RDP yoqish / persistence

> reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v
fDenyTSConnections /t REG_DWORD /d 0 /f; Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

// O'chirish
> reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v
fDenyTSConnections /t REG_DWORD /d 1 /f; Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

+

Persistence uchun Autorun, Startup dan foydalanish mumkin

// Powerview // SMB share fayllarni hammasini olish
> Invoke-FileFinder

// local admins
> Invoke-EnumerateLocalAdmin

// Access control list enum
> Get-Objectacl

// Powershell (rdp)
Enter-PSSession -ComputerName User2 -Credential just/username

// powershell bilan remote code exec
> Invoke-Command -ScriptBlock {whoami;just} -ComputerName User2 -Credential just/username

// eCPTxv2 study / enum

// tashkilot tizimlarini ntbscan orqali topish
# ntbscan -r range

// Rangedagi hostnamelarni topish:
# nmap -sL range

// domain, version topish:
# use auxiliary/scanner/smb/smb_version

// SNMP scanner
# use auxiliary/scanner/snmp/snmp_login

// Domain controllerni topish
# dig -t NS domain_name
# dig _gc. domain_name

// rcpclinet orqali enum qilish mumkin
# rpcclient -U sfsd -p sfs Adress

// tizim haqida ma'lumot olish
# rpcclient srvinfo

// domain users
# rpccleint enumdomusers

// domain (bult in)groups
# rpcclient enumalsgroups domain
# rpcclient enumalsgroups bultin

// SID topish
rpccleint > lookupnames name

//RIDs orqali malumot olish:
queryuser 500 // admin

// SMB share
# smbclient -U 'domain#user%pass' -L hostname

// DC topish
> nltest /server: birorta azo IPsi /dclist: domain

// Domain list
> net view /domain:domainname

// Powerview / has a session , etc