akde/infosec

Information security is ultimately about managing risk

  • Impacket

    See the Impack­et site for a short descrip­tion of all tools. Tip: On Kali, use the com­mand impacket-* Enumeration without authentication Deter­mine the sys­tem architecture getArch.py -target $target Returns the lis­ten­ing RPC inter­face IDs. ifmap.py $target 135rpcdump.py $target Enumeration with half authentication Sce­nario: You have cre­den­tials for one AD user. Then, try to get all users for…

  • JServ Apache Tomcat

    Overview Tom­cat usu­al­ly lis­tens on the fol­low­ing ports: 8080 — HTTP 8005 — Port for shut­ting down the Tom­cat serv­er; not inter­est­ing here 8009 — Same func­tions as the HTTP port, but via the Apache JServ pro­to­col AJP.  AJP is basi­cal­ly HTTP in a compressed/binary form. Checklist Check if /manager is accessible.  Default cre­den­tials are tom­cat / s3cret or…

  • Oracle SQL

    In Ora­cle SQL, a SID (Ser­vice Iden­ti­fi­er) is basi­cal­ly a database. Enumeration Get gen­er­al information tnscmd10g -h $target Try to get a SID: tnscmd10g status-p 1521 -h $target Anoth­er tool: Ora­cle Scanner oscanner -s $target -P 1521 Metas­ploit module scanner/oracle/tnslsnr_version Brute force SID hydra -L /usr/share/metasploit-framework/data/wordlists/sid.txt -s 1521 $target oracle-sid nmap --script oracle-sid-brute -p 1521 $target Brute…

  • Analyzing data / forensic

    General tools Imaging tools dd, of course. Note that it makes sense to set the prop­er block size (some­times 4k, but most hard dri­ves are using 512), so that, when an error occued, the exact sec­tor is shown which can after­wards be skipped. dd if=/dev/sda of=/external/file.md5 bs=512 ewfacquire sudo ewfac­quire /dev/sda Advan­tages: aff4 advanced forensic…

  • Post exploitation

    General After bee­ing root, do the fol­low­ing to gain addi­tion­al information. Copy / break /etc/shadow or SAM Inves­ti­gate all /home direc­to­ries and /root ls -lahR /home/ Are there SSH keys?  Inves­ti­gate all data­bas­es and get / break their users and passwords Check cron­job­s/-tabs Enu­mer­ate programs  and deter­mine where cre­den­tials could be.  Enu­mer­ate the user’s mail Enu­mer­ate WWW directories…

  • Decompiler / Disassembler

    Check also IDEs like Intel­liJ, Visu­al Stu­dio, Eclipse, …

  • MSSQL Microsoft SQL

    Access­ing in Linux: impacket-mssqlclient Administrator:password@$target -windows-auth Default data­bas­es are: Enumeration Deter­mine version nmap -p 445 --script ms-sql-info $target Via metas­ploit auxiliary/scanner/mssql/mssql_ping Via Impack­et mssqlinstance.py $target Login brute force scanner/mssql/mssql_login When an account is known, enu­mer­ate for vulnerabilities auxiliary/admin/mssql/mssql_enum Exploitation Exe­cute commands auxiliary/admin/mssql/mssql_exec Get shell windows/mssql/mssql_payload Tools Com­mand line sqsh -U sa -P $password -S $target:1433 From Pow­er­Shell sqlcmd -S…

  • Fun with encoding

    See https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639 as a base64 cheat sheet. The clas­sic (base64 com­bines the bytes of the text and sep­a­rates 6 bit (2^6 = 64) and maps each 6 bit to a char­ac­ter. “=” means “two byte miss­ing”. For exam­ple, if the com­bined strings have 2 bit “left” (41.…), then (A==) echo Hi | base64 -d Con­vert hex…

  • Fuzzing

    From SANS660: “Fuzzing is not an attack; it is a fault-test­ing tech­nique.” Types are: Instru­ment­ed Fuzzing: “Mon­i­tor­ing” a sys­tem to learn how nor­mal inputs look like. No pre-knowl­edge of the sys­tem needed. Intel­li­gent uta­tion: A pro­to­col gram­mar which defines paths through all the code. Inputs are mutat­ed accord­ing to the grammar. Tools https://tools.kali.org/vulnerability-analysis/sfuzz See https://en.kali.tools/all/?category=fuzzer Sulley…

  • Microsoft Exchange / Outlook

    Enumeration Multiple

  • File archives

    GZ If the file can­not be extracted gzip: log.gz: unexpected end of file use zcat index.gz

  • Magento

    Vul­ner­a­bil­i­ty scan­ner: https://github.com/steverobbins/magescan

  • Sqlite

    Show tables .tables Show columns / schema from a table PRAGMA table_info(users)

  • Docker

    General commands Show avail­able Dock­er images docker images Show run­ning Dock­er instances docker ps Run an instance in fore­ground (debug logs are visible) docker run -p 8080:80/tcp --name bolt11 aerth/boltcms:latest Run an instance in the background docker run -p 8000 --name <name> -d -t <imagename> Open shell into an instance docker exec -it <container_name> /bin/bash…

  • meterpreter

    Upgrade a shell to a meter­preter shell sessions -u $session_id Cau­tion: Maybe the build­tu­ple is the wrong architecture. Show process­es ps Show how long the user is not on his/her com­put­er (try things which could pop up shells pre­fer­refly after the sys­tem is idle for some time.) idletime Migrate into anoth­er process to make the con­nec­tion…

  • Beef

    https://beefproject.com/ Injects code into a site which tracks all actions from a user and sends it back. The brows­er can also be controlled!

  • fingerprintjs

    Fingerprintjs2 col­lects a vast amount of brows­er configurations. Vic­tims could be brought to vis­it a site which con­tains this JS which sends the infor­ma­tion back to the attacker. See OSCP 414ff

  • Windows Registry

    The Win­dows reg­istry is a cen­tral data stor­age for the oper­a­tion sys­tem as well as for appli­ca­tions. It’s a key-val­ue stor­age in a tree structure. A hive is a set of keys and their val­ues. The root hives are: Short Long Con­tent Source file HKCR HKEY_CLASSES_ROOT Infor­ma­tion about file types and properties HKCC HKEY_CURRRENT_CONFIG Infor­ma­tion about…

  • Active Directory notes

    Check­list A domain of a DC con­sists out of the fol­low­ing elements: An object in AD may have a set of ACE Access Con­trol Entries which is called ACL Access Con­trol List. An objec­t’s ACE can be retrieved in PS with Get-ObjectAcl [-Identity| $object. The SCM Ser­vice Con­trol Man­ag­er con­tains a data­base of installed ser­vices…

  • File systems

    ext3/ext4 Design prin­ci­ples: Information about the file system Gen­er­al information fsstat /dev/sda1 Infor­ma­tion of an inode (2 = root directory): istat /dev/sda1 2 Get the par­ti­tions of an image mmls server.img mmls shows the start off­set of each par­ti­tion. Show details of the par­ti­tion which starts at 4096: fsstat -o 4096 server.img Show all files of a…

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';