Cardboard Iguana Security
/
tags
/
OS
/
Windows
Dark mode
Light mode
Search
Search
101 items with this tag.
Wednesday, December 18, 2024
Access the Windows Registry using PowerShell
HowTo
OS/Windows/Registry
Application/PowerShell
Wednesday, December 18, 2024
Add Windows users at the command line
OS/Windows
Application/net
OS/Windows/Registry
Application/reg
Wednesday, December 18, 2024
AS-REP roasting
Protocol/Kerberos
OS/Windows/ActiveDirectory
Cryptography/Hashes/NT
AttackCycle/Exploitation/AS-REPRoasting
AttackCycle/Exploitation/Kerberoasting
Wednesday, December 18, 2024
AS-REP roasting with Impacket
OS/Windows/ActiveDirectory
AttackCycle/Exploitation/AS-REPRoasting
Application/Impacket
Protocol/Kerberos
Wednesday, December 18, 2024
AS-REP roasting With Rubeus
OS/Windows/ActiveDirectory
AttackCycle/Exploitation/AS-REPRoasting
Application/Rubeus
Application/Hashcat
Wednesday, December 18, 2024
Backdoor Visual Basic Scripts
AttackCycle/Exploitation
HowTo
Language/VisualBasic
FileFormat/VBS
Protocol/SMB
OS/Windows
Wednesday, December 18, 2024
Bulk edit Windows permissions
OS/Windows/Permissions
Application/secedit
HowTo
Wednesday, December 18, 2024
Bypass the PowerShell execution policy
Application/PowerShell
OS/Windows
HowTo
AttackCycle/Exploitation
Wednesday, December 18, 2024
Bypass Windows antivirus with C#
HowTo
AttackCycle/AntiForensics
OS/Windows
Application/PowerShell
Application/PowerShell/Invoke-Mimikatz
Wednesday, December 18, 2024
Calculate a file hash on Windows with CertUtil
HowTo
OS/Windows
Application/CertUtil
Cryptography/Hashes/SHA1
Wednesday, December 18, 2024
Call Mimikatz from a meterpreter shell
Application/Metasploit/meterpreter
OS/Windows/ActiveDirectory
Protocol/Kerberos
AttackCycle/PrivEsc
AttackCycle/LateralMovement
AttackCycle/Exploitation
Wednesday, December 18, 2024
Common Windows user types
OS/Windows
Wednesday, December 18, 2024
Compact VM disk images
HowTo
Application/libVirt
Application/VirtualBox
OS/Windows
OS/Linux
Application/SDelete
Application/dd
Wednesday, December 18, 2024
DCERPC
Protocol/DCERPC
OS/Windows/Server
Wednesday, December 18, 2024
Default CIFS shares
Protocol/SMB
OS/Windows
AttackCycle/PrivEsc
AttackCycle/Exploitation
Wednesday, December 18, 2024
dir
Application/dir
OS/Windows
Wednesday, December 18, 2024
Disable AMSI
HowTo
OS/Windows/AMSI
AttackCycle/AntiForensics
Application/PowerShell
OS/Windows/Defender
Wednesday, December 18, 2024
DRSUAPI
OS/Windows/Server
OS/Windows/ActiveDirectory
Protocol/DRSUAPI
Wednesday, December 18, 2024
Enumerate AD CS templates with CertUtil
HowTo
Application/CertUtil
OS/Windows/ActiveDirectory
AttackCycle/Reconnaissance
Protocol/Kerberos
Application/Rubeus
Wednesday, December 18, 2024
Equivalent Windows and *NIX commands
OS/AIX
OS/Linux
OS/macOS
OS/Android
OS/Windows
Application/cat
Application/type
Application/dig
Application/nslookup
Application/grep
Application/findstr
Application/select
Application/ifconfig
Application/ipconfig
Application/ls
Application/dir
Application/more
Application/netstat
Application/ping
Application/shutdown
Application/sleep
Application/timeout
Application/sudo
Application/RunAs
Application/tcpdump
Application/windump
Application/traceroute
Application/tracert
