Breaching Active Directory

In this article, I went over about 3 methods a threat actor can employ to gain foothold in an Active Directory (AD) doamain. While ransomware, phishing, botnets and other malware steal the headlines, AD remains a major vector of abuse. With the help of labs from *TryhackMe*, I’ll demonstrate how most common attacks are carried to get an initial compromise of a target domain. This is no way a solution to the ***BrAD*** room on TryHackme. You can go there as the room explains more than I do.

NTLM and NetNTLM

New Technology LAN Manager (NTLM) is the suite of security protocols used to authenticate users’ identities in AD. When the client requests access to a service associated with the domain, the service sends a challenge to the client, requiring that the client to perform a mathematical operation using its authentication token, and then return the result of this operation to the service. The service may validate the result or send it to the Domain Controller (DC) for validation. If the service or DC confirm that the client’s response is correct, the service allows access to the client.

NTLM is no longer recommended for use by Microsoft because NTLM does not support current cryptographic methods, such as AES or SHA-256. Microsoft adopted Kerberos as the preferred authentication protocol for Windows 2000 and subsequent Active Directory domains.

Is NTLM secure?

NTLM is generally considered insecure because it uses outdated cryptography that is vulnerable to several modes of attacks. NTLM is also vulnerable to the pass-the-hash attack and brute-force attacks.

Brute-Forcing Attacks

Say we have acquired a valid email from a company’s website through OSINT. Perhaps we could use that for brute force attacks at a certain login page. Since most AD environments have account lockout configured, we won’t be able to run a full brute-force attack. Instead, we need to perform a password spraying attack.

Password Spraying Attacks

Instead of trying multiple different passwords, which may trigger the account lockout mechanism, we choose and use one password and attempt to authenticate with all the usernames we have acquired. However, it should be noted that these types of attacks can be detected due to the amount of failed authentication attempts they will generate.

You have been provided with a list of usernames discovered during a red team OSINT exercise. The OSINT exercise also indicated the organisation’s initial onboarding password, which seems to be “Changeme123”.

And you realized the organisation have a link that leads to a login page. Now with this one password, let’s spray that against a username wordlist. For the password spraying, below is a custom python script that can be used

Syntax:

**python3 ntlm_passwordspray.py -u <userfile> -f <fqdn> -p <password> -a <attackurl>**

After running the script provided, we get a list of valid credentials we can use to authenticate in the login Form.

Now let’s use any of the credentials to try and login.

After a sccessful login, you should see a Greeting on the web page.

LDAP Bind Credentials

What is LDAP?

Lightweight Directory Access Protocol (LDAP) is a standard protocol designed to maintain and access “directory services” within a network. LDAP is widely used to build central authentication servers. These servers contain usernames and passwords for all the users within a network. Any-and-all applications and services can connect to the LDAP server to authenticate and authorize users. LDAP directories typically contain data that is regularly accessed, but rarely changed. LDAP is designed to deliver exceptionally fast READ performance, even for larger datasets. However, the WRITE performance is significantly lower.

How Does It Work?

Say a user want’s to connect to a Printer. The User must have an LDAP client installed on their system.

1. Using the client, the user establishes a secure connection(default port 389) with the LDAP directory.
2. They send a “search” query to the directory for a specific printer.
3. The LDAP directory authenticates the user.
4. The search operation is performed within the directory, and the address of the requested printer is returned.
5. The secure connection to the LDAP directory is closed.
6. The user connects to the printer.

LDAP authentication is similar to NTLM authentication. However, with LDAP authentication, the application directly verifies the user’s credentials. The application has a pair of AD credentials that it can use first to query LDAP and then verify the AD user’s credentials. Since a service using LDAP authentication requires a set of AD credentials, it opens up additional attack avenues. In essence, we can attempt to recover the AD credentials used by the service to gain authenticated access to AD.

NB: Active Directory (AD) is a proprietary directory service developed by Microsoft® to manage the authentication and authorization of users and machines on a Windows domain network. Lightweight Directory Access Protocol (LDAP) is a tool for extracting and editing data stored in Active Directory and other compatible directory service providers. Each user account in an AD has several attributes, such as the user’s full name and email address. Extracting this information in a usable format requires LDAP. LDAP’s primary function is enabling users to find data about organizations, persons, and more. It accomplishes this goal by storing data in the LDAP directory and authenticating users to access the directory. LDAP extracts information from AD with a simple, string-based query. LDAP can also share the extracted information (such as usernames and passwords) with connected devices or applications.

If you could gain a foothold on the correct host, such as a Gitlab server, it might be as simple as reading the configuration files to recover these AD credentials. These credentials are often stored in plain text in configuration files since the security model relies on keeping the location and storage configuration file secure rather than its contents.

LDAP PASS-BACK ATTACK

An attacker tricks a device to connect to a rogue server to disclose the stored network credentials or hashes while the device trying to authenticate to the server.

Most network printers have a browser based UI access that enables the user to change the configs of the printer.

Below are some examples of the WEB UI of some popular printers

In the WEB UI interface, you log in as an admin and head to the network config interface. Over there, the admin has the privilege to add the printer to the LDAP server installed in the Domain.

This is how the interaction Happens between the User, The Printer and the Domain Controller.

1. The average user sends printing requests with AD username and password

2. The Printer uses its own AD credentials to create an LDAP bind request.

3. Domain Controller (DC) provides a bind response

4. Printer requests LDAP user search

5. The DC provides a user search response

6. Printer sends an LDAP bind request + the user’s AD credentials to the DC.

7. DC sends a bind response to the Printer

Below is a mock representation of a web facing Printer UI which shows the network settings of the Printer by Tryhackme.

