search
WINDOWS & ADABOUT ME
HackTheBoxActiveDirectoryWindowsVulnLabs

Delegate

A full AD compromise of the "Delegate" Box. Initial access via hardcoded SMB credentials leads to Domain Admin by chaining Targeted Kerberoasting, Unconstrained Delegation, and PetitPotam coercion.

hashtag
1. Reconnaissance and Enumeration

The engagement began with a standard port scan using nmap against the target IP (10.129.234.69).

The scan revealed a Windows Server 2022 machine acting as a Domain Controller for delegate.vl. Standard Active Directory ports were open, including DNS (53), Kerberos (88), LDAP (389, 636, 3268, 3269), SMB (445), and WinRM (5985). With SMB open, the next step was to check for null session or Guest access using NetExec (nxc).

  • SMB Share Enumeration: Logging in as the Guest user with a blank password successfully enumerated the standard NETLOGON and SYSVOL shares.

  • RID Brute Forcing: Using the Guest session, RID brute-forcing revealed several custom domain users, including A.Briggs, N.Thompson, and a custom group named delegation admins.

hashtag
2. Initial Access

Accessing the NETLOGON share anonymously via smbclient revealed a script named users.bat. Downloading and inspecting this batch file yielded hardcoded credentials for a domain user:

Further enumeration using these valid credentials confirmed that the ms-DS-MachineAccountQuota attribute was set to the default value of 10, meaning standard users could add up to 10 computer accounts to the domain.

hashtag
3. Lateral Movement: Targeted Kerberoasting

With a foothold as A.Briggs, the next phase involved enumerating Active Directory object permissions using bloodyAD.

The output revealed a critical misconfiguration: A.Briggs had WRITE (GenericWrite) privileges over the user object N.Thompson.

This permission allows an attacker to modify attributes on the target user. To exploit this, a Targeted Kerberoasting attack was executed:

  1. Setting a Fake SPN: Because A.Briggs has write access, bloodyAD was used to register a dummy Service Principal Name (fake/service) on N.Thompson's account. This action transforms N.Thompson into a service account in the eyes of Active Directory.

  1. Requesting the Ticket: Impacket's GetUserSPNs.py was then used to request a Ticket Granting Service (TGS) ticket for this newly created SPN. The Domain Controller responded with the ticket, which is encrypted with N.Thompson's password hash.

  1. Offline Cracking: The TGS hash was saved and run through hashcat (mode 13100) using the rockyou.txt wordlist. The password was successfully cracked in under 10 seconds:

N.Thompson's Password: KALEB_2341 Using these new credentials, WinRM access was achieved via evil-winrm, and the user.txt flag was captured.

hashtag
4. Privilege Escalation: Unconstrained Delegation and Coercion

Logging in as N.Thompson provided a deeper level of access. Because N.Thompson belongs to the delegation admins group, they possess elevated privileges regarding delegation settings.

The path to Domain Admin involved abusing Unconstrained Delegation combined with NTLM coercion.

hashtag
Step 4a: Infrastructure Setup

  1. Creating a Machine Account: Impacket's addcomputer.py was used to create a new computer account named delegator$ with a known password.

Enabling Unconstrained Delegation: bloodyAD was used to modify the userAccountControl property of delegator$, adding the TRUSTED_FOR_DELEGATION flag.

DNS and SPN Configuration: To ensure the upcoming relay attack routed correctly, dnstool.py added an A record pointing delegator.delegate.vl to the attacker's IP address. addspn.py then registered a CIFS SPN to the delegator$ account.

hashtag
Step 4b: Coercion and TGT Capture

With the trap set, krbrelayx.py was started on the attacker machine, listening for incoming connections and configured to extract Kerberos tickets.

Next, PetitPotam was used to coerce the Domain Controller (DC1) into authenticating against the attacker-controlled machine (delegator.delegate.vl).

  • When DC1 reached out to the attacker machine, it saw the TRUSTED_FOR_DELEGATION flag.

  • Because of Unconstrained Delegation, DC1 sent its own Ticket Granting Ticket (TGT) along with the authentication request, allowing the service to impersonate the DC.

