• XSS.stack #1 – первый литературный журнал от юзеров форума

Post exploitation techniques after a successful reverse shell

Отслеживать
Сортировать по дате Сортировать по голосам
Escalating privileges can be a good start, on a web application server you might
find credentials in dbms configuration files.

Do a pivoting, use the credentials and explore old services and systems (such as ms17_010 vulnerable machines)
and after getting the shell on the system, there are a number of ways to continue exploring, such as kerberoasting attacks, silver / golden ticket attack .. .

Maintain persistence, escalate privilege on at least one server, and install a rootkit

and last but not least,
Do a great recon on your scope
 
За 0 Против
corporateace111 сказал(а):
What are good ways of exploiting a system after getting a successful reverse shell? exploiting cmd commands.

You want to get persistence, can search for old versions being used on machine to exploit, can try and crack /etc/passwd, you want to ideally gain/pivot access and install a rootkit, etc
 
За 0 Против
Bash: 
Post-Exploitation Methodology
│
├── 1 - Local Enumeration
│    ├── Enumerating System Information
│    ├── Enumerating Users And Groups
│    ├── Enumerating Network Information
│    ├── Enumerating Services
│    └── Automating Local Enumeration
│
├── 2 – Transfering Files  
│    ├── Setting Up A Web Server With Python
│    ├── Transfering Files To Windows Targets
│    └── Transfering Files To Linux Targets
│
├── 3 - Upgrading Shells
│    ├── Upgrading Command Shells To Meterpreter
│    └── Spawning TTY Shells
│
├── 4 - Privilege Escalation
│    ├── Identifying PrivEsc Vulns
│    ├── Windows PrivEsc
│    └── Linux PrivEsc
│
├── 5 - Persistence
│    ├── Setting Up Persistence On Windows
│    └── Setting Up Persistence On Linux
│
├── 6 - Dumping & Cracking Hashes
│    ├── Dumping & Cracking Windows Hashes
│    └── Dumping & Cracking Linux Hashes
│
├── 7 - Pivoting
│    ├── Internal Network Recon
│    └── Pivoting
│
└── 8 - Clearing Your Tracks
    └── Clearing Your Tracks On Windows & Linux
 
За 0 Против
pakhom сказал(а):
Bash: 
Post-Exploitation Methodology
│
├── 1 - Local Enumeration
│    ├── Enumerating System Information
│    ├── Enumerating Users And Groups
│    ├── Enumerating Network Information
│    ├── Enumerating Services
│    └── Automating Local Enumeration
│
├── 2 – Transfering Files 
│    ├── Setting Up A Web Server With Python
│    ├── Transfering Files To Windows Targets
│    └── Transfering Files To Linux Targets
│
├── 3 - Upgrading Shells
│    ├── Upgrading Command Shells To Meterpreter
│    └── Spawning TTY Shells
│
├── 4 - Privilege Escalation
│    ├── Identifying PrivEsc Vulns
│    ├── Windows PrivEsc
│    └── Linux PrivEsc
│
├── 5 - Persistence
│    ├── Setting Up Persistence On Windows
│    └── Setting Up Persistence On Linux
│
├── 6 - Dumping & Cracking Hashes
│    ├── Dumping & Cracking Windows Hashes
│    └── Dumping & Cracking Linux Hashes
│
├── 7 - Pivoting
│    ├── Internal Network Recon
│    └── Pivoting
│
└── 8 - Clearing Your Tracks
    └── Clearing Your Tracks On Windows & Linux
did you extract this from somewhere you can share? :)
 
За 0 Против
soup сказал(а):
It's easy to find something like that this days
Yes, I did make such a cheatsheet for everything from Recon to Data-Exfiltration, only I don't have the right cheatsheet for persistence. I've searched a bit, but I'd haven't found anything really good.
 
За 0 Против
admin


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх