Sissel Siss3l

Certifried combined with KrbRelayUp

Certifried (CVE-2022-26923) gives Domain Admin from non-privileged user with the requirement adding computer accounts or owning a computer account. Kerberos Relay targeting LDAP and Shadow Credentials gives a non-privileged domain user on a domain-joined machine local admin access on (aka owning) the machine. Combination of these two: non-privileged domain user escalating to Domain Admin without the requirement adding/owning computer accounts.

The attack below uses only Windows (no Linux tools interacting with the Domain), simulating a real-world attack scenario.

Prerequisites:

https://web.archive.org/web/20220308212352/https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2016/

Windows 2012 R2 Essentials: http://download.microsoft.com/download/8/F/7/8F7024D2-AB2A-4BE2-8406-1E3AC49C5C1F/9600.16384.WINBLUE_RTM.130821-1623_X64FRE_SERVER_SOLUTION_EN-US-IRM_SSSO_X64FRE_EN-US_DV5.ISO

Windows 2012 R2: http://download.microsoft.com/download/6/2/A/62A76ABB-9990-4EFC-A4FE-C7D698DAEB96/9600.17050.WINBLUE_REFRESH.140317-1640_X64FRE_SERVER_EVAL_EN-US-IR3_SSS_X64FREE_EN-US_DV9.ISO

Windows 2016: https://software-download.microsoft.com/download/pr/Windows_Server_2016_Datacenter_EVAL_en-us_14393_refresh.ISO

Windows 2019 Essentials: https://software-download.microsoft.com/download/pr/17763.737.190906-2324.rs5_release_svc_refresh_SERVERESSENTIALS_OEM_x64FRE_en-us_1.iso

Copy ChatGPT Transcript as markdown

javascript:void (async () => { let { default: TD } = await import("https://cdn.skypack.dev/turndown");  let json = [   ...document.querySelectorAll(".text-base"), ].map((i) => ({   html: i.innerHTML,   text: i.innerText,   markdown: new TD().turndown(i),   isPrompt: !i.querySelector(".prose"), }));  window.open(   URL.createObjectURL(     new Blob(       [         json           .map((i) =>             i.isPrompt ? `**Prompt**: ${i.text}` : `**ChatGPT**: ${i.markdown}`           )           .join("\n\n"),       ],       { type: "text/plain" }     )   ) ); })()

Google answer

Get a quick answer from google for any question

(async function answer(q) {
  var html = await fetch(
    `https://cors.explosionscratc.repl.co/google.com/search?q=${encodeURI(q)}`,

This downloads standalone MSVC compiler, linker & other tools, also headers/libraries from Windows SDK into portable folder, without installing Visual Studio. Has bare minimum components - no UWP/Store/WindowsRT stuff, just files & tools for native desktop app development.

Run py.exe portable-msvc.py and it will download output into msvc folder. By default it will download latest available MSVC & Windows SDK - currently v14.40.33807 and v10.0.26100.0.

You can list available versions with py.exe portable-msvc.py --show-versions and then pass versions you want with --msvc-version and --sdk-version arguments.

To use cl.exe/link.exe first run setup_TARGET.bat - after that PATH/INCLUDE/LIB env variables will be updated to use all the tools as usual. You can also use clang-cl.exe with these includes & libraries.

To use clang-cl.exe without running setup.bat, pass extra /winsysroot msvc argument (msvc is folder name where output is stored).

KrbRelay with RBCD Privilege Escalation HOWTO

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

TL;DR

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

LDAP signing not required on Domain Controller (default!)

Solution to Adepts of 0xCC Challenge 01

Authors: @kachakil and @samsa2k8

Summary

A PHP challenge where all source code, configuration and Docker files were provided at: https://github.com/Adepts-Of-0xCC/CHALLENGE-01

The target machine (containing the real flag) was available at: http://challenge01.adepts.of0x.cc/

	# https://numpy.org/doc/stable/reference/generated/numpy.array.html
	class ArrayExec:
	import os
	if os.name == 'nt':
	os.system("calc.exe")
	else:
	os.system("/bin/bash")

	def __array__(self):
	return 1

	##Micropython implementation of Multi-layer Perceptron (MLP)
	##Artificial Neural network-Fully connected Dense layer
	##Trained hyperparameters are collected from tensorflow-keras
	# and fed to our Neural network for testing and prediction
	##Version:1.0.1
	##Date 14/06/2022

	def zeros1d(x): # 1d zero matrix
	z = [0 for i in range(len(x))]
	return z

	#!/usr/bin/env python

	# Find the raw bitstring from a captured Flipper RAW .sub file.
	# Must provide the bitlength in ms, and the allowable error which can be tolerated.

	import re
	import sys
	import math

	filename = sys.argv[1]