OSCP pdf

【实例截图】

【核心代码】

Table of Contents
1 Penetration Testing with Kali Linux: General Course Information ............................................... 23
1.1 About The PWK Course.............................................................................................................. 23
1.1.1 PWK Course Materials ........................................................................................................... 23
1.1.2 Access to the Internal VPN Lab Network ........................................................................... 23
1.1.3 The Offensive Security Student Forum............................................................................... 24
1.1.4 Live Support ............................................................................................................................. 24
1.1.5 OSCP Exam Attempt .............................................................................................................. 24
1.2 Overall Strategies for Approaching the Course ..................................................................... 25
1.2.1 Welcome and Course Information Emails ......................................................................... 25
1.2.2 Course Materials ..................................................................................................................... 25
1.2.3 Course Exercises..................................................................................................................... 25
1.2.4 PWK Labs ................................................................................................................................. 26
1.3 Obtaining Support........................................................................................................................ 26
1.4 About Penetration Testing ......................................................................................................... 26
1.5 Legal............................................................................................................................................... 27
1.6 The MegaCorpone.com and Sandbox.local Domains.......................................................... 28
1.7 About the PWK VPN Labs .......................................................................................................... 28
1.7.1 Lab Warning ............................................................................................................................. 30
1.7.2 Control Panel ........................................................................................................................... 30
1.7.3 Reverts ...................................................................................................................................... 30
1.7.4 Client Machines....................................................................................................................... 30
1.7.5 Kali Virtual Machine................................................................................................................ 31
1.7.6 Lab Behavior and Lab Restrictions ...................................................................................... 31
1.8 Reporting....................................................................................................................................... 32
1.8.1 Consider the Objective ........................................................................................................... 32
1.8.2 Consider the Audience ........................................................................................................... 32
1.8.3 Consider What to Include ...................................................................................................... 33
1.8.4 Consider the Presentation..................................................................................................... 34
1.8.5 The PWK Report ...................................................................................................................... 34
1.8.6 Taking Notes............................................................................................................................ 35
1.8.6.1 Setup & Tips.................................................................................................................... 35
1.8.6.2 Note Taking Tools ......................................................................................................... 35
1.8.6.3 Backups ........................................................................................................................... 36
1.9 About the OSCP Exam ................................................................................................................ 36
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 4
1.9.1 Metasploit Usage - Lab vs Exam.......................................................................................... 37
1.10 Wrapping Up ................................................................................................................................. 37
2 Getting Comfortable with Kali Linux .................................................................................................. 38
2.1 Booting Up Kali Linux.................................................................................................................. 38
2.2 The Kali Menu............................................................................................................................... 39
2.3 Kali Documentation..................................................................................................................... 40
2.3.1 The Kali Linux Official Documentation ............................................................................... 41
2.3.2 The Kali Linux Support Forum .............................................................................................. 41
2.3.3 The Kali Linux Tools Site ....................................................................................................... 41
2.3.4 The Kali Linux Bug Tracker ................................................................................................... 41
2.3.5 The Kali Training Site ............................................................................................................. 41
2.3.6 Exercises................................................................................................................................... 41
2.4 Finding Your Way Around Kali .................................................................................................. 42
2.4.1 The Linux Filesystem ............................................................................................................. 42
2.4.2 Basic Linux Commands......................................................................................................... 42
2.4.2.1 Man Pages ...................................................................................................................... 42
2.4.2.2 apropos............................................................................................................................ 44
2.4.2.3 Listing Files ..................................................................................................................... 45
2.4.2.4 Moving Around ............................................................................................................... 45
2.4.2.5 Creating Directories....................................................................................................... 45
2.4.3 Finding Files in Kali Linux ...................................................................................................... 46
2.4.3.1 which ................................................................................................................................ 46
2.4.3.2 locate................................................................................................................................ 47
2.4.3.3 find .................................................................................................................................... 47
2.4.3.4 Exercises ......................................................................................................................... 47
2.5 Managing Kali Linux Services ................................................................................................... 48
2.5.1 SSH Service.............................................................................................................................. 48
2.5.2 HTTP Service ........................................................................................................................... 48
2.5.3 Exercises................................................................................................................................... 49
2.6 Searching, Installing, and Removing Tools............................................................................. 50
2.6.1 apt update ................................................................................................................................ 50
2.6.2 apt upgrade .............................................................................................................................. 50
2.6.3 apt-cache search and apt show ........................................................................................... 51
2.6.4 apt install .................................................................................................................................. 52
2.6.5 apt remove --purge ................................................................................................................. 52
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 5
2.6.6 dpkg ........................................................................................................................................... 53
2.6.6.1 Exercises ......................................................................................................................... 53
2.7 Wrapping Up ................................................................................................................................. 53
3 Command Line Fun............................................................................................................................... 54
3.1 The Bash Environment ............................................................................................................... 54
3.1.1 Environment Variables ........................................................................................................... 54
3.1.2 Tab Completion ....................................................................................................................... 56
3.1.3 Bash History Tricks................................................................................................................. 56
3.1.3.1 Exercises ......................................................................................................................... 58
3.2 Piping and Redirection................................................................................................................ 58
3.2.1 Redirecting to a New File....................................................................................................... 58
3.2.2 Redirecting to an Existing File .............................................................................................. 59
3.2.3 Redirecting from a File........................................................................................................... 59
3.2.4 Redirecting STDERR ............................................................................................................... 59
