1
Q
what is information gathering ?
A
Information Gathering is the first step of any penetration test and involves gathering or collecting information about an individual, company, website or system that you are targeting
2
Q
what are the two types of information gathering ?
A
Passive and Active
3
Q
what is passive information gathering ?
A
involves gathering as much information as possible without actively engaging with the target
4
Q
what is active information gathering ?
A
Active information gathering - involves gathering as much information as possible by actively engaging with the target system
5
Q
what are some of the activities associated with passive information gathering ?
A
- Identifying IP addresses & DNS information
- Identifying domain name and domain ownership information
- Identifying email addresses and social media profiles
- Identifying web technologies being used on target sites
- Identifying subdomains
6
Q
what are some of the activities associated with active information gathering ?
A
- Discovering open ports on target systems
- Learning about the internal infrastructure of a target network/organization
- Enumerating information from target systems
7
Q
What information should we be looking for when profiling websites
A
- IP addresses
- Directories hidden from search engines
- Names
- Email Addresses
- Phone numbers
- Physical Addresses
- Web technologies being used
8
Q
what commands can we use to find the IP address of a website ?
A
host
nslookup
9
Q
what are some common directories to check when enumerating a website ?
A
/robots.txt
/sitemap.xml
10
Q
what is the WHOIS database ?
A
Whois is a query and response protocol that is widely used for querying databases that store the registered users or assignees of an internet resource, such as a domain name, an IP address block or autonomous system
11
Q
what are three tools we can use for dns enumeration ?
A
dnsrecon
dig
dnsdumpster.com
12
Q
what is a waf ?
A
a waf is a web application firewall ?
13
Q
what is a tool we can use for enumerating subdomains ?
A
sublist3r
14
Q
what is DNS in simple terms ?
A
- DNS is a protocol that is used to resolve domain names/hostnames to IP addresses
- During the early days of the internet users would have to remember the IP addresses of the sites they wanted to visit, DNS resolves this issue by mapping domain names to their respective ip addresses
15
Q
what is a DNS name-server ?
A
A DNS server or nameserver is like a telephone directory that contains domain names and there corresponding IP addresses
16
Q
what is an A record used for with DNS ?
A
A - resolves a hostname or domain to an IPv4 address
17
Q
what is a AAAA record used for with DNS ?
A
AAAA - resolves a hostname or domain to an IPv6 address
18
Q
what is a NS record used for with DNS
A
NS - reference to the domains nameserver
19
Q
what is a MX record used for with DNS?
A
MX - resolves a domain to a mail server
20
Q
what is a SOA record used for with DNS ?
A
Domain Authority
21
Q
what is a SRV record used for with DNS ?
A
Service records
22
Q
what is a PTR record used for with DNS?
A
PTR - resolves an ip address to a hostname
23
Q
what is the purpose of DNS interrogation ?
A
- DNS interrogation is the process of enumerating DNS records for a specific domain
- The objective of DNS interrogation is to probe a DNS server to provide us with DNS records for a specific domain
- This process can provide with important information like the IP address of a domain, subdomains, mail server addresses
24
Q
why is a DNS zone transfer useful for attackers ?
A
- In certain cases DNS server admins may want to copy or transfer zone files from one DNS server to another. This process is known as a zone transfer
- If misconfigured and left unsecure this functionality can be abused by attackers to copy the zone file from the primary DNS server to another DNS server
- A DNS zone transfer can provide penetration testers with a holistic view of an organizations network layout
Furthermore in certain cases internal network addresses may be found on an organizations DNS servers
25
where is the hosts file for linux stored ?
/etc/hosts
26
what tools can we use to perform a zone transfer ?
dnsenum
27
what nmap flag can we use to ping sweep a network
-sn
28
what nmap flag can we use to scan the top 100 ports ?
-F
29
how do we run nmap scripts against a target ?
-sC
30
what option can we use to do OS detection, service detection and default script scans with nmap ?
-A
31
how do we speed up or slow down a scan with NMAP
-T0 is the slowest all the way up to -T5 which is the fastest
32
what option can we use to output scans to a text file with nmap ?
-oN test.txt
33
what port is smb ?
port 445
34
what is netbios and what port does it run on ?
Netbios sets up the session for smb and runs on port 139
35
what version of smb does the wannacry exploit take advantage of ?
smbv1
36
what nmap script can we use to see the security mode smb is using ?
--script smb=security.mode
37
what nmap script will enumerate smb sessions ?
--script smb-enum-shares
38
what is IPC$ with SMB?
With smb IPC$ is a null session
39
what else is the SMB protocol used for ?
Smb is also used to share printer information
40
what nmap script can we use to enumerate smb users ?
--script smb-enum-users
41
what nmap script can we use to enum smb groups?
--script smb-enum-groups
42
what nmap script can we use to enumerate smb services ?
--script smb-enum-services
43
what tool can we use to authenticate to smb with a null session ?
smbmap
44
what is the smb of linux called ?
samba
45
what port does FTP run on and what do we always want to check ?
