GitBook: [#1266] No subject

Author: s0cm0nkey

.gitbook/assets/image (3) (1) (1).png

@@ -781,7 +781,8 @@ ldapsearch -h 192.168.1.101 -p 389 -x -b "dc=mywebsite,dc=com"
 
 {% tab title="Tools and Resources" %}
 * [https://xapax.github.io/security/#attacking\_active\_directory\_domain/good\_to\_know/ldap\_syntax/](https://xapax.github.io/security/#attacking\_active\_directory\_domain/good\_to\_know/ldap\_syntax/)
-* [LDAPmonitor](https://github.com/p0dalirius/LDAPmonitor) - Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!f
+* [LDAPmonitor](https://github.com/p0dalirius/LDAPmonitor) - Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration
+* [ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump) - Active Directory information dumper via LDAP
 {% endtab %}
 {% endtabs %}
 
@@ -895,6 +896,8 @@ root@kali:~/dirsearch# sqsh -S someserver -U sa -P PASS -D DB_NAME
 {% tab title="Specialty Tools" %}
 * [mssqlinstance.py:](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/mssqlinstance.py) Retrieves the MSSQL instances names from the target host.
 * [mssqlclient.py:](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/mssqlclient.py) An MSSQL client, supporting SQL and Windows Authentications (hashes too). It also supports TLS.
+* [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) - A PowerShell Toolkit for Attacking SQL Server
+  * [https://github.com/NetSPI/PowerUpSQL/wiki](https://github.com/NetSPI/PowerUpSQL/wiki)
 {% endtab %}
 
 {% tab title="Resources" %}
@@ -1049,6 +1052,9 @@ Default passwords:
 
