#kerberos — Public Fediverse posts

Reset — прохождение сложной машины от Tryhackme

Годная машина на тему Windows AD, Kerberos. В начале разведки получаем доступ к гостевой шаре. Оттуда достаем файл с паролем, но не знаем от какой учетной записи. Проводим разведку юзеров, получаем список и находим 1 пользователя к которому подходит этот пароль. Далее проводим разведку с помощью BloodHound и по цепочке получаем доступ к нескольким аккаунтам у последнего есть права Unconstrained Delegation Privilege на доменный компьютер. С помощью механизма S4U2self, запрашиваем билет на имя администратора и захватываем компьютер.

https://habr.com/ru/articles/1041620/

#windows #reset #kerberos #bloodhound #impacket #hashcat #asrep_roasting #delegation #activedirectory #active_directory

New in #Metasploit: SugarCRM #RCE, login scanner and credential gatherer for Wowza Streaming Engine Manager, and three new methods for #PetitPotam.

Plus, admin/kerberos/forge_ticket now supports a new extra_sids option — which is useful for including cross-domain SIDs for forging external #Kerberos trust tickets as part of cross-trust domain escalation. The admin/kerberos/inspect_ticket has also been updated to support viewing these extra SID values.

More Kerberos and secrets dumping improvements in this week's wrap-up!

https://www.rapid7.com/blog/post/2023/03/10/metasploit-weekly-wrap-up-196/

New in #Metasploit: SugarCRM #RCE, login scanner and credential gatherer for Wowza Streaming Engine Manager, and three new methods for #PetitPotam.

Plus, admin/kerberos/forge_ticket now supports a new extra_sids option — which is useful for including cross-domain SIDs for forging external #Kerberos trust tickets as part of cross-trust domain escalation. The admin/kerberos/inspect_ticket has also been updated to support viewing these extra SID values.

More Kerberos and secrets dumping improvements in this week's wrap-up!

https://www.rapid7.com/blog/post/2023/03/10/metasploit-weekly-wrap-up-196/

New in #Metasploit: SugarCRM #RCE, login scanner and credential gatherer for Wowza Streaming Engine Manager, and three new methods for #PetitPotam.

Plus, admin/kerberos/forge_ticket now supports a new extra_sids option — which is useful for including cross-domain SIDs for forging external #Kerberos trust tickets as part of cross-trust domain escalation. The admin/kerberos/inspect_ticket has also been updated to support viewing these extra SID values.

More Kerberos and secrets dumping improvements in this week's wrap-up!

https://www.rapid7.com/blog/post/2023/03/10/metasploit-weekly-wrap-up-196/

New in #Metasploit: SugarCRM #RCE, login scanner and credential gatherer for Wowza Streaming Engine Manager, and three new methods for #PetitPotam.

Plus, admin/kerberos/forge_ticket now supports a new extra_sids option — which is useful for including cross-domain SIDs for forging external #Kerberos trust tickets as part of cross-trust domain escalation. The admin/kerberos/inspect_ticket has also been updated to support viewing these extra SID values.

More Kerberos and secrets dumping improvements in this week's wrap-up!

https://www.rapid7.com/blog/post/2023/03/10/metasploit-weekly-wrap-up-196/

New in #Metasploit: SugarCRM #RCE, login scanner and credential gatherer for Wowza Streaming Engine Manager, and three new methods for #PetitPotam.

Plus, admin/kerberos/forge_ticket now supports a new extra_sids option — which is useful for including cross-domain SIDs for forging external #Kerberos trust tickets as part of cross-trust domain escalation. The admin/kerberos/inspect_ticket has also been updated to support viewing these extra SID values.

More Kerberos and secrets dumping improvements in this week's wrap-up!

https://www.rapid7.com/blog/post/2023/03/10/metasploit-weekly-wrap-up-196/