Initial Attack Vectors
PRACTICE ! PRACTICE ! PRACTICE !
Anonymous $IPC share READ Access
If we have a READ access to IPC$ without authentication, we can list the domain users as an anonymous user
AS-REP Roasting
AS-REP roasting is a technique against Kerberos that allows password hashes to be retrieved for users that do not require pre-authentication
If the user has “Do not use Kerberos pre-authentication” - Enabled, then an attacker can recover a Kerberos AS-REP encrypted with the users RC4-HMAC’d password and he can attempt to crack this ticket offline
Pre-authentication is the initial stage in Kerberos authentication, which is managed by the KDC Authentication server and is meant to prevent brute-force attacks
In simple words this means that the account does not need to provide valid identification before requesting a Kerberos Ticket on the specified user account - Once after we gather all the usernames via kerbrute attack, we can use the Impacket's module
Now we can use john or hashcat to crack the kerberos ticket :)
LLMNR Poisoning
LLMNR => Link Local Multicast Name Resolution - Basically DNS
Used to identify hosts when DNS fails to do
Previously known as NBT-NS (Netbois Name Service)
So the key flaw is that when we respond to this service it actually responds back to us with the user's username with thier NTLMv2 hash (Password Hash)
Basically a MITM attack where the victim requests the server to access some resouce or share and happens to enter the resource or share name wrong
Ultimately the DNS fails to resolve the particular request and we sitting in the middle - We act like a legitimate service or user knowing the share or resource the victim wants to access and let him know that I know what your talking about
Send me the hash and i'll connect you with the share or resource via responder
And the attacker gets the NTLMv2 hash :)
Now that we have the NTLMv2 hash of the rgeller user, we can simply psexec into the machine via Pass the hash attack or we'll have to try cracking the hash to get the plain-text password !
SMB Relay Attacks
Only applicable when SMB signing is disabled or SMB signing is enabled, but not required and the user must be an Administrator on the computer !
Turn off SMB and HTTP on Responder.conf file, run the responder to listen on the interface eth0 and meanwhile run the ntlmrelayx.py tool
Turn on Network Discovery and File Sharing !
If suppose the SMB incident doesn't relay back to the attack machine, try navigating to the attacker's IP using the victim's browser as we disabled HTTP and SMB in our configuration file :)
We can get an Interactive shell using the -iswitch via the ntlmrelayx.py impacket module
It started an interactive shell on localhost port 11000
We can list out the available shares and use them accordingly !
We can pretty much add,get files into/fromthe ADMIN$ share (Basically System32) and take control over the system :)
Create a meterpreter executable payload like exploit.exe and execute it using the
-eswitch via the ntlmrelayx impacket module !We can even execute system command via the
-cswitch via the ntlmrelayx
Mitigation Strategies
Enable SMB Signing on all the devices
Disable NTLM authentication on network
Account tiering
Local admin restriction
Gaining Shell Access
We can use metasploit's psexec module (exploit/windows/smb/psexec) to gain a shell on the machine or we can even use the powershell module (exploit/windows/smb/psexec_psh)
We can even use the Impacket's psexec module
IPv6 DNS Attacks
Every windows or linux machine have a network adapter which has several interfaces, the most two common ones are IPv4 and IPv6 interfaces, every machine utilizes the IPv4 address for which the DNS is set - But what about IPv6, whose doing DNS for v6 ?, it is enabled but not used !
So the attacker be like, Hey I'm your DNS so i'm gonna spoof the DNS Server, So send all the IPv6 traffic to me :)
The issue here is we can get the authentication to the DC via LDAP protocol or via SMB
Before starting the Attack, make sure LDAPs is up and configured on the DC
Now let's reboot our victim machine so that it restarts all the machine's configs such as DHCP and DNS for all the network interfaces
Now IPv6 is asking the network like whose got my DNS, since we are relaying for connections using the impacket module and have our mitm set, we pretend to be the DNS serving for the IPv6
It has created a new directory called lootme, which contains all the domain_computers, groups, policy, trusts information and thier descriptions in plain text format !
Mitigation Strategies
Pass-Back Attacks - Exploiting IoT
Other Attack vectors and Strategies . . . . .
Begin the day with mitm6 or Responder
Especially when the users login to thier computers, morning around 8 or after a lunch break
Run scans to generate traffic
If scans are taking too long, look for websites in scope (Metasploit module => http_version)
Look for default credentials on web logins => Printers - Jenkins etc
Last updated
