Part 5: Hacking Active Directory - (StellarComms)

[BLUF]
This video demonstrates the final stage of a five-part series on compromising the Stellar Active Directory lab, showing how to exploit Write DACL privileges to reset a user password, extract a GMSA hash, and perform a DC Sync attack to achieve full domain control 1:53.

Key Takeaways:
• After compromising the 'Astral Researcher' account, the attacker used BloodHound to identify a 'Write DACL' permission on the 'engineering.payload' user, which allows granting any permissions, including Generic All 2:05.
• Using 'BloodyAD', the attacker granted themselves Generic All rights over 'engineering.payload', then used the same tool to reset that user's password to 'hacksmarter123' 7:25.
• With access to 'engineering.payload', the attacker utilized NetExec's LDAP module to retrieve the NTLM hash of the 'SAT Link' Group Managed Service Account (GMSA) 16:35.
• The attacker authenticated as the 'SAT Link' computer account using the retrieved hash via NetExec SMB, which possessed DC Sync privileges 18:30.
• Finally, the attacker used NetExec to dump the NTDS database, obtained the Administrator's hash, and used Evil-WinRM to gain a shell on the Domain Controller and retrieve the root flag 20:00.

[Closing statement]
By chaining these vulnerabilities, the attacker successfully moved from a single compromised user to full domain administrator access, completing the lab challenge.

Sources:

• 1:53 Introduction to BloodHound enumeration for the 'Astral Researcher' user.
• 2:05 Identification of 'Write DACL' permission on 'engineering.payload'.
• 7:25 Using BloodyAD to grant Generic All privileges.
• 16:35 Retrieving the GMSA password hash via NetExec.
• 18:30 Authenticating as the SAT Link service account.
• 20:00 Performing DC Sync and obtaining the root flag.