> For the complete documentation index, see [llms.txt](https://notes.notmalicio.us/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.notmalicio.us/core/enumeration.md). # Enumeration Initial external enumeration steps. ## Initial Scan Start with an nmap script across all ports. This helps identify what would be useful to tackle next. {% code overflow="wrap" %} ```bash sudo nmap -Pn -sV -sC -p- TARGET -oN nmap_TARGET_sC_sV_allports.nmap ``` {% endcode %} For any service, try searching the relevant services in the script database for nmap using the aliased command (see Resources page). ```bash nmapsearch SEARCHTERM ``` If a hostname is available, add that to the /etc/hosts file. In the event that the target is also a domain controller, add the domain in the hosts entry. ## Ping Assuming ICMP traffic isn't blocked, pinging the host can be used to infer OS. If the TTL is... in the 60s -> Linux, in the 120s -> Windows, in the 200s -> possibly networking equipment. ## FTP/21 Anonymous FTP Access * Try the following combinations: `anonymous`/`anonymous`, `anonymous`/`BLANK`, `ftp`/`ftp` ## SSH/22 SSH is a protocol offering encrypted remote terminal access to a host. If an `authorized_keys` file is obtained and it has a dss key at the top, look at [this technique](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md#ssh-key-predictable-prng-authorized_keys-process). ## SMTP/25/POP3/110 Look around at what you can find * Telnet in, poke around to see if you can see a list of users and change their passwords * Try to login to their email via POP3 * Example: look at SolidState walkthrough/notes Use `swaks` to interact and script SMTP * Usage: {% code overflow="wrap" %} ```bash swaks --from FROM-EMAIL --to TARGET-EMAIL --header HEADER --body CONTENT --server EMAIL-SERVER ``` {% endcode %} * Example: Look at SneakyMailer write-up ## DNS/53 Start with an nmap scan: ```bash nmap -Pn -p 53 --script dns* TARGET -oN nmap_TARGET_dns_enum.nmap ``` Nslooklup: ```bash nslookup ``` * Changes default server to IPADDR: `server IPADDR` * Only necessary when using a specific server (i.e. target host is running DNS) * IP address to lookup: `IPADDR` DNSRecon: ```bash dnsrecon -r IPRANGE -n TARGET ``` * Reverse DNS Lookup * Example: `dnsrecon -r 10.10.10.10/24 -n 10.129.104.91` Zone Transfer: ```bash dig axfr DOMAIN @IP > dig_DOMAIN.txt ``` * Try to see if there is a TLS certificate domain name to try * This can be useful for finding A records * Add these to hosts file! * Quickly pull the domains: ```bash cat dig* | grep -v ";" | grep "A" | cut -f 1 | cut -d " " -f 1 | uniq ``` * Visit all of these sites! ## TFTP/69 TFTP, of the Trivial File Transfer Protocol, runs on UDP. It basically can only upload/download files. Using a Python terminal, a client can be created to pull down files. This seems to only accept 8.3 directory notation, which can be found using `dir /x`. ```python >>>import tftpy >>>client = tftpy.TftpClient("IPADDR",PORT) >>>client.download(REMOTEFILEPATH, LOCALFILENAME, timeout=15) ``` Reference: ## Finger/79 Interact with finger service: `finger @IPADDR` If you have a user: `finger USER@IPADDR` Enumerate with finger-user-enum: `./finger-user-enum.pl -U /usr/share/seclists/Usernames/Names/names.txt -t IPADD` * Source: ## HTTP/80/HTTPS/443 Start with nmap scan: {% code overflow="wrap" %} ```bash sudo nmap -Pn -sV --script http-enum,http-title,http-methods,http-robots.txt,http-backup-finder,http-config-backup,http-generator,http-git,http-userdir-enum,http-comments-displayer -p HTTPPORTS TARGET -oN nmap_TARGET_http_enum.nmap ``` {% endcode %} If site is HTTPs, check the certificate and make sure the domains are added to hosts file. ### Directory Bruteforcing Gobuster everything: {% code overflow="wrap" %} ```bash gobuster dir -k -u http://IPADDR -w /usr/share/wordlists/dirb/common.txt -t 20 -x .txt,.php,.cgi,.sh,.html,.asp,.aspx | tee gobuster_TARGET.gobuster ``` {% endcode %} * Additionally run Gobuster for all subdirectories identified that aren't visitable. * If needed, use a stronger wordlist: `/usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt` * Also consider some SecList wordlists * `/usr/share/seclists/Discovery/Web-Content/raft-small-words.txt` * If