Application/wget
Application/whoami
Application/hostname
Language/Bash
Application/cmd
Wednesday, December 18, 2024
Exploit local Windows services
OS/Windows/Services
AttackCycle/Exploitation
Application/Metasploit/msfvenom
OS/Windows/EventLog
HowTo
Wednesday, December 18, 2024
Exploit local Windows tasks
OS/Windows/Tasks
AttackCycle/Exploitation
Application/PsExec
OS/Windows/Registry
AttackCycle/AntiForensics
HowTo
Application/icacls
Wednesday, December 18, 2024
Exploit remote Windows services
OS/Windows/Services
AttackCycle/LateralMovement
OS/Windows/UAC
Protocol/RCP
Protocol/SMB
Protocol/NetBIOS
HowTo
Wednesday, December 18, 2024
Exploit remote Windows tasks
OS/Windows/Tasks
AttackCycle/LateralMovement
OS/Windows/UAC
Protocol/RCP
Protocol/SMB
Protocol/NetBIOS
HowTo
Wednesday, December 18, 2024
Exploit VBA scripts with msfvenom
HowTo
Application/Metasploit/msfvenom
Language/VisualBasic
Application/Metasploit/meterpreter
Application/Excel
Application/Word
OS/Windows/WSH
Wednesday, December 18, 2024
Exploit the Windows DLL search order
AttackCycle/Exploitation
HowTo
OS/Windows
Wednesday, December 18, 2024
Exploit the Windows “Feature on Demand” Helper
OS/Windows/Registry
AttackCycle/PrivEsc
HowTo
Wednesday, December 18, 2024
Exploit Windows file associations
HowTo
AttackCycle/Exploitation
OS/Windows/Registry
Application/PowerShell
Application/netcat
Wednesday, December 18, 2024
Exploit Windows services
OS/Windows/Services
AttackCycle/Exploitation
AttackCycle/LateralMovement
HowTo
Wednesday, December 18, 2024
Exploit Windows shortcut files
AttackCycle/Exploitation
HowTo
Application/PowerShell
Application/netcat
OS/Windows
Wednesday, December 18, 2024
Exploit Windows tasks
OS/Windows/Tasks
AttackCycle/Exploitation
AttackCycle/LateralMovement
HowTo
Wednesday, December 18, 2024
Exploit the WinLogon initialization sequence
OS/Windows/WinLogin
OS/Windows/Registry
AttackCycle/Exploitation
HowTo
Wednesday, December 18, 2024
findstr
Application/findstr
Application/grep
OS/Windows
Wednesday, December 18, 2024
Get-WinEvent
OS/Windows/EventLog
Application/PowerShell
AttackCycle/Reconnaissance
Wednesday, December 18, 2024
Git on Windows
OS/Windows
Application/Git
Application/SSH
Application/PowerShell
Wednesday, December 18, 2024
Golden and silver ticket attacks
Protocol/Kerberos
OS/Windows/ActiveDirectory
Cryptography/Hashes/NT
AttackCycle/PrivEsc/GoldenTickets
AttackCycle/LateralMovement/SilverTickets
Wednesday, December 18, 2024
HTML applications
FileFormat/HTML
FileFormat/HTA
OS/Windows
Wednesday, December 18, 2024
icacls
Application/icacls
Application/PowerShell
OS/Windows/Permissions
Wednesday, December 18, 2024
IIS configuration data
OS/Windows/IIS
AttackCycle/Reconnaissance
Wednesday, December 18, 2024
Impacket
Application/Impacket
Application/PsExec
Protocol/Kerberos
OS/Windows/ActiveDirectory
Wednesday, December 18, 2024
Invoke-Mimikatz
Application/PowerShell/Invoke-Mimikatz
AttackCycle/PrivEsc
AttackCycle/LateralMovement
Protocol/Kerberos
OS/Windows/ActiveDirectory
AttackCycle/Reconnaissance
AttackCycle/PrivEsc/PassTheHash
AttackCycle/LateralMovement/PassTheHash
Wednesday, December 18, 2024
ipconfig
OS/Windows
Application/ipconfig
Wednesday, December 18, 2024
Kerberoasting