3.2.5 Piping......................................................................................................................................... 60
3.2.5.1 Exercises ......................................................................................................................... 60
3.3 Text Searching and Manipulation............................................................................................. 60
3.3.1 grep............................................................................................................................................ 60
3.3.2 sed ............................................................................................................................................. 61
3.3.3 cut .............................................................................................................................................. 61
3.3.4 awk............................................................................................................................................. 62
3.3.5 Practical Example ................................................................................................................... 62
3.3.5.1 Exercises ......................................................................................................................... 64
3.4 Editing Files from the Command Line ..................................................................................... 64
3.4.1 nano........................................................................................................................................... 64
3.4.2 vi ................................................................................................................................................. 65
3.5 Comparing Files........................................................................................................................... 66
3.5.1 comm ........................................................................................................................................ 66
3.5.2 diff .............................................................................................................................................. 67
3.5.3 vimdiff ....................................................................................................................................... 68
3.5.3.1 Exercises ......................................................................................................................... 69
3.6 Managing Processes .................................................................................................................. 69
3.6.1 Backgrounding Processes (bg) ............................................................................................ 70
3.6.2 Jobs Control: jobs and fg ...................................................................................................... 70
3.6.3 Process Control: ps and kill................................................................................................... 71
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 6
3.6.3.1 Exercises ......................................................................................................................... 73
3.7 File and Command Monitoring ................................................................................................. 73
3.7.1 tail............................................................................................................................................... 73
3.7.2 watch......................................................................................................................................... 74
3.7.2.1 Exercises ......................................................................................................................... 74
3.8 Downloading Files ....................................................................................................................... 74
3.8.1 wget ........................................................................................................................................... 74
3.8.2 curl ............................................................................................................................................. 75
3.8.3 axel............................................................................................................................................. 75
3.8.3.1 Exercise............................................................................................................................ 76
3.9 Customizing the Bash Environment ........................................................................................ 76
3.9.1 Bash History Customization ................................................................................................. 76
3.9.2 Alias ........................................................................................................................................... 77
3.9.3 Persistent Bash Customization............................................................................................ 78
3.9.3.1 Exercises ......................................................................................................................... 78
3.10 Wrapping Up ................................................................................................................................. 79
4 Practical Tools ....................................................................................................................................... 80
4.1 Netcat ............................................................................................................................................ 80
4.1.1 Connecting to a TCP/UDP Port ............................................................................................ 80
4.1.2 Listening on a TCP/UDP Port ............................................................................................... 81
4.1.3 Transferring Files with Netcat .............................................................................................. 82
4.1.4 Remote Administration with Netcat .................................................................................... 83
4.1.4.1 Netcat Bind Shell Scenario........................................................................................... 83
4.1.4.2 Reverse Shell Scenario ................................................................................................. 84
4.1.4.3 Exercises ......................................................................................................................... 86
4.2 Socat .............................................................................................................................................. 87
4.2.1 Netcat vs Socat ....................................................................................................................... 87
4.2.2 Socat File Transfers ............................................................................................................... 87
4.2.3 Socat Reverse Shells .............................................................................................................. 88
4.2.4 Socat Encrypted Bind Shells ................................................................................................. 88
4.2.4.1 Exercises ......................................................................................................................... 90
4.3 PowerShell and Powercat .......................................................................................................... 90
4.3.1 PowerShell File Transfers...................................................................................................... 92
4.3.2 PowerShell Reverse Shells .................................................................................................... 93
4.3.3 PowerShell Bind Shells........................................................................................................... 94
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 7
4.3.4 Powercat................................................................................................................................... 95
4.3.5 Powercat File Transfers......................................................................................................... 97
4.3.6 Powercat Reverse Shells ....................................................................................................... 97
4.3.7 Powercat Bind Shells.............................................................................................................. 98
4.3.8 Powercat Stand-Alone Payloads.......................................................................................... 98
4.3.8.1 Exercises ......................................................................................................................... 99
4.4 Wireshark .................................................................................................................................... 100
4.4.1 Wireshark Basics................................................................................................................... 100
4.4.2 Launching Wireshark............................................................................................................ 101
4.4.3 Capture Filters ....................................................................................................................... 101
4.4.4 Display Filters......................................................................................................................... 101
4.4.5 Following TCP Streams ....................................................................................................... 102
4.4.5.1 Exercises ....................................................................................................................... 103
4.5 Tcpdump ..................................................................................................................................... 104
4.5.1 Filtering Traffic ...................................................................................................................... 105
4.5.2 Advanced Header Filtering .................................................................................................. 107
4.5.2.1 Exercises ....................................................................................................................... 109
4.6 Wrapping Up ............................................................................................................................... 109
5 Bash Scripting ...................................................................................................................................... 110
5.1 Intro to Bash Scripting .............................................................................................................. 110
5.2 Variables...................................................................................................................................... 111
5.2.1 Arguments.............................................................................................................................. 113
5.2.2 Reading User Input ............................................................................................................... 114
5.3 If, Else, Elif Statements ............................................................................................................. 115
5.4 Boolean Logical Operations..................................................................................................... 118
5.5 Loops ........................................................................................................................................... 120
