SlideShare uma empresa Scribd logo

Penetration Test Black Box type - exploitation phase

•
•
luigi capuzzello
luigi capuzzello

The document aims to analyze the main phases of a penetration test starting from the information gathering phase up to having a shell on the target machine. The attacker machine is based on kali distribution.

Internet
1 de 8
Baixar para ler offline
TCP/IP Penetration Test - Exploitation Page 1 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello Summary: TCP/IP Penetration Test - Exploitation Description of the last modification: Insert description of the last modification here Issued by: Date LUIGI CAPUZZELLO 10/05/2022 TCP/IP Penetration Test - Exploitation
TCP/IP Penetration Test Page 2 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello INDEX 1. LEGAL DISCLAIMER ................................................................................................................................................... 8 2. PENETRATION TEST PATH PHASES DESCRIPTION ...................................................................................................... 9 3. ETH-TCP/IP ATTACK PATH DESCRIPTION..................................................................................................................10 3.1. ATTACK PATH SHORT DESCRIPTION .................................................................................................................................. 12 4. GETTING COMFORTABLE WITH KALI LINUX..............................................................................................................13 4.1. TMUX....................................................................................................................................................................... 13 4.2. EDITOR VI ................................................................................................................................................................... 14 4.3. HOW TO INSTALL UPDATE A PROGRAM. ......................................................................................................................... 15 4.4. FIRST ACCESS TO KALI ................................................................................................................................................... 16 5. MANAGING KALI LINUX SERVICES............................................................................................................................18 5.1. SSH SERVICE............................................................................................................................................................... 18 How to activate SSH Server ............................................................................................................................. 18 Useful command.............................................................................................................................................. 19 5.2. HTTP SERVICE............................................................................................................................................................. 20 5.3. FTP SERVICE ............................................................................................................................................................... 20 5.4. TFTPD SERVICE........................................................................................................................................................... 21 5.5. SAMBA SERVICE......................................................................................................................................................... 21 5.6. VNC SERVICE.............................................................................................................................................................. 22 6. BASH: USEFUL COMMAND.......................................................................................................................................22 6.1. USERFUL COMMAND LIST ............................................................................................................................................... 22 6.2. GREP – AWK - SED.................................................................................................................................................... 25 6.3. COMM: FILE COMPARISON ........................................................................................................................................... 26 7. INFORMATION GATHERING.....................................................................................................................................26 7.1. INTERNAL NETWORK SCAN.............................................................................................................................................. 27 7.2. TARGET INFOS ............................................................................................................................................................. 27 7.3. OSSINT..................................................................................................................................................................... 28 7.4. DNS: DEFINE ATTACK SURFACE ....................................................................................................................................... 28 7.5. INFORMATION GATHERING FROM WEB: SHODAN - CENSYS ................................................................................................... 30 7.6. MALTEGO................................................................................................................................................................... 30 7.7. FACEBOOK .................................................................................................................................................................. 30 8. SERVICE INFORMATION GATHERING .......................................................................................................................32 8.1. NMAP........................................................................................................................................................................ 32 9. EXPLOITATION .........................................................................................................................................................34 9.1. EXPLOITATION WITH AUTOMATED TOOLS .......................................................................................................................... 34 nmap ............................................................................................................................................................... 34 Sites ................................................................................................................................................................. 35 Nessus.............................................................................................................................................................. 35 openVAS .......................................................................................................................................................... 36 Metasploit ....................................................................................................................................................... 38 Searchsploit / Metasploit: Vulnerabilità note ................................................................................................. 39 Metasploit: verifica exploit non funzionanti.................................................................................................... 39 Meterpreter..................................................................................................................................................... 39 Armitage: Metasploit Interface....................................................................................................................... 41 Nessus e Metasploit ...................................................................................................................................... 44
TCP/IP Penetration Test Page 3 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello How to compile an exploit manually............................................................................................................. 45 9.2. [21] - FTP.................................................................................................................................................................. 46 Service Fingerprint........................................................................................................................................... 46 AuthN bypass: Anonymous Access .................................................................................................................. 46 AuthN bypass: Bruteforce................................................................................................................................ 46 Information Exposure ...................................................................................................................................... 46 Reverse Shell Activation .................................................................................................................................. 47 DOS.................................................................................................................................................................. 47 9.4. [22, 80, 445] - GIT..................................................................................................................................................... 48 AuthN bypass: Known Vuln ............................................................................................................................. 48 Information Exposure ...................................................................................................................................... 48 9.5. [22] - SSH ................................................................................................................................................................. 50 Service Fingerprint........................................................................................................................................... 50 AuthN Bypass: Connect through found key..................................................................................................... 50 AuthN bypass: Bruteforce................................................................................................................................ 50 AuthN bypass: Known Vuln ............................................................................................................................. 50 9.6. [22, 80, 443, 3690] - SVN.......................................................................................................................................... 52 AuthN bypass: Known Vuln ............................................................................................................................. 52 9.7. [23] - TELNET.............................................................................................................................................................. 52 AuthN bypass: Bruteforce................................................................................................................................ 52 9.8. [25] - SMTP .............................................................................................................................................................. 52 Service Fingerprint........................................................................................................................................... 52 AuthN bypass: Bruteforce................................................................................................................................ 52 Information Exposure ...................................................................................................................................... 53 Reverse Shell Activation .................................................................................................................................. 53 9.9. [50, 51, 500(UDP)] - IPSEC E VPN ................................................................................................................................ 54 AuthN bypass: Bruteforce................................................................................................................................ 54 9.10. [53] - DNS............................................................................................................................................................... 55 Service Fingerprint......................................................................................................................................... 55 Information Exposure.................................................................................................................................... 55 9.11. [69] – TFTP............................................................................................................................................................. 55 Service Fingerprint......................................................................................................................................... 55 9.12. [79] - FINGER............................................................................................................................................................ 56 Information Exposure.................................................................................................................................... 56 9.13. [80] - HTTP ............................................................................................................................................................. 56 9.14. [88] - KERBEROS........................................................................................................................................................ 57 Information Exposure.................................................................................................................................... 57 9.15. [110] – POP3.......................................................................................................................................................... 57 9.16. [111, 2049] – NFS / RPC ......................................................................................................................................... 58 Information Exposure.................................................................................................................................... 58 9.17. [123] - NTP............................................................................................................................................................. 59 Information Exposure.................................................................................................................................... 59 9.18. [143 / 993]: IMAP................................................................................................................................................... 59 Information Exposure.................................................................................................................................... 59 9.19. [161] - SNMP.......................................................................................................................................................... 60 Service Fingerprint......................................................................................................................................... 60 AuthN bypass: Bruteforce.............................................................................................................................. 60 Information Exposure.................................................................................................................................... 60 9.20. [389] AD................................................................................................................................................................. 61 Information Exposure.................................................................................................................................... 61 9.21. [389] LDAP............................................................................................................................................................. 62 Information Exposure.................................................................................................................................... 63 9.22. [443] - HTTPS ......................................................................................................................................................... 65 9.23. [443, 8443] - OPENVPN............................................................................................................................................ 66 AuthN bypass: Bruteforce.............................................................................................................................. 66
TCP/IP Penetration Test Page 4 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 9.24. [445] - SMB ............................................................................................................................................................ 67 Service Fingerprint......................................................................................................................................... 67 AuthN bypass: Bruteforce.............................................................................................................................. 67 Information Exposure.................................................................................................................................... 67 Reverse Shell Activation ................................................................................................................................ 75 9.25. [1433] - MSSQL...................................................................................................................................................... 78 Service Fingerprint......................................................................................................................................... 78 authN bypass: bruteforce.............................................................................................................................. 78 Information Exposure.................................................................................................................................... 78 Reverse Shell Activation ................................................................................................................................ 79 9.26. [1521] - ORACLE..................................................................................................................................................... 80 Information Exposure: msfconsole ................................................................................................................ 80 Information Exposure: ODAT......................................................................................................................... 80 Reverse Shell Activation ................................................................................................................................ 83 9.27. [3128] - SQUID ......................................................................................................................................................... 87 Reverse Shell Activation ................................................................................................................................ 87 9.28. [3260] - ISCSI.......................................................................................................................................................... 88 Information Exposure.................................................................................................................................... 88 9.29. [3306] – MYSQL / MARIADB..................................................................................................................................... 89 Service Fingerprint......................................................................................................................................... 89 AuthN bypass: Anonymous Access ................................................................................................................ 89 AuthN bypass: Bruteforce.............................................................................................................................. 89 Information Exposure.................................................................................................................................... 89 Reverse Shell Activation: con searchexploit .................................................................................................. 90 Reverse Shell Activation: con UDF exploitation............................................................................................. 90 9.30. [3389] - RDP........................................................................................................................................................... 92 Service Fingerprint......................................................................................................................................... 92 AuthN bypass: Bruteforce.............................................................................................................................. 92 9.31. [5900] - VNC........................................................................................................................................................... 93 Service Fingerprint......................................................................................................................................... 