GhostTask

Ghost Scheduled Task Inspired by WithSecure's research on Scheduled Task Tampering, they explained the feasibility of creating a scheduled task solely through registry key manipulation. Such an approach can bypass the generation of scheduled task creation event logs, such as 4698 and 106, providi...

vulnerable-AD

Vulnerable-AD Create a vulnerable active directory that's allowing you to test most of active directory attacks in local lab Main Features Randomize Attacks Full Coverage of the mentioned attacks you need run the script in DC with Active Directory installed Some of attacks require client...

NetNTLMtoSilverTicket

SpoolSample - NetNTLMv1 - NTLM - Silver Ticket 이 기술은 다른 사람들이 암시한 바 있지만, 지금까지 통합된 내용은 본 적이 없습니다. 아래에서는 NetNTLMv1 Challenge/Response 인증을 획득하고, 이를 NTLM 해시로 크랙한 후, 해당 NTLM 해시를 사용하여 Kerberos Silver Ticket에 서명하는 단계를 설명합니다. 이 방법은 "LAN Manager authentication level"이 2 이하로 설정된 네트워크에서 작동합니다. 이는 오래되고 큰...

blackhat-usa-2022-demos

blackhat-usa-2022-demos Blackhat USA 2022 발표 "Taking Kerberos to the Next Level"의 데모입니다. 이 자료는 James Forshaw@tiraniddo과 Nick Landers@monoxgas의 프레젠테이션 슬라이드와 데모입니다. 데모 목록은 다음과 같습니다: demo1.ps1 - 비밀번호를 사용한 Silver ticket demo2.ps1 - Silver ticket U2U demo3.ps1 - 버퍼 유형 혼동buffer type confusion을 이용한 Silv...

Kerberos Silver/Golden/Diamond/Sapphire Ticket Forging

This module forges a Kerberos ticket. Four different techniques can be used: - Silver ticket: Using a service account hash, craft a ticket impersonating any user and privileges to that account. - Golden ticket: Using the krbtgt hash, craft a ticket impersonating any user and privileges. - Diamond...

How to Mitigate Microsoft Windows 10, 11 SeriousSAM Vulnerability

Microsoft Windows 10 and Windows 11 users are at risk of a new unpatched vulnerability that was recently disclosed publicly. As we reported last week, the vulnerability — SeriousSAM — allows attackers with low-level permissions to access Windows system files to perform a Pass-the-Hash and...

MS14-068-domain privilege escalation vulnerability summary-vulnerability warning-the black bar safety net

0x01 vulnerability of origin Said to ms14-068,have to say the silver ticket, that is, the cheque in. Cheque is a piece of tgs, that is, a service Ticket. The service ticket is the client is sent directly to the server and request the service resource. If the server is not the domain controller dc...