CLIENT, LLC

Internal Penetration Test

September 30, 2024
 PAGE \

Contents
INTRODUCTION................................................................................................................................................................... 3
REPORT STRUCTURE........................................................................................................................................................... 3
EXECUTIVE SUMMARY....................................................................................................................................................... 4
SCOPE OF WORK................................................................................................................................................................ 4
TIMELINE............................................................................................................................................................................. 4
ASSESSMENT SUMMARY...................................................................................................................................................... 5
POSITIVE PRACTICES IDENTIFIED.......................................................................................................................................... 6
HIGH-LEVEL SIGNIFICANT TECHNICAL FINDINGS.................................................................................................................... 7
STRATEGIC RECOMMENDATIONS.......................................................................................................................................... 7
ATTACK KILL CHAIN.......................................................................................................................................................... 9
RECONNAISSANCE............................................................................................................................................................... 9
TARGET DEVELOPMENT..................................................................................................................................................... 10
INTRUSION......................................................................................................................................................................... 10
LATERAL MOVEMENT......................................................................................................................................................... 11
DATA EXFILTRATION.......................................................................................................................................................... 11
OPERATIONS NARRATIVE............................................................................................................................................... 12
INITIAL ACCESS................................................................................................................................................................. 12
NETWORK PROPAGATION................................................................................................................................................... 18
CLOSURE....................................................................................................................................................................... 27
TECHNICAL DETAILS....................................................................................................................................................... 28

CLIENT, LLC | Penetration Test Report

 PAGE \

Introduction
Report Structure
The report is structured as follows:
▪ Executive Summary: This section contains information about the assessment, what assets were tested,
and a high-level summary of findings and recommendations for remedial actions.
▪ Attack Kill Chain: This section provides a brief overview of the methodology typically used to simulate this
type of assessment.
▪ Operations Narrative: This section walks through the Attack Kill Chain and the Tactics, Techniques and
Procedures (TTPs) used during the execution of our attacks.
▪ Technical Details: Contains the technical descriptions of the findings and any associated risks Client, LLC
(“Client) technical team may wish to consider when remediating. This section highlights evidence collected
during the tests and proposes steps or activities required to resolve the issues outlined.

CLIENT, LLC | Penetration Test Report

 PAGE \

Executive Summary
Client, LLC (“Client”) engaged CyberGen, LLC (“CyberGen”, “Consultants”, “Offensive Security team”) to execute
Attack and Penetration tests against its internal network infrastructure, from the standpoint of an adversary who had
established a network connection within the internal network.

The penetration test had the following objectives:

▪ Identify attack vectors and weaknesses within the Client Corporate internal network infrastructure.
▪ Use various adversarial Tactics, Techniques and Procedures (TTPs) to compromise Client Active Directory
infrastructure.
▪ Determine the potential impact of identified weaknesses on Client.
▪ Provide recommendations for mitigating identified attack vectors and enhancing network security.
▪ Evaluate the effectiveness of existing security controls and identify areas for improvement.

The Offensive Security team employed the concept of path of least resistance attack kill chains to execute these
tests, which focused on attempting to access Client’s resources by exploiting identified security weaknesses, which
would provide the least resistance to an adversary.

The following is an explanation of the access provided to the team during the internal penetration test:
▪ Client deployed an instance of a Kali Linux system within Client’s internal network, which could provide the
Offensive Security team access to the internal network of Client.
▪ Client also deployed a Windows Operating System on the internal network, which served as a Jump Box
from outside the network.
▪ The CyberGen Offensive Security team first connected to the Windows Jump Box and then connected to the
Kali Linux system from the Jump Box via SSH and also Remote Desktop Protocol (RDP).
▪ The Kali Linux system was used to execute the test within Client internal network environment.

Throughout the execution of the tests, the Offensive Security team identified several positive findings, and also
identified some vulnerabilities and attack vectors. The detailed findings are listed in the TECHNICAL DETAILS
section.

Most importantly, these tests did not, nor were they intended to, identify all the potential vulnerabilities or
attack vectors on all systems within the networks.

Scope of Work
The in-scope subnets and domain(s) are listed below.

[Link]/24 [Link] [Link]

[Link]

Timeline
Various tests were conducted throughout the timeframe listed below.

Test Start Date End Date

Internal Penetration Test September 02, 2024 September 20, 2024

CLIENT, LLC | Penetration Test Report

 PAGE \

Assessment Summary
Throughout this report, the Offensive Security team uses certain notations to articulate the severity of the findings
identified. This severity level takes into consideration the following factors:
▪ Likelihood of a vulnerability or an attack vector being exploited or abused
▪ Ease of exploitation or abuse
▪ Resulting level of access to the host and the network
▪ Impact on business

The CyberGen Offensive Security team has assessed the risk ratings and should be used as a guide to understand
the priority of carrying out any remedial actions. However, individual risk ratings should be reviewed in line with
Client’s knowledge of the technical environment and with the business context of the systems being reviewed. This
may result in Client assigning different severity levels to the ones highlighted in the report. A guide to the scoring
and examples of vulnerabilities that fall into certain scores can be found below:

Severity Description
High The adversary would gain full control over the system or application (e.g. administrative, root
rights). This would also relate to attacks that would render the system or its data unusable,
irreparably damage the company’s reputation, or extract highly sensitive information that, if made
public, could cause considerable damage to the company.
Medium Medium risk vulnerabilities relate to findings that would not lead to a direct compromise of the
system or data but could be used to gain further access. Exposure could impact business systems
and business operations could experience a reduction in performance. These would often be used
in a chained attack to obtain access to a resource or network.
Low This would relate to findings such as information leakage, that is, an adversary being able to gather
usernames, internal IP address information, technologies in use, or other potentially sensitive data.
Exposure should not impact business operations, however, should be addressed to meet expected
business operations.

CyberGen found a total of 7 HIGH, 1 MEDIUM, and 1 LOW vulnerabilities.

8
7 Findings
7
6
5
4
3
2
1 1
1
0
High Medium Low

Ref # Title Severity

INT-01 Weak Password Policy High

INT-02 SMB Signing Not Enabled High

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-03 LLMNR/NBT-NS/mDNS Poisoning High

INT-04 Active Directory Certificate Service (AD CS) Misconfigurations High

INT-05 NTLM Pass-the-Hash (PtH) High

INT-06 Kerberoasting High

INT-07 ASRep-Roast High

INT-08 Machine Account Quota Medium

INT-09 Security Controls Bypass Low

Positive Practices Identified

During the course of the tests, the CyberGen Offensive Security team observed a number of positive technical and
procedural practices that limited the ability to execute certain attacks. Specifically, the team noted the following
positive controls:

Patch Management
CyberGen team noted that systems throughout the network were up to date on patches, with no vulnerabilities that
were successfully exploited. Effective patch management process ensures systems are resilient to low hanging
vulnerability attacks.

Default Passwords
All of the web portals identified during testing did not utilize default credentials. Web portals are typically targeted
because they often either do not require authentication or they are configured with default passwords. The
administrative section of a portal could contain information such as account IDs, email addresses, file shares, email
server addresses, and occasionally, passwords. By changing the default credentials on web administrative portals,
Client is decreasing its attack surface and making an adversary’s lateral movement and escalation within the
environment more difficult. CyberGen team recommends that Client continues with its processes of modifying these
default credentials on all newly installed systems.

