Knowledge Base for Penetration Testing
In today’s tutorial, we are going to focus on adding a user to sudoers on the most recent CentOS distribution : CentOS 8. The sudo command is one of the most popular command available on Linux. It allows users to perform commands as another user, which is configured by default to run as the root […]
In today’s tutorial, we are going to see how you can add a user to sudoers on Debian distributions. The sudo command allows authorized users to perform commands as another user, which is by default the root user. There are two ways to add a user to sudoers : you can add this user to […]
As a system administrator, you are probably already familiar with the LDAP protocol. If you are working in a medium to large company, you can be sure that your company already owns a LDAP server, whether it is on Linux or Windows. Invented in the early 80s, the LDAP protocol (for Lightweight Directory Access Protocol) […]
If you are working in a medium to large company, you are probably interacting on a daily basis with LDAP. Whether this is on a Windows domain controller, or on a Linux OpenLDAP server, the LDAP protocol is very useful to centralize authentication. However, as your LDAP directory grows, you might get lost in all […]
Mach-O is a binary format used by Apple for its systems. The binary format contains assembled bytes, data and other information. Structured by a list of load commands, where each load command hold the neccessary pointers to the contents. Header At offset 0 lies a header structure, struct mach_header, containing the general information about the […]
General Principals with most Outbound Controlled objects Users Groups Computers GPOs OUs Other CREATE Nodes and Edges Example output: Other sources of great Cypher Queries
RDP protocol Proxy RDP protocol using xfreerdp Proxy RDP protocol using xfreerdp and use NTLM hash to authenticate (PTH RDP) Enable Restricted Admin Mode (need admin priv)
Tools PowerUp Get services with unquoted paths and a space in their name Get services where the currentuser can write to its binary path or change argument to the binary Get the services whose configuration current user can modify Open a reverse shell listening using powercat
WMI 101 WMI = Windows Management Instrumentation –> Microsoft implementationn of CIM (Common Information Model) and WBEM (Web Based Enterprise Management).–> Provides a uniform interface for applications/scripts to manage a local or remote computer or network. WMIC = Command-Line interface for WMI WMI Components https://0xinfection.github.io/posts/wmi-classes-methods-part-2/ WMI utilities Linux Manaed Object Format (MOF) files Use to […]
PowerShell basics PowerShell scripts can used multiple things such as: PowerShell Download and execute in memory of PowerShell: PowerShell and Active Directory Domain Enumeration Using .NET Classes Enumeration can be done by using Native Executables and .NET classes: Using the DirectoryServices.ActiveDirectory.Domain class and then static method GetCurrentDomain() Get the name of the current forest Using […]
by