Uncommon Physical Breach to Domain Admin

[admin]

Although there are plenty of articles online detailing various physical red team activities such as rubber ducky attacks, key-based attacks, bypassing gates, shoulder surfing, and social engineering, I identified that the most critical aspect is the network and open LAN ports. Dumpster diving and the absence of network access controls also play significant roles.

Before that, I enumerated everything and gathered some credentials via password spraying “Jan@2024” & “Feb@2024” using Для просмотра ссылки Войди или Зарегистрируйся. Surprisingly, I was able to compromise 34 email accounts. However, as I previously mentioned, their external security was robust. Account security was also strong, with MFA and authenticator implementations in place.

I took ALFA card and laptop, identified the WiFi by sitting outside the premises of corporate office, and discovered that they were using MSCHAP-V2 (Microsoft Challenge Handshake Authentication Protocol version 2). You can read more about it Для просмотра ссылки Войди или Зарегистрируйся. We waited until night for everyone to log off and disconnect from the network.

The credentials compromised during the password spray worked well and allowed me to connect to the WiFi, giving me direct access to the internal network. This breach could have been prevented if proper network access controls had been implemented.

Eventually using credentials that were compromised initially , i was able to authenticate to DC as well.

I started enumerating everything using Для просмотра ссылки Войди или Зарегистрируйся manually as i didn’t want to generate traffic by running bloodhound or any similar automated tool.

I enumerated the users, groups, permissions etc and then i came across a template vulnerable to ESC1.

what else do i need? ah Certipy

So it hardly took 3 hours to get DA, physical breach is good to go.