Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration
Arguments ./LACheck.exe help _ _____ _ _ | | /\ / ____| | | | | | / \ | | | |__ ___ ___| | __ | | / /\ \ | | | '_ \ / _ \/ __| |/ / | |____ / ____ \ | |____| | | | __/ (__| < |______/_/ \_\ \_____|_| |_|\___|\___|_|\_\ Usage: LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:"OU=Special Servers,DC=example,DC=local" /verbose /bloodhound /user:bob@contoso.lab Local Admin Checks: smb - Attempts to access C$ share rpc - Attempts WMI query of Win32_ComputerSystem Class provider over RPC winrm - Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session Arguments: /bloodhound - generate bloodhound-digestible AdminTo and Session collection file output file is zipped and enypted with randomized name and password /dc - specify domain controller to query (if not ran on a domain-joined host) /domain - specify domain name (if not ran on a domain-joined host) /edr - check host for EDR (requires smb, rpc, or winrm) /logons - return logged on users on a host (requires smb, rpc, or winrm) /registry - enumerate sessions from registry hive (requires smb) /services - return services running as users (requires smb, rpc, or winrm) /socket - send bloodhound output to TCP socket instead of writing to disk ex: ""127.0.0.1:8080"" /targets - comma-separated list of hostnames to check /threads - specify maximum number of parallel threads (default=25) /user - specify username that collection was run under (useful during token manipulation) /validate - check credentials (https://www.kitploit.com/search/label/Credentials) against Domain prior to scanning targets (useful during token manipulation) /verbose - print additional logging information /ou - specify LDAP OU to query enabled computer objects from ex: "OU=Special Servers,DC=example,DC=local" /ldap - query hosts from the following LDAP filters: :all - All enabled computers with 'primary' group 'Domain Computers' :dc - All enabled Domain Controllers (not read-only DCs) :exclude-dc - All enabled computers that are not Domain Controllers or read-only DCs :servers - All enabled servers :servers-exclude-dc - All enabled servers excluding Domain Controllers or read-only DCs">> ./LACheck.exe help
_ _____ _ _
| | /\ / ____| | | |
| | / \ | | | |__ ___ ___| | __
| | / /\ \ | | | '_ \ / _ \/ __| |/ /
| |____ / ____ \ | |____| | | | __/ (__| <
|______/_/ \_\ \_____|_| |_|\___|\___|_|\_\

Usage:
LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:"OU=Special Servers,DC=example,DC=local" /verbose /bloodhound /user:bob@contoso.lab

Local Admin Checks:
smb - Attempts to access C$ share
rpc - Attempts WMI query of Win32_ComputerSystem Class provider over RPC
winrm - Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session

Arguments:
/bloodhound - generate bloodhound-digestible AdminTo and Session collection file
output file is zipped and enypted with randomized name and password
/dc - specify domain controller to query (if not ran on a domain-joined host)
/domain - specify domain name (if not ran on a domain-joined host)
/edr - check host for EDR (requires smb, rpc, or winrm)
/logons - return logged on users on a host (requires smb, rpc, or winrm)
/registry - enumerate sessions from registry hive (requires smb)
/services - return services running as users (requires smb, rpc, or winrm)

