whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

some additions for phishing and cleanup

This commit is contained in:
gurkenhabicht 2024-01-29 22:46:44 +01:00
parent aba2d26776
commit 1e166ee37e
1 changed files with 27 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
Cryptography/Active Directory/AD Gaining Foothold.md
View File

@ -2,7 +2,6 @@
* Methods of aquiring the first set of credentials * Methods of aquiring the first set of credentials
## Aquire credentials ## Aquire credentials
### OSINT ### OSINT
@ -12,9 +11,13 @@
* Credentials set in (github) repos * Credentials set in (github) repos
* Past breaches, [haveIbeenpwned](https://haveibeenpwned.com/), [DeHashed](https://www.dehashed.com/) * Past breaches, [haveIbeenpwned](https://haveibeenpwned.com/), [DeHashed](https://www.dehashed.com/)
### Phishing ### Phishing
* Gain credentials via eMail [Create files for using Greenwolf's NTLM theft](https://github.com/Greenwolf/ntlm_theft).
>ntlm_theft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already inside the internal network.
Gain credentials via eMail, smb write permissions and so on.
## NTLM Authenticated Services ## NTLM Authenticated Services
@ -26,7 +29,7 @@
* Web applications using something like SSO via AD * Web applications using something like SSO via AD
* Use these applications to either brute force / spraying passwords to found IDs or to verify previously aquired IDs and their passwords * Use these applications to either brute force / spraying passwords to found IDs or to verify previously aquired IDs and their passwords
## LDAP Bind Credentials ## LDAP Bind Credentials
* LDAP may be integrated into an AD Forest. An application may verify an LDAP account with the help of AD credentials at the DC. * LDAP may be integrated into an AD Forest. An application may verify an LDAP account with the help of AD credentials at the DC.
@ -40,29 +43,37 @@
* After gaining access to a device's config including LDAP parameters, reroute its IP to your own IP. This may be done via web UIs. * After gaining access to a device's config including LDAP parameters, reroute its IP to your own IP. This may be done via web UIs.
* Use an LDAP server to catch the credentials. Only PLAIN and LOGIN authentication must be allowed in order to gain the credentials. * Use an LDAP server to catch the credentials. Only PLAIN and LOGIN authentication must be allowed in order to gain the credentials.
* OpenLDAP * OpenLDAP
```sh ```sh
dpkg-reconfigure -p low slapd dpkg-reconfigure -p low slapd
``` ```
* Skip reconfiguration -> No
* Insert DNS domain and organisation * Skip reconfiguration -> No
* Provide password * Insert DNS domain and organisation
* Select `MDB` as database * Provide password
* No removal when db is purged * Select `MDB` as database
* Move old database when creating a new one * No removal when db is purged
* Downgrade authentication via `*.ldif` file * Move old database when creating a new one
* Downgrade authentication via `*.ldif` file
```sh ```sh
dn: cn=config dn: cn=config
replace: olcSaslSecProps replace: olcSaslSecProps
olcSaslSecProps: noanonymous,minssf=0,passcred olcSaslSecProps: noanonymous,minssf=0,passcred
``` ```
* Patch and reload ldap
Patch and reload ldap
```sh ```sh
sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart
``` ```
* Check via
Check via
```sh ```sh
ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
``` ```
* Make pcap via tcdump * Make pcap via tcdump
## Authentication Relay ## Authentication Relay
@ -77,10 +88,13 @@ ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
### Capture via responder ### Capture via responder
* Run responder on LAN via * Run responder on LAN via
```sh ```sh
sudo responder -I <interface> sudo responder -I <interface>
``` ```
* Use `hashcat` to crack the hashes * Use `hashcat` to crack the hashes
```sh ```sh
hashcat -m 5600 hash.txt rockyout.txt --force hashcat -m 5600 hash.txt rockyout.txt --force
``` ```
@ -109,7 +123,6 @@ hashcat -m 5600 hash.txt rockyout.txt --force
* Use `PowerPXE.ps1` to extract `*.bcd` files * Use `PowerPXE.ps1` to extract `*.bcd` files
## Configuration Files ## Configuration Files
* Configurations of services and applications as well as registry keys * Configurations of services and applications as well as registry keys