Escalada de Privilegios con BloodHound
#youtube #netexec #pentestinterno #ActiveDirectory #bloodhound #privesc #gmsa
.png)
Instalación de Bloodhound CE
🔗 https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
Usa las querys
🔗 https://queries.specterops.io/
La Query Maestra
MATCH p=(n)-[r:GenericAll|GenericWrite|WriteOwner|WriteDacl|ForceChangePassword|AllExtendedRights|AddMember|AllowedToDelegate|AllowedToAct|AdminTo|CanPSRemote|CanRDP|ExecuteDCOM|AddSelf|DCSync|ReadLAPSPassword|ReadGMSAPassword|DumpSMSAPassword|AddAllowedToAct|WriteSPN|AddKeyCredentialLink|SyncLAPSPassword|WriteAccountRestrictions|WriteGPLink|ADCSESC1|ADCSESC3|ADCSESC4|ADCSESC6a|ADCSESC6b|ADCSESC9a|ADCSESC9b|ADCSESC10a|ADCSESC10b|ADCSESC13|WriteOwnerLimitedRights|OwnsLimitedRights|CanApplyGPO|ManageCA|ManageCertificates]->(:Base)
WHERE (n:User OR n:Computer)
AND NOT n.name CONTAINS "ADMIN"
AND NOT n.name CONTAINS "ACCOUNT OPERATORS"
AND NOT n.name CONTAINS "BACKUP OPERATORS"
AND NOT n.name CONTAINS "PRINT OPERATORS"
AND NOT n.name CONTAINS "EXCHANGE"
RETURN p
LIMIT 1000
Rusthound
🔗 https://github.com/g0h4n/RustHound-CE
El resto de colectores están en Mi canal de Telegram
Setup del LAB y Fase de Reconocimiento
AS-REP Roasting y Enumeración de Usuarios
KERBEROASTING
Fase de Explotación - MSSQL y Cuentas Pre2K
BloodHound
Pentest Interno
AD