5.5.1 For Loops................................................................................................................................ 120
5.5.2 While Loops............................................................................................................................ 122
5.6 Functions .................................................................................................................................... 123
5.7 Practical Examples.................................................................................................................... 126
5.7.1 Practical Bash Usage – Example 1 ................................................................................... 126
5.7.2 Practical Bash Usage – Example 2 ................................................................................... 130
5.7.3 Practical Bash Usage – Example 3 ................................................................................... 134
5.7.3.1 Exercises ....................................................................................................................... 138
5.8 Wrapping Up ............................................................................................................................... 138
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 8
6 Passive Information Gathering ......................................................................................................... 139
6.1 Taking Notes .............................................................................................................................. 140
6.2 Website Recon ........................................................................................................................... 141
6.3 Whois Enumeration................................................................................................................... 143
6.3.1.1 Exercise.......................................................................................................................... 145
6.4 Google Hacking.......................................................................................................................... 145
6.4.1.1 Exercises ....................................................................................................................... 150
6.5 Netcraft........................................................................................................................................ 150
6.5.1.1 Exercise.......................................................................................................................... 153
6.6 Recon-ng ..................................................................................................................................... 153
6.6.1.1 Exercise.......................................................................................................................... 159
6.7 Open-Source Code .................................................................................................................... 159
6.7.1.1 Exercise.......................................................................................................................... 163
6.8 Shodan......................................................................................................................................... 163
6.9 Security Headers Scanner ....................................................................................................... 166
6.10 SSL Server Test.......................................................................................................................... 167
6.11 Pastebin....................................................................................................................................... 168
6.12 User Information Gathering ..................................................................................................... 169
6.12.1 Email Harvesting .............................................................................................................. 170
6.12.1.1 Exercises ....................................................................................................................... 171
6.12.2 Password Dumps ............................................................................................................. 171
6.13 Social Media Tools .................................................................................................................... 171
6.13.1.1 Social-Searcher ............................................................................................................ 171
6.13.2 Site-Specific Tools............................................................................................................ 172
6.13.2.1 Exercise.......................................................................................................................... 172
6.14 Stack Overflow ........................................................................................................................... 172
6.15 Information Gathering Frameworks ...................................................................................... 173
6.15.1 OSINT Framework............................................................................................................ 173
6.15.2 Maltego............................................................................................................................... 174
6.16 Wrapping Up ............................................................................................................................... 175
7 Active Information Gathering ............................................................................................................ 176
7.1 DNS Enumeration ...................................................................................................................... 176
7.1.1 Interacting with a DNS Server............................................................................................. 177
7.1.2 Automating Lookups ............................................................................................................ 177
7.1.3 Forward Lookup Brute Force .............................................................................................. 178
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 9
7.1.4 Reverse Lookup Brute Force............................................................................................... 179
7.1.5 DNS Zone Transfers ............................................................................................................. 179
7.1.6 Relevant Tools in Kali Linux ................................................................................................ 182
7.1.6.1 DNSRecon ..................................................................................................................... 182
7.1.6.2 DNSenum ...................................................................................................................... 183
7.1.6.3 Exercises ....................................................................................................................... 184
7.2 Port Scanning............................................................................................................................. 185
7.2.1 TCP / UDP Scanning ............................................................................................................ 185
7.2.1.1 TCP Scanning ............................................................................................................... 185
7.2.1.2 UDP Scanning............................................................................................................... 186
7.2.1.3 Common Port Scanning Pitfalls................................................................................ 187
7.2.2 Port Scanning with Nmap ................................................................................................... 187
7.2.2.1 Accountability for Our Traffic .................................................................................... 188
7.2.2.2 Stealth / SYN Scanning .............................................................................................. 190
7.2.2.3 TCP Connect Scanning............................................................................................... 191
7.2.2.4 UDP Scanning............................................................................................................... 192
7.2.2.5 Network Sweeping....................................................................................................... 193
7.2.2.6 OS Fingerprinting ......................................................................................................... 195
7.2.2.7 Banner Grabbing/Service Enumeration ................................................................... 196
7.2.2.8 Nmap Scripting Engine (NSE) ................................................................................... 197
7.2.2.9 Exercises ....................................................................................................................... 198
7.2.3 Masscan ................................................................................................................................. 198
7.3 SMB Enumeration...................................................................................................................... 199
7.3.1 Scanning for the NetBIOS Service ..................................................................................... 200
7.3.2 Nmap SMB NSE Scripts....................................................................................................... 200
7.3.2.1 Exercises ....................................................................................................................... 202
7.4 NFS Enumeration ...................................................................................................................... 202
7.4.1 Scanning for NFS Shares .................................................................................................... 202
7.4.2 Nmap NFS NSE Scripts ....................................................................................................... 203
7.4.2.1 Exercises ....................................................................................................................... 205
7.5 SMTP Enumeration ................................................................................................................... 205
7.5.1.1 Exercises ....................................................................................................................... 206
7.6 SNMP Enumeration................................................................................................................... 206
7.6.1 The SNMP MIB Tree ............................................................................................................. 207
7.6.2 Scanning for SNMP .............................................................................................................. 208
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 10
7.6.3 Windows SNMP Enumeration Example ........................................................................... 209
7.6.3.1 Enumerating the Entire MIB Tree.............................................................................. 209
7.6.3.2 Enumerating Windows Users .................................................................................... 209
7.6.3.3 Enumerating Running Windows Processes ........................................................... 209
7.6.3.4 Enumerating Open TCP Ports ................................................................................... 210
