Instructor: Okay, welcome back.
Let's continue with our attacktive directory.
So, what we did, for now, is we performed the two tasks
of enumerating our attacktive directory
and gathering users via "Kerberos".
This is the interesting information that we found
as we see admin gave us hash
and we, also, noticed an unusual backup account,
which had a valid username response.
Okay, so, now, since, we answered all of these questions,
let's move on to the task number five,
which is exploitation or abusing "Kerberos".
So, here, we could read the introduction.
So, after the enumeration of user accounts is finished,
we can attempt to abuse a feature within "Kerberos"
with an attack method called "ASREPRoasting".
"ASREPRoasting" occurs when a user has the privilege,
"Does not require pre-authentication" set.
This means that the account does not need
to provide valid identification
before requesting a "Kerberos" ticket
on the specified user account.
Now, if you read about active directory in "Kerberos",
you will know,
or you will notice the term "Kerberos" tickets.
And in this exploitation part,
we are going to need a tool called "Impacket"
that will allow us to generate this attack.
So, if you click on the "Impacket",
it'll allow you to download the tool.
I have already downloaded it,
so, I have it on my "Calinix" machine.
But if you didn't, you need to download it first.
The tool that we will need for this lecture,
is called "GetNPUsers.py",
which is a part of the "Impacket"
and it will be located wherever your "Impacket" is,
slash examples
and there, you will see the tool.
This will allow us to query "ASReproastable" accounts
from the key distribution center.
The only thing that's necessary to query accounts,
is a valid set of usernames,
which we enumerated previously via "Kerbrute".
Here, it gives us a note that "Impacket" may, also, need us
to use the "Python" version that is above 3.7.
And since, I, already, have that,
that's good for me.
We can go and proceed to the questions.
So, "We have two user accounts
that we could, potentially, query a ticket from.
Which user account can you query a ticket from
with no password?"
And the answer is here, is "svc-admin",
since, we got the hash for it.
But let's, also, get it
with a tool provided to us by "Impacket",
we, already, got the hash from here.
But if I go and change my directory
to "/opt/impacket/examples"
and I run the "python3 GetNPUsers",
(typing on the keyboard)
it should open the help menu.
Here, we have the help menu
and here, we have a small example of the commands
that we can run.
So, for example, "Get a TGT for a user",
which is useful for us.
Here, is how we can do that.
So, "GetNPUsers.py",
then, we provide the domain, the full domain
to the active directory
and then, the account that we are targeting.
So, let's try that.
We, also, need to use the "-no-pass" option,
which is described, I think, right here.
For this operation, you don't need the account's password.
It is, however, important to specify this "-no-pass" option
in the script.
Okay, so, let's give it a try,
"python3 GetNPUsers"
(typing on the keyboard)
and let me just clear the screen first.
So, "python3 GetNPUsers"
and, here, we want to use our domain,
which is "spookysec.local".
We want to target the account,
we can do that by providing the slash and the account name
after the domain.
Then, as we were told, we can use the "-no-pass" option
and I'll use the "-dc-ip", just to provide the "IP" address,
in case, it can't find it on the network, or over "VPN".
(clicks)
Okay, awesome.
So, this command should be complete.
And if I run it,
here, it is.
We got the "TGT" for "svc-admin",
the same output that we got once, running the "Kerbrute".
In the previous lecture, we got the hash value
of the password.
And, now, all we need to do
to get the password of the "svc-admin" account,
is to crack this hash.
Now, we do have the password list from the previous lecture
that we downloaded,
so, we're going to use that to crack the password.
Now, you can, already, answer some of the questions,
right here.
The "svc-admin" is answered for the first question.
And "Looking at the Hashcat example,"
now, this is not that important,
these two are not that important.
But if you want to answer,
the answer is "Kerberos 5 AS-REP etype 23"
And "What mode is the hash?"
I didn't, really, search this,
but you can give it a try.
Try to search it and paste it right here.
But once again, it's not that important.
What is important, is for us to crack this hash.
So, copy the entire hash and let's go to desktop,
let's "nano hash.txt"
(typing on the keyboard)
and we can save it right here, "Paste Clipboard"
and we can just save the hash, right?
And now, you can use any tool that you want
to crack this hash.
The easiest one would, probably, be to use "john",
since, all we need to do,
is specify "john hash.txt --wordlist"
and, here, we specify which wordlist we want to use
and we want to use the one
that's provided to us in this specific challenge,
which is this "Passwordlist.txt".
And once, I press enter,
here it is.
It managed to crack the password
and the password is "management2005",
which is, also, the answer to the last question, right here.
"Crack the hash with modified password list provided,
what is the user accounts password?"
The user accounts password is "management2005".
Okay, now, this can be considered
as full exploitation being over,
since, we managed to compromise the account.
But let's see, what we can do
with this password that we cracked.
So, let's move on to the next part of the enumeration,
which is right after the exploitation.
And let's see, what things we can do, right here.
