Hacking on Medium
Тайминг-атака. Как спецслужбы деанонимизируют пользователей мессенджеров.

https://cdn-images-1.medium.com/max/1280/1*TRteTHsbwTAMiMPe7c4TEw.jpeg
Представьте себе ситуацию: вы сотрудник спецслужбы, и ваша задача — вычислить особо опасного преступника, занимающегося шантажом и…

Continue reading on Medium »

Hacking on Medium
CEHv10 Module 01 道德駭客導論

Introduction to Ethical Hacking

Continue reading on 網路攻防技術 »

Hacking on Medium
Hack the Box — Archetype

https://cdn-images-1.medium.com/max/600/1*QvWsrhhyg5ehbDxTuUd-2w.png
In order to learn something, you have to be able to teach it. First in a series about the Starting Point Machines — Archetype is up First.

Continue reading on Medium »

Hacking Articles
Active Directory Enumeration: PowerView

Active Directory Enumeration is a challenge for even some of the seasoned attackers and it is easy to miss some key components and lose the change to elevate that initial foothold that you might receive. In this article, we bring you methods that you can use to enumerate AD using

The post Active Directory Enumeration: PowerView appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Active Directory Enumeration: PoweView

Active Directory Enumeration is a challenge for even some of the seasoned attackers and it is easy to miss some key components and lose the change to elevate that initial foothold that you might receive. In this article, we bring you methods that you can use to enumerate AD using PowerShell.

Table of Contents· Introduction· Get-NetUser· Get-UserProperty· Find-UserField· Invoke-UserHunter· Get-NetDomain· Get-NetDomainController· Get-NetComputer· Get-UserProperty· Get-NetForest· Get-NetForestCatalog· Get-NetForestDomain· Get-NetLoggedon· Get-DomainPolicy· Get-NetOU· Get-NetGroup· Get-NetGroupMember· Get-NetGPO· Find-GPOLocation· Invoke-EnumerateLocalAdmin · Get-NetProcess· Invoke-ShareFinder· Invoke-FileFinder· Invoke-ACLScanner· Find-LocalAdminAccess· Get-NetSession· ConclusionWe have configured an Active Directory Lab that mimics a Real-Life Environment with a bunch of Users, Machines, and Vulnerabilities. In this Article/Demonstration, we are focused on our ability to Enumerate Information that can be then further be used to elevate privileges or be able to help with Lateral Movement. A tool by the name of PowerView was developed and integrated by Will Schroeder (a.k.a harmj0y). It soon became an integral toolkit to perform Active Directory Attacks and Enumeration. For this demonstration, we will assume that we have gained the initial foothold. Now we will use PowerShell with PowerView to enumerate the machine and the Domain. In case you run into difficulties running any of the commands depicted use the Official GitHubfor the Installation Process.Get-NetUserIn our Active Directory Lab Setup, we created 7 users with different roles and privileges. We can confirm this by Viewing the Active Directory Users and Computers as shown in the image. https://1.bp.blogspot.com/-EnjZLVu70tk/YIcGMyxsEcI/AAAAAAAAvdQ/QKI5Xe47R3AUNF9SzlFbP1R83hYUjkNYACLcBGAsYHQ/s16000/1.png Get-NetUserhttps://1.bp.blogspot.com/-DAGtd_BMjLs/YIcGSXZGE7I/AAAAAAAAvdU/3OEPiY-ws1ozJOX0m-W3TIg6ofZ4Q-_6wCLcBGAsYHQ/s16000/2.png ___________________________
@hacking_Attack
@Hacking_Video