Null Sessions
CyberGen team discovered that Active Directory Domain Controllers were configured to prevent null session
authentication. A null session is when a client (computer or user) is able to establish an SMB connection to a system
with an empty username and password. An adversary can utilize null session access on a Domain Controller to
obtain a wealth of information from Active Directory, such as a listing of all configured accounts and machines,
domain trust details and password policies. This configuration was not found to be present, and CyberGen team
recommends continuing this practice of not allowing unauthenticated sessions to connect to sensitive systems.

Security Operations Response

During the course of our penetration tests, some of our activities on the Windows systems triggered some security
events. Later on, our team was copied on an email chain between CyberGen and their security monitoring solution
vendor, following up on the events that had triggered such alerts.

High-level Significant Technical Findings

Weak Password Use
Most corporate environments use Microsoft’s Active Directory to manage employee accounts and access. One
problem with Active Directory is that it does not allow for comprehensive password complexity requirements. In
essence, it does not restrict users from choosing weak passwords, requiring passwords to meet the specific length

CLIENT, LLC | Penetration Test Report

 PAGE \

and contain specific character sets. However, it takes only one weak password for a threat actor to breach an
organization’s network. In this case, it only took our team one good, guessed password for us to establish an Active
Directory Domain level access, leading to other lateral movement attacks and compromising the entire Active
Directory domain environment.

Potential impact on Client, LLC:

Passwords are an integral part of the overall security and the first line of defense against unauthorized access to
organization’s network resources, as such, when employees use easily guessed passwords, it provides
opportunities for unauthorized users such as adversaries to gain access to confidential data. Weak login credentials,
including weak passwords, are among the top causes of data breaches within organizations. A threat actor needs
only one working set of credentials to establish a foothold into an organization’s network and further exploit internal
systems.

Lack of Network Attacks Visibility

During the lateral movement phase of our operations, we discovered that most of our activities that touched
endpoint devices were detected by EDR solutions. However, we noted that almost all our activities that were
conducted on the network level (from our Kali Linux system) went without detection. For instance, we ran the
Windows executable version of the BloodHound tool from a Windows system, which got detected and killed instantly
by the EDR solution. However, when we ran the Python version of the same tool from our Kali Linux system, the
network traffic from our Kali Linux to the Domain Controller(s) went undetected.

Potential impact on Client:

Adversaries execute attacks against their targets from any of the OSI (TCP/IP) level, and if Security Operators are
monitoring attacks from only one part of this level or not monitoring some of the areas, some attacks may go
unnoticed.

Strategic Recommendations
While the recommendations in the TECHNICAL DETAILS section primarily focus on technical remediation steps, the
recommendations in this section also consider managerial and operational controls that may be helpful in
addressing the possible root-causes behind the findings of this assessment.

Maintain Proper IT Hygiene

Eliminate vulnerabilities associated with misconfigurations such as SMB Signing disabled (explained further in the
OPERATION NARRATIVES section), Kerberos-related misconfigurations, that may be lurking in your network
environment. Exploits can remain hidden for long periods of time before becoming active, and organizations will be
exposed if they fail to apply patches, updates or secure configuration across all of their endpoints. Management
should implement a general proper IT hygiene to effectively and efficiently apply patches and configurations to
systems and follow baseline configurations organization-wide in a risk-prioritized methodology. This ensures low-
hanging vulnerabilities are addressed on time.

Password Management
Implement a periodic password audit to ensure password leading practices, such as password complexity, are
implemented and enforced organization wide.

Network Event Monitoring

Many high-profile attacks occur over months of dwell time and move laterally to easily evade standard security.
Modern adversaries count on the fact that many organizations continue to rely on legacy or standard security
solutions, which are easily bypassed by modern hacking tools. In addition to Client’s EDR solutions, leadership
should consider applying network layer event monitoring.

CLIENT, LLC | Penetration Test Report

 PAGE \

CLIENT, LLC | Penetration Test Report

 PAGE \

Attack Kill Chain

The CyberGen Offensive Security team use an adaptive approach in executing the attack and penetration tests,
similar to how advanced adversaries use to operate. Below is the overview of the methodology used for the
penetration tests:

Reconnaissance

Target
Data Exfiltration
Development

Adaptive
Penetration Test
Methodology

Lateral Movement
Intrusion

Reconnaissance
Reconnaissance is typically the initial phase of most cyber-attacks and during this phase,
CyberGen Offensive Security team acquires strategic information about the client’s IT
infrastructure and organizational structure. The team uses both proprietary and Open-Source
Intelligence (OSINT) platforms and tools to passively and actively gather intelligence about the
client’s network infrastructure exposure.

The team looks for login portals or services that authenticate to client’s Active Directory environment such as the
following:
▪ Mail – Office 365, OWA, EWS, ADFS
▪ Communication/Collaboration tools – Lync, Webex, Jenkins
▪ Other network services – VPN, CMS, SharePoint, Custom apps, SMB

To ensure the activities are blended within normal user activities, the CyberGen Offensive Security team uses built-
in utilities and specialized tools to carry such activities. Some of the outcomes from this phase may include the
domain names, hostnames, domain users, domain groups, IP addresses, subnets, etc.

CLIENT, LLC | Penetration Test Report

 PAGE \

Target Development
Using the information gathered from the Reconnaissance activities, the team begins the
process of exploring the information to develop a list of targets to attack. Some of the activities
in this phase include, but not limited to, harvesting employees names, enumerating network
services with potential vulnerabilities, web applications with login portals that could be
susceptible to authentication-based attacks, wireless infrastructure that could be used to
provide entry into corporate network, credentials from possible past data breaches, etc. The
outcome of this phase provides the team with a list of potential targets that would provide the team with entry points
into the client’s network, yet, with minimal resistance.

The following are sample information the team uses to build attack plans and paths for gaining initial foothold into
the network:
▪ IP addresses or subnet ranges
▪ Domain and Subdomain names
▪ Login portals (OWA, VPN, Citrix, SharePoint, Autodiscover, etc.)
▪ Open network ports and services (Joomla, Tomcat, SSH, etc.)
▪ Possible credentials from past data breaches
▪ Possible vulnerabilities

The team also executes active network scans to identify additional targets.

Intrusion
In this phase, the team begins to interact with the targets from the Enumeration phase, in
attempts to achieve initial network access. This phase involves cyclical reiteration of tactical and
strategic attack techniques as the team tries different Tactics, Techniques and Procedures
(TTPs) to compromise endpoint devices. Some of the TTPs the team uses to compromise these
targets include software vulnerability exploitation, network service vulnerability exploitation, login
portal authentication attacks (password spray attack), weak wireless infrastructure, web
application exploitation, misconfigurations, poor user habits, etc.

The CyberGen Offensive Security team approaches this phase strategically and break the intrusion phase into:
▪ Least Resistance Path: The team focuses their attention on compromising systems that would give
adversaries initial access, with the least or no resistance. The team attempts to exploit low hanging fruit
attack vectors such as misconfigured servers, default or weak credentials, unnecessary network service
exposures, misconfigured access controls, etc.
▪ Vulnerability Exploitation: Next, the team actively attempts to exploit vulnerabilities such as client-side
vulnerabilities, remote code execution vulnerabilities to compromise systems. This phase also has some
inherent risks and as Offensive Security Operators, the team exercises professional diligence when
executing this phase.
o Denial of Service (DoS): Some exploits may crash a system, service or make the system unstable.
o Account Lockouts: An unexpected account lockout can happen from attacks such as authentication-
based attacks.
o Data Integrity: An exploit may also impact the integrity of a system and its data because of
unexpected changes to a system’s configurations or loss of data.

