⚡Bleeding Edge Vulnerabilities
🎯 HTB Academy: Active Directory Enumeration & Attacks
📍 Overview
Bleeding Edge Vulnerabilities represent the latest and most critical Active Directory attack vectors discovered in recent years. These techniques leverage recently disclosed vulnerabilities that many organizations have not yet patched, providing opportunities for rapid domain compromise. This module covers three devastating attack techniques: NoPac (SamAccountName Spoofing), PrintNightmare, and PetitPotam (MS-EFSRPC) - all capable of achieving domain compromise from standard user accounts or even unauthenticated access.
🔗 Attack Chain Context
Complete Active Directory Compromise Timeline:
Standard User Access → Bleeding Edge Exploitation → Domain Controller Compromise → Full Domain Control
(Initial Access) (Recent CVEs) (SYSTEM/Admin Rights) (Enterprise Owned)Critical Characteristics:
Recent vulnerabilities: Released within 6-9 months (as of April 2022)
High impact: Direct path to Domain Controller compromise
Low privilege requirement: Standard domain user or unauthenticated access
Multiple attack vectors: Different exploitation methods for various scenarios
Patch management gap: Many organizations slow to deploy patches
🚨 Attack Techniques Overview
1. NoPac (SamAccountName Spoofing)
CVEs: CVE-2021-42278 and CVE-2021-42287
Requirements: Standard domain user credentials
Impact: Direct Domain Controller compromise and SYSTEM shell
Method: Computer account manipulation and Kerberos ticket spoofing
2. PrintNightmare
CVEs: CVE-2021-34527 and CVE-2021-1675
Requirements: Standard domain user credentials
Impact: Remote code execution and privilege escalation
Method: Print Spooler service exploitation
3. PetitPotam (MS-EFSRPC)
CVE: CVE-2021-36942
Requirements: Unauthenticated access (no credentials needed)
Impact: Domain compromise via certificate abuse
Method: NTLM relay to Active Directory Certificate Services
🎭 NoPac (SamAccountName Spoofing)
Vulnerability Overview
CVE Breakdown
CVE-2021-42278
Security Account Manager (SAM) bypass vulnerability
Allows SamAccountName manipulation
CVE-2021-42287
Kerberos Privilege Attribute Certificate (PAC) vulnerability in ADDS
Enables privilege escalation via ticket spoofing
Attack Methodology
Machine Account Creation: Add new computer account to domain (default quota: 10)
Name Spoofing: Change SamAccountName to match Domain Controller
Kerberos Exploitation: Request tickets using spoofed identity
Privilege Escalation: Obtain SYSTEM-level access on Domain Controller
Prerequisites and Environment Setup
Tool Installation
Attack Requirements
Domain credentials: Standard domain user account
Machine quota: ms-DS-MachineAccountQuota > 0 (default: 10)
Network access: Connectivity to Domain Controller
Tool dependencies: Impacket toolkit properly installed
Vulnerability Assessment
Scanning for NoPac Vulnerability
Expected Output (Vulnerable System):
Key Vulnerability Indicators
Successful TGT retrieval: Indicates vulnerable Kerberos implementation
Machine account quota: Non-zero value allows attack execution
PAC validation: Vulnerable PAC handling mechanism present
Exploitation Methods
Method 1: Interactive Shell Access
Complete Attack Output:
Method 2: DCSync Attack
DCSync Output:
Post-Exploitation Considerations
Ticket Management
OPSEC Considerations
Semi-interactive shells: SMBExec.py creates noticeable artifacts
Service creation: BTOBTO and BTOBO services created during execution
Batch file execution: execute.bat files created and deleted for each command
AV/EDR detection: Shell establishment may trigger security alerts
🖨️ PrintNightmare
Vulnerability Overview
CVE Details
CVE-2021-34527
Windows Print Spooler remote code execution vulnerability
RCE with SYSTEM privileges
CVE-2021-1675
Windows Print Spooler privilege escalation vulnerability
Local and remote privilege escalation
Attack Prerequisites
Print Spooler service: Must be running on target (default on all Windows)
Domain credentials: Standard domain user access required
Network connectivity: Access to target Domain Controller
Exploit dependencies: Cube0x0's modified Impacket version
Environment Setup and Dependencies
Tool Installation
Service Enumeration
Exploit Execution Workflow
Step 1: Payload Generation
Step 2: SMB Share Hosting
Step 3: Metasploit Handler Configuration
Step 4: Exploit Execution
Step 5: SYSTEM Shell Access
Windows Defender Considerations
Detection Challenges
Service creation: BTOBTO service immediately flagged by Windows Defender
Batch file execution: execute.bat files trigger malicious behavior detection
Payload deployment: SMB-delivered DLL payloads often detected
VirTool detection: MSPSEexecCommand specifically identified by Defender
Evasion Strategies
