3xpl01tc0d3r

 Hello All, Active directory is a backbone of almost all the organizations. It helps the IT team to manage the systems, users, policies etc, centrally across the complete network. Since it is integral part of the organization, it open's multiple opportunity for the attackers to leverage the features of active directory and abuse them for malicious intent. We will look at one such feature known as Active Directory Replication in this post.  In this post we will look at few approach that we can use to detect the DCSync attack and gain understand about the attack. DCSync attack and detection is already explained by Sean Metcalf & Will Schroeder in their blog post. About Active Directory Replication Domain Controllers (DC) are the pillars of Active Directory (AD) environment. Organizations often have multiple Domain Controllers for it's Active Directory as a backup or they have different Domain Controllers for each location so that the authentication and other policies can b...

Hello All, In this post we will discuss on how to perform Resource-Based Constrained Delegation (RBCD) attack from an Linux machine to be specific we will use Kali Linux as an attacker machine. RBCD attacks is already been explained in detailed by  Will Schroeder ,  Elad Shamir  &  Dirk-jan Mollema  in their blog posts.  What is Resource-Based Constrained Delegation (RBCD) ? In Windows Server 2012 Microsoft introduced a new type of delegation wherein the Service Administrators or Owner of the resources are allowed to configure which accounts are trusted to delegate to them. As per the Microsoft Docs this can also be configured across the domains.  This also shifts the decision of whether a server should trust the source of a delegated identity from the delegating-from domain administrator to the resource owner. Access is controlled by the security descriptor on the target resource instead of an list of SPN records. The security descriptor are stor...

Hello All, In the post I will highlight few updates that are made to improve the code base & add long pending features to the Process Injection Tool that I wrote for learning about various Process Injection techniques and to enhance my knowledge about C# and Windows API. The tool for process injection can be found on my Github. https://github.com/3xpl01tc0d3r/ProcessInjection New Features: 1) Encryption - Added XOR & AES encryption support with custom key that needs to be passed to decrypt the shellcode at runtime. To encrypt the shellcode I have wrote another tool Obfuscator . I have wrote another short blog post for Obfuscator tool that can be found here . The tool currently only supports XOR & AES encryption. Obfuscated shellcode might help operator's to evade static detection while trying to inject the shellcode into remote process.  Required parameters to leverage Encryption: /enc  : This parameter is used to specify the encryption type(xor or aes). /key : Th...

Hello All, Introduction As a process of learning how to use Windows API and refreshing my knowledge about c# programming. I plan to learn and code some applications in c# leveraging Windows API for learning & developing tools which can be used during red team engagements. In this post I will share a simple code written in c# leveraging Windows API to dump the process memory for any running process in windows. Note:- I am not the first person to write such a code. There are many code samples available on the internet. What is memory dumping ? Memory dumping is a process in which the content of the memory is stored in a file for analyzing the reason for the crash or it can be useful for extracting sensitive information from the memory of the running process. One of the use cases for dumping the memory of the process can be to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. What is Local Security Authority Subsystem Service (L...