Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation

This repository only uses the features that have already been implemented by Microsoft in Windows OS to fine-tune it towards the highest security and locked-down state, without relying on any 3rd party component or dependency, using well-documented, supported, recommended and official methods. Continue reading for comprehensive info

winget install --id 9p7ggfl7dx57 --exact --accept-package-agreements --accept-source-agreements --force --source msstore

curl -L https://ghst.ly/getbhce | docker compose -f - up

http://localhost:8080/ui/login

docker compose pull && docker compose up

python3 bloodhound-python -u domain_user -p 'P@ss' -ns 10.0.0.1 -d contoso.com -c all --dns-tcp

# Domain Admins и время установки пароля
MATCH (g:Group) WHERE g.name =~ "(?i).*DOMAIN ADMINS.*" WITH g MATCH (g)<-
[r:MemberOf*1..]-(u) RETURN u.name AS User,
datetime({epochSeconds:toInteger(u.pwdlastset)}) as passwordLastSet, datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset

# Сервисные УЗ, время установки пароля, дата создания
MATCH (u:User) WHERE u.hasspn=true AND (NOT u.name STARTS WITH 'KRBTGT') RETURN u.name
AS accountName, datetime({epochSeconds: toInteger(u.pwdlastset)}) AS passwordLastSet,
datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset

# Пользователи и описание
MATCH (u:User) RETURN u.name as username, u.description as description

# Domain Admins или Administrators с сессией исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (n:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' OR
g.objectid ENDS WITH '-544'
MATCH p = (c:Computer)-[:HasSession]->(n) WHERE NOT c.name in domainControllers return
p

# Неограниченное делегирование исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name IN domainControllers
RETURN c

# Пользователи с ограниченным делегированием
MATCH p = ((u:User)-[r:AllowedToDelegate]->(c:Computer)) RETURN p

Native Windows toolkit for AD CS enumeration and exploitation. Everything runs through built-in OS components (certreq.exe, certutil.exe, PowerShell AD module, .NET Framework) - no third-party tools needed. Build with a sprinkle of FAFO and some finding out in lab env

🐥adcs-common.ps1
🐥Invoke-Enumerate.ps1
🐥Invoke-SnapshotAudit.ps1
🐥Invoke-RemoteAudit.ps1
🐥Invoke-ESC1.ps1 .. Invoke-ESC13.ps1
🐥Invoke-FindTemplates.ps1
🐥Invoke-PassTheCert.ps1
🐥Invoke-ShadowCredentials.ps1
🐥Invoke-Kerberoast.ps1
🐥Invoke-DomainRecon.ps1

This vulnerability essentially works by forcing a process running as system and that uses the undocumented function Windows_Storage!_SHCoCreateInstance, to create an arbitrary COM object of our choice. For this to happen, the object must be associated with an already registered COM class that supports CLSCTX_INPROC_SERVER. Arbitrary COM object creation is archived by manipulating a CoCreateInstance call first argument

Without further ado, I give you my take on what I’d like to call: Living off the Process! This is a technique that does as the name implies: We use what is already available to us in the remote process of our choosing to accomplish a given goal. In this case, the goal will be to write shellcode indirectly into the remote process with as low of a footprint as possible

Чтобы руками не выполнять различные запросы для поиска недостатков в инфраструктуре на базе 💻 Active Directory создан скрипт generator.py, который преобразует результаты Cypher запросов из 🐕 BloodHound в структурированные задачи для чек-листа Obsidian, позволяя автоматизировать процесс аудита безопасности 💻 Active Directory и отслеживать прогресс исправления уязвимостей

Obsidian: за гранью заметок. Генератор чек-листа

SharePointDumper is a PowerShell-based extraction and auditing utility that enumerates SharePoint sites a user can access via Microsoft Graph and downloads files via SharePoint

It is designed for SOC / DLP testing, purple teaming, and non-sophisticated red-team assessments, and therefore produces detailed reports including downloaded files and every HTTP request (Graph + SharePoint) for SIEM correlation

Большая база заметок по синтаксису PowerShell, командам Linux и инструментам DevOps на русском языке, собранная на пути от системного администратора Windows систем до DevOps инженера
Репозиторий содержит набор PowerShell и Bash скриптов, а также коллекцию стеков Docker Compose и манифестов Kubernetes, которые поддерживаются в актуальном состояние и эксплуатируется в домашней лаборатории

A simple tool for extracting information from SCCM PXE boot media
It will connect to a provided SCCM PXE server, download the boot media configuration, and try to decrypt it or output the hash for cracking

No admin privileges required

Variables File: SMSBoot\x64\pxe\variables.dat
BCD File: SMSBoot\x64\pxe\boot.bcd
Decryption Key: AB-CD-EF-...
Downloading variables file via TFTP...
File 'SMSBoot\x64\pxe\variables.dat' downloaded successfully. Size: 1234 bytes
Decrypted (Unicode): <XML content>
Management Point: http://sccm-mp.company.local
Site Code: PS1

Use SharpSCCM to get goodies!!!!
SharpSCCM.exe get secrets -i "{GUID}" -m "{MediaGUID}" -c "{PFX}" -sc PS1 -mp sccm-mp.company.local

A Windows Named Pipe Multi-tool / Proxy
Helps you observe, intercept, and replay traffic over Windows Named Pipes

from pipetap import PipeTap

tap = PipeTap()
tap.connect("pipetap.test", "10.0.0.1")

tap.send("foo\n")
print(tap.recv())

The complete red team guide to Initial Access: Payload Development (DLL Sideloading, Shellcode Loaders, Syscalls), HTML Smuggling, Phishing (QR Code Quishing, Teams Phishing), AitM/MFA Bypass (Evilginx, Device Code Phishing), Password Spraying, Exploiting Public-Facing Applications, Vishing, Physical Access (Rubber Ducky, Bash Bunny), Supply Chain attacks with real-world APT case studies