Red Team Notes
1.0.0
1.0.0
  • Introduction
  • PowerShell
    • find_files_by_name
    • powershell_web_access
    • enable_psremoting
    • powershell_sans_cheat
    • powerup_-_privilege_escalation
    • user_enumeration
    • powershell_-_quickies
    • constrained_language_breakout
    • powershell_-_get-system
    • domain_enumeration
    • powershell
    • random_powershell
  • mainframe
    • tso_commands
    • nmap_stuff_-_recon
  • Links and Random
    • Commands--mount-shares
    • Commands--responder
    • Commands--nac_testing
    • trash
    • Commands--nessus-openvas
    • Commands--named_pipes
    • ptx
    • Commands--mortar-shells
    • Redis-Cheatsheet
    • wifi_driver_stuff
    • bypassing_applocker_living_off_land
    • Commands--remote_and_local_file_inclusion
    • Commands--netcat-ftp
    • mimikatz
  • wifi-hacking
    • eaphammer
    • aircrack-ng_and_jtr_attack
    • new_page
    • cracking_wpa_attack
    • aircrack-ng
    • wifite
    • basics
    • hostapd
    • cowpatty_attack
    • rogue_access_point
    • cracking_wep_via_a_client_attack
    • handshake-via-pcap
    • clientless_wep_attack
    • fluxion
    • reaver
    • crack_wep
    • pyrit_attack
    • wep_shared_key_authentication_attack
  • mobile
    • qark
    • dex2jar
    • jd-gui
    • mobile
    • baby_steps
    • apktool
    • smali_and_baksmali
  • Cobalt-Strike
    • apache_rewrite_.htaccess
    • playbook
      • mail_and_smtp_enumeration-manipulation
      • lateral_movement
      • overpass_the_hash_with_rubeus-beacon_-_h
      • persistence
      • privilege_escalation
      • after_initial_access
    • situational_awareness_-_harmj0y
    • malleable
    • sid_hopping
    • generating_certificates
    • safety
    • random_commands
    • golden_ticket
    • go_daddy_domain
    • github_repos
    • malware_av_evasion
    • malware_av_evasion--main.go
    • c2_infrastructure
    • cobalt_strike_certificates
    • cpl_resource_runner_payload
  • Metasploit
    • nessus
    • network
    • meterpreter
  • Information Gathering Enumeration
    • 35 Searchsploit
    • 30 Find
    • 21 WinRM
    • 50 Gobuster
    • Enumeration by Port Number
    • 40 Active Directory
    • Linux Prevesc
    • pivoting
    • 20 Reconnoitre
    • Kerberos cheatsheet
    • 11 SMB Part 1
    • 00 ENUMERATION
    • 10 Nmap
    • 12-check-for-anonymous-smb
    • bruteforcing
    • 60 DNS Enumeration
    • 15 Firefox
  • Commands
    • rbash
    • tools-sources
    • tar
    • network-change-ip
    • sed_and_changing_files_for_malware_evasi
    • web_discovery
    • xxd
    • droopescan
    • c#
    • proxychains-admin-network
    • de-duplicate
    • privilege-escalation-windows_-_and_empir
    • ping_sweep
    • wget
    • snmp
    • custom-payloads
    • python
    • curl-wget
    • proxychains
    • goddi_-_domain_enumeration
    • nginx-bypass
    • outlook_and_owa
    • physical_hacking--rasperry_pi
    • have_a_shell
    • xml-xxe-xpath
    • xss-iframe
    • port-forward
    • physical_hacking
    • pack
    • client-side-iframe-attack
    • waf
    • laps
    • images-with-files-in-them
    • fresh-install
    • privilege-escalation-linux
    • masscan
    • arp-spoof
