ka kaywoz

ProxMox Cluster - Soup-to-Nutz

aka what i did to get from nothing to done.

note: these are designed to be primarily a re-install guide for myself (writing things down helps me memorize the knowledge), as such don't take any of this on blind faith - some areas are well tested and the docs are very robust, some items, less so). YMMV

Purpose of Proxmox cluster project

Required Outomces of cluster project

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

	:root {
	--min-item-width: 28ch;
	--max-item-width: .5fr;
	--grid-spacing: .25rem;
	--item-padding: .25rem;
	}

	/* Let items expand on small screens */
	@media (max-width: 600px) {
	:root {

	<item>
	<tunable>net.inet.icmp.drop_redirect</tunable>
	<value>1</value>
	<descr/>
	</item>
	<item>
	<tunable>net.isr.bindthreads</tunable>
	<value>1</value>
	<descr/>
	</item>

	# Simple script to check drivers in C:\windows\system32\drivers against the loldrivers list
	# Author: Oddvar Moe - @oddvar.moe

	$drivers = get-childitem -Path c:\windows\system32\drivers
	$web_client = new-object system.net.webclient
	$loldrivers = $web_client.DownloadString(" https://www.loldrivers.io/api/drivers.json") \| ConvertFrom-Json

	Write-output("Checking {0} drivers in C:\windows\system32\drivers against loldrivers.io json file" -f $drivers.Count)
	foreach ($lol in $loldrivers.KnownVulnerableSamples)
	{

	#Usage:
	#
	#NOTE: The script expects an argument which is the full File Path of the EVTX file.
	#
	#C:\>ExtractAllScripts.ps1
	#The default behavior of the script is to assimilate and extract every script/command to disk.
	#
	#C:\ExtractAllScripts -List
	#This will only list Script Block IDs with associated Script Names(if logged.)
	#

	from oletools.olevba import VBA_Parser, TYPE_OLE, TYPE_OpenXML, TYPE_Word2003_XML, TYPE_MHTML
	import sys
	import re

	vbaparser = VBA_Parser(sys.argv[1])

	replace_regex = r"\s([^=]+)\s=\sReplace\(\s([^,]+)\s,\s\"([^,])\"\s,\s\"([^,])\"\s*\)"
	replace = re.compile(replace_regex, re.MULTILINE)

	regex_url = "http(s)?://[^,\"]+"

	#include <Windows.h>

	LONG SingleStepEncryptDecrypt(EXCEPTION_POINTERS* ExceptionInfo);
	typedef VOID(__stdcall* Shellcode)();

	LPBYTE ShellcodeBuffer;
	ULONG_PTR PreviousOffset;
	ULONG_PTR CurrentOffset;
	ULONGLONG InstructionCount;
	DWORD dwOld;

	#!/usr/bin/env python
	# -- coding: utf-8 --
	# Thomas Roccia \| IconDhash.py
	# pip3 install lief
	# pip3 install pillow
	# resource: https://www.hackerfactor.com/blog/?/archives/529-Kind-of-Like-That.html

	import lief
	import os
	import argparse