🧙
Pentesting & Red Teaming Notes
  • Windows
    • Recon - Initial Access
    • Privilege Escalation
      • Enable Privs
      • SeBackupPrivilege
      • SeImpersonatePrivilege
      • SeDebugPrivilege
    • Kerberoasting
    • Lateral Movement
    • MSSQL
    • AD Related
    • Bypass-Evasion Techniques
    • Post Exploitation
    • Miscellaneous
    • UAC Bypass
    • Exploits
      • MS03-026 - RPC DCOM
      • MS04-011 - LSASRV
      • MS08-67 - Netapi
      • MS17-010 - Eternalblue
      • CVE-2019-1388
      • CVE-2020-1472 - Zerologon
      • CVE-2020-16938
      • CVE-2021-1675 - PrintNightmare
      • CVE-2022-21999 - SpoolFool
    • Coerced Auth
  • Linux
  • Abusing Active Directory ACLs
    • ReadLAPSPassword
    • WriteDacl
    • GenericWrite
    • ForceChangePassword
    • WriteOwner
  • Port Forwarding - Tunneling
  • Cloud
  • Mobile
  • Malware Development
    • Process Migration
    • Process Hollowing
    • Dynamic API Resolution
    • Suspended Threads
    • PPID Spoofing
    • Thread Stack Spoofing
    • ETW (Event Tracing for Windows)
    • AMSI Bypass
    • Tools
    • Esoteric
Powered by GitBook
On this page
  • Nfs share mounting
  • Generating shadow hash
  • Weird SSH Connections
  • Port scanning with nc

Linux

Linux section won't have much details compared to windows.

Nfs share mounting

mount -t nfs  127.0.0.1:/backup_share /mnt/myfolder -o nolock

Generating shadow hash

Generating sha-512 hashes with python

python3 -c 'import crypt;print(crypt.crypt("Password123!", "$6$foobar$"))'

Using openssl

openssl passwd -6 -salt foobar password123

Modifying shadow entry

morph3:<hash>:18727:0:99999:7:::

Weird SSH Connections

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-dss morph3@10.3.3.7 -p22000

Port scanning with nc

nc -z -v 10.2.2.86 1-65000 2>&1 | grep succeeded

for i in {1..65535}; do echo $i; done | xargs -I% -P 50 sh -c 'nc -z  -w 1 10.2.2.150 %|grep succeeded'

cat ports.txt | xargs -I% -P 50 sh -c 'nc -z  -w 1 10.2.2.22 %|grep succeeded'

PreviousCoerced AuthNextAbusing Active Directory ACLs

Last updated 2 years ago