Hacking Articles Tips Tricks Videos Tutorials
will forge a new certificate for a particular user (here, DC) and then use that certificate to ask for tickets, dump hashes etc. First step is to extract the CA. We can use certsrv.msc run command on the compromised domain admin system. https://blogger.…
his cert.pfx (combo of CA and private key) we will forge a certificate. The tool that we will be using is ForgeCert. This program can be compiled in Visual Studio 2022 just by importing the *.sln file and building the exe. Note that along with the exe, we would need BouncyCastle.dll and some config files. These files will be output in Project folder/bin/debug. Copy these files as it is in the C:\cert folder.
Now, we will forge our new certificate with the following command:
ForgeCert.exe --CaCertPath cert.pfx --CaCertPassword 12345 --Subject CN=User --SubjectAltName DC1@ignite.local --NewCertPath admincert.pfx --NewCertPassword ignite@123
You can keep a complex password here but we are keeping a simple ignite@123
Now, the golden certificate with a validity of 1 year has been saved! This means I have had access to the domain for at least a year now!
https://blogger.googleusercontent.com/img/a/AVvXsEiKQwZ0jo3_ZGdeD4cONugDpYfEjRMWk2Bf6jRwRbKQspMN0taoXtd0Yoh1vgi571lJiNmanPbYVSFBh9alRqaL5BKox2LgyhVP8A8Aep758oKzlg-1fOBN4mR3tVEHm-LHLA9TZqPsDmE41hZql9z2v0XF-RhDyGBAX0zqQwQe6YfLOUjKX4BS4_gdgQ=s16000 Obtaining domain admin’s TGTNow that I have forged my golden certificate, I can perform a number of attacks. We are simulating a scenario where the admin password has changed now. Attacker no longer can access domain admin yet still has a user system with him (windows 10 client here). Also, the attacker still has a golden certificate with him! He can use Rubeus to ask for admin’s TGT like so:
Rubeus.exe asktgt /user:DC1 /certificate:admincert.pfx /password:ignite@123
It gives a *.kirbi ticket which is a base64 encoded format of a TGT.
https://blogger.googleusercontent.com/img/a/AVvXsEhpGMQlU745xFsdlrPANs61xRgi7FPzK73CGKqJv4NIbJMknMjxnHVy2KL3nM__kum4-Gbee8YWQbsfF8z_35HSyvCN4XLIgWujY6U9g61LSxa6JH9zwbDfWG1yTXen37QfOZne13zsPa_AyKoSkFoS1iwQkZ_JuXm6iFPT0LdvPkbrLoRxVlmgzaQkwg=s16000
So, we can convert this TGT into a base64 decoded format using the kali command:
echo "<ticket" | base64 --decode > ticket.kirb
https://blogger.googleusercontent.com/img/a/AVvXsEjKwI3tdnIKbXsrrCzDWk4UYYFFfasMyF-gpSIKKUjXUWW5_ZjUKGK7sIKDG9OFedZtXihJJ1-m_TrsKL6aLsGd1BZX-HdGkuxHQbgVp_BTjNLnK35UM8F7EViMuppBwI1vb3f8q3ba3AahsuYslkhfcKFUO2zAHFDiY-bsAGfhyU5egpStXLeGjtOAPw=s16000 Extracting admin NTLM hashWith this ticket.kirbi, we can do pass the ticket attacks, extract NTLM hashes among other things. Since we don’t know the admin’s new password now, let us try to extract his credentials.
