> For the complete documentation index, see [llms.txt](https://gk2savage.gitbook.io/pentesting-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gk2savage.gitbook.io/pentesting-cheatsheet/active-directory/attack-vectors.md).

# Attack Vectors

{% embed url="<https://medium.com/@adam.toscher/top-five-ways-i-got-domain-admin-on-your-internal-network-before-lunch-2018-edition-82259ab73aaa>" %}

### LLMNR Poisoning

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvACPPFpNO56BuYn15%2F-MbvAqJFM8FF0rrFhfra%2Fimage.png?alt=media\&token=742db7bb-46f2-40dc-8a90-1702e1dc67b4)

{% embed url="<https://www.4armed.com/blog/llmnr-nbtns-poisoning-using-responder/>" %}

Basically we are mitm and wait for someone in the domain to access non-existing domain which will lead to sending a broadcast request through which we capture the hash and then maybe crack it to get access.

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvCnmPvN15A9su6U0l%2F-MbvDApifaaPf6-QPZpO%2Fimage.png?alt=media\&token=29528cb3-0ee7-46b0-8186-7fc39e51a328)

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvCnmPvN15A9su6U0l%2F-MbvDEjUtzBTyjTJ5jAD%2Fimage.png?alt=media\&token=3453d9b9-1148-46fb-8404-16be71760085)

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvCnmPvN15A9su6U0l%2F-MbvDHtyWPSQubMygCe9%2Fimage.png?alt=media\&token=26dcd8fa-c9e4-4bcf-9b03-af2c37bb61b0)

`hashcat -m 5600 ntlmhash wordlist //5600 - NetNTLMv2`

### SMB Relay

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvFpo0sjSkREPX1Drc%2F-MbvGdWOw5WUckwYP5ti%2Fimage.png?alt=media\&token=86876a5e-78bd-429e-a5a5-a63e64c47d04)

We search for devices in domain with smb signing disabled. for example with nse script in nmap for smb\
<https://nmap.org/nsedoc/scripts/smb2-security-mode.html>

We change configs in responder.conf, run the responder again with the same command and setup relay with ntlmrelayx.py. Same as LLMNR poisoning but we use the hash to relay it to smb service and get access. In ntmlrelayx.py, we can use -i to get interactive smb shell.

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvGv6STBrJwjNBwHnr%2F-MbvHDzhBf_rdsSTPU5R%2Fimage.png?alt=media\&token=4afc4c9e-4749-4ef1-ac0e-b531ffba5e00)

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvGv6STBrJwjNBwHnr%2F-MbvHP4Cyabxl5ERTkIB%2Fimage.png?alt=media\&token=26216ce0-f602-4680-a612-f54d79598fd2)

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvHd2pJ21S7a1z37t9%2F-MbvHijbxVPrtUN2Ho0-%2Fimage.png?alt=media\&token=cfac8d19-fc6a-418b-9ef1-be022ff54062)

Getting Shell with credentials using psexec\
`psexec.py marvel.local/fcastle:password1@192.168.1.12`

### IPv6 Attacks

{% embed url="<https://github.com/fox-it/mitm6>" %}

Feature like Active Directory Certificate Services can make the attack more powerful. If a AD CS certificate \
is enabled, we can run LDAP or LDAPS to attack

{% embed url="<https://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/>" %}

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvOw38e9HGbCPHiW3a%2F-MbvP7b3zrRCJ-2Im98J%2Fimage.png?alt=media\&token=227d9a84-36c7-44ee-8b5c-8597f57e1b36)

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvOw38e9HGbCPHiW3a%2F-MbvPL5DJ3h50HyEC9kn%2Fimage.png?alt=media\&token=6b496d6a-2a18-4317-8eb8-b28c6003088b)

![](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvPNletKMr51CR_932%2F-MbvPlfDNVdEfvwDTiEo%2Fimage.png?alt=media\&token=eb2e7150-9ab0-4c4b-9e1b-7336ab4453ff)

![Login from admin dc led to relay and create another user for you to get inside](https://1087083005-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Mb1qWEo9hJOOrqtKQKZ%2F-MbvPoW0EQ_skWk0WB_l%2F-MbvQHlsooqwk-wwUapM%2Fimage.png?alt=media\&token=bf69f526-52f9-437d-9fba-0886523ebdad)