FTP runs on port 21 and we want to check if anonymous access is allowed
46
what file type does Microsoft IIS use ?
.aspx
47
what port does mysql run on ?
port 3306
48
what is the NIST definition for a vulnerability ?
a weakness in the computational logic found in software and hardware components that when exploited results in a negative impact to confidentiality, integrity, or availability
49
where are the two places vulnerabilities are commonly found ?
- software
-operating system
50
what is the US Governments repository of vulnerabilities called ?
NIST which stands for National Vulnerability Database
51
what is the difference between TLS and SSL ?
TLS encrypts data in transmission open SSL allows for that encryption
52
what can we use to scan for heartbleed ?
--script ssl-heartbleed
53
explain heartbleed in a nutshell
this vulnerability would leak to much information in the packets when it was exploited
54
explain eternal blue in a nutshell
Part of the wannacry Ransome attack, this was a 0 day exploit that took advantage of SMB version 1 and was a buffer overflow
55
what version of smb is vulnerable to eternal blue ?
smbv1
56
what was log4j used for ?
Applications used log4j for logging, this was a java library
57
what data are we protecting with IT security ?
- Personally Identifiable Information
- Healthcare Information
- Financial Data
- Intellectual Property
- Business Secrets
Business Operations
58
who are we securing against ?
- Criminals
- Competitors
- Insider threats
Malicious Actors
59
what are some of the common regulations
- PCI DSS
- HIPAA
- GDPR
- CPPA
SOX
60
what is PCI DSS?
- Mandated by card brands
- Administered by the Payment Industry Security Standards Council
- Created to increase controls around cardholder data to reduce credit card fraud
61
what is HIPPA?
- US regulations for the use and disclosure of PHI
- The final rule on security standards was issued February 20, 2003
- Standards and Specifications
○ Administrative Safeguards
○ Physical Safeguards
- Technical Safeguards
62
what is GDPR?
- Data protection and privacy law in the EU
- Controllers and processors of personal data must put in place appropriate technical and organization measures to implement the data protection principles
63
what is the CPPA or California Consumer Privacy Act ?
- Intended to enhance privacy rights and consumer protection for residents of California
- Companies that become victims of data theft or other data security breaches can be ordered in civil class action lawsuits to pay statutory damages
64
what is SOX?
- Us federal law mandates certain practices in financial record keeping and reporting for corporations
- Requires strong internal control processes
65
what are some of the common cybersecurity frameworks ?
- ISO/IEC 27000
- COBIT
- NIST
- CIS
- CMMC
- ASD
66
explain ISO 27000
- Deliberately broad in scope
- Covering more than just privacy, confidentiality and IT Technical cybersecurity issues
- Applicable to organizations of all shapes and sizes
27001 is the guidelines
67
what is COBIT?
- Control objectives for information and related technologies
- Created by ISACA for information technology management and IT governance
- Business focused and defines a set of generic processes for the management of IT
68
explain and highlight NIST
- Catalog of security and privacy controls for all US federal information systems except those related to national security
- Agencies are expected to be compliant with NIST security standards and guidelines
- NIST provides a set of baseline security control and privacy controls for information systems and organizations
69
what are the CIS benchmarks ?
- Center for internet security
- Set of 18 prioritized safeguards to mitigate the most prevalent cyber attacks
- A defense in depth model to help prevent and detect malware
Offers a free hosted software product called the CIS controls Self-Assessment tool
70
what is the CMMC?
- A training certification and third party assessment program of cybersecurity in the united stated government defense industrial base
- Requires a third party assessor to verify the cybersecurity maturation level
- There is 5 levels
Anyone working with the DOD
71
what are the different types of windows vulnerabilities ?
- Information disclosure - vulnerability that allows an attacker to access confidential information
- Buffer overflows - caused by a programming error, allows attackers to write data to a buffer and overrun the allocated buffer, consequently writing data to allocated memory addresses
- Remote Code Execution - vulnerability that allows an attacker to elevate their privileges after initial compromise
- Denial of Service DOS - vulnerability that allows an attacker to consume a system/host resources consequently preventing the systems from functioning normally
72
what are the basics of Microsoft IIS?
Microsoft IIS / TCP ports 80-443 / proprietary web server software developed by Microsoft that runs on Windows
73
what are the basics of Webdav ?
WebDav / TCP ports 80-443 / HTTP extension that allows clients to update, delete, move and copy files on a web server, WebDav is used to enable a web server to act as a file server
74
what are the basics of SMB/CIFS ?
SMB-CIFS / TCP port 445 / Network File sharing protocol that is used to facilitate the sharing of files and peripherals between computers on a local network
75
what are the basics of RDP?
RDP / TCP port 3389 / proprietary GUI remote access protocol developed by Microsoft and is used to remotely authenticate and interact with a windows system
76
explain the basics of Winrm?
