DCSync Example Forest HTB

Exploiting DCSync (from Forest(HTB))

From the above figure, we can see that svc-alfresco is a member of the group Service Accounts which is a member of the group Privileged IT Accounts, which is a member of Account Operators. which we can see by checking the "shortest path to domain admins" and then cheking the node properties.

Moreover, the Account Operators group has GenericAll permissions on the Exchange Windows Permissions group, which has WriteDacl permissions on the domain.

This was a mouthful, so let’s break it down.

  • svc-alfresco is not just a member of Service Accounts, but is also a member of the groups Privileged IT Accounts and Account Operators.

  • The Account Operators group grants limited account creation privileges to a user. Therefore, the user svc-alfresco can create other users on the domain.

  • The Account Operators group has GenericAll permission on the Exchange Windows Permissions group. This permission essentially gives members full control of the group and therefore allows members to directly modify group membership. Since svc-alfresco is a member of Account Operators, he is able to modify the permissions of the Exchange Windows Permissions group.

  • The Exchange Windows Permission group has WriteDacl permission on the domain HTB.LOCAL. This permission allows members to modify the DACL (Discretionary Access Control List) on the domain. We’ll abuse this to grant ourselves DcSync privileges, which will give us the right to perform domain replication and dump all the password hashes from the domain.

Putting all the pieces together, the following is our attack path.

  1. Create a user on the domain. This is possible because svc-alfresco is a member of the group Account Operators.

  2. Add the user to the Exchange Windows Permission group. This is possible because svc-alfresco has GenericAll permissions on the Exchange Windows Permissions group.

  3. Give the user DcSync privileges. This is possible because the user is a part of the Exchange Windows Permissions group which has WriteDacl permission on the htb.local domain.

  4. Perform a DcSync attack and dump the password hashes of all the users on the domain.

  5. Perform a Pass the Hash attack to get access to the administrator’s account.

Now add a new user and add it to the exchange group

Now to check the aval modules you can use the command

Now run the following commands before executing anything on target.

Abusing write dacl

First, we need to create a credential object

Now, need PowerView, so locate it and upload it.

Now import PowerView

Now execute one of the following to grant dcsync rights.

You can also use the following syntax

Dumping hashes

Now, we can use impacket to dump all hashes.

Pass the Hash

Now, we can simply pass the hash to get shell.

Pass the hash with evil-winrm

You can also use evil-winrm. Remember to use only NT hash(last part).

PreviousDCSyncNextPost Owning Domain

Last updated