From fa490c856214911904026c980b58ac5d30bffb72 Mon Sep 17 00:00:00 2001 From: whx Date: Fri, 11 Nov 2022 01:15:07 +0100 Subject: [PATCH] restructured Post Exploitation --- Post Exploitation/C2.md | 45 + Post Exploitation/Empire.md | 82 + Post Exploitation/Enum on Target.md | 106 + Post Exploitation/IDS & IPS Evasion.md | 114 + Post Exploitation/Linux PrivEsc.md | 81 + Post Exploitation/Man in the Middle.md | 31 + Post Exploitation/Metasploit.md | 90 + Post Exploitation/NFS Root Squash.md | 13 + Post Exploitation/Pivoting.md | 230 + .../Privilege Escalation/LinEnum.sh | 1352 + .../Privilege Escalation/dirtyC0w.c | 131 + .../Privilege Escalation/library_path.c | 10 + .../Privilege Escalation/linpeas.sh | 5657 ++++ .../linux-exploit-suggester-2.pl | 694 + .../linux-exploit-suggester.sh | 1429 + .../linux-smart-enumeration.sh | 4652 +++ .../Privilege Escalation/mysql_raptor_udf2.c | 93 + .../Privilege Escalation/nginxed-root.sh | 229 + .../Privilege Escalation/preload.c | 9 + .../suid/exim/cve-2016-1531.sh | 23 + .../Privilege Escalation/suid/find_suids.sh | 10 + .../Privilege Escalation/suid/libcalc.c | 9 + .../Privilege Escalation/suid/service.c | 4 + .../Privilege Escalation/write_etc_passwd.sh | 18 + Post Exploitation/References.md | 55 + Post Exploitation/Windows/Add Users.md | 16 + .../Windows/Antivirus Evasion.md | 188 + Post Exploitation/Windows/Applocker.md | 15 + Post Exploitation/Windows/CrackMapExec.md | 25 + .../Windows/Evade Event Tracing.md | 96 + .../Windows/Living off the Land.md | 60 + Post Exploitation/Windows/Mimikatz.md | 48 + Post Exploitation/Windows/Pass the Hash.md | 12 + Post Exploitation/Windows/Powershell Logs.md | 22 + .../Powershell Scripts/ADPentestLab.ps1 | 412 + .../Windows/Powershell Scripts/ADRecon.ps1 | 12056 +++++++ .../Powershell Scripts/Azure-ADConnect.ps1 | 59 + .../Windows/Powershell Scripts/Bypass-UAC.ps1 | 1558 + .../Powershell Scripts/CVE-2018-16156.ps1 | 64 + .../Powershell Scripts/Chachi-Enumerator.ps1 | 1135 + ...SYSVOL-Replication-Latency-Convergence.ps1 | 546 + .../Powershell Scripts/DSInternals_v4.3.zip | Bin 0 -> 1561295 bytes .../DomainPasswordSpray.ps1 | 546 + .../Execute-Command-MSSQL.ps1 | 177 + .../Get-DecryptedCpassword.ps1 | 36 + .../Powershell Scripts/Get-GPPPassword.ps1 | 247 + .../Powershell Scripts/Get-PasswordFile.ps1 | 133 + .../Windows/Powershell Scripts/Get-SPN.ps1 | 274 + .../Powershell Scripts/Get-WindowsKey.ps1 | 40 + .../Windows/Powershell Scripts/GetSystem.ps1 | 162 + .../Invoke-IFileOperation.ps1 | 49 + .../Powershell Scripts/Invoke-Mimikatz.ps1 | 2744 ++ .../Powershell Scripts/Invoke-NinjaCopy.ps1 | 2834 ++ .../Windows/Powershell Scripts/PowerView.ps1 | 11329 +++++++ .../Windows/Powershell Scripts/Rubeus.exe | Bin 0 -> 212480 bytes .../Windows/Powershell Scripts/SharpHound.ps1 | 513 + .../Windows/Powershell Scripts/Sharphound.exe | Bin 0 -> 832512 bytes .../Windows/Powershell Scripts/Tater.ps1 | 1817 ++ .../attackdefence.com-walkthrough-2143.pdf | Bin 0 -> 3308254 bytes .../Windows/Powershell Scripts/cmd.asp | 45 + .../Windows/Powershell Scripts/mimikatz.exe | Bin 0 -> 1261832 bytes .../Windows/Powershell Scripts/powercat.ps1 | 948 + .../Windows/Powershell Scripts/powerup.ps1 | 4011 +++ .../Windows/Powershell Scripts/powerupsql.ps1 | 26119 ++++++++++++++++ .../Powershell Scripts/powerview-dev.ps1 | 20914 +++++++++++++ .../Windows/Powershell Scripts/powerview.ps1 | 20901 +++++++++++++ .../Powershell Scripts/puckieshell443.ps1 | 127 + .../Windows/Powershell Scripts/rev.ps1 | 127 + .../Windows/Powershell Scripts/sharphound.exe | Bin 0 -> 779776 bytes .../windows-service-accounts-enumeration.ps1 | 134 + Post Exploitation/Windows/Powershell.md | 24 + .../Privilege Escalation/Autoruns64.exe | Bin 0 -> 844464 bytes .../Privilege Escalation/accesschk64.exe | Bin 0 -> 402608 bytes .../Windows/Privilege Escalation/winPEAS.bat | 654 + .../Privilege Escalation/winPEASx64.exe | Bin 0 -> 1968640 bytes Post Exploitation/Windows/Registry.md | 7 + .../Windows/SebackupPrivilege.md | 29 + Post Exploitation/Windows/Secretsdump.md | 23 + .../Windows/Signature Evasion.md | 100 + .../Windows/User Account Control.md | 129 + Post Exploitation/Windows/Windows PrivEsc.md | 488 + Post Exploitation/pspy.md | 5 + 82 files changed, 127165 insertions(+) create mode 100644 Post Exploitation/C2.md create mode 100644 Post Exploitation/Empire.md create mode 100644 Post Exploitation/Enum on Target.md create mode 100644 Post Exploitation/IDS & IPS Evasion.md create mode 100644 Post Exploitation/Linux PrivEsc.md create mode 100644 Post Exploitation/Man in the Middle.md create mode 100644 Post Exploitation/Metasploit.md create mode 100644 Post Exploitation/NFS Root Squash.md create mode 100644 Post Exploitation/Pivoting.md create mode 100755 Post Exploitation/Privilege Escalation/LinEnum.sh create mode 100644 Post Exploitation/Privilege Escalation/dirtyC0w.c create mode 100644 Post Exploitation/Privilege Escalation/library_path.c create mode 100644 Post Exploitation/Privilege Escalation/linpeas.sh create mode 100755 Post Exploitation/Privilege Escalation/linux-exploit-suggester-2.pl create mode 100755 Post Exploitation/Privilege Escalation/linux-exploit-suggester.sh create mode 100644 Post Exploitation/Privilege Escalation/linux-smart-enumeration.sh create mode 100644 Post Exploitation/Privilege Escalation/mysql_raptor_udf2.c create mode 100755 Post Exploitation/Privilege Escalation/nginxed-root.sh create mode 100644 Post Exploitation/Privilege Escalation/preload.c create mode 100755 Post Exploitation/Privilege Escalation/suid/exim/cve-2016-1531.sh create mode 100755 Post Exploitation/Privilege Escalation/suid/find_suids.sh create mode 100644 Post Exploitation/Privilege Escalation/suid/libcalc.c create mode 100644 Post Exploitation/Privilege Escalation/suid/service.c create mode 100755 Post Exploitation/Privilege Escalation/write_etc_passwd.sh create mode 100644 Post Exploitation/References.md create mode 100644 Post Exploitation/Windows/Add Users.md create mode 100644 Post Exploitation/Windows/Antivirus Evasion.md create mode 100644 Post Exploitation/Windows/Applocker.md create mode 100644 Post Exploitation/Windows/CrackMapExec.md create mode 100644 Post Exploitation/Windows/Evade Event Tracing.md create mode 100644 Post Exploitation/Windows/Living off the Land.md create mode 100644 Post Exploitation/Windows/Mimikatz.md create mode 100644 Post Exploitation/Windows/Pass the Hash.md create mode 100644 Post Exploitation/Windows/Powershell Logs.md create mode 100644 Post Exploitation/Windows/Powershell Scripts/ADPentestLab.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/ADRecon.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Azure-ADConnect.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Bypass-UAC.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/CVE-2018-16156.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Chachi-Enumerator.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Check-SYSVOL-Replication-Latency-Convergence.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/DSInternals_v4.3.zip create mode 100644 Post Exploitation/Windows/Powershell Scripts/DomainPasswordSpray.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Execute-Command-MSSQL.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Get-DecryptedCpassword.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Get-GPPPassword.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Get-PasswordFile.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Get-SPN.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Get-WindowsKey.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/GetSystem.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Invoke-IFileOperation.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Invoke-Mimikatz.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Invoke-NinjaCopy.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/PowerView.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Rubeus.exe create mode 100644 Post Exploitation/Windows/Powershell Scripts/SharpHound.