Last updated
Last updated
DNS-Domain name:
Host name:
OS:
Server:
Kernel:
Workgroup:
Windows domain:
Services and ports: INSERTTCPSCAN
FTP-Name:
FTP-version:
Anonymous login:
INSERTFTPTEST
Name:
Version:
Takes-password:
If you have usernames test login with username:username
INSERTSSHCONNECT
Name:
Version:
VRFY:
INSERTSMTPCONNECT
This is used for tftp-server.
Name:
Version:
INSERTPOP3CONNECT
Some versions are vulnerable.
Name:
Version:
Domain/workgroup name:
Domain-sid:
Allows unauthenticated login:
Used by RPC to connect in domain network.
Name:
Version:
Password protected:
Name:
Version:
Default logins:
Name:
Version:
Basic info about web service (apache, nginx, IIS)
Server:
Scripting language:
Apache Modules:
IP-address:
Server:
Scripting language:
Apache Modules:
IP-address:
Domain-name address:
INSERTCURLHEADER
Web application (ex, wordpress, joomla, phpmyadmin)
Name:
Version:
Admin-login:
Nikto scan
INSERTNIKTOSCAN
Url brute force
INSERTDIRBSCAN
Default/Weak login
Search documentation for default passwords and test them
LFI/RFI
SQL-Injection
Sql-login-bypass
Open Burp-suite
Make and intercept a request
Send to intruder
Cluster attack.
Attack
Check for response length variation
Heartbleed:
Now we have gathered information about the system. Now comes the part where we look for exploits and vulnerabilites and features.
Add possible exploits here:
Where there are many exploits for a software, use google. It will automatically sort it by popularity.
'''''''''''''''''''''''''''''''''' PRIVESC '''''''''''''''''''''''''''''''''
Now we start the whole enumeration-process over gain.
Kernel exploits
Programs running as root
Installed software
Weak/reused/plaintext passwords
Inside service
Suid misconfiguration
World writable scripts invoked by root
Unmounted filesystems
Less likely
Private ssh keys
Bad path configuration
Cronjobs
Here you will add all possible leads. What to try.
OS:
Version:
Kernel version:
Architecture:
Current user:
Devtools:
GCC:
NC:
WGET:
Users with login:
Look for webserver, mysql or anything else like that.
Check database config-file
Check databases
Check weak passwords
Check plaintext
Binary with suid permission can be run by anyone, but when they are run they are run as root!
Example programs:
Here we are looking for any unmounted filesystems. If we find one we mount it and start the priv-esc process over again.
Look for anything that is owned by privileged user but writable for you
Check all home directories
Require user interaction
----------------------------- LOOT LOOT LOOT LOOT ----------------------
Checklist
Proof:
Network secret:
Passwords and hashes:
Dualhomed:
Tcpdump:
Interesting files:
Databases:
SSH-keys:
Browser:
Mail:
If there is a gui we want to check out the browser.
Default passwords
Paste in sqlibypass-list ()