This tool uses LDAP to check a domain for known abusable Kerberos delegation settings. Currently, it supports RBCD, Constrained, Constrained w/Protocol Transition, and Unconstrained Delegation checks.

https://github.com/IcebreakerSecurity/DelegationBOF

#LDAP
@NetPentesters

The first step in a targeted attack – or a penetration test or red team activity – is gathering intelligence on the target. While there are ways and means to do this covertly, intelligence gathering usually starts with scraping information from public sources, collectively known as open source intelligence or OSINT. There is such a wealth of legally collectible OSINT available now thanks to social media and the prevalence of online activities that this may be all that is required to give an attacker everything they need to successfully profile an organization or individual.

In this Channel , we’ll get you up to speed on what OSINT is all about and how you can learn to use OSINT tools to better understand your own digital footprint.

Join : @OsintBlackBox

​​Access Checking Active Directory

https://www.tiraniddo.dev/2022/07/access-checking-active-directory.html

#ad
@NetPentesters

​​BOF - RDPHijack

Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking. With a valid access token / kerberos ticket (e.g., golden ticket) of the session owner, you will be able to hijack the session remotely without dropping any beacon/tool on the target server.

To enumerate sessions locally/remotely, you could use Quser-BOF.

https://github.com/netero1010/RDPHijack-BOF
@NetPentesters

A python wrapper to run a command on against all users/computers/DCs of a Windows Domain

https://github.com/p0dalirius/TargetAllDomainObjects
#DC
@NetPentesters

​​PcapXray

A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction

https://github.com/Srinivas11789/PcapXray
#Forensic
#tools
@NetPentesters

​​AD denoscription password finder

The purpose of this tool is to check if passwords are stored in clear text in the denoscription of Active Directory accounts.

https://github.com/AssuranceMaladieSec/AD-denoscription-password-finder

#ad
@NetPentesters

Find vulnerabilities in AD Group Policy, but do it better than Grouper2 did.

https://github.com/Group3r/Group3r

#AD
@NetPentesters

Previously, Microsoft announced macros will be disabled in Office products by default to improve user security.

Today, Microsoft announced they have decided to undo this decision. Macros will now be enabled by default again.

@NetPentesters

[ Kerberoast implemented in VBA Macro ]
Retrieve SPNs via #LDAP queries, then ask a TGS Ticket with RC4 Etype for each one.
The ticket is exported in KiRBi format (like mimikatz does)

tool:
https://github.com/Adepts-Of-0xCC/VBA-macro-experiments/blob/main/kerberoast.vba

article:
https://adepts.of0x.cc/kerberoast-vba-macro/
#vba #kerberoast
@NetPentesters

​​Code Signing Certificate Cloning Attack

A Powershell noscript that signs input Executable file with fake Microsoft code-signing certificate to demonstrate risks of cloned-certificate sign attacks.

https://github.com/mgeeky/Penetration-Testing-Tools/tree/master/red-teaming/Self-Signed%20Threat

Research:
https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec

@NetPentesters

​​PywerView

Remotely interacts with ldap server. Also included with mini interactive console with auto completion.

Alternative for the awesome original PowerView noscript. Most of the modules used in PowerView are available in this project ( some of the flags are changed ).

Interesting Features:
▫️ Embeded user session
▫️ Mini PywerView console to make you feel like home when using PowerView in Powershell
▫️ Auto-completer, so no more memorizing commands
▫️ Cross-Domain interactions (might or might not work) Maybe more?

https://github.com/aniqfakhrul/PywerView

#ad
@NetPentesters

LDAP shell

https://github.com/PShlyundin/ldap_shell

#LDAP
@NetPentesters

#sysmon #evasion

[ SysmonQuiet Reflective DLL ]
Automatically locate sysmon process and patch its EtwEventWrite API,
causing sysmon malfunctioning while the process and its threads are still running.
(requires SeDebugPrivilege privilege)

https://github.com/ScriptIdiot/SysmonQuiet

@NetPentesters

​​vsctool

Implements Powershell functions which allow you to interact with volume shadow copies. Available functions are explained below in more detail.

https://github.com/cfalta/vsctool

#ad
@NetPentesters

​​rokenSMTP

Small python noscript to look for common #vulnerabilities on the #SMTP server.

Supported Vulnerability:
▫️ Spoofing - The ability to send an email by impersonating another user.
▫️ User Enumeration - Looking for the possibility to enumerate users with the SMTP VFRY command.

https://github.com/mrlew1s/BrokenSMTP

@NetPentesters

Vulnerabilities Scan: 15000+PoCs; 20 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty...

https://github.com/hktalent/scan4all
@NetPentesters

​​PPLDump

RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows.

https://github.com/last-byte/RIPPL

#ad
#ppl
#lsass
#tools
@NetPentesters

Azure_Workshop

#Azure #RedTeam Attack and Detect Workshop

This is a vulnerable-by-design Azure lab, containing 2 x attack paths with common misconfigurations. If you would like to see what alerts your attack path vectors are causing, recommend signing up for a Microsoft E5 trial which has Microsoft Defender for Cloud as well as Azure AD premium P2 plan. Links for signing up to an Azure Developer account can be found in the resources.txt file.

Each kill-chain has in its folder the Terraform noscript (and other pre-reqs files needed for deployment) as well as the solutions to the challenges.

https://github.com/mandiant/Azure_Workshop

@NetPentesters

Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and more!

https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7

#BloodHound
@NetPentesters

Token Duplicator

https://github.com/magnusstubman/tokenduplicator
#impersonate
#token
#duplicate
@NetPentesters