Edit

Module 23: Lateral Movement in Active Directory

Active Directory Lateral Movement Techniques

WMI and WinRM

WMI communicates through Remote Procedure Calls (RPC) over port 135 for remote access and a port between 19152 and 65535 for session data.

Using wmic to launch a remote process:

C:\Users\jeff>wmic /node:192.168.50.73 /user:jen /password:Nexus123! process call create "calc"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
        ProcessId = 752;
        ReturnValue = 0;
};

Using PowerShell requires a few more steps:

// Creating teh PSCredential object
PS C:\Users\jeff> $username = 'jen';
PS C:\Users\jeff> $password = 'Nexus123!';
PS C:\Users\jeff> $secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
PS C:\Users\jeff> $credential = New-Object System.Management.Automation.PSCredential $username, $secureString;

// Creating a Common Information Model (CIM) via the New-CimSession cmdlet.
PS C:\Users\jeff> $options = New-CimSessionOption -Protocol DCOM
PS C:\Users\jeff> $session = New-Cimsession -ComputerName 192.168.50.73 -Credential $credential -SessionOption $options 
PS C:\Users\jeff> $command = 'calc';

// Invoking the CIM Method.
PS C:\Users\jeff> Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};

ProcessId ReturnValue PSComputerName
--------- ----------- --------------
     3712           0 192.168.50.73

Using python to encode a PowerShell reverse shell, so we don't need to escape any special characters when inserting it as a WMI payload:

WinRM communicates over TCP port 5986 for encrypted HTTPS traffic and 5985 for plain HTTP.

Utilizing WinRM via winrs to execute remote commands:

Utilizing WinRM via New-PSSession to execute remote commands:

PsExec

PSExec needs three things to be used for lateral movement:

  1. The user that authenticates to the target machine needs to be part of the Administrators local group

  2. The ADMIN$ share must be available

  3. File and Printer Sharing must be turned on

By default, those last two requirements are met on modern Windows Server systems.

Using psexec to start an interactive cmd prompt on a remote device:

Pass the Hash

Pass the Hash (PtH) allows us to authenticate to a remote system or service using a user's NTLM hash instead of their plaintext password. This will only work for servers or services using NTLM authentication. Not fo rservers/services using Kerberos authentication.

PtH also has three requirements:

  1. SMB through the firewall must be open (commonly port 445)

  2. Windows File and Printer Sharing must be enabled

  3. The ADMIN$ must also be available.

Using wmiexec to pass the hash:

Overpass the Hash

With Overpass the Hash we can "over" abuse an HTLM user hash to gain a full Kerberos Ticket Granting Ticket (TGT). This can then be used to obtain a Ticket Granting Service (TGS).

Grabbing the NTLM hash:

Overassing this hash to spawn a new powershell session:

Listing cached Kerberos tickets:

Generating a TGT by authenticating to a network share:

Using psexec to launch a remote cmd on our target:

Pass the Ticket

Exporting all the TGT/TGS from memory via mimikatz:

Viewing all the exported tickets:

Injecting the tickets:

DCOM

Instantiating a remote MMC 2.0 application via an Administrative PowerShell prompt:

Example using the above to spawn a reverse shell:

Active Directory Persistence

Golden Ticket

If we can get our hands on krbtgt's password hash, we can create our own self-made custom TGTs, AKA golden tickets.

Assuming we have the SID and hash for krbtgt's password, it's time to generate a golden ticket:

Using our ticket to connect to the DC:

If we were to connect PsExec to the IP address of the domain controller instead of the hostname, we would instead force the use of NTLM authentication and access would still be blocked.

Shadow Copies

As a domain admin, we can abuse the vshadow utility to create a Shadow Copy that will allow us to extract the Active Directory Database NTDS.dit database file. Once a coyp is obtained, we need teh SYSTEM hive, then we can extract every user credential offline in our local Kali machine.

Creating that snapshot with writers disabled:

Copying the whole AD Database:

Saving the SYSTEM hive:

Using impacket-secretsdump to extract the credentials:

PreviousModule 22: Attacking Active Directory AuthenticationNextModule 24: Enumerating AWS Cloud Infrastructure

Last updated