For that we will run mimikatz on the user (windows 10 compromised non-admin system on the AD), import the ticket.kirbi using Kerberos::ptt module and then perform a DCSync attack. Since the ticket is the domain admin’s ticket, we can perform functions that require elevated privileges.
kerberos::ptt ticket.kirbi
lsadump::dcsync /domain:ignite.local /user:administrator
This gives us a fresh set of admin’s NTLM hash
https://blogger.googleusercontent.com/img/a/AVvXsEjVfxxGlYn0_Z3LrOcWyI33tfm1AGEeiUxI0ZuUCi8GOHw-wO3HHxKA3-bin5WG1ZY5nxUuCUTgnGdH7rGG8bXlS8aBOOnw2O55fsUYc3kH1bJ7NQesLJF9XYS1Dli-E0tsiHNQEKLK9CH5GYgMUOMm64G-i6_DtV559CIVZxla3exxaHcpkhMP3Gn86A=s16000 Performing PtH (Pass the Hash) attackWe can further perform Pass the hash attack using these credentials, or crack them using john/hashcat. We head over to our Kali terminal and use pth-winexe binary, which is a part of the pass the hash toolkit by byt3bl33d3r. This comes built-in in new kali os.
pth-winexe -U Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.188 cmd.exe
As you can see we have added 32 bits of 0s before the hash we dumped. As from the release of Windows 10, Microsoft made a change that LM hashes are not used anymore. But the tools that we are going to use in the practical are being used since the old NT and LM times. So, in those tools, we will be using a string of 32 zeros instead of the LM hash.
Also, to be no[...]
Now, we will forge our new certificate with the following command:
ForgeCert.exe --CaCertPath cert.pfx --CaCertPassword 12345 --Subject CN=User --SubjectAltName DC1@ignite.local --NewCertPath admincert.pfx --NewCertPassword ignite@123
You can keep a complex password here but we are keeping a simple ignite@123
Now, the golden certificate with a validity of 1 year has been saved! This means I have had access to the domain for at least a year now!
https://blogger.googleusercontent.com/img/a/AVvXsEiKQwZ0jo3_ZGdeD4cONugDpYfEjRMWk2Bf6jRwRbKQspMN0taoXtd0Yoh1vgi571lJiNmanPbYVSFBh9alRqaL5BKox2LgyhVP8A8Aep758oKzlg-1fOBN4mR3tVEHm-LHLA9TZqPsDmE41hZql9z2v0XF-RhDyGBAX0zqQwQe6YfLOUjKX4BS4_gdgQ=s16000 Obtaining domain admin’s TGTNow that I have forged my golden certificate, I can perform a number of attacks. We are simulating a scenario where the admin password has changed now. Attacker no longer can access domain admin yet still has a user system with him (windows 10 client here). Also, the attacker still has a golden certificate with him! He can use Rubeus to ask for admin’s TGT like so:
Rubeus.exe asktgt /user:DC1 /certificate:admincert.pfx /password:ignite@123
It gives a *.kirbi ticket which is a base64 encoded format of a TGT.
https://blogger.googleusercontent.com/img/a/AVvXsEhpGMQlU745xFsdlrPANs61xRgi7FPzK73CGKqJv4NIbJMknMjxnHVy2KL3nM__kum4-Gbee8YWQbsfF8z_35HSyvCN4XLIgWujY6U9g61LSxa6JH9zwbDfWG1yTXen37QfOZne13zsPa_AyKoSkFoS1iwQkZ_JuXm6iFPT0LdvPkbrLoRxVlmgzaQkwg=s16000
So, we can convert this TGT into a base64 decoded format using the kali command:
echo "<ticket" | base64 --decode > ticket.kirb
https://blogger.googleusercontent.com/img/a/AVvXsEjKwI3tdnIKbXsrrCzDWk4UYYFFfasMyF-gpSIKKUjXUWW5_ZjUKGK7sIKDG9OFedZtXihJJ1-m_TrsKL6aLsGd1BZX-HdGkuxHQbgVp_BTjNLnK35UM8F7EViMuppBwI1vb3f8q3ba3AahsuYslkhfcKFUO2zAHFDiY-bsAGfhyU5egpStXLeGjtOAPw=s16000 Extracting admin NTLM hashWith this ticket.kirbi, we can do pass the ticket attacks, extract NTLM hashes among other things. Since we don’t know the admin’s new password now, let us try to extract his credentials.
