Info-sheet

• DNS-Domain name:

• Host name:

• OS:

• Server:

• Kernel:

• Workgroup:

• Windows domain:

Services and ports: INSERTTCPSCAN

Recon

Port 21 - FTP

• FTP-Name:

• FTP-version:

• Anonymous login:

INSERTFTPTEST

Port 22 - SSH

• Name:

• Version:

• Takes-password:

• If you have usernames test login with username:username

INSERTSSHCONNECT

Port 25

• Name:

• Version:

• VRFY:

INSERTSMTPCONNECT

Port 69 - UDP - TFTP

This is used for tftp-server.

Port 110 - Pop3

• Name:

• Version:

INSERTPOP3CONNECT

Port 111 - Rpcbind

Port 135 - MSRPC

Some versions are vulnerable.

Port 143 - Imap

Port 139/445 - SMB

• Name:

• Version:

• Domain/workgroup name:

• Domain-sid:

• Allows unauthenticated login:

Port 161/162 UDP - SNMP

Port 554 - RTSP

Port 1030/1032/1033/1038

Used by RPC to connect in domain network.

Port 1521 - Oracle

• Name:

• Version:

• Password protected:

Port 2049 - NFS

Port 2100 - Oracle XML DB

• Name:

• Version:

• Default logins:

3306 - MySQL

• Name:

• Version:

Port 3339 - Oracle web interface

• Basic info about web service (apache, nginx, IIS)

• Server:

• Scripting language:

• Apache Modules:

• IP-address:

Port 80 - Web server

• Server:

• Scripting language:

• Apache Modules:

• IP-address:

• Domain-name address:

INSERTCURLHEADER

• Web application (ex, wordpress, joomla, phpmyadmin)

• Name:

• Version:

• Admin-login:

Nikto scan

INSERTNIKTOSCAN

Url brute force

INSERTDIRBSCAN

Default/Weak login

Search documentation for default passwords and test them

LFI/RFI

SQL-Injection

Sql-login-bypass

• Open Burp-suite

• Make and intercept a request

• Send to intruder

• Cluster attack.

• Attack

• Check for response length variation

Password brute force - last resort

Port 443 - HTTPS

Heartbleed:

Vulnerability analysis

Now we have gathered information about the system. Now comes the part where we look for exploits and vulnerabilites and features.

To try - List of possibilies

Add possible exploits here:

Find sploits - Searchsploit and google

Where there are many exploits for a software, use google. It will automatically sort it by popularity.

'''''''''''''''''''''''''''''''''' PRIVESC '''''''''''''''''''''''''''''''''

Privilege escalation

Now we start the whole enumeration-process over gain.

• Kernel exploits

• Programs running as root

• Installed software

• Weak/reused/plaintext passwords

• Inside service

• Suid misconfiguration

• World writable scripts invoked by root

• Unmounted filesystems

Less likely

• Private ssh keys

• Bad path configuration

• Cronjobs

To-try list

Here you will add all possible leads. What to try.

Useful commands

Basic info

• OS:

• Version:

• Kernel version:

• Architecture:

• Current user:

Devtools:

• GCC:

• NC:

• WGET:

Users with login:

Kernel exploits

Programs running as root

Look for webserver, mysql or anything else like that.

Installed software

Weak/reused/plaintext passwords

• Check database config-file

• Check databases

• Check weak passwords

• Check plaintext

Inside service

Suid misconfiguration

Binary with suid permission can be run by anyone, but when they are run they are run as root!

Example programs:

Unmounted filesystems

Here we are looking for any unmounted filesystems. If we find one we mount it and start the priv-esc process over again.

Cronjob

Look for anything that is owned by privileged user but writable for you

SSH Keys

Check all home directories

Bad path configuration

Require user interaction

----------------------------- LOOT LOOT LOOT LOOT ----------------------

Loot

Checklist

• Proof:

• Network secret:

• Passwords and hashes:

• Dualhomed:

• Tcpdump:

• Interesting files:

• Databases:

• SSH-keys:

• Browser:

• Mail:

Proof

Network secret

Passwords and hashes

Dualhomed

Tcpdump

Interesting files

Databases

SSH-Keys

Browser

Mail

GUI

If there is a gui we want to check out the browser.