WH @wh_lab
Showing posts older than #559 · Back to latest
A core challenge for threat detection engineering is reproducing common attacker behavior. Several open source and commercial projects exist for traditional endpoint and on-premise security, but there is a clear need for a cloud-native tool built with cloud providers and infrastructure in mind
Today, NTLM is classified as deprecated. Deprecated features remain available, but no longer receive updates or enhancements and may be removed in a future release. Despite its deprecated status, NTLM continues to be prevalent in environments where modern protocols, such as Kerberos, are not feasible due to legacy dependencies, network limitations, or ingrained application logic. The ongoing use of NTLM exposes organizations to the following risks:
* DNS/DoH листенер для beacon
* Мультилистенеры в gopher
* Система Events/Hooks
* Новый тип экстендеров - service
Server/Client Architecture for Multiplayer Support
Cross-platform GUI client
Fully encrypted communications
Listener and Agents as Plugin (Extender)
Client extensibility for adding new tools
Task and Jobs storage
Files and Process browsers
Socks4 / Socks5 / Socks5 Auth support
Local and Reverse port forwarding support
BOF support
Linking Agents and Sessions Graph
Agents Health Checker
Agents KillDate and WorkingTime control
Windows/Linux/MacOs agents support
Remote Terminal
sudo apt install mingw-w64 make gcc g++ g++-mingw-w64
wget https://go.dev/dl/go1.25.4.linux-amd64.tar.gz -O /tmp/go1.25.4.linux-amd64.tar.gz
sudo rm -rf /usr/local/go /usr/local/bin/go
sudo tar -C /usr/local -xzf /tmp/go1.25.4.linux-amd64.tar.gz
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go
# for windows 7 support by gopher agent
git clone https://github.com/Adaptix-Framework/go-win7 /tmp/go-win7
sudo mv /tmp/go-win7 /usr/lib/
sudo apt install gcc g++ build-essential make cmake mingw-w64 g++-mingw-w64 libssl-dev qt6-base-dev qt6-base-private-dev libxkbcommon-dev qt6-websockets-dev qt6-declarative-dev
make server-ext
make client
Forwarded from CyberSecrets
CanRDP, которая устанавливается из групповых политик, но доступы могут предоставляться через другие механизмы управления, например, SCCM или вручную. Для проверки доступа по протоколу RDP обычно используются средства для перебора паролей типа hydra или собственные разработки. Но есть другой способ.qwinsta.exe на сервере, например, qwinsta.exe /server:term.domain.local. Эта возможность связана с работой службы терминалов через вызов процедур. Для аутентификации используется Kerberos. Get-NetRDPSessions (аналог qwinsta), которая позволяет получить список сессий на удаленном хосте:Get-DomainComputer -LDAPFilter "(operatingsystem=*Windows Server*)(!userAccountControl:1.2.840.113556.1.4.803:=2)" |Get-NetRDPSession|ft -AutoSize
Get-DomainComputer -LDAPFilter "(operatingsystem=*Windows Server*)(!userAccountControl:1.2.840.113556.1.4.803:=2)" |Get-NetRDPSession|Select-Object ComputerName -Unique
Windows Server. И затем выполним команду qwinsta /server:$ComputerName. Так как в первую очередь нас интересует только доступ, то мы не будем разбирать вывод самой команды.function Invoke-CheckRDPAccess {
$searcher = [adsisearcher]'(&(objectCategory=computer)(operatingsystem=*Windows Server*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'
$searcher.PageSize = 1000
$comps=$searcher.FindAll()
foreach ($comp in $comps)
{
$ComputerName = $comp.Properties["name"][0].ToLower()
$ComputerName
if (Test-Connection -ComputerName $ComputerName -Count 1 -Quiet)
{
# Запускаем qwinsta
$processInfo = New-Object System.Diagnostics.ProcessStartInfo
$processInfo.FileName = "qwinsta.exe"
$processInfo.Arguments = "/server:$ComputerName"
$processInfo.RedirectStandardOutput = $true
$processInfo.RedirectStandardError = $true
$processInfo.UseShellExecute = $false
$processInfo.CreateNoWindow = $true
$process = New-Object System.Diagnostics.Process
$process.StartInfo = $processInfo
$process.Start() | Out-Null
$output = $process.StandardOutput.ReadToEnd()
$errorOutput = $process.StandardError.ReadToEnd()
$process.WaitForExit()
if($process.ExitCode -eq 0 -and $output)
{
Write-Host -ForegroundColor Green "You have RDP access to $ComputerName"
# Если нужно получить список сессий раскомментировать следующую строку
# $output
}
}
}
}Forwarded from Ralf Hacker Channel (Ralf Hacker)
* Сканирует по SMB, LDAP/S, MSSQL, HTTP/S, RPC, WinRM
* Находит WebDAV WebClient, CVE-2025-33073 (NTLM reflection), NTLMv1 + всякие PrinterBug, PetitPotam и т.п.
* Поддерживает аудит всего домена
* Составляет список таргетов для ntlmrelayx и других софтин.
* Сохраняет отчет в plaintext/JSON/CSV/Markdown
Forwarded from Threat Hunting Father 🦔
Поддержка 675+ хеша
Множественные улучшения (описания и исправления для JtR и HC)
Поддержка Ruby 3.4
Поддержка современных алгоритмов (SHA3, Keccak, Blake2, etc.)
