GetNPUsers & Kerberos Pre-Auth Explained

Taking a look at the Impacket GetNPUsers.py script and explaining a little bit about Kerberos pre-authentication.
Impacket: www.secureauth...
Kerberos RFC: tools.ietf.org...
My blog: vbscrub.com

[@vbscrub]

2:00 - Using GetNPUsers to get encrypted data 3:43 - Cracking the password in hashcat 5:12 - Explaining what makes an account vulnerable to this script 7:29 - LDAP query to find vulnerable users 11:04 - Wireshark capture of kerberos traffic when we run the script 15:05 - Explaining what kerberos pre authentication is 17:50 - Summary

[@cbesc]

Gold mine of a channel. The way you explain it takes me back to the 2600 quarterly days.

[@flo97ist]

Great Video, really looking forward to that active directory one. I like that you mention the real world relevance

[@MohdAnees-rv7te]

Your videos have lot of depth. It makes easier for me to remember as all put together make sense. Thank You and please keep posting more videos.

[@isitreally]

Great job man. I've always wanted to see how the bad configuration that we exploit actually looks from the other side. Looking forward to more of your videos. Cheers!

[@mikemutter4521]

your videos are great! clear, understandable and precise! Thanks for the time you put into this its helping me get ready for the OSCP

[@vbscrub]

no worries, glad it helped

[@georgegreen9145]

Now that you explained it, it seems so obvious. In the HTB forums people gave the hint of using impacket. Most scripts l tried required the user's password and that put me off. Come to find out l missed out on this important script. Great video mate! More AD videos please

[@vbscrub]

yeah its one of those things that you either know about or you don't. The first time I had to use it on a HTB box I felt like it was pretty harsh as there's no hint that that's what you need to do. But I guess it teaches you to always just try these things anyway

[@steps0x029a]

Thanks for sharing this video! That really helped me understand why GetNPUsers actually works and how it looks like from the other side. Next up is your AD video, guess I'll learn quite a lot from that (as I don't know that much about AD). Thanks again, talk to you on HTB later

[@tech0494]

More videos please ❤️❤️

[@mohamedraheem1050]

Thanks bro. , so much informative . I would like to see more of this describing videos for CTF and exploiting tools and how it works

[@vbscrub]

Thanks and yeah there will be more videos like this coming soon :)

[@cybersamurai99]

This was useful thank you

[@pauliehorgan]

Nice video, should explain to people why they are running that script instead of them just doing it automatically

[@hxmo656]

Really loved this video man, it helped me understand AD more and I finally understand the syntax for GetNPUusers lol. Definitely make another AD video on post exploitation to get DA ! Cheers

[@ProCipher]

I paused the video more than 3 times to give a like :) GJ & Thanks bro

[@caiochaves9550]

Great video!!

[@ibrahimalnafisi432]

Amazing. Thanks

[@nopnopnopnopnopnopnop]

Thank you!

[@teamgoogle2713]

Hi! Your videos are amazing and I'm glad I finally found someone who goes into as much depth as I need. You're brilliant, man. Never stop posting. You honestly leave no room for doubts because you're so detailed with everything and you have no idea how much an overthinker like me appreciates that. I just had one question, were you able to figure out how hashcat/john the ripper works behind the scenes to actually crack the password. I've been hammering my head trying to find that out but it's just a rabbit hole. Could you please help me out with this?

[@vbscrub]

I found out roughly how it works yeah. It looks for specific values in specific locations that are always the same once decrypted. So say the 10th byte in the data always has a value of 80 when the data has been decrypted, it can keep checking for that value after it tries every potential password in the word list and when it sees that value then it knows it has the correct password. Obviously its normally based on more than just one byte so that its more reliable but yeah that's basically it. If you look at the hashcat source code on github you can see the actual values it checks for are mentioned in a comment: github.com/hashcat/hashcat/blob/master/OpenCL/m18200_a0-pure.cl

[@gizmet6467]

This is perfect! thank you for the video VB! :)

[@raghav7633]

Amazing video. Paused in between just to subscribe and like. Hope to see more content. Just a suggestion you could start a series for noobs like me who just shifted their focus from linux priv esc to windows.

[@vbscrub]

Thanks :) I did do an hour long video introducing people like yourself to active directory so take a look at that one if you've not seen it already. Its called AD Basics

[@MayankMalhotra-ig6vl]

The best!!!!!!!!!!!!!!!!!!!

[@stevieberg2540]

Thanks for the video! Really helped for a Hackthebox challenge. Subscribed and will watch the other videos cause they seem interesting.

[@vbscrub]

cheers, glad to hear that

[@dojoku88]

thanks a lot VB. This is perfect!

[@SP-hz5tp]

Awesome! Please consider creating more of those explainations of common tools and techniques! Subscribed! P.S: Could you cover silver and golden tickets or some more Kerberos in general...

