# Pentesting & Red Teaming Notes

## Pentesting & Red Teaming Notes

- [Windows](https://notes.morph3.blog/windows.md)
- [Recon - Initial Access](https://notes.morph3.blog/windows/recon-initial-access.md)
- [Privilege Escalation](https://notes.morph3.blog/windows/privilege-escalation.md)
- [Enable Privs](https://notes.morph3.blog/windows/privilege-escalation/enable-privs.md)
- [SeBackupPrivilege](https://notes.morph3.blog/windows/privilege-escalation/sebackupprivilege.md): This privilege is a win. We can create a shadow copy of the OS and read secret files such as SYSTEM, SECURITY, NTDS.dit etc
- [SeImpersonatePrivilege](https://notes.morph3.blog/windows/privilege-escalation/seimpersonateprivilege.md): If you have this permission you are most likely a service account and you will %99 end up as NT Authority/System
- [SeDebugPrivilege](https://notes.morph3.blog/windows/privilege-escalation/sedebugprivilege.md): Most powerful privilege you can get. Easy system shell
- [Kerberoasting](https://notes.morph3.blog/windows/kerberoasting.md)
- [Lateral Movement](https://notes.morph3.blog/windows/lateral-movement.md)
- [MSSQL](https://notes.morph3.blog/windows/mssql.md)
- [AD Related](https://notes.morph3.blog/windows/ad-related.md)
- [Bypass-Evasion Techniques](https://notes.morph3.blog/windows/bypass-evasion-techniques.md)
- [Post Exploitation](https://notes.morph3.blog/windows/post-exploitation.md)
- [Miscellaneous](https://notes.morph3.blog/windows/miscellaneous.md)
- [UAC Bypass](https://notes.morph3.blog/windows/uac-bypass.md)
- [Exploits](https://notes.morph3.blog/windows/exploits.md)
- [MS03-026 - RPC DCOM](https://notes.morph3.blog/windows/exploits/ms03-026-rpc-dcom.md)
- [MS04-011 - LSASRV](https://notes.morph3.blog/windows/exploits/ms04-011-lsasrv.md)
- [MS08-67 - Netapi](https://notes.morph3.blog/windows/exploits/ms08-67-netapi.md)
- [MS17-010 - Eternalblue](https://notes.morph3.blog/windows/exploits/ms17-010-eternalblue.md)
- [CVE-2019-1388](https://notes.morph3.blog/windows/exploits/cve-2019-1388.md)
- [CVE-2020-1472 - Zerologon](https://notes.morph3.blog/windows/exploits/cve-2020-1472-zerologon.md)
- [CVE-2020-16938](https://notes.morph3.blog/windows/exploits/cve-2020-16938.md)
- [CVE-2021-1675 - PrintNightmare](https://notes.morph3.blog/windows/exploits/cve-2021-1675-printnightmare.md)
- [CVE-2022-21999 - SpoolFool](https://notes.morph3.blog/windows/exploits/cve-2022-21999-spoolfool.md)
- [Coerced Auth](https://notes.morph3.blog/windows/coerced-auth.md)
- [Linux](https://notes.morph3.blog/linux.md): Linux section won't have much details compared to windows.
- [Abusing Active Directory ACLs](https://notes.morph3.blog/abusing-active-directory-acls.md)
- [ReadLAPSPassword](https://notes.morph3.blog/abusing-active-directory-acls/readlapspassword.md)
- [WriteDacl](https://notes.morph3.blog/abusing-active-directory-acls/writedacl.md)
- [GenericWrite](https://notes.morph3.blog/abusing-active-directory-acls/genericwrite.md)
- [ForceChangePassword](https://notes.morph3.blog/abusing-active-directory-acls/forcechangepassword.md)
- [WriteOwner](https://notes.morph3.blog/abusing-active-directory-acls/writeowner.md)
- [Port Forwarding - Tunneling](https://notes.morph3.blog/port-forwarding-tunneling.md)
- [Cloud](https://notes.morph3.blog/cloud.md)
- [Mobile](https://notes.morph3.blog/mobile.md)
- [Malware Development](https://notes.morph3.blog/malware-development.md)
- [Process Migration](https://notes.morph3.blog/malware-development/process-migration.md)
- [Process Hollowing](https://notes.morph3.blog/malware-development/process-hollowing.md)
- [Dynamic API Resolution](https://notes.morph3.blog/malware-development/dynamic-api-resolution.md)
- [Suspended Threads](https://notes.morph3.blog/malware-development/suspended-threads.md)
- [PPID Spoofing](https://notes.morph3.blog/malware-development/ppid-spoofing.md)
- [Thread Stack Spoofing](https://notes.morph3.blog/malware-development/thread-stack-spoofing.md)
- [ETW (Event Tracing for Windows)](https://notes.morph3.blog/malware-development/etw-event-tracing-for-windows.md)
- [AMSI Bypass](https://notes.morph3.blog/malware-development/amsi-bypass.md)
- [Tools](https://notes.morph3.blog/malware-development/tools.md)
- [Esoteric](https://notes.morph3.blog/malware-development/esoteric.md)