 ## 3306 - MySQL
 
+* [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) - A PowerShell Toolkit for Attacking SQL Server
+  * [https://github.com/NetSPI/PowerUpSQL/wiki](https://github.com/NetSPI/PowerUpSQL/wiki)
+
 {% tabs %}
 {% tab title="Connect" %}
 ```

.gitbook/assets/image (3) (1).png

@@ -2,7 +2,11 @@
 
 ## Post Exploitation Tasks and Checklists
 
-<figure><img src="../../../.gitbook/assets/image.png" alt=""><figcaption></figcaption></figure>
+<figure><img src="../../../.gitbook/assets/image (5).png" alt=""><figcaption></figcaption></figure>
+
+{% content-ref url="meterpreter-post-auth-runbook.md" %}
+[meterpreter-post-auth-runbook.md](meterpreter-post-auth-runbook.md)
+{% endcontent-ref %}
 
 {% content-ref url="defense-evasion.md" %}
 [defense-evasion.md](defense-evasion.md)

.gitbook/assets/image (3).png

@@ -4,10 +4,6 @@ description: All the ways to grab the goodies
 
 # Enumeration and Harvesting
 
-{% content-ref url="../meterpreter-post-auth-runbook.md" %}
-[meterpreter-post-auth-runbook.md](../meterpreter-post-auth-runbook.md)
-{% endcontent-ref %}
-
 ## **Enumeration**
 
 {% tabs %}
@@ -36,6 +32,7 @@ description: All the ways to grab the goodies
 * [ADRecon](https://github.com/adrecon/ADRecon) - ADRecon is a tool which extracts and combines various artifacts (as highlighted below) out of an AD environment.
 * [ACLight](https://github.com/cyberark/ACLight) -A tool for advanced discovery of Privileged Accounts - including Shadow Admins.
 * [TruffleSnout](https://github.com/dsnezhkov/TruffleSnout) - Iterative AD discovery toolkit for offensive operators. Situational awareness and targeted low noise enumeration.
+* [Snaffler](https://github.com/SnaffCon/Snaffler) - It gets a list of Windows computers from Active Directory, then spreads out its snaffly appendages to them all to figure out which ones have file shares, and whether you can read them.
 {% endtab %}
 
 {% tab title="SPN Scanning" %}
@@ -93,6 +90,8 @@ Privilege escalation tools can also provide much of the enumeration that you nee
 
 iRedTeam blog - [https://www.ired.team/offensive-security/credential-access-and-credential-dumping](https://www.ired.team/offensive-security/credential-access-and-credential-dumping)
 
+<figure><img src="../../../../.gitbook/assets/image (8) (2).png" alt=""><figcaption></figcaption></figure>
+
 ### Endpoint Tools
 
 {% tabs %}
@@ -111,6 +110,9 @@ iRedTeam blog - [https://www.ired.team/offensive-security/credential-access-and-
   * [https://z4ksec.github.io/posts/masky-release-v0.0.3/](https://z4ksec.github.io/posts/masky-release-v0.0.3/)
 * [MimiPenguin](https://github.com/huntergregal/mimipenguin) - A tool to dump the login password from the current linux desktop user.
 * [Internal-Monologue](https://github.com/eladshamir/Internal-monologue) - Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
+* Impacket Tools
+  * [impacket/mimikatz.py](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/mimikatz.py)
+  * [impacket/secretsdump.py](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/secretsdump.py)
 {% endtab %}
 
 {% tab title="LaZagne" %}
@@ -151,10 +153,10 @@ Simply double clicking on the executable ‘Lazagne.exe' will cause a warning me
 {% tab title="Mimikatz" %}
 {% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Mimikatz.md" %}
 
+[Mimikatz](https://github.com/gentilkiwi/mimikatz) - Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets
 
-
-Pulls credentials out of LSASS
-
+* [SafetyKatz](https://github.com/GhostPack/SafetyKatz) - SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader.
+* [spraykatz](https://www.kali.org/tools/spraykatz/) - This package contains a tool without any pretention able to retrieve credentials on Windows machines and large Active Directory environments.
 * Can be run im memory so you dont drop and executable on the target
 * Commands - will give clear text pw of currently logged in users
   * \> C:\Tools\password\_attacks\mimikatz.exe
@@ -294,27 +296,7 @@ DCSync (Modern)
 * Windows credential manager
   *   [https://github.com/peewpw/Invoke-WCMDump/blob/master/Invoke-WCMDump.p](https://github.com/peewpw/Invoke-WCMDump/blob/master/Invoke-WCMDump.ps1)
 
-      Group Policy Preference Vul
-
-      * Info for accounts under GPP stored in a Groups.xml file that contains cpassword hash.
-      * Uses a publiclally posed Microsoft AES , easy to find, easy to use
-      * Exploit available Under powersploit script Get-GPPPassword.ps1
-      * Metasploit module
-        * \>use post/windows/gather/credentials/gpp
-        * \>set SESSION \[Session # of your shell]
-        * \>exploit
-      *   [http://esec-pentest.sogeti.com/public/files/gpprefdecrypt.py](http://esec-pentest.sogeti.com/public/files/gpprefdecrypt.py)
-
-          Group Policy Preference Vul
-
-          * Info for accounts under GPP stored in a Groups.xml file that contains cpassword hash.
-          * Uses a publiclally posed Microsoft AES , easy to find, easy to use
-          * Exploit available Under powersploit script Get-GPPPassword.ps1
-          * Metasploit module
-            * \>use post/windows/gather/credentials/gpp
-            * \>set SESSION \[Session # of your shell]
-            * \>exploit
-          * [http://esec-pentest.sogeti.com/public/files/gpprefdecrypt.py](http://esec-pentest.sogeti.com/public/files/gpprefdecrypt.py)
+
 {% endtab %}
 
 {% tab title="GPP Vuln" %}
@@ -361,10 +343,23 @@ Password FIlter DLL - used by Windows to enforce password strength policies.
 {% endtab %}
 {% endtabs %}
 
+### AD/Remote Harvesting
+
+<figure><img src="../../../../.gitbook/assets/image.png" alt=""><figcaption></figcaption></figure>
+
 {% tabs %}
-{% tab title="Kerberoasting" %}
+{% tab title="Tools and Resources" %}
+Tools
+
+* [Red Snarf](https://github.com/nccgroup/redsnarf) - RedSnarf is a pen-testing / red-teaming tool by Ed Williams for retrieving hashes and credentials from Windows workstations, servers and domain controllers using OpSec Safe Techniques
+* [https://www.kali.org/tools/redsnarf/](https://www.kali.org/tools/redsnarf/)
 
+Resources
 
+* [AD-006 - Dumping Domain Password Hashes](https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/)
+{% endtab %}
+
+{% tab title="Kerberoasting" %}
 Kerberoasting
 
 * Any ticeket can be requested by any user with kerberos, from the domain controller
@@ -386,15 +381,9 @@ Kerberoasting
       * Once extracted and on our victims machine and we can start cracking them!
         * use tgsrepcrack.p
 {% endtab %}
-
-{% tab title="Second Tab" %}
-
-{% endtab %}
 {% endtabs %}
 
-{% content-ref url="ad-remote-harvesting.md" %}
-[ad-remote-harvesting.md](ad-remote-harvesting.md)
-{% endcontent-ref %}
+## Misc
 
 <details>
 
@@ -430,9 +419,5 @@ Kerberoasting
 
 </details>
 
-<figure><img src="../../../../.gitbook/assets/image (8) (2).png" alt=""><figcaption></figcaption></figure>
-
-## Misc
-
 * [SlackPirate](https://github.com/emtunc/SlackPirate) - Slack Enumeration and Extraction Tool - extract sensitive information from a Slack Workspace
 * Copy a locked file - [https://github.com/GhostPack/Lockless](https://github.com/GhostPack/Lockless)