Skip to content

Instantly share code, notes, and snippets.

@iamadou

iamadou/ad-attacktimeline.markdown

Created March 24, 2022 11:28
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save iamadou/6f1a91cfe71acc841c0202af27bc09e1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save iamadou/6f1a91cfe71acc841c0202af27bc09e1 to your computer and use it in GitHub Desktop.
Download ZIP
AD AttackTimeline
Raw
index.html
<div class="timeline2">
<ul>
<li>
<div>
<time>2021</time>
The <a href="https://en.wikipedia.org/wiki/PrintNightmare">PrintNightmare</a> vulnerability was released. This was a remote code execution flaw in the Windows Print Spooler that could be used to take over hosts in an AD environment. The <a href="https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab">Shadow Credentials</a> attack was released which allows for low privileged users to impersonate other user and computer accounts if conditions are right, and can be used to escalate privileges in a domain. The <a href="https://www.secureworks.com/blog/nopac-a-tale-of-two-vulnerabilities-that-could-end-in-ransomware">noPac</a> attack was released in mid-December of 2021 when much of the security world was focused on the Log4j vulnerabilities. This attack allows an attacker to gain full control over a domain from a standard domain user account if the right conditions exist.
</div>
</li>
<li>
<div>
<time>2020</time> The <a href="https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/01/the-story-of-zerologon/">ZeroLogon</a> attack debuted late in 2020. This was a critical flaw that allowed an attacker to impersonate any unpatched domain controller in a network.
</div>
</li>
<li>
<div>
<time>2019</time> harmj0y delivered the talk <a href="https://www.slideshare.net/harmj0y/derbycon-2019-kerberoasting-revisited">"Kerberoasting Revisited"</a> at DerbyCon which laid out new approaches to Kerberoasting. Elad Shamir released a <a href="https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html">blog post</a> outlining techniques for abusing resource-based constrained delegation (RBCD) in Active Directory. The company BC Security released <a href="https://github.com/BC-SECURITY/Empire">Empire 3.0</a> (now version 4) which was a re-release of the PowerShell Empire framework written in Python3 with many additions and changes.
</div>
</li>
<li>
<div>
<time>2018</time> The "Printer Bug" bug was discovered by Lee Christensen and the <a href="https://github.com/leechristensen/SpoolSample">SpoolSample</a> PoC tool was released which leverages this bug to coerce Windows hosts to authenticate to other machines via the MS-RPRN RPC interface. harmj0y released the <a href="http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/">Rubeus toolkit</a> for attacking Kerberos. Late in 2018 harmj0y also released the blog <a href="http://www.harmj0y.net/blog/redteaming/not-a-security-boundary-breaking-forest-trusts/">"Not A Security Boundary: Breaking Forest Trusts"</a> which presented key research on performing attacks across forest trusts. The <a href="https://www.dcshadow.com/">DCShadow</a> attack technique was also released by Vincent LE TOUX and Benjamin Delpy at the Bluehat IL 2018 conference. The <a href="https://github.com/vletoux/pingcastle/commits/master?after=f128d84e86e675f1ad65c4b9b05bd529e1f9dc7c+34&branch=master">Ping Castle</a> tool was released by Vincent LE TOUX for performing security audits of Active Directory by looking for misconfigurations and other flaws that can raise the risk level of a domain and producing a report that can be used to identify ways to further harden the environment.
</div>
</li>
<li>
<div>
<time>2017</time> The <a href="http://www.harmj0y.net/blog/activedirectory/roasting-as-reps/">ASREPRoast</a> technique was introduced for attacking user accounts that don't require Kerberos preauthentication. _wald0 and harmj0y delivered the pivotal talk on Active Directory ACL attacks <a href="https://www.slideshare.net/harmj0y/ace-up-the-sleeve">"ACE Up the Sleeve"</a> at Black Hat and DEF CON. harmj0y released his <a href="https://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/">"A Guide to Attacking Domain Trusts"<a> blog post on enumerating and attacking domain trusts.
</div>
</li>
<li>
<div>
<time>2016</time><a href="https://wald0.com/?p=68">BloodHound</a> was released as a game changing tool for visualizing attack paths in AD at <a href="https://www.youtube.com/watch?v=wP8ZCczC1OU">DEF CON 24</a>.
</div>
</li>
<li>
<div>
