Legacy Meets Modern Breaking Active Directory Through NIS an...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://netspi.com/blog/technical-blog/network-pentesting/legacy-meets-modern-breaking-ad-through-nis-mfa-infrastructure
• Blog Title: Legacy Meets Modern: Breaking Active Directory Through NIS and MFA Infrastructure
• Suggested Section: Network Services Pentesting: add a dedicated NIS/YP pentesting section covering discovery, unauthenticated map queries, hash extraction, and cracking workflow; additionally update Linux Post-Exploitation and Active Directory/NTLM relay sections with Duo Authentication Proxy secret interception and the xp_dirtree-to-ntlmrelayx-to-MSSQL SOCKS chain.

🎯 Content Summary

Overview and impact

The post documents a complete internal compromise chain joining legacy Network Information Service (NIS), an exposed Apache NiFi deployment, Linux password reuse, Duo Authentication Proxy infrastructure, CI/CD systems, and Active Directory. No CVE is assigned or claimed. The attacker progressed from unauthenticated NiFi access to root command execution, recovered plaintext credentials and NIS password hashes, obtained root access to 53 Linux servers, intercepted cl...

🔧 Technical Details

Unauthenticated automation-platform RCE: An exposed low-code automation interface can become an RCE primitive when unauthenticated users are permitted to create or modify processors capable of invoking operating-system functionality. Test execution with a harmless command such as id and determine the service identity. If the automation service runs as root, workflow-level command execution immediately provides root RCE. For Apache NiFi, the demonstrated Metasploit module was exploit/multi/http/apache_nifi_processor_rce.

Secret recovery from operational artifacts: After obtaining filesystem access, inspect shell histories, mount definitions, test commands, service configuration, environment files, automation workflows, and home directories. Secrets passed as command-line parameters can persist in files such as .bash_history; for example, Cypress commands may retain --env username=...,password=.....

🤖 Agent Actions

Done.

Updated:

• src/network-services-pentesting/pentesting-rpcbind.md

What I added:

• Expanded the NIS / YP section with:
  • detection of NIS-backed accounts from a client
  • nsswitch.conf / +@netgroup indicators
  • unauthenticated ypcat / getent map queries
  • password-hash extraction and cracking workflow
  • post-crack SSH password reuse follow-up
  • richer table of useful NIS maps
  • blog reference in ## References

Why only this file:

• The NIS coverage was clearly incomplete.
• The MSSQL relay / xp_dirtree / NTLM relay path is already substantially covered in existing MSSQL/AD pages.
• General Linux secret hunting / sniffing is also already covered elsewhere.
• I kept the update to one file only to avoid duplicating content.

Verification:

• git diff --check passed
• only one file was modified

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://netspi.com/blog/technical-blog/network-pentesting/legacy-meets-modern-breaking-ad-through-nis-mfa-infrastructure

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting: add a dedicated NIS/YP pentesting section covering discovery, unauthenticated map queries, hash extraction, and cracking workflow; additionally update Linux Post-Exploitation and Active Directory/NTLM relay sections with Duo Authentication Proxy secret interception and the xp_dirtree-to-ntlmrelayx-to-MSSQL SOCKS chain.".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0