getSPNless

getSPNless Python tool to obtain Kerberos service tickets using the SPN-less technique. Based on Exploiting RBCD Using a Normal User Account. This tool uses the impacket project. Installation These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the...

RemoteKrbRelay

root@kitploit: //, ,//\ \ / \ \ XXX XXX / //, \o-o/-o-o/ / / \ XXX | / \ / ,-/ / \ / /,| | \ | / \ / ,-,,,/ ,,, CICADA8 Research Team From Michael Zhmaylo MzHmO RemoteKrbRelay You probably know KrbRelay and KrbRelayUp, but what if I told you it could be done remotely? With RemoteKrbRelay...

DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

Get-RBCD-Threaded

Get-RBCD-Threaded Active Directory 환경에서 리소스 기반 제한 위임RBCD 공격 경로를 찾는 도구 거의 전적으로 Elad Shamir의 훌륭한 블로그 게시물 "Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory"와 harmj0y의 "A Case Study in Wagging the Dog: Computer Takeover"를 기반으로 합니다. 실제로 여기서 무슨 일이 일어나고 있는지 이해하고...

rbcd-attack

Kerberos 리소스 기반 제한 위임 남용 TL;DR 이 저장소는 Windows Active Directory 도메인에서 Kerberos 리소스 기반 제한 위임Resource-Based Constrained Delegation에 대한 실제 공격에 관한 것입니다. 다른 일반적인 구현과의 차이점은 Windows 도메인 외부에서 공격을 시작한다는 점입니다. 즉, 도메인에 가입된 보통 Windows 컴퓨터가 아닌 곳에서 공격합니다. 이 공격은 Python3Impacket만 사용하여 그리고 그 의존성 구현되었습니다. 최신...

KrbRelayUp

KrbRelayUp Rubeus と KrbRelay の機能の一部（および謝辞セクションにあるその他の honorable mentions）をラップしたシンプルなツールで、以下の攻撃プリミティブの悪用を効率化します。 0. （任意）新しいマシンアカウントの作成（New-MachineAccount） 1. ローカルマシンアカウントの認証強制（KrbRelay） 2. LDAP への Kerberos リレー（KrbRelay） 3. RBCD 権限を追加し、ローカルマシンへの特権 ST を取得（Rubeus） 4. その ST を使用してローカルの Service Manager...

CVE-2022-26923

CVE-2022-26923 – Certifried Exploit AD CS Abuse Automation of the exploitation of CVE-2022-26923 Certifried allowing privilege escalation via abuse of Active Directory Certificate Services AD CS and Resource-Based Constrained Delegation RBCD, leading to the dump of the NTLM hash of a domain...

Metasploit Weekly Wrap-Up

C is for cookie And that’s good enough for Apache CouchDB, apparently. Our very own Jack Heysel added an exploit module based on CVE-2022-24706 targeting CouchDB prior to 3.2.2, leveraging a special default ‘monster’ cookie that allows users to run OS commands. This fake computer I just made says...

Role Base Constrained Delegation

This module can read and write the necessary LDAP attributes to configure a particular object for Role Based Constrained Delegation RBCD. When writing, the module will add an access control entry to allow the account specified in DELEGATEFROM to the object specified in DELEGATETO. In order for th...

Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp)

On April 24, 2022, a privilege escalation hacking tool, KrbRelayUp, was publicly disclosed on GitHub by security researcher Mor Davidovich. KrbRelayUp is a wrapper that can streamline the use of some features in Rubeus, KrbRelay, SCMUACBypass, PowerMad/SharpMad, Whisker, and ADCSPwn tools in...