CLIENT, LLC | Penetration Test Report

 PAGE \

Lateral Movement
Once the CyberGen Offensive Security team has compromised and gained an initial foothold on a
system, the team begins the post-exploitation and lateral movement activities. The team maps out
the client’s internal network infrastructure and creates a battle plan, deploying multiple parallel kill
chains to laterally move within the internal network for further attacks. Some of the TTPs the team
employs at this stage include privilege escalation (if or when necessary) to ensure the team can
execute certain tasks on the network with less restrictions. The team uses techniques such as credential harvesting
and re-use, Pass-the-Hash, systems misconfigurations, Active Directory Access Control abuse, network service
abuse, to gain access to key target resources. The team uses the access gained to gather additional information to
move within the internal network.

The team gathers additional information to move within the internal network via two ways:
▪ Internal Host-based Intelligence Gathering:
- Environment information gathering such as local users, settings, applications, files, shares, Remote
Desktop Protocol (RDP) sessions, credentials, configuration files, additional network interface.
- Attempts to bypass logging or preventative controls such as Endpoint Detection and Response (EDR)
security solutions, Host Behavioral Analysis, User Access Control (UAC), AppLocker, EMET,
PowerShell Constrained Mode, PowerShell Logging, AMSI, etc.
- Attempts to escalate privileges to that of Local Administrator/SYSTEM or root, if possible, using
escalation techniques or exploits.
▪ Internal Network-based/Active Directory Intelligence Gathering:
- Identify internal subnets and Virtual Local Area Networks (VLANs).
- Enumerate Active Directory for Domains, Forest Trusts, Group Memberships, Domain Users, Domain
Controllers, Administrators, Critical Systems, Group Policy Objects (GPOs), Access Control Lists
(ACLs), etc.
- Asset enumeration for password vaults, sensitive applications/file shares, intellectual property, etc.
- Network security controls enumeration such as web filtering, proxies, behavioral analytics, honey
pots/tokens, etc.

Some lateral movement activities may require high privileges (Administrator/SYSTEM) to execute certain tasks.
Hence, the team attempts other privilege escalation activities such Weak Services, Misconfigurations,
Kerberoasting, Unquoted Service Paths, Installation Files, Dynamic Link Library (DLL) Injection, Token
Manipulation, GPPassword, Kerberos Delegation attacks, Active Directory Certificate Service abuse.

Data Exfiltration
In attempts to assess the monitoring and detection capabilities of the client’s technological
controls, the team attempts to erase and clean up all activities conducted on the network.
Where permitted per the scope of the test, the team also creates dummy data and attempts to
exfiltrate such data, via multiple protocols, in attempts to assess the organization’s Data Loss
Prevention (DLP) controls.

CLIENT, LLC | Penetration Test Report

 PAGE \

OPERATIONS NARRATIVE
Testing Time Frame: September 02, 2024 – September 20, 2024

Assumed scenarios:
▪ An insider threat actor (disgruntled employee, consultant, adversary, etc), with a network-level access on
Client Corporate Internal Network.
▪ The threat actor has no network credentials.
In the following storyline, CyberGen Offensive Security team describes some of the Tactics, Techniques and
Procedures (TTPs) executed against the network infrastructure to demonstrate the skill level required to carry out
such activities. CyberGen Offensive Security team executed the penetration testing operations from a Kali Linux
system, from the standpoint of an insider adversary (e.g., adversary, consultant, disgruntled employee, etc.) who
had established an internal network access, with no Active Directory Domain User credentials.

Initial Access

Reconnaissance

The CyberGen Offensive Security team started the operations with the reconnaissance phase, where we gathered
intelligence about Client's network infrastructure attack surface. The team executed several username and email
address intelligence gathering using external Open Source Intelligence (OSINT) tools and platforms, scraping the
internet for employees of Client LLC. Using this technique, the team compiled a list of usernames of Client
employees. Moreover, the team used tools such as dig, NetExec, nbtscan and nslookup to identify the location of
high value target servers such as Domain Controllers, LDAP server, etc. In the image below, the team used dig to
locate the Global Catalogue servers on the internal network.

Figure 1: Using dig to find AD DS via DNS enumeration

LLMNR/NBT-NS Protocol Abuse

The team also used various techniques and tools to understand the internal network infrastructure, the various
subnets, DNS information, communication patterns among systems, etc. For instance, the team analyzed network
traffic on the local subnet the team’s attacking system connected, using the Open-Source tool Responder. The team
noted that systems on the network issued NetBIOS and Link Local Multicast Name Resolution (LLMNR) requests, in
attempts to locate a proxy server and connect to Server Message Block (SMB) shares that were not present. The
team then used a technique known as NetBIOS/LLMNR spoofing by executing the Responder tool to reply to the
requests, informing the workstations that the team’s attacking system should be used as the proxy server. On a

CLIENT, LLC | Penetration Test Report

 PAGE \

network where systems are vulnerable to such attack, the adversary would be able to capture user password
hashes and possibly crack them offline to gain access to systems on the network. In the image below, the team ran
fake network services and broadcasted them on the local network to respond to any request for such services to any
system on the local network.

Figure 2: Responder spoofing network services

As systems requested network services, the tool responded with its fake services and in so doing, attempted to
capture credentials or hashed credentials of services that requested credentials from authenticating accounts. In the
image below, the team used the DumpHash tool from the Responder to extract the hashes collected by Responder.

Figure 3: Password Hashes from Responder

The team attempted to crack the password hashes offline, using the Hashcat tool, shown below:

CLIENT, LLC | Penetration Test Report

 PAGE \

Figure 4: Cracking Password Hashes from Responder

Password Spraying

While the password hashes captured from Responder were undergoing cracking, the team executed an
authentication-based attack known as Password Spray. Password spray (i.e., reverse password brute-forcing)
attack technique attempts to use one weak and widely used password (e.g., Password1, Summer2023, etc.) against
a compiled list of usernames to discover a user who may be using that guessable password, so that we could
leverage that login to gain access into the user’s account or any network resource that user has access to. This
method most often leads to a successful login without any account lockout or raising too many network red flags.
Moreover, we performed this attack within reasonable time intervals to ensure the attacks did not result in account
lockouts. Using the compiled list of usernames obtained from our external intelligence gathering, we executed this
password spray attack trying several different passwords. In the screenshot below, the team executed the password
spray attack, supplying the tool with a list of usernames and a guessed password.

Figure 5: Password spray attack

From the Password Spray attack, the team discovered valid credentials for two Active Directory users. The team
then checked the discovered credentials against the network to determine if the users had any higher privileges on
the network, which they did not. Nevertheless, the team used one of the credentials and extracted all the Active
Directory users in the domain for another around of Password Spray attack.

CLIENT, LLC | Penetration Test Report

 PAGE \

Figure 6: Enumerating Active Directory users

ASRep-Roasting

Using the usernames obtained from the Active Directory, the team executed an attack known as ASRep- Roasting.
ASRep-Roasting attack is a technique that exploits a vulnerability in the Kerberos authentication protocol,
specifically targeting accounts that have Kerberos pre-authentication disabled.