Protocol/Kerberos
OS/Windows/ActiveDirectory
AttackCycle/Exploitation/Kerberoasting
Application/PowerShell/Invoke-Kerberoast
Application/Hashcat
Application/JohnTheRipper
Wednesday, December 18, 2024
Kerberoasting with Impacket
OS/Windows/ActiveDirectory
Protocol/Kerberos
AttackCycle/Exploitation/Kerberoasting
Application/Impacket
Application/Hashcat
OS/Linux/Distros/Kali
Wednesday, December 18, 2024
Kerberoasting with Rubeus
OS/Windows/ActiveDirectory
Protocol/Kerberos
AttackCycle/Exploitation/Kerberoasting
Application/Rubeus
Application/Hashcat
Wednesday, December 18, 2024
Kerberos
Protocol/Kerberos
OS/Windows/ActiveDirectory
Application/Mimikatz
Application/Rubeus
FileFormat/kirbi
Cryptography/Hashes/NT
AttackCycle/PrivEsc
AttackCycle/LateralMovement
AttackCycle/Exploitation/Kerberoasting
Application/PowerShell/Invoke-Kerberoast
Application/Hashcat
Application/JohnTheRipper
OS/Linux/Distros/Kali
AttackCycle/Exploitation/AS-REPRoasting
AttackCycle/PrivEsc/GoldenTickets
AttackCycle/LateralMovement/SilverTickets
Wednesday, December 18, 2024
Kerbrute
Protocol/Kerberos
Protocol/UDP
OS/Windows/ActiveDirectory
Application/Kerbrute
AttackCycle/Reconnaissance/BruteForcing
Wednesday, December 18, 2024
meterpreter
Application/Metasploit/meterpreter
AttackCycle/Exploitation
AttackCycle/Reconnaissance
AttackCycle/AntiForensics
Cryptography/Hashes/NT
OS/Windows/SAM
AttackCycle/PrivEsc/GoldenTickets
Application/Mimikatz
OS/Windows/EventLog
Application/PowerShell
AttackCycle/PrivEsc
OS/Windows/LSASS
Wednesday, December 18, 2024
Mimikatz
Application/Mimikatz
AttackCycle/Reconnaissance
AttackCycle/LateralMovement
AttackCycle/PrivEsc
OS/Windows/ActiveDirectory
Protocol/Kerberos
Cryptography/Hashes/NT
Application/PsExec
Application/Evil-WinRM
Application/XFreeRDP
OS/Windows/LSASS
OS/Windows/SAM
AttackCycle/LateralMovement/SilverTickets
AttackCycle/PrivEsc/GoldenTickets
AttackCycle/PrivEsc/PassTheHash
AttackCycle/LateralMovement/PassTheHash
Wednesday, December 18, 2024
msfconsole
Application/Metasploit/msfconsole
AttackCycle/CommandAndControl
AttackCycle/AntiForensics
AttackCycle/Exploitation
Application/SSH
Application/Nmap
Protocol/TCP
Protocol/UDP
Protocol/HTTP
Protocol/SMB
Protocol/SMTP
Application/MySQL
AttackCycle/Exploitation/BruteForcing
Cryptography/Hashes/NT
Application/Metasploit/msfvenom
Application/Metasploit/meterpreter
Application/PsExec
OS/Windows
Application/JohnTheRipper
Protocol/RDP
AttackCycle/LateralMovement
Application/proxychains
Protocol/SOCKS
Wednesday, December 18, 2024
msfvenom
Application/Metasploit/msfvenom
AttackCycle/Exploitation
Application/netcat
OS/Linux
OS/Windows
OS/macOS
FileFormat/HTA
Application/Metasploit/meterpreter
Language/VisualBasic
Language/Bash
Language/Python
Language/Perl
Language/PHP
Language/Java
Wednesday, December 18, 2024
MS SQL
Application/MSSQL
OS/Windows
Application/PowerShell/Powercat
Application/netcat
AttackCycle/PrivEsc
Wednesday, December 18, 2024
net
OS/Windows
Application/net
AttackCycle/Reconnaissance
LoLBins
AttackCycle/PrivEsc
Wednesday, December 18, 2024
netsh
Application/netsh
OS/Windows/Firewall
Wednesday, December 18, 2024
netstat
Application/netstat
OS/Linux
OS/Windows
Application/findstr
AttackCycle/Reconnaissance
