Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added new commands in data/cheats #87

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# impacket

% impacket, windows, exec, inital_access

Mssqlclient.py is an MSSQL client, supporting both SQL and Windows Authentications (including hashes) allowing the enumeration for Microsoft SQL servers including spawning an 'xp_cmdshell'. It also supports TLS.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, thanks for the pull request ! 👍

Can you remove this line, as it is interpreted by Arsenal please ?



## Attempts to connect to the SQL Server instance with valid credentials
#plateform/linux #target/remote #port/1433 #protocol/mssql #cat/ATTACK/EXPLOIT

```
mssqlclient.py <DOMAIN>/<USERNAME>:<PASSWORD>@<IP>
```

## Attempts to use windows authentication. DEFAULT: FALSE
#plateform/linux #target/remote #port/1433 #protocol/mssql #cat/ATTACK/EXPLOIT

```
mssqlclient.py <DOMAIN>/<USERNAME>:<PASSWORD>@<IP> -windows-auth
```

## Allow for the SQL Server instance without password
#plateform/linux #target/remote #port/1433 #protocol/mssql #cat/ATTACK/EXPLOIT

```
mssqlclient.py <DOMAIN>/<USERNAME>:<PASSWORD>@<IP> -no-pass
```

Comment on lines +22 to +28
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you remove this one, as we will not put all of the different commands in arsenal

## Attempts to use pass-the-hash method for authentication
#plateform/linux #target/remote #port/1433 #protocol/mssql #cat/ATTACK/EXPLOIT

```
mssqlclient.py <DOMAIN>/<USERNAME>@<IP> -hashes <LMHASH:NTHASH>
```

## Attempts to use kerberos authentication
#plateform/linux #target/remote #port/1433 #protocol/mssql #cat/ATTACK/EXPLOIT

```
mssqlclient.py <DOMAIN>/<USERNAME>:<PASSWORD>@<IP> -k
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that for kerberos authentication, password is not needed, and the option -no-pass could be added

```

## Attempts to use the IP address of the domain controller to be used for authentication
#plateform/linux #target/remote #port/1433 #protocol/mssql #cat/ATTACK/EXPLOIT

```
mssqlclient.py <DOMAIN>/<USERNAME>:<PASSWORD>@<IP> -dc-ip <IP>
```
Comment on lines +43 to +48
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one is not really useful in my opinion, could you also remove it ?

28 changes: 28 additions & 0 deletions arsenal/data/cheats/Hash Identifier/hashid.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# hash-identifier

% Hashes, hash identification, hash function analysis

#plateform/linux #target/local #cat/HASHES/HASH_TYPE_IDENTIFIER
Example : hashid '5f4dcc3b5aa765d61d8327deb882cf99'

https://github.com/blackploit/hash-identifier
Comment on lines +6 to +8
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It will also be interpreted by arsenal, could you remove this part ?


## All possible hash algorithms
```
hashid '<hash-value>' -e
```

Comment on lines +10 to +14
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure this one is useful, could you remove it ?

## Print hashes in Hashcat mode
```
hashid '<hash-value>' -m
```

## Print hashes in joh mode
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

john instead of joh

```
hashid '<hash-value>' -j
```

## write output to file
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you capitalize the first word please ? 😄

## Write output to file

```
hashid '<hash-value>' -o <output-file>
```
37 changes: 37 additions & 0 deletions arsenal/data/cheats/Hash Identifier/nth.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
# Name-That-Hash

% Hashes, hash identification, hash function analysis

#plateform/linux #target/local #cat/HASHES/HASH_TYPE_IDENTIFIER

https://github.com/HashPals/Name-That-Hash
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you remove it, it might cause unintended behaviors from Arsenal


## Standard Input Hash
```
nth --text '<hash-value>'
```

## Hash in a file
```
nth --file hash.txt
```

## Print hash in json format
```
nth --text '<hash-value>' --greppable
```

## Decode hashes in base64
```
nth --text '<base6d_encoded_hash>' -b64
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do you mean base64_encoded_hash ?

```

## Print little information about hash
```
nth --text '<hash-value>' -a
```

## Enable verbosity/debug logs
```
nth --text '<hash-value>' -v
```
Comment on lines +34 to +37
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not think this one is useful, could you remove it ? 😄