Skip to content

Overview

Jump to bottom
Leviathan edited this page Jun 9, 2022 · 7 revisions

1. PortScanning (to be parallelised on all machines)

1.1 fast port scan (8000 ports with default script)

  • if it takes too much time add "-T4" and relaunch nmap scan

1.2 port scanning of individual services enabling all scripts except bruteforce

  • if it takes too much time stop and launch only with "vuln" script category

1.3 repeat also with UDP

2. Service fingerprint and first interaction

2.1 nc -vn on all open services to find out more (sometimes you could found a login form)

2.2 Scan web servers first

  • visit the page with Firefox

  • see the source of the web pages for comments

2.3 Scan the various open services following hacktricks' instructions

3. Roadmap

3.1 sort the services based on those most likely to be exploited and assign times to each one

  • Websites with login forms are good starting points

4. Exploitation

4.1 using google and exploit-db to search for custom exploits

  • some useful queries:
    • "site:hackingarticles.in"
    • "site:exploit-db.com"

4.2 if you find credentials you must try them on ALL services

5. Post Exploitation

5.1 first run the basic commands on the machine (whoami, pwd, ls, ...)

5.2 then manually explore the file system

5.3 try to understand the environment (how the machine was made, what it should emulate)

5.4 import tools for later phase

  • unzip: on linux it's easy (either unzip or python), on windows if you can't use powershell then import the already unzipped folder (reduced version) and use that

  • rare case where on windows you can't import the folder because you can't do xcopy, then try using iwr or maybe ftp server if available. Also nc.exe could be used if you can import it.

5.5 Analyse the result of the enumeration script. Take a good look to:

  • 5.5.1 privileges on files

  • 5.5.2 processes with strange names (capitalised, with errors...)

  • 5.5.3 processes that are run with root permissions even though they don't need to be

  • 5.5.4 on windows look at paths with spaces

  • 5.5.5 collect ALL, but really ALL, (program versions, creds, ...) and search exploit-db and google for possible exploits

5.6 collect local exploits, import and test them

5.7 check personal messages (e.g. if you have access to mail servers or if you find mail clients, such as, for example, thunderbird)

5.8 check files/scripts written by the user. Generally the machines are quite virgin so you should have no trouble checking them by hand

Clone this wiki locally