Commit graph

205 commits

Author SHA1 Message Date
Th1b4ud
2740600a6b
Alternative TTY method with /usr/bin/script 2020-04-21 19:21:51 +02:00
Swissky
89f906f7a8 Fix issue - C reverse shell 2020-04-21 11:17:39 +02:00
Swissky
af6760ef7a RoadRecon + JSON None refs 2020-04-17 16:34:51 +02:00
Th1b4ud
29194a8ef1
Add others shell on reverse shell cheatsheet
Add others shell on reverse shell cheatsheet
2020-04-13 19:06:01 +02:00
Swissky
6e7af5a267 Docker Registry - Pull/Download 2020-04-04 18:27:41 +02:00
M4x
1d299f55c9
Delete unnecessary escape characters
`whoami` has already been wrapped in backquotes. There is no need to user escape characters again
2020-03-29 23:40:39 +08:00
Swissky
be8f32b586 Docker escape and exploit 2020-03-29 16:48:09 +02:00
Swissky
95ab07b45e CloudTrail disable, GraphQL tool 2020-03-28 12:01:56 +01:00
guenicoe
a3cc577ebd
added cmd on the USOSVC vuln
Added `cmd \c C:\Users\nc.exe` as not typing `cmd \c` did not work for me. Might need even more explanation
2020-03-24 20:15:59 +00:00
PixeL
1b190939c4
Remove example from win priv esc
This example was used on hackthebox where it leaked the root flag of a machine on free servers.
This resulted in every user being able to get the root flag before they have even completed the box which isn't fair to others.

This example should either be changed or removed completely to combat copy-pasting without knowing what you're doing.
2020-03-23 17:17:42 -05:00
Fanis Katsimpas
2bdbb2dbc5
Update Windows - Privilege Escalation.md
Make powershell on EoP - Runas easier to copy paste
2020-03-22 19:25:35 +00:00
Swissky
1538ccd7f2 Gaining AWS Console Access via API Keys 2020-03-19 11:59:49 +01:00
Swissky
1f3a94ba88 AWS SSM + Shadow copy attack 2020-03-06 15:30:38 +01:00
Swissky
5d87804f71 AWS EC2 Instance Connect + Lambda + SSM 2020-03-06 13:33:14 +01:00
Swissky
c19e36ad34 Azure AD Connect - MSOL Account's password and DCSync 2020-03-01 17:06:31 +01:00
Swissky
71a307a86b AWS - EC2 copy image 2020-02-29 12:56:00 +01:00
Swissky
74f2dfccca Kerberos Constrained Delegation 2020-02-23 21:20:46 +01:00
Swissky
c5ac4e9eff AWS Patterns 2020-02-23 20:58:53 +01:00
Swissky
915946a343 Fix Cloud Training 2020-02-21 10:50:43 +01:00
Swissky
bda7100a77 Fix Cloud references 2020-02-21 10:47:16 +01:00
Swissky
984078050b Cloud - Pentest with AWS and Azure 2020-02-21 10:36:01 +01:00
Swissky
7f0650dfc0 IIS Raid Persistence 2020-02-20 16:51:22 +01:00
Swissky
ba30618a8b Cobalt Strike - Artifact 2020-02-14 17:10:00 +01:00
Swissky
7cd49769be WMI + Cobalt Strike 2020-02-13 22:53:45 +01:00
Sameer Bhatt (debugger)
994e557178
Added more TTY Shell using perl and python 2020-02-09 12:46:18 +05:30
Swissky
aba6874517 Maps API + secretsdump enabled user/pw last set + certutil mimikatz 2020-02-06 21:41:29 +01:00
socketz
056161fd9f
Updated Java & Groovy Shells
Added threaded shells and alternative pure Java reverse shell
2020-02-06 15:43:58 +01:00
antonioCoco
50a376337d
Update Reverse Shell Cheatsheet.md 2020-02-05 23:29:43 +01:00
Swissky
fb76fdc331 Windows Firewall + DLL hijacking + Named pipes 2020-02-01 22:12:36 +01:00
Swissky
be0397fa68 BloodHound ZIP + Zero Width space tip 2020-01-19 22:46:45 +01:00
Mehtab Zafar
8dc1e3c5fe
Update TTY shell command for python
Made the command to use python3 because mostly now the machines have python3 installed.
2020-01-10 17:57:53 +05:30
Ayoma Wijethunga
7f34c01794 Change IP and port to a common value across commands 2020-01-09 16:20:49 +05:30
Ayoma Wijethunga
96b9adb98b Change IP and port to a common value across commands 2020-01-09 16:17:35 +05:30
Swissky
742c7ee3c2 AppLocker rules 2020-01-06 23:03:54 +01:00
Swissky
71171fa78b SSRF exploiting WSGI 2020-01-05 22:11:28 +01:00
Swissky
3a9b9529cb Mimikatz - Credential Manager & DPAPI 2020-01-05 17:27:02 +01:00
Swissky
73abdeed71 Kerberos AD GPO 2020-01-05 16:28:00 +01:00
Swissky
b052f78d95 Blacklist3r and Machine Key 2020-01-02 23:33:04 +01:00
György Demarcsek
9c188139ec
Added PHP reverse shell
This reverse shell payload for PHP works even if `exec` is disabled and/or the new socket is not on fd 3
2020-01-02 19:27:35 +01:00
Swissky
0a6ac284c9 AdminSDHolder Abuse 2019-12-30 19:55:47 +01:00
Swissky
bcb24c9866 Abusing Active Directory ACLs/ACEs 2019-12-30 14:22:10 +01:00
Swissky
4b10c5e302 AD mitigations 2019-12-26 12:09:23 +01:00
Swissky
1535c5f1b3 Kubernetes - Privileged Service Account Token 2019-12-20 11:33:25 +01:00
Swissky
cf5a4b6e97 XSLT injection draft 2019-12-17 21:13:59 +01:00
Swissky
896e262531 Privilege impersonation and GraphQL SQLi 2019-12-11 16:59:14 +01:00
Swissky
6f4a28ef66 Slim RCE + CAP list 2019-12-05 23:06:53 +01:00
Swissky
c60f264664 RDP backdoor + RDP session takeover 2019-11-26 23:39:14 +01:00
Swissky
06864b0ff8 Password spraying rewrite + Summary fix 2019-11-25 23:35:20 +01:00
Swissky
3abaa3e23d Linux AD - Keyring, Keytab, CCACHE 2019-11-25 23:12:06 +01:00
Swissky
00684a10cd IIS asp shell with .asa, .cer, .xamlx 2019-11-16 14:53:42 +01:00