Collection of notes to prepare for the eLearnSecurity eJPT certification exam.
Before you continue reading, please do the following:
1. Please sign up for a FREEhttps://ine.com account, and complete the Penetration Testing Student course. It is ABSOLUTE FREE! To be honest, everything you need to pass the eJPT is in that free course.
2. Do NOT treat this exam as a CTF box. This is NOT like a CTF box. Host Discovery is important. π
Host Discovery / Enumeration
Let's find out what we are working with. We are completely blind.
Sometimes clues are put here. π Old versions of FTP maybe vulnerable. Always check the version. Search for the exploit using Google / Searchsploit / Rapid7. If you find some credential, try it on SSH / Login page / database.
β’ send # Send single file
β’ put # Send one file.
β’ mput # Send multiple files.
β’ mget # Get multiple files.
β’ get # Get file from the remote computer.
β’ ls # list
β’ mget *# Download everything
β’ binary = Switches to binary transfer mode.
β’ ascii = Switch to ASCII transfer mode
1. Gather version numbers
2. Check Searchsploit
3. Check for Default Creds
4. Use Creds previously gathered
5. Download the software
Port 445 - SMB Enumeration
Always check for SMB. You might get lucky and find a vulnerable machine running SMB that has remote code execution. Remember to use searchsploit, or google to check all service versions for publicly available exploits.
Scan for NETBIOS/SMB Service with Nmap:
nmap -p 139,445 --open -oG smb.txt 192.168.1.0/24
Scan for NETBIOS/SMB Service with nbtscan:
nbtscan -r 192.168.1.0/24
Enumerate the Hostname:
nmblookup -A 10.10.10.1
Check for Null Sessions:
smbmap -H 10.10.10.1
rpcclient -U "" -N 10.10.10.1
smbclient \\\\$ip\\ShareName
if getting error "protocol negotiation failed: NT_STATUS_CONNECTION_DISCONNECTED"
smbclient -L //10.10.10.3/ --option='client min protocol=NT1'
β’ Windows NT, 2000, and XP (most SMB1) - VULNERABLE: Null Sessions can be created by default
β’ Windows 2003, and XP SP2 onwards - NOT VULNERABLE: Null Sessions can't be created defaultβ’ Most Samba (Unix) servers
List of SMB versions and corresponding Windows versions:
β’ SMB1 β Windows 2000, XP and Windows 2003.
β’ SMB2 β Windows Vista SP1 and Windows 2008
β’ SMB2.1 β Windows 7 and Windows 2008 R2
β’ SMB3 β Windows 8 and Windows 2012.
Web Application Enumeration / Exploitation - Port 80,443,8080
Make sure that you enumerate, and enumerate some more. π
Web Application Enumeration Checklist:
1. Checkout the entire webpage and what it is displaying.
2. Read every page, look for emails, names, user info, etc.
3. Directory Discovery (time to dir bust!)
4. Enumerate the interface, what is the CMS & Version? Server installation page?
5. Check for potential Local File Inclusion, Remote File Inclusion, SQL Injection, XXE, and Upload vulnerabilities
6. Check for a default server page, identify the server version
7. View Source Code:
a. Check for hidden values
b. Check for comments/developer remarks
c. Check for Extraneous Code
d. Check for passwords
8. Check for robots.txt file
9. Web Scanning
Directory Discovery/Dir Busting:
gobuster dir -u 10.10.10.181 -w /usr/share/seclists/Discovery/Web-Content/common.txt
Gobuster Quick Directory Discovery
gobuster -u $ip -w /usr/share/seclists/Discovery/Web_Content/common.txt -t 80 -a Linux
I highly suggest you learn how to use John The Ripper, Hydra, and how to unshadow passwd files. π
Unshadow
This will prepare the file for John The Ripper, you need a Passwd & Shadow File.
unshadow passwd shadow > unshadow
Hash Cracking - John The Ripper
john -wordlist /path/to/wordlist -users=users.txt hashfile
Networking - Routing
I highly recommend that you get comfortable with general networking and routing concepts, including be able to read and understand .PCAP files.
Set up IP Routing and Routing Tables
ip route - prints the routing table for the host you are on
ip route add ROUTETO via ROUTEFROM - add a route to a new network if on a switched network and you need to pivot
# local port forwarding# the target host 192.168.0.100 is running a service on port 8888# and you want that service available on the localhost port 7777
ssh -L 7777:localhost:8888 user@192.168.0.100
# remote port forwarding# you are running a service on localhost port 9999 # and you want that service available on the target host 192.168.0.100 port 12340
ssh -R 12340:localhost:9999 user@192.168.0.100
# Local proxy through remote host# You want to route network traffic through a remote host target.host# so you create a local socks proxy on port 12001 and configure the SOCKS5 settings to localhost:12001
ssh -C2qTnN -D 12001 user@target.host
Network/Service Attacks
You may need to bruteforce a service running, such as SSH, FTP, etc. Just replace the service name below to bruteforce.