Password Attacks
In a previous Module, we examined several password attacks on network services
and hashed information.
Password attacks are also a viable choice in the context of AD
to obtain user credentials.
In this section, we’ll explore various AD password attacks.
Before exploring these attacks, we need to account for one important consideration.
When performing a brute force or wordlist authentication attack,
we must be aware of account lockouts.
Too many failed logins may block the account for further attacks
and possibly alert system administrators.
To learn more about account lockouts,
let’s review the domain’s account policy as domain user jeff on CLIENT75.
We’ll execute net accounts to obtain the account policy.
There’s a lot of great information available,
but let’s first focus on Lockout threshold
which indicates a limit of five login attempts before lockout.
This means we can safely attempt four logins before triggering a lockout.
Although this may not seem like many,
we should also consider the Lockout observation window,
which indicates that thirty minutes after the last failed login,
we can make additional attempts.
With these settings, we could attempt 192 logins in a 24-hour period
against every domain user without triggering a lockout,
assuming the actual users don’t fail a login attempt.
An attack like this might consist of compiling a short list
of very common passwords and leveraging it against a massive amount of users.
Sometimes this type of attack can reveal quite a few weak account passwords
in the organization.
However, this would also generate a huge amount of network traffic.
Let’s review three kinds of password spraying attacks
that have a higher chance of success in an AD environment.
The first kind of password spraying attack uses LDAP and ADSI
to perform a low and slow password attack against AD users.
In the Module Active Directory Introduction and Enumeration,
we performed queries against the domain controller
as a logged-in user with DirectoryEntry.
However, we can also make queries in the context of a different user
by setting the DirectoryEntry instance.
In the Module Active Directory Introduction and Enumeration,
we used the DirectoryEntry constructor without arguments,
but we can provide three arguments,
including the LDAP path to the domain controller,
the username, and the password.
If the password for the user account is correct,
the object creation will be successful, as shown in the output.
If the password is invalid,
no object will be created and we will receive an exception.
To address this, let’s change the password in the constructor to WrongPassword.
We’ll note the clear warning that the user name or password is incorrect.
We could use this technique to create a PowerShell script
that enumerates all users and performs authentications according to the
Lockout threshold and Lockout observation window.
This password spraying tactic is already implemented in the PowerShell script
Spray-Passwords on CLIENT75.
The -Pass option allows us to set a single password to test,
or we can submit a wordlist file using -File.
We can also test admin accounts by adding the -Admin flag.
The PowerShell script automatically identifies domain users
and sprays a password against them.
Nice!
The password spraying was successful, providing us two valid sets of credentials
The second kind of password spraying attack against AD users leverages SMB.
This is one of the traditional approaches of password attacks in AD
and comes with some drawbacks.
For example, for every authentication attempt,
a full SMB connection has to be set up and then terminated.
As a result, this kind of password attack
is very noisy due to the generated network traffic.
It is also quite slow in comparison to other techniques.
For the purposes of this example, we’ve created a text file
containing a subset of the domain usernames to spray the password against.
We can use crackmapexec on Kali to perform this kind of password spraying.
We’ll select smb as protocol
and enter the IP address of any domain joined system such as CLIENT75.
Then, we can provide a list or single users and passwords to -u and -p.
In addition, we will enter the domain name for -d and provide the option
--continue-on-success to avoid stopping at the first valid credential.
The output shows that crackmapexec identified the same two valid sets
of credentials as __Spray-Passwords did previously.
By prepending the attempted credentials with a plus or minus,
crackmapexec indicates whether or not each is valid.
We should note that crackmapexec doesn’t examine the password policy of the domain
before starting the password spraying.
As a result, we should be cautious about locking out user accounts with this method
As a bonus, however,
the output of crackmapexec not only displays if credentials are valid,
but also if the user with the identified credentials has administrative privileges
on the target system.
For example, dave is a local admin on CLIENT75.
Let’s use crackmapexec with the password Flowers1 targeting this machine.
The output shows that crackmapexec added Pwn3d! to the output,
indicating that dave has administrative privileges on the target system.
In an assessment, this is an excellent feature to determine the level of access
we have without performing additional enumeration.
The third kind of password spraying attack we’ll discuss is based on obtaining a TGT.
For example, using kinit on a Linux system we can obtain and cache a Kerberos TGT.
We’ll need to provide a username and password to do this.
If the credentials are valid, we’ll obtain a TGT.
The advantage of this technique is that it only uses two UDP frames to determine
whether the password is valid,
as it sends only an AS-REQ and examines the response.
We could use Bash scripting or a programming language of our choice
to automate this method.
Fortunately, we can also use the tool kerbrute,
implementing this technique to spray passwords.
Since this tool is cross-platform, we can use it on Windows and Linux.
As previously, we’ve created a file named usernames.txt
containing the usernames pete, dave, and jen.
To conduct password spraying, we need to specify the passwordspray command
along with a list of usernames and the password to spray.
We’ll also need to enter the domain corp.com as an argument for -d.
Very nice!
The output shows that kerbrute
confirmed that the password is valid for pete and jen.
For crackmapexec and kerbrute, we had to provide a list of usernames.
To obtain a list of all domain users, we can leverage techniques we learned in
the Module Active Directory Introduction and Enumeration
or use the built-in user enumeration functions of both tools.
In this section, we explored ways to perform password attacks
in the context of AD.
We discussed and practiced three different methods for password spraying attacks.
These techniques are a great way to obtain valid credentials in the context of AD,
especially if there is no lockout threshold set in the account policy.
In the next two sections, we’ll perform attacks that leverage hash cracking
and often provide a higher success rate than password spraying.