Hacking Articles|Raj Chandel's Blog
Domain Escalation: Unconstrained Delegation

IntroductionPost Windows 2000, Microsoft introduced an option where users could authenticate to one system via Kerberos and work with another system. This was made possible via delegation option. Unconstrained delegation is achieved via TGT forwarding technique which is what we’ll talk about in this article.Kerberos DelegationKerberos Delegation enables a service to impersonate a computer or user in order to engage with a second service using the user's privileges and permissions.Service Principal NameA unique name (identifier) of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have account name.Unconstrained DelegationThe feature debut initially in Windows Server 2000 but it is still there for backwards compatibility. Basically, if a user requests a service ticket for a service on a server set with unconstrained delegation, that server will extract user’s TGT and cache it in its memory for later use. Which means, server can pretend to be that user to any resource on the domain. Computers -> Trust this computer for delegation to any service.TGT extraction via Unconstrained DelegationIt is obvious that we need to run our attack on the machine that has delegation enabled. So we are assuming the attacker has compromised one such machine. Assumption 1: At[...]

___________________________
@hacking_Attack
@Hacking_Video

tacker compromised DC1$ system running IIS on Kerberos authentication.Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties trustedfordelegation,serviceprincipalname,descriptionhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVnK7rS34mzNVUEiA9a8iFu-AWGIa1769BQ5rhHzo4SP7EbvihjQp8w8dUSECl3vxQYp3YZxsWhPRRj9yQnycufs-Oz0puzoYimptCyRR-tvb4yd2v2vdA4vyK4GEZOTf5BNPMidKow9FWbIIoVooMsbXuYDHAr_psusYrohNuoHGHfzlimbxJvJXKBQ/s16000/1.png The same can also be achieved by using the powerview script which is part of the PowerSploit framework created for offensive security using PowerShell. You can find it here.Import-Module .\powerview.ps1https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6OQ9WL5m9pj7MTD6OV-I3k1JRSPYRi_oNLBHHBTbDLlKs20gkF7ucGDcc2e_P6FlLq1wOxv15MgqpAhkFV5xxV-N0G749iWdV3Tr1Bj77-xfFSUqrb8MKnvOOgO5-4SaLmdAOqmRIHkfeVue6F4_0WKwn1qBFAOaCd-30xxHDJO13r3VepawQDneUAA/s16000/2.png Now, on the target system we need to run Rubeus in monitor mode on the dc1 system. After that, whenever a user connects/authenticates to dc1$ Rubeus will dump TGT of the user.rubeus.exe monitor /monitorinterval:10 /targetuser:dc1$ /nowraphttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiI9fqrYrtznEJtRXkIbdKMbwUatKKh_PeDTxcSpTgotlMeT4oj6ytWQOXV8nxKW9oJLHKNiEEnJML5en_gSdXMREzbULMa19Tz48ZUsq-dalm7uBdDWTX3tGG3iK7OL33qWxnKhcij6u9kUfFtZP6kPRQkrpY5bT6IPk-1UsnY6RtlE-O0C9f62i2AXg/s16000/3.png Now, let’s wait for genuine users to connect to dc1$ running IIS service. For simplicity, let’s do that manually using the IWR module.Invoke-WebRequest http://dc1.offense.local -UseDefaultCredentials -UseBasicParsinghttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp_YUQfI-8qvUbBWr9ife7GS2VzpcXEi97j6Xci64URJ1-nugreRG3ljY8DRP8kwxlCIYfdGz_CEuETmTQL6zqRHRH1LmvI8LpOz-o5gIADMM3VbC3DRD0Pzu6K0tTpgxApaPS_ZV2dsdnI0QoHgB7Oxesv9eMwLdttMpvhLqThgdY072ubnIcITj0Mg/s16000/4.png As you can see, Rubeus has now captured a new ticket granting ticket (TGT) from the user IGNITE\Administrator.ConclusionThe article demonstrated a delegation technique called Unconstrained Delegation because as the name suggests, there are no restrictions upon how the system that has delegation rights use a user’s authentication information. The security loopholes made Microsoft introduce Constrained Delegation. You’ll read more about that in the next article. Hope you liked the article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
$ where backdoor -[heroctf 2022] by sudo_von

https://cdn-images-1.medium.com/max/1117/1*rcr80p5kkEzWXSr8erMiVg.png
Hello, in this challenge we need to find a backdoor so let’s inspect the website.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to stop an IP accessing your website

Hi all,

I wasn't sure where to post this, so if someone could direct me to a more appropriate sub that would be awesome.

Long story short I run a business and have a malicious stalker who is trying to ruin me. Is there a way I can block her IP address from accessing my website? I believe I have her mobile and home IP.

I know it will not stop her using someone else device but it's a start.

submitted by /u/youngmanmyra
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Why Hackers Use Kali Linux?

https://cdn-images-1.medium.com/max/1000/0*JuVWtBWtutySi0wX.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Creating custom wordlists for cracking passwords

https://cdn-images-1.medium.com/max/660/1*RmSGehPf02LHSJmlULW2ng.jpeg
There are multiple tools that are readily available in Kali Linux to create custom a wordlist for cracking passwords offline. We will now…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Basic Ways To Improve SaaS Security

https://cdn-images-1.medium.com/max/600/1*HAXPA1e3NVNrNZ5r6-8lYA.png
1. Use strong passwords and enable two-factor authentication.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Starlabs MkV laptop

Anyone pick up one of these? Thoughts or reviews? Online and YouTube reviews are limited but they seem pretty decent for the price. https://us.starlabs.systems/pages/laptops

submitted by /u/ItsAllPartofTheShow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Offensive Security's Learn Fundamentals subscription - (Complete) beginner friendly?

Hi all,

Noob here. Checking to see if anyone has subscribed to Offensive Security's "Learn Fundamentals" course (https://www.offensive-security.com/fundamentals/), and if so, how beginner friendly it is exactly.

I've heard that it is meant for "brushing up" on fundamental skills needed, but as I don't think I have these skills in the first place (almost a complete beginner in CyberSec) I'm wondering if the cost of a subscription would be better spent elsewhere...

Thanks a lot!

submitted by /u/sk3llo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hall of Fame Vice Media ? hacking while sleepy…
https://medium.com/@b0x_in/hall-of-fame-vice-media-hacking-while-sleepy-3eb931f124e1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello guys, actually this is the case in 2021 but only now had time to write. So… have you ever heard of Vice media? one of the largest…Continue reading on Medium » (https://medium.com/@b0x_in/hall-of-fame-vice-media-hacking-while-sleepy-3eb931f124e1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hall of Fame Vice Media ? hacking while sleepy…

https://cdn-images-1.medium.com/max/600/1*XjUTVqsfCGuDBL157twoog.gif
Hello guys, actually this is the case in 2021 but only now had time to write. So… have you ever heard of Vice media? one of the largest…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video