WinRM / TCP ports 5986-443 / windows remote management protocol that can be used to facilitate remote access with windows systems
77
Microsoft IIS explained in depth
- IIS internet information services is a proprietary extensible web server software developed by Microsoft for use with the Windows NT Family
- It can be used to host websites/web apps and provides administrators with a robust GUI for managing websites
- IIS can be used to host bother static and dynamic web pages developed in ASP.NET and PHP
- Typically configured to run on ports 80/443
- Supported executable file extensions
- Asp
- Aspx
- Config
- Php
78
webdav explained in depth ?
- Is a set of extensions to the HTTP protocol which allows uses to collaboratively edit and manage files on remote web servers
- Webdav essentially enables a web server to function as a file server for collaborative authoring
- Webdav runs on top of Microsoft IIS on ports 80/443
- In order to connect to a webdav server you will need to provide legitimate credentials, this is because WebDav implements authentication in the form of username and password
79
what are some of the characteristics of webdav exploitation ?
- The first step of the exploitation process will involve identifying weather webdav has been configured to run on the IIS webserver
- We can perform a brute-force attack on the WebDav server in order to identify legitimate credentials that we can use for authentication
- After obtaining legitimate credentials we can authenticate with the WebDav server and upload a malicious asp payload that can be used to execute arbitrary commands or obtain a reverse shell on the target
80
what are some of the tools we can use to test webdav ?
- Davtest, used to scan, authenticate and exploit a WebDav server
Cadaver - cadaver supports file upload, download, and on screen display, in place editing, namespace operations, collection creation, deletion and resource locking
81
what is an overview of SMB
- Server message block is a network file sharing protocol that is used to facilitate the sharing of files and peripherals printers between computers on a local network
- Smb uses port 445 TCP however originally SMB ran on top of NetBIOS using port 139
SAMBA is the open source linux implementation of SMB and allows Windows systems to access linux shares and devices
82
explain smb authentication ?
- The smb protocol utilizes two levels of authentication namely:
○ User auth
○ Share authentication
User authentication - users must provide a username and password in order to authenticate with the SMB server in order to access a share
Share authentication - users must provide a password in order to access a restricted share
83
what is an overview of PsExec ?
- Psexec is a lightweight telnet replacement developed by Microsoft that allows you execute processes on remote windows systems using any users credentials
- Psexec authentication is performed via smb
- We can use PsExec utility to authenticate with the target system legitimately and run arbitrary commands or launch a remote command prompt
It is very similar to RDP however instead of controlling the remote system via GUI commands are sent via CMD
84
how do we exploit smb with psexec ?
- In order to utilize Psexec to gain access to a windows target we will need to identify legitimate user accounts and their respective passwords or password hashes
- This can be done by leveraging various tools and techniques however the most common technique will involve performing an smb login brute force attack
- We can narrow our attack down to only include usernames like administrator
Then we can authenticate with Psexec or get a reverse shell
85
what is a high level overview of eternal blue ?
- is the name given to a collection of windows vulns and exploits that allow attackers to remotely execute arbitrary code and gain access to a windows system and consequently the network that the target system is a part of
- Developed by the NSA leaded to the public in 2017 by the shadow brokers
Takes advantage of a vulnerability in the windows SMBv1 protocol that allows attackers to send specially crafted packets that cause the execution of arbitrary commands
86
explain an overview of RDP ?
- The RDP protocol is a proprietary GUI remote access protocol developed by Microsoft and is used to remotely connect and interact with a windows system
- RDP uses TCP port 3389 by default and cam also be configured to run on any other TCP port
- RDP authentication requires a user account on the target system as well as a password
We can perform an RDP Brute force attack to identify legitimate user accounts
87
what was the blue keep exploit ?
- RDP vuln in windows that could potentially allow attackers to remotely execute arbitrary code and gain access to a windows system and consequently the network that the target system is a part of
- Made public in may 2019
-Takes advantage of a vuln in windows RDP protocol that allows attackers to gain access to a chunk of kernel memory consequently allowing them to remotely execute arbitrary code at the system level without authentication
88
what is an overview of WinRM?
- Windows remote management protocol that can be used to facilitate remote access with windows systems over HTTPS
- Microsoft implemented WinRm to windows in order to make life easier on system admins
- WinRm is typically used in the following ways
○ Remotely access and interact with windows hosts on a local network
○ Remotely access and execute commands on windows systems
○ Manage and configure windows systems remotely
WinRM typically uses TCP port 5985 and 5986
89
how could one possibly exploit WinRM?
- WinRM implements access control and security for communication between systems through various forms of authentication
- We can utilize a utility called crackmapexec to perform a brute force on WinRm in order to identify users and their passwords as well as execute commands on the target system
We can also utilize a Ruby script called evil-winrm to obtain a command shell session on the target system
90
we can bruteforce winrm with crackmapexec
Crackmapexec winrm -u administrator -p
91
what is privilege escalation ?
