Becoming Domain Admin
We have now managed to pivot onto file01
and obtain a reverse Meterpreter shell in SYSTEM context.
At this point, we must perform some additional post-exploitation enumeration
to figure out if there is a way to continue our attack from this machine.
Since this is a new environment for us, we’ll first want to determine which
security solutions are in place.
In most environments, solutions and settings are centrally managed,
so we expect this server environment to somewhat mirror web01.
Our enumeration would indeed reveal Windows Defender, AppLocker,
and LSA protection installed on file01.
However, when we list all running processes with ps,
we find something interesting:
several processes are running in the context of a user named paul.
This seems very promising, since our SYSTEM integrity access to file01
will allow us to easily hijack any of this user’s sessions.
We can use the simple native net user command
to determine this user’s access level.
We find that paul is a member of the Domain Admins group,
which means our complete compromise of evil.com is close at hand.
One way to gain access to the enticing domain administrator rights would be to
dump the NTLM hash of paul from LSASS,
but that means disabling LSA protection again.
There are easier ways.
One option is to simply migrat into a process owned by paul,
but if we land in a medium-integrity process, we will have to perform a UAC
bypass to regain high-privileged access
and it will place us under the effect of AppLocker policies.
Alternatively, we could locate access tokens for paul in memory
and impersonate them.
This will allow us to perform actions in the context of paul
while still enjoying the privileges of a SYSTEM shell.
We’ll take this approach.
The incognito Meterpreter extension is ideal for this and as SYSTEM,
we can view any tokens on the machine.
Since we can impersonate paul,
we have domain administrator access to the infrastructure.
At this stage, the penetration test often becomes a lot easier,
depending on how secure the configurations are.
If we want to thoroughly compromise the domain or need to attack subsequent
trusted domains, we can obtain access to the krbtgt NTLM hash through an attack
like DCSync or simply perform lateral movement to the domain controller.
For purposes of demonstration in this small environment, we are going to opt
for the latter approach and reuse the attack through the service manager
to obtain a reverse shell from dc02.
Before we impersonate the token, we’ve updated the lateral movement code
to change the target to dc02.
We've named the compiled binary lat2.exe, and we’ll upload to file01.
Now we’ll impersonate paul.
Next, we’ll copy Inject.exe from file01 to dc02,
and run lat2.exe.
We received a new Meterpreter session.
When we interact with the session,
we discover we now have SYSTEM integrity access to dc02.
Excellent!
We have now fully compromised the evil.com domain and can extract
the NTLM hashes of all domain users
including krbtgt to retain administrative access to the domain.
In a larger environment, we could use this as a base to launch further attacks.