Cheatsheet_Solaris.txt

[+] Solaris vulnerabilities:

Solaris 7:
sadmind_exec            SADMIND -   weakness in default security settings  - allows root - rootdown.pl
**ttyprompt               TELNET -    buffer overflow in solaris login - manual through telnet client
sendmail_exec           LPD -       line printer daemon buffer overflow  - allows root
heap_noir               DTSPCD -    CDE common desktop environment heap overflow  TCP port 6112, runs with root
ypupdated_exec          YPUPDATED - weakness in handling of the command shell - allows root
kcms_readfile         kcms / ttdbserverd remote file read (only in msf2)

Solaris 8:              
sadmind_exec            SADMIND -   weakness in default security settings  - allows root - rootdown.pl
**ttyprompt               TELNET -    buffer overflow in solaris login - manual through telnet client
sendmail_exec           LPD -       line printer daemon buffer overflow  - allows root
heap_noir               DTSPCD -    CDE common desktop environment heap overflow  TCP port 6112, runs with root
ypupdated_exec          YPUPDATED - weakness in handling of the command shell - allows root.
no exploit - sadmind_adm_build_path  SADMIND  -  stack buffer overflow in adm_build_path() function.
kcms_readfile         kcms / ttdbserverd remote file read (only in msf2)

solaris 9:
sadmind_exec            SADMIND -   weakness in default security settings  - allows root - rootdown.pl
ypupdated_exec          YPUPDATED - weakness in handling of the command shell - allows root.
sadmind_adm_build_path  SADMIND  -  stack buffer overflow in adm_build_path() function.
kcms_readfile         kcms / ttdbserverd remote file read (only in msf2)

Solaris 10:
fuser                   TELNET - authentication bypass through -f command - can be manually exploited
ypupdated_exec          YPUPDATED - weakness in handling of the command shell - allows root.

Solaris 11:
fuser                   TELNET - authentication bypass through -f command - can be manually exploited 

[+] Adding solaris user:

useradd -u 0 -o pentestuser 
passwd -d pentestuser

[+] In addition, familiarise yourself with rpcinfo, nfsshell, showmount, 'mount -t nfs'.