- Privilege escalation is the process of exploiting vulnerabilities or misconfigurations in systems to elevate privileges from one user to another, typically to a user with admin or root access on a system
- Privilege escalation is a vital element of the attack life cycle and is a major determinant in the overall success of a pen test
- After gaining an initial foothold on a target system you will be required to elevate your privileges in order to perform tasks and functionality that require admin privs
The importance of priv esc in the pentest process cannot be overstated or overlooked. Developing your priv esc skills will mark you out as a good pentester
92
explain the windows kernel ?
A kernel is a computer program that is the core of an operating system and has complete control over every resource and hardware on a system it acts as a translation layer between hardware and software and facilitates the communications between these two layers
93
explain what windows NT is ?
- Windows NT is the kernel that comes packaged with all versions of Microsoft windows and operates as a traditional kernel with a few exceptions based on user design philosophy. It consists of two main modes of operation that determine access to system resources and hardware
- User mode - programs and services running in user mode have limited access to system resources and functionality
- Kernel mode - kernel mode has un-restricted access to system resources and functionality with the added functionality of managing devices and system memory
94
how do windows kernel vulnerabilities work ?
Kernel exploits on windows will typically target vulnerabilities in the windows kernel to execute arbitrary code in order to run privileged system commands or to obtain a system shell
95
what is the typical methodology for windows privilege escalation ?
- identifying kernel exploits
- downloading, compiling, and transferring kernel exploits onto the target system
96
what tool can discover windows kernel vulnerabilities ?
Windows exploit suggester a python script is good at getting the OS level and finding corresponding vulnerabilities
97
what is UAC ?
User account control is a windows security feature introduced in windows vista that is used to prevent unauthorized changes from being made to the operating system
98
what is the point of UAC?
UAC is used to ensure that changes to the operating system require approval from the administrator or a user account that is part of the local administrators group
99
what will be the difference between an admin and a non-admin when the UAC prompt comes up ?
A non-privileged user attempting to execute a program with the UAC credential prompt whereas a privileged user will be prompted with a consent prompt
100
what is necessary for us to bypass UAC?
In order to successfully bypass UAC we will need to have access to a user account that us part of the local admin group on the windows target system
101
Does UAC have different levels ?
UAC has various integrity levels ranging from low to high if the UAC protection level is set below high windows programs can be executed with elevated privileges without prompting the user for confirmation
102
what is a common tool to bypass UAC?
UACme
103
what is an overview of windows tokens ?
Windows access tokens are a core element of the authentication process on windows and are created and managed by the Local Security Authority Subsystem Service LSASS
104
what is a windows access token responsible for ?
A Windows Access token is responsible for identifying and describing the security context of a process or thread running on a system. Simply put an access token can be thought of as a temporary key akin to a web cookie that provides users with access to a system or network resource without having to provide credentials each time a process is started or a system resource is accessed
105
how are access tokens used with windows authentication ?
Access tokens are generated by the winlogon.exe process every time a user authenticates successfully and includes the identity and privileges of the user account associated with the thread or process. This token is then attached to the userinit.exe process after which all child processes started by the user will inherit a copy of the access token from their creator and will run under privileges of the same token
106
what are impersonate level tokens ?
Impersonate level tokens are created as a direct result of a non interactive login on windows typically through specific system services or domain logons
Impersonate level tokens can be used to impersonate a token on the local subsystem and not on any external systems that utilize the tokens
107
what are delegate tokens ?
Delegate level tokens are typically created through an interactive login on windows, primarily through a traditional login or through remote access protocols such as RDP
Delegate level tokens pose the largest threat as they can be used to impersonate tokens on any system
108
how do windows token impersonation attacks happen ?
The process of impersonating access tokens to elevate privileges on a system will primarily depend on the privileges assigned to the account that has been exploited to gain initial access as well as the impersonation or delegation tokens available
109
what are the privileges required for a successful impersonation attack ?
SeAssignPrimaryToken: this allows a user to impersonate tokens
SeCreateToken: this allows a user to create an arbitrary token with admin privileges
SeImpersonatePrivilege: This allows a user to create a process under the security context of another user typically with admin privs
110
what is the incognito module ?
Incognito is a built in meterpreter module that was originally a standalone application that allows you to impersonate user tokens after successful exploitation
We can use the incognito module to display a list of available tokens that we can impersonate
111
what is ADS or alternate data streams?
ADS is an NTFS New Technology File System file attribute and was designed to provide compatibility with the MACOS HFS hierarchical file system
112
what are the two different forks or streams associated with a file created on an NTFS formatted drive ?
- Any file created on an NTFS formatted drive will have two different forks/streams
Data stream - default stream that contains the data of the file
Resource stream - typically contains the metadata of the file
113
how can attackers abuse ADS?
Attackers can use ADS to hide malicious code or executables in legitimate files in order to evade detection
This can be done by storing the malicious code or executable in the file attribute resource stream of a legitimate file
This technique is usually used to evade basic signature based AV's and static scanning tools
114
where are windows password hashes stored ?
The windows OS stores hashed user account passwords locally in the SAM database
115
what is the process of hashing ?
