byinarie

KrbRelay with RBCD Privilege Escalation HOWTO

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

	#!/usr/bin/env python
	# -- Coding: UTF-8 --
	# Author: Jakob Friedl
	# Created on: Mon, 16. Oct 2023
	# Description: Shhhloader support for Havoc C2 framework
	# Usage: Load this script into Havoc: Scripts -> Scripts Manager -> Load to create Shhhloader Tab

	import os, sys, subprocess
	import threading
	import havoc

	Statement on MGM Resorts International: Setting the record straight
	9/14/2023, 7:46:49 PM

	We have made multiple attempts to reach out to MGM Resorts International, "MGM". As reported, MGM shutdown computers inside their network as a response to us. We intend to set the record straight.

	No ransomware was deployed prior to the initial take down of their infrastructure by their internal teams.

	MGM made the hasty decision to shut down each and every one of their Okta Sync servers after learning that we had been lurking on their Okta Agent servers sniffing passwords of people whose passwords couldn't be cracked from their domain controller hash dumps. Resulting in their Okta being completely locked out. Meanwhile we continued having super administrator privileges to their Okta, along with Global Administrator privileges to their Azure tenant. They made an attempt to evict us after discovering that we had access to their Okta environment, but things did not go according to plan.

	On Sunday night, MGM implement

	function Find-AclSth {
	<#
	.SYNOPSIS

	Finds object ACLs in the current (or specified) domain with modification
	rights set to non-built in objects.

	Thanks Sean Metcalf (@pyrotek3) for the idea and guidance.

	Author: Will Schroeder (@harmj0y)

	# Author: @m8sec
	# Description: Injects shellcode into the current process.

	import sys
	import ctypes
	import hashlib
	from time import sleep
	import ctypes.wintypes as wt
	from base64 import b64decode
	from Crypto.Cipher import AES

	using System;
	using System.Diagnostics;
	using System.IO;
	using System.Runtime.InteropServices;

	namespace DinjectorWithQUserAPC
	{


	public class Program

	Retrieves all of the trust relationships for this domain - Does not Grab Forest Trusts

	([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()


	Grab Forest Trusts.

	([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).GetAllTrustRelationships()


	function Get-LdapQuery
	{
	[CmdletBinding()]
	Param(
	[Parameter(Mandatory = $false,
	HelpMessage = 'Domain user to authenticate with domain\user.')]
	[string]$Username,

	[Parameter(Mandatory = $false,