Chris Farrell seajaysec

install pypykatz pip install pypykatz outisde your pipenv
Add this file to cme/module/procdump.py
compile python setup.py install
run cme smb 172.16.60.152 -u Administrator -p P@ssword -M procdump

Computer accounts added to local admins on machines via a group in the local admins

MATCH p1 = (c1:Computer)-[r:MemberOf*1..]->(g1:Group)
WITH c1,g1
MATCH p2 = (g1:Group)-[r:AdminTo]->(c2:Computer)
RETURN c1.name As Principal,c2.name AS Target,g1.name AS ViaGroup

Computer accounts added to local admins on machines explicitly

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	$machineAccountQuotaComputers = Get-ADComputer -filter {ms-DS-CreatorSID -ne "$null"} -Properties ms-DS-CreatorSID,Created

	foreach ($machine in $machineAccountQuotaComputers) {
	$creator = $null
	try {
	$creator = [System.Security.Principal.SecurityIdentifier]::new($machine.'ms-DS-CreatorSID').Translate([System.Security.Principal.NTAccount]).Value
	}
	catch {
	$creator = $machine.'ms-DS-CreatorSID'
	}

	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="utf-8">
	<title>TAP URL Decoder</title>
	</head>
	<style type="text/css">
	pre {
	display: block;
	padding: 9.5px;

	#!/usr/bin/env python
	# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
	#
	# This software is provided under under a slightly modified version
	# of the Apache Software License. See the accompanying LICENSE file
	# for more information.
	#
	# A similar approach to smbexec but executing commands through WMI.
	# Main advantage here is it runs under the user (has to be Admin)
	# account, not SYSTEM, plus, it doesn't generate noisy messages

	import json
	import sqlite3
	import olefile
	import argparse

	def parse_snt_file(file):
	# https://www.tutorialspoint.com/python_digital_forensics/python_digital_forensics_important_artifacts_in_windows
	if not olefile.isOleFile(file):
	return "Invalid OLE file"

	#!/bin/sh
	set -e
	#set -x

	usage () {
	cat <<EOF
	Usage: $0 [-v\|--verbose] [-h\|--help] [-f\|--from "dirs on camera"] [-t\|--to "backup location"] camera_ip
	EOF
	}

	#############################################
	## DEFAULT GENERAL SETTINGS (tmux show -g) ##
	#############################################

	set-option -g activity-action other
	set-option -g assume-paste-time 1
	set-option -g base-index 0
	set-option -g bell-action any
	set-option -g default-command ""
	set-option -g default-shell "/bin/bash"

	#!/usr/bin/env python3
	"""
	Script used to pull down the current video descriptions from ippsec's youtube channel.
	The raw output still has a few HTML tags that need to be manually removed and there
	also seem to be multiple duplicates of videos that have been removed in the output
	saved as ippsec-details.txt
	"""
	import re
	import sys