7.6.3.5 Enumerating Installed Software ............................................................................... 210
7.6.3.6 Exercises ....................................................................................................................... 210
7.7 Wrapping Up ............................................................................................................................... 210
8 Vulnerability Scanning ........................................................................................................................ 211
8.1 Vulnerability Scanning Overview and Considerations ........................................................ 211
8.1.1 How Vulnerability Scanners Work ..................................................................................... 211
8.1.2 Manual vs. Automated Scanning ....................................................................................... 212
8.1.3 Internet Scanning vs Internal Scanning ............................................................................ 213
8.1.4 Authenticated vs Unauthenticated Scanning .................................................................. 214
8.2 Vulnerability Scanning with Nessus....................................................................................... 214
8.2.1 Installing Nessus................................................................................................................... 215
8.2.2 Defining Targets .................................................................................................................... 220
8.2.3 Configuring Scan Definitions .............................................................................................. 223
8.2.4 Unauthenticated Scanning With Nessus.......................................................................... 227
8.2.4.1 Exercises ....................................................................................................................... 231
8.2.5 Authenticated Scanning With Nessus .............................................................................. 231
8.2.5.1 Exercises ....................................................................................................................... 235
8.2.6 Scanning with Individual Nessus Plugins ........................................................................ 235
8.2.6.1 Exercises ....................................................................................................................... 241
8.3 Vulnerability Scanning with Nmap ......................................................................................... 241
8.3.1.1 Exercise.......................................................................................................................... 244
8.4 Wrapping Up ............................................................................................................................... 244
9 Web Application Attacks .................................................................................................................... 245
9.1 Web Application Assessment Methodology ........................................................................ 245
9.2 Web Application Enumeration ................................................................................................ 245
9.2.1 Inspecting URLs .................................................................................................................... 246
9.2.2 Inspecting Page Content ..................................................................................................... 246
9.2.3 Viewing Response Headers ................................................................................................ 250
9.2.4 Inspecting Sitemaps............................................................................................................. 252
9.2.5 Locating Administration Consoles .................................................................................... 253
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 11
9.3 Web Application Assessment Tools ...................................................................................... 253
9.3.1 DIRB ......................................................................................................................................... 254
9.3.2 Burp Suite ............................................................................................................................... 255
9.3.3 Nikto ........................................................................................................................................ 278
9.3.3.1 Exercise.......................................................................................................................... 280
9.4 Exploiting Web-based Vulnerabilities .................................................................................... 280
9.4.1 Exploiting Admin Consoles ................................................................................................. 280
9.4.1.1 Burp Suite Intruder....................................................................................................... 283
9.4.1.2 Exercises ....................................................................................................................... 302
9.4.2 Cross-Site Scripting (XSS) ................................................................................................... 302
9.4.2.1 Identifying XSS Vulnerabilities................................................................................... 303
9.4.2.2 Basic XSS ...................................................................................................................... 304
9.4.2.3 Content Injection.......................................................................................................... 309
9.4.2.4 Stealing Cookies and Session Information ............................................................. 309
9.4.2.5 Exercises ....................................................................................................................... 314
9.4.2.6 Other XSS Attack Vectors .......................................................................................... 315
9.4.3 Directory Traversal Vulnerabilities ..................................................................................... 315
9.4.3.1 Identifying and Exploiting Directory Traversals ..................................................... 315
9.4.3.2 Exercise.......................................................................................................................... 317
9.4.4 File Inclusion Vulnerabilities................................................................................................ 317
9.4.4.1 Identifying File Inclusion Vulnerabilities .................................................................. 318
9.4.4.2 Exploiting Local File Inclusion (LFI) .......................................................................... 318
9.4.4.3 Contaminating Log Files ............................................................................................ 319
9.4.4.4 LFI Code Execution...................................................................................................... 320
9.4.4.5 Exercises ....................................................................................................................... 321
9.4.4.6 Remote File Inclusion (RFI)........................................................................................ 321
9.4.4.7 Exercises ....................................................................................................................... 323
9.4.4.8 Expanding Your Repertoire ........................................................................................ 323
9.4.4.9 PHP Wrappers .............................................................................................................. 324
9.4.4.10 Exercises ....................................................................................................................... 326
9.4.5 SQL Injection .......................................................................................................................... 326
9.4.5.1 Basic SQL Syntax ......................................................................................................... 327
9.4.5.2 Identifying SQL Injection Vulnerabilities .................................................................. 328
9.4.5.3 Authentication Bypass ................................................................................................ 329
9.4.5.4 Exercises ....................................................................................................................... 332
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 12
9.4.5.5 Enumerating the Database ........................................................................................ 332
9.4.5.6 Column Number Enumeration .................................................................................. 333
9.4.5.7 Understanding the Layout of the Output ................................................................. 338
9.4.5.8 Extracting Data from the Database .......................................................................... 339
9.4.5.9 Exercises ....................................................................................................................... 343
9.4.5.10 From SQL Injection to Code Execution.................................................................... 343
9.4.5.11 Exercises ....................................................................................................................... 345
9.4.5.12 Automating SQL Injection .......................................................................................... 345
9.4.5.13 Exercises ....................................................................................................................... 348
9.5 Extra Miles .................................................................................................................................. 348
9.5.1 Exercises................................................................................................................................. 349
9.6 Wrapping Up ............................................................................................................................... 349
10 Introduction to Buffer Overflows .................................................................................................. 350
10.1 Introduction to the x86 Architecture ...................................................................................... 350
10.1.1 Program Memory ............................................................................................................. 350
10.1.1.1 The Stack....................................................................................................................... 351
10.1.1.2 Function Return Mechanics ....................................................................................... 352
10.1.2 CPU Registers ................................................................................................................... 352
10.1.2.1 General Purpose Registers ........................................................................................ 353
10.1.2.2 ESP - The Stack Pointer .............................................................................................. 354
10.1.2.3 EBP - The Base Pointer ............................................................................................... 354
10.1.2.4 EIP - The Instruction Pointer ...................................................................................... 354
