Mike Donovan mpdonovan

	ip	tag_name
	162.155.56.106	Apache Log4j RCE Attempt
	223.111.180.119	Apache Log4j RCE Attempt
	213.142.150.93	Apache Log4j RCE Attempt
	211.154.194.21	Apache Log4j RCE Attempt
	210.6.176.90	Apache Log4j RCE Attempt
	199.244.51.112	Apache Log4j RCE Attempt
	199.101.171.39	Apache Log4j RCE Attempt
	197.246.175.186	Apache Log4j RCE Attempt
	196.196.150.38	Apache Log4j RCE Attempt

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

This tutorial is based on the following:
https://medium.com/upinatoms-com/sharing-a-network-between-your-vmware-fusion-linux-guest-and-your-mac-os-x-host-70d98271f142

How to setup your VMWare Fusion images to use static IP addresses on Mac OS X

Working w/ CentOS 7 and RHEL 7 linux images.

Therefore this configuration don't require any changes inside linux guest VM as it network interfaces will continue using BOOTPROTO=dhcp

1. Check your current configuration for "host-only" networking:

sudo vim /Library/Preferences/VMware\ Fusion/vmnet1/dhcpd.conf

Overview

This is a bash script that will automatically turn your wifi off if you connect your computer to an ethernet connection and turn wifi back on when you unplug your ethernet cable/adapter. If you decide to turn wifi on for whatever reason, it will remember that choice. This was improvised from this mac hint to work with Yosemite, and without hard-coding the adapter names. It's supposed to support growl, but I didn't check that part. I did, however, add OSX notification center support. Feel free to fork and fix any issues you encounter.

Most the credit for these changes go to Dave Holland.

Requirements

Mac OSX 10+
Administrator privileges

	#!/usr/bin/env python3

	"""
	Mac OSX Catalina User Password Hash Extractor

	Extracts a user's password hash as a hashcat-compatible string.

	Mac OSX Catalina (10.15) uses a salted SHA-512 PBKDF2 for storing user passwords
	(hashcat type 7100), and it's saved in an annoying binary-plist-nested-inside-xml-plist
	format, so previously reported methods for extracting the hash don't work.

	#!/bin/bash

	# server connection information
	URL="https://talkingmoose.jamfcloud.com"
	username="API-Editor"
	password="P@55w0rd"

	# provide the Jamf Pro ID of the PreStage Enrollment; look in the URL when viewing the PreStage Enrollment
	prestageID="1"

	import objc
	from Foundation import NSBundle

	IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')

	functions = [("IOServiceGetMatchingService", b"II@"),
	("IOServiceMatching", b"@*"),
	("IORegistryEntryCreateCFProperty", b"@I@@I"),
	]

	extension NSArrayController {
	/// Method which can be binded in storyboard to remove all objects from array controller
	@IBAction func removeAllObjects(sender: AnyObject) {
	let range = NSMakeRange(0, self.arrangedObjects.count)
	self.removeObjectsAtArrangedObjectIndexes(NSIndexSet(indexesInRange: range))
	}
	}

	import gssapi
	from ldap3 import Connection, SASL_AVAILABLE_MECHANISMS
	from ldap3.protocol.sasl.digestMd5 import sasl_digest_md5
	from ldap3.protocol.sasl.external import sasl_external
	from ldap3.protocol.sasl.sasl import send_sasl_negotiation, abort_sasl_negotiation

	SASL_AVAILABLE_MECHANISMS.append('GSSAPI')


	def sasl_gssapi(connection, controls):