Shuciran Pentesting Notes

SeImpersonatePrivilege

JuicyPotato The tool takes advantage of the SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege if enabled on the machine to elevate the local privileges to System. Normally, these privileges ...

22/01/2023 04 Privilege Escalation, Windows - SeImpersonatePrivilege/SeAssignPrimaryTokenPrivilege

Web Fuzzing

WFUZZ Basic Fuzzing: wfuzz -c -t 200 --hc 404 -w /usr/share/seclists/Discovery/Web-Content/IIS.fuzz.txt -u http://10.10.10.203/FUZZ Examples: Worker [[StreamIO#^a1b013]] Subdomain fuzzing: wfuzz...

22/01/2023 01 Enumeration, Web Fuzzing

MSSQL (tcp-1433)

Connection impacket-mssqlclient sa@10.11.1.31 -p 1433 -db tempdb # Sometimes you need to specify a Windows Authentication impacket-mssqlclient Archetype/sql_svc:M3g4c0rp123@10.129.95.187 -windows-...

22/01/2023 01 Enumeration, MSSQL (tcp-1433)

Password Spraying

Crackmapexec While executing a Password Spraying attack with crackmapexec always run the --continue-on-success flag, sometimes there are some cases when two users can have the same password cr...

21/01/2023 12 Active Directory, AD - Enumeration

Creds.xml

In order to create an XML file with credentials via powershell we can run the following commands: C:\Users\nico\Desktop> $credential = Get-Credential C:\Users\nico\Desktop> $credential | Exp...

05/01/2023 12 Active Directory, Authentication

Domain Admin Techniques

This is a collection of techniques to get Domain Admin via multiple techniques. Assign user to a group Import-Module ./PowerView.ps1 $SecPassword = ConvertTo-SecureString 'JDg0dd1s@d0p3cr3@t0r' -As...

02/01/2023 12 Active Directory, Privilege Escalation

Firefox Cache Passwords

Firefox Cache passwords First go to the path file session for the user: # For Windows: C:\\Users\\nikk37\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\br53rxeg.default-release # For Linux /.mozi...

02/01/2023 04 Privilege Escalation, Firefox Cache Password

RDP Remote Login

RDP into a remote machine XFREERDP To access windows via port tcp-3389 into a system: /u - user /p - password /w - weight /h - height /v - remote machine xfreerdp /u:JohnDoe /p:Pwd1...

26/12/2022 02 Lateral Movement, RDP Remote Login

Dumping SAM

Traditional dumping In order to dump the same, two register keys must be retrieved: reg save hklm\sam c:\sam reg save hklm\system c:\system You need to use impacket-secretsdump to retrieve hash...

16/12/2022 12 Active Directory, Persistence

MS17-010

IIS 5.0 In order to exploit an IIS 5.0 server the zzz_exploit.py script that is to be found here: MS17-010 is the best choice, first of all we need to create a virtual environment with python as t...

16/12/2022 06 Exploitation, MS17-010