Operation: Path of Least Resistance, Red Team Tactic as a Sys Admin That Worked For Me During Engagements
DISCLAIMER!!! FOR EDUCATIONAL PURPOSES ONLY!! Do not attempt without consent.
Honestly, I think sometimes we forget; sometimes the simplest tactic can be the winner in red team engagements. Now, it’s not a real secret there. However, one common problem in IT alone is having outdated PC’s like Windows 7, 8, 8.1, or 10. But sometimes onboarding a new “PC” on the network can work in your favor.
I honestly had some weird luck doing this, but once you onboard a VM to the domain, you can run some attacks on the domain just by having this VM up and running; Rubeus to Kerberoast can get you so much information, too. Going old-school sometimes pays off, and you can turn any machine into a pentesting tool. Sometimes you don’t need fancy gear; you can connect a laptop to the network with an Ethernet cable, go to OracleBox, download an MS ISO, install it, disable Windows Defender, and add the PC to the domain using valid credentials. Then the domain can be yours with PowerShell, using basic AD, Kerberoast, etc. commands. Even getting MS licenses is pretty easy for outdated machines.
The goal isn’t to get caught, but if you start with creds or even see how to gain physical access, this can work. And exfiltration is easy; delete the VM and make sure you got good screenshots. Now, can this be pulled off all the time? Depends; you may get caught with Event ID 4796. But cracking this can happen offline with hashcat or John the Ripper; however, with a bit of social engineering, you can get what you need too.
Sometimes we think we need all this fancy gear, that perfect payload, without getting caught. Not really. The goal isn’t trying to get caught for the red team. The blue team is being tested. You may need to act quickly, but it was my quick win once I added a user to the domain and ensured persistence.
Sometimes it’s all that takes: adding the PC to the network, getting a valid user, and installing nmap and running this command like this:
nmap -nn -Pn -sS --max-retries 2 --data-length 0 --scan-delay 0.56 -p 53,88,443,80,445,8080 $target -vvv
And the Rubeus command with the pass the ticket:
Rubeus.exe dump /nowrap
Rubeus.exe monitor /interval:5 /nowrap --check the monitor
Rubeus.exe ptt /ticket:<ticket> -- option a
Rubeus.exe ptt /ticket:C:\Temp\administrator.kirbi -- option b
klist
dir \\DC01\C$ -- accessOr Mimikatz:
mimikatz.exe "privilege::debug" "kerberos::ptt C:\Temp\administrator.kirbi" "exit"
klist
dir \\host\C$All can be done as one-liners on an older VM that’s connected to the domain and is simple. Plus, you don’t have to worry about obfuscation since it’s an older “PC”.
Plus, you can practically install Metasploit, Python, etc. You may need to pay attention to the OUs, but the more you enumerate, the easier it is to find. So don’t think you need to go out of your way either; sometimes IT offboards some PC’s too. They become the perfect labs if you can get your hands on some stuff. If you find a ThinkPad, you now have a powerful Ubuntu server.
Sometimes, going backward and going old-school is a quick, dirty method but a powerful one. And I put it in my report as well, stating that everything is accessible with just a Windows 7 or 8 VM I installed. It’s almost like the silent C2 server you added to the network. You can add the machine or put the implants on the file server — either way.
It’s not uncommon to practice this, but it’s been my favorite to turn to during a red team engagement. It flies under the radar most of the time.
Thanks for reading. One of my favorite ways to get in without being noticed is one hard truth. Somewhere out there, there are machines still running on XP, 7, hell, dare I say Vista. I got domain admin pretty quick with this simple method of going old school, checking domain GPO’s, OU’s, current user access, just by understanding how Active Directory works. Sometimes old school just does the job.