Search Results

The Big Picture To change the way you attack (and defend) Active Directory networks, change the way you think about Active Directory. What I mean by the above is this...  Focus on the holistic nature of Active Directory as opposed to individual parts Shi...

Active Directory Pentest Types Given the massive attack surface that Active Directory presents, and the fact that I only have an hour or so to present, the objective of the material here is to keep the information within the scope of the PJPT and PNPT. I could...

Usage and Help Display the xfreerdp3 man page man xfreerdp3 Display the xfreerdp3 help output on the console xfreerdp3 -h General Usage Examples # Using hostname or FQDN xfreerdp3 /v:win10ent1.ad.lab /u:'john.doe' /p:'P@$$word123!' # Using an IP ad...

Accompanying Presentation The PJPT Study Group is hosted by my friend and fellow Discord mod, Shawn Szczepkowski (aka @b33f or @b1gb33f) This lesson plan was created for a presentation given to the group by me, Ben Heater. You can find the recording of this ...

Accompanying Presentation The PJPT Study Group is hosted by my friend and fellow Discord mod, Shawn Szczepkowski (aka @b33f or @b1gb33f) This lesson plan was created for a presentation given to the group by me, Ben Heater. You can find the recording of this ...

How it Works We can send a request for a TGT --- without a pre-authentication hash --- to the Kerberos Key Distribution Center (KDC) with specific usernames in the request. If the username is valid, the KDC will prompt us for pre-authentication if required, or...

RunasCs.exe Project GitHub https://github.com/antonioCoco/RunasCs/releases Example Usage Spawn Process with Network Credentials # -l 8 : logontype 8 (NetworkCleartext) # Launch reverse PowerShell session over Netcat socket .\RunasCs.exe -d domain.tld -l...

Considerations I urge you to consider taking a snapshot of your Kali instance at its current state before installing Wine. That way you can easily roll it back in case anything goes wrong with the install or you're unhappy with the performance. Install Win...

Credential Enumeration cmdkey /list In reverse shells, I have noticed that it's impossible to spawn processes using runas.exe /savecred /user:DOMAIN\username if the credential is stored in Windows Credential Manager. That said, we may still be able to dump ...

PCAP Analysis Kerberos AS-REQ Pre-Auth Hashes Note the existence of KRB5 protocol traffic on tcp/88, which is further identified as AS-REQ data. If we inspect the application layer data in the packets, we can see details such as username, domain info, etc. We...

Example VM I want to export the pfsense-deleteme VM and import it into VirtualBox. The procedure can effectively be reduced to: Convert the VM's disk to VDI format Copy the VM's disk to the host running VirtualBox Create the VM in VirtualBox Attach the VDI dis...

Installing Faketime sudo apt install faketime faketime -h This will run the specified 'program' with the given 'arguments'.The program will be tricked into seeing the given 'timestamp' as its starting date and time.The clock will continue to run from this tim...

Problem Microsoft has continued to push many aspects of Windows security under the Hyper-V platform to create a secure isolation layer. Because of the widespread and continually changing nature of Hyper-V usage in Windows updates, this creates performance issu...

Disk Compatibility Formatting a USB drive in FAT32 on a Windows computer will cause the printer to report that the USB drive is unsupported! Format the drive on a Linux host (e.g. USB passthrough to a Linux VM on VirtualBox) Formatting the USB on Linux Id...

SALT=$(openssl rand -base64 6) # Salted MD5 openssl passwd -1 -salt $SALT your_password # Salted SHA-256 openssl passwd -5 -salt $SALT your_password # Salted SHA-512 openssl passwd -6 -salt $SALT your_password Generate a salted hash using the code exa...

Set up Custom Logging sudo apt install -y libnginx-mod-http-lua Install Nginx LUA libraries sudo nano /etc/nginx/nginx.conf.d/header_logging.conf Edit the Nginx configuration file http { # ... # ... # ... log_format custom 'Time: $time_lo...

Problem In the browser, you enter http://domain.tld or http://10.10.10.10 for example. If you're working on a CTF or a project where HTTP over TLS is not enabled, then the default setting of the Burp Chromium browser is to try and upgrade the connection to ht...

nano serv.py import http.server bind_address='0.0.0.0' port=80 class CustomRequestHandler(http.server.SimpleHTTPRequestHandler): def do_GET(self): headers = self.headers for header, value in headers.items(): print(...