Chapter 11: Advanced Active Directory Attacks

Understanding the security vulnerabilities that exist related to the trust of systems and users within Active Directory can be scary, however, it's very useful for aspiring penetration testers and red teamers who are seeking to improve their skillset.

In this chapter, you will learn how to perform advanced Active Directory attacks that focus on abusing trust within Active Directory to gain access and control of devices on a network. You will learn how to perform lateral and vertical movement within the Windows domain, and how to gain domain dominance and persistence within Active Directory.

In this chapter, we will cover the following topics:

• Understanding Kerberos
• Abusing trust on IPv6 with Active Directory
• Attacking Active Directory
• Domain dominance and persistence

Let's dive in!

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

• Kali Linux 2021.2 – https://www.kali.org/get-kali/
• Windows Server 2019 – https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019
• Windows 10 Enterprise – https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise
• mitm6 – https://github.com/fox-it/mitm6
• Mimikatz – https://github.com/gentilkiwi/mimikatz/releases

Understanding Kerberos

Kerberos is a network authentication protocol that runs on Windows Server that allows clients to authenticate on the network and access services within the domain. Kerberos provides Single Sign-On (SSO), which allows a user to authenticate once on a network and access resources without having to re-enter their user credentials each time they need to access a new resource. Kerberos supports delegated authentication, which allows a service running on a client's computer to act on behalf of the authenticated domain user when it connects to other services on the network. Kerberos supports interoperability, which allows a Windows operating system to work in other networks that also use Kerberos as their authentication mechanism. When using Kerberos on a network, it supports mutual authentication, which allows two devices to validate the identity of each other.

Within an Active Directory environment, there are three main elements when working with Kerberos...

Abusing trust on IPv6 with Active Directory

It's been many years since TCP/IP was created and became the de facto network protocol suite that is currently implemented on all devices that use a network to communicate. As you read earlier, there are many network protocols that were not built with security in mind. One such protocol is Internet Protocol version 6 (IPv6). While IPv6 is the latest version of IP and is the successor of IPv4, this protocol is also vulnerable to a lot of network-based cyber-attacks.

As an aspiring penetration tester, you can exploit the trust used within an Active Directory domain over an IPv6 network and compromise the Windows domain and the domain controller on the network. In this section, you will learn how to use a tool known as mitm6 to exploit the security vulnerabilities within IPv6 while performing an NTLM relay attack to gain control of the Active Directory domain within the network.

Important Note

To learn more about the functionality...

Attacking Active Directory

As an aspiring penetration tester, it's important to understand how to simulate real-world cyber-attacks during a penetration test to perform both lateral and vertical movement within an Active Directory domain. Over the next few sections, you will explore various popular tools that are definitely needed within your arsenal as a cybersecurity professional.

Lateral movement with CrackMapExec

CrackMapExec (CME) is a post-exploitation tool that allows penetration testers to easily automate the process of gathering sensitive information from an Active Directory domain within an organization. This tool is very useful as it also allows penetration testers to compromise the trust between domain clients and domain controllers within the network.

Using a tool such as CME within an Active Directory domain, penetration testers and red team professionals are able to quickly identify whether a user credential can be used to gain access to other systems...

Domain dominance and persistence

In this section, you will learn how to perform advanced techniques to abuse the trust within Kerberos and an Active Directory domain to gain dominance over all devices within a Windows domain and set up persistence within Active Directory.

You will learn about the fundamentals of creating the following tokens on Active Directory:

• Golden ticket
• Silver ticket
• Skeleton key

Let's take a deeper dive into abusing the trust within Active Directory.

Golden ticket

A golden ticket is a special token that is created by penetration testers using the Security Identifier (SID) of the domain, the domain name, and the NTLM hash of the Kerberos TGT. The golden ticket allows a penetration tester to gain access to any device within the domain by performing a technique known as Pass the Ticket. This is possible because the golden ticket is both encrypted and digitally signed by the hash of the Kerberos TGT account. This is the krbtgt...

Summary

During the course of this chapter, you have learned about the fundamentals of Kerberos within a Windows domain and the importance it has within Active Directory. You have also gained the skills to exploit the trust of Active Directory over an IPv6 network and perform both lateral and vertical movement within Active Directory, and have gained hands-on experience in setting up domain dominance and persistence.

I hope this chapter has been informative for you and is helpful in your journey as an aspiring penetration tester learning how to simulate real-world cyber-attacks to discover security vulnerabilities and perform exploitation using Kali Linux. In the next chapter, Delving into Command and Control Tactics, you will learn the fundamentals of command and control during a penetration test.

Further reading

To learn more about the topics that were covered in this chapter, take a look at the following resources:

• LLMNR/NBT-NS Poisoning and SMB Relay – https://attack.mitre.org/techniques/T1557/001/
• OS Credential Dumping: LSA Secrets – https://attack.mitre.org/techniques/T1003/004/
• Active Directory Security – https://adsecurity.org/