Listen to this Post
Introduction:
The compromise of an Active Directory domain remains a primary objective for cyber adversaries, and the HackTheBox “Voleur” machine provides a masterclass in chaining together common misconfigurations to achieve full domain dominance. This attack path, from initial access to Domain Admin, leverages vulnerabilities in Kerberos, user permissions, and the Data Protection API (DPAPI) to demonstrate a realistic enterprise network intrusion.
Learning Objectives:
- Understand how to exploit excessive Active Directory permissions like WriteSPN and GenericWrite.
- Master the techniques for Kerberoasting and subsequent lateral movement.
- Learn the process of extracting and decrypting DPAPI blobs to escalate privileges.
You Should Know:
1. Initial Foothold: Cracking Protected Documents
Often, shared network drives contain seemingly innocuous files like password-protected spreadsheets that can serve as the initial entry point.
`Command (John the Ripper):`
python3 /opt/john/office2john.py file.xlsx > file.hash john --wordlist=/usr/share/wordlists/rockyou.txt file.hash
This series of commands uses the `office2john.py` script to extract the password hash from a Microsoft Office file. The hash is then fed into John the Ripper with a powerful wordlist (rockyou.txt) to crack the encryption password, potentially revealing stored credentials.
2. Enumerating User Permissions with BloodHound
Once you have initial credentials, understanding the attack paths available to that user is critical.
`Command (PowerShell – SharpHound Ingestor):`
.\SharpHound.exe --CollectionMethods All --Domain megacorp.local --LdapUser <User> --LdapPass <Password>
This command executes the SharpHound data collector, which queries Active Directory for information about users, groups, sessions, and permissions. The resulting data is then imported into the BloodHound GUI to visually map out relationships and identify high-value attack paths, such as users with `WriteSPN` or `GenericAll` permissions.
3. Abusing WriteSPN for Kerberoasting
The `WriteSPN` permission allows a user to set Service Principal Names (SPNs) on another account, which can be leveraged to create a “kerberoastable” account.
`Command (PowerShell – Targeted Kerberoast):`
Set-DomainObject -Identity TargetUser -Set @{serviceprincipalname='fake/MadeUpService'}
Rubeus.exe kerberoast /user:TargetUser /nowrap
First, a fake SPN is set on a target user account using the `WriteSPN` right. Then, Rubeus is used to request a Kerberos service ticket for that SPN. This ticket is encrypted with the target user’s password hash and can be cracked offline to recover the plaintext password.
4. Gaining Shell Access with WinRM
After obtaining a user’s credentials through Kerberoasting, you need a method to execute commands on a remote host.
`Command (Linux – Evil-WinRM):`
evil-winrm -i <Target_IP> -u <Username> -p <Password>
Evil-WinRM is a powerful shell that connects to the Windows Remote Management (WinRM) service. Upon successful authentication with the compromised credentials, it provides a command-line interface on the target Windows machine, enabling further enumeration and exploitation.
5. Leveraging GenericWrite to Restore Deleted Objects
The `GenericWrite` permission on an Organizational Unit (OU) can be abused to perform a “recycle bin” attack, restoring a deleted and potentially powerful user account.
`Command (PowerShell – Active Directory Module):`
Get-ADObject -Filter {isDeleted -eq $true -and Name -like "DeletedUser"} -IncludeDeletedObjects
Restore-ADObject -Identity "<GUID_of_Deleted_Object>"
The first command lists all deleted objects in the directory that match a specific name. The second command restores the identified object using its unique GUID. A restored account may have privileged group memberships or stored credentials in its profile.
6. Stealing and Decrypting DPAPI Master Keys
The Data Protection API (DPAPI) protects sensitive data like saved browser passwords and SSH keys. The master key file can be decrypted if you have the user’s password.
`Command (Mimikatz for DPAPI):`
mimikatz dpapi::masterkey /in:"C:\Users\<User>\AppData\Roaming\Microsoft\Protect\<SID>\<MasterKeyFile>" /password:<UserPassword>
This Mimikatz command uses the compromised user’s password to decrypt their DPAPI master key. With this master key, you can then decrypt any of the user’s `blob` files that contain protected secrets, such as private keys or saved credentials.
7. Extracting the NTDS.dit Database from WSL
Access to a Linux subsystem on a Windows host (WSL) can provide a unique avenue to critical domain assets if backups are stored there.
`Command (Linux – secretsdump.py):`
python3 /opt/impacket/examples/secretsdump.py -system /path/to/SYSTEM -ntds /path/to/ntds.dit LOCAL
This Impacket script parses the `ntds.dit` database (the Active Directory credential store) using the `SYSTEM` registry hive to decrypt it. It will output the NTLM hashes for every domain user, including the Administrator, allowing for Pass-The-Hash attacks or further cracking.
What Undercode Say:
- The entire attack chain is built upon a foundation of pervasive permission misconfigurations, not zero-day exploits. `WriteSPN` and `GenericWrite` are often granted without a full understanding of their offensive potential.
- DPAPI is a critical link in the chain of credential access. Compromising a user’s password effectively compromises all secrets protected by their master key, highlighting the need for robust credential hygiene and potentially hardware-backed keys for sensitive accounts.
The Voleur machine is a stark reminder that complex attack paths are often just a series of simple, overlooked misconfigurations. The lateral movement from a low-privilege user to domain admin was possible because defensive controls were not monitoring for the abuse of these standard permissions and features. Security teams must prioritize hardening Active Directory by adhering to the principle of least privilege, aggressively hunting for Kerberoasting activity, and securing DPAPI master keys with additional controls.
Prediction:
The techniques demonstrated in the Voleur exploit will continue to be highly relevant as they target the core, stable features of Active Directory. We predict an increase in automated tools that chain these attacks seamlessly, reducing the skill barrier for attackers. Furthermore, as cloud identities become more integrated with on-premise AD, we will see these methods adapted to abusing hybrid identity permissions, making a compromised on-premise account a direct path to cloud tenant takeover. The defense will shift towards more advanced detection engineering focused on behavior analytics rather than static IOCs.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mohamedsaber – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