93 AuthN bypass: Bruteforce.............................................................................................................................. 93 9.32. [5985] – WINRM ..................................................................................................................................................... 93 Reverse Shell Activation ................................................................................................................................ 93 9.33. [6379]: REDIS......................................................................................................................................................... 94 Information Exposure.................................................................................................................................... 94 Reverse Shell Activation ................................................................................................................................ 94 PostExploitation: write file (SSH / HTTP / CRONTAB) .................................................................................... 95 9.34. [8000] JDWP: JAVA DEBUGGING PORT ........................................................................................................................ 97 Reverse Shell Activation ................................................................................................................................ 97 9.35. [8000] - AJENTI ........................................................................................................................................................ 97 Reverse Shell Activation ................................................................................................................................ 97 9.36. [8080] TOMCAT ..................................................................................................................................................... 98 Reverse Shell Activation ................................................................................................................................ 98 AuthN bypass ................................................................................................................................................ 98 Reverse Shell Activation ................................................................................................................................ 98 9.37. [9200] - ELASTICSEARCH. ........................................................................................................................................... 99 Service Fingerprint......................................................................................................................................... 99 Information Exposure.................................................................................................................................... 99 9.39. [10000] - WEBMIN.................................................................................................................................................101 Reverse Shell Activation: con meterpreter (possibili crdenziali necessarie) ................................................101 Reverse Shell Activation: manualmente (senza credenziali) .......................................................................102 9.40. [11211] - MEMCACHED............................................................................................................................................102 Information Exposure..................................................................................................................................102 9.41. [27017] - MONGODB .............................................................................................................................................104 Service Fingerprint.......................................................................................................................................104
TCP/IP Penetration Test Page 5 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello AuthN bypass: Bruteforce............................................................................................................................104 Information Exposure..................................................................................................................................104 10. MODULE: CREATE A REVERSE SHELL ....................................................................................................................106 10.1. ![WINDOWS] BY MEANF OF SETOOLKIT .........................................................................................................................106 10.2. MANUALLY..............................................................................................................................................................107 [windows]: reverse shell ..............................................................................................................................107 [windows]: reverse shell ..............................................................................................................................108 [windows]: execute command.....................................................................................................................109 10.3. BY MEANS OF TOOL: NETCAT, SOCAT, NC .......................................................................................................................109 [Windows-Linux] Netcat..............................................................................................................................109 socat............................................................................................................................................................110 NCat.............................................................................................................................................................110 10.4. BY MEANS OF MSFVENOM: EXE, ELF, PHP, ASP, JSP, WAR..................................................................................................110 [Windows]: reverse shell/ bind shell / execute command / embedded execution ......................................110 [Windows] Reverse shell nishang ................................................................................................................111 [Linux]: reverse shell / bind shell .................................................................................................................111 [Linux] PHP: reverse shell ............................................................................................................................112 [Windows] ASP/ASPX: reverse shell.............................................................................................................112 WAR: reverse shell.......................................................................................................................................112 JSP: reverse shell..........................................................................................................................................112 10.5. BY MEANS OF SCRIPTING LANGUAGE: BASH, PERL, PYTHON, PHP, POWERSHELL ....................................................................112 [Linux] bash .................................................................................................................................................113 [Linux] Perl...................................................................................................................................................113 [Linux] python..............................................................................................................................................113 [Linux] PHP ..................................................................................................................................................113 [Windows] Powershell.................................................................................................................................113 10.7. AV EVASION ...........................................................................................................................................................114 ![windows] msfvenom -> doubled enc.........................................................................................................114 manually......................................................................................................................................................117 by means of Shellter ....................................................................................................................................119 by means of mimikatz .................................................................................................................................120 11. MODULE SCRIPTING: USEFUL SCRIPT ...................................................................................................................127 11.1. JAVASCRIPT: IMPLEMENT POST ..................................................................................................................................127 11.2. LUA: READ / WRITE FILE............................................................................................................................................127 11.3. LUA: EXECUTE COMMAND.........................................................................................................................................128 11.4. PYTHON: BRUTEFORCE SOCKET TCP/UDP READING DATA FROM A FILE ..............................................................................128 11.5. PYTHON: BRUTEFORCE SOCKET ...................................................................................................................................129 11.6. PYTHON: READ DATA FROM MYSQL..............................................................................................................................129 11.7. PYTHON: TAKE DATA FROM A WEB PAGE, PROCESS IT AND SEND RESULT VIA POST ...............................................................130 11.8. PYTHON: BRUTEFORCE BY MEANS OF ANTI-CSRF ...........................................................................................................131 11.9. PYTHON: BRUTEFORCE SMTP....................................................................................................................................132 11.10. PYTHON: CRACK ENCRYPTED INFO KWOWING ALGORITHM WITH BRUTE FORCE ..................................................................134 11.11. PYTHON: CRACK ENCRYPTED INFO KWOWING ALGORITHM WITH DICTIONARY ...................................................................134 11.12. PYTHON: LFI.........................................................................................................................................................135 11.13. PHP: CRACK SALTED HASH PASSWORD......................................................................................................................136 12. MODULE: BRUTE FORCE.......................................................................................................................................137 13. MODULE: PASSWORD CRACKING.........................................................................................................................137 13.1. TOOLS..................................................................................................................................................................137 hashcat........................................................................................................................................................137 John The Ripper ...........................................................................................................................................137 hydra ...........................................................................................................................................................138
TCP/IP Penetration Test Page 6 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 13.2. DICTIONARY.........................................................................................................................................................139 Ready to use ................................................................................................................................................139 Ready to use with HASH ..............................................................................................................................139 create one with john....................................................................................................................................139 create one manually....................................................................................................................................140 13.3. CRACK PASSWORD ON-LINE.......................................................................................................................................141 online Site....................................................................................................................................................141 13.4. CRACK PASSWORD OFF-LINE......................................................................................................................................141 Python: Crack Salted Hash Password ..........................................................................................................141 .htpasswd ....................................................................................................................................................142 Cisco Password Type 5, 7.............................................................................................................................142 Crack: Mozilla profile .default .....................................................................................................................143 Crack Groups.xml.........................................................................................................................................143 Hash Generici: John .....................................................................................................................................143 Hash Generici: rcrack...................................................................................................................................145 Hash Generici: RAINBOW TABLE .................................................................................................................145 Hash Generici: ophcrack..............................................................................................................................145 Crack Linux password ................................................................................................................................146 Crack: LUKS file..........................................................................................................................................146 JWT firma: hashcat....................................................................................................................................147 .KIRBI (Kerberos Token) .............................................................................................................................147 MD5: hashcat ............................................................................................................................................148 PKI: private key with password .................................................................................................................148 VNC............................................................................................................................................................149 Windows Password Hash Cracking............................................................................................................153 Windows Password: john ..........................................................................................................................162 Windows: .dit e .bin...................................................................................................................................163 WPA/WPA2: hashcat.................................................................................................................................164 WPA/WPA2: pyrit......................................................................................................................................164 WPA/WPA2: aircrack / john ......................................................................................................................165 ZIP..............................................................................................................................................................166 14. IPV6 .....................................................................................................................................................................166 14.1. NOTATIONS.............................................................................................................................................................166 14.2. TYPES OF ADDRESSING ..............................................................................................................................................166 14.3. SPECIAL ADDESSING..................................................................................................................................................169 14.4. IPV6: ATTACK MANUALLY..........................................................................................................................................169 80: http....................................................................................................................................................................170 14.5. IPV6: ATTACK WITH ALIVE6 .......................................................................................................................................170 14.6. LOOKING AROUND ...................................................................................................................................................171 14.7. SETTING A GLOBAL ADDRESS ......................................................................................................................................171 14.8. IPV6 AND METASPLOIT .............................................................................................................................................172 14.9. SETTINGS AN IPV6 TUNNEL........................................................................................................................................175 15. APPENDIX: BECOME SILENT. ................................................................................................................................177 15.1. IPTABLES.................................................................................................................................................................177 15.2. TORTUNNEL - PROXYCHAINS........................................................................................................................................177 15.3. PROXYCHAIN...........................................................................................................................................................178 15.4. TOR......................................................................................................................................................................178 16. APPENDIX: CLEAN TRACES. ..................................................................................................................................180 17. APPENDIX: BASH SCRIPTING ................................................................................................................................180 17.1. VARIABLE................................................................................................................................................................180 17.2. FUNCTION ARGOMENT ..............................................................................................................................................180
TCP/IP Penetration Test Page 7 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 17.3. READ USER INPUT.....................................................................................................................................................180 17.4. IF / ELSE STATEMENT...............................................................................................................................................181 17.5. CICLO FOR .............................................................................................................................................................181 17.6. CICLO WHILE..........................................................................................................................................................182 17.7. FUNCTION ...........................................................................................................................................................182 18. APPENDIX: DOCKER .............................................................................................................................................183
TCP/IP Penetration Test Page 8 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 1. LEGAL DISCLAIMER Usage of this document for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Author assume no liability and are not responsible for any misuse or damage caused by this docuemnt.

