Part 4: Hacking Active Directory - (StellarComms)

[BLUF]
This video demonstrates privilege escalation in an Active Directory lab by extracting credentials from a Domain Controller's Firefox installation, ultimately compromising the "Astro Researcher" account 2:15-2:30. The attacker leverages WinRM access to locate and decrypt stored browser passwords using the target's own Firefox profile 4:10-4:30.

Key Takeaways:
• After compromising the "ops_controller" user, the attacker checks BloodHound for outbound object control and interesting group memberships, finding none that allow immediate escalation 2:15-2:30.
• The attacker identifies a critical target: the "satlink_service" account, which possesses DCsync privileges, making it the primary goal for credential theft 4:10-4:30.
• Recalling that Firefox is installed on the Domain Controller, the attacker navigates to the user profile directory to locate the login.json and key4.db files containing encrypted credentials 5:10-5:30.
• Instead of using third-party decryption tools, the attacker copies login.json and key4.db into their local Firefox profile directory to leverage Firefox's built-in decryption capabilities 12:20-12:40.
• By importing the database keys into their local browser, the attacker successfully retrieves the plaintext password for the "Astro Researcher" account 17:50-18:10.

The attacker successfully escalates privileges by exploiting local browser data storage on a high-privilege machine. This method provides a reliable alternative to complex decryption scripts when standard tools fail or are unavailable.

Sources:

• 2:15 Analysis of BloodHound results for the compromised user.
• 4:10 Identification of the DCsync target account.
• 5:10 Discovery of Firefox installation on the Domain Controller.
• 12:20 Strategy for decrypting Firefox passwords via local profile import.
• 17:50 Successful retrieval of the Astro Researcher credentials.