Testlab

Virtual machines
Assemblers
Compilers
Disassemblers
Debuggers
Decompilers
Exploit development
Exploitation tools

Notes on techniques

Introduction
- What?
- Why?
- How?
Exploiting vulnerabilities
- Social engineering
- Application-based
Attack infrastructures
Common shells

Linux

Introduction
- What?
- Why?
- How?
Reuseful escalation patterns
Kernel vulnerability exploits
- Example: CVE-2015-1328
  - Using 37292
  - Using 40688
- Notes
Exploit sudo misconfigurations
- Example: find
  - LD_PRELOAD
  - Another find
- Notes
SUID and SGID exploits
- Example: nano
  - Crack passwords file
  - Add a user
- Notes
Exploit capable programs
- Example: vim
- Notes
Cron jobs exploits
- Example: Backup script
- Notes
Path exploits
- Example
- Notes
NFS exploits
- Example: /tmp share
- Notes
Shellcode techniques
- Resources

Windows

Introduction
- What?
- Why?
- How?
Reuseful escalation patterns
Harvesting passwords
- Examples
- Notes
Quick misconfiguration wins
- Examples
  - Scheduled tasks
  - AlwaysInstallElevated
- Notes
Abusing service misconfigurations
- Examples
- Notes
Abusing dangerous privileges
Abusing vulnerable software
- Example
- Notes
Shellcode techniques
- Resources

Coding shells and exploits

Basic TCP reverse shell
Execute system commands
Keylogger
Backdoor
Bypasses

TryHackMe rooms

Introduction
- What?
- Why?
- How?
Windows PrivEsc
Linux PrivEsc
Steel Mountain
Alfred
HackPark
Game Zone
Skynet
The Daily Bugle
Overpass 2 hacked
Relevant
Internal
Mr Robot
- Key 1
- Key 2
  - Nikto
  - Gobuster
  - License
- Key 3

Root-me app-script challenges

Introduction
- What?
- Why?
- How?
Bash: System 1
- Resources
sudo: weak configuration
- Resources
Bash: System 2
- Resources
LaTeX: Input
- Resources
Powershell: Command Injection
Bash: unquoted expression injection
Perl: Command injection
- Resources
Bash: cron
Python input()
Python pickle

Smithing

Ty Myrddin Home
Unseen University
Improbability Blog
About
Contact

Powershell: Command Injection

root-me challenge: Powershell - Command Injection: Recover the database’s password.

> ;cat .passwd

Previous Next

Unseen University, 2024, with a forest garden fostered by /ut7.