Black Hat Ethical Hacking
Offensive Security Tool: linWinPwn

Offensive Security Tool: linWinPwnPost Views: 34 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes linWinPwnlinWinPwn is a bash script written by lefayjey that automates several Active Directory Enumeration and Vulnerability checks. The script uses several tools such as: impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump, certipy, and others. Red Teams find this tool particularly useful when you have access to an Active Directory environment for a limited time only and wish to automate the enumeration process and efficiently collect evidence. In addition, linWinPwn can replace the use of enumeration tools on Windows to reduce the number of created artifacts and bypass certain Anti-Virus or EDRs. This can be achieved by performing remote dynamic port forwarding through the creation of an SSH tunnel from the Windows host (e.g., VDI machine or workstation or laptop) to a remote Linux machine (e.g., Pentest laptop or VPS), and running linWinPwn with proxychains.

On the Windows host, run using PowerShell: ssh kali@<linux_machine -R 1080 -NCqfhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/SS1.png proxychains ./linWinPwn.sh -t <domain_controller_ipSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course SetupGit clone the repository and make the script executable git clone https://github.com/lefayjey/linWinPwncd linWinPwn; chmod +x linWinPwn.shInstall requirements on Kali machines using the install.sh script chmod +x install.shsudo ./install.shOn non-Kali machines, run the install_nonkali.sh script instead chmod +x install_nonkali.shsudo ./install_nonkali.shIf you’re having DNS issues or time sync errors, run the configure.sh script with -d for DNS update and -n for NTP sync

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/SS2.png chmod +x configure.shsudo ./configure.sh -t -d -nTrending: Offensive Security Tool: Mangle
Trending: Recon Tool: Maigret UsageModulesThe linWinPwn script contains 6 modules that can be used either separately or simultaneously.

Default: interactive – Open interactive menu to run checks separately
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>]
User modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum

./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M user

All modules: ad_enum,kerberos,scan_shares,vuln_checks,mssql_enum,pwd_dump
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M all

Module ad_enum: Active Directory Enumeration
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M ad_enum

Module kerberos: Kerberos Based Attacks
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M kerberos

Module scan_shares: Network Shares Scan
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M scan_shares

Module vuln_checks: Vulnerability Checks
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o o[...]

utput_dir>] -M vuln_checks

Module mssql_enum: MSSQL Enumeration
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M mssql_enum

Module pwd_dump: Password Dump
./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M pwd_dump
Trending: Exploit XSS Injections in a one-line powerful Technique Demos* HackTheBox Forest

Interactive Mode: Automated Mode: * TryHackme AttacktiveDirectory Use casesFor each of the cases described, the linWinPwn script performs different checks as shown below.

Case 1: Unauthenticated

* Module ad_enum
* rid bruteforce
* user enumeration
* ldapdomaindump anonymous enumeration
* Check if ldap-signing is enforced, check for LDAP Relay

* Module kerberos
* kerbrute user spray
* ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Blind Kerberoast
* CVE-2022-33679 exploit

* Module scan_shares
* SMB shares anonymous enumeration on identified servers

* Module vuln_checks
* Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on identified servers
* Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses ./linWinPwn.sh -t Case 2: Standard Account (using password, NTLM hash or Kerberos ticket)

* DNS extraction using adidnsdump
* Module ad_enum
* BloodHound data collection
* ldapdomaindump enumeration
* crackmapexec user=pass enumeration
* Delegation information extraction
* GPP Passwords extraction
* Extract ADCS information using certipy
* Check if ldap-signing is enforced, check for LDAP Relay
* Extraction of MachineAccountQuota of user, Password Policy and users’ descriptions containing “pass”

* Module kerberos
* kerbrute user=pass enumeration
* ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
* Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)

* Module scan_shares
* SMB shares enumeration on all domain servers
* KeePass files and processes discovery on all domain servers

* Module vuln_checks
* Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on all domain servers
* Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses

* Module mssql_enum
* Check mssql privilege escalation paths
./linWinPwn.sh -t Domain_Controller_IP_or_Target_Domain> -d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -M user
Case 3: Administrator Account (using password, NTLM hash or Kerberos ticket)

* All of the “Standard User” checks
* Module pwd_dump
* LAPS and gMSA dump
* secretsdump on all domain servers
* Dump lsass on all domain servers using: procdump, lsassy, nanodump, handlekatz, masky
* Extract backup keys using DonPAPI
./linWinPwn.sh -t Domain_Controller_IP_or_Target_Domain> -d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -M all Disclaimer: Usage of linWinPwn for attacking targets without prior mutual consent is illegal. It’s the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.
Clone the repo from here: GitHub Link
See Also: Hacking Stories: Albert Gonzalez and the ‘Get Rich or Die Trying’ Crew who stole 130 million credit card numbers https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Merlin-300x150.png Offensive Security Tool: MerlinNovember 24, 2022
Reading Time: 3 minutes

* https://www.blackh[...]

___________________________
@hacking_Attack
@Hacking_Video

atethicalhacking.com/wp-content/uploads/2022/11/maigret-300x150.png Recon Tool: MaigretNovember 18, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/SecretScanner-300x150.png Recon Tool: SecretScannerNovember 17, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Mangle-300x150.png Offensive Security Tool: MangleNovember 11, 2022
Reading Time: 4 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Offensive Security Tool: linWinPwn first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Bug Zero at a Glance [Week 19–25 November]

What happened with Bug Zero?Continue reading on Bug Zero »
Read more...

Bug Zero at a Glance [Week 19–25 November]
https://blog.bugzero.io/bug-zero-at-a-glance-week-19-25-november-e9d58c79391b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What happened with Bug Zero?Continue reading on Bug Zero » (https://blog.bugzero.io/bug-zero-at-a-glance-week-19-25-november-e9d58c79391b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
SharpSCCM - A C# Utility For Interacting With SCCM

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6ZAdfuaPhsN8-Kjti8hbHR8EUdvBLdswDeoEUlXN9lj2_ugapQxtx0ypnqqNIX5uPuXyOZbuY8eajHXuwp1E6bqHZmdml3QhPbVll-_Gu4APgiFi1utmsv8NtTfuF7Lr3mLsD1C9MmPh9HKIdgHFLu8_n27MfNDiQ-wbnXIpejMvm_K4HCdmpQkFeoQ/w640-h432/h121.png
SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr, formerly SCCM) for lateral movement and credential gathering without requiring access to the SCCM administration console GUI.

SharpSCCM was initially created to execute user hunting and lateral movement functions ported from PowerSCCM (by @harmj0y, @jaredcatkinson, @enigma0x3, and @mattifestation) and now contains additional functionality to gather credentials and abuse newly discovered attack primitives for coercing NTLM authentication in SCCM sites where automatic site-wide client push installation is enabled.

Please visit the wiki for documentation detailing how to build and use SharpSCCM.
Author

Chris Thompson is the primary author of this project. Duane Michael (@subat0mik) and Evan McBroom (@mcbroom_evan) are active contributors as well. Please feel free to reach out on Twitter (@_Mayyhem) with questions, ideas for improvements, etc., and on GitHub with issues and pull requests.

Warning

This tool was written as a proof of concept in a lab environment and has not been thoroughly tested. There are lots of unfinished bits, terrible error handling, and functions I may never complete. Please be careful and use at your own risk.
Download SharpSCCM

___________________________
@hacking_Attack
@Hacking_Video

P1 Bug — Leaked Zendesk Token in GitHub

Version en EspañolContinue reading on Medium »
Read more...

How I made the Hall of Fame in Few minutes

Hello Awesome INFOSEC COMMUNITY, I hope you all doing well! This Write-up is about how I made the hall of fame in 10 minutes. Today I’m…Continue reading on Medium »
Read more...

P1 Bug — Leaked Zendesk Token in GitHub
https://medium.com/@red_darkin/p1-bug-leaked-zendesk-token-in-github-46e97b734e8d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Version en EspañolContinue reading on Medium » (https://medium.com/@red_darkin/p1-bug-leaked-zendesk-token-in-github-46e97b734e8d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I Got the Hall of Fame in Few minutes
https://medium.com/@Onkarborude07/how-i-made-the-hall-of-fame-in-few-minutes-5831161d35be?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Awesome INFOSEC COMMUNITY, I hope you all doing well! This Write-up is about how I got the hall of fame in few minutes. Today I’m…Continue reading on Medium » (https://medium.com/@Onkarborude07/how-i-made-the-hall-of-fame-in-few-minutes-5831161d35be?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
P1 Bug — Leaked Zendesk Token in GitHub

https://cdn-images-1.medium.com/max/600/1*pIw77EvkJy71sXy_DkS_Qg.png
Version en Español

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video