- Check that we have all flags on a box ```bash find / -name "flag.txt" -type f 2> /dev/null ``` ```powershell gci c:\ -filter "flag.txt" -recurse -erroraction silentlycontinue -force ``` - Cascade dirs for visibility - Dont sleep on post-exploit enumeration! - Fully pillage a box once we get root - Dont get too jacked once we get a shell on a box or achieve root > job isnt over yet - look for non-default folders in `c:\` - look for non-default binaries in `c:\Program Files\` and `c:\Program Files (x86)\` - enum browser history - Be willing to try various webshells and revshells if first/second dont work - Same goes for revshells - For example, try different powershell revshells, base64 encoded version, and `nc.exe` revshell - use `pspy` to view running processes - for example, if a user logs into mysql running on localhost, we might see creds being leaked - `xp_cmdshell` can be leveraged to first download `nc.exe`, which can then be leveraged to generate a revshell - alternatively, we can leverage `xp_cmdshell` to execute a powershell revshell one liner - `net service\account` should always have `SeImpersonatePrivilege` - If not run `fullpowers.ps1` - if we have a `meterpreter` shell on a DC, we can easily dump SAM with `hashdump` after migrating to a process running as `administrator`; we can also `load kiwi` to use `mimikatz` - `meterpreter` also allows us to easily download files to Kali - we can use `smbclient` with an NT hash - if we come across a `.sql` file, we can review locally on Kali - BUT, we might need creds ```bash mysql -h 127.0.0.1 -u root -p < tech_forum.sql ``` - `p0wny` is a php webshell with built in upload and download features - `Get-Acl` or `Get-ServiceACL.ps1` can be used to determine who can do what to programs - `changeconfig` can be used to change `binpath` for LPE - add a user to `administrators` group or execute `nc.exe` for a revshell - `accesschk.exe` is similar to above - `icacls` can be used to determine who can do what to folders - if we have LFI, try to read common files for context - `/var/www/html/wordpress/wp-config.php` - usually, restricted shells have a `help` command that shows the commands we are able to run - look for weak hashes in `/etc/shadow - `$1 = MD5 - use `unshadow` to abuse MD5 hashes in `/etc/shadow` - If we are having a hard time running a `.py` script on a target due to dependencies or version incompatibilities, leverage wheel (`.whl`) files, which contain all the files needed to install a Python package, including metadata about the package's version, dependencies, and compatibility - Wheels can target specific Python versions, operating systems, and architectures.