2

In a Windows domain environment, there are numerous protocols (SMB, LDAP, Webpages, RDP, FTP, etc.) that query against the same Windows based AD. Many of these protocols have their own overhead that takes time, or issues that produce bad results (e.g. silently drop multiple simultaneous requests).

I'm in a training course where lockouts are not enabled, so what is the fastest/most stable strategy for performing network based dictionary/bruteforce attacks for domain accounts using standard tools such as (but not limited to) hydra in a domain environment, assuming clients/DCs with these ports are open and available?

In my environment I have LDAP, RDP, FTP, SMB, RPC ports, but am interested in hearing of other protocols options to look for.

Improve this question
2
  • @drewbenn No, I'm not limited to active attacks, but that was the focus of the question. So you're suggesting to root an FTP server (or similar) and capture incoming traffic there. Great suggestion, thanks!
    – mechgt
    Jan 20, 2018 at 11:00
  • Is this effectively answering what protocol requires the fewest bytes transmitted and the lowest processing required in order to determine if an authentication request should pass? If so, something like HTTP basic auth is extremely simple, with the password sent within the first few bytes. I'm sure there are some ultra-light UDP protocols for embedded systems that are even simpler.
    – forest
    Jan 20, 2018 at 11:57

1 Answer 1

Reset to default
3

I haven't precisely done what you're describing, but I would expect most online bruteforce and dictionary attacks to quickly run into account lockout thresholds.

One workaround for this is password spraying - trying just a few of the most common passwords against many accounts. Unless the environment's controls are tuned to detect such activity, you're likely to get at least a few valid credentials without detection - and by distributing such an attack across many protocols, you might be less likely to be detected!

But in practice, you'll almost always find this unnecessary -- because it's more efficient and reliable to exploit an unpatched system, steal credentials or hashes from that system, pass (or crack) the hashes, pivot to another system with higher-privileged credentials, and repeat until you acquire the target level of access.

Edit: I see now in your comments that the artificial lab environment that you're working with explicitly has no lockout thresholds (not usually a real-world scenario).

Of likely available protocols (including the ones that you've listed), I would expect DC-based LDAP to be the service most likely to be A) already tuned for high performance, and b) have direct access to the back-end authentication data (eliminating performance issues related to a secondary service that must then relay the authentication attempts to the back-end AD infrastructure).

I would expect a high-speed Hydra attack directly against AD LDAP, in parallel against all available DCs (including read-only DCs), to be the most likely way to even start to approach the saturation point of the aggregate back-end AD authentication capacity. Theoretically, to increase per-source throughput, you could distribute hydra to all available workstations and servers in the environment.

Improve this answer
2
  • This doesn't seem to answer the question. It sounds like it's about the overhead of authentication in the protocol, not the weakest protocols or the environments with the worst security.
    – forest
    Jan 20, 2018 at 11:54
  • 1
    As originally written, the question didn't explain that it was a lab environment that explicitly has no lockout thresholds. Providing an answer that addresses the broad performance challenge (by spreading the authentication across many services) was reasonable. I've updated my answer.
    – Royce Williams
    Jan 20, 2018 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .