Owning the Forest with Printers
In a previous section, we demonstrated how to compromise
an entire domain using the printer bug
after compromising a single server
configured with unconstrained Kerberos delegation.
In this section, we’ll reuse this technique
to directly target a domain controller in the forest root
domain and instantly compromise the entire forest
from a single server.
This technique does not require Domain Admin privileges.
However, if we have Domain Admin privileges and no servers with
unconstrained delegation exist in our current domain, we can
create one ourselves by modifying the configuration
of one of the servers.
In this section, we’ll execute the attack without
Domain Admin privileges.
To do this, we’ll first log in to appsrv01 as the Offsec user,
and open a PowerShell prompt.
From here, we can determine our access to the print spooler
service on the rdc01 root domain controller.
This output shows our access to the print spooler service on
rdc01 from the prod.corp1.com domain
This means we can use the
RpcRemoteFindFirst PrinterChangeNotification API
to force an authentication
and allow us to obtain a forwardable TGT.
We’ll repeat our actions from the previous section
by opening an administrative command prompt.
Then we’ll use Rubeus to monitor for new tickets from the root
domain controller machine account.
With Rubeus running, we’ll switch back to our PowerShell
prompt and launch SpoolSample to force the print change
notification from rdc01.
After receiving the success message,
we’ll switch back to our Rubeus monitor,
where we’ll find the new TGT displayed.
Now that we have obtained a forwardable TGT for the root
domain controller machine account,
we can use Rubeus to inject it into memory.
The root domain controller computer account is not a local
administrator on rdc01,
so we cannot directly obtain code execution.
However, a domain controller computer account has the access
right to perform AD replication.
We can exploit this by forcing a replication with Mimikatz dcsync
We now have the NTLM password hash of the root domain
Administrator account
and have obtained access to the Enterprise Admins group.
Very nice.
This section illustrated how dangerous unconstrained
Kerberos delegation can be.
In a worst-case scenario, we could compromise the entire
forest by just compromising one server or service account.
Also, bear in mind that if we obtain Domain Admin privileges
in prod.corp1.com through some other vector, we could configure
a server with unconstrained Kerberos delegation and use that
to compromise any other domain in the forest.