using a specific application, search for relevant wordlists: `find /usr/share/SecLists/ | grep APPLICATION` If stuck with Gobuster, consider switching to Dirb as there is not 100% overlap. Watch out for configuration/test files, such as phpinfo() * ALWAYS search 'password' on any configs or test files Subdomain Fuzzing Wfuzz for subdomain bruteforcing: {% code overflow="wrap" %} ```bash wfuzz -u http://IPADDR -H "Host: FUZZ.WEBSERVER_URI_ROOT" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt --hw 26 | tee subdomains_TARGET.wfuzz ``` {% endcode %} ### Additional Attacks Web exploitation is a vast area, so more techniques can be found in the Web Exploitation page: ## Kerberos/88 Check that localhost time is within one minute of listed scan time ## SMB/139/445 ### SMB Enumeration Identify dialect and modify /etc/samba.conf `min client protocol` accordingly: ```bash sudo nmap -Pn -p445 --script smb-protocols TARGET -oN nmap_TARGET_smb_protocols.nmap ``` Follow up with another nmap scan: {% code overflow="wrap" %} ```bash nmap -Pn -sV --script=smb-ls,smb-mbenum,smb-enum-shares,smb-enum-users,smb-os-discovery,smb-security-mode,smb-system-info -p 139,445 TARGET -oN nmap_TARGET_smb_enum.nmap ``` {% endcode %} Start with enum4linux: ```bash enum4linux IPADDR | tee e4l_TARGET.enum4linux ``` Find null sessions: ```bash smbclient -N -L ////IPADDR ``` Enumerate with smbmap: ```bash smbmap -H IPADDR ``` Brute force logins with a userlist and a password list: ```bash hydra -L USERLIST -P PASSWORDLIST IPADDR smb ``` ### Interact with SMB Interact with SMBClient: ```bash smbclient ////IPADDR//SHARE ``` Using smbmap to recurse through a share: ```bash smbmap -R SHARENAME -H IPADDR --depth 20 | tee smbmap_TARGET_SHARE.smb ``` Note: Check for `Groups.XML` on older Windows (i.e. pre-2012) hosts --> [Attacking Groups.XML](https://notes.notmalicio.us/core/active-directory-reference#groups.xml) Using smbmap to download a file: ```bash smbmap -R SHARENAME -H IPADDR --depth 20 -A FILENAME -q ``` * `-q` is for quiet to make it clog the terminal less * To find the file: `locate FILENAME` Using smbmap with credentials: ```bash smbmap -u USERNAME -p PASSWORD -H IPADDR ``` * Add a domain with `-d DOMAIN` * If you have admin, you can also use `-x COMMAND` to execute commands Use `crackmapexec` to further enumerate and interact with SMB: ```bash crackmapexec smb IPADDR -u USERNAME -p PASSWORD ``` * `-u` can take in a list or a single username * Add `--share` to enumerate shares * Add `--continue-on-success` to enumerate all accounts that may be valid * May be worth trying `-u whatever` and `-p ""` The file explorer can be used to browse shares easily by typing `smb://IPADDR/SHARENAME` in the address bar `rpcclient` can be used with credentials to extract additional information from SMB ```bash rpcclient -U USERNAME%PASSWORD IPADDR ``` * Below is a table with useful commands for rpcclient
CommandGoal
querydispinfoQueries display info, can return users and accounts
enumprintersEnumerates printers
### Mount a Share Mount a share: * Create directory: `mkdir smb` * Mount the share on the directory: `sudo mount -t cifs //TARGET/SHARE ./smb/` ### Change Password with SMB Change the password of an SMB account: ```bash sudo smbpasswd -r IPADDR USERNAME ``` Alternative for changing password with Impacket: ```bash ./changepassword.py DOMAIN/USERNAME:"PASSWORD"@TARGET -newpass "NEWPASSWORD" ``` ## SNMP/161 Use `snmpwalk` to pull information about host ```bash snmpwalk -v2c -c public IPADDR . | tee snmp_TARGET.snmpwalk ``` * Where `-c public` is the default community * A script to parse the very dense output of snmpwalk: {% code fullWidth="false" %} ```python # SNMPwalk Parser # Because i ain't reading all of that import sys import os import re def netstat_portion(snmpwalk_lines): netstat_info = [] for l in snmpwalk_lines: if re.search('udpLocalPort',l) or re.search('\:\:tcpConnState',l): netstat_l = f"{'udp' if re.search('udpLocal',l) else 'tcp'}\t\t" sl = l.split('.') l_ip = f"{sl[1]}.{sl[2]}.{sl[3]}.