search

⚡Bleeding Edge Vulnerabilities

hashtag
🎯 HTB Academy: Active Directory Enumeration & Attacks

hashtag
📍 Overview

Bleeding Edge Vulnerabilities represent the latest and most critical Active Directory attack vectors discovered in recent years. These techniques leverage recently disclosed vulnerabilities that many organizations have not yet patched, providing opportunities for rapid domain compromise. This module covers three devastating attack techniques: NoPac (SamAccountName Spoofing), PrintNightmare, and PetitPotam (MS-EFSRPC) - all capable of achieving domain compromise from standard user accounts or even unauthenticated access.

hashtag
🔗 Attack Chain Context

Complete Active Directory Compromise Timeline:

Standard User Access → Bleeding Edge Exploitation → Domain Controller Compromise → Full Domain Control
   (Initial Access)       (Recent CVEs)            (SYSTEM/Admin Rights)        (Enterprise Owned)

Critical Characteristics:

  • Recent vulnerabilities: Released within 6-9 months (as of April 2022)

  • High impact: Direct path to Domain Controller compromise

  • Low privilege requirement: Standard domain user or unauthenticated access

  • Multiple attack vectors: Different exploitation methods for various scenarios

  • Patch management gap: Many organizations slow to deploy patches

hashtag
🚨 Attack Techniques Overview

hashtag
1. NoPac (SamAccountName Spoofing)

  • CVEs: CVE-2021-42278 and CVE-2021-42287

  • Requirements: Standard domain user credentials

  • Impact: Direct Domain Controller compromise and SYSTEM shell

  • Method: Computer account manipulation and Kerberos ticket spoofing

hashtag
2. PrintNightmare

  • CVEs: CVE-2021-34527 and CVE-2021-1675

  • Requirements: Standard domain user credentials

  • Impact: Remote code execution and privilege escalation

  • Method: Print Spooler service exploitation

hashtag
3. PetitPotam (MS-EFSRPC)

  • CVE: CVE-2021-36942

  • Requirements: Unauthenticated access (no credentials needed)

  • Impact: Domain compromise via certificate abuse

  • Method: NTLM relay to Active Directory Certificate Services

hashtag
🎭 NoPac (SamAccountName Spoofing)

hashtag
Vulnerability Overview

hashtag
CVE Breakdown

CVE
Description
Impact

CVE-2021-42278

Security Account Manager (SAM) bypass vulnerability

Allows SamAccountName manipulation

CVE-2021-42287

Kerberos Privilege Attribute Certificate (PAC) vulnerability in ADDS

Enables privilege escalation via ticket spoofing

hashtag
Attack Methodology

  1. Machine Account Creation: Add new computer account to domain (default quota: 10)

  2. Name Spoofing: Change SamAccountName to match Domain Controller

  3. Kerberos Exploitation: Request tickets using spoofed identity

  4. Privilege Escalation: Obtain SYSTEM-level access on Domain Controller

hashtag
Prerequisites and Environment Setup

hashtag
Tool Installation

hashtag
Attack Requirements

  • Domain credentials: Standard domain user account

  • Machine quota: ms-DS-MachineAccountQuota > 0 (default: 10)

  • Network access: Connectivity to Domain Controller

  • Tool dependencies: Impacket toolkit properly installed

hashtag
Vulnerability Assessment

hashtag
Scanning for NoPac Vulnerability

Expected Output (Vulnerable System):

hashtag
Key Vulnerability Indicators

  • Successful TGT retrieval: Indicates vulnerable Kerberos implementation

  • Machine account quota: Non-zero value allows attack execution

  • PAC validation: Vulnerable PAC handling mechanism present

hashtag
Exploitation Methods

hashtag
Method 1: Interactive Shell Access

Complete Attack Output:

hashtag
Method 2: DCSync Attack

DCSync Output:

hashtag
Post-Exploitation Considerations

hashtag
Ticket Management

hashtag
OPSEC Considerations

  • Semi-interactive shells: SMBExec.py creates noticeable artifacts

  • Service creation: BTOBTO and BTOBO services created during execution

  • Batch file execution: execute.bat files created and deleted for each command

  • AV/EDR detection: Shell establishment may trigger security alerts

hashtag
🖨️ PrintNightmare

hashtag
Vulnerability Overview

hashtag
CVE Details

CVE
Description
Impact

CVE-2021-34527

Windows Print Spooler remote code execution vulnerability

RCE with SYSTEM privileges

CVE-2021-1675

Windows Print Spooler privilege escalation vulnerability

Local and remote privilege escalation

hashtag
Attack Prerequisites

  • Print Spooler service: Must be running on target (default on all Windows)

  • Domain credentials: Standard domain user access required

  • Network connectivity: Access to target Domain Controller

  • Exploit dependencies: Cube0x0's modified Impacket version

hashtag
Environment Setup and Dependencies

hashtag
Tool Installation

hashtag
Service Enumeration

hashtag
Exploit Execution Workflow

hashtag
Step 1: Payload Generation

hashtag
Step 2: SMB Share Hosting

hashtag
Step 3: Metasploit Handler Configuration

hashtag
Step 4: Exploit Execution

hashtag
Step 5: SYSTEM Shell Access

hashtag
Windows Defender Considerations

hashtag
Detection Challenges

  • Service creation: BTOBTO service immediately flagged by Windows Defender

  • Batch file execution: execute.bat files trigger malicious behavior detection

  • Payload deployment: SMB-delivered DLL payloads often detected

  • VirTool detection: MSPSEexecCommand specifically identified by Defender

hashtag
Evasion Strategies

  • Alternative payloads: Use different payload encoders or formats

  • Custom exploits: Modify exploit code to avoid signature detection

  • Living-off-the-land: Use legitimate Windows tools for post-exploitation

hashtag
🎫 PetitPotam (MS-EFSRPC)

hashtag
Vulnerability Overview

hashtag
CVE-2021-36942 Details

  • Vulnerability Type: LSA spoofing vulnerability

  • Attack Method: NTLM relay to Active Directory Certificate Services

  • Authentication Required: None (unauthenticated attack)

  • Impact: Complete domain compromise via certificate abuse

  • Patch Status: Patched in August 2021

hashtag
Attack Prerequisites

  • Active Directory Certificate Services (AD CS): Must be deployed in environment

  • Certificate Authority (CA): Web Enrollment interface accessible

  • Network access: Connectivity to Domain Controller and CA server

  • Tool requirements: ntlmrelayx.py and PetitPotam.py

hashtag
Attack Architecture

hashtag
Attack Flow Diagram

hashtag
Exploitation Workflow

hashtag
Step 1: NTLM Relay Setup

hashtag
Step 2: Authentication Coercion

PetitPotam Execution Output:

hashtag
Step 3: Certificate Retrieval

Successful NTLM Relay and Certificate Generation:

hashtag
Certificate-to-TGT Conversion

hashtag
Step 4: TGT Request with PKI Authentication

hashtag
Step 5: Environment Configuration and DCSync

hashtag
Alternative Attack Paths

hashtag
Method 1: Direct Hash Extraction with getnthash.py

hashtag
Method 2: Windows Rubeus Pass-the-Ticket

hashtag
🎯 HTB Academy Lab Solutions

hashtag
Lab Environment Details

  • Attack Host: ATTACK01 (SSH access with htb-student:HTB_@cademy_stdnt!)

  • Target Domain: INLANEFREIGHT.LOCAL

  • Domain Controller: 172.16.5.5

  • Available Credentials: forend:Klmcargo2

hashtag
🔍 Question 1: "Which two CVEs indicate NoPac.py may work? (Format: ####-#####&####-#####, no spaces)"

hashtag
CVE Research and Answer

Based on the NoPac vulnerability documentation and attack methodology:

Answer: 2021-42278&2021-42287

Explanation:

  • CVE-2021-42278: Security Account Manager (SAM) bypass vulnerability allowing SamAccountName manipulation

  • CVE-2021-42287: Kerberos Privilege Attribute Certificate (PAC) vulnerability in ADDS enabling privilege escalation

hashtag
🚀 Question 2: "Apply what was taught in this section to gain a shell on DC01. Submit the contents of flag.txt located in the DailyTasks directory on the Administrator's desktop."

hashtag
Complete Solution Walkthrough

Step 1: SSH to Attack Host

Step 2: Navigate to NoPac Directory

Step 3: Scan for Vulnerability

Step 4: Execute NoPac for Shell Access

Step 5: Navigate to Flag Location

Alternative Method - DCSync Approach:

Step 5: Flag Retrieval

🎯 Answer: D0ntSl@ckonN0P@c!

hashtag
🛡️ Defensive Measures and Mitigations

hashtag
NoPac Mitigations

hashtag
Immediate Actions

hashtag
Long-term Hardening

  • Patch Management: Apply CVE-2021-42278 and CVE-2021-42287 patches

  • Account Monitoring: Monitor for unusual computer account creation patterns

  • Privilege Reviews: Regular review of accounts with machine creation rights

  • Detection Rules: Implement SIEM rules for SamAccountName modifications

hashtag
PrintNightmare Mitigations

hashtag
Service Hardening

hashtag
Group Policy Configuration

  • Print Driver Installation: Restrict driver installation to administrators only

  • Point and Print: Disable point and print functionality via GPO

  • Package Point and Print: Configure secure package point and print settings

hashtag
PetitPotam Mitigations

hashtag
Certificate Services Hardening

hashtag
Network Controls

  • NTLM Relay Protection: Implement SMB signing and channel binding

  • Certificate Template Security: Review and harden certificate templates

  • Network Segmentation: Isolate Certificate Authority from general network

  • LDAP Authentication: Use Kerberos instead of NTLM where possible

hashtag
📊 Key Takeaways

hashtag
Technical Mastery Achieved

  1. Bleeding Edge Exploitation: Proficiency with latest AD attack vectors

  2. Multi-Vector Attacks: Understanding of various domain compromise paths

  3. Certificate Abuse: Advanced PKI and ADCS exploitation techniques

  4. Tool Proficiency: Mastery of NoPac, PrintNightmare, and PetitPotam tools

hashtag
Professional Skills Developed

  • Rapid Adaptation: Ability to quickly implement new attack techniques

  • Risk Assessment: Understanding impact and exploitability of recent vulnerabilities

  • Client Communication: Effectively explaining cutting-edge threats to stakeholders

  • Patch Prioritization: Identifying critical vulnerabilities requiring immediate attention

hashtag
Attack Methodology Mastery

hashtag
Defensive Insights

  • Patch Management: Critical importance of timely security updates

  • Attack Surface Reduction: Disabling unnecessary services and features

  • Monitoring Requirements: Detection strategies for advanced persistent threats

  • Incident Response: Rapid containment procedures for domain compromise

🔑 Complete mastery of bleeding edge Active Directory vulnerabilities - from theoretical understanding through practical exploitation to defensive implementation - representing cutting-edge enterprise penetration testing capabilities for the most current threat landscape!

PreviousKerberos "Double Hop" ProblemNextMiscellaneous Misconfigurations

Last updated