Creating a Second Expansion Pack to Mishky’s AD Range
TL;DR I added a third Forest to Mishky’s AD Range. It includes ideas from the first two forests while continuing to improve how I write code. This forest stresses some attacker TTPs I didn’t cover already in the first two forests.
I made a few more changes in the third forest:
- Many functions are now in their own PS1s. I simply call them from the main PS1, ‘Create-Shop.ps1’.
- Pre-reqs.ps1 is largely unchanged. The third forest only requires a Windows Server 2022 ISO.
- I added two more places one can cache credentials in Windows that I hadn’t used in the first two forests.
- The third forest includes a webserver running on IIS
- The third forest includes local privilege escalation. This was missing in the first two forests, in those any VM access was as local admin. In shop.local initial access is as a mere Domain User who does NOT have local admin.
I’m not changing the range diagram, not yet anyway, as there is no trust relationship between the third forest, shop.local, and lab.local or research.local.
Using the third forest
- Run Pre-reqs.ps1 if you didn’t already do so (enables Hyper-V, creates folders, pulls required ISOs, sets up the VMSwitch, etc)
- Run Create-Shop.ps1 (spins up 2 VMs and configs everything). You will need to hit Accept or Yes at a few places during the setup as it is pulling additional modules from the PowerShell Gallery.
- Open up Hyper-V Manager, connect to each VM, and hit Next. This will leave each VM sitting at a login screen instead of ‘select keyboard layout’ screen.
- Spin up your Kali VM, run an nmap scan of .151, and start attacking the range.
So what’s new or different?
This third forest stresses a few things I failed to include in the first two forests:
- Enumeration with nmap
- Webserver enumeration to glean usernames
- Password/hash spraying against those usernames
- Local privilege escalation [going from mere user to local admin]
- Dumping credentials from a few other locations
- GPO enumeration & abuse
What’s the same?
Much like the first two forests, shop.local includes a few curveballs. If you are following the twisting, windy, convoluted escalation path then you will need to fully enumerate rights and leverage true effective rights in NTFS and AD. Don’t confuse true effective rights with “Active Directory Effective Permissions” as a certain vendor likes to do.
Get Rich’s stories in your inbox
Join Medium for free to get updates from this writer.
I don’t have anything to sell, I already have a job. Everything I do in the home lab while FAFOing is free on my Medium or GitHub. I don’t paywall, I find those disgusting and contrary to the original intent of the WWW.
Additionally, I had to write the entire setup in PowerShell. That’s what I love about this project, it forces me to automate the entire thing and do IaC. I can try an idea out in the GUI, but then I have to implement it in code.
Also, I almost never write flawless, functional code right off the bat. I spent about a week writing the setup for this forest and tweaking it once I tried to run it so it’d build into live VMs.
I then spent 2 days of a 4 day weekend testing and validating my creation as a pretend attacker on my Kali VM. I found numerous bugs/issues during this time and fixed them. In my mind I had imagined an escalation path and then created it in PowerShell, Hyper-V, and a forest … but then found that it just wasn’t exploitable from Kali, or it was but there was no way in heaven or hell that anyone could enumerate it without having the ‘White Box’ knowledge that I, as the creator of the range, had.
I then tweaked things, and in a few cases I left my original idea in the range along with the proven attacker TTP I followed from Kali added in. Perhaps someone smarter than myself can follow my original idea.
Attacking the third forest
There’s no ‘Generate-Traffic.ps1’, just run the setup and fire up Kali once it’s done. I strongly suggest one keep two text files; passwords and hashes found in the first two forests.
As always, dump everything and move laterally to own any accounts found even if they’re not a local or Domain Admin. Fully enumerate, one may have to give themselves the rights to abuse something.
Summary
Much like lab.local and research.local, I had wanted to put this on TryHackMe. It’s 10 VMs across 3 forests, and 4 domains. It stresses just about every attacker TTP in AD.
They wouldn’t let me, even after I offered to do it for free. Hence it lives on GitHub. A mere shadow of Forest 1 lives in a free TryHackMe room here. I hated having to create that duct tape, Macgyvered Abomination, and THM still hasn’t approved it so it can be a publicly listed free Challenge Room.
The real, unaltered, as made for TryHackMe project lives on GitHub here, here, and here.
Screw it, spoiler alert and all that, but I was so damn proud when I got to this screenshot on my Kali VM.
I’ll admit it, I’m damn proud of the escalation path I wove into shop.local. Students will have to dump everything, and I mean everything, they find in lab.local and research.local and then password/hash spray it against the usernames they enumerate in shop.local to gain initial access in the third domain.
While shop.local is a standalone 2 VM range, it’s highly unlikely students can gain initial access to it without
- dumping every password and NTLM hash they can find in the first two forests
- enumerating usernames in shop.local
- password/hash spraying against those usernames
The Third Domain’s escalation path goes from LAN access to Domain Admin, but it’s windy, twisting, and includes a few curveballs I threw in there. There are no unpatched 0 Days involved. This path is made up of many small [mis]configurations that by themselves may seem insignificant but together add up into serious Misconfiguration Debt.
In other words, I created yet another thing that I call “The Escalation Path from Hell”. I created it, and even I had trouble following it as a pretend attacker from a Kali VM.
Honestly, if you follow the path and can explain how you did so in a “pentest report” then I will personally send you a “completion cert” for 40 CPEs. If your cert org doesn’t accept that PDF than that’s on them. You will have earned my respect.
References
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets
