{"uuid": "9d6c11dc-5bd7-4242-acaf-75fb21f2ee6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-33679", "type": "seen", "source": "https://t.me/hacking_Attack/77756", "content": "utput_dir>] -M vuln_checks \n\nModule mssql_enum:\u00a0MSSQL Enumeration\n./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M mssql_enum \n\nModule pwd_dump:\u00a0Password Dump\n./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M pwd_dump \nTrending: Exploit XSS Injections in a one-line powerful Technique Demos* HackTheBox Forest\n\nInteractive Mode: Automated Mode: * TryHackme AttacktiveDirectory Use casesFor each of the cases described, the linWinPwn script performs different checks as shown below.\n\nCase 1: Unauthenticated\n\n* Module ad_enum \n* rid bruteforce\n* user enumeration\n* ldapdomaindump anonymous enumeration\n* Check if ldap-signing is enforced, check for LDAP Relay\n\n* Module kerberos \n* kerbrute user spray\n* ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)\n* Blind Kerberoast\n* CVE-2022-33679 exploit\n\n* Module scan_shares \n* SMB shares anonymous enumeration on identified servers\n\n* Module vuln_checks \n* Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on identified servers\n* Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses ./linWinPwn.sh -t Case 2: Standard Account (using password, NTLM hash or Kerberos ticket)\n\n* DNS extraction using adidnsdump\n* Module ad_enum \n* BloodHound data collection\n* ldapdomaindump enumeration\n* crackmapexec user=pass enumeration\n* Delegation information extraction\n* GPP Passwords extraction\n* Extract ADCS information using certipy\n* Check if ldap-signing is enforced, check for LDAP Relay\n* Extraction of MachineAccountQuota of user, Password Policy and users\u2019 descriptions containing \u201cpass\u201d\n\n* Module kerberos \n* kerbrute user=pass enumeration\n* ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)\n* Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)\n\n* Module scan_shares \n* SMB shares enumeration on all domain servers\n* KeePass files and processes discovery on all domain servers\n\n* Module vuln_checks \n* Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on all domain servers\n* Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses\n\n* Module mssql_enum \n* Check mssql privilege escalation paths\n./linWinPwn.sh -t Domain_Controller_IP_or_Target_Domain> -d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -M user \nCase 3: Administrator Account (using password, NTLM hash or Kerberos ticket)\n\n* All of the \u201cStandard User\u201d checks\n* Module pwd_dump \n* LAPS and gMSA dump\n* secretsdump on all domain servers\n* Dump lsass on all domain servers using: procdump, lsassy, nanodump, handlekatz, masky\n* Extract backup keys using DonPAPI\n./linWinPwn.sh -t Domain_Controller_IP_or_Target_Domain> -d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -M all Disclaimer: Usage of linWinPwn for attacking targets without prior mutual consent is illegal. It\u2019s the end user\u2019s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.\nClone the repo from here: GitHub Link\nSee Also: Hacking Stories: Albert Gonzalez and the \u2018Get Rich or Die Trying\u2019 Crew who stole 130 million credit card numbers https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Merlin-300x150.png Offensive Security Tool: MerlinNovember 24, 2022\nReading Time: 3 minutes\n\n* https://www.blackh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:15.449240Z"}