Listen to this Post
Introduction:
In the relentless arms race of Active Directory security, post-exploitation tooling evolves to unearth deeper secrets. The latest update to NetExec, a powerful offensive security tool, introduces game-changing flags `–history` and `–kerberos-keys` that dramatically enhance credential extraction from the critical NTDS.dit database. This advancement transforms a standard hash dump into a comprehensive credential harvesting operation, exposing password histories and critical Kerberos authentication keys that can enable persistent, stealthy domain dominance.
Learning Objectives:
- Understand the function and exploitation significance of the NTDS.dit database.
- Learn to use NetExec’s new `–history` and `–kerberos-keys` flags for advanced credential extraction.
- Develop defensive strategies to detect and mitigate attacks targeting password histories and Kerberos keys.
You Should Know:
1. The NTDS.dit Goldmine: Beyond NTLM Hashes
The NTDS.dit file is the heart of an Active Directory domain, storing all user objects, their NTLM password hashes, and additional authentication data. Traditionally, tools like Impacket’s `secretsdump.py` have extracted current hashes. NetExec, often acting as a wrapper and enhancer for Impacket, now streamlines and extends this process.
Step‑by‑step guide explaining what this does and how to use it.
First, you must already have obtained Domain Admin or equivalent privileges and gained access to the Domain Controller (DC). The classic method involves using the Domain Replication Service (DRS) protocol to remotely dump the NTDS.dit. With NetExec, this becomes a one-line command.
Command (Linux):
nxc smb <DC_IP> -u <Administrator_User> -p <Password_or_Hash> --ntds
This foundational command retrieves the standard NTLM hashes. The new capabilities build directly upon this access.
2. Harvesting Password History: Cracking the User’s Pattern
The `–history` flag is a significant escalation. It extracts previous password hashes stored for each user. Password history is maintained to enforce “password uniqueness” policies, but when compromised, it allows attackers to perform offline cracking against a user’s historical passwords. Users often create passwords with minor, predictable variations, making historical hashes a treasure trove for password analysis and pattern recognition.
Step‑by‑step guide explaining what this does and how to use it.
To dump both current and historical password hashes, append the `–history` flag. The output will list each user’s current hash followed by their historical hashes.
Command (Linux):
nxc smb <DC_IP> -u <Administrator_User> -p <Password_or_Hash> --ntds --history
Analysis & Cracking:
Feed the captured historical hashes into a tool like Hashcat. Identifying a pattern (e.g., Summer2023!, Summer2024!) can help tailor wordlists for brute-force attacks against the current password or other services.
3. Stealing Kerberos Keys: The Golden Ticket Upgrade
The `–kerberos-keys` flag is perhaps even more powerful. It extracts AES-256, AES-128, and DES encryption keys associated with user and computer accounts. These keys are used for Kerberos authentication. Possessing a user’s AES key allows an attacker to request Ticket-Granting Tickets (TGTs) without the password, a technique known as “Overpass-the-Hash” but more accurately as “Pass-the-Key.” This is stealthier than NTLM relay and unaffected by credential rotation if the key material remains unchanged.
Step‑by‑step guide explaining what this does and how to use it.
Execute NetExec with the new flag to retrieve these keys. The output will include the Kerberos keys for each account.
Command (Linux):
nxc smb <DC_IP> -u <Administrator_User> -p <Password_or_Hash> --ntds --kerberos-keys
Usage with Impacket:
Once you have an AES-256 key (e.g., aes256-cts-hmac-sha1-96:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX), you can use it to request a TGT:
Command (Linux):
python3 /usr/share/doc/python3-impacket/examples/getTGT.py -hashes :<NTLM_Hash> -aesKey <AES256_KEY> <DOMAIN>/<USER> OR using the key directly: python3 /usr/share/doc/python3-impacket/examples/getTGT.py -k -no-pass -dc-ip <DC_IP> <DOMAIN>/<USER>
Export the resulting `ccache` ticket (KRB5CCNAME=), and use it with tools like `psexec.py` or `wmiexec.py` for lateral movement.
4. Defensive Detection: Hunting for NTDS.dit Access
Defenders must monitor for unauthorized access to the NTDS.dit file or the `lsass.exe` process on Domain Controllers. Key Event IDs to alert on include:
– Windows Event ID 4662 (LSASS): An operation was performed on an object. Filter for `Object Name` containing \Device\HarddiskVolumeShadowCopy.
– Windows Event ID 4656 (LSASS): A handle to an object was requested. Suspicious process names (ntdsutil.exe, vssadmin.exe, diskshadow.exe) or unknown binaries.
– Windows Event ID 4672: Special privileges assigned to new logon. Look for `SeBackupPrivilege` or `SeDebugPrivilege` being activated for suspicious accounts.
5. Mitigation Strategies: Hardening the Crown Jewels
Credential Guard (Windows 10/11 & Server 2016+): Isolates `lsass.exe` and protects Kerberos-derived credentials in a virtualized container, making direct memory extraction harder.
Restricted Admin Mode & Remote Credential Guard: Mitigates Pass-the-Hash and Pass-the-Key for RDP sessions.
LAPS (Local Administrator Password Solution) & Enhanced MFA: Limit lateral movement paths. MFA for privileged logins disrupts the use of stolen keys/hashes in real-time.
Regular Kerberos Account Resets: While disruptive, resetting the Kerberos keys (via password change) invalidates stolen AES keys. Monitor for `KRB_AP_ERR_MODIFIED` errors which may indicate attempted use of stale tickets.
Network Segmentation: Limit Domain Controller access to specific administrative subnets and systems.
What Undercode Say:
- Offensive Consolidation: NetExec is evolving beyond a convenience wrapper into a consolidated offensive platform, integrating and simplifying the most potent features of underlying tools like Impacket into a single, fast command set.
- Defensive Imperative: The extraction of password history and Kerberos keys represents a shift from credential theft for immediate access to credential theft for long-term, resilient persistence. Defenders can no longer consider a password change a complete remediation after a breach; Kerberos keys must be invalidated.
Prediction:
This enhancement in NetExec will accelerate the adoption of Kerberos-based attacks (like Pass-the-Key) over NTLM in red team operations due to increased stealth and reliability. In response, we will see a faster depreciation of NTLM within enterprise networks and a more widespread, forced rollout of Kerberos-hardening features like AES encryption-only policies and Kerberos Armoring (FAST). The focus of offensive tooling will continue to shift towards abusing legitimate protocols and data (like password history) that are harder to disable without breaking functionality, pushing defense towards more sophisticated behavioral detection around authentication sequences and DC access patterns.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Alexander Neff – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