Here's how the attack works:

▪ Target Identification: The adversary identifies user accounts that have the "Do not require Kerberos pre-
authentication" setting enabled.
▪ AS-REQ Message: The adversary sends an Authentication Server Request (AS-REQ) to the Domain
Controller (DC) for the targeted user.
▪ AS-REP Response: The DC responds with an Authentication Server Response (AS-REP) message, which
includes data encrypted with the user's password hash.
▪ Offline Cracking: The adversary captures this AS-REP message and attempts to crack the encrypted data
offline using tools such as Hashcat.

From this attack, the team identified a target [Link] and extracted his password hash for offline cracking.

Figure 7: Password hash extracted via ASRep-Roasting attack

NTLM Relay

The team also enumerated all systems that had SMB Signing not enabled on the network. Windows Operating
Systems running SMB services without Signing enabled renders such systems vulnerable to SMB-related attacks
such as SMB/NTLM Relay attacks. In an SMB/NTLM Relay attack, an adversary strategically positions their
attacking computer on an internal network and conducts an Adversary-in-the-Middle (AitM) attack to intercept

CLIENT, LLC | Penetration Test Report

 PAGE \

hashed credentials being transmitted by a machine authenticating to an SMB service. The attacking machine then
“relays” the captured authentication hash to the vulnerable SMB system (the system with SMB Signing not enabled)
and if the credentials are valid on the vulnerable system, the adversary could compromise the vulnerable system, in
some cases, with full system access.

The image below provides an overview of how such an attack could be carried:

Image 1: NTLM relay attack

To carry out the attack, the team first identified all systems running SMB service with SMB Signing not enabled,
using the NetExec tool.

Figure 8: Enumerating SMB Signing Disabled targets

Next, the team set up a relay server on the team’s attacking system, running several network services and waiting
for a connection.

CLIENT, LLC | Penetration Test Report

 PAGE \

Figure 9: NTLM relay server setup

As users on the network attempted to authenticate to their systems, their credentials were relayed to the systems
with SMB Signing disabled. In the screenshot below, as the user [Link] attempted to access network resources,
their network credentials were successfully “relayed” to the SMB servers ([Link], [Link],
[Link] and [Link]) that did not have the SMB Signing enabled.

Figure 10: Successful authentication relayed

The relayed credentials from the user [Link] had administrative privileges on two system, providing the team with
access to these system.

CLIENT, LLC | Penetration Test Report

 PAGE \

Figure 11: Sock sessions on relayed systems

Figure 12: Access to CD-SRV via NTLM Relay attack

Network Mapping

Additionally, the team executed active network scanning to probe for live systems, open ports, network services,
and potential vulnerabilities using the tool nmap.

The team had obtained salient information about the internal network and completed several attacks during the
Initial Access phase such as the following:
▪ Discovered password for two Active Directory users through Password Spray attack
▪ Cracked the password hashes of the users [Link] and [Link] from the LLMNR/NBT-NS protocol
abuse and ASRep-Roasting attacks, respectively
▪ Compromised two systems ([Link] and [Link]) via NTLM Relay attack

Network Propagation
Once the CyberGen Offensive Security team had compromised the passwords of users and access to some
systems, the team transitioned the operations into the Network Propagation phase, where the team executed
enumerations, privilege escalations and lateral movement activities. From the enumeration activities, the team
queried the Active Directory environment for information such as:
 Domains
 Domain Users
 Domain Controllers
 Administrators
 Critical Systems
 GPOs
 ACLs
 Forest Trusts
 Group Memberships

Privilege Escalation

From the enumeration activities, the team noted that the Domain Controllers are vulnerable to an attack known as
Kerberoasting. Within a Windows Active Directory environment, Service Principal Names (SPNs) are used to

CLIENT, LLC | Penetration Test Report

 PAGE \

uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be
associated with at least one service logon account. If an adversary is in possession of a valid Kerberos Ticket-
Granting Ticket (TGT), they may be able to request one or more Kerberos Ticket-Granting Service (TGS) service
tickets for any SPN from a Domain Controller (DC). Portions of these tickets may be encrypted with the RC4
algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used
as the private key and is thus vulnerable to offline cracking that may expose plaintext credentials. (Source:
[Link]

To execute this attack, the team requested TGS service tickets for any SPN from the Domain Controller of the
[Link] domain.

Figure 13: Requesting TGS service tickets

The team then extracted the TGS tickets for one account, [Link], and using the password cracking tool,
Hashcat, proceeded to crack the password hash offline.

Figure 14: Password hash from Kerberoast attack cracked

Upon cracking the password of the user [Link], the team discovered the user had Local Administrator
privileges on the system CD-WKSTN ([Link]).

Figure 15: Confirming [Link] has administrative privileges on the CD-WKSTN

Path to Domain Dominance

CLIENT, LLC | Penetration Test Report

 PAGE \

From the initial enumerations, the team had discovered the system CD-WKSTN ([Link]) had been
configured with Unconstrained Kerberos Delegation. This made the system susceptible to an attack that exploits a
configuration in Kerberos delegation where a service account is trusted to delegate authentication to any service
within the domain.
A brief overview of how the attack works:
▪ Identify Target: An adversary identifies a computer or service account configured with Unconstrained
Delegation.
▪ Compromise Target: The adversary compromises or gains access to this account or computer, with
administrative privileges.
▪ Coerce Authentication: The adversary then coerces a high-privilege account, such as a Domain Controller,
to authenticate to the compromised system. Or waits for a high-privilege account to authenticate to the
compromised system.
▪ Steal Tickets: Once the high-privilege account authenticates, the adversary can steal the Kerberos tickets
(TGTs) of this high-privileged account from the compromised system.
▪ Lateral Movement: Using these tickets, the adversary can impersonate the high-privileged account and
move laterally within the network.

In the image below, the team enumerated the Domain Controller ([Link]) for systems configured with
Unconstrained Delegation.

Figure 16: Enumerating AD objects with Unconstrained Delegation configured

With administrative privileges on the CD-WKSTN, the team used [Link]’s credential and accessed the system
through Remote Desktop Protocol (RDP). Using the tool Rubeus, the team listed all the Kerberos tickets in the CD-
WKSTN system, leading to the discovery of the tickets for the user [Link].

Figure 17: Listing Kerberos tickets using Rubeus

We proceeded to extract the ticket belonging to [Link].

CLIENT, LLC | Penetration Test Report

 PAGE \

Figure 18: Extracting Kerberos tickets belonging to [Link]

From the domain membership enumerations, the team discovered that the user [Link] was a Local
Administrator on the system CD-SRV. Hence, after extracting [Link]’s Kerberos ticket, it was imported and
then used to gain access to the CD-SRV.

Figure 19: [Link]’s Kerberos ticket used to compromise CD-SRV system

Owning the CHILD Domain

From the initial enumerations, the team had also discovered the system CD-SRV ([Link]) had been
configured with Constrained Kerberos Delegation. This configuration also made the system susceptible to an attack
that exploits a configuration in Kerberos delegation where a service is allowed to impersonate users to access
specific services on their behalf.
A brief overview of how the attack works:
▪ Identify Target: An adversary identifies a computer or service account configured with Constrained
Delegation.
▪ Compromise Target: The adversary compromises or gains access to this account or computer, with
administrative privileges.
▪ Impersonate Users: The adversary uses the compromised account to request service tickets on behalf of
other users, including high-privilege accounts.

CLIENT, LLC | Penetration Test Report

 PAGE \

▪ Access Services: With these service tickets, the adversary can access the specified services as the
impersonated user.

In the image below, the team enumerated the Domain Controller ([Link]) for systems configured with
Constrained Delegation.

