jstnkndy

#!/usr/bin/python

'''
This script can be used to identify passwords that are being used across multiple accounts.
Example: python3 password_reuse.py <file in username:hash format>
'''

import sys
from pprint import pprint
from collections import defaultdict

jstnkndy

import boto3
import argparse
import sys
from collections import deque
from threading import Thread, Lock
from queue import Queue


lock = Lock()

jstnkndy

#!/usr/bin/env python3
from ldap3 import ALL, Server, Connection, NTLM, extend, SUBTREE
import argparse

parser = argparse.ArgumentParser(description='Dump LAPS Passwords')
parser.add_argument('-u','--username',  help='username for LDAP', required=True)
parser.add_argument('-p','--password',  help='password for LDAP (or LM:NT hash)',required=True)
parser.add_argument('-l','--ldapserver', help='LDAP server (or domain)', required=False)
parser.add_argument('-d','--domain', help='Domain', required=True)
parser.add_argument('-t', '--target', help="Target Domain", required=False)

jstnkndy

Important: I'm writing this when the last version of macOS (and the one I have installed) is Mojave.

After reading a few articles I ended up with this steps:

1. On macOS, download the High Sierra installer (even if you have Mojave installed): https://itunes.apple.com/us/app/macos-high-sierra/id1246284741?ls=1&mt=12
2. If the High Sierra Installer starts, quit it.
3. Open "Disk Utility".
4. Click on "File" > "New Image" > "Blank image...". Or just press cmd+N.
5. In the "Size" field, enter 13 GB and save it wherever you want.

jstnkndy

.0.0
%00/
.000
.0.0.0
0000
00000
000000
00000000
000000000000.cfg

jstnkndy

631
161
137
123
138
1434
445
135
67
53

jstnkndy

80
23
443
21
22
25
3389
110
445
139

jstnkndy

Path : c:\program files (x86)\trend micro\client server security agent\ccsf\tmccsf.exe
Used by services : TmCCSF
File write allowed for groups : Everyone
Full control of directory allowed for groups : Everyone

Path : c:\program files (x86)\trend micro\client server security agent\hostedagent\svcgenerichost.exe
Used by services : svcGenericHost
File write allowed for groups : Everyone
Full control of directory allowed for groups : Everyone

jstnkndy

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1

mQINBFOsTdQBEACcbca5WpSCz00cZoJFuU77MVR3Esbw4JuD0Lkwp1jbOzne7+ul
58mfA+RqvApV2d7Kk4kdVzdBrWropYOMfYAoTPCasrpZ6dyXtJoVmfldn6d7RXJB
xm+A8NFi8e1XzM6AbIT/gvCkZefUN1AQ5jeN5Hh/+S/VWz9bbsfKnYxgv181DT4C
xbQv4q0NMrZmKEkFh4KLAQBY+DCnCwvXuTlhpuQ+1uBC/S2VVTBcvN1i0CLLy9FW
TkvTQWeR8nCJ3TTipkyiifZpRFMb0v/YmZ1NQQxTLkQFlWrPEczgTHvl80Gq75V9
iA1w41j9XR+CG0D3CrmfoT/spiikydGojRV9vGvpVtknmVddnS5FrNRVEMdeb3ge
BR8HD4zUnj1zjSMDOaPBSCb9bX/NDLQMMrPX545NwYVjjHItChMjuxZcbW6QZ3cn

jstnkndy

Keybase proof

I hereby claim:

• I am jstnkndy on github.
• I am jstnkndy (https://keybase.io/jstnkndy) on keybase.
• I have a public key whose fingerprint is FBB7 24C7 49C7 5C6F F61D BB37 7BCB 00C9 1BC9 1458

To claim this, I am signing this object: