Windows XML EventLog (EVTX)

Exploit Notes

Exploits related to Windows

Active Directory

AD CS (Active Directory Certificate Services) Pentesting

AS-REP Roasting

Active Directory Pentesting

BloodHound SharpHound for Active Directory

Kerberos Pentesting

LAPS (Local Administrator Password Solution) Pentesting

LDAP (Lightweight Directory Access Protocol) Pentesting

NTLM (New Technology LAN Manager) Pentesting

Netlogon Elavasion of Privilege

SMB (Server Message Block) Pentesting

Protocol

MSRPC (Microsoft Remote Procedure Call) Pentesting

RDP (Remote Desktop Protocol) Pentesting

WinRM (Windows Remote Management) Pentesting

Privilege Escalation

Iperius Backup Service Privilege Escalation

Mimikatz

UAC Windows Privilege Escalation

Windows PrivEsc with Registry Keys

Windows PrivEsc with SeBackupPrivilege

Windows PrivEsc with Unquoted Service Path

Windows Privilege Escalation

Post Exploitation

Windows Pivoting

PowerShell

PowerView

Others

Dumping Windows Password Hashes

LocalPotato

Microsoft Outlook Message (.msg)

Microsoft Word Pentesting

Windows API

Windows Basic Features

Windows Disk Management

Windows Forensics

Windows Pivoting

Windows Print Spooler Service

Windows Remote Code Execution from Linux

Windows XML EventLog (EVTX)

Last modified: 2023-03-10

Windows

EVTX is used for Microsoft Windows to store system log information.

Read EVTX in Linux

We can parse .evtx file in Linux using evtx_dump.

wget https://github.com/omerbenamram/evtx/releases/download/v0.8.1/evtx_dump-v0.8.1-x86_64-unknown-linux-gnu -O evtx_dump
chmod +x evtx_dump
./evtx_dump example.evtx > parsed.txt

Now we can find sensitive information from the parsed text.

grep -i TargetUserName parsed.txt
grep -i TargetDomainName parsed.txt

Tools by HDKS

Fuzzagotchi

Automatic web fuzzer.

aut0rec0n

Auto reconnaissance CLI.

Hash Cracker

Hash identifier.