akde/infosec

Click Here

  • XSS / Client-side Browser extraction

    Get hidden content from password fields Sce­nario: Use JavaScript for extrac­tion. Copy and pase the fol­low­ing into the web browser’s console: Extract keystrokes live from a Browser Sce­nario: Do: Extract Cookies Sce­nario: Inject/Do: Extract local / session storage Like above: Stealing site passwords Sce­nario: Then, inject JS which adds an invis­i­ble user/username/name text field and…

  • Domain Controller attacks

    Attacking Domain Controller Synchronization The DRS Direc­to­ry Repli­ca­tion Ser­vice is respon­si­ble to repli­cate a DC’s data to mul­ti­ple redun­dant DC’s. Sce­nario: You own a user who has one of the fol­low­ing rights: Nor­mal­ly, users in the fol­low­ing groups have these (could be con­fig­ured oth­er­wise, of course): You can check with the script in Basic Active Direc­to­ry…

  • Keepass

    The hash of a mas­ter pass­word of a Keep­ass kdbx file can be extract­ed with keepass2john Database.kdbx > keepass.hash Then, crack it: /opt/hashcat/hashcat keepass.hash /opt/password_lists/rockyou.txt -m 13400 -r /opt/hashcat/rules/rockyou-30000.rule (!) If there is an error regard­ing salt, check if you have the user­name like “user:” at the begin­ning of the file. Remove it.

  • Bypassing Windows protection mechanisms

    Execution If you can­not exe­cute an exe file, try these options: Windows firewall / netsh Check fire­wall state netsh advfirewall show currentprofile netsh advfirewall show state If the fire­wall is active, list the configuration: netsh advfirewall show config Exam­ple how to add excep­tions into the fire­wall via the com­mand line from an administrator: C:\Windows\temp> netsh advfirewall firewall…

  • Windows post exploitation

    Grab the SAM and sys­tem file: %windir%\repair\sam %windir%\System32\config\RegBack\SAM %windir%\system32\config\SAM %windir%\repair\system %windir%\System32\config\RegBack\system %windir%\system32\config\system (Re-) Run the cre­den­tial retriev­ers from the script page.

  • Background monitoring

    This site con­tains links to tools / tech­niques which can run in the back­ground dur­ing an engagement. Linux Windows

  • Enumerating /proc

    For reverse engineering Devi­ce­name Con­tent /proc/$pid/maps Shows the mem­pory map­ping of a process. Includes all used libraries. /proc/self/loginuid Own UID. Read processes If you can read /proc via a LFI: #!/bin/bash for i in {1..1024} do echo $i curl http://10.10.11.154/index.php\?page=/proc/$i/cmdline --output /tmp/proc/$i done The, look in the /tmp/proc direc­to­ry for files > 0 byte. Read envi­ron­ment of…

  • DPAPI

    The DPAPI is a Win­dows sys­tem which stored pass­words bound to the local system. In the user direc­to­ry there are the keys stored in the AppData\Roaming\Microsoft\Protect\<SID> directory. From the user’s pass­word, a mas­ter key is derived. When the user changes his pass­word, a new mas­ter key is gen­er­at­ed as well — and all old mas­ter…

  • Mimikatz

    Win­dows cre­ates and stores cre­den­tials in the Local Secu­ri­ty Author­i­ty Sub­sys­tem Ser­vice LSASS in the mem­o­ry. On the filesys­tem, the sam data­base stores the hashes. Use Mimikatz Usage Enable debug mode. This usess the SeDe­bug­Priv­i­lege so that we are able to com­mu­ni­cate with oth­er processes. privilege:debug Try to ele­vate priv­i­leges to obtain SYSTEM user privileges:…

  • BloodHound

    Blood­Hound ana­lyzes and present Active Direc­to­ry Data. SharpHound is the data col­lec­tor which runs on a com­pro­mised AD system. On the target: On the own system:

  • PowerShell Empire

    Main­ly post exploita­tion for AD envi­ron­ments. (Down­load — also includ­ed in Kali sources) Quick usage for privilege escalation General usage Metas­ploit syn­tax / PSE syntax Note: After use­mod­ule don’t for­get to go “back” and to “inter­act” with the agent to see job results! Com­mands with an aster­ix require a high-integri­ty Empire Agent. To upgrade one…

  • Post exploitation

    General After bee­ing root, do the fol­low­ing to gain addi­tion­al information. Copy / break /etc/shadow or SAM Inves­ti­gate all /home direc­to­ries and /root ls -lahR /home/ Are there SSH keys?  Inves­ti­gate all data­bas­es and get / break their users and passwords Check cron­job­s/-tabs Enu­mer­ate programs  and deter­mine where cre­den­tials could be.  Enu­mer­ate the user’s mail Enu­mer­ate WWW directories…

  • Sniffing network traffic (tcpdump)

    tcpdump Get incom­ing ICMP packets: sudo tcpdump -i any icmp and src host $target Nützliche Parameter Domains nicht auflösen, IPs anzeigen -n Dump der Dat­en anzeigen -X Paket in ASCII anzeigen -A Umgang mit Dateien Dump in Datei schreiben tcpdump -w file Dump aus Datei lesen tcpdump -r file Standard-Abfragen tcpdump -n src|dst 10.10.10.10 and port…

  • Wireshark

    See a pack­et in its context Kontextmenü, Follow auswählen Show only ICMP pack­ets from a host tcpdump host 10.11.1.128 and icmp -i tun0 Show oth­er sys­tems com­mu­ni­cat­ing out­side the own address ip.addr == 10.11.1.0/24 && !(ip.addr == 192.168.119.0/24) && ! dns && !browser && !ssdp && !nbns && !llmnr Record audio Wire­shark can trans­form cap­tured audio…

  • ncat

    Namenskonfusion Datei ausliefern: echo -e "HTTP/1.1 200 OK\nContent-Length: 5\n\nHallo" | nc -l localhost 8000 Datei anfragen über SSL: echo -e "GET / HTTP/1.1\nHost: localhost\n\n" | ncat -C --ssl localhost 443 Gebe Ausgabe von Programm zurück: ncat -l localhost 3000 --exec /bin/date Datei direkt übertragen (unverschlüsselt!): 1. Empfänger: user@host02:~$ ncat -l > aha oder nc -nlvp 4444…

  • redline

    Like OSX­col­lec­tor, but for Win­dows. Col­lects infor­ma­tion on a host for lat­er analyzation. https://www.fireeye.com/services/freeware/redline.html

  • osxcollector

    osx­col­lec­tor http://yelp.github.io/osxcollector/ Stand alone python script. Exe­cute it on a Mac which should be analysed. It cre­ates an archive with “every­thing” inter­esst­ing which the vic­tim can hand over an expert. See red­line for Windows