Notes

NTLM Relay Attack (ESC8)No PKINIT?Shadow Credentials

Resource-Based Constrained Delegation (RBCD)Active Directory Cheat Sheet Active Directory Checklist ◇Active Directory Overview Kerberoasting

Advanced RDP Bruteforcing Bitlocker Brute Forcing FTP Brute Forcing SMB Cracking Files Default Credentials HTTP Authentication Hydra

File Transfer - FTP ◇Transfer Files to ATTACKER ◇Transfer Files to VICTIM Using Netcat

◇Basic Linux PE Flow Cron Job Abuse ◇Linux Privilege Escalation (Canvas)SSH Forwarding

Ligolo-Ng ◇Pivoting with Ligolo-ng

SMB (139, 445)SQL (1433)NFS/Mountd (2049)FTP (21)Email Services RDP (3389)DNS (53)RPC Tools to Interact with Services

FFUF NoSQL Injection Webshells Collection

Basic Powershell Commands ◇PowerView ◇Windows PE Flow ◇Windows Privilege Escalation (Canvas)

◇The Concept of Attack

thanks to twitch.tv/kirasec for canvas

RPC

Services2025-02-18

RPCService

Misconfigurations

We can use the rpcclient tool with a null session to enumerate a workstation or Domain Controller.

rpcclient -U'%' <ip>

rpcclient gt; enumdomusers