Category: Uncategorized
-
The Hacker’s Mindset
Copied thread from Bluesky i might go on a rant for a bit here, so my apologies for your mentions. the way i think of it is there are a number of places within any given system that give rise to opportunity but as a hacker, you want to understand the layer below that so…
-
And where does the newborn go from here? The net is vast and infinite.
I’ve been thinking a lot lately. For a long time now, one of my goals in life has been to pass the OSCP. The last couple of weeks, I’ve been training for my second go at it. This time around, I was able to have some level of compromise on 4 out of 6 boxes.…
-
LDAP
If you can authenticate to LDAP, either anonymously or with credentials, you can pull everything from it like such: Alternatively, to get all users, you can use (the slash after domain is very important): To query for users that don’t require Kerberos preauthentication, see AS-REP-Roasting: Then, to get a ticket-granting-ticket (TGT) (note: this does seem…
-
Kerberoasting
Kerberos authentication is a ticketing system giving users various permissions to access various systems. Kerberos uses Service Principal Names (SPNs) as account identifiers. If you can authenticate to Active Directory, you can request a ticket for a given SPN. Retrieve SPNs with impacket-GetUserSPNs. Obtaining this ticket, you can then try to crack it using hashcat…
-
Some OSCP Resources
Getting ready for the OSCP… Again… Linking some resources here. Good OSCP guidance: https://johnjhacking.com/blog/oscp-reborn-2023 This, in turn links to several other good resources. NMAPAutomator: https://github.com/21y4d/nmapAutomator/ GTFO and LOL bins: Reverse Shell generator (you shouldn’t need this, but it can be a good reference for those pesky one-liners): https://www.revshells.com/ Playing with Active Directory: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md PrivEsc classes:…
-
Windows – Useful
Useful things for attacking Windows systems. If RDP is available, NMAP can glean some super useful information with its rdp-ntlm-info NSE script. If NetBIOS and/or SMB is enabled, enum4linux is your friend. It may even be able to enumerate local users for you. nbtscan is also useful for learning the server’s hostname. Smbclient can be…
-
SetUID Binaries
SetUID is a file permission that allows a binary to be run as the owner of the file. Specifically, if a binary is SetUID root, we can likely exploit the functionality of that binary to gain root access to the system it’s on. To find all SetUID binaries on a given system, run Check out…
-
Linux Capabilities
I had another box to hack, but the initial access portion was a mix of default creds and unrestricted file uploads. I have like 3 posts going over just that, so I’m skipping that part. What I’d like to focus on is Linux capabilities. From the man page: Cool, and capabilities can be applied to…
-
Zipfile cracking to Textpattern unrestricted file upload to DirtyCOW
AND ANOTHER ONE! These are the worst. Very little attack surface. Let’s dirbust it. Okay, we have a few directories to look at. Robots.txt even gives us a bit of a hint. After a LOT of trial and error, we finally hit it with nonstandard wordlists from dirbuster instead of dirb and found something. Okay,…
-
Unrestricted file upload to bad file permissions to sudo misconfigs
Here we go again. Don’t know what 33060 is, but let’s look at the web server. Okay, so we have a couple of pages to look at. /admin, /store, and /gym (discovered in robots.txt) all have login forms. Admin/admin works on /store, then we get a way to edit books available in the store, including…