Advanced Search
Search Results
312 total results found
Installing FleetDM Management Server
Official Documentation https://fleetdm.com/docs/deploy/reference-architectures#infrastructure-dependencies Create Debian Host apt update && apt upgrade -y && apt install -y sudo gnupg net-tools dnsutils binutils git curl Install required packages In...
Adding FleetDM Hosts via Ansible
Other Install Options Of course, the main focus of this page is to demonstrate the convenience of Ansible with respect to pushing and installing software to a batch of hosts. You don't have to use Ansible to install Fleet DM Osquery agents on your endpoints! ...
Adding Default Queries Library
Set API Context SSH into FleetDM management server Set the API address: fleetctl config set --address https://fleetdm.home.lab:8080 My TLS certificate is self-signed, so I will skip verification: fleetctl config set --tls-skip-verify true Login to the AP...
Penetrating Networks via Chisel Proxies
Click here to see this diagram in a new tab
LdapSearch
When to Use You'll know when you've found a domain controller, because it will have several ports open that clearly distinguish it: PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn ...
Enum4Linux
Details Enum4linux is a tool for enumerating information from Windows and Samba systems. It attempts to offer similar functionality to enum.exe formerly available from www.bindview.com. It is written in PERL and is basically a wrapper around the Samba tool...
Remote Bloodhound
Nmap LDAP Enumeration Acquire DC DNS Name sudo nmap -Pn -T4 -p 389,636 --script ldap-rootdse <domain-controller-ip> | grep dnsHostName | sort -u Look for the dnsHostName attribute sudo proxychains -q nmap -Pn -T4 -sT -p 389,636 --script ldap-rootdse <domain-co...
LdapDomainDump
When to Use You'll know when you've found a domain controller, because it will have several ports open that clearly distinguish it: PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open n...
Dumping DNS Records with adidnsdump
Active Directory Integrated DNS Dump (adidnsdump) GitHub Repository Installation pipx install git+https://github.com/dirkjanm/adidnsdump#egg=adidnsdump Usage Examples Requires a username and password to work. Outputs to records.csv . # Show help messag...
GetADUsers.py
When to Use Helpful in post-compromise enumeration. If you've compromised a domain-joined host, and you've dumped and / or cracked hashes, you can pass the hashes or passwords to the domain controller (even as a low-level domain user) to list users in the dir...
GetUserSPNs.py
When to Use Useful in post-compromise enumeration. If you acquire domain user passwords or hashes, you can use these credentials to see if there are any user accounts in Active Directory that have been configured with Service Principal Names (SPNs). Service P...
Impacket-Addcomputer
When to Use Could be used post-compromise upon enumerating the ms-DS-MachineAccountQuota policy. If you use a tool such as ldapdomaindump -- see here for more information -- it will write the domain policy to a file called, domain_policy.json. "ms-DS-Mach...
Enumerating Hosts and Identifying the Domain Controllers
Fingerprinting Domain Controllers PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rp...
NetExec
When to Use Useful post-compromise if you've dumped hashes from SAM or LSASS or obtained cleartext passwords, you can then pass these credentials around the network to enumerate information such as: Shares Sessions Disks Logged-on Users Users Groups ...
Password & Credential Brute Force
User Emumeration You have enumerated users with one of the methods defined here: NetExec PowerView ldapdomaindump ldapsearch enum4linux GetADUsers.py Manual Enumeration Domain Policy Enumeration You have verified the account lockout policy an...
PowerShell AD Module on Any Domain Host as Any User
Borrow a DLL Normally, one must install RSAT (Remote Server Administration Tools) on a host to make remote calls to Active Directory from a client computer. And, one must normally be an administrative user to import the PowerShell Active Directory module. Th...
DCSync
DCSync Overview DC Sync is a legitimate function of Active Directory environments where a domain controller will make a sync request from a another domain controller in the environment, as such this is not functionality that can be disabled. Normally, this f...
Port Forwarding with PLINK
Download Plink You can download the latest plink.exe binary from here: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html Individual Port Forwarding Using plink.exe in SSH mode A service on a compromised host is listening on 127.0.0.1 Open...