  • krbrelayx successfully captured the TGT for [email protected] and saved it to a .ccache file.

hashtag
Step 4c: DCSync and Domain Admin

The captured TGT effectively granted the attacker the identity of the Domain Controller itself.

  1. The KRB5CCNAME environment variable was exported to use the captured TGT.

  2. Impacket's secretsdump.py was executed to perform a DCSync attack. Because the DC has replication rights, it dumped the NTDS.DIT secrets, yielding the NTLM hash for the Administrator account

  1. Finally, a Pass-The-Hash attack via evil-winrm provided an interactive shell as the Administrator, allowing for the retrieval of the root.txt flag.

hashtag
5. Executive Summary

During the engagement against the delegate.vl environment, multiple critical Active Directory misconfigurations were identified and chained together to achieve complete domain compromise. The attack path transitioned from unauthenticated enumeration to Domain Admin by exploiting a combination of poor credential management, overly permissive Access Control Lists (ACLs), and dangerous delegation settings.

Attack Path Overview:

  1. Anonymous Access: Guest access to SMB shares revealed a batch script containing hardcoded domain credentials.

  2. Insecure ACLs: The compromised user possessed GenericWrite privileges over another user account, allowing the attacker to register a Service Principal Name (SPN) and perform a Targeted Kerberoasting attack to capture their password.

  3. Privilege Escalation: The second compromised user had the ability to configure Active Directory delegation. By creating a new machine account, configuring it for Unconstrained Delegation, and forcing the Domain Controller to authenticate to it (via PetitPotam), the attacker captured the Domain Controller's TGT, ultimately dumping the NTDS.dit database and retrieving the Domain Administrator hash.

hashtag
6. Remediations & Mitigations

To secure the delegate.vl domain against the attack vectors demonstrated in this write-up, the following remediation steps should be implemented:

hashtag
A. Secure SMB and Credential Management

  • Disable Guest/Anonymous Access: Ensure that anonymous and Guest access to SMB shares (like NETLOGON and SYSVOL) is strictly disabled to prevent unauthenticated enumeration.

  • Remove Hardcoded Credentials: Never store passwords in cleartext within logon scripts, batch files, or documentation. Utilize secure password managers or localized LAPS (Local Administrator Password Solution) for credential management.

hashtag
B. Restrict Machine Account Creation

  • Modify ms-DS-MachineAccountQuota: By default, Active Directory allows any authenticated user to add up to 10 computer accounts to the domain. This attribute should be changed from 10 to 0 to prevent attackers from creating arbitrary machine accounts for use in delegation and relay attacks.

hashtag
C. Audit Active Directory ACLs (Targeted Kerberoasting)

  • Enforce Least Privilege: Review Active Directory object permissions, specifically looking for users or groups with unnecessary GenericAll, GenericWrite, or WriteProperty permissions over other users. A.Briggs should not have had the ability to modify N.Thompson's attributes.

  • Strong Passwords: Ensure that any account requiring an SPN (Service Accounts) utilizes a complex, randomly generated password of at least 25-30 characters to make Kerberoasting offline cracking mathematically infeasible.

hashtag
D. Mitigate Unconstrained Delegation & Coercion

  • Disable Unconstrained Delegation: Unconstrained delegation is a legacy feature that is inherently unsafe because it caches the TGT of any user who authenticates to the service. Transition all services using Unconstrained Delegation to Constrained Delegation or Resource-Based Constrained Delegation (RBCD).

  • Protect Sensitive Accounts: Add highly privileged users (like Domain Admins) to the Protected Users security group, and check the "Account is sensitive and cannot be delegated" box on their AD account objects. This prevents their credentials from being delegated even if they authenticate to a compromised server.

  • Patch RPC Coercion Vulnerabilities: Apply the latest Microsoft security patches to mitigate MS-EFSRPC (PetitPotam) coercion attacks. Additionally, consider disabling the EFS service on Domain Controllers if it is not actively required.

  • Enforce SMB Signing: Require SMB signing across the domain to prevent NTLM relay attacks from being used to compromise other endpoints.

PreviousSweepNextBruno

Last updated