16 - Useful Tools
Topics
Introduction to the Windows Shells
Windows Permissions
Reverse Shells in Windows
SeImpersonatePrivilege Exploitation
On Cross Compilation
Windows Services
Weak Service Permissions
Unquoted Service Path
DLL Hijacking
Always Install Elevated
Files with Sensitive Data
Windows Hashes
Stored Credentials and the Windows Vault
Scheduled Task
Critical Registry Paths
Useful Tools
AMSI Bypass
Why Do We Use Tools?
In the field of cybersecurity, tools play a crucial role in automating repetitive, complex, or otherwise resource-intensive tasks. They help professionals save time and effort, which are often limited during assessments or incidents. A good tool should:
Clearly define its purpose and scope.
Be simple to use relative to its functionality.
Integrate seamlessly into automation workflows.
Provide concise and clear output.
Remain minimalistic, avoiding unnecessary features.
Be well-documented and, if possible, modifiable for specific needs.
Why Mindset Matters
While tools are powerful, understanding the underlying concepts they automate remains essential. This knowledge ensures that you can:
Customize tools to your needs.
Develop solutions in environments where tools are unavailable.
Mitigate tool-related detection by defenders during offensive operations.
The best tool is always a well-trained mind.
Useful Tools (Windows)
Certutil
Built-in Windows utility often used for certificate management. It can also download files:
Invoke-WebRequest (iwr)
PowerShell cmdlet to download files:
Netcat (nc)
A versatile networking tool for creating reverse shells, listening ports, and file transfers. Example for reverse shell:
Invoke-PowerShellTcp
A PowerShell reverse shell script:
Msfvenom
Tool for generating payloads. Example for a reverse shell:
MinGW32
A cross-compiler for building Windows binaries from Linux. Example of building a basic program:
Compile using:
PrintSpoofer
Exploit for abusing the SeImpersonatePrivilege:
GodPotato
Similar to PrintSpoofer, used for exploiting SeImpersonatePrivilege:
WinPEAS
Windows Privilege Escalation Awesome Script:
PowerUp
PowerShell script for auditing privilege escalation:
PrivescCheck
Identifies misconfigurations leading to privilege escalation:
BeRoot
Post-exploitation script for privilege escalation checks:
Mimikatz
Advanced credential-dumping tool:
Impacket
Python library for working with Windows protocols:
Responder
Poisoning tool for capturing hashes:
Chisel
TCP/UDP tunneling tool for pivoting:
Hashcat and John the Ripper
Tools for cracking passwords and hashes:
CrackMapExec
Network exploitation and post-exploitation framework:
Disclaimer
❗ Never use tools and techniques on real IP addresses, hosts or networks without proper authorization!❗
Last updated