10.2 Buffer Overflow Walkthrough .................................................................................................. 354
10.2.1 Sample Vulnerable Code................................................................................................. 355
10.2.2 Introducing the Immunity Debugger............................................................................. 356
10.2.3 Navigating Code ............................................................................................................... 362
10.2.4 Overflowing the Buffer..................................................................................................... 371
10.2.5 Exercises ............................................................................................................................ 373
10.3 Wrapping Up ............................................................................................................................... 373
11 Windows Buffer Overflows............................................................................................................ 375
11.1 Discovering the Vulnerability ................................................................................................... 375
11.1.1 Fuzzing the HTTP Protocol ............................................................................................ 375
11.1.1.1 Exercises ....................................................................................................................... 381
11.2 Win32 Buffer Overflow Exploitation ....................................................................................... 381
11.2.1 A Word About DEP, ASLR, and CFG .............................................................................. 382
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 13
11.2.2 Replicating the Crash....................................................................................................... 382
11.2.3 Controlling EIP................................................................................................................... 383
11.2.3.1 Exercises ....................................................................................................................... 386
11.2.4 Locating Space for Our Shellcode ................................................................................. 386
11.2.5 Checking for Bad Characters ......................................................................................... 388
11.2.5.1 Exercises ....................................................................................................................... 390
11.2.6 Redirecting the Execution Flow ..................................................................................... 390
11.2.7 Finding a Return Address ............................................................................................... 390
11.2.7.1 Exercises ....................................................................................................................... 394
11.2.8 Generating Shellcode with Metasploit ......................................................................... 394
11.2.9 Getting a Shell ................................................................................................................... 396
11.2.9.1 Exercises ....................................................................................................................... 399
11.2.10 Improving the Exploit ....................................................................................................... 400
11.2.10.1 Exercise ..................................................................................................................... 400
11.2.10.2 Extra Mile Exercises................................................................................................ 400
11.3 Wrapping Up ............................................................................................................................... 400
12 Linux Buffer Overflows ................................................................................................................... 401
12.1 About DEP, ASLR, and Canaries ............................................................................................. 401
12.2 Replicating the Crash................................................................................................................ 401
12.2.1.1 Exercises ....................................................................................................................... 405
12.3 Controlling EIP............................................................................................................................ 405
12.3.1.1 Exercises ....................................................................................................................... 406
12.4 Locating Space for Our Shellcode .......................................................................................... 406
12.5 Checking for Bad Characters .................................................................................................. 409
12.5.1.1 Exercises ....................................................................................................................... 409
12.6 Finding a Return Address......................................................................................................... 410
12.6.1.1 Exercises ....................................................................................................................... 414
12.7 Getting a Shell ............................................................................................................................ 414
12.7.1.1 Exercises ....................................................................................................................... 416
12.8 Wrapping Up ............................................................................................................................... 416
13 Client-Side Attacks .......................................................................................................................... 417
13.1 Know Your Target...................................................................................................................... 417
13.1.1 Passive Client Information Gathering........................................................................... 417
13.1.2 Active Client Information Gathering.............................................................................. 418
13.1.2.1 Social Engineering and Client-Side Attacks ............................................................ 418
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 14
13.1.2.2 Client Fingerprinting .................................................................................................... 419
13.1.2.3 Exercises ....................................................................................................................... 426
13.2 Leveraging HTML Applications............................................................................................... 426
13.2.1 Exploring HTML Applications......................................................................................... 427
13.2.2 HTA Attack in Action........................................................................................................ 430
13.2.2.1 Exercises ....................................................................................................................... 431
13.3 Exploiting Microsoft Office ...................................................................................................... 431
13.3.1 Installing Microsoft Office .............................................................................................. 431
13.3.2 Microsoft Word Macro .................................................................................................... 433
13.3.2.1 Exercise.......................................................................................................................... 438
13.3.3 Object Linking and Embedding ...................................................................................... 438
13.3.3.1 Exercise.......................................................................................................................... 440
13.3.4 Evading Protected View .................................................................................................. 440
13.3.4.1 Exercises ....................................................................................................................... 441
13.4 Wrapping Up ............................................................................................................................... 441
14 Locating Public Exploits................................................................................................................. 442
14.1 A Word of Caution ..................................................................................................................... 442
14.2 Searching for Exploits............................................................................................................... 443
14.2.1 Online Exploit Resources ................................................................................................ 443
14.2.1.1 The Exploit Database .................................................................................................. 443
14.2.1.2 SecurityFocus Exploit Archives ................................................................................. 444
14.2.1.3 Packet Storm ................................................................................................................ 445
14.2.1.4 Google Search Operators ........................................................................................... 446
14.2.2 Offline Exploit Resources ................................................................................................ 446
14.2.2.1 SearchSploit.................................................................................................................. 446
14.2.2.2 Nmap NSE Scripts ....................................................................................................... 449
14.2.2.3 The Browser Exploitation Framework (BeEF) ........................................................ 450
14.2.2.4 The Metasploit Framework........................................................................................ 452
14.3 Putting It All Together ............................................................................................................... 453
14.3.1.1 Exercises ....................................................................................................................... 456
14.4 Wrapping Up ............................................................................................................................... 456
15 Fixing Exploits .................................................................................................................................. 457
15.1 Fixing Memory Corruption Exploits........................................................................................ 457
15.1.1 Overview and Considerations ........................................................................................ 458
15.1.2 Importing and Examining the Exploit ........................................................................... 458
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 15
15.1.3 Cross-Compiling Exploit Code ....................................................................................... 460
15.1.3.1 Exercises ....................................................................................................................... 461
15.1.4 Changing the Socket Information ................................................................................. 461