Recomendados

Penetration Test Black Box type - Web Application
Penetration Test Black Box type - Web ApplicationPenetration Test Black Box type - Web Application
Penetration Test Black Box type - Web Applicationluigi capuzzello
 
Penetration Test Black box type - Post Exploitation Phase
Penetration Test Black box type - Post Exploitation PhasePenetration Test Black box type - Post Exploitation Phase
Penetration Test Black box type - Post Exploitation Phaseluigi capuzzello
 
Deployment guide
Deployment guideDeployment guide
Deployment guidedonzerci
 
Erp cloud service integration how end to-end_automation
Erp cloud service integration how end to-end_automationErp cloud service integration how end to-end_automation
Erp cloud service integration how end to-end_automationVikas Rai PRINCE2® ITIL®
 
Begining j2 me
Begining j2 meBegining j2 me
Begining j2 meVikas Mehta
 
@author Jane Programmer @cwid 123 45 678 @class
@author Jane Programmer @cwid 123 45 678 @class @author Jane Programmer @cwid 123 45 678 @class
@author Jane Programmer @cwid 123 45 678 @classtroutmanboris
 
@author Jane Programmer @cwid 123 45 678 @class.docx
@author Jane Programmer @cwid 123 45 678 @class.docx @author Jane Programmer @cwid 123 45 678 @class.docx
@author Jane Programmer @cwid 123 45 678 @class.docxShiraPrater50
 
S Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+GuideS Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+Guideguestd2fe1e
 

Recomendados

Penetration Test Black Box type - Web Application
Penetration Test Black Box type - Web ApplicationPenetration Test Black Box type - Web Application
Penetration Test Black Box type - Web Applicationluigi capuzzello
 
Penetration Test Black box type - Post Exploitation Phase
Penetration Test Black box type - Post Exploitation PhasePenetration Test Black box type - Post Exploitation Phase
Penetration Test Black box type - Post Exploitation Phaseluigi capuzzello
 
Deployment guide
Deployment guideDeployment guide
Deployment guidedonzerci
 
Erp cloud service integration how end to-end_automation
Erp cloud service integration how end to-end_automationErp cloud service integration how end to-end_automation
Erp cloud service integration how end to-end_automationVikas Rai PRINCE2® ITIL®
 
Begining j2 me
Begining j2 meBegining j2 me
Begining j2 meVikas Mehta
 
@author Jane Programmer @cwid 123 45 678 @class
@author Jane Programmer @cwid 123 45 678 @class @author Jane Programmer @cwid 123 45 678 @class
@author Jane Programmer @cwid 123 45 678 @classtroutmanboris
 
@author Jane Programmer @cwid 123 45 678 @class.docx
@author Jane Programmer @cwid 123 45 678 @class.docx @author Jane Programmer @cwid 123 45 678 @class.docx
@author Jane Programmer @cwid 123 45 678 @class.docxShiraPrater50
 
S Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+GuideS Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+Guideguestd2fe1e
 
S Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+GuideS Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+Guideguestd2fe1e
 
Wp Tools6 Manual
Wp Tools6 ManualWp Tools6 Manual
Wp Tools6 Manualguest02e043
 
B035-2447-220K.pdf
B035-2447-220K.pdfB035-2447-220K.pdf
B035-2447-220K.pdfdegido10
 
100302 going mobile
100302 going mobile100302 going mobile
100302 going mobileErin Mote
 
Senior Project: Methanol Injection Progressive Controller
Senior Project: Methanol Injection Progressive Controller Senior Project: Methanol Injection Progressive Controller
Senior Project: Methanol Injection Progressive Controller QuyenVu47
 
Lfa
LfaLfa
LfaNgoc Nguyen Dang
 
The Heart of KOOBFACE
The Heart of KOOBFACEThe Heart of KOOBFACE
The Heart of KOOBFACETrend Micro
 
Spi research paper
Spi research paperSpi research paper
Spi research paperQuyenVu47
 
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...Fédération Française des Télécoms
 
Fortigate utm-40-mr1
Fortigate utm-40-mr1Fortigate utm-40-mr1
Fortigate utm-40-mr1Yusuf Usmani
 
Qosfor ISP-Aug-2000
Qosfor ISP-Aug-2000Qosfor ISP-Aug-2000
Qosfor ISP-Aug-2000Andrew Bonar
 
Specification of the Linked Media Layer
Specification of the Linked Media LayerSpecification of the Linked Media Layer
Specification of the Linked Media LayerLinkedTV
 
An introduction to tivoli net view for os 390 v1r2 sg245224
An introduction to tivoli net view for os 390 v1r2 sg245224An introduction to tivoli net view for os 390 v1r2 sg245224
An introduction to tivoli net view for os 390 v1r2 sg245224Banking at Ho Chi Minh city
 
IP interconnexion : interface specification based on SIP/SDP (v2.1)
IP interconnexion : interface specification based on SIP/SDP (v2.1)IP interconnexion : interface specification based on SIP/SDP (v2.1)
IP interconnexion : interface specification based on SIP/SDP (v2.1)Fédération Française des Télécoms
 
Lartc
LartcLartc
Lartcgobed
 
Ibm tivoli web access for information management sg246823
Ibm tivoli web access for information management sg246823Ibm tivoli web access for information management sg246823
Ibm tivoli web access for information management sg246823Banking at Ho Chi Minh city
 
VoLTE and ViLTE.pdf
VoLTE and ViLTE.pdfVoLTE and ViLTE.pdf
VoLTE and ViLTE.pdfAsitSwain5
 
Winter Internship at WSS Ahmedabad
Winter Internship at WSS Ahmedabad Winter Internship at WSS Ahmedabad
Winter Internship at WSS Ahmedabad RonakPandya10
 
ClipFlair Final Version of the Platform
ClipFlair Final Version of the PlatformClipFlair Final Version of the Platform
ClipFlair Final Version of the PlatformClipFlair
 
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...Fédération Française des Télécoms
 
penetration testing - black box type.
penetration testing - black box type.penetration testing - black box type.
penetration testing - black box type.luigi capuzzello
 
Scacchi: tattiche di base.
Scacchi: tattiche di base.Scacchi: tattiche di base.
Scacchi: tattiche di base.luigi capuzzello
 

Mais conteúdo relacionado

Semelhante a Penetration Test Black Box type - exploitation phase

S Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+GuideS Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+Guideguestd2fe1e
 
Wp Tools6 Manual
Wp Tools6 ManualWp Tools6 Manual
Wp Tools6 Manualguest02e043
 
B035-2447-220K.pdf
B035-2447-220K.pdfB035-2447-220K.pdf
B035-2447-220K.pdfdegido10
 
100302 going mobile
100302 going mobile100302 going mobile
100302 going mobileErin Mote
 
Senior Project: Methanol Injection Progressive Controller
Senior Project: Methanol Injection Progressive Controller Senior Project: Methanol Injection Progressive Controller
Senior Project: Methanol Injection Progressive Controller QuyenVu47
 
The Heart of KOOBFACE
The Heart of KOOBFACEThe Heart of KOOBFACE
The Heart of KOOBFACETrend Micro
 
Spi research paper
Spi research paperSpi research paper
Spi research paperQuyenVu47
 
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...Fédération Française des Télécoms
 
Fortigate utm-40-mr1
Fortigate utm-40-mr1Fortigate utm-40-mr1
Fortigate utm-40-mr1Yusuf Usmani
 
Qosfor ISP-Aug-2000
Qosfor ISP-Aug-2000Qosfor ISP-Aug-2000
Qosfor ISP-Aug-2000Andrew Bonar
 
Specification of the Linked Media Layer
Specification of the Linked Media LayerSpecification of the Linked Media Layer
Specification of the Linked Media LayerLinkedTV
 
An introduction to tivoli net view for os 390 v1r2 sg245224
An introduction to tivoli net view for os 390 v1r2 sg245224An introduction to tivoli net view for os 390 v1r2 sg245224
An introduction to tivoli net view for os 390 v1r2 sg245224Banking at Ho Chi Minh city
 
Lartc
LartcLartc
Lartcgobed
 
Ibm tivoli web access for information management sg246823
Ibm tivoli web access for information management sg246823Ibm tivoli web access for information management sg246823
Ibm tivoli web access for information management sg246823Banking at Ho Chi Minh city
 
VoLTE and ViLTE.pdf
VoLTE and ViLTE.pdfVoLTE and ViLTE.pdf
VoLTE and ViLTE.pdfAsitSwain5
 
Winter Internship at WSS Ahmedabad
Winter Internship at WSS Ahmedabad Winter Internship at WSS Ahmedabad
Winter Internship at WSS Ahmedabad RonakPandya10
 
ClipFlair Final Version of the Platform
ClipFlair Final Version of the PlatformClipFlair Final Version of the Platform
ClipFlair Final Version of the PlatformClipFlair
 
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...Fédération Française des Télécoms
 

Semelhante a Penetration Test Black Box type - exploitation phase (20)

S Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+GuideS Pii Plus+C+Library+Programmer+Guide
S Pii Plus+C+Library+Programmer+Guide
 
Wp Tools6 Manual
Wp Tools6 ManualWp Tools6 Manual
Wp Tools6 Manual
 
B035-2447-220K.pdf
B035-2447-220K.pdfB035-2447-220K.pdf
B035-2447-220K.pdf
 
100302 going mobile
100302 going mobile100302 going mobile
100302 going mobile
 
Senior Project: Methanol Injection Progressive Controller
Senior Project: Methanol Injection Progressive Controller Senior Project: Methanol Injection Progressive Controller
Senior Project: Methanol Injection Progressive Controller
 
Lfa
LfaLfa
Lfa
 
The Heart of KOOBFACE
The Heart of KOOBFACEThe Heart of KOOBFACE
The Heart of KOOBFACE
 
Spi research paper
Spi research paperSpi research paper
Spi research paper
 
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...
Version 2.1.1 (juin 2019) interface SIP FFTélécoms pour interconnexion voix (...
 
