red teaming

content/notes/Red Teaming/Fundamentals/Red Team Fundamentals/Engagement_Structure.md

@@ -29,4 +29,4 @@ Components of the kill chain are broken down in the table below.
 |Exploitation|Exploit the target's system to execute code|MS17-010, Zero-Logon, etc.|
 |Installation|Install malware or other tooling|Mimikatz, Rubeus, etc.|
 |Command & Control|Control the compromised asset from a remote central controller|Empire, Cobalt Strike, etc.|
-|Actions on Objectives|Any end objectives: ransomware, data exfiltration, etc.|Conti, LockBit2.0, etc.|
+|Actions on Objectives|Any end objectives: ransomware, data exfiltration, etc.|Conti, LockBit2.0, etc.|

content/notes/Red Teaming/Fundamentals/Red Team Fundamentals/Red_team_Engagements.md

@@ -24,4 +24,3 @@ Depending on the resources available, the red team exercise can be run in severa
 - **Full Engagement:** Simulate an attacker's full workflow, from initial compromise until final goals have been achieved.
 - **Assumed Breach:** Start by assuming the attacker has already gained control over some assets, and try to achieve the goals from there. As an example, the red team could receive access to some user's credentials or even a workstation in the internal network.
 - **Table-top Exercise:**  An over the table simulation where scenarios are discussed between the red and blue teams to evaluate how they would theoretically respond to certain threats. Ideal for situations where doing live simulations might be complicated.
-

content/notes/Red Teaming/Initial Access/Password Attacks/Introduction.md

@@ -0,0 +1,22 @@
+---
+title: Introduction 🗽
+---
+This note is an introduction to the types and techniques used in password attacks. We will discuss the ways to get and generate custom password lists. The following are some of the topics we will discuss:
+
+- Password profiling
+- Password attacks techniques
+- Online password attacks
+
+### What is a password?
+
+Passwords are used as an authentication method for individuals to access computer systems or applications. Using passwords ensures the owner of the account is the only one who has access. However, if the password is shared or falls into the wrong hands, unauthorized changes to a given system could occur. Unauthorized access could potentially lead to changes in the system's overall status and health or damage the file system. Passwords are typically comprised of a combination of characters such as letters, numbers, and symbols. Thus, it is up to the user how they generate passwords!
+
+A collection of passwords is often referred to as a dictionary or wordlist. Passwords with low complexity that are easy to guess are commonly found in various publicly disclosed password data breaches. For example, an easy-to-guess password could be password, 123456, 111111, and much more. Here are the [top 100 and most common and seen passwords](https://techlabuzz.com/top-100-most-common-passwords/) for your reference. Thus, it won't take long and be too difficult for the attacker to run password attacks against the target or service to guess the password. Choosing a strong password is a good practice, making it hard to guess or crack. Strong passwords should not be common words or found in dictionaries as well as the password should be an eight characters length at least. It also should contain uppercase and lower case letters, numbers, and symbol strings (ex: *&^%$#@).
+
+Sometimes, companies have their own password policies and enforce users to follow guidelines when creating passwords. This helps ensure users aren't using common or weak passwords within their organization and could limit attack vectors such as brute-forcing. For example, a password length has to be eight characters and more, including characters, a couple of numbers, and at least one symbol. However, if the attacker figures out the password policy, he could generate a password list that satisfies the account password policy.
+
+### How secure are passwords?
+
+Passwords are a protection method for accessing online accounts or computer systems. Passwords authentication methods are used to access personal and private systems, and its main goal of using the password is to keep it safe and not share it with others.
+
+To answer the question: How secure are passwords? depends on various factors. Passwords are usually stored within the file system or database, and keeping them safe is essential. We've seen cases where companies store passwords into plaintext documents, such as the [Sony breach](https://www.techdirt.com/articles/20141204/12032329332/shocking-sony-learned-no-password-lessons-after-2011-psn-hack.shtml) in 2014. Therefore, once an attacker accesses the file system, he can easily obtain and reuse these passwords. On the other hand, others store passwords within the system using various techniques such as hashing functions or encryption algorithms to make them more secure. Even if the attacker has to access the system, it will be harder to crack. We will cover cracking hashes in the upcoming tasks.

