Hacking-Cheatsheet
Hacking Cheatsheet
General enumeration
Network discovery
Nmap
I tend to run 3 nmaps, an initial one, a full one and an UDP one, all of them in parallel:
nmap -sV -O --top-ports 50 --open -oA nmap/initial <ip or cidr>
nmap -sC -sV -O --open -p- -oA nmap/full <ip or cidr>
nmap -sU -p- -oA nmap/udp <ip or cidr>
--top-ports only scan the N most common ports
--open only show open ports
-sC use the default scripts
-sV detect versions
-O detect Operating Systems
-p- scan all the ports
-oA save the output in normal format, grepable and xml
-sU scan UDP portsIs also possible to specify scripts or ports:
If there are servers that could be not answering (ping), then add the flag -Pn (example of initial one):
Ports discovery (without nmap)
nc + bash
If you get in a machine that doesn’t have nmap installed, you can do a basic discovery of (for example), top 10 ports open in 192.168.30 by doing:
/dev/tcp/ip/port or /dev/udp/ip/port
Alternatively, is possible to do the same than above but by using the special dev files /dev/tcp/ip/port or /dev/udp/ip/port (for example nc is not found):
Taking these last examples, is straightforward to create a dummy script for scan a hole /24 net (for example):
Powershell
By using Invoke-PortScan (PowerSploit)
Leverage Native Powershell
If nmap didn’t grab banners (or is not installed), you can do it with /dev/tcp/ip/port /dev/udp/ip/port or by using telnet.
/dev/tcp/ip/port or /dev/udp/ip/port
For doing it with udp ports is the same, but changing tcp for udp
telnet
Web directorie/file scanner
Gobuster
Scan all the directories/files by extension:
For scanning without extensions, just take out the -x
Nikto
Sometimes Nikto shows juicy information, I tend to run it like:
fuff
Web fuzzer, you can get fuff here, it basically bruteforces the dirs.
Most usefull dictionaries (OSCP/HTB)
Trusted Folders (Windows)
Samba
smbclient
Check if there is anonymous login enabled:
impacket
Is also possible to use impacket in the same way than smbclient to check for anonymous login (and a lot more as browse the shares) in case of incompatible versions.
smbmap
Check which permissions we have in those shares (if there are):
Login through CIFS/WinRM/PSSession
When injecting a ticket and impersonating a user, we can swap CIFS for HTTP for getting a shell via WinRM or swap CIFS for HOST for getting a shell via PsExec!!!
CrackMapExec - WinRM
With Hash
With Password (Example gets a reverse shell)
CrackMapExec - SMB
With Hash
With Hash + Domain
With password
Version (nmap didn’t detect it)
Sometimes nmap doesn’t show the version of Samba in the remote host, if this happens, a good way to know which version the remote host is running, is to capture traffic with wireshark against the remote host on 445/139 and in parallel run an smbclient -L, do a follow tcp stream and with this we might see which version the server is running.
Exfiltration
Samba
Generate a samba server with Impacket:
Mount in Windows
Mounting it in Windows with Powershell:
Mounting it without Powershell:
On windows, to list mounted shares, either Powershell or without it:
Mount in Linux
Is needed to have installed cifs-utils, to install it (in debian based):
To mount it:
To list mounted shares:
HTTP
From your local attacker machine, create a http server with:
It’s also possible to specify which path to share, for example:
Windows
Linux
FTP
If there is an ftp server which we have access, we can upload files there through it, the "" is the same for both, windows or linux:
Sockets
Using nc/ncat is possible to create as a listener to upload/download stuff through them, the syntax for nc and ncat is basically the same. Create the socket with:
RDP
If we have access to a windows machine with a valid user/credentials and this user is in the “Remote Desktop Users”, we can share a local directorie as a mount volume through rdp itself once we connect to the machine:
Linux
Mounting volume
Forcing enable of clipboard
I might want to force the use of the clipboard if it’s not being taken by default and use the 100% of the screen:
Connection with restricted admin mode
Windows
Restricted admin mode
Stacked commands without GUI
Pivoting
It’s possible to do pivoting by using proxychains, pure nc’s or in case of linux just some fifo files (I will write them down this another methods down maybe in a future), I have used during all the OSCP an awesome tool called (sshuttle)[https://github.com/sshuttle/sshuttle] (it’s a transparent proxy server that works like “a vpn”, and doesn’t require with super rights, only thing needed is that the bastion server you will use, needs to have installed python) and sometimes some SSH Forwarding. Something worth to mention nmap doesn’t work through sshuttle.
