Important networking tips

From Grayhat cheatsheets
Jump to navigationJump to search

Next is a collection of tips related to networking in general that can be easily overlooked and can sometimes be the key to compromising a machine.

  • It can be interesting, if for example a host has an open ssh server, and with nmap we see that it is a certain old version of openssh, we can google that version, it may be old enough, and not be patched.
  • Likewise, if we get for example the Apache version of an Ubuntu server, we can deduce with high accuracy what version of Ubuntu we are dealing with, by relating it to the version of apache, as indicated in this page:

https://packages.ubuntu.com/search?keywords=apache2 This can help us find if it is an LTS version or not (in which case, it may not be patched). Check for other programs that you find running on ports in that page for the same results The same can be attempted for: CentOS: http://mirror.centos.org/centos/6/os/x86_64/Packages/ Enterprise Linux: https://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/ Change the version (7, 6, etc) in the url.

  • Port knocking works by configuring a service to watch firewall logs or packet capture interfaces for connection attempts. If a specific sequence of predefined connection attempts (or "knocks") are made, the service will modify the firewall rules to open up connections on a certain port. Another sequence can close the port again. This is indicated in the file knock.conf. Port knocking is used in Hackthebox' Nineveh with the service /etc/init.d/knockd.
  • If a Hackthebox machine has a funny name (or for that matter, every box in Hackthebox), first of all, google something like "machine_name exploit", usually these machines are given names related to the exploitation vector that needs to be employed. For example, Mirai or Blue.
  • Povoting is the act of accessing a network through another network we have already compromised, and that is hidden to the internet. If we compromise a machine, it is important to do ifconfig or ipconfig in it. If two interfaces are present, it signals that this machine is connected to two networks. It may be with two physical network interface cards (NICs), or logically, with multihoming. If we have accessed the host, we did it through one network, but we can use it to access the second network, or sniff or scan it.

Check this link for information on how to do pivoting with metasploit: https://www.offensive-security.com/metasploit-unleashed/pivoting/

Maximum Transfer Unit (MTU) is the size of the packets. It may happen than a host is configured to accept a non standard size of packets, smaller than our packets sent, and they are getting rejected without any explanation. We can change the MTU of our packets, with for example: ifconfig eth0 mtu 6000 up To make permanent changes in Debian systems, edit /etc/network/interfaces and add mtu 6000 To make permanent changes if Redhat systems, edit /etc/sysconfig/network-scripts/ifcfg-eth0 and add MTU="6000" In either case, restart the network with

/etc/init.d/networking restart

or

service network restart

respectively

  • If a port scan reveals that there is FTP active, and anonymous connections are allowed, we can connect with user anonymous and any password. We probably won't have write permissions, but it is worth trying.
  • If we look at the output of

netstat -antup

in a host we have already compromised, we can find that there is some service, like MySQL listening, but on IP 127.0.0.1, which explains that we couldn't see it from outside when we were scanning this host.

  • We can connect from a windows machine to another machine shares with the command:

net use z:\\blahblah