mpgn

Jab vs NetExec

• Original writeup: https://0xdf.gitlab.io/2024/06/29/htb-jab.html
• Video writeup: https://www.youtube.com/watch?v=tprP-GDW_6c

This writeup only highlights some part of the writeup of @0xdf that can be done with netexec instead of using another tool :)

This is not a full writeup of the JAB machine ! Bug fix on dcom is not fully merge into main !

Thanks to @ippsec for the bug report on mmcexec method !

mpgn

In progress

1. First we get the domain name to edit our etc hosts file

netexec smb 10.10.11.181                                                          
SMB         10.10.11.181    445    DC               [*] Windows 10.0 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:False)

• Domain name: absolute.htb
• Netbios name: DC

mpgn

Scrambled vs NetExec

Let pwn the box Scrambled from HackTheBox using only NetExec ! For context, I was reading Scrambled writeup from 0xdf_ when I read this:

smbclient won’t work, and I wasn’t able to get crackmapexec to work either.

To be fair, at the time of his writeup it was true, but not anymore and it's pretty simple with NXC, 5 minutes and you get root :)

Note: I will pass the web part where we get one username : ksimpson

mpgn

# https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
# https://twitter.com/richinseattle/status/1354296177743679489

# if true on powershell command or no error on reg query output you are infected !

reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig'
reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig'
reg query 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update'
[System.IO.File]::Exists('C:\Windows\System32\Nwsapagent.sys')
[System.IO.File]::Exists('C:\Windows\System32\helpsvc.sys')

mpgn

#!/bin/bash
# Wifi easy PEAP relay
#
# Author: 1mm0rt41PC - immortal-pc.info - https://github.com/1mm0rt41PC
#
# Ref:
# 	- https://github.com/sensepost/hostapd-mana
# 	- https://github.com/sensepost/wpa_sycophant
# 	- https://sensepost.com/blog/2019/peap-relay-attacks-with-wpa_sycophant/
# 	- https://www.youtube.com/watch?v=eYsGyvGxlpI&feature=youtu.be&t=1052

mpgn

Blackfield vs NetExec

Support:

• https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html
• https://netexec.wiki

---

1. Getting domain info

mpgn

# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
#   tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
#   https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

# New function naming schema:
#   Verbs:
#       Get : retrieve full raw data sets
#       Find : ‘find’ specific data entries in a data set

mpgn

Installation

• Copy bloodhound_owned.py in cme/modules and reinstall CrackMapExec python setup.py install
• pip install neo4j

Usage

cme smb 10.10.0.0/24 -d adsec.local -u jsnow -p Winter_is_coming_\! -M bloodhound_owned

mpgn

1. install pypykatz pip install pypykatz outisde your pipenv
2. Add this file to cme/module/procdump.py
3. compile python setup.py install
4. run cme smb 172.16.60.152 -u Administrator -p P@ssword -M procdump

mpgn

https://developer.typeform.com/responses/reference/retrieve-responses/ https://stackoverflow.com/questions/51893952/how-to-select-the-typeform-api-on-a-hidden-field/51895666 https://github.com/typeorm/typeorm/blob/master/docs/find-options.md