the server.<o:p Learn More: Domain Persistence: Golden Ticket Attack<o:pExtracting Tickets<o:pWe saw how to forge tickets. Tickets last longer than a normal persistence. Golden Tickets can last up to 10 years. Hence, we should have the ability to extract those tickets for usage down the road. <o:p usemodule credentials/mimikatz/extract_tickets<o:pexecute<o:phttps://1.bp.blogspot.com/-eAcjU3JjLtE/YGyxOAJ9XRI/AAAAAAAAvQg/xHuteEHa3DUa86O1ljIthpbcv7MBJ760gCLcBGAsYHQ/s16000/5.png <v:shape<v:imagedata<o:p Learn More: Deep Dive into Kerberoasting Attack<o:pDomain Cache<o:pMicrosoft Windows stores previous users’ logon information locally so that they can log on if a logon server is unreachable during later logon attempts. This is known as Domain Cache credential (DCC) but in-actually it is also known as MSCACHE or MSCASH hash. It sorted the hash of the user’s password that you can’t perform pass-the-hash attacks with this type of hash. It uses MSCACHE algorithm for generating password hash and that are stored locally in the Windows registry of Windows operating system. These hashes are stored in the Windows registry, by default the last 10 hashes.<o:p

There two versions of MSCASH/MSCACHE or DCC<o:p

· MSCACHEV1 or DCC1 used before Vista Server 2003

· MSCACHEV2 or DCC2 used after Vista & Server 2003<o:p

PowerShell Empire has a module that extracts the MSCACHEV2 hashes from the inside registry of the compromised machine. <o:p usemodule credentails/mimikatz/cache<o:pexecute<o:pAnd again, you will get the MSCACHEv2 hashes on your screen<o:p https://1.bp.blogspot.com/-gKBNZNlVFRY/YGyxXgMQTII/AAAAAAAAvQo/Y_JS0UgDDiEPaiI_uPMKpGr9KDBZznmcwCLcBGAsYHQ/s16000/6.png <v:shape<v:imagedata<o:p Learn More: Credential Dumping: Domain Cache Credential<o:p Mimikatz Commands<o:pAs we saw that there is no shortage of mimikatz modules on PowerShell Empire but the Mimikatz is still a big tool with many more attack methods than the Empire team can catch up. So, if you are at the point where you don’t remember any module but you do know the mimikatz command to run, then Empire has you covered. Use the mimikatz/command module to run manual commands directly on the compromised target. To demonstrate, we will be running the lsadump::lsa /patch on the target machine. When run, Mimikatz patches the samsrv.dll running inside the process lsass.exe to dump the NTLM hashes. <o:p usemodule credentials/mimikatz/command<o:pSet Command lsadump::lsa /patch<o:pexecute<o:p<o:p https://1.bp.blogspot.com/-4xm4F7l-fuE/YGyxk-UTxZI/AAAAAAAAvQ0/IB6YeVPfYG8ypkSRkYdsInHL6KbGERuBgCLcBGAsYHQ/s16000/7.png <v:shape<v:imagedata<o:p Extracting Certificates<o:pA Root SSL certificate is a certificate issued by a trusted certificate authority (CA). In the SSL ecosystem, anyone can generate a signing key and use it to sign a new certificate. However, that certificate isn’t considered valid unless it has been directly or indirectly signed by a trusted CA. Signed certificates can be used to mount Man in the Middle or Phishing attacks on the target or the target’s network. To extract the certificate, form a compromised machine use this module. <o:p usemodule credentials/mimikatz/certs<o:pexecute <o:p<o:p https://1.bp.blogspot.com/-n1LB3RB-rhM/YGyxsiO80tI/AAAAAAAAvQ8/nS2uGms2r4MHoRp0e9XtYV2SPhwVvnTCgCLcBGAsYHQ/s16000/8.png <v:shape<v:imagedata<o:p

The list goes on as on a rough estimate any system that is under the use might contain a short of 400 certificates and this number increases based on the user activity on the system. The details extracted by Mimikatz is of subsequent value. <o:p https://1.bp.blogspot.com/-ETsLw49nD98/YGyxy0lkpMI/AAAAAAAAvRA/IpcKor7RPvUY6cPYHOLPdO0_kEvmBWYYACLcBGAsYHQ/s16000/9.png <v:shape<v:imagedata<[...]