Now let’s reconfigure the Server ip to the attacker’s IP. and we wait and listen for a user to make a request to the printer. The printer thinking our ip is the LDAP server would forward the user credentials to us(in hopes that we’ll authenticate with the DC). Since this is LDAP and not LDAPs, everything is done in plain text. We can read the credentials.

Checking the attacker IP

Now let’s insert that into the server on the web UI and save settings.

Let’s set our netcat listener to listen for any connections the Printer tries to make to the “LDAP server”. LDAP runs on default port 389 so let’s listen to connections to that port.

After a few a moments, we receive a connection from the printer. But what do we have here?

Instead of catching the plain text credentials, we caught a supportedCapabilities error. Now what does that even mean?

Essentially, before the printer sends over the credentials, it is trying to negotiate the LDAP authentication method details. It will use this negotiation to select the most secure authentication method that both the printer and the LDAP server support. If the authentication method is too secure, the credentials will not be transmitted in cleartext.

Obviously I have no LDAP server installed on the attacker machine so such negotiations couldn’t take place, hence the error.

What should we do??

Why don’t we install a rogue LDAP server on the attacker machine? We will set it up to take care of the authentication method negotiation. We’ll configure it insecurely to allow plaintext transmission of credentials.

We will be using openLDAP which supports transmission of plaintext credentials. Install it with command:

**sudo apt-get update && sudo apt-get -y install slapd ldap-utils && sudo systemctl enable slapd**

Set your Admin Password as the server install.

After install, let’s reconfigure the LDAP server to permit plaintext transmission of credentials.After install, let’s reconfigure the LDAP server to permit plaintext transmission of credentials.

**sudo dpkg-reconfigure -p low slapd**

1- Omit OpenLDAP server configuration? No

2- DNS domain name: {target AD domain name} i.e. za.tryhackme.com

3- Use this same name for the Organization name as well:

Enter your Admin Password to confirm settings

5- Do you want the database to be removed when slapd is purged? No

6- Move old database files before creating a new database — Yes

After finishing configuring the LDAP server and it’s up and running, we need to configure its authentication methods to accept PLAIN text LOGIN. By default, LDAP supports DIGEST-MD5, NTLM and CRAM-MD5 authentication methods.

You can use the ldapsearch command to check this:

ldapsearch -H ldap:// -x -LLL -s base -b “” supportedSASLMechanisms

Now in order to downgrade this authentication method, we’ll have to create an ldif file (I’ll name mine ldifPlainText.ldif) with the following content:

• olcSaslSecProps: specifies the SASL security properties ◇ noanonymous flag disables mechanisms that support anonymous login. ◇ minssf: specifies the minimum acceptable security strength; 0 is for no protection.

Commit the new changes with ldapmodify and restart the server.

**sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./ldifPlainText.ldif && sudo service slapd restart**

Capturing LDAP Credentials

After setting up your rogue LDAP server and downgrading the auth methods, start up tcpdump/wireshark to listen on port 389

-S = Prints out the packet’s seqence numbers -x = Prints the contents of the packets

After a user requests the services of the printer, the printer forwards the user’s credentials to our rogue LDAP server and tcpdump captures the plain text packets for us.

Mitigation

• Change the default password to a complex one; it should be an easy fix !! • Disable any necessary features on these devices that are not needed. • Use the principle of the least privilege when setting up the accounts for these devices; don’t run them as domain admins • Avoid using insecure connection and use SSL encryption if the device supports that.

Authentication Relays

Server Message Block (SMB)

SMB is a protocol used by Windows that allows user (or workstations) to connect to a server (eg.a File Server). SMB communication is easy to understand. SMB clients connect to an SMB server using the SMB port( to access SMB shares. Once they access the SMB shares, clients can do things such as collaborate on files without downloading them to their machines or print using a networked printer.

However, the security of earlier versions of the SMB protocol was deemed insufficient. Several vulnerabilities and exploits were discovered that could be leveraged to recover credentials or even gain code execution on devices. Although some of these vulnerabilities were resolved in newer versions of the protocol, often organisations do not enforce the use of more recent versions since legacy systems do not support them.

Let’s take a look of some of the authentication that take place during the use of SMB.

LLMNR, NBT-NS and WPAD

LLMNR is a protocol that allows name resolution without the requirement of DNS. Able to provide a hostname-to-ip based off a multicast packet sent across the network asking all listening net interfaces to reply if they are authoritatively known as the hostname in the query.

We will be using a tool called RESPONDER

Responder allows us to perform Man-in-the-Middle attacks by poisoning the responses during NetNTLM authentication, tricking the client into talking to you instead of the actual server they wanted to connect to. On a real LAN, Responder will attempt to poison any Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Server (NBT-NS), and Web Proxy Auto-Discovery (WPAD) requests that are detected. On large Windows networks, these protocols allow hosts to perform their own local DNS resolution for all hosts on the same local network. Rather than overburdening network resources such as the DNS servers, hosts can first attempt to determine if the host they are looking for is on the same local network by sending out LLMNR requests and seeing if any hosts respond. The NBT-NS is the precursor protocol to LLMNR, and WPAD requests are made to try and find a proxy for future HTTP(s) connections.

Intercepting NetNTLM Challenge

clone Responder from github here.

Start Responder with

**sudo responder -I tun0**

Responder starts up listening on many servers

Now we wait for a challenge request, and for Responder to poison the response. After waiting for a good 10mins, We caught a challenge

Now let’s take the NTLM hash and crack it with hashcat

Now that we have the username and clear text password, we can use SSH (if installed on the target machine), Psexec or RDP to remotely log into the domain.

Logging in with SSH:

You enter the password you got from Hashcat and you get a cmd session

In my next article, I’ll be showing how an attacker can enumerate critical information of the domain after successfully gaining access to the domain.