Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Active Directory - Gain Foothold
  - Aquire credentials
    - OSINT
    - Phishing
  - NTLM Authenticated Services
  - LDAP Bind Credentials
    - LDAP Pass-Back
  - Authentication Relay
    - Capture via responder
    - Relay via responder
  - Microsoft Deployment Toolkit (MDT)
    - Preboot Execution Environment (PXE)
  - Configuration Files

# Active Directory - Gain Foothold

- Methods of aquiring the first set of credentials

## Aquire credentials

### OSINT

- Discover info about the target via
  - Questions asked on Stack Overflow
  - Credentials set in (github) repos
  - Past breaches, haveIbeenpwned, DeHashed

### Phishing

- Gain credentials via eMail

## NTLM Authenticated Services

- Windows Authentication on NetNTLM is a Challenge-Response protocol used to deliver a challenge and the result on behalf of a user -- through the application -- to the DC

- These may be exposed to the Internet. For example

  - Mail exchange, OWA webmail
  - RDP
  - VPN endpoints
  - Web applications using something like SSO via AD

- Use these applications to either brute force / spraying passwords to found IDs or to verify previously aquired IDs and their passwords

## LDAP Bind Credentials

- LDAP may be integrated into an AD Forest. An application may verify an LDAP account with the help of AD credentials at the DC.
- Third party programs may use LDAP like
  - CUPS
  - VPNs
  - gitlab

### LDAP Pass-Back

- After gaining access to a device's config including LDAP parameters, reroute its IP to your own IP. This may be done via web UIs.
- Use an LDAP server to catch the credentials. Only PLAIN and LOGIN authentication must be allowed in order to gain the credentials.
  - OpenLDAP

    dpkg-reconfigure -p low slapd

    * Skip reconfiguration -> No
    * Insert DNS domain and organisation
    * Provide password
    * Select `MDB` as database
    * No removal when db is purged
    * Move old database when creating a new one
    * Downgrade authentication via `*.ldif` file

    dn: cn=config
    replace: olcSaslSecProps
    olcSaslSecProps: noanonymous,minssf=0,passcred

    * Patch and reload ldap

    sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart

    * Check via

    ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms

- Make pcap via tcdump

## Authentication Relay

- Communcating services inside the network verify authentication of each other
- Intercept NTLM hashes send for example via `SMB` auth, or do a MITM
- Use responder poisons requests gained from
  - Link-Local Multicast Name Resolution (LLMNR)
  - NetBIOS Name Server (NBT-NS), send before LLMNR
  - Web Proxy Auto-Discovery (WPAD), finds proxies for future HTTP connections

### Capture via responder

- Run responder on LAN via

    sudo responder -I <interface>

- Use `hashcat` to crack the hashes

    hashcat -m 5600 hash.txt rockyout.txt --force

### Relay via responder

- `SMB` signing must not be enforced, either on or off
- Done after some intial enumeration and to gain administrative accounts

## Microsoft Deployment Toolkit (MDT)

- Deploy and patch software remotely
- Used in conjuction with Microsoft's System Center Configuration Manager (SCCM)

### Preboot Execution Environment (PXE)

- Read this

- Load and install OS via network

- `MDT` provisions PXE boot images
- An IP gained via `DHCP` is the validation step, PXE will be delivered by `MDT`

- Retrieve/enumerate images via `TFTP`

- Create an admin account after OS installation

- Password scraping to recover AD creds used during OS installation

- Use `PowerPXE.ps1` to extract `*.bcd` files

## Configuration Files

- Configurations of services and applications as well as registry keys
- Use enumeration scripts like `winpeas.sh` or `seatbelt`