Post Exploitation: Attacks
Linux Remote Desktop Client
Usage and Help Display the xfreerdp3 man page man xfreerdp3 Display the xfreerdp3 help output ...
Pass the Hash
Overview Dumped the SAM or LSA and now have hashes for domain or a local users. Use the hash and...
Pass the Password
Overview Cracked a hash or discovered a password for a domain user. Use the password and nxc to ...
Pass the Key
Kerberos Encryption Keys Policies on the domain controller will dictate which encryption algorit...
Pass the Certificate
Cracking PFX Archives A .pfx archive is a way to bundle the certificate, key, and metadata in on...
Pass the Ticket
Anatomy of a Kerberos Ticket [0;97d82]-2-0-40e10000-t2_felicia.dean@krbtgt-ZA.TRYHACKME.COM.kirb...
Password & Credential Brute Force
User Emumeration You have enumerated users with one of the methods defined here: NetExec Pow...
Spawn Processes as Other Users
RunasCs.exe Project GitHub https://github.com/antonioCoco/RunasCs/releases Example Usage Spaw...
Kerberoasting
Overview The attacker uses a known username and password of a user on a domain. A typical Kerbe...
Dumping Passwords from Windows Credential Manager
Credential Enumeration cmdkey /list In reverse shells, I have noticed that it's impossible to s...
Dumping Hashes without Mimikatz
Post-Compromise on Target Lsass Process Dump Sysinternals ProcDump Download ProcDump here # D...
LdapModify
When to Use You'll know when you've found a domain controller, because it will have several port...
Mimikatz
Overview https://github.com/gentilkiwi/mimikatz There are various spin-offs of the Mimikatz pro...
Group Policy Preferences (GPP)
Overview GPP allows admins to create policies with embedded credentials. The credentials are enc...
Impacket-Addcomputer
When to Use Could be used post-compromise upon enumerating the ms-DS-MachineAccountQuota policy....
DCSync
DCSync Overview DC Sync is a legitimate function of Active Directory environments where a domain...
Token Impersonation
Overview Tokens are temporary keys that allow a user to perform actions on a system or network w...
Evil-WinRM Alternatives
Problem evil-winrm works great in a pinch, but is often very buggy, so I've documented some work...
PrintNightmare
Local Privilege Escalation https://github.com/calebstewart/CVE-2021-1675
ZeroLogon
Caution This can potentially break a domain controller, due the fact that this attack temporaril...