Please enable JavaScript.

Coggle requires JavaScript to display documents.

SAN 560.3 - Coggle Diagram

- - - - Kernel Exploits :star:
        Services Running as root :star:
        World Writable Files (config files) :star:
        SETUID :star:
        GTFOBins (manage list of Unix Binaries) :star:
    - - Tools
        
        PowerSploit Powerup :star:
        Modifiable Service Binaries :black_small_square:
        Writable Registry Keys :black_small_square:
        Autologon Creds. :black_small_square:
        DLL Hijacking :black_small_square:
        LOLBAS (manage Binaries, Scripts, Libs) :star:
      - Common PrivEsc Flaws :star:
        DLL search order hijacking :black_small_square:
        Unquoted paths with spaces :black_small_square:
        Writable Windows Service executables :black_small_square:
        "AlwaysInstallElevated" registry key :black_small_square:
        Unattended install files :black_small_square:
        Group Policy Preferences (Windows 2008 domain env.) :black_small_square:
        Bypass UAC (separation of admin and non-admin functionality) :black_small_square:
  - - - Account (/etc/passwd) :star:
        Group (/etc/group) :star:
        Find Interesting Files :star:
        Copy/Paste to move files :star:
        Local File Pilfering :star:
        Password representations (UNIX/Linux: /etc/passwd, Windows: SAM database) :black_small_square:
        Crypto keys (SSH keys, PGP and GnuPG keys) :black_small_square:
    - - Useful Environment Variables (set) :star:
        Searching the File System (dir /b /s) :star:
        Managing Windows Accounts and Groups :star:
        Domain User (net user /domain) :black_small_square:
        Local Groups (net localgroup) :black_small_square:
        Domain Groups (net group) :black_small_square:
        Analyzing a System :star:
        Determining Firewall Settings (netsh advfirewall show allprofiles) :black_small_square:
        Displaying and Scraping Through Files (type) :black_small_square:
        Interacting with the Registry (reg) :black_small_square:
        PowerView :star:
        Active Directory reconnaissance :black_small_square:
        pull a full list of AD user, computer, group objects with all attributes :black_small_square:
        AD explorer :star:
        signed by Microsoft :black_small_square:
        Any domain user can request full AD layout :black_small_square:
        Dump contain password in notes fields :black_small_square:
        Find passwords in ADExplorer output :black_small_square:
        The output can only read by AD Explorer :black_small_square:
      - Seatbelt (Safety checks) :star:
- - - - :star: SAM Database (Windows NT, 2000, XP, 2003)
        
        Local Windows password representations
        
        Stored %systemroot%\ntds\ntds.dit
        
        Two forms
        :eight_pointed_black_star:LANMAN (16 bytes)
        :eight_pointed_black_star:NT Hash (16 bytes)
        
        :star: SAM Database
        
        authentication protocols for authentication across the network
        
        Three forms
        :eight_pointed_black_star:LANMAN Challenge/Response (21 bytes)
        :eight_pointed_black_star:NTLMv1 (24 bytes)
        :eight_pointed_black_star:NTLMv2 (call NTLMv2 One-Way Function (OWF))
        :eight_pointed_black_star:Microsoft Kerberos
    - - :star: Traditional DES-based schemes
        :star: MD5 ($1$)
        :star: BSDi Extended DES (_)
        :star: Blowfish-based ($2$ or $2s$)
        :star: SHA-256 ($5$)
        :star: SHA-512 ($6$)
  - - - :star: Meterpreter hash dump
        :star: mimikatz
        :star: Volume Shadow Copy Service (VSS) on Domain Controller
        :star: Sniff Challenge/response from the network
        :star: NTDSUtil (Install from Media Feature)
    - - :star: JtR
        
        Single crack
        
        Wordlist
        
        Incremental (brute force attack)
        
        External (Write your own code)
        
        :star:Hashcat
        
        specify multiple dictionary
        
        specify rules files
        
        Masking
        
        :star: Pcredz
    - - :star: Responder
        
        NBNS (NetBIOS Name Service)
        
        LLMNR (Link-Local Multicast Name Resolution)
        
        HTTP/SMB