search

ACL Abuse Tactics

hashtag
Sample Exploitation

We are in control of the wley user whose NTLMv2 hash we retrieved by running Responder earlier in the assessment. Lucky for us, this user was using a weak password, and we were able to crack the hash offline using Hashcat and retrieve the cleartext value. We know that we can use this access to kick off an attack chain that will result in us taking control of the adunn user who can perform the DCSync attack, which would give us full control of the domain by allowing us to retrieve the NTLM password hashes for all users in the domain and escalate privileges to Domain/Enterprise Admin and even achieve persistence. To perform the attack chain, we have to do the following:

  1. Use the wley user to change the password for the damundsen user

  2. Authenticate as the damundsen user and leverage GenericAll rights to add a user that we control to the Help Desk Level 1 group

  3. Take advantage of nested group membership in the Information Technology group and leverage GenericAll rights to take control of the adunn user

hashtag
Login as wley and force change the password of the user damundsen

Login as wley

PS C:\htb> $SecPassword = ConvertTo-SecureString '<PASSWORD HERE>' -AsPlainText -Force
PS C:\htb> $Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\wley', $SecPassword)

Change the password of damundsen using powerview

PS C:\htb> $damundsenPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force
PS C:\htb> cd C:\Tools\
PS C:\htb> Import-Module .\PowerView.ps1
PS C:\htb> Set-DomainUserPassword -Identity damundsen -AccountPassword $damundsenPassword -Credential $Cred -Verbose

VERBOSE: [Get-PrincipalContext] Using alternate credentials
VERBOSE: [Set-DomainUserPassword] Attempting to set the password for user 'damundsen'
VERBOSE: [Set-DomainUserPassword] Password for user 'damundsen' successfully reset

hashtag
Login as damundsen and add damunsend to the Help Desk Level 1 group

Login as damundsen

Add damundsen to the group

Confirm if damundsen was added to the group

hashtag
Utilize nested group membership for GenericAll rights to control adunn user

We must be authenticated as a member of the Information Technology group for this to be successful. Since we added damundsen to the Help Desk Level 1 group, we inherited rights via nested group membership. We can now use Set-DomainObjectarrow-up-right to create the fake SPN. We could use the tool targetedKerberoastarrow-up-right to perform this same attack from a Linux host, and it will create a temporary SPN, retrieve the hash, and delete the temporary SPN all in one command.

Creating a Fake SPN

Kerberoasting with Rubeus

The last step is to attempt to crack the password offline using Hashcat. Once we have the cleartext password, we could now authenticate as the adunn user and perform the DCSync attack

hashtag
Cleanup

In terms of cleanup, there are a few things we need to do:

  1. Remove the fake SPN we created on the adunn user.

  2. Remove the damundsen user from the Help Desk Level 1 group

  3. Set the password for the damundsen user back to its original value (if we know it) or have our client set it/alert the user

hashtag
Removing the Fake SPN from adunn's Account

hashtag
Removing damundsen from the Help Desk Level 1 Group

hashtag
Confirming damundsen was Removed from the Group

PreviousACL EnumerationNextDCSync

Last updated