COMMON SERVICES CHECKLIST

PRIMARY CATEGORY → CHECKLISTS

Important

For any AD-related protocol not found here, refer to AD Offensive Checklist

FTP

FTP

Non-Credentialed Enumeration

• FTP Service Software Version → Banner Grabbing or NMAP Comprehensive Scan

• Anonymous Access

If so, then check [[#FTP#Credentialed Enumeration|FTP Credential Enumeration]]

• Known CVEs (Searchsploit (ExploitDB), Google…) for the given FTP service version

• FTP Bruteforce and Password Spraying

Credentialed Enumeration

• Web Application + FTP Write Permissions → Try to upload a Web Shell to gain RCE

• Windows System + FTP Write Permissions → Malicious shortcut file Upload + NetNTLMv2 Hash Capture + Cracking

---

HTTP

HTTP

See Web Offensive Checklist

---

MYSQL

MYSQL

Outside

i.e. SQL Injection

See Web Offensive Checklist

Inside

i.e. After compromising a web application and establish a remote connection via Rev. Shell ( e.g. mysql cli tool )

• Look for sensitive information within all DBs

e.g. A table named Users or Employees with Crackable Hashes

---

DNS

DNS

Non-Credentialed Enumeration

• DNS Service Software Version → Banner Grabbing or NMAP Comprehensive Scan

• DNS Records Enumeration → ANY Query

• DNS Zone Transfer

• Known CVEs (Searchsploit (ExploitDB), Google…) for the given DNS service version

• Subdomain Enumeration

Credentialed Enumeration

• Windows AD → DNS Records Dump using adidnsdump

---

SMB

Non-Credentialed Enumeration

SMB

See AD Offensive Checklist

• Vulnerable SMB Version due to unpatched and outdated Windows Version

e.g. EternalBlue

• Check SMB Null and Guest Authentication

If available, then check [[#SMB#Credentialed Enumeration|SMB Credentialed Enumeration]]

• SMB Bruteforce and Password Spraying

Credentialed Enumeration

• List any available SMB Share

• READ Permissions → Look for any sensitive data through automated enumeration Snaffler or manual enumeration ( Local Mount )

• Windows System + SMB Write Permissions → Malicious shortcut file Upload + NetNTLMv2 Hash Capture + Cracking

---

RPC

RPC

See AD Offensive Checklist

Non-Credentialed Enumeration

• Check RPC Null and Guest Authentication

If available, then check [[#RPC#Credentialed Enumeration|RPC Credentialed Enumeration]]

Credentialed Enumeration

• RPC Endpoints Enumeration

• Cycling

---

LDAP

LDAP

See AD Offensive Checklist

Non-Credentialed Enumeration

• Check LDAP Null Authentication

If available, then check [[#LDAP#Credentialed Enumeration|LDAP Credentialed Enumeration]]

Credentialed Enumeration

• Look for sensitive information within LDAP Objects

Plain passwords, keys, principals susceptible to ASREPRoast or Kerberoast and so on

---

MSSQL

MSSQL

See AD Offensive Checklist

• Look for sensitive information within MSSQL Instance

e.g. Databases, Tables, Users, Procedures and so on

• Check which roles are assigned to the current DB User

• Sysadmin or ServerAdmin Role → Get Command Execution

If none of those roles are assigned, then try enabling xp_cmdshell anyways, just in case

• Command Execution → Reverse Shell + seImpersonate Abuse

• Read System Files → { HTTP Server → { ISS web.config | Tomcat users’ file } }

i.e. Read Files from a MSSQL Instance ⤴️

• Sysadmin or ServerAdmin Role → Enable Ole Automation Procedures → File Creation → { HTTP Server → Try upload a Web Shell | Busy Writable Shares/Interesting Directories → Drop a Shortcut File + { NTLM Relay | NTLM Capture } }

i.e. Write Files from a MSSQL Instance ⤴

• Current DB User with EXECUTE right over xp_dirtree → MitM and Credential Cracking

• MSSQL User Impersonation

• Communication with othe DBS via MSSQL Linked Servers → Command Execution on MSSQL Linked Servers

---

RDP

RDP

• RDP Service Software Version → Known CVEs (Searchsploit (ExploitDB), Google…)

• RDP Bruteforce and Password Spraying

---

WINRM

WINRM

• WinRM Dictionary Attack and Password Spraying

• PFX Certificate ( .x509 Format and a domain principal as UPN ) → Public and Private Key Extraction → [[5985, 5986 - WINRM#MS-PSRP#Evil-WinRM|WinRM Certificate Authentication]]

---

SMTP

SMTP

• SMTP Service Software Version → Banner Grabbing or NMAP Comprehensive Scan

• List SMTP Available Commands

• Manual User Enumeration or Automated User Enumeration

• Known CVEs (Searchsploit (ExploitDB), Google…) for the given SMTP service version

• SMTP Bruteforce and Password Spraying

• Check Open Relay

---

IMAP

IMAP

Non-Credentialed Enumeration

• IMAP Service Software Version → Banner Grabbing or NMAP Comprehensive Scan

• Known CVEs (Searchsploit (ExploitDB), Google…) for the given IMAP service version

• IMAP Bruteforce and Password Spraying

Credentialed Enumeration

• Look for sensitive information ( Plain passwords, tokens… ) in any existing email message within the given INBOX

See Service Interaction

---

POP3

POP3

Non-Credentialed Enumeration

• POP3 Service Software Version → Banner Grabbing or NMAP Comprehensive Scan

• Manual User Enumeration

• Known CVEs (Searchsploit (ExploitDB), Google…) for the given POP3 service version

• POP3 Bruteforcing and Password Spraying

Credentialed Enumeration

• Look for sensitive information ( Plain passwords, tokens… ) in any existing email message within the given INBOX

See here

---

NFS

NFS

• Check if any NFS Shared Resource is available

• If so, mount it

• NFS NO_ROOT_SQUASH

---

SNMP

SNMP

Non-Credentialed Enumeration

• SNMP Version Enumeration

• SNMPv1 and SNMPv2c → Community String Bruteforce

If we get a hit and obtain the given community string, then check [[#SNMP#Credentialed Enumeration|SNMP Credentialed Enumeration]]

Credentialed Enumeration

• Retrieve all OID values and filter by Relevant Information

---

REDIS

REDIS

It does not require authentication by default

• Look for sensitive information within existing Keyspaces

• Require Authentication set → Look for Plain Credentials in REDIS Configuration

• REDIS → SSH Pub Key Authentication

---

RSYNC

RSYNC

Non-Credentialed Enumeration

• List all available RSYNC Modules

• Check [[873 - RSYNC#Enumeration#Rsync|RSYNC Anonymous Authentication]] by listing information about an available module

If available, then check [[#RSYNC#Credentialed Enumeration|RSYNC Credentialed Enumeration]]

Credentialed Enumeration

• [[873 - RSYNC#Enumeration#Rsync|List all information related to a specific RSYNC Module]]

• Data Exfiltration → Download all available modules’ information

• Check RSYNC sensitive files’ content

e.g. rsyncd.conf, rsyncd.secrets…

---

Oracle TNS

Oracle TNS

---

IPMI

623 - IPMI