first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,11 @@
+- Note; a lot of this info is also contained in the "Windows" and "PowerShell" sections; this is for miscellaneous AD enum
+
+- Enumerate all nested members of a group or all nested groups of a user with a raw LDAP query using OID
+	- `net ads search -k -s ad. local '(CN=Domain Admins)' memberof`
+		- Get groups of which "Domain Admins" is a member, without OID
+	- `net ads search -k -5 ad. local '(member:1.2.840.113556.1.4.1941:=CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn`
+		- Use OID to walk the nested groups and find out that Domain Admins is actually a member of more groups
+	- `net ads search -k -s ad. local '(CN=Domain Admins)' member`
+		- Find members of Domain Admins group without OID
+	- `net ads search -k -5 ad.local '(memberof:1.2.840.113556.1.4.1941: =CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn`
+		- Use OID to walk nested groups and get ALL effective members of Domain Admins
@@ -0,0 +1,15 @@
+- Zone Transfer
+	- `dig @<server IP> ironcorp.me axfr`
+	- `nslookup ls -d <domain name>`
+- Extract all DNS records via LDAP (requires domain user)
+	- `adidnsdump -u contoso\\Anakin contoso.local`
+- DNSRecon
+	- `dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml`
+- Internal Network
+	- `nmap --script broadcast-dhcp-discover`
+		- Uses DHCP Discover requests to enumerate the current domain
+	- Get a list of domain controllers (replace domain.local with domain name)
+		- `dig -t SRV _gc._tcp.domain.local`
+		- `dig -t SRV _ldap._tcp.domain.local`
+		- `dig -t SRV _kerberos._tcp.domain.local`
+		- `dig -t SRV _kpasswd._tcp.domain.local`
@@ -0,0 +1,45 @@
+- Find
+	- Find SUID binaries
+		- `find / -perm -u=s -type f 2>/dev/null`
+	- Find SGID binaries
+		- `find / -perm -g=s -type f 2>/dev/null`
+	- Find sticky-bit binaries
+		- `find / -perm -1000 -type d 2>/dev/null`
+- Containerized environments (docker)
+	- Determine whether you're in a containerized environment by evaluating the process with PID 1 in `/proc`
+		- Command line attributes
+			- `cat /proc/1/cmdline`
+				- The command starting the first process in a typical Linux system will be `/sbin/init` or `/usr/lib/systemd`; in a container it will often be `/bin/sh` or `/bin/bash`
+		- Control Groups
+			- `cat /proc/1/cgroup`
+				- There will be mentions of "docker" or the other containerization tool being used here
+		- Mounts
+			- `cat /proc/1/mounts`
+				- Again, look for mentions of "docker" or similar
+	- CHECK ENVIRONMENT VARIABLES - containers are usually passed important data for their application and basic operation through environment variables. You'll often find access keys, session tokens, secrets, Kubernetes information, and other stuff.
+		- Look in `.env` files in application's directory
+	- Privileged mode
+		- Check for this by checking `/dev`; a typical docker container will only have a few devices listed in here, but a typical Linux system will have many. In a privileged container, you'll be able to see the many devices present on the main system.
+			- `tty` devices are usually a dead giveaway to a privileged container
+		- Exploitation
+			- Privileged containers allow the container to modify any aspects of the home system. Mount the main partition and write an SSH key into `/root/.ssh/authorized_keys`, modify `/etc/passwd`, or whatever.
+				1. Find main partition
+					- `fdisk -l`
+					- For Linux machines in AWS, the main device is usually `/dev/xvda` and the main partition is usually `/dev/xvda1`
+				1. Mount the main partition
+					- `mkdir /mnt/cthulhu; mount <main_partition> /mnt/cthulhu`
+				2. Modify `authorized_keys` or `/etc/passwd`.
+	- Capabilities
+		- Check what capabilities your docker container has
+			- `cat /proc/self/status | grep Cap`
+		- Decode the capabilities to make them readable
+			- `capsh --decode=<hex_capability_identifier>`
+	- Docker socket
+		- Docker exposes a REST API so that containers can communicate with the docker daemon on the host. If it can be reached from within the container, commands can be directed at Docker itself to start a privileged container and escalate permissions/escape.
+		- Check for the docker socket from within container:
+			- `curl --unix-socket /var/run/docker.sock http://localhost/images/json`
+			- `ls /var/run/docker.sock`
+			- `mount | grep docker`
+		- Docker socket has to be interacted with through curl, but the basic command to start a privileged container with the socket mounted:
+			- `docker run --privileged 1 -v /:/hostOS -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -d <image>`
+
@@ -0,0 +1,14 @@
+- Enum4Linux
+	- `enum4linux –a 10.0.0.1`
+	- `python3 enum4linux-ng <IP>`
+- RPCBind
+	- `rpcinfo –p x.x.x.x`
+- Scan subnet for Windows/Samba
+	- `nbtscan x.x.x.x`
+- Nmap
+	- `nmap IPADDR --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse`
+- SMBClient
+	- List available shares
+		- `smbclient -L //INSERTIPADDRESS/`
+	- Browse share
+		- `smbclient //INSERTIPADDRESS/ipc$ -U john`
@@ -0,0 +1,10 @@
+- SNMPWalk
+	- `snmpwalk -c public -v1 10.0.0.0`
+- SNMPCheck
+	- `snmpcheck -t 192.168.1.X -c public`
+- OneSixtyOne
+	- `onesixtyone -c names -i hosts`
+- Nmap
+	- `nmap -sT -p 161 192.168.X.X -oG snmp_results.txt`
+- SNMPEnum
+	- `snmpenum -t 192.168.1.X`