Fortigate utm-40-mr1
Fortigate utm-40-mr1Fortigate utm-40-mr1
Fortigate utm-40-mr1
 
Qosfor ISP-Aug-2000
Qosfor ISP-Aug-2000Qosfor ISP-Aug-2000
Qosfor ISP-Aug-2000
 
Specification of the Linked Media Layer
Specification of the Linked Media LayerSpecification of the Linked Media Layer
Specification of the Linked Media Layer
 
An introduction to tivoli net view for os 390 v1r2 sg245224
An introduction to tivoli net view for os 390 v1r2 sg245224An introduction to tivoli net view for os 390 v1r2 sg245224
An introduction to tivoli net view for os 390 v1r2 sg245224
 
IP interconnexion : interface specification based on SIP/SDP (v2.1)
IP interconnexion : interface specification based on SIP/SDP (v2.1)IP interconnexion : interface specification based on SIP/SDP (v2.1)
IP interconnexion : interface specification based on SIP/SDP (v2.1)
 
Lartc
LartcLartc
Lartc
 
Ibm tivoli web access for information management sg246823
Ibm tivoli web access for information management sg246823Ibm tivoli web access for information management sg246823
Ibm tivoli web access for information management sg246823
 
VoLTE and ViLTE.pdf
VoLTE and ViLTE.pdfVoLTE and ViLTE.pdf
VoLTE and ViLTE.pdf
 
Winter Internship at WSS Ahmedabad
Winter Internship at WSS Ahmedabad Winter Internship at WSS Ahmedabad
Winter Internship at WSS Ahmedabad
 
ClipFlair Final Version of the Platform
ClipFlair Final Version of the PlatformClipFlair Final Version of the Platform
ClipFlair Final Version of the Platform
 
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...
IP interconnexion : interface specification based on SIP/SDP (v2.1) - Nouvell...
 

Mais de luigi capuzzello

penetration testing - black box type.
penetration testing - black box type.penetration testing - black box type.
penetration testing - black box type.luigi capuzzello
 
Scacchi: tattiche di base.
Scacchi: tattiche di base.Scacchi: tattiche di base.
Scacchi: tattiche di base.luigi capuzzello
 
Buffer Overflow - Shellcode - Shatter Attack
Buffer Overflow - Shellcode - Shatter AttackBuffer Overflow - Shellcode - Shatter Attack
Buffer Overflow - Shellcode - Shatter Attackluigi capuzzello
 
Assembly and Reverse Engineering
Assembly and Reverse EngineeringAssembly and Reverse Engineering
Assembly and Reverse Engineeringluigi capuzzello
 

Mais de luigi capuzzello (8)

penetration testing - black box type.
penetration testing - black box type.penetration testing - black box type.
penetration testing - black box type.
 
Scacchi: tattiche di base.
Scacchi: tattiche di base.Scacchi: tattiche di base.
Scacchi: tattiche di base.
 
Cutting out Malware
Cutting out MalwareCutting out Malware
Cutting out Malware
 
Perl
PerlPerl
Perl
 
Regular expression
Regular expressionRegular expression
Regular expression
 
Buffer Overflow - Shellcode - Shatter Attack
Buffer Overflow - Shellcode - Shatter AttackBuffer Overflow - Shellcode - Shatter Attack
Buffer Overflow - Shellcode - Shatter Attack
 
Assembly and Reverse Engineering
Assembly and Reverse EngineeringAssembly and Reverse Engineering
Assembly and Reverse Engineering
 
Sicurezza informatica
Sicurezza informaticaSicurezza informatica
Sicurezza informatica
 

Último

How Do I Begin the Linksys Velop Setup Process?
How Do I Begin the Linksys Velop Setup Process?How Do I Begin the Linksys Velop Setup Process?
How Do I Begin the Linksys Velop Setup Process?Linksys Velop Login
 
Pvtaan Social media marketing proposal.pdf
Pvtaan Social media marketing proposal.pdfPvtaan Social media marketing proposal.pdf
Pvtaan Social media marketing proposal.pdfPvtaan
 
Cyber Security Services Unveiled: Strategies to Secure Your Digital Presence
Cyber Security Services Unveiled: Strategies to Secure Your Digital PresenceCyber Security Services Unveiled: Strategies to Secure Your Digital Presence
Cyber Security Services Unveiled: Strategies to Secure Your Digital PresencePC Doctors NET
 
Statistical Analysis of DNS Latencies.pdf
Statistical Analysis of DNS Latencies.pdfStatistical Analysis of DNS Latencies.pdf
Statistical Analysis of DNS Latencies.pdfOndejSur
 
Reggie miller choke t shirtsReggie miller choke t shirts
Reggie miller choke t shirtsReggie miller choke t shirtsReggie miller choke t shirtsReggie miller choke t shirts
Reggie miller choke t shirtsReggie miller choke t shirtsrahman018755
 
TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.
TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.
TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.Tortogel
 
Thank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirtsThank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirtsrahman018755
 
audience research (emma) 1.pptxkkkkkkkkkkkkkkkkk
audience research (emma) 1.pptxkkkkkkkkkkkkkkkkkaudience research (emma) 1.pptxkkkkkkkkkkkkkkkkk
audience research (emma) 1.pptxkkkkkkkkkkkkkkkkklolsDocherty
 
Production 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptxProduction 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptxChloeMeadows1
 
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWebiThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWebJie Liau
 
The Use of AI in Indonesia Election 2024: A Case Study
The Use of AI in Indonesia Election 2024: A Case StudyThe Use of AI in Indonesia Election 2024: A Case Study
The Use of AI in Indonesia Election 2024: A Case StudyDamar Juniarto
 
I’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 ShirtI’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 Shirtrahman018755
 
Development Lifecycle.pptx for the secure development of apps
Development Lifecycle.pptx for the secure development of appsDevelopment Lifecycle.pptx for the secure development of apps
Development Lifecycle.pptx for the secure development of appscristianmanaila2
 
Premier Mobile App Development Agency in USA.pdf
Premier Mobile App Development Agency in USA.pdfPremier Mobile App Development Agency in USA.pdf
Premier Mobile App Development Agency in USA.pdfappinfoedgeca
 
Bug Bounty Blueprint : A Beginner's Guide
Bug Bounty Blueprint : A Beginner's GuideBug Bounty Blueprint : A Beginner's Guide
Bug Bounty Blueprint : A Beginner's GuideVarun Mithran
 

Último (16)

How Do I Begin the Linksys Velop Setup Process?
How Do I Begin the Linksys Velop Setup Process?How Do I Begin the Linksys Velop Setup Process?
How Do I Begin the Linksys Velop Setup Process?
 