For that we will run mimikatz on the user (windows 10 compromised non-admin system on the AD), import the ticket.kirbi using Kerberos::ptt module and then perform a DCSync attack. Since the ticket is the domain admin’s ticket, we can perform functions that require elevated privileges.
kerberos::ptt ticket.kirbi
lsadump::dcsync /domain:ignite.local /user:administrator
This gives us a fresh set of admin’s NTLM hash
https://blogger.googleusercontent.com/img/a/AVvXsEjVfxxGlYn0_Z3LrOcWyI33tfm1AGEeiUxI0ZuUCi8GOHw-wO3HHxKA3-bin5WG1ZY5nxUuCUTgnGdH7rGG8bXlS8aBOOnw2O55fsUYc3kH1bJ7NQesLJF9XYS1Dli-E0tsiHNQEKLK9CH5GYgMUOMm64G-i6_DtV559CIVZxla3exxaHcpkhMP3Gn86A=s16000 Performing PtH (Pass the Hash) attackWe can further perform Pass the hash attack using these credentials, or crack them using john/hashcat. We head over to our Kali terminal and use pth-winexe binary, which is a part of the pass the hash toolkit by byt3bl33d3r. This comes built-in in new kali os.
pth-winexe -U Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.188 cmd.exe
As you can see we have added 32 bits of 0s before the hash we dumped. As from the release of Windows 10, Microsoft made a change that LM hashes are not used anymore. But the tools that we are going to use in the practical are being used since the old NT and LM times. So, in those tools, we will be using a string of 32 zeros instead of the LM hash.
Also, to be no[...]
Hacking Articles Tips Tricks Videos Tutorials
his cert.pfx (combo of CA and private key) we will forge a certificate. The tool that we will be using is ForgeCert. This program can be compiled in Visual Studio 2022 just by importing the *.sln file and building the exe. Note that along with the exe, we…
ted, when we say NTLM in modern times, we mean NTHash. NTLM is a common name that stuck around.
https://blogger.googleusercontent.com/img/a/AVvXsEgZRtq1O93tTfC3pIC42mERPeAxmKA1MrGSPqhu81UF2OPaELM_JBkC8KgoZfRIz0_bgWLII9oARCnDxIVtYCo9dbsEv0VfahS9IMvAWd9wrHkK0EfyhtlRmsH5oZ3PrTsmBVwm6ZNATy7CzB7B3HdyyqZHRhvZFXV6pEl98EOqVIuhM_1pye5fqR-p9Q=s16000
So, as you can see using the golden certificate, we were able to extract admin tickets, dump hashes and perform Pass the hash or pass the ticket attacks. Conclusion95% of the Fortune 500 companies are using Active Directory in one way or the other. Attackers or analysts often conduct pentest on the corporate AD. A golden certificate attack is a domain persistence attack that could allow an attacker up to a year of persistence on a compromised machine even if the admin password gets changed or new admins are added. It is a useful technique with the potential to have various other sub attacks in the future on ADCS. Hope you enjoyed the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Domain Persistence: Golden Certificate Attack appeared first on Hacking Articles.
➖ Sent by @TheFeedReaderBot ➖
https://blogger.googleusercontent.com/img/a/AVvXsEgZRtq1O93tTfC3pIC42mERPeAxmKA1MrGSPqhu81UF2OPaELM_JBkC8KgoZfRIz0_bgWLII9oARCnDxIVtYCo9dbsEv0VfahS9IMvAWd9wrHkK0EfyhtlRmsH5oZ3PrTsmBVwm6ZNATy7CzB7B3HdyyqZHRhvZFXV6pEl98EOqVIuhM_1pye5fqR-p9Q=s16000
So, as you can see using the golden certificate, we were able to extract admin tickets, dump hashes and perform Pass the hash or pass the ticket attacks. Conclusion95% of the Fortune 500 companies are using Active Directory in one way or the other. Attackers or analysts often conduct pentest on the corporate AD. A golden certificate attack is a domain persistence attack that could allow an attacker up to a year of persistence on a compromised machine even if the admin password gets changed or new admins are added. It is a useful technique with the potential to have various other sub attacks in the future on ADCS. Hope you enjoyed the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Domain Persistence: Golden Certificate Attack appeared first on Hacking Articles.
