1

There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account.

Now I am here to ask what can be the attack ways of AD in the perspective of a domain computer account, or more specifically, suppose "You got ACCESS to AD Joined Domain Machine but the user you compromised is Local Administrator NOT Domain User/Administrator?"

How will you approach?

This might be a generic question, but I have segregated it down to only for computer joined machines.

Or in other words: Ways to exploit Non-Domain users to become a Domain User?

3
  • Are you asking way to attack ad account without using domain account? – Infra Mar 12 at 12:03
  • @Infra, Hi, yes without using the user domain account, forex: You compromised a host and found that your host is a domain-joined host, but you have compromised a local administrator account. How will you approach the attack? In other words, How will you approach non-domain users to become domain users? – AWS Learning Mar 12 at 14:02
  • This could be possible on different ways and it is totally depend on security applied on particular network. Social engineering would be best method to achieve this kind of attack. In less secure environment, it may possible technical attack.... – Infra Mar 12 at 14:17
1

I will answer the following question: "You got ACCESS to AD Joined Domain Machine but the user you compromised is Local Administrator NOT Domain User/Administrator?"

Before starting, I think that this is a very interesting question and not wide at all.

Here is the deal, you started as a LA which basically means that you can perform almost anything you want on the current BOX. Great! Let's analyze this:

  • You are LA therefore you could have a look at the secrets stored in the computer. This includes tickets from the users that logged there, the LSASS process (and the users that interacted there), and of course the NTLM of the machine account ( you can identify these because they have a $ at the end of their name, like WS001$ , also it would be possible to check for PowerShell history files, or browser's bookmarks. Basically run local checks in order to enumerate local information that might be useful to elaborate further attacks
  • Now I assume that the computer where you are working from is domain joined. Lucky you, you have the NTLM of the local Administrator account and therefore you can perform actions like if you were the host. This is your lucky day because AD treats computer accounts and user accounts very similarly, therefore you can perfectly execute bloodhound and obtain relevant data! Thanks to a bloodhound, you discovered that one of the users that had a Kerberos ticket in memory, Larry has GenericAll permission over the user ADM-Larry which is a Domain Admin! Then you will grab the ticket, inject it with Rubeus, modify the password of ADM-Larry and finally impersonate ADM-Larry. Now you are free to do whatever you want including a DC-Sync in the DC!

Reference about the GenericAll attack:

https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces

2
  • 1
    Yeah! very Informative! Looking to more into it, I will ping you back on this here. – AWS Learning Apr 15 at 15:35
  • Feel free to ping me on any of my networks if you have any other question / scenario! – borcho Apr 15 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.