getSPNless

getSPNless Python tool to obtain Kerberos service tickets using the SPN-less technique. Based on Exploiting RBCD Using a Normal User Account. This tool uses the impacket project. Installation These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the...

DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

RemoteKrbRelay

//, ,//\ \ / \ \ XXX XXX / //, \o-o/-o-o/ / / \ XXX | / \ / ,-/ / \ / /,| | \ | / \ / ,-,,,/ ,,, CICADA8 Research Team From Michael Zhmaylo MzHmO RemoteKrbRelay You probably know KrbRelay and KrbRelayUp, but what if I told you it could be done remotely? With RemoteKrbRelay this becomes a...

Get-RBCD-Threaded

Get-RBCD-Threaded Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments Based almost entirely on wonderful blog posts "Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory" by Elad Shamir and "A Case Study in...

KrbRelayUp

KrbRelayUp Simple wrapper around some of the features of Rubeus and KrbRelay and a few other honorable mentions in the acknowledgements section in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Local machine account...

CVE-2022-26923

CVE-2022-26923 – Certifried Exploit AD CS Abuse Automation of the exploitation of CVE-2022-26923 Certifried allowing privilege escalation via abuse of Active Directory Certificate Services AD CS and Resource-Based Constrained Delegation RBCD, leading to the dump of the NTLM hash of a domain...

rbcd-attack

Abusando de la Delegación Restringida Basada en Recursos de Kerberos TL;DR Este repositorio trata sobre un ataque práctico contra la Delegación Restringida Basada en Recursos de Kerberos en un Dominio de Active Directory de Windows. La diferencia con otras implementaciones comunes es que lanzamos...

LDAP Add Service Principal Name

Add or remove an SPN on a target account to enable Kerberoast or RBCD prep chains from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient class ModulePost, LdapPostClient: info = "name": "LDAP Add Service Principal Name", "description": "Add or remove an SPN on a targ...

AD RBCD on domain object

Detects msDS-AllowedToActOnBehalfOfOtherIdentity on domain NC critical. !/usr/bin/env python3 -- coding: utf-8 -- """Detect RBCD on the domain object full domain compromise path.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info =...

Metasploit Weekly Wrap-Up

C is for cookie And that’s good enough for Apache CouchDB, apparently. Our very own Jack Heysel added an exploit module based on CVE-2022-24706 targeting CouchDB prior to 3.2.2, leveraging a special default ‘monster’ cookie that allows users to run OS commands. This fake computer I just made says...

Role Base Constrained Delegation

This module can read and write the necessary LDAP attributes to configure a particular object for Role Based Constrained Delegation RBCD. When writing, the module will add an access control entry to allow the account specified in DELEGATEFROM to the object specified in DELEGATETO. In order for th...

Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp)

On April 24, 2022, a privilege escalation hacking tool, KrbRelayUp, was publicly disclosed on GitHub by security researcher Mor Davidovich. KrbRelayUp is a wrapper that can streamline the use of some features in Rubeus, KrbRelay, SCMUACBypass, PowerMad/SharpMad, Whisker, and ADCSPwn tools in...