TL;DR ‘The Credential Theft Shuffle’ is Sean Metcalf’s term. This is just an attempt to put my notes regarding dumping and re-using credentials all in one place. Welcome to Part VIII of our Cheatsheet Series! Part I: Mimikatz cheatsheet Part II: Set-Acl cheatsheet Part III: Get-Acl cheatsheet Part IV: Enumerating…

TL;DR setting up the free OpenVAS on Kali Part I: Howto Setup BloodHound Part II: Howto Setup BlueHound Part III: Howto Setup OpenVAS Background I recently got around to finally setting up OpenVAS on Kali. I should have done it back before I took eJPT. It would have helped, luckily…

TL;DR grabbing the krbtgt isn’t just for forging Golden Tickets, it’s also for abusing trust relationships & pivoting to other domains. Spoiler Alert If you plan on doing SlayerLabs Kinetic range then don’t read this yet. Background We were recently invited to a free trial of the SlayerLabs Kinetic range…

TL;DR ownership, Domain Admins, and so called “effective permissions”. This stuff is not as hard as some claim. This shows how ownership trumps so called “effective permissions”. Welcome to Part X of our Back to the Basics Series! Part I: NTDS.dit vs SAM Part II: Ownership Matters Part III: Recovering…

TL;DR Walkthrough of the THM Anthem room found here. THM Walkthroughs: Attacktive Directory (part of the Pentest+ Pathway) Credential Harvesting (part of the Red Team Pathway) AV Evasion: Shellcode (part of the Red Team Pathway) Anthem (general Practice VM) Living off the Land (part of the Red Team Pathway) Background …

TL;DR cheatsheet for cracking various hash types with john & hashcat, with a footnote on wordlists at the end. Welcome to Part VII of our Cheatsheet Series! Part I: Mimikatz cheatsheet Part II: Set-Acl cheatsheet Part III: Get-Acl cheatsheet Part IV: Enumerating AD cheatsheet Part V: Windows reverse shells cheatsheet …

TL;DR MSOL & the Azure AD module are being deprecated, start using Microsoft Graph. Welcome to Part VI of our Cheatsheet Series! Part I: Mimikatz cheatsheet Part II: Set-Acl cheatsheet Part III: Get-Acl cheatsheet Part IV: Enumerating AD cheatsheet Part V: Windows reverse shells cheatsheet Part VI: MS Graph PowerShell…

TL;DR Walkthrough of the THM room on AV Evasion located here. THM Walkthroughs: Attacktive Directory (part of the Pentest+ Pathway) Credential Harvesting (part of the Red Team Pathway) AV Evasion: Shellcode (part of the Red Team Pathway) Anthem (general Practice VM) Living off the Land (part of the Red Team…

TL;DR I can’t take credit for any of this. This is a demo of other’s methods to run PS commands & PS1s without needing access to PowerShell.exe. The key takeaway; focus on privileges, don’t get tunnel vision on a specific tool. Welcome to Part IX of our Back to the…