search

byt3bl33d3r / DeathStar

Uses Empire's (https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs.
GNU General Public License v3.0
1.57k stars 331 forks source link

"BLANK" credentials being used to laterally spread with GPP privesc #9

Closed stboch closed 7 years ago

stboch commented 7 years ago

GPP Yielded hundreds of "BLANK" and is wasting time trying to spread laterally using .\BLANK

byt3bl33d3r commented 7 years ago

Huh , interesting. Could you give me the raw output of the privesc/gpp module? Thanks

stboch commented 7 years ago

Changed : [BLANK] UserNames : [BLANK] NewName : [BLANK] Passwords : [BLANK] File : \DC1.AD.Local\SYSVOL\AD.Local\Policies{GUID}\User\Preferences\Drives\Drives.xml

Changed : [BLANK] UserNames : [BLANK] NewName : [BLANK] Passwords : [BLANK] File : \DC1.AD.Local\SYSVOL\AD.Local\Policies{GUID}\User\Preferences\Printers\Printers.xml

Changed : [BLANK] UserNames : [BLANK] NewName : [BLANK] Passwords : [BLANK] File : \DC1.AD.Local\SYSVOL\AD.Local\Policies{GUID}\User\Preferences\Drives\Drives.xml

Changed : [BLANK] UserNames : [BLANK] NewName : [BLANK] Passwords : [BLANK] File : \DC1.AD.Local\SYSVOL\AD.Local\Policies{GUID}\Machine\Preferences\Groups\Groups.xml

Changed : [BLANK] UserNames : [BLANK] NewName : [BLANK] Passwords : [BLANK] File : \DC1.AD.Local\SYSVOL\AD.Local\Policies{GUID}\User\Preferences\Drives\Drives.xml

Changed : [BLANK] UserNames : [BLANK] NewName : [BLANK] Passwords : [BLANK] File : \DC1.AD.Local\SYSVOL\AD.Local\Policies{BGUID}\User\Preferences\Drives\Drives.xml

Changed : [BLANK] UserNames : [BLANK] NewName : [BLANK] Passwords : [BLANK] File : \DC1.AD.Local\SYSVOL\AD.Local\Policies{GUID}\User\Preferences\Drives\Drives.xml `

byt3bl33d3r commented 7 years ago

Ok , well that shoulnd't be hard to fix. Will take care of this when I get home. Cheers

byt3bl33d3r commented 7 years ago

https://github.com/byt3bl33d3r/DeathStar/commit/c305aadb7ce78fac20a30187c82c9d579348b014 should have fixed this. Re-open otherwise.