• 7MS #640: Tales of Pentest Pwnage – Part 63

  • 2024/09/07
  • 再生時間： 43 分
  • ポッドキャスト

7MS #640: Tales of Pentest Pwnage – Part 63

無料で聴く

ポッドキャストの詳細を見る

  • サマリー

  • This was my favorite pentest tale of pwnage to date! There’s a lot to cover in this episode so I’m going to try and bullet out the TLDR version here:

    • Sprinkled farmer files around the environment
    • Found high-priv boxes with WebClient enabled
    • Added “ghost” machine to the Active Directory (we’ll call it GHOSTY)
    • RBCD attack to be able to impersonate a domain admin using the CIFS/SMB service against the victim system where some higher-priv users were sitting
    • Use net.py to add myself to local admin on the victim host
    • Find a vulnerable service to hijack and have run an evil, TGT-gathering Rubeus.exe – found that Credential Guard was cramping my style!
    • Pulled the TGT from a host not protected with Credential Guard
    • Figured out the stolen user’s account has some “write” privileges to a domain controller
    • Use rbcd.py to delegate from GHOSTY and to the domain controller
    • Request a TGT for GHOSTY
    • Use getST.py to impersonate CIFS using a domain admin account on the domain controller (important thing here was to specify the DC by its FQDN, not just hostname)
    • Final move: use the domain admin ccache file to leverage net.py and add myself to the Active Directory Administrators group
    続きを読む 一部表示
activate_samplebutton_t1

あらすじ・解説

This was my favorite pentest tale of pwnage to date! There’s a lot to cover in this episode so I’m going to try and bullet out the TLDR version here:

  • Sprinkled farmer files around the environment
  • Found high-priv boxes with WebClient enabled
  • Added “ghost” machine to the Active Directory (we’ll call it GHOSTY)
  • RBCD attack to be able to impersonate a domain admin using the CIFS/SMB service against the victim system where some higher-priv users were sitting
  • Use net.py to add myself to local admin on the victim host
  • Find a vulnerable service to hijack and have run an evil, TGT-gathering Rubeus.exe – found that Credential Guard was cramping my style!
  • Pulled the TGT from a host not protected with Credential Guard
  • Figured out the stolen user’s account has some “write” privileges to a domain controller
  • Use rbcd.py to delegate from GHOSTY and to the domain controller
  • Request a TGT for GHOSTY
  • Use getST.py to impersonate CIFS using a domain admin account on the domain controller (important thing here was to specify the DC by its FQDN, not just hostname)
  • Final move: use the domain admin ccache file to leverage net.py and add myself to the Active Directory Administrators group
政治・政府
続きを読む 一部表示

7MS #640: Tales of Pentest Pwnage – Part 63に寄せられたリスナーの声

カスタマーレビュー：以下のタブを選択することで、他のサイトのレビューをご覧になれます。

Audible.co.jp

Amazon.co.jp
レビューはまだありません。