content/notes/Red Teaming/Initial Access/Password Attacks/Offline_Attacks.md

@@ -0,0 +1,245 @@
+---
+title: Offline Attacks 🏎
+---
+# Dictionary and Brute-Force Based
+
+This section discusses offline attacks, including dictionary, brute-force, and rule-based attacks.
+
+### Dictionary attack
+
+A dictionary attack is a technique used to guess passwords by using well-known words or phrases. The dictionary attack relies entirely on pre-gathered wordlists that were previously generated or found. It is important to choose or create the best candidate wordlist for your target in order to succeed in this attack. Let's explore performing a dictionary attack using what you've learned in the previous tasks about generating wordlists. We will showcase an offline dictionary attack using hashcat, which is a popular tool to crack has@hes.  
+
+Let's say that we obtain the following hash f806fc5a2a0d5ba2471600758452799c, and want to perform a dictionary attack to crack it. First, we need to know the following at a minimum:  
+
+1- What type of hash is this?  
+2- What wordlist will we be using? Or what type of attack mode could we use?
+
+To identify the type of hash, we could a tool such as hashid or hash-identifier. For this example, hash-identifier believed the possible hashing method is MD5. Please note the time to crack a hash will depend on the hardware you're using (CPU and/or GPU).
+
+````shell  
+user@machine$ hashcat -a 0 -m 0 f806fc5a2a0d5ba2471600758452799c /usr/share/wordlists/rockyou.txt
+hashcat (v6.1.1) starting...
+f806fc5a2a0d5ba2471600758452799c:rockyou
+
+Session..........: hashcat
+Status...........: Cracked
+Hash.Name........: MD5
+Hash.Target......: f806fc5a2a0d5ba2471600758452799c
+Time.Started.....: Mon Oct 11 08:20:50 2021 (0 secs)
+Time.Estimated...: Mon Oct 11 08:20:50 2021 (0 secs)
+Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
+Guess.Queue......: 1/1 (100.00%)
+Speed.#1.........:   114.1 kH/s (0.02ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
+Recovered........: 1/1 (100.00%) Digests
+Progress.........: 40/40 (100.00%)
+Rejected.........: 0/40 (0.00%)
+Restore.Point....: 0/40 (0.00%)
+Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
+Candidates.#1....: 123456 -> 123123
+
+Started: Mon Oct 11 08:20:49 2021
+Stopped: Mon Oct 11 08:20:52 2021
+````
+
+`-a` 0  sets the attack mode to a dictionary attack
+
+`-m 0`  sets the hash mode for cracking MD5 hashes; for other types, run `hashcat -h` for a list of supported hashes.
+
+`f806fc5a2a0d5ba2471600758452799c` this option could be a single hash like our example or a file that contains a hash or multiple hashes.
+
+`/usr/share/wordlists/rockyou.txt` the wordlist/dictionary file for our attack
+
+We run `hashcat` with `--show` option to show the cracked value if the hash has been cracked:
+
+````shell
+user@machine$ hashcat -a 0 -m 0 F806FC5A2A0D5BA2471600758452799C /usr/share/wordlists/rockyou.txt --show
+f806fc5a2a0d5ba2471600758452799c:rockyou
+````
+
+As a result, the cracked value is `rockyou`.
+
+### Brute-Force attack
+
+Brute-forcing is a common attack used by the attacker to gain unauthorized access to a personal account. This method is used to guess the victim's password by sending standard password combinations. The main difference between a dictionary and a brute-force attack is that a dictionary attack uses a wordlist that contains all possible passwords.
+
