DavRelayUp

DavRelayUp 这是一个快速粗糙的 KrbRelayUp 移植版本，进行了修改以允许从 webdav 到 LDAP 的 NTLM 中继，从而简化以下攻击原语的滥用： 0. 可选 新机器账户创建 New-MachineAccount 1. 强制启动 WebClient 服务 2. 启动 webdav 中继服务器 GoRelayServer - 一个嵌入在 DavRelayUp 中的 golang DLL，使用 Costura.Fody 3. 本地机器账户认证强制 SharpSystemTriggers 4. NTLM 中继到 LDAP 5. 添加 RBCD 权限并获得对本地机器的特权...

KrbRelayUp

KrbRelayUp Un wrapper sencillo alrededor de algunas de las funcionalidades de Rubeus y KrbRelay y algunas otras menciones honoríficas en la sección de agradecimientos con el fin de agilizar el abuso de la siguiente primitiva de ataque: 0. Opcional Creación de una nueva cuenta de máquina...

Metasploit Wrap-Up 05/10/2024

Password Spraying support Multiple bruteforce/login scanner modules have been updated to support a PASSWORDSPRAY module option. This work was completed in pull request 19079 from nrathaus as well as an additional update from our developers . When the password spraying option is set, the order of...

Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp)

On April 24, 2022, a privilege escalation hacking tool, KrbRelayUp, was publicly disclosed on GitHub by security researcher Mor Davidovich. KrbRelayUp is a wrapper that can streamline the use of some features in Rubeus, KrbRelay, SCMUACBypass, PowerMad/SharpMad, Whisker, and ADCSPwn tools in...

Microsoft Guidance for Enabling LDAP Channel Binding and LDAP Signing

Executive Summary LDAP channel binding and LDAP signing provide ways to increase the security for communications between LDAP clients and Active Directory domain controllers. A set of unsafe default configurations for LDAP channel binding and LDAP signing exist on Active Directory domain...