    • shellshock-squid
    • merlin
    • redis
    • get-browserdata
    • lateral_movement
    • smb-netbios-rpc
    • password-cracking
    • virtual-box_guest_additions
    • host_discovery-dns
    • certificate_tls_and_ssl
    • postgresql
    • physical_hacking--bash_bunny
    • powerview--new_page
    • mail_sniper
    • searchsploit
    • crackmapexec
    • user_agent
    • lolbins
    • files-inside-of-pictures
    • random_shellcode_-_scratch-pad
    • linux
    • ports
    • block-ip-iptables
    • httpscreenshot
    • dnscat
    • wp-scan
    • gather-gpp-creds
    • group-policy-decrypt-passwords
    • buffer-overflow
    • mac_address_change
    • sql
    • compiling-code
    • shell-for-buffer-overflow
    • hex_encode_command_line
    • spawn_a_better_shell_-_break_out_of_shit
    • nikto-proxy
    • osint
    • assembly
    • sshuttle
    • nmap_and_scanning
    • root_user_add
    • pass_the_hash
    • test-for-xxe
    • payloads
    • webdav
    • cut_commands
    • unicorn_scan
    • rdesktop_and_screen_for_linux
    • spooler_exploit
    • dns-zone-transfer
    • ssh
    • password-grep
  • reverse-shell-one-liners
    • ruby
    • c-language-reverse-shell
    • reverse_shell_one_liners
    • perl-reverse-shell-cgi-format
    • java_reverse_shell
    • python_reverse_shell
  • Bypass-Applocker
    • vbs_macro
    • pubprn.vbs
    • demiguise
    • mshta
    • regsvcs
    • regasm_2
    • bypass-uac
    • installutil
  • windows
    • uninstall_patches
    • passwords
    • powerview_3.0,_harmj0y
    • port_forward
    • powerview_acl_enum-abuse
    • powerview,_enumerate_groups-ac
    • search_4_loot
    • firewall
    • laps_abuse
    • enumeration
    • Windows
    • Windows_service_abuse
    • Windows Enumeration
  • mimikatz
    • mimikatz_list_modules
    • list_commands_in_module
    • mimikatz
    • remote_control_rpc
    • applocker_bypass_and_other_sn
    • mimikatz_-_start_and_stop_processes
    • base64_all_the_things
    • rdp
    • avoid_new_events
    • mimikatz_-_tokens
  • red-team
    • privilege_escalation_across_trusts
    • file_servers_and_files
    • lateral_movement
    • Commands--red_team
    • forest_enumeration
    • persistence_techniques
    • privilege_escalation
  • Start Procedure
    • Start-Procedure
  • Tools to add to Kali Linux
  • AD-notes
    • more-ad-notes
    • bloodhound
    • ad-notes-chirag
    • enumeration
    • pam_abuse
    • laps_abuse
    • domain_privilege_escalation
    • active_directory_one_liners
  • Setting up Kali Linux
    • Tools to add to Kali Linux
    • Items to Install in Kali
      • tmux
        • tmux_config
        • Setup_-_TMUX
        • tmux_cheat_sheet
      • crontab
      • rclone
      • Items_to_install_in_Kali
    • Tools to install
  • SQL
    • abusing_sql_server_trusts--privilege_escalation
    • abusing_sql_server_trusts
    • abusing_sql_server_trusts--post_exploitation_enumeration
    • 31 SQL
  • tools to install
  • command line
  • simple note
  • Enumeration
  • Tools to install on Windows
  • temp-readme
Powered by GitBook
On this page
  • apt install
  • Obsidian
  • Other Tools to install
  • Firefox addons
  • FoxyProxy and BURP certificate
  • git clone