sshuttle
One hop
Let’s say we are in an intranet and we have compromised a firewall that gives us access to the management net (fw.example.mgmt - ips 192.168.20.35 and 192.168.30.253 as the management ip), by using sshuttle we can create a “vpn” to talk directly to those servers, for that, we use:
Multi-hops
Now imagine that after we broke up into the management net after some some enumeration, we ended to compromise a machine that has also access to a production environment (foreman.example.mgmt - ips 192.168.30.40 and 192.168.25.87), we can take advantage of sshuttle + ProxyCommand of ssh to create a “vpn” through this multiple hops, so…putting it down, this will be kind of as follow (the diagram is extremly simplified and just for the sake of illustrate this visually, so it doesn’t intend to provide a 100% precise network diagram):
To have that working, is needed to put the next conf in your ssh conf file (normally ~/.ssh/config. It’s based on the example above, but is easy to extrapolate to different scenarios):
And now to setup the “multiple hop vpn”, run:
Chisel with remote port forward from machine in the net
On attacker machine I start up a chisel reverse server on port 9050 (imagine this machine IP is 192.168.90.90)
On compromised machine in the network I start a client connection against the server running in the attacker. The command below will be forwarding the traffic from port 8081 in the machine 172.16.42.90 throughout the compromised machine (via localhost in port 5050) to the attacker.
Metasploit: autoroute + socks_proxy
The SRVPORT of socks_proxy must match the one configured in proxychains.conf as the VERSION used as well.
Reverse shells
php
bash
sh + nc
Perl (example deploy as cgi-bin)
Java (example to deploy on tomcat)
Windows HTTP download reverse shell
We can also use it with the following parameters for migration
Or either, in the msfconsole add the parameter AutoRunScript, the following will try to migrate our reverse too explorer.exe:
Windows staged reverse TCP
Windows stageless reverse TCP
Linux staged reverse TCP
Linux staged reverse TCP
Privilege escalation
Windows
Always Install Elevated
If we have enabled a privilege which allow us to ALWAYS install with elevated privileges, we can craft a .msi leveranging wixtools, specifically with candl.exe and light.exe. The steps are as follows:
1 - Create a malicious .xml wix file:
The powershell in b64 executed is this one:
2 - Create a malicious .wix (this step and next one MUST be run from the path where the wix tools are located)
3 - Create the malicious .msi from the .wix
Run-As
Incorrect permisions in services (sc config binpath)
Binpath is set as running cmd.exe passing a commad to execute to it (so once the process dies, the one executed by it so the command to cmd.exe remains):
SAM + SYSTEM + Security
If those 3 files are in your hands (you could download to your attacker machine), you can dump hashes and crack them:
Linux
/home/user/openssl =ep (empty capabilities)
Make 2 copies of passwd, one as backup of the original, and one that will be used as custom:
Now, a custom user will be created and added to /tmp/passwd.custom with customPassword and as root user (UID = GID = 0):
Now, create a custom key.pem and cert.pem with openssl:
Encrypt the new custom passwd:
Now, decrypt the custom passwd overwritting in the process the real one (/etc/passwd):
And finally, just login with the user created with root privileges by using customPassword:
Command web injection: add user
NFS; no_root_squash,insecure,rw
If /etc/exports has a line like:
NFS is being exported and you and you have ssh access to the machine. From your attacker machine while logged as root user run:
Now from inside a SSH session on the victim machine (in this example 192.168.42.32):
Good to know (either Windows and/or Linux)
Arch cross compile exploit (and diff glibc version)
IP restriction at application level, bypass
Try to send a request modifying the HTTP header by adding:
Windows - check OS information
Windows - check architecture
Powershell running as 32 or 64 bits
Linux LFI - intesresting files to look after
Windows LFI - intesresting files to look after
Enable execution of PowerShell Scripts
Encode Powershell b64 from Linux
Encode/Decode b64 in Windows WITHOUT Powershell
Check the Type of Language available with Powershell
Set Proxy in code used (Windows)
Powershell
JScript
Hide Foreground with WMI (Windows, Office Macros)
Simple Buffer Overflow (32 bits, NO ASLR and NO DEP)
Summarized steps
0 - Crash the application
1 - Fuzzing (find aprox number of bytes where the crash took place)
2 - Find offset
3 - EIP control
4 - Check for enough space on buffer
5 - Badchars counting
6 - Find return address (JMP ESP)
7 - Create payload
Fuzzing: example with vulnserver + spike on TRUN command
Now, start wireshark filtering on the target IP/PORT below and run the trun.spk:
Once a crash takes place, go to wireshark to locate the crash.
