Domain Controller Synchronization
To exploit redundancy in synchronized domain controllers,
we’ll use Mimikatz on a domain-joined Windows machine,
and impacket-secretsdump on our non-domain joined Kali machine
for the examples of this section.
This time, we’ve connected to CLIENT75 via RDP with jeffadmin credentials.
As jeffadmin is a member of the Domain Admins group,
we already have the necessary rights assigned.
Let’s change to the Tools directory and launch Mimikatz.
For Mimikatz to perform this attack,
we can use the lsadump::dcsync module
and provide the domain username for which we want to obtain credentials
as an argument for /user:.
For the purposes of this example, we’ll target the domain user dave.
Nice!
Mimikatz performed the dcsync attack by impersonating a domain controller
and obtained the user credentials of dave by using replication.
Now, let’s copy the NTLM hash,
and store it in a file named hashes.dcsync on our Kali system.
We can then crack the hash using Hashcat
as we learned in the Password Attacks Module.
We’ll enter 1000 as mode,
rockyou.txt as wordlist,
and best64.rule as rule file.
Additionally, we will enter the file containing the NTLM hash
and --force, since we run Hashcat in a VM.
The output shows that we successfully retrieved the plaintext password of dave.
We can now obtain the NTLM hash of any domain user account
of the domain corp.com.
Furthermore, we can attempt to crack these hashes
and retrieve the plaintext passwords of these accounts.
Notably, we can perform the dcsync attack
to obtain any user password hash in the domain,
even the domain administrator Administrator.
We’ll discuss lateral movement vectors
such as leveraging NTLM hashes obtained by dcsync
in the Module Lateral Movement in Active Directory.
For now, let’s perform the dcsync attack from Linux as well.
We’ll use impacket-secretsdump to acheive this.
To launch it, we’ll enter the target username dave
as an argument for -just-dc-user,
and provide the credentials of a user with the required rights,
as well as the IP of the domain controller in the format
__domain user password@ip__.
The output shows that we successfully obtained the NTLM hash of dave.
The output of the tool states that it uses DRSUAPI, the Microsoft API
implementing the Directory Replication Service Remote Protocol.