Advanced Active Directory Attacks

Understanding the security vulnerabilities that are related to the trust of systems and users within Active Directory can be scary; however, it’s very useful for aspiring penetration testers and red teamers who are seeking to improve their skillset in identifying security flaws in an Active Directory environment within their organization.

In this chapter, you will learn how to perform advanced Active Directory attacks that focus on abusing trust within Active Directory to gain access and control of devices on a network. You will learn how to perform lateral and vertical movement within the Windows domain, and how to gain domain dominance and persistence within Active Directory.

In this chapter, we will cover the following topics:

• Understanding Kerberos
• Abusing trust on IPv6 with Active Directory
• Attacking Active Directory
• Domain dominance and persistence

Let’s dive in!

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

• Kali Linux – https://www.kali.org/get-kali/
• Windows Server 2019 – https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019
• Windows 10 Enterprise – https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
• mitm6 – https://github.com/dirkjanm/mitm6
• Mimikatz – https://github.com/gentilkiwi/mimikatz

Understanding Kerberos

Kerberos is a network authentication protocol that runs on Windows Server, which enables clients to authenticate on the network and access services within the Windows domain. Kerberos provides single sign-on (SSO), which allows a user to authenticate once on a network and access resources without having to re-enter their user credentials each time they need to access a new resource, such as a mapped network drive. Kerberos supports delegated authentication, which allows a service running on a client’s computer to act on behalf of the authenticated domain user when it connects to other services on the network. Kerberos supports interoperability, which allows a Windows-based operating system to work in other networks that also use Kerberos as their authentication mechanism. When using Kerberos on a network, it supports mutual authentication, which allows two devices to validate the identity of each other.

Within an Active Directory environment, there...

Abusing trust on IPv6 with Active Directory

It’s been many years since Transmission Control Protocol/Internet Protocol (TCP/IP) was created and became the de facto network protocol suite that is currently implemented on all devices that use a network to communicate. As you read earlier in this book, there are many network protocols that were not built with security in mind. One such protocol is the Internet Protocol version 6 (IPv6). While IPv6 is the latest implementation of IP and is the successor of IPv4, this protocol is also vulnerable to a lot of network-based cyberattacks.

As an aspiring penetration tester, you can exploit the trust used within an Active Directory domain over an IPv6 network and compromise the Windows domain and the domain controller on the network. In this section, you will learn how to use a tool known as mitm6 to exploit the security vulnerabilities within IPv6 while performing an NTLM relay attack to gain control of the Active Directory domain...

Attacking Active Directory

As an aspiring penetration tester, it’s important to understand how to simulate real-world cyberattacks to perform both lateral and vertical movement within an Active Directory domain.

Vertical movement allows a penetration tester to escalate their privileges within a network, as compared to lateral movement, which focuses on using the same user privileges across multiple systems on the network. Over the next few sections, you will explore various popular tools for achieving this that are definitely needed within your arsenal as a cybersecurity professional.

Lateral movement with CrackMapExec

CrackMapExec is a post-exploitation tool that allows penetration testers to easily automate the process of gathering sensitive information from an Active Directory domain within an organization. This tool is very useful as it also allows penetration testers to compromise the trust between domain clients and domain controllers within the network.

...

Domain dominance and persistence

In this section, you will learn how to perform advanced techniques to abuse the trust within Kerberos and an Active Directory domain to gain dominance over all devices within a Windows domain and set up persistence within Active Directory.

You will learn about the fundamentals of creating the following tokens on Active Directory:

• Golden ticket
• Silver ticket
• Skeleton key

Let’s take a deeper dive into abusing the trust within Active Directory.

Golden ticket

A golden ticket is a special token that is created by penetration testers using the Security Identifier (SID) of the domain, the domain name, and the NTLMv1 hash of the Kerberos TGT. The golden ticket allows a penetration tester to gain access to any device within the domain by performing PTT.

This is possible because the golden ticket is encrypted using the hash of the Kerberos TGT account, which is the built-in krbtgt account on Active Directory...

Summary

During the course of this chapter, you have learned about the fundamentals of Kerberos within a Windows domain and the importance it has within Active Directory. You have also gained the skills to exploit the trust of Active Directory over an IPv6 network and perform both lateral and vertical movement within Active Directory, and have gained hands-on experience in setting up domain dominance and persistence.

I trust that the knowledge presented in this chapter has provided you with valuable insights, supporting your path toward becoming an ethical hacker and penetration tester in the dynamic field of cybersecurity. May this newfound understanding empower you in your journey, allowing you to navigate the industry with confidence and make a significant impact. In the next chapter, Chapter 14, Advanced Wireless Penetration Testing, you will learn how to compromise personal and enterprise wireless networks.

Further reading

To learn more about the topics that were covered in this chapter, visit the following links:

• Understanding Kerberos – https://www.techtarget.com/searchsecurity/definition/Kerberos
• OS Credential Dumping: NTDS – https://attack.mitre.org/techniques/T1003/003/
• OS Credential Dumping: LSA Secrets – https://attack.mitre.org/techniques/T1003/004/
• LLMNR/NBT-NS Poisoning and SMB Relay – https://attack.mitre.org/techniques/T1557/001/
• Active Directory Security – https://adsecurity.org/

Join our community on Discord

Join our community’s Discord space for discussions with the author and other readers:

https://packt.link/SecNet