o:p Mimitokens<o:pToken impersonation technique can be used as local administrator to impersonate another user logged on to a system. In case we compromised a local admin on the target machine then we can use it to impersonate another logged on user e.g., domain controller using Mimitokens.<o:p usemodule credentials/mimikatz/Mimitokens<o:pexecute<o:p<o:p https://1.bp.blogspot.com/-oOtMn7eoooY/YGyx7xSFMkI/AAAAAAAAvRI/Gl_HowRAsGUpzpHOQMq8_SszQrtSP4slACLcBGAsYHQ/s16000/10.png <v:shape<v:imagedata<o:p Crypto Keys<o:pThe keys module of the PowerShell Empire works on the back of the crypto module of Mimikatz, It is one of the oldest module that still works in wild. It directs on the CryptoAPI functions of the target. In general sense the usability is like the certutil binary that is present in the Windows Machine by default. It uses the token impersonation to its advantage and then patches the legacy CryptoAPI functions to patch the CNG key isolation service that makes the keys exportable. After that it just exports those keys in a PVK file. <o:p usemodule credentials/mimikatz/keys<o:pexecute<o:p<o:p https://1.bp.blogspot.com/-eUPwbQ2jQ_g/YGyyE6m3PhI/AAAAAAAAvRU/1zEwZBO0uuYTPKbL6xQGGlJK9Nju38ULQCLcBGAsYHQ/s16000/11.png <v:shape<v:imagedata<o:p Purging Tickets<o:pWhile working with the tokens and tickets, there will be a time where the number of tickets would be too large to work with. This scenario will arise sooner or later and that’s when the purge module will help you. It will purge all the tickets in the current session. <o:p https://1.bp.blogspot.com/-KUrctJVz8tE/YGyyKz2ROGI/AAAAAAAAvRY/N9TQ7BpyIhUBmrQKGHW1goklKPEy7GulQCLcBGAsYHQ/s16000/12.png <v:shape<v:imagedata<o:p Logon Passwords<o:pMimikatz has the ability to retrieve clear text password as well as hashes. This is done by exploiting the Local Security Authority Service on the Windows. After a machine is compromised, the attacker can use the PowerShell Empire to load the logon passwords module to extract the clear text passwords. These passwords can be used to create Golden Tickets, Account Take Over or just a preliminary step to another attack. As we can see the image shown that we have successfully extracted the password for Yashika and Aarti Users.<o:p usemodule credentials/mimikatz/logonpasswords<o:pexecute<o:p<o:p https://1.bp.blogspot.com/-INmwoHetD60/YGyyT31A-BI/AAAAAAAAvRg/FK6gSXPjS7kHV-I0v7nal-bjVGOOCavJgCLcBGAsYHQ/s16000/13.png <v:shape<v:imagedata<o:p Learn More: Understanding Guide to Mimikatz<o:pLocal Security Authority (LSA|LSASS.EXE)<o:pLSA and LSASS stands for “Local Security Authority” And “Local Security Authority Subsystem (server) Service”, respectively. The LSA is a protected system process that authenticates and logs users on to the local computer. Domain credentials are used by the operating system and authenticated by the LSA. The LSA can validate user information by checking the SAM database located on the same computer. LSASS manages the local system policy, user authentication, and auditing while handling sensitive security data such as password hashes and Kerberos keys. The password is protected by the operating system. Only code running in-process with the LSA can read and write domain credentials. LSASS can store credentials in multiple forms, including: Reversibly encrypted plaintext, Kerberos tickets (ticket-granting tickets (TGTs), service tickets), NT hash, LAN Manager (LM) hash. <o:p

After compromising the target, we can use the PowerShell Empire to extract the user hashes from the machine with the help of the lsadump module as shown in the image. <o:p usemodule credentials/mimikatz/lsadump<o:pexecute<o:p<o:p https://1.bp.blogspot.com/-VeaYz8EDvyM/YGyyZeltnPI/AAAAAAAAvRo/oKwP41pq3KkYW_zrvBtGJbCtoHPQrt0XQCLcBGAsYHQ/s16000/14.[...]

png <v:shape<v:imagedata<o:p Learn More: Credential Dumping: Local Security Authority (LSA|LSASS.EXE)<o:pSAM<o:pSAM is short for the Security Account Manager which manages all the user accounts and their passwords. It acts as a database. All the passwords are hashed and then stored SAM. It is the responsibility of LSA (Local Security Authority) to verify user login by matching the passwords with the database maintained in SAM. SAM starts running in the background as soon as the Windows boots up. The sam module of the PowerShell Empire can be used to extract the SAM file and the associated password hash. <o:p usemodule credentials/mimikatz/sam<o:pexecute<o:phttps://1.bp.blogspot.com/-Eb9EiBFMGd8/YGyyeL-S3hI/AAAAAAAAvRw/xomrbRfijJc5MHPjT841DSc1CmrpaVxWQCLcBGAsYHQ/s16000/15.png <v:shape<v:imagedata<o:p

After the target is compromised by other methods the attacker can use the PowerShell Empire sam module to target the SAM file and read the password hashes as shown in the image below. <o:p https://1.bp.blogspot.com/-PVmoaul08mc/YGyylIX7n0I/AAAAAAAAvR0/zOMsPMVjmBsjT2_WFJ9PnSrcLuIbrsd-ACLcBGAsYHQ/s16000/16.png <v:shape<v:imagedata<o:p Learn More: Credential Dumping: SAM<o:pConclusion<o:pAfter Credential Dumping Series which contained different tools that can be used against a specific vulnerability it felt like there is a gap for a guide that can help a person who is trying to get the reins of PowerShell Empire and to showcase the ability of Mimikatz to target the wide range of Windows Authentication Systems with compatibility to integrate with different frameworks such as Metasploit, PowerShell Empire, Koadic etc. <o:p

Dark Reading: Attacks/Breaches
Ryuk's Rampage Has Lessons for the Enterprise

The Ryuk ransomware epidemic is no accident. The cybercriminals responsible for its spread have systematically exploited weaknesses in enterprise defenses that must be addressed.

