• Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Menu
  • Home
  • Become a Hacker
    • Get Started
    • Hacker Mindset
    • Roadmap
    • Simple Setup – Hacker 101
    • Types of Hackers
    • Recommended Courses
  • Boot People Offline
  • Courses
    • All Hacking Courses
    • Cyber Security School
  • CTF
    • Beginners to Advanced Guide
    • Create your own CTF box
    • Field and Resources Guide
    • Platforms & Wargames
    • Tools Used for Solving CTF
    • Writeups
  • Dark Web
    • Beginners Guide
    • Darknet Markets
    • Darkweb 101 (Anonymity Guide)
    • Dark Web OSINT Tools
    • Hacking Forums
    • Latest News
    • Onion Links
  • Hacker Gadgets
  • Hacking Books
  • Tools Directory
Search
Close
  • Home
  • 2018
  • February
  • 16
  • Icebreaker – Automate Network Attacks Against Active Directory

Icebreaker – Automate Network Attacks Against Active Directory

February 16, 2018July 27, 2019 Comments Off on Icebreaker – Automate Network Attacks Against Active Directory
best privilege escalation tools hacking active directory how to use icebreaker Icebreaker - Automate Network Attacks Against Active Directory icebreaker active directory icebreaker tutorial privilege escalation attacks

Automates network attacks against Active Directory to deliver you piping hot plaintext credentials when you’re inside the network but outside of the Active Directory environment.

Performs 5 different network attacks for plaintext credentials as well as hashes. Autocracks hashes found with JohnTheRipper and the top 10 million most common passwords.

  • RID cycling
    • Uses Nmap to find NULL SMB sessions
    • Performs asynchronous RID cycling to find valid usernames
    • Performs a 2 password reverse bruteforce of found usernames
    • Passwords tested: [email protected] and <season><year>, e.g., Winter2018
  • SCF file upload
    • Uses Nmap to find anonymously writeable shares on the network
    • Writes an SCF file to the share with a file icon that points to your machine
    • When a user opens the share in Explorer their hash is sent to you
    • Autocracks the hash with john and top 10 million password list
  • LLMNR/NBTNS/mDNS poisoning
    • Uses Responder.py to poison the layer 2 network and capture user hashes
    • Autocracks the hash with john and top 10 million password list
  • SMB relay
    • Uses ntlmrelay.py and Responder.py to relay SMB hashes
    • After a successful relay it will do the following on the victim machine:
      • Add an administrative user – icebreaker:[email protected]
      • Run an obfuscated and AMSI bypassing version of Mimikatz and parse the output for hashes and passwords
  • IPv6 DNS poison
    • Uses mitm6 and ntlmrelayx.py to poison IPv6 DNS and capture user and machine hashes
    • Creates fake WPAD server with authentication
    • Note: this can easily cause network connectivity issues for users so use sparingly

 

How It Works

It will perform these 5 attacks in order. RID cycling and SCF file uploads usually go fast, then it lingers on attack 3, Repsonder.py, for 10 min by default. After that amount of time, or the user-specified amount of time has passed, it will move on to the final two attacks which are run in parallel. If an SCF file was successfully uploaded and a user visits that file share in Explorer, that hash will be caught by either Responder if the hash is sent while attack 3 is running or the hash will be caught by ntlmrelayx if attacks 4 and 5 are running.

Once ntlmrelayx relays a captured hash, it will run a base64-encoded powershell command that first adds an administrative user (icebreaker:[email protected]) then runs an obfuscated and AMSI-bypassing version of Mimikatz. This mimikatz output is parsed and delivered to the user in the standard output as well as in the found-passwords.txt document.

All that’s left is pipe those credentials into DeathStar and BAM you went from being a lonely outsider leering at the party going on in that Active Directory domain to being tha goddamn domain admin.

