Age of Empire - Owning Domain Controllers

In the previous chapter, we covered the basics of Empire and how to use Empire efficiently to perform post-exploitation. Now we are in the network, what's the next step? What can we do apart from exploring the target filesystem and internal network service discovery? In every organization, a centralized server will be present to control and manage the whole network. If an attacker can compromise this central server, they would have full control over the entire organization's network. This central server is called the Domain Controller (DC), while the domain services that are provided by a Domain Controller are known as Active Directory Domain Services.

In this chapter, we will cover the following topics:

• Getting into a Domain Controller using Empire
• Automating Active Directory exploitation using the DeathStar
• Empire GUI

...

Getting into a Domain Controller using Empire

Most of the time, we get access to a web server with system privileges. When we try to get access to the Domain Controller, however, this just doesn't work. One of the reasons for this is the lack of knowledge related to Domain Controllers. For those who are learning about privilege escalation and pivoting, you are about to enter the world of lateral movement and Domain exploitation. Make sure that you are familiar with some basic concepts related to Domains and Domain Controllers. Start from: https://en.wikipedia.org/wiki/Domain_controller and move on to other topics related to the Domain Controller before continuing with this topic.

Assuming that you have some basic understanding of Domains, Domain Controllers, and Active Directory Domain Services (AD/DS), let's continue with the Active Directory exploitation. You should...

Automating Active Directory exploitation using the DeathStar

As explained by the creator:

"DeathStar is a Python script that uses Empire's RESTful API to automate gaining Domain Admin rights in Active Directory environments using a variety of techniques."

- (source: https://github.com/byt3bl33d3r/DeathStar)

To run DeathStar, we need to start Empire with a RESTful API. This can be achieved with the following command:

sudo ./empire --rest --username <username to access the API> --password <password to access the API>

Once Empire starts, we'll see the following message:

The message displayed in the previous screenshots indicates that the RESTful API is running on port 1337/tcp and an API token has been allotted. There's a huge security risk if we open port 1337/tcp for everyone. To avoid this, we will create a reverse SSH tunnel to connect to...

Empire GUI

It can sometimes be quite difficult to use Empire in command line mode. To avoid this, we're going to look at how to use the Empire web interface, which can be managed much more easily. To begin with, let's clone the GitHub repository:

git clone https://github.com/interference-security/empire-web

Now, move the empire-web directory to the /var/www/html of your web server:

Then, start the web service and check for the login.php page in empire-web. In this case, we have configured a custom web service port, 9797/tcp:

The biggest issue with accessing the Empire web in this case is that anyone can access it. Because it's a web application, anyone can try and look for vulnerabilities.

If we try to check for the 9797/tcp on the web server, it shows that the port is accessible from any interface:

A quick Nmap port scan can help us get a clear picture:

As...

Summary

In this chapter, we have covered some more advanced uses of the Empire tool to get access to the Domain Controller. We have also done this using an automated Python script called DeathStar. We then covered Empire's use through a GUI web interface. In the next chapter, we will cover the basics of C2 and the different architectures that can be used to set up the red team infrastructure.

Questions

1. Are there any other exploitation techniques to get access into Domain Controller?
2. What if bypassuac_eventvwr module doesn't work? How can we escalate the privileges without this module?
3. Will DeathStar always be able to retrieve the Domain Admin's credentials?
4. Is there a workaround if the mimikatz module doesn't work?
5. Is it necessary to have access to domain user account for domain controller enumeration?

Further reading

Automating the Empire with the Death Star: https://byt3bl33d3r.github.io/automating-the-empire-with-the-death-star-getting-domain-admin-with-a-push-of-a-button.html