15.1.4.1 Exercises ....................................................................................................................... 461
15.1.5 Changing the Return Address ........................................................................................ 462
15.1.5.1 Exercise.......................................................................................................................... 462
15.1.6 Changing the Payload...................................................................................................... 462
15.1.6.1 Exercises ....................................................................................................................... 468
15.1.7 Changing the Overflow Buffer ........................................................................................ 469
15.1.7.1 Exercises ....................................................................................................................... 471
15.2 Fixing Web Exploits ................................................................................................................... 471
15.2.1 Considerations and Overview ........................................................................................ 471
15.2.2 Selecting the Vulnerability .............................................................................................. 472
15.2.3 Changing Connectivity Information .............................................................................. 472
15.2.3.1 Exercises ....................................................................................................................... 475
15.2.4 Troubleshooting the “index out of range” Error .......................................................... 476
15.2.4.1 Exercises ....................................................................................................................... 478
15.3 Wrapping Up ............................................................................................................................... 478
16 File Transfers ................................................................................................................................... 479
16.1 Considerations and Preparations........................................................................................... 479
16.1.1 Dangers of Transferring Attack Tools .......................................................................... 479
16.1.2 Installing Pure-FTPd......................................................................................................... 479
16.1.3 The Non-Interactive Shell................................................................................................ 480
16.1.3.1 Upgrading a Non-Interactive Shell ............................................................................ 481
16.1.3.2 Exercises ....................................................................................................................... 482
16.2 Transferring Files with Windows Hosts ................................................................................ 482
16.2.1 Non-Interactive FTP Download...................................................................................... 483
16.2.2 Windows Downloads Using Scripting Languages ..................................................... 485
16.2.3 Windows Downloads with exe2hex and PowerShell ................................................. 487
16.2.4 Windows Uploads Using Windows Scripting Languages ......................................... 489
16.2.5 Uploading Files with TFTP.............................................................................................. 490
16.2.5.1 Exercises ....................................................................................................................... 491
16.3 Wrapping Up ............................................................................................................................... 491
17 Antivirus Evasion ............................................................................................................................. 492
17.1 What is Antivirus Software ...................................................................................................... 492
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 16
17.2 Methods of Detecting Malicious Code .................................................................................. 492
17.2.1 Signature-Based Detection ............................................................................................. 493
17.2.2 Heuristic and Behavioral-Based Detection .................................................................. 494
17.3 Bypassing Antivirus Detection ................................................................................................ 494
17.3.1 On-Disk Evasion ................................................................................................................ 495
17.3.1.1 Packers .......................................................................................................................... 495
17.3.1.2 Obfuscators .................................................................................................................. 495
17.3.1.3 Crypters ......................................................................................................................... 495
17.3.1.4 Software Protectors .................................................................................................... 495
17.3.2 In-Memory Evasion .......................................................................................................... 496
17.3.2.1 Remote Process Memory Injection .......................................................................... 496
17.3.2.2 Reflective DLL Injection .............................................................................................. 496
17.3.2.3 Process Hollowing....................................................................................................... 497
17.3.2.4 Inline hooking................................................................................................................ 497
17.3.3 AV Evasion: Practical Example ...................................................................................... 497
17.3.3.1 PowerShell In-Memory Injection ............................................................................... 499
17.3.3.2 Exercises ....................................................................................................................... 507
17.3.3.3 Shellter ........................................................................................................................... 507
17.3.3.4 Exercises ....................................................................................................................... 513
17.4 Wrapping Up ............................................................................................................................... 513
18 Privilege Escalation ......................................................................................................................... 514
18.1 Information Gathering .............................................................................................................. 514
18.1.1 Manual Enumeration ....................................................................................................... 514
18.1.1.1 Enumerating Users ...................................................................................................... 514
18.1.1.2 Enumerating the Hostname ...................................................................................... 516
18.1.1.3 Enumerating the Operating System Version and Architecture ........................... 517
18.1.1.4 Enumerating Running Processes and Services ..................................................... 518
18.1.1.5 Enumerating Networking Information ..................................................................... 519
18.1.1.6 Enumerating Firewall Status and Rules .................................................................. 524
18.1.1.7 Enumerating Scheduled Tasks ................................................................................. 525
18.1.1.8 Enumerating Installed Applications and Patch Levels ......................................... 528
18.1.1.9 Enumerating Readable/Writable Files and Directories......................................... 530
18.1.1.10 Enumerating Unmounted Disks ........................................................................... 532
18.1.1.11 Enumerating Device Drivers and Kernel Modules............................................. 533
18.1.1.12 Enumerating Binaries That AutoElevate ............................................................. 536
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 17
18.1.1.13 Exercise ..................................................................................................................... 537
18.1.2 Automated Enumeration................................................................................................. 537
18.1.2.1 Exercises ....................................................................................................................... 540
18.2 Windows Privilege Escalation Examples .............................................................................. 540
18.2.1 Understanding Windows Privileges and Integrity Levels .......................................... 540
18.2.2 Introduction to User Account Control (UAC) ............................................................... 541
18.2.3 User Account Control (UAC) Bypass: fodhelper.exe Case Study ............................ 544
18.2.3.1 Exercise.......................................................................................................................... 556
18.2.4 Insecure File Permissions: Serviio Case Study ........................................................... 556
18.2.4.1 Exercises ....................................................................................................................... 560
18.2.5 Leveraging Unquoted Service Paths............................................................................. 560
18.2.6 Windows Kernel Vulnerabilities: USBPcap Case Study............................................. 561
18.2.6.1 Compiling C/C Code on Windows ....................................................................... 563
18.3 Linux Privilege Escalation Examples ..................................................................................... 566
18.3.1 Understanding Linux Privileges ..................................................................................... 566
18.3.2 Insecure File Permissions: Cron Case Study .............................................................. 567
18.3.2.1 Exercise.......................................................................................................................... 568
18.3.3 Insecure File Permissions: /etc/passwd Case Study ................................................ 568
18.3.3.1 Exercise.......................................................................................................................... 569
18.3.4 Kernel Vulnerabilities: CVE-2017-1000112 Case Study ............................................ 569
18.3.4.1 Compiling C/C Code on Linux............................................................................... 570
18.4 Wrapping Up ............................................................................................................................... 571
19 Password Attacks ........................................................................................................................... 572