Pvtaan Social media marketing proposal.pdf
Pvtaan Social media marketing proposal.pdfPvtaan Social media marketing proposal.pdf
Pvtaan Social media marketing proposal.pdf
 
Cyber Security Services Unveiled: Strategies to Secure Your Digital Presence
Cyber Security Services Unveiled: Strategies to Secure Your Digital PresenceCyber Security Services Unveiled: Strategies to Secure Your Digital Presence
Cyber Security Services Unveiled: Strategies to Secure Your Digital Presence
 
Statistical Analysis of DNS Latencies.pdf
Statistical Analysis of DNS Latencies.pdfStatistical Analysis of DNS Latencies.pdf
Statistical Analysis of DNS Latencies.pdf
 
Reggie miller choke t shirtsReggie miller choke t shirts
Reggie miller choke t shirtsReggie miller choke t shirtsReggie miller choke t shirtsReggie miller choke t shirts
Reggie miller choke t shirtsReggie miller choke t shirts
 
TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.
TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.
TORTOGEL TELAH MENJADI SALAH SATU PLATFORM PERMAINAN PALING FAVORIT.
 
Thank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirtsThank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirts
 
GOOGLE Io 2024 At takes center stage.pdf
GOOGLE Io 2024 At takes center stage.pdfGOOGLE Io 2024 At takes center stage.pdf
GOOGLE Io 2024 At takes center stage.pdf
 
audience research (emma) 1.pptxkkkkkkkkkkkkkkkkk
audience research (emma) 1.pptxkkkkkkkkkkkkkkkkkaudience research (emma) 1.pptxkkkkkkkkkkkkkkkkk
audience research (emma) 1.pptxkkkkkkkkkkkkkkkkk
 
Production 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptxProduction 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptx
 
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWebiThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
 
The Use of AI in Indonesia Election 2024: A Case Study
The Use of AI in Indonesia Election 2024: A Case StudyThe Use of AI in Indonesia Election 2024: A Case Study
The Use of AI in Indonesia Election 2024: A Case Study
 
I’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 ShirtI’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 Shirt
 
Development Lifecycle.pptx for the secure development of apps
Development Lifecycle.pptx for the secure development of appsDevelopment Lifecycle.pptx for the secure development of apps
Development Lifecycle.pptx for the secure development of apps
 
Premier Mobile App Development Agency in USA.pdf
Premier Mobile App Development Agency in USA.pdfPremier Mobile App Development Agency in USA.pdf
Premier Mobile App Development Agency in USA.pdf
 
Bug Bounty Blueprint : A Beginner's Guide
Bug Bounty Blueprint : A Beginner's GuideBug Bounty Blueprint : A Beginner's Guide
Bug Bounty Blueprint : A Beginner's Guide
 