+In contrast, a brute-force attack aims to try all combinations of a character or characters. For example, let's assume that we have a bank account to which we need unauthorized access. We know that the PIN contains 4 digits as a password. We can perform a brute-force attack that starts from 0000 to 9999 to guess the valid PIN based on this knowledge. In other cases, a sequence of numbers or letters can be added to existing words in a list, such as admin0, admin1, .. admin9999.
+
+For instance, hashcat has charset options that could be used to generate your own combinations. The charsets can be found in hashcat help options.
+
+````shell   
+user@machine$ hashcat --help
+ ? | Charset
+ ===+=========
+  l | abcdefghijklmnopqrstuvwxyz
+  u | ABCDEFGHIJKLMNOPQRSTUVWXYZ
+  d | 0123456789
+  h | 0123456789abcdef
+  H | 0123456789ABCDEF
+  s |  !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
+  a | ?l?u?d?s
+  b | 0x00 - 0xff
+````
+
+The following example shows how we can use `hashcat` with the brute-force attack mode with a combination of our choice.
+
+````shell  
+user@machine$ hashcat -a 3 ?d?d?d?d --stdout
+1234
+0234
+2234
+3234
+9234
+4234
+5234
+8234
+7234
+6234
+..
+..
+````
+
+`-a 3`  sets the attacking mode as a brute-force attack
+
+`?d?d?d?d` the ?d tells hashcat to use a digit. In our case, ?d?d?d?d for four digits starting with 0000 and ending at 9999
+
+`--stdout` print the result to the terminal
+
+Now let's apply the same concept to crack the following MD5 hash: `05A5CF06982BA7892ED2A6D38FE832D6` a four-digit PIN number.
+
+````shell
+user@machine$ hashcat -a 3 -m 0 05A5CF06982BA7892ED2A6D38FE832D6 ?d?d?d?d
+05a5cf06982ba7892ed2a6d38fe832d6:2021
+
+Session..........: hashcat
+Status...........: Cracked
+Hash.Name........: MD5
+Hash.Target......: 05a5cf06982ba7892ed2a6d38fe832d6
+Time.Started.....: Mon Oct 11 10:54:06 2021 (0 secs)
+Time.Estimated...: Mon Oct 11 10:54:06 2021 (0 secs)
+Guess.Mask.......: ?d?d?d?d [4]
+Guess.Queue......: 1/1 (100.00%)
+Speed.#1.........: 16253.6 kH/s (0.10ms) @ Accel:1024 Loops:10 Thr:1 Vec:8
+Recovered........: 1/1 (100.00%) Digests
+Progress.........: 10000/10000 (100.00%)
+Rejected.........: 0/10000 (0.00%)
+Restore.Point....: 0/1000 (0.00%)
+Restore.Sub.#1...: Salt:0 Amplifier:0-10 Iteration:0-10
+Candidates.#1....: 1234 -> 6764
+
+Started: Mon Oct 11 10:54:05 2021
+Stopped: Mon Oct 11 10:54:08 2021
+````
+
+# Rule-based
+
+### Rule-Based attacks
+
+Rule-Based attacks are also known as hybrid attacks. Rule-Based attacks assume the attacker knows something about the password policy. Rules are applied to create passwords within the guidelines of the given password policy and should, in theory, only generate valid passwords. Using pre-existing wordlists may be useful when generating passwords that fit a policy — for example, manipulating or 'mangling' a password such as 'password': `p@ssword`, `Pa$$word`, `Passw0rd`, and so on.
+
+For this attack, we can expand our wordlist using either `hashcat` or `John the ripper`. However, for this attack, let's see how `John the ripper` works. Usually, John the ripper has a config file that contains rule sets, which is located at `/etc/john/john.conf` or `/opt/john/john.conf` depending on your distro or how john was installed. You can read `/etc/john/john.conf` and look for `List.Rules` to see all the available rules:
+
+````shell
+user@machine$ cat /etc/john/john.conf|grep "List.Rules:" | cut -d"." -f3 | cut -d":" -f2 | cut -d"]" -f1 | awk NF
+JumboSingle
+o1
+o2
+i1
+i2
+o1
+i1
+o2
+i2
+best64
+d3ad0ne
+dive
+InsidePro
+T0XlC
+rockyou-30000
+specific
+ShiftToggle
+Split
+Single
+Extra
+OldOffice
+Single-Extra
+Wordlist
+ShiftToggle
+Multiword
+best64
+Jumbo
+KoreLogic
+T9
+````
+