➖ Sent by @TheFeedReaderBot ➖
CommentDump - Browser extension for auditing comments in source code
https://www.reddit.com/r/Pentesting/comments/se7ser/commentdump_browser_extension_for_auditing/
<!-- SC_OFF -->https://github.com/PN-Tester/commentDump
Hey everyone, I recently created this extension which essentially extracts and dumps all the comments from the web page you are currently viewing. It extracts comments in all forms (inline, multi-line, etc.) from the current page source AND all loaded resource files. It'll highlight "interesting" keywords based on a built-in list (stuff like administrator, password, debug, etc.) but you can also customize this by supplying your own comma-separated list of keywords to the extension popup.
Its nothing fancy, but personally I've found it useful in numerous engagements. It can help you rapidly assess the verbosity and style of comments in a web application. It can quickly uncover interesting or deprecated functionality, references to internal resources, credentials, etc. Its a lot more efficient for the analyst to view these in the presented list form, versus manually scouring the application sources for comments. Hope this is useful to some! Cheers <!-- SC_ON --> submitted by /u/PN-tester (https://www.reddit.com/user/PN-tester)
[link] (https://www.reddit.com/r/Pentesting/comments/se7ser/commentdump_browser_extension_for_auditing/) [comments] (https://www.reddit.com/r/Pentesting/comments/se7ser/commentdump_browser_extension_for_auditing/)
https://www.reddit.com/r/Pentesting/comments/se7ser/commentdump_browser_extension_for_auditing/
<!-- SC_OFF -->https://github.com/PN-Tester/commentDump
Hey everyone, I recently created this extension which essentially extracts and dumps all the comments from the web page you are currently viewing. It extracts comments in all forms (inline, multi-line, etc.) from the current page source AND all loaded resource files. It'll highlight "interesting" keywords based on a built-in list (stuff like administrator, password, debug, etc.) but you can also customize this by supplying your own comma-separated list of keywords to the extension popup.
Its nothing fancy, but personally I've found it useful in numerous engagements. It can help you rapidly assess the verbosity and style of comments in a web application. It can quickly uncover interesting or deprecated functionality, references to internal resources, credentials, etc. Its a lot more efficient for the analyst to view these in the presented list form, versus manually scouring the application sources for comments. Hope this is useful to some! Cheers <!-- SC_ON --> submitted by /u/PN-tester (https://www.reddit.com/user/PN-tester)
[link] (https://www.reddit.com/r/Pentesting/comments/se7ser/commentdump_browser_extension_for_auditing/) [comments] (https://www.reddit.com/r/Pentesting/comments/se7ser/commentdump_browser_extension_for_auditing/)
StellarParticle Campaign: Novel Tactics and Techniques | CrowdStrike
https://www.reddit.com/r/redteamsec/comments/se706r/stellarparticle_campaign_novel_tactics_and/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/) [comments] (https://www.reddit.com/r/redteamsec/comments/se706r/stellarparticle_campaign_novel_tactics_and/)
https://www.reddit.com/r/redteamsec/comments/se706r/stellarparticle_campaign_novel_tactics_and/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/) [comments] (https://www.reddit.com/r/redteamsec/comments/se706r/stellarparticle_campaign_novel_tactics_and/)
hacking: security in practice
Docker, Containers and CTFs
I've been looking to go beyond the challenges on THM and have found a lot of the CTFs appear to be using docker/containerization. I download the files and have no idea what i'm even looking at.
Anybody have any great resources to start with?
submitted by /u/ShadowFox1987
[link] [comments]
Docker, Containers and CTFs
I've been looking to go beyond the challenges on THM and have found a lot of the CTFs appear to be using docker/containerization. I download the files and have no idea what i'm even looking at.