___________________________
@hacking_Attack
@Hacking_Video

/socket - send bloodhound output to TCP socket instead of writing to disk
ex: ""127.0.0.1:8080""
/targets - comma-separated list of hostnames to check
/threads - specify maximum number of parallel threads (default=25)
/user - specify username that collection was run under (useful during token manipulation)
/validate - check credentials aga inst Domain prior to scanning targets (useful during token manipulation)
/verbose - print additional logging information
/ou - specify LDAP OU to query enabled computer objects from
ex: "OU=Special Servers,DC=example,DC=local"
/ldap - query hosts from the following LDAP filters:
:all - All enabled computers with 'primary' group 'Domain Computers'
:dc - All enabled Domain Controllers (not read-only DCs)
:exclude-dc - All enabled computers that are not Domain Controllers or read-only DCs
:servers - All enabled servers
:servers-exclude-dc - All enabled servers excluding Domain Controllers or read-only DCs
Execute Assembly execute-assembly /opt/SharpTools/LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
Output authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.">[*] Tasked beacon to run .NET program: LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
[+] host called home, sent: 111705 bytes
[+] received Output
[+] Parsed Aguments:
rpc: True
smb: True
winrm: True
/bloodhound: False
/edr: False
/logons: True
/registry: False /services: False
/ldap: servers-exclude-dc
/ou:
/targets:
/threads: 10
/user: svcadmin
/validate: False
/verbose: False
[+] Performing LDAP query for all enabled computers that are not Domain Controllers or read-only DCs...
[+] This may take some time depending on the size of the environment
[+] LDAP Search Results: 2
[SMB] Admin Success: WEB01 as svcadmin
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[session] WEB01 - contoso\WEB01$ (svcadmin)
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[rdp] WEB01 - contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 - contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
[WinRM] Admin Success: DESKTOP-118GDCE as svcadmin
[WinRM] Admin Success: DEV02.contoso.com as svcadmin
[!] RPC on DEV02.contoso.com - Access denied.
[!] SMB on DEV02.contoso.com - Attempted to perform an unauthorized operation.
[RPC] Admin Success: 10.10.10.10 as svcadmin
[!] SMB on 10.10.10.10 - Attempted to perform an unauthorized operation.
[!] WinRM on 10.10.10.10 - The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.

___________________________
@hacking_Attack
@Hacking_Video

Enumeration Methods Performance Summary SMB WMI WinRM /edr fast fast fast /logons fast fast fast /services slow fast fast /registry slow fast - - = not implemented SMB /edr Inspired by harleyQu1nn's EDR.cna script (https://github.com/harleyQu1nn/AggressorScripts/blob/master/EDR.cna) Directory.GetFiles (https://docs.microsoft.com/en-us/dotnet/api/system.io.directory.getfiles) Method returns a list of drivers from: \\host\C$\windows\system32\drivers \\host\C$\windows\sysnative\drivers Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user [EDR] WEB01 - Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 - no EDR found (svcadmin)
/logons NetWkstaUserEnum (https://docs.microsoft.com/en-us/windows/win32/api/lmwksta/nf-lmwksta-netwkstauserenum) returns a list of users with interactive, service and batch logons WTSEnumerateSessionsA (https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsenumeratesessionsa) returns a list of RDP sessions on a host WTSQuerySessionInformationA (https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsquerysessioninformationa) retrieves detailed information for each RDP session Example Output ran as svcadmin user [session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[session] WEB01 - contoso\WEB01$ (svcadmin)
[session] WEB01 - contoso\devadmin (svcadmin)
[session] WEB01 - contoso\devuser (svcadmin)
[rdp] WEB01 - contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
/registry Iterate through SIDs in \\Computer\HKEY_USERS\ hive, attempts to access Volatile Environment for each SID, and retrieves values from USERDOMAIN and USERNAME keys. This method requires the Remote Registry service to be running on a remote host. If it is not: initial start type of the Remote Registry service is recorded start type is changed to Automatic Remote Registry service is started registry hives are enumerated Remote Registry service is stopped start type is reverted to its initially recorded value Due to the potentially multi-step process to enumerate each host, this method may be slower compared to alternative techniques. smb /logons is faster Example Output ran as svcadmin user [registry] WEB01 - contoso\devadmin (svcadmin)
/services ServiceController.GetServices Method (https://docs.microsoft.com/en-us/dotnet/api/system.serviceprocess.servicecontroller.getservices) retrieves a list of services on a host Each service is queried to determine the user it is configured to run as. Due to each service having to be queried individually, this method may be slower compared to alternative techniques. wmi /services is faster Example Output ran as svcadmin user [service] WEB01 - devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WMI /edr Inspired by harleyQu1nn's EDR.cna script (https://github.com/harleyQu1nn/AggressorScripts/blob/master/EDR.cna) CIM_DataFile class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/cim-datafile) returns a list of drivers from: \host\C$\windows\system32\drivers \host\C$\windows\sysnative\drivers Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user [EDR] WEB01 - Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 - no EDR found (svcadmin)
/logons Win32_LoggedOnUser class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-loggedonuser) returns a list of logged on sessions Win32_LogonSession class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-logonsession) returns detailed information for each session Example Output ran as svcadmin user [session] WEB01 - contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)