Figure 20: Enumerating AD objects with Constrained Delegation configured

To execute this attack, the team had to first extract the NTLM hash of the computer service account of CD-SRV
(CD-SRV$).

Figure 21: Extracting the NTLM hash of the CD-SRV$ account

With an NTLM hash of the CD-SRV$ account, the team requested a Service Ticket (ST) for the computer account
CD-SRV$ to impersonate the Domain Administrator user, [Link], to the SPN on the Domain Controller (the target).

Figure 22: Impersonating a Domain Administrator in a Constrained Delegation attack

Figure 23: Compromised Domain Controller in the CHILD domain

CLIENT, LLC | Penetration Test Report

 PAGE \

Having compromised the CHILD domain, the team extracted the NTDS database that contains all the NTLM hashes
and other credentials for the [Link] domain.

Figure 24: Dumping the contents of the NTDS database

The team then ran the NTDS files through password cracking for analysis. Using a regular desktop computer with 8
gig of RAM and 4 CPUs, the team cracked seventy-nine percent (79%) of the passwords within 8 hours.

Abusing Domain Trusts

The Offensive Security team continued the enumeration of the compromised CHILD domain and discovered a
Domain Trust between the CHILD and CLIENT domain through a parent-child trust relationship.

Figure 25: Bidirectional Domain Trust relationship between [Link] and [Link]

Using this information, the Offensive Security team abused this trust to compromise the parent domain ([Link])
through a Golden Ticket attack. The Golden Ticket attack can be used to compromise a parent Active Directory (AD)
domain from a child domain by exploiting the SID History configuration.
A brief overview of how the attack works:
▪ SID History is a feature in AD that allows a user to retain access to resources from a previous domain after
being migrated to a new domain. This is done by storing the old SID in the SID History attribute of the AD
object (e.g. a user account).
▪ Golden Ticket attack involves creating a forged Kerberos Ticket Granting Ticket (TGT) using the password
hash of the KRBTGT account (the account responsible for Kerberos ticket encryption in AD). With this
forged ticket, an adversary can impersonate any user, including high-privilege account such as a Domain or
an Enterprise Administrator.
▪ By injecting the SID of a high-privilege group (e.g. Enterprise or Domain Administrators) from the parent
domain into the SID History of an account in the child domain ([Link]), an adversary can gain
unauthorized access to resources in the parent ([Link]).

Steps to execute attack:

▪ Obtain the KRBTGT Hash of Child Domain: This requires privileged access to a Domain Controller to extract
the KRBTGT password hash.
▪ Create the Golden Ticket: Use the extracted hash to create a forged TGT with the necessary SIDs, including
the SID of the target high-privilege object (e.g. Enterprise Administrator).

CLIENT, LLC | Penetration Test Report

 PAGE \

▪ Inject the SID: Add the SID of the high-privilege object (e.g. Enterprise Administrator) to the SID History of
the target object.

The team automated this attack, using the raiseChild tool from the Impacket suite of tools. The tool executed the
attack as follows using the credentials of a Domain Administrator ([Link]) of the [Link] domain:
 Obtains the SID for the Enterprise Administrators group of the parent domain ([Link])
 Retrieves the hash for the KRBTGT account in the child domain ([Link])
 Creates a Golden Ticket
 Logs into the parent domain ([Link])
 Retrieves credentials for the Administrator account in the parent domain ([Link])
 Authenticates to the parent Domain's Domain Controller via Psexec

Figure 26: Compromised parent domain ([Link]) via Golden Ticket attack

Abusing Forest Trusts

While logged into the compromised CLIENT domain’s Domain Controller, the team discovered credentials of the
user [Link] for a FOREIGN domain, a domain with a Forest Trust relationship with the CLIENT domain.
The user [Link] was a low privileged user in the FOREIGN, however, the team used this user’s credentials
and discovered misconfigurations in an Active Directory Certificate Services (AD-CS) implementation on the
network.
AD CS is a server role that functions as Microsoft’s Public Key Infrastructure (PKI) implementation. AD CS
integrates with Active Directory and enables the issuing of certificates, which are X.509-formatted digitally signed
electronic documents that can be used for encryption, message signing, and/or authentication. The information
included in a certificate binds an identity (user, machine) to a public/private key pair. An application can then use the
key pair in operations as proof of the identity of the user. The Certificate Authorities (CAs) signs the certificate using
its private key and then returns it to the client. The diagram below summarizes the process of certificate issuance.

CLIENT, LLC | Penetration Test Report

 PAGE \

Image 2: Active Directory certificate issuance

A misconfigured AD CS could lead to attacks such as Credential theft, Account persistence, Domain escalation and
Domain persistence. While AD CS offers adversaries various attack paths, an adversary needs to first identify
misconfigurations that can be abused. In the screenshot below, the team probed the FOREIGN domain Certificate
Services for vulnerabilities in its deployment.

Figure 27: AD CS vulnerability scanning

The scan results revealed the CA was vulnerable to attacks labelled ESC1, ESC2, ESC3, ESC4 and EC8 due to the
misconfigured settings and policies that define the contents of the certificate issued by the enterprise CA. The team
focused on abusing the ESC4 vulnerability, which allowed the user [Link], in addition to Domain Admins,
Enterprise Admins and Local System, to alter the existing certificate Vuln-ESC4 so that they can request a
certificate from the AD CS service for any user.

CLIENT, LLC | Penetration Test Report

 PAGE \

Figure 28: One of the AD CS templates vulnerable to ESC4

Using the Certipy tool, the team altered the Vuln-ESC4 template to be vulnerable to be able to request a certificate
for one of the Domain Administrator users.

Figure 29: Altering Vuln-ESC4 certificate template to be vulnerable to ESC1

Figure 30: Requesting an Enterprise Administrator Certificate for [Link]

Using the Certipy tool, the NTLM hash of the Enterprise Administrator account was extracted from the .pfx file. With
the NTLM hash of the Enterprise Administrator, the team used Pass-the-Hash technique to authenticate to the
Domain Controller of the FOREIGN domain.

Figure 31: Access to FOREIGN Domain Controller (FN-DC)

The team reverted the altered Vuln-ESC4 certificate template to its original state to not introduce a vulnerability into
the FOREIGN domain environment.

CLIENT, LLC | Penetration Test Report

 PAGE \

Figure 32: Reverting Vuln-ESC4 Certificate template

CLOSURE
With the level of access achieved across the multiple domains, the team executed multiple post-breach activities to
demonstrate impact on the organizations. Some of the activities included logging into some senior executive
members’ email accounts (after obtaining permission from the team’s Point of Contact of the engagement) to
demonstrate impact of Business Email Compromise (BEC). To also demonstrate the impact of exfiltration of critical
data by adversaries, the team created dummy data on the compromised Domain Controllers and exfiltrated them to
an external server. Some of the information in the dummy data included:
 Full name of employees
 Date of birth
 Address
 Mobile phone number
 Email address
 Emergency contact
 Bank information for direct deposit

All these activities went undetected by the defensive controls of the client.

CLIENT, LLC | Penetration Test Report

 PAGE \

TECHNICAL DETAILS
INT-01: Weak Password Policy
Risk Rating: High

Repeat Finding N/A

CVSS Score N/A
MITRE ATT&CK TTP Password Policies (M1027)
Description and risks:
The Offensive Security team noted that, on average, Client LLC has a good password control policy implemented.
However, it takes only one weak password for an adversary to breach an organization’s network. In this case, the
team successfully compromised an Active Directory domain user account due to the use of weak and guessable
password. With a valid set of credentials, the team was able to execute further attacks on the network such as
Kerberoasting.
Also, once the team had compromised the Active Directory domains, the team extracted all the password hashes
of the domain for offline cracking and analysis. The team discovered that twenty-five (25) of the passwords used
within the domain are available on publicly known password databases. After running the password cracking for
eight hours, the team had cracked seventy-nine percent (79%) of the passwords.