19.1 Wordlists ..................................................................................................................................... 572
19.1.1 Standard Wordlists........................................................................................................... 573
19.1.1.1 Exercise.......................................................................................................................... 575
19.2 Brute Force Wordlists ............................................................................................................... 575
19.2.1.1 Exercise.......................................................................................................................... 577
19.3 Common Network Service Attack Methods ......................................................................... 578
19.3.1 HTTP htaccess Attack with Medusa ............................................................................ 579
19.3.1.1 Exercises ....................................................................................................................... 580
19.3.2 Remote Desktop Protocol Attack with Crowbar ........................................................ 581
19.3.2.1 Exercise.......................................................................................................................... 582
19.3.3 SSH Attack with THC-Hydra........................................................................................... 582
19.3.3.1 Exercise.......................................................................................................................... 583
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 18
19.3.4 HTTP POST Attack with THC-Hydra ............................................................................. 583
19.3.4.1 Exercises ....................................................................................................................... 586
19.4 Leveraging Password Hashes ................................................................................................ 586
19.4.1 Retrieving Password Hashes ......................................................................................... 586
19.4.1.1 Exercises ....................................................................................................................... 590
19.4.2 Passing the Hash in Windows ....................................................................................... 590
19.4.2.1 Exercises ....................................................................................................................... 592
19.4.3 Password Cracking .......................................................................................................... 592
19.4.3.1 Exercise.......................................................................................................................... 595
19.5 Wrapping Up ............................................................................................................................... 595
20 Port Redirection and Tunneling .................................................................................................... 596
20.1 Port Forwarding ......................................................................................................................... 596
20.1.1 RINETD ............................................................................................................................... 596
20.1.1.1 Exercises ....................................................................................................................... 600
20.2 SSH Tunneling............................................................................................................................ 600
20.2.1 SSH Local Port Forwarding ............................................................................................ 600
20.2.1.1 Exercises ....................................................................................................................... 603
20.2.2 SSH Remote Port Forwarding........................................................................................ 604
20.2.2.1 Exercises ....................................................................................................................... 606
20.2.3 SSH Dynamic Port Forwarding ...................................................................................... 606
20.2.3.1 Exercises ....................................................................................................................... 609
20.3 PLINK.exe.................................................................................................................................... 610
20.3.1.1 Exercises ....................................................................................................................... 613
20.4 NETSH ......................................................................................................................................... 613
20.4.1.1 Exercise.......................................................................................................................... 615
20.5 HTTPTunnel-ing Through Deep Packet Inspection ............................................................ 616
20.5.1.1 Exercises ....................................................................................................................... 621
20.6 Wrapping Up ............................................................................................................................... 621
21 Active Directory Attacks................................................................................................................. 622
21.1 Active Directory Theory ............................................................................................................ 622
21.2 Active Directory Enumeration ................................................................................................. 623
21.2.1 Traditional Approach ....................................................................................................... 624
21.2.1.1 Exercise.......................................................................................................................... 626
21.2.2 A Modern Approach ......................................................................................................... 626
21.2.2.1 Exercises ....................................................................................................................... 632
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 19
21.2.3 Resolving Nested Groups ............................................................................................... 632
21.2.3.1 Exercises ....................................................................................................................... 634
21.2.4 Currently Logged on Users ............................................................................................. 635
21.2.4.1 Exercises ....................................................................................................................... 637
21.2.5 Enumeration Through Service Principal Names ........................................................ 638
21.2.5.1 Exercises ....................................................................................................................... 641
21.3 Active Directory Authentication .............................................................................................. 642
21.3.1 NTLM Authentication....................................................................................................... 642
21.3.2 Kerberos Authentication ................................................................................................. 644
21.3.3 Cached Credential Storage and Retrieval .................................................................... 646
21.3.3.1 Exercises ....................................................................................................................... 649
21.3.4 Service Account Attacks ................................................................................................. 650
21.3.4.1 Exercises ....................................................................................................................... 653
21.3.5 Low and Slow Password Guessing............................................................................... 653
21.3.5.1 Exercises ....................................................................................................................... 655
21.4 Active Directory Lateral Movement........................................................................................ 655
21.4.1 Pass the Hash ................................................................................................................... 656
21.4.2 Overpass the Hash ........................................................................................................... 657
21.4.2.1 Exercise.......................................................................................................................... 661
21.4.3 Pass the Ticket ................................................................................................................. 661
21.4.3.1 Exercises ....................................................................................................................... 664
21.4.4 Distributed Component Object Model .......................................................................... 664
21.4.4.1 Exercises ....................................................................................................................... 669
21.5 Active Directory Persistence ................................................................................................... 670
21.5.1 Golden Tickets .................................................................................................................. 670
21.5.1.1 Exercises ....................................................................................................................... 674
21.5.2 Domain Controller Synchronization .............................................................................. 674
21.6 Wrapping Up ............................................................................................................................... 676
22 The Metasploit Framework ........................................................................................................... 677
22.1 Metasploit User Interfaces and Setup ................................................................................... 678
22.1.1 Getting Familiar with MSF Syntax ................................................................................. 678
22.1.2 Metasploit Database Access ......................................................................................... 680
22.1.3 Auxiliary Modules ............................................................................................................. 682
22.1.3.1 Exercises ....................................................................................................................... 687
22.2 Exploit Modules.......................................................................................................................... 687
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 20
22.2.1 SyncBreeze Enterprise..................................................................................................... 688
22.2.1.1 Exercise.......................................................................................................................... 691
22.3 Metasploit Payloads ................................................................................................................. 691
