EJPTV2 Cheat Sheet by - Yash Mehta
  • Information Gathering & Enumeration
    • Reconnaissance
      • Passive information gathering
      • Active information gathering
    • Enumeration
      • SMTP
      • MySQL Enum
        • Metasploit
        • Mysql tool,Brute force
        • Nmap
      • HTTP Enum
        • random tools
        • Nmap
        • Metasploit
      • SSH Enum
        • Nmap,Login,Hydra
        • Metasploit Modules
        • Metasploit Brute force
      • FTP Enum
        • nmap,hydra,Login
        • Metasploit
      • SMB Enum
        • smbmap
        • nmap
        • smbclient,rpcclient,enum4linux
        • metasploit,hydra
      • SMTP Enum
    • Vulnerability Scanning
      • WMAP(web application vulnerability scanner)
      • Nessus
      • Metasploit
  • Vulnerabilities in services
    • IIS WEBDAV
    • SMB/SAMBA
    • RDP
    • WinRm
    • APACHE
    • FTP
    • SSH
    • HTTP
    • SMTP
    • PHP
    • MySQL
    • Sun Glassfish
    • Workflow platform(Processmaker)
  • Exploitation
    • Windows Exploitation
      • IIS WebDav
        • msfvenom,metasploit
      • SMB
        • Brute force and Login
        • Eternal blue vulnerability
      • RDP
        • Bruteforce and Login
        • Bluekeep
      • WinRm
        • Brute force and Authentication
      • HTTP
        • HttpFileServer httpd 2.3(Rejetto)
        • BadBlue httpd 2.7
      • MySQL
      • Workflow platform(Processmaker)
      • Sun GlassFish
      • CVE-2021-44228 - Apache Log4j
      • Apache Tomcat
    • Linux Exploitation
      • Apache httpd 2.4.7-XODA Vulnerability
      • Sun Glassfish
      • Apache-Shellshock(Bash)
        • Metasploit Exploitation
      • FTP
        • Brute Force
        • ProFTPD 1.3.3c
        • vsftpd 2.3.4 - Backdoor Command Execution
      • SSH
        • Brute Force
        • libssh Authentication Bypass Scanner
      • SAMBA
        • Brute Force
        • Samba smbd 3.X - 4.X (Samba 3.5.0 -RCE)
      • SMTP
        • Brute Force
        • Haraka < 2.8.9 - Remote Command Execution
      • PHP
        • PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection
      • CVE-2021-44228 - Apache Log4j
    • Payloads
      • Encoding Payloads
      • Injecting Payloads into PEs
  • Post Exploitation
    • Privilege Escalation
      • Windows Privilege Escalation
        • Win Kernel Privesc
        • UAC Bypass Akagai64.exe
        • UAC Bypass:Memory Injection
        • PrivescCheck script
        • Access Token
        • Credentials Dumping
      • Linux Privilege Escalation
        • Cron Jobs
        • SUID
        • chkrootkit 0.49
        • Misconfigured Permissions Files
        • Misconfigured SUDO Privileges
        • Credentials Dumping
    • Hash Dumping
      • Windows hash dumping
        • MimiKatz,Kiwi
        • Pass the hash
      • Linux Hash Dumping
      • Crack the Hash
        • Windows Hash cracking
        • Linux Hash Cracking
        • Metasploit
    • Pivoting
    • Transferring Files
    • Meterpreter
      • Commands
      • Shell to Meterpreter
    • Persistence
      • Windows Persistence
        • persistence_service msf module
        • Enabling RDP(msf,admin password change)
        • Enabling RDP & New user
      • Linux Persistence
        • Adding backdoor user
        • SSHkey persistence module
        • Persistence via SSH Keys
        • Cron Jobs
    • Clearing Tracks
      • Windows clearing tracks
      • Linux clearing tracks
    • Local Enumeration
      • Windows Local Enumeration
      • Linux Local Enumeration
  • Web App Pentesting
Powered by GitBook
On this page
  • Windows Vulnerabilities
  • Windows Exploitation
  1. Exploitation

Windows Exploitation

PreviousExploitationNextIIS WebDav

Last updated 1 year ago

Windows Vulnerabilities

is a prime target for attackers given the threat surface and its popularity.

Most of the Windows vulnerabilities exploits are publicly available, making them simple to use.

  • Threat surface is fragmented, depending on the Win O.S. version.

  • The older the O.S. version, the more vulnerable to attacks.

  • All of Windows operating systems share a similarity according to the development model.

    • C programming language - leads to buffer overflows, arbitrary code execution, etc

    • No default security practices applied - must be sistematically handled by the company

    • Patching by Microsoft is not immediate, or versions are out of support/patching

  • To name a few, Windows XP, 7, Server 2008 and Server 2012, are still used by many companies and are largerly vulnerable, leaving the systems open to new attack vectors.

    • Cross platform vulnerabilities, e.g. SQL injections, cross-site scripting (on IIS web servers)

  • Physical attacks, e.g. malicious USB drives, theft, etc

Windows Exploitation

Windows has various standard native services and protocols configured or not on a host. When active, they provide an attacker with an access vector.

Protocol/Service
Ports
Purpose

TCP 80/443

Microsoft Web server for Windows, hosting web applications

TCP 80/443

HTTP extension that allows clients to copy, move, delete and update files on a web server. Used to enable a web server to act as a file server

TCP 445 / on top of NetBios 137-139

Network file and peripherals sharing protocol, betweend computers on a local network (LAN)

TCP 3389

GUI remote access protocol used to remotely authenticate and interact with Windows (Disabled by default)

TCP 5986/443

Used to facilitate remote access with Windows systems, execute remote commands

(Internet Information Services)

(Web Distributed Authoring & Versioning)

/CIFS (Server Message Block)

(Remote Desktop Protocol)

(Windows Remote Management Protocol)

Windows O.S.
Microsoft IIS
WebDAV
SMB
RDP
WinRM