ICheer_No0M icheernoom

Visual Studio 2026

This writeup only highlights some part of the writeup of @0xdf that can be done with netexec instead of using another tool :)

This is not a full writeup of the JAB machine ! Bug fix on dcom is not fully merge into main !

Thanks to @ippsec for the bug report on mmcexec method !

Queries are not complete and are meant to be a reference. If you are using them for hunting use a contains within the query language.

Kerberoasting
- (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))
- (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!msds-supportedencryptiontypes:1.2.840.113556.1.4.804:=24))
- (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(msds-supportedencryptiontypes:1.2.840.113556.1.4.804:=24))
Attributes with passwords
(userpassword=*)

	#!/usr/bin/env python
	# Impacket - Collection of Python classes for working with network protocols.
	#
	# Copyright Fortra, LLC and its affiliated companies
	#
	# All rights reserved.
	#
	# This software is provided under a slightly modified version
	# of the Apache Software License. See the accompanying LICENSE file
	# for more information.

	from datetime import datetime
	import xml.etree.ElementTree as ET
	from typing import List, Dict, Optional
	import os
	import re
	from impacket.dcerpc.v5.dcom.wmi import WBEMSTATUS
	from nxc.helpers.logger import highlight

	class TaskVulnerability:
	def __init__(self, name: str, path: str, command: str, author: str,

	from datetime import datetime
	from typing import List, Dict
	import re
	from nxc.helpers.logger import highlight
	from concurrent.futures import ThreadPoolExecutor, as_completed
	import json

	class NXCModule:
	name = "sensitive_search"
	description = "Search for files containing sensitive data patterns in shares with custom regex support"

	"""
	This script can easily configure /etc/krb5.conf for evil-winrm, by providing a domain fqdn and domain controller name
	So that evil-winrm can be used with kerberos authentication

	Evil-winrm Example:

	```bash
	export KRB5CCNAME=Administrator.ccache
	evil-winrm -i forest.htb.local -r htb.local
	```

	# -- coding: utf-8 --
	import hashlib
	import base64
	import requests, string, struct, uuid, random, re
	import sys
	from collections import OrderedDict
	from sys import version
	from urllib3.exceptions import InsecureRequestWarning
	requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
	# too lazy to deal with string <-> bytes confusion in python3 so forget it ¯\_(ツ)_/¯

	// TcbElevation - Authors: @splinter_code and @decoder_it

	#define SECURITY_WIN32
	#include <windows.h>
	#include <sspi.h>
	#include <stdio.h>

	#pragma comment(lib, "Secur32.lib")

	void EnableTcbPrivilege(BOOL enforceCheck);