Hey there!
Welcome to the course, Privilege Escalation with Rubeus.
In here,
we'll cover how you can get admin‑level access by
attacking the Kerberos service of a domain.
Imagine that you're working a red team engagement,
and you're trying to compromise the Globomantics Corporation,
which is composed by several laptops, an Active Directory,
and a few other internal servers.
Using some social engineering, you're able to compromise one user laptop,
and although this is really good, we need more than that.
Usually, users do not have a administrator‑level permission in the domain,
and that's basically what you want in a red team exercise.
So for that, we need to escalate our privileges.
In here, in this course,
we'll use Rubeus to retrieve hashed credentials from the Active
Directory using some interesting techniques,
such as the Kerberoasting attack.
Then we will crack those hashes and use those credentials to
compromise the other servers in the environment.
In this way, we can then have full access to any system we want.
If you've read about Kerberos attacks before,
you might have noticed they are not that easy to perform manually.
However, the good news here is that we have Rubeus.
This tool allows us to interact with the Kerberos system
and also automate a lot of those attacks.
The Rubeus tool was primarily developed by harmj0y,
which is a really famous cybersecurity researcher,
and thanks to him, we can save a lot of time doing privilege escalation.
If you've never heard about harmj0y before,
I do recommend you checking out his Twitter and the
several projects in his GitHub.
Basically,
Rubeus is defined by the author as a tool for raw interactions with Kerberos.
However,
I think the best part of Rubeus is not only the raw interactions but
also the automated attacks that we can perform.
For example, with just one command we can run a whole Kerberoasting attack.
What I love about Rubeus is that it is an open source software,
meaning that you can download it from this GitHub and
modify the code as much as you want.
Personally,
I have customized it so I can output the data in a format that I want.
Also,
Rubeus is really good at facilitating the interaction with Kerberos systems.
For example, if you want to list all the service accounts in a domain,
Rubeus can do that for you.
Or if you want to request service tickets, Rubeus can also do that for you.
But as I mentioned, the beauty of this tool is not on the raw requests,
but instead is on the automation of several privilege escalation attacks.
For example, with Rubeus we can perform several attacks,
including Kerberoasting attacks, AS‑REP roasting attacks,
pass the hash and pass the ticket attacks,
golden ticket attacks, and silver ticket attacks.
In this course, we will focus on the first two attacks here,
which are the most successful ones.
But you should definitely check out everything that this tool can do for you.
If you're familiar with the kill chain methodology,
we can map this tool to the escalation phase of the kill chain.
In here,
we'll use Rubeus to get access to an admin account and use
those accounts in key servers in the domain.
Also, if you're familiar with the MITRE ATT&CK framework,
we can map this course here to two phases,
Privilege Escalation and Credential Access.
Inside of Privilege Escalation, we will cover the technique T1134,
which is the Access Token Manipulation.
Also, we can map this course to the Credential Access phase,
in which we'll cover the technique T1558,
which is Steal or Forge Kerberos Tickets.
And actually, to be more specific, we will cover those two sub‑techniques here,
which are Kerberoasting and AS‑REP roasting.
So, before I go into our lab, let's understand what we'll be doing here.
So again, imagine that you're working on a red team engagement for Globomantics.
As you can see in this diagram, on the left side,
we have the laptops of the users.
In the middle, we have our Active Directory,
and on the right side we have some of the Globomantics servers.
In our case here,
we will assume that you already have compromised at
least one machine in the environment,
meaning that you have at least user‑level access to
one of the machines in the domain.
What we will do in our demo is leveraging our user‑level access on the
Active Directory to retrieve hashed credentials from the service
accounts in the Active Directory. And to retrieve those hashed
credentials we'll use to famous techniques,
which are the Kerberoasting and AS‑REP roasting.
Once we have those hashed credentials,
we can then brute force them offline using any tool.
And if we are successful,
we'll have the clear text passwords for some of those service accounts.
Pretty cool, right?
So if you want to follow the demos on your own environment, you need two things.
First, you need a compromised machine that is part of a domain.
In here, we'll use a Windows laptop that is part of the Globomantics domain.
Also, you need a machine with Active Directory installed,
and it is important that you have at least some service
accounts registered in this AD so then we can try to
retrieve their hashed passwords.
But all right, enough of theory,
let's go to our lab environment and see how it's done in real life.