Hashing is the process of converting a piece of data into another value. A hashing function or algorithm is used to generate the new value. The result of the hashing algorithm is known as a hash or hash value
116
what does the LSA do in a windows system ?
Authentication and verification of user credentials is facilitated by the local security authority or LSA
117
what did windows versions up to server 2003 utilize
LM and NTLM hashing
118
What password hashes do most windows systems use ?
Windows disables LM hashing and utilizes NTLM hashing from windows vista onwards
119
what is the SAM database in windows and some key features ?
SAM security account manager is a database file that is responsible for managing user accounts and passwords on Windows. All user account passwords stored in the SAM database are hatched
The SAM database file cannot be copied while the operating system is running
The Windows NT Kernel keeps the SAM database file locked and as a result attackers typically utilize in memory techniques and tools to dump SAM hashes from the LSASS process
In modern versions of windows the SAM database is encrypted with a syske
120
what is required to access and interact with the LSASS process ?
Elevated or Admin privileges ?
121
what are some overview and features of the LM hashes ?
LM is the default hashing algorithm that was implemented in Windows operating system prior to NT 4.0
The protocol is used to hash passwords and the hashing process can be broken down into the following steps
○ The password is broken down into seven character chunks
○ All characters are then converted into uppercase
○ Each chunk is then hashed separately with the DES algorithm
LM hashing is generally considered to be a weak protocol and can easily be cracked, primarily because the password hash does not include salts consequently making brute force and rainbow table attacks effective against LM hashes
122
what are the overview and features of an NTLM hash ?
- NTLM is a collection of authentication protocols that are utilized in windows to facilitate authentication between computers. The authentication process involves using a valid username and password to authenticate successfully
- From windows vista onwards windows disables LM hashing and utilizes NTLM hashing
- When a user account is created it is encrypted using the MD$ hashing algorithm while the original password is disposed of
NTLM improves upon LM in the following ways
123
What hashing algorithm is used to has NTLM passwords ?
MD4
124
why are windows configuration files juicy to attackers ?
Windows can automate a variety of repetitive tasks such as the mass rollout or installation of Windows on many systems
This is typically done through the use of the Unattended windows setup utility which is used to automate the mass installation/deployment of windows on systems
This tool utilizes configuration files that contain specific configurations and user account credentials specifically the administrator password
If the unattended windows setup configuration files are left on the target system after installation they can reveal user account credentials that can be used by attackers to authenticate with the windows target legitimately
125
where are the configuration files stored for the windows setup utility ?
- C:\Windows\Panther\Unattended.xml
C:\Windows\Panther\Autounattend.xml
As a security precaution the passwords stored in the unattended Windows setup configuration file may be encoded in base64
126
how do we check privileges aassociated with a windows account from the command line ?
Whoami /priv
127
what is the mimikatz tool ?
Mimikatz is a windows post exploitation tool. It allows for the extraction of clear text passwords hashes and kerberos ticket from memory
128
what is the SAM database ?
The SAM database is a database file on windows systems that stores hashed user password
129
what are the different ways we can use mimikatz ?
Mimkatz can be used to extract password hashes from the lsass.exe process memory where hashes are cached
We can utilize the pre compiled mimikatz executable if we have access to a meterpreter sessions on a windows target we can utilize the inbuilt meterpreter extension kiwi
Mimikatz will require elevated privileges in order to run correctly
130
what is a pass the hash attack ?
Pass the hash is an exploitation technique that involves capturing or harvesting NTLM hashes or clear text password and utilizing them to authenticate with the target legitimately
131
what tools can we use for a pass the hash attack ?
Metasploit PsExec module
Crackmpaexec
132
what is a high level overview of the shellshock vulnerability ?
- Shellshock is the name given to a family of vulnerabilities in the bash shell that allow an attacker to execute remote arbitrary commands via bash, consequently allowing the attacker to obtain remote access to the target system via a reverse shell
- The shellshock vulnerability is cause by a vulnerability in Bash where bash mistakenly executes trailing commands after a series of characters
- In the context of remote exploitation apache web servers configured to run CGI scripts or .sh scripts are also vulnerable to attack
- CGI common gateway interface scripts are used by apache to execute arbitrary commands on the linux system after which the output is displayed to the client
- In order to exploit this vulnerability you will need to locate an input vector or script that allows you to communicate with bash
- In the context of an apache web server we can utilize any legitimate CGI scripts accessible on the web server
- Whenever a CGI script is executed the web server will initiate a new process and run the CGI script with bash
133
whats a high level overviw of FTP ?
- FTP is a protocol that uses TCP port 21 and is used to facilitate file sharing between a server and client/clients
- It is also frequently used as a means of transferring files to and from the directory of a web server
- FTP authentication requires a username and password combination as a result we can perform a brute force attack on the FTP server in order to identify legitimate credentials
In some cases you can gain anonymous access to FTP servers
134
give a high level overview of SAMBA?
