linWinPwn v0.7.7 releases: automates a number of Active Directory Enumeration and and Vulnerability checks
linWinPwn
linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks. The script uses a number of tools and serves as the wrapper of them. Tools include impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump, certipy, silenthound, and others.
Use cases
For each of the cases described, the linWinPwn script performs different checks as shown below.
Case 1: Unauthenticated
- Module ad_enum
- rid bruteforce
- user enumeration
- ldapdomaindump anonymous enumeration
- Check if ldap-signing is enforced, check for LDAP Relay
- Module Kerberos
- kerbrute user spray
- ASREPRoast using a collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Module scan_shares
- SMB shares anonymous enumeration on identified servers
- Module vuln_checks
- Enumeration for WebDav and Spooler services on identified servers
- Check for zerologon, petitpotam, nopac weaknesses
./linWinPwn.sh -M user -t <Domain_Controller_IP_or_Target_Domain>
Case 2: Standard Account (using a password, NTLM hash, or Kerberos ticket)
- DNS extraction using adidnsdump
- Module ad_enum
- BloodHound data collection
- ldapdomaindump enumeration
- Delegation information extraction
- GPP Passwords extraction
- Extract ADCS information using certipy
- Check if ldap-signing is enforced, check for LDAP Relay
- Extraction of MachineAccountQuota of the user, Password Policy and users’ descriptions containing “pass”
- LAPS and gMSA dump
- Module Kerberos
- kerbrute user=pass enumeration
- ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
- Module scan_shares
- SMB shares enumeration on all domain servers
- Module vuln_checks
- Enumeration for WebDav and Spooler services on all domain servers
- Check for zerologon, petitpotam, nopac weaknesses
- Module mssql_enum
- Check mssql privilege escalation paths
./linWinPwn.sh -M user -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain>
Case 3: Administrator Account (using a password, NTLM hash, or Kerberos ticket)
- All of the “Standard User” checks
- Module pwd_dump
- secretsdump on all domain servers or on a provided list of servers with -S
- lsassy on all domain servers or on a provided list of servers with -S
./linWinPwn.sh -M all -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain> -S <domain_servers_list>
Changelog v0.7.7
Install
git clone https://github.com/lefayjey/linWinPwn
cd linWinPwn; chmod +x setup.sh; chmod +x linWinPwn.sh
sudo ./setup.sh
If you’re having DNS issues, run the update_dns script WARNING: The script will update /etc/resolv.conf, make sure to backup it before running the script
chmod +x update_dns.sh
sudo ./update_dns.sh <DC_IP>
Usage
Modules
The linWinPwn script contains 4 modules that can be used either separately or simultaneously.
Default (fastest): ad_enum, Kerberos with OPSEC safe checks using -O
./linWinPwn.sh -O -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP> -o <output_dir>
User modules: ad_enum,Kerberos,scan_shares,vuln_checks,mssql_enum
./linWinPwn.sh -M user -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP> -o <output_dir>
All modules: ad_enum,Kerberos,scan_shares,vuln_checks,mssql_enum,pwd_dump
./linWinPwn.sh -M all -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP> -o <output_dir>
Module ad_enum: Active Directory Enumeration
./linWinPwn.sh -M ad_enum -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain> -o <output_dir>
Module kerberos: Kerberos Based Attacks
./linWinPwn.sh -M kerberos -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain> -o <output_dir>
Module scan_shares: Network Shares Scan
./linWinPwn.sh -M scan_shares -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain> -o <output_dir>
Module vuln_checks: Vulnerability Checks
./linWinPwn.sh -M vuln_checks -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain> -o <output_dir>
Module mssql_enum: MSSQL Enumeration
./linWinPwn.sh -M mssql_enum -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain> -o <output_dir>
Module pwd_dump: Password Dump
./linWinPwn.sh -M pwd_dump -d <AD_domain> -u <AD_user> -p <AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -t <Domain_Controller_IP_or_Target_Domain> -S <domain_servers_list> -o <output_dir>