{sl[4]}" if len(l_ip) > 8: l_ip += "\t\t" else: l_ip += "\t\t\t" l_port = (sl[5]).split()[0] netstat_l += f"{l_ip}{l_port}" netstat_info.append(netstat_l) print("================= Networking =================") print("protocol\tlocal ip\t\tlocal port") for l in netstat_info: print(l) def process_portion(snmpwalk_lines): process_lines = {} process_info = [] for l in snmpwalk_lines: if re.search('hrSWRunName',l): pid = l.split(".")[1].split()[0] process = l.split('"')[1].split()[0] process_lines[str(pid)] = {} process_lines[str(pid)]["process"] = process if re.search('hrSWRunParameters',l): pid = l.split('.')[1].split()[0] args = "" if len(l.split("STRING: ")) > 1: args += l.split('"')[1] process_lines[str(pid)]["args"] = args for pl in process_lines.keys(): process_info.append(f"{pl}\t\t{process_lines[pl]['process']} {process_lines[pl]['args']}") print("================= Processes =================") print("pid\t\tprocess\t\targs") for l in process_info: print(l) n = len(sys.argv) if n == 2: snmpwalk_content = "" with open(sys.argv[1],"r") as snmpout: snmpwalk_content = snmpout.read() snmpwalk_lines = snmpwalk_content.split('\n') netstat_portion(snmpwalk_lines) print('\n') process_portion(snmpwalk_lines) else: print(f"Usage: {sys.argv[0]} SNMPWALK.out") ``` {% endcode %} Another tool `snmp-check` can be used to enumerate SNMP ```bash snmp-check TARGET | tee snmp_TARGET.snmpcheck ``` ## LDAP/389 LDAP is a service that offers a way to search for information that is in AD. Use `ldapsearch` to search for LDAP information Basic usage: ```bash ldapsearch -H ldap://IPADDR -x | tee ldap_TARGET_basic.ldapsearch ``` * Where `-x` means simple authentication Finding naming conventions: {% code overflow="wrap" %} ```bash ldapsearch -H ldap://IPADDR -x -s base namingcontexts | tee ldap_TARGET_naming_contexts.ldapsearch ``` {% endcode %} Using the naming conventions to search base: {% code overflow="wrap" %} ```bash ldapsearch -H ldap://IPADDR -x -b "DC=DCNAME,DC=DCNAME" | tee ldap_TARGET_basesearch.ldapsearch ``` {% endcode %} Generic querying of LDAP: {% code overflow="wrap" %} ```bash ldapsearch -H ldap://IPADDR -x -b "DC=DCNAME,DC=DCNAME" QUERYHERE | tee ldap_TARGET_basesearch_QUERY.ldapsearch ``` {% endcode %} * Use the following for the QUERYHERE argument * Find people: `'(objectClass=Person)'` * Find usernames: `'(objectClass=Person)' sAMAccountName` * Convert this list into a user list: `cat ldap_TARGET_users.ldapsearch | grep sAMAccountName | awk '{print $2}' > users_list.users` ## IPSEC/500/4500 Enumerate with `ike-scan` Usage: ```bash ike-scan -M IPADDR | tee ike_TARGET.ikescan ``` Aggressive mode (for pulling hashes): ```bash ike-scan IPADDR | tee ike_TARGET_aggresive.ikescan ``` ### Connect to the VPN Using `strongswan` * Setup * Edit the `/etc/ipsec.secrets` file to add the plaintext VPN PSK * Add this line: `IPADDR %any : PSK "PASSWORD"` * Edit the `/etc/ipsec.conf` file to add connection configuration information * See the examples in the file to write the configuration * Troubleshooting: * Start: `sudo ippsec start --nofork` ## IPMI/623 IPMI allows for management and monitoring of computer performance. Using nmap for version enumeration: ```bash sudo nmap -sU --script ipmi-version -p 623 TARGET -oN nmap_TARGET_sU_ipmi_enum.nmap ``` ## MS-SQL/1433 Use nmap to do some initial enum on MS-SQL: {% code overflow="wrap" %} ```bash sudo nmap -sV --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=MSSQLPORTS,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -p MSSQLPORTS TARGET -oN nmap_TARGET_mssql_enum.nmap ``` {% endcode %} * Reference: * Substitute information (i.e. password) as you find more info ### Master.mdf The master.mdf file offers an opportunity to extract hashes. * Reference: * Tool: * Remember to chmod master.mdf to binary! ### Credentialed Access Once credentials are obtained for MS-SQL, a few tools can be used to obtain shell access: * Crackmapexec: `crackmapexec mssql IPADDR -d "DOMAIN" -u sa -p "PASSWORD" -x "COMMAND"` * `sa` is the username in this case * Impacket: `impacket-mssqlclient sa@IPADDR` * You may need to `enable_xp_cmdshell` ## Oracle Database/1521 Use Nmap to brute force the SIDs and then use the output to brute force * Brute force SIDS: {% code overflow="wrap" %} ```bash nmap --script oracle-sid-brute -p 1521 TARGET -oN nmap_TARGET_oracle_brute_sids.nmap ``` {% endcode %} * `SID` will be used in the rest of the commands to denote the identified SID from this scan * Brute force users: {% code overflow="wrap" %} ```bash nmap --script oracle-enum-users --script-args oracle-enum-users.sid=SID -p 1521 TARGET -oN nmap_TARGET_oracle_enum_users.nmap ``` {% endcode %} * Brute force: {% code overflow="wrap" %} ```bash nmap --script oracle-brute --script-args oracle-brute.sid=SID -p 1521 TARGET -oN nmap_TARGET_oracle_brute.nmap ``` {% endcode %} * To change the password list, add the argument `brute.credfile` * Possibly this one from SecLists: `/usr/share/seclists/Passwords/Default-Credentials/oracle-betterdefaultpasslist.txt` * Use Sed to conform it into a brute file: `sed -i 's/:///g' oracle-betterdefaultpasslist.txt` ### Connect to Oracle DB * Once valid credentials are obtained, use sqlplus64 to interact with the service * Usage: `sqlplus64 USERNAME/PASS@TARGET/SID` * Higher privs (like sudo for Oracle DB): `sqlplus64 USERNAME/PASS@TARGET/SID as sysdba` ### Extracting information from the DB as a given user * User privileges: `select * from user_role_privs;` * Session privileges: `select * from session_privs;` * Reading a file: ```plsql declare f utl_file.file_type; s varchar(200); begin f := utl_file.fopen('PATH', 'FILE', 'R'); utl_file.get_line(f,s); utl_file.fclose(f); dbms_output.put_line(s); end; ``` * If no output, turn on server output: `set serveroutput ON` ```plsql declare f utl_file.file_type; s varchar(1000) := 'CONTENT'; begin f := utl_file.fopen('PATH', 'FILE', 'W'); utl_file.put_line(f,s); utl_file.fclose(f); end; ``` ## NFS/2049 Nmap enumeration of NFS: ```bash sudo nmap -Pn -sV --script nfs-ls,nfs-showmount,nfs-statfs -p NFS_PORTS TARGET -pN nmap_TARGET_nfs_enum.nmap ``` Show NFS mount: ```bash showmount -e TARGET ``` To mount the NFS: ```bash mkdir nfs_mnt # "local folder", which can be named anything sudo mount -t nfs IP:/SHARE nfs_mnt -o nolock cd nfs_mnt ``` ## MySQL/3306 Attempt to connect: `mysql -h TARGET -u root` For additional nmap enumeration: {% code overflow="wrap" %} ```bash sudo nmap -Pn -sV --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 -p MYSQLPORTS TARGET -oN nmap_TARGET_mysql_enum.nmap ``` {% endcode %} ## RDP/3389 RDP is the remote desktop protocol, so the best way into this service is with creds. For additional enumeration: {% code overflow="wrap" %} ```bash sudo nmap -Pn -sV --script rdp-enum-encryption,rdp-vuln-ms12-020,rdp-ntlm-info -p RDPPORTS TARGET -oN nmap_TARGET_rdp_enum.nmap ``` {% endcode %} ## SVN/3690 Subversion is a software versioning system. To checkout a repository with subversion: ```bash svn checkout svn://TARGET ``` To see the log after checkout: ```bash svn log ``` To go to a previous revision, where the desired "step back" is a number X): ```bash svn up -rX ``` ## VNC/5800/5801/5900/5901 Refer to ## WinRM/5985/5986 If these ports are open, then Windows Remoting may be enabled. This can offer a foothold if credentials are found. If the \`Remote Management Users\` group is identified to exist, this protocol may also be enabled. Use `crackmapexec` to further enumerate and interact with SMB: ```bash crackmapexec win-rm IPADDR -u USERNAME -p PASSWORD ``` * `-u` can take in a list or a single username * Add `--continue-on-success` to enumerate all accounts that may be valid Login with evil-winRM: ```bash evil-winrm -u USERNAME -p PASSWORD -i IPADDR ``` ## Redis/6379 Redis acts as a key-value store. Nmap enumeration: ```bash nmap -sV --script=redis-info -p REDISPORT TARGET -o nmap_TARGET_redis.txt ``` Directly connect via nc: `nc -nvv TARGET 6379` * Try `INFO` command first * If you have creds, try `AUTH USERNAME PASSWORD` Interact with Redis: * Select database: `SELECT 0`, `SELECT 1` * Return keys: `KEYS *` * Get key ABC: `GET ABC` Arbitrary file write: * Identify current directory: `CONFIG GET DIR` * Set to desired directory: `CONFIG SET DIR /desired/path` * Set contents (CONTENT) of key (KEYFILE): `SET KEYFILE CONTENT` * Switch to redis-cli for this portion * Name file NAME: `CONFIG SET DBFILENAME NAME` * Save file: `SAVE` Refer to ## Splunkd/8089 * If you have valid credentials, try this guide: * Tools include: