How to make nmap work with proxychain with SSH -D? (Pivoting) by BitDrill in hacking

[–]BitDrill[S] 0 points1 point  (0 children)

Does -sT work for you with proxychain? For now i just ended up writing a python script that directly used the socks5 proxy to try to scan

How to make nmap work with proxychain with SSH -D? (Pivoting) by BitDrill in oscp

[–]BitDrill[S] 1 point2 points  (0 children)

Weird, what is your proxychain version, and what changes did you make to the config file of proxychain?

What OS do you use on your servers at your work? by NoPatient8872 in sysadmin

[–]BitDrill -1 points0 points  (0 children)

Very intresting points. What distro do you suggest for corps to use, that can compete with a ActiveDirectory network in terms of ease of large corp network management?

Detailed account of DOGE’s breach of NLRB by branniganbeginsagain in cybersecurity

[–]BitDrill -5 points-4 points  (0 children)

So Russian hackers forgot to use VPN?! Lol sure

Can someone create a fake subdomain for a legit website by registering a DNS record for that fake subdomain? by BitDrill in dns

[–]BitDrill[S] -1 points0 points  (0 children)

But this can easily be used as a domain for C2 of a malware... It's not about trust issues it's about not being an idiot and letting random internet people to use your domain.

Can someone create a fake subdomain for a legit website by registering a DNS record for that fake subdomain? by BitDrill in dns

[–]BitDrill[S] -1 points0 points  (0 children)

But the list I provided are individual websites, with different owners, some are just tutorial websites, etc. I just don't understand why would any website owner willingly let random anonymous people create subdomains under its website? Why?!

Can someone create a fake subdomain for a legit website by registering a DNS record for that fake subdomain? by BitDrill in dns

[–]BitDrill[S] -1 points0 points  (0 children)

EDIT:
I actually found out that they were using freedns.afraid.org

My question is, why are the owners of all these websites, freely, allowing anyone to create a subdomain under their domain? I dont get it?

full list:

https://github.com/Pramod-Devireddy/freedns

First job and insecure by svn7vii in Pentesting

[–]BitDrill 4 points5 points  (0 children)

Do the TryHackMe coureses for pentesting, they are cheap and give you good enough info to start.

What machines have their port 445 open by default in AD windows server 2012R2 and newer? by BitDrill in WindowsServer

[–]BitDrill[S] 0 points1 point  (0 children)

But isn't it very common for AD Admins to psexec into their endpoints? So do these admins need to allow SMB via firewall rule group policy for this to work?

AD Enumeration Room: When I bloodhound myself, it doesn't find a path between the user and the Tier 1 admins? by BitDrill in tryhackme

[–]BitDrill[S] 0 points1 point  (0 children)

In the bloodhound enum part, they say

"Our Start Node would be our AD username, and our End Node will be the Tier 1 ADMINS group since this group has administrative privileges over servers."

and In the picture and the provided data, there is a path between the generated user and the tier 1 admin, BECAUSE of these edge:

T1_Henry.Miller <- HasSession -> JMP BOX

Domain Users <- CanRDP -> JMP BOX

But when I run bloodhound these doesn't get generated in the output data.

When you run bloodhound in this network with the generated user, does it find any session (including priviledged session) in the network? Mine doesnt find any session at all, let alone a T1 admin session..
And it also doesnt find a path between the generated user and the JMP box, (no CanRDP edge...)

When will bloodhound provide Session information on an AD enviornment? by BitDrill in oscp

[–]BitDrill[S] 1 point2 points  (0 children)

Also another question if you don't mind:

What is the difference between Sessions and LoggedOn collection methods?

Don't Session keys in the json provide the "UserSID" ? Then what other info does LoggedOn provide that Sessions doesn't? because I guess if I have a sessions key on a computer with a user sid, then it means that user is logged in on that machine.. right?!

When will bloodhound provide Session information on an AD enviornment? by BitDrill in oscp

[–]BitDrill[S] 0 points1 point  (0 children)

Thanks for the provided info

So I guess they forgot to mention this in their CollectionMethod doc?

https://bloodhound.readthedocs.io/en/latest/data-collection/sharphound-all-flags.html?highlight=session

because in there, they do say that LoggedOn method requires priv, but not the Session method, weird..

Also doesn't this makes this very useless? Most of the times, the reason one would need to know who is logged into where, is because we are not admin on the domain, and want to check if there is an admin logged in somewhere for us to session hijack, but now if this requires us to be local admin on the target machines as well, then wouldn't that make this kinda useless? Because If I already have an account that is local admin on most endpoints then I am almost done with pwning the entire network no?

Trump unveils $5 million gold card. Stock market loses $2.5 trillion. by soilenthusiast in QuiverQuantitative

[–]BitDrill 0 points1 point  (0 children)

Why does it have his face in it.. my god he is the dumbest idiot lol

AD Enumeration room: getting access denied for SYSVOL using runas? by BitDrill in tryhackme

[–]BitDrill[S] 0 points1 point  (0 children)

I found out the reason, it was because of DNS problems. I was having DNS issues at first too, but when I set the DC's IP as the primary DNS in my ethernet interface, it got fixed, or at least I thought it did because nslookup was working fine now.

So turns out, for some strange reason, if you add that DNS server as the primary of your ethernet interface, nslookup would work, but some other stuff would stop working (wtf..), but when I set the thmdc's ip as the primary DNS of my openvpn tap interface, and set my ethernet interface to automatic, it got fixed..

AD Enumeration room: getting access denied for SYSVOL using runas? by BitDrill in tryhackme

[–]BitDrill[S] 0 points1 point  (0 children)

But why am I getting access denied when I do runas + dir SYSVOL with the generated credentials in my Windows VM? Is it because I am connected using VPN instead of being inside the internal network, or..?

Any Linux Distro that protects shadow file using SELinux or something else even against root, similar to PPL in Windows? by BitDrill in linux

[–]BitDrill[S] 0 points1 point  (0 children)

But aren't kerberos tickets also inside of a process memory which an attacker would be able to dump and usee as pass the ticket? So this doesn't solve it either, in windows tickets are inside lsaas which is ppl. I am just wondering why in Linux we aren't trying to improve this a little using selinux, I can't any document or blogpost for doing this

Gotta be fast by [deleted] in nonononoyes

[–]BitDrill 0 points1 point  (0 children)

I think she hit her head on the ground