No Skids Allowed! A Pentester's Primer Christopher M. Steffen May 28, 2020 TABLE OF CONTENTS 1 Fundamentals 3 1.1 Introduction...............................................3 1.2 Ethics...................................................4 1.3 General Knowledge...........................................4 1.4 The Hacker’s Toolkit...........................................5 1.4.1 Virtual Machines and Operating Systems...........................5 1.4.1.1 Microsoft Windows..................................5 1.4.1.2 Apple macOS.....................................6 1.4.1.3 Linux..........................................6 1.4.1.4 And So On. ......................................6 1.4.2 Programming Languages....................................7 1.4.3 Search Engines and Google-Fu.................................7 1.5 Pentest Methodology...........................................7 1.6 Reporting.................................................9 1.7 Hacker Etiquette............................................. 10 1.7.1 Keep it Stable.......................................... 10 1.7.1.1 Don’t be a DoSser................................... 10 1.7.1.2 Avoid Brute-Force................................... 10 1.7.2 Cover Your Tracks....................................... 11 2 Tools and Techniques 13 2.1 General-Purpose............................................. 13 2.1.1 Tools.............................................. 13 2.1.1.1 Netcat: The Network Swiss-Army Knife....................... 13 2.1.1.2 Tee: Transparently Save Output from Tools...................... 15 2.1.2 File Transfers.......................................... 16 2.1.2.1 Transferring Files with Python............................ 16 2.1.3 Popping Shells......................................... 17 2.1.3.1 Netcat Shells...................................... 18 2.2 Enumeration............................................... 19 2.2.1 Tools.............................................. 19 2.2.1.1 ARP-Scan: The ARP Scanner............................. 19 2.2.1.2 Enum4linux: SMB & Samba Enumeration...................... 21 2.2.1.3 Nmap: the Network Mapper.............................. 22 2.2.1.4 smbclient: FTP-Like Client for SMB & Samba.................... 24 2.3 Vulnerability Assessment........................................ 26 2.3.1 Tools.............................................. 26 2.3.1.1 SearchSploit: a Searchable Database of Exploits................... 26 2.4 Exploitation............................................... 28 2.4.1 Tools.............................................. 28 i 2.4.1.1 The Metasploit Framework: Hacking on Rails.................... 28 2.4.1.2 Meterpreter: MSF’s Premier Payload......................... 30 2.5 Post-Exploitation............................................. 31 2.5.1 Windows Post-Exploitation................................... 31 2.5.1.1 Basic Commands................................... 32 3 Walk-Throughs 33 3.1 HackTheBox............................................... 33 3.1.1 Legacy............................................. 34 3.1.1.1 Enumeration...................................... 34 3.1.1.2 Vulnerability Assessment............................... 35 3.1.1.3 Exploitation...................................... 39 3.1.1.4 Capturing Flags.................................... 43 3.1.2 Lame.............................................. 45 3.1.2.1 Enumeration...................................... 45 3.1.2.2 Vulnerability Assessment............................... 50 3.1.2.3 Exploitation...................................... 54 3.2 VulnHub................................................. 60 3.2.1 Kioptrix Level 1......................................... 60 3.2.1.1 Enumeration...................................... 61 3.2.1.2 Vulnerability Assessment............................... 67 3.2.1.3 Exploitation...................................... 69 4 Quick Reference 77 4.1 CTF Platforms.............................................. 77 4.2 Pentesting Methodologies........................................ 77 4.3 Search Engines and OSINT Resources................................. 77 4.3.1 OSINT Resources........................................ 77 4.3.2 General-Purpose........................................ 77 4.3.3 Google Dorks.......................................... 78 4.3.4 Exploits and Vulnerabilities................................... 78 4.3.5 Images.............................................. 78 4.3.6 Internet-Connected Devices.................................. 78 4.3.7 Source Code........................................... 78 4.3.8 Usernames........................................... 78 5 Glossary 79 Index 81 ii No Skids Allowed! A Pentester's Primer Warning: The contents of this compendium are provided as educational and reference material for those interested in legal hacking. They are not intended to promote nor encourage illegal activities. The creators of this guide are not responsible for the actions of its readers. GET CONNECTED! • Read the Guide Online! • Read the Guide on Tor! • Get the Latest PDF! • Join the Team on Keybase! • Help Build the Guide! CHANGE LOG This version of No Skids Allowed! was published May 28th, 2020. • 2020.05.28: Revised layout and added walk-through of Lame from HackTheBox. • 2020.05.10: Reorganized document in preparation of expansion. Added etiquette. • 2020.04.10: Created website (with Tor support) and Keybase team. • 2020.04.07: Finished walk-through of Kioptrix Level 1 from VulnHub. • 2020.03.16: Finished “First Steps” chapter, detailing walk-through of Legacy from HackTheBox. TABLE OF CONTENTS 1 No Skids Allowed! A Pentester's Primer 2 TABLE OF CONTENTS CHAPTER ONE FUNDAMENTALS The following sections cover the basic knowledge and skills you’ll need in order to start your journey as a computer hacker. 1.1 Introduction In common usage, a script kiddie (or skid) is an unskilled individual who uses other people’s tools and exploits without understanding how or why they work, all the while calling themself a “hacker.” The term is sometimes used as a form of gate-keeping, putting down novice “wannabe” hackers for lacking knowledge they’ve had no chance to obtain. Is there anything in your life that you take for granted, without really understanding how it works? I drive my car every day, but I’m no mechanic. I couldn’t tell you how microwaves work, but I use them to make popcorn. I use other people’s inventions every day without ever knowing how they work. I don’t pretend to be a mechanic when I change my oil, nor a physicist when I make popcorn, but the fact remains: in many aspects of life, I’m a total skid. And that’s okay. In the Hacker Jargon File, a hacker is “an expert or enthusiast of any kind,” or “one who enjoys the intellectual challenge of creatively overcoming or circumventing limitations.” If we apply the same liberal brush to the term “script kiddie,” we could say that a skid is someone who takes advantage of systems in their environment without any deeper understanding or appreciation for how those systems function. If this is the case, then we’re all skids at first. We’re born skids, dependent on the world and people around us, and utterly clueless as to how any of it works. But as we learn, we grow, until we’re not so skiddish anymore. And that’s the secret: To stop being a skid, all you gotta do is stay curious, and keep learning. That’s what No Skids Allowed! is all about. It’s not about skid-shaming, it’s about learning and improving and growing, and keeping each other accountable, so that we might accurately call ourselves “hackers.” It’s not an easy path. Learning can be quite challenging, especially when the topic is as complex and diverse as In- formation Security. Whoever said, “Do what you love, and you’ll never work a day in your life” clearly wasn’t a hacker. Even the most passionate and skilled professional knows that attaining mastery over a skill takes persever- ance and strength of will. And sometimes, no matter how good you are, you’re just going to have a rough day. It’s totally fine to be an amateur, to make mistakes, to lack knowledge and skill. If you haven’t failed, you haven’t tried. And if you ever feel like you’re in over your head, just remember the wise words of Jake the Dog: 3 No Skids Allowed! A Pentester's Primer Fig. 1: “Sucking at something is the first step to becoming sorta good at something.” -Jake the Dog Image and quote from Adventure Time by Pendleton Ward 1.2 Ethics The art of hacking can be legally and ethically ambiguous at times. For professionals, proper permission can make the difference between a paycheck and a prison term. Pentesters must work within the boundaries of a defined scope, which provides the parameters and restrictions of the penetration test. Violating the scope of a penetration test can lead to dire legal consequences. However, legality isn’t the only consideration to be made. That which is legal is not always ethical, and that which is ethical is not always legal. It is vital that hackers consider the ethics of their actions, and the potential consequences those actions may have in the world. The subject of ethics weighs heavily into discussions about the disclosure of vulnerabilities, hacktivism, state- sponsored cyber-warfare, “hack-back” legislation, and many others. These subjects are highly subjective and widely debated, and will continue to evolve along with technology and global views on ethics. This guide is written for ethical hackers. To be an ethical hacker, one must have a code of ethics. The authors of this guide