Fsecurity | HH
رفتن به کانال در Telegram
👾 Канал про КБ и пентест Наш Discord: https://discord.gg/Eg8aDS7Hn7 ✉️ По сотрудничеству: @OxHaskar 🍩 Поддержать: https://www.donationalerts.com/r/xackapb
نمایش بیشتر2 067
مشترکین
-224 ساعت
-57 روز
-630 روز
آرشیو پست ها
2 067
Repost from Whitehat Lab
💻 PurpleSharp v1.3
Интересный инструмент для моделирования различных типов атак, с целью создания телеметрии в контролируемых средах 💻 Windows
❗️ 47 уникальных атак
💻 Home
💻 AD Purple Team Playbook
#purpleteam #csharp #soft
✈️ Whitehat Lab 💬 Chat
2 067
Repost from Adaptix Framework
AdaptixC2 v0.5 is out
https://github.com/Adaptix-Framework/AdaptixC2
* Windows "gopher" agent
* Fast socks5 tunnels via "gopher" agent
* New Remote Terminal
* New Client side tunnels
More details in the changelog: https://adaptix-framework.gitbook.io/adaptix-framework/changelog/v0.4-greater-than-v0.5
2 067
Repost from Whitehat Lab
🔄😉 BloodHound CE v7.3.1
Обновление инструмента для выявления связей и построения графов в 💻 Active Directory. Достаточно учетной записи доменного пользователя.
Отличный инструмент при пентесте 💻 AD среды.
Для сбора информации используются коллекторы bloodhound-ce или SharpHound
Bonus:
BadSuccessor query - dMSA (delegated Managed Service Account) в Windows Server 2025
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectsid ENDS WITH '-516' WITH COLLECT(c1.name) AS dcs MATCH (c2:Computer) WHERE c2.enabled = true AND (c2.operatingsystem contains '2025') AND (c2.name IN dcs) RETURN c2.namecurl -L https://ghst.ly/getbhce | docker compose -f - up
http://localhost:8080/ui/logindocker compose pull && docker compose uppython3 bloodhound-python -u domain_user -p 'P@ss' -ns 10.0.0.1 -d contoso.com -c all --dns-tcp# Domain Admins и время установки пароля
MATCH (g:Group) WHERE g.name =~ "(?i).*DOMAIN ADMINS.*" WITH g MATCH (g)<-
[r:MemberOf*1..]-(u) RETURN u.name AS User,
datetime({epochSeconds:toInteger(u.pwdlastset)}) as passwordLastSet, datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset# Сервисные УЗ, время установки пароля, дата создания
MATCH (u:User) WHERE u.hasspn=true AND (NOT u.name STARTS WITH 'KRBTGT') RETURN u.name
AS accountName, datetime({epochSeconds: toInteger(u.pwdlastset)}) AS passwordLastSet,
datetime({epochSeconds: toInteger(u.whencreated)}) AS dateCreated ORDER BY u.pwdlastset# Пользователи и описание
MATCH (u:User) RETURN u.name as username, u.description as description# Domain Admins или Administrators с сессией исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (n:User)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-512' OR
g.objectid ENDS WITH '-544'
MATCH p = (c:Computer)-[:HasSession]->(n) WHERE NOT c.name in domainControllers return
p# Неограниченное делегирование исключая DC
MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectid ENDS WITH '-516' WITH
COLLECT(c1.name) AS domainControllers
MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name IN domainControllers
RETURN c# Пользователи с ограниченным делегированием
MATCH p = ((u:User)-[r:AllowedToDelegate]->(c:Computer)) RETURN p