trying to learn about the User Behavior.Get-NetUser | select cnhttps://1.bp.blogspot.com/-JCIgqSCAT0k/YIcGbSYDFlI/AAAAAAAAvdc/BbbsrkUqDhQptvBmTG8kH9FYdUOuRuBSwCLcBGAsYHQ/s16000/4.png Get-NetUser -UserName Yashika https://1.bp.blogspot.com/-zf8KTrq1qiE/YIcGgDVSQeI/AAAAAAAAvdg/XPu6Jvj9sMMhYX6bZ4OT-bKzb4URESz8wCLcBGAsYHQ/s16000/5.png Get-UserPropertyWhen working with the Users and their properties, we see that there is a variable by the name pwdlastset. We can use this to check which user is reluctant to change their passwords. This can be configured to any of the property that was extracted in the previous. For this demonstration, we will be extracting the password last set property of all the users.Get-UserProperty -Properties pwdlastsethttps://1.bp.blogspot.com/--QwOofgRMds/YIcGnhyhL0I/AAAAAAAAvds/L5732d-iMUE5nvOve_iKlB845KAARkDSwCLcBGAsYHQ/s16000/6.png Find-UserFieldThere are times where there are so many users in the network that it becomes very difficult for the Domain Administrator to keep track of all users or their credentials. This is where they resort to some of the risky techniques to save the credentials information. A good example that I have seen more than ever in the real environment is saving the credentials or important information about the user in their description. This can be extracted by the use of Find-UserField with a search term. In this demonstration, we used the term pass to search for potential passwords. The user Yashika has their password written and saved in their description. This is not limited to this type of information. Lots of different data can also be extracted by using the right set of keywords such as built. This will extract the attacker from the accounts that are Built-in Accounts. Find-UserField -SearchField Description -SearchTerm “pass”https://1.bp.blogspot.com/-ikmM0Uoe5b4/YIcGsHgWQaI/AAAAAAAAvd0/E0Kcn9rosMcHbVimuNA4PHP3g3xjlsWLgCLcBGAsYHQ/s16000/7.png ___________________________
@hacking_Attack
@Hacking_Video

6U9PZWdrp3zs4fwCLcBGAsYHQ/s16000/8.png Invoke-UserHunterWhile enumerating the Domain, the attacker that has a targeted approach will be able to extract more data and that faster. The setup at home servers that we practice on doesn’t have a time constrain that attackers have to adhere to. In real-life red teaming assessments, if the attacker is taking their sweet time to extract data, they pose a risk to be detected and get thrown out of their initial access or even get captured. This is where some Reconnaissance comes in handy. During the Recon, the attacker can have a list of specific users that take priority to enumerate first and it is possible that those users will help the attacker to elevate access and they won’t need to enumerate other users. This reduces the time as well as the noise and logs that will be created when the attacker enumerates users. This is solved using the Invoke-UserHunter. It helps the attacker search or as its name suggests "hunt" for those specific users. It will accept usernames and if the attacker has a handy list of usernames, it will graciously accept it as well. It accepts the domain group and host lists as well. It uses a mix of Get-NetSessions and Get-NetLoggedon against every server and then compares the result against the target user set. Then again it raises the question of the amount of noise it will generate. But giving it a smaller number of usernames in the list or even giving it a single username will help the attacker reduce the noise significantly. It is worth noting that Invoke-UserHunter will run without any Administrator Privileges. Moving to the demonstration, the attacker runs the Invoke-UserHunter directly without any users or options. It will run against all users that it could find that usually is the Administrator. It can be observed that the information extracted is pretty basic but useful in the case of profiling a user. Invoke-UserHunterhttps://1.bp.blogspot.com/-X_WD9r7ww3g/YIcG1LiAN2I/AAAAAAAAveA/dZvNWw7dBs8EzuLpjLbPMNabqFrDSp1FgCLcBGAsYHQ/s16000/9.png Invoke-UserHunter -CheckAccesshttps://1.bp.blogspot.com/-tjZ6LtjVUKo/YIcG5JkZRfI/AAAAAAAAveI/UHxbqCysr7MND1NeLUMesviStF8rVY2dACLcBGAsYHQ/s16000/10.png Get-NetDomainWhen the attacker needs to extract the domain-related information directly from the target server, Get-NetDomain got them covered. It pretty much extracts the Domain data that includes the Forest Name, Domain Controllers with Children (that might be configured in a real environment server). Then there is the Name of the Parents with the RidRoleOwner which is a DC Object that holds the relative identifier (RID) master role and PdcRoleOwner another DC Object that holds the PDC emulator role for that specific Domain.Get-NetDomainhttps://1.bp.blogspot.com/-l5bcHj66ORQ/YIcHOHK-BpI/AAAAAAAAveY/9VOsUhp01nk5a4iTRbqqJF1XV0KF6gmEQCLcBGAsYHQ/s16000/11.png Get-NetDomain -domain “ignite.local”https://1.bp.blogspot.com/-V8JUnErR59c/YIcHXgkU6NI/AAAAAAAAvec/XurS8jIn0vErwjdBFIBg9s_0oU81BF-3QCLcBGAsYHQ/s16000/12.png Get-NetDomainControllerNext on the lineup, we have the Get-NetDomainCo[...]

