https://wearethebug.dev/tags/kerberos-relay/Recent content on WE ARE THE BUGTradecraften-usThu, 26 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-cicada/Thu, 26 Sep 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-cicada/Cicada is a Medium-rated Windows Active Directory machine hosted on the VulnLab platform, that involves discovering a password inside an image on a public share. With that password an attacker is able to discover that the machine is vulnerable to ESC8 and can use Kerberos relaying to bypass self-relay restrictions in order to get a certificate as the machine account itself. With this new certificate, we are able to dump the hashes of the Administrator user and thus compromise the whole domain.https://wearethebug.dev/posts/vl-bruno/Sat, 02 Jul 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-bruno/Bruno is a medium-rated Windows domain box that chains insecure application configuration and weak Active Directory hygiene to go from no access to domain admin. The service-facing component is a custom .NET application that extracts ZIP entries unsafely using Path.Combine, allowing crafted archives to perform a zip-slip and place files under the app folder. That capability enables a DLL-search-path hijack - an attacker who can write to the queue share can drop a malicious dll and achieve code execution as the service user. On the network/AD side, an account svc_scan is discoverable and kerberoastable/AS-REP crackable; its recovered credentials grant write access to the queue share, which is used to trigger the DLL payload and get a low-privilege shell. From there the default machine account quota of authenticated users and RBCD are abused to perform a Kerberos relay/RBCD attack that resets the Administrator password and yields full domain compromise.