← Toutes les actualités
There and Back Again: Escalating Privileges Locally
Synthèse
Now that our infrastructure has been provisioned, including a cloud VM forwarding traffic from 443/TCP to our red team infrastructure and a SOCKS5 proxy running through a ceded access agent, the attack technique guidance can finally begin. This example will showcase the aforementioned “There and Back Again” technique to coerce and receive egressed NTLM WebDAV authentication on the internet and cover relaying that authentication to a target LDAP/LDAPS service, then using the gained access to esca
Now that our infrastructure has been provisioned, including a cloud VM forwarding traffic from 443/TCP to our red team infrastructure and a SOCKS5 proxy running through a ceded access agent, the attack technique guidance can finally begin. This example will showcase the aforementioned “There and Back Again” technique to coerce and receive egressed NTLM WebDAV authentication on the internet and cover relaying that authentication to a target LDAP/LDAPS service, then using the gained access to escalate privileges locally. One of the requirements for coercing WebDAV NTLM authentication is adding a DNS entry to the domain, which is possible from low-privilege domain user access. To complete this through ceded access without prior knowledge of your current user context’s plaintext password, retrieve a Kerberos ticket either by extracting one from the current logon session or requesting one using the current user context. If credential guard is in use, extract an LDAP service ticket instead of the logon session TGT.
Service tickets are still extractable from the current logon session without touching LSASS even with credential guard in play. Once the base64 encoded Kerberos blob is extracted from the current logon session, decode the data and pipe it to a file on the Linux operator VM’s disk. echo 'doIGLk... [snip]... ' | base64 -d > ticket.
kibri Use Impacket’s ticketConverter. py script to convert the ticket from a . kirbi format to a . ccache file to be used with Impacket utilities over the SOCKS5 proxy. ticketConverter.
py ticket. kirbi ticket. ccache Once the ticket is properly formatted, use dnstool. py from Dirk-Jan’s Krbrelayx project to add a DNS record as a low-privilege user (default) using the extracted LDAP ticket, pointing to the cloud VM public IP address. KRB5CCNAME=ticket.
ccache proxychains4 python3 dnstool. py -k -u ludus. domain\\domainuser -r relayhost. ludus. domain -dns-ip 10.
2. 10. 10 -a add -d 40. 90. 233.
199 dc01. ludus.