- Recon
- Find vuln
- Exploit
- Document it
Unicornscans in cli, nmap in msfconsole to help store loot in database.
This document pools several awesome tools and blog entries together (see "Resources" at the end of this doc) in an attempt to automate the process of getting an initial foothold on a network in a situation where you have no valid credentials.
Ok, so one weird thing I'm trying to figure out is if I install ntlmrelay as the first tool we'll use, these steps seem to work ok:
git clone https://github.com/CoreSecurity/impacket.git /opt/impacket
cd /opt/impacket
pip install .
#!/bin/sh | |
java -jar -Xmx2g -Djava.awt.headless=true ~/BurpSuitePro/burpsuite_pro.jar http jerrygamblin.com 80 | |
cp *.html ~/BurpSuitePro/scan.html | |
wkhtmltopdf scan.html scan.pdf | |
curl -F file=@scan.pdf -F initial_comment="BurpProxy JerryGamblin.com Scan" -F channels=#burpreports -F token=(Your Token) https://slack.com/api/files.upload | |
rm *.html | |
rm *.pdf |
####################### | |
### Proxy curl/wget ### | |
####################### | |
export http_proxy=localhost:8080 | |
export https_proxy=localhost:8080 | |
curl -k https://ifconfig.io | |
wget --no-check-certificates https://ifconfig.io | |
####################### | |
### Proxy Java JARs ### |
from shodan import Shodan | |
from shodan.helpers import open_file, write_banner | |
from shodan.cli.helpers import get_api_key | |
from sys import argv, exit | |
# Input validation | |
if len(argv) != 3: | |
print('Usage: {} <IPs filename> <output.json.gz>'.format(argv[0])) | |
print('Example: {} grizzly-ips.txt shodan-grizzly.json.gz'.format(argv[0])) | |
exit(1) |
_ _____ ___ __ __ ___ ____ ____ _____ ____ _____ _____ _ __ __ | |
/ \|_ _/ _ \| \/ |_ _/ ___| | _ \| ____| _ \ |_ _| ____| / \ | \/ | | |
/ _ \ | || | | | |\/| || | | | |_) | _| | | | | | | | _| / _ \ | |\/| | | |
/ ___ \| || |_| | | | || | |___ | _ <| |___| |_| | | | | |___ / ___ \| | | | | |
/_/ \_\_| \___/|_| |_|___\____| |_| \_\_____|____/ |_| |_____/_/ \_\_| |_| | |
[********BEGIN TEST*******] Data Compressed T1002 has 3 Test(s) |
/ | |
$$$lang-translate.service.js.aspx | |
$367-Million-Merger-Blocked.html | |
$defaultnav | |
${idfwbonavigation}.xml | |
$_news.php | |
$search2 | |
£º | |
.0 | |
/0 |
# NOTE: the most updated version of PowerView (http://www.harmj0y.net/blog/powershell/make-powerview-great-again/) | |
# has an updated tricks Gist at https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993 | |
# get all the groups a user is effectively a member of, 'recursing up' | |
Get-NetGroup -UserName <USER> | |
# get all the effective members of a group, 'recursing down' | |
Get-NetGroupMember -GoupName <GROUP> -Recurse | |
# get the effective set of users who can administer a server |
:: Windows 10 Hardening Script | |
:: This is based mostly on my own personal research and testing. My objective is to secure/harden Windows 10 as much as possible while not impacting usability at all. (Think being able to run on this computer's of family members so secure them but not increase the chances of them having to call you to troubleshoot something related to it later on). References for virtually all settings can be found at the bottom. Just before the references section, you will always find several security settings commented out as they could lead to compatibility issues in common consumer setups but they're worth considering. | |
:: Obligatory 'views are my own'. :) | |
:: Thank you @jaredhaight for the Win Firewall config recommendations! | |
:: Thank you @ricardojba for the DLL Safe Order Search reg key! | |
:: Thank you @jessicaknotts for the help on testing Exploit Guard configs and checking privacy settings! | |
:: Best script I've found for Debloating Windows 10: https://github.com/Sycnex/Windows10Debloater | |
: |
With kerbrute.py:
python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>
With Rubeus version with brute module: