ssstonebraker

FILE SPACING:

 # double space a file
 sed G

 # double space a file which already has blank lines in it. Output file
 # should contain no more than one blank line between lines of text.
 sed '/^$/d;G'

ssstonebraker

Note: I did not author this, i found it somehwere.

Active Directory Attacks

Summary

• Tools
• Most common paths to AD compromise
  • MS14-068 (Microsoft Kerberos Checksum Validation Vulnerability)
  • Open Shares
• [GPO - Pivoting with Local Admin

ssstonebraker

ElasticSearch 5.6 Cheatsheet

Node Decomission

If you need to decomission a node the first thing you should do is transfer all shards from it to other nodes

Start Moving all Shards off a node

This command will tell ElasticSearch to:

1. Stop sending new shards to node 10.0.0.1
2. Move all existing shards on node 10.0.0.1 to other nodes in the cluster

ssstonebraker

Hydra

Supported protocols

List1	list2	list3	list4	list5
asterisk	icq	oracle-listener	rexec	snmp
cisco	imap[s]	oracle-sid	rlogin	socks5
cisco-enable	irc	pcanywhere	rpcap	ssh

ssstonebraker

[TOC]

Windows Initial Checks

Basic Info

hostname
systeminfo
whoami

Global path

If any part of the SYSTEM %PATH% variable is writeable by Authenticated Users, privesc exists

ssstonebraker

#!/usr/bin/env python

# prints all the records in all the zones in colums separated by ','.
# It uses raw mode to handle pagination to iterate over zones and records

import CloudFlare

separator=","
cf = CloudFlare.CloudFlare(token='REPLACE_WITH_YOUR_OWN_CF_TOKEN', raw=True)
per_page = 10

ssstonebraker

Pupy Post Exploitation Toolkit Notes

link to project home: https://github.com/n1nj4sec/pupy

Create aliases - modify pupy.conf

Modify pupy.conf Under the section starting with [aliases] you can add them

[aliases]

ssstonebraker

• Fuff
• Opendoor
• amap
• nmap
  • Quick Scan
  • Scan all ports with default set of scripts and SYNC for faster run time
    • Identify Services
    • Identify OS
  • Favorite scans
  • All Ports TCP and UDP

ssstonebraker

#!/bin/sh
# for testing EDR
VERSION="ng"
ADVISORY="This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission."

###########################################
#-------) Checks pre-everything (---------#
###########################################
if ([ -f /usr/bin/id ] && [ "$(/usr/bin/id -u)" -eq "0" ]) || [ "`whoami 2>/dev/null`" = "root" ]; then
  IAMROOT="1"

ssstonebraker

Discovery

Tools

SQL Injection

' or '1' ='1' --

Website Directory Enumeration