- SAMBA utilizes username and password authentication in order to obtain access to the server or a network share
- We can perform a brute force attack on the SAMBA server in order to obtain legitimate credentials
- After obtaining credentials we can use a utility called smbmap in order to enumerate samba share drives list the contents of the shares as well as download files and execute remote commands on the target
We can also utilize a tool called smbclient. It communicates with a LAN manager server, offering an interface similar to that of the FTP program. It can be used to download files from the server to the local machine, upload files from the local machine to the server as well as retrieve directory information from the server
135
what port is smb ?
- Smb is a network file sharing protocol that is used to facilitate the sharing of file and peripherals between computers on a local network
- Smb uses port 445 however originally smb ran on top of Netbios using port 139
- Samba is the linux implementation of SMB and allows Windows systems to access linux shares and devices
136
give an explanation of samba attacks ?
- SAMBA utilizes username and password authentication in order to obtain access to the server or a network share
- We can perform a brute force attack on the SAMBA server in order to obtain legitimate credentials
- After obtaining credentials we can use a utility called smbmap in order to enumerate samba share drives list the contents of the shares as well as download files and execute remote commands on the target
137
what is smbclient ?
We can also utilize a tool called smbclient. It communicates with a LAN manager server, offering an interface similar to that of the FTP program. It can be used to download files from the server to the local machine, upload files from the local machine to the server as well as retrieve directory information from the server
138
what is banner grabbing ?
Banner grabbing is an information gathering technique used by penetration testers to enumerate information regarding the target operating system as well as the services that are running on its open ports.
139
what is the goal with banner grabbing ?
The primary objective of banner grabbing is to identify the service running on a specific port as well as the service version
140
how can banner grabbing we performed ?
- Performing a service version detection scan with Nmap
- Connecting to the open port with netcat
- Authenticating with the service
141
what is a good nmap script for http enumeration ?
Nmap -sV --script=http-enum
142
what is the netcat tool ?
Netcat is a networking utility used to read and write data to network connections using TCP or UDP
143
what two kinds of communication modes does netcat utiliuze ?
- Client mode - netcat can be used in client mode to connect to any TCP/UDP port as well as a netcat listener (server)
-
Server mode - netcat can be used to listen for connections from clients to a specific port
144
what is a bind shell ?
A bind shell is a tpye of remote shell where the attacker connects directly to a listener on the target system, consequently allowing for execution of commands on the target system
145
what is a reverse shell ?
A reverse shell is a type of remote shell where the target connects directly to a listener on the attackers system, consequently allowing for execution of commands on the target system
146
what is the black box methodology ?
- host discovery
- port scanning and enumeration
- vulnerability detection/scanning
- exploitation
- manual
- automated
- Post Exploitation
- privilege escalation
- persistence
- dumping hashes
147
what coding language do IIS webservers use ?
asp and aspx
148
what are the 5 stages of a pentest?
Information gathering
enumeration
exploitation
post exploitation
reporting
149
what are some activities that go into the information gathering phase of a pentest ?
passive
-osint
active
- network mapping
- host discovery
- port scanning
- service detection and OS detection
150
what are some activities that fall under the enumeration phase of a pentest ?
- service and OS enumeration
- Service enumeration
- user enumeration
- share enumeration
151
what are some activities that full under the exploitation phase of a pentest ?
vulnerability analysis
vulnerability identification
developing and modifying exploits
service exploitation
152
what are some activities that fall under the post exploitation phase of a pentest ?
- local enumeration
- privilege escalation
- credential access
- persistence
- defense evasion
- lateral movement
153
what are some activities that fall under the report writing phase of a pentest?
- report writing
- recommendations
154
how do host communciate within networks
in computer networks hosts communicate with each other through the use of network protocols
155
what protocols reside on the session layer ?
API's, netbios, and RPC
156
what protocols reside on the presentation layer ?
ssl tls
JPEG
GIF
SSH
IMAP
157
what protocols reside on the application layer ?
HTTP
FTP
IRC
SSH
DNS
158
what is the network layer responsible for ?
The network layer of the osi model is responsible for logical addressing, routing, and forwarding data packets between devices across different networks
its primary goal is to determine the optimal path for data to travel from the source to the destination even is the devices are on separate networks
159
what do ICMP messages include ?
ICMP messages include ping echo requests and echo replies
160
what layer does IP operate at in the OSI model ?
IP enables communication between devices on different network by providing a standardized way to identify and locate hosts
161
what is fragmentation ?
- IP allows for the fragmentation of large packets into smaller fragments when traversing network with varying MTU sizes
- the receiving host reassembles these fragments to reconstruct the original packet
162
what are the three types of IP traffic ?
- one to one communication
- broadcast one to all communication
- Multicast one to many communication
163
what is the transport layer ?
the transport layer is the fourth layer of the OSI model and it plays a crucial role in facilitating communication between two devices across a network
this layer ensure reliable end to end communication, handling tasks such as error detection, flow control, and segmentation of data into smaller units
164
what is the transport layer responsible for ?
the transport layer is responsible for providing end to end communication and ensuring the reliable and ordered delivery of data between two devices on a network
165
what are the basics of TCP
- establishes a connection between the sender and receiver before any data is exchanged making sure it is reliable
- TCP guarantees reliable delivery of data it achieves this through mechanisms such as ack and retransmission of lost or corrupted packets
- TCP ensures that data is delivered in the correct order
166
what goes into network mapping when performing a pentest ?
