Jesse Moore jessefmoore

Kali Linux on Windows Subsystem for Linux (WSL)

This doc describes how to install Kali Linux on WSLv2.

WSL Docs

https://docs.microsoft.com/en-us/windows/wsl/about

Install

Finding creds in git repos is awesome.

$ for commit in $(seq 1 $(git reflog | wc -l)); do git diff HEAD@{$commit} 2>/dev/null | grep password; done
-spring.datasource.password=g!'301T%y%xT@uL`
+spring.datasource.password=4AT&G;[H@&'\^uDK
-spring.datasource.password=UmAnR=-v|{2=gyx?
+spring.datasource.password=4AT&G;[H@&'\^uDK
...

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

	param (
	[string]$cpassword
	)

	function Get-DecryptedCpassword {
	[CmdletBinding()]
	Param (
	[string] $Cpassword
	)

	using System;
	using System.IO;
	using System.Diagnostics;
	using System.Reflection;
	using System.Runtime.InteropServices;
	using System.Net;
	using System.IO.Compression;

	public class Payload
	{

	<?xml version="1.0" encoding="utf-8"?>
	<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
	<VersionEx>10.0.1.0</VersionEx>
	<PolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyID>
	<BasePolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</BasePolicyID>
	<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
	<Rules>
	<Rule><Option>Enabled:Unsigned System Integrity Policy</Option></Rule>
	<Rule><Option>Enabled:Audit Mode</Option></Rule>
	<Rule><Option>Enabled:Advanced Boot Options Menu</Option></Rule>

	@echo off
	:: Author: Ryan Watson
	:: Twitter: @gentlemanwatson
	:: Version: 1.0
	:: Credits: Credit to Syspanda.com and their Sysmon GPO article for the kick off point
	:: https://www.syspanda.com/index.php/2017/02/28/deploying-sysmon-through-gpo/

	:: IMPORTANT
	:: 1) Create a Sysmon folder with the SYSVOL share on your domain controller
	:: 2) Download Sysmon from Microsoft and place both sysmon.exe and sysmon64.exe in

	$WMI = @{
	Query = "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'MSFT_MpPreference' AND TargetInstance.DisableRealtimeMonitoring=True"
	Action = {
	#$Global:Data = $Event
	Write-Host "Defender Configuration change - DisableRealtimeMonitoring:"$Event.SourceEventArgs.NewEvent.TargetInstance.DisableRealtimeMonitoring"(Old Value:"$Event.SourceEventArgs.NewEvent.PreviousInstance.DisableRealtimeMonitoring")"
	}
	Namespace = 'root\microsoft\windows\defender'
	SourceIdentifier = "Defender.DisableRealtimeMonitoring"
	}
	$Null = Register-WMIEvent @WMI

	AWSTemplateFormatVersion: 2010-09-09
	Description: >-
	AWS CloudFormation template to create a linux bastion host with a GUI that can
	be accessed via x2go.

	Parameters:
	KeyName:
	Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
	Type: String
	VPC:

	function PNValidate {
	$Results = [PSCustomObject]@{
	Spooler = $null
	PatchInstalled = $false
	RestrictDriverInstallationToAdministrators = $null
	NoWarningNoElevationOnInstall = $null
	UpdatePromptSettings = $null
	Expoitable = $true
	Explanation = $null
	}