Penetration Test Black Box type - exploitation phase

  • 1. TCP/IP Penetration Test - Exploitation Page 1 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello Summary: TCP/IP Penetration Test - Exploitation Description of the last modification: Insert description of the last modification here Issued by: Date LUIGI CAPUZZELLO 10/05/2022 TCP/IP Penetration Test - Exploitation
  • 2. TCP/IP Penetration Test Page 2 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello INDEX 1. LEGAL DISCLAIMER ................................................................................................................................................... 8 2. PENETRATION TEST PATH PHASES DESCRIPTION ...................................................................................................... 9 3. ETH-TCP/IP ATTACK PATH DESCRIPTION..................................................................................................................10 3.1. ATTACK PATH SHORT DESCRIPTION .................................................................................................................................. 12 4. GETTING COMFORTABLE WITH KALI LINUX..............................................................................................................13 4.1. TMUX....................................................................................................................................................................... 13 4.2. EDITOR VI ................................................................................................................................................................... 14 4.3. HOW TO INSTALL UPDATE A PROGRAM. ......................................................................................................................... 15 4.4. FIRST ACCESS TO KALI ................................................................................................................................................... 16 5. MANAGING KALI LINUX SERVICES............................................................................................................................18 5.1. SSH SERVICE............................................................................................................................................................... 18 How to activate SSH Server ............................................................................................................................. 18 Useful command.............................................................................................................................................. 19 5.2. HTTP SERVICE............................................................................................................................................................. 20 5.3. FTP SERVICE ............................................................................................................................................................... 20 5.4. TFTPD SERVICE........................................................................................................................................................... 21 5.5. SAMBA SERVICE......................................................................................................................................................... 21 5.6. VNC SERVICE.............................................................................................................................................................. 22 6. BASH: USEFUL COMMAND.......................................................................................................................................22 6.1. USERFUL COMMAND LIST ............................................................................................................................................... 22 6.2. GREP – AWK - SED.................................................................................................................................................... 25 6.3. COMM: FILE COMPARISON ........................................................................................................................................... 26 7. INFORMATION GATHERING.....................................................................................................................................26 7.1. INTERNAL NETWORK SCAN.............................................................................................................................................. 27 7.2. TARGET INFOS ............................................................................................................................................................. 27 7.3. OSSINT..................................................................................................................................................................... 28 7.4. DNS: DEFINE ATTACK SURFACE ....................................................................................................................................... 28 7.5. INFORMATION GATHERING FROM WEB: SHODAN - CENSYS ................................................................................................... 30 7.6. MALTEGO................................................................................................................................................................... 30 7.7. FACEBOOK .................................................................................................................................................................. 30 8. SERVICE INFORMATION GATHERING .......................................................................................................................32 8.1. NMAP........................................................................................................................................................................ 32 9. EXPLOITATION .........................................................................................................................................................34 9.1. EXPLOITATION WITH AUTOMATED TOOLS .......................................................................................................................... 34 nmap ............................................................................................................................................................... 34 Sites ................................................................................................................................................................. 35 Nessus.............................................................................................................................................................. 35 openVAS .......................................................................................................................................................... 36 Metasploit ....................................................................................................................................................... 38 Searchsploit / Metasploit: Vulnerabilità note ................................................................................................. 39 Metasploit: verifica exploit non funzionanti.................................................................................................... 39 Meterpreter..................................................................................................................................................... 39 Armitage: Metasploit Interface....................................................................................................................... 41 Nessus e Metasploit ...................................................................................................................................... 44
  • 3. TCP/IP Penetration Test Page 3 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello How to compile an exploit manually............................................................................................................. 45 9.2. [21] - FTP.................................................................................................................................................................. 46 Service Fingerprint........................................................................................................................................... 46 AuthN bypass: Anonymous Access .................................................................................................................. 46 AuthN bypass: Bruteforce................................................................................................................................ 46 Information Exposure ...................................................................................................................................... 46 Reverse Shell Activation .................................................................................................................................. 47 DOS.................................................................................................................................................................. 47 9.4. [22, 80, 445] - GIT..................................................................................................................................................... 48 AuthN bypass: Known Vuln ............................................................................................................................. 48 Information Exposure ...................................................................................................................................... 48 9.5. [22] - SSH ................................................................................................................................................................. 50 Service Fingerprint........................................................................................................................................... 50 AuthN Bypass: Connect through found key..................................................................................................... 50 AuthN bypass: Bruteforce................................................................................................................................ 50 AuthN bypass: Known Vuln ............................................................................................................................. 50 9.6. [22, 80, 443, 3690] - SVN.......................................................................................................................................... 52 AuthN bypass: Known Vuln ............................................................................................................................. 52 9.7. [23] - TELNET.............................................................................................................................................................. 52 AuthN bypass: Bruteforce................................................................................................................................ 52 9.8. [25] - SMTP .............................................................................................................................................................. 52 Service Fingerprint........................................................................................................................................... 52 AuthN bypass: Bruteforce................................................................................................................................ 52 Information Exposure ...................................................................................................................................... 53 Reverse Shell Activation .................................................................................................................................. 53 9.9. [50, 51, 500(UDP)] - IPSEC E VPN ................................................................................................................................ 54 AuthN bypass: Bruteforce................................................................................................................................ 54 9.10. [53] - DNS............................................................................................................................................................... 55 Service Fingerprint......................................................................................................................................... 55 Information Exposure.................................................................................................................................... 55 9.11. [69] – TFTP............................................................................................................................................................. 55 Service Fingerprint......................................................................................................................................... 55 9.12. [79] - FINGER............................................................................................................................................................ 56 Information Exposure.................................................................................................................................... 56 9.13. [80] - HTTP ............................................................................................................................................................. 56 9.14. [88] - KERBEROS........................................................................................................................................................ 57 Information Exposure.................................................................................................................................... 57 9.15. [110] – POP3.......................................................................................................................................................... 57 9.16. [111, 2049] – NFS / RPC ......................................................................................................................................... 58 Information Exposure.................................................................................................................................... 58 9.17. [123] - NTP............................................................................................................................................................. 59 Information Exposure.................................................................................................................................... 59 9.18. [143 / 993]: IMAP................................................................................................................................................... 59 Information Exposure.................................................................................................................................... 59 9.19. [161] - SNMP.......................................................................................................................................................... 60 Service Fingerprint......................................................................................................................................... 60 AuthN bypass: Bruteforce.............................................................................................................................. 60 Information Exposure.................................................................................................................................... 60 9.20. [389] AD................................................................................................................................................................. 61 Information Exposure.................................................................................................................................... 61 9.21. [389] LDAP............................................................................................................................................................. 62 Information Exposure.................................................................................................................................... 63 9.22. [443] - HTTPS ......................................................................................................................................................... 65 9.23. [443, 8443] - OPENVPN............................................................................................................................................ 66 AuthN bypass: Bruteforce.............................................................................................................................. 66
  • 4. TCP/IP Penetration Test Page 4 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 9.24. [445] - SMB ............................................................................................................................................................ 67 Service Fingerprint......................................................................................................................................... 67 AuthN bypass: Bruteforce.............................................................................................................................. 67 Information Exposure.................................................................................................................................... 67 Reverse Shell Activation ................................................................................................................................ 75 9.25. [1433] - MSSQL...................................................................................................................................................... 78 Service Fingerprint......................................................................................................................................... 78 authN bypass: bruteforce.............................................................................................................................. 78 Information Exposure.................................................................................................................................... 78 Reverse Shell Activation ................................................................................................................................ 79 9.26. [1521] - ORACLE..................................................................................................................................................... 80 Information Exposure: msfconsole ................................................................................................................ 80 Information Exposure: ODAT......................................................................................................................... 80 Reverse Shell Activation ................................................................................................................................ 83 9.27. [3128] - SQUID ......................................................................................................................................................... 87 Reverse Shell Activation ................................................................................................................................ 87 9.28. [3260] - ISCSI.......................................................................................................................................................... 88 Information Exposure.................................................................................................................................... 88 9.29. [3306] – MYSQL / MARIADB..................................................................................................................................... 89 Service Fingerprint......................................................................................................................................... 89 AuthN bypass: Anonymous Access ................................................................................................................ 89 AuthN bypass: Bruteforce.............................................................................................................................. 89 Information Exposure.................................................................................................................................... 89 Reverse Shell Activation: con searchexploit .................................................................................................. 90 Reverse Shell Activation: con UDF exploitation............................................................................................. 90 9.30. [3389] - RDP........................................................................................................................................................... 92 Service Fingerprint......................................................................................................................................... 92 AuthN bypass: Bruteforce.............................................................................................................................. 92 9.31. [5900] - VNC........................................................................................................................................................... 93 Service Fingerprint......................................................................................................................................... 