Hacking Articles Tips Tricks Videos Tutorials
468 subscribers
65.8K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
It happens that due to legacy services requirements (https://www.kitploit.com/search/label/Requirements) or just bad security practices password are world-readable in the LDAP database by any user who is able to authenticate.
LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration (https://www.kitploit.com/search/label/Enumeration) and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns: DistinguishedName AttributeName Value Domain Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis (https://www.kitploit.com/search/label/Analysis) is still saved in a file with a timestamp.
Usage Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly. From the project folder: ./run.sh Easy-peasy :) Credits SecureAuthCorp: For the work on Impacket (https://github.com/SecureAuthCorp/impacket) project Alberto Solino (@agsolino): For the work on kerberoast (https://www.kitploit.com/search/label/Kerberoast) modules based on the Impacket framework Retrospected (https://github.com/Retrospected): For helping out every Friday with debugging (https://www.kitploit.com/search/label/Debugging) the code and brainstorming on new features

Download LDAP-Password-Hunter (https://github.com/oldboy21/LDAP-Password-Hunter)
LDAP-Password-Hunter - Password Hunter In The LDAP Infamous Database

It happens that due to legacy services requirements or just bad security practices password are world-readable in the LDAP database by any user who is able to authenticate. LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns: DistinguishedName AttributeName Value Domain Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis is still saved in a file with a timestamp. Usage Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly. From the project folder: ./run.sh Easy-peasy :) Credits SecureAuthCorp: For the work on Impacket project Alberto Solino (@agsolino): For the work on kerberoast modules based on the Impacket framework Retrospected: For helping out every Friday with debugging the code and brainstorming on new features Download LDAP-Password-Hunter
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
LDAP-Password-Hunter - Password Hunter In The LDAP Infamous Database

https://blogger.googleusercontent.com/img/a/AVvXsEiPhtJldAg8IFVYMqJxD-uIkrJDhA0IoLHUUBtPHQRM99PYWhnALOgqobgLdQ2QguTVdu9bHQaf7sgg4b3rKQ9lNDtITWDja9eMrYwBKygv7Q0R4r4yBC4DZ15E97rVKjrOBX36anXwRaa9luZYBgmMDfk0mRea3wDBQ2bTn3V4tfqROiqNN9bwNeiC=w640-h300
It happens that due to legacy services requirements or just bad security practices password are world-readable in the LDAP database by any user who is able to authenticate.
LDAP Password Hunter is a tool which wraps features of getTGT.py (Impacket) and ldapsearch in order to look up for password stored in LDAP database. Impacket getTGT.py script is used in order to authenticate the domain account used for enumeration and save its TGT kerberos ticket. TGT ticket is then exported in KRB5CCNAME variable which is used by ldapsearch script to authenticate and obtain TGS kerberos tickets for each domain/DC LDAP-Password-Hunter is ran for. Basing on the CN=Schema,CN=Configuration export results a custom list of attributes is built and filtered in order to identify a big query which might contains interesting results. Results are shown and saved in a sqlite3 database. The DB is made of one table containing the following columns:

* DistinguishedName
* AttributeName
* Value
* Domain

Results are way more clean than the previous version and organized in the SQL DB. The output shows the entries found only if they are not in DB, so new entries pop up but the overall outcome of the analysis is still saved in a file with a timestamp.
Usage

Be sure your krb5.conf file is clean and the domains.txt and conf.txt are filled properly.

From the project folder:

./run.sh

Easy-peasy :)

Credits

* SecureAuthCorp: For the work on Impacket project
* Alberto Solino (@agsolino): For the work on kerberoast modules based on the Impacket framework
* Retrospected: For helping out every Friday with debugging the code and brainstorming on new features
Download LDAP-Password-Hunter

___________________________
@hacking_Attack
@Hacking_Video