Zerotrace Logs

Question

What is BloodHound?

Answer 1

BloodHound is an Active Directory reconnaissance tool that uses graph theory to reveal hidden attack paths. It collects data about AD relationships, permissions, and group memberships to identify privilege escalation opportunities.

Answer 2

This Active Directory ACE (Access Control Entry) allows a principal to reset another user's password without knowing the current password. This is a powerful privilege that can be abused for lateral movement.

Answer 3

In this context, placing malicious files on a shared folder that automatically trigger NTLM authentication back to an attacker-controlled server when users browse the folder.

Answer 4

A vulnerability where user input is passed directly to system commands without proper sanitization, allowing attackers to execute arbitrary commands by injecting shell metacharacters like ;, |, or &&.

Answer 5

Local Administrator Password Solution (LAPS) is a Microsoft tool that manages local administrator passwords on domain-joined computers. Passwords are stored in Active Directory and can be retrieved by authorized users.

Answer 6

Domain Cached Credentials version 2 (DCC2) are cached password hashes stored on domain-joined computers. They allow authentication when the domain controller is unreachable but can be cracked offline.

Answer 7

Enable SMB signing on all servers to prevent NTLM relay attacks
Audit file share permissions - avoid granting write access to sensitive shares
Review ACEs like ForceChangePassword - restrict these to dedicated admin accounts
Implement network segmentation to limit lateral movement opportunities
Use Credential Guard to protect cached credentials from LSA dumps
Monitor for suspicious authentication patterns (e.g., NTLM traffic to external IPs)
Regularly audit LAPS access permissions

Answer 8

Check SMB signing - disabled signing opens NTLM relay opportunities
Writable shares are valuable for watering hole attacks with ntlm_theft
BloodHound is essential for mapping AD attack paths, especially ACE abuse
UNC path features in web apps can be exploited for hash capture
DCC2 hashes from LSA dumps can reveal privileged account credentials
Document the full attack chain for clear reporting

Lumon

Overview

Reconnaissance

[Step 1] Domain Controller Enumeration

[Step 2] Intranet Server Enumeration

[Step 3] Credential Validation and Host Setup

Intranet Enumeration

[Step 4] SMB Share Discovery

[Step 5] PDF Analysis - Intranet Documentation

[Step 6] Web Directory Enumeration

BloodHound Enumeration

[Step 7] Active Directory Data Collection

[Step 8] Attack Path Analysis

[Step 9] ForceChangePassword ACE Discovery

Exploitation - NTLM Hash Capture

[Step 10] Creating Malicious Files with ntlm_theft

[Step 11] Capturing NTLMv2 Hash

[Step 12] Cracking the Hash

Web Application Access

[Step 13] Admin Portal Login

[Step 14] Admin Panel Discovery

1. Command Injection via Ping Functionality

2. UNC Path Browser Functionality

Compromising INTRANETSVC

[Step 15] Method 1: UNC Path Hash Capture

[Step 16] Method 2: Command Injection (Alternative)

Lateral Movement to MARKS

[Step 17] Force Changing MARKS Password

LAPS Password Extraction

[Step 18] Extracting LAPS Credentials

Privilege Escalation on INTRANET

[Step 19] UAC Bypass via RDP

[Step 20] User Flag

[Step 21] Adding MARKS to Local Administrators

LSA Dump and Domain Admin Compromise

[Step 22] Dumping LSA Secrets

[Step 23] Cracking Domain Admin Hash

[Step 24] Validating Domain Admin Access

Root Flag

[Step 25] Domain Controller Access

Attack Chain Summary

Detailed Steps:

Lessons Learned

For Defenders

For Pentesters