NTLMRelay2Self over HTTP

Just a walkthrough of how to escalate privileges locally by forcing the system you landed initial access on to reflectively authenticate over HTTP to itself and forward the received connection to an HTTP listener (ntlmrelayx) configured to relay to DC servers over LDAP/LDAPs for either setting shadow credentials or configuring RBCD.

https://github.com/med0x2e/NTLMRelay2Self

#ad #ntlm #relay #rbcd #redteam

​​SMBMap

SMBMap allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind, and is intended to simplify searching for potentially sensitive data across large networks.

Some of the features have not been thoroughly tested, so changes will be forth coming as bugs are found. I only really find and fix the bugs while I'm on engagements, so progress is a bit slow. Any feedback or bug reports would be appreciated. It's definitely rough around the edges, but I'm just trying to pack in features at the moment. Version 2.0 should clean up the code a lot….whenever that actually happens ;). Thanks for checking it out!!

There's a known oddity in the SMBServer component used for the file content search feature. For some reason it throws an exception in the threading library. It still works, but the error is annoying none the less.

Features:
▫️ Pass-the-Hash Support
▫️ File upload/download/delete
▫️ Permission enumeration (writable share, meet Metasploit)
▫️ Remote Command Execution
▫️ Distrubted file content searching (beta!)
▫️ File name matching (with an auto downoad capability)

https://github.com/tothi/smbmap

#ad #samba

​​Active Directory Pentest Mindmap.

https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2022_11.svg

#mindmap #ad #pentesting

Active Directory Attack Cheat Sheet

Read

#AD #attack