Kerberos based Enum and Attack Samples
ACL Abuse and Shadow Credential
Preparation
# Get TGT for a user
impacket-getTGT 'absolute.htb/d.klay:Darkmoonsky248girl' -dc-ip $RHOST
# Inject it into memory
export KRB5CCNAME=./d.klay.ccache Enumeration
LDAP
crackmapexec ldap dc.absolute.htb --use-kcache --users 
SMB
Bloodhound
Exploitation - ACL Abuse and Shadow Credential
Get a Bloodhound result below. The m.lovegod owns the Network Audit group, which has GenericWrite on the winrm_user user.
To get access to the machine, I’ll first I’ll need to give m.lovegod write access on the Network Audit group. Then I can add m.lovegod to the group. Finally, I can use those permissions to create a shadow credential for the winrm_user account to access to the machine via evil_winrm.
Update the ownership of the user to add a 'write permission'.
Add the full control of Group to the user.
Add the user to the group.
Create a Shadow Credential.
Last updated