![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/1-RTC.png\")
T’was a Monday morning. A new assessment was about to begin.
\n\n\n\nI am no fan of Monday mornings, but assessment mornings are pure adrenaline. I woke up a little early that day to double-check if all the assessment infrastructure was up and running. Tea and r/netsec are my morning rituals before leaving home.
\n\n\n\nOn my way to the assessment, I had my Amazon Music (yeah, I know, sue me) tuned to System of a Down radio. It helps me get into the zone. I recommend Aerials; there is something weirdly poetic about that song.
\n\n\n\nMy goal was straightforward – break into the customer database server without getting caught. I had five days. It was showtime.
\n\n\n\nIt had been a good year. Red teams live and die by their outcomes. And up until then, I had hit nothing but net. There is comfort in the mindset that there is always a way in. I had no reason to believe today would be any different. I was about to learn otherwise.
\n\n\n\nWithin an hour, I could remotely control a machine within the organization over the Internet. I had a tried and tested payload that had worked well in the prior months against most perimeter detection solutions.
\n\n\n\nExcel DDE → Starts CMD → Starts a download lolbin (like bitsadmin) → fetches encrypted payload → load in memory → decrypt payload → execute → Call back.
\n\n\n\nI was able to cross the first hurdle with ease.
\n\n\n\nI had access to an account that did not have administrative privileges on my machine or, for that matter, anywhere else. I also had no idea where the database server was.
\n\n\n\nThe obvious strategy was to try and compromise the domain. If I could get the keys to the kingdom, then accessing the database server would only be a matter of time, patience, and persistence.
\n\n\n\nRight off the bat, I executed what many of us consider a lucky charm these days – Kerberoasting
\n\n\n\nA kerberoastable domain admin meant I had a high likelihood of owning the domain by lunchtime.
\n\n\n\nSo thanks to HarmJ0y’s Powerview script, I had the list of kerberoastable accounts and hashes. Unfortunately, none of them were Domain Admins, Enterprise Admins, or accounts that would allow a possibility to compromise the domain.
\n\n\n\nMy heart sank when I got the list of domain admins – just one.
\n\n\n\nOne domain admin is a rarity. The least I had seen before was five. And five is any day better than one (for a red teamer, that is). I ran a quick check of the domain admin properties, and my heart sank further.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/2-RTC.png\")
Logon restrictions to the domain controllers only! This meant that there was no chance of finding domain admin exposed credentials anywhere else.
\n\n\n\nThis was going to be more difficult than I thought.
\n\n\n\nOf the seven kerberoastable accounts, I only managed to crack one.
\n\n\n\nAnd as far as I could analyze based on its group memberships and properties, it did not appear to have anything of value. In fact, I could not even reach the machine on which the service was supposedly configured.
\n\n\n\nI decided to park this route for the time being as it was already past lunchtime on day 1.
\n\n\n\nCandidly writing, I was both annoyed and impressed at how the accounts with the tasty privileges were locked down. So next up was my trusty quick hit list:
\n\n\n\nNothing. Zilch. Zippo. Nada.
\n\n\n\nNo LLMNR struck me as especially weird. Was I on a sparsely populated subnet? A quick local segment scan showed that Port 135 and 445 were locked down. I could only see the RDP port. And there were about 100 hosts that were live. Maybe I just had to be patient. I decided to keep it running for a while.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/3-RTC.png\")
It was already day 2, and I had nothing to show for my time there.
\n\n\n\nThough it was time to switch gears and try something else, I could not just go waltzing through the network as it could trip a SIEM rule or the EDR, and I certainly did not want to get caught. Normally, I would take the risk, but experience told me that if someone had locked down the network so well, they knew what they were defending against.
\n\n\n\nI needed a clear plan of action and have multiple tasks going on at the same time. Here’s what I decided to do:
\n\n\n\nLots to do!
\n\n\n\nWhile hunting in Active Directory, I did pick up some interesting targets – Users who could change passwords, modify attributes, create policies, RDP to the server, possible workstation and server administrators, and possible DB administrators.
\n\n\n\nI also found computers that could potentially be my target customer database servers, thanks to SPN scanning and hostname keyword searches for “db”, “sql” etc.
\n\n\n\nI decided to hunt for these users on the network and see if there was a way to compromise them. I ran user hunting and session enumeration scripts, but I could not enumerate any sessions on the DC.
\n\n\n\nNetCease? No way. Just no way. The one thing I had counted on, they took from me.
\n\n\n\nFile servers were always a good target for session enumeration. Everyone connects there. But it was a NAS device that everyone was mapped to. No session enumeration was possible.
\n\n\n\nI felt like I was facing Gandalf.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/4-RTC.png\")
Just so you know, if someone kills session enumeration on their network, finding user targets becomes a matter of luck, chance, and brute force. It increases your chances of being detected because you have to expand the footprint of your search.
\n\n\n\nI was suffering because I did not have rights.
\n\n\n\nYou can still enumerate sessions if you are an administrator on the target machine, but I had no admin privileges.
\n\n\n\nAnd to top it off, most of the workstations had blocked WMI and SMB. So even BloodHound would come back empty from workstations.
\n\n\n\nI also found that the workstation computers had LAPS attributes! Local administrator password reuse was out of the question now.
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/01/5-RTC.png\")
This meant that even if I serendipitously managed to get local admin access on my machine, the local administrator password was useless to me as I couldn’t use it anywhere else!
\n\n\n\nLast day of the assessment and I was staring at a bunch of dead ends
\n\n\n\nI did manage to get administrative access to three UAT servers that had “Domain Users” in the administrator’s group. It seemed like the UAT segment did not have the same rigorous blocks as compared to the production segment.
\n\n\n\nThis story is about all the stuff that was done right.
\n\n\n\nUltimately, I was up against someone who knew how people like me operate. They didn’t do anything too fancy. They just meticulously removed options from my arsenal. And that’s half of what Active Defense is all about.