Badchars
From the block below, the next ones were not included (most common badchars):
So…actual list of badchars:
Usefull tools (on Kali Linux)
create_pattern
pattern_offset
nasm_shell
msfvenom
Shellcode POC: calc.exe
Antivirus Bypass
Antivirus tend to flag malware by Signature/Heuristics detection, we could bypass these throughout certain techniques For more details, look up into the [Exploit Development/Reversing/AV|EDR Bypass](https://ceso.github.io/2020/12/hacking-resources/#exploit-developmentreversingAV|EDR Bypass) Section on the resources part of my blog.
Signature Bypass
For example, we can obfuscate the code ciphering and/or encoding (having a decipher/decoding routine in the code), as also leverage tools dedicated for this purpose. Another thing is to use NOT common name for functions, variable names, etc; lunfardos, slang, idioisms, weird words from the dictionary, etc.
Heuristics Bypass
As for the heuristics for example AV’s tend to execute the malware inside a sandbox, we could have code for detecting if running inside a sandbox and exit if this is true. I could use the following techniques:
Sleep command and comparision of how real time has passed (AV’s could NOT wait until the sleep and just fast-forward the time)
A counter up to 1 billon (Same story than Sleep, could not wait until it finishes and just exits)
Call Windows API’s poor or not even documented (as AV’s tend to emulate API’s inside the sandboxes, but some of them will not, then at the malware trying to call it and not existing, it will be detected is running inside a Sandbox)
Verifying the name of the malware (AV’s could rename the file, if it has changed it might be running inside a sandbox)
Veifying if I can allocate TOO MUCH memory
Checking if a known user in the system exists, if it doesn’t exit
If NOT AV Bypass and Admin, DISABLE Defender
If we have admin creds, we could disable Win Defender, please note THIS IS NEVER a good idea in production environments as this can be monitored!!
AMSI Bypass
AMSI (Anti-Malware Scan Interface), in short sit’s between Powershell and Defender, so even if our crafted malware/tools have an AV Bypass, it still can be flagged by AMSI (annoying!), AMSI can also be leveraged for example for EDR’s. There are certain ways to bypass AMSI, for example forcing it to fail.
IT’S RECOMMENDED TO ALWAYS HAVE AN AMSI BYPASS BEFORE EXECUTING POWERSHELL PAYLOAD!
Active Directory
Permissions: ACE (Access Control Enties) SDDL (Security Descriptor Definition Language) - Format
BloodHound
PowerView methods for enumeration
This is the command for download injected into memory with an AMSI Bypass before
ACLs
Users
Groups
Computers
Trusts
SID’s
Exploitation
List all available credentials cached (Hashes and Passwords; Logged on user and computer)
Convert to ccache
We can use the tool ticket_converter written by zer1t0 for converting kirbi tickets to ccache and viceversa:
GenericAll
GenericWrite
WriteDACL
Unconstrained Delegation
We have local adminstrative access to a host which is configured for Kerberos Unconstrained Delegation. We can leverage Rubeus for an auth from the DC and then steal the TGT, this can be used to perform a DCSync to obtain the NTLM hash for ANY account. Other way is by triggering the printer bug on a domain controller to coerce to authenticate to the host compromised we have using it’s machine account.
If a computer account has TRUSTED_FOR_DELEGATION in it’s UserAccountControl (UAC), then it’s a viable target. Domain controllers will also have SERVER_TRUST_ACCOUNT_UAC, so…if it the machine has this, then it’s a DC.
By Forwardable TGT after login
By using of SpoolSample.exe (printer bug)
Last updated
Was this helpful?