NoSQL Network Recon - Exercise No. 1

In Redis Server, the command to retrieve key-value differs by data type.


Here are the commands to retrieve the key value:

if the value is of type string,
GET <key>

if the value is of type hash,
HGETALL <key>

if  the value is of type lists,
lrange <key> <start> <end>

if the value is of type sets,
smembers <key>

if the value is of type sorted sets,
ZRANGEBYSCORE <key> <min> <max>


The command to check the type of value a key mapping to:
type <key>

Source:
https://www.attackdefense.com/
https://stackoverflow.com/questions/37953019/wrongtype-operation-against-a-key-holding-the-wrong-kind-of-value-php

MySQL Network Recon - Exercise No. 2

The command used to connect to a remote MySQL database.

MySQL [(none)]> show databases;

MySQL [data]> show tables;

root@% = allows connection from user 'root' from any host, local or TCP (internet).
root@localhost = only allows connection from 'root' on the machine running the MySQL server.

MySQL [information_schema]> select * from user_privileges where GRANTEE like '%\%%' ;

Sources : https://www.attackdefense.com/

MEMCACHED Network Recon - Exercise No. 1

The number of key-value pairs stored on the Memcached server.

• memcstat --servers=<ip address> | grep curr_items

The value stored in the key “password” on the Memcached server.

• memccat --servers=<ip address> password

Using memcached-tool,

• /usr/share/memcached/scripts/memcached-tool <ip address:port number> dump

Using msfconsole - memcached_extractor,

Segmented LRU,

Using Least Recently Used (LRU) crawler to output every valid item,

• lru_crawler metadump all

Sources :

https://www.attackdefense.com/

https://github.com/memcached/memcached/blob/master/doc/protocol.txt

https://memcached.org/blog/modern-lru/

OSQUERY - Exercise No. 1

“consider JOINing against the users table”
osquery> select * from shell_history WHERE shell_history.uid IN (SELECT uid from users);

Who has stored the SSH private keys on the machine?
osquery> select * from shell_history WHERE shell_history.uid IN (SELECT uid from users) and shell_history.command like '%rsa%';

The path of the ftp service daemon running.
osquery> select path from  processes where name='vsftpd';

The complete path of a specific binary run as root.
osquery> select * from shell_history WHERE shell_history.uid IN (SELECT uid from users) and shell_history.command like '%sudo%';

Sources:
https://www.attackdefense.com
https://www.first.org/resources/papers/conf2018/Wilson-Doug_FIRST_20180629.pdf

OSQUERY - Networking Tables

How many network interfaces are present on the machine?
osquery> select * from interface_addresses;

How many DNS servers are configured on the machine?
osquery> select * from dns_resolvers;

208.67.222.222 belongs to OpenDNS.

Which interface is acting as the default gateway for the machine?
osquery> select * from routes;

How many entries are there in the ARP cache?
osquery> select * from arp_cache;

What is the given hostname of the machine?
osquery> select * from etc_hosts;

Source:https://www.attackdefense.com/challengedetails?cid=1044