Some Powershell Discovery Things

 Find older OS on a domain

2000,XP, 2003,Vista, 2008, Win 7, etc.

Get-ADComputer -Filter * -Properties OperatingSystem,LastLogonDate | where {$_.OperatingSystem -like "*2000*"} | select Name, OperatingSystem, Created, whenCreated, LastLogonDate, ipv4address  | sort LastLogonDate -unique | Export-CSV

I switch around "{$_.OperatingSystem -like "*2000*"}" for the various flavors of Windows I might be looking for.  "*Vista*", "*2003*", etc.

Some Kerberos Things

Get-ADComputer -Filter {TrustedForDelegation -eq $true -and primarygroupid -eq 515} -Properties trustedfordelegation,serviceprincipalname,description

Get-ADComputer -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=524288)"

Windows Post Exploit Tips

findstr /si password *.txt

findstr /si password *.xml

dir /s *pass* == *cred* == *vnc* == *.config*

findstr /spin "password" *.*

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

findstr /si password *.ini

dir /b /s sysprep.inf

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" (Windows Autologin)

https://pentestlab.blog/tag/password/ 

Post Exploitation List

Mubix Blog Post


Linux Post Exploitation
Linux Post Exploitation Command List
Backdoor Shell 

Windows Post Exploitation

OS X Post Exploitation

Obscure Systems Post Exploitation

Metasploit Post Exploitation

Known DLLs

Windows Confidential The Known DLLs Balancing Act

Windows UAC Protection Bypass

Via Slui File Handler Hijack

https://packetstormsecurity.com/files/148004/bypassuac_sluihijack.rb.txt

Windows WMI Recieve Notification

https://packetstormsecurity.com/files/147498/ms16_014_wmi_recv_notif.rb.txt

Windows Kernel Exploitation Tutorial

Part 8: Use After Free ≈ Packet Storm https://packetstormsecurity.com/files/147491/winpart8-uaf.pdf

Bad patch, bad patch

Microsoft Fixes Bad Patch That Left Windows 7, Server 2008 Open to Attack https://threatpost.com/microsoft-fixes-bad-patch-that-left-windows-7-server-2008-open-to-attack/130871/

Lexpress for the win

Check out @bohops’s Tweet: https://twitter.com/bohops/status/969388848416460800?ref_src=twcamp%5Eshare%7Ctwsrc%5Eandroid%7Ctwgr%5Edefault%7Ctwcon%5E7090%7Ctwterm%5E3

Microsoft Windows 32-bit / 64-bit cmd.exe Shellcode

https://packetstormsecurity.com/files/142572/wincmdexe-shellcode.txt

Hide console shellcode

Windows x86 Hide Console Window Shellcode https://packetstormsecurity.com/files/141586/winx86hide-shellcode.txt

Directory search shellcode

Windows x86 Executable Directory Search Shellcode

https://packetstormsecurity.com/files/141333/win86execdirsearch-shellcode.txt

Basics of Windows Incident Response

https://jordanpotti.com/2017/01/20/basics-of-windows-incident-response/

Detecting Kerberoasting Activity Part 2

Creating a Kerberoast Service Account Honeypot https://adsecurity.org/?p=3513

Microsoft AD hacking tricks

Sneaky Persistence Active Directory Trick #18: Dropping SPNs on Admin Accounts for Later Kerberoasting https://adsecurity.org/?p=3466

Practice on ntds.dit file

https://blog.didierstevens.com/2016/07/25/practice-ntds-dit-file-overview/

Huge thanks to Didier Stevens for this

Windows DLL Injection

the basics

metasploit




Tools:
DueDLLigence