Belajar Red Team Operator - Active Directory Attack Chains

#Pendahuluan

Setelah di episode 6 kita mempelajari lateral movement & pivoting — Pass-the-Hash, PSRemoting, dan tunneling — pada episode ini kita mendalami Active Directory attack chains: mengkompromi seluruh domain dari foothold awal melalui berbagai teknik Kerberos, GPO, dan ADCS exploitation.

AD attack chains adalah seni menghubungkan beberapa teknik untuk mencapai Domain Admin. Setiap chain memiliki multiple paths — dan memilih path yang tepat tergantung pada konfigurasi target.

#Kerberos Attack Chains

#Chain 1: Kerberoasting → Crack → DA

text

Step 1: Enumerate SPNs
  → GetUserSPNs → temukan service accounts
 
Step 2: Kerberoast
  → Request TGS → dapat hash
 
Step 3: Crack hash offline
  → Hashcat mode 13100
 
Step 4: Use cracked password
  → Pass-the-Password ke DC atau other services
  → Domain Admin

#Chain 2: AS-REP Roasting → Lateral Movement

text

Step 1: Find accounts without preauth
  → GetNPUsers
 
Step 2: Crack TGT hash
  → Hashcat mode 18200
 
Step 3: Use compromised account
  → Depends on account permissions
  → May chain ke other attacks

#ADCS (Active Directory Certificate Services) Exploitation

#ESC1 — Misconfigured Certificate Template

text

ESC1 Exploitation
===================
1. Enumerate certificate templates
  → Certify or Certipy
 
2. Find vulnerable template
  → ClientAuth + ENROLLEE_SUPPLIES_SUBJECT
 
3. Request certificate as another user
  → Specify SAN (Subject Alternative Name)
 
4. Use certificate for authentication
  → PKINIT → TGT → Domain Admin

bash

# Enumerate with Certify
Certify.exe find /vulnerable
 
# Or Certipy (Python)
certipy find -u user@domain.com -p password -dc-ip dc_ip -vulnerable
 
# Request certificate (ESC1)
certipy req -u user@domain.com -p password -dc-ip dc_ip \
  -ca CA-NAME -template VULNERABLE_TEMPLATE \
  -upn administrator@domain.com

#ESC8 — NTLM Relay to ADCS HTTP Endpoint

text

ESC8 Chain
===========
1. Find HTTP enrollment endpoint
2. Set NTLM relay (ntlmrelayx)
3. Coerce authentication (PetitPotam, PrinterBug)
4. Relay → certificate → TGT → DA

#GPO Abuse

#GPO Enumeration

bash

# BloodHound
bloodhound-python -u user -p pass -d domain.com -dc dc_ip -c GPO
 
# PowerShell
Get-GPO -All | ForEach-Object {
    $_ | Get-GPOReport -ReportType XML | Select-String "GPO Name"
}

#GPO Modification

text

GPO Abuse Paths
================
1. WriteGPO → modify GPO → deploy malicious settings
2. WriteGPLink → link GPO ke OU yang luas
3. GPO Admin Templates → modify registry settings

#Example: GPO → Code Execution

powershell

# Modify GPO untuk add scheduled task
# 1. Find GPO yang bisa dimodifikasi
# 2. Add Immediate Scheduled Task
# 3. Task executes when GP refresh (90 min default)

#Full AD Attack Chain

#Scenario: From Low-Priv to Domain Admin

text

Complete AD Attack Chain
==========================
1. Initial Access
   → Spearphishing → foothold di workstation
 
2. Credential Access
   → LSASS dump → local admin hash
 
3. Lateral Movement
   → PtH ke file server
 
4. Discovery
   → BloodHound → find DA path
 
5. Kerberoasting
   → Crack service account password
 
6. If service account has DA:
   → Direct access DC
   → DCSync
   → Extract krbtgt hash
   → Golden Ticket
 
7. If service account no DA:
   → ADCS ESC1 → certificate → TGT
   → Use TGT untuk access DC
   → DCSync

#Detection Avoidance

text

AD Attack Detection
====================
- Kerberoasting → Event 4769 (TGS request)
- DCSync → Event 4662 (DS-Replication)
- GPO modification → Event 5136
- Certificate abuse → CA event logs
 
Evasion:
- Use timing-based attacks (spread requests)
- Target accounts with weak passwords
- Use non-standard tools

Note

AD attack chains sangat dependent pada konfigurasi target. Selalu jalankan BloodHound untuk memetakan jalur terpendek sebelum memilih teknik. Jangan menghabiskan waktu untuk teknik yang tidak relevan.

#Praktik: AD Attack Chain Lab

bash

# 1. Setup GOAD lab atau DetectionLab
# 2. Jalankan BloodHound collection
# 3. Identify shortest path to DA
# 4. Execute chain (minimum 3 steps)
# 5. Document: detection response di SIEM

#Penutup

Inti yang harus dibawa pulang:

Kerberos chains: Kerberoasting → crack → lateral movement → DA.
ADCS exploitation: ESC1 (certificate template), ESC8 (NTLM relay).
GPO abuse: modify GPO → deploy malicious settings → code execution.
Full chain: foothold → credential access → lateral movement → DA.

Di episode 8 selanjutnya, kita akan mempelajari cloud & hybrid attack chains — AWS, Azure, AAD attacks, dan identity compromise di cloud environment.