Step 3 - Enumeration continued

I didnt know you had to manually do this but Nikto wouldnt scan the users directories on its own, I had to manually specify this using the -r switch

Nothing too interesting right there, lets move onto the next user

Look at that! Pirrip has the .ssh directory available. Lets browse to it and see what's there.

Wow, we can download the users private and public keys. Remember our Nmap results from earlier? The server is running OpenSSH which uses RSA for cryptography. RSA uses 2 keys a public and private key. If an attacker gets a hold of your private key it is very very bad. They can assume your identity and login without needing to supply your password. Lets grab those RSA keys.

I downloaded both keys and put them in my home /.ssh directory We need to chmod the files so they have the correct permissions

Now lets try to login using pirrips keys

Step 3 - Enumeration

Now that we know there are some web servers running and other services lets see what we can find out about them.

We can use wget to download that page to our box so we can extract some of those email addresses.

Lets cut that file so we only show user id's

Great! Now we have user ID's we can test with. I also ran Nikto against this host to see what we could find out.

Nikto shows that this server might be susceptible to directory indexing. I used Dirbuster to see what I could find out.

Dirbuster didn't return anything interesting when I scanned the .100 target. But look what it showed on the .101 box

It looks like our UserID list we made earlier wasn't entirely accurate. I edited it down to only inlcude the names found in the dirbuster report - pirrip, havisham, magwitch

I tried browsing the ~pirrip directory on the web server but there were no files found

Step 3 - Enumeration continued

We have already identified the host operating system, services and their version. What else can we find out about our target? We don't have any user names yet, how can we get those?

Lets see what web site is running on port 80

Wow, that page is ugly and hard to read. How else can we view it? Lets use wget to download the page locally then take a look at it

Lets take a look at that index2.php page

Hmm it looks like there are several email addresses in there. Lets try to parse them out so we can see it clearer

Great, we can see that we have emails for the system admin and other users. Lets see if we can further refine that list to just display the emails with no names or titles.

Thats looking good. Lets output the results of our cut to a new txt file for the email id's

Great, now lets cut this file and eliminate everything after the @ sign so we can get some user names

Next I opened this file with Kate and added the user names so the initial is first (example banterb I added bbanter)

Now we have some user names we can use to attempt a brute force attack on our target.

Step 3 - Enumeration

The next step in our pentest process is enumeration. During this phase we try to determine the host OS, services running and what version they are.

We already did a little bit of enumeration in my previous post using the Nmap -sV and -O options

Here are those results again

Another great tool we can use is Netcat

Lets use netcat to connect to the apache web server running on port 80

To do this we type nc -vv TARGET PORT

After we have a connection lets pull down the HTTP header to verify the apache server info

Once connected type HEAD / HTTP/1.0 then hit the return key 2x

The results confirm that this server is running Apache version 2.055

Netcat has a ton of other useful features that we will go into later