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/Sharphound.exe create mode 100644 Post Exploitation/Windows/Powershell Scripts/Tater.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/attackdefence.com-walkthrough-2143.pdf create mode 100644 Post Exploitation/Windows/Powershell Scripts/cmd.asp create mode 100644 Post Exploitation/Windows/Powershell Scripts/mimikatz.exe create mode 100644 Post Exploitation/Windows/Powershell Scripts/powercat.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/powerup.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/powerupsql.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/powerview-dev.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/powerview.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/puckieshell443.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/rev.ps1 create mode 100644 Post Exploitation/Windows/Powershell Scripts/sharphound.exe create mode 100644 Post Exploitation/Windows/Powershell Scripts/windows-service-accounts-enumeration.ps1 create mode 100644 Post Exploitation/Windows/Powershell.md create mode 100755 Post Exploitation/Windows/Privilege Escalation/Autoruns64.exe create mode 100755 Post Exploitation/Windows/Privilege Escalation/accesschk64.exe create mode 100644 Post Exploitation/Windows/Privilege Escalation/winPEAS.bat create mode 100644 Post Exploitation/Windows/Privilege Escalation/winPEASx64.exe create mode 100644 Post Exploitation/Windows/Registry.md create mode 100644 Post Exploitation/Windows/SebackupPrivilege.md create mode 100644 Post Exploitation/Windows/Secretsdump.md create mode 100644 Post Exploitation/Windows/Signature Evasion.md create mode 100644 Post Exploitation/Windows/User Account Control.md create mode 100644 Post Exploitation/Windows/Windows PrivEsc.md create mode 100644 Post Exploitation/pspy.md diff --git a/Post Exploitation/C2.md b/Post Exploitation/C2.md new file mode 100644 index 0000000..4b43462 --- /dev/null +++ b/Post Exploitation/C2.md @@ -0,0 +1,45 @@ +# Command and Control + +* [Matrix](https://www.thec2matrix.com/) +* [bcsecurity](https://www.bc-security.org/) maintains Empire 4 +* [Empire](https://github.com/BC-SECURITY/Empire.git) +* [Armitage](https://gitlab.com/kalilinux/packages/armitage.git) +* [Covenant](https://github.com/cobbr/Covenant) +* [Sliver](https://github.com/BishopFox/sliver) + +* Server + * Listener +* Payloads/Agents + * Staged/Dropper + * Stageless +* Beacons from Agents, disguised through jitter +* Modules + * Post Exploitation + * Pivoting + +## Domain Fronting + +* Use a Domain on the C2 server +* User Cloudflare to proxy the request and responses to and from the target +* Use HTTPs for channel encryption + +## Profiles + +* Server evaluates by custom user-agents to identify agents + +## Types + +* Std listener, TCP or UDP +* HTTP/HTTPS, counter FW +* DNS, if internet access of the target is flaky +* SMB, counter network segments + +## Redirector + +* Apache or nginx as reverse proxy in front of the c2 server +* FW is still needed in front of the redirector +* These get burned instead of the c2 + + + + diff --git a/Post Exploitation/Empire.md b/Post Exploitation/Empire.md new file mode 100644 index 0000000..7edb7fe --- /dev/null +++ b/Post Exploitation/Empire.md @@ -0,0 +1,82 @@ +# Empire C2 + +* [Empire Repo](https://github.com/BC-SECURITY/Empire.git) + +## Start Client and Server +```sh +poetry run python empire --server --rest --notifications +poetry run python empire.py client +``` + +## Parts +* __Listeners__ receive connections from stagers +* __Stagers__ payloads generated, for example a reverse, delivery mechanism for agents +* __Agents__ remote on target device tasks +* __Modules__ use modularized payload on agents +* __Credentials__ +* __Report__ information on devices + +* Results are stored in a DB + +## Commands +### uselistener +* Example +```sh +uselistener http +``` +* msf like commands, run listener +```sh +set