Discovery of live hosts
identification of open ports and services
network topology mapping
OS fingerprinting and detection
service version detection
identifying filtering and security measures
167
what are two mays to do host discovery on a network?
ping sweeps - sending icmp echo requests to a range of IP addresses to identify live hosts
ARP scanning - using ARP requests to identify hosts on a local network ARP scanning is effective in discovering hosts within the same broadcast domain
168
what is a ping sweep?
ping sweep is a network scanning technique used to discover live hosts within a specific IP address range on a network
169
what is the basic idea of a ping sweep?
the basic idea is to send a series of ICMP echo requests messages to a range of IP address’s and observe the responses to determine which addresses are active or live
170
how do ping sweeps work ?
ping sweeps work by sending one or more specifically crafted ICMP packets
if the destination host replies with an ICMP echo reply then the host is alive
171
what tool can we use to help determine why a host is not responding to ping ?
Wireshark can be helpful in determining why a host is not responding to ping ?
172
what nmap flag can be used for a ping scan ?
-sn
173
what nmap option can we use to fragment packets?
-f
174
what are the different types of modules within metasploit
- Exploit
- Payload
- Encoder
- Nop
- Auxiliary
175
what is the exploit module used for in msf?
exploit - a module that is used to take advantage of a vulnerability and is typically paired with a payload
176
what is the payload module used for in msf?
Payload - code that is delivered by MSF and remotely executed on the target after exploitation.
177
what is the encoder module used for in msf ?
Encoder - used to encode payloads in order to avoid av detection
178
what is the NOPS module used for in msf?
NOPS - used to ensure that payloads sizzes are consistent and ensure the stability of the payload when executed
179
what are the auxiliary modules used for in msf?
Auxiliary - a module that is used to perform additional functionality like port scanning and enumeration
180
what is a non-staged payload ?
non staged payload - a payload that is sent to the target system as is along with the exploit
181
what is a staged payload ?
2. staged payload - a staged payload is sent to the target in two parts
1. the first part stager contains a payload that is used to establish a reverse connection back to the attacker download the second part of the payload then execute it
182
what are stagers as it relates to payloads?
Stagers - stagers are typically used to establish a stable communication channel between the attacker and the target after which a stage payload is download and executed on the target system
183
what is a stage as it relates to payloads ?
stage - payload components that are downloaded by the stager
184
what flag can be used with msfvenom to specify the architececture ?
-a
185
what flag can be used to specify an encoder with msfvenom ?
-e
186
what are the ways winRM is typically used ?
- remotely access and interact with windows hosts on a local network
- remotely access and execute commands on windows systems on the internet
- manage and configure windows systems remotely
187
what port does WinRM typically use ?
5989 and 5986
188
how do we scan a host on a different subnet from a compromised host in metasploit
to scan a host on a different subnet from a compromised host you have to add a metasploit route:
run autoroute -s
189
what is a client side attack ?
a client side attack is an attack vector that involves coercing a client to execute a malicious payload on their system that connects back to the attacker when executed
190
what do client side attacks typically utilize ?
client side attacks utilize various social engineering techniques like generating malicious documents or portable executbales
191
what is msfvenom ?
msfvenom - a command line utility that can be used to generate and encode MSF payloads for various OS’s as well as web servers
192
what are some of the ways we can exploit WinRm with MSF ?
- we can utilize msf to identify WinRM users and their passwords as well as execute commands on the target system
- we can also utilize a MSF winRM exploit module to obtain a meterpreter session on the target system
193
what are some charcateristics of apache tomcat ?
- apache tomcat is a free and open source java web server
- it is used to build and host dynamic websites and web applications based on the java software platform
- apache tomcat utilizes the HTTP protocol to facilitate the underlying communication between the server and the clients
- apache tomcat uses port 8080 by default
194
what is the difference between the standard Apache HTTP web server and the apache tomcat web server ?
the standard Apache HTTP web server is used to host static and dynamic websites or web applications typically developed in PHP
the apache tomcat web server is primarily used to host dynamic websites or web applications developed in Java
195
what are some charcateristics of the Meterpreter payload ?
- the meterpreter payload is an advanced multi-functional payload that operates via DLL injection and is executed in memory on the target system consequently making it difficult to detect
- it communicates over a stage socket and provides an attacker with an interactive command interpreter on the target system
- meterpreter also allows us to load custom scripts and plugins dynamically
196
msf commands: how do we gather general system information ?
sys info
197
msf commands: how do we figure out what user we are ?
getuid
198
msf commands: how do we background a session ?
background
199
msf commands: how do we download a file ?
download
200
msf commands: how do we unzip a file ?
unzip
201
how can we upgrade a session automatically with msf?
sessions -u
202
msf commands: how do we show what disks and drives are connected ?
show_mount
203
how do we figure out the user privieleges from a windows command line ?
getprivs
204
how do we verify if a user is part of the admins from the windows command line ?
net users
net localgroup admins
205
what is a windows access token responsible for ?
a windows access token is responsible for identifying and describing the security context of a process or thread running on a system.
