• Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Menu
  • Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Search
Close
  • Home
  • 2018
  • February
  • 16
  • Icebreaker – Automate Network Attacks Against Active Directory

Icebreaker – Automate Network Attacks Against Active Directory

February 16, 2018July 27, 2019 Comments Off on Icebreaker – Automate Network Attacks Against Active Directory
best privilege escalation tools hacking active directory how to use icebreaker Icebreaker - Automate Network Attacks Against Active Directory icebreaker active directory icebreaker tutorial privilege escalation attacks

Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you’re inside the network but outside of the Active Directory environment.

Performs 5 different network attacks for plaintext credentials as well as hashes. Autocracks hashes found with JohnTheRipper and the top 10 million most common passwords.

  • RID cycling
    • Uses Nmap to find NULL SMB sessions
    • Performs asynchronous RID cycling to find valid usernames
    • Performs a 2 password reverse bruteforce of found usernames
    • Passwords tested: P@ssw0rd and <season><year>, e.g., Winter2018
  • SCF file upload
    • Uses Nmap to find anonymously writeable shares on the network
    • Writes an SCF file to the share with a file icon that points to your machine
    • When a user opens the share in Explorer their hash is sent to you
    • Autocracks the hash with john and top 10 million password list
  • LLMNR/NBTNS/mDNS poisoning
    • Uses Responder.py to poison the layer 2 network and capture user hashes
    • Autocracks the hash with john and top 10 million password list
  • SMB relay
    • Uses ntlmrelay.py and Responder.py to relay SMB hashes
    • After a successful relay it will do the following on the victim machine:
      • Add an administrative user – icebreaker:P@ssword123456
      • Run an obfuscated and AMSI bypassing version of Mimikatz and parse the output for hashes and passwords
  • IPv6 DNS poison
    • Uses mitm6 and ntlmrelayx.py to poison IPv6 DNS and capture user and machine hashes
    • Creates fake WPAD server with authentication
    • Note: this can easily cause network connectivity issues for users so use sparingly

 

How It Works

It will perform these 5 attacks in order. RID cycling and SCF file uploads usually go fast, then it lingers on attack 3, Repsonder.py, for 10 min by default. After that amount of time, or the user-specified amount of time has passed, it will move on to the final two attacks which are run in parallel. If an SCF file was successfully uploaded and a user visits that file share in Explorer, that hash will be caught by either Responder if the hash is sent while attack 3 is running or the hash will be caught by ntlmrelayx if attacks 4 and 5 are running.

Once ntlmrelayx relays a captured hash, it will run a base64-encoded powershell command that first adds an administrative user (icebreaker:P@ssword123456) then runs an obfuscated and AMSI-bypassing version of Mimikatz. This mimikatz output is parsed and delivered to the user in the standard output as well as in the found-passwords.txt document.

All that’s left is pipe those credentials into DeathStar and BAM you went from being a lonely outsider leering at the party going on in that Active Directory domain to being tha goddamn domain admin.

 

Installation

Note to Kali users: you will need to run ‘apt-get remove python-impacket’ before running the setup script

sudo ./setup.sh
sudo pipenv shell

 

Usage

Read from a newline separated list of IP addresses and instead of having ntlmrelayx add a user and mimikatz the victim upon hash relay, have it execute a custom command on the victim machine.

sudo ./icebreaker -l targets.txt -c "net user /add User1 P@ssw0rd"

Read from Nmap XML file, tell Responder to use the eth0 interface rather than the default gateway interface

sudo ./icebreaker -x nmapscan.xml -i eth0

Skip all five attacks and don’t autocrack hashes

sudo ./icebreaker.py -x nmapscan.xml -s rid,scf,llmnr,ntlmrelay,dns,crack

Run attack 3, LLMNR poisoning, for 30 minutes before moving on to attack 4, SMB relaying

sudo ./icebreaker.py -x nmapscan.xml -t 30

 