Wednesday, December 18, 2024
Nmap
Application/Nmap
Protocol/TCP
OS/Windows/Firewall
Protocol/ICMP
AttackCycle/Reconnaissance
Protocol/UDP
Protocol/HTTP
Protocol/SOCKS
Hardware/MACAddress
Protocol/ARP
Protocol/SMB
Protocol/NFS
AttackCycle/PrivEsc
Wednesday, December 18, 2024
nslookup
Application/nslookup
OS/Windows
OS/Linux
Application/dig
Wednesday, December 18, 2024
NTLM hashes
Cryptography/Hashes/NT
OS/Windows/SAM
Cryptography/Hashes/MD4
OS/Windows
Wednesday, December 18, 2024
ping
Application/ping
OS/Windows
OS/Linux
Wednesday, December 18, 2024
Pop a SYSTEM shell on the Windows login screen using sticky keys
Application/icacls
OS/Windows
Application/takeown
AttackCycle/Exploitation
HowTo
Wednesday, December 18, 2024
Pop a SYSTEM shell on the Windows login screen using Utilman
Application/icacls
Application/takeown
AttackCycle/Exploitation
OS/Windows
HowTo
Wednesday, December 18, 2024
Powercat
Application/PowerShell/Powercat
AttackCycle/LateralMovement
Application/netcat
OS/Linux/Distros/Kali
OS/Windows/AMSI
Wednesday, December 18, 2024
PowerView
Application/PowerShell/PowerView
AttackCycle/Reconnaissance
OS/Windows/AMSI
Wednesday, December 18, 2024
reg
OS/Windows/Registry
Application/reg
Wednesday, December 18, 2024
Remotely install a Windows package with PowerShell
HowTo
OS/Windows
Application/PowerShell
AttackCycle/LateralMovement
AttackCycle/Exploitation
Wednesday, December 18, 2024
Rubeus
Application/Rubeus
Protocol/Kerberos
OS/Windows/ActiveDirectory
AttackCycle/Reconnaissance
AttackCycle/Exploitation/BruteForcing
OS/Linux/Distros/Kali
AttackCycle/PrivEsc
Application/Certify
AttackCycle/LateralMovement
Wednesday, December 18, 2024
RunAs
Application/RunAs
OS/Windows
Application/sudo
Application/cmdkey
Application/whoami
Wednesday, December 18, 2024
Run a remote Windows command using PowerShell
Application/PowerShell
OS/Windows
AttackCycle/LateralMovement
HowTo
Wednesday, December 18, 2024
Set the PATH in a session on Windows
Application/PowerShell
OS/Windows
HowTo
Wednesday, December 18, 2024
Set up WMI in PowerShell
OS/Windows/WMI
Application/PowerShell
HowTo
AttackCycle/LateralMovement
Wednesday, December 18, 2024
SSH
Application/SSH
AttackCycle/LateralMovement
Protocol/SOCKS
OS/Windows
Protocol/Kerberos
Wednesday, December 18, 2024
systeminfo
Application/systeminfo
OS/Windows
Application/findstr
OS/Windows/ActiveDirectory
AttackCycle/Reconnaissance
Wednesday, December 18, 2024
Unquoted path handling in Windows
OS/Windows
AttackCycle/Exploitation
Wednesday, December 18, 2024
Useful built-in commands for Windows reconnaissance
OS/Windows
AttackCycle/Reconnaissance
Application/arp
Application/cmdkey
Application/driverquery
Application/hostname
Application/net
Application/query
Application/reg
OS/Windows/Services
OS/Windows/Tasks
Application/systeminfo
Application/whoami
Wednesday, December 18, 2024
Useful scripts for Windows reconnaissance
AttackCycle/Reconnaissance
OS/Windows
Application/WinPEAS
Application/Metasploit
Application/WindowsExploitSuggester
OS/Windows/Defender
Application/PowerShell/PowerUp
Application/Metasploit/meterpreter
Application/systeminfo
Wednesday, December 18, 2024
Use the Windows Firewall to relay ports
OS/Windows/Firewall
