Best of Post Exploitation Exploits & Tricks

Buenas.

Comparto varios trucos de post-explotación:

How to Delete ALL Files in Remote Windows PC

Website Security Certificate Attack on Remote Windows PC

Best of Remote Windows PC Hacking Tricks (Part 1)

Hack ALL Security Features in Remote Windows 7 PC

How to Shutdown, Restart, Logoff, and Hibernate Remote Windows PC

Hack WIFI Setting of Remote Windows PC

How to Change ALL Files Extension in Remote PC (Confuse File Extensions Attack)

Gather Cookies and History of Mozilla Firefox in Remote Windows, Linux or MAC PC

Hack Save Password in Mozilla Firefox in Remote Windows, Linux or MAC PC

How to Find ALL Excel, Office, PDF, and Images in Remote PC

How to Gather MUICache Entries in Remote Windows PC

Gather WLAN Information and Geolocation of Remote Windows, Linux or MAC PC

Hack Remote Windows PC using Windows NT User Message Call Win32k Kernel Pool Overflow (Schlamperei)

Set New Password of Victim PC Remotely

How to Gather Skype Logs, Firefox History and Chrome history of Remote Victim PC

Bypass UAC Protection of Remote Windows PC in Memory Injection

Hack Internet Explorer in Remote PC set your desired Home page

How to Delete Passwords/Cookies/History/Temp Internet File of Internet Explorer in Remote Victim PC
Forensics Investigation of Remote PC (Part 2)
How to Lock Drive of Remote Windows Victim PC

Shrink the Partition of Remote Victim PC

Forensics Investigation of Remote PC (Part 1)

Remotely Scan Malware/Virus in Victim PC with Metasploit

How to Broadcast YouTube Video in Remote Windows System
Hack Remote PC with Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation
Get Admin Privilege of Remote Victim PC using Windows SYSTEM Escalation via KiTrap0D
Recover Deleted Data from Remote Victim PC
How to Encrypt Drive of Remote Victim PC

How to Gather Recent Files Dump of Remote PC

Windows Manage User Level Persistent Payload Installer

Hack netNTLM Credential using Microsoft Word UNC Path Injector

How to Lock/Unlock Folder in Remote Victim PC using Metasploit

How to get the Admin Access of Remote PC using Windows Kernel Intel x64 SYSRET Vulnerability Exploit

How to Hide File in Remote Victim PC
Hack Remote Windows Password using Keylogger in Meterpreter

How to Enable Remote Desktop in Victim PC using Metasploit

How to Hack Hosts File of Remote Windows 7 PC (Host File Injection)

How to Delete Local User Account of Remote PC using Metasploit

How to Get Password Hint of Remote Victim PC

Windows Gather Directory Permissions Enumeration

How to Gather Installed Application in Victim PC
How to Gather USB Drive History of Victim PC
How to Gather Wireless Current Connection Info of Remote PC
How to Disconnect Wireless Connection of Remote PC
How to Find All Connected Wireless Network in Remote PC
How to Gather Windows Product Key of Remote victim PC
How to Gather Microsoft Outlook Saved Password in Remote PC
How to Hack Save Password in FileZilla of Remote PC
How to Detect Install OS in Victim Virtual BOX

How to Bypass Windows Escalate UAC Protection

Hack UAC settings in windows 7 using Metasploit

How to Find OS of Remote PC (OS Footprinting)

How to Hide Drives of Remote PC using Metaspolit

How to Create hidden user in Remote PC
How to use Keylogger in Meterpreter

How to change password of Remote PC in LAN

Fuente: http://www.hackingarticles.in/best-of-post-exploitation-exploits-tricks/

Cómo eludir la autenticación de Microsoft SQL Server en un servidor ya comprometido (post-explotación)

Durante una post-explotación, pudiera darse el caso en el que te encuentres con un entorno donde lo administradores de una máquina, incluso administradores de dominio, no tienen derechos de autenticación en una base de datos Microsoft SQL Server.

Ante esto, podrías dedicarle tiempo a intentar determinar que grupos o cuentas tenían acceso y añadir un nuevo usuario o suplantar uno existente. O incluso buscar las credenciales en claro en algún script en algún recurso compartido.

Pero si realmente quieres ahorrar tiempo existe un método para SQL Server 2008 R2 y anteriores que te permitirá acceso total a la base de datos instantáneamente, mediante la cuenta NT-AUTHORITY\SYSTEM:

1. Descarga el binario psexec.exe en el servidor.
2. Inicia una consola con privilegios (botón derecho en el acceso directo y ejecutar como administrador).
3. Ejecuta psexec con la siguiente opción:

psexec -s -I “C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe”
 
(La -s significa arrancar como SYSTEM y -l iniciará la aplicación de forma interactiva)

 

 

http://www.hackplayers.com