 

Installation

Note to Kali users: you will need to run ‘apt-get remove python-impacket’ before running the setup script

sudo ./setup.sh
sudo pipenv shell

 

Usage

Read from a newline separated list of IP addresses and instead of having ntlmrelayx add a user and mimikatz the victim upon hash relay, have it execute a custom command on the victim machine.

sudo ./icebreaker -l targets.txt -c "net user /add User1 [email protected]"

Read from Nmap XML file, tell Responder to use the eth0 interface rather than the default gateway interface

sudo ./icebreaker -x nmapscan.xml -i eth0

Skip all five attacks and don’t autocrack hashes

sudo ./icebreaker.py -x nmapscan.xml -s rid,scf,llmnr,ntlmrelay,dns,crack

Run attack 3, LLMNR poisoning, for 30 minutes before moving on to attack 4, SMB relaying

sudo ./icebreaker.py -x nmapscan.xml -t 30

 

Automate Network Attacks Against Active Directory: icebreaker Download

Post navigation

Whonix – An Operating System Focused On Anonymity, Privacy and Security
Onion Decoy Server

Related Articles

attack flow: helps defenders move from tracking adversary behaviors

attack flow: helps defenders move from tracking adversary behaviors

- Hack Tools
May 21, 2022
Xepor - Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask

Xepor – Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask

- Hack Tools
May 21, 2022
Octopus - Open Source Pre-Operation C2 Server Based On Python And Powershell

Octopus – Open Source Pre-Operation C2 Server Based On Python And Powershell

- Hack Tools
May 20, 2022
hacker gadgets
hacker phone covers

Recent Posts

attack flow: helps defenders move from tracking adversary behaviors

attack flow: helps defenders move from tracking adversary behaviors

May 21, 2022
EncroChat: Coke Dealer Sentenced to Almost 13 Years in Prison

EncroChat: Coke Dealer Sentenced to Almost 13 Years in Prison

May 21, 2022
Xepor - Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask

Xepor – Web Routing Framework For Reverse Engineers And Security Researchers, Brings The Best Of Mitmproxy And Flask

May 21, 2022
Octopus - Open Source Pre-Operation C2 Server Based On Python And Powershell

Octopus – Open Source Pre-Operation C2 Server Based On Python And Powershell

May 20, 2022
BinAbsInspector: Vulnerability Scanner for Binaries

BinAbsInspector: Vulnerability Scanner for Binaries

May 20, 2022
iMonitorSDK v1.0.5.1 releases: provides system behavior monitoring for terminals and the cloud

iMonitorSDK v1.0.5.1 releases: provides system behavior monitoring for terminals and the cloud

May 20, 2022

Social Media Hacking

SocialPath – Track users across Social Media Platforms

SocialPath – Track users across Social Media Platforms

- Social Media Hacking
October 16, 2019October 16, 2019

SocialPath is a django application for gathering social media intelligence on specific username. It checks for Twitter, Instagram, Facebook, Reddit...

SocialScan – Check Email Address and Username Availability on Online Platforms

SocialScan – Check Email Address and Username Availability on Online Platforms

June 17, 2019
Shellphish – Phishing Tool For 18 Social Media Apps

Shellphish – Phishing Tool For 18 Social Media Apps

June 10, 2019July 27, 2019
WhatsApp Hacking using QRLJacking

WhatsApp Hacking using QRLJacking

May 2, 2019May 19, 2019
How to Hack any Facebook Account with Z-Shadow

How to Hack any Facebook Account with Z-Shadow

April 26, 2019June 29, 2020
hacker buffs
ABOUT US

Haxf4rall is a collective, a good starting point and provides a variety of quality material for cyber security professionals.

Our primary focus revolves around the latest tools released in the Infosec community and provide a platform for developers to showcase their skillset and current projects.

COMPANY
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Menu
  • Contact Us
  • Disclaimer
  • Hacker Gadgets
  • LANC Remastered
  • PCPS IP Puller
  • Privacy Policy
  • Sitemap
  • Submit your Tool
Live Chat
RESOURCES
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Menu
  • Attack Process
  • Become a Hacker
  • Career Pathways
  • Dark Web
  • Hacking Books
  • Practice Your Skills
  • Recommended Courses
  • Simple Setup – Hacker 101
Get Started
TOOLBOX
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Menu
  • Anonymity
  • Bruteforce
  • DoS – Denial of Service
  • Information Gathering
  • Phishing
  • SQL Injection
  • Vulnerability Scanners
  • Wifi Hacking
Tools Directory

2014 – 2020 | Haxf4rall.com               Stay Connected:

Facebook Twitter Google-plus Wordpress
Please wait...

Join Our Community

Subscribe now and get your free HACKERS HANDBOOK

Don't Worry ! You will not be spammed
SIGN UP FOR NEWSLETTER NOW