Search Results

Nmap LDAP Enumeration Acquire DC DNS Name sudo nmap -Pn -T4 -p 389,636 --script ldap-rootdse <domain-controller-ip> | grep dnsHostName | sort -u Look for the dnsHostName attribute sudo proxychains -q nmap -Pn -T4 -sT -p 389,636 --script ldap-rootdse <domain-co...

When to Use    You'll know when you've found a domain controller, because it will have several ports open that clearly distinguish it: PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open n...

Active Directory Integrated DNS Dump (adidnsdump) GitHub Repository Installation pipx install git+https://github.com/dirkjanm/adidnsdump#egg=adidnsdump Usage Examples Requires a username and password to work. Outputs to records.csv . # Show help messag...

When to Use Helpful in post-compromise enumeration. If you've compromised a domain-joined host, and you've dumped and / or cracked hashes, you can pass the hashes or passwords to the domain controller (even as a low-level domain user) to list users in the dir...

When to Use Useful in post-compromise enumeration. If you acquire domain user passwords or hashes, you can use these credentials to see if there are any user accounts in Active Directory that have been configured with Service Principal Names (SPNs). Service P...

When to Use Could be used post-compromise upon enumerating the  ms-DS-MachineAccountQuota policy. If you use a tool such as  ldapdomaindump  -- see here for more information --  it will write the domain policy to a file called,  domain_policy.json. "ms-DS-Mach...

Fingerprinting Domain Controllers PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rp...

When to Use Useful post-compromise if you've dumped hashes from SAM or LSASS or obtained cleartext passwords, you can then pass these credentials around the network to enumerate information such as: Shares Sessions Disks Logged-on Users Users Groups ...

User Emumeration You have enumerated users with one of the methods defined here: NetExec PowerView ldapdomaindump ldapsearch enum4linux GetADUsers.py Manual Enumeration Domain Policy Enumeration You have verified the account lockout policy an...

Borrow a DLL Normally, one must install RSAT (Remote Server Administration Tools) on a host to make remote calls to Active Directory from a client computer. And, one must normally be an administrative user to import the PowerShell Active Directory module. Th...

DCSync Overview DC Sync is a legitimate function of Active Directory environments where a domain controller will make a sync request from a another domain controller in the environment, as such this is not functionality that can be disabled. Normally, this f...

Download Plink You can download the latest plink.exe binary from here: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html Individual Port Forwarding Using plink.exe in SSH mode A service on a compromised host is listening on 127.0.0.1 Open...

Tweaking the Configuration File You can find the client configuration file at: /etc/samba/smb.conf . If you take a look at the configuration file, you'll notice that this is the default Debian SMB client, forked for Kali. [global] #### Kali configuratio...

This procedure applies to Wazuh 4.3+ , as previous versions used references to opendistro in the configuration files. Edit the file /etc/wazuh-dashboard/opensearch_dashboards.yml and add/change the following lines: # The ttl is calculated in milliseconds # ...

Stop the Server First, stop any running FleetDM processes. I have systemd controlling my FleetDM server, so I will run this command to stop the server. sudo systemctl stop fleet Download the Latest Binaries Pay special attention to any upgrade notes on...

Purpose If you're running a lengthy nmap scan and do not want to enumerate all 65,535 TCP (or UDP) ports. You may opt to use the --top-ports scan option to reduce the duration of the scan. But, you may wonder which ports exactly you may be targeting when you ...

Problem Often in some Vulnhub or other self-hosted CTF boxes, there will be a WordPress instance configured as part of the challenge. The WordPress configuration is not correctly configured when the box is shipped and the WordPress installation is still using...

At the bootloader screen, press the e key to edit the GRUB configuration. Use the up arrow and down arrow keys to navigate the GRUB configuration. Edit the line starting with the word linux and change ro to rw and add init=/bin/bash to the end of the l...