<time>2015</time> 2015 saw the release of some of the most impactful Active Directory tools of all time. The <a href="https://github.com/EmpireProject/Empire">PowerShell Empire framework</a> was released. <a href="http://www.harmj0y.net/blog/redteaming/powerview-2-0/">PowerView 2.0</a> released as part of the (now deprecated) <a href="https://github.com/PowerShellEmpire/PowerTools/">PowerTools</a> repository, which was a part of the PowerShellEmpire GitHub account. The DCSync attack was first released by Benjamin Delpy and Vincent Le Toux as part of the <a href="https://github.com/gentilkiwi/mimikatz/">mimikatz</a> tool. It has since been included in other tools. The first stable release of CrackMapExec <a href="https://github.com/byt3bl33d3r/CrackMapExec/releases?page=3">(v1.0.0)</a> was introduced. Sean Metcalf gave a talk at Black Hat USA about the dangers of Kerberos Unconstrained Delegation and released an excellent <a href="https://adsecurity.org/?p=1667">blog post</a> on the topic. The <a href="https://github.com/SecureAuthCorp/impacket/releases?page=2">Impacket</a> toolkit was also released in 2015. This is a collection of Python tools, many of which can be used to perform Active Directory attacks. It is still actively maintained as of January 2022 and is a key part of most every penetration tester's toolkit.
</div>
</li>
<li>
<div>
<time>2014</time>Veil-PowerView first <a href="https://github.com/darkoperator/Veil-PowerView/commit/fdfd47c0a1e06e529bf31c93da7caed3479d08e1#diff-1695122ff2b5844b625f6d05c9274ce0a8b75b9b7cde84386df07e24ae98181b">released</a>. This project later became part of the <a href="https://github.com/PowerShellMafia/PowerSploit">PowerSploit</a> framework as the (no longer supported) <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1">PowerView.ps1</a> AD recon tool. The Kerberoasting attack was first presented at a conference by <a href="https://twitter.com/timmedin">Tim Medin</a> at SANS Hackfest 2014.
</div>
</li>
<li>
<div>
<time>2013</time> The <a href="https://github.com/SpiderLabs/Responder/commits/master?after=c02c74853298ea52a2bfaa4d250c3898886a44ac+174&branch=master">Responder </a> tool was released by Laurent Gaffie. Responder is a tool used for poisoning LLMNR, NBT-NS, and MDNS on an Active Directory network. It can be used to obtain password hashes and also perform SMB Relay attacks (when combined with other tools) to move laterally and vertically in an AD environment. It has evolved considerably over the years and is still actively supported (with new features added) as of January 2022.
</div>
</li>
</ul>
</div>
Raw
script.js
(function() {
'use strict';
// define variables
var timelines= document.querySelectorAll('.timeline2');
function debounce(func, wait, immediate) {
var timeout;
return function() {
var context = this, args = arguments;
var later = function() {
timeout = null;
if (!immediate) func.apply(context, args);
};
var callNow = immediate && !timeout;
clearTimeout(timeout);
timeout = setTimeout(later, wait);
if (callNow) func.apply(context, args);
};
}
function callbackFunc() {
var h,timeline, li,rect,parent_rect,i,items;
for(h=0;h<timelines.length;h++){
timeline=timelines[h];
parent_rect=timeline.getBoundingClientRect();
items = timeline.querySelectorAll(".timeline2 li");
for ( i = 0; i < items.length; i++) {
/*
if (isElementInViewport(items[i])) {
items[i].classList.add("in-view");
}
*/
li=items[i];
rect = li.getBoundingClientRect();
if( (rect.bottom<=(parent_rect.top+(rect.height/2) ) ) || (rect.top >=(parent_rect.bottom-(rect.height/2)) ) ){
//debugger;
//li.style['background']='red';
li.classList.remove("in-view");
}else{
//li.style['background']='white';
li.classList.add("in-view");
}
}
}
}
var updateLayout =debounce(function(e) {
// Does all the layout updating here
callbackFunc();
}, 500); // Maximum run of once per 500 milliseconds
// listen for events
window.addEventListener("load", callbackFunc);
window.addEventListener("resize", updateLayout);
window.addEventListener("scroll", callbackFunc);
for(var h=0;h<timelines.length;h++){
var timeline=timelines[h];
timeline.addEventListener("scroll",callbackFunc );
}
})();
Raw
style.css
/* TIMELINE
–––––––––––––––––––––––––––––––––––––––––––––––––– */
.timeline2 {
overflow-y: scroll;
overflow-x: hidden;
height: 550px;
top: calc(100%-600px);
position: relative;
scroll-behavior: smooth ;
}
.timeline2 *, .timeline2 *::before, .timeline2 *::after {
font: normal 16px/1.5 "Helvetica Neue", sans-serif;
color: #fff;
margin: 0;
padding: 0;
box-sizing: border-box;
}
.timeline2::-webkit-scrollbar {
width: 12px;
background-color: #F5F5F5;