___________________________
@hacking_Attack
@Hacking_Video

ntroller. This provides the information of the particular server device instead of the domain. When an attacker wants to extract the data about the Domain Controller Machine then this tool can be used. It extracts the Forest Information, with the Time and Date configured on the Server. IT tells the OS Version that can help constraint the search for Kernel Exploits for the attacker. Then the attacker has the IP Addressing data with the Inbound and Outbound connections. Get-NetDomainControllerhttps://1.bp.blogspot.com/-a2ngOXo9-sY/YIcHeW6u24I/AAAAAAAAveg/kgp2HmTOaCQC5BbwYjwfYrfGCd9bWWaHQCLcBGAsYHQ/s16000/13.png Get-NetDomainController -Domain ignite.localhttps://1.bp.blogspot.com/-8my3SHBPEl8/YIcHmpuu3EI/AAAAAAAAvek/2OjOLouEbxA-1XBHamBgXuzaQxZIR0mQwCLcBGAsYHQ/s16000/14.png Get-NetComputerWhat seems to be a pretty simple option can turn out to be one of the most used tools to extract a huge amount of data from either the Domain Controller or even a single device. If the attacker runs the Get-NetComputer directly on the Domain Controller machine as demonstrated, it will reveal the Computer Names of all the devices connected in the Domain.Get-NetComputerhttps://1.bp.blogspot.com/-DLLT32PPQ3I/YIcHrwesoVI/AAAAAAAAveo/UQGWndsAzn8jpJ9fuw-ioYOS9kyZpA3kACLcBGAsYHQ/s16000/15.png Get-NetComputer -Pinghttps://1.bp.blogspot.com/-Qpv6AK87VuI/YIcHyO8lNmI/AAAAAAAAvew/bANRnO8svQwZvItvtfAxB8ElBhYOBzKtQCLcBGAsYHQ/s16000/16.png Get-NetComputer -FullDatahttps://1.bp.blogspot.com/-4kU7S2QsCos/YIcH6MsXYNI/AAAAAAAAve4/nf-1ddcYM8wxSdrp73bNZmOsGe89HTuxgCLcBGAsYHQ/s16000/17.png Get-NetComputer -Operatingsystem “Windows Server 2016 Standard Evaluation”https://1.bp.blogspot.com/-fXLD-TZCF1U/YIcIAadnuqI/AAAAAAAAvfA/j8v55X3JcJopjpYQJNMChU0dhSrxMXADwCLcBGAsYHQ/s16000/18.png Get-UserPropertyNext on the list is the UserProperty. Up until now, the attacker can extract the users and very little information about them. This was limited but this problem is solved using UserProperty. With it, the attacker can aim to those niche details about any particular property. Some of the information extractable is check for Administrator Level Access, Password Time, Password Change Date, Description of the User, check what group the different users are a part of, and much more. Get-UserPropertyhttps://1.bp.blogspot.com/-1ypfKKzAio8/YIcIGdhD92I/AAAAAAAAvfI/FhEGNOSzbYUghXrnuEWm9jj6_7zrxKZJgCLcBGAsYHQ/s16000/19.png ___________________________
@hacking_Attack
@Hacking_Video

ty they want to inquire about. For the demonstration, the property that was inquired here was badpwdcount. This tells the attacker about the unsuccessful attempts that were made against all the users. Get-UserProperty -Properties badpwdcounthttps://1.bp.blogspot.com/-GKkf97jvrIg/YIcIMoEqLhI/AAAAAAAAvfQ/-oCA7Ouj1rkbePIT8dwn8QC6EqvIhKTOwCLcBGAsYHQ/s16000/20.png Get-UserProperty -Properties logoncounthttps://1.bp.blogspot.com/-wwOMmf18WzM/YIcIRvXKWQI/AAAAAAAAvfU/yHbC26L6DfIG0t10cGAmLjVfeyXsYADWACLcBGAsYHQ/s16000/21.png Get-NetForestApart from the domain information and the user information, the attacker can also gain information about the forests and there can be multiple forests inside a domain. To procure information about the forest in the current user’s domain is to use Get-NetForest.Get-NetForesthttps://1.bp.blogspot.com/-i9zQuycM2fM/YIcIXX1VgbI/AAAAAAAAvfc/nlRrvk5pIWoIrA9KlyyhhCFsstsInK8cACLcBGAsYHQ/s16000/22.png Get-NetForestCatalogForests typically have different global catalogs that can help the attacker to get some precarious information about the domain. This can be observed from the following demonstration of extracting all the global catalogs of the current forest using the Get-NetForestCatalog.Get-NetForestCataloghttps://1.bp.blogspot.com/-YuMhtfKcWuU/YIcIcvft0aI/AAAAAAAAvfk/bxjpRk30UzUhdI-2FhAgJv8efWsBZqp2wCLcBGAsYHQ/s16000/23.png Get-NetForestDomainMoving on from the catalogs, the attacker can also work on extracting the various domains of the forest the current user is located in. This can be done by running Get-NetForestDomain as shown in the demonstration. Get-NetForestDomainhttps://1.bp.blogspot.com/-tt9DV_u74k0/YIcIiPHldOI/AAAAAAAAvfs/qD8GZuU6mOA9MRUOjWTPS3UZ5MLQ6CtTwCLcBGAsYHQ/s16000/24.png Get-NetLoggedonThat’s enough Forest, getting back to the users on the local or remote machine the attacker can take advantage of the NetLoggedon module. It should be noted that Administrative Rights are required to use this module. This module executes NetWkstaUserEnum Win32API call to extract the users that are currently logged on. If the attacker is in a bit of a hurry, they can enumerate all the uses that are logged on for all the machines in the domain by using the Get-DomainComputer and then running the Get-NetLoggedon on that data. This can be concatenated using a pipe. Get-DomainComputer | Get-NetLoggedonIn this demonstration, however, it is shown how to enumerate users that are loggedon on a particular machine with the help of the ComputerName option and providing the Name. Get-NetLoggedon -ComputerName DC1 Get-DomainPolicyAmongst other information, the Domain Policy of a Domain can also reveal some pretty good information. The attacker can use the Get-Domain to extract the policy of the current domain. It reads the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller. To get more focus[...]

___________________________
@hacking_Attack
@Hacking_Video

ed on a particular domain the Domain option. To extract Domain or Domain Controller using the Source Option or Server option to bind to a particular Active Directory server.Get-DomainPolicyhttps://1.bp.blogspot.com/-Ung9oS3Mr9U/YIcIzJEFEZI/AAAAAAAAvgA/o-zr9noS7A80hXviPcjpW7Z_cvtW52ZjACLcBGAsYHQ/s16000/26.png (Get-DomainPolicy).”KerberosPolicy”https://1.bp.blogspot.com/-nXhVSqBc2PU/YIcJQcDDk4I/AAAAAAAAvgM/nQjHHqSdJXkLwBHDacNrxJPkWIgxUs35wCLcBGAsYHQ/s16000/27.png (Get-DomainPolicy).”SystemAccess”https://1.bp.blogspot.com/-We8caCMGi2c/YIcJYaW3YGI/AAAAAAAAvgQ/WlKY59wlfNs4GmppBmuURI9WcptX8gUMQCLcBGAsYHQ/s16000/28.png Get-NetOUOUs are the smallest unit in the Active Directory system. OU is abbreviated from is Organizational Unit. OUs are containers for users, groups, and computers, and they exist within a domain. OUs are useful when an administrator wants to deploy Group Policy settings to a subset of users, groups, and computers within your domain. OUs also allows Administrators to delegate admin tasks to users/groups without having to make him/her an administrator of the directory.Get-NetOUhttps://1.bp.blogspot.com/-02X7LgksgnY/YIcJjlXt31I/AAAAAAAAvgY/rToMMFX7fTgPtte36l7clZK3bxOndItOQCLcBGAsYHQ/s16000/29.png Get-NetGroupDuring enumeration that the attacker is trying to perform extracting the Group, information is one of the most important that the attacker can enumerate. To get all the groups in the current domain, the attacker can use the Get-NetGroup as demonstrated. Get-NetGrouphttps://1.bp.blogspot.com/-_5r_Q6FxmCE/YIcJy4YalpI/AAAAAAAAvgg/hsMXpSTZ5A48ztgBzEbSxNIqvmi_Zm09QCLcBGAsYHQ/s16000/30.png Get-NetGroup *admin*https://1.bp.blogspot.com/-VSsN9aC1QuU/YIcJ37RBXYI/AAAAAAAAvgo/bmbXtJCNYtA_ApusVeTNzEGhxhf7hT5vQCLcBGAsYHQ/s16000/31.png Get-NetGroup -UserName yashikahttps://1.bp.blogspot.com/-ZaWuOUpa5WY/YIcKCIYEbXI/AAAAAAAAvgw/anhaVcLYrYoq1H8g8EIjPHH9TtB8b6aswCLcBGAsYHQ/s16000/32.png Get-NetGroup -Domain ignite.localhttps://1.bp.blogspot.com/-aa8-5VzrDtw/YIcKJEHVePI/AAAAAAAAvg0/L6mNdy5G0rQ-Aqy_npOtgYJdaek80S5zwCLcBGAsYHQ/s16000/33.png ___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Active Directory Enumeration: PoweView

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
IMSI catcher and tor

Can any hackers or police see what I'm doing on tor or i2p with an IMSI catcher?

submitted by /u/wagonaway7
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video