gofetchad / gofetch Goto Github PK

View Code? Open in Web Editor NEW

622.0 37.0 139.0 1.55 MB

GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application.

License: Other

PowerShell 100.00%

bloodhound gofetch powershell active-directory security blackhat2017

gofetch's People

Contributors

Stargazers

Watchers

Forkers

adolfoeliazat expert4u-rahul tmcmil av1080p ashr minkione xmycroftx avgirl xnianq jbarcia michalkoczwara olivierh59500 c0axial m00zh33 guardacyber johnjohnsp1 izogain opexxx siowcy awesome-security gub0x1 ksmaheshkumar buildgk houcy mgcfish tim1512 smrk3r wuyasec q1f3 pacejj27 manouchehri cs24 shantanu561993 tuian stevenchen0x01 s4yhell0 h0k5 selfevo aurorafang 15124585561 metaconflict topotam firefalc0n lamkeysing92 jack51706 ch4p34un0ir minhtranca seemantbisht gilmar27 ro9ueadmin ykankaya guardianrg samyoyo blackgolf nickhakkz r00t-taurus wisdark dannymas dm2333 socmap hmhsectest01 slooppe 3453-315h eltorobiz jbalanza 8l4nk darrynza balaasif6789 leomatias aarandomhacker lightoyou attackgithub imulmul aj2317 1337g red-infosec 5l1v3r1 m3g4byt3 mushfiqur47 dlangman invokethreatguy bbbking nomadh7 nocomp crackercat erangoldman skillfactorycoding ramikan despratesparten cybersecurity-labs slachet beac0n5 mandylyy

gofetch's Issues

GoFetch Python

Is python code of GoFetch is going to be out ?

Error 1053

I am running GoFetch in the following environment, but I can not execute service with error 1053.

The targets of attack are Windows 7 (32 and 64 bit) and 2018, etc., but all result in the same error.

Where is the problem?

Execution environment

The execution environment is the following two.
Both will result in the same error.

Windows7 SP1 64-bit
PowerShell3.0
.NET4.0

Windows7 SP1 32-bit
PowerShell3.0
.NET4.0

GoFetchLog

6/6/2019 1:38 PM GoFetch started on msl8-cl05
6/6/2019 1:38 PM Attack path loaded - Verifying path
6/6/2019 1:38 PM GoFetch in AdminTo
6/6/2019 1:38 PM CopyAndExecuteNext with targetComputer: MSL8-CL03 and targetUser: ******** and payload: test.bat
6/6/2019 1:38 PM Copy payload from C:\Users\********\Downloads\GoFetch\test.bat to \\MSL8-CL03\c$\GoFetch\test.bat
6/6/2019 1:38 PM Copied additional payload from C:\Users\********\Downloads\GoFetch\test.bat to \\MSL8-CL03\c$\GoFetch\test.bat
6/6/2019 1:38 PM Run Invoke-PsExec with command: cmd.exe /c C:\GoFetch\test.bat
6/6/2019 1:38 PM Invoke-PsExec additional payload command: cmd.exe /c C:\GoFetch\test.bat
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM PsExec: {0}
6/6/2019 1:38 PM CopyAndRunAdditionalPayload - Done on MSL8-CL03
6/6/2019 1:38 PM CopyAndExecuteNext - Done Invoke-PsExec on MSL8-CL03 
6/6/2019 1:38 PM Waiting to GoFetchOutput.log file in \\MSL8-CL03\c$\GoFetch\GoFetchOutput.json
6/6/2019 1:38 PM  |MSL8-CL03| - 6/6/2019 1:38 PM GoFetch started on msl8-cl03
6/6/2019 1:38 PM  |MSL8-CL03| - 6/6/2019 1:38 PM Attack path loaded - Verifying path
6/6/2019 1:38 PM  |MSL8-CL03| - 6/6/2019 1:38 PM Local GoFetchOutput.log file was created
6/6/2019 1:38 PM Prompt message: Something went wrong 
Number of exceptions 0
6/6/2019 1:39 PM Local GoFetchOutput.log file was created

Event Viewer System Log

Log Name:      System
Source:        Service Control Manager
Date:          6/6/2019 1:38:52 PM
Event ID:      7000
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      msl8-cl03.*******.jp
Description:
The TestSVC service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2019-06-06T04:38:52.686945000Z" />
    <EventRecordID>1565</EventRecordID>
    <Correlation />
    <Execution ProcessID="468" ThreadID="264" />
    <Channel>System</Channel>
    <Computer>msl8-cl03.*******.jp</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">TestSVC</Data>
    <Data Name="param2">%%1053</Data>
  </EventData>
</Event>
--------------------------------------------------
Log Name:      System
Source:        Service Control Manager
Date:          6/6/2019 1:38:52 PM
Event ID:      7009
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      msl8-cl03.*******.jp
Description:
A timeout was reached (30000 milliseconds) while waiting for the TestSVC service to connect.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7009</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2019-06-06T04:38:52.686945000Z" />
    <EventRecordID>1564</EventRecordID>
    <Correlation />
    <Execution ProcessID="468" ThreadID="264" />
    <Channel>System</Channel>
    <Computer>msl8-cl03.*******.jp</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">30000</Data>
    <Data Name="param2">TestSVC</Data>
  </EventData>
</Event>

Input string was not in a correct format

hi,
any idea what problem was ?

When I used the export-file from BloodHound , I got this error

Error: Couldn't load files - Make sure that Invoke-GoFetch.ps1 and C:\gofetch\GoFetchPath.json are in C:\gofetch and that GoFetchPath is in the right format
Error formatting a string: Input string was not in a correct format..
PS C:\gofetch>

export file - GoFetchPath.json
Where should I get pathFromBloodHound.json ?

json parsing error

Despite using the specified version of the Bloodhound client I am still getting the following error when running Invoke-GoFetch

An error occurred while enumerating through a collection: Object reference not set to an instance of an object

Can I get a steer on how to fix this ?

Execution policy restriction

I get an error that a script cannot be executed because the PowerShell execution policy doesn't allow it. And GoFetch does not run on the following machines.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.