Part 3: Hacking Active Directory - (StellarComms)

BLUF: This video demonstrates the execution of an Active Directory attack path in the StellarComs lab, where the attacker leverages group ownership rights to compromise the 'ops controller' user and gain remote access to the domain controller 1:15.

Key Takeaways:
• The attacker identified a privilege escalation path via the 'Stellar Ops Control' group, which allows members to force-change the password of the 'ops controller' user 1:20.
• Using Impacket's owneredit script, the attacker changed the ownership of the group to their compromised 'junior analyst' account, correcting syntax issues found in BloodHound documentation 2:05.
• After gaining ownership, the attacker used dacledit to grant themselves the 'Write Members' permission on the group, allowing them to add their user account to it 9:10.
• The attacker successfully reset the 'ops controller' password using net rpc password, noting that in real-world engagements, they would typically coordinate with the client to create a new privileged account instead 14:40.
• Remote access to the domain controller was achieved using Evil-WinRM with the newly compromised credentials, allowing the retrieval of the user flag 19:15.

The demonstration highlights the importance of understanding Active Directory permissions and the practical application of tools like Impacket for privilege escalation. It also emphasizes professional conduct during pentests by advising coordination with clients before modifying production accounts.

Sources:

• 1:15 Identification of the attack path involving the 'Stellar Ops Control' group and the 'ops controller' user.
• 2:05 Execution of owneredit to change group ownership to the attacker's user.
• 9:10 Use of dacledit to add the attacker to the group and reset permissions.
• 14:40 Discussion on professional pentesting practices regarding password resets in production environments.
• 19:15 Successful login to the domain controller via Evil-WinRM and retrieval of the user flag.