chriselgee

Typing special characters:

• In Windows, the simplest way to type special characters is with the Character Map, or charmap.exe. Scroll through, double-click the ° symbol you need, click Copy, and you can Paste it into your application. Notice though - while it's selected, there are codes at the bottom. On the left is the Unicode code, U+00B0. This means that the system stores the degree character as hex 00 and B0. (Who cares? We'll come back to it.) On the right, you see Alt-0176. This means that when NumLock is turned on, you can hold Alt and type 0176 on the number pad and get a degree symbol.
• In Linux, we need that Unicode code. Press Ctrl-Shift-U, then type 00B0 and hit enter or space or whatever. The ° appears!

If you need to type something you haven't found in charmap, you can Google it. The lobster emoji, for example, is apparently 1F99E. So, on my Linux system, I hit Ctrl-Shift-U, enter the code, and get 🦞!

Want to type a lobster in Win 10? If you're up-to-date on p

chriselgee

; Sends user-entered text to most recently used program  -LTLG, 27JUN06

; Disables the little "H" systray icon while program runs
#NoTrayIcon
; Allows more than one copy to run at once
#SingleInstance, OFF

Gui, Add, Edit, x16 y50 w370 h70 vTextFodder,
Gui, Add, Text, x206 y120 w40 h20 , Times:
Gui, Add, Button, x276 y120 w110 h30 Default, &Giddyup!

chriselgee

Some tools allow or even require -6 as a command line option, and curl requires an IPv6 address to be in [] (square brackets). Also, for link local addresses, you usually have to specify the local interface you want to use.

• ping 2001:7b8:666:ffff::1:42 -I eth0
• nmap -6 2001:7b8:666:ffff::1:42%eth0
• curl http://[2001:7b8:666:ffff::1:42]:8080/ --interface eth0
• wget http://[2001:7b8:666:ffff::1:42]:8080/
• telnet -6 2001:7b8:666:ffff::1:42
• nc -6 2001:7b8:666:ffff::1:42%eth0 23

Want to find link local addresses for systems in your network segment? Try hitting local hosts and routers with these multicast addresses:

chriselgee

# Tell the attack machine to trust these hosts on a foreign domain
winrm quickconfig
winrm set winrm/config/client '@{TrustedHosts="ws01.example.com,sql02.example.com"}'

# Enter the credentials to use when connecting
$username = "example.com\compromisedAdmin"
$pass = "Luggage=12345"
$fancypass = ConvertTo-SecureString $pass -AsPlainText -Force
$dacred = New-Object System.Management.Automation.PSCredential ($userName, $fancypass)

chriselgee

# SSH Callback Service
# Replace HOSTNAME with the VPS you're connecting to
# Replace USERNAME with your user on the VPS
# Replace LOCALUSER (or the whole path) to point to the private key for USERNAME on HOSTNAME
# Usage:
# - Try the SSH manually first, as the root user, so the VPS can be added to the known_hosts file
# - `systemctl enable callback.service`, `systemctl start callback.service`
# - SSH to the VPS from your system, and `ssh USER@127.0.0.1 -p22000 -i KEYNAME`, where USER is a user on the distant system and KEYNAME is an accepted key for that user
# Troubleshooting:
# - Ensure "GatewayPorts" is set to "Yes" in /etc/ssh/sshd_config on the VPS

chriselgee

Flask cookies, when stored client-side, are .-delimited, often zlib-deflated, and Base64-encoded with _ subbed in for / and - subbed in for + (URL-safe encoding).

Let's take an example cookie from https://snowball2.kringlecastle.com/:

.eJy1kT8PgjAQxb9L5w7UIv9mNJoYB3UjDI1WJQE0IENj_O6WZxFQYhw0l7z23l1yvV-vJEz2-2RbpRdFAouSSS4ztRDqVF1IEEUWfYuYapf90WXdgDv8BqvX23WHe_tubHZdH5NzWa8aPaaNoBxqQ8da9aFPH5kHdaGOqXBkNnQMz0WHqztqbTyOzI7r8dMikfku_YJ2E_1Nf0v71W1ndml_dj_SbtZtgQ-jppFjgHsGF4f3QMxRYYDLAJcZuC3-9mNcfJajtX7BpipyEpBzKpQsCDWXeai9WXU4rkRenrKwUOVOpPJZX4pM6g7f9rjv-CNObncEAMTx.YaTaAA.SGRJEzFnk9BCtFwX-SmuSHrKofM

We can take the first piece (ignoring the signature) and store it as a variable in python3:

chriselgee

>>> "THIS is what I want"[:4]
'THIS'

>>> "THIS is what I don't want"[4:]
" is what I don't want"

>>> "I do not want THIS"[:-4]
'I do not want '

>>> "I only want THIS"[-4:]

chriselgee

# Collect target subdomains from certificate transparency searches
curl -s 'https://crt.sh/?q=counterhack.com&output=json' | jq -r '.[].name_value' | sort -u

# Find a Linux executable named python3 in the /usr/ directory
find /usr -name python3 -exec file {} \; | grep ELF

# Loop over a set of numbers
for i in {1..255}; do sudo /usr/bin/ping -c1 192.168.1.$i; done

# Loop over lines in a file

chriselgee

To find all streams within file.txt: Get-Item .\file.txt -Stream *

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\file.txt::$DATA
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\
PSChildName   : file.txt::$DATA
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName : C:\file.txt