julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add thm labs

Browse Source
This commit is contained in:
julle
2025-12-07 09:20:22 +01:00
parent a6375dde69
commit 6576804a34
16 changed files with 122 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.obsidian/graph.json
Vendored
+1 -1
View File
@@ -17,6 +17,6 @@
"repelStrength": 10,
"linkStrength": 1,
"linkDistance": 250,
"scale": 0.4444444444444444,
"scale": 0.13168724279835387,
"close": false
}
.obsidian/workspace.json
Vendored
+36 -35
View File
@@ -13,12 +13,12 @@
"state": {
"type": "markdown",
"state": {
"file": "Linux/Shell.md",
"file": "Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/21337.md",
"mode": "source",
"source": false
},
"icon": "lucide-file",
"title": "Shell"
"title": "21337"
}
}
]
@@ -94,7 +94,7 @@
"state": {
"type": "backlink",
"state": {
"file": "Linux/Shell.md",
"file": "Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Flag.md",
"collapseAll": false,
"extraContext": false,
"sortOrder": "alphabetical",
@@ -104,7 +104,7 @@
"unlinkedCollapsed": true
},
"icon": "links-coming-in",
"title": "Backlinks for Shell"
"title": "Backlinks for Flag"
}
},
{
@@ -150,7 +150,8 @@
}
],
"direction": "horizontal",
"width": 300
"width": 300,
"collapsed": true
},
"left-ribbon": {
"hiddenItems": {
@@ -166,32 +167,39 @@
},
"active": "04550972536d9a99",
"lastOpenFiles": [
"Linux/portscanning.md",
"Linux/Perm.md",
"Linux/LFI.md",
"Linux/Crontab.md",
"Linux/Cap.md",
"Linux/_etc_passwd.md",
"Linux/Tunnel/sshuttle.md",
"Linux/Tunnel/ssh.md",
"Linux/Tunnel/Socat.md",
"Linux/Tunnel/chisel.md",
"Software/php/LFI.md",
"Tools/nmap.md",
"Tools/autorecon.md",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Flag.md",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Loot.md",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/13400.md",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/21337.md",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/8000.md",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/8080.md",
"Labs/ad/cap1.md",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/Untitled",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports",
"Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155",
"Labs/THM/AOC25/Sidequest_1/Computers",
"Labs/THM/AOC25/Sidequest_1",
"Labs/THM/AOC25",
"Labs/THM",
"Proof.md",
"Labs.md",
"2024-10-28.md",
"20 EoP - Leveraging Windows Services.md",
"Windows/WWW.md",
"Windows/SMB.md",
"Windows/Scheduled Tasks.md",
"Windows/Information Gathering.md",
"Windows/Active Directory for OSCP.md",
"Windows/Tunnel/netsh.md",
"Windows/Tunnel/ligolo.md",
"Linux/LFI.md",
"Linux/Crontab.md",
"Linux/Cap.md",
"Windows/Active Directory for OSCP/Initial Access/Scan Network.md",
"Tools/nmap.md",
"MindMap/README.md",
"Linux/Tunnel/chisel.md",
"Windows/Tunnel/chisel.md",
"Windows/SMB/crackmapexec.md",
"Necronomicon/Tools/Chisel.md",
"20 EoP - Leveraging Windows Services.md",
"Labs/medtech/computers/172.16.152.0/DEV04.md",
"Tools/nc.md",
"Linux/Shell.md",
"Linux/portscanning.md",
"Linux/Perm.md",
"Linux/_etc_passwd.md",
"Windows/unnamed_b656515f39144863bbdaa2d5851c417c.png",
"MindMap/AD Mindmap/AD - OSCP.canvas",
"MindMap/WiFi/WiFi Mindmap.canvas",
@@ -214,13 +222,6 @@
"MindMap/image/Mindmap Local Port Forwarding with a Bastion host.png",
"MindMap/image",
"MindMap/WiFi",
"MindMap/Web Penetration Testing Mindmap/Web-Penetration-Testing-Mindmap.mm",
"MindMap/Web Penetration Testing Mindmap",
"MindMap/Shells",
"MindMap/SSTI",
"MindMap/Privilege escalation Mindmap",
"MindMap/Pivotting-tunnels",
"MindMap/LICENSE",
"MindMap/File-Transfer"
"MindMap/Web Penetration Testing Mindmap/Web-Penetration-Testing-Mindmap.mm"
]
}
Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Flag.md
+3
View File
@@ -0,0 +1,3 @@
Flag 1 : THM{h0pp1ing_m4d} (cells/storage)
Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Loot.md
+11
View File
@@ -0,0 +1,11 @@
Key : now_you_see_me
-----
Hopkins :
guard.hopkins@hopsecasylum.com
Pizza1234$
-------
Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/13400.md
+7
View File
@@ -0,0 +1,7 @@
http://10.81.169.155:13400/
1. password: "Johnnyboy1982!"
2. username: "guard.hopkins@hopsecasylum.com"
guard-hopkins-sr
Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/21337.md
+4
View File
@@ -0,0 +1,4 @@
Unlock other ports :
http://10.81.169.155:21337/
key : now_you_see_me
Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/8000.md
+15
View File
@@ -0,0 +1,15 @@
Fakebook
http://10.81.169.155:8000/
create user :
aa : G7tP3xQa
Hopkins :
guard.hopkins@hopsecasylum.com
Pizza1234$
Johnnyboy
DoorDasher
Labs/THM/AOC25/Sidequest_1/Computers/10.81.169.155/Ports/8080.md
+7
View File
@@ -0,0 +1,7 @@
Get flags service :
http://10.81.169.155:8080/
To bypass the login , paste in console : document.getElementById("loginWindow").style.display = "none";
document.getElementById("mapScreen").style.display = "block";
Linux/Tunnel/chisel.md
+3 -1
View File
@@ -1,2 +1,4 @@
client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:**10.4.228.215**### :::4242
client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:chisel client 192.168.45.224:4242 R:4343:**10.4.228.215**### :::4242
See [[Necronomicon/Tools/Chisel]] for a cleaner command matrix and [[Windows/Tunnel/chisel]] for the Windows-side syntax. The pivoting mind maps in [[MindMap/README]] cover wider tunnel options when chisel is blocked.
