linWinPwn is a bash script that wraps a number of Active Directory tools for enumeration (LDAP, RPC, ADCS, MSSQL, Kerberos), vulnerability checks, object modifications and password dumping. The script streamlines the use a number of tools including: impacket, bloodhound, netexec, enum4linux-ng, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump, certipy, silenthound, bloodyAD, DonPAPI and many others.
linWinPwn can be particularly useful when you have access to an Active Directory environment for a limited time only, and you wish to be more efficient in the enumeration process and in the collection of evidence. In addition, linWinPwn can replace the use of enumeration tools on Windows in the aim of reducing the number of created artifacts (e.g., PowerShell commands, Windows Events, created files on disk), and bypassing certain Anti-Virus or EDRs. This can be achieved by performing remote dynamic port forwarding through the creation of an SSH tunnel from the Windows host (e.g., VDI machine or workstation or laptop) to a remote Linux machine (e.g., Pentest laptop or VPS), and running linWinPwn with proxychains.
On the Windows host, run using PowerShell:
ssh kali@<linux_machine> -R 1080 -NCqf
On the Linux machine, first update /etc/proxychains4.conf to include socks5 127.0.0.1 1080, then run:
proxychains ./linWinPwn.sh -t <Domain_Controller_IP>
Git clone the repository and make the script executable
git clone https://github.com/lefayjey/linWinPwn
cd linWinPwn; chmod +x linWinPwn.shInstall requirements using the install.sh script (using standard account)
chmod +x install.sh
./install.shThe linWinPwn script can be ran in interactive mode, or in automation mode.
Default: interactive - Open interactive menu to run checks separately
./linWinPwn.sh -t <Domain_Controller_IP> [-d <AD_domain> -u <AD_user> -p <AD_password> -H <hash[LM:NT]> -K <kerbticket[./krb5cc_ticket]> -A <AES_key> -C <cert[./cert.pfx]> -o <output_dir>]Using the --auto parameter - Run automatically the enumeration steps only (no exploitation nor modifications to the AD)
./linWinPwn.sh -t <Domain_Controller_IP> --auto -d <AD_domain> -u <AD_user> -p <AD_password> -H <hash[LM:NT]> -K <kerbticket[./krb5cc_ticket]> -A <AES_key> -C <cert[./cert.pfx]> -o <output_dir>]Auto config - Run NTP sync with target DC and add entry to /etc/hosts before running the modules
./linWinPwn.sh -t <Domain_Controller_IP> --auto-configLDAPS - Use LDAPS instead of LDAP (port 636)
./linWinPwn.sh -t <Domain_Controller_IP> --ldapsForce Kerberos Auth - Force using Kerberos authentication instead of NTLM (when possible)
./linWinPwn.sh -t <Domain_Controller_IP> --force-kerbVerbose - Enable all verbose and debug outputs
./linWinPwn.sh -t <Domain_Controller_IP> --verboseInterface - Choose attacker's network interface
./linWinPwn.sh -t <Domain_Controller_IP> -I tun0
./linWinPwn.sh -t <Domain_Controller_IP> --interface eth0Targets - Choose targets to be scanned (DC, All, IP=IP_or_hostname, File=./path_to_file)
./linWinPwn.sh -t <Domain_Controller_IP> -T All
./linWinPwn.sh -t <Domain_Controller_IP> --targets DC
./linWinPwn.sh -t <Domain_Controller_IP> -T IP=192.168.0.1
./linWinPwn.sh -t <Domain_Controller_IP> -T File=./list_servers.txt- HackTheBox Forest
Interactive Mode:
Automated Mode:
- TryHackme AttacktiveDirectory
When using the automated mode, different checks are performed based on the provided credentials.
Unauthenticated (no credentials provided)
- Anonymous enumeration using netexec, enum4linux-ng, ldapdomaindump, ldeep
- RID bruteforce using netexec
- kerbrute user spray
- Pre2k authentication check on collected list of computers
- ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Blind Kerberoast
- CVE-2022-33679 exploit
- Check for DNS unsecure updates for AS-REQ abuse using krbjack
- SMB shares anonymous enumeration on identified servers
- Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on identified servers
- Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses
./linWinPwn.sh -t <Domain_Controller_IP_or_Target_Domain> --autoAuthenticated (using password, NTLM hash, Kerberos ticket, AES key or pfx Certificate)
- DNS extraction using adidnsdump
- BloodHound data collection
- Enumeration using netexec, enum4linux-ng, ldapdomaindump, bloodyAD, sccmhunter, rdwatool, sccmhunter, GPOwned
- Generate wordlist for password cracking
- netexec find accounts with user=pass
- Pre2k authentication check on domain computers
- Extract ADCS information using certipy and certi.py
- kerbrute 6DA9 find accounts with user=pas
- ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Targeted Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- SMB shares enumeration on all domain servers using smbmap, manspider and cme's spider_plus
- Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on all domain servers (using cme, Coercer and RPC Dump)
- Check for ms17-010, ms14-068, zerologon, petitpotam, nopac, smb-signing, ntlmv1, runasppl, certifried weaknesses
- Check mssql privilege escalation paths
- Check mssql relay possibilities
./linWinPwn.sh -t <Domain_Controller_IP_or_Target_Domain> -d <AD_domain> -u <AD_user> -p <AD_password> -H <hash[LM:NT]> -K <kerbticket[./krb5cc_ticket]> -A <AES_key> -C <cert[./cert.pfx]> --auto- Add more enumeration and exploitation tools...
-
Inspiration: S3cur3Th1sSh1t - WinPwn
-
Tools:
- fortra - impacket
- NeffIsBack, Marshall-Hallenbeck, zblurx, mpgn, byt3bl33d3r and all contributors - crackmapexec/netexec
- Fox-IT - bloodhound-python
- dirkjanm - ldapdomaindump, adidnsdump
- zer1t0 - certi.py
- ly4k - Certipy
- ShawnDEvans - smbmap
- ropnop - windapsearch, kerbrute
- login-securite - DonPAPI
- Processus-Thief - HEKATOMB
- layer8secure - SilentHound
- ShutdownRepo - TargetedKerberoast
- franc-pentest - ldeep
- garrettfoster13 - pre2k, aced, sccmhunter
- zblurx - certsync
- p0dalirius - Coercer, FindUncommonShares, ExtractBitlockerKeys, LDAPWordlistHarvester, ldapconsole, pyLDAPmonitor, RDWAtool
- blacklanternsecurity - MANSPIDER
- CravateRouge - bloodyAD
- shellster - LDAPPER
- TrustedSec - orpheus
- lkarlslund - Adalanche
- X-C3LL - GPOwned
- Hackndo - pyGPOAbuse
- CompassSecurity - mssqlrelay
-
References:
- https://orange-cyberdefense.github.io/ocd-mindmaps/
- https://github.com/swisskyrepo/PayloadsAllTheThings
- https://book.hacktricks.xyz/
- https://adsecurity.org/
- https://casvancooten.com/
- https://www.thehacker.recipes/
- https://www.ired.team/
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
- https://hideandsec.sh/
Usage of linWinPwn for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.