93 AuthN bypass: Bruteforce.............................................................................................................................. 93 9.32. [5985] – WINRM ..................................................................................................................................................... 93 Reverse Shell Activation ................................................................................................................................ 93 9.33. [6379]: REDIS......................................................................................................................................................... 94 Information Exposure.................................................................................................................................... 94 Reverse Shell Activation ................................................................................................................................ 94 PostExploitation: write file (SSH / HTTP / CRONTAB) .................................................................................... 95 9.34. [8000] JDWP: JAVA DEBUGGING PORT ........................................................................................................................ 97 Reverse Shell Activation ................................................................................................................................ 97 9.35. [8000] - AJENTI ........................................................................................................................................................ 97 Reverse Shell Activation ................................................................................................................................ 97 9.36. [8080] TOMCAT ..................................................................................................................................................... 98 Reverse Shell Activation ................................................................................................................................ 98 AuthN bypass ................................................................................................................................................ 98 Reverse Shell Activation ................................................................................................................................ 98 9.37. [9200] - ELASTICSEARCH. ........................................................................................................................................... 99 Service Fingerprint......................................................................................................................................... 99 Information Exposure.................................................................................................................................... 99 9.39. [10000] - WEBMIN.................................................................................................................................................101 Reverse Shell Activation: con meterpreter (possibili crdenziali necessarie) ................................................101 Reverse Shell Activation: manualmente (senza credenziali) .......................................................................102 9.40. [11211] - MEMCACHED............................................................................................................................................102 Information Exposure..................................................................................................................................102 9.41. [27017] - MONGODB .............................................................................................................................................104 Service Fingerprint.......................................................................................................................................104
  • 5. TCP/IP Penetration Test Page 5 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello AuthN bypass: Bruteforce............................................................................................................................104 Information Exposure..................................................................................................................................104 10. MODULE: CREATE A REVERSE SHELL ....................................................................................................................106 10.1. ![WINDOWS] BY MEANF OF SETOOLKIT .........................................................................................................................106 10.2. MANUALLY..............................................................................................................................................................107 [windows]: reverse shell ..............................................................................................................................107 [windows]: reverse shell ..............................................................................................................................108 [windows]: execute command.....................................................................................................................109 10.3. BY MEANS OF TOOL: NETCAT, SOCAT, NC .......................................................................................................................109 [Windows-Linux] Netcat..............................................................................................................................109 socat............................................................................................................................................................110 NCat.............................................................................................................................................................110 10.4. BY MEANS OF MSFVENOM: EXE, ELF, PHP, ASP, JSP, WAR..................................................................................................110 [Windows]: reverse shell/ bind shell / execute command / embedded execution ......................................110 [Windows] Reverse shell nishang ................................................................................................................111 [Linux]: reverse shell / bind shell .................................................................................................................111 [Linux] PHP: reverse shell ............................................................................................................................112 [Windows] ASP/ASPX: reverse shell.............................................................................................................112 WAR: reverse shell.......................................................................................................................................112 JSP: reverse shell..........................................................................................................................................112 10.5. BY MEANS OF SCRIPTING LANGUAGE: BASH, PERL, PYTHON, PHP, POWERSHELL ....................................................................112 [Linux] bash .................................................................................................................................................113 [Linux] Perl...................................................................................................................................................113 [Linux] python..............................................................................................................................................113 [Linux] PHP ..................................................................................................................................................113 [Windows] Powershell.................................................................................................................................113 10.7. AV EVASION ...........................................................................................................................................................114 ![windows] msfvenom -> doubled enc.........................................................................................................114 manually......................................................................................................................................................117 by means of Shellter ....................................................................................................................................119 by means of mimikatz .................................................................................................................................120 11. MODULE SCRIPTING: USEFUL SCRIPT ...................................................................................................................127 11.1. JAVASCRIPT: IMPLEMENT POST ..................................................................................................................................127 11.2. LUA: READ / WRITE FILE............................................................................................................................................127 11.3. LUA: EXECUTE COMMAND.........................................................................................................................................128 11.4. PYTHON: BRUTEFORCE SOCKET TCP/UDP READING DATA FROM A FILE ..............................................................................128 11.5. PYTHON: BRUTEFORCE SOCKET ...................................................................................................................................129 11.6. PYTHON: READ DATA FROM MYSQL..............................................................................................................................129 11.7. PYTHON: TAKE DATA FROM A WEB PAGE, PROCESS IT AND SEND RESULT VIA POST ...............................................................130 11.8. PYTHON: BRUTEFORCE BY MEANS OF ANTI-CSRF ...........................................................................................................131 11.9. PYTHON: BRUTEFORCE SMTP....................................................................................................................................132 11.10. PYTHON: CRACK ENCRYPTED INFO KWOWING ALGORITHM WITH BRUTE FORCE ..................................................................134 11.11. PYTHON: CRACK ENCRYPTED INFO KWOWING ALGORITHM WITH DICTIONARY ...................................................................134 11.12. PYTHON: LFI.........................................................................................................................................................135 11.13. PHP: CRACK SALTED HASH PASSWORD......................................................................................................................136 12. MODULE: BRUTE FORCE.......................................................................................................................................137 13. MODULE: PASSWORD CRACKING.........................................................................................................................137 13.1. TOOLS..................................................................................................................................................................137 hashcat........................................................................................................................................................137 John The Ripper ...........................................................................................................................................137 hydra ...........................................................................................................................................................138
  • 6. TCP/IP Penetration Test Page 6 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 13.2. DICTIONARY.........................................................................................................................................................139 Ready to use ................................................................................................................................................139 Ready to use with HASH ..............................................................................................................................139 create one with john....................................................................................................................................139 create one manually....................................................................................................................................140 13.3. CRACK PASSWORD ON-LINE.......................................................................................................................................141 online Site....................................................................................................................................................141 13.4. CRACK PASSWORD OFF-LINE......................................................................................................................................141 Python: Crack Salted Hash Password ..........................................................................................................141 .htpasswd ....................................................................................................................................................142 Cisco Password Type 5, 7.............................................................................................................................142 Crack: Mozilla profile .default .....................................................................................................................143 Crack Groups.xml.........................................................................................................................................143 Hash Generici: John .....................................................................................................................................143 Hash Generici: rcrack...................................................................................................................................145 Hash Generici: RAINBOW TABLE .................................................................................................................145 Hash Generici: ophcrack..............................................................................................................................145 Crack Linux password ................................................................................................................................146 Crack: LUKS file..........................................................................................................................................146 JWT firma: hashcat....................................................................................................................................147 .KIRBI (Kerberos Token) .............................................................................................................................147 MD5: hashcat ............................................................................................................................................148 PKI: private key with password .................................................................................................................148 VNC............................................................................................................................................................149 Windows Password Hash Cracking............................................................................................................153 Windows Password: john ..........................................................................................................................162 Windows: .dit e .bin...................................................................................................................................163 WPA/WPA2: hashcat.................................................................................................................................164 WPA/WPA2: pyrit......................................................................................................................................164 WPA/WPA2: aircrack / john ......................................................................................................................165 ZIP..............................................................................................................................................................166 14. IPV6 .....................................................................................................................................................................166 14.1. NOTATIONS.............................................................................................................................................................166 14.2. TYPES OF ADDRESSING ..............................................................................................................................................166 14.3. SPECIAL ADDESSING..................................................................................................................................................169 14.4. IPV6: ATTACK MANUALLY..........................................................................................................................................169 80: http....................................................................................................................................................................170 14.5. IPV6: ATTACK WITH ALIVE6 .......................................................................................................................................170 14.6. LOOKING AROUND ...................................................................................................................................................171 14.7. SETTING A GLOBAL ADDRESS ......................................................................................................................................171 14.8. IPV6 AND METASPLOIT .............................................................................................................................................172 14.9. SETTINGS AN IPV6 TUNNEL........................................................................................................................................175 15. APPENDIX: BECOME SILENT. ................................................................................................................................177 15.1. IPTABLES.................................................................................................................................................................177 15.2. TORTUNNEL - PROXYCHAINS........................................................................................................................................177 15.3. PROXYCHAIN...........................................................................................................................................................178 15.4. TOR......................................................................................................................................................................178 16. APPENDIX: CLEAN TRACES. ..................................................................................................................................180 17. APPENDIX: BASH SCRIPTING ................................................................................................................................180 17.1. VARIABLE................................................................................................................................................................180 17.2. FUNCTION ARGOMENT ..............................................................................................................................................180
  • 7. TCP/IP Penetration Test Page 7 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 17.3. READ USER INPUT.....................................................................................................................................................180 17.4. IF / ELSE STATEMENT...............................................................................................................................................181 17.5. CICLO FOR .............................................................................................................................................................181 17.6. CICLO WHILE..........................................................................................................................................................182 17.7. FUNCTION ...........................................................................................................................................................182 18. APPENDIX: DOCKER .............................................................................................................................................183
  • 8. TCP/IP Penetration Test Page 8 / 184 Linkedin: https://www.linkedin.com/in/luigi-capuzzello/ Slideshare: http://www.slideshare.net/luigicapuzzello Twitter: @FisherKasparov Skype: luigi.capuzzello 1. LEGAL DISCLAIMER Usage of this document for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Author assume no liability and are not responsible for any misuse or damage caused by this docuemnt.