Shuciran Pentesting Notes

Uploading files using TFTP (older Windows Systems)

During a penetration test, we can use TFTP to transfer files from older Windows operating systems up to Windows XP and 2003. This is a terrific tool for non-interactive file transfer, but it is not...

09/11/2022 03 File Transfer, Uploading files using TFTP (older Windows Systems)

Downloads with exe2hex and Powershell

This technique is useful to compress the binary we want to transfer, convert it to a hex string, and embed it into a Windows script. On the Windows machine, we will paste this script into our shel...

09/11/2022 03 File Transfer, Downloads with exe2hex and Powershell

Deserialization Attack

Ysoserial.NET ysoserial.NET this tool only works for Windows, after download it we need to identify the format of the binary or program running the code (-g) and the format (-f) that has the deseri...

06/11/2022 06 Exploitation, Deserialization Attack

Cross-Compiling Exploit Code

mingw-w64 In order to avoid compilation issues, it is generally recommended to use native compilers for the specific operating system targeted by the code; however, this may not always be an option...

06/11/2022 06 Exploitation, Cross-Compiling Exploit Code

Buffer Overflow (Linux)

First we need to disable ASLR on Kali for testing: echo 0 | sudo tee /proc/sys/kernel/randomize_va_space Setting up the EDB debugger First thing, it runs with the following command: root@debian:~...

05/11/2022 06 Exploitation, Buffer Overflow (Linux)

Buffer Overflow (Windows)

Setting up the Immunity Debugger First open it as administrator, then attach the process on “File” menu and then select the service and don’t forget to click on “Play”: Install mona.py Download ...

14/10/2022 06 Exploitation, Buffer Overflow (Windows)

Networking (Linux)

PSPY Pspy github download Monitoring Services running ./pspy64 Examples: Epsilon IP Address ifconfig -a ip address show ip a s DNS cat /etc/resolv.conf Network connections netstat -tulnpa ss ...

12/10/2022 01 Enumeration, Linux

RDP (tcp-3389)

NMAP Multiple Vulns nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 10.11.1.7 Brute Force Hydra hydra -l pedro -P /usr/share/wordlists/rockyou.txt 10.11.1.7 rdp ...

17/09/2022 01 Enumeration, RDP (tcp-3389)

SNMP (udp-161)

SNMPWALK Enumerate the entire public community using SNMPv2, -t 10 to increase the timeout period to 10 seconds: snmpwalk -v 2c -c Public -t 10 10.10.11.107 snmpcheck 10.10.202.78 -c Public Exampl...

09/09/2022 01 Enumeration, SNMP (udp-161)

PHPMyAdmin Brute Force via Burpsuite Intruder

Burp Suite Intruder Since the default credentials didn’t seem to work and blank passwords aren’t allowed, let’s try to automate some basic username and password combinations with Burp Suite’s Intr...

05/09/2022 06 Exploitation, PHPMyAdmin Brute Force via Burpsuite Intruder