___________________________
@hacking_Attack
@Hacking_Video

[session] WEB01 - contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 - contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 - contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
/registry Queries the Win32_UserProfile class (https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ee886409(v=vs.85)) to retrieve SIDs for user profiles on a system. The EnumKey method of the StdRegProv class (https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/enumkey-method-in-class-stdregprov) retrieves the \\Computer\HKEY_USERS\ hive and attempts to access Volatile Environment for each returned SID to retrieve values from the USERDOMAIN and USERNAME keys. Example Output ran as svcadmin user [registry] WEB01 - contoso\devadmin (svcadmin)
/services Queries the Win32_Service class (https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service) to retrieve the name, user, and state of services Example Output ran as svcadmin user [service] WEB01 - devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WinRM Each WMI checks is also implemented using WMI Resources (https://docs.microsoft.com/en-us/windows/win32/winrm/querying-for-specific-instances-of-a-resource) and WMI Enumeration (https://docs.microsoft.com/en-us/windows/win32/api/wsmandisp/nf-wsmandisp-iwsmansession-enumerate) over WinRM. This avoids the use of PowerShell runspaces.

Download LACheck (https://github.com/mitchmoser/LACheck)

___________________________
@hacking_Attack
@Hacking_Video

Help me with my system please....can anyone help me with this my kali virtual os was lagging on recon phase with slow fuzzing...what should i do to make it fast
https://www.reddit.com/r/Pentesting/comments/s0hc0v/help_me_with_my_system_pleasecan_anyone_help_me/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Revolutionary-Play59 (https://www.reddit.com/user/Revolutionary-Play59)
[link] (https://i.redd.it/r7zvhuy2cua81.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/s0hc0v/help_me_with_my_system_pleasecan_anyone_help_me/)

___________________________
@hacking_Attack
@Hacking_Video

Using Filename to Inject XSS Payload

Back in july 2021 i was hunting for bugs on a web application that had a very small scope, i would call it Redacted.com for the sake of…Continue reading on Medium »
Read more...

Bug Bounty: Fingerprinting

Fingerprinting — Finding and Indexing Services and Technologies used by your target.Continue reading on Medium »
Read more...

Using Filename to Inject XSS Payload
https://medium.com/@ayomi1791/using-filename-to-inject-xss-payload-214cb6d1ec6c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Back in july 2021 i was hunting for bugs on a web application that had a very small scope, i would call it Redacted.com for the sake of…Continue reading on Medium » (https://medium.com/@ayomi1791/using-filename-to-inject-xss-payload-214cb6d1ec6c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty: Fingerprinting
https://medium.com/@Sm9l/bug-bounty-fingerprinting-204506945ab?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Fingerprinting — Finding and Indexing Services and Technologies used by your target.Continue reading on Medium » (https://medium.com/@Sm9l/bug-bounty-fingerprinting-204506945ab?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bug Bounty: Fingerprinting

https://cdn-images-1.medium.com/max/1750/1*vjTEyrfwOERRdS39X8KidA.png
Fingerprinting — Finding and Indexing Services and Technologies used by your target.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
LACheck - Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it legal to take back my own account?

Tldr below^

I have had a minecraft account that's been mine since 2010, I played it on multiple servers, but mostly singleplayer. In 2016 I quit the game for some time to focus on personal matters and early 2017 I receiced notice from various servers that my account was banned for "suspicious activities". Tried logging in but the credentials were different. The emailaddress bound to it had different credentials as well, when I finally got back my emailaddress everything was wiped and so was my account. I just want the name of the account back, I don't care for any values on the account, just the name accountname because of a private server world I no longer have my things in.

Since the company and customer service are being complete ass about helping me recover the account, I'm thinking about other ways to get it back. Whoever stole the account probably still has it, but it appears to not be used anymore. Since I'm not allowed to prove it's mine, can I rightfully steal back what's mine?

Tldr: Someone stole my account and wiped his traces clean, since customer support won't help me, can I 'steal' back my account without getting in legal trouble?

submitted by /u/SirLeonardo20
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anyone know of a reliable subreddit or forum one can find breach compilations

I recently discovered the h8mail tool (yes i'm new) but the only good compilation that I didn't have to pay for with a forum currency of some sort was the COMB breach. This made me wonder if there is any place one could find more specific breaches like the PDL Customer breach for example. Any help would be appreciated

submitted by /u/Pippin_42
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video