WH @wh_lab
Showing posts older than #582 · Back to latest
This post (sticker, poll or similar) has no web preview. Open in Telegram
This vulnerability essentially works by forcing a process running as system and that uses the undocumented function Windows_Storage!_SHCoCreateInstance, to create an arbitrary COM object of our choice. For this to happen, the object must be associated with an already registered COM class that supports CLSCTX_INPROC_SERVER. Arbitrary COM object creation is archived by manipulating a CoCreateInstance call first argument
Forwarded from TaipanByte CTF
Forwarded from 1N73LL1G3NC3
• auto - Automated Pass-the-Ticket attack
• sessions - List logon sessions. Similar to running klist sessions
• klist - List tickets in the current session. Similar to running klist
• tickets - List tickets in all sessions (not only TGTs). Similar to running Rubeus.exe dump
• export - Export a TGT given the LogonId. Similar to running Rubeus.exe dump
• ptt - Import a ticket file given the file name. Similar to running Rubeus.exe ptt
Native Windows toolkit for AD CS enumeration and exploitation. Everything runs through built-in OS components (certreq.exe, certutil.exe, PowerShell AD module, .NET Framework) - no third-party tools needed. Build with a sprinkle of FAFO and some finding out in lab env
🐥adcs-common.ps1
🐥Invoke-Enumerate.ps1
🐥Invoke-SnapshotAudit.ps1
🐥Invoke-RemoteAudit.ps1
🐥Invoke-ESC1.ps1 .. Invoke-ESC13.ps1
🐥Invoke-FindTemplates.ps1
🐥Invoke-PassTheCert.ps1
🐥Invoke-ShadowCredentials.ps1
🐥Invoke-Kerberoast.ps1
🐥Invoke-DomainRecon.ps1
Forwarded from AD_POHEQUE
curl -L https://ghst.ly/getbhce | docker compose -f - up
http://localhost:8080/ui/login
docker compose pull && docker compose up
python3 bloodhound-python -u domain_user -p 'P@ss' -ns 10.0.0.1 -d contoso.com -c all --dns-tcp
# Domain Admins и время установки пароля
MATCH (g:Group) WHERE g.name =~ "(?i).*DOMAIN ADMINS.*" WITH g MATCH (g)<-
[r:MemberOf*1..]-(u) RETURN u.name AS User,
datetime({epochSeconds:toInteger(u.pwdlastset)}) as passwordLastSet, datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset
# Сервисные УЗ, время установки пароля, дата создания
MATCH (u:User) WHERE u.hasspn=true AND (NOT u.name STARTS WITH 'KRBTGT') RETURN u.name
AS accountName, datetime({epochSeconds: toInteger(u.pwdlastset)}) AS passwordLastSet,
datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset
# Пользователи и описание
MATCH (u:User) RETURN u.name as username, u.description as description
# Domain Admins или Administrators с сессией исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (n:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' OR
g.objectid ENDS WITH '-544'
MATCH p = (c:Computer)-[:HasSession]->(n) WHERE NOT c.name in domainControllers return
p
# Неограниченное делегирование исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name IN domainControllers
RETURN c
# Пользователи с ограниченным делегированием
MATCH p = ((u:User)-[r:AllowedToDelegate]->(c:Computer)) RETURN p
🐥 Migrate to Qt6
🐥 Add support for multiple tabs and windows
🐥 New frame with customizable size, color and shininess
🐥 New and updated fonts and profiles
🐥 Plenty of small fixes and improvements
Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation
This repository only uses the features that have already been implemented by Microsoft in Windows OS to fine-tune it towards the highest security and locked-down state, without relying on any 3rd party component or dependency, using well-documented, supported, recommended and official methods. Continue reading for comprehensive info
winget install --id 9p7ggfl7dx57 --exact --accept-package-agreements --accept-source-agreements --force --source msstore
Originally featured in the lehack 2025 CTF, this lab is now available for free to everyone! In this lab, you’ll explore how to use the powerful tool NetExec to efficiently compromise an Active Directory domain during an internal pentest.
The ultimate goal? Become Domain Administrator by following various attack paths, using nothing but NetExec! and Maybe BloodHound (Why not?)
This year, the community nominated 63 pieces of research as contenders. This is significantly fewer than the crazy 121 submissions last time, possibly because we collectively got distracted by AI. That said, it's back in line with historical nomination numbers from 2022 and 2023
Forwarded from DUCKERZ
One malicious formula can turn a spreadsheet into a Remote Code Execution (RCE) beachhead. This sandbox escape lets a formula author execute OS commands or run host‑runtime JavaScript, collapsing the boundary between “cell logic” and host execution
Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities
GenericAll - полные права на объект
GenericWrite - редактировать атрибуты объекта
WriteOwner - изменить владельца объекта
WriteProperty - запись определенного свойства
WriteDACL - редактировать ACE объекта
AllExtendedRights - расширенные права на объект
ForceChangePassword - сменить пароль объекта
Self - возможность добавить себя в группу
Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/canix1/ADACLScanner/refs/heads/master/ADACLScan.ps1' -OutFile ADACLScan.ps1
.\ADACLScan.ps1
.\ADACLScan.ps1 -Base (Get-ADRootDSE).defaultNamingContext -Owner -Scope subtree -Filter '(objectClass=*)' | Where-Object {$_.Access -eq 'Owner'}