}
.timeline2::-webkit-scrollbar-track {
-webkit-box-shadow: inset 0 0 6px rgba(0,0,0,0.3);
border-radius: 10px;
background-color: #F5F5F5;
}
.timeline2::-webkit-scrollbar-thumb {
border-radius: 10px;
-webkit-box-shadow: inset 0 0 6px rgba(0,0,0,.3);
background-color: #555;
}
.timeline2 ul {
background: #456990;
/* padding: 50px 0; */
}
.timeline2 ul li {
list-style-type: none;
position: relative;
width: 2px;/* width: 6px; */
margin: 0 auto;
padding-top: 10px;/* 50px; */
padding-bottom: 10px;/* padding-bottom: 20px; = center padding-bottom: 10px; = center */
background: #fff; /* background: black; */
border-left: 3px double white;
}
.timeline2 ul li::after {
content: '';
position: absolute;
left: 50%;
top: 30px; /* bottom: 0; bottom: 50%;=center top: 30px;=top */
transform: translateX(-55%);/* transform: translateX(-50%); */
-webkit-transform: translateX(-55%);
width: 30px;
height: 30px;
border-radius: 50%;
background: inherit;
border: 2px solid #03A9F4;
}
.timeline2 ul li div {
position: relative;
bottom: 0;
width: 400px;
padding: 15px;
background: #03A9F4;
}
.timeline2 ul li div::before {
content: '';
position: absolute;
top: 20px; /* bottom: 7px; bottom: 50%;=center top: 20px;=top */
width: 0;
height: 0;
border-style: solid;
}
.timeline2 ul li:nth-child(odd) div {
left: 45px;
}
.timeline2 ul li:nth-child(odd) div::before {
left: -15px;
border-width: 16px 16px 16px 0;/* border-width: 8px 16px 8px 0; */
border-color: transparent #03A9F4 transparent transparent;
}
.timeline2 ul li:nth-child(even) div {
left: -439px;
}
.timeline2 ul li:nth-child(even) div::before {
right: -15px;
border-width: 16px 0 16px 16px; /* border-width: 8px 0 8px 16px; */
border-color: transparent transparent transparent #03A9F4;
}
.timeline2 ul li:nth-child(odd) .time {
position: absolute;
top: 20px;
left: -100px;
width: 90px;
}
.timeline2 ul li:nth-child(even) .time {
position: absolute;
top: 20px;
right: -120px;
width: 90px;
}
.timeline2 time {
display: block;
font-size: 1.2rem;
font-weight: bold;
margin-bottom: 8px;
}
/* EFFECTS
–––––––––––––––––––––––––––––––––––––––––––––––––– */
.timeline2 ul li::after {
transition: background .5s ease-in-out;
-webkit-transition: background .5s ease-in-out;
}
.timeline2 ul li.in-view::after {
background: #03A9F4;
border: 2px solid white;
}
.timeline2 ul li div {
visibility: hidden;
opacity: 0;
transition: all .5s ease-in-out;
-webkit-transition: all .5s ease-in-out;
}
.timeline2 ul li:nth-child(odd) div {
transform: translate3d(200px, 0, 0);
-webkit-transform: translate(200px, 0, 0);
}
.timeline2 ul li:nth-child(even) div {
transform: translate3d(-200px, 0, 0);
-webkit-transform: translate(-200px, 0, 0);
}
.timeline2 ul li.in-view div {
transform: none;
-webkit-transform: none;
visibility: visible;
opacity: 1;
/* disabled when arrow is on top position
border-radius: 10px;
*/
}
.timeline2 ul li .time {
transition: all .5s ease-in-out;
-webkit-transition: all .5s ease-in-out;
transform: rotate(-90deg);
-webkit-transform:rotate(270deg);
}
.timeline2 ul li.in-view .time {
transform: rotate(0deg);
-webkit-transform:rotate(0deg);
}
/* GENERAL MEDIA QUERIES
–––––––––––––––––––––––––––––––––––––––––––––––––– */
@media screen and (max-width: 900px) {
.timeline2 ul li div {
width: 250px;
}
.timeline2 ul li:nth-child(even) div {
left: -289px;
/*250+45-6*/
}
}
@media screen and (max-width: 600px) {
.timeline2 ul li {
margin-left: 20px;
}
.timeline2 ul li div {
width: calc(100vw - 120px);
}
.timeline2 ul li:nth-child(even) div {
left: 45px;
}
.timeline2 ul li:nth-child(even) div::before {
left: -15px;
border-width: 16px 16px 16px 0; /* border-width: 8px 16px 8px 0; */
border-color: transparent #03A9F4 transparent transparent;
}
.timeline2 ul li:nth-child(odd) .time {
position: absolute;
top: 60px;
left: -23px;
width: 90px;
/*
transform: rotate(-90deg);
-webkit-transform:rotate(270deg);
*/
transform: rotate(0deg);
-webkit-transform:rotate(0deg);
}
.timeline2 ul li:nth-child(even) .time {
position: absolute;
top: 60px;
right: -67px;
width: 90px;
/*
transform: rotate(-90deg);
-webkit-transform:rotate(270deg);
*/
transform: rotate(0deg);
-webkit-transform:rotate(0deg);
}
.timeline2 ul li.in-view:nth-child(odd) .time {
transform: rotate(-90deg);
-webkit-transform:rotate(270deg);
}
.timeline2 ul li.in-view:nth-child(even) .time {
transform: rotate(-90deg);
-webkit-transform:rotate(270deg);
}
}
@iamadou
Copy link
Copy Markdown
Author

iamadou commented Mar 24, 2022

AD's lastest Attack Tiimeline takes from HTB Academy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment