Ctrlk
About meBook a Meeting
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Edit

Attacking Active Directory & NTDS.dit

  • Once a Windows system is joined to a domain, it will no longer default to referencing the SAM database to validate logon requests.

    • This does not mean the SAM database can no longer be used.

    • to log on using a local account in the SAM database can still do so by

      • specifying the hostname of the device proceeded by the Username (Example: WS01/nameofuser)

      • or with direct access to the device then typing ./ at the logon UI in the Username field.

Launching the Attack with CrackMapExec

crackmapexec smb 10.129.201.57 -u bwilliamson -p /usr/share/wordlists/fasttrack.txt

  • if the admins configured an account lockout policy, this attack could lock out the account that we are targeting

  • At the time of this note (January 2022), an account lockout policy is not enforced by default with the default group policies that apply to a Windows domain, meaning it is possible that we will come across environments vulnerable to this exact attack we are practicing.

Capturing NTDS.dit

  • NT Directory Services (NTDS) is the directory service used with AD to find & organize network resources.

    • the NTDS.dit file is stored at %systemroot%/ntds on the domain controllers in a forest. The .dit stands for directory information tree.

    • This is the primary database file associated with AD and stores all domain usernames, password hashes, and other critical schema information

Evil-WinRM

Checking Local Group Membership

net localgroup

Checking User Account Privileges including Domain

  • This account has both Administrators and Domain Administrator rights which means we can do just about anything we want, including making a copy of the NTDS.dit file.

Creating Shadow Copy of C:

  • When all the components support Volume Shadow Copy (VSS), you can use them to back up your application data without taking the applications offline

  • We can use vssadmin to create a Volume Shadow Copy (VSS) of the C: drive or whatever volume the admin chose when initially installing AD.

    • It is very likely that NTDS will be stored on C: as that is the default location selected at install, but it is possible to change the location.

Copying NTDS.dit from the VSS

Crack the NT hash with hashcat

Pass-the-Hash Considerations

PreviousPypykatzNextEvil-WinRM

Last updated