julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add thm labs

Browse Source
This commit is contained in:
julle
2025-12-07 09:20:22 +01:00
parent a6375dde69
commit 6576804a34
16 changed files with 122 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Windows/Active Directory for OSCP.md
+9
View File
@@ -1,3 +1,12 @@
<https://whimsical.com/active-directory-YJFeAhW9GMtmLX4SWxKCCM> (Follow Mind map for nodes)
![unnamed_b656515f39144863bbdaa2d5851c417c](unnamed_b656515f39144863bbdaa2d5851c417c.png)
## Quick links
- Initial access: [[Windows/Active Directory for OSCP/Initial Access/Scan Network]], [[Windows/Active Directory for OSCP/Initial Access/Get User List]], [[Windows/Active Directory for OSCP/Initial Access/LDAP Search]], [[Windows/Active Directory for OSCP/Initial Access/SMB Shares]]
- Enumeration: [[Windows/Active Directory for OSCP/Enumeration]], [[Windows/Active Directory for OSCP/Enumeration/net cmd]], [[Windows/Active Directory for OSCP/Enumeration/PowerView Enumeration]], [[Windows/Active Directory for OSCP/Enumeration/script]]
- Low hanging fruit: [[Windows/Active Directory for OSCP/Low Hanging Fruit/Null Login]], [[Windows/Active Directory for OSCP/Low Hanging Fruit/Group Policy in SYSVOL]]
- Valid credentials handling: [[Windows/Active Directory for OSCP/Valid Credentials/CrackHash]], [[Windows/Active Directory for OSCP/Valid Credentials/Kerberoasting]], [[Windows/Active Directory for OSCP/Valid Credentials/Runas (Invoke-RunasCs)|Runas (Invoke-RunasCs)]], [[Windows/Active Directory for OSCP/Valid Credentials/BloodHound]]
- Usernames without passwords: [[Windows/Active Directory for OSCP/We have User Name but no Password/Password Spray]], [[Windows/Active Directory for OSCP/We have User Name but no Password/ASREP Roast]]
- Lateral movement: [[Windows/Active Directory for OSCP/Lateral Movement/RDP]], [[Windows/Active Directory for OSCP/Lateral Movement/Win-RM]], [[Windows/Active Directory for OSCP/Lateral Movement/Pass-The-Hash [psexec, impacket, CME]]], [[Windows/Active Directory for OSCP/Lateral Movement/DCOM]], [[Windows/Active Directory for OSCP/Lateral Movement/Credential SAM dumping]], [[Windows/Active Directory for OSCP/Lateral Movement/Interactive Shell]], [[Windows/Active Directory for OSCP/Lateral Movement/Pseudo-Shell]]
- Credential dumping and data handling: [[Windows/Active Directory for OSCP/Mimikatz]], [[Windows/Active Directory for OSCP/NTDS.dir cracking with SYSTEM]], [[Windows/Active Directory for OSCP/Permission Move/DC Sync]]
Windows/Information Gathering.md
+6 -1
View File
@@ -7,4 +7,9 @@
- Running processes`
<https://github.com/itm4n/PrivescCheck>
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"
## Deep dives
- Host basics: [[Windows/Information Gathering/Username and Hostname]], [[Windows/Information Gathering/Network]], [[Windows/Information Gathering/History]]
- Local discovery: [[Windows/Information Gathering/Locate files]], [[Windows/Information Gathering/Installed Program]]
- Related tools and scans: [[Tools/nmap]], [[Tools/autorecon]], [[Windows/SMB/crackmapexec]]
Windows/Tunnel/chisel.md
+3 -1
View File
@@ -1 +1,3 @@
`chisel client 192.168.45.206:443 R:socks`
`chisel client 192.168.45.206:443 R:socks`
See also [[Necronomicon/Tools/Chisel]] for more forwarding patterns and the Linux usage cheats in [[Linux/Tunnel/chisel]].