Tools to Add / Learn
Backlog index — items not yet fully documented in the vault. When you add one, move it to Done with a wikilink.
Ctrl+F:
backlog·todo·ligolo·socat·Rubeus·nginx
cd /tmp
wget https://github.com/Wandmalfarbe/pandoc-latex-template/releases/download/v3.5.1/Eisvogel.tar.gz
tar xzf Eisvogel.tar.gz
# Remove broken files from the failed wget
rm -f ~/.local/share/pandoc/templates/eisvogel.latex
# Install the real standalone template
sudo mkdir -p /usr/share/pandoc/data/templates
sudo cp Eisvogel-*/eisvogel.latex /usr/share/pandoc/data/templates/
mkdir -p ~/.local/share/pandoc/templates
cp Eisvogel-*/eisvogel.latex ~/.local/share/pandoc/templates/
# Should be ~50KB+, NOT 0
ls -lh /usr/share/pandoc/data/templates/eisvogel.latex
📌 Open Backlog
| Item | Notes | Target |
|---|---|---|
| Rubeus.exe | Download this to kali tool folder before example | Rubeus > 📌 Running Rubeus |
| solarputtycreaker | Research if OSCP-relevant | — |
| badodt + Responder | Malicious ODT → NTLM capture | Responder |
| Manual enum checklist | sudo -l, strings, etc. every box | Every Box - Manual Workflow |
| Nginx sites-enabled | Subdomain vhost enum on compromised web server | See snippet below |
| .NET reverse | DNSpy, ILSpy; run binary + Wireshark auth capture | Shells |
| PowerShell vs Python shells | When to use each | Shells |
| YouTube | mac3HaJN2EI | TBD |
📌 Snippets to Place
Nginx vhost enum (www-data shell)
When the app runs on Nginx, check sites-enabled for vhosts/subdomains missed in initial recon:
ls -la /etc/nginx/sites-enabled/
cat /etc/nginx/sites-enabled/*
grep -r server_name /etc/nginx/📌 Done / Moved Elsewhere
- Attack path + credential graphs → Attack Path Graph · Credential Graph · Credential Discovery
- RunasCs.exe → RunasCs
- winExploitSuggester.py → winExploitSuggester
- rpcdump.py (dynamic port) → rpcdump · RPC
- Registry hives / Linux passwd vs SAM → Registry Hives and Linux Equivalents
- BeanShooter (JMX) → BeanShooter · UseCases for ports > Port 1099 — Java RMI / JMX
- Manual hash generation → Manual Hash Generation
- linux-exploit-suggester → linux-exploit-suggester
- Every box manual workflow → Every Box - Manual Workflow
- nxc user-desc / gmsa / keepass / —ntds / —generate-hosts-file → CrackMapExec - nxc > 📌 8b) User export & user descriptions
- JuicyPotato nc reverse shell → Potato Attacks > 📌 6) JuicyPotato / JuicyPotatoNG
- ldapsearch userlist pipeline → ldapsearch > 📌 Extract Usernames to File
- mysqldump / mysql.exe / mysqldump.exe → MySQL > 📌 10) mysqldump — backup / exfiltrate databases
- nbtscan → nbtscan · UseCases for ports > Port 137-139 — NetBIOS
- pypykatz → pypykatz · LSASS > 📌 4) Parse dump offline (Kali)
- Ligolo-ng commands → Ligolo-ng > 📌 9) Proxy Shell Commands (Official Reference) (verified v0.8.x)
- socat → Socat
- sshuttle → sshuttle
- Netsh / portproxy → Netsh
- Plink → Plink
- SSH keys / authorized_keys → SSH > Method 2 — Private Key Authentication (`id_rsa`) · SSH > Method 4 — `authorized_keys` (add your key for access / persistence)
- winExploitSuggester (verified complete) → winExploitSuggester
- linux-exploit-suggester (verified complete) → linux-exploit-suggester
- AES256 / getTGT -aesKey → Kerberos Scripts > 📌 3) getTGT.py — Request Ticket-Granting Ticket · use ticket → Use Kerberos Ticket
- SeBackupPrivilege → SeBackupPrivilege ·
nxc -M backup_operator· diskshadow · robocopy · wbadmin · DLLs - SeRestorePrivilege → SeRestorePrivilege · wbadmin recovery · write abuse
- diskshadow / robocopy → diskshadow · robocopy