Info-sheet

Recon

Port 21 - FTP

• Name:

• Version:

• Anonymous login:

Port 22 - SSH

• Name:

• Version:

• Protocol:

• RSA-key-fingerprint:

• Takes-password:

  If you have usernames test login with username:username

Port 25

• Name:

• Version:

• VRFY:

• EXPN:

Port 110 - Pop3

• Name:

• Version:

Port 135 - MSRPC

Some versions are vulnerable.

Exploit:

Port 139/445 - SMB

• Name:

• Version:

• Domain/workgroup name:

• Domain-sid:

• Allows unauthenticated login:

Port 161/162 UDP - SNMP

Port 554 - RTSP

Port 1030/1032/1033/1038

Used by RPC to connect in domain network. Usually nothing.

Port 1433 - MSSQL

• Version:

If you have credentials look in metasploit for other modules.

Port 1521 - Oracle

Name: Version: Password protected:

Port 2100 - Oracle XML DB

• Name:

• Version:

Default logins:

Port 2049 - NFS

3306 - MySQL

• Name:

• Version:

Port 3339 - Oracle web interface

• Basic info about web service (apache, nginx, IIS)

• Server:

• Scripting language:

• Apache Modules:

• IP-address:

• Domain-name address:

Port 3389 - Remote desktop

Test logging in to see what OS is running

Port 80

• Server:

• Scripting language:

• Apache Modules:

• Domain-name address:

INSERTCURLHEADER

• Web application

• Name:

• Version:

Nikto scan

INSERTNIKTOSCAN

Url brute force

INSERTDIRBSCAN

Default/Weak login

Google documentation for default passwords and test them:

LFI/RFI

SQL-Injection

Sql-login-bypass

• Open Burp-suite

• Make and intercept request

• Send to intruder

• Cluster attack

• Attack

• Check for response length variation

Password brute force - last resort

Port 443 - HTTPS

Heartbleed:

Vulnerability analysis

Now we have gathered information about the system. Now comes the part where we look for exploits and vulnerabilities and features.

To try - List of possibilities

Add possible exploits here:

Find sploits - Searchsploit and google

Where there are many exploits for a software, use google. It will automatically sort it by popularity.

'''''''''''''''''''''''''''''''''' PRIVESC '''''''''''''''''''''''''''''''''

Privilege escalation

Now we start the whole enumeration-process over gain. This is a checklist. You need to check of every single one, in this order.

• Kernel exploits

• Cleartext password

• Reconfigure service parameters

• Inside service

• Program running as root

• Installed software

• Scheduled tasks

• Weak passwords

To-try list

Here you will add all possible leads. What to try.

Basic info

• OS:

• Version:

• Architecture:

• Current user:

• Hotfixes:

• Antivirus:

Users:

Localgroups:

Kernel exploits

Cleartext passwords

Reconfigure service parameters

• Unquoted service paths

Check book for instructions

• Weak service permissions

Check book for instructions

Inside service

Check netstat to see what ports are open from outside and from inside. Look for ports only available on the inside.

Programs running as root/system

Installed software

Scheduled tasks

Weak passwords

Remote desktop

Useful commands

Add user and enable RDP

----------------------------- LOOT LOOT LOOT LOOT -------------------

Loot

• Proof:

• Network secret:

• Password and hashes:

• Dualhomed:

• Tcpdump:

• Interesting files:

• Databases:

• SSH-keys:

• Browser:

Proof

Network secret

Passwords and hashes

Dualhomed

Tcpdump

Interesting files

Mail

Browser

• Browser start-page:

• Browser-history:

• Saved passwords:

Databases

SSH-keys

How to replicate: