Pentesting Active Directory and Windows-based Infrastructure: A comprehensive practical guide to penetration testing Microsoft infrastructure

Cover
Title Page
Copyright and Credits
Dedications
Contributors
Table of Contents
Preface
Chapter 1: Getting the Lab Ready and Attacking Exchange Server
	Technical requirements
	Lab architecture and deployment
	Active Directory kill chain
	Why we will not cover initial access and host-related topics
	Attacking Exchange Server
		User enumeration and password spraying
		Dumping and exfiltrating
		Zero2Hero exploits
		Gaining a foothold
	Summary
	Further reading
Chapter 2: Defense Evasion
	Technical requirements
	AMSI, PowerShell CLM, and AppLocker
		Antimalware Scan Interface
		Way 1 – Error forcing
		Way 2 – Obfuscation
		Way 3 – Memory patch
		AppLocker and PowerShell CLM
	PowerShell Enhanced Logging and Sysmon
	Event Tracing for Windows (ETW)
	Summary
	References
	Further reading
Chapter 3: Domain Reconnaissance and Discovery
	Technical requirements
	Enumeration using built-in capabilities
		PowerShell cmdlet
		WMI
		net.exe
		LDAP
	Enumeration tools
		SharpView/PowerView
		BloodHound
	Enumerating services and hunting for users
		SPN
		The file server
		User hunting
	Enumeration detection evasion
		Microsoft ATA
		Honey tokens
	Summary
	References
	Further reading
Chapter 4: Credential Access in Domain
	Technical requirements
	Clear-text credentials in the domain
		Old, but still worth trying
		Password in the description field
		Password spray
	Capture the hash
	Forced authentication
		MS-RPRN abuse (PrinterBug)
		MS-EFSR abuse (PetitPotam)
		WebDAV abuse
		MS-FSRVP abuse (ShadowCoerce)
		MS-DFSNM abuse (DFSCoerce)
	Roasting the three-headed dog
		Kerberos 101
		ASREQRoast
		KRB_AS_REP roasting (ASREPRoast)
		Kerberoasting
	Automatic password management in the domain
		LAPS
		gMSA
	NTDS secrets
	DCSync
	Dumping user credentials in clear text via DPAPI
	Summary
	References
	Further reading
Chapter 5: Lateral Movement in Domain and Across Forests
	Technical requirements
	Usage of administration protocols in the domain
		PSRemoting and JEA
		RDP
		Other protocols with Impacket
	Relaying the hash
	Pass-the-whatever
		Pass-the-hash
		Pass-the-key and overpass-the-hash
		Pass-the-ticket
	Kerberos delegation
		Unconstrained delegation
		Resource-based constrained delegation
		Constrained delegation
		Bronze Bit attack aka CVE-2020-17049
	Abusing trust for lateral movement
	Summary
	References
	Further reading
Chapter 6: Domain Privilege Escalation
	Technical requirements
	Zero2Hero exploits
		MS14-068
		Zerologon (CVE-2020-1472)
		PrintNightmare (CVE-2021-1675 & CVE-2021-34527)
		sAMAccountName Spoofing and noPac (CVE-2021-42278/CVE-2021-42287)
		RemotePotato0
	ACL abuse
		Group
		Computer
		User
		DCSync
	Group Policy abuse
	Other privilege escalation vectors
		Built-in security groups
		DNSAdmins abuse (CVE-2021-40469)
		Child/parent domain escalation
		Privileged Access Management
	Summary
	References
	Further reading
Chapter 7: Persistence on Domain Level
	Technical requirements
	Domain persistence
		Forged tickets
		A domain object’s ACL and attribute manipulations
		DCShadow
		Golden gMSA
	Domain controller persistence
		Skeleton Key
		A malicious SSP
		DSRM
		Security descriptor alteration
	Summary
	References
Chapter 8: Abusing Active Directory Certificate Services
	Technical requirements
	PKI theory
	Certificate theft
		THEFT1 – Exporting certificates using the CryptoAPI
		THEFT2 – User certificate theft via DPAPI
		THEFT3 – Machine certificate theft via DPAPI
		THEFT4 – Harvest for certificate files
		THEFT5 – NTLM credential theft via PKINIT (nPAC-the-hash)
	Account persistence
		PERSIST1 – Active user credential theft via certificates
		PERSIST2 – Machine persistence via certificates
		PERSIST3 – Account persistence via certificate renewal
		Shadow credentials
	Domain privilege escalation
		Certifried (CVE-2022-26923)
		Template and extension misconfigurations
		Improper access controls
		CA misconfiguration
		Relay attacks
	Domain persistence
		DPERSIST1 – Forge certificates with stolen CA certificate
		DPERSIST2 – Trusting rogue CA certificates
		DPERSIST3 – Malicious misconfiguration
	Summary
	References
Chapter 9: Compromise Microsoft SQL Server
	Technical requirements
	Introduction, discovery, and enumeration
		SQL Server introduction
		Discovery
		Brute force
		Database enumeration
	Privilege escalation
		Impersonation
		TRUSTWORTHY misconfiguration
		UNC path injection
		From a service account to SYSTEM
		From a local administrator to sysadmin
	OS command execution
		xp_cmdshell
		A custom extended stored procedure
		Custom CLR assemblies
		OLE automation procedures
		Agent jobs
		External scripts
	Lateral movement
		Shared service accounts
		Database links
	Persistence
		File and registry autoruns
		Startup stored procedures
		Malicious triggers
	Summary
	Further reading
Chapter 10: Taking Over WSUS and SCCM
	Technical requirements
	Abusing WSUS
	Introduction to MECM/SCCM
		Deployment
	Reconnaissance
	Privilege escalation
		Client push authentication coercion
		Credential harvesting
	Lateral movement
		Client push authentication relay attack
		Site takeover
		Abuse of Microsoft SQL Server
		Deploying an application
	Defensive recommendations
	Summary
	References
	Further reading
Index
Other Books You May Enjoy