Skip to main content

FOR Loops

>> FOR /L %i in (1,1,255) do @ping -n 1 10.10.10.%i | find "Reply"

--> is a ping sweep
>> FOR /f %i in (password.lst) do @echo %i & @net use file://target_ip_addr/ %i /u:[username] 2>nul &&  pause

--> password guess; instead of pause, we could append our results to a file with :

&& echo Username: %i >> success.txt

>> FOR /L %i in (1,1,255) do echo %i & ping -n 5 127.0.0.1 & cls -->
[command1] & [command2] --> run multiple commands
[command1] && [command2] --> run multiple commands only if the prior command is succeeded without error

u could use the echo cmd to build a script line by line by running the following cmd several times, varying the line each time you run it

c:\ echo [line] << file.bat

The FOR loop variable must be changed from %[var] to %%[var] to make in a batch file. Place 2 %age sign infront of each vaiable name

=========================

windows>for /L %i in (1,1,255) do @echo 192.168.58.%i: & @nslookup  192.168.58.%i 192.168.58.60 2>nul | find "Name"

this cmd starts a FOR /L couting loop at 1, counts by 1, and proceed through 255, using %i as the variable. At ach iteration through the loop, it echoes the ip address that it is trying by a colon, w/o displaying the echo cmd (@echo 192.168.58.%i:). then it performs a reverse lookup of each ip address against server 192.168.58.60 using lookup, again w/o displaying the nslookup cmd (@nslookup 192.168.58.%i 192.168.58.160). if nslookup cant find a name it display a mesg of ***[server] cant find..... we want to get rid of that standard error so we redirect it to nul. we search the outupt of the cmd with the find command, looking for the string  "Name" b/c sucssessfully searched names will include this string.

windows>for /L %i in (1,1,255) do @nslookup  192.168.58.%i 192.168.58.60 2>nul | find "Name" && echo 192.168.58.%i

will display to ip address when we succsssfully resolve a name, we could run.

========================================

windows>for /f %i in (ports.txt) do @nc.exe -n -vv -w3 192.168.54.139 %i

build a port scanner using ports.txt which simply contains the port numbers (one port number at a line). you could use following to develop the list.

windows> echo 21 >> ports.txt
windows> echo 22 >> ports.txt
windows> echo 23 >> ports.txt

Comments

Popular posts from this blog

28 VM SecOS-1

Walkthru: Notes: A. https://c0d3g33k.blogspot.com/2017/01/secos.html [capture admin cookie using 127.0.0.1 in a code  test.html  with cross site scripting vulnerability,  CSRF attack, use exploit 37088 for priv escalation ] B. http://oldsmokingjoe.blogspot.com/2016/01/walkthrough-secos-1.html [ Hacking Node.js and MangoDB   ] c. http://oldsmokingjoe.blogspot.com/2016/01/walkthrough-secos-1.html [use wget to post data from CLI. Add other cmds to ping cmd using curl and wget] D. https://chousensha.github.io/blog/2015/02/04/pentest-lab-secos/ [SSH tunnel so we can access the ping site from Kali and dont have to pass via CLI] Notes: # Nmap 7.70 scan initiated Thu Jul 19 09:26:05 2018 as: nmap -sV -O -oN ../reports/192.168.117.6/192.168.117.6.nmap 192.168.117.6 Nmap scan report for 192.168.117.6 Host is up (0.00042s latency). Not shown: 998 closed ports PORT     STATE SERVICE VERSION 22/tcp   open  ssh  ...

VM 9 : PHP Include And Post Exploitation

Walkthrough 1.        https://medium.com/@Kan1shka9/pentesterlab-php-include-and-post-exploitation-walkthrough-8a85bcfa7b1d 2.        Ine [] 3.        http://megwhite.com.au/pentester-lab-bootcamp-walkthrough-php-include-post-exploitation/ 4.        http://fallensnow-jack.blogspot.com/2014/07/pentester-lab-php-lfi-post-exploitation.html Notes: root@kali:~# nmap 10.0.0.12 Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-30 12:23 EDT Nmap scan report for 10.0.0.12 Host is up (0.00035s latency). Not shown: 999 filtered ports PORT    STATE SERVICE 80/tcp open   http MAC Address: 08:00:27:1F:12:24 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.31 seconds root@kali:~# Enumerating port 80 Run dirb root@kali:~# dirb http://10.0.0.12/ ----------------- DIRB v2.22 By The Dark Raver...

VM 15: Kioptix 2014

Walkthru Notes 2nd approach  using nc via web using php reverse shell 3rd approach   w/o metasploit =================== walkthru: 1.  Updating OpenFuck Exploit(764) but it didnt work here @ https://paulsec.github.io/blog/2014/04/14/updating-openfuck-exploit/ 2. ============== Notes: 80/tcp open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) MAC Address: 08:00:27:82:89:F9 (Oracle VirtualBox virtual NIC) Running: FreeBSD 9.X|10.X OS CPE: cpe:/o:freebsd:freebsd:9 cpe:/o:freebsd:freebsd:10 OS details: FreeBSD 9.0-RELEASE - 10.3-RELEASE PORT     STATE SERVICE VERSION 8080/tcp open  http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) |_http-server-header: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 |_http-title: 403 Forbidden MAC Address: 08:00:27:82:89:F9 (Oracle VirtualBox...