Nmap and service enumeration
The usual flow when starting a box is to find every open port, run scripts and version detection only on those ports, and then enumerate each service.
Your values
Saved in this browser and applied to every cheatsheet.
Nmap
First contact
Linux or Windows? (TTL)
ping -c 1 10.10.11.20A TTL close to 64 is usually Linux and close to 128, Windows.
All TCP ports (fast)
sudo nmap -p- --open -sS --min-rate 5000 -n -Pn 10.10.11.20 -oG puertos
Extract the port list
grep -oP '\d+(?=/open)' puertos | paste -sd, -
Versions and default scripts
nmap -sCV -p22,80 10.10.11.20 -oN objetivoReplace 22,80 with the ports from the previous step.
UDP (most common)
sudo nmap -sU --top-ports 100 --open -n -Pn 10.10.11.20NSE scripts
Known vulnerabilities
nmap --script vuln -p445 10.10.11.20
Search scripts by name
ls /usr/share/nmap/scripts/ | grep -i smb
Web path fuzzing with nmap
nmap --script http-enum -p80 10.10.11.20Without nmap (from a compromised host)
Ports with bash
Target
for p in $(seq 1 65535); do (echo > /dev/tcp/172.16.1.10/$p) 2>/dev/null && echo "$p abierto"; done
Ports with nc
Target
nc -zv -w1 172.16.1.10 1-10000 2>&1 | grep -i succeededServices
SMB (445)
Shares without credentials
smbclient -L //10.10.11.20 -N
With netexec (null and guest session)
netexec smb 10.10.11.20 -u '' -p '' --shares
netexec smb 10.10.11.20 -u 'guest' -p '' --shares
With credentials
netexec smb 10.10.11.20 -u 'usuario' -p 'Password123!' --shares
Download a whole share
smbclient //10.10.11.20/share -N -c 'recurse ON; prompt OFF; mget *'
Full enumeration
enum4linux-ng -A 10.10.11.20FTP (21)
Anonymous access
ftp [email protected]Empty or any password. Type binary before downloading binary files.
Download everything
wget -m --no-passive ftp://anonymous:[email protected]SNMP (161/udp)
Try communities
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt 10.10.11.20
Walk the tree
snmpwalk -v2c -c public 10.10.11.20
Processes and arguments (passwords in command lines)
snmpwalk -v2c -c public 10.10.11.20 1.3.6.1.2.1.25.4.2.1.5NFS (2049)
List exports
showmount -e 10.10.11.20
Mount
sudo mount -t nfs 10.10.11.20:/ruta /mnt/nfs -o nolockDNS (53)
Zone transfer
dig axfr box.htb @10.10.11.20
Records
dig any box.htb @10.10.11.20Others
Add the domain to /etc/hosts
echo '10.10.11.20 box.htb' | sudo tee -a /etc/hosts
LDAP (389)
ldapsearch -x -H ldap://10.10.11.20 -s base namingcontexts
Redis (6379)
redis-cli -h 10.10.11.20 INFO
rpcbind (111)
rpcinfo -p 10.10.11.20No command matches.