Burpsuite-Copy-As-XMLHttpRequest - Copy As XMLHttpRequest BurpSuite Extension
http://www.kitploit.com/2021/04/burpsuite-copy-as-xmlhttprequest-copy.html

The extension adds a context menu to BurpSuite that allows you to copy multiple requests as Javascript's XmlHttpRequest, which simplifies PoC development when exploiting (https://www.kitploit.com/search/label/Exploiting) XSS.
Installation
download the latest JAR (https://www.kitploit.com/search/label/JAR) from releases or build manually add JAR to burpsuite (https://www.kitploit.com/search/label/Burpsuite) using tabs: "Extender" -> "Extensions" -> "Add"
Usage
select one request from any tab or a few requests in "Proxy" -> "HTTP history" tab invoke context menu and select "Copy as XMLHttpRequest"

Download Burpsuite-Copy-As-Xmlhttprequest (https://github.com/vulnbe/burpsuite-copy-as-xmlhttprequest)

Burpsuite-Copy-As-XMLHttpRequest - Copy As XMLHttpRequest BurpSuite Extension

The extension adds a context menu to BurpSuite that allows you to copy multiple requests as Javascript's XmlHttpRequest, which simplifies PoC development when exploiting XSS.Installation download the latest JAR from releases or build manually add JAR to burpsuite using tabs: "Extender" -> "Extensions" -> "Add" Usage select one request from any tab or a few requests in "Proxy" -> "HTTP history" tab invoke context menu and select "Copy as XMLHttpRequest" Download Burpsuite-Copy-As-Xmlhttprequest
Read more...

Hacking on Medium
Your Source Code might be Git’ing Exposed — Hacking Publicly Exposed Git Repositories

https://cdn-images-1.medium.com/max/750/1*MtN0EF4cstJ60W97omcyEA.png
Git is a Version Control System used to track and monitor modifications made in files/folders during application development. Git works by…

Continue reading on Medium »

Hacking on Medium
Hackeando Wi-Fi en 2021

https://cdn-images-1.medium.com/max/2600/1*TRx3UcmUam1nttlsjc_8mQ.jpeg
Estos días estuve ayudando en una mudanza, por eso no hubo publicación este lunes.

Continue reading on Medium »

Hacking on Medium
Pickle Rick — TryHackMe

https://cdn-images-1.medium.com/max/602/1*mdiCWpqTwsbMGjYFFU7kuw.png
A Rick and Morty CTF. Help turn Rick back into a human!

Continue reading on Medium »

Hacking on Medium
Kode with Klossy and TechTogether Alumni, From Scholar to Hacker

https://cdn-images-1.medium.com/max/2240/1*LXwRDm-zLbSiu7OZv3H64Q.png
Learn more about the participants of Kode with Klossy and TechTogether programs.

Continue reading on TechTogether »

Preventing Dependency Confusion Attacks in Python
https://medium.com/ochrona/preventing-dependency-confusion-attacks-in-python-fa6058ac972f?source=rss------bug_bounty-5

Before we get into how to protect python applications from dependency confusion attacks, we’ll define this new attack vector, give a bit…Continue reading on Ochrona Security » (https://medium.com/ochrona/preventing-dependency-confusion-attacks-in-python-fa6058ac972f?source=rss------bug_bounty-5)

A question and a request to specialists about Architecture, or any suggestions for a beginner :)
https://www.reddit.com/r/redteamsec/comments/mlon9x/a_question_and_a_request_to_specialists_about/

<!-- SC_OFF -->Question and request to specialists I would like to go deeper into AD security. Currently setting up the AD environment on the home lab, is there anyone who did something like that at home in the laboratory and would like to share the architecture they have implemented at home? I miss a bit of an idea, and I must honestly admit that I was inspired by a series of courses from "Red Team Labs: Enterprise Windows Environments", but this is too high a level for me, I like to throw myself into the deep water no less, this is where I learn the best :) <!-- SC_ON --> submitted by /u/r3g3x_abc (https://www.reddit.com/user/r3g3x_abc)
[link] (https://www.reddit.com/r/redteamsec/comments/mlon9x/a_question_and_a_request_to_specialists_about/) [comments] (https://www.reddit.com/r/redteamsec/comments/mlon9x/a_question_and_a_request_to_specialists_about/)