Whisker

Whisker Whisker は、Active Directory のユーザーおよびコンピューターアカウントの msDS-KeyCredentialLink 属性を操作して、ターゲットアカウントに「シャドウ資格情報」を実質的に追加することで、それらのアカウントを乗っ取るための C ツールです。 このツールは、Michael Grafnetter @MGrafnetter による DSInternals のコードをベースにしています。 この攻撃を成功させるには、環境に少なくとも Windows Server 2016 を実行しているドメインコントローラーが存在し、そのドメインコントローラ...

pywhisker

pyWhisker pyWhisker는 Elad Shamir이 만들고 C으로 작성된 원본 Whisker의 Python 버전입니다. 이 도구를 사용하면 대상 사용자/컴퓨터의 msDS-KeyCredentialLink 특성을 조작하여 해당 개체에 대한 완전한 제어권을 얻을 수 있습니다. 이 도구는 Impacket과 podalirius가 만든 PyDSInternals Michael Grafnetter's 의 DSInternals 의 Python 버전를 기반으로 합니다. 이 도구는 Dirk-jan의 PKINITtools와 함께 유닉스 기...

ShadowSpray

ShadowSpray 도메인 전체에 Shadow Credentials를 스프레이하여 도메인 내 다른 객체에 대한 오래된 GenericWrite/GenericAll DACL을 악용하기 위한 도구입니다. 이 도구의 목적 많은 엔지니어링에서 BloodHound를 통해 "Everyone" / "Authenticated Users" / "Domain Users" 또는 거의 모든 도메인 사용자를 포함하는 넓은 그룹이 도메인의 다른 객체에 대해 GenericWrite/GenericAll DACL을 가지고 있는 것을 봅니다. 이러한 권한을...

KrbRelay

KrbRelay 세 머리 개를 릴레이합니다. 자세한 내용은 https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html 및 https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html 에서 확인하세요. 대부분의 완전히 패치된 Windows 시스템에서 작동합니다. 실험실 환경의 서버 OS에서는 방화벽이 OXID 리졸버를 차단하기...

KrbRelayUp

KrbRelayUp Rubeus と KrbRelay の機能の一部（および謝辞セクションにあるその他の honorable mentions）をラップしたシンプルなツールで、以下の攻撃プリミティブの悪用を効率化します。 0. （任意）新しいマシンアカウントの作成（New-MachineAccount） 1. ローカルマシンアカウントの認証強制（KrbRelay） 2. LDAP への Kerberos リレー（KrbRelay） 3. RBCD 権限を追加し、ローカルマシンへの特権 ST を取得（Rubeus） 4. その ST を使用してローカルの Service Manager...

NTLM Relay to Self (HTTP to LDAP) - Post Exploitation

This module performs an NTLM relay-to-self privilege escalation attack. It starts an HTTP-to-LDAP relay server on the compromised host, then triggers the WebClient service via an ETW event allowing a low-privilege user to start it, and coerces the local machine account to authenticate via...

Exploits AD CS Template misconfigurations which involve updating an LDAP object: ESC9, ESC10, and ESC16

This module exploits Active Directory Certificate Services AD CS template misconfigurations, specifically ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user. The module leverages the auxiliary/admin/ldap/ldapobjectattribute module to update...

Metasploit Wrap-Up 05/17/2024

LDAP Authentication Improvements This week, in Metasploit v6.4.9, the team has added multiple improvements for LDAP related attacks. Two improvements relating to authentication is the new support for Signing and Channel Binding. Microsoft has been making changes to harden the communications to...

Metasploit Weekly Wrap-Up 04/12/24

Account Takeover using Shadow Credentials The new release of Metasploit Framework includes a Shadow Credentials module added by smashery used for reliably taking over an Active Directory user account or computer, and letting future authentication to happen as that account. This can be chained wit...

ShadowSpray - A Tool To Spray Shadow Credentials Across An Entire Domain In Hopes Of Abusing Long Forgotten GenericWrite/GenericAll DACLs Over Other Objects In The Domain

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or some other...

Whisker - A C# Tool For Taking Over Active Directory User And Computer Accounts By Manipulating Their msDS-KeyCredentialLink Attribute

Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this attack to...