Was this helpful?

  1. Setting up Kali Linux

Tools to install

apt install

updatedb apt search xxxxxx

on new install

apt update
apt install kali-desktop-gnome

apt install kali-linux-default
apt install kali-linux-everything

apt install kali-wallpapers-all

dpkg-reconfigure locales
dpkg-reconfigure keyboard-configuration
apt-get install console-common



dpkg-reconfigure kali-grant-root

If you really don’t care about security, and if you preferred the old model, you can install kali-grant-root and run

dpkg-reconfigure kali-grant-root



to configure password-less root rights.

sudo su
(enter you password)

dpkg-reconfigure kali-grant-root
(choose top option)

sudo su
(we don't need password for root.  close terminal and reopen it)


next edit .bashrc for the user and add

sudo su 

to the bottom 
-----
update Kali Linux

    apt update
    apt list --upgradeable
    apt upgrade

    apt dist-upgrade

tmux

    apt-get install tmux

nano ~/.tmux.conf 


# Improve colors
# set -g default-terminal 'screen-256color'


# Set scrollback buffer to 10000
set -g history-limit 1000000


# Customize the status line
# set -g status-fg  green
# set -g status-bg  black


# remap prefix from 'C-b' to 'C-a'
unbind C-b
set-option -g prefix C-a
bind-key C-a send-prefix


# split panes using | and -
bind h split-window -h
bind v split-window -v
unbind '"'
unbind %


# don't rename windows automatically
set-option -g allow-rename off


# reload config file (change file location to your the tmux.conf you want to use)
bind r source-file ~/.tmux.conf

tmux new -s HTB

sublimetext

wget -qO - https://download.sublimetext.com/sublimehq-pub.gpg | sudo apt-key add -

apt-get install apt-transport-https

echo "deb https://download.sublimetext.com/ apt/stable/" | sudo tee /etc/apt/sources.list.d/sublime-text.list

apt-get update

apt-get install sublime-text

rclone

    apt install rclone
    rclone config
    n
    GoogleDrive
    (number for Google Drive)
    client_id <cr>
    client_secret <cr>
    Choose a number from below, or type in your own value
         1 / Full access all files, excluding Application Data Folder.
             \ "drive"
    edit advanced config (Y/N) n
    use auto config (Y/N) y

crontab -e

crontab -e

# Edit this file to introduce tasks to be run by cron.
# 
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
# 
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').
# 
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# 
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
# 
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
# 
# For more information see the manual pages of crontab(5) and cron(8)
# 
# m h  dom mon dow   command

# ┌───────────── minute (0 - 59)  
# │ ┌───────────── hour (0 - 23)  
# │ │ ┌───────────── day of month (1 - 31)  
# │ │ │ ┌───────────── month (1 - 12)  
# │ │ │ │ ┌───────────── day of week (0 - 6) (Sunday to Saturday;  
# │ │ │ │ │                                   7 is also Sunday on some systems)  
# │ │ │ │ │  
# │ │ │ │ │  
# * * * * * command_to_execute 

# Backup Documents to Google Drive evey 20 minutes
*/20 * * * * rclone sync /root/Documents/ GoogleDrive:kali-Documents-2019.3/
# 09 * * * * rclone copy GoogleDrive:kali-Documents-2019.3a/ /home/kali/Documents/
*/10 * * * * rclone copy GoogleDrive:Machine-Writeups-Notes/ /root/Documents/



/home/kali

AutoRecon

sudo apt install python3
sudo apt install python3-pip


(To make this easier, you could add the following alias to your ~/.profile (or equivalent):)

alias sudo="sudo env \"PATH=$PATH\""

Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/kali/.local/bin"

sudo apt install seclists curl enum4linux gobuster nbtscan nikto nmap onesixtyone oscanner smbclient smbmap smtp-user-enum snmp sslscan sipvicious tnscmd10g whatweb wkhtmltopdf

sudo python3 -m pip install git+https://github.com/Tib3rius/AutoRecon.git

MS Visual Studio

cd /opt/

sudo apt update
sudo apt install curl gpg software-properties-common apt-transport-https
curl -sSL https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
echo "deb [arch=amd64] https://packages.microsoft.com/repos/vscode stable main" | sudo tee /etc/apt/sources.list.d/vscode.list
sudo apt update
sudo apt install code

Obsidian

cp ~/Downloads/Obsidian-0.11.13.AppImage ~/.local/bin/obsidian 
chmod +x ~/.local/bin/obsidian

Other Tools to install

xclip

Firefox addons

Wappalyzer

FoxyProxy and BURP certificate

add FoxyProxy into Firefox via the menu
searchsploit -u
apt install golang

mkdir -p ~/go/{pkg,bin,src}

nano ~/.profile

add

    export GOPATH="$HOME/go"
    export GOBIN="$GOPATH"/bin"
    export PATH="$PATH:$GOBIN"


exit and save then type
~/.profile     


go get -v -u github.com/zricethezav/gitleaks

gobuster
git clone https://github.com/OJ/gobuster.git
go build
    apt install python3-dev python3-pip

    pip3 install truffleHog
    pip3 install jwt
    pip3 install pyjwt
Microsoft Access database tools

    apt install mdbtools
Tools for reading Microsoft Outlook PST files

    apt install pst-utils
apt install crackmapexec

apt install rlwrap
cd /opt/
git clone https://github.com/SecureAuthCorp/impacket

cd /opt/
git clone https://github.com/DominicBreuker/pspylo

cd /opt/
git clone https://github.com/ropnop/kerbrute


cd /opt/
rm -rf BloodHound

git clone https://github.com/BloodHoundAD/BloodHound.git

cd/opt/BloodHound

wget https://github.com/BloodHoundAD/BloodHound/releases/download/3.0.3/BloodHound-linux-x64.zip
unzip BloodHound-linux-x64.zip


cd /opt/
git clone https://github.com/PowerShellMafia/PowerSploit/ -b dev

mimitatz
cd /opt/
git clone https://github.com/gentilkiwi/mimikatz


cd /opt/
git clone https://github.com/pdfminer/pdfminer.six
pip install pdfminer.six


cd /opt/
git clone https://github.com/wireghoul/dotdotpwn


cd /opt/
git clone https://github.com/theevilbit/ciscot7.git

evil-winrm
cd /opt/
git clone https://github.com/Hackplayers/evil-winrm
cd /evil-winrm
gem install evil-winrm
pip3 install donut-shellcode


cd /opt/
apt install padbuster


cd /opt/
apt install python3-venv p7zip-full -y


cd /opt/
git clone https://github.com/snovvcrash/usbrip.git usbrip && cd usbrip

git clone

cd /opt

git clone

apt install padbuster

vpn openvpn --config dystopian.ovpn

crontab

bash script to install tools

#!/bin/bash

home='cd /opt'

`echo $home`

apt install python3-dev python3-pip
pip3 install truffleHog
pip3 install jwt
pip3 install pyjwt

apt install pst-utils
apt install crackmapexec
apt install rlwrap

# dirsearch
git clone https://github.com/maurosoria/dirsearch

# EyeWitness
git clone https://github.com/FortyNorthSecurity/EyeWitness
cd EyeWitness/setup
./setup.sh
`echo $home`

# Masscan
git clone https://github.com/robertdavidgraham/masscan

# Parameth
git clone https://github.com/maK-/parameth

# Recon-ng
git clone https://bitbucket.org/LaNMaSteR53/recon-ng

# Sublist3r
git clone https://github.com/aboul3la/Sublist3r

# Aquatone
git clone https://github.com/michenriksen/aquatone

# WPScan
git clone https://github.com/wpscanteam/wpscan

# DNSRecon
git clone https://github.com/darkoperator/dnsrecon

# Gobuster
git clone https://github.com/OJ/gobuster
cd gobuster
apt install golang
make
export PATH=$PATH:/opt/gobuster
`echo $home`

# MassDNS
git clone https://github.com/blechschmidt/massdns

# RobotsDisallowed
git clone https://github.com/danielmiessler/RobotsDisallowed

# Seclists
mkdir wordlists; cd wordlists
git clone https://github.com/danielmiessler/SecLists
`echo $home`

# Easy-P
git clone https://github.com/cheetz/Easy-P

# Nishang
git clone https://github.com/samratashok/nishang

# Powersploit
git clone https://github.com/PowerShellMafia/PowerSploit

# LinEnum
mkdir -p priv_esc/linux; cd priv_esc/linux
git clone https://github.com/rebootuser/LinEnum

# linux-exploit-suggest.sh
git clone https://github.com/mzet-/linux-exploit-suggester

# linuxprivchecker.py
wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py

# unix-privesc-check
git clone https://github.com/pentestmonkey/unix-privesc-check
`echo $home`

# Empire
mkdir priv_esc/windows; cd priv_esc/windows
git clone https://github.com/EmpireProject/Empire
`echo $home`

# my bits now
#/----------------------------------------------------------------------------/

git clone https://github.com/SecureAuthCorp/impacket

git clone https://github.com/DominicBreuker/pspylo

git clone https://github.com/ropnop/kerbrute

cd /opt/
rm -rf BloodHound

git clone https://github.com/BloodHoundAD/BloodHound.git

cd/opt/BloodHound

wget https://github.com/BloodHoundAD/BloodHound/releases/download/3.0.3/BloodHound-linux-x64.zip
unzip BloodHound-linux-x64.zip


cd /opt/
git clone https://github.com/PowerShellMafia/PowerSploit/ -b dev

# mimitatz
cd /opt/
git clone https://github.com/gentilkiwi/mimikatz


cd /opt/
git clone https://github.com/pdfminer/pdfminer.six
pip install pdfminer.six


cd /opt/
git clone https://github.com/wireghoul/dotdotpwn


cd /opt/
git clone https://github.com/theevilbit/ciscot7.git

evil-winrm
cd /opt/
git clone https://github.com/Hackplayers/evil-winrm
cd /evil-winrm
gem install evil-winrm
pip3 install donut-shellcode


cd /opt/
apt install padbuster


cd /opt/
apt install python3-venv p7zip-full -y


cd /opt/
git clone https://github.com/snovvcrash/usbrip.git usbrip && cd usbrip
etc/hosts


# Hack the Box machines
10.10.10.29     bank.htb
# 10.10.10.100  active.htb htb
# 10.10.10.160  Postman
# 10.10.10.161  htb.local htb 
# 10.10.10.162  staging-order.mango.htb
# 10.10.10.168  obscurity.htb
# 10.10.10.172  megabank.local
# 10.10.10.177  oouch.htb consumer.oouch.htb authorization.oouch.htb
# 10.10.10.179  megacorp.htb
# 10.10.10.180  remote.htb
# 10.10.10.183  forwardslash.htb
# 10.10.10.186  quick.htb portal.quick.htb


# Vulnhub machines
# 192.168.1.86  kioptrix3.com
# 192.168.1.87  gfriEND.lan

I

this will set up root.

sudo -i
(enter you password)

whoami
(this should return root)

(now change the password for root)
passwd root
(now type the password)
crontab 

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
21 *    * * *   root    rclone copy GoogleDrive:/kali-Documents-2019.3 /home/kali/Documents/
23 *    * * *   root    rclone sync /home/kali/Documents/ GoogleDrive:/kali-Documents-2020.1
03 * * * * rclone copy GoogleDrive:kali-Documents-2020.3a/ /home/kali/Documents/
*/05 *  * * *   root    rclone copy GoogleDrive:/kali-Documents-2020.3a/ /home/kali/Documents/

change ownership of all files from root to user For recursive (i.e files and folders inside a folder):

 sudo chown -R user:user dirName

PS1='[\033[1;31m]\u@\h[\033[1;34m]\w:[\033[0;37m]$

Linux proof

    hostname && whoami && cat proof.txt && ip a

Windows proof

    hostname && whoami.exe && type proof.txt && ipconfig/all
# m h  dom mon dow   command
# ┌───────────── minute (0 - 59)  
# │ ┌───────────── hour (0 - 23)  
# │ │ ┌───────────── day of month (1 - 31)  
# │ │ │ ┌───────────── month (1 - 12)  
# │ │ │ │ ┌───────────── day of week (0 - 6) (Sunday to Saturday;  
# │ │ │ │ │                                   7 is also Sunday on some systems)  
# │ │ │ │ │  
# │ │ │ │ │  
# * * * * * command_to_execute 

# Backup Documents to Google Drive evey 20 minutes
*/20 * * * * rclone sync /root/Documents/ GoogleDrive:kali-Documents-rolling-new/
#*/07 * * * * rclone sync /root/Documents/machine-write-ups/ GoogleDrive:Machine-Writeups-Notes/
*/05 * * * * rclone sync GoogleDrive:kali-Documents-rolling-2021.1a/ /root/Documents/
*/07 * * * * rclone sync GoogleDrive:kali-Documents-rolling-2021-1/ /root/Documents/
*/10 * * * * rclone copy GoogleDrive:Machine-Writeups-Notes/ /root/Documents/machine-write-ups
PreviousItems_to_install_in_KaliNextSQL

Last updated 3 years ago

Was this helpful?

apt install python3-venv p7zip-full -y git clone usbrip && cd usbrip

https://github.com/snovvcrash/usbrip.git