Anybody have any great resources to start with?
submitted by /u/ShadowFox1987
[link] [comments]
reddit
Docker, Containers and CTFs
I've been looking to go beyond the challenges on THM and have found a lot of the CTFs appear to be using docker/containerization. I download the...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
If you have installed any of the 470 infected apps, then you are one of the 105 million victims of Dark Herring android malware globally
https://external-preview.redd.it/RBluzylYW9n-hQ07kXIzdBAvlZa2EiaKQdv9DUWEJAg.jpg?width=640&crop=smart&auto=webp&s=7755bce837a68a175ccfad0f1fbce059a09d57fd submitted by /u/vishalthevaxus
[link] [comments]
If you have installed any of the 470 infected apps, then you are one of the 105 million victims of Dark Herring android malware globally
https://external-preview.redd.it/RBluzylYW9n-hQ07kXIzdBAvlZa2EiaKQdv9DUWEJAg.jpg?width=640&crop=smart&auto=webp&s=7755bce837a68a175ccfad0f1fbce059a09d57fd submitted by /u/vishalthevaxus
[link] [comments]
open sourced website vulnrability scanner?
https://www.reddit.com/r/Pentesting/comments/sear2j/open_sourced_website_vulnrability_scanner/
<!-- SC_OFF -->looking to buy someones privacy-forward image host, but I wanted to check the domain for vulnrabilities/backdoors before making an offer, so i know how much work has to be done. anyone know of any scanners? <!-- SC_ON --> submitted by /u/Glittering-Fall3956 (https://www.reddit.com/user/Glittering-Fall3956)
[link] (https://www.reddit.com/r/Pentesting/comments/sear2j/open_sourced_website_vulnrability_scanner/) [comments] (https://www.reddit.com/r/Pentesting/comments/sear2j/open_sourced_website_vulnrability_scanner/)
https://www.reddit.com/r/Pentesting/comments/sear2j/open_sourced_website_vulnrability_scanner/
<!-- SC_OFF -->looking to buy someones privacy-forward image host, but I wanted to check the domain for vulnrabilities/backdoors before making an offer, so i know how much work has to be done. anyone know of any scanners? <!-- SC_ON --> submitted by /u/Glittering-Fall3956 (https://www.reddit.com/user/Glittering-Fall3956)
[link] (https://www.reddit.com/r/Pentesting/comments/sear2j/open_sourced_website_vulnrability_scanner/) [comments] (https://www.reddit.com/r/Pentesting/comments/sear2j/open_sourced_website_vulnrability_scanner/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
GRABIFY IP LOGGER Create or Track URLs
https://cdn-images-1.medium.com/max/1358/1*AuWr1ZkgDb23Wb3EA_ddPA.png
Grabify IP logger will help you find and track the IP address of any person with just three simple steps:
Continue reading on Medium »
GRABIFY IP LOGGER Create or Track URLs
https://cdn-images-1.medium.com/max/1358/1*AuWr1ZkgDb23Wb3EA_ddPA.png
Grabify IP logger will help you find and track the IP address of any person with just three simple steps:
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacked &Hustled: Facebook and the Coordinated Con
https://cdn-images-1.medium.com/max/1283/1*6bTKd38QxgVqbA7ypFUn7g.png
January 3, the first Monday of the new year. I am packing for a storytelling event in Minnesota. It’s going to be a great year, I know it.
Continue reading on Medium »
Hacked &Hustled: Facebook and the Coordinated Con
https://cdn-images-1.medium.com/max/1283/1*6bTKd38QxgVqbA7ypFUn7g.png
January 3, the first Monday of the new year. I am packing for a storytelling event in Minnesota. It’s going to be a great year, I know it.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacked &Hustled: Facebook and the Coordinated Con
https://cdn-images-1.medium.com/max/1273/1*spW_nuQ6dOZiktg4L8OE-g.png
January 3, the first Monday of the new year. I am packing for a storytelling event in Minnesota. It’s going to be a great year, I know it.
Continue reading on Medium »
Hacked &Hustled: Facebook and the Coordinated Con
https://cdn-images-1.medium.com/max/1273/1*spW_nuQ6dOZiktg4L8OE-g.png
January 3, the first Monday of the new year. I am packing for a storytelling event in Minnesota. It’s going to be a great year, I know it.
Continue reading on Medium »