👨‍💻 LLMNR Poisoning with Responder.

• LLMNR Poisoning;
- Getting onto the Network (Example for Context);
• LLMNR Poisoning (SMB);
- How Responder works to poison SMB;
- Setting up Responder for the Attack;
- Capturing a User’s Hash with Responder: Mistyped Share;
• LLMNR Poisoning (WPAD);
- How Responder works to poison WPAD;
- Setting up Responder for the Attack;
- Capturing a User’s Hash with Responder: Mistyped URL;
- Why not grab plaintext?
• LLMNR Poisoning (DHCP);
- How Responder works to poison DHCP;
- Setting up Responder for the Attack;
- Capturing the Computer Hash with Responder: DHCP Lease Renewal;
• Cracking NetNTLMv2 Hashes with Hashcat;
• Bonus: CTF’ish Use-Cases for Responder;
- Getting an NetNTLMv2 Hash from MS-SQL (port 1433);
- Getting an NetNTLMv2 Hash from an SSRF Vulnerability;
• Want to stay up to date with the latest hacks?

• In this post we will go over the concept of LLMNR poisoning. To perform LLMNR poisoning we will execute a MITM (man-in-the-middle) attack using a tool called Responder. Using this tool we will see how we can get in-between user requests for SMB, WPAD, and DHCP to gather NetNTLMv2 hashes. After that, we will see how we can crack the NetNTLMv2 hash-type using hashcat.

🧷 https://juggernaut-sec.com/llmnr-poisoning-responder/,

#hashcat #LLMNR #MITM #Responder

👨‍💻 Kerberoasting.

• Finding Kerberoastable Users Using setspn;
• Rubeus.exe;
- Cracking the TGS-REP Hashes with Hashcat;
• Invoke-Kerberoast.ps1;
• GetUserSPNs.py;
• Mitigation;
• Want to stay up to date with the latest hacks?

In this blog post we will have a look at three different ways to perform kerberoasting, how to use hashcat to crack the service ticket (hash), and a few ways that we can mitigate this type of attack.

🧷 https://juggernaut-sec.com/kerberoasting/

#hashcat #kerberoasting

🔐 Password Hunting – Linux Privilege Escalation.

• Password Hunting – Filenames and File Contents;
- Hunting for Interesting Filenames;
- Hunting for Interesting Strings Inside Files;
• Password Hunting – Web Files / Config Files;
- Passwords in Config Files;
- Passwords in Other Web Files (WebDav Example);
- Cracking the WebDav Password with Hashcat;
• Password Hunting – Hidden Files and Folders;
- Passwords in Unique (Custom) Hidden Folder and File;
- Passwords in Bash History Files;
- Passwords in SSH Keys;
- Cracking an SSH Key using John the Ripper;
• Password Hunting – MySQL;
- Password Hashes in a Custom Database Part 1 – MD5 Hashes;
- Cracking Custom Database Hashes Using Hashcat;
- Password Hashes in a Custom Database Part 2 – Base64 Decode;
• Password Hunting – /var/backups Folder;
- Cracking Shadow Hashes with Hashcat;
• Passwords Hunting – Password Protected Files;
- Cracking the RAR Files Password Using John the Ripper;
• Password Hunting with Tools – LinPEAS;
• Want to stay up to date with the latest hacks?

• In this post we will be exploring the art of password hunting on a target Linux machine as a means to escalate privileges either horizontally or vertically. We will review various techniques to hunt for passwords, as well as some common locations they are stored. During our hunt, we will uncover credentials in scripts, config files, filenames, hashes and much more!

🧷 https://juggernaut-sec.com/password-hunting-lpe/

#cracking #Hashcat #Linux