Показывает формат для Hashcat и JohntheRipper
Работает как приложение и библиотека
gem install haiti-hash
haiti 786a02f742015903c6c6fd852552d272912f4740e15847618a86e217f71f5419d25e1031afee585313896444934eb04b903a685b1448b755d56f701afe9be2ce
SHA-512 [HC: 1700] [JtR: raw-sha512]
SHA3-512 [HC: 17600] [JtR: raw-sha3]
SHA3-512 [HC: 17600] [JtR: dynamic_400]
Keccak-512 [HC: 18000] [JtR: raw-keccak]
BLAKE2-512 [JtR: raw-blake2]
Whirlpool [HC: 6100] [JtR: whirlpool]
Salsa10
Salsa20
Skein-512 [JtR: skein-512]
Skein-1024(512)
require 'haiti'
# Instantiate a HashIdentifier object that will automatically identify
# the hash type
hi = HashIdentifier.new('786a02f742015903c6c6fd852552d272912f4740e15847618a86e217f71f5419d25e1031afee585313896444934eb04b903a685b1448b755d56f701afe9be2ce')
# Loop over the hash type candidates and retrieve data
hi.type.each do |type|
name = type.name
hashcat_id = type.hashcat
john_ref = type.john
extended = type.extended
samples = type.samples
end
Forwarded from CyberSecrets
SMB SIGNING, сама политика устанавливает smb подпись на всех хостах принадлежащие OU WORKSTATION. В OU входит рабочая станция администратора I.IVANOV.Forwarded from RedTeam brazzers (Миша)
git clone https://github.com/wagga40/Zircolite
cd Zircolite
pip3 install -r requirements.full.txt
python3 zircolite.py --evtx system.evtx
python3 zircolite.py --evtx system.evtx --ruleset rules/rules_windows_sysmon_pysigma.json
python3 zircolite.py --events auditd.log --ruleset rules/rules_linux.json --auditd
python3 zircolite.py --events sysmon.log --ruleset rules/rules_linux.json --sysmon4linux
python3 zircolite.py -U
Delegations is a tool that allows you to work with all types of Kerberos delegations (unconstrained, constrained, and resource-based constrained delegations) in Active Directory
The software consists in several tabs, each of them dedicated to a given artifact category. The tabs of the GUI are as follows:
Log Parsers - parses the most common Linux logs and returns them in a CSV file easy to filter out with Excel
ELF File Analysis - Extracts strings, metadata and imported functions from an ELF executable. This also does some basic anomaly checks in the ELF sections
/Etc/Shadow - a simple /etc/shadow parser
/Etc/Passwd - a simple /etc/passwd parser
/Proc/Modules - reads the /proc/modules artifact and interprets its flags (if a module tainted the Kernel, if it is not part of the official Kernel etc.)
Proc Reconstruct - examines the /proc virtual filesystem and returns important info on memory in an easy to review GUI
Crawlers - traverses the entire artifact collection, parses several artifact types and returns the parse output in consolidated views
RPM Package Analysis - examines an RPM package and extracts scripts, metadata, hashes etc.
DEB Package Analysis - examines a DEB package and extracts scripts, metadata, hashes etc.
SQLite Extractors - extracts tables from some Linux artifacts in SQLite format
Tree View - The entire collection can be viewed in tree mode with a built-in "Notepad++ like" editor and possibility to dump data in binary format
curl -X POST https://gorgeous-parrot-35.webhook.cool -H "Content-Type: application/json" -d '{"hello": "world", "is_true": true}'
MACSec (802.1X AE)
EAPOL (Checking 802.1X versions)
ARP (Host Discovery)
CDP (Cisco Discovery Protocol)
DTP (Dynamic Trunking Protocol)
LLDP (Link Layer Discovery Protocol)
VLAN (802.1Q)
S7COMM (Siemens) (SCADA)
OMRON (SCADA)
TACACS+ (Terminal Access Controller Access Control System Plus)
ModbusTCP (SCADA)
STP (Spanning Tree Protocol)
OSPF (Open Shortest Path First)
EIGRP (Enhanced Interior Gateway Routing Protocol)
BGP (Border Gateway Protocol)
VRRP (Virtual Router Redundancy Protocol)
HSRP (Host Standby Redundancy Protocol)
GLBP (Gateway Load Balancing Protocol)
IGMP (Internet Group Management Protocol)
LLMNR (Link Local Multicast Name Resolution)
NBT-NS (NetBIOS Name Service)
MDNS (Multicast DNS)
DHCP (Dynamic Host Configuration Protocol)
DHCPv6 (Dynamic Host Configuration Protocol v6)
ICMPv6 (Internet Control Message Protocol v6)
SSDP (Simple Service Discovery Protocol)
MNDP (MikroTik Neighbor Discovery Protocol)
SNMP (Simple Network Management Protocol)
sudo apt update && sudo apt install above
Hot mode - работа непосредственно с сетевым интерфейсом и возможностью включить захват пакетов по таймеру
Cold mode - анализ дампов сетевого трафика
sudo above --interface eth0 --timer 120 --output above.pcap
above --input ospf-md5.cap
MITM attacks are widely used by penetration testers, as they have a significant impact in allowing them to intercept credentials from various services. MITM is also often part of relay attacks, when the attacker performs lateral movement across the infrastructure. However, conducting MITM attacks carries certain risks