Remote Exploitation Part-0001 Tools

We are Here! Exploitation.

What We do Here?

Use knowledge acquired so far to gain access to the target machine.

Exploitation can be both side Client side and server side.

Server Side - direct contact with the server it does not involve user

            interaction.

Network Protocols

Why this is -> You just cannot attack a protocol without knowing how it works.

Come across only three protocols.

                    1. TCP (Transmission Control Protocol)

          2. UDP (User Datagram Protocol)

         3. ICMP (Internet Control Messaging Protocol)

TCP :

Most internet traffic is based upon TCP since it guarantees a reliable communication.

Ex:: FTP, SMTP, Telnet, HTTP

TCP is used we need to perform a reliable communication between a client and server.

TCP performs a reliable communication via three-way handshake;

UDP :

UDP is exact opposite of TCP;

Used for faster communication.

Ex : video streaming, such as Skype (VOIP) communication.

Advantage : Much faster and efficient

Disadvantage : UDP not guarantee that the packet will reach the destination, since ii does not perform the 3 way handshake, this causing reliability issue.

UDP protocols : DNS and SQL Server.

ICMP :

Run upon : Layer 3 (network Layer) of the OSI Model;

TCP and UDP : Layer 4

Developed for troubleshooting error messages on a network.

Connectionless protocol, which means that it gives us no guarantee that the packet will reach the destination.

Common Application : PING and Traceroute

Server Protocols

All servers protocols divide in Two categories.

 1. Text-based

 2. Binary protocols.

 1. Text-based protocols :

Human readable, and this is where you, as a penetration tester, need to spend most of your time.

Ex : HTTP, FTP and SMTP;

  2. Binary Protocols :

     Not human readable, and very difficult to understand;

     they are designed for efficiency across the wire.

     our focus would be on text/ASCII based protocols, not binary protocols.

 Need to Talk Text-based protocols :

FTP :

File Transfer protocol;

Runs on port No : 21

Used for : Uploading/downloading files from a server.

Weakest link in a network because it's unencrypted.

SMTP :

Simple Mail Transfer Protocol

Runs on port No : 25

Used for : Mailing servers nowadays.

HTTP :

Open browser and type URL, into the address what you type

http://www.--------.com

Runs on Port No : 80 and HTTPS (443)

Read more on network protocols

Network Remote Services

We know how to enumerate open ports and services running upon those ports.

Now its time to Exploit….

Tools :

HYDRA, Medusa, And Ncrack

Network Services : FTP, SSH, RDP.

Common Target Protocols

FTP

SSH

SMB

SMTP

HTTP

RDP

VNC

MySQL

MS SQL

Generally, if you crack any one of these services, the methodology is same.

Tools :

THC Hydra :

   Tool : One of the oldest password cracking tools.

   Developed by : The Hackers Community

   Why used : most protocols coverage than other password cracking tool in my knowledge.

Basics Syntax :

Hydra -L username -P password file <Target IP> <service>   

   

              Ex:

Hydra -L user.txt -P password.txt <Target IP> <service>

We need to scan

Medusa :

Tool : Really fast password cracking tool.

  more stable and faster because it uses "Pthread". Meaning that won’t necessarily duplicate the information.

Syntax :

  Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file]    [-C file] -M module [OPT]

-M  = Service to Attack;

Cracking SSH with Medusa :

Ncrack :

Based upon nmap libraries.

It can be combined with nmap to yield great results.

Disadvantage it supports very few services

Names : FTP, SSH, Telnet, POP3, SMB, RDP, and VNC;

Basic Syntax :

Ncrack -u username -P password file -P port of the service to attack -f quit cracking after the first credential is found;