KrbRelay

KrbRelay 세 머리 개를 릴레이합니다. 자세한 내용은 https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html 및 https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html 에서 확인하세요. 대부분의 완전히 패치된 Windows 시스템에서 작동합니다. 실험실 환경의 서버 OS에서는 방화벽이 OXID 리졸버를 차단하기...

pywhisker

pyWhisker pyWhisker — это аналог оригинального Whisker на Python, созданного Эладом Шамиром и написанного на C. Этот инструмент позволяет манипулировать атрибутом msDS-KeyCredentialLink целевого пользователя/компьютера для получения полного контроля над этим объектом. Он основан на Impacket и...

Whisker

Whisker Whisker — это C-инструмент для перехвата учётных записей пользователей и компьютеров Active Directory путём манипуляции их атрибутом msDS-KeyCredentialLink, что фактически добавляет «теневые учётные данные» Shadow Credentials к целевой учётной записи. Этот инструмент основан на коде из...

KrbRelayUp

KrbRelayUp Rubeus と KrbRelay の機能の一部（および謝辞セクションにあるその他の honorable mentions）をラップしたシンプルなツールで、以下の攻撃プリミティブの悪用を効率化します。 0. （任意）新しいマシンアカウントの作成（New-MachineAccount） 1. ローカルマシンアカウントの認証強制（KrbRelay） 2. LDAP への Kerberos リレー（KrbRelay） 3. RBCD 権限を追加し、ローカルマシンへの特権 ST を取得（Rubeus） 4. その ST を使用してローカルの Service Manager...

ShadowSpray

ShadowSpray 도메인 전체에 Shadow Credentials를 스프레이하여 도메인 내 다른 객체에 대한 오래된 GenericWrite/GenericAll DACL을 악용하기 위한 도구입니다. 이 도구의 목적 많은 엔지니어링에서 BloodHound를 통해 "Everyone" / "Authenticated Users" / "Domain Users" 또는 거의 모든 도메인 사용자를 포함하는 넓은 그룹이 도메인의 다른 객체에 대해 GenericWrite/GenericAll DACL을 가지고 있는 것을 봅니다. 이러한 권한을...

NTLM Relay to Self (HTTP to LDAP) - Post Exploitation

This module performs an NTLM relay-to-self privilege escalation attack. It starts an HTTP-to-LDAP relay server on the compromised host, then triggers the WebClient service via an ETW event allowing a low-privilege user to start it, and coerces the local machine account to authenticate via...

Exploits AD CS Template misconfigurations which involve updating an LDAP object: ESC9, ESC10, and ESC16

This module exploits Active Directory Certificate Services AD CS template misconfigurations, specifically ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user. The module leverages the auxiliary/admin/ldap/ldapobjectattribute module to update...

Metasploit Wrap-Up 05/17/2024

LDAP Authentication Improvements This week, in Metasploit v6.4.9, the team has added multiple improvements for LDAP related attacks. Two improvements relating to authentication is the new support for Signing and Channel Binding. Microsoft has been making changes to harden the communications to...

Metasploit Weekly Wrap-Up 04/12/24

Account Takeover using Shadow Credentials The new release of Metasploit Framework includes a Shadow Credentials module added by smashery used for reliably taking over an Active Directory user account or computer, and letting future authentication to happen as that account. This can be chained wit...

ShadowSpray - A Tool To Spray Shadow Credentials Across An Entire Domain In Hopes Of Abusing Long Forgotten GenericWrite/GenericAll DACLs Over Other Objects In The Domain

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or some other...

Whisker - A C# Tool For Taking Over Active Directory User And Computer Accounts By Manipulating Their msDS-KeyCredentialLink Attribute

Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this attack to...