Active Directory Privilege Escalation
Traverse the Active Directory permissions to escalate your privileges and access more
Last updated
Traverse the Active Directory permissions to escalate your privileges and access more
Last updated
Windows Active Directory (AD) is meant to be a directory of resources. It mainly holds Users, Groups, and Computers allowing administrators to write policies for managing the network.
The system has gotten so big and complex that it's hard to find a secure environment. The biggest problem is sticking to backward compatibility, meaning old and insecure protocols should still be supported in the newest version, so that any two versions can work together. This causes many different versions to stay active while administrators forget about them.
Some of the main protocols found in AD are:
LDAP (Lightweight Directory Access Protocol): The "database" of AD, where resources are stored and queried
DNS (Domain Name System): Resolving domain names to IP addresses in the internal network
SMB (Server Message Block): Used for different things, mainly file sharing and printer access
NTLM & Kerberos Authentication: First came NTLM, which after many security patches, was thrown out over Kerberos. In most ADs, however, this old protocol is still used in places, or it can be forced by an attacker. See Windows Authentication for more information
Pentesting Active Directory is a game of privilege escalation. First, often some credentials or code execution is found as an entry point, and then you move throughout the network by accessing files, exploiting more services or simply abusing privileges. This is then repeated until the Domain Admin account is reached which gives full access to do anything on the domain.
Using nmap to find open ports, you can try to find any initial access for you to escalate from.
To be efficient, you will often use tooling in order to perform enumeration and attacks. A list of useful tools with a small description for each one can be found here:
Impacket is a Python library implementing many protocols used by Active Directory. Its examples/ directory houses many useful scripts for attacking a domain with different techniques, and some useful utilities. To learn what each script does, check out the work-in-progress list here:
BloodHound is a visual tool that allows you to explore and analyze big Active Directory networks by finding paths to higher privileges. To set it up, there are 3 components:
A Neo4J database to store data in the form of graphs, which BloodHound will analyze
BloodHound client to analyze the graph and find privilege escalation paths
Raw AD information like users, groups, and privileges. This is used to find paths in
These can be easily started with a Docker container:
After having started up, you should find a login page on http://localhost:3000/ui/login. In the docker logs, you will find an "Initial Password Set To:" the first time, with a random string that is the password for the admin user you should log in as. After successfully logging in, it will ask you to change the password to another strong random string, and then you are greeted with the welcome screen.
In the File Ingest page, you can press Upload Files and drag in collected data from Ingesting data.
You can follow the installation instructions to install the neo4j binary, which you can start at any time using:
This will start a database server on http://localhost:7474/ where you need to change the password for the first time. Default credentials are neo4j:neo4j, and when you log in, you are asked to set a new one. After doing so you can connect to it with BloodHound as explained below.
Download the latest release from GitHub and simply start the program. It will open a GUI application where you are required to log in with the Neo4J credentials you set, after which you will see a blank canvas.
Fetching the data from AD is done with an "ingestor". The official one is SharpHound which you run as a domain-joined user to enumerate everything they can access:
Possibly an easier way however is using the Python tool which can be run from anywhere and supports multiple ways of authentication:
You should select all these files in BloodHound when uploading data, giving it as much information as possible. Then visiting the main page again your can start to analyze the data and their connections.
Check out the following awesome post that shows the basic usage of BloodHound CE:
BloodHound will analyze and show privilege escalation paths with connections that get you from one domain object to another. It will already explain how to exploit these steps in great detail by clicking on a path, but here are a few common ones that you may be able to exploit.
The GitHub tool linked above is quite simple. It connects to the remote registry as your backup operator user and then exports the SAM, SYSTEM and SECURITY hives one by one to an SMB share you provide. This means you'll need to set up a server to receive the files, easily done with impacket:
This opens up an externally listening SMB server that writes and reads files in the local share/ folder, mounted on \share in SMB. This now allows you to run the exploit and receive all the files:
After all files have been received, the listener can be closed and you should find the three files inside of your local share/ folder. These can now be used to extract credentials in the domain:
In the output above, the 'local SAM hashes' section lists local accounts on the computer. If enabled, you can log in as the local Administrator, for example, to completely take over the Domain Controller. This is not always the case however, but another option is the 'LSA Secrets'. This shows a $MACHINE.ACC with an NTLM hash as well. This is the machine account of the target we just dumped, so the domain controller as DC01$. We can actually use this machine account to log in to places like a regular account, like on the domain controller itself. This is not disabled by default.
With administrator access to the domain controller, we can dump all secrets using secretsdump.py once more. This time we will pass the hash for the computer account of the domain controller:
Using the 'DRSUAPI method' we get another Administrator account, but this is a domain account, so we have just leaked the credentials of a domain administrator. It should also print all other domain accounts so the whole domain is compromised.
BloodHound uses LDAP to query and analyze all permissions users have and sometimes tells you that a user has write privileges to another user via LDAP. A great tool to find and exploit these types of misconfigurations is BloodyAD:
Writable LDAP objects can be enumerated using the get writable command:
If you find here that you have permission to write over another user, you may be able to simply overwrite their current password with set password and log in with it right after:
Tip: Authentication can also be done with pass-the-hash, see Authentication for details
On the right are a few buttons, and to upload data for it to analyze chooseUpload Data. Here you can select multiple files we will generate in the next section.
When a user you have access to is part of the Backup Operators group, BloodHound shows them as a 'High-Value Target'. This is with good reason because such a user has permission to dump highly sensitive data like the registry hives on the Domain Controller. This can be used to extract the hashes of all domain users and then crack them or perform .
GitHub - CravateRouge/bloodyAD: BloodyAD is an Active Directory Privilege Escalation FrameworkGitHub
