Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Hacking > Hacking - Section 8 - Exploitation and Gaining Access. > Flashcards

Hacking - Section 8 - Exploitation and Gaining Access. Flashcards

1
Q

What is exploitation?

A

Is to use the vulnerabilities found to send a payload (a program) to the target.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does the payload allows you to do?

A

Write commands directly into the target machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What happens if the target doesn’t have any vulnerabilities?

A

You need to make them open a payload by themselves, by using emails, files, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a vulnerability?

A

Can be when a code of a software was not well written, which can be exploited by a the use of a bug in order to make it function differently (payload).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a CVT and a zero day vulnerability?

A

CVT + a year / when it first occurred is a bug exploited vulnerability.
zero day is a vulnerab that has not been patched yet (not discovered).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a shell?

Explain its two types:

A

shell = payload
reverse shell - target machine trying to connect back to the kali linux, exploit the target and drop a shell, which will tell the target machine to connect to our port.
bind shell - target machine opens their port for us to connect, but almost never work because firewalls can forbid target machines to open ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How to open the metasploitable framkework list?

A

cd /usr/share/metasploitable-framework/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How to open a metasploitable framkework file to see its code?

A

nano + name of it.

in the directory that they are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How to open the msfconsole?

A

msfconsole

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How to show any section inside the msfconsole?

A

show + section you want

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How to show a section inside of msfconsole?

A

type: show + name of the section

ex - show payloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How to use a module?

A

use + section name + name of it

ex - use exploit/ + name you’ve copied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

After using a module, how can you know more about it?

A

show info

show options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Inside the ‘show options’ command, if you want to change any info you can type:

A

set + name of option + new info

ex - set LHOST 192.168.7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Inside the ‘module’, to show the payloads that will work for that command you can type:

And how to set a new payload?

A

show payloads

copy the one you desire (show payloads) and type:
set payload + its name
show options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How to show the available targets inside the module?

and how to set one?

A

show targets

set target + number (then use exploit)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can you use a version explored in the searchsploit on the msfconsole?

A

If you find a path result with metasploit in it, you can use:
search + name of the version (on the msfconsole)

18
Q

How to exit the shell?

A

exit

19
Q

What is the ‘netcat’ tool and how to use it?

A

A tool that allows us to to establish a connection with other machines using TCP/UDP.
nc -h
nc + IP + Port Nº

20
Q

What are some rare exploits that barely happen but are guaranteed to exploy?

A

Bindshell and Tellnet.

21
Q

How to exploit a telnet?

A

telnet + IP

22
Q

How to run the commands on the msfconsole?

A

run

23
Q

How to search for a version of a exploit?

A

searchsploit + its name
msfconsole
use + the name you saw +/port that u desire
use + same thing as above + /the version u choose from msfconsole
run
ex - use auxiliary/scanner/smb/
use auxiliary/scanner/smb/ + /version u desire
set RGHOST
run

24
Q

What is a brute force attack?

A

Is to send information (usernames and passwords) to the target to check if any of those are correct.

25
Q

Why is the brute force attack used?

A

To check if the target has default credentials or weak passwords (or both).

26
Q

How to access ssh modules (msfconsole)

A

search ssh

27
Q

How to set a password/username file to use in a brutal force attack?

A

nano PASSWORDS.txt (write passwords inside of it)
nano USERNAMES.txt (write usernames inside of it)
(go to desktop and type pwd)
set PASS_FILE pwd + /PASSWORDS.txt
set USER_FILE pwd + /USERNAMES.txt
set VERBOSE TRUE
set RHOSTS + IP

28
Q

What does the command ‘session’ do?

and how to open (start) connection with one?

A

Will show you all the shells that you are connected.

sessions + -i + Nº of it

29
Q

What does the -p- command on the nmap mean?

A

Means it’ll access all ports of the machine.

ex - sudo nmap -sV + IP + -p-

30
Q

How to connect to a VNC port?

A

vncviewer + IP

password = password

31
Q

What is the port 445 on windows?

A

A port that is always open, mainly on companies, because it is used to share files and data between the companies computers.

32
Q

What does the ‘getuid’ command stands for on windows?

A

It will tell u the ‘account’ that u are positioned.

NT AUTHORITY\SYSTEM is the highest one.

33
Q

How to show all the files including the hidden directories on a ls command?

A

ls -la

34
Q

How to execute the eternalblue_doublepulsar on msfconsole?

A

use windows/sub/eternalblue_doublepulsar
processinject - lsass.exe (for 64x machines)
RHOSTS - target IP
targetarchitecture - 64x (for 64x machines)
payload - (windows/x64/meterpreter/reverse_tcp)

35
Q

What is a RCE?

A

Remote code execution

meaning that the attacker does not have to authenticate in order to write codes on the machine.

36
Q

What is the port that is frequently opened into big companies but not on home devices?

A

port 3389

37
Q

What can you do to check if a target is vulnerable?

A

You can use an auxiliary module of the specific vulnerability that you intend to deploy.

38
Q

How to use the bluekeep exploit?

A

search bluekeep
use it
set RHOSTS (need port 3389 opened)

39
Q

What happens if you invade a router?

A

You’ll get access to the whole network.

40
Q

Why are routers the easiest devices to hack?

A

Because most of them (home routers) have default login passwords.

41
Q

How to open the ‘routersploit’ command?

A

rsf.py

42
Q

What does the /autopwn scan do?

A

It scans the router for several vulnerabilities and see if any of them are exploitable.

Hacking (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions