Windows

Exploitation

• Hashgrab using scf, lnk
  • https://github.com/Greenwolf/ntlm_theft/blob/master/ntlm_theft.py
• SMB guest access, null sessions
• ldap queries - --rid-brute
• Web apps - Tilde enum

Privesc

• Check user privileges
• Check group privileges
  • If part of an interesting group but cant see the privileges:
    • Check UAC bypassing
• Check Permission issues
  • SharpUp, wmic, accesschk, sc
• Kernel Exploitation
• Check what third party programs are installed
  • exploit Vulnerable Service
• Escape Citrix
• Check always installed elevated reg keys
• Check Scheduled Tasks

Post Exploitation

• Credential Theft
  • lazagne, snaffler, PS History, config, ini, xml
  • Chrome, Firefox
  • sticky notes, clipboard
  • PS creds, DPAPI decryption
• Traffic capture
  • Wireshark
  • procmon.ps1
• check installed apps
• check ps and reg keys
• Check backup accounts/servers
• Check description fields nxc smb --users
• Mount VHDX/VMDK