This POC is inspired by James Forshaw (@tiraniddo (https://twitter.com/tiraniddo)) shared at BlackHat (https://www.kitploit.com/search/label/BlackHat) USA 2022 titled “Taking Kerberos (https://www.kitploit.com/search/label/Kerberos) To The Next Level ” topic, he shared a Demo of abusing Kerberos tickets to achieve UAC bypass. By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges by accessing the SCM to create a system service. James Forshaw explained the rationale behind this in a blog post called "Bypassing UAC in the most Complex Way Possible!", which got me very interested. Although he didn't provide the full exploit code, I built a POC based on Rubeus (https://github.com/GhostPack/Rubeus#tgtdeleg). As a C# toolset (https://www.kitploit.com/search/label/Toolset) for raw Kerberos interaction and ticket abuse, Rubeus provides an easy interface that allows us to easily initiate Kerberos requests and manipulate Kerberos tickets. You can see related articles about KRBUACBypass in my blog "Revisiting a UAC Bypass By Abusing Kerberos Tickets", including the background principle and how it is implemented. As said in the article, this article was inspired by @tiraniddo's "Taking Kerberos To The Next Level" (I would not have done it without his sharing) and I just implemented it as a tool before I graduated from college.
Tgtdeleg Trick We cannot manually generate a TGT as we do not have and do not have access to the current user's credentials. However, Benjamin Delpy (@gentilkiwi (https://github.com/gentilkiwi)) in his Kekeo (https://github.com/gentilkiwi/kekeo/blob/4fbb44ec54ff093ae0fbe4471de19681a8e71a86/kekeo/modules/kuhl_m_tgt.c#L189) A trick (tgtdeleg) was added that allows you to abuse unconstrained delegation to obtain a local TGT with a session key. Tgtdeleg abuses the Kerberos GSS-API to obtain available TGTs for the current user without obtaining elevated privileges on the host. This method uses the AcquireCredentialsHandle function to obtain the Kerberos security credentials (https://www.kitploit.com/search/label/Credentials) handle for the current user, and calls the InitializeSecurityContext function for HOST/DC.domain.com using the ISC_REQ_DELEGATE flag and the target SPN to prepare the pseudo-delegation context to send to the domain controller. This causes the KRB_AP-REQ in the GSS-API output to include the KRB_CRED in the Authenticator Checksum. The service ticket's session key is then extracted from the local Kerberos cache and used to decrypt the KRB_CRED in the Authenticator to obtain a usable TGT. The Rubeus toolset also incorporates this technique. For details, please refer to “Rubeus – Now With More Kekeo”. With this TGT, we can generate our own service ticket, and the feasible operation process is as follows: Use the Tgtdeleg trick to get the user's TGT. Use the TGT to request the KDC to generate a new service ticket for the local computer. Add a KERB-AD-RESTRICTION-ENTRY, but fill in a fake MachineID. Submit the service ticket into the cache. Krbscm Once you have a service ticket, you can use Kerberos authentication (https://www.kitploit.com/search/label/Authentication) to access Service Control Manager (SCM) Named Pipes or TCP via HOST/HOSTNAME or RPC/HOSTNAME SPN. Note that SCM's Win32 API always uses Negotiate authentication. James Forshaw created a simple POC: SCMUACBypass.cpp (https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82), through the two APIs HOOK AcquireCredentialsHandle and InitializeSecurityContextW, the name of the authentication package called by SCM (pszPack age ) to Kerberos to enable the SCM to use Kerberos when authenticating locally. Let’s see it in action Now let's take a look at the running effect, as shown in the figure below. First request a ticket for the HOST service of the current server through the asktgs function, and then create a system service through

krbscm to gain the SYSTEM privilege. KRBUACBypass.exe asktgs
KRBUACBypass.exe krbscm


Download KRBUACBypass (https://github.com/wh0amitz/KRBUACBypass)

Hacking on Medium
Kioptrix Level 1.3 (#4) | VulnHub Walkthrough by Mark de Moras

https://cdn-images-1.medium.com/max/1920/1*nuV2T9Ie5horvfeCFxR75g.png
This is a full walkthrough to the Kioptrix Level 1.3 (#4) machine from VulnHub. I made a video in correlation with this writeup which you…

Continue reading on Medium »

Hacking on Medium
Curve Finance Hacked

https://cdn-images-1.medium.com/max/1300/1*OWipN5wmBefLrKNATPMQ3Q.jpeg
The recent hacking of Curve Finance liquidity pools could have far and wide reaching consequences for the crypto and DeFi space.

Continue reading on Medium »

Hacking on Medium
“Exploit de Curve: Impacto DeFi”

https://cdn-images-1.medium.com/max/1200/1*u7hOec2oemUmjCzdjhrFTA.png
El 30 de julio se explotaron varios grupos estables en Curve Finance que usaban Vyper, con pérdidas que superaron los 47 millones de…

Continue reading on Medium »

Hacking on Medium
Curve Finance: Unleashing the Power of Stablecoin Trading in DeFi

https://cdn-images-1.medium.com/max/600/0*GFOsyrSZn3bF9w9n.png
The world of decentralized finance (DeFi) has witnessed a remarkable rise, with various platforms offering innovative solutions for…

Continue reading on Medium »

Hacking on Medium
Uncovering Information Disclosures: A Step-by-Step Guide for Beginners

https://cdn-images-1.medium.com/max/1000/1*DIJCj38nRE8jtOjhUeH4og.jpeg
Introduction :

Continue reading on Medium »

Hacking on Medium
Python Libraries for Hackers

https://cdn-images-1.medium.com/max/2600/1*E4od0LKRNcYZ6ueDyfSqIQ.png
Hi friends welcome back to my another article .My name is MrHorbio and I am an Ethical Hacker . Today we will Talk about most easiest and…

Continue reading on System Weakness »

Hacking on Medium
The Joy of Plant Parenthood: How Indoor Gardening Soothes the Soul

https://cdn-images-1.medium.com/max/2600/0*v-v7dD31RiVzgC41
In the bustling chaos of our modern lives, finding moments of peace and serenity becomes an invaluable pursuit. As an adventurer who has…

Continue reading on ILLUMINATION »

Hacking on Medium
The Future of Online Privacy: Top 5 Technologies You Need to Know About

https://cdn-images-1.medium.com/max/2600/0*18mE2KPCn4VJLqrI
From quantum cryptography’s virtually unbreakable encryption to blockchain’s transparent and secure transactions, learn the five…

Continue reading on Stealth Security »

Hacking on Medium
How can networking help in advancing a cybersecurity career and finding job opportunities?

Networking can play a significant role in advancing a cybersecurity career and finding job opportunities. In the field of cybersecurity…

Continue reading on Medium »

KitPloit - PenTest Tools!
KRBUACBypass - UAC Bypass By Abusing Kerberos Tickets

https://blogger.googleusercontent.com/img/a/AVvXsEhqpBtrUpwuDvoE0AOX5Zdn8wo46E4ZqNHPGH6P4xdy7vOPtIvRas_ucx0mJQuSurlCLy-ec8WFeBziP-QiQU3UiQJz03gxRj4EvmcATydHEqUF87tvTgkGglDsxoXYKYPY4wSzn2DJ7tIfKdIa-jpo71jABC5BedRSVY-LkRi7Z9WM_x9faxreW33QPnbe=w640-h404 This POC is inspired by James Forshaw (@tiraniddo) shared at BlackHat USA 2022 titled “Taking Kerberos To The Next Level ” topic, he shared a Demo of abusing Kerberos tickets to achieve UAC bypass. By adding a KERB-AD-RESTRICTION-ENTRYto the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges by accessing the SCM to create a system service. James Forshaw explained the rationale behind this in a blog post called "Bypassing UAC in the most Complex Way Possible!", which got me very interested. Although he didn't provide the full exploit code, I built a POC based on Rubeus. As a C# toolset for raw Kerberos interaction and ticket abuse, Rubeus provides an easy interface that allows us to easily initiate Kerberos requests and manipulate Kerberos tickets.