Linux/portscanning.md
+3 -1
View File
@@ -1 +1,3 @@
for i in $(seq 1 254.; do nc -zv -w 1 172.16.228.$i 445; done
for i in $(seq 1 254.; do nc -zv -w 1 172.16.228.$i 445; done
For fuller scans see [[Tools/nmap]] and [[Tools/autorecon]]; they pair well with SSH tunnels in [[Linux/Tunnel/ssh]] when only restricted access is available.
Tools/autorecon.md
+3 -1
View File
@@ -5,4 +5,6 @@ autorecon <target>
```
proxychains -q autorecon 10.1.1.65 --proxychains
```
```
Related notes: [[Tools/nmap]] for follow-up port scans and [[Windows/Information Gathering]] for host recon once access is gained.
Tools/nc.md
+8
View File
@@ -0,0 +1,8 @@
## Connect to filtred port
```
nebi@htb[/htb]$ ncat -nv --source-port 53 10.129.2.28 50000
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Connected to 10.129.2.28:50000.
220 ProFTPd
```
Tools/nmap.md
+3 -1
View File
@@ -55,4 +55,6 @@ sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace
```bash
sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53
```
```
See also: [[Tools/autorecon]] for automated port discovery, [[Linux/portscanning]] for quick Bash loops, and [[Windows/Active Directory for OSCP/Initial Access/Scan Network]] when nmap has to run through proxychains in AD-heavy networks.
Windows/Active Directory for OSCP.md
+9
View File
@@ -1,3 +1,12 @@
<https://whimsical.com/active-directory-YJFeAhW9GMtmLX4SWxKCCM> (Follow Mind map for nodes)
![unnamed_b656515f39144863bbdaa2d5851c417c](unnamed_b656515f39144863bbdaa2d5851c417c.png)
## Quick links
- Initial access: [[Windows/Active Directory for OSCP/Initial Access/Scan Network]], [[Windows/Active Directory for OSCP/Initial Access/Get User List]], [[Windows/Active Directory for OSCP/Initial Access/LDAP Search]], [[Windows/Active Directory for OSCP/Initial Access/SMB Shares]]
- Enumeration: [[Windows/Active Directory for OSCP/Enumeration]], [[Windows/Active Directory for OSCP/Enumeration/net cmd]], [[Windows/Active Directory for OSCP/Enumeration/PowerView Enumeration]], [[Windows/Active Directory for OSCP/Enumeration/script]]
- Low hanging fruit: [[Windows/Active Directory for OSCP/Low Hanging Fruit/Null Login]], [[Windows/Active Directory for OSCP/Low Hanging Fruit/Group Policy in SYSVOL]]
- Valid credentials handling: [[Windows/Active Directory for OSCP/Valid Credentials/CrackHash]], [[Windows/Active Directory for OSCP/Valid Credentials/Kerberoasting]], [[Windows/Active Directory for OSCP/Valid Credentials/Runas (Invoke-RunasCs)|Runas (Invoke-RunasCs)]], [[Windows/Active Directory for OSCP/Valid Credentials/BloodHound]]
- Usernames without passwords: [[Windows/Active Directory for OSCP/We have User Name but no Password/Password Spray]], [[Windows/Active Directory for OSCP/We have User Name but no Password/ASREP Roast]]
- Lateral movement: [[Windows/Active Directory for OSCP/Lateral Movement/RDP]], [[Windows/Active Directory for OSCP/Lateral Movement/Win-RM]], [[Windows/Active Directory for OSCP/Lateral Movement/Pass-The-Hash [psexec, impacket, CME]]], [[Windows/Active Directory for OSCP/Lateral Movement/DCOM]], [[Windows/Active Directory for OSCP/Lateral Movement/Credential SAM dumping]], [[Windows/Active Directory for OSCP/Lateral Movement/Interactive Shell]], [[Windows/Active Directory for OSCP/Lateral Movement/Pseudo-Shell]]
- Credential dumping and data handling: [[Windows/Active Directory for OSCP/Mimikatz]], [[Windows/Active Directory for OSCP/NTDS.dir cracking with SYSTEM]], [[Windows/Active Directory for OSCP/Permission Move/DC Sync]]
Windows/Information Gathering.md
+6 -1
View File
@@ -7,4 +7,9 @@
- Running processes`
<https://github.com/itm4n/PrivescCheck>
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML"
## Deep dives
- Host basics: [[Windows/Information Gathering/Username and Hostname]], [[Windows/Information Gathering/Network]], [[Windows/Information Gathering/History]]
- Local discovery: [[Windows/Information Gathering/Locate files]], [[Windows/Information Gathering/Installed Program]]
- Related tools and scans: [[Tools/nmap]], [[Tools/autorecon]], [[Windows/SMB/crackmapexec]]
Windows/Tunnel/chisel.md
+3 -1
View File
@@ -1 +1,3 @@
`chisel client 192.168.45.206:443 R:socks`
`chisel client 192.168.45.206:443 R:socks`
See also [[Necronomicon/Tools/Chisel]] for more forwarding patterns and the Linux usage cheats in [[Linux/Tunnel/chisel]].