akde/infosec

Click Here

  • Responder

    respon­der: Lis­ten with respon­der on a net­work and wait for AD sys­tems to ask for a DC. This can reveal a NTLM hash. (Source) Start respon­der on the own system: sudo responder -I tun0 --wpad Con­nect from the tar­get sys­tem to this sys­tem via smb. In the Win­dows explor­er, or in the com­mand line via dir…

  • Lateral movement

    Logon on another system with a NTLM hash Sce­nario: Then, use mimikatz to inject anoth­er user’s NTLM hash into the secret storage: Steal another user’s session Sce­nario: Then, with the use of mimikatz: privilege::debugsekurlsa::tickets /export This exports avail­able tick­ets into the work­ing direc­to­ry (suf­fix .kirbi). Then, choose one file/ticket from the cor­rect user and ser­vice. For…

  • PowerShell Empire

    Main­ly post exploita­tion for AD envi­ron­ments. (Down­load — also includ­ed in Kali sources) Quick usage for privilege escalation General usage Metas­ploit syn­tax / PSE syntax Note: After use­mod­ule don’t for­get to go “back” and to “inter­act” with the agent to see job results! Com­mands with an aster­ix require a high-integri­ty Empire Agent. To upgrade one…

  • Sniffing network traffic (tcpdump)

    tcpdump Get incom­ing ICMP packets: sudo tcpdump -i any icmp and src host $target Nützliche Parameter Domains nicht auflösen, IPs anzeigen -n Dump der Dat­en anzeigen -X Paket in ASCII anzeigen -A Umgang mit Dateien Dump in Datei schreiben tcpdump -w file Dump aus Datei lesen tcpdump -r file Standard-Abfragen tcpdump -n src|dst 10.10.10.10 and port…

  • Wireshark

    See a pack­et in its context Kontextmenü, Follow auswählen Show only ICMP pack­ets from a host tcpdump host 10.11.1.128 and icmp -i tun0 Show oth­er sys­tems com­mu­ni­cat­ing out­side the own address ip.addr == 10.11.1.0/24 && !(ip.addr == 192.168.119.0/24) && ! dns && !browser && !ssdp && !nbns && !llmnr Record audio Wire­shark can trans­form cap­tured audio…

  • ncat

    Namenskonfusion Datei ausliefern: echo -e "HTTP/1.1 200 OK\nContent-Length: 5\n\nHallo" | nc -l localhost 8000 Datei anfragen über SSL: echo -e "GET / HTTP/1.1\nHost: localhost\n\n" | ncat -C --ssl localhost 443 Gebe Ausgabe von Programm zurück: ncat -l localhost 3000 --exec /bin/date Datei direkt übertragen (unverschlüsselt!): 1. Empfänger: user@host02:~$ ncat -l > aha oder nc -nlvp 4444…

  • Network and port scans

    General notes NC / Netcat Try net­cat first on inter­est­ing ports or nar­row port ranges to be more silent Network scan Choose a port which is prob­a­bly open on sys­tems on this net­work. E.g. 445 for Win­dows hosts or 22 for Lin­ux hosts. for i in $(seq 1 254); do nc -zv -w 1 10.10.10.$i 445;…