So, with the user's account credentials
we, now, have significantly more access within the domain.
We can, now, attempt to enumerate any shares
that the domain controller may be giving out.
Okay, for this,
(typing on the keyboard)
to enumerate, we can use "smbclient".
Now, "smbclient" will most likely need to be used
with "sudo" (indistinct) type,
"sudo smbclient",
with "-U" option, we specified the domain
with the account that we want to log into.
So, let's specify "spookysec.local",
we want to use "svc-admin"
and we want to use "-L" option
and "-L" option in the "smbclient" is used
to list all the shares on the domain.
All we need to do, is specify the "//"
and then, the "IP" address of the domain.
I think, we, already, have it copied,
or no, we do have the hash copied now.
So, let me just re-copy the domain,
(clicks)
paste it right here.
And the first thing that it will ask,
is for the "sudo" password
and then, it'll ask for the "svc-admin" password.
We, already, cracked it
and we know, that the password is "management2000".
Okay, so, for some reason,
we get the "NT_STATUS_LOGON_FAILURE".
So, I might have typed it incorrectly.
Let me just-
(typing on the keyboard)
okay, here it is.
Now, it worked and now, we can see all the shares
that are in this domain.
So, we can see there is six of them,
we have "ADMIN$", we have this "backup",
which, once again, is interesting to us,
we have "C$", "IPC$", "NETLOGON" and "SYSVOL".
And the reason why "backup" is interesting to us,
is because it's not common to be here.
Others are common to be here
and "backup" is something that's sticking out, once again.
So, to answer some of these questions,
"What utility can we use to map remote SMB shares?"
We, already, saw.
It's "smbclient".
We can provide it, right here, as answer.
Which option we use to list the shares?
So, we use the "-L" option
and that will, also, be the correct answer.
"How many remote shares is the server listing?"
We counted that to be six,
right here.
And there is one particular share that we have access to
that contains a text file.
Now, we didn't really come up to here, yet.
So, let's see, whether do we, indeed, have access
to the backup share?
Okay, so, we can, also, once again, use "smbclient"
to access the shares, so, "sudo smbclient",
we provide "-U" with the domain and the account,
so, "svc-admin".
And only thing we need to do,
we no longer need to use the "-L" option,
we just need to specify the "IP" address
and, also, the share that we want to access.
So, in our case,
we want to access the backup share,
which we should be able to,
(typing on the keyboard)
once, entering the "svc-admin" password.
And here, if I type "dir",
we get one file in the directory,
which is the "backup_credentials",
since, let me see, if "pwd" is working.
So, "pwd" is working and the current directory is "backup".
So, we successfully entered the backup share,
or the backup directory
and we have one file, which is "backup_credentials.txt",
which, of course, will be interesting to us.
So, let's use "get" command to get "backup_credentials".
And we can see,
it is downloaded, right here, on the desktop.
And the reason, it's on the desktop,
is because my terminal is, currently,
in the desktop directory.
So, that's where it got downloaded.
Now, of course,
I did not know this at the start
that we, only, have access to the backup account.
But if you give a try to some other share that we saw,
such as, for example, "ADMIN$"
and you type in the password,
(typing on the keyboard)
we will get "ACCESS_DENIED" error.
And the only one
that doesn't get "ACCESS_DENIED" error,
is "backup" account.
So, now, that we've downloaded our "backup_credentials",
(typing on the keyboard)
we can "cat" it to see the output
and the output seems weird, right?
Well, you will, eventually, find out
that this is "Base64"
and this can be decoded.
But let's, first, answer the fifth question in this task,
which is "What is the content of the file?"
The content of the file is this,
we just copy it and paste it, right here
and we got the correct answer.
Now, to decode this, we can use any online decoders.
So, just type "base64 decode"
(typing on the keyboard)
and we can use any website that pops up.
Just make sure that we copy this first.
(clicks)
Go to this website, since, I, already, used it before,
let's use it again
(clicks)
and let's paste this.
Just zoom this in, so, we can see it a little bit better.
(clicks)
And if I click on "DECODE",
okay, here it is,
"backup@spookysec.local"
and this would be the password.
So, we successfully got the output,
or the password for the backup account
after we decoded the "backup_credentials"
from "Base64".
Now, you can answer this question, right here,
which is "Decoding the contents of the file,
what is the full content?"
You just copy the output that we got
and you paste it, right here.
Okay, awesome.
So, we successfully compromised, technically, two accounts.
We compromised the "svc-admin" and the "backup" account,
or we got the "backup_credentials",
once, we logged in as "svc-admin",
since, "svc-admin" had access to the backup share,
but it didn't have access to other shares.
So, there's a little bit of a vulnerability, right there,
since, we did have access to the "backup" account,
which provides us with "backup_credentials".
But we cannot access any other share,
which is quite contradictory,
since, we can just use the "backup" account
to access other shares,
which we will see, in the next lecture.
So, we successfully compromised one account for now
and let's see, how we can perform privilege escalation
in the next lecture.
See you there.