OCO AD Range

[marissaeinhorn]

Attack chain

1. Catch Callback from pre-seeded implant from .45

• Requires listener set up properly (either in sliver/other post-ex
  platform/MSF depending on range availability)
• Requires redirector set up properly

2. Survey Accesses after gaining access

• Will have user-level access
• Need to priv-esc to get system (PowerSploit)
• Workstation Admin is logged into the system

3. Gain Workstation Admin Credentials

• Use migrate or steal the token for the Workstation Admin that you see
  logged in when surveying

4. Active Directory Enumeration

• BloodHound
• PowerView
• net commands (e.g. net <computers/users/groups> /domain)
• Get-AD* commands

5. ID Domain Admin logged into the .10 (probably from BloodHound sessions
   report)

6. ID Basic Facts about the domain itself

• Users / Groups / Computers
• Domain Admins
• Workstation Admins
• Enterprise Admins
• etc.

7. Laterally move to the .100 to obtain DA credentials

8. Elevate to system and migrate or steal token of Domain Admin logged in

9. Laterally move to the Domain Controller (DC)

10. Collect/crack hashes for the domain

• Can do w/ mimikatz/kiwi
• Steal ntds.dit