Tips And Tricks
Tips and Tricks
SUppose we compromise a machine devsrv.dollarcorp.moneycorp.local and are local administrator on it and we need to run mimikatz on it but smb is not open so we cannot copy it drectly via share, outbound http traffic is filtered so we cannot use IEX so what can we do? in such case we can load locally loaded functions in remote machine Here after priv esc first we add our first compromised user student145 to local administrator group and RDP Group of devsrv.dollarcorp.moneycorp.local then from student145 initial machine
Disable defender on the remote machine
Remember to bypass AMSI on every new user and Check the Execution policy language mode
Modify Invoke-Mimikatz.ps1 script to call the function in the script itself because we can't dot source files if in constrained language mode
If you have local administrator rights on other machines you can do anything including enabling rdp, enabling ps remoting, running script block to download tcp one liner reverse shell and executing it to catch reverse shell from script block and various other ways.
https://github.com/Flangvik/NetLoader this can be used to load any C# binary from filepath or url, patching AMSI and unhooks ETW.
We also have AssemblyLoad.exe that can be used to load the Netloaderin-memory from a URL which then loads a binary from a filepathor URL.
Port forward to bypass behaviour based detection
executes port forward command on dcorp-mgmt machine where anything that is sent via 172.16.100.1 student machine's port 80 is forwarded to dcorp-mgmt's loopback address via port 8080 and anything that is sent through loopback 0.0.0.0 port 8080 is forwarded to 172.16.100.1's port 80 which is the student vm respectively.
Host Loader.exe via HFS on student vm and here using winrs on dcorp-mgmt machine Loader.exe will load safetykatz from http://127.0.0.1:8080/SafetyKatz.exe since port forwarding was done that anything that is sent through loopback 0.0.0.0 port 8080 is forwarded to 172.16.100.1's port 80 which is the student vm in this case
OverPassThe Hash is the way to move laterally in most cases after you get credentials of users from different machines always use overpass the hash from the initial machine where you have administrative access not from the same machine where you got the hash.
After over pass the hash always use invisi shell in the shell as that particular user.
To copy loader or rubues or any other tool on other machine where we have administrative access.
Getting http service ticket will allow for winrs and PSRemote but keep in mind to pass full domain name during winrs or ps remoting example:
Creating ticket for ldap on dc will allow for dcsync.
Always bypass script block logging after moving laterally to a machine
then bypass AMSI
While extracting aes keys for machin account always use the last one as we may find multiple aeskeys from same account see the SID 2-1-5-18 is for system account use this.
remember Use bettersafetykatz for forging tickets and Rubeus and safetykatz for over pass the hash and extracting credentials.
IF we are not able to winrs or access command line using other techniques after creating golden or silver ticket in memory we can perform dcsync to extract aes hash of default administrator of moneycorp.local domain then over pass the hash
then using rubeus to over pass the hash
then winrs to access the dc winrs -r:mcorp-dc cmd
IF injected too many tickets certain problems may arise always logoff and logon at such cases.
This error is due to applocker policy
This error is due to constrained language mode
Last updated