AttackCycle/LateralMovement
HowTo
Application/netsh
Wednesday, December 18, 2024
Use WinRM with PowerShell
HowTo
Protocol/WinRM
Application/PowerShell
OS/Windows
Wednesday, December 18, 2024
Visual Basic for Applications
Language/VisualBasic
OS/Windows/WSH
AttackCycle/Exploitation
Wednesday, December 18, 2024
whoami
Application/whoami
OS/Linux
OS/macOS
OS/AIX
OS/Windows
Wednesday, December 18, 2024
Windows DLL search order
OS/Windows
Application/ProcMon
Wednesday, December 18, 2024
Windows event IDs
OS/Windows/EventLog
Wednesday, December 18, 2024
Windows event logs
OS/Windows/EventLog
Wednesday, December 18, 2024
Windows local service accounts
OS/Windows/Services
Wednesday, December 18, 2024
Windows logon scripts
OS/Windows/UserInit
OS/Windows/Registry
AttackCycle/Exploitation
AttackCycle/PrivEsc
Wednesday, December 18, 2024
Windows permissions
OS/Windows/Permissions
OS/Linux/Permissions
Wednesday, December 18, 2024
Windows reconnaissance with PowerShell
OS/Windows/ActiveDirectory
OS/Windows/Firewall
Application/PowerShell
OS/Windows
AttackCycle/Reconnaissance
OS/Windows/EventLog
OS/Windows/Services
Wednesday, December 18, 2024
Windows Remote Management
Application/PowerShell
OS/Windows/Registry
OS/Windows/UAC
AttackCycle/LateralMovement
Protocol/WinRM
Wednesday, December 18, 2024
Windows Run and RunOnce Registry keys
OS/Windows/Registry
Wednesday, December 18, 2024
Windows Scripting Host
OS/Windows/WSH
Language/VisualBasic
AttackCycle/Exploitation
Wednesday, December 18, 2024
Windows SeBackup and SeRestore permissions
OS/Windows/SAM
OS/Windows/Permissions/SeBackup
OS/Windows/Permissions/SeRestore
Application/reg
Application/Impacket
Wednesday, December 18, 2024
Windows SeImpersonate and SeAssignPrimaryToken permissions
OS/Windows/Permissions/SeImpersonate
OS/Windows/Permissions/SeAssignPrimaryToken
Protocol/WinRM
Application/RogueWinRM
Application/PowerShell
AttackCycle/LateralMovement
AttackCycle/PrivEsc
Wednesday, December 18, 2024
Windows service ACLs
OS/Windows/Permissions
OS/Windows/Services
Protocol/WinRM
Application/PowerShell
Wednesday, December 18, 2024
Windows services
OS/Windows/Services
OS/Windows/Registry
OS/Windows/Drivers
Wednesday, December 18, 2024
Windows SeTakeOwnership permission
Application/icacls
OS/Windows/Permissions/SeTakeOwnership
Application/takeown
OS/Windows
Wednesday, December 18, 2024
Windows Startup folder
OS/Windows
Wednesday, December 18, 2024
Windows unattended installation data
OS/Windows
AttackCycle/Reconnaissance
Wednesday, December 18, 2024
winrs
OS/Windows
Application/winrs
Protocol/WinRM
Application/PowerShell
Wednesday, December 18, 2024
wmic
OS/Windows
Application/wmic
Application/WindowsExploitSuggester
AttackCycle/Reconnaissance
AttackCycle/Exploitation
AttackCycle/LateralMovement
Application/PowerShell
Wednesday, December 18, 2024
Working with services in PowerShell
Application/PowerShell
OS/Windows/Services
Wednesday, December 18, 2024
Work with remote services using WMI and PowerShell
OS/Windows/WMI
Application/PowerShell
OS/Windows/Services
HowTo
Wednesday, December 18, 2024
Work with remote tasks using WMI and PowerShell
HowTo
Application/PowerShell
OS/Windows/Tasks
AttackCycle/Exploitation
AttackCycle/PrivEsc
OS/Windows/WMI