[@vbscrub]

thanks! and yeah that's a good idea, a quick video explaining golden tickets would be easy enough to do

[@SP-hz5tp]

VbScrub Nice! Appreciate it! :)

[@CarricDooley]

Great content! "Waffling on" was not a probem at all! =)

[@swift87100]

Great job dude!! You earned a subscriber!!

[@CodeXND]

Thank you ..very informative

[@vbscrub]

no problem :) more coming soon

[@whitefighter5928]

great job !

[@jumpstep7085]

damnit, Thats very surprising - I didn't realize it didn't reflect a real world situation. If not this, what do you think are the most commonly exploited Windows/Windows Active Directory vulnerabilities when it comes to getting a foothold?? Thanks heaps for the video @VBScrub

[@CatSmiling]

ty for this brah

[@robinhood3841]

2:24 when we specify valid user on the domain, dont we get more result compared to anonymous user? I mean i encountered ctf machines where i didnt be able to perform this attack unless i got a valid user on the domain which gives me access to more users

[@soumyanilbiswas_reveng007]

Sir, I'm still confused about AS-Rep roasting. We are capturing TGT and TGT is encrypted by krbtgt LT key. So after cracking hash should we not get the real passwd of krbtgt service account password rather getting user account passwords ?? When I saw your theory video, i saw that TGT is encrypted by krbtgt acc. passwd, but when I did practical in my home lab, I saw the same thing, that I got passwd hashes of users which has pre-auth disabled... What am I lacking ???

[@dharanisanjaiy]

See 19:12 timestamp. He is requesting hash for jsmith user so the KDC will encrypt the TGT key with jsmith's password. Thats y we can able to retrieve jsmith's pass. Whereas for other user, the KDC needs their password to encrypt thats why it showed error

[@kasireddyvenki5421]

good video bro

[@westernvibes1267]

Amazing work explaining why and when to use these.. i was so lost and confused by these tools. By the way can you tell how to extract gpp passwords when get access to sysvol shares? I mean you just search through it manually or is there any tool?

[@vbscrub]

there are tools that get the GPP passwords yeah. Just google it and you'll find some powershell scripts that do it

[@nicksmith5654]

Hey I can use your help! I'm trying to run GetNPUsers with a -userslist tag and end up here --> GetNPUsers.py: error: unrecognized arguments: -usersfile user.txt ... I can't seem to find -usersfile in the usage options --> usage: GetNPUsers.py [-h] [-request] [-outputfile OUTPUTFILE] [-debug] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] target What do you think? Thank you in advance!

[@frankdSda]

what u do to run directly python script from cmd without use hearder line "python3 name.py" example! AND NICE VIDEO !!!!

[@urnotalone69]

the fun thing is that you explained all of this but forgot how to explain and to show how to download it xd

[@lonixlon]

so i guess hashcat tries to decrypt the data with all the keys in the wordlist untill non-garbage is returned?

[@SnakePlissken1]

Dude how did you get this to run on Windows? C:> is DOS??

[@jonathancsoy]

Well...still not working for me. The same error appears. Can you please write the sintax with in Linux?

[@6cylbmw]

I just tried what you said in the video (using the script with and without specifing usernames) on a htb machine, but it does not work when Im not specifying the username.

[@vbscrub]

depends which machine. On one of the currently live machines you can do it without specifying a username and it will find a result because anonymous logon has permission to view everything in AD. In another one you need the username because anonymous logon does not have permission to view the user account that has this option set, so the LDAP query the script runs will not find any results

[@sva8420]

when i'm using GetNPUsers i got ("No entries found!")

[@6cylbmw]

Greate one. It feels like you are a little rushed and considering what you said in the last videos I suppose you are afraid your videos may be too long. Tbh, for me could be even hours long if you feel like that would be needed. Im really looking forward the AD video.

[@vbscrub]

Thanks for the feedback I'll bear that in mind for the next one, cheers

[@sva8420]

when i'm using GetNPUsers i got ("No entries found!")

[@sva8420]

when i'm using GetNPUsers i got ("No entries found!")

[@sva8420]

when i'm using GetNPUsers i got ("No entries found!")

[@sva8420]

when i'm using GetNPUsers i got ("No entries found!")

[@sva8420]

when i'm using GetNPUsers i got ("No entries found!")

[@vbscrub]

maybe there are no accounts with kerberos pre auth disabled in the domain you are running it against? Either that or there are some accounts but you do not have permission to view them. On some of the CTF machines I've done, you need to know the username of the user first. Then you run it with domain.local/username instead of just domain.local/

[@sva8420]

@@vbscrub i try this and i got " Password: [*] Cannot authenticate administrator, getting its TGT [-] User administrator doesn't have UF_DONT_REQUIRE_PREAUTH set"

[@sva8420]

coming from "S@un@ server HTB" :\ if know what i mean