Alternative payloads: Use different payload encoders or formats
Custom exploits: Modify exploit code to avoid signature detection
Living-off-the-land: Use legitimate Windows tools for post-exploitation
🎫 PetitPotam (MS-EFSRPC)
Vulnerability Overview
CVE-2021-36942 Details
Vulnerability Type: LSA spoofing vulnerability
Attack Method: NTLM relay to Active Directory Certificate Services
Authentication Required: None (unauthenticated attack)
Impact: Complete domain compromise via certificate abuse
Patch Status: Patched in August 2021
Attack Prerequisites
Active Directory Certificate Services (AD CS): Must be deployed in environment
Certificate Authority (CA): Web Enrollment interface accessible
Network access: Connectivity to Domain Controller and CA server
Tool requirements: ntlmrelayx.py and PetitPotam.py
Attack Architecture
Attack Flow Diagram
Exploitation Workflow
Step 1: NTLM Relay Setup
Step 2: Authentication Coercion
PetitPotam Execution Output:
Step 3: Certificate Retrieval
Successful NTLM Relay and Certificate Generation:
Certificate-to-TGT Conversion
Step 4: TGT Request with PKI Authentication
Step 5: Environment Configuration and DCSync
Alternative Attack Paths
Method 1: Direct Hash Extraction with getnthash.py
Method 2: Windows Rubeus Pass-the-Ticket
🎯 HTB Academy Lab Solutions
Lab Environment Details
Attack Host: ATTACK01 (SSH access with
htb-student:HTB_@cademy_stdnt!)Target Domain: INLANEFREIGHT.LOCAL
Domain Controller: 172.16.5.5
Available Credentials:
forend:Klmcargo2
🔍 Question 1: "Which two CVEs indicate NoPac.py may work? (Format: ####-#####&####-#####, no spaces)"
CVE Research and Answer
Based on the NoPac vulnerability documentation and attack methodology:
Answer: 2021-42278&2021-42287
Explanation:
CVE-2021-42278: Security Account Manager (SAM) bypass vulnerability allowing SamAccountName manipulation
CVE-2021-42287: Kerberos Privilege Attribute Certificate (PAC) vulnerability in ADDS enabling privilege escalation
🚀 Question 2: "Apply what was taught in this section to gain a shell on DC01. Submit the contents of flag.txt located in the DailyTasks directory on the Administrator's desktop."
Complete Solution Walkthrough
Step 1: SSH to Attack Host
Step 2: Navigate to NoPac Directory
Step 3: Scan for Vulnerability
Step 4: Execute NoPac for Shell Access
Step 5: Navigate to Flag Location
Alternative Method - DCSync Approach:
Step 5: Flag Retrieval
🎯 Answer: D0ntSl@ckonN0P@c!
🛡️ Defensive Measures and Mitigations
NoPac Mitigations
Immediate Actions
Long-term Hardening
Patch Management: Apply CVE-2021-42278 and CVE-2021-42287 patches
Account Monitoring: Monitor for unusual computer account creation patterns
Privilege Reviews: Regular review of accounts with machine creation rights
Detection Rules: Implement SIEM rules for SamAccountName modifications
PrintNightmare Mitigations
Service Hardening
Group Policy Configuration
Print Driver Installation: Restrict driver installation to administrators only
Point and Print: Disable point and print functionality via GPO
Package Point and Print: Configure secure package point and print settings
PetitPotam Mitigations
Certificate Services Hardening
Network Controls
NTLM Relay Protection: Implement SMB signing and channel binding
Certificate Template Security: Review and harden certificate templates
Network Segmentation: Isolate Certificate Authority from general network
LDAP Authentication: Use Kerberos instead of NTLM where possible
📊 Key Takeaways
Technical Mastery Achieved
Bleeding Edge Exploitation: Proficiency with latest AD attack vectors
Multi-Vector Attacks: Understanding of various domain compromise paths
Certificate Abuse: Advanced PKI and ADCS exploitation techniques
Tool Proficiency: Mastery of NoPac, PrintNightmare, and PetitPotam tools
Professional Skills Developed
Rapid Adaptation: Ability to quickly implement new attack techniques
Risk Assessment: Understanding impact and exploitability of recent vulnerabilities
Client Communication: Effectively explaining cutting-edge threats to stakeholders
Patch Prioritization: Identifying critical vulnerabilities requiring immediate attention
Attack Methodology Mastery
Defensive Insights
Patch Management: Critical importance of timely security updates
Attack Surface Reduction: Disabling unnecessary services and features
Monitoring Requirements: Detection strategies for advanced persistent threats
Incident Response: Rapid containment procedures for domain compromise
🔑 Complete mastery of bleeding edge Active Directory vulnerabilities - from theoretical understanding through practical exploitation to defensive implementation - representing cutting-edge enterprise penetration testing capabilities for the most current threat landscape!
Last updated