You can see related articles about KRBUACBypass in my blog "Revisiting a UAC Bypass By Abusing Kerberos Tickets", including the background principle and how it is implemented. As said in the article, this article was inspired by @tiraniddo's "Taking Kerberos To The Next Level" (I would not have done it without his sharing) and I just implemented it as a tool before I graduated from college. Tgtdeleg TrickWe cannot manually generate a TGT as we do not have and do not have access to the current user's credentials. However, Benjamin Delpy (@gentilkiwi) in his Kekeo A trick (tgtdeleg) was added that allows you to abuse unconstrained delegation to obtain a local TGT with a session key.

Tgtdeleg abuses the Kerberos GSS-API to obtain available TGTs for the current user without obtaining elevated privileges on the host. This method uses the AcquireCredentialsHandlefunction to obtain the Kerberos security credentials handle for the current user, and calls the InitializeSecurityContextfunction for HOST/DC.domain.comusing the ISC_REQ_DELEGATEflag and the target SPN to prepare the pseudo-delegation context to send to the domain controller. This causes the KRB_AP-REQ in the GSS-API output to include the KRB_CRED in the Authenticator Checksum. The service ticket's session key is then extracted from the local Kerberos cache and used to decrypt the KRB_CRED in the Authenticator to obtain a usable TGT. The Rubeus toolset also incorporates this technique. For details, please refer to “Rubeus – Now With More Kekeo”.

With this TGT, we can generate our own service ticket, and the feasible operation process is as follows:

1. Use the Tgtdeleg trick to get the user's TGT.
2. Use the TGT to request the KDC to generate a new service ticket for the local computer. Add a KERB-AD-RESTRICTION-ENTRY, but fill in a fake MachineID.
3. Submit the service ticket into the cache. KrbscmOnce you have a service ticket, you can use Kerberos authentication to access Service Control Manager (SCM) Named Pipes or TCP via HOST/HOSTNAME or RPC/HOSTNAME SPN. Note that SCM's Win32 API always uses Negotiate authentication. James Forshaw created a simple POC: SCMUACBypass.cpp, through the two APIs HOOK AcquireCredentialsHandle and InitializeSecurityContextW, the name of the authentication package called by SCM (pszPack age ) to Kerberos to enable the SCM to use Kerberos when authenticating locally. Let’s see it in actionNow let's take a look at the running effect, as shown in the figure below. First request a ticket for the HOST service of the current server through the asktgs function, and then create a system service through krbscm to gain the SYSTEM privilege. KRBUACBypass.exe asktgs
KRBUACBypass.exe krbscmDownload KRBUACBypass

NTLMrelay agains VPN
https://www.reddit.com/r/redteamsec/comments/15g69x9/ntlmrelay_agains_vpn/

<!-- SC_OFF -->Sup guys, I wonder what would yo do if you had a VPN connection to the network (e.g. GlobalProtect) and you had to perform some kind of relay attack (like ntlmrelay(ldap)+PrivExchange). The issue is the you receive IP address and even can ping DC, but at the same time that ip address is given you by the VPN and users from the domain can not ping it. Are there any ways how to handle that issue? <!-- SC_ON --> submitted by /u/no_seaweed666 (https://www.reddit.com/user/no_seaweed666)
[link] (https://www.reddit.com/r/redteamsec/comments/15g69x9/ntlmrelay_agains_vpn/) [comments] (https://www.reddit.com/r/redteamsec/comments/15g69x9/ntlmrelay_agains_vpn/)

Deep Web
Footage

Any rare combat footage on the dark net? Like body cam, inside navy seal operations, or something like that. It’s just super interesting to me and hard to find on here. I’m super interested in illicit activity busts, or irregular warfare

submitted by /u/AdhesivenessFar6938
[link] [comments]