22.3.1 Staged vs Non-Staged Payloads ................................................................................... 691
22.3.2 Meterpreter Payloads ...................................................................................................... 692
22.3.3 Experimenting with Meterpreter .................................................................................... 693
22.3.3.1 Exercise.......................................................................................................................... 695
22.3.4 Executable Payloads........................................................................................................ 695
22.3.5 Metasploit Exploit Multi Handler ................................................................................... 697
22.3.6 Client-Side Attacks ........................................................................................................... 700
22.3.7 Advanced Features and Transports ............................................................................. 701
22.3.7.1 Exercises ....................................................................................................................... 705
22.4 Building Our Own MSF Module ............................................................................................... 705
22.4.1.1 Exercise.......................................................................................................................... 710
22.5 Post-Exploitation with Metasploit .......................................................................................... 710
22.5.1 Core Post-Exploitation Features.................................................................................... 710
22.5.2 Migrating Processes ........................................................................................................ 712
22.5.3 Post-Exploitation Modules.............................................................................................. 712
22.5.4 Pivoting with the Metasploit Framework ..................................................................... 715
22.5.4.1 Exercise.......................................................................................................................... 720
22.6 Metasploit Automation............................................................................................................. 720
22.6.1.1 Exercise.......................................................................................................................... 722
22.7 Wrapping Up ............................................................................................................................... 722
23 PowerShell Empire .......................................................................................................................... 723
23.1 Installation, Setup, and Usage................................................................................................. 723
23.1.1 PowerShell Empire Syntax.............................................................................................. 724
23.1.2 Listeners and Stagers...................................................................................................... 725
23.1.3 The Empire Agent ............................................................................................................. 728
23.1.3.1 Exercises ....................................................................................................................... 732
23.2 PowerShell Modules ................................................................................................................. 732
23.2.1 Situational Awareness ..................................................................................................... 732
23.2.2 Credentials and Privilege Escalation ............................................................................ 735
23.2.3 Lateral Movement ............................................................................................................ 738
23.3 Switching Between Empire and Metasploit.......................................................................... 740
23.3.1.1 Exercises ....................................................................................................................... 743
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 21
23.4 Wrapping Up ............................................................................................................................... 743
24 Assembling the Pieces: Penetration Test Breakdown ............................................................. 744
24.1 Public Network Enumeration................................................................................................... 744
24.2 Targeting the Web Application................................................................................................ 745
24.2.1 Web Application Enumeration ....................................................................................... 746
24.2.2 SQL Injection Exploitation ............................................................................................... 753
24.2.2.1 Exercise.......................................................................................................................... 761
24.2.3 Cracking the Password ................................................................................................... 761
24.2.4 Enumerating the Admin Interface ................................................................................. 763
24.2.5 Obtaining a Shell ............................................................................................................... 766
24.2.6 Post-Exploitation Enumeration ...................................................................................... 773
24.2.7 Creating a Stable Pivot Point.......................................................................................... 775
24.3 Targeting the Database ............................................................................................................ 779
24.3.1 Enumeration ...................................................................................................................... 779
24.3.1.1 Application/Service Enumeration ............................................................................. 779
24.3.2 Attempting to Exploit the Database .............................................................................. 784
24.3.2.1 Why We Failed .............................................................................................................. 786
24.4 Deeper Enumeration of the Web Application Server .......................................................... 787
24.4.1 More Thorough Post Exploitation ................................................................................. 787
24.4.2 Privilege Escalation .......................................................................................................... 788
24.4.3 Searching for DB Credentials ......................................................................................... 790
24.5 Targeting the Database Again ................................................................................................ 791
24.5.1 Exploitation ........................................................................................................................ 791
24.5.1.1 Exercises ....................................................................................................................... 794
24.5.2 Post-Exploitation Enumeration ...................................................................................... 794
24.5.3 Creating a Stable Reverse Tunnel ................................................................................. 796
24.6 Targeting Poultry ....................................................................................................................... 798
24.6.1 Enumeration ...................................................................................................................... 798
24.6.1.1 Network Enumeration ................................................................................................. 799
24.6.2 Exploitation (Or Just Logging In) ................................................................................... 800
24.6.3 Post-Exploitation Enumeration ...................................................................................... 802
24.6.4 Unquoted Search Path Exploitation .............................................................................. 809
24.6.5 Post-Exploitation Enumeration ...................................................................................... 814
24.7 Internal Network Enumeration ................................................................................................ 815
24.7.1 Reviewing the Results ..................................................................................................... 817
www.hide01.ir | t.me/Hide01/2
Learning In Cyber Security Should Be Free And Accessible For All | www.hide01.ir | hide01@disr.it
Penetration Testing with Kali Linux
PWK V2.0.1 - Copyright © Hide01.ir Ltd. All Rights Reserved. 22
24.8 Targeting the Jenkins Server .................................................................................................. 822
24.8.1 Application Enumeration................................................................................................. 823
24.8.2 Exploiting Jenkins ............................................................................................................ 829
24.8.3 Post Exploitation Enumeration ...................................................................................... 839
24.8.4 Privilege Escalation .......................................................................................................... 840
24.8.5 Post Exploitation Enumeration ...................................................................................... 843
24.9 Targeting the Domain Controller ............................................................................................ 845
24.9.1 Exploiting the Domain Controller................................................................................... 845
24.10 Wrapping Up .......................................................................................................................... 849
25 Trying Harder: The Labs................................................................................................................. 850
25.1 Real Life Simulations ................................................................................................................ 850
25.2 Machine Dependencies ............................................................................................................ 850
25.3 Unlocking Networks .................................................................................................................. 850
25.4 Routing ........................................................................................................................................ 851
25.5 Machine Ordering & Attack Vectors....................................................................................... 851
25.6 Firewall / Routers / NAT........................................................................................................... 851
25.7 Passwords .................................................................................................................................. 851
25.8 Wrapping Up ............................................................................................................................... 851