Collaborate Disseminate
I have this code for exploiting PsExec that works perfectly fine when I have a TGS for the CIFS SPN on the target, however there are situations where I only have plaintext credentials for the local admin of the target, and so I cannot requ… Continue reading Custom PsExec csharp code with plaintext credentials
I am currently working on a solution to at least try to implement a working/modern "change password" option to chntpw.
First of all: Windows uses this format in its hive file:
root@rescue /mnt/Windows/System32/config # samdump2 S… Continue reading How to generate actually valid NTLM hash for chntpw (for SAM hive file injection)
I have Kali inside the internal network, and I’m local admin on another computer (windows 10) on the same network as the Kali.
What other attack options do I have, besides those in the title?
When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i’th password (re-)set by a SAM account there are two hashes stored by Active Directory (AD): ntlm- i and lm- i. I know storin… Continue reading Can hashes labeled ‘lm’ in SAM database mimikatz dump be another type than (NT)LM?
To start with, Microsoft’s June Security Patch has a fix for CVE-2022-26925, a Man-In-The-Middle attack against NTLM. According to NIST, this attack is actively being exploited in the wild, so …read more Continue reading This Week in Security:Breaking CACs to Fix NTLM, The Biggest Leak Ever, and Fixing Firefox by Breaking It
I have seen Event Logs in Windows Event Viewer with EventID 6038 from Source LsaSrv.
My systems are: SQL server 2019 and Windows 10 20H2 machines.
I am attempting to audit what is using NTLM Authentication but do not know how to do this wi… Continue reading How can I find out what is using NTLM in my environment?
I am having a real issue cracking one NT hash i’ve pulled from my system for a Microsoft Account.
I used – PwDump8.2
I have an admin account unlocked on the system and can access most files.
I know pieces of the password so I have used Joh… Continue reading pwdump8-8.2 correct hash for Microsoft Account Win10
According to the freeradius document https://freeradius.org/radiusd/man/rlm_pap.txt I can use NT-Password as the type of storing user’s password. However, I have only found the type of generating raw MD4 as NTLM Hash. As I need to use MSCH… Continue reading Are there other types of NT Password (NTLM Hash) besides raw MD4?
According to the freeradius document https://freeradius.org/radiusd/man/rlm_pap.txt I can use NT-Password as the type of storing user’s password. However, I have only found the type of generating raw MD4 as NTLM Hash. As I need to use MSCH… Continue reading Are there other types of NT Password (NTLM Hash) besides raw MD4?
I’m trying to understand the format of NTLMv2 hash. The following is an example I get from a website:
neo::MANGO:1122334455667788:2F6CC22CFDC387CFEEB2D325E8997564:0101000000000000C79708D95F14D2011D717D511A761654000000000200060053004D004200… Continue reading Understanding NTLMv2 Hash format [duplicate]