steel-mountain

Report Template

Table of Contents

• Summary
• Enumerate
  • Ports
  • Services
    • FTP
    • SSH
    • SMTP
    • DNS
    • HTTP
    • POP3
    • RPC
    • IMAP
    • NetBIOS
    • SMB
    • SQL
    • RDP
  • OS
    • Nmap OS Discovery Scan
    • Nmap OS Discovery Scan via SMB
• Exploit
  • Password Guessing
    • Default Credentials
    • Hydra
  • CVE-2021-1234
    • EDB-ID-56789
    • cyberphor POC
    • Metasploit
• Explore
• Escalate
• Lessons Learned

Summary

• Hostname:
• Description:
• IP Address:
• MAC Address: (ref:)
• Domain: WORKGROUP
• TCP Ports and Services
  • 22
    • OpenSSH
  • 80
    • HTTP
  • 445
    • SMBv1
• UDP Ports and Services
  • 53
    • DNS
• OS
  • Distro: (ref:)
  • Kernel: (ref:)
  • Architecture: (ref:)
• Users (ref:)
  • root
  • administrator
• Vulnerabilities and Exploits
  • CVE-2021-1234 (ref:)
    • EDB-ID-56789
    • cyberphor POC
    • Metasploit
• Tools Used
  • Nmap
• Flag
  • ???
• Hints
  • n/a

Enumerate

Setup

TARGET=10.11.12.13
NAME=demo
new-ctf $NAME
cd $NAME

Ports

sudo nmap $TARGET -sS -sU --min-rate 1000 -oN scans/$NAME-nmap-initial
sudo nmap $TARGET -sS -sU -p- --min-rate 1000 -oN scans/$NAME-nmap-complete
sudo nmap $TARGET -sV $(print-open-ports-from-nmap-scan scans/$NAME-nmap-complete) -oN scans/$NAME-nmap-versions

# output
NSTR

Services

FTP

cd loot
touch README.too # create a file
ftp $TARGET 21 # login using anonymous:anonymous
put README.too # upload file created above (i.e. check if we have write privileges)
ls
binary 
get file.txt # download a file (i.e. check if we have read privileges)
mget * # download everything
exit

SSH

???

SMTP

Automated enumeration of supported SMTP commands.

sudo nmap $TARGET -p25 --script smtp-commands -oN scans/$NAME-nmap-script-smtp-commands

Automated enumeration of existing SMTP users.

sudo nmap $TARGET -p25 --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY,EXPN,RCPT} -oN scans/$NAME-nmap-script-smtp-enum-users

smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t $TARGET

Automated enumeration of exploitable SMTP vulnerabilities.

sudo nmap $TARGET -p25 --script smtp-vuln* -oN scans/mailman-nmap-script-smtp-vuln

DNS

???

HTTP

dirsearch -u $TARGET:$PORT -o $FULLPATH/$NAME-dirsearch --format=simple
dirsearch -u $TARGET:$PORT -e php -o $FULLPATH/$NAME-dirsearch-php --format=simple

# output
NSTR

dirb http://$TARGET -r -z10 -o scans/$NAME-dirb-common

# output
NSTR

nikto -h $TARGET -p $PORT -T 2 -Format txt -o scans/$NAME-nikto-misconfig

# output
NSTR

sudo nmap $TARGET -p80 --script http-shellshock -oN scans/$NAME-nmap-script-http-shellshock

# output
NSTR

RPC

rpcclient -U '' $TARGET

# output
NSTR

NetBIOS

nbtscan $TARGET

# output
NSTR

SMB

smbclient -L $TARGET

# output
NSTR

smbmap -H $TARGET

# output
NSTR

# check if vulnerable to EternalBlue
sudo nmap $TARGET -p445 --script smb-vuln-ms17-010 -oN scans/$NAME-nmap-scripts-smb-vuln-ms17-010

# output
NSTR

# check if vulnerable to SambaCry
sudo nmap $TARGET -p445 --script smb-vuln-cve-2017-7494 --script-args smb-vuln-cve-2017-7494.check-version -oN scans/$NAME-nmap-smb-vuln-cve-2017-7494

# output
NSTR

SQL

mysql -u $USER -h $TARGET

# output
NSTR

RDP

sudo nmap $TARGET -p3389 --script rdp-ntlm-info -oN scans/$NAME-nmap-script-rdp-ntlm-info

# output
NSTR

rdesktop -u administrator $TARGET

OS

Nmap OS Discovery Scan

sudo nmap $TARGET -O -oN scans/$NAME-nmap-os

# output
NSTR

Nmap OS Discovery Scan via SMB

sudo nmap $TARGET -p445 --script smb-os-discovery -oN scans/$NAME-nmap-os-smb

# output
NSTR

Exploit

Password Guessing

Default Credentials

# CMS Web App 9000
# admin:admin

Hydra

hydra -l root -P /usr/share/wordlists/rockyou.txt $TARGET http-post-form "/phpmyadmin/index.php?:pma_username=^USER^&pma_password=^PASS^:Cannot|without"

# output
NSTR

CVE-2021-1234

EDB-ID-56789

searchsploit foo
mkdir edb-id-56789
cd edb-id-56789
searchsploit -x 56789

cyberphor POC

git clone https://github.com/cyberphor/cve-2021-1234-poc.git
cd cve-2021-56789-poc

Metasploit

msfconsole
search ???
use exploit/???/???
set LHOST tun0
set RHOST $TARGET
run

Explore

NSTR

Escalate

NSTR

Lessons Learned

• Birds are not real.