whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added information

This commit is contained in:
whackx 2023-08-13 22:57:52 +02:00
parent 9cc5934de4
commit 1bd88497c1
2 changed files with 67 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
Enumeration/NFS.md
View File

@ -1,12 +1,43 @@
# NFS Enumeration # NFS Enumeration
## Find Mounts The Network File System (NFS) is a distributed file system protocol that allows
* `rpcinfo -p $TARGET_IP` clients in a network to access and interact with files and directories on
* `showmount -e $TARGET_IP` remote servers as if they were local. Developed by Sun Microsystems in the
1980s, NFS is designed to enable efficient sharing and management of files
across different operating systems and platforms.
## Mount NFS operates based on a client-server model, where the client is the system
that requests access to files or directories, and the server is the system that
holds and manages these resources. The NFS protocol defines a set of operations
that clients can use to perform file-related tasks, such as reading, writing,
creating, deleting, and listing files and directories.
## Find NFS Shares on the Network
NFS provides a level of transparency to the user and applications. Remote files
and directories are accessed just like local ones, with no need for the user to
be aware of the underlying network communication. You just have to find the shares.
You can look for NFS mounts on a network using the following command
```sh
rpcinfo -p $TARGET_IP
```
or another alternative is
```sh
showmount -e $TARGET_IP
```
## Mount NFS Shares
Clients can "mount" remote directories onto their local file system, making the
remote files and directories appear as if they are part of the client's own
file system hierarchy.
Mount a share via the following command
```sh ```sh
mount -t nfs $TARGET_IP /tmp/nfsfiles mount -t nfs $TARGET_IP /tmp/nfsfiles
``` ```

41
Enumeration/rsync.md
View File

@ -1,9 +1,13 @@
# rsync # rsync
* [netspi article]( https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/) > rsync is an open source utility that provides fast incremental file transfer.
* [hacktricks' rsync](https://book.hacktricks.xyz/pentesting/873-pentesting-rsync) > rsync is freely available under the GNU General Public License and is currently
> being maintained by Wayne Davison.
> -- [rsync.samba.org](rsync.samba.org)
## Enumerate ## Enumerate via rsync
Enumerate files and directories via rsync in the following ways
```sh ```sh
rsync <target-IP>:: rsync <target-IP>::
@ -11,32 +15,49 @@ rsync <target-IP>::files
rsync <target-IP>::files/foo/ rsync <target-IP>::files/foo/
``` ```
### via netcat ### Enumerate through rsync protocol via netcat
Another way is the following
* Another way is the following
```sh ```sh
nc -vn $TARGET_IP 873 nc -vn $TARGET_IP 873
``` ```
* Repeat the identical handshake, e.g.
Repeat the handshake identical to the rsync binary, e.g.
``` ```
@RSYNCD: 31.0 @RSYNCD: 31.0
``` ```
* List all directories
Afterwards you are able to list all directories
```sh ```sh
#list #list
``` ```
## Downloads ## Downloads via rsync
Download files and directories through rsynv via the following commands
```sh ```sh
rsync <user>@<target-IP>::/files/foo/bar.txt . rsync <user>@<target-IP>::/files/foo/bar.txt .
rsync -r <user>@<target-IP>::/files/foo . rsync -r <user>@<target-IP>::/files/foo .
``` ```
Use no credentials at all to connect anonymously.
## Uploads Login anonymously might work out in some cases, use no credentials at all to connect anonymously.
## Uploads via rsync
Upload files and directories through rsynv via the following commands
```sh ```sh
rsync authorized_keys <user>@<target-IP>::/files/foo/.ssh/ rsync authorized_keys <user>@<target-IP>::/files/foo/.ssh/
rsync -r documents <user>@<target-IP>::/files/foo/ rsync -r documents <user>@<target-IP>::/files/foo/
``` ```
## References
* [rsync webpage](rsync.samba.org)
* [netspi article]( https://www.netspi.com/blog/technical/network-penetration-testing/linux-hacking-case-studies-part-1-rsync/)
* [hacktricks' rsync](https://book.hacktricks.xyz/pentesting/873-pentesting-rsync)