Impact on Client LLC:

Passwords are integral part of the overall security and the first line of defense against unauthorized access to
organization’s network resources. As such, when employees use easily guessed passwords, it provides
opportunities for unauthorized users such as adversaries to gain access to confidential data. Weak login
credentials, including weak passwords, are among the top causes of data breaches within organizations. An
adversary needs only one working set of credentials to establish a foothold into an organization’s network and
further exploit internal systems.
Remediation and further information:
To address the use of weak password by AD users and mitigate the associated risks, the following remediation
steps should be taken:
 Password Complexity: Enforce the use of complex password through a password complexity
implementation using Group Policy Object (GPO).
References:
 [Link]
 [Link]
Affected Asset:
 Active Directory domain-wide

Reproduction/Proof of Concept:

In the screenshot below, the team was able to guess the password for the user accounts [Link] and [Link]
due to their choice of weak password.

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-01.A: Guessed AD user password

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-02: SMB Signing Not Enabled

Risk Rating: High
Repeat Finding N/A
CVSS Score N/A
MITRE ATT&CK TTP Adversary-in-the-Middle (T1557)
Description and risks:
The CyberGen Offensive Security team identified several systems running SMB services but did not have Signing
enabled. Windows Operating Systems running SMB services without Signing enabled renders such systems
vulnerable to SMB-related attacks such as SMB/NTLM Relay attacks.
NTLM is short for New Technology LAN Manager. NTLM is the successor to the authentication protocol in
Microsoft LAN Manager (LANMAN). NTLM is a protocol that uses a challenge and response method to
authenticate a client (user or computer).
 First, the client establishes a network path to the server and sends a NEGOTIATE_MESSAGE advertising
its capabilities.
 Next, the server responds with CHALLENGE_MESSAGE which is used to establish the identity of the
client.
 Finally, the client responds to the challenge with an AUTHENTICATE_MESSAGE.
The NTLM protocol uses one or both hashed password values (LM or NTLM). Both passwords are also stored on
the server (or Domain Controller). However, due to the lack of salting, the LM or NTLM hashes are also equivalent
to their hash values, meaning that if an adversary grabs the hash value from the server, they can authenticate
without knowing the actual password.
In an SMB/NTLM Relay attack, an adversary strategically positions their attacking computer on an internal
network and conducts an Adversary-in-the-Middle (AitM) attack to intercept hashed credentials being transmitted
by a machine authenticating to an SMB service. The attacking machine then “relays” the captured authentication
hash to the vulnerable SMB system (the system with SMB Signing not enabled) and if the credentials are valid on
the vulnerable system, the adversary could compromise the vulnerable system, in some cases, with full system
access.
During the engagement, the Offensive Security team relayed high-privileged account to four systems, where the
team gained administrative access to two of the systems.

Impact on Client LLC:

Exploitation of this vulnerability can lead to the following:
 Unauthorized Access: Adversaries can intercept and modify SMB traffic, potentially gaining unauthorized
access to sensitive files, shares, or resources on the network.
 Data Theft: Sensitive data, including user credentials and confidential documents, may be stolen, or
tampered with during transit, leading to data breaches.
 Network Compromise: An adversary may compromise the integrity of the network, potentially escalating
privileges and gaining control over systems or services.
 AitM Attacks: Without SMB Signing, the network becomes vulnerable to AitM attacks, which can lead to
the interception and manipulation of data.
Remediation and further information:
The following remediation steps can be performed to help mitigate issues that arise from this finding:
 Enable SMB Signing: Ensure that SMB Signing is enabled on all relevant systems. This can be done
through Group Policy settings on Windows systems. Enabling SMB Signing ensures that all SMB
communication is digitally signed, making it harder for adversaries to tamper with traffic.
o Set the following two GPO to Enabled:
- Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security
Options > Microsoft network server: Digitally sign communications (always)
- Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security
Options > Microsoft network client: Digitally sign communications (always)

CLIENT, LLC | Penetration Test Report

 PAGE \

 Patch and Update: Keep all systems and network systems up to date with the latest security patches and
updates. Vulnerabilities in SMB protocols are often addressed through software updates, so staying
current is crucial.
Affected Asset:
 [Link]
 [Link]
 [Link]
 [Link]
Reproduction/Proof of Concept:

In the screenshot below, the team used the NetExec tool to identify systems running SMB service with no signing
enabled.

INT-02-A: Enumerating SMB Signing Disabled targets

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-03: LLMNR/NBT-NS/mDNS Poisoning

Risk Rating: High

Repeat Finding Yes
CVSS Score N/A
MITRE ATT&CK TTP Adversary-in-the-Middle (T1557)
Description and risks:
LLMNR (Link-Local Multicast Name Resolution), NBT-NS (NetBIOS Name Service), and mDNS (Multicast DNS)
are all protocols used for name resolution on local networks. These protocols are enabled by default on most
modern Operating Systems and allow systems to discover each other on the same network without the need for a
DNS server.
Typically, when a Windows system (Vista and higher version) needs to request a name lookup, it checks the
following four places in order:
 The Local Hosts File
 Configured DNS Servers
 A LLMNR multicast query
 NetBIOS Name Service Broadcast query
If the request fails on both the local hosts file and the configured DNS server, it then makes a LLMNR multicast
request on the network. Since this is a multicast request, any system on the local network joined to the multicast
group can answer. In summary:
 WPAD, LLMNR and NB-NS are services built into the Windows Operating Systems and are enabled by
default.
 WPAD will probe the network looking for services that proxy internet sessions, to avoid manually
configuring workstations with the relevant Proxy information. Adversaries take advantage of this
vulnerability by responding to NBNS/LLMNR requests and redirecting the proxy traffic through a device
that the adversary controls. This can allow the adversary to intercept credentials, force NTLM
authentication, and other malicious activities.
 LLMNR provides name resolution of hosts on the local network so that DNS is not required to respond to
all requests. The intent is to reduce the load on the internal network’s DNS. LLMNR also benefits an
organization, as it provides local resolution of names if a DNS server fails. Despite these benefits, LLMNR
can be manipulated to provide sensitive information to an adversary.
 Additionally, if LLMNR is disabled, NB-NS will still respond to the requests.
An adversary can exploit these protocols by sending out malicious name resolution responses, which can lead to
the poisoning of the name resolution caches of victim systems. This can result in the adversary being able to
redirect network traffic to their own systems, intercept sensitive information, and potentially execute code on a
victim’s system.

Impact on Client LLC:

Exploitation of this vulnerability can lead to the following:
 Credential Theft: Adversaries can capture sensitive credentials, such as usernames and passwords, by
intercepting authentication attempts made through manipulated LLMNR requests and responses.
 Unauthorized Access: Adversaries can exploit this vulnerability to gain unauthorized access to systems,
networks, and resources, potentially compromising the entire network infrastructure.
 Disruption of Services: By redirecting legitimate traffic, adversaries can disrupt network services and
cause downtime, affecting business operations.
Remediation and further information:
The following remediation steps can be performed to help mitigate issues that arise from this finding:
 Disable LLMNR, NBT-NS, and mDNS protocols to prevent adversaries from injecting fake DNS responses
and redirecting traffic to their machine.

