In this lesson, we're going to talk
about two types of attacks, Kerberos Attacks
and Lightweight Directory Access Protocol injection attacks,
which is the LDAP attack,
and also how to use CrackMapExec.
Understanding these attacks will help you defend
against them and also use them during your Pen Test.
First, let's look at Kerberos attacks.
Kerberos is a network authentication protocol used
to verify the identity of users and services.
One common Kerberos attack is the pass the ticket attack.
In this attack, the attacker captures a Kerberos ticket
and uses it to authenticate
as the original user without needing their password.
This could be done using tools like mimikatz.
Imagine you have access
to a compromised machine on your network.
You could use mimikatz to extract a Kerberos ticket
with the following command,
mimikatz # kerberos :: list /export.
This command lists and exports the Kerberos tickets
present on the machine.
You can then use these tickets
to access other network resources as the original user.
Another example of a Kerberos attack is
the Kerberoasting attack,
where attackers extract service accounts tickets
and attempt to crack their passwords offline.
To protect against Kerberos attacks,
organizations should enforce strong password policies,
regularly update service accounts passwords,
and monitor for unusual authentication activity.
Next, let's discuss LDAP injection attacks.
LDAP is a protocol used to access
and maintain directory information services.
LDAP injection occurs when an attacker exploits
insecure LDAP queries to manipulate
or retrieve sensitive information
from the directory service.
For example, if an application uses unsanitized user input
into a LDAP query, an attacker could inject malicious code
to alter the query's behavior.
This query might return all users in a directory,
bypassing authentication.
To defend against LDAP injection,
always sanitize user inputs, use parameterized queries,
and also implement proper input validation.
Finally, let's take a look at how to use CrackMapExec.
CrackMapExec is a post-exploitation tool
that helps automate various tasks in a Windows environment.
It can be used for credential validation, user enumeration,
and executing commands on remote systems.
Suppose you have a list of usernames and passwords,
and want to check their validity on a network.
You could use CrackMapExec
with a command like crackmapexec smb,
then we have the IP address,
the -u option with a users.txt,
and the -p option with a password.txt file.
In this command, smb specifies the protocol,
and then we have the IP address with a CIDR notation of 24,
which specifies the target IP range.
And then we have -u, which points at the user.txt file,
which provides the list of usernames.
And then we have the -p option,
which points to the passwords.txt file,
which provides the list of passwords.
This command will try each username and password pair
across all IP addresses in the specific range.
CrackMapExec can also be used for executing commands
on remote systems, dumping SAM hashes, and more.
For instance, to execute a command on a remote system,
you might use crackmapexec smb.
It will have the IP address,
the -u option and -p option again,
with the -x option pointing to the 'ipconfig.'
This runs the 'ipconfig' command on the remote system
with the IP address of 192.168.1.100
using the provided admin credentials.
To reiterate again,
to defend against the misuse of tools like CrackMapExec,
make sure you're using strong credential policies,
monitoring for unusual command execution,
and then segment your network to limit access.
So remember, Kerberos attacks involve
exploiting Kerberos authentication,
and LDAP injection manipulates directory queries.
We can also use a tool like CrackMapExec
to automate post-exploitation tasks.
Understanding these methods will help you both defend
against and use these attacks in your Penetration Test.