Neko

Initial Access in Active Directory

Getting those initial credentials and enumerating AD

Last updated: May 4th, 2023

Initial Access

  • NTLM Authenticated Services
    • Heavily used by the services on a domain
      • Mail servers that expose an OWA portal
      • RDP servers on the internet
      • VPNs
      • WebApps
    • Brute-force
    • Password Spraying
  • LDAP Bind Credentials
    • LDAP Pass-back Attacks
    • Hosting a Rogue LDAP Server
      • Capturing LDAP Credentials
  • Authentication Relays
    • SMB
    • LLMNR, NBT, WPAD
    • Intercepting NetNTLM Challenge
    • Relaying the Challenge
  • Microsoft Deployment Toolkit
    • MDT and SCCM
    • PXE Boot
  • Configuration Files
  • Runas
    • runas.exe /netonly /user:\ cmd.exe

Enumeration

  • Credential Injection
  • MMC
  • CMD
  • PSH
  • Bloodhound