Windows

IMPORTANT NOTE

NOTE: REMEBER TO CHANGE THE PORT NUMBER IN /ETC/PROXYCHAINS TO KALI PORT YOU HAVE SET UP. (SAFEST IS TO KEEP ALL THE PORT THE SAME TO AVOID CONFUSION)

SSH.exe

SSH Local Tunneling

On CONFLUENCE01

On KALI

Any commands running on Kali to be pointed at CONFLUENCE01 IP Address

SSH Dynamic Tunneling

On CONFLUENCE01

On Kali

Any commands running on Kali to be pointed at HRSHARES01 IP Address via Proxychains

SSH Remote Port Forwarding

On CONFLUENCE01

On Kali

Any commands running on Kali to be pointed at Loopback address

NOTE: Make sure machine is running OpenSSH

SSH Remote Dynamic Port Forwarding

On CONFLUENCE01

On Kali

Any commands running on Kali can be pointed at any IP via Proxychains

NOTE: Make sure can RCE to machine

On Machine

  1. Get Netcat from Kali

  1. Set up listener on Kali

  2. Send reverse shell to Kali via RCE

  1. Get plink.exe

  1. Execute port forwarding

The port forwarding above allow us to RDP into the machine

On Kali

Any commands running on Kali to be pointed Loopback

Netsh

NOTE: Make sure to RDP into a user that has Administrative rights

1

Create Netsh port forwarding

2

Create firewall rule

3

The above command allow us to SSH into PGDATABASE01 using PGDATABASE01 Username and MULTISERVER03 IP Address

Clean tracks after done

Chisel

On Kali

To start server

To monitor network streams

Any commands running on Kali to be pointed at PGDATABASE01 IP Address via Proxychains

On CONFLUENCE01

To install chisel on target machine

To port forward

To view the error output

Ligolo-Ng

NOTE: When using nmap, add --unprivileged OR -PE to avoid false positives

Setup

On Kali

1
2
3
4
5
6

On Target Machine

Tunnel

On Kali

NOTE: Run the above command in /ligolo/proxy

On Target Machine

NOTE: Once agent connects to server, return to Kali Machine and follow the steps in ligolo-ng console

NOTE: Add the following if you want the internal to reach you. E.G. reverse shell

Verify

Last updated