📕
writeups
  • Introduction
  • Try Hack Me
    • Walkthroughs
      • Core Windows Processes
      • Linux: Local Enumeration
      • Network services
      • Network services 2
      • What the Shell?
      • Common Linux Privesc
      • Hashing - Crypto 101
    • Challanges (CTF)
      • Basic pentesting
      • tomghost
      • VulnNet
  • hack the box
    • Easy machines
    • Medium machines
Powered by GitBook
On this page
  • Task 2: Understanding NFS
  • Task 3: Enumerating NFS
  • Task 4: Exploiting NFS
  • Task 5: Understanding SMTP
  • Task 6: Enumerating SMTP
  • Task 7: Exploiting SMTP
  • Task 8: Understanding MySQL
  • Task 9: Enumerating MySQL
  • Task 10: Exploiting MySQL

Was this helpful?

  1. Try Hack Me
  2. Walkthroughs

Network services 2

Enumerating and Exploiting More Common Network Services & Misconfigurations

PreviousNetwork servicesNextWhat the Shell?

Last updated 3 years ago

Was this helpful?

This room from describes a few more common Network Service vulnerabilities and misconfigurations.

Task 2: Understanding NFS

NFS -

  • NFS = Network File System

  • It is used to share file and directories using network

  • Working method: client will request to mount directory. If client has permission, it will send 'file handle'

Task 3: Enumerating NFS

Method for enum -

  • Scan with nmap

  • Create mount point (directory) in the attacker machine

  • Command to connect with mount: mount -t nfs IP:share /tmp/mount/ -nolock

    • mount: Execute the mount command

    • -t nfs: type of device to mount. Here it is nfs

    • IP:share : the ip of the target and the share we want to mount

    • -nolock: not to use NLM locking

Task 4: Exploiting NFS

Example method for exploiting -

  • Get NFS access

  • Gain low privilege access

  • Upload bash executable to NFS share

  • Get a reverse shell / Enumerate for ssh key / Escalate privilege

Task 5: Understanding SMTP

SMTP -

  • Stands for - simple mail transfer protocol

  • It's verifies and sends outgoing mail

  • Works with POP/IMAP

    • POP (post office protocol) : simply downloads the inbox from mail server

    • IMAP (internet message access protocol) : this is to synchronize the current inbox

Task 6: Enumerating SMTP

Two internal commands for SMTP -

  • VRFY: confirm the name of valid users

  • EXPN: this reveals the actual address of user and list of email

Task 7: Exploiting SMTP

Hydra brute force gave the solution here: hydra -t 16 -l [USERNAME] -P [rockyou.txt location] -vV [Machine IP Addres] ssh

Task 8: Understanding MySQL

Task 9: Enumerating MySQL

MySQL is not going to initial attack point. After getting initial access, it will help.

Task 10: Exploiting MySQL

NFS pentest cheat sheet:

hackTricks
tryHackMe