Now that we know how to use the ADRecon tool,
I want to show you one interesting attack that we can perform with this tool.
The ADRecon tool is able to perform a Kerberoast attack,
which basically queries the domain for SPN service accounts and
extracts the hash passwords from the Kerberos tickets.
If you never heard about this attack before,
just Google about it. It is a pretty cool attack.
So I'm already here in the terminal, and I'm already using PowerShell.
To get hash credentials from the service accounts,
we need to execute the ADRecon script, but adding the
‑Collect flag and specify the Kerberoast attack.
Also, I want the results to be saved in the CSV format,
so I'll put ‑OutputType and then CSV.
Perfect.
Now, all I have to do is to press Enter.
And in just a few seconds we have a new CSV file created,
so let's take a look at it.
This new file,
it is inside of the ADRecon folder and into this output folder here.
In here, let's go to CSV results and open the Kerberoast file.
Awesome.
Take a look.
We have here the name of the service accounts and the hashes in two formats.
One is for the John the Ripper password cracking tool,
and the other one is for the hashcat password cracking tool.
All we have to do now is crack those hashes.
So, let me copy those hashes for the hashcat tool.
Perfect.
Now,
let me go to my Kali Linux virtual machine where I have all my writing tools.
In here, I open the terminal, go to the Desktop folder,
and save the hashes into a new file called gbm_hashes,
which stands for Globomantics hashes.
Perfect.
We can check the content of the file now,
just to make sure the hashes are there.
Also,
I have here a password list file containing several passwords
that'll be used to crack the hashed passwords.
Perfect.
Now all I have to do is run the hashcat.
For that, I will type hashcat and then ‑m to define the mode,
or in other words, to specify the type of the hashes that we're trying to crack.
It is pretty much impossible to memorize all the hashes from hashcat,
so let me open my browser and Google hashcat modes.
Then let me go to the first link, which is the official documentation.
And here, let me search for the word Kerberos.
As you can see, there are three types of Kerberos hashes here.
If we take a look in _____ hashes, you see that they start with krb5tgs.
Krb, it stands for Kerberos, 5 is the version of the Kerberos hash,
and tgs is the type of hash.
So let's take a look at the hashcat modes.
Perfect.
Here, take a look.
The Kerberos TGS hash, and the code for this hash is 13100.
So let's go back to the terminal and type this code in there.
Cool.
Now we need to put the name of the file containing the hashes and then the
name of the file containing the password list. And that's it.
Let's execute it.
Oh, wait, take a look.
We've got an error here.
And this error is really common if you're using Kali Linux in a virtual machine.
It basically says that it did not find any GPUs to run.
So, we can ignore this error by using ‑‑force,
which will tell hashcat to use my CPU instead of my GPU.
So, let's start again.
Let's use the same command, but let's use the flag ‑‑force.
Perfect.
Now, when I press Enter,
hashcat will try to use the password list to find the clear text password
for the hashes that we extracted with the ADRecon tool.
After a few minutes, you see this, the hashes,
and then column, and the plain text password.
For this sql‑admin‑1 account,
the clear text password is Secret123 and an exclamation mark.
For this svc‑iis‑01 account,
the password is alsoSecret123!. And for this svc‑iis‑02 account,
the password isPassword123!. Pretty cool,
right?
Just in a few minutes,
we're able to get the plain text passwords for those service accounts.
So, let's try to use this first account.
As you can see, it is used to log into this SQL‑SERVER‑01 machine.
Since we have tons of information from ADRecon,
let's take a look on what the server is.
So let's go back to our Windows machine and open the
report that I _____ in the previous demo.
In here, let's go to the Computers tab, and in this list,
I can see that this SQL‑SERVER‑01 machine is running Windows
2008, and I even have the IP address here.
Perfect.
Now that I have the IP address, the username, and the password,
let's use Remote Desktop to look into the server.
So I type the IP here and I click on Connect.
Here, Windows is asking which credentials I want to use to log into machine.
Since I will use a different credential,
I will go to the button More options and click on Use a different account.
Now here I can type the credentials for the account
that we just got the password, which is sql‑admin‑1,
and the password isSecret123!. So, let's just click on OK,
accept the certificate warning, and that's it.
We're in the server.
We can even open a prompt to check which user we are using here.
And we can check the permissions for this user using the
comment net user /domain sql‑admin‑1.
As you can see here, this user is a local admin to the server.
That's awesome.
Just by using the ADRecon and some other techniques,
we're able to get the hash passwords for a few accounts and use
those accounts to get admin access to a server.
Pretty cool, right?