bridge-four

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

bridge-four

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace EtwpTest
{
    class Program
    {
        static void Main(string[] args)
        {

bridge-four

# search for and reproduce output that matches a specific regex.
alias search {
	local('$regex $regex2 $entry $event $bid $out $when');

	# take all of the args, without processing/parsing as normal.
	if (strlen($0) > 7) {
		$regex = substr($0, 7);
	}
	else {
		berror($1, "search [regex]");

bridge-four

#!/usr/bin/env python
# -*- coding: utf-8 -*-

"""
Collect all forks of a github project and return the most recently pushed.
Any alternatives I could find searched only the most recent forks of a project,
which does not return accurate results for projects with many forks.

Note that the GitHub API has a rate limit of 60 requests per hour for unauthenticated requests.
You can create a personal access token in order to circumvent this, which will raise the limit

bridge-four

bing.profile:68:set pipename "win_svc";            
bing.profile:69:set pipename_stager "win_svc";     
clean_template.profile:24:set pipename "ntsvcs##";
clean_template.profile:25:set pipename_stager "scerpc##";
clean_template.profile:34:set ssh_pipename "SearchTextHarvester##";
clean_template.profile:363:    set pipename "DserNamePipe##";
cobalt.profile:139:##    pipename: msagent_##
cobalt.profile:140:##    pipename_stager: status_##
cobalt.profile:142:##    - Do not use an existing namedpipe, Beacon doesn't check for conflict!
cobalt.profile:145:#set pipename        "wkssvc_##";

bridge-four

This is a variation of the technique originally discovered by subtee and described here

TL;DR It essentially allows you to turn any .NET application into a lolbin by providing a configuration file and specifying the <appDomainManagerAssembly> element pointing to a specially crafted .NET assembly which executes when the application is loaded.

This variation allows you to load the AppDomainManager assembly from a UNC path or HTTP(s) server. Also disables ETW thanks to the <etwEnable> element :)

1. Copy some binary you love to say, C:\Test. Lets use aspnet_compiler.exe as an example
2. Compile test.cs to test.dll with a signed strong name, this is required to load an assembly outside of a .NET applications base directory.
3. Host test.dll on a remote SMB or HTTP(S) server

bridge-four

#!/bin/bash
set -e

GO_VERSION="1.20.6"
GO_URL="https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz"
EXPECTED_CHECKSUM="b945ae2bb5db01a0fb4786afde64e6fbab50b67f6fa0eb6cfa4924f16a7ff1eb"

# Log output of script
exec > >(tee -i /home/ubuntu/install.log)
exec 2>&1