filipesam

Intro

This document pools several awesome tools and blog entries together (see "Resources" at the end of this doc) in an attempt to automate the process of getting an initial foothold on a network in a situation where you have no valid credentials.

Download and install ntlmrelay

Ok, so one weird thing I'm trying to figure out is if I install ntlmrelay as the first tool we'll use, these steps seem to work ok:

git clone https://github.com/CoreSecurity/impacket.git /opt/impacket
cd /opt/impacket
pip install .

Low Hanging Hacker Fruit

This gist focuses on (relatively) free and (relatively) easy things organizations can do to better protect their networks without buying yet another black box with blinking lights.

Got some ideas of your own that should be on this list? Please leave a comment below!

Implementing a stronger AD password policy

Microsoft has a great paper on the topic that gives some nice high level recommendations:

Use a unique password per site
Enable complexity

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	#!/usr/bin/python

	# extracts OSX user hashes and outputs a format crackable with oclHashcat
	# adapted from http://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored
	# and https://web.archive.org/web/20140703020831/http://www.michaelfairley.co/blog/2014/05/18/how-to-extract-os-x-mavericks-password-hash-for-cracking-with-hashcat/
	#
	# automation of approach by @harmj0y
	#
	# sudo ./osx_hashdump.py
	# ./oclHashcat64.bin -m 7100 hash.txt wordlist.txt

	#!/bin/bash

	sudo apt-get install git
	cd /tmp/
	git clone https://github.com/darkoperator/MSF-Installer.git
	cd MSF-Installer
	sudo ./msf_install.sh -i
	source ~/.bashrc
	sudo chmod 0666 /usr/local/share/metasploit-framework/log/production.log

	#!/usr/bin/env python

	# abuse cases and better implementation from the original discoverer: https://github.com/leechristensen/SpoolSample

	import os
	import sys
	import argparse
	import binascii
	import ConfigParser
	from time import sleep


	---------------
	MATCH (u:User)-[r:AdminTo\|MemberOf*1..]->(c:Computer
	RETURN u.name

	That’ll return a list of users who have admin rights on at least one system either explicitly or through group membership
	---------------

	MATCH
	(U:User)-[r:MemberOf\|:AdminTo*1..]->(C:Computer)

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

	#!/usr/bin/python3

	'''
	author: ceres-c
	usage: ./frida-extract-keystore.py
	Once the keystore(s) have been exported you have to convert them to PKCS12 using keytool
	'''

	import frida, sys, time

	DSDButil
	========

	- dsdbutil (dsdbutil.exe) is utility for performing maintenance on AD/LDS databases [https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753151(v%3Dws.11)]
	- dsdbutil supports VSS snapshot creation
	- dsdbutil can be used to extract the AD database (ntds.dit) for offline analysis (with secretsdump.py)

	- Example #1: Using Snapshot GUID obtained from cmd output

	dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"