SMB crackmapexec smb 10.10.11.158 -u users -p creds Example: [[StreamIO#^11d8df]] LDAP crackmapexec ldap 10.10.11.158 -u users -p creds --continue-on-success [[StreamIO#^676765]] WINRM crackmap...
During the enumeration and information gathering process, we discover a MySQL service running on TCP port 3306. C:\Windows\system32>netstat -anpb TCP netstat -anpb TCP Active Connections P...
For this to work, the Windows system must have the IP Helper service running and IPv6 support must be enabled for the interface we want to use. Fortunately, both are on and enabled by default on Wi...
Our goal is to initiate a remote desktop connection from our Kali Linux machine to the Windows Server 2016 through the compromised Linux server using only the HTTP protocol. We will rely on HTTPTu...
HTTP htaccess Attack with Medusa We will attempt to gain access to an htaccess-protected folder, /admin, on that server. Next, we will launch medusa and initiate the attack against the htaccess-p...
We will use a port forwarding tool called rinetd to redirect traffic on our Kali Linux server. This tool is easy to configure, available in the Kali Linux repositories, and is easily installed with...
When attempting to exploit system-level software (such as drivers or the kernel itself), we must pay careful attention to several factors including the target’s operating system, version, and archi...
A common way to elevate privileges on a Windows system is to exploit insecure file permissions on services that run as nt authority\system. For example, consider a scenario in which a software dev...
Scenario: CVE-2017-1000112 Kernel exploits are an excellent way to escalate privileges, but success may depend on matching not only the target’s kernel version but also the operating system flavor...
Users User Privileges whoami /priv whoami /groups Network Privileges net user net group `domain` net localgroup `local` net localgroup <Group Name> net accounts `domain` net accounts /domain...