206
what proccess on windows generates access tokens ?
access tokens are generated by the winlogon.exe process every time a user authenticates successfully and includes the identity and privileges of the user account associated with the thread or process
207
what is incognito in msf?
incognito is a built in meterpreter module that was originally a standalone application that allows you to impersonate user tokens after successful exploitation
We can use the incognito module to display a list of available tokens that we can impersonate
208
how do we load the incognito module in msf?
load incognito
209
how do we see what tokens our user has with msf?
list tokens -u
210
how do we impersonate a token with msf ?
impersonate_token "token"
211
what can we use psexec for ?
we can use the PsExec module to legitimately authenticate with the target system via SMB
212
when we are enumerating system information on a windows machine what are we looking for ?
- hostname
- os name
- os build and service pack
- os architecture x/64 x/86
- installed updates and hotfixes
213
what are we looking for when enumerating users and groups on a windows system?
- current user & privileges
- Additional user information
- other users on the system
- groups
- members of the built in admin group
214
how do we display the privileges we have from the windows command line ?
whoami /priv
215
how do we see all accounts on the system from the windows command line ?
see all the accounts on the system:
net users
216
what are we looking for when we are enumerating networking information on a windows host?
- current ip-address and network adapter
- internal networks
- TCP/UDP services running and their respective ports
- other hosts in the network
- routing table
- windows firewall state
217
what is a process in windows ?
a process is an instance of a running exe or program.
218
what is a service on windows ?
a service is a process which runs in the background and does not interact with the desktop
219
what facilitates authentication and verification of user credentials on a windows system?
authentication and verification of user credentials in a windows system is facilitated by the local security authority LSA
220
what is the sam database on windows responsible for ?
sam is a databse file that is responsible for managing user accounts and passwords in windows all user account passwords stored in the sam database are hashes
221
what process do attacker usually use to dump windows hashes ?
the Windows NT kernel keeps the SAM database file locked and as a result attackers typically utilize in memory techniques and tools to dump SAM hashes from the LSASS process
222
what is NTLM in windows ?
NTLM is a collection of authentication protocols that are utilized in Windows to facilitate authentication between computers the authentication process involves using a valid username and password to authenticate successfully
223
how does NTLM improve upon LM ?
- does not split the hash in two chunks
- case sensitive
- allows the use of symbols and unicode characters
224
what can we use to dump windows password hashes ?
- the inbuilt meterpreter hashdump command
- Mimikatz
225
what is pivoting ?
Pivoting is a post exploitation technique that involves utilizing a compromised host that is connected to multiple networks to gain access to systems within other networks
after gaining access to one host we can use the compromised host to exploit other hosts on a private internal network to which we could not access previously
in the context of pivoting we can forward a remote port on a previously inaccessible host to a local port on our kali linux system so that we can remotely interact/exploit the service running on the port
226
what is port forwarding ?
port forwarding is the process of redirecting traffic from a specific port on a target system to a specific port on our system
227
how do we add a route with msf ?
run autoroute -s
228
what do we need to do once we know a port is open on an internal system ?
once we know what port is open on the internal system we need to perform port forwarding to get a better idea of what is running
229
how do we show available filters in Wireshark ?
If we click the green ribbon we can view a list of available filters
230
how would we filter by IP address ?
ip.addr ==
231
How would we filter by source and destination IP address in wireshark ?
ip.src == and ip.dst ==
232
what technologies reside on the application layer of the OSI model ?
- end user layer
- HTTP
- FTP
- IRD
- SSH
- DNS
233
what technologies reside on the presentation layer of the OSI model?
- Syntax layer
- SSL
- SSH
- IMAP
- FTP
- MPEG
- JPEG
234
what technologies reside on the session layer of the OSI model
- Synch and send to port
- API’s
- sockets
- WinSock
235
what technologies reside on the transport layer of the OSI model?
- end to end communications
- TCP
- UDP
236
what technologies reside on the network layer of the OSI model ?
- Packets
- IP
- ICMP
- IPSEC
- IGMP
237
what technologies reside on the data link layer of the OSI model?
- Frames
- Ethernet
- PPP
- Switch
- Bridge
238
what technologies reside on the physical layer of the OSI model?
- Physical structure
- topology
- coax
- fiber
- wireless
- hubs
- repeaters
239
what is ARP?
ARP or Address Resolution protocol is a layer 2 protocol that is used to connect IP address’s with MAC address’s
240
what is XSS?
xss is classified as an injection attack where malicious Javascript gets injected into a web application with the intention of being executed by other users
241