CLIENT, LLC | Penetration Test Report

 PAGE \

 Disable LLMNR & mDNS via GPO

o Open the “Group Policy Editor” by pressing “Windows key + R” on your keyboard, then type
“[Link]” and press Enter.
o In the left pane of the Group Policy Editor, navigate to “Computer Configuration” -> “Administrative
Templates” -> “Network” -> “DNS Client”.
o In the right pane, locate the policy “Turn off Multicast Name Resolution” and double-click on it.
o Select the “Enabled” option to turn off LLMNR.
o Click “Apply” and “OK” to save the changes.
o Restart your computer to ensure that the changes take effect.
 Disable NBT-NS
o Open the Control Panel on your Windows computer.
o Click on “Network and Sharing Center.”
o Click on “Change adapter settings.”
o Right-click on the network adapter that you want to disable NBT-NS for and select “Properties.”
o In the “Networking” tab, scroll down and find “Internet Protocol Version 4 (TCP/Ipv4)” and select it.
o Click on the “Properties” button.
o Click on the “Advanced” button.
o Click on the “WINS” tab.
o In the “NetBIOS setting” section, select “Disable NetBIOS over TCP/IP.”
o Click on “OK” to save the changes.
o Repeat previous steps for any additional network adapters that you want to disable NBT-NS for.
References:
 LLMNR & NBT-NS Poisoning and Credential Access using Responder: [Link]
techniques-hands-on/llmnr-nbt-ns-poisoning-and-credential-access-using-responder/
 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay:
[Link]
Affected Asset:
 Active Directory Infrastructure

Reproduction/Proof of Concept:

Create fake services such as SMB and HTTP to answer requests from internal clients.

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-03.A: Responder spoofing network services

INT-03.B: NetNTLM password hash captured

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-04: Active Directory Certificate Service (AD CS) Misconfigurations

Risk Rating: High

Repeat Finding No
CVSS Score N/A
MITRE ATT&CK TTP T1552.004
Description and risks:
The AD CS misconfigurations highlight potential security weaknesses within the Active Directory Certificate
Services (AD CS) infrastructure, which plays a crucial role in managing and issuing digital certificates. The
misconfigurations identified within the AD CS implementation could lead to the following attack to elevate a low-
privileged computer account to that of a Domain Administrator, hence, Domain Escalation:
 Request a certificate based on a vulnerable certificate template and impersonate any domain user
account (e.g. Domain Administrator)
 Request a certificate based on a vulnerable certificate template and use it for any purpose
 Request a certificate based on a vulnerable certificate template and then use that certificate to request
another certificate on behalf of another domain user account (e.g. Domain Administrator)
The Offensive Security team discovered the following vulnerable Certificate Templates:
 Vuln-ESC1
 Vuln-ESC2
 Vuln-ESC3
 Vuln-ESC4
The team exploited the misconfigured Vuln-ESC4 Certificate Template to become an Enterprise Administrator of
the FOREIGN domain.

Impact on Client LLC:

Exploitation of this vulnerability can lead to the following:
 Unauthorized Certificate Issuance: Threat actors can leverage this vulnerability to request and obtain
digital certificates from AD CS, enabling them to impersonate legitimate users, devices, or services.
 Data Exposure: If AD CS stores sensitive certificate-related data, it may be at risk of exposure, leading to
potential data breaches.
 Compromise of Trust: The compromise of the AD CS infrastructure undermines the trust model in the
organization, potentially enabling further attacks and impersonation.
 Escalation of Privilege: Threat actors can use stolen certificates to escalate privileges, access secure
systems, or execute lateral movement within the network.
 Post-Exploitation Attacks: Once inside the network, adversaries can conduct post-exploitation activities
such as data exfiltration, malware deployment, and persistence.
Remediation and further information:
To address this vulnerability and mitigate the associated risks, the following remediation steps may be taken:
 Review Certificate Policies: Review and update certificate issuance policies to minimize the risk of
unauthorized certificate issuance.
 Disable NTLM: Disable NTLM authentication wherever possible and enforce the use of more secure
authentication methods, such as Kerberos or LDAP over SSL (LDAPS).
 Enrollment Approval: To protect against a malicious use, configure certificate templates to require the
approval of a CA certificate manager for any certificate enrollment request.
References:
 [Link]
 [Link]
 [Link]
9e098fe298f4

CLIENT, LLC | Penetration Test Report

 PAGE \

Affected Asset:
 [Link]

Reproduction/Proof of Concept:

Use the certipy tool to identify vulnerabilities in the AD CS implementation.

INT-04.A: Enumerating AD CS infrastructure for vulnerabilities

INT-04.B: An ESC4 vulnerable template due to misconfigured ACES for the user [Link]

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-05: NTLM Pass-the-Hash (PtH)

Risk Rating: High

Repeat Finding Yes
CVSS Score N/A
MITRE ATT&CK TTP Use Alternate Authentication
Material: Pass the Hash
(T1550.002)
Description and risks:
The team noted that the Active Directory systems are vulnerable to the Pass-the-Hash (PtH) attack. A Pass-the-
Hash (PtH) attack uses a technique in which an adversary captures an NTLM password hash of an account on
one computer and then uses the password hashes (instead of a clear text password) to authenticate to other
computers on the network. The password hash value can be used directly as an authenticator to access services
on behalf of the user through single sign-on (SSO) authentication.
This attack is possible because the NTLM/LM password hashing mechanism does not salt or randomize a
password’s hash, hence, the NTLM/LM password hash remains static between sessions. This means an
account’s NTLM password hash remains the same all the time, making it possible to re-use it on the network. The
team abused this misconfiguration to gain administrative access to the Domain Controllers and other systems on
the domains.

Impact on Client LLC:

An adversary who successfully obtains the NTLM hash of an account that has administrative privileges to systems
on the Active Directory can authenticate to these systems, using only the username and the password hash. The
adversary could use such access to proceed with other lateral movement activities on the network.
Remediation and further information:
To address this vulnerability and mitigate the associated risks, the following remediation steps may be taken:
 Implement Kerberos authentication: Kerberos uses stronger hashing algorithms and provides better
protection against Pass-the-Hash attacks. It is recommended to migrate from NTLM to Kerberos
authentication whenever possible.
 Enforce multi-factor authentication: Enforce the usage of multi-factor authentication (MFA) for all
administrative accounts, such as Domain Administrator accounts. This will add an extra layer of security to
prevent unauthorized access.
Affected Asset:
 Active Directory Domain Computers

Reproduction/Proof of Concept:

With an administrative account, use impacket suite of scripts to authenticate to a system with a username and
NTLM password hash.

INT-05.A: Authentication into Domain Controller with NT hash of the administrator account

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-06: Kerberoasting

Risk Rating: High

Repeat Finding Yes
CVSS Score N/A
MITRE ATT&CK TTP Steal or Forge Kerberos Tickets:
Kerberoasting (T1558.003)
Description and risks:
The Offensive Security team discovered that the [Link] account had an associated Service Principal Name
(SPNs), rending this account to the Kerberoasting attack. Kerberoasting attack affects Microsoft Windows Active
Directory environments, which exploits weaknesses in the Ticket Granting Service (TGS) of the Kerberos
authentication protocol, allowing adversaries to target service accounts and extract their Ticket Granting Ticket
(TGT) hashes. Once these hashes are obtained, they can be cracked offline, potentially revealing plaintext
passwords, and providing unauthorized access to critical systems and resources. The team successfully cracked
the password hash of the [Link] account after the Kerberoasting attack, which provided the team
administrative access to one system.

Impact on Client LLC:

Exploitation of this vulnerability can lead to the following:
 Unauthorized Access: Adversaries can use cracked TGT hashes to gain unauthorized access to various
network resources, including servers, databases, and sensitive data.
 Credential Theft: The compromise of service account credentials can lead to the theft of plaintext
passwords, allowing adversaries to impersonate legitimate users and escalate privileges.
 Lateral Movement: Once inside the network, adversaries can pivot to other systems and conduct further
attacks, potentially leading to the compromise of additional systems and data.
Remediation and further information:
To address this vulnerability and mitigate the associated risks, the following remediation steps may be taken:
 Disable Unnecessary Services: Identify and disable unnecessary or unused services and accounts to
reduce the attack surface.
 Least Privilege Principle: Ensure that service accounts have only the minimum permissions required to
perform their tasks. Avoid assigning unnecessary privileges.
 Monitor for Anomalies: Implement network and endpoint monitoring solutions to detect suspicious
activities, such as multiple failed authentication attempts or unusual access patterns.
 Implement Strong Password Policies: Enforce complex and unique passwords for service accounts to
make it more difficult for adversaries to crack TGT hashes.
 Kerberos Encryption: Enable AES Kerberos encryption (or another stronger encryption algorithm), rather
than RC4, where possible.
References:
 [Link]
 [Link]
Affected Asset:
 Active Directory domain-wide

Reproduction/Proof of Concept:

Use the [Link] script from impacket with credentials for a valid domain user.

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-06.A: SPN request leading to extraction of password hashes for the user [Link]

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-07: AS-Rep Roasting

Risk Rating: High

Repeat Finding Yes
CVSS Score N/A
MITRE ATT&CK TTP Steal or Forge Kerberos Tickets:
AS-REP Roasting(T1558.004)
Description and risks:
AS-REP Roasting is a technique that exploits a weakness in the Kerberos authentication protocol.
This vulnerability allows adversaries to extract encrypted authentication data (AS-REP) from Active Directory (AD)
Domain Controllers for user accounts that are not configured to require Kerberos pre-authentication.
This data can be cracked offline using brute force methods, enabling adversaries to obtain plaintext user
passwords and gain unauthorized access to the target network.
The Offensive Security team discovered that the user account [Link] had been configured to not require
Kerberos pre-authentication. The team leveraged this misconfiguration to retrieve the password hash of that user
and then successfully cracked it offline.

Kerberos preauthentication disabled on a user account

Impact on Client LLC:

An adversary can use tools such as impacket or Rubeus to extract AS-REP data for vulnerable user accounts
from an AD Domain Controller.
The adversary can then use another tool such as Hashcat to crack the extracted data offline, revealing the
plaintext password for the targeted user account.
With this information, the adversary can gain unauthorized access to the target network and carry out further
attacks.
Remediation and further information:
To address this vulnerability and mitigate the associated risks, the following remediation steps may be taken:
 Enable Kerberos pre-authentication: Ensure that all user accounts in the AD domain are configured to
require Kerberos pre-authentication. This can be done by enabling the "Do not allow Kerberos
preauthentication" option in the account properties for each user account. This will prevent the extraction
of AS-REP data and make it more difficult for adversaries to crack user passwords offline.
 Monitor for AS-REP Roasting attacks: Ensure monitoring is in place within the network for signs of AS-
REP Roasting attacks, such as unusual login patterns or failed login attempts. This can be achieved by
using tools such as Microsoft's Advanced Threat Analytics or third-party SIEM solutions.
 Implement strong password policies: Ensure strong password policies are in place that will require users

CLIENT, LLC | Penetration Test Report

 PAGE \

to choose complex passwords and change them frequently. This can make it more difficult for adversaries
to crack user passwords even if they are able to extract the password hash.
References:
 Cracking Active Directory Passwords with AS-REP Roasting:
[Link]
 Helping protect against AS-REP Roasting with Microsoft Defender for Identity:
[Link]
roasting-with-microsoft-defender/ba-p/2244089
 [Link]
Affected Asset:
 Active Directory domain-wide

Reproduction/Proof of Concept:

Use the GetNPUsers script from impacket to execute an AS-Rep Roasting attack to retrieve password hashes of
user who have Kerberos preauthentication disabled.

INT-07.A: Password hash of [Link] retrieved via AS-Rep Roasting attack

CLIENT, LLC | Penetration Test Report

 PAGE \

INT-08: Default Machine Account Quota

Risk Rating: Medium

Repeat Finding No
CVSS Score N/A
MITRE ATT&CK TTP N/A
Description and risks:
The CyberGen Offensive Security team noted that the Client domain has the value of the ms-DS-
MachineAccountQuota attribute set to the default of 10. This allows any Active Directory object (including
machine accounts) to create up to 10 machine accounts on the domain. This is a functionality allowed by
Microsoft by default.
An adversary in possession of a low privileged AD account can take advantage of this to create a low-privilege
machine account on the domain to execute attacks such as an NTLM relay attack. Offensive Security team
abused this configuration to successfully carry out a Resource-Based Constrained Delegation (RBCD) attack,
leading to compromising the [Link] domain. This attack takes advantage of a legitimate Kerberos feature
whereby machine accounts can delegate access to other machine accounts. An adversary needs to be able to
impersonate another server’s machine account, through NTLM relaying for example, to perform this attack.

Impact on Client LLC:

While this configuration is not a vulnerability per se, it still does provide an attack vector for an adversary who has
obtained low privileged AD object account to execute a chain of attack. Some of the attacks could lead to
compromising other objects in the domain such as the Domain Controller.
Remediation and further information:
Set the ms-DS-MachineAccountQuota attribute to 0
Using PowerShell
 Open PowerShell as Administrator
 Run the Command:
Set-ADDomain -Identity <DomainName> -Replace @{"ms-DS-MachineAccountQuota"="0"}
Using Active Directory Users and Computers (ADUC)
 Open ADUC:
- Go to Start > Administrative Tools >Active Directory Users and Computers
 Enable Advanced Features:
- Click on View in the menu and select Advanced Features
 Navigate to the Domain Properties:
- Right-click on your domain and select Properties
 Edit the Attribute:
- Go to the Attribute Editor tab.
- Find and double-click on ms-DS-MachineAccountQuota
- Set the value to 0 and click OK
Using ADSI Edit
 Open ADSI Edit:
- Go to Start > Run, type [Link], and press Enter
 Connect to the Domain:
- Right-click on ADSI Edit and select Connect to
- Ensure the Default naming context is selected and click OK
 Navigate to the Domain Object:
- Expand the domain node and locate your domain object.

CLIENT, LLC | Penetration Test Report

 PAGE \

 Edit the Attribute:

- Right-click on the domain object and select Properties
- Find ms-DS-MachineAccountQuota in the list.
- Set the value to 0 and click OK
Affected Asset:
 Active Directory computer objects

Reproduction/Proof of Concept:

During the RBCD attack, the Offensive Security team had to first create and join a computer object (fakepc$) to the
[Link] domain.

INT-08.A – Adding a computer object to the domain

CLIENT, LLC | Penetration Test Report

 PAGE \

Thank You

CLIENT, LLC | Penetration Test Report