AnonQuebec

#!/bin/bash
#LAST UPDATE: 30/03/2020
#LAS CHANGE: added pkg-config.
RED='\033[0;31m'
GRN='\033[0;32m'
YLL='\033[1;33m'
NC='\033[0m' # No Color
#FILE NAMES
PTROOTDIR="pentestTools"
PTDIRS="{lists,tools,shells/{klbuiltin,}}"

AnonQuebec

# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
#   tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
#   https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

# New function naming schema:
#   Verbs:
#       Get : retrieve full raw data sets
#       Find : ‘find’ specific data entries in a data set

AnonQuebec

========================================================================================================================
						Kerberos Attacks
========================================================================================================================



[+] Kerbose attack

./GetUserSPNs.py -dc-ip 192.168.168.10 sittingduck.info/notanadmin

AnonQuebec

# Enumeration

# Credential Injection

runas.exe /netonly /user:<domain>\<username> cmd.exe


# enumeration users
users
net user /domain

AnonQuebec

Note: I did not author this, i found it somehwere.

Active Directory Attacks

Summary

• Tools
• Most common paths to AD compromise
  • MS14-068 (Microsoft Kerberos Checksum Validation Vulnerability)
  • Open Shares
• [GPO - Pivoting with Local Admin

AnonQuebec

# Enumeration

# Credential Injection

runas.exe /netonly /user:<domain>\<username> cmd.exe


# enumeration users
users
net user /domain

AnonQuebec

Note: I did not author this, i found it somehwere.

Active Directory Attacks

Summary

• Tools
• Most common paths to AD compromise
  • MS14-068 (Microsoft Kerberos Checksum Validation Vulnerability)
  • Open Shares
• [GPO - Pivoting with Local Admin

AnonQuebec

Sources

Google spreadsheet

Linux Boxes

Lame

Writeup 0xdf

AnonQuebec

from shodan import Shodan 
import subprocess as sp 
import requests

api = Shodan("iG0r3X7hjuIVWlopWTyy8DPO7eIF3wEG")

def clrscr():
    sp.call(["clear"], shell=True)

def breakline():

AnonQuebec

Options All -Indexes

RewriteEngine on
RewriteCond %{HTTP_HOST} ^{domain}$ [NC,OR]
RewriteCond %{HTTP_HOST} ^{domain}$
RewriteCond %{REQUEST_URI} !public/
RewriteRule (.*) /public/$1 [L]

# START BAD BOTS ### DO NOT EDIT THIS LINE AT ALL ###
BrowserMatchNoCase "(?:\b)360Spider(?:\b)" bad_bot