Automate Network Attacks Against Active Directory: icebreaker Download

Post navigation

Whonix – An Operating System Focused On Anonymity, Privacy and Security
Onion Decoy Server

Related Articles

CVE-2023-28326: Critical Vulnerability in Apache OpenMeetings

CVE-2023-28326: Critical Vulnerability in Apache OpenMeetings

- Hack Tools
March 28, 2023
Decider - A Web Application That Assists Network Defenders, Analysts, And Researcher In The Process Of Mapping Adversary Behaviors To The MITRE ATT&CK Framework

Decider – A Web Application That Assists Network Defenders, Analysts, And Researcher In The Process Of Mapping Adversary Behaviors To The MITRE ATT&CK Framework

- Hack Tools
March 28, 2023
Android app from China exploited 0-day CVE-2023-20963 flaw

Android app from China exploited 0-day CVE-2023-20963 flaw

- Hack Tools
March 28, 2023
hacker gadgets
hacker phone covers

Recent Posts

CVE-2023-28326: Critical Vulnerability in Apache OpenMeetings

CVE-2023-28326: Critical Vulnerability in Apache OpenMeetings

March 28, 2023
Decider - A Web Application That Assists Network Defenders, Analysts, And Researcher In The Process Of Mapping Adversary Behaviors To The MITRE ATT&CK Framework

Decider – A Web Application That Assists Network Defenders, Analysts, And Researcher In The Process Of Mapping Adversary Behaviors To The MITRE ATT&CK Framework

March 28, 2023
Android app from China exploited 0-day CVE-2023-20963 flaw

Android app from China exploited 0-day CVE-2023-20963 flaw

March 28, 2023
Geogramint: OSINT Geolocalization tool for Telegram

Geogramint: OSINT Geolocalization tool for Telegram

March 28, 2023
Polaris: open source policy engine for Kubernetes

Polaris: open source policy engine for Kubernetes

March 27, 2023
ThunderCloud - Cloud Exploit Framework

ThunderCloud – Cloud Exploit Framework

March 27, 2023

Social Media Hacking

SocialPath – Track users across Social Media Platforms

SocialPath – Track users across Social Media Platforms

- Social Media Hacking
October 16, 2019October 16, 2019

SocialPath is a django application for gathering social media intelligence on specific username. It checks for Twitter, Instagram, Facebook, Reddit...

SocialScan – Check Email Address and Username Availability on Online Platforms

SocialScan – Check Email Address and Username Availability on Online Platforms

June 17, 2019
Shellphish – Phishing Tool For 18 Social Media Apps

Shellphish – Phishing Tool For 18 Social Media Apps

June 10, 2019July 27, 2019
WhatsApp Hacking using QRLJacking

WhatsApp Hacking using QRLJacking

May 2, 2019May 19, 2019
How to Hack any Facebook Account with Z-Shadow

How to Hack any Facebook Account with Z-Shadow

April 26, 2019June 29, 2020
hacker buffs

About Us

Haxf4rall is a collective, a good starting point and provides a variety of quality material for cyber security professionals.

Join Our Community!

Please wait...
Get the latest News and Hacking Tools delivered to your inbox.
Don't Worry ! You will not be spammed

Active Members

Submit a Tool

Hackers Handbook 2018


Grab your copy here

ABOUT US

Haxf4rall is a collective, a good starting point and provides a variety of quality material for cyber security professionals.

Our primary focus revolves around the latest tools released in the Infosec community and provide a platform for developers to showcase their skillset and current projects.

COMPANY
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Menu
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Live Chat
RESOURCES
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Menu
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Get Started
TOOLBOX
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Menu
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Tools Directory

2014 – 2020 | Haxf4rall.com               Stay Connected:

Facebook Twitter Google-plus Wordpress
Please wait...

Join Our Community

Subscribe now and get your free HACKERS HANDBOOK

Don't Worry ! You will not be spammed
SIGN UP FOR NEWSLETTER NOW