TCM PEH Course Review+AD Notes
TCM PEH (The Cyber Mentor Practical Ethical Hacking) Course Review!
A little while ago I was gifted the PEH course by TCM from someone in his server!
TL;DR The PEH course is a wonderful introduction to pentesting and I would reccomend it to learn the basics.
The course covers:
It is frequently on discount and is worth every penny.
While this information could be found in other places, Heath’s style of teaching is comprehensive and easy to follow along with.
He walks through a couple of boxes from HacktheBox.eu which really help with getting that initial grasp on your own methodology.
The buffer overflow video made binary exploitation a bit more palatable than I was expecting.
Here are some notes that I took from the Active Directory portion of the course. Not meant to be a polished guide for use by others :)
Attacking AD: Initial Attack vectors
Abuse native windows features to get access.
Netbios and LLMNR
Relay Attack
NTLM Relay
MS17-010, eternalblue still found surprisingly a lot on internal test
Kerberoasting, post comprimise
mitm6
Top Five ways i got domain admin on your intenrnal network before lunch
—-LLMNR Poisining
Link local multicast name resolution
Previously NBT-NT or netbios name service
basically DNS, that’s what we use when DNS fails
This is a man in the middle attack, stealing the hash
Using Responder.py from Impacket
python Responder.py -I tun0 -rdwv
we get an NTLM hash
crack with hashcat hashcat -m hashes.txt rockyou.txt or hashcat -m hashfile wordlist
run it first thing in the morning or back from lunch because you need a lot of traffic to intercept
When we respond to the service it responds back with a username and a NTLM hash
—-SMB Relay
instead of cracking hashes that we get with responder we can instead relay those
hashes to specific machines and potentially gain access.
cannot relay credential to the same machine
smb signing disabled
replayed user credentials must be on that machine
open Responder.conf file and turn off SMB and HTTP
run responder python Responder.py -I tun0 -rdwv
setup your relay ntlmrelayx.py -tf targets.txt -smb2support then wait for an event
profit
nc ip 11000 afterwards for an smb shell
Dumping out the SAM files, they’re like shadow in linux. Usernames and hashes for local users on the computer.
SMB signing disabled by default on workstation accounts but by default enabled and required on domain controllers
Discovering hosts with SMB signing disabled. You can run nessus and it will tell you.
NMAP built in script and github SMB signing check script
NMAP - nmap –script=smb2-security-mode.nse -p445 IP/24
can attack even if it says message signing enable but not required
—-IPv6 Attacks
another form of relaying, a lot more reliable. Utilizing ipv6
spoof dns for ipv6 addresses because usually no one is doing dns for ipv4
you don’t have to be admin
Learned about these a little bit previously from a presentation by QCS (Queen City Skiddies) member lpha3ch0.
https://qcskiddies.com/?page_id=79
mitm6 -d domain
setup a relay attack ntlmrelayx.py -6 -t ldaps:\domaincontrollerip -wh wpadfile -l dir
can use SMB, LDAP, IMAP and MSSQL
-6 is for ipv6 and -t is for target
loot is in html files open with firefox
Thanks for reading!