Category: Walkthroughs

Active Directory Hacking with Kali: Attackative Directory

OluwatobiLeave a comment

Introduction

For my fifth machine in the Active Directory hacking with Kali series, I’ll be pwning attackative directory from tryhackme. Attackative directory is an easy active directory machine that teaches the basics of active directory enumeration and ASREPROASTING attacks.

Recon

Initial Nmap scan

Detailed Nmap Scan

SMB Enumeration

Crackmapexec RID brute

Found some domain users

Save users into a text file

Try ASREPROAST on discovered users

We discover the user svc-admin is Asreproasteble and save the obtained hash into a file to be cracked

Exploitation

SVC-Admin’s password cracked with john

Let’s spray this password with crackmapexec, we have access to SMB

Enumerate share access with SMB Map

We have access to three shares, backups is a non-default share so lets check it out first

Interesting a credentials file… download locally and open

decode the base64 text

Try evil-winrm with back creds …

No luck..

Try dumping secrets with Impacket-SecretDump.py

We get admin hash!

Use evil-winrm to pass the hash and profit

Active Directory 101: Sauna

OluwatobiLeave a comment

Introduction

For my third machine in the Hackthebox AD 101 track, I’ll be pwning Sauna. Sauna is an easy active directory machine that teaches the basics of ASREPROASTING and Domain Replication Attacks . The attack path to domain admin wasn’t complicated and was a good test of how much I’ve learned so far. Initial access was achieved by obtaining and cracking the TGT of a non-preauthenticated user. Upon discovery and compromise of a user with DC Sync rights I was able to escalate privileges by dumping and passing the NTLM hash of the domain administrator.

Read more “Active Directory 101: Sauna”

Active Directory 101: Forest

OluwatobiLeave a comment

Introduction

For my second machine in the Hackthebox Active Directory 101 track, I’ll be pwning Forest. Forest is another active directory machine that teaches the basics of ASREPROASTING and abusing Discretionary Access Control Lists (DACL). The attack path to domain admin was quite new to me as I learnt another AD privilege escalation technique. For this box, initial access was gained by sending a dummy TGT request to obtain the credentials of a Non-preauthenticated user. Following post compromise enumeration, I was able to become domain admin by first abusing access control rights to a domain object then launching a DC SYNC attack to obtain NTLM hashes for all domain users and administrators.

Reconnaissance

Read more “Active Directory 101: Forest”

Active Directory 101: Active

OluwatobiLeave a comment

Introduction

For my first machine in the Hackthebox Active Directory 101 track, I’ll be pwning Active. Active is an active directory machine that teaches the basics of GPP attacks and kerberoasting. The attack path to domain admin was quite straightforward following a brief introduction to AD hacking by TCM, for this box, initial access was gained via a poorly configured SMB share containing a windows group policy preference configuration file (groups.xml), then kereberoasting was leveraged to escalate privileges.

Read more “Active Directory 101: Active”