+We can see that we have many rules that are available for us to use. We will create a wordlist with only one password containing the string tryhackme, to see how we can expand the wordlist. Let's choose one of the rules, the best64 rule, which contains the best 64 built-in John rules, and see what it can do!
+
+````shell
+user@machine$ john --wordlist=/tmp/single-password-list.txt --rules=best64 --stdout | wc -l
+Using default input encoding: UTF-8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+76p 0:00:00:00 100.00% (2021-10-11 13:42) 1266p/s pordpo
+76
+````
+
+`--wordlist=` to specify the wordlist or dictionary file. 
+
+`--rules` to specify which rule or rules to use.
+
+`--stdout` to print the output to the terminal.
+
+`|wc -l`  to count how many lines John produced.
+
+By running the previous command, we expand our password list from 1 to 76 passwords. Now let's check another rule, one of the best rules in John, KoreLogic. KoreLogic uses various built-in and custom rules to generate complex password lists. For more information, please visit this website [here](https://contest-2010.korelogic.com/rules.html). Now let's use this rule and check whether the Tryh@ckm3 is available in our list!
+
+````shell
+user@machine$ john --wordlist=single-password-list.txt --rules=KoreLogic --stdout |grep "Tryh@ckm3"
+Using default input encoding: UTF-8
+Press 'q' or Ctrl-C to abort, almost any other key for status
+Tryh@ckm3
+7089833p 0:00:00:02 100.00% (2021-10-11 13:56) 3016Kp/s tryhackme999999
+````
+
+The output from the previous command shows that our list has the complex version of tryhackme, which is Tryh@ckm3. Finally, we recommend checking out all the rules and finding one that works the best for you. Many rules apply combinations to an existing wordlist and expand the wordlist to increase the chance of finding a valid password!
+
+### Custom Rules
+
+John the ripper has a lot to offer. For instance, we can build our own rule(s) and use it at run time while john is cracking the hash or use the rule to build a custom wordlist!
+
+Let's say we wanted to create a custom wordlist from a pre-existing dictionary with custom modification to the original dictionary. The goal is to add special characters (ex: !@#$*&) to the beginning of each word and add numbers 0-9 at the end. The format will be as follows:
+
+`[symbols]word[0-9]`
+
+We can add our rule to the end of john.conf:
+
+````shell
+user@machine$ sudo vi /etc/john/john.conf 
+[List.Rules:THM-Password-Attacks] 
+Az"[0-9]" ^[!@#$]
+````
+
+`[List.Rules:THM-Password-Attacks]`  specify the rule name THM-Password-Attacks.
+
+`Az` represents a single word from the original wordlist/dictionary using -p.
+
+`"[0-9]"` append a single digit (from 0 to 9) to the end of the word. For two digits, we can add `"[0-9][0-9]"`  and so on.  
+
+`^[!@#$]` add a special character at the beginning of each word. `^` means the beginning of the line/word. Note, changing ^ to $ will append the special characters to the end of the line/word.
+
+Now let's create a file containing a single word password to see how we can expand our wordlist using this rule.
+
+````shell
+user@machine$ echo "password" > /tmp/single.lst
+````
+
+We include the name of the rule we created in the John command using the --rules option. We also need to show the result in the terminal. We can do this by using --stdout as follows:
+
+````shell
+user@machine$ john --wordlist=/tmp/single.lst --rules=THM-Password-Attacks --stdout 
+Using default input encoding: UTF-8 
+!password0 
+@password0 
+#password0 
+$password0
+````
+
+*NOTE: for format `[symbol][dictionary word][0-9][0-9]`, the rule is: `Az"[0-9][0-9]" ^[!@#$]`*