# Initial Foothold

#### **General:**

1. Always try to **guess directories** (common names, machine name, smb share, ftp dirs name)
2. When founds mysql/mssql **creds**, try to get a shell with **sqsh**
3. **DNSrecon** when DNS 53 is open (try **UDP** **scan** too) a. **nslookup** -> server IP -> IP b. **dig** axfr domain @IP
4. Try **SQLi** on login page
5. Try **NoSQLi** on login
6. Try to add payload in **exiftool** comment when uploading images
7. Try **$()** for **command injection** if there is **filtering**
8. Enum SNMP with **snmpwalk**
9. Try to **bypass 403** in a url with **/;/**
10. Check for **port banners** with **LFI** (/proc/PID/cmdline)
11. For **Oracle TNS**, use **odat** (HTB Silo)

#### **Redis:**

1. Try **redis rogue server** RCE (https://github.com/Dliv3/redis-rogue-server)
2. If 1 doesn't work, try uploading **custom module.so** file and use redis-cli MODULE LOAD (hacktricks)
3. Try config set dir and config set dbname **manually**
4. If **non persistent** on disk, try adding **ssh keys** (see HTB Postman)

#### **Linux:**

1. Enumerate **all ports**
2. **Upload** files via ftp/access via web
3. **Bruteforce** FTP/SSH/MYSQL/ with **given usernames** atleast or apply **common** default creds
4. Try to **chain** issues
5. **searchsploit** software name + version
6. Search on google for better **PoC** on **github**
7. Check **null passwords**

#### **Linux Reverse shell:**

1. Change ports to **well known ports**
2. Check **nc version** with '**which**','whereis'
3. Try **nc mkfifo**, python, python3
4. Host a server on your machine, curl exploit file on target and system

#### **Windows Reverse shell:**

1. Try powershell **base64** (revshells.com)
2. **Libreoffice** for client side **macro** attacks
3. URL **Encode enabled**
4. **msfvenom** _-p windows/shell\_reverse\_tcp_

#### **Windows:**

1. **Mount smb** shares with **mount** _-t cifs -u anonymous_
2. Mount **vhd** files with **guestmount** (HTB bastion)

#### **Active Directory:**

1. **crackmapexec** to check for allowed types (smb/evil-winrm/ssh)
2. **Enum4linux**
3. From a list of users, find valid users with **kerbrute**
4. Search for service accounts through **LDAPsearch**
5. Check for **service account permissions with bloodhound**
6. Use **bloodhound-python** if no interactive shell
7. If a domain is being hit by target, use python **DNSUpdate** and responder (HTB intelligence)
8. **GPP Passwords** are inside Policies\ID\MACHINE\Preferences\Groups
9. **AS-REP roasting** with list of users with **GetNPUsers.py**
