Exploits related to Windows

Active Directory

AD CS (Active Directory Certificate Services) Pentesting

AS-REP Roasting

Active Directory Pentesting

BloodHound SharpHound for Active Directory

Kerberos Pentesting

LAPS (Local Administrator Password Solution) Pentesting

LDAP (Lightweight Directory Access Protocol) Pentesting

NTLM (New Technology LAN Manager) Pentesting

Netlogon Elavasion of Privilege

SMB (Server Message Block) Pentesting

Protocol

MSRPC (Microsoft Remote Procedure Call) Pentesting

RDP (Remote Desktop Protocol) Pentesting

WinRM (Windows Remote Management) Pentesting

Privilege Escalation

Iperius Backup Service Privilege Escalation

ManageEngine ADSelfService Plus PrivEsc

Mimikatz

Outlook Reminder Privilege Escalation

UAC Windows Privilege Escalation

Windows PrivEsc with Potatoes

Windows PrivEsc with Registry Keys

Windows PrivEsc with SeBackupPrivilege

Windows PrivEsc with Unquoted Service Path

Windows Privilege Escalation

Post Exploitation

Windows Pivoting

PowerShell

PowerView

Others

Dumping Windows Password Hashes

LocalPotato

M365 (Microsoft Office 365) Pentesting

Microsoft Outlook Message (.msg)

Microsoft Word Pentesting

Reading OneDrive Logs

WSL Pentesting

Windows API

Windows Disk Management

Windows Forensics

Windows Memory Dump Analysis

Windows Pivoting

Windows Print Spooler Service

Windows Remote Code Execution from Linux

Windows XML EventLog (EVTX)

Windows Pivoting

Last modified: 2023-02-04

Network

Accessing obtained over one machine to exploit another machine deeper in the network.

Enumerate Network

After entering the target server, enumerate and search other networks.

Check the ARP Cache in Target Machine

arp.exe -a

Check IP Addresses

Get-Content c:\Windows\System32\drivers\etc\hosts
ipconfig /all

Search Other Network Ranges

No content yet.

Tools by Muhammd

RedTeam Repos

Automatic PenTest Scripts

AutoRecon

Auto reconnaissance CLI.

PenTest Tools