Shuciran Pentesting Notes

MSSQL (tcp-1433)

Connection impacket-mssqlclient sa@10.11.1.31 -p 1433 -db tempdb # Sometimes you need to specify a Windows Authentication impacket-mssqlclient Archetype/sql_svc:M3g4c0rp123@10.129.95.187 -windows-...

22/01/2023 01 Enumeration, MSSQL (tcp-1433)

Password Spraying

Crackmapexec While executing a Password Spraying attack with crackmapexec always run the --continue-on-success flag, sometimes there are some cases when two users can have the same password cr...

21/01/2023 12 Active Directory, AD - Enumeration

Creds.xml

In order to create an XML file with credentials via powershell we can run the following commands: C:\Users\nico\Desktop> $credential = Get-Credential C:\Users\nico\Desktop> $credential | Exp...

05/01/2023 12 Active Directory, Authentication

Domain Admin Techniques

This is a collection of techniques to get Domain Admin via multiple techniques. Assign user to a group Import-Module ./PowerView.ps1 $SecPassword = ConvertTo-SecureString 'JDg0dd1s@d0p3cr3@t0r' -As...

02/01/2023 12 Active Directory, Privilege Escalation

Firefox Cache Passwords

Firefox Cache passwords First go to the path file session for the user: # For Windows: C:\\Users\\nikk37\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\br53rxeg.default-release # For Linux /.mozi...

02/01/2023 04 Privilege Escalation, Firefox Cache Password

RDP Remote Login

RDP into a remote machine XFREERDP To access windows via port tcp-3389 into a system: /u - user /p - password /w - weight /h - height /v - remote machine xfreerdp /u:JohnDoe /p:Pwd1...

26/12/2022 02 Lateral Movement, RDP Remote Login

Dumping SAM

Traditional dumping In order to dump the same, two register keys must be retrieved: reg save hklm\sam c:\sam reg save hklm\system c:\system You need to use impacket-secretsdump to retrieve hash...

16/12/2022 12 Active Directory, Persistence

MS17-010

IIS 5.0 In order to exploit an IIS 5.0 server the zzz_exploit.py script that is to be found here: MS17-010 is the best choice, first of all we need to create a virtual environment with python as t...

16/12/2022 06 Exploitation, MS17-010

Python Virtual Environment

For python2 and Kali check this article: pyenv installation PyEnv Install dependencies: sudo apt install -y build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev wget cu...

15/12/2022 05 Utilities, Python Virtual Environment

MariaDB/MySQL UDF Exploitation

Now that we are connected, we can look at what privileges we have as the wp user and get a better idea of how this MariaDB instance is configured. MariaDB [(none)]> SHOW Grants; +--------------...

11/12/2022 06 Exploitation, MariaDB/MySQL UDF Exploitation